X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/6d5f5cafb4c507abe36434bf7695573284eb8761..1d717e1c110562fd6bf28478c79f180cafeba776:/src/src/readconf.c diff --git a/src/src/readconf.c b/src/src/readconf.c index 6ed2ea409..08014c9af 100644 --- a/src/src/readconf.c +++ b/src/src/readconf.c @@ -117,9 +117,12 @@ static optionlist optionlist_config[] = { #endif { "disable_ipv6", opt_bool, &disable_ipv6 }, #ifndef DISABLE_DKIM + { "dkim_verify_hashes", opt_stringptr, &dkim_verify_hashes }, + { "dkim_verify_keytypes", opt_stringptr, &dkim_verify_keytypes }, + { "dkim_verify_minimal", opt_bool, &dkim_verify_minimal }, { "dkim_verify_signers", opt_stringptr, &dkim_verify_signers }, #endif -#ifdef EXPERIMENTAL_DMARC +#ifdef SUPPORT_DMARC { "dmarc_forensic_sender", opt_stringptr, &dmarc_forensic_sender }, { "dmarc_history_file", opt_stringptr, &dmarc_history_file }, { "dmarc_tld_file", opt_stringptr, &dmarc_tld_file }, @@ -241,7 +244,7 @@ static optionlist optionlist_config[] = { #endif { "pid_file_path", opt_stringptr, &pid_file_path }, { "pipelining_advertise_hosts", opt_stringptr, &pipelining_advertise_hosts }, -#ifdef SUPPORT_PIPE_CONNECT +#ifndef DISABLE_PIPE_CONNECT { "pipelining_connect_advertise_hosts", opt_stringptr, &pipe_connect_advertise_hosts }, #endif @@ -306,7 +309,7 @@ static optionlist optionlist_config[] = { { "smtp_ratelimit_hosts", opt_stringptr, &smtp_ratelimit_hosts }, { "smtp_ratelimit_mail", opt_stringptr, &smtp_ratelimit_mail }, { "smtp_ratelimit_rcpt", opt_stringptr, &smtp_ratelimit_rcpt }, - { "smtp_receive_timeout", opt_func, &fn_smtp_receive_timeout }, + { "smtp_receive_timeout", opt_func, (void *) &fn_smtp_receive_timeout }, { "smtp_reserve_hosts", opt_stringptr, &smtp_reserve_hosts }, { "smtp_return_error_details",opt_bool, &smtp_return_error_details }, #ifdef SUPPORT_I18N @@ -3071,80 +3074,6 @@ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "malformed ratelimit data: %s", s); -/************************************************* -* Drop privs for checking TLS config * -*************************************************/ - -/* We want to validate TLS options during readconf, but do not want to be -root when we call into the TLS library, in case of library linkage errors -which cause segfaults; before this check, those were always done as the Exim -runtime user and it makes sense to continue with that. - -Assumes: tls_require_ciphers has been set, if it will be - exim_user has been set, if it will be - exim_group has been set, if it will be - -Returns: bool for "okay"; false will cause caller to immediately exit. -*/ - -#ifndef DISABLE_TLS -static BOOL -tls_dropprivs_validate_require_cipher(BOOL nowarn) -{ -const uschar *errmsg; -pid_t pid; -int rc, status; -void (*oldsignal)(int); - -/* If TLS will never be used, no point checking ciphers */ - -if ( !tls_advertise_hosts - || !*tls_advertise_hosts - || Ustrcmp(tls_advertise_hosts, ":") == 0 - ) - return TRUE; -else if (!nowarn && !tls_certificate) - log_write(0, LOG_MAIN, - "Warning: No server certificate defined; will use a selfsigned one.\n" - " Suggested action: either install a certificate or change tls_advertise_hosts option"); - -oldsignal = signal(SIGCHLD, SIG_DFL); - -fflush(NULL); -if ((pid = fork()) < 0) - log_write(0, LOG_MAIN|LOG_PANIC_DIE, "fork failed for TLS check"); - -if (pid == 0) - { - /* in some modes, will have dropped privilege already */ - if (!geteuid()) - exim_setugid(exim_uid, exim_gid, FALSE, - US"calling tls_validate_require_cipher"); - - if ((errmsg = tls_validate_require_cipher())) - log_write(0, LOG_PANIC_DIE|LOG_CONFIG, - "tls_require_ciphers invalid: %s", errmsg); - fflush(NULL); - exim_underbar_exit(0); - } - -do { - rc = waitpid(pid, &status, 0); -} while (rc < 0 && errno == EINTR); - -DEBUG(D_tls) - debug_printf("tls_validate_require_cipher child %d ended: status=0x%x\n", - (int)pid, status); - -signal(SIGCHLD, oldsignal); - -return status == 0; -} -#endif /*DISABLE_TLS*/ - - - - /************************************************* * Read main configuration options * *************************************************/ @@ -3326,19 +3255,19 @@ if (f.trusted_config && Ustrcmp(filename, US"/dev/null")) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Exim configuration file %s has the " "wrong owner, group, or mode", big_buffer); - } -/* Do a dummy store-allocation of a size related to the (toplevel) file size. -This assumes we will need this much storage to handle all the allocations -during startup; it won't help when .include is being used. When it does, it -will cut down on the number of store blocks (and malloc calls, and sbrk -syscalls). It also assume we're on the relevant pool. */ + /* Do a dummy store-allocation of a size related to the (toplevel) file size. + This assumes we will need this much storage to handle all the allocations + during startup; it won't help when .include is being used. When it does, it + will cut down on the number of store blocks (and malloc calls, and sbrk + syscalls). It also assume we're on the relevant pool. */ -if (statbuf.st_size > 8192) - { - rmark r = store_mark(); - void * dummy = store_get((int)statbuf.st_size, FALSE); - store_reset(r); + if (statbuf.st_size > 8192) + { + rmark r = store_mark(); + void * dummy = store_get((int)statbuf.st_size, FALSE); + store_reset(r); + } } /* Process the main configuration settings. They all begin with a lower case @@ -3463,15 +3392,14 @@ smtp_active_hostname = primary_hostname; got set above. Of course, writing to the log may not work if log_file_path is not set, but it will at least get to syslog or somewhere, with any luck. */ -if (*spool_directory == 0) +if (!*spool_directory) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "spool_directory undefined: cannot " "proceed"); /* Expand the spool directory name; it may, for example, contain the primary host name. Same comment about failure. */ -s = expand_string(spool_directory); -if (s == NULL) +if (!(s = expand_string(spool_directory))) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to expand spool_directory " "\"%s\": %s", spool_directory, expand_string_message); spool_directory = s; @@ -3480,32 +3408,27 @@ spool_directory = s; the null string or "syslog". It is also allowed to contain one instance of %D or %M. However, it must NOT contain % followed by anything else. */ -if (*log_file_path != 0) +if (*log_file_path) { const uschar *ss, *sss; int sep = ':'; /* Fixed for log file path */ - s = expand_string(log_file_path); - if (s == NULL) + if (!(s = expand_string(log_file_path))) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to expand log_file_path " "\"%s\": %s", log_file_path, expand_string_message); ss = s; - while ((sss = string_nextinlist(&ss,&sep,big_buffer,big_buffer_size)) != NULL) + while ((sss = string_nextinlist(&ss, &sep, big_buffer, big_buffer_size))) { uschar *t; if (sss[0] == 0 || Ustrcmp(sss, "syslog") == 0) continue; - t = Ustrstr(sss, "%s"); - if (t == NULL) + if (!(t = Ustrstr(sss, "%s"))) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "log_file_path \"%s\" does not " "contain \"%%s\"", sss); *t = 'X'; - t = Ustrchr(sss, '%'); - if (t != NULL) - { + if ((t = Ustrchr(sss, '%'))) if ((t[1] != 'D' && t[1] != 'M') || Ustrchr(t+2, '%') != NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "log_file_path \"%s\" contains " "unexpected \"%%\" character", s); - } } log_file_path = s; @@ -3648,11 +3571,6 @@ if ((tls_verify_hosts || tls_try_verify_hosts) && !tls_verify_certificates) "tls_%sverify_hosts is set, but tls_verify_certificates is not set", tls_verify_hosts ? "" : "try_"); -/* This also checks that the library linkage is working and we can call -routines in it, so call even if tls_require_ciphers is unset */ -if (!tls_dropprivs_validate_require_cipher(nowarn)) - exit(1); - /* Magic number: at time of writing, 1024 has been the long-standing value used by so many clients, and what Exim used to use always, that it makes sense to just min-clamp this max-clamp at that. */ @@ -4225,7 +4143,7 @@ Returns: nothing static void auths_init(void) { -#ifdef SUPPORT_PIPE_CONNECT +#ifndef DISABLE_PIPE_CONNECT int nauths = 0; #endif @@ -4251,11 +4169,11 @@ for (auth_instance * au = auths; au; au = au->next) "(%s and %s) have the same public name (%s)", au->client ? US"client" : US"server", au->name, bu->name, au->public_name); -#ifdef SUPPORT_PIPE_CONNECT +#ifndef DISABLE_PIPE_CONNECT nauths++; #endif } -#ifdef SUPPORT_PIPE_CONNECT +#ifndef DISABLE_PIPE_CONNECT f.smtp_in_early_pipe_no_auth = nauths > 16; #endif }