diff options
Diffstat (limited to 'debian/patches')
54 files changed, 5887 insertions, 0 deletions
diff --git a/debian/patches/31_eximmanpage.dpatch b/debian/patches/31_eximmanpage.dpatch new file mode 100755 index 0000000..cfbfc26 --- /dev/null +++ b/debian/patches/31_eximmanpage.dpatch @@ -0,0 +1,250 @@ +Description: We ship the binary as exim4 instead of exim, fix manpage + accordingly. +Author: Marc Haber <mh+debian-packages@zugschlus.de>, + Andreas Metzler <ametzler@bebt.de> +Last-Update: 2019-10-17 +Forwarded: not-needed (upstream uses the "exim" name) + +--- a/doc/exim.8 ++++ b/doc/exim.8 +@@ -1,9 +1,9 @@ +-.TH EXIM 8 ++.TH EXIM4 8 + .SH NAME +-exim \- a Mail Transfer Agent ++exim4 \- a Mail Transfer Agent + .SH SYNOPSIS + .nf +-.B exim [options] arguments ... ++.B exim4 [options] arguments ... + .B mailq [options] arguments ... + .B rsmtp [options] arguments ... + .B rmail [options] arguments ... +@@ -40,7 +40,7 @@ local message on the standard input, wit + recipients) is assumed. Thus, for example, if Exim is installed in + \fI/usr/sbin\fP, you can send a message from the command line like this: + .sp +- /usr/sbin/exim -i <recipient-address(es)> ++ /usr/sbin/exim4 -i <recipient-address(es)> + <message content, including all the header lines> + CTRL-D + .sp +@@ -125,8 +125,8 @@ ports, on multiple ports, and only on sp + .sp + When a listening daemon + is started without the use of \fB\-oX\fP (that is, without overriding the normal +-configuration), it writes its process id to a file called exim\-daemon.pid +-in Exim's spool directory. This location can be overridden by setting ++configuration), it writes its process id to a file called ++/run/exim4/exim.pid. This location can be overridden by setting + PID_FILE_PATH in Local/Makefile. The file is written while Exim is still + running as root. + .sp +@@ -180,7 +180,7 @@ available to admin users. + This option operates like \fB\-be\fP except that it must be followed by the name + of a file. For example: + .sp +- exim \-bem /tmp/testmessage ++ exim4 \-bem /tmp/testmessage + .sp + The file is read as a message (as if receiving a locally\-submitted non\-SMTP + message) before any of the test expansions are done. Thus, message\-specific +@@ -206,7 +206,7 @@ If you want to test a system filter file + can use both \fB\-bF\fP and \fB\-bf\fP on the same command, in order to test a system + filter and a user filter in the same run. For example: + .sp +- exim \-bF /system/filter \-bf /user/filter </test/message ++ exim4 \-bF /system/filter \-bf /user/filter </test/message + .sp + This is helpful when the system filter adds header lines or sets filter + variables that are used by the user filter. +@@ -258,8 +258,8 @@ This option runs a fake SMTP session as + standard input and output. The IP address may include a port number at the end, + after a full stop. For example: + .sp +- exim \-bh 10.9.8.7.1234 +- exim \-bh fe80::a00:20ff:fe86:a061.5678 ++ exim4 \-bh 10.9.8.7.1234 ++ exim4 \-bh fe80::a00:20ff:fe86:a061.5678 + .sp + When an IPv6 address is given, it is converted into canonical form. In the case + of the second example above, the value of \fI$sender_host_address\fP after +@@ -417,7 +417,7 @@ main configuration options to be written + of one or more specific options can be requested by giving their names as + arguments, for example: + .sp +- exim \-bP qualify_domain hold_domains ++ exim4 \-bP qualify_domain hold_domains + .sp + However, any option setting that is preceded by the word "hide" in the + configuration file is not shown in full, except to an admin user. For other +@@ -445,7 +445,7 @@ written directly into the spool director + .sp + If \fB\-bP\fP is followed by a name preceded by +, for example, + .sp +- exim \-bP +local_domains ++ exim4 \-bP +local_domains + .sp + it searches for a matching named list of any type (domain, host, address, or + local part) and outputs what it finds. +@@ -454,7 +454,7 @@ If one of the words \fBrouter\fP, \fBtra + followed by the name of an appropriate driver instance, the option settings for + that driver are output. For example: + .sp +- exim \-bP transport local_delivery ++ exim4 \-bP transport local_delivery + .sp + The generic driver options are output first, followed by the driver's private + options. A list of the names of drivers of a particular type can be obtained by +@@ -539,7 +539,7 @@ This option is for testing retry rules, + arguments. It causes Exim to look for a retry rule that matches the values + and to write it to the standard output. For example: + .sp +- exim \-brt bach.comp.mus.example ++ exim4 \-brt bach.comp.mus.example + Retry rule: *.comp.mus.example F,2h,15m; F,4d,30m; + .sp + The first +@@ -552,7 +552,7 @@ rule is found that matches the host, one + sought. Finally, an argument that is the name of a specific delivery error, as + used in setting up retry rules, can be given. For example: + .sp +- exim \-brt haydn.comp.mus.example quota_3d ++ exim4 \-brt haydn.comp.mus.example quota_3d + Retry rule: *@haydn.comp.mus.example quota_3d F,1h,15m + .TP 10 + \fB\-brw\fP +@@ -655,7 +655,7 @@ doing such tests. + .TP 10 + \fB\-bV\fP + This option causes Exim to write the current version number, compilation +-number, and compilation date of the \fIexim\fP binary to the standard output. ++number, and compilation date of the \fIexim4\fP binary to the standard output. + It also lists the DBM library that is being used, the optional modules (such as + specific lookup types), the drivers that are included in the binary, and the + name of the runtime configuration file that is in use. +@@ -683,7 +683,7 @@ If no arguments are given, Exim runs in + right angle bracket for addresses to be verified. + .sp + Unlike the \fB\-be\fP test option, you cannot arrange for Exim to use the +-readline() function, because it is running as \fIexim\fP and there are ++readline() function, because it is running as \fIexim4\fP and there are + security issues. + .sp + Verification differs from address testing (the \fB\-bt\fP option) in that routers +@@ -796,14 +796,14 @@ command line item. \fB\-D\fP can be used + string, in which case the equals sign is optional. These two commands are + synonymous: + .sp +- exim \-DABC ... +- exim \-DABC= ... ++ exim4 \-DABC ... ++ exim4 \-DABC= ... + .sp + To include spaces in a macro definition item, quotes must be used. If you use + quotes, spaces are permitted around the macro name and the equals sign. For + example: + .sp +- exim '\-D ABC = something' ... ++ exim4 '\-D ABC = something' ... + .sp + \fB\-D\fP may be repeated up to 10 times on a command line. + Only macro names up to 22 letters long can be set. +@@ -938,8 +938,8 @@ never provoke a bounce. An empty sender + string, or as a pair of angle brackets with nothing between them, as in these + examples of shell commands: + .sp +- exim \-f '<>' user@domain +- exim \-f "" user@domain ++ exim4 \-f '<>' user@domain ++ exim4 \-f "" user@domain + .sp + In addition, the use of \fB\-f\fP is not restricted when testing a filter file + with \fB\-bf\fP or when testing or verifying addresses using the \fB\-bt\fP or +@@ -1315,12 +1315,12 @@ other circumstances, they are ignored un + The \fB\-oMa\fP option sets the sender host address. This may include a port + number at the end, after a full stop (period). For example: + .sp +- exim \-bs \-oMa 10.9.8.7.1234 ++ exim4 \-bs \-oMa 10.9.8.7.1234 + .sp + An alternative syntax is to enclose the IP address in square brackets, + followed by a colon and the port number: + .sp +- exim \-bs \-oMa [10.9.8.7]:1234 ++ exim4 \-bs \-oMa [10.9.8.7]:1234 + .sp + The IP address is placed in the \fI$sender_host_address\fP variable, and the + port, if present, in \fI$sender_host_port\fP. If both \fB\-oMa\fP and \fB\-bh\fP +@@ -1526,22 +1526,22 @@ If other commandline options specify an + will specify a queue to operate on. + For example: + .sp +- exim \-bp \-qGquarantine ++ exim4 \-bp \-qGquarantine + mailq \-qGquarantine +- exim \-qGoffpeak \-Rf @special.domain.example ++ exim4 \-qGoffpeak \-Rf @special.domain.example + .TP 10 + \fB\-q\fP<\fIqflags\fP> <\fIstart id\fP> <\fIend id\fP> + When scanning the queue, Exim can be made to skip over messages whose ids are + lexically less than a given value by following the \fB\-q\fP option with a + starting message id. For example: + .sp +- exim \-q 0t5C6f\-0000c8\-00 ++ exim4 \-q 0t5C6f\-0000c8\-00 + .sp + Messages that arrived earlier than 0t5C6f\-0000c8\-00 are not inspected. If a + second message id is given, messages whose ids are lexically greater than it + are also skipped. If the same id is given twice, for example, + .sp +- exim \-q 0t5C6f\-0000c8\-00 0t5C6f\-0000c8\-00 ++ exim4 \-q 0t5C6f\-0000c8\-00 0t5C6f\-0000c8\-00 + .sp + just one delivery process is started, for that message. This differs from + \fB\-M\fP in that retry data is respected, and it also differs from \fB\-Mc\fP in +@@ -1557,7 +1557,7 @@ starting a queue runner process at inter + single daemon process handles both functions. A common way of starting up a + combined daemon at system boot time is to use a command such as + .sp +- /usr/exim/bin/exim \-bd \-q30m ++ /usr/sbin/exim4 \-bd \-q30m + .sp + Such a daemon listens for incoming SMTP calls, and also starts a queue runner + process every 30 minutes. +@@ -1588,7 +1588,7 @@ regular expression; otherwise it is a li + If you want to do periodic queue runs for messages with specific recipients, + you can combine \fB\-R\fP with \fB\-q\fP and a time value. For example: + .sp +- exim \-q25m \-R @special.domain.example ++ exim4 \-q25m \-R @special.domain.example + .sp + This example does a queue run for messages with recipients in the given domain + every 25 minutes. Any additional flags that are specified with \fB\-q\fP are +@@ -1704,6 +1704,26 @@ under most shells. + .sp + . + .SH "SEE ALSO" ++.BR exicyclog (8), ++.BR exigrep (8), ++.BR exim_checkaccess (8), ++.BR exim_convert4r4 (8), ++.BR exim_db (8), ++.BR exim_dbmbuild (8), ++.BR exim_lock (8), ++.BR eximon (8), ++.BR exinext (8), ++.BR exiqgrep (8), ++.BR exiqsumm (8), ++.BR exiwhat (8), ++.BR update\-exim4.conf (8), ++.BR update\-exim4defaults (8), ++/usr/share/doc/exim4\-base/, ++/usr/share/doc/exim4\-base/README.Debian.[gz|html]. + .rs + .sp + The full Exim specification, the Exim book, and the Exim wiki. ++ ++.SH AUTHOR ++This manual page was provided with the upstream Exim source package. ++It was enhanced for the Debian GNU/Linux system. diff --git a/debian/patches/32_exim4.dpatch b/debian/patches/32_exim4.dpatch new file mode 100644 index 0000000..967869d --- /dev/null +++ b/debian/patches/32_exim4.dpatch @@ -0,0 +1,106 @@ +Description: Accommodate source for installing exim as exim4. +Author: Andreas Metzler <ametzler@debian.org> +Origin: vendor +Forwarded: not-needed +Last-Update: 2018-12-12 + +--- a/OS/Makefile-Linux ++++ b/OS/Makefile-Linux +@@ -28,9 +28,9 @@ XLFLAGS=-L$(X11)/lib + X11_LD_LIB=$(X11)/lib + + EXIWHAT_PS_ARG=ax +-EXIWHAT_EGREP_ARG='/exim( |$$)' ++EXIWHAT_EGREP_ARG='/exim4( |$$)' + EXIWHAT_MULTIKILL_CMD=killall +-EXIWHAT_MULTIKILL_ARG=exim ++EXIWHAT_MULTIKILL_ARG=exim4 + EXIWHAT_KILL_SIGNAL=-USR1 + + # End +--- a/src/exicyclog.src ++++ b/src/exicyclog.src +@@ -149,7 +149,7 @@ done + + st=' ' + exim_path=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` +-if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim; fi ++if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi + + spool_directory=`$exim_path -C $config -bP spool_directory | sed 's/.*=[ ]*//'` + +--- a/src/exim_checkaccess.src ++++ b/src/exim_checkaccess.src +@@ -52,7 +52,7 @@ done + # a tab to keep the tab in one place. + + exim_path=`perl -ne 'chop;if (/^\s*exim_path\s*=\s*(.*)/){print "$1\n";last;}' $config` +-if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim; fi ++if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi + + + ######################################################################### +--- a/src/eximon.src ++++ b/src/eximon.src +@@ -79,7 +79,7 @@ config=${EXIMON_EXIM_CONFIG-$config} + + st=' ' + EXIM_PATH=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` +-if test "$EXIM_PATH" = ""; then EXIM_PATH=BIN_DIRECTORY/exim; fi ++if test "$EXIM_PATH" = ""; then EXIM_PATH=BIN_DIRECTORY/exim4; fi + + SPOOL_DIRECTORY=`$EXIM_PATH -C $config -bP spool_directory | sed 's/.*=[ ]*//'` + LOG_FILE_PATH=`$EXIM_PATH -C $config -bP log_file_path | sed 's/.*=[ ]*//'` +--- a/src/exinext.src ++++ b/src/exinext.src +@@ -97,7 +97,7 @@ if [ "$exim_path" = "" ]; then + exim_path=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` + fi + +-if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim; fi ++if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi + spool_directory=`$exim_path $eximmacdef -C $config -bP spool_directory | sed 's/.*=[ ]*//'` + qualify_domain=`$exim_path $eximmacdef -C $config -bP qualify_domain | sed 's/.*=[ ]*//'` + +@@ -181,7 +181,7 @@ perl - $exim_path "$eximmacdef" $argone + + # Run exim_dumpdb to get out the retry data and pick off what we want + +- open(DATA, "${exim}_dumpdb $spool retry |") || ++ open(DATA, "/usr/sbin/exim_dumpdb $spool retry |") || + die "can't run exim_dumpdb"; + + while (<DATA>) +--- a/src/exiqgrep.src ++++ b/src/exiqgrep.src +@@ -24,7 +24,7 @@ use Getopt::Std; + use File::Basename; + + # Have this variable point to your exim binary. +-my $exim = 'BIN_DIRECTORY/exim'; ++my $exim = 'BIN_DIRECTORY/exim4'; + my $eargs = '-bpu'; + my %id; + my %opt; +--- a/src/exiwhat.src ++++ b/src/exiwhat.src +@@ -98,7 +98,7 @@ fi + + st=' ' + exim_path=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` +-if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim; fi ++if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi + spool_directory=`$exim_path -C $config -bP spool_directory | sed "s/.*=[ ]*//"` + process_log_path=`$exim_path -C $config -bP process_log_path | sed "s/.*=[ ]*//"` + +--- a/src/globals.c ++++ b/src/globals.c +@@ -906,7 +906,7 @@ const uschar *event_name = NULL; + + + gid_t exim_gid = EXIM_GID; +-uschar *exim_path = US BIN_DIRECTORY "/exim" ++uschar *exim_path = US BIN_DIRECTORY "/exim4" + "\0<---------------Space to patch exim_path->"; + uid_t exim_uid = EXIM_UID; + int expand_level = 0; /* Nesting depth, indent for debug */ diff --git a/debian/patches/33_eximon.binary.dpatch b/debian/patches/33_eximon.binary.dpatch new file mode 100755 index 0000000..e0f5593 --- /dev/null +++ b/debian/patches/33_eximon.binary.dpatch @@ -0,0 +1,17 @@ +Description: We move eximon.bin out of $PATH to /usr/libexec/. Let it be + found there. +Author: Andreas Piesk +Last-Update: 2020-03-21 +Forwarded: not-needed + +--- a/OS/eximon.conf-Default ++++ b/OS/eximon.conf-Default +@@ -5,7 +5,7 @@ + # The name of the eximon binary, usually the same as the eximon script, + # with .bin stuck on the end. + +-EXIMON_BINARY="${EXIMON_BINARY-$0.bin}" ++EXIMON_BINARY="/usr/libexec/exim4/${EXIMON_BINARY-${0##*/}.bin}" + + # The remaining parameters are values likely to be changed to suit the + # user's taste. They are documented in the EDITME file. diff --git a/debian/patches/34_eximstatsmanpage.dpatch b/debian/patches/34_eximstatsmanpage.dpatch new file mode 100755 index 0000000..3245965 --- /dev/null +++ b/debian/patches/34_eximstatsmanpage.dpatch @@ -0,0 +1,20 @@ +Description: Add note about installing perl-modules on Debian to + generated manpage +Author: Andreas Metzler <ametzler@debian.org> +Origin: vendor +Forwarded: not-needed +Last-Update: 2013-09-28 + +--- exim4-4.82~rc1.orig/src/eximstats.src ++++ exim4-4.82~rc1/src/eximstats.src +@@ -501,6 +501,10 @@ To install these, download and unpack th + make test + make install + ++On B<Debian GNU/Linux> you can use ++C<apt-get install libgd-perl libgd-text-perl libgd-graph-perl> ++instead. ++ + =item B<-chartdir>I <dir> + + Create the charts in the directory <dir> diff --git a/debian/patches/35_install.dpatch b/debian/patches/35_install.dpatch new file mode 100755 index 0000000..d0ab602 --- /dev/null +++ b/debian/patches/35_install.dpatch @@ -0,0 +1,49 @@ +Description: Exim's installation scripts install the binary as + exim-<version> - disable this feature. +Author: Andreas Metzler <ametzler@debian.org> +Origin: vendor +Forwarded: not-needed +Last-Update: 2016-09-25 + +--- a/scripts/exim_install ++++ b/scripts/exim_install +@@ -221,6 +221,8 @@ while [ $# -gt 0 ]; do + version=exim-`$exim 2>/dev/null | \ + awk '/Exim version/ { OFS=""; print $3,"-",substr($4,2,length($4)-1) }'`${EXE} + ++ version=exim ++ + if [ "${version}" = "exim-${EXE}" ]; then + echo $com "" + echo $com "*** Could not run $exim to find version number ***" +@@ -370,10 +372,8 @@ done + + + +-# If there is no configuration file, install the default, modifying it to refer +-# to the configured system aliases file. If there is no setting for +-# SYSTEM_ALIASES_FILE, use the traditional /etc/aliases. If the file does not +-# exist, install a default (dummy) for that too. ++# Install default configuration file ++# This is a local Debian modification. + + # However, if CONFIGURE_FILE specifies a list of files, skip this code. + +@@ -396,7 +396,7 @@ elif [ ! -f ${CONFIGURE_FILE} ]; then + ${real} ${MKDIR} -p `${DIRNAME} ${CONFIGURE_FILE}` + + echo sed -e '\\' +- echo " \"/SYSTEM_ALIASES_FILE/ s'SYSTEM_ALIASES_FILE'${ACTUAL_SYSTEM_ALIASES_FILE}'\"" '\\' ++ echo " \"/SYSTEM_ALIASES_FILE/ s'SYSTEM_ALIASES_FILE'/etc/aliases'\"" '\\' + echo " ../src/configure.default > \${CONFIGURE_FILE}" + + # I can't find a way of writing this using the ${real} feature because +@@ -405,7 +405,7 @@ elif [ ! -f ${CONFIGURE_FILE} ]; then + + if [ "$real" = "" ] ; then + sed -e \ +- "/SYSTEM_ALIASES_FILE/ s'SYSTEM_ALIASES_FILE'${ACTUAL_SYSTEM_ALIASES_FILE}'" \ ++ "/SYSTEM_ALIASES_FILE/ s'SYSTEM_ALIASES_FILE'/etc/aliases'" \ + ../src/configure.default > ${CONFIGURE_FILE} + else + true diff --git a/debian/patches/60_convert4r4.dpatch b/debian/patches/60_convert4r4.dpatch new file mode 100755 index 0000000..23fb0ae --- /dev/null +++ b/debian/patches/60_convert4r4.dpatch @@ -0,0 +1,41 @@ +Description: Add a warning message to convert4r4 +Author: Marc Haber <mh+debian-packages@zugschlus.de> +Origin: vendor +Forwarded: not-needed +Last-Update: 2013-09-28 + +--- a/src/convert4r4.src ++++ b/src/convert4r4.src +@@ -666,6 +666,32 @@ return defined $main{$_[0]} && $main{$_[ + + print STDERR "Runtime configuration file converter for Exim release 4.\n"; + ++if( !defined $ENV{"CONVERT4R4"} || $ENV{"CONVERT4R4"} ne "I understand this is an unsupported tool" ) { ++ ++ print STDERR <<EOF; ++convert4r4 on Debian GNU/Linux deprecated ++ ++This tool is unsupported by upstream and discouraged by the Debian Exim 4 ++maintainers. It has multiple known bugs, and you need to manually ++review its output after using it anyway. Please seriously consider complete ++manual regeneration of the Exim 4 configuration, preferably by using the new ++Debconf interface to Exim 4. ++ ++If you decide to ignore this advice and to use this script anyway, ++setting the environment variable CONVERT4R4 to the value ++\"I understand this is an unsupported tool\" ++will allow you to run the script. If you find bugs, you get to keep ++the pieces. Please do not file bugs against this script in the Debian ++BTS without providing a patch fixing the bugs, and please do not ++expect the upstream exim-users mailing list to answer questions. ++ ++Kind regards ++the Debian Exim4 Maintainers ++EOF ++ ++ exit 1; ++} ++ + $transport_start = $director_start = $router_start = $retry_start + = $rewrite_start = $auth_start = 999999; + diff --git a/debian/patches/67_unnecessaryCopt.diff b/debian/patches/67_unnecessaryCopt.diff new file mode 100644 index 0000000..daae1e4 --- /dev/null +++ b/debian/patches/67_unnecessaryCopt.diff @@ -0,0 +1,69 @@ +Description: Stop using exim's -C option in utility scripts (exiwhat + et al.) since this breaks with ALT_CONFIG_PREFIX. +Author: Andreas Metzler <ametzler@bebt.de> +Forwarded: http://bugs.exim.org/show_bug.cgi?id=1045 +Last-Update: 2018-12-31 + +--- a/src/exicyclog.src ++++ b/src/exicyclog.src +@@ -151,10 +151,10 @@ st=' ' + exim_path=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` + if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi + +-spool_directory=`$exim_path -C $config -bP spool_directory | sed 's/.*=[ ]*//'` ++spool_directory=`$exim_path -bP spool_directory | sed 's/.*=[ ]*//'` + + if [ "$log_file_path" = "" ] ; then +- log_file_path=`$exim_path -C $config -bP log_file_path | sed 's/.*=[ ]*//'` ++ log_file_path=`$exim_path -bP log_file_path | sed 's/.*=[ ]*//'` + fi + + # If log_file_path contains only "syslog" then no Exim log files are in use. +--- a/src/eximon.src ++++ b/src/eximon.src +@@ -81,8 +81,8 @@ st=' ' + EXIM_PATH=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` + if test "$EXIM_PATH" = ""; then EXIM_PATH=BIN_DIRECTORY/exim4; fi + +-SPOOL_DIRECTORY=`$EXIM_PATH -C $config -bP spool_directory | sed 's/.*=[ ]*//'` +-LOG_FILE_PATH=`$EXIM_PATH -C $config -bP log_file_path | sed 's/.*=[ ]*//'` ++SPOOL_DIRECTORY=`$EXIM_PATH -bP spool_directory | sed 's/.*=[ ]*//'` ++LOG_FILE_PATH=`$EXIM_PATH -bP log_file_path | sed 's/.*=[ ]*//'` + + # If log_file_path is "syslog" then logging is only to syslog, and the monitor + # is unable to display a log tail unless EXIMON_LOG_FILE_PATH is set to tell +--- a/src/exinext.src ++++ b/src/exinext.src +@@ -98,8 +98,8 @@ if [ "$exim_path" = "" ]; then + fi + + if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi +-spool_directory=`$exim_path $eximmacdef -C $config -bP spool_directory | sed 's/.*=[ ]*//'` +-qualify_domain=`$exim_path $eximmacdef -C $config -bP qualify_domain | sed 's/.*=[ ]*//'` ++spool_directory=`$exim_path $eximmacdef -bP spool_directory | sed 's/.*=[ ]*//'` ++qualify_domain=`$exim_path $eximmacdef -bP qualify_domain | sed 's/.*=[ ]*//'` + + # Now do the job. Perl uses $ so frequently that we don't want to have to + # escape them all from the shell, so pass in shell variable values as +@@ -144,7 +144,7 @@ perl - $exim_path "$eximmacdef" $argone + # Run Exim to get a list of hosts for the given domain; for + # each one construct the appropriate retry key. + +- open(LIST, "$exim -C $config -v -bt $address |") || ++ open(LIST, "$exim -v -bt $address |") || + die "can't run exim to route $address"; + + while (<LIST>) +--- a/src/exiwhat.src ++++ b/src/exiwhat.src +@@ -99,8 +99,8 @@ fi + st=' ' + exim_path=`grep "^[$st]*exim_path" $config | sed "s/.*=[$st]*//"` + if test "$exim_path" = ""; then exim_path=BIN_DIRECTORY/exim4; fi +-spool_directory=`$exim_path -C $config -bP spool_directory | sed "s/.*=[ ]*//"` +-process_log_path=`$exim_path -C $config -bP process_log_path | sed "s/.*=[ ]*//"` ++spool_directory=`$exim_path -bP spool_directory | sed "s/.*=[ ]*//"` ++process_log_path=`$exim_path -bP process_log_path | sed "s/.*=[ ]*//"` + + # The file that Exim writes when sent the SIGUSR1 signal is specified by + # the process_log_path option. If that is not defined, Exim uses the file diff --git a/debian/patches/70_remove_exim-users_references.dpatch b/debian/patches/70_remove_exim-users_references.dpatch new file mode 100755 index 0000000..f3dda95 --- /dev/null +++ b/debian/patches/70_remove_exim-users_references.dpatch @@ -0,0 +1,38 @@ +Description: Point Debian users to Debian specific ML. +Author: Marc Haber <mh+debian-packages@zugschlus.de> +Last-Update: 2018-12-31 +Forwarded: not-needed + +--- a/README ++++ b/README +@@ -14,8 +14,16 @@ from Exim 3, though the basic structure + older book may be helpful for the background, but a lot of the detail has + changed, so it is likely to be confusing to newcomers. + +-There is a website at https://www.exim.org; this contains details of the +-mailing list exim-users@exim.org. ++Information about the way Debian has built the binary packages is ++obtainable in /usr/share/doc/exim4-base/README.Debian.gz, and there ++is a Debian-centered mailing list, ++pkg-exim4-users@lists.alioth.debian.org. Please ask Debian-specific ++questions there, and only write to the upstream exim-users mailing ++list if you are sure that your question is not Debian-specific. You ++can find the subscription web page on ++http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users ++ ++There is a website at https://www.exim.org/. + + A copy of the Exim FAQ should be available from the same source that you used + to obtain the Exim distribution. Additional formats for the documentation +--- a/src/eximstats.src ++++ b/src/eximstats.src +@@ -537,8 +537,7 @@ about how to create charts from the tabl + + =head1 AUTHOR + +-There is a website at https://www.exim.org - this contains details of the +-mailing list exim-users@exim.org. ++There is a website at https://www.exim.org/. + + =head1 TO DO + diff --git a/debian/patches/75_01-Fix-exit-on-attempt-to-rewrite-a-malformed-address.-.patch b/debian/patches/75_01-Fix-exit-on-attempt-to-rewrite-a-malformed-address.-.patch new file mode 100644 index 0000000..bf0f649 --- /dev/null +++ b/debian/patches/75_01-Fix-exit-on-attempt-to-rewrite-a-malformed-address.-.patch @@ -0,0 +1,57 @@ +From e7ec503729970a03d4509921342bc81313976126 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Tue, 12 Jul 2022 22:14:04 +0100 +Subject: [PATCH] Fix exit on attempt to rewrite a malformed address. Bug 2903 + +--- + doc/ChangeLog | 5 + + src/rewrite.c | 9 +- + test/confs/0471 | 7 + + test/log/0471 | 5 + + test/scripts/0000-Basic/0471 | 4 +- + test/stderr/0471 | 245 ++++++++++++++++++++++++++++++++++- + 6 files changed, 267 insertions(+), 8 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -1,9 +1,14 @@ + This document describes *changes* to previous versions, that might + affect Exim's operation, with an unchanged configuration file. For new + options, and new features, see the NewStuff file next to this ChangeLog. + ++JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address. ++ Make the rewrite never match and keep the logging. Trust the ++ admin to be using verify=header-syntax (to actually reject the message). ++ ++ + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from + after reception to before a subsequent reception. This should +--- a/src/rewrite.c ++++ b/src/rewrite.c +@@ -493,19 +493,18 @@ + empty address, overlong addres. Sometimes the result matters, sometimes not. + It seems this function is called for *any* header we see. */ + + if (!recipient) + { +- /* Handle unparesable addresses in the header. Slightly ugly because a ++ /* Log unparesable addresses in the header. Slightly ugly because a + null output from the extract can also result from a header without an +- address, "To: undisclosed recpients:;" being the classic case. */ ++ address, "To: undisclosed recpients:;" being the classic case. Ignore ++ this one and carry on. */ + + if ((rewrite_rules || routed_old) && Ustrcmp(errmess, "empty address") != 0) +- { + log_write(0, LOG_MAIN, "rewrite: %s", errmess); +- exim_exit(EXIT_FAILURE); +- } ++ + loop_reset_point = store_reset(loop_reset_point); + continue; + } + + /* If routed_old is not NULL, this is a rewrite caused by a router, diff --git a/debian/patches/75_05-SPF-fix-memory-accounting-for-error-case.patch b/debian/patches/75_05-SPF-fix-memory-accounting-for-error-case.patch new file mode 100644 index 0000000..e474acf --- /dev/null +++ b/debian/patches/75_05-SPF-fix-memory-accounting-for-error-case.patch @@ -0,0 +1,25 @@ +From 93c722ce0549360af68269f088f4e59ed8fc130e Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sun, 7 Aug 2022 17:00:27 +0100 +Subject: [PATCH] SPF: fix memory accounting for error case + +--- + src/spf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/spf.c b/src/spf.c +index db6eea3a8..a8c0f75c4 100644 +--- a/src/spf.c ++++ b/src/spf.c +@@ -204,7 +204,7 @@ spf_nxdomain = SPF_dns_rr_new_init(spf_dns_server, + "", ns_t_any, 24 * 60 * 60, HOST_NOT_FOUND); + if (!spf_nxdomain) + { +- free(spf_dns_server); ++ store_free(spf_dns_server); + return NULL; + } + +-- +2.35.1 + diff --git a/debian/patches/75_08-Fix-regex-n-use-after-free.-Bug-2915.patch b/debian/patches/75_08-Fix-regex-n-use-after-free.-Bug-2915.patch new file mode 100644 index 0000000..be6ccae --- /dev/null +++ b/debian/patches/75_08-Fix-regex-n-use-after-free.-Bug-2915.patch @@ -0,0 +1,196 @@ +From 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Wed, 31 Aug 2022 15:37:40 +0100 +Subject: [PATCH] Fix $regex<n> use-after-free. Bug 2915 + +--- + doc/ChangeLog | 8 +++++++- + src/exim.c | 4 +--- + src/expand.c | 2 +- + src/functions.h | 1 + + src/globals.c | 2 +- + src/regex.c | 29 ++++++++++++++++++----------- + src/smtp_in.c | 2 ++ + test/confs/4002 | 10 ++++++++++ + test/mail/4002.userx | 7 +++++++ + test/scripts/4000-scanning/4002 | 7 +++++++ + 10 files changed, 55 insertions(+), 17 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -4,15 +4,21 @@ + + JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address. + Make the rewrite never match and keep the logging. Trust the + admin to be using verify=header-syntax (to actually reject the message). + ++JH/08 Bug 2915: Fix use-after-free for $regex<n> variables. Previously when ++ more than one message arrived in a single connection a reference from ++ the earlier message could be re-used. Often a sigsegv resulted. ++ These variables were introduced in Exim 4.87. ++ Debug help from Graeme Fowler. ++ + + Exim version 4.96 + ----------------- + +-JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from ++JH/01 Move the wait-for-next-tick (needed for unique message IDs) from + after reception to before a subsequent reception. This should + mean slightly faster delivery, and also confirmation of reception + to senders. + + JH/02 Move from using the pcre library to pcre2. The former is no longer +--- a/src/exim.c ++++ b/src/exim.c +@@ -1999,12 +1999,10 @@ + + regex_whitelisted_macro = + regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE); + #endif + +-for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; +- + /* If the program is called as "mailq" treat it as equivalent to "exim -bp"; + this seems to be a generally accepted convention, since one finds symbolic + links called "mailq" in standard OS configurations. */ + + if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) || +@@ -6082,11 +6080,11 @@ + callout_address = NULL; + sending_ip_address = NULL; + deliver_localpart_data = deliver_domain_data = + recipient_data = sender_data = NULL; + acl_var_m = NULL; +- for(int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++ regex_vars_clear(); + + store_reset(reset_point); + } + + exim_exit(EXIT_SUCCESS); /* Never returns */ +--- a/src/expand.c ++++ b/src/expand.c +@@ -1871,11 +1871,11 @@ + { + tree_node * node = tree_search(router_var, name + 2); + return node ? node->data.ptr : strict_acl_vars ? NULL : US""; + } + +-/* Handle $auth<n> variables. */ ++/* Handle $auth<n>, $regex<n> variables. */ + + if (Ustrncmp(name, "auth", 4) == 0) + { + uschar *endptr; + int n = Ustrtoul(name + 4, &endptr, 10); +--- a/src/functions.h ++++ b/src/functions.h +@@ -436,10 +436,11 @@ + extern int regex(const uschar **); + #endif + extern BOOL regex_match(const pcre2_code *, const uschar *, int, uschar **); + extern BOOL regex_match_and_setup(const pcre2_code *, const uschar *, int, int); + extern const pcre2_code *regex_must_compile(const uschar *, BOOL, BOOL); ++extern void regex_vars_clear(void); + extern void retry_add_item(address_item *, uschar *, int); + extern BOOL retry_check_address(const uschar *, host_item *, uschar *, BOOL, + uschar **, uschar **); + extern retry_config *retry_find_config(const uschar *, const uschar *, int, int); + extern BOOL retry_ultimate_address_timeout(uschar *, const uschar *, +--- a/src/globals.c ++++ b/src/globals.c +@@ -1313,11 +1313,11 @@ + #ifndef DISABLE_PIPE_CONNECT + const pcre2_code *regex_EARLY_PIPE = NULL; + #endif + const pcre2_code *regex_ismsgid = NULL; + const pcre2_code *regex_smtp_code = NULL; +-const uschar *regex_vars[REGEX_VARS]; ++const uschar *regex_vars[REGEX_VARS] = { 0 };; + #ifdef WHITELIST_D_MACROS + const pcre2_code *regex_whitelisted_macro = NULL; + #endif + #ifdef WITH_CONTENT_SCAN + uschar *regex_match_string = NULL; +--- a/src/regex.c ++++ b/src/regex.c +@@ -94,22 +94,32 @@ + } + pcre2_match_data_free(md); + return FAIL; + } + ++ ++/* reset expansion variables */ ++void ++regex_vars_clear(void) ++{ ++regex_match_string = NULL; ++for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++} ++ ++ ++ + int +-regex(const uschar **listptr) ++regex(const uschar ** listptr) + { + unsigned long mbox_size; +-FILE *mbox_file; +-pcre_list *re_list_head; +-uschar *linebuffer; ++FILE * mbox_file; ++pcre_list * re_list_head; ++uschar * linebuffer; + long f_pos = 0; + int ret = FAIL; + +-/* reset expansion variable */ +-regex_match_string = NULL; ++regex_vars_clear(); + + if (!mime_stream) /* We are in the DATA ACL */ + { + if (!(mbox_file = spool_mbox(&mbox_size, NULL, NULL))) + { /* error while spooling */ +@@ -167,18 +177,17 @@ + + + int + mime_regex(const uschar **listptr) + { +-pcre_list *re_list_head = NULL; +-FILE *f; +-uschar *mime_subject = NULL; ++pcre_list * re_list_head = NULL; ++FILE * f; ++uschar * mime_subject = NULL; + int mime_subject_len = 0; + int ret; + +-/* reset expansion variable */ +-regex_match_string = NULL; ++regex_vars_clear(); + + /* precompile our regexes */ + if (!(re_list_head = compile(*listptr))) + return FAIL; /* no regexes -> nothing to do */ + +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -2155,12 +2155,14 @@ + prdr_requested = FALSE; + #endif + #ifdef SUPPORT_I18N + message_smtputf8 = FALSE; + #endif ++regex_vars_clear(); + body_linecount = body_zerocount = 0; + ++lookup_value = NULL; /* Can be set by ACL */ + sender_rate = sender_rate_limit = sender_rate_period = NULL; + ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */ + /* Note that ratelimiters_conn persists across resets. */ + + /* Reset message ACL variables */ diff --git a/debian/patches/75_09-Fix-non-WITH_CONTENT_SCAN-build.patch b/debian/patches/75_09-Fix-non-WITH_CONTENT_SCAN-build.patch new file mode 100644 index 0000000..6071fa7 --- /dev/null +++ b/debian/patches/75_09-Fix-non-WITH_CONTENT_SCAN-build.patch @@ -0,0 +1,58 @@ +From d8ecc7bf97934a1e2244788c610c958cacd740bd Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Wed, 31 Aug 2022 17:03:37 +0100 +Subject: [PATCH 1/3] Fix non-WITH_CONTENT_SCAN build. + +Broken-by: 4e9ed49f8f +--- + src/exim.c | 11 +++++++++++ + src/regex.c | 10 ---------- + 2 files changed, 11 insertions(+), 10 deletions(-) + +--- a/src/exim.c ++++ b/src/exim.c +@@ -1677,10 +1677,21 @@ + if ((s = expand_string(big_buffer))) printf("%s\n", CS s); + else printf("Failed: %s\n", expand_string_message); + } + + ++/* reset regex expansion variables */ ++void ++regex_vars_clear(void) ++{ ++regex_match_string = NULL; ++for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++} ++ ++ ++ ++ + + /************************************************* + * Entry point and high-level code * + *************************************************/ + +--- a/src/regex.c ++++ b/src/regex.c +@@ -95,20 +95,10 @@ + pcre2_match_data_free(md); + return FAIL; + } + + +-/* reset expansion variables */ +-void +-regex_vars_clear(void) +-{ +-regex_match_string = NULL; +-for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; +-} +- +- +- + int + regex(const uschar ** listptr) + { + unsigned long mbox_size; + FILE * mbox_file; diff --git a/debian/patches/75_10-Fix-non-WITH_CONTENT_SCAN-build-2.patch b/debian/patches/75_10-Fix-non-WITH_CONTENT_SCAN-build-2.patch new file mode 100644 index 0000000..0a8ed51 --- /dev/null +++ b/debian/patches/75_10-Fix-non-WITH_CONTENT_SCAN-build-2.patch @@ -0,0 +1,135 @@ +From 158dff9936e36a2d31d037d3988b9353458d6471 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Wed, 31 Aug 2022 17:17:59 +0100 +Subject: [PATCH 2/3] Fix non-WITH_CONTENT_SCAN build (2) + +Broken-by: d8ecc7bf97 +--- + src/exim.c | 13 +------------ + src/functions.h | 2 +- + src/globals.h | 2 +- + src/regex.c | 10 ++++++++++ + src/smtp_in.c | 2 ++ + 5 files changed, 15 insertions(+), 14 deletions(-) + +--- a/src/exim.c ++++ b/src/exim.c +@@ -1677,21 +1677,10 @@ + if ((s = expand_string(big_buffer))) printf("%s\n", CS s); + else printf("Failed: %s\n", expand_string_message); + } + + +-/* reset regex expansion variables */ +-void +-regex_vars_clear(void) +-{ +-regex_match_string = NULL; +-for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; +-} +- +- +- +- + + /************************************************* + * Entry point and high-level code * + *************************************************/ + +@@ -6085,17 +6074,17 @@ + deliver_domain_orig = NULL; + deliver_host = deliver_host_address = NULL; + dnslist_domain = dnslist_matched = NULL; + #ifdef WITH_CONTENT_SCAN + malware_name = NULL; ++ regex_vars_clear(); + #endif + callout_address = NULL; + sending_ip_address = NULL; + deliver_localpart_data = deliver_domain_data = + recipient_data = sender_data = NULL; + acl_var_m = NULL; +- regex_vars_clear(); + + store_reset(reset_point); + } + + exim_exit(EXIT_SUCCESS); /* Never returns */ +--- a/src/functions.h ++++ b/src/functions.h +@@ -432,15 +432,15 @@ + extern BOOL receive_msg(BOOL); + extern int_eximarith_t receive_statvfs(BOOL, int *); + extern void receive_swallow_smtp(void); + #ifdef WITH_CONTENT_SCAN + extern int regex(const uschar **); ++extern void regex_vars_clear(void); + #endif + extern BOOL regex_match(const pcre2_code *, const uschar *, int, uschar **); + extern BOOL regex_match_and_setup(const pcre2_code *, const uschar *, int, int); + extern const pcre2_code *regex_must_compile(const uschar *, BOOL, BOOL); +-extern void regex_vars_clear(void); + extern void retry_add_item(address_item *, uschar *, int); + extern BOOL retry_check_address(const uschar *, host_item *, uschar *, BOOL, + uschar **, uschar **); + extern retry_config *retry_find_config(const uschar *, const uschar *, int, int); + extern BOOL retry_ultimate_address_timeout(uschar *, const uschar *, +--- a/src/globals.h ++++ b/src/globals.h +@@ -895,16 +895,16 @@ + #ifndef DISABLE_PIPE_CONNECT + extern const pcre2_code *regex_EARLY_PIPE; /* For recognizing PIPE_CONNCT */ + #endif + extern const pcre2_code *regex_ismsgid; /* Compiled r.e. for message ID */ + extern const pcre2_code *regex_smtp_code; /* For recognizing SMTP codes */ +-extern const uschar *regex_vars[]; /* $regexN variables */ + #ifdef WHITELIST_D_MACROS + extern const pcre2_code *regex_whitelisted_macro; /* For -D macro values */ + #endif + #ifdef WITH_CONTENT_SCAN + extern uschar *regex_match_string; /* regex that matched a line (regex ACL condition) */ ++extern const uschar *regex_vars[]; + #endif + extern int remote_delivery_count; /* Number of remote addresses */ + extern int remote_max_parallel; /* Maximum parallel delivery */ + extern uschar *remote_sort_domains; /* Remote domain sorting order */ + extern retry_config *retries; /* Chain of retry config information */ +--- a/src/regex.c ++++ b/src/regex.c +@@ -95,10 +95,20 @@ + pcre2_match_data_free(md); + return FAIL; + } + + ++/* reset expansion variables */ ++void ++regex_vars_clear(void) ++{ ++regex_match_string = NULL; ++for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL; ++} ++ ++ ++ + int + regex(const uschar ** listptr) + { + unsigned long mbox_size; + FILE * mbox_file; +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -2155,11 +2155,13 @@ + prdr_requested = FALSE; + #endif + #ifdef SUPPORT_I18N + message_smtputf8 = FALSE; + #endif ++#ifdef WITH_CONTENT_SCAN + regex_vars_clear(); ++#endif + body_linecount = body_zerocount = 0; + + lookup_value = NULL; /* Can be set by ACL */ + sender_rate = sender_rate_limit = sender_rate_period = NULL; + ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */ diff --git a/debian/patches/75_11-Fix-non-WITH_CONTENT_SCAN-build-3.patch b/debian/patches/75_11-Fix-non-WITH_CONTENT_SCAN-build-3.patch new file mode 100644 index 0000000..b06d896 --- /dev/null +++ b/debian/patches/75_11-Fix-non-WITH_CONTENT_SCAN-build-3.patch @@ -0,0 +1,45 @@ +From 32da6327e434e986a18b75a84f2d8c687ba14619 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 1 Sep 2022 15:54:35 +0100 +Subject: [PATCH 3/3] Fix non-WITH_CONTENT_SCAN build (3) + +Broken-by: d8ecc7bf97 +--- + src/expand.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/expand.c b/src/expand.c +index 89de56255..831ca2b75 100644 +--- a/src/expand.c ++++ b/src/expand.c +@@ -1869,6 +1869,7 @@ if (Ustrncmp(name, "auth", 4) == 0) + if (!*endptr && n != 0 && n <= AUTH_VARS) + return auth_vars[n-1] ? auth_vars[n-1] : US""; + } ++#ifdef WITH_CONTENT_SCAN + else if (Ustrncmp(name, "regex", 5) == 0) + { + uschar *endptr; +@@ -1876,6 +1877,7 @@ else if (Ustrncmp(name, "regex", 5) == 0) + if (!*endptr && n != 0 && n <= REGEX_VARS) + return regex_vars[n-1] ? regex_vars[n-1] : US""; + } ++#endif + + /* For all other variables, search the table */ + +@@ -8715,9 +8717,11 @@ assert_variable_notin() treats as const, so deconst is safe. */ + for (int i = 0; i < AUTH_VARS; i++) if (auth_vars[i]) + assert_variable_notin(US"auth<n>", US auth_vars[i], &e); + ++#ifdef WITH_CONTENT_SCAN + /* check regex<n> variables. assert_variable_notin() treats as const. */ + for (int i = 0; i < REGEX_VARS; i++) if (regex_vars[i]) + assert_variable_notin(US"regex<n>", US regex_vars[i], &e); ++#endif + + /* check known-name variables */ + for (var_entry * v = var_table; v < var_table + var_table_size; v++) +-- +2.35.1 + diff --git a/debian/patches/75_16-GnuTLS-fix-for-clients-offering-no-TLS-extensions.patch b/debian/patches/75_16-GnuTLS-fix-for-clients-offering-no-TLS-extensions.patch new file mode 100644 index 0000000..ae2fa16 --- /dev/null +++ b/debian/patches/75_16-GnuTLS-fix-for-clients-offering-no-TLS-extensions.patch @@ -0,0 +1,114 @@ +From ece23f05d6a430a461a75639197271c23f6858ec Mon Sep 17 00:00:00 2001 +From: Jasen Betts <jasen@xnet.co.nz> +Date: Fri, 30 Sep 2022 13:49:41 +0100 +Subject: [PATCH] GnuTLS: fix for clients offering no TLS extensions + +--- + doc/ChangeLog | 3 +++ + src/tls-gnu.c | 3 ++- + src/tls-openssl.c | 39 +++++++++++++++--------------- + test/confs/2091 | 1 + + test/log/2091 | 3 +++ + test/scripts/2090-GnuTLS-ALPN/2091 | 19 +++++++++++++++ + test/stdout/2091 | 21 ++++++++++++++++ + 7 files changed, 68 insertions(+), 21 deletions(-) + create mode 120000 test/confs/2091 + create mode 100644 test/log/2091 + create mode 100644 test/scripts/2090-GnuTLS-ALPN/2091 + create mode 100644 test/stdout/2091 + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -10,10 +10,14 @@ + more than one message arrived in a single connection a reference from + the earlier message could be re-used. Often a sigsegv resulted. + These variables were introduced in Exim 4.87. + Debug help from Graeme Fowler. + ++JH/10 GnuTLS: fix for (IOT?) clients offering no TLS extensions at all. ++ Find and fix by Jasen Betts. ++ ++ + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/tls-gnu.c ++++ b/src/tls-gnu.c +@@ -1130,12 +1130,13 @@ + static int + tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype, + unsigned when, unsigned int incoming, const gnutls_datum_t * msg) + { + /* Call fn for each extension seen. 3.6.3 onwards */ +-return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg, ++int rc = gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg, + GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO); ++return rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE ? 0 : rc; + } + + + # ifdef notdef_crashes + /* Make a note that we saw a status-response */ +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -940,40 +940,39 @@ + + Returns: nothing + */ + + static void +-info_callback(SSL *s, int where, int ret) ++info_callback(SSL * s, int where, int ret) + { + DEBUG(D_tls) + { +- const uschar * str; ++ gstring * g = NULL; + +- if (where & SSL_ST_CONNECT) +- str = US"SSL_connect"; +- else if (where & SSL_ST_ACCEPT) +- str = US"SSL_accept"; +- else +- str = US"SSL info (undefined)"; ++ if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect"); ++ if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept"); ++ if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg"); ++ if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit"); ++ if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read"); ++ if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write"); ++ if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert"); ++ if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start"); ++ if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done"); + + if (where & SSL_CB_LOOP) +- debug_printf("%s: %s\n", str, SSL_state_string_long(s)); ++ debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s)); + else if (where & SSL_CB_ALERT) +- debug_printf("SSL3 alert %s:%s:%s\n", +- str = where & SSL_CB_READ ? US"read" : US"write", ++ debug_printf("SSL %s %s:%s\n", g->s, + SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret)); + else if (where & SSL_CB_EXIT) + { +- if (ret == 0) +- debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s)); +- else if (ret < 0) +- debug_printf("%s: error in %s\n", str, SSL_state_string_long(s)); ++ if (ret <= 0) ++ debug_printf("SSL %s: %s in %s\n", g->s, ++ ret == 0 ? "failed" : "error", SSL_state_string_long(s)); + } +- else if (where & SSL_CB_HANDSHAKE_START) +- debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s)); +- else if (where & SSL_CB_HANDSHAKE_DONE) +- debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s)); ++ else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE)) ++ debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s)); + } + } + + #ifdef OPENSSL_HAVE_KEYLOG_CB + static void diff --git a/debian/patches/75_18-Fix-Build-with-libopendmarc-1.4.x-fixes-2728.patch b/debian/patches/75_18-Fix-Build-with-libopendmarc-1.4.x-fixes-2728.patch new file mode 100644 index 0000000..f261d62 --- /dev/null +++ b/debian/patches/75_18-Fix-Build-with-libopendmarc-1.4.x-fixes-2728.patch @@ -0,0 +1,88 @@ +From 1561c5d88b3a23a4348d8e3c1ce28554fcbcfe46 Mon Sep 17 00:00:00 2001 +From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de> +Date: Sat, 15 Oct 2022 19:30:58 +0200 +Subject: [PATCH 1/2] Fix: Build with libopendmarc 1.4.x (fixes 2728) + +--- + doc/ChangeLog | 3 +++ + src/EDITME | 7 +++++-- + src/config.h.defaults | 1 + + src/dmarc.c | 7 ++++++- + 4 files changed, 15 insertions(+), 3 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -13,10 +13,13 @@ + Debug help from Graeme Fowler. + + JH/10 GnuTLS: fix for (IOT?) clients offering no TLS extensions at all. + Find and fix by Jasen Betts. + ++HS/01 Bug 2728: Introduce EDITME option "DMARC_API" to work around incompatible ++ API changes in libopendmarc. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/EDITME ++++ b/src/EDITME +@@ -600,18 +600,21 @@ + + # EXPERIMENTAL_DCC=yes + + # Uncomment the following line to add DMARC checking capability, implemented + # using libopendmarc libraries. You must have SPF and DKIM support enabled also. +-# Library version libopendmarc-1.4.1-1.fc33.x86_64 (on Fedora 33) is known broken; +-# 1.3.2-3 works. I seems that the OpenDMARC project broke their API. + # SUPPORT_DMARC=yes + # CFLAGS += -I/usr/local/include + # LDFLAGS += -lopendmarc + # Uncomment the following if you need to change the default. You can + # override it at runtime (main config option dmarc_tld_file) + # DMARC_TLD_FILE=/etc/exim/opendmarc.tlds ++# ++# Library version libopendmarc-1.4.1-1.fc33.x86_64 (on Fedora 33) is known broken; ++# 1.3.2-3 works. It seems that the OpenDMARC project broke their API. ++# Use this option if you need to build with an old library (1.3.x) ++# DMARC_API=100300 + + # Uncomment the following line to add ARC (Authenticated Received Chain) + # support. You must have SPF and DKIM support enabled also. + # EXPERIMENTAL_ARC=yes + +--- a/src/config.h.defaults ++++ b/src/config.h.defaults +@@ -148,10 +148,11 @@ + #define STRING_SPRINTF_BUFFER_SIZE (8192 * 4) + + #define SUPPORT_CRYPTEQ + #define SUPPORT_DANE + #define SUPPORT_DMARC ++#define DMARC_API 100400 + #define DMARC_TLD_FILE "/etc/exim/opendmarc.tlds" + #define SUPPORT_I18N + #define SUPPORT_I18N_2008 + #define SUPPORT_MAILDIR + #define SUPPORT_MAILSTORE +--- a/src/dmarc.c ++++ b/src/dmarc.c +@@ -457,11 +457,16 @@ + dkim_result = vs == PDKIM_VERIFY_PASS ? DMARC_POLICY_DKIM_OUTCOME_PASS : + vs == PDKIM_VERIFY_FAIL ? DMARC_POLICY_DKIM_OUTCOME_FAIL : + vs == PDKIM_VERIFY_INVALID ? DMARC_POLICY_DKIM_OUTCOME_TMPFAIL : + DMARC_POLICY_DKIM_OUTCOME_NONE; + libdm_status = opendmarc_policy_store_dkim(dmarc_pctx, US sig->domain, +- dkim_result, US""); ++/* The opendmarc project broke its API in a way we can't detect * easily. ++ * The EDITME provides a DMARC_API variable */ ++#if DMARC_API >= 100400 ++ sig->selector, ++#endif ++ dkim_result, US""); + DEBUG(D_receive) + debug_printf("DMARC adding DKIM sender domain = %s\n", sig->domain); + if (libdm_status != DMARC_PARSE_OKAY) + log_write(0, LOG_MAIN|LOG_PANIC, + "failure to store dkim (%s) for DMARC: %s", diff --git a/debian/patches/75_19-DMARC-fix-use-after-free-in-dmarc_dns_lookup.patch b/debian/patches/75_19-DMARC-fix-use-after-free-in-dmarc_dns_lookup.patch new file mode 100644 index 0000000..e8bda9e --- /dev/null +++ b/debian/patches/75_19-DMARC-fix-use-after-free-in-dmarc_dns_lookup.patch @@ -0,0 +1,39 @@ +From 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445 Mon Sep 17 00:00:00 2001 +From: Lorenz Brun <lorenz@brun.one> +Date: Fri, 14 Oct 2022 21:02:51 +0200 +Subject: [PATCH 2/2] DMARC: fix use-after-free in dmarc_dns_lookup + +This fixes a use-after-free in dmarc_dns_lookup where the result +of dns_lookup in dnsa is freed before the required data is copied out. + +Fixes: 9258363 ("DNS: explicit alloc/free of workspace") +--- + src/dmarc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/dmarc.c b/src/dmarc.c +index ad0c26c91..53c2752ac 100644 +--- a/src/dmarc.c ++++ b/src/dmarc.c +@@ -226,16 +226,17 @@ dns_scan dnss; + int rc = dns_lookup(dnsa, string_sprintf("_dmarc.%s", dom), T_TXT, NULL); + + if (rc == DNS_SUCCEED) + for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; + rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) + if (rr->type == T_TXT && rr->size > 3) + { ++ uschar *record = string_copyn_taint(US rr->data, rr->size, GET_TAINTED); + store_free_dns_answer(dnsa); +- return string_copyn_taint(US rr->data, rr->size, GET_TAINTED); ++ return record; + } + store_free_dns_answer(dnsa); + return NULL; + } + + + static int +-- +2.35.1 + diff --git a/debian/patches/75_22-Fix-daemon-startup.-Bug-2930.patch b/debian/patches/75_22-Fix-daemon-startup.-Bug-2930.patch new file mode 100644 index 0000000..2a3434f --- /dev/null +++ b/debian/patches/75_22-Fix-daemon-startup.-Bug-2930.patch @@ -0,0 +1,68 @@ +From 221321d2c51b83d1feced80ecd6c2fe33ec5456c Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 3 Nov 2022 20:08:25 +0000 +Subject: [PATCH 1/2] Fix daemon startup. Bug 2930 + +Broken-by: 7d5055276a +--- + doc/ChangeLog | 4 ++++ + src/daemon.c | 8 ++++++-- + 2 files changed, 10 insertions(+), 2 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -16,10 +16,14 @@ + Find and fix by Jasen Betts. + + HS/01 Bug 2728: Introduce EDITME option "DMARC_API" to work around incompatible + API changes in libopendmarc. + ++JH/12 Bug 2930: Fix daemon startup. When started from any process apart from ++ pid 1, in the normal "background daemon" mode, having to drop process- ++ group leadership also lost track of needing to create listener sockets. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/daemon.c ++++ b/src/daemon.c +@@ -1744,19 +1744,23 @@ + { + /* If the parent process of this one has pid == 1, we are re-initializing the + daemon as the result of a SIGHUP. In this case, there is no need to do + anything, because the controlling terminal has long gone. Otherwise, fork, in + case current process is a process group leader (see 'man setsid' for an +- explanation) before calling setsid(). */ ++ explanation) before calling setsid(). ++ All other forks want daemon_listen cleared. Rather than blow a register, jsut ++ restore it here. */ + + if (getppid() != 1) + { ++ BOOL daemon_listen = f.daemon_listen; + pid_t pid = exim_fork(US"daemon"); + if (pid < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "fork() failed when starting daemon: %s", strerror(errno)); + if (pid > 0) exit(EXIT_SUCCESS); /* in parent process, just exit */ + (void)setsid(); /* release controlling terminal */ ++ f.daemon_listen = daemon_listen; + } + } + + /* We are now in the disconnected, daemon process (unless debugging). Set up + the listening sockets if required. */ +@@ -2090,11 +2094,11 @@ + { /* found; append port to list */ + for (p = i2->log; *p; ) p++; /* end of existing string */ + if (*--p == '}') *p = '\0'; /* drop EOL */ + while (isdigit(*--p)) ; /* char before port */ + +- i2->log = *p == ':' /* no list yet? */ ++ i2->log = *p == ':' /* no list yet? { */ + ? string_sprintf("%.*s{%s,%d}", + (int)(p - i2->log + 1), i2->log, p+1, ipa->port) + : string_sprintf("%s,%d}", i2->log, ipa->port); + ipa->log = NULL; + break; diff --git a/debian/patches/75_23-Fix-reccipients-after-run.-.-Bug-2929.patch b/debian/patches/75_23-Fix-reccipients-after-run.-.-Bug-2929.patch new file mode 100644 index 0000000..1c98ef2 --- /dev/null +++ b/debian/patches/75_23-Fix-reccipients-after-run.-.-Bug-2929.patch @@ -0,0 +1,45 @@ +From 6b331d5834d12bdda21857cd6fffac17038ce3c7 Mon Sep 17 00:00:00 2001 +From: Ruben Jenster <r.jenster@drachenfels.de> +Date: Thu, 3 Nov 2022 21:38:15 +0000 +Subject: [PATCH 2/2] Fix $reccipients after ${run...}. Bug 2929 + +Broken-by: cfe6acff2d +--- + doc/ChangeLog | 3 +++ + src/transport.c | 3 ++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -20,10 +20,13 @@ + + JH/12 Bug 2930: Fix daemon startup. When started from any process apart from + pid 1, in the normal "background daemon" mode, having to drop process- + group leadership also lost track of needing to create listener sockets. + ++JH/13 Bug 2929: Fix using $recipients after ${run...}. A change made for 4.96 ++ resulted in the variable appearing empty. Find and fix by Ruben Jenster. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/transport.c ++++ b/src/transport.c +@@ -2342,13 +2342,14 @@ + /* Handle normal expansion string */ + + else + { + const uschar *expanded_arg; ++ BOOL enable_dollar_recipients_g = f.enable_dollar_recipients; + f.enable_dollar_recipients = allow_dollar_recipients; + expanded_arg = expand_cstring(argv[i]); +- f.enable_dollar_recipients = FALSE; ++ f.enable_dollar_recipients = enable_dollar_recipients_g; + + if (!expanded_arg) + { + uschar *msg = string_sprintf("Expansion of \"%s\" " + "from command \"%s\" in %s failed: %s", diff --git a/debian/patches/75_31-Fix-regext-substring-capture-variables-for-null-matc.patch b/debian/patches/75_31-Fix-regext-substring-capture-variables-for-null-matc.patch new file mode 100644 index 0000000..bd250f2 --- /dev/null +++ b/debian/patches/75_31-Fix-regext-substring-capture-variables-for-null-matc.patch @@ -0,0 +1,79 @@ +From e63825824cc406c160ccbf2b154c5d81b168604a Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Fri, 11 Nov 2022 00:05:59 +0000 +Subject: [PATCH 1/2] Fix regext substring capture variables for null matches. + Bug 2933 + +broken-by: 59d66fdc13f0 +--- + doc/ChangeLog | 5 +++++ + src/exim.c | 2 ++ + src/malware.c | 3 +++ + src/regex.c | 2 +- + 4 files changed, 11 insertions(+), 1 deletion(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -22,10 +22,15 @@ + pid 1, in the normal "background daemon" mode, having to drop process- + group leadership also lost track of needing to create listener sockets. + + JH/13 Bug 2929: Fix using $recipients after ${run...}. A change made for 4.96 + resulted in the variable appearing empty. Find and fix by Ruben Jenster. ++ ++JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96 ++ a capture group which obtained no text (eg. "(abc)*" matching zero ++ occurrences) could cause a segfault if the corresponding $<n> was ++ expanded. + + + + Exim version 4.96 + ----------------- +--- a/src/exim.c ++++ b/src/exim.c +@@ -167,10 +167,12 @@ + for (int matchnum = setup < 0 ? 0 : 1; matchnum < res; matchnum++) + { + PCRE2_SIZE len; + pcre2_substring_get_bynumber(md, matchnum, + (PCRE2_UCHAR **)&expand_nstring[expand_nmax], &len); ++ if (!expand_nstring[expand_nmax]) ++ { expand_nstring[expand_nmax] = US""; len = 0; } + expand_nlength[expand_nmax++] = (int)len; + } + expand_nmax--; + } + else if (res != PCRE2_ERROR_NOMATCH) DEBUG(D_any) +--- a/src/malware.c ++++ b/src/malware.c +@@ -323,11 +323,14 @@ + int i = pcre2_match(cre, text, PCRE2_ZERO_TERMINATED, 0, 0, md, pcre_mtc_ctx); + PCRE2_UCHAR * substr = NULL; + PCRE2_SIZE slen; + + if (i >= 2) /* Got it */ ++ { + pcre2_substring_get_bynumber(md, 1, &substr, &slen); ++ if (!substr) substr = US""; ++ } + return US substr; + } + + static const pcre2_code * + m_pcre_nextinlist(const uschar ** list, int * sep, +--- a/src/regex.c ++++ b/src/regex.c +@@ -84,11 +84,11 @@ + for (int nn = 1; nn < n; nn++) + { + PCRE2_UCHAR * cstr; + PCRE2_SIZE cslen; + pcre2_substring_get_bynumber(md, nn, &cstr, &cslen); +- regex_vars[nn-1] = CUS cstr; ++ regex_vars[nn-1] = cstr ? CUS cstr : CUS""; + } + + return OK; + } + } diff --git a/debian/patches/75_32-Fix-regex-substring-capture-variables-for-null-match.patch b/debian/patches/75_32-Fix-regex-substring-capture-variables-for-null-match.patch new file mode 100644 index 0000000..7c2c14a --- /dev/null +++ b/debian/patches/75_32-Fix-regex-substring-capture-variables-for-null-match.patch @@ -0,0 +1,94 @@ +From 7ad1a2b2cc57b5f4bcb59186a9a8abcbed9f4f76 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Fri, 11 Nov 2022 18:22:00 +0000 +Subject: [PATCH 2/2] Fix regex substring capture variables for null matches + (again). Bug 2933 + +Broken-by: 59d66fdc13f0 +--- + src/exim.c | 11 +++++------ + src/malware.c | 10 +++++----- + src/regex.c | 8 ++++---- + test/aux-var-src/0383.F | 4 ++-- + test/log/0383 | 4 ++-- + test/mail/0383.CALLER | 8 ++++---- + test/scripts/0000-Basic/0002 | 2 ++ + test/stdout/0002 | 2 ++ + 8 files changed, 26 insertions(+), 23 deletions(-) + +--- a/src/exim.c ++++ b/src/exim.c +@@ -160,20 +160,19 @@ + PCRE_EOPT | options, md, pcre_mtc_ctx); + BOOL yield; + + if ((yield = (res >= 0))) + { ++ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md); + res = pcre2_get_ovector_count(md); + expand_nmax = setup < 0 ? 0 : setup + 1; + for (int matchnum = setup < 0 ? 0 : 1; matchnum < res; matchnum++) + { +- PCRE2_SIZE len; +- pcre2_substring_get_bynumber(md, matchnum, +- (PCRE2_UCHAR **)&expand_nstring[expand_nmax], &len); +- if (!expand_nstring[expand_nmax]) +- { expand_nstring[expand_nmax] = US""; len = 0; } +- expand_nlength[expand_nmax++] = (int)len; ++ int off = matchnum * 2; ++ int len = ovec[off + 1] - ovec[off]; ++ expand_nstring[expand_nmax] = string_copyn(subject + ovec[off], len); ++ expand_nlength[expand_nmax++] = len; + } + expand_nmax--; + } + else if (res != PCRE2_ERROR_NOMATCH) DEBUG(D_any) + { +--- a/src/malware.c ++++ b/src/malware.c +@@ -319,19 +319,19 @@ + uschar * + m_pcre_exec(const pcre2_code * cre, uschar * text) + { + pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx); + int i = pcre2_match(cre, text, PCRE2_ZERO_TERMINATED, 0, 0, md, pcre_mtc_ctx); +-PCRE2_UCHAR * substr = NULL; +-PCRE2_SIZE slen; ++uschar * substr = NULL; + + if (i >= 2) /* Got it */ + { +- pcre2_substring_get_bynumber(md, 1, &substr, &slen); +- if (!substr) substr = US""; ++ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md); ++ int len = ovec[3] - ovec[2]; ++ substr = string_copyn(text + ovec[2], len); + } +-return US substr; ++return substr; + } + + static const pcre2_code * + m_pcre_nextinlist(const uschar ** list, int * sep, + char * listerr, uschar ** errstr) +--- a/src/regex.c ++++ b/src/regex.c +@@ -81,14 +81,14 @@ + sizeof(regex_match_string_buffer)-1); + regex_match_string = regex_match_string_buffer; + + for (int nn = 1; nn < n; nn++) + { +- PCRE2_UCHAR * cstr; +- PCRE2_SIZE cslen; +- pcre2_substring_get_bynumber(md, nn, &cstr, &cslen); +- regex_vars[nn-1] = cstr ? CUS cstr : CUS""; ++ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md); ++ int off = nn * 2; ++ int len = ovec[off + 1] - ovec[off]; ++ regex_vars[nn-1] = string_copyn(linebuffer + ovec[off], len); + } + + return OK; + } + } diff --git a/debian/patches/75_34-Fix-regex-substring-capture-commentary.-Bug-2933.patch b/debian/patches/75_34-Fix-regex-substring-capture-commentary.-Bug-2933.patch new file mode 100644 index 0000000..61d4483 --- /dev/null +++ b/debian/patches/75_34-Fix-regex-substring-capture-commentary.-Bug-2933.patch @@ -0,0 +1,48 @@ +From 9ba47886c71d40edc99b026a99edee269d9c9c6f Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sat, 12 Nov 2022 12:38:22 +0000 +Subject: [PATCH] Fix regex substring capture - commentary. Bug 2933 + +Broken-by (corrected): 22ed7a5295f1 +--- + src/exim.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/src/exim.c b/src/exim.c +index 16c0184e0..625494ce4 100644 +--- a/src/exim.c ++++ b/src/exim.c +@@ -102,11 +102,13 @@ pcre_gen_mtc_ctx = pcre2_match_context_create(pcre_gen_ctx); + * Execute regular expression and set strings * + *************************************************/ + + /* This function runs a regular expression match, and sets up the pointers to + the matched substrings. The matched strings are copied so the lifetime of +-the subject is not a problem. ++the subject is not a problem. Matched strings will have the same taint status ++as the subject string (this is not a de-taint method, and must not be made so ++given the support for wildcards in REs). + + Arguments: + re the compiled expression + subject the subject string + options additional PCRE options +@@ -130,10 +132,15 @@ if ((yield = (res >= 0))) + PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md); + res = pcre2_get_ovector_count(md); + expand_nmax = setup < 0 ? 0 : setup + 1; + for (int matchnum = setup < 0 ? 0 : 1; matchnum < res; matchnum++) + { ++ /* Although PCRE2 has a pcre2_substring_get_bynumber() conveneience, it ++ seems to return a bad pointer when a capture group had no data, eg. (.*) ++ matching zero letters. So use the underlying ovec and hope (!) that the ++ offsets are sane (including that case). Should we go further and range- ++ check each one vs. the subject string length? */ + int off = matchnum * 2; + int len = ovec[off + 1] - ovec[off]; + expand_nstring[expand_nmax] = string_copyn(subject + ovec[off], len); + expand_nlength[expand_nmax++] = len; + } +-- +2.35.1 + diff --git a/debian/patches/75_37-OpenSSL-when-preloading-creds-do-the-server-certs-be.patch b/debian/patches/75_37-OpenSSL-when-preloading-creds-do-the-server-certs-be.patch new file mode 100644 index 0000000..2e21065 --- /dev/null +++ b/debian/patches/75_37-OpenSSL-when-preloading-creds-do-the-server-certs-be.patch @@ -0,0 +1,232 @@ +From 7f65a63b60c6ea86db683ac00e221939f3bb1d47 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Tue, 25 Oct 2022 21:26:30 +0100 +Subject: [PATCH 1/2] OpenSSL: when preloading creds do the server certs before + the OCSP proofs so that the latter can ve verified before loading + +--- + src/tls-openssl.c | 113 ++++++++++++++++++++++-------------------- + 1 file changed, 58 insertions(+), 55 deletions(-) + +diff --git a/src/tls-openssl.c b/src/tls-openssl.c +index 68ad6f15b..fdf0d92b2 100644 +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -441,14 +441,16 @@ exim_openssl_state_st state_server = {.is_server = TRUE}; + static int + setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, + uschar ** errstr ); + + /* Callbacks */ + #ifndef DISABLE_OCSP + static int tls_server_stapling_cb(SSL *s, void *arg); ++static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk); ++static void x509_store_dump_cert_s_names(X509_STORE * store); + #endif + + + + /* Daemon-called, before every connection, key create/rotate */ + #ifndef DISABLE_TLS_RESUME + static void tk_init(void); +@@ -1307,15 +1309,14 @@ ocsp_load_response(exim_openssl_state_st * state, const uschar * filename, + { + BIO * bio; + OCSP_RESPONSE * resp; + OCSP_BASICRESP * basic_response; + OCSP_SINGLERESP * single_response; + ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd; + STACK_OF(X509) * sk; +-unsigned long verify_flags; + int status, reason, i; + + DEBUG(D_tls) + debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename); + + if (!filename || !*filename) return; + +@@ -1372,28 +1373,28 @@ if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL) + if (!(basic_response = OCSP_response_get1_basic(resp))) + { + DEBUG(D_tls) + debug_printf("OCSP response parse error: unable to extract basic response.\n"); + goto bad; + } + +-sk = state->verify_stack; +-verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */ ++sk = state->verify_stack; /* set by setup_certs() / chain_from_pem_file() */ + + /* May need to expose ability to adjust those flags? + OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT + OCSP_TRUSTOTHER OCSP_NOINTERN */ + +-/* This does a full verify on the OCSP proof before we load it for serving +-up; possibly overkill - just date-checks might be nice enough. ++/* This does a partial verify (only the signer link, not the whole chain-to-CA) ++on the OCSP proof before we load it for serving up; possibly overkill - ++just date-checks might be nice enough. + + OCSP_basic_verify takes a "store" arg, but does not +-use it for the chain verification, which is all we do +-when OCSP_NOVERIFY is set. The content from the wire +-"basic_response" and a cert-stack "sk" are all that is used. ++use it for the chain verification, when OCSP_NOVERIFY is set. ++The content from the wire "basic_response" and a cert-stack "sk" are all ++that is used. + + We have a stack, loaded in setup_certs() if tls_verify_certificates + was a file (not a directory, or "system"). It is unfortunate we + cannot used the connection context store, as that would neatly + handle the "system" case too, but there seems to be no library + function for getting a stack from a store. + [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ] +@@ -1402,15 +1403,15 @@ SNI handling. + + Separately we might try to replace using OCSP_basic_verify() - which seems to not + be a public interface into the OpenSSL library (there's no manual entry) - + But what with? We also use OCSP_basic_verify in the client stapling callback. + And there we NEED it; we must verify that status... unless the + library does it for us anyway? */ + +-if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0) ++if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0) + { + DEBUG(D_tls) + { + ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring)); + debug_printf("OCSP response verify failure: %s\n", US ssl_errstring); + } + goto bad; +@@ -1747,61 +1748,18 @@ if (opt_unset_or_noexpand(tls_eccurve)) + if (init_ecdh(ctx, &dummy_errstr)) + state_server.lib_state.ecdh = TRUE; + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n"); + + #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT) +-/* If we can, preload the server-side cert, key and ocsp */ +- +-if ( opt_set_and_noexpand(tls_certificate) +-# ifndef DISABLE_OCSP +- && opt_unset_or_noexpand(tls_ocsp_file) +-#endif +- && opt_unset_or_noexpand(tls_privatekey)) +- { +- /* Set watches on the filenames. The implementation does de-duplication +- so we can just blindly do them all. */ +- +- if ( tls_set_watch(tls_certificate, TRUE) +-# ifndef DISABLE_OCSP +- && tls_set_watch(tls_ocsp_file, TRUE) +-#endif +- && tls_set_watch(tls_privatekey, TRUE)) +- { +- state_server.certificate = tls_certificate; +- state_server.privatekey = tls_privatekey; +-#ifndef DISABLE_OCSP +- state_server.u_ocsp.server.file = tls_ocsp_file; +-#endif +- +- DEBUG(D_tls) debug_printf("TLS: preloading server certs\n"); +- if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK) +- state_server.lib_state.conn_certs = TRUE; +- } +- } +-else if ( !tls_certificate && !tls_privatekey +-# ifndef DISABLE_OCSP +- && !tls_ocsp_file +-#endif +- ) +- { /* Generate & preload a selfsigned cert. No files to watch. */ +- if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK) +- { +- state_server.lib_state.conn_certs = TRUE; +- lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */ +- } +- } +-else +- DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n"); +- +- + /* If we can, preload the Authorities for checking client certs against. + Actual choice to do verify is made (tls_{,try_}verify_hosts) +-at TLS conn startup */ ++at TLS conn startup. ++Do this before the server ocsp so that its info can verify the ocsp. */ + + if ( opt_set_and_noexpand(tls_verify_certificates) + && opt_unset_or_noexpand(tls_crl)) + { + /* Watch the default dir also as they are always included */ + + if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE) +@@ -1809,18 +1767,63 @@ if ( opt_set_and_noexpand(tls_verify_certificates) + && tls_set_watch(tls_crl, FALSE)) + { + DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n"); + + if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr) + == OK) + state_server.lib_state.cabundle = TRUE; +- } ++ ++ /* If we can, preload the server-side cert, key and ocsp */ ++ ++ if ( opt_set_and_noexpand(tls_certificate) ++# ifndef DISABLE_OCSP ++ && opt_unset_or_noexpand(tls_ocsp_file) ++# endif ++ && opt_unset_or_noexpand(tls_privatekey)) ++ { ++ /* Set watches on the filenames. The implementation does de-duplication ++ so we can just blindly do them all. */ ++ ++ if ( tls_set_watch(tls_certificate, TRUE) ++# ifndef DISABLE_OCSP ++ && tls_set_watch(tls_ocsp_file, TRUE) ++# endif ++ && tls_set_watch(tls_privatekey, TRUE)) ++ { ++ state_server.certificate = tls_certificate; ++ state_server.privatekey = tls_privatekey; ++#ifndef DISABLE_OCSP ++ state_server.u_ocsp.server.file = tls_ocsp_file; ++# endif ++ ++ DEBUG(D_tls) debug_printf("TLS: preloading server certs\n"); ++ if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK) ++ state_server.lib_state.conn_certs = TRUE; ++ } ++ } ++ else if ( !tls_certificate && !tls_privatekey ++# ifndef DISABLE_OCSP ++ && !tls_ocsp_file ++# endif ++ ) ++ { /* Generate & preload a selfsigned cert. No files to watch. */ ++ if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK) ++ { ++ state_server.lib_state.conn_certs = TRUE; ++ lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */ ++ } ++ } ++ else ++ DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n"); ++ } + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n"); ++ ++ + #endif /* EXIM_HAVE_INOTIFY */ + + + /* If we can, preload the ciphers control string */ + + if (opt_set_and_noexpand(tls_require_ciphers)) + { +-- +2.35.1 + diff --git a/debian/patches/75_38-OpenSSL-fix-double-expansion-of-tls_verify_certifica.patch b/debian/patches/75_38-OpenSSL-fix-double-expansion-of-tls_verify_certifica.patch new file mode 100644 index 0000000..09e4f11 --- /dev/null +++ b/debian/patches/75_38-OpenSSL-fix-double-expansion-of-tls_verify_certifica.patch @@ -0,0 +1,217 @@ +From 62b97c2ecf148ee86053d82e5509e4c3a5a20054 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sat, 29 Oct 2022 22:33:43 +0100 +Subject: [PATCH 2/2] OpenSSL: fix double-expansion of tls_verify_certificates + +--- + src/tls-openssl.c | 66 +++++++++++++++++++++---------------------- + 1 file changed, 33 insertions(+), 33 deletions(-) + +diff --git a/src/tls-openssl.c b/src/tls-openssl.c +index fdf0d92b2..2e09882d2 100644 +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -435,15 +435,15 @@ typedef struct exim_openssl_state { + /* should figure out a cleanup of API to handle state preserved per + implementation, for various reasons, which can be void * in the APIs. + For now, we hack around it. */ + exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */ + exim_openssl_state_st state_server = {.is_server = TRUE}; + + static int +-setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, ++setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host, + uschar ** errstr ); + + /* Callbacks */ + #ifndef DISABLE_OCSP + static int tls_server_stapling_cb(SSL *s, void *arg); + static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk); + static void x509_store_dump_cert_s_names(X509_STORE * store); +@@ -1762,18 +1762,18 @@ if ( opt_set_and_noexpand(tls_verify_certificates) + { + /* Watch the default dir also as they are always included */ + + if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE) + && tls_set_watch(tls_verify_certificates, FALSE) + && tls_set_watch(tls_crl, FALSE)) + { ++ uschar * v_certs = tls_verify_certificates; + DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n"); + +- if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr) +- == OK) ++ if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK) + state_server.lib_state.cabundle = TRUE; + + /* If we can, preload the server-side cert, key and ocsp */ + + if ( opt_set_and_noexpand(tls_certificate) + # ifndef DISABLE_OCSP + && opt_unset_or_noexpand(tls_ocsp_file) +@@ -1897,18 +1897,19 @@ if ( opt_set_and_noexpand(ob->tls_verify_certificates) + { + if ( !watch + || tls_set_watch(CUS X509_get_default_cert_file(), FALSE) + && tls_set_watch(ob->tls_verify_certificates, FALSE) + && tls_set_watch(ob->tls_crl, FALSE) + ) + { ++ uschar * v_certs = ob->tls_verify_certificates; + DEBUG(D_tls) + debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name); + +- if (setup_certs(ctx, ob->tls_verify_certificates, ++ if (setup_certs(ctx, &v_certs, + ob->tls_crl, dummy_host, &dummy_errstr) == OK) + ob->tls_preload.cabundle = TRUE; + } + } + else + DEBUG(D_tls) + debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name); +@@ -2238,22 +2239,20 @@ if (state->u_ocsp.server.file) + { + SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb); + SSL_CTX_set_tlsext_status_arg(server_sni, state); + } + #endif + + { +- uschar * expcerts; +- if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates", +- &expcerts, &dummy_errstr) +- || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL, ++ uschar * v_certs = tls_verify_certificates; ++ if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL, + &dummy_errstr)) != OK) + goto bad; + +- if (expcerts && *expcerts) ++ if (v_certs && *v_certs) + setup_cert_verify(server_sni, FALSE, verify_callback_server); + } + + /* do this after setup_certs, because this can require the certs for verifying + OCSP information. */ + if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK) + goto bad; +@@ -3017,32 +3016,33 @@ return TRUE; + + + /* Called by both client and server startup; on the server possibly + repeated after a Server Name Indication. + + Arguments: + sctx SSL_CTX* to initialise +- certs certs file, expanded ++ certs certs file, returned expanded + crl CRL file or NULL + host NULL in a server; the remote host in a client + errstr error string pointer + + Returns: OK/DEFER/FAIL + */ + + static int +-setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, ++setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host, + uschar ** errstr) + { +-uschar *expcerts, *expcrl; ++uschar * expcerts, * expcrl; + +-if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr)) ++if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr)) + return DEFER; + DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts); + ++*certsp = expcerts; + if (expcerts && *expcerts) + { + /* Tell the library to use its compiled-in location for the system default + CA bundle. Then add the ones specified in the config, if any. */ + + if (!SSL_CTX_set_default_verify_paths(sctx)) + return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr); +@@ -3330,28 +3330,28 @@ if (verify_check_host(&tls_verify_hosts) == OK) + server_verify_optional = FALSE; + else if (verify_check_host(&tls_try_verify_hosts) == OK) + server_verify_optional = TRUE; + else + goto skip_certs; + + { +- uschar * expcerts; +- if (!expand_check(tls_verify_certificates, US"tls_verify_certificates", +- &expcerts, errstr)) +- return DEFER; +- DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts); ++ uschar * v_certs = tls_verify_certificates; + + if (state_server.lib_state.cabundle) +- { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); } ++ { ++ DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); ++ setup_cert_verify(ctx, server_verify_optional, verify_callback_server); ++ } + else +- if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK) ++ { ++ if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK) + return rc; +- +- if (expcerts && *expcerts) +- setup_cert_verify(ctx, server_verify_optional, verify_callback_server); ++ if (v_certs && *v_certs) ++ setup_cert_verify(ctx, server_verify_optional, verify_callback_server); ++ } + } + skip_certs: ; + + #ifndef DISABLE_TLS_RESUME + # if OPENSSL_VERSION_NUMBER < 0x30000000L + SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback); + /* despite working, appears to always return failure, so ignoring */ +@@ -3606,28 +3606,28 @@ if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts + client_verify_optional = FALSE; + else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK) + client_verify_optional = TRUE; + else + return OK; + + { +- uschar * expcerts; +- if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates", +- &expcerts, errstr)) +- return DEFER; +- DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts); ++ uschar * v_certs = ob->tls_verify_certificates; + + if (state->lib_state.cabundle) +- { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); } ++ { ++ DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n"); ++ setup_cert_verify(ctx, client_verify_optional, verify_callback_client); ++ } + else +- if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK) ++ { ++ if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK) + return rc; +- +- if (expcerts && *expcerts) +- setup_cert_verify(ctx, client_verify_optional, verify_callback_client); ++ if (v_certs && *v_certs) ++ setup_cert_verify(ctx, client_verify_optional, verify_callback_client); ++ } + } + + if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK) + { + state->verify_cert_hostnames = + #ifdef SUPPORT_I18N + string_domain_utf8_to_alabel(host->certname, NULL); +-- +2.35.1 + diff --git a/debian/patches/75_42-Fix-run-arg-parsing.patch b/debian/patches/75_42-Fix-run-arg-parsing.patch new file mode 100644 index 0000000..79e55d6 --- /dev/null +++ b/debian/patches/75_42-Fix-run-arg-parsing.patch @@ -0,0 +1,100 @@ +From 44b6e099b76f403a55e77650821f8a69e9d2682e Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sat, 3 Dec 2022 23:13:53 +0000 +Subject: [PATCH] Fix ${run } arg parsing + . + Backported by Bryce Harrington for Ubuntu + +Broken-by: cfe6acff2ddc +--- + doc/ChangeLog | 4 ++++ + src/expand.c | 13 ++++++++++--- + src/transport.c | 4 +++- + test/scripts/0000-Basic/0002 | 2 ++ + test/stdout/0002 | 2 ++ + 5 files changed, 21 insertions(+), 4 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -28,10 +28,14 @@ JH/13 Bug 2929: Fix using $recipients af + JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96 + a capture group which obtained no text (eg. "(abc)*" matching zero + occurrences) could cause a segfault if the corresponding $<n> was + expanded. + ++JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument ++ included a close-brace character (eg. it itself used an expansion) an ++ error occurred. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/expand.c ++++ b/src/expand.c +@@ -5529,11 +5529,11 @@ while (*s) + { + FILE * f; + const uschar * arg, ** argv; + BOOL late_expand = TRUE; + +- if ((expand_forbid & RDO_RUN) != 0) ++ if (expand_forbid & RDO_RUN) + { + expand_string_message = US"running a command is not permitted"; + goto EXPAND_FAILED; + } + +@@ -5561,16 +5561,22 @@ while (*s) + } + s++; + + if (late_expand) /* this is the default case */ + { +- int n = Ustrcspn(s, "}"); ++ int n; ++ const uschar * t; ++ /* Locate the end of the args */ ++ (void) expand_string_internal(s, TRUE, &t, TRUE, TRUE, NULL); ++ n = t - s; + arg = skipping ? NULL : string_copyn(s, n); + s += n; + } + else + { ++ DEBUG(D_expand) ++ debug_printf_indent("args string for ${run} expand before split\n"); + if (!(arg = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok))) + goto EXPAND_FAILED; + Uskip_whitespace(&s); + } + /*{*/ +--- a/src/transport.c ++++ b/src/transport.c +@@ -2187,10 +2187,12 @@ if (expand_arguments) + BOOL allow_dollar_recipients = addr && addr->parent + && Ustrcmp(addr->parent->address, "system-filter") == 0; + + for (int i = 0; argv[i]; i++) + { ++ DEBUG(D_expand) debug_printf_indent("arg %d\n", i); ++ + /* Handle special fudge for passing an address list */ + + if (addr && + (Ustrcmp(argv[i], "$pipe_addresses") == 0 || + Ustrcmp(argv[i], "${pipe_addresses}") == 0)) +@@ -2361,11 +2363,11 @@ if (expand_arguments) + } + else *errptr = msg; + return FALSE; + } + +- if ( f.running_in_test_harness && is_tainted(expanded_arg) ++ if ( f.running_in_test_harness && is_tainted(expanded_arg) + && Ustrcmp(etext, "queryprogram router") == 0) + { /* hack, would be good to not need it */ + DEBUG(D_transport) + debug_printf("SPECIFIC TESTSUITE EXEMPTION: tainted arg '%s'\n", + expanded_arg); diff --git a/debian/patches/75_50-Fix-logging-of-max-size-log-line.patch b/debian/patches/75_50-Fix-logging-of-max-size-log-line.patch new file mode 100644 index 0000000..55c983e --- /dev/null +++ b/debian/patches/75_50-Fix-logging-of-max-size-log-line.patch @@ -0,0 +1,82 @@ +From 1ed24e36e279c922d3366f6c3144570cc5f54d7a Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Mon, 19 Dec 2022 21:09:17 +0000 +Subject: [PATCH] Fix logging of max-size log line + +Broken-by: d12746bc15d8 +--- + doc/ChangeLog | 5 +++++ + src/log.c | 7 ++++--- + test/confs/0633 | 21 ++++++++++++++++++++ + test/scripts/0000-Basic/0633 | 9 +++++++++ + test/stderr/0633 | 38 ++++++++++++++++++++++++++++++++++++ + test/stdout/0633 | 15 ++++++++++++++ + 6 files changed, 92 insertions(+), 3 deletions(-) + create mode 100644 test/confs/0633 + create mode 100644 test/scripts/0000-Basic/0633 + create mode 100644 test/stderr/0633 + create mode 100644 test/stdout/0633 + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -32,10 +32,15 @@ JH/14 Bug 2933: Fix regex substring matc + + JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument + included a close-brace character (eg. it itself used an expansion) an + error occurred. + ++JH/18 Fix a fencepost error in logging. Previously (since 4.92) when a log line ++ was exactly sized compared to the log buffer, a crash occurred with the ++ misleading message "bad memory reference; pool not found". ++ Found and traced by Jasen Betts. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/log.c ++++ b/src/log.c +@@ -803,11 +803,11 @@ Returns: nothing + void + log_write(unsigned int selector, int flags, const char *format, ...) + { + int paniclogfd; + ssize_t written_len; +-gstring gs = { .size = LOG_BUFFER_SIZE-1, .ptr = 0, .s = log_buffer }; ++gstring gs = { .size = LOG_BUFFER_SIZE-2, .ptr = 0, .s = log_buffer }; + gstring * g; + va_list ap; + + /* If panic_recurseflag is set, we have failed to open the panic log. This is + the ultimate disaster. First try to write the message to a debug file and/or +@@ -949,15 +949,14 @@ DEBUG(D_any|D_v) + g->ptr = i; + g = string_cat(g, US"**** log string overflowed log buffer ****"); + } + va_end(ap); + +- g->size = LOG_BUFFER_SIZE; + g = string_catn(g, US"\n", 1); + debug_printf("%s", string_from_gstring(g)); + +- gs.size = LOG_BUFFER_SIZE-1; /* Having used the buffer for debug output, */ ++ gs.size = LOG_BUFFER_SIZE-2; /* Having used the buffer for debug output, */ + gs.ptr = 0; /* reset it for the real use. */ + gs.s = log_buffer; + } + /* If no log file is specified, we are in a mess. */ + +@@ -1035,10 +1034,12 @@ if ( flags & LOG_RECIPIENTS + if (LOG_BUFFER_SIZE - g->ptr < Ustrlen(s) + 3) break; + g = string_fmt_append_f(g, SVFMT_TAINT_NOCHK, " %s", s); + } + } + ++/* actual size, now we are placing the newline (and space for NUL) */ ++gs.size = LOG_BUFFER_SIZE; + g = string_catn(g, US"\n", 1); + string_from_gstring(g); + + /* Handle loggable errors when running a utility, or when address testing. + Write to log_stderr unless debugging (when it will already have been written), diff --git a/debian/patches/75_55-Fix-recursion-on-dns_again_means_nonexist.-Bug-2911.patch b/debian/patches/75_55-Fix-recursion-on-dns_again_means_nonexist.-Bug-2911.patch new file mode 100644 index 0000000..bbbfbe9 --- /dev/null +++ b/debian/patches/75_55-Fix-recursion-on-dns_again_means_nonexist.-Bug-2911.patch @@ -0,0 +1,76 @@ +From 1d38781da934809e6ce0b8c3718c4b3bccdfe1d2 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Wed, 28 Dec 2022 19:39:06 +0000 +Subject: [PATCH] Fix recursion on dns_again_means_nonexist. Bug 2911 + +--- + doc/ChangeLog | 8 +++++ + src/dns.c | 12 ++++++++ + test/confs/2202 | 18 +++++++++-- + test/scripts/2200-dnsdb/2202 | 8 +++++ + test/stderr/2202 | 58 +++++++++++++++++++++++++++++++++++- + test/stdout/2202 | 8 +++++ + 6 files changed, 108 insertions(+), 4 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -33,10 +33,18 @@ JH/14 Bug 2933: Fix regex substring matc + JH/18 Fix a fencepost error in logging. Previously (since 4.92) when a log line + was exactly sized compared to the log buffer, a crash occurred with the + misleading message "bad memory reference; pool not found". + Found and traced by Jasen Betts. + ++JH/19 Bug 2911: Fix a recursion in DNS lookups. Previously, if the main option ++ dns_again_means_nonexist included an element causing a DNS lookup which ++ iteslf returned DNS_AGAIN, unbounded recursion occurred. Possible results ++ included (though probably not limited to) a process crash from stack ++ memory limit, or from excessive open files. Replace this with a paniclog ++ whine (as this is likely a configuration error), and returning ++ DNS_NOMATCH. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/dns.c ++++ b/src/dns.c +@@ -799,10 +799,11 @@ int + dns_basic_lookup(dns_answer * dnsa, const uschar * name, int type) + { + int rc; + #ifndef STAND_ALONE + const uschar * save_domain; ++static BOOL try_again_recursion = FALSE; + #endif + + /* DNS lookup failures of any kind are cached in a tree. This is mainly so that + a timeout on one domain doesn't happen time and time again for messages that + have many addresses in the same domain. We rely on the resolver and name server +@@ -903,15 +904,26 @@ if (dnsa->answerlen < 0) switch (h_errno + DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n", + name, dns_text_type(type)); + + /* Cut this out for various test programs */ + #ifndef STAND_ALONE ++ if (try_again_recursion) ++ { ++ log_write(0, LOG_MAIN|LOG_PANIC, ++ "dns_again_means_nonexist recursion seen for %s (assuming nonexist)", ++ name); ++ return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH); ++ } ++ ++ try_again_recursion = TRUE; + save_domain = deliver_domain; + deliver_domain = string_copy(name); /* set $domain */ + rc = match_isinlist(name, CUSS &dns_again_means_nonexist, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL); + deliver_domain = save_domain; ++ try_again_recursion = FALSE; ++ + if (rc != OK) + { + DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n"); + return dns_fail_return(name, type, 0, DNS_AGAIN); + } diff --git a/debian/patches/75_58-Close-server-smtp-socket-explicitly-on-connect-ACL-d.patch b/debian/patches/75_58-Close-server-smtp-socket-explicitly-on-connect-ACL-d.patch new file mode 100644 index 0000000..ddf54fa --- /dev/null +++ b/debian/patches/75_58-Close-server-smtp-socket-explicitly-on-connect-ACL-d.patch @@ -0,0 +1,50 @@ +From 57d70161718e02927a22d6a3481803b72035ac46 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sat, 31 Dec 2022 13:37:17 +0000 +Subject: [PATCH] Close server smtp socket explicitly on connect ACL "drop" + +--- + src/smtp_in.c | 13 ++++++++ + test/confs/0022 | 2 ++ + test/log/0022 | 2 ++ + test/rejectlog/0022 | 3 ++ + test/scripts/0000-Basic/0022 | 13 ++++++++ + test/stderr/0022 | 60 ++++++++++++++++++------------------ + test/stdout/0022 | 6 ++++ + 7 files changed, 69 insertions(+), 30 deletions(-) + create mode 100644 test/rejectlog/0022 + +diff --git a/src/smtp_in.c b/src/smtp_in.c +index 1cfcc0404..6880e3c09 100644 +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -3563,10 +3563,23 @@ log_write(L_smtp_connection, LOG_MAIN, "%s closed by DROP in ACL", + /* Run the not-quit ACL, but without any custom messages. This should not be a + problem, because we get here only if some other ACL has issued "drop", and + in that case, *its* custom messages will have been used above. */ + + smtp_notquit_exit(US"acl-drop", NULL, NULL); ++ ++/* An overenthusiastic fail2ban/iptables implimentation has been seen to result ++in the TCP conn staying open, and retrying, despite this process exiting. A ++malicious client could possibly do the same, tying up server netowrking ++resources. Close the socket explicitly to try to avoid that (there's a note in ++the Linux socket(7) manpage, SO_LINGER para, to the effect that exim() without ++close() results in the socket always lingering). */ ++ ++(void) poll_one_fd(fileno(smtp_in), POLLIN, 200); ++DEBUG(D_any) debug_printf_indent("SMTP(close)>>\n"); ++(void) fclose(smtp_in); ++(void) fclose(smtp_out); ++ + return 2; + } + + + +diff --git a/test/rejectlog/0022 b/test/rejectlog/0022 +new file mode 100644 +index 000000000..68e21fff3 +-- +2.39.0 + diff --git a/debian/patches/75_60-OpenSSL-fix-tls_eccurve-setting-explicit-curve-group.patch b/debian/patches/75_60-OpenSSL-fix-tls_eccurve-setting-explicit-curve-group.patch new file mode 100644 index 0000000..da05ba9 --- /dev/null +++ b/debian/patches/75_60-OpenSSL-fix-tls_eccurve-setting-explicit-curve-group.patch @@ -0,0 +1,184 @@ +From ca4014de81e6aa367aa0a54c49b4c3d4b137814c Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sun, 1 Jan 2023 12:18:38 +0000 +Subject: [PATCH] OpenSSL: fix tls_eccurve setting explicit curve/group. Bug + 2954 + +--- + doc/ChangeLog | 4 +++ + src/tls-openssl.c | 39 ++++++++++++++---------- + test/confs/2148 | 54 ++++++++++++++++++++++++++++++++++ + test/confs/2149 | 39 +++++++++++++----------- + test/log/2148 | 48 ++++++++++++++++++++++++++++++ + test/log/2149 | 39 ++++++++++++------------ + test/paniclog/{2149 => 2148} | 0 + test/scripts/2100-OpenSSL/2148 | 50 +++++++++++++++++++++++++++++++ + test/scripts/2100-OpenSSL/2149 | 50 ++++++++++++++++--------------- + test/stderr/2148 | 5 ++++ + test/stderr/2149 | 3 -- + 11 files changed, 250 insertions(+), 81 deletions(-) + create mode 100644 test/confs/2148 + create mode 100644 test/log/2148 + rename test/paniclog/{2149 => 2148} (100%) + create mode 100644 test/scripts/2100-OpenSSL/2148 + create mode 100644 test/stderr/2148 + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -41,10 +41,14 @@ JH/19 Bug 2911: Fix a recursion in DNS l + included (though probably not limited to) a process crash from stack + memory limit, or from excessive open files. Replace this with a paniclog + whine (as this is likely a configuration error), and returning + DNS_NOMATCH. + ++JH/20 Bug 2954: (OpenSSL) Fix setting of explicit EC curve/group. Previously ++ this always failed, probably leading to the usual downgrade to in-clear ++ connections. ++ + + + Exim version 4.96 + ----------------- + +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -657,16 +657,16 @@ if (dh_bitsize <= tls_dh_max_bits) + /* EVP_PKEY_free(pkey); crashes */ + #endif + } + else + DEBUG(D_tls) +- debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n", ++ debug_printf(" Diffie-Hellman initialized from %s with %d-bit prime\n", + dhexpanded ? dhexpanded : US"default", dh_bitsize); + } + else + DEBUG(D_tls) +- debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n", ++ debug_printf(" dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n", + dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits); + + #if OPENSSL_VERSION_NUMBER < 0x30000000L + DH_free(dh); + #endif +@@ -712,23 +712,31 @@ init_ecdh(SSL_CTX * sctx, uschar ** errs + #ifdef OPENSSL_NO_ECDH + return TRUE; + #else + + uschar * exp_curve; +-int nid; +-BOOL rv; ++int nid, rc; + + # ifndef EXIM_HAVE_ECDH + DEBUG(D_tls) +- debug_printf("No OpenSSL API to define ECDH parameters, skipping\n"); ++ debug_printf(" No OpenSSL API to define ECDH parameters, skipping\n"); + return TRUE; + # else + + if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr)) + return FALSE; ++ ++/* Is the option deliberately empty? */ ++ + if (!exp_curve || !*exp_curve) ++ { ++#if OPENSSL_VERSION_NUMBER >= 0x10002000L ++ DEBUG(D_tls) debug_printf( " ECDH OpenSSL 1.0.2+: clearing curves list\n"); ++ (void) SSL_CTX_set1_curves(sctx, &nid, 0); ++#endif + return TRUE; ++ } + + /* "auto" needs to be handled carefully. + * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1 + * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto + * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO) +@@ -737,27 +745,26 @@ if (!exp_curve || !*exp_curve) + */ + if (Ustrcmp(exp_curve, "auto") == 0) + { + #if OPENSSL_VERSION_NUMBER < 0x10002000L + DEBUG(D_tls) debug_printf( +- "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n"); ++ " ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n"); + exp_curve = US"prime256v1"; + #else + # if defined SSL_CTRL_SET_ECDH_AUTO + DEBUG(D_tls) debug_printf( +- "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n"); ++ " ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n"); + SSL_CTX_set_ecdh_auto(sctx, 1); + return TRUE; + # else + DEBUG(D_tls) debug_printf( +- "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n"); ++ " ECDH OpenSSL 1.1.0+: temp key parameter settings: library default selection\n"); + return TRUE; + # endif + #endif + } + +-DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve); + if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef + # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID + && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef + # endif + ) +@@ -777,27 +784,27 @@ if ( (nid = OBJ_sn2nid (CCS exp_c + } + + /* The "tmp" in the name here refers to setting a temporary key + not to the stability of the interface. */ + +- if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0)) ++ if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0)) + tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr); + else +- DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve); ++ DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' curve\n", exp_curve); + EC_KEY_free(ecdh); + } + + #else /* v 3.0.0 + */ + +-if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0) ++if ((rc = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0) + tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr); + else +- DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve); ++ DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' group\n", exp_curve); + + #endif + +-return !rv; ++return !!rc; + + # endif /*EXIM_HAVE_ECDH*/ + #endif /*OPENSSL_NO_ECDH*/ + } + +@@ -1719,19 +1726,19 @@ state_server.lib_state.lib_ctx = ctx; + + /* Preload DH params and EC curve */ + + if (opt_unset_or_noexpand(tls_dhparam)) + { +- DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n"); ++ DEBUG(D_tls) debug_printf("TLS: preloading DH params '%s' for server\n", tls_dhparam); + if (init_dh(ctx, tls_dhparam, &dummy_errstr)) + state_server.lib_state.dh = TRUE; + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n"); + if (opt_unset_or_noexpand(tls_eccurve)) + { +- DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n"); ++ DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve '%s' for server\n", tls_eccurve); + if (init_ecdh(ctx, &dummy_errstr)) + state_server.lib_state.ecdh = TRUE; + } + else + DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n"); diff --git a/debian/patches/75_62-OpenSSL-Fix-tls_eccurve-on-earlier-versions-than-3.0.patch b/debian/patches/75_62-OpenSSL-Fix-tls_eccurve-on-earlier-versions-than-3.0.patch new file mode 100644 index 0000000..e346df1 --- /dev/null +++ b/debian/patches/75_62-OpenSSL-Fix-tls_eccurve-on-earlier-versions-than-3.0.patch @@ -0,0 +1,42 @@ +From 7fa5764c203f2f4a900898a79ed02d674075313f Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Mon, 2 Jan 2023 15:04:14 +0000 +Subject: [PATCH 1/3] OpenSSL: Fix tls_eccurve on earlier versions than 3.0.0. + Bug 2954 + +Broken-by: ca4014de81e6 +--- + src/tls-openssl.c | 7 ++++--- + test/log/2149 | 28 ++++++++++++++-------------- + test/runtest | 3 +++ + test/scripts/2100-OpenSSL/2149 | 22 ++++++++++++---------- + 4 files changed, 33 insertions(+), 27 deletions(-) + +diff --git a/src/tls-openssl.c b/src/tls-openssl.c +index 4d0f99ea9..e063d29bd 100644 +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -786,8 +786,9 @@ if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef + # endif + ) + { +- tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve), +- NULL, NULL, errstr); ++ uschar * s = string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve); ++ DEBUG(D_tls) debug_printf("TLS error '%s'\n", s); ++ if (errstr) *errstr = s; + return FALSE; + } + +@@ -803,7 +804,7 @@ if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef + /* The "tmp" in the name here refers to setting a temporary key + not to the stability of the interface. */ + +- if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0)) ++ if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh)) == 0) + tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr); + else + DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' curve\n", exp_curve); +-- +2.39.0 + diff --git a/debian/patches/75_63-OpenSSL-log-conns-rejected-for-bad-ALPN-with-the-off.patch b/debian/patches/75_63-OpenSSL-log-conns-rejected-for-bad-ALPN-with-the-off.patch new file mode 100644 index 0000000..15b1b8a --- /dev/null +++ b/debian/patches/75_63-OpenSSL-log-conns-rejected-for-bad-ALPN-with-the-off.patch @@ -0,0 +1,99 @@ +From e1aca33756f73c22b00a98d40ce2be8ed94464b1 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 5 Jan 2023 13:03:37 +0000 +Subject: [PATCH 2/3] OpenSSL: log conns rejected for bad ALPN, with the + offered value + +Unfortunately, no way to do this under GnuTLS +--- + src/match.c | 1 + + src/tls-gnu.c | 9 ++++++++- + src/tls-openssl.c | 13 +++++++++++-- + test/log/1190 | 2 ++ + test/runtest | 3 +++ + 5 files changed, 25 insertions(+), 3 deletions(-) + +diff --git a/src/match.c b/src/match.c +index 91a49c0f0..07070362d 100644 +--- a/src/match.c ++++ b/src/match.c +@@ -968,6 +968,7 @@ Arguments: + s string to search for + listptr ptr to ptr to colon separated list of patterns, or NULL + sep a separator value for the list (see string_nextinlist()) ++ or zero for auto + anchorptr ptr to tree for named items, or NULL if no named items + cache_bits ptr to cache_bits for ditto, or NULL if not caching + type MCL_DOMAIN when matching a domain list +diff --git a/src/tls-gnu.c b/src/tls-gnu.c +index 729fb5879..b47fabf1d 100644 +--- a/src/tls-gnu.c ++++ b/src/tls-gnu.c +@@ -1119,21 +1119,28 @@ switch (tls_id) + /* The format of "data" here doesn't seem to be documented, but appears + to be a 2-byte field with a (redundant, given the "size" arg) total length + then a sequence of one-byte size then string (not nul-term) names. The +- latter is as described in OpenSSL documentation. */ ++ latter is as described in OpenSSL documentation. ++ Note that we do not get called for a match_fail, making it hard to log ++ a single bad ALPN being offered (the common case). */ ++ { ++ gstring * g = NULL; + + DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size); + for (const uschar * s = data+2; s-data < size-1; s += *s + 1) + { + server_seen_alpn++; ++ g = string_append_listele_n(g, ':', s+1, *s); + DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1); + } + DEBUG(D_tls) debug_printf("\n"); + if (server_seen_alpn > 1) + { ++ log_write(0, LOG_MAIN, "TLS ALPN (%s) rejected", string_from_gstring(g)); + DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n"); + return GNUTLS_E_NO_APPLICATION_PROTOCOL; + } + break; ++ } + #endif + } + return 0; +diff --git a/src/tls-openssl.c b/src/tls-openssl.c +index e063d29bd..513ba0d3a 100644 +--- a/src/tls-openssl.c ++++ b/src/tls-openssl.c +@@ -2324,6 +2324,8 @@ static int + tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen, + const uschar * in, unsigned int inlen, void * arg) + { ++gstring * g = NULL; ++ + server_seen_alpn = TRUE; + DEBUG(D_tls) + { +@@ -2354,12 +2356,19 @@ if ( inlen > 1 /* at least one name */ + } + } + +-/* More than one name from clilent, or name did not match our list. */ ++/* More than one name from client, or name did not match our list. */ + + /* This will be fatal to the TLS conn; would be nice to kill TCP also. + Maybe as an option in future; for now leave control to the config (must-tls). */ + +-DEBUG(D_tls) debug_printf("TLS ALPN rejected\n"); ++for (int pos = 0, siz; pos < inlen; pos += siz+1) ++ { ++ siz = in[pos]; ++ if (pos + 1 + siz > inlen) siz = inlen - pos - 1; ++ g = string_append_listele_n(g, ':', in + pos + 1, siz); ++ } ++log_write(0, LOG_MAIN, "TLS ALPN (%s) rejected", string_from_gstring(g)); ++gstring_release_unused(g); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + #endif /* EXIM_HAVE_ALPN */ +-- +2.39.0 + diff --git a/debian/patches/75_64-DANE-do-not-check-dns_again_means_nonexist-for-TLSA-.patch b/debian/patches/75_64-DANE-do-not-check-dns_again_means_nonexist-for-TLSA-.patch new file mode 100644 index 0000000..417ffa4 --- /dev/null +++ b/debian/patches/75_64-DANE-do-not-check-dns_again_means_nonexist-for-TLSA-.patch @@ -0,0 +1,96 @@ +From 30520c8f87fcf660ed99a2344cae7f9787f7bc89 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 5 Jan 2023 18:39:51 +0000 +Subject: [PATCH 3/3] DANE: do not check dns_again_means_nonexist for TLSA + results of TRY_AGAIN + +--- + doc/doc-docbook/spec.xfpt | 7 ++++++- + doc/ChangeLog | 4 ++++ + src/dns.c | 35 ++++++++++++++++++++++------------- + 3 files changed, 32 insertions(+), 14 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -46,10 +46,14 @@ JH/19 Bug 2911: Fix a recursion in DNS l + JH/20 Bug 2954: (OpenSSL) Fix setting of explicit EC curve/group. Previously + this always failed, probably leading to the usual downgrade to in-clear + connections. + + ++JH/20 Fix TLSA lookups. Previously dns_again_means_nonexist would affect ++ SERVFAIL results, which breaks the downgrade resistance of DANE. Change ++ to not checking that list for these looks. ++ + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/dns.c ++++ b/src/dns.c +@@ -904,25 +904,34 @@ if (dnsa->answerlen < 0) switch (h_errno + DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n", + name, dns_text_type(type)); + + /* Cut this out for various test programs */ + #ifndef STAND_ALONE +- if (try_again_recursion) ++ /* Permitting dns_again_means nonexist for TLSA lookups breaks the ++ doewngrade resistance of dane, so avoid for those. */ ++ ++ if (type == T_TLSA) ++ rc = FAIL; ++ else + { +- log_write(0, LOG_MAIN|LOG_PANIC, +- "dns_again_means_nonexist recursion seen for %s (assuming nonexist)", +- name); +- return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH); +- } ++ if (try_again_recursion) ++ { ++ log_write(0, LOG_MAIN|LOG_PANIC, ++ "dns_again_means_nonexist recursion seen for %s" ++ " (assuming nonexist)", name); ++ return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), ++ DNS_NOMATCH); ++ } + +- try_again_recursion = TRUE; +- save_domain = deliver_domain; +- deliver_domain = string_copy(name); /* set $domain */ +- rc = match_isinlist(name, CUSS &dns_again_means_nonexist, 0, +- &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL); +- deliver_domain = save_domain; +- try_again_recursion = FALSE; ++ try_again_recursion = TRUE; ++ save_domain = deliver_domain; ++ deliver_domain = string_copy(name); /* set $domain */ ++ rc = match_isinlist(name, CUSS &dns_again_means_nonexist, 0, ++ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL); ++ deliver_domain = save_domain; ++ try_again_recursion = FALSE; ++ } + + if (rc != OK) + { + DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n"); + return dns_fail_return(name, type, 0, DNS_AGAIN); +--- a/doc/spec.txt ++++ b/doc/spec.txt +@@ -14246,11 +14246,13 @@ dns_again_means_nonexist, it is treated + should be used with care. You can make it apply to reverse lookups by a setting + such as this: + + dns_again_means_nonexist = *.in-addr.arpa + +-This option applies to all DNS lookups that Exim does. It also applies when the ++This option applies to all DNS lookups that Exim does, except for TLSA lookups ++(where knowing about such failures +is security-relevant). It also applies ++when the + gethostbyname() or getipnodebyname() functions give temporary errors, since + these are most likely to be caused by DNS lookup problems. The dnslookup router + has some options of its own for controlling what happens when lookups for MX or + SRV records give temporary errors. These more specific options are applied + after this global option. diff --git a/debian/patches/75_66-Fix-crash-in-expansions.patch b/debian/patches/75_66-Fix-crash-in-expansions.patch new file mode 100644 index 0000000..d776c8e --- /dev/null +++ b/debian/patches/75_66-Fix-crash-in-expansions.patch @@ -0,0 +1,84 @@ +From 70069b65a39a7ba73a36fbd95371ff03cde1eb23 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 2 Feb 2023 20:00:35 +0000 +Subject: [PATCH] Fix crash in expansions + +Broken-by: 1058096b8c53 +--- + doc/ChangeLog | 4 ++++ + src/expand.c | 9 +++++---- + test/stderr/0630 | 1 + + 3 files changed, 10 insertions(+), 4 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -50,10 +50,14 @@ JH/20 Bug 2954: (OpenSSL) Fix setting of + + JH/20 Fix TLSA lookups. Previously dns_again_means_nonexist would affect + SERVFAIL results, which breaks the downgrade resistance of DANE. Change + to not checking that list for these looks. + ++JH/23 Fix crash in string expansions. Previously, if an empty variable was ++ immediately followed by an expansion operator, a null-indirection read ++ was done, killing the process. ++ + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/expand.c ++++ b/src/expand.c +@@ -4652,11 +4652,11 @@ while (*s) + yield = string_catn(yield, value, len); + + continue; + } + +- if (isdigit(*s)) ++ if (isdigit(*s)) /* A $<n> variable */ + { + int n; + s = read_cnumber(&n, s); + if (n >= 0 && n <= expand_nmax) + yield = string_catn(yield, expand_nstring[n], expand_nlength[n]); +@@ -7060,10 +7060,11 @@ NOT_ITEM: ; + if (arg) *arg++ = '_'; /* Put back for error messages */ + } + + /* Deal specially with operators that might take a certificate variable + as we do not want to do the usual expansion. For most, expand the string.*/ ++ + switch(c) + { + #ifndef DISABLE_TLS + case EOP_MD5: + case EOP_SHA1: +@@ -7107,11 +7108,11 @@ NOT_ITEM: ; + + /* Otherwise, switch on the operator type. After handling go back + to the main loop top. */ + + { +- int start = yield->ptr; ++ unsigned expansion_start = gstring_length(yield); + switch(c) + { + case EOP_BASE32: + { + uschar *t; +@@ -8168,12 +8169,12 @@ NOT_ITEM: ; + goto EXPAND_FAILED; + } /* EOP_* switch */ + + DEBUG(D_expand) + { +- const uschar * s = yield->s + start; +- int i = yield->ptr - start; ++ const uschar * s = yield->s + expansion_start; ++ int i = gstring_length(yield) - expansion_start; + BOOL tainted = is_tainted(s); + + DEBUG(D_noutf8) + { + debug_printf_indent("|-----op-res: %.*s\n", i, s); diff --git a/debian/patches/75_68-Fix-srs_encode-.-for-mod-1024-day-zero.patch b/debian/patches/75_68-Fix-srs_encode-.-for-mod-1024-day-zero.patch new file mode 100644 index 0000000..dddd5e9 --- /dev/null +++ b/debian/patches/75_68-Fix-srs_encode-.-for-mod-1024-day-zero.patch @@ -0,0 +1,62 @@ +From 51f9c07cd341c9c1a09b3816df988c6f44477c99 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Tue, 11 Apr 2023 11:59:08 +0100 +Subject: [PATCH] Fix ${srs_encode ..} for mod-1024 day zero + +--- + doc/ChangeLog | 3 +++ + src/expand.c | 10 ++++------ + 2 files changed, 7 insertions(+), 6 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -54,10 +54,13 @@ JH/20 Fix TLSA lookups. Previously dns_ + + JH/23 Fix crash in string expansions. Previously, if an empty variable was + immediately followed by an expansion operator, a null-indirection read + was done, killing the process. + ++JH/27 Fix ${srs_encode ..}. Previously it would give a bad result for one day ++ every 1024 days. ++ + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/expand.c ++++ b/src/expand.c +@@ -3440,11 +3440,11 @@ switch(cond_type = identify_operator(&s, + case 3: return NULL; + } + + /* Match the given local_part against the SRS-encoded pattern */ + +- re = regex_must_compile(US"^(?i)SRS0=([^=]+)=([A-Z2-7]+)=([^=]*)=(.*)$", ++ re = regex_must_compile(US"^(?i)SRS0=([^=]+)=([A-Z2-7]{2})=([^=]*)=(.*)$", + TRUE, FALSE); + md = pcre2_match_data_create(4+1, pcre_gen_ctx); + if (pcre2_match(re, sub[0], PCRE2_ZERO_TERMINATED, 0, PCRE_EOPT, + md, pcre_mtc_ctx) < 0) + { +@@ -6957,17 +6957,15 @@ while (*s) + + /* ${base32:${eval:$tod_epoch/86400&0x3ff}}= */ + { + struct timeval now; + unsigned long i; +- gstring * h = NULL; + + gettimeofday(&now, NULL); +- for (unsigned long i = (now.tv_sec / 86400) & 0x3ff; i; i >>= 5) +- h = string_catn(h, &base32_chars[i & 0x1f], 1); +- if (h) while (h->ptr > 0) +- g = string_catn(g, &h->s[--h->ptr], 1); ++ i = (now.tv_sec / 86400) & 0x3ff; ++ g = string_catn(g, &base32_chars[i >> 5], 1); ++ g = string_catn(g, &base32_chars[i & 0x1f], 1); + } + g = string_catn(g, US"=", 1); + + /* ${domain:$return_path}=${local_part:$return_path} */ + { diff --git a/debian/patches/75_70-Fix-variable-initialisation-in-smtp-transport.-Bug-2.patch b/debian/patches/75_70-Fix-variable-initialisation-in-smtp-transport.-Bug-2.patch new file mode 100644 index 0000000..4a2e3b5 --- /dev/null +++ b/debian/patches/75_70-Fix-variable-initialisation-in-smtp-transport.-Bug-2.patch @@ -0,0 +1,46 @@ +From a8786a66feb3c003c74551399b345b1634cc6739 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 4 May 2023 15:41:46 +0100 +Subject: [PATCH 1/3] Fix variable initialisation in smtp transport. Bug 2996 + +--- + doc/ChangeLog | 8 ++++++++ + src/transports/smtp.c | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -61,10 +61,18 @@ JH/23 Fix crash in string expansions. Pr + was done, killing the process. + + JH/27 Fix ${srs_encode ..}. Previously it would give a bad result for one day + every 1024 days. + ++JH/28 Bug 2996: Fix a crash in the smtp transport. When finding that the ++ message being considered for delivery was already being handled by ++ another process, and having an SMTP connection already open, the function ++ to close it tried to use an uninitialized variable. This would afftect ++ high-volume sites more, especially when running mailing-list-style loads. ++ Pollution of logs was the major effect, as the other process delivered ++ the message. Found and partly investigated by Graeme Fowler. ++ + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/transports/smtp.c ++++ b/src/transports/smtp.c +@@ -4950,11 +4950,11 @@ Returns: nothing + void + smtp_transport_closedown(transport_instance *tblock) + { + smtp_transport_options_block * ob = SOB tblock->options_block; + client_conn_ctx cctx; +-smtp_context sx; ++smtp_context sx = {0}; + uschar buffer[256]; + uschar inbuffer[4096]; + uschar outbuffer[16]; + + /*XXX really we need an active-smtp-client ctx, rather than assuming stdout */ diff --git a/debian/patches/75_71-Auths-fix-possible-OOB-write-in-external-authenticat.patch b/debian/patches/75_71-Auths-fix-possible-OOB-write-in-external-authenticat.patch new file mode 100644 index 0000000..f6936a9 --- /dev/null +++ b/debian/patches/75_71-Auths-fix-possible-OOB-write-in-external-authenticat.patch @@ -0,0 +1,22 @@ +From 7bb5bc2c6592e062bf0b514cc71afd2d93e2e0dd Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 11 May 2023 18:02:43 +0100 +Subject: [PATCH 1/4] Auths: fix possible OOB write in external authenticator. + Bug 2999 + +--- + doc/doc-txt/ChangeLog | 3 +++ + src/src/auths/external.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/src/auths/external.c ++++ b/src/auths/external.c +@@ -103,7 +103,7 @@ if (expand_nmax == 0) /* skip if rxd da + if (ob->server_param2) + { + uschar * s = expand_string(ob->server_param2); +- auth_vars[expand_nmax] = s; ++ auth_vars[expand_nmax = 1] = s; + expand_nstring[++expand_nmax] = s; + expand_nlength[expand_nmax] = Ustrlen(s); + if (ob->server_param3) diff --git a/debian/patches/75_72-Auths-use-uschar-more-in-spa-authenticator.patch b/debian/patches/75_72-Auths-use-uschar-more-in-spa-authenticator.patch new file mode 100644 index 0000000..03958fc --- /dev/null +++ b/debian/patches/75_72-Auths-use-uschar-more-in-spa-authenticator.patch @@ -0,0 +1,226 @@ +From 0519dcfb5f149154a416b54865fd8026abb57791 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 11 May 2023 18:53:25 +0100 +Subject: [PATCH 2/4] Auths: use uschar more in spa authenticator + +--- + src/src/auths/auth-spa.c | 72 +++++++++++++++++++++------------------- + src/src/auths/auth-spa.h | 8 ++--- + src/src/auths/spa.c | 13 ++++---- + 3 files changed, 47 insertions(+), 46 deletions(-) + +--- a/src/auths/auth-spa.c ++++ b/src/auths/auth-spa.c +@@ -155,6 +155,9 @@ int main (int argc, char ** argv) + up with a different answer to the one above) + */ + ++#ifndef MACRO_PREDEF ++ ++ + #define DEBUG_X(a,b) ; + + extern int DEBUGLEVEL; +@@ -1229,21 +1232,21 @@ else \ + + #define spa_string_add(ptr, header, string) \ + { \ +-char *p = string; \ ++uschar * p = string; \ + int len = 0; \ +-if (p) len = strlen(p); \ +-spa_bytes_add(ptr, header, (US p), len); \ ++if (p) len = Ustrlen(p); \ ++spa_bytes_add(ptr, header, p, len); \ + } + + #define spa_unicode_add_string(ptr, header, string) \ + { \ +-char *p = string; \ +-uschar *b = NULL; \ ++uschar * p = string; \ ++uschar * b = NULL; \ + int len = 0; \ + if (p) \ + { \ +- len = strlen(p); \ +- b = strToUnicode(p); \ ++ len = Ustrlen(p); \ ++ b = US strToUnicode(CS p); \ + } \ + spa_bytes_add(ptr, header, b, len*2); \ + } +@@ -1366,15 +1369,15 @@ fprintf (fp, " Flags = %08x\n", IVA + #endif + + void +-spa_build_auth_request (SPAAuthRequest * request, char *user, char *domain) ++spa_build_auth_request (SPAAuthRequest * request, uschar * user, uschar * domain) + { +-char *u = strdup (user); +-char *p = strchr (u, '@'); ++uschar * u = string_copy(user); ++uschar * p = Ustrchr(u, '@'); + + if (p) + { + if (!domain) +- domain = p + 1; ++ domain = p + 1; + *p = '\0'; + } + +@@ -1384,7 +1387,6 @@ SIVAL (&request->msgType, 0, 1); + SIVAL (&request->flags, 0, 0x0000b207); /* have to figure out what these mean */ + spa_string_add (request, user, u); + spa_string_add (request, domain, domain); +-free (u); + } + + +@@ -1475,16 +1477,16 @@ free (u); + + void + spa_build_auth_response (SPAAuthChallenge * challenge, +- SPAAuthResponse * response, char *user, +- char *password) ++ SPAAuthResponse * response, uschar * user, ++ uschar * password) + { + uint8x lmRespData[24]; + uint8x ntRespData[24]; + uint32x cf = IVAL(&challenge->flags, 0); +-char *u = strdup (user); +-char *p = strchr (u, '@'); +-char *d = NULL; +-char *domain; ++uschar * u = string_copy(user); ++uschar * p = Ustrchr(u, '@'); ++uschar * d = NULL; ++uschar * domain; + + if (p) + { +@@ -1492,33 +1494,33 @@ if (p) + *p = '\0'; + } + +-else domain = d = strdup((cf & 0x1)? +- CCS GetUnicodeString(challenge, uDomain) : +- CCS GetString(challenge, uDomain)); ++else domain = d = string_copy(cf & 0x1 ++ ? CUS GetUnicodeString(challenge, uDomain) ++ : CUS GetString(challenge, uDomain)); + +-spa_smb_encrypt (US password, challenge->challengeData, lmRespData); +-spa_smb_nt_encrypt (US password, challenge->challengeData, ntRespData); ++spa_smb_encrypt(password, challenge->challengeData, lmRespData); ++spa_smb_nt_encrypt(password, challenge->challengeData, ntRespData); + + response->bufIndex = 0; + memcpy (response->ident, "NTLMSSP\0\0\0", 8); + SIVAL (&response->msgType, 0, 3); + +-spa_bytes_add (response, lmResponse, lmRespData, (cf & 0x200) ? 24 : 0); +-spa_bytes_add (response, ntResponse, ntRespData, (cf & 0x8000) ? 24 : 0); ++spa_bytes_add(response, lmResponse, lmRespData, cf & 0x200 ? 24 : 0); ++spa_bytes_add(response, ntResponse, ntRespData, cf & 0x8000 ? 24 : 0); + + if (cf & 0x1) { /* Unicode Text */ +- spa_unicode_add_string (response, uDomain, domain); +- spa_unicode_add_string (response, uUser, u); +- spa_unicode_add_string (response, uWks, u); ++ spa_unicode_add_string(response, uDomain, domain); ++ spa_unicode_add_string(response, uUser, u); ++ spa_unicode_add_string(response, uWks, u); + } else { /* OEM Text */ +- spa_string_add (response, uDomain, domain); +- spa_string_add (response, uUser, u); +- spa_string_add (response, uWks, u); ++ spa_string_add(response, uDomain, domain); ++ spa_string_add(response, uUser, u); ++ spa_string_add(response, uWks, u); + } + +-spa_string_add (response, sessionKey, NULL); ++spa_string_add(response, sessionKey, NULL); + response->flags = challenge->flags; +- +-if (d != NULL) free (d); +-free (u); + } ++ ++ ++#endif /*!MACRO_PREDEF*/ +--- a/src/auths/auth-spa.h ++++ b/src/auths/auth-spa.h +@@ -79,10 +79,10 @@ typedef struct + + void spa_bits_to_base64 (unsigned char *, const unsigned char *, int); + int spa_base64_to_bits(char *, int, const char *); +-void spa_build_auth_response (SPAAuthChallenge *challenge, +- SPAAuthResponse *response, char *user, char *password); +-void spa_build_auth_request (SPAAuthRequest *request, char *user, +- char *domain); ++void spa_build_auth_response (SPAAuthChallenge * challenge, ++ SPAAuthResponse * response, uschar * user, uschar * password); ++void spa_build_auth_request (SPAAuthRequest * request, uschar * user, ++ uschar * domain); + extern void spa_smb_encrypt (unsigned char * passwd, unsigned char * c8, + unsigned char * p24); + extern void spa_smb_nt_encrypt (unsigned char * passwd, unsigned char * c8, +--- a/src/auths/spa.c ++++ b/src/auths/spa.c +@@ -284,14 +284,13 @@ SPAAuthRequest request; + SPAAuthChallenge challenge; + SPAAuthResponse response; + char msgbuf[2048]; +-char *domain = NULL; +-char *username, *password; ++uschar * domain = NULL, * username, * password; + + /* Code added by PH to expand the options */ + + *buffer = 0; /* Default no message when cancelled */ + +-if (!(username = CS expand_string(ob->spa_username))) ++if (!(username = expand_string(ob->spa_username))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " +@@ -300,7 +299,7 @@ if (!(username = CS expand_string(ob->sp + return ERROR; + } + +-if (!(password = CS expand_string(ob->spa_password))) ++if (!(password = expand_string(ob->spa_password))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " +@@ -310,7 +309,7 @@ if (!(password = CS expand_string(ob->sp + } + + if (ob->spa_domain) +- if (!(domain = CS expand_string(ob->spa_domain))) ++ if (!(domain = expand_string(ob->spa_domain))) + { + if (f.expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " +@@ -330,7 +329,7 @@ if (!smtp_read_response(sx, US buffer, b + + DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain); + +-spa_build_auth_request(&request, CS username, domain); ++spa_build_auth_request(&request, username, domain); + spa_bits_to_base64(US msgbuf, US &request, spa_request_length(&request)); + + DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf); +@@ -347,7 +346,7 @@ if (!smtp_read_response(sx, US buffer, b + DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4); + spa_base64_to_bits(CS (&challenge), sizeof(challenge), CCS (buffer + 4)); + +-spa_build_auth_response(&challenge, &response, CS username, CS password); ++spa_build_auth_response(&challenge, &response, username, password); + spa_bits_to_base64(US msgbuf, US &response, spa_request_length(&response)); + DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf); + diff --git a/debian/patches/75_73-Auths-fix-possible-OOB-write-in-SPA-authenticator.-B.patch b/debian/patches/75_73-Auths-fix-possible-OOB-write-in-SPA-authenticator.-B.patch new file mode 100644 index 0000000..8c763fa --- /dev/null +++ b/debian/patches/75_73-Auths-fix-possible-OOB-write-in-SPA-authenticator.-B.patch @@ -0,0 +1,24 @@ +From e17b8b0f19b25a223b0cc41933b881c3a1073e61 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 11 May 2023 19:31:54 +0100 +Subject: [PATCH 3/4] Auths: fix possible OOB write in SPA authenticator. Bug + 3000 + +--- + doc/doc-txt/ChangeLog | 3 +++ + src/src/auths/auth-spa.c | 4 +++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/src/auths/auth-spa.c ++++ b/src/auths/auth-spa.c +@@ -1214,7 +1214,9 @@ char versionString[] = "libntlm version + + #define spa_bytes_add(ptr, header, buf, count) \ + { \ +-if (buf && (count) != 0) /* we hate -Wint-in-bool-contex */ \ ++if ( buf && (count) != 0 /* we hate -Wint-in-bool-contex */ \ ++ && ptr->bufIndex + count < sizeof(ptr->buffer) \ ++ ) \ + { \ + SSVAL(&ptr->header.len,0,count); \ + SSVAL(&ptr->header.maxlen,0,count); \ diff --git a/debian/patches/75_74-Auths-fix-possible-OOB-read-in-SPA-authenticator.-Bu.patch b/debian/patches/75_74-Auths-fix-possible-OOB-read-in-SPA-authenticator.-Bu.patch new file mode 100644 index 0000000..d4e0eb6 --- /dev/null +++ b/debian/patches/75_74-Auths-fix-possible-OOB-read-in-SPA-authenticator.-Bu.patch @@ -0,0 +1,75 @@ +From 04107e98d58efb69f7e2d7b81176e5374c7098a3 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 11 May 2023 21:08:08 +0100 +Subject: [PATCH 4/4] Auths: fix possible OOB read in SPA authenticator. Bug + 3001 + +--- + doc/doc-txt/ChangeLog | 3 +++ + src/src/auths/auth-spa.c | 36 ++++++++++++++++++++++++++++-------- + 2 files changed, 31 insertions(+), 8 deletions(-) + +--- a/src/auths/auth-spa.c ++++ b/src/auths/auth-spa.c +@@ -1254,15 +1254,10 @@ spa_bytes_add(ptr, header, b, len*2); \ + } + + +-#define GetUnicodeString(structPtr, header) \ +-unicodeToString(((char*)structPtr) + IVAL(&structPtr->header.offset,0) , SVAL(&structPtr->header.len,0)/2) +-#define GetString(structPtr, header) \ +-toString(((CS structPtr) + IVAL(&structPtr->header.offset,0)), SVAL(&structPtr->header.len,0)) +- + #ifdef notdef + + #define DumpBuffer(fp, structPtr, header) \ +-dumpRaw(fp,(US structPtr)+IVAL(&structPtr->header.offset,0),SVAL(&structPtr->header.len,0)) ++ dumpRaw(fp,(US structPtr)+IVAL(&structPtr->header.offset,0),SVAL(&structPtr->header.len,0)) + + + static void +@@ -1326,8 +1321,33 @@ buf[len] = 0; + return buf; + } + ++static inline uschar * ++get_challenge_unistr(SPAAuthChallenge * challenge, SPAStrHeader * hdr) ++{ ++int off = IVAL(&hdr->offset, 0); ++int len = SVAL(&hdr->len, 0); ++return off + len < sizeof(SPAAuthChallenge) ++ ? US unicodeToString(CS challenge + off, len/2) : US""; ++} ++ ++static inline uschar * ++get_challenge_str(SPAAuthChallenge * challenge, SPAStrHeader * hdr) ++{ ++int off = IVAL(&hdr->offset, 0); ++int len = SVAL(&hdr->len, 0); ++return off + len < sizeof(SPAAuthChallenge) ++ ? US toString(CS challenge + off, len) : US""; ++} ++ + #ifdef notdef + ++#define GetUnicodeString(structPtr, header) \ ++ unicodeToString(((char*)structPtr) + IVAL(&structPtr->header.offset,0) , SVAL(&structPtr->header.len,0)/2) ++ ++#define GetString(structPtr, header) \ ++ toString(((CS structPtr) + IVAL(&structPtr->header.offset,0)), SVAL(&structPtr->header.len,0)) ++ ++ + void + dumpSmbNtlmAuthRequest (FILE * fp, SPAAuthRequest * request) + { +@@ -1497,8 +1517,8 @@ if (p) + } + + else domain = d = string_copy(cf & 0x1 +- ? CUS GetUnicodeString(challenge, uDomain) +- : CUS GetString(challenge, uDomain)); ++ ? CUS get_challenge_unistr(challenge, &challenge->uDomain) ++ : CUS get_challenge_str(challenge, &challenge->uDomain)); + + spa_smb_encrypt(password, challenge->challengeData, lmRespData); + spa_smb_nt_encrypt(password, challenge->challengeData, ntRespData); diff --git a/debian/patches/75_74-Cancel-early-pipe-on-an-observed-advertising-change.patch b/debian/patches/75_74-Cancel-early-pipe-on-an-observed-advertising-change.patch new file mode 100644 index 0000000..bcec88f --- /dev/null +++ b/debian/patches/75_74-Cancel-early-pipe-on-an-observed-advertising-change.patch @@ -0,0 +1,35 @@ +From 4d108e7777e9b8e5fb212c31812fef61529cd414 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Mon, 12 Jun 2023 22:13:46 +0100 +Subject: [PATCH] Cancel early-pipe on an observed advertising change + +--- + src/transports/smtp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/transports/smtp.c b/src/transports/smtp.c +index c72028ce9..24ee577a2 100644 +--- a/src/transports/smtp.c ++++ b/src/transports/smtp.c +@@ -1111,15 +1111,18 @@ if (pending_EHLO) + *(tls_out.active.sock < 0 + ? &sx->ehlo_resp.cleartext_features : &sx->ehlo_resp.crypted_features) = + peer_offered; + *ap = authbits; + write_ehlo_cache_entry(sx); + } + else ++ { + invalidate_ehlo_cache_entry(sx); ++ sx->early_pipe_active = FALSE; /* cancel further early-pipe on this conn */ ++ } + + return OK; /* just carry on */ + } + # ifdef EXPERIMENTAL_ESMTP_LIMITS + /* If we are handling LIMITS, compare the actual EHLO LIMITS values with the + cached values and invalidate cache if different. OK to carry on with + connect since values are advisory. */ +-- +2.40.1 + diff --git a/debian/patches/75_76-Expansions-disallow-UTF-16-surrogates-from-utf8clean.patch b/debian/patches/75_76-Expansions-disallow-UTF-16-surrogates-from-utf8clean.patch new file mode 100644 index 0000000..713435b --- /dev/null +++ b/debian/patches/75_76-Expansions-disallow-UTF-16-surrogates-from-utf8clean.patch @@ -0,0 +1,99 @@ +From 1209e3e19e292cee517e43a2ccfe9b44b33bb1dc Mon Sep 17 00:00:00 2001 +From: Jasen Betts <jasen@xnet.co.nz> +Date: Sun, 23 Jul 2023 13:43:59 +0100 +Subject: [PATCH] Expansions: disallow UTF-16 surrogates from ${utf8clean:...}. + Bug 2998 + +--- + doc/ChangeLog | 4 ++++ + src/expand.c | 27 +++++++++++++++++---------- + 2 files changed, 21 insertions(+), 10 deletions(-) + +--- a/src/expand.c ++++ b/src/expand.c +@@ -7731,11 +7731,11 @@ NOT_ITEM: ; + + case EOP_UTF8CLEAN: + { + int seq_len = 0, index = 0; + int bytes_left = 0; +- long codepoint = -1; ++ ulong codepoint = (ulong)-1; + int complete; + uschar seq_buff[4]; /* accumulate utf-8 here */ + + /* Manually track tainting, as we deal in individual chars below */ + +@@ -7761,40 +7761,47 @@ NOT_ITEM: ; + codepoint = (codepoint << 6) | (c & 0x3f); + seq_buff[index++] = c; + if (--bytes_left == 0) /* codepoint complete */ + if(codepoint > 0x10FFFF) /* is it too large? */ + complete = -1; /* error (RFC3629 limit) */ ++ else if ( (codepoint & 0x1FF800 ) == 0xD800 ) /* surrogate */ ++ /* A UTF-16 surrogate (which should be one of a pair that ++ encode a Unicode codepoint that is outside the Basic ++ Multilingual Plane). Error, not UTF8. ++ RFC2279.2 is slightly unclear on this, but ++ https://unicodebook.readthedocs.io/issues.html#strict-utf8-decoder ++ says "Surrogates characters are also invalid in UTF-8: ++ characters in U+D800—U+DFFF have to be rejected." */ ++ complete = -1; + else + { /* finished; output utf-8 sequence */ + yield = string_catn(yield, seq_buff, seq_len); + index = 0; + } + } + } + else /* no bytes left: new sequence */ + { +- if(!(c & 0x80)) /* 1-byte sequence, US-ASCII, keep it */ ++ if (!(c & 0x80)) /* 1-byte sequence, US-ASCII, keep it */ + { + yield = string_catn(yield, &c, 1); + continue; + } +- if((c & 0xe0) == 0xc0) /* 2-byte sequence */ +- { +- if(c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */ ++ if ((c & 0xe0) == 0xc0) /* 2-byte sequence */ ++ if (c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */ + complete = -1; + else + { +- bytes_left = 1; +- codepoint = c & 0x1f; ++ bytes_left = 1; ++ codepoint = c & 0x1f; + } +- } +- else if((c & 0xf0) == 0xe0) /* 3-byte sequence */ ++ else if ((c & 0xf0) == 0xe0) /* 3-byte sequence */ + { + bytes_left = 2; + codepoint = c & 0x0f; + } +- else if((c & 0xf8) == 0xf0) /* 4-byte sequence */ ++ else if ((c & 0xf8) == 0xf0) /* 4-byte sequence */ + { + bytes_left = 3; + codepoint = c & 0x07; + } + else /* invalid or too long (RFC3629 allows only 4 bytes) */ +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -69,10 +69,13 @@ JH/28 Bug 2996: Fix a crash in the smtp + to close it tried to use an uninitialized variable. This would afftect + high-volume sites more, especially when running mailing-list-style loads. + Pollution of logs was the major effect, as the other process delivered + the message. Found and partly investigated by Graeme Fowler. + ++JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints. ++ Found and fixed by Jasen Betts. No testcase for this as my usual text ++ editor insists on emitting only valid UTF-8. + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from diff --git a/debian/patches/75_77-GnuTLS-fix-crash-with-tls_dhparam-none.patch b/debian/patches/75_77-GnuTLS-fix-crash-with-tls_dhparam-none.patch new file mode 100644 index 0000000..ced0ce9 --- /dev/null +++ b/debian/patches/75_77-GnuTLS-fix-crash-with-tls_dhparam-none.patch @@ -0,0 +1,92 @@ +From 8e9770348dc4173ab83657ee023c22f479ebb712 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Mon, 24 Jul 2023 13:30:40 +0100 +Subject: [PATCH] GnuTLS: fix crash with "tls_dhparam = none" + +--- + doc/ChangeLog | 4 ++++ + src/tls-gnu.c | 16 +++++++++------- + test/log/2049 | 7 +++++++ + test/scripts/2000-GnuTLS/2049 | 8 ++++++++ + 4 files changed, 28 insertions(+), 7 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -73,10 +73,14 @@ JH/28 Bug 2996: Fix a crash in the smtp + + JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints. + Found and fixed by Jasen Betts. No testcase for this as my usual text + editor insists on emitting only valid UTF-8. + ++JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave ++ a null-indireciton SIGSEGV for the receive process. ++ ++ + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from + after reception to before a subsequent reception. This should +--- a/src/tls-gnu.c ++++ b/src/tls-gnu.c +@@ -712,11 +712,11 @@ exist, we generate them. This means that + The new file is written as a temporary file and renamed, so that an incomplete + file is never present. If two processes both compute some new parameters, you + waste a bit of effort, but it doesn't seem worth messing around with locking to + prevent this. + +-Returns: OK/DEFER/FAIL ++Returns: OK/DEFER (expansion issue)/FAIL (requested none) + */ + + static int + init_server_dh(uschar ** errstr) + { +@@ -750,11 +750,11 @@ if (!exp_tls_dhparam) + else if (Ustrcmp(exp_tls_dhparam, "historic") == 0) + use_file_in_spool = TRUE; + else if (Ustrcmp(exp_tls_dhparam, "none") == 0) + { + DEBUG(D_tls) debug_printf("Requested no DH parameters\n"); +- return OK; ++ return FAIL; + } + else if (exp_tls_dhparam[0] != '/') + { + if (!(m.data = US std_dh_prime_named(exp_tls_dhparam))) + return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr); +@@ -1971,27 +1971,29 @@ Arguments: + + Returns: OK/DEFER/FAIL + */ + + static int +-tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr) ++tls_set_remaining_x509(exim_gnutls_state_st * state, uschar ** errstr) + { +-int rc; +-const host_item *host = state->host; /* macro should be reconsidered? */ ++int rc = OK; ++const host_item * host = state->host; /* macro should be reconsidered? */ + + /* Create D-H parameters, or read them from the cache file. This function does + its own SMTP error messaging. This only happens for the server, TLS D-H ignores + client-side params. */ + + if (!state->host) + { + if (!dh_server_params) +- if ((rc = init_server_dh(errstr)) != OK) return rc; ++ if ((rc = init_server_dh(errstr)) == DEFER) return rc; + + /* Unnecessary & discouraged with 3.6.0 or later, according to docs. But without it, + no DHE- ciphers are advertised. */ +- gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params); ++ ++ if (rc == OK) ++ gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params); + } + + /* Link the credentials to the session. */ + + if ((rc = gnutls_credentials_set(state->session, diff --git a/debian/patches/75_79-Fix-recipients-expansion-when-used-within-run.-.-Bug.patch b/debian/patches/75_79-Fix-recipients-expansion-when-used-within-run.-.-Bug.patch new file mode 100644 index 0000000..1eb9d8f --- /dev/null +++ b/debian/patches/75_79-Fix-recipients-expansion-when-used-within-run.-.-Bug.patch @@ -0,0 +1,294 @@ +From 6707bfa9fb78858de938a1abca2846c820c5ded7 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 3 Aug 2023 18:40:42 +0100 +Subject: [PATCH 2/2] Fix $recipients expansion when used within ${run...}. + Bug 3013 + +Broken-by: cfe6acff2ddc +--- + doc/ChangeLog | 3 +++ + src/deliver.c | 2 +- + src/expand.c | 5 ++--- + src/functions.h | 2 +- + src/macros.h | 5 +++++ + src/routers/queryprogram.c | 3 +-- + src/smtp_in.c | 4 ++-- + src/transport.c | 18 +++++++++--------- + src/transports/lmtp.c | 4 ++-- + src/transports/pipe.c | 11 ++++++----- + src/transports/smtp.c | 2 +- + test/log/0635 | 2 +- + 12 files changed, 34 insertions(+), 27 deletions(-) + +--- a/src/deliver.c ++++ b/src/deliver.c +@@ -2382,11 +2382,11 @@ if ((pid = exim_fork(US"delivery-local") + + if (tp->filter_command) + { + ok = transport_set_up_command(&transport_filter_argv, + tp->filter_command, +- TRUE, PANIC, addr, FALSE, US"transport filter", NULL); ++ TSUC_EXPAND_ARGS, PANIC, addr, US"transport filter", NULL); + transport_filter_timeout = tp->filter_timeout; + } + else transport_filter_argv = NULL; + + if (ok) +--- a/src/expand.c ++++ b/src/expand.c +@@ -5527,11 +5527,11 @@ while (*s) + + case EITEM_RUN: + { + FILE * f; + const uschar * arg, ** argv; +- BOOL late_expand = TRUE; ++ unsigned late_expand = TSUC_EXPAND_ARGS | TSUC_ALLOW_TAINTED_ARGS | TSUC_ALLOW_RECIPIENTS; + + if (expand_forbid & RDO_RUN) + { + expand_string_message = US"running a command is not permitted"; + goto EXPAND_FAILED; +@@ -5540,11 +5540,11 @@ while (*s) + /* Handle options to the "run" */ + + while (*s == ',') + { + if (Ustrncmp(++s, "preexpand", 9) == 0) +- { late_expand = FALSE; s += 9; } ++ { late_expand = 0; s += 9; } + else + { + const uschar * t = s; + while (isalpha(*++t)) ; + expand_string_message = string_sprintf("bad option '%.*s' for run", +@@ -5599,11 +5599,10 @@ while (*s) + if (!transport_set_up_command(&argv, /* anchor for arg list */ + arg, /* raw command */ + late_expand, /* expand args if not already done */ + 0, /* not relevant when... */ + NULL, /* no transporting address */ +- late_expand, /* allow tainted args, when expand-after-split */ + US"${run} expansion", /* for error messages */ + &expand_string_message)) /* where to put error message */ + goto EXPAND_FAILED; + + /* Create the child process, making it a group leader. */ +--- a/src/functions.h ++++ b/src/functions.h +@@ -616,11 +616,11 @@ extern BOOL transport_pass_socket(con + , unsigned, unsigned, unsigned + #endif + ); + extern uschar *transport_rcpt_address(address_item *, BOOL); + extern BOOL transport_set_up_command(const uschar ***, const uschar *, +- BOOL, int, address_item *, BOOL, const uschar *, uschar **); ++ unsigned, int, address_item *, const uschar *, uschar **); + extern void transport_update_waiting(host_item *, uschar *); + extern BOOL transport_write_block(transport_ctx *, uschar *, int, BOOL); + extern void transport_write_reset(int); + extern BOOL transport_write_string(int, const char *, ...); + extern BOOL transport_headers_send(transport_ctx *, +--- a/src/macros.h ++++ b/src/macros.h +@@ -1112,6 +1112,11 @@ should not be one active. */ + + #define NOTIFIER_SOCKET_NAME "exim_daemon_notify" + #define NOTIFY_MSG_QRUN 1 /* Notify message types */ + #define NOTIFY_QUEUE_SIZE_REQ 2 + ++/* Flags for transport_set_up_command() */ ++#define TSUC_EXPAND_ARGS BIT(0) ++#define TSUC_ALLOW_TAINTED_ARGS BIT(1) ++#define TSUC_ALLOW_RECIPIENTS BIT(2) ++ + /* End of macros.h */ +--- a/src/routers/queryprogram.c ++++ b/src/routers/queryprogram.c +@@ -286,14 +286,13 @@ if (curr_uid != root_uid && (uid != curr + + /* Set up the command to run */ + + if (!transport_set_up_command(&argvptr, /* anchor for arg list */ + ob->command, /* raw command */ +- TRUE, /* expand the arguments */ ++ TSUC_EXPAND_ARGS, /* arguments expanded but must not be tainted */ + 0, /* not relevant when... */ + NULL, /* no transporting address */ +- FALSE, /* args must be untainted */ + US"queryprogram router", /* for error messages */ + &addr->message)) /* where to put error message */ + return DEFER; + + /* Create the child process, making it a group leader. */ +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -5840,12 +5840,12 @@ while (done <= 0) + { + uschar *error; + BOOL rc; + etrn_command = smtp_etrn_command; + deliver_domain = smtp_cmd_data; +- rc = transport_set_up_command(&argv, smtp_etrn_command, TRUE, 0, NULL, +- FALSE, US"ETRN processing", &error); ++ rc = transport_set_up_command(&argv, smtp_etrn_command, TSUC_EXPAND_ARGS, 0, NULL, ++ US"ETRN processing", &error); + deliver_domain = NULL; + if (!rc) + { + log_write(0, LOG_MAIN|LOG_PANIC, "failed to set up ETRN command: %s", + error); +--- a/src/transport.c ++++ b/src/transport.c +@@ -2082,34 +2082,34 @@ return FALSE; + * Set up direct (non-shell) command * + *************************************************/ + + /* This function is called when a command line is to be parsed and executed + directly, without the use of /bin/sh. It is called by the pipe transport, +-the queryprogram router, and also from the main delivery code when setting up a ++the queryprogram router, for any ${run } expansion, ++and also from the main delivery code when setting up a + transport filter process. The code for ETRN also makes use of this; in that + case, no addresses are passed. + + Arguments: + argvptr pointer to anchor for argv vector + cmd points to the command string (modified IN PLACE) +- expand_arguments true if expansion is to occur ++ flags bits for expand-args, allow taint, allow $recipients + expand_failed error value to set if expansion fails; not relevant if + addr == NULL + addr chain of addresses, or NULL +- allow_tainted_args as it says; used for ${run} + etext text for use in error messages + errptr where to put error message if addr is NULL; + otherwise it is put in the first address + + Returns: TRUE if all went well; otherwise an error will be + set in the first address and FALSE returned + */ + + BOOL + transport_set_up_command(const uschar *** argvptr, const uschar * cmd, +- BOOL expand_arguments, int expand_failed, address_item * addr, +- BOOL allow_tainted_args, const uschar * etext, uschar ** errptr) ++ unsigned flags, int expand_failed, address_item * addr, ++ const uschar * etext, uschar ** errptr) + { + const uschar ** argv, * s; + int address_count = 0, argcount = 0, max_args; + + /* Get store in which to build an argument list. Count the number of addresses +@@ -2180,14 +2180,14 @@ DEBUG(D_transport) + debug_printf("direct command:\n"); + for (int i = 0; argv[i]; i++) + debug_printf(" argv[%d] = '%s'\n", i, string_printing(argv[i])); + } + +-if (expand_arguments) ++if (flags & TSUC_EXPAND_ARGS) + { +- BOOL allow_dollar_recipients = addr && addr->parent +- && Ustrcmp(addr->parent->address, "system-filter") == 0; ++ BOOL allow_dollar_recipients = (flags & TSUC_ALLOW_RECIPIENTS) ++ || (addr && addr->parent && Ustrcmp(addr->parent->address, "system-filter") == 0); /*XXX could we check this at caller? */ + + for (int i = 0; argv[i]; i++) + { + DEBUG(D_expand) debug_printf_indent("arg %d\n", i); + +@@ -2370,11 +2370,11 @@ if (expand_arguments) + { /* hack, would be good to not need it */ + DEBUG(D_transport) + debug_printf("SPECIFIC TESTSUITE EXEMPTION: tainted arg '%s'\n", + expanded_arg); + } +- else if ( !allow_tainted_args ++ else if ( !(flags & TSUC_ALLOW_TAINTED_ARGS) + && arg_is_tainted(expanded_arg, i, addr, etext, errptr)) + return FALSE; + argv[i] = expanded_arg; + } + } +--- a/src/transports/lmtp.c ++++ b/src/transports/lmtp.c +@@ -487,12 +487,12 @@ argument list and expanding the items. * + + if (ob->cmd) + { + DEBUG(D_transport) debug_printf("using command %s\n", ob->cmd); + sprintf(CS buffer, "%.50s transport", tblock->name); +- if (!transport_set_up_command(&argv, ob->cmd, TRUE, PANIC, addrlist, FALSE, +- buffer, NULL)) ++ if (!transport_set_up_command(&argv, ob->cmd, TSUC_EXPAND_ARGS, PANIC, ++ addrlist, buffer, NULL)) + return FALSE; + + /* If the -N option is set, can't do any more. Presume all has gone well. */ + if (f.dont_deliver) + goto MINUS_N; +--- a/src/transports/pipe.c ++++ b/src/transports/pipe.c +@@ -289,24 +289,25 @@ Arguments: + Returns: TRUE if all went well; otherwise an error will be + set in the first address and FALSE returned + */ + + static BOOL +-set_up_direct_command(const uschar ***argvptr, uschar *cmd, +- BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname, +- pipe_transport_options_block *ob) ++set_up_direct_command(const uschar *** argvptr, uschar * cmd, ++ BOOL expand_arguments, int expand_fail, address_item * addr, uschar * tname, ++ pipe_transport_options_block * ob) + { + BOOL permitted = FALSE; + const uschar **argv; + + /* Set up "transport <name>" to be put in any error messages, and then + call the common function for creating an argument list and expanding + the items if necessary. If it fails, this function fails (error information + is in the addresses). */ + +-if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail, +- addr, FALSE, string_sprintf("%.50s transport", tname), NULL)) ++if (!transport_set_up_command(argvptr, cmd, ++ expand_arguments ? TSUC_EXPAND_ARGS : 0, ++ expand_fail, addr, string_sprintf("%.50s transport", tname), NULL)) + return FALSE; + + /* Point to the set-up arguments. */ + + argv = *argvptr; +--- a/src/transports/smtp.c ++++ b/src/transports/smtp.c +@@ -3803,11 +3803,11 @@ if (tblock->filter_command) + + /* On failure, copy the error to all addresses, abandon the SMTP call, and + yield ERROR. */ + + if (!transport_set_up_command(&transport_filter_argv, +- tblock->filter_command, TRUE, DEFER, addrlist, FALSE, ++ tblock->filter_command, TSUC_EXPAND_ARGS, DEFER, addrlist, + string_sprintf("%.50s transport filter", tblock->name), NULL)) + { + set_errno_nohost(addrlist->next, addrlist->basic_errno, addrlist->message, DEFER, + FALSE, &sx->delivery_start); + yield = ERROR; +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -76,10 +76,12 @@ JH/31 Bug 2998: Fix ${utf8clean:...} to + editor insists on emitting only valid UTF-8. + + JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave + a null-indireciton SIGSEGV for the receive process. + ++JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}. ++ In 4.96 this would expand to empty. + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from diff --git a/debian/patches/75_82-GnuTLS-fix-autogen-cert-expiry-date.-Bug-3014.patch b/debian/patches/75_82-GnuTLS-fix-autogen-cert-expiry-date.-Bug-3014.patch new file mode 100644 index 0000000..cdf062e --- /dev/null +++ b/debian/patches/75_82-GnuTLS-fix-autogen-cert-expiry-date.-Bug-3014.patch @@ -0,0 +1,42 @@ +From 36bc854c86908ee921225c1d30e35c4d59eed822 Mon Sep 17 00:00:00 2001 +From: Andreas Metzler <ametzler@bebt.de> +Date: Mon, 14 Aug 2023 17:27:16 +0100 +Subject: [PATCH] GnuTLS: fix autogen cert expiry date. Bug 3014 + +Broken-by: 48e9099006 +--- + doc/ChangeLog | 3 +++ + src/tls-gnu.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -79,10 +79,13 @@ JH/32 Fix "tls_dhparam = none" under Gnu + a null-indireciton SIGSEGV for the receive process. + + JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}. + In 4.96 this would expand to empty. + ++JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server ++ certificate. Find and fix by Andreas Metzler. ++ + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from + after reception to before a subsequent reception. This should +--- a/src/tls-gnu.c ++++ b/src/tls-gnu.c +@@ -1001,11 +1001,11 @@ if ((rc = gnutls_x509_privkey_generate(p + where = US"configuring cert"; + now = 1; + if ( (rc = gnutls_x509_crt_set_version(cert, 3)) + || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now))) + || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL))) +- || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */ ++ || (rc = gnutls_x509_crt_set_expiration_time(cert, now + (long)2 * 60 * 60)) /* 2 hour */ + || (rc = gnutls_x509_crt_set_key(cert, pkey)) + + || (rc = gnutls_x509_crt_set_dn_by_oid(cert, + GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2)) + || (rc = gnutls_x509_crt_set_dn_by_oid(cert, diff --git a/debian/patches/75_83-Re-fix-live-variable-value-free.-The-inital-fix-resu.patch b/debian/patches/75_83-Re-fix-live-variable-value-free.-The-inital-fix-resu.patch new file mode 100644 index 0000000..0cfc69e --- /dev/null +++ b/debian/patches/75_83-Re-fix-live-variable-value-free.-The-inital-fix-resu.patch @@ -0,0 +1,77 @@ +From 21b172df101c2c52faf0cc56a502395451975be9 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Thu, 24 Aug 2023 15:51:21 +0100 +Subject: [PATCH 2/2] Re-fix live variable $value free. The inital fix + resulted in $value from ${run...} not being available later, which is a + documented feature. + +Broken=by: cf3fecb9e873 +--- + doc/doc-docbook/spec.xfpt | 1 + + doc/ChangeLog | 4 ++-- + src/exim.c | 3 ++- + test/confs/0635 | 1 + + test/log/0635 | 1 + + test/mail/0635.CALLER | 13 +++++++++++++ + 6 files changed, 20 insertions(+), 3 deletions(-) + create mode 100644 test/mail/0635.CALLER + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -76,10 +76,13 @@ JH/31 Bug 2998: Fix ${utf8clean:...} to + editor insists on emitting only valid UTF-8. + + JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave + a null-indireciton SIGSEGV for the receive process. + ++JH/33 Fix free for live variable $value created by a ${run ...} expansion during ++ -bh use. Internal checking would spot this and take a panic. ++ + JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}. + In 4.96 this would expand to empty. + + JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server + certificate. Find and fix by Andreas Metzler. +--- a/src/exim.c ++++ b/src/exim.c +@@ -5754,11 +5754,11 @@ for (BOOL more = TRUE; more; ) + for (int i = 0; i < count; i++) + { + int start, end, domain; + uschar * errmess; + /* There can be multiple addresses, so EXIM_DISPLAYMAIL_MAX (tuned for 1) is too short. +- * We'll still want to cap it to something, just in case. */ ++ We'll still want to cap it to something, just in case. */ + uschar * s = string_copy_taint( + exim_str_fail_toolong(list[i], BIG_BUFFER_SIZE, "address argument"), + GET_TAINTED); + + /* Loop for each comma-separated address */ +@@ -6089,10 +6089,11 @@ MORELOOP: + callout_address = NULL; + sending_ip_address = NULL; + deliver_localpart_data = deliver_domain_data = + recipient_data = sender_data = NULL; + acl_var_m = NULL; ++ lookup_value = NULL; /* Can be set by ACL */ + + store_reset(reset_point); + } + + exim_exit(EXIT_SUCCESS); /* Never returns */ +--- a/doc/spec.txt ++++ b/doc/spec.txt +@@ -9650,10 +9650,13 @@ ${run <options> {<command arg list>}{<st + If the command requires shell idioms, such as the > redirect operator, the + shell must be invoked directly, such as with: + + ${run{/bin/bash -c "/usr/bin/id >/tmp/id"}{yes}{yes}} + ++ Note that $value will not persist beyond the reception of a single ++ message. ++ + The return code from the command is put in the variable $runrc, and this + remains set afterwards, so in a filter file you can do things like this: + + if "${run{x y z}{}}$runrc" is 1 then ... + elif $runrc is 2 then ... diff --git a/debian/patches/76-01-fix-string_is_ip_address-CVE-2023-42117-Bug-3031.patch b/debian/patches/76-01-fix-string_is_ip_address-CVE-2023-42117-Bug-3031.patch new file mode 100644 index 0000000..cbddde0 --- /dev/null +++ b/debian/patches/76-01-fix-string_is_ip_address-CVE-2023-42117-Bug-3031.patch @@ -0,0 +1,309 @@ +From a95acb1c19c2e3600ef327c71318e33316d34440 Mon Sep 17 00:00:00 2001 +From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de> +Date: Thu, 5 Oct 2023 22:49:57 +0200 +Subject: [PATCH 1/3] fix: string_is_ip_address (CVE-2023-42117) Bug 3031 + +--- + doc/ChangeLog | 206 ++++++++++++++++++++++++++++++++++++++++++ + src/expand.c | 14 ++- + src/functions.h | 1 + + src/string.c | 200 +++++++++++++++++++++------------------- + 4 files changed, 323 insertions(+), 98 deletions(-) + +diff --git a/src/expand.c b/src/expand.c +index 36c9f423b..4986e4657 100644 +--- a/src/expand.c ++++ b/src/expand.c +@@ -2646,17 +2646,25 @@ switch(cond_type = identify_operator(&s, &opname)) + } + *yield = (Ustat(sub[0], &statbuf) == 0) == testfor; + break; + + case ECOND_ISIP: + case ECOND_ISIP4: + case ECOND_ISIP6: +- rc = string_is_ip_address(sub[0], NULL); +- *yield = ((cond_type == ECOND_ISIP)? (rc != 0) : +- (cond_type == ECOND_ISIP4)? (rc == 4) : (rc == 6)) == testfor; ++ { ++ const uschar *errp; ++ const uschar **errpp; ++ DEBUG(D_expand) errpp = &errp; else errpp = 0; ++ if (0 == (rc = string_is_ip_addressX(sub[0], NULL, errpp))) ++ DEBUG(D_expand) debug_printf("failed: %s\n", errp); ++ ++ *yield = ( cond_type == ECOND_ISIP ? rc != 0 : ++ cond_type == ECOND_ISIP4 ? rc == 4 : rc == 6) == testfor; ++ } ++ + break; + + /* Various authentication tests - all optionally compiled */ + + case ECOND_PAM: + #ifdef SUPPORT_PAM + rc = auth_call_pam(sub[0], &expand_string_message); +diff --git a/src/functions.h b/src/functions.h +index 224666cb1..3c8104d25 100644 +--- a/src/functions.h ++++ b/src/functions.h +@@ -552,14 +552,15 @@ extern gstring *string_catn(gstring *, const uschar *, int) WARN_UNUSED_RESULT; + extern int string_compare_by_pointer(const void *, const void *); + extern uschar *string_copy_dnsdomain(uschar *); + extern uschar *string_copy_malloc(const uschar *); + extern uschar *string_dequote(const uschar **); + extern uschar *string_format_size(int, uschar *); + extern int string_interpret_escape(const uschar **); + extern int string_is_ip_address(const uschar *, int *); ++extern int string_is_ip_addressX(const uschar *, int *, const uschar **); + #ifdef SUPPORT_I18N + extern BOOL string_is_utf8(const uschar *); + #endif + extern const uschar *string_printing2(const uschar *, int); + extern uschar *string_split_message(uschar *); + extern uschar *string_unprinting(uschar *); + #ifdef SUPPORT_I18N +diff --git a/src/string.c b/src/string.c +index a5161bb31..9aefc2b58 100644 +--- a/src/string.c ++++ b/src/string.c +@@ -25,131 +25,141 @@ address (assuming HAVE_IPV6 is set). If a mask is permitted and one is present, + and maskptr is not NULL, its offset is placed there. + + Arguments: + s a string + maskptr NULL if no mask is permitted to follow + otherwise, points to an int where the offset of '/' is placed + if there is no / followed by trailing digits, *maskptr is set 0 ++ errp NULL if no diagnostic information is required, and if the netmask ++ length should not be checked. Otherwise it is set pointing to a short ++ descriptive text. + + Returns: 0 if the string is not a textual representation of an IP address + 4 if it is an IPv4 address + 6 if it is an IPv6 address +-*/ + ++The legacy string_is_ip_address() function follows below. ++*/ + int +-string_is_ip_address(const uschar *s, int *maskptr) +-{ +-int yield = 4; ++string_is_ip_addressX(const uschar *ip_addr, int *maskptr, const uschar **errp) { ++ struct addrinfo hints; ++ struct addrinfo *res; + +-/* If an optional mask is permitted, check for it. If found, pass back the +-offset. */ ++ uschar *slash, *percent; + +-if (maskptr) ++ uschar *endp = 0; ++ long int mask = 0; ++ const uschar *addr = 0; ++ ++ /* If there is a slash, but we didn't request a (optional) netmask, ++ we return failure, as we do if the mask isn't a pure numerical value, ++ or if it is negative. The actual length is checked later, once we know ++ the address family. */ ++ if (slash = Ustrchr(ip_addr, '/')) + { +- const uschar *ss = s + Ustrlen(s); +- *maskptr = 0; +- if (s != ss && isdigit(*(--ss))) ++ if (!maskptr) + { +- while (ss > s && isdigit(ss[-1])) ss--; +- if (ss > s && *(--ss) == '/') *maskptr = ss - s; ++ if (errp) *errp = "netmask found, but not requested"; ++ return 0; + } +- } +- +-/* A colon anywhere in the string => IPv6 address */ +- +-if (Ustrchr(s, ':') != NULL) +- { +- BOOL had_double_colon = FALSE; +- BOOL v4end = FALSE; +- +- yield = 6; +- +- /* An IPv6 address must start with hex digit or double colon. A single +- colon is invalid. */ +- +- if (*s == ':' && *(++s) != ':') return 0; +- +- /* Now read up to 8 components consisting of up to 4 hex digits each. There +- may be one and only one appearance of double colon, which implies any number +- of binary zero bits. The number of preceding components is held in count. */ + +- for (int count = 0; count < 8; count++) ++ uschar *rest; ++ mask = Ustrtol(slash+1, &rest, 10); ++ if (*rest || mask < 0) + { +- /* If the end of the string is reached before reading 8 components, the +- address is valid provided a double colon has been read. This also applies +- if we hit the / that introduces a mask or the % that introduces the +- interface specifier (scope id) of a link-local address. */ +- +- if (*s == 0 || *s == '%' || *s == '/') return had_double_colon ? yield : 0; +- +- /* If a component starts with an additional colon, we have hit a double +- colon. This is permitted to appear once only, and counts as at least +- one component. The final component may be of this form. */ +- +- if (*s == ':') +- { +- if (had_double_colon) return 0; +- had_double_colon = TRUE; +- s++; +- continue; +- } +- +- /* If the remainder of the string contains a dot but no colons, we +- can expect a trailing IPv4 address. This is valid if either there has +- been no double-colon and this is the 7th component (with the IPv4 address +- being the 7th & 8th components), OR if there has been a double-colon +- and fewer than 6 components. */ +- +- if (Ustrchr(s, ':') == NULL && Ustrchr(s, '.') != NULL) +- { +- if ((!had_double_colon && count != 6) || +- (had_double_colon && count > 6)) return 0; +- v4end = TRUE; +- yield = 6; +- break; +- } +- +- /* Check for at least one and not more than 4 hex digits for this +- component. */ +- +- if (!isxdigit(*s++)) return 0; +- if (isxdigit(*s) && isxdigit(*(++s)) && isxdigit(*(++s))) s++; +- +- /* If the component is terminated by colon and there is more to +- follow, skip over the colon. If there is no more to follow the address is +- invalid. */ +- +- if (*s == ':' && *(++s) == 0) return 0; ++ if (errp) *errp = "netmask not numeric or <0"; ++ return 0; + } + +- /* If about to handle a trailing IPv4 address, drop through. Otherwise +- all is well if we are at the end of the string or at the mask or at a percent +- sign, which introduces the interface specifier (scope id) of a link local +- address. */ ++ *maskptr = slash - ip_addr; /* offset of the slash */ ++ endp = slash; ++ } else if (maskptr) *maskptr = 0; /* no slash found */ + +- if (!v4end) +- return (*s == 0 || *s == '%' || +- (*s == '/' && maskptr != NULL && *maskptr != 0))? yield : 0; ++ /* The interface-ID suffix (%<id>) is optional (for IPv6). If it ++ exists, we check it syntactically. Later, if we know the address ++ family is IPv4, we might reject it. ++ The interface-ID is mutually exclusive with the netmask, to the ++ best of my knowledge. */ ++ if (percent = Ustrchr(ip_addr, '%')) ++ { ++ if (slash) ++ { ++ if (errp) *errp = "interface-ID and netmask are mutually exclusive"; ++ return 0; ++ } ++ for (uschar *p = percent+1; *p; p++) ++ if (!isalnum(*p) && !ispunct(*p)) ++ { ++ if (errp) *errp = "interface-ID must match [[:alnum:][:punct:]]"; ++ return 0; ++ } ++ endp = percent; + } + +-/* Test for IPv4 address, which may be the tail-end of an IPv6 address. */ +- +-for (int i = 0; i < 4; i++) ++ /* inet_pton() can't parse netmasks and interface IDs, so work on a shortened copy ++ allocated on the current stack */ ++ if (endp) { ++ ptrdiff_t l = endp - ip_addr; ++ if (l > 255) ++ { ++ if (errp) *errp = "rudiculous long ip address string"; ++ return 0; ++ } ++ addr = alloca(l+1); /* *BSD does not have strndupa() */ ++ Ustrncpy((uschar *)addr, ip_addr, l); ++ ((uschar*)addr)[l] = '\0'; ++ } else addr = ip_addr; ++ ++ int af; ++ union { /* we do not need this, but inet_pton() needs a place for storage */ ++ struct in_addr sa4; ++ struct in6_addr sa6; ++ } sa; ++ ++ af = Ustrchr(addr, ':') ? AF_INET6 : AF_INET; ++ if (!inet_pton(af, addr, &sa)) + { +- long n; +- uschar * end; +- +- if (i != 0 && *s++ != '.') return 0; +- n = strtol(CCS s, CSS &end, 10); +- if (n > 255 || n < 0 || end <= s || end > s+3) return 0; +- s = end; ++ if (errp) *errp = af == AF_INET6 ? "IP address string not parsable as IPv6" ++ : "IP address string not parsable IPv4"; ++ return 0; + } ++ /* we do not check the values of the mask here, as ++ this is done on the callers side (but I don't understand why), so ++ actually I'd like to do it here, but it breaks at least 0002 */ ++ switch (af) ++ { ++ case AF_INET6: ++ if (errp && mask > 128) ++ { ++ *errp = "IPv6 netmask value must not be >128"; ++ return 0; ++ } ++ return 6; ++ case AF_INET: ++ if (percent) ++ { ++ if (errp) *errp = "IPv4 address string must not have an interface-ID"; ++ return 0; ++ } ++ if (errp && mask > 32) { ++ *errp = "IPv4 netmask value must not be >32"; ++ return 0; ++ } ++ return 4; ++ default: ++ if (errp) *errp = "unknown address family (should not happen)"; ++ return 0; ++ } ++} + +-return !*s || (*s == '/' && maskptr && *maskptr != 0) ? yield : 0; ++int ++string_is_ip_address(const uschar *ip_addr, int *maskptr) { ++ return string_is_ip_addressX(ip_addr, maskptr, 0); + } ++ + #endif /* COMPILE_UTILITY */ + + + /************************************************* + * Format message size * + *************************************************/ + +-- +2.42.0 + diff --git a/debian/patches/76-02-SPF-harden-against-crafted-DNS-responses.patch b/debian/patches/76-02-SPF-harden-against-crafted-DNS-responses.patch new file mode 100644 index 0000000..b11ef14 --- /dev/null +++ b/debian/patches/76-02-SPF-harden-against-crafted-DNS-responses.patch @@ -0,0 +1,64 @@ +From 654056e44fc93a0ee7c09d1228933e8af6862206 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Tue, 10 Oct 2023 12:45:27 +0100 +Subject: [PATCH 2/3] SPF: harden against crafted DNS responses + +(cherry picked from commit 4f07f38374f8662c318699fb30432273ffcfe0d3) +--- + src/spf.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/spf.c b/src/spf.c +index db6eea3a8..1981d81b6 100644 +--- a/src/spf.c ++++ b/src/spf.c +@@ -116,14 +116,15 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; + { + const uschar * s = rr->data; + + srr.ttl = rr->ttl; + switch(rr_type) + { + case T_MX: ++ if (rr->size < 2) continue; + s += 2; /* skip the MX precedence field */ + case T_PTR: + { + uschar * buf = store_malloc(256); + (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, s, + (DN_EXPAND_ARG4_TYPE)buf, 256); + s = buf; +@@ -131,24 +132,28 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; + } + + case T_TXT: + { + gstring * g = NULL; + uschar chunk_len; + ++ if (rr->size < 1+6) continue; /* min for version str */ + if (strncmpic(rr->data+1, US SPF_VER_STR, 6) != 0) + { + HDEBUG(D_host_lookup) debug_printf("not an spf record: %.*s\n", + (int) s[0], s+1); + continue; + } + +- for (int off = 0; off < rr->size; off += chunk_len) ++ /* require 1 byte for the chunk_len */ ++ for (int off = 0; off < rr->size - 1; off += chunk_len) + { +- if (!(chunk_len = s[off++])) break; ++ if ( !(chunk_len = s[off++]) ++ || rr->size < off + chunk_len /* ignore bogus size chunks */ ++ ) break; + g = string_catn(g, s+off, chunk_len); + } + if (!g) + continue; + gstring_release_unused(g); + s = string_copy_malloc(string_from_gstring(g)); + DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s); +-- +2.42.0 + diff --git a/debian/patches/76-03-Harden-dnsdb-against-crafted-DNS-responses.-Bug-3033.patch b/debian/patches/76-03-Harden-dnsdb-against-crafted-DNS-responses.-Bug-3033.patch new file mode 100644 index 0000000..b748661 --- /dev/null +++ b/debian/patches/76-03-Harden-dnsdb-against-crafted-DNS-responses.-Bug-3033.patch @@ -0,0 +1,244 @@ +From f6b1f8e7d642f82d830a71b78699a4349e0158e1 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Tue, 10 Oct 2023 23:03:28 +0100 +Subject: [PATCH 3/3] Harden dnsdb against crafted DNS responses. Bug 3033 + +(cherry picked from commit 8787c8994f07c23c3664d76926e02f07314d699d) +--- + doc/ChangeLog | 3 ++ + src/dns.c | 11 +++--- + src/lookups/dnsdb.c | 78 +++++++++++++++++++++++++++-------------- + 3 files changed, 59 insertions(+), 33 deletions(-) + +diff --git a/src/dns.c b/src/dns.c +index 7d7ee0c04..8dc3695a1 100644 +--- a/src/dns.c ++++ b/src/dns.c +@@ -300,15 +300,15 @@ return string_from_gstring(g); + + /* Increment the aptr in dnss, checking against dnsa length. + Return: TRUE for a bad result + */ + static BOOL + dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta) + { +-return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen; ++return (dnss->aptr += delta) > dnsa->answer + dnsa->answerlen; + } + + /************************************************* + * Get next DNS record from answer block * + *************************************************/ + + /* Call this with reset == RESET_ANSWERS to scan the answer block, reset == +@@ -384,15 +384,15 @@ if (reset != RESET_NEXT) + namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, + dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME); + if (namelen < 0) goto null_return; + /* skip name, type, class & TTL */ + TRACE trace = "A-hdr"; + if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return; + GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */ +- /* skip over it */ ++ /* skip over it, checking for a bogus size */ + TRACE trace = "A-skip"; + if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return; + } + dnss->rrcount = reset == RESET_AUTHORITY + ? ntohs(h->nscount) : ntohs(h->arcount); + TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__, + reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount); +@@ -424,18 +424,17 @@ if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return; + GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */ + TRACE trace = "R-class"; + if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */ + GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */ + GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */ + dnss->srr.data = dnss->aptr; /* The record's data follows */ + +-/* Unchecked increment ok here since no further access on this iteration; +-will be checked on next at "R-name". */ +- +-dnss->aptr += dnss->srr.size; /* Advance to next RR */ ++/* skip over it, checking for a bogus size */ ++if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) ++ goto null_return; + + /* Return a pointer to the dns_record structure within the dns_answer. This is + for convenience so that the scans can use nice-looking for loops. */ + + TRACE debug_printf("%s: return %s\n", __FUNCTION__, dns_text_type(dnss->srr.type)); + return &dnss->srr; + +diff --git a/src/lookups/dnsdb.c b/src/lookups/dnsdb.c +index 355be1b5d..020dc9a52 100644 +--- a/src/lookups/dnsdb.c ++++ b/src/lookups/dnsdb.c +@@ -394,80 +394,101 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + /* Other kinds of record just have one piece of data each, but there may be + several of them, of course. */ + + if (yield->ptr) yield = string_catn(yield, outsep, 1); + + if (type == T_TXT || type == T_SPF) + { +- if (outsep2 == NULL) /* output only the first item of data */ +- yield = string_catn(yield, US (rr->data+1), (rr->data)[0]); ++ if (!outsep2) /* output only the first item of data */ ++ { ++ uschar n = (rr->data)[0]; ++ /* size byte + data bytes must not excced the RRs length */ ++ if (n + 1 <= rr->size) ++ yield = string_catn(yield, US (rr->data+1), n); ++ } + else + { + /* output all items */ + int data_offset = 0; + while (data_offset < rr->size) + { +- uschar chunk_len = (rr->data)[data_offset++]; +- if (outsep2[0] != '\0' && data_offset != 1) ++ uschar chunk_len = (rr->data)[data_offset]; ++ int remain = rr->size - data_offset; ++ ++ /* Apparently there are resolvers that do not check RRs before passing ++ them on, and glibc fails to do so. So every application must... ++ Check for chunk len exceeding RR */ ++ ++ if (chunk_len > remain) ++ chunk_len = remain; ++ ++ if (*outsep2 && data_offset != 0) + yield = string_catn(yield, outsep2, 1); +- yield = string_catn(yield, US ((rr->data)+data_offset), chunk_len); ++ yield = string_catn(yield, US ((rr->data) + ++data_offset), --chunk_len); + data_offset += chunk_len; + } + } + } + else if (type == T_TLSA) +- { +- uint8_t usage, selector, matching_type; +- uint16_t payload_length; +- uschar s[MAX_TLSA_EXPANDED_SIZE]; +- uschar * sp = s; +- uschar * p = US rr->data; ++ if (rr->size < 3) ++ continue; ++ else ++ { ++ uint8_t usage, selector, matching_type; ++ uint16_t payload_length; ++ uschar s[MAX_TLSA_EXPANDED_SIZE]; ++ uschar * sp = s; ++ uschar * p = US rr->data; ++ ++ usage = *p++; ++ selector = *p++; ++ matching_type = *p++; ++ /* What's left after removing the first 3 bytes above */ ++ payload_length = rr->size - 3; ++ sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2, ++ selector, *outsep2, matching_type, *outsep2); ++ /* Now append the cert/identifier, one hex char at a time */ ++ while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4)) ++ sp += sprintf(CS sp, "%02x", *p++); + +- usage = *p++; +- selector = *p++; +- matching_type = *p++; +- /* What's left after removing the first 3 bytes above */ +- payload_length = rr->size - 3; +- sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2, +- selector, *outsep2, matching_type, *outsep2); +- /* Now append the cert/identifier, one hex char at a time */ +- while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4)) +- sp += sprintf(CS sp, "%02x", *p++); +- +- yield = string_cat(yield, s); +- } ++ yield = string_cat(yield, s); ++ } + else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SOA, T_SRV */ + { + int priority, weight, port; + uschar s[264]; + uschar * p = US rr->data; + + switch (type) + { + case T_MXH: ++ if (rr->size < sizeof(u_int16_t)) continue; + /* mxh ignores the priority number and includes only the hostnames */ + GETSHORT(priority, p); + break; + + case T_MX: ++ if (rr->size < sizeof(u_int16_t)) continue; + GETSHORT(priority, p); + sprintf(CS s, "%d%c", priority, *outsep2); + yield = string_cat(yield, s); + break; + + case T_SRV: ++ if (rr->size < 3*sizeof(u_int16_t)) continue; + GETSHORT(priority, p); + GETSHORT(weight, p); + GETSHORT(port, p); + sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2, + weight, *outsep2, port, *outsep2); + yield = string_cat(yield, s); + break; + + case T_CSA: ++ if (rr->size < 3*sizeof(u_int16_t)) continue; + /* See acl_verify_csa() for more comments about CSA. */ + GETSHORT(priority, p); + GETSHORT(weight, p); + GETSHORT(port, p); + + if (priority != 1) continue; /* CSA version must be 1 */ + +@@ -510,15 +531,15 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + "domain=%s", dns_text_type(type), domain); + break; + } + else yield = string_cat(yield, s); + + if (type == T_SOA && outsep2 != NULL) + { +- unsigned long serial, refresh, retry, expire, minimum; ++ unsigned long serial = 0, refresh = 0, retry = 0, expire = 0, minimum = 0; + + p += rc; + yield = string_catn(yield, outsep2, 1); + + rc = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p, + (DN_EXPAND_ARG4_TYPE)s, sizeof(s)); + if (rc < 0) +@@ -526,16 +547,19 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + log_write(0, LOG_MAIN, "responsible-mailbox truncated: type=%s " + "domain=%s", dns_text_type(type), domain); + break; + } + else yield = string_cat(yield, s); + + p += rc; +- GETLONG(serial, p); GETLONG(refresh, p); +- GETLONG(retry, p); GETLONG(expire, p); GETLONG(minimum, p); ++ if (rr->size >= p - rr->data - 5*sizeof(u_int32_t)) ++ { ++ GETLONG(serial, p); GETLONG(refresh, p); ++ GETLONG(retry, p); GETLONG(expire, p); GETLONG(minimum, p); ++ } + sprintf(CS s, "%c%lu%c%lu%c%lu%c%lu%c%lu", + *outsep2, serial, *outsep2, refresh, + *outsep2, retry, *outsep2, expire, *outsep2, minimum); + yield = string_cat(yield, s); + } + } + } /* Loop for list of returned records */ +-- +2.42.0 + diff --git a/debian/patches/76-10-Fix-tr.-and-empty-strings.-Bug-3023.patch b/debian/patches/76-10-Fix-tr.-and-empty-strings.-Bug-3023.patch new file mode 100644 index 0000000..f297336 --- /dev/null +++ b/debian/patches/76-10-Fix-tr.-and-empty-strings.-Bug-3023.patch @@ -0,0 +1,56 @@ +From 0f8814a1d8db65d1815a6a544a08fb2b6b9207ed Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Mon, 11 Sep 2023 15:50:35 +0100 +Subject: [PATCH] Fix ${tr...} and empty-strings. Bug 3023 + +(cherry picked from commit b015574531cf18b2126edb9da5a99dad659207dd) +--- + doc/ChangeLog | 3 +++ + src/expand.c | 9 ++++----- + test/scripts/0000-Basic/0002 | 1 + + test/stdout/0002 | 1 + + 4 files changed, 9 insertions(+), 5 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -85,10 +85,13 @@ JH/34 Bug 3013: Fix use of $recipients w + In 4.96 this would expand to empty. + + JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server + certificate. Find and fix by Andreas Metzler. + ++JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings ++ and ${tr...}. Found and diagnosed by Heiko Schlichting. ++ + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from + after reception to before a subsequent reception. This should +--- a/src/expand.c ++++ b/src/expand.c +@@ -5696,20 +5696,19 @@ while (*s) + case 1: goto EXPAND_FAILED_CURLY; + case 2: + case 3: goto EXPAND_FAILED; + } + +- yield = string_cat(yield, sub[0]); +- o2m = Ustrlen(sub[2]) - 1; +- +- if (o2m >= 0) for (; oldptr < yield->ptr; oldptr++) ++ if ( (yield = string_cat(yield, sub[0])) ++ && (o2m = Ustrlen(sub[2]) - 1) >= 0) ++ for (; oldptr < yield->ptr; oldptr++) + { + uschar *m = Ustrrchr(sub[1], yield->s[oldptr]); + if (m) + { + int o = m - sub[1]; +- yield->s[oldptr] = sub[2][(o < o2m)? o : o2m]; ++ yield->s[oldptr] = sub[2][o < o2m ? o : o2m]; + } + } + + if (skipping) continue; + break; diff --git a/debian/patches/76-12-DNS-more-hardening-against-crafted-responses.patch b/debian/patches/76-12-DNS-more-hardening-against-crafted-responses.patch new file mode 100644 index 0000000..150c92c --- /dev/null +++ b/debian/patches/76-12-DNS-more-hardening-against-crafted-responses.patch @@ -0,0 +1,219 @@ +From b94ea1bd61485a97c2d0dc2cab4c4d86ffe82e89 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Sun, 15 Oct 2023 12:15:06 +0100 +Subject: [PATCH] DNS: more hardening against crafted responses + +--- + src/acl.c | 1 + + src/dns.c | 39 ++++++++++++++++++++++++++++++--------- + src/functions.h | 16 ++++++++++++++++ + src/host.c | 3 +++ + src/lookups/dnsdb.c | 10 +++++----- + 5 files changed, 55 insertions(+), 14 deletions(-) + +diff --git a/src/acl.c b/src/acl.c +index 118e4b35d..302dedaeb 100644 +--- a/src/acl.c ++++ b/src/acl.c +@@ -1434,6 +1434,7 @@ for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); + + /* Extract the numerical SRV fields (p is incremented) */ + ++ if (rr_bad_size(rr, 3 * sizeof(uint16_t))) continue; + GETSHORT(priority, p); + GETSHORT(weight, p); + GETSHORT(port, p); +diff --git a/src/dns.c b/src/dns.c +index db566f2e8..1347deec8 100644 +--- a/src/dns.c ++++ b/src/dns.c +@@ -299,13 +299,23 @@ return string_from_gstring(g); + + + ++/* Check a pointer for being past the end of a dns answer. ++Exactly one past the end is defined as ok. ++Return TRUE iff bad. ++*/ ++static BOOL ++dnsa_bad_ptr(const dns_answer * dnsa, const uschar * ptr) ++{ ++return ptr > dnsa->answer + dnsa->answerlen; ++} ++ + /* Increment the aptr in dnss, checking against dnsa length. + Return: TRUE for a bad result + */ + static BOOL + dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta) + { +-return (dnss->aptr += delta) > dnsa->answer + dnsa->answerlen; ++return dnsa_bad_ptr(dnsa, dnss->aptr += delta); + } + + /************************************************* +@@ -385,10 +395,14 @@ if (reset != RESET_NEXT) + namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, + dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME); + if (namelen < 0) goto null_return; ++ + /* skip name, type, class & TTL */ + TRACE trace = "A-hdr"; + if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return; ++ ++ if (dnsa_bad_ptr(dnsa, dnss->aptr + sizeof(uint16_t))) goto null_return; + GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */ ++ + /* skip over it, checking for a bogus size */ + TRACE trace = "A-skip"; + if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return; +@@ -422,12 +436,18 @@ from the following bytes. */ + TRACE trace = "R-name"; + if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return; + +-GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */ ++/* Check space for type, class, TTL & data-size-word */ ++if (dnsa_bad_ptr(dnsa, dnss->aptr + 3 * sizeof(uint16_t) + sizeof(uint32_t))) ++ goto null_return; ++ ++GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */ ++ + TRACE trace = "R-class"; +-if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */ +-GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */ +-GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */ +-dnss->srr.data = dnss->aptr; /* The record's data follows */ ++(void) dnss_inc_aptr(dnsa, dnss, sizeof(uint16_t)); /* skip class */ ++ ++GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */ ++GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */ ++dnss->srr.data = dnss->aptr; /* The record's data follows */ + + /* skip over it, checking for a bogus size */ + if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) +@@ -743,17 +763,17 @@ if (fake_dnsa_len_for_fail(dnsa, type)) + /* Skip the mname & rname strings */ + + if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, +- p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0) ++ p, (DN_EXPAND_ARG4_TYPE)discard_buf, sizeof(discard_buf))) < 0) + break; + p += len; + if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, +- p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0) ++ p, (DN_EXPAND_ARG4_TYPE)discard_buf, sizeof(discard_buf))) < 0) + break; + p += len; + + /* Skip the SOA serial, refresh, retry & expire. Grab the TTL */ + +- if (p > dnsa->answer + dnsa->answerlen - 5 * INT32SZ) ++ if (dnsa_bad_ptr(dnsa, p + 5 * INT32SZ)) + break; + p += 4 * INT32SZ; + GETLONG(ttl, p); +@@ -1257,6 +1277,7 @@ switch (type) + const uschar * p = rr->data; + + /* Extract the numerical SRV fields (p is incremented) */ ++ if (rr_bad_size(rr, 3 * sizeof(uint16_t))) continue; + GETSHORT(priority, p); + GETSHORT(dummy_weight, p); + GETSHORT(port, p); +diff --git a/src/functions.h b/src/functions.h +index 8f85165e7..39119ca09 100644 +--- a/src/functions.h ++++ b/src/functions.h +@@ -1110,6 +1110,22 @@ store_free_dns_answer_trc(dns_answer * dnsa, const uschar * func, unsigned line) + store_free_3(dnsa, CCS func, line); + } + ++ ++/* Check for an RR being large enough. Return TRUE iff bad. */ ++static inline BOOL ++rr_bad_size(const dns_record * rr, size_t minbytes) ++{ ++return rr->size < minbytes; ++} ++ ++/* Check for an RR having further data beyond a given pointer. ++Return TRUE iff bad. */ ++static inline BOOL ++rr_bad_increment(const dns_record * rr, const uschar * ptr, size_t minbytes) ++{ ++return rr_bad_size(rr, ptr - rr->data + minbytes); ++} ++ + /******************************************************************************/ + /* Routines with knowledge of spool layout */ + +diff --git a/src/host.c b/src/host.c +index 3e5a88660..ce7ca2bab 100644 +--- a/src/host.c ++++ b/src/host.c +@@ -2725,6 +2725,7 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); + const uschar * s = rr->data; /* MUST be unsigned for GETSHORT */ + uschar data[256]; + ++ if (rr_bad_size(rr, sizeof(uint16_t))) continue; + GETSHORT(precedence, s); /* Pointer s is advanced */ + + /* For MX records, we use a random "weight" which causes multiple records of +@@ -2737,6 +2738,8 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); + /* SRV records are specified with a port and a weight. The weight is used + in a special algorithm. However, to start with, we just use it to order the + records of equal priority (precedence). */ ++ ++ if (rr_bad_increment(rr, s, 2 * sizeof(uint16_t))) continue; + GETSHORT(weight, s); + GETSHORT(port, s); + } +diff --git a/src/lookups/dnsdb.c b/src/lookups/dnsdb.c +index 35a946447..fcf80e3dd 100644 +--- a/src/lookups/dnsdb.c ++++ b/src/lookups/dnsdb.c +@@ -452,20 +452,20 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + switch (type) + { + case T_MXH: +- if (rr->size < sizeof(u_int16_t)) continue; ++ if (rr_bad_size(rr, sizeof(u_int16_t))) continue; + /* mxh ignores the priority number and includes only the hostnames */ + GETSHORT(priority, p); + break; + + case T_MX: +- if (rr->size < sizeof(u_int16_t)) continue; ++ if (rr_bad_size(rr, sizeof(u_int16_t))) continue; + GETSHORT(priority, p); + sprintf(CS s, "%d%c", priority, *outsep2); + yield = string_cat(yield, s); + break; + + case T_SRV: +- if (rr->size < 3*sizeof(u_int16_t)) continue; ++ if (rr_bad_size(rr, 3*sizeof(u_int16_t))) continue; + GETSHORT(priority, p); + GETSHORT(weight, p); + GETSHORT(port, p); +@@ -475,7 +475,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + break; + + case T_CSA: +- if (rr->size < 3*sizeof(u_int16_t)) continue; ++ if (rr_bad_size(rr, 3*sizeof(u_int16_t))) continue; + /* See acl_verify_csa() for more comments about CSA. */ + GETSHORT(priority, p); + GETSHORT(weight, p); +@@ -542,7 +542,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0))) + else yield = string_cat(yield, s); + + p += rc; +- if (rr->size >= p - rr->data - 5*sizeof(u_int32_t)) ++ if (!rr_bad_increment(rr, p, 5 * sizeof(u_int32_t))) + { + GETLONG(serial, p); GETLONG(refresh, p); + GETLONG(retry, p); GETLONG(expire, p); GETLONG(minimum, p); +-- +2.42.0 + diff --git a/debian/patches/76-14-Lookups-Fix-dnsdb-lookup-of-multi-chunk-TXT.-Bug-305.patch b/debian/patches/76-14-Lookups-Fix-dnsdb-lookup-of-multi-chunk-TXT.-Bug-305.patch new file mode 100644 index 0000000..7b9eb6e --- /dev/null +++ b/debian/patches/76-14-Lookups-Fix-dnsdb-lookup-of-multi-chunk-TXT.-Bug-305.patch @@ -0,0 +1,118 @@ +From 79670d3c32ccb37fe06f25d8192943b58606a32a Mon Sep 17 00:00:00 2001 +From: Jeremy Harris <jgh146exb@wizmail.org> +Date: Fri, 17 Nov 2023 16:55:17 +0000 +Subject: [PATCH] Lookups: Fix dnsdb lookup of multi-chunk TXT. Bug 3054 + +Broken=by: f6b1f8e7d642 +--- + doc/ChangeLog | 6 ++++- + src/dns.c | 4 +++- + src/lookups/dnsdb.c | 45 +++++++++++++++--------------------- + test/dnszones-src/db.test.ex | 1 + + test/scripts/2200-dnsdb/2200 | 1 + + test/src/fakens.c | 1 + + test/stdout/2200 | 1 + + 7 files changed, 31 insertions(+), 28 deletions(-) + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -87,10 +87,13 @@ JH/34 Bug 3013: Fix use of $recipients w + JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server + certificate. Find and fix by Andreas Metzler. + + JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings + and ${tr...}. Found and diagnosed by Heiko Schlichting. ++ ++JH/06 Bug 3054: Fix dnsdb lookup for a TXT record with multiple chunks. This ++ was broken by hardening introduced for Bug 3033. + + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from +--- a/src/dns.c ++++ b/src/dns.c +@@ -428,11 +428,13 @@ TRACE trace = "R-namelen"; + namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr, + (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME); + if (namelen < 0) goto null_return; + + /* Move the pointer past the name and fill in the rest of the data structure +-from the following bytes. */ ++from the following bytes. We seem to be assuming here that the RR blob passed ++to us by the resolver library is the same as that defined for an RR by RFC 1035 ++section 3.2.1 */ + + TRACE trace = "R-name"; + if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return; + + /* Check space for type, class, TTL & data-size-word */ +--- a/src/lookups/dnsdb.c ++++ b/src/lookups/dnsdb.c +@@ -390,46 +390,36 @@ while ((domain = string_nextinlist(&keys + } + continue; + } + + /* Other kinds of record just have one piece of data each, but there may be +- several of them, of course. */ ++ several of them, of course. TXT & SPF can have data in multiple chunks. */ + + if (yield->ptr) yield = string_catn(yield, outsep, 1); + + if (type == T_TXT || type == T_SPF) +- { +- if (!outsep2) /* output only the first item of data */ ++ for (unsigned data_offset = 0; data_offset + 1 < rr->size; ) + { +- uschar n = (rr->data)[0]; +- /* size byte + data bytes must not excced the RRs length */ +- if (n + 1 <= rr->size) +- yield = string_catn(yield, US (rr->data+1), n); ++ uschar chunk_len = (rr->data)[data_offset]; ++ int remain; ++ ++ if (outsep2 && *outsep2 && data_offset != 0) ++ yield = string_catn(yield, outsep2, 1); ++ ++ /* Apparently there are resolvers that do not check RRs before passing ++ them on, and glibc fails to do so. So every application must... ++ Check for chunk len exceeding RR */ ++ ++ remain = rr->size - ++data_offset; ++ if (chunk_len > remain) ++ chunk_len = remain; ++ yield = string_catn(yield, US ((rr->data) + data_offset), chunk_len); ++ data_offset += chunk_len; ++ ++ if (!outsep2) break; /* output only the first chunk of the RR */ ++ + } +- else +- { +- /* output all items */ +- int data_offset = 0; +- while (data_offset < rr->size) +- { +- uschar chunk_len = (rr->data)[data_offset]; +- int remain = rr->size - data_offset; +- +- /* Apparently there are resolvers that do not check RRs before passing +- them on, and glibc fails to do so. So every application must... +- Check for chunk len exceeding RR */ +- +- if (chunk_len > remain) +- chunk_len = remain; +- +- if (*outsep2 && data_offset != 0) +- yield = string_catn(yield, outsep2, 1); +- yield = string_catn(yield, US ((rr->data) + ++data_offset), --chunk_len); +- data_offset += chunk_len; +- } +- } +- } + else if (type == T_TLSA) + if (rr->size < 3) + continue; + else + { diff --git a/debian/patches/77_CVE-2023-51766_4.97.1-release.diff b/debian/patches/77_CVE-2023-51766_4.97.1-release.diff new file mode 100644 index 0000000..77d52ce --- /dev/null +++ b/debian/patches/77_CVE-2023-51766_4.97.1-release.diff @@ -0,0 +1,440 @@ +Description: Fix smtp-smuggling (CVE-2023-51766) + Pull upstream changes from 4.97.1 security release. +Author: Jeremy Harris <jgh146exb@wizmail.org> +Bug-Debian: https://bugs.debian.org/1059387 +Origin: upstream +Last-Update: 2023-12-31 + +--- a/doc/ChangeLog ++++ b/doc/ChangeLog +@@ -91,10 +91,16 @@ JH/39 Bug 3023: Fix crash induced by som + and ${tr...}. Found and diagnosed by Heiko Schlichting. + + JH/06 Bug 3054: Fix dnsdb lookup for a TXT record with multiple chunks. This + was broken by hardening introduced for Bug 3033. + ++JH/s1 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in ++ LF-only mode (as detected from the first header line). Previously we did ++ accept that in (normal) CRLF mode; this has been raised as a possible ++ attack scenario (under the name "smtp smuggling", CVE-2023-51766). ++ ++ + Exim version 4.96 + ----------------- + + JH/01 Move the wait-for-next-tick (needed for unique message IDs) from + after reception to before a subsequent reception. This should +--- /dev/null ++++ b/doc/doc-txt/cve-2023-51766 +@@ -0,0 +1,69 @@ ++CVE ID: CVE-2023-51766 ++Date: 2016-12-15 ++Credits: https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ ++Version(s): all up to 4.97 inclusive ++Issue: Given a buggy relay, Exim can be induced to accept a second message embedded ++ as part of the body of a first message ++ ++Conditions ++========== ++ ++If *all* the following conditions are met ++ ++ Runtime options ++ --------------- ++ ++ * Exim offers PIPELINING on incoming connections ++ ++ * Exim offers CHUNKING on incoming connections ++ ++ Operation ++ --------- ++ ++ * DATA (as opposed to BDAT) is used for a message reception ++ ++ * The relay host sends to the Exim MTA message data including ++ one of "LF . LF" or "CR LF . LF" or "LF . CR LF". ++ ++ * Exim interprets the sequence as signalling the end of data for ++ the SMTP DATA command, and hence a first message. ++ ++ * Exim interprets further input which the relay had as message body ++ data, as SMTP commands and data. This could include a MAIL, RCPT, ++ BDAT (etc) sequence, resulting in a further message acceptance. ++ ++Impact ++====== ++ ++One or more messages can be accepted by Exim that have not been ++properly validated by the buggy relay. ++ ++Fix ++=== ++ ++Install a fixed Exim version: ++ ++ 4.98 (once available) ++ 4.97.1 ++ ++If you can't install one of the above versions, ask your package ++maintainer for a version containing the backported fix. On request and ++depending on our resources we will support you in backporting the fix. ++(Please note, that Exim project officially doesn't support versions ++prior the current stable version.) ++ ++ ++Workaround ++========== ++ ++ Disable CHUNKING advertisement for incoming connections. ++ ++ An attempt to "smuggle" a DATA command will trip a syncronisation ++ check. ++ ++*or* ++ ++ Disable PIPELINING advertisement for incoming connections. ++ ++ The "smuggled" MAIL FROM command will then trip a syncronisation ++ check. +--- a/src/receive.c ++++ b/src/receive.c +@@ -826,104 +826,118 @@ we make the CRs optional in all cases. + + July 2003: Bare CRs cause trouble. We now treat them as line terminators as + well, so that there are no CRs in spooled messages. However, the message + terminating dot is not recognized between two bare CRs. + ++Dec 2023: getting a site to send a body including an "LF . LF" sequence ++followed by SMTP commands is a possible "smtp smuggling" attack. If ++the first (header) line for the message has a proper CRLF then enforce ++that for the body: convert bare LF to a space. ++ + Arguments: +- fout a FILE to which to write the message; NULL if skipping ++ fout a FILE to which to write the message; NULL if skipping ++ strict_crlf require full CRLF sequence as a line ending + + Returns: One of the END_xxx values indicating why it stopped reading + */ + + static int +-read_message_data_smtp(FILE *fout) ++read_message_data_smtp(FILE * fout, BOOL strict_crlf) + { +-int ch_state = 0; +-int ch; +-int linelength = 0; ++enum { s_linestart, s_normal, s_had_cr, s_had_nl_dot, s_had_dot_cr } ch_state = ++ s_linestart; ++int linelength = 0, ch; + + while ((ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF) + { + if (ch == 0) body_zerocount++; + switch (ch_state) + { +- case 0: /* After LF or CRLF */ +- if (ch == '.') +- { +- ch_state = 3; +- continue; /* Don't ever write . after LF */ +- } +- ch_state = 1; ++ case s_linestart: /* After LF or CRLF */ ++ if (ch == '.') ++ { ++ ch_state = s_had_nl_dot; ++ continue; /* Don't ever write . after LF */ ++ } ++ ch_state = s_normal; + +- /* Else fall through to handle as normal uschar. */ ++ /* Else fall through to handle as normal uschar. */ + +- case 1: /* Normal state */ +- if (ch == '\n') +- { +- ch_state = 0; +- body_linecount++; ++ case s_normal: /* Normal state */ ++ if (ch == '\r') ++ { ++ ch_state = s_had_cr; ++ continue; /* Don't write the CR */ ++ } ++ if (ch == '\n') /* Bare LF at end of line */ ++ if (strict_crlf) ++ ch = ' '; /* replace LF with space */ ++ else ++ { /* treat as line ending */ ++ ch_state = s_linestart; ++ body_linecount++; ++ if (linelength > max_received_linelength) ++ max_received_linelength = linelength; ++ linelength = -1; ++ } ++ break; ++ ++ case s_had_cr: /* After (unwritten) CR */ ++ body_linecount++; /* Any char ends line */ + if (linelength > max_received_linelength) +- max_received_linelength = linelength; ++ max_received_linelength = linelength; + linelength = -1; +- } +- else if (ch == '\r') +- { +- ch_state = 2; +- continue; +- } +- break; ++ if (ch == '\n') /* proper CRLF */ ++ ch_state = s_linestart; ++ else ++ { ++ message_size++; /* convert the dropped CR to a stored NL */ ++ if (fout && fputc('\n', fout) == EOF) return END_WERROR; ++ cutthrough_data_put_nl(); ++ if (ch == '\r') /* CR; do not write */ ++ continue; ++ ch_state = s_normal; /* not LF or CR; process as standard */ ++ } ++ break; + +- case 2: /* After (unwritten) CR */ +- body_linecount++; +- if (linelength > max_received_linelength) +- max_received_linelength = linelength; +- linelength = -1; +- if (ch == '\n') +- { +- ch_state = 0; +- } +- else +- { +- message_size++; +- if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR; +- cutthrough_data_put_nl(); +- if (ch != '\r') ch_state = 1; else continue; +- } +- break; ++ case s_had_nl_dot: /* After [CR] LF . */ ++ if (ch == '\n') /* [CR] LF . LF */ ++ if (strict_crlf) ++ ch = ' '; /* replace LF with space */ ++ else ++ return END_DOT; ++ else if (ch == '\r') /* [CR] LF . CR */ ++ { ++ ch_state = s_had_dot_cr; ++ continue; /* Don't write the CR */ ++ } ++ /* The dot was removed on reaching s_had_nl_dot. For a doubled dot, here, ++ reinstate it to cutthrough. The current ch, dot or not, is passed both to ++ cutthrough and to file below. */ ++ else if (ch == '.') ++ { ++ uschar c = ch; ++ cutthrough_data_puts(&c, 1); ++ } ++ ch_state = s_normal; ++ break; + +- case 3: /* After [CR] LF . */ +- if (ch == '\n') +- return END_DOT; +- if (ch == '\r') +- { +- ch_state = 4; +- continue; +- } +- /* The dot was removed at state 3. For a doubled dot, here, reinstate +- it to cutthrough. The current ch, dot or not, is passed both to cutthrough +- and to file below. */ +- if (ch == '.') +- { +- uschar c= ch; +- cutthrough_data_puts(&c, 1); +- } +- ch_state = 1; +- break; ++ case s_had_dot_cr: /* After [CR] LF . CR */ ++ if (ch == '\n') ++ return END_DOT; /* Preferred termination */ + +- case 4: /* After [CR] LF . CR */ +- if (ch == '\n') return END_DOT; +- message_size++; +- body_linecount++; +- if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR; +- cutthrough_data_put_nl(); +- if (ch == '\r') +- { +- ch_state = 2; +- continue; +- } +- ch_state = 1; +- break; ++ message_size++; /* convert the dropped CR to a stored NL */ ++ body_linecount++; ++ if (fout && fputc('\n', fout) == EOF) return END_WERROR; ++ cutthrough_data_put_nl(); ++ if (ch == '\r') ++ { ++ ch_state = s_had_cr; ++ continue; /* CR; do not write */ ++ } ++ ch_state = s_normal; ++ break; + } + + /* Add the character to the spool file, unless skipping; then loop for the + next. */ + +@@ -1135,11 +1149,11 @@ Returns: nothing + void + receive_swallow_smtp(void) + { + if (message_ended >= END_NOTENDED) + message_ended = chunking_state <= CHUNKING_OFFERED +- ? read_message_data_smtp(NULL) ++ ? read_message_data_smtp(NULL, FALSE) + : read_message_bdat_smtp_wire(NULL); + } + + + +@@ -1946,28 +1960,36 @@ for (;;) + LF specially by inserting a white space after it to ensure that the header + line is not terminated. */ + + if (ch == '\n') + { +- if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = FALSE; +- else if (first_line_ended_crlf) receive_ungetc(' '); ++ if (first_line_ended_crlf == TRUE_UNSET) ++ first_line_ended_crlf = FALSE; ++ else if (first_line_ended_crlf) ++ receive_ungetc(' '); + goto EOL; + } + + /* This is not the end of the line. If this is SMTP input and this is + the first character in the line and it is a "." character, ignore it. + This implements the dot-doubling rule, though header lines starting with + dots aren't exactly common. They are legal in RFC 822, though. If the + following is CRLF or LF, this is the line that that terminates the ++ + entire message. We set message_ended to indicate this has happened (to + prevent further reading), and break out of the loop, having freed the + empty header, and set next = NULL to indicate no data line. */ + + if (f.dot_ends && ptr == 0 && ch == '.') + { ++ /* leading dot while in headers-read mode */ + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); +- if (ch == '\r') ++ if (ch == '\n' && first_line_ended_crlf == TRUE /* and not TRUE_UNSET */ ) ++ /* dot, LF but we are in CRLF mode. Attack? */ ++ ch = ' '; /* replace the LF with a space */ ++ ++ else if (ch == '\r') + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch != '\n') + { + if (ch >= 0) receive_ungetc(ch); +@@ -1999,11 +2021,12 @@ for (;;) + if (ch == '\r') + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch == '\n') + { +- if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = TRUE; ++ if (first_line_ended_crlf == TRUE_UNSET) ++ first_line_ended_crlf = TRUE; + goto EOL; + } + + /* Otherwise, put back the character after CR, and turn the bare CR + into LF SP. */ +@@ -3144,11 +3167,11 @@ if (cutthrough.cctx.sock >= 0 && cutthro + (void) cutthrough_headers_send(); + } + + + /* Open a new spool file for the data portion of the message. We need +-to access it both via a file descriptor and a stream. Try to make the ++to access it both via a file descriptor and a stdio stream. Try to make the + directory if it isn't there. */ + + spool_name = spool_fname(US"input", message_subdir, message_id, US"-D"); + DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name); + +@@ -3213,11 +3236,11 @@ message id or "next" line. */ + if (!ferror(spool_data_file) && !(receive_feof)() && message_ended != END_DOT) + { + if (smtp_input) + { + message_ended = chunking_state <= CHUNKING_OFFERED +- ? read_message_data_smtp(spool_data_file) ++ ? read_message_data_smtp(spool_data_file, first_line_ended_crlf) + : spool_wireformat + ? read_message_bdat_smtp_wire(spool_data_file) + : read_message_bdat_smtp(spool_data_file); + receive_linecount++; /* The terminating "." line */ + } +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -5447,16 +5447,16 @@ while (done <= 0) + } + break; + } + + if (chunking_state > CHUNKING_OFFERED) +- rc = OK; /* No predata ACL or go-ahead output for BDAT */ ++ rc = OK; /* There is no predata ACL or go-ahead output for BDAT */ + else + { +- /* If there is an ACL, re-check the synchronization afterwards, since the +- ACL may have delayed. To handle cutthrough delivery enforce a dummy call +- to get the DATA command sent. */ ++ /* If there is a predata-ACL, re-check the synchronization afterwards, ++ since the ACL may have delayed. To handle cutthrough delivery enforce a ++ dummy call to get the DATA command sent. */ + + if (!acl_smtp_predata && cutthrough.cctx.sock < 0) + rc = OK; + else + { +--- a/doc/spec.txt ++++ b/doc/spec.txt +@@ -33555,12 +33555,10 @@ MTA within an operating system would use + has shown that this is not the case; for example, there are Unix applications + that use CRLF in this circumstance. For this reason, and for compatibility with + other MTAs, the way Exim handles line endings for all messages is now as + follows: + +- * LF not preceded by CR is treated as a line ending. +- + * CR is treated as a line ending; if it is immediately followed by LF, the LF + is ignored. + + * The sequence "CR, dot, CR" does not terminate an incoming SMTP message, nor + a local message in the state where a line containing only a dot is a +@@ -33571,11 +33569,14 @@ follows: + behind this is that bare CRs in header lines are most likely either to be + mistakes, or people trying to play silly games. + + * If the first header line received in a message ends with CRLF, a subsequent + bare LF in a header line is treated in the same way as a bare CR in a +- header line. ++ header line and a bare LF in a body line is replaced with a space. ++ ++ * If the first header line received in a message does not end with CRLF, a ++ subsequent LF not preceded by CR is treated as a line ending. + + + 48.3 Unqualified addresses + -------------------------- + diff --git a/debian/patches/90_localscan_dlopen.dpatch b/debian/patches/90_localscan_dlopen.dpatch new file mode 100644 index 0000000..21c96b1 --- /dev/null +++ b/debian/patches/90_localscan_dlopen.dpatch @@ -0,0 +1,347 @@ +Description: Allow one to use and switch between different local_scan functions + without recompiling exim. + http://marc.merlins.org/linux/exim/files/sa-exim-current/ Original patch from + David Woodhouse, modified first by Derrick 'dman' Hudson and then by Marc + MERLIN for SA-Exim and minor/major API version tracking +Author: David Woodhouse, Derrick 'dman' Hudson, Marc MERLIN +Origin: other, http://marc.merlins.org/linux/exim/files/sa-exim-current/ +Forwarded: https://bugs.exim.org/show_bug.cgi?id=2671 +Last-Update: 2022-12-19 + +--- a/src/EDITME ++++ b/src/EDITME +@@ -874,10 +874,25 @@ HEADERS_CHARSET="ISO-8859-1" + # as the traditional crypt() function. + # *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING *** + + + #------------------------------------------------------------------------------ ++# On systems which support dynamic loading of shared libraries, Exim can ++# load a local_scan function specified in its config file instead of having ++# to be recompiled with the desired local_scan function. For a full ++# description of the API to this function, see the Exim specification. ++ ++DLOPEN_LOCAL_SCAN=yes ++ ++# If you set DLOPEN_LOCAL_SCAN, then you need to include -rdynamic in the ++# linker flags. Without it, the loaded .so won't be able to access any ++# functions from exim. ++ ++LDFLAGS += -rdynamic ++CFLAGS += -fvisibility=hidden ++ ++#------------------------------------------------------------------------------ + # The default distribution of Exim contains only the plain text form of the + # documentation. Other forms are available separately. If you want to install + # the documentation in "info" format, first fetch the Texinfo documentation + # sources from the ftp directory and unpack them, which should create files + # with the extension "texinfo" in the doc directory. You may find that the +--- a/src/config.h.defaults ++++ b/src/config.h.defaults +@@ -31,10 +31,12 @@ Do not put spaces between # and the 'def + #define AUTH_SPA + #define AUTH_TLS + + #define AUTH_VARS 4 + ++#define DLOPEN_LOCAL_SCAN ++ + #define BIN_DIRECTORY + + #define CONFIGURE_FILE + #define CONFIGURE_FILE_USE_EUID + #define CONFIGURE_FILE_USE_NODE +--- a/src/globals.c ++++ b/src/globals.c +@@ -115,10 +115,14 @@ tls_support tls_out = { + uschar *dsn_envid = NULL; + int dsn_ret = 0; + const pcre2_code *regex_DSN = NULL; + uschar *dsn_advertise_hosts = NULL; + ++#ifdef DLOPEN_LOCAL_SCAN ++uschar *local_scan_path = NULL; ++#endif ++ + #ifndef DISABLE_TLS + BOOL gnutls_compat_mode = FALSE; + BOOL gnutls_allow_auto_pkcs11 = FALSE; + uschar *hosts_require_alpn = NULL; + uschar *openssl_options = NULL; +--- a/src/globals.h ++++ b/src/globals.h +@@ -153,10 +153,14 @@ extern uschar *tls_advertise_hosts; / + extern uschar *dsn_envid; /* DSN envid string */ + extern int dsn_ret; /* DSN ret type*/ + extern const pcre2_code *regex_DSN; /* For recognizing DSN settings */ + extern uschar *dsn_advertise_hosts; /* host for which TLS is advertised */ + ++#ifdef DLOPEN_LOCAL_SCAN ++extern uschar *local_scan_path; /* Path to local_scan() library */ ++#endif ++ + /* Input-reading functions for messages, so we can use special ones for + incoming TCP/IP. */ + + extern int (*lwr_receive_getc)(unsigned); + extern uschar * (*lwr_receive_getbuf)(unsigned *); +--- a/src/local_scan.c ++++ b/src/local_scan.c +@@ -5,60 +5,136 @@ + /* Copyright (c) University of Cambridge 1995 - 2009 */ + /* Copyright (c) The Exim Maintainers 2021 */ + /* See the file NOTICE for conditions of use and distribution. */ + + +-/****************************************************************************** +-This file contains a template local_scan() function that just returns ACCEPT. +-If you want to implement your own version, you should copy this file to, say +-Local/local_scan.c, and edit the copy. To use your version instead of the +-default, you must set +- +-HAVE_LOCAL_SCAN=yes +-LOCAL_SCAN_SOURCE=Local/local_scan.c +- +-in your Local/Makefile. This makes it easy to copy your version for use with +-subsequent Exim releases. +- +-For a full description of the API to this function, see the Exim specification. +-******************************************************************************/ +- +- + /* This is the only Exim header that you should include. The effect of + including any other Exim header is not defined, and may change from release to + release. Use only the documented interface! */ + + #include "local_scan.h" + +- +-/* This is a "do-nothing" version of a local_scan() function. The arguments +-are: +- +- fd The file descriptor of the open -D file, which contains the +- body of the message. The file is open for reading and +- writing, but modifying it is dangerous and not recommended. +- +- return_text A pointer to an unsigned char* variable which you can set in +- order to return a text string. It is initialized to NULL. +- +-The return values of this function are: +- +- LOCAL_SCAN_ACCEPT +- The message is to be accepted. The return_text argument is +- saved in $local_scan_data. +- +- LOCAL_SCAN_REJECT +- The message is to be rejected. The returned text is used +- in the rejection message. +- +- LOCAL_SCAN_TEMPREJECT +- This specifies a temporary rejection. The returned text +- is used in the rejection message. +-*/ ++#ifdef DLOPEN_LOCAL_SCAN ++#include <dlfcn.h> ++#include <stdlib.h> ++static int (*local_scan_fn)(int fd, uschar **return_text) = NULL; ++static int load_local_scan_library(void); ++#endif + + int + local_scan(int fd, uschar **return_text) + { +-return LOCAL_SCAN_ACCEPT; ++ ++#ifdef DLOPEN_LOCAL_SCAN ++/* local_scan_path is defined AND not the empty string */ ++if (local_scan_path && *local_scan_path) ++ { ++ if (!local_scan_fn) ++ { ++ if (!load_local_scan_library()) ++ { ++ char *base_msg , *error_msg , *final_msg ; ++ int final_length = -1 ; ++ ++ base_msg=US"Local configuration error - local_scan() library failure\n"; ++ error_msg = dlerror() ; ++ ++ final_length = strlen(base_msg) + strlen(error_msg) + 1 ; ++ final_msg = (char*)malloc( final_length*sizeof(char) ) ; ++ *final_msg = '\0' ; ++ ++ strcat( final_msg , base_msg ) ; ++ strcat( final_msg , error_msg ) ; ++ ++ *return_text = final_msg ; ++ return LOCAL_SCAN_TEMPREJECT; ++ } ++ } ++ return local_scan_fn(fd, return_text); ++ } ++else ++#endif ++ return LOCAL_SCAN_ACCEPT; ++} ++ ++#ifdef DLOPEN_LOCAL_SCAN ++ ++static int load_local_scan_library(void) ++{ ++/* No point in keeping local_scan_lib since we'll never dlclose() anyway */ ++void *local_scan_lib = NULL; ++int (*local_scan_version_fn)(void); ++int vers_maj; ++int vers_min; ++ ++local_scan_lib = dlopen(local_scan_path, RTLD_NOW); ++if (!local_scan_lib) ++ { ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() library open failed - " ++ "message temporarily rejected"); ++ return FALSE; ++ } ++ ++local_scan_version_fn = dlsym(local_scan_lib, "local_scan_version_major"); ++if (!local_scan_version_fn) ++ { ++ dlclose(local_scan_lib); ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() library doesn't contain " ++ "local_scan_version_major() function - message temporarily rejected"); ++ return FALSE; ++ } ++ ++/* The major number is increased when the ABI is changed in a non ++ backward compatible way. */ ++vers_maj = local_scan_version_fn(); ++ ++local_scan_version_fn = dlsym(local_scan_lib, "local_scan_version_minor"); ++if (!local_scan_version_fn) ++ { ++ dlclose(local_scan_lib); ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() library doesn't contain " ++ "local_scan_version_minor() function - message temporarily rejected"); ++ return FALSE; ++ } ++ ++/* The minor number is increased each time a new feature is added (in a ++ way that doesn't break backward compatibility) -- Marc */ ++vers_min = local_scan_version_fn(); ++ ++ ++if (vers_maj != LOCAL_SCAN_ABI_VERSION_MAJOR) ++ { ++ dlclose(local_scan_lib); ++ local_scan_lib = NULL; ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() has an incompatible major" ++ "version number, you need to recompile your module for this version" ++ "of exim (The module was compiled for version %d.%d and this exim provides" ++ "ABI version %d.%d)", vers_maj, vers_min, LOCAL_SCAN_ABI_VERSION_MAJOR, ++ LOCAL_SCAN_ABI_VERSION_MINOR); ++ return FALSE; ++ } ++else if (vers_min > LOCAL_SCAN_ABI_VERSION_MINOR) ++ { ++ dlclose(local_scan_lib); ++ local_scan_lib = NULL; ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() has an incompatible minor" ++ "version number, you need to recompile your module for this version" ++ "of exim (The module was compiled for version %d.%d and this exim provides" ++ "ABI version %d.%d)", vers_maj, vers_min, LOCAL_SCAN_ABI_VERSION_MAJOR, ++ LOCAL_SCAN_ABI_VERSION_MINOR); ++ return FALSE; ++ } ++ ++local_scan_fn = dlsym(local_scan_lib, "local_scan"); ++if (!local_scan_fn) ++ { ++ dlclose(local_scan_lib); ++ log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() library doesn't contain " ++ "local_scan() function - message temporarily rejected"); ++ return FALSE; ++ } ++return TRUE; + } + ++#endif /* DLOPEN_LOCAL_SCAN */ ++ + /* End of local_scan.c */ +--- a/src/local_scan.h ++++ b/src/local_scan.h +@@ -25,10 +25,11 @@ store.c + /* Some basic types that make some things easier, the Exim configuration + settings, and the store functions. */ + + #include <stdarg.h> + #include <sys/types.h> ++#pragma GCC visibility push(default) + #include "config.h" + #include "mytypes.h" + #include "store.h" + + +@@ -164,10 +165,13 @@ extern const uschar *headers_charset; / + extern header_line *header_last; /* Final header */ + extern header_line *header_list; /* First header */ + extern BOOL host_checking; /* Set when checking a host */ + extern uschar *interface_address; /* Interface for incoming call */ + extern int interface_port; /* Port number for incoming call */ ++#ifdef DLOPEN_LOCAL_SCAN ++extern uschar *local_scan_path; ++#endif + extern uschar *message_id; /* Internal id of message being handled */ + extern uschar *received_protocol; /* Name of incoming protocol */ + extern int recipients_count; /* Number of recipients */ + extern recipient_item *recipients_list;/* List of recipient addresses */ + extern unsigned char *sender_address; /* Sender address */ +@@ -234,6 +238,8 @@ extern uschar * string_copy_taint_functi + extern pid_t child_open_exim_function(int *, const uschar *); + extern pid_t child_open_exim2_function(int *, uschar *, uschar *, const uschar *); + extern pid_t child_open_function(uschar **, uschar **, int, int *, int *, BOOL, const uschar *); + #endif + ++#pragma GCC visibility pop ++ + /* End of local_scan.h */ +--- a/src/readconf.c ++++ b/src/readconf.c +@@ -210,10 +210,13 @@ static optionlist optionlist_config[] = + #endif + { "local_from_check", opt_bool, {&local_from_check} }, + { "local_from_prefix", opt_stringptr, {&local_from_prefix} }, + { "local_from_suffix", opt_stringptr, {&local_from_suffix} }, + { "local_interfaces", opt_stringptr, {&local_interfaces} }, ++#ifdef DLOPEN_LOCAL_SCAN ++ { "local_scan_path", opt_stringptr, &local_scan_path }, ++#endif + #ifdef HAVE_LOCAL_SCAN + { "local_scan_timeout", opt_time, {&local_scan_timeout} }, + #endif + { "local_sender_retain", opt_bool, {&local_sender_retain} }, + { "localhost_number", opt_stringptr, {&host_number_string} }, +--- a/src/string.c ++++ b/src/string.c +@@ -416,10 +416,11 @@ return ss; + + + + #if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \ + && !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY) ++#pragma GCC visibility push(default) + /************************************************* + * Copy and save string * + *************************************************/ + + /* +@@ -461,10 +462,11 @@ Returns: copy of string in new store + uschar * + string_copyn_function(const uschar * s, int n) + { + return string_copyn(s, n); + } ++#pragma GCC visibility pop + #endif + + + /************************************************* + * Copy and save string in malloc'd store * diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..b57ca5e --- /dev/null +++ b/debian/patches/series @@ -0,0 +1,53 @@ +31_eximmanpage.dpatch +32_exim4.dpatch +33_eximon.binary.dpatch +34_eximstatsmanpage.dpatch +35_install.dpatch +60_convert4r4.dpatch +67_unnecessaryCopt.diff +70_remove_exim-users_references.dpatch +75_01-Fix-exit-on-attempt-to-rewrite-a-malformed-address.-.patch +75_05-SPF-fix-memory-accounting-for-error-case.patch +75_08-Fix-regex-n-use-after-free.-Bug-2915.patch +75_09-Fix-non-WITH_CONTENT_SCAN-build.patch +75_10-Fix-non-WITH_CONTENT_SCAN-build-2.patch +75_11-Fix-non-WITH_CONTENT_SCAN-build-3.patch +75_16-GnuTLS-fix-for-clients-offering-no-TLS-extensions.patch +75_18-Fix-Build-with-libopendmarc-1.4.x-fixes-2728.patch +75_19-DMARC-fix-use-after-free-in-dmarc_dns_lookup.patch +75_22-Fix-daemon-startup.-Bug-2930.patch +75_23-Fix-reccipients-after-run.-.-Bug-2929.patch +75_31-Fix-regext-substring-capture-variables-for-null-matc.patch +75_32-Fix-regex-substring-capture-variables-for-null-match.patch +75_34-Fix-regex-substring-capture-commentary.-Bug-2933.patch +75_37-OpenSSL-when-preloading-creds-do-the-server-certs-be.patch +75_38-OpenSSL-fix-double-expansion-of-tls_verify_certifica.patch +75_42-Fix-run-arg-parsing.patch +75_50-Fix-logging-of-max-size-log-line.patch +75_55-Fix-recursion-on-dns_again_means_nonexist.-Bug-2911.patch +75_58-Close-server-smtp-socket-explicitly-on-connect-ACL-d.patch +75_60-OpenSSL-fix-tls_eccurve-setting-explicit-curve-group.patch +75_62-OpenSSL-Fix-tls_eccurve-on-earlier-versions-than-3.0.patch +75_63-OpenSSL-log-conns-rejected-for-bad-ALPN-with-the-off.patch +75_64-DANE-do-not-check-dns_again_means_nonexist-for-TLSA-.patch +75_66-Fix-crash-in-expansions.patch +75_68-Fix-srs_encode-.-for-mod-1024-day-zero.patch +75_70-Fix-variable-initialisation-in-smtp-transport.-Bug-2.patch +75_71-Auths-fix-possible-OOB-write-in-external-authenticat.patch +75_72-Auths-use-uschar-more-in-spa-authenticator.patch +75_73-Auths-fix-possible-OOB-write-in-SPA-authenticator.-B.patch +75_74-Auths-fix-possible-OOB-read-in-SPA-authenticator.-Bu.patch +75_74-Cancel-early-pipe-on-an-observed-advertising-change.patch +75_76-Expansions-disallow-UTF-16-surrogates-from-utf8clean.patch +75_77-GnuTLS-fix-crash-with-tls_dhparam-none.patch +75_79-Fix-recipients-expansion-when-used-within-run.-.-Bug.patch +75_82-GnuTLS-fix-autogen-cert-expiry-date.-Bug-3014.patch +75_83-Re-fix-live-variable-value-free.-The-inital-fix-resu.patch +76-01-fix-string_is_ip_address-CVE-2023-42117-Bug-3031.patch +76-02-SPF-harden-against-crafted-DNS-responses.patch +76-03-Harden-dnsdb-against-crafted-DNS-responses.-Bug-3033.patch +76-10-Fix-tr.-and-empty-strings.-Bug-3023.patch +76-12-DNS-more-hardening-against-crafted-responses.patch +76-14-Lookups-Fix-dnsdb-lookup-of-multi-chunk-TXT.-Bug-305.patch +77_CVE-2023-51766_4.97.1-release.diff +90_localscan_dlopen.dpatch |