exim: update to version 4.96

Exim version 4.96
-----------------

JH/01 Move the wait-for-next-tick (needed for unique message IDs) from
      after reception to before a subsequent reception.  This should
      mean slightly faster delivery, and also confirmation of reception
      to senders.

JH/02 Move from using the pcre library to pcre2.  The former is no longer
      being developed or supported (by the original developer).

JH/03 Constification work in the filters module required a major version
      bump for the local-scan API.  Specifically, the "headers_charset"
      global which is visible via the API is now const and may therefore
      not be modified by local-scan code.

JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for
      sendfile() didi not account for the way the ClamAV driver code called it.

JH/05 Bug 2819: speed up command-line messages being read in.  Previously a
      time check was being done for every character; replace that with one
      per buffer.

JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL.  Previously the string
      sent was prefixed with a length byte.

JH/07 Change the SMTP feature name for pipelining connect to be compliant with
      RFC 5321.  Previously Dovecot (at least) would log errors during
      submission.

JH/08 Remove stripping of the binaries from the FreeBSD build.  This was added
      in 4.61 without a reason logged. Binaries will be bigger, which might
      matter on diskspace-constrained systems, but debug is easier.

JH/09 Fix macro-definition during "-be" expansion testing.  The move to
      write-protected store for macros had not accounted for these runtime
      additions; fix by removing this protection for "-be" mode.

JH/10 Convert all uses of select() to poll().  FreeBSD 12.2 was found to be
      handing out large-numbered file descriptors, violating the usual Unix
      assumption (and required by Posix) that the lowest possible number will be
      allocated by the kernel when a new one is needed.  In the daemon, and any
      child procesees, values higher than 1024 (being bigger than FD_SETSIZE)
      are not useable for FD_SET() [and hence select()] and overwrite the stack.
      Assorted crashes happen.

JH/11 Fix use of $sender_host_name in daemon process.  When used in certain
      main-section options or in a connect ACL, the value from the first ever
      connection was never replaced for subsequent connections.  Found by
      Wakko Warner.

JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux,
      though only once PCRE2 was introduced: the memory accounting used under
      debug offset allocations by an int, giving a hard trap in early startup.
      Change to using a size_t.  Debug and fix by John Paul Adrian Glaubitz.

JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value
      with underbars is given.  The write-protection of configuration introduced
      in 4.95 trapped when normalisation was applied to an option not needing
      expansion action.

JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.

JH/15 Fix a resource leak in *BSD.  An off-by-one error resulted in the daemon
      failing to close the certificates directory, every hour or any time it
      was touched.

JH/16 Debugging initiated by an ACL control now continues through into routing
      and transport processes.  Previously debugging stopped any time Exim
      re-execs, or for processing a queued message.

JH/17 The "expand" debug selector now gives more detail, specifically on the
      result of expansion operators and items.

JH/18 Bug 2751: Fix include_directory in redirect routers.  Previously a
      bad comparison between the option value and the name of the file to
      be included was done, and a mismatch was wrongly identified.
      4.88 to 4.95 are affected.

JH/19 Support for Berkeley DB versions 1 and 2 is withdrawn.

JH/20 When built with NDBM for hints DB's check for nonexistence of a name
      supplied as the db file-pair basename.  Previously, if a directory
      path was given, for example via the autoreply "once" option, the DB
      file.pag and file.dir files would be created in that directory's
      parent.

JH/21 Remove the "allow_insecure_tainted_data" main config option and the
      "taint" log_selector.  These were previously deprecated.

JH/22 Fix static address-list lookups to properly return the matched item.
      Previously only the domain part was returned.

JH/23 Bug 2864: FreeBSD: fix transport hang after 4xx/5xx response. Previously
      the call into OpenSSL to send a TLS Close was being repeated; this
      resulted in the library waiting for the peer's Close.  If that was never
      sent we waited forever.  Fix by tracking send calls.

JH/24 The ${run} expansion item now expands its command string elements after
      splitting.  Previously it was before; the new ordering makes handling
      zero-length arguments simpler.  The old ordering can be obtained by
      appending a new option "preexpand", after a comma, to the "run".

JH/25 Taint-check exec arguments for transport-initiated external processes.
      Previously, tainted values could be used.  This affects "pipe", "lmtp" and
      "queryprogram" transport, transport-filter, and ETRN commands.
      The ${run} expansion is also affected: in "preexpand" mode no part of
      the command line may be tainted, in default mode the executable name
      may not be tainted.

JH/26 Fix CHUNKING on a continued-transport.  Previously the usabliility of
      the the facility was not passed across execs, and only the first message
      passed over a connection could use BDAT; any further ones using DATA.

JH/27 Support the PIPECONNECT facility in the smtp transport when the helo_data
      uses $sending_ip_address and an interface is specified.
      Previously any use of the local address in the EHLO name disabled
      PIPECONNECT, the common case being to use the rDNS of it.

JH/28 OpenSSL: fix transport-required OCSP stapling verification under session
      resumption. Previously verify failed because no certificate status is
      passed on the wire for the restarted session. Fix by using the recorded
      ocsp status of the stored session for the new connection.

JH/29 TLS resumption: the key for session lookup in the client now includes
      more info that a server could potentially use in configuring a TLS
      session, avoiding oferring mismatching sessions to such a server.
      Previously only the server IP was used.

JH/30 Fix string_copyn() for limit greater than actual string length.
      Previously the copied amount was the limit, which could result in a
      overlapping memcpy for newly allocated destination soon after a
      source string shorter than the limit.  Found/investigated  by KM.

JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection
      close; it may be needed for a subsequent connection.  This caused a
      SEGV on primary-MX defer.  Found/investigated by Gedalya & Andreas.

JH/32 Fix CHUNKING for a second message on a connection when the first was
      rejected.  Previously we did not reset the chunking-offered state, and
      erroneously rejected the BDAT command.  Investigation help from
      Jesse Hathaway.

JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning
      an empty address.  Previously the expansion returned an error.

HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending
      proxy.  Previously these were misparsed, leading to paniclog entries.

Also contains commit 51be321b27 "Fix PAM auth. Bug 2813" addressing
CVE-2022-37451.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

mail/exim/Makefile

@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=exim
-PKG_VERSION:=4.95
+PKG_VERSION:=4.96
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://ftp.exim.org/pub/exim/exim4/
-PKG_HASH:=cc9cb653fff2ea947c3702680b59c99ac0bd1bbf19976d37e22a463cd804f167
+PKG_HASH:=299a56927b2eb3477daafd3c5bda02bc67e5c4e5898a7aeaf2740875278cf1a3
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 
 PKG_LICENSE:=GPL-2.0-or-later
@@ -45,7 +45,7 @@ LOOKUPS:= \
 define Package/exim/Default
   SECTION:=mail
   CATEGORY:=Mail
-  DEPENDS:=+libdb47 +libpcre $(ICONV_DEPENDS) +BUILD_NLS:libidn2 +BUILD_NLS:libidn
+  DEPENDS:=+libdb47 +libpcre2 $(ICONV_DEPENDS) +BUILD_NLS:libidn2 +BUILD_NLS:libidn
   TITLE:=Exim message transfer agent
   URL:=http://www.exim.org/
   USERID:=exim=42:exim=42

mail/exim/patches/030-openssl-deprecated.patch

@@ -13,7 +13,7 @@
    }
 --- a/src/pdkim/signing.c
 +++ b/src/pdkim/signing.c
-@@ -704,7 +704,6 @@ return NULL;
+@@ -703,7 +703,6 @@ return NULL;
  void
  exim_dkim_init(void)
  {
@@ -34,7 +34,7 @@
  #ifndef OPENSSL_NO_ECDH
  # include <openssl/ec.h>
  #endif
-@@ -834,8 +837,9 @@ if (!EVP_PKEY_assign_RSA(pkey, rsa))
+@@ -885,8 +888,9 @@ pkey = EVP_RSA_gen(2048);
  
  X509_set_version(x509, 2);				/* N+1 - version 3 */
  ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
@@ -46,18 +46,18 @@
  X509_set_pubkey(x509, pkey);
  
  name = X509_get_subject_name(x509);
-@@ -4512,8 +4516,8 @@ fprintf(f, "Library version: OpenSSL: Co
-            "                          Runtime: %s\n"
-            "                                 : %s\n",
-            OPENSSL_VERSION_TEXT,
--           SSLeay_version(SSLEAY_VERSION),
--           SSLeay_version(SSLEAY_BUILT_ON));
-+           OpenSSL_version(OPENSSL_VERSION),
-+           OpenSSL_version(OPENSSL_BUILT_ON));
- /* third line is 38 characters for the %s and the line is 73 chars long;
- the OpenSSL output includes a "built on: " prefix already. */
+@@ -4670,8 +4674,8 @@ return string_fmt_append(g,
+     "                          Runtime: %s\n"
+     "                                 : %s\n",
+ 	     OPENSSL_VERSION_TEXT,
+-	     SSLeay_version(SSLEAY_VERSION),
+-	     SSLeay_version(SSLEAY_BUILT_ON));
++	     OpenSSL_version(OPENSSL_VERSION),
++	     OpenSSL_version(OPENSSL_BUILT_ON));
+   /* third line is 38 characters for the %s and the line is 73 chars long;
+   the OpenSSL output includes a "built on: " prefix already. */
  }
-@@ -4555,8 +4559,6 @@ if (pidnow != pidlast)
+@@ -4713,8 +4717,6 @@ if (pidnow != pidlast)
    is unique for each thread", this doesn't apparently apply across processes,
    so our own warning from vaguely_random_number_fallback() applies here too.
    Fix per PostgreSQL. */
@@ -68,7 +68,7 @@
  
 --- a/src/tlscert-openssl.c
 +++ b/src/tlscert-openssl.c
-@@ -217,13 +217,13 @@ return mod ? tls_field_from_dn(cp, mod)
+@@ -218,13 +218,13 @@ return mod ? tls_field_from_dn(cp, mod)
  uschar *
  tls_cert_not_before(void * cert, uschar * mod)
  {

mail/exim/patches/100-localscan_dlopen.patch

@@ -10,7 +10,7 @@ Last-Update: 2021-07-28
 
 --- a/src/EDITME
 +++ b/src/EDITME
-@@ -883,6 +883,21 @@ HEADERS_CHARSET="ISO-8859-1"
+@@ -873,6 +873,21 @@ HEADERS_CHARSET="ISO-8859-1"
  
  
  #------------------------------------------------------------------------------
@@ -34,7 +34,7 @@ Last-Update: 2021-07-28
  # the documentation in "info" format, first fetch the Texinfo documentation
 --- a/src/config.h.defaults
 +++ b/src/config.h.defaults
-@@ -35,6 +35,8 @@ Do not put spaces between # and the 'def
+@@ -33,6 +33,8 @@ Do not put spaces between # and the 'def
  
  #define AUTH_VARS                     4
  
@@ -45,8 +45,8 @@ Last-Update: 2021-07-28
  #define CONFIGURE_FILE
 --- a/src/globals.c
 +++ b/src/globals.c
-@@ -121,6 +121,10 @@ int     dsn_ret                = 0;
- const pcre  *regex_DSN         = NULL;
+@@ -117,6 +117,10 @@ int     dsn_ret                = 0;
+ const pcre2_code  *regex_DSN         = NULL;
  uschar *dsn_advertise_hosts    = NULL;
  
 +#ifdef DLOPEN_LOCAL_SCAN
@@ -58,8 +58,8 @@ Last-Update: 2021-07-28
  BOOL    gnutls_allow_auto_pkcs11 = FALSE;
 --- a/src/globals.h
 +++ b/src/globals.h
-@@ -156,6 +156,9 @@ extern int      dsn_ret;               /
- extern const pcre  *regex_DSN;         /* For recognizing DSN settings */
+@@ -155,6 +155,9 @@ extern int      dsn_ret;               /
+ extern const pcre2_code  *regex_DSN;         /* For recognizing DSN settings */
  extern uschar  *dsn_advertise_hosts;   /* host for which TLS is advertised */
  
 +#ifdef DLOPEN_LOCAL_SCAN
@@ -70,7 +70,7 @@ Last-Update: 2021-07-28
  
 --- a/src/local_scan.c
 +++ b/src/local_scan.c
-@@ -6,58 +6,133 @@
+@@ -7,58 +7,133 @@
  /* See the file NOTICE for conditions of use and distribution. */
  
  
@@ -266,7 +266,7 @@ Last-Update: 2021-07-28
  extern uschar *message_id;             /* Internal id of message being handled */
  extern uschar *received_protocol;      /* Name of incoming protocol */
  extern int     recipients_count;       /* Number of recipients */
-@@ -235,4 +239,6 @@ extern pid_t    child_open_exim2_functio
+@@ -236,4 +240,6 @@ extern pid_t    child_open_exim2_functio
  extern pid_t    child_open_function(uschar **, uschar **, int, int *, int *, BOOL, const uschar *);
  #endif
  
@@ -275,7 +275,7 @@ Last-Update: 2021-07-28
  /* End of local_scan.h */
 --- a/src/readconf.c
 +++ b/src/readconf.c
-@@ -215,6 +215,9 @@ static optionlist optionlist_config[] =
+@@ -212,6 +212,9 @@ static optionlist optionlist_config[] =
    { "local_from_prefix",        opt_stringptr,   {&local_from_prefix} },
    { "local_from_suffix",        opt_stringptr,   {&local_from_suffix} },
    { "local_interfaces",         opt_stringptr,   {&local_interfaces} },
@@ -295,9 +295,9 @@ Last-Update: 2021-07-28
  /*************************************************
  *            Copy and save string                *
  *************************************************/
-@@ -470,6 +471,7 @@ Ustrncpy(ss, s, n);
- ss[n] = 0;
- return ss;
+@@ -463,6 +464,7 @@ string_copyn_function(const uschar * s,
+ {
+ return string_copyn(s, n);
  }
 +#pragma GCC visibility pop
  #endif

mail/exim/patches/200-fix-build.patch

@@ -0,0 +1,41 @@
+--- a/src/drtables.c
++++ b/src/drtables.c
+@@ -736,7 +736,7 @@ else
+     {
+     char * name = ent->d_name;
+     int len = (int)strlen(name);
+-    if (regex_match(regex_islookupmod, US name, len, NUL))
++    if (regex_match(regex_islookupmod, US name, len, NULL))
+       {
+       int pathnamelen = len + (int)strlen(LOOKUP_MODULE_DIR) + 2;
+       void *dl;
+--- a/src/exim.c
++++ b/src/exim.c
+@@ -636,13 +636,15 @@ exim_nullstd(void)
+ {
+ int devnull = -1;
+ struct stat statbuf;
++const char devnullpath[] = "/dev/null";
++
+ for (int i = 0; i <= 2; i++)
+   {
+   if (fstat(i, &statbuf) < 0 && errno == EBADF)
+     {
+-    if (devnull < 0) devnull = open("/dev/null", O_RDWR);
++    if (devnull < 0) devnull = open(devnullpath, O_RDWR);
+     if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
+-      string_open_failed("/dev/null", NULL));
++      string_open_failed("%s", devnullpath));
+     if (devnull != i) (void)dup2(devnull, i);
+     }
+   }
+--- a/src/local_scan.h
++++ b/src/local_scan.h
+@@ -26,6 +26,7 @@ store.c
+ settings, and the store functions. */
+ 
+ #include <stdarg.h>
++#include <stdlib.h>
+ #include <sys/types.h>
+ #pragma GCC visibility push(default)
+ #include "config.h"