[PATCH 5/5] submission-login: submission-proxy - Recognize 421 4.7.0 as connection...

When the backend signals that the user's connection limit has been
reached, do not classify the response as a generic temporary
authentication failure (which causes the proxy to reconnect). Map it
instead to LOGIN_PROXY_FAILURE_TYPE_AUTH_LIMIT_REACHED_REPLIED, which
suppresses retries and reports the failure as proxy_dest_connection_limit
in the login_aborted event/log line. This mirrors what imap-login does
for the [LIMIT] response code and pop3-login for [IN-USE].

Other 421 replies (typically server shutdown / fatal error) are mapped
to LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED rather than AUTH_TEMPFAIL: 421
means "closing transmission channel" (RFC 5321 Section 4.2.1), so a
reconnect on the same destination is unlikely to help and should not
happen automatically.

Gbp-Pq: Name 0005-submission-login-submission-proxy-Recognize-421-4.7..patch

diff --git a/src/submission-login/submission-proxy.c b/src/submission-login/submission-proxy.c
index a2b7d2ff423ee987e056e3e2458440703dd813a5..6f2c7f436a4b13e4c3ec960f1d392d920cd085e5 100644 (file)
--- a/src/submission-login/submission-proxy.c
+++ b/src/submission-login/submission-proxy.c
@@ -694,7 +694,21 @@ int submission_proxy_parse_line(struct client *client, const char *line)
           be using only Dovecot as their backend :) */
        enum login_proxy_failure_type failure_type =
                LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED;
-       if ((status / 100) == 4)
+       if (status == 421) {
+               /* The backend won't accept further AUTH attempts on this
+                  connection. If it signaled 4.7.0, the user's connection
+                  limit (mail_max_userip_connections) was reached; report
+                  that specifically. Otherwise treat as a generic auth
+                  reply (e.g. backend shutting down). The reply was
+                  prepared from the backend's 421 line; forward it to the
+                  client and detach the AUTH command. */
+               failure_type = (null_strcmp(enh_code, "4.7.0") == 0) ?
+                       LOGIN_PROXY_FAILURE_TYPE_AUTH_LIMIT_REACHED_REPLIED :
+                       LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED;
+               i_assert(subm_client->proxy_reply != NULL);
+               smtp_server_reply_submit(subm_client->proxy_reply);
+               subm_client->pending_auth = NULL;
+       } else if ((status / 100) == 4)
                failure_type = LOGIN_PROXY_FAILURE_TYPE_AUTH_TEMPFAIL;
        else if (!submission_proxy_handle_redirect(
                        client, status, enh_code, text, &failure_type, &text)) {