Enhance mail module with access control like ngx_http_access_module module

[weishen@…]

We are running nginx as the mail proxy, but there are lots of invalid authentiations every day. We have got some ips to block, but found the mail module lacks deny/allow directives as ngx_http_access_module, so please add the feature.
By the way, we have tried the stream module as a proxy to mail block.

worker_processes  8;
user root;

events {
    use epoll;
    worker_connections  10240;
}

pid       /opt/work/log/nginx_pop.pid;
error_log /opt/work/log/error_pop.log error;

mail {
    auth_http          127.0.0.1:8080/auth;
    timeout            5000;
    proxy              on;
    xclient            on;
    server {
    listen              127.0.0.1:1100;
    protocol            pop3;

}


}

stream {
    # deny IP
    include includes/deny_ip.conf;
    upstream @pop_up {
        server 127.0.0.1:1100;
    }

    # POP
    # =============================
    server {
        listen 110;
        proxy_pass @pop_up;
        #proxy_pass 127.0.0.1:1100;
     }
}

This method will not set the correct Client-IP header for the auth_http, all is 127.0.0.1, it impacts our analysis from the malicious flow.

[Maxim Dounin]

By design of the mail module, access checks as well as various rate limits are expected to be done by the ​auth_http script along with authentication. As such, usefulness of access checks in the mail module itself is quite limited.