./mail/dovecot2, Secure IMAP and POP3 server

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 2.3.5, Package name: dovecot-2.3.5, Maintainer: adam

Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems,
written with security primarily in mind. Dovecot is an excellent choice for both
small and large installations. It's fast, simple to set up, requires no special
administration and it uses very little memory.


Required to run:
[archivers/lz4]

Required to build:
[pkgtools/cwrappers]

Package options: kqueue, pam, ssl, tcpwrappers

Master sites:

SHA1: e03f2ad6d80afb1b23d4f82a5ced794e07f467b7
RMD160: 428b4351e7566dbdac8da41be890016bfc575ff7
Filesize: 6807.109 KB

Version history: (Expand)


CVS history: (Expand)


   2019-03-05 18:05:46 by Hauke Fath | Files touched by this commit (1) | Package updated
Log message:
Bump version after pkg update.
   2019-03-05 17:51:04 by Hauke Fath | Files touched by this commit (4) | Package updated
Log message:
Update mail/dovecot2 to v2.3.5.

From the upstream release-note:

NEWS:

+ Lua push notification driver: mail keywords and flags are provided
in MessageNew and MessageAppend events.
+ submission: Implement support for plugins.
+ auth: When auth_policy_log_only=yes, only log what the policy server
response would do without actually doing it.
+ auth: Always log policy server decisions with auth_verbose=yes
- v2.3.[34]: doveadm log errors: Output was missing user/session
- lda: Debug log lines could have shown slightly corrupted
- login proxy: Login processes may have crashed in various ways when
login_proxy_max_disconnect_delay was set.
- imap: Fix crash with Maildir+zlib if client disconnects during APPEND
- lmtp proxy: Fix potential assert-crash
- lmtp/submission: Fix crash when SMTP client transaction times out
- submission: Split large XCLIENT commands to 512 bytes per command,
so Postfix accepts them.
- submission: Fix crash when client sends invalid BURL command
- submission: relay backend: VRFY command: Avoid forwarding 500 and
502 replies back to client.
- lib-http: Fix potential assert-crash when DNS lookup fails
- lib-fts: Fix search query generation when one language ignores a
token (e.g. via stopwords).
   2019-02-06 02:41:28 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
mail/dovecot2: update to 2.3.4.1

v2.3.4.1 2019-02-05  Aki Tuomi <aki.tuomi@open-xchange.com>

	* CVE-2019-3814: If imap/pop3/managesieve/submission client has
	  trusted certificate with missing username field
	  (ssl_cert_username_field), under some configurations Dovecot
	  mistakenly trusts the username provided via authentication instead
	  of failing.
	* ssl_cert_username_field setting was ignored with external SMTP AUTH,
	  because none of the MTAs (Postfix, Exim) currently send the
	  cert_username field. This may have allowed users with trusted
	  certificate to specify any username in the authentication. This bug
	  didn't affect Dovecot's Submission service.
   2018-12-02 05:45:00 by Amitai Schleier | Files touched by this commit (2)
Log message:
Provide declarations for kill() and SIGKILL to fix NetBSD-8 build.
   2018-12-01 12:42:41 by Amitai Schleier | Files touched by this commit (1)
Log message:
Move PKGPATH check after bsd.prefs.mk to fix circular dependency.
   2018-11-30 19:43:10 by Adam Ciarcinski | Files touched by this commit (11) | Package updated
Log message:
dovecot2: updated to 2.3.4

2.3.4:
 * The default postmaster_address is now "postmaster@<user domain or
   server hostname>". If username contains the @domain part, that's
   used. If not, then the server's hostname is used.
 * "doveadm stats dump" now returns two decimals for the \ 
"avg" field.

 + Added push notification driver that uses a Lua script
 + Added new SQL, DNS and connection events.
   See https://wiki2.dovecot.org/Events
 + Added "doveadm mailbox cache purge" command.
 + Added events API support for Lua scripts
 + doveadm force-resync -f parameter performs "index fsck" while opening
   the index. This may be useful to fix some types of broken index files.
   This may become the default behavior in a later version.
 - director: Kicking a user crashes if login process is very slow
 - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
   unless QUIT is sent.
 - auth: Fix crypt() segfault with glibc-2.28+
 - imap: Running UID FILTER script with errors assert-crashes
 - dsync, pop3-migration: POP3 UIDLs weren't added to
   dovecot.index.cache while mails were saved.
 - dict clients may have been using 100% CPU while waiting for dict
   server to finish commands.
 - doveadm user: Fixed user listing via HTTP API
 - All levels of Cassandra log messages were logged as Dovecot errors.
 - http/smtp client may have crashed after SSL handshake
 - Lua auth converted strings that looked like numbers into numbers.
   2018-10-23 18:29:19 by Adam Ciarcinski | Files touched by this commit (9) | Package updated
Log message:
dovecot2: updated to 2.3.3

2.3.3:
* doveconf hides more secrets now in the default output.
* ssl_dh setting is no longer enforced at startup. If it's not set and
  non-ECC DH key exchange happens, error is logged and client is
  disconnected.

+ Added log_debug=<filter> setting.
+ Added log_core_filter=<log filter> setting.
+ quota-clone: Write to dict asynchronously
+ --enable-hardening attempts to use retpoline Spectre 2 mitigations
+ lmtp proxy: Support source_ip passdb extra field.
+ doveadm stats dump: Support more fields and output stddev by default.
+ push-notification: Add SSL support for OX backend.
- NUL bytes in mail headers can cause truncated replies when fetched.
- director: Conflicting host up/down state changes may in some rare
  situations ended up in a loop of two directors constantly overwriting
  each others' changes.
- director: Fix hang/crash when multiple doveadm commands are being
  handled concurrently.
- director: Fix assert-crash if doveadm disconnects too early
- virtual plugin: Some searches used 100% CPU for many seconds
- dsync assert-crashed with acl plugin in some situations.
- mail_attachment_detection_options=add-flags-on-save assert-crashed
  with some specific Sieve scripts.
- Mail snippet generation crashed with mails containing invalid
  Content-Type:multipart header.
- Log prefix ordering was different for some log lines.
- quota: With noenforcing option current quota usage wasn't updated.
- auth: Kerberos authentication against Samba assert-crashed.
- stats clients were unnecessarily chatty with the stats server.
- imapc: Fixed various assert-crashes when reconnecting to server.
- lmtp, submission: Fix potential crash if client disconnects while
  handling a command.
- quota: Fixed compiling with glibc-2.26 / support libtirpc.
- fts-solr: Empty search values resulted in 400 Bad Request errors
- fts-solr: default_ns parameter couldn't be used
- submission server crashed if relay server returned over 7 lines in
  a reply (e.g. to EHLO)
   2018-07-14 22:15:33 by Adam Ciarcinski | Files touched by this commit (4) | Package updated
Log message:
dovecot2: updated to 2.3.2.1

v2.3.2 still had a few unexpected bugs:
- SSL/TLS servers may have crashed during client disconnection
- lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
  sometimes assert-crashed.
- v2.3.2: "make check" may have crashed with 32bit systems

v2.3.2 is mainly a bugfix release. It contains all the changes in v2.2.36, as \ 
well as a bunch of other fixes (mainly for v2.3-only bugs). Binary packages are \ 
already in https://repo.dovecot.org/
* old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while
  opening /proc/self/io. This may still cause security problems if the
  process is ptrace()d at the same time. Instead, open it while still
  running as root.
+ doveadm: Added mailbox cache decision&remove commands. See
  doveadm-mailbox(1) man page for details.
+ doveadm: Added rebuild attachments command for rebuilding
  $HasAttachment or $HasNoAttachment flags for matching mails. See
  doveadm-rebuild(1) man page for details.
+ cassandra: Use fallback_consistency on more types of errors
+ lmtp proxy: Support outgoing SSL/TLS connections
+ lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
+ submission: Add support for rawlog_dir
+ submission: Add submission_client_workarounds setting.
+ lua auth: Add password_verify() function and additional fields in
  auth request.
- doveadm-server: TCP connections are hanging when there is a lot of
  network output. This especially caused hangs in dsync-replication.
- Using multiple type=shared mdbox namespaces crashed
- mail_fsync setting was ignored. It was always set to "optimized".
- lua auth: Fix potential crash at deinit
- SSL/TLS servers may have crashed if client disconnected during
  handshake.
- SSL/TLS servers: Don't send extraneous certificates to client when
  alt certs are used.
- lda, lmtp: Return-Path header without '<' may have assert-crashed.
- lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash
- lda: -f parameter didn't allow empty/null/domainless address
- lmtp, submission: Message size limit was hardcoded to 40 MB.
  Exceeding it caused the connection to get dropped during transfer.
- lmtp: Fix potential crash when delivery fails at DATA stage
- lmtp: login_greeting setting was ignored
- Fix to work with OpenSSL v1.0.2f
- systemd unit restrictions were too strict by default
- Fix potential crashes when a lot of log output was produced
- SMTP client may have assert-crashed when sending mail
- IMAP COMPRESS: Send "end of compression" marker when disconnecting.
- cassandra: Fix consistency=quorum to work
- dsync: Lock file generation failed if home directory didn't exist
- Snippet generation for HTML mails didn't ignore &entities inside
  blockquotes, producing strange looking snippets.
- imapc: Fix assert-crash if getting disconnected and after
  reconnection all mails in the selected mailbox are gone.
- pop3c: Handle unexpected server disconnections without assert-crash
- fts: Fixes to indexing mails via virtual mailboxes.
- fts: If mails contained NUL characters, the text around it wasn't
  indexed.
- Obsolete dovecot.index.cache offsets were sometimes used. Trying to
  fetch a field that was just added to cache file may not have always
  found it.