- Dovecot-news - dovecot.org

Released Sieve v0.1.1 and ManageSieve v0.11.2 for Dovecot v1.2.alpha4
by Stephan Bosch 25 Nov '08

25 Nov '08

Hello Dovecot users, Since the first release of the new Sieve implementation, not that many bugs were reported. This is probably due to the fact that it is not tried yet by that many people. In the mean time, I did find and fix some more bugs myself, I adapted to changes in Dovecot, wrote some more documentation and started work on the enotify extension. Both Sieve and ManageSieve were changed to match API changes in Dovecot and therefore older versions will not compile against the new Dovecot release. Likewise, these new Sieve and ManageSieve releases will not compile for older Dovecot versions. Changelog Sieve v0.1.1: * Re-enabled support for compiling against dovecot headers. Much like cmusieve, command line tools like sievec and sieved are not compiled in this case. * Started implementation of enotify extension. Not anywhere near finished though. * Adapted to changes in Dovecot on various occasions, making this release dependent on Dovecot >= v1.2.alpa4. + Improved logging of errors at specific occasions and added debug messages to find script execution problems quicker. + Removed code duplication between command line tools and the test suite. Also restructured the sources of the tools. + Added UTF-8 to UTF-7 folder name conversion for compatibility with IMAP. + Created man pages for the command line tools. These are automatically installed upon 'make install' + Incorporated Valgrind support into the test suite and fixed a few memory leaks in the process. - Fixed compile error surfacing for gcc3.4. Forgot mask argument for the open() system call when the O_CREAT flag is specified. Bug found by Sergey Ivanov. - Fixed bug in the sievec tool. -d output was always written to stdout. - Fixed important bug in the imap4flags extension. When no :flags argument is specified, the previous version would always use the final value of the internal variable to set the flags. This means that modifications to the internal variable also affected the bare fileinto/keep actions executed earlier. This does not comply to the RFC. - Fixed bug in the include extension's import/export commands. Duplicate import/exports caused problems. - Fixed bug in the handling of non-existent scripts. Errors were sometimes ignored. - Dovecot omitted unfolding multi-line headers. This was added to the cmusieve plugin after the code was incorporated into the new implementation. This is now implicitly fixed by concurrent change in Dovecot. Changelog ManageSieve v0.11.2: * Adapted to changes in Dovecot, making this release dependent on Dovecot >= v1.2.alpa4 The following files are released: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.1.tar.gz.sig ManageSieve package: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.2.tar.gz.s… ManageSieve patch: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha4-managesieve-0.11.2.d… The full story of the new Sieve implementation is available in my previous posting: http://www.dovecot.org/list/dovecot-news/2008-October/000087.html I still need to update the wiki with pointers to the new Sieve implementation. I hope to have some time and motivation to do so in the next few days. Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.7 released
by Timo Sirainen 24 Nov '08

24 Nov '08

http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.7.tar.gz.sig I should have released this earlier since v1.1.6 had that annoying startup problem, but surprisingly few people complained about it so I kind of forgot about it then. BTW. v1.2 progresses nicely. Now that shared mailboxes are finally fully supported, there aren't any widely used IMAP features missing from Dovecot. v1.2.beta1 shouldn't be in too distant future anymore. * IMAP QUOTA extension now returns "MESSAGE" quota, not "MESSAGES". This makes Dovecot now RFC 2087 compliant. Hopefully this change doesn't break anyone's Dovecot-specific quota checking code.. + Added !include and !include_try directives to config file reader. Note that !include doesn't currently work with deliver. The main point here is that ssl_key_password can be placed to a different file with !include_try that deliver can just ignore. + More error/debug message logging improvements. - v1.1.6 gave "userdb didn't return a home directory" error at startup - Some config file parsers (deliver, passwd-file, acl, trash) ignored the file's last line if it didn't end with LF. - fts: SEARCH SUBJECT didn't search messages that weren't already in fts index. - fts-solr: Don't assert-crash if we couldn't connect to Solr. - IMAP: Mailbox deletion gave an error, but still worked, if mails' control directory wasn't the same as index directory. - Several fixes to rarely used mailbox list layout configurations.

1 0

ManageSieve SECURITY hole: virtual users can edit scripts of other virtual users (all versions)
by Stephan Bosch 17 Nov '08

17 Nov '08

Hello, While updating the ManageSieve implementation to the latest draft specification I noticed a major omission in the way script names are handled. Essentially, script names are directly appended to the sieve storage directory path and suffixed with '.sieve'. This does not take the use of '../' in script names into account. Therefore, clever virtual users that know the directory structure of the server can read and edit script files of other virtual users with the same system uid. The added '.sieve' suffix prevents further security breach, because only sieve scripts are accessible this way. Note that of course any publicly accessible sieve script is also affected. I am sorry to report that this bug was introduced pretty much from the start, meaning that all versions of the ManageSieve patch/package are affected. To quickly resolve this issue, I provide patches against the existing releases and I release new versions for Dovecot v1.1 through v1.2. The security patches against the existing releases are very small and should therefore also apply to older versions or can be adjusted to apply cleanly with relative ease. The security patches are available as follows: http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-managesieve-v9.3-securit… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.3-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0-security… The security patch for v1.0 is applied against the patched Dovecot tree, while patches for v1.1 and v1.2 are applied against the ManageSieve package. The new releases are available as follows (v1.1 and v1.2 versions have additional changes, read the NEWS files for more info): http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz http://www.rename-it.nl/dovecot/1.0/dovecot-1.0.15-MANAGESIEVE-v9.4.diff.gz… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.4.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.1.tar.gz.s… Refreshed ManageSieve patches for v1.1 and v1.2 are available to avoid confusion, but an existing patched Dovecot should work fine. I hope package maintainers will quickly incorporate the security patches to get rid of this stupidity as soon as possible. Don't hesitate to notify me when there are problems! Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.1.6 released
by Timo Sirainen 30 Oct '08

30 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz.sig The invalid message address parsing bug is pretty important since it allows a remote user to send broken mail headers and prevent the recipient from accessing the mailbox afterwards, because the process will always just crash trying to parse the header. This is assuming that the IMAP client uses FETCH ENVELOPE command, not all do. Note that it doesn't affect versions older than v1.1.4. + dovecot -n and -a now prints some system information at the top. + More error/debug message logging improvements. - pop3-login: Fixed assert-crash if a client sent USER+PASS+USER+PASS commands in the same IP packet. - Parsing an invalid message address like "From: (" caused an assert-crash in v1.1.4 and v1.1.5. - Folding whitespace wasn't handled correctly inside quoted-strings, causing some messages to be parsed incorrectly. - mbox: Fixed saving messages that begin with a valid From_-line.

1 0

ManageSieve v0.11.0 released for Dovecot 1.2.alpha3
by Stephan Bosch 24 Oct '08

24 Oct '08

Hello Dovecot users, I have composed a release of the ManageSieve service for Dovecot v1.2. I also added two new capabilities that were added to the ManageSieve specification. Just like the last few releases, this new release supports the new Sieve plugin already. Change Log v0.11.0 ------------------- * Upgraded to Dovecot v1.2 * Added support for new ManageSieve capabilities RENAME and NOOP * Moved sieve settings to plugin {} section of config file. Now the settings `sieve` and `sieve_dir` in the plugin section are used for both the Sieve plugin and the ManageSieve service, avoiding the posibility of accidental differences in configuration. Installation ------------ The full installation procedure and other relevant information regarding ManageSieve is supposed to be available on the Dovecot wiki: http://wiki.dovecot.org/ManageSieve However, the changes regarding the config file are not properly described there yet. Refer to the package's README file in stead. New release: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.0.tar.gz.s… I have released a new patch for Dovecot v1.2 as well: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.alpha3-managesieve-0.11.0.d… My public key (id: 3DFBB4F4) can be found at wwwkeys.pgp.net. Don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

First release (v0.1.0) of the new Sieve implementation for Dovecot v1.2
by Stephan Bosch 23 Oct '08

23 Oct '08

Hello Dovecot users, Finally, after little more than a year, I finished the first release of the new Sieve implementation for Dovecot. The main reason for rewriting the Sieve engine is to provide more reliable script execution and to provide better error messages to users and system administrators. Also, since the Sieve language evolves quickly, with new language extensions published every year, the aim is to provide support for quickly extending the engine with new features. This implementation aims to comply to RFC8225 and it provides support for the following Sieve language extensions: * fileinto * reject * envelope * encoded-character * vacation * subaddress * relational * regex * imap4flags * copy * include * body * variables In comparison to the old CMU Sieve plugin, I added support for the very useful variables extension. However, the notify extension is notably missing. This will be implemented for next major release (0.2.x). Refer to the README file for a full list of its features: http://hg.rename-it.nl/dovecot-libsieve/raw-file/0.1.0/README Installation ------------ The source package is available as follows: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.0.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.0.tar.gz.sig Alternatively, it can be cloned from the mercurial repository: hg clone http://hg.rename-it.nl/dovecot-libsieve The compilation procedure is identical to the cmusieve plugin (http://wiki.dovecot.org/LDA/Sieve) Don't forget to execute ./autogen.sh first if you obtained the sources through mercurial. This release will not compile against Dovecot versions older than v1.2.alpha3. The configuration is very similar to the original plugin as well. The most notable difference is the name of the plugin, which is simply 'sieve' in stead of 'cmusieve'. After compilation, the Sieve engine can be verified before deployment using the included test suite. This is done by executing `make test` in the top of the source tree. The test suite is known to finish flawlessly on the i386 and amd64 platforms. The test suite is not very comprehensive yet, as it only tests the evaluation of scripts and omits testing the actual execution of actions. As this release contains about 30k effective lines of fresh code, bugs will eventually surface. Make sure that you provide enough information to reproduce the problem if you report bugs, i.e. the script and the mail message that caused the problem and/or relevant log entries. Have fun testing the new Sieve plugin. Don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl IRC: Freenode, #dovecot, S[r]us

1 0

Released v1.1.5 and v1.2.alpha3
by Timo Sirainen 22 Oct '08

22 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.5.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.5.tar.gz.sig http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha3.tar.gz http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha3.tar.gz.sig A combined release announcement for a change. :) Largest changes since v1.1.4: * Dovecot prints an informational message about authentication problems at startup. The message goes away after the first successful authentication. This hopefully reduces the number of "Why doesn't my authentication work?" questions. + Maildir/dbox: Try harder to assign unique UIDVALIDITY values to mailboxes to avoid potential problems when recreating or renaming mailboxes. The UIDVALIDITY is tracked using dovecot-uidvalidity* files in the mail root directory. + Many logging improvements - In some conditions Dovecot could have stopped using existing cache file and never used it again until it was deleted. - pop3 + Maildir: Make sure virtual sizes are always written to dovecot-uidlist. This way if the indexes are lost Dovecot will never do a huge amount of work to recalculate them. - mbox: Fixed listing mailboxes in namespaces with prefix beginning with '~' or '/' (i.e. UW-IMAP compatibility namespaces didn't work). - dict quota: Don't crash when recalculating quota (when quota warnings enabled). - Fixes to handling "out of disk space/quota" failures. - Blocking passdbs/userdbs (e.g. PAM, MySQL) could have failed lookups sometimes when auth_worker_max_request_count was non-zero. - Fixed compiling with OpenBSD Largest changes since v1.2.alpha2: + Added userdb checkpassword (by Sascha Wilde) + Autocreate plugin: http://wiki.dovecot.org/Plugins/Autocreate + Listescape plugin: http://wiki.dovecot.org/Plugins/Listescape - All the same fixes as for v1.1.5 I was thinking about waiting for Kolab people's work for shared mailbox support to get done, get that code to v1.2 tree and then release v1.2.beta1 with feature freeze.

1 0

v1.1.4 released
by Timo Sirainen 05 Oct '08

05 Oct '08

http://dovecot.org/releases/1.1/dovecot-1.1.4.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.4.tar.gz.sig - SORT: Yet another assert-crashfix when renumbering index sort IDs. - ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working. - Maildir++ quota: Fixes to rebuilding when quota limit wasn't specified in Dovecot (0 limit or limit read from maildirsize). - mbox: Several bugfixes causing errors and crashes. - Several fixes to expire plugin / expire-tool. - lock_method=dotlock could have deadlocked with itself. - Many error handling fixes and log message improvements.

1 0

v1.2.alpha1 released
by Timo Sirainen 05 Sep '08

05 Sep '08

http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha1.tar.gz http://dovecot.org/releases/1.2/alpha/dovecot-1.2.alpha1.tar.gz.sig This is the only v1.2.alpha announcement I'm going to send to dovecot-news list. Next announcement will be for either v1.2.beta1 or v1.2.rc1. I'm hoping that v1.2 stabilizes pretty soon. There are no huge changes like there were in 0.99->1.0 or 1.0->1.1, so most of the bugs are probably related to new features. I'm already running v1.2 myself and it's gone through heavy stress testing with my imaptest tool, so I'm expecting it to be stable enough for real world testing with not-all-that-important servers. It's safe to jump between v1.1 and v1.2 at any time or even have them concurrently accessing the same mailboxes. Dovecot v1.2 has a lot of new IMAP extensions implemented. The biggest change comes from CONDSTORE extension which adds a new concept of "modification sequences" (modseq for short). Each message has a modseq that increases whenever a flag is changed or when the message is expunged. The client can keep track of the highest seen modseq and request only changes done since the modseq. See QRESYNC (RFC 5162) for more information. Dovecot starts keeping track of the modseqs only when the first "CONDSTORE/QRESYNC enabling command" is executed. Before that no disk space is used for modseqs. When modseqs are enabled dovecot.index file uses 8 bytes per message more space. Other implemented IMAP extensions are: ESEARCH, SEARCHRES, WITHIN, ID and CONTEXT=SEARCH. Added thread indexes to optimize IMAP THREAD command. Only the first half of threading is currently optimized, the rest will hopefully follow later. Added a non-standard X-REFERENCES2 threading algorithm where threads are sorted by their latest message instead of the thread root message. There is also no base subject merging. This may be renamed and become part of SEARCH=INTHREAD extension some day. SEARCH=INTHREAD is still a draft, but the INTHREAD search key is already implemented by Dovecot v1.2. This is mostly useful with virtual mailboxes. Virtual mailboxes: http://wiki.dovecot.org/Plugins/Virtual Then there are also some internal API changes which will make some things easier. For example lib-storage now allows handling multiple different users at the same time.

1 0

v1.1.3 released
by Timo Sirainen 02 Sep '08

02 Sep '08

http://dovecot.org/releases/1.1/dovecot-1.1.3.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.3.tar.gz.sig This fixes several mbox problems previous v1.1 releases have had. * mail_max_userip_connections limit no longer applies to master user logins. + login_log_format_elements: Added %k to show SSL protocol/cipher information. Not included by default. + imap/pop3-proxy: If auth_verbose=yes, log proxy login failures. + deliver: Added -s parameter to autosubscribe to autocreated mailboxes. - message parser fixes - hopefully fixes an infinite looping problem - SORT: One more assert-crashfix when renumbering index sort IDs. - mbox: Saving may have truncated the mail being saved - mbox: Several other bugfixes - mail_full_filesystem_access=yes was broken when listing mailboxes (it still is with maildir++ layout). - maildirlock utility was somewhat broken - zlib plugin: bzip2 support was somewhat broken - NFS: Make sure writing to files via output streams don't assert-crash when write() returns only partial success.

1 0