[dovecot/core] 1dd308: lib-smtp: client: Fix ignoring invalid certificate...

Tue Jan 30 13:00:12 EET 2018

  Branch: refs/heads/master
  Home:   https://github.com/dovecot/core
  Commit: 1dd30824d32f02372cd775b3e54b3b7780c2c4dd
      https://github.com/dovecot/core/commit/1dd30824d32f02372cd775b3e54b3b7780c2c4dd
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-25 (Thu, 25 Jan 2018)

  Changed paths:
    M src/lib-smtp/smtp-client-connection.c

  Log Message:
  -----------
  lib-smtp: client: Fix ignoring invalid certificate from server.

Although it initially allowed the invalid certificate, it would still fail later
on while reading/writing the SSL streams.

  Commit: c211cfd6adff5131929ae23b157f7ea5f0d2cd9c
      https://github.com/dovecot/core/commit/c211cfd6adff5131929ae23b157f7ea5f0d2cd9c
  Author: Sergey Kitov <sergey.kitov at open-xchange.com>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-imap-client/imapc-connection.c

  Log Message:
  -----------
  lib-imap-client: continue imapc operation on parsing errors.

  Commit: 364ba9bc3de992d2feefdbb97b7c2ce404648e13
      https://github.com/dovecot/core/commit/364ba9bc3de992d2feefdbb97b7c2ce404648e13
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Remove useless stream eof check.

It also looks to be problematic.

  Commit: e4d05b8c5dd8c5a18f6654a9f940a15ea9d245e9
      https://github.com/dovecot/core/commit/e4d05b8c5dd8c5a18f6654a9f940a15ea9d245e9
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Remove check for -2 returned from i_stream_read_more().

The stream must have space for at least 1 byte.

  Commit: 23a7a07d4d7cab538509ceef21a280dcc243362f
      https://github.com/dovecot/core/commit/23a7a07d4d7cab538509ceef21a280dcc243362f
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client-remote.c
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Use reliable means of checking for input stream EOF.

  Commit: d9b6d24bfa1354757fe9bc68205c0323e40abce3
      https://github.com/dovecot/core/commit/d9b6d24bfa1354757fe9bc68205c0323e40abce3
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Restructure reading input from program to simplify handling of dot input stream.

  Commit: b99e1062d1fb964a3545f2b5ef87588e09185ef8
      https://github.com/dovecot/core/commit/b99e1062d1fb964a3545f2b5ef87588e09185ef8
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Simplify cleanup of dot input stream in program_client_program_input().

  Commit: 3e1b133686cac6670f6f93479525200772c5e233
      https://github.com/dovecot/core/commit/3e1b133686cac6670f6f93479525200772c5e233
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client-remote.c

  Log Message:
  -----------
  lib-program-client: remote: Don't change exit_code in program_client_remote_disconnect() when program_input is already NULL.

When the program_input is NULL, the stream is finished, meaning that the
exit_code is set based on the return code. There can be a program_input for
remote streams, even when the program produces no output.

  Commit: 824ca2373b872449b6b6ce29707c02c0d810eb74
      https://github.com/dovecot/core/commit/824ca2373b872449b6b6ce29707c02c0d810eb74
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Flush/finish the output stream after o_stream_send_istream().

There may still be data in the output stream buffer. Failing to flush this
leads to truncated output. For the output towards the program o_stream_finish()
is used, since there may be an ostream_dot in between (or something else for
future features).

  Commit: 4427c6add036d046c291cbbc82e496c5135ccf04
      https://github.com/dovecot/core/commit/4427c6add036d046c291cbbc82e496c5135ccf04
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Add comments to program_input/program_output functions.

  Commit: e9853e8d860bd8c2b003f30deeba6716a093d7e3
      https://github.com/dovecot/core/commit/e9853e8d860bd8c2b003f30deeba6716a093d7e3
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client.h

  Log Message:
  -----------
  lib-program-client: Document the purpose of the use_dotstream setting.

  Commit: 71a4fc61f93898d5c12dd66c4b4f39511e5dcd3f
      https://github.com/dovecot/core/commit/71a4fc61f93898d5c12dd66c4b4f39511e5dcd3f
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/test-program-client-local.c

  Log Message:
  -----------
  lib-program-client: local: Add test for big data I/O.

  Commit: d9683a6493b2298ecd309522df315f8e7188e869
      https://github.com/dovecot/core/commit/d9683a6493b2298ecd309522df315f8e7188e869
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-26 (Fri, 26 Jan 2018)

  Changed paths:
    M src/lib-program-client/program-client-local.c
    M src/lib-program-client/program-client-private.h
    M src/lib-program-client/program-client-remote.c
    M src/lib-program-client/program-client.c

  Log Message:
  -----------
  lib-program-client: Make an explicit enum for the exit code.

Before, the meaning of the code was confusing, since the actual program returns
a different set of values.

  Commit: a56840e419fb37d98df754153118ff6f213f8233
      https://github.com/dovecot/core/commit/a56840e419fb37d98df754153118ff6f213f8233
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-28 (Sun, 28 Jan 2018)

  Changed paths:
    M src/lib-smtp/smtp-client-connection.c

  Log Message:
  -----------
  lib-smtp: client: Fix timeout leak sometimes occurring at unexpected remote disconnect.

While disconnected, newly submitted commands are queued, yet scheduled for
immediate failure. The timeout used for that was not cleaned up.

  Commit: 6e1bc1f4a080539860a3f121c5b51c9bfda1f1af
      https://github.com/dovecot/core/commit/6e1bc1f4a080539860a3f121c5b51c9bfda1f1af
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-28 (Sun, 28 Jan 2018)

  Changed paths:
    M src/lib-http/http-client-request.c

  Log Message:
  -----------
  lib-http: client: Assert that req->client != NULL in http_client_request_send_error().

Applies when blocking payload output API is being used.
Addresses a report by scan-build.

  Commit: def7173e3b9ba4df100fcef9e989f6971b559418
      https://github.com/dovecot/core/commit/def7173e3b9ba4df100fcef9e989f6971b559418
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-29 (Mon, 29 Jan 2018)

  Changed paths:
    M src/lib-smtp/smtp-server-reply.c

  Log Message:
  -----------
  lib-smtp: server: Fix overwriting a previously submitted reply.

The submitted flag was not reset, nor was the replies_submitted counter
decreased. This caused assertion failures.

  Commit: b5d61c3f6ead1284cb54b6f30e3e907f9c8a7ffe
      https://github.com/dovecot/core/commit/b5d61c3f6ead1284cb54b6f30e3e907f9c8a7ffe
  Author: Stephan Bosch <stephan.bosch at dovecot.fi>
  Date:   2018-01-29 (Mon, 29 Jan 2018)

  Changed paths:
    M src/submission/submission-commands.c

  Log Message:
  -----------
  submission: Properly handle omission of required authentication for relay connection.

Particularly, do not forward the 530 error to the client. Instead, log the
problem and close the client connection with an internal error.

  Commit: a9b135760aea6d1790d447d351c56b78889dac22
      https://github.com/dovecot/core/commit/a9b135760aea6d1790d447d351c56b78889dac22
  Author: Aki Tuomi <aki.tuomi at dovecot.fi>
  Date:   2018-01-29 (Mon, 29 Jan 2018)

  Changed paths:
    M src/lib-auth/auth-client-request.c
    M src/lib-auth/auth-server-connection.c
    M src/lib-auth/auth-server-connection.h

  Log Message:
  -----------
  lib-auth: Remove request after abort

Otherwise the request will still stay in hash table
and get dereferenced when all requests are aborted
causing an attempt to access free'd memory.

Found by Apollon Oikonomopoulos <apoikos at debian.org>

Broken in 1a29ed2f96da1be22fa5a4d96c7583aa81b8b060

Compare: https://github.com/dovecot/core/compare/54d0a5a308ed...a9b135760aea