Updated copyright notices to include the year 2018.

director: Don't send USERs in handshake that were already sent between handshake If the user was refreshed since the handshake was started, it means that the same user was already sent to the other side (added to the stream immediately after it was received/handled). There's no need to send it again. This fixes a potentally infinite handshake when users are rapidly changing and the handshake iterator never sees the end of the list. (Each refreshed user is moved to the end of the list, so handshaking can keep sending the same user over and over again.)

director: Avoid USER loops when ring latency is over 1 second Do this by adding a timestamp parameter to USER events. This way if it takes over 1 second for the USER event to traverse the ring, it won't get into an infinite loop getting the user updated over and over again.

director: Make sure a missing right-side connection is always reconnected This code shouldn't be needed, but add it just to be sure.

director: Add kick_callback to director This callback gets called whenever director has performed a kick.

director: Show in process title how many users are being kicked.

director: Log an error if login process sends unexpected reply to KICK* commands

director: Use *_host.ip_str to avoid net_ip2addr() calls

director: Track show long the last ring sync took.

director: When ring is synced, purge any pending "removed" directors This allows adding a director back to the ring without having to wait for 30 seconds.

director: Rename director_delayed_dir_remove_timeout() to director_hosts_purge_removed() This allows using it for other purposes without having a confusing name.

director: Fix potential panic when director is alone If director is alone and it can't connect to other directors, it might crash with: Panic: file director.c: line 318 (director_set_ring_synced): assertion failed: (!dir->ring_synced)

director: Allow doveadm director ring remove for the same director Fixes: Panic: file doveadm-connection.c: line 859 (doveadm_connection_cmd_run): assertion failed: (conn->dir->right == NULL && conn->dir->left == NULL)

director: Fix tracking user move count when user is freed early users_moving_count wasn't updated if the user was freed before killing it finished. This caused "doveadm director flush" to hang while waiting for the move count to drop to 0, which it never did. Also following flushes were doing less work in parallel, or possibly even nothing since director thought there were too many users already being moved.

global: start relying on timeout_remove(NULL) being a no-op Cleanup performed with the following semantic patch: @@ expression E; @@ - if (E != NULL) { - timeout_remove(&E); - } + timeout_remove(&E);

director: Fix flush to kick the user also when all backends are down The user's host can't change, because there are no other hosts. So add a new parameter to force the kick anyway.

director: Delay calling state_change_callback() after user kick is finished Otherwise it can get into recursive loop and cause problems.

director: Fix crash when flush is run and all backends are down. Instead of moving the users elsewhere, just kill them and flush the backend.

director: When director is removed, notify it before disconnecting This way the removed director will know that it's been removed, and it can also more quickly forward the removal to other directors.

director: Log info line for every incoming/outgoing connection This can help with debugging problems.

director: Cleanup - move code to a new director_log_connect() Also adds a missing ')' to the log line.

director: Log info line whenever a director is added/removed from ring This can help with debugging problems.

director: Improve debugging: Log ring desync when there is no right connection

director: When logging "ring SYNC lost", include sync seq number in message This can help with debugging.

doveadm director ring remove: Wait ring sync before and after removal This helps mainly with automated tests.

director: Add old host's up/down and vhost count parameters to director_flush_socket The "down" status allows the script to determine whether it should try to perform any work on the old host. The vhost count may be unnecessary, but might be useful for some purpose.

director: Make director_consistent_hashing=yes mandatory

director: Add more debug logging for moving & killing users

director: Fix USER-MOVE getting stuck if a director already uses the correct host

director: Make sure USER-KILLED isn't sent before USER-MOVE If USER-MOVE was for a user that didn't exist, killing sent USER-KILLED immediately before the forwarding USER-MOVE. This caused the move to get stuck, giving errors like: director: Error: Finishing user 3224731354 move timed out, its state may now be inconsistent (state=waiting-for-everyone)

director: Add assert to make sure USER-MOVE doesn't change tag

director: Fix assert-crash when flush script takes too long Fixes: Panic: file director.c: line 966 (director_user_move_timeout): assertion failed: (user->kill_ctx->kill_state != USER_KILL_STATE_FLUSHING)

Updated copyright notices to include the year 2017.

director: Fix crash when using director_flush_socket Broken accidentally when merging b44033e45e9f48f8a6e1ac5905234fec5de6d6cc

director: Fix USER-KICK and USER-KICK-ALT forwarding The internal IPC command was prefixed, which caused the remote director to reject the commands and disconnect: director(...): Command proxy: Unknown command proxy director(...): Remote sent invalid protocol data recently, waiting 57 secs before allowing further communication

director: Fix crash when receiving USER-MOVE for nonexistent user.

director: Keep per-tag directory

director: Code cleanup - moved username_hash generation to director.h It's not really user_directory specific. This is especially important in the following patches that add per-tag user_directories. It's also not always known which tag the username_hash refers to, so there can't be different tag-specific username_hash generators.

director: Code cleanup - added user director_iterate_users_*() wrappers. This will shrink the diff for the following changes.

director: Code cleanup - use temporary users variables This will shrink the diff for the following changes.

lib: API change - var_expand*() now returns error string. This allows callers to fail properly if the format string is invalid.

director: Send user's old and new backend IPs to flush script. If user was created due to the user-move, don't execute the flush script since it wouldn't really have any work to do anyway.

director: User move - Don't try to kick user's connections if user wasn't even known.

director: Code cleanup - moved user kill startup to its own function. No functional changes.

director: Moved all user killing state to struct director_kill_context This should make it a bit easier to understand the life time of user killing. It also simplifies code by removing struct director_user_kill_finish_ctx. Finally, this already reduces memory usage with 32bit systems, and would make it possible to reduce also on 64bit systems if timestamp is shrank to 31 bits and weak bit moved after it. I'm not sure if that would be better for performance though. In any case it would provide free space for 4 extra bytes if that were needed in future.

director: Code cleanup - rename director_kill_context.self to kill_is_self_initiated

director: Code cleanup - added USER_IS_BEING_KILLED() macro

director: Code cleanup - move enum user_kill_state to director.h This will be needed by following commits

director: Execute director_flush_socket only from one director. Having each director do it would be redundant since they're all supposed to be performing the same flush task to the same backend.

director: Improve debug logging output.

director: Fix user move hangs when another move is triggered early. Running "doveadm director flush" before the previous flush hadn't fully finished could have caused users to hang until their move timeout: director: Error: Finishing user 3249070169 move timed out, its state may now be inconsistent (state=waiting-for-everyone)

director: Prevent race conditions by adding USER_KILL_STATE_FLUSHING In theory it's possible that a user is freed during a flush and added back before flush is finished, possibly even being moved again. This check makes sure that we don't finish such move unless we're actually at the correct flushing state. (If there's another flush also running for the user it'll be ignored.) This is also useful for logging purposes.

director: If user move times out, log the state it was in at the time.

director: Show in process title how many users are being moved.

director: Code cleanup - Finish user move always in the same function.

director: Call state_change_callback on user move timeout.

director: Fix crash handling director_flush_socket when user is freed.

director: Support flush socket This allows specifying an URI to execute on user kill. It can be of form exec:/path/to/bin, unix:/path/to/socket or tcp:ip:port The location is sent FLUSH username-hash per killed user. You can execute some action there, and you are expected to return '+\nOK\n' as reply once you are done.

doveadm director kick: Added -f <passdb field> parameter. This works for all the user_* passdb fields.

director: Escape username when handling USER-KICK. This could have caused problems if username parameter contained TABs or LFs, which of course shouldn't normally happen.

director: Throttle user move/kill failure errors after 100/sec. If it happened to a lot of users, they can take a lot of space in logs.

global: Use only explicit int -> bool conversions These were checked with a patched clang.

lib: net_get_ip_any[46]() to struct net_ip[46]_any Also add struct net_ip[46]_loopback.

director: Fixed memory leak when killing a user.

director: Make sure a long-delayed kill reply for user doesn't mess up the state. This should fix assert-crash: director: Panic: file director.c: line 690 (director_user_kill_finish_delayed_to): assertion failed: (ctx->user->kill_state == USER_KILL_STATE_DELAY)

director: Don't re-send SYNC unnecessarily often.

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

director: Don't mark the host desynced if director is alone in ring.

director: Fixed backend selection when multiple tags were used. The previous algorithm was causing an uneven load for backends. This change breaks compatibility with older director servers that were using tags because of the different selection algorithm. The new director code refuses to run within a cluster with old directors if tags are used.

director: Code cleanup - access host->tag via mail_host_get_tag() In preparation for the following changes.

director: Code cleanup - make most mail_host_*() list parameters unnecessary.

director: Remember backends' hostnames and send them in login reply. This allows login processes to verify the remote server's hostname in SSL certificate.

director: Detect if directors' hosts have become desynced by sending hosts_hash in SYNC parameter. Also fix up such a situation by resending all HOSTs.

director: Use mail_hosts_hash() to improve debug log messages.

director: Don't become desynced if two directors change the same backend in incompatible ways. This would have caused "User hash .. is being redirected to two hosts" errors, which wouldn't easily go away as the directors have a different view of what hosts currently exist.

director: Added director_user_kick_delay setting. This replaces the hardcoded 2 seconds delay. This setting specifies how long to wait for after user has been kicked from all directors before letting the user login to the new server. This timeout should be large enough that the user's existing processes in the old backend should be finished.

Changed type of internet port values to in_port_t everywhere. Created special SET_IN_PORT setting type for internet port values. Created net_str2port() for parsing internet port values. Removed several atoi() invocations in the process.

director: Added "up" vs "down" states and doveadm director up/down commands. These commands are intended to be used by automated watchdogs that detect if backends are up or down. This way the vhost count doesn't get forgotten after server goes down. It also means that admin can manually take down a server by setting its vhost count to 0 without the watchdog automatically bringing it back up.

director: Improved debug logging about connecting to another director.

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

director: Added support for backend cluster "tags". This allows using a single director ring for multiple backend clusters. By default everything has an empty tag. A passdb lookup can return "director_tag" field containing the wanted tag name. If there aren't any backend servers with the wanted tag, it's treated the same as if there aren't any backend servers available (= wait for 30 secs for a backend and then return temporary failure). Tags can be added to configuration by adding @tag suffix to IPs/hosts. For example: director_mail_servers = 10.0.0.100-10.0.0.110@name1 10.0.0.120@name2 "doveadm director add" can also add tags either with @tag suffix or with -t parameter. "doveadm director status user@domain" requires giving the user's correct tag with -t parameter or the results won't be correct (empty tag's results are shown). Tags can't currently be changed for an existing host without removing it first.

director: Added director_consistent_hashing setting. This should have been the default since the beginning. I didn't thik it was worth the trouble originally because in theory it shouldn't matter much if users jump between multiple backends. But this makes caching behavior worse, especially for systems which are using local cache files.

director: When logging a warning about ring being synced again, log how many seconds it took

Removed pointless NULL checks. Found by Coverity

director: If we detect that a user is being proxied to multiple backends, disconnect wrong connections. Especially IMAP connections can otherwise stay alive for a long time and cause problems.

doveadm director kick command added. The kick gets sent to all the proxies within the director ring.

director: Fixed handling weak users when there were exactly 2 director servers in the ring.

Updated copyright notices to include year 2014.

director: Avoid infinite SYNC loops if the originating director goes away for a long time.

Oops :) Update copyrights to 2013 without breaking all .c files.