Do not sleep for tiny periods, or hang trying to sleep for zero. Bug 1426

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 09ce7984819d254978f7b7d8c909e859f1798fe4..aa9d23ddbf03b2e19a422887b81ae9129f505120 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -45,7 +45,7 @@
 . Update the Copyright year (only) when changing content.
 . /////////////////////////////////////////////////////////////////////////////
 
-.set previousversion "4.80"
+.set previousversion "4.83"
 .include ./local_params
 
 .set ACL "access control lists (ACLs)"
@@ -5556,10 +5556,12 @@ unreachable.
 
 The next two lines are concerned with &'ident'& callbacks, as defined by RFC
 1413 (hence their names):
+.new
 .code
-rfc1413_query_hosts = *
+rfc1413_hosts = *
 rfc1413_query_timeout = 0s
 .endd
+.wen
 These settings cause Exim to avoid ident callbacks for all incoming SMTP calls.
 Few hosts offer RFC1413 service these days; calls have to be
 terminated by a timeout and this needlessly delays the startup
@@ -7005,7 +7007,6 @@ ${lookup dnsdb{a=one.host.com:two.host.com}}
 Thus, in the default case, as long as at least one of the DNS lookups
 yields some data, the lookup succeeds.
 
-.new
 .cindex "DNSSEC" "dns lookup"
 Use of &(DNSSEC)& is controlled by a dnssec modifier.
 The possible keywords are
@@ -7018,7 +7019,6 @@ is treated as equivalent to a temporary DNS error.
 The default is &"never"&.
 
 See also the &$lookup_dnssec_authenticated$& variable.
-.wen
 
 
 
@@ -7084,7 +7084,6 @@ With sufficiently modern LDAP libraries, Exim supports forcing TLS over regular
 LDAP connections, rather than the SSL-on-connect &`ldaps`&.
 See the &%ldap_start_tls%& option.
 
-.new
 Starting with Exim 4.83, the initialization of LDAP with TLS is more tightly
 controlled. Every part of the TLS configuration can be configured by settings in
 &_exim.conf_&. Depending on the version of the client libraries installed on
@@ -7094,7 +7093,6 @@ certificates. This revealed a nuance where the current UID that exim was
 running as could affect which config files it read. With Exim 4.83, these
 methods become optional, only taking effect if not specifically set in
 &_exim.conf_&.
-.wen
 
 
 .section "LDAP quoting" "SECID68"
@@ -7242,9 +7240,7 @@ them. The following names are recognized:
 &`USER       `&  set the DN, for authenticating the LDAP bind
 &`PASS       `&  set the password, likewise
 &`REFERRALS  `&  set the referrals parameter
-.new
 &`SERVERS    `&  set alternate server list for this query only
-.wen
 &`SIZE       `&  set the limit for the number of entries returned
 &`TIME       `&  set the maximum waiting time for a query
 .endd
@@ -7266,7 +7262,6 @@ Netscape SDK; for OpenLDAP no action is taken.
 The TIME parameter (also a number of seconds) is passed to the server to
 set a server-side limit on the time taken to complete a search.
 
-.new
 The SERVERS parameter allows you to specify an alternate list of ldap servers
 to use for an individual lookup.  The global ldap_servers option provides a
 default list of ldap servers, and a single lookup can specify a single ldap
@@ -7274,7 +7269,6 @@ server to use.  But when you need to do a lookup with a list of servers that is
 different than the default list (maybe different order, maybe a completely
 different set of servers), the SERVERS parameter allows you to specify this
 alternate list.
-.wen
 
 Here is an example of an LDAP query in an Exim lookup that uses some of these
 values. This is a single line, folded to fit on the page:
@@ -8354,7 +8348,6 @@ Both &`+include_unknown`& and &`+ignore_unknown`& may appear in the same
 list. The effect of each one lasts until the next, or until the end of the
 list.
 
-.new
 .section "Mixing wildcarded host names and addresses in host lists" &&&
          "SECTmixwilhos"
 .cindex "host list" "mixing names and addresses in"
@@ -8390,7 +8383,6 @@ If the first &%accept%& fails, Exim goes on to try the second one. See chapter
 &`+ignore_unknown`&, which was discussed in depth in the first example in
 this section.
 .endlist
-.wen
 
 
 .section "Temporary DNS errors when looking up host information" &&&
@@ -8885,7 +8877,6 @@ the expansion result is an empty string.
 If the ACL returns defer the result is a forced-fail.  Otherwise the expansion fails.
 
 
-.new
 .vitem "&*${certextract{*&<&'field'&>&*}{*&<&'certificate'&>&*}&&&
        {*&<&'string2'&>&*}{*&<&'string3'&>&*}}*&"
 .cindex "expansion" "extracting cerificate fields"
@@ -8948,7 +8939,6 @@ which is one of "dns", "uri" or "mail";
 if so the elenment tags are omitted.
 
 If not otherwise noted field values are presented in human-readable form.
-.wen
 
 .vitem "&*${dlfunc{*&<&'file'&>&*}{*&<&'function'&>&*}{*&<&'arg'&>&*}&&&
        {*&<&'arg'&>&*}...}*&"
@@ -9597,7 +9587,6 @@ expansion item above.
         {*&<&'string2'&>&*}}*&"
 .cindex "expansion" "running a command"
 .cindex "&%run%& expansion item"
-.new
 The command and its arguments are first expanded as one string. The string is
 split apart into individual arguments by spaces, and then the command is run
 in a separate process, but under the same uid and gid.  As in other command
@@ -9614,7 +9603,6 @@ in a string containing quotes, because it would interfere with the quotes
 around the command arguments. A possible guard against this is to wrap the
 variable in the &%sg%& operator to change any quote marks to some other
 character.
-.wen
 
 The standard input for the command exists, but is empty. The standard output
 and standard error are set to the same file descriptor.
@@ -11011,6 +10999,13 @@ precedes the expansion of the string. For example, the commands available in
 Exim filter files include an &%if%& command with its own regular expression
 matching condition.
 
+.new
+.vitem "&$acl_arg1$&, &$acl_arg2$&, etc"
+Within an acl condition, expansion condition or expansion item
+any arguments are copied to these variables,
+any unused variables being made empty.
+.wen
+
 .vitem "&$acl_c...$&"
 Values can be placed in these variables by the &%set%& modifier in an ACL. They
 can be given any name that starts with &$acl_c$& and is at least six characters
@@ -11032,6 +11027,12 @@ message is received, the values of these variables are saved with the message,
 and can be accessed by filters, routers, and transports during subsequent
 delivery.
 
+.new
+.vitem &$acl_narg$&
+Within an acl condition, expansion condition or expansion item
+this variable has the number of arguments.
+.wen
+
 .vitem &$acl_verify_message$&
 .vindex "&$acl_verify_message$&"
 After an address verification has failed, this variable contains the failure
@@ -11570,7 +11571,6 @@ ability to find the amount of free space (only true for experimental systems),
 the space value is -1. See also the &%check_log_space%& option.
 
 
-.new
 .vitem &$lookup_dnssec_authenticated$&
 .vindex "&$lookup_dnssec_authenticated$&"
 This variable is set after a DNS lookup done by
@@ -11578,7 +11578,6 @@ a dnsdb lookup expansion, dnslookup router or smtp transport.
 It will be empty if &(DNSSEC)& was not requested,
 &"no"& if the result was not labelled as authenticated data
 and &"yes"& if it was.
-.wen
 
 .vitem &$mailstore_basename$&
 .vindex "&$mailstore_basename$&"
@@ -12357,7 +12356,6 @@ on an outbound SMTP connection; the meaning of
 this depends upon the TLS implementation used.
 If TLS has not been negotiated, the value will be 0.
 
-.new
 .vitem &$tls_in_ourcert$&
 .vindex "&$tls_in_ourcert$&"
 This variable refers to the certificate presented to the peer of an
@@ -12365,9 +12363,7 @@ inbound connection when the message was received.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%& or &%sha1%& operator,
 or a &%def%& condition.
-.wen
 
-.new
 .vitem &$tls_in_peercert$&
 .vindex "&$tls_in_peercert$&"
 This variable refers to the certificate presented by the peer of an
@@ -12375,25 +12371,20 @@ inbound connection when the message was received.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%& or &%sha1%& operator,
 or a &%def%& condition.
-.wen
 
-.new
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"
 This variable refers to the certificate presented to the peer of an
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%& or &%sha1%& operator,
 or a &%def%& condition.
-.wen
 
-.new
 .vitem &$tls_out_peercert$&
 .vindex "&$tls_out_peercert$&"
 This variable refers to the certificate presented by the peer of an
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%& or &%sha1%& operator,
 or a &%def%& condition.
-.wen
 
 .vitem &$tls_in_certificate_verified$&
 .vindex "&$tls_in_certificate_verified$&"
@@ -12432,6 +12423,26 @@ and then set to the outgoing cipher suite if one is negotiated. See chapter
 &<<CHAPTLS>>& for details of TLS support and chapter &<<CHAPsmtptrans>>& for
 details of the &(smtp)& transport.
 
+.new
+.vitem &$tls_in_ocsp$&
+.vindex "&$tls_in_ocsp$&"
+When a message is received from a remote client connection
+the result of any OCSP request from the client is encoded in this variable:
+.code
+0 OCSP proof was not requested (default value)
+1 No response to request
+2 Response not verified
+3 Verification failed
+4 Verification succeeded
+.endd
+
+.vitem &$tls_out_ocsp$&
+.vindex "&$tls_out_ocsp$&"
+When a message is sent to a remote host connection
+the result of any OCSP request made is encoded in this variable.
+See &$tls_in_ocsp$& for values.
+.wen
+
 .vitem &$tls_in_peerdn$&
 .vindex "&$tls_in_peerdn$&"
 .vindex "&$tls_peerdn$&"
@@ -17851,7 +17862,6 @@ when there is a DNS lookup error.
 
 
 
-.new
 .option dnssec_request_domains dnslookup "domain list&!!" unset
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
@@ -17860,11 +17870,9 @@ when there is a DNS lookup error.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.
 This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
-.wen
 
 
 
-.new
 .option dnssec_require_domains dnslookup "domain list&!!" unset
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
@@ -17874,7 +17882,6 @@ DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.
 This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
-.wen
 
 
 
@@ -22781,7 +22788,6 @@ See the &%search_parents%& option in chapter &<<CHAPdnslookup>>& for more
 details.
 
 
-.new
 .option dnssec_request_domains smtp "domain list&!!" unset
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
@@ -22790,11 +22796,9 @@ details.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.
 This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
-.wen
 
 
 
-.new
 .option dnssec_require_domains smtp "domain list&!!" unset
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
@@ -22804,7 +22808,6 @@ DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.
 This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
-.wen
 
 
 
@@ -25395,6 +25398,9 @@ but it is present in many binary distributions.
 .scindex IIDdcotauth2 "authenticators" "&(dovecot)&"
 This authenticator is an interface to the authentication facility of the
 Dovecot POP/IMAP server, which can support a number of authentication methods.
+.new
+Note that Dovecot must be configured to use auth-client not auth-userdb.
+.wen
 If you are using Dovecot to authenticate POP/IMAP clients, it might be helpful
 to use the same mechanisms for SMTP authentication. This is a server
 authenticator only. There is only one option:
@@ -26263,6 +26269,10 @@ file named by &%tls_ocsp_file%&.
 Note that the proof only covers the terminal server certificate,
 not any of the chain from CA to it.
 
+.new
+There is no current way to staple a proof for a client certificate.
+.wen
+
 .code
   A helper script "ocsp_fetch.pl" for fetching a proof from a CA
   OCSP server is supplied.  The server URL may be included in the
@@ -28431,7 +28441,6 @@ This condition checks whether the sending host (the client) is authorized to
 send email. Details of how this works are given in section
 &<<SECTverifyCSA>>&.
 
-.new
 .vitem &*verify&~=&~header_names_ascii*&
 .cindex "&%verify%& ACL condition"
 .cindex "&ACL;" "verifying header names only ASCII"
@@ -28446,7 +28455,6 @@ allowable characters are decimal ASCII values 33 through 126.
 Exim itself will handle headers with non-ASCII characters, but it can cause
 problems for downstream applications, so this option will allow their
 detection and rejection in the DATA ACL's.
-.wen
 
 .vitem &*verify&~=&~header_sender/*&<&'options'&>
 .cindex "&%verify%& ACL condition"
@@ -35060,10 +35068,8 @@ or (in case &*-a*& switch is specified)
 .code
 exim -bp
 .endd
-.new
 The &*-C*& option is used to specify an alternate &_exim.conf_& which might
 contain alternate exim configuration the queue management might be using.
-.wen
 
 to obtain a queue listing, and then greps the output to select messages 
 that match given criteria. The following selection options are available:

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 61086c7e254ae90872eb640b6b8e21c4938b0b3b..bea6b1aa3dc2edb782537b94a6e614523bbaaccd 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,6 +2,21 @@ Change log file for Exim from version 4.21
 -------------------------------------------
 
 
+Exim version 4.84
+-----------------
+TL/01 Bugzilla 1506: Re-add a 'return NULL' to silence complaints from static
+      checkers that were complaining about end of non-void function with no
+      return.
+
+JH/01 Bug 1513: Fix parsing of quoted parameter values in MIME headers.
+      This was a regression intruduced in 4.83 by another bugfix.
+
+JH/02 Fix broken compilation when EXPERIMENTAL_DSN is enabled.
+
+TL/02 Bug 1509: Fix exipick for enhanced spoolfile specification used when
+      EXPERIMENTAL_DNS is enabled.  Fix from Wolfgang Breyha.
+
+
 Exim version 4.83
 -----------------
 

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index f3e2dc1eb68eb49b51ab63e20eeb776677955eb1..1b7ad35dd6cf022ff6035948089db5ce451dcd16 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -6,6 +6,10 @@ Before a formal release, there may be quite a lot of detail so that people can
 test from the snapshots or the CVS before the documentation is updated. Once
 the documentation is updated, this file is reduced to a short list.
 
+Version 4.84
+------------
+
+
 Version 4.83
 ------------
 

diff --git a/src/src/deliver.c b/src/src/deliver.c
index b0b4601dc3575df6188bec955dfc2f9a93999b2c..87b54d88e900b9ab88263c62445560bb17b2c38d 100644 (file)
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -6511,8 +6511,8 @@ if (addr_senddsn != NULL)
        "Content-type: text/plain; charset=us-ascii\n\n"
    
        "This message was created automatically by mail delivery software.\n"
-       " ----- The following addresses had successful delivery notifications -----\n"
-      qualify_domain_sender, sender_addres, boundaryStrs, boundarySt);
+       " ----- The following addresses had successful delivery notifications -----\n",
+      qualify_domain_sender, sender_address, boundaryStr, boundaryStr);
 
     addr_dsntmp = addr_senddsn;
     while(addr_dsntmp)
@@ -6944,8 +6944,9 @@ wording. */
       for (addr = handled_addr; addr; addr = addr->next)
         {
         fprintf(f, "Action: failed\n"
-           "Final-Recipient: rfc822;%s\n", addr->address
-           "Status: 5.0.0\n");
+           "Final-Recipient: rfc822;%s\n"
+           "Status: 5.0.0\n",
+           addr->address);
         if (addr->host_used && addr->host_used->name)
           fprintf(f, "Remote-MTA: dns; %s\nDiagnostic-Code: smtp; %d\n",
            addr->host_used->name, addr->basic_errno);

diff --git a/src/src/exipick.src b/src/src/exipick.src
index ed3b6615436ed6df7bfccd0780abe9b24190a6e1..4708ebb4a29d4e4419d9d54b5bbdf472329628dc 100644 (file)
--- a/src/src/exipick.src
+++ b/src/src/exipick.src
@@ -1020,6 +1020,12 @@ sub _parse_header {
       return($self->_error("incorrect format: $_")) if (length($2) != $3);
       $self->{_recips}{$1} = { pno => $4, errors_to => $2 };
       $addr = $1;
+    } elsif (/^(\S*)\s(\S*)\s(\d+),(\d+)\s(\S*)\s(\d+),(-?\d+)#3$/) {
+      #print STDERR "exim4 new type #3 DSN (untested): $_\n";
+      return($self->_error("incorrect format: $_"))
+        if ((length($2) != $3) || (length($5) != $6));
+      $self->{_recips}{$1} = { pno => $7, errors_to => $5 };
+      $addr = $1;
     } elsif (/^.*#(\d+)$/) {
       #print STDERR "exim4 #$1 style (unimplemented): $_\n";
       $self->_error("exim4 #$1 style (unimplemented): $_");

diff --git a/src/src/expand.c b/src/src/expand.c
index c6356fbe12202145895a8aa15aaf2c90643ccfc7..70d7c7d2ff61ef892d8b244f11c440d40a34f408 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1879,6 +1879,8 @@ switch (vp->type)
   #endif
 
   }
+
+return NULL;  /* Unknown variable. Silences static checkers. */
 }
 
 

diff --git a/src/src/mime.c b/src/src/mime.c
index 6a9e31a0aa5e5aaf20a5868956c435cb316c431d..95d3da4723cf5de2115014dfebb73ae728639ac0 100644 (file)
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -601,16 +601,28 @@ NEXT_PARAM_SEARCH:
            int param_value_len = 0;
 
            /* found an interesting parameter? */
-           if (strncmpic(mp->name, p,mp->namelen) == 0)
+           if (strncmpic(mp->name, p, mp->namelen) == 0)
              {
              uschar *q = p + mp->namelen;
+             int size = 0;
+             int ptr = 0;
+
              /* yes, grab the value and copy to its corresponding expansion variable */
-             while(*q != ';') q++;
-             param_value_len = (q - (p + mp->namelen));
-             param_value = (uschar *)malloc(param_value_len+1);
-             memset(param_value,0,param_value_len+1);
-             q = p + mp->namelen;
-             Ustrncpy(param_value, q, param_value_len);
+             while(*q && *q != ';')            /* ; terminates */
+               {
+               if (*q == '"')
+                 {
+                 q++;                          /* skip leading " */
+                 while(*q && *q != '"')        /* which protects ; */
+                   param_value = string_cat(param_value, &size, &ptr, q++, 1);
+                 if (*q) q++;                  /* skip trailing " */
+                 }
+               else
+                 param_value = string_cat(param_value, &size, &ptr, q++, 1);
+               }
+             param_value[ptr++] = '\0';
+             param_value_len = ptr;
+
              param_value = rfc2047_decode(param_value, check_rfc2047_length, NULL, 32, &param_value_len, &q);
              debug_printf("Found %s MIME parameter in %s header, value is '%s'\n", mp->name, mime_header_list[i].name, param_value);
              *((uschar **)(mp->value)) = param_value;

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 18994eaa93d053894eddc5c9bd0668deeed910b2..e562a8926d7b43792b892cadbd569403db6f6612 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -888,7 +888,7 @@ if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
  {
   tls_out.ocsp = OCSP_FAILED;
   if (log_extra_selector & LX_tls_cipher)
-    log_write(0, LOG_MAIN, "Received TLS status response, parse error");
+    log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
   else
     DEBUG(D_tls) debug_printf(" parse error\n");
   return 0;
@@ -898,7 +898,7 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
   {
   tls_out.ocsp = OCSP_FAILED;
   if (log_extra_selector & LX_tls_cipher)
-    log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
+    log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
   else
     DEBUG(D_tls) debug_printf(" error parsing response\n");
   OCSP_RESPONSE_free(rsp);
@@ -928,6 +928,8 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
              cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
       {
       tls_out.ocsp = OCSP_FAILED;
+      if (log_extra_selector & LX_tls_cipher)
+       log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
       BIO_printf(bp, "OCSP response verify failure\n");
       ERR_print_errors(bp);
       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;