RELEASE_NOTES revision 71345
1 SENDMAIL RELEASE NOTES 2 $Id: RELEASE_NOTES,v 8.561.2.5.2.181 2000/12/28 23:56:46 gshapiro Exp $ 3 4 5This listing shows the version of the sendmail binary, the version 6of the sendmail configuration files, the date of release, and a 7summary of the changes in that release. 8 98.11.2/8.11.2 2000/12/29 10 Prevent a segmentation fault when trying to set a class in 11 address test mode due to a negative array index. Audit 12 other array indexing. This bug is not believed to be 13 exploitable. Noted by Michal Zalewski of the "Internet for 14 Schools" project (IdS). 15 Add an FFR (for future release) to drop privileges when using 16 address test mode. This will be turned on in 8.12. It can 17 be enabled by compiling with: 18 APPENDDEF(`conf_sendmail_ENVDEF', `-D_FFR_TESTMODE_DROP_PRIVS') 19 in your devtools/Site/site.config.m4 file. Suggested by 20 Michal Zalewski of the "Internet for Schools" project (IdS). 21 Fix potential problem with Cyrus-SASL security layer which may have 22 caused I/O errors, especially for mechanism DIGEST-MD5. 23 When QueueSortOrder was set to host, sendmail might not read 24 enough of the queue file to determine the host, making the 25 sort sub-optimal. Problem noted by Jeff Earickson of 26 Colby College. 27 Don't issue DSNs for addresses which use the NOTIFY parameter (per 28 RFC 1891) but don't have FAILURE as value. 29 Initialize Cyrus-SASL library before the SMTP daemon is started. 30 This implies that every change to SASL related files requires 31 a restart of the daemon, e.g., Sendmail.conf, new SASL 32 mechanisms (in form of shared libraries). 33 Properly set the STARTTLS related macros during a queue run for 34 a cached connection. Bug reported by Michael Kellen of 35 NxNetworks, Inc. 36 Log the server name in relay= for ruleset tls_server instead of the 37 client name. 38 Include original length of bad field/header when reporting 39 MaxMimeHeaderLength problems. Requested by Ulrich Windl of 40 the Universitat Regensburg. 41 Fix delivery to set-user-ID files that are expanded from aliases in 42 DeliveryMode queue. Problem noted by Ric Anderson of the 43 University of Arizona. 44 Fix LDAP map -m (match only) flag. Problem noted by Jeff Giuliano 45 of Collective Technologies. 46 Avoid using a negative argument for sleep() calls when delaying answers 47 to EXPN/VRFY commands on systems which respond very slowly. 48 Problem noted by Mikolaj J. Habryn of Optus Internet 49 Engineering. 50 Make sure the F=u flag is set in the default prog mailer 51 definition. Problem noted by Kari Hurtta of the Finnish 52 Meteorological Institute. 53 Fix IPv6 check for unspecified addresses. Patch from 54 Jun-ichiro itojun Hagino of the KAME Project. 55 Fix return values for IRIX nsd map. From Kari Hurtta of the Finnish 56 Meteorological Institute. 57 Fix parsing of DaemonPortOptions and ClientPortOptions. Read all 58 of the parameters to find Family= setting before trying to 59 interpret Addr= and Port=. Problem noted by Valdis 60 Kletnieks of Virginia Tech. 61 When delivering to a file directly from an alias, do not call 62 initgroups(); instead use the DefaultUser group information. 63 Problem noted by Marc Schaefer of ALPHANET NF. 64 RunAsUser now overrides the ownership of the control socket, if 65 created. Otherwise, sendmail can not remove it upon 66 close. Problem noted by Werner Wiethege. 67 Fix ConnectionRateThrottle counting as the option is the number of 68 overall connections, not the number of connections per 69 socket. A future version may change this to per socket 70 counting. 71 Portability: 72 Clean up libsmdb so it functions properly on platforms 73 where sizeof(u_int32_t) != sizeof(size_t). Problem 74 noted by Rein Tollevik of Basefarm AS. 75 Fix man page formatting for compatibility with Solaris' 76 whatis. From Stephen Gildea of InTouch Systems, Inc. 77 UnixWare 7 includes snprintf() support. From Larry 78 Rosenman. 79 IPv6 changes for platforms using KAME. Patch from 80 Jun-ichiro itojun Hagino of the KAME Project. 81 Avoid a typedef compile conflict with Berkeley DB 3.X and 82 Solaris 2.5 or earlier. Problem noted by Bob Hughes 83 of Pacific Access. 84 Add preliminary support for AIX 5. Contributed by 85 Valdis Kletnieks of Virginia Tech. 86 Solaris 9 load average support from Andrew Tucker of Sun 87 Microsystems. 88 CONFIG: Reject addresses of the form a!b if FEATURE(`nouucp', `r') 89 is used. Problem noted by Phil Homewood of Asia Online, 90 patch from Neil Rickert of Northern Illinois University. 91 CONFIG: Change the default DNS based blacklist server for 92 FEATURE(`dnsbl') to blackholes.mail-abuse.org. 93 CONFIG: Deal correctly with the 'C' flag in {daemon_flags}, i.e., 94 implicitly assume canonical host names. 95 CONFIG: Deal with "::" in IPv6 addresses for access_db. Based on 96 patch by Motonori Nakamura of Kyoto University. 97 CONFIG: New OSTYPE(`aix5') contributed by Valdis Kletnieks of 98 Virginia Tech. 99 CONFIG: Pass the illegal header form <list:;> through untouched 100 instead of making it worse. Problem noted by Motonori 101 Nakamura of Kyoto University. 102 CONTRIB: Added buildvirtuser (see `perldoc contrib/buildvirtuser`). 103 CONTRIB: qtool.pl: An empty queue is not an error. Problem noted 104 by Jan Krueger of digitalanswers communications consulting 105 gmbh. 106 CONTRIB: domainmap.m4: Handle domains with '-' in them. From Mark 107 Roth of the University of Illinois at Urbana-Champaign. 108 DEVTOOLS: Change the internal devtools OS, REL, and ARCH m4 109 variables into bldOS, bldREL, and bldARCH to prevent 110 namespace collisions. Problem noted by Motonori Nakamura 111 of Kyoto University. 112 RMAIL: Undo the 8.11.1 change to use -G when calling sendmail. It 113 causes some changes in behavior and may break rmail for 114 installations where sendmail is actually a wrapper to 115 another MTA. The change will re-appear in a future 116 version. 117 SMRSH: Use the vendor supplied directory on HPUX 10.X, HPUX 11.X, 118 and SunOS 5.8. Requested by Jeff A. Earickson of Colby 119 College and John Beck of Sun Microsystems. 120 VACATION: Fix pattern matching for addresses to ignore. 121 VACATION: Don't reply to addresses of the form owner-* 122 or *-owner. 123 New Files: 124 cf/ostype/aix5.m4 125 contrib/buildvirtuser 126 devtools/OS/AIX.5.0 127 1288.11.1/8.11.1 2000/09/27 129 Fix SMTP EXPN command output if the address expands to a single 130 name. Fix from John Beck of Sun Microsystems. 131 Don't try STARTTLS in the client if the PRNG has not been properly 132 seeded. This problem only occurs on systems without 133 /dev/urandom. Problem detected by Jan Krueger of 134 digitalanswers communications consulting gmbh and 135 Neil Rickert of Northern Illinois University. 136 Don't use the . and .. directories when expanding QueueDirectory 137 wildcards. 138 Do not try to cache LDAP connections across processes as a parent 139 process may close the connection before the child process 140 has completed. Problem noted by Lai Yiu Fai of the Hong 141 Kong University of Science and Technology and Wolfgang 142 Hottgenroth of UUNET. 143 Use Timeout.fileopen to limit the amount of time spent trying to 144 read the LDAP secret from a file. 145 Prevent SIGTERM from removing a command line submitted item after 146 the user submits the message and before the first delivery 147 attempt completes. Problem noted by Max France of AlphaNet. 148 Fix from Neil Rickert of Northern Illinois University. 149 Deal correctly with MaxMessageSize restriction if message size is 150 greater than 2^31. Problem noted by Tim "Darth Dice" Bosserman 151 of EarthLink. 152 Turn off queue checkpointing if CheckpointInterval is set to zero. 153 Treat an empty home directory (from getpw*() or $HOME) as 154 non-existent instead of treating it as /. Problem noted by 155 Todd C. Miller of Courtesan Consulting. 156 Don't drop duplicate headers when reading a queued item. Problem 157 noted by Motonori Nakamura of Kyoto University. 158 Avoid bogus error text when logging the savemail panic "cannot 159 save rejected email anywhere". Problem noted by Marc G. 160 Fournier of Acadia University. 161 If an LDAP search fails because the LDAP server went down, close 162 the map so subsequent searches reopen the map. If there are 163 multiple LDAP servers, the down server will be skipped and 164 one of the others may be able to take over. 165 Set the ${load_avg} macro to the current load average, not the 166 previous load average query result. 167 If a non-optional map used in a check_* ruleset can't be opened, 168 return a temporary failure to the remote SMTP client 169 instead of ignoring the map. Problem noted by Allan E 170 Johannesen of Worcester Polytechnic Institute. 171 Avoid a race condition when queuing up split envelopes by saving 172 the split envelopes before the original envelope. 173 Fix a bug in the PH_MAP code which caused mail to bounce instead of 174 defer if the PH server could not be contacted. From Mark 175 Roth of the University of Illinois at Urbana-Champaign. 176 Prevent QueueSortOrder=Filename from interfering with -qR, -qS, and 177 ETRN. Problem noted by Erik R. Leo of SoVerNet. 178 Change error code for unrecognized parameters to the SMTP MAIL and 179 RCPT commands from 501 to 555 per RFC 1869. Problem 180 reported to Postfix by Robert Norris of Monash University. 181 Prevent overwriting the argument of -B on certain OS. Problem 182 noted by Matteo Gelosa of I.NET S.p.A. 183 Use the proper routine for freeing memory with Netscape's LDAP 184 client libraries. Patch from Paul Hilchey of the 185 University of British Columbia. 186 Portability: 187 Move the NETINET6 define to devtools/OS/SunOS.5.{8,9} 188 instead of defining it in conf.h so users can 189 override the setting. Suggested by 190 Henrik Nordstrom of Ericsson. 191 On HP-UX 10.X and 11.X, use /usr/sbin/sendmail instead of 192 /usr/lib/sendmail for rmail and vacation. From 193 Jeff A. Earickson of Colby College. 194 On HP-UX 11.X, use /usr/sbin instead of /usr/libexec (which 195 does not exist). From Jeff A. Earickson of Colby 196 College. 197 Avoid using the UCB subsystem on NCR MP-RAS 3.x. From 198 Tom Moore of NCR. 199 NeXT 3.X and 4.X installs man pages in /usr/man. From 200 Hisanori Gogota of NTT/InterCommunicationCenter. 201 Solaris 8 and later include /var/run. The default PID file 202 location is now /var/run/sendmail.pid. From John 203 Beck of Sun Microsystems. 204 SFIO includes snprintf() for those operating systems 205 which do not. From Todd C. Miller of Courtesan 206 Consulting. 207 CONFIG: Use the result of _CERT_REGEX_SUBJECT_ not {cert_subject}. 208 Problem noted by Kaspar Brand of futureLab AG. 209 CONFIG: Change 553 SMTP reply code to 501 to avoid problems with 210 errors in the MAIL address. 211 CONFIG: Fix FEATURE(nouucp) usage in example .mc files. Problem 212 noted by Ron Jarrell of Virginia Tech. 213 CONFIG: Add support for Solaris 8 (and later) as OSTYPE(solaris8). 214 Contributed by John Beck of Sun Microsystems. 215 CONFIG: Set confFROM_HEADER such that the mail hub can possibly add 216 GECOS information for an address. This more closely 217 matches pre-8.10 nullclient behavior. From Per Hedeland of 218 Ericsson. 219 CONFIG: Fix MODIFY_MAILER_FLAGS(): apply the flag modifications for 220 SMTP to all *smtp* mailers and those for RELAY to the relay 221 mailer as described in cf/README. 222 MAIL.LOCAL: Open the mailbox as the recipient not root so quotas 223 are obeyed. Problem noted by Damian Kuczynski of NIK. 224 MAKEMAP: Do not change a map's owner to the TrustedUser if using 225 makemap to 'unmake' the map. 226 RMAIL: Avoid overflowing the list of recipients being passed to 227 sendmail. 228 RMAIL: Invoke sendmail with '-G' to indicate this is a gateway 229 submission. Problem noted by Kari Hurtta of the Finnish 230 Meteorological Institute. 231 VACATION: Read the complete message to avoid "broken pipe" signals. 232 VACATION: Do not cut off vacation.msg files which have a single 233 dot as the only character on the line. 234 New Files: 235 cf/ostype/solaris8.m4 236 2378.11.0/8.11.0 2000/07/19 238 SECURITY: If sendmail is installed as a non-root set-user-ID binary 239 (not the normal case), some operating systems will still 240 keep a saved-uid of the effective-uid when sendmail tries 241 to drop all of its privileges. If sendmail needs to drop 242 these privileges and the operating system doesn't set the 243 saved-uid as well, exit with an error. Problem noted by 244 Kari Hurtta of the Finnish Meteorological Institute. 245 SECURITY: sendmail depends on snprintf() NUL terminating the string 246 it populates. It is possible that some broken 247 implementations of snprintf() exist that do not do this. 248 Systems in this category should compile with 249 -DSNPRINTF_IS_BROKEN=1. Use test/t_snprintf.c to test your 250 system and report broken implementations to 251 sendmail-bugs@sendmail.org and your OS vendor. Problem 252 noted by Slawomir Piotrowski of TELSAT GP. 253 Support SMTP Service Extension for Secure SMTP (RFC 2487) (STARTTLS). 254 Implementation influenced by the example programs of 255 OpenSSL and the work of Lutz Jaenicke of TU Cottbus. 256 Add new STARTTLS related options CACERTPath, CACERTFile, 257 ClientCertFile, ClientKeyFile, DHParameters, RandFile, 258 ServerCertFile, and ServerKeyFile. These are documented in 259 cf/README and doc/op/op.*. 260 New STARTTLS related macros: ${cert_issuer}, ${cert_subject}, 261 ${tls_version}, ${cipher}, ${cipher_bits}, ${verify}, 262 ${server_name}, and ${server_addr}. These are documented 263 in cf/README and doc/op/op.*. 264 Add support for the Entropy Gathering Daemon (EGD) for better 265 random data. 266 New DontBlameSendmail option InsufficientEntropy for systems which 267 don't properly seed the PRNG for OpenSSL but want to 268 try to use STARTTLS despite the security problems. 269 Support the security layer in SMTP AUTH for mechanisms which 270 support encryption. Based on code contributed by Tim 271 Martin of CMU. 272 Add new macro ${auth_ssf} to reflect the SMTP AUTH security 273 strength factor. 274 LDAP's -1 (single match only) flag was not honored if the -z 275 (delimiter) flag was not given. Problem noted by ST Wong of 276 the Chinese University of Hong Kong. Fix from Mark Adamson 277 of CMU. 278 Add more protection from accidentally tripping OpenLDAP 1.X's 279 ld_errno == LDAP_DECODING_ERROR hack on ldap_next_attribute(). 280 Suggested by Kurt Zeilenga of OpenLDAP. 281 Fix the default family selection for DaemonPortOptions. As 282 documented, unless a family is specified in a 283 DaemonPortOptions option, "inet" is the default. It is 284 also the default if no DaemonPortOptions value is set. 285 Therefore, IPv6 users should configure additional sockets 286 by adding DaemonPortOptions settings with Family=inet6 if 287 they wish to also listen on IPv6 interfaces. Problem noted 288 by Jun-ichiro itojun Hagino of the KAME Project. 289 Set ${if_family} when setting ${if_addr} and ${if_name} to reflect 290 the interface information for an outgoing connection. 291 Not doing so was creating a mismatch between the socket 292 family and address used in subsequent connections if the 293 M=b modifier was set in DaemonPortOptions. Problem noted 294 by John Beck of Sun Microsystems. 295 If DaemonPortOptions modifier M=b is used, determine the socket 296 family based on the IP address. ${if_family} is no longer 297 persistent (i.e., saved in qf files). Patch from John Beck 298 of Sun Microsystems. 299 sendmail 8.10 and 8.11 reused the ${if_addr} and ${if_family} 300 macros for both the incoming interface address/family and 301 the outgoing interface address/family. In order for M=b 302 modifier in DaemonPortOptions to work properly, preserve 303 the incoming information in the queue file for later 304 delivery attempts. 305 Use SMTP error code and enhanced status code from check_relay in 306 responses to commands. Problem noted by Jeff Wasilko of 307 smoe.org. 308 Add more vigilance in checking for putc() errors on output streams 309 to protect from a bug in Solaris 2.6's putc(). Problem 310 noted by Graeme Hewson of Oracle. 311 The LDAP map -n option (return attribute names only) wasn't working. 312 Problem noted by Ajay Matia. 313 Under certain circumstances, an address could be listed as deferred 314 but would be bounced back to the sender as failed to be 315 delivered when it really should have been queued. Problem 316 noted by Allan E Johannesen of Worcester Polytechnic Institute. 317 Prevent a segmentation fault in a child SMTP process from getting 318 the SMTP transaction out of sync. Problem noted by Per 319 Hedeland of Ericsson. 320 Turn off RES_DEBUG if SFIO is defined unless SFIO_STDIO_COMPAT 321 is defined to avoid a core dump due to incompatibilities 322 between sfio and stdio. Problem noted by Neil Rickert 323 of Northern Illinois University. 324 Don't log useless envelope ID on initial connection log. Problem 325 noted by Kari Hurtta of the Finnish Meteorological Institute. 326 Convert the free disk space shown in a control socket status query 327 to kilobyte units. 328 If TryNullMXList is True and there is a temporary DNS failure 329 looking up the hostname, requeue the message for a later 330 attempt. Problem noted by Ari Heikkinen of Pohjois-Savo 331 Polytechnic. 332 Under the proper circumstances, failed connections would be recorded 333 as "Bad file number" instead of "Connection failed" in the 334 queue file and persistent host status. Problem noted by 335 Graeme Hewson of Oracle. 336 Avoid getting into an endless loop if a non-hoststat directory exists 337 within the hoststatus directory (e.g., lost+found). 338 Patch from Valdis Kletnieks of Virginia Tech. 339 Make sure Timeout.queuereturn=now returns a bounce message to the 340 sender. Problem noted by Per Hedeland of Ericsson. 341 If a message data file can't be opened at delivery time, panic and 342 abort the attempt instead of delivering a message that 343 states "<<< No Message Collected >>>". 344 Fixup the GID checking code from 8.10.2 as it was overly 345 restrictive. Problem noted by Mark G. Thomas of Mark 346 G. Thomas Consulting. 347 Preserve source port number instead of replacing it with the ident 348 port number (113). 349 Document the queue status characters in the mailq man page. 350 Suggested by Ulrich Windl of the Universitat Regensburg. 351 Process queued items in which none of the recipient addresses have 352 host portions (or there are no recipients). Problem noted 353 by Valdis Kletnieks of Virginia Tech. 354 If a cached LDAP connection is used for multiple maps, make sure 355 only the first to open the connection is allowed to close 356 it so a later map close doesn't break the connection for 357 other maps. Problem noted by Wolfgang Hottgenroth of UUNET. 358 Netscape's LDAP libraries do not support Kerberos V4 359 authentication. Patch from Rainer Schoepf of the 360 University of Mainz. 361 Provide workaround for inconsistent handling of data passed 362 via callbacks to Cyrus SASL prior to version 1.5.23. 363 Mention ENHANCEDSTATUSCODES in the SMTP HELP helpfile. Omission 364 noted by Ulrich Windl of the Universitat Regensburg. 365 Portability: 366 Add the ability to read IPv6 interface addresses into class 367 'w' under FreeBSD (and possibly others). From Jun 368 Kuriyama of IMG SRC, Inc. and the FreeBSD Project. 369 Replace code for finding the number of CPUs on HPUX. 370 NCRUNIX MP-RAS 3.02 SO_REUSEADDR socket option does not 371 work properly causing problems if the accept() 372 fails and the socket needs to be reopened. Patch 373 from Tom Moore of NCR. 374 NetBSD uses a .0 extension of formatted man pages. From 375 Andrew Brown of Crossbar Security. 376 Return to using the IPv6 AI_DEFAULT flag instead of AI_V4MAPPED 377 for calls to getipnodebyname(). The Linux 378 implementation is broken so AI_ADDRCONFIG is stripped 379 under Linux. From John Beck of Sun Microsystems and 380 John Kennedy of Cal State University, Chico. 381 CONFIG: Catch invalid addresses containing a ',' at the wrong place. 382 Patch from Neil Rickert of Northern Illinois University. 383 CONFIG: New variables for the new sendmail options: 384 confCACERT_PATH CACERTPath 385 confCACERT CACERTFile 386 confCLIENT_CERT ClientCertFile 387 confCLIENT_KEY ClientKeyFile 388 confDH_PARAMETERS DHParameters 389 confRAND_FILE RandFile 390 confSERVER_CERT ServerCertFile 391 confSERVER_KEY ServerKeyFile 392 CONFIG: Provide basic rulesets for TLS policy control and add new 393 tags to the access database to support these policies. See 394 cf/README for more information. 395 CONFIG: Add TLS information to the Received: header. 396 CONFIG: Call tls_client ruleset from check_mail in case it wasn't 397 called due to a STARTTLS command. 398 CONFIG: If TLS_PERM_ERR is defined, TLS related errors are permanent 399 instead of temporary. 400 CONFIG: FEATURE(`relay_hosts_only') didn't work in combination with 401 the access map and relaying to a domain without using a To: 402 tag. Problem noted by Mark G. Thomas of Mark G. Thomas 403 Consulting. 404 CONFIG: Set confEBINDIR to /usr/sbin to match the devtools entry in 405 OSTYPE(`linux') and OSTYPE(`mklinux'). From Tim Pierce of 406 RootsWeb.com. 407 CONFIG: Make sure FEATURE(`nullclient') doesn't use aliasing and 408 forwarding to make it as close to the old behavior as 409 possible. Problem noted by George W. Baltz of the 410 University of Maryland. 411 CONFIG: Added OSTYPE(`darwin') for Mac OS X and Darwin users. From 412 Wilfredo Sanchez of Apple Computer, Inc. 413 CONFIG: Changed the map names used by FEATURE(`ldap_routing') from 414 ldap_mailhost and ldap_mailroutingaddress to ldapmh and 415 ldapmra as underscores in map names cause problems if 416 underscore is in OperatorChars. Problem noted by Bob Zeitz 417 of the University of Alberta. 418 CONFIG: Apply blacklist_recipients also to hosts in class {w}. 419 Patch from Michael Tratz of Esosoft Corporation. 420 CONFIG: Use A=TCP ... instead of A=IPC ... in SMTP mailers. 421 CONTRIB: Add link_hash.sh to create symbolic links to the hash 422 of X.509 certificates. 423 CONTRIB: passwd-to-alias.pl: More protection from special characters; 424 treat special shells as root aliases; skip entries where the 425 GECOS full name and username match. From Ulrich Windl of the 426 Universitat Regensburg. 427 CONTRIB: qtool.pl: Add missing last_modified_time method and fix a 428 typo. Patch from Graeme Hewson of Oracle. 429 CONTRIB: re-mqueue.pl: Improve handling of a race between re-mqueue 430 and sendmail. Patch from Graeme Hewson of Oracle. 431 CONTRIB: re-mqueue.pl: Don't exit(0) at end so can be called as 432 subroutine Patch from Graeme Hewson of Oracle. 433 CONTRIB: Add movemail.pl (move old mail messages between queues by 434 calling re-mqueue.pl) and movemail.conf (configuration 435 script for movemail.pl). From Graeme Hewson of Oracle. 436 CONTRIB: Add cidrexpand (expands CIDR blocks as a preprocessor to 437 makemap). From Derek J. Balling of Yahoo,Inc. 438 DEVTOOLS: INSTALL_RAWMAN installation option mistakenly applied any 439 extension modifications (e.g., MAN8EXT) to the installation 440 target. Patch from James Ralston of Carnegie Mellon 441 University. 442 DEVTOOLS: Add support for SunOS 5.9. 443 DEVTOOLS: New option confLN contains the command used to create 444 links. 445 LIBSMDB: Berkeley DB 2.X and 3.X errors might be lost and not 446 reported. 447 MAIL.LOCAL: DG/UX portability. Problem noted by Tim Boyer of 448 Denman Tire Corporation. 449 MAIL.LOCAL: Prevent a possible DoS attack when compiled with 450 -DCONTENTLENGTH. Based on patch from 3APA3A@SECURITY.NNOV.RU. 451 MAILSTATS: Fix usage statement (-p and -o are optional). 452 MAKEMAP: Change man page layout as workaround for problem with nroff 453 and -man on Solaris 7. Patch from Larry Williamson. 454 RMAIL: AIX 4.3 has snprintf(). Problem noted by David Hayes of 455 Black Diamond Equipment, Limited. 456 RMAIL: Prevent a segmentation fault if the incoming message does not 457 have a From line. 458 VACATION: Read all of the headers before deciding whether or not 459 to respond instead of stopping after finding recipient. 460 Added Files: 461 cf/ostype/darwin.m4 462 contrib/cidrexpand 463 contrib/link_hash.sh 464 contrib/movemail.conf 465 contrib/movemail.pl 466 devtools/OS/SunOS.5.9 467 test/t_snprintf.c 468 4698.10.2/8.10.2 2000/06/07 470 SECURITY: Work around broken Linux setuid() implementation. 471 On Linux, a normal user process has the ability to subvert 472 the setuid() call such that it is impossible for a root 473 process to drop its privileges. Problem noted by Wojciech 474 Purczynski of elzabsoft.pl. 475 SECURITY: Add more vigilance around set*uid(), setgid(), setgroups(), 476 initgroups(), and chroot() calls. 477 Added Files: 478 test/t_setuid.c 479 4808.10.1/8.10.1 2000/04/06 481 SECURITY: Limit the choice of outgoing (client-side) SMTP 482 Authentication mechanisms to those specified in 483 AuthMechanisms to prevent information leakage. We do not 484 recommend use of PLAIN for outgoing mail as it sends the 485 password in clear text to possibly untrusted servers. See 486 cf/README's DefaultAuthInfo section for additional information. 487 Copy the ident argument for openlog() to avoid problems on some 488 OSs. Based on patch from Rob Bajorek from Webhelp.com. 489 Avoid bogus error message when reporting an alias line as too long. 490 Avoid bogus socket error message if sendmail.cf version level is 491 greater than sendmail binary supported version. Patch 492 from John Beck of Sun Microsystems. 493 Prevent a malformed ruleset (missing right hand side) from causing 494 a segmentation fault when using address test mode. Based on 495 patch from John Beck of Sun Microsystems. 496 Prevent memory leak from use of NIS maps and yp_match(3). Problem 497 noted by Gil Kloepfer of the University of Texas at Austin. 498 Fix queue file permission checks to allow for TrustedUser ownership. 499 Change logging of errors from the trust_auth ruleset to LogLevel 10 500 or higher. 501 Avoid simple password cracking attacks against SMTP AUTH by using 502 exponential delay after too many tries within one connection. 503 Encode an initial empty AUTH challenge as '=', not as empty string. 504 Avoid segmentation fault on EX_SOFTWARE internal error logs. 505 Problem noted by Allan E Johannesen of Worcester 506 Polytechnic Institute. 507 Ensure that a header check which resolves to $#discard actually 508 discards the message. 509 Emit missing value warnings for aliases with no right hand side 510 when newaliases is run instead of only when delivery is 511 attempted to the alias. 512 Remove AuthOptions missing value warning for consistency with other 513 flag options. 514 Portability: 515 SECURITY: Specify a run-time shared library search path for 516 AIX 4.X instead of using the dangerous AIX 4.X 517 linker semantics. AIX 4.X users should consult 518 sendmail/README for further information. Problem 519 noted by Valdis Kletnieks of Virginia Tech. 520 Avoid use of strerror(3) call. Problem noted by Charles 521 Levert of Ecole Polytechnique de Montreal. 522 DGUX requires -lsocket -lnsl and has a non-standard install 523 program. From Tim Boyer of Denman Tire Corporation. 524 HPUX 11.0 has a broken res_search() function. 525 Updates to devtools/OS/NeXT.3.X, NeXT.4.X, and NEXTSTEP.4.X 526 from J. P. McCann of E I A. 527 Digital UNIX/Compaq Tru64 5.0 now includes snprintf(3). 528 Problem noted by Michael Long of Info Avenue Internet 529 Services, LLC. 530 Modern (post-199912) OpenBSD versions include working 531 strlc{at,py}(3) functions. From Todd C. Miller of 532 Courtesan Consulting. 533 SINIX doesn't have random(3). From Gerald Rinske of 534 Siemens Business Services. 535 CONFIG: Change error message about unresolvable sender domain to 536 include the sender address. Proposed by Wolfgang Rupprecht 537 of WSRCC. 538 CONFIG: Fix usenet mailer calls. 539 CONFIG: If RELAY_MAILER_FLAGS is not defined, use SMTP_MAILER_FLAGS 540 to be backward compatible with 8.9. 541 CONFIG: Change handling of default case @domain for virtusertable 542 to allow for +*@domain to deal with +detail. 543 CONTRIB: Remove converting.sun.configs -- it is obsolete. 544 DEVTOOLS: confUBINMODE was being ignored. Fix from KITAZIMA, Tuneki 545 of NEC. 546 DEVTOOLS: Add to NCR platform list and include the architecture 547 (i486). From Tom J. Moore of NCR. 548 DEVTOOLS: SECURITY: Change method of linking with sendmail utility 549 libraries to work around the AIX 4.X and SunOS 4.X linker's 550 overloaded -L option. Problem noted by Valdis Kletnieks of 551 Virginia Tech. 552 DEVTOOLS: configure.sh was overriding the user's choice for 553 confNROFF. Problem noted by Glenn A. Malling of Syracuse 554 University. 555 DEVTOOLS: New variables conf_prog_LIB_POST and confBLDVARIANT added 556 for other internal projects but included in the open source 557 release. 558 LIBSMDB: Check for ".db" instead of simply "db" at the end of the 559 map name to determine whether or not to add the extension. 560 This fixes makemap when building the userdb file. Problem 561 noted by Andrew J Cole of the University of Leeds. 562 LIBSMDB: Allow a database to be opened for updating and created if 563 it doesn't already exist. Problem noted by Rand Wacker of 564 Sendmail. 565 LIBSMDB: If type is SMDB_TYPE_DEFAULT and both NEWDB and NDBM are 566 available, fall back to NDBM if NEWDB open fails. This 567 fixes praliases. Patch from John Beck of Sun Microsystems. 568 LIBSMUTIL: safefile()'s SFF_NOTEXCL check was being misinterpreted 569 as SFF_NOWRFILES. 570 OP.ME: Clarify some issues regarding mailer flags. Suggested by 571 Martin Mokrejs of The Charles University and Neil Rickert of 572 Northern Illinois University. 573 PRALIASES: Restore 8.9.X functionality of being able to search for 574 particular keys in a database by specifying the keys on the 575 command line. Man page updated accordingly. Patch from 576 John Beck of Sun Microsystems. 577 VACATION: SunOS 4.X portability from Charles Levert of Ecole 578 Polytechnique de Montreal. 579 VACATION: Fix -t option which is ignored but available for 580 compatibility with Sun's version, based on patch from 581 Volker Dobler of Infratest Burke. 582 Added Files: 583 devtools/M4/UNIX/smlib.m4 584 devtools/OS/OSF1.V5.0 585 Deleted Files: 586 contrib/converting.sun.configs 587 Deleted Directories (already done in 8.10.0 but not listed): 588 doc/intro 589 doc/usenix 590 doc/changes 591 5928.10.0/8.10.0 2000/03/01 593 ************************************************************* 594 * The engineering department at Sendmail, Inc. has suffered * 595 * the tragic loss of a key member of our engineering team. * 596 * Julie Van Bourg was the Vice President of Engineering * 597 * at Sendmail, Inc. during the development and deployment * 598 * of this release. It was her vision, dedication, and * 599 * support that has made this release a success. Julie died * 600 * on October 26, 1999 of cancer. We have lost a leader, a * 601 * coach, and a friend. * 602 * * 603 * This release is dedicated to her memory and to the joy, * 604 * strength, ideals, and hope that she brought to all of us. * 605 * Julie, we miss you! * 606 ************************************************************* 607 SECURITY: The safe file checks now back track through symbolic 608 links to make sure the files can't be compromised due 609 to poor permissions on the parent directories of the 610 symbolic link target. 611 SECURITY: Only root, TrustedUser, and users in class t can rebuild 612 the alias map. Problem noted by Michal Zalewski of the 613 "Internet for Schools" project (IdS). 614 SECURITY: There is a potential for a denial of service attack if 615 the AutoRebuildAliases option is set as a user can kill the 616 sendmail process while it is rebuilding the aliases file 617 (leaving it in an inconsistent state). This option and 618 its use is deprecated and will be removed from a future 619 version of sendmail. 620 SECURITY: Make sure all file descriptors (besides stdin, stdout, and 621 stderr) are closed before restarting sendmail. Problem noted 622 by Michal Zalewski of the "Internet for Schools" project 623 (IdS). 624 Begin using /etc/mail/ for sendmail related files. This affects 625 a large number of files. See cf/README for more details. 626 The directory structure of the distribution has changed slightly 627 for easier code sharing among the programs. 628 Support SMTP AUTH (see RFC 2554). New macros for this purpose 629 are ${auth_authen}, ${auth_type}, and ${auth_author} 630 which hold the client's authentication credentials, 631 the mechanism used for authentication, and the 632 authorization identity (i.e., the AUTH= parameter if 633 supplied). Based on code contributed by Tim Martin of CMU. 634 On systems which use the Torek stdio library (all of the BSD 635 distributions), use memory-buffered files to reduce 636 file system overhead by not creating temporary files on 637 disk. Contributed by Exactis.com, Inc. 638 New option DataFileBufferSize to control the maximum size of a 639 memory-buffered data (df) file before a disk-based file is 640 used. Contributed by Exactis.com, Inc. 641 New option XscriptFileBufferSize to control the maximum size of a 642 memory-buffered transcript (xf) file before a disk-based 643 file is used. Contributed by Exactis.com, Inc. 644 sendmail implements RFC 2476 (Message Submission), e.g., it can 645 now listen on several different ports. Use: 646 O DaemonPortOptions=Name=MSA, Port=587, M=E 647 to run a Message Submission Agent (MSA); this is turned 648 on by default in m4-generated .cf files; it can be turned 649 off with FEATURE(`no_default_msa'). 650 The 'XUSR' SMTP command is deprecated. Mail user agents should 651 begin using RFC 2476 Message Submission for initial user 652 message submission. XUSR may disappear from a future release. 653 The new '-G' (relay (gateway) submission) command line option 654 indicates that the message being submitted from the command 655 line is for relaying, not initial submission. This means 656 the message will be rejected if the addresses are not fully 657 qualified and no canonicalization will be done. Future 658 releases may even reject improperly formed messages. 659 The '-U' (initial user submission) command line option is 660 deprecated and may be removed from a future release. 661 Mail user agents should begin using '-G' to indicate that 662 this is a relay submission (the inverse of -U). 663 The next release of sendmail will assume that any message submitted 664 from the command line is an initial user submission and act 665 accordingly. 666 If sendmail doesn't have enough privileges to run a .forward 667 program or deliver to file as the owner of that file, the 668 address is marked as unsafe. This means if RunAsUser is 669 set, users won't be able to use programs or delivery to 670 files in their .forward files. Administrators can override 671 this by setting the DontBlameSendmail option to the new 672 setting NonRootSafeAddr. 673 Allow group or world writable directories if the sticky bit is set 674 on the directory and DontBlameSendmail is set to 675 TrustStickyBit. Based on patch from Chris Metcalf of 676 InCert Software. 677 Prevent logging of unsafe directory paths for non-existent forward 678 files if the new DontWarnForwardFileInUnsafeDirPath bit is 679 set in the DontBlameSendmail option. Requested by many. 680 New Timeout.control option to limit the total time spent satisfying 681 a control socket request. 682 New Timeout.resolver options for controlling BIND resolver 683 settings: 684 Timeout.resolver.retrans 685 Sets the resolver's retransmission time interval (in 686 seconds). Sets both Timeout.resolver.retrans.first 687 and Timeout.resolver.retrans.normal. 688 Timeout.resolver.retrans.first 689 Sets the resolver's retransmission time interval (in 690 seconds) for the first attempt to deliver a message. 691 Timeout.resolver.retrans.normal 692 Sets the resolver's retransmission time interval (in 693 seconds) for all resolver lookups except the first 694 delivery attempt. 695 Timeout.resolver.retry 696 Sets the number of times to retransmit a resolver 697 query. Sets both Timeout.resolver.retry.first 698 and Timeout.resolver.retry.normal. 699 Timeout.resolver.retry.first 700 Sets the number of times to retransmit a resolver 701 query for the first attempt to deliver a message. 702 Timeout.resolver.retry.normal 703 Sets the number of times to retransmit a resolver 704 query for all resolver lookups except the first 705 delivery attempt. 706 Contributed by Exactis.com, Inc. 707 Support multiple queue directories. To use multiple queues, supply 708 a QueueDirectory option value ending with an asterisk. For 709 example, /var/spool/mqueue/q* will use all of the 710 directories or symbolic links to directories beginning with 711 'q' in /var/spool/mqueue as queue directories. Keep in 712 mind, the queue directory structure should not be changed 713 while sendmail is running. Queue runs create a separate 714 process for running each queue unless the verbose flag is 715 given on a non-daemon queue run. New items are randomly 716 assigned to a queue. Contributed by Exactis.com, Inc. 717 Support different directories for qf, df, and xf queue files; if 718 subdirectories or symbolic links to directories of those names 719 exist in the queue directories, they are used for the 720 corresponding queue files. Keep in mind, the queue 721 directory structure should not be changed while sendmail is 722 running. Proposed by Mathias Koerber of Singapore 723 Telecommunications Ltd. 724 New queue file naming system which uses a filename guaranteed to be 725 unique for 60 years. This allows queue IDs to be assigned 726 without fancy file system locking. Queued items can be 727 moved between queues easily. Contributed by Exactis.com, 728 Inc. 729 Messages which are undeliverable due to temporary address failures 730 (e.g., DNS failure) will now go to the FallBackMX host, if 731 set. Contributed by Exactis.com, Inc. 732 New command line option '-L tag' which sets the identifier used for 733 syslog. Contributed by Exactis.com, Inc. 734 QueueSortOrder=Filename will sort the queue by filename. This 735 avoids opening and reading each queue file when preparing 736 to run the queue. Contributed by Exactis.com, Inc. 737 Shared memory counters and microtimers functionality has been 738 donated by Exactis.com, Inc. 739 The SCCS ID tags have been replaced with RCS ID tags. 740 Allow trusted users (those on a T line or in $=t) to set the 741 QueueDirectory (Q) option without an X-Authentication-Warning: 742 being added. Suggested by Michael K. Sanders. 743 IPv6 support based on patches from John Kennedy of Cal State 744 University, Chico, Motonori Nakamura of Kyoto University, 745 and John Beck of Sun Microsystems. 746 In low-disk space situations, where sendmail would previously refuse 747 connections, still accept them, but only allow ETRN commands. 748 Suggested by Mathias Koerber of Singapore Telecommunications 749 Ltd. 750 The [IPC] builtin mailer now allows delivery to a UNIX domain socket 751 on systems which support them. This can be used with LMTP 752 local delivery agents which listen on a named socket. An 753 example mailer might be: 754 Mexecmail, P=[IPC], F=lsDFMmnqSXzA5@/:|, E=\r\n, 755 S=10, R=20/40, T=DNS/RFC822/X-Unix, 756 A=FILE /var/run/lmtpd 757 Code contributed by Lyndon Nerenberg of Messaging Direct. 758 The [TCP] builtin mailer name is now deprecated. Use [IPC] 759 instead. 760 The first mailer argument in the [IPC] mailer is now checked for a 761 legitimate value. Possible values are TCP (for TCP/IP 762 connections), IPC (which will be deprecated in a future 763 version), and FILE (for UNIX domain socket delivery). 764 PrivacyOptions=goaway no longer includes the noetrn and the noreceipts 765 flags. 766 PrivacyOptions=nobodyreturn instructs sendmail not to include the 767 body of the original message on delivery status 768 notifications. 769 Don't announce DSN if PrivacyOptions=noreceipts is set. Problem noted 770 by Dan Bernstein, fix from Robert Harker of Harker Systems. 771 Accept the SMTP RSET command even when rejecting commands due to TCP 772 Wrappers or the check_relay ruleset. Problem noted by 773 Steve Schweinhart of America Online. 774 Warn if OperatorChars is set multiple times. OperatorChars should 775 not be set after rulesets are defined. Suggested by 776 Mitchell Blank Jr of Exec-PC. 777 Do not report temporary failure on delivery to files. In 778 interactive delivery mode, this would result in two SMTP 779 responses after the DATA command. Problem noted by 780 Nik Conwell of Boston University. 781 Check file close when mailing to files. Problem noted by Nik 782 Conwell of Boston University. 783 Avoid a segmentation fault when using the LDAP map. Patch from 784 Curtis W. Hillegas of Princeton University. 785 Always bind to the LDAP server regardless of whether you are using 786 ldap_open() or ldap_init(). Fix from Raj Kunjithapadam of 787 @Home Network. 788 New ruleset trust_auth to determine whether a given AUTH= 789 parameter of the MAIL command should be trusted. See SMTP 790 AUTH, cf/README, and doc/op/op.ps. 791 Allow new named config file rules check_vrfy, check_expn, and 792 check_etrn for VRFY, EXPN, and ETRN commands, respectively, 793 similar to check_rcpt etc. 794 Introduce new macros ${rcpt_mailer}, ${rcpt_host}, ${rcpt_addr}, 795 ${mail_mailer}, ${mail_host}, ${mail_addr} that hold 796 the results of parsing the RCPT and MAIL arguments, i.e. 797 the resolved triplet from $#mailer $@host $:addr. 798 From Kari Hurtta of the Finnish Meteorological Institute. 799 New macro ${client_resolve} which holds the result of the resolve 800 call for ${client_name}: OK, FAIL, FORGED, TEMP. Proposed 801 by Kari Hurtta of the Finnish Meteorological Institute. 802 New macros ${dsn_notify}, ${dsn_envid}, and ${dsn_ret} that hold 803 the corresponding DSN parameter values. Proposed by 804 Mathias Herberts. 805 New macro ${msg_size} which holds the value of the SIZE= parameter, 806 i.e., usually the size of the message (in an ESMTP dialogue), 807 before the message has been collected, thereafter it holds 808 the message size as computed by sendmail (and can be used 809 in check_compat). 810 The macro ${deliveryMode} now specifies the current delivery mode 811 sendmail is using instead of the value of the DeliveryMode 812 option. 813 New macro ${ntries} holds the number of delivery attempts. 814 Drop explicit From: if same as what would be generated only if it is 815 a local address. From Motonori Nakamura of Kyoto University. 816 Write pid to file also if sendmail only processes the queue. 817 Proposed by Roy J. Mongiovi of Georgia Tech. 818 Log "low on disk space" only when necessary. 819 New macro ${load_avg} can be used to check the current load average. 820 Suggested by Scott Gifford of The Internet Ramp. 821 Return-Receipt-To: header implies DSN request if option RrtImpliesDsn 822 is set. 823 Flag -S for maps to specify the character which is substituted 824 for spaces (instead of the default given by O BlankSub). 825 Flag -D for maps: perform no lookup in deferred delivery mode. 826 This flag is set by default for the host map. Based on a 827 proposal from Ian MacPhedran of the University of Saskatchewan. 828 Open maps only on demand, not at startup. 829 Log warning about unsupported IP address families. 830 New option MaxHeadersLength allows to specify a maximum length 831 of the sum of all headers. This can be used to prevent 832 a denial-of-service attack. 833 New option MaxMimeHeaderLength which limits the size of MIME 834 headers and parameters within those headers. This option 835 is intended to protect mail user agents from buffer 836 overflow attacks. 837 Added option MaxAliasRecursion to specify the maximum depth of 838 alias recursion. 839 New flag F=6 for mailers to strip headers to seven bit. 840 Map type syslog to log the key via syslogd. 841 Entries in the alias file can be continued by putting a backslash 842 directly before the newline. 843 New option DeadLetterDrop to define the location of the system-wide 844 dead.letter file, formerly hardcoded to 845 /usr/tmp/dead.letter. If this option is not set (the 846 default), sendmail will not attempt to save to a 847 system-wide dead.letter file if it can not bounce the mail 848 to the user nor postmaster. Instead, it will rename the qf 849 file as it has in the past when the dead.letter file 850 could not be opened. 851 New option PidFile to define the location of the pid file. The 852 value of this option is macro expanded. 853 New option ProcessTitlePrefix specifies a prefix string for the 854 process title shown in 'ps' listings. 855 New macros for use with the PidFile and ProcessTitlePrefix options 856 (along with the already existing macros): 857 ${daemon_info} Daemon information, e.g. 858 SMTP+queueing@00:30:00 859 ${daemon_addr} Daemon address, e.g., 0.0.0.0 860 ${daemon_family} Daemon family, e.g., inet, inet6, etc. 861 ${daemon_name} Daemon name, e.g., MSA. 862 ${daemon_port} Daemon port, e.g., 25 863 ${queue_interval} Queue run interval, e.g., 00:30:00 864 New macros especially for virtual hosting: 865 ${if_name} hostname of interface of incoming connection. 866 ${if_addr} address of interface of incoming connection. 867 The latter is only set if the interface does not belong to the 868 loopback net. 869 If a message being accepted via a method other than SMTP and 870 would be rejected by a header check, do not send the message. 871 Suggested by Phil Homewood of Mincom Pty Ltd. 872 Don't strip comments for header checks if $>+ is used instead of $>. 873 Provide header value as quoted string in the macro 874 ${currHeader} (possibly truncated to MAXNAME). Suggested by 875 Jan Krueger of Unix-AG of University of Hannover. 876 The length of the header value is stored in ${hdrlen}. 877 H*: allows to specify a default ruleset for header checks. This 878 ruleset will only be called if the individual header does 879 not have its own ruleset assigned. Suggested by Jan 880 Krueger of Unix-AG of University of Hannover. 881 The name of the header field stored in ${hdr_name}. 882 Comments (i.e., text within parentheses) in rulesets are not 883 removed if the config file version is greater than or equal 884 to 9. For example, "R$+ ( 1 ) $@ 1" matches the 885 input "token (1)" but does not match "token". 886 Avoid removing the Content-Transfer-Encoding MIME header on 887 MIME messages. Problem noted by Sigurbjorn B. Larusson of 888 Multimedia Consumer Services. Fix from Per Hedeland of 889 Ericsson. 890 Avoid duplicate Content-Transfer-Encoding MIME header on 891 messages with 8-bit text in headers. Problem noted by 892 Per Steinar Iversen of Oslo College. Fix from Per Hedeland 893 of Ericsson. 894 Avoid keeping maps locked longer than necessary when re-opening a 895 modified database map file. Problem noted by Chris Adams 896 of Renaissance Internet Services. 897 Resolving to the $#error mailer with a temporary failure code (e.g., 898 $#error $@ tempfail $: "400 Temporary failure") will now 899 queue up the message instead of bouncing it. 900 Be more liberal in acceptable responses to an SMTP RSET command as 901 standard does not provide any indication of what to do when 902 something other than 250 is received. Based on a patch 903 from Steve Schweinhart of America Online. 904 New option TrustedUser allows to specify a user who can own 905 important files instead of root. This requires HASFCHOWN. 906 Fix USERDB conditional so compiling with NEWDB or HESIOD and 907 setting USERDB=0 works. Fix from Jorg Zanger of Schock. 908 Fix another instance (similar to one in 8.9.3) of a network failure 909 being mis-logged as "Illegal Seek" instead of whatever 910 really went wrong. From John Beck of Sun Microsystems. 911 $? tests also whether the macro is non-null. 912 Print an error message if a mailer definition contains an invalid 913 equate name. 914 New mailer equate /= to specify a directory to chroot() into before 915 executing the mailer program. Suggested by Igor Vinokurov. 916 New mailer equate W= to specify the maximum time to wait for the 917 mailer to return after sending all data to it. 918 Only free memory from the process list when adding a new process 919 into a previously filled slot. Previously, the memory was 920 freed at removal time. Since removal can happen in a 921 signal handler, this may leave the memory map in an 922 inconsistent state. Problem noted by Jeff A. Earickson and 923 David Cooley of Colby College. 924 When using the UserDB @hostname catch-all, do not try to lookup 925 local users in the passwd file. The UserDB code has 926 already decided the message will be passed to another host 927 for processing. Fix from Tony Landells of Burdett 928 Buckeridge Young Limited. 929 Support LDAP authorization via either a file containing the 930 password or Kerberos V4 using the new map options 931 '-ddistinguished_name', '-Mmethod', and '-Pfilename'. The 932 distinguished_name is who to login as. The method can be 933 one of LDAP_AUTH_NONE, LDAP_AUTH_SIMPLE, or 934 LDAP_AUTH_KRBV4. The filename is the file containing the 935 secret key for LDAP_AUTH_SIMPLE or the name of the Kerberos 936 ticket file for LDAP_AUTH_KRBV4. Patch from Booker Bense 937 of Stanford University. 938 The ldapx map has been renamed to ldap. The use of ldapx is 939 deprecated and will be removed in a future version. 940 If the result of an LDAP search returns a multi-valued attribute 941 and the map has the column delimiter set, it turns that 942 response into a delimiter separated string. The LDAP map 943 will traverse multiple entries as well. LDAP alias maps 944 automatically set the column delimiter to the comma. 945 Based on patch from Booker Bense of Stanford University and 946 idea from Philip A. Prindeville of Mirapoint, Inc. 947 Support return of multiple values for a single LDAP lookup. The 948 values to be returned should be in a comma separated string. 949 For example, `-v "email,emailother"'. Patch from 950 Curtis W. Hillegas of Princeton University. 951 Allow the use of LDAP for alias maps. 952 If no LDAP attributes are specified in an LDAP map declaration, all 953 attributes found in the match will be returned. 954 Prevent commas in quoted strings in the AliasFile value from 955 breaking up a single entry into multiple entries. This is 956 needed for LDAP alias file specifications to allow for 957 comma separated key and value strings. 958 Keep connections to LDAP server open instead of opening and closing 959 for each lookup. To reduce overhead, sendmail will cache 960 connections such that multiple maps which use the same 961 host, port, bind DN, and authentication will only result in 962 a single connection to that host. 963 Put timeout in the proper place for USE_LDAP_INIT. 964 Be more careful about checking for errors and freeing memory on 965 LDAP lookups. 966 Use asynchronous LDAP searches to save memory and network 967 resources. 968 Do not copy LDAP query results if the map's match only flag is set. 969 Increase portability to the Netscape LDAP libraries. 970 Change the parsing of the LDAP filter specification. '%s' is still 971 replaced with the literal contents of the map lookup key -- 972 note that this means a lookup can be done using the LDAP 973 special characters. The new '%0' token can be used instead 974 of '%s' to encode the key buffer according to RFC 2254. 975 For example, if the LDAP map specification contains '-k 976 "(user=%s)"' and a lookup is done on "*", this would be 977 equivalent to '-k "(user=*)"' -- matching ANY record with a 978 user attribute. Instead, if the LDAP map specification 979 contains '-k "(user=%0)"' and a lookup is done on "*", this 980 would be equivalent to '-k "(user=\2A)"' -- matching a user 981 with the name "*". 982 New LDAP map flags: "-1" requires a single match to be returned, if 983 more than one is returned, it is equivalent to no records 984 being found; "-r never|always|search|find" sets the LDAP 985 alias dereference option; "-Z size" limits the number of 986 matches to return. 987 New option LDAPDefaultSpec allows a default map specification for 988 LDAP maps. The value should only contain LDAP specific 989 settings such as "-h host -p port -d bindDN", etc. The 990 settings will be used for all LDAP maps unless they are 991 specified in the individual map specification ('K' 992 command). This option should be set before any LDAP maps 993 are defined. 994 Prevent an NDBM alias file opening loop when the NDBM open 995 continually fails. Fix from Roy J. Mongiovi of Georgia 996 Tech. 997 Reduce memory utilization for smaller symbol table entries. In 998 particular, class entries get much smaller, which can be 999 important if you have large classes. 1000 On network-related temporary failures, record the hostname which 1001 gave error in the queued status message. Requested by 1002 Ulrich Windl of the Universitat Regensburg. 1003 Add new F=% mailer flag to allow for a store and forward 1004 configuration. Mailers which have this flag will not attempt 1005 delivery on initial receipt of a message or on queue runs 1006 unless the queued message is selected using one of the 1007 -qI/-qR/-qS queue run modifiers or an ETRN request. Code 1008 provided by Philip Guenther of Gustavus Adolphus College. 1009 New option ControlSocketName which, when set, creates a daemon 1010 control socket. This socket allows an external program to 1011 control and query status from the running sendmail daemon 1012 via a named socket, similar to the ctlinnd interface to the 1013 INN news server. Access to this interface is controlled by 1014 the UNIX file permissions on the named socket on most UNIX 1015 systems (see sendmail/README for more information). An 1016 example control program is provided as contrib/smcontrol.pl. 1017 Change the default values of QueueLA from 8 to (8 * numproc) and 1018 RefuseLA from 12 to (12 * numproc) where numproc is the 1019 number of processors online on the system (if that can be 1020 determined). For single processor machines, this change 1021 has no effect. 1022 Don't return body of message to postmaster on "Too many hops" bounces. 1023 Based on fix from Motonori Nakamura of Kyoto University. 1024 Give more detailed DSN descriptions for some cases. Patch from 1025 Motonori Nakamura of Kyoto University. 1026 Logging of alias, forward file, and UserDB expansion now happens 1027 at LogLevel 11 or higher instead of 10 or higher. 1028 Logging of an envelope's complete delivery (the "done" message) now 1029 happens at LogLevel 10 or higher instead of 11 or higher. 1030 Logging of TCP/IP or UNIX standard input connections now happens at 1031 LogLevel 10 or higher. Previously, only TCP/IP connections 1032 were logged, and on at LogLevel 12 or higher. Setting 1033 LogLevel to 10 will now assist users in tracking frequent 1034 connection-based denial of service attacks. 1035 Log basic information about authenticated connections at LogLevel 1036 10 or higher. 1037 Log SMTP Authentication mechanism and author when logging the sender 1038 information (from= syslog line). 1039 Log the DSN code for each recipient if one is available as a new 1040 equate (dsn=). 1041 Macro expand PostmasterCopy and DoubleBounceAddress options. 1042 New "ph" map for performing ph queries in rulesets. More 1043 information is available at 1044 http://www-dev.cso.uiuc.edu/sendmail/. Contributed by Mark 1045 Roth of the University of Illinois at Urbana-Champaign. 1046 Detect temporary lookup failures in the host map if looking up a 1047 bracketed IP address. Problem noted by Kari Hurtta of the 1048 Finnish Meteorological Institute. 1049 Do not report a Remote-MTA on local deliveries. Problem noted by 1050 Kari Hurtta of the Finnish Meteorological Institute. 1051 When a forward file points to an alias which runs a program, run 1052 the program as the default user and the default group, not 1053 the forward file user. This change also assures the 1054 :include: directives in aliases are also processed using 1055 the default user and group. Problem noted by Sergiu 1056 Popovici of DNT Romania. 1057 Prevent attempts to save a dead.letter file for a user with 1058 no home directory (/no/such/directory). Problem noted by 1059 Michael Brown of Finnigan FT/MS. 1060 Include message delay and number of tries when logging that a 1061 message has been completely delivered (LogLevel of 10 or 1062 above). Suggested by Nick Hilliard of Ireland Online. 1063 Log the sender of a message even if none of the recipients were 1064 accepted. If some of the recipients were rejected, it is 1065 helpful to know the sender of the message. 1066 Check the root directory (/) when checking a path for safety. 1067 Problem noted by John Beck of Sun Microsystems. 1068 Prevent multiple responses to the DATA command if DeliveryMode is 1069 interactive and delivering to an alias which resolves to 1070 multiple files. 1071 Macros in the helpfile are expanded if the helpfile version is 2 or 1072 greater (see below); the help function doesn't print the 1073 version of sendmail any longer, instead it is placed in 1074 the helpfile ($v). Suggested by Chuck Foster of UUNET 1075 PIPEX. Additionally, comment lines (starting with #) are 1076 skipped and a version line (#vers) is introduced. The 1077 helpfile version for 8.10.0 is 2, if no version or an older 1078 version is found, a warning is logged. The '#vers' 1079 directive should be placed at the top of the help file. 1080 Use fsync() when delivering to a file to guarantee the delivery to 1081 disk succeeded. Suggested by Nick Christenson. 1082 If delivery to a file is unsuccessful, truncate the file back to its 1083 length before the attempt. 1084 If a forward points to a filename for delivery, change to the 1085 user's uid before checking permissions on the file. This 1086 allows delivery to files on NFS mounted directories where 1087 root is remapped to nobody. Problem noted by Harald 1088 Daeubler of Universitaet Ulm. 1089 purgestat and sendmail -bH purge only expired (Timeout.hoststatus) 1090 host status files, not all files. 1091 Any macros stored in the class $={persistentMacros} will be saved 1092 in the queue file for the message and set when delivery 1093 is attempted on the queued item. Suggested by Kyle Jones of 1094 Wonderworks Inc. 1095 Add support for storing information between rulesets using the new 1096 macro map class. This can be used to store information 1097 between queue runs as well using $={persistentMacros}. 1098 Based on an idea from Jan Krueger of Unix-AG of University 1099 of Hannover. 1100 New map class arith to allow for computations in rules. The 1101 operation (+, -, *, /, l (for less than), and =) is given 1102 as key. The two operands are specified as arguments; the 1103 lookup returns the result of the computation. For example, 1104 "$(arith l $@ 4 $@ 2 $)" will return "FALSE" and 1105 "$(arith + $@ 4 $@ 2 $)" will return "6". 1106 Add new syntax for header declarations which decide whether to 1107 include the header based on a macro rather than a mailer 1108 flag: 1109 H?${MyMacro}?X-My-Header: ${MyMacro} 1110 This should be used along with $={persistentMacros}. 1111 It can be used for adding headers to a message based on 1112 the results of check_* and header check rulesets. 1113 Allow new named config file rule check_eoh which is called after 1114 all of the headers have been collected. The input to the 1115 ruleset the number of headers and the size of all of the 1116 headers in bytes separated by $|. This ruleset along with 1117 the macro storage map can be used to correlate information 1118 gathered between headers and to check for missing headers. 1119 See cf/README or doc/op/op.ps for an example. 1120 Change the default for the MeToo option to True to correspond 1121 to the clarification in the DRUMS SMTP Update spec. This 1122 option is deprecated and will be removed from a future 1123 version. 1124 Change the sendmail binary default for SendMimeErrors to True. 1125 Change the sendmail binary default for SuperSafe to True. 1126 Display ruleset names in debug and address test mode output 1127 if referencing a named ruleset. 1128 New mailer equate m= which will limit the number of messages 1129 delivered per connection on an SMTP or LMTP mailer. 1130 Improve QueueSortOrder=Host by reversing the hostname before 1131 using it to sort. Now all the same domains are really run 1132 through the queue together. If they have the same MX host, 1133 then they will have a much better opportunity to use the 1134 connection cache if available. This should be a reasonable 1135 performance improvement. Patch from Randall Winchester of 1136 the University of Maryland. 1137 If a message is rejected by a header check ruleset, log who would 1138 have received the message if it had not been rejected. 1139 New "now" value for Timeout.queuereturn to bounce entries from the 1140 queue immediately. No delivery attempt is made. 1141 Increase sleeping time exponentially after too many "bad" commands 1142 up to 4 minutes delay (compare MAX{BAD,NOOP,HELO,VRFY,ETRN}- 1143 COMMANDS). 1144 New option ClientPortOptions similar to DaemonPortOptions 1145 but for outgoing connections. 1146 New suboptions for DaemonPortOptions: Name (a name used for 1147 error messages and logging) and Modifiers, i.e. 1148 a require authentication 1149 b bind to interface through which mail has 1150 been received 1151 c perform hostname canonification 1152 f require fully qualified hostname 1153 h use name of interface for outgoing HELO 1154 command 1155 C don't perform hostname canonification 1156 E disallow ETRN (see RFC 2476) 1157 New suboption for ClientPortOptions: Modifiers, i.e. 1158 h use name of interface for HELO command 1159 The version number for queue files (qf) has been incremented to 4. 1160 Log unacceptable HELO/EHLO domain name attempts if LogLevel is set 1161 to 10 or higher. Suggested by Rick Troxel of the National 1162 Institutes of Health. 1163 If a mailer dies, print the status in decimal instead of octal 1164 format. Suggested by Michael Shapiro of Sun Microsystems. 1165 Limit the length of all MX records considered for delivery to 8k. 1166 Move message priority from sender to recipient logging. Suggested by 1167 Ulrich Windl of the Universitat Regensburg. 1168 Add support for Berkeley DB 3.X. 1169 Add fix for Berkeley DB 2.X fcntl() locking race condition. 1170 Requires a post-2.7.5 version of Berkeley DB. 1171 Support writing traffic log (sendmail -X option) to a FIFO. 1172 Patch submitted by Rick Heaton of Network Associates, Inc. 1173 Do not ignore Timeout settings in the .cf file when a Timeout 1174 sub-options is set on the command line. Problem noted by 1175 Graeme Hewson of Oracle. 1176 Randomize equal preference MX records each time delivery is 1177 attempted via a new connection to a host instead of once per 1178 session. Suggested by Scott Salvidio of Compaq. 1179 Implement enhanced status codes as defined by RFC 2034. 1180 Add [hostname] to class w for the names of all interfaces unless 1181 DontProbeInterfaces is set. This is useful for sending mails 1182 to hosts which have dynamically assigned names. 1183 If a message is bounced due to bad MIME conformance, avoid bouncing 1184 the bounce for the same reason. If the body is not 8-bit 1185 clean, and EightBitMode isn't set to pass8, the body will 1186 not be included in the bounce. Problem noted by Valdis 1187 Kletnieks of Virginia Tech. 1188 The timeout for sending a message via SMTP has been changed from 1189 '${msgsize} / 16 + (${nrcpts} * 300)' to a timeout which 1190 simply checks for progress on sending data every 5 minutes. 1191 This will detect the inability to send information quicker 1192 and reduce the number of processes simply waiting to 1193 timeout. 1194 Prevent a segmentation fault on systems which give a partial filled 1195 interface address structure when loading the system network 1196 interface addresses. Fix from Reinier Bezuidenhout of 1197 Nanoteq. 1198 Add a compile-time configuration macro, MAXINTERFACES, which 1199 indicates the number of interfaces to read when probing 1200 for hostnames and IP addresses for class w ($=w). The 1201 default value is 512. Based on idea from Reinier 1202 Bezuidenhout of Nanoteq. 1203 If the RefuseLA option is set to 0, do not reject connections based 1204 on load average. 1205 Allow ruleset 0 to have a name. Problem noted by Neil Rickert of 1206 Northern Illinois University. 1207 Expand the Return-Path: header at delivery time, after "owner-" 1208 envelope splitting has occurred. 1209 Don't try to sort the queue if there are no entries. Patch from 1210 Luke Mewburn from RMIT University. 1211 Add a "/quit" command to address test mode. 1212 Include the proper sender in the UNIX "From " line and Return-Path: 1213 header when undeliverable mail is saved to ~/dead.letter. 1214 Problem noted by Kari Hurtta of the Finnish Meteorological 1215 Institute. 1216 The contents of a class can now be copied to another class using 1217 the syntax: "C{Dest} $={Source}". This would copy all of 1218 the items in class $={Source} into the class $={Dest}. 1219 Include original envelope's error transcript in bounces created for 1220 split (owner-) envelopes to see the original errors when 1221 the recipients were added. Based on fix from Motonori 1222 Nakamura of Kyoto University. 1223 Show reason for permanent delivery errors directly after the 1224 addresses. From Motonori Nakamura of Kyoto University. 1225 Prevent a segmentation fault when bouncing a split-envelope 1226 message. Patch from Motonori Nakamura of Kyoto University. 1227 If the specification for the queue run interval (-q###) has a 1228 syntax error, consider the error fatal and exit. 1229 Pay attention to CheckpointInterval during LMTP delivery. Problem 1230 noted by Motonori Nakamura of Kyoto University. 1231 On operating systems which have setlogin(2), use it to set the 1232 login name to the RunAsUserName when starting as a daemon. 1233 This is for delivery to programs which use getlogin(). 1234 Based on fix from Motonori Nakamura of Kyoto University. 1235 Differentiate between "command not implemented" and "command 1236 unrecognized" in the SMTP dialogue. 1237 Strip returns from forward and include files. Problem noted by 1238 Allan E Johannesen of Worcester Polytechnic Institute. 1239 Prevent a core dump when using 'sendmail -bv' on an address which 1240 resolves to the $#error mailer with a temporary failure. 1241 Based on fix from Neil Rickert of Northern Illinois 1242 University. 1243 Prevent multiple deliveries of a message with a "non-local alias" 1244 pointing to a local user, if canonicalization fails 1245 the message was requeued *and* delivered to the alias. 1246 If an invalid ruleset is declared, the ruleset name could be 1247 ignored and its rules added to S0. Instead, ignore the 1248 ruleset lines as well. 1249 Avoid incorrect Final-Recipient, Action, and X-Actual-Recipient 1250 success DSN fields as well as duplicate entries for a 1251 single address due to S5 and UserDB processing. Problems 1252 noted by Kari Hurtta of the Finnish Meteorological 1253 Institute. 1254 Turn off timeouts when exiting sendmail due to an interrupt signal 1255 to prevent the timeout from firing during the exit process. 1256 Problem noted by Michael Shapiro of Sun Microsystems. 1257 Do not append @MyHostName to non-RFC822 addresses output by the EXPN 1258 command or on Final-Recipient: and X-Actual-Recipient: DSN 1259 headers. Non-RFC822 addresses include deliveries to 1260 programs, file, DECnet, etc. 1261 Fix logic for determining if a local user is using -f or -bs to 1262 spoof their return address. Based on idea from Neil Rickert 1263 of Northern Illinois University and patch from Per Hedeland 1264 of Ericsson. 1265 Report the proper UID in the bounce message if an :include: file is 1266 owned by a uid that doesn't map to a username and the 1267 :include: file contains delivery to a file or program. 1268 Problem noted by John Beck of Sun Microsystems. 1269 Avoid the attempt of trying to send a second SMTP QUIT command if 1270 the remote server responds to the first QUIT with a 4xx 1271 response code and drops the connection. This behavior was 1272 noted by Ulrich Windl of the Universitat Regensburg when 1273 sendmail was talking to the Mercury 1.43 MTA. 1274 If a hostname lookup times out and ServiceSwitchFile is set but the 1275 file is not present, the lookup failure would be marked as 1276 a permanent failure instead of a temporary failure. Fix 1277 from Russell King of the ARM Linux Project. 1278 Handle aliases or forwards which deliver to programs using tabs 1279 instead of spaces between arguments. Problem noted by Randy 1280 Wormser. Fix from Neil Rickert of Northern Illinois 1281 University. 1282 Allow MaxRecipientsPerMessage option to be set on the command line 1283 by normal users (e.g., sendmail won't drop its root 1284 privileges) to allow overrides for message submission via 1285 'sendmail -bs'. 1286 Set the names for help file and statistics file to "helpfile" and 1287 "statistics", respectively, if no parameters are given for 1288 them in the .cf file. 1289 Avoid bogus 'errbody: I/O Error -7' log messages when sending 1290 success DSN messages for messages relayed to non-DSN aware 1291 systems. Problem noted by Juergen Georgi of RUS University 1292 of Stuttgart and Kyle Tucker of Parexel International. 1293 Prevent +detail information from interfering with local delivery to 1294 multiple users in the same transaction (F=m). 1295 Add H_FORCE flag for the X-Authentication-Warning: header, so it 1296 will be added even if one already exists. Problem noted 1297 by Michal Zalewski of Marchew Industries. 1298 Stop processing SMTP commands if the SMTP connection is dropped. 1299 This prevents a remote system from flooding the connection 1300 with commands and then disconnecting. Previously, the 1301 server would process all of the buffered commands. Problem 1302 noted by Michal Zalewski of Marchew Industries. 1303 Properly process user-supplied headers beginning with '?'. Problem 1304 noted by Michal Zalewski of Marchew Industries. 1305 If multiple header checks resolve to the $#error mailer, use the 1306 last permanent (5XX) failure if any exist. Otherwise, use 1307 the last temporary (4XX) failure. 1308 RFC 1891 requires "hexchar" in a "xtext" to be upper case. Patch 1309 from Ronald F. Guilmette of Infinite Monkeys & Co. 1310 Timeout.ident now defaults to 5 seconds instead of 30 seconds to 1311 prevent the now common delays associated with mailing to a 1312 site which drops IDENT packets. Suggested by many. 1313 Persistent host status data is not reloaded disk when current data 1314 is available in the in-memory cache. Problem noted by Per 1315 Hedeland of Ericsson. 1316 mailq displays unprintable characters in addresses as their octal 1317 representation and a leading backslash. This avoids problems 1318 with "unprintable" characters. Problem noted by Michal 1319 Zalewski of the "Internet for Schools" project (IdS). 1320 The mail line length limit (L= equate) was adding the '!' indicator 1321 one character past the limit. This would cause subsequent 1322 hops to break the line again. The '!' is now placed in 1323 the last column of the limit if the line needs to be broken. 1324 Problem noted by Joe Pruett of Q7 Enterprises. Based on fix 1325 from Per Hedeland of Ericsson. 1326 If a resolver ANY query is larger than the UDP packet size, the 1327 resolver will fall back to TCP. However, some 1328 misconfigured firewalls black 53/TCP so the ANY lookup 1329 fails whereas an MX or A record might succeed. Therefore, 1330 don't fail on ANY queries. 1331 If an SMTP recipient is rejected due to syntax errors in the 1332 address, do not send an empty postmaster notification DSN 1333 to the postmaster. Problem noted by Neil Rickert of 1334 Northern Illinois University. 1335 Allow '_' and '.' in map names when parsing a sequence map 1336 specification. Patch from William Setzer of North Carolina 1337 State University. 1338 Fix hostname in logging of read timeouts for the QUIT command on 1339 cached connections. Problem noted by Neil Rickert of 1340 Northern Illinois University. 1341 Use a more descriptive entry to log "null" connections, i.e., 1342 "host did not issue MAIL/EXPN/VRFY/ETRN during connection". 1343 Fix a file descriptor leak in ONEX mode. 1344 Portability: 1345 Reverse signal handling logic such that sigaction(2) with 1346 the SA_RESTART flag is the preferred method and the 1347 other signal methods are only tried if SA_RESTART 1348 is not available. Problem noted by Allan E 1349 Johannesen of Worcester Polytechnic Institute. 1350 AIX 4.x supports the sa_len member of struct sockaddr. 1351 This allows network interface probing to work 1352 properly. Fix from David Bronder of the 1353 University of Iowa. 1354 AIX 4.3 has snprintf() support. 1355 Use "PPC" as the architecture name when building under 1356 AIX. This will be reflected in the obj.* directory 1357 name. 1358 Apple Darwin support based on Apple Rhapsody port. 1359 Fixed AIX 'make depend' method from Valdis Kletnieks of 1360 Virginia Tech. 1361 Digital UNIX has uname(2). 1362 GNU Hurd updates from Mark Kettenis of the University of 1363 Amsterdam. 1364 Improved HPUX 11.0 portability. 1365 Properly determine the number of CPUs on FreeBSD 2.X, 1366 FreeBSD 3.X, HP/UX 10.X and HP/UX 11.X. 1367 Remove special IRIX ABI cases from Build script and the OS 1368 files. Use the standard 'cc' options used by SGI 1369 in building the operating system. Users can 1370 override the defaults by setting confCC and 1371 confLIBSEARCHPATH appropriately. 1372 IRIX nsd map support from Bob Mende of SGI. 1373 Minor devtools fixes for IRIX from Bob Mende of SGI. 1374 Linux patch for IP_SRCROUTE support from Joerg Dorchain 1375 of MW EDV & ELECTRONIC. 1376 Linux now uses /usr/sbin for confEBINDIR in the build 1377 system. From MATSUURA Takanori of Osaka University. 1378 Remove special treatment for Linux PPC in the build 1379 system. From MATSUURA Takanori of Osaka University. 1380 Motorolla UNIX SYSTEM V/88 Release 4.0 support from 1381 Sergey Rusanov of the Republic of Udmurtia. 1382 NCR MP-RAS 3.x includes regular expression support. From 1383 Tom J. Moore of NCR. 1384 NEC EWS-UX/V series settings for _PATH_VENDOR_CF and 1385 _PATH_SENDMAILPID from Oota Toshiya of 1386 NEC Computers Group Planning Division. 1387 Minor NetBSD owner/group tweaks from Ayamura Kikuchi, M.D. 1388 NEWS-OS 6.X listed SYSLOG_BUFSIZE as 256 in confENVDEF and 1389 1024 in conf.h. Since confENVDEF would be used, 1390 use that value in conf.h. 1391 Use NeXT's NETINFO to get domain name. From Gerd Knops of 1392 BITart Consulting. 1393 Use NeXT's NETINFO for alias and hostname resolution if 1394 AUTO_NETINFO_ALIASES and AUTO_NETINFO_HOSTS are 1395 defined. Patch from Wilfredo Sanchez of Apple 1396 Computer, Inc. 1397 NeXT portability tweaks. Problems reported by Dragan 1398 Milicic of the University of Utah and J. P. McCann 1399 of E I A. 1400 New compile flag FAST_PID_RECYCLE: set this if your system 1401 can reuse the same PID in the same second. 1402 New compile flag HASFCHOWN: set this if your OS has 1403 fchown(2). 1404 New compile flag HASRANDOM: set this to 0 if your OS does 1405 not have random(3). rand() will be used instead. 1406 New compile flag HASSRANDOMDEV: set this if your OS has 1407 srandomdev(3). 1408 New compile flag HASSETLOGIN: set this if your OS has 1409 setlogin(2). 1410 Replace SINIX and ReliantUNIX support with version 1411 specific SINIX files. From Gerald Rinske of 1412 Siemens Business Services. 1413 Use the 60-second load average instead of the 5 second load 1414 average on Compaq Tru64 UNIX (formerly Digital 1415 UNIX). From Chris Teakle of the University of Qld. 1416 Use ANSI C by default for Compaq Tru64 UNIX. Suggested by 1417 Randall Winchester of Swales Aerospace. 1418 Correct setgroups() prototype for Compaq Tru64 UNIX. 1419 Problem noted by Randall Winchester of Swales 1420 Aerospace. 1421 Hitachi 3050R/3050RX and 3500 Workstations running 1422 HI-UX/WE2 4.02, 6.10 and 7.10 from Motonori 1423 NAKAMURA of Kyoto University. 1424 New compile flag NO_GETSERVBYNAME: set this to disable 1425 use of getservbyname() on systems which can 1426 not lookup a service by name over NIS, such as 1427 HI-UX. Patch from Motonori NAKAMURA of Kyoto 1428 University. 1429 Use devtools/bin/install.sh on SCO 5.x. Problem noted 1430 by Sun Wenbing of the China Engineering and 1431 Technology Information Network. 1432 make depend didn't work properly on UNIXWARE 4.2. Problem 1433 noted by Ariel Malik of Netology, Ltd. 1434 Use /usr/lbin as confEBINDIR for Compaq Tru64 (Digital UNIX). 1435 Set confSTDIO_TYPE to torek for BSD-OS, FreeBSD, NetBSD, 1436 and OpenBSD. 1437 A recent Compaq Ultrix 4.5 Y2K patch has broken detection 1438 of local_hostname_length(). See sendmail/README 1439 for more details. Problem noted by Allan E 1440 Johannesen of Worcester Polytechnic Institute. 1441 CONFIG: Begin using /etc/mail/ for sendmail related files. This 1442 affects a large number of files. See cf/README for more 1443 details. 1444 CONFIG: New macro MAIL_SETTINGS_DIR contains the path (including 1445 trailing slash) for the mail settings directory. 1446 CONFIG: Increment version number of config file to 9. 1447 CONFIG: OSTYPE(`bsdi1.0') and OSTYPE(`bsdi2.0') have been 1448 deprecated and may be removed from a future release. 1449 BSD/OS users should begin using OSTYPE(`bsdi'). 1450 CONFIG: OpenBSD 2.4 installs mail.local non-setuid root. This 1451 requires a new OSTYPE(`openbsd'). From Todd C. Miller of 1452 Courtesan Consulting. 1453 CONFIG: New OSTYPE(`hpux11') for HP/UX 11.X. 1454 CONFIG: A syntax error in check_mail would cause fake top-level 1455 domains (.BITNET, .DECNET, .FAX, .USENET, and .UUCP) to 1456 be improperly rejected as unresolvable. 1457 CONFIG: New FEATURE(`dnsbl') takes up to two arguments (name of 1458 DNS server, rejection message) and can be included 1459 multiple times. 1460 CONFIG: New FEATURE(`relay_mail_from') allows relaying if the 1461 mail sender is listed as RELAY in the access map (and tagged 1462 with From:). 1463 CONFIG: Optional tagging of LHS in the access map (Connect:, 1464 From:, To:) to enable finer control. 1465 CONFIG: New FEATURE(`ldap_routing') implements LDAP address 1466 routing. See cf/README for a complete description of the 1467 new functionality. 1468 CONFIG: New variables for the new sendmail options: 1469 confAUTH_MECHANISMS AuthMechanisms 1470 confAUTH_OPTIONS AuthOptions 1471 confCLIENT_OPTIONS ClientPortOptions 1472 confCONTROL_SOCKET_NAME ControlSocketName 1473 confDEAD_LETTER_DROP DeadLetterDrop 1474 confDEF_AUTH_INFO DefaultAuthInfo 1475 confDF_BUFFER_SIZE DataFileBufferSize 1476 confLDAP_DEFAULT_SPEC LDAPDefaultSpec 1477 confMAX_ALIAS_RECURSION MaxAliasRecursion 1478 confMAX_HEADERS_LENGTH MaxHeadersLength 1479 confMAX_MIME_HEADER_LENGTH MaxMimeHeaderLength 1480 confPID_FILE PidFile 1481 confPROCESS_TITLE_PREFIX ProcessTitlePrefix 1482 confRRT_IMPLIES_DSN RrtImpliesDsn 1483 confTO_CONTROL Timeout.control 1484 confTO_RESOLVER_RETRANS Timeout.resolver.retrans 1485 confTO_RESOLVER_RETRANS_FIRST Timeout.resolver.retrans.first 1486 confTO_RESOLVER_RETRANS_NORMAL Timeout.resolver.retrans.normal 1487 confTO_RESOLVER_RETRY Timeout.resolver.retry 1488 confTO_RESOLVER_RETRY_FIRST Timeout.resolver.retry.first 1489 confTO_RESOLVER_RETRY_NORMAL Timeout.resolver.retry.normal 1490 confTRUSTED_USER TrustedUser 1491 confXF_BUFFER_SIZE XscriptFileBufferSize 1492 CONFIG: confDAEMON_OPTIONS has been replaced by DAEMON_OPTIONS(), 1493 which takes the options as argument and can be used 1494 multiple times; see cf/README for details. 1495 CONFIG: Add a fifth mailer definition to MAILER(`smtp') called 1496 "dsmtp". This mail provides on-demand delivery using the 1497 F=% mailer flag described above. The "dsmtp" mailer 1498 definition uses the new DSMTP_MAILER_ARGS which defaults 1499 to "IPC $h". 1500 CONFIG: New variables LOCAL_MAILER_MAXMSGS, SMTP_MAILER_MAXMSGS, 1501 and RELAY_MAILER_MAXMSGS for setting the m= equate for the 1502 local, smtp, and relay mailers respectively. 1503 CONFIG: New variable LOCAL_MAILER_DSN_DIAGNOSTIC_CODE for setting 1504 the DSN Diagnostic-Code type for the local mailer. The 1505 value should be changed with care. 1506 CONFIG: FEATURE(`local_lmtp') now sets the DSN Diagnostic-Code type 1507 for the local mailer to the proper value of "SMTP". 1508 CONFIG: All included maps are no longer optional by default; if 1509 there there is a problem with a map, sendmail will 1510 complain. 1511 CONFIG: Removed root from class E; use EXPOSED_USER(`root') 1512 to get the old behavior. Suggested by Joe Pruett 1513 of Q7 Enterprises. 1514 CONFIG: MASQUERADE_EXCEPTION() defines hosts/subdomains which 1515 will not be masqueraded. Proposed by Arne Wichmann 1516 of MPI Saarbruecken, Griff Miller of PGS Tensor, 1517 Jayme Cox of Broderbund Software Inc. 1518 CONFIG: A list of exceptions for FEATURE(`nocanonify') can be 1519 specified by CANONIFY_DOMAIN or CANONIFY_DOMAIN_FILE, 1520 i.e., a list of domains which are passed to $[ ... $] 1521 for canonification. Based on an idea from Neil Rickert 1522 of Northern Illinois University. 1523 CONFIG: If `canonify_hosts' is specified as parameter for 1524 FEATURE(`nocanonify') then addresses which have only 1525 a hostname, e.g., <user@host>, will be canonified. 1526 CONFIG: If FEATURE(`nocanonify') is turned on, a trailing dot is 1527 nevertheless added to addresses with more than one component 1528 in it. 1529 CONFIG: Canonification is no longer attempted for any host or domain 1530 in class 'P' ($=P). 1531 CONFIG: New class for matching virtusertable entries $={VirtHost} that 1532 can be populated by VIRTUSER_DOMAIN or VIRTUSER_DOMAIN_FILE. 1533 FEATURE(`virtuser_entire_domain') can be used to apply this 1534 class also to entire subdomains. Hosts in this class are 1535 treated as canonical in SCanonify2, i.e., a trailing dot 1536 is added. 1537 CONFIG: If VIRTUSER_DOMAIN() or VIRTUSER_DOMAIN_FILE() are used, 1538 include $={VirtHost} in $=R (hosts allowed to relay). 1539 CONFIG: FEATURE(`generics_entire_domain') can be used to apply the 1540 genericstable also to subdomains of $=G. 1541 CONFIG: Pass "+detail" as %2 for virtusertable lookups. 1542 Patch from Noam Freedman from University of Chicago. 1543 CONFIG: Pass "+detail" as %1 for genericstable lookups. Suggested 1544 by Raymond S Brand of rsbx.net. 1545 CONFIG: Allow @domain in genericstable to override masquerading. 1546 Suggested by Owen Duffy from Owen Duffy & Associates. 1547 CONFIG: LOCAL_DOMAIN() adds entries to class w. Suggested by Steve 1548 Hubert of University of Washington. 1549 CONFIG: OSTYPE(`gnuhurd') has been replaced by OSTYPE(`gnu') as 1550 GNU is now the canonical system name. From Mark 1551 Kettenis of the University of Amsterdam. 1552 CONFIG: OSTYPE(`unixware7') updates from Larry Rosenman. 1553 CONFIG: Do not include '=' in option expansion if there is no value 1554 associated with the option. From Andrew Brown of 1555 Graffiti World Wide, Inc. 1556 CONFIG: Add MAILER(`qpage') to define a new pager mailer. Contributed 1557 by Philip A. Prindeville of Enteka Enterprise Technology 1558 Services. 1559 CONFIG: MAILER(`cyrus') was not preserving case for mail folder 1560 names. Problem noted by Randall Winchester of Swales 1561 Aerospace. 1562 CONFIG: RELAY_MAILER_FLAGS can be used to define additional flags 1563 for the relay mailer. Suggested by Doug Hughes of Auburn 1564 University and Brian Candler. 1565 CONFIG: LOCAL_MAILER_FLAGS now includes 'P' (Add Return-Path: 1566 header) by default. Suggested by Per Hedeland of Ericsson. 1567 CONFIG: Use SMART_HOST for bracketed addresses, e.g., user@[host]. 1568 Suggested by Kari Hurtta of the Finnish Meteorological 1569 Institute. 1570 CONFIG: New macro MODIFY_MAILER_FLAGS to tweak *_MAILER_FLAGS; 1571 i.e., to set, add, or delete flags. 1572 CONFIG: If SMTP AUTH is used then relaying is allowed for any user 1573 who authenticated via a "trusted" mechanism, i.e., one that 1574 is defined via TRUST_AUTH_MECH(`list of mechanisms'). 1575 CONFIG: FEATURE(`delay_checks') delays check_mail and check_relay 1576 after check_rcpt and allows for exceptions from the checks. 1577 CONFIG: Map declarations have been moved into their associated 1578 feature files to allow greater flexibility in use of 1579 sequence maps. Suggested by Per Hedeland of Ericsson. 1580 CONFIG: New macro LOCAL_MAILER_EOL to override the default end of 1581 line string for the local mailer. Requested by Il Oh of 1582 Willamette Industries, Inc. 1583 CONFIG: Route addresses are stripped, i.e., <@a,@b,@c:user@d> is 1584 converted to <user@d> 1585 CONFIG: Reject bogus return address of <@@hostname>, generated by 1586 Sun's older, broken configuration files. 1587 CONFIG: FEATURE(`nullclient') now provides the full rulesets of a 1588 normal configuration, allowing anti-spam checks to be 1589 performed. 1590 CONFIG: Don't return a permanent error (Relaying denied) if 1591 ${client_name} can't be resolved just temporarily. 1592 Suggested by Kari Hurtta of the Finnish Meteorological 1593 Institute. 1594 CONFIG: Change numbered rulesets into named (which still can 1595 be accessed by their numbers). 1596 CONFIG: FEATURE(`nouucp') takes one parameter: reject or nospecial 1597 which describes whether to disallow "!" in the local part 1598 of an address. 1599 CONFIG: Call Local_localaddr from localaddr (S5) which can be used 1600 to rewrite an address from a mailer which has the F=5 flag 1601 set. If the ruleset returns a mailer, the appropriate 1602 action is taken, otherwise the returned tokens are ignored. 1603 CONFIG: cf/ostype/solaris.m4 has been renamed to solaris2.pre5.m4 1604 and cf/ostype/solaris2.m4 is now a copy of solaris2.ml.m4. 1605 The latter is kept around for backward compatibility. 1606 CONFIG: Allow ":D.S.N:" for mailer/virtusertable "error:" entries, 1607 where "D.S.N" is an RFC 1893 compliant error code. 1608 CONFIG: Use /usr/lbin as confEBINDIR for Compaq Tru64 (Digital UNIX). 1609 CONFIG: Remove second space between username and date in UNIX From_ 1610 line. Noted by Allan E Johannesen of Worcester Polytechnic 1611 Institute. 1612 CONFIG: Make sure all of the mailers have complete T= equates. 1613 CONFIG: Extend FEATURE(`local_procmail') so it can now take 1614 arguments overriding the mailer program, arguments, and 1615 mailer definition flags. This makes it possible to use 1616 other programs such as maildrop for local delivery. 1617 CONFIG: Emit warning if FEATURE(`local_lmtp') or 1618 FEATURE(`local_procmail') is given after MAILER(`local'). 1619 Patch from Richard A. Nelson of IBM. 1620 CONFIG: Add SMTP Authentication information to Received: header 1621 default value (confRECEIVED_HEADER). 1622 CONFIG: Remove `l' flag from USENET_MAILER_FLAGS as it is not a 1623 local mailer. Problem noted by Per Hedeland of Ericsson. 1624 CONTRIB: Added bounce-resender.pl from Brian R. Gaeke of the 1625 University of California at Berkeley. 1626 CONTRIB: Added domainmap.m4 from Mark D. Roth of the University of 1627 Illinois at Urbana-Champaign. 1628 CONTRIB: etrn.pl now recognizes bogus host names. Patch from 1629 Bruce Barnett of GE's R&D Lab. 1630 CONTRIB: Patches for re-mqueue.pl by Graeme Hewson of Oracle 1631 Corporation UK. 1632 CONTRIB: Added qtool.pl to assist in managing the queues. 1633 DEVTOOLS: Prevent user environment variables from interfering with 1634 the Build scripts. Problem noted by Ezequiel H. Panepucci of 1635 Yale University. 1636 DEVTOOLS: 'Build -M' will display the obj.* directory which will 1637 be used for building. 1638 DEVTOOLS: 'Build -A' will display the architecture that would be 1639 used for a fresh build. 1640 DEVTOOLS: New variable confRANLIB, set automatically by configure.sh. 1641 DEVTOOLS: New variable confRANLIBOPTS for the options to send to 1642 ranlib. 1643 DEVTOOLS: 'Build -O <path>' will have the object files build in 1644 <path>/obj.*. Suggested by Bryan Costales of Exactis. 1645 DEVTOOLS: New variable confNO_MAN_BUILD which will prevent the 1646 building of the man pages when defined. Suggested by Bryan 1647 Costales. 1648 DEVTOOLS: New variables confNO_HELPFILE_INSTALL and 1649 confNO_STATISTICS_INSTALL which will prevent the 1650 installation of the sendmail helpfile and statistics file 1651 respectively. Suggested by Bryan Costales. 1652 DEVTOOLS: Recognize ReliantUNIX as SINIX. Patch from Gerald Rinske 1653 of Siemens Business Services. 1654 DEVTOOLS: New variable confSTDIO_TYPE which defines the type of 1655 stdio library. The new buffered file I/O depends on the 1656 Torek stdio library. This option can be either portable or 1657 torek. 1658 DEVTOOLS: New variables confSRCADD and confSMSRCADD which 1659 correspond to confOBJADD and confSMOBJADD respectively. 1660 They should contain the C source files for the object files 1661 listed in confOBJADD and confSMOBJADD. These file names 1662 will be passed to the 'make depend' stage of compilation. 1663 DEVTOOLS: New program specific variables for each of the programs 1664 in the sendmail distribution. Each has the form 1665 `conf_prog_ENVDEF', for example, `conf_sendmail_ENVDEF'. 1666 The new variables are conf_prog_ENVDEF, conf_prog_LIBS, 1667 conf_prog_SRCADD, and conf_prog_OBJADD. 1668 DEVTOOLS: Build system redesign. This should have little affect on 1669 building the distribution, but documentation on the changes 1670 are in devtools/README. 1671 DEVTOOLS: Don't allow 'Build -f file' if an object directory already 1672 exists. Suggested by Valdis Kletnieks of Virginia Tech. 1673 DEVTOOLS: Rename confSRCDIR to confSMSRCDIR since it only identifies 1674 the path to the sendmail source directory. confSRCDIR is a 1675 new variable which identifies the root of the source 1676 directories for all of the programs in the distribution. 1677 DEVTOOLS: confSRCDIR and confSMSRCDIR are now determined at Build 1678 time. They can both still be overridden by setting the m4 1679 macro. 1680 DEVTOOLS: confSBINGRP now defaults to bin instead of kmem. 1681 DEVTOOLS: 'Build -Q prefix' uses devtools/Site/prefix.*.m4 for 1682 build configurations, and places objects in obj.prefix.*/. 1683 Complains as 'Build -f file' does for existing object 1684 directories. Suggested by Tom Smith of Digital Equipment 1685 Corporation. 1686 DEVTOOLS: Setting confINSTALL_RAWMAN will install unformatted 1687 manual pages in the directory tree specified by 1688 confMANROOTMAN. 1689 DEVTOOLS: If formatting the manual pages fails, copy in the 1690 preformatted pages from the distribution. The new variable 1691 confCOPY specifies the copying program. 1692 DEVTOOLS: Defining confFORCE_RMAIL will install rmail without 1693 question. Suggested by Terry Lambert of Whistle 1694 Communications. 1695 DEVTOOLS: confSTFILE and confHFFILE can be used to change the names 1696 of the installed statistics and help files, respectively. 1697 DEVTOOLS: Remove spaces in `uname -r` output when determining 1698 operating system identity. Problem noted by Erik 1699 Wachtenheim of Dartmouth College. 1700 DEVTOOLS: New variable confLIBSEARCHPATH to specify the paths that 1701 will be search for the libraries specified in confLIBSEARCH. 1702 Defaults to "/lib /usr/lib /usr/shlib". 1703 DEVTOOLS: New variables confSTRIP and confSTRIPOPTS for specifying 1704 how to strip binaries. These are used by the new 1705 install-strip target. 1706 DEVTOOLS: New config file site.post.m4 which is included after 1707 the others (if it exists). 1708 DEVTOOLS: Change order of LIBS: first product specific libraries 1709 then the default ones. 1710 MAIL.LOCAL: Will not be installed setuid root. To use mail.local 1711 as local delivery agent without LMTP mode, use 1712 MODIFY_MAILER_FLAGS(`LOCAL', `+S') 1713 to set the S flag. 1714 MAIL.LOCAL: Do not reject addresses which would otherwise be 1715 accepted by sendmail. Suggested by Neil Rickert of 1716 Northern Illinois University. 1717 MAIL.LOCAL: New -7 option which causes LMTP mode not to advertise 1718 8BITMIME in the LHLO response. Suggested by Kari Hurtta of 1719 the Finnish Meteorological Institute. 1720 MAIL.LOCAL: Add support for the maillock() routines by defining 1721 MAILLOCK when compiling. Also requires linking with 1722 -lmail. Patch from Neil Rickert of Northern Illinois 1723 University. 1724 MAIL.LOCAL: Create a Content-Length: header if CONTENTLENGTH is 1725 defined when compiling. Automatically set for Solaris 2.3 1726 and later. Patch from Neil Rickert of Northern Illinois 1727 University. 1728 MAIL.LOCAL: Move the initialization of the 'notifybiff' address 1729 structure to the beginning of the program. This ensures that 1730 the getservbyname() is done before any seteuid to a possibly 1731 unauthenticated user. If you are using NIS+ and secure RPC 1732 on a Solaris system, this avoids syslog messages such as, 1733 "authdes_refresh: keyserv(1m) is unable to encrypt session 1734 key." Patch from Neil Rickert of Northern Illinois 1735 University. 1736 MAIL.LOCAL: Support group writable mail spool files when MAILGID is 1737 set to the gid to use (-DMAILGID=6) when compiling. 1738 Patch from Neil Rickert of Northern Illinois University. 1739 MAIL.LOCAL: When a mail message included lines longer than 2046 1740 characters (in LMTP mode), mail.local split the incoming 1741 line up into 2046-character output lines (excluding the 1742 newline). If an input line was 2047 characters long 1743 (excluding CR-LF) and the last character was a '.', 1744 mail.local saw it as the end of input, transfered it to the 1745 user mailbox and tried to write an `ok' back to sendmail. 1746 If the message was much longer, both sendmail and 1747 mail.local would deadlock waiting for each other to read 1748 what they have written. Problem noted by Peter Jeremy of 1749 Alcatel Australia Limited. 1750 MAIL.LOCAL: New option -b to return a permanent error instead of a 1751 temporary error if a mailbox exceeds quota. Suggested by 1752 Neil Rickert of Northern Illinois University. 1753 MAIL.LOCAL: The creation of a lockfile is subject to a global 1754 timeout to avoid starvation. 1755 MAIL.LOCAL: Properly parse addresses with multiple quoted 1756 local-parts. Problem noted by Ronald F. Guilmette of 1757 Infinite Monkeys & Co. 1758 MAIL.LOCAL: NCR MP/RAS 3.X portability from Tom J. Moore of NCR. 1759 MAILSTATS: New -p option to invoke program mode in which stats are 1760 printed in a machine readable fashion and the stats file 1761 is reset. Patch from Kevin Hildebrand of the University 1762 of Maryland. 1763 MAKEMAP: If running as root, automatically change the ownership of 1764 generated maps to the TrustedUser as specified in the 1765 sendmail configuration file. 1766 MAKEMAP: New -C option to accept an alternate sendmail 1767 configuration file to use for finding the TrustedUser 1768 option. 1769 MAKEMAP: New -u option to dump (unmap) a database. Based on 1770 code contributed by Roy Mongiovi of Georgia Tech. 1771 MAKEMAP: New -e option to allow empty values. Suggested by Philip 1772 A. Prindeville of Enteka Enterprise Technology Services. 1773 MAKEMAP: Compile cleanly on 64-bit operating systems. Problem 1774 noted by Gerald Rinske of Siemens Business Services. 1775 OP.ME: Correctly document interaction between F=S and U= mailer 1776 equates. Problem noted by Bob Halley of Internet Engines. 1777 OP.ME: Fixup Timeout documentation. From Graeme Hewson of Oracle 1778 Corporation UK. 1779 OP.ME: The Timeout [r] option was incorrectly listed as "safe" 1780 (e.g., sendmail would not drop root privileges if the 1781 option was specified on the command line). Problem noted 1782 by Todd C. Miller of Courtesan Consulting. 1783 PRALIASES: Handle the hash and btree map specifications for 1784 Berkeley DB. Patch from Brian J. Coan of the 1785 Institute for Global Communications. 1786 PRALIASES: Read the sendmail.cf file for the location(s) of the 1787 alias file(s) if the -f option is not used. Patch from 1788 John Beck of Sun Microsystems. 1789 PRALIASES: New -C option to specify an alternate sendmail 1790 configuration file to use for finding alias file(s). Patch 1791 from John Beck of Sun Microsystems. 1792 SMRSH: allow shell commands echo, exec, and exit. Allow command 1793 lists using || and &&. Based on patch from Brian J. Coan 1794 of the Institute for Global Communications. 1795 SMRSH: Update README for the new Build system. From Tim Pierce 1796 of RootsWeb Genealogical Data Cooperative. 1797 VACATION: Added vacation auto-responder to sendmail distribution. 1798 LIBSMDB: Added abstracted database library. Works with Berkeley 1799 DB 1.85, Berkeley DB 2.X, Berkeley DB 3.X, and NDBM. 1800 Changed Files: 1801 The Build script in the various program subdirectories are 1802 no longer symbolic links. They are now scripts 1803 which execute the actual Build script in 1804 devtools/bin. 1805 All the manual pages are now written against -man and not 1806 -mandoc as they were previously. 1807 Add a simple Makefile to every directory so make instead 1808 of Build will work (unless parameters are 1809 required for Build). 1810 New Directories: 1811 devtools/M4/UNIX 1812 include 1813 libmilter 1814 libsmdb 1815 libsmutil 1816 vacation 1817 Renamed Directories: 1818 BuildTools => devtools 1819 src => sendmail 1820 Deleted Files: 1821 cf/m4/nullrelay.m4 1822 devtools/OS/Linux.ppc 1823 devtools/OS/ReliantUNIX 1824 devtools/OS/SINIX 1825 sendmail/ldap_map.h 1826 New Files: 1827 INSTALL 1828 PGPKEYS 1829 cf/cf/generic-linux.cf 1830 cf/cf/generic-linux.mc 1831 cf/feature/delay_checks.m4 1832 cf/feature/dnsbl.m4 1833 cf/feature/generics_entire_domain.m4 1834 cf/feature/no_default_msa.m4 1835 cf/feature/relay_mail_from.m4 1836 cf/feature/virtuser_entire_domain.m4 1837 cf/mailer/qpage.m4 1838 cf/ostype/bsdi.m4 1839 cf/ostype/hpux11.m4 1840 cf/ostype/openbsd.m4 1841 contrib/bounce-resender.pl 1842 contrib/domainmap.m4 1843 contrib/qtool.8 1844 contrib/qtool.pl 1845 devtools/M4/depend/AIX.m4 1846 devtools/M4/list.m4 1847 devtools/M4/string.m4 1848 devtools/M4/subst_ext.m4 1849 devtools/M4/switch.m4 1850 devtools/OS/Darwin 1851 devtools/OS/GNU 1852 devtools/OS/SINIX.5.43 1853 devtools/OS/SINIX.5.44 1854 devtools/OS/m88k 1855 devtools/bin/find_in_path.sh 1856 mail.local/Makefile 1857 mailstats/Makefile 1858 makemap/Makefile 1859 praliases/Makefile 1860 rmail/Makefile 1861 sendmail/Makefile 1862 sendmail/bf.h 1863 sendmail/bf_portable.c 1864 sendmail/bf_portable.h 1865 sendmail/bf_torek.c 1866 sendmail/bf_torek.h 1867 sendmail/shmticklib.c 1868 sendmail/statusd_shm.h 1869 sendmail/timers.c 1870 sendmail/timers.h 1871 smrsh/Makefile 1872 vacation/Makefile 1873 Renamed Files: 1874 cf/ostype/gnuhurd.m4 => cf/ostype/gnu.m4 1875 sendmail/cdefs.h => include/sendmail/cdefs.h 1876 sendmail/sendmail.hf => sendmail/helpfile 1877 sendmail/mailstats.h => include/sendmail/mailstats.h 1878 sendmail/pathnames.h => include/sendmail/pathnames.h 1879 sendmail/safefile.c => libsmutil/safefile.c 1880 sendmail/snprintf.c => libsmutil/snprintf.c 1881 sendmail/useful.h => include/sendmail/useful.h 1882 cf/ostype/solaris2.m4 => cf/ostype/solaris2.pre5.m4 1883 Copied Files: 1884 cf/ostype/solaris2.ml.m4 => cf/ostype/solaris2.m4 1885 18868.9.3/8.9.3 1999/02/04 1887 SECURITY: Limit message headers to a maximum of 32K bytes (total 1888 of all headers in a single message) to prevent a denial of 1889 service attack. This limit will be configurable in 8.10. 1890 Problem noted by Michal Zalewski of the "Internet for 1891 Schools" project (IdS). 1892 Prevent segmentation fault on an LDAP lookup if the LDAP map 1893 was closed due to an earlier failure. Problem noted by 1894 Jeff Wasilko of smoe.org. Fix from Booker Bense of 1895 Stanford University and Per Hedeland of Ericsson. 1896 Preserve the order of the MIME headers in multipart messages 1897 when performing the MIME header length check. This 1898 will allow PGP signatures to function properly. Problem 1899 noted by Lars Hecking of University College, Cork, Ireland. 1900 If ruleset 5 rewrote the local address to an :include: directive, 1901 the delivery would fail with an "aliasing/forwarding loop 1902 broken" error. Problem noted by Eric C Hagberg of Morgan 1903 Stanley. Fix from Per Hedeland of Ericsson. 1904 Allow -T to work for bestmx maps. Fix from Aaron Schrab of 1905 ExecPC Internet Systems. 1906 During the transfer of a message in an SMTP transaction, if a 1907 TCP timeout occurs, the message would be properly queued 1908 for later retry but the failure would be logged as 1909 "Illegal Seek" instead of a timeout. Problem noted by 1910 Piotr Kucharski of the Warsaw School of Economics (SGH) 1911 and Carles Xavier Munyoz Baldo of CTV Internet. 1912 Prevent multiple deliveries on a self-referencing alias if the 1913 F=w mailer flag is not set. Problem noted by Murray S. 1914 Kucherawy of Concentric Network Corporation and Per 1915 Hedeland of Ericsson. 1916 Do not strip empty headers but if there is no value and a 1917 default is defined in sendmail.cf, use the default. 1918 Problem noted by Philip Guenther of Gustavus Adolphus 1919 College and Christopher McCrory of Netus, Inc. 1920 Don't inherit information about the sender (notably the full name) 1921 in SMTP (-bs) mode, since this might be called from inetd. 1922 Accept any 3xx reply code in response to DATA command instead of 1923 requiring 354. This change will match the wording to be 1924 published in the updated SMTP specification from the DRUMS 1925 group of the IETF. 1926 Portability: 1927 AIX 4.2.0 or 4.2.1 may become updated by the fileset 1928 bos.rte.net level 4.2.0.2. This introduces the 1929 softlink /usr/lib/libbind.a which should 1930 not be used. It conflicts with the resolver 1931 built into libc.a. "bind" has been removed 1932 from the confLIBSEARCH BuildTools variable. 1933 Users who have installed BIND 8.X will have 1934 to add it back in their site.config.m4 file. 1935 Problem noted by Ole Holm Nielsen of the 1936 Technical University of Denmark. 1937 CRAY TS 10.0.x from Sven Nielsen of San Diego 1938 Supercomputer Center. 1939 Improved LDAP version 3 integration based on input 1940 from Kurt D. Zeilenga of the OpenLDAP Foundation, 1941 John Beck of Sun Microsystems, and Booker Bense 1942 of Stanford University. 1943 Linux doesn't have a standard way to get the timezone 1944 between different releases. Back out the 1945 change in 8.9.2 and don't attempt to derive 1946 a timezone. Problem reported by Igor S. Livshits 1947 of the University of Illinois at Urbana-Champaign 1948 and Michael Dickens of Tetranet Communications. 1949 Reliant UNIX, the new name for SINIX, from Gert-Jan Looy 1950 of Siemens/SNI. 1951 SunOS 5.8 from John Beck of Sun Microsystems. 1952 CONFIG: SCO UnixWare 2.1 and 7.0 need TZ to get the proper 1953 timezone. Problem noted by Petr Lampa of Technical 1954 University of Brno. 1955 CONFIG: Handle <@bestmx-host:user@otherhost> addressing properly 1956 when using FEATURE(bestmx_is_local). Patch from Neil W. 1957 Rickert of Northern Illinois University. 1958 CONFIG: Properly handle source routed and %-hack addresses on 1959 hosts which the mailertable remaps to local:. Patch from 1960 Neil W. Rickert of Northern Illinois University. 1961 CONFIG: Internal fixup of mailertable local: map value. Patch from 1962 Larry Parmelee of Cornell University. 1963 CONFIG: Only add back +detail from host portion of mailer triplet 1964 on local mailer triplets if it was originally +detail. 1965 Patch from Neil W. Rickert of Northern Illinois University. 1966 CONFIG: The bestmx_is_local checking done in check_rcpt would 1967 cause later checks to fail. Patch from Paul J Murphy of 1968 MIDS Europe. 1969 New Files: 1970 BuildTools/OS/CRAYTS.10.0.x 1971 BuildTools/OS/ReliantUNIX 1972 BuildTools/OS/SunOS.5.8 1973 19748.9.2/8.9.2 1998/12/30 1975 SECURITY: Remove five second sleep on accepting daemon connections 1976 due to an accept() failure. This sleep could be used 1977 for a denial of service attack. 1978 Do not silently ignore queue files with names which are too long. 1979 Patch from Bryan Costales of InfoBeat, Inc. 1980 Do not store failures closing an SMTP session in persistent 1981 host status. Reported by Graeme Hewson of Oracle 1982 Corporation UK. 1983 Allow symbolic link forward files if they are in safe directories. 1984 Problem noted by Andreas Schott of the Max Planck Society. 1985 Missing columns in a text map could cause a segmentation fault. 1986 Fix from David Lee of the University of Durham. 1987 Note that for 8.9.X, PrivacyOptions=goaway also includes the 1988 noetrn flag. This is scheduled to change in a future 1989 version of sendmail. Problem noted by Theo Van Dinter of 1990 Chrysalis Symbolic Designa and Alan Brown of Manawatu 1991 Internet Services. 1992 When trying to do host canonification in a Wildcard MX 1993 environment, try an MX lookup of the hostname without the 1994 default domain appended. Problem noted by Olaf Seibert of 1995 Polderland Language & Speech Technology. 1996 Reject SMTP RCPT To: commands with only comments (i.e. 1997 'RCPT TO: (comment)'. Problem noted by Earle Ake of 1998 Hassler Communication Systems Technology, Inc. 1999 Handle any number of %s in the LDAP filter spec. Patch from 2000 Per Hedeland of Ericsson. 2001 Clear ldapx open timeouts even if the map open failed to prevent 2002 a segmentation fault. Patch from Wayne Knowles of the 2003 National Institute of Water & Atmospheric Research Ltd. 2004 Do not syslog envelope clone messages when using address 2005 verification (-bv). Problem noted by Kari Hurtta of the 2006 Finnish Meteorological Institute. 2007 Continue to perform queue runs while in daemon mode even if the 2008 daemon is rejecting connections due to a disk full 2009 condition. Problem noted by JR Oldroyd of TerraNet 2010 Internet Services. 2011 Include full filename on installation of the sendmail.hf file 2012 in case the $HFDIR directory does not exist. Problem 2013 noted by Josef Svitak of Montana State University. 2014 Close all maps when exiting the process with one exception. 2015 Berkeley DB can use internal shared memory locking for 2016 its memory pool. Closing a map opened by another process 2017 will interfere with the shared memory and locks of the 2018 parent process leaving things in a bad state. For 2019 Berkeley DB, only close the map if the current process 2020 is also the one that opened the map, otherwise only close 2021 the map file descriptor. Thanks to Yoseff Francus of 2022 Collective Technologies for volunteering his system for 2023 extended testing. 2024 Avoid null pointer dereference on XDEBUG output for SMTP reply 2025 failures. Problem noted by Carlos Canau of EUnet Portugal. 2026 On mailq and hoststat listings being piped to another program, such 2027 as more, if the pipe closes (i.e., the user quits more), 2028 stop sending output and exit. Patch from Allan E Johannesen 2029 of Worcester Polytechnic Institute. 2030 In accordance with the documentation, LDAP map lookup failures 2031 are now considered temporary failures instead of permanent 2032 failures unless the -t flag is used in the map definition. 2033 Problem noted by Booker Bense of Stanford University and 2034 Eric C. Hagberg of Morgan Stanley. 2035 Fix by one error reporting on long alias names. Problem noted by 2036 H. Paul Hammann of the Missouri Research and Education 2037 Network. 2038 Fix DontBlameSendmail=IncludeFileInUnsafeDirPath behavior. Problem 2039 noted by Barry S. Finkel of Argonne National Laboratory. 2040 When automatically converting from 8 bit to quoted printable MIME, 2041 be careful not to miss a multi-part boundary if that 2042 boundary is preceded by a boundary-like line. Problem 2043 noted by Andreas Raschle of Ansid Inc. Fix from 2044 Kari Hurtta of the Finnish Meteorological Institute. 2045 Avoid bogus reporting of "LMTP tobuf overflow" when the buffer 2046 has enough space for the additional address. Problem 2047 noted by Steve Cliffe of the University of Wollongong. 2048 Fix DontBlameSendmail=FileDeliveryToSymlink behavior. Problem 2049 noted by Alex Vorobiev of Swarthmore College. 2050 If the check_compat ruleset resolves to the $#discard mailer, 2051 discard the current recipient. Unlike check_relay, 2052 check_mail, and check_rcpt, the entire envelope is not 2053 discarded. Problem noted by RZ D. Rahlfs. Fix from 2054 Claus Assmann of Christian-Albrechts-University of Kiel. 2055 Avoid segmentation fault when reading ServiceSwitchFile files with 2056 bogus formatting. Patch from Kari Hurtta of the Finnish 2057 Meteorological Institute. 2058 Support Berkeley DB 2.6.4 API change. 2059 OP.ME: Pages weren't properly output on duplexed printers. Fix 2060 from Matthew Black of CSU Long Beach. 2061 Portability: 2062 Apple Rhapsody from Wilfredo Sanchez of Apple Computer, Inc. 2063 Avoid a clash with IRIX 6.2 getopt.h and the UserDatabase 2064 option structure. Problem noted by Ashley M. 2065 Kirchner of Photo Craft Laboratories, Inc. 2066 Break out IP address to hostname translation for 2067 reading network interface addresses into 2068 class 'w'. Patch from John Kennedy of 2069 Cal State University, Chico. 2070 AIX 4.x use -qstrict with -O3 to prevent the optimized 2071 from changing the semantics of the compiled 2072 program. From Simon Travaglia of the 2073 University of Waikato, New Zealand. 2074 FreeBSD 2.2.2 and later support setusercontext(). From 2075 Peter Wemm of DIALix. 2076 FreeBSD 3.x fix from Peter Wemm of DIALix. 2077 IRIX 5.x has a syslog buffer size of 512 bytes. From 2078 Nao NINOMIYA of Utsunomiya University. 2079 IRIX 6.5 64-bit Build support. 2080 LDAP Version 3 support from John Beck and Ravi Iyer 2081 of Sun Microsystems. 2082 Linux does not implement seteuid() properly. From 2083 John Kennedy of Cal State University, Chico. 2084 Linux timezone type was set improperly. From Takeshi Itoh 2085 of Bits Co., Ltd. 2086 NCR MP-RAS 3.x needs -lresolv for confLIBS. From 2087 Tom J. Moore of NCR. 2088 NeXT 4.x correction to man page path. From J. P. McCann 2089 of E I A. 2090 System V Rel 5.x (a.k.a UnixWare7 w/o BSD-Compatibility Libs) 2091 from Paul Gampe of the Asia Pacific Network 2092 Information Center. 2093 ULTRIX now requires an optimization limit of 970 from 2094 Allan E Johannesen of Worcester Polytechnic 2095 Institute. 2096 Fix extern declaration for sm_dopr(). Fix from Henk 2097 van Oers of Algemeen Nederlands Persbureau. 2098 CONFIG: Catch @hostname,user@anotherhost.domain as relaying. 2099 Problem noted by Mark Rogov of AirMedia, Inc. Fix from 2100 Claus Assmann of Christian-Albrechts-University of Kiel. 2101 CONFIG: Do not refer to http://maps.vix.com/ on RBL rejections as 2102 there are multiple RBL's available and the MAPS RBL may 2103 not be the one in use. Suggested by Alan Brown of 2104 Manawatu Internet Services. 2105 CONFIG: Properly strip route addresses (i.e., @host1:user@host2) 2106 when stripping down a recipient address to check for 2107 relaying. Patch from Claus Assmann of 2108 Christian-Albrechts-University of Kiel and Neil W Rickert 2109 of Northern Illinois University. 2110 CONFIG: Allow the access database to override RBL lookups. Patch 2111 from Claus Assmann of Christian-Albrechts-University of 2112 Kiel. 2113 CONFIG: UnixWare 7 support from Phillip P. Porch of The Porch 2114 Dot Com. 2115 CONFIG: Fixed check for deferred delivery mode warning. Patch 2116 from Claus Assmann of Christian-Albrechts-University of 2117 Kiel and Per Hedeland of Ericsson. 2118 CONFIG: If a recipient using % addressing is used, e.g. 2119 user%site@othersite, and othersite's MX records are now 2120 checked for local hosts if FEATURE(relay_based_on_MX) is 2121 used. Problem noted by Alexander Litvin of Lucky Net Ltd. 2122 Patch from Alexander Litvin of Lucky Net Ltd and 2123 Claus Assmann of Christian-Albrechts-University of Kiel. 2124 MAIL.LOCAL: Prevent warning messages from appearing in the LMTP 2125 stream. Do not allow more than one response per recipient. 2126 MAIL.LOCAL: Handle routed addresses properly when using LMTP. Fix 2127 from John Beck of Sun Microsystems. 2128 MAIL.LOCAL: Properly check for CRLF when using LMTP. Fix from 2129 John Beck of Sun Microsystems. 2130 MAIL.LOCAL: Substitute MAILER-DAEMON for the LMTP empty sender in 2131 the envelope From header. 2132 MAIL.LOCAL: Accept underscores in hostnames in LMTP mode. 2133 Problem noted by Glenn A. Malling of Syracuse University. 2134 MAILSTATS: Document msgsrej and msgsdis fields in the man page. 2135 Problem noted by Richard Wong of Princeton University. 2136 MAKEMAP: Build group list so group writable files are allowed with 2137 the -s flag. Problem noted by Curt Sampson of Internet 2138 Portal Services, Inc. 2139 PRALIASES: Automatically handle alias files created without the 2140 NULL byte at the end of the key. Patch from John Beck of 2141 Sun Microsystems. 2142 PRALIASES: Support Berkeley DB 2.6.4 API change. 2143 New Files: 2144 BuildTools/OS/IRIX64.6.5 2145 BuildTools/OS/UnixWare.5.i386 2146 cf/ostype/unixware7.m4 2147 contrib/smcontrol.pl 2148 src/control.c 2149 21508.9.1/8.9.1 1998/07/02 2151 If both an OS specific site configuration file and a generic 2152 site.config.m4 file existed, only the latter was used 2153 instead of both. Problem noted by Geir Johannessen of 2154 the Norwegian University of Science and Technology. 2155 Fix segmentation fault while converting 8 bit to 7 bit MIME 2156 multipart messages by trying to write to an unopened 2157 file descriptor. Fix from Kari Hurtta of the Finnish 2158 Meteorological Institute. 2159 Do not assume Message: and Text: headers indicate the end of 2160 the header area when parsing MIME headers. Problem noted 2161 by Kari Hurtta of the Finnish Meteorological Institute. 2162 Setting the confMAN#SRC Build variable would only effect the 2163 installation commands. The man pages would still be 2164 built with .0 extensions. Problem noted by Bryan 2165 Costales of InfoBeat, Inc. 2166 Installation of manual pages didn't honor the DESTDIR environment 2167 variable. Problem noted by Bryan Costales of InfoBeat, Inc. 2168 If the check_relay ruleset resolved to the discard mailer, messages 2169 were still delivered. Problem noted by Mirek Luc of NASK. 2170 Mail delivery to files would fail with an Operating System Error 2171 if sendmail was not running as root, i.e., RunAsUser was set. 2172 Problem noted by Leonard N. Zubkoff of Dandelion Digital. 2173 Prevent MinQueueAge from interfering from queued items created 2174 in the future, i.e., if the system clock was set ahead 2175 and then back. Problem noted by Michael Miller of the 2176 University of Natal, Pietermaritzburg. 2177 Do not advertise ETRN support in ESTMP EHLO reply if noetrn is 2178 set in the PrivacyOptions option. Fix from Ted Rule of 2179 Flextech TV. 2180 Log invalid persistent host status file lines instead of 2181 bouncing the message. Problem noted by David Lindes of 2182 DaveLtd Enterprises. 2183 Move creation of empty sendmail.st file from installation to 2184 compilation. Installation may be done from a read-only 2185 mount. Fix from Bryan Costales of InfoBeat, Inc. and Ric 2186 Anderson of the Oasis Research Center, Inc. 2187 Enforce the maximum number of User Database entries limit. Problem 2188 noted by Gary Buchanan of Credence Systems Inc. 2189 Allow dead.letter files in root's home directory. Problem noted 2190 by Anna Ullman of Sun Microsystems. 2191 Program deliveries in forward files could be marked unsafe if 2192 any directory listed in the ForwardPath option did not 2193 exist. Problem noted by Jorg Bielak of Coastal Web Online. 2194 Do not trust the length of the address structure returned by 2195 gethostbyname(). Problem noted by Chris Evans of Oxford 2196 University. 2197 If the SIZE= MAIL From: ESMTP parameter is too large, use the 2198 5.3.4 DSN status code instead of 5.2.2. Similarly, for 2199 non-local deliveries, if the message is larger than the 2200 mailer maximum message size, use 5.3.4 instead of 5.2.3. 2201 Suggested by Antony Bowesman of 2202 Fujitsu/TeaWARE Mail/MIME System. 2203 Portability: 2204 Fix the check for an IP address reverse lookup for 2205 use in $&{client_name} on 64 bit platforms. 2206 From Gilles Gallot of Institut for Development 2207 and Resources in Intensive Scientific computing. 2208 BSD-OS uses .0 for man page extensions. From Jeff Polk 2209 of BSDI. 2210 DomainOS detection for Build. Also, version 10.4 and later 2211 ship a unistd.h. Fixes from Takanobu Ishimura of 2212 PICT Inc. 2213 NeXT 4.x uses /usr/lib/man/cat for its man pages. From 2214 J. P. McCann of E I A. 2215 SCO 4.X and 5.X include NDBM support. From Vlado Potisk 2216 of TEMPEST, Ltd. 2217 CONFIG: Do not pass spoofed PTR results through resolver for 2218 qualification. Problem noted by Michiel Boland of 2219 Digital Valley Internet Professionals; fix from 2220 Kari Hurtta of the Finnish Meteorological Institute. 2221 CONFIG: Do not try to resolve non-DNS hostnames such as UUCP, 2222 BITNET, and DECNET addresses for resolvable senders. 2223 Problem noted by Alexander Litvin of Lucky Net Ltd. 2224 CONFIG: Work around Sun's broken configuration which sends bounce 2225 messages as coming from @@hostname instead of <>. LMTP 2226 would not accept @@hostname. 2227 OP.ME: Corrections to complex sendmail startup script from Rick 2228 Troxel of the National Institutes of Health. 2229 RMAIL: Do not install rmail by default, require 'make force-install' 2230 as this rmail isn't the same as others. Suggested by 2231 Kari Hurtta of the Finnish Meteorological Institute. 2232 New Files: 2233 BuildTools/OS/DomainOS.10.4 2234 22358.9.0/8.9.0 1998/05/19 2236 SECURITY: To prevent users from reading files not normally 2237 readable, sendmail will no longer open forward, :include:, 2238 class, ErrorHeader, or HelpFile files located in unsafe 2239 (i.e., group or world writable) directory paths. Sites 2240 which need the ability to override security can use the 2241 DontBlameSendmail option. See the README file for more 2242 information. 2243 SECURITY: Problems can occur on poorly managed systems, specifically, 2244 if maps or alias files are in world writable directories. 2245 This fixes the change added to 8.8.6 to prevent links in these 2246 world writable directories. 2247 SECURITY: Make sure ServiceSwitchFile option file is not a link if 2248 it is in a world writable directory. 2249 SECURITY: Never pass a tty to a mailer -- if a mailer can get at the 2250 tty it may be able to push bytes back to the senders input. 2251 Unfortunately this breaks -v mode. Problem noted by 2252 Wietse Venema of the Global Security Analysis Lab at 2253 IBM T.J. Watson Research. 2254 SECURITY: Empty group list if DontInitGroups is set to true to 2255 prevent program deliveries from picking up extra group 2256 privileges. Problem reported by Wolfgang Ley of DFN-CERT. 2257 SECURITY: The default value for DefaultUser is now set to the uid and 2258 gid of the first existing user mailnull, sendmail, or daemon 2259 that has a non-zero uid. If none of these exist, sendmail 2260 reverts back to the old behavior of using uid 1 and gid 1. 2261 This is a security problem for Linux which has chosen that 2262 uid and gid for user bin instead of daemon. If DefaultUser 2263 is set in the configuration file, that value overrides this 2264 default. 2265 SECURITY: Since 8.8.7, the check for non-setuid binaries 2266 interfered with setting an alternate group id for the 2267 RunAsUser option. Problem noted by Randall Winchester of 2268 the University of Maryland. 2269 Add support for Berkeley DB 2.X. Based on patch from John Kennedy 2270 of Cal State University, Chico. 2271 Remove support for OLD_NEWDB (pre-1.5 version of Berkeley DB). Users 2272 which previously defined OLD_NEWDB=1 must now upgrade to the 2273 current version of Berkeley DB. 2274 Added support for regular expressions using the new map class regex. 2275 From Jan Krueger of Unix-AG of University of Hannover. 2276 Support for BIND 8.1.1's hesiod for hesiod maps and hesiod 2277 UserDatabases from Randall Winchester of the University 2278 of Maryland. 2279 Allow any shell for user shell on program deliveries on V1 2280 configurations for backwards compatibility on machines which 2281 do not have getusershell(). Fix from John Beck of Sun 2282 Microsystems. 2283 On operating systems which change the process title by reusing the 2284 argument vector memory, sendmail could corrupt memory if the 2285 last argument was either "-q" or "-d". Problem noted by 2286 Frank Langbein of the University of Stuttgart. 2287 Support Local Mail Transfer Protocol (LMTP) between sendmail and 2288 mail.local on the F=z flag. 2289 Macro-expand the contents of the ErrMsgFile. Previously this was 2290 only done if you had magic characters (0x81) to indicate 2291 macro expansion. Now $x will be expanded. This means that 2292 real dollar signs have to be backslash escaped. 2293 TCP Wrappers expects "unknown" in the hostname argument if the 2294 reverse DNS lookup for the incoming connection fails. 2295 Problem noted by Randy Grimshaw of Syracuse University and 2296 Wietse Venema of the Global Security Analysis Lab at 2297 IBM T.J. Watson Research. 2298 DSN success bounces generated from an invocation of sendmail -t 2299 would be sent to both the sender and MAILER-DAEMON. 2300 Problem noted by Claus Assmann of 2301 Christian-Albrechts-University of Kiel. 2302 Avoid "Error 0" messages on delivery mailers which exit with a 2303 valid exit value such as EX_NOPERM. Fix from Andreas Luik 2304 of ISA Informationssysteme GmbH. 2305 Tokenize $&x expansions on right hand side of rules. This eliminates 2306 the need to use tricks like $(dequote "" $&{client_name} $) 2307 to cause the ${client_name} macro to be properly tokenized. 2308 Add the MaxRecipientsPerMessage option: this limits the number of 2309 recipients that will be accepted in a single SMTP 2310 transaction. After this number is reached, sendmail 2311 starts returning "452 Too many recipients" to all RCPT 2312 commands. This can be used to limit the number of recipients 2313 per envelope (in particular, to discourage use of the server 2314 for spamming). Note: a better approach is to restrict 2315 relaying entirely. 2316 Fixed pointer initialization for LDAP lmap struct, fixed -s option 2317 to ldapx map and added timeout for ldap_open call to 2318 avoid hanging sendmail in the event of hung LDAP servers. 2319 Patch from Booker Bense of Stanford University. 2320 Allow multiple -qI, -qR, or -qS queue run limiters. For example, 2321 '-qRfoo -qRbar' would deliver mail to recipients with foo or 2322 bar in their address. Patch from Allan E Johannesen of 2323 Worcester Polytechnic Institute. 2324 The bestmx map will now return a list of the MX servers for a host if 2325 passed a column delimiter via the -z map flag. This can be 2326 used to check if the server is an MX server for the recipient 2327 of a message. This can be used to help prevent relaying. 2328 Patch from Mitchell Blank Jr of Exec-PC. 2329 Mark failures for the *file* mailer and return bounce messages to the 2330 sender for those failures. 2331 Prevent bogus syslog timestamps on errors in sendmail.cf by 2332 preserving the TZ environment variable until TimeZoneSpec 2333 has been determined. Problem noted by Ralf Hildebrandt of 2334 Technical University of Braunschweig. Patch from Per Hedeland 2335 of Ericsson. 2336 Print test input in address test mode when input is not from the tty 2337 when the -v flag is given (i.e., sendmail -bt -v) to make 2338 output easier to decipher. Problem noted by Aidan Nichol 2339 of Procter & Gamble. 2340 The LDAP map -s flag was not properly parsed and the error message 2341 given included the remainder of the arguments instead of 2342 solely the argument in error. Problem noted by Aidan Nichol 2343 of Procter & Gamble. 2344 New DontBlameSendmail option. This option allows administrators to 2345 bypass some of sendmail's file security checks at the expense 2346 of system security. This should only be used if you are 2347 absolutely sure you know the consequences. The available 2348 DontBlameSendmail options are: 2349 Safe 2350 AssumeSafeChown 2351 ClassFileInUnsafeDirPath 2352 ErrorHeaderInUnsafeDirPath 2353 GroupWritableDirPathSafe 2354 GroupWritableForwardFileSafe 2355 GroupWritableIncludeFileSafe 2356 GroupWritableAliasFile 2357 HelpFileinUnsafeDirPath 2358 WorldWritableAliasFile 2359 ForwardFileInGroupWritableDirPath 2360 IncludeFileInGroupWritableDirPath 2361 ForwardFileInUnsafeDirPath 2362 IncludeFileInUnsafeDirPath 2363 ForwardFileInUnsafeDirPathSafe 2364 IncludeFileInUnsafeDirPathSafe 2365 MapInUnsafeDirPath 2366 LinkedAliasFileInWritableDir 2367 LinkedClassFileInWritableDir 2368 LinkedForwardFileInWritableDir 2369 LinkedIncludeFileInWritableDir 2370 LinkedMapInWritableDir 2371 LinkedServiceSwitchFileInWritableDir 2372 FileDeliveryToHardLink 2373 FileDeliveryToSymLink 2374 WriteMapToHardLink 2375 WriteMapToSymLink 2376 WriteStatsToHardLink 2377 WriteStatsToSymLink 2378 RunProgramInUnsafeDirPath 2379 RunWritableProgram 2380 New DontProbeInterfaces option to turn off the inclusion of all the 2381 interface names in $=w on startup. In particular, if you 2382 have lots of virtual interfaces, this option will speed up 2383 startup. However, unless you make other arrangements, mail 2384 sent to those addresses will be bounced. 2385 Automatically create alias databases if they don't exist and 2386 AutoRebuildAliases is set. 2387 Add PrivacyOptions=noetrn flag to disable the SMTP ETRN command. 2388 Suggested by Christophe Wolfhugel of the Institut Pasteur. 2389 Add PrivacyOptions=noverb flag to disable the SMTP VERB command. 2390 When determining the client host name ($&{client_name} macro), do 2391 a forward (A) DNS lookup on the result of the PTR lookup 2392 and compare results. If they differ or if the PTR lookup 2393 fails, &{client_name} will contain the IP address 2394 surrounded by square brackets (e.g., [127.0.0.1]). 2395 New map flag: -Tx appends "x" to lookups that return temporary failure 2396 (i.e, it is like -ax for the temporary failure case, in 2397 contrast to the success case). 2398 New syntax to do limited checking of header syntax. A config line 2399 of the form: 2400 HHeader: $>Ruleset 2401 causes the indicated Ruleset to be invoked on the Header 2402 when read. This ruleset works like the check_* rulesets -- 2403 that is, it can reject mail on the basis of the contents. 2404 Limit the size of the HELO/EHLO parameter to prevent spammers 2405 from hiding their connection information in Received: 2406 headers. 2407 When SingleThreadDelivery is active, deliveries to locked hosts 2408 are skipped. This will cause the delivering process to 2409 try the next MX host or queue the message if no other MX 2410 hosts are available. Suggested by Alexander Litvin. 2411 The [FILE] mailer type now delivers to the file specified in the 2412 A= equate of the mailer definition instead of $u. It also 2413 obeys all of the F= mailer flags such as the MIME 2414 7/8 bit conversion flags. This is useful for defining 2415 a mailer which delivers to the same file regardless of the 2416 recipient (e.g., 'A=FILE /dev/null' to discard unwanted mail). 2417 Do not assume the identity of a remote connection is root@localhost 2418 if the remote connection closes the socket before the 2419 remote identity can be queried. 2420 Change semantics of the F=S mailer flag back to 8.7.5 behavior. 2421 Some mailers, including procmail, require that the real 2422 uid is left unchanged by sendmail. Problem noted by Per 2423 Hedeland of Ericsson. 2424 No longer is the src/obj*/Makefile selected from a large list -- it 2425 is now generated using the information in BuildTools/OS/ -- 2426 some of the details are determined dynamically via 2427 BuildTools/bin/configure.sh. 2428 The other programs in the sendmail distribution -- mail.local, 2429 mailstats, makemap, praliases, rmail, and smrsh -- now use 2430 the new Build method which creates an operating system 2431 specific Makefile using the information in BuildTools. 2432 Make 4xx reply codes to the SMTP MAIL command be non-sticky (i.e., 2433 a failure on one message won't affect future messages to the 2434 same host). This is necessary if the remote host sends 2435 a 451 error if the domain of the sender does not resolve 2436 as is common in anti-spam configurations. Problem noted 2437 by Mitchell Blank Jr of Exec-PC. 2438 New "discard" mailer for check_* rulesets and header checking 2439 rulesets. If one of the above rulesets resolves to the 2440 $#discard mailer, the commands will be accepted but the 2441 message will be completely discarded after it is accepting. 2442 This means that even if only one of the recipients 2443 resolves to the $#discard mailer, none of the recipients 2444 will receive the mail. Suggested by Brian Kantor. 2445 All but the last cloned envelope of a split envelope were queued 2446 instead of being delivered. Problem noted by John Caruso 2447 of CNET: The Computer Network. 2448 Fix deadlock situation in persistent host status file locking. 2449 Syslog an error if a user forward file could not be read due to 2450 an error. Patch from John Beck of Sun Microsystems. 2451 Use the first name returned on machine lookups when canonifying a 2452 hostname via NetInfo. Patch from Timm Wetzel of GWDG. 2453 Clear the $&{client_addr}, $&{client_name}, and $&{client_port} 2454 macros when delivering a bounce message to prevent 2455 rejection by a check_compat ruleset which uses these macros. 2456 Problem noted by Jens Hamisch of AgiX Internetservices GmbH. 2457 If the check_relay ruleset resolves to the the error mailer, the 2458 error in the $: portion of the resolved triplet is used 2459 in the rejection message given to the remote machine. 2460 Suggested by Scott Gifford of The Internet Ramp. 2461 Set the $&{client_addr}, $&{client_name}, and $&{client_port} macros 2462 before calling the check_relay ruleset. Suggested by Scott 2463 Gifford of The Internet Ramp. 2464 Sendmail would get a segmentation fault if a mailer exited with an 2465 exit code of 79. Problem noted by Aaron Schrab of ExecPC 2466 Internet. Fix from Christophe Wolfhugel of the Pasteur 2467 Institute. 2468 Separate snprintf/vsnprintf routines into separate file for use by 2469 mail.local. 2470 Allow multiple map lookups on right hand side, e.g., 2471 R$* $( host $1 $) $| $( passwd $1 $). Patch from 2472 Christophe Wolfhugel of the Pasteur Institute. 2473 Properly generate success DSN messages if requested for aliases 2474 which have owner- aliases. Problem noted by Kari Hurtta 2475 of the Finnish Meteorological Institute. 2476 Properly display delayed-expansion macros ($&{macroname}) in 2477 address test mode (-bt). Problem noted by Bryan Costales 2478 of InfoBeat, Inc. 2479 -qR could sometimes match names incorrectly. Problem noted by 2480 Lutz Euler of Lavielle EDV Systemberatung GmbH & Co. 2481 Include a magic number and version in the StatusFile for the 2482 mailstats command. 2483 Record the number of rejected and discarded messages in the 2484 StatusFile for display by the mailstats command. Patch 2485 from Randall Winchester of the University of Maryland. 2486 IDENT returns where the OSTYPE field equals "OTHER" now list the 2487 user portion as IDENT:username@site instead of 2488 username@site to differentiate the two. Suggested by 2489 Kari Hurtta of the Finnish Meteorological Institute. 2490 Enforce timeout for LDAP queries. Patch from Per Hedeland of 2491 Ericsson. 2492 Change persistent host status filename substitution so '/' is 2493 replaced by ':' instead of '|' to avoid clashes. Also 2494 avoid clashes with hostnames with leading dots. Fix from 2495 Mitchell Blank Jr. of Exec-PC. 2496 If the system lock table is full, only attempt to create a new 2497 queue entry five times before giving up. Previously, it 2498 was attempted indefinitely which could cause the partition 2499 to run out of inodes. Problem noted by Suzie Weigand of 2500 Stratus Computer, Inc. 2501 In verbose mode, warn if the sendmail.cf version is less than the 2502 currently supported version. 2503 Sorting for QueueSortOrder=host is now case insensitive. Patch 2504 from Randall S. Winchester of the University of Maryland. 2505 Properly quote a full name passed via the -F command line option, 2506 the Full-Name: header, or the NAME environment variable if 2507 it contains characters which must be quoted. Problem noted 2508 by Kari Hurtta of the Finnish Meteorological Institute. 2509 Avoid possible race condition that unlocked a mail job before 2510 releasing the transcript file on systems that use flock(2). 2511 In some cases, this might result in a "Transcript Unavailable" 2512 message in error bounces. 2513 Accept SMTP replies which contain only a reply code and no 2514 accompanying text. Problem noted by Fernando Fraticelli of 2515 Digital Equipment Corporation. 2516 Portability: 2517 AIX 4.1 uses int for SOCKADDR_LEN_T from Motonori Nakamura 2518 of Kyoto University. 2519 AIX 4.2 requires <userpw.h> before <usersec.h>. Patch from 2520 Randall S. Winchester of the University of 2521 Maryland. 2522 AIX 4.3 from Valdis Kletnieks of Virginia Tech CNS. 2523 CRAY T3E from Manu Mahonen of Center for Scientific Computing 2524 in Finland. 2525 Digital UNIX now uses statvfs for determining free 2526 disk space. Patch from Randall S. Winchester of 2527 the University of Maryland. 2528 HP-UX 11.x from Richard Allen of Opin Kerfi HF and 2529 Regis McEwen of Progress Software Corporation. 2530 IRIX 64 bit fixes from Kari Hurtta of the Finnish 2531 Meteorological Institute. 2532 IRIX 6.2 configuration fix for mail.local from Michael Kyle 2533 of CIC/Advanced Computing Laboratory. 2534 IRIX 6.5 from Thomas H Jones II of SGI. 2535 IRIX 6.X load average code from Bob Mende of SGI. 2536 QNX from Glen McCready <glen@qnx.com>. 2537 SCO 4.2 and 5.x use /usr/bin instead of /usr/ucb for links 2538 to sendmail. Install with group bin instead of kmem 2539 as kmem does not exist. From Guillermo Freige of 2540 Gobernacion de la Pcia de Buenos Aires and Paul 2541 Fischer of BTG, Inc. 2542 SunOS 4.X does not include memmove(). Patch from 2543 Per Hedeland of Ericsson. 2544 SunOS 5.7 includes getloadavg() function for determining 2545 load average. Patch from John Beck of Sun 2546 Microsystems. 2547 CONFIG: Increment version number of config file. 2548 CONFIG: add DATABASE_MAP_TYPE to set the default type of database 2549 map for the various maps. The default is hash. Patch from 2550 Robert Harker of Harker Systems. 2551 CONFIG: new confEBINDIR m4 variable for defining the executable 2552 directory for certain programs. 2553 CONFIG: new FEATURE(local_lmtp) to use the new LMTP support for 2554 local mail delivery. By the default, /usr/libexec/mail.local 2555 is used. This is expected to be the mail.local shipped 2556 with 8.9 which is LMTP capable. The path is based on the 2557 new confEBINDIR m4 variable. 2558 CONFIG: Use confEBINDIR in determining path to smrsh for 2559 FEATURE(smrsh). Note that this changes the default from 2560 /usr/local/etc/smrsh to /usr/libexec/smrsh. To obtain the 2561 old path for smrsh, use FEATURE(smrsh, /usr/local/etc/smrsh). 2562 CONFIG: DOMAIN(generic) changes the default confFORWARD_PATH to 2563 include $z/.forward.$w+$h and $z/.forward+$h which allow 2564 the user to setup different .forward files for 2565 user+detail addressing. 2566 CONFIG: add confMAX_RCPTS_PER_MESSAGE, confDONT_PROBE_INTERFACES, 2567 and confDONT_BLAME_SENDMAIL to set MaxRecipientsPerMessage, 2568 DontProbeInterfaces, and DontBlameSendmail options. 2569 CONFIG: by default do not allow relaying (that is, accepting mail 2570 from outside your domain and sending it to another host 2571 outside your domain). 2572 CONFIG: new FEATURE(promiscuous_relay) to allow mail relaying from 2573 any site to any site. 2574 CONFIG: new FEATURE(relay_entire_domain) allows any host in your 2575 domain as defined by the 'm' class ($=m) to relay. 2576 CONFIG: new FEATURE(relay_based_on_MX) to allow relaying based on 2577 the MX records of the host portion of an incoming recipient. 2578 CONFIG: new FEATURE(access_db) which turns on the access database 2579 feature. This database give you the ability to allow 2580 or refuse to accept mail from specified domains for 2581 administrative reasons. By default, names that are listed 2582 as "OK" in the access db are domain names, not host names. 2583 CONFIG: new confCR_FILE m4 variable for defining the name of the file 2584 used for class 'R'. Defaults to /etc/mail/relay-domains. 2585 CONFIG: new command RELAY_DOMAIN(domain) and RELAY_DOMAIN_FILE(file) 2586 to add items to class 'R' ($=R) for hosts allowed to relay. 2587 CONFIG: new FEATURE(relay_hosts_only) to change the behavior 2588 of FEATURE(access_db) and class 'R' to lookup individual 2589 host names only. 2590 CONFIG: new FEATURE(loose_relay_check). Normally, if a recipient 2591 using % addressing is used, e.g. user%site@othersite, 2592 and othersite is in class 'R', the check_rcpt ruleset 2593 will strip @othersite and recheck user@site for relaying. 2594 This feature changes that behavior. It should not be 2595 needed for most installations. 2596 CONFIG: new FEATURE(relay_local_from) to allow relaying if the 2597 domain portion of the mail sender is a local host. This 2598 should only be used if absolutely necessary as it opens 2599 a window for spammers. Patch from Randall S. Winchester of 2600 the University of Maryland. 2601 CONFIG: new FEATURE(blacklist_recipients) turns on the ability to 2602 block incoming mail destined for certain recipient 2603 usernames, hostnames, or addresses. 2604 CONFIG: By default, MAIL FROM: commands in the SMTP session will be 2605 refused if the host part of the argument to MAIL FROM: cannot 2606 be located in the host name service (e.g., DNS). 2607 CONFIG: new FEATURE(accept_unresolvable_domains) accepts 2608 unresolvable hostnames in MAIL FROM: SMTP commands. 2609 CONFIG: new FEATURE(accept_unqualified_senders) accepts 2610 MAIL FROM: senders which do not include a domain. 2611 CONFIG: new FEATURE(rbl) Turns on rejection of hosts found in the 2612 Realtime Blackhole List. You can specify the RBL name 2613 server to contact by specifying it as an optional argument. 2614 The default is rbl.maps.vix.com. For details, see 2615 http://maps.vix.com/rbl/. 2616 CONFIG: Call Local_check_relay, Local_check_mail, and 2617 Local_check_rcpt from check_relay, check_mail, and 2618 check_rcpt. Users with local rulesets should place the 2619 rules using LOCAL_RULESETS. If a Local_check_* ruleset 2620 returns $#OK, the message is accepted. If the ruleset 2621 returns a mailer, the appropriate action is taken, else 2622 the return of the ruleset is ignored. 2623 CONFIG: CYRUS_MAILER_FLAGS now includes the /:| mailer flags by 2624 default to support file, :include:, and program deliveries. 2625 CONFIG: Remove the default for confDEF_USER_ID so the binary can 2626 pick the proper default value. See the SECURITY note 2627 above for more information. 2628 CONFIG: FEATURE(nodns) now warns the user that the feature is a 2629 no-op. Patch from Kari Hurtta of the Finnish 2630 Meteorological Institute. 2631 CONFIG: OSTYPE(osf1) now sets DefaultUserID (confDEF_USER_ID) to 2632 daemon since DEC's /bin/mail will drop the envelope 2633 sender if run as mailnull. See the Digital UNIX section 2634 of src/README for more information. Problem noted by 2635 Kari Hurtta of the Finnish Meteorological Institute. 2636 CONFIG: .cf files are now stored in the same directory with the 2637 .mc files instead of in the obj directory. 2638 CONFIG: New options confSINGLE_LINE_FROM_HEADER, 2639 confALLOW_BOGUS_HELO, and confMUST_QUOTE_CHARS for 2640 setting SingleLineFromHeader, AllowBogusHELO, and 2641 MustQuoteChars respectively. 2642 MAIL.LOCAL: support -l flag to run LMTP on stdin/stdout. This 2643 SMTP-like protocol allows detailed reporting of delivery 2644 status on a per-user basis. Code donated by John Myers of 2645 CMU (now of Netscape). 2646 MAIL.LOCAL: HP-UX support from Randall S. Winchester of the 2647 University of Maryland. NOTE: mail.local is not 2648 compatible with the stock HP-UX mail format. Be sure to 2649 read mail.local/README. 2650 MAIL.LOCAL: Prevent other mail delivery agents from stealing a 2651 mailbox lock. Patch from Randall S. Winchester of the 2652 University of Maryland. 2653 MAIL.LOCAL: glibc portability from John Kennedy of Cal State 2654 University, Chico. 2655 MAIL.LOCAL: IRIX portability from Kari Hurtta of the Finnish 2656 Meteorological Institute. 2657 MAILSTATS: Display the number of rejected and discarded messages 2658 in the StatusFile. Patch from Randall Winchester of the 2659 University of Maryland. 2660 MAKEMAP: New -s flag to ignore safety checks on database map files 2661 such as linked files in world writable directories. 2662 MAKEMAP: Add support for Berkeley DB 2.X. Remove OLD_NEWDB support. 2663 PRALIASES: Add support for Berkeley DB 2.X. 2664 PRALIASES: Do not automatically include NDBM support. Problem 2665 noted by Ralf Hildebrandt of the Technical University of 2666 Braunschweig. 2667 RMAIL: Improve portability for other platforms. Patches from 2668 Randall S. Winchester of the University of Maryland and 2669 Kari Hurtta of the Finnish Meteorological Institute. 2670 Changed Files: 2671 src/Makefiles/Makefile.* files have been modified to use 2672 the new build mechanism and are now BuildTools/OS/*. 2673 src/makesendmail changed to symbolic link to src/Build. 2674 New Files: 2675 BuildTools/M4/header.m4 2676 BuildTools/M4/depend/BSD.m4 2677 BuildTools/M4/depend/CC-M.m4 2678 BuildTools/M4/depend/NCR.m4 2679 BuildTools/M4/depend/Solaris.m4 2680 BuildTools/M4/depend/X11.m4 2681 BuildTools/M4/depend/generic.m4 2682 BuildTools/OS/AIX.4.2 2683 BuildTools/OS/AIX.4.x 2684 BuildTools/OS/CRAYT3E.2.0.x 2685 BuildTools/OS/HP-UX.11.x 2686 BuildTools/OS/IRIX.6.5 2687 BuildTools/OS/NEXTSTEP.4.x 2688 BuildTools/OS/NeXT.4.x 2689 BuildTools/OS/NetBSD.8.3 2690 BuildTools/OS/QNX 2691 BuildTools/OS/SunOS.5.7 2692 BuildTools/OS/dcosx.1.x.NILE 2693 BuildTools/README 2694 BuildTools/Site/README 2695 BuildTools/bin/Build 2696 BuildTools/bin/configure.sh 2697 BuildTools/bin/find_m4.sh 2698 BuildTools/bin/install.sh 2699 Makefile 2700 cf/cf/Build 2701 cf/cf/generic-hpux10.cf 2702 cf/feature/accept_unqualified_senders.m4 2703 cf/feature/accept_unresolvable_domains.m4 2704 cf/feature/access_db.m4 2705 cf/feature/blacklist_recipients.m4 2706 cf/feature/loose_relay_check.m4 2707 cf/feature/local_lmtp.m4 2708 cf/feature/promiscuous_relay.m4 2709 cf/feature/rbl.m4 2710 cf/feature/relay_based_on_MX.m4 2711 cf/feature/relay_entire_domain.m4 2712 cf/feature/relay_hosts_only.m4 2713 cf/feature/relay_local_from.m4 2714 cf/ostype/qnx.m4 2715 contrib/doublebounce.pl 2716 mail.local/Build 2717 mail.local/Makefile.m4 2718 mail.local/README 2719 mailstats/Build 2720 mailstats/Makefile.m4 2721 makemap/Build 2722 makemap/Makefile.m4 2723 praliases/Build 2724 praliases/Makefile.m4 2725 rmail/Build 2726 rmail/Makefile.m4 2727 rmail/rmail.0 2728 smrsh/Build 2729 smrsh/Makefile.m4 2730 src/Build 2731 src/Makefile.m4 2732 src/snprintf.c 2733 Deleted Files: 2734 cf/cf/Makefile (replaced by Makefile.dist) 2735 mail.local/Makefile 2736 mail.local/Makefile.dist 2737 mailstats/Makefile 2738 mailstats/Makefile.dist 2739 makemap/Makefile 2740 makemap/Makefile.dist 2741 praliases/Makefile 2742 praliases/Makefile.dist 2743 rmail/Makefile 2744 smrsh/Makefile 2745 smrsh/Makefile.dist 2746 src/Makefile 2747 src/Makefiles/Makefile.AIX.4 (split into AIX.4.x and AIX.4.2) 2748 src/Makefiles/Makefile.SMP_DC.OSx.NILE 2749 (renamed BuildTools/OS/dcosx.1.x.NILE) 2750 src/Makefiles/Makefile.Utah (obsolete platform) 2751 Renamed Files: 2752 READ_ME => README 2753 cf/cf/Makefile.dist => Makefile 2754 cf/cf/obj/* => cf/cf/* 2755 src/READ_ME => src/README 2756 27578.8.8/8.8.8 1997/10/24 2758 If the check_relay ruleset failed, the relay= field was logged 2759 incorrectly. Problem noted by Kari Hurtta of the Finnish 2760 Meteorological Institute. 2761 If /usr/tmp/dead.letter already existed, sendmail could not 2762 add additional bounces to it. Problem noted by Thomas J. 2763 Arseneault of SRI International. 2764 If an SMTP mailer used a non-standard port number for the outgoing 2765 connection, it would be displayed incorrectly in verbose mode. 2766 Problem noted by John Kennedy of Cal State University, Chico. 2767 Log the ETRN parameter specified by the client before altering them 2768 to internal form. Suggested by Bob Kupiec of GES-Verio. 2769 EXPN and VRFY SMTP commands on malformed addresses were logging as 2770 User unknown with bogus delay= values. Change them to log 2771 the same as compliant addresses. Problem noted by Kari E. 2772 Hurtta of the Finnish Meteorological Institute. 2773 Ignore the debug resolver option unless using sendmail debug trace 2774 option for resolver. Problem noted by Greg Nichols of Wind 2775 River Systems. 2776 If SingleThreadDelivery was enabled and the remote server returned a 2777 protocol error on the DATA command, the connection would be 2778 closed but the persistent host status file would not be 2779 unlocked so other sendmail processes could not deliver to 2780 that host. Problem noted by Peter Wemm of DIALix. 2781 If queueing up a message due to an expensive mailer, don't increment 2782 the number of delivery attempts or set the last delivery 2783 attempt time so the message will be delivered on the next 2784 queue run regardless of MinQueueAge. Problem noted by 2785 Brian J. Coan of the Institute for Global Communications. 2786 Authentication warnings of "Processed from queue _directory_" and 2787 "Processed by _username_ with -C _filename_" would be logged 2788 with the incorrect timestamp. Problem noted by Kari E. Hurtta 2789 of the Finnish Meteorological Institute. 2790 Use a better heuristic for detecting GDBM. 2791 Log null connections on dropped connections. Problem noted by 2792 Jon Lewis of Florida Digital Turnpike. 2793 If class dbm maps are rebuilt, sendmail will now detect this and 2794 reopen the map. Previously, they could give stale 2795 results during a single message processing (but would 2796 recover when the next message was received). Fix from 2797 Joe Pruett of Q7 Enterprises. 2798 Do not log failures such as "User unknown" on -bv or SMTP VRFY 2799 requests. Problem noted by Kari E. Hurtta of the 2800 Finnish Meteorological Institute. 2801 Do not send a bounce message back to the sender regarding bad 2802 recipients if the SMTP connection is dropped before the 2803 message is accepted. Problem noted by Kari E. Hurtta of the 2804 Finnish Meteorological Institute. 2805 Use "localhost" instead of "[UNIX: localhost]" when connecting to 2806 sendmail via a UNIX pipe. This will allow rulesets using 2807 $&{client_name} to process without sending the string through 2808 dequote. Problem noted by Alan Barrett of Internet Africa. 2809 A combination of deferred delivery mode, a double bounce situation, 2810 and the inability to save a bounce message to 2811 /var/tmp/dead.letter would cause sendmail to send a bounce 2812 to postmaster but not remove the offending envelope from the 2813 queue causing it to create a new bounce message each time the 2814 queue was run. Problem noted by Brad Doctor of Net Daemons 2815 Associates. 2816 Remove newlines from hostname information returned via DNS. There are 2817 no known security implications of newlines in hostnames as 2818 sendmail filters newlines in all vital areas; however, this 2819 could cause confusing error messages. 2820 Starting with sendmail 8.8.6, mail sent with the '-t' option would be 2821 rejected if any of the specified addresses were bad. This 2822 behavior was modified to only reject the bad addresses and not 2823 the entire message. Problem noted by Jozsef Hollosi of 2824 SuperNet, Inc. 2825 Use Timeout.fileopen when delivering mail to a file. Suggested by 2826 Bryan Costales of InfoBeat, Inc. 2827 Display the proper Final-Recipient on DSN messages for non-SMTP 2828 mailers. Problem noted by Kari E. Hurtta of the 2829 Finnish Meteorological Institute. 2830 An error in calculating the available space in the list of addresses 2831 for logging deliveries could cause an address to be silently 2832 dropped. 2833 Include the initial user environment if sendmail is restarted via 2834 a HUP signal. This will give room for the process title. 2835 Problem noted by Jon Lewis of Florida Digital Turnpike. 2836 Mail could be delivered without a body if the machine does not 2837 support flock locking and runs out of processes during 2838 delivery. Fix from Chuck Lever of the University of Michigan. 2839 Drop recipient address from 251 and 551 SMTP responses per RFC 821. 2840 Problem noted by Kari E. Hurtta of the Finnish Meteorological 2841 Institute. 2842 Make sure non-rebuildable database maps are opened before the 2843 rebuildable maps (i.e., alias files) in case the database maps 2844 are needed for verifying the left hand side of the aliases. 2845 Problem noted by Lloyd Parkes of Victoria University. 2846 Make sure sender RFC822 source route addresses are alias expanded for 2847 bounce messages. Problem noted by Juergen Georgi of 2848 RUS University of Stuttgart. 2849 Minor lint fixes. 2850 Return a temporary error instead of a permanent error if an LDAP map 2851 search returns an error. This will allow sequenced maps which 2852 use other LDAP servers to be checked. Fix from Booker Bense 2853 of Stanford University. 2854 When automatically converting from quoted printable to 8bit text do 2855 not pad bare linefeeds with a space. Problem noted by Theo 2856 Nolte of the University of Technology Aachen, Germany. 2857 Portability: 2858 Non-standard C compilers may have had a problem compiling 2859 conf.c due to a standard C external declaration of 2860 setproctitle(). Problem noted by Ted Roberts of 2861 Electronic Data Systems. 2862 AUX: has a broken O_EXCL implementation. Reported by Jim 2863 Jagielski of jaguNET Access Services. 2864 BSD/OS: didn't compile if HASSETUSERCONTEXT was defined. 2865 Digital UNIX: Digital UNIX (and possibly others) moves 2866 loader environment variables into the loader memory 2867 area. If one of these environment variables (such as 2868 LD_LIBRARY_PATH) was the last environment variable, 2869 an invalid memory address would be used by the process 2870 title routine causing memory corruption. Problem 2871 noted by Sam Hartman of Mesa Internet Systems. 2872 GNU libc: uses an enum for _PC_CHOWN_RESTRICTED which caused 2873 chownsafe() to always return 0 even if the OS does 2874 not permit file giveaways. Problem noted by 2875 Yasutaka Sumi of The University of Tokyo. 2876 IRIX6: Syslog buffer size set to 512 bytes. Reported by 2877 Gerald Rinske of Siemens Business Services VAS. 2878 Linux: Pad process title with NULLs. Problem noted by 2879 Jon Lewis of Florida Digital Turnpike. 2880 SCO OpenServer 5.0: SIOCGIFCONF ioctl call returns an 2881 incorrect value for the number of interfaces. 2882 Problem noted by Chris Loelke of JetStream Internet 2883 Services. 2884 SINIX: Update for Makefile and syslog buffer size from Gerald 2885 Rinske of Siemens Business Services VAS. 2886 Solaris: Make sure HASGETUSERSHELL setting for SunOS is not 2887 used on a Solaris machine. Problem noted by 2888 Stephen Ma of Jtec Pty Limited. 2889 CONFIG: SINIX: Update from Gerald Rinske of Siemens Business 2890 Services VAS. 2891 MAKEMAP: Use a better heuristic for detecting GDBM. 2892 CONTRIB: expn.pl: Updated version from the author, David Muir Sharnoff. 2893 OP.ME: Document the F=i mailer flag. Problem noted by Per Hedeland of 2894 Ericsson. 2895 28968.8.7/8.8.7 1997/08/03 2897 If using Berkeley DB on systems without O_EXLOCK (open a file with 2898 an exclusive lock already set -- i.e., almost all systems 2899 except 4.4-BSD derived systems), the initial attempt at 2900 rebuilding aliases file if the database didn't already 2901 exist would fail. Patch from Raymund Will of LST Software 2902 GmbH. 2903 Bogus incoming SMTP commands would reset the SMTP conversation. 2904 Problem noted by Fredrik J�nsson of the Royal Institute 2905 of Technology, Stockholm. 2906 Since TCP Wrappers includes setenv(), unsetenv(), and putenv(), 2907 some environments could give "multiple definitions" for these 2908 routines during compilation. If using TCP Wrappers, assume 2909 that these routines are included as though they were in the 2910 C library. Patch from Robert La Ferla. 2911 When a NEWDB database map was rebuilt at the same time it was being 2912 used by a queue run, the maps could be left locked for the 2913 duration of the queue run, causing other processes to hang. 2914 Problem noted by Kendall Libby of Shore.NET. 2915 In some cases, NoRecipientAction=add-bcc was being ignored, so the 2916 mail was passed on without any recipient header. This could 2917 cause problems downstream. Problem noted by Xander Jansen 2918 of SURFnet ExpertiseCentrum. 2919 Give error when GDBM is used with sendmail. GDBM's locking and 2920 linking of the .dir and .pag files interferes with sendmail's 2921 locking and security checks. Problems noted by Fyodor 2922 Yarochkin of the Kyrgyz Republic FreeNet. 2923 Don't fsync qf files if SuperSafe option is not set. 2924 Avoid extra calls to gethostbyname for addresses for which a 2925 gethostbyaddr found no value. Also, ignore any returns 2926 from gethostbyaddr that look like a dotted quad. 2927 If PTR lookup fails when looking up an SMTP peer, don't tag it as 2928 "may be forged", since at the network level we pretty much 2929 have to assume that the information is good. 2930 In some cases, errors during an SMTP session could leave files 2931 open or locked. 2932 Better handling of missing file descriptors (0, 1, 2) on startup. 2933 Better handling of non-setuid binaries -- avoids certain obnoxious 2934 errors during testing. 2935 Errors in file locking of NEWDB maps had the incorrect file name 2936 printed in the error message. 2937 If the AllowBogusHELO option were set and an EHLO with a bad or 2938 missing parameter were issued, the EHLO behaved like a HELO. 2939 Load limiting never kicked in for incoming SMTP transactions if the 2940 DeliveryMode=background and any recipient was an alias or 2941 had a .forward file. From Nik Conwell of Boston University. 2942 On some non-Posix systems, the decision of whether chown(2) permits 2943 file giveaway was undefined. From Tetsu Ushijima of the 2944 Tokyo Institute of Technology. 2945 Fix race condition that could cause the body of a message to be 2946 lost (so only the header was delivered). This only occurs 2947 on systems that do not use flock(2), and only when a queue 2948 runner runs during a critical section in another message 2949 delivery. Based on a patch from Steve Schweinhart of 2950 Results Computing. 2951 If a qf file was found in a mail queue directory that had a problem 2952 (wrong ownership, bad format, etc.) and the file name was 2953 exactly MAXQFNAME bytes long, then instead of being tried 2954 once, it would be tried on every queue run. Problem noted 2955 by Bryan Costales of Mercury Mail. 2956 If the system supports an st_gen field in the status structure, 2957 include it when reporting that a file has changed after open. 2958 This adds a new compile flag, HAS_ST_GEN (0/1 option). 2959 This out to be checked as well as reported, since it is 2960 theoretically possible for an attacker to remove a file after 2961 it is opened and replace it with another file that has the 2962 same i-number, but some filesystems (notably AFS) return 2963 garbage in this field, and hence always look like the file 2964 has changed. As a practical matter this is not a security 2965 problem, since the files can be neither hard nor soft links, 2966 and on no filesystem (that I am aware of) is it possible to 2967 have two files on the same filesystem with the same i-number 2968 simultaneously. 2969 Delete the root Makefile from the distribution -- it is only for 2970 use internally, and does not work at customer sites. 2971 Fix botch that caused the second MAIL FROM: command in a single 2972 transaction to clear the entire transaction. Problem 2973 noted by John Kennedy of Cal State University, Chico. 2974 Work properly on machines that have _PATH_VARTMP defined without 2975 a trailing slash. (And a pox on vendors that decide to 2976 ignore the established conventions!) Problem noted by 2977 Gregory Neil Shapiro of WPI. 2978 Internal changes to make it easier to add another protocol family 2979 (intended for IPv6). Patches are from John Kennedy of 2980 CSU Chico. 2981 In certain cases, 7->8 bit MIME decoding of Base64 text could leave 2982 an extra space at the beginning of some lines. Problem 2983 noted by Charles Karney of Princeton University; fix based 2984 on a patch from Christophe Wolfhugel. 2985 Portability: 2986 Allow _PATH_VENDOR_CF to be set in Makefile for consistency 2987 with the _Sendmail_ book, 2nd edition. Note that 2988 the book is actually wrong: _PATH_SENDMAILCF should 2989 be used instead. 2990 AIX 3.x: Include <sys/select.h>. Patch from Gene Rackow 2991 of Argonne National Laboratory. 2992 OpenBSD from from Paul DuBois of the University of Wisconsin. 2993 RISC/os 4.0 from Paul DuBois of the University of Wisconsin. 2994 SunOS: Include <memory.h> to fix warning from util.c. From 2995 James Aldridge of EUnet Ltd. 2996 Solaris: Change STDIR (location of status file) to /etc/mail 2997 in Makefiles. 2998 Linux, Dynix, UNICOS: Remove -DNDBM and -lgdbm from 2999 Makefiles. Use NEWDB on Linux instead. 3000 NCR MP-RAS 3.x with STREAMware TCP/IP: SIOCGIFNUM ioctl 3001 exists but behaves differently than other OSes. 3002 Add SIOCGIFNUM_IS_BROKEN compile flag to get 3003 around the problem. Problem noted by Tom Moore of 3004 NCR Corp. 3005 HP-UX 9.x: fix compile warnings for old select API. Problem 3006 noted by Tom Smith of Digital Equipment Corp. 3007 UnixWare 2.x: compile warnings on offsetof macro. Problem 3008 noted by Tom Good of the Community Access Information 3009 Resource Network 3010 SCO 4.2: compile problems caused by a change in the type of 3011 the "length" parameters passed to accept, getpeername, 3012 getsockname, and getsockopt. Adds new compile flags 3013 SOCKADDR_SIZE_T and SOCKOPT_SIZE_T. Problem reported 3014 by Tom Good of St. Vincent's North Richmond Community 3015 Mental Health Center Residential Services. 3016 AIX 4: Use size_t for SOCKADDR_SIZE_T and SOCKOPT_SIZE_T. 3017 Suggested by Brett Hogden of Rochester Gas & Electric 3018 Corp. 3019 Linux: avoid compile problem for versions of <setjmp.h> that 3020 #define both setjmp and longjmp. Problem pointed out 3021 by J.R. Oldroyd of TerraNet. 3022 CONFIG: SCO UnixWare 2.1: Support for OSTYPE(sco-uw-2.1) 3023 from Christopher Durham of SCO. 3024 CONFIG: NEXTSTEP: define confCW_FILE to 3025 /etc/sendmail/sendmail.cw to match the usual 3026 configuration. Patch from Dennis Glatting of 3027 PlainTalk. 3028 CONFIG: MAILER(fax) called a program that hasn't existed for a long 3029 time. Convert to use the HylaFAX 4.0 conventions. Suggested 3030 by Harry Styron. 3031 CONFIG: Improve sample anti-spam rulesets in cf/cf/knecht.mc. These 3032 are the rulesets in use on sendmail.org. 3033 MAKEMAP: give error on GDBM files. 3034 MAIL.LOCAL: Make error messages a bit more explicit, for example, 3035 telling more details on what actually changed when "file 3036 changed after open". 3037 CONTRIB: etrn.pl: Ignore comments in Fw files. Support multiple Fw 3038 files. 3039 CONTRIB: passwd-to-alias.pl: Handle 8 bit characters and '-'. 3040 NEW FILES: 3041 src/Makefiles/Makefile.OpenBSD 3042 src/Makefiles/Makefile.RISCos.4_0 3043 test/t_exclopen.c 3044 cf/ostype/sco-uw-2.1.m4 3045 DELETED FILES: 3046 Makefile 3047 30488.8.6/8.8.6 1997/06/14 3049 ************************************************************* 3050 * The extensive assistance of Gregory Neil Shapiro of WPI * 3051 * in preparing this release is gratefully appreciated. * 3052 * Sun Microsystems has also provided resources toward * 3053 * continued sendmail development. * 3054 ************************************************************* 3055 SECURITY: A few systems allow an open with the O_EXCL|O_CREAT open 3056 mode bits set to create a file that is a symbolic link that 3057 points nowhere. This makes it possible to create a root 3058 owned file in an arbitrary directory by inserting the symlink 3059 into a writable directory after the initial lstat(2) check 3060 determined that the file did not exist. The only verified 3061 example of a system having these odd semantics for O_EXCL 3062 and symbolic links was HP-UX prior to version 9.07. Most 3063 systems do not have the problem, since a exclusive create 3064 of a file disallows symbolic links. Systems that have been 3065 verified to NOT have the problem include AIX 3.x, *BSD, 3066 DEC OSF/1, HP-UX 9.07 and higher, Linux, SunOS, Solaris, 3067 and Ultrix. This is a potential exposure on systems that 3068 have this bug and which do not have a MAILER-DAEMON alias 3069 pointing at a legitimate account, since this will cause old 3070 mail to be dropped in /var/tmp/dead.letter. 3071 SECURITY: Problems can occur on poorly managed systems, specifically, 3072 if maps or alias files are in world writable directories. 3073 If your system has alias maps in writable directories, it 3074 is potentially possible for an attacker to replace the .db 3075 (or .dir and .pag) files by symbolic links pointing at 3076 another database; this can be used either to expose 3077 information (e.g., by pointing an alias file at /etc/spwd.db 3078 and probing for accounts), or as a denial-of-service attack 3079 (by trashing the password database). The fix disallows 3080 symbolic links entirely when rebuilding alias files or on 3081 maps that are in writable directories, and always warns on 3082 writable directories; 8.9 will probably consider writable 3083 directories to be fatal errors. This does not represent an 3084 exposure on systems that have alias files in unwritable 3085 system directories. 3086 SECURITY: disallow .forward or :include: files that are links (hard 3087 or soft) if the parent directory (or any directory in the 3088 path) is writable by anyone other than the owner. This is 3089 similar to the previous case for user files. This change 3090 should not affect most systems, but is necessary to prevent 3091 an attacker who can write the directory from pointing such 3092 files at other files that are readable only by the owner. 3093 SECURITY: Tighten safechown rules: many systems will say that they 3094 have a safe (restricted to root) chown even on files that 3095 are mounted from another system that allows owners to give 3096 away files. The new rules are very strict, trusting file 3097 ownership only in those few cases where the system has 3098 been verified to be at least as paranoid as necessary. 3099 However, it is possible to relax the rules to partially 3100 trust the ownership if the directory path is not world or 3101 group writable. This might allow someone who has a legitimate 3102 :include: file (referenced directly from /etc/aliases) to 3103 become another non-root user if the :include: file is in a 3104 non-writable directory on an NFS-mounted filesystem where 3105 the local system says that giveaway is denied but it is 3106 actually permitted. I believe this to be a very small set 3107 of cases. If in doubt, do not point :include: aliases at 3108 NFS-mounted filesystems. 3109 SECURITY: When setting a numeric group id using the RunAsUser option 3110 (e.g., "O RunAsUser=10:20", the group id would not be set. 3111 Implicit group ids (e.g., "O RunAsUser=mailnull") or alpha 3112 group ids (e.g., "O RunAsUser=mailuser:mailgrp") worked fine. 3113 The user id was still set properly. Problem noted by Uli 3114 Pralle of the Technical University of Berlin. 3115 Save the initial gid set for use when checking for if the 3116 PrivacyOptions=restrictmailq option is set. Problem reported 3117 by Wolfgang Ley of DFN-CERT. 3118 Make 55x reply codes to the SMTP DATA-"." be non-sticky (i.e., a 3119 failure on one message won't affect future messages to the 3120 same host). 3121 IP source route printing had an "off by one" error that would 3122 affect any options that came after the route option. Patch 3123 from Theo de Raadt. 3124 The "Message is too large" error didn't successfully bounce the error 3125 back to the sender. Problem reported by Stephen More of 3126 PSI; patch from Gregory Neil Shapiro of WPI. 3127 Change SMTP status code 553 to map into Extended code 5.1.0 (instead 3128 of 5.1.3); it apparently gets used in multiple ways. 3129 Suggested by John Myers of Portola Communications. 3130 Fix possible extra null byte generated during collection if errors 3131 occur at the beginning of the stream. Patch contributed by 3132 Andrey A. Chernov and Gregory Neil Shapiro. 3133 Code changes to avoid possible reentrant call of malloc/free within 3134 a signal handler. Problem noted by John Beck of Sun 3135 Microsystems. 3136 Move map initialization to be earlier so that check_relay ruleset 3137 will have the latest version of the map data. Problem noted 3138 by Paul Forgey of Metainfo; patch from Gregory Neil Shapiro. 3139 If there are fatal errors during the collection phase (e.g., message 3140 too large) don't send the bogus message. 3141 Avoid "cannot open xfAAA00000" messages when sending to aliases that 3142 have errors and have owner- aliases. Problem noted by Michael 3143 Barber of MTU; fix from Gregory Neil Shapiro of WPI. 3144 Avoid null pointer dereference on illegal Boundary= parameters in 3145 multipart/mixed Content-Type: header. Problem noted by 3146 Richard Muirden of RMIT University. 3147 Always print error messages during newaliases (-bi) even if the 3148 ErrorMode is not set to "print". Fix from Gregory Neil 3149 Shapiro. 3150 Test mode could core dump if you did a /map lookup in an optional map 3151 that could not be opened. Based on a fix from John Beck of 3152 Sun Microsystems. 3153 If DNS is misconfigured so that the last MX record tried points to 3154 a host that does not have an A record, but other MX records 3155 pointed to something reasonable, don't bounce the message 3156 with a "host unknown" error. Note that this should really 3157 be fixed in the zone file for the domain. Problem noted by 3158 Joe Rhett of Navigist, Inc. 3159 If a map fails (e.g., DNS times out) on all recipient addresses, mark 3160 the message as having been tried; otherwise the next queue 3161 run will not realize that this is a second attempt and will 3162 retry immediately. Problem noted by Bryan Costales of 3163 Mercury Mail. 3164 If the clock is set backwards, and a MinQueueAge is set, no jobs 3165 will be run until the later setting of the clock is reached. 3166 "Problem" (I use the term loosely) noted by Eric Hagberg of 3167 Morgan Stanley. 3168 If the load average rises above the cutoff threshold (above which 3169 sendmail will not process the queue at all) during a queue 3170 run, abort the queue run immediately. Problem noted by 3171 Bryan Costales of Mercury Mail. 3172 The variable queue processing algorithm (based on the message size, 3173 number of recipients, message precedence, and job age) was 3174 non-functional -- either the entire queue was processed or 3175 none of the queue was processed. The updated algorithm 3176 does no queue run if a single recipient zero size job will 3177 not be run. 3178 If there is a fatal ("panic") message that will cause sendmail to 3179 die immediately, never hold the error message for future 3180 printing. 3181 Force ErrorMode=print in -bt mode so that all errors are printed 3182 regardless of the setting of the ErrorMode option in the 3183 configuration file. Patch from Gregory Neil Shapiro. 3184 New compile flag HASSTRERROR says that this OS has the strerror(3) 3185 routine available in one of the libraries. Use it in conf.h. 3186 The -m (match only) flag now works on host class maps. 3187 If class hash or btree maps are rebuilt, sendmail will now detect 3188 this and reopen the map. Previously, they could give 3189 erroneous results during a single message processing 3190 (but would recover when the next message was received). 3191 Don't delete zero length queue files when doing queue runs until the 3192 files are at least ten minutes old. This avoids a potential 3193 race condition: the creator creates the qf file, getting back 3194 a file descriptor. The queue runner locks it and deletes it 3195 because it is zero length. The creator then writes the 3196 descriptor that is now for a disconnected file, and the 3197 job goes away. Based on a suggestion by Bryan Costales. 3198 When determining the "validated" host name ($_ macro), do a forward 3199 (A) DNS lookup on the result of the PTR lookup and compare 3200 results. If they differ or if the PTR lookup fails, tag the 3201 address as "may be forged". 3202 Log null connections (i.e., hosts that connect but do not do any 3203 substantive activity on the connection before disconnecting; 3204 "substantive" is defined to be MAIL, EXPN, VRFY, or ETRN. 3205 Always permit "writes" to /dev/null regardless of the link count. 3206 This is safe because /dev/null is special cased, and no open 3207 or write is ever actually attempted. Patch from Villy Kruse 3208 of TwinCom. 3209 If a message cannot be sent because of a 552 (exceeded storage 3210 allocation) response to the MAIL FROM:<>, and a SIZE= parameter 3211 was given, don't return the body in the bounce, since there 3212 is a very good chance that the message will double-bounce. 3213 Fix possible line truncation if a quoted-printable had an =00 escape 3214 in the body. Problem noted by Charles Karney of the Princeton 3215 Plasma Physics Laboratory. 3216 Notify flags (e.g., -NSUCCESS) were lost on user+detail addresses. 3217 Problem noted by Kari Hurtta of the Finnish Meteorological 3218 Institute. 3219 The MaxDaemonChildren option wasn't applying to queue runs as 3220 documented. Note that this increases the potential denial 3221 of service problems with this option: an attacker can 3222 connect many times, and thereby lock out queue runs as well 3223 as incoming connections. If you use this option, you should 3224 run the "sendmail -bd" and "sendmail -q30m" jobs separately 3225 to avoid this attack. Failure to limit noted by Matthew 3226 Dillon of BEST Internet Communications. 3227 Always give a message in newaliases if alias files cannot be 3228 opened instead of failing silently. Suggested by Gregory 3229 Neil Shapiro. This change makes the code match the O'Reilly 3230 book (2nd edition). 3231 Some older versions of the resolver could return with h_errno == -1 3232 if no name server could be reached, causing mail to bounce 3233 instead of queueing. Treat this like TRY_AGAIN. Fix from 3234 John Beck of SunSoft. 3235 If a :include: file is owned by a user that does not have an entry 3236 in the passwd file, sendmail could dereference a null pointer. 3237 Problem noted by Satish Mynam of Sun Microsystems. 3238 Take precautions to make sure that the SMTP protocol cannot get out 3239 of sync if (for example) an alias file cannot be opened. 3240 Fix a possible race condition that can cause a SIGALRM to come in 3241 immediately after a SIGHUP, causing the new sendmail to die. 3242 Avoid possible hang on SVr3 systems when doing child reaping. Patch 3243 from Villy Kruse of TwinCom. 3244 Ignore improperly formatted SMTP reply codes. Previously these were 3245 partially processed, which could cause confusing error 3246 returns. 3247 Fix possible bogus pointer dereference when doing ldapx map lookups 3248 on some architectures. 3249 Portability: 3250 A/UX: from Jim Jagielski of NASA/GSFC. 3251 glibc: SOCK_STREAM was changed from a #define to an enum, 3252 thus breaking #ifdef SOCK_STREAM. Only option seems 3253 to be to assume SOCK_STREAM if __GNU_LIBRARY__ is 3254 defined. Problem reported by A Sun of the University 3255 of Washington. 3256 Solaris: use SIOCGIFNUM to get the number of interfaces on 3257 the system rather than guessing at compile time. 3258 Patch contributed by John Beck of Sun Microsystems. 3259 Intel Paragon: from Wendy Lin of Purdue University. 3260 GNU Hurd: from Miles Bader of the GNU project. 3261 RISC/os 4.50 from Harlan Stenn of PFCS Corporation. 3262 ISC Unix: wait never returns if SIGCLD signals are blocked. 3263 Unfortunately releasing them opens a race condition, 3264 but there appears to be no fix for this. Patch from 3265 Gregory Neil Shapiro. 3266 BIND 8.1 for IPv6 compatibility from John Kennedy. 3267 Solaris: a bug in strcasecmp caused characters with the 3268 high order bit set to apparently randomly match 3269 letters -- for example, $| (0233) matches "i" and "I". 3270 Problem noted by John Gregson of the University of 3271 Cambridge. 3272 IRIX 6.x: make Makefile.IRIX.6.2 apply to all 6.x. From 3273 Kari Hurtta. 3274 IRIX 6.x: Create Makefiles for systems that claim to be 3275 IRIX64 but are 6.2 or higher (so use the regular 3276 IRIX Makefile). 3277 IRIX 6.x: Fix load average computation on 64 bit kernels. 3278 Problem noted by Eric Hagberg of Morgan Stanley. 3279 CONFIG: Some canonification was still done for UUCP-like addresses 3280 even if FEATURE(nocanonify) was set. Problem pointed out by 3281 Brian Candler. 3282 CONFIG: In some cases UUCP mailers wouldn't properly recognize all 3283 local names as local. Problem noted by Jeff Polk of BSDI; 3284 fix provided by Gregory Neil Shapiro. 3285 CONFIG: The "local:user" syntax entries in mailertables and other 3286 "mailer:user" syntax locations returned an incorrect value 3287 for the $h macro. Problem noted by Gregory Neil Shapiro. 3288 CONFIG: Retain "+detail" information when forwarding mail to a 3289 MAIL_HUB, LUSER_RELAY, or LOCAL_RELAY. Patch from Philip 3290 Guenther of Gustavus Adolphus College. 3291 CONFIG: Make sure user+detail works for FEATURE(virtusertable); 3292 rules are the same as for aliasing. Based on a patch from 3293 Gregory Neil Shapiro. 3294 CONFIG: Break up parsing rules into several pieces; this should 3295 have no functional change in this release, but makes it 3296 possible to have better anti-spam rulesets in the future. 3297 CONFIG: Disallow double dots in host names to avoid having the 3298 HostStatusDirectory store status under the wrong name. 3299 In some cases this can be used as a denial-of-service attack. 3300 Problem noted by Ron Jarrell of Virginia Tech, patch from 3301 Gregory Neil Shapiro. 3302 CONFIG: Don't use F=m (multiple recipients per invocation) for 3303 MAILER(procmail), but do pass F=Pn9 (include Return-Path:, 3304 don't include From_, and convert to 8-bit). Suggestions 3305 from Kimmo Suominen and Roderick Schertler. 3306 CONFIG: Domains under $=M (specified with MASQUERADE_DOMAIN) were 3307 being masqueraded as though FEATURE(masquerade_entire_domain) 3308 was specified, even when it wasn't. 3309 MAIL.LOCAL: Solaris 2.6 has snprintf. From John Beck of SunSoft. 3310 MAIL.LOCAL: SECURITY: check to make sure that an attacker doesn't 3311 "slip in" a symbolic link between the lstat(2) call and the 3312 exclusive open. This is only a problem on System V derived 3313 systems that allow an exclusive create on files that are 3314 symbolic links pointing nowhere. 3315 MAIL.LOCAL: If the final mailbox close() failed, the user id was 3316 not reset back to root, which on some systems would cause 3317 later mailboxes to fail. Also, any partial message would 3318 not be truncated, which could result in repeated deliveries. 3319 Problem noted by Bruce Evans via Peter Wemm (FreeBSD 3320 developers). 3321 MAKEMAP: Handle cases where O_EXLOCK is #defined to be 0. A similar 3322 change to the sendmail map code was made in 8.8.3. Problem 3323 noted by Gregory Neil Shapiro. 3324 MAKEMAP: Give warnings on file problems such as map files that are 3325 symbolic links; although makemap is not setuid root, it is 3326 often run as root and hence has the potential for the same 3327 sorts of problems as alias rebuilds. 3328 MAKEMAP: Change compilation so that it will link properly on 3329 NEXTSTEP. 3330 CONTRIB: etrn.pl: search for Cw as well as Fw lines in sendmail.cf. 3331 Accept an optional list of arguments following the server 3332 name for the ETRN arguments to use (instead of $=w). Other 3333 miscellaneous bug fixes. From Christian von Roques via 3334 John Beck of Sun Microsystems. 3335 CONTRIB: Add passwd-to-alias.pl, contributed by Kari Hurtta. This 3336 Perl script converts GECOS information in the /etc/passwd 3337 file into aliases, allowing for faster access to full name 3338 lookups; it is also clever about adding aliases (to root) 3339 for system accounts. 3340 NEW FILES: 3341 src/safefile.c 3342 cf/ostype/gnuhurd.m4 3343 cf/ostype/irix6.m4 3344 contrib/passwd-to-alias.pl 3345 src/Makefiles/Makefile.IRIX64.6.1 3346 src/Makefiles/Makefile.IRIX64.6.x 3347 RENAMED FILES: 3348 src/Makefiles/Makefile.IRIX.6.2 => Makefile.IRIX.6.x 3349 src/Makefiles/Makefile.IRIX64 => Makefile.IRIX64.6.0 3350 33518.8.5/8.8.5 1997/01/21 3352 SECURITY: Clear out group list during startup. Without this, sendmail 3353 will continue to run with the group permissions of the caller, 3354 even if RunAsUser is specified. 3355 SECURITY: Make purgestat (-bH) be root-only. This is not in response 3356 to any known attack, but it's best to be conservative. 3357 Suggested by Peter Wemm of DIALix. 3358 SECURITY: Fix buffer overrun problem in MIME code that has possible 3359 security implications. Patch from Alex Garthwaite of the 3360 University of Pennsylvania. 3361 Use of a -f flag with a phrase attached (e.g., "-f 'Full Name <addr>'") 3362 would truncate the address after "Full". Although the -f 3363 syntax is incorrect (since it is in the envelope, it 3364 shouldn't have comments and full names), the failure mode 3365 was unnecessarily awful. 3366 Fix a possible null pointer dereference when converting 8-bit data 3367 to a 7-bit format. Problem noted by Jim Hutchins of 3368 Sandia National Labs and David James of British Telecom. 3369 Clear out stale state that affected F=9 on SMTP mailers in queue 3370 runs. Although this really shouldn't be used (F=9 is for 3371 final delivery only, and using it on an SMTP mailer makes 3372 it possible for a message to be converted from 8->7->8->7 3373 bits several times), it shouldn't have failed with a syserr. 3374 Problem noted by Eric Hagberg of Morgan Stanley. 3375 _Really_ fix the multiple :maildrop code in the user database 3376 module. Patch from Roy Mongiovi of Georgia Tech. 3377 Let F lines in the configuration file actually read root-only 3378 files if the configuration file is safe. Based on a 3379 patch from Keith Reynolds of SCO. 3380 ETRN followed by QUIT would hold the connection open until the queue 3381 run completed. Problem noted by Truck Lewis of TDK 3382 Semiconductor Corp. 3383 It turns out that despite the documentation, the TCP wrappers library 3384 does _not_ log rejected connections. Do the logging ourselves. 3385 Problem noted by Fletcher Mattox of the University of Texas 3386 at Austin. 3387 If sendmail finds a qf file in its queue directory that is an unknown 3388 version (e.g., when backing out to an old version), the 3389 error is reported on every queue run. Change it to only 3390 give the error once (and rename the qf => Qf). Patch from 3391 William A. Gianopoulos of Raytheon Company. 3392 Start a new session when doing background delivery; currently it 3393 ignored signals but didn't start a new signal, that caused 3394 some problems if a background process tried to send mail 3395 under certain circumstances. Problem noted by Eric Hagberg 3396 of Morgan Stanley; fix from Kari Hurtta. 3397 Simplify test for skipping a queue run to just check if the current 3398 load average is >= the queueing load average. Previously 3399 the check factored in some other parameters that caused it 3400 to essentially never skip the queue run. Patch from Bryan 3401 Costales. 3402 If the SMTP server is running in "nullserver" mode (that is, it is 3403 rejecting all commands), start sleeping after MAXBADCOMMAND 3404 (25) commands; this helps prevent a bad guy from putting 3405 you into a tight loop as a denial-of-service attack. Based 3406 on an e-mail conversation with Brad Knowles of AOL. 3407 Slow down when too many "light weight" commands have been issued; 3408 this helps prevent a class of denial-of-service attacks. 3409 The current values and defaults are: 3410 MAXNOOPCOMMANDS 20 NOOP, VERB, ONEX, XUSR 3411 MAXHELOCOMMANDS 3 HELO, EHLO 3412 MAXVRFYCOMMANDS 6 VRFY, EXPN 3413 MAXETRNCOMMANDS 8 ETRN 3414 These will probably be configurable in a future release. 3415 On systems that have uid_t typedefed to be an unsigned short, programs 3416 that had the F=S flag and no U= equate would be invoked with 3417 the real uid set to 65535 rather than being left unchanged. 3418 In some cases, NOTIFY=NEVER was not being honored. Problem noted 3419 by Steve Hubert of the University of Washington, Seattle. 3420 Mail that was Quoted-Printable encoded and had a soft line break on 3421 the last line (i.e., an incomplete continuation) had the last 3422 line dropped. Since this appears to be illegal it isn't 3423 clear what to do with it, but flushing the last line seems 3424 to be a better "fail soft" approach. Based on a patch from 3425 Eric Hagberg. 3426 If AllowBogusHELO and PrivacyOptions=needmailhelo are both set, a 3427 bogus HELO command still causes the "Polite people say HELO 3428 first" error message. Problem pointed out by Chris Thomas 3429 of UCLA; patch from John Beck of SunSoft. 3430 Handle "sendmail -bp -qSfoobar" properly if restrictqrun is set 3431 in PrivacyOptions. The -q shouldn't turn this command off. 3432 Problem noted by Murray Kucherawy of Pacific Bell Internet; 3433 based on a patch from Gregory Neil Shapiro of WPI. 3434 Don't consider SMTP reply codes 452 or 552 (exceeded storage allocation) 3435 in a DATA transaction to be sticky; these can occur because 3436 a message is too large, and smaller messages should still go 3437 through. Problem noted by Matt Dillon of Best Internet 3438 Communications. 3439 In some cases bounces were saved in /var/tmp/dead.letter even if they 3440 had been successfully delivered to the envelope sender. 3441 Problem noted Eric Hagberg of Morgan Stanley; solution from 3442 Gregory Neil Shapiro of WPI. 3443 Give better diagnostics on long alias lines. Based on code contributed 3444 by Patrick Gosling of the University of Cambridge. 3445 Increase the number of virtual interfaces that will be probed for 3446 alternate names. Problem noted by Amy Rich of Shore.Net. 3447 PORTABILITY: 3448 UXP/DS V20L10 for Fujitsu DS/90: Makefile patches from 3449 Toshiaki Nomura of Fujitsu Limited. 3450 SunOS with LDAP support: compile problems with struct timeval. 3451 Patch from Nick Cuccia of TCSI Corporation. 3452 SCO: from Keith Reynolds of SCO. 3453 Solaris: kstat load average computation wasn't being used. 3454 Fixes from Michael Ju. Tokarev of Telecom Service, JSC 3455 (Moscow). 3456 OpenBSD: from Jason Downs of teeny.org. 3457 Altos System V: from Tim Rice. 3458 Solaris 2.5: from Alan Perry of SunSoft. 3459 Solaris 2.6: from John Beck of SunSoft. 3460 Harris Nighthawk PowerUX (mh6000 box): from Bob Miorelli 3461 of Pratt & Whitney <miorelli@pweh.com>. 3462 CONFIG: It seems that I hadn't gotten the Received: line syntax 3463 _just_right_ yet. Tweak it again. I'll omit the names 3464 of the "contributors" (quantity two) in this one case. 3465 As of now, NO MORE DISCUSSION about the syntax of the 3466 Received: line. 3467 CONFIG: Although FEATURE(nullclient) uses EXPOSED_USER (class $=E), 3468 it never inserts that class into the output file. Fix it 3469 so it will honor EXPOSED_USER but will _not_ include root 3470 automatically in this class. Problem noted by Ronan KERYELL 3471 of Centre de Recherche en Informatique de l'�cole Nationale 3472 Sup�rieure des Mines de Paris (CRI-ENSMP). 3473 CONFIG: Clean up handling of "local:" syntax in relay specifications 3474 such as LUSER_RELAY. This change permits the following 3475 syntaxes: ``local:'' will send to the same user on the 3476 local machine (e.g., in a mailertable entry for "host", 3477 ``local:'' will cause an address addressed to user@host to 3478 go to user on the local machone). ``local:user'' will send 3479 to the named user on the local machine. ``local:user@host'' 3480 is equivalent to ``local:user'' (the host is ignored). In 3481 all cases, the original user@host is passed in $@ (i.e., the 3482 detail information). Inspired by a report from Michael Fuhr. 3483 CONFIG: Strip quotes from the first word of an "error:" host 3484 indication. This lets you set (for example) the LUSER_RELAY 3485 to be ``error:\"5.1.1\" Your Message Here''. Note the use 3486 of the \" so that the resulting string is properly quoted. 3487 Problem noted by Gregory Neil Shapiro of WPI. 3488 OP.ME: documentation was inconsistent about whether sendmail did a 3489 NOOP or a RSET to probe the connection (it does a RSET). 3490 Inconsistency noted by Deeran Peethamparam. 3491 OP.ME: insert additional blank pages so it will print properly on 3492 a duplex printer. From Matthew Black of Cal State University, 3493 Long Beach. 3494 34958.8.4/8.8.4 1996/12/02 3496 SECURITY: under some circumstances, an attacker could get additional 3497 permissions by hard linking to files that were group 3498 writable by the attacker. The solution is to disallow any 3499 files that have hard links -- this will affect .forward, 3500 :include:, and output files. Problem noted by Terry 3501 Kyriacopoulos of Interlog Internet Services. As a 3502 workaround, set UnsafeGroupWrites -- always a good idea. 3503 SECURITY: the TryNullMXList (w) option should not be safe -- if it 3504 is, it is possible to do a denial-of-service attack on 3505 MX hosts that rely on the use of the null MX list. There 3506 is no danger if you have this option turned off (the default). 3507 Problem noted by Dan Bernstein. Also, make the DontInitGroups 3508 unsafe. I know of no specific attack against this, although 3509 a denial-of-service attack is probably possible, but in theory 3510 you should not be able to safely tweak anything that affects 3511 the permissions that are used when mail is delivered. 3512 Purgestat could go into an infinite loop if one of the host status 3513 directories somehow became empty. Problem noted by Roy 3514 Mongiovi of Georgia Tech. 3515 Processes got "lost" when counting children due to a race condition. 3516 This caused "proc_list_probe: lost pid" messages to be logged. 3517 Problem noted by several people. 3518 On systems with System V SIGCLD child signal semantics (notably AIX 3519 and HP-UX), mail transactions would print the message "451 3520 SMTP-MAIL: lost child: No child processes". Problem noted 3521 by several people. 3522 Miscellaneous compiler warnings on picky compilers (or when setting 3523 gcc to high warning levels). From Tom Moore of NCR Corp. 3524 SMTP protocol errors, and most errors on MAIL FROM: lines should 3525 not be persistent between runs, since they are based on the 3526 message rather than the host. Problem noted by Matt Dillon 3527 of Best Internet Communications. 3528 The F=7 flag was ignored on SMTP mailers. Problem noted by Tom Moore 3529 of NCR (a.k.a., AT&T Global Information Solutions). 3530 Avoid the possibility of having a child daemon run to completion 3531 (including closing the SMTP socket) before the parent has 3532 had a chance to close the socket; this can cause the parent 3533 to hang for a long time waiting for the socket to drain. 3534 Patch from Don Lewis of TDK Semiconductor. 3535 If the fork() failed in a queue run, the queue runners would not be 3536 rescheduled (so queue runs would stop). Patch from Don Lewis. 3537 Some error conditions in ETRN could cause output without an SMTP 3538 status code. Problem noted by Don Lewis. 3539 Multiple :maildrop addresses in the user database didn't work properly. 3540 Patch from Roy Mongiovi of Georgia Tech. 3541 Add ".db" automatically onto any user database spec that does not 3542 already have it; this is for consistency with makemap, the 3543 K line, and the documentation. Inconsistency pointed out 3544 by Roy Mongiovi. 3545 Allow sendmail to be properly called in nohup mode. Patch from 3546 Kyle Jones of UUNET. 3547 Change ETRN to ignore but still update host status files; previously 3548 it would ignore them and not save the updated status, which 3549 caused stale information to be maintained. Based on a patch 3550 from Christopher Davis of Kapor Enterprises Inc. Also, have 3551 ETRN ignore the MinQueueAge option. 3552 Patch long term host status to recover more gracefully from an empty 3553 host status file condition. Patch from NAKAMURA Motonori 3554 of Kyoto University. 3555 Several patches to signal handling code to fix potential race 3556 conditions from Don Lewis. 3557 Make it possible to compile with -DDAEMON=0 (previously it had some 3558 compile errors). This turns DAEMON, QUEUE, and SMTP into 3559 0/1 compilation flags. Note that DAEMON is an obsolete 3560 compile flag; use NETINET instead. Solution based on a 3561 patch from Bryan Costales. 3562 PORTABILITY FIXES: 3563 AIX4: getpwnam() and getpwuid() do a sequential scan of the 3564 /etc/security/passwd file when called as root. This 3565 is very slow on some systems. To speed it up, use the 3566 (undocumented) _getpw{nam,uid}_shadow() routines. 3567 Patch from Chris Thomas of UCLA/OAC Systems Group. 3568 SCO 5.x: include -lprot in the Makefile. Patch from Bill 3569 Glicker of Burrelle's Information Service. 3570 NEWS-OS 4.x: need a definition for MODE_T to compile. Patch 3571 from Makoto MATSUSHITA of Osaka University. 3572 SunOS 4.0.3: compile problems. Patches from Andrew Cole of 3573 Leeds University and SASABE Tetsuro of the University 3574 of Tokyo. 3575 DG/UX 5.4.4.11 from Brian J. Murrell of InterLinx Support 3576 Services, Inc. 3577 Domain/OS from Don (Truck) Lewis of TDK Semiconductor Corp. 3578 I believe this to have only been a problem if you 3579 compiled with -DUSE_VENDOR_CF_PATH -- another reason 3580 to stick with /etc/sendmail.cf as your One True Path. 3581 Digital UNIX (OSF/1 on Alpha) load average computation from 3582 Martin Laubach of the Technischen Universit�t Wien. 3583 CONFIG: change default Received: line to be multiple lines rather 3584 than one long one. By popular demand. 3585 MAIL.LOCAL: warnings weren't being logged on some systems. Patch 3586 from Jerome Berkman of U.C. Berkeley. 3587 MAKEMAP: be sure to zero hinfo to avoid cruft that can cause runs 3588 to take a very long time. Problem noted by Yoshiro YONEYA 3589 of NTT Software Corporation. 3590 CONTRIB: add etrn.pl, contributed by John Beck. 3591 NEW FILES: 3592 contrib/etrn.pl 3593 35948.8.3/8.8.3 1996/11/17 3595 SECURITY: it was possible to get a root shell by lying to sendmail 3596 about argv[0] and then sending it a signal. Problem noted 3597 by Leshka Zakharoff <leshka@leshka.chuvashia.su> on the 3598 best-of-security list. 3599 Log sendmail binary version number in "Warning: .cf version level 3600 (%d) exceeds program functionality (%d) message" -- this 3601 should make it clearer to people that they are running 3602 the wrong binary. 3603 Fix a problem that occurs when you open an SMTP connection and then 3604 do one or more ETRN commands followed by a MAIL command; at 3605 the end of the DATA phase sendmail would incorrectly report 3606 "451 SMTP-MAIL: lost child: No child processes". Problem 3607 noted by Eric Bishop of Virginia Tech. 3608 When doing text-based host canonification (typically /etc/hosts 3609 lookup), a null host name would match any /etc/hosts entry 3610 with space at the end of the line. Problem noted by Steve 3611 Hubert of the University of Washington, Seattle. 3612 7 to 8 bit BASE64 MIME conversions could duplicate bits of text. 3613 Problem reported by Tom Smith of Digital Equipment Corp. 3614 Increase the size of the DNS answer buffer -- the standard UDP packet 3615 size PACKETSZ (512) is not sufficient for some nameserver 3616 answers containing very many resource records. The resolver 3617 may also switch to TCP and retry if it detects UDP packet 3618 overflow. Also, allow for the fact that the resolver 3619 routines res_query and res_search return the size of the 3620 *un*truncated answer in case the supplied answer buffer it 3621 not big enough to accommodate the entire answer. Patch from 3622 Eric Wassenaar. 3623 Improvements to MaxDaemonChildren code. If you think you have too 3624 many children, probe the ones you have to verify that they 3625 are still around. Suggested by Jared Mauch of CICnet, Inc. 3626 Also, do this probe before growing the vector of children 3627 pids; this previously caused the vector to grow indefinitely 3628 due to a race condition. Problem reported by Kyle Jones of 3629 UUNET. 3630 On some architectures, <db.h> (from the Berkeley DB library) defines 3631 O_EXLOCK to zero; this fools the map compilation code into 3632 thinking that it can avoid race conditions by locking on open. 3633 Change it to check for O_EXLOCK non-zero. Problem noted by 3634 Leif Erlingsson of Data Lege. 3635 Always call res_init() on startup (if compiled in, of course) to 3636 allow the sendmail.cf file to tweak resolver flags; without 3637 it, flag tweaks in ResolverOptions are ignored. Patch from 3638 Andrew Sun of Merrill Lynch. 3639 Improvements to host status printing code. Suggested by Steve Hubert 3640 of the University of Washington, Seattle. 3641 Change MinQueueAge option processing to do the check for the job age 3642 when reading the queue file, rather than at the end; this 3643 avoids parsing the addresses, which can do DNS lookups. 3644 Problem noted by John Beck of InReference, Inc. 3645 When MIME was being 7->8 bit decoded, "From " lines weren't being 3646 properly escaped. Problem noted by Peter Nilsson of the 3647 University of Linkoping. 3648 In some cases, sendmail would retain root permissions during queue 3649 runs even if RunAsUser was set. Problem noted by Mark 3650 Thomas of Mark G. Thomas Consulting. 3651 If the F=l flag was set on an SMTP mailer to indicate that it is 3652 actually local delivery, and NOTIFY=SUCCESS is specified in 3653 the envelope, and the receiving SMTP server speaks DSN, then 3654 the DSN would be both generated locally and propagated to the 3655 other end. 3656 The U= mailer field didn't correctly extract the group id if the 3657 user id was numeric. Problem noted by Kenneth Herron of 3658 MCI Telecommunications Communications. 3659 If a message exceeded the fixed maximum size on input, the body of 3660 the message was included in the bounce. Note that this did 3661 not occur if it exceeded the maximum _output_ size. Problem 3662 reported by Kyle Jones of UUNET. 3663 PORTABILITY FIXES: 3664 AIX4: 4.1 doesn't have a working setreuid(2); change the 3665 AIX4 defines to use seteuid(2) instead, which 3666 works on 4.1 as well as 4.2. Problem noted by 3667 H�kan Lindholm of interAF, Sweden. 3668 AIX4: use tzname[] vector to determine time zone name. 3669 Patch from NAKAMURA Motonori of Kyoto University. 3670 MkLinux: add Makefile.Linux.ppc and OSTYPE(mklinux) support. 3671 Contributed by Paul DuBois <dubois@primate.wisc.edu>. 3672 Solaris: kstat(3k) support for retrieving the load average. 3673 This adds the LA_KSTAT definition for LA_TYPE. 3674 The outline of the implementation was contributed 3675 by Michael Tokarev of Telecom Service, JSC, Moscow. 3676 HP-UX 10.0 gripes about the (perfectly legal!) forward 3677 declaration of struct rusage at the top of conf.h; 3678 change it to only be included if you are using gcc, 3679 which is apparently the only compiler that requires 3680 it in the first place. Problem noted by Jeff 3681 Earickson of Colby College. 3682 IRIX: don't default to using gcc. IRIX is a civilized 3683 operating system that comes with a decent compiler 3684 by default. Problem noted by Barry Bouwsma and 3685 Kari Hurtta. 3686 CONFIG: specify F=9 as default in FEATURE(local_procmail) for 3687 consistency with other local mailers. Inconsistency 3688 pointed out by Teddy Hogeborn <teddy@fukt.hk-r.se>. 3689 CONFIG: if the "limited best mx" feature is used (to reduce DNS 3690 overhead) as part of the bestmx_is_local feature, the 3691 domain part was dropped from the name. Patch from Steve 3692 Hubert of the University of Washington, Seattle. 3693 CONFIG: catch addresses of the form "user@.dom.ain"; these could 3694 end up being translated to the null host name, which would 3695 return any entry in /etc/hosts that had a space at the end 3696 of the line. Problem noted by Steve Hubert of the 3697 University of Washington, Seattle. 3698 CONFIG: add OSTYPE(aix4). From Michael Sofka of Rensselaer 3699 Polytechnic Institute. 3700 MAKEMAP: tweak hash and btree parameters for better performance. 3701 Patch from Matt Dillon of Best Internet Communications. 3702 NEW FILES: 3703 src/Makefiles/Makefile.Linux.ppc 3704 cf/ostype/aix4.m4 3705 cf/ostype/mklinux.m4 3706 37078.8.2/8.8.2 1996/10/18 3708 SECURITY: fix a botch in the 7-bit MIME patch; the previous patch 3709 changed the code but didn't fix the problem. 3710 PORTABILITY FIXES: 3711 Solaris: Don't use the system getusershell(3); it can 3712 apparently corrupt the heap in some circumstances. 3713 Problem found by Ken Pizzini of Spry, Inc. 3714 OP.ME: document several mailer flags that were accidentally omitted 3715 from this document. These flags were F=d, F=j, F=R, and F=9. 3716 CONFIG: no changes. 3717 37188.8.1/8.8.1 1996/10/17 3719 SECURITY: unset all environment variables that the resolver will 3720 examine during queue runs and daemon mode. Problem noted 3721 by Dan Bernstein of the University of Illinois at Chicago. 3722 SECURITY: in some cases an illegal 7-bit MIME-encoded text/plain 3723 message could overflow a buffer if it was converted back 3724 to 8 bits. This caused core dumps and has the potential 3725 for a remote attack. Problem first noted by Gregory Shapiro 3726 of WPI. 3727 Avoid duplicate deliveries of error messages on systems that don't 3728 have flock(2) support. Patch from Motonori Nakamura of 3729 Kyoto University. 3730 Ignore null FallBackMX (V) options. If this option is null (as 3731 opposed to undefined) it can cause "null signature" syserrs 3732 on illegal host names. 3733 If a Base64 encoded text/plain message has no trailing newline in 3734 the encoded text, conversion back to 8 bits will drop the 3735 final line. Problem noted by Pierre David. 3736 If running with a RunAsUser, sendmail would give bogus "cannot 3737 setuid" (or seteuid, or setreuid) messages on some systems. 3738 Problem pointed out by Jordan Mendelson of Web Services, Inc. 3739 Always print error messages in -bv mode -- previously, -bv would 3740 be absolutely silent on errors if the error mode was sent 3741 to (say) mail-back. Problem noted by Kyle Jones of UUNET. 3742 If -qI/R/S is set (or the ETRN command is used), ignore all long 3743 term host status. This is necessary because it is common 3744 to do this when you know a host has just come back up. 3745 Disallow duplicate HELO/EHLO commands as required by RFC 1651 section 3746 4.2. Excessive permissiveness noted by Lee Flight of the 3747 University of Leicester. 3748 If a service (such as NIS) is specified as the last entry in the 3749 service switch, but that service is not compiled in, sendmail 3750 would return a temporary failure when an entry was not found 3751 in the map. This caused the message to be queued instead of 3752 bouncing immediately. Problem noted by Harry Edmon of the 3753 University of Washington. 3754 PORTABILITY FIXES: 3755 Solaris 2.3 had compilation problems in conf.c. Several 3756 people pointed this out. 3757 NetBSD from Charles Hannum of MIT. 3758 AIX4 improvements based on info from Steve Bauer of South 3759 Dakota School of Mines & Technology. 3760 CONFIG: ``error:code message'' syntax was broken in virtusertable. 3761 Patch from Gil Kloepfer Jr. 3762 CONFIG: if FEATURE(nocanonify) was specified, hosts in $=M (set 3763 using MASQUERADE_DOMAIN) were not masqueraded unless they 3764 were also in $=w. Problem noted by Zoltan Basti of 3765 Softec. 3766 MAIL.LOCAL: patches to compile and link cleanly on AIX. Based 3767 on a patch from Eric Hagberg of Morgan Stanley. 3768 MAIL.LOCAL: patches to compile on NEXTSTEP. From Patrick Nolan 3769 of Stanford via Robert La Ferla. 3770 37718.8.0/8.8.0 1996/09/26 3772 Under some circumstances, Bcc: headers would not be properly 3773 deleted. Pointed out by Jonathan Kamens of OpenVision. 3774 Log a warning if the sendmail daemon is invoked without a full 3775 pathname, which prevents "kill -1" from working. I was 3776 urged to put this in by Andrey A. Chernov of DEMOS (Russia). 3777 Fix small buffer overflow. Since the data in this buffer was not 3778 read externally, there was no security problem (and in fact 3779 probably wouldn't really overflow on most compilers). Pointed 3780 out by KIZU takashi of Osaka University. 3781 Fix problem causing domain literals such as [1.2.3.4] to be ignored 3782 if a FallbackMXHost was specified in the configuration file 3783 -- all mail would be sent to the fallback even if the original 3784 host was accessible. Pointed out by Munenari Hirayama of 3785 NSC (Japan). 3786 A message that didn't terminate with a newline would (sometimes) not 3787 have the trailing "." added properly in the SMTP dialogue, 3788 causing SMTP to hang. Patch from Per Hedeland of Ericsson. 3789 The DaemonPortOptions suboption to bind to a particular address was 3790 incorrect and nonfunctional due to a misunderstanding of the 3791 semantics of binding on a passive socket. Patch from 3792 NIIBE Yutaka of Mitsubishi Research Institute. 3793 Increase the number of MX hosts for a single name to 100 to better 3794 handle the truly huge service providers such as AOL, which 3795 has 13 at the moment (and climbing). In order to avoid 3796 trashing memory, the buffer for all names has only been 3797 slightly increased in size, to 12.8K from 10.2K -- this means 3798 that if a single name had 100 MX records, the average size 3799 of those records could not exceed 128 bytes. Requested by 3800 Brad Knowles of America On Line. 3801 Restore use of IDENT returns where the OSTYPE field equals "OTHER". 3802 Urged by Dan Bernstein of U.C. Berkeley. 3803 Print q_statdate and q_specificity in address structure debugging 3804 printout. 3805 Expand MCI structure flag bits for debugging output. 3806 Support IPv6-style domain literals, which can have colons between 3807 square braces. 3808 Log open file descriptors for the "cannot dup" messages in deliver(); 3809 this is an attempt to track down a bug that one person seems 3810 to be having (it may be a Solaris bug!). 3811 DSN NOTIFY parameters were not properly propagated across queue runs; 3812 this caused the NOTIFY info to sometimes be lost. Problem 3813 pointed out by Claus Assmann of the 3814 Christian-Albrechts-University of Kiel. 3815 The statistics gathered in the sendmail.st file were too high; in 3816 some cases failures (e.g., user unknown or temporary failure) 3817 would count as a delivery as far as the statistics were 3818 concerned. Problem noted by Tom Moore of AT&T GIS. 3819 Systems that don't have flock() would not send split envelopes in 3820 the initial run. Problem pointed out by Leonard Zubkoff of 3821 Dandelion Digital. 3822 Move buffer overflow checking -- these primarily involve distrusting 3823 results that may come from NIS and DNS. 3824 4.4-BSD-derived systems, including FreeBSD, NetBSD, and BSD/OS didn't 3825 include <paths.h> and hence had the wrong pathnames for a few 3826 things like /var/tmp. Reported by Matthew Green. 3827 Conditions were reversed for the Priority: header, resulting in all 3828 values being interpreted as non-urgent except for non-urgent, 3829 which was interpreted as normal. Patch from Bryan Costales. 3830 The -o (optional) flag was being ignored on hash and btree maps 3831 since 8.7.2. Fix from Bryan Costales. 3832 Content-Types listed in class "q" will always be encoded as 3833 Quoted-Printable (or more accurately, will never be encoded 3834 as base64). The class can have primary types (e.g., "text") 3835 or full types (e.g., "text/plain"). Based on a suggestion by 3836 Marius Olafsson of the University of Iceland. 3837 Define ${envid} to be the original envelope id (from the ESMTP DSN 3838 dialogue) so it can be passed to programs in mailers. 3839 Define ${bodytype} to be the body type (from the -B flag or the 3840 BODY= ESMTP parameter) so it can be passed to programs in 3841 mailers. 3842 Cause the VRFY command to return 252 instead of 250 unless the F=q 3843 flag is set in the mailer descriptor. Suggested by John 3844 Myers of CMU. 3845 Implement ESMTP ETRN command to flush the queue for a specific host. 3846 The command takes a host name; data for that host is 3847 immediately (and asynchronously) flushed. Because this shares 3848 the -qR implementation, other hosts may be attempted, but 3849 there should be no security implications. Implementation 3850 from John Beck of InReference, Inc. See RFC 1985 for details. 3851 Add three new command line flags to pass in DSN parameters: -V envid 3852 (equivalent to ENVID=envid on the MAIL command), -R ret 3853 (equivalent to RET=ret on the MAIL command), and -Nnotify 3854 (equivalent to NOTIFY=notify on the RCPT command). Note 3855 that the -N flag applies to all recipients; there is no way 3856 to specify per-address notifications on the command line, 3857 nor is there an equivalent for the ORCPT= per-address 3858 parameter. 3859 Restore LogLevel option to be safe (it can only be increased); 3860 apparently I went into paranoid mode between 8.6 and 8.7 3861 and made it unsafe. Pointed out by Dabe Murphy of the 3862 University of Maryland. 3863 New logging on log level 15: all SMTP traffic. Patches from 3864 Andrew Gross of San Diego Supercomputer Center. 3865 NetInfo property value searching code wasn't stopping when it found 3866 a match. This was causing the wrong values to be found (and 3867 had a memory leak). Found by Bastian Schleuter of TU-Berlin. 3868 Add new F=0 (zero) mailer flag to turn off MX lookups. It was pointed 3869 out by Bill Wisner of Electronics for Imaging that you can't 3870 use the bracket address form for the MAIL_HUB macro, since 3871 that causes the brackets to remain in the envelope recipient 3872 address used for delivery. The simple fix (stripping off the 3873 brackets in the config file) breaks the use of IP literal 3874 addresses. This flag will solve that problem. 3875 Add MustQuoteChars option. This is a list of characters that must 3876 be quoted if they are found in the phrase part of an address 3877 (that is, the full name part). The characters @,;:\()[] are 3878 always in this list and cannot be removed. The default is 3879 this list plus . and ' to match RFC 822. 3880 Add AllowBogusHELO option; if set, sendmail will allow HELO commands 3881 that do not include a host name for back compatibility with 3882 some stupid SMTP clients. Setting this violates RFC 1123 3883 section 5.2.5. 3884 Add MaxDaemonChildren option; if this is set, sendmail will start 3885 rejecting connections if it has more than this many 3886 outstanding children accepting mail. Note that you may 3887 see more processes than this because of outgoing mail; this 3888 is for incoming connections only. 3889 Add ConnectionRateThrottle option. If set to a positive value, the 3890 number of incoming SMTP connections that will be permitted 3891 in a single second is limited to this number. Connections are 3892 not refused during this time, just deferred. The intent is to 3893 flatten out demand so that load average limiting can kick in. 3894 It is less radical than MaxDaemonChildren, which will stop 3895 accepting connections even if all the connections are idle 3896 (e.g., due to connection caching). 3897 Add Timeout.hoststatus option. This interval (defaulting to 30m) 3898 specifies how long cached information about the state of a 3899 host will be kept before they are considered stale and the 3900 host is retried. If you are using persistent host status 3901 (i.e., the HostStatusDirectory option is set) this will apply 3902 between runs; otherwise, it applies only within a single queue 3903 run and hence is useful only for hosts that have large queues 3904 that take a very long time to run. 3905 Add SingleLineFromHeader option. If set, From: headers are coerced 3906 into being a single line even if they had newlines in them 3907 when read. This is to get around a botch in Lotus Notes. 3908 Text class maps were totally broken -- if you ever retrieved the last 3909 item in a table it would be truncated. Problem noted by 3910 Gregory Neil Shapiro of WPI. 3911 Extend the lines printed by the mailq command (== the -bp flag) when 3912 -v is given to 120 characters; this allows more information 3913 to be displayed. Suggested by Gregory Neil Shapiro of WPI. 3914 Allow macro definitions (`D' lines) with unquoted commas; previously 3915 this was treated as end-of-input. Problem noted by Bryan 3916 Costales. 3917 The RET= envelope parameter (used for DSNs) wasn't properly written 3918 to the queue file. Fix from John Hughes of Atlantic 3919 Technologies, Inc. 3920 Close /var/tmp/dead.letter after a successful write -- otherwise 3921 if this happens in a queue run it can cause nasty delays. 3922 Problem noted by Mark Horton of AT&T. 3923 If userdb entries pointed to userdb entries, and there were multiple 3924 values for a given key, the database cursor would get 3925 trashed by the recursive call. Problem noted by Roy Mongiovi 3926 of Georgia Tech. Fixed by reading all the values and creating 3927 a comma-separated list; thus, the -v output will be somewhat 3928 different for this case. 3929 Fix buffer allocation problem with Hesiod-based userdb maps when 3930 HES_GETMAILHOST is defined. Based on a patch by Betty Lee 3931 of Stanford University. 3932 When envelopes were split due to aliases with owner- aliases, and 3933 there was some error on one of the lists, more than one of 3934 the owners would get the message. Problem pointed out by 3935 Roy Mongiovi of Georgia Tech. 3936 Detect excessive recursion in macro expansions, e.g., $X defined 3937 in terms of $Y which is defined in terms of $X. Problem 3938 noted by Bryan Costales; patch from Eric Wassenaar. 3939 When using F=U to get "ugly UUCP" From_ lines, a buffer could in 3940 some cases get trashed causing bogus From_ lines. Fix from 3941 Kyle Jones of UUNET. 3942 When doing load average initialization, if the nlist call for avenrun 3943 failed, the second and subsequent lookups wouldn't notice 3944 that fact causing bogus load averages to be returned. Noted 3945 by Casper Dik of Sun Holland. 3946 Fix problem with incompatibility with some versions of inet_aton that 3947 have changed the return value to unsigned, so a check for an 3948 error return of -1 doesn't work. Use INADDR_NONE instead. 3949 This could cause mail to addresses such as [foo.com] to bounce 3950 or get dropped. Problem noted by Christophe Wolfhugel of the 3951 Pasteur Institute. 3952 DSNs were inconsistent if a failure occurred during the DATA phase 3953 rather than the RCPT phase: the Action: would be correct, but 3954 the detailed status information would be wrong. Problem noted 3955 by Bob Snyder of General Electric Company. 3956 Add -U command line flag and the XUSR ESMTP extension, both indicating 3957 that this is the initial MUA->MTA submission. The flag current 3958 does nothing, but in future releases (when MUAs start using 3959 these flags) it will probably turn on things like DNS 3960 canonification. 3961 Default end-of-line string (E= specification on mailer [M] lines) 3962 to \r\n on SMTP mailers. Default remains \n on non-SMTP 3963 mailers. 3964 Change the internal definition for the *file* and *include* mailers 3965 to have $u in the argument vectors so that they aren't 3966 misinterpreted as SMTP mailers and thus use \r\n line 3967 termination. This will affect anyone who has redefined 3968 either of these in their configuration file. 3969 Don't assume that IDENT servers close the connection after a query; 3970 responses can be newline terminated. From Terry Kennedy of 3971 St. Peter's College. 3972 Avoid core dumps on erroneous configuration files that have 3973 $#mailer with nothing following. From Bryan Costales. 3974 Avoid null pointer dereference with high debug values in unlockqueue. 3975 Fix from Randy Martin of Clemson University. 3976 Fix possible buffer overrun when expanding very large macros. Fix 3977 from Kyle Jones of UUNET. 3978 After 25 EXPN or VRFY commands, start pausing for a second before 3979 processing each one. This avoids a certain form of denial 3980 of service attack. Potential attack pointed out by Bryan 3981 Costales. 3982 Allow new named (not numbered!) config file rules to do validity 3983 checking on SMTP arguments: check_mail for MAIL commands and 3984 check_rcpt for RCPT commands. These rulesets can do anything 3985 they want; their result is ignored unless they resolve to the 3986 $#error mailer, in which case the indicated message is printed 3987 and the command is rejected. Similarly, the check_compat 3988 ruleset is called before delivery with "from_addr $| to_addr" 3989 (the $| is a meta-symbol used to separate the two addresses); 3990 it can give a "this sender can't send to this recipient" 3991 notification. Note that this patch allows $| to stand alone 3992 in rulesets. 3993 Define new macros ${client_name}, ${client_addr}, and ${client_port} 3994 that have the name, IP address, and port number (respectively) 3995 of the SMTP client (that is, the entity at the other end of 3996 the connection. These can be used in (e.g.) check_rcpt to 3997 verify that someone isn't trying to relay mail through your 3998 host inappropriately. Be sure to use the deferred evaluation 3999 form, for example $&{client_name}, to avoid having these bound 4000 when sendmail reads the configuration file. 4001 Add new config file rule check_relay to check the incoming connection 4002 information. Like check_compat, it is passed the host name 4003 and host address separated by $| and can reject connections 4004 on that basis. 4005 Allow IDA-style recursive function calls. Code contributed by Mark 4006 Lovell and Paul Vixie. 4007 Eliminate the "No ! in UUCP From address!" message" -- instead, create 4008 a virtual UUCP address using either a domain address or the $k 4009 macro. Based on code contributed by Mark Lovell and Paul 4010 Vixie. 4011 Add Stanford LDAP map. Requires special libraries that are not 4012 included with sendmail. Contributed by Booker C. Bense 4013 <bbense@networking.stanford.edu>; contact him for support. 4014 See also the src/READ_ME file. 4015 Allow -dANSI to turn on ANSI escape sequences in debug output; this 4016 puts metasymbols (e.g., $+) in reverse video. Really useful 4017 only for debugging deep bits of code where it is important to 4018 distinguish between the single-character metasymbol $+ and the 4019 two characters $, +. 4020 Changed ruleset 89 (executed in dumpstate()) to a named ruleset, 4021 debug_dumpstate. 4022 Add new UnsafeGroupWrites option; if set, .forward and :include: 4023 files that are group writable are considered "unsafe" -- that 4024 is, programs and files referenced from such files are not 4025 valid recipients. 4026 Delete bogosity test for FallBackMX host; this prevented it to be a 4027 name that was not in DNS or was a domain-literal. Problem 4028 noted by Tom May. 4029 Change the introduction to error messages to more clearly delineate 4030 permanent from temporary failures; if both existed in a 4031 single message it could be confusing. Suggested by John 4032 Beck of InReference, Inc. 4033 The IngoreDot (i) option didn't work for lines that were terminated 4034 with CRLF. Problem noted by Ted Stockwell of Secure 4035 Computing Corporation. 4036 Add a heuristic to improve the handling of unbalanced `<' signs in 4037 message headers. Problem reported by Matt Dillon of Best 4038 Internet Communications. 4039 Check for bogus characters in the 0200-0237 range; since these are 4040 used internally, very strange errors can occur if those 4041 characters appear in headers. Problem noted by Anders Gertz 4042 of Lysator. 4043 Implement 7 -> 8 bit MIME conversions. This only takes place if the 4044 recipient mailer has the F=9 flag set, and only works on 4045 text/plain body types. Code contributed by Marius Olafsson 4046 of the University of Iceland. 4047 Special case "postmaster" name so that it is always treated as lower 4048 case in alias files regardless of configuration settings; 4049 this prevents some potential problems where "Postmaster" or 4050 "POSTMASTER" might not match "postmaster". In most cases 4051 this change is a no-op. 4052 The -o map flag was ignored for text maps. Problem noted by Bryan 4053 Costales. 4054 The -a map flag was ignored for dequote maps. Problem noted by 4055 Bryan Costales. 4056 Fix core dump when a lookup of a class "prog" map returns no 4057 response. Patch from Bryan Costales. 4058 Log instances where sendmail is deferring or rejecting connections 4059 on LogLevel 14. Suggested by Kyle Jones of UUNET. 4060 Include port number in process title for network daemons. Suggested 4061 by Kyle Jones of UUNET. 4062 Send ``double bounces'' (errors that occur when sending an error 4063 message) to the address indicated in the DoubleBounceAddress 4064 option (default: postmaster). Previously they were always 4065 sent to postmaster. Suggested by Kyle Jones of UUNET. 4066 Add new mode, -bD, that acts like -bd in all respects except that 4067 it runs in foreground. This is useful for using with a 4068 wrapper that "watches" system services. Suggested by Kyle 4069 Jones of UUNET. 4070 Fix botch in spacing around (parenthesized) comments in addresses 4071 when the comment comes before the address. Patch from 4072 Motonori Nakamura of Kyoto University. 4073 Use the prefix "Postmaster notify" on the Subject: lines of messages 4074 that are being bounced to postmaster, rather than "Returned 4075 mail". This permits the person who is postmaster more 4076 easily determine what messages are to their role as 4077 postmaster versus bounces to mail they actually sent. Based 4078 on a suggestion by Motonori Nakamura. 4079 Add new value "time" for QueueSortOrder option; this causes the queue 4080 to be sorted strictly by the time of submission. Note that 4081 this can cause very bad behavior over slow lines (because 4082 large jobs will tend to delay small jobs) and on nodes with 4083 heavy traffic (because old things in the queue for hosts that 4084 are down delay processing of new jobs). Also, this does not 4085 guarantee that jobs will be delivered in submission order 4086 unless you also set DeliveryMode=queue. In general, it should 4087 probably only be used on the command line, and only in 4088 conjunction with -qRhost.domain. In fact, there are very few 4089 cases where it should be used at all. Based on an 4090 implementation by Motonori Nakamura. 4091 If a map lookup in ruleset 5 returns tempfail, queue the message in 4092 the same manner as other rulesets. Previously a temporary 4093 failure in ruleset 5 was ignored. Patch from Booker Bense 4094 of Stanford University. 4095 Don't proceed to the next MX host if an SMTP MAIL command returns a 4096 5yz (permanent failure) code. The next MX host will still be 4097 tried if the connection cannot be opened in the first place 4098 or if the MAIL command returns a 4yz (temporary failure) code. 4099 (It's hard to know what to do here, since neither RFC 974 nor 4100 RFC 1123 specify when to proceed to the next MX host.) 4101 Suggested by Jonathan Kamens of OpenVision, Inc. 4102 Add new "-t" flag for map definitions (the "K" line in the .cf file). 4103 This causes map lookups that get a temporary failure (e.g., 4104 name server failure) to _not_ defer the delivery of the 4105 message. This should only be used if your configuration file 4106 is prepared to do something sensible in this case. Based on 4107 an idea by Gregory Shapiro of WPI. 4108 Fix problem finding network interface addresses. Patch from 4109 Motonori Nakamura. 4110 Don't reject qf entries that are not owned by your effective uid if 4111 you are not running setuid; this makes management of certain 4112 kinds of firewall setups difficult. Patch suggested by 4113 Eamonn Coleman of Qualcomm. 4114 Add persistent host status. This keeps the information normally 4115 maintained within a single queue run in disk files that are 4116 shared between sendmail instances. The HostStatusDirectory 4117 is the directory in which the information is maintained. If 4118 not set, persistent host status is turned off. If not a full 4119 pathname, it is relative to the queue directory. A common 4120 value is ".hoststat". 4121 There are also two new operation modes: 4122 * -bh prints the status of hosts that have had recent 4123 connections. 4124 * -bH purges the host statuses. No attempt is made to save 4125 recent status information. 4126 This feature was originally written by Paul Vixie of Vixie 4127 Enterprises for KJS and adapted for V8 by Mark Lovell of 4128 Bigrock Consulting. Paul's funding of Mark and Mark's patience 4129 with my insistence that things fit cleanly into the V8 4130 framework is gratefully appreciated. 4131 New SingleThreadDelivery option (requires HostStatusDirectory to 4132 operate). Avoids letting two sendmails on the local machine 4133 open connections to the same remote host at the same time. 4134 This reduces load on the other machine, but can cause mail to 4135 be delayed (for example, if one sendmail is delivering a huge 4136 message, other sendmails won't be able to send even small 4137 messages). Also, it requires another file descriptor (for the 4138 lock file) per connection, so you may have to reduce 4139 ConnectionCacheSize to avoid running out of per-process 4140 file descriptors. Based on the persistent host status code 4141 contributed by Paul Vixie and Mark Lovell. 4142 Allow sending to non-simple files (e.g., /dev/null) even if the 4143 SafeFileEnvironment option is set. Problem noted by Bryan 4144 Costales. 4145 The -qR flag mistakenly matched flags in the "R" line of the queue 4146 file. Problem noted by Bryan Costales. 4147 If a job was aborted using the interrupt signal (e.g., control-C from 4148 the keyboard), on some occasions an empty df file would be 4149 left around; these would collect in the queue directory. 4150 Problem noted by Bryan Costales. 4151 Change the makesendmail script to enhance the search for Makefiles 4152 based on release number. For example, on SunOS 5.5.1, it will 4153 search for Makefile.SunOS.5.5.1, Makefile.SunOS.5.5, and then 4154 Makefile.SunOS.5.x (in addition to the other rules, e.g., 4155 adding $arch). Problem noted by Jason Mastaler of Atlanta 4156 Webmasters. 4157 When creating maps using "newaliases", always map the keys to lower 4158 case when creating the map unless the -f flag is specified on 4159 the map itself. Previously this was done based on the F=u 4160 flag in the local mailer, which meant you could create aliases 4161 that you could never access. Problem noted by Bob Wu of DEC. 4162 When a job was read from the queue, the bits causing notification on 4163 failure or delay were always set. This caused those 4164 notifications to be sent even if NOTIFY=NEVER had been 4165 specified. Problem noted by Steve Hubert of the University 4166 of Washington, Seattle. 4167 Add new configurable routine validate_connection (in conf.c). This 4168 lets you decide if you are willing to accept traffic from 4169 this host. If it returns FALSE, all SMTP commands will return 4170 "550 Access denied". -DTCPWRAPPERS will include support for 4171 TCP wrappers; you will need to add -lwrap to the link line. 4172 (See src/READ_ME for details.) 4173 Don't include the "THIS IS A WARNING MESSAGE ONLY" banner on postmaster 4174 bounces. Some people seemed to think that this could be 4175 confusing (even though it is true). Suggested by Motonori 4176 Nakamura. 4177 Add new RunAsUser option; this causes sendmail to do a setuid to that 4178 user early in processing to avoid potential security problems. 4179 However, this means that all .forward and :include: files must 4180 be readable by that user, and all files to be written must be 4181 writable by that user and all programs will be executed by that 4182 user. It is also incompatible with the SafeFileEnvironment 4183 option. In other words, it may not actually add much to 4184 security. However, it should be useful on firewalls and other 4185 places where users don't have accounts and the aliases file is 4186 well constrained. 4187 Add Timeout.iconnect. This is like Timeout.connect except it is used 4188 only on the first attempt to delivery to an address. It could 4189 be set to be lower than Timeout.connect on the principle that 4190 the mail should go through quickly to responsive hosts; less 4191 responsive hosts get to wait for the next queue run. 4192 Fix a problem on Solaris that occasionally causes programs 4193 (such as vacation) to hang with their standard input connected 4194 to a UDP port. It also created some signal handling problems. 4195 The problems turned out to be an interaction between vfork(2) 4196 and some of the libraries, particularly NIS/NIS+. I am 4197 indebted to Tor Egge <tegge@idt.ntnu.no> for this fix. 4198 Change user class map to do the same matching that actual delivery 4199 will do instead of just a /etc/passwd lookup. This adds 4200 fuzzy matching to the user map. Patch from Dan Oscarsson. 4201 The Timeout.* options are not safe -- they can be used to create a 4202 denial-of-service attack. Problem noted by Christophe 4203 Wolfhugel. 4204 Don't send PostmasterCopy messages in the event of a "delayed" 4205 notification. Suggested by Barry Bouwsma. 4206 Don't advertise "VERB" ESMTP extension if the "noexpn" privacy 4207 option is set, since this disables VERB mode. Suggested 4208 by John Hawkinson of MIT. 4209 Complain if the QueueDirectory (Q) option is not set. Problem noted 4210 by Motonori Nakamura of Kyoto University. 4211 Only queue messages on transient .forward open failures if there 4212 were no successful opens. The previous behavior caused it 4213 to queue even if a "fall back" .forward was found. Problem 4214 noted by Ann-Kian Yeo of the Dept. of Information Systems 4215 and Computer Science (DISCS), NUS, Singapore. 4216 Don't do 8->7 bit conversions when bouncing a MIME message that 4217 is bouncing because of a MIME error during 8->7 bit conversion; 4218 the encapsulated message will bounce again, causing a loop. 4219 Problem noted by Steve Hubert of the University of Washington. 4220 Create xf (transcript) files using the TempFileMode option value 4221 instead of 0644. Suggested by Ann-Kian Yeo of the 4222 National University of Singapore. 4223 Print errors if setgid/setuid/etc. fail during delivery. This helps 4224 detect cases where DefaultUid is set to something that the 4225 system can't cope with. 4226 PORTABILITY FIXES: 4227 Support for AIX/RS 2.2.1 from Mark Whetzel of Western 4228 Atlas International. 4229 Patches for Intel Paragon OSF/1 1.3 from Leo Bicknell 4230 <bicknell@ufp.org>. 4231 On DEC OSF/1 3.2 and earlier, the MatchGECOS code would only 4232 work on the first recipient of a message due to a 4233 bug in the getpwent family. If this is something you 4234 use, you can define DEC_OSF_BROKEN_GETPWENT=1 for a 4235 workaround. From Maximum Entropy of Sanford C. 4236 Bernstein and Associates. 4237 FreeBSD 1.1.5.1 uname -r returns a string containing 4238 parentheses, which breaks makesendmail. Reported 4239 by Piero Serini <piero@strider.ibenet.it>. 4240 Sequent DYNIX/ptx 4.0.2 patches from Jack Woolley of 4241 Systems and Computer Technology Corporation. 4242 Solaris 2.x: omit the UUCP grade parameter (-g flag) because 4243 it is system-dependent. Problem noted by J.J. Bailey 4244 of Bailey Computer Consulting. 4245 Pyramid NILE running DC/OSx support from Earle F. Ake of 4246 Hassler Communication Systems Technology, Inc. 4247 HP-UX 10.x compile glitches, reported by Anne Brink of the 4248 U.S. Army and James Byrne of Harte & Lyne Limited. 4249 NetBSD from Matthew Green of the NetBSD crew. 4250 SCO 5.x from Keith Reynolds of SCO. 4251 IRIX 6.2 from Robert Tarrall of the University of 4252 Colorado and Kari Hurtta of the Finnish Meteorological 4253 Institute. 4254 UXP/DS (Fujitsu/ICL DS/90 series) support from Diego R. 4255 Lopez, CICA (Seville). 4256 NCR SVR4 MP-RAS 3.x support from Tom Moore of NCR. 4257 PTX 3.2.0 from Kenneth Stailey of the US Department of Labor 4258 Employment Standards Administration. 4259 Altos System V (5.3.1) from Tim Rice of Multitalents. 4260 Concurrent Systems Corporation Maxion from Donald R. Laster 4261 Jr. 4262 NetInfo maps (improved debugging and multi-valued aliases) 4263 from Adrian Steinmann of Steinmann Consulting. 4264 ConvexOS 11.5 (including SecureWare C2 and the Share Scheduler) 4265 from Eric Schnoebelen of Convex. 4266 Linux 2.0 mail.local patches from Horst von Brand. 4267 NEXTSTEP 3.x compilation from Robert La Ferla. 4268 NEXTSTEP 3.x code changes from Allan J. Nathanson of NeXT. 4269 Solaris 2.5 configuration fixes for mail.local by Jim Davis 4270 of the University of Arizona. 4271 Solaris 2.5 has a working setreuid. Noted by David Linn of 4272 Vanderbilt University. 4273 Solaris changes for praliases, makemap, mailstats, and smrsh. 4274 Previously you had to add -DSOLARIS in Makefile.dist; 4275 this auto-detects. Based on a patch from Randall 4276 Winchester of the University of Maryland. 4277 CONFIG: add generic-nextstep3.3.mc file. Contributed by 4278 Robert La Ferla of Hot Software. 4279 CONFIG: allow mailertables to resolve to ``error:code message'' 4280 (where "code" is an exit status) on domains (previously 4281 worked only on hosts). Patch from Cor Bosman of Xs4all 4282 Foundation. 4283 CONFIG: hooks for IPv6-style domain literals. 4284 CONFIG: predefine ALIAS_FILE and change the prototype file so that 4285 if it is undefined the AliasFile option is never set; this 4286 should be transparent for most everyone. Suggested by John 4287 Myers of CMU. 4288 CONFIG: add FEATURE(limited_masquerade). Without this feature, any 4289 domain listed in $=w is masqueraded. With it, only those 4290 domains listed in a MASQUERADE_DOMAIN macro are masqueraded. 4291 CONFIG: add FEATURE(masquerade_entire_domain). This causes 4292 masquerading specified by MASQUERADE_DOMAIN to apply to all 4293 hosts under those domains as well as the domain headers 4294 themselves. For example, if a configuration had 4295 MASQUERADE_DOMAIN(foo.com), then without this feature only 4296 foo.com would be masqueraded; with it, *.foo.com would be 4297 masqueraded as well. Based on an implementation by Richard 4298 (Pug) Bainter of U. Texas. 4299 CONFIG: add FEATURE(genericstable) to do a more general rewriting of 4300 outgoing addresses. Defaults to ``hash -o /etc/genericstable''. 4301 Keys are user names; values are outgoing mail addresses. Yes, 4302 this does overlap with the user database, and figuring out 4303 just when to use which one may be tricky. Based on code 4304 contributed by Richard (Pug) Bainter of U. Texas with updates 4305 from Per Hedeland of Ericsson. 4306 CONFIG: add FEATURE(virtusertable) to do generalized rewriting of 4307 incoming addresses. Defaults to ``hash -o /etc/virtusertable''. 4308 Keys are either fully qualified addresses or just the host 4309 part (with the @ sign). For example, a table containing: 4310 info@foo.com foo-info 4311 info@bar.com bar-info 4312 @baz.org jane@elsewhere.net 4313 would send all mail destined for info@foo.com to foo-info 4314 (which is presumably an alias), mail addressed to info@bar.com 4315 to bar-info, and anything addressed to anyone at baz.org will 4316 be sent to jane@elsewhere.net. The names foo.com, bar.com, 4317 and baz.org must all be in $=w. Based on discussions with 4318 a great many people. 4319 CONFIG: add nullclient configurations to define SMTP_MAILER_FLAGS. 4320 Suggested by Richard Bainter. 4321 CONFIG: add FAX_MAILER_ARGS to tweak the arguments passed to the 4322 "fax" mailer. 4323 CONFIG: allow mailertable entries to resolve to local:user; this 4324 passes the original user@host in to procmail-style local 4325 mailers as the "detail" information to allow them to do 4326 additional clever processing. From Joe Pruett of 4327 Teleport Corporation. Delivery to the original user can 4328 be done by specifying "local:" (with nothing after the colon). 4329 CONFIG: allow any context that takes "mailer:domain" to also take 4330 "mailer:user@domain" to force mailing to the given user; 4331 "local:user" can also be used to do local delivery. This 4332 applies on *_RELAY and in the mailertable entries. Based 4333 on a suggestion by Ribert Kiessling of Easynet. 4334 CONFIG: Allow FEATURE(bestmx_is_local) to take an argument that 4335 limits the possible domains; this reduces the number of DNS 4336 lookups required to support this feature. For example, 4337 FEATURE(bestmx_is_local, my.site.com) limits the lookups 4338 to domains under my.site.com. Code contributed by Anthony 4339 Thyssen <anthony@cit.gu.edu.au>. 4340 CONFIG: LOCAL_RULESETS introduces any locally defined rulesets, 4341 such as the check_rcpt ruleset. Suggested by Gregory Shapiro 4342 of WPI. 4343 CONFIG: MAILER_DEFINITIONS introduces any mailer definitions, in the 4344 event you have to define local mailers. Suggested by 4345 Gregory Shapiro of WPI. 4346 CONFIG: fix cases where a three- (or more-) stage route-addr could 4347 be misinterpreted as a list:...; syntax. Based on a patch by 4348 Vlado Potisk <Vlado_Potisk@tempest.sk>. 4349 CONFIG: Fix masquerading of UUCP addresses when the UUCP relay is 4350 remotely connected. The address host!user was being 4351 converted to host!user@thishost instead of host!user@uurelay. 4352 Problem noted by William Gianopoulos of Raytheon Company. 4353 CONFIG: add confTO_ICONNECT to set Timeout.iconnect. 4354 CONFIG: change FEATURE(redirect) message from "User not local" to 4355 "User has moved"; the former wording was confusing if the 4356 new address is still on the local host. Based on a suggestion 4357 by Andreas Luik. 4358 CONFIG: add support in FEATURE(nullclient) for $=E (exposed users). 4359 However, the class is not pre-initialized to contain root. 4360 Suggested by Gregory Neil Shapiro. 4361 CONTRIB: Remove XLA code at the request of the author, Christophe 4362 Wolfhugel. 4363 CONTRIB: Add re-mqueue.pl, contributed by Paul Pomes of Qualcomm. 4364 MAIL.LOCAL: make it possible to compile mail.local on Solaris. Note 4365 well: this produces a slightly different mailbox format (no 4366 Content-Length: headers), file ownerships and modes are 4367 different (not owned by group mail; mode 600 instead of 660), 4368 and the local mailer flags will have to be tweaked (make them 4369 match bsd4.4) in order to use this mailer. Patches from Paul 4370 Hammann of the Missouri Research and Education Network. 4371 MAIL.LOCAL: in some cases it could return EX_OK even though there 4372 was a delivery error, such as if the ownership on the file 4373 was wrong or the mode changed between the initial stat and 4374 the open. Problem reported by William Colburn of the New 4375 Mexico Institute of Mining and Technology. 4376 MAILSTATS: handle zero length files more reliably. Patch from Bryan 4377 Costales. 4378 MAILSTATS: add man page contributed by Keith Bostic of BSDI. 4379 MAKEMAP: The -d flag (to allow duplicate keys) to a btree map wasn't 4380 honored. Fix from Michael Scott Shappe. 4381 PRALIASES: add man page contributed by Keith Bostic of BSDI. 4382 NEW FILES: 4383 src/Makefiles/Makefile.AIX.2 4384 src/Makefiles/Makefile.IRIX.6.2 4385 src/Makefiles/Makefile.maxion 4386 src/Makefiles/Makefile.NCR.MP-RAS.3.x 4387 src/Makefiles/Makefile.SCO.5.x 4388 src/Makefiles/Makefile.UXPDSV20 4389 mailstats/mailstats.8 4390 praliases/praliases.8 4391 cf/cf/generic-nextstep3.3.mc 4392 cf/feature/genericstable.m4 4393 cf/feature/limited_masquerade.m4 4394 cf/feature/masquerade_entire_domain.m4 4395 cf/feature/virtusertable.m4 4396 cf/ostype/aix2.m4 4397 cf/ostype/altos.m4 4398 cf/ostype/maxion.m4 4399 cf/ostype/solaris2.ml.m4 4400 cf/ostype/uxpds.m4 4401 contrib/re-mqueue.pl 4402 DELETED FILES: 4403 src/Makefiles/Makefile.Solaris 4404 contrib/xla/README 4405 contrib/xla/xla.c 4406 RENAMED FILES: 4407 src/Makefiles/Makefile.NCR3000 => Makefile.NCR.MP-RAS.2.x 4408 src/Makefiles/Makefile.SCO.3.2v4.2 => Makefile.SCO.4.2 4409 src/Makefiles/Makefile.UXPDS => Makefile.UXPDSV10 4410 src/Makefiles/Makefile.NeXT => Makefile.NeXT.2.x 4411 src/Makefiles/Makefile.NEXTSTEP => Makefile.NeXT.3.x 4412 44138.7.6/8.7.3 1996/09/17 4414 SECURITY: It is possible to force getpwuid to fail when writing the 4415 queue file, causing sendmail to fall back to running programs 4416 as the default user. This is not exploitable from off-site. 4417 Workarounds include using a unique user for the DefaultUser 4418 (old u & g options) and using smrsh as the local shell. 4419 SECURITY: fix some buffer overruns; in at least one case this allows 4420 a local user to get root. This is not known to be exploitable 4421 from off-site. The workaround is to disable chfn(1) commands. 4422 44238.7.5/8.7.3 1996/03/04 4424 Fix glitch in 8.7.4 when putting certain internal lines; this can 4425 in some case cause connections to hang or messages to have 4426 extra spaces in odd places. Patch from Eric Wassenaar; 4427 reports from Eric Hall of Chiron Corporation, Stephen 4428 Hansen of Stanford University, Dean Gaudet of HotWired, 4429 and others. 4430 44318.7.4/8.7.3 1996/02/18 4432 SECURITY: In some cases it was still possible for an attacker to 4433 insert newlines into a queue file, thus allowing access to 4434 any user (except root). 4435 CONFIG: no changes -- it is not a bug that the configuration 4436 version number is unchanged. 4437 44388.7.3/8.7.3 1995/12/03 4439 Fix botch in name server timeout in RCPT code; this problem caused 4440 two responses in SMTP, which breaks things horribly. Fix 4441 from Gregory Neil Shapiro of WPI. 4442 Verify that L= value on M lines cannot be negative, which could cause 4443 negative array subscripting. Not a security problem since 4444 this has to be in the config file, but it could have caused 4445 core dumps. Pointed out by Bryan Costales. 4446 Fix -d21 debug output for long macro names. Pointed out by Bryan 4447 Costales. 4448 PORTABILITY FIXES: 4449 SCO doesn't have ftruncate. From Bill Aten of Computerizers. 4450 IBM's version of arpa/nameser.h defaults to the wrong byte 4451 order. Tweak it to work properly. Based on fixes 4452 from Fletcher Mattox of UTexas and Betty Lee of 4453 Stanford University. 4454 CONFIG: add confHOSTS_FILE m4 variable to set HostsFile option. 4455 Deficiency pointed out by Bryan Costales of ICSI. 4456 44578.7.2/8.7.2 1995/11/19 4458 REALLY fix the backslash escapes in SmtpGreetingMessage, 4459 OperatorChars, and UnixFromLine options. They were not 4460 properly repaired in 8.7.1. 4461 Completely delete the Bcc: header if and only if there are other 4462 valid recipient headers (To:, Cc: or Apparently-To:, the 4463 last being a historic botch, of course). If Bcc: is the 4464 only recipient header in the message, its value is tossed, 4465 but the header name is kept. The old behavior (always keep 4466 the header name and toss the value) allowed primary recipients 4467 to see that a Bcc: went to _someone_. 4468 Include queue id on ``Authentication-Warning: <host>: <user> set 4469 sender to <address> using -f'' syslog messages. Suggested 4470 by Kari Hurtta. 4471 If a sequence or switch map lookup entry gets a tempfail but then 4472 continues on to another map type, but the name is not found, 4473 return a temporary failure from the sequence or switch map. 4474 For example, if hosts search ``dns files'' and DNS fails 4475 with a tempfail, the hosts map will go on and search files, 4476 but if it fails the whole thing should be a tempfail, not 4477 a permanent (host unknown) failure, even though that is the 4478 failure in the hosts.files map. This error caused hard 4479 bounces when it should have requeued. 4480 Aliases to files such as /users/bar/foo/inbox, with /users/bar/foo 4481 owned by bar mode 700 and inbox being setuid bar stopped 4482 working properly due to excessive paranoia. Pointed out by 4483 John Hawkinson of Panix. 4484 An SMTP RCPT command referencing a host that gave a nameserver 4485 timeout would return a 451 command (8.6 accepted it and 4486 queued it locally). Revert to the 8.6 behavior in order 4487 to simplify queue management for clustered systems. Suggested 4488 by Gregory Neil Shapiro of WPI. The same problem could break 4489 MH, which assumes that the SMTP session will succeed (tsk, tsk 4490 -- mail gets lost!); this was pointed out by Stuart Pook of 4491 Infobiogen. 4492 Fix possible buffer overflow in munchstring(). This was not a security 4493 problem because you couldn't specify any argument to this 4494 without first giving up root privileges, but it is still a 4495 good idea to avoid future problems. Problem noted by John 4496 Hawkinson and Sam Hartman of MIT. 4497 ``452 Out of disk space for temp file'' messages weren't being 4498 printed. Fix from David Perlin of Nanosoft. 4499 Don't advertise the ESMTP DSN extension if the SendMimeErrors option 4500 is not set, since this is required to get the actual DSNs 4501 created. Problem pointed out by John Gardiner Myers of CMU. 4502 Log permission problems that cause .forward and :include: files to 4503 be untrusted or ignored on log level 12 and higher. Suggested 4504 by Randy Martin of Clemson University. 4505 Allow user ids in U= clauses of M lines to have hyphens and 4506 underscores. 4507 Fix overcounting of recipients -- only happened when sending to an 4508 alias. Pointed out by Mark Andrews of SGI and Jack Woolley 4509 of Systems and Computer Technology Corporation. 4510 If a message is sent to an address that fails, the error message that 4511 is returned could show some extraneous "success" information 4512 included even if the user did not request success notification, 4513 which was confusing. Pointed out by Allan Johannesen of WPI. 4514 Config files that had no AliasFile definition were defaulting to 4515 using /etc/aliases; this caused problems with nullclient 4516 configurations. Change it back to the 8.6 semantics of 4517 having no local alias file unless it is declared. Problem 4518 noted by Charles Karney of Princeton University. 4519 Fix compile problem if NOTUNIX is defined. Pointed out by Bryan 4520 Costales of ICSI. 4521 Map lookups of class "userdb" maps were always case sensitive; they 4522 should be controlled by the -f flag like other maps. Pointed 4523 out by Bjart Kvarme <bjart.kvarme@usit.uio.no>. 4524 Fix problem that caused some addresses to be passed through ruleset 5 4525 even when they were tagged as "sticky" by prefixing the 4526 address with an "@". Patch from Thomas Dwyer III of Michigan 4527 Technological University. 4528 When converting a message to Quoted-Printable, prevent any lines with 4529 dots alone on a line by themselves. This is because of the 4530 preponderance of broken mailers that still get this wrong. 4531 Code contributed by Per Hedeland of Ericsson. 4532 Fix F{macro}/file construct -- it previously did nothing. Pointed 4533 out by Bjart Kvarme of USIT/UiO (Norway). 4534 Announce whether a cached connection is SMTP or ESMTP (in -v mode). 4535 Requested by Allan Johannesen. 4536 Delete check for text format of alias files -- it should be legal 4537 to have the database format of the alias files without the 4538 text version. Problem pointed out by Joe Rhett of Navigist, 4539 Inc. 4540 If "Ot" was specified with no value, the TZ variable was not properly 4541 imported from the environment. Pointed out by Frank Crawford 4542 <frank@ansto.gov.au>. 4543 Some architectures core dumped on "program" maps that didn't have 4544 extra arguments. Patch from Booker C. Bense of Stanford 4545 University. 4546 Queue run processes would re-spawn daemons when given a SIGHUP; only 4547 the parent should do this. Fix from Brian Coan of the 4548 Association for Progressive Communications. 4549 If MinQueueAge was set and a message was considered but not run 4550 during a queue run and the Timeout.queuereturn interval was 4551 reached, a "timed out" error message would be returned that 4552 didn't include the failed address (and claimed to be a warning 4553 even though it was fatal). The fix is to not return such 4554 messages until they are actually tried, i.e., in the next 4555 MinQueueAge interval. Problem noted by Rein Tollevik of 4556 SINTEF RUNIT, Oslo. 4557 Add HES_GETMAILHOST compile flag to support MIT Hesiod distributions 4558 that have the hes_getmailhost() routine. DEC Hesiod 4559 distributions do not have this routine. Based on a patch 4560 from Betty Lee of Stanford University. 4561 Extensive cleanups to map open code to handle a locking race condition 4562 in ndbm, hash, and btree format database files on some (most 4563 non-4.4-BSD based) OS architectures. This should solve the 4564 occasional "user unknown" problem during alias rebuilds that 4565 has plagued me for quite some time. Based on a patch from 4566 Thomas Dwyer III of Michigan Technological University. 4567 PORTABILITY FIXES: 4568 Solaris: Change location of newaliases and mailq from 4569 /usr/ucb to /usr/bin to match Sun settings. From 4570 James B. Davis of TCI. 4571 DomainOS: Makefile.DomainOS doesn't require -ldbm. From 4572 Don Lewis of Silicon Systems. 4573 HP-UX 10: rename Makefile.HP-UX.10 => Makefile.HP-UX.10.x 4574 so that the makesendmail script will find it. Pointed 4575 out by Richard Allen of the University of Iceland. 4576 Also, use -Aa -D_HPUX_SOURCE instead of -Ae, which 4577 isn't supported on all compilers. 4578 UXPDS: compilation fixes from Diego R. Lopez. 4579 CONFIG: FAX mailer wasn't setting .FAX as a pseudo-domain unless 4580 you also had a FAX_RELAY. From Thomas.Tornblom@Hax.SE. 4581 CONFIG: Minor glitch in S21 -- attachment of local domain name 4582 didn't have trailing dot. From Jim Hickstein of Teradyne. 4583 CONFIG: Fix best_mx_is_local feature to allow nested addresses such as 4584 user%host@thishost. From Claude Scarpelli of Infobiogen 4585 (France). 4586 CONFIG: OSTYPE(hpux10) failed to define the location of the help file. 4587 Pointed out by Hannu Martikka of Nokia Telecommunications. 4588 CONFIG: Diagnose some inappropriate ordering in configuration files, 4589 such as FEATURE(smrsh) listed after MAILER(local). Based on 4590 a bug report submitted by Paul Hoffman of Proper Publishing. 4591 CONFIG: Make OSTYPE files consistently not override settings that 4592 have already been set. Previously it worked differently 4593 for different files. 4594 CONFIG: Change relay mailer to do masquerading like 8.6 did. My take 4595 is that this is wrong, but the change was causing problems 4596 for some people. From Per Hedeland of Ericsson. 4597 CONTRIB: bitdomain.c patch from John Gardiner Myers <jgm+@CMU.EDU>; 4598 portability changes for Posix environments (no functional 4599 changes). 4600 46018.7.1/8.7.1 1995/10/01 4602 Old macros that have become options (SmtpGreetingMessage, 4603 OperatorChars, and UnixFromLine) didn't allow backslash 4604 escapes in the options, where they previously had. Bug 4605 pointed out by John Hawkinson of MIT. 4606 Fix strange case of an executable called by a program map that 4607 returns a value but also a non-zero exit status; this 4608 would give contradictory results in the higher level; in 4609 particular, the default clause in the map lookup would be 4610 ignored. Change to ignore the value if the program returns 4611 non-zero exit status. From Tom Moore of AT&T GIS. 4612 Shorten parameters passed to syslog() in some contexts to avoid a 4613 bug in many vendors' implementations of that routine. Although 4614 this isn't really a bug in sendmail per se, and my solution 4615 has to assume that syslog() has at least a 1K buffer size 4616 internally (I know some vendors have shortened this 4617 dramatically -- they're on their own), sendmail is a popular 4618 target. Also, limit the size of %s arguments in sprintf. 4619 These both have possible security implications. Solutions 4620 suggested by Casper Dik of Sun's Network Security Group 4621 (Holland), Mark Seiden, and others. 4622 Fix a problem that might cause a non-standard -B (body type) 4623 parameter to be passed to the next server with undefined 4624 results. This could have security implications. 4625 If a filesystem was at > 100% utilization, the freediskspace() 4626 routine incorrectly returned an error rather than zero. 4627 Problem noted by G. Paul Ziemba of Alantec. 4628 Change MX sort order so that local hostnames (those in $=w) always 4629 sort first within a given preference. This forces the bestmx 4630 map to always return the local host first, if it is included 4631 in the list of highest priority MX records. From K. Robert 4632 Elz. 4633 Avoid some possible null pointer dereferences. Fixes from Randy 4634 Martin <WOLF@CLEMSON.EDU> 4635 When sendmail starts up on systems that have no fully qualified 4636 domain name (FQDN) anywhere in the first matching host map 4637 (e.g., /etc/hosts if the hosts service searches "files dns"), 4638 sendmail would sleep to try to find a FQDN, which it really 4639 really needs. This has been changed to fall through to the 4640 next map type if it can't find a FQDN -- i.e., if the hosts 4641 file doesn't have a FQDN, it will try dns even though the 4642 short name was found in /etc/hosts. This is probably a crock, 4643 but many people have hosts files without FQDNs. Remember: 4644 domain names are your friends. 4645 Log a high-priority message if you can't find your FQDN during startup. 4646 Suggested by Simon Barnes of Schlumberger Limited. 4647 When using Hesiod, initialize it early to improve error reporting. 4648 Patch from Don Lewis of Silicon Systems, Inc. 4649 Apparently at least some versions of Linux have a 90 !minute! TCP 4650 connection timeout in the kernel. Add a new "connect" timeout 4651 to limit this time. Defaults to zero (use whatever the 4652 kernel provides). Based on code contributed by J.R. Oldroyd 4653 of TerraNet. 4654 Under some circumstances, a failed message would not be properly 4655 removed from the queue, causing tons of bogus error messages. 4656 (This fix eliminates the problematic EF_KEEPQUEUE flag.) 4657 Problem noted by Allan E Johannesen and Gregory Neil Shapiro 4658 of WPI. 4659 PORTABILITY FIXES: 4660 On IRIX 5.x, there was an inconsistency in the setting 4661 of sendmail.st location. Change the Makefile to 4662 install it in /var/sendmail.st to match the OSTYPE 4663 file and SGI standards. From Andre 4664 <andre@curry.zfe.siemens.de>. 4665 Support for Fujitsu/ICL UXP/DS (For the DS/90 Series) 4666 from Diego R. Lopez <drlopez@cica.es>. 4667 Linux compilation patches from J.R. Oldroyd of TerraNet, Inc. 4668 LUNA 2 Mach patches from Motonori Nakamura. 4669 SunOS Makefile was including -ldbm, which is for the old 4670 dbm library. The ndbm library is part of libc. 4671 CONFIG: avoid bouncing ``user@host.'' (note trailing dot) with 4672 ``local configuration error'' in nullclient configuration. 4673 Patch from Gregory Neil Shapiro of WPI. 4674 CONFIG: don't allow an alias file in nullclient configurations -- 4675 since all addresses are relayed, they give errors during 4676 rebuild. Suggested by Per Hedeland of Ericsson. 4677 CONFIG: local mailer on Solaris 2 should always get a -f flag because 4678 otherwise the F=S causes the From_ line to imply that root is 4679 the sender. Problem pointed out by Claude Scarpelli of 4680 Infobiogen (France). 4681 NEW FILES: 4682 cf/feature/use_ct_file.m4 (omitted from 8.7 by mistake) 4683 src/Makefiles/Makefile.KSR (omitted from 8.7 by mistake) 4684 src/Makefiles/Makefile.UXPDS 4685 46868.7/8.7 1995/09/16 4687 Fix a problem that could cause sendmail to run out of file 4688 descriptors due to a trashed data structure after a 4689 vfork. Fix from Brian Coan of the Institute for 4690 Global Communications. 4691 Change the VRFY response if you have disabled VRFY -- some 4692 people seemed to think that it was too rude. 4693 Avoid reference to uninitialized file descriptor if HASFLOCK 4694 was not defined. This was used "safely" in the sense 4695 that it only did a stat, but it would have set the 4696 map modification time improperly. Problem pointed out 4697 by Roy Mongiovi of Georgia Tech. 4698 Clean up the Subject: line on warning messages and return 4699 receipts so that they don't say "Returned mail:"; this 4700 can be confusing. 4701 Move ruleset entry/exit debugging from 21.2 to 21.1 -- this is 4702 useful enough to make it worthwhile printing on "-d". 4703 Avoid logging alias statistics every time you read the alias 4704 file on systems with no database method compiled in. 4705 If you have a name with a trailing dot, and you try looking it 4706 up using gethostbyname without the dot (for /etc/hosts 4707 compatibility), be sure to turn off RES_DEFNAMES and 4708 RES_DNSRCH to avoid finding the wrong name accidentally. 4709 Problem noted by Charles Amos of the University of 4710 Maryland. 4711 Don't do timeouts in collect if you are not running SMTP. 4712 There is nothing that says you can't have a long 4713 running program piped into sendmail (possibly via 4714 /bin/mail, which just execs sendmail). Problem reported 4715 by Don "Truck" Lewis of Silicon Systems. 4716 Try gethostbyname() even if the DNS lookup fails iff option I 4717 is not set. This allows you to have hosts listed in 4718 NIS or /etc/hosts that are not known to DNS. It's normally 4719 a bad idea, but can be useful on firewall machines. This 4720 should really be broken out on a separate flag, I suppose. 4721 Avoid compile warnings against BIND 4.9.3, which uses function 4722 prototypes. From Don Lewis of Silicon Systems. 4723 Avoid possible incorrect diagnosis of DNS-related errors caused 4724 by things like attempts to resolve uucp names using 4725 $[ ... $] -- the fix is to clear h_errno at appropriate 4726 times. From Kyle Jones of UUNET. 4727 SECURITY: avoid denial-of-service attacks possible by destroying 4728 the alias database file by setting resource limits low. 4729 This involves adding two new compile-time options: 4730 HASSETRLIMIT (indicating that setrlimit(2) support is 4731 available) and HASULIMIT (indicating that ulimit(2) support 4732 is available -- the Release 3 form is used). The former 4733 is assumed on BSD-based systems, the latter on System 4734 V-based systems. Attack noted by Phil Brandenberger of 4735 Swarthmore University. 4736 New syntaxes in test (-bt) mode: 4737 ``.Dmvalue'' will define macro "m" to "value". 4738 ``.Ccvalue'' will add "value" to class "c". 4739 ``=Sruleset'' will dump the contents of the indicated 4740 ruleset. 4741 ``=M'' will display the known mailers. 4742 ``-ddebug-spec'' is equivalent to the command-line 4743 -d debug flag. 4744 ``$m'' will print the value of macro $m. 4745 ``$=c'' will print the contents of class $=c. 4746 ``/mx host'' returns the MX records for ``host''. 4747 ``/parse address'' will parse address, returning the value of 4748 crackaddr (essentially, the comment information) 4749 and the parsed address. 4750 ``/try mailer address'' will rewrite address into the form 4751 it will have when presented to the indicated mailer. 4752 ``/tryflags flags'' will set flags used by parsing. The 4753 flags can be `H' for header or `E' for envelope, 4754 and `S' for sender or `R' for recipient. These 4755 can be combined, so `HR' sets flags for header 4756 recipients. 4757 ``/canon hostname'' will try to canonify hostname and 4758 return the result. 4759 ``/map mapname key'' will look up `key' in the indicated 4760 `mapname' and return the result. 4761 Somewhat better handling of UNIX-domain socket addresses -- it 4762 should show the pathname rather than hex bytes. 4763 Restore ``-ba'' mode -- this reads a file from stdin and parses 4764 the header for envelope sender information and uses 4765 CR-LF as message terminators. It was thought to be 4766 obsolete (used only for Arpanet NCP protocols), but it 4767 turns out that the UK ``Grey Book'' protocols require 4768 that functionality. 4769 Fix a fix in previous release -- if gethostname and gethostbyname 4770 return a name without dots, and if an attempt to canonify 4771 that name fails, wait one minute and try again. This can 4772 result in an extra 60 second delay on startup if your system 4773 hostname (as returned by hostname(1)) has no dot and no names 4774 listed in /etc/hosts or your NIS map have a dot. 4775 Check for proper domain name on HELO and EHLO commands per 4776 RFC 1123 section 5.2.5. Problem noted by Thomas Dwyer III 4777 of Michigan Technological University. 4778 Relax chownsafe rules slightly -- old version said that if you 4779 can't tell if _POSIX_CHOWN_RESTRICTED is set (that is, 4780 if fpathconf returned EINVAL or ENOSYS), assume that 4781 chown is not safe. The new version falls back to whether 4782 you are on a BSD system or not. This is important for 4783 SunOS, which apparently always returns one of those 4784 error codes. This impacts whether you can mail to files 4785 or not. 4786 Syntax errors such as unbalanced parentheses in the configuration 4787 file could be omitted if you had "Oem" prior to the 4788 syntax error in the config file. Change to always print 4789 the error message. It was especially weird because it 4790 would cause a "warning" message to be sent to the Postmaster 4791 for every message sent (but with no transcript). Problem 4792 noted by Gregory Paris of Motorola. 4793 Rewrite collect and putbody to handle full 8-bit data, including 4794 zero bytes. These changes are internally extensive, but 4795 should have minimal impact on external function. 4796 Allow full words for option names -- if the option letter is 4797 (apparently) a space, then take the word following -- e.g., 4798 O MatchGECOS=TRUE 4799 The full list of old and new names is as follows: 4800 7 SevenBitInput 4801 8 EightBitMode 4802 A AliasFile 4803 a AliasWait 4804 B BlankSub 4805 b MinFreeBlocks/MaxMessageSize 4806 C CheckpointInterval 4807 c HoldExpensive 4808 D AutoRebuildAliases 4809 d DeliveryMode 4810 E ErrorHeader 4811 e ErrorMode 4812 f SaveFromLine 4813 F TempFileMode 4814 G MatchGECOS 4815 H HelpFile 4816 h MaxHopCount 4817 i IgnoreDots 4818 I ResolverOptions 4819 J ForwardPath 4820 j SendMimeErrors 4821 k ConnectionCacheSize 4822 K ConnectionCacheTimeout 4823 L LogLevel 4824 l UseErrorsTo 4825 m MeToo 4826 n CheckAliases 4827 O DaemonPortOptions 4828 o OldStyleHeaders 4829 P PostmasterCopy 4830 p PrivacyOptions 4831 Q QueueDirectory 4832 q QueueFactor 4833 R DontPruneRoutes 4834 r, T Timeout 4835 S StatusFile 4836 s SuperSafe 4837 t TimeZoneSpec 4838 u DefaultUser 4839 U UserDatabaseSpec 4840 V FallbackMXHost 4841 v Verbose 4842 w TryNullMXList 4843 x QueueLA 4844 X RefuseLA 4845 Y ForkEachJob 4846 y RecipientFactor 4847 z ClassFactor 4848 Z RetryFactor 4849 The old macros that passed information into sendmail have 4850 been changed to options; those correspondences are: 4851 $e SmtpGreetingMessage 4852 $l UnixFromLine 4853 $o OperatorChars 4854 $q (deleted -- not necessary) 4855 To avoid possible problems with an older sendmail, 4856 configuration level 6 is accepted by this version of 4857 sendmail; any config file using the new names should 4858 specify "V6" in the configuration. 4859 Change address parsing to properly note that a phrase before a 4860 colon and a trailing semicolon are essentially the same 4861 as text outside of angle brackets (i.e., sendmail should 4862 treat them as comments). This is to handle the 4863 ``group name: addr1, addr2, ..., addrN;'' syntax (it will 4864 assume that ``group name:'' is a comment on the first 4865 address and the ``;'' is a comment on the last address). 4866 This requires config file support to get right. It does 4867 understand that :: is NOT this syntax, and can be turned 4868 off completely by setting the ColonOkInAddresses option. 4869 Level 6 config files added with new mailer flags: 4870 A Addresses are aliasable. 4871 i Do udb rewriting on envelope as well as header 4872 sender lines. Applies to the from address mailer 4873 flags rather than the recipient mailer flags. 4874 j Do udb rewriting on header recipient addresses. 4875 Applies to the sender mailer flags rather than the 4876 recipient mailer flags. 4877 k Disable check for loops when doing HELO command. 4878 o Always run as the mail recipient, even on local 4879 delivery. 4880 w Check for an /etc/passwd entry for this user. 4881 5 Pass addresses through ruleset 5. 4882 : Check for :include: on this address. 4883 | Check for |program on this address. 4884 / Check for /file on this address. 4885 @ Look up sender header addresses in the user 4886 database. Applies to the mailer flags for the 4887 mailer corresponding to the envelope sender 4888 address, rather than to recipient mailer flags. 4889 Pre-level 6 configuration files set A, w, 5, :, |, /, and @ 4890 on the "local" mailer, the o flag on the "prog" and "*file*" 4891 mailers, and the ColonOkInAddresses option. 4892 Eight-to-seven bit MIME conversions. This borrows ideas from 4893 John Beck of Hewlett-Packard, who generously contributed 4894 their implementation to me, which I then didn't use (see 4895 mime.c for an explanation of why). This adds the 4896 EightBitMode option (a.k.a. `8') and an F=8 mailer flag 4897 to control handling of 8-bit data. These have to cope with 4898 two types of 8-bit data: unlabelled 8-bit data (that is, 4899 8-bit data that is entered without declaring it as 8-bit 4900 MIME -- technically this is illegal according to the 4901 specs) and labelled 8-bit data (that is, it was declared 4902 as 8BITMIME in the ESMTP session or by using the 4903 -B8BITMIME command line flag). If the F=8 mailer flag is 4904 set then 8-bit data is sent to non-8BITMIME machines 4905 instead of converting to 7 bit (essentially using 4906 just-send-8 semantics). The values for EightBitMode are: 4907 m convert unlabelled 8-bit input to 8BITMIME, and do 4908 any necessary conversion of 8BITMIME to 7BIT 4909 (essentially, the full MIME option). 4910 p pass unlabelled 8-bit input, but convert labelled 4911 8BITMIME input to 7BIT as required (default). 4912 s strict adherence: reject unlabelled 8-bit input, 4913 convert 8BITMIME to 7BIT as required. The F=8 4914 flag is ignored. 4915 Unlabelled 8-bit data is rejected in mode `s' regardless of 4916 the setting of F=8. 4917 Add new internal class 'n', which is the set of MIME Content-Types 4918 which can not be 8 to 7 bit encoded because of other 4919 considerations. Types "multipart/*" and "message/*" are 4920 never directly encoded (although their components can be). 4921 Add new internal class 's', which is the set of subtypes of the 4922 MIME message/* content type that can be treated as though 4923 they are an RFC822 message. It is predefined to have 4924 "rfc822". Suggested By Kari Hurtta. 4925 Add new internal class 'e'. This is the set of MIME 4926 Content-Transfer-Encodings that can be converted to 4927 a seven bit format (Quoted-Printable or Base64). It is 4928 preinitialized to contain "7bit", "8bit", and "binary". 4929 Add C=charset mailer parameter and the the DefaultCharSet option (no 4930 short name) to set the default character set to use in the 4931 Content-Type: header when doing encoding of an 8-bit message 4932 which isn't marked as MIME into MIME format. If the C= 4933 parameter is set on the Envelope From address, use that as 4934 the default encoding; else use the DefaultCharSet option. 4935 If neither is set, it defaults to "unknown-8bit" as 4936 suggested by RFC 1428 section 3. 4937 Allow ``U=user:group'' field in mailer definition to set a default 4938 user and group that a mailer will be executed as. This 4939 overrides the 'u' and 'g' options, and if the `F=S' flag is 4940 also set, it is the uid/gid that will always be used (that 4941 is, the controlling address is ignored). The values may be 4942 numeric or symbolic; if only a symbolic user is given (no 4943 group) that user's default group in the passwd file is used 4944 as the group. Based on code donated by Chip Rosenthal of 4945 Unicom. 4946 Allow `u' option to also accept user:group as a value, in the same 4947 fashion as the U= mailer option. 4948 Add the symbolic time zone name in the Arpanet format dates (as 4949 a comment). This adds a new compile-time configuration 4950 flag: TZ_TYPE can be set to TZ_TM_NAME (use the value 4951 of (struct tm *)->tm_name), TZ_TM_ZONE (use the value 4952 of (struct tm *)->tm_zone), TZ_TZNAME (use extern char 4953 *tzname[(struct tm *)->tm_isdst]), TZ_TIMEZONE (use 4954 timezone()), or TZ_NONE (don't include the comment). Code 4955 from Chip Rosenthal. 4956 The "Timeout" option (formerly "r") is extended to allow suboptions. 4957 For example, 4958 O Timeout.helo = 2m 4959 There are also two new suboptions "queuereturn" and 4960 "queuewarn"; these subsume the old T option. Thus, to 4961 set them both the preferred new syntax is 4962 O Timeout.queuereturn = 5d 4963 O Timeout.queuewarn = 4h 4964 Sort queue by host name instead of by message priority if the 4965 QueueSortOrder option (no short name) is set is set to 4966 ``host''. This makes better use of the connection cache, 4967 but may delay more ``interactive'' messages behind large 4968 backlogs under some circumstances. This is probably a 4969 good option if you have high speed links or don't do lots 4970 of ``batch'' messages, but less good if you are using 4971 something like PPP on a 14.4 modem. Based on code 4972 contributed by Roy Mongiovi of Georgia Tech (my main 4973 contribution was to make it configurable). 4974 Save i-number of df file in qf file to simplify rebuilding of queue 4975 after disastrous disk crash. Suggested by Kyle Jones of 4976 UUNET; closely based on code from KJS DECWRL code written 4977 by Paul Vixie. NOTA BENE: The qf files produced by 8.7 4978 are NOT back compatible with 8.6 -- that is, you can convert 4979 from 8.6 to 8.7, but not the other direction. 4980 Add ``F=d'' mailer flag to disable all use of angle brackets in 4981 route-addrs in envelopes; this is because in some cases 4982 they can be sent to the shell, which interprets them as 4983 I/O redirection. 4984 Don't include error file (option E) with return-receipts; this 4985 can be confusing. 4986 Don't send "Warning: cannot send" messages to owner-* or 4987 *-request addresses. Suggested by Christophe Wolfhugel 4988 of the Institut Pasteur, Paris. 4989 Allow -O command line flag to set long form options. 4990 Add "MinQueueAge" option to set the minimum time between attempts 4991 to run the queue. For example, if the queue interval 4992 (-q value) is five minutes, but the minimum queue age 4993 is fifteen minutes, jobs won't be tried more often than 4994 once every fifteen minutes. This can be used to give 4995 you more responsiveness if your delivery mode is set to 4996 queue-only. 4997 Allow "fileopen" timeout (default: 60 seconds) for opening 4998 :include: and .forward files. 4999 Add "-k", "-v", and "-z" flags to map definitions; these set the 5000 key field name, the value field name, and the field 5001 delimiter. The field delimiter can be a single character 5002 or the sequence "\t" or "\n" for tab or newline. 5003 These are for use by NIS+ and similar access methods. 5004 Change maps to always strip quotes before lookups; the -q flag 5005 turns off this behavior. Suggested by Motonori Nakamura. 5006 Add "nisplus" map class. Takes -k and -v flags to choose the 5007 key and value field names respectively. Code donated by 5008 Sun Microsystems. 5009 Add "hesiod" map class. The "file name" is used as the 5010 "HesiodNameType" parameter to hes_resolve(3). Returns the 5011 first value found for the match. Code donated by Scott 5012 Hutton of Indiana University. 5013 Add "netinfo" (NeXT NetInfo) map class. Maps can have a -k flag to 5014 specify the name of the property that is searched as the 5015 key and a -v flag to specify the name of the property that 5016 is returned as the value (defaults to "members"). The 5017 default map is "/aliases". Some code based on code 5018 contributed by Robert La Ferla of Hot Software. 5019 Add "text" map class. This does slow, linear searches through 5020 text files. The -z flag specifies a column delimiter 5021 (defaults to any sequence of white space), the -k flag 5022 sets the key column number, and the -v flag sets the 5023 value column number. Lines beginning with `#' are treated 5024 as comments. 5025 Add "program" map class to execute arbitrary programs. The search 5026 key is presented as the last argument; the output is one 5027 line read from the programs standard output. Exit statuses 5028 are from sysexits.h. 5029 Add "sequence" map class -- searches maps in sequence until it 5030 finds a match. For example, the declarations: 5031 Kmap1 ... 5032 Kmap2 ... 5033 Kmapseq sequence map1 map2 5034 defines a map "mapseq" that first searches map1; if the 5035 value is found it is returned immediately, otherwise 5036 map2 is searched and the value returned. 5037 Add "switch" map class. This is much like "sequence" except that 5038 the ordering is fetched from an external file, usually 5039 the system service switch. The parameter is the name of 5040 the service to switch on, and the maps that it will use 5041 are the name of the switch map followed by ".service_type". 5042 For example, if the declaration of the map is 5043 Ksample switch hosts 5044 and the system service switch specifies that hosts are 5045 looked up using dns and nis in that order, then this is 5046 equivalent to 5047 Ksample sequence sample.dns sample.nis 5048 The subordinate maps (sample.*) must already be defined. 5049 Add "user" map class -- looks up users using getpwnam. Takes a 5050 "-v field" flag on the definition that tells what passwd 5051 entry to return -- legal values are name, passwd, uid, gid, 5052 gecos, dir, and shell. Generally expected to be used with 5053 the -m (matchonly) flag. 5054 Add "bestmx" map class -- returns the best MX value for the host 5055 listed as the value. If there are several "best" MX records 5056 for this host, one will be chosen at random. 5057 Add "userdb" map class -- looks up entries in the user database. 5058 The "file name" is actually the tag that will be used, 5059 typically "mailname". If there are multiple entries 5060 matching the name, the one chosen is undefined. 5061 Add multiple queue timeouts (both return and warning). These are 5062 set by the Precedence: or Priority: header fields to one of 5063 three values. If a Priority: is set and has value "normal", 5064 "urgent", or "non-urgent" the corresponding timeouts are 5065 used. If no priority is set, the Precedence: is consulted; 5066 if negative, non-urgent timeouts are used; if greater than 5067 zero, urgent timeouts are used. Otherwise, normal timeouts 5068 are used. The timeouts are set by setting the six timeouts 5069 queue{warn,return}.{urgent,normal,non-urgent}. 5070 Fix problem when a mail address is resolved to a $#error mailer 5071 with a temporary failure indication; it works in SMTP, 5072 but when delivering locally the mail is silently discarded. 5073 This patch, from Kyle Jones of UUNET, bounces it instead 5074 of queueing it (queueing is very hard). 5075 When using /etc/hosts or NIS-style lookups, don't assume that 5076 the first name in the list is the best one -- instead, 5077 search for the first one with a dot. For example, if 5078 an /etc/hosts entry reads 5079 128.32.149.68 mammoth mammoth.CS.Berkeley.EDU 5080 this change will use the second name as the canonical 5081 machine name instead of the initial, unqualified name. 5082 Change dequote map to replace spaces in quoted text with a value 5083 indicated by the -s flag on the dequote map definition. 5084 For example, ``Mdequote dequote -s_'' will change 5085 "Foo Bar" into an unquoted Foo_Bar instead of leaving it 5086 quoted (because of the space character). Suggested by Dan 5087 Oscarsson for use in X.400 addresses. 5088 Implement long macro names as ${name}; long class names can 5089 be similarly referenced as $={name} and $~{name}. 5090 Definitions are (e.g.) ``D{name}value''. Names that have 5091 a leading lower case letter or punctuation characters are 5092 reserved for internal use by sendmail; i.e., config files 5093 should use names that begin with a capital letter. Based 5094 on code contributed by Dan Oscarsson. 5095 Fix core dump if getgrgid returns a null group list (as opposed 5096 to an empty group list, that is, a pointer to a list 5097 with no members). Fix from Andrew Chang of Sun Microsystems. 5098 Fix possible core dump if malloc fails -- if the malloc in xalloc 5099 failed, it called syserr which called newstr which called 5100 xalloc.... The newstr is now avoided for "panic" messages. 5101 Reported by Stuart Kemp of James Cook University. 5102 Improve connection cache timeouts; previously, they were not even 5103 checked if you were delivering to anything other than an 5104 IPC-connected host, so a series of (say) local mail 5105 deliveries could cause cached connections to be open 5106 much longer than the specified timeout. 5107 If an incoming message exceeds the maximum message size, stop 5108 writing the incoming bytes to the queue data file, since 5109 this can fill your mqueue partition -- this is a possible 5110 denial-of-service attack. 5111 Don't reject all numeric local user names unless HESIOD is 5112 defined. It turns out that Posix allows all-numeric 5113 user names. Fix from Tony Sanders of BSDI. 5114 Add service switch support. If the local OS has a service 5115 switch (e.g., /etc/nsswitch.conf on Solaris or /etc/svc.conf 5116 on DEC systems) that will be used; otherwise, it falls back 5117 to using a local mechanism based on the ServiceSwitchFile 5118 option (default: /etc/service.switch). For example, if the 5119 service switch lists "files" and "nis" for the aliases 5120 service, that will be the default lookup order. the "files" 5121 ("local" on DEC) service type expands to any alias files 5122 you listed in the configuration file, even if they aren't 5123 actually file lookups. 5124 Option I (NameServerOptions) no longer sets the "UseNameServer" 5125 variable which tells whether or not DNS should be considered 5126 canonical. This is now determined based on whether or not 5127 "dns" is in the service list for "hosts". 5128 Add preliminary support for the ESMTP "DSN" extension (Delivery 5129 Status Notifications). DSN notifications override 5130 Return-Receipt-To: headers, which are bogus anyhow -- 5131 support for them has been removed. 5132 Add T=mts-name-type/address-type/diagnostic-type keyletter to mailer 5133 definitions to define the types used in DSN returns for 5134 MTA names, addresses, and diagnostics respectively. 5135 Extend heuristic to force running in ESMTP mode to look for the 5136 five-character string "ESMTP" anywhere in the 220 greeting 5137 message (not just the second line). This is to provide 5138 better compatibility with other ESMTP servers. 5139 Print sequence number of job when running the queue so you can 5140 easily see how much progress you have made. Suggested 5141 by Peter Wemm of DIALix. 5142 Map newlines to spaces in logged message-ids; some versions of 5143 syslog truncate the rest of the line after newlines. 5144 Suggested by Fletcher Mattox of U. Texas. 5145 Move up forking for job runs so that if a message is split into 5146 multiple envelopes you don't get "fork storms" -- this 5147 also improves the connection cache utilization. 5148 Accept "<<>>", "<<<>>>", and so forth as equivalent to "<>" for 5149 the purposes of refusing to send error returns. Suggested 5150 by Motonori Nakamura of Ritsumeikan University. 5151 Relax rules on when a file can be written when referenced from 5152 the aliases file: use the default uid/gid instead of the 5153 real uid/gid. This allows you to create a file owned by 5154 and writable only by the default uid/gid that will work 5155 all the time (without having the setuid bit set). Change 5156 suggested by Shau-Ping Lo and Andrew Cheng of Sun 5157 Microsystems. 5158 Add "DialDelay" option (no short name) to provide an "extra" 5159 delay for dial on demand systems. If this is non-zero 5160 and a connect fails, sendmail will wait this long and 5161 then try again. If it takes longer than the kernel 5162 timeout interval to establish the connection, this 5163 option can give the network software time to establish 5164 the link. The default units are seconds. 5165 Move logging of sender information to be as early as possible; 5166 previously, it could be delayed a while for SMTP mail 5167 sent to aliases. Suggested by Brad Knowles of the 5168 Defense Information Systems Agency. 5169 Call res_init() before setting RES_DEBUG; this is required by 5170 BIND 4.9.3, or so I'm told. From Douglas Anderson of 5171 the National Computer Security Center. 5172 Add xdelay= field in logs -- this is a transaction delay, telling 5173 you how long it took to deliver to this address on the 5174 last try. It is intended to be used for sorting mailing 5175 lists to favor "quick" addresses. Provided for use by 5176 the mailprio scripts (see below). 5177 If a map cannot be opened, and that map is non-optional, and 5178 an address requires that map for resolution, queue the 5179 map instead of bouncing it. This involves creating a 5180 pseudo-class of maps called "bogus-map" -- if a required 5181 map cannot be opened, the class is changed to bogus-map; 5182 all queries against bogus-map return "tempfail". The 5183 bogus-map class is not directly accessible. A sample 5184 implementation was donated by Jem Taylor of Glasgow 5185 University Computing Service. 5186 Fix a possible core dump when mailing to a program that talks 5187 SMTP on its standard input. Fix from Keith Moore of 5188 the University of Kentucky. 5189 Make it possible to resolve filenames to $#local $: @ /filename; 5190 previously, the "@" would cause it to not be recognized 5191 as a file. Problem noted by Brian Hill of U.C. Davis. 5192 Accept a -1 signal to re-exec the daemon. This only works if 5193 argv[0] is a full path to sendmail. 5194 Fix bug in "addr=..." field in O option on little-endian machines 5195 -- the network number wasn't being converted to network 5196 byte order. Patch from Kurt Lidl of Pix Technologies 5197 Corporation. 5198 Pre-initialize the resolver early on; this is to avoid a bug with 5199 BIND 4.9.3 that can cause the _res.retry field to get 5200 reset to zero, causing all name server lookups to time 5201 out. Fix from Matt Day of Artisoft. 5202 Restore T line (trusted users) in config file -- but instead of 5203 locking out the -f flag, they just tell whether or not 5204 an X-Authentication-Warning: will be added. This really 5205 just creates new entries in class 't', so "Ft/file/name" 5206 can be used to read trusted user names from a file. 5207 Trusted users are also allowed to execute programs even 5208 if they have a shell that isn't in /etc/shells. 5209 Improve NEWDB alias file rebuilding so it will create them 5210 properly if they do not already exist. This had been 5211 a MAYBENEXTRELEASE feature in 8.6.9. 5212 Check for @:@ entry in NIS maps before starting up to avoid 5213 (but not prevent, sigh) race conditions. This ought to 5214 be handled properly in ypserv, but isn't. Suggested by 5215 Michael Beirne of Motorola. 5216 Refuse connections if there isn't enough space on the filesystem 5217 holding the queue. Contributed by Robert Dana of Wolf 5218 Communications. 5219 Skip checking for directory permissions in the path to a file 5220 when checking for file permissions iff setreuid() 5221 succeeded -- it is unnecessary in that case. This avoids 5222 significant performance problems when looking for .forward 5223 files. Based on a suggestion by Win Bent of USC. 5224 Allow symbolic ruleset names. Syntax can be "Sname" to get an 5225 arbitrary ruleset number assigned or "Sname = integer" 5226 to assign a specific ruleset number. Reference is 5227 $>name_or_number. Names can be composed of alphas, digits, 5228 underscore, or hyphen (first character must be non-numeric). 5229 Allow -o flag on AliasFile lines to make the alias file optional. 5230 From Bryan Costales of ICSI. 5231 Add NoRecipientAction option to handle the case where there is 5232 no legal recipient header in the message. It can take 5233 on values: 5234 None Leave the message as is. The 5235 message will be passed on even 5236 though it is in technically 5237 illegal syntax. 5238 Add-To Add a To: header with any 5239 recipients that it can find from 5240 the envelope. This risks exposing 5241 Bcc: recipients. 5242 Add-Apparently-To Add an Apparently-To: header. This 5243 has almost no redeeming social value, 5244 and is provided only for back 5245 compatibility. 5246 Add-To-Undisclosed Add a header reading 5247 To: undisclosed-recipients:; 5248 which will have the effect of 5249 making the message legal without 5250 exposing Bcc: recipients. 5251 Add-Bcc To add an empty Bcc: header. 5252 There is a chance that mailers down 5253 the line will delete this header, 5254 which could cause exposure of Bcc: 5255 recipients. 5256 The default is NoRecipientAction=None. 5257 Truncate (rather than delete) Bcc: lines in the header. This 5258 should prevent later sendmails (at least, those that don't 5259 themselves delete Bcc:) from considering this message to 5260 be non-conforming -- although it does imply that non-blind 5261 recipients can see that a Bcc: was sent, albeit not to whom. 5262 Add SafeFileEnvironment option. If declared, files named as delivery 5263 targets must be regular files in addition to the regular 5264 checks. Also, if the option is non-null then it is used as 5265 the name of a directory that is used as a chroot(2) 5266 environment for the delivery; the file names listed in an 5267 alias or forward should include the name of this root. 5268 For example, if you run with 5269 O SafeFileEnvironment=/arch 5270 then aliases should reference "/arch/rest/of/path". If a 5271 value is given, sendmail also won't try to save to 5272 /usr/tmp/dead.letter (instead it just leaves the job in the 5273 queue as Qfxxxxxx). Inspired by *Hobbit*'s sendmail patch kit. 5274 Support -A flag for alias files; this will comma concatenate like 5275 entries. For example, given the aliases: 5276 list: member1 5277 list: member2 5278 and an alias file declared as: 5279 OAhash:-A /etc/aliases 5280 the final alias inserted will be "list: member1,member2"; 5281 without -A you will get an error on the second and subsequent 5282 alias for "list". Contributed by Bryan Costales of ICSI. 5283 Line-buffer transcript file. Suggested by Liudvikas Bukys. 5284 Fix a problem that could cause very long addresses to core dump in 5285 some special circumstances. Problem pointed out by Allan 5286 Johannesen. 5287 (Internal change.) Change interface to expand() (macro expansion) 5288 to be simpler and more consistent. 5289 Delete check for funny qf file names. This didn't really give 5290 any extra security and caused some people some problems. 5291 (If you -really- want this, define PICKY_QF_NAME_CHECK 5292 at compile time.) Suggested by Kyle Jones of UUNET. 5293 (Internal change.) Change EF_NORETURN to EF_NO_BODY_RETN and 5294 merge with DSN code; this is simpler and more consistent. 5295 This may affect some people who have written their own 5296 checkcompat() routine. 5297 (Internal change.) Eliminate `D' line in qf file. The df file 5298 is now assumed to be the same name as the qf file (with 5299 the `q' changed to a `d', of course). 5300 Avoid forking for delivery if all recipient mailers are marked as 5301 "expensive" -- this can be a major cost on some systems. 5302 Essentially, this forces sendmail into "queue only" mode 5303 if all it is going to do is queue anyway. 5304 Avoid sending a null message in some rather unusual circumstances 5305 (specifically, the RCPT command returns a temporary 5306 failure but the connection is lost before the DATA 5307 command). Fix from Scott Hammond of Secure Computing 5308 Corporation. 5309 Change makesendmail to use a somewhat more rational naming scheme: 5310 Makefiles and obj directories are named $os.$rel.$arch, 5311 where $os is the operating system (e.g., SunOS), $rel is 5312 the release number (e.g., 5.3), and $arch is the machine 5313 architecture (e.g., sun4). Any of these can be omitted, 5314 and anything after the first dot in a release number can 5315 be replaced with "x" (e.g., SunOS.4.x.sun4). The previous 5316 version used $os.$arch.$rel and was rather less general. 5317 Change makesendmail to do a "make depend" in the target directory 5318 when it is being created. This involves adding an empty 5319 "depend:" entry in most Makefiles. 5320 Ignore IDENT return value if the OSTYPE field returns "OTHER", 5321 as indicated by RFC 1413. Pointed out by Kari Hurtta 5322 of the Finnish Meteorological Institute. 5323 Fix problem that could cause multiple responses to DATA command 5324 on header syntax errors (e.g., lines beginning with colons). 5325 Problem noted by Jens Thomassen of the University of Oslo. 5326 Don't let null bytes in headers cause truncation of the rest of 5327 the header. 5328 Log Authentication-Warning:s. Suggested by Motonori Nakamura. 5329 Increase timeouts on message data puts to allow time for receivers 5330 to canonify addresses in headers on the fly. This is still 5331 a rather ugly heuristic. From Motonori Nakamura. 5332 Add "HasWildcardMX" suboption to ResolverOptions; if set, MX 5333 records are not used when canonifying names, and when MX 5334 lookups are done for addressing they must be fully 5335 qualified. This is useful if you have a wildcard MX record, 5336 although it may cause other problems. In general, don't use 5337 wildcard MX records. Patch from Motonori Nakamura. 5338 Eliminate default two-line SMTP greeting message. Instead of 5339 adding an extra "ESMTP spoken here" line, the word "ESMTP" 5340 is added between the first and second word of the first 5341 line of the greeting message (i.e., immediately after the 5342 host name). This eliminates the need for the BROKEN_SMTP_PEERS 5343 compile flag. Old sendmails won't see the ESMTP, but that's 5344 acceptable because SIZE was the only useful extension that 5345 old sendmails understand. 5346 Avoid gethostbyname calls on UNIX domain sockets during SIGUSR1 5347 invoked state dumps. From Masaharu Onishi. 5348 Allow on-line comments in .forward and :include: files; they are 5349 introduced by the string "<LWSP>#@#<LWSP>", where <LWSP> 5350 is a space or a tab. This is intended for native 5351 representation of non-ASCII sets such as Japanese, where 5352 existing encodings would be unreadable or would lose 5353 data -- for example, 5354 <motonori@cs.ritsumei.ac.jp> NAKAMURA Motonori 5355 (romanized/less information) 5356 <motonori@cs.ritsumei.ac.jp> =?ISO-2022-JP?B?GyRCQ2ZCPBsoQg==?= 5357 =?ISO-2022-JP?B?GyRCQUdFNRsoQg==?= 5358 (with MIME encoding, not human readable) 5359 <motonori@cs.ritsumei.ac.jp> #@# ^[$BCfB<^[(B ^[$BAGE5^[(B 5360 (native encoding with ISO-2022-JP) 5361 The last form is human readable in the Japanese environment. 5362 Based on a fix from (surprise!) Motonori Nakamura. 5363 Don't make SMTP error returns on MAIL FROM: line be "sticky" for all 5364 messages to that host; these are most frequently associated 5365 with addresses rather than the host, with the exception of 5366 421 (service shutting down). The effect was to cause queues 5367 to sometimes take an excessive time to flush. Reported by 5368 Robert Sargent of Southern Geographics Technologies and 5369 Eric Prestemon of American University. 5370 Add Nice=N mailer option to set the niceness at which a mailer will 5371 run. This is actually a relative niceness (that is, an 5372 increment on the background value). 5373 Log queue runs that are skipped due to high loads. They are logged 5374 at LOG_INFO priority iff the log level is > 8. Contributed 5375 by Bruce Nagel of Data General. 5376 Allow the error mailer to accept a DSN-style error status code 5377 instead of an sysexits status code in the host part. 5378 Anything with a dot will be interpreted as a DSN-style code. 5379 Add new mailer flag: F=3 will tell translations to Quoted-Printable 5380 to encode characters that might be munged by an EBCDIC system 5381 in addition to the set required by RFC 1521. The additional 5382 characters are !, ", #, $, @, [, \, ], ^, `, {, |, }, and ~. 5383 (Think of "IBM 360" as the mnemonic for this flag.) 5384 Change check for mailing to files to look for a pathname of [FILE] 5385 rather than looking for the mailer named *file*. The mapping 5386 of leading slashes still goes to the *file* mailer. This 5387 allows you to implement the *file* mailer as a separate 5388 program, for example, to insert a Content-Length: header 5389 or do special security policy. However, note that the usual 5390 initial checking for the file permissions is still done, and 5391 the program in question needs to be very careful about how 5392 it does the file write to avoid security problems. 5393 Be able to read ~root/.forward even if the path isn't accessible to 5394 regular users. This is disrecommended because sendmail 5395 sometimes does not run as root (e.g., when an unsafe option 5396 is specified on the command line), but should otherwise be 5397 safe because .forward files must be owned by the user for 5398 whom mail is being forwarded, and cannot be a symbolic link. 5399 Suggested by Forrest Aldrich of Wang Laboratories. 5400 Add new "HostsFile" option that is the pathname to the /etc/hosts 5401 file. This is used for canonifying hostnames when the 5402 service type is "files". 5403 Implement programs on F (read class from file) line. The syntax is 5404 Fc|/path/to/program to read the output from the program 5405 into class "c". 5406 Probe the network interfaces to find alternate names for this 5407 host. Requires the SIOCGIFCONF ioctl call. Code 5408 contributed by SunSoft. 5409 Add "E" configuration line to set or propagate environment 5410 variables into children. "E<envar>" will propagate 5411 the named variable from the environment when sendmail 5412 was invoked into any children it calls; "E<envar>=<value>" 5413 sets the named variable to the indicated value. Any 5414 variables not explicitly named will not be in the child 5415 environment. However, sendmail still forces an 5416 "AGENT=sendmail" environment variable, in part to enforce 5417 at least one environment variable, since many programs and 5418 libraries die horribly if this is not guaranteed. 5419 Change heuristic for rebuilding both NEWDB and NDBM versions of 5420 alias databases -- new algorithm looks for the substring 5421 "/yp/" in the file name. This is more portable and involves 5422 less overhead. Suggested by Motonori Nakamura. 5423 Dynamically allocate the queue work list so that you don't lose 5424 jobs in large queue runs. The old QUEUESIZE compile parameter 5425 is replaced by QUEUESEGSIZE (the unit of allocation, which 5426 should not need to be changed) and the MaxQueueRunSize option, 5427 which is the absolute maximum number of jobs that will ever 5428 be handled in a single queue run. Based on code contributed 5429 by Brian Coan of the Institute for Global Communications. 5430 Log message when a message is dropped because it exceeds the maximum 5431 message size. Suggested by Leo Bicknell of Virginia Tech. 5432 Allow trusted users (those on a T line or in $=t) to use -bs without 5433 an X-Authentication-Warning: added. Suggested by Mark Thomas 5434 of Mark G. Thomas Consulting. 5435 Announce state of compile flags on -d0.1 (-d0.10 throws in the 5436 OS-dependent defines). The old semantic of -d0.1 to not 5437 run the daemon in background has been moved to -d99.100, 5438 and the old 52.5 flag (to avoid disconnect() from closing 5439 all output files) has been moved to 52.100. This makes 5440 things more consistent (flags below .100 don't change 5441 semantics) and separates out the backgrounding so that 5442 it doesn't happen automatically on other unrelated debugging 5443 flags. 5444 If -t is used but no addresses are found in the header, give an 5445 error message rather than just doing nothing. Fix from 5446 Motonori Nakamura. 5447 On systems (like SunOS) where the effective gid is not necessarily 5448 included in the group list returned by getgroups(), the 5449 `restrictmailq' option could sometimes cause an authorized 5450 user to not be able to use `mailq'. Fix from Charles Hannum 5451 of MIT. 5452 Allow symbolic service names for [IPC] mailers. Suggested by 5453 Gerry Magennis of Logica International. 5454 Add DontExpandCnames option to prevent $[ ... $] from expanding CNAMEs 5455 when running DNS. For example, if the name FTP.Foo.ORG is 5456 a CNAME for Cruft.Foo.ORG, then when sitting on a machine in 5457 the Foo.ORG domain a lookup of "FTP" returns "Cruft.Foo.ORG" 5458 if this option is not set, or "FTP.Foo.ORG" if it is set. 5459 This is technically illegal under RFC 822 and 1123, but the 5460 IETF is moving toward legalizing it. Note that turning on 5461 this option is not sufficient to guarantee that a downstream 5462 neighbor won't rewrite the address for you. 5463 Add "-m" flag to makesendmail script -- this tells you what object 5464 directory and Makefile it will use, but doesn't actually do 5465 the make. 5466 Do some additional checking on the contents of the qf file to try 5467 to detect attacks against the qf file. In particular, 5468 abort on any line beginning "From ", and add an "end of 5469 file" line -- any data after that line is prohibited. 5470 Always use /etc/sendmail.cf, regardless of the arbitrary vendor 5471 choices. This can be overridden in the Makefile by using 5472 either -DUSE_VENDOR_CF_PATH to get the vendor location 5473 (to the extent that we know it) or by defining 5474 _PATH_SENDMAILCF (which is a "hard override"). This allows 5475 sendmail 8 to have more consistent installation instructions. 5476 Allow macros on `K' line in config file. Suggested by Andrew Chang 5477 of Sun Microsystems. 5478 Improved symbol table hash function from Eric Wassenaar. This one 5479 is at least 50% faster. 5480 Fix problem that didn't notice that timeout on file open was a 5481 transient error. Fix from Larry Parmelee of Cornell 5482 University. 5483 Allow comments (lines beginning with a `#') in files read for 5484 classes. Suggested by Motonori Nakamura. 5485 Make SIGINT (usually ^C) in test mode return to the prompt instead 5486 of dropping out entirely. This makes testing some of the 5487 name server lookups easier to deal with when there are 5488 hung servers. From Motonori Nakamura. 5489 Add new ${opMode} macro that is set to the current operation mode 5490 (e.g., `s' for -bs, `t' for -bt, etc.). Suggested by 5491 Claude Marinier <MARINIER@emp.ewd.dreo.dnd.ca>. 5492 Add new delivery mode (Odd) that defers all map lookups to queue runs. 5493 Kind of like queue-only mode (Odq) except it tries to avoid 5494 any external service requests; for dial-on-demand hosts that 5495 want to minimize DNS lookups when mail is being queued. For 5496 this to work you will also have to make sure that gethostbyname 5497 of your local host name does not do a DNS lookup. 5498 Improved handling of "out of space" conditions from John Myers of 5499 Carnegie Mellon. 5500 Improved security for mailing to files on systems that have fchmod(2) 5501 support. 5502 Improve "cannot send message for N days" message -- now says "could 5503 not send for past N days". Suggested by Tom Moore of AT&T 5504 Global Information Solutions. 5505 Less misleading Subject: line on messages sent to postmaster only. 5506 From Motonori Nakamura. 5507 Avoid duplicate error messages on bad command line flags. From 5508 Motonori Nakamura. 5509 Better error message for case where ruleset 0 falls off the end 5510 or otherwise does not resolve to a canonical triple. 5511 Fix a problem that could cause multiple bounce messages if a bad 5512 address was sent along with a good address to an SMTP 5513 site where that SMTP site returned a 4yz code in response 5514 to the final dot of the data. Problem reported by David 5515 James of British Telecom. 5516 Add "volatile" declarations so that gcc -O2 will work. Patches 5517 from Alexander Dupuy of System Management ARTS. 5518 Delete duplicates in MX lists -- believe it or not, there are sites 5519 that list the same host twice in an MX list. This deletion 5520 only works on adjacent preferences, so an MX list that 5521 had A=5, B=10, A=15 would leave both As, but one that had 5522 A=5, A=10, B=15 would reduce to A, B. This is intentional, 5523 just in case there is something weird I haven't thought of. 5524 Suggested by Barry Shein of Software Tool & Die. 5525 SECURITY: .forward files cannot be symbolic links. If they are, 5526 a bad guy can read your private files. 5527 PORTABILITY FIXES: 5528 Solaris 2 from Rob McMahon <cudcv@csv.warwick.ac.uk>. 5529 System V Release 4 from Motonori Nakamura of Ritsumeikan 5530 University. This expands the disk size 5531 checking to include all (?) SVR4 configurations. 5532 System V Release 4 from Kimmo Suominen -- initgroups(3) 5533 and setrlimit(2) are both available. 5534 System V Release 4 from sob@sculley.ffg.com -- some versions 5535 apparently "have EX_OK defined in other headerfiles." 5536 Linux Makefile typo. 5537 Linux getusershell(3) is broken in Slackware 2.0 -- 5538 from Andrew Pam of Xanadu Australia. 5539 More Linux tweaking from John Kennedy of California State 5540 University, Chico. 5541 Cray changes from Eric Wassenaar: ``On Cray, shorts, 5542 ints, and longs are all 64 bits, and all structs 5543 are multiples of 64 bits. This means that the 5544 sizeof operator returns only multiples of 8. 5545 This requires adaptation of code that really 5546 deals with 32 bit or 16 bit fields, such as IP 5547 addresses or nameserver fields.'' 5548 DG/UX 5.4.3 from Mark T. Robinson <mtr@ornl.gov>. To 5549 get the old behavior, use -DDGUX_5_4_2. 5550 DG/UX hack: add _FORCE_MAIL_LOCAL_=yes environment 5551 variable to fix bogus /bin/mail behavior. 5552 Tandem NonStop-UX from Rick McCarty <mccarty@mpd.tandem.com>. 5553 This also cleans up some System V Release 4 compile 5554 problems. 5555 Solaris 2: sendmail.cw file should be in /etc/mail to 5556 match all the other configuration files. Fix 5557 from Glenn Barry of Emory University. 5558 Solaris 2.3: compile problem in conf.c. Fix from Alain 5559 Nissen of the University of Liege, Belgium. 5560 Ultrix: freespace calculation was incorrect. Fix from 5561 Takashi Kizu of Osaka University. 5562 SVR4: running in background gets a SIGTTOU because the 5563 emulation code doesn't realize that "getpeername" 5564 doesn't require reading the file. Fix from Peter 5565 Wemm of DIALix. 5566 Solaris 2.3: due to an apparent bug in the socket emulation 5567 library, sockets can get into a "wedged" state where 5568 they just return EPROTO; closing and re-opening the 5569 socket clears the problem. Fix from Bob Manson 5570 of Ohio State University. 5571 Hitachi 3050R & 3050RX running HI-UX/WE2: portability 5572 fixes from Akihiro Hashimoto ("Hash") of Chiba 5573 University. 5574 AIX changes to allow setproctitle to work from Rainer Sch�pf 5575 of Zentrum f�r Datenverarbeitung der Universit�t 5576 Mainz. 5577 AIX changes for load average from Ed Ravin of NASA/Goddard. 5578 SCO Unix from Chip Rosenthal of Unicom (code was using the 5579 wrong statfs call). 5580 ANSI C fixes from Adam Glass (NetBSD project). 5581 Stardent Titan/ANSI C fixes from Kate Hedstrom of Rutgers 5582 University. 5583 DG-UX fixes from Bruce Nagel of Data General. 5584 IRIX64 updates from Mark Levinson of the University of 5585 Rochester Medical Center. 5586 Altos System V (``the first UNIX/XENIX merge the Altos 5587 did for their Series 1000 & Series 2000 line; 5588 their merged code was licensed back to AT&T and 5589 Microsoft and became System V release 3.2'') from 5590 Tim Rice <timr@crl.com>. 5591 OSF/1 running on Intel Paragon from Jeff A. Earickson 5592 <jeff@ssd.intel.com> of Intel Scalable Systems 5593 Division. 5594 Amdahl UTS System V 2.1.5 (SVr3-based) from Janet Jackson 5595 <janet@dialix.oz.au>. 5596 System V Release 4 (statvfs semantic fix) from Alain 5597 Durand of I.M.A.G. 5598 HP-UX 10.x multiprocessor load average changes from 5599 Scott Hutton and Jeff Sumler of Indiana University. 5600 Cray CSOS from Scott Bolte of Cray Computer Corporation. 5601 Unicos 8.0 from Douglas K. Rand of the University of North 5602 Dakota, Scientific Computing Center. 5603 Solaris 2.4 fixes from Sanjay Dani of Dani Communications. 5604 ConvexOS 11.0 from Christophe Wolfhugel. 5605 IRIX 4.0.5 from David Ashton-Reader of CADcentre. 5606 ISC UNIX from J. J. Bailey. 5607 HP-UX 9.xx on the 8xx series machines from Remy Giraud 5608 of Meteo France. 5609 HP-UX configuration from Tom Lane <tgl@sss.pgh.pa.us>. 5610 IRIX 5.2 and 5.3 from Kari E. Hurtta. 5611 FreeBSD 2.0 from Mike Hickey of Federal Data Corporation. 5612 Sony NEWS-OS 4.2.1R and 6.0.3 from Motonori Nakamura. 5613 Omron LUNA unios-b, mach from Motonori Nakamura. 5614 NEC EWS-UX/V 4.2 from Motonori Nakamura. 5615 NeXT 2.1 from Bryan Costales. 5616 AUX patch thanks to Mike Erwin of Apple Computer. 5617 HP-UX 10.0 from John Beck of Hewlett-Packard. 5618 Ultrix: allow -DBROKEN_RES_SEARCH=0 if you are using a 5619 non-DEC resolver. Suggested by Allan Johannesen. 5620 UnixWare 2.0 fixes from Petr Lampa of the Technical 5621 University of Brno (Czech Republic). 5622 KSR OS 1.2.2 support from Todd Miller of the University 5623 of Colorado. 5624 UX4800 support from Kazuhisa Shimizu of NEC. 5625 MAKEMAP: allow -d flag to allow insertion of duplicate aliases 5626 in type ``btree'' maps. The semantics of this are undefined 5627 for regular maps, but it can be useful for the user database. 5628 MAKEMAP: lock database file while rebuilding to avoid sendmail 5629 lookups while the rebuild is going on. There is a race 5630 condition between the open(... O_TRUNC ...) and the lock 5631 on the file, but it should be quite small. 5632 SMRSH: sendmail restricted shell added to the release. This can 5633 be used as an alternative to /bin/sh for the "prog" mailer, 5634 giving the local administrator more control over what 5635 programs can be run from sendmail. 5636 MAIL.LOCAL: add this local mailer to the tape. It is not really 5637 part of the release proper, and isn't fully supported; in 5638 particular, it does not run on System V based systems and 5639 never will. 5640 CONTRIB: a patch to rmail.c from Bill Gianopoulos of Raytheon 5641 to allow rmail to compile on systems that don't have 5642 function prototypes and systems that don't have snprintf. 5643 CONTRIB: add the "mailprio" scripts that will help you sort mailing 5644 lists by transaction delay times so that addresses that 5645 respond quickly get sent first. This is to prevent very 5646 sluggish servers from delaying other peoples' mail. 5647 Contributed by Tony Sanders of BSDI. 5648 CONTRIB: add the "bsdi.mc" file as contributed by Tony Sanders 5649 of BSDI. This has a lot of comments to help people out. 5650 CONFIG: Don't have .mc files include(../m4/cf.m4) -- instead, 5651 put this on the m4 command line. On GNU m4 (which 5652 supports the __file__ primitive) you can run m4 in an 5653 arbitrary directory -- use either: 5654 m4 ${CFDIR}/m4/cf.m4 config.mc > config.cf 5655 or 5656 m4 -I${CFDIR} m4/cf.m4 config.mc > config.cf 5657 On other versions of m4 that don't support __file__, you 5658 can use: 5659 m4 -D_CF_DIR_=${CFDIR}/ ${CFDIR}/m4/cf.m4 ... 5660 (Note the trailing slash on the _CF_DIR_ definition.) 5661 Old versions of m4 will default to _CF_DIR_=.. for back 5662 compatibility. 5663 CONFIG: fix mail from <> so it will properly convert to 5664 MAILER-DAEMON on local addresses. 5665 CONFIG: fix code that was supposed to catch colons in host 5666 names. Problem noted by John Gardiner Myers of CMU. 5667 CONFIG: allow use of SMTP_MAILER_MAX in nullclient configuration. 5668 From Paul Riddle of the University of Maryland, Baltimore 5669 County. 5670 CONFIG: Catch and reject "." as a host address. 5671 CONFIG: Generalize domaintable to look up all domains, not 5672 just unqualified ones. 5673 CONFIG: Delete OLD_SENDMAIL support -- as near as I can tell, it 5674 was never used and didn't work anyway. 5675 CONFIG: Set flags A, w, 5, :, /, |, and @ on the "local" mailer 5676 and d on all mailers in the UUCP class. 5677 CONFIG: Allow "user+detail" to be aliased specially: it will first 5678 look for an alias for "user+detail", then for "user+*", and 5679 finally for "user". This is intended for forwarding mail 5680 for system aliases such as root and postmaster to a 5681 centralized hub. 5682 CONFIG: add confEIGHT_BIT_HANDLING to set option 8 (see above). 5683 CONFIG: add smtp8 mailer; this has the F=8 (just-send-8) flag set. 5684 The F=8 flag is also set on the "relay" mailer, since 5685 this is expected to be another sendmail. 5686 CONFIG: avoid qualifying all UUCP addresses sent via SMTP with 5687 the name of the UUCP_RELAY -- in some cases, this is the 5688 wrong value (e.g., when we have local UUCP connections), 5689 and this can create unreplyable addresses. From Chip 5690 Rosenthal of Unicom. 5691 CONFIG: add confRECEIVED_HEADER to change the format of the 5692 Received: header inserted into all messages. Suggested by 5693 Gary Mills of the University of Manitoba. 5694 CONFIG: Make "notsticky" the default; use FEATURE(stickyhost) 5695 to get the old behavior. I did this upon observing 5696 that almost everyone needed this feature, and that the 5697 concept I was trying to make happen didn't work with 5698 some user agents anyway. FEATURE(notsticky) still works, 5699 but it is a no-op. 5700 CONFIG: Add LUSER_RELAY -- the host to which unrecognized user 5701 names are sent, rather than immediately diagnosing them 5702 as User Unknown. 5703 CONFIG: Add SMTP_MAILER_ARGS, ESMTP_MAILER_ARGS, SMTP8_MAILER_ARGS, 5704 and RELAY_MAILER_ARGS to set the arguments for the 5705 indicated mailers. All default to "IPC $h". Patch from 5706 Larry Parmelee of Cornell University. 5707 CONFIG: pop mailer needs F=n flag to avoid "annoying side effects 5708 on the client side" and F=P to get an appropriate 5709 return-path. From Kimmo Suominen. 5710 CONFIG: add FEATURE(local_procmail) to use the procmail program 5711 as the local mailer. For addresses of the form "user+detail" 5712 the "detail" part is passed to procmail via the -a flag. 5713 Contributed by Kimmo Suominen. 5714 CONFIG: add MAILER(procmail) to add an interface to procmail for 5715 use from mailertables. This lets you execute arbitrary 5716 procmail scripts. Contributed by Kimmo Suominen. 5717 CONFIG: add T= fields (MTS type) to local, smtp, and uucp mailers. 5718 CONFIG: add OSTYPE(ptx2) for DYNIX/ptx 2.x from Sequent. From 5719 Paul Southworth of CICNet Systems Support. 5720 CONFIG: use -a$g as default to UUCP mailers, instead of -a$f. 5721 This causes the null return path to be rewritten as 5722 MAILER-DAEMON; otherwise UUCP gets horribly confused. 5723 From Michael Hohmuth of Technische Universitat Dresden. 5724 CONFIG: Add FEATURE(bestmx_is_local) to cause any hosts that 5725 list us as the best possible MX record to be treated as 5726 though they were local (essentially, assume that they 5727 are included in $=w). This can cause additional DNS 5728 traffic, but is easier to administer if this fits your 5729 local model. It does not work reliably if there are 5730 multiple hosts that share the best MX preference. 5731 Code contributed by John Oleynick of Rutgers. 5732 CONFIG: Add FEATURE(smrsh) to use smrsh (the SendMail Restricted 5733 SHell) instead of /bin/sh as the program used for delivery 5734 to programs. If an argument is included, it is used as 5735 the path to smrsh; otherwise, /usr/local/etc/smrsh is 5736 assumed. 5737 CONFIG: Add LOCAL_MAILER_MAX and PROCMAILER_MAILER_MAX to limit the 5738 size of messages to the local and procmail mailers 5739 respectively. Contributed by Brad Knowles of the Defense 5740 Information Systems Agency. 5741 CONFIG: Handle leading ``phrase:'' and trailing ``;'' as comments 5742 (just like text outside of angle brackets) in order to 5743 properly deal with ``group: addr1, ... addrN;'' syntax. 5744 CONFIG: Require OSTYPE macro (the defaults really don't apply to 5745 any real systems any more) and tweak the DOMAIN macro 5746 so that it is less likely that users will accidentally use 5747 the Berkeley defaults. Also, create some generic files 5748 that really can be used in the real world. 5749 CONFIG: Add new configuration macros to set character sets for 5750 messages _arriving from_ various mailers: LOCAL_MAILER_CHARSET, 5751 SMTP_MAILER_CHARSET, and UUCP_MAILER_CHARSET. 5752 CONFIG: Change UUCP_MAX_SIZE to UUCP_MAILER_MAX for consistency. 5753 The old name will still be accepted for a while at least. 5754 CONFIG: Implement DECNET_RELAY as spec for host to which DECNET 5755 mail (.DECNET pseudo-domain or node::user) will be sent. 5756 As with all relays, it can be ``mailer:hostname''. Suggested 5757 by Scott Hutton. 5758 CONFIG: Add MAILER(mail11) to get DECnet support. Code contributed 5759 by Barb Dijker of Labyrinth Computer Services. 5760 CONFIG: change confCHECK_ALIASES to default to False -- it has poor 5761 performance for large alias files, and this confused many 5762 people. 5763 CONFIG: Add confCF_VERSION to append local information to the 5764 configuration version number displayed during SMTP startup. 5765 CONFIG: fix some.newsgroup.usenet@local.host syntax (previously it 5766 would only work when locally addressed. Fix from 5767 Edvard Tuinder of Cistron Internet Services. 5768 CONFIG: use ${opMode} to avoid error on .REDIRECT addresses if option 5769 "n" (CheckAliases) is set when rebuilding alias database. 5770 Based on code contributed by Claude Marinier. 5771 CONFIG: Allow mailertable to have values of the form 5772 ``error:code message''. The ``code'' is a status code 5773 derived from the sysexits codes -- e.g., NOHOST or UNAVAILABLE. 5774 Contributed by David James <dwj@agw.bt.co.uk>. 5775 CONFIG: add MASQUERADE_DOMAIN(domain list) to extend the list of 5776 sender domains that will be replaced with the masquerade name. 5777 These domains will not be treated as local, but if mail passes 5778 through with sender addresses in those domains they will be 5779 replaced by the masquerade name. These can also be specified 5780 in a file using MASQUERADE_DOMAIN_FILE(filename). 5781 CONFIG: add FEATURE(masquerade_envelope) to masquerade the envelope 5782 as well as the header. Substantial improvements to this 5783 code were contributed by Per Hedeland. 5784 CONFIG: add MAILER(phquery) to define a new "ph" mailer; this can be 5785 accessed from a mailertable to do CCSO ph lookups. Contributed 5786 by Kimmo Suominen. 5787 CONFIG: add MAILER(cyrus) to define a new Cyrus mailer; this can be 5788 used to define cyrus and cyrusbb mailers (for IMAP support). 5789 Contributed by John Gardiner Myers of Carnegie Mellon. 5790 CONFIG: add confUUCP_MAILER to select default mailer to use for 5791 UUCP addressing. Suggested by Tom Moore of AT&T GIS. 5792 NEW FILES: 5793 cf/cf/cs-hpux10.mc 5794 cf/cf/cs-solaris2.mc 5795 cf/cf/cyrusproto.mc 5796 cf/cf/generic-bsd4.4.mc 5797 cf/cf/generic-hpux10.mc 5798 cf/cf/generic-hpux9.mc 5799 cf/cf/generic-osf1.mc 5800 cf/cf/generic-solaris2.mc 5801 cf/cf/generic-sunos4.1.mc 5802 cf/cf/generic-ultrix4.mc 5803 cf/cf/huginn.cs.mc 5804 cf/domain/berkeley-only.m4 5805 cf/domain/generic.m4 5806 cf/feature/bestmx_is_local.m4 5807 cf/feature/local_procmail.m4 5808 cf/feature/masquerade_envelope.m4 5809 cf/feature/smrsh.m4 5810 cf/feature/stickyhost.m4 5811 cf/feature/use_ct_file.m4 5812 cf/m4/cfhead.m4 5813 cf/mailer/cyrus.m4 5814 cf/mailer/mail11.m4 5815 cf/mailer/phquery.m4 5816 cf/mailer/procmail.m4 5817 cf/ostype/amdahl-uts.m4 5818 cf/ostype/bsdi2.0.m4 5819 cf/ostype/hpux10.m4 5820 cf/ostype/irix5.m4 5821 cf/ostype/isc4.1.m4 5822 cf/ostype/ptx2.m4 5823 cf/ostype/unknown.m4 5824 contrib/bsdi.mc 5825 contrib/mailprio 5826 contrib/rmail.oldsys.patch 5827 mail.local/mail.local.0 5828 makemap/makemap.0 5829 smrsh/README 5830 smrsh/smrsh.0 5831 smrsh/smrsh.8 5832 smrsh/smrsh.c 5833 src/Makefiles/Makefile.CSOS 5834 src/Makefiles/Makefile.EWS-UX_V 5835 src/Makefiles/Makefile.HP-UX.10 5836 src/Makefiles/Makefile.IRIX.5.x 5837 src/Makefiles/Makefile.IRIX64 5838 src/Makefiles/Makefile.ISC 5839 src/Makefiles/Makefile.KSR 5840 src/Makefiles/Makefile.NEWS-OS.4.x 5841 src/Makefiles/Makefile.NEWS-OS.6.x 5842 src/Makefiles/Makefile.NEXTSTEP 5843 src/Makefiles/Makefile.NonStop-UX 5844 src/Makefiles/Makefile.Paragon 5845 src/Makefiles/Makefile.SCO.3.2v4.2 5846 src/Makefiles/Makefile.SunOS.5.3 5847 src/Makefiles/Makefile.SunOS.5.4 5848 src/Makefiles/Makefile.SunOS.5.5 5849 src/Makefiles/Makefile.UNIX_SV.4.x.i386 5850 src/Makefiles/Makefile.uts.systemV 5851 src/Makefiles/Makefile.UX4800 5852 src/aliases.0 5853 src/mailq.0 5854 src/mime.c 5855 src/newaliases.0 5856 src/sendmail.0 5857 test/t_seteuid.c 5858 RENAMED FILES: 5859 cf/cf/alpha.mc => cf/cf/s2k-osf1.mc 5860 cf/cf/chez.mc => cf/cf/chez.cs.mc 5861 cf/cf/hpux-cs-exposed.mc => cf/cf/cs-hpux9.mc 5862 cf/cf/osf1-cs-exposed.mc => cf/cf/cs-osf1.mc 5863 cf/cf/s2k.mc => cf/cf/s2k-ultrix4.mc 5864 cf/cf/sunos4.1-cs-exposed.mc => cf/cf/cs-sunos4.1.mc 5865 cf/cf/ultrix4.1-cs-exposed.mc => cf/cf/cs-ultrix4.mc 5866 cf/cf/vangogh.mc => cf/cf/vangogh.cs.mc 5867 cf/domain/Berkeley.m4 => cf/domain/Berkeley.EDU.m4 5868 cf/domain/cs-exposed.m4 => cf/domain/CS.Berkeley.EDU.m4 5869 cf/domain/eecs-hidden.m4 => cf/domain/EECS.Berkeley.EDU.m4 5870 cf/domain/s2k.m4 => cf/domain/S2K.Berkeley.EDU.m4 5871 cf/ostype/hpux.m4 => cf/ostype/hpux9.m4 5872 cf/ostype/irix.m4 => cf/ostype/irix4.m4 5873 cf/ostype/ultrix4.1.m4 => cf/ostype/ultrix4.m4 5874 src/Makefile.* => src/Makefiles/Makefile.* 5875 src/Makefile.AUX => src/Makefiles/Makefile.A-UX 5876 src/Makefile.BSDI => src/Makefiles/Makefile.BSD-OS 5877 src/Makefile.DGUX => src/Makefiles/Makefile.dgux 5878 src/Makefile.RISCos => src/Makefiles/Makefile.UMIPS 5879 src/Makefile.SunOS.4.0.3 => src/Makefiles/Makefile.SunOS.4.0 5880 OBSOLETED FILES: 5881 cf/cf/cogsci.mc 5882 cf/cf/cs-exposed.mc 5883 cf/cf/cs-hidden.mc 5884 cf/cf/hpux-cs-hidden.mc 5885 cf/cf/knecht.mc 5886 cf/cf/osf1-cs-hidden.mc 5887 cf/cf/sunos3.5-cs-exposed.mc 5888 cf/cf/sunos3.5-cs-hidden.mc 5889 cf/cf/sunos4.1-cs-hidden.mc 5890 cf/cf/ultrix4.1-cs-hidden.mc 5891 cf/domain/cs-hidden.m4 5892 contrib/rcpt-streaming 5893 src/Makefiles/Makefile.SunOS.5.x 5894 58958.6.13/8.6.12 1996/01/25 5896 SECURITY: In some cases it was still possible for an attacker to 5897 insert newlines into a queue file, thus allowing access to 5898 any user (except root). 5899 CONFIG: no changes -- it is not a bug that the configuration 5900 version number is unchanged. 5901 59028.6.12/8.6.12 1995/03/28 5903 Fix to IDENT code (it was getting the size of the reply buffer 5904 too small, so nothing was ever accepted). Fix from several 5905 people, including Allan Johannesen, Shane Castle of the 5906 Boulder County Information Services, and Jeff Smith of 5907 Warwick University (all arrived within a few hours of 5908 each other!). 5909 Fix a problem that could cause large jobs to run out of 5910 file descriptors on systems that use vfork() rather 5911 than fork(). 5912 59138.6.11/8.6.11 1995/03/08 5914 The ``possible attack'' message would be logged more often 5915 than necessary if you are using Pine as a user agent. 5916 The wrong host would be reported in the ``possible attack'' 5917 message when attempted from IDENT. 5918 In some cases the syslog buffer could be overflowed when 5919 reporting the ``possible attack'' message. This can 5920 cause denial of service attacks. Truncate the message 5921 to 80 characters to prevent this problem. 5922 When reading the IDENT response a loop is needed around the 5923 read from the network to ensure that you don't get 5924 partial lines. 5925 Password entries without any shell listed (that is, a null 5926 shell) wouldn't match as "ok". Problem noted by 5927 Rob McMahon. 5928 When running BIND 4.9.x a problem could occur because the 5929 _res.options field is initialized differently than it 5930 was historically -- this requires that sendmail call 5931 res_init before it tweaks any bits. 5932 Fix an incompatibility in openxscript() between the file open mode 5933 and the stdio mode passed to fdopen. This caused UnixWare 5934 2.0 to have conniptions. Fix from Martin Sohnius of 5935 Novell Labs Europe. 5936 Fix problem with static linking of local getopt routine when 5937 using GNU's ld command. Fix from John Kennedy of 5938 Cal State Chico. 5939 It was possible to turn off privacy flags. Problem noted by 5940 *Hobbit*. 5941 Be more paranoid about writing files. Suggestions by *Hobbit* 5942 and Liudvikas Bukys. 5943 MAKEMAP: fixes for 64 bit machines (DEC Alphas in particular) 5944 from Spider Boardman. 5945 CONFIG: No changes (version number only, to keep it in sync 5946 with the binaries). 5947 59488.6.10/8.6.10 1995/02/10 5949 SECURITY: Diagnose bogus values to some command line flags that 5950 could allow trash to get into headers and qf files. 5951 Validate the name of the user returned by the IDENT protocol. 5952 Some systems that really dislike IDENT send intentionally 5953 bogus information. Problem pointed out by Michael Bushnell 5954 of the Free Software Foundation. Has some security 5955 implications. 5956 Fix a problem causing error messages about DNS problems when 5957 the host name contained a percent sign to act oddly 5958 because it was passed as a printf-style format string. 5959 In some cases this could cause core dumps. 5960 Avoid possible buffer overrun in returntosender() if error 5961 message is quite long. From Fletcher Mattox of the 5962 University of Texas. 5963 Fix a problem that would silently drop "too many hops" error 5964 messages if and only if you were sending to an alias. 5965 From Jon Giltner of the University of Colorado and 5966 Dan Harton of Oak Ridge National Laboratory. 5967 Fix a bug that caused core dumps on some systems if -d11.2 was 5968 set and e->e_message was null. Fix from Bruce Nagel of 5969 Data General. 5970 Fix problem that can still cause df files to be left around 5971 after "hop count exceeded" messages. Fix from Andrew 5972 Chang and Shau-Ping Lo of SunSoft. 5973 Fix a problem that can cause buffer overflows on very long 5974 user names (as might occur if you piped to a program 5975 with a lot of arguments). 5976 Avoid returning an error and re-queueing if the host signature 5977 is null; this can occur on addresses like ``user@.''. 5978 Problem noted by Wesley Craig and the University of 5979 Michigan. 5980 Avoid possible calls to malloc(0) if MCI caching is turned 5981 off. Bug fix from Pierre David of the Laboratoire 5982 Parallelisme, Reseaux, Systemes et Modelisation (PRiSM), 5983 Universite de Versailles - St Quentin, and Jacky 5984 Thibault. 5985 Make a local copy of the line being sent via senttolist() -- in 5986 some cases, buffers could get trashed by map lookups 5987 causing it to do unexpected things. This also simplifies 5988 some of the map code. 5989 CONFIG: No changes (version number only, to keep it in sync 5990 with the binaries). 5991 59928.6.9/8.6.9 1994/04/19 5993 Do all mail delivery completely disconnected from any terminal. 5994 This provides consistency with daemon delivery and 5995 may have some security implications. 5996 Make sure that malloc doesn't get called with zero size, 5997 since that fails on some systems. Reported by Ed 5998 Hill of the University of Iowa. 5999 Fix multi-line values for $e (SMTP greeting message). Reported 6000 by Mike O'Connor of Ford Motor Company. 6001 Avoid syserr if no NIS domain name is defined, but the map it 6002 is trying to open is optional. From Win Bent of USC. 6003 Changes for picky compilers from Ed Gould of Digital Equipment. 6004 Hesiod support for UDB from Todd Miller of the University of 6005 Colorado. Use "hesiod" as the service name in the U 6006 option. 6007 Fix a problem that failed to set the "authentic" host name (that 6008 is, the one derived from the socket info) if you called 6009 sendmail -bs from inetd. Based on code contributed by 6010 Todd Miller (this problem was also reported by Guy Helmer 6011 of Dakota State University). This also fixes a related 6012 problem reported by Liudvikas Bukys of the University of 6013 Rochester. 6014 Parameterize "nroff -h" in all the Makefiles so people with 6015 variant versions can use them easily. Suggested by 6016 Peter Collinson of Hillside Systems. 6017 SMTP "MAIL" commands with multiple ESMTP parameters required two 6018 spaces between parameters instead of one. Reported by 6019 Valdis Kletnieks of Virginia Tech. 6020 Reduce the number of system calls during message collection by 6021 using global timeouts around the collect() loop. This 6022 code was contributed by Eric Wassenaar. 6023 If the initial hostname name gathering results in a name 6024 without a dot (usually caused by NIS misconfiguration) 6025 and BIND is compiled in, directly access DNS to get 6026 the canonical name. This should make life easier for 6027 Solaris systems. If it still can't be resolved, and 6028 if the name server is listed as "required", try again 6029 in 30 seconds. If that also fails, exit immediately to 6030 avoid bogus "config error: mail loops back to myself" 6031 messages. 6032 Improve the "MAIL DELETED BECAUSE OF LACK OF DISK SPACE" error 6033 message to explain how much space was available and 6034 sound a bit less threatening. Suggested by Stan Janet 6035 of the National Institute of Standards and Technology. 6036 If mail is delivered to an alias that has an owner, deliver any 6037 requested return-receipt immediately, and strip the 6038 Return-Receipt-To: header from the subsequent message. 6039 This prevents a certain class of denial of service 6040 attack, arguably gives more reasonable semantics, and 6041 moves things more towards what will probably become a 6042 network standard. Suggested by Christopher Davis of 6043 Kapor Enterprises. 6044 Add a "noreceipts" privacy flag to turn off all return receipts 6045 without recompiling. 6046 Avoid printing ESMTP parameters as part of the error message 6047 if there are errors during parsing. This change is 6048 purely cosmetic. 6049 Avoid sending out error messages during the collect phase of 6050 SMTP; there is an MVS mailer from UCLA that gets 6051 confused by this. Of course, I think it's their bug.... 6052 Check for the $j macro getting undefined, losing a dot, or getting 6053 lost from $=w in the daemon before accepting a connection; 6054 if it is, it dumps state, prints a LOG_ALERT message, 6055 and drops core for debugging. This is an attempt to 6056 track down a bug that I thought was long since gone. 6057 If you see this, please forward the log fragment to 6058 sendmail@sendmail.ORG. 6059 Change OLD_NEWDB from a #ifdef to a #if so it can be turned off 6060 with -DOLD_NEWDB=0 on the command line. From Christophe 6061 Wolfhugel. 6062 Instead of trying to truncate the listen queue for the server 6063 SMTP port when the load average is too high, just close 6064 the port completely and reopen it later as needed. 6065 This ensures that the other end gets a quick "connection 6066 refused" response, and that the connection can be 6067 recovered later. In particular, some socket emulations 6068 seem to get confused if you tweak the listen queue 6069 size around and can never start listening to connections 6070 again. The down side is that someone could start up 6071 another daemon process in the interim, so you could 6072 have multiple daemons all not listening to connections; 6073 this could in turn cause the sendmail.pid file to be 6074 incorrect. A better approach might be to accept the 6075 connection and give a 421 code, but that could break 6076 other mailers in mysterious ways and have paging behavior 6077 implications. 6078 Fix a glitch in TCP-level debugging that caused flag 16.101 to 6079 set debugging on the wrong socket. From Eric Wassenaar. 6080 When creating a df* temporary file, be sure you truncate any 6081 existing data in the file -- otherwise system crashes 6082 and the like could result in extra data being sent. 6083 DOC: Replace the CHANGES-R5-R8 readme file with a paper in the 6084 doc directory. This includes some additional 6085 information. 6086 CONFIG: change UUCP rules to never add $U! or $k! on the front 6087 of recipient envelope addresses. This should have been 6088 handled by the $&h trick, but broke if people were 6089 mixing domainized and UUCP addresses. They should 6090 probably have converted all the way over to uucp-uudom 6091 instead of uucp-{new,old}, but the failure mode was to 6092 loop the mail, which was bad news. 6093 Portability fixes: 6094 Newer BSDI systems (several people). 6095 Older BSDI systems from Christophe Wolfhugel. 6096 Intergraph CLIX, from Paul Southworth of CICNet. 6097 UnixWare, from Evan Champion. 6098 NetBSD from Adam Glass. 6099 Solaris from Quentin Campbell of the University of 6100 Newcastle upon Tyne. 6101 IRIX from Dean Cookson and Bill Driscoll of Mitre 6102 Corporation. 6103 NCR 3000 from Kevin Darcy of Chrysler Financial Corporation. 6104 SunOS (it has setsid() and setvbuf() calls) from 6105 Jonathan Kamens of OpenVision Technologies. 6106 HP-UX from Tor Lillqvist. 6107 New Files: 6108 src/Makefile.CLIX 6109 src/Makefile.NCR3000 6110 doc/changes/Makefile 6111 doc/changes/changes.me 6112 doc/changes/changes.ps 6113 61148.6.8/8.6.6 1994/03/21 6115 SECURITY: it was possible to read any file as root using the 6116 E (error message) option. Reported by Richard Jones; 6117 fixed by Michael Corrigan and Christophe Wolfhugel. 6118 61198.6.7/8.6.6 1994/03/14 6120 SECURITY: it was possible to get root access by using weird 6121 values to the -d flag. Thanks to Alain Durand of 6122 INRIA for forwarding me the notice from the bugtraq 6123 list. 6124 61258.6.6/8.6.6 1994/03/13 6126 SECURITY: the ability to give files away on System V-based 6127 systems proved dangerous -- don't run as the owner 6128 of a :include: file on a system that allows giveaways. 6129 Unfortunately, this also applies to determining a 6130 valid shell. 6131 IMPORTANT: Previous versions weren't expiring old connections 6132 in the connection cache for a long time under some 6133 circumstances. This could result in resource exhaustion, 6134 both at your end and at the other end. This checks the 6135 connections for timeouts much more frequently. From 6136 Doug Anderson of NCSC. 6137 Fix a glitch that snuck in that caused programs to be run as 6138 the sender instead of the recipient if the mail was 6139 from a local user to another local user. From 6140 Motonori Nakamura of Kyoto University. 6141 Fix "wildcard" on /etc/shells matching -- instead of looking 6142 for "*", look for "/SENDMAIL/ANY/SHELL/". From 6143 Bryan Costales of ICSI. 6144 Change the method used to declare the "statfs" availability; 6145 instead of HASSTATFS and/or HASUSTAT with a ton of 6146 tweaking in conf.c, there is a single #define called 6147 SFS_TYPE which takes on one of six values (SFS_NONE 6148 for no statfs availability, SFS_USTAT for the ustat(2) 6149 syscall, SFS_4ARGS for a four argument statfs(2) call, 6150 and SFS_VFS, SFS_MOUNT, or SFS_STATFS for a two argument 6151 statfs(2) call with the declarations in <sys/vfs.h>, 6152 <sys/mount.h>, or <sys/statfs.h> respectively). 6153 Fix glitch in NetInfo support that could return garbage if 6154 there was no "/locations/sendmail" property. From 6155 David Meyer of the University of Virginia. 6156 Change HASFLOCK from defined/not-defined to a 0/1 definition 6157 to allow Linux to turn it off even though it is a 6158 BSD-like system. 6159 Allow setting of "ident" timeout to zero to turn off the ident 6160 protocol entirely. 6161 Make 7-bit stripping local to a connection (instead of to a 6162 mailer); this allows you to specify that SMTP is a 6163 7-bit channel, but revert to 8-bit should it advertise 6164 that it supports 8BITMIME. You still have to specify 6165 mailer flag 7 to get this stripping at all. 6166 Improve makesendmail script so it handles more cases automatically. 6167 Tighten up restrictions on taking ownership of :include: files 6168 to avoid problems on systems that allow you to give away 6169 files. 6170 Fix a problem that made it impossible to rebuild the alias 6171 file if it was on a read-only file system. From 6172 Harry Edmon of the University of Washington. 6173 Improve MX randomization function. From John Gardiner Myers 6174 of CMU. 6175 Fix a minor glitch causing a bogus message to be printed (used 6176 %s instead of %d in a printf string for the line number) 6177 when a bad queue file was read. From Harry Edmon. 6178 Allow $s to remain NULL on locally generated mail. I'm not 6179 sure this is necessary, but a lot of people have complained 6180 about it, and there is a legitimate question as to whether 6181 "localhost" is legal as an 822-style domain. 6182 Fix a problem with very short line lengths (mailer L= flag) in 6183 headers. This causes a leading space to be added onto 6184 continuation lines (including in the body!), and also 6185 tries to wrap headers containing addresses (From:, To:, 6186 etc) intelligently at the shorter line lengths. Problem 6187 Reported by Lars-Johan Liman of SUNET Operations Center. 6188 Log the real user name when logging syserrs, since these can have 6189 security implications. Suggested by several people. 6190 Fix address logging of cached connections -- it used to always 6191 log the numeric address as zero. This is a somewhat 6192 bogus implementation in that it does an extra system 6193 call, but it should be an inexpensive one. Fix from 6194 Motonori Nakamura. 6195 Tighten up handling of short syslog buffers even more -- there 6196 were cases where the outgoing relay= name was too long 6197 to share a line with delay= and mailer= logging. 6198 Limit the overhead on split envelopes to one open file descriptor 6199 per envelope -- previously the overhead was three 6200 descriptors. This was in response to a problem reported 6201 by P{r (Pell) Emanuelsson. 6202 Fixes to better handle the case of unexpected connection closes; 6203 this redirects the output to the transcript so the info 6204 is not lost. From Eric Wassenaar. 6205 Fix potential string overrun if you macro evaluate a string that 6206 has a naked $ at the end. Problem noted by James Matheson 6207 <jmrm@eng.cam.ac.uk>. 6208 Make default error number on $#error messages 553 (``Requested 6209 action not taken: mailbox name not allowed'') instead of 6210 501 (``Syntax error in parameters or arguments'') to 6211 avoid bogus "protocol error" messages. 6212 Strip off any existing trailing dot on names during $[ ... $] 6213 lookup. This prevents it from ending up with two dots 6214 on the end of dot terminated names. From Wesley Craig 6215 of the University of Michigan and Bryan Costales of ICSI. 6216 Clean up file class reading so that the debugging information is 6217 more informative. It hadn't been using setclass, so you 6218 didn't see the class items being added. 6219 Avoid core dump if you are running a version of sendmail where 6220 NIS is compiled in, and you specify an NIS map, but 6221 NIS is not running. Fix from John Oleynick of 6222 Rutgers. 6223 Diagnose bizarre case where res_search returns a failure value, 6224 but sets h_errno to a success value. 6225 Make sure that "too many hops" messages are considered important 6226 enough to send an error to the Postmaster (that is, the 6227 address specified in the P option). This fix should 6228 help problems that cause the df file to be left around 6229 sometimes -- unfortunately, I can't seem to reproduce 6230 the problem myself. 6231 Avoid core dump (null pointer reference) on EXPN command; this 6232 only occurred if your log level was set to 10 or higher 6233 and the target account was an alias or had a .forward file. 6234 Problem noted by Janne Himanka. 6235 Avoid "denial of service" attacks by someone who is flooding your 6236 SMTP port with bad commands by shutting the connection 6237 after 25 bad commands are issued. From Kyle Jones of 6238 UUNET. 6239 Fix core dump on error messages with very long "to" buffers; 6240 fmtmsg overflows the message buffer. Fixed by trimming 6241 the to address to 203 characters. Problem reported by 6242 John Oleynick. 6243 Fix configuration for HASFLOCK -- there were some spots where 6244 a #ifndef was incorrectly #ifdef. Pointed out by 6245 George Baltz of the University of Maryland. 6246 Fix a typo in savemail() that could cause the error message To: 6247 lists to be incorrect in some places. From Motonori 6248 Nakamura. 6249 Fix a glitch that can cause duplicate error messages on split 6250 envelopes where an address on one of the lists has a 6251 name server failure. Fix from Voradesh Yenbut of the 6252 University of Washington. 6253 Fix possible bogus pointer reference on ESMTP parameters that 6254 don't have an ``=value'' part. 6255 CNAME loops caused an error message to be generated, but also 6256 re-queued the message. Changed to just re-queue the 6257 message (it's really hard to just bounce it because 6258 of the weird way the name server works in the presence 6259 of CNAME loops). Problem noted by James M.R.Matheson 6260 of Cambridge University. 6261 Avoid giving ``warning: foo owned process doing -bs'' messages 6262 if they use ``MAIL FROM:<foo>'' where foo is their true 6263 user name. Suggested by Andreas Stolcke of ICSI. 6264 Change the NAMED_BIND compile flag to be a 0/1 flag so you can 6265 override it easily in the Makefile -- that is, you can 6266 turn it off using -DNAMED_BIND=0. 6267 If a gethostbyname(...) of an address with a trailing dot fails, 6268 try it without the trailing dot. This is because if 6269 you have a version of gethostbyname() that falls back 6270 to NIS or the /etc/hosts file it will fail to find 6271 perfectly reasonable names that just don't happen to 6272 be dot terminated in the hosts file. You don't want to 6273 strip the dot first though because we're trying to ensure 6274 that country names that match one of your subdomains get 6275 a chance. 6276 PRALIASES: fix bogus output on non-null-terminated strings. 6277 From Bill Gianopoulos of Raytheon. 6278 CONFIG: Avoid rewriting anything that matches $w to be $j. 6279 This was in code intended to only catch the self-literal 6280 address (that is, [1.2.3.4], where 1.2.3.4 is your 6281 IP address), but the code was broken. However, it will 6282 still do this if $M is defined; this is necessary to 6283 get client configurations to work (sigh). Note that this 6284 means that $M overrides :mailname entries in the user 6285 database! Problem noted by Paul Southworth. 6286 CONFIG: Fix definition of Solaris help file location. From 6287 Steve Cliffe <steve@gorgon.cs.uow.edu.au>. 6288 CONFIG: Fix bug that broke news.group.USENET mappings. 6289 CONFIG: Allow declaration of SMTP_MAILER_MAX, FAX_MAILER_MAX, 6290 and USENET_MAILER_MAX to tweak the maximum message 6291 size for various mailers. 6292 CONFIG: Change definition of USENET_MAILER_ARGS to include argv[0] 6293 instead of assuming that it is "inews" for consistency 6294 with other mailers. From Michael Corrigan of UC San Diego. 6295 CONFIG: When mail is forwarded to a LOCAL_RELAY or a MAIL_HUB, 6296 qualify the address in the SMTP envelope as user@{relay|hub} 6297 instead of user@$j. From Bill Wisner of The Well. 6298 CONFIG: Fix route-addr syntax in nullrelay configuration set. 6299 CONFIG: Don't turn off case mapping of user names in the local 6300 mailer for IRIX. This was different than most every other 6301 system. 6302 CONFIG: Avoid infinite loops on certainly list:; syntaxes in 6303 envelope. Noted by Thierry Besancon 6304 <besancon@excalibur.ens.fr>. 6305 CONFIG: Don't include -z by default on uux line -- most systems 6306 don't want it set by default. Pointed out by Philippe 6307 Michel of Thomson CSF. 6308 CONFIG: Fix some bugs with mailertables -- for example, if your 6309 host name was foo.bar.ray.com and you matched against 6310 ".ray.com", the old implementation bound %1 to "bar" 6311 instead of "foo.bar". Also, allow "." in the mailertable 6312 to match anything -- essentially, take over SMART_HOST. 6313 This also moves matching of explicit local host names 6314 before the mailertable so they don't have to be special 6315 cased in the mailertable data. Reported by Bill 6316 Gianopoulos of Raytheon; the fix for the %1 binding 6317 problem was contributed by Nicholas Comanos of the 6318 University of Sydney. 6319 CONFIG: Don't include "root" in class $=L (users to deliver 6320 locally, even if a hub or relay exists) by default. 6321 This is because of the known bug where definition of 6322 both a LOCAL_RELAY and a MAIL_HUB causes $=L to ignore 6323 both and deliver into the local mailbox. 6324 CONFIG: Move up bitdomain and uudomain handling so that they 6325 are done before .UUCP class matching; uudomain was 6326 reported as ineffective before. This also frees up 6327 diversion 8 for future use. Problem reported by Kimmo 6328 Suominen. 6329 CONFIG: Don't try to convert dotted IP address (e.g., [1.2.3.4]) 6330 into host names. As pointed out by Jonathan Kamens, 6331 these are often used because either the forward or reverse 6332 mapping is broken; this translation makes it broken again. 6333 DOC: Clarify $@ and $: in the Install & Op Guide. From Kimmo 6334 Suominen. 6335 Portability fixes: 6336 Unicos from David L. Kensiski of Sterling Software. 6337 DomainOS from Don Lewis of Silicon Systems. 6338 GNU m4 1.0.3 from Karst Koymans of Utrecht University. 6339 Convex from Kimmo Suominen <kim@tac.nyc.ny.us>. 6340 NetBSD from Adam Glass <glass@sun-lamp.cs.berkeley.edu>. 6341 BSD/386 from Tony Sanders of BSDI. 6342 Apollo from Eric Wassenaar. 6343 DGUX from Doug Anderson. 6344 Sequent DYNIX/ptx 2.0 from Tim Wright of Sequent. 6345 NEW FILES: 6346 src/Makefile.DomainOS 6347 src/Makefile.PTX 6348 src/Makefile.SunOS.5.1 6349 src/Makefile.SunOS.5.2 6350 src/Makefile.SunOS.5.x 6351 src/mailq.1 6352 cf/ostype/domainos.m4 6353 doc/op/Makefile 6354 doc/intro/Makefile 6355 doc/usenix/Makefile 6356 63578.6.5/8.6.5 1994/01/13 6358 Security fix: /.forward could be owned by anyone (the test 6359 to allow root to own any file was backwards). From 6360 Bob Campbell at U.C. Berkeley. 6361 Security fix: group ids were not completely set when programs 6362 were invoked. This caused programs to have group 6363 permissions they should not have had (usually group 6364 daemon instead of their own group). In particular, 6365 Perl scripts would refuse to run. 6366 Security: check to make sure files that are written are not 6367 symbolic links (at least under some circumstances). 6368 Although this does not respond to a specific known 6369 attack, it's just a good idea. Suggested by 6370 Christian Wettergren. 6371 Security fix: if a user had an NFS mounted home directory on 6372 a system with a restricted shell listed in their 6373 /etc/passwd entry, they could still execute any 6374 program by putting that in their .forward file. 6375 This fix prevents that by insisting that their shell 6376 appear in /etc/shells before allowing a .forward to 6377 execute a program or write a file. You can disable 6378 this by putting "*" in /etc/shells. It also won't 6379 permit world-writable :include: files to reference 6380 programs or files (there's no way to disable this). 6381 These behaviors are only one level deep -- for 6382 example, it is legal for a world-writable :include: 6383 file to reference an alias that writes a file, on 6384 the assumption that the alias file is well controlled. 6385 Security fix: root was not treated suspiciously enough when 6386 looking into subdirectories. This would potentially 6387 allow a cracker to examine files that were publicly 6388 readable but in a non-publicly searchable directory. 6389 Fix a problem that causes an error on QUIT on a cached 6390 connection to create problems on the current job. 6391 These are typically unrelated, so errors occur in 6392 the wrong place. 6393 Reset CurrentLA in sendall() -- this makes sendmail queue 6394 runs more responsive to load average, and fixes a 6395 problem that ignored the load average in locally 6396 generated mail. From Eric Wassenaar. 6397 Fix possible core dump on aliases with null LHS. From 6398 John Orthoefer of BB&N. 6399 Revert to using flock() whenever possible -- there are just 6400 too many bugs in fcntl() locking, particularly over 6401 NFS, that cause sendmail to fail in perverse ways. 6402 Fix a bug that causes the connection cache to get confused 6403 when sending error messages. This resulted in 6404 "unexpected close" messages. It should fix itself 6405 on the following queue run. Problem noted by 6406 Liudvikas Bukys of the University of Rochester. 6407 Include $k in $=k as documented in the Install & Op Guide. 6408 This seems odd, but it was documented.... From 6409 Michael Corrigan of UCSD. 6410 Fix problem that caused :include:s from alias files to be 6411 forced to be owned by root instead of daemon 6412 (actually DefUid). From Tim Irvin. 6413 Diagnose unrecognized I option values -- from Mortin Forssen 6414 of the Chalmers University of Technology. 6415 Make "error" mailer work consistently when there is no error 6416 code associated with it -- previously it returned OK 6417 even though there was a real problem. Now it assumes 6418 EX_UNAVAILABLE. 6419 Fix bug that caused the last header line of messages that had 6420 no body and which were terminated with EOF instead of 6421 "." to be discarded. Problem noted by Liudvikas Bukys. 6422 Fix core dump on SMTP mail to programs that failed -- it tried 6423 to go to a "next MX host" when none existed, causing 6424 a core dump. From der Mouse at McGill University. 6425 Change IDENTPROTO from a defined/not defined to a 0/1 switch; 6426 this makes it easier to turn it off (using 6427 -DIDENTPROTO=0 in the Makefile). From der Mouse. 6428 Fix YP_MASTER_NAME store to use the unupdated result of 6429 gethostname() (instead of myhostname(), which tries 6430 to fully qualify the name) to be consistent with 6431 SunOS. If your hostname is unqualified, this fixes 6432 transfers to slave servers. Bug noted by Keith 6433 McMillan of Ameritech Services, Inc. 6434 Fix Ultrix problem: gethostbyname() can return a very large 6435 (> 500) h_length field, which causes the sockaddr 6436 to be trashed. Use the size of the sockaddr instead. 6437 Fix from Bob Manson of Ohio State. 6438 Don't assume "-a." on host lookups if NAMED_BIND is not 6439 defined -- this confuses gethostbyname on hosts 6440 file lookups, which doesn't understand the trailing 6441 dot convention. 6442 Log SMTP server subprocesses that die with a signal instead 6443 of from a clean exit. 6444 If you don't have option "I" set, don't assume that a DNS 6445 "host unknown" message is authoritative -- it 6446 might still be found in /etc/hosts. 6447 Fix a problem that would cause Deferred: messages to be sent 6448 as the subject of an error message, even though the 6449 actual cause of a message was more severe than that. 6450 Problem noted by Chris Seabrook of OSSI. 6451 Fix race condition in DBM alias file locking. From Kyle 6452 Jones of UUNET. 6453 Limit delivery syslog line length to avoid bugs in some 6454 versions of syslog(3). This adds a new compile time 6455 variable SYSLOG_BUFSIZE. From Jay Plett of Princeton 6456 University, which is in turn derived from IDA. 6457 Fix quotes inside of comments in addresses -- previously 6458 it insisted that they be balanced, but the 822 spec 6459 says that they should be ignored. 6460 Dump open file state to syslog upon receiving SIGUSR1 (for 6461 debugging). This also evaluates ruleset 89, if set 6462 (with the null input), and logs the result. This 6463 should be used sparingly, since the rewrite process 6464 is not reentrant. 6465 Change -qI, -qR, and -qS flags to be case-insensitive as 6466 documented in the Bat Book. 6467 If the mailer returned EX_IOERR or EX_OSERR, sendmail did not 6468 return an error message and did not requeue the message. 6469 Fix based on code from Roland Dirlewanger of 6470 Reseau Regional Aquarel, Bordeaux, France. 6471 Fix a problem that caused a seg fault if you got a 421 error 6472 code during some parts of connection initialization. 6473 I've only seen this when talking to buggy mailers on 6474 the other end, but it shouldn't give a seg fault in 6475 any case. From Amir Plivatsky. 6476 Fix core dump caused by a ruleset call that returns null. 6477 Fix from Bryan Costales of ICSI. 6478 Full-Name: field was being ignored. Fix from Motonori Nakamura 6479 of Kyoto University. 6480 Fix a possible problem with very long input lines in setproctitle. 6481 From P{r Emanuelsson. 6482 Avoid putting "This is a warning message" out on return receipts. 6483 Suggested by Douglas Anderson. 6484 Detect loops caused by recursive ruleset calls. Suggested by 6485 Bryan Costales. 6486 Initialize non-alias maps during alias rebuilds -- they may be 6487 needed for parsing. Problem noted by Douglas Anderson. 6488 Log sender address even if no message was collected in SMTP 6489 (e.g., if all RCPTs failed). Suggested by Motonori 6490 Nakamura. 6491 Don't reflect the owner-list contents into the envelope sender 6492 address if the value contains ", :, /, or | (to avoid 6493 illegal addresses appearing there). 6494 Efficiency hack for toktype macro -- from Craig Partridge of 6495 BB&N. 6496 Clean up DNS error printing so that a host name is always 6497 included. 6498 Remember to set $i during queue runs. Reported by Stephen 6499 Campbell of Dartmouth University. 6500 If the environment variable HOSTALIASES is set, use it during 6501 canonification as the name of a file with per-user host 6502 translations so that headers are properly mapped. Reported 6503 by Anne Bennett of Concordia University. 6504 Avoid printing misleading error message if SMTP mailer (not 6505 using [IPC]) should die on a core dump. 6506 Avoid incorrect diagnosis of "file 1 closed" when it is caused 6507 by the other end closing the connection. From 6508 Dave Morrison of Oracle. 6509 Improve several of the error messages printed by "mailq" 6510 to include a host name or other useful information. 6511 Add NetInfo preliminary support for NeXT systems. From Vince 6512 DeMarco. 6513 Fix a glitch that sometimes caused :include:s that pointed to 6514 NFS filesystems that were down to give an "aliasing/ 6515 forwarding loop broken" message instead of queueing 6516 the message for retry. Noted by William C Fenner of 6517 the NRL Connection Machine Facility. 6518 Fix a problem that could cause a core dump if the input sequence 6519 had (or somehow acquired) a \231 character. 6520 Make sure that route-addrs always have <angle brackets> around 6521 them in non-SMTP envelopes (SMTP envelopes already do 6522 this properly). 6523 Avoid weird headers on unbalanced punctuation of the form: 6524 ``Joe User <user)'' -- this caused reference to the 6525 null macro. Fix from Rick McCarty of IO.COM. 6526 Fix a problem that caused an alias "user: user@local.host" to 6527 not have the QNOTREMOTE bit set; this caused configs 6528 to act as if FEATURE(notsticky) was defined even when 6529 it was not. The effect of the problem was to make it 6530 very hard to to set up satellite sites that had a few 6531 local accounts, with everything else forwarded to a 6532 corporate hub. Reported by Detlef Drewanz of the 6533 University of Rostock and Mark Frost of NCD. 6534 Change queuing to not call rulesets 3, {1 or 2}, 4 on header 6535 addresses. This is more efficient (fewer name server 6536 calls) and fixes certain unusual configurations, such 6537 as those that have ruleset 4 do something that is 6538 non-idempotent unless a mailer-specific ruleset did 6539 something else. Problem reported by Brian J. Coan 6540 of the Institute for Global Communications. 6541 Fix the "obsolete argument" routine in main to better understand 6542 new arguments. For example, if you used ``sendmail 6543 -C config -v -q'' it would choke on the -q because 6544 the -C would stop looking for old-format arguments. 6545 Fix the code that was intended to allow two users to forward their 6546 mail to the same program and have them appear unique. 6547 Portability fixes for: 6548 SCO UNIX from Murray Kucherawy. 6549 SCO Open Server 3.2v4 from Philippe Brand. 6550 System V Release 4 from Rick Ellis and others. 6551 OSF/1 from Steve Campbell. 6552 DG/UX from Ben Mesander of the USGS and Bryan Curnutt 6553 of Stoner Associates. 6554 Motorola SysV88 from Kevin Johnson of Motorola. 6555 Solaris 2.3 from Casper H.S. Dik of the University 6556 of Amsterdam and John Caruso of University 6557 of Maryland. 6558 FreeBSD from Ollivier Robert. 6559 NetBSD from Adam Glass. 6560 TitanOS from Kate Hedstrom of Rutgers University. 6561 Irix from Bryan Curnutt. 6562 Dynix from Jim Davis of the University of Arizona. 6563 RISC/os. 6564 Linux from John Kennedy of California State University 6565 at Chico. 6566 Solaris 2.x from Tony Boner of the U.S. Air Force. 6567 NEXTSTEP 3.x from Vince DeMarco. 6568 HP-UX from various people. NOTA BENE: the location 6569 of the config file has moved to /usr/lib 6570 to match the HP-UX version of sendmail. 6571 CONFIG: Don't do any recipient rewriting on relay mailer; 6572 since this is intended only for internal use, the 6573 usual RFC 821/822/1123 rules can be relaxed. The 6574 main point of this is to avoid munging (ugh) UUCP 6575 addresses when relaying internally. 6576 CONFIG: fix typo in mailer/uucp.m4 that mutilates list:; 6577 syntax addresses delivered via UUCP. Solution 6578 provided by Peter Wemm. 6579 CONFIG: fix thumb-fumble in default UUCP relaying in ruleset 6580 zero; it caused double @ signs in addresses. From 6581 Irving Reid of the University of Toronto. 6582 CONFIG: Portability fixes for SCO Unix 3.2 with TCP/IP 1.2.1 6583 from Markku Toijala of ICL Personal Systems Oy. 6584 CONFIG: Add trailing "." on pseudo-domains for consistency; 6585 this fixes a problem (noted by Al Whaley of Sunnyside) 6586 that made it hard to recognize your own pseudodomain 6587 names. 6588 CONFIG: catch "@host" syntax errors (i.e., null local-parts) 6589 rather than letting them get "local configuration 6590 error"s. Problem noted by John Gardiner Myers. 6591 CONFIG: add uucp-uudom mailer variant, based on code posted 6592 by Spider Boardman <spider@Orb.Nashua.NH.US>; this 6593 has uucp-dom semantics but old UUCP syntax. This 6594 also permits "uucp-old" as an alias for "uucp" and 6595 "uucp-new" as a synonym for "suucp" for consistency. 6596 CONFIG: add POP mailer support (from Kimmo Suominen 6597 <kim@grendel.lut.fi>). 6598 CONFIG: drop CSNET_RELAY support -- CSNET is long gone. 6599 CONFIG: fix bug caused with domain literal addresses (e.g., 6600 ``[128.32.131.12]'') when FEATURE(allmasquerade) 6601 was set; it would get an additional @masquerade.host 6602 added to the address. Problem noted by Peter Wan 6603 of Georgia Tech. 6604 CONFIG: make sure that the local UUCP name is in $=w. From 6605 Jim Murray of Stratus. 6606 CONFIG: changes to UUCP rewriting to simulate IDA-style "V" 6607 mailer flag. Briefly, if you are sending to host 6608 "foo", then it rewrites "foo!...!baz" to "...!baz", 6609 "foo!baz" remains "foo!baz", and anything else has 6610 the local name prepended. 6611 CONFIG: portability fixes for HP-UX. 6612 DOC: several minor problems fixed in the Install & Op Guide. 6613 MAKEMAP: fix core dump problem on lines that are too long or 6614 which lack newline. From Mark Delany. 6615 MAILSTATS: print sums of columns (total messages & kbytes 6616 in and out of the system). From Tom Ferrin of UC 6617 San Francisco Computer Graphics Lab. 6618 SIGNIFICANT USER- OR SYSAD-VISIBLE CHANGES: 6619 On HP-UX, /etc/sendmail.cf has been moved to 6620 /usr/lib/sendmail.cf to match HP sendmail. 6621 Permissions have been tightened up on world-writable 6622 :include: files and accounts that have shells 6623 that are not listed in /etc/shells. This may 6624 cause some .forward files that have worked 6625 before to start failing. 6626 SIGUSR1 dumps some state to the log. 6627 NEW FILES: 6628 src/Makefile.DGUX 6629 src/Makefile.Dynix 6630 src/Makefile.FreeBSD 6631 src/Makefile.Mach386 6632 src/Makefile.NetBSD 6633 src/Makefile.RISCos 6634 src/Makefile.SCO 6635 src/Makefile.SVR4 6636 src/Makefile.Titan 6637 cf/mailer/pop.m4 6638 cf/ostype/bsdi1.0.m4 6639 cf/ostype/dgux.m4 6640 cf/ostype/dynix3.2.m4 6641 cf/ostype/sco3.2.m4 6642 makemap/Makefile.dist 6643 praliases/Makefile.dist 6644 66458.6.4/8.6.4 1993/10/31 6646 Repair core-dump problem (write to read-only memory segment) 6647 if you fall back to the return-to-Postmaster case in 6648 savemail. Problem reported by Richard Liu. 6649 Immediately diagnose bogus sender addresses in SMTP. This 6650 makes quite certain that crackers can't use this 6651 class of attack. 6652 Reliability Fix: check return value from fclose() and fsync() 6653 in a few critical places. 6654 Minor problem in initsys() that reversed a condition for 6655 redirecting the output channel on queue runs. It's 6656 not clear this code even does anything. From Eric 6657 Wassenaar of the Dutch National Institute for Nuclear 6658 and High-Energy Physics. 6659 Fix some problems that caused queue runs to do "too much work", 6660 such as double-reading the Errors-To: header. From 6661 Eric Wassenaar. 6662 Error messages on writing the temporary file (including the 6663 data file) were getting suppressed in SMTP -- this 6664 fix causes them to be properly reported. From Eric 6665 Wassenaar. 6666 Some changes to support AF_UNIX sockets -- this will only 6667 really become relevant in the next release, but some 6668 people need it for local patches. From Michael 6669 Corrigan of UC San Diego. 6670 Use dynamically allocated memory (instead of static buffers) 6671 for macros defined in initsys() and settime(); since 6672 these can have different values depending on which 6673 envelope they are in. From Eric Wassenaar. 6674 Improve logging to show ctladdr on to= logging; this tells you 6675 what uid/gid processes ran as. 6676 Fix a problem that caused error messages to be discarded if 6677 the sender address was unparseable for some reason; 6678 this was supposed to fall back to the "return to 6679 postmaster" case. 6680 Improve aliaswait backoff algorithm. 6681 Portability patches for Linux (8.6.3 required another header 6682 file) (from Karl London) and SCO UNIX. 6683 CONFIG: patch prog mailer to not strip host name off of envelope 6684 addresses (so that it matches local again). From 6685 Christopher Davis. 6686 CONFIG: change uucp-dom mailer so that "<>" translates to $n; 6687 this prevents uux from seeing lines with null names like 6688 ``From Sat Oct 30 14:55:31 1993''. From Motonori 6689 Nakamura of Kyoto University. 6690 CONFIG: handle <list:;> syntax correctly. This isn't legal, but 6691 it shouldn't fail miserably. From Motonori Nakamura. 6692 66938.6.2/8.6.2 1993/10/15 6694 Put a "successful delivery" message in the transcript for 6695 addresses that get return-receipts. 6696 Put a prominent "this is only a warning" message in warning 6697 messages -- some people don't read carefully enough 6698 and end up sending the message several times. 6699 Include reason for temporary failure in the "warning" return 6700 message. Currently, it just says "cannot send for 6701 four hours". 6702 Fix the "Original message received" time generated for 6703 returntosender messages. It was previously listed as 6704 the current time. Bug reported by Eric Hagberg of 6705 Cornell University Medical College. 6706 If there is an error when writing the body of a message, 6707 don't send the trailing dot and wait for a response 6708 in sender SMTP, as this could cause the connection to 6709 hang up under some bizarre circumstances. From Eric 6710 Wassenaar. 6711 Fix some server SMTP synchronization problems caused when 6712 connections fail during message collection. From 6713 Eric Wassenaar. 6714 Fix a problem that can cause srvrsmtp to reject mail if the 6715 name server is down -- it accepts the RCPT but rejects 6716 the DATA command. Problem reported by Jim Murray of 6717 Stratus. 6718 Fix a problem that can cause core dumps if the config file 6719 incorrectly resolves to a null hostname. Reported by 6720 Allan Johannesen of WPI. 6721 Non-root use of -C flag, dangerous -f flags, and use of -oQ 6722 by non-root users were not put into 6723 X-Authentication-Warning:s as intended because the 6724 config file hadn't set the PrivacyOptions yet. Fix 6725 from Sven-Ove Westberg of the University of Lulea. 6726 Under very odd circumstances, the alias file rebuild code 6727 could get confused as to whether a database was 6728 open or not. 6729 Check "vendor code" on the end of V lines -- this is 6730 intended to provide a hook for vendor-specific 6731 configuration syntax. (This is a "new feature", 6732 but I've made an exception to my rule in a belief 6733 that this is a highly exceptional case.) 6734 Portability fixes for DG/UX (from Douglas Anderson of NCSC), 6735 SCO Unix (from Murray Kucherawy), A/UX, and OSF/1 6736 (from Jon Forrest of UC Berkeley) 6737 CONFIG: fix ``mailer:host'' form of UUCP relay naming. 6738 67398.6.1/8.6 1993/10/08 6740 Portability fixes for A/UX and Encore UMAX V. 6741 Fix error message handling -- if you had a name server down 6742 causing an error during parsing, that message was never 6743 propagated to the queue file. 6744 67458.6/8.6 1993/10/05 6746 Configuration cleanup: make it easier to undo IDENTPROTO in 6747 conf.h (other systems have the same bug). 6748 If HASGETDTABLESIZE and _SC_OPEN_MAX are both defined, assume 6749 getdtablesize() instead of sysconf(); a disturbingly 6750 large number of systems defined _SC_OPEN_MAX in the 6751 header files but don't have the syscall. 6752 Another patch to really truly ignore MX records in getcanonname 6753 if trymx == FALSE. 6754 Fix problem that caused the "250 IAA25499 Message accepted for 6755 delivery" message to be omitted if there was an error 6756 in the header of the message (e.g., a bad Errors-To: 6757 line). Pointed out by Michael Corrigan of UCSD. 6758 Announce name of host we are chatting when we get errors; this 6759 is an IDA-ism suggested by Christophe Wolfhugel. 6760 Portability fixes for Alpha OSF/1 (from Anthony Baxter of the 6761 Australian Artificial Intelligence Institute), SCO Unix 6762 (from Murray Kucherawy of Hookup Communication Corp.), 6763 NeXT (from Vince DeMarco and myself), Linux (from 6764 Karl London <karl@borg.demon.co.uk>), BSDI (from 6765 Christophe Wolfhugel, and SVR4 on Dell (from Kimmo 6766 Suominen), AUX 3.0 on Macintosh, and ANSI C compilers. 6767 Some changes to get around gcc optimizer bugs. From Takahiro 6768 Kanbe. 6769 Fix error recovery in queueup if another tf file of the same 6770 name already exists. Problem stumbled over by Bill 6771 Wisner of The Well. 6772 Output YP_MASTER_NAME and YP_LAST_MODIFIED without null bytes. 6773 Problem noted by Keith McMillan of Ameritech Services. 6774 Deal with group permissions properly when opening .forward and 6775 :include: files. This relaxes the 8.1C restrictions 6776 slightly more. This includes proper setting of groups 6777 when reading :include: files, allowing you to read some 6778 files that you should be able to read but have previously 6779 been denied unless you owned them or they had "other" 6780 read permission. 6781 Make certain that $j is in $=w (after the .cf is read) so that 6782 if the user is forced to override some silly system, 6783 MX suppression will still work. 6784 Fix a couple of efficiency problems where newstr was double- 6785 calling expensive routines. In at least one case, it 6786 wasn't guaranteed that they would always return the 6787 same result. Problem noted by Christophe Wolfhugel. 6788 Fix null pointer dereference in putoutmsg -- only on an error 6789 condition from a non-SMTP mailer. From Motonori 6790 Nakamura. 6791 Macro expand "C" line class definitions before scanning so that 6792 "CX $Z" works. 6793 Fix problem that caused error message to be sent while still 6794 trying to send the original message if the connection 6795 is closed during a DATA command after getting an error 6796 on an RCPT command (pretty obscure). Problem reported 6797 by John Myers of CMU. 6798 Fix reply to NOOP to be 250 instead of 200 -- this is a long 6799 term bug. 6800 Fix a nasty bug causing core dumps when returning the "warning: 6801 cannot deliver for N hours -- will keep trying" message; 6802 it only occurred if you had PostmasterCopy set and 6803 only on some architectures. Although sendmail would 6804 keep trying, it would send error messages on each 6805 queue interval. This is an important fix. 6806 Allow u and g options to take user and group names respectively. 6807 Don't do a chdir into the queue directory in -bt mode to make 6808 ruleset testing a bit easier. 6809 Don't allow users to turn off logging (using -oL) on the command 6810 line -- command line can only raise, not lower, logging 6811 level. 6812 Set $u to the original recipient on the SMTP transaction or on 6813 the command line. This is only done if there is exactly 6814 one recipient. Technically, this does not meet the 6815 specs, because it does not guarantee a domain on the 6816 address. 6817 Fix a problem that dumped error messages on bad addresses if 6818 you used the -t flag. Problem noted by Josh Smith of 6819 Harvey Mudd College. 6820 Given an address such as ``<foo> <bar>'', auto-quote the first 6821 ``<foo>'' part, giving ``"<foo>" <bar>''. This is to 6822 avoid the problem of people who use angle brackets in 6823 their full name information. 6824 Fix a null pointer dereference if you set option "l", have 6825 an Errors-To: header in the message, and have Errors-To: 6826 defined in the config file H lines. From J.R. Oldroyd. 6827 Put YPCOMPAT on #ifdef NIS instead -- it's one less thing to get 6828 wrong when compiling. Suggested by Rick McCarty of TI. 6829 Fix a problem that could pass negative SIZE parameter if the 6830 df file got lost; this would cause servers to always 6831 give a temporary failure, making the problem even worse. 6832 Problem noted by Allan Johannesen of WPI. 6833 Add "ident" timeout (one of the "r" option selectors) for IDENT 6834 protocol timeouts (30s default). Requested by Murray 6835 Kucherawy of HookUp Communication Corp. to handle bogus 6836 PC TCP/IP implementations. 6837 Change $w default definition to be just the first component of 6838 the domain name on config level 5. The $j macro defaults 6839 to the FQDN; $m remains as before. This lets well-behaved 6840 config files use any of the short, long, or subdomain 6841 names. 6842 Add makesendmail script in src to try to automate multi-architecture 6843 builds. I know, this is sub-optimal, but it is still 6844 helpful. 6845 Fix very obscure race condition that can cause a queue run to 6846 get a queue file for an already completed job. This 6847 problem has existed for years. Problem noted by the 6848 long suffering Allan Johannesen of WPI. 6849 Fix a problem that caused the raw sender name to be passed to 6850 udbsender instead of the canonified name -- this caused 6851 it to sometimes miss records that it should have found. 6852 Relax check of name on HELO packet so that a program using -bs 6853 that claims to be itself works properly. 6854 Restore rewriting of $: part of address through 2, R, 4 in 6855 buildaddr -- this requires passing a lot of flags to get 6856 it right. Unlike old versions, this ONLY rewrites 6857 recipient addresses, not sender addresses. 6858 Fix a bug that caused core dumps in config files that cannot 6859 resolve /file/name style addresses. Fix from Jonathan 6860 Kamens of OpenVision Technologies. 6861 Fix problem with fcntl locking that can cause error returns to 6862 be lost if the lock is lost; this required fully 6863 queueing everything, dropping the envelope (so errors 6864 would get returned), and then re-reading the queue from 6865 scratch. 6866 Fix a problem that caused aliases that redefine an otherwise 6867 true address to still send to the original address 6868 if and only if the alias failed in certain bizarre 6869 ways (e.g, if they pointed at a list:; syntax address). 6870 Problem pointed out by Jonathan Kamens. 6871 Remove support for frozen configuration files. They caused 6872 more trouble than it was worth. 6873 Fix problem that can cause error messages to get ignored when 6874 using both -odb and -t flags. Problem noted by Rob 6875 McNicholas at U.C. Berkeley. 6876 Include all "normal" variations on hostname in $=w. For example, 6877 if the host name is vangogh.cs.berkeley.edu, $=w will 6878 contain vangogh, vangogh.cs, and vangogh.cs.berkeley.edu. 6879 Add "restrictqrun" privacy flag -- without this, anyone can run 6880 the queue. 6881 Reset SmtpPhase global on initial connection creation so that 6882 messages don't come out with stale information. 6883 Pass an "ext" argument to lockfile so that error/log messages 6884 will properly reflect the true filename being locked. 6885 Put all [...] address forms into $=w -- this eliminates the need 6886 for MAXIPADDR in conf.h. Suggested by John Gardiner 6887 Myers of CMU. 6888 Fix a bug that can cause qf files to be left around even after 6889 an SMTP RSET command. Problem and fix from Michael 6890 Corrigan. 6891 Don't send a PostmasterCopy to errors when the Precedence: is 6892 negative. Error reports still go to the envelope 6893 sender address. 6894 Add LA_SHORT for load averages. 6895 Lock sendmail.st file when posting statistics. 6896 Add "SendBufSize" and "RcvBufSize" suboptions to "O" option to 6897 set the size of the TCP send and receive buffers; if you 6898 run over a slow slip line you may need to set these down 6899 (although it would be better to fix the SLIP implementation 6900 so that it's not necessary to recompile every program 6901 that does bulk data transfer). 6902 Allow null defaults on $( ... $) lookups. Problem reported by 6903 Amir Plivatsky. 6904 Diagnose crufty S and V config lines. This resulted from an 6905 observation that some people were using the SITE macro 6906 without the SITECONFIG macro first, which was causing 6907 bogus config files that were not caught. 6908 Fix makemap -f flag to turn off case folding (it was turning it 6909 on instead). THIS IS A USER VISIBLE CHANGE!!! 6910 Fix a problem that caused multiple error messages to be sent if 6911 you used "sendmail -t -oem -odb", your system uses fcntl 6912 locking, and one of the recipient addresses is unknown. 6913 Reset uid earlier in include() so that recursive .forwards or 6914 :include:s don't use the wrong uid. 6915 If file descriptor 0, 1, or 2 was closed when sendmail was 6916 called, the code to recover the descriptor was broken. 6917 This sometimes (only sometimes) caused problems with the 6918 alias file. Fix from Motonori Nakamura. 6919 Fix a problem that caused aliaswait to go into infinite recursion 6920 if the @:@ metasymbol wasn't found in the alias file. 6921 Improve error message on newaliases if database files cannot be 6922 opened or if running with no database format defined. 6923 Do a better estimation of the size of error messages when NoReturn 6924 is set. Problem noted by P{r (Pell) Emanuelsson. 6925 Fix a problem causing the "c" option (don't connect to expensive 6926 mailers) to be ignored in SMTP. Problem noted and the 6927 solution suggested by Robert Elz of The University of 6928 Melbourne. 6929 Improve connection caching algorithm by passing "[host]" to 6930 hostsignature, which strips the square brackets and 6931 returns the real name. This allows mailertable entries 6932 to match regular entries. 6933 Re-enable Return-Receipt-To: -- people seem to want this stupid 6934 feature, even if it doesn't work right. 6935 Catch and log attempts to try the "wiz" command in server SMTP. 6936 This also ups the log level from LOG_NOTICE to LOG_CRIT. 6937 Be more generous at assigning $z to the home directory -- do this 6938 for programs that are specified through a .forward file. 6939 Fix from Andrew Chang of Sun Microsystems. 6940 Always save a fatal error message in preference to a non-fatal 6941 error message so that the "subject" line of return 6942 messages is the best possible. 6943 CONFIG: reduce the number of quotes needed to quote configuration 6944 parameters with commas: two quotes should work now, e.g., 6945 define(ALIAS_FILE, ``/etc/aliases,/etc/aliases.local''). 6946 CONFIG: class $=Z is a set of UUCP hosts that use uucp-dom 6947 connections (domain-ized UUCP). 6948 CONFIG: fix bug in default maps (-o must be before database file 6949 name). Pointed out by Christophe Wolfhugel. 6950 CONFIG: add FEATURE(nodns) to state that we are not relying on 6951 DNS. This would presumably be used in UUCP islands. 6952 CONFIG: add OSTYPE(nextstep) and OSTYPE(linux). 6953 CONFIG: log $u in Received: line. This is in technical violation 6954 of the standards, since it doesn't guarantee a domain 6955 on the address. 6956 CONFIG: don't assume "m" in local mailer flags -- this means that 6957 if you redefine LOCAL_MAILER_FLAGS you will have to include 6958 the "m" flag should you want it. Apparently some Solaris 2.2 6959 installations can't handle multiple local recipients. 6960 Problem noted by Josh Smith. 6961 CONFIG: add confDOMAIN_NAME to set $j (if undefined, $j defaults). 6962 CONFIG: change default version level from 4 to 5. 6963 CONFIG: add FEATURE(nullclient) to create a config file that 6964 forwards all mail to a hub without ever looking at the 6965 addresses in any detail. 6966 CONFIG: properly strip mailer: information off of relays when 6967 used to change .BITNET form into %-hack form. 6968 CONFIG: fix a problem that caused infinite loops if presented 6969 with an address such as "!foo". 6970 CONFIG: check for self literal (e.g., [128.32.131.12]) even if 6971 the reverse "PTR" mapping is broken. There's a better 6972 way to do this, but the change is fairly major and I 6973 want to hold it for another release. Problem noted by 6974 Bret Marquis. 6975 69768.5/8.5 1993/07/23 6977 Serious bug: if you used a command line recipient that was unknown 6978 sendmail would not send a return message (it was treating 6979 everything as though it had an SMTP-style client that 6980 would do the return itself). Problem noted by Josh Smith. 6981 Change "trymx" option in getcanonname() to ignore all MX data, 6982 even during a T_ANY query. This actually didn't break 6983 anything, because the only time you called getcanonname 6984 with !trymx was if you already knew there were no MX 6985 records, but it is somewhat cleaner. From Motonori 6986 Nakamura. 6987 Don't call getcanonname from getmxrr if you already know there 6988 are no DNS records matching the name. 6989 Fix a problem causing error messages to always include "The 6990 original message was received ... from localhost". 6991 The correct original host information is now included. 6992 Previous change to cf/sh/makeinfo.sh doesn't port to Ultrix (their 6993 version of "test" doesn't have the -x flag). Change it 6994 to use -f instead. From John Myers. 6995 CONFIG: 8.4 mistakenly set the default SMTP-style mailer to 6996 esmtp -- it should be smtp. 6997 CONFIG: send all relayed mail using confRELAY_MAILER (defaults 6998 to "relay" (a variant of "smtp") if MAILER(smtp) is used, 6999 else "suucp" if MAILER(uucp) is used, else "unknown"); 7000 this cleans up the configs somewhat. This fixes a serious 7001 problem that caused route-addrs to get mistaken as relays, 7002 pointed out by John Myers. WARNING: this also causes 7003 the default on SMART_HOST to change from "suucp" to 7004 "relay" if you have MAILER(smtp) specified. 7005 70068.4/8.4 1993/07/22 7007 Add option `w'. If you receive a message that comes to you because 7008 you are the best (lowest preference) target of an MX, and 7009 you haven't explicitly recognized the source MX host in 7010 your .cf file, this option will cause you to try the target 7011 host directly (as if there were no MX for it at all). If 7012 `w' is not set, this case is a configuration error. 7013 Beware: if `w' is set, senders may get bogus errors like 7014 "message timed out" or "host unknown" for problems that 7015 are really configuration errors. This option is 7016 disrecommended, provided only for compatibility with 7017 UIUC sendmail. 7018 Fix a problem that caused the incoming socket to be left open 7019 when sendmail forks after the DATA command. This caused 7020 calling systems to wait in FIN_WAIT_2 state until the 7021 entire list was processed and the child closed -- a 7022 potentially prodigious amount of time. Problem noted 7023 by Neil Rickert. 7024 Fix problem (created in 6.64) that caused mail sent to multiple 7025 addresses, one of which was a bad address, to completely 7026 suppress the sending of the message. This changes 7027 handling of EF_FATALERRS somewhat, and adds an 7028 EF_GLOBALERRS flag. This also fixes a potential problem 7029 with duplicate error messages if there is a syntax error 7030 in the header of a message that isn't noticed until late 7031 in processing. Original problem pointed out by Josh Smith 7032 of Harvey Mudd College. This release includes quite a bit 7033 of dickering with error handling (see below). 7034 Back out SMTP transaction if MAIL gets nested 501 error. This 7035 will only hurt already-broken software and should help 7036 humans. 7037 Fix a problem that broke aliases when neither NDBM nor NEWDB were 7038 compiled in. It would never read the alias file. 7039 Repair unbalanced `)' and `>' (the "open" versions are already 7040 repaired). 7041 Logging of "done" in dropenvelope() was incorrect: it would 7042 log this even when the queue file still existed. Change 7043 this to only log "done" (at log level 11) when the 7044 queue file is actually removed. From John Myers. 7045 Log "lost connection" in server SMTP at log level 20 if there 7046 is no pending transaction. Some senders just close the 7047 connection rather than sending QUIT. 7048 Fix a bug causing getmxrr to add a dot to the end of unqualified 7049 domains that do not have MX records -- this would cause 7050 the subsequent host name lookup to fail. The problem 7051 only occurred if you had FEATURE(nocanonify) set. 7052 Problem noted by Rick McCarty of Texas Instruments. 7053 Fix invocation of setvbuf when passed a -X flag -- I had 7054 unwittingly used an ANSI C extension, and this caused 7055 core dumps on some machines. 7056 Diagnose self-destructive alias loops on RCPT as well as EXPN. 7057 Previously it just gave an empty send queue, which 7058 then gave either "Need RCPT (recipient)" at the DATA 7059 (confusing, since you had given an RCPT command which 7060 returned 250) or just dropped the email, depending on 7061 whether you were running VERBose mode. Now it usually 7062 diagnoses this case as "aliasing/forwarding loop broken". 7063 Unfortunately, it still doesn't adequately diagnose 7064 some true error conditions. 7065 Add internal concept of "warning messages" using 6xx codes. 7066 These are not reported only to Postmaster. Unbalanced 7067 parens, brackets, and quotes are printed as 653 codes. 7068 They are always mapped to 5xx codes before use in SMTP. 7069 Clean up error messages to tell both the actual address that 7070 failed and the alias they arose from. This makes it 7071 somewhat easier to diagnose problems. Difficulty noted 7072 by Motonori Nakamura. 7073 Fix a problem that inappropriately added a ctladdr to addresses 7074 that shouldn't have had one during a queue run. This 7075 caused error messages to be handled differently during 7076 a queue run than a direct run. 7077 Don't print the qf name and line number if you get errors during 7078 the direct run of the queue from srvrsmtp -- this was 7079 just extra stuff for users to crawl through. 7080 Put command line flags on second line of pid file so you can 7081 auto-restart the daemon with all appropriate arguments. 7082 Use "kill `head -1 /etc/sendmail.pid`" to stop the 7083 daemon, and "eval `tail -1 /etc/sendmail.pid`" to 7084 restart it. 7085 Remove the ``setuid(getuid())'' in main -- this caused the 7086 IDENT daemon to screw up. This required that I change 7087 HASSETEUID to HASSETREUID and complicate the mode 7088 changing somewhat because both Ultrix and SunOS seem 7089 to have a bug causing seteuid() to set the saved uid 7090 as well as the effective. The program test/t_setreuid.c 7091 will test to see if your implementation of setreuid(2) 7092 is appropriately functional. 7093 The FallBackMX (option V) handling failed to properly identify 7094 fallback to yourself -- most of the code was there, 7095 but it wasn't being enabled. Problem noted by Murray 7096 Kucherawy of the University of Waterloo. 7097 Change :include: open timeout from ETIMEDOUT to an internal 7098 code EOPENTIMEOUT; this avoids adding "during SmtpPhase 7099 with CurHostName" in error messages, which can be 7100 confusing. Reported by Jonathan Kamens of OpenVision 7101 Technologies. 7102 Back out setpgrp (setpgid on POSIX systems) call to reset the 7103 process group id. The original fix was to get around 7104 some problems with recalcitrant MUAs, but it breaks 7105 any call from a shell that creates a process group id 7106 different from the process id. I could try to fix 7107 this by diddling the tty owner (using tcsetpgrp or 7108 equivalent) but this is too likely to break other 7109 things. 7110 Portability changes: 7111 Support -M as equivalent to -oM on Ultrix -- apparently 7112 DECnet calls sendmail with -MrDECnet -Ms<HOST> -bs 7113 instead of using standard flags. Oh joy. This 7114 behavior reported by Jon Giltner of University 7115 of Colorado. 7116 SGI IRIX -- this includes several changes that should 7117 help other strict ANSI compilers. 7118 SCO Unix -- from Murray Kucherawy of HookUp Communication 7119 Corporation. 7120 Solaris running the Sun C compiler (which despite the 7121 documentation apparently doesn't define 7122 __STDC__ by default). 7123 ConvexOS from Eric Schnoebelen of Convex. 7124 Sony NEWS workstations and Omron LUNA workstations from 7125 Motonori Nakamura. 7126 CONFIG: add confTRY_NULL_MX_LIST to set option `w'. 7127 CONFIG: delete `C' and `e' from default SMTP mailers flags; 7128 several people have made a good argument that this 7129 creates more problems than it solves (although this 7130 may prove painful in the short run). 7131 CONFIG: generalize all the relays to accept a "mailer:host" 7132 format. 7133 CONFIG: move local processing in ruleset 0 into a new ruleset 7134 98 (8 on old sendmail). Domain literal [a.b.c.d] 7135 addresses are also passed through this ruleset. 7136 CONFIG: if neither SMART_HOST nor MAILER(smtp) were defined, 7137 internet-style addresses would "fall off the end" of 7138 ruleset zero and be interpreted as local -- however, 7139 the angle brackets confused the recursive call. 7140 These are now diagnosed as "Unrecognized host name". 7141 CONFIG: USENET rules weren't included in S0 because of a mistaken 7142 ifdef(`_MAILER_USENET_') instead of 7143 ifdef(`_MAILER_usenet_'). Problem found by Rein Tollevik 7144 of SINTEF RUNIT, Oslo. 7145 CONFIG: move up LOCAL_RULE_0 processing so that it happens very 7146 early in ruleset 0; this allows .mc authors to bypass 7147 things like the "short circuit" code for local addresses. 7148 Prompted by a comment by Bill Wisner of The Well. 7149 CONFIG: add confSMTP_MAILER to define the mailer used (smtp or 7150 esmtp) to send SMTP mail. This allows you to default 7151 to esmtp but use a mailertable or other override to 7152 deal with broken servers. This logic was pointed out 7153 to me by Bill Wisner. Ditto for confLOCAL_MAILER. 7154 Changes to cf/sh/makeinfo.sh to make it portable to SVR4 7155 environments. Ugly as sin. 7156 71578.3/8.3 1993/07/13 7158 Fix setuid problems introduced in 8.2 that caused messages 7159 like "Cannot create qfXXXXXX: Invalid argument" 7160 or "Cannot reopen dfXXXXXX: Permission denied". This 7161 involved a new compile flag "HASSETEUID" that takes 7162 the place of the old _POSIX_SAVED_IDS -- it turns out 7163 that the POSIX interface is broken enough to break 7164 some systems badly. This includes some fixes for 7165 HP-UX. Also fixes problems where the real uid is 7166 not reset properly on startup (from Neil Rickert). 7167 Fix a problem that caused timed out messages to not report the 7168 addresses that timed out. Error messages are also more 7169 "user friendly". 7170 Drop required bandwidth on connections from 64 bytes/sec to 7171 16 bytes/sec. 7172 Further Solaris portability changes -- doesn't require the BSD 7173 compatibility library. This also adds a new 7174 "HASGETDTABLESIZE" compile flag which can be used if 7175 you want to use getdtablesize(2) instead of sysconf(2). 7176 These are loosely based on changes from David Meyer at 7177 University of Oregon. This now seems to work, at least 7178 for quick test cases. 7179 Fix a problem that can cause duplicate error messages to be 7180 sent if you are in SMTP, you send to multiple addresses, 7181 and at least one of those addresses is good and points 7182 to an account that has a .forward file (whew!). 7183 Fix a problem causing messages to be discarded if checkcompat() 7184 returned EX_TEMPFAIL (because it didn't properly mark 7185 the "to" address). Problem noted by John Myers. 7186 Fix dfopen to return NULL if the open failed; I was depending 7187 on fdopen(-1) returning NULL, which isn't the case. This 7188 isn't serious, but does result in weird error diagnoses. 7189 From Michael Corrigan. 7190 CONFIG: add UUCP_MAX_SIZE M4 macro to set the maximum size of 7191 messages sent through UUCP-family mailers. Suggested 7192 by Bill Wisner of The Well. 7193 CONFIG: if both MAILER(uucp) and MAILER(smtp) are specified, 7194 include a "uucp-dom" mailer that uses domain-style 7195 addressing. Suggested by Bill Wisner. 7196 CONFIG: Add LOCAL_SHELL_FLAGS and LOCAL_SHELL_ARGS to match 7197 LOCAL_MAILER_FLAGS and LOCAL_MAILER_ARGS. Suggested by 7198 Christophe Wolfhugel. 7199 CONFIG: Add OSTYPE(aix3). From Christophe Wolfhugel. 7200 72018.2/8.2 1993/07/11 7202 Don't drop out on config file parse errors in -bt mode. 7203 On older configuration files, assume option "l" (use Errors-To 7204 header) for back compatibility. NOTE: this DOES NOT 7205 imply an endorsement of the Errors-To: header in any way. 7206 Accept -x flag on AIX-3 as well as OSF/1. Why, why, why??? 7207 Don't log errors on EHLO -- it isn't a "real" error for an old 7208 SMTP server to give an error on this command, and 7209 logging it in the transcript can be confusing. Fix 7210 from Bill Wisner. 7211 IRIX compatibility changes provided by Dan Rich 7212 <drich@sandman.lerc.nasa.gov>. 7213 Solaris 2 compatibility changes. Provided by Bob Cunningham 7214 <bob@kahala.soest.hawaii.edu>, John Oleynick 7215 <juo@klinzhai.rutgers.edu> 7216 Debugging: -d17 was overloaded (hostsignature and usersmtp.c); 7217 move usersmtp (smtpinit and smtpmailfrom) to -d18 to 7218 match the other flags in that file. 7219 Flush transcript before fork in mailfile(). From Eric Wassenaar. 7220 Save h_errno in mci struct and improve error message display. 7221 Changes from Eric Wassenaar. 7222 Open /dev/null for the transcript if the create of the xf file 7223 failed; this avoids at least one possible null pointer 7224 reference in very weird cases. From Eric Wassenaar. 7225 Clean up statistics gathering; it was over-reporting because of 7226 forks. From Eric Wassenaar. 7227 Fix problem that causes old Return-Path: line to override new 7228 Return-Path: line (conf.c needs H_FORCE to avoid 7229 re-using old value). From Motonori Nakamura. 7230 Fix broken -m flag in K definition -- even if -m (match only) 7231 was specified, it would still replace the key with the 7232 value. Noted by Rick McCarty of Texas Instruments. 7233 If the name server timed out over several days, no "timed out" 7234 message would ever be sent back. The timeout code 7235 has been moved from markfailure() to dropenvelope() 7236 so that all such failures should be diagnosed. Pointed 7237 out by Christophe Wolfhugel and others. 7238 Relax safefile() constraints: directories in an include or 7239 forward path must be readable by self if the controlling 7240 user owns the entry, readable by all otherwise (e.g., 7241 when reading your .forward file, you have to own and 7242 have X permission in it; everyone needs X permission in 7243 the root and directories leading up to your home); 7244 include files must be readable by anyone, but need not 7245 be owned by you. 7246 If _POSIX_SAVED_IDS is defined, setuid to the owner before 7247 reading a .forward file; this gets around some problems 7248 on NFS mounts if root permission is not exported and 7249 the user's home directory isn't x'able. 7250 Additional NeXT portability enhancements from Axel Zinser. 7251 Additional HP-UX portability enhancements from Brian Bullen. 7252 Add a timeout around SMTP message writes; this assumes you can 7253 get throughput of at least 64 bytes/second. Note that 7254 this does not impact the "datafinal" default, which 7255 is separate; this is just intended to work around 7256 network clogs that will occur before the final dot 7257 is sent. From Eric Wassenaar. 7258 Change map code to set the "include null" flag adaptively -- 7259 it initially tries both, but if it finds anything 7260 matching without a null it never tries again with a 7261 null and vice versa. If -N is specified, it never 7262 tries without the null and creates new maps with a 7263 null byte. If -O is specified, it never tries with 7264 the null (for efficiency). If -N and -O are specified, 7265 you get -NO (get it?) lookup at all, so this would 7266 be a bad idea. If you don't specify either -N or -O, 7267 it adapts. 7268 Fix recognition of "same from address" so that MH submissions 7269 will insert the appropriate full name information; 7270 this used to work and got broken somewhere along the 7271 way. 7272 Some changes to eliminate some unnecessary SYSERRs in the 7273 log. For example, if you lost a connection, don't 7274 bother reporting that fact on the connection you lost. 7275 Add some "extended debugging" flags to try to track down 7276 why we get occasional problems with file descriptor 7277 one being closed when execing a mailer; it seems to 7278 only happen when there has been another error in the 7279 same transaction. This requires XDEBUG, defined 7280 by default in conf.h. 7281 Add "-X filename" command line flag, which logs both sides of 7282 all SMTP transactions. This is intended ONLY for 7283 debugging bad implementations of other mailers; start 7284 it up, send a message from a mailer that is failing, 7285 and then kill it off and examine the indicated log. 7286 This output is not intended to be particularly human 7287 readable. This also adds the HASSETVBUF compile 7288 flag, defaulted on if your compiler defines __STDC__. 7289 CONFIG: change SMART_HOST to override an SMTP mailer. If you 7290 have a local net that should get direct connects, you 7291 will need to use LOCAL_NET_CONFIG to catch these hosts. 7292 See cf/README for an example. 7293 CONFIG: add LOCAL_MAILER_ARGS (default: `mail -d $u') to handle 7294 sites that don't use the -d flag. 7295 CONFIG: hide recipient addresses as well as sender addresses 7296 behind $M if FEATURE(allmasquerade) is specified; this 7297 has been requested by several people, but can break 7298 local aliases. For example, if you mail to "localalias" 7299 this will be rewritten as "localalias@masqueradehost"; 7300 although initial delivery will work, replies will be 7301 broken. Use it sparingly. 7302 CONFIG: add FEATURE(domaintable). This maps unqualified domains 7303 to qualified domains in headers. I believe this is 7304 largely equivalent to the IDA feature of the same name. 7305 CONFIG: use $U as UUCP name instead of $k. This permits you 7306 to override the "system name" as your UUCP name -- 7307 in particular, to use domain-ized UUCP names. From 7308 Bill Wisner of The Well. 7309 CONFIG: create new mailer "esmtp" that always tries EHLO 7310 first. This is currently unused in the config files, 7311 but could be used in a mailertable entry. 7312 73138.1C/8.1B 1993/06/27 7314 Serious security bug fix: it was possible to read any file on 7315 the system, regardless of ownership and permissions. 7316 If a subroutine returns a fully qualified address, return it 7317 immediately instead of feeding it back into rewriting. 7318 This fixes a problem with mailertable lookups. 7319 CONFIG: fix some M4 frotz (concat => CONCAT) 7320 73218.1B/8.1A 1993/06/12 7322 Serious bug fix: pattern matching backup algorithm stepped by 7323 two tokens in classes instead of one. Found by Claus 7324 Assmann at University of Kiel, Germany. 7325 73268.1A/8.1A 1993/06/08 7327 Another mailertable fix.... 7328 73298.1/8.1 1993/06/07 7330 4.4BSD freeze. No semantic changes. 7331