Copyright updates:
[exim.git] / src / src / malware.c
CommitLineData
8523533c
TK
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873
JH
5/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
6 * License: GPL
1e1ddfac 7 * Copyright (c) The Exim Maintainers 2015 - 2020
80fea873 8 */
8523533c
TK
9
10/* Code for calling virus (malware) scanners. Called from acl.c. */
11
12#include "exim.h"
c11d665d 13#ifdef WITH_CONTENT_SCAN /* entire file */
8523533c 14
c8599aad
JH
15typedef enum {
16#ifndef DISABLE_MAL_FFROTD
17 M_FPROTD,
18#endif
19#ifndef DISABLE_MAL_FFROT6D
20 M_FPROT6D,
21#endif
22#ifndef DISABLE_MAL_DRWEB
23 M_DRWEB,
24#endif
25#ifndef DISABLE_MAL_AVE
26 M_AVES,
27#endif
28#ifndef DISABLE_MAL_FSECURE
29 M_FSEC,
30#endif
31#ifndef DISABLE_MAL_KAV
32 M_KAVD,
33#endif
34#ifndef DISABLE_MAL_SOPHIE
35 M_SOPHIE,
36#endif
37#ifndef DISABLE_MAL_CLAM
38 M_CLAMD,
39#endif
40#ifndef DISABLE_MAL_MKS
41 M_MKSD,
42#endif
43#ifndef DISABLE_MAL_AVAST
44 M_AVAST,
45#endif
46#ifndef DISABLE_MAL_SOCK
47 M_SOCK,
48#endif
49#ifndef DISABLE_MAL_CMDLINE
50 M_CMDL,
51#endif
4e559e21 52 M_DUMMY
c8599aad 53 } scanner_t;
b1f8e4f8
JH
54typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
55static struct scan
56{
57 scanner_t scancode;
58 const uschar * name;
59 const uschar * options_default;
60 contype_t conn;
61} m_scans[] =
62{
c11d665d 63#ifndef DISABLE_MAL_FFROTD
b1f8e4f8 64 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
c11d665d
JH
65#endif
66#ifndef DISABLE_MAL_FFROT6D
67 { M_FPROT6D, US"f-prot6d", US"localhost 10200", MC_TCP },
68#endif
69#ifndef DISABLE_MAL_DRWEB
b1f8e4f8 70 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
c11d665d
JH
71#endif
72#ifndef DISABLE_MAL_AVE
b1f8e4f8 73 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
c11d665d
JH
74#endif
75#ifndef DISABLE_MAL_FSECURE
b1f8e4f8 76 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
c11d665d
JH
77#endif
78#ifndef DISABLE_MAL_KAV
b1f8e4f8 79 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
c11d665d
JH
80#endif
81#ifndef DISABLE_MAL_SOPHIE
b1f8e4f8 82 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
c11d665d
JH
83#endif
84#ifndef DISABLE_MAL_CLAM
b1f8e4f8 85 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
c11d665d
JH
86#endif
87#ifndef DISABLE_MAL_MKS
b1f8e4f8 88 { M_MKSD, US"mksd", NULL, MC_NONE },
c11d665d
JH
89#endif
90#ifndef DISABLE_MAL_AVAST
b6fbf22d 91 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
c11d665d
JH
92#endif
93#ifndef DISABLE_MAL_SOCK
94 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
95#endif
96#ifndef DISABLE_MAL_CMDLINE
97 { M_CMDL, US"cmdline", NULL, MC_NONE },
98#endif
b1f8e4f8
JH
99 { -1, NULL, NULL, MC_NONE } /* end-marker */
100};
101
c11d665d
JH
102/******************************************************************************/
103# ifdef MACRO_PREDEF /* build solely to predefine macros */
104
105# include "macro_predef.h"
106
107void
108features_malware(void)
109{
2b8b8e4e
JH
110const uschar * s;
111uschar * t;
c11d665d
JH
112uschar buf[64];
113
114spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
115
d7978c0f 116for (const struct scan * sc = m_scans; sc->scancode != -1; sc++)
c11d665d 117 {
d7978c0f
JH
118 for (s = sc->name, t = buf+14; *s; s++) if (*s != '-')
119 *t++ = toupper(*s);
c11d665d
JH
120 *t = '\0';
121 builtin_macro_create(buf);
122 }
123}
124
125/******************************************************************************/
126# else /*!MACRO_PREDEF, main build*/
127
128
129#define MALWARE_TIMEOUT 120 /* default timeout, seconds */
130
131static const uschar * malware_regex_default = US ".+";
132static const pcre * malware_default_re = NULL;
133
134
135
136#ifndef DISABLE_MAL_CLAM
599dcb77 137/* The maximum number of clamd servers that are supported in the configuration */
c11d665d
JH
138# define MAX_CLAMD_SERVERS 32
139# define MAX_CLAMD_SERVERS_S "32"
599dcb77 140
8a512ed5
JH
141typedef struct clamd_address {
142 uschar * hostspec;
143 unsigned tcp_port;
144 unsigned retry;
145} clamd_address;
8523533c
TK
146#endif
147
a9ccd69a 148
c11d665d
JH
149#ifndef DISABLE_MAL_DRWEB
150# define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
151# define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
152# define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
8523533c 153
c11d665d
JH
154# define DERR_READ_ERR (1<<0) /* read error */
155# define DERR_NOMEMORY (1<<2) /* no memory */
156# define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
157# define DERR_BAD_CALL (1<<15) /* wrong command */
476be7e2
JH
158
159static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
160static const pcre * drweb_re = NULL;
c11d665d 161#endif
476be7e2 162
c11d665d 163#ifndef DISABLE_MAL_FSECURE
476be7e2
JH
164static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
165static const pcre * fsec_re = NULL;
c11d665d 166#endif
476be7e2 167
c11d665d 168#ifndef DISABLE_MAL_KAV
476be7e2
JH
169static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
170static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
171static const pcre * kav_re_sus = NULL;
172static const pcre * kav_re_inf = NULL;
c11d665d 173#endif
476be7e2 174
c11d665d 175#ifndef DISABLE_MAL_AVAST
476be7e2 176static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
ad93c40f
HSHR
177static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
178static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
476be7e2
JH
179static const pcre * ava_re_clean = NULL;
180static const pcre * ava_re_virus = NULL;
ad93c40f 181static const pcre * ava_re_error = NULL;
c11d665d 182#endif
476be7e2 183
c11d665d 184#ifndef DISABLE_MAL_FFROT6D
71b32d41
ACK
185static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
186static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
187static const pcre * fprot6d_re_error = NULL;
188static const pcre * fprot6d_re_virus = NULL;
c11d665d 189#endif
71b32d41 190
476be7e2
JH
191
192
193/******************************************************************************/
194
059f2ace 195#ifndef DISABLE_MAL_KAV
b1f8e4f8 196/* Routine to check whether a system is big- or little-endian.
8523533c
TK
197 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
198 Needed for proper kavdaemon implementation. Sigh. */
059f2ace
JH
199# define BIG_MY_ENDIAN 0
200# define LITTLE_MY_ENDIAN 1
b1f8e4f8
JH
201static int test_byte_order(void);
202static inline int
203test_byte_order()
204{
205 short int word = 0x0001;
5903c6ff 206 char *byte = CS &word;
b1f8e4f8 207 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
8523533c 208}
059f2ace 209#endif
8523533c 210
b1f8e4f8 211BOOL malware_ok = FALSE;
8523533c 212
8544e77a
PP
213/* Gross hacks for the -bmalware option; perhaps we should just create
214the scan directory normally for that case, but look into rigging up the
215needed header variables if not already set on the command-line? */
216extern int spool_mbox_ok;
55240832 217extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
8544e77a 218
8544e77a 219
ad93c40f
HSHR
220/* Some (currently avast only) use backslash escaped whitespace,
221this function undoes these escapes */
46682a67 222
ad93c40f 223static inline void
46682a67
JH
224unescape(uschar *p)
225{
226uschar *p0;
227for (; *p; ++p)
228 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
229 for (p0 = p; *p0; ++p0) *p0 = p0[1];
ad93c40f 230}
8544e77a 231
ad93c40f 232/* --- malware_*_defer --- */
b1f8e4f8 233static inline int
ad93c40f 234malware_panic_defer(const uschar * str)
b1f8e4f8 235{
8a512ed5
JH
236log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
237return DEFER;
b1f8e4f8 238}
ad93c40f
HSHR
239static inline int
240malware_log_defer(const uschar * str)
241{
242log_write(0, LOG_MAIN, "malware acl condition: %s", str);
243return DEFER;
244}
245/* --- m_*_defer --- */
246static inline int
247m_panic_defer(struct scan * scanent, const uschar * hostport,
0ea02355 248 const uschar * str)
b1f8e4f8 249{
ad93c40f 250return malware_panic_defer(string_sprintf("%s %s : %s",
0ea02355 251 scanent->name, hostport ? hostport : CUS"", str));
b1f8e4f8 252}
ad93c40f
HSHR
253static inline int
254m_log_defer(struct scan * scanent, const uschar * hostport,
255 const uschar * str)
256{
257return malware_log_defer(string_sprintf("%s %s : %s",
258 scanent->name, hostport ? hostport : CUS"", str));
259}
260/* --- m_*_defer_3 */
261static inline int
262m_panic_defer_3(struct scan * scanent, const uschar * hostport,
263 const uschar * str, int fd_to_close)
264{
265(void) close(fd_to_close);
266return m_panic_defer(scanent, hostport, str);
267}
b1f8e4f8
JH
268
269/*************************************************/
270
c11d665d 271#ifndef DISABLE_MAL_CLAM
b1f8e4f8
JH
272/* Only used by the Clamav code, which is working from a list of servers and
273uses the returned in_addr to get a second connection to the same system.
274*/
275static inline int
276m_tcpsocket(const uschar * hostname, unsigned int port,
10ac8d7f 277 host_item * host, uschar ** errstr, const blob * fastopen_blob)
b1f8e4f8 278{
4a5cbaff 279return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
10ac8d7f 280 host, errstr, fastopen_blob);
b1f8e4f8 281}
c11d665d 282#endif
b1f8e4f8
JH
283
284static int
b1f8e4f8
JH
285m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
286{
8a512ed5
JH
287if (send(sock, buf, cnt, 0) < 0)
288 {
289 int err = errno;
290 (void)close(sock);
291 *errstr = string_sprintf("unable to send to socket (%s): %s",
292 buf, strerror(err));
293 return -1;
294 }
295return sock;
b1f8e4f8
JH
296}
297
298static const pcre *
299m_pcre_compile(const uschar * re, uschar ** errstr)
300{
8a512ed5
JH
301const uschar * rerror;
302int roffset;
303const pcre * cre;
304
3d2e82c5 305if (!(cre = pcre_compile(CS re, PCRE_COPT, CCSS &rerror, &roffset, NULL)))
8a512ed5
JH
306 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
307 re, rerror, roffset);
308return cre;
b1f8e4f8
JH
309}
310
311uschar *
312m_pcre_exec(const pcre * cre, uschar * text)
313{
8a512ed5
JH
314int ovector[10*3];
315int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
c11d665d 316 ovector, nelem(ovector));
8a512ed5
JH
317uschar * substr = NULL;
318if (i >= 2) /* Got it */
3d2e82c5 319 pcre_get_substring(CS text, ovector, i, 1, CCSS &substr);
8a512ed5 320return substr;
b1f8e4f8
JH
321}
322
323static const pcre *
55414b25
JH
324m_pcre_nextinlist(const uschar ** list, int * sep,
325 char * listerr, uschar ** errstr)
b1f8e4f8 326{
8a512ed5
JH
327const uschar * list_ele;
328const pcre * cre = NULL;
329
330if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
331 *errstr = US listerr;
332else
ac4d558b
JH
333 {
334 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
335 string_printing(list_ele));
8a512ed5 336 cre = m_pcre_compile(CUS list_ele, errstr);
ac4d558b 337 }
8a512ed5 338return cre;
b1f8e4f8
JH
339}
340
4e71661f
JH
341/*
342 Simple though inefficient wrapper for reading a line. Drop CRs and the
343 trailing newline. Can return early on buffer full. Null-terminate.
344 Apply initial timeout if no data ready.
345
0f0c8159
JH
346 Return: number of chars - zero for an empty line
347 -1 on EOF
348 -2 on timeout or error
4e71661f
JH
349*/
350static int
0a5441fc 351recv_line(int fd, uschar * buffer, int bsize, time_t tmo)
4e71661f
JH
352{
353uschar * p = buffer;
354ssize_t rcv;
0f0c8159 355BOOL ok = FALSE;
4e71661f 356
0a5441fc 357if (!fd_ready(fd, tmo))
0f0c8159 358 return -2;
4e71661f 359
0f0c8159 360/*XXX tmo handling assumes we always get a whole line */
4e71661f 361/* read until \n */
0f0c8159 362errno = 0;
4e71661f
JH
363while ((rcv = read(fd, p, 1)) > 0)
364 {
0f0c8159 365 ok = TRUE;
4e71661f
JH
366 if (p-buffer > bsize-2) break;
367 if (*p == '\n') break;
368 if (*p != '\r') p++;
369 }
0f0c8159
JH
370if (!ok)
371 {
e1d04f48 372 DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
0f0c8159
JH
373 rcv==0 ? "EOF" : "error", strerror(errno));
374 return rcv==0 ? -1 : -2;
375 }
4e71661f
JH
376*p = '\0';
377
e1d04f48 378DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
4e71661f
JH
379return p - buffer;
380}
381
382/* return TRUE iff size as requested */
383static BOOL
0a5441fc 384recv_len(int sock, void * buf, int size, time_t tmo)
4e71661f 385{
0a5441fc 386return fd_ready(sock, tmo)
4e71661f
JH
387 ? recv(sock, buf, size, 0) == size
388 : FALSE;
389}
390
391
0f0c8159 392
c11d665d 393#ifndef DISABLE_MAL_MKS
0f0c8159
JH
394/* ============= private routines for the "mksd" scanner type ============== */
395
c11d665d 396# include <sys/uio.h>
0f0c8159
JH
397
398static inline int
399mksd_writev (int sock, struct iovec * iov, int iovcnt)
400{
401int i;
402
403for (;;)
404 {
405 do
406 i = writev (sock, iov, iovcnt);
407 while (i < 0 && errno == EINTR);
408 if (i <= 0)
409 {
ad93c40f 410 (void) malware_panic_defer(
0f0c8159
JH
411 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
412 return -1;
413 }
414 for (;;) /* check for short write */
415 if (i >= iov->iov_len)
416 {
417 if (--iovcnt == 0)
418 return 0;
419 i -= iov->iov_len;
420 iov++;
421 }
422 else
423 {
424 iov->iov_len -= i;
425 iov->iov_base = CS iov->iov_base + i;
426 break;
427 }
428 }
429}
430
431static inline int
0a5441fc 432mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, time_t tmo)
0f0c8159 433{
74f1a423 434client_conn_ctx cctx = {.sock = sock};
0f0c8159
JH
435int offset = 0;
436int i;
437
438do
439 {
0a5441fc 440 i = ip_recv(&cctx, av_buffer+offset, av_buffer_size-offset, tmo);
0f0c8159
JH
441 if (i <= 0)
442 {
ad93c40f 443 (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
0f0c8159
JH
444 return -1;
445 }
446
447 offset += i;
448 /* offset == av_buffer_size -> buffer full */
449 if (offset == av_buffer_size)
450 {
ad93c40f 451 (void) malware_panic_defer(US"malformed reply received from mksd");
0f0c8159
JH
452 return -1;
453 }
454 } while (av_buffer[offset-1] != '\n');
455
456av_buffer[offset] = '\0';
457return offset;
458}
459
460static inline int
461mksd_parse_line(struct scan * scanent, char * line)
462{
463char *p;
464
465switch (*line)
466 {
467 case 'O': /* OK */
468 return OK;
469
470 case 'E':
471 case 'A': /* ERR */
472 if ((p = strchr (line, '\n')) != NULL)
473 *p = '\0';
ad93c40f 474 return m_panic_defer(scanent, NULL,
0f0c8159
JH
475 string_sprintf("scanner failed: %s", line));
476
477 default: /* VIR */
478 if ((p = strchr (line, '\n')) != NULL)
479 {
480 *p = '\0';
481 if ( p-line > 5
482 && line[3] == ' '
483 && (p = strchr(line+4, ' ')) != NULL
484 && p-line > 4
485 )
486 {
487 *p = '\0';
488 malware_name = string_copy(US line+4);
489 return OK;
490 }
491 }
ad93c40f 492 return m_panic_defer(scanent, NULL,
0f0c8159
JH
493 string_sprintf("malformed reply received: %s", line));
494 }
495}
496
497static int
498mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
0a5441fc 499 time_t tmo)
0f0c8159
JH
500{
501struct iovec iov[3];
502const char *cmd = "MSQ\n";
503uschar av_buffer[1024];
504
505iov[0].iov_base = (void *) cmd;
506iov[0].iov_len = 3;
507iov[1].iov_base = (void *) scan_filename;
508iov[1].iov_len = Ustrlen(scan_filename);
509iov[2].iov_base = (void *) (cmd + 3);
510iov[2].iov_len = 1;
511
512if (mksd_writev (sock, iov, 3) < 0)
513 return DEFER;
514
515if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
516 return DEFER;
517
518return mksd_parse_line (scanent, CS av_buffer);
519}
c11d665d 520#endif /* MKSD */
0f0c8159 521
8a512ed5 522
c11d665d 523#ifndef DISABLE_MAL_CLAM
8a512ed5
JH
524static int
525clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
526{
527uschar * s;
528
529cd->retry = 0;
530while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
8a512ed5
JH
531 if (Ustrncmp(s, "retry=", 6) == 0)
532 {
533 int sec = readconf_readtime((s += 6), '\0', FALSE);
534 if (sec < 0)
535 return FAIL;
536 cd->retry = sec;
537 }
538 else
539 return FAIL;
93a6fce2 540return OK;
8a512ed5 541}
c11d665d
JH
542#endif
543
544
8a512ed5 545
8544e77a
PP
546/*************************************************
547* Scan content for malware *
548*************************************************/
549
550/* This is an internal interface for scanning an email; the normal interface
551is via malware(), or there's malware_in_file() used for testing/debugging.
552
553Arguments:
0f0c8159 554 malware_re match condition for "malware="
040721f2
JH
555 scan_filename the file holding the email to be scanned, if we're faking
556 this up for the -bmalware test, else NULL
0f0c8159 557 timeout if nonzero, non-default timeoutl
8544e77a
PP
558
559Returns: Exim message processing code (OK, FAIL, DEFER, ...)
560 where true means malware was found (condition applies)
561*/
b1f8e4f8 562static int
040721f2
JH
563malware_internal(const uschar * malware_re, const uschar * scan_filename,
564 int timeout)
b1f8e4f8 565{
0f0c8159 566int sep = 0;
55414b25 567const uschar *av_scanner_work = av_scanner;
0f0c8159 568uschar *scanner_name;
0f0c8159
JH
569unsigned long mbox_size;
570FILE *mbox_file;
571const pcre *re;
572uschar * errstr;
573struct scan * scanent;
574const uschar * scanner_options;
74f1a423 575client_conn_ctx malware_daemon_ctx = {.sock = -1};
0f0c8159 576time_t tmo;
040721f2 577uschar * eml_filename, * eml_dir;
0f0c8159 578
040721f2
JH
579if (!malware_re)
580 return FAIL; /* empty means "don't match anything" */
581
582/* Ensure the eml mbox file is spooled up */
583
584if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
ad93c40f 585 return malware_panic_defer(US"error while creating mbox spool file");
0f0c8159 586
040721f2
JH
587/* None of our current scanners need the mbox file as a stream (they use
588the name), so we can close it right away. Get the directory too. */
0f0c8159 589
040721f2
JH
590(void) fclose(mbox_file);
591eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
0f0c8159
JH
592
593/* parse 1st option */
040721f2 594if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
0f0c8159
JH
595 return FAIL; /* explicitly no matching */
596
597/* special cases (match anything except empty) */
476be7e2
JH
598if ( strcmpic(malware_re,US"true") == 0
599 || Ustrcmp(malware_re,"*") == 0
600 || Ustrcmp(malware_re,"1") == 0
601 )
602 {
603 if ( !malware_default_re
604 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
ad93c40f 605 return malware_panic_defer(errstr);
0f0c8159 606 malware_re = malware_regex_default;
476be7e2
JH
607 re = malware_default_re;
608 }
0f0c8159
JH
609
610/* compile the regex, see if it works */
476be7e2 611else if (!(re = m_pcre_compile(malware_re, &errstr)))
ad93c40f 612 return malware_panic_defer(errstr);
0f0c8159
JH
613
614/* if av_scanner starts with a dollar, expand it first */
615if (*av_scanner == '$')
616 {
617 if (!(av_scanner_work = expand_string(av_scanner)))
ad93c40f 618 return malware_panic_defer(
0f0c8159
JH
619 string_sprintf("av_scanner starts with $, but expansion failed: %s",
620 expand_string_message));
b1f8e4f8 621
0f0c8159 622 DEBUG(D_acl)
e1d04f48 623 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
0f0c8159
JH
624 /* disable result caching in this case */
625 malware_name = NULL;
626 malware_ok = FALSE;
8523533c
TK
627 }
628
0f0c8159
JH
629/* Do not scan twice (unless av_scanner is dynamic). */
630if (!malware_ok)
631 {
632 /* find the scanner type from the av_scanner option */
633 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
ad93c40f 634 return malware_panic_defer(US"av_scanner configuration variable is empty");
0f0c8159
JH
635 if (!timeout) timeout = MALWARE_TIMEOUT;
636 tmo = time(NULL) + timeout;
637
3e60dd41
JH
638 for (scanent = m_scans; ; scanent++)
639 {
0f0c8159 640 if (!scanent->name)
ad93c40f 641 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
0f0c8159
JH
642 scanner_name));
643 if (strcmpic(scanner_name, US scanent->name) != 0)
644 continue;
ac4d558b
JH
645 DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
646 scanner_name, readconf_printtime(timeout));
647
0f0c8159
JH
648 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
649 scanner_options = scanent->options_default;
650 if (scanent->conn == MC_NONE)
b1f8e4f8 651 break;
ac4d558b
JH
652
653 DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
0f0c8159
JH
654 switch(scanent->conn)
655 {
74f1a423 656 case MC_TCP:
7d2f2d36 657 malware_daemon_ctx.sock = ip_tcpsocket(scanner_options, &errstr, 5, NULL); break;
74f1a423
JH
658 case MC_UNIX:
659 malware_daemon_ctx.sock = ip_unixsocket(scanner_options, &errstr); break;
660 case MC_STRM:
7d2f2d36 661 malware_daemon_ctx.sock = ip_streamsocket(scanner_options, &errstr, 5, NULL); break;
74f1a423
JH
662 default:
663 /* compiler quietening */ break;
384152a6 664 }
74f1a423 665 if (malware_daemon_ctx.sock < 0)
ad93c40f 666 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
667 break;
668 }
8e669ac1 669
0f0c8159
JH
670 switch (scanent->scancode)
671 {
c11d665d 672#ifndef DISABLE_MAL_FFROTD
0f0c8159 673 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
b1f8e4f8 674 {
0f0c8159
JH
675 uschar *fp_scan_option;
676 unsigned int detected=0, par_count=0;
677 uschar * scanrequest;
678 uschar buf[32768], *strhelper, *strhelper2;
679 uschar * malware_name_internal = NULL;
680 int len;
b1f8e4f8 681
0f0c8159 682 scanrequest = string_sprintf("GET %s", eml_filename);
b1f8e4f8 683
0f0c8159
JH
684 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
685 NULL, 0)))
686 {
687 scanrequest = string_sprintf("%s%s%s", scanrequest,
688 par_count ? "%20" : "?", fp_scan_option);
689 par_count++;
690 }
691 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
e1d04f48 692 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
0f0c8159 693 scanner_name, scanrequest);
b1f8e4f8 694
0f0c8159 695 /* send scan request */
74f1a423 696 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
ad93c40f 697 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 698
74f1a423 699 while ((len = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) >= 0)
0f0c8159
JH
700 if (len > 0)
701 {
702 if (Ustrstr(buf, US"<detected type=\"") != NULL)
703 detected = 1;
704 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
4e71661f 705 {
0f0c8159 706 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
4e71661f 707 {
0f0c8159
JH
708 *strhelper2 = '\0';
709 malware_name_internal = string_copy(strhelper+6);
4e71661f
JH
710 }
711 }
0f0c8159 712 else if (Ustrstr(buf, US"<summary code=\""))
4e71661f 713 {
0f0c8159
JH
714 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
715 ? malware_name_internal : NULL;
716 break;
4e71661f 717 }
0f0c8159
JH
718 }
719 if (len < -1)
720 {
74f1a423 721 (void)close(malware_daemon_ctx.sock);
0f0c8159
JH
722 return DEFER;
723 }
724 break;
725 } /* f-protd */
c11d665d
JH
726#endif
727
728#ifndef DISABLE_MAL_FFROT6D
729 case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
730 {
731 int bread;
732 uschar * e;
733 uschar * linebuffer;
734 uschar * scanrequest;
735 uschar av_buffer[1024];
736
737 if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
738 || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
ad93c40f 739 return malware_panic_defer(errstr);
c11d665d
JH
740
741 scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
742 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
743 scanner_name, scanrequest);
744
74f1a423 745 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
ad93c40f 746 return m_panic_defer(scanent, CUS callout_address, errstr);
c11d665d 747
0a5441fc 748 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo);
c11d665d
JH
749
750 if (bread <= 0)
ad93c40f 751 return m_panic_defer_3(scanent, CUS callout_address,
c11d665d 752 string_sprintf("unable to read from socket (%s)", strerror(errno)),
74f1a423 753 malware_daemon_ctx.sock);
c11d665d
JH
754
755 if (bread == sizeof(av_buffer))
ad93c40f 756 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 757 US"buffer too small", malware_daemon_ctx.sock);
c11d665d
JH
758
759 av_buffer[bread] = '\0';
760 linebuffer = string_copy(av_buffer);
761
74f1a423 762 m_sock_send(malware_daemon_ctx.sock, US"QUIT\n", 5, 0);
c11d665d
JH
763
764 if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
ad93c40f 765 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 766 string_sprintf("scanner reported error (%s)", e), malware_daemon_ctx.sock);
b1f8e4f8 767
c11d665d
JH
768 if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
769 malware_name = NULL;
770
771 break;
772 } /* f-prot6d */
773#endif
774
775#ifndef DISABLE_MAL_DRWEB
0f0c8159
JH
776 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
777 /* v0.1 - added support for tcp sockets */
778 /* v0.0 - initial release -- support for unix sockets */
779 {
780 int result;
781 off_t fsize;
782 unsigned int fsize_uint;
783 uschar * tmpbuf, *drweb_fbuf;
784 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
785 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
0f0c8159
JH
786
787 /* prepare variables */
788 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
789 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
790
791 if (*scanner_options != '/')
792 {
793 /* calc file size */
c4141216 794 if ((drweb_fd = exim_open2(CCS eml_filename, O_RDONLY)) == -1)
ad93c40f 795 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
796 string_sprintf("can't open spool file %s: %s",
797 eml_filename, strerror(errno)),
74f1a423 798 malware_daemon_ctx.sock);
b1f8e4f8 799
0f0c8159
JH
800 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
801 {
d315eda1
JH
802 int err;
803badseek: err = errno;
b1f8e4f8 804 (void)close(drweb_fd);
ad93c40f 805 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
806 string_sprintf("can't seek spool file %s: %s",
807 eml_filename, strerror(err)),
74f1a423 808 malware_daemon_ctx.sock);
0f0c8159
JH
809 }
810 fsize_uint = (unsigned int) fsize;
811 if ((off_t)fsize_uint != fsize)
812 {
b1f8e4f8 813 (void)close(drweb_fd);
ad93c40f 814 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
815 string_sprintf("seeking spool file %s, size overflow",
816 eml_filename),
74f1a423 817 malware_daemon_ctx.sock);
4e71661f 818 }
0f0c8159 819 drweb_slen = htonl(fsize);
d315eda1
JH
820 if (lseek(drweb_fd, 0, SEEK_SET) < 0)
821 goto badseek;
0f0c8159 822
e1d04f48 823 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
0f0c8159
JH
824 scanner_name, scanner_options);
825
826 /* send scan request */
74f1a423
JH
827 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
828 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
829 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
830 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
4e71661f 831 {
0f0c8159 832 (void)close(drweb_fd);
ad93c40f 833 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159 834 "unable to send commands to socket (%s)", scanner_options),
74f1a423 835 malware_daemon_ctx.sock);
4e71661f 836 }
8e669ac1 837
f3ebb786 838 if (!(drweb_fbuf = store_malloc(fsize_uint)))
0f0c8159
JH
839 {
840 (void)close(drweb_fd);
ad93c40f 841 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
842 string_sprintf("unable to allocate memory %u for file (%s)",
843 fsize_uint, eml_filename),
74f1a423 844 malware_daemon_ctx.sock);
0f0c8159 845 }
b1f8e4f8 846
0f0c8159
JH
847 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
848 {
849 int err = errno;
850 (void)close(drweb_fd);
f3ebb786 851 store_free(drweb_fbuf);
ad93c40f 852 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
853 string_sprintf("can't read spool file %s: %s",
854 eml_filename, strerror(err)),
74f1a423 855 malware_daemon_ctx.sock);
0f0c8159
JH
856 }
857 (void)close(drweb_fd);
b1f8e4f8 858
0f0c8159 859 /* send file body to socket */
74f1a423 860 if (send(malware_daemon_ctx.sock, drweb_fbuf, fsize, 0) < 0)
4e71661f 861 {
f3ebb786 862 store_free(drweb_fbuf);
ad93c40f 863 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159 864 "unable to send file body to socket (%s)", scanner_options),
74f1a423 865 malware_daemon_ctx.sock);
0f0c8159 866 }
f3ebb786 867 store_free(drweb_fbuf);
0f0c8159
JH
868 }
869 else
870 {
871 drweb_slen = htonl(Ustrlen(eml_filename));
b1f8e4f8 872
e1d04f48 873 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
0f0c8159 874 scanner_name, scanner_options);
b1f8e4f8 875
0f0c8159 876 /* send scan request */
74f1a423
JH
877 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
878 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
879 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
880 (send(malware_daemon_ctx.sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
881 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
ad93c40f 882 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159 883 "unable to send commands to socket (%s)", scanner_options),
74f1a423 884 malware_daemon_ctx.sock);
0f0c8159 885 }
b1f8e4f8 886
0f0c8159 887 /* wait for result */
74f1a423 888 if (!recv_len(malware_daemon_ctx.sock, &drweb_rc, sizeof(drweb_rc), tmo))
ad93c40f 889 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 890 US"unable to read return code", malware_daemon_ctx.sock);
0f0c8159
JH
891 drweb_rc = ntohl(drweb_rc);
892
74f1a423 893 if (!recv_len(malware_daemon_ctx.sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
ad93c40f 894 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 895 US"unable to read the number of viruses", malware_daemon_ctx.sock);
0f0c8159
JH
896 drweb_vnum = ntohl(drweb_vnum);
897
898 /* "virus(es) found" if virus number is > 0 */
899 if (drweb_vnum)
900 {
acec9514 901 gstring * g = NULL;
b1f8e4f8 902
0f0c8159
JH
903 /* setup default virus name */
904 malware_name = US"unknown";
b1f8e4f8 905
0f0c8159 906 /* set up match regex */
476be7e2
JH
907 if (!drweb_re)
908 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
b1f8e4f8 909
0f0c8159 910 /* read and concatenate virus names into one string */
d7978c0f 911 for (int i = 0; i < drweb_vnum; i++)
4e71661f 912 {
acec9514
JH
913 int ovector[10*3];
914
0f0c8159 915 /* read the size of report */
74f1a423 916 if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
ad93c40f 917 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 918 US"cannot read report size", malware_daemon_ctx.sock);
0f0c8159 919 drweb_slen = ntohl(drweb_slen);
f3ebb786
JH
920
921 /* assume tainted, since it is external input */
922 tmpbuf = store_get(drweb_slen, TRUE);
b1f8e4f8 923
0f0c8159 924 /* read report body */
74f1a423 925 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
ad93c40f 926 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 927 US"cannot read report string", malware_daemon_ctx.sock);
0f0c8159 928 tmpbuf[drweb_slen] = '\0';
8544e77a 929
0f0c8159
JH
930 /* try matcher on the line, grab substring */
931 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
c11d665d 932 ovector, nelem(ovector));
0f0c8159
JH
933 if (result >= 2)
934 {
935 const char * pre_malware_nb;
8e669ac1 936
0f0c8159 937 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
8e669ac1 938
0f0c8159 939 if (i==0) /* the first name we just copy to malware_name */
b2bcdd35 940 g = string_cat(NULL, US pre_malware_nb);
8e669ac1 941
acec9514 942 /*XXX could be string_append_listele? */
0f0c8159 943 else /* concatenate each new virus name to previous */
acec9514 944 g = string_append(g, 2, "/", pre_malware_nb);
8e669ac1 945
0f0c8159
JH
946 pcre_free_substring(pre_malware_nb);
947 }
948 }
acec9514 949 malware_name = string_from_gstring(g);
0f0c8159
JH
950 }
951 else
952 {
953 const char *drweb_s = NULL;
954
955 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
956 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
957 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
958 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
959 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
960 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
961 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
962 * and others are ignored */
963 if (drweb_s)
ad93c40f 964 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 965 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
74f1a423 966 malware_daemon_ctx.sock);
8e669ac1 967
0f0c8159 968 /* no virus found */
b1f8e4f8 969 malware_name = NULL;
0f0c8159
JH
970 }
971 break;
972 } /* drweb */
c11d665d 973#endif
8e669ac1 974
c11d665d 975#ifndef DISABLE_MAL_AVE
0f0c8159
JH
976 case M_AVES: /* "aveserver" scanner type -------------------------------- */
977 {
978 uschar buf[32768];
979 int result;
8544e77a 980
0f0c8159
JH
981 /* read aveserver's greeting and see if it is ready (2xx greeting) */
982 buf[0] = 0;
74f1a423 983 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
8544e77a 984
0f0c8159 985 if (buf[0] != '2') /* aveserver is having problems */
ad93c40f 986 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 987 string_sprintf("unavailable (Responded: %s).",
5903c6ff 988 ((buf[0] != 0) ? buf : US "nothing") ),
74f1a423 989 malware_daemon_ctx.sock);
8e669ac1 990
0f0c8159
JH
991 /* prepare our command */
992 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
993 eml_filename);
994
995 /* and send it */
e1d04f48 996 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
0f0c8159 997 scanner_name, buf);
74f1a423 998 if (m_sock_send(malware_daemon_ctx.sock, buf, Ustrlen(buf), &errstr) < 0)
ad93c40f 999 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
1000
1001 malware_name = NULL;
1002 result = 0;
1003 /* read response lines, find malware name and final response */
74f1a423 1004 while (recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo) > 0)
0f0c8159
JH
1005 {
1006 if (buf[0] == '2')
1007 break;
1008 if (buf[0] == '5') /* aveserver is having problems */
4e71661f 1009 {
ad93c40f 1010 result = m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1011 string_sprintf("unable to scan file %s (Responded: %s).",
1012 eml_filename, buf));
1013 break;
4e71661f 1014 }
0f0c8159
JH
1015 if (Ustrncmp(buf,"322",3) == 0)
1016 {
1017 uschar *p = Ustrchr(&buf[4], ' ');
1018 *p = '\0';
1019 malware_name = string_copy(&buf[4]);
1020 }
1021 }
1022
74f1a423 1023 if (m_sock_send(malware_daemon_ctx.sock, US"quit\r\n", 6, &errstr) < 0)
ad93c40f 1024 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
1025
1026 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1027 buf[0] = 0;
74f1a423 1028 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
0f0c8159
JH
1029
1030 if (buf[0] != '2') /* aveserver is having problems */
ad93c40f 1031 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1032 string_sprintf("unable to quit dialogue (Responded: %s).",
5903c6ff 1033 ((buf[0] != 0) ? buf : US "nothing") ),
74f1a423 1034 malware_daemon_ctx.sock);
0f0c8159
JH
1035
1036 if (result == DEFER)
1037 {
74f1a423 1038 (void)close(malware_daemon_ctx.sock);
0f0c8159
JH
1039 return DEFER;
1040 }
1041 break;
b1f8e4f8 1042 } /* aveserver */
c11d665d 1043#endif
8e669ac1 1044
c11d665d 1045#ifndef DISABLE_MAL_FSECURE
b1f8e4f8
JH
1046 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
1047 {
d7978c0f 1048 int i, bread = 0;
0f0c8159
JH
1049 uschar * file_name;
1050 uschar av_buffer[1024];
0f0c8159
JH
1051 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
1052 US"CONFIGURE\tTIMEOUT\t0\n",
1053 US"CONFIGURE\tMAXARCH\t5\n",
1054 US"CONFIGURE\tMIME\t1\n" };
1055
1056 malware_name = NULL;
1057
e1d04f48 1058 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159
JH
1059 scanner_name, scanner_options);
1060 /* pass options */
1061 memset(av_buffer, 0, sizeof(av_buffer));
c11d665d 1062 for (i = 0; i != nelem(cmdopt); i++)
0f0c8159 1063 {
b1f8e4f8 1064
74f1a423 1065 if (m_sock_send(malware_daemon_ctx.sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
ad93c40f 1066 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1067
0a5441fc 1068 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo);
0f0c8159
JH
1069 if (bread > 0) av_buffer[bread]='\0';
1070 if (bread < 0)
ad93c40f 1071 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1072 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
74f1a423 1073 malware_daemon_ctx.sock);
d7978c0f 1074 for (int j = 0; j < bread; j++)
0f0c8159
JH
1075 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
1076 av_buffer[j] ='@';
1077 }
8e669ac1 1078
0f0c8159
JH
1079 /* pass the mailfile to fsecure */
1080 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
b1f8e4f8 1081
74f1a423 1082 if (m_sock_send(malware_daemon_ctx.sock, file_name, Ustrlen(file_name), &errstr) < 0)
ad93c40f 1083 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1084
0f0c8159
JH
1085 /* set up match */
1086 /* todo also SUSPICION\t */
476be7e2
JH
1087 if (!fsec_re)
1088 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
b1f8e4f8 1089
0f0c8159
JH
1090 /* read report, linewise. Apply a timeout as the Fsecure daemon
1091 sometimes wants an answer to "PING" but they won't tell us what */
fd02dc0e 1092 {
0f0c8159
JH
1093 uschar * p = av_buffer;
1094 uschar * q;
fd02dc0e 1095
0f0c8159
JH
1096 for (;;)
1097 {
80591636 1098 errno = ETIMEDOUT;
0f0c8159 1099 i = av_buffer+sizeof(av_buffer)-p;
0a5441fc 1100 if ((bread= ip_recv(&malware_daemon_ctx, p, i-1, tmo)) < 0)
ad93c40f 1101 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1102 string_sprintf("unable to read result (%s)", strerror(errno)),
74f1a423 1103 malware_daemon_ctx.sock);
b1f8e4f8 1104
755762fd 1105 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
0f0c8159
JH
1106 {
1107 *q = '\0';
fd02dc0e 1108
0f0c8159
JH
1109 /* Really search for virus again? */
1110 if (!malware_name)
1111 /* try matcher on the line, grab substring */
476be7e2 1112 malware_name = m_pcre_exec(fsec_re, p);
fd02dc0e 1113
0f0c8159
JH
1114 if (Ustrstr(p, "OK\tScan ok."))
1115 goto fsec_found;
1116 }
fd02dc0e 1117
0f0c8159
JH
1118 /* copy down the trailing partial line then read another chunk */
1119 i = av_buffer+sizeof(av_buffer)-p;
1120 memmove(av_buffer, p, i);
1121 p = av_buffer+i;
fd02dc0e 1122 }
b1f8e4f8 1123 }
fd02dc0e
JH
1124
1125 fsec_found:
b1f8e4f8
JH
1126 break;
1127 } /* fsecure */
c11d665d 1128#endif
599dcb77 1129
c11d665d 1130#ifndef DISABLE_MAL_KAV
b1f8e4f8
JH
1131 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
1132 {
0f0c8159
JH
1133 time_t t;
1134 uschar tmpbuf[1024];
1135 uschar * scanrequest;
1136 int kav_rc;
2decbec9
RC
1137 unsigned long kav_reportlen;
1138 int bread;
0f0c8159
JH
1139 const pcre *kav_re;
1140 uschar *p;
1141
1142 /* get current date and time, build scan request */
1143 time(&t);
1144 /* pdp note: before the eml_filename parameter, this scanned the
1145 directory; not finding documentation, so we'll strip off the directory.
1146 The side-effect is that the test framework scanning may end up in
1147 scanning more than was requested, but for the normal interface, this is
1148 fine. */
1149
1150 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
1151 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
1152 p = Ustrrchr(scanrequest, '/');
1153 if (p)
1154 *p = '\0';
1155
e1d04f48 1156 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159
JH
1157 scanner_name, scanner_options);
1158
1159 /* send scan request */
74f1a423 1160 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
ad93c40f 1161 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1162
0f0c8159 1163 /* wait for result */
74f1a423 1164 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, 2, tmo))
ad93c40f 1165 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1166 US"unable to read 2 bytes from socket.", malware_daemon_ctx.sock);
b1f8e4f8 1167
0f0c8159
JH
1168 /* get errorcode from one nibble */
1169 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
1170 switch(kav_rc)
1171 {
1172 case 5: case 6: /* improper kavdaemon configuration */
ad93c40f 1173 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1174 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
74f1a423 1175 malware_daemon_ctx.sock);
0f0c8159 1176 case 1:
ad93c40f 1177 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1178 US"reported 'scanning not completed' (code 1).", malware_daemon_ctx.sock);
0f0c8159 1179 case 7:
ad93c40f 1180 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1181 US"reported 'kavdaemon damaged' (code 7).", malware_daemon_ctx.sock);
0f0c8159 1182 }
b1f8e4f8 1183
4c04137d 1184 /* code 8 is not handled, since it is ambiguous. It appears mostly on
0f0c8159 1185 bounces where part of a file has been cut off */
b1f8e4f8 1186
0f0c8159
JH
1187 /* "virus found" return codes (2-4) */
1188 if (kav_rc > 1 && kav_rc < 5)
b1f8e4f8 1189 {
0f0c8159 1190 int report_flag = 0;
599dcb77 1191
0f0c8159
JH
1192 /* setup default virus name */
1193 malware_name = US"unknown";
b1f8e4f8 1194
0f0c8159 1195 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
b1f8e4f8 1196
0f0c8159
JH
1197 /* read the report, if available */
1198 if (report_flag == 1)
1199 {
1200 /* read report size */
74f1a423 1201 if (!recv_len(malware_daemon_ctx.sock, &kav_reportlen, 4, tmo))
ad93c40f 1202 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1203 US"cannot read report size", malware_daemon_ctx.sock);
b1f8e4f8 1204
0f0c8159
JH
1205 /* it's possible that avp returns av_buffer[1] == 1 but the
1206 reportsize is 0 (!?) */
1207 if (kav_reportlen > 0)
4e71661f 1208 {
0f0c8159 1209 /* set up match regex, depends on retcode */
476be7e2
JH
1210 if (kav_rc == 3)
1211 {
1212 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1213 kav_re = kav_re_sus;
1214 }
1215 else
1216 {
1217 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1218 kav_re = kav_re_inf;
1219 }
0f0c8159 1220
6e92b3ae
JH
1221 /* read report, linewise. Using size from stream to read amount of data
1222 from same stream is safe enough. */
1223 /* coverity[tainted_data] */
0f0c8159 1224 while (kav_reportlen > 0)
4e71661f 1225 {
74f1a423 1226 if ((bread = recv_line(malware_daemon_ctx.sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
0f0c8159
JH
1227 break;
1228 kav_reportlen -= bread+1;
1229
1230 /* try matcher on the line, grab substring */
1231 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1232 break;
b1f8e4f8
JH
1233 }
1234 }
1235 }
0f0c8159
JH
1236 }
1237 else /* no virus found */
1238 malware_name = NULL;
599dcb77 1239
0f0c8159 1240 break;
599dcb77 1241 }
c11d665d 1242#endif
8544e77a 1243
c11d665d 1244#ifndef DISABLE_MAL_CMDLINE
b1f8e4f8
JH
1245 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1246 {
0f0c8159
JH
1247 const uschar *cmdline_scanner = scanner_options;
1248 const pcre *cmdline_trigger_re;
1249 const pcre *cmdline_regex_re;
1250 uschar * file_name;
1251 uschar * commandline;
1252 void (*eximsigchld)(int);
1253 void (*eximsigpipe)(int);
1254 FILE *scanner_out = NULL;
1255 int scanner_fd;
1256 FILE *scanner_record = NULL;
1257 uschar linebuffer[32767];
1258 int rcnt;
1259 int trigger = 0;
1260 uschar *p;
1261
1262 if (!cmdline_scanner)
ad93c40f 1263 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1264
0f0c8159
JH
1265 /* find scanner output trigger */
1266 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1267 "missing trigger specification", &errstr);
1268 if (!cmdline_trigger_re)
ad93c40f 1269 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1270
0f0c8159
JH
1271 /* find scanner name regex */
1272 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1273 "missing virus name regex specification", &errstr);
1274 if (!cmdline_regex_re)
ad93c40f 1275 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1276
0f0c8159
JH
1277 /* prepare scanner call; despite the naming, file_name holds a directory
1278 name which is documented as the value given to %s. */
b1f8e4f8 1279
0f0c8159
JH
1280 file_name = string_copy(eml_filename);
1281 p = Ustrrchr(file_name, '/');
1282 if (p)
1283 *p = '\0';
1284 commandline = string_sprintf(CS cmdline_scanner, file_name);
b1f8e4f8 1285
0f0c8159
JH
1286 /* redirect STDERR too */
1287 commandline = string_sprintf("%s 2>&1", commandline);
b1f8e4f8 1288
e1d04f48 1289 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159 1290 scanner_name, commandline);
b1f8e4f8 1291
0f0c8159
JH
1292 /* store exims signal handlers */
1293 eximsigchld = signal(SIGCHLD,SIG_DFL);
1294 eximsigpipe = signal(SIGPIPE,SIG_DFL);
b1f8e4f8 1295
0f0c8159
JH
1296 if (!(scanner_out = popen(CS commandline,"r")))
1297 {
1298 int err = errno;
1299 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1300 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1301 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1302 }
1303 scanner_fd = fileno(scanner_out);
94a18f28 1304
040721f2 1305 file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
b1f8e4f8 1306
0f0c8159
JH
1307 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1308 {
1309 int err = errno;
1310 (void) pclose(scanner_out);
1311 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1312 return m_panic_defer(scanent, NULL, string_sprintf(
0f0c8159
JH
1313 "opening scanner output file (%s) failed: %s.",
1314 file_name, strerror(err)));
1315 }
8e669ac1 1316
0f0c8159
JH
1317 /* look for trigger while recording output */
1318 while ((rcnt = recv_line(scanner_fd, linebuffer,
1319 sizeof(linebuffer), tmo)))
1320 {
1321 if (rcnt < 0)
93a6fce2
JH
1322 {
1323 int err = errno;
0f0c8159
JH
1324 if (rcnt == -1)
1325 break;
93a6fce2
JH
1326 (void) pclose(scanner_out);
1327 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1328 return m_panic_defer(scanent, NULL, string_sprintf(
93a6fce2
JH
1329 "unable to read from scanner (%s): %s",
1330 commandline, strerror(err)));
1331 }
4e71661f 1332
0f0c8159
JH
1333 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1334 {
1335 /* short write */
1336 (void) pclose(scanner_out);
1337 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1338 return m_panic_defer(scanent, NULL, string_sprintf(
0f0c8159 1339 "short write on scanner output file (%s).", file_name));
4e71661f 1340 }
0f0c8159
JH
1341 putc('\n', scanner_record);
1342 /* try trigger match */
1343 if ( !trigger
1344 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1345 )
1346 trigger = 1;
1347 }
8e669ac1 1348
0f0c8159
JH
1349 (void)fclose(scanner_record);
1350 sep = pclose(scanner_out);
1351 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1352 if (sep != 0)
ad93c40f 1353 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1354 sep == -1
1355 ? string_sprintf("running scanner failed: %s", strerror(sep))
1356 : string_sprintf("scanner returned error code: %d", sep));
b1f8e4f8 1357
0f0c8159
JH
1358 if (trigger)
1359 {
1360 uschar * s;
1361 /* setup default virus name */
1362 malware_name = US"unknown";
b1f8e4f8 1363
0f0c8159 1364 /* re-open the scanner output file, look for name match */
9e21ce8f
JH
1365 scanner_record = Ufopen(file_name, "rb");
1366 while (Ufgets(linebuffer, sizeof(linebuffer), scanner_record))
1367 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer))) /* try match */
0f0c8159 1368 malware_name = s;
0f0c8159
JH
1369 (void)fclose(scanner_record);
1370 }
1371 else /* no virus found */
1372 malware_name = NULL;
1373 break;
b1f8e4f8 1374 } /* cmdline */
c11d665d 1375#endif
599dcb77 1376
c11d665d 1377#ifndef DISABLE_MAL_SOPHIE
b1f8e4f8
JH
1378 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1379 {
0f0c8159
JH
1380 int bread = 0;
1381 uschar *p;
1382 uschar * file_name;
1383 uschar av_buffer[1024];
b1f8e4f8 1384
0f0c8159
JH
1385 /* pass the scan directory to sophie */
1386 file_name = string_copy(eml_filename);
1387 if ((p = Ustrrchr(file_name, '/')))
1388 *p = '\0';
b1f8e4f8 1389
e1d04f48 1390 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159 1391 scanner_name, scanner_options);
b1f8e4f8 1392
74f1a423
JH
1393 if ( write(malware_daemon_ctx.sock, file_name, Ustrlen(file_name)) < 0
1394 || write(malware_daemon_ctx.sock, "\n", 1) != 1
0f0c8159 1395 )
ad93c40f 1396 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1397 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
74f1a423 1398 malware_daemon_ctx.sock);
b1f8e4f8 1399
0f0c8159
JH
1400 /* wait for result */
1401 memset(av_buffer, 0, sizeof(av_buffer));
0a5441fc 1402 if ((bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo)) <= 0)
ad93c40f 1403 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1404 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
74f1a423 1405 malware_daemon_ctx.sock);
0f0c8159
JH
1406
1407 /* infected ? */
1408 if (av_buffer[0] == '1') {
1409 uschar * s = Ustrchr(av_buffer, '\n');
1410 if (s)
1411 *s = '\0';
1412 malware_name = string_copy(&av_buffer[2]);
1413 }
1414 else if (!strncmp(CS av_buffer, "-1", 2))
ad93c40f 1415 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1416 US"scanner reported error", malware_daemon_ctx.sock);
0f0c8159
JH
1417 else /* all ok, no virus */
1418 malware_name = NULL;
599dcb77 1419
0f0c8159 1420 break;
8544e77a 1421 }
c11d665d 1422#endif
8e669ac1 1423
c11d665d 1424#ifndef DISABLE_MAL_CLAM
b1f8e4f8
JH
1425 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1426 {
0f0c8159
JH
1427/* This code was originally contributed by David Saez */
1428/* There are three scanning methods available to us:
1429* (1) Use the SCAN command, pointing to a file in the filesystem
1430* (2) Use the STREAM command, send the data on a separate port
1431* (3) Use the zINSTREAM command, send the data inline
1432* The zINSTREAM command was introduced with ClamAV 0.95, which marked
1433* STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1434* In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
e5ba8aa7 1435* the TCP-connected daemon is actually local; otherwise we use zINSTREAM
0f0c8159
JH
1436* See Exim bug 926 for details. */
1437
80591636 1438 uschar *p, *vname, *result_tag;
0f0c8159 1439 int bread=0;
0f0c8159
JH
1440 uschar av_buffer[1024];
1441 uschar *hostname = US"";
1442 host_item connhost;
1443 uschar *clamav_fbuf;
1444 int clam_fd, result;
1445 off_t fsize;
1446 unsigned int fsize_uint;
1447 BOOL use_scan_command = FALSE;
8a512ed5 1448 clamd_address * cv[MAX_CLAMD_SERVERS];
0f0c8159 1449 int num_servers = 0;
0f0c8159 1450 uint32_t send_size, send_final_zeroblock;
4a5cbaff 1451 blob cmd_str;
0f0c8159 1452
8a512ed5
JH
1453 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1454 there's no reason we should not mix local and remote servers */
1455
0f0c8159 1456 if (*scanner_options == '/')
8a512ed5
JH
1457 {
1458 clamd_address * cd;
1459 const uschar * sublist;
1460 int subsep = ' ';
1461
0f0c8159
JH
1462 /* Local file; so we def want to use_scan_command and don't want to try
1463 * passing IP/port combinations */
1464 use_scan_command = TRUE;
f3ebb786 1465 cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
8a512ed5
JH
1466
1467 /* extract socket-path part */
1468 sublist = scanner_options;
1469 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1470
1471 /* parse options */
1472 if (clamd_option(cd, sublist, &subsep) != OK)
ad93c40f 1473 return m_panic_defer(scanent, NULL,
8a512ed5
JH
1474 string_sprintf("bad option '%s'", scanner_options));
1475 cv[0] = cd;
1476 }
0f0c8159
JH
1477 else
1478 {
0f0c8159
JH
1479 /* Go through the rest of the list of host/port and construct an array
1480 * of servers to try. The first one is the bit we just passed from
1481 * scanner_options so process that first and then scan the remainder of
1482 * the address buffer */
1483 do
4e71661f 1484 {
8a512ed5
JH
1485 clamd_address * cd;
1486 const uschar * sublist;
1487 int subsep = ' ';
1488 uschar * s;
b1f8e4f8 1489
0f0c8159
JH
1490 /* The 'local' option means use the SCAN command over the network
1491 * socket (ie common file storage in use) */
8a512ed5
JH
1492 /*XXX we could accept this also as a local option? */
1493 if (strcmpic(scanner_options, US"local") == 0)
0f0c8159
JH
1494 {
1495 use_scan_command = TRUE;
1496 continue;
1497 }
b1f8e4f8 1498
f3ebb786 1499 cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
b1f8e4f8 1500
0f0c8159 1501 /* extract host and port part */
8a512ed5
JH
1502 sublist = scanner_options;
1503 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1504 {
ad93c40f 1505 (void) m_panic_defer(scanent, NULL,
8a512ed5
JH
1506 string_sprintf("missing address: '%s'", scanner_options));
1507 continue;
1508 }
1509 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
0f0c8159 1510 {
ad93c40f 1511 (void) m_panic_defer(scanent, NULL,
8a512ed5
JH
1512 string_sprintf("missing port: '%s'", scanner_options));
1513 continue;
1514 }
93a6fce2 1515 cd->tcp_port = atoi(CS s);
8a512ed5
JH
1516
1517 /* parse options */
1518 /*XXX should these options be common over scanner types? */
1519 if (clamd_option(cd, sublist, &subsep) != OK)
ad93c40f 1520 return m_panic_defer(scanent, NULL,
8a512ed5 1521 string_sprintf("bad option '%s'", scanner_options));
b1f8e4f8 1522
8a512ed5 1523 cv[num_servers++] = cd;
0f0c8159
JH
1524 if (num_servers >= MAX_CLAMD_SERVERS)
1525 {
ad93c40f 1526 (void) m_panic_defer(scanent, NULL,
0f0c8159
JH
1527 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1528 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1529 break;
1530 }
8a512ed5
JH
1531 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1532 NULL, 0)));
8e669ac1 1533
0f0c8159
JH
1534 /* check if we have at least one server */
1535 if (!num_servers)
ad93c40f 1536 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1537 US"no useable server addresses in malware configuration option.");
1538 }
b1f8e4f8 1539
0f0c8159
JH
1540 /* See the discussion of response formats below to see why we really
1541 don't like colons in filenames when passing filenames to ClamAV. */
1542 if (use_scan_command && Ustrchr(eml_filename, ':'))
ad93c40f 1543 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1544 string_sprintf("local/SCAN mode incompatible with" \
1545 " : in path to email filename [%s]", eml_filename));
b1f8e4f8 1546
4a5cbaff
JH
1547 /* Set up the very first data we will be sending */
1548 if (!use_scan_command)
4a5cbaff 1549 { cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
4a5cbaff
JH
1550 else
1551 {
1552 cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
1553 cmd_str.len = Ustrlen(cmd_str.data);
1554 }
1555
0f0c8159
JH
1556 /* We have some network servers specified */
1557 if (num_servers)
1558 {
1559 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1560 * only supports AF_INET, but we should probably be looking to the
1561 * future and rewriting this to be protocol-independent anyway. */
b1f8e4f8 1562
0f0c8159
JH
1563 while (num_servers > 0)
1564 {
4a5cbaff 1565 int i = random_number(num_servers);
8a512ed5 1566 clamd_address * cd = cv[i];
b1f8e4f8 1567
e1d04f48 1568 DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
8a512ed5 1569 cd->hostspec, cd->tcp_port);
0f0c8159
JH
1570
1571 /* Lookup the host. This is to ensure that we connect to the same IP
1572 * on both connections (as one host could resolve to multiple ips) */
8a512ed5 1573 for (;;)
0f0c8159 1574 {
b536a578 1575 /*XXX we trust that the cmd_str is ideempotent */
74f1a423 1576 if ((malware_daemon_ctx.sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
4a5cbaff 1577 &connhost, &errstr, &cmd_str)) >= 0)
8a512ed5
JH
1578 {
1579 /* Connection successfully established with a server */
1580 hostname = cd->hostspec;
4a5cbaff 1581 cmd_str.len = 0;
8a512ed5
JH
1582 break;
1583 }
1584 if (cd->retry <= 0) break;
1585 while (cd->retry > 0) cd->retry = sleep(cd->retry);
4e71661f 1586 }
74f1a423 1587 if (malware_daemon_ctx.sock >= 0)
8a512ed5 1588 break;
b1f8e4f8 1589
ad93c40f 1590 (void) m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
1591
1592 /* Remove the server from the list. XXX We should free the memory */
1593 num_servers--;
8a512ed5
JH
1594 for (; i < num_servers; i++)
1595 cv[i] = cv[i+1];
4e71661f 1596 }
8e669ac1 1597
0f0c8159 1598 if (num_servers == 0)
ad93c40f 1599 return m_panic_defer(scanent, NULL, US"all servers failed");
0f0c8159
JH
1600 }
1601 else
8a512ed5
JH
1602 for (;;)
1603 {
74f1a423 1604 if ((malware_daemon_ctx.sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
8a512ed5
JH
1605 {
1606 hostname = cv[0]->hostspec;
1607 break;
1608 }
1609 if (cv[0]->retry <= 0)
ad93c40f 1610 return m_panic_defer(scanent, CUS callout_address, errstr);
8a512ed5
JH
1611 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1612 }
b1f8e4f8 1613
0f0c8159
JH
1614 /* have socket in variable "sock"; command to use is semi-independent of
1615 * the socket protocol. We use SCAN if is local (either Unix/local
1616 * domain socket, or explicitly told local) else we stream the data.
1617 * How we stream the data depends upon how we were built. */
1618
1619 if (!use_scan_command)
1620 {
0f0c8159
JH
1621 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1622 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1623 chunk. */
b1f8e4f8 1624
e1d04f48 1625 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
1626 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1627 scanner_name);
b1f8e4f8 1628
4a5cbaff
JH
1629 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1630 if (cmd_str.len)
74f1a423 1631 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
ad93c40f 1632 return m_panic_defer_3(scanent, CUS hostname,
4a5cbaff
JH
1633 string_sprintf("unable to send zINSTREAM to socket (%s)",
1634 strerror(errno)),
74f1a423 1635 malware_daemon_ctx.sock);
b1f8e4f8 1636
0f0c8159 1637 /* calc file size */
9e21ce8f 1638 if ((clam_fd = exim_open2(CS eml_filename, O_RDONLY)) < 0)
0f0c8159
JH
1639 {
1640 int err = errno;
ad93c40f 1641 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1642 string_sprintf("can't open spool file %s: %s",
1643 eml_filename, strerror(err)),
74f1a423 1644 malware_daemon_ctx.sock);
0f0c8159
JH
1645 }
1646 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1647 {
d315eda1
JH
1648 int err;
1649b_seek: err = errno;
e5ba8aa7 1650 (void)close(clam_fd);
ad93c40f 1651 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1652 string_sprintf("can't seek spool file %s: %s",
1653 eml_filename, strerror(err)),
74f1a423 1654 malware_daemon_ctx.sock);
0f0c8159
JH
1655 }
1656 fsize_uint = (unsigned int) fsize;
1657 if ((off_t)fsize_uint != fsize)
1658 {
e5ba8aa7 1659 (void)close(clam_fd);
ad93c40f 1660 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1661 string_sprintf("seeking spool file %s, size overflow",
1662 eml_filename),
74f1a423 1663 malware_daemon_ctx.sock);
0f0c8159 1664 }
d315eda1
JH
1665 if (lseek(clam_fd, 0, SEEK_SET) < 0)
1666 goto b_seek;
b1f8e4f8 1667
f3ebb786 1668 if (!(clamav_fbuf = store_malloc(fsize_uint)))
0f0c8159 1669 {
e5ba8aa7 1670 (void)close(clam_fd);
ad93c40f 1671 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1672 string_sprintf("unable to allocate memory %u for file (%s)",
1673 fsize_uint, eml_filename),
74f1a423 1674 malware_daemon_ctx.sock);
0f0c8159 1675 }
b1f8e4f8 1676
0f0c8159
JH
1677 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1678 {
1679 int err = errno;
f3ebb786 1680 store_free(clamav_fbuf); (void)close(clam_fd);
ad93c40f 1681 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1682 string_sprintf("can't read spool file %s: %s",
1683 eml_filename, strerror(err)),
74f1a423 1684 malware_daemon_ctx.sock);
0f0c8159
JH
1685 }
1686 (void)close(clam_fd);
b1f8e4f8 1687
0f0c8159 1688 /* send file body to socket */
0f0c8159
JH
1689 send_size = htonl(fsize_uint);
1690 send_final_zeroblock = 0;
74f1a423
JH
1691 if ((send(malware_daemon_ctx.sock, &send_size, sizeof(send_size), 0) < 0) ||
1692 (send(malware_daemon_ctx.sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1693 (send(malware_daemon_ctx.sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
0f0c8159 1694 {
f3ebb786 1695 store_free(clamav_fbuf);
ad93c40f 1696 return m_panic_defer_3(scanent, NULL,
0f0c8159 1697 string_sprintf("unable to send file body to socket (%s)", hostname),
74f1a423 1698 malware_daemon_ctx.sock);
4e71661f 1699 }
f3ebb786 1700 store_free(clamav_fbuf);
0f0c8159
JH
1701 }
1702 else
1703 { /* use scan command */
1704 /* Send a SCAN command pointing to a filename; then in the then in the
1705 * scan-method-neutral part, read the response back */
1706
1707/* ================================================================= */
1708
1709 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1710 which dates to when ClamAV needed us to break apart the email into the
1711 MIME parts (eg, with the now deprecated demime condition coming first).
1712 Some time back, ClamAV gained the ability to deconstruct the emails, so
1713 doing this would actually have resulted in the mail attachments being
1714 scanned twice, in the broken out files and from the original .eml.
1715 Since ClamAV now handles emails (and has for quite some time) we can
1716 just use the email file itself. */
4a5cbaff 1717 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
0f0c8159 1718
e1d04f48 1719 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
1720 "Malware scan: issuing %s local-path scan [%s]\n",
1721 scanner_name, scanner_options);
b1f8e4f8 1722
4a5cbaff 1723 if (cmd_str.len)
74f1a423 1724 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
ad93c40f 1725 return m_panic_defer_3(scanent, CUS callout_address,
4a5cbaff 1726 string_sprintf("unable to write to socket (%s)", strerror(errno)),
74f1a423 1727 malware_daemon_ctx.sock);
b1f8e4f8 1728
0f0c8159
JH
1729 /* Do not shut down the socket for writing; a user report noted that
1730 * clamd 0.70 does not react well to this. */
1731 }
1732 /* Commands have been sent, no matter which scan method or connection
1733 * type we're using; now just read the result, independent of method. */
1734
1735 /* Read the result */
1736 memset(av_buffer, 0, sizeof(av_buffer));
0a5441fc 1737 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo);
74f1a423
JH
1738 (void)close(malware_daemon_ctx.sock);
1739 malware_daemon_ctx.sock = -1;
1740 malware_daemon_ctx.tls_ctx = NULL;
0f0c8159
JH
1741
1742 if (bread <= 0)
ad93c40f 1743 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1744 string_sprintf("unable to read from socket (%s)",
1745 errno == 0 ? "EOF" : strerror(errno)));
1746
1747 if (bread == sizeof(av_buffer))
ad93c40f 1748 return m_panic_defer(scanent, CUS callout_address,
0ea02355 1749 US"buffer too small");
0f0c8159
JH
1750 /* We're now assured of a NULL at the end of av_buffer */
1751
1752 /* Check the result. ClamAV returns one of two result formats.
1753 In the basic mode, the response is of the form:
1754 infected: -> "<filename>: <virusname> FOUND"
1755 not-infected: -> "<filename>: OK"
1756 error: -> "<filename>: <errcode> ERROR
1757 If the ExtendedDetectionInfo option has been turned on, then we get:
1758 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1759 for the infected case. Compare:
1760/tmp/eicar.com: Eicar-Test-Signature FOUND
1761/tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1762
1763 In the streaming case, clamd uses the filename "stream" which you should
1764 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1765 client app will replace "stream" with the original filename before returning
1766 results to stdout, but the trace shows the data).
1767
1768 We will assume that the pathname passed to clamd from Exim does not contain
1769 a colon. We will have whined loudly above if the eml_filename does (and we're
1770 passing a filename to clamd). */
1771
1772 if (!(*av_buffer))
ad93c40f 1773 return m_panic_defer(scanent, CUS callout_address,
0ea02355 1774 US"ClamAV returned null");
0f0c8159
JH
1775
1776 /* strip newline at the end (won't be present for zINSTREAM)
1777 (also any trailing whitespace, which shouldn't exist, but we depend upon
1778 this below, so double-check) */
1779 p = av_buffer + Ustrlen(av_buffer) - 1;
1780 if (*p == '\n') *p = '\0';
1781
e1d04f48 1782 DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
0f0c8159
JH
1783
1784 while (isspace(*--p) && (p > av_buffer))
1785 *p = '\0';
1786 if (*p) ++p;
0f0c8159
JH
1787
1788 /* colon in returned output? */
80591636 1789 if(!(p = Ustrchr(av_buffer,':')))
ad93c40f 1790 return m_panic_defer(scanent, CUS callout_address, string_sprintf(
0f0c8159
JH
1791 "ClamAV returned malformed result (missing colon): %s",
1792 av_buffer));
1793
1794 /* strip filename */
1795 while (*p && isspace(*++p)) /**/;
1796 vname = p;
1797
1798 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1799 but we should at least be resistant to it. */
1800 p = Ustrrchr(vname, ' ');
1801 result_tag = p ? p+1 : vname;
1802
1803 if (Ustrcmp(result_tag, "FOUND") == 0)
1804 {
1805 /* p should still be the whitespace before the result_tag */
1806 while (isspace(*p)) --p;
1807 *++p = '\0';
1808 /* Strip off the extended information too, which will be in parens
1809 after the virus name, with no intervening whitespace. */
1810 if (*--p == ')')
4e71661f 1811 {
0f0c8159
JH
1812 /* "(hash:size)", so previous '(' will do; if not found, we have
1813 a curious virus name, but not an error. */
1814 p = Ustrrchr(vname, '(');
1815 if (p)
1816 *p = '\0';
4e71661f 1817 }
0f0c8159 1818 malware_name = string_copy(vname);
e1d04f48 1819 DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
b1f8e4f8 1820
0f0c8159
JH
1821 }
1822 else if (Ustrcmp(result_tag, "ERROR") == 0)
ad93c40f 1823 return m_panic_defer(scanent, CUS callout_address,
0f0c8159 1824 string_sprintf("ClamAV returned: %s", av_buffer));
b1f8e4f8 1825
0f0c8159
JH
1826 else if (Ustrcmp(result_tag, "OK") == 0)
1827 {
1828 /* Everything should be OK */
1829 malware_name = NULL;
e1d04f48 1830 DEBUG(D_acl) debug_printf_indent("Malware not found\n");
b1f8e4f8 1831
0f0c8159
JH
1832 }
1833 else
ad93c40f 1834 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1835 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1836
1837 break;
b1f8e4f8 1838 } /* clamd */
c11d665d 1839#endif
b1f8e4f8 1840
c11d665d 1841#ifndef DISABLE_MAL_SOCK
b1f8e4f8 1842 case M_SOCK: /* "sock" scanner type ------------------------------------- */
0f0c8159
JH
1843 /* This code was derived by Martin Poole from the clamd code contributed
1844 by David Saez and the cmdline code
1845 */
b1f8e4f8 1846 {
0f0c8159
JH
1847 int bread;
1848 uschar * commandline;
1849 uschar av_buffer[1024];
1850 uschar * linebuffer;
1851 uschar * sockline_scanner;
1852 uschar sockline_scanner_default[] = "%s\n";
1853 const pcre *sockline_trig_re;
1854 const pcre *sockline_name_re;
1855
1856 /* find scanner command line */
ac4d558b
JH
1857 if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1858 NULL, 0))
1859 && *sockline_scanner
1860 )
0f0c8159
JH
1861 { /* check for no expansions apart from one %s */
1862 uschar * s = Ustrchr(sockline_scanner, '%');
1863 if (s++)
1864 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
ad93c40f 1865 return m_panic_defer_3(scanent, NULL,
74f1a423 1866 US"unsafe sock scanner call spec", malware_daemon_ctx.sock);
0f0c8159
JH
1867 }
1868 else
1869 sockline_scanner = sockline_scanner_default;
ac4d558b
JH
1870 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1871 string_printing(sockline_scanner));
b1f8e4f8 1872
0f0c8159
JH
1873 /* find scanner output trigger */
1874 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1875 "missing trigger specification", &errstr);
1876 if (!sockline_trig_re)
74f1a423 1877 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
b1f8e4f8 1878
0f0c8159
JH
1879 /* find virus name regex */
1880 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1881 "missing virus name regex specification", &errstr);
1882 if (!sockline_name_re)
74f1a423 1883 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
b1f8e4f8 1884
0f0c8159 1885 /* prepare scanner call - security depends on expansions check above */
040721f2 1886 commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
ac4d558b
JH
1887 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1888 string_printing(commandline));
b1f8e4f8 1889
0f0c8159 1890 /* Pass the command string to the socket */
74f1a423 1891 if (m_sock_send(malware_daemon_ctx.sock, commandline, Ustrlen(commandline), &errstr) < 0)
ad93c40f 1892 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1893
0f0c8159 1894 /* Read the result */
0a5441fc 1895 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo);
b1f8e4f8 1896
0f0c8159 1897 if (bread <= 0)
ad93c40f 1898 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1899 string_sprintf("unable to read from socket (%s)", strerror(errno)),
74f1a423 1900 malware_daemon_ctx.sock);
b1f8e4f8 1901
0f0c8159 1902 if (bread == sizeof(av_buffer))
ad93c40f 1903 return m_panic_defer_3(scanent, CUS callout_address,
74f1a423 1904 US"buffer too small", malware_daemon_ctx.sock);
0f0c8159
JH
1905 av_buffer[bread] = '\0';
1906 linebuffer = string_copy(av_buffer);
ac4d558b
JH
1907 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1908 string_printing(linebuffer));
b1f8e4f8 1909
0f0c8159
JH
1910 /* try trigger match */
1911 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1912 {
1913 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1914 malware_name = US "unknown";
ac4d558b
JH
1915 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1916 string_printing(malware_name));
b1f8e4f8 1917 }
0f0c8159
JH
1918 else /* no virus found */
1919 malware_name = NULL;
1920 break;
8523533c 1921 }
c11d665d 1922#endif
8e669ac1 1923
c11d665d 1924#ifndef DISABLE_MAL_MKS
b1f8e4f8
JH
1925 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1926 {
0f0c8159
JH
1927 char *mksd_options_end;
1928 int mksd_maxproc = 1; /* default, if no option supplied */
1929 int retval;
b1f8e4f8 1930
0f0c8159
JH
1931 if (scanner_options)
1932 {
1933 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1934 if ( *scanner_options == '\0'
1935 || *mksd_options_end != '\0'
1936 || mksd_maxproc < 1
1937 || mksd_maxproc > 32
1938 )
ad93c40f 1939 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1940 string_sprintf("invalid option '%s'", scanner_options));
1941 }
8e669ac1 1942
74f1a423 1943 if((malware_daemon_ctx.sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
ad93c40f 1944 return m_panic_defer(scanent, CUS callout_address, errstr);
8e669ac1 1945
0f0c8159 1946 malware_name = NULL;
94a18f28 1947
e1d04f48 1948 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
94a18f28 1949
74f1a423 1950 if ((retval = mksd_scan_packed(scanent, malware_daemon_ctx.sock, eml_filename, tmo)) != OK)
0f0c8159 1951 {
74f1a423 1952 close (malware_daemon_ctx.sock);
0f0c8159
JH
1953 return retval;
1954 }
1955 break;
8523533c 1956 }
c11d665d 1957#endif
0f0c8159 1958
c11d665d 1959#ifndef DISABLE_MAL_AVAST
b6fbf22d
JH
1960 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1961 {
b6fbf22d
JH
1962 uschar buf[1024];
1963 uschar * scanrequest;
b6fbf22d 1964 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
0f0c8159 1965 int nread;
ad93c40f 1966 uschar * error_message = NULL;
4fe93c4b
HSHR
1967 BOOL more_data = FALSE;
1968 BOOL strict = TRUE;
b6fbf22d
JH
1969
1970 /* According to Martin Tuma @avast the protocol uses "escaped
1971 whitespace", that is, every embedded whitespace is backslash
1972 escaped, as well as backslash is protected by backslash.
1973 The returned lines contain the name of the scanned file, a tab
1974 and the [ ] marker.
1975 [+] - not infected
1976 [L] - infected
aded2255 1977 [E] - some error occurred
71bb51e0
HSHR
1978 Such marker follows the first non-escaped TAB. For more information
1979 see avast-protocol(5)
ad93c40f
HSHR
1980
1981 We observed two cases:
1982 -> SCAN /file
1983 <- /file [E]0.0 Error 13 Permission denied
1984 <- 451 SCAN Engine error 13 permission denied
1985
1986 -> SCAN /file
1987 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1988 <- /file… [+]2.0
1989 <- /file… [+]2.0 0 Eicar Test Virus!!!
1990 <- 200 SCAN OK
1991
1992 If the scanner returns 4xx, DEFER is a good decision, combined
1993 with a panic log entry, to get the admin's attention.
1994
1995 If the scanner returns 200, we reject it as malware, if found any,
1996 or, in case of an error, we set the malware message to the error
1997 string.
1998
1999 Some of the >= 42000 errors are message related - usually some
2000 broken archives etc, but some of them are e.g. license related.
2001 Once the license expires the engine starts returning errors for
2002 every scanning attempt. I¹ have the full list of the error codes
2003 but it is not a public API and is subject to change. It is hard
2004 for me to say what you should do in case of an engine error. You
2005 can have a “Treat * unscanned file as infection” policy or “Treat
2006 unscanned file as clean” policy. ¹) Jakub Bednar
2007
2008 */
2009
476be7e2
JH
2010 if ( ( !ava_re_clean
2011 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
2012 || ( !ava_re_virus
2013 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
ad93c40f
HSHR
2014 || ( !ava_re_error
2015 && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
b6fbf22d 2016 )
ad93c40f 2017 return malware_panic_defer(errstr);
b6fbf22d
JH
2018
2019 /* wait for result */
0f0c8159 2020 for (avast_stage = AVA_HELO;
74f1a423 2021 (nread = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) > 0;
0f0c8159 2022 )
b6fbf22d
JH
2023 {
2024 int slen = Ustrlen(buf);
94431adb 2025 if (slen >= 1)
b6fbf22d 2026 {
71bb51e0
HSHR
2027
2028 /* Multi line responses are bracketed between 210 … and nnn … */
2029 if (Ustrncmp(buf, "210", 3) == 0)
2030 {
2031 more_data = 1;
2032 continue;
2033 }
2034 else if (more_data && isdigit(buf[0])) more_data = 0;
2035
b6fbf22d
JH
2036 switch (avast_stage)
2037 {
2038 case AVA_HELO:
71bb51e0 2039 if (more_data) continue;
b6fbf22d
JH
2040 if (Ustrncmp(buf, "220", 3) != 0)
2041 goto endloop; /* require a 220 */
2042 goto sendreq;
2043
2044 case AVA_OPT:
71bb51e0 2045 if (more_data) continue;
b6fbf22d
JH
2046 if (Ustrncmp(buf, "200", 3) != 0)
2047 goto endloop; /* require a 200 */
2048
2049 sendreq:
2050 {
2051 int len;
2052 /* Check for another option to send. Newline-terminate it. */
2053 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
2054 NULL, 0)))
2055 {
eb445b04
HSHR
2056 if (Ustrcmp(scanrequest, "pass_unscanned") == 0)
2057 {
2058 DEBUG(D_acl) debug_printf_indent("pass unscanned files as clean\n");
2059 strict = FALSE;
2060 goto sendreq;
2061 }
b6fbf22d
JH
2062 scanrequest = string_sprintf("%s\n", scanrequest);
2063 avast_stage = AVA_OPT; /* just sent option */
71bb51e0 2064 DEBUG(D_acl) debug_printf_indent("send to avast OPTION: %s", scanrequest);
b6fbf22d
JH
2065 }
2066 else
2067 {
040721f2 2068 scanrequest = string_sprintf("SCAN %s\n", eml_dir);
b6fbf22d 2069 avast_stage = AVA_RSP; /* just sent command */
71bb51e0 2070 DEBUG(D_acl) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir);
b6fbf22d
JH
2071 }
2072
2073 /* send config-cmd or scan-request to socket */
2074 len = Ustrlen(scanrequest);
74f1a423 2075 if (send(malware_daemon_ctx.sock, scanrequest, len, 0) == -1)
b6fbf22d
JH
2076 {
2077 scanrequest[len-1] = '\0';
ad93c40f 2078 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
b6fbf22d 2079 "unable to send request '%s' to socket (%s): %s",
74f1a423 2080 scanrequest, scanner_options, strerror(errno)), malware_daemon_ctx.sock);
b6fbf22d
JH
2081 }
2082 break;
2083 }
2084
2085 case AVA_RSP:
71bb51e0 2086
91e974f5 2087 if (isdigit(buf[0])) /* We're done */
71bb51e0 2088 goto endloop;
71bb51e0 2089
91e974f5 2090 if (malware_name) /* Nothing else matters, just read on */
ad93c40f 2091 break;
b6fbf22d 2092
91e974f5 2093 if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
b6fbf22d
JH
2094 break;
2095
4fe93c4b 2096 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
ad93c40f
HSHR
2097 {
2098 unescape(malware_name);
2099 DEBUG(D_acl)
2100 debug_printf_indent("unescaped malware name: '%s'\n", malware_name);
2101 break;
2102 }
2103
91e974f5 2104 if (strict) /* treat scanner errors as malware */
ad93c40f 2105 {
4fe93c4b 2106 if ((malware_name = m_pcre_exec(ava_re_error, buf)))
91e974f5
HSHR
2107 {
2108 unescape(malware_name);
2109 DEBUG(D_acl)
2110 debug_printf_indent("unescaped error message: '%s'\n", malware_name);
2111 break;
2112 }
ad93c40f 2113 }
91e974f5 2114 else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
eb445b04
HSHR
2115 {
2116 log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
2117 break;
2118 }
2119
83d2a861 2120 /* here also for any unexpected response from the scanner */
eb445b04 2121 DEBUG(D_acl) debug_printf("avast response not handled: '%s'\n", buf);
91e974f5 2122
b6fbf22d 2123 goto endloop;
755762fd 2124
83d2a861 2125 default: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
755762fd 2126 __FILE__, __LINE__, __FUNCTION__);
b6fbf22d 2127 }
0f0c8159 2128 }
b6fbf22d 2129 }
91e974f5 2130
b6fbf22d
JH
2131 endloop:
2132
46682a67
JH
2133 if (nread == -1) error_message = US"EOF from scanner";
2134 else if (nread < 0) error_message = US"timeout from scanner";
2135 else if (nread == 0) error_message = US"got nothing from scanner";
91e974f5 2136 else if (buf[0] != '2') error_message = buf;
ad93c40f 2137
91e974f5 2138 DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n");
74f1a423 2139 if (send(malware_daemon_ctx.sock, "QUIT\n", 5, 0) == -1)
91e974f5
HSHR
2140 return m_panic_defer_3(scanent, CUS callout_address,
2141 string_sprintf("unable to send quit request to socket (%s): %s",
74f1a423 2142 scanner_options, strerror(errno)), malware_daemon_ctx.sock);
91e974f5
HSHR
2143
2144 if (error_message)
74f1a423 2145 return m_panic_defer_3(scanent, CUS callout_address, error_message, malware_daemon_ctx.sock);
ad93c40f 2146
b6fbf22d 2147 }
c11d665d 2148#endif
0f0c8159 2149 } /* scanner type switch */
8523533c 2150
74f1a423
JH
2151 if (malware_daemon_ctx.sock >= 0)
2152 (void) close (malware_daemon_ctx.sock);
0f0c8159 2153 malware_ok = TRUE; /* set "been here, done that" marker */
b1f8e4f8 2154 }
8523533c 2155
0f0c8159
JH
2156/* match virus name against pattern (caseless ------->----------v) */
2157if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
2158 {
e1d04f48 2159 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
2160 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
2161 return OK;
2162 }
2163else
2164 return FAIL;
8523533c
TK
2165}
2166
2167
0f0c8159
JH
2168/*************************************************
2169* Scan an email for malware *
2170*************************************************/
8523533c 2171
0f0c8159
JH
2172/* This is the normal interface for scanning an email, which doesn't need a
2173filename; it's a wrapper around the malware_file function.
8523533c 2174
0f0c8159
JH
2175Arguments:
2176 malware_re match condition for "malware="
2177 timeout if nonzero, timeout in seconds
2178
2179Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2180 where true means malware was found (condition applies)
2181*/
2182int
2183malware(const uschar * malware_re, int timeout)
8523533c 2184{
040721f2 2185int ret = malware_internal(malware_re, NULL, timeout);
8e669ac1 2186
55240832 2187if (ret == DEFER) av_failed = TRUE;
55240832 2188return ret;
8523533c
TK
2189}
2190
8e669ac1 2191
0f0c8159
JH
2192/*************************************************
2193* Scan a file for malware *
2194*************************************************/
8e669ac1 2195
0f0c8159
JH
2196/* This is a test wrapper for scanning an email, which is not used in
2197normal processing. Scan any file, using the Exim scanning interface.
2198This function tampers with various global variables so is unsafe to use
2199in any other context.
8e669ac1 2200
0f0c8159
JH
2201Arguments:
2202 eml_filename a file holding the message to be scanned
8523533c 2203
0f0c8159
JH
2204Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2205 where true means malware was found (condition applies)
2206*/
2207int
2208malware_in_file(uschar *eml_filename)
8523533c 2209{
55240832
JH
2210uschar message_id_buf[64];
2211int ret;
2212
2213/* spool_mbox() assumes various parameters exist, when creating
2214the relevant directory and the email within */
2215
2216(void) string_format(message_id_buf, sizeof(message_id_buf),
2217 "dummy-%d", vaguely_random_number(INT_MAX));
2218message_id = message_id_buf;
2219sender_address = US"malware-sender@example.net";
2220return_path = US"";
2221recipients_list = NULL;
2222receive_add_recipient(US"malware-victim@example.net", -1);
8768d548 2223f.enable_dollar_recipients = TRUE;
55240832 2224
040721f2 2225ret = malware_internal(US"*", eml_filename, 0);
55240832
JH
2226
2227Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
2228spool_mbox_ok = 1;
2229
2230/* don't set no_mbox_unspool; at present, there's no way for it to become
2231set, but if that changes, then it should apply to these tests too */
2232
2233unspool_mbox();
2234
2235/* silence static analysis tools */
2236message_id = NULL;
2237
2238return ret;
8523533c
TK
2239}
2240
476be7e2
JH
2241
2242void
2243malware_init(void)
2244{
2245if (!malware_default_re)
2246 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
c11d665d
JH
2247
2248#ifndef DISABLE_MAL_DRWEB
476be7e2
JH
2249if (!drweb_re)
2250 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
c11d665d
JH
2251#endif
2252#ifndef DISABLE_MAL_FSECURE
476be7e2
JH
2253if (!fsec_re)
2254 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
c11d665d
JH
2255#endif
2256#ifndef DISABLE_MAL_KAV
476be7e2
JH
2257if (!kav_re_sus)
2258 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2259if (!kav_re_inf)
2260 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
c11d665d 2261#endif
fd5a6ffb 2262#ifndef DISABLE_MAL_AVAST
476be7e2
JH
2263if (!ava_re_clean)
2264 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2265if (!ava_re_virus)
2266 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
ad93c40f
HSHR
2267if (!ava_re_error)
2268 ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
c11d665d 2269#endif
fd5a6ffb 2270#ifndef DISABLE_MAL_FFROT6D
71b32d41
ACK
2271if (!fprot6d_re_error)
2272 fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
2273if (!fprot6d_re_virus)
2274 fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
c11d665d
JH
2275#endif
2276}
2277
2278
ab1604ea
JH
2279gstring *
2280malware_show_supported(gstring * g)
c11d665d 2281{
ab1604ea
JH
2282g = string_cat(g, US"Malware:");
2283for (struct scan * sc = m_scans; sc->scancode != (scanner_t)-1; sc++)
2284 g = string_fmt_append(g, " %s", sc->name);
2285return string_cat(g, US"\n");
476be7e2
JH
2286}
2287
c11d665d
JH
2288
2289# endif /*!MACRO_PREDEF*/
b1f8e4f8
JH
2290#endif /*WITH_CONTENT_SCAN*/
2291/*
2292 * vi: aw ai sw=2
2293 */