./security/gsasl, GNU implementation of the Simple Authentication and Security Layer

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 1.10.0nb1, Package name: gsasl-1.10.0nb1, Maintainer: pkgsrc-users

GNU SASL is an implementation of the Simple Authentication and Security Layer
framework and a few common SASL mechanisms. SASL is used by network servers
(e.g., IMAP, SMTP) to request authentication from clients, and in clients to
authenticate against servers.

GNU SASL contains a library (`libgsasl'), a command line utility (`gsasl')
to access the library from the shell, and a manual. The library includes
support for the SASL framework (with authentication functions and application
data privacy and integrity functions) and at least partial support for the
CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN,
NTLM and KERBEROS_V5 mechanisms.


Required to run:
[security/gnutls] [security/heimdal] [security/libgcrypt] [security/openssl] [devel/libntlm] [devel/libidn]

Required to build:
[pkgtools/cwrappers]

Master sites: (Expand)

SHA1: ec3def1bdc4a0b6284f0d1e2901495218c87587e
RMD160: 0b7b66702493527f295ba35c4f2a409600839946
Filesize: 5806.715 KB

Version history: (Expand)


CVS history: (Expand)


   2021-04-21 15:25:34 by Adam Ciarcinski | Files touched by this commit (864)
Log message:
revbump for boost-libs
   2021-01-07 23:09:52 by Thomas Klausner | Files touched by this commit (4) | Package updated
Log message:
gsasl: update to 1.10.0.

* Version 1.10.0 (released 2021-01-01) [stable]

** This is a new major stable release.  Brief changes compared to 1.8.x:

*** SCRAM-SHA-256 and SCRAM-SHA-256-PLUS support per RFC 7677.

*** SCRAM supports password-less usage (StoredKey/ServerKey).

*** New 'gsasl --mkpasswd' command to prepare SCRAM salted/hashed passwords.

*** Final warning that obsolete APIs will be removed.

*** Various cleanups, portability and other bug fixes.
See the entries in NEWS and lib/NEWS covering the 1.9.x branch for details.

* Version 1.9.3 (released 2021-01-01) [beta]

** Fix build/portability problems.  GnuTLS >= 3.4 is required.
Thanks to Bruno Haible for reports.

* Version 1.9.2 (released 2020-12-24) [beta]

** gsasl: Don't abort command on some exepected TLS events (for TLS 1.3).
Patch from Enrico Scholz <enrico.scholz@sigma-chemnitz.de> in:
https://lists.gnu.org/archive/html/help … 00000.html

** gsasl: Use GnuTLS system trust settings by default for X.509 server
** certificate validation.
Before it was documented behaviour that unless --x509-ca-file was
used, no verification of the server-side certificate was performed.
Now instead it will use the system trust settings, which on properly
configured systems results in verification of the server certificate.
As a result, you may now start to get server certificate verification
errors in situations where you didn't expect them.  Use --x509-ca-file
with the empty string ("") as a file name to use the old behaviour to
not abort on server certificate verification failures.

** SCRAM, GS2 and GSSAPI retrieve properties later in
** the authentication process.
Before the property GSASL_CB_TLS_UNIQUE was retrieved during SCRAM
gsasl_client_start() and gsasl_server_start(), and the properties
GSSAPI_SERVICE and GSSAPI_HOSTNAME was retrived during GS2/GSSAPI
gsasl_server_start().  Now they are retrieved during the first call to
gsasl_step().

The only user-visible impact of this should be that 'gsasl
--client-mechanisms' and 'gsasl --server-mechanisms' will now not
query for parameters before giving a list of supported mechanisms,
which arguable gives a better user experience.  The downside of this
is that SCRAM-*-PLUS, GS2 and GSSAPI may be advertised even though
completing the server mechanism may not complete.

The problem with calling callbacks in the start() function is that the
callback will have no per-session context at that point, only a global
context, so the only way to give per-session unique callback responses
is to use a separate global handle per session.  This was discovered
in the Exim implementation of gsasl with SCRAM that used to request
the GSASL_CB_TLS_UNIQUE property in the start() function.  After
noticing this design issue, and writing this self test, it was
discovered that it also happened for the GSSAPI/GS2 server (not
client) mechanism for the GSASL_SERVICE and GSASL_HOSTNAME properties.

Thanks to Jeremy Harris for noticing the problem and discussion, see
https://lists.gnu.org/archive/html/help … 00035.html

** gsasl: The --mkpasswd output format follows Dovecot 'doveadm pw'.

** Filenames of images in the manual are now prefixed with 'gsasl-'.
This makes /usr/share/info more understandable, and it is suggested by
at least Debian to do this in upstream.

** Build changes.
Some more compiler warnings used and code fixed.  Improved ./configure
diagnostics.

* Version 1.9.1 (released 2020-01-14) [beta]

** gsasl: New --mkpasswd argument to prepare salted/hashed passwords.
Currently mechanisms SCRAM-SHA-1 and SCRAM-SHA-256 are supported.  New
parameter --iteration-count to indicate number of PBKDF2 rounds,
default being 65536.  New parameter --salt to specify PBKDF2 salt.

* Version 1.9.0 (released 2020-01-03) [beta]

** Client and server support for SCRAM-SHA-256 and SCRAM-SHA-256-PLUS.

** gsasl: If PORT argument is "587" or "submission", SMTP \ 
mode is used.
Further, unrecognized PORT arguments will now on raise an error to
specify --smtp or --imap.
   2020-11-16 14:05:08 by Thomas Klausner | Files touched by this commit (4) | Package updated
Log message:
gsasl: update to 1.8.1.

* Version 1.8.1 (released 2019-08-02) [stable]

** gsasl: IMAP client code now permits empty SASL tokens prefixed with '+'.
Normally servers should send '+ '.  Buggy servers include Microsoft
Exchange.  Reported by Adam Sj√łgren.

** GSSAPI client: Now retrieves GSASL_AUTHZID for authorization identity.
** GSSAPI client: Can now transmit an empty/missing authorization identity.
See lib/NEWS for more information.

** Build fixes.
Update of gnulib, including how it is bootstrapped.

** i18n: Updated translations.
   2020-05-22 12:56:49 by Adam Ciarcinski | Files touched by this commit (624)
Log message:
revbump after updating security/nettle
   2020-03-08 17:51:54 by Thomas Klausner | Files touched by this commit (2833)
Log message:
*: recursive bump for libffi
   2020-01-19 00:36:14 by Roland Illig | Files touched by this commit (3046)
Log message:
all: migrate several HOMEPAGEs to https

pkglint --only "https instead of http" -r -F

With manual adjustments afterwards since pkglint 19.4.4 fixed a few
indentations in unrelated lines.

This mainly affects projects hosted at SourceForce, as well as
freedesktop.org, CTAN and GNU.
   2020-01-18 22:51:16 by Jonathan Perkin | Files touched by this commit (1836)
Log message:
*: Recursive revision bump for openssl 1.1.1.
   2019-07-21 00:46:59 by Thomas Klausner | Files touched by this commit (595)
Log message:
*: recursive bump for nettle 3.5.1