- Dovecot-news - dovecot.org

v2.2.14.rc1 released
by Timo Sirainen 03 Oct '14

03 Oct '14

http://dovecot.org/releases/2.2/rc/dovecot-2.2.14.rc1.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.14.rc1.tar.gz.sig I've wanted to do this release for months now, but I keep being too busy all the time. This release fixes several important bugs and a lot of smaller ones. Because there are such a large number of changes I thought I'd make this release candidate release first and the final v2.2.14 early next week. I usually read through the Dovecot mailing list mails before making a new release to see if there are some (important) bugs reported, but I've been way too busy recently to read through everything. I still have over 250 unread mails and I don't think I'll have time to read them anytime soon. On the positive side the Dovecot company is now hiring more people. Especially having more Dovecot coders would reduce my work load and maybe allow me to go back to reading the Dovecot mailing list daily.. See: http://www.dovecot.fi/dovecot-is-hiring-software-engineer-helsinki/ (you can do this work anywhere - no need to live in Finland) http://www.dovecot.fi/dovecot-is-hiring-operations-and-support-engineer-hel… (this probably requires living in Finland) http://www.dovecot.fi/dovecot-is-hiring-technical-pre-sales-engineer-helsin… (probably no need to live in Finland) Here are some of the larger changes since v2.2.13: * lmtp: Delivered-To: header no longer contains <> around the email address. Other MDAs don't have it either. * "Out of disk space" errors are now treated as temporary errors (not the same as "Out of disk quota"). * replication plugin: Use replication only for users who have a non-empty mail_replica setting. + lmtp proxy: Log a line about each mail delivery. + Added login_source_ips setting. This can be used to set the source IP address round-robin from a pool of IPs (in case you run out of TCP ports). + Rawlog settings can use tcp:<host>:<port> as the path. + virtual plugin: Don't keep more than virtual_max_open_mailboxes (default 64) number of backend mailboxes open. + SSL/TLS compression can be disabled with ssl_options=no_compression + acl: Global ACL file now supports "quotes" around patterns. + Added last-login plugin to set user's last-login timestamp on login. + LDAP auth: Allow passdb credentials lookup also with auth_bind=yes - IMAP: MODSEQ was sent in FETCH reply even if CONDSTORE/QRESYNC wasn't enabled. This broke at least old Outlooks. - passdb static treated missing password field the same as an empty password field. - mdbox: Fixed potential infinite looping when scanning a broken mdbox file. - imap-login, pop3-login: Fixed potential crashes when client disconnected unexpectedly. - imap proxy: The connection was hanging in some usage patterns. This mainly affected older Outlooks. - lmtp proxy: The proxy sometimes delivered empty mails in error situations or potentially delivered truncated mails. - fts-lucene: If whitespace_chars was set, we may have ended up indexing some garbage words, growing the index size unnecessarily. - -c and -i parameters for dovecot/doveadm commands were ignored if the config socket was readable. - quota: Quota recalculation didn't include INBOX in some setups. - Mail headers were sometimes added to dovecot.index.cache in wrong order. The main problem this caused was with dsync+imapc incremental syncing when the second sync thought the local mailbox had changed. - doveadm backup didn't notice if emails were missing from the middle of the destination mailbox. Now it deletes and resyncs the mailbox.

1 0

Released Pigeonhole v0.4.3 for Dovecot v2.2.13.
by Stephan Bosch 12 May '14

12 May '14

Hello Dovecot users, Now that Dovecot v2.2.13 is released, I can release a new Pigeonhole. Due to changes in Dovecot, this Pigeonhole release will not compile cleanly against older Dovecot releases. This release is mainly about bugfixes. One notable addition is that I have updated the "vnd.dovecot.duplicate" extension to the new IETF draft "duplicate" extension. Changelog v0.4.3: * Editheader extension: Made control characters allowed for editheader, except NUL. Before, this would cause a runtime error. + Upgraded Dovecot-specific Sieve "vnd.dovecot.duplicate" extension to match the new draft "duplicate" extension. - Fixed sieve_result_global_log_error to log only as i_info in administrator log (syslog) if executed from multiscript context. - Sieve redirect extension: Adjusted loop detection to show leniency to resent messages. - Sieve include extension: Fixed problem with handling of duplicate includes with different parameters :once or :optional. - Sieve spamtest/virustest extensions: Tests were erroneously performed against the original message. When used together with extprograms filter to add the spam headers, the changes were not being used by the spamtest and virustest extensions. - Deprecated Sieve notify extension: Fixed segfault problems in message string substitution. - ManageSieve: Fixed active link verification to handle redundant path slashes correctly. - Sieve vacation extension: - Fixed interaction of sieve_vacation_dont_check_recipient with sieve_vacation_send_from_recipient setting. - Fixed log message for discarded response. - Sieve extprograms plugin: - Forgot to disable the alarm() timeouts set for script execution. - Fixed fd leak and handling of output shutdown. - Fixed 'Bad filedescriptor' error occurring when disconnecting script client. - Made sure that programs are never forked with root privileges. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.3.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.3.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.2.13 released
by Timo Sirainen 11 May '14

11 May '14

http://dovecot.org/releases/2.2/dovecot-2.2.13.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.13.tar.gz.sig A few minor changes since v2.2.13.rc1, mainly making the Pigeonhole tests pass. * Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly. This could have left the connections hanging arond for a long time. (Affected Dovecot v1.1+) + mdbox: Added mdbox_purge_preserve_alt setting to keep the file within alt storage during purge. (Should become enforced in v2.3.0?) + fts: Added support for parsing attachments via Apache Tika. Enable with: plugin { fts_tika = http://tikahost:9998/tika/ } + virtual plugin: Delay opening backend mailboxes until it's necessary. This requires mailbox_list_index=yes to work. (Currently IMAP IDLE command still causes all backend mailboxes to be opened.) + mail_never_cache_fields=* means now to disable all caching. This may be a useful optimization as doveadm/dsync parameter for some admin tasks which shouldn't really update the cache file. + IMAP: Return SPECIAL-USE flags always for LSUB command. - pop3 server was still crashing in v2.2.12 with some settings - maildir: Various fixes and improvements to handling compressed mails, especially when they have broken/missing S=sizes in filenames. - fts-lucene, fts-solr: Fixed crash on search when the index contained duplicate entries. - Many fixes and performance improvements to dsync and replication - director was somewhat broken when there were exactly two directors in the ring. It caused errors about "weak users" getting stuck. - mail_attachment_dir: Attachments with the last base64-encoded line longer than the rest wasn't handled correctly. - IMAP: SEARCH/SORT PARTIAL was handled completely wrong in v2.2.11+ - acl: Global ACL file handling was broken when multiple entries matched the mailbox name. (Only the first entry was used.)

1 0

v2.2.13.rc1 released
by Timo Sirainen 08 May '14

08 May '14

http://dovecot.org/releases/2.2/rc/dovecot-2.2.13.rc1.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.13.rc1.tar.gz.sig There have been a ton of smaller and some larger changes since v2.2.12, so I thought I'd first make a RC release and the final v2.2.13 tomorrow. Please try it out! BTW. I've read most of the mails again in Dovecot mailing list, but there are still a few reported bugs I decided to leave until later. Anyway feel free to re-send any bug reports for things that haven't been fixed in v2.2.13 yet. * Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly. This could have left the connections hanging arond for a long time. (Affected Dovecot v1.1+) + mdbox: Added mdbox_purge_preserve_alt setting to keep the file within alt storage during purge. (Should become enforced in v2.3.0?) + fts: Added support for parsing attachments via Apache Tika. Enable with: plugin { fts_tika = http://tikahost:9998/tika/ } + virtual plugin: Delay opening backend mailboxes until it's necessary. This requires mailbox_list_index=yes to work. (Currently IMAP IDLE command still causes all backend mailboxes to be opened.) + mail_never_cache_fields=* means now to disable all caching. This may be a useful optimization as doveadm/dsync parameter for some admin tasks which shouldn't really update the cache file. + IMAP: Return SPECIAL-USE flags always for LSUB command. - pop3 server was still crashing in v2.2.12 with some settings - maildir: Various fixes and improvements to handling compressed mails, especially when they have broken/missing S=sizes in filenames. - fts-lucene, fts-solr: Fixed crash on search when the index contained duplicate entries. - Many fixes and performance improvements to dsync and replication - director was somewhat broken when there were exactly two directors in the ring. It caused errors about "weak users" getting stuck. - mail_attachment_dir: Attachments with the last base64-encoded line longer than the rest wasn't handled correctly. - IMAP: SEARCH/SORT PARTIAL was handled completely wrong in v2.2.11+ - acl: Global ACL file handling was broken when multiple entries matched the mailbox name. (Only the first entry was used.)

1 0

Denial of Service attacks against Dovecot v1.1+
by Timo Sirainen 08 May '14

08 May '14

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected. There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because the oldest connection always gets destroyed this requires quite a lot of activity from the attacker. This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper limit without being able to disconnect any of the oldest connections. Here are patches to fix this: http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3 http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339 http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to patch it yourself. For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.

1 0

v2.2.12 released
by Timo Sirainen 13 Feb '14

13 Feb '14

http://dovecot.org/releases/2.2/dovecot-2.2.12.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.12.tar.gz.sig POP3 server code changes rarely, so I haven't spent time adding automated testing for it. So of course now that it changed in v2.1.11 there was a bug that caused it to crash most of the time (except for the test case I was using while developing it). This release fixes it, no other changes.

1 0

v2.2.11 released
by Timo Sirainen 12 Feb '14

12 Feb '14

http://dovecot.org/releases/2.2/dovecot-2.2.11.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.11.tar.gz.sig I haven't had time to read through the Dovecot mailing list yet, so there are likely some reported bugs that haven't been fixed yet. I'll try to get to them next week in San Francisco. (Probably can't get much done this week in Tokyo.) In the mean time here's v2.2.11 with some new features. + acl plugin: Added an alternative global ACL file that can contain mailbox patterns. See http://wiki2.dovecot.org/ACL for details. + imap proxy: Added proxy_nopipelining passdb setting to work around other IMAP servers' bugs (MS Exchange 2013 especially). + Added %{auth_user}, %{auth_username} and %{auth_domain} variables. See http://wiki2.dovecot.org/Variables for details. + Added support for LZ4 compression. + stats: Track also wall clock time for commands. + pop3_migration plugin improvements to try harder to match the UIDLs correctly. - imap: SEARCH/SORT PARTIAL reponses may have been too large. - doveadm backup: Fixed assert-crash when syncing mailbox deletion.

1 0

v2.2.10 released
by Timo Sirainen 20 Dec '13

20 Dec '13

http://dovecot.org/releases/2.2/dovecot-2.2.10.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.10.tar.gz.sig I've been really busy the last few months, as I guess people in Dovecot mailing list have seen since I haven't been very responsive. There are at least some dsync bugs I haven't had time to look into yet. The busyness probably continues for a while more, but the next year is looking much better for me and for Dovecot in general. We're planning to hire a few more Dovecot coders at some point, so if you're interested send me an email. :) + auth: passdb/userdb dict rewrite to support much more complex setups. See doc/example-config/dovecot-dict-auth.conf.ext. The old settings will continue to work. + auth: Added userdb result_success/failure/tempfail and skip settings, similar to passdb's. See http://wiki2.dovecot.org/UserDatabase + imap: Implemented SETQUOTA command for admin user when quota_set is configured. See http://master.wiki2.dovecot.org/Quota/Configuration + quota: Support "*" and "?" wildcards in mailbox names in quota_rules + mysql: Added ssl_verify_server_cert=no|yes parameter. This currently defaults to "no" to make sure nothing breaks, but likely will become "yes" in Dovecot v2.3. + ldap: Added blocking=yes setting to use auth worker processes for ldap lookups. This is a workaround for now to be able to use multiple simultaneous LDAP connections. + pop3c+dsync performance improvements - quota-status: quota_grace was ignored - ldap: Fixed memory leak with auth_bind=yes and without auth_bind_userdn. - imap: Don't send HIGHESTMODSEQ anymore on SELECT/EXAMINE when CONDSTORE/QRESYNC has never before been enabled for the mailbox. - imap: Fixes to handling mailboxes without permanent modseqs. (When [NOMODSEQ] is returned by SELECT, mainly with in-memory indexes.) - imap: Various fixes to METADATA support. - stats plugin: Processes that only temporarily dropped privileges (e.g. indexer-worker) may have been logging errors about not being able to open /proc/self/io.

1 0

v2.2.9 released
by Timo Sirainen 25 Nov '13

25 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.9.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.9.tar.gz.sig + Full text search indexing can now be done automatically after saving/copying mails by setting plugin { fts_autoindex=yes } + replicator: Added replication_dsync_parameters setting to pass "doveadm sync" parameters (for controlling what to replicate). + Added mail-filter plugin + Added liblzma/xz support (zlib_save=xz) - v2.2.8's improved cache file handling exposed several old bugs related to fetching mail headers. - v2.2.7's iostream handling changes were causing some connections to be disconnected before flushing their output (e.g. POP3 logout message wasn't being sent)

1 0

v2.2.8 released
by Timo Sirainen 19 Nov '13

19 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.8.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.8.tar.gz.sig + Mail cache lookups work for the mail being saved. This improves performance by avoiding the need to parse the mail multiple times when using some plugins (e.g. mail_log). + Mail cache works for recently cached data also with in-memory indexes. + imapc: Many performance improvements, especially when working with dsync. Also added imapc_feature=fetch-headers which allows using FETCH BODY.PEEK[HEADER.FIELDS (..)] to avoid reading the entire header. + mail_location = ..:FULLDIRNAME=dbox-Mails is the same as :DIRNAME=dbox-Mails, but it will also be used for :INDEX and :CONTROL directories. (It should have worked this way from the beginning, but can't be changed anymore without breaking existing installations). - Fixed infinite loop in message parsing if message ends with "--boundary" and CR (without LF). Messages saved via SMTP/LMTP can't trigger this, because messages must end with an "LF.". A user could trigger this for him/herself though. - lmtp: Client was sometimes disconnected before all the output was sent to it. - imap_zlib plugin caused crashes during client disconnection in v2.2.7 - replicator: Database wasn't being exported to disk every 15 minutes as it should have. Instead it was being imported, causing "doveadm replicator remove" commands to not work very well.

1 0