mirror of
https://github.com/mailscope/kumomta.git
synced 2026-09-13 05:52:13 +00:00
Wez Furlong
4055c50522
This commit is a step towards some general improvements around our handling of authentication and authorization. This commit is focused primarily on authorization, but there are some adjustments to how we track authentication as part of enabling that. We now have a separate AuthInfo type that holds the overall authentication information/context associated with an inbound SMTP or HTTP session. It is populated with the peer_address as a fact rather than a statement of trust. If authentication via the appropriate lua auth callback is successful, then the AuthInfo has additional identities added. There are some types and events for loading access control lists and matching their rules against an AuthInfo. There is now a system default ACL that is equivalent to the prior hard-coded access policy that was encoded into each HTTP endpoint. This change makes it possible to replace the ACL with a user-defined ACL. Later will be some work on authentication to allow more options for HTTP auth.
1.0 KiB
1.0 KiB
Unreleased Changes in The Mainline
Breaking Changes
Other Changes and Enhancements
- Enhanced Access Control subsystem, supported by a new Authentication, Authorization and Accounting (AAA) module exposed to lua as kumo.aaa.
- The
Handlebarstemplate dialect now runs with recursive lookup for improved compatibility with other handlebars implementations. msg:check_fix_conformance()can now detect and attempt to fix issues where the charset is invalid for parts that use transfer-encoding, by applying any charset detection options, falling back to UTF-8.
Fixes
- An SPF record containing U+200B (zero width space) could cause SPF record parsing to panic and the service to crash
- MIME part body extraction did not always consider the charset for text parts
- Errors raised while dispatching should_enqueue_log_record were not logged to the diagnostic log.