postfix-log-parser 0.2.0

//! # Relay 邮件中继组件解析器
//!
//! Relay 是 Postfix 的邮件中继传输组件，负责：
//! - 通过 SMTP 协议向远程服务器投递邮件
//! - 处理邮件路由和中继决策
//! - 管理投递重试和失败处理
//! - 记录详细的投递状态和性能指标
//!
//! ## 核心功能
//!
//! - **邮件投递**: 通过 SMTP 向目标服务器投递邮件
//! - **连接管理**: 建立和维护与远程服务器的连接
//! - **投递状态**: 跟踪投递成功、失败、延迟状态
//! - **性能监控**: 记录延迟分解和连接质量
//! - **错误处理**: 详细的连接错误和 TLS 问题诊断
//!
//! ## 支持的事件类型
//!
//! - **投递状态**: 成功、退回、延迟投递的详细记录
//! - **连接问题**: 连接失败、超时、拒绝等网络问题
//! - **TLS 事件**: SSL/TLS 连接建立和证书验证
//! - **中继配置**: 传输映射和路由配置事件
//!
//! ## 示例日志格式
//!
//! ```text
//! # 投递成功
//! 4D2952A00AD6: to=<user@example.com>, relay=mail.example.com[1.2.3.4]:25, delay=88, delays=0/0.01/88/0, dsn=2.0.0, status=sent (250 Message accepted)
//!
//! # 投递失败
//! 4D2952A00AD6: to=<user@example.com>, relay=none, delay=0, delays=0/0/0/0, dsn=5.4.6, status=bounced (mail for domain.com loops back to myself)
//!
//! # 连接问题
//! 4D2952A00AD6: connect to mail.example.com[1.2.3.4]:25: Connection timed out
//! 4D2952A00AD6: lost connection with mail.example.com[1.2.3.4] while sending message body
//! ```

use lazy_static::lazy_static;
use regex::Regex;
use std::net::IpAddr;
use std::str::FromStr;

use super::ComponentParser;
use crate::error::ParseError;
use crate::events::base::BaseEvent;
use crate::events::relay::{
    ConnectionIssueType, DelayBreakdown, DeliveryStatus, RelayConfigType, RelayEvent,
};
use crate::events::ComponentEvent;

/// RELAY组件解析器
///
/// 处理Postfix relay/smtp传输代理的日志
/// relay组件负责通过SMTP将邮件发送到远程或本地目标
pub struct RelayParser;

lazy_static! {
    /// 主要投递状态模式 - 匹配95%+的relay日志
    /// 例如: "4D2952A00AD6: to=<m01@zcloud.center>, relay=mail.zcloud.center[223.223.197.126]:25, delay=88, delays=0/0.01/88/0, dsn=4.4.2, status=deferred (lost connection)"
    static ref DELIVERY_STATUS_PATTERN: Regex = Regex::new(
        r"^([A-F0-9]+):\s+to=<([^>]+)>,\s+relay=([^,\[\]]+)(?:\[([^\]]+)\])?(?::(\d+))?,\s+delay=([0-9.]+),\s+delays=([0-9./]+),\s+dsn=([0-9.]+),\s+status=(\w+)\s*\(([^)]*)\)"
    ).unwrap();

    /// 无法投递模式 - 当没有可用的relay时
    /// 例如: "4D2952A00AD6: to=<user@domain.com>, orig_to=<user>, relay=none, delay=0, delays=0/0/0/0, dsn=5.4.6, status=bounced (mail for domain.com loops back to myself)"
    static ref NO_RELAY_PATTERN: Regex = Regex::new(
        r"^([A-F0-9]+):\s+to=<([^>]+)>(?:,\s+orig_to=<[^>]+>)?,\s+relay=none,\s+delay=([0-9.]+),\s+delays=([0-9./]+),\s+dsn=([0-9.]+),\s+status=(\w+)\s*\(([^)]*)\)"
    ).unwrap();

    /// 连接问题模式 - 匹配连接失败、超时等问题
    /// 例如: "warning: smtp_connect_timeout: stream not ready"
    static ref CONNECTION_ISSUE_PATTERN: Regex = Regex::new(
        r"^([A-F0-9]+):\s+to=<([^>]+)>,\s+relay=([^,\[\]]+)(?:\[([^\]]+)\])?(?::(\d+))?,.*?(?:connection\s+(lost|refused|timeout|failed)|host\s+unreachable|network\s+unreachable)"
    ).unwrap();

    /// TLS相关错误模式
    static ref TLS_ERROR_PATTERN: Regex = Regex::new(
        r"^([A-F0-9]+):\s+to=<([^>]+)>,\s+relay=([^,\[\]]+).*?(?:TLS|SSL|certificate)"
    ).unwrap();

    /// 传输映射配置模式
    static ref TRANSPORT_MAP_PATTERN: Regex = Regex::new(
        r"transport\s+maps?\s+(?:lookup|configuration|error)"
    ).unwrap();
}

impl RelayParser {
    pub fn new() -> Self {
        Self
    }

    /// 解析单行relay日志
    pub fn parse_line(&self, line: &str, base_event: BaseEvent) -> Option<RelayEvent> {
        // 按频率优先级处理，最常见的模式优先

        // 1. 投递状态模式（最常见，95%+）
        if let Some(caps) = DELIVERY_STATUS_PATTERN.captures(line) {
            return self.parse_delivery_status(caps, base_event);
        }

        // 2. 无relay可用模式
        if let Some(caps) = NO_RELAY_PATTERN.captures(line) {
            return self.parse_no_relay_status(caps, base_event);
        }

        // 3. 连接问题模式
        if let Some(caps) = CONNECTION_ISSUE_PATTERN.captures(line) {
            return self.parse_connection_issue(caps, base_event, line);
        }

        // 4. TLS相关错误
        if let Some(caps) = TLS_ERROR_PATTERN.captures(line) {
            return self.parse_tls_issue(caps, base_event, line);
        }

        // 5. 传输配置相关
        if TRANSPORT_MAP_PATTERN.is_match(line) {
            return Some(RelayEvent::RelayConfiguration {
                base: base_event,
                config_type: RelayConfigType::TransportMapping,
                details: line.to_string(),
            });
        }

        None
    }

    /// 解析投递状态信息
    fn parse_delivery_status(
        &self,
        caps: regex::Captures,
        base_event: BaseEvent,
    ) -> Option<RelayEvent> {
        let queue_id = caps.get(1)?.as_str().to_string();
        let recipient = caps.get(2)?.as_str().to_string();
        let relay_host = caps.get(3)?.as_str().to_string();
        let relay_ip = caps.get(4).and_then(|m| IpAddr::from_str(m.as_str()).ok());
        let relay_port = caps.get(5).and_then(|m| m.as_str().parse().ok());
        let delay = caps.get(6)?.as_str().parse().ok()?;
        let delays_str = caps.get(7)?.as_str();
        let dsn = caps.get(8)?.as_str().to_string();
        let status_str = caps.get(9)?.as_str();
        let status_description = caps.get(10)?.as_str().to_string();

        let delays = DelayBreakdown::from_delays_string(delays_str)?;
        let status = self.parse_delivery_status_type(status_str)?;

        Some(RelayEvent::DeliveryStatus {
            base: base_event,
            queue_id,
            recipient,
            relay_host,
            relay_ip,
            relay_port,
            delay,
            delays,
            dsn,
            status,
            status_description,
        })
    }

    /// 解析无relay可用的投递状态
    fn parse_no_relay_status(
        &self,
        caps: regex::Captures,
        base_event: BaseEvent,
    ) -> Option<RelayEvent> {
        let queue_id = caps.get(1)?.as_str().to_string();
        let recipient = caps.get(2)?.as_str().to_string();
        let delay = caps.get(3)?.as_str().parse().ok()?;
        let delays_str = caps.get(4)?.as_str();
        let dsn = caps.get(5)?.as_str().to_string();
        let status_str = caps.get(6)?.as_str();
        let status_description = caps.get(7)?.as_str().to_string();

        let delays = DelayBreakdown::from_delays_string(delays_str)?;
        let status = self.parse_delivery_status_type(status_str)?;

        Some(RelayEvent::DeliveryStatus {
            base: base_event,
            queue_id,
            recipient,
            relay_host: "none".to_string(),
            relay_ip: None,
            relay_port: None,
            delay,
            delays,
            dsn,
            status,
            status_description,
        })
    }

    /// 解析连接问题
    fn parse_connection_issue(
        &self,
        caps: regex::Captures,
        base_event: BaseEvent,
        full_line: &str,
    ) -> Option<RelayEvent> {
        let queue_id = caps.get(1)?.as_str().to_string();
        let recipient = caps.get(2)?.as_str().to_string();
        let relay_host = caps.get(3)?.as_str().to_string();
        let relay_ip = caps.get(4).and_then(|m| IpAddr::from_str(m.as_str()).ok());

        let issue_type = if full_line.contains("lost connection") {
            ConnectionIssueType::LostConnection
        } else if full_line.contains("connection refused") {
            ConnectionIssueType::ConnectionRefused
        } else if full_line.contains("timeout") {
            ConnectionIssueType::ConnectionTimeout
        } else if full_line.contains("host unreachable")
            || full_line.contains("network unreachable")
        {
            ConnectionIssueType::DnsResolutionFailed
        } else {
            ConnectionIssueType::Other
        };

        Some(RelayEvent::ConnectionIssue {
            base: base_event,
            queue_id,
            recipient,
            relay_host,
            relay_ip,
            issue_type,
            error_message: full_line.to_string(),
        })
    }

    /// 解析TLS相关问题
    fn parse_tls_issue(
        &self,
        caps: regex::Captures,
        base_event: BaseEvent,
        full_line: &str,
    ) -> Option<RelayEvent> {
        let queue_id = caps.get(1)?.as_str().to_string();
        let recipient = caps.get(2)?.as_str().to_string();
        let relay_host = caps.get(3)?.as_str().to_string();

        Some(RelayEvent::ConnectionIssue {
            base: base_event,
            queue_id,
            recipient,
            relay_host,
            relay_ip: None,
            issue_type: ConnectionIssueType::TlsHandshakeFailed,
            error_message: full_line.to_string(),
        })
    }

    /// 解析投递状态类型
    fn parse_delivery_status_type(&self, status_str: &str) -> Option<DeliveryStatus> {
        match status_str.to_lowercase().as_str() {
            "sent" => Some(DeliveryStatus::Sent),
            "deferred" => Some(DeliveryStatus::Deferred),
            "bounced" => Some(DeliveryStatus::Bounced),
            "failed" => Some(DeliveryStatus::Failed),
            "rejected" => Some(DeliveryStatus::Rejected),
            _ => None,
        }
    }

    /// 获取解析器信息
    pub fn info(&self) -> &'static str {
        "RELAY组件解析器 - 处理Postfix relay/smtp传输代理日志，支持投递状态、连接问题和配置事件"
    }
}

impl ComponentParser for RelayParser {
    fn parse(&self, message: &str) -> Result<ComponentEvent, ParseError> {
        // 创建一个临时的BaseEvent，用于解析
        // 在实际使用中，这些字段会被MasterParser正确填充
        let base_event = BaseEvent {
            timestamp: chrono::Utc::now(),
            hostname: "temp".to_string(),
            component: "relay".to_string(),
            process_id: 0,
            log_level: crate::events::base::PostfixLogLevel::Info,
            raw_message: message.to_string(),
        };

        if let Some(relay_event) = self.parse_line(message, base_event) {
            Ok(ComponentEvent::Relay(relay_event))
        } else {
            Err(ParseError::ComponentParseError {
                component: "relay".to_string(),
                reason: "无法识别的relay日志格式".to_string(),
            })
        }
    }

    fn component_name(&self) -> &'static str {
        "relay"
    }

    fn can_parse(&self, message: &str) -> bool {
        // 检查是否包含relay特征
        DELIVERY_STATUS_PATTERN.is_match(message)
            || NO_RELAY_PATTERN.is_match(message)
            || CONNECTION_ISSUE_PATTERN.is_match(message)
            || TLS_ERROR_PATTERN.is_match(message)
            || TRANSPORT_MAP_PATTERN.is_match(message)
    }
}

impl Default for RelayParser {
    fn default() -> Self {
        Self::new()
    }
}