August 2015 - dovecot

bug in acl_defaults_from_inbox option
by Marco Giunta 08 Sep '15

08 Sep '15

Hi at all, there is a bug in in acl_defaults_from_inbox option: if you define it with ANY value ('yes', 'no', 'whatyouwant', 'xxx') it acts like the value is ALWAYS 'yes', and Dovecot enable it; the only way to disable it, is comment it or delete from configuration file. With 'acl_defaults_from_inbox = no', or 'acl_defaults_from_inbox = whatyouwant', all my folders get ACLs from INBOX; in my case I want to only share INBOX, but also all other folders were shared. When you comment 'acl_defaults_from_inbox', Dovecot works like expected. Marco # 2.2.15: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: Linux 2.6.18-400.1.1.el5 x86_64 Red Hat Enterprise Linux Server auth_master_user_separator = * auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = XXXXXXXXXXXXXXXXXXXXXXXX doveadm_port = 12345 first_valid_uid = 200 hostname = xxxxxxx.sissa.it imap_client_workarounds = delay-newmail lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = * login_log_format_elements = user=<%u> PID=%p method=%m rip=%r lip=%l %c login_trusted_networks = XXX.XXX.1.172/30 XXX.XXX.24.0/23 mail_gid = mail mail_home = /var/spool/mail/%1n/%n mail_location = maildir:/var/spool/mail/%1n/%n:INDEX=/var/shared/indexes/%1n/%n mail_plugins = acl fts fts_solr mailbox_alias quota mail_shared_explicit_inbox = yes mail_uid = vmail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate imapflags notify mbox_write_locks = fcntl mmap_disable = yes namespace archives { hidden = no inbox = no list = children location = maildir:/var/spool/archives/%1n/%n:INDEX=/var/shared/indexes/%1n/%n/archives mailbox 2015 { auto = subscribe special_use = \Archive } prefix = Archives. separator = . subscriptions = no type = private } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox INBOX_spam { auto = subscribe special_use = \Junk } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } namespace others { list = children location = maildir:/var/spool/mail/%%1n/%%n:INDEXPVT=/var/shared/indexes/%1n/%n/shared/%%n prefix = Other Users.%%n. separator = . subscriptions = no type = shared } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_defaults_from_inbox = no acl_shared_dict = file:/var/shared/dovecot/shared-mailboxes.dict fts = solr fts_autoindex = yes fts_autoindex_max_recent_msgs = 20 fts_solr = url=http://solr.localdomain:8080/solr/ mailbox_alias_new = INBOX_spam mailbox_alias_old = Junk quota = maildir:User quota:ns= quota2 = maildir:Archive quota:ns=Archives. quota2_rule = *:storage=20GB quota2_warning = storage=95%% quota2-warning 95 %u quota2_warning2 = storage=90%% quota2-warning 90 %u quota2_warning3 = storage=80%% quota2-warning 80 %u quota_rule = *:storage=5GB quota_rule2 = Trash:storage=+20%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Quota exceeded (mailbox for user is full) quota_status_success = DUNNO quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/sieve/.dovecot.sieve sieve_default = /etc/dovecot/sieve/dovecot.sieve sieve_extensions = +notify +imapflags sieve_max_redirects = 16 } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = postmaster(a)sissa.it protocols = imap pop3 lmtp sieve rejection_reason = Your message to <%t> was automatically rejected for the following reason: %n%n%r service auth { inet_listener { port = 49494 } unix_listener auth-userdb { user = vmail } } service dict { unix_listener dict { user = vmail } } service doveadm { inet_listener { port = 26001 } } service imap-login { process_min_avail = 16 service_count = 0 } service imap { process_limit = 2048 } service lmtp { inet_listener lmtp { port = 24 } process_min_avail = 5 } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 16 service_count = 0 vsz_limit = 256 M } service quota-status { client_limit = 1 executable = /usr/libexec/dovecot/quota-status -p postfix inet_listener { port = 25001 } } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service quota2-warning { executable = script /usr/local/bin/dovecot-quota2-warning.sh unix_listener quota2-warning { user = vmail } user = vmail } ssl_cert = </etc/pki/dovecot/certs/xxxxx-crt.pem ssl_key = </etc/pki/dovecot/private/Xxxxx-key.pem ssl_protocols = !SSLv2 !SSLv3 submission_host = xxxxxx.sissa.it:25 syslog_facility = local2 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl fts fts_solr mailbox_alias quota sieve postmaster_address = xxxxxxx(a)sissa.it } protocol lda { info_log_path = log_path = mail_plugins = acl fts fts_solr mailbox_alias quota sieve syslog_facility = local2 } protocol imap { mail_max_userip_connections = 50 mail_plugins = acl fts fts_solr mailbox_alias quota imap_quota imap_acl } protocol sieve { mail_max_userip_connections = 50 } protocol pop3 { mail_max_userip_connections = 50 } -- ----------------------------------- |Marco Giunta - SISSA Computer Staff| |Via Bonomea, 265 | |34136 - Trieste, Italy | |Tel: +39-40-3787-503 | |Fax: +39-040-3787-244 | |e-mail: giunta(a)sissa.it | -----------------------------------

2 2

[Patch] Fix hang in safe_sendfile on SmartOS
by Sebastian Wiedenroth 08 Sep '15

08 Sep '15

# HG changeset patch # User Sebastian Wiedenroth <sebastian.wiedenroth(a)skylime.net> # Date 1437050484 -7200 # Thu Jul 16 14:41:24 2015 +0200 # Node ID 7ef3a533b097e8e6590e754dc56ad308ab29233b # Parent e3640ccaa76d77a9658126d1f8f306480dad8af7 Fix hang in safe_sendfile on SmartOS The call to sendfile on SmartOS can fail with EOPNOTSUPP. This is a valid error code and documented in the man page. This error code needs to be handled or else dovecot will retry the sendfile call endlessly and hang. diff -r e3640ccaa76d -r 7ef3a533b097 src/lib/sendfile-util.c --- a/src/lib/sendfile-util.c Sat Jan 10 04:32:42 2015 +0200 +++ b/src/lib/sendfile-util.c Thu Jul 16 14:41:24 2015 +0200 @@ -116,7 +116,7 @@ if (errno == EINVAL) { /* most likely trying to read past EOF */ ret = 0; - } else if (errno == EAFNOSUPPORT) { + } else if (errno == EAFNOSUPPORT || errno == EOPNOTSUPP) { /* not supported, return Linux-like EINVAL so caller sees only consistent errnos. */ errno = EINVAL;

2 4

Patch for "doveadm -f table" nit (was Re: Dovecot current number of connections being used.)
by Joseph Tam 08 Sep '15

08 Sep '15

> doveadm who -1 2>/dev/null | wc -l You have to redirect stderr to /dev/null because that's where the first header line is written to. The default format style (table) is inconsistent with the other formats (flow,pager,tab) that write headers and data to stdout. The following patch will pick this nit. This patch will require modifications to scripts that rely on doveadm writing headers to stderr. For example, the above doveadm command could be modified to doveadm who -1 | grep -vc '^username' -------------------------------------------------------------------------------- --- a/dovecot-2.2.16.rc1/src/doveadm/doveadm-print-table.c Wed Mar 18 15:40:40 2015 +++ b/dovecot-2.2.16.rc1/src/doveadm/doveadm-print-table.c Wed Mar 18 15:41:18 2015 @@ -151,3 +151,3 @@ for (i = 0; i < count; i++) { - if (i > 0) fprintf(stderr, " "); + if (i > 0) printf(" "); @@ -155,3 +155,3 @@ DOVEADM_PRINT_HEADER_FLAG_RIGHT_JUSTIFY) == 0) { - fprintf(stderr, "%-*s", (int)headers[i].length, + printf("%-*s", (int)headers[i].length, headers[i].title); @@ -158,3 +158,3 @@ } else { - fprintf(stderr, "%*s", (int)headers[i].length, + printf("%*s", (int)headers[i].length, headers[i].title); @@ -162,3 +162,3 @@ } - fprintf(stderr, "\n"); + printf("\n"); } -------------------------------------------------------------------------------- Joseph Tam <jtam.home(a)gmail.com>

5 9

Re: Null deference pointer in dovecot-2.2.18
by 吴迪 08 Sep '15

08 Sep '15

Dear, use our static analysis tools, I find some bugs (Null deference pointer) for dovecot-2.2.18. Null deference pointer bugs often make program crashes, Please confim them, Thanks! 1. dovecot-2.2.18/src/config/config-request.c 332 'setting_export_section_name(ctx->prefix, def, children[i], i);', pointer 'children' in line 202 assigned NULL and if branch 'case SET_DEFLIST_UNIQUE' not execute, so pointer 'children' is always NULL. It load to a bug of null deference pointer In line 332. The same bugs also appeared in : 1. dovecot-2.2.18/src/lib-index/mail-index-fsck.c line 170 or 174, pointer 'kw_rec ' mybe NULL. 2.dovecot-2.2.18/src/lib-storage/mail-search-args-simplify line 349, pointer 'prev_arg' mybe NULL. best wishes~ Amy

3 2

RFC 5465 (NOTIFY) violation: missing HIGHESTMODSEQ in initial STATUS responses
by Guilhem Moulin 08 Sep '15

08 Sep '15

Quoting RFC 5465 (NOTIFY): “If the NOTIFY command enables MessageNew, MessageExpunge, AnnotationChange, or FlagChange notifications for a mailbox other than the currently selected mailbox, and the client has specified the STATUS indicator parameter, then the server MUST send a STATUS response for that mailbox before NOTIFY's tagged OK. […] If either AnnotationChange or FlagChange are included and the server also supports the CONDSTORE [RFC4551] and/or QRESYNC [RFC5162] extensions, the STATUS response MUST contain UIDVALIDITY and HIGHESTMODSEQ.” — https://tools.ietf.org/html/rfc5465#section-3.1 While unsolicited STATUS responses include HIGHESTMODSEQ indeed, the initial STATUS responses (caused by the presence of the STATUS indicator) do not: ~$ /usr/lib/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 … CONDSTORE QRESYNC … NOTIFY SPECIAL-USE] Logged in as guilhem a ENABLE QRESYNC * ENABLED QRESYNC a OK Enabled (0.000 secs). b NOTIFY SET STATUS (SUBSCRIBED (MessageNew MessageExpunge FlagChange)) * STATUS INBOX (MESSAGES 9069 UIDNEXT 109398 UIDVALIDITY 1312585007 UNSEEN 0) […] b OK NOTIFY completed (0.008 secs). [time passes… a new message is delivered to INBOX] * STATUS INBOX (MESSAGES 9070 UIDNEXT 109399 UNSEEN 1 HIGHESTMODSEQ 22216) This defeats the purpose of the STATUS indicator for disconnected clients since they have to issue separate STATUS commands (or a LIST command if LIST-{EXTENDED,STATUS} have been advertized) to find out which mailboxes have got a new HIGHESTMODSEQ. Cheers, -- Guilhem.

2 1

NOTIFY regression: 2.18 no longer notifies of events in INBOX
by Guilhem Moulin 08 Sep '15

08 Sep '15

Here is an example with APPEND $ /usr/lib/dovecot/imap S1: * PREAUTH [CAPABILITY IMAP4rev1 … MOVE NOTIFY SPECIAL-USE] Logged in as guilhem C1: a1 NOTIFY SET (INBOXES (MessageNew MessageExpunge FlagChange)) S1: a1 OK NOTIFY completed (0.000 secs) $ /usr/lib/dovecot/imap S2: * PREAUTH [CAPABILITY IMAP4rev1 … MOVE NOTIFY SPECIAL-USE] Logged in as guilhem C2: a2 APPEND INBOX {1+} C2: x S2: a2 OK [APPENDUID 1384472528 26085] Append completed (0.229 secs). With 2.13 from Debian Jessie, S1 sends a notification for the new message in INBOX, as expected: S1: * STATUS INBOX (MESSAGES 4333 UIDNEXT 26086 UNSEEN 1) However it doesn't with 2.18 from Debian Sid, as if ‘INBOX’ was excluded from the mailbox filter ‘INBOXES’. It does send a notification for ‘virtual/unseen’ instead (as expected), but nothing for ‘INBOX’. S1: * STATUS virtual/unseen (MESSAGES 3 UIDNEXT 15186 UNSEEN 3) This is INBOX-specific because APPENDING the message to another mailbox triggers the notification on both 2.13 and 2.18 as expected: S1: * STATUS test (MESSAGES 2 UIDNEXT 3 UNSEEN 2) S1: * STATUS virtual/unseen (MESSAGES 2 UIDNEXT 15195 UNSEEN 2) I attach the ‘dovecot -n’ output for both 2.13 and 2.18. -- Guilhem.

2 1

"NOTIFY SET (mailboxes INBOX (...))" crashes the IMAP client
by Guilhem Moulin 07 Sep '15

07 Sep '15

Hi list, The NOTIFY extension (RFC 5465) works fine for mailboxes in the "virtual/" namespace, but it crashes the IMAP client when used with a mailbox in the empty "" namespace: ~$ /usr/lib/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 … NOTIFY SPECIAL-USE] Logged in as guilhem a NAMESPACE * NAMESPACE (("" "/")("virtual/" "/")) NIL NIL a OK Namespace completed. b NOTIFY SET (mailboxes virtual/all (MessageNew MessageExpunge)) b OK NOTIFY completed (0.001 secs). c NOTIFY SET (mailboxes INBOX (MessageNew MessageExpunge)) imap(guilhem): Panic: file mail-namespace.c: line 679 (mail_namespace_find): assertion failed: (ns != NULL) imap(guilhem): Error: Raw backtrace: … Aborted The "subtree" mailbox filter has the same problem, but the non-parameterized ones ("inboxes", "personal" and "subscribed") work fine. You'll find the output of ‘dovecot -n’ enclosed. Cheers, -- Guilhem.

2 3

question on autch cache parameters
by matthias lay 07 Sep '15

07 Sep '15

Hi list, I have a question on auth caching in 2.2.18. I am using acl_groups for a master user, appended in a static userdb file # snip ############################### master@uma:{SHA}XXXX=::::::userdb_acl_groups=umareadmaster allow_nets=127.0.0.1 # snap ############################### and use this group in a global ACL file. I discovered this only works on first NOT-cached login environment in imap-postlogin script on first login: AUTH_TOKEN=e96b5a32ceb2cafc4460c210ad2e92e3d7ab388c MASTER_USER=master@uma SPUSER=private/pdf LOCAL_IP=127.0.0.1 USER=pdf AUTH_USER=master@uma PWD=/var/run/dovecot USERDB_KEYS=ACL_GROUPS HOME SPUSER MASTER_USER AUTH_TOKEN AUTH_USER SHLVL=1 HOME=/var/data/vmail/private/pdf ACL_GROUPS=umareadmaster IP=127.0.0.1 _=/usr/bin/env on the second cached login it looks like this AUTH_TOKEN=12703b11932f233520f6d4b33559c33aeb1cfc7f MASTER_USER=master@uma SPUSER=private/pdf LOCAL_IP=127.0.0.1 USER=pdf AUTH_USER=master@uma PWD=/var/run/dovecot USERDB_KEYS=HOME SPUSER MASTER_USER AUTH_TOKEN AUTH_USER SHLVL=1 HOME=/var/data/vmail/private/pdf IP=127.0.0.1 _=/usr/bin/env so the ACL_GROUPS is gone. is this intended to be like that. so groups not included in cache and I have to find another approach? anybody else encountered similar problems with some auth Variables and caching? Greetz Matze

4 6

Mailbox can't be created
by Paulo Matos 06 Sep '15

06 Sep '15

Hi, I have setup postfix master.cf to use dovecot-lda to deliver (using -m) all messages to PreInbox: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -a ${recipient} -d ${user}@${nexthop} -m PreINBOX And enabled lda_mailbox_autocreate. The message I have now it: Aug 27 10:02:29 lda(): Info: msgid=<dae42d0cf57bf4496a3dd53e162f8281(a)localhost.localdomain>: save failed to open mailbox PreINBOX: Mailbox can't be created Aug 27 10:02:29 lda(): Info: msgid=<dae42d0cf57bf4496a3dd53e162f8281(a)localhost.localdomain>: saved mail to INBOX Why wouldn't dovecot itself be able to create mailboxes? I am using virtual domains and users on a mysql database through postfix and mailboxes saved in MailDir format. Configuration of dovecot is: # 2.2.18: /etc/dovecot/dovecot.conf # OS: Linux 4.1.5-x86_64-linode61 x86_64 Fedora release 22 (Twenty Two) ext4 auth_debug = yes auth_mechanisms = plain login digest-md5 cram-md5 auth_verbose = yes auth_verbose_passwords = yes default_internal_user = root imap_client_workarounds = delay-newmail tb-extra-mailbox-sep lda_mailbox_autocreate = yes mail_debug = yes mail_location = maildir:/home/vmail/%d/%n/Maildir maildir_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } postmaster_address = pmatos protocols = imap quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = $default_internal_user } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes driver = static } protocol lda { auth_socket_path = /var/run/dovecot/auth-master deliver_log_format = msgid=%m: %$ log_path = /home/vmail/dovecot-deliver.log } protocol imap { mail_max_userip_connections = 100 } Regards, -- Paulo Matos

4 14

internal server error
by Sergey Schwartz 03 Sep '15

03 Sep '15

Hi! Today I've got a client unable to open a mailbox with Thunderbird - constantly drops connection. On the server side I can see an error message in the log Jul 22 11:07:29 mx10 dovecot: imap(oleg.vasilyev(a)bgoperator.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x7c96f) [0x7fd52575b96f] -> /usr/lib/dovecot/libdovecot.so.0(+0x7c9ce) [0x7fd52575b9ce] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fd525709875] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x74) [0x7fd525aa72d4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x561) [0x7fd525a91cf1] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x2b1) [0x7fd525a79241] -> /usr/lib/dovecot/libdovecot.so.0(+0x66e47) [0x7fd525745e47] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x68) [0x7fd5257657a8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fd52576614d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x62) [0x7fd52574af02] -> /usr/lib/dovecot/libdovecot.so.0(+0x667ff) [0x7fd5257457ff] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x68) [0x7fd5257657a8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fd52576614d] -> /usr/lib/dovecot/libdovecot.so.0(message_get_header_size+0x53) [0x7fd52574e4b3] -> /usr/lib/dovecot/libdovecot-storage.so.0(imap_msgpart_open+0x257) [0x7fd525ab4527] -> dovecot/imap(+0x1da42) [0x7fd525f3ca42] -> dovecot/imap(+0x1be3f) [0x7fd525f3ae3f] -> dovecot/imap(imap_fetch_more+0x37) [0x7fd525f3be97] -> dovecot/imap(cmd_fetch+0x316) [0x7fd525f2f946] -> dovecot/imap(command_exec+0x4c) [0x7fd525f398cc] -> dovecot/imap(+0x19830) [0x7fd525f38830] -> dovecot/imap(+0x198c4) [0x7fd525f388c4] -> dovecot/imap(client_handle_input+0x115) [0x7fd525f38bc5] -> dovecot/imap(client_input+0x75) [0x7fd525f38fa5] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x5b) [0x7fd52576e54b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xbb) [0x7fd52576f5cb] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7fd52576e5d9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fd52576e658] Jul 22 11:07:29 mx10 dovecot: imap(oleg.vasilyev(a)bgoperator.com): Fatal: master: service(imap): child 17109 killed with signal 6 (core dumped) Should I report a bug or there is a workaround for this issue? -- Best regards, Sergey Schwartz Senior System Administrator Biblio Globus Tour Operator www.bgoperator.ru T: +7 495 5042500 ext 1532 E: sergey.schwartz(a)bgoperator.com

4 6