X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/322050c2d9e83d10f046da71aa2cd9cc5a355b0b..328895cc07b8caf8c18003569431a02129989289:/doc/doc-txt/ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 599c7877a..6d51cd882 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.404 2006/10/09 14:36:25 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.414 2006/10/24 12:56:06 ph10 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -65,7 +65,7 @@ PH/11 Callouts were setting the name used for EHLO/HELO from $smtp_active_
       addresses), $smtp_active_hostname is used.
 
 PH/12 Installed Andrey Panin's patch to add a dovecot authenticator. Various
-      tweaks were necessary in order to get it to work:
+      tweaks were necessary in order to get it to work (see also 21 below):
       (a) The code assumed that strncpy() returns a negative number on buffer
           overflow, which isn't the case. Replaced with Exim's string_format()
           function.
@@ -109,6 +109,63 @@ PH/16 It seems that the options setting for the resolver (RES_DEFNAMES and
       of host_find_byname() use the default settings of RES_DEFNAMES
       (qualify_single) but not RES_DNSRCH (search_parents).
 
+PH/17 Applied (a modified version of) Nico Erfurth's patch to make
+      spool_read_header() do less string testing, by means of a preliminary
+      switch on the second character of optional "-foo" lines. (This is
+      overdue, caused by the large number of possibilities that now exist.
+      Originally there were few.) While I was there, I also converted the
+      str(n)cmp tests so they don't re-test the leading "-" and the first
+      character, in the hope this might squeeze out yet more improvement.
+
+PH/18 Two problems with "group" syntax in header lines when verifying: (1) The
+      flag allowing group syntax was set by the header_syntax check but not
+      turned off, possible causing trouble later; (2) The flag was not being
+      set at all for the header_verify test, causing "group"-style headers to
+      be rejected. I have now set it in this case, and also caused header_
+      verify to ignore an empty address taken from a group. While doing this, I
+      came across some other cases where the code for allowing group syntax
+      while scanning a header line wasn't quite right (mostly, not resetting
+      the flag correctly in the right place). These bugs could have caused
+      trouble for malformed header lines. I hope it is now all correct.
+
+PH/19 The functions {pwcheck,saslauthd}_verify_password() are always called
+      with the "reply" argument non-NULL. The code, however (which originally
+      came from elsewhere) had *some* tests for NULL when it wrote to *reply,
+      but it didn't always do it. This confused somebody who was copying the
+      code for some other use. I have removed all the tests.
+
+PH/20 It was discovered that the GnuTLS code had support for RSA_EXPORT, a
+      feature that was used to support insecure browsers during the U.S. crypto
+      embargo. It requires special client support, and Exim is probably the
+      only MTA that supported it -- and would never use it because real RSA is
+      always available. This code has been removed, because it had the bad
+      effect of slowing Exim down by computing (never used) parameters for the
+      RSA_EXPORT functionality.
+
+PH/21 On the advice of Timo Sirainen, added a check to the dovecot
+      authenticator to fail if there's a tab character in the incoming data
+      (there should never be unless someone is messing about, as it's supposed
+      to be base64-encoded). Also added, on Timo's advice, the "secured" option
+      if the connection is using TLS or if the remote IP is the same as the
+      local IP, and the "valid-client-cert option" if a client certificate has
+      been verified.
+
+PH/22 As suggested by Dennis Davis, added a server_condition option to *all*
+      authenticators. This can be used for authorization after authentication
+      succeeds. (In the case of plaintext, it servers for both authentication
+      and authorization.)
+
+PH/23 Testing for tls_required and lost_connection in a retry rule didn't work
+      if any retry times were supplied.
+
+PH/24 Exim crashed if verify=helo was activated during an incoming -bs
+      connection, where there is no client IP address to check. In this
+      situation, the verify now always succeeds.
+
+PH/25 Applied John Jetmore's -Mset patch.
+
+PH/26 Added -bem to be like -Mset, but loading a message from a file.
+
 
 Exim version 4.63
 -----------------