Author: bapt
Date: Mon Aug 22 07:24:02 2016
New Revision: 304588
URL: https://svnweb.freebsd.org/changeset/base/304588
Log:
Import Dragonfly Mail Agent snapshort from 20160806 aka v0.11+
Most important change being:
dma - Fix security hole
Affecting DragonFly 4.6 and earlier, Matt Dillon fixed this in base after
finding out from BSDNow Episode 152. Comments following were from his commit
which explains better than I. Just taking his change and putting it here as
well.
* dma makes an age-old mistake of not properly checking whether a file
owned by a user is a symlink or not, a bug which the original mail.local
also had.
* Add O_NOFOLLOW to disallow symlinks.
Thanks-to: BSDNow Episode 152, made me dive dma to check when they talked
about the mail.local bug.
Approved by: re (kib)
Modified:
releng/11.0/contrib/dma/VERSION
releng/11.0/contrib/dma/dma-mbox-create.c
releng/11.0/contrib/dma/dma.c
releng/11.0/contrib/dma/dma.h
releng/11.0/contrib/dma/dns.c
releng/11.0/contrib/dma/local.c
releng/11.0/contrib/dma/net.c
releng/11.0/libexec/dma/Makefile.inc
Directory Properties:
releng/11.0/ (props changed)
Modified: releng/11.0/contrib/dma/VERSION
==============================================================================
--- releng/11.0/contrib/dma/VERSION Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/VERSION Mon Aug 22 07:24:02 2016
(r304588)
@@ -1 +1 @@
-v0.10
+v0.11
Modified: releng/11.0/contrib/dma/dma-mbox-create.c
==============================================================================
--- releng/11.0/contrib/dma/dma-mbox-create.c Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/dma-mbox-create.c Mon Aug 22 07:24:02 2016
(r304588)
@@ -142,7 +142,7 @@ main(int argc, char **argv)
logfail(EX_CANTCREAT, "cannot build mbox path for `%s/%s'",
_PATH_MAILDIR, user);
}
- f = open(fn, O_RDONLY|O_CREAT, 0600);
+ f = open(fn, O_RDONLY|O_CREAT|O_NOFOLLOW, 0600);
if (f < 0)
logfail(EX_NOINPUT, "cannt open mbox `%s'", fn);
Modified: releng/11.0/contrib/dma/dma.c
==============================================================================
--- releng/11.0/contrib/dma/dma.c Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/dma.c Mon Aug 22 07:24:02 2016
(r304588)
@@ -321,7 +321,7 @@ deliver(struct qitem *it)
snprintf(errmsg, sizeof(errmsg), "unknown bounce reason");
retry:
- syslog(LOG_INFO, "trying delivery");
+ syslog(LOG_INFO, "<%s> trying delivery", it->addr);
if (it->remote)
error = deliver_remote(it);
@@ -331,7 +331,7 @@ retry:
switch (error) {
case 0:
delqueue(it);
- syslog(LOG_INFO, "delivery successful");
+ syslog(LOG_INFO, "<%s> delivery successful", it->addr);
exit(EX_OK);
case 1:
Modified: releng/11.0/contrib/dma/dma.h
==============================================================================
--- releng/11.0/contrib/dma/dma.h Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/dma.h Mon Aug 22 07:24:02 2016
(r304588)
@@ -49,7 +49,7 @@
#define VERSION "DragonFly Mail Agent " DMA_VERSION
#define BUF_SIZE 2048
-#define ERRMSG_SIZE 200
+#define ERRMSG_SIZE 1024
#define USERNAME_SIZE 50
#define MIN_RETRY 300 /* 5 minutes */
#define MAX_RETRY (3*60*60) /* retry at least every 3 hours */
Modified: releng/11.0/contrib/dma/dns.c
==============================================================================
--- releng/11.0/contrib/dma/dns.c Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/dns.c Mon Aug 22 07:24:02 2016
(r304588)
@@ -34,6 +34,7 @@
*/
#include <sys/types.h>
+#include <sys/param.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <arpa/nameser.h>
Modified: releng/11.0/contrib/dma/local.c
==============================================================================
--- releng/11.0/contrib/dma/local.c Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/local.c Mon Aug 22 07:24:02 2016
(r304588)
@@ -196,7 +196,7 @@ retry:
goto out;
}
- error = snprintf(line, sizeof(line), "%sFrom %s\t%s", newline, sender,
ctime(&now));
+ error = snprintf(line, sizeof(line), "%sFrom %s %s", newline, sender,
ctime(&now));
if (error < 0 || (size_t)error >= sizeof(line)) {
syslog(LOG_NOTICE, "local delivery deferred: can not write
header: %m");
goto out;
Modified: releng/11.0/contrib/dma/net.c
==============================================================================
--- releng/11.0/contrib/dma/net.c Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/contrib/dma/net.c Mon Aug 22 07:24:02 2016
(r304588)
@@ -372,11 +372,13 @@ deliver_to_host(struct qitem *it, struct
host->host, host->addr, c, neterr); \
snprintf(errmsg, sizeof(errmsg), "%s [%s] did not like our
%s:\n%s", \
host->host, host->addr, c, neterr); \
- return (-1); \
+ error = -1; \
+ goto out; \
} else if (res != exp) { \
syslog(LOG_NOTICE, "remote delivery deferred: %s [%s] failed
after %s: %s", \
host->host, host->addr, c, neterr); \
- return (1); \
+ error = 1; \
+ goto out; \
}
/* Check first reply from remote host */
@@ -426,7 +428,8 @@ deliver_to_host(struct qitem *it, struct
syslog(LOG_ERR, "remote delivery failed:"
" SMTP login failed: %m");
snprintf(errmsg, sizeof(errmsg), "SMTP login to %s
failed", host->host);
- return (-1);
+ error = -1;
+ goto out;
}
/* SMTP login is not available, so try without */
else if (error > 0) {
Modified: releng/11.0/libexec/dma/Makefile.inc
==============================================================================
--- releng/11.0/libexec/dma/Makefile.inc Mon Aug 22 07:08:00 2016
(r304587)
+++ releng/11.0/libexec/dma/Makefile.inc Mon Aug 22 07:24:02 2016
(r304588)
@@ -7,7 +7,7 @@ DMA_SOURCES= ${.CURDIR}/../../../contrib
CFLAGS+= -I${DMA_SOURCES} \
-DHAVE_REALLOCF -DHAVE_STRLCPY -DHAVE_GETPROGNAME \
-DCONF_PATH='"/etc/dma"' \
- -DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.10"' \
+ -DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.11+"' \
-DDMA_ROOT_USER='"mailnull"' \
-DDMA_GROUP='"mail"'
BINGRP= mail
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
