exim-4.89.1

[bdubbs@…]

New point version.

[bdubbs@…]

Exim version 4.89+fixes

HS/01 Cleanup, prevent repeated use of -p/-oMr (CVE-2017-1000369)

JH/06 Default openssl_options to include +no_ticket, to reduce load on peers.

Disable the session-cache too, which might reduce our load. Since we currrectly use a new context for every connection, both as server and client, there is no benefit for these. GnuTLS appears to not support tickets server-side by default (we don't call gnutls_session_ticket_enable_server()) but client side is enabled by default on recent versions (3.1.3 +) unless the PFS priority string is used (3.2.4 +).

JH/07 Fix smtp transport use of limited max_rcpt under mua_wrapper.

Previously the check for any unsuccessful recipients did not notice the limit, and erroneously found still-pending ones.

JH/19 Bug 2141: Use the full-complex API for Berkeley DB rather than the legacy-

compatible one, to avoid the (poorly documented) possibility of a config file in the working directory redirecting the DB files, possibly correpting some existing file. CVE-2017-10140 assigned for BDB.

JH/20 Bug 2147: Do not defer for a verify-with-callout-and-random which is not

cache-hot. Previously, although the result was properly cached, the initial verify call returned a defer.

JH/21 Bug 2151 (partial):

Avoid using SIZE on the MAIL for a callout verify, on any but

the main verify for receipient in uncached-mode.

JH/26 Fix DKIM bug: when the pseudoheader generated for signing was exactly

the right size to place the terminating semicolon on its own folded line, the header hash was calculated to an incorrect value thanks to the (relaxed) space the fold became.

JH/27 Fix SOCKS bug: an unitialized pointer was deref'd by the transport process

which could crash as a result. This could lead to undeliverable messages.

JH/15 Fix a crash in the smtp transport caused when two hosts in succession

are unsuable for non-message-specific reasons - eg. connection timeout, banner-time rejection.

JH/29 Fix queue_run_in_order to ignore the PID portion of the message ID. This

matters on fast-turnover and PID-randomising systems, which were getting out-of-order delivery.

JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for

a possibly-overlapping copy. The symptom was that "Remote host closed connection in response to HELO" was logged instead of the actual 4xx error for the HELO.

JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.

A crafted sequence of BDAT commands could result in in-use memory beeing freed. CVE-2017-16943.

HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading

from SMTP input. Previously it was always done; now only done for DATA and not BDAT commands. CVE-2017-16944.

[bdubbs@…]

Now version 4.90.

Rework error string handling in TLS interface so that the caller in more cases is responsible for logging. This permits library-sourced string to be attached to addresses during delivery, and collapses pairs of long lines into single ones.

Allow PKG_CONFIG_PATH to be set in Local/Makefile and use it correctly during configuration. Wildcards are allowed and expanded.

Rework error string handling in DKIM to pass more info back to callers. This permits better logging.

Rework the transport continued-connection mechanism: when TLS is active, do not close it down and have the child transport start it up again on the passed-on TCP connection. Instead, proxy the child (and any subsequent ones) for TLS via a unix-domain socket channel. Logging is affected: the continued delivery log lines do not have any DNSSEC, TLS Certificate or OCSP information. TLS cipher information is still logged.

Shorten the log line for daemon startup by collapsing adjacent sets of identical IP addresses on different listening ports. Will also affect "exiwhat" output.

Bug 2070: uClibc defines GLIBC without providing glibc headers; add noisy ifdef guards to special-case this sillyness. Patch from Bernd Kuhls.

Tighten up the checking in isip4 (et al): dotted-quad components larger than 255 are no longer allowed.

Default openssl_options to include +no_ticket, to reduce load on peers. Disable the session-cache too, which might reduce our load. Since we currrectly use a new context for every connection, both as server and client, there is no benefit for these. GnuTLS appears to not support tickets server-side by default (we don't call gnutls_session_ticket_enable_server()) but client side is enabled by default on recent versions (3.1.3 +) unless the PFS priority string is used (3.2.4 +).

Add $SOURCE_DATE_EPOCH support for reproducible builds, per spec at <​https://reproducible-builds.org/specs/source-date-epoch/>.

Fix smtp transport use of limited max_rcpt under mua_wrapper. Previously the check for any unsuccessful recipients did not notice the limit, and erroneously found still-pending ones.

Pipeline CHUNKING command and data together, on kernels that support MSG_MORE. Only in-clear (not on TLS connections).

Avoid using a temporary file during transport using dkim. Unless a transport-filter is involved we can buffer the headers in memory for creating the signature, and read the spool data file once for the signature and again for transmission.

Enable use of sendfile in Linux builds as default. It was disabled in 4.77 as the kernel support then wasn't solid, having issues in 64bit mode. Now, it's been long enough. Add support for FreeBSD also.

Bug 2104: Fix continued use of a transport connection with TLS. In the case where the routing stage had gathered several addresses to send to a host before calling the transport for the first, we previously failed to close down TLS in the old transport process before passing the TCP connection to the new process. The new one sent a STARTTLS command which naturally failed, giving a failed delivery and bloating the retry database. Investigation and fix prototype from Wolfgang Breyha.

Fix check on SMTP command input synchronisation. Previously there were false-negatives in the check that the sender had not preempted a response or prompt from Exim (running as a server), due to that code's lack of awareness of the SMTP input buffering.

Add commandline_checks_require_admin option. Exim drops privileges sanely, various checks such as -be aren't a security problem, as long as you trust local users with access to their own account. When invoked by services which pass untrusted data to Exim, this might be an issue. Set this option in main configuration AND make fixes to the calling application, such as using -- to stop processing options.

Do pipelining under TLS. Previously, although safe, no advantage was taken. Now take care to pack both (client) MAIL,RCPT,DATA, and (server) responses to those, into a single TLS record each way (this usually means a single packet). As a side issue, smtp_enforce_sync now works on TLS connections.

OpenSSL/1.1: use DH_bits() for more accurate DH param sizes. This affects you only if you're dancing at the edge of the param size limits. If you are, and this message makes sense to you, then: raise the configured limit or use OpenSSL 1.1. Nothing we can do for older versions.

For the "sock" variant of the malware scanner interface, accept an empty cmdline element to get the documented default one. Previously it was inaccessible.

Fix a crash in the smtp transport caused when two hosts in succession are unsuable for non-message-specific reasons - eg. connection timeout, banner-time rejection.

Fix logging of delivery remote port, when specified by router, under callout/hold.

Repair manualroute's ability to take options in any order, even if one is the name of a transport. Fixes bug 2140.

Cleanup, prevent repeated use of -p/-oMr (CVE-2017-1000369)

Change the list-building routines interface to use the expanding-string triplet model, for better allocation and copying behaviour.

Prebuild the data-structure for "builtin" macros, for faster startup. Previously it was constructed the first time a possibly-matching string was met in the configuration file input during startup; now it is done during compilation.

Bug 2141: Use the full-complex API for Berkeley DB rather than the legacy- compatible one, to avoid the (poorly documented) possibility of a config file in the working directory redirecting the DB files, possibly correpting some existing file. CVE-2017-10140 assigned for BDB.

Bug 2147: Do not defer for a verify-with-callout-and-random which is not cache-hot. Previously, although the result was properly cached, the initial verify call returned a defer.

Bug 2151: Avoid using SIZE on the MAIL for a callout verify, on any but the main verify for receipient in uncached-mode.

Retire historical build files to an "unsupported" subdir. These are defined as "ones for which we have no current evidence of testing".

DKIM: enforce the DNS pubkey record "h" permitted-hashes optional field, if present. Previously it was ignored.

Start using specified-initialisers in C structure init coding. This is a C99 feature (it's 2017, so now considered safe).

Use one-bit bitfields for flags in the "addr" data structure. Previously if was a fixed-sized field and bitmask ops via macros; it is now more extensible.

GitHub PR 56: Apply MariaDB build fix. Patch provided by Jaroslav Škarvada.

Bug 2161: Fix regression in sieve quoted-printable handling introduced during Coverity cleanups [4.87 JH/47] Diagnosis and fix provided by Michael Fischer v. Mollard.

Fix DKIM bug: when the pseudoheader generated for signing was exactly the right size to place the terminating semicolon on its own folded line, the header hash was calculated to an incorrect value thanks to the (relaxed) space the fold became.

Fix Bug 2130: large writes from the transport subprocess where chunked and confused the parent.

Fix SOCKS bug: an unitialized pointer was deref'd by the transport process which could crash as a result. This could lead to undeliverable messages.

Logging: "next input sent too soon" now shows where input was truncated for log purposes.

Fix queue_run_in_order to ignore the PID portion of the message ID. This matters on fast-turnover and PID-randomising systems, which were getting out-of-order delivery.

Fix a logging bug on aarch64: an unsafe routine was previously used for a possibly-overlapping copy. The symptom was that "Remote host closed connection in response to HELO" was logged instead of the actual 4xx error for the HELO.

Fix CHUNKING code to properly flush the unwanted chunk after an error. Previously only that bufferd was discarded, resulting in SYMTP command desynchronisation.

DKIM: when a message has multiple signatures matching an identity given in dkim_verify_signers, run the dkim acl once for each. Previously only one run was done. Bug 2189.

Downgrade an unfound-list name (usually a typo in the config file) from "panic the current process" to "deliberately defer". The panic log is still written with the problem list name; the mail and reject logs now get a temp-reject line for the message that was being handled, saying something like "domains check lookup or other defer". The SMTP 451 message is still "Temporary local problem".

Fix a use-after-free while reading smtp input for header lines. A crafted sequence of BDAT commands could result in in-use memory beeing freed. CVE-2017-16943.

Fix checking for leading-dot on a line during headers reading from SMTP input. Previously it was always done; now only done for DATA and not BDAT commands. CVE-2017-16944.

Flush received data in BDAT mode after detecting an error fatal to the message (such as an overlong header line). Previously this was not done and we did not exit BDAT mode. Followon from the previous item though a different problem.

[bdubbs@…]

Fixed at revision 19616.