Bug 524485

Summary: dovecot-1.2.5-1 ignores "imap_capability"-configuration
Product: [Fedora] Fedora Reporter: Harald Reindl <h.reindl>
Component: dovecotAssignee: Michal Hlavinka <mhlavink>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: low    
Version: 11CC: mhlavink
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 1.2.6-3.fc11 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-11-06 00:03:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Harald Reindl 2009-09-20 18:39:01 UTC
After many Tests wie upgraded our Mailserver to fedora 11 using the newest dovecot package, but now iphone-clients have troubles

I am sure the reason is that "imap_capability" is now ignored from our configuration, in our setup dovecot works as proxy for dbmail to provide ssl/tls,cram-md5... and has to answer with the same features as dbmail

With fedora 10 the output was fine and STARTTLS/AUTH dynamicly added from "mechanisms" and if ssl is enabled/disabled
_____________________________________________

[root@backup-dbmail:~]$ cat /etc/dovecot.conf | grep imap_capability
imap_capability = IMAP4 IMAP4rev1 ACL NAMESPACE CHILDREN SORT QUOTA THREAD=ORDEREDSUBJECT UNSELECT IDLE

[root@backup-dbmail:~]$ telnet backup-dbmail 143
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=PLAIN AUTH=LOGIN AUTH=NTLM] thelounge.net Backup-Mail-Service
_____________________________________________

Comment 1 Michal Hlavinka 2009-10-01 12:49:38 UTC
imap_capability is not ignored, there is only one small difference. Both dovecot 1.1.x and 1.2.x return correct answer for 'A CAPABILITY' question:

A CAPABILITY
* CAPABILITY IMAP4 IMAP4rev1 ACL NAMESPACE CHILDREN SORT QUOTA THREAD=ORDEREDSUBJECT UNSELECT IDLE STARTTLS AUTH=PLAIN
A OK Capability completed

the only difference is initial hello message: for dovecot 1.1 it's only:
* OK Dovecot ready.

but for dovecot 1.2 it's:
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready.

so CAPABILITY information in hello message is not complete. But this message is not complete even when imap_capability is not used at all.

I'll ask upstream about capability differences in hello message and capability answer.

Comment 2 Harald Reindl 2009-10-01 13:01:17 UTC
This is not correct
After upgrade to f11 we had some troubles
In fact this was because the wrong output

> so CAPABILITY information in hello message is not complete. 
> But this message is not complete even when imap_capability is not 
> used at all.

This is wrong abnd must be also a bug in 1.2
Version 1.1 had "login_greeting_capability = yes" which is gone away since 1.2 does this implicit, anyways 1.2 is not working as imap-proxy because it lies to the client!

I have excluded dovecot in our infrastructure from updates and made a rebuild of the f10-1.1 package (own build and repo-infrastructure) because our clients would kill me if they can not check their mails

Comment 3 Michal Hlavinka 2009-10-02 15:20:02 UTC
I've asked upstream, from response:

> The capability in greeting message is short on purpose.
> It's only enough capabilities to get client logged in.
> After login Dovecot sends an updated full capability list
> to the client. It uses a few different tricks to get most
> clients understand the change.

> So the only potential problem I see here is if client
> understands the greeting capability and permanently
> remembers that the server supports LITERAL+, ID and
> ENABLE after login but the destination server actually
> doesn't.

> The other capabilities are relevant only before login.

> I'd anyway like to hear what exactly is the problem and
> with what client, preferably with IMAP traffic logs showing
> what's happening wrong.

So, could you describe your mail environment in more details?
Is it possible for you to capture imap traffic what happens when problem occurs?

thanks

Comment 4 Harald Reindl 2009-10-02 15:35:10 UTC
Why are such simple things so complicated?
If i configure the imap_capability there is a reason to do that
There is no reason at any point of connection to make a different output

It is a bug to lie in the greeting because the sense of the greeting is for clients which do support it to reduce requests

The imap-server is dbmail which supports "IMAP4 IMAP4rev1 ACL NAMESPACE CHILDREN SORT QUOTA THREAD=ORDEREDSUBJECT UNSELECT IDLE" and in version 1.1 it worked fine

The problem sue is "LITERAL+" what dbmail does not support
As said the problem client was apple iphome


It makes no sense to play around which clients works in which way

Comment 5 Michal Hlavinka 2009-10-21 10:46:44 UTC
Hi,

dovecot upstream has made necessary changes and dovecot now shows imap_capability in greeting message if it's set. So this should be fixed in dovecot-1.2.6-3.fc11

Comment 6 Fedora Update System 2009-10-21 11:01:27 UTC
dovecot-1.2.6-3.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/dovecot-1.2.6-3.fc11

Comment 7 Fedora Update System 2009-10-21 11:02:05 UTC
dovecot-1.2.6-4.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/dovecot-1.2.6-4.fc12

Comment 8 Harald Reindl 2009-10-22 15:34:20 UTC
Confirmed - THANK YOU for your help upstream!
Apple iPhone now connects fine to dbmail behind dovecot-proxy

[harry@nb-rhsoft:~]$ telnet dbmail 143
* OK [CAPABILITY IMAP4 IMAP4rev1 ACL NAMESPACE CHILDREN SORT QUOTA THREAD=ORDEREDSUBJECT UNSELECT IDLE STARTTLS
AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=PLAIN AUTH=LOGIN AUTH=NTLM] thelounge.net Mail-Service

Oct 22 17:31:13 mail dovecot: dovecot: Killed with signal 15 (by pid=4865 uid=0 code=kill)
Oct 22 17:31:13 Info: Dovecot v1.2.6 starting up (core dumps disabled)
Oct 22 17:31:13 auth-worker(default): Info: mysql: Connected to localhost (dbmail)
Oct 22 17:31:14 imap-login: Info: proxy(h.reindl): started proxying to 127.0.0.1:143:
user=<h.reindl>, method=CRAM-MD5, rip=10.0.0.245, lip=10.0.0.15, TLS

Comment 9 Fedora Update System 2009-10-27 07:26:30 UTC
dovecot-1.2.6-3.fc11 has been pushed to the Fedora 11 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update dovecot'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F11/FEDORA-2009-10859

Comment 10 Fedora Update System 2009-11-06 00:03:54 UTC
dovecot-1.2.6-3.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.