- dovecot - dovecot.org

Disable sieve redirect filters?
by jarland＠mxroute.com 21 Mar '24

21 Mar '24

Right now we're using Dovecot for sieve filters. Good old fairly standard config: https://mxbin.io/N6hDUi I'm hoping someone has an idea, but I think I'm probably on my own here. The problem is that this is the best solution to preventing people from spoofing external senders when creating redirects to external recipients: sieve_redirect_envelope_from = recipient But also, as great as this is, it kind of sucks because users continually insist on receiving spam and phishing emails. When a user sends a phishing email, I step in to make sure our network isn't being abused. That's how we do what we do for high quality inbox delivery, we police the hell out of our network. So my problem is I end up with all of these users that I need to review every day, only to find out they just created a redirect filter and "redirected" a phishing email. So my long winded question is, how can I disable redirect filters? I don't want users to be able to create them. But I want them to have access to the rest of the functions of the sieve filtering. Is this possible, or would this need to be an entirely new function contributed to the project's code?

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 20 Mar '24

20 Mar '24

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 6

Notifications to over-quota accounts
by N V 15 Mar '24

15 Mar '24

Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance! Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance!

3 2

Question about sieve language
by Lev Serebryakov 15 Mar '24

15 Mar '24

Hello! I need to match all messages sent from some specific domain and all its sub-domains. I can achieve this with: if address :match :domain "From" [ "domain.com", "*.domain.com" ] { ... } But it looks ugly, especially if repeated for 5-6 domains. Is here way better? `:match ["*domain.com"]` will match "notdomain.com" and `:is [ "domain.com" ] doesn't match sub-domains. I understand, that it is (slightly?) off-topic, but I can not find any sieve-specific resources (all google find ins questions about PronotMail and FastMail filters, and these questions are very basic). Thank you. -- // Black Lion AKA Lev Serebryakov

3 4

antispoofing with dovecot submission
by Adrian M 15 Mar '24

15 Mar '24

Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ? Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ?

4 3

How to get a memory pointer in the core process
by Joan Moreau 15 Mar '24

15 Mar '24

Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks

4 11

dovecot panic
by Michael Grant 15 Mar '24

15 Mar '24

I'm running dovecot 2.3.19.1 on debian stable. I just started seeing a slew of these in my log: Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap(mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap(mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Error: Raw backtrace: #0 test_subprocess_fork[0x7f1a33d7ca20] -> #1 backtrace_append[0x7f1a33d7cc90] -> #2 backtrace_get[0x7f1a33d7ce20] -> #3 execvp_const[0x7f1a33d89f90] -> #4 i_syslog_fatal_handler[0x7f1a33d8a900] -> #5 i_panic[0x7f1a33ce00a4] -> #6 fs_wrapper_unlock[0x7f1a33cdb71d] -> #7 i_stream_snapshot_free[0x7f1a33d96110] -> #8 i_stream_unref[0x7f1a33d96180] -> #9 index_mail_get_virtual_size[0x7f1a33f2d190] -> #10 index_mail_save_finish[0x7f1a33f2d470] -> #11 index_mail_get_special[0x7f1a33f2d690] -> #12 mail_get_special[0x7f1a33eaf950] -> #13 cmd_select[0x560714f983e0] -> #14 imap_fetch_begin[0x560714f9d170] -> #15 imap_fetch_more[0x560714f9d550] -> #16 cmd_fetch[0x560714f91c00] -> #17 command_exec[0x560714f9a880] -> #18 cmd_x_cancel[0x560714fa0510] -> #19 cmd_x_cancel[0x560714fa0510] -> #20 cmd_x_cancel[0x560714fa0510] -> #21 client_handle_input[0x560714fa0880] -> #22 client_input[0x560714fa0d80] -> #23 io_loop_call_io[0x7f1a33da1c70] -> #24 io_loop_handler_run_internal[0x7f1a33da3970] -> #25 io_loop_handler_run[0x7f1a33da3b00] -> #26 io_loop_run[0x7f1a33da3cd0] -> #27 master_service_run[0x7f1a33d14180] -> #28 main[0x560714f8ca00] -> #29 __libc_init_first[0x7f1a33ac51d0] -> #30 __libc_start_main[0x7f1a33ac5280] -> #31 _start[0x560714f8d000] I realize this is a slightly old version of dovecot but this is what's in debian's stable package repository. I see 2.3.21+dfsg1-2 in testing and 2.3.21+dfsg1-3 in unstable. I really try to avoid installing this on production. I didn't recently change anything in my configs on the server. I did start recently using 'eM Client' on Windows a couple days ago, could that have caused this? Mail seems to continue to come in to my imap clients, but these errors in the log are worrying! Michael Grant I'm running dovecot 2.3.19.1 on debian stable. I just started seeing a slew of these in my log: Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap (mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot- >mstream->snapshot_pending) Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap (mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Error: Raw backtrace: #0 test_subprocess_fork[0x7f1a33d7ca20] -> #1 backtrace_append[0x7f1a33d7cc90] - > #2 backtrace_get[0x7f1a33d7ce20] -> #3 execvp_const[0x7f1a33d89f90] -> #4 i_syslog_fatal_handler[0x7f1a33d8a900] -> #5 i_panic[0x7f1a33ce00a4] -> #6 fs_wrapper_unlock[0x7f1a33cdb71d] -> #7 i_stream_snapshot_free[0x7f1a33d96110] -> #8 i_stream_unref[0x7f1a33d96180] -> #9 index_mail_get_virtual_size [0x7f1a33f2d190] -> #10 index_mail_save_finish[0x7f1a33f2d470] -> #11 index_mail_get_special[0x7f1a33f2d690] -> #12 mail_get_special[0x7f1a33eaf950] -> #13 cmd_select[0x560714f983e0] -> #14 imap_fetch_begin[0x560714f9d170] - > #15 imap_fetch_more[0x560714f9d550] -> #16 cmd_fetch[0x560714f91c00] -> #17 command_exec[0x560714f9a880] -> #18 cmd_x_cancel[0x560714fa0510] -> #19 cmd_x_cancel[0x560714fa0510] -> #20 cmd_x_cancel[0x560714fa0510] -> #21 client_handle_input[0x560714fa0880] -> #22 client_input[0x560714fa0d80] -> #23 io_loop_call_io[0x7f1a33da1c70] -> #24 io_loop_handler_run_internal [0x7f1a33da3970] -> #25 io_loop_handler_run[0x7f1a33da3b00] -> #26 io_loop_run [0x7f1a33da3cd0] -> #27 master_service_run[0x7f1a33d14180] -> #28 main [0x560714f8ca00] -> #29 __libc_init_first[0x7f1a33ac51d0] -> #30 __libc_start_main[0x7f1a33ac5280] -> #31 _start[0x560714f8d000] I realize this is a slightly old version of dovecot but this is what's in debian's stable package repository. I see 2.3.21+dfsg1-2 in testing and 2.3.21+dfsg1-3 in unstable. I really try to avoid installing this on production. I didn't recently change anything in my configs on the server. I did start recently using 'eM Client' on Windows a couple days ago, could that have caused this? Mail seems to continue to come in to my imap clients, but these errors in the log are worrying! Michael Grant

2 1

Re: [EXT] Re: How to get a memory pointer in the core process
by Joseph Tam 15 Mar '24

15 Mar '24

From: Joan Moreau > I am trying to avoid closing/ reopening a file pointer to the exact same file > between each call to the plugin Can't you do an end-run around all this by having a persistent standalone process that holds all your persistent data, and the plugin collects session data and passes it to the persistent process via sockets? You'll have to have some initial handshake protocol to establish session context, but this seems the easiest way to accomplish what you want. Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot and solr clustering
by Maciej Milaszewski 13 Mar '24

13 Mar '24

Hi I have 1 director and ~8 dovecot nodes. I thinking about Solr cluster beacuse one server solr probably is not enough. I thinking about SolrCloud Mode but I don't know if it will work with Dovecot And if not SolrCloud Mode, then what? I don't have much experience in Solr clustering and I want to choose the most optimal solution with scalable aand redundancy (bare metal servers is not problem) Hi I have 1 director and ~8 dovecot nodes. I thinking about Solr cluster beacuse one server solr probably is not enough. I thinking about SolrCloud Mode but I don't know if it will work with Dovecot And if not SolrCloud Mode, then what? I don't have much experience in Solr clustering and I want to choose the most optimal solution with scalable aand redundancy (bare metal servers is not problem)

1 0

Dovecot and SNI
by steffan＠hldns.com 13 Mar '24

13 Mar '24

I have an old CentOS 7 server using dovecot 2.2.36 and OpenSSL 1.0.2k-fips that’s been fine for quite some time. Recently I started getting complaints related to SNI. I test with this: openssl s_client -connect mail.domain.com:993 -crlf -quiet On macOS using OpenSSL LibreSSL 3.3.6 I test and get the default dovecot domain “SomeWrongDomain.com” which causes issues. On Oracle Linux 9 using OpenSSL 3.0.7 I get the correct response for the domain “mail.domain.com” What could cause this? Thank you, Steffan Cline steffan(a)hldns.com<mailto:steffan@hldns.com> 602-793-0014 I have an old CentOS 7 server using dovecot 2.2.36 and OpenSSL 1.0.2k-fips that’s been fine for quite some time. Recently I started getting complaints related to SNI. I test with this: openssl s_client -connect mail.domain.com:993 -crlf -quiet On macOS using OpenSSL LibreSSL 3.3.6 I test and get the default dovecot domain “SomeWrongDomain.com” which causes issues. On Oracle Linux 9 using OpenSSL 3.0.7 I get the correct response for the domain “mail.domain.com” What could cause this? Thank you, Steffan Cline steffan(a)hldns.com 602-793-0014

4 3