Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection durin…
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D60741
mail/exim: daemon fails to create notifier socket on start if no correct exit (+)
Since recent version (e.g. 4.98) exim successfully creates notifier socket file in FreeBSD.
But if file already exists during exim start it's just ignored with error message in log.
Without notifier socket exim cannot check if there is already running exim daemon
with e.g. such condition: ${if eq {$queue_size} {} }.
Add socket file removing before daemon start.
exim_notifier_socket variable is added for notifier_socket setting overriding in exim configuration.
PR: 281615
Notified by: vvd
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI
LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.
Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.
This commit introduces databases/lmdb0 as a holding port for the 0.9.35
release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually
conflicting with databases/lmdb, which retains 1.0. The two packages
cannot be installed simultaneously, but having lmdb0 available means:
* Ports known to require the 0.9 ABI can declare an explicit dependency
on databases/lmdb0 until they are validated against 1.0.
* Users with existing databases in the 0.9 format can still access the
mdb_dump and mdb_load utilities to migrate data before upgrading.
* The package conflict prevents accidental mixing.
All 50 direct dependents of databases/lmdb are redirected to
databases/lmdb0 for now with a PORTREVISION bump, effectively restoring
the tree to the state prior to the LMDB 1.0 update. Once all dependent
ports are validated against LMDB 1.0, they will be moved back to
databases/lmdb and databases/lmdb0 will be removed.
PR: ports/296530
mail/exim*: update to 4.98.2 release (+)
This is a security release, addressing CVE-2025-30232
JH/01 Fix use-after-free notified by Trend Micro (ref: ZDI-CAN-26250).
Null out debug_pretrigger_buf pointer before freeing the buffer;
the use of this buffer by the storage management checks the pointer
for non-null before using it.
Security: CVE-2025-30232
mail/exim: update 4.96.2 -> 4.97
Notable changes:
- The internal (but exposed in logs, Received: headers and Message-ID: headers)
identifier used for messages is longer than in the previous release
PR: 274909
Changes: https://lists.exim.org/lurker/message/20231104.135832.37148bbd.en.html
Reported-by: doctor@doctor.nl2k.ab.ca
Approved-by: fluffy (maintainer)
Reviewed-by: Igor Zabelin <igorz@yandex.ru>
mail/exim: Unmark BROKEN for openssl30
New version 4.96 comes with support for OpenSSL 3.0.X which has been
tested however support with 3.1.X has not yet been tested.
It maybe the case that while I was marking ports BROKEN the MAINTAINER
was updating the port and missed this snippet causing a mid air
collission.
PR: 265098
Tested by: i.dani@outlook.com
mail/exim: Mark BROKEN_SSL
- Fails to build with error: token is not a valid binary operator in a
preprocessor subexpression
- There is an upstream release more recent than the one in the tree
which supports OpenSSL 3.0.0
Approved by: portmgr (blanket)
mail/exim: actually fix the bug in code (+)
The comment prior to smtp_printf() implementation says that the
extra BOOL argument tells whether "further is data expected".
Looking at other invocations of it, including those
for error 451, it should be FALSE here.
mail/exim: unbreak build with LLVM15 (+)
Pass -Wno-int-conversion to CFLAGS fixes error with strict conversion rules introduced in LLVM15
error: incompatible pointer to integer conversion passing 'char *' to parameter of type 'BOOL' (aka 'unsigned int') [-Wint-conversion]
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
mail/exim: port TLS patches from upstream (+)
This fixes hang in TLS transport after 4xx or 5xx bug
(see https://bugs.exim.org/show_bug.cgi?id=2864)
PR: 262594
Tested by: Kurt Jaeger, David Siebörger
mail/exim: switch to native SRS implementation (+)
Years before Exim used alternative SRS library.
Since 4.95 release, SRS functions was implemented as native code,
switch build process tu use it insteasd of outdated alternative
PR: 260789
Tested by: Martin Waschbüsch
Sponsored by: Netzkommune GmbH
mail/exim: update to 4.95 release (+)
Finally, Exim will be pushed to 4.95 release.
Long wait was caused by some criticals errors in vanilla release,
upstream fixes got a some time to come.
* Apply sendfile patch, fixes SIGSEGV using clamd via TCP [1]
* Convert select() to poll(), fixes crashes (SIGSEV) on FreeBSD 12.2 [2]
PR: 258848 [1], 259822 [2]
Sponsored by: Netzkommune GmbH
mail/exim: unbreak after mail/opendmarc update (+)
Last update for mail/opendmarc to 1.4.2 changes required params for
opendmarc_policy_store_dkim subroutine by introducing *dkim_selector
as pair for *domain.
Adjust exim' dmarc routines by pass NULL string as *dkim_selector to
force opendmarc subroutine go thru autodetect required selector on the fly.
This dirt'n'ugly hack will be dropped as soon as functionality will be
adjusted upstream in proper way.
Bump PORTREVISION to force rebuild.
Reported by: ler, poudriere failure
PR: 260678
mail/exim: update to 4.94.2 security release
* New upstream security release.
+ Release based on +fixes branch.
+ Fixes multiple security vulnerabilities reported by Qualys and adds
related robustness improvements. (Special thanks to Heiko)
CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
CVE-2020-28007: Link attack in Exim's log directory
CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
CVE-2020-28012: Missing close-on-exec flag for privileged pipe
CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
CVE-2020-28009: Integer overflow in get_stdinput()
CVE-2020-28015, CVE-28021: New-line injection into spool header file
CVE-2020-28026: Line truncation and injection in spool_read_header()
CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
CVE-2020-28017: Integer overflow in receive_add_recipient()
CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
CVE-2020-28011: Heap buffer overflow in queue_run()
CVE-2020-28010: Heap out-of-bounds write in main()
CVE-2020-28018: Use-after-free in tls-openssl.c
CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
CVE-2020-28014, CVE-2021-27216: PID file handling
CVE-2020-28008: Assorted attacks in Exim's spool directory
CVE-2020-28019: Failure to reset function pointer after BDAT error
* Incorporate debian patches to turn taint failures into warnings.