X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/183389fae10672e8d5ffb1f14f23a179798f483a..ce437b2e0dc12c342b1ac67d5435a893b800fd05:/doc/doc-txt/ChangeLog diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 39136ea7e..874d725f3 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -2,6 +2,172 @@ This document describes *changes* to previous versions, that might affect Exim's operation, with an unchanged configuration file. For new options, and new features, see the NewStuff file next to this ChangeLog. +Exim version 4.97 +----------------- + +JH/01 The hosts_connection_nolog main option now also controls "no MAIL in + SMTP connection" log lines. + +JH/02 Option default value updates: + - queue_fast_ramp (main) true (was false) + - remote_max_parallel (main) 4 (was 2) + +JH/03 Cache static regex pattern compilations, for use by ACLs. + +JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address. + Make the rewrite never match and keep the logging. Trust the + admin to be using verify=header-syntax (to actually reject the message). + + +Exim version 4.96 +----------------- + +JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from + after reception to before a subsequent reception. This should + mean slightly faster delivery, and also confirmation of reception + to senders. + +JH/02 Move from using the pcre library to pcre2. The former is no longer + being developed or supported (by the original developer). + +JH/03 Constification work in the filters module required a major version + bump for the local-scan API. Specifically, the "headers_charset" + global which is visible via the API is now const and may therefore + not be modified by local-scan code. + +JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for + sendfile() didi not account for the way the ClamAV driver code called it. + +JH/05 Bug 2819: speed up command-line messages being read in. Previously a + time check was being done for every character; replace that with one + per buffer. + +JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string + sent was prefixed with a length byte. + +JH/07 Change the SMTP feature name for pipelining connect to be compliant with + RFC 5321. Previously Dovecot (at least) would log errors during + submission. + +JH/08 Remove stripping of the binaries from the FreeBSD build. This was added + in 4.61 without a reason logged. Binaries will be bigger, which might + matter on diskspace-constrained systems, but debug is easier. + +JH/09 Fix macro-definition during "-be" expansion testing. The move to + write-protected store for macros had not accounted for these runtime + additions; fix by removing this protection for "-be" mode. + +JH/10 Convert all uses of select() to poll(). FreeBSD 12.2 was found to be + handing out large-numbered file descriptors, violating the usual Unix + assumption (and required by Posix) that the lowest possible number will be + allocated by the kernel when a new one is needed. In the daemon, and any + child procesees, values higher than 1024 (being bigger than FD_SETSIZE) + are not useable for FD_SET() [and hence select()] and overwrite the stack. + Assorted crashes happen. + +JH/11 Fix use of $sender_host_name in daemon process. When used in certain + main-section options or in a connect ACL, the value from the first ever + connection was never replaced for subsequent connections. Found by + Wakko Warner. + +JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux, + though only once PCRE2 was introduced: the memory accounting used under + debug offset allocations by an int, giving a hard trap in early startup. + Change to using a size_t. Debug and fix by John Paul Adrian Glaubitz. + +JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value + with underbars is given. The write-protection of configuration introduced + in 4.95 trapped when normalisation was applied to an option not needing + expansion action. + +JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters. + +JH/15 Fix a resource leak in *BSD. An off-by-one error resulted in the daemon + failing to close the certificates directory, every hour or any time it + was touched. + +JH/16 Debugging initiated by an ACL control now continues through into routing + and transport processes. Previously debugging stopped any time Exim + re-execs, or for processing a queued message. + +JH/17 The "expand" debug selector now gives more detail, specifically on the + result of expansion operators and items. + +JH/18 Bug 2751: Fix include_directory in redirect routers. Previously a + bad comparison between the option value and the name of the file to + be included was done, and a mismatch was wrongly identified. + 4.88 to 4.95 are affected. + +JH/19 Support for Berkeley DB versions 1 and 2 is withdrawn. + +JH/20 When built with NDBM for hints DB's check for nonexistence of a name + supplied as the db file-pair basename. Previously, if a directory + path was given, for example via the autoreply "once" option, the DB + file.pag and file.dir files would be created in that directory's + parent. + +JH/21 Remove the "allow_insecure_tainted_data" main config option and the + "taint" log_selector. These were previously deprecated. + +JH/22 Fix static address-list lookups to properly return the matched item. + Previously only the domain part was returned. + +JH/23 Bug 2864: FreeBSD: fix transport hang after 4xx/5xx response. Previously + the call into OpenSSL to send a TLS Close was being repeated; this + resulted in the library waiting for the peer's Close. If that was never + sent we waited forever. Fix by tracking send calls. + +JH/24 The ${run} expansion item now expands its command string elements after + splitting. Previously it was before; the new ordering makes handling + zero-length arguments simpler. The old ordering can be obtained by + appending a new option "preexpand", after a comma, to the "run". + +JH/25 Taint-check exec arguments for transport-initiated external processes. + Previously, tainted values could be used. This affects "pipe", "lmtp" and + "queryprogram" transport, transport-filter, and ETRN commands. + The ${run} expansion is also affected: in "preexpand" mode no part of + the command line may be tainted, in default mode the executable name + may not be tainted. + +JH/26 Fix CHUNKING on a continued-transport. Previously the usabliility of + the the facility was not passed across execs, and only the first message + passed over a connection could use BDAT; any further ones using DATA. + +JH/27 Support the PIPECONNECT facility in the smtp transport when the helo_data + uses $sending_ip_address and an interface is specified. + Previously any use of the local address in the EHLO name disabled + PIPECONNECT, the common case being to use the rDNS of it. + +JH/28 OpenSSL: fix transport-required OCSP stapling verification under session + resumption. Previously verify failed because no certificate status is + passed on the wire for the restarted session. Fix by using the recorded + ocsp status of the stored session for the new connection. + +JH/29 TLS resumption: the key for session lookup in the client now includes + more info that a server could potentially use in configuring a TLS + session, avoiding oferring mismatching sessions to such a server. + Previously only the server IP was used. + +JH/30 Fix string_copyn() for limit greater than actual string length. + Previously the copied amount was the limit, which could result in a + overlapping memcpy for newly allocated destination soon after a + source string shorter than the limit. Found/investigated by KM. + +JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection + close; it may be needed for a subsequent connection. This caused a + SEGV on primary-MX defer. Found/investigated by Gedalya & Andreas. + +JH/32 Fix CHUNKING for a second message on a connection when the first was + rejected. Previously we did not reset the chunking-offered state, and + erroneously rejected the BDAT command. Investigation help from + Jesse Hathaway. + +JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning + an empty address. Previously the expansion returned an error. + +HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending + proxy. Previously these were misparsed, leading to paniclog entries. + Exim version 4.95 ----------------- @@ -38,7 +204,7 @@ JH/06 Bug 2594: Change the name used for certificate name checks in the smtp JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for smtp_accept_max_per_host allocated resources which were not released when the limit was exceeded. This eventually crashed the daemon. Fix - by adding a relase action in that path. + by adding a release action in that path. JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are expanded; previously using tainted values was rejected. Fix by using @@ -75,7 +241,7 @@ JH/15 Bug 2620: Fix "spam" ACL condition. Previously, tainted values for the JH/16 Bug 2615: Fix pause during message reception, on systems that have been suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time - spent suspended, ignoring the Posix definition. Previously we assumed + spent suspended, ignoring the POSIX definition. Previously we assumed it did and a constant offset from real time could be used as a correction. Change to using the same clock source for the start-of-message and the post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it @@ -83,12 +249,12 @@ JH/16 Bug 2615: Fix pause during message reception, on systems that have been JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the RFC says it is optional some validators care. The missing char was not - intended but triggered by a line-wrap alignement. Discovery and fix by + intended but triggered by a line-wrap alignment. Discovery and fix by Guillaume Outters, hacked on by JH. JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the name being quoted was tainted a trap would be taken. Fix by using - dynamicaly created buffers. The routine could have been called by a + dynamically created buffers. The routine could have been called by a rewrite with the "h" flag, by using the "-F" command-line option, or by using a "name=" option on a control=submission ACL modifier. @@ -146,10 +312,196 @@ JH/29 Bug 2675: add outgoing-interface I= element to deferred "==" log lines, JH/30 Bug 2677: fix matching of long addresses. Since 4.93 a limit of 256 was applied. This resulted, if any header-line rewrite rules were configured, - in a panic-log trigerrable by sending a message with a long address in - a header. Fix by increaing the arbitrary limit to larger than a single + in a panic-log triggerable by sending a message with a long address in + a header. Fix by increasing the arbitrary limit to larger than a single (dewrapped) 5322 header line maximum size. +JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option + is changed from X_PIPE_CONNECT to PIPE_CONNECT. This is in line with + RFC 6648 which deprecates X- options in protocols as a general practice. + Changeover between the implementations is handled by the mechanisms + already coded. + +JH/32 Bug 2599: fix delay of delivery to a local address where there is also + a remote which uses callout/hold. Previously the local was queued. + +JH/33 Fix a taint trap in the ${listextract } expansion when the source data + was tainted. + +JH/34 Fix the placement of a multiple-message delivery marker in the delivery + log line. The asterisk is now consistently appended to the remote IP + (and port, if given), and will also be provided on defer and fail log + lines. Previously it could be placed on the local IP if that was being + logged, and was only provided on delivery lines. + +JH/35 Bug 2343: Harden exim_tidydb against corrupt wait- files. + +JH/36 Bug 2687: Fix interpretation of multiple ^ chars in a plaintext + authenticator client_send option. Previously the next char, after a pair + was collapsed, was taken verbatim (so ^^^foo became ^^foo; ^^^^foo became + ^^\x00foo). Fixed to get ^\x00foo and ^^foo respectively to match the + documentation. There is still no way to get a leading ^ immediately + after a NUL (ie. for the password of a PLAIN method authenticator. + +JH/37 Enforce the expected size, for fixed-size records read from hints-DB + files. For bad sizes read, delete the record and whine to paniclog. + +JH/38 When logging an AUTH failure, as server, do not include sensitive + information. Previously, the credentials would be included if given + as part of the AUTH command line and an ACL denied authentication. + +JH/39 Bug 2691: fix $local_part_data. When the matching list element + referred to a file, bad data was returned. This likely also affected + $domain_part_data. + +JH/40 The gsasl authenticator now supports caching of the salted password + generated by the client-side implementation. This required the addition + of a new variable: $auth4. + +JH/41 Fix daemon SIGHUP on FreeBSD. Previously, a named socket for IPC was + left undeleted; the attempt to re-create it then failed - resulting in + the usual "SIGHUP tp have daemon reload configuration" to not work. + This affected any platform not supporting "abstract" Unix-domain + sockets (i.e. not Linux). + +JH/42 Bug 2693: Harden against a peer which reneges on a 452 "too many + recipients" response to RCPT in a later response, with a 250. The + previous coding assumed this would not happen, and under PIPELINING + would result in both lost and duplicate recipients for a message. + +JH/43 Bug 2694: Fix weighted distribution of work to multiple spamd servers. + Previously the weighting was incorrectly applied. Similar fix for socks + proxies. Found and fixed by Heiko Schlichting. + +JH/44 Bug 2701: Fix list-expansion of dns_ipv4_lookup. Previously, it did + not handle sub-lists included using the +namedlist syntax. While + investigating, the same found for dns_trust_aa, dns_again_means_nonexist, + dnssec_require_domains, dnssec_request_domains, srv_fail_domains, + mx_fail_domains. + +JH/45 Use a (new) separate store pool-pair for DKIM verify working data. + Previously the permanent pool was used, so the sore could not be freed. + This meant a connection with many messages would use continually-growing + memory. + +JH/46 Use an exponentially-increasing block size when malloc'ing store. Do it + per-pool so as not to waste too much space. Previously a constant size + was used which resulted in O(n^2) behaviour; now we get O(n log n) making + DOS attacks harder. The cost is wasted memory use in the larger blocks. + +JH/47 Use explicit alloc/free for DNS lookup workspace. This permits using the + same space repeatedly, and a smaller process footprint. + +JH/48 Use a less bogus-looking filename for a temporary used for DH-parameters + for GnuTLS. Previously the name started "%s" which, while not a bug, + looked as if if might be one. + +JH/49 Bug 2710: when using SOCKS for additional messages after the first (a + "continued connection") make the $proxy_* variables available. Previously + the information was not passed across the exec() call for subsequent + transport executions. This also mean that the log lines for the + messages can show the proxy information. + +JH/50 Bug 2672: QT elements in log lines, unless disabled, now exclude the + receive time. With modern systems the difference is significant. + The historical behaviour can be restored by disabling (a new) log_selector + "queue_time_exclusive". + +JH/51 Taint-check ACL line. Previously, only filenames (for out-of-line ACL + content) were specifically tested for. Now, also cover expansions + resulting in ACL names and inline ACL content. + +JH/52 Fix ${ip6norm:} operator. Previously, any trailing line text was dropped, + making it unusable in complex expressions. + +JH/53 Bug 2743: fix immediate-delivery via named queue. Previously this would + fail with a taint-check on the spoolfile name, and leave the message + queued. + +HS/01 Enforce absolute PID file path name. + +HS/02 Handle SIGINT as we handle SIGTERM: terminate the Exim process. + +PP/01 Add a too-many-bad-recipients guard to the default config's RCPT ACL. + +PP/02 Bug 2643: Correct TLS DH constants. + A missing NUL termination in our code-generation tool had led to some + incorrect Diffie-Hellman constants in the Exim source. + Reported by kylon94, code-gen tool fix by Simon Arlott. + +PP/03 Impose security length checks on various command-line options. + Fixes CVE-2020-SPRSS reported by Qualys. + +PP/04 Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX + better. Reported by Qualys. + +PP/05 Fix security issue CVE-2020-PFPSN and guard against cmdline invoker + providing a particularly obnoxious sender full name. + Reported by Qualys. + +PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase() + +PP/07 Refuse to allocate too little memory, block negative/zero allocations. + Security guard. + +PP/08 Change default for recipients_max from unlimited to 50,000. + +PP/09 Fix security issue with too many recipients on a message (to remove a + known security problem if someone does set recipients_max to unlimited, + or if local additions add to the recipient list). + Fixes CVE-2020-RCPTL reported by Qualys. + +PP/10 Fix security issue in SMTP verb option parsing + Fixes CVE-2020-EXOPT reported by Qualys. + +PP/11 Fix security issue in BDAT state confusion. + Ensure we reset known-good where we know we need to not be reading BDAT + data, as a general case fix, and move the places where we switch to BDAT + mode until after various protocol state checks. + Fixes CVE-2020-BDATA reported by Qualys. + +HS/03 Die on "/../" in msglog file names + +QS/01 Creation of (database) files in $spool_dir: only uid=0 or the uid of + the Exim runtime user are allowed to create files. + +QS/02 PID file creation/deletion: only possible if uid=0 or uid is the Exim + runtime user. + +QS/03 When reading the output from interpreted forward files we do not + pass the pipe between the parent and the interpreting process to + executed child processes (if any). + +QS/04 Always die if requested from internal logging, even is logging is + disabled. + +JH/54 DMARC: recent versions of the OpenDMARC library appear to have broken + the API; compilation noo longer completes with DMARC support included. + This affects 1.4.1-1 on Fedora 33 (1.3.2-3 is functional); and has + been reported on other platforms. + +JH/55 TLS: as server, reject connections with ALPN indicating non-smtp use. + +JH/56 Make the majority of info read from config files readonly, for defence-in- + depth against exploits. Suggestion by Qualys. + Not supported on Solaris 10. + +JH/57 Fix control=fakreject for a custom message containing tainted data. + Previously this resulted in a log complaint, due to a re-expansion present + since fakereject was originally introduced. + +JH/58 GnuTLS: Fix certextract expansion. If a second modifier after a tag + modifier was given, a loop resulted. + +JH/59 DKIM: Fix small-message verification under TLS with chunking. If a + pipelined SMTP command followed the BDAT LAST then it would be + incorrectly treated as part of the message body, causing a verification + fail. + +JH/60 Bug 2805: Fix logging of domain-literals in Message_ID: headers. They + require looser validation rules than those for 821-level addresses, + which only permit IP addresses. + Exim version 4.94 ----------------- @@ -574,6 +926,10 @@ JH/47 ARC: fix crash in signing, triggered when a configuration error failed to do ARC verification. The Authentication-Results: header line added by the configuration then had no ARC item. +JH/48 Bug 2784: fix shutdown=no in the ${readsocket) expansion item. Previously + an incorrect mode was used for reading the result, resulting in it being + ignored. + Exim version 4.92 -----------------