Fukuoka.go #17 Jun 10, 2021 の発表資料です。
Fukuoka.go #17Tomohisa Oda / Jun 10, 2021Transparent SMTP Proxy in GoGoͰͭ͘ΔಁաܕSMTPϓϩΩγ
View Slide
Fukuoka.go #17@linyowsBlog: tomohisaoda.comAffiliation: GMO pepabo, inc.Fukuoka.go and Fukuoka.ts Organizer
Fukuoka.go #17@linyowsBlog: tomohisaoda.comAffiliation: GMO pepabo, inc.Fukuoka.go and Fukuoka.ts Organizer࠷ۙɺNotionʹࣅإֆΛॻ͍ͯΒ͍·ͨ͠ɻ
Fukuoka.go #17๏ ϗεςΟϯάࣄۀ෦ Senior Engineering Leadࣄۀ෦ͷCTOVPoEͷΑ͏ͳͷ๏ ϖύϘݚڀॴ भେֶڞಉݚڀ2020 Պݚඅ࠾ https://kaken.nii.ac.jp/grant/KAKENHI-PROJECT-20K11791/ܰྔίϯςφʹΑΔେنߴूੵϝʔϧϗεςΟϯάج൫ʹ͓͚Δૹ৴ػೳͷߴػೳԽIn Pepabo…
Fukuoka.go #17Private ProjectsΞϓϦέʔγϣϯ͕ࣗϦϙδτϦ͔Β࠷৽ͷίʔυΛݕͯࣗ͠ಈͰσϓϩΠͱσϦόϦʔΛߦ͏πʔϧlinuxͷuser໊લղܾΛGitHubͷTeamϝϯόʔϦϙδτϦͷΞΫηεݖݶऀ͔Βߦ͏πʔϧϝʔϧૹ৴༻ͷಁաܕSMTPϓϩΩγͰϦΫΤετͱϨεϙϯεΛϩάσʔλϕʔεʹग़ྗ͢Δ͜ͱ͕Ͱ͖ΔNew!!
Fukuoka.go #17ϝʔϧͷΈͱϝʔϧϗεςΟϯάͷ՝
Fukuoka.go #17✉Architecture💻 🖥Mail SubmissionAgent:587Mail TransferAgent:25Mail DeliveryAgent:993Postfix Postfix Dovecot✉✉SMTPSMTPLMTPIMAP📱📱DNSMX TXT(SPF, DKIM, DMARC…)
Fukuoka.go #17✉Architecture💻 🖥Mail SubmissionAgent:587Mail TransferAgent:25Mail DeliveryAgent:993Postfix Postfix Dovecot✉✉SMTPSMTPLMTPIMAP📱📱[email protected]DNSMX TXT(SPF, DKIM, DMARC…)[email protected]Bob AliceϝʔϧϗεςΟϯάʹ͓͍ͯϝʔϧΛ૬खઌʹ౸ୡͤ͞Δ͜ͱ͕ॏཁ
Fukuoka.go #17ϝʔϧͷ౸ୡੑʹӨڹΛ༩͑Δ̐ͭͷ͜ͱvia: https://sendgrid.kke.co.jp/blog/?p=4494 by Jillian Smith๏ ϝʔϧΠϯϑϥͷ݈શੑʢωοτϫʔΫͱDNSʣ๏ ϝʔϧͷίϯςϯπʢఴϑΝΠϧ, ຊจ, ϔομʔͳͲʣ๏ ϝʔϧͷૹ৴ݩʢૹ৴ݩIP, υϝΠϯ, ૹ৴ྔͳͲʣ๏ ड৴ଆαʔόͷՄ༻ੑ
Fukuoka.go #17๏ ϝʔϧΠϯϑϥͷ݈શੑʢωοτϫʔΫͱDNSʣ๏ ϝʔϧͷίϯςϯπʢఴϑΝΠϧ, ຊจ, ϔομʔͳͲʣ๏ ϝʔϧͷૹ৴ݩʢૹ৴ݩIP, υϝΠϯ, ૹ৴ྔͳͲʣ๏ ड৴ଆαʔόͷՄ༻ੑϝʔϧͷ౸ୡੑʹӨڹΛ༩͑Δ̐ͭͷ͜ͱvia: https://sendgrid.kke.co.jp/blog/?p=4494 by Jillian Smith%/4#-ʹొ͞ΕΔͳͲϨϐϡςʔγϣϯʢධʣʹӨڹ͢Δ
Fukuoka.go #17๏ ༷ʑͳϢʔβ͕͏ϚϧνςφϯτͰ͋ΔͨΊɺϝʔϧΛৗతʹͨ͘͞Μૹ৴͢ΔΞΧϯτ͋Εɺීஈগͳ͍͕ͨ·ʹେྔૹ৴͢ΔΞΧϯτ͋Δ๏ ͦͦΞΧϯτΛͬऔΒΕΔέʔε͋Δ๏ ड৴ऀ͕ͳͥड͚औΓڋ൱Λͨ͠ͷ͔͕͔Γʹ͍͘ʢDMARCରԠ͕͋Εผʣ๏ ϝʔϧํͷΓͱΓͳͷͰɺૹ৴ଆ͕εύϜߦҝͱࢥ͍ͬͯͳͯ͘ड৴ऀ͕εύϜߦҝͩͱײ͡Δ͜ͱ͋Γ͏ΔϝʔϧϗεςΟϯάʹ͓͚Δ՝
Fukuoka.go #17๏ ༷ʑͳϢʔβ͕͏ϚϧνςφϯτͰ͋ΔͨΊɺϝʔϧΛৗతʹͨ͘͞Μૹ৴͢ΔΞΧϯτ͋Εɺීஈগͳ͍͕ͨ·ʹେྔૹ৴͢ΔΞΧϯτ͋Δ๏ ͦͦΞΧϯτΛͬऔΒΕΔέʔε͋Δ๏ ड৴ऀ͕ͳͥड͚औΓڋ൱Λͨ͠ͷ͔͕͔Γʹ͍͘ʢDMARCରԠ͕͋Εผʣ๏ ϝʔϧํͷΓͱΓͳͷͰɺૹ৴ଆ͕εύϜߦҝͱࢥ͍ͬͯͳͯ͘ड৴ऀ͕εύϜߦҝͩͱײ͡Δ͜ͱ͋Γ͏ΔϝʔϧϗεςΟϯάʹ͓͚Δ՝ϝʔϧૹ৴࣌ͷͲΜͳৼΔ͍͕ड৴ڋ൱ʹࢸ͔ͬͨʁੳ͠ݕͰ͖ΔΑ͏ʹ͍ͨ͠ʂ
Fukuoka.go #17✉Architecture💻 🖥Mail SubmissionAgent:587Mail TransferAgent:25Mail DeliveryAgent:993Postfix Postfix Dovecot✉✉SMTPSMTPLMTPIMAP📱📱[email protected]DNSMX TXT(SPF, DKIM, DMARC…)[email protected]Bob Alice͜ͷΓͱΓΛੳͰ͖Δɺ͔ͭΛݕͰ͖Εૹ৴ΛϒϩοΫͰ͖ΔΈ͕ඞཁ
Fukuoka.go #17࣮ݱํ๏ͷൺֱ
Fukuoka.go #17ϝʔϧϦϨʔ vs. ಁաܕϓϩΩγMail TransferAgent:25Mail TransferAgent:25Postfix Postfix[email protected]TransparentProxy:25Mail TransferAgent:25? Postfix[email protected]Mail SubmissionAgent:587Postfix[email protected]Mail SubmissionAgent:587Postfix[email protected]✉ ✉✉✉ϝʔϧϦϨʔΛߦ͏ͱϗοϓ͕૿͑ϝʔϧΩϡʔͷཧ͕ෳࡶʹͳΔ4.51ड͚ྲྀ͢ಁաܕϓϩΩγͩͱϝʔϧΩϡʔཧ͕ݱߦͱมΘΒͣγϯϓϧͰ͋Δɻ͔͠͠ɺͦͷΑ͏ͳϛυϧΣΞ͕ݟͨΒͳ͍ɻ
Fukuoka.go #17GoͰͭ͘ΔಁաܕSMTPϓϩΩγ
Fukuoka.go #17Ͳ͏ͬͯಁաܕϓϩΩγΛ࣮ݱ͢Δ͔๏ Port25൪ѼΛDNATͰશͯProxyʹૹΔ๏ getsockopt(2)ͰѼઌมߋલͷΞυϨεΛऔಘ͢Δ
Fukuoka.go #17SMTP Examplevia: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol4.5104*-ͷͱͯγϯϓϧͳϓϩτίϧ
Fukuoka.go #17Goͷio.CopyΛָ͑উͳΜ͡Όͳ͍ʁ
Fukuoka.go #17TransparentProxyGoMail TransferAgentPostfix[email protected]Mail SubmissionAgentPostfix[email protected]io.Copy(internalConn, externalConn)io.Copy(externalConn, internalConn)
Fukuoka.go #17PoCී௨ʹϝʔϧΛૹड৴Ͱ͖ͨͷͰશʹ͏·͍ͬͨ͘ͱࢥͬͨɻ͔͠͠ɺHPSPVUJOFͷมΛग़ྗͯ͠ΈΔͱɺ్த͔Βจࣈ͕ಡΊͳ͍ײ͡ʹ
Fukuoka.go #17STARTTLSͷ͜ͱΛΕ͍ͯͨ!!!
Fukuoka.go #17μϯάϨʔυ߈ܸରԠʹ͢Δ
Fukuoka.go #17୯ʹJP$PQZͰͳ͘5-4ίωΫγϣϯ·Ͱ੍ޚ͢Δඞཁ͕͋ͬͨ
Fukuoka.go #1745"355-4ʹରԠͯ͠ͳ͍Ϩεϙϯεʹ͢Δ
Fukuoka.go #17όοϑΝϦϯάͨ͠σʔλΛ5-4ίωΫγϣϯͱͦͷޙͷఆܕΓऔΓޙʹૹ৴͢Δ
Fukuoka.go #17Demo: ࣌ؒͳ͍͔
Fukuoka.go #17๏ Integration Testͷख๏Λߟ͑ΔʢPostfixґଘΛͲ͏͖͔͢ʣ๏ ऩूͨ͠ใΛDatabaseʹੵͱੳ๏ IptablesґଘϧʔςΟϯάΛBPF/XDPΛ͏Α͏ʹ͢Δ๏ ProductionΧφϦΞϦϦʔεࠓޙͷܭը — github.com/linyows/warp
Fukuoka.go #17๏ ϝʔϧͷ౸ୡੑʹؔΘΔ̐ͭͷ߲͕͋Δ๏ ϝʔϧϗεςΟϯάʹ͓͚Δ՝ड৴ڋ൱ͷཧ༝͕Θ͔Βͳ͍͜ͱ๏ ϝʔϧૹ৴࣌ͷΞΧϯτ͝ͱͷৼΔ͍ͱड৴ڋ൱ͷؔΛݟ͚ͭΔͨΊͷಁաܕϓϩΩγ๏ ಁաܕϓϩΩγʹ͢ΔʹDNATͱgetsockoptΛͬͨ๏ SMTPͷಁաܕϓϩΩγͷ࣮io.Copy͢Δ͚ͩͰμϝͰμϯάϨʔυ߈ܸΛରԠ͢Δඞཁ͕͋Γ࣮͕গ͠ෳࡶConclusion
Fukuoka.go #17Thank you \ʕ⊙౪⚆ʔ/
linyows
gishi_yama
ancaghenade
myahagi
cer
ufoo68
sagawa23
syumai
treastrain
tosh2230
mukky620
jmatsu
squer
shpigford
zakiwarfel
marktimemedia
chrisshort
danielanewman
ufuk
tmm1
chrislema
garrettdimon
akmur
productmarketing
philhawksworth