1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
7 * Copyright (c) The Exim Maintainers 2015 - 2018
10 /* Code for calling virus (malware) scanners. Called from acl.c. */
13 #ifdef WITH_CONTENT_SCAN /* entire file */
16 #ifndef DISABLE_MAL_FFROTD
19 #ifndef DISABLE_MAL_FFROT6D
22 #ifndef DISABLE_MAL_DRWEB
25 #ifndef DISABLE_MAL_AVE
28 #ifndef DISABLE_MAL_FSECURE
31 #ifndef DISABLE_MAL_KAV
34 #ifndef DISABLE_MAL_SOPHIE
37 #ifndef DISABLE_MAL_CLAM
40 #ifndef DISABLE_MAL_MKS
43 #ifndef DISABLE_MAL_AVAST
46 #ifndef DISABLE_MAL_SOCK
49 #ifndef DISABLE_MAL_CMDLINE
53 typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
58 const uschar * options_default;
62 #ifndef DISABLE_MAL_FFROTD
63 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
65 #ifndef DISABLE_MAL_FFROT6D
66 { M_FPROT6D, US"f-prot6d", US"localhost 10200", MC_TCP },
68 #ifndef DISABLE_MAL_DRWEB
69 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
71 #ifndef DISABLE_MAL_AVE
72 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
74 #ifndef DISABLE_MAL_FSECURE
75 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
77 #ifndef DISABLE_MAL_KAV
78 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
80 #ifndef DISABLE_MAL_SOPHIE
81 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
83 #ifndef DISABLE_MAL_CLAM
84 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
86 #ifndef DISABLE_MAL_MKS
87 { M_MKSD, US"mksd", NULL, MC_NONE },
89 #ifndef DISABLE_MAL_AVAST
90 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
92 #ifndef DISABLE_MAL_SOCK
93 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
95 #ifndef DISABLE_MAL_CMDLINE
96 { M_CMDL, US"cmdline", NULL, MC_NONE },
98 { -1, NULL, NULL, MC_NONE } /* end-marker */
101 /******************************************************************************/
102 # ifdef MACRO_PREDEF /* build solely to predefine macros */
104 # include "macro_predef.h"
107 features_malware(void)
109 const struct scan * sc;
114 spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
116 for (sc = m_scans; sc->scancode != -1; sc++)
118 for(s = sc->name, t = buf+14; *s; s++) if (*s != '-') *t++ = toupper(*s);
120 builtin_macro_create(buf);
124 /******************************************************************************/
125 # else /*!MACRO_PREDEF, main build*/
128 #define MALWARE_TIMEOUT 120 /* default timeout, seconds */
130 static const uschar * malware_regex_default = US ".+";
131 static const pcre * malware_default_re = NULL;
135 #ifndef DISABLE_MAL_CLAM
136 /* The maximum number of clamd servers that are supported in the configuration */
137 # define MAX_CLAMD_SERVERS 32
138 # define MAX_CLAMD_SERVERS_S "32"
140 typedef struct clamd_address {
148 #ifndef DISABLE_MAL_DRWEB
149 # define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
150 # define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
151 # define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
153 # define DERR_READ_ERR (1<<0) /* read error */
154 # define DERR_NOMEMORY (1<<2) /* no memory */
155 # define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
156 # define DERR_BAD_CALL (1<<15) /* wrong command */
158 static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
159 static const pcre * drweb_re = NULL;
162 #ifndef DISABLE_MAL_FSECURE
163 static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
164 static const pcre * fsec_re = NULL;
167 #ifndef DISABLE_MAL_KAV
168 static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
169 static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
170 static const pcre * kav_re_sus = NULL;
171 static const pcre * kav_re_inf = NULL;
174 #ifndef DISABLE_MAL_AVAST
175 static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
176 static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
177 static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
178 static const pcre * ava_re_clean = NULL;
179 static const pcre * ava_re_virus = NULL;
180 static const pcre * ava_re_error = NULL;
183 #ifndef DISABLE_MAL_FFROT6D
184 static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
185 static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
186 static const pcre * fprot6d_re_error = NULL;
187 static const pcre * fprot6d_re_virus = NULL;
192 /******************************************************************************/
194 /* Routine to check whether a system is big- or little-endian.
195 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
196 Needed for proper kavdaemon implementation. Sigh. */
197 #define BIG_MY_ENDIAN 0
198 #define LITTLE_MY_ENDIAN 1
199 static int test_byte_order(void);
203 short int word = 0x0001;
204 char *byte = CS &word;
205 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
208 BOOL malware_ok = FALSE;
210 /* Gross hacks for the -bmalware option; perhaps we should just create
211 the scan directory normally for that case, but look into rigging up the
212 needed header variables if not already set on the command-line? */
213 extern int spool_mbox_ok;
214 extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
217 /* Some (currently avast only) use backslash escaped whitespace,
218 this function undoes these escapes */
225 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
226 for (p0 = p; *p0; ++p0) *p0 = p0[1];
229 /* --- malware_*_defer --- */
231 malware_panic_defer(const uschar * str)
233 log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
237 malware_log_defer(const uschar * str)
239 log_write(0, LOG_MAIN, "malware acl condition: %s", str);
242 /* --- m_*_defer --- */
244 m_panic_defer(struct scan * scanent, const uschar * hostport,
247 return malware_panic_defer(string_sprintf("%s %s : %s",
248 scanent->name, hostport ? hostport : CUS"", str));
251 m_log_defer(struct scan * scanent, const uschar * hostport,
254 return malware_log_defer(string_sprintf("%s %s : %s",
255 scanent->name, hostport ? hostport : CUS"", str));
257 /* --- m_*_defer_3 */
259 m_panic_defer_3(struct scan * scanent, const uschar * hostport,
260 const uschar * str, int fd_to_close)
262 (void) close(fd_to_close);
263 return m_panic_defer(scanent, hostport, str);
266 m_log_defer_3(struct scan * scanent, const uschar * hostport,
267 const uschar * str, int fd_to_close)
269 (void) close(fd_to_close);
270 return m_log_defer(scanent, hostport, str);
273 /*************************************************/
275 #ifndef DISABLE_MAL_CLAM
276 /* Only used by the Clamav code, which is working from a list of servers and
277 uses the returned in_addr to get a second connection to the same system.
280 m_tcpsocket(const uschar * hostname, unsigned int port,
281 host_item * host, uschar ** errstr, const blob * fastopen_blob)
283 return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
284 host, errstr, fastopen_blob);
289 m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
291 if (send(sock, buf, cnt, 0) < 0)
295 *errstr = string_sprintf("unable to send to socket (%s): %s",
303 m_pcre_compile(const uschar * re, uschar ** errstr)
305 const uschar * rerror;
309 cre = pcre_compile(CS re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
311 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
312 re, rerror, roffset);
317 m_pcre_exec(const pcre * cre, uschar * text)
320 int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
321 ovector, nelem(ovector));
322 uschar * substr = NULL;
323 if (i >= 2) /* Got it */
324 pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
329 m_pcre_nextinlist(const uschar ** list, int * sep,
330 char * listerr, uschar ** errstr)
332 const uschar * list_ele;
333 const pcre * cre = NULL;
335 if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
336 *errstr = US listerr;
339 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
340 string_printing(list_ele));
341 cre = m_pcre_compile(CUS list_ele, errstr);
347 Simple though inefficient wrapper for reading a line. Drop CRs and the
348 trailing newline. Can return early on buffer full. Null-terminate.
349 Apply initial timeout if no data ready.
351 Return: number of chars - zero for an empty line
353 -2 on timeout or error
356 recv_line(int fd, uschar * buffer, int bsize, int tmo)
362 if (!fd_ready(fd, tmo-time(NULL)))
365 /*XXX tmo handling assumes we always get a whole line */
368 while ((rcv = read(fd, p, 1)) > 0)
371 if (p-buffer > bsize-2) break;
372 if (*p == '\n') break;
377 DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
378 rcv==0 ? "EOF" : "error", strerror(errno));
379 return rcv==0 ? -1 : -2;
383 DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
387 /* return TRUE iff size as requested */
389 recv_len(int sock, void * buf, int size, int tmo)
391 return fd_ready(sock, tmo-time(NULL))
392 ? recv(sock, buf, size, 0) == size
398 #ifndef DISABLE_MAL_MKS
399 /* ============= private routines for the "mksd" scanner type ============== */
401 # include <sys/uio.h>
404 mksd_writev (int sock, struct iovec * iov, int iovcnt)
411 i = writev (sock, iov, iovcnt);
412 while (i < 0 && errno == EINTR);
415 (void) malware_panic_defer(
416 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
419 for (;;) /* check for short write */
420 if (i >= iov->iov_len)
430 iov->iov_base = CS iov->iov_base + i;
437 mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, int tmo)
444 i = ip_recv(sock, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL));
447 (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
452 /* offset == av_buffer_size -> buffer full */
453 if (offset == av_buffer_size)
455 (void) malware_panic_defer(US"malformed reply received from mksd");
458 } while (av_buffer[offset-1] != '\n');
460 av_buffer[offset] = '\0';
465 mksd_parse_line(struct scan * scanent, char * line)
476 if ((p = strchr (line, '\n')) != NULL)
478 return m_panic_defer(scanent, NULL,
479 string_sprintf("scanner failed: %s", line));
482 if ((p = strchr (line, '\n')) != NULL)
487 && (p = strchr(line+4, ' ')) != NULL
492 malware_name = string_copy(US line+4);
496 return m_panic_defer(scanent, NULL,
497 string_sprintf("malformed reply received: %s", line));
502 mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
506 const char *cmd = "MSQ\n";
507 uschar av_buffer[1024];
509 iov[0].iov_base = (void *) cmd;
511 iov[1].iov_base = (void *) scan_filename;
512 iov[1].iov_len = Ustrlen(scan_filename);
513 iov[2].iov_base = (void *) (cmd + 3);
516 if (mksd_writev (sock, iov, 3) < 0)
519 if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
522 return mksd_parse_line (scanent, CS av_buffer);
527 #ifndef DISABLE_MAL_CLAM
529 clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
534 while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
535 if (Ustrncmp(s, "retry=", 6) == 0)
537 int sec = readconf_readtime((s += 6), '\0', FALSE);
550 /*************************************************
551 * Scan content for malware *
552 *************************************************/
554 /* This is an internal interface for scanning an email; the normal interface
555 is via malware(), or there's malware_in_file() used for testing/debugging.
558 malware_re match condition for "malware="
559 scan_filename the file holding the email to be scanned, if we're faking
560 this up for the -bmalware test, else NULL
561 timeout if nonzero, non-default timeoutl
563 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
564 where true means malware was found (condition applies)
567 malware_internal(const uschar * malware_re, const uschar * scan_filename,
571 const uschar *av_scanner_work = av_scanner;
572 uschar *scanner_name;
573 unsigned long mbox_size;
577 struct scan * scanent;
578 const uschar * scanner_options;
581 uschar * eml_filename, * eml_dir;
584 return FAIL; /* empty means "don't match anything" */
586 /* Ensure the eml mbox file is spooled up */
588 if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
589 return malware_panic_defer(US"error while creating mbox spool file");
591 /* None of our current scanners need the mbox file as a stream (they use
592 the name), so we can close it right away. Get the directory too. */
594 (void) fclose(mbox_file);
595 eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
597 /* parse 1st option */
598 if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
599 return FAIL; /* explicitly no matching */
601 /* special cases (match anything except empty) */
602 if ( strcmpic(malware_re,US"true") == 0
603 || Ustrcmp(malware_re,"*") == 0
604 || Ustrcmp(malware_re,"1") == 0
607 if ( !malware_default_re
608 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
609 return malware_panic_defer(errstr);
610 malware_re = malware_regex_default;
611 re = malware_default_re;
614 /* compile the regex, see if it works */
615 else if (!(re = m_pcre_compile(malware_re, &errstr)))
616 return malware_panic_defer(errstr);
618 /* if av_scanner starts with a dollar, expand it first */
619 if (*av_scanner == '$')
621 if (!(av_scanner_work = expand_string(av_scanner)))
622 return malware_panic_defer(
623 string_sprintf("av_scanner starts with $, but expansion failed: %s",
624 expand_string_message));
627 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
628 /* disable result caching in this case */
633 /* Do not scan twice (unless av_scanner is dynamic). */
636 /* find the scanner type from the av_scanner option */
637 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
638 return malware_panic_defer(US"av_scanner configuration variable is empty");
639 if (!timeout) timeout = MALWARE_TIMEOUT;
640 tmo = time(NULL) + timeout;
642 for (scanent = m_scans; ; scanent++)
645 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
647 if (strcmpic(scanner_name, US scanent->name) != 0)
649 DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
650 scanner_name, readconf_printtime(timeout));
652 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
653 scanner_options = scanent->options_default;
654 if (scanent->conn == MC_NONE)
657 DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
658 switch(scanent->conn)
660 case MC_TCP: sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
661 case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr); break;
662 case MC_STRM: sock = ip_streamsocket(scanner_options, &errstr, 5); break;
663 default: /* compiler quietening */ break;
666 return m_panic_defer(scanent, CUS callout_address, errstr);
670 switch (scanent->scancode)
672 #ifndef DISABLE_MAL_FFROTD
673 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
675 uschar *fp_scan_option;
676 unsigned int detected=0, par_count=0;
677 uschar * scanrequest;
678 uschar buf[32768], *strhelper, *strhelper2;
679 uschar * malware_name_internal = NULL;
682 scanrequest = string_sprintf("GET %s", eml_filename);
684 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
687 scanrequest = string_sprintf("%s%s%s", scanrequest,
688 par_count ? "%20" : "?", fp_scan_option);
691 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
692 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
693 scanner_name, scanrequest);
695 /* send scan request */
696 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
697 return m_panic_defer(scanent, CUS callout_address, errstr);
699 while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0)
702 if (Ustrstr(buf, US"<detected type=\"") != NULL)
704 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
706 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
709 malware_name_internal = string_copy(strhelper+6);
712 else if (Ustrstr(buf, US"<summary code=\""))
714 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
715 ? malware_name_internal : NULL;
728 #ifndef DISABLE_MAL_FFROT6D
729 case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
734 uschar * scanrequest;
735 uschar av_buffer[1024];
737 if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
738 || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
739 return malware_panic_defer(errstr);
741 scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
742 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
743 scanner_name, scanrequest);
745 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
746 return m_panic_defer(scanent, CUS callout_address, errstr);
748 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
751 return m_panic_defer_3(scanent, CUS callout_address,
752 string_sprintf("unable to read from socket (%s)", strerror(errno)),
755 if (bread == sizeof(av_buffer))
756 return m_panic_defer_3(scanent, CUS callout_address,
757 US"buffer too small", sock);
759 av_buffer[bread] = '\0';
760 linebuffer = string_copy(av_buffer);
762 m_sock_send(sock, US"QUIT\n", 5, 0);
764 if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
765 return m_panic_defer_3(scanent, CUS callout_address,
766 string_sprintf("scanner reported error (%s)", e), sock);
768 if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
775 #ifndef DISABLE_MAL_DRWEB
776 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
777 /* v0.1 - added support for tcp sockets */
778 /* v0.0 - initial release -- support for unix sockets */
782 unsigned int fsize_uint;
783 uschar * tmpbuf, *drweb_fbuf;
784 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
785 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
787 /* prepare variables */
788 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
789 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
791 if (*scanner_options != '/')
794 if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
795 return m_panic_defer_3(scanent, NULL,
796 string_sprintf("can't open spool file %s: %s",
797 eml_filename, strerror(errno)),
800 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
803 badseek: err = errno;
804 (void)close(drweb_fd);
805 return m_panic_defer_3(scanent, NULL,
806 string_sprintf("can't seek spool file %s: %s",
807 eml_filename, strerror(err)),
810 fsize_uint = (unsigned int) fsize;
811 if ((off_t)fsize_uint != fsize)
813 (void)close(drweb_fd);
814 return m_panic_defer_3(scanent, NULL,
815 string_sprintf("seeking spool file %s, size overflow",
819 drweb_slen = htonl(fsize);
820 if (lseek(drweb_fd, 0, SEEK_SET) < 0)
823 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
824 scanner_name, scanner_options);
826 /* send scan request */
827 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
828 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
829 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
830 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
832 (void)close(drweb_fd);
833 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
834 "unable to send commands to socket (%s)", scanner_options),
838 if (!(drweb_fbuf = US malloc(fsize_uint)))
840 (void)close(drweb_fd);
841 return m_panic_defer_3(scanent, NULL,
842 string_sprintf("unable to allocate memory %u for file (%s)",
843 fsize_uint, eml_filename),
847 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
850 (void)close(drweb_fd);
852 return m_panic_defer_3(scanent, NULL,
853 string_sprintf("can't read spool file %s: %s",
854 eml_filename, strerror(err)),
857 (void)close(drweb_fd);
859 /* send file body to socket */
860 if (send(sock, drweb_fbuf, fsize, 0) < 0)
863 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
864 "unable to send file body to socket (%s)", scanner_options),
870 drweb_slen = htonl(Ustrlen(eml_filename));
872 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
873 scanner_name, scanner_options);
875 /* send scan request */
876 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
877 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
878 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
879 (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
880 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
881 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
882 "unable to send commands to socket (%s)", scanner_options),
886 /* wait for result */
887 if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo))
888 return m_panic_defer_3(scanent, CUS callout_address,
889 US"unable to read return code", sock);
890 drweb_rc = ntohl(drweb_rc);
892 if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
893 return m_panic_defer_3(scanent, CUS callout_address,
894 US"unable to read the number of viruses", sock);
895 drweb_vnum = ntohl(drweb_vnum);
897 /* "virus(es) found" if virus number is > 0 */
903 /* setup default virus name */
904 malware_name = US"unknown";
906 /* set up match regex */
908 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
910 /* read and concatenate virus names into one string */
911 for (i = 0; i < drweb_vnum; i++)
915 /* read the size of report */
916 if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo))
917 return m_panic_defer_3(scanent, CUS callout_address,
918 US"cannot read report size", sock);
919 drweb_slen = ntohl(drweb_slen);
920 tmpbuf = store_get(drweb_slen);
922 /* read report body */
923 if (!recv_len(sock, tmpbuf, drweb_slen, tmo))
924 return m_panic_defer_3(scanent, CUS callout_address,
925 US"cannot read report string", sock);
926 tmpbuf[drweb_slen] = '\0';
928 /* try matcher on the line, grab substring */
929 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
930 ovector, nelem(ovector));
933 const char * pre_malware_nb;
935 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
937 if (i==0) /* the first name we just copy to malware_name */
938 g = string_cat(NULL, US pre_malware_nb);
940 /*XXX could be string_append_listele? */
941 else /* concatenate each new virus name to previous */
942 g = string_append(g, 2, "/", pre_malware_nb);
944 pcre_free_substring(pre_malware_nb);
947 malware_name = string_from_gstring(g);
951 const char *drweb_s = NULL;
953 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
954 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
955 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
956 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
957 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
958 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
959 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
960 * and others are ignored */
962 return m_panic_defer_3(scanent, CUS callout_address,
963 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
973 #ifndef DISABLE_MAL_AVE
974 case M_AVES: /* "aveserver" scanner type -------------------------------- */
979 /* read aveserver's greeting and see if it is ready (2xx greeting) */
981 recv_line(sock, buf, sizeof(buf), tmo);
983 if (buf[0] != '2') /* aveserver is having problems */
984 return m_panic_defer_3(scanent, CUS callout_address,
985 string_sprintf("unavailable (Responded: %s).",
986 ((buf[0] != 0) ? buf : US "nothing") ),
989 /* prepare our command */
990 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
994 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
996 if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
997 return m_panic_defer(scanent, CUS callout_address, errstr);
1001 /* read response lines, find malware name and final response */
1002 while (recv_line(sock, buf, sizeof(buf), tmo) > 0)
1006 if (buf[0] == '5') /* aveserver is having problems */
1008 result = m_panic_defer(scanent, CUS callout_address,
1009 string_sprintf("unable to scan file %s (Responded: %s).",
1010 eml_filename, buf));
1013 if (Ustrncmp(buf,"322",3) == 0)
1015 uschar *p = Ustrchr(&buf[4], ' ');
1017 malware_name = string_copy(&buf[4]);
1021 if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0)
1022 return m_panic_defer(scanent, CUS callout_address, errstr);
1024 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1026 recv_line(sock, buf, sizeof(buf), tmo);
1028 if (buf[0] != '2') /* aveserver is having problems */
1029 return m_panic_defer_3(scanent, CUS callout_address,
1030 string_sprintf("unable to quit dialogue (Responded: %s).",
1031 ((buf[0] != 0) ? buf : US "nothing") ),
1034 if (result == DEFER)
1043 #ifndef DISABLE_MAL_FSECURE
1044 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
1046 int i, j, bread = 0;
1048 uschar av_buffer[1024];
1049 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
1050 US"CONFIGURE\tTIMEOUT\t0\n",
1051 US"CONFIGURE\tMAXARCH\t5\n",
1052 US"CONFIGURE\tMIME\t1\n" };
1054 malware_name = NULL;
1056 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1057 scanner_name, scanner_options);
1059 memset(av_buffer, 0, sizeof(av_buffer));
1060 for (i = 0; i != nelem(cmdopt); i++)
1063 if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
1064 return m_panic_defer(scanent, CUS callout_address, errstr);
1066 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1067 if (bread > 0) av_buffer[bread]='\0';
1069 return m_panic_defer_3(scanent, CUS callout_address,
1070 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
1072 for (j = 0; j < bread; j++)
1073 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
1077 /* pass the mailfile to fsecure */
1078 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
1080 if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0)
1081 return m_panic_defer(scanent, CUS callout_address, errstr);
1084 /* todo also SUSPICION\t */
1086 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
1088 /* read report, linewise. Apply a timeout as the Fsecure daemon
1089 sometimes wants an answer to "PING" but they won't tell us what */
1091 uschar * p = av_buffer;
1097 i = av_buffer+sizeof(av_buffer)-p;
1098 if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0)
1099 return m_panic_defer_3(scanent, CUS callout_address,
1100 string_sprintf("unable to read result (%s)", strerror(errno)),
1103 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
1107 /* Really search for virus again? */
1109 /* try matcher on the line, grab substring */
1110 malware_name = m_pcre_exec(fsec_re, p);
1112 if (Ustrstr(p, "OK\tScan ok."))
1116 /* copy down the trailing partial line then read another chunk */
1117 i = av_buffer+sizeof(av_buffer)-p;
1118 memmove(av_buffer, p, i);
1128 #ifndef DISABLE_MAL_KAV
1129 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
1132 uschar tmpbuf[1024];
1133 uschar * scanrequest;
1135 unsigned long kav_reportlen;
1140 /* get current date and time, build scan request */
1142 /* pdp note: before the eml_filename parameter, this scanned the
1143 directory; not finding documentation, so we'll strip off the directory.
1144 The side-effect is that the test framework scanning may end up in
1145 scanning more than was requested, but for the normal interface, this is
1148 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
1149 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
1150 p = Ustrrchr(scanrequest, '/');
1154 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1155 scanner_name, scanner_options);
1157 /* send scan request */
1158 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
1159 return m_panic_defer(scanent, CUS callout_address, errstr);
1161 /* wait for result */
1162 if (!recv_len(sock, tmpbuf, 2, tmo))
1163 return m_panic_defer_3(scanent, CUS callout_address,
1164 US"unable to read 2 bytes from socket.", sock);
1166 /* get errorcode from one nibble */
1167 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
1170 case 5: case 6: /* improper kavdaemon configuration */
1171 return m_panic_defer_3(scanent, CUS callout_address,
1172 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
1175 return m_panic_defer_3(scanent, CUS callout_address,
1176 US"reported 'scanning not completed' (code 1).", sock);
1178 return m_panic_defer_3(scanent, CUS callout_address,
1179 US"reported 'kavdaemon damaged' (code 7).", sock);
1182 /* code 8 is not handled, since it is ambiguous. It appears mostly on
1183 bounces where part of a file has been cut off */
1185 /* "virus found" return codes (2-4) */
1186 if (kav_rc > 1 && kav_rc < 5)
1188 int report_flag = 0;
1190 /* setup default virus name */
1191 malware_name = US"unknown";
1193 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
1195 /* read the report, if available */
1196 if (report_flag == 1)
1198 /* read report size */
1199 if (!recv_len(sock, &kav_reportlen, 4, tmo))
1200 return m_panic_defer_3(scanent, CUS callout_address,
1201 US"cannot read report size", sock);
1203 /* it's possible that avp returns av_buffer[1] == 1 but the
1204 reportsize is 0 (!?) */
1205 if (kav_reportlen > 0)
1207 /* set up match regex, depends on retcode */
1210 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1211 kav_re = kav_re_sus;
1215 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1216 kav_re = kav_re_inf;
1219 /* read report, linewise. Using size from stream to read amount of data
1220 from same stream is safe enough. */
1221 /* coverity[tainted_data] */
1222 while (kav_reportlen > 0)
1224 if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
1226 kav_reportlen -= bread+1;
1228 /* try matcher on the line, grab substring */
1229 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1235 else /* no virus found */
1236 malware_name = NULL;
1242 #ifndef DISABLE_MAL_CMDLINE
1243 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1245 const uschar *cmdline_scanner = scanner_options;
1246 const pcre *cmdline_trigger_re;
1247 const pcre *cmdline_regex_re;
1249 uschar * commandline;
1250 void (*eximsigchld)(int);
1251 void (*eximsigpipe)(int);
1252 FILE *scanner_out = NULL;
1254 FILE *scanner_record = NULL;
1255 uschar linebuffer[32767];
1260 if (!cmdline_scanner)
1261 return m_panic_defer(scanent, NULL, errstr);
1263 /* find scanner output trigger */
1264 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1265 "missing trigger specification", &errstr);
1266 if (!cmdline_trigger_re)
1267 return m_panic_defer(scanent, NULL, errstr);
1269 /* find scanner name regex */
1270 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1271 "missing virus name regex specification", &errstr);
1272 if (!cmdline_regex_re)
1273 return m_panic_defer(scanent, NULL, errstr);
1275 /* prepare scanner call; despite the naming, file_name holds a directory
1276 name which is documented as the value given to %s. */
1278 file_name = string_copy(eml_filename);
1279 p = Ustrrchr(file_name, '/');
1282 commandline = string_sprintf(CS cmdline_scanner, file_name);
1284 /* redirect STDERR too */
1285 commandline = string_sprintf("%s 2>&1", commandline);
1287 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1288 scanner_name, commandline);
1290 /* store exims signal handlers */
1291 eximsigchld = signal(SIGCHLD,SIG_DFL);
1292 eximsigpipe = signal(SIGPIPE,SIG_DFL);
1294 if (!(scanner_out = popen(CS commandline,"r")))
1297 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1298 return m_panic_defer(scanent, NULL,
1299 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1301 scanner_fd = fileno(scanner_out);
1303 file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
1305 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1308 (void) pclose(scanner_out);
1309 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1310 return m_panic_defer(scanent, NULL, string_sprintf(
1311 "opening scanner output file (%s) failed: %s.",
1312 file_name, strerror(err)));
1315 /* look for trigger while recording output */
1316 while ((rcnt = recv_line(scanner_fd, linebuffer,
1317 sizeof(linebuffer), tmo)))
1324 (void) pclose(scanner_out);
1325 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1326 return m_panic_defer(scanent, NULL, string_sprintf(
1327 "unable to read from scanner (%s): %s",
1328 commandline, strerror(err)));
1331 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1334 (void) pclose(scanner_out);
1335 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1336 return m_panic_defer(scanent, NULL, string_sprintf(
1337 "short write on scanner output file (%s).", file_name));
1339 putc('\n', scanner_record);
1340 /* try trigger match */
1342 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1347 (void)fclose(scanner_record);
1348 sep = pclose(scanner_out);
1349 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1351 return m_panic_defer(scanent, NULL,
1353 ? string_sprintf("running scanner failed: %s", strerror(sep))
1354 : string_sprintf("scanner returned error code: %d", sep));
1359 /* setup default virus name */
1360 malware_name = US"unknown";
1362 /* re-open the scanner output file, look for name match */
1363 scanner_record = fopen(CS file_name, "rb");
1364 while (fgets(CS linebuffer, sizeof(linebuffer), scanner_record))
1367 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
1370 (void)fclose(scanner_record);
1372 else /* no virus found */
1373 malware_name = NULL;
1378 #ifndef DISABLE_MAL_SOPHIE
1379 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1384 uschar av_buffer[1024];
1386 /* pass the scan directory to sophie */
1387 file_name = string_copy(eml_filename);
1388 if ((p = Ustrrchr(file_name, '/')))
1391 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1392 scanner_name, scanner_options);
1394 if ( write(sock, file_name, Ustrlen(file_name)) < 0
1395 || write(sock, "\n", 1) != 1
1397 return m_panic_defer_3(scanent, CUS callout_address,
1398 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
1401 /* wait for result */
1402 memset(av_buffer, 0, sizeof(av_buffer));
1403 if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
1404 return m_panic_defer_3(scanent, CUS callout_address,
1405 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
1409 if (av_buffer[0] == '1') {
1410 uschar * s = Ustrchr(av_buffer, '\n');
1413 malware_name = string_copy(&av_buffer[2]);
1415 else if (!strncmp(CS av_buffer, "-1", 2))
1416 return m_panic_defer_3(scanent, CUS callout_address,
1417 US"scanner reported error", sock);
1418 else /* all ok, no virus */
1419 malware_name = NULL;
1425 #ifndef DISABLE_MAL_CLAM
1426 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1428 /* This code was originally contributed by David Saez */
1429 /* There are three scanning methods available to us:
1430 * (1) Use the SCAN command, pointing to a file in the filesystem
1431 * (2) Use the STREAM command, send the data on a separate port
1432 * (3) Use the zINSTREAM command, send the data inline
1433 * The zINSTREAM command was introduced with ClamAV 0.95, which marked
1434 * STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1435 * In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
1436 * the TCP-connected daemon is actually local; otherwise we use zINSTREAM
1437 * See Exim bug 926 for details. */
1439 uschar *p, *vname, *result_tag;
1441 uschar av_buffer[1024];
1442 uschar *hostname = US"";
1444 uschar *clamav_fbuf;
1445 int clam_fd, result;
1447 unsigned int fsize_uint;
1448 BOOL use_scan_command = FALSE;
1449 clamd_address * cv[MAX_CLAMD_SERVERS];
1450 int num_servers = 0;
1451 uint32_t send_size, send_final_zeroblock;
1454 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1455 there's no reason we should not mix local and remote servers */
1457 if (*scanner_options == '/')
1460 const uschar * sublist;
1463 /* Local file; so we def want to use_scan_command and don't want to try
1464 * passing IP/port combinations */
1465 use_scan_command = TRUE;
1466 cd = (clamd_address *) store_get(sizeof(clamd_address));
1468 /* extract socket-path part */
1469 sublist = scanner_options;
1470 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1473 if (clamd_option(cd, sublist, &subsep) != OK)
1474 return m_panic_defer(scanent, NULL,
1475 string_sprintf("bad option '%s'", scanner_options));
1480 /* Go through the rest of the list of host/port and construct an array
1481 * of servers to try. The first one is the bit we just passed from
1482 * scanner_options so process that first and then scan the remainder of
1483 * the address buffer */
1487 const uschar * sublist;
1491 /* The 'local' option means use the SCAN command over the network
1492 * socket (ie common file storage in use) */
1493 /*XXX we could accept this also as a local option? */
1494 if (strcmpic(scanner_options, US"local") == 0)
1496 use_scan_command = TRUE;
1500 cd = (clamd_address *) store_get(sizeof(clamd_address));
1502 /* extract host and port part */
1503 sublist = scanner_options;
1504 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1506 (void) m_panic_defer(scanent, NULL,
1507 string_sprintf("missing address: '%s'", scanner_options));
1510 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
1512 (void) m_panic_defer(scanent, NULL,
1513 string_sprintf("missing port: '%s'", scanner_options));
1516 cd->tcp_port = atoi(CS s);
1519 /*XXX should these options be common over scanner types? */
1520 if (clamd_option(cd, sublist, &subsep) != OK)
1521 return m_panic_defer(scanent, NULL,
1522 string_sprintf("bad option '%s'", scanner_options));
1524 cv[num_servers++] = cd;
1525 if (num_servers >= MAX_CLAMD_SERVERS)
1527 (void) m_panic_defer(scanent, NULL,
1528 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1529 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1532 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1535 /* check if we have at least one server */
1537 return m_panic_defer(scanent, NULL,
1538 US"no useable server addresses in malware configuration option.");
1541 /* See the discussion of response formats below to see why we really
1542 don't like colons in filenames when passing filenames to ClamAV. */
1543 if (use_scan_command && Ustrchr(eml_filename, ':'))
1544 return m_panic_defer(scanent, NULL,
1545 string_sprintf("local/SCAN mode incompatible with" \
1546 " : in path to email filename [%s]", eml_filename));
1548 /* Set up the very first data we will be sending */
1549 if (!use_scan_command)
1550 { cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
1553 cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
1554 cmd_str.len = Ustrlen(cmd_str.data);
1557 /* We have some network servers specified */
1560 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1561 * only supports AF_INET, but we should probably be looking to the
1562 * future and rewriting this to be protocol-independent anyway. */
1564 while (num_servers > 0)
1566 int i = random_number(num_servers);
1567 clamd_address * cd = cv[i];
1569 DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
1570 cd->hostspec, cd->tcp_port);
1572 /* Lookup the host. This is to ensure that we connect to the same IP
1573 * on both connections (as one host could resolve to multiple ips) */
1576 if ((sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
1577 &connhost, &errstr, &cmd_str)) >= 0)
1579 /* Connection successfully established with a server */
1580 hostname = cd->hostspec;
1584 if (cd->retry <= 0) break;
1585 while (cd->retry > 0) cd->retry = sleep(cd->retry);
1590 (void) m_panic_defer(scanent, CUS callout_address, errstr);
1592 /* Remove the server from the list. XXX We should free the memory */
1594 for (; i < num_servers; i++)
1598 if (num_servers == 0)
1599 return m_panic_defer(scanent, NULL, US"all servers failed");
1604 if ((sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
1606 hostname = cv[0]->hostspec;
1609 if (cv[0]->retry <= 0)
1610 return m_panic_defer(scanent, CUS callout_address, errstr);
1611 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1614 /* have socket in variable "sock"; command to use is semi-independent of
1615 * the socket protocol. We use SCAN if is local (either Unix/local
1616 * domain socket, or explicitly told local) else we stream the data.
1617 * How we stream the data depends upon how we were built. */
1619 if (!use_scan_command)
1621 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1622 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1625 DEBUG(D_acl) debug_printf_indent(
1626 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1629 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1631 if (send(sock, cmd_str.data, cmd_str.len, 0) < 0)
1632 return m_panic_defer_3(scanent, CUS hostname,
1633 string_sprintf("unable to send zINSTREAM to socket (%s)",
1637 /* calc file size */
1638 if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0)
1641 return m_panic_defer_3(scanent, NULL,
1642 string_sprintf("can't open spool file %s: %s",
1643 eml_filename, strerror(err)),
1646 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1649 b_seek: err = errno;
1650 (void)close(clam_fd);
1651 return m_panic_defer_3(scanent, NULL,
1652 string_sprintf("can't seek spool file %s: %s",
1653 eml_filename, strerror(err)),
1656 fsize_uint = (unsigned int) fsize;
1657 if ((off_t)fsize_uint != fsize)
1659 (void)close(clam_fd);
1660 return m_panic_defer_3(scanent, NULL,
1661 string_sprintf("seeking spool file %s, size overflow",
1665 if (lseek(clam_fd, 0, SEEK_SET) < 0)
1668 if (!(clamav_fbuf = US malloc(fsize_uint)))
1670 (void)close(clam_fd);
1671 return m_panic_defer_3(scanent, NULL,
1672 string_sprintf("unable to allocate memory %u for file (%s)",
1673 fsize_uint, eml_filename),
1677 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1680 free(clamav_fbuf); (void)close(clam_fd);
1681 return m_panic_defer_3(scanent, NULL,
1682 string_sprintf("can't read spool file %s: %s",
1683 eml_filename, strerror(err)),
1686 (void)close(clam_fd);
1688 /* send file body to socket */
1689 send_size = htonl(fsize_uint);
1690 send_final_zeroblock = 0;
1691 if ((send(sock, &send_size, sizeof(send_size), 0) < 0) ||
1692 (send(sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1693 (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
1696 return m_panic_defer_3(scanent, NULL,
1697 string_sprintf("unable to send file body to socket (%s)", hostname),
1704 { /* use scan command */
1705 /* Send a SCAN command pointing to a filename; then in the then in the
1706 * scan-method-neutral part, read the response back */
1708 /* ================================================================= */
1710 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1711 which dates to when ClamAV needed us to break apart the email into the
1712 MIME parts (eg, with the now deprecated demime condition coming first).
1713 Some time back, ClamAV gained the ability to deconstruct the emails, so
1714 doing this would actually have resulted in the mail attachments being
1715 scanned twice, in the broken out files and from the original .eml.
1716 Since ClamAV now handles emails (and has for quite some time) we can
1717 just use the email file itself. */
1718 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
1720 DEBUG(D_acl) debug_printf_indent(
1721 "Malware scan: issuing %s local-path scan [%s]\n",
1722 scanner_name, scanner_options);
1725 if (send(sock, cmd_str.data, cmd_str.len, 0) < 0)
1726 return m_panic_defer_3(scanent, CUS callout_address,
1727 string_sprintf("unable to write to socket (%s)", strerror(errno)),
1730 /* Do not shut down the socket for writing; a user report noted that
1731 * clamd 0.70 does not react well to this. */
1733 /* Commands have been sent, no matter which scan method or connection
1734 * type we're using; now just read the result, independent of method. */
1736 /* Read the result */
1737 memset(av_buffer, 0, sizeof(av_buffer));
1738 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1743 return m_panic_defer(scanent, CUS callout_address,
1744 string_sprintf("unable to read from socket (%s)",
1745 errno == 0 ? "EOF" : strerror(errno)));
1747 if (bread == sizeof(av_buffer))
1748 return m_panic_defer(scanent, CUS callout_address,
1749 US"buffer too small");
1750 /* We're now assured of a NULL at the end of av_buffer */
1752 /* Check the result. ClamAV returns one of two result formats.
1753 In the basic mode, the response is of the form:
1754 infected: -> "<filename>: <virusname> FOUND"
1755 not-infected: -> "<filename>: OK"
1756 error: -> "<filename>: <errcode> ERROR
1757 If the ExtendedDetectionInfo option has been turned on, then we get:
1758 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1759 for the infected case. Compare:
1760 /tmp/eicar.com: Eicar-Test-Signature FOUND
1761 /tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1763 In the streaming case, clamd uses the filename "stream" which you should
1764 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1765 client app will replace "stream" with the original filename before returning
1766 results to stdout, but the trace shows the data).
1768 We will assume that the pathname passed to clamd from Exim does not contain
1769 a colon. We will have whined loudly above if the eml_filename does (and we're
1770 passing a filename to clamd). */
1773 return m_panic_defer(scanent, CUS callout_address,
1774 US"ClamAV returned null");
1776 /* strip newline at the end (won't be present for zINSTREAM)
1777 (also any trailing whitespace, which shouldn't exist, but we depend upon
1778 this below, so double-check) */
1779 p = av_buffer + Ustrlen(av_buffer) - 1;
1780 if (*p == '\n') *p = '\0';
1782 DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
1784 while (isspace(*--p) && (p > av_buffer))
1788 /* colon in returned output? */
1789 if(!(p = Ustrchr(av_buffer,':')))
1790 return m_panic_defer(scanent, CUS callout_address, string_sprintf(
1791 "ClamAV returned malformed result (missing colon): %s",
1794 /* strip filename */
1795 while (*p && isspace(*++p)) /**/;
1798 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1799 but we should at least be resistant to it. */
1800 p = Ustrrchr(vname, ' ');
1801 result_tag = p ? p+1 : vname;
1803 if (Ustrcmp(result_tag, "FOUND") == 0)
1805 /* p should still be the whitespace before the result_tag */
1806 while (isspace(*p)) --p;
1808 /* Strip off the extended information too, which will be in parens
1809 after the virus name, with no intervening whitespace. */
1812 /* "(hash:size)", so previous '(' will do; if not found, we have
1813 a curious virus name, but not an error. */
1814 p = Ustrrchr(vname, '(');
1818 malware_name = string_copy(vname);
1819 DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
1822 else if (Ustrcmp(result_tag, "ERROR") == 0)
1823 return m_panic_defer(scanent, CUS callout_address,
1824 string_sprintf("ClamAV returned: %s", av_buffer));
1826 else if (Ustrcmp(result_tag, "OK") == 0)
1828 /* Everything should be OK */
1829 malware_name = NULL;
1830 DEBUG(D_acl) debug_printf_indent("Malware not found\n");
1834 return m_panic_defer(scanent, CUS callout_address,
1835 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1841 #ifndef DISABLE_MAL_SOCK
1842 case M_SOCK: /* "sock" scanner type ------------------------------------- */
1843 /* This code was derived by Martin Poole from the clamd code contributed
1844 by David Saez and the cmdline code
1848 uschar * commandline;
1849 uschar av_buffer[1024];
1850 uschar * linebuffer;
1851 uschar * sockline_scanner;
1852 uschar sockline_scanner_default[] = "%s\n";
1853 const pcre *sockline_trig_re;
1854 const pcre *sockline_name_re;
1856 /* find scanner command line */
1857 if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1859 && *sockline_scanner
1861 { /* check for no expansions apart from one %s */
1862 uschar * s = Ustrchr(sockline_scanner, '%');
1864 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
1865 return m_panic_defer_3(scanent, NULL,
1866 US"unsafe sock scanner call spec", sock);
1869 sockline_scanner = sockline_scanner_default;
1870 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1871 string_printing(sockline_scanner));
1873 /* find scanner output trigger */
1874 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1875 "missing trigger specification", &errstr);
1876 if (!sockline_trig_re)
1877 return m_panic_defer_3(scanent, NULL, errstr, sock);
1879 /* find virus name regex */
1880 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1881 "missing virus name regex specification", &errstr);
1882 if (!sockline_name_re)
1883 return m_panic_defer_3(scanent, NULL, errstr, sock);
1885 /* prepare scanner call - security depends on expansions check above */
1886 commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
1887 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1888 string_printing(commandline));
1890 /* Pass the command string to the socket */
1891 if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
1892 return m_panic_defer(scanent, CUS callout_address, errstr);
1894 /* Read the result */
1895 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1898 return m_panic_defer_3(scanent, CUS callout_address,
1899 string_sprintf("unable to read from socket (%s)", strerror(errno)),
1902 if (bread == sizeof(av_buffer))
1903 return m_panic_defer_3(scanent, CUS callout_address,
1904 US"buffer too small", sock);
1905 av_buffer[bread] = '\0';
1906 linebuffer = string_copy(av_buffer);
1907 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1908 string_printing(linebuffer));
1910 /* try trigger match */
1911 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1913 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1914 malware_name = US "unknown";
1915 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1916 string_printing(malware_name));
1918 else /* no virus found */
1919 malware_name = NULL;
1924 #ifndef DISABLE_MAL_MKS
1925 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1927 char *mksd_options_end;
1928 int mksd_maxproc = 1; /* default, if no option supplied */
1931 if (scanner_options)
1933 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1934 if ( *scanner_options == '\0'
1935 || *mksd_options_end != '\0'
1937 || mksd_maxproc > 32
1939 return m_panic_defer(scanent, CUS callout_address,
1940 string_sprintf("invalid option '%s'", scanner_options));
1943 if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
1944 return m_panic_defer(scanent, CUS callout_address, errstr);
1946 malware_name = NULL;
1948 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
1950 if ((retval = mksd_scan_packed(scanent, sock, eml_filename, tmo)) != OK)
1959 #ifndef DISABLE_MAL_AVAST
1960 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1963 uschar * scanrequest;
1964 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
1966 uschar * error_message = NULL;
1967 BOOL more_data = FALSE;
1970 /* According to Martin Tuma @avast the protocol uses "escaped
1971 whitespace", that is, every embedded whitespace is backslash
1972 escaped, as well as backslash is protected by backslash.
1973 The returned lines contain the name of the scanned file, a tab
1977 [E] - some error occured
1978 Such marker follows the first non-escaped TAB. For more information
1979 see avast-protocol(5)
1981 We observed two cases:
1983 <- /file [E]0.0 Error 13 Permission denied
1984 <- 451 SCAN Engine error 13 permission denied
1987 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1989 <- /file… [+]2.0 0 Eicar Test Virus!!!
1992 If the scanner returns 4xx, DEFER is a good decision, combined
1993 with a panic log entry, to get the admin's attention.
1995 If the scanner returns 200, we reject it as malware, if found any,
1996 or, in case of an error, we set the malware message to the error
1999 Some of the >= 42000 errors are message related - usually some
2000 broken archives etc, but some of them are e.g. license related.
2001 Once the license expires the engine starts returning errors for
2002 every scanning attempt. I¹ have the full list of the error codes
2003 but it is not a public API and is subject to change. It is hard
2004 for me to say what you should do in case of an engine error. You
2005 can have a “Treat * unscanned file as infection” policy or “Treat
2006 unscanned file as clean” policy. ¹) Jakub Bednar
2010 if ( ( !ava_re_clean
2011 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
2013 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
2015 && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
2017 return malware_panic_defer(errstr);
2019 /* wait for result */
2020 for (avast_stage = AVA_HELO;
2021 (nread = recv_line(sock, buf, sizeof(buf), tmo)) > 0;
2024 int slen = Ustrlen(buf);
2028 /* Multi line responses are bracketed between 210 … and nnn … */
2029 if (Ustrncmp(buf, "210", 3) == 0)
2034 else if (more_data && isdigit(buf[0])) more_data = 0;
2036 switch (avast_stage)
2039 if (more_data) continue;
2040 if (Ustrncmp(buf, "220", 3) != 0)
2041 goto endloop; /* require a 220 */
2045 if (more_data) continue;
2046 if (Ustrncmp(buf, "200", 3) != 0)
2047 goto endloop; /* require a 200 */
2052 /* Check for another option to send. Newline-terminate it. */
2053 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
2056 if (Ustrcmp(scanrequest, "pass_unscanned") == 0)
2058 DEBUG(D_acl) debug_printf_indent("pass unscanned files as clean\n");
2062 scanrequest = string_sprintf("%s\n", scanrequest);
2063 avast_stage = AVA_OPT; /* just sent option */
2064 DEBUG(D_acl) debug_printf_indent("send to avast OPTION: %s", scanrequest);
2068 scanrequest = string_sprintf("SCAN %s\n", eml_dir);
2069 avast_stage = AVA_RSP; /* just sent command */
2070 DEBUG(D_acl) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir);
2073 /* send config-cmd or scan-request to socket */
2074 len = Ustrlen(scanrequest);
2075 if (send(sock, scanrequest, len, 0) == -1)
2077 scanrequest[len-1] = '\0';
2078 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
2079 "unable to send request '%s' to socket (%s): %s",
2080 scanrequest, scanner_options, strerror(errno)), sock);
2087 if (isdigit(buf[0])) /* We're done */
2090 if (malware_name) /* Nothing else matters, just read on */
2093 if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2096 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
2098 unescape(malware_name);
2100 debug_printf_indent("unescaped malware name: '%s'\n", malware_name);
2104 if (strict) /* treat scanner errors as malware */
2106 if ((malware_name = m_pcre_exec(ava_re_error, buf)))
2108 unescape(malware_name);
2110 debug_printf_indent("unescaped error message: '%s'\n", malware_name);
2114 else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2116 log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
2120 /* here also for any unexpected response from the scanner */
2121 DEBUG(D_acl) debug_printf("avast response not handled: '%s'\n", buf);
2125 default: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
2126 __FILE__, __LINE__, __FUNCTION__);
2133 if (nread == -1) error_message = US"EOF from scanner";
2134 else if (nread < 0) error_message = US"timeout from scanner";
2135 else if (nread == 0) error_message = US"got nothing from scanner";
2136 else if (buf[0] != '2') error_message = buf;
2138 DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n");
2139 if (send(sock, "QUIT\n", 5, 0) == -1)
2140 return m_panic_defer_3(scanent, CUS callout_address,
2141 string_sprintf("unable to send quit request to socket (%s): %s",
2142 scanner_options, strerror(errno)), sock);
2145 return m_panic_defer_3(scanent, CUS callout_address, error_message, sock);
2149 } /* scanner type switch */
2152 (void) close (sock);
2153 malware_ok = TRUE; /* set "been here, done that" marker */
2156 /* match virus name against pattern (caseless ------->----------v) */
2157 if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
2159 DEBUG(D_acl) debug_printf_indent(
2160 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
2168 /*************************************************
2169 * Scan an email for malware *
2170 *************************************************/
2172 /* This is the normal interface for scanning an email, which doesn't need a
2173 filename; it's a wrapper around the malware_file function.
2176 malware_re match condition for "malware="
2177 timeout if nonzero, timeout in seconds
2179 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2180 where true means malware was found (condition applies)
2183 malware(const uschar * malware_re, int timeout)
2185 int ret = malware_internal(malware_re, NULL, timeout);
2187 if (ret == DEFER) av_failed = TRUE;
2192 /*************************************************
2193 * Scan a file for malware *
2194 *************************************************/
2196 /* This is a test wrapper for scanning an email, which is not used in
2197 normal processing. Scan any file, using the Exim scanning interface.
2198 This function tampers with various global variables so is unsafe to use
2199 in any other context.
2202 eml_filename a file holding the message to be scanned
2204 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2205 where true means malware was found (condition applies)
2208 malware_in_file(uschar *eml_filename)
2210 uschar message_id_buf[64];
2213 /* spool_mbox() assumes various parameters exist, when creating
2214 the relevant directory and the email within */
2216 (void) string_format(message_id_buf, sizeof(message_id_buf),
2217 "dummy-%d", vaguely_random_number(INT_MAX));
2218 message_id = message_id_buf;
2219 sender_address = US"malware-sender@example.net";
2221 recipients_list = NULL;
2222 receive_add_recipient(US"malware-victim@example.net", -1);
2223 enable_dollar_recipients = TRUE;
2225 ret = malware_internal(US"*", eml_filename, 0);
2227 Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
2230 /* don't set no_mbox_unspool; at present, there's no way for it to become
2231 set, but if that changes, then it should apply to these tests too */
2235 /* silence static analysis tools */
2245 if (!malware_default_re)
2246 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
2248 #ifndef DISABLE_MAL_DRWEB
2250 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
2252 #ifndef DISABLE_MAL_FSECURE
2254 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
2256 #ifndef DISABLE_MAL_KAV
2258 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2260 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
2262 #ifndef DISABLE_MAL_AVAST
2264 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2266 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
2268 ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
2270 #ifndef DISABLE_MAL_FFROT6D
2271 if (!fprot6d_re_error)
2272 fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
2273 if (!fprot6d_re_virus)
2274 fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
2280 malware_show_supported(FILE * f)
2283 fprintf(f, "Malware:");
2284 for (sc = m_scans; sc->scancode != -1; sc++) fprintf(f, " %s", sc->name);
2289 # endif /*!MACRO_PREDEF*/
2290 #endif /*WITH_CONTENT_SCAN*/