Hello!

On Tue, Oct 13, 2020 at 01:08:57PM +0000, Fabian Flückiger wrote:

> I am using NGINX as a mailproxy and recently discovered, that wireshark detects IMAP-LOGIN messages sent by nginx as "Malformed".
>
> The message contains: Line: 3 LOGIN {18}\r\n (HEX: 0000 33 20 4c 4f 47 49 4e 20 7b 31 38 7d 0d 0a)

This certainly isn't malformed (though incomplete). Most likely,
Wireshark fails to recognize IMAP string literal correctly.

> Some imap servers react to this with "BAD UNKNOWN Command" and close the connection.

Define "some imap servers".

> Here the full communication between nginx and backend:
>
> 3 LOGIN {18}
>
> + go ahead
>
> <redacted user> {9}
>
> + go ahead
>
> <redacted pass>
>
> 3 OK LOGIN completed
>
> 4 CAPABILITY
>
>
> BAD UNKNOWN Command
>
>
> any ideas?

The error seems to be returned to the "4 CAPABILITY" command.
This is not a command nginx sends, rather something it proxies
from the client.

Nevertheless, this seems to be incorrect behaviour of the backend
server: the CAPABILITY command looks perfectly valid. Moreover, even
for unrecognized commands correct response would be "* BAD ...",
that is, an untagged response, prefixed with the token "*".

--
Maxim Dounin
http://mdounin.ru/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx