Update sendmail to 8.15.1: this is mostly a feature/bugfix release.

Note that there was an incompatible config change for IPv6 users.
See the MESSAGE file for details.

pkgsrc change: delete a couple of patches that have been upstreamed

Proofpoint, Inc., and the Sendmail Consortium announce the availability
of sendmail 8.15.1. This release:

   o offers more TLS related features,
   o does not ignore temporary map lookup failures during header rewriting,
   o uses uncompressed IPv6 addresses by default, which is an incompatible
     change that requires to update IPv6 related configuration data.

as well as many other enhancements.  For details see the release
notes below.

                        SENDMAIL RELEASE NOTES


This listing shows the version of the sendmail binary, the version
of the sendmail configuration files, the date of release, and a
summary of the changes in that release.

8.15.1/8.15.1   2014/12/06
        SECURITY: Properly set the close-on-exec flag for file descriptors
                (except stdin, stdout, and stderr) before executing mailers.
        If header rewriting fails due to a temporary map lookup failure,
                queue the mail for later retry instead of sending it
                without rewriting the header.  Note: this is done
                while the mail is being sent and hence the transaction
                is aborted, which only works for SMTP/LMTP mailers
                hence the handling of temporary map failures is
                suppressed for other mailers. SMTP/LMTP servers may
                complain about aborted transactions when this problem
                occurs.
                See also "DNS Lookups" in sendmail/TUNING.
        Incompatible Change: Use uncompressed IPv6 addresses by default,
                i.e., they will not contain "::".  For example,
                instead of ::1 it will be 0:0:0:0:0:0:0:1.  This
                permits a zero subnet to have a more specific match,
                such as different map entries for IPv6:0:0 vs IPv6:0.
                This change requires that configuration data
                (including maps, files, classes, custom ruleset,
                etc) must use the same format, so make certain such
                configuration data is updated before using 8.15.
                As a very simple check search for patterns like
                'IPv6:[0-9a-fA-F:]*::' and 'IPv6::'. If necessary,
                the prior format can be retained by compiling with:
                APPENDDEF(`conf_sendmail_ENVDEF', `-DIPV6_FULL=0')
                in your devtools/Site/site.config.m4 file.
        If debugging is turned on (-d0.14) also print the OpenSSL
                versions, both build time and run time
                (provided STARTTLS is compiled in).
        If a connection to the MTA is dropped by the client before its
                hostname can be validated, treat it as "may be forged",
                so that the unvalidated hostname is not passed to a
                milter in xxfi_connect().
        Add a timeout for communication with socket map servers
                which can be specified using the -d option.
        Add a compile time option HESIOD_ALLOW_NUMERIC_LOGIN to allow
                numeric logins even if HESIOD is enabled.
        The new option CertFingerprintAlgorithm specifies the finger-
                print algorithm (digest) to use for the presented cert.
                If the option is not set, md5 is used and the macro
                {cert_md5} contains the cert fingerprint.
                However, if the option is set, the specified algorithm
                (e.g., sha1) is used and the macro {cert_fp} contains
                the cert fingerprint.
                That is, as long as the option is not set, the behaviour
                does not change, but otherwise, {cert_md5} is superseded
                by {cert_fp} even if you set CertFingerprintAlgorithm
                to md5.
        The options ServerSSLOptions and ClientSSLOptions can be used
                to set SSL options for the server and client side
                respectively. See SSL_CTX_set_options(3) for a list.
                Note: this change turns on SSL_OP_NO_SSLv2 and
                SSL_OP_NO_TICKET for the client. See doc/op/op.me
                for details.
        A new map type "arpa" is available to reverse an IP (IPv4 or IPv6)
                address. It returns the string for the PTR lookup, but
                without trailing {ip6,in-addr}.arpa.
        New operation mode  'C' just checks the configuration file, e.g.,
                sendmail -C new.cf -bC
                will perform a basic syntax/consistency check of new.cf.
        The mailer flag 'I' is deprecated and will be removed in a
                future version.
        Allow local (not just TCP) socket connections to the server, e.g.,
                O DaemonPortOptions=Family=local, Addr=/var/mta/server.sock
                can be used.
        If the new option MaxQueueAge is set to a value greater than zero,
                entries in the queue will be retried during a queue run
                only if the individual retry time has been reached which
                is doubled for each attempt.  The maximum retry time is
                limited by the specified value.
        New DontBlameSendmail option GroupReadableDefaultAuthInfoFile
                to relax requirement for DefaultAuthInfo file.
        Reset timeout after receiving a message to appropriate value if
                STARTTLS is in use.  Based on patch by Kelsey Cummings
                of Sonic.net.
        Report correct error messages from the LDAP library for a range of
                small negative return values covering those used by OpenLDAP.
        Fix compilation with Berkeley DB 5.0 and 6.0.  Patch from
                Allan E Johannesen of Worcester Polytechnic Institute.
        CONFIG: FEATURE(`nopercenthack') takes one parameter: reject or
                nospecial which describes whether to disallow "%" in the
                local part of an address.
        DEVTOOLS: Fix regression in auto-detection of libraries when only
                shared libraries are available.  Problem reported by
                Bryan Costales.
        LIBMILTER: Mark communication socket as close-on-exec in case
                a user's filter starts other applications.
                Based on patch from Paul Howarth.
        Portability:
                SunOS 5.12 has changed the API for sigwait(2) to conform
                with XPG7.  Based on patch from Roger Faulkner of Oracle.
        Deleted Files:
                libsm/path.c

7 files changed, 45 insertions, 44 deletions

diff --git a/mail/sendmail/MESSAGE b/mail/sendmail/MESSAGE
index 064227009d2..f9ce82c70ae 100644
--- a/mail/sendmail/MESSAGE
+++ b/mail/sendmail/MESSAGE
@@ -1,5 +1,28 @@
 ===========================================================================
-$NetBSD: MESSAGE,v 1.7 2012/12/20 20:38:46 jnemeth Exp $
+$NetBSD: MESSAGE,v 1.8 2014/12/06 23:22:20 jnemeth Exp $
+
+INCOMPATIBLE CONFIG CHANGE
+
+If you are updating from a previous version to 8.15.1 or later,
+note that there has been an incompatible config change for IPv6
+addresses:
+
+        Incompatible Change: Use uncompressed IPv6 addresses by default,
+                i.e., they will not contain "::".  For example,
+                instead of ::1 it will be 0:0:0:0:0:0:0:1.  This
+                permits a zero subnet to have a more specific match,
+                such as different map entries for IPv6:0:0 vs IPv6:0.
+                This change requires that configuration data
+                (including maps, files, classes, custom ruleset,
+                etc) must use the same format, so make certain such
+                configuration data is updated before using 8.15.
+                As a very simple check search for patterns like
+                'IPv6:[0-9a-fA-F:]*::' and 'IPv6::'. If necessary,
+                the prior format can be retained by compiling with:
+                APPENDDEF(`conf_sendmail_ENVDEF', `-DIPV6_FULL=0')
+                in your devtools/Site/site.config.m4 file.
+
+===========================================================================
 
 To use "${PKGNAME}" as the system's mail transport agent you have
 to install "${PREFIX}/share/examples/sendmail/mailer.conf" as global
diff --git a/mail/sendmail/Makefile b/mail/sendmail/Makefile
index 643278a3c4c..d4f89cdc61b 100644
--- a/mail/sendmail/Makefile
+++ b/mail/sendmail/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.126 2014/09/19 21:24:05 jnemeth Exp $
+# $NetBSD: Makefile,v 1.127 2014/12/06 23:22:20 jnemeth Exp $
 
 PKGNAME=	sendmail-${DIST_VERS}
-PKGREVISION=	4
 COMMENT=	The well known Mail Transport Agent
 
 CONFLICTS+=	courier-mta-[0-9]* fastforward>=0.51nb2 postfix-[0-9]*
diff --git a/mail/sendmail/Makefile.common b/mail/sendmail/Makefile.common
index 8f6b4d53952..674ff659a7d 100644
--- a/mail/sendmail/Makefile.common
+++ b/mail/sendmail/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.61 2014/06/15 20:48:49 jnemeth Exp $
+# $NetBSD: Makefile.common,v 1.62 2014/12/06 23:22:20 jnemeth Exp $
 #
 # used by mail/libmilter/Makefile
 # used by mail/sendmail/Makefile
@@ -22,7 +22,7 @@ PATCHDIR=	${.CURDIR}/../../mail/sendmail/patches
 
 USE_LANGUAGES=	c99
 
-DIST_VERS=	8.14.9
+DIST_VERS=	8.15.1
 
 MAKE_ENV+=	BSD_BINOWN=${BINOWN} BSD_BINGRP=${BINGRP} \
 		BSD_MANOWN=${MANOWN} BSD_MANGRP=${MANGRP} \
diff --git a/mail/sendmail/PLIST b/mail/sendmail/PLIST
index 31188376ea3..2e1ec3e3d6b 100644
--- a/mail/sendmail/PLIST
+++ b/mail/sendmail/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.22 2014/06/22 11:42:35 hauke Exp $
+@comment $NetBSD: PLIST,v 1.23 2014/12/06 23:22:20 jnemeth Exp $
 bin/hoststat
 bin/mailq
 bin/newaliases
@@ -96,6 +96,7 @@ share/sendmail/feature/allmasquerade.m4
 share/sendmail/feature/always_add_domain.m4
 share/sendmail/feature/authinfo.m4
 share/sendmail/feature/badmx.m4
+share/sendmail/feature/bcc.m4
 share/sendmail/feature/bestmx_is_local.m4
 share/sendmail/feature/bitdomain.m4
 share/sendmail/feature/blacklist_recipients.m4
@@ -123,9 +124,11 @@ share/sendmail/feature/msp.m4
 share/sendmail/feature/mtamark.m4
 share/sendmail/feature/no_default_msa.m4
 share/sendmail/feature/nocanonify.m4
+share/sendmail/feature/nopercenthack.m4
 share/sendmail/feature/notsticky.m4
 share/sendmail/feature/nouucp.m4
 share/sendmail/feature/nullclient.m4
+share/sendmail/feature/prefixmod.m4
 share/sendmail/feature/preserve_local_plus_detail.m4
 share/sendmail/feature/preserve_luser_host.m4
 share/sendmail/feature/promiscuous_relay.m4
@@ -147,6 +150,7 @@ share/sendmail/feature/uucpdomain.m4
 share/sendmail/feature/virtuser_entire_domain.m4
 share/sendmail/feature/virtusertable.m4
 share/sendmail/hack/cssubdomain.m4
+share/sendmail/hack/xconnect.m4
 share/sendmail/m4/cf.m4
 share/sendmail/m4/cfhead.m4
 share/sendmail/m4/proto.m4
diff --git a/mail/sendmail/distinfo b/mail/sendmail/distinfo
index 17b3f75b198..06571d783c3 100644
--- a/mail/sendmail/distinfo
+++ b/mail/sendmail/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.54 2014/09/24 13:27:03 joerg Exp $
+$NetBSD: distinfo,v 1.55 2014/12/06 23:22:20 jnemeth Exp $
 
-SHA1 (sendmail.8.14.9.tar.gz) = fcf92eb0c119da1593ccda96ee24b4d0b0b21fd7
-RMD160 (sendmail.8.14.9.tar.gz) = da36f900a94c9300521a60bf917ed3e5d6c88d1e
-Size (sendmail.8.14.9.tar.gz) = 2114293 bytes
+SHA1 (sendmail.8.15.1.tar.gz) = ab5a2e80927c52c3621240d6bc424fb4b4d65f99
+RMD160 (sendmail.8.15.1.tar.gz) = 07d76be08fcc9d42480b9aef0799345ed51cda30
+Size (sendmail.8.15.1.tar.gz) = 2186562 bytes
 SHA1 (patch-aa) = bd1ab754f7146d002eaf8c0347e114b4049a7776
 SHA1 (patch-af) = bd3e26b0e78eadd610713430ae6deac888176442
 SHA1 (patch-ag) = f76de45c7e8d16207670e151265b7edbca4c045c
@@ -18,10 +18,10 @@ SHA1 (patch-as) = 652b107d5f68507a0b2fb7c5402186eff96c6bc0
 SHA1 (patch-at) = 7c206df88d29671faef950276a5119ef2f525f4b
 SHA1 (patch-au) = 87e907f36482f3ca03754160bc1ee106e17e3aaa
 SHA1 (patch-av) = 1b6bd4547930507ab67427bcf8a390c0afce0fb0
-SHA1 (patch-aw) = 76402522b3737c5bde2ee9061f76cdf73f232853
+SHA1 (patch-aw) = 9077b9fc4063bd1a66500b203d246bcddae8eb0f
 SHA1 (patch-ax) = adba9177404e10d5f461e1e8f0c4dd5840d78dd1
 SHA1 (patch-ay) = 94f9c633c1d15037ddd0a6ed46a4f3aaec236fc2
-SHA1 (patch-az) = e067d46657593348e7df912d1d54c02c0dfd54ed
+SHA1 (patch-az) = 592ec93f700723485a5969ae1f1836c64975d1d0
 SHA1 (patch-ba) = c190b11b9874f00a18b9c75b6e734f4a9dd3f68f
 SHA1 (patch-bb) = 6c86a60af25b02fc0389f1d40f59c5031d9679f1
 SHA1 (patch-bc) = 9e7346342dfe1ca5d84053b913df4be41a979683
diff --git a/mail/sendmail/patches/patch-aw b/mail/sendmail/patches/patch-aw
index fa44e4717b6..94e3f6a3474 100644
--- a/mail/sendmail/patches/patch-aw
+++ b/mail/sendmail/patches/patch-aw
@@ -1,6 +1,6 @@
-$NetBSD: patch-aw,v 1.3 2014/06/20 16:26:55 jnemeth Exp $
+$NetBSD: patch-aw,v 1.4 2014/12/06 23:22:20 jnemeth Exp $
 
---- sendmail/readcf.c.orig	2014-05-16 20:40:15.000000000 +0000
+--- sendmail/readcf.c.orig	2014-10-22 16:33:53.000000000 +0000
 +++ sendmail/readcf.c
 @@ -20,6 +20,10 @@ SM_RCSID("@(#)$Id: readcf.c,v 8.692 2013
  # include <arpa/inet.h>
@@ -13,32 +13,7 @@ $NetBSD: patch-aw,v 1.3 2014/06/20 16:26:55 jnemeth Exp $
  
  #define SECONDS
  #define MINUTES	* 60
-@@ -124,6 +128,14 @@ readcf(cfname, safe, e)
- 		| SSL_OP_NO_TICKET
- #endif
- 		;
-+#ifdef SSL_OP_TLSEXT_PADDING
-+	/* 
-+	 * For now disable SSL_OP_TLSEXT_PADDING: with OpenSSL 1.0.1g
-+	 * and 1.0.1h it breaks compatibility with some sites.
-+	 */
-+	Srv_SSL_Options &= ~SSL_OP_TLSEXT_PADDING;
-+	Clt_SSL_Options &= ~SSL_OP_TLSEXT_PADDING;
-+#endif
- #endif /* STARTTLS */
- 	if (DontLockReadFiles)
- 		sff |= SFF_NOLOCK;
-@@ -2406,6 +2418,9 @@ static struct ssl_options
- #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
- 	{ "SSL_OP_CRYPTOPRO_TLSEXT_BUG",	SSL_OP_CRYPTOPRO_TLSEXT_BUG	},
- #endif
-+#ifdef SSL_OP_TLSEXT_PADDING
-+	{ "SSL_OP_TLSEXT_PADDING",	SSL_OP_TLSEXT_PADDING	},
-+#endif
- 	{ NULL,		0		}
- };
- #endif /* STARTTLS && _FFR_TLS_1 */
-@@ -2810,13 +2825,13 @@ setoption(opt, val, safe, sticky, e)
+@@ -2999,13 +3003,13 @@ setoption(opt, val, safe, sticky, e)
  			if (rfp->rf_name == NULL)
  				syserr("readcf: I option value %s unrecognized", q);
  			else if (clearmode)
diff --git a/mail/sendmail/patches/patch-az b/mail/sendmail/patches/patch-az
index a8b5d368192..cb22ee58a81 100644
--- a/mail/sendmail/patches/patch-az
+++ b/mail/sendmail/patches/patch-az
@@ -1,6 +1,6 @@
-$NetBSD: patch-az,v 1.1 2014/06/15 20:48:50 jnemeth Exp $
+$NetBSD: patch-az,v 1.2 2014/12/06 23:22:20 jnemeth Exp $
 
---- sendmail/srvrsmtp.c.orig	2014-05-16 20:40:15.000000000 +0000
+--- sendmail/srvrsmtp.c.orig	2014-11-12 03:02:04.000000000 +0000
 +++ sendmail/srvrsmtp.c
 @@ -46,6 +46,10 @@ static bool	tls_ok_srv = false;
  static bool	NotFirstDelivery = false;
@@ -13,7 +13,7 @@ $NetBSD: patch-az,v 1.1 2014/06/15 20:48:50 jnemeth Exp $
  /* server features */
  #define SRV_NONE	0x0000	/* none... */
  #define SRV_OFFER_TLS	0x0001	/* offer STARTTLS */
-@@ -3731,8 +3735,8 @@ smtp_data(smtp, e)
+@@ -3983,8 +3987,8 @@ smtp_data(smtp, e)
  	id = e->e_id;
  
  #if NAMED_BIND
@@ -23,4 +23,4 @@ $NetBSD: patch-az,v 1.1 2014/06/15 20:48:50 jnemeth Exp $
 +	sm_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
  #endif /* NAMED_BIND */
  
- 
+ #if _FFR_PROXY