packages/exim
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!8 upgrade to 4.97 to resolve the CVE-2023-42114 to CVE-2023-42119

Browse Source 
From: @Tom_zc 
Reviewed-by: @small_leek 
Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot 2024-01-11 07:25:29 +00:00 committed by Gitee
commit f0a2e42e50
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
7 changed files with 85 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
exim-4.96-build-fix.patch
View File

@ -1,13 +0,0 @@
diff --git a/src/drtables.c b/src/drtables.c
index 513ef6c..3fa5c92 100644
--- a/src/drtables.c
+++ b/src/drtables.c
@@ -736,7 +736,7 @@ else
{
char * name = ent->d_name;
int len = (int)strlen(name);
- if (regex_match(regex_islookupmod, US name, len, NUL))
+ if (regex_match(regex_islookupmod, US name, len, NULL))
{
int pathnamelen = len + (int)strlen(LOOKUP_MODULE_DIR) + 2;
void *dl;

13
exim-4.96-opendmarc-1.4-build-fix.patch
View File

@ -1,13 +0,0 @@
diff --git a/src/dmarc.c b/src/dmarc.c
index 17bba9d..a218380 100644
--- a/src/dmarc.c
+++ b/src/dmarc.c
@@ -459,7 +459,7 @@ if (!dmarc_abort && !sender_host_authenticated)
vs == PDKIM_VERIFY_INVALID ? DMARC_POLICY_DKIM_OUTCOME_TMPFAIL :
DMARC_POLICY_DKIM_OUTCOME_NONE;
libdm_status = opendmarc_policy_store_dkim(dmarc_pctx, US sig->domain,
- dkim_result, US"");
+ sig->selector, dkim_result, US"");
DEBUG(D_receive)
debug_printf("DMARC adding DKIM sender domain = %s\n", sig->domain);
if (libdm_status != DMARC_PARSE_OKAY)

BIN
exim-4.96.tar.xz
View File

Binary file not shown.

126
exim-4.96-config.patch → exim-4.97-config.patch
View File

@ -1,8 +1,8 @@
diff --git a/scripts/Configure-Makefile b/scripts/Configure-Makefile diff --git a/scripts/Configure-Makefile b/scripts/Configure-Makefile
index ed77b6a..b9eb64d 100755 index dc5015f..07f8c23 100755
--- a/scripts/Configure-Makefile --- a/scripts/Configure-Makefile
+++ b/scripts/Configure-Makefile +++ b/scripts/Configure-Makefile
@@ -317,7 +317,7 @@ if [ "${EXIM_PERL}" != "" ] ; then @@ -319,7 +319,7 @@ if [ "${EXIM_PERL}" != "" ] ; then
mv $mft $mftt mv $mft $mftt
echo "PERL_CC=`$PERL_COMMAND -MConfig -e 'print $Config{cc}'`" >>$mft echo "PERL_CC=`$PERL_COMMAND -MConfig -e 'print $Config{cc}'`" >>$mft
@ -12,10 +12,10 @@ index ed77b6a..b9eb64d 100755
echo "" >>$mft echo "" >>$mft
cat $mftt >> $mft cat $mftt >> $mft
diff --git a/src/EDITME b/src/EDITME diff --git a/src/EDITME b/src/EDITME
index 53022e5..cf0b33e 100644 index f68b3f1..a0b37b2 100644
--- a/src/EDITME --- a/src/EDITME
+++ b/src/EDITME +++ b/src/EDITME
@@ -99,7 +99,7 @@ @@ -101,7 +101,7 @@
# /usr/local/sbin. The installation script will try to create this directory, # /usr/local/sbin. The installation script will try to create this directory,
# and any superior directories, if they do not exist. # and any superior directories, if they do not exist.
@ -24,7 +24,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -115,7 +115,7 @@ BIN_DIRECTORY=/usr/exim/bin @@ -117,7 +117,7 @@ BIN_DIRECTORY=/usr/exim/bin
# don't exist. It will also install a default runtime configuration if this # don't exist. It will also install a default runtime configuration if this
# file does not exist. # file does not exist.
@ -33,7 +33,7 @@ index 53022e5..cf0b33e 100644
# It is possible to specify a colon-separated list of files for CONFIGURE_FILE. # It is possible to specify a colon-separated list of files for CONFIGURE_FILE.
# In this case, Exim will use the first of them that exists when it is run. # In this case, Exim will use the first of them that exists when it is run.
@@ -132,7 +132,7 @@ CONFIGURE_FILE=/usr/exim/configure @@ -134,7 +134,7 @@ CONFIGURE_FILE=/usr/exim/configure
# deliveries. (Local deliveries run as various non-root users, typically as the # deliveries. (Local deliveries run as various non-root users, typically as the
# owner of a local mailbox.) Specifying these values as root is not supported. # owner of a local mailbox.) Specifying these values as root is not supported.
@ -42,7 +42,7 @@ index 53022e5..cf0b33e 100644
# If you specify EXIM_USER as a name, this is looked up at build time, and the # If you specify EXIM_USER as a name, this is looked up at build time, and the
# uid number is built into the binary. However, you can specify that this # uid number is built into the binary. However, you can specify that this
@@ -153,7 +153,7 @@ EXIM_USER= @@ -155,7 +155,7 @@ EXIM_USER=
# for EXIM_USER (e.g. EXIM_USER=exim), you don't need to set EXIM_GROUP unless # for EXIM_USER (e.g. EXIM_USER=exim), you don't need to set EXIM_GROUP unless
# you want to use a group other than the default group for the given user. # you want to use a group other than the default group for the given user.
@ -51,7 +51,7 @@ index 53022e5..cf0b33e 100644
# Many sites define a user called "exim", with an appropriate default group, # Many sites define a user called "exim", with an appropriate default group,
# and use # and use
@@ -210,10 +210,10 @@ SPOOL_DIRECTORY=/var/spool/exim @@ -212,10 +212,10 @@ SPOOL_DIRECTORY=/var/spool/exim
# If you are building with TLS, the library configuration must be done: # If you are building with TLS, the library configuration must be done:
# Uncomment this if you are using OpenSSL # Uncomment this if you are using OpenSSL
@ -64,7 +64,7 @@ index 53022e5..cf0b33e 100644
# TLS_LIBS=-lssl -lcrypto # TLS_LIBS=-lssl -lcrypto
# TLS_LIBS=-L/usr/local/openssl/lib -lssl -lcrypto # TLS_LIBS=-L/usr/local/openssl/lib -lssl -lcrypto
@@ -340,7 +340,7 @@ TRANSPORT_SMTP=yes @@ -342,7 +342,7 @@ TRANSPORT_SMTP=yes
# This one is special-purpose, and commonly not required, so it is not # This one is special-purpose, and commonly not required, so it is not
# included by default. # included by default.
@ -73,7 +73,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -349,9 +349,9 @@ TRANSPORT_SMTP=yes @@ -351,9 +351,9 @@ TRANSPORT_SMTP=yes
# MBX, is included only when requested. If you do not know what this is about, # MBX, is included only when requested. If you do not know what this is about,
# leave these settings commented out. # leave these settings commented out.
@ -86,7 +86,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -409,22 +409,28 @@ LOOKUP_DBM=yes @@ -411,22 +411,28 @@ LOOKUP_DBM=yes
LOOKUP_LSEARCH=yes LOOKUP_LSEARCH=yes
LOOKUP_DNSDB=yes LOOKUP_DNSDB=yes
@ -106,7 +106,7 @@ index 53022e5..cf0b33e 100644
-# LOOKUP_MYSQL_PC=mariadb -# LOOKUP_MYSQL_PC=mariadb
-# LOOKUP_NIS=yes -# LOOKUP_NIS=yes
+LOOKUP_MYSQL=2 +LOOKUP_MYSQL=2
+LOOKUP_MYSQL_PC=mariadb +LOOKUP_MYSQL_PC=libmariadb
+LOOKUP_NIS=yes +LOOKUP_NIS=yes
# LOOKUP_NISPLUS=yes # LOOKUP_NISPLUS=yes
+CFLAGS+=-I/usr/include/nsl -I/usr/include/tirpc +CFLAGS+=-I/usr/include/nsl -I/usr/include/tirpc
@ -124,7 +124,7 @@ index 53022e5..cf0b33e 100644
# LOOKUP_SQLITE_PC=sqlite3 # LOOKUP_SQLITE_PC=sqlite3
# LOOKUP_WHOSON=yes # LOOKUP_WHOSON=yes
@@ -437,7 +443,7 @@ LOOKUP_DNSDB=yes @@ -439,7 +445,7 @@ LOOKUP_DNSDB=yes
# Some platforms may need this for LOOKUP_NIS: # Some platforms may need this for LOOKUP_NIS:
@ -133,7 +133,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
# If you have set LOOKUP_LDAP=yes, you should set LDAP_LIB_TYPE to indicate # If you have set LOOKUP_LDAP=yes, you should set LDAP_LIB_TYPE to indicate
@@ -511,7 +517,7 @@ SUPPORT_DANE=yes @@ -513,7 +519,7 @@ SUPPORT_DANE=yes
# files are defaulted in the OS/Makefile-Default file, but can be overridden in # files are defaulted in the OS/Makefile-Default file, but can be overridden in
# local OS-specific make files. # local OS-specific make files.
@ -142,7 +142,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -521,7 +527,7 @@ SUPPORT_DANE=yes @@ -523,7 +529,7 @@ SUPPORT_DANE=yes
# and the MIME ACL. Please read the documentation to learn more about these # and the MIME ACL. Please read the documentation to learn more about these
# features. # features.
@ -152,9 +152,9 @@ index 53022e5..cf0b33e 100644
# If you have content scanning you may wish to only include some of the scanner # If you have content scanning you may wish to only include some of the scanner
# interfaces. Uncomment any of these lines to remove that code. # interfaces. Uncomment any of these lines to remove that code.
@@ -604,12 +610,12 @@ DISABLE_MAL_MKS=yes @@ -604,12 +610,12 @@ DISABLE_MAL_MKS=yes
# Uncomment the following line to add DMARC checking capability, implemented
# using libopendmarc libraries. You must have SPF and DKIM support enabled also. # using libopendmarc libraries. You must have SPF and DKIM support enabled also.
# Library version libopendmarc-1.4.1-1.fc33.x86_64 (on Fedora 33) is known broken;
# 1.3.2-3 works. I seems that the OpenDMARC project broke their API.
-# SUPPORT_DMARC=yes -# SUPPORT_DMARC=yes
+SUPPORT_DMARC=yes +SUPPORT_DMARC=yes
# CFLAGS += -I/usr/local/include # CFLAGS += -I/usr/local/include
@ -164,10 +164,10 @@ index 53022e5..cf0b33e 100644
# override it at runtime (main config option dmarc_tld_file) # override it at runtime (main config option dmarc_tld_file)
-# DMARC_TLD_FILE=/etc/exim/opendmarc.tlds -# DMARC_TLD_FILE=/etc/exim/opendmarc.tlds
+DMARC_TLD_FILE=/usr/share/publicsuffix/public_suffix_list.dat +DMARC_TLD_FILE=/usr/share/publicsuffix/public_suffix_list.dat
#
# Uncomment the following line to add ARC (Authenticated Received Chain) # Library version libopendmarc-1.4.1-1.fc33.x86_64 (on Fedora 33) is known broken;
# support. You must have SPF and DKIM support enabled also. # 1.3.2-3 works. It seems that the OpenDMARC project broke their API.
@@ -709,7 +715,7 @@ FIXED_NEVER_USERS=root @@ -740,7 +746,7 @@ FIXED_NEVER_USERS=root
# CONFIGURE_OWNER setting, to specify a configuration file which is listed in # CONFIGURE_OWNER setting, to specify a configuration file which is listed in
# the TRUSTED_CONFIG_LIST file, then root privileges are not dropped by Exim. # the TRUSTED_CONFIG_LIST file, then root privileges are not dropped by Exim.
@ -176,7 +176,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -754,18 +760,18 @@ FIXED_NEVER_USERS=root @@ -785,18 +791,18 @@ FIXED_NEVER_USERS=root
# included in the Exim binary. You will then need to set up the run time # included in the Exim binary. You will then need to set up the run time
# configuration to make use of the mechanism(s) selected. # configuration to make use of the mechanism(s) selected.
@ -203,7 +203,7 @@ index 53022e5..cf0b33e 100644
# Heimdal through 1.5 required pkg-config 'heimdal-gssapi'; Heimdal 7.1 # Heimdal through 1.5 required pkg-config 'heimdal-gssapi'; Heimdal 7.1
# requires multiple pkg-config files to work with Exim, so the second example # requires multiple pkg-config files to work with Exim, so the second example
@@ -792,7 +798,7 @@ FIXED_NEVER_USERS=root @@ -823,7 +829,7 @@ FIXED_NEVER_USERS=root
# one that is set in the headers_charset option. The default setting is # one that is set in the headers_charset option. The default setting is
# defined by this setting: # defined by this setting:
@ -212,7 +212,7 @@ index 53022e5..cf0b33e 100644
# If you are going to make use of $header_xxx expansions in your configuration # If you are going to make use of $header_xxx expansions in your configuration
# file, or if your users are going to use them in filter files, and the normal # file, or if your users are going to use them in filter files, and the normal
@@ -812,7 +818,7 @@ HEADERS_CHARSET="ISO-8859-1" @@ -843,7 +849,7 @@ HEADERS_CHARSET="ISO-8859-1"
# the Sieve filter support. For those OS where iconv() is known to be installed # the Sieve filter support. For those OS where iconv() is known to be installed
# as standard, the file in OS/Makefile-xxxx contains # as standard, the file in OS/Makefile-xxxx contains
# #
@ -221,7 +221,7 @@ index 53022e5..cf0b33e 100644
# #
# If you are not using one of those systems, but have installed iconv(), you # If you are not using one of those systems, but have installed iconv(), you
# need to uncomment that line above. In some cases, you may find that iconv() # need to uncomment that line above. In some cases, you may find that iconv()
@@ -888,7 +894,7 @@ HEADERS_CHARSET="ISO-8859-1" @@ -919,7 +925,7 @@ HEADERS_CHARSET="ISO-8859-1"
# Once you have done this, "make install" will build the info files and # Once you have done this, "make install" will build the info files and
# install them in the directory you have defined. # install them in the directory you have defined.
@ -230,7 +230,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -901,7 +907,7 @@ HEADERS_CHARSET="ISO-8859-1" @@ -932,7 +938,7 @@ HEADERS_CHARSET="ISO-8859-1"
# %s. This will be replaced by one of the strings "main", "panic", or "reject" # %s. This will be replaced by one of the strings "main", "panic", or "reject"
# to form the final file names. Some installations may want something like this: # to form the final file names. Some installations may want something like this:
@ -239,7 +239,7 @@ index 53022e5..cf0b33e 100644
# which results in files with names /var/log/exim_mainlog, etc. The directory # which results in files with names /var/log/exim_mainlog, etc. The directory
# in which the log files are placed must exist; Exim does not try to create # in which the log files are placed must exist; Exim does not try to create
@@ -973,7 +979,7 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1004,7 +1010,7 @@ ZCAT_COMMAND=/usr/bin/zcat
# (version 5.004 or later) installed, set EXIM_PERL to perl.o. Using embedded # (version 5.004 or later) installed, set EXIM_PERL to perl.o. Using embedded
# Perl costs quite a lot of resources. Only do this if you really need it. # Perl costs quite a lot of resources. Only do this if you really need it.
@ -248,7 +248,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -983,7 +989,7 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1014,7 +1020,7 @@ ZCAT_COMMAND=/usr/bin/zcat
# that the local_scan API is made available by the linker. You may also need # that the local_scan API is made available by the linker. You may also need
# to add -ldl to EXTRALIBS so that dlopen() is available to Exim. # to add -ldl to EXTRALIBS so that dlopen() is available to Exim.
@ -257,7 +257,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -993,7 +999,7 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1024,7 +1030,7 @@ ZCAT_COMMAND=/usr/bin/zcat
# support, which is intended for use in conjunction with the SMTP AUTH # support, which is intended for use in conjunction with the SMTP AUTH
# facilities, is included only when requested by the following setting: # facilities, is included only when requested by the following setting:
@ -266,7 +266,7 @@ index 53022e5..cf0b33e 100644
# You probably need to add -lpam to EXTRALIBS, and in some releases of # You probably need to add -lpam to EXTRALIBS, and in some releases of
# GNU/Linux -ldl is also needed. # GNU/Linux -ldl is also needed.
@@ -1005,12 +1011,12 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1036,12 +1042,12 @@ ZCAT_COMMAND=/usr/bin/zcat
# If you may want to use outbound (client-side) proxying, using Socks5, # If you may want to use outbound (client-side) proxying, using Socks5,
# uncomment the line below. # uncomment the line below.
@ -281,7 +281,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -1034,9 +1040,9 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1065,9 +1071,9 @@ ZCAT_COMMAND=/usr/bin/zcat
# installed on your system (www.libspf2.org). Depending on where it is installed # installed on your system (www.libspf2.org). Depending on where it is installed
# you may have to edit the CFLAGS and LDFLAGS lines. # you may have to edit the CFLAGS and LDFLAGS lines.
@ -293,7 +293,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -1101,7 +1107,7 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1132,7 +1138,7 @@ ZCAT_COMMAND=/usr/bin/zcat
# group. Once you have installed saslauthd, you should arrange for it to be # group. Once you have installed saslauthd, you should arrange for it to be
# started by root at boot time. # started by root at boot time.
@ -302,7 +302,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -1115,8 +1121,8 @@ ZCAT_COMMAND=/usr/bin/zcat @@ -1146,8 +1152,8 @@ ZCAT_COMMAND=/usr/bin/zcat
# library for TCP wrappers, so you probably need something like this: # library for TCP wrappers, so you probably need something like this:
# #
# USE_TCP_WRAPPERS=yes # USE_TCP_WRAPPERS=yes
@ -313,7 +313,7 @@ index 53022e5..cf0b33e 100644
# #
# but of course there may need to be other things in CFLAGS and EXTRALIBS_EXIM # but of course there may need to be other things in CFLAGS and EXTRALIBS_EXIM
# as well. # as well.
@@ -1168,7 +1174,7 @@ SYSTEM_ALIASES_FILE=/etc/aliases @@ -1199,7 +1205,7 @@ SYSTEM_ALIASES_FILE=/etc/aliases
# is "yes", as well as supporting line editing, a history of input lines in the # is "yes", as well as supporting line editing, a history of input lines in the
# current run is maintained. # current run is maintained.
@ -322,7 +322,7 @@ index 53022e5..cf0b33e 100644
# You may need to add -ldl to EXTRALIBS when you set USE_READLINE=yes. # You may need to add -ldl to EXTRALIBS when you set USE_READLINE=yes.
# Note that this option adds to the size of the Exim binary, because the # Note that this option adds to the size of the Exim binary, because the
@@ -1185,7 +1191,7 @@ SYSTEM_ALIASES_FILE=/etc/aliases @@ -1216,7 +1222,7 @@ SYSTEM_ALIASES_FILE=/etc/aliases
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
# Uncomment this setting to include IPv6 support. # Uncomment this setting to include IPv6 support.
@ -331,7 +331,7 @@ index 53022e5..cf0b33e 100644
############################################################################### ###############################################################################
# THINGS YOU ALMOST NEVER NEED TO MENTION # # THINGS YOU ALMOST NEVER NEED TO MENTION #
@@ -1206,13 +1212,13 @@ SYSTEM_ALIASES_FILE=/etc/aliases @@ -1237,13 +1243,13 @@ SYSTEM_ALIASES_FILE=/etc/aliases
# haven't got Perl, Exim will still build and run; you just won't be able to # haven't got Perl, Exim will still build and run; you just won't be able to
# use those utilities. # use those utilities.
@ -352,7 +352,7 @@ index 53022e5..cf0b33e 100644
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
@@ -1414,7 +1420,7 @@ EXIM_TMPDIR="/tmp" @@ -1445,7 +1451,7 @@ EXIM_TMPDIR="/tmp"
# (process id) to a file so that it can easily be identified. The path of the # (process id) to a file so that it can easily be identified. The path of the
# file can be specified here. Some installations may want something like this: # file can be specified here. Some installations may want something like this:
@ -362,7 +362,7 @@ index 53022e5..cf0b33e 100644
# If PID_FILE_PATH is not defined, Exim writes a file in its spool directory # If PID_FILE_PATH is not defined, Exim writes a file in its spool directory
# using the name "exim-daemon.pid". # using the name "exim-daemon.pid".
diff --git a/src/configure.default b/src/configure.default diff --git a/src/configure.default b/src/configure.default
index 3761daf..a5d3718 100644 index 633c653..6379927 100644
--- a/src/configure.default --- a/src/configure.default
+++ b/src/configure.default +++ b/src/configure.default
@@ -67,7 +67,7 @@ @@ -67,7 +67,7 @@
@ -430,9 +430,9 @@ index 3761daf..a5d3718 100644
# For OpenSSL, prefer EC- over RSA-authenticated ciphers # For OpenSSL, prefer EC- over RSA-authenticated ciphers
.ifdef _HAVE_OPENSSL .ifdef _HAVE_OPENSSL
@@ -189,8 +197,8 @@ tls_resumption_hosts = ${if inlist {$received_port}{587:465} {:}{*}} @@ -193,8 +201,8 @@ tls_resumption_hosts = ${if inlist {$received_port}{587:465} {:}{*}}
# them you should also allow TLS-on-connect on the traditional but # them you should also allow TLS-on-connect on the traditional (and now
# non-standard port 465. # standard) port 465.
-# daemon_smtp_ports = 25 : 465 : 587 -# daemon_smtp_ports = 25 : 465 : 587
-# tls_on_connect_ports = 465 -# tls_on_connect_ports = 465
@ -441,7 +441,7 @@ index 3761daf..a5d3718 100644
# Specify the domain you want to be added to all unqualified addresses # Specify the domain you want to be added to all unqualified addresses
@@ -248,6 +256,24 @@ never_users = root @@ -252,6 +260,24 @@ never_users = root
host_lookup = * host_lookup = *
@ -466,7 +466,7 @@ index 3761daf..a5d3718 100644
# The setting below causes Exim to try to initialize the system resolver # The setting below causes Exim to try to initialize the system resolver
# library with DNSSEC support. It has no effect if your library lacks # library with DNSSEC support. It has no effect if your library lacks
@@ -378,8 +404,8 @@ timeout_frozen_after = 7d @@ -382,8 +408,8 @@ timeout_frozen_after = 7d
# Note that TZ is handled separately by the timezone runtime option # Note that TZ is handled separately by the timezone runtime option
# and TIMEZONE_DEFAULT buildtime option. # and TIMEZONE_DEFAULT buildtime option.
@ -477,7 +477,7 @@ index 3761daf..a5d3718 100644
@@ -390,6 +416,29 @@ timeout_frozen_after = 7d @@ -394,6 +420,29 @@ timeout_frozen_after = 7d
begin acl begin acl
@ -507,7 +507,7 @@ index 3761daf..a5d3718 100644
# This access control list is used for every RCPT command in an incoming # This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either # SMTP message. The tests are run in order until the address is either
# accepted or denied. # accepted or denied.
@@ -401,6 +450,7 @@ acl_check_rcpt: @@ -405,6 +454,7 @@ acl_check_rcpt:
accept hosts = : accept hosts = :
control = dkim_disable_verify control = dkim_disable_verify
@ -515,7 +515,7 @@ index 3761daf..a5d3718 100644
############################################################################# #############################################################################
# The following section of the ACL is concerned with local parts that contain # The following section of the ACL is concerned with local parts that contain
@@ -454,7 +504,8 @@ acl_check_rcpt: @@ -458,7 +508,8 @@ acl_check_rcpt:
accept local_parts = postmaster accept local_parts = postmaster
domains = +local_domains domains = +local_domains
@ -525,7 +525,7 @@ index 3761daf..a5d3718 100644
require verify = sender require verify = sender
@@ -494,6 +545,7 @@ acl_check_rcpt: @@ -498,6 +549,7 @@ acl_check_rcpt:
accept hosts = +relay_from_hosts accept hosts = +relay_from_hosts
control = submission control = submission
control = dkim_disable_verify control = dkim_disable_verify
@ -533,7 +533,7 @@ index 3761daf..a5d3718 100644
# Accept if the message arrived over an authenticated connection, from # Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient # any host. Again, these messages are usually from MUAs, so recipient
@@ -503,6 +555,7 @@ acl_check_rcpt: @@ -507,6 +559,7 @@ acl_check_rcpt:
accept authenticated = * accept authenticated = *
control = submission control = submission
control = dkim_disable_verify control = dkim_disable_verify
@ -541,7 +541,7 @@ index 3761daf..a5d3718 100644
# Insist that any other recipient address that we accept is either in one of # Insist that any other recipient address that we accept is either in one of
# our local domains, or is in a domain for which we explicitly allow # our local domains, or is in a domain for which we explicitly allow
@@ -523,7 +576,8 @@ acl_check_rcpt: @@ -527,7 +580,8 @@ acl_check_rcpt:
# There are no default checks on DNS black lists because the domains that # There are no default checks on DNS black lists because the domains that
# contain these lists are changing all the time. However, here are two # contain these lists are changing all the time. However, here are two
# examples of how you can get Exim to perform a DNS black list lookup at this # examples of how you can get Exim to perform a DNS black list lookup at this
@ -551,7 +551,7 @@ index 3761daf..a5d3718 100644
# #
# deny dnslists = black.list.example # deny dnslists = black.list.example
# message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text # message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
@@ -531,6 +585,10 @@ acl_check_rcpt: @@ -535,6 +589,10 @@ acl_check_rcpt:
# warn dnslists = black.list.example # warn dnslists = black.list.example
# add_header = X-Warning: $sender_host_address is in a black list at $dnslist_domain # add_header = X-Warning: $sender_host_address is in a black list at $dnslist_domain
# log_message = found in $dnslist_domain # log_message = found in $dnslist_domain
@ -562,7 +562,7 @@ index 3761daf..a5d3718 100644
############################################################################# #############################################################################
############################################################################# #############################################################################
@@ -557,6 +615,10 @@ acl_check_rcpt: @@ -561,6 +619,10 @@ acl_check_rcpt:
# set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER} # set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER}
############################################################################# #############################################################################
@ -573,7 +573,7 @@ index 3761daf..a5d3718 100644
# At this point, the address has passed all the checks that have been # At this point, the address has passed all the checks that have been
# configured, so we accept it unconditionally. # configured, so we accept it unconditionally.
@@ -606,21 +668,32 @@ acl_check_data: @@ -610,21 +672,32 @@ acl_check_data:
message = header syntax message = header syntax
log_message = header syntax ($acl_verify_message) log_message = header syntax ($acl_verify_message)
@ -614,7 +614,7 @@ index 3761daf..a5d3718 100644
############################################################################# #############################################################################
# No more tests if PRDR was actively used. # No more tests if PRDR was actively used.
@@ -634,11 +707,63 @@ acl_check_data: @@ -638,11 +711,63 @@ acl_check_data:
# condition = ... # condition = ...
############################################################################# #############################################################################
@ -679,7 +679,7 @@ index 3761daf..a5d3718 100644
###################################################################### ######################################################################
@@ -740,7 +865,7 @@ system_aliases: @@ -744,7 +869,7 @@ system_aliases:
driver = redirect driver = redirect
allow_fail allow_fail
allow_defer allow_defer
@ -688,7 +688,7 @@ index 3761daf..a5d3718 100644
# user = exim # user = exim
file_transport = address_file file_transport = address_file
pipe_transport = address_pipe pipe_transport = address_pipe
@@ -778,7 +903,7 @@ userforward: @@ -782,7 +907,7 @@ userforward:
# local_part_suffix = +* : -* # local_part_suffix = +* : -*
# local_part_suffix_optional # local_part_suffix_optional
file = $home/.forward file = $home/.forward
@ -697,7 +697,7 @@ index 3761daf..a5d3718 100644
no_verify no_verify
no_expn no_expn
check_ancestor check_ancestor
@@ -786,6 +911,12 @@ userforward: @@ -790,6 +915,12 @@ userforward:
pipe_transport = address_pipe pipe_transport = address_pipe
reply_transport = address_reply reply_transport = address_reply
@ -710,7 +710,7 @@ index 3761daf..a5d3718 100644
# This router matches local user mailboxes. If the router fails, the error # This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user". # message is "Unknown user".
@@ -826,6 +957,25 @@ remote_smtp: @@ -830,6 +961,25 @@ remote_smtp:
tls_resumption_hosts = * tls_resumption_hosts = *
.endif .endif
@ -736,7 +736,7 @@ index 3761daf..a5d3718 100644
# This transport is used for delivering messages to a smarthost, if the # This transport is used for delivering messages to a smarthost, if the
# smarthost router is enabled. This starts from the same basis as # smarthost router is enabled. This starts from the same basis as
@@ -880,8 +1030,8 @@ local_delivery: @@ -884,8 +1034,8 @@ local_delivery:
delivery_date_add delivery_date_add
envelope_to_add envelope_to_add
return_path_add return_path_add
@ -747,7 +747,7 @@ index 3761daf..a5d3718 100644
# This transport is used for handling pipe deliveries generated by alias or # This transport is used for handling pipe deliveries generated by alias or
@@ -914,6 +1064,16 @@ address_reply: @@ -918,6 +1068,16 @@ address_reply:
driver = autoreply driver = autoreply
@ -764,7 +764,7 @@ index 3761daf..a5d3718 100644
###################################################################### ######################################################################
# RETRY CONFIGURATION # # RETRY CONFIGURATION #
@@ -954,6 +1114,21 @@ begin rewrite @@ -958,6 +1118,21 @@ begin rewrite
# AUTHENTICATION CONFIGURATION # # AUTHENTICATION CONFIGURATION #
###################################################################### ######################################################################
@ -786,7 +786,7 @@ index 3761daf..a5d3718 100644
# The following authenticators support plaintext username/password # The following authenticators support plaintext username/password
# authentication using the standard PLAIN mechanism and the traditional # authentication using the standard PLAIN mechanism and the traditional
# but non-standard LOGIN mechanism, with Exim acting as the server. # but non-standard LOGIN mechanism, with Exim acting as the server.
@@ -969,7 +1144,7 @@ begin rewrite @@ -973,7 +1148,7 @@ begin rewrite
# The default RCPT ACL checks for successful authentication, and will accept # The default RCPT ACL checks for successful authentication, and will accept
# messages from authenticated users from anywhere on the Internet. # messages from authenticated users from anywhere on the Internet.
@ -795,7 +795,7 @@ index 3761daf..a5d3718 100644
# PLAIN authentication has no server prompts. The client sends its # PLAIN authentication has no server prompts. The client sends its
# credentials in one lump, containing an authorization ID (which we do not # credentials in one lump, containing an authorization ID (which we do not
@@ -983,7 +1158,7 @@ begin authenticators @@ -987,7 +1162,7 @@ begin authenticators
# driver = plaintext # driver = plaintext
# server_set_id = $auth2 # server_set_id = $auth2
# server_prompts = : # server_prompts = :
@ -804,7 +804,7 @@ index 3761daf..a5d3718 100644
# server_advertise_condition = ${if def:tls_in_cipher } # server_advertise_condition = ${if def:tls_in_cipher }
# LOGIN authentication has traditional prompts and responses. There is no # LOGIN authentication has traditional prompts and responses. There is no
@@ -995,7 +1170,7 @@ begin authenticators @@ -999,7 +1174,7 @@ begin authenticators
# driver = plaintext # driver = plaintext
# server_set_id = $auth1 # server_set_id = $auth1
# server_prompts = <| Username: | Password: # server_prompts = <| Username: | Password:

25
exim-4.96-dlopen-localscan.patch → exim-4.97-dlopen-localscan.patch
View File

@ -1,8 +1,8 @@
diff --git a/src/EDITME b/src/EDITME diff --git a/src/EDITME b/src/EDITME
index cf0b33e..7d4cbf3 100644 index a0b37b2..dbf009f 100644
--- a/src/EDITME --- a/src/EDITME
+++ b/src/EDITME +++ b/src/EDITME
@@ -878,6 +878,21 @@ HAVE_ICONV=yes @@ -909,6 +909,21 @@ HAVE_ICONV=yes
# *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING *** # *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING ***
@ -25,7 +25,7 @@ index cf0b33e..7d4cbf3 100644
# The default distribution of Exim contains only the plain text form of the # The default distribution of Exim contains only the plain text form of the
# documentation. Other forms are available separately. If you want to install # documentation. Other forms are available separately. If you want to install
diff --git a/src/config.h.defaults b/src/config.h.defaults diff --git a/src/config.h.defaults b/src/config.h.defaults
index 25ab755..e27a51d 100644 index 28d4f13..460169a 100644
--- a/src/config.h.defaults --- a/src/config.h.defaults
+++ b/src/config.h.defaults +++ b/src/config.h.defaults
@@ -33,6 +33,8 @@ Do not put spaces between # and the 'define'. @@ -33,6 +33,8 @@ Do not put spaces between # and the 'define'.
@ -38,10 +38,10 @@ index 25ab755..e27a51d 100644
#define CONFIGURE_FILE #define CONFIGURE_FILE
diff --git a/src/globals.c b/src/globals.c diff --git a/src/globals.c b/src/globals.c
index ff246fe..b9dfbbb 100644 index e94bef7..801b88f 100644
--- a/src/globals.c --- a/src/globals.c
+++ b/src/globals.c +++ b/src/globals.c
@@ -151,6 +151,10 @@ time_t tls_watch_trigger_time = (time_t)0; @@ -152,6 +152,10 @@ time_t tls_watch_trigger_time = (time_t)0;
uschar *tls_advertise_hosts = NULL; uschar *tls_advertise_hosts = NULL;
#endif #endif
@ -53,10 +53,10 @@ index ff246fe..b9dfbbb 100644
/* Per Recipient Data Response variables */ /* Per Recipient Data Response variables */
BOOL prdr_enable = FALSE; BOOL prdr_enable = FALSE;
diff --git a/src/globals.h b/src/globals.h diff --git a/src/globals.h b/src/globals.h
index fe099e4..7530a76 100644 index 6ec4e61..620b700 100644
--- a/src/globals.h --- a/src/globals.h
+++ b/src/globals.h +++ b/src/globals.h
@@ -148,6 +148,11 @@ extern uschar *tls_verify_hosts; /* Mandatory client verification */ @@ -150,6 +150,11 @@ extern uschar *tls_verify_hosts; /* Mandatory client verification */
extern int tls_watch_fd; /* for inotify of creds files */ extern int tls_watch_fd; /* for inotify of creds files */
extern time_t tls_watch_trigger_time; /* non-0: triggered */ extern time_t tls_watch_trigger_time; /* non-0: triggered */
#endif #endif
@ -69,12 +69,12 @@ index fe099e4..7530a76 100644
extern uschar *dsn_envid; /* DSN envid string */ extern uschar *dsn_envid; /* DSN envid string */
diff --git a/src/local_scan.c b/src/local_scan.c diff --git a/src/local_scan.c b/src/local_scan.c
index 7a3bae7..6ea5d2d 100644 index da44cb7..d19af58 100644
--- a/src/local_scan.c --- a/src/local_scan.c
+++ b/src/local_scan.c +++ b/src/local_scan.c
@@ -6,59 +6,133 @@ @@ -7,59 +7,134 @@
/* Copyright (c) The Exim Maintainers 2021 */
/* See the file NOTICE for conditions of use and distribution. */ /* See the file NOTICE for conditions of use and distribution. */
/* SPDX-License-Identifier: GPL-2.0-or-later */
+#include <local_scan.h> +#include <local_scan.h>
@ -130,6 +130,7 @@ index 7a3bae7..6ea5d2d 100644
-*/ -*/
+#ifdef DLOPEN_LOCAL_SCAN +#ifdef DLOPEN_LOCAL_SCAN
+#include <dlfcn.h> +#include <dlfcn.h>
+#include <stdlib.h>
+static int (*local_scan_fn)(int fd, uschar **return_text) = NULL; +static int (*local_scan_fn)(int fd, uschar **return_text) = NULL;
+static int load_local_scan_library(void); +static int load_local_scan_library(void);
+#endif +#endif
@ -254,10 +255,10 @@ index 7a3bae7..6ea5d2d 100644
+ +
/* End of local_scan.c */ /* End of local_scan.c */
diff --git a/src/readconf.c b/src/readconf.c diff --git a/src/readconf.c b/src/readconf.c
index 06bc50f..6ecb0af 100644 index e77458d..137250d 100644
--- a/src/readconf.c --- a/src/readconf.c
+++ b/src/readconf.c +++ b/src/readconf.c
@@ -212,6 +212,9 @@ static optionlist optionlist_config[] = { @@ -216,6 +216,9 @@ static optionlist optionlist_config[] = {
{ "local_from_prefix", opt_stringptr, {&local_from_prefix} }, { "local_from_prefix", opt_stringptr, {&local_from_prefix} },
{ "local_from_suffix", opt_stringptr, {&local_from_suffix} }, { "local_from_suffix", opt_stringptr, {&local_from_suffix} },
{ "local_interfaces", opt_stringptr, {&local_interfaces} }, { "local_interfaces", opt_stringptr, {&local_interfaces} },

BIN
exim-4.97.tar.xz Normal file
View File

Binary file not shown.

17
exim.spec
View File

@ -3,8 +3,8 @@
Summary: The exim mail transfer agent Summary: The exim mail transfer agent
Name: exim Name: exim
Version: 4.96 Version: 4.97
Release: 3 Release: 1
License: GPLv2+ License: GPLv2+
Url: https://www.exim.org/ Url: https://www.exim.org/
@ -35,14 +35,11 @@ Source10: exim.service
Source11: exim-gen-cert Source11: exim-gen-cert
Source12: clamd.exim.service Source12: clamd.exim.service
Patch0: exim-4.96-config.patch Patch0: exim-4.97-config.patch
Patch1: exim-4.94-libdir.patch Patch1: exim-4.94-libdir.patch
Patch2: exim-4.96-dlopen-localscan.patch Patch2: exim-4.97-dlopen-localscan.patch
Patch3: exim-4.96-pic.patch Patch3: exim-4.96-pic.patch
# https://bugs.exim.org/show_bug.cgi?id=2728
Patch4: exim-4.96-opendmarc-1.4-build-fix.patch
# https://bugs.exim.org/show_bug.cgi?id=2899
Patch5: exim-4.96-build-fix.patch
Requires: /etc/pki/tls/certs /etc/pki/tls/private Requires: /etc/pki/tls/certs /etc/pki/tls/private
Requires: setup Requires: setup
@ -69,6 +66,7 @@ BuildRequires: libX11-devel
BuildRequires: libSM-devel BuildRequires: libSM-devel
BuildRequires: perl-devel BuildRequires: perl-devel
BuildRequires: perl-generators BuildRequires: perl-generators
BuildRequires: perl-File-FcntlLock
BuildRequires: libICE-devel BuildRequires: libICE-devel
BuildRequires: libXpm-devel BuildRequires: libXpm-devel
BuildRequires: libXt-devel BuildRequires: libXt-devel
@ -482,6 +480,9 @@ fi
%{_sysconfdir}/cron.daily/greylist-tidy.sh %{_sysconfdir}/cron.daily/greylist-tidy.sh
%changelog %changelog
* Sat Dec 16 2023 zhuchao <tom_toworld@163.com> - 4.97-1
- DESC:upgrade to 4.97 to resolve the CVE-2023-42114 to CVE-2023-42119
* Tue Aug 29 2023 zhuchao <tom_toworld@163.com> - 4.96-3 * Tue Aug 29 2023 zhuchao <tom_toworld@163.com> - 4.96-3
- DESC:fix bug about print error message in install exim-clamav and exim-greylist - DESC:fix bug about print error message in install exim-clamav and exim-greylist