- Dovecot-news - dovecot.org

Denial of Service attacks against Dovecot v1.1+
by Timo Sirainen 08 May '14

08 May '14

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected. There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because the oldest connection always gets destroyed this requires quite a lot of activity from the attacker. This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper limit without being able to disconnect any of the oldest connections. Here are patches to fix this: http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3 http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339 http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to patch it yourself. For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.

1 0

v2.2.12 released
by Timo Sirainen 13 Feb '14

13 Feb '14

http://dovecot.org/releases/2.2/dovecot-2.2.12.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.12.tar.gz.sig POP3 server code changes rarely, so I haven't spent time adding automated testing for it. So of course now that it changed in v2.1.11 there was a bug that caused it to crash most of the time (except for the test case I was using while developing it). This release fixes it, no other changes.

1 0

v2.2.11 released
by Timo Sirainen 12 Feb '14

12 Feb '14

http://dovecot.org/releases/2.2/dovecot-2.2.11.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.11.tar.gz.sig I haven't had time to read through the Dovecot mailing list yet, so there are likely some reported bugs that haven't been fixed yet. I'll try to get to them next week in San Francisco. (Probably can't get much done this week in Tokyo.) In the mean time here's v2.2.11 with some new features. + acl plugin: Added an alternative global ACL file that can contain mailbox patterns. See http://wiki2.dovecot.org/ACL for details. + imap proxy: Added proxy_nopipelining passdb setting to work around other IMAP servers' bugs (MS Exchange 2013 especially). + Added %{auth_user}, %{auth_username} and %{auth_domain} variables. See http://wiki2.dovecot.org/Variables for details. + Added support for LZ4 compression. + stats: Track also wall clock time for commands. + pop3_migration plugin improvements to try harder to match the UIDLs correctly. - imap: SEARCH/SORT PARTIAL reponses may have been too large. - doveadm backup: Fixed assert-crash when syncing mailbox deletion.

1 0

v2.2.10 released
by Timo Sirainen 20 Dec '13

20 Dec '13

http://dovecot.org/releases/2.2/dovecot-2.2.10.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.10.tar.gz.sig I've been really busy the last few months, as I guess people in Dovecot mailing list have seen since I haven't been very responsive. There are at least some dsync bugs I haven't had time to look into yet. The busyness probably continues for a while more, but the next year is looking much better for me and for Dovecot in general. We're planning to hire a few more Dovecot coders at some point, so if you're interested send me an email. :) + auth: passdb/userdb dict rewrite to support much more complex setups. See doc/example-config/dovecot-dict-auth.conf.ext. The old settings will continue to work. + auth: Added userdb result_success/failure/tempfail and skip settings, similar to passdb's. See http://wiki2.dovecot.org/UserDatabase + imap: Implemented SETQUOTA command for admin user when quota_set is configured. See http://master.wiki2.dovecot.org/Quota/Configuration + quota: Support "*" and "?" wildcards in mailbox names in quota_rules + mysql: Added ssl_verify_server_cert=no|yes parameter. This currently defaults to "no" to make sure nothing breaks, but likely will become "yes" in Dovecot v2.3. + ldap: Added blocking=yes setting to use auth worker processes for ldap lookups. This is a workaround for now to be able to use multiple simultaneous LDAP connections. + pop3c+dsync performance improvements - quota-status: quota_grace was ignored - ldap: Fixed memory leak with auth_bind=yes and without auth_bind_userdn. - imap: Don't send HIGHESTMODSEQ anymore on SELECT/EXAMINE when CONDSTORE/QRESYNC has never before been enabled for the mailbox. - imap: Fixes to handling mailboxes without permanent modseqs. (When [NOMODSEQ] is returned by SELECT, mainly with in-memory indexes.) - imap: Various fixes to METADATA support. - stats plugin: Processes that only temporarily dropped privileges (e.g. indexer-worker) may have been logging errors about not being able to open /proc/self/io.

1 0

v2.2.9 released
by Timo Sirainen 25 Nov '13

25 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.9.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.9.tar.gz.sig + Full text search indexing can now be done automatically after saving/copying mails by setting plugin { fts_autoindex=yes } + replicator: Added replication_dsync_parameters setting to pass "doveadm sync" parameters (for controlling what to replicate). + Added mail-filter plugin + Added liblzma/xz support (zlib_save=xz) - v2.2.8's improved cache file handling exposed several old bugs related to fetching mail headers. - v2.2.7's iostream handling changes were causing some connections to be disconnected before flushing their output (e.g. POP3 logout message wasn't being sent)

1 0

v2.2.8 released
by Timo Sirainen 19 Nov '13

19 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.8.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.8.tar.gz.sig + Mail cache lookups work for the mail being saved. This improves performance by avoiding the need to parse the mail multiple times when using some plugins (e.g. mail_log). + Mail cache works for recently cached data also with in-memory indexes. + imapc: Many performance improvements, especially when working with dsync. Also added imapc_feature=fetch-headers which allows using FETCH BODY.PEEK[HEADER.FIELDS (..)] to avoid reading the entire header. + mail_location = ..:FULLDIRNAME=dbox-Mails is the same as :DIRNAME=dbox-Mails, but it will also be used for :INDEX and :CONTROL directories. (It should have worked this way from the beginning, but can't be changed anymore without breaking existing installations). - Fixed infinite loop in message parsing if message ends with "--boundary" and CR (without LF). Messages saved via SMTP/LMTP can't trigger this, because messages must end with an "LF.". A user could trigger this for him/herself though. - lmtp: Client was sometimes disconnected before all the output was sent to it. - imap_zlib plugin caused crashes during client disconnection in v2.2.7 - replicator: Database wasn't being exported to disk every 15 minutes as it should have. Instead it was being imported, causing "doveadm replicator remove" commands to not work very well.

1 0

v2.2.7 released
by Timo Sirainen 03 Nov '13

03 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.7.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.7.tar.gz.sig * Some usage of passdb checkpassword could have been exploitable by local users. You may need to modify your setup to keep it working. See http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security + auth: Added ability to truncate values logged by auth_verbose_passwords (see 10-logging.conf comment) + mdbox: Added "mdbox_deleted" storage, which can be used to access messages with refcount=0. For example: doveadm import mdbox_deleted:~/mdbox "" mailbox inbox subject oops + ssl-params: Added ssl_dh_parameters_length setting. - master process was doing a hostname.domain lookup for each created process, which may have caused a lot of unnecessary DNS lookups. - dsync: Syncing over 100 messages at once caused problems in some situations, causing messages to get new UIDs. - fts-solr: Different Solr hosts for different users didn't work.

1 1

Released Pigeonhole v0.4.2 for Dovecot v2.2.6 and Pigeonhole v0.3.6 for Dovecot v2.1.17.
by Stephan Bosch 26 Sep '13

26 Sep '13

Hello Dovecot users, Now that Dovecot v2.2.6 is released, I can release a new Pigeonhole. Due to the SO_REUSEPORT changes in Dovecot, this Pigeonhole release will not compile cleanly against older Dovecot releases. This release is mainly about bugfixes. I also made a new release for Dovecot v2.1.17 that includes most of these fixes and some older ones. A word of warning for people using doveadm sync in combination with sieve: make sure you update both sides of the replication to avoid problems after upgrade. The attribute sub-tree under which Sieve scripts are replicated has moved to a different root. Since we expect that very few people are affected, there is no facility for backwards compatibility. This is no problem as long as both sides are upgraded. There is one new feature for the Sieve vacation extension. Normally vacation replies are sent with <> sender to prevent mail loops. A setting is provided to override this behavior (doc/extensions/vacation.txt), as requested on the mailing list. This is not a violation of the specification, but use this with care. Changelog v0.4.2: * Incompatible change in Sieve doveadm plugin: the root attribute for Sieve scripts is changed. Make sure that you update both sides of a dsync setup simultaneously when Sieve is involved, otherwise synchronization will likely fail. + Added support for sending Sieve vacation replies with an actual sender, rather than the default <> sender. Check the updated doc/extensions/vacation.txt for more information. - Fixed a binary code read problem in the `set' command of the Sieve variables extension. Using the set command with a modifier and an empty string value would cause code corruption problems while running the script. - Various fixes for doveadm-sieve plugin, mostly crashes. These include a fix for the `Invalid value for default sieve attribute' problem. - Various fixes for compiler and static analyzer warnings, e.g. as reported by CLang and on 32 bit systems. - Fixed the implementation of the new :options flag for the Sieve include extension. - Fixed potential segfault bug at deinitialization of the lda-sieve plugin. - Fixed messed up hex output for sieve-dump tool. Changelog v0.3.6: - Fixed a binary code read problem in the `set' command of the Sieve variables extension. Using the set command with a modifier and an empty string value would cause code corruption problems while running the script. - Various fixes for compiler and static analyzer warnings, as reported by CLang. - ManageSieve: Fixed '[' ']' stupidity for response codes (only happened before login). - Fixed setting name in example-config/conf.d/20-managesieve.conf. - Fixed messed up hex output for sieve-dump tool. The releases are available as follows: http://www.rename-it.nl/dovecot/2.2/dovecot-2.2-pigeonhole-0.4.2.tar.gz http://www.rename-it.nl/dovecot/2.2/dovecot-2.2-pigeonhole-0.4.2.tar.gz.sig http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.6.tar.gz http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.6.tar.gz.sig Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.2.6 released
by Timo Sirainen 25 Sep '13

25 Sep '13

http://dovecot.org/releases/2.2/dovecot-2.2.6.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.6.tar.gz.sig I didn't have time to look into the latest reported dsync replication bugs, but this release should have been done a long time ago already and I'm busy for next few days, so no more waiting. Things seem to be working quite well in general though. * acl: If public/shared namespace has a shared subscriptions file for all users, don't list subscription entries that are not visible to the user accessing it. + doveadm: Added "auth lookup" command for doing passdb lookup. + login_log_format_elements: Added %{orig_user}, %{orig_username} and %{orig_domain} expanding to the username exactly as sent by the client (before any changes auth process made). + Added ssl_prefer_server_ciphers setting. + auth_verbose_passwords: Log the password also for unknown users. + Linux: Added optional support for SO_REUSEPORT with inet_listener { reuse_port=yes } - director: v2.2.5 changes caused "SYNC lost" errors - dsync: Many fixes and error handling improvements - doveadm -A: Don't waste CPU by doing a separate config lookup for each user - Long-running ssl-params process no longer prevents Dovecot restart - mbox: Fixed mailbox_list_index=yes to work correctly

1 0

v2.2.5 released
by Timo Sirainen 05 Aug '13

05 Aug '13

http://dovecot.org/releases/2.2/dovecot-2.2.5.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.5.tar.gz.sig So, I'm back from the first vacation I've had in about 10 years. (Well, maybe there were a few short ones.) I was planning on coding it the whole time, but looks like I didn't manage to get anything at all done. Maybe that's a good vacation?.. Anyway, I've still a few more pending things to look into, but it's been too long since v2.2.4 so here are the fixes so far. + SSL: Added support for ECDH/ECDHE cipher suites (by David Hicks) + Added some missing man pages (by Pascal Volk) + quota-status: Added quota_status_toolarge setting (by Ulrich Zehl) - director: Users near expiration could have been redirected to different servers at the same time. - pop3: Avoid assert-crash if client disconnects during LIST. - mdbox: Corrupted index header still wasn't automatically fixed. - dsync: Various fixes to work better with imapc and pop3c storages. - ldap: sasl_bind=yes caused crashes, because Dovecot's lib-sasl symbols conflicted with Cyrus SASL library. - imap: Various error handling fixes to CATENATE. (Found using Apple's stress test script.)

1 0