Update openssl_options values to 1.1.1c

[users/heiko/exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index f1db06451049f7f8f0a1c49dc3a00b5078b60619..43b306d3b8d787989746c3cc3844a0bbc4205fd0 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -70,6 +70,49 @@ JH/16 Fix the variables set by the gsasl authenticator.  Previously a pointer to
       library live data was being used, so the results became garbage.  Make
       copies while it is still usable.
 
       library live data was being used, so the results became garbage.  Make
       copies while it is still usable.
 

+JH/17 Logging: when the deliver_time selector ise set, include the DT= field
+      on delivery deferred (==) and failed (**) lines (if a delivery was
+      attemtped).  Previously it was only on completion (=>) lines.
+
+JH/18 Authentication: the gsasl driver not provides the $authN variables in time
+      for the expansion of the server_scram_iter and server_scram_salt options.
+
+WB/01 SPF: DNS lookups for the obsolete SPF RR type done by the libspf2 library
+      are now specifically given a NO_DATA response without hitting the system
+      resolver.  The library goes on to do the now-standard TXT lookup.
+      Use of dnsdb lookups is not affected.
+
+JH/19 Bug 2507: Modules: on handling a dynamic-module (lookups) open failure,
+      only retrieve the errormessage once.  Previously two calls to dlerror()
+      were used, and the second one (for mainlog/paniclog) retrieved null
+      information.
+
+JH/20 Taint checking: disallow use of tainted data for
+      - the appendfile transport file and directory options
+      - the pipe transport command
+      - the autoreply transport file, log and once options
+      - file names used by the redirect router (including filter files)
+      - named-queue names
+      Previously this was permitted.
+
+JH/21 Bug 2501: Fix init call in the heimdal authenticator.  Previously it
+      adjusted the size of a major service buffer; this failed because the
+      buffer was in use at the time.  Change to a compile-time increase in the
+      buffer size, when this authenticator is compiled into exim.
+
+JH/22 Taint checking: move to a hybrid approach for checking.  Previously, one
+      of two ways was used, depending on a build-time flag.  The fast method
+      relied on assumptions about the OS and libc malloc, which were known to
+      not hold for the BSD-derived platforms, and discovered to not hold for
+      32-bit Linux either.  In fact the glibc documentation describes cases
+      where these assumptions do not hold.  The new implementation tests for
+      the situation arising and actively switches over from fast to safe mode.
+
+PP/01 Update the openssl_options possible values through OpenSSL 1.1.1c.
+      New values supported, if defined on system where compiled:
+      allow_no_dhe_kex, cryptopro_tlsext_bug, enable_middlebox_compat,
+      no_anti_replay, no_encrypt_then_mac, prioritize_chacha, tlsext_padding
+

 
 Exim version 4.93
 -----------------
 
 Exim version 4.93
 -----------------