diff --git a/AUTHORS b/AUTHORS index df9d543..5c9ad9e 100644 --- a/AUTHORS +++ b/AUTHORS @@ -21,3 +21,8 @@ websites for further details. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/). + +Translations +------------ +Thanks to Per-Arne Christensen for the Norwegian translation of +the GUI. diff --git a/ChangeLog b/ChangeLog index c8edbf9..cbf3ae9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,11 +1,12 @@ E-MailRelay Change Log ====================== -2.2 -> 2.2.1 ------------- +2.2 -> 2.3 +---------- * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). * Windows event log not used for verbose logging (prefer "--log-file"). * New admin 'forward' command to trigger forwarding without waiting. +* Optional base64 encoding of passwords in secrets files ("plain:b"). * Support for MbedTLS version 3. 2.1 -> 2.2 diff --git a/Makefile.am b/Makefile.am index 0ec2fa3..4b011a5 100644 --- a/Makefile.am +++ b/Makefile.am @@ -22,7 +22,7 @@ # Additional pseudo-targets: # * rpm - builds an rpm package using rpmbuild # * deb - builds a deb package using debhelper -# * cmake - generates simplistic cmake files under ./build/ +# * cmake - generates cmake files under ./build/ # * tidy - runs cmake-tidy # * format - runs cmake-format # @@ -41,7 +41,7 @@ # $ sudo make deb # # and possibly: -# $ make cmake ; cd build ; make +# $ make cmake ; make -C build # $ make tidy TIDY=clang-tidy-10 # $ make format FORMAT=clang-format-10 # $ make distcheck DISTCHECK_CONFIGURE_FLAGS=--disable-testing @@ -126,6 +126,7 @@ format: cmake: @chmod +x bin/make2cmake || true bin/make2cmake - mkdir build || true + test -d build || mkdir build cd build && cmake -DCMAKE_MAKE_PROGRAM:FILEPATH=/usr/bin/make -DCMAKE_EXPORT_COMPILE_COMMANDS=ON .. + @echo now run make from the '"build"' directory diff --git a/Makefile.in b/Makefile.in index 54124f9..e24e46a 100644 --- a/Makefile.in +++ b/Makefile.in @@ -24,7 +24,7 @@ # Additional pseudo-targets: # * rpm - builds an rpm package using rpmbuild # * deb - builds a deb package using debhelper -# * cmake - generates simplistic cmake files under ./build/ +# * cmake - generates cmake files under ./build/ # * tidy - runs cmake-tidy # * format - runs cmake-format # @@ -43,7 +43,7 @@ # $ sudo make deb # # and possibly: -# $ make cmake ; cd build ; make +# $ make cmake ; make -C build # $ make tidy TIDY=clang-tidy-10 # $ make format FORMAT=clang-format-10 # $ make distcheck DISTCHECK_CONFIGURE_FLAGS=--disable-testing @@ -952,8 +952,9 @@ format: cmake: @chmod +x bin/make2cmake || true bin/make2cmake - mkdir build || true + test -d build || mkdir build cd build && cmake -DCMAKE_MAKE_PROGRAM:FILEPATH=/usr/bin/make -DCMAKE_EXPORT_COMPILE_COMMANDS=ON .. + @echo now run make from the '"build"' directory # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. diff --git a/NEWS b/NEWS index 3cd8551..d0d4d31 100644 --- a/NEWS +++ b/NEWS @@ -1,28 +1,5 @@ News ---- -E-MailRelay 2.2 is now fully C++11, so older compilers will not work unless -they have a "-std=c++11" option or similar, and this also means that -"uclibc++" is no longer supported. - -The behaviour with respect to the "--remote-clients" command-line option is -changed in this release: previously IPv4 connections were allowed only from -the host's local address, as determined by a DNS lookup, unless using -"--remote-clients". The new implementation allows connections from any -loopback or 'private use' address, defined in RFC-1918 and RFC-5735. This -brings the IPv4 behaviour in line with IPv6, and it still honours the intent -of the "--remote-clients" option in protecting the naive user against -accidental exposore to the public internet. - -Some internationalisation support has been added, using gettext() for the -main program and Qt's tr() for the GUI. See "doc/developer.txt". - -A systemd unit file has been added, although by default it is only installed -as an "examples" file. Use "e_systemddir=/usr/lib/systemd/system" on the -"./configure" command-line to have it installed by "make install". - -This release has a new "make tidy" option that runs "clang-tidy" over the -code and also "make cmake" to generate simple cmake files for a unix build. - -Version 2.2.1 adds support for unix-domain sockets. - -Thanks to Per-Arne Christensen for the Norwegian translation of the GUI. +Version 2.3 is a relatively minor release. The main functional change is to +support unix domain sockets. Non-functional code changes include better +separation of interface and implementation in the SMTP message store. diff --git a/VERSION b/VERSION index c043eea..bb576db 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.2.1 +2.3 diff --git a/bin/AutoMakeParser.pm b/bin/AutoMakeParser.pm index 15fc9dc..8dadd3b 100644 --- a/bin/AutoMakeParser.pm +++ b/bin/AutoMakeParser.pm @@ -298,7 +298,7 @@ sub simplepath for my $x ( @split ) { next if( $x eq "" || $x eq "." ) ; - if( $x eq ".." && scalar(@out) && @out[-1] ne ".." ) + if( $x eq ".." && scalar(@out) && $out[-1] ne ".." ) { pop @out ; } diff --git a/bin/doxygen.sh b/bin/doxygen.sh old mode 100644 new mode 100755 diff --git a/bin/emailrelay-bcc-check.pl b/bin/emailrelay-bcc-check.pl index 3d0adc6..a549234 100755 --- a/bin/emailrelay-bcc-check.pl +++ b/bin/emailrelay-bcc-check.pl @@ -30,7 +30,7 @@ use strict ; use FileHandle ; $SIG{__DIE__} = sub { (my $e = join(" ",@_)) =~ s/\n/ /g ; print "<>\n" ; exit 99 } ; -my $content = @ARGV[0] or die "usage error\n" ; +my $content = $ARGV[0] or die "usage error\n" ; my $verbose = 1 ; # read the bcc list from the content file diff --git a/bin/emailrelay-deliver.sh.in b/bin/emailrelay-deliver.sh.in index a3120cd..09a3e1c 100644 --- a/bin/emailrelay-deliver.sh.in +++ b/bin/emailrelay-deliver.sh.in @@ -20,7 +20,6 @@ # setup. # - store="__SPOOL_DIR__" postmaster="root" procmail="procmail" diff --git a/bin/emailrelay-rot13.pl b/bin/emailrelay-rot13.pl index ffe2a70..68159eb 100755 --- a/bin/emailrelay-rot13.pl +++ b/bin/emailrelay-rot13.pl @@ -31,7 +31,7 @@ while(<$fh_in>) if( $in_header && ( $line =~ m/^\s/ ) && scalar(@headers) ) # folding { - @headers[-1] .= "\r\n$line" ; + $headers[-1] .= "\r\n$line" ; } elsif( $in_header && ( $line =~ m/^$/ ) ) { diff --git a/bin/emailrelay-set-from.pl b/bin/emailrelay-set-from.pl index 9790e49..f537a9a 100755 --- a/bin/emailrelay-set-from.pl +++ b/bin/emailrelay-set-from.pl @@ -25,7 +25,7 @@ my $new_from = 'noreply@example.com' ; my $new_sender = '' ; my $new_reply_to = $new_from ; -my $content = @ARGV[0] or die "usage error\n" ; +my $content = $ARGV[0] or die "usage error\n" ; my $in = new FileHandle( $content , "r" ) or die ; my $out = new FileHandle( "$content.tmp" , "w" ) or die ; diff --git a/bin/make-format b/bin/make-format index aafdec3..435d7d3 100755 --- a/bin/make-format +++ b/bin/make-format @@ -177,9 +177,9 @@ sub fixup } # add some more whitespace - $line =~ s:(\S);$:\1 ;: ; - $line =~ s:(\S); //(.*):\1 ; //\2: ; - $line =~ s:(\S),:\1 ,:g unless ( $line =~ m/["']/ or $line =~ m://.*,: ) ; + $line =~ s:(\S);$:$1 ;: ; + $line =~ s:(\S); //(.*):$1 ; //$2: ; + $line =~ s:(\S),:$1 ,:g unless ( $line =~ m/["']/ or $line =~ m://.*,: ) ; print $fh_out $line , "\n" or die ; } diff --git a/bin/winbuild.pm b/bin/winbuild.pm index 2cd9a1f..34a1d81 100644 --- a/bin/winbuild.pm +++ b/bin/winbuild.pm @@ -353,7 +353,8 @@ sub create_touchfile sub read_makefiles { my ( $switches , $vars ) = @_ ; - return AutoMakeParser::readall( "." , $switches , $vars , 1 ) ; + my $verbose = 1 ; + return AutoMakeParser::readall( "." , $switches , $vars , $verbose ) ; } sub cache_value diff --git a/bootstrap b/bootstrap old mode 100644 new mode 100755 diff --git a/configure b/configure index 1fbdf65..3207ae7 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for E-MailRelay 2.2.1. +# Generated by GNU Autoconf 2.69 for E-MailRelay 2.3. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. @@ -577,8 +577,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='E-MailRelay' PACKAGE_TARNAME='emailrelay' -PACKAGE_VERSION='2.2.1' -PACKAGE_STRING='E-MailRelay 2.2.1' +PACKAGE_VERSION='2.3' +PACKAGE_STRING='E-MailRelay 2.3' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -657,8 +657,6 @@ GCONFIG_TESTING_FALSE GCONFIG_TESTING_TRUE GCONFIG_MAC_FALSE GCONFIG_MAC_TRUE -GCONFIG_IPV6_FALSE -GCONFIG_IPV6_TRUE GCONFIG_INTERFACE_NAMES_FALSE GCONFIG_INTERFACE_NAMES_TRUE GCONFIG_INSTALL_HOOK_FALSE @@ -796,7 +794,6 @@ enable_epoll enable_gui enable_install_hook enable_interface_names -enable_ipv6 enable_mac enable_std_thread enable_testing @@ -1378,7 +1375,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures E-MailRelay 2.2.1 to adapt to many kinds of systems. +\`configure' configures E-MailRelay 2.3 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1445,7 +1442,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of E-MailRelay 2.2.1:";; + short | recursive ) echo "Configuration of E-MailRelay 2.3:";; esac cat <<\_ACEOF @@ -1473,7 +1470,6 @@ Optional Features: --enable-interface-names allow network interface names for defining listening addresses (default yes) - --enable-ipv6 enable ipv6 (default auto) --enable-mac enable building for mac os x (default auto) --enable-std-thread use std::thread or not (default auto) --enable-testing enable make check tests (default yes) @@ -1579,7 +1575,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -E-MailRelay configure 2.2.1 +E-MailRelay configure 2.3 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2015,7 +2011,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by E-MailRelay $as_me 2.2.1, which was +It was created by E-MailRelay $as_me 2.3, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2880,7 +2876,7 @@ fi # Define the identity of the package. PACKAGE='emailrelay' - VERSION='2.2.1' + VERSION='2.3' # Some tools Automake needs. @@ -9368,52 +9364,6 @@ else fi -# Check whether --enable-ipv6 was given. -if test "${enable_ipv6+set}" = set; then : - enableval=$enable_ipv6; -fi - - - if test "$enable_ipv6" = "no" - then - gconfig_use_ipv6="no" - else - if test "$gconfig_cv_ipv6" = "no" - then - if test "$enable_ipv6" = "yes" - then - { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: ignoring --enable-ipv6" >&5 -$as_echo "$as_me: WARNING: ignoring --enable-ipv6" >&2;} - fi - gconfig_use_ipv6="no" - else - gconfig_use_ipv6="yes" - fi - fi - - if test "$enable_ipv6" != "no" -a "$gconfig_use_ipv6" = "no" - then - gconfig_warnings="$gconfig_warnings ipv6_ipv6_networking" - fi - - if test "$gconfig_use_ipv6" = "yes" ; then - -$as_echo "#define GCONFIG_ENABLE_IPV6 1" >>confdefs.h - - else - -$as_echo "#define GCONFIG_ENABLE_IPV6 0" >>confdefs.h - - fi - if test "$gconfig_use_ipv6" = "yes"; then - GCONFIG_IPV6_TRUE= - GCONFIG_IPV6_FALSE='#' -else - GCONFIG_IPV6_TRUE='#' - GCONFIG_IPV6_FALSE= -fi - - # Check whether --enable-mac was given. if test "${enable_mac+set}" = set; then : enableval=$enable_mac; @@ -10337,10 +10287,6 @@ if test -z "${GCONFIG_INTERFACE_NAMES_TRUE}" && test -z "${GCONFIG_INTERFACE_NAM as_fn_error $? "conditional \"GCONFIG_INTERFACE_NAMES\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi -if test -z "${GCONFIG_IPV6_TRUE}" && test -z "${GCONFIG_IPV6_FALSE}"; then - as_fn_error $? "conditional \"GCONFIG_IPV6\" was never defined. -Usually this means the macro was only invoked conditionally." "$LINENO" 5 -fi if test -z "${GCONFIG_MAC_TRUE}" && test -z "${GCONFIG_MAC_FALSE}"; then as_fn_error $? "conditional \"GCONFIG_MAC\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 @@ -10782,7 +10728,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by E-MailRelay $as_me 2.2.1, which was +This file was extended by E-MailRelay $as_me 2.3, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -10848,7 +10794,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -E-MailRelay config.status 2.2.1 +E-MailRelay config.status 2.3 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index d04917d..b3a5ef2 100755 --- a/configure.ac +++ b/configure.ac @@ -19,7 +19,7 @@ dnl dnl Process this file with autoconf to produce a configure script. dnl -AC_INIT([E-MailRelay],[2.2.1],[],[emailrelay]) +AC_INIT([E-MailRelay],[2.3],[],[emailrelay]) AC_CONFIG_SRCDIR([src/glib/gdef.h]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE([no-define]) @@ -90,8 +90,6 @@ AC_ARG_ENABLE([install-hook],AS_HELP_STRING([--enable-install-hook],[enable fixi GCONFIG_FN_ENABLE_INSTALL_HOOK AC_ARG_ENABLE([interface-names],AS_HELP_STRING([--enable-interface-names],[allow network interface names for defining listening addresses (default yes)])) GCONFIG_FN_ENABLE_INTERFACE_NAMES -AC_ARG_ENABLE([ipv6],AS_HELP_STRING([--enable-ipv6],[enable ipv6 (default auto)])) -GCONFIG_FN_ENABLE_IPV6 AC_ARG_ENABLE([mac],AS_HELP_STRING([--enable-mac],[enable building for mac os x (default auto)])) GCONFIG_FN_ENABLE_MAC AC_ARG_ENABLE([std-thread],AS_HELP_STRING([--enable-std-thread],[use std::thread or not (default auto)])) diff --git a/configure.sh b/configure.sh index a26b2d1..663ff2b 100755 --- a/configure.sh +++ b/configure.sh @@ -117,10 +117,10 @@ then fi if test -d "$MBEDTLS_DIR" then - echo "configure.sh: mbedtls directory exists: adding --with-mbedtls and CPPFLAGS=-I$MBEDTLS_DIR/include etc" + echo "configure.sh: mbedtls directory exists: adding --with-mbedtls and CXXFLAGS=-I$MBEDTLS_DIR/include etc" with_mbedtls="--with-mbedtls" make_mbedtls=1 - export CPPFLAGS="$CPPFLAGS -I`pwd`/$MBEDTLS_DIR/include" + export CXXFLAGS="$CXXFLAGS -I`pwd`/$MBEDTLS_DIR/include" export LDFLAGS="$LDFLAGS -L`pwd`/$MBEDTLS_DIR/library" fi @@ -139,7 +139,7 @@ then export GCONFIG_WINDMC="$TARGET-windmc" export GCONFIG_WINDRES="$TARGET-windres" export CXXFLAGS="$CXXFLAGS -std=c++11 -pthread" - #export CPPFLAGS="$CPPFLAGS -D_WIN32_WINNT=0x0501" eg. for Windows XP, otherwise whatever mingw defaults to + #export CXXFLAGS="$CXXFLAGS -D_WIN32_WINNT=0x0501" eg. for Windows XP, otherwise whatever mingw defaults to export LDFLAGS="$LDFLAGS -pthread" if test -x "`which $CXX`" ; then : ; else echo "error: no mingw c++ compiler: [$CXX]\n" ; exit 1 ; fi ( echo msbuild . ; echo qt-x86 . ; echo qt-x64 . ; echo cmake . ; echo msvc . ) > winbuild.cfg @@ -184,35 +184,35 @@ then : elif test "0$opt_openwrt" -eq 1 then - TARGET="mips-openwrt-linux-musl" - SDK_DIR="`find $HOME -maxdepth 3 -type d -iname openwrt-sdk\* 2>/dev/null | sort | head -1`" - SDK_TOOLCHAIN_DIR="`find \"$SDK_DIR/staging_dir\" -type d -iname toolchain-\* 2>/dev/null | sort | head -1`" - SDK_TARGET_DIR="`find \"$SDK_DIR/staging_dir\" -type d -iname target-\* 2>/dev/null | sort | head -1`" - export CC="$SDK_TOOLCHAIN_DIR/bin/$TARGET-gcc" - export CXX="$SDK_TOOLCHAIN_DIR/bin/$TARGET-c++" - export AR="$SDK_TOOLCHAIN_DIR/bin/$TARGET-ar" - export STRIP="$SDK_TOOLCHAIN_DIR/bin/$TARGET-strip" - export CXXFLAGS="-fno-rtti -fno-threadsafe-statics -Os $CXXFLAGS" - export CPPFLAGS="$CPPFLAGS -DG_SMALL" + TARGET="mips-openwrt-linux-musl" + SDK_DIR="`find $HOME -maxdepth 3 -type d -iname openwrt-sdk\* 2>/dev/null | sort | head -1`" + SDK_TOOLCHAIN_DIR="`find \"$SDK_DIR/staging_dir\" -type d -iname toolchain-\* 2>/dev/null | sort | head -1`" + SDK_TARGET_DIR="`find \"$SDK_DIR/staging_dir\" -type d -iname target-\* 2>/dev/null | sort | head -1`" + export CC="$SDK_TOOLCHAIN_DIR/bin/$TARGET-gcc" + export CXX="$SDK_TOOLCHAIN_DIR/bin/$TARGET-c++" + export AR="$SDK_TOOLCHAIN_DIR/bin/$TARGET-ar" + export STRIP="$SDK_TOOLCHAIN_DIR/bin/$TARGET-strip" + export CXXFLAGS="-fno-rtti -fno-threadsafe-statics -Os $CXXFLAGS" + export CXXFLAGS="$CXXFLAGS -DG_SMALL" export LDFLAGS="$LDFLAGS -static" export LIBS="-lgcc_eh" if test -x "$CXX" ; then : ; else echo "error: no c++ compiler for target [$TARGET]: CXX=[$CXX]\n" ; exit 1 ; fi - $thisdir/configure $enable_debug --host $TARGET \ + $thisdir/configure $enable_debug --host $TARGET \ --disable-gui --without-pam --without-doxygen \ $with_mbedtls --disable-std-thread \ --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc \ --localstatedir=/var $opt_passthrough e_initdir=/etc/init.d "$@" echo : echo "build with..." - #echo " export PATH=\"$SDK_TOOLCHAIN_DIR/bin:\$PATH\"" - #echo " export STAGING_DIR=\"$SDK_DIR/staging_dir\"" + #echo " export PATH=\"$SDK_TOOLCHAIN_DIR/bin:\$PATH\"" + #echo " export STAGING_DIR=\"$SDK_DIR/staging_dir\"" test "$make_mbedtls" -eq 1 && echo " make -C $MBEDTLS_DIR/library CC=$CC AR=$AR" echo " make" echo " make -C src/main strip" : elif test "`uname`" = "NetBSD" then - export CPPFLAGS="$CPPFLAGS -I/usr/X11R7/include" + export CXXFLAGS="$CXXFLAGS -I/usr/X11R7/include" export LDFLAGS="$LDFLAGS -L/usr/X11R7/lib" $thisdir/configure $enable_debug $with_mbedtls \ --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc \ @@ -220,7 +220,7 @@ then : elif test "`uname`" = "FreeBSD" then - export CPPFLAGS="$CPPFLAGS -I/usr/local/include -I/usr/local/include/libav" + export CXXFLAGS="$CXXFLAGS -I/usr/local/include -I/usr/local/include/libav" export LDFLAGS="$LDFLAGS -L/usr/local/lib -L/usr/local/lib/libav" $thisdir/configure $enable_debug $with_mbedtls \ --prefix=/usr/local --mandir=/usr/local/man \ @@ -228,7 +228,7 @@ then : elif test "`uname`" = "OpenBSD" then - export CPPFLAGS="$CPPFLAGS -I/usr/X11R6/include" + export CXXFLAGS="$CXXFLAGS -I/usr/X11R6/include" export LDFLAGS="$LDFLAGS -L/usr/X11R6/lib" $thisdir/configure $enable_debug $with_mbedtls \ --prefix=/usr/local --mandir=/usr/local/man \ @@ -236,14 +236,14 @@ then : elif test "`uname`" = "Darwin" then - export CPPFLAGS="$CPPFLAGS -I/opt/local/include -I/opt/X11/include" + export CXXFLAGS="$CXXFLAGS -I/opt/local/include -I/opt/X11/include" export LDFLAGS="$LDFLAGS -L/opt/local/lib -L/opt/X11/lib" $thisdir/configure $enable_debug $with_mbedtls \ --prefix=/opt/local --mandir=/opt/local/man $opt_passthrough "$@" : elif test "`uname`" = "Linux" then - export CPPFLAGS + export CXXFLAGS export LDFLAGS $thisdir/configure $enable_debug $with_mbedtls \ --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc \ @@ -251,7 +251,7 @@ then $opt_passthrough e_rundir=/run/emailrelay "$@" : else - export CPPFLAGS="$CPPFLAGS -I/usr/X11R7/include -I/usr/X11R6/include -I/usr/local/include -I/opt/local/include -I/opt/X11/include" + export CXXFLAGS="$CXXFLAGS -I/usr/X11R7/include -I/usr/X11R6/include -I/usr/local/include -I/opt/local/include -I/opt/X11/include" export LDFLAGS="$LDFLAGS -L/usr/X11R7/lib -L/usr/X11R6/lib -L/usr/local/lib -L/opt/local/lib -L/opt/X11/lib" $thisdir/configure $enable_debug $with_mbedtls $opt_passthrough "$@" fi diff --git a/debian/changelog b/debian/changelog index 293fd35..0a024f8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,7 +1,8 @@ -emailrelay (2.2.1) unstable; urgency=low +emailrelay (2.3) unstable; urgency=low * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). * Windows event log not used for verbose logging (prefer "--log-file"). * New admin 'forward' command to trigger forwarding without waiting. + * Optional base64 encoding of passwords in secrets files ("plain:b"). * Support for MbedTLS version 3. -- maintainer graeme_walker Tue, 14 Feb 2022 00:00:00 +0000 @@ -27,7 +28,7 @@ emailrelay (2.1) unstable; urgency=low * New "--idle-timeout" option for server-side connections. * Support for RFC-5782 DNSBL blocking ("--dnsbl"). * Filter scripts are given the path of the envelope file in argv2. - * Message files can be editied by "--client-filter" scripts. + * Message files can be edited by "--client-filter" scripts. * Better support for CRAM-SHAx authentication. * New "--client-auth-config" and "--server-auth-config" options. * New "--show" option on windows to better control the user interface style. diff --git a/debian/postinst b/debian/postinst index a2f33b1..9de64ae 100644 --- a/debian/postinst +++ b/debian/postinst @@ -27,7 +27,7 @@ emailrelay_fix_html() emailrelay_create_config() { - if test ! -f /etc/emailrelay.conf -a -f /etc/emailrelay.conf.template + if test ! -e /etc/emailrelay.conf -a -f /etc/emailrelay.conf.template then cp /etc/emailrelay.conf.template /etc/emailrelay.conf fi diff --git a/doc/changelog.html b/doc/changelog.html index a11da41..bd5062b 100644 --- a/doc/changelog.html +++ b/doc/changelog.html @@ -9,11 +9,12 @@

E-MailRelay Change Log

-

2.2 -> 2.2.1

+

2.2 -> 2.3

  • Unix domain sockets supported (eg. --interface=/tmp/smtp.s.
  • Windows event log not used for verbose logging (prefer --log-file).
  • New admin forward command to trigger forwarding without waiting.
    • +
  • Optional base64 encoding of passwords in secrets files (plain:b).
  • Support for MbedTLS version 3.

2.1 -> 2.2

diff --git a/doc/changelog.md b/doc/changelog.md index 398e380..ec4e9dc 100644 --- a/doc/changelog.md +++ b/doc/changelog.md @@ -1,12 +1,13 @@ E-MailRelay Change Log ====================== -2.2 -> 2.2.1 ------------- +2.2 -> 2.3 +---------- * Unix domain sockets supported (eg. `--interface=/tmp/smtp.s`). * Windows event log not used for verbose logging (prefer `--log-file`). * New admin `forward` command to trigger forwarding without waiting. +* Optional base64 encoding of passwords in secrets files (`plain:b`). * Support for MbedTLS version 3. 2.1 -> 2.2 @@ -34,7 +35,7 @@ E-MailRelay Change Log * New `--idle-timeout` option for server-side connections. * Support for [RFC-5782][] [DNSBL][] blocking (`--dnsbl`). * Filter scripts are given the path of the envelope file in argv2. -* Message files can be editied by `--client-filter` scripts. +* Message files can be edited by `--client-filter` scripts. * Better support for CRAM-SHAx authentication. * New `--client-auth-config` and `--server-auth-config` options. * New `--show` option on windows to better control the user interface style. diff --git a/doc/changelog.rst b/doc/changelog.rst index 241978f..3312174 100644 --- a/doc/changelog.rst +++ b/doc/changelog.rst @@ -2,12 +2,13 @@ E-MailRelay Change Log ********************** -2.2 -> 2.2.1 -============ +2.2 -> 2.3 +========== * Unix domain sockets supported (eg. *--interface=/tmp/smtp.s*). * Windows event log not used for verbose logging (prefer *--log-file*). * New admin *forward* command to trigger forwarding without waiting. +* Optional base64 encoding of passwords in secrets files (*plain:b*). * Support for MbedTLS version 3. 2.1 -> 2.2 diff --git a/doc/changelog.txt b/doc/changelog.txt index 242e721..a2cb5eb 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -1,11 +1,12 @@ E-MailRelay Change Log ====================== -2.2 -> 2.2.1 ------------- +2.2 -> 2.3 +---------- * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). * Windows event log not used for verbose logging (prefer "--log-file"). * New admin "forward" command to trigger forwarding without waiting. +* Optional base64 encoding of passwords in secrets files ("plain:b"). * Support for MbedTLS version 3. 2.1 -> 2.2 diff --git a/doc/conf.py.sphinx b/doc/conf.py.sphinx index c7bae5d..d02c370 100644 --- a/doc/conf.py.sphinx +++ b/doc/conf.py.sphinx @@ -7,10 +7,10 @@ templates_path = ['_templates'] source_suffix = '.rst' master_doc = 'index' project = u'E-MailRelay' -copyright = u'2021, Graeme Walker' +copyright = u'2022, Graeme Walker' author = u'Graeme Walker' -version = u'2.2' -release = u'2.2' +version = u'2.3' +release = u'2.3' language = None today_fmt = '%Y-%m-%d' exclude_patterns = [] diff --git a/doc/emailrelay-man.html b/doc/emailrelay-man.html index 24dd93d..0a43183 100644 --- a/doc/emailrelay-man.html +++ b/doc/emailrelay-man.html @@ -195,7 +195,7 @@ Displays help text and then exits. Use with --verbose for more complete o
-H, --hidden
-Windows only. Hides the application window and disables all message boxes, overriding any --show option. This is useful when running as a windows service. +Windows only. Hides the application window and disables all message boxes, overriding any --show option. This is useful when running as a windows service.
--idle-timeout <time>
@@ -211,7 +211,7 @@ Specifies the IP network addresses or interface names used to bind listening por
--localedir <dir>
-Specifies a locale base directory where localisation message catalogues can be found. An empty directory can be used for the built-in default. +Enables localisation and specifies the locale base directory where message catalogues can be found. An empty directory can be used for the built-in default.
-l, --log
@@ -331,7 +331,7 @@ Selects and configures the low-level TLS library, using a comma-separated list o
-u, --user <username>
-When started as root the program switches to an non-privileged effective user-id when idle. This option can be used to define which user-id is used. Specify root to disable all user-id switching. Ignored on Windows. +When started as root the program switches to a non-privileged effective user-id when idle. This option can be used to define the idle user-id and also the group ownership of new files and sockets. Specify root to disable all user-id switching. Ignored on Windows.
-v, --verbose
@@ -366,7 +366,8 @@ Graeme Walker, mailto:graem
This document was created by -man2html, +man2html, using the manual pages.
+ diff --git a/doc/emailrelay.1 b/doc/emailrelay.1 index 0706a65..3bb3d6b 100644 --- a/doc/emailrelay.1 +++ b/doc/emailrelay.1 @@ -146,7 +146,7 @@ Allow forwarding to continue even if some recipient addresses on an e-mail envel Displays help text and then exits. Use with \fI--verbose\fR for more complete output. .TP .B \-H, --hidden -Windows only. Hides the application window and disables all message boxes, overriding any \fI\fR\fI--show\fR\fI\fR option. This is useful when running as a windows service. +Windows only. Hides the application window and disables all message boxes, overriding any \fI--show\fR option. This is useful when running as a windows service. .TP .B --idle-timeout \fI
--localedir <dir>
- Specifies a locale base directory where localisation message catalogues can - be found. An empty directory can be used for the built-in default. + Enables localisation and specifies the locale base directory where message + catalogues can be found. An empty directory can be used for the built-in + default.
--log (-l)
@@ -437,9 +438,10 @@
--user <username> (-u)
- When started as root the program switches to an non-privileged effective - user-id when idle. This option can be used to define which user-id is used. - Specify root to disable all user-id switching. Ignored on Windows. + When started as root the program switches to a non-privileged effective + user-id when idle. This option can be used to define the idle user-id and + also the group ownership of new files and sockets. Specify root to + disable all user-id switching. Ignored on Windows.
--verbose (-v)
@@ -503,7 +505,7 @@
  • as each message is submitted, just before receipt is acknowledged (--immediate)
  • as soon as the submitting client connection disconnects (--forward-on-disconnect)
  • periodically (--poll=)
    • -
  • on demand using the administration interface's flush command (--admin=)
    • +
  • on demand using the administration interface's forward command (--admin=)
  • when a --filter script exits with an exit code of 103
    • @@ -753,13 +755,20 @@ emailrelay --as-client=example.com:smtp --client-auth=/etc/emailrelay-server.aut

    - The first two fields are case-insensitive. The xtext encoding scheme is - defined properly in RFC-3461, but basically it says that non-alphanumeric - characters (including space, +, # and =) should be represented in - uppercase hexadecimal ascii as +XX. So a space should be written as +20; - + as +2B; # as +23; and = as +3D. Also note that modern email - services will expect userids and passwords containing non-ASCII characters to - use UTF-8 encoding with RFC-4013 normalisation applied. + The xtext encoding scheme is defined properly in RFC-3461, but basically it + says that non-alphanumeric characters (including space, +, # and =) should + be represented in uppercase hexadecimal ascii as +XX. So a space should be + written as +20; + as +2B; # as +23; and = as +3D. +

    + +

    + Base64 encoding can be used instead of xtext encoding for the user identifier + and plain password by replacing plain by plain:b. +

    + +

    + Note that modern email services will expect userids and passwords containing + non-ASCII characters to use UTF-8 encoding with RFC-4013 normalisation applied.

    @@ -775,10 +784,10 @@ emailrelay --as-client=example.com:smtp --client-auth=/etc/emailrelay-server.aut

    The PLAIN, LOGIN and CRAM-MD5 mechanisms can use plaintext passwords, stored in the secrets file using a password-type of plain. In addition, the - CRAM-MD5 mechanism can also use hashed passwords generated by the + CRAM-MD5 mechanism can also make use of hashed passwords generated by the emailrelay-passwd program and these are stored in the secrets file with a password-type of md5. (Hashed passwords are marginally more secure because - the plaintext password which might be used on other accounts, is not easily + the plaintext password which might be used on other accounts is not easily recovered. However, hashed passwords can only be used for HMAC authentication mechanisms that are based on the same hash function.) The XOAUTH2 mechanism can be used for client-side authentication using tokens that have been @@ -872,10 +881,10 @@ server plain carol my+20password

    TLS encryption

    - E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: to enable - client-side TLS encryption when E-MailRelay is acting as an SMTP client use the - --client-tls command-line option, and to enable server-side TLS when - E-MailRelay is acting as an SMTP or POP server use --server-tls. The + E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: use the + --client-tls command-line option to enable client-side TLS encryption when + E-MailRelay is acting as an SMTP client, and use --server-tls to enable + server-side TLS when E-MailRelay is acting as an SMTP or POP server. The connections start off as unencrypted and the SMTP command STARTTLS (or the POP STLS command) can be used to negotiate TLS encryption before any passwords are exchanged. @@ -1083,7 +1092,7 @@ password required pam_deny.so 

    --as-client ipv4or6.example.com:25 --client-interface 0.0.0.0
 --as-client ipv4or6.example.com:25 --client-interface ::
    -

    Unix domain sockets

    +

    Unix domain sockets

    E-MailRelay on Unix will listen on unix-domain sockets instead of IPv4 or IPv6 if the --interface option is given as an absolute file-system path: @@ -1093,31 +1102,37 @@ password required pam_deny.so Eg:

    - 
    --interface=/run/smtp.s --port=0
    + 
    --interface=/run/smtp.s --port=0
+

    When listening on more than one unix-domain socket use the extended form of the - "--interface" option with a prefix of "smtp=", "pop=", or "admin=": + --interface option with a prefix of smtp=, pop=, or admin=:

    +

    Eg:

    - 
    --interface=smtp=/run/smtp.s --port=0 --interface=pop=/run/pop.s --pop --pop-port=0
    + 
    --interface=smtp=/run/smtp.s --port=0 --interface=pop=/run/pop.s --pop --pop-port=0
+

    The forwarding address can also be a unix-domain address:

    +

    Eg:

    - 
    --forward-to=/run/smtp.s
    + 
    --forward-to=/run/smtp.s
+

    And it is also possible to communicate with message filters over a unix-domain socket:

    +

    Eg:

    @@ -1126,7 +1141,7 @@ password required pam_deny.so --filter=spam:/run/spamd.s --filter=spam-edit:/run/spamd.s -

    SOCKS

    +

    SOCKS

    E-MailRelay can use a SOCKS 4a proxy for establishing outgoing SMTP connections; just append the SOCKS proxy address to the SMTP server's address, @@ -1147,7 +1162,7 @@ password required pam_deny.so establish the connection. The target SMTP server will see a connection coming from the Tor exit node rather than from the E-MailRelay server.

    -

    Address verification

    +

    Address verification

    By default the E-MailRelay server will accept all recipient addresses for incoming e-mails as valid. This default behaviour can be modified by using an @@ -1350,7 +1365,7 @@ catch( e ) information as returned by verifier scripts but in reverse, such as 0|postmaster|Local Postmaster or 2|mailbox unavailable.

    -

    Connection blocking

    +

    Connection blocking

    All incoming connections from remote network addresses are blocked by default, but can be allowed by using the --remote-clients/-r option. This is to @@ -1390,7 +1405,7 @@ catch( e ) Connections from loopback and private (RFC-1918) network addresses are never checked.

    -

    Security issues

    +

    Security issues

    The following are some security issues that have been taken into consideration:

    @@ -1477,7 +1492,7 @@ catch( e ) The Authentication, PAM Authentication and TLS encryption sections above also relate to security.

    -

    Administration interface

    +

    Administration interface

    If enabled with the --admin command-line option, the E-MailRelay server will provide a network interface for performing administration tasks. This is a @@ -1492,9 +1507,18 @@ E-MailRelay> quit

    - The flush command is used to get the E-MailRelay server to forward spooled - mail to the next SMTP server. The forward command does the same but without - waiting for completion. + The forward command is used to trigger the E-MailRelay server into forwarding + spooled mail to the next SMTP server. +

    + +

    + The flush command is similar but it uses its own connection to the SMTP + server and waits for the messages to be sent. +

    + +

    + The unfail-all command can be used to remove the .bad filename extension + from files in the spool directory.

    @@ -1502,7 +1526,7 @@ E-MailRelay> quit network status information and activity statistics, and notify enables asynchronous event notification.

    -

    Bcc handling

    +

    Bcc handling

    E-MailRelay transfers e-mail messages without changing their content in any way, other than by adding a Received header. In particular, if a message @@ -1523,7 +1547,7 @@ E-MailRelay> quit An E-MailRelay --filter script can be used to reject messages with incorrect Bcc: headers, and an example script is included.

    -

    Files and directories

    +

    Files and directories

    On Unix-like systems E-MailRelay installs by default under /usr/local, but binary distributions will probably have been built to install elsewhere. @@ -1569,7 +1593,7 @@ E-MailRelay> quit It is possible to change the installation root directory after building by using make DESTDIR= install or DESTDIR= make -e install. However, this will not change the default spool directory path built into the - scripts and executables so the correct spool directory will have to be + scripts and executables so the correct spool directory will then have to be specified at run-time with the --spool-dir command-line option.

    diff --git a/doc/reference.md b/doc/reference.md index 1da955c..e23157c 100644 --- a/doc/reference.md +++ b/doc/reference.md @@ -210,7 +210,7 @@ where <option> is: * \-\-hidden (-H) Windows only. Hides the application window and disables all message boxes, - overriding any `--show` option. This is useful when running as a windows + overriding any `--show` option. This is useful when running as a windows service. * \-\-idle-timeout <time> @@ -241,8 +241,9 @@ where <option> is: * \-\-localedir <dir> - Specifies a locale base directory where localisation message catalogues can - be found. An empty directory can be used for the built-in default. + Enables localisation and specifies the locale base directory where message + catalogues can be found. An empty directory can be used for the built-in + default. * \-\-log (-l) @@ -423,9 +424,10 @@ where <option> is: * \-\-user <username> (-u) - When started as root the program switches to an non-privileged effective - user-id when idle. This option can be used to define which user-id is used. - Specify `root` to disable all user-id switching. Ignored on Windows. + When started as root the program switches to a non-privileged effective + user-id when idle. This option can be used to define the idle user-id and + also the group ownership of new files and sockets. Specify `root` to + disable all user-id switching. Ignored on Windows. * \-\-verbose (-v) @@ -475,7 +477,7 @@ command-line options: * as each message is submitted, just before receipt is acknowledged (`--immediate`) * as soon as the submitting client connection disconnects (`--forward-on-disconnect`) * periodically (`--poll=`) -* on demand using the administration interface's `flush` command (`--admin=`) +* on demand using the administration interface's `forward` command (`--admin=`) * when a `--filter` script exits with an exit code of 103 These can be mixed. @@ -660,13 +662,16 @@ user identifier; and the `password` field is the xtext-encoded plain password or a base64-encoded `HMAC-MD5` state. For `client` lines the password-type can also be `oauth`. -The first two fields are case-insensitive. The `xtext` encoding scheme is -defined properly in [RFC-3461][], but basically it says that non-alphanumeric -characters (including space, `+`, `#` and `=`) should be represented in -uppercase hexadecimal ascii as `+XX`. So a space should be written as `+20`; -`+` as `+2B`; `#` as `+23`; and `=` as `+3D`. Also note that modern email -services will expect userids and passwords containing non-ASCII characters to -use UTF-8 encoding with [RFC-4013][] normalisation applied. +The `xtext` encoding scheme is defined properly in [RFC-3461][], but basically it +says that non-alphanumeric characters (including space, `+`, `#` and `=`) should +be represented in uppercase hexadecimal ascii as `+XX`. So a space should be +written as `+20`; `+` as `+2B`; `#` as `+23`; and `=` as `+3D`. + +Base64 encoding can be used instead of xtext encoding for the user identifier +and plain password by replacing `plain` by `plain:b`. + +Note that modern email services will expect userids and passwords containing +non-ASCII characters to use UTF-8 encoding with [RFC-4013][] normalisation applied. Authentication proceeds according to an authentication 'mechanism' that is advertised by the server and selected by the client. Many authentication @@ -678,10 +683,10 @@ available via PAM (see below). The PLAIN, LOGIN and CRAM-MD5 mechanisms can use plaintext passwords, stored in the secrets file using a password-type of `plain`. In addition, the -CRAM-MD5 mechanism can also use hashed passwords generated by the +CRAM-MD5 mechanism can also make use of hashed passwords generated by the `emailrelay-passwd` program and these are stored in the secrets file with a password-type of `md5`. (Hashed passwords are marginally more secure because -the plaintext password which might be used on other accounts, is not easily +the plaintext password which might be used on other accounts is not easily recovered. However, hashed passwords can only be used for HMAC authentication mechanisms that are based on the same hash function.) The XOAUTH2 mechanism can be used for client-side authentication using tokens that have been @@ -753,10 +758,10 @@ described below. TLS encryption -------------- -E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: to enable -client-side TLS encryption when E-MailRelay is acting as an SMTP client use the -`--client-tls` command-line option, and to enable server-side TLS when -E-MailRelay is acting as an SMTP or POP server use `--server-tls`. The +E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: use the +`--client-tls` command-line option to enable client-side TLS encryption when +E-MailRelay is acting as an SMTP client, and use `--server-tls` to enable +server-side TLS when E-MailRelay is acting as an SMTP or POP server. The connections start off as unencrypted and the SMTP command `STARTTLS` (or the POP `STLS` command) can be used to negotiate TLS encryption before any passwords are exchanged. @@ -1169,7 +1174,7 @@ The following are some security issues that have been taken into consideration: `root.daemon` with permissions of `-rwxrwxr-x` and messages files are created with permissions of `-rw-rw----`. This allows normal users to list messages files but not read them. - + The `emailrelay-submit` program is given group ownership of `daemon` with its group set-user-id flag set. This allows it to create message files in the spool directory, and the files created end up owned by the submitter but with @@ -1179,7 +1184,7 @@ The following are some security issues that have been taken into consideration: Logging output is conditioned so that ANSI escape sequences cannot appear in the log. - + Passwords and message content are not logged (except if using the `--debug` option at run time with debug logging enabled at build time). @@ -1214,9 +1219,14 @@ simple command-line interface which is compatible with `netcat` and `telnet`: E-MailRelay> help E-MailRelay> quit -The `flush` command is used to get the E-MailRelay server to forward spooled -mail to the next SMTP server. The `forward` command does the same but without -waiting for completion. +The `forward` command is used to trigger the E-MailRelay server into forwarding +spooled mail to the next SMTP server. + +The `flush` command is similar but it uses its own connection to the SMTP +server and waits for the messages to be sent. + +The `unfail-all` command can be used to remove the `.bad` filename extension +from files in the spool directory. The `list` command lists the messages in the spool directory, `status` provides network status information and activity statistics, and `notify` enables @@ -1274,7 +1284,7 @@ Standard ([FHS][]) use this configure command: It is possible to change the installation root directory after building by using `make DESTDIR= install` or `DESTDIR= make -e install`. However, this will not change the default spool directory path built into the -scripts and executables so the correct spool directory will have to be +scripts and executables so the correct spool directory will then have to be specified at run-time with the `--spool-dir` command-line option. On Windows the installation GUI prompts for two installation directories, diff --git a/doc/reference.rst b/doc/reference.rst index deb0950..81d6826 100644 --- a/doc/reference.rst +++ b/doc/reference.rst @@ -213,7 +213,7 @@ where \ is: * --hidden (-H) Windows only. Hides the application window and disables all message boxes, - overriding any *--show* option. This is useful when running as a windows + overriding any *--show* option. This is useful when running as a windows service. * --idle-timeout \ @@ -244,8 +244,9 @@ where \ is: * --localedir \ - Specifies a locale base directory where localisation message catalogues can - be found. An empty directory can be used for the built-in default. + Enables localisation and specifies the locale base directory where message + catalogues can be found. An empty directory can be used for the built-in + default. * --log (-l) @@ -426,9 +427,10 @@ where \ is: * --user \ (-u) - When started as root the program switches to an non-privileged effective - user-id when idle. This option can be used to define which user-id is used. - Specify *root* to disable all user-id switching. Ignored on Windows. + When started as root the program switches to a non-privileged effective + user-id when idle. This option can be used to define the idle user-id and + also the group ownership of new files and sockets. Specify *root* to + disable all user-id switching. Ignored on Windows. * --verbose (-v) @@ -478,7 +480,7 @@ command-line options: * as each message is submitted, just before receipt is acknowledged (\ *--immediate*\ ) * as soon as the submitting client connection disconnects (\ *--forward-on-disconnect*\ ) * periodically (\ *--poll=*\ ) -* on demand using the administration interface's *flush* command (\ *--admin=*\ ) +* on demand using the administration interface's *forward* command (\ *--admin=*\ ) * when a *--filter* script exits with an exit code of 103 These can be mixed. @@ -675,13 +677,16 @@ user identifier; and the *password* field is the xtext-encoded plain password or a base64-encoded *HMAC-MD5* state. For *client* lines the password-type can also be *oauth*. -The first two fields are case-insensitive. The *xtext* encoding scheme is -defined properly in RFC-3461_, but basically it says that non-alphanumeric -characters (including space, *+*, *#* and *=*) should be represented in -uppercase hexadecimal ascii as *+XX*. So a space should be written as *+20*; -*+* as *+2B*; *#* as *+23*; and *=* as *+3D*. Also note that modern email -services will expect userids and passwords containing non-ASCII characters to -use UTF-8 encoding with RFC-4013_ normalisation applied. +The *xtext* encoding scheme is defined properly in RFC-3461_, but basically it +says that non-alphanumeric characters (including space, *+*, *#* and *=*) should +be represented in uppercase hexadecimal ascii as *+XX*. So a space should be +written as *+20*; *+* as *+2B*; *#* as *+23*; and *=* as *+3D*. + +Base64 encoding can be used instead of xtext encoding for the user identifier +and plain password by replacing *plain* by *plain:b*. + +Note that modern email services will expect userids and passwords containing +non-ASCII characters to use UTF-8 encoding with RFC-4013_ normalisation applied. Authentication proceeds according to an authentication 'mechanism' that is advertised by the server and selected by the client. Many authentication @@ -693,10 +698,10 @@ available via PAM (see below). The PLAIN, LOGIN and CRAM-MD5 mechanisms can use plaintext passwords, stored in the secrets file using a password-type of *plain*. In addition, the -CRAM-MD5 mechanism can also use hashed passwords generated by the +CRAM-MD5 mechanism can also make use of hashed passwords generated by the *emailrelay-passwd* program and these are stored in the secrets file with a password-type of *md5*. (Hashed passwords are marginally more secure because -the plaintext password which might be used on other accounts, is not easily +the plaintext password which might be used on other accounts is not easily recovered. However, hashed passwords can only be used for HMAC authentication mechanisms that are based on the same hash function.) The XOAUTH2 mechanism can be used for client-side authentication using tokens that have been @@ -774,10 +779,10 @@ described below. TLS encryption ============== -E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: to enable -client-side TLS encryption when E-MailRelay is acting as an SMTP client use the -*--client-tls* command-line option, and to enable server-side TLS when -E-MailRelay is acting as an SMTP or POP server use *--server-tls*. The +E-MailRelay can use negotiated TLS to encrypt SMTP and POP sessions: use the +*--client-tls* command-line option to enable client-side TLS encryption when +E-MailRelay is acting as an SMTP client, and use *--server-tls* to enable +server-side TLS when E-MailRelay is acting as an SMTP or POP server. The connections start off as unencrypted and the SMTP command *STARTTLS* (or the POP *STLS* command) can be used to negotiate TLS encryption before any passwords are exchanged. @@ -1289,9 +1294,14 @@ simple command-line interface which is compatible with *netcat* and *telnet*: E-MailRelay> help E-MailRelay> quit -The *flush* command is used to get the E-MailRelay server to forward spooled -mail to the next SMTP server. The *forward* command does the same but without -waiting for completion. +The *forward* command is used to trigger the E-MailRelay server into forwarding +spooled mail to the next SMTP server. + +The *flush* command is similar but it uses its own connection to the SMTP +server and waits for the messages to be sent. + +The *unfail-all* command can be used to remove the *.bad* filename extension +from files in the spool directory. The *list* command lists the messages in the spool directory, *status* provides network status information and activity statistics, and *notify* enables @@ -1351,7 +1361,7 @@ Standard (FHS_) use this configure command: It is possible to change the installation root directory after building by using *make DESTDIR= install* or *DESTDIR= make -e install*. However, this will not change the default spool directory path built into the -scripts and executables so the correct spool directory will have to be +scripts and executables so the correct spool directory will then have to be specified at run-time with the *--spool-dir* command-line option. On Windows the installation GUI prompts for two installation directories, diff --git a/doc/reference.txt b/doc/reference.txt index 1d6f335..a92ca4f 100644 --- a/doc/reference.txt +++ b/doc/reference.txt @@ -178,7 +178,7 @@ where