projects / exim.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
constification
[exim.git] / src / src / malware.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
6 * License: GPL
7 * Copyright (c) The Exim Maintainers 2015 - 2018
8 */
9
10 /* Code for calling virus (malware) scanners. Called from acl.c. */
11
12 #include "exim.h"
13 #ifdef WITH_CONTENT_SCAN /* entire file */
14
15 typedef enum {
16 #ifndef DISABLE_MAL_FFROTD
17 M_FPROTD,
18 #endif
19 #ifndef DISABLE_MAL_FFROT6D
20 M_FPROT6D,
21 #endif
22 #ifndef DISABLE_MAL_DRWEB
23 M_DRWEB,
24 #endif
25 #ifndef DISABLE_MAL_AVE
26 M_AVES,
27 #endif
28 #ifndef DISABLE_MAL_FSECURE
29 M_FSEC,
30 #endif
31 #ifndef DISABLE_MAL_KAV
32 M_KAVD,
33 #endif
34 #ifndef DISABLE_MAL_SOPHIE
35 M_SOPHIE,
36 #endif
37 #ifndef DISABLE_MAL_CLAM
38 M_CLAMD,
39 #endif
40 #ifndef DISABLE_MAL_MKS
41 M_MKSD,
42 #endif
43 #ifndef DISABLE_MAL_AVAST
44 M_AVAST,
45 #endif
46 #ifndef DISABLE_MAL_SOCK
47 M_SOCK,
48 #endif
49 #ifndef DISABLE_MAL_CMDLINE
50 M_CMDL,
51 #endif
52 M_DUMMY
53 } scanner_t;
54 typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
55 static struct scan
56 {
57 scanner_t scancode;
58 const uschar * name;
59 const uschar * options_default;
60 contype_t conn;
61 } m_scans[] =
62 {
63 #ifndef DISABLE_MAL_FFROTD
64 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
65 #endif
66 #ifndef DISABLE_MAL_FFROT6D
67 { M_FPROT6D, US"f-prot6d", US"localhost 10200", MC_TCP },
68 #endif
69 #ifndef DISABLE_MAL_DRWEB
70 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
71 #endif
72 #ifndef DISABLE_MAL_AVE
73 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
74 #endif
75 #ifndef DISABLE_MAL_FSECURE
76 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
77 #endif
78 #ifndef DISABLE_MAL_KAV
79 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
80 #endif
81 #ifndef DISABLE_MAL_SOPHIE
82 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
83 #endif
84 #ifndef DISABLE_MAL_CLAM
85 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
86 #endif
87 #ifndef DISABLE_MAL_MKS
88 { M_MKSD, US"mksd", NULL, MC_NONE },
89 #endif
90 #ifndef DISABLE_MAL_AVAST
91 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
92 #endif
93 #ifndef DISABLE_MAL_SOCK
94 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
95 #endif
96 #ifndef DISABLE_MAL_CMDLINE
97 { M_CMDL, US"cmdline", NULL, MC_NONE },
98 #endif
99 { -1, NULL, NULL, MC_NONE } /* end-marker */
100 };
101
102 /******************************************************************************/
103 # ifdef MACRO_PREDEF /* build solely to predefine macros */
104
105 # include "macro_predef.h"
106
107 void
108 features_malware(void)
109 {
110 const uschar * s;
111 uschar * t;
112 uschar buf[64];
113
114 spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
115
116 for (const struct scan * sc = m_scans; sc->scancode != -1; sc++)
117 {
118 for (s = sc->name, t = buf+14; *s; s++) if (*s != '-')
119 *t++ = toupper(*s);
120 *t = '\0';
121 builtin_macro_create(buf);
122 }
123 }
124
125 /******************************************************************************/
126 # else /*!MACRO_PREDEF, main build*/
127
128
129 #define MALWARE_TIMEOUT 120 /* default timeout, seconds */
130
131 static const uschar * malware_regex_default = US ".+";
132 static const pcre * malware_default_re = NULL;
133
134
135
136 #ifndef DISABLE_MAL_CLAM
137 /* The maximum number of clamd servers that are supported in the configuration */
138 # define MAX_CLAMD_SERVERS 32
139 # define MAX_CLAMD_SERVERS_S "32"
140
141 typedef struct clamd_address {
142 uschar * hostspec;
143 unsigned tcp_port;
144 unsigned retry;
145 } clamd_address;
146 #endif
147
148
149 #ifndef DISABLE_MAL_DRWEB
150 # define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
151 # define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
152 # define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
153
154 # define DERR_READ_ERR (1<<0) /* read error */
155 # define DERR_NOMEMORY (1<<2) /* no memory */
156 # define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
157 # define DERR_BAD_CALL (1<<15) /* wrong command */
158
159 static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
160 static const pcre * drweb_re = NULL;
161 #endif
162
163 #ifndef DISABLE_MAL_FSECURE
164 static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
165 static const pcre * fsec_re = NULL;
166 #endif
167
168 #ifndef DISABLE_MAL_KAV
169 static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
170 static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
171 static const pcre * kav_re_sus = NULL;
172 static const pcre * kav_re_inf = NULL;
173 #endif
174
175 #ifndef DISABLE_MAL_AVAST
176 static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
177 static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
178 static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
179 static const pcre * ava_re_clean = NULL;
180 static const pcre * ava_re_virus = NULL;
181 static const pcre * ava_re_error = NULL;
182 #endif
183
184 #ifndef DISABLE_MAL_FFROT6D
185 static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
186 static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
187 static const pcre * fprot6d_re_error = NULL;
188 static const pcre * fprot6d_re_virus = NULL;
189 #endif
190
191
192
193 /******************************************************************************/
194
195 #ifndef DISABLE_MAL_KAV
196 /* Routine to check whether a system is big- or little-endian.
197 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
198 Needed for proper kavdaemon implementation. Sigh. */
199 # define BIG_MY_ENDIAN 0
200 # define LITTLE_MY_ENDIAN 1
201 static int test_byte_order(void);
202 static inline int
203 test_byte_order()
204 {
205 short int word = 0x0001;
206 char *byte = CS &word;
207 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
208 }
209 #endif
210
211 BOOL malware_ok = FALSE;
212
213 /* Gross hacks for the -bmalware option; perhaps we should just create
214 the scan directory normally for that case, but look into rigging up the
215 needed header variables if not already set on the command-line? */
216 extern int spool_mbox_ok;
217 extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
218
219
220 /* Some (currently avast only) use backslash escaped whitespace,
221 this function undoes these escapes */
222
223 static inline void
224 unescape(uschar *p)
225 {
226 uschar *p0;
227 for (; *p; ++p)
228 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
229 for (p0 = p; *p0; ++p0) *p0 = p0[1];
230 }
231
232 /* --- malware_*_defer --- */
233 static inline int
234 malware_panic_defer(const uschar * str)
235 {
236 log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
237 return DEFER;
238 }
239 static inline int
240 malware_log_defer(const uschar * str)
241 {
242 log_write(0, LOG_MAIN, "malware acl condition: %s", str);
243 return DEFER;
244 }
245 /* --- m_*_defer --- */
246 static inline int
247 m_panic_defer(struct scan * scanent, const uschar * hostport,
248 const uschar * str)
249 {
250 return malware_panic_defer(string_sprintf("%s %s : %s",
251 scanent->name, hostport ? hostport : CUS"", str));
252 }
253 static inline int
254 m_log_defer(struct scan * scanent, const uschar * hostport,
255 const uschar * str)
256 {
257 return malware_log_defer(string_sprintf("%s %s : %s",
258 scanent->name, hostport ? hostport : CUS"", str));
259 }
260 /* --- m_*_defer_3 */
261 static inline int
262 m_panic_defer_3(struct scan * scanent, const uschar * hostport,
263 const uschar * str, int fd_to_close)
264 {
265 (void) close(fd_to_close);
266 return m_panic_defer(scanent, hostport, str);
267 }
268
269 /*************************************************/
270
271 #ifndef DISABLE_MAL_CLAM
272 /* Only used by the Clamav code, which is working from a list of servers and
273 uses the returned in_addr to get a second connection to the same system.
274 */
275 static inline int
276 m_tcpsocket(const uschar * hostname, unsigned int port,
277 host_item * host, uschar ** errstr, const blob * fastopen_blob)
278 {
279 return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
280 host, errstr, fastopen_blob);
281 }
282 #endif
283
284 static int
285 m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
286 {
287 if (send(sock, buf, cnt, 0) < 0)
288 {
289 int err = errno;
290 (void)close(sock);
291 *errstr = string_sprintf("unable to send to socket (%s): %s",
292 buf, strerror(err));
293 return -1;
294 }
295 return sock;
296 }
297
298 static const pcre *
299 m_pcre_compile(const uschar * re, uschar ** errstr)
300 {
301 const uschar * rerror;
302 int roffset;
303 const pcre * cre;
304
305 cre = pcre_compile(CS re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
306 if (!cre)
307 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
308 re, rerror, roffset);
309 return cre;
310 }
311
312 uschar *
313 m_pcre_exec(const pcre * cre, uschar * text)
314 {
315 int ovector[10*3];
316 int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
317 ovector, nelem(ovector));
318 uschar * substr = NULL;
319 if (i >= 2) /* Got it */
320 pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
321 return substr;
322 }
323
324 static const pcre *
325 m_pcre_nextinlist(const uschar ** list, int * sep,
326 char * listerr, uschar ** errstr)
327 {
328 const uschar * list_ele;
329 const pcre * cre = NULL;
330
331 if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
332 *errstr = US listerr;
333 else
334 {
335 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
336 string_printing(list_ele));
337 cre = m_pcre_compile(CUS list_ele, errstr);
338 }
339 return cre;
340 }
341
342 /*
343 Simple though inefficient wrapper for reading a line. Drop CRs and the
344 trailing newline. Can return early on buffer full. Null-terminate.
345 Apply initial timeout if no data ready.
346
347 Return: number of chars - zero for an empty line
348 -1 on EOF
349 -2 on timeout or error
350 */
351 static int
352 recv_line(int fd, uschar * buffer, int bsize, int tmo)
353 {
354 uschar * p = buffer;
355 ssize_t rcv;
356 BOOL ok = FALSE;
357
358 if (!fd_ready(fd, tmo-time(NULL)))
359 return -2;
360
361 /*XXX tmo handling assumes we always get a whole line */
362 /* read until \n */
363 errno = 0;
364 while ((rcv = read(fd, p, 1)) > 0)
365 {
366 ok = TRUE;
367 if (p-buffer > bsize-2) break;
368 if (*p == '\n') break;
369 if (*p != '\r') p++;
370 }
371 if (!ok)
372 {
373 DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
374 rcv==0 ? "EOF" : "error", strerror(errno));
375 return rcv==0 ? -1 : -2;
376 }
377 *p = '\0';
378
379 DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
380 return p - buffer;
381 }
382
383 /* return TRUE iff size as requested */
384 static BOOL
385 recv_len(int sock, void * buf, int size, int tmo)
386 {
387 return fd_ready(sock, tmo-time(NULL))
388 ? recv(sock, buf, size, 0) == size
389 : FALSE;
390 }
391
392
393
394 #ifndef DISABLE_MAL_MKS
395 /* ============= private routines for the "mksd" scanner type ============== */
396
397 # include <sys/uio.h>
398
399 static inline int
400 mksd_writev (int sock, struct iovec * iov, int iovcnt)
401 {
402 int i;
403
404 for (;;)
405 {
406 do
407 i = writev (sock, iov, iovcnt);
408 while (i < 0 && errno == EINTR);
409 if (i <= 0)
410 {
411 (void) malware_panic_defer(
412 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
413 return -1;
414 }
415 for (;;) /* check for short write */
416 if (i >= iov->iov_len)
417 {
418 if (--iovcnt == 0)
419 return 0;
420 i -= iov->iov_len;
421 iov++;
422 }
423 else
424 {
425 iov->iov_len -= i;
426 iov->iov_base = CS iov->iov_base + i;
427 break;
428 }
429 }
430 }
431
432 static inline int
433 mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, int tmo)
434 {
435 client_conn_ctx cctx = {.sock = sock};
436 int offset = 0;
437 int i;
438
439 do
440 {
441 i = ip_recv(&cctx, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL));
442 if (i <= 0)
443 {
444 (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
445 return -1;
446 }
447
448 offset += i;
449 /* offset == av_buffer_size -> buffer full */
450 if (offset == av_buffer_size)
451 {
452 (void) malware_panic_defer(US"malformed reply received from mksd");
453 return -1;
454 }
455 } while (av_buffer[offset-1] != '\n');
456
457 av_buffer[offset] = '\0';
458 return offset;
459 }
460
461 static inline int
462 mksd_parse_line(struct scan * scanent, char * line)
463 {
464 char *p;
465
466 switch (*line)
467 {
468 case 'O': /* OK */
469 return OK;
470
471 case 'E':
472 case 'A': /* ERR */
473 if ((p = strchr (line, '\n')) != NULL)
474 *p = '\0';
475 return m_panic_defer(scanent, NULL,
476 string_sprintf("scanner failed: %s", line));
477
478 default: /* VIR */
479 if ((p = strchr (line, '\n')) != NULL)
480 {
481 *p = '\0';
482 if ( p-line > 5
483 && line[3] == ' '
484 && (p = strchr(line+4, ' ')) != NULL
485 && p-line > 4
486 )
487 {
488 *p = '\0';
489 malware_name = string_copy(US line+4);
490 return OK;
491 }
492 }
493 return m_panic_defer(scanent, NULL,
494 string_sprintf("malformed reply received: %s", line));
495 }
496 }
497
498 static int
499 mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
500 int tmo)
501 {
502 struct iovec iov[3];
503 const char *cmd = "MSQ\n";
504 uschar av_buffer[1024];
505
506 iov[0].iov_base = (void *) cmd;
507 iov[0].iov_len = 3;
508 iov[1].iov_base = (void *) scan_filename;
509 iov[1].iov_len = Ustrlen(scan_filename);
510 iov[2].iov_base = (void *) (cmd + 3);
511 iov[2].iov_len = 1;
512
513 if (mksd_writev (sock, iov, 3) < 0)
514 return DEFER;
515
516 if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
517 return DEFER;
518
519 return mksd_parse_line (scanent, CS av_buffer);
520 }
521 #endif /* MKSD */
522
523
524 #ifndef DISABLE_MAL_CLAM
525 static int
526 clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
527 {
528 uschar * s;
529
530 cd->retry = 0;
531 while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
532 if (Ustrncmp(s, "retry=", 6) == 0)
533 {
534 int sec = readconf_readtime((s += 6), '\0', FALSE);
535 if (sec < 0)
536 return FAIL;
537 cd->retry = sec;
538 }
539 else
540 return FAIL;
541 return OK;
542 }
543 #endif
544
545
546
547 /*************************************************
548 * Scan content for malware *
549 *************************************************/
550
551 /* This is an internal interface for scanning an email; the normal interface
552 is via malware(), or there's malware_in_file() used for testing/debugging.
553
554 Arguments:
555 malware_re match condition for "malware="
556 scan_filename the file holding the email to be scanned, if we're faking
557 this up for the -bmalware test, else NULL
558 timeout if nonzero, non-default timeoutl
559
560 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
561 where true means malware was found (condition applies)
562 */
563 static int
564 malware_internal(const uschar * malware_re, const uschar * scan_filename,
565 int timeout)
566 {
567 int sep = 0;
568 const uschar *av_scanner_work = av_scanner;
569 uschar *scanner_name;
570 unsigned long mbox_size;
571 FILE *mbox_file;
572 const pcre *re;
573 uschar * errstr;
574 struct scan * scanent;
575 const uschar * scanner_options;
576 client_conn_ctx malware_daemon_ctx = {.sock = -1};
577 time_t tmo;
578 uschar * eml_filename, * eml_dir;
579
580 if (!malware_re)
581 return FAIL; /* empty means "don't match anything" */
582
583 /* Ensure the eml mbox file is spooled up */
584
585 if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
586 return malware_panic_defer(US"error while creating mbox spool file");
587
588 /* None of our current scanners need the mbox file as a stream (they use
589 the name), so we can close it right away. Get the directory too. */
590
591 (void) fclose(mbox_file);
592 eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
593
594 /* parse 1st option */
595 if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
596 return FAIL; /* explicitly no matching */
597
598 /* special cases (match anything except empty) */
599 if ( strcmpic(malware_re,US"true") == 0
600 || Ustrcmp(malware_re,"*") == 0
601 || Ustrcmp(malware_re,"1") == 0
602 )
603 {
604 if ( !malware_default_re
605 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
606 return malware_panic_defer(errstr);
607 malware_re = malware_regex_default;
608 re = malware_default_re;
609 }
610
611 /* compile the regex, see if it works */
612 else if (!(re = m_pcre_compile(malware_re, &errstr)))
613 return malware_panic_defer(errstr);
614
615 /* if av_scanner starts with a dollar, expand it first */
616 if (*av_scanner == '$')
617 {
618 if (!(av_scanner_work = expand_string(av_scanner)))
619 return malware_panic_defer(
620 string_sprintf("av_scanner starts with $, but expansion failed: %s",
621 expand_string_message));
622
623 DEBUG(D_acl)
624 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
625 /* disable result caching in this case */
626 malware_name = NULL;
627 malware_ok = FALSE;
628 }
629
630 /* Do not scan twice (unless av_scanner is dynamic). */
631 if (!malware_ok)
632 {
633 /* find the scanner type from the av_scanner option */
634 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
635 return malware_panic_defer(US"av_scanner configuration variable is empty");
636 if (!timeout) timeout = MALWARE_TIMEOUT;
637 tmo = time(NULL) + timeout;
638
639 for (scanent = m_scans; ; scanent++)
640 {
641 if (!scanent->name)
642 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
643 scanner_name));
644 if (strcmpic(scanner_name, US scanent->name) != 0)
645 continue;
646 DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
647 scanner_name, readconf_printtime(timeout));
648
649 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
650 scanner_options = scanent->options_default;
651 if (scanent->conn == MC_NONE)
652 break;
653
654 DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
655 switch(scanent->conn)
656 {
657 case MC_TCP:
658 malware_daemon_ctx.sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
659 case MC_UNIX:
660 malware_daemon_ctx.sock = ip_unixsocket(scanner_options, &errstr); break;
661 case MC_STRM:
662 malware_daemon_ctx.sock = ip_streamsocket(scanner_options, &errstr, 5); break;
663 default:
664 /* compiler quietening */ break;
665 }
666 if (malware_daemon_ctx.sock < 0)
667 return m_panic_defer(scanent, CUS callout_address, errstr);
668 break;
669 }
670
671 switch (scanent->scancode)
672 {
673 #ifndef DISABLE_MAL_FFROTD
674 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
675 {
676 uschar *fp_scan_option;
677 unsigned int detected=0, par_count=0;
678 uschar * scanrequest;
679 uschar buf[32768], *strhelper, *strhelper2;
680 uschar * malware_name_internal = NULL;
681 int len;
682
683 scanrequest = string_sprintf("GET %s", eml_filename);
684
685 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
686 NULL, 0)))
687 {
688 scanrequest = string_sprintf("%s%s%s", scanrequest,
689 par_count ? "%20" : "?", fp_scan_option);
690 par_count++;
691 }
692 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
693 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
694 scanner_name, scanrequest);
695
696 /* send scan request */
697 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
698 return m_panic_defer(scanent, CUS callout_address, errstr);
699
700 while ((len = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) >= 0)
701 if (len > 0)
702 {
703 if (Ustrstr(buf, US"<detected type=\"") != NULL)
704 detected = 1;
705 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
706 {
707 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
708 {
709 *strhelper2 = '\0';
710 malware_name_internal = string_copy(strhelper+6);
711 }
712 }
713 else if (Ustrstr(buf, US"<summary code=\""))
714 {
715 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
716 ? malware_name_internal : NULL;
717 break;
718 }
719 }
720 if (len < -1)
721 {
722 (void)close(malware_daemon_ctx.sock);
723 return DEFER;
724 }
725 break;
726 } /* f-protd */
727 #endif
728
729 #ifndef DISABLE_MAL_FFROT6D
730 case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
731 {
732 int bread;
733 uschar * e;
734 uschar * linebuffer;
735 uschar * scanrequest;
736 uschar av_buffer[1024];
737
738 if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
739 || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
740 return malware_panic_defer(errstr);
741
742 scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
743 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
744 scanner_name, scanrequest);
745
746 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
747 return m_panic_defer(scanent, CUS callout_address, errstr);
748
749 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
750
751 if (bread <= 0)
752 return m_panic_defer_3(scanent, CUS callout_address,
753 string_sprintf("unable to read from socket (%s)", strerror(errno)),
754 malware_daemon_ctx.sock);
755
756 if (bread == sizeof(av_buffer))
757 return m_panic_defer_3(scanent, CUS callout_address,
758 US"buffer too small", malware_daemon_ctx.sock);
759
760 av_buffer[bread] = '\0';
761 linebuffer = string_copy(av_buffer);
762
763 m_sock_send(malware_daemon_ctx.sock, US"QUIT\n", 5, 0);
764
765 if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
766 return m_panic_defer_3(scanent, CUS callout_address,
767 string_sprintf("scanner reported error (%s)", e), malware_daemon_ctx.sock);
768
769 if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
770 malware_name = NULL;
771
772 break;
773 } /* f-prot6d */
774 #endif
775
776 #ifndef DISABLE_MAL_DRWEB
777 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
778 /* v0.1 - added support for tcp sockets */
779 /* v0.0 - initial release -- support for unix sockets */
780 {
781 int result;
782 off_t fsize;
783 unsigned int fsize_uint;
784 uschar * tmpbuf, *drweb_fbuf;
785 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
786 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
787
788 /* prepare variables */
789 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
790 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
791
792 if (*scanner_options != '/')
793 {
794 /* calc file size */
795 if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
796 return m_panic_defer_3(scanent, NULL,
797 string_sprintf("can't open spool file %s: %s",
798 eml_filename, strerror(errno)),
799 malware_daemon_ctx.sock);
800
801 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
802 {
803 int err;
804 badseek: err = errno;
805 (void)close(drweb_fd);
806 return m_panic_defer_3(scanent, NULL,
807 string_sprintf("can't seek spool file %s: %s",
808 eml_filename, strerror(err)),
809 malware_daemon_ctx.sock);
810 }
811 fsize_uint = (unsigned int) fsize;
812 if ((off_t)fsize_uint != fsize)
813 {
814 (void)close(drweb_fd);
815 return m_panic_defer_3(scanent, NULL,
816 string_sprintf("seeking spool file %s, size overflow",
817 eml_filename),
818 malware_daemon_ctx.sock);
819 }
820 drweb_slen = htonl(fsize);
821 if (lseek(drweb_fd, 0, SEEK_SET) < 0)
822 goto badseek;
823
824 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
825 scanner_name, scanner_options);
826
827 /* send scan request */
828 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
829 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
830 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
831 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
832 {
833 (void)close(drweb_fd);
834 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
835 "unable to send commands to socket (%s)", scanner_options),
836 malware_daemon_ctx.sock);
837 }
838
839 if (!(drweb_fbuf = US malloc(fsize_uint)))
840 {
841 (void)close(drweb_fd);
842 return m_panic_defer_3(scanent, NULL,
843 string_sprintf("unable to allocate memory %u for file (%s)",
844 fsize_uint, eml_filename),
845 malware_daemon_ctx.sock);
846 }
847
848 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
849 {
850 int err = errno;
851 (void)close(drweb_fd);
852 free(drweb_fbuf);
853 return m_panic_defer_3(scanent, NULL,
854 string_sprintf("can't read spool file %s: %s",
855 eml_filename, strerror(err)),
856 malware_daemon_ctx.sock);
857 }
858 (void)close(drweb_fd);
859
860 /* send file body to socket */
861 if (send(malware_daemon_ctx.sock, drweb_fbuf, fsize, 0) < 0)
862 {
863 free(drweb_fbuf);
864 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
865 "unable to send file body to socket (%s)", scanner_options),
866 malware_daemon_ctx.sock);
867 }
868 }
869 else
870 {
871 drweb_slen = htonl(Ustrlen(eml_filename));
872
873 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
874 scanner_name, scanner_options);
875
876 /* send scan request */
877 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
878 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
879 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
880 (send(malware_daemon_ctx.sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
881 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
882 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
883 "unable to send commands to socket (%s)", scanner_options),
884 malware_daemon_ctx.sock);
885 }
886
887 /* wait for result */
888 if (!recv_len(malware_daemon_ctx.sock, &drweb_rc, sizeof(drweb_rc), tmo))
889 return m_panic_defer_3(scanent, CUS callout_address,
890 US"unable to read return code", malware_daemon_ctx.sock);
891 drweb_rc = ntohl(drweb_rc);
892
893 if (!recv_len(malware_daemon_ctx.sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
894 return m_panic_defer_3(scanent, CUS callout_address,
895 US"unable to read the number of viruses", malware_daemon_ctx.sock);
896 drweb_vnum = ntohl(drweb_vnum);
897
898 /* "virus(es) found" if virus number is > 0 */
899 if (drweb_vnum)
900 {
901 gstring * g = NULL;
902
903 /* setup default virus name */
904 malware_name = US"unknown";
905
906 /* set up match regex */
907 if (!drweb_re)
908 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
909
910 /* read and concatenate virus names into one string */
911 for (int i = 0; i < drweb_vnum; i++)
912 {
913 int ovector[10*3];
914
915 /* read the size of report */
916 if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
917 return m_panic_defer_3(scanent, CUS callout_address,
918 US"cannot read report size", malware_daemon_ctx.sock);
919 drweb_slen = ntohl(drweb_slen);
920 tmpbuf = store_get(drweb_slen);
921
922 /* read report body */
923 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
924 return m_panic_defer_3(scanent, CUS callout_address,
925 US"cannot read report string", malware_daemon_ctx.sock);
926 tmpbuf[drweb_slen] = '\0';
927
928 /* try matcher on the line, grab substring */
929 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
930 ovector, nelem(ovector));
931 if (result >= 2)
932 {
933 const char * pre_malware_nb;
934
935 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
936
937 if (i==0) /* the first name we just copy to malware_name */
938 g = string_cat(NULL, US pre_malware_nb);
939
940 /*XXX could be string_append_listele? */
941 else /* concatenate each new virus name to previous */
942 g = string_append(g, 2, "/", pre_malware_nb);
943
944 pcre_free_substring(pre_malware_nb);
945 }
946 }
947 malware_name = string_from_gstring(g);
948 }
949 else
950 {
951 const char *drweb_s = NULL;
952
953 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
954 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
955 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
956 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
957 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
958 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
959 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
960 * and others are ignored */
961 if (drweb_s)
962 return m_panic_defer_3(scanent, CUS callout_address,
963 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
964 malware_daemon_ctx.sock);
965
966 /* no virus found */
967 malware_name = NULL;
968 }
969 break;
970 } /* drweb */
971 #endif
972
973 #ifndef DISABLE_MAL_AVE
974 case M_AVES: /* "aveserver" scanner type -------------------------------- */
975 {
976 uschar buf[32768];
977 int result;
978
979 /* read aveserver's greeting and see if it is ready (2xx greeting) */
980 buf[0] = 0;
981 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
982
983 if (buf[0] != '2') /* aveserver is having problems */
984 return m_panic_defer_3(scanent, CUS callout_address,
985 string_sprintf("unavailable (Responded: %s).",
986 ((buf[0] != 0) ? buf : US "nothing") ),
987 malware_daemon_ctx.sock);
988
989 /* prepare our command */
990 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
991 eml_filename);
992
993 /* and send it */
994 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
995 scanner_name, buf);
996 if (m_sock_send(malware_daemon_ctx.sock, buf, Ustrlen(buf), &errstr) < 0)
997 return m_panic_defer(scanent, CUS callout_address, errstr);
998
999 malware_name = NULL;
1000 result = 0;
1001 /* read response lines, find malware name and final response */
1002 while (recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo) > 0)
1003 {
1004 if (buf[0] == '2')
1005 break;
1006 if (buf[0] == '5') /* aveserver is having problems */
1007 {
1008 result = m_panic_defer(scanent, CUS callout_address,
1009 string_sprintf("unable to scan file %s (Responded: %s).",
1010 eml_filename, buf));
1011 break;
1012 }
1013 if (Ustrncmp(buf,"322",3) == 0)
1014 {
1015 uschar *p = Ustrchr(&buf[4], ' ');
1016 *p = '\0';
1017 malware_name = string_copy(&buf[4]);
1018 }
1019 }
1020
1021 if (m_sock_send(malware_daemon_ctx.sock, US"quit\r\n", 6, &errstr) < 0)
1022 return m_panic_defer(scanent, CUS callout_address, errstr);
1023
1024 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1025 buf[0] = 0;
1026 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
1027
1028 if (buf[0] != '2') /* aveserver is having problems */
1029 return m_panic_defer_3(scanent, CUS callout_address,
1030 string_sprintf("unable to quit dialogue (Responded: %s).",
1031 ((buf[0] != 0) ? buf : US "nothing") ),
1032 malware_daemon_ctx.sock);
1033
1034 if (result == DEFER)
1035 {
1036 (void)close(malware_daemon_ctx.sock);
1037 return DEFER;
1038 }
1039 break;
1040 } /* aveserver */
1041 #endif
1042
1043 #ifndef DISABLE_MAL_FSECURE
1044 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
1045 {
1046 int i, bread = 0;
1047 uschar * file_name;
1048 uschar av_buffer[1024];
1049 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
1050 US"CONFIGURE\tTIMEOUT\t0\n",
1051 US"CONFIGURE\tMAXARCH\t5\n",
1052 US"CONFIGURE\tMIME\t1\n" };
1053
1054 malware_name = NULL;
1055
1056 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1057 scanner_name, scanner_options);
1058 /* pass options */
1059 memset(av_buffer, 0, sizeof(av_buffer));
1060 for (i = 0; i != nelem(cmdopt); i++)
1061 {
1062
1063 if (m_sock_send(malware_daemon_ctx.sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
1064 return m_panic_defer(scanent, CUS callout_address, errstr);
1065
1066 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1067 if (bread > 0) av_buffer[bread]='\0';
1068 if (bread < 0)
1069 return m_panic_defer_3(scanent, CUS callout_address,
1070 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
1071 malware_daemon_ctx.sock);
1072 for (int j = 0; j < bread; j++)
1073 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
1074 av_buffer[j] ='@';
1075 }
1076
1077 /* pass the mailfile to fsecure */
1078 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
1079
1080 if (m_sock_send(malware_daemon_ctx.sock, file_name, Ustrlen(file_name), &errstr) < 0)
1081 return m_panic_defer(scanent, CUS callout_address, errstr);
1082
1083 /* set up match */
1084 /* todo also SUSPICION\t */
1085 if (!fsec_re)
1086 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
1087
1088 /* read report, linewise. Apply a timeout as the Fsecure daemon
1089 sometimes wants an answer to "PING" but they won't tell us what */
1090 {
1091 uschar * p = av_buffer;
1092 uschar * q;
1093
1094 for (;;)
1095 {
1096 errno = ETIMEDOUT;
1097 i = av_buffer+sizeof(av_buffer)-p;
1098 if ((bread= ip_recv(&malware_daemon_ctx, p, i-1, tmo-time(NULL))) < 0)
1099 return m_panic_defer_3(scanent, CUS callout_address,
1100 string_sprintf("unable to read result (%s)", strerror(errno)),
1101 malware_daemon_ctx.sock);
1102
1103 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
1104 {
1105 *q = '\0';
1106
1107 /* Really search for virus again? */
1108 if (!malware_name)
1109 /* try matcher on the line, grab substring */
1110 malware_name = m_pcre_exec(fsec_re, p);
1111
1112 if (Ustrstr(p, "OK\tScan ok."))
1113 goto fsec_found;
1114 }
1115
1116 /* copy down the trailing partial line then read another chunk */
1117 i = av_buffer+sizeof(av_buffer)-p;
1118 memmove(av_buffer, p, i);
1119 p = av_buffer+i;
1120 }
1121 }
1122
1123 fsec_found:
1124 break;
1125 } /* fsecure */
1126 #endif
1127
1128 #ifndef DISABLE_MAL_KAV
1129 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
1130 {
1131 time_t t;
1132 uschar tmpbuf[1024];
1133 uschar * scanrequest;
1134 int kav_rc;
1135 unsigned long kav_reportlen;
1136 int bread;
1137 const pcre *kav_re;
1138 uschar *p;
1139
1140 /* get current date and time, build scan request */
1141 time(&t);
1142 /* pdp note: before the eml_filename parameter, this scanned the
1143 directory; not finding documentation, so we'll strip off the directory.
1144 The side-effect is that the test framework scanning may end up in
1145 scanning more than was requested, but for the normal interface, this is
1146 fine. */
1147
1148 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
1149 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
1150 p = Ustrrchr(scanrequest, '/');
1151 if (p)
1152 *p = '\0';
1153
1154 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1155 scanner_name, scanner_options);
1156
1157 /* send scan request */
1158 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
1159 return m_panic_defer(scanent, CUS callout_address, errstr);
1160
1161 /* wait for result */
1162 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, 2, tmo))
1163 return m_panic_defer_3(scanent, CUS callout_address,
1164 US"unable to read 2 bytes from socket.", malware_daemon_ctx.sock);
1165
1166 /* get errorcode from one nibble */
1167 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
1168 switch(kav_rc)
1169 {
1170 case 5: case 6: /* improper kavdaemon configuration */
1171 return m_panic_defer_3(scanent, CUS callout_address,
1172 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
1173 malware_daemon_ctx.sock);
1174 case 1:
1175 return m_panic_defer_3(scanent, CUS callout_address,
1176 US"reported 'scanning not completed' (code 1).", malware_daemon_ctx.sock);
1177 case 7:
1178 return m_panic_defer_3(scanent, CUS callout_address,
1179 US"reported 'kavdaemon damaged' (code 7).", malware_daemon_ctx.sock);
1180 }
1181
1182 /* code 8 is not handled, since it is ambiguous. It appears mostly on
1183 bounces where part of a file has been cut off */
1184
1185 /* "virus found" return codes (2-4) */
1186 if (kav_rc > 1 && kav_rc < 5)
1187 {
1188 int report_flag = 0;
1189
1190 /* setup default virus name */
1191 malware_name = US"unknown";
1192
1193 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
1194
1195 /* read the report, if available */
1196 if (report_flag == 1)
1197 {
1198 /* read report size */
1199 if (!recv_len(malware_daemon_ctx.sock, &kav_reportlen, 4, tmo))
1200 return m_panic_defer_3(scanent, CUS callout_address,
1201 US"cannot read report size", malware_daemon_ctx.sock);
1202
1203 /* it's possible that avp returns av_buffer[1] == 1 but the
1204 reportsize is 0 (!?) */
1205 if (kav_reportlen > 0)
1206 {
1207 /* set up match regex, depends on retcode */
1208 if (kav_rc == 3)
1209 {
1210 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1211 kav_re = kav_re_sus;
1212 }
1213 else
1214 {
1215 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1216 kav_re = kav_re_inf;
1217 }
1218
1219 /* read report, linewise. Using size from stream to read amount of data
1220 from same stream is safe enough. */
1221 /* coverity[tainted_data] */
1222 while (kav_reportlen > 0)
1223 {
1224 if ((bread = recv_line(malware_daemon_ctx.sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
1225 break;
1226 kav_reportlen -= bread+1;
1227
1228 /* try matcher on the line, grab substring */
1229 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1230 break;
1231 }
1232 }
1233 }
1234 }
1235 else /* no virus found */
1236 malware_name = NULL;
1237
1238 break;
1239 }
1240 #endif
1241
1242 #ifndef DISABLE_MAL_CMDLINE
1243 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1244 {
1245 const uschar *cmdline_scanner = scanner_options;
1246 const pcre *cmdline_trigger_re;
1247 const pcre *cmdline_regex_re;
1248 uschar * file_name;
1249 uschar * commandline;
1250 void (*eximsigchld)(int);
1251 void (*eximsigpipe)(int);
1252 FILE *scanner_out = NULL;
1253 int scanner_fd;
1254 FILE *scanner_record = NULL;
1255 uschar linebuffer[32767];
1256 int rcnt;
1257 int trigger = 0;
1258 uschar *p;
1259
1260 if (!cmdline_scanner)
1261 return m_panic_defer(scanent, NULL, errstr);
1262
1263 /* find scanner output trigger */
1264 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1265 "missing trigger specification", &errstr);
1266 if (!cmdline_trigger_re)
1267 return m_panic_defer(scanent, NULL, errstr);
1268
1269 /* find scanner name regex */
1270 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1271 "missing virus name regex specification", &errstr);
1272 if (!cmdline_regex_re)
1273 return m_panic_defer(scanent, NULL, errstr);
1274
1275 /* prepare scanner call; despite the naming, file_name holds a directory
1276 name which is documented as the value given to %s. */
1277
1278 file_name = string_copy(eml_filename);
1279 p = Ustrrchr(file_name, '/');
1280 if (p)
1281 *p = '\0';
1282 commandline = string_sprintf(CS cmdline_scanner, file_name);
1283
1284 /* redirect STDERR too */
1285 commandline = string_sprintf("%s 2>&1", commandline);
1286
1287 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1288 scanner_name, commandline);
1289
1290 /* store exims signal handlers */
1291 eximsigchld = signal(SIGCHLD,SIG_DFL);
1292 eximsigpipe = signal(SIGPIPE,SIG_DFL);
1293
1294 if (!(scanner_out = popen(CS commandline,"r")))
1295 {
1296 int err = errno;
1297 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1298 return m_panic_defer(scanent, NULL,
1299 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1300 }
1301 scanner_fd = fileno(scanner_out);
1302
1303 file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
1304
1305 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1306 {
1307 int err = errno;
1308 (void) pclose(scanner_out);
1309 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1310 return m_panic_defer(scanent, NULL, string_sprintf(
1311 "opening scanner output file (%s) failed: %s.",
1312 file_name, strerror(err)));
1313 }
1314
1315 /* look for trigger while recording output */
1316 while ((rcnt = recv_line(scanner_fd, linebuffer,
1317 sizeof(linebuffer), tmo)))
1318 {
1319 if (rcnt < 0)
1320 {
1321 int err = errno;
1322 if (rcnt == -1)
1323 break;
1324 (void) pclose(scanner_out);
1325 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1326 return m_panic_defer(scanent, NULL, string_sprintf(
1327 "unable to read from scanner (%s): %s",
1328 commandline, strerror(err)));
1329 }
1330
1331 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1332 {
1333 /* short write */
1334 (void) pclose(scanner_out);
1335 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1336 return m_panic_defer(scanent, NULL, string_sprintf(
1337 "short write on scanner output file (%s).", file_name));
1338 }
1339 putc('\n', scanner_record);
1340 /* try trigger match */
1341 if ( !trigger
1342 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1343 )
1344 trigger = 1;
1345 }
1346
1347 (void)fclose(scanner_record);
1348 sep = pclose(scanner_out);
1349 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1350 if (sep != 0)
1351 return m_panic_defer(scanent, NULL,
1352 sep == -1
1353 ? string_sprintf("running scanner failed: %s", strerror(sep))
1354 : string_sprintf("scanner returned error code: %d", sep));
1355
1356 if (trigger)
1357 {
1358 uschar * s;
1359 /* setup default virus name */
1360 malware_name = US"unknown";
1361
1362 /* re-open the scanner output file, look for name match */
1363 scanner_record = fopen(CS file_name, "rb");
1364 while (fgets(CS linebuffer, sizeof(linebuffer), scanner_record))
1365 {
1366 /* try match */
1367 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
1368 malware_name = s;
1369 }
1370 (void)fclose(scanner_record);
1371 }
1372 else /* no virus found */
1373 malware_name = NULL;
1374 break;
1375 } /* cmdline */
1376 #endif
1377
1378 #ifndef DISABLE_MAL_SOPHIE
1379 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1380 {
1381 int bread = 0;
1382 uschar *p;
1383 uschar * file_name;
1384 uschar av_buffer[1024];
1385
1386 /* pass the scan directory to sophie */
1387 file_name = string_copy(eml_filename);
1388 if ((p = Ustrrchr(file_name, '/')))
1389 *p = '\0';
1390
1391 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1392 scanner_name, scanner_options);
1393
1394 if ( write(malware_daemon_ctx.sock, file_name, Ustrlen(file_name)) < 0
1395 || write(malware_daemon_ctx.sock, "\n", 1) != 1
1396 )
1397 return m_panic_defer_3(scanent, CUS callout_address,
1398 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
1399 malware_daemon_ctx.sock);
1400
1401 /* wait for result */
1402 memset(av_buffer, 0, sizeof(av_buffer));
1403 if ((bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
1404 return m_panic_defer_3(scanent, CUS callout_address,
1405 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
1406 malware_daemon_ctx.sock);
1407
1408 /* infected ? */
1409 if (av_buffer[0] == '1') {
1410 uschar * s = Ustrchr(av_buffer, '\n');
1411 if (s)
1412 *s = '\0';
1413 malware_name = string_copy(&av_buffer[2]);
1414 }
1415 else if (!strncmp(CS av_buffer, "-1", 2))
1416 return m_panic_defer_3(scanent, CUS callout_address,
1417 US"scanner reported error", malware_daemon_ctx.sock);
1418 else /* all ok, no virus */
1419 malware_name = NULL;
1420
1421 break;
1422 }
1423 #endif
1424
1425 #ifndef DISABLE_MAL_CLAM
1426 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1427 {
1428 /* This code was originally contributed by David Saez */
1429 /* There are three scanning methods available to us:
1430 * (1) Use the SCAN command, pointing to a file in the filesystem
1431 * (2) Use the STREAM command, send the data on a separate port
1432 * (3) Use the zINSTREAM command, send the data inline
1433 * The zINSTREAM command was introduced with ClamAV 0.95, which marked
1434 * STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1435 * In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
1436 * the TCP-connected daemon is actually local; otherwise we use zINSTREAM
1437 * See Exim bug 926 for details. */
1438
1439 uschar *p, *vname, *result_tag;
1440 int bread=0;
1441 uschar av_buffer[1024];
1442 uschar *hostname = US"";
1443 host_item connhost;
1444 uschar *clamav_fbuf;
1445 int clam_fd, result;
1446 off_t fsize;
1447 unsigned int fsize_uint;
1448 BOOL use_scan_command = FALSE;
1449 clamd_address * cv[MAX_CLAMD_SERVERS];
1450 int num_servers = 0;
1451 uint32_t send_size, send_final_zeroblock;
1452 blob cmd_str;
1453
1454 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1455 there's no reason we should not mix local and remote servers */
1456
1457 if (*scanner_options == '/')
1458 {
1459 clamd_address * cd;
1460 const uschar * sublist;
1461 int subsep = ' ';
1462
1463 /* Local file; so we def want to use_scan_command and don't want to try
1464 * passing IP/port combinations */
1465 use_scan_command = TRUE;
1466 cd = (clamd_address *) store_get(sizeof(clamd_address));
1467
1468 /* extract socket-path part */
1469 sublist = scanner_options;
1470 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1471
1472 /* parse options */
1473 if (clamd_option(cd, sublist, &subsep) != OK)
1474 return m_panic_defer(scanent, NULL,
1475 string_sprintf("bad option '%s'", scanner_options));
1476 cv[0] = cd;
1477 }
1478 else
1479 {
1480 /* Go through the rest of the list of host/port and construct an array
1481 * of servers to try. The first one is the bit we just passed from
1482 * scanner_options so process that first and then scan the remainder of
1483 * the address buffer */
1484 do
1485 {
1486 clamd_address * cd;
1487 const uschar * sublist;
1488 int subsep = ' ';
1489 uschar * s;
1490
1491 /* The 'local' option means use the SCAN command over the network
1492 * socket (ie common file storage in use) */
1493 /*XXX we could accept this also as a local option? */
1494 if (strcmpic(scanner_options, US"local") == 0)
1495 {
1496 use_scan_command = TRUE;
1497 continue;
1498 }
1499
1500 cd = (clamd_address *) store_get(sizeof(clamd_address));
1501
1502 /* extract host and port part */
1503 sublist = scanner_options;
1504 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1505 {
1506 (void) m_panic_defer(scanent, NULL,
1507 string_sprintf("missing address: '%s'", scanner_options));
1508 continue;
1509 }
1510 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
1511 {
1512 (void) m_panic_defer(scanent, NULL,
1513 string_sprintf("missing port: '%s'", scanner_options));
1514 continue;
1515 }
1516 cd->tcp_port = atoi(CS s);
1517
1518 /* parse options */
1519 /*XXX should these options be common over scanner types? */
1520 if (clamd_option(cd, sublist, &subsep) != OK)
1521 return m_panic_defer(scanent, NULL,
1522 string_sprintf("bad option '%s'", scanner_options));
1523
1524 cv[num_servers++] = cd;
1525 if (num_servers >= MAX_CLAMD_SERVERS)
1526 {
1527 (void) m_panic_defer(scanent, NULL,
1528 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1529 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1530 break;
1531 }
1532 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1533 NULL, 0)));
1534
1535 /* check if we have at least one server */
1536 if (!num_servers)
1537 return m_panic_defer(scanent, NULL,
1538 US"no useable server addresses in malware configuration option.");
1539 }
1540
1541 /* See the discussion of response formats below to see why we really
1542 don't like colons in filenames when passing filenames to ClamAV. */
1543 if (use_scan_command && Ustrchr(eml_filename, ':'))
1544 return m_panic_defer(scanent, NULL,
1545 string_sprintf("local/SCAN mode incompatible with" \
1546 " : in path to email filename [%s]", eml_filename));
1547
1548 /* Set up the very first data we will be sending */
1549 if (!use_scan_command)
1550 { cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
1551 else
1552 {
1553 cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
1554 cmd_str.len = Ustrlen(cmd_str.data);
1555 }
1556
1557 /* We have some network servers specified */
1558 if (num_servers)
1559 {
1560 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1561 * only supports AF_INET, but we should probably be looking to the
1562 * future and rewriting this to be protocol-independent anyway. */
1563
1564 while (num_servers > 0)
1565 {
1566 int i = random_number(num_servers);
1567 clamd_address * cd = cv[i];
1568
1569 DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
1570 cd->hostspec, cd->tcp_port);
1571
1572 /* Lookup the host. This is to ensure that we connect to the same IP
1573 * on both connections (as one host could resolve to multiple ips) */
1574 for (;;)
1575 {
1576 /*XXX we trust that the cmd_str is ideempotent */
1577 if ((malware_daemon_ctx.sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
1578 &connhost, &errstr, &cmd_str)) >= 0)
1579 {
1580 /* Connection successfully established with a server */
1581 hostname = cd->hostspec;
1582 cmd_str.len = 0;
1583 break;
1584 }
1585 if (cd->retry <= 0) break;
1586 while (cd->retry > 0) cd->retry = sleep(cd->retry);
1587 }
1588 if (malware_daemon_ctx.sock >= 0)
1589 break;
1590
1591 (void) m_panic_defer(scanent, CUS callout_address, errstr);
1592
1593 /* Remove the server from the list. XXX We should free the memory */
1594 num_servers--;
1595 for (; i < num_servers; i++)
1596 cv[i] = cv[i+1];
1597 }
1598
1599 if (num_servers == 0)
1600 return m_panic_defer(scanent, NULL, US"all servers failed");
1601 }
1602 else
1603 for (;;)
1604 {
1605 if ((malware_daemon_ctx.sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
1606 {
1607 hostname = cv[0]->hostspec;
1608 break;
1609 }
1610 if (cv[0]->retry <= 0)
1611 return m_panic_defer(scanent, CUS callout_address, errstr);
1612 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1613 }
1614
1615 /* have socket in variable "sock"; command to use is semi-independent of
1616 * the socket protocol. We use SCAN if is local (either Unix/local
1617 * domain socket, or explicitly told local) else we stream the data.
1618 * How we stream the data depends upon how we were built. */
1619
1620 if (!use_scan_command)
1621 {
1622 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1623 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1624 chunk. */
1625
1626 DEBUG(D_acl) debug_printf_indent(
1627 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1628 scanner_name);
1629
1630 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1631 if (cmd_str.len)
1632 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
1633 return m_panic_defer_3(scanent, CUS hostname,
1634 string_sprintf("unable to send zINSTREAM to socket (%s)",
1635 strerror(errno)),
1636 malware_daemon_ctx.sock);
1637
1638 /* calc file size */
1639 if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0)
1640 {
1641 int err = errno;
1642 return m_panic_defer_3(scanent, NULL,
1643 string_sprintf("can't open spool file %s: %s",
1644 eml_filename, strerror(err)),
1645 malware_daemon_ctx.sock);
1646 }
1647 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1648 {
1649 int err;
1650 b_seek: err = errno;
1651 (void)close(clam_fd);
1652 return m_panic_defer_3(scanent, NULL,
1653 string_sprintf("can't seek spool file %s: %s",
1654 eml_filename, strerror(err)),
1655 malware_daemon_ctx.sock);
1656 }
1657 fsize_uint = (unsigned int) fsize;
1658 if ((off_t)fsize_uint != fsize)
1659 {
1660 (void)close(clam_fd);
1661 return m_panic_defer_3(scanent, NULL,
1662 string_sprintf("seeking spool file %s, size overflow",
1663 eml_filename),
1664 malware_daemon_ctx.sock);
1665 }
1666 if (lseek(clam_fd, 0, SEEK_SET) < 0)
1667 goto b_seek;
1668
1669 if (!(clamav_fbuf = US malloc(fsize_uint)))
1670 {
1671 (void)close(clam_fd);
1672 return m_panic_defer_3(scanent, NULL,
1673 string_sprintf("unable to allocate memory %u for file (%s)",
1674 fsize_uint, eml_filename),
1675 malware_daemon_ctx.sock);
1676 }
1677
1678 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1679 {
1680 int err = errno;
1681 free(clamav_fbuf); (void)close(clam_fd);
1682 return m_panic_defer_3(scanent, NULL,
1683 string_sprintf("can't read spool file %s: %s",
1684 eml_filename, strerror(err)),
1685 malware_daemon_ctx.sock);
1686 }
1687 (void)close(clam_fd);
1688
1689 /* send file body to socket */
1690 send_size = htonl(fsize_uint);
1691 send_final_zeroblock = 0;
1692 if ((send(malware_daemon_ctx.sock, &send_size, sizeof(send_size), 0) < 0) ||
1693 (send(malware_daemon_ctx.sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1694 (send(malware_daemon_ctx.sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
1695 {
1696 free(clamav_fbuf);
1697 return m_panic_defer_3(scanent, NULL,
1698 string_sprintf("unable to send file body to socket (%s)", hostname),
1699 malware_daemon_ctx.sock);
1700 }
1701
1702 free(clamav_fbuf);
1703 }
1704 else
1705 { /* use scan command */
1706 /* Send a SCAN command pointing to a filename; then in the then in the
1707 * scan-method-neutral part, read the response back */
1708
1709 /* ================================================================= */
1710
1711 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1712 which dates to when ClamAV needed us to break apart the email into the
1713 MIME parts (eg, with the now deprecated demime condition coming first).
1714 Some time back, ClamAV gained the ability to deconstruct the emails, so
1715 doing this would actually have resulted in the mail attachments being
1716 scanned twice, in the broken out files and from the original .eml.
1717 Since ClamAV now handles emails (and has for quite some time) we can
1718 just use the email file itself. */
1719 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
1720
1721 DEBUG(D_acl) debug_printf_indent(
1722 "Malware scan: issuing %s local-path scan [%s]\n",
1723 scanner_name, scanner_options);
1724
1725 if (cmd_str.len)
1726 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
1727 return m_panic_defer_3(scanent, CUS callout_address,
1728 string_sprintf("unable to write to socket (%s)", strerror(errno)),
1729 malware_daemon_ctx.sock);
1730
1731 /* Do not shut down the socket for writing; a user report noted that
1732 * clamd 0.70 does not react well to this. */
1733 }
1734 /* Commands have been sent, no matter which scan method or connection
1735 * type we're using; now just read the result, independent of method. */
1736
1737 /* Read the result */
1738 memset(av_buffer, 0, sizeof(av_buffer));
1739 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1740 (void)close(malware_daemon_ctx.sock);
1741 malware_daemon_ctx.sock = -1;
1742 malware_daemon_ctx.tls_ctx = NULL;
1743
1744 if (bread <= 0)
1745 return m_panic_defer(scanent, CUS callout_address,
1746 string_sprintf("unable to read from socket (%s)",
1747 errno == 0 ? "EOF" : strerror(errno)));
1748
1749 if (bread == sizeof(av_buffer))
1750 return m_panic_defer(scanent, CUS callout_address,
1751 US"buffer too small");
1752 /* We're now assured of a NULL at the end of av_buffer */
1753
1754 /* Check the result. ClamAV returns one of two result formats.
1755 In the basic mode, the response is of the form:
1756 infected: -> "<filename>: <virusname> FOUND"
1757 not-infected: -> "<filename>: OK"
1758 error: -> "<filename>: <errcode> ERROR
1759 If the ExtendedDetectionInfo option has been turned on, then we get:
1760 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1761 for the infected case. Compare:
1762 /tmp/eicar.com: Eicar-Test-Signature FOUND
1763 /tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1764
1765 In the streaming case, clamd uses the filename "stream" which you should
1766 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1767 client app will replace "stream" with the original filename before returning
1768 results to stdout, but the trace shows the data).
1769
1770 We will assume that the pathname passed to clamd from Exim does not contain
1771 a colon. We will have whined loudly above if the eml_filename does (and we're
1772 passing a filename to clamd). */
1773
1774 if (!(*av_buffer))
1775 return m_panic_defer(scanent, CUS callout_address,
1776 US"ClamAV returned null");
1777
1778 /* strip newline at the end (won't be present for zINSTREAM)
1779 (also any trailing whitespace, which shouldn't exist, but we depend upon
1780 this below, so double-check) */
1781 p = av_buffer + Ustrlen(av_buffer) - 1;
1782 if (*p == '\n') *p = '\0';
1783
1784 DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
1785
1786 while (isspace(*--p) && (p > av_buffer))
1787 *p = '\0';
1788 if (*p) ++p;
1789
1790 /* colon in returned output? */
1791 if(!(p = Ustrchr(av_buffer,':')))
1792 return m_panic_defer(scanent, CUS callout_address, string_sprintf(
1793 "ClamAV returned malformed result (missing colon): %s",
1794 av_buffer));
1795
1796 /* strip filename */
1797 while (*p && isspace(*++p)) /**/;
1798 vname = p;
1799
1800 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1801 but we should at least be resistant to it. */
1802 p = Ustrrchr(vname, ' ');
1803 result_tag = p ? p+1 : vname;
1804
1805 if (Ustrcmp(result_tag, "FOUND") == 0)
1806 {
1807 /* p should still be the whitespace before the result_tag */
1808 while (isspace(*p)) --p;
1809 *++p = '\0';
1810 /* Strip off the extended information too, which will be in parens
1811 after the virus name, with no intervening whitespace. */
1812 if (*--p == ')')
1813 {
1814 /* "(hash:size)", so previous '(' will do; if not found, we have
1815 a curious virus name, but not an error. */
1816 p = Ustrrchr(vname, '(');
1817 if (p)
1818 *p = '\0';
1819 }
1820 malware_name = string_copy(vname);
1821 DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
1822
1823 }
1824 else if (Ustrcmp(result_tag, "ERROR") == 0)
1825 return m_panic_defer(scanent, CUS callout_address,
1826 string_sprintf("ClamAV returned: %s", av_buffer));
1827
1828 else if (Ustrcmp(result_tag, "OK") == 0)
1829 {
1830 /* Everything should be OK */
1831 malware_name = NULL;
1832 DEBUG(D_acl) debug_printf_indent("Malware not found\n");
1833
1834 }
1835 else
1836 return m_panic_defer(scanent, CUS callout_address,
1837 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1838
1839 break;
1840 } /* clamd */
1841 #endif
1842
1843 #ifndef DISABLE_MAL_SOCK
1844 case M_SOCK: /* "sock" scanner type ------------------------------------- */
1845 /* This code was derived by Martin Poole from the clamd code contributed
1846 by David Saez and the cmdline code
1847 */
1848 {
1849 int bread;
1850 uschar * commandline;
1851 uschar av_buffer[1024];
1852 uschar * linebuffer;
1853 uschar * sockline_scanner;
1854 uschar sockline_scanner_default[] = "%s\n";
1855 const pcre *sockline_trig_re;
1856 const pcre *sockline_name_re;
1857
1858 /* find scanner command line */
1859 if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1860 NULL, 0))
1861 && *sockline_scanner
1862 )
1863 { /* check for no expansions apart from one %s */
1864 uschar * s = Ustrchr(sockline_scanner, '%');
1865 if (s++)
1866 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
1867 return m_panic_defer_3(scanent, NULL,
1868 US"unsafe sock scanner call spec", malware_daemon_ctx.sock);
1869 }
1870 else
1871 sockline_scanner = sockline_scanner_default;
1872 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1873 string_printing(sockline_scanner));
1874
1875 /* find scanner output trigger */
1876 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1877 "missing trigger specification", &errstr);
1878 if (!sockline_trig_re)
1879 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
1880
1881 /* find virus name regex */
1882 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1883 "missing virus name regex specification", &errstr);
1884 if (!sockline_name_re)
1885 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
1886
1887 /* prepare scanner call - security depends on expansions check above */
1888 commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
1889 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1890 string_printing(commandline));
1891
1892 /* Pass the command string to the socket */
1893 if (m_sock_send(malware_daemon_ctx.sock, commandline, Ustrlen(commandline), &errstr) < 0)
1894 return m_panic_defer(scanent, CUS callout_address, errstr);
1895
1896 /* Read the result */
1897 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1898
1899 if (bread <= 0)
1900 return m_panic_defer_3(scanent, CUS callout_address,
1901 string_sprintf("unable to read from socket (%s)", strerror(errno)),
1902 malware_daemon_ctx.sock);
1903
1904 if (bread == sizeof(av_buffer))
1905 return m_panic_defer_3(scanent, CUS callout_address,
1906 US"buffer too small", malware_daemon_ctx.sock);
1907 av_buffer[bread] = '\0';
1908 linebuffer = string_copy(av_buffer);
1909 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1910 string_printing(linebuffer));
1911
1912 /* try trigger match */
1913 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1914 {
1915 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1916 malware_name = US "unknown";
1917 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1918 string_printing(malware_name));
1919 }
1920 else /* no virus found */
1921 malware_name = NULL;
1922 break;
1923 }
1924 #endif
1925
1926 #ifndef DISABLE_MAL_MKS
1927 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1928 {
1929 char *mksd_options_end;
1930 int mksd_maxproc = 1; /* default, if no option supplied */
1931 int retval;
1932
1933 if (scanner_options)
1934 {
1935 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1936 if ( *scanner_options == '\0'
1937 || *mksd_options_end != '\0'
1938 || mksd_maxproc < 1
1939 || mksd_maxproc > 32
1940 )
1941 return m_panic_defer(scanent, CUS callout_address,
1942 string_sprintf("invalid option '%s'", scanner_options));
1943 }
1944
1945 if((malware_daemon_ctx.sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
1946 return m_panic_defer(scanent, CUS callout_address, errstr);
1947
1948 malware_name = NULL;
1949
1950 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
1951
1952 if ((retval = mksd_scan_packed(scanent, malware_daemon_ctx.sock, eml_filename, tmo)) != OK)
1953 {
1954 close (malware_daemon_ctx.sock);
1955 return retval;
1956 }
1957 break;
1958 }
1959 #endif
1960
1961 #ifndef DISABLE_MAL_AVAST
1962 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1963 {
1964 uschar buf[1024];
1965 uschar * scanrequest;
1966 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
1967 int nread;
1968 uschar * error_message = NULL;
1969 BOOL more_data = FALSE;
1970 BOOL strict = TRUE;
1971
1972 /* According to Martin Tuma @avast the protocol uses "escaped
1973 whitespace", that is, every embedded whitespace is backslash
1974 escaped, as well as backslash is protected by backslash.
1975 The returned lines contain the name of the scanned file, a tab
1976 and the [ ] marker.
1977 [+] - not infected
1978 [L] - infected
1979 [E] - some error occurred
1980 Such marker follows the first non-escaped TAB. For more information
1981 see avast-protocol(5)
1982
1983 We observed two cases:
1984 -> SCAN /file
1985 <- /file [E]0.0 Error 13 Permission denied
1986 <- 451 SCAN Engine error 13 permission denied
1987
1988 -> SCAN /file
1989 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1990 <- /file… [+]2.0
1991 <- /file… [+]2.0 0 Eicar Test Virus!!!
1992 <- 200 SCAN OK
1993
1994 If the scanner returns 4xx, DEFER is a good decision, combined
1995 with a panic log entry, to get the admin's attention.
1996
1997 If the scanner returns 200, we reject it as malware, if found any,
1998 or, in case of an error, we set the malware message to the error
1999 string.
2000
2001 Some of the >= 42000 errors are message related - usually some
2002 broken archives etc, but some of them are e.g. license related.
2003 Once the license expires the engine starts returning errors for
2004 every scanning attempt. I¹ have the full list of the error codes
2005 but it is not a public API and is subject to change. It is hard
2006 for me to say what you should do in case of an engine error. You
2007 can have a “Treat * unscanned file as infection” policy or “Treat
2008 unscanned file as clean” policy. ¹) Jakub Bednar
2009
2010 */
2011
2012 if ( ( !ava_re_clean
2013 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
2014 || ( !ava_re_virus
2015 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
2016 || ( !ava_re_error
2017 && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
2018 )
2019 return malware_panic_defer(errstr);
2020
2021 /* wait for result */
2022 for (avast_stage = AVA_HELO;
2023 (nread = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) > 0;
2024 )
2025 {
2026 int slen = Ustrlen(buf);
2027 if (slen >= 1)
2028 {
2029
2030 /* Multi line responses are bracketed between 210 … and nnn … */
2031 if (Ustrncmp(buf, "210", 3) == 0)
2032 {
2033 more_data = 1;
2034 continue;
2035 }
2036 else if (more_data && isdigit(buf[0])) more_data = 0;
2037
2038 switch (avast_stage)
2039 {
2040 case AVA_HELO:
2041 if (more_data) continue;
2042 if (Ustrncmp(buf, "220", 3) != 0)
2043 goto endloop; /* require a 220 */
2044 goto sendreq;
2045
2046 case AVA_OPT:
2047 if (more_data) continue;
2048 if (Ustrncmp(buf, "200", 3) != 0)
2049 goto endloop; /* require a 200 */
2050
2051 sendreq:
2052 {
2053 int len;
2054 /* Check for another option to send. Newline-terminate it. */
2055 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
2056 NULL, 0)))
2057 {
2058 if (Ustrcmp(scanrequest, "pass_unscanned") == 0)
2059 {
2060 DEBUG(D_acl) debug_printf_indent("pass unscanned files as clean\n");
2061 strict = FALSE;
2062 goto sendreq;
2063 }
2064 scanrequest = string_sprintf("%s\n", scanrequest);
2065 avast_stage = AVA_OPT; /* just sent option */
2066 DEBUG(D_acl) debug_printf_indent("send to avast OPTION: %s", scanrequest);
2067 }
2068 else
2069 {
2070 scanrequest = string_sprintf("SCAN %s\n", eml_dir);
2071 avast_stage = AVA_RSP; /* just sent command */
2072 DEBUG(D_acl) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir);
2073 }
2074
2075 /* send config-cmd or scan-request to socket */
2076 len = Ustrlen(scanrequest);
2077 if (send(malware_daemon_ctx.sock, scanrequest, len, 0) == -1)
2078 {
2079 scanrequest[len-1] = '\0';
2080 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
2081 "unable to send request '%s' to socket (%s): %s",
2082 scanrequest, scanner_options, strerror(errno)), malware_daemon_ctx.sock);
2083 }
2084 break;
2085 }
2086
2087 case AVA_RSP:
2088
2089 if (isdigit(buf[0])) /* We're done */
2090 goto endloop;
2091
2092 if (malware_name) /* Nothing else matters, just read on */
2093 break;
2094
2095 if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2096 break;
2097
2098 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
2099 {
2100 unescape(malware_name);
2101 DEBUG(D_acl)
2102 debug_printf_indent("unescaped malware name: '%s'\n", malware_name);
2103 break;
2104 }
2105
2106 if (strict) /* treat scanner errors as malware */
2107 {
2108 if ((malware_name = m_pcre_exec(ava_re_error, buf)))
2109 {
2110 unescape(malware_name);
2111 DEBUG(D_acl)
2112 debug_printf_indent("unescaped error message: '%s'\n", malware_name);
2113 break;
2114 }
2115 }
2116 else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2117 {
2118 log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
2119 break;
2120 }
2121
2122 /* here also for any unexpected response from the scanner */
2123 DEBUG(D_acl) debug_printf("avast response not handled: '%s'\n", buf);
2124
2125 goto endloop;
2126
2127 default: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
2128 __FILE__, __LINE__, __FUNCTION__);
2129 }
2130 }
2131 }
2132
2133 endloop:
2134
2135 if (nread == -1) error_message = US"EOF from scanner";
2136 else if (nread < 0) error_message = US"timeout from scanner";
2137 else if (nread == 0) error_message = US"got nothing from scanner";
2138 else if (buf[0] != '2') error_message = buf;
2139
2140 DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n");
2141 if (send(malware_daemon_ctx.sock, "QUIT\n", 5, 0) == -1)
2142 return m_panic_defer_3(scanent, CUS callout_address,
2143 string_sprintf("unable to send quit request to socket (%s): %s",
2144 scanner_options, strerror(errno)), malware_daemon_ctx.sock);
2145
2146 if (error_message)
2147 return m_panic_defer_3(scanent, CUS callout_address, error_message, malware_daemon_ctx.sock);
2148
2149 }
2150 #endif
2151 } /* scanner type switch */
2152
2153 if (malware_daemon_ctx.sock >= 0)
2154 (void) close (malware_daemon_ctx.sock);
2155 malware_ok = TRUE; /* set "been here, done that" marker */
2156 }
2157
2158 /* match virus name against pattern (caseless ------->----------v) */
2159 if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
2160 {
2161 DEBUG(D_acl) debug_printf_indent(
2162 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
2163 return OK;
2164 }
2165 else
2166 return FAIL;
2167 }
2168
2169
2170 /*************************************************
2171 * Scan an email for malware *
2172 *************************************************/
2173
2174 /* This is the normal interface for scanning an email, which doesn't need a
2175 filename; it's a wrapper around the malware_file function.
2176
2177 Arguments:
2178 malware_re match condition for "malware="
2179 timeout if nonzero, timeout in seconds
2180
2181 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2182 where true means malware was found (condition applies)
2183 */
2184 int
2185 malware(const uschar * malware_re, int timeout)
2186 {
2187 int ret = malware_internal(malware_re, NULL, timeout);
2188
2189 if (ret == DEFER) av_failed = TRUE;
2190 return ret;
2191 }
2192
2193
2194 /*************************************************
2195 * Scan a file for malware *
2196 *************************************************/
2197
2198 /* This is a test wrapper for scanning an email, which is not used in
2199 normal processing. Scan any file, using the Exim scanning interface.
2200 This function tampers with various global variables so is unsafe to use
2201 in any other context.
2202
2203 Arguments:
2204 eml_filename a file holding the message to be scanned
2205
2206 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2207 where true means malware was found (condition applies)
2208 */
2209 int
2210 malware_in_file(uschar *eml_filename)
2211 {
2212 uschar message_id_buf[64];
2213 int ret;
2214
2215 /* spool_mbox() assumes various parameters exist, when creating
2216 the relevant directory and the email within */
2217
2218 (void) string_format(message_id_buf, sizeof(message_id_buf),
2219 "dummy-%d", vaguely_random_number(INT_MAX));
2220 message_id = message_id_buf;
2221 sender_address = US"malware-sender@example.net";
2222 return_path = US"";
2223 recipients_list = NULL;
2224 receive_add_recipient(US"malware-victim@example.net", -1);
2225 f.enable_dollar_recipients = TRUE;
2226
2227 ret = malware_internal(US"*", eml_filename, 0);
2228
2229 Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
2230 spool_mbox_ok = 1;
2231
2232 /* don't set no_mbox_unspool; at present, there's no way for it to become
2233 set, but if that changes, then it should apply to these tests too */
2234
2235 unspool_mbox();
2236
2237 /* silence static analysis tools */
2238 message_id = NULL;
2239
2240 return ret;
2241 }
2242
2243
2244 void
2245 malware_init(void)
2246 {
2247 if (!malware_default_re)
2248 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
2249
2250 #ifndef DISABLE_MAL_DRWEB
2251 if (!drweb_re)
2252 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
2253 #endif
2254 #ifndef DISABLE_MAL_FSECURE
2255 if (!fsec_re)
2256 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
2257 #endif
2258 #ifndef DISABLE_MAL_KAV
2259 if (!kav_re_sus)
2260 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2261 if (!kav_re_inf)
2262 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
2263 #endif
2264 #ifndef DISABLE_MAL_AVAST
2265 if (!ava_re_clean)
2266 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2267 if (!ava_re_virus)
2268 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
2269 if (!ava_re_error)
2270 ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
2271 #endif
2272 #ifndef DISABLE_MAL_FFROT6D
2273 if (!fprot6d_re_error)
2274 fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
2275 if (!fprot6d_re_virus)
2276 fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
2277 #endif
2278 }
2279
2280
2281 void
2282 malware_show_supported(FILE * f)
2283 {
2284 fprintf(f, "Malware:");
2285 for (struct scan * sc = m_scans; sc->scancode != (scanner_t)-1; sc++) fprintf(f, " %s", sc->name);
2286 fprintf(f, "\n");
2287 }
2288
2289
2290 # endif /*!MACRO_PREDEF*/
2291 #endif /*WITH_CONTENT_SCAN*/
2292 /*
2293 * vi: aw ai sw=2
2294 */
Unnamed repository; edit this file 'description' to name the repository.