From: Clinton Ebadi Date: Mon, 30 Jan 2017 22:14:09 +0000 (-0500) Subject: Import Upstream version 4.84.2 X-Git-Tag: upstream/4.84.2^0 X-Git-Url: https://git.hcoop.net/hcoop/debian/exim4.git/commitdiff_plain/188b6fee0dfdf699a1a302e16b70d17b4f325bcd Import Upstream version 4.84.2 --- diff --git a/OS/Makefile-Base b/OS/Makefile-Base index 87a8037..ac832bc 100644 --- a/OS/Makefile-Base +++ b/OS/Makefile-Base @@ -313,6 +313,7 @@ OBJ_EXIM = acl.o child.o crypt16.o daemon.o dbfn.o debug.o deliver.o \ rda.o readconf.o receive.o retry.o rewrite.o rfc2047.o \ route.o search.o sieve.o smtp_in.o smtp_out.o spool_in.o spool_out.o \ std-crypto.o store.o string.o tls.o tod.o transport.o tree.o verify.o \ + environment.o \ $(OBJ_LOOKUPS) \ local_scan.o $(EXIM_PERL) $(OBJ_WITH_CONTENT_SCAN) \ $(OBJ_WITH_OLD_DEMIME) $(OBJ_EXPERIMENTAL) @@ -549,6 +550,7 @@ dns.o: $(HDRS) dns.c enq.o: $(HDRS) enq.c exim.o: $(HDRS) exim.c expand.o: $(HDRS) expand.c +environment.o: $(HDRS) environment.c filter.o: $(HDRS) filter.c filtertest.o: $(HDRS) filtertest.c globals.o: $(HDRS) globals.c diff --git a/doc/ChangeLog b/doc/ChangeLog index bea6b1a..3c8f592 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,6 +1,16 @@ Change log file for Exim from version 4.21 ------------------------------------------- +Exim version 4.84.2 +------------------- +Portability release + + +Exim version 4.84.1 +------------------- +HS/04 Add support for keep_environment and add_environment options. + Fix for CVE-2016-1531 + Exim version 4.84 ----------------- diff --git a/doc/exim.8 b/doc/exim.8 index 0fccbc7..09dad3c 100644 --- a/doc/exim.8 +++ b/doc/exim.8 @@ -453,6 +453,10 @@ using one of the words \fBrouter_list\fP, \fBtransport_list\fP, or settings can be obtained by using \fBrouters\fP, \fBtransports\fP, or \fBauthenticators\fP. .sp +If \fBenvironment\fP is given as an argument, the set of environment +variables is output, line by line. Using the \fB\-n\fP flag supresses the value of the +variables. +.sp If invoked by an admin user, then \fBmacro\fP, \fBmacro_list\fP and \fBmacros\fP are available, similarly to the drivers. Because macros are sometimes used for storing passwords, this option is restricted. @@ -724,6 +728,8 @@ name, but it can be a colon\-separated list of names. In this case, the first file that exists is used. Failure to open an existing file stops Exim from proceeding any further along the list, and an error is generated. .sp +The file names need to be absolute names. +.sp When this option is used by a caller other than root, and the list is different from the compiled\-in list, Exim gives up its root privilege immediately, and runs with the real and effective uid and gid set to those of the caller. diff --git a/doc/filter.txt b/doc/filter.txt index 6d8544e..89d2d65 100644 --- a/doc/filter.txt +++ b/doc/filter.txt @@ -4,10 +4,8 @@ Philip Hazel Copyright (c) 2014 University of Cambridge -+-----------------------------------------------------------------------------+ -+-------------------------------------+--------------------------------+------+ -|Revision 4.84 |11 Aug 2014 |PH | -+-------------------------------------+--------------------------------+------+ +Revision 4.84.2 02 Mar 2016 PH + ------------------------------------------------------------------------------- TABLE OF CONTENTS @@ -79,7 +77,7 @@ TABLE OF CONTENTS This document describes the user interfaces to Exim's in-built mail filtering facilities, and is copyright (c) University of Cambridge 2014. It corresponds -to Exim version 4.84. +to Exim version 4.84.2. 1.1 Introduction diff --git a/doc/spec.txt b/doc/spec.txt index e400286..9f8e1ac 100644 --- a/doc/spec.txt +++ b/doc/spec.txt @@ -4,10 +4,8 @@ Exim Maintainers Copyright (c) 2014 University of Cambridge -+-----------------------------------------------------------------------------+ -+-------------------------------------+--------------------------------+------+ -|Revision 4.84 |11 Aug 2014 |EM | -+-------------------------------------+--------------------------------+------+ +Revision 4.84.2 02 Mar 2016 EM + ------------------------------------------------------------------------------- TABLE OF CONTENTS @@ -657,7 +655,7 @@ ACKNOWLEDGMENTS, in which I have started recording the names of contributors. 1.1 Exim documentation ---------------------- -This edition of the Exim specification applies to version 4.84 of Exim. +This edition of the Exim specification applies to version 4.84.2 of Exim. Substantive changes from the 4.83 edition are marked in some renditions of the document; this paragraph is so marked if the rendition is capable of showing a change indicator. @@ -1766,7 +1764,7 @@ only a short time (see timeout_frozen_after and ignore_bounce_errors_after). Exim is distributed as a gzipped or bzipped tar file which, when unpacked, creates a directory with the name of the current release (for example, -exim-4.84) into which the following files are placed: +exim-4.84.2) into which the following files are placed: ACKNOWLEDGMENTS contains some acknowledgments CHANGES contains a reference to where changes are documented @@ -2376,7 +2374,7 @@ when you have set INFO_DIRECTORY, as described in section 4.17 below. For the utility programs, old versions are renamed by adding the suffix .O to their names. The Exim binary itself, however, is handled differently. It is installed under a name that includes the version number and the compile number, -for example exim-4.84-1. The script then arranges for a symbolic link called +for example exim-4.84.2-1. The script then arranges for a symbolic link called exim to point to the binary. If you are updating a previous version of Exim, the script takes care to ensure that the name exim is never absent from the directory (as seen by other processes). @@ -3071,6 +3069,10 @@ brief message about itself and exits. authenticator_list, and a complete list of all drivers with their option settings can be obtained by using routers, transports, or authenticators. + If environment is given as an argument, the set of environment variables is + output, line by line. Using the -n flag supresses the value of the + variables. + If invoked by an admin user, then macro, macro_list and macros are available, similarly to the drivers. Because macros are sometimes used for storing passwords, this option is restricted. The output format is one item @@ -3359,6 +3361,8 @@ brief message about itself and exits. first file that exists is used. Failure to open an existing file stops Exim from proceeding any further along the list, and an error is generated. + The file names need to be absolute names. + When this option is used by a caller other than root, and the list is different from the compiled-in list, Exim gives up its root privilege immediately, and runs with the real and effective uid and gid set to those @@ -12454,6 +12458,14 @@ received. See chapter 42 for further details. This option defines the ACL that is run when an SMTP VRFY command is received. See chapter 42 for further details. ++---------------+---------+-----------------+--------------+ +|add_environment|Use: main|Type: string list|Default: empty| ++---------------+---------+-----------------+--------------+ + +This option allows to set individual environment variables that the currently +linked libraries and programs in child processes use. The default list is +empty, + +------------+---------+------------------+--------------+ |admin_groups|Use: main|Type: string list*|Default: unset| +------------+---------+------------------+--------------+ @@ -13484,6 +13496,29 @@ ignore_fromline_local must be set to achieve this effect. See ignore_fromline_hosts above. ++----------------+---------+-----------------+--------------+ +|keep_environment|Use: main|Type: string list|Default: unset| ++----------------+---------+-----------------+--------------+ + +This option contains a string list of environment variables to keep. You have +to trust these variables or you have to be sure that these variables do not +impose any security risk. Keep in mind that during the startup phase Exim is +running with an effective UID 0 in most installations. As the default value is +an empty list, the default environment for using libraries, running embedded +Perl code, or running external binaries is empty, and does not not even contain +PATH or HOME. + +Actually the list is interpreted as a list of patterns (10.1), except that it +is not expanded first. + +WARNING: Macro substitution is still done first, so having a macro FOO and +having FOO_HOME in your keep_environment option may have unexpected results. +You may work around this using a regular expression that does not match the +macro name: ^[F]OO_HOME$. + +Current versions of Exim issue a warning during startupif you do not mention +keep_environment or add_environment in your runtime configuration file. + +--------------+---------+----------+-----------+ |keep_malformed|Use: main|Type: time|Default: 4d| +--------------+---------+----------+-----------+ @@ -14508,6 +14543,14 @@ qualifies them only if the message came from a host that matches sender_unqualified_hosts, or if the message was submitted locally (not using TCP/IP), and the -bnq option was not set. ++---------------+---------+-----------------+--------------+ +|set_environment|Use: main|Type: string list|Default: empty| ++---------------+---------+-----------------+--------------+ + +This option allows to set individual environment variables that the currently +linked libraries and programs in child processes use. The default list is +empty, + +---------------------+---------+-------------+-------------+ |smtp_accept_keepalive|Use: main|Type: boolean|Default: true| +---------------------+---------+-------------+-------------+ diff --git a/scripts/MakeLinks b/scripts/MakeLinks index 01cd21f..39a0fe1 100755 --- a/scripts/MakeLinks +++ b/scripts/MakeLinks @@ -198,6 +198,7 @@ ln -s ../src/dns.c dns.c ln -s ../src/drtables.c drtables.c ln -s ../src/dummies.c dummies.c ln -s ../src/enq.c enq.c +ln -s ../src/environment.c environment.c ln -s ../src/exim.c exim.c ln -s ../src/exim_dbmbuild.c exim_dbmbuild.c ln -s ../src/exim_dbutil.c exim_dbutil.c diff --git a/src/cnumber.h b/src/cnumber.h deleted file mode 100644 index d00491f..0000000 --- a/src/cnumber.h +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/src/environment.c b/src/environment.c new file mode 100644 index 0000000..3af82a6 --- /dev/null +++ b/src/environment.c @@ -0,0 +1,71 @@ +/************************************************* +* Exim - an Internet mail transport agent * +*************************************************/ + +/* Copyright (c) Heiko Schlittermann 2016 + * hs@schlittermann.de + * See the file NOTICE for conditions of use and distribution. + */ + +#include "exim.h" + +extern char **environ; + +/* The cleanup_environment() function is used during the startup phase +of the Exim process, right after reading the configurations main +part, before any expansions take place. It retains the environment +variables we trust (via the keep_environment option) and allows to +set additional variables (via add_environment). + +Returns: TRUE if successful + FALSE otherwise +*/ + +BOOL +cleanup_environment() +{ +if (!keep_environment || *keep_environment == '\0') + { + /* From: https://github.com/dovecot/core/blob/master/src/lib/env-util.c#L55 + Try to clear the environment. + a) environ = NULL crashes on OS X. + b) *environ = NULL doesn't work on FreeBSD 7.0. + c) environ = emptyenv doesn't work on Haiku OS + d) environ = calloc() should work everywhere */ + + if (environ) *environ = NULL; + + } +else if (Ustrcmp(keep_environment, "*") != 0) + { + uschar **p; + if (environ) for (p = USS environ; *p; /* see below */) + { + /* It's considered broken if we do not find the '=', according to + Florian Weimer. For now we ignore such strings. unsetenv() would complain, + getenv() would complain. */ + uschar *eqp = Ustrchr(*p, '='); + + if (eqp) + { + uschar *name = string_copyn(*p, eqp - *p); + if (OK != match_isinlist(name, USS &keep_environment, + 0, NULL, NULL, MCL_NOEXPAND, FALSE, NULL)) + if (unsetenv(CS name) < 0) return FALSE; + else p = USS environ; /* RESTART from the beginning */ + else p++; + store_reset(name); + } + } + } +if (add_environment) + { + uschar *p; + int sep = 0; + uschar* envlist = add_environment; + while ((p = string_nextinlist(&envlist, &sep, NULL, 0))) + putenv(CS p); + } + + return TRUE; +} diff --git a/src/exim.c b/src/exim.c index 517b543..3dc5214 100644 --- a/src/exim.c +++ b/src/exim.c @@ -3685,8 +3685,19 @@ init_lookup_list(); is a failure. It leaves the configuration file open so that the subsequent configuration data for delivery can be read if needed. */ +/* To be safe: change the working directory to /. */ +if (Uchdir("/") < 0) + { + perror("exim: chdir `/': "); + exit(EXIT_FAILURE); + } + readconf_main(); +if (cleanup_environment() == FALSE) + log_write(0, LOG_PANIC_DIE, "Can't cleanup environment"); + + /* If an action on specific messages is requested, or if a daemon or queue runner is being started, we need to know if Exim was called by an admin user. This is the case if the real user is root or exim, or if the real group is @@ -3832,7 +3843,7 @@ TMPDIR macro, if this macro is defined. */ #ifdef TMPDIR { uschar **p; - for (p = USS environ; *p != NULL; p++) + if (environ) for (p = USS environ; *p != NULL; p++) { if (Ustrncmp(*p, "TMPDIR=", 7) == 0 && Ustrcmp(*p+7, TMPDIR) != 0) @@ -3872,10 +3883,10 @@ else uschar **new; uschar **newp; int count = 0; - while (*p++ != NULL) count++; + if (environ) while (*p++ != NULL) count++; if (envtz == NULL) count++; newp = new = malloc(sizeof(uschar *) * (count + 1)); - for (p = USS environ; *p != NULL; p++) + if (environ) for (p = USS environ; *p != NULL; p++) { if (Ustrncmp(*p, "TZ=", 3) == 0) continue; *newp++ = *p; @@ -4465,7 +4476,8 @@ if (list_options) (Ustrcmp(argv[i], "router") == 0 || Ustrcmp(argv[i], "transport") == 0 || Ustrcmp(argv[i], "authenticator") == 0 || - Ustrcmp(argv[i], "macro") == 0)) + Ustrcmp(argv[i], "macro") == 0 || + Ustrcmp(argv[i], "environment") == 0)) { readconf_print(argv[i+1], argv[i], flag_n); i++; diff --git a/src/functions.h b/src/functions.h index a6257a9..67a3916 100644 --- a/src/functions.h +++ b/src/functions.h @@ -97,6 +97,7 @@ extern int check_host(void *, uschar *, uschar **, uschar **); extern uschar **child_exec_exim(int, BOOL, int *, BOOL, int, ...); extern pid_t child_open_uid(uschar **, uschar **, int, uid_t *, gid_t *, int *, int *, uschar *, BOOL); +extern BOOL cleanup_environment(void); extern uschar *cutthrough_finaldot(void); extern BOOL cutthrough_flush_send(void); extern BOOL cutthrough_headers_send(void); @@ -374,6 +375,7 @@ extern uschar *string_append(uschar *, int *, int *, int, ...); extern uschar *string_append_listele(uschar *, uschar, const uschar *); extern uschar *string_base62(unsigned long int); extern uschar *string_cat(uschar *, int *, int *, const uschar *, int); +extern int string_compare_by_pointer(const void *, const void *); extern uschar *string_copy_dnsdomain(uschar *); extern uschar *string_copy_malloc(uschar *); extern uschar *string_copylc(uschar *); diff --git a/src/globals.c b/src/globals.c index d3f9987..08e6e8d 100644 --- a/src/globals.c +++ b/src/globals.c @@ -309,6 +309,7 @@ BOOL active_local_from_check = FALSE; BOOL active_local_sender_retain = FALSE; int body_8bitmime = 0; BOOL accept_8bitmime = TRUE; /* deliberately not RFC compliant */ +uschar *add_environment = NULL; address_item *addr_duplicate = NULL; address_item address_defaults = { @@ -761,6 +762,8 @@ uschar *iterate_item = NULL; int journal_fd = -1; +uschar *keep_environment = NULL; + int keep_malformed = 4*24*60*60; /* 4 days */ uschar *eldap_dn = NULL; diff --git a/src/globals.h b/src/globals.h index 2bedcf5..b3ad4b2 100644 --- a/src/globals.h +++ b/src/globals.h @@ -153,6 +153,7 @@ extern uschar **address_expansions[ADDRESS_EXPANSIONS_COUNT]; /* General global variables */ extern BOOL accept_8bitmime; /* Allow *BITMIME incoming */ +extern uschar *add_environment; /* List of environment variables to add */ extern int body_8bitmime; /* sender declared BODY= ; 7=7BIT, 8=8BITMIME */ extern header_line *acl_added_headers; /* Headers added by an ACL */ extern tree_node *acl_anchor; /* Tree of named ACLs */ @@ -487,6 +488,7 @@ extern uschar *iterate_item; /* Item from iterate list */ extern int journal_fd; /* Fd for journal file */ +extern uschar *keep_environment; /* Whitelist for environment variables */ extern int keep_malformed; /* Time to keep malformed messages */ extern uschar *eldap_dn; /* Where LDAP DNs are left */ diff --git a/src/mytypes.h b/src/mytypes.h index 964abf8..b9aef70 100644 --- a/src/mytypes.h +++ b/src/mytypes.h @@ -66,6 +66,7 @@ almost always literal strings. */ #define US (unsigned char *) #define CUS (const unsigned char *) #define USS (unsigned char **) +#define CUSS (const unsigned char **) /* The C library string functions expect "char *" arguments. Use macros to avoid having to write a cast each time. We do this for string and file diff --git a/src/readconf.c b/src/readconf.c index adb538c..6e33034 100644 --- a/src/readconf.c +++ b/src/readconf.c @@ -11,6 +11,9 @@ implementation of the conditional .ifdef etc. */ #include "exim.h" +extern char **environ; + + #define CSTATE_STACK_SIZE 10 @@ -162,6 +165,7 @@ static optionlist optionlist_config[] = { { "acl_smtp_starttls", opt_stringptr, &acl_smtp_starttls }, #endif { "acl_smtp_vrfy", opt_stringptr, &acl_smtp_vrfy }, + { "add_environment", opt_stringptr, &add_environment }, { "admin_groups", opt_gidlist, &admin_groups }, { "allow_domain_literals", opt_bool, &allow_domain_literals }, { "allow_mx_to_ip", opt_bool, &allow_mx_to_ip }, @@ -274,6 +278,7 @@ static optionlist optionlist_config[] = { { "ignore_bounce_errors_after", opt_time, &ignore_bounce_errors_after }, { "ignore_fromline_hosts", opt_stringptr, &ignore_fromline_hosts }, { "ignore_fromline_local", opt_bool, &ignore_fromline_local }, + { "keep_environment", opt_stringptr, &keep_environment }, { "keep_malformed", opt_time, &keep_malformed }, #ifdef LOOKUP_LDAP { "ldap_ca_cert_dir", opt_stringptr, &eldap_ca_cert_dir }, @@ -2486,6 +2491,7 @@ second argument is NULL. There are some special values: macro_list print a list of macro names +name print a named list item local_scan print the local_scan options + environment print the used execution environment If the second argument is not NULL, it must be one of "router", "transport", "authenticator" or "macro" in which case the first argument identifies the @@ -2627,6 +2633,25 @@ if (type == NULL) names_only = TRUE; } + else if (Ustrcmp(name, "environment") == 0) + { + if (environ) + { + uschar **p; + size_t n; + for (p = USS environ; *p; p++) ; + n = p - USS environ; + qsort(environ, p - USS environ, sizeof(*p), string_compare_by_pointer); + + for (p = USS environ; *p; p++) + { + if (no_labels) *(Ustrchr(*p, '=')) = '\0'; + puts(*p); + } + } + return; + } + else { print_ol(find_option(name, optionlist_config, optionlist_config_size), @@ -2940,6 +2965,15 @@ uschar *list = config_main_filelist; while((filename = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)) != NULL) { + + /* To avoid confusion: Exim changes to / at the very beginning and + * and to $spool_directory later. */ + if (filename[0] != '/') + { + fprintf(stderr, "-C %s: only absolute names are allowed\n", filename); + exit(EXIT_FAILURE); + } + /* Cut out all the fancy processing unless specifically wanted */ #if defined(CONFIGURE_FILE_USE_NODE) || defined(CONFIGURE_FILE_USE_EUID) @@ -3380,6 +3414,11 @@ if (gnutls_require_kx || gnutls_require_mac || gnutls_require_proto) " gnutls_require_kx, gnutls_require_mac and gnutls_require_protocols" " are obsolete\n"); #endif /*SUPPORT_TLS*/ + +if ((!add_environment || *add_environment == '\0') && !keep_environment) + log_write(0, LOG_MAIN, + "WARNING: purging the environment.\n" + " Suggested action: use keep_environment and add_environment.\n"); } diff --git a/src/string.c b/src/string.c index 0f657dc..38e498a 100644 --- a/src/string.c +++ b/src/string.c @@ -1635,6 +1635,17 @@ return yield; #endif /* COMPILE_UTILITY */ +#ifndef COMPILE_UTILITY +/* qsort(3), currently used to sort the environment variables +for -bP environment output, needs a function to compare two pointers to string +pointers. Here it is. */ + +int +string_compare_by_pointer(const void *a, const void *b) +{ +return Ustrcmp(* CUSS a, * CUSS b); +} +#endif /* COMPILE_UTILITY */ diff --git a/src/tls-openssl.c b/src/tls-openssl.c index 18994ea..02158be 100644 --- a/src/tls-openssl.c +++ b/src/tls-openssl.c @@ -623,7 +623,7 @@ bad: { extern char ** environ; uschar ** p; - for (p = USS environ; *p != NULL; p++) + if (environ) for (p = USS environ; *p != NULL; p++) if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0) { DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n"); diff --git a/src/version.sh b/src/version.sh index dbf18d7..1de6875 100644 --- a/src/version.sh +++ b/src/version.sh @@ -1,4 +1,4 @@ -# automatically generated file - see ../scripts/reversion -EXIM_RELEASE_VERSION="4.84" -EXIM_VARIANT_VERSION="" -EXIM_COMPILE_NUMBER="1" +# initial version automatically generated from release-process/scripts/mk_exim_release.pl +EXIM_RELEASE_VERSION=4.84 +EXIM_VARIANT_VERSION=_2 +EXIM_COMPILE_NUMBER=0