Merge branch 'master' of git://git.exim.org/exim

[users/jgh/exim.git] / doc / doc-txt / NewStuff

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 487ce30b347c73f53ab6e0edcf06be45621501e5..432bbd220a9fda370f081db2f2db6e3fd9f82d45 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -13,10 +13,7 @@ Version 4.78
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so

-    careful use needs to be made of the conditions in Exim.  Note that
-    this can not yet be used as a drop-in replacement for Cyrus SASL, as
-    Exim is currently unable to construct strings with embedded NULs for
-    use as keys in lookups against sasldb2.
+    careful use needs to be made of the conditions in Exim.

 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME
 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME


@@ -29,6 +26,48 @@ Version 4.78
     "LOOKUP_LIBS" directly.  Similarly for handling the TLS library support
     without adjusting "TLS_INCLUDE" and "TLS_LIBS".
 
     "LOOKUP_LIBS" directly.  Similarly for handling the TLS library support
     without adjusting "TLS_INCLUDE" and "TLS_LIBS".
 

+ 4. New expansion variable $tls_bits.
+
+ 5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
+    be joined together with ASCII NUL characters to construct the key to pass
+    into the DBM library.  Can be used with gsasl to access sasldb2 files as
+    used by Cyrus SASL.
+
+ 6. OpenSSL now supports TLS1.1 and TLS1.2 with OpenSSL 1.0.1.
+
+    Avoid release 1.0.1a if you can.  Note that the default value of
+    "openssl_options" is no longer "+dont_insert_empty_fragments", as that
+    increased susceptibility to attack.  This may still have interoperability
+    implications for very old clients (see version 4.31 change 37) but
+    administrators can choose to make the trade-off themselves and restore
+    compatibility at the cost of session security.
+
+ 7. Use of the new expansion variable $tls_sni in the main configuration option
+    tls_certificate will cause Exim to re-expand the option, if the client
+    sends the TLS Server Name Indication extension, to permit choosing a
+    different certificate; tls_privatekey will also be re-expanded.  You must
+    still set these options to expand to valid files when $tls_sni is not set.
+
+    The SMTP Transport has gained the option tls_sni, which will set a hostname
+    for outbound TLS sessions, and set $tls_sni too.
+
+    A new log_selector, +tls_sni, has been added, to log received SNI values
+    for Exim as a server.
+
+    Currently OpenSSL only.
+
+ 8. The existing "accept_8bitmime" option now defaults to true.  This means
+    that Exim is deliberately not strictly RFC compliant.  We're following
+    Dan Bernstein's advice in http://cr.yp.to/smtp/8bitmime.html by default.
+    Those who disagree, or know that they are talking to mail servers that,
+    even today, are not 8-bit clean, need to turn off this option.
+
+ 9. Exim can now be started with -bw (with an optional timeout, given as
+    -bw<timespec>).  With this, stdin at startup is a socket that is
+    already listening for connections.  This has a more modern name of
+    "socket activation", but forcing the activated socket to fd 0.  We're
+    interested in adding more support for modern variants.
+

 
 Version 4.77
 ------------
 
 Version 4.77
 ------------