Message Hashing Plugin (message-hashing)

This plugin calculates a hash for every attachment in a message (attachment determination done via istream-attachment-extractor code) and a hash for the entire message.

This calculated data is emitted via named events, which can be collected and analyzed as needed.

This plugin captures message saving via any method (LMTP/LDA, doveadm, IMAP APPEND). To restrict to a certain protocol, load the plugin in a protocol block instead of globally.

Settings

message_hashing_hash_method

Default	md5
Value	string

The hashing method to use. Must be a recognized Dovecot hashing method (see auth_policy_hash_mech for list of supported methods).

message_hashing_min_attachment_size

Default	1 B
Value	size

The minimum size of an attachment to be processed; attachments smaller than this will be skipped.

Events

message_hashing_msg_full

If message-hashing plugin is loaded, emitted for every message saved.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
append	If 1, the message was saved via IMAP APPEND.
attachments	The number of attachments processed in this message (attachments with size > min_atc_size).
hash	The calculated hash of the entire message.
size	The size (in bytes) of the entire message.

message_hashing_msg_part

If message-hashing plugin is loaded, emitted for every attachment found when a message is saved.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
append	If 1, the message was saved via IMAP APPEND.
hash	The calculated hash of the attachment.
size	The size (in bytes) of the attachment.

Example Configuration

WARNING

This plugin requires the notify plugin to be loaded.

mail_plugins {
  notify = yes
  message_hashing = yes
}

message_hashing_hash_method = md5
message_hashing_min_attachment_size = 1 B

Debugging

You can view message hashing information in the log by using log_debug:

log_debug = event=message_hashing_msg_full OR event=message_hashing_msg_part

Example output:

Apr 21 19:11:39 imap(3752 foo)<KWoZVYDAEI9/AAAB>: Debug: message-hashing: message part (06a9effc7cb6182578e876d0cce2b617, 7)
Apr 21 19:11:39 imap(3752 foo)<KWoZVYDAEI9/AAAB>: Debug: message-hashing: message part (c9269421e2389c0ca53bcf1854e49182, 8)
Apr 21 19:11:39 imap(3752 foo)<KWoZVYDAEI9/AAAB>: Debug: message-hashing: full message (8e8c6d47004d4e0a99f14d6cd788ee4f, 81)