Support "G" modifier on numbers in ${if comparisons.

[users/heiko/exim.git] / doc / doc-txt / NewStuff

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index b962b61a24a71481a3c3da7c19f2266827d1634a..aae58c631db548f7b05499c75e97e394b9ef2d64 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -6,7 +6,86 @@ Before a formal release, there may be quite a lot of detail so that people can
 test from the snapshots or the CVS before the documentation is updated. Once
 the documentation is updated, this file is reduced to a short list.
 
 test from the snapshots or the CVS before the documentation is updated. Once
 the documentation is updated, this file is reduced to a short list.
 

-Version 4.78
+Version 4.81
+------------
+
+ 1. New command-line option -bI:sieve will list all supported sieve extensions
+    of this Exim build on standard output, one per line.
+    ManageSieve (RFC 5804) providers managing scripts for use by Exim should
+    query this to establish the correct list to include in the protocol's
+    SIEVE capability line.
+
+ 2. If the -n option is combined with the -bP option, then the name of an
+    emitted option is not output, only the value (if visible to you).
+    For instance, "exim -n -bP pid_file_path" should just emit a pathname
+    followed by a newline, and no other text.
+
+ 3. When built with SUPPORT_TLS and USE_GNUTLS, the SMTP transport driver now
+    has a "tls_dh_min_bits" option, to set the minimum acceptable number of
+    bits in the Diffie-Hellman prime offered by a server (in DH ciphersuites)
+    acceptable for security.  (Option accepted but ignored if using OpenSSL).
+    Defaults to 1024, the old value.  May be lowered only to 512, or raised as
+    far as you like.  Raising this may hinder TLS interoperability with other
+    sites and is not currently recommended.  Lowering this will permit you to
+    establish a TLS session which is not as secure as you might like.
+
+    Unless you really know what you are doing, leave it alone.
+
+ 4. If not built with DISABLE_DNSSEC, Exim now has the main option
+    dns_use_dnssec; if set to 1 then Exim will initialise the resolver library
+    to send the DO flag to your recursive resolver.  If you have a recursive
+    resolver, which can set the Authenticated Data (AD) flag in results, Exim
+    can now detect this.
+
+    Current status: work-in-progress; $sender_host_dnssec variable added.
+
+ 5. DSCP support for outbound connections: on a transport using the smtp driver,
+    set "dscp = ef", for instance, to cause the connections to have the relevant
+    DSCP (IPv4 TOS or IPv6 TCLASS) value in the header.
+
+    Similarly for inbound connections, there is a new control modifier, dscp,
+    so "warn control = dscp/ef" in the connect ACL, or after authentication.
+
+    Supported values depend upon system libraries.  "exim -bI:dscp" to list the
+    ones Exim knows of.  You can also set a raw number 0..0x3F.
+
+ 6. The -G command-line flag is no longer ignored; it is now equivalent to an
+    ACL setting "control = suppress_local_fixups".  The -L command-line flag
+    is now accepted and forces use of syslog, with the provided tag as the
+    process name.  A few other flags used by Sendmail are now accepted and
+    ignored.
+
+ 7. New cutthrough routing feature.  Requested by a "control = cutthrough_delivery"
+    ACL modifier; works for single-recipient mails which are recieved on and
+    deliverable via SMTP.  Using the connection made for a recipient verify,
+    if requested before the verify, or a new one made for the purpose while
+    the inbound connection is still active.  The bulk of the mail item is copied
+    direct from the inbound socket to the outbound (as well as the spool file).
+    When the source notifies the end of data, the data acceptance by the destination
+    is negociated before the acceptance is sent to the source.  If the destination
+    does not accept the mail item, for example due to content-scanning, the item
+    is not accepted from the source and therefore there is no need to generate
+    a bounce mail.  This is of benefit when providing a secondary-MX service.
+    The downside is that delays are under the control of the ultimate destination
+    system not your own.
+
+    The Recieved-by: header on items delivered by cutthrough is generated
+    early in of reception rather than at the end; this will affect any timestamp
+    included.  The log line showing delivery is recorded before that showing
+    reception; it uses a new ">>" tag instead of "=>".
+    
+    To support the feature, verify-callout connections can now use ESMTP and TLS.
+    The usual smtp transport options are honoured, plus a (new, default everything)
+    hosts_verify_avoid_tls.
+
+    New variable families named tls_in_cipher, tls_out_cipher etc. are introduced
+    for specific access to the information for each connection.  The old names
+    are present for now but deprecated.
+
+    Not yet supported: IGNOREQUOTA, SIZE, PIPELINING, AUTH.
+
+
+Version 4.80

 ------------
 
  1. New authenticator driver, "gsasl".  Server-only (at present).
 ------------
 
  1. New authenticator driver, "gsasl".  Server-only (at present).


@@ -26,6 +105,9 @@ Version 4.78
     "LOOKUP_LIBS" directly.  Similarly for handling the TLS library support
     without adjusting "TLS_INCLUDE" and "TLS_LIBS".
 
     "LOOKUP_LIBS" directly.  Similarly for handling the TLS library support
     without adjusting "TLS_INCLUDE" and "TLS_LIBS".
 

+    In addition, setting PCRE_CONFIG=yes will query the pcre-config tool to
+    find the headers and libraries for PCRE.
+

  4. New expansion variable $tls_bits.
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
  4. New expansion variable $tls_bits.
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will


@@ -33,6 +115,80 @@ Version 4.78
     into the DBM library.  Can be used with gsasl to access sasldb2 files as
     used by Cyrus SASL.
 
     into the DBM library.  Can be used with gsasl to access sasldb2 files as
     used by Cyrus SASL.
 

+ 6. OpenSSL now supports TLS1.1 and TLS1.2 with OpenSSL 1.0.1.
+
+    Avoid release 1.0.1a if you can.  Note that the default value of
+    "openssl_options" is no longer "+dont_insert_empty_fragments", as that
+    increased susceptibility to attack.  This may still have interoperability
+    implications for very old clients (see version 4.31 change 37) but
+    administrators can choose to make the trade-off themselves and restore
+    compatibility at the cost of session security.
+
+ 7. Use of the new expansion variable $tls_sni in the main configuration option
+    tls_certificate will cause Exim to re-expand the option, if the client
+    sends the TLS Server Name Indication extension, to permit choosing a
+    different certificate; tls_privatekey will also be re-expanded.  You must
+    still set these options to expand to valid files when $tls_sni is not set.
+
+    The SMTP Transport has gained the option tls_sni, which will set a hostname
+    for outbound TLS sessions, and set $tls_sni too.
+
+    A new log_selector, +tls_sni, has been added, to log received SNI values
+    for Exim as a server.
+
+ 8. The existing "accept_8bitmime" option now defaults to true.  This means
+    that Exim is deliberately not strictly RFC compliant.  We're following
+    Dan Bernstein's advice in http://cr.yp.to/smtp/8bitmime.html by default.
+    Those who disagree, or know that they are talking to mail servers that,
+    even today, are not 8-bit clean, need to turn off this option.
+
+ 9. Exim can now be started with -bw (with an optional timeout, given as
+    -bw<timespec>).  With this, stdin at startup is a socket that is
+    already listening for connections.  This has a more modern name of
+    "socket activation", but forcing the activated socket to fd 0.  We're
+    interested in adding more support for modern variants.
+
+10. ${eval } now uses 64-bit values on supporting platforms.  A new "G" suffix
+    for numbers indicates multiplication by 1024^3.
+
+11. The GnuTLS support has been revamped; the three options gnutls_require_kx,
+    gnutls_require_mac & gnutls_require_protocols are no longer supported.
+    tls_require_ciphers is now parsed by gnutls_priority_init(3) as a priority
+    string, documentation for which is at:
+    http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
+
+    SNI support has been added to Exim's GnuTLS integration too.
+
+    For sufficiently recent GnuTLS libraries, ${randint:..} will now use
+    gnutls_rnd(), asking for GNUTLS_RND_NONCE level randomness.
+
+12. With OpenSSL, if built with EXPERIMENTAL_OCSP, a new option tls_ocsp_file
+    is now available.  If the contents of the file are valid, then Exim will
+    send that back in response to a TLS status request; this is OCSP Stapling.
+    Exim will not maintain the contents of the file in any way: administrators
+    are responsible for ensuring that it is up-to-date.
+
+    See "experimental-spec.txt" for more details.
+
+13. ${lookup dnsdb{ }} supports now SPF record types. They are handled
+    identically to TXT record lookups.
+
+14. New expansion variable $tod_epoch_l for higher-precision time.
+
+15. New global option tls_dh_max_bits, defaulting to current value of NSS
+    hard-coded limit of DH ephemeral bits, to fix interop problems caused by
+    GnuTLS 2.12 library recommending a bit count higher than NSS supports.
+
+16. tls_dhparam now used by both OpenSSL and GnuTLS, can be path or identifier.
+    Option can now be a path or an identifier for a standard prime.
+    If unset, we use the DH prime from section 2.2 of RFC 5114, "ike23".
+    Set to "historic" to get the old GnuTLS behaviour of auto-generated DH
+    primes.
+
+17. SSLv2 now disabled by default in OpenSSL.  (Never supported by GnuTLS).
+    Use "openssl_options -no_sslv2" to re-enable support, if your OpenSSL
+    install was not built with OPENSSL_NO_SSL2 ("no-ssl2").
+

 
 Version 4.77
 ------------
 
 Version 4.77
 ------------