users/jgh/exim.git
10 years agoBetter logging of OCSP fails
Jeremy Harris [Mon, 11 Aug 2014 16:10:12 +0000 (17:10 +0100)]
Better logging of OCSP fails

10 years agoEnable OCSP
Jeremy Harris [Sun, 10 Aug 2014 20:52:24 +0000 (21:52 +0100)]
Enable OCSP

10 years agoAdd (2 0 1) test
Jeremy Harris [Sun, 10 Aug 2014 18:06:47 +0000 (19:06 +0100)]
Add (2 0 1) test

10 years agoChange CV= log line element for dane-verified cert
Jeremy Harris [Sun, 10 Aug 2014 16:25:26 +0000 (17:25 +0100)]
Change CV= log line element for dane-verified cert

10 years agoCapture the knowlege that verification succeeded
Jeremy Harris [Sun, 10 Aug 2014 15:57:15 +0000 (16:57 +0100)]
Capture the knowlege that verification succeeded

10 years agoAdd direct-A test
Jeremy Harris [Sun, 10 Aug 2014 14:55:43 +0000 (15:55 +0100)]
Add direct-A test

10 years agoVerifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)
Jeremy Harris [Sun, 10 Aug 2014 14:00:27 +0000 (15:00 +0100)]
Verifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)

10 years agoDiffs for draft 11
Jeremy Harris [Sun, 10 Aug 2014 13:58:59 +0000 (14:58 +0100)]
Diffs for draft 11

10 years agoCopy latest SMTP-with-DANE - draft 11
Jeremy Harris [Sun, 10 Aug 2014 13:43:59 +0000 (14:43 +0100)]
Copy latest SMTP-with-DANE - draft 11

10 years agoAdd support in the fakens utility for TLSA records
Jeremy Harris [Sun, 10 Aug 2014 11:31:21 +0000 (12:31 +0100)]
Add support in the fakens utility for TLSA records

10 years agoAdd support in the fakens utility for marking records as "secure"
Jeremy Harris [Sun, 10 Aug 2014 10:58:06 +0000 (11:58 +0100)]
Add support in the fakens utility for marking records as "secure"
and returning an AD bit for lookups.

10 years agoOn a host lookup name->MX->A->ip sequence, require both stages to
Jeremy Harris [Sun, 10 Aug 2014 10:49:49 +0000 (11:49 +0100)]
On a host lookup name->MX->A->ip sequence, require both stages to
be dnssec before declaring the lookup was secure.

10 years agoIgnore dane-related debug out in non-dane testcases
Jeremy Harris [Sat, 9 Aug 2014 15:04:37 +0000 (16:04 +0100)]
Ignore dane-related debug out in non-dane testcases

10 years agoDoc updates for work since 4.83 exim-4_84
Jeremy Harris [Sat, 9 Aug 2014 12:44:29 +0000 (13:44 +0100)]
Doc updates for work since 4.83

10 years agoTest development
Jeremy Harris [Fri, 8 Aug 2014 20:37:22 +0000 (21:37 +0100)]
Test development

10 years agoBug 1509: Add parser for DSN spool lines exim-4_84_RC2
Wolfgang Breyha [Fri, 8 Aug 2014 20:04:06 +0000 (13:04 -0700)]
Bug 1509: Add parser for DSN spool lines

DSN support added a new formatted entry to the spool files, this change
  gives exipick the ability to read that entry.

10 years agoTestsuite basics.
Jeremy Harris [Fri, 8 Aug 2014 19:45:24 +0000 (20:45 +0100)]
Testsuite basics.

Not actually excercising DANE yet,
this will take additions in the fakedns and
probably changes in certificates.

10 years agoSketch in library interface
Jeremy Harris [Thu, 7 Aug 2014 21:18:41 +0000 (22:18 +0100)]
Sketch in library interface

10 years agoGeneral discussion of DANE usage
Jeremy Harris [Thu, 7 Aug 2014 19:31:46 +0000 (20:31 +0100)]
General discussion of DANE usage

10 years agoBetter logging of OCSP fails
Jeremy Harris [Mon, 4 Aug 2014 15:03:39 +0000 (16:03 +0100)]
Better logging of OCSP fails

10 years agoDocument $tls_in_ocsp, $tls_out_ocsp
Jeremy Harris [Mon, 4 Aug 2014 13:55:55 +0000 (14:55 +0100)]
Document $tls_in_ocsp, $tls_out_ocsp

10 years agoFix broken EXPERIMENTAL_DSN compile
Jeremy Harris [Sat, 2 Aug 2014 10:26:11 +0000 (11:26 +0100)]
Fix broken EXPERIMENTAL_DSN compile

10 years agoFix development-testing induced crash on second use
Jeremy Harris [Fri, 1 Aug 2014 18:07:56 +0000 (19:07 +0100)]
Fix development-testing induced crash on second use

10 years agoBasic DANE entry points
Jeremy Harris [Fri, 1 Aug 2014 17:16:53 +0000 (18:16 +0100)]
Basic DANE entry points

10 years agoAdd note on Dovecot configuration for authentication. Bug 1512 exim-4_84_RC1
Jeremy Harris [Fri, 1 Aug 2014 08:18:18 +0000 (09:18 +0100)]
Add note on Dovecot configuration for authentication.  Bug 1512

10 years agoAdd interface documentation for the DANE library
Jeremy Harris [Thu, 31 Jul 2014 20:52:48 +0000 (21:52 +0100)]
Add interface documentation for the DANE library

10 years agoFix parsing of quoted parameter values in MIME headers. Bug 1513
Jeremy Harris [Wed, 30 Jul 2014 20:42:38 +0000 (21:42 +0100)]
Fix parsing of quoted parameter values in MIME headers.  Bug 1513

10 years agoCoding style closer to project norms
Jeremy Harris [Tue, 29 Jul 2014 21:27:42 +0000 (22:27 +0100)]
Coding style closer to project norms

10 years agoAdd DANE RFC (6698) for reference
Todd Lyons [Tue, 29 Jul 2014 15:40:38 +0000 (08:40 -0700)]
Add DANE RFC (6698) for reference

10 years agoAdd current draft of SMTP with DANE
Todd Lyons [Tue, 29 Jul 2014 14:33:26 +0000 (07:33 -0700)]
Add current draft of SMTP with DANE

10 years agoCreate a hosts_try_dane transport option, does nothing yet
Todd Lyons [Mon, 24 Mar 2014 18:24:23 +0000 (11:24 -0700)]
Create a hosts_try_dane transport option, does nothing yet

10 years agoFramework to build dane support
Todd Lyons [Wed, 5 Mar 2014 14:17:54 +0000 (06:17 -0800)]
Framework to build dane support

10 years agoFix doc parse error
Todd Lyons [Tue, 29 Jul 2014 12:24:50 +0000 (05:24 -0700)]
Fix doc parse error

10 years agoDocument acl args variables in main variables section
Jeremy Harris [Sat, 26 Jul 2014 13:28:40 +0000 (14:28 +0100)]
Document acl args variables in main variables section

10 years agoFix "default config" section wrt. rfc1413_hosts
Jeremy Harris [Thu, 24 Jul 2014 12:55:00 +0000 (13:55 +0100)]
Fix "default config" section wrt. rfc1413_hosts

10 years agoBug 1506: document change made
Todd Lyons [Wed, 23 Jul 2014 15:11:09 +0000 (08:11 -0700)]
Bug 1506: document change made

10 years agoBug 1506: Silence static checkers.
Lars Mueller [Wed, 23 Jul 2014 14:22:52 +0000 (07:22 -0700)]
Bug 1506: Silence static checkers.

Re-adds a return NULL which was removed because it was redundant. Static
  checkers don't parse the logic, so adding it back to make them happy.

10 years agoBug 1506: Fix static typechecker output
Todd Lyons [Wed, 23 Jul 2014 14:09:06 +0000 (07:09 -0700)]
Bug 1506: Fix static typechecker output

The end of the function can never be reached because the switch is only
  reached if the value it is checking is valid. Putting this return
  silences the warnings.

10 years agoUpdate version numbers, clean docs for next release
Todd Lyons [Wed, 23 Jul 2014 14:08:52 +0000 (07:08 -0700)]
Update version numbers, clean docs for next release

10 years agoDo not sleep for tiny periods, or hang trying to sleep for zero. Bug 1426
Jeremy Harris [Tue, 27 May 2014 20:50:41 +0000 (21:50 +0100)]
Do not sleep for tiny periods, or hang trying to sleep for zero. Bug 1426

10 years agoEnsure timer never set to zero for millisleep. Bug 1426
Jeremy Harris [Mon, 26 May 2014 15:09:37 +0000 (16:09 +0100)]
Ensure timer never set to zero for millisleep.  Bug 1426

10 years agoMassage coding style to project norm
Jeremy Harris [Tue, 22 Jul 2014 21:30:22 +0000 (22:30 +0100)]
Massage coding style to project norm

10 years agoDocumentation/Tests for CVE-2014-2972 fix exim-4_83
Todd Lyons [Fri, 18 Jul 2014 18:42:08 +0000 (11:42 -0700)]
Documentation/Tests for CVE-2014-2972 fix

10 years agoOnly expand integers for integer math once
Tony Finch [Wed, 16 Jul 2014 13:13:39 +0000 (06:13 -0700)]
Only expand integers for integer math once

10 years agoFix regex for Suse when converting spec to ASCII
Todd Lyons [Tue, 15 Jul 2014 19:50:35 +0000 (12:50 -0700)]
Fix regex for Suse when converting spec to ASCII

10 years agoFix parsing of mime headers
Jeremy Harris [Mon, 14 Jul 2014 13:13:22 +0000 (14:13 +0100)]
Fix parsing of mime headers

RFC2045 allows parameter values to be quoted; an embedded semicolon
must then not terminate the parameter.

10 years agoDNSSEC: fix clang warning re && in || precedence
Phil Pennock [Mon, 14 Jul 2014 07:13:13 +0000 (03:13 -0400)]
DNSSEC: fix clang warning re && in || precedence

I looked and AFAICT the compiler guidance gives the correct logical
binding for the code intention.

```
dnsdb.c:362:32: warning: '&&' within '||' [-Wlogical-op-parentheses]
       || dnssec_mode == DEFER && !dns_is_secure(&dnsa)
       ~~ ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
dnsdb.c:362:32: note: place parentheses around the '&&' expression to silence this warning
       || dnssec_mode == DEFER && !dns_is_secure(&dnsa)
                               ^
          (                                            )
```

10 years agoMacOS: fix clang redef warning
Phil Pennock [Mon, 14 Jul 2014 07:10:41 +0000 (03:10 -0400)]
MacOS: fix clang redef warning

10 years agoUse Ustrlen() on a uschar
Phil Pennock [Mon, 14 Jul 2014 07:04:16 +0000 (03:04 -0400)]
Use Ustrlen() on a uschar

10 years agoFix unsigned < 0 check
Phil Pennock [Mon, 14 Jul 2014 06:59:52 +0000 (02:59 -0400)]
Fix unsigned < 0 check

Two places in malware.c were using `fsize`, defined as `unsigned int`,
to receive the result of `lseek()` and then checking if the value was
less than 0.  As clang says:

```
malware.c:1228:46: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
          if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0) {
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~
```

Fix.  Use `off_t`, which we're already using elsewhere, then use
`fsize_uint` to handle off_t being potentially 64-bit, and a
sanity-check on conversion which hopefully won't be optimised away by
compilers.

10 years agoRename T_APL to T_ADDRESSES
Phil Pennock [Mon, 14 Jul 2014 06:49:33 +0000 (02:49 -0400)]
Rename T_APL to T_ADDRESSES

Fixes Github issue #15

Known DNS RRTYPE aliases can be found at
<http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml>
and `T_APL` conflicts with the `APL` RRTYPE, Address Prefix List, in
experimental RFC 3123.

Issue reported compilation issues on OpenBSD.

Instead, use `T_ADDRESSES`.

10 years agoFix TLS SNI, and add regression test cases
Jeremy Harris [Sun, 13 Jul 2014 11:18:09 +0000 (12:18 +0100)]
Fix TLS SNI, and add regression test cases

10 years agoReinstate SNI variables under GnuTLS. Bug 1499 exim-4_83_RC3
Jeremy Harris [Tue, 8 Jul 2014 12:54:53 +0000 (13:54 +0100)]
Reinstate SNI variables under GnuTLS.  Bug 1499

10 years agoTypo in docs, add missing word
Todd Lyons [Thu, 3 Jul 2014 17:29:50 +0000 (10:29 -0700)]
Typo in docs, add missing word

10 years agoAdd cscope files to git ignore list
Todd Lyons [Thu, 3 Jul 2014 17:23:18 +0000 (10:23 -0700)]
Add cscope files to git ignore list

10 years agoEnhance documentation of ${run command parsing.
Todd Lyons [Thu, 3 Jul 2014 15:32:48 +0000 (08:32 -0700)]
Enhance documentation of ${run command parsing.

10 years agoBug 1496: Fix typo in ChangeLog
Todd Lyons [Wed, 2 Jul 2014 14:04:38 +0000 (07:04 -0700)]
Bug 1496: Fix typo in ChangeLog

10 years agoBug 1495: Exiqgrep -C check configfile readability
Andrew Colin Kissa [Wed, 2 Jul 2014 14:00:46 +0000 (07:00 -0700)]
Bug 1495: Exiqgrep -C check configfile readability

10 years agoUse enum for var_entry type
Jeremy Harris [Fri, 20 Jun 2014 12:40:24 +0000 (13:40 +0100)]
Use enum for var_entry type

10 years agoFix build dependencies
Heiko Schlittermann [Tue, 17 Jun 2014 11:18:26 +0000 (12:18 +0100)]
Fix build dependencies

"make distclean; make -j" was failing on config.h

10 years agoCorrect testuite doc
Jeremy Harris [Sun, 15 Jun 2014 15:44:56 +0000 (16:44 +0100)]
Correct testuite doc

10 years agoFix testcase 0390 when testing an EXPERIMENTAL_TPDA compile
Jeremy Harris [Sun, 15 Jun 2014 15:16:32 +0000 (16:16 +0100)]
Fix testcase 0390 when testing an EXPERIMENTAL_TPDA compile

Insert a custom-munge for the new transport option.
This may be removed once the code goes mainline.

10 years agoFix testcase 0373
Jeremy Harris [Sun, 15 Jun 2014 14:48:55 +0000 (15:48 +0100)]
Fix testcase 0373

A readsocket expansion against a unix-domain socket which is
immediately closed.  This gave variable results does to the race of
the write into the client-end versus the close at the server end.
Insert under-testsuite delays to assure sequencing; the testcase
now specifically looks for a write into a closed peer.

10 years agoFix dkim for no-key case under SENDFILE compile. Bug 934
Wolfgang Breyha [Wed, 11 Jun 2014 18:19:49 +0000 (19:19 +0100)]
Fix dkim for no-key case under SENDFILE compile.  Bug 934

Tested-by: <wbreyha@gmx.net>
10 years agoTidy coding style. Bug 934
Jeremy Harris [Wed, 11 Jun 2014 18:17:28 +0000 (19:17 +0100)]
Tidy coding style.  Bug 934

10 years agoUse strict C89 variable declaration positioning
Jeremy Harris [Sun, 8 Jun 2014 20:31:47 +0000 (21:31 +0100)]
Use strict C89 variable declaration positioning

10 years agoPreempt future testsuite integration of EXPERIMENTAL_DSN
Jeremy Harris [Sun, 8 Jun 2014 20:13:07 +0000 (21:13 +0100)]
Preempt future testsuite integration of EXPERIMENTAL_DSN

10 years agoFix testcase for today's faster cpus
Jeremy Harris [Sun, 8 Jun 2014 20:08:31 +0000 (21:08 +0100)]
Fix testcase for today's faster cpus

10 years agoTestcase for udpsend
Jeremy Harris [Sun, 8 Jun 2014 16:49:21 +0000 (17:49 +0100)]
Testcase for udpsend

10 years agoInitial set of warnings for the upcoming release
Jeremy Harris [Fri, 6 Jun 2014 19:17:51 +0000 (20:17 +0100)]
Initial set of warnings for the upcoming release

10 years agoFix testcase for 984702 - the buffer boundary was deliberately
Jeremy Harris [Fri, 6 Jun 2014 16:53:08 +0000 (17:53 +0100)]
Fix testcase for 984702 - the buffer boundary was deliberately
being explored by the test

10 years agoMore care with time types
Jeremy Harris [Fri, 6 Jun 2014 14:58:54 +0000 (15:58 +0100)]
More care with time types

10 years agoFix udpsend and ip_connectedsocket(). exim-4_83_RC2
Tony Finch [Thu, 5 Jun 2014 17:01:11 +0000 (18:01 +0100)]
Fix udpsend and ip_connectedsocket().

The ip_connectedsocket() function's socket type support and error
reporting did not work properly.

10 years agoTidy up OpenSSL certificate signature & sig_algorithm extractor results.
Jeremy Harris [Thu, 5 Jun 2014 14:16:29 +0000 (15:16 +0100)]
Tidy up OpenSSL certificate signature & sig_algorithm extractor results.
Bug 1489

10 years agoCompiler quietening
Jeremy Harris [Wed, 4 Jun 2014 19:11:25 +0000 (20:11 +0100)]
Compiler quietening

10 years agoEnsure output buffer big enough for DSN additions to MAIL FROM. Bug 1482
Jeremy Harris [Mon, 26 May 2014 15:07:33 +0000 (16:07 +0100)]
Ensure output buffer big enough for DSN additions to MAIL FROM.  Bug 1482

10 years agoFix tiny ChangeLog typo
Todd Lyons [Mon, 2 Jun 2014 12:54:39 +0000 (05:54 -0700)]
Fix tiny ChangeLog typo

10 years agoSupport service names for tls_on_connect_ports. Bug 72
Jeremy Harris [Sat, 31 May 2014 14:36:13 +0000 (15:36 +0100)]
Support service names for tls_on_connect_ports.  Bug 72

10 years agoFix doc for $sender_host_dnssec. Bug 1485
Jeremy Harris [Fri, 30 May 2014 13:23:12 +0000 (14:23 +0100)]
Fix doc for $sender_host_dnssec. Bug 1485

10 years agoFix no-ssl build
Jeremy Harris [Fri, 30 May 2014 11:58:26 +0000 (12:58 +0100)]
Fix no-ssl build

10 years agoFix delivery $host in client authenticator in verify/callout. Bug 1476
Jeremy Harris [Thu, 29 May 2014 21:46:48 +0000 (22:46 +0100)]
Fix delivery $host in client authenticator in verify/callout.  Bug 1476

10 years agoLog warnings on presence of deperecated options
Jeremy Harris [Thu, 29 May 2014 20:57:04 +0000 (21:57 +0100)]
Log warnings on presence of deperecated options

10 years agoFix dnssec dnsdb lookup in defer_never mode
Jeremy Harris [Thu, 29 May 2014 20:00:04 +0000 (21:00 +0100)]
Fix dnssec dnsdb lookup in defer_never mode

10 years agoBug 1444: Fix \r\n handling writing spool file
Todd Lyons [Wed, 28 May 2014 15:48:45 +0000 (08:48 -0700)]
Bug 1444: Fix \r\n handling writing spool file

Fix a bug which causes DKIM signatures to fail because what gets
  written to the spool file is different than what gets passed through
  the DKIM code.

10 years agoMerge tag 'exim-4_82_1' exim-4_83_RC1
Todd Lyons [Wed, 28 May 2014 12:12:00 +0000 (05:12 -0700)]
Merge tag 'exim-4_82_1'

Fix Conflicts:
src/src/dmarc.c

10 years agoSECURITY: DMARC uses From header untrusted data exim-4_82_1
Todd Lyons [Mon, 26 May 2014 19:14:16 +0000 (12:14 -0700)]
SECURITY: DMARC uses From header untrusted data

CVE-2014-2957

To find the sending domain, expand_string() was used to directly parse
  the contents of the From header. This passes untrusted data directly
  into an internal function. Convert to use standard internal parsing
  functions.

10 years agoIncrease limit of smtp_confirmation logging from 100 to 256 chars. Bug 1408
Jeremy Harris [Mon, 26 May 2014 15:26:58 +0000 (16:26 +0100)]
Increase limit of smtp_confirmation logging from 100 to 256 chars.  Bug 1408

10 years agoErrorcheck TLS library calls
Jeremy Harris [Mon, 26 May 2014 10:47:30 +0000 (11:47 +0100)]
Errorcheck TLS library calls

10 years agoRestrict certificate name checkin for wildcards.
Jeremy Harris [Mon, 26 May 2014 09:35:50 +0000 (10:35 +0100)]
Restrict certificate name checkin for wildcards.

On more recent OpenSSL library versions the builtin wildcard checking
can take a restriction option that we want, to disallow the more
complex possibilities of wildcarding.

10 years agoMissing initialiser
Jeremy Harris [Sun, 25 May 2014 12:21:39 +0000 (13:21 +0100)]
Missing initialiser

10 years agoAdd OpenSSL version check
Jeremy Harris [Fri, 23 May 2014 17:46:03 +0000 (18:46 +0100)]
Add OpenSSL version check

10 years agoAdd GnuTLS version check
Jeremy Harris [Fri, 23 May 2014 17:32:48 +0000 (18:32 +0100)]
Add GnuTLS version check

10 years agoMove OCSP out of EXPERIMENTAL
Jeremy Harris [Fri, 23 May 2014 14:50:07 +0000 (15:50 +0100)]
Move OCSP out of EXPERIMENTAL

10 years agoCompiler quietening. Bug 907
Jeremy Harris [Thu, 22 May 2014 20:50:27 +0000 (21:50 +0100)]
Compiler quietening.  Bug 907

10 years agoBug 1394: Document how to do per host conn limits
Todd Lyons [Thu, 22 May 2014 20:24:42 +0000 (13:24 -0700)]
Bug 1394: Document how to do per host conn limits

Since the max connections per host setting is computed and enforced
  in the master listening process before the fork, there is no easy
  way to get an accurate connection count once the Proxy Protocol
  negotiation has been done (i.e. in a child process, after the
  fork). Rather than try to use a shared mmap file using CAS in the
  children to manipulate it, we just advise of a crude version of
  max connections per IP be achieved by using ratelimit per_conn in
  the connect ACL.

10 years agoFix doc for dovecot authenticator. Bugs 1448, 1483
Jeremy Harris [Thu, 22 May 2014 15:22:53 +0000 (16:22 +0100)]
Fix doc for dovecot authenticator.  Bugs 1448, 1483

10 years agoRFC3461 support - MIME DSN messages. Bug 118
Wolfgang Breyha [Wed, 21 May 2014 15:21:46 +0000 (16:21 +0100)]
RFC3461 support - MIME DSN messages.    Bug 118

10 years agoEliminate one foolish way to break the build
Jeremy Harris [Tue, 20 May 2014 21:53:48 +0000 (22:53 +0100)]
Eliminate one foolish way to break the build

10 years agoAdd PRDR feature output in -bV
Todd Lyons [Wed, 21 May 2014 14:03:29 +0000 (07:03 -0700)]
Add PRDR feature output in -bV

10 years agoSupport optional server certificate name checking. Bug 1479
Jeremy Harris [Tue, 20 May 2014 20:25:10 +0000 (21:25 +0100)]
Support optional server certificate name checking.  Bug 1479
Enable EXPERIMENTAL_CERTNAMES to include.