fluent-plugin-mailrelay 0.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 357f205e699a6ec3f301864d4bdd08e588c2904e
+  data.tar.gz: 98b3bdbd6e3db7ce34197bb83e5896ab09a41f33
+SHA512:
+  metadata.gz: 6fdedc25155aedaff0b9109fd0b21aff04bc4b10bb107d51fe3afe67297f2becd3e0c55edb3a923c78538794cc24e9499a33792d8983071166e5c013872a9f57
+  data.tar.gz: f74e64fde377851d5584f9fae1a3c0f2f3adbdd72815cd20df76c6651c85a3dd9c5fa1dfafd30429b78a31b84ade37a9bd0d71d2ab9c46cafdbf9181fdaea019

data/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.0.0
+
+First version

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in fluent-plugin-mailrelay.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 TODO: Write your name
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,101 @@
+# Fluent::Plugin::Mailrelay
+
+Fluentd plugin to tracking mail relay in your networks.
+This plugin expects fluent-plugin-sendmail `unbundled' JSON outputs.
+
+## Configuration
+
+```
+<source>
+  type sendmail
+  path /var/log/maillog
+  tag sendmail
+  unbundle yes
+</source>
+
+<match sendmail>
+  type mailrelay
+  mynetworks ["127.0.0.1", "1.1.1.0/24"]
+  flush_interval 60
+  @label @relay
+</match>
+
+<label @relay>
+  <match sendmail>
+     type file
+     path /var/log/sendmail
+  </match>
+</label>
+```
+
+example of sendmail log
+
+```
+
+@centos001
+
+Jul  7 19:47:51 centos001 sendmail[22886]: u67AlmbO022886: from=<grandeur09+from@gmail.com>, size=5, class=0, nrcpts=1, msgid=<201607071047.u67AlmbO022886@centos001.localdomain>, proto=SMTP, daemon=MTA, relay=localhost [127.0.0.1]
+Jul  7 19:47:51 centos001 sendmail[22888]: u67AlmbO022886: to=<grandeur09+to@gmail.com>, delay=00:00:00, xdelay=00:00:00, mailer=smtp, pri=120005, relay=[1.1.1.2] [1.1.1.2], dsn=2.0.0, stat=Sent (u67Alp74018025 Message accepted for delivery)
+
+@centos002
+
+Jul  7 19:47:51 centos002 sendmail[18025]: u67Alp74018025: from=<grandeur09+from@gmail.com>, size=417, class=0, nrcpts=1, msgid=<201607071047.u67AlmbO022886@centos001.localdomain>, proto=ESMTP, daemon=MTA, relay=[1.1.1.1]
+Jul  7 19:47:53 centos002 sendmail[18027]: u67Alp74018025: to=<grandeur09+to@gmail.com>, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, pri=120417, relay=gmail-smtp-in.l.google.com. [74.125.204.27], dsn=2.0.0, stat=Sent (OK 1467888473 d129si502387itc.63 - gsmtp)
+
+```
+
+This plugin emit record like below:
+
+```
+2016-07-07T19:47:53+09:00       sendmail
+{
+   "from":"<grandeur09+from@gmail.com>",
+   "to":"<grandeur09+to@gmail.com>",
+   "msgid":"<201607071047.u67AlmbO022886@centos001.localdomain>",
+   "delay_sec_sum":2,
+   "relay":[
+      {
+         "mta":"centos001",
+         "relay_to":{
+            "ip":"1.1.1.2",
+            "host":null
+         },
+         "stat":"sent",
+         "dsn":"2.0.0",
+         "delay":"00:00:00",
+         "arrived_at_mta":1467888471
+      },
+      {
+         "mta":"centos002",
+         "relay_to":{
+            "ip":"74.125.204.27",
+            "host":"gmail-smtp-in.l.google.com."
+         },
+         "stat":"sent",
+         "dsn":"2.0.0",
+         "delay":"00:00:02",
+         "arrived_at_mta":1467888473
+      }
+   ]
+}
+```
+
+## TODO
+
+* writing test code.
+
+## ChangeLog
+
+See [CHANGELOG.md](CHANGELOG.md) for details.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## Copyright
+
+Copyright (c) 2014 yudai09. See [LICENSE](LICENSE) for details.

data/Rakefile

@@ -0,0 +1,12 @@
+require "bundler/gem_tasks"
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test
+
+task :default => :spec

data/fluent-plugin-mailrelay.gemspec

@@ -0,0 +1,24 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+
+Gem::Specification.new do |spec|
+  spec.name          = "fluent-plugin-mailrelay"
+  spec.version       = "0.0.0"
+  spec.authors       = ["Yudai Kato"]
+  spec.email         = ["grandeur09@gmail.com"]
+
+  spec.summary       = %q{Output plugin to trace mail relayed in intranetwork.}
+  spec.description   = %q{trace mail relayed in intra network.}
+  spec.homepage      = "https://github.com/yudai09/fluent-plugin-mailrelay.git"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "rake"
+  spec.add_runtime_dependency "fluentd"
+  spec.add_runtime_dependency("lru_redux", [">= 0.8.4"])
+end

data/lib/fluent/plugin/out_mailrelay.rb

@@ -0,0 +1,194 @@
+module Fluent
+  class MailRelayOutput < Fluent::BufferedOutput
+    Fluent::Plugin.register_output('mailrelay', self)
+    config_param :lrucache_size, :integer, :default => (1024*1024)
+    config_param :mynetworks, :array, :default => ['127.0.0.1']
+
+    require 'time'
+    require 'lru_redux'
+    require 'ipaddr'
+
+    def initialize
+      super
+      @transactions = LruRedux::ThreadSafeCache.new(@lrucache_size)
+    end
+
+    def str2ipaddr(sipaddrs)
+      ipaddrs = Array.new()
+      sipaddrs.each do |sipaddr|
+        ipaddr = IPAddr.new(sipaddr)
+        ipaddrs.push(ipaddr)
+      end
+      ipaddrs
+    end
+
+    def configure(conf)
+      super
+      @mynetworks = str2ipaddr(@mynetworks)
+    end
+
+    def start
+      super
+    end
+
+    def shutdown
+      super
+    end
+
+    def format(tag, time, record)
+      [tag, time, record].to_msgpack
+    end
+
+    def write(chunk)
+      begin
+        # Fluentd doesn't guarantee message order
+        # For tracking relay of mail, this plugin should buffer logs and sort it by date order.
+        messages = sort_messages(chunk.to_enum(:msgpack_each))
+        readys = []
+        messages.each do |tag, time, record|
+          ready, mail_id = push2relaylog(tag, time, record)
+          # this plugin does not output relay log until the mail relayed to outer mynetworks.
+          # Therefore, if a mail is deferred, the relay log will not be outputed until the mail is bounced or sent.
+          if ready
+            readys.push([mail_id, tag, time])
+          end
+        end
+        readys.each { |ready|
+          mail_id, tag, time = ready
+          log = @transactions[mail_id]
+          router.emit(tag, time, log.record)
+          @transactions.delete(mail_id)
+        }
+      rescue
+        $log.warn 'mailrelay: error write() ', :error=>$!.to_s
+        $log.debug_backtrace
+      end
+    end
+
+    private
+    def sort_messages(messages)
+      messages = sort_by_time(messages)
+    end
+
+    def sort_by_time(messages)
+      messages.sort_by do |tag, time, record|
+        record[:time]
+      end
+    end
+
+    def push2relaylog(tag, time, record)
+      from = get_fromaddr(record)
+      to = get_toaddr(record)
+      msgid = get_msgid(record)
+
+      mail_id = from + to + msgid
+      $log.warn 'mailrelay: ',  from, ', ', to, ',', msgid, ',', mail_id
+
+      mta = get_mta(record)
+      relay_to = get_relay_to(record)
+      stat = get_stat(record)
+      dsn = get_dsn(record)
+      delay = get_delay(record)
+      arrived_at_mta = time
+
+      log = nil
+      if @transactions.has_key?(mail_id)
+        log = @transactions[mail_id]
+      else
+        log = MailRelayLog.new(from, to, msgid)
+        @transactions[mail_id] = log
+      end
+
+      log.merge(mta, relay_to, stat, dsn, delay, arrived_at_mta)
+      if not relay_to.nil? and not relay_to_mynetworks(relay_to['ip']) or
+          stat == 'sent_local'
+        return true, mail_id
+      end
+      return false, mail_id
+    end
+
+    def get_fromaddr(record)
+      record['from']['from']
+    end
+
+    def get_toaddr(record)
+      record['to']['to']
+    end
+
+    def get_msgid(record)
+      record['from']['msgid']
+    end
+
+    def get_mta(record)
+      record['mta']
+    end
+
+    def get_relay_to(record)
+      record['to']['relay']
+    end
+
+    def get_stat(record)
+      record['to']['canonical_status']
+    end
+
+    def get_dsn(record)
+      record['to']['dsn']
+    end
+
+    def get_delay(record)
+      record['to']['delay']
+    end
+
+    def relay_to_mynetworks(ip)
+      @mynetworks.each {|mynetwork|
+        if mynetwork.include?(ip)
+          return true
+        end
+      }
+      return false
+    end
+  end
+end
+
+class MailRelayLog
+  def initialize(from, to, msgid)
+    @relay = []
+    @status = :init
+    @from = from
+    @to = to
+    @msgid = msgid
+    @delay_sum = 0
+  end
+
+  def record
+    return {
+      'from' => @from,
+      'to' => @to,
+      'msgid' => @msgid,
+      'delay_sec_sum' => @delay_sum,
+      'relay' => @relay.each {|relay|
+        {
+          'relay' => relay['relay'],
+          'stat' => relay['stat'],
+          'dsn' => relay['dsn'],
+          'delay' => relay['delay'],
+        }
+      }
+    }
+  end
+
+  def merge(mta, relay_to, stat, dsn, delay, arrived_at_mta)
+    @relay.push({
+                  'mta' => mta,
+                  'relay_to' => relay_to,
+                  'stat' => stat,
+                  'dsn' => dsn,
+                  'delay' => delay,
+                  'arrived_at_mta' => arrived_at_mta
+                })
+    dtime = Time.parse(delay)
+    if stat =='sent' or stat == 'bounced'
+        @delay_sum += (dtime.hour * 60 * 60) + (dtime.min * 60) + (dtime.sec)
+    end
+  end
+end

metadata

@@ -0,0 +1,93 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-mailrelay
+version: !ruby/object:Gem::Version
+  version: 0.0.0
+platform: ruby
+authors:
+- Yudai Kato
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2016-07-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: lru_redux
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.8.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.8.4
+description: trace mail relayed in intra network.
+email:
+- grandeur09@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- fluent-plugin-mailrelay.gemspec
+- lib/fluent/plugin/out_mailrelay.rb
+homepage: https://github.com/yudai09/fluent-plugin-mailrelay.git
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: Output plugin to trace mail relayed in intranetwork.
+test_files: []