imap proxy and untagged commands

Maxim Dounin mdounin at
Wed Mar 13 14:48:57 UTC 2013


First of all, thank you for Dovecot!

On Wed, Mar 13, 2013 at 03:53:16PM +0200, Timo Sirainen wrote:

> Hi,
> I noticed that the IMAP proxying code currently doesn't ignore extra
> untagged replies from the backend server. For example this would be a
> valid session:
> S: * OK Server ready
> S: * NO We're having some load issues
> C: a login {4}
> S: * OK foo
> S: + OK
> S: * OK bar
> C: user pass
> S: * OK almost done
> S: a OK logged in
> In real world Dovecot can already send some extra untagged replies if
> there is some trouble (e.g. heavy load) with its authentication process.
> What happens is:
> S: * OK Waiting for authentication process to respond..
> C: a LOGIN {3}
> S: * OK Waiting for authentication process to respond..
> and nginx fails:
> 2013/03/13 15:38:55 [error] 7257#0: *15 upstream sent invalid response:
> "* OK Waiting for authentication process to respond.." while reading
> response from upstream, client:, server:, login:
> "tss", upstream:
> I attempted to fix this, but it looks like the current code doesn't make
> this very easy. Especially since it seems to be handling data one "read
> block" at a time, which can contain multiple lines, each of which should
> be handled separately (the untagged and non-untagged replies may arrive
> in the same IP packet).

Yes, thanks, it's a known issue - untagged responses are not 
handled properly (and there is a similar issue with SMTP multiline 
replies, quick and dirty patch at [1]).  This isn't considered as 
a major problem since nginx is expected to work with controlled 
IMAP backends, and it's usually trivial to avoid such untagged 
responses.  It would be good to fix it though.


Maxim Dounin

More information about the nginx-devel mailing list