Testsuite: workaround older-perl bug
[exim.git] / src / src / malware.c
CommitLineData
8523533c
TK
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873
JH
5/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
6 * License: GPL
f9ba5e22 7 * Copyright (c) The Exim Maintainers 2015 - 2018
80fea873 8 */
8523533c
TK
9
10/* Code for calling virus (malware) scanners. Called from acl.c. */
11
12#include "exim.h"
c11d665d 13#ifdef WITH_CONTENT_SCAN /* entire file */
8523533c 14
c8599aad
JH
15typedef enum {
16#ifndef DISABLE_MAL_FFROTD
17 M_FPROTD,
18#endif
19#ifndef DISABLE_MAL_FFROT6D
20 M_FPROT6D,
21#endif
22#ifndef DISABLE_MAL_DRWEB
23 M_DRWEB,
24#endif
25#ifndef DISABLE_MAL_AVE
26 M_AVES,
27#endif
28#ifndef DISABLE_MAL_FSECURE
29 M_FSEC,
30#endif
31#ifndef DISABLE_MAL_KAV
32 M_KAVD,
33#endif
34#ifndef DISABLE_MAL_SOPHIE
35 M_SOPHIE,
36#endif
37#ifndef DISABLE_MAL_CLAM
38 M_CLAMD,
39#endif
40#ifndef DISABLE_MAL_MKS
41 M_MKSD,
42#endif
43#ifndef DISABLE_MAL_AVAST
44 M_AVAST,
45#endif
46#ifndef DISABLE_MAL_SOCK
47 M_SOCK,
48#endif
49#ifndef DISABLE_MAL_CMDLINE
50 M_CMDL,
51#endif
52 } scanner_t;
b1f8e4f8
JH
53typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
54static struct scan
55{
56 scanner_t scancode;
57 const uschar * name;
58 const uschar * options_default;
59 contype_t conn;
60} m_scans[] =
61{
c11d665d 62#ifndef DISABLE_MAL_FFROTD
b1f8e4f8 63 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
c11d665d
JH
64#endif
65#ifndef DISABLE_MAL_FFROT6D
66 { M_FPROT6D, US"f-prot6d", US"localhost 10200", MC_TCP },
67#endif
68#ifndef DISABLE_MAL_DRWEB
b1f8e4f8 69 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
c11d665d
JH
70#endif
71#ifndef DISABLE_MAL_AVE
b1f8e4f8 72 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
c11d665d
JH
73#endif
74#ifndef DISABLE_MAL_FSECURE
b1f8e4f8 75 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
c11d665d
JH
76#endif
77#ifndef DISABLE_MAL_KAV
b1f8e4f8 78 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
c11d665d
JH
79#endif
80#ifndef DISABLE_MAL_SOPHIE
b1f8e4f8 81 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
c11d665d
JH
82#endif
83#ifndef DISABLE_MAL_CLAM
b1f8e4f8 84 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
c11d665d
JH
85#endif
86#ifndef DISABLE_MAL_MKS
b1f8e4f8 87 { M_MKSD, US"mksd", NULL, MC_NONE },
c11d665d
JH
88#endif
89#ifndef DISABLE_MAL_AVAST
b6fbf22d 90 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
c11d665d
JH
91#endif
92#ifndef DISABLE_MAL_SOCK
93 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
94#endif
95#ifndef DISABLE_MAL_CMDLINE
96 { M_CMDL, US"cmdline", NULL, MC_NONE },
97#endif
b1f8e4f8
JH
98 { -1, NULL, NULL, MC_NONE } /* end-marker */
99};
100
c11d665d
JH
101/******************************************************************************/
102# ifdef MACRO_PREDEF /* build solely to predefine macros */
103
104# include "macro_predef.h"
105
106void
107features_malware(void)
108{
2b8b8e4e
JH
109const struct scan * sc;
110const uschar * s;
111uschar * t;
c11d665d
JH
112uschar buf[64];
113
114spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
115
116for (sc = m_scans; sc->scancode != -1; sc++)
117 {
118 for(s = sc->name, t = buf+14; *s; s++) if (*s != '-') *t++ = toupper(*s);
119 *t = '\0';
120 builtin_macro_create(buf);
121 }
122}
123
124/******************************************************************************/
125# else /*!MACRO_PREDEF, main build*/
126
127
128#define MALWARE_TIMEOUT 120 /* default timeout, seconds */
129
130static const uschar * malware_regex_default = US ".+";
131static const pcre * malware_default_re = NULL;
132
133
134
135#ifndef DISABLE_MAL_CLAM
599dcb77 136/* The maximum number of clamd servers that are supported in the configuration */
c11d665d
JH
137# define MAX_CLAMD_SERVERS 32
138# define MAX_CLAMD_SERVERS_S "32"
599dcb77 139
8a512ed5
JH
140typedef struct clamd_address {
141 uschar * hostspec;
142 unsigned tcp_port;
143 unsigned retry;
144} clamd_address;
8523533c
TK
145#endif
146
a9ccd69a 147
c11d665d
JH
148#ifndef DISABLE_MAL_DRWEB
149# define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
150# define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
151# define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
8523533c 152
c11d665d
JH
153# define DERR_READ_ERR (1<<0) /* read error */
154# define DERR_NOMEMORY (1<<2) /* no memory */
155# define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
156# define DERR_BAD_CALL (1<<15) /* wrong command */
476be7e2
JH
157
158static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
159static const pcre * drweb_re = NULL;
c11d665d 160#endif
476be7e2 161
c11d665d 162#ifndef DISABLE_MAL_FSECURE
476be7e2
JH
163static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
164static const pcre * fsec_re = NULL;
c11d665d 165#endif
476be7e2 166
c11d665d 167#ifndef DISABLE_MAL_KAV
476be7e2
JH
168static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
169static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
170static const pcre * kav_re_sus = NULL;
171static const pcre * kav_re_inf = NULL;
c11d665d 172#endif
476be7e2 173
c11d665d 174#ifndef DISABLE_MAL_AVAST
476be7e2 175static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
ad93c40f
HSHR
176static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
177static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
476be7e2
JH
178static const pcre * ava_re_clean = NULL;
179static const pcre * ava_re_virus = NULL;
ad93c40f 180static const pcre * ava_re_error = NULL;
c11d665d 181#endif
476be7e2 182
c11d665d 183#ifndef DISABLE_MAL_FFROT6D
71b32d41
ACK
184static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
185static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
186static const pcre * fprot6d_re_error = NULL;
187static const pcre * fprot6d_re_virus = NULL;
c11d665d 188#endif
71b32d41 189
476be7e2
JH
190
191
192/******************************************************************************/
193
b1f8e4f8 194/* Routine to check whether a system is big- or little-endian.
8523533c
TK
195 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
196 Needed for proper kavdaemon implementation. Sigh. */
197#define BIG_MY_ENDIAN 0
198#define LITTLE_MY_ENDIAN 1
b1f8e4f8
JH
199static int test_byte_order(void);
200static inline int
201test_byte_order()
202{
203 short int word = 0x0001;
5903c6ff 204 char *byte = CS &word;
b1f8e4f8 205 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
8523533c
TK
206}
207
b1f8e4f8 208BOOL malware_ok = FALSE;
8523533c 209
8544e77a
PP
210/* Gross hacks for the -bmalware option; perhaps we should just create
211the scan directory normally for that case, but look into rigging up the
212needed header variables if not already set on the command-line? */
213extern int spool_mbox_ok;
55240832 214extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
8544e77a 215
8544e77a 216
ad93c40f
HSHR
217/* Some (currently avast only) use backslash escaped whitespace,
218this function undoes these escapes */
46682a67 219
ad93c40f 220static inline void
46682a67
JH
221unescape(uschar *p)
222{
223uschar *p0;
224for (; *p; ++p)
225 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
226 for (p0 = p; *p0; ++p0) *p0 = p0[1];
ad93c40f 227}
8544e77a 228
ad93c40f 229/* --- malware_*_defer --- */
b1f8e4f8 230static inline int
ad93c40f 231malware_panic_defer(const uschar * str)
b1f8e4f8 232{
8a512ed5
JH
233log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
234return DEFER;
b1f8e4f8 235}
ad93c40f
HSHR
236static inline int
237malware_log_defer(const uschar * str)
238{
239log_write(0, LOG_MAIN, "malware acl condition: %s", str);
240return DEFER;
241}
242/* --- m_*_defer --- */
243static inline int
244m_panic_defer(struct scan * scanent, const uschar * hostport,
0ea02355 245 const uschar * str)
b1f8e4f8 246{
ad93c40f 247return malware_panic_defer(string_sprintf("%s %s : %s",
0ea02355 248 scanent->name, hostport ? hostport : CUS"", str));
b1f8e4f8 249}
ad93c40f
HSHR
250static inline int
251m_log_defer(struct scan * scanent, const uschar * hostport,
252 const uschar * str)
253{
254return malware_log_defer(string_sprintf("%s %s : %s",
255 scanent->name, hostport ? hostport : CUS"", str));
256}
257/* --- m_*_defer_3 */
258static inline int
259m_panic_defer_3(struct scan * scanent, const uschar * hostport,
260 const uschar * str, int fd_to_close)
261{
262(void) close(fd_to_close);
263return m_panic_defer(scanent, hostport, str);
264}
265static inline int
266m_log_defer_3(struct scan * scanent, const uschar * hostport,
0ea02355 267 const uschar * str, int fd_to_close)
b1f8e4f8 268{
8a512ed5 269(void) close(fd_to_close);
ad93c40f 270return m_log_defer(scanent, hostport, str);
b1f8e4f8
JH
271}
272
273/*************************************************/
274
c11d665d 275#ifndef DISABLE_MAL_CLAM
b1f8e4f8
JH
276/* Only used by the Clamav code, which is working from a list of servers and
277uses the returned in_addr to get a second connection to the same system.
278*/
279static inline int
280m_tcpsocket(const uschar * hostname, unsigned int port,
10ac8d7f 281 host_item * host, uschar ** errstr, const blob * fastopen_blob)
b1f8e4f8 282{
4a5cbaff 283return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
10ac8d7f 284 host, errstr, fastopen_blob);
b1f8e4f8 285}
c11d665d 286#endif
b1f8e4f8
JH
287
288static int
b1f8e4f8
JH
289m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
290{
8a512ed5
JH
291if (send(sock, buf, cnt, 0) < 0)
292 {
293 int err = errno;
294 (void)close(sock);
295 *errstr = string_sprintf("unable to send to socket (%s): %s",
296 buf, strerror(err));
297 return -1;
298 }
299return sock;
b1f8e4f8
JH
300}
301
302static const pcre *
303m_pcre_compile(const uschar * re, uschar ** errstr)
304{
8a512ed5
JH
305const uschar * rerror;
306int roffset;
307const pcre * cre;
308
309cre = pcre_compile(CS re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
310if (!cre)
311 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
312 re, rerror, roffset);
313return cre;
b1f8e4f8
JH
314}
315
316uschar *
317m_pcre_exec(const pcre * cre, uschar * text)
318{
8a512ed5
JH
319int ovector[10*3];
320int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
c11d665d 321 ovector, nelem(ovector));
8a512ed5
JH
322uschar * substr = NULL;
323if (i >= 2) /* Got it */
324 pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
325return substr;
b1f8e4f8
JH
326}
327
328static const pcre *
55414b25
JH
329m_pcre_nextinlist(const uschar ** list, int * sep,
330 char * listerr, uschar ** errstr)
b1f8e4f8 331{
8a512ed5
JH
332const uschar * list_ele;
333const pcre * cre = NULL;
334
335if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
336 *errstr = US listerr;
337else
ac4d558b
JH
338 {
339 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
340 string_printing(list_ele));
8a512ed5 341 cre = m_pcre_compile(CUS list_ele, errstr);
ac4d558b 342 }
8a512ed5 343return cre;
b1f8e4f8
JH
344}
345
4e71661f
JH
346/*
347 Simple though inefficient wrapper for reading a line. Drop CRs and the
348 trailing newline. Can return early on buffer full. Null-terminate.
349 Apply initial timeout if no data ready.
350
0f0c8159
JH
351 Return: number of chars - zero for an empty line
352 -1 on EOF
353 -2 on timeout or error
4e71661f
JH
354*/
355static int
356recv_line(int fd, uschar * buffer, int bsize, int tmo)
357{
358uschar * p = buffer;
359ssize_t rcv;
0f0c8159 360BOOL ok = FALSE;
4e71661f
JH
361
362if (!fd_ready(fd, tmo-time(NULL)))
0f0c8159 363 return -2;
4e71661f 364
0f0c8159 365/*XXX tmo handling assumes we always get a whole line */
4e71661f 366/* read until \n */
0f0c8159 367errno = 0;
4e71661f
JH
368while ((rcv = read(fd, p, 1)) > 0)
369 {
0f0c8159 370 ok = TRUE;
4e71661f
JH
371 if (p-buffer > bsize-2) break;
372 if (*p == '\n') break;
373 if (*p != '\r') p++;
374 }
0f0c8159
JH
375if (!ok)
376 {
e1d04f48 377 DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
0f0c8159
JH
378 rcv==0 ? "EOF" : "error", strerror(errno));
379 return rcv==0 ? -1 : -2;
380 }
4e71661f
JH
381*p = '\0';
382
e1d04f48 383DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
4e71661f
JH
384return p - buffer;
385}
386
387/* return TRUE iff size as requested */
388static BOOL
389recv_len(int sock, void * buf, int size, int tmo)
390{
391return fd_ready(sock, tmo-time(NULL))
392 ? recv(sock, buf, size, 0) == size
393 : FALSE;
394}
395
396
0f0c8159 397
c11d665d 398#ifndef DISABLE_MAL_MKS
0f0c8159
JH
399/* ============= private routines for the "mksd" scanner type ============== */
400
c11d665d 401# include <sys/uio.h>
0f0c8159
JH
402
403static inline int
404mksd_writev (int sock, struct iovec * iov, int iovcnt)
405{
406int i;
407
408for (;;)
409 {
410 do
411 i = writev (sock, iov, iovcnt);
412 while (i < 0 && errno == EINTR);
413 if (i <= 0)
414 {
ad93c40f 415 (void) malware_panic_defer(
0f0c8159
JH
416 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
417 return -1;
418 }
419 for (;;) /* check for short write */
420 if (i >= iov->iov_len)
421 {
422 if (--iovcnt == 0)
423 return 0;
424 i -= iov->iov_len;
425 iov++;
426 }
427 else
428 {
429 iov->iov_len -= i;
430 iov->iov_base = CS iov->iov_base + i;
431 break;
432 }
433 }
434}
435
436static inline int
437mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, int tmo)
438{
439int offset = 0;
440int i;
441
442do
443 {
444 i = ip_recv(sock, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL));
445 if (i <= 0)
446 {
ad93c40f 447 (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
0f0c8159
JH
448 return -1;
449 }
450
451 offset += i;
452 /* offset == av_buffer_size -> buffer full */
453 if (offset == av_buffer_size)
454 {
ad93c40f 455 (void) malware_panic_defer(US"malformed reply received from mksd");
0f0c8159
JH
456 return -1;
457 }
458 } while (av_buffer[offset-1] != '\n');
459
460av_buffer[offset] = '\0';
461return offset;
462}
463
464static inline int
465mksd_parse_line(struct scan * scanent, char * line)
466{
467char *p;
468
469switch (*line)
470 {
471 case 'O': /* OK */
472 return OK;
473
474 case 'E':
475 case 'A': /* ERR */
476 if ((p = strchr (line, '\n')) != NULL)
477 *p = '\0';
ad93c40f 478 return m_panic_defer(scanent, NULL,
0f0c8159
JH
479 string_sprintf("scanner failed: %s", line));
480
481 default: /* VIR */
482 if ((p = strchr (line, '\n')) != NULL)
483 {
484 *p = '\0';
485 if ( p-line > 5
486 && line[3] == ' '
487 && (p = strchr(line+4, ' ')) != NULL
488 && p-line > 4
489 )
490 {
491 *p = '\0';
492 malware_name = string_copy(US line+4);
493 return OK;
494 }
495 }
ad93c40f 496 return m_panic_defer(scanent, NULL,
0f0c8159
JH
497 string_sprintf("malformed reply received: %s", line));
498 }
499}
500
501static int
502mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
503 int tmo)
504{
505struct iovec iov[3];
506const char *cmd = "MSQ\n";
507uschar av_buffer[1024];
508
509iov[0].iov_base = (void *) cmd;
510iov[0].iov_len = 3;
511iov[1].iov_base = (void *) scan_filename;
512iov[1].iov_len = Ustrlen(scan_filename);
513iov[2].iov_base = (void *) (cmd + 3);
514iov[2].iov_len = 1;
515
516if (mksd_writev (sock, iov, 3) < 0)
517 return DEFER;
518
519if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
520 return DEFER;
521
522return mksd_parse_line (scanent, CS av_buffer);
523}
c11d665d 524#endif /* MKSD */
0f0c8159 525
8a512ed5 526
c11d665d 527#ifndef DISABLE_MAL_CLAM
8a512ed5
JH
528static int
529clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
530{
531uschar * s;
532
533cd->retry = 0;
534while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
8a512ed5
JH
535 if (Ustrncmp(s, "retry=", 6) == 0)
536 {
537 int sec = readconf_readtime((s += 6), '\0', FALSE);
538 if (sec < 0)
539 return FAIL;
540 cd->retry = sec;
541 }
542 else
543 return FAIL;
93a6fce2 544return OK;
8a512ed5 545}
c11d665d
JH
546#endif
547
548
8a512ed5 549
8544e77a
PP
550/*************************************************
551* Scan content for malware *
552*************************************************/
553
554/* This is an internal interface for scanning an email; the normal interface
555is via malware(), or there's malware_in_file() used for testing/debugging.
556
557Arguments:
0f0c8159 558 malware_re match condition for "malware="
040721f2
JH
559 scan_filename the file holding the email to be scanned, if we're faking
560 this up for the -bmalware test, else NULL
0f0c8159 561 timeout if nonzero, non-default timeoutl
8544e77a
PP
562
563Returns: Exim message processing code (OK, FAIL, DEFER, ...)
564 where true means malware was found (condition applies)
565*/
b1f8e4f8 566static int
040721f2
JH
567malware_internal(const uschar * malware_re, const uschar * scan_filename,
568 int timeout)
b1f8e4f8 569{
0f0c8159 570int sep = 0;
55414b25 571const uschar *av_scanner_work = av_scanner;
0f0c8159 572uschar *scanner_name;
0f0c8159
JH
573unsigned long mbox_size;
574FILE *mbox_file;
575const pcre *re;
576uschar * errstr;
577struct scan * scanent;
578const uschar * scanner_options;
579int sock = -1;
580time_t tmo;
040721f2 581uschar * eml_filename, * eml_dir;
0f0c8159 582
040721f2
JH
583if (!malware_re)
584 return FAIL; /* empty means "don't match anything" */
585
586/* Ensure the eml mbox file is spooled up */
587
588if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
ad93c40f 589 return malware_panic_defer(US"error while creating mbox spool file");
0f0c8159 590
040721f2
JH
591/* None of our current scanners need the mbox file as a stream (they use
592the name), so we can close it right away. Get the directory too. */
0f0c8159 593
040721f2
JH
594(void) fclose(mbox_file);
595eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
0f0c8159
JH
596
597/* parse 1st option */
040721f2 598if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
0f0c8159
JH
599 return FAIL; /* explicitly no matching */
600
601/* special cases (match anything except empty) */
476be7e2
JH
602if ( strcmpic(malware_re,US"true") == 0
603 || Ustrcmp(malware_re,"*") == 0
604 || Ustrcmp(malware_re,"1") == 0
605 )
606 {
607 if ( !malware_default_re
608 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
ad93c40f 609 return malware_panic_defer(errstr);
0f0c8159 610 malware_re = malware_regex_default;
476be7e2
JH
611 re = malware_default_re;
612 }
0f0c8159
JH
613
614/* compile the regex, see if it works */
476be7e2 615else if (!(re = m_pcre_compile(malware_re, &errstr)))
ad93c40f 616 return malware_panic_defer(errstr);
0f0c8159
JH
617
618/* if av_scanner starts with a dollar, expand it first */
619if (*av_scanner == '$')
620 {
621 if (!(av_scanner_work = expand_string(av_scanner)))
ad93c40f 622 return malware_panic_defer(
0f0c8159
JH
623 string_sprintf("av_scanner starts with $, but expansion failed: %s",
624 expand_string_message));
b1f8e4f8 625
0f0c8159 626 DEBUG(D_acl)
e1d04f48 627 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
0f0c8159
JH
628 /* disable result caching in this case */
629 malware_name = NULL;
630 malware_ok = FALSE;
8523533c
TK
631 }
632
0f0c8159
JH
633/* Do not scan twice (unless av_scanner is dynamic). */
634if (!malware_ok)
635 {
636 /* find the scanner type from the av_scanner option */
637 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
ad93c40f 638 return malware_panic_defer(US"av_scanner configuration variable is empty");
0f0c8159
JH
639 if (!timeout) timeout = MALWARE_TIMEOUT;
640 tmo = time(NULL) + timeout;
641
3e60dd41
JH
642 for (scanent = m_scans; ; scanent++)
643 {
0f0c8159 644 if (!scanent->name)
ad93c40f 645 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
0f0c8159
JH
646 scanner_name));
647 if (strcmpic(scanner_name, US scanent->name) != 0)
648 continue;
ac4d558b
JH
649 DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
650 scanner_name, readconf_printtime(timeout));
651
0f0c8159
JH
652 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
653 scanner_options = scanent->options_default;
654 if (scanent->conn == MC_NONE)
b1f8e4f8 655 break;
ac4d558b
JH
656
657 DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
0f0c8159
JH
658 switch(scanent->conn)
659 {
8c0d5ae8
JH
660 case MC_TCP: sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
661 case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr); break;
3e60dd41 662 case MC_STRM: sock = ip_streamsocket(scanner_options, &errstr, 5); break;
0f0c8159 663 default: /* compiler quietening */ break;
384152a6 664 }
0f0c8159 665 if (sock < 0)
ad93c40f 666 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
667 break;
668 }
8e669ac1 669
0f0c8159
JH
670 switch (scanent->scancode)
671 {
c11d665d 672#ifndef DISABLE_MAL_FFROTD
0f0c8159 673 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
b1f8e4f8 674 {
0f0c8159
JH
675 uschar *fp_scan_option;
676 unsigned int detected=0, par_count=0;
677 uschar * scanrequest;
678 uschar buf[32768], *strhelper, *strhelper2;
679 uschar * malware_name_internal = NULL;
680 int len;
b1f8e4f8 681
0f0c8159 682 scanrequest = string_sprintf("GET %s", eml_filename);
b1f8e4f8 683
0f0c8159
JH
684 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
685 NULL, 0)))
686 {
687 scanrequest = string_sprintf("%s%s%s", scanrequest,
688 par_count ? "%20" : "?", fp_scan_option);
689 par_count++;
690 }
691 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
e1d04f48 692 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
0f0c8159 693 scanner_name, scanrequest);
b1f8e4f8 694
0f0c8159
JH
695 /* send scan request */
696 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
ad93c40f 697 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 698
0f0c8159
JH
699 while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0)
700 if (len > 0)
701 {
702 if (Ustrstr(buf, US"<detected type=\"") != NULL)
703 detected = 1;
704 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
4e71661f 705 {
0f0c8159 706 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
4e71661f 707 {
0f0c8159
JH
708 *strhelper2 = '\0';
709 malware_name_internal = string_copy(strhelper+6);
4e71661f
JH
710 }
711 }
0f0c8159 712 else if (Ustrstr(buf, US"<summary code=\""))
4e71661f 713 {
0f0c8159
JH
714 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
715 ? malware_name_internal : NULL;
716 break;
4e71661f 717 }
0f0c8159
JH
718 }
719 if (len < -1)
720 {
721 (void)close(sock);
722 return DEFER;
723 }
724 break;
725 } /* f-protd */
c11d665d
JH
726#endif
727
728#ifndef DISABLE_MAL_FFROT6D
729 case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
730 {
731 int bread;
732 uschar * e;
733 uschar * linebuffer;
734 uschar * scanrequest;
735 uschar av_buffer[1024];
736
737 if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
738 || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
ad93c40f 739 return malware_panic_defer(errstr);
c11d665d
JH
740
741 scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
742 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
743 scanner_name, scanrequest);
744
745 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
ad93c40f 746 return m_panic_defer(scanent, CUS callout_address, errstr);
c11d665d
JH
747
748 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
749
750 if (bread <= 0)
ad93c40f 751 return m_panic_defer_3(scanent, CUS callout_address,
c11d665d
JH
752 string_sprintf("unable to read from socket (%s)", strerror(errno)),
753 sock);
754
755 if (bread == sizeof(av_buffer))
ad93c40f 756 return m_panic_defer_3(scanent, CUS callout_address,
c11d665d
JH
757 US"buffer too small", sock);
758
759 av_buffer[bread] = '\0';
760 linebuffer = string_copy(av_buffer);
761
762 m_sock_send(sock, US"QUIT\n", 5, 0);
763
764 if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
ad93c40f 765 return m_panic_defer_3(scanent, CUS callout_address,
c11d665d 766 string_sprintf("scanner reported error (%s)", e), sock);
b1f8e4f8 767
c11d665d
JH
768 if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
769 malware_name = NULL;
770
771 break;
772 } /* f-prot6d */
773#endif
774
775#ifndef DISABLE_MAL_DRWEB
0f0c8159
JH
776 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
777 /* v0.1 - added support for tcp sockets */
778 /* v0.0 - initial release -- support for unix sockets */
779 {
780 int result;
781 off_t fsize;
782 unsigned int fsize_uint;
783 uschar * tmpbuf, *drweb_fbuf;
784 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
785 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
0f0c8159
JH
786
787 /* prepare variables */
788 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
789 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
790
791 if (*scanner_options != '/')
792 {
793 /* calc file size */
794 if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
ad93c40f 795 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
796 string_sprintf("can't open spool file %s: %s",
797 eml_filename, strerror(errno)),
798 sock);
b1f8e4f8 799
0f0c8159
JH
800 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
801 {
d315eda1
JH
802 int err;
803badseek: err = errno;
b1f8e4f8 804 (void)close(drweb_fd);
ad93c40f 805 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
806 string_sprintf("can't seek spool file %s: %s",
807 eml_filename, strerror(err)),
808 sock);
809 }
810 fsize_uint = (unsigned int) fsize;
811 if ((off_t)fsize_uint != fsize)
812 {
b1f8e4f8 813 (void)close(drweb_fd);
ad93c40f 814 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
815 string_sprintf("seeking spool file %s, size overflow",
816 eml_filename),
817 sock);
4e71661f 818 }
0f0c8159 819 drweb_slen = htonl(fsize);
d315eda1
JH
820 if (lseek(drweb_fd, 0, SEEK_SET) < 0)
821 goto badseek;
0f0c8159 822
e1d04f48 823 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
0f0c8159
JH
824 scanner_name, scanner_options);
825
826 /* send scan request */
827 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
828 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
829 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
830 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
4e71661f 831 {
0f0c8159 832 (void)close(drweb_fd);
ad93c40f 833 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159
JH
834 "unable to send commands to socket (%s)", scanner_options),
835 sock);
4e71661f 836 }
8e669ac1 837
40c90bca 838 if (!(drweb_fbuf = US malloc(fsize_uint)))
0f0c8159
JH
839 {
840 (void)close(drweb_fd);
ad93c40f 841 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
842 string_sprintf("unable to allocate memory %u for file (%s)",
843 fsize_uint, eml_filename),
844 sock);
845 }
b1f8e4f8 846
0f0c8159
JH
847 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
848 {
849 int err = errno;
850 (void)close(drweb_fd);
851 free(drweb_fbuf);
ad93c40f 852 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
853 string_sprintf("can't read spool file %s: %s",
854 eml_filename, strerror(err)),
855 sock);
856 }
857 (void)close(drweb_fd);
b1f8e4f8 858
0f0c8159
JH
859 /* send file body to socket */
860 if (send(sock, drweb_fbuf, fsize, 0) < 0)
4e71661f 861 {
0f0c8159 862 free(drweb_fbuf);
ad93c40f 863 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159
JH
864 "unable to send file body to socket (%s)", scanner_options),
865 sock);
866 }
0f0c8159
JH
867 }
868 else
869 {
870 drweb_slen = htonl(Ustrlen(eml_filename));
b1f8e4f8 871
e1d04f48 872 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
0f0c8159 873 scanner_name, scanner_options);
b1f8e4f8 874
0f0c8159
JH
875 /* send scan request */
876 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
877 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
878 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
879 (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
880 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
ad93c40f 881 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
0f0c8159
JH
882 "unable to send commands to socket (%s)", scanner_options),
883 sock);
884 }
b1f8e4f8 885
0f0c8159
JH
886 /* wait for result */
887 if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo))
ad93c40f 888 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
889 US"unable to read return code", sock);
890 drweb_rc = ntohl(drweb_rc);
891
892 if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
ad93c40f 893 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
894 US"unable to read the number of viruses", sock);
895 drweb_vnum = ntohl(drweb_vnum);
896
897 /* "virus(es) found" if virus number is > 0 */
898 if (drweb_vnum)
899 {
900 int i;
acec9514 901 gstring * g = NULL;
b1f8e4f8 902
0f0c8159
JH
903 /* setup default virus name */
904 malware_name = US"unknown";
b1f8e4f8 905
0f0c8159 906 /* set up match regex */
476be7e2
JH
907 if (!drweb_re)
908 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
b1f8e4f8 909
0f0c8159
JH
910 /* read and concatenate virus names into one string */
911 for (i = 0; i < drweb_vnum; i++)
4e71661f 912 {
acec9514
JH
913 int ovector[10*3];
914
0f0c8159
JH
915 /* read the size of report */
916 if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo))
ad93c40f 917 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
918 US"cannot read report size", sock);
919 drweb_slen = ntohl(drweb_slen);
920 tmpbuf = store_get(drweb_slen);
b1f8e4f8 921
0f0c8159
JH
922 /* read report body */
923 if (!recv_len(sock, tmpbuf, drweb_slen, tmo))
ad93c40f 924 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
925 US"cannot read report string", sock);
926 tmpbuf[drweb_slen] = '\0';
8544e77a 927
0f0c8159
JH
928 /* try matcher on the line, grab substring */
929 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
c11d665d 930 ovector, nelem(ovector));
0f0c8159
JH
931 if (result >= 2)
932 {
933 const char * pre_malware_nb;
8e669ac1 934
0f0c8159 935 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
8e669ac1 936
0f0c8159 937 if (i==0) /* the first name we just copy to malware_name */
b2bcdd35 938 g = string_cat(NULL, US pre_malware_nb);
8e669ac1 939
acec9514 940 /*XXX could be string_append_listele? */
0f0c8159 941 else /* concatenate each new virus name to previous */
acec9514 942 g = string_append(g, 2, "/", pre_malware_nb);
8e669ac1 943
0f0c8159
JH
944 pcre_free_substring(pre_malware_nb);
945 }
946 }
acec9514 947 malware_name = string_from_gstring(g);
0f0c8159
JH
948 }
949 else
950 {
951 const char *drweb_s = NULL;
952
953 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
954 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
955 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
956 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
957 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
958 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
959 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
960 * and others are ignored */
961 if (drweb_s)
ad93c40f 962 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
963 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
964 sock);
8e669ac1 965
0f0c8159 966 /* no virus found */
b1f8e4f8 967 malware_name = NULL;
0f0c8159
JH
968 }
969 break;
970 } /* drweb */
c11d665d 971#endif
8e669ac1 972
c11d665d 973#ifndef DISABLE_MAL_AVE
0f0c8159
JH
974 case M_AVES: /* "aveserver" scanner type -------------------------------- */
975 {
976 uschar buf[32768];
977 int result;
8544e77a 978
0f0c8159
JH
979 /* read aveserver's greeting and see if it is ready (2xx greeting) */
980 buf[0] = 0;
981 recv_line(sock, buf, sizeof(buf), tmo);
8544e77a 982
0f0c8159 983 if (buf[0] != '2') /* aveserver is having problems */
ad93c40f 984 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 985 string_sprintf("unavailable (Responded: %s).",
5903c6ff 986 ((buf[0] != 0) ? buf : US "nothing") ),
0f0c8159 987 sock);
8e669ac1 988
0f0c8159
JH
989 /* prepare our command */
990 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
991 eml_filename);
992
993 /* and send it */
e1d04f48 994 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
0f0c8159
JH
995 scanner_name, buf);
996 if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
ad93c40f 997 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
998
999 malware_name = NULL;
1000 result = 0;
1001 /* read response lines, find malware name and final response */
1002 while (recv_line(sock, buf, sizeof(buf), tmo) > 0)
1003 {
1004 if (buf[0] == '2')
1005 break;
1006 if (buf[0] == '5') /* aveserver is having problems */
4e71661f 1007 {
ad93c40f 1008 result = m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1009 string_sprintf("unable to scan file %s (Responded: %s).",
1010 eml_filename, buf));
1011 break;
4e71661f 1012 }
0f0c8159
JH
1013 if (Ustrncmp(buf,"322",3) == 0)
1014 {
1015 uschar *p = Ustrchr(&buf[4], ' ');
1016 *p = '\0';
1017 malware_name = string_copy(&buf[4]);
1018 }
1019 }
1020
1021 if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0)
ad93c40f 1022 return m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
1023
1024 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1025 buf[0] = 0;
1026 recv_line(sock, buf, sizeof(buf), tmo);
1027
1028 if (buf[0] != '2') /* aveserver is having problems */
ad93c40f 1029 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1030 string_sprintf("unable to quit dialogue (Responded: %s).",
5903c6ff 1031 ((buf[0] != 0) ? buf : US "nothing") ),
0f0c8159
JH
1032 sock);
1033
1034 if (result == DEFER)
1035 {
1036 (void)close(sock);
1037 return DEFER;
1038 }
1039 break;
b1f8e4f8 1040 } /* aveserver */
c11d665d 1041#endif
8e669ac1 1042
c11d665d 1043#ifndef DISABLE_MAL_FSECURE
b1f8e4f8
JH
1044 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
1045 {
0f0c8159
JH
1046 int i, j, bread = 0;
1047 uschar * file_name;
1048 uschar av_buffer[1024];
0f0c8159
JH
1049 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
1050 US"CONFIGURE\tTIMEOUT\t0\n",
1051 US"CONFIGURE\tMAXARCH\t5\n",
1052 US"CONFIGURE\tMIME\t1\n" };
1053
1054 malware_name = NULL;
1055
e1d04f48 1056 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159
JH
1057 scanner_name, scanner_options);
1058 /* pass options */
1059 memset(av_buffer, 0, sizeof(av_buffer));
c11d665d 1060 for (i = 0; i != nelem(cmdopt); i++)
0f0c8159 1061 {
b1f8e4f8 1062
0f0c8159 1063 if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
ad93c40f 1064 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1065
0f0c8159
JH
1066 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1067 if (bread > 0) av_buffer[bread]='\0';
1068 if (bread < 0)
ad93c40f 1069 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1070 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
1071 sock);
1072 for (j = 0; j < bread; j++)
1073 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
1074 av_buffer[j] ='@';
1075 }
8e669ac1 1076
0f0c8159
JH
1077 /* pass the mailfile to fsecure */
1078 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
b1f8e4f8 1079
0f0c8159 1080 if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0)
ad93c40f 1081 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1082
0f0c8159
JH
1083 /* set up match */
1084 /* todo also SUSPICION\t */
476be7e2
JH
1085 if (!fsec_re)
1086 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
b1f8e4f8 1087
0f0c8159
JH
1088 /* read report, linewise. Apply a timeout as the Fsecure daemon
1089 sometimes wants an answer to "PING" but they won't tell us what */
fd02dc0e 1090 {
0f0c8159
JH
1091 uschar * p = av_buffer;
1092 uschar * q;
fd02dc0e 1093
0f0c8159
JH
1094 for (;;)
1095 {
80591636 1096 errno = ETIMEDOUT;
0f0c8159
JH
1097 i = av_buffer+sizeof(av_buffer)-p;
1098 if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0)
ad93c40f 1099 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1100 string_sprintf("unable to read result (%s)", strerror(errno)),
1101 sock);
b1f8e4f8 1102
755762fd 1103 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
0f0c8159
JH
1104 {
1105 *q = '\0';
fd02dc0e 1106
0f0c8159
JH
1107 /* Really search for virus again? */
1108 if (!malware_name)
1109 /* try matcher on the line, grab substring */
476be7e2 1110 malware_name = m_pcre_exec(fsec_re, p);
fd02dc0e 1111
0f0c8159
JH
1112 if (Ustrstr(p, "OK\tScan ok."))
1113 goto fsec_found;
1114 }
fd02dc0e 1115
0f0c8159
JH
1116 /* copy down the trailing partial line then read another chunk */
1117 i = av_buffer+sizeof(av_buffer)-p;
1118 memmove(av_buffer, p, i);
1119 p = av_buffer+i;
fd02dc0e 1120 }
b1f8e4f8 1121 }
fd02dc0e
JH
1122
1123 fsec_found:
b1f8e4f8
JH
1124 break;
1125 } /* fsecure */
c11d665d 1126#endif
599dcb77 1127
c11d665d 1128#ifndef DISABLE_MAL_KAV
b1f8e4f8
JH
1129 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
1130 {
0f0c8159
JH
1131 time_t t;
1132 uschar tmpbuf[1024];
1133 uschar * scanrequest;
1134 int kav_rc;
2decbec9
RC
1135 unsigned long kav_reportlen;
1136 int bread;
0f0c8159
JH
1137 const pcre *kav_re;
1138 uschar *p;
1139
1140 /* get current date and time, build scan request */
1141 time(&t);
1142 /* pdp note: before the eml_filename parameter, this scanned the
1143 directory; not finding documentation, so we'll strip off the directory.
1144 The side-effect is that the test framework scanning may end up in
1145 scanning more than was requested, but for the normal interface, this is
1146 fine. */
1147
1148 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
1149 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
1150 p = Ustrrchr(scanrequest, '/');
1151 if (p)
1152 *p = '\0';
1153
e1d04f48 1154 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159
JH
1155 scanner_name, scanner_options);
1156
1157 /* send scan request */
1158 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
ad93c40f 1159 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1160
0f0c8159
JH
1161 /* wait for result */
1162 if (!recv_len(sock, tmpbuf, 2, tmo))
ad93c40f 1163 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1164 US"unable to read 2 bytes from socket.", sock);
b1f8e4f8 1165
0f0c8159
JH
1166 /* get errorcode from one nibble */
1167 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
1168 switch(kav_rc)
1169 {
1170 case 5: case 6: /* improper kavdaemon configuration */
ad93c40f 1171 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1172 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
1173 sock);
1174 case 1:
ad93c40f 1175 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1176 US"reported 'scanning not completed' (code 1).", sock);
1177 case 7:
ad93c40f 1178 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1179 US"reported 'kavdaemon damaged' (code 7).", sock);
1180 }
b1f8e4f8 1181
4c04137d 1182 /* code 8 is not handled, since it is ambiguous. It appears mostly on
0f0c8159 1183 bounces where part of a file has been cut off */
b1f8e4f8 1184
0f0c8159
JH
1185 /* "virus found" return codes (2-4) */
1186 if (kav_rc > 1 && kav_rc < 5)
b1f8e4f8 1187 {
0f0c8159 1188 int report_flag = 0;
599dcb77 1189
0f0c8159
JH
1190 /* setup default virus name */
1191 malware_name = US"unknown";
b1f8e4f8 1192
0f0c8159 1193 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
b1f8e4f8 1194
0f0c8159
JH
1195 /* read the report, if available */
1196 if (report_flag == 1)
1197 {
1198 /* read report size */
1199 if (!recv_len(sock, &kav_reportlen, 4, tmo))
ad93c40f 1200 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159 1201 US"cannot read report size", sock);
b1f8e4f8 1202
0f0c8159
JH
1203 /* it's possible that avp returns av_buffer[1] == 1 but the
1204 reportsize is 0 (!?) */
1205 if (kav_reportlen > 0)
4e71661f 1206 {
0f0c8159 1207 /* set up match regex, depends on retcode */
476be7e2
JH
1208 if (kav_rc == 3)
1209 {
1210 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1211 kav_re = kav_re_sus;
1212 }
1213 else
1214 {
1215 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1216 kav_re = kav_re_inf;
1217 }
0f0c8159 1218
6e92b3ae
JH
1219 /* read report, linewise. Using size from stream to read amount of data
1220 from same stream is safe enough. */
1221 /* coverity[tainted_data] */
0f0c8159 1222 while (kav_reportlen > 0)
4e71661f 1223 {
0f0c8159
JH
1224 if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
1225 break;
1226 kav_reportlen -= bread+1;
1227
1228 /* try matcher on the line, grab substring */
1229 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1230 break;
b1f8e4f8
JH
1231 }
1232 }
1233 }
0f0c8159
JH
1234 }
1235 else /* no virus found */
1236 malware_name = NULL;
599dcb77 1237
0f0c8159 1238 break;
599dcb77 1239 }
c11d665d 1240#endif
8544e77a 1241
c11d665d 1242#ifndef DISABLE_MAL_CMDLINE
b1f8e4f8
JH
1243 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1244 {
0f0c8159
JH
1245 const uschar *cmdline_scanner = scanner_options;
1246 const pcre *cmdline_trigger_re;
1247 const pcre *cmdline_regex_re;
1248 uschar * file_name;
1249 uschar * commandline;
1250 void (*eximsigchld)(int);
1251 void (*eximsigpipe)(int);
1252 FILE *scanner_out = NULL;
1253 int scanner_fd;
1254 FILE *scanner_record = NULL;
1255 uschar linebuffer[32767];
1256 int rcnt;
1257 int trigger = 0;
1258 uschar *p;
1259
1260 if (!cmdline_scanner)
ad93c40f 1261 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1262
0f0c8159
JH
1263 /* find scanner output trigger */
1264 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1265 "missing trigger specification", &errstr);
1266 if (!cmdline_trigger_re)
ad93c40f 1267 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1268
0f0c8159
JH
1269 /* find scanner name regex */
1270 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1271 "missing virus name regex specification", &errstr);
1272 if (!cmdline_regex_re)
ad93c40f 1273 return m_panic_defer(scanent, NULL, errstr);
b1f8e4f8 1274
0f0c8159
JH
1275 /* prepare scanner call; despite the naming, file_name holds a directory
1276 name which is documented as the value given to %s. */
b1f8e4f8 1277
0f0c8159
JH
1278 file_name = string_copy(eml_filename);
1279 p = Ustrrchr(file_name, '/');
1280 if (p)
1281 *p = '\0';
1282 commandline = string_sprintf(CS cmdline_scanner, file_name);
b1f8e4f8 1283
0f0c8159
JH
1284 /* redirect STDERR too */
1285 commandline = string_sprintf("%s 2>&1", commandline);
b1f8e4f8 1286
e1d04f48 1287 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159 1288 scanner_name, commandline);
b1f8e4f8 1289
0f0c8159
JH
1290 /* store exims signal handlers */
1291 eximsigchld = signal(SIGCHLD,SIG_DFL);
1292 eximsigpipe = signal(SIGPIPE,SIG_DFL);
b1f8e4f8 1293
0f0c8159
JH
1294 if (!(scanner_out = popen(CS commandline,"r")))
1295 {
1296 int err = errno;
1297 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1298 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1299 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1300 }
1301 scanner_fd = fileno(scanner_out);
94a18f28 1302
040721f2 1303 file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
b1f8e4f8 1304
0f0c8159
JH
1305 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1306 {
1307 int err = errno;
1308 (void) pclose(scanner_out);
1309 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1310 return m_panic_defer(scanent, NULL, string_sprintf(
0f0c8159
JH
1311 "opening scanner output file (%s) failed: %s.",
1312 file_name, strerror(err)));
1313 }
8e669ac1 1314
0f0c8159
JH
1315 /* look for trigger while recording output */
1316 while ((rcnt = recv_line(scanner_fd, linebuffer,
1317 sizeof(linebuffer), tmo)))
1318 {
1319 if (rcnt < 0)
93a6fce2
JH
1320 {
1321 int err = errno;
0f0c8159
JH
1322 if (rcnt == -1)
1323 break;
93a6fce2
JH
1324 (void) pclose(scanner_out);
1325 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1326 return m_panic_defer(scanent, NULL, string_sprintf(
93a6fce2
JH
1327 "unable to read from scanner (%s): %s",
1328 commandline, strerror(err)));
1329 }
4e71661f 1330
0f0c8159
JH
1331 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1332 {
1333 /* short write */
1334 (void) pclose(scanner_out);
1335 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
ad93c40f 1336 return m_panic_defer(scanent, NULL, string_sprintf(
0f0c8159 1337 "short write on scanner output file (%s).", file_name));
4e71661f 1338 }
0f0c8159
JH
1339 putc('\n', scanner_record);
1340 /* try trigger match */
1341 if ( !trigger
1342 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1343 )
1344 trigger = 1;
1345 }
8e669ac1 1346
0f0c8159
JH
1347 (void)fclose(scanner_record);
1348 sep = pclose(scanner_out);
1349 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1350 if (sep != 0)
ad93c40f 1351 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1352 sep == -1
1353 ? string_sprintf("running scanner failed: %s", strerror(sep))
1354 : string_sprintf("scanner returned error code: %d", sep));
b1f8e4f8 1355
0f0c8159
JH
1356 if (trigger)
1357 {
1358 uschar * s;
1359 /* setup default virus name */
1360 malware_name = US"unknown";
b1f8e4f8 1361
0f0c8159
JH
1362 /* re-open the scanner output file, look for name match */
1363 scanner_record = fopen(CS file_name, "rb");
1364 while (fgets(CS linebuffer, sizeof(linebuffer), scanner_record))
1365 {
1366 /* try match */
1367 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
1368 malware_name = s;
4e71661f 1369 }
0f0c8159
JH
1370 (void)fclose(scanner_record);
1371 }
1372 else /* no virus found */
1373 malware_name = NULL;
1374 break;
b1f8e4f8 1375 } /* cmdline */
c11d665d 1376#endif
599dcb77 1377
c11d665d 1378#ifndef DISABLE_MAL_SOPHIE
b1f8e4f8
JH
1379 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1380 {
0f0c8159
JH
1381 int bread = 0;
1382 uschar *p;
1383 uschar * file_name;
1384 uschar av_buffer[1024];
b1f8e4f8 1385
0f0c8159
JH
1386 /* pass the scan directory to sophie */
1387 file_name = string_copy(eml_filename);
1388 if ((p = Ustrrchr(file_name, '/')))
1389 *p = '\0';
b1f8e4f8 1390
e1d04f48 1391 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
0f0c8159 1392 scanner_name, scanner_options);
b1f8e4f8 1393
0f0c8159
JH
1394 if ( write(sock, file_name, Ustrlen(file_name)) < 0
1395 || write(sock, "\n", 1) != 1
1396 )
ad93c40f 1397 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1398 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
1399 sock);
b1f8e4f8 1400
0f0c8159
JH
1401 /* wait for result */
1402 memset(av_buffer, 0, sizeof(av_buffer));
1403 if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
ad93c40f 1404 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1405 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
1406 sock);
1407
1408 /* infected ? */
1409 if (av_buffer[0] == '1') {
1410 uschar * s = Ustrchr(av_buffer, '\n');
1411 if (s)
1412 *s = '\0';
1413 malware_name = string_copy(&av_buffer[2]);
1414 }
1415 else if (!strncmp(CS av_buffer, "-1", 2))
ad93c40f 1416 return m_panic_defer_3(scanent, CUS callout_address,
0ea02355 1417 US"scanner reported error", sock);
0f0c8159
JH
1418 else /* all ok, no virus */
1419 malware_name = NULL;
599dcb77 1420
0f0c8159 1421 break;
8544e77a 1422 }
c11d665d 1423#endif
8e669ac1 1424
c11d665d 1425#ifndef DISABLE_MAL_CLAM
b1f8e4f8
JH
1426 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1427 {
0f0c8159
JH
1428/* This code was originally contributed by David Saez */
1429/* There are three scanning methods available to us:
1430* (1) Use the SCAN command, pointing to a file in the filesystem
1431* (2) Use the STREAM command, send the data on a separate port
1432* (3) Use the zINSTREAM command, send the data inline
1433* The zINSTREAM command was introduced with ClamAV 0.95, which marked
1434* STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1435* In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
e5ba8aa7 1436* the TCP-connected daemon is actually local; otherwise we use zINSTREAM
0f0c8159
JH
1437* See Exim bug 926 for details. */
1438
80591636 1439 uschar *p, *vname, *result_tag;
0f0c8159 1440 int bread=0;
0f0c8159
JH
1441 uschar av_buffer[1024];
1442 uschar *hostname = US"";
1443 host_item connhost;
1444 uschar *clamav_fbuf;
1445 int clam_fd, result;
1446 off_t fsize;
1447 unsigned int fsize_uint;
1448 BOOL use_scan_command = FALSE;
8a512ed5 1449 clamd_address * cv[MAX_CLAMD_SERVERS];
0f0c8159 1450 int num_servers = 0;
0f0c8159 1451 uint32_t send_size, send_final_zeroblock;
4a5cbaff 1452 blob cmd_str;
0f0c8159 1453
8a512ed5
JH
1454 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1455 there's no reason we should not mix local and remote servers */
1456
0f0c8159 1457 if (*scanner_options == '/')
8a512ed5
JH
1458 {
1459 clamd_address * cd;
1460 const uschar * sublist;
1461 int subsep = ' ';
1462
0f0c8159
JH
1463 /* Local file; so we def want to use_scan_command and don't want to try
1464 * passing IP/port combinations */
1465 use_scan_command = TRUE;
8a512ed5
JH
1466 cd = (clamd_address *) store_get(sizeof(clamd_address));
1467
1468 /* extract socket-path part */
1469 sublist = scanner_options;
1470 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1471
1472 /* parse options */
1473 if (clamd_option(cd, sublist, &subsep) != OK)
ad93c40f 1474 return m_panic_defer(scanent, NULL,
8a512ed5
JH
1475 string_sprintf("bad option '%s'", scanner_options));
1476 cv[0] = cd;
1477 }
0f0c8159
JH
1478 else
1479 {
0f0c8159
JH
1480 /* Go through the rest of the list of host/port and construct an array
1481 * of servers to try. The first one is the bit we just passed from
1482 * scanner_options so process that first and then scan the remainder of
1483 * the address buffer */
1484 do
4e71661f 1485 {
8a512ed5
JH
1486 clamd_address * cd;
1487 const uschar * sublist;
1488 int subsep = ' ';
1489 uschar * s;
b1f8e4f8 1490
0f0c8159
JH
1491 /* The 'local' option means use the SCAN command over the network
1492 * socket (ie common file storage in use) */
8a512ed5
JH
1493 /*XXX we could accept this also as a local option? */
1494 if (strcmpic(scanner_options, US"local") == 0)
0f0c8159
JH
1495 {
1496 use_scan_command = TRUE;
1497 continue;
1498 }
b1f8e4f8 1499
8a512ed5 1500 cd = (clamd_address *) store_get(sizeof(clamd_address));
b1f8e4f8 1501
0f0c8159 1502 /* extract host and port part */
8a512ed5
JH
1503 sublist = scanner_options;
1504 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1505 {
ad93c40f 1506 (void) m_panic_defer(scanent, NULL,
8a512ed5
JH
1507 string_sprintf("missing address: '%s'", scanner_options));
1508 continue;
1509 }
1510 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
0f0c8159 1511 {
ad93c40f 1512 (void) m_panic_defer(scanent, NULL,
8a512ed5
JH
1513 string_sprintf("missing port: '%s'", scanner_options));
1514 continue;
1515 }
93a6fce2 1516 cd->tcp_port = atoi(CS s);
8a512ed5
JH
1517
1518 /* parse options */
1519 /*XXX should these options be common over scanner types? */
1520 if (clamd_option(cd, sublist, &subsep) != OK)
ad93c40f 1521 return m_panic_defer(scanent, NULL,
8a512ed5 1522 string_sprintf("bad option '%s'", scanner_options));
b1f8e4f8 1523
8a512ed5 1524 cv[num_servers++] = cd;
0f0c8159
JH
1525 if (num_servers >= MAX_CLAMD_SERVERS)
1526 {
ad93c40f 1527 (void) m_panic_defer(scanent, NULL,
0f0c8159
JH
1528 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1529 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1530 break;
1531 }
8a512ed5
JH
1532 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1533 NULL, 0)));
8e669ac1 1534
0f0c8159
JH
1535 /* check if we have at least one server */
1536 if (!num_servers)
ad93c40f 1537 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1538 US"no useable server addresses in malware configuration option.");
1539 }
b1f8e4f8 1540
0f0c8159
JH
1541 /* See the discussion of response formats below to see why we really
1542 don't like colons in filenames when passing filenames to ClamAV. */
1543 if (use_scan_command && Ustrchr(eml_filename, ':'))
ad93c40f 1544 return m_panic_defer(scanent, NULL,
0f0c8159
JH
1545 string_sprintf("local/SCAN mode incompatible with" \
1546 " : in path to email filename [%s]", eml_filename));
b1f8e4f8 1547
4a5cbaff
JH
1548 /* Set up the very first data we will be sending */
1549 if (!use_scan_command)
4a5cbaff 1550 { cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
4a5cbaff
JH
1551 else
1552 {
1553 cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
1554 cmd_str.len = Ustrlen(cmd_str.data);
1555 }
1556
0f0c8159
JH
1557 /* We have some network servers specified */
1558 if (num_servers)
1559 {
1560 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1561 * only supports AF_INET, but we should probably be looking to the
1562 * future and rewriting this to be protocol-independent anyway. */
b1f8e4f8 1563
0f0c8159
JH
1564 while (num_servers > 0)
1565 {
4a5cbaff 1566 int i = random_number(num_servers);
8a512ed5 1567 clamd_address * cd = cv[i];
b1f8e4f8 1568
e1d04f48 1569 DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
8a512ed5 1570 cd->hostspec, cd->tcp_port);
0f0c8159
JH
1571
1572 /* Lookup the host. This is to ensure that we connect to the same IP
1573 * on both connections (as one host could resolve to multiple ips) */
8a512ed5 1574 for (;;)
0f0c8159 1575 {
4a5cbaff
JH
1576 if ((sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
1577 &connhost, &errstr, &cmd_str)) >= 0)
8a512ed5
JH
1578 {
1579 /* Connection successfully established with a server */
1580 hostname = cd->hostspec;
4a5cbaff 1581 cmd_str.len = 0;
8a512ed5
JH
1582 break;
1583 }
1584 if (cd->retry <= 0) break;
1585 while (cd->retry > 0) cd->retry = sleep(cd->retry);
4e71661f 1586 }
8a512ed5
JH
1587 if (sock >= 0)
1588 break;
b1f8e4f8 1589
ad93c40f 1590 (void) m_panic_defer(scanent, CUS callout_address, errstr);
0f0c8159
JH
1591
1592 /* Remove the server from the list. XXX We should free the memory */
1593 num_servers--;
8a512ed5
JH
1594 for (; i < num_servers; i++)
1595 cv[i] = cv[i+1];
4e71661f 1596 }
8e669ac1 1597
0f0c8159 1598 if (num_servers == 0)
ad93c40f 1599 return m_panic_defer(scanent, NULL, US"all servers failed");
0f0c8159
JH
1600 }
1601 else
8a512ed5
JH
1602 for (;;)
1603 {
1604 if ((sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
1605 {
1606 hostname = cv[0]->hostspec;
1607 break;
1608 }
1609 if (cv[0]->retry <= 0)
ad93c40f 1610 return m_panic_defer(scanent, CUS callout_address, errstr);
8a512ed5
JH
1611 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1612 }
b1f8e4f8 1613
0f0c8159
JH
1614 /* have socket in variable "sock"; command to use is semi-independent of
1615 * the socket protocol. We use SCAN if is local (either Unix/local
1616 * domain socket, or explicitly told local) else we stream the data.
1617 * How we stream the data depends upon how we were built. */
1618
1619 if (!use_scan_command)
1620 {
0f0c8159
JH
1621 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1622 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1623 chunk. */
b1f8e4f8 1624
e1d04f48 1625 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
1626 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1627 scanner_name);
b1f8e4f8 1628
4a5cbaff
JH
1629 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1630 if (cmd_str.len)
1631 if (send(sock, cmd_str.data, cmd_str.len, 0) < 0)
ad93c40f 1632 return m_panic_defer_3(scanent, CUS hostname,
4a5cbaff
JH
1633 string_sprintf("unable to send zINSTREAM to socket (%s)",
1634 strerror(errno)),
1635 sock);
b1f8e4f8 1636
0f0c8159
JH
1637 /* calc file size */
1638 if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0)
1639 {
1640 int err = errno;
ad93c40f 1641 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1642 string_sprintf("can't open spool file %s: %s",
1643 eml_filename, strerror(err)),
1644 sock);
1645 }
1646 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1647 {
d315eda1
JH
1648 int err;
1649b_seek: err = errno;
e5ba8aa7 1650 (void)close(clam_fd);
ad93c40f 1651 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1652 string_sprintf("can't seek spool file %s: %s",
1653 eml_filename, strerror(err)),
1654 sock);
1655 }
1656 fsize_uint = (unsigned int) fsize;
1657 if ((off_t)fsize_uint != fsize)
1658 {
e5ba8aa7 1659 (void)close(clam_fd);
ad93c40f 1660 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1661 string_sprintf("seeking spool file %s, size overflow",
1662 eml_filename),
1663 sock);
1664 }
d315eda1
JH
1665 if (lseek(clam_fd, 0, SEEK_SET) < 0)
1666 goto b_seek;
b1f8e4f8 1667
40c90bca 1668 if (!(clamav_fbuf = US malloc(fsize_uint)))
0f0c8159 1669 {
e5ba8aa7 1670 (void)close(clam_fd);
ad93c40f 1671 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1672 string_sprintf("unable to allocate memory %u for file (%s)",
1673 fsize_uint, eml_filename),
1674 sock);
1675 }
b1f8e4f8 1676
0f0c8159
JH
1677 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1678 {
1679 int err = errno;
e5ba8aa7 1680 free(clamav_fbuf); (void)close(clam_fd);
ad93c40f 1681 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1682 string_sprintf("can't read spool file %s: %s",
1683 eml_filename, strerror(err)),
1684 sock);
1685 }
1686 (void)close(clam_fd);
b1f8e4f8 1687
0f0c8159 1688 /* send file body to socket */
0f0c8159
JH
1689 send_size = htonl(fsize_uint);
1690 send_final_zeroblock = 0;
1691 if ((send(sock, &send_size, sizeof(send_size), 0) < 0) ||
1692 (send(sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1693 (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
1694 {
b1f8e4f8 1695 free(clamav_fbuf);
ad93c40f 1696 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1697 string_sprintf("unable to send file body to socket (%s)", hostname),
1698 sock);
4e71661f 1699 }
b1f8e4f8 1700
0f0c8159 1701 free(clamav_fbuf);
0f0c8159
JH
1702 }
1703 else
1704 { /* use scan command */
1705 /* Send a SCAN command pointing to a filename; then in the then in the
1706 * scan-method-neutral part, read the response back */
1707
1708/* ================================================================= */
1709
1710 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1711 which dates to when ClamAV needed us to break apart the email into the
1712 MIME parts (eg, with the now deprecated demime condition coming first).
1713 Some time back, ClamAV gained the ability to deconstruct the emails, so
1714 doing this would actually have resulted in the mail attachments being
1715 scanned twice, in the broken out files and from the original .eml.
1716 Since ClamAV now handles emails (and has for quite some time) we can
1717 just use the email file itself. */
4a5cbaff 1718 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
0f0c8159 1719
e1d04f48 1720 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
1721 "Malware scan: issuing %s local-path scan [%s]\n",
1722 scanner_name, scanner_options);
b1f8e4f8 1723
4a5cbaff
JH
1724 if (cmd_str.len)
1725 if (send(sock, cmd_str.data, cmd_str.len, 0) < 0)
ad93c40f 1726 return m_panic_defer_3(scanent, CUS callout_address,
4a5cbaff
JH
1727 string_sprintf("unable to write to socket (%s)", strerror(errno)),
1728 sock);
b1f8e4f8 1729
0f0c8159
JH
1730 /* Do not shut down the socket for writing; a user report noted that
1731 * clamd 0.70 does not react well to this. */
1732 }
1733 /* Commands have been sent, no matter which scan method or connection
1734 * type we're using; now just read the result, independent of method. */
1735
1736 /* Read the result */
1737 memset(av_buffer, 0, sizeof(av_buffer));
1738 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1739 (void)close(sock);
1740 sock = -1;
1741
1742 if (bread <= 0)
ad93c40f 1743 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1744 string_sprintf("unable to read from socket (%s)",
1745 errno == 0 ? "EOF" : strerror(errno)));
1746
1747 if (bread == sizeof(av_buffer))
ad93c40f 1748 return m_panic_defer(scanent, CUS callout_address,
0ea02355 1749 US"buffer too small");
0f0c8159
JH
1750 /* We're now assured of a NULL at the end of av_buffer */
1751
1752 /* Check the result. ClamAV returns one of two result formats.
1753 In the basic mode, the response is of the form:
1754 infected: -> "<filename>: <virusname> FOUND"
1755 not-infected: -> "<filename>: OK"
1756 error: -> "<filename>: <errcode> ERROR
1757 If the ExtendedDetectionInfo option has been turned on, then we get:
1758 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1759 for the infected case. Compare:
1760/tmp/eicar.com: Eicar-Test-Signature FOUND
1761/tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1762
1763 In the streaming case, clamd uses the filename "stream" which you should
1764 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1765 client app will replace "stream" with the original filename before returning
1766 results to stdout, but the trace shows the data).
1767
1768 We will assume that the pathname passed to clamd from Exim does not contain
1769 a colon. We will have whined loudly above if the eml_filename does (and we're
1770 passing a filename to clamd). */
1771
1772 if (!(*av_buffer))
ad93c40f 1773 return m_panic_defer(scanent, CUS callout_address,
0ea02355 1774 US"ClamAV returned null");
0f0c8159
JH
1775
1776 /* strip newline at the end (won't be present for zINSTREAM)
1777 (also any trailing whitespace, which shouldn't exist, but we depend upon
1778 this below, so double-check) */
1779 p = av_buffer + Ustrlen(av_buffer) - 1;
1780 if (*p == '\n') *p = '\0';
1781
e1d04f48 1782 DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
0f0c8159
JH
1783
1784 while (isspace(*--p) && (p > av_buffer))
1785 *p = '\0';
1786 if (*p) ++p;
0f0c8159
JH
1787
1788 /* colon in returned output? */
80591636 1789 if(!(p = Ustrchr(av_buffer,':')))
ad93c40f 1790 return m_panic_defer(scanent, CUS callout_address, string_sprintf(
0f0c8159
JH
1791 "ClamAV returned malformed result (missing colon): %s",
1792 av_buffer));
1793
1794 /* strip filename */
1795 while (*p && isspace(*++p)) /**/;
1796 vname = p;
1797
1798 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1799 but we should at least be resistant to it. */
1800 p = Ustrrchr(vname, ' ');
1801 result_tag = p ? p+1 : vname;
1802
1803 if (Ustrcmp(result_tag, "FOUND") == 0)
1804 {
1805 /* p should still be the whitespace before the result_tag */
1806 while (isspace(*p)) --p;
1807 *++p = '\0';
1808 /* Strip off the extended information too, which will be in parens
1809 after the virus name, with no intervening whitespace. */
1810 if (*--p == ')')
4e71661f 1811 {
0f0c8159
JH
1812 /* "(hash:size)", so previous '(' will do; if not found, we have
1813 a curious virus name, but not an error. */
1814 p = Ustrrchr(vname, '(');
1815 if (p)
1816 *p = '\0';
4e71661f 1817 }
0f0c8159 1818 malware_name = string_copy(vname);
e1d04f48 1819 DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
b1f8e4f8 1820
0f0c8159
JH
1821 }
1822 else if (Ustrcmp(result_tag, "ERROR") == 0)
ad93c40f 1823 return m_panic_defer(scanent, CUS callout_address,
0f0c8159 1824 string_sprintf("ClamAV returned: %s", av_buffer));
b1f8e4f8 1825
0f0c8159
JH
1826 else if (Ustrcmp(result_tag, "OK") == 0)
1827 {
1828 /* Everything should be OK */
1829 malware_name = NULL;
e1d04f48 1830 DEBUG(D_acl) debug_printf_indent("Malware not found\n");
b1f8e4f8 1831
0f0c8159
JH
1832 }
1833 else
ad93c40f 1834 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1835 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1836
1837 break;
b1f8e4f8 1838 } /* clamd */
c11d665d 1839#endif
b1f8e4f8 1840
c11d665d 1841#ifndef DISABLE_MAL_SOCK
b1f8e4f8 1842 case M_SOCK: /* "sock" scanner type ------------------------------------- */
0f0c8159
JH
1843 /* This code was derived by Martin Poole from the clamd code contributed
1844 by David Saez and the cmdline code
1845 */
b1f8e4f8 1846 {
0f0c8159
JH
1847 int bread;
1848 uschar * commandline;
1849 uschar av_buffer[1024];
1850 uschar * linebuffer;
1851 uschar * sockline_scanner;
1852 uschar sockline_scanner_default[] = "%s\n";
1853 const pcre *sockline_trig_re;
1854 const pcre *sockline_name_re;
1855
1856 /* find scanner command line */
ac4d558b
JH
1857 if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1858 NULL, 0))
1859 && *sockline_scanner
1860 )
0f0c8159
JH
1861 { /* check for no expansions apart from one %s */
1862 uschar * s = Ustrchr(sockline_scanner, '%');
1863 if (s++)
1864 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
ad93c40f 1865 return m_panic_defer_3(scanent, NULL,
0f0c8159
JH
1866 US"unsafe sock scanner call spec", sock);
1867 }
1868 else
1869 sockline_scanner = sockline_scanner_default;
ac4d558b
JH
1870 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1871 string_printing(sockline_scanner));
b1f8e4f8 1872
0f0c8159
JH
1873 /* find scanner output trigger */
1874 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1875 "missing trigger specification", &errstr);
1876 if (!sockline_trig_re)
ad93c40f 1877 return m_panic_defer_3(scanent, NULL, errstr, sock);
b1f8e4f8 1878
0f0c8159
JH
1879 /* find virus name regex */
1880 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1881 "missing virus name regex specification", &errstr);
1882 if (!sockline_name_re)
ad93c40f 1883 return m_panic_defer_3(scanent, NULL, errstr, sock);
b1f8e4f8 1884
0f0c8159 1885 /* prepare scanner call - security depends on expansions check above */
040721f2 1886 commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
ac4d558b
JH
1887 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1888 string_printing(commandline));
b1f8e4f8 1889
0f0c8159
JH
1890 /* Pass the command string to the socket */
1891 if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
ad93c40f 1892 return m_panic_defer(scanent, CUS callout_address, errstr);
b1f8e4f8 1893
0f0c8159
JH
1894 /* Read the result */
1895 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
b1f8e4f8 1896
0f0c8159 1897 if (bread <= 0)
ad93c40f 1898 return m_panic_defer_3(scanent, CUS callout_address,
0f0c8159
JH
1899 string_sprintf("unable to read from socket (%s)", strerror(errno)),
1900 sock);
b1f8e4f8 1901
0f0c8159 1902 if (bread == sizeof(av_buffer))
ad93c40f 1903 return m_panic_defer_3(scanent, CUS callout_address,
0ea02355 1904 US"buffer too small", sock);
0f0c8159
JH
1905 av_buffer[bread] = '\0';
1906 linebuffer = string_copy(av_buffer);
ac4d558b
JH
1907 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1908 string_printing(linebuffer));
b1f8e4f8 1909
0f0c8159
JH
1910 /* try trigger match */
1911 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1912 {
1913 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1914 malware_name = US "unknown";
ac4d558b
JH
1915 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1916 string_printing(malware_name));
b1f8e4f8 1917 }
0f0c8159
JH
1918 else /* no virus found */
1919 malware_name = NULL;
1920 break;
8523533c 1921 }
c11d665d 1922#endif
8e669ac1 1923
c11d665d 1924#ifndef DISABLE_MAL_MKS
b1f8e4f8
JH
1925 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1926 {
0f0c8159
JH
1927 char *mksd_options_end;
1928 int mksd_maxproc = 1; /* default, if no option supplied */
1929 int retval;
b1f8e4f8 1930
0f0c8159
JH
1931 if (scanner_options)
1932 {
1933 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1934 if ( *scanner_options == '\0'
1935 || *mksd_options_end != '\0'
1936 || mksd_maxproc < 1
1937 || mksd_maxproc > 32
1938 )
ad93c40f 1939 return m_panic_defer(scanent, CUS callout_address,
0f0c8159
JH
1940 string_sprintf("invalid option '%s'", scanner_options));
1941 }
8e669ac1 1942
3e60dd41 1943 if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
ad93c40f 1944 return m_panic_defer(scanent, CUS callout_address, errstr);
8e669ac1 1945
0f0c8159 1946 malware_name = NULL;
94a18f28 1947
e1d04f48 1948 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
94a18f28 1949
0f0c8159
JH
1950 if ((retval = mksd_scan_packed(scanent, sock, eml_filename, tmo)) != OK)
1951 {
1952 close (sock);
1953 return retval;
1954 }
1955 break;
8523533c 1956 }
c11d665d 1957#endif
0f0c8159 1958
c11d665d 1959#ifndef DISABLE_MAL_AVAST
b6fbf22d
JH
1960 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1961 {
b6fbf22d
JH
1962 uschar buf[1024];
1963 uschar * scanrequest;
b6fbf22d 1964 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
0f0c8159 1965 int nread;
ad93c40f 1966 uschar * error_message = NULL;
4fe93c4b
HSHR
1967 BOOL more_data = FALSE;
1968 BOOL strict = TRUE;
b6fbf22d
JH
1969
1970 /* According to Martin Tuma @avast the protocol uses "escaped
1971 whitespace", that is, every embedded whitespace is backslash
1972 escaped, as well as backslash is protected by backslash.
1973 The returned lines contain the name of the scanned file, a tab
1974 and the [ ] marker.
1975 [+] - not infected
1976 [L] - infected
1977 [E] - some error occured
71bb51e0
HSHR
1978 Such marker follows the first non-escaped TAB. For more information
1979 see avast-protocol(5)
ad93c40f
HSHR
1980
1981 We observed two cases:
1982 -> SCAN /file
1983 <- /file [E]0.0 Error 13 Permission denied
1984 <- 451 SCAN Engine error 13 permission denied
1985
1986 -> SCAN /file
1987 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1988 <- /file… [+]2.0
1989 <- /file… [+]2.0 0 Eicar Test Virus!!!
1990 <- 200 SCAN OK
1991
1992 If the scanner returns 4xx, DEFER is a good decision, combined
1993 with a panic log entry, to get the admin's attention.
1994
1995 If the scanner returns 200, we reject it as malware, if found any,
1996 or, in case of an error, we set the malware message to the error
1997 string.
1998
1999 Some of the >= 42000 errors are message related - usually some
2000 broken archives etc, but some of them are e.g. license related.
2001 Once the license expires the engine starts returning errors for
2002 every scanning attempt. I¹ have the full list of the error codes
2003 but it is not a public API and is subject to change. It is hard
2004 for me to say what you should do in case of an engine error. You
2005 can have a “Treat * unscanned file as infection” policy or “Treat
2006 unscanned file as clean” policy. ¹) Jakub Bednar
2007
2008 */
2009
476be7e2
JH
2010 if ( ( !ava_re_clean
2011 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
2012 || ( !ava_re_virus
2013 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
ad93c40f
HSHR
2014 || ( !ava_re_error
2015 && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
b6fbf22d 2016 )
ad93c40f 2017 return malware_panic_defer(errstr);
b6fbf22d
JH
2018
2019 /* wait for result */
0f0c8159
JH
2020 for (avast_stage = AVA_HELO;
2021 (nread = recv_line(sock, buf, sizeof(buf), tmo)) > 0;
2022 )
b6fbf22d
JH
2023 {
2024 int slen = Ustrlen(buf);
94431adb 2025 if (slen >= 1)
b6fbf22d 2026 {
71bb51e0
HSHR
2027
2028 /* Multi line responses are bracketed between 210 … and nnn … */
2029 if (Ustrncmp(buf, "210", 3) == 0)
2030 {
2031 more_data = 1;
2032 continue;
2033 }
2034 else if (more_data && isdigit(buf[0])) more_data = 0;
2035
b6fbf22d
JH
2036 switch (avast_stage)
2037 {
2038 case AVA_HELO:
71bb51e0 2039 if (more_data) continue;
b6fbf22d
JH
2040 if (Ustrncmp(buf, "220", 3) != 0)
2041 goto endloop; /* require a 220 */
2042 goto sendreq;
2043
2044 case AVA_OPT:
71bb51e0 2045 if (more_data) continue;
b6fbf22d
JH
2046 if (Ustrncmp(buf, "200", 3) != 0)
2047 goto endloop; /* require a 200 */
2048
2049 sendreq:
2050 {
2051 int len;
2052 /* Check for another option to send. Newline-terminate it. */
2053 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
2054 NULL, 0)))
2055 {
eb445b04
HSHR
2056 if (Ustrcmp(scanrequest, "pass_unscanned") == 0)
2057 {
2058 DEBUG(D_acl) debug_printf_indent("pass unscanned files as clean\n");
2059 strict = FALSE;
2060 goto sendreq;
2061 }
b6fbf22d
JH
2062 scanrequest = string_sprintf("%s\n", scanrequest);
2063 avast_stage = AVA_OPT; /* just sent option */
71bb51e0 2064 DEBUG(D_acl) debug_printf_indent("send to avast OPTION: %s", scanrequest);
b6fbf22d
JH
2065 }
2066 else
2067 {
040721f2 2068 scanrequest = string_sprintf("SCAN %s\n", eml_dir);
b6fbf22d 2069 avast_stage = AVA_RSP; /* just sent command */
71bb51e0 2070 DEBUG(D_acl) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir);
b6fbf22d
JH
2071 }
2072
2073 /* send config-cmd or scan-request to socket */
2074 len = Ustrlen(scanrequest);
ad93c40f 2075 if (send(sock, scanrequest, len, 0) == -1)
b6fbf22d
JH
2076 {
2077 scanrequest[len-1] = '\0';
ad93c40f 2078 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
b6fbf22d
JH
2079 "unable to send request '%s' to socket (%s): %s",
2080 scanrequest, scanner_options, strerror(errno)), sock);
2081 }
2082 break;
2083 }
2084
2085 case AVA_RSP:
71bb51e0 2086
91e974f5 2087 if (isdigit(buf[0])) /* We're done */
71bb51e0 2088 goto endloop;
71bb51e0 2089
91e974f5 2090 if (malware_name) /* Nothing else matters, just read on */
ad93c40f 2091 break;
b6fbf22d 2092
91e974f5 2093 if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
b6fbf22d
JH
2094 break;
2095
4fe93c4b 2096 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
ad93c40f
HSHR
2097 {
2098 unescape(malware_name);
2099 DEBUG(D_acl)
2100 debug_printf_indent("unescaped malware name: '%s'\n", malware_name);
2101 break;
2102 }
2103
91e974f5 2104 if (strict) /* treat scanner errors as malware */
ad93c40f 2105 {
4fe93c4b 2106 if ((malware_name = m_pcre_exec(ava_re_error, buf)))
91e974f5
HSHR
2107 {
2108 unescape(malware_name);
2109 DEBUG(D_acl)
2110 debug_printf_indent("unescaped error message: '%s'\n", malware_name);
2111 break;
2112 }
ad93c40f 2113 }
91e974f5 2114 else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
eb445b04
HSHR
2115 {
2116 log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
2117 break;
2118 }
2119
83d2a861 2120 /* here also for any unexpected response from the scanner */
eb445b04 2121 DEBUG(D_acl) debug_printf("avast response not handled: '%s'\n", buf);
91e974f5 2122
b6fbf22d 2123 goto endloop;
755762fd 2124
83d2a861 2125 default: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
755762fd 2126 __FILE__, __LINE__, __FUNCTION__);
b6fbf22d 2127 }
0f0c8159 2128 }
b6fbf22d 2129 }
91e974f5 2130
b6fbf22d
JH
2131 endloop:
2132
46682a67
JH
2133 if (nread == -1) error_message = US"EOF from scanner";
2134 else if (nread < 0) error_message = US"timeout from scanner";
2135 else if (nread == 0) error_message = US"got nothing from scanner";
91e974f5 2136 else if (buf[0] != '2') error_message = buf;
ad93c40f 2137
91e974f5
HSHR
2138 DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n");
2139 if (send(sock, "QUIT\n", 5, 0) == -1)
2140 return m_panic_defer_3(scanent, CUS callout_address,
2141 string_sprintf("unable to send quit request to socket (%s): %s",
2142 scanner_options, strerror(errno)), sock);
2143
2144 if (error_message)
2145 return m_panic_defer_3(scanent, CUS callout_address, error_message, sock);
ad93c40f 2146
b6fbf22d 2147 }
c11d665d 2148#endif
0f0c8159 2149 } /* scanner type switch */
8523533c 2150
0f0c8159
JH
2151 if (sock >= 0)
2152 (void) close (sock);
2153 malware_ok = TRUE; /* set "been here, done that" marker */
b1f8e4f8 2154 }
8523533c 2155
0f0c8159
JH
2156/* match virus name against pattern (caseless ------->----------v) */
2157if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
2158 {
e1d04f48 2159 DEBUG(D_acl) debug_printf_indent(
0f0c8159
JH
2160 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
2161 return OK;
2162 }
2163else
2164 return FAIL;
8523533c
TK
2165}
2166
2167
0f0c8159
JH
2168/*************************************************
2169* Scan an email for malware *
2170*************************************************/
8523533c 2171
0f0c8159
JH
2172/* This is the normal interface for scanning an email, which doesn't need a
2173filename; it's a wrapper around the malware_file function.
8523533c 2174
0f0c8159
JH
2175Arguments:
2176 malware_re match condition for "malware="
2177 timeout if nonzero, timeout in seconds
2178
2179Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2180 where true means malware was found (condition applies)
2181*/
2182int
2183malware(const uschar * malware_re, int timeout)
8523533c 2184{
040721f2 2185int ret = malware_internal(malware_re, NULL, timeout);
8e669ac1 2186
55240832 2187if (ret == DEFER) av_failed = TRUE;
55240832 2188return ret;
8523533c
TK
2189}
2190
8e669ac1 2191
0f0c8159
JH
2192/*************************************************
2193* Scan a file for malware *
2194*************************************************/
8e669ac1 2195
0f0c8159
JH
2196/* This is a test wrapper for scanning an email, which is not used in
2197normal processing. Scan any file, using the Exim scanning interface.
2198This function tampers with various global variables so is unsafe to use
2199in any other context.
8e669ac1 2200
0f0c8159
JH
2201Arguments:
2202 eml_filename a file holding the message to be scanned
8523533c 2203
0f0c8159
JH
2204Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2205 where true means malware was found (condition applies)
2206*/
2207int
2208malware_in_file(uschar *eml_filename)
8523533c 2209{
55240832
JH
2210uschar message_id_buf[64];
2211int ret;
2212
2213/* spool_mbox() assumes various parameters exist, when creating
2214the relevant directory and the email within */
2215
2216(void) string_format(message_id_buf, sizeof(message_id_buf),
2217 "dummy-%d", vaguely_random_number(INT_MAX));
2218message_id = message_id_buf;
2219sender_address = US"malware-sender@example.net";
2220return_path = US"";
2221recipients_list = NULL;
2222receive_add_recipient(US"malware-victim@example.net", -1);
2223enable_dollar_recipients = TRUE;
2224
040721f2 2225ret = malware_internal(US"*", eml_filename, 0);
55240832
JH
2226
2227Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
2228spool_mbox_ok = 1;
2229
2230/* don't set no_mbox_unspool; at present, there's no way for it to become
2231set, but if that changes, then it should apply to these tests too */
2232
2233unspool_mbox();
2234
2235/* silence static analysis tools */
2236message_id = NULL;
2237
2238return ret;
8523533c
TK
2239}
2240
476be7e2
JH
2241
2242void
2243malware_init(void)
2244{
2245if (!malware_default_re)
2246 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
c11d665d
JH
2247
2248#ifndef DISABLE_MAL_DRWEB
476be7e2
JH
2249if (!drweb_re)
2250 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
c11d665d
JH
2251#endif
2252#ifndef DISABLE_MAL_FSECURE
476be7e2
JH
2253if (!fsec_re)
2254 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
c11d665d
JH
2255#endif
2256#ifndef DISABLE_MAL_KAV
476be7e2
JH
2257if (!kav_re_sus)
2258 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2259if (!kav_re_inf)
2260 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
c11d665d 2261#endif
fd5a6ffb 2262#ifndef DISABLE_MAL_AVAST
476be7e2
JH
2263if (!ava_re_clean)
2264 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2265if (!ava_re_virus)
2266 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
ad93c40f
HSHR
2267if (!ava_re_error)
2268 ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
c11d665d 2269#endif
fd5a6ffb 2270#ifndef DISABLE_MAL_FFROT6D
71b32d41
ACK
2271if (!fprot6d_re_error)
2272 fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
2273if (!fprot6d_re_virus)
2274 fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
c11d665d
JH
2275#endif
2276}
2277
2278
2279void
2280malware_show_supported(FILE * f)
2281{
2282struct scan * sc;
2283fprintf(f, "Malware:");
2284for (sc = m_scans; sc->scancode != -1; sc++) fprintf(f, " %s", sc->name);
2285fprintf(f, "\n");
476be7e2
JH
2286}
2287
c11d665d
JH
2288
2289# endif /*!MACRO_PREDEF*/
b1f8e4f8
JH
2290#endif /*WITH_CONTENT_SCAN*/
2291/*
2292 * vi: aw ai sw=2
2293 */