aboutsummaryrefslogtreecommitdiff
path: root/mail
Commit message (Collapse)AuthorAge
* msmtp: update to version 1.8.25Josef Schlehofer2024-04-30
| | | | | | | Release notes: https://marlam.de/msmtp/news/msmtp-1-8-25/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* exim: update to 4.97.1Daniel Golle2024-04-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6 has accidentally been disabled in all Exim builds since the package was introduced in OpenWrt due to a faulty `sed` script. This has now been fixed, so beware that IPv6 is now enabled when updating from previous releases. Upstream changes since version 4.96.2 (bottom up): JH/s1 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in LF-only mode (as detected from the first header line). Previously we did accept that in (normal) CRLF mode; this has been raised as a possible attack scenario (under the name "smtp smuggling", CVE-2023-51766). JH/01 The hosts_connection_nolog main option now also controls "no MAIL in SMTP connection" log lines. JH/02 Option default value updates: - queue_fast_ramp (main) true (was false) - remote_max_parallel (main) 4 (was 2) JH/03 Cache static regex pattern compilations, for use by ACLs. JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address. Make the rewrite never match and keep the logging. Trust the admin to be using verify=header-syntax (to actually reject the message). JH/05 Follow symlinks for placing a watch on TLS creds files. This means (under Linux) we watch the dir containing the final file; previously it would be the dir with the first symlink. We still do not monitor the entire path. JH/06 Check for bad chars in rDNS for sender_host_name. The OpenBSD (at least) dn_expand() is happy to pass them through. JH/07 OpenSSL Fix auto-reload of changed server OCSP proof. Previously, if the file with the proof had an unchanged name, the new proof(s) were loaded on top of the old ones (and nover used; the old ones were stapled). JH/08 Bug 2915: Fix use-after-free for $regex<n> variables. Previously when more than one message arrived in a single connection a reference from the earlier message could be re-used. Often a sigsegv resulted. These variables were introduced in Exim 4.87. Debug help from Graeme Fowler. JH/09 Fix ${filter } for conditions that modify $value. Previously the modified version would be used in construction the result, and a memory error would occur. JH/10 GnuTLS: fix for (IOT?) clients offering no TLS extensions at all. Find and fix by Jasen Betts. JH/11 OpenSSL: fix for ancient clients needing TLS support for versions earlier than TLSv1,2, Previously, more-recent versions of OpenSSL were permitting the systemwide configuration to override the Exim config. HS/01 Bug 2728: Introduce EDITME option "DMARC_API" to work around incompatible API changes in libopendmarc. JH/12 Bug 2930: Fix daemon startup. When started from any process apart from pid 1, in the normal "background daemon" mode, having to drop process- group leadership also lost track of needing to create listener sockets. JH/13 Bug 2929: Fix using $recipients after ${run...}. A change made for 4.96 resulted in the variable appearing empty. Find and fix by Ruben Jenster. JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96 a capture group which obtained no text (eg. "(abc)*" matching zero occurrences) could cause a segfault if the corresponding $<n> was expanded. JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument included a close-brace character (eg. it itself used an expansion) an error occurred. JH/16 Move running the smtp connect ACL to before, for TLS-on-connect ports, starting TLS. Previously it was after, meaning that attackers on such ports had to be screened using the host_reject_connection main config option. The new sequence aligns better with the STARTTLS behaviour, and permits defences against crypto-processing load attacks, even though it is strictly an incompatible change. Also, avoid sending any SMTP fail response for either the connect ACL or host_reject_connection, for TLS-on-connect ports. JH/17 Permit the ACL "encrypted" condition to be used in a HELO/EHLO ACL, Previously this was not permitted, but it makes reasonable sense. While there, restore a restriction on using it from a connect ACL; given the change JH/16 it could only return false (and before 4.91 was not permitted). JH/18 Fix a fencepost error in logging. Previously (since 4.92) when a log line was exactly sized compared to the log buffer, a crash occurred with the misleading message "bad memory reference; pool not found". Found and traced by Jasen Betts. JH/19 Bug 2911: Fix a recursion in DNS lookups. Previously, if the main option dns_again_means_nonexist included an element causing a DNS lookup which itself returned DNS_AGAIN, unbounded recursion occurred. Possible results included (though probably not limited to) a process crash from stack memory limit, or from excessive open files. Replace this with a paniclog whine (as this is likely a configuration error), and returning DNS_NOMATCH. JH/20 Bug 2954: (OpenSSL) Fix setting of explicit EC curve/group. Previously this always failed, probably leading to the usual downgrade to in-clear connections. JH/21 Fix TLSA lookups. Previously dns_again_means_nonexist would affect SERVFAIL results, which breaks the downgrade resistance of DANE. Change to not checking that list for these lookups. JH/22 Bug 2434: Add connection-elapsed "D=" element to more connection closure log lines. JH/23 Fix crash in string expansions. Previously, if an empty variable was immediately followed by an expansion operator, a null-indirection read was done, killing the process. JH/24 Bug 2997: When built with EXPERIMENTAL_DSN_INFO, bounce messages can include an SMTP response string which is longer than that supported by the delivering transport. Alleviate by wrapping such lines before column 80. JH/25 Bug 2827: Restrict size of References: header in bounce messages to 998 chars (RFC limit). Previously a limit of 12 items was made, which with a not-impossible References: in the message being bounced could still be over-large and get stopped in the transport. JH/26 For a ${readsocket } in TLS mode, send a TLS Close Alert before the TCP close. Previously a bare socket close was done. JH/27 Fix ${srs_encode ..}. Previously it would give a bad result for one day every 1024 days. JH/28 Bug 2996: Fix a crash in the smtp transport. When finding that the message being considered for delivery was already being handled by another process, and having an SMTP connection already open, the function to close it tried to use an uninitialized variable. This would afftect high-volume sites more, especially when running mailing-list-style loads. Pollution of logs was the major effect, as the other process delivered the message. Found and partly investigated by Graeme Fowler. JH/29 Change format of the internal ID used for message identification. The old version only supported 31 bits for a PID element; the new 64 (on systems which can use Base-62 encoding, which is all currently supported ones but not Darwin (MacOS) or Cygwin, which have case-insensitive filesystems and must use Base-36). The new ID is 23 characters rather than 16, and is visible in various places - notably logs, message headers, and spool file names. Various of the ancillary utilities also have to know the format. As well as the expanded PID portion, the sub-second part of the time recorded in the ID is expanded to support finer precision. Theoretically this permits a receive rate from a single comms channel of better than the previous 2000/sec. The major timestamp part of the ID is not changed; at 6 characters it is usable until about year 3700. Updating from previously releases is fully supported: old-format spool files are still usable, and the utilities support both formats. New message will use the new format. The one hints-DB file type which uses message-IDs (the transport wait- DB) will be discarded if an old-format ID is seen; new ones will be built with only new-format IDs. Optionally, a utility can be used to convert spool files from old to new, but this is only an efficiency measure not a requirement for operation Downgrading from new to old requires running a provided utility, having first stopped all operations. This will convert any spool files from new back to old (losing time-precision and PID information) and remove any wait- hints databases. JH/30 Bug 3006: Fix handling of JSON strings having embedded commas. Previously we treated them as item separators when parsing for a list item, but they need to be protected by the doublequotes. While there, add handling for backslashes. JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints. Found and fixed by Jasen Betts. No testcase for this as my usual text editor insists on emitting only valid UTF-8. JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave a null-indirection SIGSEGV for the receive process. JH/33 Fix free for live variable $value created by a ${run ...} expansion during -bh use. Internal checking would spot this and take a panic. JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}. In 4.96 this would expand to empty. JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server certificate. Find and fix by Andreas Metzler. JH/36 Add ARC info to DMARC hostory records. JH/37 Bug 3016: Avoid sending DSN when message was accepted under fakereject or fakedefer. Previously the sender could discover that the message had in fact been accepted. JH/38 Taint-track intermediate values from the peer in multi-stage authentation sequences. Previously the input was not noted as being tainted; notably this resulted in behaviour of LOGIN vs. PLAIN being inconsistent under bad coding of authenticators. JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings and ${tr...}. Found and diagnosed by Heiko Schlichting. JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which CVE-2023-42115 JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42116 JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42114 JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address. Make the rewrite never match and keep the logging. Trust the admin to be using verify=header-syntax (to actually reject the message). JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses. CVE-2023-42219 could be triggered by externally-supplied input. Found by Trend Micro. CVE-2023-42115 JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42116 JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42114 JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address. Make the rewrite never match and keep the logging. Trust the admin to be using verify=header-syntax (to actually reject the message). Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* treewide: fix licence typosFabrice Fontaine2024-01-31
| | | | | | | | | | | | | - PKG_LICENCE -> PKG_LICENSE - PKC_LICENSE_FILES -> PKG_LICENSE_FILES - BSD 3-Clause -> BSD-3-Clause - BSD-3-clause -> BSD-3-Clause - BSD-2-clause -> BSD-2-Clause - Public Domain -> Public-Domain - PublicDomain -> Public-Domain - Drop unneeded ',' in PKG_LICENSE or PKG_LICENSE_FILES Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* dovecot: update to 2.3.21W. Michael Petullo2024-01-06
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* pigeonhole: update to 0.5.21W. Michael Petullo2024-01-02
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* postfix: Fix enabling PCRE supportFelix Matouschek2023-12-01
| | | | | | | | | | After the change from PCRE to PCRE2 when enabling POSTFIX_PCRE the resulting postfix build no longer reports pcre as an available module. (postfconf -m). This is caused by using the wrong syntax for the HAS_PCRE build flag (HAS_PCRE2 vs HAS_PCRE=2). This fixes the build flag to use the correct syntax. Signed-off-by: Felix Matouschek <felix@matouschek.org>
* fdm: update to 2.2 release and switch to PCRE2Christian Marangi2023-10-30
| | | | | | | | | | Update to release 2.2 and switch to PCRE2. New release switched from PCRE to PCRE2 and is now required. Drop patch merged upstream and backport 2 additional patch that fix a user-after-free and a PCRE2 bug. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* postfix: move to PCRE2 libraryChristian Marangi2023-10-29
| | | | | | | Move to PCRE2 library as PCRE is EOL and won't receive any security updates anymore. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* postfix: bump to 3.8.2 releaseChristian Marangi2023-10-29
| | | | | | | | | Bump postfix to 3.8.2 release. Refresh patches and drop patch 502-detect-glibc.patch as it got merged upstream. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* exim: update to version 4.96.2Daniel Golle2023-10-24
| | | | | | | | Fixes vulnerabilities: - Improper Neutralization of Special Elements (CVE-2023-42117) - dnsdb Out-Of-Bounds Read (CVE-2023-42119) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* exim: update to version 4.96.1Daniel Golle2023-10-08
| | | | | | | | | | | | | | | | | | This is a security release. JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which could be triggered by externally-supplied input. Found by Trend Micro. CVE-2023-42115 JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42116 JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could be triggered by externally-controlled input. Found by Trend Micro. CVE-2023-42114 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* exim: apply hotfix for some ZDI reported vulnerabilitiesDaniel Golle2023-10-01
| | | | | | | Apply preliminary hotfix for some (three?) of the 0-day vulnerabilities reported by ZDI. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* msmtp: update to version 1.8.24Josef Schlehofer2023-09-22
| | | | | | | Release notes: https://github.com/marlam/msmtp-mirror/commit/ef62463e4d0dc1f8e7f1db4f8dd35650999c13f9X Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* alpine: disable parallel buildEneas U de Queiroz2023-06-19
| | | | | | | | | | | | | | | | | Parallel build does not work because it may reach a point where OSTYPE might be needed before it is actually built. They appear to run parallel to each other: echo slx > OSTYPE [...] cat: OSTYPE: No such file or directory sh: line 1: test: too many arguments cat: OSTYPE: No such file or directory Already built for -- you must do "make clean" first make[6]: *** [Makefile:706: rebuild] Error 1 make[6]: *** Waiting for unfinished jobs.... Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* mblaze: fix compilation with musl 1.2.4Tianling Shen2023-05-17
| | | | | | | | | musl 1.2.4 deprecated legacy "LFS64" ("large file support") interfaces so just having _GNU_SOURCE defined is not enough anymore. Backport an upstream fix to replace these old data types. Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* pigeonhole: update to version 0.5.20Daniel Golle2023-05-13
| | | | | | | | v0.5.20 2022-12-12 Aki Tuomi <aki.tuomi@open-xchange.com> * No changes - release done to keep version numbers synced. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dovecot: update to version 2.3.20Daniel Golle2023-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | v2.3.20 2022-12-22 Aki Tuomi <aki.tuomi@open-xchange.com> + Add dsync_features=no-header-hashes. When this setting is enabled and one dsync side doesn't support mail GUIDs (i.e. imapc), there is no fallback to using header hashes. Instead, dsync assumes that all mails with identical IMAP UIDs contains the same mail contents. This can significantly improve dsync performance with some IMAP servers that don't support caching Date/Message-ID headers. + lua: HTTP client has more settings now, see https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client + replicator: "doveadm replicator status" command now outputs when the next sync is expected for the user. - LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list recovery was not optimal. - auth: Assert crash would occur when iterating multiple userdb backends. - director: Logging into director using master user with auth_master_user_separator character redirected user to a wrong backend, unless master_user_separator setting was also set to the same value. Merged these into auth_master_user_separator. - dsync: Couldn't always fix folder GUID conflicts automatically with Maildir format. This resulted in replication repeatedly failing with "Remote lost mailbox GUID". - dsync: Failed to migrate INBOX when using namespace prefix=INBOX/, resulting in "Remote lost mailbox GUID" errors. - dsync: INBOX was created too early with namespace prefix=INBOX/, resulting a GUID conflict. This may have been resolved automatically, but not always. - dsync: v2.3.18 regression: Wrong imapc password with dsync caused Panic: file lib-event.c: line 506 (event_pop_global): assertion failed: (event == current_global_event) - imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT configured did not return correct (private) unseen counts. - lib-dict: Process would crash when committing data to redis without dict proxy. - lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH. Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment): assertion failed: (data != NULL). v2.3.13 regression. - lib-storage: mail_attribute_dict with dict-sql failed when it tried to lookup empty dict keys. - lib: ioloop-kqueue was missing include breaking some BSD builds. - lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail processes, because it expected "dns-client" socket to exist in the current directory. - oauth2: Using %{oauth2:name} variables could cause useless introspections. - pop3: Sending POP3 command with ':' character caused an assert-crash. v2.3.18 regression. - replicator: Replication queue had various issues, potentially causing replication requests to become stuck. - stats: Invalid Prometheus label names were created with specific histogram group_by configurations. Prometheus rejected these labels. v2.3.19.1 2022-06-14 Aki Tuomi <aki.tuomi@open-xchange.com> - doveadm deduplicate: Non-duplicate mails were deleted. v2.3.19 regression. - auth: Crash would occur when iterating multiple backends. Fixes: Panic: file userdb-blocking.c: line 125 (userdb_blocking_iter_next): assertion failed: (ctx->conn != NULL) v2.3.19 2022-05-10 Aki Tuomi <aki.tuomi@open-xchange.com> + Added mail_user_session_finished event, which is emitted when the mail user session is finished (e.g. imap, pop3, lmtp). It also includes fields with some process statistics information. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + Added process_shutdown_filter setting. When an event matches the filter, the process will be shutdown after the current connection(s) have finished. This is intended to reduce memory usage of long-running imap processes that keep a lot of memory allocated instead of freeing it to the OS. + auth: Add cache hit indicator to auth passdb/userdb finished events. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + doveadm deduplicate: Performance is improved significantly. + imapc: COPY commands were sent one mail at a time to the remote IMAP server. Now the copying is buffered, so multiple mails can be copied with a single COPY command. + lib-lua: Add a Lua interface to Dovecot's HTTP client library. See https://doc.dovecot.org/admin_manual/lua/ for more information. - auth: Cache lookup would use incorrect cache key after username change. - auth: Improve handling unexpected LDAP connection errors/hangs. Try to fix up these cases by reconnecting to the LDAP server and aborting LDAP requests earlier. - auth: Process crashed if userdb iteration was attempted while auth-workers were already full handling auth requests. - auth: db-oauth2: Using %{oauth2:name} variables caused unnecessary introspection requests. - dict: Timeouts may have been leaked at deinit. - director: Ring may have become unstable if a backend's tag was changed. It could also have caused director process to crash. - doveadm kick: Numeric parameter was treated as IP address. - doveadm: Proxying can panic when flushing print output. Fixes Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop). - doveadm sync: BROKENCHAR was wrongly changed to '_' character when migrating mailboxes. This was set by default to %, so any mailbox names containing % characters were modified to "_25". - imapc: Copying or moving mails with doveadm to an imapc mailbox could have produced "Error: Syncing mailbox '[...]' failed" Errors. The operation itself succeeded but attempting to sync the destination mailbox failed. - imapc: Prevent index log synchronization errors when two or more imapc sessions are adding messages to the same mailbox index files, i.e. INDEX=MEMORY is not used. - indexer: Process was slowly leaking memory for each indexing request. - lib-fts: fts header filters caused binary content to be sent to the indexer with non-default configuration. - doveadm-server: Process could hang in some situations when printing output to TCP client, e.g. when printing doveadm sync state. - lib-index: dovecot.index.log files were often read and parsed entirely, rather than only the parts that were actually necessary. This mainly increased CPU usage. - lmtp-proxy: Session ID forwarding would cause same session IDs being used when delivering same mail to multiple backends. - log: Log prefix update may have been lost if log process was busy. This could have caused log prefixes to be empty or in some cases reused between sessions, i.e. log lines could have been logged for the wrong user/session. - mail_crypt: Plugin crashes if it's loaded only for some users. Fixes Panic: Module context mail_crypt_user_module missing. - mail_crypt: When LMTP was delivering mails to both recipients with mail encryption enabled and not enabled, the non-encrypted recipients may have gotten mails encrypted anyway. This happened when the first recipient was encrypted (mail_crypt_save_version=2) and the 2nd recipient was not encrypted (mail_crypt_save_version=0). - pop3: Session would crash if empty line was sent. - stats: HTTP server leaked memory. - submission-login: Long credentials, such as OAUTH2 tokens, were refused during SASL interactive due to submission server applying line length limits. - submission-login: When proxying to remote host, authentication was not using interactive SASL when logging in using long credentials such as OAUTH2 tokens. This caused authentication to fail due to line length constraints in SMTP protocol. - submission: Terminating the client connection with QUIT command after mail transaction is started with MAIL command and before it is finished with DATA/BDAT can cause a segfault crash. - virtual: doveadm search queries with mailbox-guid as the only parameter crashes: Panic: file virtual-search.c: line 77 (virtual_search_get_records): assertion failed: (result != 0) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dovecot: Fix iconv macro is missing compile errorJuan del Bosque2023-05-10
| | | | | | | | | Fix a Dovecot compile error when building with no other packages than the default in master build, because iconv macro is missing. Fixes: #20677 Signed-off-by: Juan del Bosque <juan@web64.pro>
* treewide: remove AUTORELEASEPaul Fertser2023-04-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Automatically compute and substitute current values for all $(AUTORELEASE) instances as this feature is deprecated and shouldn't be used. The following temporary change was made to the core: diff --git a/rules.mk b/rules.mk index 57d7995d4fa8..f16367de87a8 100644 --- a/rules.mk +++ b/rules.mk @@ -429,7 +429,7 @@ endef abi_version_str = $(subst -,,$(subst _,,$(subst .,,$(1)))) COMMITCOUNT = $(if $(DUMP),0,$(call commitcount)) -AUTORELEASE = $(if $(DUMP),0,$(call commitcount,1)) +AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) all: FORCE: ; And this command used to fix affected packages: for i in $(cd feeds/packages; git grep -l PKG_RELEASE:=.*AUTORELEASE | \ sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/download done Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* treewide: refactor to use PKG_BUILD_FLAGS:=ltoAndre Heider2023-04-08
| | | | | | | | | | See commit 07730ff3 "treewide: add support for "lto" in PKG_BUILD_FLAGS" on the main repository. Note: Some packages only added `-flto` to CFLAGS and not LDFLAGS. This fixes it and properly enables LTO. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: refactor to use PKG_BUILD_FLAGS:=gc-sectionsAndre Heider2023-04-08
| | | | | | | | | | | | See commit da370098 "treewide: add support for "gc-sections" in PKG_BUILD_FLAGS" on the main repository. Note: This only touches packages which use all three parts (-ffunction-sections, -fdata-sections and -Wl,--gc-sections) enabled by this build flag. Some packages only use a subset, and these are left unchanged for now. Signed-off-by: Andre Heider <a.heider@gmail.com>
* alpine: fix old URLRosen Penev2023-01-14
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* opendkim: use pkgconfig for libbsdRosen Penev2023-01-13
| | | | | | Allows using the overlay. Also remove the outdated uClibc patch. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* pigeonhole: update to 0.5.19W. Michael Petullo2022-12-22
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* emailrelay: update to v2.4.1Sergey Ponomarev2022-12-20
| | | | | | | The patch seems not needed anymore. Also remove deprecated PKG_RELEASE:=$(AUTORELEASE) Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
* postfix: Fix compile against glibc 2.36Hauke Mehrtens2022-12-19
| | | | | | | | This backports a change from postfix 3.8, I do not know exactly why it detects Linux 6 here, but this is needed to fix compilation with glibc 2.36. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* exim: update to version 4.96Daniel Golle2022-09-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Exim version 4.96 ----------------- JH/01 Move the wait-for-next-tick (needed for unique message IDs) from after reception to before a subsequent reception. This should mean slightly faster delivery, and also confirmation of reception to senders. JH/02 Move from using the pcre library to pcre2. The former is no longer being developed or supported (by the original developer). JH/03 Constification work in the filters module required a major version bump for the local-scan API. Specifically, the "headers_charset" global which is visible via the API is now const and may therefore not be modified by local-scan code. JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for sendfile() didi not account for the way the ClamAV driver code called it. JH/05 Bug 2819: speed up command-line messages being read in. Previously a time check was being done for every character; replace that with one per buffer. JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string sent was prefixed with a length byte. JH/07 Change the SMTP feature name for pipelining connect to be compliant with RFC 5321. Previously Dovecot (at least) would log errors during submission. JH/08 Remove stripping of the binaries from the FreeBSD build. This was added in 4.61 without a reason logged. Binaries will be bigger, which might matter on diskspace-constrained systems, but debug is easier. JH/09 Fix macro-definition during "-be" expansion testing. The move to write-protected store for macros had not accounted for these runtime additions; fix by removing this protection for "-be" mode. JH/10 Convert all uses of select() to poll(). FreeBSD 12.2 was found to be handing out large-numbered file descriptors, violating the usual Unix assumption (and required by Posix) that the lowest possible number will be allocated by the kernel when a new one is needed. In the daemon, and any child procesees, values higher than 1024 (being bigger than FD_SETSIZE) are not useable for FD_SET() [and hence select()] and overwrite the stack. Assorted crashes happen. JH/11 Fix use of $sender_host_name in daemon process. When used in certain main-section options or in a connect ACL, the value from the first ever connection was never replaced for subsequent connections. Found by Wakko Warner. JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux, though only once PCRE2 was introduced: the memory accounting used under debug offset allocations by an int, giving a hard trap in early startup. Change to using a size_t. Debug and fix by John Paul Adrian Glaubitz. JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value with underbars is given. The write-protection of configuration introduced in 4.95 trapped when normalisation was applied to an option not needing expansion action. JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters. JH/15 Fix a resource leak in *BSD. An off-by-one error resulted in the daemon failing to close the certificates directory, every hour or any time it was touched. JH/16 Debugging initiated by an ACL control now continues through into routing and transport processes. Previously debugging stopped any time Exim re-execs, or for processing a queued message. JH/17 The "expand" debug selector now gives more detail, specifically on the result of expansion operators and items. JH/18 Bug 2751: Fix include_directory in redirect routers. Previously a bad comparison between the option value and the name of the file to be included was done, and a mismatch was wrongly identified. 4.88 to 4.95 are affected. JH/19 Support for Berkeley DB versions 1 and 2 is withdrawn. JH/20 When built with NDBM for hints DB's check for nonexistence of a name supplied as the db file-pair basename. Previously, if a directory path was given, for example via the autoreply "once" option, the DB file.pag and file.dir files would be created in that directory's parent. JH/21 Remove the "allow_insecure_tainted_data" main config option and the "taint" log_selector. These were previously deprecated. JH/22 Fix static address-list lookups to properly return the matched item. Previously only the domain part was returned. JH/23 Bug 2864: FreeBSD: fix transport hang after 4xx/5xx response. Previously the call into OpenSSL to send a TLS Close was being repeated; this resulted in the library waiting for the peer's Close. If that was never sent we waited forever. Fix by tracking send calls. JH/24 The ${run} expansion item now expands its command string elements after splitting. Previously it was before; the new ordering makes handling zero-length arguments simpler. The old ordering can be obtained by appending a new option "preexpand", after a comma, to the "run". JH/25 Taint-check exec arguments for transport-initiated external processes. Previously, tainted values could be used. This affects "pipe", "lmtp" and "queryprogram" transport, transport-filter, and ETRN commands. The ${run} expansion is also affected: in "preexpand" mode no part of the command line may be tainted, in default mode the executable name may not be tainted. JH/26 Fix CHUNKING on a continued-transport. Previously the usabliility of the the facility was not passed across execs, and only the first message passed over a connection could use BDAT; any further ones using DATA. JH/27 Support the PIPECONNECT facility in the smtp transport when the helo_data uses $sending_ip_address and an interface is specified. Previously any use of the local address in the EHLO name disabled PIPECONNECT, the common case being to use the rDNS of it. JH/28 OpenSSL: fix transport-required OCSP stapling verification under session resumption. Previously verify failed because no certificate status is passed on the wire for the restarted session. Fix by using the recorded ocsp status of the stored session for the new connection. JH/29 TLS resumption: the key for session lookup in the client now includes more info that a server could potentially use in configuring a TLS session, avoiding oferring mismatching sessions to such a server. Previously only the server IP was used. JH/30 Fix string_copyn() for limit greater than actual string length. Previously the copied amount was the limit, which could result in a overlapping memcpy for newly allocated destination soon after a source string shorter than the limit. Found/investigated by KM. JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection close; it may be needed for a subsequent connection. This caused a SEGV on primary-MX defer. Found/investigated by Gedalya & Andreas. JH/32 Fix CHUNKING for a second message on a connection when the first was rejected. Previously we did not reset the chunking-offered state, and erroneously rejected the BDAT command. Investigation help from Jesse Hathaway. JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning an empty address. Previously the expansion returned an error. HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending proxy. Previously these were misparsed, leading to paniclog entries. Also contains commit 51be321b27 "Fix PAM auth. Bug 2813" addressing CVE-2022-37451. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mutt: add PKG_CONFIG_DEPENDSRosen Penev2022-07-20
| | | | | | Should fix missing dependencies when manupulating options. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* postfix: fix download failureMichal Vasilek2022-07-17
| | | | | | | cdn.postfix.johnriley.me serves a certificate for a different domain name. Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
* pigeonhole: update to 2.3.18W. Michael Petullo2022-05-11
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* dovecot: update to 2.3.18W. Michael Petullo2022-05-11
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* Revert "postfix: fix build on macos"Sergey V. Lobanov2022-02-11
| | | | This reverts commit 9d8171aa0647a0e4c5f27004d3f4c982ac0d1ebe.
* emailrelay: don't disable fortify sourceRosen Penev2022-02-04
| | | | | | GCC8 and 9 are gone. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* mutt: update to 2.1.5Matthew Hagan2022-02-02
| | | | Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* mutt: add header caching support via libgdbmMatthew Hagan2022-02-02
| | | | | | Add header caching option to mutt, using the libgdbm database routines. Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* mutt: move configurables to Config.inMatthew Hagan2022-02-02
| | | | Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* postfix: fix build on macosSergey V. Lobanov2022-01-25
| | | | | | | | | | | | | macos build fails due to two reasons: 1. using build host ar and ranlib tools 2. using uname -r to get kernel version First issue is fixed by specifying ar and ranlib from toolchain Second issue is fixed by specifying kernel release major version=5 Using 'uname -r' from build host for cross-compiling is not a good idea even for Linux build host Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
* mblaze: fix build on macosSergey V. Lobanov2022-01-11
| | | | | | redefine OS=Linux due to OpenWrt is always Linux Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
* postfix: Fix compile with glibc 2.34Hauke Mehrtens2022-01-09
| | | | | | | | | | | | | | | | | | This adds a patch from Open embedded to fix compilation with glibc 2.34. This patch was taken from here: https://github.com/openembedded/meta-openembedded/blob/master/meta-networking/recipes-daemons/postfix/files/0007-correct-signature-of-closefrom-API.patch It fixes the following build problem: /builder/shared-workdir/build/sdk/staging_dir/toolchain-arc_arc700_gcc-11.2.0_glibc/include/unistd.h:366:13: error: conflicting types for 'closefrom'; have 'void(int)' 366 | extern void closefrom (int __lowfd) __THROW; | ^~~~~~~~~ In file included from attr_clnt.c:87: ./sys_defs.h:1511:12: note: previous declaration of 'closefrom' with type 'int(int)' 1511 | extern int closefrom(int); | ^~~~~~~~~ make: *** [Makefile:192: attr_clnt.o] Error 1 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* alpine: update to 2.25Rosen Penev2021-12-17
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* mblaze: update to 1.2Rosen Penev2021-12-16
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* msmtp: update to version 1.8.1.9Josef Schlehofer2021-12-04
| | | | | | | Changelog: https://marlam.de/msmtp/news/msmtp-1-8-19/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* postfix: prevent displaying config options when not enabledMatthew Hagan2021-11-08
| | | | | | | | | | Postfix's options should not be visible in the config when Postfix is not enabled. Secondly, place the config option menu behind the Postfix option rather than underneath. Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* mutt: prevent exposing mutt config options when not enabledMatthew Hagan2021-11-08
| | | | | | | | Ensure Mutt's configuration options do not appear in the config when Mutt is not enabled. Reported-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* msmtp: update to version 1.8.17Josef Schlehofer2021-10-17
| | | | | | | - Use AUTORELEASE fce It helps when someone forgets to bump PKG_RELEASE Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* exim: update to version 4.95Daniel Golle2021-10-09
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mutt: add smtp, sasl, gnutls, menuconfig optionsMatthew Hagan2021-10-08
| | | | | | | | | | Compile tested: bcm53xx, MX65, master Add support for SMTP, SASL, GnuTLS and POP, IMAP, OpenSSL in the menuconfig. The SMTP/SASL configurable was required to successfully send email on GMail. Tested separately using OpenSSL and GnuTLS. Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* Merge pull request #16679 from paper42/mutt-2.1.3Alexandru Ardelean2021-09-28
|\ | | | | mutt: update to 2.1.3
| * mutt: update to 2.1.3Michal Vasilek2021-09-21
| | | | | | | | Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
* | pigeonhole: update to 0.5.16Rosen Penev2021-09-25
|/ | | | | | Update URL. Signed-off-by: Rosen Penev <rosenp@gmail.com>
Powered by cgit, Themed by Ted Yin.