Prevent poor connection reuse (bug 1141).

[exim.git] / doc / doc-txt / NewStuff

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index c25e51ba073c6af922ea133f0df589b39290960e..432bbd220a9fda370f081db2f2db6e3fd9f82d45 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -13,10 +13,7 @@ Version 4.78
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so

-    careful use needs to be made of the conditions in Exim.  Note that
-    this can not yet be used as a drop-in replacement for Cyrus SASL, as
-    Exim is currently unable to construct strings with embedded NULs for
-    use as keys in lookups against sasldb2.
+    careful use needs to be made of the conditions in Exim.

 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME
 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME


@@ -33,7 +30,43 @@ Version 4.78
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
     be joined together with ASCII NUL characters to construct the key to pass
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
     be joined together with ASCII NUL characters to construct the key to pass

-    into the DBM library.
+    into the DBM library.  Can be used with gsasl to access sasldb2 files as
+    used by Cyrus SASL.
+
+ 6. OpenSSL now supports TLS1.1 and TLS1.2 with OpenSSL 1.0.1.
+
+    Avoid release 1.0.1a if you can.  Note that the default value of
+    "openssl_options" is no longer "+dont_insert_empty_fragments", as that
+    increased susceptibility to attack.  This may still have interoperability
+    implications for very old clients (see version 4.31 change 37) but
+    administrators can choose to make the trade-off themselves and restore
+    compatibility at the cost of session security.
+
+ 7. Use of the new expansion variable $tls_sni in the main configuration option
+    tls_certificate will cause Exim to re-expand the option, if the client
+    sends the TLS Server Name Indication extension, to permit choosing a
+    different certificate; tls_privatekey will also be re-expanded.  You must
+    still set these options to expand to valid files when $tls_sni is not set.
+
+    The SMTP Transport has gained the option tls_sni, which will set a hostname
+    for outbound TLS sessions, and set $tls_sni too.
+
+    A new log_selector, +tls_sni, has been added, to log received SNI values
+    for Exim as a server.
+
+    Currently OpenSSL only.
+
+ 8. The existing "accept_8bitmime" option now defaults to true.  This means
+    that Exim is deliberately not strictly RFC compliant.  We're following
+    Dan Bernstein's advice in http://cr.yp.to/smtp/8bitmime.html by default.
+    Those who disagree, or know that they are talking to mail servers that,
+    even today, are not 8-bit clean, need to turn off this option.
+
+ 9. Exim can now be started with -bw (with an optional timeout, given as
+    -bw<timespec>).  With this, stdin at startup is a socket that is
+    already listening for connections.  This has a more modern name of
+    "socket activation", but forcing the activated socket to fd 0.  We're
+    interested in adding more support for modern variants.

 
 
 Version 4.77
 
 
 Version 4.77