GnuTLS: Fix client detection of server reject of client cert under TLS1.3

[exim.git] / doc / doc-misc / WishList

diff --git a/doc/doc-misc/WishList b/doc/doc-misc/WishList
index 808626dd0e3520122e6f7fdbf845cd623df0a28a..28ae7332f5a264b824f80414f0ad9fd62426570d 100644 (file)
--- a/doc/doc-misc/WishList
+++ b/doc/doc-misc/WishList
@@ -1,8 +1,12 @@
-$Cambridge: exim/doc/doc-misc/WishList,v 1.57 2005/11/17 10:15:28 ph10 Exp $
-

 EXIM 4 WISH LIST
 ----------------
 
 EXIM 4 WISH LIST
 ----------------
 

+This Wish List is now obsolete. The items it contains have been imported into
+the Exim Bugzilla, which is where all new wishes should be added. This file is
+no longer maintained. Some day it should be deleted.
+
+
+===============================================================================

 Even when it was first released, Exim 4 had a Wish List because not all the
 things suggested for it were implemented. The list has not stopped growing...
 
 Even when it was first released, Exim 4 had a Wish List because not all the
 things suggested for it were implemented. The list has not stopped growing...
 


@@ -167,8 +171,8 @@ So the admin can pass back a reason.
 mark david mcCreary
 
 "I use the syntax_errors_to feature to email a copy of the error message.
 mark david mcCreary
 
 "I use the syntax_errors_to feature to email a copy of the error message.

-It would be helpful to have the X-Failed-Receipients header in there,
-identifying which addreses(s) are the problem, so that I don't have to
+It would be helpful to have the X-Failed-Recipients header in there,
+identifying which address(es) are the problem, so that I don't have to

 parse the body of the email message to figure out which addresses."
 ------------------------------------------------------------------------------
 
 parse the body of the email message to figure out which addresses."
 ------------------------------------------------------------------------------
 


@@ -295,16 +299,6 @@ David Carter
 So several warnings could be generated as the mailbox got bigger and bigger.
 ------------------------------------------------------------------------------
 
 So several warnings could be generated as the mailbox got bigger and bigger.
 ------------------------------------------------------------------------------
 

-(146) 15-May-2000 M  Allow SMTP error codes in retry rules
-
-This would allow special handling of certain errors from certain hosts. In
-particular, it would allow failing of certain 4xx codes.
-
-This is now available for 4xx responses to RCPT commands. Is anything more
-needed? Apparently, yes; there's been a request for a similar feature for MAIL
-commands.
-------------------------------------------------------------------------------
-

 (148) 15-May-2000 S  Warn recipient if message rejected for quota excession.
 Heinz Ekker
 
 (148) 15-May-2000 S  Warn recipient if message rejected for quota excession.
 Heinz Ekker
 


@@ -626,7 +620,7 @@ Joachim Wieland
 
 Is this really worth it? A per-transport value is also suggested - that would
 mean remembering the value with each failed address and taking a minimum or
 
 Is this really worth it? A per-transport value is also suggested - that would
 mean remembering the value with each failed address and taking a minimum or

-a maximimum (which?).
+a maximum (which?).

 ------------------------------------------------------------------------------
 
 (24)  21-Feb-02 ?  A way of testing TLS using -bh
 ------------------------------------------------------------------------------
 
 (24)  21-Feb-02 ?  A way of testing TLS using -bh


@@ -821,7 +815,7 @@ logs the IP of the sending host in the => line?" Also requested was amount of
 data transmitted for a non-delivery attempt.
 ------------------------------------------------------------------------------
 
 data transmitted for a non-delivery attempt.
 ------------------------------------------------------------------------------
 

-(69)  03-Jul-02 T  Log selector to log whoson checs
+(69)  03-Jul-02 T  Log selector to log whoson checks

 Matt Bernstein
 
 "I'd quite like a log_selector option which could spot you'd done a whoson
 Matt Bernstein
 
 "I'd quite like a log_selector option which could spot you'd done a whoson


@@ -995,7 +989,7 @@ a list defer.
 Peter A. Savitch
 
 OpenLDAP 2.1 is going to be more popular (2.1.9 is available with many
 Peter A. Savitch
 
 OpenLDAP 2.1 is going to be more popular (2.1.9 is available with many

-bug fixes). TLS-enabled LDAP is an interesting and usefull thing.
+bug fixes). TLS-enabled LDAP is an interesting and useful thing.

 I can try to implement some things and send the patches, like with
 ldapi.
 
 I can try to implement some things and send the patches, like with
 ldapi.
 


@@ -1220,12 +1214,6 @@ Maybe there should always be a variable with the error message for all the
 different kinds of verify failure.
 ------------------------------------------------------------------------------
 
 different kinds of verify failure.
 ------------------------------------------------------------------------------
 

-(196) 30-Sep-03 S  A way of detecting whether it was HELO or EHLO in the ACL
-
-$received_protocol isn't reset until after the command is accepted (which
-seems right), and $smtp_data shows only the arguments. Maybe $smtp_command?
-------------------------------------------------------------------------------
-

 (197) 30-Sep-03 S  MACROS_DROP_PRIVS and ALT_CONFIG_DROP_PRIVS
 
 Now that alternative configurations can be restricted to certain directories,
 (197) 30-Sep-03 S  MACROS_DROP_PRIVS and ALT_CONFIG_DROP_PRIVS
 
 Now that alternative configurations can be restricted to certain directories,


@@ -1261,11 +1249,6 @@ This is an option that turns all hard bounces into soft bounces. The idea is
 that it can be used as a safety-net while testing configurations. Instead of a
 local bounce, the message stays on the queue; instead of 5xx SMTP responses,
 4xx ones are given.
 that it can be used as a safety-net while testing configurations. Instead of a
 local bounce, the message stays on the queue; instead of 5xx SMTP responses,
 4xx ones are given.

-
-The ability to do the opposite - turn 4xx into 5xx under certain circumstances
-might also be useful (e.g. after a certain time). This might best be done by
-extending the retry logic to recognize 4xx as a special error. (This is now
-done.)

 ------------------------------------------------------------------------------
 
 (202) 10-Oct-03 S  -bvsomething to do a callout after the verify
 ------------------------------------------------------------------------------
 
 (202) 10-Oct-03 S  -bvsomething to do a callout after the verify


@@ -1303,7 +1286,6 @@ permanent ones after some fixed time.
 ------------------------------------------------------------------------------
 
 (209) 31-Oct-03 S  a way of making crashes in pipe commands temporary errors
 ------------------------------------------------------------------------------
 
 (209) 31-Oct-03 S  a way of making crashes in pipe commands temporary errors

-

 ------------------------------------------------------------------------------
 
 (210) 31-Oct-03 S  runtime option to change the daemon name used for tcprwappers
 ------------------------------------------------------------------------------
 
 (210) 31-Oct-03 S  runtime option to change the daemon name used for tcprwappers


@@ -1320,19 +1302,11 @@ option, for use with multiple Exim daemons.
 See also 333.
 ------------------------------------------------------------------------------
 
 See also 333.
 ------------------------------------------------------------------------------
 

-(214) 05-Nov-03 S  Put the wild part of local part prefix/suffx in variables
+(214) 05-Nov-03 S  Put the wild part of local part prefix/suffix in variables

 
 Unfortunately, this isn't quite as trivial as it seems.
 ------------------------------------------------------------------------------
 
 
 Unfortunately, this isn't quite as trivial as it seems.
 ------------------------------------------------------------------------------
 

-(215) 14-Nov-03 S  A way of turning off message-submission fix-ups
-
-Globally, and perhaps also via an ACL control so that it can be done on a
-per-message basis. Is this still needed? Since this item was added to this
-list, default fixups for non-local messages have been removed, and control =
-submission has been added.
-------------------------------------------------------------------------------
-

 (215) 26-Nov-03 M/L Conversion of IDNA domain names for logging
 
 IDNA (RFCs 3490-3492) converts domains names containing non-ASCII characters
 (215) 26-Nov-03 M/L Conversion of IDNA domain names for logging
 
 IDNA (RFCs 3490-3492) converts domains names containing non-ASCII characters


@@ -1344,13 +1318,6 @@ e.g. exigrep, eximstats, will be automatically handled if the logs are
 changed.)
 ------------------------------------------------------------------------------
 
 changed.)
 ------------------------------------------------------------------------------
 

-(216) 27-Nov-03 S  Option to bounce if required TLS doesn't happen
-
-This is for the smtp transport with hosts_require_tls set. Currently, it
-defers. Possibly the best approach is to make the error one that can be seen by
-the retry logic.
-------------------------------------------------------------------------------
-

 (217) 27-Nov-03 M  A function to pass back variables from Perl
 
 This is a function that can be called from Perl, to take a name and a value and
 (217) 27-Nov-03 M  A function to pass back variables from Perl
 
 This is a function that can be called from Perl, to take a name and a value and


@@ -1456,12 +1423,6 @@ this reason, I don't really like this idea.
 (236) 02-Feb-04 S  String in local_scan that's added to the binary version string
 ------------------------------------------------------------------------------
 
 (236) 02-Feb-04 S  String in local_scan that's added to the binary version string
 ------------------------------------------------------------------------------
 

-(237) 02-Feb-04 M  Add_header in ACLs because "message" is overloaded
-
-This would be useful for verbs where "message" is an error message. See also
-333.
-------------------------------------------------------------------------------
-

 (238) 05-Feb-04 S  ${address to handle multiple addresses
 
 At present, ${address expects to see just one address. An extension would let
 (238) 05-Feb-04 S  ${address to handle multiple addresses
 
 At present, ${address expects to see just one address. An extension would let


@@ -1622,12 +1583,6 @@ For example: mainlog_selector and rejectlog_selector, with log_selector setting
 both of them.
 ------------------------------------------------------------------------------
 
 both of them.
 ------------------------------------------------------------------------------
 

-(286) 21-Jul-04 M Distinguishing a larger number of errors
-
-For instance, detecting "connection reset by peer" (ENETRESET or ECONNRESET)
-might be useful.
-------------------------------------------------------------------------------
-

 (288) 10-Aug-04 M Option for verify to require MX
 
 e.g. verify=sender/require_mx
 (288) 10-Aug-04 M Option for verify to require MX
 
 e.g. verify=sender/require_mx


@@ -1653,7 +1608,7 @@ how useful this would actually be in practice.
 
 (292) 13-Aug-04 M Overall timeout for message reception
 
 
 (292) 13-Aug-04 M Overall timeout for message reception
 

-A client could in priciple keep an SMTP connection open for a very long time by
+A client could in principle keep an SMTP connection open for a very long time by

 trickling in data very slowly. Also, after message_size_limit is exceeded, Exim
 continues to swallow the data (though it does not write it to disk) until the
 end is reached. Again, the connection could be held open for a very long time.
 trickling in data very slowly. Also, after message_size_limit is exceeded, Exim
 continues to swallow the data (though it does not write it to disk) until the
 end is reached. Again, the connection could be held open for a very long time.


@@ -1919,7 +1874,7 @@ headers should be re-planned and re-implemented in a more consistent manner.
 These are the main previous items:
 
 Exim 3 Wish List: 41, 85, 149, 187.
 These are the main previous items:
 
 Exim 3 Wish List: 41, 85, 149, 187.

-Exim 4 Wish List: 55, 62, 63, 160, 212, 237, 270, 314, 328.
+Exim 4 Wish List: 55, 62, 63, 160, 212, 270, 314, 328.

 ------------------------------------------------------------------------------
 
 (334) 07-Jun-05 M Support for messages larger than 2G
 ------------------------------------------------------------------------------
 
 (334) 07-Jun-05 M Support for messages larger than 2G


@@ -1969,7 +1924,7 @@ second. Maybe something like ${match_any{...}{...}} is needed.
 
 (341) 15-Sep-05 S Add /return_path_retain to submission mode
 
 
 (341) 15-Sep-05 S Add /return_path_retain to submission mode
 

-This would re-instate the behaviour prior to change 4.52/TF/02.
+This would re-instate the behaviour prior to change 4.52/PH/04.

 ------------------------------------------------------------------------------
 
 (342) 26-Sep-05 T Log and maybe defer odd values for condition pre-condition
 ------------------------------------------------------------------------------
 
 (342) 26-Sep-05 T Log and maybe defer odd values for condition pre-condition


@@ -1983,6 +1938,34 @@ should also defer, for compatibility with ACLs.
 
 The natural syntax for this would be to use a regex, like this:
 ${lookup regex{/some/file regex}{found-string}{not-found-string}}
 
 The natural syntax for this would be to use a regex, like this:
 ${lookup regex{/some/file regex}{found-string}{not-found-string}}

+However, it would be natural to want to use $1 etc in the found-string; this
+would be hard because of the lookup caching (if repeated, the lookup won't
+actually be done and therefore the numerical variables won't be set), and in
+any case, even without caching (and it could, I suppose, be disabled for this
+lookup) those variables are not in the right storage pool even if they were
+preserved after the lookup.
+
+An alternative approach might be to implement something like this:
+
+  ${scanfile{/some/file}{sub-expression}}
+
+where the sub-expression is expanded for every line in the file, with each line
+in turn being put into $value. This is like a conditional ${readfile, and in
+fact ${readfile could be written using ${scanfile. It would be nice to find a
+way of stopping the scan once something has happened. The only thing I can
+think of is to invent a variable that changes when scanning a line generates
+some non-null text, and then always to stop on a forced failure. That would
+allow expressions like this:
+
+  ${scanfile{/some/file}
+    {
+    ${if eq{$generated}{}{${if match{regex}{$value}{something}}} fail}
+    }}
+
+It's all rather clumsy. Once a line has matched and generated some text, the
+next iteration would stop the scan. Another thought: maybe use $scanline
+instead of $value (to save confusion) and have $scantext containing everything
+that's been generated so far. That sounds pretty flexible.

 ------------------------------------------------------------------------------
 
 (344) 10-Oct-05 M Make debug_print work in authenticators
 ------------------------------------------------------------------------------
 
 (344) 10-Oct-05 M Make debug_print work in authenticators


@@ -2011,11 +1994,66 @@ code, because of caching. Probably means we have to invent ewildlsearch and
 enwildlsearch.
 ------------------------------------------------------------------------------
 
 enwildlsearch.
 ------------------------------------------------------------------------------
 

-(348) 17-Nov-05 S Option to allow AUTH when not advertised.
+(351) 31-Mar-06 ? Allow some/all/a few internal variables to be set
+
+The original idea was to allow "set authenticated = x" to pretend a connection
+is authenticated after other conditions are true. This can, of course, be
+packaged up using macros in other ways. Setting other variables could cause
+problems.
+------------------------------------------------------------------------------
+
+(352) 04-Apr-06 S Add +accept_defer for host lists (and maybe others)
+
+At present, a defer causes a delivery defer. For non-critical ACLs there are
+times when it may be better to accept. See also 226 and 289.
+------------------------------------------------------------------------------
+
+(354) 30-Jun-06 ? Extensions to SMTP error codes
+
+A number of ideas arose following a discussion on the mailing list. I record
+them here so that they don't get lost. The motivations were to support the 551
+bounce code and enhanced status codes. Suggestions are to add a new ACL
+feature, possibly one of:
+
+  errorcode = 511
+  control = errorcode=551
+  message = 551 xxxx
+
+where in the last case, it's recognized by being 3 digits. In all cases, the
+first digit must be "right" for the circumstance - ignore or fault if not?
+
+To handle ESC, perhaps a new variable called $smtp_errorcode, settable by an
+option in a router when it fails, would do the trick. It could be used in any
+of the above modifiers.
+------------------------------------------------------------------------------
+
+(355) 30-Jun-06 ? Facility to permit experiments with SMTP extensions
+
+This is what was suggested:
+
+- adding some expansion variables: $ehlo_extensions (which will
+   hold the remote server supported smtp extensions announced
+   in the ehlo) and $rcpt_arguments with any RCPT extra argument
+
+- a main configuration option for adding ehlo extensions to the
+   ehlo response, like:
+
+   extra_ehlo_extensions = XFOO : XBAR
+
+- a extra option for the smtp transport to add arguments to
+   the RCPT TO command, like:
+
+   rcpt_args = FOO=BAR  (will make exim issue RCPT TO:<a@b.c> FOO=BAR
+   when delivering that message)
+
+- a new acl for unknown smtp commands

 
 

-It seems that there are clients that send AUTH when it hasn't been advertised,
-some even after HELO, not even EHLO. Sigh. Possibly this should be an ACL
-control, to enable it to be restricted to certain hosts.
+This should be very simple to implement and will allow to make
+some experiments and implement custom extensions, i.e. one to
+known if remote client will redirect on 551 or not. Also the acl
+for unknown smtp command could be used for other purposes, like
+to detect and react to some kiddies that send things like
+http://... on the smtp port.

 ------------------------------------------------------------------------------
 ------------------------------------------------------------------------------

---- HWM 348 ------------------------------------------------------------------
+--- HWM 355 ------------------------------------------------------------------

 ---------------------------- End of WishList ---------------------------------
 ---------------------------- End of WishList ---------------------------------