- Dovecot-news - dovecot.org

v1.2.8 released
by Timo Sirainen 20 Nov '09

20 Nov '09

http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig This is mainly to fix the 0777 base_dir creation issue, which could be considered a security hole, exploitable by local users. An attacker could for example replace Dovecot's auth socket and log in as other users. Gaining root privileges isn't possible though. This affects only v1.2 users, v1.1 and older versions were creating the directory with 0755 permission. If your Dovecot's base_dir isn't in /var/run/dovecot/, you should also make sure that the $prefix/var/ and $prefix/var/run/ (i.e. /usr/local/var/, /usr/local/var/run/ by default) aren't 0777. * Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually. - acl: If user has rights from more than one group, merge them instead of choosing one group's rights and ignoring others. - virtual: When using a lot of mailboxes, the virtual mailbox's header could have grown over 32 kB and caused "out of memory" crashes. Also over 64 kB headers couldn't even be updated with existing transaction log records. Added a new record type that gets used with >=64 kB headers. Older Dovecot versions don't understand this header and will log errors if they see it. - FETCH BODYSTRUCTURE didn't return RFC 2231 "key*" fields correctly

1 0

v1.2.7 released
by Timo Sirainen 10 Nov '09

10 Nov '09

http://dovecot.org/releases/1.2/dovecot-1.2.7.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.7.tar.gz.sig * IMAP: IDLE now sends "Still here" notifications to same user's connections at the same time. This hopefully reduces power usage of some mobile clients that use multiple IDLEing connections. * IMAP: If imap_capability is set, show it in the login banner. + IMAP: Implemented SORT=DISPLAY extension. - Login process creation could have sometimes failed with epoll_ctl() errors or without epoll probably some other strange things could have happened. - Maildir: Fixed some performance issues - Maildir: Fixed crash when using a lot of keywords. - Several fixes to QRESYNC extension and modseq handling - mbox: Make sure failed saves get rolled back with NFS. - dbox: Several fixes.

1 0

v1.1.20 released
by Timo Sirainen 10 Nov '09

10 Nov '09

http://dovecot.org/releases/1.1/dovecot-1.1.20.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.20.tar.gz.sig Hopefully one of the last v1.1 releases. * Upgraded to Unicode 5.2.0 - Maildir: Fixed crash when using a lot of keywords. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors.

1 0

Released Sieve v0.1.13 for Dovecot v1.2.6
by Stephan Bosch 18 Oct '09

18 Oct '09

Hello Dovecot users, After about a month of silence, I finally release a new version of Pigeonhole Sieve. This release fixes problems in the multiscript support and improves the body extension further towards RFC compliance. The body extension still needs work, however, since some content types still give erroneous results. Changelog Sieve v0.1.13: + Body extension: implemented proper handling of the :raw transform and added various new tests to the test suite. However, :content "multipart" and :content "message/rfc822" are still not working. + Fixed race condition occuring when multiple instances are saving the same binary (patch by Timo Sirainen). + Test suite: added support for testing multiscript execution. - Made compiler more lenient towars missing CRLF at the end of the script in a hash comment. - Body extension: don't give SKIP_BODY_BLOCK flag to message parser, we want the body! (patch by Timo Sirainen). - Fixed handling of implicit side effects for multiscript execution. - Fixed bugs in multiscript support; subsequent keep actions were not always merged correctly and implicit side effects were not always handled correctly. - Fixed a segfault bug in the sieve-test tool occuring when compile fails. - Fixed segfault bug in action procesing. It was triggered while merging side effects in duplicate actions. - Fixed bug in the Sieve plugin that caused it to try to stat() a NULL path, yielding a 'Bad address' error. The release is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.13.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.13.tar.gz.sig Refer to http://pigeonhole.dovecot.org for more information. Have fun testing the new release and don't hesitate to notify me when there are problems. Releases for Dovecot v2.0 are still under development... Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.0.alpha1 released
by Timo Sirainen 12 Oct '09

12 Oct '09

http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha1.tar.gz http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha1.tar.gz.sig So here's the first alpha version of Dovecot v2.0. There are still a couple of things left to do, but in general it should work for most people. I started using it for my own mails a few days ago and it seems to work without errors. Largest changes since v1.2: * Global ACLs are now looked up using namespace prefixes. For example if you previously had INBOX. namespace prefix and a global ACL for "INBOX.Sent", it's now looked up from "INBOX.Sent" file instead of "Sent" as before. + Redesigned master process. It's now more modular and there is less code running as root. + Configuration supports now per-local/remote ip/network settings. + dsync utility does a two-way mailbox synchronization. + LMTP server and proxying. + Added mdbox (multi-dbox) mail storage backend. + doveadm utility can be used to do all kinds of administration functions. Old dovecotpw and *view utilities now exist in its subcommands. Some things left to do: - Do something about backwards compatibility with v1.x. Either make it read v1.x config files or provide some config conversion utility. - dsync still has some bugs - config process is a bit too slow. config handling in general could use some caching all around. no need to ask configuration for each login unless there are per-remote-ip settings. - some kind of an optional connection policy server could be useful. mainly to finally implement tcp-wrappers support. - mail_uid, mail_gid, mail_chroot settings don't really work now. I think this actually needs a bit larger change, which is probably a good idea in any case: After successfully authenticating, login process needs to get imap/pop3 process executed. Currently this is done by transferring the connection fd to master process, doing userdb lookup and then forking and execing the imap/pop3 process. The new behavior I'm thinking is that after auth, login process would connect to imap/pop3 unix socket in the login/ directory. That would cause master process to fork a new imap/pop3 process (running as root). Login process would send the necessary auth information via the unix socket, possibly transfer also the fd, and imap/pop3 would do the userdb lookup and then drop privileges. This change has some pros: - Master process will no longer temporarily hold some extra fds and use extra memory during auth lookups. If auth process is hanging these could cause problems. - Master process will no longer have any special auth handling code and I can remove type=auth-source and type=auth services. - Of course fixes the mail_* setting issue, because all of this is now done by imap/pop3 process, which knows about these settings. - Creating support for "multiple imap/pop3 post-login connections in a single process" should be pretty easy to implement with this. The imap/pop3 unix socket just needs to be listened by a new process in the middle that keeps track of what imap/pop3 processes exist and can redirect the new connections to those. But also some cons: - drop_priv_before_exec=yes no longer works, unless the uid/gid is hardcoded to the service {} block. - Each imap/pop3 process needs to do a connect() to auth server at startup, adding a bit to the latency.

1 0

v1.2.6 released
by Timo Sirainen 05 Oct '09

05 Oct '09

http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz.sig A couple of random things: - I decided to start using "hg sign" to gpg sign all releases in mercurial repository. - v2.0.alpha1 will hopefully be released in a week or two. Changes since 1.2.5: * Upgraded to Unicode 5.2.0 + Added authtest utility for doing passdb and userdb lookups. + login: ssl_security string now also shows the used compression. - quota: Don't crash with non-Maildir++ quota backend. - imap proxy: Fixed crashing with some specific password characters. - dovecot --exec-mail was broken. - Avoid assert-crashing when two processes try to create index at the same time.

1 0

v1.2.5 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz.sig I'll be more or less gone for next two weeks. Tomorrow I'm heading to MacSysAdmin in Sweden to give a Dovecot talk, the next week I'll be in Finland on vacation. After that I'm hoping to get v2.0.alpha1 released in October. * Authentication: DIGEST-MD5 and RPA mechanisms no longer require user's login realm to be listed in auth_realms. It only made configuration more difficult without really providing extra security. * zlib plugin: Don't allow clients to save compressed data directly. This prevents users from exploiting (most of the) potential security holes in zlib/bzlib. + Added pop3_save_uidl setting. + dict quota: When updating quota and user isn't already in dict, recalculate and save the quota. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - v1.2.4 index file handling could have caused an assert-crash - IMAP: Fixes to QRESYNC extension. - virtual plugin: Crashfix - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Maildir: Performance fixes, especially with maildir_very_dirty_syncs. - Maildir++ quota: Limits weren't read early enough from maildirsize file (when quota limits not enforced by Dovecot) - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

v1.1.19 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz.sig This is hopefully the last v1.1.x release. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - ldap: Fixed hang when >128 requests were sent at once. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

Security holes in CMU Sieve plugin
by Timo Sirainen 13 Sep '09

13 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

Released Sieve v0.1.12 and ManageSieve v0.11.9 for Dovecot v1.2.4
by Stephan Bosch 21 Aug '09

21 Aug '09

Hello Dovecot users, I finally managed to make new releases of Sieve and ManageSieve for the recent Dovecot v1.2.4 release. The ManageSieve release is important to match login proxy API changes in Dovecot; older versions will not compile against the new Dovecot release. The new Sieve release first includes the new date extension, which allows matching against date values in header fields and the current date-time at script execution. Changelog Sieve v0.1.12: + Testsuite: added support for testing binaries stored on disk. + Implemented the new date extension. This allows matching against date values in header fields and the current date at the time of script evaluation. Changelog ManageSieve v0.11.9: * Adjusted to changes in the Dovecot login proxy API. This release therefore depends on Dovecot v1.2.4. + Reintroduced ability to abort SASL with "*" response. Latest ManageSieve specification includes it. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0