Forum Discussion

JG's avatar
JG
Icon for Cumulonimbus rankCumulonimbus
May 17, 2014

Logging SMTP traffic info via HSL to remote log server.

Our SMTP servers need info about mail messages being sent in order to identify the mail sending devices (and thereby the mail sending users) but are not able to do so due to the use of SNATs on the ltm. I have put together an irule based on some existing shared code to log relevant info to a remote log server, as shown below. I'd appreciate it if anybody can let me know if there is anything missing/incorrect in it:

 

when CLIENT_ACCEPTED {
    set hsl [HSL::open -proto UDP -pool /APPLICATION/test_logserver]
    set tstamp [clock format [clock seconds] -format "%d/%m/%Y %H:%M:%S %z"]
    HSL::send $hsl "<22> $tstamp [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port] CLIENT_ACCEPTED\n"
TCP::collect
}

when CLIENT_DATA {
    set cdata [TCP::payload]

    if { [ string length $cdata ] <= 0 } {
        return
    }
    if { not ( $cdata contains "\r\n" ) } {
        return
    }
    if { $cdata starts_with "MAIL FROM:" } {
        set cfrom [TCP::payload]
        set tstamp [clock format [clock seconds] -format "%d/%m/%Y %H:%M:%S %z"]
        HSL::send $hsl "<22> $tstamp [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port] $cfrom\n"
        return
    }
    if { $cdata starts_with "RCPT TO:" } {
        set crcpt "$crcpt[TCP::payload]"
        set tstamp [clock format [clock seconds] -format "%d/%m/%Y %H:%M:%S %z"]
        HSL::send $hsl "<22> $tstamp [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port] $crcpt\n"
        return
    }
    TCP::release
    TCP::collect
}

when CLIENT_CLOSED {
    set tstamp [clock format [clock seconds] -format "%d/%m/%Y %H:%M:%S %z"]
    HSL::send $hsl "<22> $tstamp [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port] CLIENT_CLOSED\n"
}

Another question is if an SMTP security profile in ASM is enabled, will this irule run first or after the security profile is assessed first?

 

application delivery
deployment
devops
iRules
LTM
security
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    May 18, 2014

    It tuns out that it is probably not worth it trying to capture/filter SMTP data using TCP::collect as there may be too much data from the client side for the irule to handle it. That is probably why there hasn't been much feature enhancement, at least in the area of passing client IP addr to the backend, in irule for SMTP for many years.

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 18, 2014

    have you tried stream profile/irule (i.e. STREAM_MATCHED)? just thinking it might be better (than TCP::collect) in term of performance.

     

    i might be wrong anyway.