- dovecot - dovecot.org

mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings)
by Klaus Tachtler 26 Dec '25

26 Dec '25

Hello everyone, Problem info: An error occurs, while trying to establish a TLS/SSL secured connection to a database (mariadb), which has the ability to accept TLS/SSL connections. Analysis from Archlinux Gitlab Issue, which could be found under following link by - Toolybird: https://gitlab.archlinux.org/archlinux/packaging/packages/dovecot/-/issues/… > Thanks for reporting. It would appear to be some kind of (upstream?) > bug in the autofoo. The error message can be traced back to > HAVE_MYSQL_SSL being undefined when it should be defined. This is > reflected in log: https://reproducible.archlinux.org/api/v0/builds/946041/log > It took quite some debugging, but adding the following hack before the > autoreconf call appears to make it work: > checking for mysql_ssl_set in -llibmariadb... no > sed -i 's/mysql_driver="libmariadb"/mysql_driver="mariadb"/' m4/ > want_mysql.m4 > After that it now shows: > checking for mysql_ssl_set in -lmariadb... yes Steps to reproduce: 1. Configure dovecot 2.4.2-4 as described below 2. Restart dovecot 2.4.2-4 3. Try send an email (echo "Test-E-Mail" | /usr/sbin/sendmail root) 4. Determine error messages inside dovecot 2.4.2-4-Log 01 Dec 22 04:57:38 server dovecot[842]: auth: Error: mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) 02 Dec 22 04:57:38 server dovecot[842]: auth-worker: Error: mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) Additional info: OS version: Archlinux package version(s): dovecot 2.4.2-4 necessary config file part: 45 sql_driver = mysql 46 47 mysql db.idmz.tachtler.net { 48 host = db.idmz.tachtler.net 49 port = 3306 50 user = postfixuser 51 password = geheim 52 dbname = postfix 53 ssl = yes 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem 55 ssl_client_cert_file = /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem 56 ssl_client_key_file = /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem 57 ssl_cipher_list = DHE-RSA-AES256-SHA 58 } WITHOUT the following line, a database connections is possible and works as expected: 53 ssl = yes 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem 55 ssl_client_cert_file = /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem 56 ssl_client_key_file = /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem 57 ssl_cipher_list = DHE-RSA-AES256-SHA Thanky you in advance for your help! Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

1 0

Rootless docker image missing /usr/bin/sleep causing health check to not work
by saturos+dove＠gmail.com 23 Dec '25

23 Dec '25

Hello! I was attempting to set up health checking as in the Health Checking document [1]. But it seems that the rootless image is missing the sleep command, which prints the error: dovecot[16633]: Dec 22 22:05:04 health-check: Error: /dovecot/libexec/dovecot/health-check.sh: 31: sed: not found Reproduction: $ podman run --rm -it index.docker.io/dovecot/dovecot:latest-dev which sleep /usr/bin/sleep $ podman run --rm -it index.docker.io/dovecot/dovecot:latest-root which sleep /usr/bin/sleep $ podman run --rm -it index.docker.io/dovecot/dovecot:latest which sleep $ Set up healthchecking on 5001. With latest: $ echo -e "PING\n" | nc -v localhost 5001 Connection to localhost (::1) 5001 port [tcp/*] succeeded! $ With latest-dev: $ echo -e "PING\n" | nc -v localhost 5001 Connection to localhost (::1) 5001 port [tcp/*] succeeded! PONG and the error log above is generated. Version: $ podman run --rm -it index.docker.io/dovecot/dovecot:latest dovecot --version 2.4.2 (0962ed2104) [1] https://doc.dovecot.org/2.4.2/core/config/health_check.html

2 1

quota_mail_size question
by Marcel Menzel 22 Dec '25

22 Dec '25

Hello List, I've enabled the quota_mail_size parameter to match what I've set in Postfix, but it seems to me that this parameter has no effect. Currently set to quota_mail_size = 104857600B (with or without the suffix does not matter in my case as both won't work), but connecting to the LMTP socket does not seem to advertise SIZE: # socat /run/dovecot/lmtp readline 220 mail-fra01 Hello there LHLO test 250-mail-fra01 250-8BITMIME 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-SMTPUTF8 250 STARTTLS quit 221 2.0.0 Bye Also looking at IMAP logs on clients, APPENDLIMIT also does not seem to get advertised there. Quota itself seems to work fine via userdb, also via the IMAP quota extension as my clients report the usage. Thanks, Marcel doveconf -n: # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2 (767418c3) # OS: Linux 6.17.11-hardened1-1-hardened x86_64 # Hostname: mail-fra01 dovecot_config_version = 2.4.2 auth_verbose = yes dovecot_storage_version = 2.4.2 first_valid_uid = 8 fts_autoindex = yes hostname = mail-fra01 imap4rev2_enable = yes last_valid_uid = 8 lmtp_rcpt_check_quota = yes login_greeting = Hello there mail_driver = maildir mail_gid = mail mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/ mail_plugins { quota = yes quota_clone = yes notify = yes virtual = yes fts = yes fts_xapian = yes } mail_server_admin = mailto:marcel@menzel.de mail_server_comment = hi mail_uid = mail mail_utf8_extensions = yes mailbox_list_storage_escape_char = \ mailbox_list_utf8 = yes passdb_default_password_scheme = SHA256-CRYPT protocols { imap = yes pop3 = yes sieve = yes lmtp = yes } quota_mail_size = 104857600B quota_status_nouser = DUNNO sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.environment = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_redirect_envelope_from = recipient sql_driver = pgsql ssl = required ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 ssl_curve_list = X448:X25519:P-256 ssl_options = no_ticket submission_host = 127.0.0.1:25 verbose_proctitle = yes protocol imap { imap_hibernate_timeout = 10 secs imap_idle_notify_interval = 29 mins imap_metadata = yes mail_max_userip_connections = 50 mail_plugins { imap_quota = yes imap_sieve = yes last_login = yes } } protocol pop3 { mail_plugins { last_login = yes } } protocol sieve { mail_plugins { last_login = yes } } protocol lmtp { mail_plugins { sieve = yes push_notification = yes } postmaster_address = postmaster@%{user | domain} } service lmtp { user = mail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service auth-worker { user = $SET:default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = dovecot mode = 0660 user = mail } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service indexer-worker { vsz_limit = 8 G } maildir { very_dirty_syncs = yes } mail_attribute { dict file { path = %{home}/dovecot-attributes } } fts xapian { } language en { default = yes } language de { } namespace inbox { inbox = yes separator = / mailbox Archive { auto = subscribe special_use = "\\Archive" } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { fts_autoindex = no auto = subscribe autoexpunge = 30 days special_use = "\\Junk" } mailbox Sent { special_use = "\\Sent" } mailbox Trash { fts_autoindex = no auto = subscribe autoexpunge = 120 days special_use = "\\Trash" quota_storage_extra = 100M } } pgsql mcl { parameters { dbname = mail host = 10.10.3.2 password = <redacted> port = 6432 sslmode = disable user = mail } } userdb sql { iterate_query = SELECT username AS user FROM mailbox; query = SELECT CONCAT(quota, 'B') AS quota_storage_size FROM mailbox WHERE username = '%{user | lower}' LIMIT 1; } passdb sql { query = SELECT username AS user, password, allow_nets FROM mailbox WHERE username = '%{user | lower}' AND active = true LIMIT 1; } ssl_server { cert_file = /etc/ssl/private/dovecot.crt.pem key_file = /etc/ssl/private/dovecot.pk.pem prefer_ciphers = server } ssl_client { ca_dir = /etc/ssl/certs } sieve_script default { name = default path = /var/vmail/global.sieve type = default } sieve_script personal { active_path = /var/vmail/%{user | domain}/%{user | username}/dovecot.sieve path = /var/vmail/%{user | domain}/%{user | username}/sieve type = personal } mailbox Spam { sieve_script spam { cause = copy append path = /usr/lib/dovecot/sieve-pipe/report-spam.sieve type = before } } imapsieve_from Spam { sieve_script ham { cause = copy append path = /usr/lib/dovecot/sieve-pipe/report-ham.sieve type = before } } quota "User quota" { } quota_clone { dict proxy { name = quota_clone_sql } } dict_server { dict quota_clone_sql { driver = sql sql_driver = pgsql dict_map priv/quota/messages { sql_table = quota2 username_field = username dict_map_value_field messages { } } dict_map priv/quota/storage { sql_table = quota2 username_field = username dict_map_value_field bytes { } } } }

2 1

2.4.2 post login core dump when trash plugin is enabled
by Aragon Gouveia 22 Dec '25

22 Dec '25

Hi, docker run --rm --name dovecot -e USER_PASSWORD=test123 -v dovecot_mail:/srv/vmail -v ~aragon/dovetest/local.conf:/etc/dovecot/conf.d/local.conf -p 110:31110 -p 143:31143 --ulimit core=-1 dovecot/dovecot:latest-dev Dec 16 00:49:57 master: Info: Dovecot v2.4.2 (0962ed2104) starting up for imap, pop3, lmtp, sieve Dec 16 00:50:08 pop3-login: Info: Logged in: user=<test>, method=PLAIN, rip=172.17.0.1, lip=172.17.0.2, mpid=16, secured, session=<m5/SGwdGHNKsEQAB> Dec 16 00:50:08 pop3(test)<16><m5/SGwdGHNKsEQAB>: Fatal: master: service(pop3): child 16 killed with signal 11 (core dumped) Contents of ~aragon/dovetest/local.conf: mail_plugins { quota = yes trash = yes } protocols = imap pop3 lmtp sieve login_trusted_networks = 172.16.0.0/15 # telnet localhost 110 Trying ::1... Connected to localhost. Escape character is '^]'. +OK [XCLIENT] Dovecot ready. user test +OK pass test123 +OK Logged in. Connection closed by foreign host. dovecot-sysreport uploaded to https://limewire.com/d/PLgit#mrIN2Wx73J Is this sufficient info? Regrettably no debug symbols in the Docker builds, unless I missed something. Thank you in advance. Regards, Aragon

2 2

Sieve regex behavior
by Luca Weiss 22 Dec '25

22 Dec '25

Hi, I'm having troubles lately with a Sieve script of mine: require "fileinto"; require "mailbox"; require "regex"; if header :regex "Subject" "\\[.*PATCH.*\\]" { fileinto :create "Inbox.Patches"; } This should move all patches with "[PATCH]" or "[RFC PATCH v3]" into this Inbox subfolder, I'm pretty sure this version worked flawlessly in the past but since a couple of weeks ago it's not working with some emails. Debugging this, with manually editing mail files, I came to this discovery. That one mail matches and it's getting moved to the correct folder: Subject: Re: [PATCH v2 3/6] arm64: dts: qcom: qcm6490-shift-otter: A Adding one more character leads to it not getting moved: Subject: Re: [PATCH v2 3/6] arm64: dts: qcom: qcm6490-shift-otter: Ad Does anybody have an explanation for this why this broke, and how to fix either Dovecot/Pigeonhole or my Sieve script? I've already lost hours trying to figure this out and I'm not getting any wiser... Regards Luca

4 3

Error after power failure
by Doug Hardie 22 Dec '25

22 Dec '25

My mail server lost power and now I am having issues with dsync for one user. Here is the command and output: mail# doveadm backup -u doug remote:sermons dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: /var/mail/home_mail/doug/Maildir/dovecot.index: Couldn't set transaction log view (seq 295..297): Missing middle file seq=296 (between 295..297, we have seqs 295,297): Not found from .log.2: File is already open dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: Failed to read transaction log for mailbox INBOX dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: Remote command returned error 75: ssh sermons doveadm dsync-server -udoug -U How do I fix this issue? Thanks, -- Doug

2 1

Pigeonhole managesieve-login panic
by revsuine 19 Dec '25

19 Dec '25

Hi folks, I'm getting a ``` Dec 19 16:18:07 managesieve-login: Panic: file client.c: line 350 (managesieve_client_input_next_cmd): assertion failed: (args != NULL) Dec 19 16:18:07 auth: Debug: conn unix:login (pid=7390,uid=91) [2]: Disconnected: Connection closed (fd=20) Dec 19 16:18:07 managesieve-login: Fatal: master: service(managesieve-login): child 7390 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) ``` When trying to connect to MANAGESIEVE using [sieve-connect][1]. The command I'm using is ``` sieve-connect -s revsuine.xyz -u pid1 --passwordfd=5 5<<<"$(command to get pass here)" ``` This command was working previously (within the past year), though I don't remember which versions of Dovecot/Pigeonhole I tried it on. sieve-connect has not been updated recently, so there aren't any changes in sieve-connect that would've caused this. I'm attaching the files generated by `dovecot-sysreport` which includes my `dovecot -n`. Server OS is Alpine Linux 3.23.2. ~revsuine [1]: https://github.com/philpennock/sieve-connect

1 0

Attachments corrupted by sieve "redirect" action
by Michael Orlitzky 18 Dec '25

18 Dec '25

We got a report today from one of our customers that they are unable to "redirect" mail with attachments off-site. At first I was skeptical, because sieve does not mess with the message body... but sure enough, it's easy to reproduce: 1. Create a new address (mailbox) 2. Create a single sieve "redirect" filter for that address, pointing to my own mailbox 3. Send it a message with an attachment 4. An attachment is visible on the message that arrives, but it is corrupt For example: $ cat hello.original.txt Hello, world! but $ cat hello.attached.txt (it's empty). Sending a JPEG image is a bit more enlightening: $ /bin/ls -l *jpg -rw------- 1 mjo mjo 337119 Dec 18 11:15 image.attached.jpg -rw-r--r-- 1 mjo mjo 337173 Dec 18 11:13 image.original.jpg So something _is_ sent, but the start of the file is corrupt. Looking at it in a hex editor, it's only the first few lines that are messed up. This is with dovecot 2.4.2, but notably, we are using zlib compression: mail_plugins = mail_compress mail_compress_write_method = gz I'm curious if anyone else can reproduce this? Redirecting via sieve is not common, so this isn't an emergency, but obviously it is preferable to have it working.

2 1

Imap-login bind errors after upgrading dovecot from 2.3 to 2.4
by onyeibo 18 Dec '25

18 Dec '25

Greetings I updated the OS in a VPS blindly and broke the mail service. I had set up this service over four years ago and never had issues with upgrades until recently. I realized the gravity of my mistake after dovecot refused to start. Version 2.4.1 had arrived and I am in so much trouble. So far, I have adapted the configuraton files to 2.4 standards. "doveadm auth test user" tells me that the authentication is working fine. I am able to view old mails via doveadm. However, I get nothing new from mail clients. The maillog tells me that mails are getting queued (why?). I see status=sent (250.2.0.0) in some transactions, but that is the extent of success. However, I still get a nagging error message (see the end of this mail). dovecot -n # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.17.11-300.fc43.x86_64 x86_64 Fedora release 43 (Forty Three) dovecot_config_version = 2.4.1 auth_debug = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 first_valid_uid = xxxx mail_driver = maildir mail_home = /home/mails/%{user | domain}/%{user | username} mail_path = %{home}/Maildir mail_privileged_group = mail passdb_default_password_scheme = BLF-CRYPT protocols { imap = yes lmtp = yes sieve = yes } sql_driver = pgsql ssl = required ssl_cipher_list = PROFILE=SYSTEM pgsql localhost { parameters { dbname = postfix password = xxxxxxx user = postfix } } passdb sql {n query = SELECT username AS user, password FROM mailbox WHERE username = '%{user}' AND active='1' } userdb sql { query = SELECT '/home/mails/' || maildir AS home, xxxx as uid, xxxx as gid FROM mailbox WHERE username = '%{user}' AND active = '1' } namespace inbox { inbox = yes mailbox Drafts { auto = create special_use = "\\Drafts" } mailbox Junk { auto = create special_use = "\\Junk" } mailbox Trash { auto = create special_use = "\\Trash" } mailbox Sent { auto = create special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service lmtp { executable = lmtp -L process_min_avail = 5 user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /etc/letsencrypt/live/xxxxxxx.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/xxxxxxx.com/privkey.pem prefer_ciphers = server } protocol lmtp { info_log_path = /var/log/lmtp/dovecot-lmtp.log mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve} I did adjust an entry in postfix (master.cf). I switched from dovecot-lda to dovecot-lmtp. LDA was throwing permission errors when accessing the cert file. Most reference materials recommended LMTP because its processes already have the required privileges. So ... master.cf (postfix)dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -a ${original_recipient} -d ${user}@${nexthop}# maillog errors Dec 16 22:16:29 xxxxxxx.com dovecot[139456]: master: Error: bind(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 xxxxxxx.com dovecot[139456]: master: Fatal: Failed to create per-PID unix_listener %{pid}: net_listen_unix(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 xxxxxxx.com dovecot[809]: master: Error: service(imap-login): command startup failed, throttling for 2.000 secsDec 16 22:16:29 xxxxxxx.com dovecot[139216]: imap-login: Fatal: master: service(imap-login): child 139456 returned error 89 (Fatal failure) What am I missing? Regards Onyeibo Greetings I updated the OS in a VPS blindly and broke the mail service. I had set up this service over four years ago and never had issues with upgrades until recently. I realized the gravity of my mistake after dovecot refused to start. Version 2.4.1 had arrived and I am in so much trouble. So far, I have adapted the configuraton files to 2.4 standards. "doveadm auth test user" tells me that the authentication is working fine. I am able to view old mails via doveadm. However, I get nothing new from mail clients. The maillog tells me that mails are getting queued (why?). I see status=sent (250.2.0.0) in some transactions, but that is the extent of success. However, I still get a nagging error message (see the end of this mail). dovecot -n # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.17.11-300.fc43.x86_64 x86_64 Fedora release 43 (Forty Three) dovecot_config_version = 2.4.1 auth_debug = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 first_valid_uid = xxxx mail_driver = maildir mail_home = /home/mails/%{user | domain}/%{user | username} mail_path = %{home}/Maildir mail_privileged_group = mail passdb_default_password_scheme = BLF-CRYPT protocols { imap = yes lmtp = yes sieve = yes } sql_driver = pgsql ssl = required ssl_cipher_list = PROFILE=SYSTEM pgsql localhost { parameters { dbname = postfix password = xxxxxxx user = postfix } } passdb sql {n query = SELECT username AS user, password FROM mailbox WHERE username = '%{user}' AND active='1' } userdb sql { query = SELECT '/home/mails/' || maildir AS home, xxxx as uid, xxxx as gid FROM mailbox WHERE username = '%{user}' AND active = '1' } namespace inbox { inbox = yes mailbox Drafts { auto = create special_use = "\\Drafts" } mailbox Junk { auto = create special_use = "\\Junk" } mailbox Trash { auto = create special_use = "\\Trash" } mailbox Sent { auto = create special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service lmtp { executable = lmtp -L process_min_avail = 5 user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /etc/letsencrypt/live/xxxxxxx.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/xxxxxxx.com/privkey.pem prefer_ciphers = server } protocol lmtp { info_log_path = /var/log/lmtp/dovecot-lmtp.log mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve } I did adjust an entry in postfix (master.cf). I switched from dovecot-lda to dovecot-lmtp. LDA was throwing permission errors when accessing the cert file. Most reference materials recommended LMTP because its processes already have the required privileges. So ... master.cf (postfix) dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -a ${original_recipient} -d ${user}@${nexthop}# maillog errors Dec 16 22:16:29 [1]xxxxxxx.com dovecot[139456]: master: Error: bind(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 [2]xxxxxxx.com dovecot[139456]: master: Fatal: Failed to create per-PID unix_listener %{pid}: net_listen_unix(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 [3]xxxxxxx.com dovecot[809]: master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Dec 16 22:16:29 [4]xxxxxxx.com dovecot[139216]: imap-login: Fatal: master: service(imap-login): child 139456 returned error 89 (Fatal failure) What am I missing? Regards Onyeibo References Visible links 1. http://xxxxxxx.com/ 2. http://xxxxxxx.com/ 3. http://xxxxxxx.com/ 4. http://xxxxxxx.com/

4 9

Bug Report: authCacheFlush HTTP API crashes with assertion failure
by Yurii Krainiuk 17 Dec '25

17 Dec '25

*## Title* authCacheFlush HTTP API crashes with assertion failure - type mismatch between API schema and implementation *## Dovecot Version* 2.4.2 *## Component* doveadm HTTP API *## Description* The authCacheFlush command via doveadm HTTP API causes a server crash with an assertion failure. The HTTP API schema declares the user parameter as array type, but the internal implementation (doveadm_cmd_param_str) expects string type, causing a type mismatch assertion failure. *## Steps to Reproduce* 1. Send any authCacheFlush request to doveadm HTTP API: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":"username(a)domain.com"},"tag1"]]' \ http://localhost:8080/doveadm/v1 2. Or with user as array (matching the declared schema): bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":["username(a)domain.com"]},"tag1"]]' \ http://localhost:8080/doveadm/v1 3. Or without any parameters: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{},"tag1"]]' \ http://localhost:8080/doveadm/v1 *## Expected Result* Auth cache should be flushed and API returns success response like: json [["doveadmResponse",[{"entries":1}],"tag1"]] *## Actual Result* Server crashes with empty reply (HTTP connection closed). The doveadm process is killed with signal 6 (SIGABRT). *## Error Log* Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) Error: Raw backtrace: #0 test_subprocess_fork[0x7362eb54a570] -> #1 backtrace_append[0x7362eb54a820] -> #2 backtrace_get[0x7362eb54a9c0] -> #3 e_info[0x7362eb556370] -> #4 i_syslog_fatal_handler[0x7362eb5564b0] -> #5 i_panic[0x7362eb474f28] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7362eb4e6a00] -> #8 io_loop_call_io[0x7362eb572510] -> #9 io_loop_handler_run_internal[0x7362eb5743a0] -> #10 io_loop_handler_run[0x7362eb574540] -> #11 io_loop_run[0x7362eb574740] -> #12 master_service_run[0x7362eb4bc640] -> #13 main[0x64c4233d74f0] -> #14 __libc_init_first[0x7362eb02a150] -> #15 __libc_start_main[0x7362eb02a200] -> #16 _start[0x64c4233d76e0] Fatal: master: service(doveadm): child 2302469 killed with signal 6 (core dumped) *## API Schema (from GET /doveadm/v1)* The API endpoint reports the following schema for authCacheFlush: json { "command": "authCacheFlush", "parameters": [ {"name": "socketPath", "type": "string"}, {"name": "user", "type": "array"} ] } *## Analysis* The API schema declares user as array, but line 120 in doveadm-cmd-parse.c calls doveadm_cmd_param_str() which asserts param->type == CMD_PARAM_STR. This type mismatch causes the crash. The relevant assertion in source code: c // doveadm-cmd-parse.c:120 assertion failed: (param->type == CMD_PARAM_STR) *## Note* - The CLI command doveadm auth cache flush <user> works correctly - Only the HTTP API is affected - All authentication methods (X-Dovecot-API header, Basic Auth) produce the same crash - The crash occurs regardless of whether parameters are provided or not *## Workaround* Currently no workaround via HTTP API. Must use CLI directly or via SSH. *## Environment* - OS: Linux (Ubuntu/Debian) - Dovecot: 2.4.2 - doveadm HTTP API enabled on port 8080 ## Title authCacheFlush HTTP API crashes with assertion failure - type mismatch between API schema and implementation ## Dovecot Version 2.4.2 ## Component doveadm HTTP API ## Description The authCacheFlush command via doveadm HTTP API causes a server crash with an assertion failure. The HTTP API schema declares the user parameter as array type, but the internal implementation (doveadm_cmd_param_str) expects string type, causing a type mismatch assertion failure. ## Steps to Reproduce 1. Send any authCacheFlush request to doveadm HTTP API: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":"[1]username(a)domain.com"},"tag1"]]' \ [2]http://localhost:8080/doveadm/v1 2. Or with user as array (matching the declared schema): bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":["[3]username(a)domain.com"]},"tag1"]]' \ [4]http://localhost:8080/doveadm/v1 3. Or without any parameters: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{},"tag1"]]' \ [5]http://localhost:8080/doveadm/v1 ## Expected Result Auth cache should be flushed and API returns success response like: json [["doveadmResponse",[{"entries":1}],"tag1"]] ## Actual Result Server crashes with empty reply (HTTP connection closed). The doveadm process is killed with signal 6 (SIGABRT). ## Error Log Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) Error: Raw backtrace: #0 test_subprocess_fork[0x7362eb54a570] -> #1 backtrace_append[0x7362eb54a820] -> #2 backtrace_get[0x7362eb54a9c0] -> #3 e_info[0x7362eb556370] -> #4 i_syslog_fatal_handler[0x7362eb5564b0] -> #5 i_panic[0x7362eb474f28] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7362eb4e6a00] -> #8 io_loop_call_io[0x7362eb572510] -> #9 io_loop_handler_run_internal[0x7362eb5743a0] -> #10 io_loop_handler_run[0x7362eb574540] -> #11 io_loop_run[0x7362eb574740] -> #12 master_service_run[0x7362eb4bc640] -> #13 main[0x64c4233d74f0] -> #14 __libc_init_first[0x7362eb02a150] -> #15 __libc_start_main[0x7362eb02a200] -> #16 _start[0x64c4233d76e0] Fatal: master: service(doveadm): child 2302469 killed with signal 6 (core dumped) ## API Schema (from GET /doveadm/v1) The API endpoint reports the following schema for authCacheFlush: json { "command": "authCacheFlush", "parameters": [ {"name": "socketPath", "type": "string"}, {"name": "user", "type": "array"} ] } ## Analysis The API schema declares user as array, but line 120 in doveadm-cmd-parse.c calls doveadm_cmd_param_str() which asserts param->type == CMD_PARAM_STR. This type mismatch causes the crash. The relevant assertion in source code: c // doveadm-cmd-parse.c:120 assertion failed: (param->type == CMD_PARAM_STR) ## Note - The CLI command doveadm auth cache flush <user> works correctly - Only the HTTP API is affected - All authentication methods (X-Dovecot-API header, Basic Auth) produce the same crash - The crash occurs regardless of whether parameters are provided or not ## Workaround Currently no workaround via HTTP API. Must use CLI directly or via SSH. ## Environment - OS: Linux (Ubuntu/Debian) - Dovecot: 2.4.2 - doveadm HTTP API enabled on port 8080 References Visible links 1. mailto:username@domain.com 2. http://localhost:8080/doveadm/v1 3. mailto:username@domain.com 4. http://localhost:8080/doveadm/v1 5. http://localhost:8080/doveadm/v1

2 1