aboutsummaryrefslogtreecommitdiffstats
path: root/Changelog
Commit message (Collapse)AuthorAgeFiles
* libinterimap: remove default SSL_protocols value.Guilhem Moulin2020-12-111
| | | | | | | | Namely, use the system default instead of "!SSLv2 !SSLv3 !TLSv1 !TLSv1.1". As of Debian Buster (OpenSSL 1.1.1) this does not make a difference, however using the system default provides better compatibility with future libssl versions.
* Remove incorrect affirmation from 0.5.4 changelog.Guilhem Moulin2020-12-111
| | | | | The test suite already required OpenSSL ≥1.1.1 as some tests are using TLSv1.3.
* typofixGuilhem Moulin2020-12-111
|
* Prepare new release v0.5.4.v0.5.4Guilhem Moulin2020-12-111
|
* Prepare new release v0.5.4.Guilhem Moulin2020-12-111
|
* rename 'debian' branch to 'debian/latest' for DEP-14 compliance.Guilhem Moulin2020-12-111
|
* Makefile: new 'release' target.Guilhem Moulin2020-12-111
| | | | Also, change the tag format from upstream/$VERSION to v$VERSION.
* libinterimap: add support for the TLS SNI (Server Name Indication) extension.Guilhem Moulin2020-12-111
| | | | | | This is controlled by the new 'SSL_hostname' option. The default value of that option is the value of the 'host' option when it is hostname, and the empty string (which disables SNI) when it is an IP literal.
* libinterimap: make SSL_verify check the hostname as well.Guilhem Moulin2020-12-111
| | | | | | | | | | More precisely, ensure that the certificate Subject Alternative Name (SAN) or Subject CommonName (CN) matches the hostname or IP literal specified by the 'host' option. Previously it was only verifying the chain of trust. This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version 1.0.2.
* libinterimap: factor out hostname/IP parsing.Guilhem Moulin2020-12-111
| | | | | Also, document that enclosing 'host' value in square brackets forces its interpretation as an IP literal (hence skips name resolution).
* test suite: always generate new certificates on `make test`.Guilhem Moulin2020-12-111
| | | | | In addition, sign test certificates with the same root CA. Hence running `make test` now requires OpenSSL 1.1.1 or later.
* libinterimap: show the matching pinned SPKI in --debug mode.Guilhem Moulin2020-12-111
|
* documentation: replace example.org with example.net for consistency.Guilhem Moulin2020-12-101
|
* Prepare new release.upstream/0.5.3Guilhem Moulin2020-12-091
|
* New test with a server offering both RSA+ECDSA certificates.Guilhem Moulin2020-12-091
| | | | | | | | | | | | This requires dovecot-imapd 2.2.31 or later. Certificate generated with: $ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve \ -out tests/snippets/dovecot/dovecot.ecdsa.key $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \ -key tests/snippets/dovecot/dovecot.ecdsa.key \ -out tests/snippets/dovecot/dovecot.ecdsa.crt
* libinterimap: SSL_fingerprint now supports a space-separate list of digests ↵Guilhem Moulin2020-12-091
| | | | | | | | | to pin. And succeeds if, and only if, the peer certificate SPKI matches one of the pinned digest values. Specifying multiple digest values can key useful in key rollover scenarios and/or when the server supports certificates of different types (for instance RSA+ECDSA).
* test suite: use a RSA certificate rather than ECDSA.Guilhem Moulin2020-12-091
| | | | | | | | | It's arguably the most common use-case. Generated with $ openssl genpkey -algorithm RSA -out tests/snippets/dovecot/dovecot.rsa.key $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \ -key tests/snippets/dovecot/dovecot.rsa.key \ -out tests/snippets/dovecot/dovecot.rsa.crt
* libinterimap: 'debug' forces 'null-stderr' = 0.Guilhem Moulin2020-12-081
| | | | | | The standard error is never sent to /dev/null in debug mode. Closes: deb#968392
* Prepare new release.upstream/0.5.2Guilhem Moulin2020-08-031
|
* libinterimap: abort on PREAUTH greeting received on plaintext connectionsGuilhem Moulin2020-08-031
| | | | | Set "STARTTLS = NO" to ignore. This is similar to CVE-2020-12398 and CVE-2020-14093.
* libinterimap: Fix response injection vulnerability after STARTTLS.Guilhem Moulin2020-08-031
| | | | For background see https://gitlab.com/muttmua/mutt/-/issues/248 .
* libinterimap: fail when a capability to ENABLE is missing from the server's ↵Guilhem Moulin2020-08-031
| | | | CAPABILITY listing.
* Makefile: remove 'smart' extension from pandoc call to generate manuals.Guilhem Moulin2020-08-031
|
* Prepare new release.upstream/0.5.1Guilhem Moulin2020-07-021
|
* Makefile: Major refactoring, add install and uninstall targets.Guilhem Moulin2020-07-021
| | | | | | Honor BUILD_DOCDIR and DESTDIR variables. Also, remove the `use lib` statement from our executables.
* pullimap: Also compare RFC 5322 date and envelope information in mailbox ↵Guilhem Moulin2020-07-021
| | | | comparison tests.
* Fix version number.Guilhem Moulin2020-01-291
|
* Prepare new release candidate.upstream/0.5-rcGuilhem Moulin2019-12-141
|
* pullimap: Fix mangling of data lines starting with a dot.Guilhem Moulin2019-11-181
| | | | | | | Some LMTP servers, Dovecot's in particular, trims leading dots that are not doubled (e.g. “.foo” would become “foo”). In RFC 5322 sec. 4.5.2 explicitly says that when an RFC 5322 line starts with a '.', the character needs to be doubled.
* pullimap: Treat messages with a NIL RFC822 attribute as empty.Guilhem Moulin2019-11-181
|
* interimap: Gracefully ignore messages with NIL RFC822 attribute.Guilhem Moulin2019-11-171
| | | | | | Like we do for zero-length messages. Closes: #944812.
* Avoid sending large UID EXPUNGE|FETCH|STORE and APPEND commands.Guilhem Moulin2019-11-131
| | | | | | | | | | | | | | | | | | | | | | UID EXPUNGE|FETCH|STORE commands are now split into multiple (sequential) commands when their set representation exceeds 4096 bytes in size. Without splitting logic set representations could grow arbitrarily large, and exceed the server's maximum command size. This adds roundtrips which could be eliminated by pipelining, but it's unlikely to make any difference in typical synchronization work. While set representations seem to remain small in practice, they might grow significantly if many non-contiguous UIDs were flagged and/or expunged, and later synchronized at once. Furthermore, for MULTIAPPEND-capable servers, the number of messages is limited to 128 per APPEND command (also subject to a combined literal size of 1MiB like before). These numbers are currently not configurable. They're intentionally lower than Dovecot's default maximum command size (64k) in order to avoid a deadlock situation after sending 8k-long commands under COMPRESS=DEFLATE: https://dovecot.org/pipermail/dovecot/2019-November/117522.html .
* Net::IMAP::InterIMAP::push_flag_updates() bugfixes.Guilhem Moulin2019-11-131
| | | | | | | | | | | | | | The UNCHANGEDSINCE test from the CONDSTORE extension was incorrectly placed after the flag list in UID STORE commands. In practice this meant the server didn't add the MODIFIED code when needed. The server won't send an untagged FETCH command (and won't increase the message's MODSEQ) if no change was made to the flag list. A panic() was incorrectly triggered in that case. When the flag list was set (by another client) to a superset of the UID STORE command currently processed, the extra flags were not synchronized. Cf. RFC 7162 sec. 3.1.3 ex. 10.
* interimap: raise SELECT sample set size from 64 to 256 bytes.Guilhem Moulin2019-11-131
| | | | | | | | | | | | | | A n-bytes set covers at least ⌊(n+1)/11⌋ UIDs (UIDs are at most 10 bytes of size), hence 23 UIDs for 256 bytes long sets. However we exceed it by another range, so in the worst case (if the the higher UIDs are sparse) we'll sample ⌊(n+1)/11+1⌋ UIDs: 1000000000,1000000002,1000000004,…,1000000046 This was 6 UIDs for n=64 which is a tad low; this is now raised to 24 UIDs. The actual set size returned by sample() is of max size n+22 bytes (extra "$UID1:$UID2," where $UID1 and $UID2 are both ≥10⁹).
* Test suite: add new tests for SSL/TLS.Guilhem Moulin2019-11-131
| | | | | SSL connections are accepted on TCP port 10993. Also, fix STARTTLS directive, broken since fba1c36…
* libinterimap: honor compress={Yes/No}.Guilhem Moulin2019-11-081
|
* Refactor logging logic.Guilhem Moulin2019-11-071
| | | | | | | Also, introduce new option 'logger-prefix' to determine the prefix of each log line. Closes: #942725.
* libinterimap: Don't panic at the end of the compressed stream.Guilhem Moulin2019-11-071
| | | | | Cf. Compress::Raw::Zlib's documentation. Z_STREAM_END denotes a successful state.
* pullimap, interimap: redact AUTHENTICATE and LOGIN commandsGuilhem Moulin2019-11-061
| | | | | | In --debug mode in order to avoid inadvertently receiving credentials in bug reports. --debug can be set twice to spell out these commands in full.
* libinterimap: use directories relative to $HOME for the XDG defaults.Guilhem Moulin2019-07-081
| | | | | | | | | | | | Previously getpwuid() was called to determine the user's home directory, while the XDG specification explicitely mentions $HOME. Conveniently our docs always mentioned ~/, which on POSIX-compliant systems expands to the value of the variable HOME (and the result is unspecified when the variable is unset). Cf. Shell and Utilities volume of POSIX.1-2017, sec. 2.6.1: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_06_01
* interimap: clarify that 'ignore-mailbox' is matched against internal names.Guilhem Moulin2019-07-071
| | | | | | | That is, without leading reference, and where the hierarchy delimiter is replaced with null characters. /!\ This changes breaks backward compatibility!
* Refactor documentation.Guilhem Moulin2019-07-051
| | | | | In particular, move manpages to the 'doc' directory, and generate HTML documentation with `make html`.
* Improve wording.Guilhem Moulin2019-05-301
|
* typo fixesGuilhem Moulin2019-05-281
|
* Manpages: clarify that the tunnel command is run following Perl's `exec` ↵Guilhem Moulin2019-05-271
| | | | | | | | | | | | semantics. It is passed to `/bin/sh -c` when it contains shell metacharacters; and split into words and passed to execvp(3) otherwise. https://perldoc.perl.org/functions/exec.html (Since c8fb54897f046a5a3fb4c1d45dc21fd8bcd882e3 the value no longer needs to stard with a forward slash.)
* Add test-suite (requires dovecot-imapd).Guilhem Moulin2019-05-271
|
* New option 'list-reference' to specify a reference name.Guilhem Moulin2019-05-271
| | | | | | | | This is useful for synchronizing multiple remote servers against different namespaces belonging to the same local IMAP server (using a different InterIMAP instance for each local namespace ↔ remote synchronization, for instance with the newy provided systemd template unit file).
* libinterimap: use socketpair(2) in tunnel mode.Guilhem Moulin2019-05-271
| | | | | | Rather than two pipe(2). Also, use SOCK_CLOEXEC to save a fcntl() call when setting the close-on-exec flag on the socket (even though Perl will likely call fcntl() anyway).
* interimap: fix handling of mod-sequence values greater or equal than 2 << 63.Guilhem Moulin2019-05-271
| | | | | | | | | | | | | | | SQLite processes every INTEGER values as a 8-byte signed integer, so we need to manually do the conversion from/to uint64_t client-side if we don't want to overflow or receive floats. https://www.sqlite.org/datatype3.html#storage_classes_and_datatypes http://jakegoulding.com/blog/2011/02/06/sqlite-64-bit-integers/ We could also do the same trick for local/remote UIDs, UIDVALITY and UIDNEXT values to slim the database down at the expense of pre/post- processing. (Values of SQLite's INTEGER class are 1, 2, 3, 4, 6, or 8 bytes signed integers depending on the manitudes, so we could save some space for values ≥2³¹.) But that seems a little overkill.
* interimap: Enforce SQLite foreign key constraints.Guilhem Moulin2019-05-271
| | | | | | | | Setting the 'foreign_keys' PRAGMA during a multi-statement transaction (when SQLite is not in autocommit mode) is a no-op. https://www.sqlite.org/pragma.html#pragma_foreign_keys https://www.sqlite.org/foreignkeys.html#fk_enable
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 09:48:03 +0000