Postfix snapshot 20051220

Postfix snapshot 20051220 provides a plug-in architecture for SASL
authentication. With this, Postfix can support multiple SASL
implementations without source code patches. Implementors of
alternative implementations (Dovecot, Bieringer) are encouraged to
look at the plug-in interface and see if it is workable.

For backwards compatibility the default plug-in type is Cyrus SASL,
so everything should behave like it did before. Some error messages
are slightly different, but these changes are generally improvements.

	Wietse

RELEASE_NOTES:

    Incompatibility with snapshot 20051220
    ======================================

    The Postfix-with-Cyrus-SASL build procedure has changed. You now
    need to specify -DUSE_CYRUS_SASL in addition to -DUSE_SASL_AUTH or
    else you end up without any Cyrus SASL support. The error messages
    are:

	unsupported SASL server implementation: cyrus
	unsupported SASL client implementation: cyrus

    Major changes with snapshot 20051220
    ====================================

    Plug-in support for SASL authentication in the SMTP server and in
    the SMTP+LMTP client. With this, Postfix can support multiple SASL
    implementations without source code patches.  Some distributors may
    even make SASL support a run-time linking option, just like they
    do with Postfix lookup tables.

    Hints and tips for plug-in developers are in the xsasl/README file.

    For backwards compatibility the default plug-in type is Cyrus SASL,
    so everything should behave like it did before. Some error messages
    are slightly different, but these are generally improvements.

    The "postconf -a" command shows what plug-in implementations are
    available for the SMTP server, and "postconf -A" does the same for
    the SMTP+LMTP client.  Plug-in implementations are selected with
    the smtpd_sasl_type, smtp_sasl_type and lmtp_sasl_type configuration
    parameters.

    Other new configuration parameters are smtpd_sasl_path, smtp_sasl_path
    and lmtp_sasl_path. These are better left alone; they are introduced
    for the convenience of other SASL implementations.

HISTORY file:
=============

20051213

	Bugfix: *SQL, proxy and LDAP map types were not defined in
	user-land commands such as postqueue. Leandro Santi. File:
	postqueue/postqueue.c.

20051212-14

	Server-side plug-in interface for SASL authentication. This
	uses Cyrus SASL by default, so nothing has changed except
	error messages may be more informative.  Files:
	smtpd/smtpd_sasl_proto.c smtpd/smtpd_sasl_glue.c,
	xsasl/xsasl_server.[hc], xsasl/cyrus_server.[hc]
	xsasl/cyrus_strerror.c, xsasl/cyrus_log.c, xsasl/cyrus_security.c.

20051215

	Portability: IRIX 6.5.28 defines sa_len as a macro, so it
	can't be used as a variable identifier. Zach McDanel. Files:
	dns/dns_rr_to_sa.c, smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.

20051216

	Cleanup: removed some scar tissue that was introduced with
	server-side SASL plug-in support. Files: smtpd_sasl_proto.c,
	smtpd_sasl_glue.c.

	Client-side plug-in interface for SASL authentication. This
	uses Cyrus SASL by default, so nothing has changed except
	error messages may be more informative.  Files: smtp_sasl_glue.c,
	xsasl/xsasl_client.[hc], xsasl/cyrus_client.[hc].

20051217

	Bugfix: when a SASL client password is required by a specific
	server, defer delivery when no server-announced mechanism
	survives the smtp_sasl_mechanism_filter, instead of ignoring
	the SASL announcement and trying to deliver the mail over
	an unauthenticated connection and risking that mail will
	be rejected.  File: smtp/smtp_sasl_proto.c, smtp/smtp_proto.c.

	Portability: zero the "struct msg" just in case. Both purify
	(Linux) and valgrind (FreeBSD) complain about uninitialized
	bits.  Files: util/unix_{send,recv}_fd.c.

20051219

	Cleanup: generic smtpd_sasl_path, smtp_sasl_path and
	lmtp_sasl_path configuration parameters; simplified the
	SASL plug-in API, and made initial provisions for SASL
	session encryption. Files: xsasl/*.[hc].

	Feature: "postconf -a" lists the available SASL server
	plug-in types, and "postconf -A" does the same for the
	client.  Files: postconf.c, xsasl_{client,server}.c.

	Feature: new SMTPD policy attributes "encryption_protocol",
	"encryption_cypher" and "encryption_keysize", to distinguish
	plaintext from encrypted connections.