Make DB_SIGNINGTABLE symbol available in Lua scripts.
Fix bug #214: Handle arbitrarily large From: fields.
LIBOPENDKIM: Fix bug #213: Remove "dkim_default_senderhdrs" from
dkim.h.
LIBOPENDKIM: Fix bug #219: Unresolved CNAMEs are not failures,
according to the DNS (see RFC6604), so report them as
NXDOMAIN or similar.
2.10.0 2014/12/27
Feature request #182: Remove "AddAllSignatureResults". All signature
results will now be added via Authentication-Results header
fields.
Feature request #180: Rename "LDAPSoftStart" to "SoftStart" and apply
it to SQL connections as well.
Feature request #179: Add "IgnoreMalformedMail" option.
Fix bug #183: Discontinue support for ADSP. This removes the
following configuration file items:
AddAllSignatureResults LocalADSP
ADSPAction NoDiscardableMailTo
ADSPNoSuchDomain On-PolicyError
BogusPolicy SendADSPReports
DisableADSP SenderHeaders
LDAPSoftStart UnprotectedPolicy
Make "rrvs" and "smime" recognized Authentication-Results methods.
LIBOPENDKIM: Feature request #157: Add dkim_mail_parse_multi().
LIBOPENDKIM: Feature request #185: Add dkim_set_dnssec().
LIBOPENDKIM: Fix bug #183: Discontinue support for ADSP. This
means all of the following:
- the dkim_policy_t type has been removed
- the DKIM_POLICY_* constants have been removed
- the DKIM_PRESULT_* constants have been removed
- passing DKIM_OPTS_SENDERHDRS to dkim_options() now
results in an error
- the DKIM_PSTATE structure has been removed
- all of the following functions have been removed:
dkim_policy(), dkim_policy_dnssec(),
dkim_policy_getqueries(), dkim_policy_getreportinfo(),
dkim_policy_state_free(), dkim_policy_state_new(),
dkim_policy_syntax(), dkim_getpolicystr(),
dkim_getpresult(), dkim_getpresultstr(),
dkim_set_policy_lookup(), dkim_test_adsp()
LIBOPENDKIM: DKIM_LIBFLAGS_STRICTHDRS now also confirms syntactical
validity of the From field before proceeding with a signing or
verifying operation.
CONTRIB: Fix bug #207: Clean up the "stats" directory.
CONTRIB: Add "repute" directory which could eventually replace the
PHP implementation.
CONTRIB: Patches to systemd and init/redhat.
Log DB error string in dkimf_add_signrequest(), and fix a DSN handling
error in dkimf_db_strerror().
LIBOPENDKIM: Ignore entries in the oversign header field name list
that are empty, and an oversign header field name list that
is present but empty.
LIBOPENDKIM: Allow header field lists to be empty, flushing any that
were previously defined.
BUILD: Improve tests for including <strl.h>.
REPUTATION: Use lowercase for keywords in REPUTE query generation
and handling.
STATS: Clean up a dead link in opendkim-genstats.
2.7.2 2012/11/14
Log the author domain name when rejecting or discarding due to ADSP.
LIBOPENDKIM: Improve re-entrancy of dkim_eoh() when verifying.
LIBOPENDKIM: Only do a single read attempt of a private key under
GNUTLS to avoid hiding a useful error code.
STATS: Add long option support for opendkim-importstats.
STATS: Fix overly-strict domain name rules in opendkim-reportstats.
TOOLS: Fix opendkim-genkey subdomains default.
TOOLS: Fix opendkim-testmsg GNUTLS initialization.
TOOLS: Add ability to assert a reporter ID to opendkim-spam.
TOOLS: Add ability to skip a fixed number of Received: fields.
TOOLS: Print a warning when asked to generate a key smaller than
the recommended minimum.
BUILD: Fix bug #SF3585163: Use a provided libstrl if detected.
BUILD: Portability fixes for Solaris 10 from Claus Assmann and
Leena Heino.
2.7.1 2012/10/30
Fix bug #SF3581657: Fix faulty logic in LDAP open code.
Fix bug #SF3581743: Properly handle NULLs returned from OpenDBX
queries and low field counts in dkimf_db_walk().
In the _FFR_REPUTATION code, free JSON objects when done with them.
TOOLS: Fix argument parsing in new version of opendkim-genkey.
2.7.0 2012/10/24
Feature request #SF2964375: Reject configuration files that have
a SigningTable referencing a missing or malformed KeyTable
entry.
Feature request #SF3544764: Support for libar has been discontinued.
For asynchronous and/or thread-safe resolver service,
use libunbound or a suitable version of BIND.
Feature request #SF3545658: Replace "ResolvConf" with "Nameservers"
and add support for NS list overrides for versions of bind
that have res_setservers(). Also rename "UnboundConfigFile"
to "ResolverConfiguration", and make "TrustAnchorFile"
generally available.
Feature request #SF3547124: Skip reputation checks on passing
signatures whose keys had a "t=y" value.
Feature request #SF3555842: Add "ReputationTest" setting.
Feature request #SF3556439: Update opendkim-atpszone per RFC6541.
Feature request #SF3559744: Add library option DKIM_OPTS_MINKEYBITS
allowing one to specify a minimum number of key bits for
acceptable keys and signatures. This is exposed through new
configuration file option "MinimumKeyBits". The default
is 1024.
Fix bug #SF3536414: Activate _FFR_OVERSIGN, and remove
DKIM_OPTS_ALWAYSHDRS.
Fix bug #SF3536655: Rename "X-Header" to "SoftwareHeader", and rename
all header fields added that start "X-" to remove that prefix,
per RFC6648. The old name will be accepted through the end
of the 2.7.x line.
Fix bug #SF3538896: Remove antiquated CVS Id: tags, which cleans up
some (harmless) build warnings.
Fix bug #SF3548741: Add "ReputationTimeout" for use inside
_FFR_REPUTATION, rather than using the built-in default
or a hard-coded one.
Fix bug #SF3549307: Remove _FFR_REPUTATION_CACHE, as it is redundant
to caching code that's part of _FFR_REPUTATION already.
Fix bug #SF3555844: Get repute client code in sync with repute.php
(and the current REPUTE WG drafts).
Fix bounds checking in the dstring printf functions.
Fix loop structure in the C side of odkim.get_rcpt().
Change all temporary directory defaults from /var/tmp to /tmp.
Activate _FFR_LUA_GLOBALS.
Request the milter permissions required to get _FFR_REDIRECT working.
Add _FFR_REPRRD, which is a second approach to DKIM-based reputation
using round robin databases and Holt-Winters foreacasting
using rrdtool (see http://oss.oetiker.ch/rrdtool/). Still
experimental.
Patch #SF3555843: With sufficient verbosity, report the default
configuration file path. Patch from Andreas Schulze.
BUILD: Fix bug #SF3531658: Move the strlcat() and strlcpy()
implementations to their own library so that programs don't
drag in crypto and other dependencies they don't need.
Also clean up several other unnecessary dependencies imposed
by imprecise use of autoconf.
BUILD: Patch #SF3555845: Add support for older versions of libcurl.
BUILD: Install non-user things in sbin instead of bin.
LIBOPENDKIM: Feature request #SF3565006: Add dkim_add_querymethod()
and dkim_sig_seterror(), define DKIM_CBSTAT_DEFAULT, and
remove an assertion in dkim_get_key_dns(), which together
allow for applications to develop non-standard key retrieval
mechanisms.
LIBOPENDKIM: Fix bug #SF3559080: Log correct domains and selectors
with SSL errors.
LIBOPENDKIM: Add DNS functions dkim_dns_config(), dkim_dns_init(),
dkim_dns_nslist(), dkim_dns_set_init(), dkim_dns_set_close(),
dkim_dns_set_nslist(), dkim_dns_set_config(),
dkim_dns_set_trustanchor(), dkim_dns_trustanchor().
LIBOPENDKIM: Patch #SF3562496: Add DKIM_OPTS_REQUIREDHDRS to allow
alteration of the mandatory header field set.
LIBOPENDKIM: If "q=" is present and method "dns" is specified, it
must be followed by "/txt", per RFC6376.
LIBOPENDKIM: For dkim_add_xtag(), copy the provided values so the
caller doesn't have to keep them around.
LIBOPENDKIM: Allow dual signing of a single body with dkim_resign().
STATS: Fix bug #SF3555847: Add "--nocircles" to opendkim-gengraphs
to allow operation with versions of gnuplot that don't know
what "with circles" means.
STATS: Patch #SF3555841: Temporary table SQL correction.
TOOLS: Feature request #SF3553918: Add "-u" flag to opendkim-atpszone
and opendkim-genzone enabling them to produce output suitable
for use as input to nsupdate(8).
TOOLS: Feature request #SF3558818: Teach opendkim-testkey about the new
"ResolverConfiguration" setting.
TOOLS: Fix bug #SF3565013: Replace opendkim-genkey with a perl script
that knows how to do splitting of character-strings in DNS
TXT records.
TOOLS: Fix bug #SF3568846: Add "-t" to opendkim-testmsg to allow
override of the directory where temporary files go. Also,
clean up temporary files after creating them.
TOOLS: Add opendkim-rephistory.
This should fix PR pkg/47370.
Fix bug #SF3496208: Replace stats/opendkim-genstats with a perl
script so it's far more efficient.
Fix bug #SF3514793: Pass proper flags to libdb when creating
temporary LDAP caches. Problem noted by Sergey Romanov.
Fix a crash bug when using LocalADSP with a message with no
parseable From: field. Problem noted by John Merriam.
Fix a crash bug when using LDAP with authentication when LDAPAuthUser
is not defined.
STATS: Fix bug #SF3510729: Convert stats/opendkim-gengraphs to a perl
script.
2.5.1 2012/03/15
Fix bug #SF3496131: Fix query cache build problem.
Fix bug #SF3500660: Add Date: header field to generated reports.
BUILD: A few subsidiary libraries need to know about -lresolv on
systems that need it. Reported by Scott Kitterman.
STATS: Add "-E" command line flag to opendkim-importstats, forcing
an abort on any input error.
2.5.0 2012/02/29
#####################################################################
### ###
### This release is dedicated to the memory of J.D. Falk, a ###
### tireless champion of anti-abuse technology and collaboration ###
### and a founding member of the Board of the Trusted Domain ###
### Project, a participant in related IETF work, and a long-time ###
### particpant and supporter of MAAWG. J.D. was taken by cancer ###
### on November 16, 2011. His enthusiasm and perspective for ###
### all of this work will be sorely missed. ###
### ###
#####################################################################
Feature request #SF3385816: Discontinue DomainKeys support.
Feature request #SF3393282: Update ARF output per
draft-ietf-marf-authfailure-report-03 et seq.
Feature request #SF3406814: Add ability to invoke chroot().
Feature request #SF3477908: Update DKIM reporting per
draft-ietf-marf-dkim-reporting-10.
Add "WeakSyntaxChecks" suppressing some short-circuiting error checks
on syntax.
Allow a set of test files to be passed via "-t" rather than just one.
Add _FFR_REPUTATION, and several new support libraries (in the
libut/ and reputation/ directories) for doing DKIM-based
reputation evaluations of arriving messages. Full
documentation of the algorithms will appear in an upcoming
white paper. This also includes several new configuration
options that make use of reputation data pulled from servers:
ReputationCache
ReputationCacheTTL
ReputationLimits
ReputationLowTime
ReputationMinimum
ReputationLimitModifiers
ReputationRatios
ReputationSpamCheck
ReputationTimeFactor
For now these are briefly documented in reputation/README.
As this subsystem matures, they will be fully documented in
opendkim.conf(5).
Fix bug #SF3471520: Don't crash when the first line of a configuration
file is an "Include" instruction.
Fix bug #SF3475149: Apply RFC2254 encoding to LDAP queries.
LIBOPENDKIM: Feature request #SF3317160: Per RFC6376, remove
granularity checks.
LIBOPENDKIM: Feature request #SF3385768: Add dkim_privkey_load(),
allowing validation of a private key before reaching
end-of-message.
LIBOPENDKIM: Feature request #SF3423226: Copy header field name lists
instead of using the caller's copy.
LIBOPENDKIM: Update list of header fields that should be signed
per RFC6376.
LIBOPENDKIM: Don't report the absence of "c=" as an error, since
there is a default.
LIBOPENDKIM: Add DKIM_SIG_CHECK() macro. Suggested by Heikki
Gruner.
LIBAR: Fix bug #SF2917856: Rename "ar.h" to "async-resolv.h" since
"ar.h" is already in common use.
STATS: Feature request #SF3397903: Drop all support for data needed
for the DKIM Implementation Report, as it has been completed.
Leave stuff that's useful for reputation R&D.
STATS: Feature request #SF3402857: Modify opendkim-spam to be able
to write update records to statistics files.
STATS: Feature request #SF3439384: Make opendkim-importstats more
backend-agnostic.
TOOLS: Add opendkim-testmsg, for signing/verifying messages without
all the milter code being invoked.
CONTRIB: Add LDAP documentation and examples.
Fix bug #SF3400670: Send ADSP failure reports when rejecting
a message.
Fix bug #SF3419149: Add MaximumSignedBytes to opendkim-config.h.
Fix bug #SF3441240: Appy ReportBccAddress when generating ADSP
reports.
Fix bug #SF3447199: Fix logic preventing the application of the
BodyLengthDB.
Fix Authentication-Results generation with "AddAllSignatureResults"
enabled.
Fix a crash bug when trying to handle certain malformed header fields
in verify-only mode.
Improve error checking in the callback provided to libunbound to
avoid crashes.
Cope with versions of Sleepycat DB that crash when asking for a file
descriptor for in-memory databases.
Don't override "On-NoSignature" when "Quarantine" is set.
Ignore header field names that contain semi-colons, as they produce
syntactically invalid signatures.
LIBOPENDKIM: Fix bug #SF3465400: Don't use "new" as a parameter name
in dkim.h since that's an error for C++.
LIBOPENDKIM: NOERROR is the same as NXDOMAIN for the purposes of
the ADSP existence check. Problem noted by Todd Nagengast.
LIBOPENDKIM: Return DKIM_STAT_SYNTAX from dkim_header() if the header
field name contained a semi-colon.
LIBAR: After computing a timeout, if the fractional seconds portion
adds to exactly a second, convert that amount to seconds.
Previous versions only converted when the fractional portion
exceeded a second. This led to threads that spin
indefinitely. Problem noted by Todd Lyons and Gary Mills;
forensic evidence revealing the problem at long last provided
by Todd Lyons.
STATS: Fix a crash bug in opendkim-importstats due to improper handling
of NULL returns from SQL.
2.4.2
Don't apply BodyLengthDB when not signing.
LIBOPENDKIM: Update for draft-kucherawy-dkim-atps-06.
LIBOPENDKIM: Terminate the strings returned by dkim_sig_getsubstring()
and dkim_sig_getidentity() whenever possible.
CONTRIB: Change "chkconfig" instruction in RHEL init script,
and a minor tweak to the RPM spec file.
2.4.1 2011/06/28
Fix bug #SF3312691: Add "-e" command line switch to extract a value
from configuration.
Fix bug #SF3324488: Accommodate postfix's job ID generation by moving
the BodyLengthDB check down to EOH.
Fix bug #SF3327106: Fix mode-based short-circuit logic.
Patch #SF3321766: Remove "-d" from usage message (not implemented).
Print database error strings instead of just return codes in
query test mode, and clean up error strings when extracting
them from the layers below.
Minor fixes related to use of OpenDBX.
LIBOPENDKIM: Fix bug #SF3328330: Correct generation of "z=" tags.
LIBOPENDKIM: Patch #SF3313534: Improve thread-safe use of OpenSSL
in dkim_init() and dkim_free().
LIBOPENDKIM: Patch #SF3314269: Change all uses of off_t to ssize_t,
as the former is reserved for use with filesystem APIs.
LIBOPENDKIM: Make the user context pointer (void) rather than
(const void) since the caller is allowed to change it.
LIBOPENDKIM: Proper handling of DKIM_CBSTAT_ERROR from the prescreen
and final callbacks.
LIBOPENDKIM: Fix up initialization under _FFR_OVERSIGN.
BUILD: Adjust gprof code to accomodate systems that put profiling
output in <binary>.gmon rather than gmon.out.
2.4.0 2011/06/06
Feature request #SF3060140: Extension of odkim.sign() to include
maximum signed byte count.
Feature request #SF3171865: Add _FFR_LUA_GLOBALS, enabling a
mechanism to maintain state between Lua scripts.
Feature request #SF3241982: Optionally add an Authentication-Results
field for all signatures present, not just the first good one.
Feature request #SF3256630: Add _FFR_RATE_LIMIT, enabling hooks for
post-verification rate controls.
Feature request #SF3290461: Add optional support for querying a
memcache daemon via libmemcached.
Feature request #SF3299041: Be tougher on use of the "l=" tag by
removing "BodyLengths", renaming "BodyLengthDBFile" to
"BodyLengthDB", and allowing pattern matches. This
effectively activates _FFR_BODYLENGTH_DB as well.
Feature request #SF3303911: Add "DisableADSP" setting.
In the stats recording code, only check for a domain match for
signatures that don't have errors (i.e., short circuit if
sigerror is not zero).
LIBOPENDKIM: Feature request #SF2969516: Teach dkim_chunk() about
DKIM_LIBFLAGS_FIXCRLF.
LIBOPENDKIM: Feature request #SF3123731: Extend FixCRLF to cover
header fields.
LIBOPENDKIM: Feature request #SF3151534: Extract DKIM reputation
support to its own library.
LIBOPENDKIM: Feature request #SF3279589: Add _FFR_XTAGS, adding
support for generic extension tags in signatures.
LIBOPENDKIM: Feature request #SF3300738: Add dkim_sig_getqueries()
and dkim_policy_getqueries() to assist API consumers that
have their own DNS mechanisms not directly adaptable to ours.
LIBOPENDKIM: Return an error from dkim_getsighdr() or
dkim_getsighdr_d() if called after a key load failure.
LIBAR: Check that the descriptor's write socket is writable before
calling ar_sendquery() when trying to identify open requests
that need retransmission.
STATS: Feature request #SF3066106: Add "opendkim-anonstats" tool.
CONTRIB: Paths in init/redhat/opendkim are now auto-generated.
Activate _FFR_MAXVERIFY.
Fix bug #SF3067338: Create a pool of DB handles for SQL operations
so that queries don't all share one serially.
Fix bug #SF3156559: Don't compile Lua scripts anew for each execution.
Fix bug #SF3210385: Fix issue with configuration reload failures
having some side effects on the remaining active configuration
handle. Reported by Andreas Schulze.
Fix bug #SF3235131: Don't report ADSP errors as signature errors
in Authentication-Results header fields.
Fix bug #SF3258459: Don't send progress messages during EOH. Problem
reported by Gary Mills.
Fix bug #SF3276469: When generating "z=" tags, apply omit and sign
header field lists. Problem noted by Todd Lyons.
Add ADSP processing error information to A-R header fields.
LIBOPENDKIM: Use a time_t to store TTL and clock drift options
rather than unsigned long. Patch from Piotr Sikora.
LIBAR: Include class and type in debugging messages. Suggested
by Gary Mills.
LIBAR: Start the dispatcher on the first query, not in ar_init().
Allows ar_init() to be called before a fork() safely.
CONTRIB: Adjust installed path in RedHat start script. Patch
from Naresh V.
CONTRIB: Require the current libopendkim in the opendkim definition
in the RPM spec file. Patch from Naresh V.
2.3.1 2011/03/28
Feature request #SF3196060: Log retrieved reputation values.
Patch from Andreas Schulze.
Feature request #SF3199824: Don't log "no signature data" unless
LogWhy is enabled or the action for unsigned mail is something
other than "accept".
Fix bug #SF3196069: Log more detail when dkimf_config_setlib() fails.
Problem noted by Andreas Schulze.
Fix bug #SF3197890: Update ARF report format for DKIM verification
failures to use what's in draft-ietf-dkim-marf-reporting.
Fix bug #SF3204725: Add "ReplaceHeaders" data set to constrain what
header fields are affected by "ReplaceRules". Problem
noted by Chris Callegari.
Fix bug #SF3211114: Extract "BaseDirectory" from configuration
file properly.
Fix bug #SF3234178: Correct handling of a KeyTable entry for which the
key data is empty. Based on a patch from Yoshiaki Yanagihara.
Patch #SF3205699: Make all header field name and domain name data
sets case insensitive. Submitted by Richard Rognlie.
Add a case-insensitivity flag to odkim.db_open().
Minor correction to DNS function return codes for unbound, which
doesn't have an expired/no-reply distinction like libar does.
LIBOPENDKIM: Fix up timeout handling with a DNS callback is in use.
LIBOPENDKIM: Update for draft-kucherawy-dkim-atps-03.
STATS: Fix bug #SF3195449: Omit data from reporters that are not
currently marked "enabled" in the reporters table.
STATS: Evaluate "i=" against the "d=" domain, not the "From" domain.
Problem noted by Mark Martinec.
STATS: A few more reports.
MILTERTEST: Don't use non-standard printf() conversions.
MILTERTEST: Get the SMFIP_HDR_LEADSPC logic right.
TOOLS: Feature request #SF3200848: Add a backgrounding option
(on by default) to opendkim-spam.
Mail) sender authentication system proposed by the E-mail Signing Technology
Group (ESTG), now standardized by the IETF (RFC4871). It also includes
implementations of the Author Domain Signing Practises (ADSP, RFC5617) and
Vouch By Reference (VBR, RFC5518) proposed standards.
The project started from a code fork of version 2.8.3 of the open source
dkim-milter package developed and maintained by Sendmail, Inc.
pettai
adam