* Add an anon_fast option that attempts anonymous authentication
(generally implemented via anonymous PKINIT inside the Kerberos
library) and then, if successful, uses those credentials for FAST
armor. If fast_ccache and anon_fast are both specified, anonymous
authentication will be used as a fallback if the specified FAST ticket
cache doesn't exist. Based on patches from Yair Yarom.
* Add a user_realm option to only set the realm for unqualified user
principals. This differs from the existing realm option in that realm
also changes the default realm for authorization decisions and for
verification of credentials. Update the realm option documentation to
clarify the differences and remove incorrect information. Patch from
Roland C. Dowdeswell.
* Add a no_prompt option to suppress the PAM module's prompt for the
user's password and defer all prompting to the Kerberos library. This
allows the Kerberos library to have complete control of the prompting
process, which may be desireable if authentication mechanisms other
than password are in use. Be aware that, with this option set, the
PAM module has no control over the contents of the prompt and cannot
store the user's password in the PAM data. Based on a patch by Yair
Yarom.
* Add a silent option to force the module to behave as if the
application had passed in PAM_SILENT and suppress text messages and
errors from the Kerberos library. Patch from Yair Yarom.
* Add preliminary support for Kerberos trace logging via a trace option
that enables trace logging if supported by the underlying Kerberos
library. The option takes as an argument the file name to which to
log trace output. This option does not yet work with any released
version of Kerberos, but may work with the next release of MIT
Kerberos.
* MIT Kerberos does not add a colon and space to its password prompts,
but Heimdal does. pam-krb5 previously unconditionally added a colon
and space, resulting in doubled colons with Heimdal. Work around this
inconsistency by not adding the colon and space if already present.
* Fix alt_auth_map support to preserve the realm of the authentication
identity when forming the alternate authentication principal, matching
the documentation.
* Document that the alt_auth_map format may contain a realm to force all
mapped principals to be in that realm. In that case, don't add the
realm of the authentication identity. Note that this can be used as a
simple way to attempt authentication in an alternate realm first and
then fall back to the local realm, although any complex attempt at
authentication in multiple realms should instead run the module
multiple times with different realm settings.
* Avoid a NULL pointer dereference if krb5_init_context fails.
* Fix initialization of time values in the module configuration on
platforms (like S/390X) where krb5_deltat is not equivalent to long.
* Close a memory leak when search_k5login is set but the user has no
.k5login file.
* Close several memory leaks in alt_auth_map support.
* Suppress bogus error messages about unknown option for the realm
option. The option was being parsed and honored despite the error.
* Retry authentication under try_first_pass on several other errors in
addition to decrypt integrity check errors to handle a wider array of
possible "password incorrect" error messages from the KDC.
* Update to rra-c-util 4.4:
* Update to C TAP Harness 1.12:
- Bux fix release
- Rollerd's -alwayssign flag logic had a critical error that could
have caused a zone to be signed with the wrong ZSK at particular
points of the ZSK key rolling process.
* Only use libyubikey when --with-cr is used.
* Set correct permissions on tempfile.
* YubiKey 2.2 contains a bug in challenge-response that makes it output the
same response to all challenges unless HMAC_LT64 is set. Add warnings to
ykpamcfg and a warning through conversate in the pam module. Keys programmed
like this should be reprogrammed with the HMAC_LT64 flag set.
* Implement option -ooath-id to easily set OATH token identifier.
* Fix numerous compiler warnings from clang. Thanks to
Clemens Lang <neverpanic@gmail.com>.
* ykclient: Add C++ namespace protection.
* Add multi-server support with curl_multi.
Enabled by default for YubiCloud servers.
Settable with the new library function set_template_urls() or
the urls parameter to ykclient_verify_otp_v2().
* Remove extra % in ykclient help.
* Add ca path option to ykclient, --ca.
Patch from Jay Kline <jay.kline.ctr@hpcmo.hpc.mil>.
* Make the nonce unique for consecutive calls to the same ykclient handle.
* Do url encoding of OTP before sending.
* Fix segfault on curl error.
Patch from Lee Hinman <lee.hinman.ctr@hpc.mil>
Fix bug #SF3496208: Replace stats/opendkim-genstats with a perl
script so it's far more efficient.
Fix bug #SF3514793: Pass proper flags to libdb when creating
temporary LDAP caches. Problem noted by Sergey Romanov.
Fix a crash bug when using LocalADSP with a message with no
parseable From: field. Problem noted by John Merriam.
Fix a crash bug when using LDAP with authentication when LDAPAuthUser
is not defined.
STATS: Fix bug #SF3510729: Convert stats/opendkim-gengraphs to a perl
script.
2.5.1 2012/03/15
Fix bug #SF3496131: Fix query cache build problem.
Fix bug #SF3500660: Add Date: header field to generated reports.
BUILD: A few subsidiary libraries need to know about -lresolv on
systems that need it. Reported by Scott Kitterman.
STATS: Add "-E" command line flag to opendkim-importstats, forcing
an abort on any input error.
2.5.0 2012/02/29
#####################################################################
### ###
### This release is dedicated to the memory of J.D. Falk, a ###
### tireless champion of anti-abuse technology and collaboration ###
### and a founding member of the Board of the Trusted Domain ###
### Project, a participant in related IETF work, and a long-time ###
### particpant and supporter of MAAWG. J.D. was taken by cancer ###
### on November 16, 2011. His enthusiasm and perspective for ###
### all of this work will be sorely missed. ###
### ###
#####################################################################
Feature request #SF3385816: Discontinue DomainKeys support.
Feature request #SF3393282: Update ARF output per
draft-ietf-marf-authfailure-report-03 et seq.
Feature request #SF3406814: Add ability to invoke chroot().
Feature request #SF3477908: Update DKIM reporting per
draft-ietf-marf-dkim-reporting-10.
Add "WeakSyntaxChecks" suppressing some short-circuiting error checks
on syntax.
Allow a set of test files to be passed via "-t" rather than just one.
Add _FFR_REPUTATION, and several new support libraries (in the
libut/ and reputation/ directories) for doing DKIM-based
reputation evaluations of arriving messages. Full
documentation of the algorithms will appear in an upcoming
white paper. This also includes several new configuration
options that make use of reputation data pulled from servers:
ReputationCache
ReputationCacheTTL
ReputationLimits
ReputationLowTime
ReputationMinimum
ReputationLimitModifiers
ReputationRatios
ReputationSpamCheck
ReputationTimeFactor
For now these are briefly documented in reputation/README.
As this subsystem matures, they will be fully documented in
opendkim.conf(5).
Fix bug #SF3471520: Don't crash when the first line of a configuration
file is an "Include" instruction.
Fix bug #SF3475149: Apply RFC2254 encoding to LDAP queries.
LIBOPENDKIM: Feature request #SF3317160: Per RFC6376, remove
granularity checks.
LIBOPENDKIM: Feature request #SF3385768: Add dkim_privkey_load(),
allowing validation of a private key before reaching
end-of-message.
LIBOPENDKIM: Feature request #SF3423226: Copy header field name lists
instead of using the caller's copy.
LIBOPENDKIM: Update list of header fields that should be signed
per RFC6376.
LIBOPENDKIM: Don't report the absence of "c=" as an error, since
there is a default.
LIBOPENDKIM: Add DKIM_SIG_CHECK() macro. Suggested by Heikki
Gruner.
LIBAR: Fix bug #SF2917856: Rename "ar.h" to "async-resolv.h" since
"ar.h" is already in common use.
STATS: Feature request #SF3397903: Drop all support for data needed
for the DKIM Implementation Report, as it has been completed.
Leave stuff that's useful for reputation R&D.
STATS: Feature request #SF3402857: Modify opendkim-spam to be able
to write update records to statistics files.
STATS: Feature request #SF3439384: Make opendkim-importstats more
backend-agnostic.
TOOLS: Add opendkim-testmsg, for signing/verifying messages without
all the milter code being invoked.
CONTRIB: Add LDAP documentation and examples.
In terms of the core YAP, most changes are small bug fixes. They include
- better support for 64 bits in win64,
- some fixes to the garbage collector
- OSX Lion compilation
- wide char support
- bug in copy_term when some variables have attributes
- fixes to lam interface
- C-interface and SWI support
- over-optimisation of =/2.
- arithmetic exceptions
- write_canonical (Ulrich)
- retracting may not follow lu semantics
- minor predicate import bug.
There has been a lot of progress in ProbLog and cplint.
decentralized, and highly reliable synchronization. That means that a key
submitted to one SKS server will quickly be distributed to all key servers,
and even wildly out-of-date servers, or servers that experience spotty
connectivity, can fully synchronize with rest of the system.
pkg_summary2deps:
- Fix in 'pkg_summary2deps -dn'
(missing pkgname if multivariant packages are present,
for example py26-gtk2 and py27-gtk2)
pkg_summary2leaves:
- Fix. 'pkg_summary2deps -dpnra' should be used
instead of 'pkg_summary2deps -dpa'
More regression tests for pkg_summary2leaves and pkg_summary2deps
Minor fix in pkg_uniq_summary.1
psu_funcs.awk:
- new function pkgpana2pkgpath
