October 2016 - dovecot

Dict proxy client returning empty string instead of multiline string
by Pierre Jaury 18 Oct '16

18 Oct '16

Hello, I am using a dict proxy for my sieve extdata plugin to access some fields from an SQLite database (autoreply text and other database-configured items). All tests are performed against version 2.2.25. $ dovecot --version 2.2.25 (7be1766) My configuration looks like: dict { sieve = sqlite:/etc/dovecot/pigeonhole-sieve.dict } [...] sieve_extdata_dict_uri = proxy::sieve I am able to read pretty much any attribute without any issue, except when the value contains a special character like "\r" or "\n". By using the doveadm dict client, I narrowed it down to the dictionary management part (either server, protocol or client). I was suspecting escaping functions from "lib/strescape.c" (mostly str_tabescape and its counterpart, used by "lib-dict/client.c"), so I monitored socket communications. It seems that escaping is done properly on the server and the socket is not an issue either. The following strace dump results from running "doveadm dict get" against the dict socket: connect(8, {sa_family=AF_UNIX, sun_path="..."}, 110) = 0 fstat(8, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 [...] write(8, "H2\t0\t0\tadmin(a)domain.tld\tsieve\n", 30) = 30 [...] read(8, "Otest\1r\1ntest\n", 8192) = 14 Indeed "\1r" and "\1n" are the escape sequences used by "lib/strescape.c". I went deeped and debugged the call to "dict_lookup" performed by doveadm. Indeed the client gets the proper string from the socket and to my surprise, it is properly unescaped. Then, in "client_dict_lookup" ("lib-dict/dict-client.c"), the call to "p_strdup" returns an empty string (null byte set at the target address). Before the call to the dict "->lookup" attribute (client_dict_lookup): RAX: 0x7ffff73a37c0 (push r14) RBX: 0x6831b8 ("priv/reply_body") RCX: 0x7fffffffe240 --> 0x682a60 --> 0x6831b8 ("priv/reply_body") RDX: 0x6831b8 ("priv/reply_body") RSI: 0x683288 --> 0x7ffff7653120 --> 0x7ffff73ea620 ([...]) RDI: 0x690ad0 --> 0x7ffff7400713 --> 0x75250079786f7270 ('proxy') 0x7ffff73a1f10 <dict_lookup+32>: mov rcx,r11 (value_r) 0x7ffff73a1f13 <dict_lookup+35>: mov rdx,r8 (key) 0x7ffff73a1f16 <dict_lookup+38>: mov rsi,r10 (pool) 0x7ffff73a1f19 <dict_lookup+41>: mov rdi,r9 (dict) 0x7ffff73a1f1c <dict_lookup+44>: add rsp,0x8 => 0x7ffff73a1f20 <dict_lookup+48>: jmp rax Before the call to p_strdup in "client_dict_lookup": RSI: 0x6832d8 ("test\r\ntest") (lookup.result.value) RDI: 0x683288 --> 0x7ffff7653120 --> [...] (pool) RAX: 0x0 (result) 0x7ffff73a384f: nop 0x7ffff73a3850: mov rsi,QWORD PTR [rsp+0x8] 0x7ffff73a3855: mov rdi,r14 => 0x7ffff73a3858: call 0x7ffff736d3c0 <p_strdup@plt> 0x7ffff73a385d: mov QWORD PTR [r13+0x0],rax 0x7ffff73a3861: mov rsi,QWORD PTR [rsp+0x18] 0x7ffff73a3866: xor rsi,QWORD PTR fs:0x28 0x7ffff73a386f: mov eax,ebx After the call: 0x7ffff73a3850: mov rsi,QWORD PTR [rsp+0x8] 0x7ffff73a3855: mov rdi,r14 0x7ffff73a3858: call 0x7ffff736d3c0 <p_strdup@plt> => 0x7ffff73a385d: mov QWORD PTR [r13+0x0],rax 0x7ffff73a3861: mov rsi,QWORD PTR [rsp+0x18] 0x7ffff73a3866: xor rsi,QWORD PTR fs:0x28 0x7ffff73a386f: mov eax,ebx 0x7ffff73a3871: jne 0x7ffff73a38da RSI: 0x0 RDI: 0x6832d8 --> 0x0 RAX: 0x6832d8 --> 0x0 (result) It is worth noting that I can reproduce the exact same execution flow with a non-multiline result string (lookup.result.value) that is properly copied by "p_strdup" and returned in RAX, then displayed by doveadm. I am not familiar with the pooling mechanism hidden behind the call to p_strdump and not quite sure why this behaviour is emerging. Maybe I am even miles away from an understanding of the issue here, but it sounds to me like something is wrong in the way "p_strdup" performs the copy. Hope this helps, kaiyou.

2 11

Re: First steps in Dovecot; IMAP not working
by Joseph Tam 18 Oct '16

18 Oct '16

Marnaud <anic297(a)mac.com> writes: > "mailtest", the new user, is in group mail(8). In addition, I've added > write permission for "others" to /var/mail. Now, I'm trying to send a > message to "mailtest" from another, working, e-mail account and nothing > happens. This time, "doveadm log errors" is empty. > > In short, I don't get any error but no mail either. Two things to check: # What does dovecot think user "mailtest" has? doveadm user mailtest # The sticky bit should be set on /var/mail (you didn't mention # setting it. It probably doesn't have bearing on this problem, # but it will make it a little more secure. chmod 1777 /var/mail > Since "doveadm log errors" returns an empty result, where should I look > for the problem? I usually don't use this command, I look at the log file which seems to have more details. Try looking there for more diagnostics. Also, look at your MTA's logs as well. Joseph Tam <jtam.home(a)gmail.com>

4 4

Warning: Sent SIGKILL to 100 imap-login processes
by Ximo Mira 18 Oct '16

18 Oct '16

Hi, Last night we tried a traffic bypass in an existing mail environment before migration to new Dovecot backend platfom using Dovecot proxy. We are using an LDAP value for checking the proxy host of the user. POP traffic was running flawlessly, but IMAP connections started to drop when few clients connected: Oct 17 22 :26:51 master: Warning: Sent SIGKILL to 100 imap-login processes There are hundreds of these lines, always between 99 and 100 processes. Looks like some kind of limit, but not sure if its related to the Dovecot proxy machines (pool of 3 in total) or the final destination (the same IMAP server for +10000 users). Concurrect IMAP connections may rise to around 2000. Thanks.

2 1

dovecot 2.2.25 BUG: local_name is not matching correctly
by Arkadiusz Miśkiewicz 17 Oct '16

17 Oct '16

Bug report: When using dovecot 2.2.25 SNI capability it doesn't always match proper vhost config. For example if we have such config: local_name imap.example.com { ssl_cert = </etc/certs/cert.imap.example.com.pem ssl_key = </etc/certs/cert.imap.example.com.pem } but imap client sends mixedcase SNI hostname like "IMAP.example.com" then dovecot won't match above local_name imap.example.coml config section. IMO dovecot should do case insensitive comparison. Case sensitive matching for DNS names makes little sense. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 2

Massive LMTP Problems with dovecot
by Ralf Hildebrandt 17 Oct '16

17 Oct '16

Currently I'm having massive problems with LMTP delivery into dovcot. dovecot/lmtp processes are piling up, eas using considerable amounts of CPU: # ps auxwww|fgrep dove root 20537 0.0 0.0 18124 1196 ? Ss 15:18 0:00 /usr/sbin/dovecot -c /etc/dovecot/dovecot.conf dovecot 20541 0.0 0.0 9620 1084 ? S 15:18 0:00 dovecot/anvil root 20542 0.0 0.0 9752 1264 ? S 15:18 0:00 dovecot/log root 20544 0.0 0.0 21168 2276 ? S 15:18 0:00 dovecot/config copymail 20580 72.8 0.0 39556 7036 ? R 15:18 2:00 dovecot/lmtp dovecot 20582 0.0 0.0 18568 1756 ? S 15:18 0:00 dovecot/auth copymail 20597 77.2 0.0 35688 5136 ? R 15:18 2:06 dovecot/lmtp copymail 20598 39.3 0.0 38060 5596 ? R 15:18 1:04 dovecot/lmtp copymail 20613 62.3 0.0 38036 5600 ? R 15:18 1:41 dovecot/lmtp copymail 20619 56.4 0.0 37732 7448 ? R 15:18 1:31 dovecot/lmtp copymail 20620 75.9 0.0 35872 5336 ? R 15:18 2:03 dovecot/lmtp copymail 20627 37.8 0.0 36480 5892 ? R 15:18 1:01 dovecot/lmtp copymail 20838 60.5 0.0 35640 5036 ? R 15:19 0:59 dovecot/lmtp copymail 20840 66.3 0.0 35920 5296 ? R 15:19 1:04 dovecot/lmtp copymail 20841 66.0 0.0 37456 6852 ? R 15:19 1:04 dovecot/lmtp copymail 20842 64.5 0.0 36424 5808 ? R 15:19 1:02 dovecot/lmtp copymail 20843 67.6 0.0 39612 7064 ? R 15:19 1:05 dovecot/lmtp doveadm stop won't stop these, I have to use kill -9 on them. I already tried disabling fts (entirely), still things won't speed up. I can't strace: # strace -p 20841 Process 20841 attached (and that's it) # dpkg -l|grep dovecot ii dovecot-core 2:2.2.25-1~auto+57 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.2.25-1~auto+57 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.2.25-1~auto+57 amd64 secure POP3/IMAP server - LMTP server ii dovecot-lucene 2:2.2.25-1~auto+57 amd64 secure POP3/IMAP server - Lucene support ii dovecot-sieve 2:2.2.25-1~auto+57 amd64 secure POP3/IMAP server - Sieve filters support I also tried deleting the mdboxes, that also didn't change anything. Ideas? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

2 1

Re: First steps in Dovecot; IMAP not working
by Marnaud 17 Oct '16

17 Oct '16

Sorry, my previous message got mangled. I'm re-writing it, quoting manually. I apologize for the traffic. >(Sorry I read this list in digest form so frequently I'm half a step behind.) No problem. >No, it's quite explicit. User "webuser" has uid/gid = 1001(webuser)/1000(ftpusers). Your mail spool has permission uid/gid = root(0)/mail(8), neither of which allows webuser to write to this mail spool to creates its own mail folder. You're right (I don't have enough Unix habits, it seems...). I couldn't change this user (it must be in the ftpusers group for other purposes), so I tried adding another user for testing mail. "mailtest", the new user, is in group mail(8). In addition, I've added write permission for "others" to /var/mail. Now, I'm trying to send a message to "mailtest" from another, working, e-mail account and nothing happens. This time, "doveadm log errors" is empty. In short, I don't get any error but no mail either. >Aki Tuomi <aki.tuomi(a)dovecot.fi> replies with several solutions: >>In your configuration, dovecot uses whatever user/group returned by PAM. Since the webuser has never logged in, it has no directory under /var/mail. If you want, you can >>a) override mail_uid and mail_gid in userdb/passdb >>b) pre-create /var/mail/webuser and chown it to webuser:ftpusers >>c) you can let ftpusers write to /var/mail. Ok, I thought I had to do all of them (and didn't understand step a)). So I've done step c) by allowing everyone write access. >Or if you dynamically/frequently onboard mail accounts, and users cannot arbitrarily write into this directory, you can "chmod 1777 /var/mail/" and let dovecot auto-create it (might also want to set "lda_mailbox_autocreate = yes". I've done it right now; same problem. Since "doveadm log errors" returns an empty result, where should I look for the problem? Thank you.

1 0

Re: First steps in Dovecot; IMAP not working
by Joseph Tam 17 Oct '16

17 Oct '16

(Sorry I read this list in digest form so frequently I'm half a step behind.) > For sake of ?security?, I chose to not allow plaintext communication > (being new to this, I think being strict is a good choice). I?ve tried > with the openssl option and it successfully logged in. Yes, you've included some more log entries, which makes the problem clearer, as it usually does. > Oct 13 05:56:28 imap(webuser): Error: open(/var/mail/webuser) failed: > Permission denied (euid=1001(webuser) egid=1000(ftpusers) missing +w perm: > /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) > ... > I checked, using ls -l /var, and I get this: > drwxrwsr-x 2 root mail 4096 Apr 27 11:27 mail > so the group looks to be correctly set to 'mail', despite what the log says, > right? No, it's quite explicit. User "webuser" has uid/gid = 1001(webuser)/1000(ftpusers). Your mail spool has permission uid/gid = root(0)/mail(8), neither of which allows webuser to write to this mail spool to creates its own mail folder. Aki Tuomi <aki.tuomi(a)dovecot.fi> replies with several solutions: > In your configuration, dovecot uses whatever user/group returned by > PAM. Since the webuser has never logged in, it has no directory under > /var/mail. If you want, you can > > a) override mail_uid and mail_gid in userdb/passdb > b) pre-create /var/mail/webuser and chown it to webuser:ftpusers > c) you can let ftpusers write to /var/mail. Or if you dynamically/frequently onboard mail accounts, and users cannot arbitrarily write into this directory, you can "chmod 1777 /var/mail/" and let dovecot auto-create it (might also want to set "lda_mailbox_autocreate = yes". Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: First steps in Dovecot; IMAP not working
by Aki Tuomi 17 Oct '16

17 Oct '16

On 13.10.2016 12:42, Marnaud wrote: > > "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> doveconf -n shows what's there. if you have ssl=no somewhere else in the >> config after you set it to required, it gets overwritten. >> >> Aki > > Thanks, Aki. > It means I have to open each conf file (e.g. using nano) and search > for ssl=no; I'm right or there's a specific file to check? I see you replied to me only, please keep your replies on-list. Try grep -r ssl.*no /etc/dovecot Aki

4 13

Latest HG Changes (fac92b5) affect Sieve-Plugin/LMTP
by Thomas Leuxner 15 Oct '16

15 Oct '16

# 2.2.devel (c73322f): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (fac92b5) # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 ==> /var/log/dovecot/dovecot.log <== Oct 15 09:50:15 nihlus dovecot: lmtp(11447): Connect from local Oct 15 09:50:15 nihlus dovecot: lmtp(tlx(a)leuxner.net): Panic: file lda-sieve-plugin.c: line 447 (lda_sieve_execute_scripts): assertion failed: (script != NULL) Oct 15 09:50:15 nihlus dovecot: lmtp(tlx(a)leuxner.net): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x938ae) [0x7fd161fc18ae] -> /usr/lib/dovecot/libdovecot.so.0(+0x9399c) [0x7fd161fc199c] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fd161f5b6de] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3af8) [0x7fd15fdf8af8] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x49) [0x7fd16258bb39] -> dovecot/lmtp [DATA tlx(a)leuxner.net](+0x724e) [0x7fd1629bc24e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x4c) [0x7fd161fd5e4c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10a) [0x7fd161fd730a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x25) [0x7fd161fd5ed5] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fd161fd6078] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fd161f61be3] -> dovecot/lmtp [DATA tlx(a)leuxner.net](main+0x1a2) [0x7fd1629ba382] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7fd161ba4b45] -> dovecot/lmtp [DATA tlx(a)leuxner.net](+0x5430) [0x7fd1629ba430] Oct 15 09:50:15 nihlus dovecot: lmtp(tlx(a)leuxner.net): Fatal: master: service(lmtp): child 11447 killed with signal 6 (core not dumped)

3 9

Re: First steps in Dovecot; IMAP not working
by Joseph Tam 14 Oct '16

14 Oct '16

Moi <anic297(a)mac.com> wrote: > I've made some more tests and I still can't receive mails; sending them > still works. I don't receive any error message, just the mails that are > supposed to be received won't come. > In the mail logs, I find only this relevant line: > dovecot: imap-login: Aborted login (no auth attempts in 2 secs): user=<> Did you post doveconf -n (I didn't catch the head of this thread)? That would be step 0. A good first step is to test whether you have basic authentication working (to separate out if you have a server or client issue). I assume you allow plaintext communication, but if not, substitute telnet with "openssl sclient -connect your-server:993": C: # telnet your-server 143 S: * OK [CAPABILITY ... C: x1 login testuser theirpassword If you get an OK response to this, it may be a client issue (check settings on client). If you get an error or failure, look inward: check logs and config. Joseph Tam <jtam.home(a)gmail.com>

2 1