./mail/dovecot2, Secure IMAP and POP3 server

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 2.3.2.1, Package name: dovecot-2.3.2.1, Maintainer: adam

Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems,
written with security primarily in mind. Dovecot is an excellent choice for both
small and large installations. It's fast, simple to set up, requires no special
administration and it uses very little memory.


Required to run:
[archivers/lz4]

Required to build:
[pkgtools/cwrappers]

Package options: kqueue, pam, ssl, tcpwrappers

Master sites:

SHA1: 4f4996db202584d4c54a1a906df870ee16ff02ed
RMD160: b60ac0bd2c20f57cbe272781bd30523c9cbfa8a9
Filesize: 6638.175 KB

Version history: (Expand)


CVS history: (Expand)


   2018-07-14 22:15:33 by Adam Ciarcinski | Files touched by this commit (4) | Package updated
Log message:
dovecot2: updated to 2.3.2.1

v2.3.2 still had a few unexpected bugs:
- SSL/TLS servers may have crashed during client disconnection
- lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
  sometimes assert-crashed.
- v2.3.2: "make check" may have crashed with 32bit systems

v2.3.2 is mainly a bugfix release. It contains all the changes in v2.2.36, as \ 
well as a bunch of other fixes (mainly for v2.3-only bugs). Binary packages are \ 
already in https://repo.dovecot.org/
* old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while
  opening /proc/self/io. This may still cause security problems if the
  process is ptrace()d at the same time. Instead, open it while still
  running as root.
+ doveadm: Added mailbox cache decision&remove commands. See
  doveadm-mailbox(1) man page for details.
+ doveadm: Added rebuild attachments command for rebuilding
  $HasAttachment or $HasNoAttachment flags for matching mails. See
  doveadm-rebuild(1) man page for details.
+ cassandra: Use fallback_consistency on more types of errors
+ lmtp proxy: Support outgoing SSL/TLS connections
+ lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
+ submission: Add support for rawlog_dir
+ submission: Add submission_client_workarounds setting.
+ lua auth: Add password_verify() function and additional fields in
  auth request.
- doveadm-server: TCP connections are hanging when there is a lot of
  network output. This especially caused hangs in dsync-replication.
- Using multiple type=shared mdbox namespaces crashed
- mail_fsync setting was ignored. It was always set to "optimized".
- lua auth: Fix potential crash at deinit
- SSL/TLS servers may have crashed if client disconnected during
  handshake.
- SSL/TLS servers: Don't send extraneous certificates to client when
  alt certs are used.
- lda, lmtp: Return-Path header without '<' may have assert-crashed.
- lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash
- lda: -f parameter didn't allow empty/null/domainless address
- lmtp, submission: Message size limit was hardcoded to 40 MB.
  Exceeding it caused the connection to get dropped during transfer.
- lmtp: Fix potential crash when delivery fails at DATA stage
- lmtp: login_greeting setting was ignored
- Fix to work with OpenSSL v1.0.2f
- systemd unit restrictions were too strict by default
- Fix potential crashes when a lot of log output was produced
- SMTP client may have assert-crashed when sending mail
- IMAP COMPRESS: Send "end of compression" marker when disconnecting.
- cassandra: Fix consistency=quorum to work
- dsync: Lock file generation failed if home directory didn't exist
- Snippet generation for HTML mails didn't ignore &entities inside
  blockquotes, producing strange looking snippets.
- imapc: Fix assert-crash if getting disconnected and after
  reconnection all mails in the selected mailbox are gone.
- pop3c: Handle unexpected server disconnections without assert-crash
- fts: Fixes to indexing mails via virtual mailboxes.
- fts: If mails contained NUL characters, the text around it wasn't
  indexed.
- Obsolete dovecot.index.cache offsets were sometimes used. Trying to
  fetch a field that was just added to cache file may not have always
  found it.
   2018-05-22 22:49:45 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (6) | Package updated
Log message:
dovecot2: update to 2.3.1

Changes:
* Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
* API CHANGE: array_idx_modifiable will no longer allocate space
 - Particularly affects how you should check MODULE_CONTEXT result, or use \ 
REQUIRE_MODULE_CONTEXT.

+ mail_attachment_detection_options setting controls when
  $HasAttachment and $HasNoAttachment keywords are set for mails.
+ imap: Support fetching body snippets using FETCH (SNIPPET) or
  (SNIPPET (LAZY=FUZZY))
+ fs-compress: Automatically detect whether input is compressed or not.
  Prefix the compression algorithm with "maybe-" to enable the
  detection, for example: "compress:maybe-gz:6:..."
+ Added settings to change dovecot.index* files' optimization behavior.
  See https://wiki2.dovecot.org/IndexFiles#Settings
+ Auth cache can now utilize auth workers to do password hash
  verification by setting auth_cache_verify_password_with_worker=yes.
+ Added charset_alias plugin. See
  https://wiki2.dovecot.org/Plugins/CharsetAlias
+ imap_logout_format and pop3_logout_format settings now support all of the \ 
generic variables (e.g. %{rip}, %{session}, etc.)
   2018-04-18 00:29:53 by Thomas Klausner | Files touched by this commit (286)
Log message:
Add p11-kit to gnutls/bl3.mk and bump dependencies.
   2018-03-01 12:13:14 by Takahiro Kambe | Files touched by this commit (3) | Package updated
Log message:
mail/dovecot2: update to 2.3.0.1

Small patch release to fix the worst bugs in v2.3.0. v2.3.1 is coming in about a \ 
month with a lot more changes.

 * CVE-2017-15130: TLS SNI config lookups may lead to excessive
   memory usage, causing imap-login/pop3-login VSZ limit to be reached
   and the process restarted. This happens only if Dovecot config has
   local_name { } or local { } configuration blocks and attacker uses
   randomly generated SNI servernames.
 * CVE-2017-14461: Parsing invalid email addresses may cause a crash or
   leak memory contents to attacker. For example, these memory contents
   might contain parts of an email from another user if the same imap
   process is reused for multiple users. First discovered by Aleksandar
   Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
   via HackerOne.
 * CVE-2017-15132: Aborted SASL authentication leaks memory in login
   process.
 * Linux: Core dumping is no longer enabled by default via
   PR_SET_DUMPABLE, because this may allow attackers to bypass
   chroot/group restrictions. Found by cPanel Security Team. Nowadays
   core dumps can be safely enabled by using "sysctl -w
   fs.suid_dumpable=2". If the old behaviour is wanted, it can still be
   enabled by setting:
   import_environment=$import_environment PR_SET_DUMPABLE=1
 - imap-login with SSL/TLS connections may end up in infinite loop
   2018-01-24 16:16:49 by Jonathan Perkin | Files touched by this commit (1)
Log message:
dovecot2: Don't automatically add compiler security features.
   2018-01-08 14:03:15 by Filip Hajny | Files touched by this commit (1)
Log message:
mail/dovecot2: bump ABI dependency to 2.3.0 for dovecot2-pigeonhole.
   2018-01-04 01:22:02 by Maya Rashish | Files touched by this commit (2)
Log message:
dovecot2: remove now redundant patch.

Heads up by jzu, thanks.
   2018-01-02 16:52:44 by Filip Hajny | Files touched by this commit (10) | Package updated
Log message:
Update mail/dovecot2* to 2.3.0.

Some of the larger changes:

* Various setting changes, see https://wiki2.dovecot.org/Upgrading/2.3
* Logging rewrite started: Logging is now based on hierarchical events.
  This makes it possible to do various things, like: 1) giving
  consistent log prefixes, 2) enabling debug logging with finer
  granularity, 3) provide logs in more machine readable formats
  (e.g. json). Everything isn't finished yet, especially a lot of the
  old logging code still needs to be translated to the new way.
* Statistics rewrite started: Stats are now based on (log) events.
  It's possible to gather statistics about any event that is logged.
  See http://wiki2.dovecot.org/Statistics for details
* ssl_dh setting replaces the old generated ssl-parameters.dat
* IMAP: When BINARY FETCH finds a broken mails, send [PARSE] error
  instead of [UNKNOWNCTE]
* Linux: core dumping via PR_SET_DUMPABLE is no longer enabled by
  default due to potential security reasons (found by cPanel Security
  Team).
+ Added support for SMTP submission proxy server, which includes
  support for BURL and CHUNKING extension.
+ LMTP rewrite. Supports now CHUNKING extension and mixing of
  local/proxy recipients.
+ auth: Support libsodium to add support for ARGON2I and ARGON2ID
  password schemes.
+ auth: Support BLF-CRYPT password scheme in all platforms
+ auth: Added LUA scripting support for passdb/userdb.
  See https://wiki2.dovecot.org/AuthDatabase/Lua
- Input streams are more reliable now when there are errors or when
  the maximum buffer size is reached. Previously in some situations
  this could have caused Dovecot to try to read already freed memory.
- Output streams weren't previously handling failures when writing a
  trailer at the end of the stream. This mainly affected encrypt and
  zlib compress ostreams, which could have silently written truncated
  files if the last write happened to fail (which shouldn't normally
  have ever happened).
- virtual plugin: Fixed panic when fetching mails from virtual
  mailboxes with IMAP BINARY extension.
- doveadm-server: Fix potential hangs with SSL connections
- doveadm proxy: Reading commands' output from v2.2.33+ servers could
  have caused the output to be corrupted or caused a crash.
- Many other smaller fixes