X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/a799883d8ad340d935db4d729a31c02cb8a1d977..b84580f1e38405e0a94f8d8f41df0cdaf8d0115f:/src/README.UPDATING diff --git a/src/README.UPDATING b/src/README.UPDATING index 6a820bc7c..ef07d6533 100644 --- a/src/README.UPDATING +++ b/src/README.UPDATING @@ -26,6 +26,57 @@ The rest of this document contains information about changes in 4.xx releases that might affect a running system. +Exim version 4.89 +----------------- + + * OpenSSL: oldest supported release series is now 1.0.2, which is the oldest + supported by the OpenSSL project. If you can build Exim with an older + release series, congratulations. If you can't, then upgrade. + The file doc/openssl.txt contains instructions for installing a current + OpenSSL outside the system library paths and building Exim to use it. + + +Exim version 4.88 +----------------- + + * The "demime" ACL condition, deprecated for the past 10 years, has + now been removed. + + * Old GnuTLS configuration options "gnutls_require_kx", "gnutls_require_mac", + and "gnutls_require_protocols" have now been removed. (Inoperative from + 4.80, per below; logging warnings since 4.83, again per below). + + +Exim version 4.83 +----------------- + + * SPF condition results renamed "permerror" and "temperror". The old + names are still accepted for back-compatability, for this release. + + * TLS details are now logged on rejects, subject to log selectors. + + * Items in headers_remove lists must now have any embedded list-separators + doubled. + + * Attempted use of the deprecated options "gnutls_require_kx" et. al. + now result in logged warning. + + +Exim version 4.82 +----------------- + + * New option gnutls_allow_auto_pkcs11 defaults false; if you have GnuTLS 2.12.0 + or later and do want PKCS11 modules to be autoloaded, then set this option. + + * A per-transport wait- database is no longer updated if the transport + sets "connection_max_messages" to 1, as it can not be used and causes + unnecessary serialisation and load. External tools tracking the state of + Exim by the hints databases may need modification to take this into account. + + * The av_scanner option can now accept multiple clamd TCP targets, all other + setting limitations remain. + + Exim version 4.80 ----------------- @@ -43,6 +94,12 @@ Exim version 4.80 the message. No tool has been provided as we believe this is a rare occurence. + * For OpenSSL, SSLv2 is now disabled by default. (GnuTLS does not support + SSLv2). RFC 6176 prohibits SSLv2 and some informal surveys suggest no + actual usage. You can re-enable with the "openssl_options" Exim option, + in the main configuration section. Note that supporting SSLv2 exposes + you to ciphersuite downgrade attacks. + * With OpenSSL 1.0.1+, Exim now supports TLS 1.1 and TLS 1.2. If built against 1.0.1a then you will get a warning message and the "openssl_options" value will not parse "no_tlsv1_1": the value changes @@ -52,8 +109,9 @@ Exim version 4.80 "openssl_options" gains "no_tlsv1_1", "no_tlsv1_2" and "no_compression". COMPATIBILITY WARNING: The default value of "openssl_options" is no longer - "+dont_insert_empty_fragments". We default to unset. That old default was - grandfathered in from before openssl_options became a configuration option. + "+dont_insert_empty_fragments". We default to "+no_sslv2". + That old default was grandfathered in from before openssl_options became a + configuration option. Empty fragments are inserted by default through TLS1.0, to partially defend against certain attacks; TLS1.1+ change the protocol so that this is not needed. The DIEF SSL option was required for some old releases of mail @@ -105,7 +163,7 @@ Exim version 4.80 is instead given to gnutls_priority_init(3), which expects a priority string; this behaviour is much closer to the OpenSSL behaviour. See: - http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html + http://www.gnutls.org/manual/html_node/Priority-Strings.html for fuller documentation of the strings parsed. The three gnutls_require_* options are still parsed by Exim and, for this release, silently ignored. @@ -493,7 +551,7 @@ Version 4.23 3. Version 4.23 saves the contents of the ACL variables with the message, so that they can be used later. If one of these variables contains a newline, there will be a newline character in the spool that will not be interpreted - correctely by a previous version of Exim. (Exim ignores keyed spool file + correctly by a previous version of Exim. (Exim ignores keyed spool file items that it doesn't understand - precisely for this kind of problem - but it expects them all to be on one line.)