Aki Tuomi [Fri, 12 Jun 2026 11:19:42 +0000 (11:19 +0000)]
[PATCH 3/4] lib-compression: istream-zstd - Guard against no-progress loop in read
If ZSTD_decompressStream() returns with neither input consumed nor
output produced, the read loop would spin indefinitely. Add a check
after each call: if input.pos is unchanged and output.pos is zero,
treat it as a corrupt stream (EIO).
Gbp-Pq: Name 0003-lib-compression-istream-zstd-Guard-against-no-progre.patch
Aki Tuomi [Fri, 12 Jun 2026 11:19:42 +0000 (11:19 +0000)]
[PATCH 4/4] lib-compression: test - Add zero-len frame test for all handlers
Verify that successive empty compressed frames produce a clean EOF
across all compression algorithms. lz4 is limited to one frame as it
uses a custom single-stream format without concatenation support.
Gbp-Pq: Name 0004-lib-compression-test-Add-zero-len-frame-test-for-all.patch
Timo Sirainen [Mon, 4 May 2026 13:10:13 +0000 (13:10 +0000)]
[PATCH 2/2] lib-sieve: storage: file - Validate script stat path through dir_fd
Extend the symlink-escape protection added in the previous commit to the
stat performed by sieve_file_script_open(): an "include :personal" lookup
or any other indirect path that triggers sieve_file_script_stat() also
needs to refuse a symlink whose target leaves the personal storage
directory, otherwise the existence check succeeds and the file is opened
later via the safe path with an unhelpful "permission denied".
Add sieve_file_script_stat_safe(), which uses fstatat(AT_SYMLINK_NOFOLLOW)
to obtain the entry's own stat (lnk_st) and then, only if the entry is a
symlink, opens it through sieve_file_storage_open_safe() to validate the
target stays inside dir_fd and to fetch the resolved target's stat (st)
via fstat(). Non-symlink entries skip the open entirely.
Use the new helper in sieve_file_script_open() whenever fstorage->dir_fd
is available, falling back to the unsafe lstat+stat variant for
non-personal or single-file storages.
Gbp-Pq: Name 0002-lib-sieve-storage-file-Validate-script-stat-path-thr.patch
Pigeonhole's file storage followed any symlink encountered while resolving a
script path, including symlinks in personal (user-writable) storage whose
target lay outside the storage directory. In some non-recommended
configurations a user could exploit this through the include extension:
an "include :personal name;" lookup of ~/sieve/name.sieve transparently
followed a user-placed to e.g. another user's file readable by the mail
process, leaking its contents (or causing it to be parsed as Sieve).
Normally this shouldn't be possible, because sieve processes shouldn't
have any more privileges to read files than the local system user creating
the symlink.
Open the canonical (realpath'd) personal storage directory at storage init
time and keep an O_DIRECTORY|O_CLOEXEC fd to it. Resolve script content
reads through this fd by routing sieve_file_script_get_stream() via a new
sieve_file_storage_open_safe() wrapper around t_openat_safe(), which:
- opens each path component with O_NOFOLLOW so symlinks are detected
explicitly rather than transparently followed;
- follows symlinks only when their (recursively resolved) target stays
beneath dir_fd, refusing absolute targets and `..` past the storage
root with ELOOP;
- caps the symlink-hop count to bound resolution time.
Anchoring at dir_fd makes the lookup TOCTOU-safe even when intermediate
path components are mutated on disk concurrently: resolution stays
relative to the original directory inode and the safe walker still rejects
any target that leaves it.
Apply the protection only when storage->is_personal is set; admin-managed
global storage is trusted and may legitimately use cross-boundary symlinks.
Single-file storages (is_file=TRUE) keep dir_fd at -1 and fall back to the
existing open path. Also guard the dir_fd open with S_ISDIR() to handle the
autodetect quirk where storage_path can refer to a regular file even when
is_file is FALSE.
Gbp-Pq: Name 0001-lib-sieve-storage-file-Refuse-symlinks-escaping-pers.patch
Add a helper that opens a path relative to a directory fd while refusing
any resolution that escapes that directory. Each component is opened with
O_NOFOLLOW so symlinks are detected explicitly rather than transparently
followed; symlinks are then resolved manually and only honoured when their
(recursively resolved) target also stays beneath the base fd. Absolute
symlink targets, leading '/', and '..' past the base are rejected with
errno=ELOOP. Symlink chains are bounded by
PATH_UTIL_OPENAT_SAFE_MAX_SYMLINKS hops.
Anchoring resolution at a caller-held base_fd makes the lookup TOCTOU-safe
even when intermediate path components are mutated on disk concurrently:
the kernel resolves all openat() lookups relative to the original
directory inode that base_fd refers to, so an attacker mutating path
components on the filesystem cannot redirect resolution.
This is the portable counterpart to Linux's openat2() with RESOLVE_BENEATH
and is intended for callers that need to safely look up files under a
user-writable directory (e.g. a Sieve script storage directory).
Gbp-Pq: Name 0002-lib-path-util-Add-t_openat_safe-for-jailed-openat-re.patch
Timo Sirainen [Thu, 11 Jun 2026 19:33:23 +0000 (19:33 +0000)]
[PATCH 2/2] lib-sieve: actions - Create fileinto mailbox without the autocreate flag
Stop setting MAILBOX_FLAG_AUTO_CREATE/SUBSCRIBE in act_store. Instead, on
mailbox_open() returning MAIL_ERROR_NOTFOUND, create the mailbox explicitly
with sieve_act_store_create_mailbox() when autocreation is enabled (the
:create side effect already creates it explicitly).
This makes the creation go through the normal ACL CREATE gate, so a fileinto
(with lda_mailbox_autocreate=yes) or fileinto :create can no longer create a
mailbox in a shared or public namespace that the user lacks the CREATE right
for.
A permission failure to create the mailbox is classified by
sieve_act_store_create_error_status(): for a user's personal script it is a
permanent failure (implicit keep), while for a global (administrator-defined)
script it is deferred (temporary failure), so the administrator notices the
script is behaving in a way they did not intend.
Gbp-Pq: Name 0002-lib-sieve-actions-Create-fileinto-mailbox-without-th.patch
Timo Sirainen [Thu, 11 Jun 2026 19:31:45 +0000 (19:31 +0000)]
[PATCH 1/2] lib-sieve: actions - Split mailbox creation into sieve_act_store_create_mailbox()
Pure refactoring with no functional change: move the mailbox_create() /
subscribe / reopen sequence out of the "mailbox" extension's :create side
effect (seff_mailbox_create_pre_execute) into a new reusable
sieve_act_store_create_mailbox() helper.
Gbp-Pq: Name 0001-lib-sieve-actions-Split-mailbox-creation-into-sieve_.patch
Timo Sirainen [Thu, 11 Jun 2026 17:20:40 +0000 (17:20 +0000)]
[PATCH 2/2] lib-storage: Remove MAILBOX_FLAG_AUTO_CREATE and MAILBOX_FLAG_AUTO_SUBSCRIBE
These flags were set only by mail delivery (lib-lda) and Sieve fileinto
(Pigeonhole), both of which now create the target mailbox explicitly with
mailbox_create(). Nothing sets the flags anymore, so remove them and drop
the flag checks from mailbox_is_autocreated() and mailbox_is_autosubscribed().
As a result mailbox_is_autocreated() reflects only mailboxes that virtually
already exist (the user's INBOX and admin-configured "auto" mailboxes), so
the ACL plugin again enforces the CREATE right for delivery-autocreated
mailboxes in shared and public namespaces.
Gbp-Pq: Name 0002-lib-storage-Remove-MAILBOX_FLAG_AUTO_CREATE-and-MAIL.patch
Instead of relying on MAILBOX_FLAG_AUTO_CREATE to have mailbox_open()
implicitly create the target, open it and, on MAIL_ERROR_NOTFOUND,
create it explicitly when lda_mailbox_autocreate is enabled. This makes
the creation go through the normal mailbox_create() path (including ACL
checks) and removes one of the two users of the autocreate mailbox flags.
Gbp-Pq: Name 0001-lib-lda-mail-deliver-Autocreate-delivery-mailbox-via.patch
Timo Sirainen [Sat, 4 Jul 2026 16:04:04 +0000 (16:04 +0000)]
[PATCH] imap-login: Fix excessive memory growth with pre-login ID command
The pre-login ID parser reset the per-argument line and list limits after
every argument, so nothing bounded the number of key/value pairs. Each
external key grew log_reply and added a distinct event field (a linear
scan, making it O(N^2)), allowing a pre-auth CPU/memory amplification.
Account at most 30 pairs (per RFC 2971) into the logging and client_id
bookkeeping. Internal x-* parameter handlers still run for pairs beyond
the limit, since a trusted proxy may legitimately forward more fields.
Gbp-Pq: Name 0001-imap-login-Fix-excessive-memory-growth-with-pre-logi.patch
Aki Tuomi [Mon, 25 May 2026 14:54:03 +0000 (14:54 +0000)]
[PATCH] lib-sieve: Reduce CPU limit check interval in :contains and :matches matchers
Reduce the interval to 64 so worst-case work between checks is ~64 MiB.
cpu_limit_exceeded() is a signal-counter comparison with no syscall, so
the higher call frequency has no measurable cost.
Gbp-Pq: Name 0008-lib-sieve-Reduce-CPU-limit-check-interval-in-contain.patch
Timo Sirainen [Wed, 3 Jun 2026 12:25:49 +0000 (12:25 +0000)]
[PATCH 7/7] lib-sieve: Log an info line when opening a CPU-disabled script
sieve_binary_check_executable() blocks execution when a script's
persisted cumulative CPU usage already exceeds sieve_max_cpu_time, but
only logged the block at debug level. With cumulative tracking now
sticky across redeliveries via the per-user sieve-rusage file, the
script can stay blocked indefinitely until the resource_usage_timeout
decay or admin intervention; operators benefit from a per-attempt
record of that block at info level.
Promote the existing debug log to e_info and include the cumulative
CPU usage. The caller continues to emit its own error message on the
failed open (lda-sieve, imap-sieve, imap-filter-sieve plugin paths).
Gbp-Pq: Name 0007-lib-sieve-Log-an-info-line-when-opening-a-CPU-disabl.patch
Timo Sirainen [Wed, 3 Jun 2026 12:25:38 +0000 (12:25 +0000)]
[PATCH 6/7] lib-sieve: Log a warning when cumulative CPU exceeds the limit
sieve_binary_record_resource_usage() returned FALSE when the script's
cumulative CPU time crossed sieve_max_cpu_time, but the only log line
on that path was a debug-level "Updated cumulative resource usage"
emitted on every recording, with no signal at the actual disable
transition. Operators had to infer the disable from later "Failed to
open script ... (cumulative resource limit exceeded)" errors on
subsequent deliveries.
Emit a warning at the transition point, including the cumulative CPU
usage that triggered it.
Gbp-Pq: Name 0006-lib-sieve-Log-a-warning-when-cumulative-CPU-exceeds-.patch
Timo Sirainen [Tue, 5 May 2026 16:51:27 +0000 (16:51 +0000)]
[PATCH 5/7] lib-sieve: file storage: Remove orphan compiled binaries on delete and rename
DELETESCRIPT and RENAMESCRIPT only operated on the .sieve file and
left the matching compiled binary (.svbin) on disk. The orphan was
never referenced again under that name, so it accumulated as wasted
disk space until something else (manual cleanup, account removal)
removed it.
Unlink fscript->bin_path alongside the .sieve operation. The unlink is
best-effort: failures other than ENOENT are logged but do not fail the
DELETE/RENAME.
Gbp-Pq: Name 0005-lib-sieve-file-storage-Remove-orphan-compiled-binari.patch
Timo Sirainen [Tue, 5 May 2026 16:30:23 +0000 (16:30 +0000)]
[PATCH 4/7] lib-sieve: Switch sieve_max_cpu_time enforcement to time-decayed re-enable
When a user's cumulative CPU time exceeded sieve_max_cpu_time, the
script was permanently disabled. SIEVE_BINARY_FLAG_RESOURCE_LIMIT was
set in the binary header on first overrun and was never cleared by
the resource_usage_timeout decay (which only zeroed the cpu_time
field), so sieve_binary_check_executable() refused execution forever
unless the binary was recompiled or an admin manually wiped the file.
Replace the sticky-flag model with one driven purely by the persisted
cumulative cpu_time, decayed by resource_usage_timeout:
- Drop SIEVE_BINARY_FLAG_RESOURCE_LIMIT and the enum that defined it;
nothing reads sbin->header.flags anymore.
- sieve_binary_check_executable() and sieve_binary_check_resource_usage()
call sieve_resource_usage_is_excessive() on the current cumulative
cpu_time. Raising sieve_max_cpu_time now correctly re-enables a
previously over-limit user without further intervention.
- Gate per-user file persistence on the per-run delta, not the
cumulative total. A refused-without-running attempt has a zero
delta, skips the file write, and leaves update_time at the moment
work was actually consumed. After resource_usage_timeout seconds
of inactivity (or only-trivial deliveries) the next load decays
the cpu_time to zero and the user is allowed to run again.
The on-disk per-user sieve-rusage file format becomes:
V1 <cpu-secs> <update-time>
Gbp-Pq: Name 0004-lib-sieve-Switch-sieve_max_cpu_time-enforcement-to-t.patch
Timo Sirainen [Wed, 3 Jun 2026 12:10:46 +0000 (12:10 +0000)]
[PATCH 3/7] lib-sieve: Rename on-disk header rusage fields to unused_*
The .svbin header's resource_usage fields no longer carry data: they
are zeroed on save and discarded on load. Cumulative CPU tracking
lives in the per-user sieve-rusage file, and the in-memory carry-over
lives in sbin->persisted_rusage.
Flatten the nested resource_usage struct and rename the fields to
unused_update_time and unused_cpu_time_msecs so it is obvious the
fields are kept only for on-disk format compatibility. The memory
layout of struct sieve_binary_header is unchanged.
Gbp-Pq: Name 0003-lib-sieve-Rename-on-disk-header-rusage-fields-to-unu.patch
Timo Sirainen [Tue, 5 May 2026 16:19:20 +0000 (16:19 +0000)]
[PATCH 2/7] lib-sieve: Drop binary-header resource usage tracking
With the per-user sieve-rusage file now authoritative for personal
storages, the .svbin header no longer needs to carry CPU usage. Admin
storages (sieve_before/after, default location) cannot be re-uploaded
by the user, so cross-run tracking is unnecessary there; the runtime
sieve_max_cpu_time check still enforces the per-execution limit.
Move the in-memory cumulative carry-over from sbin->header.resource_usage
to a dedicated sbin->persisted_rusage substruct. The on-disk header
struct now solely represents the wire format and is zeroed on every
save; the in-memory carry-over no longer overloads it. Drop the now-dead
"resource usage" section from sieve_binary_dumper_run() (the on-disk
fields are always zero, so the section never produced output).
Gbp-Pq: Name 0002-lib-sieve-Drop-binary-header-resource-usage-tracking.patch
Timo Sirainen [Tue, 5 May 2026 16:18:34 +0000 (16:18 +0000)]
[PATCH 1/7] lib-sieve: Add per-user sieve-rusage file for cumulative CPU tracking
Cumulative resource usage was previously stored in each compiled Sieve
binary's (.svbin) header. Because the binary file is keyed by script
name, a user could reset their CPU budget by uploading the same script
under a different name (PUTSCRIPT newname + SETACTIVE newname),
RENAMESCRIPT, or DELETESCRIPT followed by PUTSCRIPT under another
name. Each such operation produced a fresh .svbin with zero counter,
allowing the sieve_max_cpu_time limit to be bypassed indefinitely.
Track cumulative CPU per user instead, in <INBOX-namespace-root>/sieve-rusage.
The file persists across all script renames, deletions, and re-uploads,
since it is not tied to any particular script name. Tracking is enabled
only for personal storages where the user's INBOX namespace has a
filesystem path; admin/default storages are unaffected here.
The on-disk format is a single ASCII line:
V1 <flags> <cpu-secs> <update-time>
CPU time is rounded up to whole seconds when persisted; sub-second
precision is preserved only for the in-memory accumulation within a
single execution. The file is updated by writing a new copy via
file_dotlock_open_mode() and replacing the original via
file_dotlock_replace(). Concurrent writers are serialized through the
dotlock; readers do not need a lock because the rename is atomic.
The .svbin header still carries its original resource_usage struct as
the active fallback when no per-user file is available; a follow-up
commit drops that path.
Gbp-Pq: Name 0001-lib-sieve-Add-per-user-sieve-rusage-file-for-cumulat.patch
Stephan Bosch [Wed, 4 Mar 2026 20:53:36 +0000 (21:53 +0100)]
[PATCH] lib-sieve: sieve-storage - Fix panic caused by flawed detection of personal storage type
Recent commit d82c2e624e4a9c364a6fa58fad0938ae5578660c added the is_personal
flag, but it is assigned too late. Fix this issue by assigning this flag in the
earliest allocation function.
This issue commonly surfaces when people forget to set an appropriate type for a
script storage definition, in which case the "personal" type is the default.
Stephan Bosch [Tue, 25 Nov 2025 04:07:16 +0000 (05:07 +0100)]
[PATCH] lib-sieve: sieve-storage - Add is_personal bit
Simpler than evaluating the type and personal storage is created only through
sieve_storage_create_personal(). This mimics the bit for default storage.
Gbp-Pq: Name 0001-lib-sieve-sieve-storage-Add-is_personal-bit.patch
Timo Sirainen [Tue, 23 Jun 2026 15:26:51 +0000 (15:26 +0000)]
[PATCH 2/2] lib-storage: Simplify mailbox_mkdir() using mailbox_list_mkdir_root(NULL)
mailbox_mkdir() looked up the root path via mailbox_list_get_root_forced()
only to pass it straight to mailbox_list_mkdir_root(). Let mkdir_root()
resolve the root itself by passing path=NULL, dropping the local variable.
Gbp-Pq: Name 0002-lib-storage-Simplify-mailbox_mkdir-using-mailbox_lis.patch
Timo Sirainen [Tue, 23 Jun 2026 14:59:45 +0000 (14:59 +0000)]
[PATCH 1/2] lib-storage: Allow NULL path in mailbox_list_mkdir_root()
When path is NULL, look up the root directory path of the given type via
mailbox_list_get_root_path() and create that. If there is no path of the
requested type, nothing is done. This avoids open-coding the common
get_root_path() + mkdir_root() pair at call sites.
Gbp-Pq: Name 0001-lib-storage-Allow-NULL-path-in-mailbox_list_mkdir_ro.patch
Timo Sirainen [Mon, 6 Jul 2026 07:17:42 +0000 (07:17 +0000)]
[PATCH 2/3] doveadm: compress-connect - Don't hang when server rejects COMPRESS
After sending a COMPRESS command the client stopped reading stdin and
waited for the server's reply, but it only resumed on an "OK Begin
compression" reply. If the server rejected COMPRESS (e.g. a NO reply for
an unsupported mechanism), compress_waiting was never cleared: the client
waited forever for an OK that never came while the server waited for the
next command, deadlocking the session.
Remember the COMPRESS command tag and treat any tagged reply to it that
isn't the compression-start reply as a rejection, resuming the pipelined
input.
Gbp-Pq: Name 0002-doveadm-compress-connect-Don-t-hang-when-server-reje.patch
Timo Sirainen [Sat, 4 Jul 2026 21:57:15 +0000 (21:57 +0000)]
[PATCH 1/3] imap: Restrict COMPRESS to DEFLATE only
cmd_compress() and the imap-login proxy side channel looked up any
registered compression handler by name, so a client could request e.g.
COMPRESS ZSTD even though only COMPRESS=DEFLATE is advertised (RFC 4978).
Non-DEFLATE algorithms can require far more memory to decompress (a zstd
decoder alone can hold a 16+ MB window per connection versus ~40 KB for
inflate). This matters now that imap-login handles COMPRESS for proxied
connections: an attacker opening many connections could drive the shared
login process into its vsz_limit and crash it, affecting all clients on
that process.
Only accept DEFLATE on both the backend and the login proxy path.
Gbp-Pq: Name 0001-imap-Restrict-COMPRESS-to-DEFLATE-only.patch
Timo Sirainen [Wed, 22 Apr 2026 12:44:24 +0000 (15:44 +0300)]
[PATCH 2/3] imap-acl: Fail if ACL identifier is invalid
Reject invalid identifiers early in imap_acl_identifier_parse() using
acl_id_is_valid(). This prevents CR/LF injection and rejects identifiers
that are too long, contain control characters or are not valid UTF-8.
Timo Sirainen [Sun, 19 Apr 2026 23:10:29 +0000 (23:10 +0000)]
[PATCH] lib-sieve: Enforce CPU time limit within :contains and :matches matcher loops
The naive O(N*M) substring search in mcht-contains.c and the naive find loop
in mcht-matches.c can run for hours on a large value (e.g. a message body),
completely bypassing sieve_max_cpu_time because that limit was only checked
between bytecode operations.
Expose the active CPU limit via sieve_runtime_cpu_limit_exceeded() and poll
it every 4096 inner iterations. When the limit is hit the match returns
SIEVE_EXEC_RESOURCE_LIMIT, matching the existing behavior at the bytecode
boundary. This is a minimal safety net ahead of switching the matchers to
algorithms that do not require it.
Aki Tuomi [Fri, 25 Jul 2025 05:16:52 +0000 (08:16 +0300)]
[PATCH] auth: Use AUTH_CACHE_KEY_USER instead of per-database constants
Fixes cache key issue where users would end up overwriting
each other in cache due to cache key being essentially static
string because we no longer support %u.
Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients. This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch
* Import upstream fixes for multiple security issues. (Closes: #1146018)
- CVE-2026-27852: DoS by sending mail with bad header
- CVE-2026-33263: submission-login: Panic when
mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8)
failed: Bad file descriptor
- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare
Carriage Return
- CVE-2026-33605: managesieve-login: Pre-auth crash
- CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential
Backtracking — CPU Denial of Service
- CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole
ManageSieve CHECKSCRIPT/PUTSCRIPT
- CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted
References Header (index-thread-links.c)
- CVE-2026-40015: imap-hibernate can be crashed
- CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
in strmap (mail-index-strmap.c / hash2.c)
- CVE-2026-40018: MySQL multi-byte escaping wrong
- CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl
restrictions
- CVE-2026-42007: Sieve editheader RCE
- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command
- CVE-2026-42394: sieve: symlink traversal flaw could result in
arbitrary file disclosure
- CVE-2026-52681: Sieve resource usage tracking lost when active
script changes
- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage
- CVE-2026-73209: imap-login crash: Self-recursion on zero-output
decompress chunks
- CVE-2026-33606: dsync: Mail content can cause dsync protocol
injection
- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced
Email Body Matches Sender-Chosen Text
- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows
nopassword injection via trusted proxy
- CVE-2026-42392: imap-urlauth leaks memory into user-visible error
messages
- CVE-2026-42393: doveadm_password or api key length can still be
leaked with timing comparisons
- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes
- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR
semantics in remote validation path
- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for
missing scope claim
* lib-mail: istream-header-filter - Fix potential assert-crash
(Closes: #1144639)
* CI: Disable test-build-twice job, which is known to fail on trixie
projects / dovecot.git / log