[Dovecot] Avelsieve 1.9.7 and Dovecot/TLS

Hi,

i'm installing a new mail server for our faculty and want to use the squirrelmail plugin 'avelsieve' (1.9.7). As documented on the dovecot wiki there is a problem in the STARTTLS code and i found a solution (that works for my installation):

i've traced the server output in 'get_response' and instead of a script list i saw "IMPLEMENTATION". So i took a look at the file 'managesieve.lib.php' and the STARTTLS code:

/* If we allow STARTTLS, use it */
if($this->capabilities['starttls'] === true && function_exists('stream_socket_enable_crypto') === true) {
    fputs($this->fp,"STARTTLS\r\n");
    $starttls_response = $this->line=fgets($this->fp,1024);
    if(stream_socket_enable_crypto($this->fp, true, STREAM_CRYPTO_METHOD_TLS_CLIENT) == false) {
        $this->error=EC_UNKNOWN;
        $this->error_raw = "Failed to establish TLS connection.";
        return false;
    } else {
        $this->loggedin = true;
        
        // RFC says that we need to ask for the capabilities again
        $this->sieve_get_capability();
        $this->loggedin = false;
    }   
}
 

With my limited time and debugging possibilities i've found that the dovecot managesieve server seems to send capability lines 'automagically'. I've added a few "debugging" lines

/* If we allow STARTTLS, use it */
if($this->capabilities['starttls'] === true && function_exists('stream_socket_enable_crypto') === true) {
    fputs($this->fp,"STARTTLS\r\n");
    $starttls_response = $this->line=fgets($this->fp,1024);
    if(stream_socket_enable_crypto($this->fp, true, STREAM_CRYPTO_METHOD_TLS_CLIENT) == false) {
        $this->error=EC_UNKNOWN;
        $this->error_raw = "Failed to establish TLS connection.";
        return false;
    } else {
        $this->loggedin = true;
        

$starttls_response = $this->line=fgets($this->fp,1024); $errormsg .= _("MFI fgets ") . $starttls_response . '<br>'; print_errormsg($errormsg);

        // RFC says that we need to ask for the capabilities again
        $this->sieve_get_capability();
        $this->loggedin = false;
    }   
}

and could read

    MFI fgets "IMPLEMENTATION" "dovecot"

what will throw the following 'sieve_get_capability' out of sync. Then i've added a second 'fgets' and received:

    MFI fgets "SASL" "PLAIN"

Then i've added a third 'fgets' and received:

    MFI fgets "SIEVE" "fileinto reject envelope vacation imapflags notify subaddress relational comparator-i;ascii-numeric regex"

Then i've added a fourth 'fgets' and received:

    MFI fgets OK "TLS negotiation successful."

Now the protocol should be in sync again and after removing the lines

    $errormsg .= _("MFI 1 fgets ") . $starttls_response . '<br>';
    print_errormsg($errormsg);

i could load my scripts back. So, adding four lines reading

    $starttls_response = $this->line=fgets($this->fp,1024);
    $starttls_response = $this->line=fgets($this->fp,1024);
    $starttls_response = $this->line=fgets($this->fp,1024);
    $starttls_response = $this->line=fgets($this->fp,1024);

solved the problem. I know this is not a sound "fix", but i hope to help you with this.

One addendum: a "debugging" using my errormsg-printout of the output from

/* If we allow STARTTLS, use it */
if($this->capabilities['starttls'] === true && function_exists('stream_socket_enable_crypto') === true) {
    fputs($this->fp,"STARTTLS\r\n");
    $starttls_response = $this->line=fgets($this->fp,1024);
    

resulted in the response:

    MFI fgets OK "Begin TLS negotiation now."

what looks proper to me, but the negotiation makes the server send the four lines mentioned above.

Cheers