- Dovecot-news - dovecot.org

v1.0.14 released
by Timo Sirainen 02 Jun '08

02 Jun '08

http://dovecot.org/releases/1.0/dovecot-1.0.14.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.14.tar.gz.sig Since v1.1.0 release is getting near, this could well be the last v1.0 release. I'll still fix important bugs, but if the bugfix is large or affects only few people it'll probably get fixed only in v1.1 releases. * mbox: Enable mail_privileged_group while creating INBOX. - IMAP: Fixed a rare crash in FETCH BODY/BODYSTRUCTURE - IMAP: If mailbox is selected with EXAMINE, ignore flag changes - proxy: Login success reply was sent in two IP packets, which confused some IMAP/POP3 clients - ACL plugin leaked memory a bit - dovecot-auth: allow_nets setting with network masks didn't work correctly with big endian machines.

1 0

v1.1.rc7 released
by Timo Sirainen 30 May '08

30 May '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc7.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc7.tar.gz.sig One extra RC release, just to fix compiling problems with non-Linux OSes. Nothing else changed since rc6.

1 0

Re: [Dovecot-news] [Dovecot] v1.1.rc6 released - not working
by Timo Sirainen 30 May '08

30 May '08

On May 30, 2008, at 5:15 AM, Marc Perkel wrote: > I had just tested rc5 today and it didn't work for me. So I just > downloaded rc6 and same problem. Here's what I'm seeing in the log. > > dovecot: May 29 19:10:10 Error: IMAP(support(a)junkemailfilter.com): > mail_location: maildir: Unknown setting: > dovecot: May 29 19:10:10 Fatal: IMAP(support(a)junkemailfilter.com): > Namespace initialization failed > dovecot: May 29 19:10:10 Error: IMAP(marc(a)perkel.com): > mail_location: maildir: Unknown setting: > dovecot: May 29 19:10:10 Fatal: IMAP(marc(a)perkel.com): Namespace > initialization failed > dovecot: May 29 19:10:10 Info: imap-login: Login: user=<marc(a)perkel.com > >, method=PLAIN, rip=24.143.247.50, lip=65.49.42.45, TLS > dovecot: May 29 19:10:10 Error: IMAP(support(a)junkemailfilter.com): > mail_location: maildir: Unknown setting: > dovecot: May 29 19:10:10 Fatal: IMAP(support(a)junkemailfilter.com): > Namespace initialization failed > > mail_location = maildir:/vhome/%d/home/%n::INDEX=/nobackup/imap- > cache/%d-%n You've :: in the middle, which is most likely causing it. I can't think of anything I've done since rc5 that would have touched that part of the code though.

1 0

v1.1.rc6 released
by Timo Sirainen 30 May '08

30 May '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc6.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc6.tar.gz.sig This is it. The first v1.1 release that actually deserves the "release candidate" name. It contains everything I require from v1.1.0 release. There are two bugs left that I'd like to get fixed, but they won't block v1.1.0 release: * index_mailbox_set_recent_uid() assert (reported by Diego Liziero) * Maildir not always finding new messages and returning them as empty (reported by Anders). The major change in v1.1.rc6 release is the SORT indexing half-rewrite. I hadn't much stress tested that code before, and once I started I just kept finding more and more weird bugs and it became extremely difficult to figure out how to fix them, so I finally decided to just redesign how it's supposed to work and then implemented that. The resulting sort code is a lot cleaner and it should also perform better (although it could still be improved a bit: the basic binary searching could be replaced with one that first binary searches between already-looked-up sort-strings and only after that binary searches the resulting space which requires slower sort-string lookups). Hopefully there are also no stupid bugs left like returning messages in wrong sort order. :) I've been wasting time this past week getting new stuff for my new apartment, but that's nearly done now. I think (hope) I'm going to be more productive in here, there are less neighbours behind walls/floors (just 1), so less potential for annoying noises. :) Thinking also seems to work better when there's more space to walk around. And finally, the changes since v1.1.rc5: * Index file format changed a bit. If an older Dovecot v1.1 reads index files updated by rc6+, they may give "Invalid header record size" or "ext reset: invalid record size" warnings. v1.0 won't give these errors. * IMAP: LIST .. RETURN (X-STATUS) command return now LIST entries before STATUS entries. * zlib plugin: Uncompress if the message begins with zlib header instead of looking at the 'Z' flag. This fixes copying with hard links. Based on a patch by Richard Platel. + IMAP: SORT index handling code was half-rewritten to fix several bugs when multiple sessions were sorting at the same time. The new code is hopefully also faster. + Maildir: If POP3 UIDL extra field is found from dovecot-uidlist, it's used instead of the default UIDL format (or X-UIDL: header). This allows easily preserving UIDLs when migrating from other POP3 servers. Patch by Nicholas Von Hollen @ Mailtrust. + Maildir: ,W=<vsize> is now always added to maildir filenames + deliver: Avoid reading dovecot-uidlist's contents if possible. + Added %T modifier = Trim whitespace from end of string - IMAP: Fixed some bugs in LIST-EXTENDED implementation. - IMAP: If client tries to change the selected mailbox state while another command is still running, wait until the command is finished. This fixes some crashes and other unwanted behavior. - allow_nets userdb setting was broken with big endian CPUs

1 0

Sieve plugins 1.0.3 and 1.1.5 released
by Timo Sirainen 16 May '08

16 May '08

http://dovecot.org/releases/sieve/dovecot-sieve-1.0.3.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.3.tar.gz.sig http://dovecot.org/releases/sieve/dovecot-sieve-1.1.5.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.5.tar.gz.sig I've usually released new Sieve plugins at the same time as new Dovecot versions, but since I wasn't planning on releasing v1.0.14 anytime soon and it looks like v1.0.2 release was quite a while ago, I decided to release these today. Changes: - Improved vacation reply checks, log discarded vacation replies (in v1.0.3, these were already in v1.1.0) - Expand ~ to home directory in sieve path - If compiled script has the exact same mtime as the source script, assume the script hasn't changed (changed "<" check to "<="). - Unfold multiline headers before comparing them. - Improved error logging.

1 0

v1.1.rc5 released
by Timo Sirainen 05 May '08

05 May '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc5.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc5.tar.gz.sig I've finally gone through all my unread mails and fixed most of the reported bugs. There are only a couple ones left that I can't reproduce. Please report if you still have any problems with rc5, even if you already have reported the same bug before. v1.1.rc6 will hopefully be the last RC before v1.1.0. + Support cross-realm Kerberos 5 authentication. Based on patch by Zachary Kotlarek. + Added dict_db_config setting to point to a Berkeley DB config file. + If mail_chroot ends with "/.", remove chroot prefix from home directory. - Fixed several bugs and memory leaks in ACL plugin. LIST and LSUB may have listed mailboxes where user had no 'l' access. STORE could have been used to update any flags without appropriate access. - mbox: Valid-looking From_-lines in message bodies caused the message to be split to two messages (broken since v1.0). - Plugin initialization hooks were called in wrong order, possibly causing problems when multiple plugins were used at the same time. - Expire plugin was broken - LIST-EXTENDED options were ignored. - LDAP: Static attribute names weren't working correctly - deliver: mail_uid and mail_gid settings weren't used. - pop3 + maildir++ quota: maildirsize file wasn't created if it didn't exist already. - dnotify: Waiting for dotlock to be deleted used 100% CPU

1 0

v1.1.rc4 released
by Timo Sirainen 01 Apr '08

01 Apr '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc4.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc4.tar.gz.sig I didn't have time/energy to fix everything I wanted, so it'll probably be a few more RCs left until v1.1.0. This is anyway an important release, because it fixes two buffer overflows in search code which have been in all v1.1 releases (but not v1.0). Really stupid mistakes, I must have been tired or something when writing the code.. Anyway I now added code to notice these kind of buffer overflows when they happen (if --enable-debug is used), so hopefully these will be the last ones. * Fixed two buffer overflows in str_find_init(). It was used by SEARCH code when searching for headers or message body. Added code to catch these kind of overflows when compiling with --enable-debug. Found by Diego Liziero. + LDAP: Added debug_level and ldaprc_path settings (OpenLDAP-only) + Squat: Added fts_squat = partial=n full=m settings. See the wiki. - dbox metadata updating fixes. - quota: backend=n didn't work - SEARCH RECENT may have returned non-recent messages if index files were created by v1.0. - If mailbox was opened as read-only with EXAMINE, STOREs were permanently saved. - LDAP: Templates were somewhat broken (by richs at whidbey.net)

1 0

v1.0.13 and v1.1.rc3 released
by Timo Sirainen 09 Mar '08

09 Mar '08

http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz.sig http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gz.sig Note that the changes for the security hole fix were quite large. I tested with several auth configurations myself and they seemed to work, but it's possible I left a bug somewhere in there breaking someone's configuration. So make sure to test that it works after upgrading. Of course it would be really nice if Dovecot had a proper test suite where testing all configurations could be automated and run before each release. I've already started this with my imaptest tool (http://imapwiki.org/ImapTest) but it only does IMAP tests and a lot of things are still missing. Some help would be nice here. * Fixed a security hole in blocking passdbs (MySQL always. PAM, passwd and shadow if blocking=yes) where user could specify extra fields in the password. The main problem here is when specifying "skip_password_check" introduced in v1.0.11 for fixing master user logins, allowing the user to log in as anyone without a valid password. - mail_privileged_group was broken in some systems (OS X, Solaris?) - IMAP THREAD: Fixed some correctness problems

1 0

Security hole #6: Some passdbs allowed users to log in without a valid password
by Timo Sirainen 09 Mar '08

09 Mar '08

This affects only blocking passdbs: - MySQL - PAM, passwd and shadow if blocking=yes The underlying bug exists in all v1.0.x versions, but I couldn't figure out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2. Probably a good idea to upgrade in any case. The main problem is that Dovecot's internal protocols use TAB character as a delimiter, but passwords were sent unescaped through them. So passwords containing TAB characters allowed to add new internal fields. The main problem here is a new "skip_password_check" field added in v1.0.11 to fix problems with master user logins. Specifying this field allowed the user to skip the password check, as the name implies. This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure there are no more escaping problems with any fields, but it can be also fixed with a less intrusive patch for v1.0: http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e

1 0

v1.1.rc2 released
by Timo Sirainen 08 Mar '08

08 Mar '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz.sig Changes since rc1: * mail_extra_groups setting was commonly used insecurely. This setting is now deprecated. Most users should switch to using mail_privileged_group setting, but if you really need the old functionality use mail_access_groups instead. + Expire plugin now supports wildcards in mailbox names. + dbox: Expire plugin supports moving old mails to alternative dbox directory + Maildir++ quota: quota_rule=?:<rule> specifies a default rule which is used only if the maildirsize file doesn't exist. + If SSL/TLS connection isn't closed cleanly, log the last error in the disconnection line. + EXPUNGE: If new \Deleted messages were found while expunging, do it again and expunge them as well (Outlook workaround) - IMAP: SEARCH, LIST and THREAD command correctness fixes - Maildir++ quota: Quota rules and warnings with % rules didn't work if the default limits were taken from maildirsize file. - Maildir++ quota: If both byte and message limits weren't specified, maildirsize file was recalculated all the time - mbox: Flag and keyword updates may have gotten lost in some situations (happens with v1.0 too) - ldap: Don't crash if userdb lookup fails - Squat fixes and performance improvements Things left to do for v1.1.0: - dbox has a metadata corruption bug, find and fix it - Squat has some locking issues that causes errors when stress testing with multiple connections - Squat doesn't do NFS cache flushing and has some other NFS problems.

1 0