Note that there is a separate todo.html with different content than this.
soon - MUST:
- blacklist DigiNotar/Comodo/Türktrust hacks/certs, possibly with Chrome's serial#
list?
- check if wildcards from X.509 are handled as strictly as required by
the RFCs.
- audit if there are further untrusted data report_*() calls.
- Debian Bug #475239, MIME decoder may break up words (need to quote results)
- put bare IP addresses in brackets for SMTP (check if there are RFC
1123/5321/5322 differences)
- Fix further occurrences of SMTP reply code handling:
- for proper smtp_reponse caching of multiline codes (there are some)
- for stomping over control characters.
- check if smtpname and smtpaddress in particular work as advertised,
thread "Fetchmail with Postfix virtual users" around 2009-09-23 on
fetchmail-users@, by Joost Roeleveld and Gerard Seibert.
- virtual domain DOCUMENTATION (rewriting @example.com to
@virtual.example.com possible? Joost Roeleveld, thread "Fetchmail with
Postfix virtual users" around 2009-09-23 on fetchmail-users@).
soon - SHOULD:
- support NIL and strings where they are alternatives to literals
- Debian Bug #531589: fetchmail ignores SIGUSR1 in idle mode.
seems non-trivial to fix: in imap_idle(), we wait for untagged
responses, and may be deep in SSL_peek -- and that restarts the
underlying blocking read() from the socket, so we never break out of
the SSL_peek() with SIGUSR1.
- add repoll for all kinds of auth failures
(requires framework to track which auth failed in auto mode)
- SockOpen sometimes exits with errno == 0, confusing users (found with
Google RealTime on Twitter)
- make sure the man page completely lists all options (f. i. sslcertpath) in
the tables.
- allow \Deleted without \Seen, rf.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466299
- document IMAP4 ACL requirements
- CRYPTO: log configured server name on certificate mismatch (perhaps pay
attention to via entries and stuff like that)
- CRYPTO: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=432618
* write a table of combinations of TLS/SSL options
- add To: header to warning mails (authfail for instance)
- Fix TOCTOU race around prc_filecheck*
- Read CAPABILITY from greeting if present, saves one round trip.
- Check if LAST argument is properly validated against message count.
- add Message-ID: header and other SHOULD headers to warning mails?
- report actual SMTP error with "SMTP listener refused delivery", sugg.
Richard Brooksby, fetchmail-users 2010-04-06.
soon - MAY:
- find a better replacement for sscanf parsing - we don't usually
detect errors in format strings such as "* %d FETCH " because we don't
check if the FETCH is (a) present, (b) consumed.
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471176
=> fetchmail: support utf-8 encoding in log file
Revisit http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=400719
=> syslog messages are localised
http://lists.debian.org/debian-devel/2006/11/msg01068.html
- when logging to syslog, disable locale?
- Get rid of peeking in socket.c? MSG_PEEK seems non-portable.
- revise ticker, and add something like .........20%.... ... 100%
(suggested by Yue Wu)
questionable:
- Convert POP3 UIDs to X-UIDL?
- fetch IMAP message in one go (fetchmail-devel by Adam Simpkins
around Nov 2nd)?
6.4:
- Properly free host/user entries (through C++ class instantiation and destructors...)
- Remove stupid options, such as spambounce, or deferred bounces for anything
but wrong addresses
- Do not ever guess envelope from content headers such as To:/Cc:/Resent-To: or
similar.
- Replace sscanf/fscanf by functions that do range checking
(strtol/strtoul), and make arguments unsigned long.
- drop LAST support
- use PS_PROTOCOL for pre-/post-connect command failures - 6.3 uses
PS_SYNTAX, and that's not necessarily the case. At least if the
command terminates with a signal, we should report PS_PROTOCOL.
- revisit maximum allowed rcfile permissions, fix inconsistency
(silently allowing g+x).
- make UID code more efficient, parsing is O(n^2), should be no worse
than O(n log n), lookup is O(n), should be O(log n).
* Idea for C: use tfind/tsearch. Need to split idlist up
so it only keeps the ids, and use an array to track status.
- help systematic debugging
- by making logging more strict (Postfix's msg_* as example??)
- by adding a --loggingtest or something that emits
a set of test log messages at various severity levels, in order to
make sure people get complete logs.
- by adding messages where fetchmail stuffed its output.
- Debian Bug #454291 fetchmail --quit: should check, that pid file
really contains pid of fetchmail process (Dmitry Nezhevenko)
=> use fcntl() lock?
- feature to skip first N or all messages upon first download, or fetch
last N.
- download onl