X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/83e2f8a2515d1cd787ac68b052f6e4539dd48752..f45100a3ede668925c8212076b90bc70264a0abb:/src/README.UPDATING diff --git a/src/README.UPDATING b/src/README.UPDATING index a91794d6c..e685b8ec3 100644 --- a/src/README.UPDATING +++ b/src/README.UPDATING @@ -66,6 +66,11 @@ Exim version 4.80 security for compatibility. Exim is now defaulting to higher security and rewarding more modern clients. + If the option tls_dhparams is set and the parameters loaded from the file + have a bit-count greater than the new option tls_dh_max_bits, then the file + will now be ignored. If this affects you, raise the tls_dh_max_bits limit. + We suspect that most folks are using dated defaults and will not be affected. + * Ldap lookups returning multi-valued attributes now separate the attributes with only a comma, not a comma-space sequence. Also, an actual comma within a returned attribute is doubled. This makes it possible to parse the @@ -80,16 +85,18 @@ Exim version 4.80 new option, you can safely force it off before upgrading, to decouple configuration changes from the binary upgrade while remaining RFC compliant. - * The GnuTLS support has been mostly rewritten, to use 2.12.x APIs. As part - of this, these three options are no longer supported: + * The GnuTLS support has been mostly rewritten, to use APIs which don't cause + deprecation warnings in GnuTLS 2.12.x. As part of this, these three options + are no longer supported: gnutls_require_kx gnutls_require_mac gnutls_require_protocols - Their functionality is entirely subsumed into tls_require_ciphers, which is - no longer parsed apart by Exim but is instead given to - gnutls_priority_init(3), which is no longer an Exim list. See: + Their functionality is entirely subsumed into tls_require_ciphers. In turn, + tls_require_ciphers is no longer an Exim list and is not parsed by Exim, but + is instead given to gnutls_priority_init(3), which expects a priority string; + this behaviour is much closer to the OpenSSL behaviour. See: http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html @@ -109,6 +116,25 @@ Exim version 4.80 support for SNI and other features more readily. We regret that it wasn't feasible to retain the three dropped options. + * If built with TLS support, then Exim will now validate the value of + the main section tls_require_ciphers option at start-up. Before, this + would cause a STARTTLS 4xx failure, now it causes a failure to start. + Running with a broken configuration which causes failures that may only + be left in the logs has been traded off for something more visible. This + change makes an existing problem more prominent, but we do not believe + anyone would deliberately be running with an invalid tls_require_ciphers + option. + + This also means that library linkage issues caused by conflicts of some + kind might take out the main daemon, not just the delivery or receiving + process. Conceivably some folks might prefer to continue delivering + mail plaintext when their binary is broken in this way, if there is a + server that is a candidate to receive such mails that does not advertise + STARTTLS. Note that Exim is typically a setuid root binary and given + broken linkage problems that cause segfaults, we feel it is safer to + fail completely. (The check is not done as root, to ensure that problems + here are not made worse by the check). + Exim version 4.77 ----------------- @@ -119,6 +145,9 @@ Exim version 4.77 problem. Prior to this release, supported values were "TLS1" and "SSL3", so you should be able to update configuration prior to update. + [nb: gnutls_require_protocols removed in Exim 4.80, instead use + tls_require_ciphers to provide a priority string; see notes above] + * The match_{string1}{string2} expansion conditions no longer subject string2 to string expansion, unless Exim was built with the new "EXPAND_LISTMATCH_RHS" option. Too many people have inadvertently created