- dovecot - dovecot.org

[Dovecot] [PATCH] Bad boundary check in client_find_namespace
by Christoph Bussenius 09 Feb '12

09 Feb '12

Hi, while trying to investigate the bug I reported last week, I found that there is a broken boundary check in client_find_namespace in src/imap/imap-commands-util.c. The code is: /* make sure two hierarchy separators aren't next to each others */ for (p = storage_name+1; *p != '\0'; p++) { if (p[0] == ns->real_sep && p[-1] == ns->real_sep) { client_send_tagline(cmd, "NO Invalid mailbox name."); return NULL; } } The loop iterates over the string storage_name starting from its second byte. However, the string may be "". This is the case if you select the root of a namespace, like in "SELECT shared" or "SELECT shared/user1". In that case, the code will read past the end of the buffer from random memory until it finds a zero byte or a duplicate separator. This would fix it: diff -ru dovecot-2.0.15.orig/src/imap/imap-commands-util.c dovecot-2.0.15/src/imap/imap-commands-util.c --- dovecot-2.0.15.orig/src/imap/imap-commands-util.c 2011-08-02 12:29:37.000000000 +0200 +++ dovecot-2.0.15/src/imap/imap-commands-util.c 2011-09-26 18:33:16.121917759 +0200 @@ -81,7 +81,9 @@ } /* make sure two hierarchy separators aren't next to each others */ - for (p = storage_name+1; *p != '\0'; p++) { + for (p = storage_name; *p != '\0'; p++) { + if (p == storage_name) + continue; if (p[0] == ns->real_sep && p[-1] == ns->real_sep) { client_send_tagline(cmd, "NO Invalid mailbox name."); return NULL; Cheers, Christoph Bußenius -- Christoph Bußenius Rechnerbetriebsgruppe der Fakultäten Informatik und Mathematik TU München +49 89-289-18519 <> Raum 00.05.055 <> Boltzmannstr. 3 <> Garching

3 2

[Dovecot] 2.0.14 doveadm proxy list segfault
by Tom Pawlowski 09 Feb '12

09 Feb '12

Hi Timo, Periodic segfaults with doveadm proxy list: root@director1:~) doveadm proxy list doveadm(root): Error: LIST failed: Disconnected Segmentation fault (core dumped) Sometimes it's just the 'LIST failed' error, other times it's the error with the segfault. Usually the first attempt to call it works, subsequent attempts fail. I've attached a strace log of it in action. -- Tom Pawlowski OIT-CSS System Administrator office: Hill 147 email: tompru(a)jla.rutgers.edu phone: (732) 445-2634

2 1

[Dovecot] Syncing shared mailboxes
by Knud Dombrowsky 09 Feb '12

09 Feb '12

Hi, while trying to sync the mailboxes of several users who use and share their mailboxes dsync prints this message: dsync-local(<user-who-uses-shared-mailbox>): Warning: Subscriptions file /home/<user-who-uses-shared-mailbox>/Maildir/subscriptions: Removing invalid entry: shared/<sharing-user>/<shared-folder> The problem is: Every user has to subscribe the shared folder again after each run of dsync... Is dsync capable of syncing shared mailboxes? Are there any preliminaries to do so? thanks in advance, Knud

2 1

[Dovecot] crash on shared folders if remote user has empty $home
by Peer Heinlein 09 Feb '12

09 Feb '12

Hi, in seldom cirumstances it's possible that the imap-process is crashing without write something usefule into the logfile. a) User foo exists, is happy and everything's alright b) He had a shared folder given from bar c) In our setup we have mailforwarding adresses without a valid $home in LDAP c) if user bar is changed from a user with into a mailforwarding adress, the user foo won't have an entry for $home any more, but still exists in LDAP. d) If foo logs in, dovecot's exploring the shared folders given from the non-existing user bar. But bar's entry in LDAP doesn't have $home any more. imap crashes and closes the TCP-connection immediately. root@dobby2:/etc/dovecot# telnet xxxxxxxx 143 Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE ACL UIDPLUS STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5 AUTH=DIGEST-MD5] Dovecot ready. Testing. a LOGIN foo xxxxx a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS ACL UIDPLUS QUOTA ACL RIGHTS=texk] Logged in a LIST "" "*" * BYE Internal error occurred. Refer to server log for more information. Connection closed by foreign host. Dec 22 21:57:41 dobby2 dovecot: master: Error: service(imap): child 18095 killed with signal 11 (core dumps disabled) e) This happens if mail_location=mdbox:%%h/mdbox is set in the shared folder namespace. If I set "mail_location=auto:" then Dovecot logs an error message, but is still possible to continue without any problems. Dec 22 21:33:59 dobby2 dovecot: imap(bar): Error: Namespace 'shared/bar/': Autodetection failed for auto: (home=/mail/foo/) -- Heinlein Professional Linux Support GmbH Linux: Akademie - Support - Hosting http://www.heinlein-support.de Tel: 030 / 40 50 51 - 0 Fax: 030 / 40 50 51 - 19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 2

[Dovecot] LSUB and subscribed folders
by Peer Heinlein 09 Feb '12

09 Feb '12

I have a strange behavior on a customer's server and I don't understand that: User "bar" has some folders and one shared folder from "foo" if I use the "LIST"-command, which should list AFAIK *all* folders: # telnet localhost 143 a login bar xxxx a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS ACL RIGHTS=texk] Logged in a LIST "" "*" * LIST (\HasNoChildren) "/" "Gesendete Objekte" * LIST (\HasNoChildren) "/" "Papierkorb" * LIST (\HasNoChildren) "/" "INBOX" * LIST (\HasNoChildren) "/" "Trash" * LIST (\HasNoChildren) "/" "Entw&APw-rfe" * LIST (\HasNoChildren) "/" "Spam" * LIST (\Noselect \HasChildren) "/" "shared/foo" * LIST (\HasNoChildren) "/" "shared/foo/INBOX" a OK List completed. Using the LSUB-command, which should only list subscribed folders I can see some more shared folders. AFAIK the output of LSUB must be always less then LIST: a LSUB "" "*" * LSUB () "/" "Entw&APw-rfe" * LSUB () "/" "Gesendete Objekte" * LSUB () "/" "INBOX" * LSUB () "/" "Papierkorb" * LSUB () "/" "Spam" * LSUB () "/" "Trash" * LSUB (\Noselect) "/" "shared/amerkel" * LSUB () "/" "shared/foo/Papierkorb/Ungelesene Mails" * LSUB () "/" "shared/foo/INBOX" * LSUB () "/" "shared/foo/INBOX/abc/Unterebene 1" * LSUB () "/" "shared/foo/INBOX/abc/Unterebene 1/Test6789" * LSUB () "/" "shared/foo/INBOX/abc/Unterebene 1/Test Unterornder" * LSUB () "/" "shared/foo/INBOX/abc/Unterebene 1/Tsfgnksfgnk" a OK Lsub completed. a logout * BYE Logging out a OK Logout completed. And why is /shared/foo/INBOX listed with "HasNoChildren"? IMHO that's looking buggy. And, btw: Looks like's not possible to use the "doveadm"-command to get a list of a user's complete folder list. Maybe "doveadm mailbox" should get some extra parameters to geht all folders / only subscribe folders / only shared folders: # doveadm mailbox list -u bar Gesendete Objekte Papierkorb INBOX Trash Entwürfe Spam -- Heinlein Professional Linux Support GmbH Linux: Akademie - Support - Hosting http://www.heinlein-support.de Tel: 030/405051-42 Fax: 030/405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

3 2

[Dovecot] doveadm altmove fails to pack messages?
by Lauri Alanko 09 Feb '12

09 Feb '12

Hello again. When I use doveadm altmove, I notice that it may result in some very small storage files in either the primary or the alternate storage location. I'm not quite sure, but it almost seems like every storage file that contains messages to be moved is simply split into two parts, even if a part might only contain a single message. This seems quite curious, since the idea of mdbox is after all to store as many messages in a single file as fits in mdbox_rotate_size, and dovecot-lda can quite successfully append messages to existing storage files. So why can't doveadm altmove? Is this the expected behavior, or is there something wrong with my setup? Thanks again, Lauri

2 1

[Dovecot] force-resync fails to recover all messages in mdbox
by Lauri Alanko 09 Feb '12

09 Feb '12

To my understanding, when using mdbox, doveadm force-resync should be able to recover all the messages from the storage files alone, though of course losing all metadata except the initial delivery folder. However, this does not seem to be the case. For me, force-resync creates only partial indices that lose messages. The message contents are of course still in the storage files, but dovecot just doesn't seem to be aware of some of them after recreating the indices. Here is an example. I created a test mdbox by syncing a mailing list folder from a mbox location: $ dsync -m haskell-cafe backup mdbox:~/dbox Then I switched the location to the new mdbox: $ /usr/sbin/dovecot -n # 2.0.15: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-0.bpo.1-amd64 x86_64 Debian wheezy/sid mail_fsync = never mail_location = mdbox:~/dbox mail_plugins = zlib passdb { driver = pam } plugin { sieve = ~/etc/sieve/dovecot.sieve sieve_dir = ~/etc/sieve zlib_save = bz2 zlib_save_level = 9 } protocols = " imap" ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } protocol lda { mail_plugins = zlib sieve } Then I checked the number of messages we had in the new location: $ doveadm search all | wc 93236 186472 3625098 This was indeed the correct number, so the sync was fine: $ grep -c '^From .*..:..:.. ....$' ../mbox/haskell-cafe 93237 Then I removed all the indices and rebuilt them: $ mkdir bak $ mv mailboxes bak $ mv storage/dovecot.map.index* bak/ $ doveadm force-resync inbox doveadm(la): Warning: mdbox /home/la/dbox/storage: rebuilding indexes And what have we now: $ doveadm search all | wc 43864 87728 1699590 Somehow dovecot lost over half of the messages! This is really worrisome. It should always be possible to extract the plain mail content out from the storage, but currently it only _looks_ like it is possible: you get a problem in the indices, rebuild them, and then later migrate somewhere else. If you don't notice that you are missing mails, you may then eventually destroy the original mdbox storage files, thinking that their content is now safely elsewhere, when it really isn't. Lauri

2 3

[Dovecot] Fedora 16 configuration
by Cliff Hayes 09 Feb '12

09 Feb '12

Hello, I am trying to get dovecot to work on a fedora 16 install with sendmail. I have been able to get it to work in the past with dovecot.conf but not with the new conf.d directory and associated config files. I keep seeing this in maillog: Feb 7 14:28:59 sendmail dovecot: pop3-login: Aborted login (no auth attempts): rip=x.x.x.x, lip=x.x.x.x And the mail client comes back with username or password invalid. Is there instructions somewhere regarding fedora 16 installs? I found this one and tried it to no avail: http://www.server-world.info/en/note?os=Fedora_16&p=mail&f=2 Thanks in advance, Cliff

2 1

[Dovecot] openbsd and dovecot
by User Max 09 Feb '12

09 Feb '12

I'm setting up dovecot in OpenBSD OS. The problem is that I can't set up dovecot to use kerberos authentication via bsdauth which is "similar to pam" I try to test dovecot via telnet: telnet localhost pop3 user test +OK pass password -ERR [IN-USE] Temporary authentication failure and some strings from logs Feb 3 15:02:37 srv-mx-00 dovecot: auth: Error: bsdauth(rodin.m,127.0.0.1): getpwnam() failed: Operation not permitted Feb 3 15:02:46 srv-mx-00 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<rodin.m>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Feb 3 15:29:13 srv-mx-00 dovecot: auth: Error: bsdauth(test,127.0.0.1): getpwnam() failed: Operation not permitted What am I doing wrong? Here is the output of dovecot -n auth_krb5_keytab = /etc/kerberosV/krb5.keytab auth_mechanisms = plain login default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no first_valid_gid = 2000 first_valid_uid = 2000 last_valid_gid = 2000 last_valid_uid = 2000 mail_gid = vmail mail_location = maildir:/var/vmail/%u%Ud/Maildir mail_uid = vmail mbox_write_locks = fcntl mmap_disable = yes passdb { driver = bsdauth } service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0666 user = _postfix } } ssl_cert = </etc/ssl/dovecotcert.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = uid=2000 gid=2000 home=/var/mail/%Lu driver = static } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }

3 3

[Dovecot] Slightly more intelligent way of handling issues in sdbox?
by Mark Zealey 09 Feb '12

09 Feb '12

Hi there, I was doing some testing on sdbox yesterday. Basically I did the following procedure: 1) Create new sdbox; deliver 2 messages into it (u.1, u.2) 2) Create a copy of the index file (no cache file created yet) 3) deliver another message to the mailbox (u.3) 4) copy back index file from stage (2) 5) deliver new mail Then the message delivered in stage 3 ie u.3 gets replaced with the message delivered in (5) also called u.3. Is it possible to try an open/access call on the mail file before overwriting it with the new message in case we have an issue where an older version of the index file is present (eg due to nfs latencies) ? I notice when you are expunging files you very carefully open them and read the header contents to make sure the guid is the same as in the index - any reason that this is not done when delivering? This is with lmtp on dovecot 2.0.16. I also noticed that index corruption in sdbox does not get automatically repaired. I know this is because the flags are stored in the index files so you'd get some loss of flags, but in many situations for us this auto-repair with flag loss would be better than having the mailbox locked out until we manually do a force-resync on it. (speaking of which, it would be great if force-resync also rebuilt the cache files if there are valid cache files around, rather than just doing away with them) Thanks, Mark

3 4