Subject: announcing: imap-2004 release candidate 1

From: Mark Crispin <[email-masked]>
Date: Tue, 6 Jan 2004 00:01:59 -0800 (PST)

imap-2004 (yes, it's now 2004) is nearing release status, and is
available on:
	ftp://ftp.cac.washington.edu/mail/imap-2004.RC.tar.Z

There are quite a few changes in imap-2004 from imap-2002e.  Following is
a list of the externally-visible changes:

IPv6 support now exists for UNIX and Windows, but is not the default.  To
build with IPv6 support, add "IP=6" to the make/nmake command line.
Windows IPv6 support is only in W2K builds.  A big "THANK YOU" to
everybody who contributed IPv6 patches over the years.  Although this is a
completely different implementation than any of the contributions, it was
heavily influenced by all of them.]

The NNTP driver now supports NNTP SASL and TLS.

The ldb (Debian) and lrh (RedHat) ports now look for mlock on
/usr/sbin/mlock instead of /etc/mlock.

imapd now supports the LITERAL+ and SASL-IR extensions.

The IMAP driver has some additional checks to reduce the amount of network
traffic, including executing "silly searches" (searches of sequence numbers
only) locally.

The IMAP, POP, SMTP, and NNTP drivers now have diagnostic code to provide
better information about servers which violate SASL's empty challenge
requirements (e.g. with the PLAIN mechanism).

In addition, programmers who use the c-client library in their
applications should note that many declarations which are completely
internal to a driver have been removed from the driver .h file.  In those
cases where there are no external declarations left the .h file has been
eliminated entirely.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Dirk-Willem van Gulik <[email-masked]>
Date: Wed, 7 Jan 2004 05:31:49 -0800 (PST)

Here is a tiny little patch. See man page below.

       Under  normal  operations a connection needs to be either SSL encrypted
       to accept a plain text password, or one of the DIGEST methods  must  be
       used  when  communicating in the clear. Sometimes, e.g. when connecting
       from a local web interfaces, such as Squirrelmail, stunnel, or ssh,  it
       may  be  of  use to make an exception for connections in the clear over
       the loopback interface. In these cases add  the  argument  -plaintextok
       when  starting  things  from  an  inetd  which is bound to the loopback
       interface.

Dw

diff -u -r imap-2004.RC1.orig/docs/RELNOTES imap-2004.RC1/docs/RELNOTES
--- imap-2004.RC1.orig/docs/RELNOTES    Mon Jan  5 22:42:07 2004
+++ imap-2004.RC1/docs/RELNOTES Wed Jan  7 14:33:34 2004
@@ -4,6 +4,11 @@
 build with this version with minor modification.  imap-2003 was not
 released except as development snapshots.

+Added a '-plaintextok' argument to the imapd. Useful when running
+it through an inetd connected to the loopback interface. This bypasses
+the sensible default requiring passwords to be either over SSL or
+in digest form when transmitted in the clear. ([email-masked]).
+
 IPv6 support now exists for UNIX and Windows, but is not the default.  To
 build with IPv6 support, add "IP=6" to the make/nmake command line.
Windows
 IPv6 support is only in W2K builds.
diff -u -r imap-2004.RC1.orig/src/imapd/imapd.8c
imap-2004.RC1/src/imapd/imapd.8c
--- imap-2004.RC1.orig/src/imapd/imapd.8c       Tue Jul 15 02:54:11 2003
+++ imap-2004.RC1/src/imapd/imapd.8c    Wed Jan  7 14:30:55 2004
@@ -1,9 +1,11 @@
 .TH IMAPD 8C "July 14, 2003"
 .UC 5
+.Nm imapd
 .SH NAME
 IMAPd \- Internet Message Access Protocol server
 .SH SYNOPSIS
-.B /usr/etc/imapd
+.B imapd
+[ -plaintextok ]
 .SH DESCRIPTION
 .I imapd
 is a server which supports the
@@ -19,6 +21,15 @@
 file (see
 .IR services (5)).
 Normally, this is port 143.
+.PP
+Under normal operations a connection needs to be either SSL encrypted to
+accept a plain text password, or one of the DIGEST methods must be used
+when communicating in the clear. Sometimes, e.g. when connecting from
+a local web interfaces, such as Squirrelmail, stunnel, or ssh, it may
+be of use to make an exception for connections in the clear over the
+loopback interface. In these cases add the argument
+.B -plaintextok
+when starting things from an inetd which is bound to the loopback
interface.
 .PP
 This daemons contains CRAM-MD5 support.  See the md5.txt documentation
 file for additional information.
diff -u -r imap-2004.RC1.orig/src/imapd/imapd.c
imap-2004.RC1/src/imapd/imapd.c
--- imap-2004.RC1.orig/src/imapd/imapd.c        Tue Dec 16 00:38:25 2003
+++ imap-2004.RC1/src/imapd/imapd.c     Wed Jan  7 14:31:48 2004
@@ -269,6 +269,13 @@
   mail_parameters (NIL,SET_MAILPROXYCOPY,(void *) proxycopy);
                                /* arm referral callback */
   mail_parameters (NIL,SET_IMAPREFERRAL,(void *) referral);
+
+  /* XXXX 12/2003 - [email-masked] / www.asemantics.com */
+  if((argc>1)&&(strcmp(argv[argc-1],"-plaintextok")==0)) {
+       mail_parameters (NIL,SET_DISABLEPLAINTEXT,NIL);
+       argc --;
+  }
+
   if (stat (SHUTDOWNFILE,&sbuf)) {
     s = myusername_full (&i);  /* get user name and flags */
     switch (i) {

---

From: Antonio Querubin <[email-masked]>
Date: Wed, 7 Jan 2004 18:23:52 -1000 (HST)

> heavily influenced by all of them.]

One thing you might consider adding to the docs are hints for setting up
inetd or xinetd to simultaneously listen on BOTH IPv4 and IPv6 for
different OS.

Some OS want to see separate IPv4-only and IPv6-only listening sockets
configured in inetd.conf or xinetd.conf.  Others will accept IPv4
connections on lines configured for IPv6 and actually generate errors if
you have both configured when inetd or xinetd start up.  It's not clear to
me whether this difference is due to how inetd or xinetd are built or
whether it's due to the kernel's IP stack implementation.  I suspect it's
really the latter.  Below are some examples:

Here's a fragment of /usr/local/etc/xinetd.conf for a FreeBSD 4.9 server:

service imap
{
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /usr/local/libexec/imapd
}
service imap
{
        flags           = IPv6
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /usr/local/libexec/imapd
}
service imaps
{
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /usr/local/libexec/imapd
}
service imaps
{
        flags           = IPv6
        socket_type     = stream
        protocol        = tcp
        wait            = no
        user            = root
        server          = /usr/local/libexec/imapd
}

Note that you have to specify a nearly identical paragraph for each
service which differs only by the 'flags = IPv6'.  An equivalent
inetd.conf would look something like:

imap  stream  tcp     nowait  root    /usr/local/libexec/imapd        imapd
imap  stream  tcp6    nowait  root    /usr/local/libexec/imapd        imapd
imaps stream  tcp     nowait  root    /usr/local/libexec/imapd        imapd
imaps stream  tcp6    nowait  root    /usr/local/libexec/imapd        imapd

The man pages for inetd suggest that if you use a single entry with
'tcp46' replacing either 'tcp' or 'tcp6' the system will listen on both
types of addresses.  At least for the case of FreeBSD this is actually
incorrect.

Now if you were to use the above xinetd.conf on Fedora Linux, it would
complain.  What does work under Linux is to create a single service
paragraph for each service which will accept connections on both IPv4 and
IPv6:

In /etc/xinetd.d/imap:

service imap
{
        flags       = IPv6
        disable     = no
        socket_type = stream
        wait        = no
        user        = root
        server      = /usr/local/sbin/imapd
}

In /etc/xinetd.d/imaps:

service imaps
{
        flags       = IPv6
        disable     = no
        socket_type = stream
        wait        = no
        user        = root
        server      = /usr/local/sbin/imapd
}

The man page for xinetd says the IPv6 flag means xinetd will listen ONLY
on IPv6.  However the actual behaviour (for Fedora Linux) is to listen on
both IPv4 and IPv6.

All of the above also applies to ipop3d.  Anyway, this might save some
folks a little bit of head scratching time.