commit e8ac8be0a3d56ba0a189fb970c339ac6e84769be
Author: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date:   Mon May 3 15:53:28 2021 +0200

    Fix DANE + SNI handling (Bug 2265)
    
    Broken in d8e99d6047e709b35eabb1395c2046100d1a1dda
    Thanks to JGH and Wolfgang Breyha for contributions.

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index f26e2337a..9ee6a578a 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -2015,7 +2015,7 @@ if (continue_hostname && continue_proxy_cipher)
       {
       case OK:		sx->conn_args.dane = TRUE;
 			ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-			ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+                        ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 			break;
       case FAIL_FORCED:	break;
       default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
@@ -2097,7 +2097,7 @@ if (!continue_hostname)
 	  {
 	  case OK:		sx->conn_args.dane = TRUE;
 				ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-				ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+				ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 				break;
 	  case FAIL_FORCED:	break;
 	  default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,

commit ed64b5c2f0f44db27ae48128fc97d5ad8406a28e
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Tue May 4 13:06:31 2021 +0100

    Fix ${ipv6norm:}
    
    (cherry picked from commit 8b4b6ac90766b11fa74fa3001778b49456adbe42)

diff --git a/src/src/host.c b/src/src/host.c
index dbc7ce20d..ee9d323a7 100644
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -1197,9 +1197,9 @@ for (c = buffer, k = -1, i = 0; i < 8; i++)
   c++;
   }
 
-c[-1] = '\0';	/* drop trailing colon */
+*--c = '\0';	/* drop trailing colon */
 
-/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, d, d + 2*(k+1)); */
+/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */
 if (k >= 0)
   {			/* collapse */
   c = d + 2*(k+1);

commit e3311bc211d20617d90e75ea8ec7e01e6210483d
Merge: 6429b0fc7 ed64b5c2f
Author: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date:   Sun May 9 11:25:09 2021 +0200

    Merge branch 'exim-4.94+fixes' of ssh://git.exim.org/home/git/exim into exim-4.94+fixes

commit 53b8b89b51a9b3f28b8e476528be0237c628261c
Merge: e8ac8be0a e3311bc21
Author: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date:   Sun May 9 11:26:03 2021 +0200

    Merge branch 'exim-4.94+fixes' into exim-4.94.2+fixes

commit c1faf04b865465894c7ca41ab4585fb69d4a5936
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Wed May 12 15:01:12 2021 +0100

    Named Queues: fix immediate-delivery.  Bug 2743
    
    (cherry picked from commit 159cf206c97f876b07829d92db2217689745c1e8)

diff --git a/src/src/exim.c b/src/src/exim.c
index ee75739ec..7411f0467 100644
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -2789,9 +2789,11 @@ on the second character (the one after '-'), to save some effort. */
 		  else badarg = TRUE;
 		  break;
 
-    /* -MCG: set the queue name, to a non-default value */
+    /* -MCG: set the queue name, to a non-default value. Arguably, anything
+       from the commandline should be tainted - but we will need an untainted
+       value for the spoolfile when doing a -odi delivery process. */
 
-	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), TRUE);
+	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), FALSE);
 		  else badarg = TRUE;
 		  break;
 

commit 1e7013764134c0a4a0f1fedbf33d87a21d76b3b5
Merge: 53b8b89b5 c1faf04b8
Author: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date:   Thu May 13 08:31:37 2021 +0200

    Merge branch 'exim-4.94+fixes' into exim-4.94.2+fixes
    
    How to make sure that cherry-picking to a +fixes branch goes to the
    *latest* +fixes branch?

commit 20812729e3e47a193a21d326ecd036d67a8b2724
Author: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date:   Sun May 16 19:11:19 2021 +0200

    Fix host_name_lookup (Close 2747)
    
    Thanks to Nico R for providing a reproducing configuration.
    
            host_lookup             = *
            message_size_limit      = ${if def:sender_host_name {32M}{32M}}
            acl_smtp_connect        = acl_smtp_connect
            acl_smtp_rcpt           = acl_smtp_rcpt
    
            begin acl
              acl_smtp_connect:
                    warn ratelimit = 256 / 1m / per_conn
                    accept
    
              acl_smtp_rcpt:
                    accept hosts = 127.0.0.*
    
            begin routers
            null:
              driver          = accept
              transport       = null
    
            begin transports
            null:
              driver          = appendfile
              file            = /dev/null
    
    Tested with
    
            swaks -f mailbox@example.org -t mailbox@example.org --pipe 'exim -bh 127.0.0.1 -C /opt/exim/etc/exim-bug.conf'
    
    The IP must have a PTR to "localhost." to reproduce it.

diff --git a/src/src/host.c b/src/src/host.c
index ee9d323a7..2047b9798 100644
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -1581,7 +1581,7 @@ Put it in permanent memory. */
 
   if (hosts->h_aliases)
     {
-    int count = 1;
+    int count = 1;  /* need 1 more for terminating NULL */
     uschar **ptr;
 
     for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;
@@ -1690,7 +1690,7 @@ while ((ordername = string_nextinlist(&list, &sep, NULL, 0)))
       {
       uschar **aptr = NULL;
       int ssize = 264;
-      int count = 0;
+      int count = 1;  /* need 1 more for terminating NULL */
       int old_pool = store_pool;
 
       sender_host_dnssec = dns_is_secure(dnsa);

commit c819f3bcad02bcb06004ae2ad135b68fab0ae888
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Wed Jul 7 22:19:07 2021 +0100

    Fix tainted message for fakereject
    
    (cherry picked from commit a9ac2d7fc219e41a353abf1f599258b9b9d21b7e)

diff --git a/src/src/acl.c b/src/src/acl.c
index 7061230b4..65324405c 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3137,7 +3137,9 @@ for (; cb; cb = cb->next)
 	    {
 	    const uschar *pp = p + 1;
 	    while (*pp) pp++;
-	    fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
+	    /* The entire control= line was expanded at top so no need to expand
+	    the part after the / */
+	    fake_response_text = string_copyn(p+1, pp-p-1);
 	    p = pp;
 	    }
 	   else /* Explicitly reset to default string */

commit b7fb6ac5d99f0b1000652c91fecad101af4defc0
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Tue Aug 10 17:36:03 2021 +0100

    Testsuite: testcases for DKIM under TLS
    
    (cherry picked from commit 15a44d749b2f4097d43c2d887b6c5bca2d0d8b4a)

diff --git a/src/src/transports/appendfile.c b/src/src/transports/appendfile.c
index 8ab8b6016..5b0e8fadc 100644
--- a/src/src/transports/appendfile.c
+++ b/src/src/transports/appendfile.c
@@ -476,7 +476,7 @@ if (ob->create_file_string)
     value = create_inhome;
   else
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
-      "invalid value given for \"file_create\" for the %s transport: %s",
+      "invalid value given for \"create_file\" for the %s transport: %s",
         tblock->name, ob->create_file_string);
   ob->create_file = value;
   }

commit 44a62f58613f26f5cba82e9fa1e3d6f83124c550
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Wed Aug 11 13:08:43 2021 +0100

    DKIM: fix verify under TLS & chunking, with pipelined next command
    
    Cherry-picked from: b367453a08

diff --git a/src/src/dkim.c b/src/src/dkim.c
index 92adb3589..b376aa240 100644
--- a/src/src/dkim.c
+++ b/src/src/dkim.c
@@ -127,8 +127,9 @@ dkim_verify_ctx = pdkim_init_verify(&dkim_exim_query_dns_txt, dot_stuffing);
 dkim_collect_input = dkim_verify_ctx ? DKIM_MAX_SIGNATURES : 0;
 dkim_collect_error = NULL;
 
-/* Start feed up with any cached data */
-receive_get_cache();
+/* Start feed up with any cached data, but limited to message data */
+receive_get_cache(chunking_state == CHUNKING_LAST
+		  ? chunking_data_left : GETC_BUFFER_UNLIMITED);
 
 store_pool = dkim_verify_oldpool;
 }
diff --git a/src/src/functions.h b/src/src/functions.h
index e22fd4f99..c450536a2 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -64,7 +64,7 @@ extern int     tls_ferror(void);
 extern void    tls_free_cert(void **);
 extern int     tls_getc(unsigned);
 extern uschar *tls_getbuf(unsigned *);
-extern void    tls_get_cache(void);
+extern void    tls_get_cache(unsigned);
 extern BOOL    tls_import_cert(const uschar *, void **);
 extern int     tls_read(void *, uschar *, size_t);
 extern int     tls_server_start(const uschar *, uschar **);
@@ -481,7 +481,7 @@ extern BOOL    smtp_get_interface(uschar *, int, address_item *,
 extern BOOL    smtp_get_port(uschar *, address_item *, int *, uschar *);
 extern int     smtp_getc(unsigned);
 extern uschar *smtp_getbuf(unsigned *);
-extern void    smtp_get_cache(void);
+extern void    smtp_get_cache(unsigned);
 extern int     smtp_handle_acl_fail(int, int, uschar *, uschar *);
 extern void    smtp_log_no_mail(void);
 extern void    smtp_message_code(uschar **, int *, uschar **, uschar **, BOOL);
diff --git a/src/src/globals.c b/src/src/globals.c
index fcb9cc0b5..c89cf6304 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -168,7 +168,7 @@ uschar * (*lwr_receive_getbuf)(unsigned *) = NULL;
 int (*lwr_receive_ungetc)(int) = stdin_ungetc;
 int (*receive_getc)(unsigned)  = stdin_getc;
 uschar * (*receive_getbuf)(unsigned *)  = NULL;
-void (*receive_get_cache)(void)= NULL;
+void (*receive_get_cache)(unsigned)     = NULL;
 int (*receive_ungetc)(int)     = stdin_ungetc;
 int (*receive_feof)(void)      = stdin_feof;
 int (*receive_ferror)(void)    = stdin_ferror;
diff --git a/src/src/globals.h b/src/src/globals.h
index bb811553c..f615a29ad 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -156,7 +156,7 @@ extern uschar * (*lwr_receive_getbuf)(unsigned *);
 extern int (*lwr_receive_ungetc)(int);
 extern int (*receive_getc)(unsigned);
 extern uschar * (*receive_getbuf)(unsigned *);
-extern void (*receive_get_cache)(void);
+extern void (*receive_get_cache)(unsigned);
 extern int (*receive_ungetc)(int);
 extern int (*receive_feof)(void);
 extern int (*receive_ferror)(void);
diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
index 17d17beb9..fc5328478 100644
--- a/src/src/smtp_in.c
+++ b/src/src/smtp_in.c
@@ -583,10 +583,12 @@ return buf;
 }
 
 void
-smtp_get_cache(void)
+smtp_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 int n = smtp_inend - smtp_inptr;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(smtp_inptr, n);
 #endif
@@ -661,7 +663,9 @@ for(;;)
   if (chunking_state == CHUNKING_LAST)
     {
 #ifndef DISABLE_DKIM
+    dkim_collect_input = dkim_save;
     dkim_exim_verify_feed(NULL, 0);	/* notify EOD */
+    dkim_collect_input = 0;
 #endif
     return EOD;
     }
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 6ee603595..17081c821 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -3267,11 +3267,13 @@ return buf;
 
 
 void
-tls_get_cache()
+tls_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 exim_gnutls_state_st * state = &state_server;
 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
 #endif
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 499384b50..55b4162f8 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -3566,10 +3566,12 @@ return buf;
 
 
 void
-tls_get_cache()
+tls_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
 #endif

commit 348973434e549417db769a090b695f37f80ce2a0
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Tue Aug 31 21:55:00 2021 +0100

    Avoid using CLOCK_MONOTONIC for $received_time.  Bug 2615
    
    (cherry picked from commit 8dcd5efb1f89d17b0b214e1face4146d3a1edd28)

diff --git a/src/src/receive.c b/src/src/receive.c
index 6eec73e2b..07a5708f7 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -1789,15 +1789,19 @@ if (sender_host_address) dmarc_init();	/* initialize libopendmarc */
 
 /* Remember the time of reception. Exim uses time+pid for uniqueness of message
 ids, and fractions of a second are required. See the comments that precede the
-message id creation below. */
+message id creation below.
+We use a routine that if possible uses a monotonic clock, and can be used again
+after reception for the tick-wait even under the Linux non-Posix behaviour. */
 
 exim_gettime(&message_id_tv);
 
 /* For other uses of the received time we can operate with granularity of one
 second, and for that we use the global variable received_time. This is for
-things like ultimate message timeouts. */
+things like ultimate message timeouts.
+For this we do not care about the Linux suspend/resume problem, so rather than
+use exim_gettime() everywhere we use a plain gettimeofday() here. */
 
-received_time = message_id_tv;
+gettimeofday(&received_time, NULL);
 
 /* If SMTP input, set the special handler for timeouts. The alarm() calls
 happen in the smtp_getc() function when it refills its buffer. */
@@ -4325,7 +4329,10 @@ pid can be re-used within our time interval. We can't shorten the interval
 without re-designing the message-id. See comments above where the message id is
 created. This is Something For The Future.
 Do this wait any time we have created a message-id, even if we rejected the
-message.  This gives unique IDs for logging done by ACLs. */
+message.  This gives unique IDs for logging done by ACLs.
+The initial timestamp must have been obtained via exim_gettime() to avoid
+issues on Linux with suspend/resume.
+It would be Nicer to only pause before a follow-on message. */
 
 if (id_resolution != 0)
   {
