- Dovecot-news - dovecot.org

v1.1.9 released
by Timo Sirainen 23 Jan '09

23 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.9.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.9.tar.gz.sig Lots of small dbox fixes, hopefully migrations from Maildir are now working correctly. I'm also planning on releasing v1.2.beta1 in a few days. + Sending SIGUSR2 to dovecot-auth now also logs statistics about cache inserts. This could help figuring out auth cache size. + deliver: Added rejection_subject setting, which is used for rejected mails. + pop3: Prevent clients from looping forever trying to fetch an expunged message. + If login process crashes, log the IP address that (maybe) caused it. + If core dump limit is 0, add "core dumps disabled" to startup log line. + Log better messages for "Permission denied" errors - mbox: Fixed assert-crash with pop3_lock_session=yes - dbox: Fixes to handling maildir-converted files. - Auth cache wasn't working correctly for all fields (e.g. allow_nets) with blocking passdbs (e.g. mysql). - pgsql: Handle reconnecting to server without failing auth lookups. - Berkeley DB memory/resource leak fixes. - maildir: Fixes to handling over 26 keywords.

1 0

v1.1.8 released
by Timo Sirainen 07 Jan '09

07 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz.sig Most importantly mbox bugfixes. v1.1 should finally be as stable with mboxes as it was with v1.0. Hopefully we'll also soon have the first v1.2 beta release and the final v1.2.0 somewhat soon after that. - mbox: Several bugfixes. Fixes "next message unexpectedly lost" errors and perhaps some other problems as well. - deliver: It wasn't possible to override boolean settings in lda section by setting them to "no". - Maildir++ quota didn't correctly check if maildirs had changed during recalculation. - kqueue notify: Fixed assert-crash in some situations - dbox: Several fixes to handling Maildir migrations - Logging/error message improvements

1 0

Released Sieve v0.1.2 (important bug fixed)
by Stephan Bosch 26 Nov '08

26 Nov '08

Hello Dovecot users, Today, Andy Howell tripped an important bug in the Sieve interpreter that makes it crash when redirect is executed. That is why I quickly release yet another new version to provide a fix for this bug. I really should prevent this from happening again in the future by extending the test suite to test the execution of actions. Changelog v0.1.2: - Fixed important bug in the redirect action (and probably other actions like reject and vacation that only send messages). This was a bug in the handling of context information during the execution of actions. It caused the sieve interpreter to crash with a segfault when redirect was executed. The release is available here: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.2.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.2.tar.gz.sig Refer to the initial release mail for more information: http://www.dovecot.org/list/dovecot-news/2008-October/000087.html Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

Released Sieve v0.1.1 and ManageSieve v0.11.2 for Dovecot v1.2.alpha4
by Stephan Bosch 25 Nov '08

25 Nov '08

Hello Dovecot users, Since the first release of the new Sieve implementation, not that many bugs were reported. This is probably due to the fact that it is not tried yet by that many people. In the mean time, I did find and fix some more bugs myself, I adapted to changes in Dovecot, wrote some more documentation and started work on the enotify extension. Both Sieve and ManageSieve were changed to match API changes in Dovecot and therefore older versions will not compile against the new Dovecot release. Likewise, these new Sieve and ManageSieve releases will not compile for older Dovecot versions. Changelog Sieve v0.1.1: * Re-enabled support for compiling against dovecot headers. Much like cmusieve, command line tools like sievec and sieved are not compiled in this case. * Started implementation of enotify extension. Not anywhere near finished though. * Adapted to changes in Dovecot on various occasions, making this release dependent on Dovecot >= v1.2.alpa4. + Improved logging of errors at specific occasions and added debug messages to find script execution problems quicker. + Removed code duplication between command line tools and the test suite. Also restructured the sources of the tools. + Added UTF-8 to UTF-7 folder name conversion for compatibility with IMAP. + Created man pages for the command line tools. These are automatically installed upon 'make install' + Incorporated Valgrind support into the test suite and fixed a few memory leaks in the process. - Fixed compile error surfacing for gcc3.4. Forgot mask argument for the open() system call when the O_CREAT flag is specified. Bug found by Sergey Ivanov. - Fixed bug in the sievec tool. -d output was always written to stdout. - Fixed important bug in the imap4flags extension. When no :flags argument is specified, the previous version would always use the final value of the internal variable to set the flags. This means that modifications to the internal variable also affected the bare fileinto/keep actions executed earlier. This does not comply to the RFC. - Fixed bug in the include extension's import/export commands. Duplicate import/exports caused problems. - Fixed bug in the handling of non-existent scripts. Errors were sometimes ignored. - Dovecot omitted unfolding multi-line headers. This was added to the cmusieve plugin after the code was incorporated into the new implementation. This is now implicitly fixed by concurrent change in Dovecot. Changelog ManageSieve v0.11.2: * Adapted to changes in Dovecot, making this release dependent on Dovecot >= v1.2.alpa4 The following files are released: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz.sig ManageSieve package: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz.s… ManageSieve patch: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… The full story of the new Sieve implementation is available in my previous posting: http://www.dovecot.org/list/dovecot-news/2008-October/000087.html I still need to update the wiki with pointers to the new Sieve implementation. I hope to have some time and motivation to do so in the next few days. Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.7 released
by Timo Sirainen 24 Nov '08

24 Nov '08

http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz.sig I should have released this earlier since v1.1.6 had that annoying startup problem, but surprisingly few people complained about it so I kind of forgot about it then. BTW. v1.2 progresses nicely. Now that shared mailboxes are finally fully supported, there aren't any widely used IMAP features missing from Dovecot. v1.2.beta1 shouldn't be in too distant future anymore. * IMAP QUOTA extension now returns "MESSAGE" quota, not "MESSAGES". This makes Dovecot now RFC 2087 compliant. Hopefully this change doesn't break anyone's Dovecot-specific quota checking code.. + Added !include and !include_try directives to config file reader. Note that !include doesn't currently work with deliver. The main point here is that ssl_key_password can be placed to a different file with !include_try that deliver can just ignore. + More error/debug message logging improvements. - v1.1.6 gave "userdb didn't return a home directory" error at startup - Some config file parsers (deliver, passwd-file, acl, trash) ignored the file's last line if it didn't end with LF. - fts: SEARCH SUBJECT didn't search messages that weren't already in fts index. - fts-solr: Don't assert-crash if we couldn't connect to Solr. - IMAP: Mailbox deletion gave an error, but still worked, if mails' control directory wasn't the same as index directory. - Several fixes to rarely used mailbox list layout configurations.

1 0

ManageSieve SECURITY hole: virtual users can edit scripts of other virtual users (all versions)
by Stephan Bosch 17 Nov '08

17 Nov '08

Hello, While updating the ManageSieve implementation to the latest draft specification I noticed a major omission in the way script names are handled. Essentially, script names are directly appended to the sieve storage directory path and suffixed with '.sieve'. This does not take the use of '../' in script names into account. Therefore, clever virtual users that know the directory structure of the server can read and edit script files of other virtual users with the same system uid. The added '.sieve' suffix prevents further security breach, because only sieve scripts are accessible this way. Note that of course any publicly accessible sieve script is also affected. I am sorry to report that this bug was introduced pretty much from the start, meaning that all versions of the ManageSieve patch/package are affected. To quickly resolve this issue, I provide patches against the existing releases and I release new versions for Dovecot v1.1 through v1.2. The security patches against the existing releases are very small and should therefore also apply to older versions or can be adjusted to apply cleanly with relative ease. The security patches are available as follows: http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… The security patch for v1.0 is applied against the patched Dovecot tree, while patches for v1.1 and v1.2 are applied against the ManageSieve package. The new releases are available as follows (v1.1 and v1.2 versions have additional changes, read the NEWS files for more info): http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz.s… Refreshed ManageSieve patches for v1.1 and v1.2 are available to avoid confusion, but an existing patched Dovecot should work fine. I hope package maintainers will quickly incorporate the security patches to get rid of this stupidity as soon as possible. Don't hesitate to notify me when there are problems! Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.6 released
by Timo Sirainen 30 Oct '08

30 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz.sig The invalid message address parsing bug is pretty important since it allows a remote user to send broken mail headers and prevent the recipient from accessing the mailbox afterwards, because the process will always just crash trying to parse the header. This is assuming that the IMAP client uses FETCH ENVELOPE command, not all do. Note that it doesn't affect versions older than v1.1.4. + dovecot -n and -a now prints some system information at the top. + More error/debug message logging improvements. - pop3-login: Fixed assert-crash if a client sent USER+PASS+USER+PASS commands in the same IP packet. - Parsing an invalid message address like "From: (" caused an assert-crash in v1.1.4 and v1.1.5. - Folding whitespace wasn't handled correctly inside quoted-strings, causing some messages to be parsed incorrectly. - mbox: Fixed saving messages that begin with a valid From_-line.

1 0

ManageSieve v0.11.0 released for Dovecot 1.2.alpha3
by Stephan Bosch 24 Oct '08

24 Oct '08

Hello Dovecot users, I have composed a release of the ManageSieve service for Dovecot v1.2. I also added two new capabilities that were added to the ManageSieve specification. Just like the last few releases, this new release supports the new Sieve plugin already. Change Log v0.11.0 ------------------- * Upgraded to Dovecot v1.2 * Added support for new ManageSieve capabilities RENAME and NOOP * Moved sieve settings to plugin {} section of config file. Now the settings `sieve` and `sieve_dir` in the plugin section are used for both the Sieve plugin and the ManageSieve service, avoiding the posibility of accidental differences in configuration. Installation ------------ The full installation procedure and other relevant information regarding ManageSieve is supposed to be available on the Dovecot wiki: http://wiki.dovecot.org/ManageSieve However, the changes regarding the config file are not properly described there yet. Refer to the package's README file in stead. New release: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz.s… I have released a new patch for Dovecot v1.2 as well: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… My public key (id: 3DFBB4F4) can be found at wwwkeys.pgp.net. Don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

First release (v0.1.0) of the new Sieve implementation for Dovecot v1.2
by Stephan Bosch 23 Oct '08

23 Oct '08

Hello Dovecot users, Finally, after little more than a year, I finished the first release of the new Sieve implementation for Dovecot. The main reason for rewriting the Sieve engine is to provide more reliable script execution and to provide better error messages to users and system administrators. Also, since the Sieve language evolves quickly, with new language extensions published every year, the aim is to provide support for quickly extending the engine with new features. This implementation aims to comply to RFC8225 and it provides support for the following Sieve language extensions: * fileinto * reject * envelope * encoded-character * vacation * subaddress * relational * regex * imap4flags * copy * include * body * variables In comparison to the old CMU Sieve plugin, I added support for the very useful variables extension. However, the notify extension is notably missing. This will be implemented for next major release (0.2.x). Refer to the README file for a full list of its features: http://hg.rename-it.nl/dovecot-libsieve/raw-file/0.1.0/README Installation ------------ The source package is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.0.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.0.tar.gz.sig Alternatively, it can be cloned from the mercurial repository: hg clone http://hg.rename-it.nl/dovecot-libsieve The compilation procedure is identical to the cmusieve plugin (http://wiki.dovecot.org/LDA/Sieve) Don't forget to execute ./autogen.sh first if you obtained the sources through mercurial. This release will not compile against Dovecot versions older than v1.2.alpha3. The configuration is very similar to the original plugin as well. The most notable difference is the name of the plugin, which is simply 'sieve' in stead of 'cmusieve'. After compilation, the Sieve engine can be verified before deployment using the included test suite. This is done by executing `make test` in the top of the source tree. The test suite is known to finish flawlessly on the i386 and amd64 platforms. The test suite is not very comprehensive yet, as it only tests the evaluation of scripts and omits testing the actual execution of actions. As this release contains about 30k effective lines of fresh code, bugs will eventually surface. Make sure that you provide enough information to reproduce the problem if you report bugs, i.e. the script and the mail message that caused the problem and/or relevant log entries. Have fun testing the new Sieve plugin. Don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

Released v1.1.5 and v1.2.alpha3
by Timo Sirainen 22 Oct '08

22 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.5.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.5.tar.gz.sig http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha3.tar.gz http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha3.tar.gz.sig A combined release announcement for a change. :) Largest changes since v1.1.4: * Dovecot prints an informational message about authentication problems at startup. The message goes away after the first successful authentication. This hopefully reduces the number of "Why doesn't my authentication work?" questions. + Maildir/dbox: Try harder to assign unique UIDVALIDITY values to mailboxes to avoid potential problems when recreating or renaming mailboxes. The UIDVALIDITY is tracked using dovecot-uidvalidity* files in the mail root directory. + Many logging improvements - In some conditions Dovecot could have stopped using existing cache file and never used it again until it was deleted. - pop3 + Maildir: Make sure virtual sizes are always written to dovecot-uidlist. This way if the indexes are lost Dovecot will never do a huge amount of work to recalculate them. - mbox: Fixed listing mailboxes in namespaces with prefix beginning with '~' or '/' (i.e. UW-IMAP compatibility namespaces didn't work). - dict quota: Don't crash when recalculating quota (when quota warnings enabled). - Fixes to handling "out of disk space/quota" failures. - Blocking passdbs/userdbs (e.g. PAM, MySQL) could have failed lookups sometimes when auth_worker_max_request_count was non-zero. - Fixed compiling with OpenBSD Largest changes since v1.2.alpha2: + Added userdb checkpassword (by Sascha Wilde) + Autocreate plugin: http://wiki.dovecot.org/Plugins/Autocreate + Listescape plugin: http://wiki.dovecot.org/Plugins/Listescape - All the same fixes as for v1.1.5 I was thinking about waiting for Kolab people's work for shared mailbox support to get done, get that code to v1.2 tree and then release v1.2.beta1 with feature freeze.

1 0