Jeremy Harris [Sun, 6 May 2012 17:53:34 +0000 (18:53 +0100)]
Fix tls variables order, and testsuite case 5401 (cutthrough) for changes that went in with dual-tls.
Jeremy Harris [Sun, 6 May 2012 16:12:31 +0000 (17:12 +0100)]
Deal explicitly with attempt to callout via null transport; fixes crash.
Jeremy Harris [Tue, 1 May 2012 19:12:36 +0000 (20:12 +0100)]
Fixup testsuite cases affected by dual-tls - mainly EHLO on callouts.
Jeremy Harris [Sun, 29 Apr 2012 20:02:27 +0000 (21:02 +0100)]
Dual-tls - split management of TLS into in- and out-bound connection-handling.
Enables concurrent use from a single process, and thereby use for cutthrough delivery.
As a side-effect EHLO and TLS use for verify callouts introduced.
This was a manual import from elsewhere and is known to fail the test-suite.
Jeremy Harris [Sun, 29 Apr 2012 17:22:56 +0000 (18:22 +0100)]
Testsuite cases for basic cutthrough_delivery.
Also fixed bug where a predata acl was required for cutthrough.
Jeremy Harris [Thu, 26 Apr 2012 22:59:34 +0000 (23:59 +0100)]
Basic cutthrough delivery.
Todd Lyons [Mon, 4 Jun 2012 13:03:18 +0000 (06:03 -0700)]
Test for proper parsing of optional MAIL FROM args.
Todd Lyons [Tue, 29 May 2012 13:07:42 +0000 (06:07 -0700)]
Refactor optional MAIL FROM args
Todd Lyons [Mon, 4 Jun 2012 13:05:29 +0000 (06:05 -0700)]
Test system - parse ipv6 addresses with no :: in them.
Jeremy Harris [Mon, 4 Jun 2012 12:14:28 +0000 (13:14 +0100)]
Remove extraneous #ifndef guards from config.h.default
Phil Pennock [Mon, 4 Jun 2012 00:27:59 +0000 (20:27 -0400)]
Implement -G => "control=suppress_local_fixups"
fixes bug 1117
Phil Pennock [Sun, 3 Jun 2012 22:46:58 +0000 (18:46 -0400)]
Cmdline -L option; also -Ac -Am -X<logfile>
These are for Sendmail compatibility.
bug 1117
Phil Pennock [Sun, 3 Jun 2012 17:27:20 +0000 (13:27 -0400)]
ChangeLog: note cyrus plugin use situation
Phil Pennock [Sun, 3 Jun 2012 17:18:03 +0000 (13:18 -0400)]
Cyrus SASL: set host;port properties on auth driver
Phil Pennock [Sun, 3 Jun 2012 17:04:54 +0000 (13:04 -0400)]
copyright year
Phil Pennock [Sun, 3 Jun 2012 13:42:50 +0000 (09:42 -0400)]
DSCP: inbound via control = dscp/<value>
Phil Pennock [Sat, 2 Jun 2012 21:43:19 +0000 (17:43 -0400)]
Docs: pipes in redirect, need for quote caution
Phil Pennock [Sat, 2 Jun 2012 21:19:32 +0000 (17:19 -0400)]
Christof Meerwald (for patches in bug 1095)
Phil Pennock [Sat, 2 Jun 2012 18:45:26 +0000 (14:45 -0400)]
DSCP: take numeric values too.
Also fix doc claim that value is unexpanded.
Also strip affix whitespace before numeric conversion and fixed string comparison.
Phil Pennock [Sat, 2 Jun 2012 14:41:41 +0000 (10:41 -0400)]
FreeBSD is ELF and has been for a long time
Phil Pennock [Sat, 2 Jun 2012 13:10:44 +0000 (09:10 -0400)]
DSCP: document; hex print; -bI:dscp
Phil Pennock [Fri, 1 Jun 2012 16:05:42 +0000 (12:05 -0400)]
DSCP support, tentative
Phil Pennock [Fri, 1 Jun 2012 14:15:14 +0000 (10:15 -0400)]
DNSSEC babystep: dns_use_dnssec & $sender_host_dnssec
Phil Pennock [Fri, 1 Jun 2012 12:30:06 +0000 (08:30 -0400)]
improve PH entry, per Bill Hacker's suggestion
Phil Pennock [Fri, 1 Jun 2012 11:49:05 +0000 (07:49 -0400)]
ACKNOWLEDGEMENTS update, covering a few years
Phil Pennock [Fri, 1 Jun 2012 09:52:31 +0000 (05:52 -0400)]
tls_dh_min_bits smtp transport option
Could not find an API for use with OpenSSL, so GnuTLS only
Phil Pennock [Fri, 1 Jun 2012 08:29:39 +0000 (04:29 -0400)]
Make -n combine with -bP to inhibit names
Phil Pennock [Fri, 1 Jun 2012 07:37:26 +0000 (03:37 -0400)]
Add -bI:help and -bI:sieve
Phil Pennock [Thu, 31 May 2012 10:29:28 +0000 (06:29 -0400)]
Doc: drop .new/.wen, update previousversion.
Also, drop fix one place which claimed TLS SNI support was OpenSSL only.
Phil Pennock [Thu, 31 May 2012 00:40:15 +0000 (20:40 -0400)]
Revert "Lower EXIM_CLIENT_DH_MIN_BITS 1024 -> 512."
This reverts commit
83f4c7515f3eb06dc070e78edd2694c1d088e5fd.
This was not a new check! The call to gnutls_dh_set_prime_bits() was
made with DH_BITS in Exim 4.77, so the only difference is that now an
administrator can choose at compile time to change the lower bound.
So keeping this at 1024 is not a regression and if we can't talk to them
now, we couldn't before, and we shouldn't lower security by default.
The reverted commit was only acceptable IF it was still better than what
we had in Exim 4.77.
Phil Pennock [Wed, 30 May 2012 23:38:20 +0000 (19:38 -0400)]
Lower EXIM_CLIENT_DH_MIN_BITS 1024 -> 512.
Wolfgang Breyha saw a real-world site using 768 bits.
Phil Pennock [Mon, 28 May 2012 05:11:48 +0000 (01:11 -0400)]
Merge openssl_disable_ssl2 branch
Phil Pennock [Sun, 27 May 2012 16:21:37 +0000 (12:21 -0400)]
typo fix: "overriden" -> "overridden" from Andreas Metzler
Phil Pennock [Sun, 27 May 2012 16:12:31 +0000 (12:12 -0400)]
release: don't try to sign .tar.lz files
Jeremy Harris [Sun, 27 May 2012 15:50:39 +0000 (16:50 +0100)]
Test: update for new tls_dhparam (suite used on Scientific Linux 6 test host).
Phil Pennock [Sun, 27 May 2012 15:02:01 +0000 (11:02 -0400)]
Doc: fix glitch
Phil Pennock [Sun, 27 May 2012 14:57:32 +0000 (10:57 -0400)]
Test: update for new tls_dhparam
Phil Pennock [Sun, 27 May 2012 14:02:12 +0000 (10:02 -0400)]
Doc: SECTgnutlsparam referencing tls_dhparam
Phil Pennock [Sun, 27 May 2012 13:14:39 +0000 (09:14 -0400)]
For DH, use standard primes from RFCs
Phil Pennock [Sun, 27 May 2012 05:34:36 +0000 (01:34 -0400)]
">" -> ">=" for EXIM_CLIENT_DH_MIN_BITS+10
Phil Pennock [Sun, 27 May 2012 05:17:04 +0000 (01:17 -0400)]
Deal with GnuTLS DH generation overshoot
Phil Pennock [Sun, 27 May 2012 03:42:50 +0000 (23:42 -0400)]
FAQ for GnuTLS
Phil Pennock [Sun, 27 May 2012 00:18:31 +0000 (20:18 -0400)]
teach sprint_vformat() size_t z modifier (jgh)
Jeremy wrote this, mostly; I just fixed up a comment and pedantically numbered the enum values
Phil Pennock [Sun, 27 May 2012 00:10:40 +0000 (20:10 -0400)]
fix size param for gnutls_dh_params_export_pkcs3() again
Todd Lyons [Fri, 25 May 2012 16:19:36 +0000 (09:19 -0700)]
Ignore vim swap files and test/* temporary files/dirs
Phil Pennock [Fri, 25 May 2012 14:57:25 +0000 (10:57 -0400)]
release: no .lz by default for now
Phil Pennock [Fri, 25 May 2012 14:29:06 +0000 (10:29 -0400)]
Doc: Provide context for bare numbers from CHAP/SECT.
Phil Pennock [Fri, 25 May 2012 09:01:39 +0000 (05:01 -0400)]
Cyrus SASL auth: SSF retrieval was incorrect.
Exim thought protection layer was required, which is not implemented.
Patch from Wolfgang Breyha.
Fixes bug 1254
Phil Pennock [Fri, 25 May 2012 08:05:17 +0000 (04:05 -0400)]
It's 2012, not 1012. Noted by Jay Rouman
Nigel Metheringham [Thu, 24 May 2012 15:45:12 +0000 (16:45 +0100)]
Added some more .gitignore entries
Ignore more build side effects
Nigel Metheringham [Thu, 24 May 2012 15:40:42 +0000 (16:40 +0100)]
Moved pdkim declaration to satisfy older compilers
As suggested by Dennis Davis to fix an error with gcc 2.95.2
which threw the following error:-
gcc pdkim.c
pdkim.c: In function `pdkim_feed_finish':
pdkim.c:1389: parse error before `*'
pdkim.c:1390: `hdrs' undeclared (first use in this function)
pdkim.c:1390: (Each undeclared identifier is reported only once
pdkim.c:1390: for each function it appears in.)
gmake[2]: *** [pdkim.o] Error 1
See https://lists.exim.org/lurker/message/
20120524.094800.
89928246.en.html
Phil Pennock [Thu, 24 May 2012 06:12:53 +0000 (02:12 -0400)]
ReleaseTools: support .lz lzip archives
Phil Pennock [Thu, 24 May 2012 03:43:20 +0000 (23:43 -0400)]
_ISOC99_SOURCE -> _GNU_SOURCE
_ISOC99_SOURCE broke build on Linux (Ubuntu 11.10) because it broke <resolv.h>, <arpa/nameser.h>, etc.
Their u_char and u_int usage relies upon BSD source being enabled too. So use _GNU_SOURCE.
Phil Pennock [Thu, 24 May 2012 03:27:44 +0000 (23:27 -0400)]
Define _ISOC99_SOURCE in exim.h
Done before os.h is pulled in so an OS can override it.
Phil Pennock [Wed, 23 May 2012 19:03:21 +0000 (15:03 -0400)]
Doc: move -bmalware into alphabetic place
Phil Pennock [Wed, 23 May 2012 17:02:52 +0000 (13:02 -0400)]
Doc: s/DNS/domains/ in new text
Phil Pennock [Wed, 23 May 2012 16:58:18 +0000 (12:58 -0400)]
Doc: document when dnslookup will decline
Phil Pennock [Wed, 23 May 2012 16:25:16 +0000 (12:25 -0400)]
Doc: tls_require_ciphers examples
Note how to test strings, provide examples which distinguish port 25 from other ports.
Carefully used short examples, but allows two different strings per implementation
and demonstrates how the strings are very different.
Todd Lyons [Wed, 23 May 2012 13:35:31 +0000 (06:35 -0700)]
Manually control locale, setting to "C" in runtest script.
Fixes the output of 'ls' command to a standard format (test 345).
Phil Pennock [Wed, 23 May 2012 05:20:09 +0000 (01:20 -0400)]
expanded comment, noting size types and API issue
Phil Pennock [Wed, 23 May 2012 00:12:35 +0000 (20:12 -0400)]
README.UPDATING: emphasise more the LDAP issue
Phil Pennock [Tue, 22 May 2012 13:06:24 +0000 (09:06 -0400)]
OCSP description: minor nits
Phil Pennock [Tue, 22 May 2012 02:14:18 +0000 (22:14 -0400)]
Enable PCRE_CONFIG by default
With this, src/EDITME as Local/Makefile *only* needs EXIM_USER to be
set and EXIM_MONITOR commented out for Exim to build on my box.
I think this is a reasonable default; if there are releases of PCRE which
do not include pcre-config, then on those boxes a slight change will be
needed, but only where the file was already having to be edited anyway.
Phil Pennock [Tue, 22 May 2012 01:58:00 +0000 (21:58 -0400)]
Guard SNI usage better (client-side)
Jeremy Harris [Mon, 21 May 2012 21:16:00 +0000 (22:16 +0100)]
Testsuite: more robust fix for SHELL vs /bin/sh, take two.
Jeremy Harris [Mon, 21 May 2012 19:36:42 +0000 (20:36 +0100)]
Revert "Testsuite: more robust fix for SHELL vs /bin/sh"
This reverts commit
8dedb69a41c30fd82ab6e084fe567f7ee7aaa562.
Kills testcase 0137.
Jeremy Harris [Mon, 21 May 2012 18:51:21 +0000 (19:51 +0100)]
Testsuite: more robust fix for SHELL vs /bin/sh
Phil Pennock [Mon, 21 May 2012 10:49:54 +0000 (06:49 -0400)]
OpenBSD compat, DNS resolver library
Report and point to fix from Dennis Davis.
Phil Pennock [Mon, 21 May 2012 10:33:08 +0000 (06:33 -0400)]
Update binary's copyright message.
Rough text per suggestion from Tony.
Amended ACKNOWLEDGEMENTS briefly, but need to actually add people. Like, er, me.
Phil Pennock [Mon, 21 May 2012 09:54:50 +0000 (05:54 -0400)]
avoid NUL in dh params file
gnutls_dh_params_export_pkcs3() returns 2 different sizes.
NUL observed by Janne Snabb
Phil Pennock [Mon, 21 May 2012 04:32:11 +0000 (00:32 -0400)]
.end -> .wen
Phil Pennock [Mon, 21 May 2012 04:29:25 +0000 (00:29 -0400)]
Add tls_dh_max_bits to OptionLists.txt
Phil Pennock [Mon, 21 May 2012 04:20:37 +0000 (00:20 -0400)]
features.h; tls_validate_require_cipher: log flag & tests
Pull in <features.h> on Linux.
Switch readconf log from D_all (bug) to D_tls (though D_any would have
worked).
Modified runtest to handle clamped DH bits and
tls_validate_require_cipher added debug logging.
Phil Pennock [Mon, 21 May 2012 02:58:18 +0000 (22:58 -0400)]
only drop privs for TLS if still root
Phil Pennock [Mon, 21 May 2012 02:15:48 +0000 (22:15 -0400)]
Update docs for latest state of TLS affairs.
gnutls-params bits count no longer necessarily what GnuTLS says to use.
The OpenSSL-vs-GnuTLS text needed some updating.
Catches a ChangeLog addition made during the previous commit, so not picked up by it.
Phil Pennock [Mon, 21 May 2012 01:49:40 +0000 (21:49 -0400)]
Added tls_dh_max_bits & check tls_require_ciphers early.
Janne Snabb tracked down the GnuTLS 2.12 vs NSS (Thunderbird) interop
problems to a hard-coded limit of 2236 bits for DH in NSS while GnuTLS
was suggesting 2432 bits as normal.
Added new global option tls_dh_max_bits to clamp all DH values (client
or server); unexpanded integer. Default value to 2236. Apply to both
GnuTLS and OpenSSL (which requires tls_dh_params for this).
Tired of debugging "SMTP fails TLS" error messages in mailing-lists
caused by OpenSSL library/include clashes, and of finding out I typo'd
in tls_require_ciphers only at the STARTTLS handshake. During readconf,
fork/drop-privs/initialise-TLS-library. In that, if tls_require_ciphers
is set, then validate it.
The validation child will panic if it can't initialise or if
tls_require_ciphers can't be parsed, else it exits 0. If the child
exits anything other than 0, the main Exim process will exit.
Phil Pennock [Sun, 20 May 2012 23:35:34 +0000 (19:35 -0400)]
Guard TLS SNI callback define better.
Guarded the callback invocation on OpenSSL having TLS extension support.
Failed to guard the callback definition. Fixed.
Problem spotted by Todd Lyons.
Phil Pennock [Sun, 20 May 2012 22:22:06 +0000 (18:22 -0400)]
tls_require_ciphers must be assigned to state copy
Todd Lyons [Sun, 20 May 2012 15:11:23 +0000 (08:11 -0700)]
Merge branch 'master_testsuite_faq'
Todd Lyons [Sun, 20 May 2012 15:08:59 +0000 (08:08 -0700)]
FAQ of running test suite
Jeremy Harris [Sun, 20 May 2012 14:32:34 +0000 (15:32 +0100)]
Testsuite: more guidance in README
Phil Pennock [Sun, 20 May 2012 09:34:57 +0000 (05:34 -0400)]
Typo: PRE_PRERELEASE -> PCRE_PRERELEASE
Noted by Moritz Wilhelmy.
Phil Pennock [Sun, 20 May 2012 09:33:22 +0000 (05:33 -0400)]
GnuTLS debug callback: check for existing \n
Phil Pennock [Sun, 20 May 2012 07:48:53 +0000 (03:48 -0400)]
"make makfile" -> "make makefile".
Confirmed typo, rather than QNXism, by grepping tree and finding no
other instances.
Reported by René Berber.
Phil Pennock [Sun, 20 May 2012 02:22:06 +0000 (22:22 -0400)]
Cipher munging continues.
I omitted log/2025 pending further investigation.
Phil Pennock [Sun, 20 May 2012 01:29:45 +0000 (21:29 -0400)]
HAVE_IPV6=yes in comment; need value!
Jeremy Harris [Sun, 20 May 2012 00:04:24 +0000 (01:04 +0100)]
Testsuite: munge recorded TLS version &c in output to permit awkward test-host installations.
Phil Pennock [Sat, 19 May 2012 23:55:15 +0000 (19:55 -0400)]
PRINTF_FUNCTION -> ALMOST_PRINTF.
WANT_DEEPER_PRINTF_CHECKS guards ALMOST_PRINTF being PRINTF_FUNCTION.
Fix some actual issues exposed when I cut down on the spam.
Phil Pennock [Sat, 19 May 2012 23:13:51 +0000 (19:13 -0400)]
Portability to HP-UX.
Report and fix from Michael Haardt.
The resolver library change's assumed typedef was absent, but the
underlying struct __res_state is present. Long type issues for the
arithmetic changes.
Phil Pennock [Sat, 19 May 2012 21:59:09 +0000 (17:59 -0400)]
PCRE_PRERELEASE fix, again
Phil Pennock [Fri, 18 May 2012 23:17:38 +0000 (19:17 -0400)]
Torture the English language slightly less
Phil Pennock [Fri, 18 May 2012 22:22:30 +0000 (18:22 -0400)]
Fix three issues highlighted by clang analyser.
Only crash-plausible issue would require the Cambridge-specific
iplookup router and a misconfiguration.
Report from Marcin Mirosław
Phil Pennock [Fri, 18 May 2012 22:07:55 +0000 (18:07 -0400)]
Test suite fixes, mostly for new certs.
New cert1 and cert2 but I'd only updated the GnuTLS tests.
This fixes OpenSSL ones too.
The SHELL vs /bin/sh one also fixed, finally realised that
the test output just hadn't been updated to match the munging.
Phil Pennock [Fri, 18 May 2012 20:22:04 +0000 (16:22 -0400)]
Document DCC in experimental-spec.txt
Base text from Wolfgang Breyha.
I went over it as someone new to it, to make some obvious-to-experts-but-not-me fixes.
Phil Pennock [Fri, 18 May 2012 19:52:08 +0000 (15:52 -0400)]
Second SPF fix, moved to where type is correct.
De-initialised "type" var in stack declaration, so a repeat of this mistake
would lead to an uninitialized variable usage warning which would have blocked
the previous incorrect fix from being committed.
Phil Pennock [Fri, 18 May 2012 19:46:06 +0000 (15:46 -0400)]
Fix dcc_header content corruption.
(stack memory referenced, read-only, out of scope).
Patch from Wolfgang Breyha, report from Stuart Northfield.
Phil Pennock [Fri, 18 May 2012 19:35:32 +0000 (15:35 -0400)]
SPF multiple strings join on "".
Patch from Janne Snabb.
Phil Pennock [Fri, 18 May 2012 03:04:36 +0000 (23:04 -0400)]
GnuTLS pretty much passes test suite.
Fixed assumption that tls_certificate non-NULL in server when TLS
advertised.
Weakened an !S_ISREG() to an S_ISDIR() to keep the test-suite happy.
Using:
do { rc = gnutls_handshake(state->session);
} while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
is contra-indicated when you expect SIGALRM to be able to break you out
of the loop. A little _too_ robust there. Switching last part to:
(rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen)
is rather more productive.
Only test not passing is 2025, which makes major assumptions about
cipher suites and needs to be revisited to see what it's trying to
achieve. We fail the test because we successfully deliver the message
without expected errors, because other ciphersuites are available, since
we're no longer limited to a *very* short list embedded in the Exim
code. That sort of failure I can live with.
Phil Pennock [Fri, 18 May 2012 02:12:59 +0000 (22:12 -0400)]
Make test-suite client cmd -t<timeout> actually work
Phil Pennock [Fri, 18 May 2012 00:07:04 +0000 (20:07 -0400)]
CRL addition returns count of CRLs added
A couple more cert1/2 strings updated, plus some disambiguating rhubarb.