Request 3229 (superseded)

cyrus-imapd.spec Changed

@@ -1,12 +1,11 @@
 %global testdata_commit ca669d4b76c71cbeb4fa840e263e2c031e19ea88
 %global testdata_short %(echo %{testdata_commit} | cut -c -8)
-%global cyrus_version 3.6.6
 
 # Cassandane was split into separate CI test, run '--with cassandane' to enable it.
 %bcond_with cassandane
 
 Name: cyrus-imapd
-Version: 3.6.6.4
+Version: 3.6.1
 Release: 0.1%{?dist}
 
 %define ssl_pem_file_prefix /etc/pki/%name/%name
@@ -25,7 +24,7 @@
 License: BSD
 URL: http://www.cyrusimap.org/
 
-Source0: cyrus-imapd-%{cyrus_version}.tar.gz
+Source0: cyrus-imapd-3.6.1.tar.gz
 
 
 # Adapt a timeout to handle our slower builders
@@ -44,6 +43,30 @@
 # https://github.com/cyrusimap/cyrus-imapd/issues/2629#issuecomment-456925909
 Patch3: patch-cyrus-perl-linking
 
+# https://github.com/cyrusimap/cyrus-imapd/pull/3892
+Patch4: patch-cyrus-squatter-assert-crash
+
+Patch5: 0001-Fixed-CALDAV-PUT-requests-while-proxying.patch
+
+%if 0%{?rhel} >= 9
+Patch6: 0001-Openssl-3.0-fixes.patch
+%endif
+
+Patch7: 0003-Configurable-default-addressbook-display-name.patch
+Patch8: 0004-Autocreate-on-PROPFIND.patch
+Patch9: 0001-Add-support-for-delayed-delete-mode-in-sync_apply_un.patch
+Patch10: 0005-Fixed-GETMETADATA-proxying.patch
+Patch11: 0001-Accept-existing-ancestors-to-new-mailboxes.patch
+Patch12: 0001-Fix-SETMETADATA-on-shared-folders.patch
+Patch13: 0001-Print-errors-during-sieve-script-parsing.patch
+Patch14: 0002-Ignore-broken-and-missing-sieve-scripts-during-repli.patch
+Patch15: 0001-Fixed-crash-on-0-pointer-access-in-mupdate.c.patch
+Patch16: 0001-Backwards-compatibility-for-the-sync-protocol-withou.patch
+Patch17: 0001-Always-quote-SETMETADATA-values.patch
+Patch18: 0002-Fixed-GETMETADATA-parsing.patch
+Patch19: 0001-For-metadata-proxying-we-expect-to-have-as-maniy-ent.patch
+Patch20: 0001-Correctly-proxy-GETMETADATA-with-DEPTH-0.patch
+
 
 Source10: cyrus-imapd.logrotate
 Source11: cyrus-imapd.pam-config
@@ -229,7 +252,7 @@
 
 
 %prep
-%autosetup -p1 -n cyrus-imapd-%{cyrus_version}
+%autosetup -p1 -n cyrus-imapd-%version
 echo %version > VERSION
 
 # Install the Fedora-specific documentation file

0001-Accept-existing-ancestors-to-new-mailboxes.patch Added

@@ -0,0 +1,36 @@
+From b7e92363efd8955e9abb0300805d28cf6ec06588 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 3 Mar 2023 15:11:34 +0100
+Subject: PATCH Accept existing ancestors to new mailboxes
+
+I've been running into this when creating multiple shared mailboxes,
+such as shared/Resources/test1@kolab.org, shared/Resources/test2@kolab.org.
+After the first mailbox, any subsequent mailbox creation with an @ in
+the name would fail (because it tried to recreate the shared mailbox).
+
+The regression was introduced by 31d612831f719cfa288e7e03e51ff553bc9c6a50,
+and only affects the localcreate path (seems to work fine in a murder)
+---
+ imap/imapd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index bd97a0b31..4abcd27dc 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -7150,6 +7150,12 @@ localcreate:
+                                            imapd_userid, imapd_authstate,
+                                            flags, NULL/*mailboxptr*/);
+                 if (r) {
++                    // If the mailbox already exists this should be fine.
++                    // TODO: check acl?
++                    if (r == IMAP_MAILBOX_EXISTS) {
++                        r = 0;
++                        continue;
++                    }
+                     // XXX  should we delete the ancestors we just created?
+                     break;
+                 }
+-- 
+2.39.1
+

0001-Add-support-for-delayed-delete-mode-in-sync_apply_un.patch Added

@@ -0,0 +1,76 @@
+From 56cd822d3570c8837c5475a0864192351dc28f8f Mon Sep 17 00:00:00 2001
+From: "Jeroen van Meeuwen (Apheleia IT)" <vanmeeuwen@apheleia-it.ch>
+Date: Tue, 29 Nov 2022 11:38:25 +0100
+Subject: PATCH Add support for delayed delete mode in sync_apply_unmailbox()
+ and sync_apply_unuser()
+
+Signed-off-by: Jeroen van Meeuwen (Apheleia IT) <vanmeeuwen@apheleia-it.ch>
+---
+ imap/sync_support.c | 33 +++++++++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+diff --git a/imap/sync_support.c b/imap/sync_support.c
+index e6e558d6f..20d84e30f 100644
+--- a/imap/sync_support.c
++++ b/imap/sync_support.c
+@@ -3630,6 +3630,7 @@ bail:
+ int sync_apply_unmailbox(struct dlist *kin, struct sync_state *sstate)
+ {
+     const char *mboxname = kin->sval;
++    int r;
+ 
+     struct mboxlock *namespacelock = mboxname_usernamespacelock(mboxname);
+ 
+@@ -3637,9 +3638,20 @@ int sync_apply_unmailbox(struct dlist *kin, struct sync_state *sstate)
+     int delflags = MBOXLIST_DELETE_FORCE | MBOXLIST_DELETE_SILENT;
+     if (sstate->flags & SYNC_FLAG_LOCALONLY)
+         delflags |= MBOXLIST_DELETE_LOCALONLY;
+-    int r = mboxlist_deletemailbox(mboxname, sstate->userisadmin,
++
++    if (!mboxlist_delayed_delete_isenabled()) {
++        r = mboxlist_deletemailbox(mboxname, sstate->userisadmin,
++                                   sstate->userid, sstate->authstate,
++                                   NULL, delflags);
++    } else if (mboxname_isdeletedmailbox(mboxname, NULL)) {
++        r = mboxlist_deletemailbox(mboxname, sstate->userisadmin,
+                                    sstate->userid, sstate->authstate,
+                                    NULL, delflags);
++    } else {
++        r = mboxlist_delayed_deletemailbox(mboxname, sstate->userisadmin,
++                                           sstate->userid, sstate->authstate,
++                                           NULL, delflags);
++    }
+ 
+     mboxname_release(&namespacelock);
+ 
+@@ -3972,11 +3984,24 @@ int sync_apply_unuser(struct dlist *kin, struct sync_state *sstate)
+     int delflags = MBOXLIST_DELETE_FORCE;
+     if (sstate->flags & SYNC_FLAG_LOCALONLY)
+         delflags |= MBOXLIST_DELETE_LOCALONLY;
++
+     for (i = list->count; i; i--) {
+         const char *name = strarray_nth(list, i-1);
+-        r = mboxlist_deletemailbox(name, sstate->userisadmin,
+-                                   sstate->userid, sstate->authstate,
+-                                   NULL, delflags);
++
++        if (!mboxlist_delayed_delete_isenabled()) {
++            r = mboxlist_deletemailbox(name, sstate->userisadmin,
++                                       sstate->userid, sstate->authstate,
++                                       NULL, delflags);
++        } else if (mboxname_isdeletedmailbox(name, NULL)) {
++            r = mboxlist_deletemailbox(name, sstate->userisadmin,
++                                       sstate->userid, sstate->authstate,
++                                       NULL, delflags);
++        } else {
++            r = mboxlist_delayed_deletemailbox(name, sstate->userisadmin,
++                                               sstate->userid, sstate->authstate,
++                                               NULL, delflags);
++        }
++
+         if (r) goto done;
+     }
+ 
+-- 
+2.37.3
+

0001-Always-quote-SETMETADATA-values.patch Added

@@ -0,0 +1,27 @@
+From 2d3fd722e89d579cbbd1fe1006e7b8a7d19891a4 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 19 May 2023 10:58:27 +0200
+Subject: PATCH Always quote SETMETADATA values
+
+the value can be NUL, a quoted string or a literal, but NOT an atom.
+Per RFC and parsing implementation.
+---
+ imap/imap_proxy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/imap/imap_proxy.c b/imap/imap_proxy.c
+index dd7c608b2..7d6dc4335 100644
+--- a/imap/imap_proxy.c
++++ b/imap/imap_proxy.c
+@@ -1497,7 +1497,7 @@ int annotate_store_proxy(const char *server, const char *mbox_pat,
+             /* Print the entry-value pair */
+             prot_printamap(be->out, entrybuf.s, entrybuf.len);
+             prot_putc(' ', be->out);
+-            prot_printamap(be->out, av->value.s, av->value.len);
++            prot_printmap(be->out, av->value.s, av->value.len);
+ 
+             if (av->next) prot_putc(' ', be->out);
+         }
+-- 
+2.40.0
+

0001-Backwards-compatibility-for-the-sync-protocol-withou.patch Added

@@ -0,0 +1,43 @@
+From d45b77b5d13108009c4ecd09bc15c032b527fdba Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Wed, 17 May 2023 18:16:09 +0200
+Subject: PATCH Backwards compatibility for the sync protocol without MODSEQ
+
+Required after 9d4d5069230d699c34e9c8410f0bd1df9ae3040a
+---
+ imap/sync_support.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/imap/sync_support.c b/imap/sync_support.c
+index f2699108a..0b43f15d0 100755
+--- a/imap/sync_support.c
++++ b/imap/sync_support.c
+@@ -1420,8 +1420,11 @@ int decode_annotations(/*const*/struct dlist *annots,
+             return IMAP_PROTOCOL_BAD_PARAMETERS;
+         if (!dlist_getatom(aa, "USERID", &userid))
+             return IMAP_PROTOCOL_BAD_PARAMETERS;
+-        if (!dlist_getnum64(aa, "MODSEQ", &modseq))
+-            return IMAP_PROTOCOL_BAD_PARAMETERS;
++        if (!dlist_getnum64(aa, "MODSEQ", &modseq)) {
++            // Backwards compat for cyrus 2.5
++            modseq = 0;
++            //return IMAP_PROTOCOL_BAD_PARAMETERS;
++        }
+         if (!dlist_getbuf(aa, "VALUE", &value))
+             return IMAP_PROTOCOL_BAD_PARAMETERS;
+         if (!strcmp(entry, IMAP_ANNOT_NS "thrid") &&
+@@ -2997,9 +3000,9 @@ int sync_apply_mailbox(struct dlist *kin,
+     /* take all mailbox (not message) annotations - aka metadata,
+      * they're not versioned either */
+     if (ka)
+-        decode_annotations(ka, &mannots, mailbox, NULL);
++        r = decode_annotations(ka, &mannots, mailbox, NULL);
+ 
+-    r = read_annotations(mailbox, NULL, &rannots, 0, 0);
++    if (!r) r = read_annotations(mailbox, NULL, &rannots, 0, 0);
+     if (!r) r = apply_annotations(mailbox, NULL, rannots, mannots, 0, NULL);
+ 
+     if (r) {
+-- 
+2.40.0
+

0001-Correctly-proxy-GETMETADATA-with-DEPTH-0.patch Added

@@ -0,0 +1,75 @@
+From 572a42859211d810af65fb4e40962115831b21fa Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 7 Sep 2023 22:04:38 +0200
+Subject: PATCH Correctly proxy GETMETADATA with DEPTH != 0
+
+Not that the backend handles DEPTH infinity correctly, but we try.
+---
+ imap/imap_proxy.c | 40 ++++++++++++++++++++++++++++++++++------
+ 1 file changed, 34 insertions(+), 6 deletions(-)
+
+diff --git a/imap/imap_proxy.c b/imap/imap_proxy.c
+index 7d6dc4335..aca1ab4df 100644
+--- a/imap/imap_proxy.c
++++ b/imap/imap_proxy.c
+@@ -1409,7 +1409,7 @@ int annotate_fetch_proxy(const char *server, const char *mbox_pat,
+                          const strarray_t *attribute_pat)
+ {
+     struct backend *be;
+-    int i;
++    int i, increment;
+     char mytag128;
+ 
+     assert(server && mbox_pat && entry_pat && attribute_pat);
+@@ -1421,15 +1421,43 @@ int annotate_fetch_proxy(const char *server, const char *mbox_pat,
+ 
+     /* Send command to remote */
+     proxy_gentag(mytag, sizeof(mytag));
+-    prot_printf(be->out, "%s GETMETADATA \"%s\" (", mytag, mbox_pat);
++    prot_printf(be->out, "%s GETMETADATA (", mytag);
++
++    //For depth infinity/1 we get an extra entry (per pattern), with a suffix we can check (* for infinity, % for 1).
++    // entry /vendor/kolab/folder-type
++    // entry /vendor/kolab/folder-type/*
++    //
++    // We only check the first, because there is just one depth in GETMETADATA
++    // FIXME: we completely ignore other options
++    if (entry_pat->count == attribute_pat->count) {
++        prot_printf(be->out, "DEPTH 0) \"%s\" (", mbox_pat);
++    } else if (entry_pat->count > 1) {
++        const char *entry = strarray_nth(entry_pat, 1);
++        const char suffix = entrystrlen(entry) - 1;
++        if (suffix == '%') {
++            prot_printf(be->out, "DEPTH 1) \"%s\" (", mbox_pat);
++        } else if (suffix == '*') {
++            prot_printf(be->out, "DEPTH infinity) \"%s\" (", mbox_pat);
++        } else {
++            syslog(LOG_ERR, "Unknown entry suffix %s %c", entry, suffix);
++            return IMAP_INTERNAL;
++        }
++    }
+ 
+-    if (entry_pat->count != attribute_pat->count) {
+-        syslog(LOG_ERR, "Number of scopes and entries must match");
++    //With DEPTH 0, we get one entry pattern. With DEPTH infinity an extra pattern with /*, and with DEPTH 1 and extra pattern of /%
++    if (entry_pat->count == attribute_pat->count) {
++        increment = 1;
++    } else {
++        increment = 2;
++    }
++    //The count matches if depth = 0, otherwise we have twice the number of entries.
++    if ((entry_pat->count / increment) != attribute_pat->count) {
++        syslog(LOG_ERR, "Number of scopes and entries must match %i %i", entry_pat->count, attribute_pat->count);
+         return IMAP_INTERNAL;
+     }
+ 
+-    for (i = 0; i < entry_pat->count; i++) {
+-        const char *entry = strarray_nth(entry_pat, i);
++    for (i = 0; (i * increment) < entry_pat->count; i++) {
++        const char *entry = strarray_nth(entry_pat, i * increment);
+         const char *scope, *attr = strarray_nth(attribute_pat, i);
+         if (!strcmp(attr, "value.shared")) {
+             scope = "/shared";
+-- 
+2.41.0
+

0001-Fix-SETMETADATA-on-shared-folders.patch Added

@@ -0,0 +1,35 @@
+From 24a205d2c4d7c3696413439c1bb68137d2ef9bf6 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 3 Mar 2023 17:12:46 +0100
+Subject: PATCH Fix SETMETADATA on shared folders
+
+Doesn't work at least when setting the metadata as cyrus-admin.
+
+This probably broke in bb26a0f1287ef7e0196d0f3eb4b268fee92c2ee7,
+but I'm not sure what the correct fix is.
+---
+ imap/mboxlist.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/imap/mboxlist.c b/imap/mboxlist.c
+index 5f4ac2446..e09873d04 100644
+--- a/imap/mboxlist.c
++++ b/imap/mboxlist.c
+@@ -1085,7 +1085,13 @@ static int mboxlist_update_racl(const char *dbname, const mbentry_t *oldmbentry,
+ static void assert_namespacelocked(const char *mboxname)
+ {
+     char *userid = mboxname_to_userid(mboxname);
+-    assert(user_isnamespacelocked(userid));
++    // I think this just doesn't work for shared folders
++    if (!user_isnamespacelocked(userid)) {
++        syslog(LOG_ERR,
++                "assert_namespacelocked failed for userid '%s' and mailbox '%s'",
++                userid, mboxname);
++        // assert(false);
++    }
+     free(userid);
+ }
+ 
+-- 
+2.39.1
+

0001-Fixed-CALDAV-PUT-requests-while-proxying.patch Added

0001-Fixed-crash-on-0-pointer-access-in-mupdate.c.patch Added

@@ -0,0 +1,47 @@
+From 49a6571f495c731796ab31f7cefca317d8e3e19a Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 5 May 2023 09:19:35 +0200
+Subject: PATCH Fixed crash on 0 pointer access in mupdate.c
+
+We can't check the location of the mailbox if it doesn't exist.
+This means we can't really suppress the DOESNTEXIST message,
+but I don't know if this is a problem in reality.
+---
+ imap/mupdate.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/imap/mupdate.c b/imap/mupdate.c
+index 2cc2571bc..8d4f92415 100644
+--- a/imap/mupdate.c
++++ b/imap/mupdate.c
+@@ -1629,7 +1629,7 @@ static void cmd_set(struct conn *C,
+              * deactivation twice. Suppress bailing out on the second one
+              * (the replica).
+              */
+-            if (strcmp(m->location, location)) {
++            if (m && strcmp(m->location, location)) {
+                 /* failed; mailbox not currently active */
+                 msg = NOTACTIVE;
+                 goto done;
+@@ -1643,15 +1643,9 @@ static void cmd_set(struct conn *C,
+         if (!m) {
+             /* Check if we run in a discrete murder topology */
+             if (config_mupdate_config == IMAP_ENUM_MUPDATE_CONFIG_STANDARD) {
+-                /* Replicated backends with the same server name issue
+-                 * deletion twice. Suppress bailing out on the second one
+-                 * (the replica).
+-                 */
+-                if (strcmp(m->location, location)) {
+-                    /* failed; mailbox doesn't exist */
+-                    msg = DOESNTEXIST;
+-                    goto done;
+-                }
++                /* failed; mailbox doesn't exist */
++                msg = DOESNTEXIST;
++                goto done;
+             }
+             /* otherwise do nothing (local delete on master) */
+         } else {
+-- 
+2.40.0
+

0001-For-metadata-proxying-we-expect-to-have-as-maniy-ent.patch Added

@@ -0,0 +1,52 @@
+From c8fb932617612efb224d0c589082969be92f5018 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 19 May 2023 14:06:42 +0200
+Subject: PATCH For metadata proxying we expect to have as maniy entries in
+ the attributes as for the values.
+
+This might break metadata support in LIST, don't think the codepath is
+used elsewhere.
+---
+ imap/imapd.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 4abcd27dc..e57c7bfb6 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -10374,8 +10374,6 @@ static int _metadata_to_annotate(const strarray_t *entries,
+                                  const char *tag, int depth)
+ {
+     int i;
+-    int have_shared = 0;
+-    int have_private = 0;
+ 
+     /* we need to rewrite the entries and attribs to match the way that
+      * the old annotation system works. */
+@@ -10390,12 +10388,12 @@ static int _metadata_to_annotate(const strarray_t *entries,
+         if (!strncmp(ent, "/private", 8) &&
+             (ent8 == '\0' || ent8 == '/')) {
+             xstrncpy(entry, ent + 8, MAX_MAILBOX_NAME);
+-            have_private = 1;
++            strarray_append(newa, "value.priv");
+         }
+         else if (!strncmp(ent, "/shared", 7) &&
+                  (ent7 == '\0' || ent7 == '/')) {
+             xstrncpy(entry, ent + 7, MAX_MAILBOX_NAME);
+-            have_shared = 1;
++            strarray_append(newa, "value.shared");
+         }
+         else {
+             if (tag)
+@@ -10415,8 +10413,6 @@ static int _metadata_to_annotate(const strarray_t *entries,
+         }
+     }
+ 
+-    if (have_private) strarray_append(newa, "value.priv");
+-    if (have_shared) strarray_append(newa, "value.shared");
+ 
+     return 0;
+ }
+-- 
+2.40.0
+

0001-Openssl-3.0-fixes.patch Added

@@ -0,0 +1,175 @@
+From 2c816fac8d7f69539b0dde34fa74a55257232d16 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 14 Oct 2022 17:00:07 +0200
+Subject: PATCH Openssl 3.0 fixes
+
+---
+ imap/tls.c      | 31 +++++++++++++++++++------------
+ imtest/imtest.c | 12 +++++++-----
+ 2 files changed, 26 insertions(+), 17 deletions(-)
+
+diff --git a/imap/tls.c b/imap/tls.c
+index 7951c98e3..df6c9cd61 100644
+--- a/imap/tls.c
++++ b/imap/tls.c
+@@ -149,7 +149,7 @@ static int tls_serverengine = 0; /* server engine initialized? */
+ static int tls_clientengine = 0; /* client engine initialized? */
+ static int do_dump = 0;         /* actively dumping protocol? */
+ 
+-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
++#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ static DH *dh_params = NULL;
+ #endif
+ 
+@@ -240,7 +240,7 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
+ }
+ #endif
+ 
+-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
++#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ /* Logic copied from OpenSSL apps/s_server.c: give the TLS context
+  * DH params to work with DHE-* cipher suites. Hardcoded fallback
+  * in case no DH params in server_key or server_cert.
+@@ -739,7 +739,6 @@ EXPORTED int     tls_init_serverengine(const char *ident,
+     const char   *client_ca_file;
+     const char   *server_ca_file;
+     const char   *server_cert_file;
+-    const char   *server_dhparam_file;
+     const char   *server_key_file;
+     const char   *crl_file_path;
+     enum enum_value tls_client_certs;
+@@ -883,7 +882,6 @@ EXPORTED int     tls_init_serverengine(const char *ident,
+ 
+     server_ca_file = config_getstring(IMAPOPT_TLS_SERVER_CA_FILE);
+     server_cert_file = config_getstring(IMAPOPT_TLS_SERVER_CERT);
+-    server_dhparam_file = config_getstring(IMAPOPT_TLS_SERVER_DHPARAM);
+     server_key_file = config_getstring(IMAPOPT_TLS_SERVER_KEY);
+ 
+     if (config_debug) {
+@@ -949,8 +947,11 @@ EXPORTED int     tls_init_serverengine(const char *ident,
+     SSL_CTX_set_tmp_rsa_callback(s_ctx, tmp_rsa_cb);
+ #endif
+ 
+-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
++#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
++    SSL_CTX_set_dh_auto(s_ctx, 1);
++#elif (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
+     /* Load DH params for DHE-* key exchanges */
++    const char *server_dhparam_file = config_getstring(IMAPOPT_TLS_SERVER_DHPARAM);
+     dh_params = load_dh_param(server_dhparam_file, server_key_file, server_cert_file);
+     SSL_CTX_set_tmp_dh(s_ctx, dh_params);
+ #endif
+@@ -959,12 +960,16 @@ EXPORTED int     tls_init_serverengine(const char *ident,
+     const char *ec = config_getstring(IMAPOPT_TLS_ECCURVE);
+     int openssl_nid = OBJ_sn2nid(ec);
+     if (openssl_nid != 0) {
++#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
++        SSL_CTX_set1_curves(s_ctx, &openssl_nid, 1);
++#else
+         EC_KEY *ecdh;
+         ecdh = EC_KEY_new_by_curve_name(openssl_nid);
+         if (ecdh != NULL) {
+             SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
+             EC_KEY_free(ecdh);
+         }
++#endif
+     }
+ #endif
+ 
+@@ -1086,20 +1091,22 @@ EXPORTED int     tls_init_serverengine(const char *ident,
+ 
+ /* taken from OpenSSL apps/s_cb.c */
+ 
+-static long bio_dump_cb(BIO * bio, int cmd, const char *argp, int argi,
+-                        long argl __attribute__((unused)), long ret)
++static long bio_dump_cb(BIO * bio, int cmd, const char *argp,
++                        size_t len __attribute__((unused)), int argi,
++                        long argl __attribute__((unused)), int ret,
++                        size_t *processed __attribute__((unused)))
+ {
+     if (!do_dump)
+         return (ret);
+ 
+     if (cmd == (BIO_CB_READ | BIO_CB_RETURN)) {
+-        printf("read from %08lX %08lX (%d bytes => %ld (0x%lX))",
++        printf("read from %08lX %08lX (%d bytes => %d (0x%X))",
+                (unsigned long)bio, (unsigned long)argp,
+                argi, ret, ret);
+         tls_dump(argp, (int) ret);
+         return (ret);
+     } else if (cmd == (BIO_CB_WRITE | BIO_CB_RETURN)) {
+-        printf("write to %08lX %08lX (%d bytes => %ld (0x%lX))",
++        printf("write to %08lX %08lX (%d bytes => %d (0x%X))",
+                (unsigned long) bio, (unsigned long)argp,
+                argi, ret, ret);
+         tls_dump(argp, (int) ret);
+@@ -1171,7 +1178,7 @@ EXPORTED int tls_start_servertls(int readfd, int writefd, int timeout,
+      * created for us, so we can use it for debugging purposes.
+      */
+     if (var_imapd_tls_loglevel >= 3)
+-        BIO_set_callback(SSL_get_rbio(tls_conn), bio_dump_cb);
++        BIO_set_callback_ex(SSL_get_rbio(tls_conn), bio_dump_cb);
+ 
+     /* Dump the negotiation for loglevels 3 and 4*/
+     if (var_imapd_tls_loglevel >= 3)
+@@ -1402,7 +1409,7 @@ EXPORTED int tls_shutdown_serverengine(void)
+             sess_dbopen = 0;
+         }
+ 
+-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL)
++#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
+         if (dh_params) DH_free(dh_params);
+ #endif
+     }
+@@ -1659,7 +1666,7 @@ HIDDEN int tls_start_clienttls(int readfd, int writefd,
+      * created for us, so we can use it for debugging purposes.
+      */
+     if (var_proxy_tls_loglevel >= 3)
+-        BIO_set_callback(SSL_get_rbio(tls_conn), bio_dump_cb);
++        BIO_set_callback_ex(SSL_get_rbio(tls_conn), bio_dump_cb);
+ 
+     /* Dump the negotiation for loglevels 3 and 4*/
+     if (var_proxy_tls_loglevel >= 3)
+diff --git a/imtest/imtest.c b/imtest/imtest.c
+index a6fcf91e6..ca241fa61 100644
+--- a/imtest/imtest.c
++++ b/imtest/imtest.c
+@@ -630,20 +630,22 @@ static int tls_dump(const char *s, int len)
+ 
+ /* taken from OpenSSL apps/s_cb.c */
+ 
+-static long bio_dump_cb(BIO * bio, int cmd, const char *argp, int argi,
+-                        long argl __attribute__((unused)), long ret)
++static long bio_dump_cb(BIO * bio, int cmd, const char *argp,
++                        size_t len __attribute__((unused)), int argi,
++                        long argl __attribute__((unused)), int ret,
++                        size_t *processed __attribute__((unused)))
+ {
+     if (!do_dump)
+         return (ret);
+ 
+     if (cmd == (BIO_CB_READ | BIO_CB_RETURN)) {
+-        printf("read from %08lX %08lX (%d bytes => %ld (0x%lX))\n",
++        printf("read from %08lX %08lX (%d bytes => %d (0x%X))\n",
+                (unsigned long) bio, (unsigned long) argp,
+                argi, ret, ret);
+         tls_dump(argp, (int) ret);
+         return (ret);
+     } else if (cmd == (BIO_CB_WRITE | BIO_CB_RETURN)) {
+-        printf("write to %08lX %08lX (%d bytes => %ld (0x%lX))\n",
++        printf("write to %08lX %08lX (%d bytes => %d (0x%X))\n",
+                (unsigned long) bio, (unsigned long) argp,
+                argi, ret, ret);
+         tls_dump(argp, (int) ret);
+@@ -686,7 +688,7 @@ static int tls_start_clienttls(unsigned *layer, char **authid)
+      * created for us, so we can use it for debugging purposes.
+      */
+     if (verbose==1)
+-        BIO_set_callback(SSL_get_rbio(tls_conn), bio_dump_cb);
++        BIO_set_callback_ex(SSL_get_rbio(tls_conn), bio_dump_cb);
+ 
+     /* Dump the negotiation for loglevels 3 and 4 */
+     if (verbose==1)
+-- 
+2.37.3
+

0001-Print-errors-during-sieve-script-parsing.patch Added

@@ -0,0 +1,49 @@
+From 0812b21a1697face5e49b73c9820d4c072735da1 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Wed, 15 Mar 2023 15:27:12 +0100
+Subject: PATCH 1/2 Print errors during sieve script parsing
+
+The one in mailbox.c stopped replication in it's tracks (from cyrus 2.5
+to 3.6), with a rather unhelpful "append_fromstage() failed: System I/O error" message.
+---
+ imap/mailbox.c  | 3 +++
+ imap/sieve_db.c | 3 +++
+ 2 files changed, 6 insertions(+)
+ mode change 100644 => 100755 imap/mailbox.c
+ mode change 100644 => 100755 imap/sieve_db.c
+
+diff --git a/imap/mailbox.c b/imap/mailbox.c
+old mode 100644
+new mode 100755
+index 434afc11a..73ed22b38
+--- a/imap/mailbox.c
++++ b/imap/mailbox.c
+@@ -4087,6 +4087,9 @@ static int mailbox_update_sieve(struct mailbox *mailbox,
+         char *errors = NULL;
+ 
+         r = sievedir_put_script(mailbox->sievedir, name, content, &errors);
++        if (errors) {
++            syslog(LOG_ERR, "Error during sievedir_put_script for %s %s", mailbox_name(mailbox), errors);
++        }
+ 
+         if (!r && isactive) {
+             r = sievedir_activate_script(mailbox->sievedir, name);
+diff --git a/imap/sieve_db.c b/imap/sieve_db.c
+old mode 100644
+new mode 100755
+index 6088b8425..ea3653874
+--- a/imap/sieve_db.c
++++ b/imap/sieve_db.c
+@@ -1052,6 +1052,9 @@ EXPORTED int sieve_script_rebuild(const char *userid,
+     /* Update bytecode */
+     char *errors = NULL;
+     r = sievedir_put_script(sievedir, script, content, &errors);
++    if (errors) {
++        syslog(LOG_ERR, "Error during sievedir_put_script for %s %s", userid, errors);
++    }
+     free(errors);
+ 
+   done:
+-- 
+2.39.2
+

0002-Fixed-GETMETADATA-parsing.patch Added

@@ -0,0 +1,72 @@
+From 9a27d175b594f5315437ad7701f87bb643ec82fc Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 18 May 2023 14:52:04 +0200
+Subject: PATCH 2/2 Fixed GETMETADATA parsing
+
+THe previous implementation broken when requesting multiple metadata
+items (/shared/vendor/foo /private/vendor/foo).
+I assume this breaks GETANNOTATION and it may not work in the cases that
+the parsing in imap.c handles, but at least the basics work.
+---
+ imap/imap_proxy.c | 34 +++++++++++++++++++---------------
+ 1 file changed, 19 insertions(+), 15 deletions(-)
+
+diff --git a/imap/imap_proxy.c b/imap/imap_proxy.c
+index 14de79732..4e0db8821 100644
+--- a/imap/imap_proxy.c
++++ b/imap/imap_proxy.c
+@@ -1409,7 +1409,7 @@ int annotate_fetch_proxy(const char *server, const char *mbox_pat,
+                          const strarray_t *attribute_pat)
+ {
+     struct backend *be;
+-    int i, j;
++    int i;
+     char mytag128;
+ 
+     assert(server && mbox_pat && entry_pat && attribute_pat);
+@@ -1422,24 +1422,28 @@ int annotate_fetch_proxy(const char *server, const char *mbox_pat,
+     /* Send command to remote */
+     proxy_gentag(mytag, sizeof(mytag));
+     prot_printf(be->out, "%s GETMETADATA \"%s\" (", mytag, mbox_pat);
++
++    if (entry_pat->count != attribute_pat->count) {
++        syslog(LOG_ERR, "Number of scopes and entries must match");
++        return IMAP_INTERNAL;
++    }
++
+     for (i = 0; i < entry_pat->count; i++) {
+         const char *entry = strarray_nth(entry_pat, i);
+-
+-        for (j = 0; j < attribute_pat->count; j++) {
+-            const char *scope, *attr = strarray_nth(attribute_pat, j);
+-            if (!strcmp(attr, "value.shared")) {
+-                scope = "/shared";
+-            }
+-            else if (!strcmp(attr, "value.priv")) {
+-                scope = "/private";
+-            }
+-            else {
+-                syslog(LOG_ERR, "won't get deprecated annotation attribute %s", attr);
+-                continue;
+-            }
+-            prot_printf(be->out, "%s%s%s", i ? " " : "", scope, entry);
++        const char *scope, *attr = strarray_nth(attribute_pat, i);
++        if (!strcmp(attr, "value.shared")) {
++            scope = "/shared";
+         }
++        else if (!strcmp(attr, "value.priv")) {
++            scope = "/private";
++        }
++        else {
++            syslog(LOG_ERR, "won't get deprecated annotation attribute %s", attr);
++            continue;
++        }
++        prot_printf(be->out, "%s%s%s", i ? " " : "", scope, entry);
+     }
++
+     prot_printf(be->out, ")\r\n");
+     prot_flush(be->out);
+ 
+-- 
+2.40.0
+

0002-Ignore-broken-and-missing-sieve-scripts-during-repli.patch Added

@@ -0,0 +1,66 @@
+From e88b325855b83ff366c8108114ced33ec8f964b2 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Wed, 15 Mar 2023 15:58:09 +0100
+Subject: PATCH 2/2 Ignore broken and missing sieve scripts during
+ replication
+
+Required to synchronize legacy sieve scripts
+---
+ imap/sync_support.c | 14 +++++++++++++-
+ lib/imapoptions     |  5 +++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+ mode change 100644 => 100755 imap/sync_support.c
+
+diff --git a/imap/sync_support.c b/imap/sync_support.c
+old mode 100644
+new mode 100755
+index e6e558d6f..f2699108a
+--- a/imap/sync_support.c
++++ b/imap/sync_support.c
+@@ -933,7 +933,13 @@ int sync_sieve_activate(const char *userid, const char *bcname)
+                  (int) strlen(bcname) - BYTECODE_SUFFIX_LEN, bcname);
+ 
+         r = sievedb_lookup_name(db, name, &sdata, 0);
+-        if (r) goto done;
++        if (r) {
++            if (config_getswitch(IMAPOPT_SYNC_IGNORE_SIEVE_ERRORS)) {
++                syslog(LOG_ERR, "Failed to find the sieve script to activate: %s. Ignoring", bcname);
++                r = 0;
++            }
++            goto done;
++        }
+     }
+ 
+     r = sieve_script_activate(mailbox, sdata);
+@@ -3447,6 +3453,12 @@ int sync_sieve_upload(const char *userid, const char *fname,
+     }
+ 
+     r = sieve_script_store(mailbox, sdata, &buf);
++    if (r) {
++        if (config_getswitch(IMAPOPT_SYNC_IGNORE_SIEVE_ERRORS)) {
++            syslog(LOG_ERR, "Failed to store the sieve script %s for %s. Ignoring", name, userid);
++            r = 0;
++        }
++    }
+ 
+   done:
+     if (!r) sync_log_sieve(userid);
+diff --git a/lib/imapoptions b/lib/imapoptions
+index c15163265..384fb523b 100644
+--- a/lib/imapoptions
++++ b/lib/imapoptions
+@@ -2827,6 +2827,11 @@ product version in the capabilities
+    sync_client will only use csync.  Prefix with a channel name to
+    apply only for that channel */
+ 
++{ "sync_ignore_sieve_errors", 0, SWITCH, "3.6.0" }
++/* Whether sync_client should ignore errors related to sieve
++   script creation, and activation. Useful to fix replication
++   with legacy backends*/
++
+ { "syslog_prefix", NULL, STRING, "3.1.8" }
+ /* String to be prepended to the process name in syslog entries. Can
+    be further overridden by setting the $CYRUS_SYSLOG_PREFIX environment
+-- 
+2.39.2
+

0003-Configurable-default-addressbook-display-name.patch Added

@@ -0,0 +1,41 @@
+From d894680d087a684196f1af914fc399ca9fb06181 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Fri, 21 Oct 2022 12:15:20 +0200
+Subject: PATCH 3/4 Configurable default addressbook display name
+
+---
+ imap/http_carddav.c | 3 ++-
+ lib/imapoptions     | 3 +++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/imap/http_carddav.c b/imap/http_carddav.c
+index 0b7e6c7a5..1c9840047 100644
+--- a/imap/http_carddav.c
++++ b/imap/http_carddav.c
+@@ -485,7 +485,8 @@ EXPORTED int carddav_create_defaultaddressbook(const char *userid) {
+     r = mboxlist_lookup(mbname_intname(mbname), NULL, NULL);
+     if (r == IMAP_MAILBOX_NONEXISTENT) {
+         r = _create_mailbox(userid, mbname_intname(mbname),
+-                            MBTYPE_ADDRESSBOOK, "personal",
++                            MBTYPE_ADDRESSBOOK,
++                            config_getstring(IMAPOPT_ADDRESSBOOK_DEFAULT_DISPLAYNAME),
+                             &namespacelock);
+     }
+ 
+diff --git a/lib/imapoptions b/lib/imapoptions
+index 5cb8ef7b8..801401dc7 100644
+--- a/lib/imapoptions
++++ b/lib/imapoptions
+@@ -109,6 +109,9 @@ are listed with ``<none>''.
+    hierarchy will be at the toplevel of the shared namespace.  A
+    user's personal addressbook hierarchy will be a child of their Inbox. */
+ 
++{ "addressbook_default_displayname", "personal", STRING, "3.4.5" }
++/* The displayname to be used when creating a user's 'Default' addressbook. */
++
+ { "admins", "", STRING, "2.3.17" }
+ /* The list of userids with administrative rights.  Separate each userid
+    with a space.  Sites using Kerberos authentication may use
+-- 
+2.37.3
+

0004-Autocreate-on-PROPFIND.patch Added

@@ -0,0 +1,70 @@
+From 589ff4d046586ea313dea026ca58de52ec504755 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Mon, 24 Oct 2022 21:37:34 +0200
+Subject: PATCH 4/4 Autocreate on PROPFIND
+
+If we don't have existing calendar folders then dav_parse_req_target
+fails, because it looks for the base calendar via mupdate.
+The new codepath simply attempts to lookup the inbox instead and then
+proxies the request to that backend, triggering the autocreate.
+This requires that the inbox has been created before though.
+---
+ imap/http_dav.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+diff --git a/imap/http_dav.c b/imap/http_dav.c
+index 7c13d783b..2aac8d5bb 100644
+--- a/imap/http_dav.c
++++ b/imap/http_dav.c
+@@ -484,6 +484,28 @@ static unsigned long principal_allow_cb(struct request_target_t *tgt)
+     return tgt->namespace->allow;
+ }
+ 
++static struct backend *proxy_findinboxserver(const char *userid)
++{
++    mbentry_t *mbentry = NULL;
++    struct backend *s = NULL;
++
++    char *inbox = mboxname_user_mbox(userid, NULL);
++    int r = mboxlist_lookup(inbox, &mbentry, NULL);
++    free(inbox);
++
++    if (r) return NULL;
++
++    if (mbentry->mbtype & MBTYPE_REMOTE) {
++        s = proxy_findserver(mbentry->server, &http_protocol,
++                             httpd_userid, &backend_cached,
++                             NULL, NULL, httpd_in);
++    }
++
++    mboxlist_entry_free(&mbentry);
++
++    return s;
++}
++
+ 
+ /* Parse request-target path in DAV principals namespace */
+ static int principal_parse_path(const char *path, struct request_target_t *tgt,
+@@ -6116,7 +6138,18 @@ EXPORTED int meth_propfind(struct transaction_t *txn, void *params)
+     /* Parse the path */
+     if (fparams->parse_path) {
+         r = dav_parse_req_target(txn, fparams);
+-        if (r) return r;
++        if (r) {
++
++            struct backend *be;
++            be = proxy_findinboxserver(txn->req_tgt.userid);
++            if (!be) {
++                syslog(LOG_ERR, "Could not find a backend");
++                return HTTP_UNAVAILABLE;
++            }
++            return http_pipe_req_resp(be, txn);
++
++            return r;
++        }
+     }
+ 
+     /* Make sure method is allowed */
+-- 
+2.37.3
+

0005-Fixed-GETMETADATA-proxying.patch Added

Dockerfile Deleted

@@ -1,37 +0,0 @@
-FROM quay.io/almalinux/almalinux:8
-RUN rpm --import https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux
-
-# Add EPEL.
-RUN dnf -y install dnf-plugin-config-manager && \
-    dnf config-manager --set-enabled powertools && \
-    dnf -y install epel-release && \
-    dnf -y module enable 389-ds:1.4/default && \
-    dnf -y module enable mariadb:10.3 && \
-    dnf -y install iputils vim-enhanced bind-utils && \
-    dnf clean all
-RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
-
-# Install kolab
-RUN rpm --import https://mirror.apheleia-it.ch/repos/Kolab:/16/key.asc && \
-    rpm -Uvh https://mirror.apheleia-it.ch/repos/Kolab:/16/kolab-16-for-el8.rpm
-RUN sed -i -e '/^ssl/d' /etc/yum.repos.d/kolab*.repo && \
-    dnf config-manager --enable kolab-16-testing &&\
-    dnf -y --setopt tsflags= install patch &&\
-    dnf clean all
-
-RUN sed -i -r -e 's/^SELINUX=.*$/SELINUX=permissive/g' /etc/selinux/config 2>/dev/null || :
-
-WORKDIR /root/
-
-RUN dnf -y install git autoconf automake bison cyrus-sasl-devel flex gcc gperf jansson-devel libbsd-devel libtool libicu-devel libuuid-devel openssl-devel pkgconfig sqlite-devel brotli-devel libical-devel libxml2-devel libnghttp2-devel shapelib  zlib-devel pcre-devel perl-devel && \
-    dnf -y install cyrus-imapd  cyrus-sasl cyrus-sasl-plain && \
-    dnf -y group install "Development Tools"
-
-RUN dnf -y install unzip bash git tar gzip wget curl which python3-sphinx jansson-devel gperf cpan transfig
-RUN cpan Pod::POM::View::Restructured
-RUN pip3 install gitpython
-
-ADD buildtarball.sh /buildtarball.sh
-RUN id default || (groupadd -g 1000 default && useradd -d /home/default/ -u 1000 -g 1000 default)
-USER 1000
-WORKDIR /home/default/

Makefile Deleted

buildtarball.sh Deleted

cyrus-imapd-3.6.6.tar.gz -> cyrus-imapd-3.6.1.tar.gz Changed

patch-cyrus-squatter-assert-crash Added

release.sh Deleted

Overview

Request 3229 (superseded)

Request History