global: Flip MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT to ..._ALLOW_ROOT

lib-storage: Flip disallow_root in service_drop_privileges()

lib: Add restrict_access_flags enum to use with restrict_access[_by_env]() Swap parameter locations in the functions to make sure plugins are updated to use the new api.

lib: Flip drop_setuid_root in restrict_access_settings

Updated copyright notices to include the year 2018.

lib-storage: Add mail_user.event and give parent event in mail_user_alloc*()

lib-storage: Add mail_storage_service_user.event and use it as the global event The event is set in the same place as where the user's default logging prefix is changed.

lib-storage: Remove mail_storage_service_io_deactivate() We now require that ioloop context is always properly deactivated, so there's no need for the function.

lib-storage: mail_storage_service_io_[de]activate_user() - [de]activate the whole ioloop context

lib-storage: mail_storage_service_user_unref() - deactivate user before removing callbacks Otherwise the next commit won't work correctly.

lib-storage: Create ioloop context regardless of logging settings This will be needed by the following commits.

lib-storage: mail-user: Added more information about the client connection. Submission service will need it to pass to the backend MTA in XCLIENT and for creating the "Received:" header.

lib-storage: mail-user: Changed mail_user_set_vars() to accept struct mail_user_connection_data, rather than individual fields.

lib-storage: added settings updating function for the mail_storage_service user

lib-storage: MAIL_STORAGE_SERVICE_FLAG_NO_PLUGINS wasn't working correctly Especially with "doveadm user" it still triggered running the plugins, because doveadm loads all the plugins early.

lib-storage: If userdb returns chdir extra field, chdir() there instead of home This can avoid unnecessary home directory accesses if indexes are stored outside the home and there's no other reason to chdir() to home.

lib-storage: If chdir(home) fails due to EACCES, don't log two errors.

lmtp: Fix for wrong session id of mail user when saving mail, quota checking on When quota is checked mail user is allocated with custom ":quota" session id suffix without incrementing service user session id counter

lib-storage: Replace MAIL_STORAGE_SERVICE_FLAG_AUTOEXPUNGE with explicit mail_user_autoexpunge() This allows better control of which users are being autoexpunged. This patch changes behavior at least in two ways now: 1) After shared folder access, the owner user isn't autoexpunged at deinit. Although this is a bit questionable of whether it should be or not. 2) LMTP's quota check at RCPT TO stage doesn't trigger autoexpunging.

lib-storage: Use refcounting for mail_storage_service_user doveadm import was freeing the user too early, which resulted mail_user._service_user pointing to freed memory. More importantly, after 34512eaad8b1b2f929e6d6e3a2f7252c29fba97b user->set was pointing to already freed memory.

lib-storage: mail_storage_init/deinit() is now reference counted. This allows calling them multiple times and only the final deinit frees the data.

lib-storage: Don't duplicate service user's settings into mail_user The mail_storage_service_user.user_set isn't used afterwards, so it can be directly used to avoid wasting memory.

Updated copyright notices to include the year 2017.

global: Replaced all instances of memset(p, 0, sizeof(*p)) with the new i_zero() macro. Used the following script: C_FILES=`git ls-files *.c` H_FILES=`git ls-files *.h` for F in "$C_FILES $H_FILES"; do echo "$F" perl -p -i -e 's/safe_memset\(&\(?([^,]*)\)?,\s*0,\s*sizeof\(\g1\)\)/i_zero_safe(&$1)/g' $F perl -p -i -e 's/safe_memset\(([^,]*),\s*0,\s*sizeof\(\*\g1\)\)/i_zero_safe($1)/g' $F perl -p -i -e 's/memset\(&\(?([^,]*)\)?,\s*0,\s*sizeof\(\g1\)\)/i_zero(&$1)/g' $F perl -p -i -e 's/memset\(([^,]*),\s*0,\s*sizeof\(\*\g1\)\)/i_zero($1)/g' $F done

global: Change string position/length from unsigned int to size_t Mainly to avoid truncating >4GB strings, which might potentially cause some security holes. Normally there are other limits, which prevent such excessive strings from being created in the first place. I'm sure this didn't find everything. Maybe everything could be found with compiler warnings. -Wconversion kind of does it, but it gives way too many unnecessary warnings. These were mainly found with: grep " = strlen" egrep "unsigned int.*(size|len)"

lib-storage: Add mail_storage_service_user_get_pool()

global: Replace some settings_parse_line() calls with settings_parse_keyvalue()

lib-storage: Fix previous var_expand() change.

lib: API change - var_expand_func_table.func() can now return error. None of the existing functions were changed to return errors (yet).

lib: API change - var_expand*() now returns error string. This allows callers to fail properly if the format string is invalid.

global: Try to initialize var_expand_tab[] directly. This avoids accidents with the array numbering being wrong.

global: Use i_strchr_to_next() wherever useful.

%{auth_domain} shouldn't include the leading '@'

lib-storage: Added mail_user.session_create_time and .session_restored

lib-storage: Fix potential crash when userdb-returns "key+=value" for a nonexistent setting. type would have also happened to be initialized to SET_STR for the crash to happen.

lib-storage: Fixed accessing user as root when user has no uid. This shouldn't normally be done, but might as well fix it. Fixes: Fatal: mail-storage-service: seteuid(4294967295) failed: Invalid argument

lib-storage: If chdir to home doesn't work, chdir to root instead. Most importantly this fixes unlink_directory() when current directory after dropping privileges can't be open()ed.

global: unsigned int:1 -> bool:1 perl -i -pe 's/unsigned int ([^,:;]+):1;/bool $1:1;/' **/*.[ch]

lib-storage: Fixed error_r with mail_storage_service_lookup_next() We no longer want to hide the actual error message.

Remove t_malloc in favour of t_malloc_no0 Using either t_malloc_no0 or t_malloc0 makes it clear whether the allocated memory is zeroed or not.

lib-storage: mail_storage_service_next() now returns error string.

lib-storage: mail_storage_service_lookup() now returns the full error.

lib-storage: Remove unused mail_storage_service_all_init()

lib-storage: Added mail_storage_service_all_init_mask() This allows providing a usermask hint to the userdb iteration lookup. For example with LDAP this allows setting the base based on the @domain.

lib-storage: Don't use same session ID for multiple mail_storage_service_next() calls. dsync does multiple mail_storage_service_next() calls for the same mail_storage_service_user. This causes stats plugin to send the same session ID to stats process, which complains about duplicates. Solved this in a generic way by having the following mail_storage_service_next() calls append :counter to session ID.

lib-storage: Changed separator between session_id_prefix and unique part to be ':' Although '-' wasn't used by default either, it's much more likely that custom session IDs might contain it. ':' is hopefully less likely to be used. This allows log parsers that actually want to find out the original session's all log lines to cut out everything after the initial ':'.

doveadm-auth: Added missing code forgotten from commit 208754367

lib-storage: Use getuid() instead of geteuid() for checking if we're running as root. This fixes running multiple doveadm commands for different users. Running mail_storage_service_init() + _deinit() multiple times left euid non-root, which dropped the MAIL_STORAGE_SERVICE_FLAG_TEMP_PRIV_DROP flag.

lib-storage: Verify settings only after applying settings from userdb This is especially important to verify() functions that parse the settings and store data permanently based on them, e.g. pop3_delete_flag or imap_client_workarounds, which effectively couldn't be overwritten by userdb.

lib-storage: Added missing %{userdb:*:default} handling

lib-storage: Deduplicate %{userdb:*} handling for mail_user and mail_storage_service_user

lib-storage: Enable autoexpunge only when MAIL_STORAGE_SERVICE_FLAG_AUTOEXPUNGE is set.

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

lib-storage: Added mail_storage_service_input.session_id_prefix This should make it easier to pass through the original session_id to worker process sessions. Especially if these sessions are somewhat short-lived it can be useful to assign them a unique session ID while still being able to match it to the parent's session ID.

lib-storage: Create ioloop context for users even if log prefix changing is disabled. This fixes stats plugin to work with lmtp, imap-urlauth and doveadm-server.

lib-storage: Support %{userdb:*} variables in mail_home and mail_chroot settings.

Remove now-unnecessary direct stdlib.h #includes.

lib-storage: Store pointer to mail_storage_service_user to mail_user if it exists.

lib-storage: Added mail_storage_service_user_get_service_ctx()

Removed all invocations of atoi().

lib-storage: Added %{userdb:*} expansion to mail settings.

lib-storage: mail_storage_service_user_free() needs to update log prefix if current user is freed.

lib-storage: If session_id isn't given, generate a new one. This is useful for tracking logs written by services that aren't directly related to any specific user session.

lib-storage: Use module_dir_try_load_missing() to load user plugins.

lib-storage: Previous log prefix changing code started accessing freed memory.

lib-storage: Set the user log prefix earlier when initializing user. So the full prefix with session and other useful information is included in the log message as early as possible. Some fatal/panic errors wouldn't even have shown the username.

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib-storage: Allow calling storage service's ioloop activate/deactivate functions manually.

lib: Code cleanup - check io_loop_context_add/remove_callbacks() callback parameters.

Avoid logging warnings about increasing memory pool/data stack with DEBUG on. These could have a minor effect on memory usage, but shouldn't be much.

lib-storage: Added mail_user_dup()

lib-storage: Set mail_user->session_id before calling mail_user_init()

lib-storage: Added struct mail_user.session_id

Updated copyright notices to include year 2014.

auth, login, mail: Added %{auth_user}, %{auth_username} and %{auth_domain} They expand to the SASL authentication ID. So if master user login is done, it expands to the master user. If username changes during authentication, it expands to the original username. Otherwise %{user} and %{auth_user} are equal.

lib-storage: Added mail_user->admin flag. The previous admin-flag used to mix up "admin user" and "admin tool", while this new purpose only means "admin user".

lib-storage: Added mail_storage_service_set_auth_conn()

lib-storage: Don't create a settings cache for initial global settings read. This fixes at least doveadm -A so that it doesn't connect to config process for each user.

lib-storage: Use a separate auth-userdb connection for iterating through users. This is required because the auth-userdb connection is also wanted in the middle of the iteration to do USER lookups.

lib-storage: Improved seteuid() error messages a bit.

lib-storage: If settings can't be read because of permission denied, restart process.

lib-storage: Ignore MAIL_STORAGE_SERVICE_FLAG_TEMP_PRIV_DROP if service user isn't root.

lib-storage: With temporary privilege dropping, switch to root before doing config lookup. This fixes the problem of not having enough permissions to connect to the config socket.

lib-storage: mail_storage_service_all_init() no longer returns total number of users. In preperation for removing the count functionality, since it requires reading all the users into memory for it to work. This also required removing the /total from verbosity counter with doveadm -A.

lib-storage: mail_storage_service_lookup() ignored input->service.

Oops :) Update copyrights to 2013 without breaking all .c files.