Add Hornetsecurity functionality to policy-extras

[tommairs]

This adds functionality to use Hornetsecurity's spam and malware protection as documented here.

[wez]

This module functions should be functions rather than methods, because they don't store any state in "self":

Suggested change

	function mod:connect(vhost, vparams)
	function mod.connect(vhost, vparams)

Having just done a pass through the docs, I can see that they have sections like this:

local hornethost =
    hornet:connect('172.31.17.26', { port = '8080', use_tls = 'false' })

  if not hornethost then
    print 'No connection to Hornetsecurity host'
  else

the if not hornesthost is impossible to trigger because the connect method unconditionally just returns an object, so we should update the docs to simplify things by removing the if bit.

Since this function isn't actually connecting to anything, I would advocate rolling it into the scan function below, making things simpler overall

[wez]

I would collapse the mod:connect function here like this:

Suggested change

	local params = {
	host = params.host or '127.0.0.1',
	port = params.port or 8080,
	timeout = params.timeout or 10,
	use_tls = params.use_tls or false,
	}

[wez]

I'd also collapse extraparams into params just to keep things simpler with a single table style parameter to the scan function.

[wez]

Suggested change

	duration = '' .. tostring(duration) .. 's'
	duration = tostring(duration) .. 's'

[wez]

There's no need to form an SMTP style disposition just to crack it apart again; you can directly use the response information.

Unconditionally printing status in these helpers for per-message actions will generate a lot of noise in the diagnostic logs, so we should avoid that. In addition, a print for an error with no error being propagated out is a silent error until someone looks at the diagnostic logs, and should be avoided as well.

I'd suggest phrasing the logic this way, which causes failures to talk to the API to bubble up as 421 technical difficulties errors in the incoming session. There are other ways to handle this, but we should probably have a design session to talk about the higher level plans for this sort of integration.

Suggested change

	local disposition = string.format(
	'%d %s: %s',
	response:status_code(),
	response:status_reason(),
	response:text()
	)
	if string.sub(disposition, 1, 8) == '200 OK: ' then
	scanresult = disposition
	scanresult = string.sub(scanresult, 9, string.len(scanresult))
	else
	scanresult = disposition
	print 'Security scan failed'
	end
	-- If requested, add headers to message to describe the scan results
	if modifymsg == true then
	scanresult_json = kumo.serde.json_parse(scanresult)
	for skey, svalue in pairs(scanresult_json) do
	skey = 'X-Hornet-' .. skey
	msg:append_header(skey, svalue)
	end
	end
	return scanresult
	local scanresult = response:text()
	if response:status_code() ~= 200 then
	-- this will produce a 421 technical difficulties response
	error('failed to query hornetsecurity: ' .. scanresult)
	end
	-- invalid json will produce a 421 technical difficulties response
	scanresult_json = kumo.serde.json_parse(scanresult)
	if modifymsg then
	for skey, svalue in pairs(scanresult_json) do
	msg:append_header('X-Hornet-' .. skey, svalue)
	end
	end
	return scanresult_json