126 lines
4.3 KiB
Plaintext
126 lines
4.3 KiB
Plaintext
News
|
|
----
|
|
E-MailRelay Version 2.0 is a major release, with more complete support for IPv6
|
|
and TLS, a reworked Windows core, and non-blocking execution of external filters
|
|
and address verifiers.
|
|
|
|
Compatibility
|
|
-------------
|
|
There are some breaks in compatibility with earlier versions, althought most
|
|
have backwards-compatibility mitigations built into the 2.0 code:
|
|
|
|
# TLS command-line options have changed
|
|
|
|
The "--server-tls" options no longer takes a value; the certificate file
|
|
is given by a separate "--server-tls-certificate" option. A temporary
|
|
backwards-compatibility fix inserts "--server-tls-certificate" between
|
|
"--server-tls" and the filename, with a deprecation warning.
|
|
|
|
The "--tls-config" options have changed. The certificate-verification
|
|
tweaks have become command-line options in their own right (such as
|
|
"--server-tls-verify") and the protocol version options are spelt out
|
|
as "tlsv1.1" etc. For example, "--tls-config=mbedtls,tlsv1.1,-tlsv1.2".
|
|
|
|
# Reserved exit codes from filters are handled differently
|
|
|
|
The reserved "--filter" exit codes are handled as shown below. The
|
|
ones that were explicitly documented behave in the same way, although
|
|
the 'rescan' feature (103) is no longer tied to "--poll".
|
|
|
|
# The admin command-line has cosmetic changes
|
|
|
|
The "--admin" command-line usage is a bit tidier, although the "flush"
|
|
command is unchanged. Users of the "notify" command should re-test.
|
|
|
|
# Address verifier command-line is simpler
|
|
|
|
The command-line passed to the external address verifier script is
|
|
simplified. Backwards compatibility is preserved by using a new
|
|
command-line option "--address-verifier" to replace "--verifier". For
|
|
forwards compatibility there requirement to supply an interface version
|
|
number.
|
|
|
|
# The secrets file format has changed
|
|
|
|
See below.
|
|
|
|
# The message envelope format is updated
|
|
|
|
The message envelope file format has changed, with full backwards
|
|
compatibility. The ClientName fields is removed, and the MailFromAuthIn
|
|
and MailFromAuthOut fields are added.
|
|
|
|
Secrets file
|
|
------------
|
|
The second field of the secrets file is now the password encoding rather than
|
|
the authentication mechanism. This can be made backwards compatible since in
|
|
earlier releases there was an unambiguous mapping of mechanism to format.
|
|
|
|
In 2.0 the mechanism is not fixed; the client side protocol will try all of
|
|
the server's mechanisms for which it has compatible secrets, with plaintext
|
|
passwords being compatible with any mechanism.
|
|
|
|
On the server side the server advertises all mechanisms, regardless of the
|
|
available secrets, since the client is expected to go through the list of
|
|
advertised mechanisms until it gets to one where there is an available server
|
|
secret. This is unlikely to cause a regression since only MD5 passwords can
|
|
result in an authentication mismatch and CRAM-MD5 is the first and most secure
|
|
mechanism advertised; to get a regression failure a CRAM-MD5 capable client
|
|
would see (eg.) LOGIN appear as an additional mechanism, and then perversely
|
|
choose LOGIN in preference to CRAM-MD5, and then give up before trying
|
|
CRAM-MD5.
|
|
|
|
Filter exit codes
|
|
-----------------
|
|
For completeness, this is the filter exit code handling, showing how the
|
|
changes for 2.0 affect documented and undocumented exit codes in the
|
|
range 104 to 107:
|
|
|
|
Server v1.9:
|
|
* 0 ok (commit of .new)
|
|
* 1..99 fail (rename .bad)
|
|
* 100 abandon (try to commit but ignore errors) (documented)
|
|
* 101 ok
|
|
* 102 abandon, re-scan (by expiring --poll timer)
|
|
* 103 ok, re-scan (documented)
|
|
* 104 abandon
|
|
* 105 ok
|
|
* 106 abandon, re-scan
|
|
* 107 ok, re-scan
|
|
* 108.. fail
|
|
|
|
Server v2.0:
|
|
* 0 ok (commit of .new)
|
|
* 1..99 fail (rename .bad)
|
|
* 100 abandon (try to commit but ignore errors) (documented)
|
|
* 101 ok
|
|
* 102 abandon, re-scan (independent of --poll)
|
|
* 103 ok, re-scan (documented)
|
|
* 104 fail, re-scan
|
|
* 105.. fail
|
|
|
|
Client v1.9:
|
|
* 0 ok (send, delete)
|
|
* 1..99 fail (dont send, rename .bad)
|
|
* 100 ignore (dont send, dont delete or rename) (documented)
|
|
* 101 ok
|
|
* 102 ok, stop scanning (documented)
|
|
* 103 ok
|
|
* 104 ignore
|
|
* 105 ok
|
|
* 106 ok, stop scanning
|
|
* 107 ok
|
|
* 108.. fail
|
|
|
|
Client v2.0:
|
|
* 0 ok (send, delete)
|
|
* 1..99 fail (dont send, rename .bad)
|
|
* 100 ignore (dont send, dont delete or rename) (documented)
|
|
* 101 ok
|
|
* 102 ok, stop scanning (documented)
|
|
* 103 ok
|
|
* 104 ignore, stop scanning
|
|
* 105 fail, stop scanning
|
|
* 105.. fail
|
|
|