| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Changes since 1.4.0 from the RELEASE_NOTES file
NOTE: In response to CVE-2019-20790, opendmarc has changed
how it evaluates headers added by previous
SPF milters. Users are encouraged to read the
CVE-2019-20790 file in the "SECURITY" folder
for more details. (#49, #158). Originally reported by
Jianjun Chen, feedback by Simon Wilson and
David Bürgin <dbuergin@gluet.ch>.
NOTE: OpenDMARC's internal SPF handling will be removed
in a future version. Users are encouraged to
build linked against libspf2. Many pre-built
packages provided by OS packagers already do this.
(See https://www.libspf2.org)
Addition of defines for MUSL C Library. (#129/#133). Patches by
Marco Rebhan.
Updated opendmarc.conf manpage and opendmarc.conf.sample to point to
https://publicsuffix.org/list/.
Added a CONTRIBUTING document.
Fix two #ifdefs in arc functions for strlcpy. (#138). Reported by
Leo Bicknell.
Fixes to MySQL Schema (#98/#99). Patch by Bond Keevil.
LIBSPF2 calls would not compile on OpenBSD due to OpenBSD not
having the ns_type definition in arpa/resolv.h.
Added detection to configure script. (#134)
Reworked hcreate_r calls to use hcreate, to compile natively on
OpenBSD and MacOS. (Part of #94) Reported by Rupert
Gallagher.
Add compatibility with AutoConf 2.70. (#95)
Documentation updates about SourceForge being deprecated. (#101)
Only accept results from Received-SPF fields that indicate clearly
which identifier was being evaluated, since DMARC specifically
only wants results based on MAIL FROM.
Many build-time fixes (#100, #91, #90, #86, #85, #84, #83, #82, #81)
Patches provided by Rupert Gallagher (ruga@protonmail.com)
Added config option HoldQuarantinedMessages (default false), which
controls if messages with p=quarantine will be passed on to
the mail stream (if False) or placed in the MTA's "hold"
queue (if True). Issue #105. Patch by Marcos Moraes, on
the OpenDMARC mailing list.
Remove "--with-wall" from "configure". Suggested by Leo Bicknell.
LIBOPENDMARC: Fix bug #50: Ignore all RRTYPEs other than TXT.
Problem reported by Jan Bouwhuis.
LIBOPENDMARC: Fix bug #89: Repair absurd RRTYPE test in SPF code.
LIBOPENDMARC: Fix bug #104: Fix bogus header field parsing code.
LIBOPENDMARC: Fix bug #161: Don't pass the client IP address through
htonl() since it's already in network byte order. This
was causing SPF errors when the internal SPF
implementation was in use.
LIBOPENDMARC: Fix numerous problems with the internal SPF
implementation.
|
|
If RequiredFrom is set, opendmarc will reject messages that lack
a From header from which a valid domain can be extracted. This
is a subset of the full RFC5322 requirements enforced by the
RequiredHeaders option.
While non RFC5322-compliant messages are too common to make
RequiredHeaders always usable, the check on the From header
remains especially valuable. It makes sure forged domain messages
cannot evade the filter by just omitting the From header and relying
on the MTA to fill it by a copy from the enveloppe header.
Submitted upstream as
https://github.com/trusteddomainproject/OpenDMARC/pull/147
|
|
|
|
Change since 1.3.1 from RELEASE_NOTES
1.4.0 2018/06/??
Add ARC support. Extensive work contributed by ValiMail.
Add "DomainWhitelist" and "DomainWhitelistFile" config options.
Extract client IP address for ARC reports when provided via
Authentication-Results.
Update SQL schema to support new reporting functionality for DKIM
selectors and ARC local policy overrides (refer to the example
schema.mysql file).
Add experimental support for reporting of ARC local policy overrides.
Add support for recording and reporting of DKIM selectors.
Override a DMARC "fail" if an ARC "pass" is recorded in conjunction with
an ARC policy pass.
Fix bug #137: Handle base64 inside AR tokens that are values.
Problem reported by Joseph Coffland.
LIBOPENDMARC: Fix bug #203: Reject DMARC records that have duplicate
tags in them. Reported by Dirk Stoecker.
REPORTS: Feature request #146: Add option to pull input from a file.
REPORTS: Fix bug #153: Suppress duplicate results from the same
domain. Patch from Tomki Camp.
1.3.2 2017/03/04
Feature request #86: Change meaning of "RequiredHeaders" such that
header validity is always checked, but messages are only
rejected on that basis when the flag is set. Based
on a patch from Andreas Schulze.
Feature request #127: Log SPF results when rejecting. Requested
by Patrick Wagner; patch from Andreas Schulze, follow-up
patch from Juri Haberland.
Feature request #138: Inculde policy and disposition information
in an Authentication-Results comment. Based on a patch
from Juri Haberland.
Feature request #139: Include the client host name if known
in failure reports. Suggested by Roland Turner;
patch by Andreas Schulze.
Fix bug #95: Assume IPv6 for SPF operations. Patch from Juri Haberland.
Fix bug #120: Fix control logic around the SPF result.
Reported by Christophe Wolfhugel; patch from Andreas Schulze.
Fix bug #122: Don't skip the HELO milter phase when SPF is enabled.
Reported by Christophe Wolfhugel.
Fix bug #157: Fix logging of implicit authserv-ids. Reported
by Andreas Schulze; patch from Juri Haberland.
Fix bug #158: Log ignored connections. Patch from Andreas Schulze.
Fix bug #160: Fix "SyslogFacility" handling. Patch from
Juri Haberland.
Fix bug #163: Use a larger buffer for the raw MAIL FROM value.
Based on a patch from Andreas Schulze.
Fix bug #174: Trim "!" suffixes from reporting addresses. Problem
noted by Juri Haberland.
Fix bug #186: When reloading the configuration file, the public
suffix list was read in with the wrong comment indicator.
Patch from Federico Omoto.
Fix bug #194: Fix inappropriate DMARC status when "p=none" is
discovered. Patch from Juri Haberland.
Fix bug #195: When parsing Received-SPF, use the correct constants
in the history file entries. Patch from Juri Haberland.
LIBOPENDMARC: Fix bug #115: Fix type mismatch. Patch from
Sebastian A. Siewior via Scott Kitterman.
LIBOPENDMARC: Fix bug #121: Fix IPv6 CIDR matching in SPF code.
Patch from Christophe Wolfhugel.
LIBOPENDMARC: Fix bug #125: Compile time IPv6 fix. Reported by
Christophe Wolfhugel.
LIBOPENDMARC: Fix bug #131: Fix alignment bug. Patch from
Andreas Schulze.
LIBOPENDMARC: Fix bug #147: Fix stripping of whitespace from
DMARC DNS records. Based on a patch from Job Noorman.
LIBOPENDMARC: Fix bug #149: Apply "sp" setting, if present and
applicable. Patch from Petr Novak.
LIBOPENDMARC: Fix bug #154: Fix "rf" and "fo" processing logic.
LIBOPENDMARC: Fix bug #156: Fix variable name. Patch by
Andreas Schulze.
LIBOPENDMARC: Fix bug #165: Fix logic in checking which SPF
identifier was used. Patches from Marco Favero and
Juri Haberland.
LIBOPENDMARC: Fix bug #167: Don't return "fail" when we should
return "none". Patch from Marco Favero.
REPORTS: Fix bug #134: Handle SMTP errors correctly. Patch from
Andreas Schulze.
REPORTS: Fix bug #141: Set the HELO parameter correctly.
Reported by Alan Smith; patch from Andreas Schulze.
REPORTS: Fix bug #143: Fix logic in table truncation.
Reported by Wayne Andersen; patch from Juri Haberland.
REPORTS: Fix bug #162: Always report "sp" in aggregate reports.
Patch from Juri Haberland.
REPORTS: Fix bug #166: Fix report start/end time logic.
Patch from Juri Haberland.
REPORTS: Fix bug #188: Don't delete inputs too early in
opendmarc-reports. Patch from Juri Haberland.
TOOLS: Fix bug #161: "Forensic" reports were renamed "Failure"
reports. Patch from Andreas Schulze.
TOOLS: Fix bug #164: Handle IPv6 test addresses. Reported by
Andreas Schulze; patch from Juri Haberland.
DOCS: Patch #189: Replace the DMARC RFC with an HTML page
referencing the relevant specs, since Debian doesn't
consider RFCs to be "free". Patch from Scott Kitterman
via Juri Haberland.
|
|
Use res_ndestroy() instead of res_nclose() to properly cleanup resources
on NetBSD (and others that use __res_ndestroy() or res_ndestroy() instead
of res_nclose()). Original patch by Roy Marples.
|
|
|
