X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/1a7b746d86ec130021bc42586e54246e04142f40..cc00f4af38ebcc8255460398f573ba6e6ec842e3:/doc/doc-txt/NewStuff?ds=inline

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 9c8b9df7b..33d23f72a 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -6,6 +6,97 @@ Before a formal release, there may be quite a lot of detail so that people can
 test from the snapshots or the CVS before the documentation is updated. Once
 the documentation is updated, this file is reduced to a short list.
 
+Version 4.86
+------------
+
+ 1. Support for using the system standard CA bundle.
+
+ 2. New expansion items $config_file, $config_dir, containing the file
+    and directory name of the main configuration file. Also $exim_version.
+
+ 3. New "malware=" support for Avast.
+
+ 4. New "spam=" variant option for Rspamd.
+
+ 5. Assorted options on malware= and spam= scanners.
+
+ 6. A commandline option to write a comment into the logfile.
+
+Version 4.85
+------------
+
+ 1. If built with EXPERIMENTAL_DANE feature enabled, Exim will follow the
+    DANE smtp draft to assess a secure chain of trust of the certificate
+    used to establish the TLS connection based on a TLSA record in the
+    domain of the sender.
+
+ 2. The EXPERIMENTAL_TPDA feature has been renamed to EXPERIMENTAL_EVENT
+    and several new events have been created. The reason is because it has
+    been expanded beyond just firing events during the transport phase. Any
+    existing TPDA transport options will have to be rewritten to use a new
+    $event_name expansion variable in a condition. Refer to the
+    experimental-spec.txt for details and examples.
+
+ 3. The EXPERIMENTAL_CERTNAMES features is an enhancement to verify that
+    server certs used for TLS match the result of the MX lookup. It does
+    not use the same mechanism as DANE.
+
+
+Version 4.84
+------------
+
+
+Version 4.83
+------------
+
+ 1. If built with the EXPERIMENTAL_PROXY feature enabled, Exim can be
+    configured to expect an initial header from a proxy that will make the
+    actual external source IP:host be used in exim instead of the IP of the
+    proxy that is connecting to it.
+
+ 2. New verify option header_names_ascii, which will check to make sure
+    there are no non-ASCII characters in header names.  Exim itself handles
+    those non-ASCII characters, but downstream apps may not, so Exim can
+    detect and reject if those characters are present.
+
+ 3. New expansion operator ${utf8clean:string} to replace malformed UTF8
+    codepoints with valid ones.
+
+ 4. New malware type "sock".  Talks over a Unix or TCP socket, sending one
+    command line and matching a regex against the return data for trigger
+    and a second regex to extract malware_name.  The mail spoolfile name can
+    be included in the command line.
+
+ 5. The smtp transport now supports options "tls_verify_hosts" and
+    "tls_try_verify_hosts".  If either is set the certificate verification
+    is split from the encryption operation. The default remains that a failed
+    verification cancels the encryption.
+
+ 6. New SERVERS override of default ldap server list.  In the ACLs, an ldap
+    lookup can now set a list of servers to use that is different from the
+    default list.
+
+ 7. New command-line option -C for exiqgrep to specify alternate exim.conf
+    file when searching the queue.
+
+ 8. OCSP now supports GnuTLS also, if you have version 3.1.3 or later of that.
+
+ 9. Support for DNSSEC on outbound connections.
+
+10. New variables "tls_(in,out)_(our,peer)cert" and expansion item
+    "certextract" to extract fields from them. Hash operators md5 and sha1
+    work over them for generating fingerprints, and a new sha256 operator
+    for them added.
+
+11. PRDR is now supported dy default.
+
+12. OCSP stapling is now supported by default.
+
+13. If built with the EXPERIMENTAL_DSN feature enabled, Exim will output
+    Delivery Status Notification messages in MIME format, and negociate
+    DSN features per RFC 3461.
+
+
 Version 4.82
 ------------
 
@@ -88,7 +179,7 @@ Version 4.82
  8. New expansion operators ${listnamed:name} to get the content of a named list
     and ${listcount:string} to count the items in a list.
 
- 9. New global option "gnutls_enable_pkcs11", defaults false.  The GnuTLS
+ 9. New global option "gnutls_allow_auto_pkcs11", defaults false.  The GnuTLS
     rewrite in 4.80 combines with GnuTLS 2.12.0 or later, to autoload PKCS11
     modules.  For some situations this is desirable, but we expect admin in
     those situations to know they want the feature.  More commonly, it means
@@ -97,6 +188,13 @@ Version 4.82
     through, thus breakage.  So we explicitly inhibit the PKCS11 initialisation
     unless this new option is set.
 
+    Some older OS's with earlier versions of GnuTLS might not have pkcs11 ability,
+    so have also added a build option which can be used to build Exim with GnuTLS
+    but without trying to use any kind of PKCS11 support.  Uncomment this in the
+    Local/Makefile:
+
+    AVOID_GNUTLS_PKCS11=yes
+
 10. The "acl = name" condition on an ACL now supports optional arguments.
     New expansion item "${acl {name}{arg}...}" and expansion condition
     "acl {{name}{arg}...}" are added.  In all cases up to nine arguments
@@ -157,6 +255,8 @@ Version 4.82
 25. Experimental TPDA (Transport Post Delivery Action) function added.
     Patch provided by Axel Rau.
 
+26. Experimental Redis lookup added. Patch provided by Warren Baker.
+
 
 Version 4.80
 ------------