TLS fixes for OpenSSL.

[exim.git] / src / README.UPDATING

diff --git a/src/README.UPDATING b/src/README.UPDATING
index 8a0533b102137bccb9d14eb082e2eacbb60febe3..9e3689d84d505a92cb9acf599c35053cd3813dd7 100644 (file)
--- a/src/README.UPDATING
+++ b/src/README.UPDATING
@@ -26,6 +26,29 @@ The rest of this document contains information about changes in 4.xx releases
 that might affect a running system.
 
 
+Exim version 4.78
+-----------------
+
+ * The value of $tls_peerdn is now print-escaped when written to the spool file
+   in a -tls_peerdn line, and unescaped when read back in.  We received reports
+   of values with embedded newlines, which caused spool file corruption.
+
+   If you have a corrupt spool file and you wish to recover the contents after
+   upgrading, then lock the message, replace the new-lines that should be part
+   of the -tls_peerdn line with the two-character sequence \n and then unlock
+   the message.  No tool has been provided as we believe this is a rare
+   occurence.
+
+ * With OpenSSL 1.0.1+, Exim now supports TLS 1.1 and TLS 1.2.  If built
+   against 1.0.1a then you will get a warning message and the
+   "openssl_options" value will not parse "no_tlsv1_1": the value changes
+   incompatibly between 1.0.1a and 1.0.1b, because the value chosen for 1.0.1a
+   is infelicitous.  We advise avoiding 1.0.1a.
+
+   "openssl_options" gains "no_tlsv1_1", "no_tlsv1_2" and "no_compression".
+
+
+
 Exim version 4.77
 -----------------
 
@@ -42,6 +65,19 @@ Exim version 4.77
    that build option, please let the developers know, and know why, so we can
    try to provide a safer mechanism for you.
 
+   The match{}{} expansion condition (for regular expressions) is NOT affected.
+   For match_<type>{s1}{s2}, all list functionality is unchanged.  The only
+   change is that a '$' appearing in s2 will not trigger expansion, but instead
+   will be treated as a literal $ sign; the effect is very similar to having
+   wrapped s2 with \N...\N.  If s2 contains a named list and the list definition
+   uses $expansions then those _will_ be processed as normal.  It is only the
+   point at which s2 is read where expansion is inhibited.
+
+   If you are trying to test if two email addresses are equal, use eqi{s1}{s2}.
+   If you are testing if the address in s1 occurs in the list of items given
+   in s2, either use the new inlisti{s1}{s2} condition (added in 4.77) or use
+   the pre-existing forany{s2}{eqi{$item}{s1}} condition.
+
 
 Exim version 4.74
 -----------------
@@ -70,7 +106,7 @@ Exim version 4.73
  * Exim will no longer accept a configuration file owned by the Exim
    run-time user, unless that account is explicitly the value in
    CONFIGURE_OWNER, which we discourage.  Exim now checks to ensure that
-   files are not writable by other accounts.
+   files are not writeable by other accounts.
 
  * The ALT_CONFIG_ROOT_ONLY build option is no longer optional and is forced
    on; the Exim user can, by default, no longer use -C/-D and retain privilege.
@@ -103,7 +139,7 @@ It has been superceded by a native implementation of its successor DKIM.
 
 2. Up to version 4.69, Exim came with an embedded version of the PCRE library.
 As of 4.70, this is no longer the case. To compile Exim, you will need PCRE
-installed. Most OS distributions have ready-made library and develoment
+installed. Most OS distributions have ready-made library and development
 packages.