<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Thanks Kees and Maxim, for the patch and the discussion. A very
helpful community!<br>
</p>
<p>This looks like it's working well for my use case for a
tcp465/"ssl on" mail proxy server block. My earlier issues appear
to have (at least partly) been related to STARTTLS with a
tcp587/"starttls only" block that I started my investigations
with...</p>
<p>Once I switched over to the straight SSL block things started
working a lot better. I'll get back to my STARTTLS challenge in a
little bit, unless there's some reason you know of off-hand that
it should act differently?<br>
</p>
The only other thing I've noticed is an inconsistency/typo in the
'set_real_ip_from' directive (as in the documentation section of the
patchset). It looks like it is actually parsed as 'set_realip_from'
(no _ in the realip part). I'm not sure which is the correct form (
:-) ), but the feature works when I use the 'set_realip_from' form ,
so it does differ from the docs...<br>
<br>
Thanks again Kees! Wayde.<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 08/07/2017 09:25 AM, Kees Bos wrote:<br>
</div>
<blockquote type="cite"
cite="mid:1502112324.14660.21.camel@gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div>On ma, 2017-08-07 at 07:49 -0400, Wayde Nie wrote:</div>
<blockquote type="cite"> On 08/07/2017 03:44 AM, Kees Bos wrote:,
and when I do set
<blockquote type="cite"
cite="mid:1502091868.14660.6.camel@gmail.com">
<blockquote type="cite">
<pre wrap="">proxy_protocol
on the listen directive I see the correct ip and port picked up and
logged in the error.log, however, then nginx stops sending the smtp
greeting... My mail client connects to my loadbalancer, the lb
connects
to nginx:587 sending the PROXY line, nginx parses and logs the PROXY
fields, then the client times out waiting for any return traffic
from
nginx... I know it's something I'm doing :-)
I'm happy to keep poking away at it, but curious mostly, if you think
the approach is sound? (ie. use $proxy_protocol_addr, set by
proxy_protocol directive and pass in to auth_http script in auth url
as
a get param?) and if an initial patch that starts by just setting
$proxy_protocol_* variables would be a useful first step in this type
of
functionality?
<blockquote type="cite"><pre wrap="">Just to get the picture right (it looks to me that your downstream smtp
server expects the proxy protocol), what's the exact flow you're trying
to accomplish?</pre>
</blockquote></pre>
</blockquote>
</blockquote>
<br>
Hi Kees,<br>
<br>
Thanks for looking!<br>
<br>
In my use case I have an external hardware loadbalancer that is
receiving end user connections on a VIP, pre-pending
proxy_protocol header and loadbalancing them to small pool of
nginx servers running as the mail proxies. Nginx is parsing the
proxy_protocol header and (I hope) proxying to my upstream smtp
server without passing the proxy_protocol header, which my
upstream smtp server doesn't support (as currently implemented).<br>
<br>
Flow like:<br>
<blockquote>1) Client makes connection to [external-LB-VIP:587]
for email submission<br>
2) [external-LB-VIP:587] --> injects proxy_protocol header
--> load balances to set of nginx services via TCP service
pool (ie: lb straight tcp, no application level inspection by
loadbalancer, other than prepending proxy_protocol header)<br>
3) Nginx parses proxy_protocol header, logs client ip and
passes client IP into auth_http script, along with username
and password for authn/authz<br>
4) on successful return response from auth_http; nginx proxies
mail submission to upstream smtp server without proxy_protocol
header.<br>
</blockquote>
<br>
So, if possible, I'd like nginx to get the client ip passed to
it from the external hardware load balancer, log it and then use
it in the auth_http script, but otherwise not pass it on to the
upstream smtp server...<br>
<br>
Is this doable?<br>
<br>
Thanks,Wayde. <br>
</blockquote>
<div><br>
</div>
<div>Yep. Should be.</div>
<div><br>
</div>
<div>I just noticed that my mail from Jul 20 is emtpy and should
contain the latest patch. I've just sent the patch.</div>
<div><br>
</div>
<div><br>
</div>
<div>In your case, the config should probably be something like:</div>
<div><br>
</div>
<div>
<pre>mail {</pre>
<pre> server_name mail.example.com;</pre>
<pre> auth_http <auth url>;</pre>
<pre>
</pre>
<pre> server {</pre>
<pre> listen 587 proxy_protocol;</pre>
<pre> protocol smtp;</pre>
<pre> set_real_ip_from <external lb ip>;</pre>
<pre> }</pre>
<pre>}</pre>
<div><br>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
nginx-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></pre>
</blockquote>
<br>
</body>
</html>