Request 3045 (accepted)

roundcubemail.spec Changed

@@ -48,7 +48,7 @@
 %global logdir /var/log/roundcubemail
 %global tmpdir /var/lib/roundcubemail
 
-%global rc_version 1.5.2
+%global rc_version 1.5.3
 %global plugin_version 3.5.11
 %global skin_version 0.5.0
 #%%global rc_rel_suffix rc2.12
@@ -58,7 +58,7 @@
 Name:           roundcubemail
 Version:        %{rc_version}
 
-Release:        3%{?dot_rel_suffix}%{?dist}
+Release:        4%{?dot_rel_suffix}%{?dist}
 
 Summary:        Roundcube Webmail is a browser-based multilingual IMAP client
 
@@ -85,6 +85,12 @@
 
 Patch201:       default-configuration.patch
 Patch202:       roundcubemail-1.4-beta86-plugin-enigma-homedir.patch
+Patch203:       0001-Enigma-WOAT-Support-8626.patch
+Patch204:       0002-Update-changelog.patch
+Patch205:       0003-Introduce-optional-support-to-inject-PROXY-protocol-.patch
+Patch206:       0004-Use-rcube_utils-remote_addr-to-take-HTTP_X_FORWARDED.patch
+Patch207:       0005-Add-a-warning-regarding-implicit-ssl.patch
+Patch208:       0006-CS-fixes-update-changelog.patch
 
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
@@ -95,9 +101,10 @@
 Recommends:     mod_php_any
 %else
 Requires:       webserver
-%if 0%{?plesk} > 0
+%if 0%{?plesk} > 0 && 0%{?rhel} == 7
 # On Plesk we can afford to build with an incompatible php version because we have the plesk supplied php versions
 Requires:       php-common
+Requires:       plesk-php56
 %else
 Requires:       php-common >= 5.5
 %endif
@@ -113,6 +120,13 @@
 Requires:       php-mbstring
 Requires:       php-pear >= 1.9.0
 Requires:       php-xml
+#TODO exclude on plesk?
+%if 0%{?rhel} > 7
+Requires:       php-json
+Requires:       php-ldap
+Requires:       php-kolab
+Requires:       php-kolabformat
+%endif
 
 %if 0%{?rhel} <= 7
 #FIXME keep using mysqlnd, but somehow upgrade and remove the existing roundcube packages
@@ -158,6 +172,8 @@
 Obsoletes:      %{name}-plugin-kolab_chat-skin-elastic-assets <= %{plugin_version}
 Obsoletes:      %{name}-plugin-kolab_config <= %{plugin_version}
 Obsoletes:      %{name}-plugin-kolab_config-assets <= %{plugin_version}
+Obsoletes:      %{name}-plugin-kolab_delegation <= %{plugin_version}
+Obsoletes:      %{name}-plugin-kolab_delegation-assets <= %{plugin_version}
 Obsoletes:      %{name}-plugin-kolab_files <= %{plugin_version}
 Obsoletes:      %{name}-plugin-kolab_files-assets <= %{plugin_version}
 Obsoletes:      %{name}-plugin-kolab_files-skin-elastic <= %{plugin_version}
@@ -225,6 +241,7 @@
 Provides: %{name}-plugin-kolab_activesync = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
 Provides: %{name}-plugin-kolab_addressbook = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
 Provides: %{name}-plugin-kolab_config = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
+Provides: %{name}-plugin-kolab_delegation = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
 Provides: %{name}-plugin-kolab_files = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
 Provides: %{name}-plugin-kolab_folders = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
 Provides: %{name}-plugin-kolab_notes = %{?epoch:%{epoch}:}%{plugin_version}-%{release}
@@ -259,6 +276,8 @@
 Provides: %{name}(skin-plesk) = %{?epoch:%{epoch}:}%{skin_version}-%{release}
 Provides: %{name}-skin-plesk = %{?epoch:%{epoch}:}%{skin_version}-%{release}
 Provides: %{name}-skin-plesk-larry = %{?epoch:%{epoch}:}%{skin_version}-%{release}
+Provides: %{name}(skin-plesk-larry) = %{?epoch:%{epoch}:}%{skin_version}-%{release}
+Provides: %{name}(skin-plesk-larry-assets) = %{?epoch:%{epoch}:}%{skin_version}-%{release}
 %else
 Provides: %{name}-skin-kolab = %{?epoch:%{epoch}:}%{skin_version}-%{release}
 %endif
@@ -300,6 +319,12 @@
 %if 0%{?plesk} < 1
 %patch202 -p1
 %endif
+%patch203 -p1
+%patch204 -p1
+%patch205 -p1
+%patch206 -p1
+%patch207 -p1
+%patch208 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" | while read file; do
@@ -540,8 +565,14 @@
     touch %{_localstatedir}/lib/rpm-state/roundcubemail/httpd.restarted
 fi
 
+%if 0%{?plesk} > 0 && 0%{?rhel} == 7
+php="/opt/plesk/php/5.6/bin/php"
+%else
+php="/usr/bin/php"
+%endif
+
 # Process all sql updates (requires the php-mysqlnd package for the pdo driver for the system php)
-php %{_datadir}/roundcubemail/bin/updatedb.sh \
+%{php} %{_datadir}/roundcubemail/bin/updatedb.sh \
     --dir %{_datadir}/doc/roundcubemail/SQL/ \
     --package roundcube || : \
     >/dev/null 2>&1
@@ -556,7 +587,7 @@
                 fi
             fi
 
-            php %{_datadir}/roundcubemail/bin/updatedb.sh \
+            %{php} %{_datadir}/roundcubemail/bin/updatedb.sh \
                 --dir $dir \
                 --package $(basename ${plugin}) \
                 >/dev/null 2>&1 || :
@@ -602,6 +633,11 @@
 %dir %{_localstatedir}/lib/rpm-state/roundcubemail/
 
 %changelog
+* Wed Aug 3 2022 Christian Mollekopf <mollekopf@apheleia-it.ch> - 1.5.3-1
+- Roundcube 1.5.3
+- WOAT support
+- PROXY protocol support
+
 * Wed Apr 20 2022 Christian Mollekopf <mollekopf@apheleia-it.ch> - 1.5.2-1
 - Roundcube 1.5.2

0001-Enigma-WOAT-Support-8626.patch Added

@@ -0,0 +1,240 @@
+From 4f25da4f006bbf5bec15a88a08dca68df2bebdbe Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <cmollekopf@gmail.com>
+Date: Mon, 1 Aug 2022 11:51:32 +0200
+Subject: PATCH 1/6 Enigma: WOAT Support (#8626)
+
+* Enigma: WOAT Support
+* Fixed public key extraction from dns record
+
+Co-authored-by: Aleksander Machniak <alec@alec.pl>
+Co-authored-by: Christian Mollekopf <mollekopf@apheleia-it.ch>
+---
+ plugins/enigma/config.inc.php.dist      |  5 ++
+ plugins/enigma/lib/enigma_engine.php    | 93 +++++++++++++++++++++++--
+ plugins/enigma/lib/enigma_subkey.php    | 12 +++-
+ program/lib/Roundcube/rcube_message.php | 10 +--
+ 4 files changed, 108 insertions(+), 12 deletions(-)
+
+diff --git a/plugins/enigma/config.inc.php.dist b/plugins/enigma/config.inc.php.dist
+index a5a5233c2..d654c764d 100644
+--- a/plugins/enigma/config.inc.php.dist
++++ b/plugins/enigma/config.inc.php.dist
+@@ -78,3 +78,8 @@ $config'enigma_passwordless' = false;
+ //     - enigma_options_lock = 'sign'
+ //     - dont_override       = 'enigma_sign_all'
+ $config'enigma_options_lock' = ;
++
++// Enable Kolab's Web Of Anti-Trust feature
++// Fetches public keys from DNS. Default: false
++// To enable set it to True or an array of domain names.
++$config'enigma_woat' = false;
+diff --git a/plugins/enigma/lib/enigma_engine.php b/plugins/enigma/lib/enigma_engine.php
+index 113030db1..1717d41da 100644
+--- a/plugins/enigma/lib/enigma_engine.php
++++ b/plugins/enigma/lib/enigma_engine.php
+@@ -28,6 +28,7 @@ class enigma_engine
+     private $pgp_driver;
+     private $smime_driver;
+     private $password_time;
++    private $sender;
+     private $cache = ;
+ 
+     public $decryptions     = ;
+@@ -272,6 +273,9 @@ class enigma_engine
+ 
+         $recipients = array_unique($recipients);
+ 
++        // Fetch keys from external sources, if configured
++        $this->sync_keys($recipients);
++
+         // find recipient public keys
+         foreach ((array) $recipients as $email) {
+             if ($email == $from && $sign_key) {
+@@ -380,6 +384,17 @@ class enigma_engine
+             return;
+         }
+ 
++        // Get the message/part sender
++        if (!empty($p'object'->sender) && !empty($p'object'->sender'mailto')) {
++            $this->sender = $p'object'->sender'mailto';
++        }
++        if (!empty($p'structure'->headers) && !empty($p'structure'->headers'from')) {
++            $from = rcube_mime::decode_address_list($p'structure'->headers'from', 1, false);
++            if (($from = current($from)) && !empty($from'mailto')) {
++                $this->sender = $from'mailto';
++            }
++        }
++
+         // Don't be tempted to support encryption in text/html parts
+         // Because of EFAIL vulnerability we should never support this (#6289)
+ 
+@@ -881,6 +896,11 @@ class enigma_engine
+     {
+         // @TODO: Handle big bodies using (temp) files
+ 
++        // Import sender's key from external sources, if configured
++        if ($this->sender) {
++            $this->sync_keys($this->sender);
++        }
++
+         // Get rid of possible non-ascii characters (#5962)
+         $sig_body = preg_replace('/^\x00-\x7F/', '', $sig_body);
+ 
+@@ -905,6 +925,11 @@ class enigma_engine
+     {
+         // @TODO: Handle big bodies using (temp) files
+ 
++        // Import sender's key from external sources, if configured
++        if ($this->sender) {
++            $this->sync_keys($this->sender);
++        }
++
+         // Get rid of possible non-ascii characters (#5962)
+         $msg_body = preg_replace('/^\x00-\x7F/', '', $msg_body);
+ 
+@@ -1020,19 +1045,25 @@ class enigma_engine
+             return;
+         }
+ 
+-        $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
+-        $ret  = null;
++        $mode  = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
++        $found = ;
+ 
+         // check key validity and type
+         foreach ($result as $key) {
+             if (($subkey = $key->find_subkey($email, $mode))
+                 && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
+             ) {
+-                $ret = $key;
+-                break;
++                $found$subkey->get_creation_date(true) = $key;
+             }
+         }
+ 
++        // Use the most recent one
++        if (count($found) > 1) {
++            ksort($found, SORT_NUMERIC);
++        }
++
++        $ret = count($found) > 0 ? array_pop($found) : null;
++
+         // cache private key info for better performance
+         // we can skip one list_keys() call when signing and attaching a key
+         if ($can_sign) {
+@@ -1442,4 +1473,58 @@ class enigma_engine
+             );
+         }
+     }
++
++    /**
++     * Import public keys from DNS according to Kolab Web-Of-Anti-Trust
++     *
++     * @param array $recipients List of email addresses
++     */
++    protected function sync_keys($recipients)
++    {
++        $import = ;
++        $woat = $this->rc->config->get('enigma_woat');
++
++        if (empty($woat)) {
++            return;
++        }
++
++        foreach ($recipients as $recipient) {
++            if (!strpos($recipient, '@')) {
++                continue;
++            }
++
++            list($local, $domain) = explode('@', $recipient);
++
++            // Do this for configured domains only
++            if (is_array($woat) && !in_array_nocase($domain, $woat)) {
++                continue;
++            }
++
++            // remove parts behind a recipient delimiter ("jeroen+Trash" => "jeroen")
++            $local = preg_replace('/\+.*$/', '', $local);
++
++            $fqdn = sha1($local) . '._woat.' . $domain;
++
++            // Fetch the TXT record(s)
++            if (($records = dns_get_record($fqdn, DNS_TXT)) === false) {
++                continue;
++            }
++
++            foreach ($records as $record) {
++                if (strpos($record'txt', 'v=woat1,') === 0) {
++                    $entry = explode('public_key=', $record'txt');
++                    if (count($entry) == 2) {
++                        $import = $entry1;
++                        // For now we support only one key
++                        break;
++                    }
++                }
++            }
++        }
++
++        // Import the fetched keys
++        if (!empty($import)) {
++            $this->import_key(implode("\n", $import));
++        }
++    }
+ }
+diff --git a/plugins/enigma/lib/enigma_subkey.php b/plugins/enigma/lib/enigma_subkey.php
+index ffdb3e8ce..014ab7de3 100644
+--- a/plugins/enigma/lib/enigma_subkey.php
++++ b/plugins/enigma/lib/enigma_subkey.php
+@@ -93,12 +93,18 @@ class enigma_subkey
+     /**
+      * Returns subkey creation date-time string
+      *
+-     * @return string|null
++     * @param bool $asInt Return the date as an integer
++     *
++     * @return string|null|int
+      */
+-    function get_creation_date()
++    function get_creation_date($asInt = false)
+     {
+         if (empty($this->created)) {
+-            return null;
++            return $asInt ? 0 : null;
++        }
++
++        if ($asInt) {
++            return (int) $this->created->format('U');
+         }
+ 
+         $date_format = rcube::get_instance()->config->get('date_format', 'Y-m-d');
+diff --git a/program/lib/Roundcube/rcube_message.php b/program/lib/Roundcube/rcube_message.php
+index e81df1b2f..7a2f7d96a 100644
+--- a/program/lib/Roundcube/rcube_message.php
++++ b/program/lib/Roundcube/rcube_message.php
+@@ -126,6 +126,11 @@ class rcube_message
+             )
+         ;
+ 
++        $this->mime    = new rcube_mime($this->headers->charset);
++        $this->subject = str_replace("\n", '', $this->headers->get('subject'));
++        $from          = $this->mime->decode_address_list($this->headers->from, 1);
++        $this->sender  = current($from);
++
+         if (!empty($this->headers->structure)) {
+             $this->get_mime_numbers($this->headers->structure);
+             $this->parse_structure($this->headers->structure);
+@@ -134,11 +139,6 @@ class rcube_message
+             $this->body = $this->storage->get_body($uid);
+         }
+ 
+-        $this->mime    = new rcube_mime($this->headers->charset);
+-        $this->subject = str_replace("\n", '', $this->headers->get('subject'));
+-        $from          = $this->mime->decode_address_list($this->headers->from, 1);
+-        $this->sender  = current($from);
+-
+         // notify plugins and let them analyze this structured message object
+         $this->app->plugins->exec_hook('message_load', 'object' => $this);
+     }
+-- 
+2.37.1
+

0002-Update-changelog.patch Added

0003-Introduce-optional-support-to-inject-PROXY-protocol-.patch Added

@@ -0,0 +1,153 @@
+From 70e23efafae75b5604fd5206e64571cee59ba71a Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 14 Jul 2022 15:04:16 +0200
+Subject: PATCH 3/6 Introduce optional support to inject PROXY protocol
+ headers after opening IMAP TCP streams.
+
+Version 1 (text based) and version 2 (binary) protocol header types are
+supported. Supports both IPv4 and IPv6 style headers.
+
+http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+---
+ config/defaults.inc.php                      | 10 +++
+ program/lib/Roundcube/rcube_imap_generic.php |  8 ++
+ program/lib/Roundcube/rcube_utils.php        | 79 ++++++++++++++++++++
+ 3 files changed, 97 insertions(+)
+
+diff --git a/config/defaults.inc.php b/config/defaults.inc.php
+index 018ad9af3..a6cd3b9a5 100644
+--- a/config/defaults.inc.php
++++ b/config/defaults.inc.php
+@@ -157,12 +157,22 @@ $config'imap_auth_type' = null;
+ // IMAP socket context options
+ // See http://php.net/manual/en/context.ssl.php
+ // The example below enables server certificate validation
++//
++// proxy_protocol is used to inject HAproxy style headers in the TCP stream
++// See http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+ //$config'imap_conn_options' = 
+ //  'ssl'         => 
+ //     'verify_peer'  => true,
+ //     'verify_depth' => 3,
+ //     'cafile'       => '/etc/openssl/certs/ca.crt',
+ //   ,
++//  'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
++//       'version'       => 1 | 2, // required, if array
++//       'remote_addr'   => $_SERVER'REMOTE_ADDR',
++//       'remote_port'   => $_SERVER'REMOTE_PORT',
++//       'local_addr'    => $_SERVER'SERVER_ADDR',
++//       'local_port'    => $_SERVER'SERVER_PORT',
++//   ,
+ // ;
+ // Note: These can be also specified as an array of options indexed by hostname
+ $config'imap_conn_options' = null;
+diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
+index 8f1285368..d2f5cf410 100644
+--- a/program/lib/Roundcube/rcube_imap_generic.php
++++ b/program/lib/Roundcube/rcube_imap_generic.php
+@@ -1070,6 +1070,14 @@ class rcube_imap_generic
+             return false;
+         }
+ 
++        // insert proxy protocol header, if enabled
++        if (!empty($this->prefs'socket_options')) {
++            $proxy_protocol_header = rcube_utils::proxy_protocol_header($this->prefs'socket_options', $this->fp);
++            if (strlen($proxy_protocol_header) > 0) {
++                fwrite($this->fp, $proxy_protocol_header);
++            }
++        }
++        
+         if ($this->prefs'timeout' > 0) {
+             stream_set_timeout($this->fp, $this->prefs'timeout');
+         }
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index eb51f98ed..ec31fa11b 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1645,4 +1645,83 @@ class rcube_utils
+ 
+         return trim($subject);
+     }
++
++    /**
++     * When proxy_protocol is configured for a connection type,
++     * generate the HAproxy style PROXY protocol header for injection
++     * into the TCP stream.
++     * http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
++     * 
++     * PROXY protocol headers must be sent before any other data is sent on the TCP socket.
++     *
++     * @param array $conn_options preferences array which may contain proxy_protocol (generally {driver}_conn_options)
++     *
++     * @return string proxy protocol header data, if enabled, otherwise empty string
++     */
++    public static function proxy_protocol_header($conn_options = null)
++    {
++        if ($conn_options === null)
++        {
++            return "";
++        }
++        // verify that proxy_protocol option is present
++        if (is_array($conn_options) && array_key_exists('proxy_protocol', $conn_options)) {
++            if (is_array($conn_options'proxy_protocol')) {
++                $proxy_protocol_version = $conn_options'proxy_protocol''version';
++                $proxy_protocol_options = $conn_options'proxy_protocol';
++            }
++            else {
++                $proxy_protocol_version = $conn_options'proxy_protocol';
++                $proxy_protocol_options = null;
++            }
++
++            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : $_SERVER'REMOTE_ADDR' );
++            $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
++            $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
++            $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
++            $proxy_protocol_ip_version = (strpos($proxy_protocol_remote_addr, ":") === false ? 4 : 6);
++
++            if ($proxy_protocol_version === 1) {
++                // text based PROXY protocol
++
++                // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
++                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_remote_addr, ".") !== false) {
++                    $proxy_protocol_remote_addr = inet_ntop(inet_pton($proxy_protocol_remote_addr));
++                }
++                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_local_addr, ".") !== false) {
++                    $proxy_protocol_local_addr = inet_ntop(inet_pton($proxy_protocol_local_addr));
++                }
++
++                $proxy_protocol_text = "PROXY " . // protocol header
++                    ($proxy_protocol_ip_version === 6 ? "TCP6 " : "TCP4 ") . // IP version type
++                    $proxy_protocol_remote_addr .
++                    " " .
++                    $proxy_protocol_local_addr .
++                    " " .
++                    $proxy_protocol_remote_port .
++                    " " .
++                    $proxy_protocol_local_port .
++                    "\r\n";
++                return $proxy_protocol_text;
++            }
++            else if ($proxy_protocol_version === 2) {
++                // binary PROXY protocol
++                $proxy_protocol_bin = pack("H*", "0D0A0D0A000D0A515549540A" . // protocol header
++                    "21" . // protocol version and command
++                    ($proxy_protocol_ip_version === 6 ? "2" : "1") . // IP version type
++                    "1"); // TCP
++                $proxy_protocol_addr = inet_pton($proxy_protocol_remote_addr) .
++                    inet_pton($proxy_protocol_local_addr) .
++                    pack("n", $proxy_protocol_remote_port) .
++                    pack("n", $proxy_protocol_local_port);
++                $proxy_protocol_bin .= pack("n", strlen($proxy_protocol_addr)) . $proxy_protocol_addr;
++                return $proxy_protocol_bin;
++            }
++            else {
++                // unknown proxy protocol version
++                return "";
++            }
++        }
++        return "";
++    }
+ }
+-- 
+2.37.1
+

0004-Use-rcube_utils-remote_addr-to-take-HTTP_X_FORWARDED.patch Added

@@ -0,0 +1,26 @@
+From 9616178e5d8a62dca3cc77c1a287a29460530fe6 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 21 Jul 2022 20:16:11 +0200
+Subject: PATCH 4/6 Use rcube_utils::remote_addr() to take
+ HTTP_X_FORWARDED_FOR into account
+
+---
+ program/lib/Roundcube/rcube_utils.php | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index ec31fa11b..49eb1c06e 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1675,7 +1675,7 @@ class rcube_utils
+                 $proxy_protocol_options = null;
+             }
+ 
+-            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : $_SERVER'REMOTE_ADDR' );
++            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : self::remote_addr() );
+             $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
+             $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
+             $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
+-- 
+2.37.1
+

0005-Add-a-warning-regarding-implicit-ssl.patch Added

0006-CS-fixes-update-changelog.patch Added

@@ -0,0 +1,195 @@
+From b5b2e2043be22105987b369c935b259ea4421c73 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Mon, 1 Aug 2022 12:25:00 +0200
+Subject: PATCH 6/6 CS fixes, update changelog
+
+---
+ CHANGELOG.md                          |   1 +
+ config/defaults.inc.php               |  26 +++---
+ program/lib/Roundcube/rcube_utils.php | 109 +++++++++++---------------
+ 3 files changed, 60 insertions(+), 76 deletions(-)
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index da04ede39..81c5d3572 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -2,6 +2,7 @@
+ 
+ ## Release 1.5.3
+ 
++- Support for HAproxy protocol header in IMAP connections (#8625)
+ - Enigma: Support Kolab's Web Of Anti-Trust feature (#8626)
+ - Enigma: Fix initial synchronization of private keys
+ - Enigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments (#8413)
+diff --git a/config/defaults.inc.php b/config/defaults.inc.php
+index b25b419bf..ae1d1862d 100644
+--- a/config/defaults.inc.php
++++ b/config/defaults.inc.php
+@@ -163,19 +163,19 @@ $config'imap_auth_type' = null;
+ // WARNING: Please note this is currently incompatible with implicit ssl,
+ // since the proxy protocol preamble is expected before the ssl handshake.
+ //$config'imap_conn_options' = 
+-//  'ssl'         => 
+-//     'verify_peer'  => true,
+-//     'verify_depth' => 3,
+-//     'cafile'       => '/etc/openssl/certs/ca.crt',
+-//   ,
+-//  'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
+-//       'version'       => 1 | 2, // required, if array
+-//       'remote_addr'   => $_SERVER'REMOTE_ADDR',
+-//       'remote_port'   => $_SERVER'REMOTE_PORT',
+-//       'local_addr'    => $_SERVER'SERVER_ADDR',
+-//       'local_port'    => $_SERVER'SERVER_PORT',
+-//   ,
+-// ;
++//    'ssl' => 
++//        'verify_peer'  => true,
++//        'verify_depth' => 3,
++//        'cafile'       => '/etc/openssl/certs/ca.crt',
++//    ,
++//    'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
++//        'version'       => 1 | 2, // required, if array
++//        'remote_addr'   => $_SERVER'REMOTE_ADDR', // optional
++//        'remote_port'   => $_SERVER'REMOTE_PORT', // optional
++//        'local_addr'    => $_SERVER'SERVER_ADDR', // optional
++//        'local_port'    => $_SERVER'SERVER_PORT', // optional
++//    ,
++//;
+ // Note: These can be also specified as an array of options indexed by hostname
+ $config'imap_conn_options' = null;
+ 
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 49eb1c06e..392c338c0 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1647,81 +1647,64 @@ class rcube_utils
+     }
+ 
+     /**
+-     * When proxy_protocol is configured for a connection type,
+-     * generate the HAproxy style PROXY protocol header for injection
+-     * into the TCP stream.
++     * Generates the HAproxy style PROXY protocol header for injection
++     * into the TCP stream, if configured.
++     *
+      * http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+      * 
+      * PROXY protocol headers must be sent before any other data is sent on the TCP socket.
+      *
+-     * @param array $conn_options preferences array which may contain proxy_protocol (generally {driver}_conn_options)
++     * @param array $options Preferences array which may contain proxy_protocol (generally {driver}_conn_options)
+      *
+-     * @return string proxy protocol header data, if enabled, otherwise empty string
++     * @return string Proxy protocol header data, if enabled, otherwise empty string
+      */
+-    public static function proxy_protocol_header($conn_options = null)
++    public static function proxy_protocol_header($options = null)
+     {
+-        if ($conn_options === null)
+-        {
+-            return "";
+-        }
+-        // verify that proxy_protocol option is present
+-        if (is_array($conn_options) && array_key_exists('proxy_protocol', $conn_options)) {
+-            if (is_array($conn_options'proxy_protocol')) {
+-                $proxy_protocol_version = $conn_options'proxy_protocol''version';
+-                $proxy_protocol_options = $conn_options'proxy_protocol';
+-            }
+-            else {
+-                $proxy_protocol_version = $conn_options'proxy_protocol';
+-                $proxy_protocol_options = null;
+-            }
+-
+-            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : self::remote_addr() );
+-            $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
+-            $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
+-            $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
+-            $proxy_protocol_ip_version = (strpos($proxy_protocol_remote_addr, ":") === false ? 4 : 6);
++        if (empty($options) || !is_array($options) || !array_key_exists('proxy_protocol', $options)) {
++            return '';
++        }
+ 
+-            if ($proxy_protocol_version === 1) {
+-                // text based PROXY protocol
++        if (is_array($options'proxy_protocol')) {
++            $version = $options'proxy_protocol''version';
++            $options = $options'proxy_protocol';
++        }
++        else {
++            $version = (int) $options'proxy_protocol';
++            $options = ;
++        }
+ 
+-                // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
+-                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_remote_addr, ".") !== false) {
+-                    $proxy_protocol_remote_addr = inet_ntop(inet_pton($proxy_protocol_remote_addr));
+-                }
+-                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_local_addr, ".") !== false) {
+-                    $proxy_protocol_local_addr = inet_ntop(inet_pton($proxy_protocol_local_addr));
+-                }
++        $remote_addr = array_key_exists('remote_addr', $options) ? $options'remote_addr' : self::remote_addr();
++        $remote_port = array_key_exists('remote_port', $options) ? $options'remote_port' : $_SERVER'REMOTE_PORT';
++        $local_addr  = array_key_exists('local_addr', $options) ? $options'local_addr' : $_SERVER'SERVER_ADDR';
++        $local_port  = array_key_exists('local_port', $options) ? $options'local_port' : $_SERVER'SERVER_PORT';
++        $ip_version  = strpos($remote_addr, ':') === false ? 4 : 6;
+ 
+-                $proxy_protocol_text = "PROXY " . // protocol header
+-                    ($proxy_protocol_ip_version === 6 ? "TCP6 " : "TCP4 ") . // IP version type
+-                    $proxy_protocol_remote_addr .
+-                    " " .
+-                    $proxy_protocol_local_addr .
+-                    " " .
+-                    $proxy_protocol_remote_port .
+-                    " " .
+-                    $proxy_protocol_local_port .
+-                    "\r\n";
+-                return $proxy_protocol_text;
++        // Text based PROXY protocol
++        if ($version == 1) {
++            // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
++            if ($ip_version === 6 && strpos($remote_addr, '.') !== false) {
++                $remote_addr = inet_ntop(inet_pton($remote_addr));
+             }
+-            else if ($proxy_protocol_version === 2) {
+-                // binary PROXY protocol
+-                $proxy_protocol_bin = pack("H*", "0D0A0D0A000D0A515549540A" . // protocol header
+-                    "21" . // protocol version and command
+-                    ($proxy_protocol_ip_version === 6 ? "2" : "1") . // IP version type
+-                    "1"); // TCP
+-                $proxy_protocol_addr = inet_pton($proxy_protocol_remote_addr) .
+-                    inet_pton($proxy_protocol_local_addr) .
+-                    pack("n", $proxy_protocol_remote_port) .
+-                    pack("n", $proxy_protocol_local_port);
+-                $proxy_protocol_bin .= pack("n", strlen($proxy_protocol_addr)) . $proxy_protocol_addr;
+-                return $proxy_protocol_bin;
+-            }
+-            else {
+-                // unknown proxy protocol version
+-                return "";
++            if ($ip_version === 6 && strpos($local_addr, '.') !== false) {
++                $local_addr = inet_ntop(inet_pton($local_addr));
+             }
++
++            return "PROXY TCP{$ip_version} {$remote_addr} {$local_addr} {$remote_port} {$local_port}\r\n";
+         }
+-        return "";
++
++        // Binary PROXY protocol
++        if ($version == 2) {
++            $addr = inet_pton($remote_addr) . inet_pton($local_addr) . pack('n', $remote_port) . pack('n', $local_port);
++            $head = implode(
++                    '0D0A0D0A000D0A515549540A',     // protocol header
++                    '21',                           // protocol version and command
++                    $ip_version === 6 ? '2' : '1',  // IP version type
++                    '1'                             // TCP
++            );
++
++            return pack('H*', $head) . pack('n', strlen($addr)) . $addr;
++        }
++
++        return '';
+     }
+ }
+-- 
+2.37.1
+

buildroundcubemailtarball.config Added

buildroundcubemailtarball.sh Changed

debian.changelog Changed

debian.series Changed

roundcubemail-1.5.2.tar.gz -> roundcubemail-1.5.3.tar.gz Changed

roundcubemail.dsc Changed

Overview

Request 3045 (accepted)

Request History