summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2012-05-17fix TLS SNI segfault casePhil Pennock
Failed to notice my test config on the GnuTLS box did nothing with SNI. Fixed segfault. Better diagnostics. Still not actually changing key/cert, need to investigate further
2012-05-17Guards for older releases of GnuTLS.Phil Pennock
gnutls_sec_param_to_pk_bits() and gnutls_rnd() are both new as of GnuTLS 2.12.x. Guard their usage on 2.12.0+ at compile time. In older versions, the vaguely_random_number() function just immediately calls the fallback, so it's the same as before this change (just one extra indirection in the code-path). Define a constant of 1024 for dh-bits for use in those old releases where GnuTLS won't tell us how many we should use. Change the on-disk filename for generated D-H params again, replacing the -normal with -<bitcount>, so that it's 1024 or whatever, and as the value changes, Exim will automatically start using the new value.
2012-05-17dnsdb SPF support, from Janne SnabbPhil Pennock
2012-05-16Merge branch 'experimental_ocsp'Phil Pennock
2012-05-16Overhaul of GnuTLS code.Phil Pennock
GnuTLS code re-done, using cut&paste for preservation where appropriate. Stop using deprecated APIs. Stop hard-coding lists of ciphers. Use gnutls_priority_init() instead. Turns tls_require_ciphers into a string in the GnuTLS case, not just OpenSSL case. Deprecate three gnutls_require_* options; now ignored but not errors. (No warnings yet). Added TLS SNI support. Made the channel binding integration theoretically actually work. I had it guarded by an #ifdef but the value used was an enum instead. Oops. Fixed. New code much more amenable to future work permitting TLS in callouts. DH param sizes now chosen by GnuTLS maintainers, we use "normal"; that's suddenly a lot more bits, so the saved filename was changed too. (GNUTLS_SEC_PARAM_NORMAL). DH param setup only done for servers now, since clients don't need/use it. GnuTLS a lot more robust to library negotiation using stuff we don't support, error-ing out quickly for other authentication systems (PGP, etc). Renamed pseudo_random_number() to vaguely_random_number() which makes the nature clearer. GnuTLS now provides a vaguely_random_number() implementation, to match OpenSSL. Pull in <inttypes.h> to make the recent arithmetic changes compile on MacOS. Nuke test 2011 which related to the gnutls_require_* options now non-functional.
2012-05-13Use defines in config.h for type & scanf-patterns for eval. Update docs.Jeremy Harris
2012-05-13Make integer values 64bit (bug 1171).Jeremy Harris
2012-05-13Oops, missed .c change in bug 1246 fix git commitPhil Pennock
2012-05-12pcre-config support.Phil Pennock
Remove a couple of stray references to PCRE_CFLAGS too (dating from when PCRE was bundled).
2012-05-10fix non-bw case, late slip not re-run by my earlier testsPhil Pennock
2012-05-09Merge branch 'master' of git://git.exim.org/eximJeremy Harris
2012-05-09Fix non-TLS build. Detection and fix by Todd Lyons.Jeremy Harris
2012-05-08inetd wait mode support with -bwPhil Pennock
2012-05-08OCSP Stapling support, under EXPERIMENTAL_OCSP.Phil Pennock
OpenSSL only.
2012-05-07Testsuite: updates for 8bitmime-as-default.Jeremy Harris
2012-05-07Default accept_8bitmime to true.Phil Pennock
Some discussion at http://bugs.exim.org/show_bug.cgi?id=817 Refer readers to Dan Bernstein's analysis of the issues. Consensus seen from maintainers is that DJB is right on this point.
2012-05-07revert "%s" addition in em_main.c, broke %D in log_file.Phil Pennock
Also added gdb support. This leaves us with a printf warning. We accept that as the cost of using PRINTF_FORMAT for strings that aren't libc formats.
2012-05-06Unbreak build on Solaris.Phil Pennock
Solaris needs -lresolv, ie $(LIBRESOLV), for anything referencing DNS. I added _res stuff to os.c. os.c is used by multiple tools, but of those only Exim needs the DNS functionality. So used a !defined(COMPILE_UTILITY) guard.
2012-05-05DNS resolver init changes for NetBSD compatibility.Phil Pennock
2012-05-05Fix eximon build (tls_sni)Jeremy Harris
2012-05-04Check localhost_number expansion for failure.Phil Pennock
Avoids NULL dereference. Report and patch from Alun Jones. Also a couple of SIZE_T_FMT sizeof() printf string fixes while I was in there. fixes bug 1122
2012-05-04silence various compiler complaints; expose NVALGRINDPhil Pennock
2012-05-04More tls_sni support: outbound, logging.Phil Pennock
tls_sni as SMTP transport option. Use correct storage pool for copying tls_sni, so survives for life of process. Add +tls_sni log-selector, for inbound tls_sni. Update exipick to handle -tls_sni in spool files. Also reset tls_bits at start of outbound connection (was missing).
2012-05-04TLS SNI support for OpenSSL ($tls_sni)Phil Pennock
2012-05-03Guard loadable module vars with LOOKUP_MODULE_DIR.Phil Pennock
Fixes compiler complaints about unused variables.
2012-05-03spurious compiler warning of unused var fixPhil Pennock
(but added check in case wrong about spuriousness)
2012-05-03OpenSSL fixes and backwards compat break.Phil Pennock
Drop SSL_clear() after SSL_new() which causes protocol negotiation failures for TLS1.0 vs TLS1.1/1.2 in OpenSSL 1.0.1b. Remove SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS (+dont_insert_empty_fragments) from default of openssl_options.
2012-05-03LDAP: Check for errors of TLS initialisationPhil Pennock
Report and patch from Dmitry Banschikov.
2012-05-01Code refactoring in acl.c (bug 1184)Jeremy Harris
Move to a table-driven approach for the parsing of "verify =".
2012-05-01Change notes for bug 660.Jeremy Harris
2012-05-01Return multi-values attributes from an LDAP lookup in parsable form (bug 660).Jeremy Harris
2012-04-30Fix verification when DKIM Signatures are not inserted as tracking headers. ↵Tom Kistner
Thanks to Wolfgang Breyha for the patch! (bug 1239)
2012-04-29Include string_interpret_escape() in COMPILE_UTILITY cases.Jeremy Harris
Eximon needs it, via util-spool_in.o It needed a private hex_digits[] to avoid bringing in all of globals.c to COMPILE_UTILITY.
2012-04-28include string_unprinting() in COMPILE_UTILITY cases.Phil Pennock
jgh debugged eximon build failure; util-spool_in.o needs it
2012-04-28TLS fixes for OpenSSL.Phil Pennock
Support TLS 1.1 & 1.2 New "openssl_options" values (all now documented). Set SSL_MODE_AUTO_RETRY so that OpenSSL will retry a read or write after TLS renegotiation, which otherwise led to messages "Got SSL error 2".
2012-04-28describe spool file changes for -tls_peerdnPhil Pennock
2012-04-27Handle \n in tls_peerdn for spool files.Phil Pennock
Fixes bug 1240.
2012-04-25Add ACL name to debug output of condition result (bug 1238).Jeremy Harris
2012-04-23Ensure $smtp_command is initialized before it can be expanded (bug 1182).Jeremy Harris
2012-04-23Add pointer to IPv6 support in prototype Makefile (bug 1232).Jeremy Harris
2012-04-22Always init_lookup_list before readconf_main.Phil Pennock
This happens while still root. Be more emphatic in EDITME about the security implications of loadable modules.
2012-04-22Mark cases where printf format strings are usedDirk Mueller
Bug report from Lars Müller <lars@samba.org> (via SUSE), Patch from Dirk Mueller <dmueller@suse.com>
2012-04-12Handle TAB, not just SP, in MAIL args.Phil Pennock
Analysis, diagnosis and variant patch by Todd Lyons.
2012-03-21Merge branch 'dbmjz'Phil Pennock
2012-03-21heimdal_gssapi: accept SASL with empty authzidPhil Pennock
Saw this happening with Apple Mail; accept it, dup the GSS Display Name
2012-03-02Add dbmjz lookup typePhil Pennock
2012-02-19Log auth data in rejectlog.Phil Pennock
http://bugs.exim.org/attachment.cgi?id=547&action=edit fixes bug: 1214 Patch by Jeremy Harris
2012-02-18expand cyrus_sasl server_realm optionPhil Pennock
2012-02-18Merge branch 'sasl_fixes'Phil Pennock
2012-02-18Use gsasl_property_fast() in property callback.Phil Pennock
Avoids the loops which we only cancel out anyway.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-27 17:20:24 +0000