Log message:
dovecot2: update to 2.2.33.1

v2.2.33.1:
- dovecot-lda was logging to stderr instead of to the log file.

v2.2.33:
* doveadm director commands wait for the changes to be visible in the
  whole ring before they return. This is especially useful in testing.
* Environments listed in import_environment setting are now set or
  preserved when executing standalone commands (e.g. doveadm)

+ doveadm proxy: Support proxying logs. Previously the logs were
  visible only in the backend's logs.
+ Added %{if}, see https://wiki2.dovecot.org/Variables#Conditionals
+ Added a new notify_status plugin, which can be used to update dict
  with current status of a mailbox when it changes. See
  https://wiki2.dovecot.org/Plugins/NotifyStatus
+ Mailbox list index can be disabled for a namespace by appending
  ":LISTINDEX=" to location setting.
+ dsync/imapc: Added dsync_hashed_headers setting to specify which
  headers are used to match emails.
+ pop3-migration: Add pop3_migration_ignore_extra_uidls=yes to ignore
  mails that are visible in POP3 but not IMAP. This could happen if
  new mails were delivered during the migration run.
+ pop3-migration: Further improvements to help with Zimbra
+ pop3-migration: Cache POP3 UIDLs in imapc's dovecot.index.cache
  if indexes are enabled. These are used to optimize incremental syncs.
+ cassandra, dict-sql: Use prepared statements if protocol version>3.
+ auth: Added %{ldap_dn} variable for passdb/userdb ldap
- acl: The "create" (k) permission in global acl-file was sometimes
  ignored, allowing users to create mailboxes when they shouldn't have.
- sdbox: Mails were always opened when expunging, unless
  mail_attachment_fs was explicitly set to empty.
- lmtp/doveadm proxy: hostip passdb field was ignored, which caused
  unnecessary DNS lookups if host field wasn't an IP
- lmtp proxy: Fix crash when receiving unexpected reply in RCPT TO
- quota_clone: Update also when quota is unlimited (broken in v2.2.31)
- mbox, zlib: Fix assert-crash when accessing compressed mbox
- doveadm director kick -f parameter didn't work
- doveadm director flush <host> resulted flushing all hosts, if <host>
  wasn't an IP address.
- director: Various fixes to handling backend/director changes at
  abnormal times, especially while ring was unsynced. These could have
  resulted in crashes, non-optimal behavior or ignoring some of the
  changes.
- director: Use less CPU in imap-login processes when moving/kicking
  many users.
- lmtp: Session IDs were duplicated/confusing with multiple RCPT TOs
  when lmtp_rcpt_check_quota=yes
- doveadm sync -1 fails when local mailboxes exist that do not exist
  remotely. This commonly happened when lazy_expunge mailbox was
  autocreated when incremental sync expunged mails.
- pop3: rawlog_dir setting didn't work

Log message:
Changes 2.2.32:
There are various changes in this release that can be used to significantly \ 
reduce disk IO with:
1) NFS storage especially, but I guess also other remote filesystems and even \ 
some with local disks
2) When mail storage and INDEX storage are separated

 * imapc: Info-level line is logged every time when successfully
   connected to the remote server. This includes local/remote IP/port,
   which can be useful for matching against external logs.
 * config: Log a warning if plugin { key=no } is used explicitly.
   v2.3 will support "no" properly in plugin settings, but for now
   any value at all for a boolean plugin setting is treated as "yes",
   even if it's written as explicit "no". This change will now warn
   that it most likely won't work as intended.

 + Various optimizations to avoid accessing files/directories when it's
   not necessary. Especially avoid accessing mail root directories when
   INDEX directories point to a different filesystem.
 + mail_location can now include ITERINDEX parameter. This tells Dovecot
   to perform mailbox listing from the INDEX path instead of from the
   mail root path. It's mainly useful when the INDEX storage is on a
   faster storage.
 + mail_location can now include VOLATILEDIR=<path> parameter. This
   is used for creating lock files and in future potentially other
   files that don't need to exist permanently. The path could point to
   tmpfs for example. This is especially useful to avoid creating lock
   files to NFS or other remote filesystems. For example:
   mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u
 + mail_location's LISTINDEX=<path> can now contain a full path.
   This allows storing mailbox list index to a different storage
   than the rest of the indexes, for example to tmpfs.
 + mail_location can now include NO-NOSELECT parameter. This
   automatically deletes any \NoSelect mailboxes that have no children.
   These mailboxes are sometimes confusing to users.
 + mail_location can now include BROKENCHAR=<char> parameter. This can
   be useful with imapc to access mailbox names that aren't valid mUTF-7
   charset from remote servers.
 + If mailbox_list_index_very_dirty_syncs=yes, the list index is no
   longer refreshed against filesystem when listing mailboxes. This
   allows the mailbox listing to be done entirely by only reading the
   mailbox list index.
 + Added mailbox_list_index_include_inbox setting to control whether
   INBOX's STATUS information should be cached in the mailbox list
   index. The default is "no", but it may be useful to change it to
   "yes", especially if LISTINDEX points to tmpfs.
 + userdb can return chdir=<path>, which override mail_home for the
   chdir location. This can be useful to avoid accessing home directory
   on login.
 + userdb can return postlogin=<socket> to specify per-user imap/pop3
   postlogin socket path.
 + cassandra: Add support for result paging by adding page_size=<n>
   parameter to the connect setting.
 + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from
   headers when matching mails. This helps with migrations from Zimbra.
 + imap_logout_format supports now %{appended} and %{autoexpunged}
 + virtual plugin: Optimize IDLE to use mailbox list index for finding
   out when something has changed.
 + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor
 - virtual plugin: A lot of fixes. In many cases it was also working
   very inefficiently or even incorrectly.
 - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31.
   It was actually (mostly) working in previous versions, but broken
   in v2.2.31.
 - Modseq tracking didn't always work correctly. This could have caused
   imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to
   not work perfectly.
 - mdbox: "Inconsistency in map index" wasn't fixed automatically
 - dict-ldap: %variable values used in the LDAP filter weren't escaped.
 - quota=count: quota_warning = -storage=.. was never executed (try 2).
   v2.2.31 fixed it for -messages, but not for -storage.
 - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent
   FETCHes, but weren't.
 - quota-status service didn't support recipient_delimiter
 - acl: Don't access dovecot-acl-list files with acl_globals_only=yes
 - mail_location: If INDEX dir is set, mailbox deletion deletes its
   childrens' indexes. For example if "box" is deleted, \ 
"box/child"
   index directory was deleted as well (but mails were preserved).
 - director: v2.2.31 caused rapid reconnection loops to directors
   that were down.

Log message:
Bumped BUILDLINK_ABI_DEPENDS

Log message:
Changes 2.2.31:
* LMTP: Removed "(Dovecot)" from added Received headers. Some
  installations want to hide it, and there's not really any good reason
  for anyone to have it.

+ Add ssl_alt_cert and ssl_alt_key settings to add support for
  having both RSA and ECDSA certificates.
+ dsync/imapc, pop3-migration plugin: Strip trailing whitespace from
  headers when matching mails. This helps with migrations from Zimbra.
+ acl: Add acl_globals_only setting to disable looking up
  per-mailbox dovecot-acl files.
+ Parse invalid message addresses better. This mainly affects the
  generated IMAP ENVELOPE replies.
- v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly.
  It could have deleted wrong mail's cache or assert-crashed.
- v2.2.30 mail-crypt-acl plugin was assert-crashing
- v2.2.30 welcome plugin wasn't working
- Various fixes to handling mailbox listing. Especially related to
  handling nonexistent autocreated/autosubscribed mailboxes and ACLs.
- Global ACL file was parsed as if it was local ACL file. This caused
  some of the ACL rule interactions to not work exactly as intended.
- auth: forward_* fields didn't work properly: Only the first forward
  field was working, and only if the first passdb lookup succeeded.
- Using mail_sort_max_read_count sometimes caused "Broken sort-*
  indexes, resetting" errors.
- Using mail_sort_max_read_count may have caused very high CPU usage.
- Message address parsing could have crashed on invalid input.
- imapc_features=fetch-headers wasn't always working correctly and
  caused the full header to be fetched.
- imapc: Various bugfixes related to connection failure handling.
- quota=imapc sent unnecessary FETCH RFC822.SIZE to server when
  expunging mails.
- quota=count: quota_warning = -storage=.. was never executed
- quota=count: Add support for "ns" parameter
- dsync: Fix incremental syncing for mails that don't have Date or
  Message-ID headers.
- imap: Fix hang when client sends pipelined SEARCH +
  EXPUNGE/CLOSE/LOGOUT.
- oauth2: Token validation didn't accept empty server responses.
- imap: NOTIFY command has been almost completely broken since the
  beginning. I guess nobody has been trying to use it.

Log message:
Hopefully the last 2.2.30.x..
- auth: Multiple failed authentications within short time caused
  crashes
- push-notification: OX driver crashed at deinit

Log message:
Changes 2.2.30.1:
- quota_warning scripts weren't working in v2.2.30
- vpopmail still wasn't compiling

Log message:
Changes 2.2.30:
* auth: Use timing safe comparisons for everything related to
  passwords. It's unlikely that these could have been used for
  practical attacks, especially because Dovecot delays and flushes all
  failed authentications in 2 second intervals. Also it could have
  worked only when passwords were stored in plaintext in the passdb.
* master process sends SIGQUIT to all running children at shutdown,
  which instructs them to close all the socket listeners immediately.
  This way restarting Dovecot should no longer fail due to some
  processes keeping the listeners open for a long time.

+ auth: Add passdb { mechanisms=none } to match separate passdb lookup
+ auth: Add passdb { username_filter } to use passdb only if user
  matches the filter. See https://wiki2.dovecot.org/PasswordDatabase
+ dsync: Add dsync_commit_msgs_interval setting. It attempts to commit
  the transaction after saving this many new messages. Because of the
  way dsync works, it may not always be possible if mails are copied
  or UIDs need to change.
+ imapc: Support imapc_features=search without ESEARCH extension.
+ imapc: Add imapc_features=fetch-bodystructure to pass through remote
  server's FETCH BODY and BODYSTRUCTURE.
+ imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the
  remote server.
+ passdb imap: Add allow_invalid_cert and ssl_ca_file parameters.
+ If dovecot.index.cache corruption is detected, reset only the one
  corrupted mail instead of the whole file.
+ doveadm mailbox status: Add "firstsaved" field.
+ director_flush_socket: Add old host's up/down and vhost count as parameters
- More fixes to automatically fix corruption in dovecot.list.index
- dsync-server: Fix support for dsync_features=empty-header-workaround
- imapc: Various bugfixes, including infinite loops on some errors
- IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't
  enabled modseq tracking via CONDSTORE/QRESYNC.
- fts-lucene: Fix it to work again with mbox format
- Some internal error messages may have contained garbage in v2.2.29
- mail-crypt: Re-encrypt when copying/moving mails and per-mailbox keys
  are used. Otherwise the copied mails can't be opened.
- vpopmail: Fix compiling

Log message:
Move including options.mk to Makefile.common, the plugins do a full build
so need to build it the same way as the main package.  Fixes SSL build.

Log message:
Explicitly disable epoll/inotify on illumos, based on patch in PR#52176.

Log message:
Update dovecot2 to 2.2.29.1.  This release contains security fixes.

v2.2.29.1 2017-04-12  Timo Sirainen <tss@iki.fi>

	- imapc reconnection fix was forgotten from 2.2.29 release, which also
	  made "make check" fail in a unit test
	- dict-sql: Merging multiple UPDATEs to a single statement wasn't
	  actually working.
	- Fixed building with vpopmail

v2.2.29 2017-04-10  Timo Sirainen <tss@iki.fi>

	* passdb/userdb dict: Don't double-expand %variables in keys. If dict
	  was used as the authentication passdb, using specially crafted
	  %variables in the username could be used to cause DoS (CVE-2017-2669)
	* When Dovecot encounters an internal error, it logs the real error and
	  usually logs another line saying what function failed. Previously the
	  second log line's error message was a rather uninformative "Internal
	  error occurred. Refer to server log for more information." Now the
	  real error message is duplicated in this second log line.
	* lmtp: If a delivery has multiple recipients, run autoexpunging only
	  for the last recipient. This avoids a problem where a long
	  autoexpunge run causes LMTP client to timeout between the DATA
	  replies, resulting in duplicate mail deliveries.
	* config: Don't stop the process due to idling. Otherwise the
	  configuration is reloaded when the process restarts.
	* mail_log plugin: Differentiate autoexpunges from regular expunges
	* imapc: Use LOGOUT to cleanly disconnect from server.
	* lib-http: Internal status codes (>9000) are no longer visible in logs
	* director: Log vhost count changes and HOST-UP/DOWN

	+ quota: Add plugin { quota_max_mail_size } setting to limit the
	  maximum individual mail size that can be saved.
	+ imapc: Add imapc_features=delay-login. If set, connecting to the
	  remote IMAP server isn't done until it's necessary.
	+ imapc: Add imapc_connection_retry_count and
	  imapc_connection_retry_interval settings.
	+ imap, pop3, indexer-worker: Add (deinit) to process title before
	  autoexpunging runs.
	+ Added %{encrypt} and %{decrypt} variables
	+ imap/pop3 proxy: Log proxy state in errors as human-readable string.
	+ imap/pop3-login: All forward_* extra fields returned by passdb are
	  sent to the next hop when proxying using ID/XCLIENT commands. On the
	  receiving side these fields are imported and sent to auth process
	  where they're accessible via %{passdb:forward_*}. This is done only
	  if the sending IP address matches login_trusted_networks.
	+ imap-login: If imap_id_retain=yes, send the IMAP ID string to
	  auth process. %{client_id} expands to it in auth process. The ID
	  string is also sent to the next hop when proxying.
	+ passdb imap: Use ssl_client_ca_* settings for CA validation.
	- fts-tika: Fixed crash when parsing attachment without
	  Content-Disposition header. Broken by 2.2.28.
	- trash plugin was broken in 2.2.28
	- auth: When passdb/userdb lookups were done via auth-workers, too much
	  data was added to auth cache. This could have resulted in wrong
	  replies when using multiple passdbs/userdbs.
	- auth: passdb { skip & mechanisms } were ignored for the first passdb
	- oauth2: Various fixes, including fixes to crashes
	- dsync: Large Sieve scripts (or other large metadata) weren't always
	  synced.
	- Index rebuild (e.g. doveadm force-resync) set all mails as \Recent
	- imap-hibernate: %{userdb:*} wasn't expanded in mail_log_prefix
	- doveadm: Exit codes weren't preserved when proxying commands via
	  doveadm-server. Almost all errors used exit code 75 (tempfail).
	- ACLs weren't applied to not-yet-existing autocreated mailboxes.
	- Fixed a potential crash when parsing a broken message header.
	- cassandra: Fallback consistency settings weren't working correctly.
	- doveadm director status <user>: "Initial config" was always empty
	- imapc: Various reconnection fixes.