- dovecot - dovecot.org

[PATCH] Manually cleanup OpenSSL from dovecot_openssl_common_global_unref()
by Apollon Oikonomopoulos 21 Nov '16

21 Nov '16

OpenSSL 1.1 features a cleanup function that is automatically run on shutdown using atexit(3). This function frees all OpenSSL-allocated resources. In dovecot, OpenSSL is loaded indirectly using dlopen(3) against the relevant dovecot crypto module and is finally unloaded using dlclose(3). Until OpenSSL 1.0.1c this worked fine, however OpenSSL 1.0.1c makes sure[1] that the library stays loaded after the initial dlclose() so that the atexit(3) handlers can run on shutdown. This, together with the fact that dovecot uses custom allocation functions for OpenSSL and has already partially free()'d some of OpenSSL's resources in module_free(), leads to a segfault at process shutdown[2]. We fix this by explicitly calling OPENSSL_cleanup() during module unload. This is safe to do, as long as we will never want to subsequently re-initialize OpenSSL. [1] https://github.com/openssl/openssl/commit/4af9f7fe79ff82b90c16969b7e5871435… [2] https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=amd64&ver=1:2.2… Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- src/lib-ssl-iostream/dovecot-openssl-common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib-ssl-iostream/dovecot-openssl-common.c b/src/lib-ssl-iostream/dovecot-openssl-common.c index 51ea3ad..2bf6307 100644 --- a/src/lib-ssl-iostream/dovecot-openssl-common.c +++ b/src/lib-ssl-iostream/dovecot-openssl-common.c @@ -101,6 +101,9 @@ bool dovecot_openssl_common_global_unref(void) ERR_remove_thread_state(NULL); #endif ERR_free_strings(); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + OPENSSL_cleanup(); +#endif return FALSE; } -- 2.10.1

4 4

Index-cache sizes
by Tom Sommer 21 Nov '16

21 Nov '16

I had a customer with an INBOX cache of 400MB+ (5.5GB maildir) which gave me "Error: mmap_anon(474165248) failed: Cannot allocate memory" errors, then I deleted the cache files and ran 'doveadm index -u xxx(a)example.com "*"', now the INBOX cache is 7MB What is up with that? Is the cache now missing something or does it make sense to wipe cache files and reindex cache every-so-often? -- Tom

1 0

Feedback on first, i.e. novice-level, experiences with dovecot
by Michael Felt 21 Nov '16

21 Nov '16

a) google: "dovecot imap configuration" brought an article from 2005 as the first item: while I like debian and a bit of history you may want to ask yourself how to improve your site as the primary hit from google. FYI: years ago I had great results in the top of google searches - and then I made a major error - I moved my site to a new url and google forgot me. b) using your http://wiki.dovecot.org/QuickConfiguration as a guide: I built dovecot using --prefix=/opt (I abhor /usr/local these days - that is so 1984ish). The applications got installed in /opt/bin root@x066:/data/prj/aixtools/dovecot/core# ls -ltr /opt total 36 drwxr-xr-x 3 root root 4096 Nov 20 14:33 lib drwxr-xr-x 3 root root 4096 Nov 20 14:33 include drwxr-xr-x 6 root root 4096 Nov 20 14:33 share drwxr-xr-x 3 root root 4096 Nov 20 14:33 libexec drwxr-xr-x 2 root root 4096 Nov 20 14:33 sbin drwxr-xr-x 2 root root 4096 Nov 20 14:33 bin Are the directories 'make install' touched or made. root@x066:/data/prj/aixtools/dovecot/core# /opt/bin/doveconf -n # 2.3.devel (92c8109): /opt/etc/dovecot/dovecot.conf doveconf: Fatal: open(/opt/etc/dovecot/dovecot.conf) failed: No such file or directory where are example configs? root@x066:/data/prj/aixtools/dovecot/core# find /opt -name example-config root@x066:/data/prj/aixtools/dovecot/core# Not in /opt How about a default config? root@x066:/data/prj/aixtools/dovecot/core# find / -name dovecot /etc/init.d/dovecot /etc/pam.d/dovecot /etc/default/dovecot /etc/dovecot /var/lib/dovecot ^C Seems to be /etc/dovecot root@x066:/data/prj/aixtools/dovecot/core# ls -l /etc/dovecot total 40 drwxr-xr-x 2 root root 4096 Apr 30 2015 conf.d -rw-r--r-- 1 root root 4180 Jun 8 2014 dovecot.conf -rw-r----- 1 root dovecot 410 Jun 8 2014 dovecot-db.conf.ext -rw-r----- 1 root dovecot 782 Jun 8 2014 dovecot-dict-sql.conf.ext -rw-r--r-- 1 root dovecot 1363 Apr 30 2015 dovecot.pem -rw-r----- 1 root dovecot 5348 Jun 8 2014 dovecot-sql.conf.ext drwx------ 2 root root 4096 Apr 30 2015 private -rw-r--r-- 1 root root 121 Jun 8 2014 README and finally - read README to find the examples: root@x066:/data/prj/aixtools/dovecot/core# cat /etc/dovecot/README Configuration files go to this directory. See example configuration files in /usr/share/doc/dovecot-core/example-config/ Conclusion: --prefix=/opt is not applied everywhere. * More first impressions as I come to them - if you want them - as I hope this helps make dovecot better! Michael

2 4

doveadm service: verify client cert
by Matwey V. Kornilov 20 Nov '16

20 Nov '16

Hello, I want to open a socket for connecting doveadm using tcps. I do the following: service doveadm { inet_listener { port = 5001 ssl = yes } } At the same time, I would like to verify client certificates for connections goes to port 5001. I am trying to do the following, but it doesn't work: protocol doveadm { ssl_require_crl = yes ssl_verify_client_cert = yes } How could I achieve required behavior?

1 0

Compound Literal - xlc and gcc differences can be patched
by Michael Felt 19 Nov '16

19 Nov '16

Since I so miserably misspelled packaging - a new thread specific to the issue at hand. I found a "workaround". In short, xlc does not accept arrays of nested array - the bottom line (best message) is: 1506-995 (S) An aggregate containing a flexible array member cannot be used as a member of a structure or as an array element. At the core - all the other messages come because this (I shall call it nesting). For the test-http-auth.c file I have a patch (attached). make ran for while with no issue, then it started running into several files with this same style of specification - doveadm-dict.c being the first one. I ran "make -i" and I notice several files with this - for xlc - "unaccepted" syntax. Please look at the patch - what it basically is - and let me know whether you would consider accepting patches in this form (e.g., verify gcc (I assume) will accept it as well). If your answer is yes, I shall proceed with the additional files (learn how your MACROS work!) and send them to you. Again, initially I would just send one, e.g., doveadm-dict.c - to be sure your regular compiler also builds this alternate specification. Thank you for your consideration! Michael

2 5

Re: Good email client to use with Dovecot?
by Joseph Tam 19 Nov '16

19 Nov '16

Steve Litt asks > * And most important, where can I find the best, most unambiguous > Alpine documentation, that doesn't assume I know anything about > Alpine? The ~/.pinerc config file is well documented. There is a bewildering number of options, and you can tweak it just about anyway you like. Choice of mail readers tend to a religious issue. Users of a particular reader will only change when you pry their cold dead fingers off of it. Alpine is not a bad choice (I've been using it and it's predeccesor for decades), and I go through mail faster than most people I know as I can type faster than they can click buttons, scroll, and drag windows around. However, it sort of sucks when you read formatted mail HTML with lots of graphics). Joseph Tam <jtam.home(a)gmail.com>

1 0

Generalized looping possible in pigeonhole sieve?
by Jeff Kletsky 18 Nov '16

18 Nov '16

I'm struggling to achieve the kind of filtering with sieve that I was able to do with procmail. TL;DR I'd like a way to loop through a set of (address, destination) pairs in sieve so that I can maintain the (address, destination) pairs in one place and not have to explicitly write scores of nearly identical [...] if address :matches ["From", "Sender", "To", "Cc"] "address53" { fileinto "destination53" } if address :matches ["From", "Sender", "To", "Cc"] "address54" { fileinto "destination54" } [...] Longer: I've been using a table-based dispatch approach with procmail for years and it was working reasonably well. The approach uses list of pairs of address and destination boxes and doing a lookup based on the message to be delivered. With procmail, I collected the list of addresses and passed them to external scripts to do the lookup. If I just had a dozen boxes that I deal with, that would be straightforward to implement and maintain in sieve. As the list is an order of magnitude greater than that, maintaining the list of pairs in an external file and programmatically looping through it is a lot easier. I've looked at vnd.dovecot.execute and it certainly can return a destination box name given the input information. Unfortunately, the construct of (for example) address :matches "To" "*"' only returns the first address, not the list of addresses. I can't see a good way to get all the addressees from sieve to pass to the external program. If I have to pass the message (or at least the interesting headers) to the external program and then parse the address list myself, then I'm nearly all the way to just using a full-on external program to parse the whole message. While I'm not adverse to writing the whole thing in Python (or the like) and just using sieve as a thin shell, I'd like to make sure I'm not missing something in sieve. One way to achieve this would be to be able to loop through the pairs and using variable substitution for each iteration. I haven't seen anything in Dovecot Pigeonhole sieve that allows this. If you have any ideas on how to harness sieve for this, I'd appreciate it! Jeff

3 2

BUG: nopassword doesn't work with CRAM-MD5
by Arkadiusz Miśkiewicz 18 Nov '16

18 Nov '16

Hello. dovecot 2.2.26.0 When testing nopassword extra field (http://wiki2.dovecot.org/PasswordDatabase/ExtraFields) with CRAM-MD5 dovecot doesn't allow any password (while it should) and returns " Authentication failed" while in logs: Nov 17 08:22:34 auth-worker(1551): Info: sql(pepe,127.0.0.1,<Y8amDXpBptV/AAAB>): Requested CRAM-MD5 scheme, but we have a NULL password NULL is there because our sql query returns empty password just like wiki says "nopassword: you want to allow all passwords, use an empty password and this field. " If password is returned in sql query then it fails, too: Nov 17 09:00:49 auth-worker(2206): Error: sql(pepe,127.0.0.1,<eO5vlnpBtNd/AAAB>): nopassword set but password is non- empty So looks to be a bug. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 6

Any way to simplify repeated use of same string-list?
by Jeff Kletsky 18 Nov '16

18 Nov '16

I often use the same set of header names when doing an 'address' comparison. I would prefer to be able to specify that once, then re-use it in several places. As an example set "address_mailman_fields" "\"To\", \"Cc\", \"From\", \"Errors-To\""; if address :domain :matches ["${address_mailman_fields}"] "example.com" { [...] } if address :domain :matches ["${address_mailman_fields}"] "dovecot.org" { [...] } or the like would be quite helpful. From what I can tell, even though the variable interpolation *looks* like a string-list, it isn't parsed as such. For example, from sieve-test output: sieve-test(jeff): Debug: Mailbox <filename> Opened mail UID=1 because: header "To", "Cc", "From", "Errors-To" (Cache file is unusable) testing: line 27: info: DEBUG: address ["${address_mailman_fields}"] didn't match. sieve-test(jeff): Debug: Mailbox <filename> Opened mail UID=1 because: header ["To", "Cc", "From", "Errors-To"] (Cache file is unusable) testing: line 34: info: DEBUG: address "[${address_mailman_fields}]" didn't match. Is there any trick available to specify a string-list once, then re-use it throughout the script? Thanks, Jeff

1 0

dovecot pre-install issue
by soumitri＠iitk.ac.in 17 Nov '16

17 Nov '16

Hello all, I am going for a dovecot director based setup (2 director+ 2 imap), more imap servers will be added later depending on demand/load. Presently I have 12000+ dovecot users with Maildir quota varying from 1 GB to 20GB. (peak hour IOPS 50000+) I am having 2 options in choosing dovecot version. 1) Old stable release. I.e RHEL, with prebuilt binary. This will be having less trouble in managing. Why RHEL still using version 2.2.10. 2) Latest release with best features and lesser known bugs. I.e CentOS7 with with latest compiled version. I have to be more involved if a bug is found. I will prefer a less admin work after the setup, with all/most features working. If you have a recent similar setup/dovecot gurus, Pl. suggest. With thanks & regards, -- Soumitri Mishra http://home.iitk.ac.in/~soumitri/

3 5