OpenSMTPD is a FREE implementation of the SMTP protocol with some common
extensions. It allows ordinary machines to exchange e-mails with systems
speaking the SMTP protocol. It implements a fairly large part of RFC5321
and can already cover a large range of use-cases.
It runs on OpenBSD, NetBSD, FreeBSD, DragonFlyBSD, Linux and macOS.
The archives are now available from the main site at www.OpenSMTPD.org
We would like to thank the OpenSMTPD community for their help in testing
the snapshots, reporting bugs, contributing code and packaging for other
systems.
Dependencies note:
==================
This release builds with LibreSSL, or OpenSSL >= 1.1.
It's preferable to depend on LibreSSL as OpenSMTPD is written and tested
with that dependency. OpenSSL library is considered as a best effort
target TLS library and provided as a commodity, LibreSSL has become our
target TLS library.
Changes in this release:
========================
This includes also the OpenBSD 7.9 errata `002` and `015` (all the
ones released as of today.)
- Restricted the characters allowed through when expanding variables with
the raw modifier, both in the MDA command line and in its environment.
- Don't lowercase K_AUTH lookups. The lookup key is "user:password", so
passwords were being case-flattened before reaching the table.
- Reject CR and LF in the sender, recipients and DSN options taken from
the sendmail(8) command line, which could otherwise inject additional
SMTP commands into the local dialogue.
- Reject empty or slash-bearing usernames before building the mbox path.
- Fixed a possible out of bounds access in dname_expand().
- Fixed a possible out of bounds read in text_to_netaddr().
- Stop parsing DNS answers once unpack_rr() reports a failure, instead of
looping on the attacker-controlled answer count.
- Validate encrypted queue buffer sizes before processing the auth tag and
IV data.
- Hardened the privsep environment: reject oversized sockaddr payloads
received over IPC, clear userinfo before sending it over imsg, zero the
temporary envelope parsing buffers, and drop pending asynchronous lookup
references when a session is torn down.
- EHLO now resets the transaction, as required by RFC 5321.
- Return 452 instead of 451 when there are too many recipients.
- "smtp limit max-rcpt" now requires a value of at least 100, per RFC 5321.
- Removed "support" for the WIZ command.
- Fixed using modifiers together with partial expansion in format
specifiers, for example %{sender.user[6:]:strip}.
- Fixed a leak of the inflate stream on every read from a compressed queue.
- Fixed leaks of mda_subaddress and dispatcher in mda_envelope_free(), and
of the copied envelope on the smarthost lookup failure path.
- Unlink the transformed temporary file on every queue commit failure,
instead of leaving orphaned .comp/.enc files behind.
- Updated the bundled imsg and switched smtpd over to imsgbuf_get().
- Various documentation improvements.
Two changes in this release can affect existing installations:
* A configuration setting "smtp limit max-rcpt" below 100 is now rejected
at parse time.
* The set of characters accepted in envelope addresses no longer includes
$ ` { | } , which are never present in legitimate addresses and are
commonly seen in exploit attempts.
bundled libtls:
- Added X25519MLKEM768 to the front of the default ECDHE curve list.
Curves the installed libcrypto does not know about are skipped when
expanding the default list, so this is a no-op before OpenSSL 3.5; a
curve requested explicitly is still an error.
- Consistently use the "x" variants of the error setting functions where
errno carries no useful information, and report TLS_ERROR_OUT_OF_MEMORY
rather than TLS_ERROR_UNKNOWN after allocation failures.
- Disallow wildcard matching of a TLD specified as a FQDN. smtpd is
not believed to be affected.
- Added missing length checks before BIO_new_mem_buf(): certificates
and keys larger than INT_MAX no longer have their length truncated.
- The subject of a certificate is no longer treated as optional.
- Abort the handshake when there is no ALPN protocol overlap, as required
by RFC 7301. Not reachable from smtpd.
- const correctness for X509_NAME, in preparation for OpenSSL 4.
- Open certificate and key files with O_CLOEXEC.
Checksums:
==========
SHA256 (opensmtpd-7.9.0p0.tar.gz) =
74e640de18a8ea63ef43ba2ddb1a6ad1eb82cce2e600b94e98cb551bb2a724c4
Verify:
=======
Starting with version 5.7.1, releases are signed with signify(1).
You can obtain the public key from our website, check with our community
that it has not been altered on its way to your machine.
$ wget https://www.opensmtpd.org/archives/opensmtpd-20181026.pub
Once you are confident the key is correct, you can verify the release as
described below:
1. download both release tarball and matching signature file to same directory:
$ wget https://www.opensmtpd.org/archives/opensmtpd-7.9.0p0.sum.sig
$ wget https://www.opensmtpd.org/archives/opensmtpd-7.9.0p0.tar.gz
2. use `signify` to verify that signature file is properly signed and that the
checksum matches the release tarball you downloaded:
$ signify -C -e -p opensmtpd-20181026.pub -x opensmtpd-7.9.0p0.sum.sig
Signature Verified
opensmtpd-7.9.0p0.tar.gz: OK
If you don't get an OK message, then something is not right and you should not
install without first understanding why it failed.
Support:
========
You are encouraged to register to our general purpose mailing-list:
http://www.opensmtpd.org/list.html
The "Official" IRC channel for the project is at:
#opensmtpd @ irc.libera.chat
Support us:
===========
The project is maintained by volunteers, you can support us by:
- donating time to help test development branch during development cycle
- donating money to either one of the OpenBSD or OpenSMTPD project
- sponsoring developers through direct donations or patreon
- sponsoring developers through contracts to write features
Get in touch with us by e-mail or on IRC for more informations.
Reporting Bugs:
===============
Please read http://www.opensmtpd.org/report.html
Security bugs should be reported directly to [email protected]
Other bugs may be reported to [email protected]
