1 /* $Cambridge: exim/src/src/malware.c,v 1.15 2006/07/06 14:19:50 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-???? */
10 /* Code for calling virus (malware) scanners. Called from acl.c. */
13 #ifdef WITH_CONTENT_SCAN
15 /* declaration of private routines */
16 int mksd_scan_packed(int sock
);
18 /* SHUT_WR seems to be undefined on Unixware? */
24 #define MALWARE_TIMEOUT 120
27 #define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
28 #define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
29 #define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
31 #define DERR_READ_ERR (1<<0) /* read error */
32 #define DERR_NOMEMORY (1<<2) /* no memory */
33 #define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
34 #define DERR_BAD_CALL (1<<15) /* wrong command */
36 /* Routine to check whether a system is big- or litte-endian.
37 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
38 Needed for proper kavdaemon implementation. Sigh. */
39 #define BIG_MY_ENDIAN 0
40 #define LITTLE_MY_ENDIAN 1
41 int test_byte_order(void);
42 int test_byte_order() {
43 short int word
= 0x0001;
44 char *byte
= (char *) &word
;
45 return(byte
[0] ? LITTLE_MY_ENDIAN
: BIG_MY_ENDIAN
);
48 uschar malware_name_buffer
[256];
51 int malware(uschar
**listptr
) {
53 uschar
*list
= *listptr
;
54 uschar
*av_scanner_work
= av_scanner
;
56 uschar scanner_name_buffer
[16];
57 uschar
*malware_regex
;
58 uschar malware_regex_buffer
[64];
59 uschar malware_regex_default
[] = ".+";
60 unsigned long mbox_size
;
66 /* make sure the eml mbox file is spooled up */
67 mbox_file
= spool_mbox(&mbox_size
);
68 if (mbox_file
== NULL
) {
69 /* error while spooling */
70 log_write(0, LOG_MAIN
|LOG_PANIC
,
71 "malware acl condition: error while creating mbox spool file");
74 /* none of our current scanners need the mbox
75 file as a stream, so we can close it right away */
76 (void)fclose(mbox_file
);
78 /* extract the malware regex to match against from the option list */
79 if ((malware_regex
= string_nextinlist(&list
, &sep
,
81 sizeof(malware_regex_buffer
))) != NULL
) {
83 /* parse 1st option */
84 if ( (strcmpic(malware_regex
,US
"false") == 0) ||
85 (Ustrcmp(malware_regex
,"0") == 0) ) {
86 /* explicitly no matching */
90 /* special cases (match anything except empty) */
91 if ( (strcmpic(malware_regex
,US
"true") == 0) ||
92 (Ustrcmp(malware_regex
,"*") == 0) ||
93 (Ustrcmp(malware_regex
,"1") == 0) ) {
94 malware_regex
= malware_regex_default
;
98 /* empty means "don't match anything" */
102 /* Reset sep that is set by previous string_nextinlist() call */
105 /* compile the regex, see if it works */
106 re
= pcre_compile(CS malware_regex
, PCRE_COPT
, (const char **)&rerror
, &roffset
, NULL
);
108 log_write(0, LOG_MAIN
|LOG_PANIC
,
109 "malware acl condition: regular expression error in '%s': %s at offset %d", malware_regex
, rerror
, roffset
);
113 /* if av_scanner starts with a dollar, expand it first */
114 if (*av_scanner
== '$') {
115 av_scanner_work
= expand_string(av_scanner
);
116 if (av_scanner_work
== NULL
) {
117 log_write(0, LOG_MAIN
|LOG_PANIC
,
118 "malware acl condition: av_scanner starts with $, but expansion failed: %s", expand_string_message
);
122 debug_printf("Expanded av_scanner global: %s\n", av_scanner_work
);
123 /* disable result caching in this case */
129 /* Do not scan twice. */
130 if (malware_ok
== 0) {
132 /* find the scanner type from the av_scanner option */
133 if ((scanner_name
= string_nextinlist(&av_scanner_work
, &sep
,
135 sizeof(scanner_name_buffer
))) == NULL
) {
136 /* no scanner given */
137 log_write(0, LOG_MAIN
|LOG_PANIC
,
138 "malware acl condition: av_scanner configuration variable is empty");
142 /* "drweb" scanner type ----------------------------------------------- */
143 /* v0.1 - added support for tcp sockets */
144 /* v0.0 - initial release -- support for unix sockets */
145 if (strcmpic(scanner_name
,US
"drweb") == 0) {
146 uschar
*drweb_options
;
147 uschar drweb_options_buffer
[1024];
148 uschar drweb_options_default
[] = "/usr/local/drweb/run/drwebd.sock";
149 struct sockaddr_un server
;
150 int sock
, result
, ovector
[30];
151 unsigned int port
, fsize
;
152 uschar tmpbuf
[1024], *drweb_fbuf
;
153 uschar scanrequest
[1024];
154 uschar drweb_match_string
[128];
155 int drweb_rc
, drweb_cmd
, drweb_flags
= 0x0000, drweb_fd
,
156 drweb_vnum
, drweb_slen
, drweb_fin
= 0x0000;
158 uschar hostname
[256];
163 if ((drweb_options
= string_nextinlist(&av_scanner_work
, &sep
,
164 drweb_options_buffer
, sizeof(drweb_options_buffer
))) == NULL
) {
165 /* no options supplied, use default options */
166 drweb_options
= drweb_options_default
;
169 if (*drweb_options
!= '/') {
171 /* extract host and port part */
172 if( sscanf(CS drweb_options
, "%s %u", hostname
, &port
) != 2 ) {
173 log_write(0, LOG_MAIN
|LOG_PANIC
,
174 "malware acl condition: drweb: invalid socket '%s'", drweb_options
);
178 /* Lookup the host */
179 if((he
= gethostbyname(CS hostname
)) == 0) {
180 log_write(0, LOG_MAIN
|LOG_PANIC
,
181 "malware acl condition: drweb: failed to lookup host '%s'", hostname
);
185 in
= *(struct in_addr
*) he
->h_addr_list
[0];
187 /* Open the drwebd TCP socket */
188 if ( (sock
= ip_socket(SOCK_STREAM
, AF_INET
)) < 0) {
189 log_write(0, LOG_MAIN
|LOG_PANIC
,
190 "malware acl condition: drweb: unable to acquire socket (%s)",
195 if (ip_connect(sock
, AF_INET
, (uschar
*)inet_ntoa(in
), port
, 5) < 0) {
197 log_write(0, LOG_MAIN
|LOG_PANIC
,
198 "malware acl condition: drweb: connection to %s, port %u failed (%s)",
199 inet_ntoa(in
), port
, strerror(errno
));
203 /* prepare variables */
204 drweb_cmd
= htonl(DRWEBD_SCAN_CMD
);
205 drweb_flags
= htonl(DRWEBD_RETURN_VIRUSES
| DRWEBD_IS_MAIL
);
206 (void)string_format(scanrequest
, 1024,CS
"%s/scan/%s/%s.eml",
207 spool_directory
, message_id
, message_id
);
210 drweb_fd
= open(CS scanrequest
, O_RDONLY
);
211 if (drweb_fd
== -1) {
213 log_write(0, LOG_MAIN
|LOG_PANIC
,
214 "malware acl condition: drweb: can't open spool file %s: %s",
215 scanrequest
, strerror(errno
));
218 fsize
= lseek(drweb_fd
, 0, SEEK_END
);
221 (void)close(drweb_fd
);
222 log_write(0, LOG_MAIN
|LOG_PANIC
,
223 "malware acl condition: drweb: can't seek spool file %s: %s",
224 scanrequest
, strerror(errno
));
227 drweb_slen
= htonl(fsize
);
228 lseek(drweb_fd
, 0, SEEK_SET
);
230 /* send scan request */
231 if ((send(sock
, &drweb_cmd
, sizeof(drweb_cmd
), 0) < 0) ||
232 (send(sock
, &drweb_flags
, sizeof(drweb_flags
), 0) < 0) ||
233 (send(sock
, &drweb_fin
, sizeof(drweb_fin
), 0) < 0) ||
234 (send(sock
, &drweb_slen
, sizeof(drweb_slen
), 0) < 0)) {
236 (void)close(drweb_fd
);
237 log_write(0, LOG_MAIN
|LOG_PANIC
,
238 "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options
);
242 drweb_fbuf
= (uschar
*) malloc (fsize
);
245 (void)close(drweb_fd
);
246 log_write(0, LOG_MAIN
|LOG_PANIC
,
247 "malware acl condition: drweb: unable to allocate memory %u for file (%s)",
252 result
= read (drweb_fd
, drweb_fbuf
, fsize
);
255 (void)close(drweb_fd
);
257 log_write(0, LOG_MAIN
|LOG_PANIC
,
258 "malware acl condition: drweb: can't read spool file %s: %s",
259 scanrequest
, strerror(errno
));
262 (void)close(drweb_fd
);
264 /* send file body to socket */
265 if (send(sock
, drweb_fbuf
, fsize
, 0) < 0) {
268 log_write(0, LOG_MAIN
|LOG_PANIC
,
269 "malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options
);
272 (void)close(drweb_fd
);
275 /* open the drwebd UNIX socket */
276 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
278 log_write(0, LOG_MAIN
|LOG_PANIC
,
279 "malware acl condition: drweb: can't open UNIX socket");
282 server
.sun_family
= AF_UNIX
;
283 Ustrcpy(server
.sun_path
, drweb_options
);
284 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
286 log_write(0, LOG_MAIN
|LOG_PANIC
,
287 "malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options
, errno
);
291 /* prepare variables */
292 drweb_cmd
= htonl(DRWEBD_SCAN_CMD
);
293 drweb_flags
= htonl(DRWEBD_RETURN_VIRUSES
| DRWEBD_IS_MAIL
);
294 (void)string_format(scanrequest
, 1024,CS
"%s/scan/%s/%s.eml", spool_directory
, message_id
, message_id
);
295 drweb_slen
= htonl(Ustrlen(scanrequest
));
297 /* send scan request */
298 if ((send(sock
, &drweb_cmd
, sizeof(drweb_cmd
), 0) < 0) ||
299 (send(sock
, &drweb_flags
, sizeof(drweb_flags
), 0) < 0) ||
300 (send(sock
, &drweb_slen
, sizeof(drweb_slen
), 0) < 0) ||
301 (send(sock
, scanrequest
, Ustrlen(scanrequest
), 0) < 0) ||
302 (send(sock
, &drweb_fin
, sizeof(drweb_fin
), 0) < 0)) {
304 log_write(0, LOG_MAIN
|LOG_PANIC
,
305 "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options
);
310 /* wait for result */
311 if ((bread
= recv(sock
, &drweb_rc
, sizeof(drweb_rc
), 0) != sizeof(drweb_rc
))) {
313 log_write(0, LOG_MAIN
|LOG_PANIC
,
314 "malware acl condition: drweb: unable to read return code");
317 drweb_rc
= ntohl(drweb_rc
);
319 if ((bread
= recv(sock
, &drweb_vnum
, sizeof(drweb_vnum
), 0) != sizeof(drweb_vnum
))) {
321 log_write(0, LOG_MAIN
|LOG_PANIC
,
322 "malware acl condition: drweb: unable to read the number of viruses");
325 drweb_vnum
= ntohl(drweb_vnum
);
327 /* "virus(es) found" if virus number is > 0 */
331 uschar pre_malware_nb
[256];
333 malware_name
= malware_name_buffer
;
335 /* setup default virus name */
336 Ustrcpy(malware_name_buffer
,"unknown");
338 /* read and concatenate virus names into one string */
339 for (i
=0;i
<drweb_vnum
;i
++)
341 /* read the size of report */
342 if ((bread
= recv(sock
, &drweb_slen
, sizeof(drweb_slen
), 0) != sizeof(drweb_slen
))) {
344 log_write(0, LOG_MAIN
|LOG_PANIC
,
345 "malware acl condition: drweb: cannot read report size");
348 drweb_slen
= ntohl(drweb_slen
);
350 /* read report body */
351 if ((bread
= recv(sock
, tmpbuf
, drweb_slen
, 0)) != drweb_slen
) {
353 log_write(0, LOG_MAIN
|LOG_PANIC
,
354 "malware acl condition: drweb: cannot read report string");
357 tmpbuf
[drweb_slen
] = '\0';
359 /* set up match regex, depends on retcode */
360 Ustrcpy(drweb_match_string
, "infected\\swith\\s*(.+?)$");
362 drweb_re
= pcre_compile( CS drweb_match_string
,
364 (const char **)&rerror
,
368 /* try matcher on the line, grab substring */
369 result
= pcre_exec(drweb_re
, NULL
, CS tmpbuf
, Ustrlen(tmpbuf
), 0, 0, ovector
, 30);
371 pcre_copy_substring(CS tmpbuf
, ovector
, result
, 1, CS pre_malware_nb
, 255);
373 /* the first name we just copy to malware_name */
375 Ustrcpy(CS malware_name_buffer
, CS pre_malware_nb
);
377 /* concatenate each new virus name to previous */
378 int slen
= Ustrlen(malware_name_buffer
);
379 if (slen
< (slen
+Ustrlen(pre_malware_nb
))) {
380 Ustrcat(malware_name_buffer
, "/");
381 Ustrcat(malware_name_buffer
, pre_malware_nb
);
387 char *drweb_s
= NULL
;
389 if (drweb_rc
& DERR_READ_ERR
) drweb_s
= "read error";
390 if (drweb_rc
& DERR_NOMEMORY
) drweb_s
= "no memory";
391 if (drweb_rc
& DERR_TIMEOUT
) drweb_s
= "timeout";
392 if (drweb_rc
& DERR_BAD_CALL
) drweb_s
= "wrong command";
393 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
394 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
395 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
396 * and others are ignored */
398 log_write(0, LOG_MAIN
|LOG_PANIC
,
399 "malware acl condition: drweb: drweb daemon retcode 0x%x (%s)", drweb_rc
, drweb_s
);
408 /* ----------------------------------------------------------------------- */
409 else if (strcmpic(scanner_name
,US
"aveserver") == 0) {
411 uschar kav_options_buffer
[1024];
412 uschar kav_options_default
[] = "/var/run/aveserver";
414 struct sockaddr_un server
;
418 if ((kav_options
= string_nextinlist(&av_scanner_work
, &sep
,
420 sizeof(kav_options_buffer
))) == NULL
) {
421 /* no options supplied, use default options */
422 kav_options
= kav_options_default
;
425 /* open the aveserver socket */
426 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
428 log_write(0, LOG_MAIN
|LOG_PANIC
,
429 "malware acl condition: can't open UNIX socket.");
432 server
.sun_family
= AF_UNIX
;
433 Ustrcpy(server
.sun_path
, kav_options
);
434 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
436 log_write(0, LOG_MAIN
|LOG_PANIC
,
437 "malware acl condition: unable to connect to aveserver UNIX socket (%s). errno=%d", kav_options
, errno
);
441 /* read aveserver's greeting and see if it is ready (2xx greeting) */
442 recv_line(sock
, buf
, 32768);
445 /* aveserver is having problems */
447 log_write(0, LOG_MAIN
|LOG_PANIC
,
448 "malware acl condition: aveserver is unavailable (Responded: %s).", ((buf
[0] != 0) ? buf
: (uschar
*)"nothing") );
452 /* prepare our command */
453 (void)string_format(buf
, 32768, "SCAN bPQRSTUW %s/scan/%s/%s.eml\r\n", spool_directory
, message_id
, message_id
);
456 if (send(sock
, buf
, Ustrlen(buf
), 0) < 0) {
458 log_write(0, LOG_MAIN
|LOG_PANIC
,
459 "malware acl condition: unable to write to aveserver UNIX socket (%s)", kav_options
);
465 /* read response lines, find malware name and final response */
466 while (recv_line(sock
, buf
, 32768) > 0) {
467 debug_printf("aveserver: %s\n", buf
);
470 } else if (buf
[0] == '5') {
471 /* aveserver is having problems */
472 log_write(0, LOG_MAIN
|LOG_PANIC
,
473 "malware acl condition: unable to scan file %s/scan/%s/%s.eml (Responded: %s).",
474 spool_directory
, message_id
, message_id
, buf
);
477 } else if (Ustrncmp(buf
,"322",3) == 0) {
478 uschar
*p
= Ustrchr(&buf
[4],' ');
480 Ustrcpy(malware_name_buffer
,&buf
[4]);
481 malware_name
= malware_name_buffer
;
485 /* prepare our command */
486 (void)string_format(buf
, 32768, "quit\r\n");
489 if (send(sock
, buf
, Ustrlen(buf
), 0) < 0) {
491 log_write(0, LOG_MAIN
|LOG_PANIC
,
492 "malware acl condition: unable to write to aveserver UNIX socket (%s)", kav_options
);
496 /* read aveserver's greeting and see if it is ready (2xx greeting) */
497 recv_line(sock
, buf
, 32768);
500 /* aveserver is having problems */
502 log_write(0, LOG_MAIN
|LOG_PANIC
,
503 "malware acl condition: unable to quit aveserver dialogue (Responded: %s).", ((buf
[0] != 0) ? buf
: (uschar
*)"nothing") );
509 if (result
== DEFER
) return DEFER
;
511 /* "fsecure" scanner type ------------------------------------------------- */
512 else if (strcmpic(scanner_name
,US
"fsecure") == 0) {
513 uschar
*fsecure_options
;
514 uschar fsecure_options_buffer
[1024];
515 uschar fsecure_options_default
[] = "/var/run/.fsav";
516 struct sockaddr_un server
;
517 int sock
, i
, j
, bread
= 0;
518 uschar file_name
[1024];
519 uschar av_buffer
[1024];
521 static uschar
*cmdoptions
[] = { US
"CONFIGURE\tARCHIVE\t1\n",
522 US
"CONFIGURE\tTIMEOUT\t0\n",
523 US
"CONFIGURE\tMAXARCH\t5\n",
524 US
"CONFIGURE\tMIME\t1\n" };
527 if ((fsecure_options
= string_nextinlist(&av_scanner_work
, &sep
,
528 fsecure_options_buffer
,
529 sizeof(fsecure_options_buffer
))) == NULL
) {
530 /* no options supplied, use default options */
531 fsecure_options
= fsecure_options_default
;
534 /* open the fsecure socket */
535 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
537 log_write(0, LOG_MAIN
|LOG_PANIC
,
538 "malware acl condition: unable to open fsecure socket %s (%s)",
539 fsecure_options
, strerror(errno
));
542 server
.sun_family
= AF_UNIX
;
543 Ustrcpy(server
.sun_path
, fsecure_options
);
544 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
546 log_write(0, LOG_MAIN
|LOG_PANIC
,
547 "malware acl condition: unable to connect to fsecure socket %s (%s)",
548 fsecure_options
, strerror(errno
));
553 memset(av_buffer
, 0, sizeof(av_buffer
));
554 for (i
=0; i
!= 4; i
++) {
555 /* debug_printf("send option \"%s\"",cmdoptions[i]); */
556 if (write(sock
, cmdoptions
[i
], Ustrlen(cmdoptions
[i
])) < 0) {
558 log_write(0, LOG_MAIN
|LOG_PANIC
,
559 "malware acl condition: unable to write fsecure option %d to %s (%s)",
560 i
, fsecure_options
, strerror(errno
));
564 bread
= ip_recv(sock
, av_buffer
, sizeof(av_buffer
), MALWARE_TIMEOUT
);
565 if (bread
>0) av_buffer
[bread
]='\0';
568 log_write(0, LOG_MAIN
|LOG_PANIC
,
569 "malware acl condition: unable to read fsecure answer %d (%s)", i
, strerror(errno
));
572 for (j
=0;j
<bread
;j
++) if((av_buffer
[j
]=='\r')||(av_buffer
[j
]=='\n')) av_buffer
[j
] ='@';
573 /* debug_printf("read answer %d read=%d \"%s\"\n", i, bread, av_buffer ); */
574 /* while (Ustrstr(av_buffer, "OK\tServer configured.@") == NULL); */
577 /* pass the mailfile to fsecure */
578 (void)string_format(file_name
,1024,"SCAN\t%s/scan/%s/%s.eml\n", spool_directory
, message_id
, message_id
);
579 /* debug_printf("send scan %s",file_name); */
580 if (write(sock
, file_name
, Ustrlen(file_name
)) < 0) {
582 log_write(0, LOG_MAIN
|LOG_PANIC
,
583 "malware acl condition: unable to write fsecure scan to %s (%s)",
584 fsecure_options
, strerror(errno
));
589 /* todo also SUSPICION\t */
590 fs_inf
= pcre_compile("\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$", PCRE_COPT
, (const char **)&rerror
, &roffset
, NULL
);
592 /* read report, linewise */
596 memset(av_buffer
, 0, sizeof(av_buffer
));
598 bread
=ip_recv(sock
, &av_buffer
[i
], 1, MALWARE_TIMEOUT
);
601 log_write(0, LOG_MAIN
|LOG_PANIC
,
602 "malware acl condition: unable to read fsecure result (%s)", strerror(errno
));
607 while ((i
< sizeof(av_buffer
)-1 ) && (av_buffer
[i
-1] != '\n'));
608 av_buffer
[i
-1] = '\0';
609 /* debug_printf("got line \"%s\"\n",av_buffer); */
611 /* Really search for virus again? */
612 if (malware_name
== NULL
) {
613 /* try matcher on the line, grab substring */
614 i
= pcre_exec(fs_inf
, NULL
, CS av_buffer
, Ustrlen(av_buffer
), 0, 0, ovector
, 30);
617 pcre_copy_substring(CS av_buffer
, ovector
, i
, 1, CS malware_name_buffer
, 255);
618 malware_name
= malware_name_buffer
;
622 while (Ustrstr(av_buffer
, "OK\tScan ok.") == NULL
);
625 /* ----------------------------------------------------------------------- */
627 /* "kavdaemon" scanner type ------------------------------------------------ */
628 else if (strcmpic(scanner_name
,US
"kavdaemon") == 0) {
630 uschar kav_options_buffer
[1024];
631 uschar kav_options_default
[] = "/var/run/AvpCtl";
632 struct sockaddr_un server
;
636 uschar scanrequest
[1024];
637 uschar kav_match_string
[128];
639 unsigned long kav_reportlen
, bread
;
642 if ((kav_options
= string_nextinlist(&av_scanner_work
, &sep
,
644 sizeof(kav_options_buffer
))) == NULL
) {
645 /* no options supplied, use default options */
646 kav_options
= kav_options_default
;
649 /* open the kavdaemon socket */
650 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
652 log_write(0, LOG_MAIN
|LOG_PANIC
,
653 "malware acl condition: can't open UNIX socket.");
656 server
.sun_family
= AF_UNIX
;
657 Ustrcpy(server
.sun_path
, kav_options
);
658 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
660 log_write(0, LOG_MAIN
|LOG_PANIC
,
661 "malware acl condition: unable to connect to kavdaemon UNIX socket (%s). errno=%d", kav_options
, errno
);
665 /* get current date and time, build scan request */
667 strftime(CS tmpbuf
, sizeof(tmpbuf
), "<0>%d %b %H:%M:%S:%%s/scan/%%s", localtime(&t
));
668 (void)string_format(scanrequest
, 1024,CS tmpbuf
, spool_directory
, message_id
);
670 /* send scan request */
671 if (send(sock
, scanrequest
, Ustrlen(scanrequest
)+1, 0) < 0) {
673 log_write(0, LOG_MAIN
|LOG_PANIC
,
674 "malware acl condition: unable to write to kavdaemon UNIX socket (%s)", kav_options
);
678 /* wait for result */
679 if ((bread
= recv(sock
, tmpbuf
, 2, 0) != 2)) {
681 log_write(0, LOG_MAIN
|LOG_PANIC
,
682 "malware acl condition: unable to read 2 bytes from kavdaemon socket.");
686 /* get errorcode from one nibble */
687 if (test_byte_order() == LITTLE_MY_ENDIAN
) {
688 kav_rc
= tmpbuf
[0] & 0x0F;
691 kav_rc
= tmpbuf
[1] & 0x0F;
694 /* improper kavdaemon configuration */
695 if ( (kav_rc
== 5) || (kav_rc
== 6) ) {
697 log_write(0, LOG_MAIN
|LOG_PANIC
,
698 "malware acl condition: please reconfigure kavdaemon to NOT disinfect or remove infected files.");
704 log_write(0, LOG_MAIN
|LOG_PANIC
,
705 "malware acl condition: kavdaemon reported 'scanning not completed' (code 1).");
711 log_write(0, LOG_MAIN
|LOG_PANIC
,
712 "malware acl condition: kavdaemon reported 'kavdaemon damaged' (code 7).");
716 /* code 8 is not handled, since it is ambigous. It appears mostly on
717 bounces where part of a file has been cut off */
719 /* "virus found" return codes (2-4) */
720 if ((kav_rc
> 1) && (kav_rc
< 5)) {
723 /* setup default virus name */
724 Ustrcpy(malware_name_buffer
,"unknown");
725 malware_name
= malware_name_buffer
;
727 if (test_byte_order() == LITTLE_MY_ENDIAN
) {
728 report_flag
= tmpbuf
[1];
731 report_flag
= tmpbuf
[0];
734 /* read the report, if available */
735 if( report_flag
== 1 ) {
736 /* read report size */
737 if ((bread
= recv(sock
, &kav_reportlen
, 4, 0)) != 4) {
739 log_write(0, LOG_MAIN
|LOG_PANIC
,
740 "malware acl condition: cannot read report size from kavdaemon");
744 /* it's possible that avp returns av_buffer[1] == 1 but the
745 reportsize is 0 (!?) */
746 if (kav_reportlen
> 0) {
747 /* set up match regex, depends on retcode */
749 Ustrcpy(kav_match_string
, "suspicion:\\s*(.+?)\\s*$");
751 Ustrcpy(kav_match_string
, "infected:\\s*(.+?)\\s*$");
753 kav_re
= pcre_compile( CS kav_match_string
,
755 (const char **)&rerror
,
759 /* read report, linewise */
760 while (kav_reportlen
> 0) {
765 while ( recv(sock
, &tmpbuf
[bread
], 1, 0) == 1 ) {
767 if ( (tmpbuf
[bread
] == '\n') || (bread
> 1021) ) break;
771 tmpbuf
[bread
] = '\0';
773 /* try matcher on the line, grab substring */
774 result
= pcre_exec(kav_re
, NULL
, CS tmpbuf
, Ustrlen(tmpbuf
), 0, 0, ovector
, 30);
776 pcre_copy_substring(CS tmpbuf
, ovector
, result
, 1, CS malware_name_buffer
, 255);
790 /* ----------------------------------------------------------------------- */
793 /* "cmdline" scanner type ------------------------------------------------ */
794 else if (strcmpic(scanner_name
,US
"cmdline") == 0) {
795 uschar
*cmdline_scanner
;
796 uschar cmdline_scanner_buffer
[1024];
797 uschar
*cmdline_trigger
;
798 uschar cmdline_trigger_buffer
[1024];
799 const pcre
*cmdline_trigger_re
;
800 uschar
*cmdline_regex
;
801 uschar cmdline_regex_buffer
[1024];
802 const pcre
*cmdline_regex_re
;
803 uschar file_name
[1024];
804 uschar commandline
[1024];
805 void (*eximsigchld
)(int);
806 void (*eximsigpipe
)(int);
807 FILE *scanner_out
= NULL
;
808 FILE *scanner_record
= NULL
;
809 uschar linebuffer
[32767];
814 /* find scanner command line */
815 if ((cmdline_scanner
= string_nextinlist(&av_scanner_work
, &sep
,
816 cmdline_scanner_buffer
,
817 sizeof(cmdline_scanner_buffer
))) == NULL
) {
818 /* no command line supplied */
819 log_write(0, LOG_MAIN
|LOG_PANIC
,
820 "malware acl condition: missing commandline specification for cmdline scanner type.");
824 /* find scanner output trigger */
825 if ((cmdline_trigger
= string_nextinlist(&av_scanner_work
, &sep
,
826 cmdline_trigger_buffer
,
827 sizeof(cmdline_trigger_buffer
))) == NULL
) {
828 /* no trigger regex supplied */
829 log_write(0, LOG_MAIN
|LOG_PANIC
,
830 "malware acl condition: missing trigger specification for cmdline scanner type.");
834 /* precompile trigger regex */
835 cmdline_trigger_re
= pcre_compile(CS cmdline_trigger
, PCRE_COPT
, (const char **)&rerror
, &roffset
, NULL
);
836 if (cmdline_trigger_re
== NULL
) {
837 log_write(0, LOG_MAIN
|LOG_PANIC
,
838 "malware acl condition: regular expression error in '%s': %s at offset %d", cmdline_trigger_re
, rerror
, roffset
);
842 /* find scanner name regex */
843 if ((cmdline_regex
= string_nextinlist(&av_scanner_work
, &sep
,
844 cmdline_regex_buffer
,
845 sizeof(cmdline_regex_buffer
))) == NULL
) {
846 /* no name regex supplied */
847 log_write(0, LOG_MAIN
|LOG_PANIC
,
848 "malware acl condition: missing virus name regex specification for cmdline scanner type.");
852 /* precompile name regex */
853 cmdline_regex_re
= pcre_compile(CS cmdline_regex
, PCRE_COPT
, (const char **)&rerror
, &roffset
, NULL
);
854 if (cmdline_regex_re
== NULL
) {
855 log_write(0, LOG_MAIN
|LOG_PANIC
,
856 "malware acl condition: regular expression error in '%s': %s at offset %d", cmdline_regex_re
, rerror
, roffset
);
860 /* prepare scanner call */
861 (void)string_format(file_name
,1024,"%s/scan/%s", spool_directory
, message_id
);
862 (void)string_format(commandline
,1024, CS cmdline_scanner
,file_name
);
863 /* redirect STDERR too */
864 Ustrcat(commandline
," 2>&1");
866 /* store exims signal handlers */
867 eximsigchld
= signal(SIGCHLD
,SIG_DFL
);
868 eximsigpipe
= signal(SIGPIPE
,SIG_DFL
);
870 scanner_out
= popen(CS commandline
,"r");
871 if (scanner_out
== NULL
) {
872 log_write(0, LOG_MAIN
|LOG_PANIC
,
873 "malware acl condition: calling cmdline scanner (%s) failed: %s.", commandline
, strerror(errno
));
874 signal(SIGCHLD
,eximsigchld
);
875 signal(SIGPIPE
,eximsigpipe
);
879 (void)string_format(file_name
,1024,"%s/scan/%s/%s_scanner_output", spool_directory
, message_id
, message_id
);
880 scanner_record
= modefopen(file_name
,"wb",SPOOL_MODE
);
882 if (scanner_record
== NULL
) {
883 log_write(0, LOG_MAIN
|LOG_PANIC
,
884 "malware acl condition: opening scanner output file (%s) failed: %s.", file_name
, strerror(errno
));
886 signal(SIGCHLD
,eximsigchld
);
887 signal(SIGPIPE
,eximsigpipe
);
891 /* look for trigger while recording output */
892 while(fgets(CS linebuffer
,32767,scanner_out
) != NULL
) {
893 if ( Ustrlen(linebuffer
) > fwrite(linebuffer
, 1, Ustrlen(linebuffer
), scanner_record
) ) {
895 log_write(0, LOG_MAIN
|LOG_PANIC
,
896 "malware acl condition: short write on scanner output file (%s).", file_name
);
898 signal(SIGCHLD
,eximsigchld
);
899 signal(SIGPIPE
,eximsigpipe
);
902 /* try trigger match */
903 if (!trigger
&& regex_match_and_setup(cmdline_trigger_re
, linebuffer
, 0, -1))
907 (void)fclose(scanner_record
);
909 signal(SIGCHLD
,eximsigchld
);
910 signal(SIGPIPE
,eximsigpipe
);
913 /* setup default virus name */
914 Ustrcpy(malware_name_buffer
,"unknown");
915 malware_name
= malware_name_buffer
;
917 /* re-open the scanner output file, look for name match */
918 scanner_record
= fopen(CS file_name
,"rb");
919 while(fgets(CS linebuffer
,32767,scanner_record
) != NULL
) {
921 result
= pcre_exec(cmdline_regex_re
, NULL
, CS linebuffer
, Ustrlen(linebuffer
), 0, 0, ovector
, 30);
923 pcre_copy_substring(CS linebuffer
, ovector
, result
, 1, CS malware_name_buffer
, 255);
926 (void)fclose(scanner_record
);
933 /* ----------------------------------------------------------------------- */
936 /* "sophie" scanner type ------------------------------------------------- */
937 else if (strcmpic(scanner_name
,US
"sophie") == 0) {
938 uschar
*sophie_options
;
939 uschar sophie_options_buffer
[1024];
940 uschar sophie_options_default
[] = "/var/run/sophie";
942 struct sockaddr_un server
;
944 uschar file_name
[1024];
945 uschar av_buffer
[1024];
947 if ((sophie_options
= string_nextinlist(&av_scanner_work
, &sep
,
948 sophie_options_buffer
,
949 sizeof(sophie_options_buffer
))) == NULL
) {
950 /* no options supplied, use default options */
951 sophie_options
= sophie_options_default
;
954 /* open the sophie socket */
955 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
957 log_write(0, LOG_MAIN
|LOG_PANIC
,
958 "malware acl condition: can't open UNIX socket.");
961 server
.sun_family
= AF_UNIX
;
962 Ustrcpy(server
.sun_path
, sophie_options
);
963 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
965 log_write(0, LOG_MAIN
|LOG_PANIC
,
966 "malware acl condition: unable to connect to sophie UNIX socket (%s). errno=%d", sophie_options
, errno
);
970 /* pass the scan directory to sophie */
971 (void)string_format(file_name
,1024,"%s/scan/%s", spool_directory
, message_id
);
972 if (write(sock
, file_name
, Ustrlen(file_name
)) < 0) {
974 log_write(0, LOG_MAIN
|LOG_PANIC
,
975 "malware acl condition: unable to write to sophie UNIX socket (%s)", sophie_options
);
979 (void)write(sock
, "\n", 1);
981 /* wait for result */
982 memset(av_buffer
, 0, sizeof(av_buffer
));
983 if ((!(bread
= ip_recv(sock
, av_buffer
, sizeof(av_buffer
), MALWARE_TIMEOUT
)) > 0)) {
985 log_write(0, LOG_MAIN
|LOG_PANIC
,
986 "malware acl condition: unable to read from sophie UNIX socket (%s)", sophie_options
);
993 if (av_buffer
[0] == '1') {
994 if (Ustrchr(av_buffer
, '\n')) *Ustrchr(av_buffer
, '\n') = '\0';
995 Ustrcpy(malware_name_buffer
,&av_buffer
[2]);
996 malware_name
= malware_name_buffer
;
998 else if (!strncmp(CS av_buffer
, "-1", 2)) {
999 log_write(0, LOG_MAIN
|LOG_PANIC
,
1000 "malware acl condition: malware acl condition: sophie reported error");
1004 /* all ok, no virus */
1005 malware_name
= NULL
;
1008 /* ----------------------------------------------------------------------- */
1011 /* "clamd" scanner type ------------------------------------------------- */
1012 /* This code was contributed by David Saez */
1013 else if (strcmpic(scanner_name
,US
"clamd") == 0) {
1014 uschar
*clamd_options
;
1015 uschar clamd_options_buffer
[1024];
1016 uschar clamd_options_default
[] = "/tmp/clamd";
1018 struct sockaddr_un server
;
1021 uschar file_name
[1024];
1022 uschar av_buffer
[1024];
1023 uschar hostname
[256];
1026 uschar
*clamd_options2
;
1027 uschar clamd_options2_buffer
[1024];
1028 uschar clamd_options2_default
[] = "";
1029 uschar av_buffer2
[1024];
1030 uschar
*clamav_fbuf
;
1031 uschar scanrequest
[1024];
1032 int sockData
, clam_fd
, result
;
1035 if ((clamd_options
= string_nextinlist(&av_scanner_work
, &sep
,
1036 clamd_options_buffer
,
1037 sizeof(clamd_options_buffer
))) == NULL
) {
1038 /* no options supplied, use default options */
1039 clamd_options
= clamd_options_default
;
1041 if ((clamd_options2
= string_nextinlist(&av_scanner_work
, &sep
,
1042 clamd_options2_buffer
,
1043 sizeof(clamd_options2_buffer
))) == NULL
) {
1044 clamd_options2
= clamd_options2_default
;
1047 /* socket does not start with '/' -> network socket */
1048 if (*clamd_options
!= '/') {
1050 /* extract host and port part */
1051 if( sscanf(CS clamd_options
, "%s %u", hostname
, &port
) != 2 ) {
1052 log_write(0, LOG_MAIN
|LOG_PANIC
,
1053 "malware acl condition: clamd: invalid socket '%s'", clamd_options
);
1057 /* Lookup the host */
1058 if((he
= gethostbyname(CS hostname
)) == 0) {
1059 log_write(0, LOG_MAIN
|LOG_PANIC
,
1060 "malware acl condition: clamd: failed to lookup host '%s'", hostname
);
1064 in
= *(struct in_addr
*) he
->h_addr_list
[0];
1066 /* Open the ClamAV Socket */
1067 if ( (sock
= ip_socket(SOCK_STREAM
, AF_INET
)) < 0) {
1068 log_write(0, LOG_MAIN
|LOG_PANIC
,
1069 "malware acl condition: clamd: unable to acquire socket (%s)",
1074 if (ip_connect(sock
, AF_INET
, (uschar
*)inet_ntoa(in
), port
, 5) < 0) {
1076 log_write(0, LOG_MAIN
|LOG_PANIC
,
1077 "malware acl condition: clamd: connection to %s, port %u failed (%s)",
1078 inet_ntoa(in
), port
, strerror(errno
));
1082 if (strcmpic(clamd_options2
,US
"local") == 0) {
1084 /* Pass the string to ClamAV (7 = "SCAN \n" + \0) */
1086 (void)string_format(file_name
,1024,"SCAN %s/scan/%s\n", spool_directory
, message_id
);
1088 if (send(sock
, file_name
, Ustrlen(file_name
), 0) < 0) {
1090 log_write(0, LOG_MAIN
|LOG_PANIC
,"malware acl condition: clamd: unable to write to socket (%s)",
1096 /* Pass the string to ClamAV (7 = "STREAM\n") */
1098 if (send(sock
, "STREAM\n", 7, 0) < 0) {
1100 log_write(0, LOG_MAIN
|LOG_PANIC
,"malware acl condition: clamd: unable to write to socket (%s)",
1104 memset(av_buffer2
, 0, sizeof(av_buffer2
));
1105 bread
= ip_recv(sock
, av_buffer2
, sizeof(av_buffer2
), MALWARE_TIMEOUT
);
1108 log_write(0, LOG_MAIN
|LOG_PANIC
,
1109 "malware acl condition: clamd: unable to read PORT from socket (%s)",
1114 if (bread
== sizeof(av_buffer
)) {
1115 log_write(0, LOG_MAIN
|LOG_PANIC
,
1116 "malware acl condition: clamd: buffer too small");
1120 if (!(*av_buffer2
)) {
1121 log_write(0, LOG_MAIN
|LOG_PANIC
,
1122 "malware acl condition: clamd: ClamAV returned null");
1126 av_buffer2
[bread
] = '\0';
1127 if( sscanf(CS av_buffer2
, "PORT %u\n", &port
) != 1 ) {
1128 log_write(0, LOG_MAIN
|LOG_PANIC
,
1129 "malware acl condition: clamd: Expected port information from clamd, got '%s'", av_buffer2
);
1133 if ( (sockData
= ip_socket(SOCK_STREAM
, AF_INET
)) < 0) {
1134 log_write(0, LOG_MAIN
|LOG_PANIC
,
1135 "malware acl condition: clamd: unable to acquire socket (%s)",
1140 if (ip_connect(sockData
, AF_INET
, (uschar
*)inet_ntoa(in
), port
, 5) < 0) {
1141 (void)close(sockData
);
1142 log_write(0, LOG_MAIN
|LOG_PANIC
,
1143 "malware acl condition: clamd: connection to %s, port %u failed (%s)",
1144 inet_ntoa(in
), port
, strerror(errno
));
1148 (void)string_format(scanrequest
, 1024,CS
"%s/scan/%s/%s.eml",
1149 spool_directory
, message_id
, message_id
);
1151 /* calc file size */
1152 clam_fd
= open(CS scanrequest
, O_RDONLY
);
1153 if (clam_fd
== -1) {
1154 log_write(0, LOG_MAIN
|LOG_PANIC
,
1155 "malware acl condition: clamd: can't open spool file %s: %s",
1156 scanrequest
, strerror(errno
));
1159 fsize
= lseek(clam_fd
, 0, SEEK_END
);
1161 log_write(0, LOG_MAIN
|LOG_PANIC
,
1162 "malware acl condition: clamd: can't seek spool file %s: %s",
1163 scanrequest
, strerror(errno
));
1166 lseek(clam_fd
, 0, SEEK_SET
);
1168 clamav_fbuf
= (uschar
*) malloc (fsize
);
1170 (void)close(sockData
);
1171 (void)close(clam_fd
);
1172 log_write(0, LOG_MAIN
|LOG_PANIC
,
1173 "malware acl condition: clamd: unable to allocate memory %u for file (%s)",
1174 fsize
, scanrequest
);
1178 result
= read (clam_fd
, clamav_fbuf
, fsize
);
1180 (void)close(sockData
);
1181 (void)close(clam_fd
);
1183 log_write(0, LOG_MAIN
|LOG_PANIC
,
1184 "malware acl condition: clamd: can't read spool file %s: %s",
1185 scanrequest
, strerror(errno
));
1188 (void)close(clam_fd
);
1190 /* send file body to socket */
1191 if (send(sockData
, clamav_fbuf
, fsize
, 0) < 0) {
1192 (void)close(sockData
);
1194 log_write(0, LOG_MAIN
|LOG_PANIC
,
1195 "malware acl condition: clamd: unable to send file body to socket (%s:%u)", hostname
, port
);
1199 (void)close(sockData
);
1203 /* open the local socket */
1204 if ((sock
= socket(AF_UNIX
, SOCK_STREAM
, 0)) < 0) {
1205 log_write(0, LOG_MAIN
|LOG_PANIC
,
1206 "malware acl condition: clamd: unable to acquire socket (%s)",
1211 server
.sun_family
= AF_UNIX
;
1212 Ustrcpy(server
.sun_path
, clamd_options
);
1214 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
1216 log_write(0, LOG_MAIN
|LOG_PANIC
,
1217 "malware acl condition: clamd: unable to connect to UNIX socket %s (%s)",
1218 clamd_options
, strerror(errno
) );
1223 /* Pass the string to ClamAV (7 = "SCAN \n" + \0) */
1225 (void)string_format(file_name
,1024,"SCAN %s/scan/%s\n", spool_directory
, message_id
);
1227 if (send(sock
, file_name
, Ustrlen(file_name
), 0) < 0) {
1229 log_write(0, LOG_MAIN
|LOG_PANIC
,"malware acl condition: clamd: unable to write to socket (%s)",
1235 We're done sending, close socket for writing.
1237 One user reported that clamd 0.70 does not like this any more ...
1241 /* shutdown(sock, SHUT_WR); */
1243 /* Read the result */
1244 memset(av_buffer
, 0, sizeof(av_buffer
));
1245 bread
= ip_recv(sock
, av_buffer
, sizeof(av_buffer
), MALWARE_TIMEOUT
);
1249 log_write(0, LOG_MAIN
|LOG_PANIC
,
1250 "malware acl condition: clamd: unable to read from socket (%s)",
1255 if (bread
== sizeof(av_buffer
)) {
1256 log_write(0, LOG_MAIN
|LOG_PANIC
,
1257 "malware acl condition: clamd: buffer too small");
1261 /* Check the result. ClamAV Returns
1262 infected: -> "<filename>: <virusname> FOUND"
1263 not-infected: -> "<filename>: OK"
1264 error: -> "<filename>: <errcode> ERROR */
1266 if (!(*av_buffer
)) {
1267 log_write(0, LOG_MAIN
|LOG_PANIC
,
1268 "malware acl condition: clamd: ClamAV returned null");
1272 /* strip newline at the end */
1273 p
= av_buffer
+ Ustrlen(av_buffer
) - 1;
1274 if( *p
== '\n' ) *p
= '\0';
1276 /* colon in returned output? */
1277 if((p
= Ustrrchr(av_buffer
,':')) == NULL
) {
1278 log_write(0, LOG_MAIN
|LOG_PANIC
,
1279 "malware acl condition: clamd: ClamAV returned malformed result: %s",
1284 /* strip filename */
1286 while (*p
== ' ') ++p
;
1288 if ((p
= Ustrstr(vname
, "FOUND"))!=NULL
) {
1290 for (--p
;p
>vname
&& *p
<=32;p
--) *p
=0;
1291 for (;*vname
==32;vname
++);
1292 Ustrcpy(malware_name_buffer
,vname
);
1293 malware_name
= malware_name_buffer
;
1296 if (Ustrstr(vname
, "ERROR")!=NULL
) {
1297 /* ClamAV reports ERROR
1299 for (;*vname
!='\n' && vname
>av_buffer
; vname
--);
1300 if (*vname
=='\n') vname
++;
1302 log_write(0, LOG_MAIN
|LOG_PANIC
,
1303 "malware acl condition: clamd: ClamAV returned %s",vname
);
1307 /* Everything should be OK */
1308 malware_name
= NULL
;
1312 /* ----------------------------------------------------------------------- */
1315 /* "mksd" scanner type --------------------------------------------------- */
1316 else if (strcmpic(scanner_name
,US
"mksd") == 0) {
1317 uschar
*mksd_options
;
1318 char *mksd_options_end
;
1319 uschar mksd_options_buffer
[32];
1320 int mksd_maxproc
= 1; /* default, if no option supplied */
1321 struct sockaddr_un server
;
1325 if ((mksd_options
= string_nextinlist(&av_scanner_work
, &sep
,
1326 mksd_options_buffer
,
1327 sizeof(mksd_options_buffer
))) != NULL
) {
1328 mksd_maxproc
= (int) strtol(CS mksd_options
, &mksd_options_end
, 10);
1329 if ((*mksd_options
== '\0') || (*mksd_options_end
!= '\0') ||
1330 (mksd_maxproc
< 1) || (mksd_maxproc
> 32)) {
1331 log_write(0, LOG_MAIN
|LOG_PANIC
,
1332 "malware acl condition: mksd: invalid option '%s'", mksd_options
);
1337 /* open the mksd socket */
1338 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
1340 log_write(0, LOG_MAIN
|LOG_PANIC
,
1341 "malware acl condition: can't open UNIX socket.");
1344 server
.sun_family
= AF_UNIX
;
1345 Ustrcpy(server
.sun_path
, "/var/run/mksd/socket");
1346 if (connect(sock
, (struct sockaddr
*) &server
, sizeof(struct sockaddr_un
)) < 0) {
1348 log_write(0, LOG_MAIN
|LOG_PANIC
,
1349 "malware acl condition: unable to connect to mksd UNIX socket (/var/run/mksd/socket). errno=%d", errno
);
1353 malware_name
= NULL
;
1355 retval
= mksd_scan_packed(sock
);
1360 /* ----------------------------------------------------------------------- */
1362 /* "unknown" scanner type ------------------------------------------------- */
1364 log_write(0, LOG_MAIN
|LOG_PANIC
,
1365 "malware condition: unknown scanner type '%s'", scanner_name
);
1368 /* ----------------------------------------------------------------------- */
1370 /* set "been here, done that" marker */
1374 /* match virus name against pattern (caseless ------->----------v) */
1375 if ( (malware_name
!= NULL
) &&
1376 (regex_match_and_setup(re
, malware_name
, 0, -1)) ) {
1385 /* simple wrapper for reading lines from sockets */
1386 int recv_line(int sock
, uschar
*buffer
, int size
) {
1389 memset(buffer
,0,size
);
1391 while(recv(sock
,p
,1,0) > -1) {
1392 if ((p
-buffer
) > (size
-2)) break;
1393 if (*p
== '\n') break;
1394 if (*p
!= '\r') p
++;
1402 /* ============= private routines for the "mksd" scanner type ============== */
1404 #include <sys/uio.h>
1406 int mksd_writev (int sock
, struct iovec
*iov
, int iovcnt
)
1412 i
= writev (sock
, iov
, iovcnt
);
1413 while ((i
< 0) && (errno
== EINTR
));
1416 log_write(0, LOG_MAIN
|LOG_PANIC
,
1417 "malware acl condition: unable to write to mksd UNIX socket (/var/run/mksd/socket)");
1422 if (i
>= iov
->iov_len
) {
1429 iov
->iov_base
= CS iov
->iov_base
+ i
;
1435 int mksd_read_lines (int sock
, uschar
*av_buffer
, int av_buffer_size
)
1441 if ((i
= recv (sock
, av_buffer
+offset
, av_buffer_size
-offset
, 0)) <= 0) {
1443 log_write(0, LOG_MAIN
|LOG_PANIC
,
1444 "malware acl condition: unable to read from mksd UNIX socket (/var/run/mksd/socket)");
1449 /* offset == av_buffer_size -> buffer full */
1450 if (offset
== av_buffer_size
) {
1452 log_write(0, LOG_MAIN
|LOG_PANIC
,
1453 "malware acl condition: malformed reply received from mksd");
1456 } while (av_buffer
[offset
-1] != '\n');
1458 av_buffer
[offset
] = '\0';
1462 int mksd_parse_line (char *line
)
1473 if ((p
= strchr (line
, '\n')) != NULL
)
1475 log_write(0, LOG_MAIN
|LOG_PANIC
,
1476 "malware acl condition: mksd scanner failed: %s", line
);
1480 if ((p
= strchr (line
, '\n')) != NULL
) {
1482 if (((p
-line
) > 5) && ((p
-line
) < sizeof (malware_name_buffer
)) && (line
[3] == ' '))
1483 if (((p
= strchr (line
+4, ' ')) != NULL
) && ((p
-line
) > 4)) {
1485 Ustrcpy (malware_name_buffer
, line
+4);
1486 malware_name
= malware_name_buffer
;
1490 log_write(0, LOG_MAIN
|LOG_PANIC
,
1491 "malware acl condition: malformed reply received from mksd: %s", line
);
1496 int mksd_scan_packed (int sock
)
1498 struct iovec iov
[7];
1499 char *cmd
= "MSQ/scan/.eml\n";
1500 uschar av_buffer
[1024];
1502 iov
[0].iov_base
= cmd
;
1504 iov
[1].iov_base
= CS spool_directory
;
1505 iov
[1].iov_len
= Ustrlen (spool_directory
);
1506 iov
[2].iov_base
= cmd
+ 3;
1508 iov
[3].iov_base
= iov
[5].iov_base
= CS message_id
;
1509 iov
[3].iov_len
= iov
[5].iov_len
= Ustrlen (message_id
);
1510 iov
[4].iov_base
= cmd
+ 3;
1512 iov
[6].iov_base
= cmd
+ 9;
1515 if (mksd_writev (sock
, iov
, 7) < 0)
1518 if (mksd_read_lines (sock
, av_buffer
, sizeof (av_buffer
)) < 0)
1523 return mksd_parse_line (CS av_buffer
);