MBOX-Line: From tss at iki.fi  Sun Jun  1 12:20:43 2008
To: imap-protocol@u.washington.edu
From: Timo Sirainen <tss@iki.fi>
Date: Fri Jun  8 12:34:41 2018
Subject: [Imap-protocol] Proxy IP forwarding
In-Reply-To: <0i/azqanypELGcsgZG99yw.md5@lochnagar.oryx.com>
References: <1212341451.3904.500.camel@hurina>
	<0i/azqanypELGcsgZG99yw.md5@lochnagar.oryx.com>
Message-ID: <1212348043.3904.521.camel@hurina>

On Sun, 2008-06-01 at 20:45 +0200, Arnt Gulbrandsen wrote:
> Timo Sirainen writes:
> > Has anyone implemented some kind of a IP forwarding extension? So 
> > backend servers could see the original IPs instead of the proxy's. So 
> > login would go something like:
> >
> > 1 XFORWARD lip 1.2.3.4 lport 143 rip 4.5.6.7 rport 35353
> > 2 LOGIN user pass
> 
> Login referrals? 

No, not what I meant.

> Cyrus Murder?

Maybe. I tried to look into the Cyrus code but I couldn't find what
commands it uses.

> > I guess I could just implement it like that, but at least trying to be
> > interoperable with another implementation would be nice. :)
> 
> I've done such things as an administrator on the TCP level, using 
> transparent proxying and load balancing. Sufficiently advanced hackery 
> is indistinguishable from magic. Sufficiently advanced hackery is 
> easily distinguished from a good idea. (Login referrals IMO have the 
> same characteristics.)

The idea would be that there's a frontend IMAP proxy that looks up the
backend IMAP server based on the username, tells the backend server the
user's IP and then logs in using the provided user+password. Currently
the IP isn't forwarded, so some IP-based user access checks don't work.

Kernel-level transparent proxying wouldn't be enough ?because this isn't
just dummy proxying/load-balancing, but is it possible (with Linux) to
somehow do transparent proxying with userspace doing the actual proxying
(it'd also have to decode SSL sessions)?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: This is a digitally signed message part
URL: <http://mailman13.u.washington.edu/pipermail/imap-protocol/attachments/20080601/d0c18bca/attachment.sig>
