imap proxy and untagged commands

[Maxim Dounin]

Hello!

First of all, thank you for Dovecot!

On Wed, Mar 13, 2013 at 03:53:16PM +0200, Timo Sirainen wrote:

> Hi,
> 
> I noticed that the IMAP proxying code currently doesn't ignore extra
> untagged replies from the backend server. For example this would be a
> valid session:
> 
> S: * OK Server ready
> S: * NO We're having some load issues
> C: a login {4}
> S: * OK foo
> S: + OK
> S: * OK bar
> C: user pass
> S: * OK almost done
> S: a OK logged in
> 
> In real world Dovecot can already send some extra untagged replies if
> there is some trouble (e.g. heavy load) with its authentication process.
> What happens is:
> 
> S: * OK Waiting for authentication process to respond..
> C: a LOGIN {3}
> S: * OK Waiting for authentication process to respond..
> 
> and nginx fails:
> 
> 2013/03/13 15:38:55 [error] 7257#0: *15 upstream sent invalid response:
> "* OK Waiting for authentication process to respond.." while reading
> response from upstream, client: 127.0.0.1, server: 0.0.0.0:10143, login:
> "tss", upstream: 127.0.0.1:143
> 
> I attempted to fix this, but it looks like the current code doesn't make
> this very easy. Especially since it seems to be handling data one "read
> block" at a time, which can contain multiple lines, each of which should
> be handled separately (the untagged and non-untagged replies may arrive
> in the same IP packet).

Yes, thanks, it's a known issue - untagged responses are not 
handled properly (and there is a similar issue with SMTP multiline 
replies, quick and dirty patch at [1]).  This isn't considered as 
a major problem since nginx is expected to work with controlled 
IMAP backends, and it's usually trivial to avoid such untagged 
responses.  It would be good to fix it though.

[1] http://mailman.nginx.org/pipermail/nginx/2010-August/021785.html

-- 
Maxim Dounin
http://nginx.org/en/donation.html