SASL 2.1.27 rc5
Ken Murchison <[email protected]> Tue, 10 Oct 2017 07:59:12 -0400
| Newsgroups | gmane.mail.imap.cyrus.announce |
|---|---|
| Organization | FastMail Pty Ltd |
| Message-ID | <1567e417-c282-90c1-4504-077120bf961b__16134.2472689741$1507636853$gmane$org@fastmail.com> |
This is a multi-part message in MIME format.
--------------98E04AF174C679C107BB984A
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
All,
I have built a fourth release candidate of SASL 2.1.27 which can be
downloaded from here:
HTTP:
http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz [MD5:
0e4ab034e93933ae7e4891b6ff58694f]
http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz.sig
[MD5: 5ebb22737aa11810f6c9e5d12b167f16]
FTP:
ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz
[MD5: 0e4ab034e93933ae7e4891b6ff58694f]
ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz.sig
[MD5: 5ebb22737aa11810f6c9e5d12b167f16]
Note that the distro has been signed by my colleague Partha Susarla at
FastMail.
The only major change since RC4 has to do with detection of PAM
support. Those using PAM with saslauthd are encouraged to make sure
that this release compiles and runs as expected.
The (mostly) complete list of changes from 2.1.26 are these:
* Added support for OpenSSL 1.1
* Added support for lmdb (from Howard Chu)
* Lots of build fixes (from Ignacio Casal Quinteiro and others)
* Treat SCRAM and DIGEST-MD5 as more secure than PLAIN when selecting
client mech
* DIGEST-MD5 plugin:
o Fixed memory leaks
o Fixed a segfault when looking for non-existent reauth cache
o Prevent client from going from step 3 back to step 2
o Allow cmusaslsecretDIGEST-MD5 property to be disabled
* GSSAPI plugin:
o Added support for retrieving negotiated SSF
o Fixed GSS-SPNEGO to use flags negotiated by GSSAPI for SSF
o Properly compute maxbufsize AFTER security layers have been set
* SCRAM plugin:
o Added support for SCRAM-SHA-256
* LOGIN plugin:
o Don’t prompt client for password until requested by server
* NTLM plugin:
o Fixed crash due to uninitialized HMAC context
* saslauthd:
o cache.c:
+ Don’t use cached credentials if timeout has expired
+ Fixed debug logging output
o ipc_doors.c:
+ Fixed potential DoS attack (from Oracle)
o ipc_unix.c:
+ Prevent premature closing of socket
o auth_rimap.c:
+ Added support LOGOUT command
+ Added support for unsolicited CAPABILITY responses in LOGIN
reply
+ Properly detect end of responses (don’t needlessly wait)
+ Properly handle backslash in passwords
o auth_httpform:
+ Fix off-by-one error in string termination
+ Added support for 204 success response
o auth_krb5.c:
+ Added krb5_conv_krb4_instance option
+ Added more verbose error logging
At this point any major changes (e.g. API, wire protocol) will be pushed
out to 2.1.28 or 2.2.0. I believe that this is close to being a final
release which I would like to get out by the end of September.
The biggest outstanding issues are those around recent GSSAPI changes.
I'm inclined to defer to Alexey's judgement on these unless someone can
convince us that the SASL code is wrong per the specs. The fact that it
broke a particular piece of code doesn't necessarily mean that the
application code is correct and the SASL change was wrong.
If there are any other last minute show stoppers, please open an issue
on GitHub (preferably with a patch), or better yet create a pull request.
--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd
--------------98E04AF174C679C107BB984A
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>All,</p>
<p>I have built a fourth release candidate of SASL 2.1.27 which can
be downloaded from here:</p>
<pre wrap="">HTTP:
<a class="moz-txt-link-freetext" href="http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz">http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz</a> [MD5:
0e4ab034e93933ae7e4891b6ff58694f]
<a class="moz-txt-link-freetext" href="http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz.sig">http://www.cyrusimap.org/releases/cyrus-sasl-2.1.27-rc5.tar.gz.sig</a>
[MD5: 5ebb22737aa11810f6c9e5d12b167f16]
FTP:
<a class="moz-txt-link-freetext" href="ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz">ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz</a>
[MD5: 0e4ab034e93933ae7e4891b6ff58694f]
<a class="moz-txt-link-freetext" href="ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz.sig">ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27-rc5.tar.gz.sig</a>
[MD5: 5ebb22737aa11810f6c9e5d12b167f16]</pre>
Note that the distro has been signed by my colleague Partha Susarla
at FastMail.<br>
<br>
<br>
The only major change since RC4 has to do with detection of PAM
support. Those using PAM with saslauthd are encouraged to make sure
that this release compiles and runs as expected.<br>
<p><br>
</p>
<p>The (mostly) complete list of changes from 2.1.26 are these:</p>
<ul class="simple">
<li>Added support for OpenSSL 1.1</li>
<li>Added support for lmdb (from Howard Chu)</li>
<li>Lots of build fixes (from Ignacio Casal Quinteiro and others)</li>
<li>Treat SCRAM and DIGEST-MD5 as more secure than PLAIN when
selecting client mech</li>
<li>DIGEST-MD5 plugin:
<ul>
<li>Fixed memory leaks</li>
<li>Fixed a segfault when looking for non-existent reauth
cache</li>
<li>Prevent client from going from step 3 back to step 2</li>
<li>Allow cmusaslsecretDIGEST-MD5 property to be disabled</li>
</ul>
</li>
<li>GSSAPI plugin:
<ul>
<li>Added support for retrieving negotiated SSF</li>
<li>Fixed GSS-SPNEGO to use flags negotiated by GSSAPI for SSF</li>
<li>Properly compute maxbufsize AFTER security layers have
been set</li>
</ul>
</li>
<li>SCRAM plugin:
<ul>
<li>Added support for SCRAM-SHA-256</li>
</ul>
</li>
<li>LOGIN plugin:
<ul>
<li>Don’t prompt client for password until requested by server</li>
</ul>
</li>
<li>NTLM plugin:
<ul>
<li>Fixed crash due to uninitialized HMAC context</li>
</ul>
</li>
<li>saslauthd:
<ul>
<li>cache.c:
<ul>
<li>Don’t use cached credentials if timeout has expired</li>
<li>Fixed debug logging output</li>
</ul>
</li>
<li>ipc_doors.c:
<ul>
<li>Fixed potential DoS attack (from Oracle)</li>
</ul>
</li>
<li>ipc_unix.c:
<ul>
<li>Prevent premature closing of socket</li>
</ul>
</li>
<li>auth_rimap.c:
<ul>
<li>Added support LOGOUT command</li>
<li>Added support for unsolicited CAPABILITY responses in
LOGIN reply</li>
<li>Properly detect end of responses (don’t needlessly
wait)</li>
<li>Properly handle backslash in passwords</li>
</ul>
</li>
<li>auth_httpform:
<ul>
<li>Fix off-by-one error in string termination</li>
<li>Added support for 204 success response</li>
</ul>
</li>
<li>auth_krb5.c:
<ul>
<li>Added krb5_conv_krb4_instance option</li>
<li>Added more verbose error logging</li>
</ul>
</li>
</ul>
</li>
</ul>
<p> </p>
<br>
<br>
At this point any major changes (e.g. API, wire protocol) will be
pushed out to 2.1.28 or 2.2.0. I believe that this is close to
being a final release which I would like to get out by the end of
September. <br>
<br>
The biggest outstanding issues are those around recent GSSAPI
changes. I'm inclined to defer to Alexey's judgement on these
unless someone can convince us that the SASL code is wrong per the
specs. The fact that it broke a particular piece of code doesn't
necessarily mean that the application code is correct and the SASL
change was wrong.<br>
<br>
If there are any other last minute show stoppers, please open an
issue on GitHub (preferably with a patch), or better yet create a
pull request.<br>
<pre class="moz-signature" cols="72">--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd</pre>
</body>
</html>
--------------98E04AF174C679C107BB984A--