- Dovecot-news - dovecot.org

v1.2.11 released
by Timo Sirainen 08 Mar '10

08 Mar '10

http://dovecot.org/releases/1.2/dovecot-1.2.11.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.11.tar.gz.sig mbox users really should upgrade, because by sending a message with a huge header you could basically cause a DoS (this problem exists only with v1.2.x, not with v1.0 or v1.1). - mbox: Message header reading was unnecessarily slow. Fetching a huge header could have resulted in Dovecot eating a lot of CPU. Also searching messages was much slower than necessary. - mbox, dbox, cydir: Mail root directory was created with 0770 permissions, instead of 0700. - maildir: Reading uidlist could have ended up in an infinite loop. - IMAP IDLE: v1.2.7+ caused extra load by checking changes every 0.5 seconds after a change had occurred in mailbox

1 0

v2.0.beta3 released
by Timo Sirainen 20 Feb '10

20 Feb '10

http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta3.tar.gz http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta3.tar.gz.sig I had to break a few APIs in this release to get some other stuff implemented and fixed. And since I had to break some of them, I decided it could be a good time to do some other less necessary API cleanups. This made things again much simpler. I'm hoping to get v2.0.rc1 out in not too distant future. Pretty much the only big missing feature that I wanted to do is being able to add per-protocol auth settings (e.g. protocol smtp { userdb { .. } }), but that doesn't seem to be all that easy to implement. There are of course some bugs still left to be fixed, mainly related to mdbox and dsync. User visible changes: - imap_zlib plugin implements COMPRESS=DEFLATE IMAP extension - zlib plugin: Added support for compressing mails while saving - zlib plugin: fixed reading bzip2 compressed mail files - zlib plugin: Added support for dbox and mdbox formats - mdbox: doveadm purge moves old mails to alt storage (if using alt storage) - added support for tcpwrappers - added support for SHA512 password scheme (by Mark Washenberger) - mailbox deletion is now free of race conditions (e.g. quota calculations). if another session tries to access mailbox before it's fully deleted, it'll get "Mailbox is being deleted" error. - "key = $set" in config file now sets key's value to "set" setting's value. this is probably rather limited outside the only place where I created it for: service { user = $default_internal_user } - default_internal_user and default_login_user settings now specify what users should be used for them. currently the default is still dovecot and dovecot, but I'm hoping to change default_login_user to something else.. - Removed maildir_copy_preserve_filename setting. It's now always tried to be preserved (or rather: message's GUID is preserved) - auth failure penalty tries to avoid increasing penalty for IP if auth is failing always with the same user+password combination. - doveadm penalty command can be used to see the current penalties - login processes: config lookups are now cached, so it no longer asks for configuration from config process every time (except if there are remote {} blocks in config. also the local {} caching could be smarter.) - Tons of mdbox fixes - Tons of dsync fixes, especially with mbox So some of the changes visible to developers are: - dovecot-config file changed. if your external plugin uses this file, you need to change it to use the new format. - added dovecot.m4 file that can be used by external plugins' configure script to get Dovecot settings. This was mainly done by Dennis Schridde. - mailbox_alloc() no longer has stream parameter, instead there's mailbox_open_stream() - mailbox_close() renamed to mailbox_free(). added a different mailbox_close(), which only closes opened mailbox, but doesn't free it. - mailbox_delete(), mailbox_rename() APIs changed - notify plugin's delete/rename API changed as well - mailbox GUID is now looked up using mailbox_get_guid(), not mailbox_status() - dict_iterate*() API changed

1 0

Dovecot blog
by Timo Sirainen 19 Feb '10

19 Feb '10

http://blog.dovecot.org/ I was thinking that I could blog about: - ideas for new Dovecot feature designs - when I actually manage to implement some new great feature - maybe some stuff about IMAP/email in general - and maybe whenever I happen to be moving to a different country I wasn't really planning on announcing new releases there. Dovecot feature designs are also sent to Dovecot mailing list, as before. But there have been other things I've thought about mentioning somewhere, but Dovecot ML didn't really seem like the right place. I doubt I'll update the blog very often. But that probably makes it even more useful, since casual readers find the useful stuff quickly. :)

1 0

v2.0.beta2 released
by Timo Sirainen 31 Jan '10

31 Jan '10

http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta2.tar.gz http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta2.tar.gz.sig I tried to keep the configuration and APIs compatible with v2.0.beta1, but unfortunately there were a few things that really had to be changed: 1. passdbs and userdbs have now a separate "driver" setting inside them. So for example if you had: userdb passwd { } You'll now need to use instead: userdb { driver = passwd } 2. Services now have default inet_listeners. You need to either remove your existing ones, or override the defaults by giving the listeners's name like shown in the new example master.conf. For example if you had: service imap-login { inet_listener { port = 1234 .. change it to: service imap-login { inet_listener imap { port = 1234 If you want to disable a default listener, you can set its port to 0. Some new features: - Added auth_verbose_passwords = no|plain|sha1. If authentication fails, this setting logs the used password. If you don't really need to know what the password itself was, but are more interested in knowing if the user is simply trying to use the wrong password every single time or if it's a brute force attack, you can set this to "sha1" and only the SHA1 of the password is logged. That's enough to know if the password is same or different between login attempts. - lazy-expunge: Support a single-namespace configuration. In this setup if mailbox has some expunged messages and then the whole mailbox gets deleted, they get merged into the same deleted mailbox. - protocol !imap { .. } adds configuration to all protocols except imap. - imap/pop3 proxying supports now async DNS lookups for hosts. There's a separate dns-client service doing the lookups using OS's own blocking resolver. - dovecot-config file changed in a way that it'll be easier to create external software linking against dovecot libraries. This made Pigeonhole's configure script a lot simpler. And of course there have been lots of fixes.

1 0

Released Pigeonhole Sieve v0.1.15 and ManageSieve v0.11.11 for Dovecot v1.2.10
by Stephan Bosch 25 Jan '10

25 Jan '10

Hello Dovecot users, It's been a while since the last Pigeonhole Sieve and ManageSieve releases. That is why this release includes quite a few changes. Most interestingly, the include extension is updated to match the most recent specification, the Sieve interpreter now includes plugin support and ManageSieve now has support for enforcing quota on the size of scripts, the number of scripts and the space the scripts occupy on disk. Other than that, quite a few small bugs were fixed. One of which was in the i;ascii-numeric comparator. If one of the matched strings did not start with a digit, the comparator would always yield a 'less-than' result. In stead it should have considered the string starting with the non-digit character as having a positive infinite value. Elsewhere in this list, Julian Cowley pointed out that negative values also start with a non-digit character, which some people may not have understood (i.e. i;ascii-numeric works only on unsigned values). The bug fix in this release could therefore change result of certain misconceived (and probably spam-related) Sieve rules, so watch out! I started work on the spamtest(plus) and virustest extensions. These are implemented for the most part, but their configurability needs quite a bit more work. Changelog Sieve v0.1.15: * Enotify extension: - Adjusted notify method API for addition of new notification methods. - Set default importance level to 'normal' (was 'high'). * Include extension: updated implementation towards most recent specification (all should be backwards compatible): - Implemented global variables namespace. - Global command may now appear anywhere in a script. - Implemented script name checking using the requirements specified in the ManageSieve draft. - One issue remains: ManageSieve currently requires included scripts to be uploaded first, which is not according to specification. * Changed envelope path parser to allow to and from envelope addresses that have no domain part. + Added preliminary support for Sieve plugins and added support for installing Sieve development headers. + Started work on the implementation of the spamtest, spamtestplus and virustest extensions (unfinished). + Deprecated notify extension: implemented denotify command. + Variables extension: added support for variable namespaces. + Added configurable script size limit. Compiler will refuse to compile files larger than sieve_max_script_size. + Testsuite changes: - Added support for changing and testing an extension's configuration. - Added a command line parameter for copying errors to stderr. - Fixed a bug in the i;ascii-numeric comparator. If one of the strings started with a non-digit character, the comparator would always yield less-than. - Imap4flags extension: fixed bug in removeflag: removing a single flag failed due to off-by-one error (bug report by Julian Cowley). - Improved EACCES error messages for stat() and lstat() syscalls and slightly improved error messages that may uccur when saving a binary. - Vacation extension: fixed typo in runtime log message (patch by Julian Cowley). - Fixed use of minus '-' in man pages; it is now properly escaped. - Fixed parser recovery. In particular cases it would trigger spurious errors after an initial valid error and sometimes additional errors were inappropriately ignored. Changelog ManageSieve v0.11.11: * This release contains adjustments to match changes in the Sieve API. This means that this release will only compile against Pigeonhole Sieve v0.1.15. + Implemented ManageSieve QUOTA enforcement. + Added MAXREDIRECTS capability after login. + Implemented new script name rules specified in most recent ManageSieve draft. - Fixed assertion failure occuring with challenge-response SASL mechanisms. - Made configure complain about trying to compile against installed Dovecot headers alone. - Fixed compile warning for compilation against CMUSieve. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.15.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.15.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.11.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.11.tar.gz.… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.10-managesieve-0.11.11.diff… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.10-managesieve-0.11.11.diff… Refer to http://pigeonhole.dovecot.org for more information. Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.10 released
by Timo Sirainen 25 Jan '10

25 Jan '10

http://dovecot.org/releases/1.2/dovecot-1.2.10.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.10.tar.gz.sig The Maildir bugs were common for everyone, although only NFS users seemed to notice for some reason. + %variables now support %{host}, %{pid} and %{env:ENVIRONMENT_NAME} everywhere. + LIST-STATUS capability is now advertised - maildir: Fixed several assert-crashes. - imap: LIST "" inbox shouldn't crash when using namespace with "INBOX." prefix. - lazy_expunge now ignores non-private namespaces.

1 0

Released Pigeonhole Sieve v0.1.14 and ManageSieve v0.11.10 for Dovecot v1.2.9
by Stephan Bosch 19 Dec '09

19 Dec '09

Hello Dovecot users, Due to personal matters I haven't had time to do anything in the last few weeks. Before that I provided some pre-releases and since nobody indicated problems with those, I release them definitively now. I hope the shit storm has blown over, so that I can dedicate more of my time towards Pigeonhole development. The Sieve release involves a large architectural change, but also fixes quite a few small problems. The ManageSieve release is necessary to match Sieve API changes. Changelog Sieve v0.1.14: * Made the imposed limits on the number of redirects and the number of actions configurable. The settings are called sieve_max_actions and sieve_max_redirects. * Did a major rework of extension handling, making sure that no global state is maintained. This change was triggered by problems that global state info would cause for Dovecot v2.0, but it is also important for v1.2 as it significantly cleans up the library implementation. + Made LDA Sieve plugin recognize the deliver_log_format setting. + Message headers produced from user-supplied data are now RFC2047-encoded if necessary for outgoing messages. This is for example important for the :subject argument of the vacation action. + Added support for the $text$ substitution in the deprecated notify extension. + The subaddress extension now also accepts recipient_delimiter setting as an alias for sieve_subaddress_sep setting. This anticipates the recipient_delimiter setting in v2.0. - Fixed logging of mailbox names. It logged the converted mUTF7 version in stead of the original UTF8 version supplied by the user. - Fixed a minor memory leak in the multiscript support. - Fixed a bug in the recompilation of Sieve scripts. Made sure that scripts are only recompiled when the script file - or the symlink pointing to it - is strictly newer. Changelog ManageSieve v0.11.10: * This release contains adjustments to match changes in the Sieve API. This means that this release will only compile against Pigeonhole Sieve v0.1.14. - Fixed compilation of ManageSieve against CMUSieve. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.14.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.14.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.10.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.10.tar.gz.… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.9-managesieve-0.11.10.diff.… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.9-managesieve-0.11.10.diff.… Refer to http://pigeonhole.dovecot.org for more information. Have fun testing the new releases and don't hesitate to notify me when there are problems. Releases for Dovecot v2.0 are still under development... Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v1.2.9 released
by Timo Sirainen 16 Dec '09

16 Dec '09

http://dovecot.org/releases/1.2/dovecot-1.2.9.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.9.tar.gz.sig Hopefully this release will be enough bug-free that I don't need to make v1.2 releases for next few months. * maildir: When saving, filenames now always contain ,S=<size>. Previously this was done only when quota plugin was loaded. It's required for zlib plugin and may be useful for other things too. + lazy-expunge: Support a single-namespace configuration. If a mailbox is deleted, its messages are merged with its old expunged messages (if there were any). + expire: Settings now support spaces in mailbox names by using quoted strings. - maildir: v1.2.7 and v1.2.8 caused assert-crashes in maildir_uidlist_records_drop_expunges() - maildir_copy_preserve_filename=yes could have caused crashes. - Maildir++ quota: % limits weren't updated when limits were read from maildirsize. - virtual: v1.2.8 didn't fully fix the "lots of mailboxes" bug - virtual: Fixed updating virtual mailbox based on flag changes. - fts-squat: Fixed searching multi-byte characters.

1 0

v2.0.beta1 released
by Timo Sirainen 14 Dec '09

14 Dec '09

http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta1.tar.gz http://dovecot.org/releases/2.0/beta/dovecot-2.0.beta1.tar.gz.sig Now that v2.0 is in beta stage I don't expect anything big to change anymore. The configuration and the APIs shouldn't change in non-backwards compatible ways. There are still bugs left to be fixed and some small features to be implemented, but I'd like to have people start testing it more. The biggest unimplemented "feature" is how to convert v1.x configuration easily/automatically to v2.0. Either the old config file should be translated to new one, or Dovecot should be able to read the old config file as-is. I think I like the translation better, so that people won't still be using v1.x configuration when v2.1 arrives and drops v1.x support. Largest changes since alpha3: - if some IP address is failing authentications, all auth attempts from the IP are delayed increasingly. a successful auth drops the delay. max delay is 15 seconds. this is enforced by auth process, so it works across different connections/processes/protocols. - lib-storage plugin API changed. processes handling multiple users now support different plugins for different users. - expire plugin's settings work a bit differently now: http://hg.dovecot.org/dovecot-2.0/rev/46691becc45e - post-login scripting works again, see http://dovecot.org/list/dovecot/2009-December/045139.html - Tons of fixes

1 0

v1.2.8 released
by Timo Sirainen 20 Nov '09

20 Nov '09

http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.8.tar.gz.sig This is mainly to fix the 0777 base_dir creation issue, which could be considered a security hole, exploitable by local users. An attacker could for example replace Dovecot's auth socket and log in as other users. Gaining root privileges isn't possible though. This affects only v1.2 users, v1.1 and older versions were creating the directory with 0755 permission. If your Dovecot's base_dir isn't in /var/run/dovecot/, you should also make sure that the $prefix/var/ and $prefix/var/run/ (i.e. /usr/local/var/, /usr/local/var/run/ by default) aren't 0777. * Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually. - acl: If user has rights from more than one group, merge them instead of choosing one group's rights and ignoring others. - virtual: When using a lot of mailboxes, the virtual mailbox's header could have grown over 32 kB and caused "out of memory" crashes. Also over 64 kB headers couldn't even be updated with existing transaction log records. Added a new record type that gets used with >=64 kB headers. Older Dovecot versions don't understand this header and will log errors if they see it. - FETCH BODYSTRUCTURE didn't return RFC 2231 "key*" fields correctly

1 0