From: Timo Sirainen Date: Thu, 7 May 2026 10:58:24 +0000 (+0000) Subject: [PATCH 5/5] submission-login: submission-proxy - Recognize 421 4.7.0 as connection... X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~18 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e71c3a6b4ff580f1d78654d9f3e29e1f0ea07177;p=dovecot.git [PATCH 5/5] submission-login: submission-proxy - Recognize 421 4.7.0 as connection-limit reply When the backend signals that the user's connection limit has been reached, do not classify the response as a generic temporary authentication failure (which causes the proxy to reconnect). Map it instead to LOGIN_PROXY_FAILURE_TYPE_AUTH_LIMIT_REACHED_REPLIED, which suppresses retries and reports the failure as proxy_dest_connection_limit in the login_aborted event/log line. This mirrors what imap-login does for the [LIMIT] response code and pop3-login for [IN-USE]. Other 421 replies (typically server shutdown / fatal error) are mapped to LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED rather than AUTH_TEMPFAIL: 421 means "closing transmission channel" (RFC 5321 Section 4.2.1), so a reconnect on the same destination is unlikely to help and should not happen automatically. Gbp-Pq: Name 0005-submission-login-submission-proxy-Recognize-421-4.7..patch --- diff --git a/src/submission-login/submission-proxy.c b/src/submission-login/submission-proxy.c index a2b7d2f..6f2c7f4 100644 --- a/src/submission-login/submission-proxy.c +++ b/src/submission-login/submission-proxy.c @@ -694,7 +694,21 @@ int submission_proxy_parse_line(struct client *client, const char *line) be using only Dovecot as their backend :) */ enum login_proxy_failure_type failure_type = LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED; - if ((status / 100) == 4) + if (status == 421) { + /* The backend won't accept further AUTH attempts on this + connection. If it signaled 4.7.0, the user's connection + limit (mail_max_userip_connections) was reached; report + that specifically. Otherwise treat as a generic auth + reply (e.g. backend shutting down). The reply was + prepared from the backend's 421 line; forward it to the + client and detach the AUTH command. */ + failure_type = (null_strcmp(enh_code, "4.7.0") == 0) ? + LOGIN_PROXY_FAILURE_TYPE_AUTH_LIMIT_REACHED_REPLIED : + LOGIN_PROXY_FAILURE_TYPE_AUTH_REPLIED; + i_assert(subm_client->proxy_reply != NULL); + smtp_server_reply_submit(subm_client->proxy_reply); + subm_client->pending_auth = NULL; + } else if ((status / 100) == 4) failure_type = LOGIN_PROXY_FAILURE_TYPE_AUTH_TEMPFAIL; else if (!submission_proxy_handle_redirect( client, status, enh_code, text, &failure_type, &text)) {