Improve X.509 certificate validation reporting.

[~andy/fetchmail] / NEWS

diff --git a/NEWS b/NEWS
index f5ea77da97b94d9755864eba85dfbdbad05961ec..f44944b307895518ceea0984376f0ec3312920d7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -56,20 +56,45 @@ removed from a 6.4.0 or newer release.)
 
 --------------------------------------------------------------------------------
 
-fetchmail-6.3.24 (not yet released):
+fetchmail-6.3.25 (not yet released):
+
+# CHANGES
+* Improved reporting when SSL/TLS X.509 certificate validation has failed,
+  working around a not-so-recent swapping of two OpenSSL error codes, and
+  a practical impossibility to distinguish broken certification chains from
+  missing trust anchors (root certificates).
+* OpenSSL decoded errors are now reported through report(), rather than dumped
+  to stderr, so that they should show up in logfiles and/or syslog.
+
+# WORKAROUNDS
+* Older systems that provide the older RFC-2553 implementation of getaddrinfo,
+  rather than the current RFC-3493, and systems that do not provide this
+  getaddrinfo() interface at all and thus use the replacement functions from
+  libesmtp/getaddrinfo.?, might return EAI_NODATA when a host is registered in
+  DNS as MX or similar, but without A or AAAA records.  Handle this situation
+  when checking for multidrop aliases and treat EAI_NODATA the same as
+  EAI_NONAME, i. e. name cannot be resolved.
+
+  The proper fix, however, is to upgrade the operating system.
+
+
+fetchmail-6.3.24 (released 2012-12-23, 26108 LoC):
 
 # NOTE THAT THE RELEASE OF FUTURE FETCHMAIL 6.3.X VERSIONS IS UNCLEAR.
 Should a 7.0 release be made earlier, chances are that the 6.3.X branch
 is abandoned and its changes be folded into the 7.0 release, with changes
 after 6.3.24 not available on their own in a newer 6.3.X release.
 
+# NOTE THAT FETCHMAIL IS NO LONGER PUBLISHED THROUGH IBIBLIO.
+  They have stopped accepting submissions and consider themselves an archive.
+
 # CRITICAL AND REGRESSION FIXES
 * Plug a memory leak in OpenSSL's certificate verification callback.
   This would affect fetchmail configurations running with SSL in daemon mode
   more than one-shot runs.
   Reported by Erik Thiele, and pinned by Dominik Heeg,
   fixes Debian Bug #688015.
-  This bug was introduced into fetchmail 6.2.9 (committed 2005-10-29)
+  This bug was introduced into fetchmail 6.3.0 (committed 2005-10-29)
   when support for subjectAltName was added through a patch by Roland
   Stigge, submitted as Debian Bug#201113.