The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkeys file (related to t-testdata…
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results …
VuXML only (0)
Listed in VuXML, the packaged version 2.10.3_24 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (1)
Show 1 fixed
VuXML entries whose affected range the packaged version has left.
needs-patchneeds-qamaintainer-feedback?merge-quarterly? mail/opendkim: 2.10.3_16 fails to start without PidFile specified in opendkim.conf or UserId specified with [:group]
Open
2023-05-29
Commits (97)
Baptiste Daroussin (bapt) · 2.10.3_24
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D60741
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI
LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.
Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.
This commit introduces databases/lmdb0 as a holding port for the 0.9.35
release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually
conflicting with databases/lmdb, which retains 1.0. The two packages
cannot be installed simultaneously, but having lmdb0 available means:
* Ports known to require the 0.9 ABI can declare an explicit dependency
on databases/lmdb0 until they are validated against 1.0.
* Users with existing databases in the 0.9 format can still access the
mdb_dump and mdb_load utilities to migrate data before upgrading.
* The package conflict prevents accidental mixing.
All 50 direct dependents of databases/lmdb are redirected to
databases/lmdb0 for now with a PORTREVISION bump, effectively restoring
the tree to the state prior to the LMDB 1.0 update. Once all dependent
ports are validated against LMDB 1.0, they will be moved back to
databases/lmdb and databases/lmdb0 will be removed.
PR: ports/296530
mail/opendkim: fix strlcpy misuse with overlapping buffers
strlcpy() is undefined when source and destination overlap. Replace
with manual copy in the SubDomains domain extraction where
dfc->mctx_domain and the source pointer p can overlap.
PR: 283487
Approved by: freebsd-ports@dan.me.uk (maintainer timeout)
security/libsodium: Update to 1.0.21
The API remains compatible but bumping all dependent ports as SHLIB
has changed.
Changelog: https://github.com/jedisct1/libsodium/releases/tag/1.0.21-RELEASE
Security: https://00f.net/2025/12/30/libsodium-vulnerability/
PR: 279347
mail/opendkim-devel: Add new port
* Add mail/opendkim-devel, development snapshot of OpenDKIM.
* Mark mail/opendkim and mail/opendkim-devel as CONFLICTS_INSTALL with
each other
cleanup: remove occurrences of WITH_DEBUG
DEBUG like all ports features, must not ever be set in a port, they are
user facing features, that the user needs to enable in their
environment/make.conf, either by defining WITH_DEBUG globally, or by
setting WITH_DEBUG_PORTS with origin of ports they want DEBUG enabled
in.
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
cleanup: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* Alex Trull <freebsd.alex@trull.org>
* Alonso Cardenas <acm@FreeBSD.org>
* Boris Samorodov <bsam@FreeBSD.org>
* David Shane Holden <dpejesh@yahoo.com>
* Felix Palmen <felix@palmen-it.de>
* Hirohisa Yamaguchi <umq@ueo.co.jp>
* Kevin Bowling <kbowling@FreeBSD.org>
* Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
* Markus Mann, CTS - FreeBSD Team <de-freebsd@ctseuro.com>
* Matthias Andree
* Matthias Fechner <mfechner@FreeBSD.org>
* Oleg Sidorkin <osidorkin@gmail.com>
* Oliver Lehmann
* Radim Kolar <hsn@sendmail.cz>
* Timothy Beyer <beyert@cs.ucr.edu>
* hq@FreeBSD.org
* johalun0@gmail.com
* lev@FreeBSD.org
* rooneg@electricjellyfish.net
With hat: portmgr
mail/opendkim: Respect PidFile setting in opendkim.conf
While here, pet rclint a bit, though it doesn't like the profile parts
not being in functions
PR: ports/254762
Reported by: Rob LA LAU <freebsd@ohreally.nl>
Reviewed by: skozlov (a previous iteration)
Approved by: maintainer timeout, 9 months
Differential Revision: https://reviews.freebsd.org/D29586
mail/opendkim: Fix errors when no value is set for socket in RC script
Fix errors
PR: ports/222122
Submitted by: Matthias Pfaller <matthias.pfaller@familie-pfaller.de>
(Fix)
While here, various style fixes; no need for the "x$var" != "x" idiom
as that is confusing to follow.
Approved by: maintainer timeout (3 years)
The pkg-plist fix for OPENDBX option in r541860 was incomplete: it didn't take into account STATS option. Use the patch submitted by fjoe@ instead.
PR: 211723
mail/opendkim: mark broken with Lua 5.3 and higher
PR: 232953
Reported by: pr@aoek.com
Approved by: Daniel Austin <freebsd-ports@dan.me.uk> (maintainer)
dns/unbound: update to 1.8.0
Bump PORTREVISION on consumers due to library major version change
PR: 231283
Submitted by: jaap@NLnetLabs.nl (maintainer)
- bump MILTER_SOVER to fix linking on FREEBSD-12 - bump PORTREVISION on ports using libmilter - rename WITH_SENDMAIL_PORT to WITH_MILTER_PORT - rename WITH_SENDMAIL_BASE to WITH_MILTER_BASE - rename WITH_SENDMAIL_STATIC_MILTER to WITH_MILTER_STATIC - cleanup ifdefs - fix build on batv-filter with libmilter from ports
mail/opendkim: Add GID support to the rc script
PR: 208056
Submitted by: Krzysztof <ports@bsdserwis.com>
Approved by: Daniel Austin <freebsd-ports@dan.me.uk> (maintainer)
- Update security/gnutls to 3.4.10. - Rename the LIBDANE option DANE because that's the name of the protocol supported by libgnutls-dane and gnutls-cli. Also clarify the option description. - Add an IDN option. - libgnutls-openssl has been removed in 3.4. Some ports used this library in their LIB_DEPENDS but no port actually required it. - Some old API functions have been removed. Ports t
net-im/jabber: This port used the old API to give users fine grained
control over which crypto algorithms were used via a configuration file.
It's not immediately obvious how to port this to the new API so the port
always uses the defaults now.
www/hydra: Mark BROKEN. This uses more removed calls than the other ports,
is said to be alpha quality and not fully functional and has been abandoned
10 years ago.
PR: 207768
Exp-run by: antoine
Approved by: portmgr (antoine)
- Update unbound to 1.5.7 - Bump PORTREVISIOn on dependent ports
Some Upgrade Notes:
This release fixes a validation failure for nodata with wildcards and
emptynonterminals. Fixes OpenSSL Library compability. Fixes correct
response for malformed EDNS queries. For crypto in libunbound there is
libnettle support.
Qname minimisation is implemented. Use qname-minimisation: yes to
enable it. This version sends the full query name when an error is
found for intermediate names. It should therefore not fail for names
on nonconformant servers. It combines well with
harden-below-nxdomain: yes because those nxdomains are probed by the
qname minimisation, and that will both stop privacy sensitive traffic
and reduce nonsense traffic to authority servers. So consider
enabling both. In this implementation IPv6 reverse lookups add
several labels per increment, because otherwise those lookups would be
very slow. [ Reference
https://tools.ietf.org/html/draft-ietf-dnsop-qname-minimisation-08 ]
More details at <http://unbound.net>
PR: 206347
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl>
Approved by: maintainer timeout
Sponsored by: DK Hostmaster A/S
* Add a fix for where libopendkim fails to cope with a header line which is wrapped immediately after the header name. This has been reported upstream:
http://sourceforge.net/p/opendkim/bugs/230/
* Update pkg-descr -- all of the ADSP stuff has gone from opendkim
now.
PR: 202668
Approved by: freebsd-ports@dan.me.uk (maintainer)
- Update mail/opendkim to 2.10.3 - Assign maintainership to submitter - Mark mail/p5-Mail-OpenDKIM as broken, and deprecate it, please use mail/p5-Mail-DKIM instead
While here:
- Sort USES
- Make IGNORE text start with lower case
- Regenerate some patches
PR: 200900
Submitted by: Daniel Austin <freebsd-ports at dan.me.uk>
Approved by: Maintainer timeout