I believe I have properly configured nginx v1.24.0 (open source) for
IMAP proxy on FreeBSD 14.0. I am, however, unable to establish a TLS
connection to the upstream server.

I have confirmed that I can connect to the proxy with TLS and that the
auth server is called. The auth server returns the expected Auth-Server
and Auth-Port. The upstream server is on a remote host with Dovecot
running TLS on the standard port of 993. I can see the TCP handshake
between the proxy and Dovecot on both machines, but nginx does not proceed.

It eventually returns "* BAD internal server error" with the error log
indicating a timeout

2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http process
status line
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http process headers
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Server: nginx/1.24.0"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Date: Sat, 06 Jan 2024 18:54:33 GMT"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Connection: close"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Auth-Status: OK"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Auth-Server: 2601:aaaa:bbbb:cccc::1234"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header:
"Auth-Port: 993"
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail auth http header done
2024/01/06 10:54:33 [debug] 6217#100294: *1 event timer del: 11: 43974303
2024/01/06 10:54:33 [debug] 6217#100294: *1 reusable connection: 0
2024/01/06 10:54:33 [debug] 6217#100294: *1 free: 0000167258040800,
unused: 64
2024/01/06 10:54:33 [debug] 6217#100294: *1 posix_memalign:
0000167258041100:256 @16
2024/01/06 10:54:33 [debug] 6217#100294: *1 stream socket 11
2024/01/06 10:54:33 [debug] 6217#100294: *1 connect to
2601:aaaa:bbbb:cccc::1234:993, fd:11 #4
2024/01/06 10:54:33 [debug] 6217#100294: *1 kevent set event: 11: ft:-1
fl:0025
2024/01/06 10:54:33 [debug] 6217#100294: *1 kevent set event: 11: ft:-2
fl:0025
2024/01/06 10:54:33 [debug] 6217#100294: *1 event timer add: 11:
60000:43974303
2024/01/06 10:54:33 [debug] 6217#100294: *1 posix_memalign:
0000167258041200:256 @16
2024/01/06 10:54:33 [debug] 6217#100294: *1 malloc: 0000167258049000:4096
2024/01/06 10:54:33 [debug] 6217#100294: *1 mail proxy write handler
2024/01/06 10:55:33 [debug] 6217#100294: *1 event timer del: 11: 43974303
2024/01/06 10:55:33 [debug] 6217#100294: *1 mail proxy imap auth handler
2024/01/06 10:55:33 [info] 6217#100294: *1 upstream timed out (60:
Operation timed out) while connecting to upstream


I have confirmed using openssl s_client that the connection can be made
from the host running nginx to the host at the expected IP address and port.

Looking at the source, I did not see an option in the auth-header
parsing related to using TLS upstream.

Is there a way to use TLS for the IMAP upstream natively (without
needing to configure a port with STARTTLS)?

TIA,

Jeff


mail {

    error_log /var/log/nginx/error.log debug;

    ssl_certificate path/to/fullchain.pem;
    ssl_certificate_key path/to/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:1m;  # about 4000 sessions
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    # verify chain of trust of OCSP response using Root CA and
Intermediate certs
    ssl_trusted_certificate path/to/fullchain.pem;

    # replace with the IP address of your resolver
    resolver [::1] 127.0.0.1;


    proxy_pass_error_message on;

    server {
        server_name     proxy-name.allycomm.com;
        listen  993 ssl;
        listen  [::]:993 ssl;
        protocol imap;

        auth_http       [::1]:<port>/<path>;

        # From Dovecot (2024-01-04)
        imap_capabilities IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE
IDLE LITERAL+ AUTH=PLAIN;
    }
}





_______________________________________________
nginx mailing list
nginx@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx