| version 1.5, 2004/10/31 11:52:30 |
version 1.6, 2004/11/28 23:01:06 |
|
|
| # 2004-10-19 - created |
# 2004-10-19 - created |
| # |
# |
| |
|
| # $Platon: perl-modules/Platon/Log/Mail/Postfix.pm,v 1.4 2004/10/30 00:27:43 rajo Exp $ |
# $Platon: perl-modules/Platon/Log/Mail/Postfix.pm,v 1.5 2004/10/31 11:52:30 rajo Exp $ |
| |
|
| package Platon::Log::Mail::Postfix; |
package Platon::Log::Mail::Postfix; |
| |
|
|
|
| # process_name: postfix-script smtpd smtp cleanup qmgr pickup local master |
# process_name: postfix-script smtpd smtp cleanup qmgr pickup local master |
| |
|
| if ($xx->{process_name} eq 'smtpd') { # {{{ |
if ($xx->{process_name} eq 'smtpd') { # {{{ |
| |
# TODO: |
| |
# postfix/smtpd[13456]: TLS engine: cannot load RSA cert/key data |
| |
# postfix/smtpd[10972]: unable to get private key from \'/etc/postfix/client.pem\' |
| |
# postfix/smtpd[10972]: 10972:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:389: |
| |
# postfix/smtpd[10972]: TLS engine: cannot load RSA cert/key data |
| |
# postfix/smtpd[13456]: unable to get certificate from \'/etc/postfix/ca.pem\' |
| |
# postfix/smtpd[13456]: 13456:error:02001002:system library:fopen:No such file or directory:bss_file.c:276:fopen(\'/etc/postfix/ca.pem\',\'r\'): |
| |
# postfix/smtpd[13456]: 13456:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: |
| |
# postfix/smtpd[13456]: 13456:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:760: |
| |
# postfix/smtpd[2122]: SSL_accept error from gw.xxx.sk[17.5.3.4]: 0 |
| if ($xx->{postfix_key} eq 'NOQUEUE') { |
if ($xx->{postfix_key} eq 'NOQUEUE') { |
| my ($status, $addr, $rest, $info); |
# postfix/smtpd[5502]: NOQUEUE: reject: RCPT from mailgw.xxx.sk[58.95.16.250]: 550 <xxx@gimmel.xxx.sk>: Recipient address rejected: User unknown in local recipient table; from=<gqumt@chaexxx.net> to=<xxx@gimmel.xxx.sk> proto=ESMTP helo=<mailgw.xxx.sk> |
| ($status, $addr, $rest, $info) = ($xx->{rest} =~ m/(\S+): ([^:]+): (.+); ([^;]*)$/o); |
# postfix/smtpd[5583]: NOQUEUE: reject: RCPT from daleth.ip.xxx.sk[58.95.17.170]: 554 <bucek@xxx.sk>: Relay access denied; from=<bucek@gimmel.xxx.sk> to=<bucek@xxx.sk> proto=ESMTP helo=<[58.95.17.170]> |
| $xx->{rest} = $rest; |
# postfix/smtpd[5291]: NOQUEUE: reject: RCPT from rev-95-1-57-83.xxx.sk[95.1.57.83]: 553 <haluz@domain.sk>: Sender address rejected: not owned by user rajo@gimmel.xxx.sk; from=<haluz@xxx.sk> to=<rajo@xxx.sk> proto=ESMTP helo=<[10.254.0.111]> |
| |
my ($void1, $addr, $status, $rest1, $rest2, $info) = split(/[;:] /, $xx->{rest}); |
| |
$xx->{rest} = "$rest1: $rest2"; |
| |
($xx->{sasl_username}) = ($rest2 =~ m/user (\S+)$/o); |
| ($xx->{client_hostname}, $xx->{client_ip}) = ($addr =~ m/(\S+)\[([\.0-9]+)\]$/o); |
($xx->{client_hostname}, $xx->{client_ip}) = ($addr =~ m/(\S+)\[([\.0-9]+)\]$/o); |
| |
($xx->{status}) = ($status =~ m/^(\d+)/o); |
| # $info = 'from=<> to=<webmaster@foobar.sk> proto=ESMTP helo=<rage.xyzt.net>' |
# $info = 'from=<> to=<webmaster@foobar.sk> proto=ESMTP helo=<rage.xyzt.net>' |
| _parse_by_equal($info, $xx); |
_parse_by_equal($info, $xx); |
| $xx->{from} =~ s/[\<>]//go; |
$xx->{from} =~ s/[\<>]//go; |
| $xx->{to} =~ s/[\<>]//go; |
$xx->{to} =~ s/[\<>]//go; |
| $xx->{helo} =~ s/[\<>]//go; |
$xx->{helo} =~ s/[\<>]//go; |
| } |
} |
| |
elsif ($xx->{postfix_key} =~ m/^[A-F0-9]{10}$/o) { # valid postfix key |
| |
# postfix/smtpd[5277]: AAF642B2BB: client=rev-95-1-57-83.xxx.sk[95.1.57.83], sasl_method=PLAIN, sasl_username=rajo@gimmel.xxx.sk |
| |
_parse_by_equal($xx->{rest}, $xx); |
| |
($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{client} =~ m/(\S+)\[([\.0-9]+)\]$/o); |
| |
$xx->{rest} = undef; |
| |
} |
| elsif ($xx->{postfix_key} eq 'connect' |
elsif ($xx->{postfix_key} eq 'connect' |
| or $xx->{postfix_key} eq 'disconnect' |
or $xx->{postfix_key} eq 'disconnect' |
| or $xx->{postfix_key} eq 'lost') { |
or $xx->{postfix_key} eq 'lost') { |
|
| Line 111 sub savelog($$;) |
|
| ($xx->{client_ip}, $xx->{client_hostname}) = ($xx->{rest} =~ m/smtpd_peer_init: (\S+): hostname (\S+)/o); |
($xx->{client_ip}, $xx->{client_hostname}) = ($xx->{rest} =~ m/smtpd_peer_init: (\S+): hostname (\S+)/o); |
| } |
} |
| else { |
else { |
| ($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{rest} =~ m/from (\S+)\[([\.0-9]+)\]/o); |
# postfix/smtpd[5277]: AAF642B2BB: client=rev-95-1-57-83.xxx.sk[95.1.57.83], sasl_method=PLAIN, sasl_username=rajo@gimmel.xxx.sk |
| |
# postfix/smtpd[6185]: warning: hostname.sk[111.11.12.34]: SASL CRAM-MD5 authentication failed |
| |
($xx->{client_hostname}, $xx->{client_ip}, $xx->{rest}) = ($xx->{rest} =~ m/(\S+)\[([\.0-9]+)\]:\s*([^:]*)$/o); |
| |
if (!defined($xx->{client_hostname})) { |
| |
($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{rest} =~ m/from (\S+)\[([\.0-9]+)\]/o); |
| |
} |
| if (!defined($xx->{client_hostname})) { |
if (!defined($xx->{client_hostname})) { |
| ($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{rest} =~ m/client=(\S+)\[([\.0-9]+)\]$/o); |
($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{rest} =~ m/client=(\S+)\[([\.0-9]+)\]$/o); |
| } |
} |
| Line 112 sub savelog($$;) |
|
| Line 137 sub savelog($$;) |
|
| return $self->_savelog($xx); |
return $self->_savelog($xx); |
| } # }}} |
} # }}} |
| elsif ($xx->{process_name} eq 'smtp') { # {{{ |
elsif ($xx->{process_name} eq 'smtp') { # {{{ |
| # postfix/smtp[16172]: connect to buling.com[216.168.41.237]: Connection timed out (port 25) |
# postfix/smtp[16172]: connect to bug.com[21.16.4.27]: Connection timed out (port 25) |
| # postfix/smtp[16172]: 6D49F140B966: to=<webmaster@barfoo.com>, relay=none, delay=107781, status=deferred (connect to buling.com[216.168.41.237]: Connection timed out) |
# postfix/smtp[16172]: 6D49F140B966: to=<webmaster@barfoo.com>, relay=none, delay=107781, status=deferred (connect to bug.com[21.16.4.27]: Connection timed out) |
| if ($xx->{postfix_key} eq 'connect') { |
if ($xx->{postfix_key} eq 'connect') { |
| # TODO: incoming and and outgoing connections goes mixed here! seee 'to ' keyword on next line |
# TODO: incoming and and outgoing connections goes mixed here! seee 'to ' keyword on next line |
| ($xx->{client_hostname}, $xx->{client_ip}) = ($xx->{rest} =~ m/to (\S+)\[([\.0-9]+)\]/o); |
($xx->{client_hostname}, $xx->{client_ip}, $xx->{rest}) = ($xx->{rest} =~ m/to (\S+)\[([\.0-9]+)\]:\s*([^:]*)$/o); |
| |
} |
| |
# TLS error messages in smtp |
| |
elsif ($xx->{postfix_key} eq 'Host' |
| |
or $xx->{postfix_key} eq 'verify' |
| |
or $xx->{postfix_key} eq 'Unverified' |
| |
or $xx->{postfix_key} eq 'TLS' |
| |
or $xx->{postfix_key} eq 'Peer' |
| |
) { |
| |
$xx->{rest} = $xx->{postfix_key} . ' ' . $xx->{rest}; |
| |
undef $xx->{postfix_key}; |
| } |
} |
| else { |
else { |
| |
# postfix/smtp[5155]: 141D32B2BF: to=<rajo@xxx.sk>, relay=idea.xxx.sk[95.68.3.8], delay=5, status=sent (250 Ok: queued as 749C9140008E) |
| |
# postfix/smtp[6422]: AA8E72B2BF: host idea.xxx.sk[95.68.3.8] said: 451 <xxx@gimmel.xxx.sk>: Temporary lookup failure (in reply to RCPT TO command) |
| |
|
| my ($info); |
if ($xx->{rest} =~ /^host /) { |
| if ($xx->{rest} =~ m/^([^(]+)\s*(\(.*\))$/o) { |
my ($addr, $status, $rest) = split(/[;:] /, $xx->{rest}); |
| |
($xx->{client_hostname}, $xx->{client_ip}) = ($addr =~ m/(\S+)\[([\.0-9]+)\]/o); |
| |
($xx->{status}) = ($status =~ m/^(\d+)/o); |
| |
($xx->{mail_to}) = ($status =~ m/<([^<>]+)>/o); |
| |
$xx->{rest} = $rest; |
| |
use Data::Dumper; |
| |
print Dumper($xx); |
| |
} |
| |
elsif ($xx->{rest} =~ m/^([^(]+)\s*(\(.*\))$/o) { |
| |
my ($info); |
| ($info, $xx->{rest}) = ($1, $2); |
($info, $xx->{rest}) = ($1, $2); |
| |
_parse_by_equal($info, $xx); |
| |
$xx->{from} =~ s/[\<>]//go; |
| |
$xx->{to} =~ s/[\<>]//go; |
| } |
} |
| _parse_by_equal($info, $xx); |
|
| $xx->{from} =~ s/[\<>]//go; |
|
| $xx->{to} =~ s/[\<>]//go; |
|
| } |
} |
| |
|
| return $self->_savelog($xx); |
return $self->_savelog($xx); |
| Line 188 sub _savelog($$;) |
|
| Line 234 sub _savelog($$;) |
|
| $data->{pid}, $data->{postfix_key}, $data->{client_hostname}, $data->{client_ip}, $data->{uid}, |
$data->{pid}, $data->{postfix_key}, $data->{client_hostname}, $data->{client_ip}, $data->{uid}, |
| $data->{"message-id"}, $data->{"resent-message-id"}, $data->{from}, $data->{to}, |
$data->{"message-id"}, $data->{"resent-message-id"}, $data->{from}, $data->{to}, |
| $data->{size}, $data->{nrcpt}, $data->{relay}, $data->{delay}, |
$data->{size}, $data->{nrcpt}, $data->{relay}, $data->{delay}, |
| $data->{status}, $data->{proto}, $data->{helo}, $data->{rest} |
$data->{status}, $data->{proto}, $data->{helo}, $data->{sasl_method}, |
| |
$data->{sasl_username}, $data->{rest} |
| ) or warn $self->{sql_insert}->errstr; |
) or warn $self->{sql_insert}->errstr; |
| |
|
| } # }}} |
} # }}} |
|
|
| pid, postfix_key, client_hostname, client_ip, client_uid, |
pid, postfix_key, client_hostname, client_ip, client_uid, |
| message_id, resent_message_id, mail_from, mail_to, |
message_id, resent_message_id, mail_from, mail_to, |
| mail_size, mail_nrcpt, relay, delay, |
mail_size, mail_nrcpt, relay, delay, |
| status, proto, helo, message) |
status, proto, helo, sasl_method, |
| |
sasl_username, message) |
| VALUES |
VALUES |
| (?, ?, ?, ?, |
(?, ?, ?, ?, |
| ?, ?, ?, ?, ?, |
?, ?, ?, ?, ?, |
| ?, ?, ?, ?, |
?, ?, ?, ?, |
| ?, ?, ?, ?, |
?, ?, ?, ?, |
| ?, ?, ?, ?) |
?, ?, ?, ?, |
| |
?, ?) |
| "); |
"); |
| |
|
| } # }}} |
} # }}} |