Phil Pennock [Mon, 10 Sep 2018 02:24:39 +0000 (22:24 -0400)]
docs: unbreak spec build
I've created a homebrew tap with sdop and xfpt in it, so I can install
those more easily on macOS in the future, and now have bothered actually
building the docs. `.url()` should have been `&url()` in two places.
The `make spec.pdf` pipeline yields a document where those are not
clickable links, but if i use `make spec.ps` and let macOS auto-convert
to PDF upon open, those are proper clickable hyperlinks. So this switch
is definitely for the better.
Phil Pennock [Fri, 7 Sep 2018 17:56:27 +0000 (13:56 -0400)]
Fix broken doc links and http→https where possible
I got a cookie-cutter email from folks noting the modssl.org doc links
were broken and asking us to use their site instead, which was both
helpful and a rather heavy page with advertising on it, so not something
I want our docs to link to.
Fixed the modssl link to point to the correct current Apache docs, since
mod_ssl has not been a separate project for … a very long time.
Audited every `http:` link in the Spec, replacing with https if
available, updating URLs as needed, or trimming deadwood as appropriate.
This did edit one license text, but in a way which I believe is
reasonable and in the license holder's best interests.
* Use comments with a datestamp for any remaining http: URLs, showing
when they were last audited
* Suggest migrating away from Berkeley DB.
* Drop mention of a patched `pam_unix` module which is no longer available.
* In revamping the CDB tools links, add my own tools.
* Redo the intro text for the mod_ssl stuff (first person voice of PH).
* Rescorla's book's online examples appear to be gone; drop mention of
them and point to Ristić's more recent book too.
* Point to wikipedia list of DNSxL services as an overview, in part
because I dropped the reference to the defunct rfc-ignorant.org and
there was no good candidate as an exemplar for domain-based lists.
* Note that mksd is a candidate for removal from Exim since mks_vir
is dead.
* Drop LogReport/lire reference (dead/gone and can't find it).
* Redo proxy protocol spec-linking text.
* Replace FAQ A1701 with text saying "don't do that" (self-signed certs)
and just telling people to use a CA instead, pointing strongly to
Let's Encrypt. We did nobody any favors with that old text still
being present today (it was entirely appropriate when written).
Xin Li [Mon, 27 Aug 2018 09:32:51 +0000 (11:32 +0200)]
Do not use arc4random_stir() directly (Bug 2304)
arc4random_stir should not be used directly (it's fully automated after
FreeBSD r227520, or approximately __FreeBSD_version 1000002), the
interface will be removed from FreeBSD soon (bugs.freebsd.org/230756).
Phil Pennock [Fri, 13 Jul 2018 16:24:26 +0000 (12:24 -0400)]
doc: DANE: don't claim TA can be elided from chain
While technically an implementation can choose to use a public TA from
DNS or elsewhere to populate a missing TA from the chain, that creates
interoperability issues and the OpenSSL integration code, at least,
doesn't support that and after a bit of work drilling through layers of
abstraction, I've not figured out what GnuTLS does and I've decided I
don't care.
So I'm heeding Viktor's advice and changing the docs to just say to
publish the TA in the chain sent by the server.
Phil Pennock [Tue, 10 Jul 2018 18:35:58 +0000 (14:35 -0400)]
Document problems with SHA-1 in certs with DANE-TA
Very few domains are using SHA-1 in EE certs issued from a CA used in
DANE-TA anchoring, but some are. Meanwhile apparently GnuTLS now
defaults to disabling SHA-1 in chains. Which is eminently reasonable.
I do not believe that Exim should re-enable use of SHA-1 here. Let it
die. Document with warnings that folks using a private CA for certs to
be publicly trusted via DANE-TA should follow decent operational
issuance practices.
Also update my Channel Binding docs for GSASL to warn that Channel
Binding is Broken™.
Phil Pennock [Mon, 16 Apr 2018 19:24:34 +0000 (15:24 -0400)]
Belated README.UPDATING notes for Exim 4.91
People skip versions and move past them later, so while it's too late
for 4.91, this will still help people moving to 4.92 from pre-4.91 in
future.
Note that none of these strictly needed to be documented here:
experimental features, features marked as deprecated for many many
years, etc. But let's err on the side of caution and include "things
which will break if you try to upgrade without changing Local/Makefile".