diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..594d8b8 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +zcp-7.?.*.tar.gz diff --git a/dead.package b/dead.package deleted file mode 100644 index 0f98991..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -Package is retired diff --git a/sources b/sources new file mode 100644 index 0000000..a15167f --- /dev/null +++ b/sources @@ -0,0 +1 @@ +4744f5c09ca082ea23cd28ea1d10941f zcp-7.1.12.tar.gz diff --git a/zarafa-7.1.10-imap-badcharset.patch b/zarafa-7.1.10-imap-badcharset.patch new file mode 100644 index 0000000..76b5a36 --- /dev/null +++ b/zarafa-7.1.10-imap-badcharset.patch @@ -0,0 +1,19 @@ +Patch by Robert Scheck for Zarafa <= 7.1.10 which fixes the RFC- +violating reply of the Zarafa IMAP gateway in response to a failed SEARCH CHARSET request. +This is documented at http://tools.ietf.org/html/rfc3501#page-64: "BADCHARSET: Optionally +followed by a parenthesized list of charsets. [...]". This patch adds missing parenthesis. + +Proposed to upstream via e-mail on Sun, 27 Jul 2014 23:58:01 +0200, patch was put into the +upstream ticket https://jira.zarafa.com/browse/ZCP-12504. + +--- zarafa-7.1.10/gateway/IMAP.cpp 2014-05-23 15:56:37.000000000 +0200 ++++ zarafa-7.1.10/gateway/IMAP.cpp.imap-badcharset 2014-07-27 23:42:30.000000000 +0200 +@@ -2409,7 +2409,7 @@ + if (lstSearchCriteria[1] != "WINDOWS-1252") { + iconv = new ECIConv("windows-1252", lstSearchCriteria[1]); + if (!iconv->canConvert()) { +- hr2 = HrResponse(RESP_TAGGED_NO, strTag, "[BADCHARSET WINDOWS-1252] "+strMode+"SEARCH charset not supported"); ++ hr2 = HrResponse(RESP_TAGGED_NO, strTag, "[BADCHARSET (WINDOWS-1252)] "+strMode+"SEARCH charset not supported"); + hr = MAPI_E_CALL_FAILED; + goto exit; + } diff --git a/zarafa-7.1.10-imap-fetch-body.patch b/zarafa-7.1.10-imap-fetch-body.patch new file mode 100644 index 0000000..da4e2fa --- /dev/null +++ b/zarafa-7.1.10-imap-fetch-body.patch @@ -0,0 +1,93 @@ +Patch by Robert Scheck for Zarafa <= 7.1.10 which fixes the RFC- +violating reply of the Zarafa IMAP gateway in response to a body fetch request. This is +documented at http://tools.ietf.org/html/rfc3501#page-55. Additionally this has been also +compared with the Dovecot IMAP server as a nearly (or even de facto) IMAP server reference +implementation. Please note that this is NOT a duplicate of ZCP-11590/ZCP-11739/ZCP-12365! + +Wrong behaviour of Zarafa <= 7.1.10rc1-44973 (without this patch): +> A4 FETCH 1 (BODY.PEEK[HEADER.FIELDS (FROM FROM)]) +< * 1 FETCH (BODY[HEADER.FIELDS (FROM FROM)] {66} +From: User1 +From: User1 + +) +< A4 OK FETCH completed + +Comparison with IMAP server Dovecot 2.2.13: +> A4 FETCH 1 (BODY.PEEK[HEADER.FIELDS (FROM FROM)]) +< * 1 FETCH (BODY[HEADER.FIELDS (FROM FROM)] {34} +From: User1 + +) +< A4 OK Fetch completed. + +Correct behaviour of Zarafa (after having this patch applied): +> A4 FETCH 1 (BODY.PEEK[HEADER.FIELDS (FROM FROM)]) +< * 1 FETCH (BODY[HEADER.FIELDS (FROM FROM)] {34} +From: User1 + +) +< A4 OK FETCH completed + +Testing: Full IMAP dialog example from the client perspective (after this patch applied): +< * OK [CAPABILITY IMAP4rev1 LITERAL+ AUTH=PLAIN] Zarafa IMAP gateway ready +> A0 LOGIN robert robert +< A0 OK [CAPABILITY IMAP4rev1 LITERAL+ CHILDREN XAOL-OPTION NAMESPACE QUOTA IDLE] LOGIN completed +> A1 LIST "" INBOX +< * LIST (\HasNoChildren) "/" "INBOX" +< A1 OK LIST completed +> A2 SELECT INBOX +< * 2 EXISTS +< * 0 RECENT +< * FLAGS (\Seen \Draft \Deleted \Flagged \Answered $Forwarded) +< * OK [PERMANENTFLAGS (\Seen \Draft \Deleted \Flagged \Answered $Forwarded)] Permanent flags +< * OK [UIDNEXT 4343] Predicted next UID +< * OK [UNSEEN 1] First unseen message +< * OK [UIDVALIDITY 9313] UIDVALIDITY value +< A2 OK [READ-WRITE] SELECT completed +> A3 SEARCH UNSEEN ALL +< * SEARCH 1 2 +< A3 OK SEARCH completed +> A4 FETCH 1 (BODY.PEEK[HEADER.FIELDS (FROM FROM)]) +< * 1 FETCH (BODY[HEADER.FIELDS (FROM FROM)] {34} +From: User1 + +) +< A4 OK FETCH completed +> A5 CLOSE +< A5 OK CLOSE completed +> A6 LOGOUT +< * BYE Zarafa server logging out +< A6 OK LOGOUT completed + +IMPORTANT: This patch has been very carefully and extensively tested but it might not be +perfect nevertheless as I am not really a C/C++ developer. There should be a code review +by an experienced C/C++ developer before merging into Zarafa core. + +Proposed to upstream via e-mail on Thu, 29 May 2014 01:55:35 +0200, patch was put into the +upstream ticket https://jira.zarafa.com/browse/ZCP-12398. + +--- zarafa-7.1.10/gateway/IMAP.cpp 2014-05-12 12:06:03.000000000 +0200 ++++ zarafa-7.1.10/gateway/IMAP.cpp.imap-fetch-body 2014-05-29 00:49:29.000000000 +0200 +@@ -5253,10 +5253,21 @@ + } else { + vector lstReqFields; + vector::iterator iterReqField; ++ vector::iterator r, w; ++ set tmpset; + + // Get fields as vector + lstReqFields = tokenize(strFields, " "); + ++ // Make elements of vector unique ++ for(r = lstReqFields.begin(), w = lstReqFields.begin(); r != lstReqFields.end(); ++r) { ++ if(tmpset.insert(*r).second) { ++ *w++ = *r; ++ } ++ } ++ ++ lstReqFields.erase(w, lstReqFields.end()); ++ + // Output headers specified, in order of field set + for(iterReqField = lstReqFields.begin(); iterReqField != lstReqFields.end(); iterReqField++) { + for(iterField = lstFields.begin(); iterField != lstFields.end(); iterField++) { diff --git a/zarafa-7.1.10-kyotocabinet.patch b/zarafa-7.1.10-kyotocabinet.patch new file mode 100644 index 0000000..00cdeab --- /dev/null +++ b/zarafa-7.1.10-kyotocabinet.patch @@ -0,0 +1,31 @@ +Patch by Robert Scheck for zarafa >= 7.1.10 which re-adds the ability to disable +zarafa-search during build-time. This is e.g. required if CLucene and/or Kyotocabinet is unavailable or +broken on the given system and/or architecture. Interestingly that patch is not new, I wrote these lines +in 2012 the first time, proposed them as a patch to Zarafa and got merged. With a recent Zarafa release it +seems they silently removed it again... + +Proposed to upstream via e-mail on Fri, 11 Jul 2014 01:03:43 +0200, patch was put into the upstream ticket +https://jira.zarafa.com/browse/ZCP-12463. + +--- zarafa-7.1.10/ECtools/zarafa-search/Makefile.am 2014-05-23 15:03:49.000000000 +0200 ++++ zarafa-7.1.10/ECtools/zarafa-search/Makefile.am.kyotocabinet 2014-07-10 21:48:42.000000000 +0200 +@@ -1,4 +1,8 @@ ++if WITH_CLUCENE ++if WITH_KYOTOCABINET + bin_PROGRAMS = zarafa-search ++endif ++endif + + AM_CPPFLAGS = ${ZCPPFLAGS} \ + -I${top_srcdir}/mapi4linux/include \ +--- zarafa-7.1.10/ECtools/zarafa-search/Makefile.in 2014-05-23 15:04:02.000000000 +0200 ++++ zarafa-7.1.10/ECtools/zarafa-search/Makefile.in.kyotocabinet 2014-07-10 21:49:16.000000000 +0200 +@@ -34,7 +34,7 @@ + POST_UNINSTALL = : + build_triplet = @build@ + host_triplet = @host@ +-bin_PROGRAMS = zarafa-search$(EXEEXT) ++@WITH_CLUCENE_TRUE@@WITH_KYOTOCABINET_TRUE@bin_PROGRAMS = zarafa-search$(EXEEXT) + subdir = ECtools/zarafa-search + DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in + ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 diff --git a/zarafa-7.1.11-php-unbundle.patch b/zarafa-7.1.11-php-unbundle.patch new file mode 100644 index 0000000..0934c0e --- /dev/null +++ b/zarafa-7.1.11-php-unbundle.patch @@ -0,0 +1,39 @@ +Patch by Robert Scheck for zarafa >= 7.1.11 which removes the bundled PHP PEAR files/libraries +and replaces them by files and libraries shipped by the distribution. From file server/PEAR/JSON.php only the function +json_decode() is used, which can be provided by the php-json RPM package. The file server/PEAR/XML/Unserializer.php can +be provided by the php-pear-XML-Serializer RPM package. The rest of the PHP PEAR files/libraries are only dependencies of +these two files mentioned before (which are satisfied by the two newly required RPM packages). + +--- zarafa-7.1.11.rsc/php-webclient-ajax/config.php.dist 2014-09-03 09:56:49.000000000 +0200 ++++ zarafa-7.1.11.rsc/php-webclient-ajax/config.php.dist.php-unbundle 2014-09-07 18:24:28.000000000 +0200 +@@ -56,7 +56,7 @@ + + // Define the server paths + set_include_path(BASE_PATH. PATH_SEPARATOR . +- BASE_PATH."server/PEAR/" . PATH_SEPARATOR . ++ "/usr/share/pear/" . PATH_SEPARATOR . + "/usr/share/php/"); + + // Define the relative URL for dialogs, this string is appended with HTTP GET arguments +--- zarafa-7.1.11.rsc/php-webclient-ajax/zarafa.php 2014-09-03 10:45:06.000000000 +0200 ++++ zarafa-7.1.11.rsc/php-webclient-ajax/zarafa.php.php-unbundle 2014-09-07 18:21:36.000000000 +0200 +@@ -59,7 +59,7 @@ + include("config.php"); + include("defaults.php"); + include("server/util.php"); +- require("server/PEAR/JSON.php"); ++ @include("server/PEAR/JSON.php"); + + require("mapi/mapi.util.php"); + require("mapi/mapicode.php"); +--- zarafa-7.1.11.rsc/php-webclient-ajax/server/core/class.xmlparser.php 2014-09-03 10:45:06.000000000 +0200 ++++ zarafa-7.1.11.rsc/php-webclient-ajax/server/core/class.xmlparser.php.php-unbundle 2014-09-07 18:22:40.000000000 +0200 +@@ -50,7 +50,7 @@ + + ?> + for Zarafa <= 7.1.11 which enhances my earlier +this year implemented "disable_plaintext_auth" feature (new option in Zarafa >= 7.1.10 to disable +all plaintext authentications unless SSL/TLS is used), https://jira.zarafa.com/browse/ZCP-12142 +contains the initial implementation and a more verbose feature description. + +Given that there are unfortunately still Zarafa systems around using saslauthd without pam_mapi +but rimap instead the "disable_plaintext_auth" feature prevents them from enabling this option as +rimap doesn't support SSL/TLS; https://jira.zarafa.com/browse/ZCP-12473 contains an example report +by a Zarafa customer. Thus this patch adds an exception if the source IPv4 address is "127.0.0.1" +and allows even if "disable_plaintext_auth" is enabled a cleartext authentication. It was a design +decision to check only for 127.0.0.1/32 rather 127.0.0.0/8 because there seem to be systems where +the loopback network except 127.0.0.1/32 is routable?! + +Important: The technical implementation of this patch might be not perfect as I am not really a C/ +C++ developer. There should be a code review by an experienced C/C++ developer before merging into +Zarafa core. + +Proposed to upstream via e-mail on Thu, 16 Oct 2014 00:00:05 +0200, patch was put into the upstream +ticket https://jira.zarafa.com/browse/ZCP-12473. + +--- zarafa-7.1.11/gateway/IMAP.cpp 2014-09-03 10:45:06.000000000 +0200 ++++ zarafa-7.1.11/gateway/IMAP.cpp.plaintext_auth_localhost 2014-09-24 01:29:10.000000000 +0200 +@@ -757,7 +757,7 @@ + if (!lpChannel->UsingSsl() && lpChannel->sslctx()) + strCapabilities += " STARTTLS"; + +- if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0) ++ if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0) + strCapabilities += " LOGINDISABLED"; + else + strCapabilities += " AUTH=PLAIN"; +@@ -923,7 +923,7 @@ + char *plain = lpConfig->GetSetting("disable_plaintext_auth"); + + // If plaintext authentication was disabled any authentication attempt must be refused very soon +- if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0) { ++ if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0) { + hr2 = HrResponse(RESP_TAGGED_NO, strTag, "[PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure " + "(SSL/TLS) connections."); + if (hr2 != hrSuccess) +@@ -1002,7 +1002,7 @@ + } + + // If plaintext authentication was disabled any login attempt must be refused very soon +- if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0) { ++ if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0) { + hr2 = HrResponse(RESP_UNTAGGED, "BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client " + "did it anyway. If anyone was listening, the password was exposed."); + if (hr2 != hrSuccess) +--- zarafa-7.1.11/gateway/POP3.cpp 2014-09-03 10:45:06.000000000 +0200 ++++ zarafa-7.1.11/gateway/POP3.cpp.plaintext_auth_localhost 2014-09-24 01:30:41.000000000 +0200 +@@ -320,7 +320,7 @@ + if (!lpChannel->UsingSsl() && lpChannel->sslctx()) + strCapabilities += "STLS\r\n"; + +- if (!(!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0)) ++ if (!(!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0)) + strCapabilities += "USER\r\n"; + } + +@@ -402,7 +402,7 @@ + HRESULT hr = hrSuccess; + char *plain = lpConfig->GetSetting("disable_plaintext_auth"); + +- if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0) { ++ if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0) { + hr = HrResponse(POP3_RESP_AUTH_ERROR, "Plaintext authentication disallowed on non-secure (SSL/TLS) connections"); + lpLogger->Log(EC_LOGLEVEL_ERROR, "Aborted login from %s with username \"%s\" (tried to use disallowed plaintext auth)", + lpChannel->GetIPAddress().c_str(), strUser.c_str()); +@@ -431,7 +431,7 @@ + HRESULT hr = hrSuccess; + char *plain = lpConfig->GetSetting("disable_plaintext_auth"); + +- if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0) { ++ if (!lpChannel->UsingSsl() && lpChannel->sslctx() && plain && strcmp(plain, "yes") == 0 && strcmp(lpChannel->GetIPAddress().c_str(), "127.0.0.1") != 0) { + hr = HrResponse(POP3_RESP_AUTH_ERROR, "Plaintext authentication disallowed on non-secure (SSL/TLS) connections"); + if(szUser.empty()) + lpLogger->Log(EC_LOGLEVEL_ERROR, "Aborted login from %s without username (tried to use disallowed " +--- zarafa-7.1.11/doc/manual.xml 2014-09-03 09:56:28.000000000 +0200 ++++ zarafa-7.1.11/doc/manual.xml.plaintext_auth_localhost 2014-10-15 01:22:14.000000000 +0200 +@@ -8024,7 +8024,9 @@ + + + Disable all plaintext POP3 and IMAP authentications unless +- SSL/TLS is used. Obviously this requires at least ++ SSL/TLS is used (except for connections originating from ++ 127.0.0.1 to allow saslauthd with rimap). ++ Obviously enabling this configuration option requires at least + ssl_private_key_file and + ssl_certificate_file to take effect. + Default: no diff --git a/zarafa-7.1.11-rpath.patch b/zarafa-7.1.11-rpath.patch new file mode 100644 index 0000000..88ac16f --- /dev/null +++ b/zarafa-7.1.11-rpath.patch @@ -0,0 +1,85 @@ +Patch by Robert Scheck for zarafa >= 7.1.11, which works +around the broken libtool of Debian. Multilib/multiarch systems like Fedora or Red +Hat Enterprise Linux are using /usr/lib64 for 64 bit libraries and /usr/lib is used +for 32 bit libraries. That allows to run 32 bit software on 64 bit systems. Debian +systems only use /usr/lib which contains only 32 or 64 bit systems depending on the +architecture. + +Libtool hardcodes the runtime search path in a library (rpath), if the library that +is used for linking is not within the default system library path. The result is, +that if aclocal.m4/configure files are generated by a Debian system, but used on a +Fedora or Red Hat Enterprise Linux 64 bit system for compiling, "-rpath /usr/lib64" +makes it into the binary. + +Fedora and EPEL (for Red Hat Enterprise Linux) do not allow binaries with rpath, as +the Linux dynamic linker is usually smarter than the hardcoded path. + +The fix for this issue is to add the optional /lib64 and /usr/lib64 directories at/ +within libtool in front of the regular /lib and /usr/lib directories at the system +library path. These libtool information are hold in aclocal.m4, which is generated +by running aclocal. As the content of aclocal.m4 is included into configure during +a run of autoconf, aclocal.m4 needs to be modified within the upstream build system +each time after a aclocal run - until Debian's libtool is fixed at Debian upstream. + +Applying the fix is either possible by using the first hunk of the patch (second +hunk is runtime-only if configure file has been already generated) or by running +the following sed command after each aclocal run within the upstream build system: + + sed -e 's@\(# Append ld.so.conf contents to the search path\)@# Add ABI-specific directories to the system library path.\n sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"\n\n \1@' \ + -e 's@/lib /usr/lib $lt_ld_extra@$sys_lib_dlsearch_path_spec $lt_ld_extra@' -i zarafa-7.1.11/aclocal.m4 + +More information regarding this topic can be found for example at: + + - http://osdir.com/ml/bug-libtool-gnu/2009-12/msg00034.html + - http://lists.gnu.org/archive/html/libtool/2009-01/msg00039.html + - http://thread.gmane.org/gmane.comp.gnu.libtool.general/8339/focus=8345 + +--- zarafa-7.1.11/aclocal.m4 2014-09-03 09:56:52.000000000 +0200 ++++ zarafa-7.1.11/aclocal.m4.rpath 2014-09-07 17:20:37.000000000 +0200 +@@ -2672,10 +2672,13 @@ + # before this can be enabled. + hardcode_into_libs=yes + ++ # Add ABI-specific directories to the system library path. ++ sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib" ++ + # Append ld.so.conf contents to the search path + if test -f /etc/ld.so.conf; then + lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` +- sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" ++ sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra" + fi + + # We used to test for /lib/ld.so.1 and disable shared libraries on +--- zarafa-7.1.11/configure 2014-09-03 09:56:53.000000000 +0200 ++++ zarafa-7.1.11/configure.rpath 2014-09-07 17:28:07.000000000 +0200 +@@ -10983,10 +10983,13 @@ + # before this can be enabled. + hardcode_into_libs=yes + ++ # Add ABI-specific directories to the system library path. ++ sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib" ++ + # Append ld.so.conf contents to the search path + if test -f /etc/ld.so.conf; then + lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` +- sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" ++ sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra" + fi + + # We used to test for /lib/ld.so.1 and disable shared libraries on +@@ -16025,10 +16028,13 @@ + # before this can be enabled. + hardcode_into_libs=yes + ++ # Add ABI-specific directories to the system library path. ++ sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib" ++ + # Append ld.so.conf contents to the search path + if test -f /etc/ld.so.conf; then + lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` +- sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" ++ sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra" + fi + + # We used to test for /lib/ld.so.1 and disable shared libraries on diff --git a/zarafa-7.1.11-vacation-headers.patch b/zarafa-7.1.11-vacation-headers.patch new file mode 100644 index 0000000..924ff1d --- /dev/null +++ b/zarafa-7.1.11-vacation-headers.patch @@ -0,0 +1,32 @@ +Patch by Robert Scheck for Zarafa >= 7.1.11 which restricts replies by +zarafa-autorespond to automated processes and mailing lists according to RFC 5230, section 4.6. For +further details please have a look to http://tools.ietf.org/html/rfc5230#page-8 as well. + +Proposed to upstream via e-mail on Wed, 27 Aug 2014 23:30:31 +0200, patch was put into the upstream +ticket https://jira.zarafa.com/browse/ZCP-12590. + +--- zarafa-7.1.11/spooler/DAgent.cpp 2014-08-24 12:27:06.000000000 +0200 ++++ zarafa-7.1.11/spooler/DAgent.cpp.vacation-headers 2014-08-27 23:20:18.000000000 +0200 +@@ -1422,11 +1422,19 @@ + + // See if we're looping + if (lpMessageProps[0].ulPropTag == PR_TRANSPORT_MESSAGE_HEADERS_A) { +- if ( (strstr(lpMessageProps[0].Value.lpszA, "X-Zarafa-Vacation:") != NULL) || +- (strstr(lpMessageProps[0].Value.lpszA, "Auto-Submitted:") != NULL) || +- (strstr(lpMessageProps[0].Value.lpszA, "Precedence:") != NULL) ) ++ if ( (strstr(lpMessageProps[0].Value.lpszA, "X-Zarafa-Vacation:") != NULL) || // Zarafa ++ (strstr(lpMessageProps[0].Value.lpszA, "Auto-Submitted:") != NULL) || // RFC 3834 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Id:") != NULL) || // RFC 2919 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Help:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Subscribe:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Unsubscribe:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Post:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Owner:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "List-Archive:") != NULL) || // RFC 2369 ++ (strstr(lpMessageProps[0].Value.lpszA, "Precedence:") != NULL) ) // RFC 3834 + // Vacation header already present, do not send vacation reply + // Precedence: list/bulk/junk, do not reply to these mails ++ // See also http://tools.ietf.org/html/rfc5230#page-8 for details + goto exit; + // save headers to a file so they can also be tested from the script we're runing + snprintf(szTemp, PATH_MAX, "%s/autorespond-headers.XXXXXX", getenv("TEMP") == NULL ? "/tmp" : getenv("TEMP")); diff --git a/zarafa-7.1.11-vacation-headers2.patch b/zarafa-7.1.11-vacation-headers2.patch new file mode 100644 index 0000000..7fcae17 --- /dev/null +++ b/zarafa-7.1.11-vacation-headers2.patch @@ -0,0 +1,44 @@ +Patch by Robert Scheck for Zarafa >= 7.1.11 which adds anti-loop headers +for automatic responses by zarafa-autorespond for Microsoft Exchange and all vacation(1) compatible +implementations. + +For the Microsoft Exchange related part useful links are: + - http://msdn.microsoft.com/en-us/library/ee219609(v=exchg.80).aspx + - https://www.jitbit.com/maxblog/18-detecting-outlook-autoreplyout-of-office-emails-and-x-auto-response-suppress-header/ + +For vacation(1) compatible implementations useful links are: + - http://www.daemon-systems.org/man/vacation.1.html + - Book "sendmail" (written by Bryan Costales, Claus Assmann, George Jansen, Gregory Neil Shapiro), ISBN 0596555342 + +Proposed to upstream via e-mail on Wed, 27 Aug 2014 23:59:58 +0200, patch was put into the upstream +ticket https://jira.zarafa.com/browse/ZCP-12591. + +--- zarafa-7.1.11/spooler/DAgent.cpp 2014-08-24 12:27:06.000000000 +0200 ++++ zarafa-7.1.11/spooler/DAgent.cpp.vacation-headers2 2014-08-27 23:52:42.000000000 +0200 +@@ -1469,12 +1469,25 @@ + if (hr != hrSuccess) + goto exit; + +- // add anti-loop header ++ // add anti-loop header for Zarafa + snprintf(szHeader, PATH_MAX, "\nX-Zarafa-Vacation: autorespond"); + hr = WriteOrLogError(fd, szHeader, strlen(szHeader)); + if (hr != hrSuccess) + goto exit; + ++ // add anti-loop header for Exchange, see http://msdn.microsoft.com/en-us/library/ee219609(v=exchg.80).aspx ++ snprintf(szHeader, PATH_MAX, "\nX-Auto-Response-Suppress: All"); ++ hr = WriteOrLogError(fd, szHeader, strlen(szHeader)); ++ if (hr != hrSuccess) ++ goto exit; ++ ++ // add anti-loop header for vacation(1) compatible implementations, see section 10.9 of book "sendmail" (written ++ // by Bryan Costales, Claus Assmann, George Jansen, Gregory Neil Shapiro), ISBN 0596555342 ++ snprintf(szHeader, PATH_MAX, "\nPrecedence: bulk"); ++ hr = WriteOrLogError(fd, szHeader, strlen(szHeader)); ++ if (hr != hrSuccess) ++ goto exit; ++ + if (lpMessageProps[3].ulPropTag == PR_SUBJECT_W) { + // convert as one string because of [] characters + swprintf(szwHeader, PATH_MAX, L"%ls [%ls]", szSubject, lpMessageProps[3].Value.lpszW); diff --git a/zarafa-7.1.11-webaccess-fail2ban.patch b/zarafa-7.1.11-webaccess-fail2ban.patch new file mode 100644 index 0000000..3c2b5c3 --- /dev/null +++ b/zarafa-7.1.11-webaccess-fail2ban.patch @@ -0,0 +1,21 @@ +Patch by Robert Scheck for Zarafa <= 7.1.11 which logs authentication +failures of Zarafa WebAccess into the error log of the webserver. This is basically a backport of +https://jira.zarafa.com/browse/WA-6908 from WebApp to WebAccess. In difference to original patch +there is no inappropriate space before a punctuation mark also known as "plenken". + +Proposed to upstream via e-mail on Wed, 13 Aug 2014 22:56:09 +0200, initial patch was put into the +upstream ticket https://jira.zarafa.com/browse/ZCP-12543. + +--- zarafa-7.1.11/php-webclient-ajax/client/login.php 2014-09-03 10:45:06.000000000 +0200 ++++ zarafa-7.1.11/php-webclient-ajax/client/login.php 2015-02-18 01:08:13.000000000 +0100 +@@ -86,6 +86,10 @@ + switch($_SESSION["hresult"]){ + case MAPI_E_LOGON_FAILED: + case MAPI_E_UNCONFIGURED: ++ // Print error message to error_log of webserver ++ if (!empty($_POST["username"])) { ++ error_log('user '.$_POST["username"].': authentication failure at MAPI'); ++ } + echo _("Logon failed, please check your name/password."); + break; + case MAPI_E_NETWORK_ERROR: diff --git a/zarafa-7.1.12-gsoap-sslv3.patch b/zarafa-7.1.12-gsoap-sslv3.patch new file mode 100644 index 0000000..b1e58f2 --- /dev/null +++ b/zarafa-7.1.12-gsoap-sslv3.patch @@ -0,0 +1,38 @@ +Patch by Robert Scheck for zarafa >= 7.1.12 which disables weak SSLv2 +and SSLv3 protocols for encrypted SOAP connections between the Zarafa services. Until (including) +the Zarafa 7.1.11 release the upstream default was to replace the SSLv23_method() that a pristine +gSOAP library ships with the "safer" SSLv3_method(). With Zarafa 7.1.12 the SSLv3_method() was +changed to SSLv23_method(). However this enables SSLv2 again (and still does not disable SSLv3). +Thus this patch disables SSLv2 and SSLv3 as well as TLS compression explicitly; similar like the +Zarafa Outlook Client which meanwhile only allows TLSv1.0 (and better). + +Proposed to upstream via e-mail on Wed, 2 Apr 2014 11:35:40 +0200, initial patch was put into the +upstream ticket Ticket#2014040210000266. + +--- zarafa-7.1.12/provider/common/SOAPSock.cpp 2015-04-07 13:10:13.000000000 +0200 ++++ zarafa-7.1.12/provider/common/SOAPSock.cpp.gsoap-sslv3 2015-04-07 16:32:20.000000000 +0200 +@@ -157,9 +157,6 @@ + + lpCmd->endpoint = strdup(strServerPath.c_str()); + +- // default allow SSLv3, TLSv1, TLSv1.1 and TLSv1.2 +- lpCmd->soap->ctx = SSL_CTX_new(SSLv23_method()); +- + #ifdef WITH_OPENSSL + if (strncmp("https:", lpCmd->endpoint, 6) == 0) { + // no need to add certificates to call, since soap also calls SSL_CTX_set_default_verify_paths() +@@ -183,6 +180,14 @@ + lpCmd->soap->fsslverify = ssl_verify_callback_zarafa_silent; + + SSL_CTX_set_verify(lpCmd->soap->ctx, SSL_VERIFY_PEER, lpCmd->soap->fsslverify); ++ ++ // disable SSLv2 (according to RFC 6176) and SSLv3, leaving just TLSv1.0 (and better) ++ SSL_CTX_set_options(lpCmd->soap->ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); ++ ++#ifdef SSL_OP_NO_COMPRESSION ++ // disable TLS compression to close the CRIME attack vector (also known as CVE-2012-4929) ++ SSL_CTX_set_options(lpCmd->soap->ctx, SSL_OP_NO_COMPRESSION); ++#endif + } + #endif + diff --git a/zarafa-7.1.12-licensed-archiver.patch b/zarafa-7.1.12-licensed-archiver.patch new file mode 100644 index 0000000..0ccde8c --- /dev/null +++ b/zarafa-7.1.12-licensed-archiver.patch @@ -0,0 +1,117 @@ +Patch by Robert Scheck for Zarafa >= 7.1.12 which removes a wrongly introduced dependency to the +proprietary zarafa-licensed. From Zarafa 7.1.11 to 7.1.12 there were some changes to the ValidateArchiverLicense() method; +due to these changes rebuilding fails with "ArchiverSession.cpp:53:23: fatal error: ECLicense.h: No such file or directory" +now. The patch just reverts the changes that were introduced from 7.1.11 to 7.1.12 to get the code building again. + +--- zarafa-7.1.12/ECtools/zarafa-archiver/ArchiverSession.cpp 2015-04-07 13:10:12.000000000 +0200 ++++ zarafa-7.1.12/ECtools/zarafa-archiver/ArchiverSession.cpp.licensed-archiver 2015-04-07 15:55:07.000000000 +0200 +@@ -50,8 +50,6 @@ + #include "mapiext.h" + #include "userutil.h" + #include "ECMsgStore.h" +-#include "ECLicense.h" +-#include "ECMAPILicense.h" + + typedef mapi_memory_ptr ECServerListPtr; + +@@ -879,38 +877,7 @@ + typedef mapi_object_ptr ECMsgStorePtr; + + HRESULT ArchiverSession::ValidateArchiverLicense(bool attachnewuser /* = false*/) const { +- IMsgStore *lpMsgStore = NULL; +- IMsgStore *lpProxedMsgStore = NULL; +- UnknownPtr ptrUnknown; +- ECMsgStorePtr ptrOnlineStore; +- +- HRESULT hr = HrOpenDefaultStore(GetMAPISession(), MDB_WRITE | MDB_NO_DIALOG | MDB_NO_MAIL | MDB_TEMPORARY, &lpMsgStore); +- if (hr != hrSuccess) +- goto exit; +- +- hr = GetProxyStoreObject(lpMsgStore, &lpProxedMsgStore); +- if (hr != hrSuccess) +- goto exit; +- +- hr = lpProxedMsgStore->QueryInterface(IID_ECMsgStoreOnline, &ptrUnknown); +- if (hr != hrSuccess) +- goto exit; +- +- hr = ptrUnknown->QueryInterface(IID_ECMsgStore, &ptrOnlineStore); +- if (hr != hrSuccess) { +- m_lpLogger->Log(EC_LOGLEVEL_FATAL, "Unable to validate archived user count. Please check the archiver and licensed log for errors."); +- hr = MAPI_E_NO_SUPPORT; +- goto exit; +- } +- +- hr = HrCheckLicense(&ptrOnlineStore->m_xMsgStore, SERVICE_TYPE_ARCHIVE, ZARAFA_ARCHIVE_DEFAULT); +- if (hr != hrSuccess) +- { +- m_lpLogger->Log(EC_LOGLEVEL_FATAL, "No archiver license found."); +- hr = MAPI_E_NO_SUPPORT; +- } +- else +- { ++ HRESULT hr; + unsigned int ulArchivedUsers = 0; + unsigned int ulMaxUsers = 0; + +@@ -931,7 +898,6 @@ + } else if (ulArchivedUsers + 5 >= ulMaxUsers) { //@todo which warning limit? + m_lpLogger->Log(EC_LOGLEVEL_FATAL, "You almost reached the archived user limit. Archived users %d of %d", ulArchivedUsers, ulMaxUsers); + } +- } + + exit: + return hr; +--- zarafa-7.1.12/ECtools/zarafa-archiver/Makefile.am 2015-04-07 12:00:49.000000000 +0200 ++++ zarafa-7.1.12/ECtools/zarafa-archiver/Makefile.am.licensed-archiver 2015-04-07 15:59:42.000000000 +0200 +@@ -9,7 +9,6 @@ + -I${top_srcdir}/provider/client \ + -I${top_srcdir}/provider/include \ + -I${top_srcdir}/provider/soap \ +- -I${top_srcdir}/liblicense \ + -I${top_builddir}/provider/soap \ + $(GSOAP_CFLAGS) \ + -I${top_srcdir}/common \ +@@ -17,9 +16,7 @@ + + libarchiver_la_LIBADD = ${top_builddir}/mapi4linux/src/libmapi.la \ + ${top_builddir}/common/libcommon_mapi.la \ +- ${top_builddir}/common/libcommon_util.la \ +- ${top_builddir}/liblicense/liblicense.la \ +- ${top_builddir}/liblicense/liblicense_mapi.la ++ ${top_builddir}/common/libcommon_util.la + + libarchiver_la_SOURCES = \ + ArchiverSession.cpp ArchiverSession.h ArchiverSessionPtr.h \ +--- zarafa-7.1.12/ECtools/zarafa-archiver/Makefile.in 2015-04-07 12:03:40.000000000 +0200 ++++ zarafa-7.1.12/ECtools/zarafa-archiver/Makefile.in.licensed-archiver 2015-04-07 16:00:15.000000000 +0200 +@@ -112,9 +112,7 @@ + libarchiver_la_DEPENDENCIES = \ + ${top_builddir}/mapi4linux/src/libmapi.la \ + ${top_builddir}/common/libcommon_mapi.la \ +- ${top_builddir}/common/libcommon_util.la \ +- ${top_builddir}/liblicense/liblicense.la \ +- ${top_builddir}/liblicense/liblicense_mapi.la ++ ${top_builddir}/common/libcommon_util.la + am_libarchiver_la_OBJECTS = ArchiverSession.lo archiver-common.lo \ + ArchiveManageImpl.lo ArchiveStateCollector.lo \ + ArchiveStateUpdater.lo ArchiveHelper.lo StoreHelper.lo \ +@@ -395,7 +393,6 @@ + -I${top_srcdir}/provider/client \ + -I${top_srcdir}/provider/include \ + -I${top_srcdir}/provider/soap \ +- -I${top_srcdir}/liblicense \ + -I${top_builddir}/provider/soap \ + $(GSOAP_CFLAGS) \ + -I${top_srcdir}/common \ +@@ -403,9 +400,7 @@ + + libarchiver_la_LIBADD = ${top_builddir}/mapi4linux/src/libmapi.la \ + ${top_builddir}/common/libcommon_mapi.la \ +- ${top_builddir}/common/libcommon_util.la \ +- ${top_builddir}/liblicense/liblicense.la \ +- ${top_builddir}/liblicense/liblicense_mapi.la ++ ${top_builddir}/common/libcommon_util.la + + libarchiver_la_SOURCES = \ + ArchiverSession.cpp ArchiverSession.h ArchiverSessionPtr.h \ diff --git a/zarafa-7.1.12-ssl_ecdhe.patch b/zarafa-7.1.12-ssl_ecdhe.patch new file mode 100644 index 0000000..837fba2 --- /dev/null +++ b/zarafa-7.1.12-ssl_ecdhe.patch @@ -0,0 +1,85 @@ +Patch by Robert Scheck for Zarafa >= 7.1.12 which implements ECDHE (elliptic +curve diffie-hellman key exchange) support. http://en.wikipedia.org/wiki/Elliptic_curve_cryptography is +providing more information about elliptic curves. + +Suggestions for testing; run the following openssl(1) commands before and after applying this patch: + +1. echo QUIT | openssl s_client -connect :110 -starttls pop3 2>&1 | grep Cipher +2. echo QUIT | openssl s_client -connect :143 -starttls imap 2>&1 | grep Cipher +3. echo QUIT | openssl s_client -connect :237 2>&1 | grep Cipher +4. echo QUIT | openssl s_client -connect :993 2>&1 | grep Cipher +5. echo QUIT | openssl s_client -connect :995 2>&1 | grep Cipher +6. echo QUIT | openssl s_client -connect :8443 2>&1 | grep Cipher + +After applying this patch the output should contain e.g. "ECDHE-RSA-AES256-GCM-SHA384" on a Red Hat +Enterprise Linux 6.5 (only RHEL >= 6.5 has support for elliptic curve). Without this patch the result +is e.g. "AES256-GCM-SHA384". + +Important: The technical implementation of this patch might be not perfect as I am not really a C/C++ +developer. The logic and the implementation is heavily based on Sendmail. There should be a code review +by an experienced C/C++ and OpenSSL developer before merging into Zarafa core. + +This patch should be only applied after ZCP-12143 and its dependencies. However this patch might maybe +not directly apply due to some previous merge issues as mentioned in Ticket#2014030810000131. + +Proposed to upstream via e-mail on Mon, 14 Apr 2014 12:04:17 +0200, initial patch was put into upstream +ticket https://jira.zarafa.com/browse/ZCP-12237. + +--- zarafa-7.1.12/common/ECChannel.cpp 2015-04-07 13:10:12.000000000 +0200 ++++ zarafa-7.1.12/common/ECChannel.cpp.ssl_ecdhe 2015-04-07 17:12:15.000000000 +0200 +@@ -93,6 +93,9 @@ + char *ssl_ciphers = lpConfig->GetSetting("ssl_ciphers"); + char *ssl_name = NULL; + int ssl_op = 0, ssl_include = 0, ssl_exclude = 0; ++#if !defined(OPENSSL_NO_ECDH) && defined(NID_X9_62_prime256v1) ++ EC_KEY *ecdh; ++#endif + + if (lpConfig == NULL) { + lpLogger->Log(EC_LOGLEVEL_ERROR, "ECChannel::HrSetCtx(): invalid parameters"); +@@ -113,6 +116,16 @@ + + SSL_CTX_set_options(lpCTX, SSL_OP_ALL); // enable quirk and bug workarounds + ++#if !defined(OPENSSL_NO_ECDH) && defined(NID_X9_62_prime256v1) ++ ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ ++ if (ecdh != NULL) { ++ SSL_CTX_set_options(lpCTX, SSL_OP_SINGLE_ECDH_USE); ++ SSL_CTX_set_tmp_ecdh(lpCTX, ecdh); ++ EC_KEY_free(ecdh); ++ } ++#endif ++ + ssl_name = strtok(ssl_protocols, " "); + while(ssl_name != NULL) { + int ssl_proto = 0; +--- zarafa-7.1.12/provider/server/ECSoapServerConnection.cpp 2015-04-07 13:10:13.000000000 +0200 ++++ zarafa-7.1.12/provider/server/ECSoapServerConnection.cpp.ssl_ecdhe 2015-04-07 17:13:23.000000000 +0200 +@@ -235,6 +235,9 @@ + char *server_ssl_ciphers = m_lpConfig->GetSetting("server_ssl_ciphers"); + char *ssl_name = NULL; + int ssl_op = 0, ssl_include = 0, ssl_exclude = 0; ++#if !defined(OPENSSL_NO_ECDH) && defined(NID_X9_62_prime256v1) ++ EC_KEY *ecdh; ++#endif + + if(lpServerName == NULL) { + free(server_ssl_ciphers); +@@ -268,6 +271,16 @@ + + SSL_CTX_set_options(lpsSoap->ctx, SSL_OP_ALL); + ++#if !defined(OPENSSL_NO_ECDH) && defined(NID_X9_62_prime256v1) ++ ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ ++ if (ecdh != NULL) { ++ SSL_CTX_set_options(lpsSoap->ctx, SSL_OP_SINGLE_ECDH_USE); ++ SSL_CTX_set_tmp_ecdh(lpsSoap->ctx, ecdh); ++ EC_KEY_free(ecdh); ++ } ++#endif ++ + ssl_name = strtok(server_ssl_protocols, " "); + while(ssl_name != NULL) { + int ssl_proto = 0; diff --git a/zarafa-7.1.12-ssl_protocols_ciphers.patch b/zarafa-7.1.12-ssl_protocols_ciphers.patch new file mode 100644 index 0000000..c9de1c6 --- /dev/null +++ b/zarafa-7.1.12-ssl_protocols_ciphers.patch @@ -0,0 +1,123 @@ +Patch by Robert Scheck for Zarafa >= 7.1.12 which re-adds the whole +documentation that was initially proposed to upstream but lost when this feature was backported +from Zarafa 7.2 to the 7.1 series. + +Proposed to upstream via e-mail on Sat, 8 Mar 2014 14:30:29 +0100, initial patch was put into +the upstream ticket https://jira.zarafa.com/browse/ZCP-12143. + +--- zarafa-7.1.12/doc/manual.xml 2015-04-07 12:03:31.000000000 +0200 ++++ zarafa-7.1.12/doc/manual.xml.ssl_protocols_ciphers 2015-04-07 17:05:47.000000000 +0200 +@@ -4226,14 +4226,35 @@ + + + +- ++ + +- Incoming SSL connections normally are v3. +- Default: no +- ++ Disabled or enabled protocol names. Supported protocol names ++ are SSLv2, SSLv3 ++ and TLSv1. If Zarafa was linked against ++ OpenSSL 1.0.1 or later there is additional support for the new protocols ++ TLSv1.1 and TLSv1.2. ++ To exclude both, SSLv2 and SSLv3 set ++ to !SSLv2 !SSLv3. SSLv2 is considered unsafe ++ and these connections should not be accepted. ++ Default: !SSLv2 ++ ++ ++ ++ ++ ++ ++ SSL ciphers to use, set to ALL for backward compatibility. ++ Default: ALL:!LOW:!SSLv2:!EXP:!aNULL + + + ++ ++ ++ ++ Prefer the server's order of SSL ciphers over client's. ++ Default: no ++ ++ + + + +@@ -8090,11 +8111,32 @@ + + + +- ++ ++ ++ Disabled or enabled protocol names. Supported protocol names ++ are SSLv2, SSLv3 ++ and TLSv1. If Zarafa was linked against ++ OpenSSL 1.0.1 or later there is additional support for the new protocols ++ TLSv1.1 and TLSv1.2. ++ To exclude both, SSLv2 and SSLv3 set ++ to !SSLv2 !SSLv3. SSLv2 is considered unsafe ++ and these connections should not be accepted. ++ Default: !SSLv2 ++ ++ ++ ++ ++ + +- Accept SSLv2 only connections. SSLv2 is considered +- unsafe, and these connections should not be +- accepted. ++ SSL ciphers to use, set to ALL for backward compatibility. ++ Default: ALL:!LOW:!SSLv2:!EXP:!aNULL ++ ++ ++ ++ ++ ++ ++ Prefer the server's order of SSL ciphers over client's. + Default: no + + +@@ -10091,11 +10133,32 @@ + + + +- ++ ++ ++ Disabled or enabled protocol names. Supported protocol names ++ are SSLv2, SSLv3 ++ and TLSv1. If Zarafa was linked against ++ OpenSSL 1.0.1 or later there is additional support for the new protocols ++ TLSv1.1 and TLSv1.2. ++ To exclude both, SSLv2 and SSLv3 set ++ to !SSLv2 !SSLv3. SSLv2 is considered unsafe ++ and these connections should not be accepted. ++ Default: !SSLv2 ++ ++ ++ ++ ++ ++ ++ SSL ciphers to use, set to ALL for backward compatibility. ++ Default: ALL:!LOW:!SSLv2:!EXP:!aNULL ++ ++ ++ ++ ++ + +- Accept SSLv2 only connections. SSLv2 is considered +- unsafe, and these connections should not be +- accepted. ++ Prefer the server's order of SSL ciphers over client's. + Default: no + + diff --git a/zarafa-7.1.12-upgrade-lock.patch b/zarafa-7.1.12-upgrade-lock.patch new file mode 100644 index 0000000..2a1fddd --- /dev/null +++ b/zarafa-7.1.12-upgrade-lock.patch @@ -0,0 +1,56 @@ +Patch by Robert Scheck for Zarafa 7.1.12 which backports the fix for +CVE-2015-3436. Guido Günther detected and reported that replacing "/tmp/zarafa-upgrade-lock" by +a symlink makes the zarafa-server process following that symlink and thus allows to overwrite +arbitrary files in the filesystem (assuming zarafa-server runs as root which is not the case by +default at Fedora, but it is the upstream default). One just needs write permissions in /tmp and +wait until the zarafa-server is restarted. https://bugzilla.redhat.com/show_bug.cgi?id=1222151 +contains further information. The difference between this backport and the original diff is that +the log levels were reworked from Zarafa 7.1.x to 7.2.x (which this backport takes care of). + +--- zarafa-7.1.12/provider/server/ECServer.cpp 2015-05-08 15:09:05.000000000 +0200 ++++ zarafa-7.1.12/provider/server/ECServer.cpp.upgrade-lock 2015-05-18 23:05:00.000000000 +0200 +@@ -101,6 +101,8 @@ + // have to go with the safe value which is for 64bit. + #define MYSQL_MIN_THREAD_STACK (256*1024) + ++const char upgrade_lock_file[] = "/tmp/zarafa-upgrade-lock"; ++ + extern ECSessionManager* g_lpSessionManager; + + // scheduled functions +@@ -832,7 +834,7 @@ + // SIGSEGV backtrace support + stack_t st = {0}; + struct sigaction act = {{0}}; +- FILE *tmplock = NULL; ++ int tmplock = -1; + struct stat dir = {0}; + struct passwd *runasUser = NULL; + +@@ -1288,8 +1290,9 @@ + m_bDatabaseUpdateIgnoreSignals = true; + + // add a lock file to disable the /etc/init.d scripts +- tmplock = fopen("/tmp/zarafa-upgrade-lock","w"); +- if (!tmplock) ++ tmplock = open(upgrade_lock_file, O_CREAT | O_EXCL, S_IRUSR | S_IWUSR); ++ ++ if (tmplock == -1) + g_lpLogger->Log(EC_LOGLEVEL_FATAL, "WARNING: Unable to place upgrade lockfile: %s", strerror(errno)); + + #ifdef EMBEDDED_MYSQL +@@ -1314,9 +1317,11 @@ + er = lpDatabaseFactory->UpdateDatabase(m_bForceDatabaseUpdate, dbError); + + // remove lock file +- if (tmplock) { +- fclose(tmplock); +- unlink("/tmp/zarafa-upgrade-lock"); ++ if (tmplock != -1) { ++ if (unlink(upgrade_lock_file) == -1) ++ g_lpLogger->Log(EC_LOGLEVEL_FATAL, "WARNING: Unable to delete upgrade lockfile (%s): %s", upgrade_lock_file, strerror(errno)); ++ ++ close(tmplock); + } + + if(er == ZARAFA_E_INVALID_VERSION) { diff --git a/zarafa-7.1.12-webaccess-mcrypt.patch b/zarafa-7.1.12-webaccess-mcrypt.patch new file mode 100644 index 0000000..e7b3fcd --- /dev/null +++ b/zarafa-7.1.12-webaccess-mcrypt.patch @@ -0,0 +1,58 @@ +Patch by Robert Scheck for Zarafa >= 7.1.12 which fixes the fix that fixes CVE-2014-0103. Ush, +that was complicated, so: CVE-2014-0103 exists because Zarafa WebAccess < 7.1.10 and Zarafa WebApp < 1.6 storing passwords +in cleartext on server (in the PHP session). Zarafa solved this flaw by using openssl_encrypt() and openssl_decrypt() from +PHP's OpenSSL bindings. However these functions are only available in PHP 5.3 or later. Without this patch suggestion, any +older but still supported Linux distribution like Red Hat Enterprise Linux 5 or SuSE Linux Enterprise Server 10 (which are +both shipping PHP < 5.3 by default) would still be left vulnerable. + +Given that I am personally more a fan of OpenSSL rather mcrypt, I am not absolutely sure if this implementation is really +correct even it works fine on my test system. So please explicitly review this code to avoid introducing another security +flaw by trying to fix one! A thing that I generally question for myself is the usage of "des-ede3-cbc"/"MCRYPT_TRIPLEDES" +instead of e.g. MCRYPT_RIJNDAEL_128. Given that this decision was initially made by Zarafa I am just following that here. + +Important: To get this patch really powerful the install-time requirement needs to be adapted like this (this example is +based on Fedora's build system so the macros %{?rhel} and %{?fedora} might not exist at Zarafa but need to be replaced by +other macros): + +%if 0%{?rhel}%{?fedora} < 6 +Requires: php-mcrypt +%else +Requires: php-openssl +%endif + +This requires php-openssl (provided by php-common) on RHEL 6 (and later) and php-mcrypt (separate package) before RHEL 6. + +Proposed to upstream via e-mail on Thu, 5 Jun 2014 00:24:32 +0200, initial patch was put into the (non-disclosed) upstream +ticket https://jira.zarafa.com/browse/ZCP-12407. + +--- zarafa-7.1.12/php-webclient-ajax/index.php 2015-04-07 13:10:13.000000000 +0200 ++++ zarafa-7.1.12/php-webclient-ajax/index.php.webaccess-mcrypt 2015-04-07 16:22:23.000000000 +0200 +@@ -135,6 +135,8 @@ + } else { + $_SESSION['password'] = openssl_encrypt($password,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV); + } ++ } elseif(function_exists("mcrypt_encrypt")) { ++ $_SESSION['password'] = base64_encode(mcrypt_encrypt(MCRYPT_TRIPLEDES, PASSWORD_KEY, $password, MCRYPT_MODE_CBC, PASSWORD_IV)); + } else { + $_SESSION["password"] = $password; + } +--- zarafa-7.1.12/php-webclient-ajax/server/core/class.mapisession.php 2015-04-07 13:10:14.000000000 +0200 ++++ zarafa-7.1.12/php-webclient-ajax/server/core/class.mapisession.php.webaccess-mcrypt 2015-04-07 16:23:58.000000000 +0200 +@@ -132,6 +132,8 @@ + } else { + $password = openssl_decrypt($password,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV); + } ++ } elseif(function_exists("mcrypt_decrypt")) { ++ $password = rtrim(mcrypt_decrypt(MCRYPT_TRIPLEDES, PASSWORD_KEY, base64_decode($password), MCRYPT_MODE_CBC, PASSWORD_IV), "\0"); + } + // logon + $this->session = mapi_logon_zarafa($username, $password, $server, $sslcert_file, $sslcert_pass); +@@ -144,6 +146,8 @@ + } else { + $password = openssl_encrypt($password,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV); + } ++ } elseif(function_exists("mcrypt_encrypt")) { ++ $password = base64_encode(mcrypt_encrypt(MCRYPT_TRIPLEDES, PASSWORD_KEY, $password, MCRYPT_MODE_CBC, PASSWORD_IV)); + } + + if ($result == NOERROR && $this->session !== false){ diff --git a/zarafa-webaccess.conf b/zarafa-webaccess.conf new file mode 100644 index 0000000..e2b702a --- /dev/null +++ b/zarafa-webaccess.conf @@ -0,0 +1,48 @@ +# +# Zarafa Webaccess featuring a 'Look & Feel' similar to Outlook +# + +Alias /webaccess /usr/share/zarafa-webaccess/ + +# Following Apache and PHP settings need to be set to work correct +# + + # Some apache settings + DirectoryIndex index.php + Options -Indexes +FollowSymLinks + + + # Apache 2.4 + Require all granted + + + # Apache 2.2 + Order allow,deny + Allow from all + + + # Register globals must be off + php_flag register_globals off + + # Magic quotes must be off + php_flag magic_quotes_gpc off + php_flag magic_quotes_runtime off + + # The maximum POST limit. To upload large files, this value must + # be larger than upload_max_filesize. + php_value post_max_size 31M + php_value upload_max_filesize 30M + + # Short open tags must be on + php_flag short_open_tag on + + # Uncomment to enhance security of WebAccess by restricting cookies + # to only be provided over HTTPS connections +# php_flag session.cookie_secure on +# php_flag session.cookie_httponly on + + # Uncomment for debugging purposes only. Make sure Apache/PHP can + # write to this file or no errors will be logged! +# php_flag log_errors on +# php_value error_log /var/lib/zarafa-webaccess/error_log + diff --git a/zarafa.ini b/zarafa.ini new file mode 100644 index 0000000..160434a --- /dev/null +++ b/zarafa.ini @@ -0,0 +1,2 @@ +; Enable Zarafa mapi extension module +extension=mapi.so diff --git a/zarafa.logrotate b/zarafa.logrotate new file mode 100644 index 0000000..17a12ed --- /dev/null +++ b/zarafa.logrotate @@ -0,0 +1,100 @@ +/var/log/zarafa/archiver.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + create 0644 zarafa zarafa +} + +/var/log/zarafa/dagent.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-dagent 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/gateway.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-gateway 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/ical.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-ical 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/indexer.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-indexer 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/monitor.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-monitor 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/server.log /var/log/zarafa/audit.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-server 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} + +/var/log/zarafa/spooler.log { + weekly + missingok + rotate 52 + compress + delaycompress + notifempty + postrotate + killall -HUP zarafa-spooler 2> /dev/null || true + endscript + create 0644 zarafa zarafa +} diff --git a/zarafa.spec b/zarafa.spec new file mode 100644 index 0000000..3821ad1 --- /dev/null +++ b/zarafa.spec @@ -0,0 +1,1165 @@ +%global beta_or_rc 0 +%global actual_release 2 +%global svnrevision 49411 +%global with_search 1 +%global with_ldap 1 +%global with_xmlto 1 +%if 0%{?fedora} > 15 || 0%{?rhel} > 6 +%global with_gsoap 1 +%else +%global with_gsoap 0 +%endif +%global no_multiupload 1 +%global no_bundled_php 1 +%global php_apiver %((echo 0; php -i 2>/dev/null | sed -n 's/^PHP API => //p') | tail -1) +%global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))") + +# Private libraries are not be exposed globally by RPM +# RPM 4.8 +%{?filter_provides_in: %filter_provides_in %{_libdir}/%{name}/.*\.so$} +%{?filter_provides_in: %filter_provides_in %{_libdir}/php/modules/.*\.so$} +%{?filter_setup} +# RPM 4.9 +%global __provides_exclude_from %{?__provides_exclude_from:%__provides_exclude_from|}%{_libdir}/%{name}/.*\\.so$ +%global __provides_exclude_from %{__provides_exclude_from}|%{_libdir}/php/modules/.*\\.so$ + +%if "%{php_version}" < "5.6" +%global ini_name %{name}.ini +%else +%global ini_name 40-%{name}.ini +%endif + +Summary: Open Source Edition of the Zarafa Collaboration Platform +Name: zarafa +Version: 7.1.12 +%if %{beta_or_rc} +Release: 0.%{actual_release}.svn%{svnrevision}%{?dist} +%else +Release: %{actual_release}%{?dist} +%endif +# Red Hat Legal has been advised by email from Zarafa that no license is +# required in order to use the letter string "zarafa" (combined with other +# words) in the package naming, to refer to the software as "Zarafa" to +# indicate its intended purpose, and to modify packages with bug fixes and +# enhancements. +License: AGPLv3 with exceptions +Group: Applications/Productivity +URL: http://www.zarafa.com/ +%if %{beta_or_rc} +Source0: http://download.zarafa.com/community/beta/7.1/%{version}-%{svnrevision}/sourcecode/zcp-%{version}.tar.gz +%else +Source0: http://download.zarafa.com/community/final/7.1/%{version}-%{svnrevision}/sourcecode/zcp-%{version}.tar.gz +%endif +Source1: %{name}.ini +Source2: %{name}.logrotate +Source3: %{name}-webaccess.conf + +Patch0: zarafa-7.1.11-rpath.patch +Patch1: zarafa-7.1.11-php-unbundle.patch +Patch2: zarafa-7.1.10-kyotocabinet.patch +Patch3: zarafa-7.1.12-ssl_protocols_ciphers.patch +Patch4: zarafa-7.1.12-ssl_ecdhe.patch +Patch5: zarafa-7.1.11-plaintext_auth_localhost.patch +Patch6: zarafa-7.1.10-imap-badcharset.patch +Patch7: zarafa-7.1.10-imap-fetch-body.patch +Patch8: zarafa-7.1.11-vacation-headers.patch +Patch9: zarafa-7.1.11-vacation-headers2.patch +Patch10: zarafa-7.1.11-webaccess-fail2ban.patch +Patch11: zarafa-7.1.12-webaccess-mcrypt.patch +Patch12: zarafa-7.1.12-gsoap-sslv3.patch +Patch13: zarafa-7.1.12-licensed-archiver.patch +Patch14: zarafa-7.1.12-upgrade-lock.patch + +BuildRequires: bison +BuildRequires: gcc-c++ +BuildRequires: byacc +BuildRequires: flex +BuildRequires: gettext +BuildRequires: libical-devel >= 0.42 +BuildRequires: libvmime-devel >= 0.9.0, libvmime(api) <= 20120406 +BuildRequires: libxml2-devel +BuildRequires: mysql-devel >= 4.1 +BuildRequires: ncurses-devel +BuildRequires: pam-devel +BuildRequires: php-devel >= 4.3 +BuildRequires: %{_includedir}/uuid/uuid.h +BuildRequires: %{_includedir}/curl/curl.h +BuildRequires: libicu-devel >= 3.4 +%if 0%{?rhel}%{?fedora} > 5 +BuildRequires: boost-devel >= 1.35.0 +%else +BuildRequires: boost141-devel +%endif +BuildRequires: swig +BuildRequires: python-devel >= 2.4 + +%if %{with_gsoap} +BuildRequires: gsoap-devel +%endif + +%if %{with_search} +BuildRequires: kyotocabinet-devel +%if 0%{?fedora} > 15 || 0%{?rhel} > 6 +BuildRequires: clucene09-core-devel >= 0.9.21b-1 +%else +BuildRequires: clucene-core-devel >= 0.9.21b-1 +%endif +%endif + +%if %{with_ldap} +BuildRequires: openldap-devel +%endif + +%if %{with_xmlto} +BuildRequires: xmlto +%endif + +# The main package pulls in all of classical zarafa core packages +Requires: zarafa-dagent%{?_isa} = %{version}-%{release} +Requires: zarafa-gateway%{?_isa} = %{version}-%{release} +Requires: zarafa-ical%{?_isa} = %{version}-%{release} +Requires: zarafa-monitor%{?_isa} = %{version}-%{release} +Requires: zarafa-server%{?_isa} = %{version}-%{release} +Requires: zarafa-spooler%{?_isa} = %{version}-%{release} +Requires: zarafa-utils%{?_isa} = %{version}-%{release} + +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) + +%description +The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The +Open Source Collaboration provides an integration with your existing Linux +mail server, native mobile phone support by ActiveSync compatibility and a +webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an +IMAP and a POP3 gateway as well as an iCal/CalDAV gateway, the Zarafa Open +Source Collaboration can combine the usability with the stability and the +flexibility of a Linux server. + +The proven Zarafa groupware solution is using MAPI objects, provides a MAPI +client library as well as programming interfaces for C++, PHP and Python. +The other Zarafa related packages need to be installed to gain all features +and benefits of the Zarafa Collaboration Platform (ZCP). + +%package archiver +Summary: Archive messages to a secondary Zarafa server +Group: Applications/Archiving +Requires: zarafa-common = %{version}-%{release} + +%description archiver +The zarafa-archiver package includes the Zarafa Archiver to decrease the +size of a production Zarafa server by copying or moving the messages to +a secondary Zarafa server. Clients will still be able to open the message +from the secondary Zarafa server directly. + +%package client +Summary: The Zarafa Client library +Group: System Environment/Libraries +Requires: zarafa-common = %{version}-%{release} + +%description client +The zarafa-client package provides the Zarafa Client library, which gets +used by the Open Source MAPI (Messaging Application Programming Interface) +implementation of Zarafa as provider between MAPI and Zarafa. + +%package common +Summary: Common Zarafa files and directories +Group: Applications/Productivity +Requires(pre): shadow-utils +%if 0%{?rhel}%{?fedora} > 5 +BuildArch: noarch +%endif + +%description common +The zarafa-common package provides the filesystem structure and includes +common files required by most other Zarafa packages. It also provides the +creation of the zarafa user for the different Zarafa services. + +%package contacts +Summary: MAPI provider adding contact folders to the address book +Group: System Environment/Libraries +Requires: zarafa-common = %{version}-%{release} + +%description contacts +The zarafa-contacts package contains an additional MAPI provider to find +all contact folders of a user and add the contents transparently into the +MAPI address book. The MAPI provider allows Zarafa WebApp users to select +which contact folders will be listed in the WebApp address book. + +%package dagent +Summary: Mail Delivery Agent for Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires: php-mapi%{?_isa} = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service + +%description dagent +The zarafa-dagent package includes the Zarafa Delivery Agent to deliver +e-mail messages from Internet Mail format to Zarafa. The Zarafa Delivery +Agent can be used trigger the local mailer (MDA) or even act as the LMTP +server. + +%package devel +Summary: Development files for several Zarafa libraries +Group: Development/Libraries +Requires: libmapi%{?_isa} = %{version}-%{release}, pkgconfig +Provides: %{name}-static = %{version}-%{release} +Provides: %{name}-static%{?_isa} = %{version}-%{release} + +%description devel +The zarafa-devel package includes header files and libraries necessary for +developing own programs which use functions and interfaces from the Zarafa +Collaboration Platform. The Zarafa Open Source Collaboration is using MAPI +objects, provides a MAPI client library and a C++ programming interface. + +%package gateway +Summary: POP3/IMAP Gateway for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires: python-MAPI%{?_isa} = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service + +%description gateway +The zarafa-gateway package includes the Zarafa POP3/IMAP Gateway service +to enable regular non-MAPI e-mail clients to connect through POP3 or IMAP +to the Zarafa server to access their e-mails. Using IMAP, it is possible +as well to view the contents of shared folders and subfolders. The Zarafa +POP3/IMAP Gateway service can be configured to listen for POP3, POP3S, +IMAP and/or IMAPS. + +%package ical +Summary: iCal/CalDAV gateway for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service +Provides: zarafa-caldav = %{version}-%{release} +Provides: zarafa-caldav%{?_isa} = %{version}-%{release} +Obsoletes: zarafa-caldav < 6.40.5-1 + +%description ical +The zarafa-ical package includes the Zarafa iCal/CalDAV gateway service +to enable users to access their calendar using iCalendar (RFC 2445/5545) +or CalDAV (RFC 4791) compliant clients. The iCal/CalDAV gateway service +can be configured to listen for HTTP and HTTPS requests. + +%package monitor +Summary: Quota Monitor for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service + +%description monitor +The zarafa-monitor package includes the Zarafa Monitoring service which +is responsible for checking the users store (mailbox) size, and sending +them (and administrators) a warning e-mail when limits are exceeded. + +%if %{with_search} +%package search +Summary: Indexer search engine for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release}, file +Requires: catdoc, libxslt, w3m, unzip, %{_bindir}/pdftotext +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service +Provides: zarafa-indexer = %{version}-%{release} +Provides: zarafa-indexer%{?_isa} = %{version}-%{release} +Obsoletes: zarafa-indexer < 7.1.0-1 + +%description search +The zarafa-search package includes the Zarafa Indexing service for fast +and full-text searching. Using CLucene search engine, this service makes +an index per user of messages and attachments for the Zarafa server. At +search queries, the server will use this index to quickly find messages, +items and even in contents of attached documents. +%endif + +%package server +Summary: Server component for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service + +%description server +The zarafa-server package includes the main Zarafa Server and Storage +process. It contacts a database server and provides services to Zarafa +clients. The user base can be either retrieved from an external source +or can be setup with a separate list of users. + +%package spooler +Summary: Mail Spooler for the Zarafa Collaboration Platform +Group: System Environment/Daemons +Requires: zarafa-common = %{version}-%{release} +Requires: python-MAPI%{?_isa} = %{version}-%{release} +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/service, /sbin/chkconfig +Requires(postun): /sbin/service + +%description spooler +The zarafa-spooler package includes the Zarafa Spooler service which is +responsible for converting the Zarafa e-mails from outboxes to Internet +Mail and send it using the configured SMTP server to the recipients. + +%package utils +Summary: Zarafa Utilities for administration and management +Group: Applications/System +Requires: zarafa-common = %{version}-%{release} + +%description utils +The zarafa-utils package includes various administration and management +utilities for the Zarafa Open Source Collaboration environment including +reporting, user and password management. + +%package webaccess +Summary: Zarafa Webaccess featuring a 'Look & Feel' similar to Outlook +Group: Applications/Productivity +Requires: httpd, php-mapi = %{version}-%{release} +# Bug: php53 from RHEL 5 does not provide php (#717158) +%if 0%{?rhel} == 5 +Requires: mod_php >= 4.3, php-mcrypt +%else +Requires: php >= 4.3, php-openssl +%endif +%if %{no_bundled_php} +Requires: php-json, php-pear-XML-Serializer +%endif +%if 0%{?rhel}%{?fedora} > 5 +BuildArch: noarch +%endif + +%description webaccess +Zarafa Webaccess features the familiar Outlook 'Look & Feel' interface +and you can keep using the features in Outlook that have always allowed +you to work efficiently. View your e-mail, calendar and contacts via a +web browser. And opening your colleagues calendar or sending a meeting +request is only a piece of cake. The Zarafa Webaccess is using the ajax +technology to give a more interactive feeling to the users. + +%package -n libmapi +Summary: MAPI implementation and library by Zarafa +Group: System Environment/Libraries +Requires: zarafa-client%{?_isa} = %{version}-%{release} +Requires: libvmime(abi) <= 20120406 +Requires(post): /sbin/ldconfig +Requires(postun): /sbin/ldconfig + +%description -n libmapi +The libmapi package provides the Open Source MAPI (Messaging Application +Programming Interface) implementation by Zarafa. The MAPI is a messaging +architecture and a Component Object Model based API for Microsoft Windows +which allows control over the messaging system on the client computer, +creation and management of messages, management of the client mailbox, +service providers, etc. This MAPI implementation by Zarafa is also known +as MAPI4Linux. + +%package -n php-mapi +Summary: The PHP MAPI extension by Zarafa +Group: Development/Languages +# Bug: Without mod_ssl, reloading httpd causes core dump +Requires: mod_ssl +%if 0%{?php_zend_api:1} +Requires: php(zend-abi) = %{php_zend_api}, php(api) = %{php_core_api} +%else +Requires: php-api = %{php_apiver} +%endif + +%description -n php-mapi +The php-mapi package contains the PHP MAPI extension to provide access to +Microsoft MAPI functions while using PHP. Although not all MAPI functions +and interfaces are supported so far, most functions have a PHP counterpart +in this extension. Using this PHP MAPI extension, developers can create +e.g. webbased e-mail and calendaring systems and interfaces with existing +PHP projects, using the MAPI functions like a normal MAPI program. + +%package -n python-MAPI +Summary: The Python MAPI extension by Zarafa +Group: Development/Languages + +%description -n python-MAPI +The python-MAPI package contains the Python MAPI extension to provide the +access to Microsoft MAPI functions while using Python. Using this Python +MAPI extension, developers can create Python programs which use MAPI calls +to interact with Zarafa. + +%prep +%setup -q +%patch0 -p1 -b .rpath +touch -c -r aclocal.m4.rpath aclocal.m4 +%if %{no_bundled_php} +%patch1 -p1 -b .php-unbundle +%endif +%patch2 -p1 -b .kyotocabinet +%patch3 -p1 -b .ssl_protocols_ciphers +%patch4 -p1 -b .ssl_ecdhe +%patch5 -p1 -b .disable_plaintext_auth-localhost +%patch6 -p1 -b .imap-badcharset +%patch7 -p1 -b .imap-fetch-body +%patch8 -p1 -b .vacation-headers +%patch9 -p1 -b .vacation-headers2 +%patch10 -p1 -b .webaccess-fail2ban +%patch11 -p1 -b .webaccess-mcrypt +rm -f php-webclient-ajax/{.,*,*/*}/*.webaccess-* +%patch12 -p1 -b .gsoap-sslv3 +%patch13 -p1 -b .licensed-archiver +%patch14 -p1 -b .upgrade-lock + +%build +%if 0%{?rhel}%{?fedora} < 6 +export CPPFLAGS="$CPPFLAGS -I%{_includedir}/boost141" +export LDFLAGS="$LDFLAGS -L%{_libdir}/boost141" +%endif + +%if %{with_search} && 0%{?rhel}%{?fedora} > 6 +export LDFLAGS="$RPM_LD_FLAGS -L%{_libdir}/clucene09" +%endif + +%configure \ + --with-userscript-prefix=%{_sysconfdir}/%{name}/userscripts \ + --with-quotatemplate-prefix=%{_sysconfdir}/%{name}/quotamail \ + --with-searchscripts-prefix=%{_datadir}/%{name}/searchscripts \ +%if %{with_gsoap} + --with-system-gsoap \ +%endif +%if %{with_search} +%if 0%{?rhel}%{?fedora} > 6 + --with-clucene-lib-prefix=%{_libdir}/clucene09 \ + --with-clucene-include-prefix=%{_includedir}/clucene09 \ +%else + --with-clucene-lib-prefix=%{_libdir} \ + --with-clucene-include-prefix=%{_includedir} \ +%endif +%else + --disable-kyotocabinet \ + --with-clucene-lib-prefix= \ +%endif + --enable-release \ + --enable-epoll \ + --enable-swig \ + --enable-python \ + --disable-static +make %{?_smp_mflags} + +%install +rm -rf $RPM_BUILD_ROOT +make \ +%if 0%{?rhel}%{?fedora} < 6 + docdir=%{_datadir}/doc/%{name}/ \ + datarootdir=%{_datadir} \ +%endif + DESTDIR=$RPM_BUILD_ROOT \ + INSTALL='install -p' \ + install \ + install-ajax-webaccess + +# Nuke all overlefts from licensed, managed or other proprietary items +rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/{%{name}/{license,licensed.cfg,report-ca},cron.daily/%{name}-client-update} +rm -f $RPM_BUILD_ROOT%{_mandir}/man?/{zarafa-{backup,restore,report,msr,msr-verify,ldapms.cfg,{licensed,ws}{,.cfg}},za-{acl{set,sync},restore}}.* + +# Move all the initscripts to their appropriate place and +# ensure that all services are off by default at boot time +rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/init.d/ +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/ +for service in dagent gateway ical search monitor server spooler; do + if [ -f installer/linux/%{name}-$service.init.rhel ]; then + sed -e 's@345@-@' installer/linux/%{name}-$service.init.rhel > \ + $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/%{name}-$service + chmod 755 $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/%{name}-$service + touch -c -r installer/linux/%{name}-$service.init.rhel $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/%{name}-$service + fi +done + +# Move the configuration files to their correct place and handle +# /usr/lib vs. /usr/lib64 for all architectures correct and set +# run_as_user, run_as_group and local_admin_users values correct +for config in $RPM_BUILD_ROOT%{_datadir}/doc/%{name}/example-config/*.cfg; do + config=$(basename $config) + if [ -f $RPM_BUILD_ROOT%{_datadir}/doc/%{name}/example-config/$config ]; then + sed -e 's@\(run_as_\(user\|group\)[[:space:]]*=\).*@\1 %{name}@' -e 's@/usr/lib/zarafa@%{_libdir}/%{name}@' \ + -e 's@\(local_admin_users[[:space:]]*=[[:space:]]*root.*\)@\1 %{name}@' \ + $RPM_BUILD_ROOT%{_datadir}/doc/%{name}/example-config/$config > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/$config + chmod 640 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/$config + touch -c -r $RPM_BUILD_ROOT%{_datadir}/doc/%{name}/example-config/$config $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/$config + fi +done + +# Move the logrotate configuration file to its correct place +install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} +%if 0%{?fedora} >= 16 || 0%{?rhel} >= 7 +sed -e 's/}/\tsu root root\n}/' -i $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} +touch -c -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} +%endif + +# Move the userscripts to their correct place and symlink them +mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}/userscripts/ +for userscript in companies_common.sh groups_common.sh users_common.sh \ + createcompany creategroup createuser deletecompany deletegroup deleteuser; do + mv -f $RPM_BUILD_ROOT{%{_sysconfdir},%{_datadir}}/%{name}/userscripts/$userscript + ln -sf ../../..%{_datadir}/%{name}/userscripts/$userscript $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/userscripts/$userscript +done + +# Create the data directory and install some files into +mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}/ +install -p -m 644 installer/linux/db-{calc-storesize,*attachments*} $RPM_BUILD_ROOT%{_datadir}/%{name}/ +install -p -m 644 installer/linux/{ssl-certificates.sh,audit-parse.pl,zarafa7-upgrade} $RPM_BUILD_ROOT%{_datadir}/%{name}/ +%if %{with_ldap} +install -p -m 644 installer/linux/{db-upgrade-objectsid-to-objectguid,ldap-switch-sendas}.pl $RPM_BUILD_ROOT%{_datadir}/%{name}/ +install -p -m 644 installer/{ldap/%{name}.schema,%{name}.ldif} $RPM_BUILD_ROOT%{_datadir}/%{name}/ +%else +rm -f $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ldap.{active-directory,openldap,propmap}.cfg +rm -f $RPM_BUILD_ROOT%{_mandir}/man5/%{name}-ldap.cfg.5* +%endif + +# Install the script to optimize IMAP headers for new gateway +mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}-gateway/ +install -p -m 644 tools/python-scripts/optimize-imap.py $RPM_BUILD_ROOT%{_datadir}/%{name}-gateway/ + +# Create the default log and lib directories for packaging +mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/{lib/%{name}/{dagent,spooler}/plugins,log/%{name}}/ + +# Remove all libtool .la files to avoid packaging of them +rm -f $RPM_BUILD_ROOT{%{_libdir}/{,php/modules,%{name}},%{python_sitearch}}/*.la + +# Remove files that are anyway in %doc or %{_datadir}/%{name}/ +rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/%{name}{,-gateway}/ + +# Move Indexer/CLucene related files to its correct places +%if %{with_search} +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/searchscripts/ +mv -f $RPM_BUILD_ROOT{%{_datadir},%{_sysconfdir}}/%{name}/searchscripts/attachments_parser.db +for helper in attachments_parser xmltotext.xslt zmktemp; do + ln -s ../../..%{_datadir}/%{name}/searchscripts/$helper $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/searchscripts/$helper +done +%else +rm -f $RPM_BUILD_ROOT{%{_sysconfdir}/{rc.d/init.d,sysconfig},%{_mandir}/man?}/%{name}-search* +rm -rf $RPM_BUILD_ROOT{%{_sysconfdir}/%{name}/search.cfg,%{_datadir}/%{name}/searchscripts/} +%endif + +# Move the webaccess configuration file to its correct place +mv -f $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/webaccess{-ajax,} +rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/config.php +ln -sf ../../..%{_sysconfdir}/%{name}/webaccess/config.php $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/config.php + +# Install the apache configuration file for webaccess +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/ +install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/%{name}-webaccess.conf + +# Move the webaccess plugins directory to its correct place +rm -rf $RPM_BUILD_ROOT{%{_datadir},%{_localstatedir}/lib}/%{name}-webaccess/plugins +mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/plugins/ + +# Remove unwanted language connectors and webaccess files +rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/client/widgets/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.{cfm,pl} +rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/{.htaccess,%{name}-webaccess.conf} + +# Remove flash-based multi-attachment upload (missing source) +%if %{no_multiupload} +sed '148,155d' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/webaccess/config.php > \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/webaccess/config.php.new +touch -c -r $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/webaccess/config.php{,.new} +mv -f $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/webaccess/config.php{.new,} +rm -rf $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/client/widgets/swfupload/ +%endif + +# Remove bundled PHP PEAR files/libraries +%if %{no_bundled_php} +rm -rf $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/server/PEAR +rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}-webaccess/{.,server/core}/*.php-unbundle +%endif + +# Remove files only required by proprietary web services +rm -rf $RPM_BUILD_ROOT{%{_sysconfdir}/%{name}/ws.cfg,%{_datadir}/zarafa/timezones} + +# Rename the PHP config file when needed (PHP 5.6+) +if [ "%{name}.ini" != "%{ini_name}" ]; then + mv -f $RPM_BUILD_ROOT%{_sysconfdir}/php.d/{%{name}.ini,%{ini_name}} +fi + +%find_lang %{name} + +%clean +rm -rf $RPM_BUILD_ROOT + +%pre common +getent group %{name} > /dev/null || %{_sbindir}/groupadd -r %{name} +getent passwd %{name} > /dev/null || %{_sbindir}/useradd -r -g %{name} -d %{_localstatedir}/lib/%{name} -s /sbin/nologin -c "Zarafa Service Account" %{name} +exit 0 + +%post archiver +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/archiver.* > /dev/null 2>&1 || : + +%post dagent +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-dagent +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/dagent.* > /dev/null 2>&1 || : + +%post gateway +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-gateway +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/gateway.* > /dev/null 2>&1 || : + +%post ical +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-ical +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/ical.* > /dev/null 2>&1 || : + +%post monitor +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-monitor +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/monitor.* > /dev/null 2>&1 || : + +%if %{with_search} +%post search +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-search +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/search.* > /dev/null 2>&1 || : +%endif + +%post server +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-server +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/server.* > /dev/null 2>&1 || : +chown %{name}:%{name} %{_localstatedir}/log/%{name}/audit.* > /dev/null 2>&1 || : + +%post spooler +[ $1 -eq 1 ] && /sbin/chkconfig --add %{name}-spooler +# Ensure correct log file ownership after upgrade from official packages +chown %{name}:%{name} %{_localstatedir}/log/%{name}/spooler.* > /dev/null 2>&1 || : + +%post client -p /sbin/ldconfig + +%post -n libmapi -p /sbin/ldconfig + +%preun dagent +if [ $1 -eq 0 ]; then + /sbin/service %{name}-dagent stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-dagent +fi + +%preun gateway +if [ $1 -eq 0 ]; then + /sbin/service %{name}-gateway stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-gateway +fi + +%preun ical +if [ $1 -eq 0 ]; then + /sbin/service %{name}-ical stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-ical +fi + +%preun monitor +if [ $1 -eq 0 ]; then + /sbin/service %{name}-monitor stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-monitor +fi + +%if %{with_search} +%preun search +if [ $1 -eq 0 ]; then + /sbin/service %{name}-search stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-search +fi +%endif + +%preun server +if [ $1 -eq 0 ]; then + /sbin/service %{name}-server stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-server +fi + +%preun spooler +if [ $1 -eq 0 ]; then + /sbin/service %{name}-spooler stop > /dev/null 2>&1 || : + /sbin/chkconfig --del %{name}-spooler +fi + +%postun dagent +if [ $1 -ne 0 ]; then + /sbin/service %{name}-dagent condrestart > /dev/null 2>&1 || : +fi + +%postun gateway +if [ $1 -ne 0 ]; then + /sbin/service %{name}-gateway condrestart > /dev/null 2>&1 || : +fi + +%postun ical +if [ $1 -ne 0 ]; then + /sbin/service %{name}-ical condrestart > /dev/null 2>&1 || : +fi + +%postun monitor +if [ $1 -ne 0 ]; then + /sbin/service %{name}-monitor condrestart > /dev/null 2>&1 || : +fi + +%if %{with_search} +%postun search +if [ $1 -ne 0 ]; then + /sbin/service %{name}-search condrestart > /dev/null 2>&1 || : +fi +%endif + +%postun server +if [ $1 -ne 0 ]; then + /sbin/service %{name}-server condrestart > /dev/null 2>&1 || : +fi + +%postun spooler +if [ $1 -ne 0 ]; then + /sbin/service %{name}-spooler condrestart > /dev/null 2>&1 || : +fi + +%postun client -p /sbin/ldconfig + +%post webaccess +if [ -f %{_sysconfdir}/%{name}/webaccess/config.php ]; then + sed -e "s/\(define('PASSWORD_KEY','\)a75356b0d1b81b7\(');\)/\1$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)\2/" \ + -e "s/\(define('PASSWORD_IV','\)b3f5a483\(');\)/\1$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)\2/" \ + -i %{_sysconfdir}/%{name}/webaccess/config.php +fi + +%postun -n libmapi -p /sbin/ldconfig + +%files +%defattr(-,root,root,-) + +%files archiver +%defattr(-,root,root,-) +%{_bindir}/%{name}-archiver +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/archiver.cfg +%{_mandir}/man1/%{name}-archiver.1* +%{_mandir}/man5/%{name}-archiver.cfg.5* + +%files client -f %{name}.lang +%defattr(-,root,root,-) +%config(noreplace) %{_sysconfdir}/mapi/%{name}.inf +%{_libdir}/libzarafaclient.so +%{_libdir}/libzarafasync.so.* + +%files common +%defattr(-,root,root,-) +%{!?_licensedir:%global license %%doc} +%license installer/licenseagreement/AGPL-3 +%dir %{_sysconfdir}/%{name}/ +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%config(noreplace) %{_sysconfdir}/sysconfig/%{name} +%{_mandir}/man1/%{name}.1* +%dir %{_datadir}/%{name}/ +%dir %attr(0755,%{name},%{name}) %{_localstatedir}/lib/%{name}/ +%dir %attr(0770,root,%{name}) %{_localstatedir}/log/%{name}/ + +%files contacts +%defattr(-,root,root,-) +%config(noreplace) %{_sysconfdir}/mapi/zcontacts.inf +%{_libdir}/libzarafacontacts.so + +%files dagent +%defattr(-,root,root,-) +%doc installer/linux/createuser.dotforward +%{_bindir}/%{name}-autorespond +%{_bindir}/%{name}-dagent +%{_bindir}/%{name}-mr-accept +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/dagent.cfg +%config(noreplace) %{_sysconfdir}/%{name}/autorespond +%{_sysconfdir}/rc.d/init.d/%{name}-dagent +%{_mandir}/man1/%{name}-dagent.1* +%{_mandir}/man1/%{name}-autorespond.1* +%{_mandir}/man5/%{name}-dagent.cfg.5* +%{_datadir}/%{name}-dagent/ +%dir %attr(0755,%{name},%{name}) %{_localstatedir}/lib/%{name}/dagent/ +%dir %attr(0755,%{name},%{name}) %{_localstatedir}/lib/%{name}/dagent/plugins/ + +%files devel +%defattr(-,root,root,-) +%{_libdir}/libarchiver.so +%{_libdir}/libarchiver-core.so +%{_libdir}/libicalmapi.so +%{_libdir}/libinetmapi.so +%{_libdir}/libmapi.so +%{_libdir}/libcommon_mapi.a +%{_libdir}/libcommon_service.a +%{_libdir}/libcommon_ssl.a +%{_libdir}/libcommon_util.a +%{_libdir}/libfreebusy.a +%{_libdir}/libzarafasync.so +%{_includedir}/icalmapi/ +%{_includedir}/inetmapi/ +%{_includedir}/mapi4linux/ +%{_includedir}/libfreebusy/ +%{_includedir}/libzarafasync/ +%{_includedir}/%{name}/ +%{_libdir}/pkgconfig/%{name}.pc + +%files gateway +%defattr(-,root,root,-) +%{_bindir}/%{name}-gateway +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/gateway.cfg +%{_sysconfdir}/rc.d/init.d/%{name}-gateway +%{_datadir}/%{name}-gateway/ +%{_mandir}/man1/%{name}-gateway.1* +%{_mandir}/man5/%{name}-gateway.cfg.5* + +%files ical +%defattr(-,root,root,-) +%{_bindir}/%{name}-ical +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/ical.cfg +%{_sysconfdir}/rc.d/init.d/%{name}-ical +%{_mandir}/man1/%{name}-ical.1* +%{_mandir}/man5/%{name}-ical.cfg.5* + +%files monitor +%defattr(-,root,root,-) +%{_bindir}/%{name}-monitor +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/monitor.cfg +%dir %{_sysconfdir}/%{name}/quotamail/ +%config(noreplace) %{_sysconfdir}/%{name}/quotamail/companywarning.mail +%config(noreplace) %{_sysconfdir}/%{name}/quotamail/userhard.mail +%config(noreplace) %{_sysconfdir}/%{name}/quotamail/usersoft.mail +%config(noreplace) %{_sysconfdir}/%{name}/quotamail/userwarning.mail +%{_sysconfdir}/rc.d/init.d/%{name}-monitor +%{_mandir}/man1/%{name}-monitor.1* +%{_mandir}/man5/%{name}-monitor.cfg.5* + +%if %{with_search} +%files search +%defattr(-,root,root,-) +%{_bindir}/%{name}-search +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/search.cfg +%{_sysconfdir}/rc.d/init.d/%{name}-search +%dir %{_sysconfdir}/%{name}/searchscripts/ +%config(noreplace) %{_sysconfdir}/%{name}/searchscripts/attachments_parser.db +%{_sysconfdir}/%{name}/searchscripts/attachments_parser +%{_sysconfdir}/%{name}/searchscripts/xmltotext.xslt +%{_sysconfdir}/%{name}/searchscripts/zmktemp +%dir %{_datadir}/%{name}/searchscripts/ +%{_datadir}/%{name}/searchscripts/attachments_parser +%{_datadir}/%{name}/searchscripts/xmltotext.xslt +%{_datadir}/%{name}/searchscripts/zmktemp +%{_mandir}/man1/%{name}-search.1* +%{_mandir}/man5/%{name}-search.cfg.5* +%endif + +%files server +%defattr(-,root,root,-) +%{_bindir}/%{name}-server +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/server.cfg +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/unix.cfg +%{_sysconfdir}/rc.d/init.d/%{name}-server +%dir %{_sysconfdir}/%{name}/userscripts/ +%{_sysconfdir}/%{name}/userscripts/createuser +%{_sysconfdir}/%{name}/userscripts/creategroup +%{_sysconfdir}/%{name}/userscripts/createcompany +%{_sysconfdir}/%{name}/userscripts/deleteuser +%{_sysconfdir}/%{name}/userscripts/deletegroup +%{_sysconfdir}/%{name}/userscripts/deletecompany +%{_sysconfdir}/%{name}/userscripts/*common.sh +%dir %{_sysconfdir}/%{name}/userscripts/createuser.d/ +%dir %{_sysconfdir}/%{name}/userscripts/creategroup.d/ +%dir %{_sysconfdir}/%{name}/userscripts/createcompany.d/ +%dir %{_sysconfdir}/%{name}/userscripts/deleteuser.d/ +%dir %{_sysconfdir}/%{name}/userscripts/deletegroup.d/ +%dir %{_sysconfdir}/%{name}/userscripts/deletecompany.d/ +%config(noreplace) %{_sysconfdir}/%{name}/userscripts/createcompany.d/00createpublic +%config(noreplace) %{_sysconfdir}/%{name}/userscripts/createuser.d/00createstore +%{_datadir}/%{name}/userscripts/ +%dir %{_libdir}/%{name}/ +%{_libdir}/%{name}/dbplugin.so +%{_libdir}/%{name}/unixplugin.so +%{_mandir}/man1/%{name}-server.1* +%{_mandir}/man5/%{name}-server.cfg.5* +%{_mandir}/man5/%{name}-unix.cfg.5* +%if %{with_ldap} +%{_datadir}/%{name}/%{name}.schema +%{_datadir}/%{name}/%{name}.ldif +%{_datadir}/%{name}/db-upgrade-objectsid-to-objectguid.pl +%{_datadir}/%{name}/ldap-switch-sendas.pl +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/ldap.active-directory.cfg +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/ldap.openldap.cfg +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/ldap.propmap.cfg +%{_libdir}/%{name}/ldapplugin.so +%{_mandir}/man5/%{name}-ldap.cfg.5* +%endif + +%files spooler +%defattr(-,root,root,-) +%{_bindir}/%{name}-spooler +%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/spooler.cfg +%{_sysconfdir}/rc.d/init.d/%{name}-spooler +%{_mandir}/man1/%{name}-spooler.1* +%{_mandir}/man5/%{name}-spooler.cfg.5* +%{_datadir}/%{name}-spooler/ +%dir %attr(0755,%{name},%{name}) %{_localstatedir}/lib/%{name}/spooler/ +%dir %attr(0755,%{name},%{name}) %{_localstatedir}/lib/%{name}/spooler/plugins/ + +%files utils +%defattr(-,root,root,-) +%{_bindir}/%{name}-admin +%{_bindir}/%{name}-fsck +%{_bindir}/%{name}-mailbox-permissions +%{_bindir}/%{name}-passwd +%{_bindir}/%{name}-set-oof +%{_bindir}/%{name}-stats +%{_datadir}/%{name}/audit-parse.pl +%{_datadir}/%{name}/db-calc-storesize +%{_datadir}/%{name}/db-convert-attachments-to-files +%{_datadir}/%{name}/db-remove-orphaned-attachments +%{_datadir}/%{name}/ssl-certificates.sh +%{_datadir}/%{name}/zarafa7-upgrade +%{_mandir}/man1/%{name}-admin.1* +%{_mandir}/man1/%{name}-fsck.1* +%{_mandir}/man1/%{name}-mailbox-permissions.1* +%{_mandir}/man1/%{name}-passwd.1* +%{_mandir}/man1/%{name}-set-oof.1* +%{_mandir}/man1/%{name}-stats.1* + +%files webaccess +%defattr(-,root,root,-) +%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}-webaccess.conf +%dir %{_sysconfdir}/%{name}/ +%dir %attr(0750,root,apache) %{_sysconfdir}/%{name}/webaccess/ +%config(noreplace) %attr(0640,root,apache) %{_sysconfdir}/%{name}/webaccess/config.php +%{_datadir}/%{name}-webaccess/ +%dir %{_localstatedir}/lib/%{name}-webaccess/ +%dir %attr(0770,root,apache) %{_localstatedir}/lib/%{name}-webaccess/tmp/ + +%files -n libmapi +%defattr(-,root,root,-) +%dir %{_sysconfdir}/mapi/ +%{_libdir}/libarchiver.so.* +%{_libdir}/libarchiver-core.so.* +%{_libdir}/libicalmapi.so.* +%{_libdir}/libinetmapi.so.* +%{_libdir}/libmapi.so.* + +%files -n php-mapi +%defattr(-,root,root,-) +%config(noreplace) %{_sysconfdir}/php.d/%{ini_name} +%config(noreplace) %{_sysconfdir}/%{name}/php-mapi.cfg +%{_datadir}/php/mapi/ +%{_libdir}/php/modules/mapi.so + +%files -n python-MAPI +%defattr(-,root,root,-) +%{python_sitearch}/* + +%changelog +* Mon May 18 2015 Robert Scheck 7.1.12-2 +- Upgrade to 7.1.12 (re-released) +- Backported patch from Zarafa 7.2 to fix CVE-2015-3436 (#1222151) + +* Tue Apr 07 2015 Robert Scheck 7.1.12-1 +- Upgrade to 7.1.12 +- Added multiple minor enhancement and bugfix patches +- Added patch to fix CVE-2014-0103 for PHP < 5.3 (#1073618) +- Handle "su" option in logrotate >= 3.8.0 to avoid errors + +* Sat Oct 25 2014 Kevin Kofler 7.1.11-2 +- Rebuild for reference-counting-enabled clucene09 + +* Wed Oct 15 2014 Robert Scheck 7.1.11-1 +- Upgrade to 7.1.11 (#1139442) +- Removed bundled PHP PEAR files/libraries +- Added patch to allow mitigation of SSLv3/POODLE vulnerability +- Added patch to implement ECDHE support (depending on OpenSSL) +- Added patch to allow plaintext authentication from 127.0.0.1 + +* Tue Aug 26 2014 David Tardon - 7.1.10-5 +- rebuild for ICU 53.1 + +* Mon Aug 25 2014 Robert Scheck 7.1.10-4 +- Fixed multiple incorrect default permissions (#1133439) + +* Mon Aug 18 2014 Fedora Release Engineering - 7.1.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Mon Jul 14 2014 Robert Scheck 7.1.10-3 +- Rebuild for gSOAP 2.8.17 + +* Fri Jul 11 2014 Robert Scheck 7.1.10-2 +- Added a workaround to really support MariaDB (#995870) +- Re-added a patch to allow building without zarafa-search + +* Sun Jun 29 2014 Robert Scheck 7.1.10-1 +- Upgrade to 7.1.10 + +* Fri Jun 20 2014 Remi Collet - 7.1.9-2.1 +- rebuild for https://fedoraproject.org/wiki/Changes/Php56 +- add numerical prefix to extension configuration file + +* Sat Jun 07 2014 Fedora Release Engineering - 7.1.9-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu May 22 2014 Petr Machata - 7.1.9-2 +- Rebuild for boost 1.55.0 + +* Thu May 01 2014 Robert Scheck 7.1.9-1 +- Upgrade to 7.1.9 + +* Fri Feb 21 2014 Robert Scheck 7.1.8-3 +- Upgrade to 7.1.8 (re-released) + +* Fri Feb 14 2014 Parag Nemade - 7.1.8-2 +- Rebuild for icu 52 + +* Thu Jan 30 2014 Robert Scheck 7.1.8-1 +- Upgrade to 7.1.8 (#1056767, #1059903) + +* Sun Dec 08 2013 Robert Scheck 7.1.7-1 +- Upgrade to 7.1.7 (#1008068) +- Added dependency from gateway and spooler to python-MAPI +- Added requirements to virtual libvmime ABI/API provides + +* Mon Aug 05 2013 Robert Scheck 7.1.5-1 +- Upgrade to 7.1.5 (#747241, #863498, #926039, #946900) +- Added configuration compatibility for Apache 2.2 and 2.4 + +* Sun Aug 04 2013 Fedora Release Engineering - 7.1.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Sat Jul 27 2013 Petr Machata - 7.1.4-2 +- Rebuild for boost 1.54.0 + +* Sat May 25 2013 Rex Dieter 7.1.4-2 +- rebuild (libical) + +* Sun Mar 24 2013 Robert Scheck 7.1.4-1 +- Upgrade to 7.1.4 + +* Fri Mar 22 2013 Remi Collet 7.0.13-2 +- rebuild for http://fedoraproject.org/wiki/Features/Php55 + +* Sun Mar 03 2013 Robert Scheck 7.0.13-1 +- Upgrade to 7.0.13 + +* Sun Feb 10 2013 Robert Scheck 7.0.12-1 +- Upgrade to 7.0.12 + +* Sun Feb 10 2013 Denis Arnaud - 7.0.9-3 +- Rebuild for Boost-1.53.0 + +* Fri Feb 01 2013 Parag Nemade - 7.0.9-2 +- Rebuild for icu 50 + +* Mon Aug 13 2012 Robert Scheck 7.0.9-1 +- Upgrade to 7.0.9 (#847534) + +* Sun Aug 12 2012 Rex Dieter 7.0.8-2 +- rebuild (boost) + +* Sun Jul 22 2012 Fedora Release Engineering - 7.0.8-1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Tue Jun 19 2012 Robert Scheck 7.0.8-1 +- Upgrade to 7.0.8 + +* Wed May 09 2012 Robert Scheck 7.0.7-1 +- Upgrade to 7.0.7 + +* Sun Apr 22 2012 Robert Scheck 7.0.6-1 +- Upgrade to 7.0.6 + +* Sat Mar 10 2012 Robert Scheck 7.0.5-1 +- Upgrade to 7.0.5 + +* Tue Feb 28 2012 Fedora Release Engineering - 7.0.4-2 +- Rebuilt for c++ ABI breakage + +* Thu Jan 19 2012 Remi Collet - 7.0.4-2 +- build against php 5.4.0 +- fix so filters + +* Fri Jan 13 2012 Robert Scheck 7.0.4-1 +- Upgrade to 7.0.4 +- Added patch for rebuilding with PHP 5.4 (thanks to Remi Collet) +- Work around crashs by reducing open file descriptors (#760888) + +* Sat Dec 17 2011 Robert Scheck 7.0.3-2 +- Enabled non-optional build of epoll socket handling (#760888) + +* Sun Nov 20 2011 Robert Scheck 7.0.3-1 +- Upgrade to 7.0.3 + +* Sat Oct 01 2011 Robert Scheck 7.0.2-1 +- Upgrade to 7.0.2 (#717968) + +* Sun Aug 14 2011 Robert Scheck 7.0.1-1 +- Upgrade to 7.0.1 (#725250, #725909, #727346) + +* Mon Jun 27 2011 Robert Scheck 7.0.0-1 +- Upgrade to 7.0.0 + +* Tue Jun 14 2011 Robert Scheck 6.40.9-1 +- Upgrade to 6.40.9 + +* Sat May 28 2011 Robert Scheck 6.40.8-1 +- Upgrade to 6.40.8 + +* Wed Apr 06 2011 Robert Scheck 6.40.7-1 +- Upgrade to 6.40.7 + +* Thu Mar 24 2011 Robert Scheck 6.40.6-2 +- Rebuilt for mysql 5.5.10 (soname bump in libmysqlclient) + +* Mon Mar 21 2011 Robert Scheck 6.40.6-1 +- Upgrade to 6.40.6 + +* Sun Feb 27 2011 Robert Scheck 6.40.5-1 +- Upgrade to 6.40.5 + +* Tue Feb 08 2011 Fedora Release Engineering - 6.40.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Sun Dec 12 2010 Robert Scheck 6.40.4-1 +- Upgrade to 6.40.4 + +* Fri Oct 29 2010 Robert Scheck 6.40.3-1 +- Upgrade to 6.40.3 + +* Tue Aug 31 2010 Robert Scheck 6.40.2-1 +- Upgrade to 6.40.2 + +* Mon Aug 09 2010 Robert Scheck 6.40.1-1 +- Upgrade to 6.40.1 + +* Tue Jun 15 2010 Robert Scheck 6.40.0-3 +- Rebuild for perl 5.12.1 + +* Fri Jun 11 2010 Robert Scheck 6.40.0-2 +- Added patch to ensure -pthread for -lclucene configure test + +* Thu Jun 10 2010 Robert Scheck 6.40.0-1 +- Upgrade to 6.40.0 (#564135, #565252, #600993) + +* Sat May 01 2010 Robert Scheck 6.30.14-1 +- Upgrade to 6.30.14 + +* Sun Apr 25 2010 Robert Scheck 6.30.13-1 +- Upgrade to 6.30.13 +- Moved zarafa.schema file from %%doc to %%{_datadir}/%%{name} + +* Sat Mar 20 2010 Robert Scheck 6.30.12-1 +- Upgrade to 6.30.12 + +* Fri Mar 19 2010 Robert Scheck 6.30.11-1 +- Upgrade to 6.30.11 + +* Tue Feb 23 2010 Robert Scheck 6.30.10-2 +- Backported a patch from trunk to avoid the crash of zarafa-server + when creating new user with db or unix plugin (#564282, #567262) +- Backported another patch from trunk to avoid the crash of httpd + caused by PHP mapi.so during the logon in the webaccess (#564129) + +* Sat Feb 06 2010 Robert Scheck 6.30.10-1 +- Upgrade to 6.30.10 (#498194) +- Initial spec file for Fedora and Red Hat Enterprise Linux (thanks + to Jeroen van Meeuwen, John van der Kamp and Steve Hardy)