- Dovecot-news - dovecot.org

v1.2.6 released
by Timo Sirainen 06 Oct '09

06 Oct '09

http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.6.tar.gz.sig A couple of random things: - I decided to start using "hg sign" to gpg sign all releases in mercurial repository. - v2.0.alpha1 will hopefully be released in a week or two. Changes since 1.2.5: * Upgraded to Unicode 5.2.0 + Added authtest utility for doing passdb and userdb lookups. + login: ssl_security string now also shows the used compression. - quota: Don't crash with non-Maildir++ quota backend. - imap proxy: Fixed crashing with some specific password characters. - dovecot --exec-mail was broken. - Avoid assert-crashing when two processes try to create index at the same time.

1 0

v1.2.5 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.5.tar.gz.sig I'll be more or less gone for next two weeks. Tomorrow I'm heading to MacSysAdmin in Sweden to give a Dovecot talk, the next week I'll be in Finland on vacation. After that I'm hoping to get v2.0.alpha1 released in October. * Authentication: DIGEST-MD5 and RPA mechanisms no longer require user's login realm to be listed in auth_realms. It only made configuration more difficult without really providing extra security. * zlib plugin: Don't allow clients to save compressed data directly. This prevents users from exploiting (most of the) potential security holes in zlib/bzlib. + Added pop3_save_uidl setting. + dict quota: When updating quota and user isn't already in dict, recalculate and save the quota. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - v1.2.4 index file handling could have caused an assert-crash - IMAP: Fixes to QRESYNC extension. - virtual plugin: Crashfix - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Maildir: Performance fixes, especially with maildir_very_dirty_syncs. - Maildir++ quota: Limits weren't read early enough from maildirsize file (when quota limits not enforced by Dovecot) - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

v1.1.19 released
by Timo Sirainen 14 Sep '09

14 Sep '09

http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.19.tar.gz.sig This is hopefully the last v1.1.x release. - file_set_size() was broken with OSes that didn't support posix_fallocate() (almost everyone except Linux), causing all kinds of index file errors. - ldap: Fixed hang when >128 requests were sent at once. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - deliver: Don't send rejects to any messages that have Auto-Submitted header. This avoids emails loops. - Message decoding fixes (mainly for IMAP SEARCH, Sieve).

1 0

Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

Released Sieve v0.1.12 and ManageSieve v0.11.9 for Dovecot v1.2.4
by Stephan Bosch 21 Aug '09

21 Aug '09

Hello Dovecot users, I finally managed to make new releases of Sieve and ManageSieve for the recent Dovecot v1.2.4 release. The ManageSieve release is important to match login proxy API changes in Dovecot; older versions will not compile against the new Dovecot release. The new Sieve release first includes the new date extension, which allows matching against date values in header fields and the current date-time at script execution. Changelog Sieve v0.1.12: + Testsuite: added support for testing binaries stored on disk. + Implemented the new date extension. This allows matching against date values in header fields and the current date at the time of script evaluation. Changelog ManageSieve v0.11.9: * Adjusted to changes in the Dovecot login proxy API. This release therefore depends on Dovecot v1.2.4. + Reintroduced ability to abort SASL with "*" response. Latest ManageSieve specification includes it. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.12.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.9.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.4-managesieve-0.11.9.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.4 released
by Timo Sirainen 17 Aug '09

17 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.4.tar.gz.sig I'll be on vacation for the rest of this week. I'll read my mails once in a while though. * acl: When looking up ACL defaults, use global/local default files if they exist. So it's now possible to set default ACLs by creating dovecot-acl file to the mail root directory. + imap/pop3 proxy: If proxy destination is known to be down, fail connections to it immediately. + imap/pop3 proxy: Added proxy_timeout passdb extra field to specify proxy's connect timeout. - Fixed a crash in index file handling. - Fixed a crash in saving messages where message contained a CR character that wasn't followed by LF (and the CR happened to be the last character in an internal buffer). - v1.2.3 crashed when listing shared namespace prefix. - listescape plugin: Several fixes. - autocreate plugin: Fixed autosubscribing to mailboxes in subscriptions=no namespaces.

1 0

Released Sieve v0.1.11 and ManageSieve v0.11.8 for Dovecot v1.2.3
by Stephan Bosch 08 Aug '09

08 Aug '09

Hello Dovecot users, Apart from unfinished development of the date extension, this is a set of bug-fix releases. A few portability issues were found, a few stupidities were fixed and the ManageSieve proxy now also works with TLS. Most notably, the include extension had an issue regarding the expansion of $HOME in the personal include path. I've built a project site at: http://pigeonhole.dovecot.org Changelog Sieve v0.1.11: + Built skeleton implementation for the date extension (RFC5260). It compiles, but it does not do anything useful yet. Therefore, it is not part of the default compilation. - Fixed ARM portability issues caused by char type not being signed on that platform. Reading optional operands from a binary would fail for action side effects. Also, an accidental mixup of an int return type with bool caused the interpreter to continue on ARM even though an error occured. - Removed direct stdint.h includes to prevent portability issues. - Fixed segfault bug in the handling of script open failures. - Include: improved user error messages and system log messages. - Fixed copy-paste mixup between sieve_after and sieve_before settings in the LDA Sieve plugin. If only a sieve_after script was active, nothing would have been executed. Patch by Mike Abbott. - Include: fixed a bug in HOME substitution in the sieve_dir path. Surfaced in ManageSieve. Changelog ManageSieve v0.11.8: - Fixed TLS support for proxying ManageSieve. The protocol state machine was incorrect. Also added a check that disables ssl when 'starttls' is not enabled for the user. This produces a proper warning in the log file. There is no such thing as a managesieveS protocol which has SSL from the start. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.3 released
by Timo Sirainen 08 Aug '09

08 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz.sig A few days later than I wanted, but here it is. * Mailbox names with control characters can't be created anymore. Existing mailboxes can still be accessed though. + Allow namespace prefix to be opened as mailbox, if a mailbox already exists in the root dir. - Maildir: dovecot-uidlist was being recreated every time a mailbox was accessed, even if nothing changed. - listescape plugin was somewhat broken - Compiling fixes for non-Linux/BSDs - imap: tb-extra-mailbox-sep workaround was broken. - ldap: Fixed hang when >128 requests were sent at once. - fts_squat: Fixed crashing when searching virtual mailbox. - imap: Fixed THREAD .. INTHREAD crashing.

1 0

Released Sieve v0.1.10 for Dovecot v1.2.2
by Stephan Bosch 03 Aug '09

03 Aug '09

Hello Dovecot users, In the last week two nasty bugs were found in the new Sieve implementation. Primarily, the include extension did not work when a compiled binary was loaded from disk. This is something that is still not tested by the test suite, giving this bug the opportunity to slip through. Also, the value matching implementation would sometimes cause a assertion failure. Other than that, various small bugs were fixed. On the more positive side, I have implemented support for the new mailbox extension (RFC 5490), which provides the means to test whether a mailbox exists. Also, it adds the :create argument to the fileinto command, which makes sure that the target folder is created before saving is attempted. Of course, this is only useful when deliver is used with the -n option. There wasn't a great need for this extension, but I could use it in the test suite and it was almost trivial to implement. In other news, I have further developed the sieve-filter command line tool. It is getting closer to a usable state, being able to filter a large number of messages in an existing mailbox, but its use is currently still very much discouraged as it tends to be very good at eating mailboxes when the user is less attentive. It needs more command line configuration options, a simulation mode to perform a dry run, and a man page that describes its use and its dangers. Changelog for Sieve v0.1.10: * Changed action execution of fileinto and keep. These changes depend on API additions in Dovecot, making this release depend on Dovecot v1.2.2 or newer. * Further developed the sieve-filter command line tool. This required a few changes to the action execution of the Sieve engine. The tool was successfully tested on folders with a few 100k spam messages. However, the commandline options are still incomplete, a man page is missing and it needs much more testing before I can recommend anyone to use this tool. + Added support for the mailbox extension. This allows checking whether a mailbox exists using the mailboxexists command and it adds the :create argument to the fileinto command to create the mailbox when it is missing. The :create feature is useless unless the Deliver LDA is run with the -n option. + Improved the testsuite with tests for message delivery. Messages stored using keep and fileinto can be fed back into the Sieve engine for verification. This includes testing of applied IMAP flags. + Updated the man pages with the new method of specifying the supported extensions using + and - (for the -x parameter of the sieve tools) + Further developed the deprecated notify extension. A dummy for the denotify command exists, meaning that its use does not cause an error anymore. - Fixed a bug in the derivation of the binary path from the script path. A bare filename would yield a path relative to root. - Fixed a bug in the value matching code. The context data now uses a proper pool in stead of the data stack. Bug reported by Jan Sechser. - Fixed assertion fail in the include extension caused by missing initialization upon binary load. This bug surfaces only for stored binaries. Bug reported by Tom Hendrikx. - Fixed include error message for failed :global include. It mentioned the wrong config parameter. - Fixed broken wiki reference in an error message of the plugin about the 'sieve' setting. - Fixed behavior of fileinto when delivering into a namespace prefix. Previous fix used the wrong storage. The release is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.10.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.10.tar.gz.sig Have fun testing the new releases and don't hesitate to notify me when there are problems. Please include your configuration, the involved Sieve scripts and an example message in any bug or problem report when possible, so that I can easily reproduce the issue. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.18 released
by Timo Sirainen 27 Jul '09

27 Jul '09

http://dovecot.org/releases/1.1/dovecot-1.1.18.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.18.tar.gz.sig A few more fixes to v1.1 series. It probably won't have many released left. + dovecot -n/-a now outputs also lda settings. - Maildir++ quota: Quota was sometimes updated wrong when it was being recalculated. - Searching quoted-printable message body internally converted "_" characters to spaces and didn't match search keys with "_". - Messages in year's first/last day may have had broken timezones with OSes not having struct tm->tm_gmtoff (e.g. Solaris).

2 1