- Dovecot-news - dovecot.org

Released Sieve v0.1.13 for Dovecot v1.2.6
by Stephan Bosch 19 Oct '09

19 Oct '09

Hello Dovecot users, After about a month of silence, I finally release a new version of Pigeonhole Sieve. This release fixes problems in the multiscript support and improves the body extension further towards RFC compliance. The body extension still needs work, however, since some content types still give erroneous results. Changelog Sieve v0.1.13: + Body extension: implemented proper handling of the :raw transform and added various new tests to the test suite. However, :content "multipart" and :content "message/rfc822" are still not working. + Fixed race condition occuring when multiple instances are saving the same binary (patch by Timo Sirainen). + Test suite: added support for testing multiscript execution. - Made compiler more lenient towars missing CRLF at the end of the script in a hash comment. - Body extension: don't give SKIP_BODY_BLOCK flag to message parser, we want the body! (patch by Timo Sirainen). - Fixed handling of implicit side effects for multiscript execution. - Fixed bugs in multiscript support; subsequent keep actions were not always merged correctly and implicit side effects were not always handled correctly. - Fixed a segfault bug in the sieve-test tool occuring when compile fails. - Fixed segfault bug in action procesing. It was triggered while merging side effects in duplicate actions. - Fixed bug in the Sieve plugin that caused it to try to stat() a NULL path, yielding a 'Bad address' error. The release is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.13.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.13.tar.gz.sig Refer to http://pigeonhole.dovecot.org for more information. Have fun testing the new release and don't hesitate to notify me when there are problems. Releases for Dovecot v2.0 are still under development... Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.0.alpha1 released
by Timo Sirainen 13 Oct '09

13 Oct '09

http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha1.tar.gz http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha1.tar.gz.sig So here's the first alpha version of Dovecot v2.0. There are still a couple of things left to do, but in general it should work for most people. I started using it for my own mails a few days ago and it seems to work without errors. Largest changes since v1.2: * Global ACLs are now looked up using namespace prefixes. For example if you previously had INBOX. namespace prefix and a global ACL for "INBOX.Sent", it's now looked up from "INBOX.Sent" file instead of "Sent" as before. + Redesigned master process. It's now more modular and there is less code running as root. + Configuration supports now per-local/remote ip/network settings. + dsync utility does a two-way mailbox synchronization. + LMTP server and proxying. + Added mdbox (multi-dbox) mail storage backend. + doveadm utility can be used to do all kinds of administration functions. Old dovecotpw and *view utilities now exist in its subcommands. Some things left to do: - Do something about backwards compatibility with v1.x. Either make it read v1.x config files or provide some config conversion utility. - dsync still has some bugs - config process is a bit too slow. config handling in general could use some caching all around. no need to ask configuration for each login unless there are per-remote-ip settings. - some kind of an optional connection policy server could be useful. mainly to finally implement tcp-wrappers support. - mail_uid, mail_gid, mail_chroot settings don't really work now. I think this actually needs a bit larger change, which is probably a good idea in any case: After successfully authenticating, login process needs to get imap/pop3 process executed. Currently this is done by transferring the connection fd to master process, doing userdb lookup and then forking and execing the imap/pop3 process. The new behavior I'm thinking is that after auth, login process would connect to imap/pop3 unix socket in the login/ directory. That would cause master process to fork a new imap/pop3 process (running as root). Login process would send the necessary auth information via the unix socket, possibly transfer also the fd, and imap/pop3 would do the userdb lookup and then drop privileges. This change has some pros: - Master process will no longer temporarily hold some extra fds and use extra memory during auth lookups. If auth process is hanging these could cause problems. - Master process will no longer have any special auth handling code and I can remove type=auth-source and type=auth services. - Of course fixes the mail_* setting issue, because all of this is now done by imap/pop3 process, which knows about these settings. - Creating support for "multiple imap/pop3 post-login connections in a single process" should be pretty easy to implement with this. The imap/pop3 unix socket just needs to be listened by a new process in the middle that keeps track of what imap/pop3 processes exist and can redirect the new connections to those. But also some cons: - drop_priv_before_exec=yes no longer works, unless the uid/gid is hardcoded to the service {} block. - Each imap/pop3 process needs to do a connect() to auth server at startup, adding a bit to the latency.

1 0

v1.2.6 released
by Timo Sirainen 06 Oct '09

06 Oct '09

http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz.sig A couple of random things: - I decided to start using "hg sign" to gpg sign all releases in mercurial repository. - v2.0.alpha1 will hopefully be released in a week or two. Changes since 1.2.5: * Upgraded to Unicode 5.2.0 + Added authtest utility for doing passdb and userdb lookups. + login: ssl_security string now also shows the used compression. - quota: Don't crash with non-Maildir++ quota backend. - imap proxy: Fixed crashing with some specific password characters. - dovecot --exec-mail was broken. - Avoid assert-crashing when two processes try to create index at the same time.

1 0

v1.2.5 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz.sig I'll be more or less gone for next two weeks. Tomorrow I'm heading to MacSysAdmin in Sweden to give a Dovecot talk, the next week I'll be in Finland on vacation. After that I'm hoping to get v2.0.alpha1 released in October. * Authentication: DIGEST-MD5 and RPA mechanisms no longer require user's login realm to be listed in auth_realms. It only made configuration more difficult without really providing extra security. * zlib plugin: Don't allow clients to save compressed data directly. This prevents users from exploiting (most of the) potential security holes in zlib/bzlib. + Added pop3_save_uidl setting. + dict quota: When updating quota and user isn't already in dict, recalculate and save the quota. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - v1.2.4 index file handling could have caused an assert-crash - IMAP: Fixes to QRESYNC extension. - virtual plugin: Crashfix - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Maildir: Performance fixes, especially with maildir_very_dirty_syncs. - Maildir++ quota: Limits weren't read early enough from maildirsize file (when quota limits not enforced by Dovecot) - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

v1.1.19 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz.sig This is hopefully the last v1.1.x release. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - ldap: Fixed hang when >128 requests were sent at once. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

Released Sieve v0.1.12 and ManageSieve v0.11.9 for Dovecot v1.2.4
by Stephan Bosch 21 Aug '09

21 Aug '09

Hello Dovecot users, I finally managed to make new releases of Sieve and ManageSieve for the recent Dovecot v1.2.4 release. The ManageSieve release is important to match login proxy API changes in Dovecot; older versions will not compile against the new Dovecot release. The new Sieve release first includes the new date extension, which allows matching against date values in header fields and the current date-time at script execution. Changelog Sieve v0.1.12: + Testsuite: added support for testing binaries stored on disk. + Implemented the new date extension. This allows matching against date values in header fields and the current date at the time of script evaluation. Changelog ManageSieve v0.11.9: * Adjusted to changes in the Dovecot login proxy API. This release therefore depends on Dovecot v1.2.4. + Reintroduced ability to abort SASL with "*" response. Latest ManageSieve specification includes it. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.4 released
by Timo Sirainen 17 Aug '09

17 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz.sig I'll be on vacation for the rest of this week. I'll read my mails once in a while though. * acl: When looking up ACL defaults, use global/local default files if they exist. So it's now possible to set default ACLs by creating dovecot-acl file to the mail root directory. + imap/pop3 proxy: If proxy destination is known to be down, fail connections to it immediately. + imap/pop3 proxy: Added proxy_timeout passdb extra field to specify proxy's connect timeout. - Fixed a crash in index file handling. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - v1.2.3 crashed when listing shared namespace prefix. - listescape plugin: Several fixes. - autocreate plugin: Fixed autosubscribing to mailboxes in subscriptions=no namespaces.

1 0

Released Sieve v0.1.11 and ManageSieve v0.11.8 for Dovecot v1.2.3
by Stephan Bosch 08 Aug '09

08 Aug '09

Hello Dovecot users, Apart from unfinished development of the date extension, this is a set of bug-fix releases. A few portability issues were found, a few stupidities were fixed and the ManageSieve proxy now also works with TLS. Most notably, the include extension had an issue regarding the expansion of $HOME in the personal include path. I've built a project site at: http://pigeonhole.dovecot.org Changelog Sieve v0.1.11: + Built skeleton implementation for the date extension (RFC5260). It compiles, but it does not do anything useful yet. Therefore, it is not part of the default compilation. - Fixed ARM portability issues caused by char type not being signed on that platform. Reading optional operands from a binary would fail for action side effects. Also, an accidental mixup of an int return type with bool caused the interpreter to continue on ARM even though an error occured. - Removed direct stdint.h includes to prevent portability issues. - Fixed segfault bug in the handling of script open failures. - Include: improved user error messages and system log messages. - Fixed copy-paste mixup between sieve_after and sieve_before settings in the LDA Sieve plugin. If only a sieve_after script was active, nothing would have been executed. Patch by Mike Abbott. - Include: fixed a bug in HOME substitution in the sieve_dir path. Surfaced in ManageSieve. Changelog ManageSieve v0.11.8: - Fixed TLS support for proxying ManageSieve. The protocol state machine was incorrect. Also added a check that disables ssl when 'starttls' is not enabled for the user. This produces a proper warning in the log file. There is no such thing as a managesieveS protocol which has SSL from the start. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.3 released
by Timo Sirainen 08 Aug '09

08 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz.sig A few days later than I wanted, but here it is. * Mailbox names with control characters can't be created anymore. Existing mailboxes can still be accessed though. + Allow namespace prefix to be opened as mailbox, if a mailbox already exists in the root dir. - Maildir: dovecot-uidlist was being recreated every time a mailbox was accessed, even if nothing changed. - listescape plugin was somewhat broken - Compiling fixes for non-Linux/BSDs - imap: tb-extra-mailbox-sep workaround was broken. - ldap: Fixed hang when >128 requests were sent at once. - fts_squat: Fixed crashing when searching virtual mailbox. - imap: Fixed THREAD .. INTHREAD crashing.

1 0