1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
7 * Copyright (c) The Exim Maintainers 2015 - 2018
10 /* Code for calling virus (malware) scanners. Called from acl.c. */
13 #ifdef WITH_CONTENT_SCAN /* entire file */
16 #ifndef DISABLE_MAL_FFROTD
19 #ifndef DISABLE_MAL_FFROT6D
22 #ifndef DISABLE_MAL_DRWEB
25 #ifndef DISABLE_MAL_AVE
28 #ifndef DISABLE_MAL_FSECURE
31 #ifndef DISABLE_MAL_KAV
34 #ifndef DISABLE_MAL_SOPHIE
37 #ifndef DISABLE_MAL_CLAM
40 #ifndef DISABLE_MAL_MKS
43 #ifndef DISABLE_MAL_AVAST
46 #ifndef DISABLE_MAL_SOCK
49 #ifndef DISABLE_MAL_CMDLINE
54 typedef enum {MC_NONE
, MC_TCP
, MC_UNIX
, MC_STRM
} contype_t
;
59 const uschar
* options_default
;
63 #ifndef DISABLE_MAL_FFROTD
64 { M_FPROTD
, US
"f-protd", US
"localhost 10200-10204", MC_TCP
},
66 #ifndef DISABLE_MAL_FFROT6D
67 { M_FPROT6D
, US
"f-prot6d", US
"localhost 10200", MC_TCP
},
69 #ifndef DISABLE_MAL_DRWEB
70 { M_DRWEB
, US
"drweb", US
"/usr/local/drweb/run/drwebd.sock", MC_STRM
},
72 #ifndef DISABLE_MAL_AVE
73 { M_AVES
, US
"aveserver", US
"/var/run/aveserver", MC_UNIX
},
75 #ifndef DISABLE_MAL_FSECURE
76 { M_FSEC
, US
"fsecure", US
"/var/run/.fsav", MC_UNIX
},
78 #ifndef DISABLE_MAL_KAV
79 { M_KAVD
, US
"kavdaemon", US
"/var/run/AvpCtl", MC_UNIX
},
81 #ifndef DISABLE_MAL_SOPHIE
82 { M_SOPHIE
, US
"sophie", US
"/var/run/sophie", MC_UNIX
},
84 #ifndef DISABLE_MAL_CLAM
85 { M_CLAMD
, US
"clamd", US
"/tmp/clamd", MC_NONE
},
87 #ifndef DISABLE_MAL_MKS
88 { M_MKSD
, US
"mksd", NULL
, MC_NONE
},
90 #ifndef DISABLE_MAL_AVAST
91 { M_AVAST
, US
"avast", US
"/var/run/avast/scan.sock", MC_STRM
},
93 #ifndef DISABLE_MAL_SOCK
94 { M_SOCK
, US
"sock", US
"/tmp/malware.sock", MC_STRM
},
96 #ifndef DISABLE_MAL_CMDLINE
97 { M_CMDL
, US
"cmdline", NULL
, MC_NONE
},
99 { -1, NULL
, NULL
, MC_NONE
} /* end-marker */
102 /******************************************************************************/
103 # ifdef MACRO_PREDEF /* build solely to predefine macros */
105 # include "macro_predef.h"
108 features_malware(void)
110 const struct scan
* sc
;
115 spf(buf
, sizeof(buf
), US
"_HAVE_MALWARE_");
117 for (sc
= m_scans
; sc
->scancode
!= -1; sc
++)
119 for(s
= sc
->name
, t
= buf
+14; *s
; s
++) if (*s
!= '-') *t
++ = toupper(*s
);
121 builtin_macro_create(buf
);
125 /******************************************************************************/
126 # else /*!MACRO_PREDEF, main build*/
129 #define MALWARE_TIMEOUT 120 /* default timeout, seconds */
131 static const uschar
* malware_regex_default
= US
".+";
132 static const pcre
* malware_default_re
= NULL
;
136 #ifndef DISABLE_MAL_CLAM
137 /* The maximum number of clamd servers that are supported in the configuration */
138 # define MAX_CLAMD_SERVERS 32
139 # define MAX_CLAMD_SERVERS_S "32"
141 typedef struct clamd_address
{
149 #ifndef DISABLE_MAL_DRWEB
150 # define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
151 # define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
152 # define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
154 # define DERR_READ_ERR (1<<0) /* read error */
155 # define DERR_NOMEMORY (1<<2) /* no memory */
156 # define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
157 # define DERR_BAD_CALL (1<<15) /* wrong command */
159 static const uschar
* drweb_re_str
= US
"infected\\swith\\s*(.+?)$";
160 static const pcre
* drweb_re
= NULL
;
163 #ifndef DISABLE_MAL_FSECURE
164 static const uschar
* fsec_re_str
= US
"\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
165 static const pcre
* fsec_re
= NULL
;
168 #ifndef DISABLE_MAL_KAV
169 static const uschar
* kav_re_sus_str
= US
"suspicion:\\s*(.+?)\\s*$";
170 static const uschar
* kav_re_inf_str
= US
"infected:\\s*(.+?)\\s*$";
171 static const pcre
* kav_re_sus
= NULL
;
172 static const pcre
* kav_re_inf
= NULL
;
175 #ifndef DISABLE_MAL_AVAST
176 static const uschar
* ava_re_clean_str
= US
"(?!\\\\)\\t\\[\\+\\]";
177 static const uschar
* ava_re_virus_str
= US
"(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
178 static const uschar
* ava_re_error_str
= US
"(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
179 static const pcre
* ava_re_clean
= NULL
;
180 static const pcre
* ava_re_virus
= NULL
;
181 static const pcre
* ava_re_error
= NULL
;
184 #ifndef DISABLE_MAL_FFROT6D
185 static const uschar
* fprot6d_re_error_str
= US
"^\\d+\\s<(.+?)>$";
186 static const uschar
* fprot6d_re_virus_str
= US
"^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
187 static const pcre
* fprot6d_re_error
= NULL
;
188 static const pcre
* fprot6d_re_virus
= NULL
;
193 /******************************************************************************/
195 #ifndef DISABLE_MAL_KAV
196 /* Routine to check whether a system is big- or little-endian.
197 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
198 Needed for proper kavdaemon implementation. Sigh. */
199 # define BIG_MY_ENDIAN 0
200 # define LITTLE_MY_ENDIAN 1
201 static int test_byte_order(void);
205 short int word
= 0x0001;
206 char *byte
= CS
&word
;
207 return(byte
[0] ? LITTLE_MY_ENDIAN
: BIG_MY_ENDIAN
);
211 BOOL malware_ok
= FALSE
;
213 /* Gross hacks for the -bmalware option; perhaps we should just create
214 the scan directory normally for that case, but look into rigging up the
215 needed header variables if not already set on the command-line? */
216 extern int spool_mbox_ok
;
217 extern uschar spooled_message_id
[MESSAGE_ID_LENGTH
+1];
220 /* Some (currently avast only) use backslash escaped whitespace,
221 this function undoes these escapes */
228 if (*p
== '\\' && (isspace(p
[1]) || p
[1] == '\\'))
229 for (p0
= p
; *p0
; ++p0
) *p0
= p0
[1];
232 /* --- malware_*_defer --- */
234 malware_panic_defer(const uschar
* str
)
236 log_write(0, LOG_MAIN
|LOG_PANIC
, "malware acl condition: %s", str
);
240 malware_log_defer(const uschar
* str
)
242 log_write(0, LOG_MAIN
, "malware acl condition: %s", str
);
245 /* --- m_*_defer --- */
247 m_panic_defer(struct scan
* scanent
, const uschar
* hostport
,
250 return malware_panic_defer(string_sprintf("%s %s : %s",
251 scanent
->name
, hostport
? hostport
: CUS
"", str
));
254 m_log_defer(struct scan
* scanent
, const uschar
* hostport
,
257 return malware_log_defer(string_sprintf("%s %s : %s",
258 scanent
->name
, hostport
? hostport
: CUS
"", str
));
260 /* --- m_*_defer_3 */
262 m_panic_defer_3(struct scan
* scanent
, const uschar
* hostport
,
263 const uschar
* str
, int fd_to_close
)
265 (void) close(fd_to_close
);
266 return m_panic_defer(scanent
, hostport
, str
);
269 /*************************************************/
271 #ifndef DISABLE_MAL_CLAM
272 /* Only used by the Clamav code, which is working from a list of servers and
273 uses the returned in_addr to get a second connection to the same system.
276 m_tcpsocket(const uschar
* hostname
, unsigned int port
,
277 host_item
* host
, uschar
** errstr
, const blob
* fastopen_blob
)
279 return ip_connectedsocket(SOCK_STREAM
, hostname
, port
, port
, 5,
280 host
, errstr
, fastopen_blob
);
285 m_sock_send(int sock
, uschar
* buf
, int cnt
, uschar
** errstr
)
287 if (send(sock
, buf
, cnt
, 0) < 0)
291 *errstr
= string_sprintf("unable to send to socket (%s): %s",
299 m_pcre_compile(const uschar
* re
, uschar
** errstr
)
301 const uschar
* rerror
;
305 cre
= pcre_compile(CS re
, PCRE_COPT
, (const char **)&rerror
, &roffset
, NULL
);
307 *errstr
= string_sprintf("regular expression error in '%s': %s at offset %d",
308 re
, rerror
, roffset
);
313 m_pcre_exec(const pcre
* cre
, uschar
* text
)
316 int i
= pcre_exec(cre
, NULL
, CS text
, Ustrlen(text
), 0, 0,
317 ovector
, nelem(ovector
));
318 uschar
* substr
= NULL
;
319 if (i
>= 2) /* Got it */
320 pcre_get_substring(CS text
, ovector
, i
, 1, (const char **) &substr
);
325 m_pcre_nextinlist(const uschar
** list
, int * sep
,
326 char * listerr
, uschar
** errstr
)
328 const uschar
* list_ele
;
329 const pcre
* cre
= NULL
;
331 if (!(list_ele
= string_nextinlist(list
, sep
, NULL
, 0)))
332 *errstr
= US listerr
;
335 DEBUG(D_acl
) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
336 string_printing(list_ele
));
337 cre
= m_pcre_compile(CUS list_ele
, errstr
);
343 Simple though inefficient wrapper for reading a line. Drop CRs and the
344 trailing newline. Can return early on buffer full. Null-terminate.
345 Apply initial timeout if no data ready.
347 Return: number of chars - zero for an empty line
349 -2 on timeout or error
352 recv_line(int fd
, uschar
* buffer
, int bsize
, int tmo
)
358 if (!fd_ready(fd
, tmo
-time(NULL
)))
361 /*XXX tmo handling assumes we always get a whole line */
364 while ((rcv
= read(fd
, p
, 1)) > 0)
367 if (p
-buffer
> bsize
-2) break;
368 if (*p
== '\n') break;
373 DEBUG(D_acl
) debug_printf_indent("Malware scan: read %s (%s)\n",
374 rcv
==0 ? "EOF" : "error", strerror(errno
));
375 return rcv
==0 ? -1 : -2;
379 DEBUG(D_acl
) debug_printf_indent("Malware scan: read '%s'\n", buffer
);
383 /* return TRUE iff size as requested */
385 recv_len(int sock
, void * buf
, int size
, int tmo
)
387 return fd_ready(sock
, tmo
-time(NULL
))
388 ? recv(sock
, buf
, size
, 0) == size
394 #ifndef DISABLE_MAL_MKS
395 /* ============= private routines for the "mksd" scanner type ============== */
397 # include <sys/uio.h>
400 mksd_writev (int sock
, struct iovec
* iov
, int iovcnt
)
407 i
= writev (sock
, iov
, iovcnt
);
408 while (i
< 0 && errno
== EINTR
);
411 (void) malware_panic_defer(
412 US
"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
415 for (;;) /* check for short write */
416 if (i
>= iov
->iov_len
)
426 iov
->iov_base
= CS iov
->iov_base
+ i
;
433 mksd_read_lines (int sock
, uschar
*av_buffer
, int av_buffer_size
, int tmo
)
435 client_conn_ctx cctx
= {.sock
= sock
};
441 i
= ip_recv(&cctx
, av_buffer
+offset
, av_buffer_size
-offset
, tmo
-time(NULL
));
444 (void) malware_panic_defer(US
"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
449 /* offset == av_buffer_size -> buffer full */
450 if (offset
== av_buffer_size
)
452 (void) malware_panic_defer(US
"malformed reply received from mksd");
455 } while (av_buffer
[offset
-1] != '\n');
457 av_buffer
[offset
] = '\0';
462 mksd_parse_line(struct scan
* scanent
, char * line
)
473 if ((p
= strchr (line
, '\n')) != NULL
)
475 return m_panic_defer(scanent
, NULL
,
476 string_sprintf("scanner failed: %s", line
));
479 if ((p
= strchr (line
, '\n')) != NULL
)
484 && (p
= strchr(line
+4, ' ')) != NULL
489 malware_name
= string_copy(US line
+4);
493 return m_panic_defer(scanent
, NULL
,
494 string_sprintf("malformed reply received: %s", line
));
499 mksd_scan_packed(struct scan
* scanent
, int sock
, const uschar
* scan_filename
,
503 const char *cmd
= "MSQ\n";
504 uschar av_buffer
[1024];
506 iov
[0].iov_base
= (void *) cmd
;
508 iov
[1].iov_base
= (void *) scan_filename
;
509 iov
[1].iov_len
= Ustrlen(scan_filename
);
510 iov
[2].iov_base
= (void *) (cmd
+ 3);
513 if (mksd_writev (sock
, iov
, 3) < 0)
516 if (mksd_read_lines (sock
, av_buffer
, sizeof (av_buffer
), tmo
) < 0)
519 return mksd_parse_line (scanent
, CS av_buffer
);
524 #ifndef DISABLE_MAL_CLAM
526 clamd_option(clamd_address
* cd
, const uschar
* optstr
, int * subsep
)
531 while ((s
= string_nextinlist(&optstr
, subsep
, NULL
, 0)))
532 if (Ustrncmp(s
, "retry=", 6) == 0)
534 int sec
= readconf_readtime((s
+= 6), '\0', FALSE
);
547 /*************************************************
548 * Scan content for malware *
549 *************************************************/
551 /* This is an internal interface for scanning an email; the normal interface
552 is via malware(), or there's malware_in_file() used for testing/debugging.
555 malware_re match condition for "malware="
556 scan_filename the file holding the email to be scanned, if we're faking
557 this up for the -bmalware test, else NULL
558 timeout if nonzero, non-default timeoutl
560 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
561 where true means malware was found (condition applies)
564 malware_internal(const uschar
* malware_re
, const uschar
* scan_filename
,
568 const uschar
*av_scanner_work
= av_scanner
;
569 uschar
*scanner_name
;
570 unsigned long mbox_size
;
574 struct scan
* scanent
;
575 const uschar
* scanner_options
;
576 client_conn_ctx malware_daemon_ctx
= {.sock
= -1};
578 uschar
* eml_filename
, * eml_dir
;
581 return FAIL
; /* empty means "don't match anything" */
583 /* Ensure the eml mbox file is spooled up */
585 if (!(mbox_file
= spool_mbox(&mbox_size
, scan_filename
, &eml_filename
)))
586 return malware_panic_defer(US
"error while creating mbox spool file");
588 /* None of our current scanners need the mbox file as a stream (they use
589 the name), so we can close it right away. Get the directory too. */
591 (void) fclose(mbox_file
);
592 eml_dir
= string_copyn(eml_filename
, Ustrrchr(eml_filename
, '/') - eml_filename
);
594 /* parse 1st option */
595 if (strcmpic(malware_re
, US
"false") == 0 || Ustrcmp(malware_re
,"0") == 0)
596 return FAIL
; /* explicitly no matching */
598 /* special cases (match anything except empty) */
599 if ( strcmpic(malware_re
,US
"true") == 0
600 || Ustrcmp(malware_re
,"*") == 0
601 || Ustrcmp(malware_re
,"1") == 0
604 if ( !malware_default_re
605 && !(malware_default_re
= m_pcre_compile(malware_regex_default
, &errstr
)))
606 return malware_panic_defer(errstr
);
607 malware_re
= malware_regex_default
;
608 re
= malware_default_re
;
611 /* compile the regex, see if it works */
612 else if (!(re
= m_pcre_compile(malware_re
, &errstr
)))
613 return malware_panic_defer(errstr
);
615 /* if av_scanner starts with a dollar, expand it first */
616 if (*av_scanner
== '$')
618 if (!(av_scanner_work
= expand_string(av_scanner
)))
619 return malware_panic_defer(
620 string_sprintf("av_scanner starts with $, but expansion failed: %s",
621 expand_string_message
));
624 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work
);
625 /* disable result caching in this case */
630 /* Do not scan twice (unless av_scanner is dynamic). */
633 /* find the scanner type from the av_scanner option */
634 if (!(scanner_name
= string_nextinlist(&av_scanner_work
, &sep
, NULL
, 0)))
635 return malware_panic_defer(US
"av_scanner configuration variable is empty");
636 if (!timeout
) timeout
= MALWARE_TIMEOUT
;
637 tmo
= time(NULL
) + timeout
;
639 for (scanent
= m_scans
; ; scanent
++)
642 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
644 if (strcmpic(scanner_name
, US scanent
->name
) != 0)
646 DEBUG(D_acl
) debug_printf_indent("Malware scan: %s tmo=%s\n",
647 scanner_name
, readconf_printtime(timeout
));
649 if (!(scanner_options
= string_nextinlist(&av_scanner_work
, &sep
, NULL
, 0)))
650 scanner_options
= scanent
->options_default
;
651 if (scanent
->conn
== MC_NONE
)
654 DEBUG(D_acl
) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options
);
655 switch(scanent
->conn
)
658 malware_daemon_ctx
.sock
= ip_tcpsocket(scanner_options
, &errstr
, 5); break;
660 malware_daemon_ctx
.sock
= ip_unixsocket(scanner_options
, &errstr
); break;
662 malware_daemon_ctx
.sock
= ip_streamsocket(scanner_options
, &errstr
, 5); break;
664 /* compiler quietening */ break;
666 if (malware_daemon_ctx
.sock
< 0)
667 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
671 switch (scanent
->scancode
)
673 #ifndef DISABLE_MAL_FFROTD
674 case M_FPROTD
: /* "f-protd" scanner type -------------------------------- */
676 uschar
*fp_scan_option
;
677 unsigned int detected
=0, par_count
=0;
678 uschar
* scanrequest
;
679 uschar buf
[32768], *strhelper
, *strhelper2
;
680 uschar
* malware_name_internal
= NULL
;
683 scanrequest
= string_sprintf("GET %s", eml_filename
);
685 while ((fp_scan_option
= string_nextinlist(&av_scanner_work
, &sep
,
688 scanrequest
= string_sprintf("%s%s%s", scanrequest
,
689 par_count
? "%20" : "?", fp_scan_option
);
692 scanrequest
= string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest
);
693 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s: %s\n",
694 scanner_name
, scanrequest
);
696 /* send scan request */
697 if (m_sock_send(malware_daemon_ctx
.sock
, scanrequest
, Ustrlen(scanrequest
)+1, &errstr
) < 0)
698 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
700 while ((len
= recv_line(malware_daemon_ctx
.sock
, buf
, sizeof(buf
), tmo
)) >= 0)
703 if (Ustrstr(buf
, US
"<detected type=\"") != NULL
)
705 else if (detected
&& (strhelper
= Ustrstr(buf
, US
"<name>")))
707 if ((strhelper2
= Ustrstr(buf
, US
"</name>")) != NULL
)
710 malware_name_internal
= string_copy(strhelper
+6);
713 else if (Ustrstr(buf
, US
"<summary code=\""))
715 malware_name
= Ustrstr(buf
, US
"<summary code=\"11\">")
716 ? malware_name_internal
: NULL
;
722 (void)close(malware_daemon_ctx
.sock
);
729 #ifndef DISABLE_MAL_FFROT6D
730 case M_FPROT6D
: /* "f-prot6d" scanner type ----------------------------------- */
735 uschar
* scanrequest
;
736 uschar av_buffer
[1024];
738 if ((!fprot6d_re_virus
&& !(fprot6d_re_virus
= m_pcre_compile(fprot6d_re_virus_str
, &errstr
)))
739 || (!fprot6d_re_error
&& !(fprot6d_re_error
= m_pcre_compile(fprot6d_re_error_str
, &errstr
))))
740 return malware_panic_defer(errstr
);
742 scanrequest
= string_sprintf("SCAN FILE %s\n", eml_filename
);
743 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s: %s\n",
744 scanner_name
, scanrequest
);
746 if (m_sock_send(malware_daemon_ctx
.sock
, scanrequest
, Ustrlen(scanrequest
), &errstr
) < 0)
747 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
749 bread
= ip_recv(&malware_daemon_ctx
, av_buffer
, sizeof(av_buffer
), tmo
-time(NULL
));
752 return m_panic_defer_3(scanent
, CUS callout_address
,
753 string_sprintf("unable to read from socket (%s)", strerror(errno
)),
754 malware_daemon_ctx
.sock
);
756 if (bread
== sizeof(av_buffer
))
757 return m_panic_defer_3(scanent
, CUS callout_address
,
758 US
"buffer too small", malware_daemon_ctx
.sock
);
760 av_buffer
[bread
] = '\0';
761 linebuffer
= string_copy(av_buffer
);
763 m_sock_send(malware_daemon_ctx
.sock
, US
"QUIT\n", 5, 0);
765 if ((e
= m_pcre_exec(fprot6d_re_error
, linebuffer
)))
766 return m_panic_defer_3(scanent
, CUS callout_address
,
767 string_sprintf("scanner reported error (%s)", e
), malware_daemon_ctx
.sock
);
769 if (!(malware_name
= m_pcre_exec(fprot6d_re_virus
, linebuffer
)))
776 #ifndef DISABLE_MAL_DRWEB
777 case M_DRWEB
: /* "drweb" scanner type ----------------------------------- */
778 /* v0.1 - added support for tcp sockets */
779 /* v0.0 - initial release -- support for unix sockets */
783 unsigned int fsize_uint
;
784 uschar
* tmpbuf
, *drweb_fbuf
;
785 int drweb_rc
, drweb_cmd
, drweb_flags
= 0x0000, drweb_fd
,
786 drweb_vnum
, drweb_slen
, drweb_fin
= 0x0000;
788 /* prepare variables */
789 drweb_cmd
= htonl(DRWEBD_SCAN_CMD
);
790 drweb_flags
= htonl(DRWEBD_RETURN_VIRUSES
| DRWEBD_IS_MAIL
);
792 if (*scanner_options
!= '/')
795 if ((drweb_fd
= open(CCS eml_filename
, O_RDONLY
)) == -1)
796 return m_panic_defer_3(scanent
, NULL
,
797 string_sprintf("can't open spool file %s: %s",
798 eml_filename
, strerror(errno
)),
799 malware_daemon_ctx
.sock
);
801 if ((fsize
= lseek(drweb_fd
, 0, SEEK_END
)) == -1)
804 badseek
: err
= errno
;
805 (void)close(drweb_fd
);
806 return m_panic_defer_3(scanent
, NULL
,
807 string_sprintf("can't seek spool file %s: %s",
808 eml_filename
, strerror(err
)),
809 malware_daemon_ctx
.sock
);
811 fsize_uint
= (unsigned int) fsize
;
812 if ((off_t
)fsize_uint
!= fsize
)
814 (void)close(drweb_fd
);
815 return m_panic_defer_3(scanent
, NULL
,
816 string_sprintf("seeking spool file %s, size overflow",
818 malware_daemon_ctx
.sock
);
820 drweb_slen
= htonl(fsize
);
821 if (lseek(drweb_fd
, 0, SEEK_SET
) < 0)
824 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
825 scanner_name
, scanner_options
);
827 /* send scan request */
828 if ((send(malware_daemon_ctx
.sock
, &drweb_cmd
, sizeof(drweb_cmd
), 0) < 0) ||
829 (send(malware_daemon_ctx
.sock
, &drweb_flags
, sizeof(drweb_flags
), 0) < 0) ||
830 (send(malware_daemon_ctx
.sock
, &drweb_fin
, sizeof(drweb_fin
), 0) < 0) ||
831 (send(malware_daemon_ctx
.sock
, &drweb_slen
, sizeof(drweb_slen
), 0) < 0))
833 (void)close(drweb_fd
);
834 return m_panic_defer_3(scanent
, CUS callout_address
, string_sprintf(
835 "unable to send commands to socket (%s)", scanner_options
),
836 malware_daemon_ctx
.sock
);
839 if (!(drweb_fbuf
= US
malloc(fsize_uint
)))
841 (void)close(drweb_fd
);
842 return m_panic_defer_3(scanent
, NULL
,
843 string_sprintf("unable to allocate memory %u for file (%s)",
844 fsize_uint
, eml_filename
),
845 malware_daemon_ctx
.sock
);
848 if ((result
= read (drweb_fd
, drweb_fbuf
, fsize
)) == -1)
851 (void)close(drweb_fd
);
853 return m_panic_defer_3(scanent
, NULL
,
854 string_sprintf("can't read spool file %s: %s",
855 eml_filename
, strerror(err
)),
856 malware_daemon_ctx
.sock
);
858 (void)close(drweb_fd
);
860 /* send file body to socket */
861 if (send(malware_daemon_ctx
.sock
, drweb_fbuf
, fsize
, 0) < 0)
864 return m_panic_defer_3(scanent
, CUS callout_address
, string_sprintf(
865 "unable to send file body to socket (%s)", scanner_options
),
866 malware_daemon_ctx
.sock
);
871 drweb_slen
= htonl(Ustrlen(eml_filename
));
873 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
874 scanner_name
, scanner_options
);
876 /* send scan request */
877 if ((send(malware_daemon_ctx
.sock
, &drweb_cmd
, sizeof(drweb_cmd
), 0) < 0) ||
878 (send(malware_daemon_ctx
.sock
, &drweb_flags
, sizeof(drweb_flags
), 0) < 0) ||
879 (send(malware_daemon_ctx
.sock
, &drweb_slen
, sizeof(drweb_slen
), 0) < 0) ||
880 (send(malware_daemon_ctx
.sock
, eml_filename
, Ustrlen(eml_filename
), 0) < 0) ||
881 (send(malware_daemon_ctx
.sock
, &drweb_fin
, sizeof(drweb_fin
), 0) < 0))
882 return m_panic_defer_3(scanent
, CUS callout_address
, string_sprintf(
883 "unable to send commands to socket (%s)", scanner_options
),
884 malware_daemon_ctx
.sock
);
887 /* wait for result */
888 if (!recv_len(malware_daemon_ctx
.sock
, &drweb_rc
, sizeof(drweb_rc
), tmo
))
889 return m_panic_defer_3(scanent
, CUS callout_address
,
890 US
"unable to read return code", malware_daemon_ctx
.sock
);
891 drweb_rc
= ntohl(drweb_rc
);
893 if (!recv_len(malware_daemon_ctx
.sock
, &drweb_vnum
, sizeof(drweb_vnum
), tmo
))
894 return m_panic_defer_3(scanent
, CUS callout_address
,
895 US
"unable to read the number of viruses", malware_daemon_ctx
.sock
);
896 drweb_vnum
= ntohl(drweb_vnum
);
898 /* "virus(es) found" if virus number is > 0 */
904 /* setup default virus name */
905 malware_name
= US
"unknown";
907 /* set up match regex */
909 drweb_re
= m_pcre_compile(drweb_re_str
, &errstr
);
911 /* read and concatenate virus names into one string */
912 for (i
= 0; i
< drweb_vnum
; i
++)
916 /* read the size of report */
917 if (!recv_len(malware_daemon_ctx
.sock
, &drweb_slen
, sizeof(drweb_slen
), tmo
))
918 return m_panic_defer_3(scanent
, CUS callout_address
,
919 US
"cannot read report size", malware_daemon_ctx
.sock
);
920 drweb_slen
= ntohl(drweb_slen
);
921 tmpbuf
= store_get(drweb_slen
);
923 /* read report body */
924 if (!recv_len(malware_daemon_ctx
.sock
, tmpbuf
, drweb_slen
, tmo
))
925 return m_panic_defer_3(scanent
, CUS callout_address
,
926 US
"cannot read report string", malware_daemon_ctx
.sock
);
927 tmpbuf
[drweb_slen
] = '\0';
929 /* try matcher on the line, grab substring */
930 result
= pcre_exec(drweb_re
, NULL
, CS tmpbuf
, Ustrlen(tmpbuf
), 0, 0,
931 ovector
, nelem(ovector
));
934 const char * pre_malware_nb
;
936 pcre_get_substring(CS tmpbuf
, ovector
, result
, 1, &pre_malware_nb
);
938 if (i
==0) /* the first name we just copy to malware_name */
939 g
= string_cat(NULL
, US pre_malware_nb
);
941 /*XXX could be string_append_listele? */
942 else /* concatenate each new virus name to previous */
943 g
= string_append(g
, 2, "/", pre_malware_nb
);
945 pcre_free_substring(pre_malware_nb
);
948 malware_name
= string_from_gstring(g
);
952 const char *drweb_s
= NULL
;
954 if (drweb_rc
& DERR_READ_ERR
) drweb_s
= "read error";
955 if (drweb_rc
& DERR_NOMEMORY
) drweb_s
= "no memory";
956 if (drweb_rc
& DERR_TIMEOUT
) drweb_s
= "timeout";
957 if (drweb_rc
& DERR_BAD_CALL
) drweb_s
= "wrong command";
958 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
959 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
960 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
961 * and others are ignored */
963 return m_panic_defer_3(scanent
, CUS callout_address
,
964 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc
, drweb_s
),
965 malware_daemon_ctx
.sock
);
974 #ifndef DISABLE_MAL_AVE
975 case M_AVES
: /* "aveserver" scanner type -------------------------------- */
980 /* read aveserver's greeting and see if it is ready (2xx greeting) */
982 recv_line(malware_daemon_ctx
.sock
, buf
, sizeof(buf
), tmo
);
984 if (buf
[0] != '2') /* aveserver is having problems */
985 return m_panic_defer_3(scanent
, CUS callout_address
,
986 string_sprintf("unavailable (Responded: %s).",
987 ((buf
[0] != 0) ? buf
: US
"nothing") ),
988 malware_daemon_ctx
.sock
);
990 /* prepare our command */
991 (void)string_format(buf
, sizeof(buf
), "SCAN bPQRSTUW %s\r\n",
995 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s %s\n",
997 if (m_sock_send(malware_daemon_ctx
.sock
, buf
, Ustrlen(buf
), &errstr
) < 0)
998 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1000 malware_name
= NULL
;
1002 /* read response lines, find malware name and final response */
1003 while (recv_line(malware_daemon_ctx
.sock
, buf
, sizeof(buf
), tmo
) > 0)
1007 if (buf
[0] == '5') /* aveserver is having problems */
1009 result
= m_panic_defer(scanent
, CUS callout_address
,
1010 string_sprintf("unable to scan file %s (Responded: %s).",
1011 eml_filename
, buf
));
1014 if (Ustrncmp(buf
,"322",3) == 0)
1016 uschar
*p
= Ustrchr(&buf
[4], ' ');
1018 malware_name
= string_copy(&buf
[4]);
1022 if (m_sock_send(malware_daemon_ctx
.sock
, US
"quit\r\n", 6, &errstr
) < 0)
1023 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1025 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1027 recv_line(malware_daemon_ctx
.sock
, buf
, sizeof(buf
), tmo
);
1029 if (buf
[0] != '2') /* aveserver is having problems */
1030 return m_panic_defer_3(scanent
, CUS callout_address
,
1031 string_sprintf("unable to quit dialogue (Responded: %s).",
1032 ((buf
[0] != 0) ? buf
: US
"nothing") ),
1033 malware_daemon_ctx
.sock
);
1035 if (result
== DEFER
)
1037 (void)close(malware_daemon_ctx
.sock
);
1044 #ifndef DISABLE_MAL_FSECURE
1045 case M_FSEC
: /* "fsecure" scanner type ---------------------------------- */
1047 int i
, j
, bread
= 0;
1049 uschar av_buffer
[1024];
1050 static uschar
*cmdopt
[] = { US
"CONFIGURE\tARCHIVE\t1\n",
1051 US
"CONFIGURE\tTIMEOUT\t0\n",
1052 US
"CONFIGURE\tMAXARCH\t5\n",
1053 US
"CONFIGURE\tMIME\t1\n" };
1055 malware_name
= NULL
;
1057 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1058 scanner_name
, scanner_options
);
1060 memset(av_buffer
, 0, sizeof(av_buffer
));
1061 for (i
= 0; i
!= nelem(cmdopt
); i
++)
1064 if (m_sock_send(malware_daemon_ctx
.sock
, cmdopt
[i
], Ustrlen(cmdopt
[i
]), &errstr
) < 0)
1065 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1067 bread
= ip_recv(&malware_daemon_ctx
, av_buffer
, sizeof(av_buffer
), tmo
-time(NULL
));
1068 if (bread
> 0) av_buffer
[bread
]='\0';
1070 return m_panic_defer_3(scanent
, CUS callout_address
,
1071 string_sprintf("unable to read answer %d (%s)", i
, strerror(errno
)),
1072 malware_daemon_ctx
.sock
);
1073 for (j
= 0; j
< bread
; j
++)
1074 if (av_buffer
[j
] == '\r' || av_buffer
[j
] == '\n')
1078 /* pass the mailfile to fsecure */
1079 file_name
= string_sprintf("SCAN\t%s\n", eml_filename
);
1081 if (m_sock_send(malware_daemon_ctx
.sock
, file_name
, Ustrlen(file_name
), &errstr
) < 0)
1082 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1085 /* todo also SUSPICION\t */
1087 fsec_re
= m_pcre_compile(fsec_re_str
, &errstr
);
1089 /* read report, linewise. Apply a timeout as the Fsecure daemon
1090 sometimes wants an answer to "PING" but they won't tell us what */
1092 uschar
* p
= av_buffer
;
1098 i
= av_buffer
+sizeof(av_buffer
)-p
;
1099 if ((bread
= ip_recv(&malware_daemon_ctx
, p
, i
-1, tmo
-time(NULL
))) < 0)
1100 return m_panic_defer_3(scanent
, CUS callout_address
,
1101 string_sprintf("unable to read result (%s)", strerror(errno
)),
1102 malware_daemon_ctx
.sock
);
1104 for (p
[bread
] = '\0'; (q
= Ustrchr(p
, '\n')); p
= q
+1)
1108 /* Really search for virus again? */
1110 /* try matcher on the line, grab substring */
1111 malware_name
= m_pcre_exec(fsec_re
, p
);
1113 if (Ustrstr(p
, "OK\tScan ok."))
1117 /* copy down the trailing partial line then read another chunk */
1118 i
= av_buffer
+sizeof(av_buffer
)-p
;
1119 memmove(av_buffer
, p
, i
);
1129 #ifndef DISABLE_MAL_KAV
1130 case M_KAVD
: /* "kavdaemon" scanner type -------------------------------- */
1133 uschar tmpbuf
[1024];
1134 uschar
* scanrequest
;
1136 unsigned long kav_reportlen
;
1141 /* get current date and time, build scan request */
1143 /* pdp note: before the eml_filename parameter, this scanned the
1144 directory; not finding documentation, so we'll strip off the directory.
1145 The side-effect is that the test framework scanning may end up in
1146 scanning more than was requested, but for the normal interface, this is
1149 strftime(CS tmpbuf
, sizeof(tmpbuf
), "%d %b %H:%M:%S", localtime(&t
));
1150 scanrequest
= string_sprintf("<0>%s:%s", CS tmpbuf
, eml_filename
);
1151 p
= Ustrrchr(scanrequest
, '/');
1155 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1156 scanner_name
, scanner_options
);
1158 /* send scan request */
1159 if (m_sock_send(malware_daemon_ctx
.sock
, scanrequest
, Ustrlen(scanrequest
)+1, &errstr
) < 0)
1160 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1162 /* wait for result */
1163 if (!recv_len(malware_daemon_ctx
.sock
, tmpbuf
, 2, tmo
))
1164 return m_panic_defer_3(scanent
, CUS callout_address
,
1165 US
"unable to read 2 bytes from socket.", malware_daemon_ctx
.sock
);
1167 /* get errorcode from one nibble */
1168 kav_rc
= tmpbuf
[ test_byte_order()==LITTLE_MY_ENDIAN
? 0 : 1 ] & 0x0F;
1171 case 5: case 6: /* improper kavdaemon configuration */
1172 return m_panic_defer_3(scanent
, CUS callout_address
,
1173 US
"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
1174 malware_daemon_ctx
.sock
);
1176 return m_panic_defer_3(scanent
, CUS callout_address
,
1177 US
"reported 'scanning not completed' (code 1).", malware_daemon_ctx
.sock
);
1179 return m_panic_defer_3(scanent
, CUS callout_address
,
1180 US
"reported 'kavdaemon damaged' (code 7).", malware_daemon_ctx
.sock
);
1183 /* code 8 is not handled, since it is ambiguous. It appears mostly on
1184 bounces where part of a file has been cut off */
1186 /* "virus found" return codes (2-4) */
1187 if (kav_rc
> 1 && kav_rc
< 5)
1189 int report_flag
= 0;
1191 /* setup default virus name */
1192 malware_name
= US
"unknown";
1194 report_flag
= tmpbuf
[ test_byte_order() == LITTLE_MY_ENDIAN
? 1 : 0 ];
1196 /* read the report, if available */
1197 if (report_flag
== 1)
1199 /* read report size */
1200 if (!recv_len(malware_daemon_ctx
.sock
, &kav_reportlen
, 4, tmo
))
1201 return m_panic_defer_3(scanent
, CUS callout_address
,
1202 US
"cannot read report size", malware_daemon_ctx
.sock
);
1204 /* it's possible that avp returns av_buffer[1] == 1 but the
1205 reportsize is 0 (!?) */
1206 if (kav_reportlen
> 0)
1208 /* set up match regex, depends on retcode */
1211 if (!kav_re_sus
) kav_re_sus
= m_pcre_compile(kav_re_sus_str
, &errstr
);
1212 kav_re
= kav_re_sus
;
1216 if (!kav_re_inf
) kav_re_inf
= m_pcre_compile(kav_re_inf_str
, &errstr
);
1217 kav_re
= kav_re_inf
;
1220 /* read report, linewise. Using size from stream to read amount of data
1221 from same stream is safe enough. */
1222 /* coverity[tainted_data] */
1223 while (kav_reportlen
> 0)
1225 if ((bread
= recv_line(malware_daemon_ctx
.sock
, tmpbuf
, sizeof(tmpbuf
), tmo
)) < 0)
1227 kav_reportlen
-= bread
+1;
1229 /* try matcher on the line, grab substring */
1230 if ((malware_name
= m_pcre_exec(kav_re
, tmpbuf
)))
1236 else /* no virus found */
1237 malware_name
= NULL
;
1243 #ifndef DISABLE_MAL_CMDLINE
1244 case M_CMDL
: /* "cmdline" scanner type ---------------------------------- */
1246 const uschar
*cmdline_scanner
= scanner_options
;
1247 const pcre
*cmdline_trigger_re
;
1248 const pcre
*cmdline_regex_re
;
1250 uschar
* commandline
;
1251 void (*eximsigchld
)(int);
1252 void (*eximsigpipe
)(int);
1253 FILE *scanner_out
= NULL
;
1255 FILE *scanner_record
= NULL
;
1256 uschar linebuffer
[32767];
1261 if (!cmdline_scanner
)
1262 return m_panic_defer(scanent
, NULL
, errstr
);
1264 /* find scanner output trigger */
1265 cmdline_trigger_re
= m_pcre_nextinlist(&av_scanner_work
, &sep
,
1266 "missing trigger specification", &errstr
);
1267 if (!cmdline_trigger_re
)
1268 return m_panic_defer(scanent
, NULL
, errstr
);
1270 /* find scanner name regex */
1271 cmdline_regex_re
= m_pcre_nextinlist(&av_scanner_work
, &sep
,
1272 "missing virus name regex specification", &errstr
);
1273 if (!cmdline_regex_re
)
1274 return m_panic_defer(scanent
, NULL
, errstr
);
1276 /* prepare scanner call; despite the naming, file_name holds a directory
1277 name which is documented as the value given to %s. */
1279 file_name
= string_copy(eml_filename
);
1280 p
= Ustrrchr(file_name
, '/');
1283 commandline
= string_sprintf(CS cmdline_scanner
, file_name
);
1285 /* redirect STDERR too */
1286 commandline
= string_sprintf("%s 2>&1", commandline
);
1288 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1289 scanner_name
, commandline
);
1291 /* store exims signal handlers */
1292 eximsigchld
= signal(SIGCHLD
,SIG_DFL
);
1293 eximsigpipe
= signal(SIGPIPE
,SIG_DFL
);
1295 if (!(scanner_out
= popen(CS commandline
,"r")))
1298 signal(SIGCHLD
,eximsigchld
); signal(SIGPIPE
,eximsigpipe
);
1299 return m_panic_defer(scanent
, NULL
,
1300 string_sprintf("call (%s) failed: %s.", commandline
, strerror(err
)));
1302 scanner_fd
= fileno(scanner_out
);
1304 file_name
= string_sprintf("%s/%s_scanner_output", eml_dir
, message_id
);
1306 if (!(scanner_record
= modefopen(file_name
, "wb", SPOOL_MODE
)))
1309 (void) pclose(scanner_out
);
1310 signal(SIGCHLD
,eximsigchld
); signal(SIGPIPE
,eximsigpipe
);
1311 return m_panic_defer(scanent
, NULL
, string_sprintf(
1312 "opening scanner output file (%s) failed: %s.",
1313 file_name
, strerror(err
)));
1316 /* look for trigger while recording output */
1317 while ((rcnt
= recv_line(scanner_fd
, linebuffer
,
1318 sizeof(linebuffer
), tmo
)))
1325 (void) pclose(scanner_out
);
1326 signal(SIGCHLD
,eximsigchld
); signal(SIGPIPE
,eximsigpipe
);
1327 return m_panic_defer(scanent
, NULL
, string_sprintf(
1328 "unable to read from scanner (%s): %s",
1329 commandline
, strerror(err
)));
1332 if (Ustrlen(linebuffer
) > fwrite(linebuffer
, 1, Ustrlen(linebuffer
), scanner_record
))
1335 (void) pclose(scanner_out
);
1336 signal(SIGCHLD
,eximsigchld
); signal(SIGPIPE
,eximsigpipe
);
1337 return m_panic_defer(scanent
, NULL
, string_sprintf(
1338 "short write on scanner output file (%s).", file_name
));
1340 putc('\n', scanner_record
);
1341 /* try trigger match */
1343 && regex_match_and_setup(cmdline_trigger_re
, linebuffer
, 0, -1)
1348 (void)fclose(scanner_record
);
1349 sep
= pclose(scanner_out
);
1350 signal(SIGCHLD
,eximsigchld
); signal(SIGPIPE
,eximsigpipe
);
1352 return m_panic_defer(scanent
, NULL
,
1354 ? string_sprintf("running scanner failed: %s", strerror(sep
))
1355 : string_sprintf("scanner returned error code: %d", sep
));
1360 /* setup default virus name */
1361 malware_name
= US
"unknown";
1363 /* re-open the scanner output file, look for name match */
1364 scanner_record
= fopen(CS file_name
, "rb");
1365 while (fgets(CS linebuffer
, sizeof(linebuffer
), scanner_record
))
1368 if ((s
= m_pcre_exec(cmdline_regex_re
, linebuffer
)))
1371 (void)fclose(scanner_record
);
1373 else /* no virus found */
1374 malware_name
= NULL
;
1379 #ifndef DISABLE_MAL_SOPHIE
1380 case M_SOPHIE
: /* "sophie" scanner type --------------------------------- */
1385 uschar av_buffer
[1024];
1387 /* pass the scan directory to sophie */
1388 file_name
= string_copy(eml_filename
);
1389 if ((p
= Ustrrchr(file_name
, '/')))
1392 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1393 scanner_name
, scanner_options
);
1395 if ( write(malware_daemon_ctx
.sock
, file_name
, Ustrlen(file_name
)) < 0
1396 || write(malware_daemon_ctx
.sock
, "\n", 1) != 1
1398 return m_panic_defer_3(scanent
, CUS callout_address
,
1399 string_sprintf("unable to write to UNIX socket (%s)", scanner_options
),
1400 malware_daemon_ctx
.sock
);
1402 /* wait for result */
1403 memset(av_buffer
, 0, sizeof(av_buffer
));
1404 if ((bread
= ip_recv(&malware_daemon_ctx
, av_buffer
, sizeof(av_buffer
), tmo
-time(NULL
))) <= 0)
1405 return m_panic_defer_3(scanent
, CUS callout_address
,
1406 string_sprintf("unable to read from UNIX socket (%s)", scanner_options
),
1407 malware_daemon_ctx
.sock
);
1410 if (av_buffer
[0] == '1') {
1411 uschar
* s
= Ustrchr(av_buffer
, '\n');
1414 malware_name
= string_copy(&av_buffer
[2]);
1416 else if (!strncmp(CS av_buffer
, "-1", 2))
1417 return m_panic_defer_3(scanent
, CUS callout_address
,
1418 US
"scanner reported error", malware_daemon_ctx
.sock
);
1419 else /* all ok, no virus */
1420 malware_name
= NULL
;
1426 #ifndef DISABLE_MAL_CLAM
1427 case M_CLAMD
: /* "clamd" scanner type ----------------------------------- */
1429 /* This code was originally contributed by David Saez */
1430 /* There are three scanning methods available to us:
1431 * (1) Use the SCAN command, pointing to a file in the filesystem
1432 * (2) Use the STREAM command, send the data on a separate port
1433 * (3) Use the zINSTREAM command, send the data inline
1434 * The zINSTREAM command was introduced with ClamAV 0.95, which marked
1435 * STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1436 * In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
1437 * the TCP-connected daemon is actually local; otherwise we use zINSTREAM
1438 * See Exim bug 926 for details. */
1440 uschar
*p
, *vname
, *result_tag
;
1442 uschar av_buffer
[1024];
1443 uschar
*hostname
= US
"";
1445 uschar
*clamav_fbuf
;
1446 int clam_fd
, result
;
1448 unsigned int fsize_uint
;
1449 BOOL use_scan_command
= FALSE
;
1450 clamd_address
* cv
[MAX_CLAMD_SERVERS
];
1451 int num_servers
= 0;
1452 uint32_t send_size
, send_final_zeroblock
;
1455 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1456 there's no reason we should not mix local and remote servers */
1458 if (*scanner_options
== '/')
1461 const uschar
* sublist
;
1464 /* Local file; so we def want to use_scan_command and don't want to try
1465 * passing IP/port combinations */
1466 use_scan_command
= TRUE
;
1467 cd
= (clamd_address
*) store_get(sizeof(clamd_address
));
1469 /* extract socket-path part */
1470 sublist
= scanner_options
;
1471 cd
->hostspec
= string_nextinlist(&sublist
, &subsep
, NULL
, 0);
1474 if (clamd_option(cd
, sublist
, &subsep
) != OK
)
1475 return m_panic_defer(scanent
, NULL
,
1476 string_sprintf("bad option '%s'", scanner_options
));
1481 /* Go through the rest of the list of host/port and construct an array
1482 * of servers to try. The first one is the bit we just passed from
1483 * scanner_options so process that first and then scan the remainder of
1484 * the address buffer */
1488 const uschar
* sublist
;
1492 /* The 'local' option means use the SCAN command over the network
1493 * socket (ie common file storage in use) */
1494 /*XXX we could accept this also as a local option? */
1495 if (strcmpic(scanner_options
, US
"local") == 0)
1497 use_scan_command
= TRUE
;
1501 cd
= (clamd_address
*) store_get(sizeof(clamd_address
));
1503 /* extract host and port part */
1504 sublist
= scanner_options
;
1505 if (!(cd
->hostspec
= string_nextinlist(&sublist
, &subsep
, NULL
, 0)))
1507 (void) m_panic_defer(scanent
, NULL
,
1508 string_sprintf("missing address: '%s'", scanner_options
));
1511 if (!(s
= string_nextinlist(&sublist
, &subsep
, NULL
, 0)))
1513 (void) m_panic_defer(scanent
, NULL
,
1514 string_sprintf("missing port: '%s'", scanner_options
));
1517 cd
->tcp_port
= atoi(CS s
);
1520 /*XXX should these options be common over scanner types? */
1521 if (clamd_option(cd
, sublist
, &subsep
) != OK
)
1522 return m_panic_defer(scanent
, NULL
,
1523 string_sprintf("bad option '%s'", scanner_options
));
1525 cv
[num_servers
++] = cd
;
1526 if (num_servers
>= MAX_CLAMD_SERVERS
)
1528 (void) m_panic_defer(scanent
, NULL
,
1529 US
"More than " MAX_CLAMD_SERVERS_S
" clamd servers "
1530 "specified; only using the first " MAX_CLAMD_SERVERS_S
);
1533 } while ((scanner_options
= string_nextinlist(&av_scanner_work
, &sep
,
1536 /* check if we have at least one server */
1538 return m_panic_defer(scanent
, NULL
,
1539 US
"no useable server addresses in malware configuration option.");
1542 /* See the discussion of response formats below to see why we really
1543 don't like colons in filenames when passing filenames to ClamAV. */
1544 if (use_scan_command
&& Ustrchr(eml_filename
, ':'))
1545 return m_panic_defer(scanent
, NULL
,
1546 string_sprintf("local/SCAN mode incompatible with" \
1547 " : in path to email filename [%s]", eml_filename
));
1549 /* Set up the very first data we will be sending */
1550 if (!use_scan_command
)
1551 { cmd_str
.data
= US
"zINSTREAM"; cmd_str
.len
= 10; }
1554 cmd_str
.data
= string_sprintf("SCAN %s\n", eml_filename
);
1555 cmd_str
.len
= Ustrlen(cmd_str
.data
);
1558 /* We have some network servers specified */
1561 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1562 * only supports AF_INET, but we should probably be looking to the
1563 * future and rewriting this to be protocol-independent anyway. */
1565 while (num_servers
> 0)
1567 int i
= random_number(num_servers
);
1568 clamd_address
* cd
= cv
[i
];
1570 DEBUG(D_acl
) debug_printf_indent("trying server name %s, port %u\n",
1571 cd
->hostspec
, cd
->tcp_port
);
1573 /* Lookup the host. This is to ensure that we connect to the same IP
1574 * on both connections (as one host could resolve to multiple ips) */
1577 /*XXX we trust that the cmd_str is ideempotent */
1578 if ((malware_daemon_ctx
.sock
= m_tcpsocket(cd
->hostspec
, cd
->tcp_port
,
1579 &connhost
, &errstr
, &cmd_str
)) >= 0)
1581 /* Connection successfully established with a server */
1582 hostname
= cd
->hostspec
;
1586 if (cd
->retry
<= 0) break;
1587 while (cd
->retry
> 0) cd
->retry
= sleep(cd
->retry
);
1589 if (malware_daemon_ctx
.sock
>= 0)
1592 (void) m_panic_defer(scanent
, CUS callout_address
, errstr
);
1594 /* Remove the server from the list. XXX We should free the memory */
1596 for (; i
< num_servers
; i
++)
1600 if (num_servers
== 0)
1601 return m_panic_defer(scanent
, NULL
, US
"all servers failed");
1606 if ((malware_daemon_ctx
.sock
= ip_unixsocket(cv
[0]->hostspec
, &errstr
)) >= 0)
1608 hostname
= cv
[0]->hostspec
;
1611 if (cv
[0]->retry
<= 0)
1612 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1613 while (cv
[0]->retry
> 0) cv
[0]->retry
= sleep(cv
[0]->retry
);
1616 /* have socket in variable "sock"; command to use is semi-independent of
1617 * the socket protocol. We use SCAN if is local (either Unix/local
1618 * domain socket, or explicitly told local) else we stream the data.
1619 * How we stream the data depends upon how we were built. */
1621 if (!use_scan_command
)
1623 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1624 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1627 DEBUG(D_acl
) debug_printf_indent(
1628 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1631 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1633 if (send(malware_daemon_ctx
.sock
, cmd_str
.data
, cmd_str
.len
, 0) < 0)
1634 return m_panic_defer_3(scanent
, CUS hostname
,
1635 string_sprintf("unable to send zINSTREAM to socket (%s)",
1637 malware_daemon_ctx
.sock
);
1639 /* calc file size */
1640 if ((clam_fd
= open(CS eml_filename
, O_RDONLY
)) < 0)
1643 return m_panic_defer_3(scanent
, NULL
,
1644 string_sprintf("can't open spool file %s: %s",
1645 eml_filename
, strerror(err
)),
1646 malware_daemon_ctx
.sock
);
1648 if ((fsize
= lseek(clam_fd
, 0, SEEK_END
)) < 0)
1651 b_seek
: err
= errno
;
1652 (void)close(clam_fd
);
1653 return m_panic_defer_3(scanent
, NULL
,
1654 string_sprintf("can't seek spool file %s: %s",
1655 eml_filename
, strerror(err
)),
1656 malware_daemon_ctx
.sock
);
1658 fsize_uint
= (unsigned int) fsize
;
1659 if ((off_t
)fsize_uint
!= fsize
)
1661 (void)close(clam_fd
);
1662 return m_panic_defer_3(scanent
, NULL
,
1663 string_sprintf("seeking spool file %s, size overflow",
1665 malware_daemon_ctx
.sock
);
1667 if (lseek(clam_fd
, 0, SEEK_SET
) < 0)
1670 if (!(clamav_fbuf
= US
malloc(fsize_uint
)))
1672 (void)close(clam_fd
);
1673 return m_panic_defer_3(scanent
, NULL
,
1674 string_sprintf("unable to allocate memory %u for file (%s)",
1675 fsize_uint
, eml_filename
),
1676 malware_daemon_ctx
.sock
);
1679 if ((result
= read(clam_fd
, clamav_fbuf
, fsize_uint
)) < 0)
1682 free(clamav_fbuf
); (void)close(clam_fd
);
1683 return m_panic_defer_3(scanent
, NULL
,
1684 string_sprintf("can't read spool file %s: %s",
1685 eml_filename
, strerror(err
)),
1686 malware_daemon_ctx
.sock
);
1688 (void)close(clam_fd
);
1690 /* send file body to socket */
1691 send_size
= htonl(fsize_uint
);
1692 send_final_zeroblock
= 0;
1693 if ((send(malware_daemon_ctx
.sock
, &send_size
, sizeof(send_size
), 0) < 0) ||
1694 (send(malware_daemon_ctx
.sock
, clamav_fbuf
, fsize_uint
, 0) < 0) ||
1695 (send(malware_daemon_ctx
.sock
, &send_final_zeroblock
, sizeof(send_final_zeroblock
), 0) < 0))
1698 return m_panic_defer_3(scanent
, NULL
,
1699 string_sprintf("unable to send file body to socket (%s)", hostname
),
1700 malware_daemon_ctx
.sock
);
1706 { /* use scan command */
1707 /* Send a SCAN command pointing to a filename; then in the then in the
1708 * scan-method-neutral part, read the response back */
1710 /* ================================================================= */
1712 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1713 which dates to when ClamAV needed us to break apart the email into the
1714 MIME parts (eg, with the now deprecated demime condition coming first).
1715 Some time back, ClamAV gained the ability to deconstruct the emails, so
1716 doing this would actually have resulted in the mail attachments being
1717 scanned twice, in the broken out files and from the original .eml.
1718 Since ClamAV now handles emails (and has for quite some time) we can
1719 just use the email file itself. */
1720 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
1722 DEBUG(D_acl
) debug_printf_indent(
1723 "Malware scan: issuing %s local-path scan [%s]\n",
1724 scanner_name
, scanner_options
);
1727 if (send(malware_daemon_ctx
.sock
, cmd_str
.data
, cmd_str
.len
, 0) < 0)
1728 return m_panic_defer_3(scanent
, CUS callout_address
,
1729 string_sprintf("unable to write to socket (%s)", strerror(errno
)),
1730 malware_daemon_ctx
.sock
);
1732 /* Do not shut down the socket for writing; a user report noted that
1733 * clamd 0.70 does not react well to this. */
1735 /* Commands have been sent, no matter which scan method or connection
1736 * type we're using; now just read the result, independent of method. */
1738 /* Read the result */
1739 memset(av_buffer
, 0, sizeof(av_buffer
));
1740 bread
= ip_recv(&malware_daemon_ctx
, av_buffer
, sizeof(av_buffer
), tmo
-time(NULL
));
1741 (void)close(malware_daemon_ctx
.sock
);
1742 malware_daemon_ctx
.sock
= -1;
1743 malware_daemon_ctx
.tls_ctx
= NULL
;
1746 return m_panic_defer(scanent
, CUS callout_address
,
1747 string_sprintf("unable to read from socket (%s)",
1748 errno
== 0 ? "EOF" : strerror(errno
)));
1750 if (bread
== sizeof(av_buffer
))
1751 return m_panic_defer(scanent
, CUS callout_address
,
1752 US
"buffer too small");
1753 /* We're now assured of a NULL at the end of av_buffer */
1755 /* Check the result. ClamAV returns one of two result formats.
1756 In the basic mode, the response is of the form:
1757 infected: -> "<filename>: <virusname> FOUND"
1758 not-infected: -> "<filename>: OK"
1759 error: -> "<filename>: <errcode> ERROR
1760 If the ExtendedDetectionInfo option has been turned on, then we get:
1761 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1762 for the infected case. Compare:
1763 /tmp/eicar.com: Eicar-Test-Signature FOUND
1764 /tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1766 In the streaming case, clamd uses the filename "stream" which you should
1767 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1768 client app will replace "stream" with the original filename before returning
1769 results to stdout, but the trace shows the data).
1771 We will assume that the pathname passed to clamd from Exim does not contain
1772 a colon. We will have whined loudly above if the eml_filename does (and we're
1773 passing a filename to clamd). */
1776 return m_panic_defer(scanent
, CUS callout_address
,
1777 US
"ClamAV returned null");
1779 /* strip newline at the end (won't be present for zINSTREAM)
1780 (also any trailing whitespace, which shouldn't exist, but we depend upon
1781 this below, so double-check) */
1782 p
= av_buffer
+ Ustrlen(av_buffer
) - 1;
1783 if (*p
== '\n') *p
= '\0';
1785 DEBUG(D_acl
) debug_printf_indent("Malware response: %s\n", av_buffer
);
1787 while (isspace(*--p
) && (p
> av_buffer
))
1791 /* colon in returned output? */
1792 if(!(p
= Ustrchr(av_buffer
,':')))
1793 return m_panic_defer(scanent
, CUS callout_address
, string_sprintf(
1794 "ClamAV returned malformed result (missing colon): %s",
1797 /* strip filename */
1798 while (*p
&& isspace(*++p
)) /**/;
1801 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1802 but we should at least be resistant to it. */
1803 p
= Ustrrchr(vname
, ' ');
1804 result_tag
= p
? p
+1 : vname
;
1806 if (Ustrcmp(result_tag
, "FOUND") == 0)
1808 /* p should still be the whitespace before the result_tag */
1809 while (isspace(*p
)) --p
;
1811 /* Strip off the extended information too, which will be in parens
1812 after the virus name, with no intervening whitespace. */
1815 /* "(hash:size)", so previous '(' will do; if not found, we have
1816 a curious virus name, but not an error. */
1817 p
= Ustrrchr(vname
, '(');
1821 malware_name
= string_copy(vname
);
1822 DEBUG(D_acl
) debug_printf_indent("Malware found, name \"%s\"\n", malware_name
);
1825 else if (Ustrcmp(result_tag
, "ERROR") == 0)
1826 return m_panic_defer(scanent
, CUS callout_address
,
1827 string_sprintf("ClamAV returned: %s", av_buffer
));
1829 else if (Ustrcmp(result_tag
, "OK") == 0)
1831 /* Everything should be OK */
1832 malware_name
= NULL
;
1833 DEBUG(D_acl
) debug_printf_indent("Malware not found\n");
1837 return m_panic_defer(scanent
, CUS callout_address
,
1838 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer
));
1844 #ifndef DISABLE_MAL_SOCK
1845 case M_SOCK
: /* "sock" scanner type ------------------------------------- */
1846 /* This code was derived by Martin Poole from the clamd code contributed
1847 by David Saez and the cmdline code
1851 uschar
* commandline
;
1852 uschar av_buffer
[1024];
1853 uschar
* linebuffer
;
1854 uschar
* sockline_scanner
;
1855 uschar sockline_scanner_default
[] = "%s\n";
1856 const pcre
*sockline_trig_re
;
1857 const pcre
*sockline_name_re
;
1859 /* find scanner command line */
1860 if ( (sockline_scanner
= string_nextinlist(&av_scanner_work
, &sep
,
1862 && *sockline_scanner
1864 { /* check for no expansions apart from one %s */
1865 uschar
* s
= Ustrchr(sockline_scanner
, '%');
1867 if ((*s
!= 's' && *s
!= '%') || Ustrchr(s
+1, '%'))
1868 return m_panic_defer_3(scanent
, NULL
,
1869 US
"unsafe sock scanner call spec", malware_daemon_ctx
.sock
);
1872 sockline_scanner
= sockline_scanner_default
;
1873 DEBUG(D_acl
) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1874 string_printing(sockline_scanner
));
1876 /* find scanner output trigger */
1877 sockline_trig_re
= m_pcre_nextinlist(&av_scanner_work
, &sep
,
1878 "missing trigger specification", &errstr
);
1879 if (!sockline_trig_re
)
1880 return m_panic_defer_3(scanent
, NULL
, errstr
, malware_daemon_ctx
.sock
);
1882 /* find virus name regex */
1883 sockline_name_re
= m_pcre_nextinlist(&av_scanner_work
, &sep
,
1884 "missing virus name regex specification", &errstr
);
1885 if (!sockline_name_re
)
1886 return m_panic_defer_3(scanent
, NULL
, errstr
, malware_daemon_ctx
.sock
);
1888 /* prepare scanner call - security depends on expansions check above */
1889 commandline
= string_sprintf( CS sockline_scanner
, CS eml_filename
);
1890 DEBUG(D_acl
) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1891 string_printing(commandline
));
1893 /* Pass the command string to the socket */
1894 if (m_sock_send(malware_daemon_ctx
.sock
, commandline
, Ustrlen(commandline
), &errstr
) < 0)
1895 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1897 /* Read the result */
1898 bread
= ip_recv(&malware_daemon_ctx
, av_buffer
, sizeof(av_buffer
), tmo
-time(NULL
));
1901 return m_panic_defer_3(scanent
, CUS callout_address
,
1902 string_sprintf("unable to read from socket (%s)", strerror(errno
)),
1903 malware_daemon_ctx
.sock
);
1905 if (bread
== sizeof(av_buffer
))
1906 return m_panic_defer_3(scanent
, CUS callout_address
,
1907 US
"buffer too small", malware_daemon_ctx
.sock
);
1908 av_buffer
[bread
] = '\0';
1909 linebuffer
= string_copy(av_buffer
);
1910 DEBUG(D_acl
) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1911 string_printing(linebuffer
));
1913 /* try trigger match */
1914 if (regex_match_and_setup(sockline_trig_re
, linebuffer
, 0, -1))
1916 if (!(malware_name
= m_pcre_exec(sockline_name_re
, av_buffer
)))
1917 malware_name
= US
"unknown";
1918 DEBUG(D_acl
) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1919 string_printing(malware_name
));
1921 else /* no virus found */
1922 malware_name
= NULL
;
1927 #ifndef DISABLE_MAL_MKS
1928 case M_MKSD
: /* "mksd" scanner type ------------------------------------- */
1930 char *mksd_options_end
;
1931 int mksd_maxproc
= 1; /* default, if no option supplied */
1934 if (scanner_options
)
1936 mksd_maxproc
= (int)strtol(CS scanner_options
, &mksd_options_end
, 10);
1937 if ( *scanner_options
== '\0'
1938 || *mksd_options_end
!= '\0'
1940 || mksd_maxproc
> 32
1942 return m_panic_defer(scanent
, CUS callout_address
,
1943 string_sprintf("invalid option '%s'", scanner_options
));
1946 if((malware_daemon_ctx
.sock
= ip_unixsocket(US
"/var/run/mksd/socket", &errstr
)) < 0)
1947 return m_panic_defer(scanent
, CUS callout_address
, errstr
);
1949 malware_name
= NULL
;
1951 DEBUG(D_acl
) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name
);
1953 if ((retval
= mksd_scan_packed(scanent
, malware_daemon_ctx
.sock
, eml_filename
, tmo
)) != OK
)
1955 close (malware_daemon_ctx
.sock
);
1962 #ifndef DISABLE_MAL_AVAST
1963 case M_AVAST
: /* "avast" scanner type ----------------------------------- */
1966 uschar
* scanrequest
;
1967 enum {AVA_HELO
, AVA_OPT
, AVA_RSP
, AVA_DONE
} avast_stage
;
1969 uschar
* error_message
= NULL
;
1970 BOOL more_data
= FALSE
;
1973 /* According to Martin Tuma @avast the protocol uses "escaped
1974 whitespace", that is, every embedded whitespace is backslash
1975 escaped, as well as backslash is protected by backslash.
1976 The returned lines contain the name of the scanned file, a tab
1980 [E] - some error occured
1981 Such marker follows the first non-escaped TAB. For more information
1982 see avast-protocol(5)
1984 We observed two cases:
1986 <- /file [E]0.0 Error 13 Permission denied
1987 <- 451 SCAN Engine error 13 permission denied
1990 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1992 <- /file… [+]2.0 0 Eicar Test Virus!!!
1995 If the scanner returns 4xx, DEFER is a good decision, combined
1996 with a panic log entry, to get the admin's attention.
1998 If the scanner returns 200, we reject it as malware, if found any,
1999 or, in case of an error, we set the malware message to the error
2002 Some of the >= 42000 errors are message related - usually some
2003 broken archives etc, but some of them are e.g. license related.
2004 Once the license expires the engine starts returning errors for
2005 every scanning attempt. I¹ have the full list of the error codes
2006 but it is not a public API and is subject to change. It is hard
2007 for me to say what you should do in case of an engine error. You
2008 can have a “Treat * unscanned file as infection” policy or “Treat
2009 unscanned file as clean” policy. ¹) Jakub Bednar
2013 if ( ( !ava_re_clean
2014 && !(ava_re_clean
= m_pcre_compile(ava_re_clean_str
, &errstr
)))
2016 && !(ava_re_virus
= m_pcre_compile(ava_re_virus_str
, &errstr
)))
2018 && !(ava_re_error
= m_pcre_compile(ava_re_error_str
, &errstr
)))
2020 return malware_panic_defer(errstr
);
2022 /* wait for result */
2023 for (avast_stage
= AVA_HELO
;
2024 (nread
= recv_line(malware_daemon_ctx
.sock
, buf
, sizeof(buf
), tmo
)) > 0;
2027 int slen
= Ustrlen(buf
);
2031 /* Multi line responses are bracketed between 210 … and nnn … */
2032 if (Ustrncmp(buf
, "210", 3) == 0)
2037 else if (more_data
&& isdigit(buf
[0])) more_data
= 0;
2039 switch (avast_stage
)
2042 if (more_data
) continue;
2043 if (Ustrncmp(buf
, "220", 3) != 0)
2044 goto endloop
; /* require a 220 */
2048 if (more_data
) continue;
2049 if (Ustrncmp(buf
, "200", 3) != 0)
2050 goto endloop
; /* require a 200 */
2055 /* Check for another option to send. Newline-terminate it. */
2056 if ((scanrequest
= string_nextinlist(&av_scanner_work
, &sep
,
2059 if (Ustrcmp(scanrequest
, "pass_unscanned") == 0)
2061 DEBUG(D_acl
) debug_printf_indent("pass unscanned files as clean\n");
2065 scanrequest
= string_sprintf("%s\n", scanrequest
);
2066 avast_stage
= AVA_OPT
; /* just sent option */
2067 DEBUG(D_acl
) debug_printf_indent("send to avast OPTION: %s", scanrequest
);
2071 scanrequest
= string_sprintf("SCAN %s\n", eml_dir
);
2072 avast_stage
= AVA_RSP
; /* just sent command */
2073 DEBUG(D_acl
) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir
);
2076 /* send config-cmd or scan-request to socket */
2077 len
= Ustrlen(scanrequest
);
2078 if (send(malware_daemon_ctx
.sock
, scanrequest
, len
, 0) == -1)
2080 scanrequest
[len
-1] = '\0';
2081 return m_panic_defer_3(scanent
, CUS callout_address
, string_sprintf(
2082 "unable to send request '%s' to socket (%s): %s",
2083 scanrequest
, scanner_options
, strerror(errno
)), malware_daemon_ctx
.sock
);
2090 if (isdigit(buf
[0])) /* We're done */
2093 if (malware_name
) /* Nothing else matters, just read on */
2096 if (pcre_exec(ava_re_clean
, NULL
, CS buf
, slen
, 0, 0, NULL
, 0) == 0)
2099 if ((malware_name
= m_pcre_exec(ava_re_virus
, buf
)))
2101 unescape(malware_name
);
2103 debug_printf_indent("unescaped malware name: '%s'\n", malware_name
);
2107 if (strict
) /* treat scanner errors as malware */
2109 if ((malware_name
= m_pcre_exec(ava_re_error
, buf
)))
2111 unescape(malware_name
);
2113 debug_printf_indent("unescaped error message: '%s'\n", malware_name
);
2117 else if (pcre_exec(ava_re_error
, NULL
, CS buf
, slen
, 0, 0, NULL
, 0) == 0)
2119 log_write(0, LOG_MAIN
, "internal scanner error (ignored): %s", buf
);
2123 /* here also for any unexpected response from the scanner */
2124 DEBUG(D_acl
) debug_printf("avast response not handled: '%s'\n", buf
);
2128 default: log_write(0, LOG_PANIC
, "%s:%d:%s: should not happen",
2129 __FILE__
, __LINE__
, __FUNCTION__
);
2136 if (nread
== -1) error_message
= US
"EOF from scanner";
2137 else if (nread
< 0) error_message
= US
"timeout from scanner";
2138 else if (nread
== 0) error_message
= US
"got nothing from scanner";
2139 else if (buf
[0] != '2') error_message
= buf
;
2141 DEBUG(D_acl
) debug_printf_indent("sent to avast QUIT\n");
2142 if (send(malware_daemon_ctx
.sock
, "QUIT\n", 5, 0) == -1)
2143 return m_panic_defer_3(scanent
, CUS callout_address
,
2144 string_sprintf("unable to send quit request to socket (%s): %s",
2145 scanner_options
, strerror(errno
)), malware_daemon_ctx
.sock
);
2148 return m_panic_defer_3(scanent
, CUS callout_address
, error_message
, malware_daemon_ctx
.sock
);
2152 } /* scanner type switch */
2154 if (malware_daemon_ctx
.sock
>= 0)
2155 (void) close (malware_daemon_ctx
.sock
);
2156 malware_ok
= TRUE
; /* set "been here, done that" marker */
2159 /* match virus name against pattern (caseless ------->----------v) */
2160 if (malware_name
&& regex_match_and_setup(re
, malware_name
, 0, -1))
2162 DEBUG(D_acl
) debug_printf_indent(
2163 "Matched regex to malware [%s] [%s]\n", malware_re
, malware_name
);
2171 /*************************************************
2172 * Scan an email for malware *
2173 *************************************************/
2175 /* This is the normal interface for scanning an email, which doesn't need a
2176 filename; it's a wrapper around the malware_file function.
2179 malware_re match condition for "malware="
2180 timeout if nonzero, timeout in seconds
2182 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2183 where true means malware was found (condition applies)
2186 malware(const uschar
* malware_re
, int timeout
)
2188 int ret
= malware_internal(malware_re
, NULL
, timeout
);
2190 if (ret
== DEFER
) av_failed
= TRUE
;
2195 /*************************************************
2196 * Scan a file for malware *
2197 *************************************************/
2199 /* This is a test wrapper for scanning an email, which is not used in
2200 normal processing. Scan any file, using the Exim scanning interface.
2201 This function tampers with various global variables so is unsafe to use
2202 in any other context.
2205 eml_filename a file holding the message to be scanned
2207 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2208 where true means malware was found (condition applies)
2211 malware_in_file(uschar
*eml_filename
)
2213 uschar message_id_buf
[64];
2216 /* spool_mbox() assumes various parameters exist, when creating
2217 the relevant directory and the email within */
2219 (void) string_format(message_id_buf
, sizeof(message_id_buf
),
2220 "dummy-%d", vaguely_random_number(INT_MAX
));
2221 message_id
= message_id_buf
;
2222 sender_address
= US
"malware-sender@example.net";
2224 recipients_list
= NULL
;
2225 receive_add_recipient(US
"malware-victim@example.net", -1);
2226 f
.enable_dollar_recipients
= TRUE
;
2228 ret
= malware_internal(US
"*", eml_filename
, 0);
2230 Ustrncpy(spooled_message_id
, message_id
, sizeof(spooled_message_id
));
2233 /* don't set no_mbox_unspool; at present, there's no way for it to become
2234 set, but if that changes, then it should apply to these tests too */
2238 /* silence static analysis tools */
2248 if (!malware_default_re
)
2249 malware_default_re
= regex_must_compile(malware_regex_default
, FALSE
, TRUE
);
2251 #ifndef DISABLE_MAL_DRWEB
2253 drweb_re
= regex_must_compile(drweb_re_str
, FALSE
, TRUE
);
2255 #ifndef DISABLE_MAL_FSECURE
2257 fsec_re
= regex_must_compile(fsec_re_str
, FALSE
, TRUE
);
2259 #ifndef DISABLE_MAL_KAV
2261 kav_re_sus
= regex_must_compile(kav_re_sus_str
, FALSE
, TRUE
);
2263 kav_re_inf
= regex_must_compile(kav_re_inf_str
, FALSE
, TRUE
);
2265 #ifndef DISABLE_MAL_AVAST
2267 ava_re_clean
= regex_must_compile(ava_re_clean_str
, FALSE
, TRUE
);
2269 ava_re_virus
= regex_must_compile(ava_re_virus_str
, FALSE
, TRUE
);
2271 ava_re_error
= regex_must_compile(ava_re_error_str
, FALSE
, TRUE
);
2273 #ifndef DISABLE_MAL_FFROT6D
2274 if (!fprot6d_re_error
)
2275 fprot6d_re_error
= regex_must_compile(fprot6d_re_error_str
, FALSE
, TRUE
);
2276 if (!fprot6d_re_virus
)
2277 fprot6d_re_virus
= regex_must_compile(fprot6d_re_virus_str
, FALSE
, TRUE
);
2283 malware_show_supported(FILE * f
)
2286 fprintf(f
, "Malware:");
2287 for (sc
= m_scans
; sc
->scancode
!= (scanner_t
)-1; sc
++) fprintf(f
, " %s", sc
->name
);
2292 # endif /*!MACRO_PREDEF*/
2293 #endif /*WITH_CONTENT_SCAN*/