On 10/13/23 06:55, Arnaud Cordier wrote: Hi Justas, Thank you for your answer. Unfortunately, I already have a dual stack cluster with an IPv6 assigned to the pod: 3: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1430 qdisc noqueue state UP qlen 1000 link/ether c6:90:d2:cf:b8:77 brd ff:ff:ff:ff:ff:ff inet 10.42.4.52/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fd23:23:42:0:251d:192a:bb7f:a1f4/128 scope global valid_lft forever preferred_lft forever inet6 fe80::c490:d2ff:fecf:b877/64 scope link valid_lft forever preferred_lft forever Any additional idea? --- Arnaud Cordier --------------- CryptID Freelance cybersecurity engineer - Pentester - Red teamer Tel: +33 (0)6 61 44 82 04 On 10/12/23 22:54, Justas Umbrasas wrote: Hey,
we are running a similar setup without an issue (not on k8s). I believe the
reason is that the remote dovecot pod is only binding on IPv4 and has no IPv6
configured. This is kind of a hack, however you could try binding the pod to
both IPv4 and IPv6 and see if it works.
Best,
Justas Umbrasas
On 2023-10-12 20:25, Arnaud Cordier via dovecot wrote:
Dear all,
I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot
container is exposed behind a Traefik load-balancer, which acts just
like HAProxy would, using the Proxy Protocol in order to allow
Dovecot to be aware of the real source IP of the client, as follows:
Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot
My setup works well over IPv4.
Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>,
method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21,
mpid=1369531, session=<xxxx>
Howevever, if the client originates from an IPv6 address, Dovecot
does not seem to take the real IPv6 origin into account and fails.
Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected:
Proxied local address is invalid (address=`10.42.4.21',
rip=10.42.4.21)
A network capture shows that the proxy protocol indeed sends the real
IPv6 IP, that should be taken into account by dovecot:
......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993
The error seems to be raised in "core/src/lib-master/master-service-
haproxy.c" line 553:
551 if (net_addr2ip(*fields, &local_ip) < 0 ||
552 local_ip.family != family) {
553 e_error(hpconn->event, "Client
disconnected: "
554 "Proxied local address is
invalid "
555 "(address=`%s', rip=%s)",
str_sanitize(*fields, 64),
556 net_ip2addr(real_remote_ip));
557 return -1;
558 }
559 fields++;
I suppose that the issue is related to the fact that the client
originates from an IPv6 then the reverse proxy forwards the
connection to Dovecot over IPv4, which results in the
"local_ip.family != family" condition to be true.
Why is such a restriction implemented ?
It is to be noted that I implemented the exact same load-balancer
architecture for postfix, which successfully handles an IPv6 real IP
over an IPv4 connection.
I temporarily fixed the issue by setting an IPv4 only DNS record for
my imaps domain name, however, do you think that a fix could be
implemented in Dovecot?
Kind regards,
_______________________________________________
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org
OpenPGP_0xB09B2E1B5DDC756C.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-le...@dovecot.org
