Re: [exim/exim] read_message_data_smtp should comply with RFC5321 (Issue #1195)

2026:

Following the "smtp smuggling" attack of Dec 2023, messages having proper CRLF for the first header line get strict enforcement wrt. bare LF in the body. Any seen in the body are replaced with a space. Any seen in headers are taken as a line-ending but get a space appended so as to not terminate the header.

The fudge of relaxing CRLF checking if the initial header line is LF-only is still there, accepting either CRLF or bare-LF as a line-ending for both headers and body.

We could still add an ACL control (or a main-section option) as noted, though we should also consider bare-CR handling (currently - header: line-end with space appended, body: line ending).

Likewise, we could check all the way though headers (plus a first body line) and then enforce strict CRLF if it was good.
Doing either raises the issue of what action to take on violation. Perm-reject is the obvious one.

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/1195#issuecomment-239503 ) or reply to this email directly.