- Dovecot-news - dovecot.org

v1.1.10 released
by Timo Sirainen 27 Jan '09

27 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.10.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.10.tar.gz.sig v1.1.9 wasn't such a great release. Once again: Would be great if someone started a proper testing suite so releases could be tested.. - Maildir: Keyword handling was somewhat broken in v1.1.9 - userdb prefetch was broken with blocking passdbs in v1.1.9 - dict process didn't always die with the rest of Dovecot - dict quota was somewhat broken with pgsql

2 1

Released ManageSieve v0.10.5 for Dovecot v1.1.9
by Stephan Bosch 26 Jan '09

26 Jan '09

Hello Dovecot users, Because there was a crash bug in the ManageSieve v0.10.4 login daemon, I made a new release of the ManageSieve service for Dovecot v1.1. This release includes two other small fixes as well. Changelog v0.10.5: - Fixed a segfault bug in the authentication time-out. Bug report and trace provided by Wolfgang Friebel. - Fixed maximum permissions for uploaded scripts; was 0777. This was shielded however by the default umask (not documented to be configurable), so the actual permissions would never have been 0777. - Fixed handling of ~/ in use of mail-data for script location The following files are released: ManageSieve package: http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.5.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.5.tar.gz.s… ManageSieve patch: http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.9-managesieve-0.10.5.diff.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.9-managesieve-0.10.5.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

v1.1.9 released
by Timo Sirainen 23 Jan '09

23 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.9.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.9.tar.gz.sig Lots of small dbox fixes, hopefully migrations from Maildir are now working correctly. I'm also planning on releasing v1.2.beta1 in a few days. + Sending SIGUSR2 to dovecot-auth now also logs statistics about cache inserts. This could help figuring out auth cache size. + deliver: Added rejection_subject setting, which is used for rejected mails. + pop3: Prevent clients from looping forever trying to fetch an expunged message. + If login process crashes, log the IP address that (maybe) caused it. + If core dump limit is 0, add "core dumps disabled" to startup log line. + Log better messages for "Permission denied" errors - mbox: Fixed assert-crash with pop3_lock_session=yes - dbox: Fixes to handling maildir-converted files. - Auth cache wasn't working correctly for all fields (e.g. allow_nets) with blocking passdbs (e.g. mysql). - pgsql: Handle reconnecting to server without failing auth lookups. - Berkeley DB memory/resource leak fixes. - maildir: Fixes to handling over 26 keywords.

1 0

v1.1.8 released
by Timo Sirainen 07 Jan '09

07 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz.sig Most importantly mbox bugfixes. v1.1 should finally be as stable with mboxes as it was with v1.0. Hopefully we'll also soon have the first v1.2 beta release and the final v1.2.0 somewhat soon after that. - mbox: Several bugfixes. Fixes "next message unexpectedly lost" errors and perhaps some other problems as well. - deliver: It wasn't possible to override boolean settings in lda section by setting them to "no". - Maildir++ quota didn't correctly check if maildirs had changed during recalculation. - kqueue notify: Fixed assert-crash in some situations - dbox: Several fixes to handling Maildir migrations - Logging/error message improvements

1 0

Released Sieve v0.1.2 (important bug fixed)
by Stephan Bosch 26 Nov '08

26 Nov '08

Hello Dovecot users, Today, Andy Howell tripped an important bug in the Sieve interpreter that makes it crash when redirect is executed. That is why I quickly release yet another new version to provide a fix for this bug. I really should prevent this from happening again in the future by extending the test suite to test the execution of actions. Changelog v0.1.2: - Fixed important bug in the redirect action (and probably other actions like reject and vacation that only send messages). This was a bug in the handling of context information during the execution of actions. It caused the sieve interpreter to crash with a segfault when redirect was executed. The release is available here: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.2.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.2.tar.gz.sig Refer to the initial release mail for more information: http://www.dovecot.org/list/dovecot-news/2008-October/000087.html Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

Released Sieve v0.1.1 and ManageSieve v0.11.2 for Dovecot v1.2.alpha4
by Stephan Bosch 25 Nov '08

25 Nov '08

Hello Dovecot users, Since the first release of the new Sieve implementation, not that many bugs were reported. This is probably due to the fact that it is not tried yet by that many people. In the mean time, I did find and fix some more bugs myself, I adapted to changes in Dovecot, wrote some more documentation and started work on the enotify extension. Both Sieve and ManageSieve were changed to match API changes in Dovecot and therefore older versions will not compile against the new Dovecot release. Likewise, these new Sieve and ManageSieve releases will not compile for older Dovecot versions. Changelog Sieve v0.1.1: * Re-enabled support for compiling against dovecot headers. Much like cmusieve, command line tools like sievec and sieved are not compiled in this case. * Started implementation of enotify extension. Not anywhere near finished though. * Adapted to changes in Dovecot on various occasions, making this release dependent on Dovecot >= v1.2.alpa4. + Improved logging of errors at specific occasions and added debug messages to find script execution problems quicker. + Removed code duplication between command line tools and the test suite. Also restructured the sources of the tools. + Added UTF-8 to UTF-7 folder name conversion for compatibility with IMAP. + Created man pages for the command line tools. These are automatically installed upon 'make install' + Incorporated Valgrind support into the test suite and fixed a few memory leaks in the process. - Fixed compile error surfacing for gcc3.4. Forgot mask argument for the open() system call when the O_CREAT flag is specified. Bug found by Sergey Ivanov. - Fixed bug in the sievec tool. -d output was always written to stdout. - Fixed important bug in the imap4flags extension. When no :flags argument is specified, the previous version would always use the final value of the internal variable to set the flags. This means that modifications to the internal variable also affected the bare fileinto/keep actions executed earlier. This does not comply to the RFC. - Fixed bug in the include extension's import/export commands. Duplicate import/exports caused problems. - Fixed bug in the handling of non-existent scripts. Errors were sometimes ignored. - Dovecot omitted unfolding multi-line headers. This was added to the cmusieve plugin after the code was incorporated into the new implementation. This is now implicitly fixed by concurrent change in Dovecot. Changelog ManageSieve v0.11.2: * Adapted to changes in Dovecot, making this release dependent on Dovecot >= v1.2.alpa4 The following files are released: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz.sig ManageSieve package: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz.s… ManageSieve patch: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… The full story of the new Sieve implementation is available in my previous posting: http://www.dovecot.org/list/dovecot-news/2008-October/000087.html I still need to update the wiki with pointers to the new Sieve implementation. I hope to have some time and motivation to do so in the next few days. Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.7 released
by Timo Sirainen 24 Nov '08

24 Nov '08

http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz.sig I should have released this earlier since v1.1.6 had that annoying startup problem, but surprisingly few people complained about it so I kind of forgot about it then. BTW. v1.2 progresses nicely. Now that shared mailboxes are finally fully supported, there aren't any widely used IMAP features missing from Dovecot. v1.2.beta1 shouldn't be in too distant future anymore. * IMAP QUOTA extension now returns "MESSAGE" quota, not "MESSAGES". This makes Dovecot now RFC 2087 compliant. Hopefully this change doesn't break anyone's Dovecot-specific quota checking code.. + Added !include and !include_try directives to config file reader. Note that !include doesn't currently work with deliver. The main point here is that ssl_key_password can be placed to a different file with !include_try that deliver can just ignore. + More error/debug message logging improvements. - v1.1.6 gave "userdb didn't return a home directory" error at startup - Some config file parsers (deliver, passwd-file, acl, trash) ignored the file's last line if it didn't end with LF. - fts: SEARCH SUBJECT didn't search messages that weren't already in fts index. - fts-solr: Don't assert-crash if we couldn't connect to Solr. - IMAP: Mailbox deletion gave an error, but still worked, if mails' control directory wasn't the same as index directory. - Several fixes to rarely used mailbox list layout configurations.

1 0

ManageSieve SECURITY hole: virtual users can edit scripts of other virtual users (all versions)
by Stephan Bosch 17 Nov '08

17 Nov '08

Hello, While updating the ManageSieve implementation to the latest draft specification I noticed a major omission in the way script names are handled. Essentially, script names are directly appended to the sieve storage directory path and suffixed with '.sieve'. This does not take the use of '../' in script names into account. Therefore, clever virtual users that know the directory structure of the server can read and edit script files of other virtual users with the same system uid. The added '.sieve' suffix prevents further security breach, because only sieve scripts are accessible this way. Note that of course any publicly accessible sieve script is also affected. I am sorry to report that this bug was introduced pretty much from the start, meaning that all versions of the ManageSieve patch/package are affected. To quickly resolve this issue, I provide patches against the existing releases and I release new versions for Dovecot v1.1 through v1.2. The security patches against the existing releases are very small and should therefore also apply to older versions or can be adjusted to apply cleanly with relative ease. The security patches are available as follows: http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… The security patch for v1.0 is applied against the patched Dovecot tree, while patches for v1.1 and v1.2 are applied against the ManageSieve package. The new releases are available as follows (v1.1 and v1.2 versions have additional changes, read the NEWS files for more info): http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz.s… Refreshed ManageSieve patches for v1.1 and v1.2 are available to avoid confusion, but an existing patched Dovecot should work fine. I hope package maintainers will quickly incorporate the security patches to get rid of this stupidity as soon as possible. Don't hesitate to notify me when there are problems! Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.6 released
by Timo Sirainen 30 Oct '08

30 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz.sig The invalid message address parsing bug is pretty important since it allows a remote user to send broken mail headers and prevent the recipient from accessing the mailbox afterwards, because the process will always just crash trying to parse the header. This is assuming that the IMAP client uses FETCH ENVELOPE command, not all do. Note that it doesn't affect versions older than v1.1.4. + dovecot -n and -a now prints some system information at the top. + More error/debug message logging improvements. - pop3-login: Fixed assert-crash if a client sent USER+PASS+USER+PASS commands in the same IP packet. - Parsing an invalid message address like "From: (" caused an assert-crash in v1.1.4 and v1.1.5. - Folding whitespace wasn't handled correctly inside quoted-strings, causing some messages to be parsed incorrectly. - mbox: Fixed saving messages that begin with a valid From_-line.

1 0

ManageSieve v0.11.0 released for Dovecot 1.2.alpha3
by Stephan Bosch 24 Oct '08

24 Oct '08

Hello Dovecot users, I have composed a release of the ManageSieve service for Dovecot v1.2. I also added two new capabilities that were added to the ManageSieve specification. Just like the last few releases, this new release supports the new Sieve plugin already. Change Log v0.11.0 ------------------- * Upgraded to Dovecot v1.2 * Added support for new ManageSieve capabilities RENAME and NOOP * Moved sieve settings to plugin {} section of config file. Now the settings `sieve` and `sieve_dir` in the plugin section are used for both the Sieve plugin and the ManageSieve service, avoiding the posibility of accidental differences in configuration. Installation ------------ The full installation procedure and other relevant information regarding ManageSieve is supposed to be available on the Dovecot wiki: http://wiki.dovecot.org/ManageSieve However, the changes regarding the config file are not properly described there yet. Refer to the package's README file in stead. New release: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz.s… I have released a new patch for Dovecot v1.2 as well: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… My public key (id: 3DFBB4F4) can be found at wwwkeys.pgp.net. Don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0