Merge branch 'acl'

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index eb5bd4cba994e3adea11cfe25de74bdde0ff387b..eb359d0882783ac5e0937c870e652be0f99ed7ec 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -12857,6 +12857,9 @@ listed in more than one group.
 .section "TLS" "SECID108"
 .table2
 .row &%gnutls_compat_mode%&          "use GnuTLS compatibility mode"
+.new
+.row &%gnutls_enable_pkcs11%&        "allow GnuTLS to autoload PKCS11 modules"
+.wen
 .row &%openssl_options%&             "adjust OpenSSL compatibility options"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
@@ -13885,6 +13888,19 @@ This option controls whether GnuTLS is used in compatibility mode in an Exim
 server. This reduces security slightly, but improves interworking with older
 implementations of TLS.
 
+
+.new
+option gnutls_enable_pkcs11 main boolean unset
+This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
+the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
+
+See
+&url(http://www.gnu.org/software/gnutls/manual/gnutls.html#Smart-cards-and-HSMs)
+for documentation.
+.wen
+
+
+
 .option headers_charset main string "see below"
 This option sets a default character set for translating from encoded MIME
 &"words"& in header lines, when referenced by an &$h_xxx$& expansion item. The

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 9dbc65c09375bbaa46acdbb7b47f5d74710641ce..a9c9abed8c4c66873267ede00eb0751cb27414b1 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -44,6 +44,11 @@ NM/01 Bugzilla 1197 - Spec typo
 
 JH/03 Add expansion operators ${listnamed:name} and ${listcount:string}
 
+PP/09 Add gnutls_enable_pkcs11 option.
+
+PP/10 Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC.
+      Pulled from Debian 30_dontoverridecflags.dpatch by Andreas Metzler.
+
 JH/04 Add expansion item ${acl {name}{arg}...}, expansion condition
       "acl {{name}{arg}...}", and optional args on acl condition
       "acl = name arg..."

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index df2ede807eed72c88291d99a9f62f7d4177b0e5c..53d533dea2e658e6233616ecf8347babec05ca77 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -87,7 +87,16 @@ Version 4.81
  8. New expansion operators ${listnamed:name} to get the content of a named list
     and ${listcount:string} to count the items in a list.
 
- 9. The "acl = name" condition on an ACL now supports optional arguments.
+ 9. New global option "gnutls_enable_pkcs11", defaults false.  The GnuTLS
+    rewrite in 4.80 combines with GnuTLS 2.12.0 or later, to autoload PKCS11
+    modules.  For some situations this is desirable, but we expect admin in
+    those situations to know they want the feature.  More commonly, it means
+    that GUI user modules get loaded and are broken by the setuid Exim being
+    unable to access files specified in environment variables and passed
+    through, thus breakage.  So we explicitly inhibit the PKCS11 initialisation
+    unless this new option is set.
+
+10. The "acl = name" condition on an ACL now supports optional arguments.
     New expansion item "${acl {name}{arg}...}" and expansion condition
     "acl {{name}{arg}...}" are added.  In all cases up to nine arguments
     can be used, appearing in $acl_arg1 to $acl_arg9 for the called ACL.

diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 1c7881e767307f09637b6a9fb3b2f3197196e6b9..05074bba7576f11fd09f4a03d0b9c489d83e837f 100644 (file)
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -243,6 +243,7 @@ gecos_name                           string*         unset         main
 gecos_pattern                        string          unset         main
 gethostbyname                        boolean         false         smtp
 gnutls_compat_mode                   boolean         unset         main              4.70
+gnutls_enable_pkcs11                 boolean         false         main              4.81
 gnutls_require_kx                    string*         unset         main              4.67 deprecated, warns
                                      string*         unset         smtp              4.67 deprecated, warns
 gnutls_require_mac                   string*         unset         main              4.67 deprecated, warns

diff --git a/src/.gitattributes b/src/.gitattributes
new file mode 100644 (file)
index 0000000..554385c
--- /dev/null
+++ b/src/.gitattributes
@@ -0,0 +1 @@
+ACKNOWLEDGMENTS         encoding=utf-8

diff --git a/src/OS/Makefile-Linux b/src/OS/Makefile-Linux
index 8b721410e7b11a96a5206a75fe2059d8898abd18..990f884e9cb2b33ac3ce734986c461312b21449e 100644 (file)
--- a/src/OS/Makefile-Linux
+++ b/src/OS/Makefile-Linux
@@ -1,5 +1,9 @@
 # Exim: OS-specific make file for Linux. This is for modern Linuxes,
 # which use libc6.
+#
+# For Linux, we assume GNU Make; at time of writing, the only extension
+# used is ?= which is actually portable to other maintained Make variants,
+# just is not POSIX.
 
 HAVE_ICONV=yes
 
@@ -8,8 +12,9 @@ CHOWN_COMMAND=look_for_it
 CHGRP_COMMAND=look_for_it
 CHMOD_COMMAND=look_for_it
 
-CFLAGS=-O -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-CFLAGS_DYNAMIC=-shared -rdynamic
+# Preserve CFLAGS and CFLAGS_DYNAMIC from the caller/environment
+CFLAGS ?= -O -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+CFLAGS_DYNAMIC ?= -shared -rdynamic
 
 DBMLIB = -ldb
 USE_DB = yes

diff --git a/src/README.UPDATING b/src/README.UPDATING
index d34dec1e1cf32d82d728e6fd5e8622d8959a24c4..b7406f43c177b2b85a9c7087c96db5b899350fe7 100644 (file)
--- a/src/README.UPDATING
+++ b/src/README.UPDATING
@@ -26,6 +26,13 @@ The rest of this document contains information about changes in 4.xx releases
 that might affect a running system.
 
 
+Exim version 4.81
+-----------------
+
+ * New option gnutls_enable_pkcs11 defaults false; if you have GnuTLS 2.12.0
+   or later and do want PKCS11 modules to be autoloaded, then set this option.
+
+
 Exim version 4.80
 -----------------
 

diff --git a/src/src/globals.c b/src/src/globals.c
index b6db9251da2352271b9c45c84c4738ac341a53eb..21122f0f9430b3005697b67e2e63c2a38c39dc70 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -117,6 +117,7 @@ tls_support tls_out = {
 
 #ifdef SUPPORT_TLS
 BOOL    gnutls_compat_mode     = FALSE;
+BOOL    gnutls_enable_pkcs11   = FALSE;
 uschar *gnutls_require_mac     = NULL;
 uschar *gnutls_require_kx      = NULL;
 uschar *gnutls_require_proto   = NULL;

diff --git a/src/src/globals.h b/src/src/globals.h
index 639d88f3136e0e24a97285730324bd75eeeba18a..783eb7ba3bde501963b6969e4e1ff93a88859659 100644 (file)
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -89,6 +89,7 @@ extern tls_support tls_out;
 
 #ifdef SUPPORT_TLS
 extern BOOL    gnutls_compat_mode;     /* Less security, more compatibility */
+extern BOOL    gnutls_enable_pkcs11;   /* Let GnuTLS autoload PKCS11 modules */
 extern uschar *gnutls_require_mac;     /* So some can be avoided */
 extern uschar *gnutls_require_kx;      /* So some can be avoided */
 extern uschar *gnutls_require_proto;   /* So some can be avoided */

diff --git a/src/src/readconf.c b/src/src/readconf.c
index 750e0d31606088381d15fdf4ff4551619a2ccf93..087ab5b9b0a01706437ea3d3905d5ac990e3213b 100644 (file)
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -236,6 +236,7 @@ static optionlist optionlist_config[] = {
   { "gecos_pattern",            opt_stringptr,   &gecos_pattern },
 #ifdef SUPPORT_TLS
   { "gnutls_compat_mode",       opt_bool,        &gnutls_compat_mode },
+  { "gnutls_enable_pkcs11",     opt_bool,        &gnutls_enable_pkcs11 },
   /* These three gnutls_require_* options stopped working in Exim 4.80 */
   { "gnutls_require_kx",        opt_stringptr,   &gnutls_require_kx },
   { "gnutls_require_mac",       opt_stringptr,   &gnutls_require_mac },

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index c582af79f0c43472c434e6881c1ae9e666005fbc..2399857679ca3234c63e01312c8649efde85076b 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -39,6 +39,10 @@ require current GnuTLS, then we'll drop support for the ancient libraries).
 #include <gnutls/x509.h>
 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
 #include <gnutls/crypto.h>
+/* needed to disable PKCS11 autoload unless requested */
+#if GNUTLS_VERSION_NUMBER >= 0x020c00
+# include <gnutls/pkcs11.h>
+#endif
 
 /* GnuTLS 2 vs 3
 
@@ -172,6 +176,7 @@ before, for now. */
 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
 #define HAVE_GNUTLS_RND
+#define HAVE_GNUTLS_PKCS11
 #endif
 
 
@@ -911,6 +916,19 @@ if (!exim_gnutls_base_init_done)
   {
   DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
 
+#ifdef HAVE_GNUTLS_PKCS11
+  /* By default, gnutls_global_init will init PKCS11 support in auto mode,
+  which loads modules from a config file, which sounds good and may be wanted
+  by some sysadmin, but also means in common configurations that GNOME keyring
+  environment variables are used and so breaks for users calling mailq.
+  To prevent this, we init PKCS11 first, which is the documented approach. */
+  if (!gnutls_enable_pkcs11)
+    {
+    rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
+    exim_gnutls_err_check(US"gnutls_pkcs11_init");
+    }
+#endif
+
   rc = gnutls_global_init();
   exim_gnutls_err_check(US"gnutls_global_init");
 
@@ -970,7 +988,7 @@ if (rc != OK) return rc;
 /* set SNI in client, only */
 if (host)
   {
-  if (!expand_check(state->tlsp->sni, "tls_out_sni", &state->exp_tls_sni))
+  if (!expand_check(state->tlsp->sni, US"tls_out_sni", &state->exp_tls_sni))
     return DEFER;
   if (state->exp_tls_sni && *state->exp_tls_sni)
     {
@@ -1945,6 +1963,13 @@ if (exim_gnutls_base_init_done)
   log_write(0, LOG_MAIN|LOG_PANIC,
       "already initialised GnuTLS, Exim developer bug");
 
+#ifdef HAVE_GNUTLS_PKCS11
+if (!gnutls_enable_pkcs11)
+  {
+  rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
+  validate_check_rc(US"gnutls_pkcs11_init");
+  }
+#endif
 rc = gnutls_global_init();
 validate_check_rc(US"gnutls_global_init()");
 exim_gnutls_base_init_done = TRUE;