Merge ~ericeberry/ubuntu/+source/dovecot:ubuntu/noble-devel into ubuntu/+source/dovecot:ubuntu/noble-devel

[Eric Berry]

[Vladimir Petko (vpa1977)]

Please see https://code.launchpad.net/~ericeberry/ubuntu/+source/dovecot/+git/dovecot/+merge/486602/comments/1345867

review: Needs Fixing

[Eric Berry (ericeberry)]

> Please see https://code.launchpad.net/~ericeberry/ubuntu/+source/dovecot/+git/
> dovecot/+merge/486602/comments/1345867

> Hi,
>
> it looks this the patch is incomplete, the upstream patch also updates salt
> length in `dcrypt_openssl_encrypt_private_key_dovecot` [1].
>
> Some nits:
> - it may be easier for reviewers if you provide a separate patch per upstream
> commit.
> - Description: field should contain a short description, commit message is a
> good canidate: lib-dcrypt: Increase salt to 16 bytes for dovecot v2 keys
> - The long description can expand on that
> - If we adapt upstream patch, we should use backport, url
>
>
>
> [1] https://github.com/dovecot/core/commit/dab49bf12228f382f646329974350cf829f
> cdfcb.diff
> [2] https://dep-team.pages.debian.net/deps/dep3/

There are two versions of the dcrypt-openssl.c file. One version for OpenSSL 1.x and one version for OpenSSL 3.x. The file is renamed to decrypt-openssl.c based on which version of OpenSSL is being used. In our case the decrypt-openssl3.c file is renamed to decrypt-openssl.c and that is the file that is patched.

Your requested changes to the the dep3 header have been incorporated.

Is there any way to speed this process up? This patch has been lingering since May. Getting one line feedback from the ubuntu-sponsors team every two months is not helpful or productive.

[Vladimir Petko (vpa1977)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading dovecot_2.3.21+dfsg1-2ubuntu6.1.dsc: done.
  Uploading dovecot_2.3.21+dfsg1-2ubuntu6.1.debian.tar.xz: done.
  Uploading dovecot_2.3.21+dfsg1-2ubuntu6.1_source.buildinfo: done.
  Uploading dovecot_2.3.21+dfsg1-2ubuntu6.1_source.changes: done.
Successfully uploaded packages.

review: Approve

[Lukas Märdian (slyon)]

Claiming the ~ubuntu-sponsors review slot, to make it disappear from the sponsoring report, as it has already been uploaded.

review: Abstain

diff --git a/debian/changelog b/debian/changelog
index 71c4f34..9e8120c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+dovecot (1:2.3.21+dfsg1-2ubuntu6.1) noble; urgency=medium
+
+  * Update PBKDF2 salt length to be FIPS 140-3 compliant (LP: #2107773).
+
+ -- Eric Berry <[e-mail]>  Fri, 03 Oct 2025 15:37:20 -0700
+
 dovecot (1:2.3.21+dfsg1-2ubuntu6) noble-security; urgency=medium
 
   * Patches for CVE-2024-23184, CVE-2024-23185 (LP: #2077324).
diff --git a/debian/patches/fips-pbkdf2-fix-invalid-salt-length.patch b/debian/patches/fips-pbkdf2-fix-invalid-salt-length.patch
new file mode 100644
index 0000000..bd78661
--- /dev/null
+++ b/debian/patches/fips-pbkdf2-fix-invalid-salt-length.patch
@@ -0,0 +1,125 @@
+Description: lib-dcrypt: Increase salt to 16 bytes for dovecot v2 keys
+ When one enables FIPS mode on a Jammy system and then
+ attempts to use Dovecot to create an encrypted mailbox, the module
+ returns a invalid salt length error. FIPS mode requires a 16 byte
+ salt for PBEKDF2 and Dovecot is only requesting 8 bytes of salt.
+ The solution is to modify Dovecot to request 16 bytes of salt.
+Author: Aki Tuomi <[e-mail]>
+Origin: backport, https://github.com/dovecot/core/compare/5ebc1e3e56024ea2a0925de99edd7fb1e7b652a7%5E...dab49bf12228f382f646329974350cf829fcdfcb
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107773
+
+--- a/src/lib-dcrypt/dcrypt-openssl.c
++++ b/src/lib-dcrypt/dcrypt-openssl.c
+@@ -2181,7 +2181,7 @@
+ 	bool res;
+ 	unsigned char *ptr;
+ 
+-	unsigned char salt[8];
++	unsigned char salt[DCRYPT_DOVECOT_SALT_LEN];
+ 	buffer_t *peer_key = t_buffer_create(128);
+ 	buffer_t *secret = t_buffer_create(128);
+ 	cipher = t_str_lcase(cipher);
+--- a/src/lib-dcrypt/dcrypt-private.h
++++ b/src/lib-dcrypt/dcrypt-private.h
+@@ -8,6 +8,9 @@
+ #define DCRYPT_DOVECOT_KEY_ENCRYPT_PK 1
+ #define DCRYPT_DOVECOT_KEY_ENCRYPT_PASSWORD 2
+ 
++/* Fips requires 16 byte salt */
++#define DCRYPT_DOVECOT_SALT_LEN 16
++
+ struct dcrypt_vfs {
+ 	bool (*initialize)(const struct dcrypt_settings *set,
+ 			   const char **error_r);
+--- a/src/lib-dcrypt/test-crypto.c
++++ b/src/lib-dcrypt/test-crypto.c
+@@ -475,7 +475,13 @@
+ 		"7d945aa6492275a02881071eceec5749caf2485da8c64fb601"
+ 		"229098:ab13d251976dedab546b67354e7678821740dd534b7"
+ 		"49c2857f66bf62bbaddfd:ab13d251976dedab546b67354e76"
+-		"78821740dd534b749c2857f66bf62bbaddfd"
++		"78821740dd534b749c2857f66bf62bbaddfd",
++		"2:1.3.132.0.35:2:aes-256-ctr:cf9951243f5e609a5e20d"
++		"353e4011f62:sha256:2048:0c056337f221f5fd287eb3ef48"
++		"86e596ef3b92e7d33c01a79579b35c8595f8e13cf4bccdb7f5"
++		"409b095be5179bd94668ad88050ff828617ef3415b9e167d22"
++		"e7fd95a3f80b3b:15286fe2a53773c64efa2b8fa79d4cd5b46"
++		"3d422d30bf9103ca97999636e864f",
+ 	};
+ 
+ 	test_begin("test_load_v2_key");
+@@ -519,6 +525,26 @@
+ 	dcrypt_key_unref_private(&priv);
+ 	dcrypt_key_unref_public(&pub);
+ 
++	/* Matches the encrypted private key in index 4 */
++	static const char *pem_key_4 =
++"-----BEGIN PRIVATE KEY-----\n"
++"MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBoC5EFaNm/mWOH9Dp\n"
++"juTNIuRRyKVEFZ0o1R9gPbeza2VvvKYZaIPck2HWEmJGoHOwo+Kc/Fq0Z7ka3Irg\n"
++"o9CfYlihgYkDgYYABAFNIIDZZR3AYzhDsWvG9t3vznEsAtEZ9jjnhs4foSyfkKsq\n"
++"Cj7+CY4JZVhHfjpWpPQ4XFRqZzdyCVCyTegVxONCpgEITkmjCd9z4gndS5+zysw9\n"
++"mG6LOGyxnLz7ZbRqdZ1pqh9+pMk47luCfhGa8RRKjXeJXrU4uE9Uu++fA7zfP95o\n"
++"Ew==\n"
++"-----END PRIVATE KEY-----\n";
++
++	test_assert_idx(dcrypt_key_load_private(&priv,
++		keys[4], "password", NULL, &error), 4);
++	test_assert_idx(dcrypt_key_store_private(priv,
++		DCRYPT_FORMAT_PEM, NULL, tmp,
++		NULL, NULL, &error), 4);
++	test_assert_strcmp_idx(str_c(tmp), pem_key_4, 4);
++	buffer_set_used_size(tmp, 0);
++	dcrypt_key_unref_private(&priv);
++
+ 	buffer_free(&tmp);
+ 
+ 	if (error != NULL) error = NULL;
+@@ -532,24 +558,35 @@
+ 	const char *error;
+ 
+ 	test_begin("test_load_v2_public_key");
+-	const char *key =
++	const char *keys[] = {
+ 		"2:3058301006072a8648ce3d020106052b810400230344000"
+ 		"301c50954e734dd8b410a607764a7057065a45510da52f2c6"
+ 		"e28e0cb353b9c389fa8cb786943ae991fce9befed78fb162f"
+ 		"bbc615415f06af06c8cc80c37f4e94ff6c7:185a721254278"
+ 		"2e239111f9c19d126ad55b18ddaf4883d66afe8d9627c3607"
+-		"d8";
+-
+-	test_assert(dcrypt_key_load_public(&pub, key, &error));
+-
+-	buffer_t *tmp = buffer_create_dynamic(default_pool, 256);
++		"d8",
++		"2:3058301006072a8648ce3d020106052b810400230344000"
++		"301897d80b69ed3eccda4c5a5edc67e9a11ef76c4894710af"
++		"b3deb52e5d996f23b6252d93ab349d1931a234eda9ff7cc40"
++		"095b2b084b86e066839c7de8a08bf5bf46b:0a955323b7c00"
++		"ef44581122c510cbfacfc503aea291b3a3fa2a811356df5be"
++		"cd",
++	};
+ 
+-	if (pub != NULL) {
+-		test_assert(dcrypt_key_store_public(pub,
+-			DCRYPT_FORMAT_DOVECOT, tmp, &error));
+-		test_assert(strcmp(key, str_c(tmp))==0);
+-		buffer_free(&tmp);
+-		dcrypt_key_unref_public(&pub);
++	for (size_t i = 0; i < N_ELEMENTS(keys); i++) {
++		const char *key = keys[i];
++		test_assert_idx(dcrypt_key_load_public(&pub, key, &error), i);
++		test_assert_idx(pub != NULL, i);
++
++		buffer_t *tmp = buffer_create_dynamic(default_pool, 256);
++
++		if (pub != NULL) {
++			test_assert_idx(dcrypt_key_store_public(pub,
++					DCRYPT_FORMAT_DOVECOT, tmp, &error), i);
++			test_assert_strcmp_idx(key, str_c(tmp), i);
++			buffer_free(&tmp);
++			dcrypt_key_unref_public(&pub);
++		}
+ 	}
+ 
+ 	test_end();
diff --git a/debian/patches/series b/debian/patches/series
index dd4a15b..c25f218 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -31,3 +31,4 @@ CVE-2024-23184-5-lib-mail-Add-message_address_parse_full-and-struct-messag.patch
 CVE-2024-23184-6-lib-mail-lib-imap-Optimize-parsing-large-number-of-addres.patch
 CVE-2024-23185-1-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
 CVE-2024-23185-2-lib-mail-message-parser-Limit-headers-total-count-to-50MB.patch
+fips-pbkdf2-fix-invalid-salt-length.patch