Added tls_dh_max_bits & check tls_require_ciphers early.

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index aeaf2da694bd401636870f876218b74b85858bf7..9db1c38238d61163de659cbfba8401c74dcace69 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -65,6 +65,8 @@ TK/01 Bugzilla 1239 - fix DKIM verification when signature was not inserted
 JH/01 Bugzilla 660 - Multi-valued attributes from ldap now parseable as a
       comma-sep list; embedded commas doubled.
 
+JH/02 Refactored ACL "verify =" logic to table-driven dispatch.
+
 PP/15 LDAP: Check for errors of TLS initialisation, to give correct
       diagnostics.
       Report and patch from Dmitry Banschikov.
@@ -99,7 +101,7 @@ PP/23 Added PCRE_CONFIG=yes support to Makefile for using pcre-config to
 PP/24 Fixed headers_only on smtp transports (was not sending trailing dot).
       Bugzilla 1246, report and most of solution from Tomasz Kusy.
 
-JH/02 ${eval } now uses 64-bit and supports a "g" suffix (like to "k" and "m").
+JH/03 ${eval } now uses 64-bit and supports a "g" suffix (like to "k" and "m").
       This may cause build issues on older platforms.
 
 PP/25 Revamped GnuTLS support, passing tls_require_ciphers to
@@ -111,8 +113,37 @@ PP/25 Revamped GnuTLS support, passing tls_require_ciphers to
 PP/26 Added EXPERIMENTAL_OCSP for OpenSSL.
 
 PP/27 Applied dnsdb SPF support patch from Janne Snabb.
+      Applied second patch from Janne, implementing suggestion to default
+      multiple-strings-in-record handling to match SPF spec.
+
+JH/04 Added expansion variable $tod_epoch_l for a higher-precision time.
+
+PP/28 Fix DCC dcc_header content corruption (stack memory referenced,
+      read-only, out of scope).
+      Patch from Wolfgang Breyha, report from Stuart Northfield.
+
+PP/29 Fix three issues highlighted by clang analyser static analysis.
+      Only crash-plausible issue would require the Cambridge-specific
+      iplookup router and a misconfiguration.
+      Report from Marcin Mirosław.
+
+PP/30 Another attempt to deal with PCRE_PRERELEASE, this one less buggy.
+
+PP/31 %D in printf continues to cause issues (-Wformat=security), so for
+      now guard some of the printf checks behind WANT_DEEPER_PRINTF_CHECKS.
+      As part of this, removing so much warning spew let me fix some minor
+      real issues in debug logging.
+
+PP/32 GnuTLS was always using default tls_require_ciphers, due to a missing
+      assignment on my part.  Fixed.
+
+PP/33 Added tls_dh_max_bits option, defaulting to current hard-coded limit
+      of NSS, for GnuTLS/NSS interop.  Problem root cause diagnosis by
+      Janne Snabb (who went above and beyond: thank you).
 
-JH/03 Added expansion variable $tod_epoch_l for a higher-precision time.
+PP/34 Validate tls_require_ciphers on startup, since debugging an invalid
+      string otherwise requires a connection and a bunch more work and it's
+      relatively easy to get wrong.
 
 
 Exim version 4.77