1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
7 * Copyright (c) The Exim Maintainers 2015 - 2018
10 /* Code for calling virus (malware) scanners. Called from acl.c. */
13 #ifdef WITH_CONTENT_SCAN /* entire file */
16 #ifndef DISABLE_MAL_FFROTD
19 #ifndef DISABLE_MAL_FFROT6D
22 #ifndef DISABLE_MAL_DRWEB
25 #ifndef DISABLE_MAL_AVE
28 #ifndef DISABLE_MAL_FSECURE
31 #ifndef DISABLE_MAL_KAV
34 #ifndef DISABLE_MAL_SOPHIE
37 #ifndef DISABLE_MAL_CLAM
40 #ifndef DISABLE_MAL_MKS
43 #ifndef DISABLE_MAL_AVAST
46 #ifndef DISABLE_MAL_SOCK
49 #ifndef DISABLE_MAL_CMDLINE
53 typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
58 const uschar * options_default;
62 #ifndef DISABLE_MAL_FFROTD
63 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
65 #ifndef DISABLE_MAL_FFROT6D
66 { M_FPROT6D, US"f-prot6d", US"localhost 10200", MC_TCP },
68 #ifndef DISABLE_MAL_DRWEB
69 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
71 #ifndef DISABLE_MAL_AVE
72 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
74 #ifndef DISABLE_MAL_FSECURE
75 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
77 #ifndef DISABLE_MAL_KAV
78 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
80 #ifndef DISABLE_MAL_SOPHIE
81 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
83 #ifndef DISABLE_MAL_CLAM
84 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
86 #ifndef DISABLE_MAL_MKS
87 { M_MKSD, US"mksd", NULL, MC_NONE },
89 #ifndef DISABLE_MAL_AVAST
90 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
92 #ifndef DISABLE_MAL_SOCK
93 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
95 #ifndef DISABLE_MAL_CMDLINE
96 { M_CMDL, US"cmdline", NULL, MC_NONE },
98 { -1, NULL, NULL, MC_NONE } /* end-marker */
101 /******************************************************************************/
102 # ifdef MACRO_PREDEF /* build solely to predefine macros */
104 # include "macro_predef.h"
107 features_malware(void)
113 spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
115 for (const struct scan * sc = m_scans; sc->scancode != -1; sc++)
117 for (s = sc->name, t = buf+14; *s; s++) if (*s != '-')
120 builtin_macro_create(buf);
124 /******************************************************************************/
125 # else /*!MACRO_PREDEF, main build*/
128 #define MALWARE_TIMEOUT 120 /* default timeout, seconds */
130 static const uschar * malware_regex_default = US ".+";
131 static const pcre * malware_default_re = NULL;
135 #ifndef DISABLE_MAL_CLAM
136 /* The maximum number of clamd servers that are supported in the configuration */
137 # define MAX_CLAMD_SERVERS 32
138 # define MAX_CLAMD_SERVERS_S "32"
140 typedef struct clamd_address {
148 #ifndef DISABLE_MAL_DRWEB
149 # define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
150 # define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
151 # define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
153 # define DERR_READ_ERR (1<<0) /* read error */
154 # define DERR_NOMEMORY (1<<2) /* no memory */
155 # define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
156 # define DERR_BAD_CALL (1<<15) /* wrong command */
158 static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
159 static const pcre * drweb_re = NULL;
162 #ifndef DISABLE_MAL_FSECURE
163 static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
164 static const pcre * fsec_re = NULL;
167 #ifndef DISABLE_MAL_KAV
168 static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
169 static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
170 static const pcre * kav_re_sus = NULL;
171 static const pcre * kav_re_inf = NULL;
174 #ifndef DISABLE_MAL_AVAST
175 static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
176 static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
177 static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
178 static const pcre * ava_re_clean = NULL;
179 static const pcre * ava_re_virus = NULL;
180 static const pcre * ava_re_error = NULL;
183 #ifndef DISABLE_MAL_FFROT6D
184 static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
185 static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
186 static const pcre * fprot6d_re_error = NULL;
187 static const pcre * fprot6d_re_virus = NULL;
192 /******************************************************************************/
194 #ifndef DISABLE_MAL_KAV
195 /* Routine to check whether a system is big- or little-endian.
196 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
197 Needed for proper kavdaemon implementation. Sigh. */
198 # define BIG_MY_ENDIAN 0
199 # define LITTLE_MY_ENDIAN 1
200 static int test_byte_order(void);
204 short int word = 0x0001;
205 char *byte = CS &word;
206 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
210 BOOL malware_ok = FALSE;
212 /* Gross hacks for the -bmalware option; perhaps we should just create
213 the scan directory normally for that case, but look into rigging up the
214 needed header variables if not already set on the command-line? */
215 extern int spool_mbox_ok;
216 extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
219 /* Some (currently avast only) use backslash escaped whitespace,
220 this function undoes these escapes */
227 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
228 for (p0 = p; *p0; ++p0) *p0 = p0[1];
231 /* --- malware_*_defer --- */
233 malware_panic_defer(const uschar * str)
235 log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
239 malware_log_defer(const uschar * str)
241 log_write(0, LOG_MAIN, "malware acl condition: %s", str);
244 /* --- m_*_defer --- */
246 m_panic_defer(struct scan * scanent, const uschar * hostport,
249 return malware_panic_defer(string_sprintf("%s %s : %s",
250 scanent->name, hostport ? hostport : CUS"", str));
253 m_log_defer(struct scan * scanent, const uschar * hostport,
256 return malware_log_defer(string_sprintf("%s %s : %s",
257 scanent->name, hostport ? hostport : CUS"", str));
259 /* --- m_*_defer_3 */
261 m_panic_defer_3(struct scan * scanent, const uschar * hostport,
262 const uschar * str, int fd_to_close)
264 (void) close(fd_to_close);
265 return m_panic_defer(scanent, hostport, str);
268 /*************************************************/
270 #ifndef DISABLE_MAL_CLAM
271 /* Only used by the Clamav code, which is working from a list of servers and
272 uses the returned in_addr to get a second connection to the same system.
275 m_tcpsocket(const uschar * hostname, unsigned int port,
276 host_item * host, uschar ** errstr, const blob * fastopen_blob)
278 return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
279 host, errstr, fastopen_blob);
284 m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
286 if (send(sock, buf, cnt, 0) < 0)
290 *errstr = string_sprintf("unable to send to socket (%s): %s",
298 m_pcre_compile(const uschar * re, uschar ** errstr)
300 const uschar * rerror;
304 cre = pcre_compile(CS re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
306 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
307 re, rerror, roffset);
312 m_pcre_exec(const pcre * cre, uschar * text)
315 int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
316 ovector, nelem(ovector));
317 uschar * substr = NULL;
318 if (i >= 2) /* Got it */
319 pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
324 m_pcre_nextinlist(const uschar ** list, int * sep,
325 char * listerr, uschar ** errstr)
327 const uschar * list_ele;
328 const pcre * cre = NULL;
330 if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
331 *errstr = US listerr;
334 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
335 string_printing(list_ele));
336 cre = m_pcre_compile(CUS list_ele, errstr);
342 Simple though inefficient wrapper for reading a line. Drop CRs and the
343 trailing newline. Can return early on buffer full. Null-terminate.
344 Apply initial timeout if no data ready.
346 Return: number of chars - zero for an empty line
348 -2 on timeout or error
351 recv_line(int fd, uschar * buffer, int bsize, int tmo)
357 if (!fd_ready(fd, tmo-time(NULL)))
360 /*XXX tmo handling assumes we always get a whole line */
363 while ((rcv = read(fd, p, 1)) > 0)
366 if (p-buffer > bsize-2) break;
367 if (*p == '\n') break;
372 DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
373 rcv==0 ? "EOF" : "error", strerror(errno));
374 return rcv==0 ? -1 : -2;
378 DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
382 /* return TRUE iff size as requested */
384 recv_len(int sock, void * buf, int size, int tmo)
386 return fd_ready(sock, tmo-time(NULL))
387 ? recv(sock, buf, size, 0) == size
393 #ifndef DISABLE_MAL_MKS
394 /* ============= private routines for the "mksd" scanner type ============== */
396 # include <sys/uio.h>
399 mksd_writev (int sock, struct iovec * iov, int iovcnt)
406 i = writev (sock, iov, iovcnt);
407 while (i < 0 && errno == EINTR);
410 (void) malware_panic_defer(
411 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
414 for (;;) /* check for short write */
415 if (i >= iov->iov_len)
425 iov->iov_base = CS iov->iov_base + i;
432 mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, int tmo)
434 client_conn_ctx cctx = {.sock = sock};
440 i = ip_recv(&cctx, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL));
443 (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
448 /* offset == av_buffer_size -> buffer full */
449 if (offset == av_buffer_size)
451 (void) malware_panic_defer(US"malformed reply received from mksd");
454 } while (av_buffer[offset-1] != '\n');
456 av_buffer[offset] = '\0';
461 mksd_parse_line(struct scan * scanent, char * line)
472 if ((p = strchr (line, '\n')) != NULL)
474 return m_panic_defer(scanent, NULL,
475 string_sprintf("scanner failed: %s", line));
478 if ((p = strchr (line, '\n')) != NULL)
483 && (p = strchr(line+4, ' ')) != NULL
488 malware_name = string_copy(US line+4);
492 return m_panic_defer(scanent, NULL,
493 string_sprintf("malformed reply received: %s", line));
498 mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
502 const char *cmd = "MSQ\n";
503 uschar av_buffer[1024];
505 iov[0].iov_base = (void *) cmd;
507 iov[1].iov_base = (void *) scan_filename;
508 iov[1].iov_len = Ustrlen(scan_filename);
509 iov[2].iov_base = (void *) (cmd + 3);
512 if (mksd_writev (sock, iov, 3) < 0)
515 if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
518 return mksd_parse_line (scanent, CS av_buffer);
523 #ifndef DISABLE_MAL_CLAM
525 clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
530 while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
531 if (Ustrncmp(s, "retry=", 6) == 0)
533 int sec = readconf_readtime((s += 6), '\0', FALSE);
546 /*************************************************
547 * Scan content for malware *
548 *************************************************/
550 /* This is an internal interface for scanning an email; the normal interface
551 is via malware(), or there's malware_in_file() used for testing/debugging.
554 malware_re match condition for "malware="
555 scan_filename the file holding the email to be scanned, if we're faking
556 this up for the -bmalware test, else NULL
557 timeout if nonzero, non-default timeoutl
559 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
560 where true means malware was found (condition applies)
563 malware_internal(const uschar * malware_re, const uschar * scan_filename,
567 const uschar *av_scanner_work = av_scanner;
568 uschar *scanner_name;
569 unsigned long mbox_size;
573 struct scan * scanent;
574 const uschar * scanner_options;
575 client_conn_ctx malware_daemon_ctx = {.sock = -1};
577 uschar * eml_filename, * eml_dir;
580 return FAIL; /* empty means "don't match anything" */
582 /* Ensure the eml mbox file is spooled up */
584 if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
585 return malware_panic_defer(US"error while creating mbox spool file");
587 /* None of our current scanners need the mbox file as a stream (they use
588 the name), so we can close it right away. Get the directory too. */
590 (void) fclose(mbox_file);
591 eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
593 /* parse 1st option */
594 if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
595 return FAIL; /* explicitly no matching */
597 /* special cases (match anything except empty) */
598 if ( strcmpic(malware_re,US"true") == 0
599 || Ustrcmp(malware_re,"*") == 0
600 || Ustrcmp(malware_re,"1") == 0
603 if ( !malware_default_re
604 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
605 return malware_panic_defer(errstr);
606 malware_re = malware_regex_default;
607 re = malware_default_re;
610 /* compile the regex, see if it works */
611 else if (!(re = m_pcre_compile(malware_re, &errstr)))
612 return malware_panic_defer(errstr);
614 /* if av_scanner starts with a dollar, expand it first */
615 if (*av_scanner == '$')
617 if (!(av_scanner_work = expand_string(av_scanner)))
618 return malware_panic_defer(
619 string_sprintf("av_scanner starts with $, but expansion failed: %s",
620 expand_string_message));
623 debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
624 /* disable result caching in this case */
629 /* Do not scan twice (unless av_scanner is dynamic). */
632 /* find the scanner type from the av_scanner option */
633 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
634 return malware_panic_defer(US"av_scanner configuration variable is empty");
635 if (!timeout) timeout = MALWARE_TIMEOUT;
636 tmo = time(NULL) + timeout;
638 for (scanent = m_scans; ; scanent++)
641 return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
643 if (strcmpic(scanner_name, US scanent->name) != 0)
645 DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
646 scanner_name, readconf_printtime(timeout));
648 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
649 scanner_options = scanent->options_default;
650 if (scanent->conn == MC_NONE)
653 DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
654 switch(scanent->conn)
657 malware_daemon_ctx.sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
659 malware_daemon_ctx.sock = ip_unixsocket(scanner_options, &errstr); break;
661 malware_daemon_ctx.sock = ip_streamsocket(scanner_options, &errstr, 5); break;
663 /* compiler quietening */ break;
665 if (malware_daemon_ctx.sock < 0)
666 return m_panic_defer(scanent, CUS callout_address, errstr);
670 switch (scanent->scancode)
672 #ifndef DISABLE_MAL_FFROTD
673 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
675 uschar *fp_scan_option;
676 unsigned int detected=0, par_count=0;
677 uschar * scanrequest;
678 uschar buf[32768], *strhelper, *strhelper2;
679 uschar * malware_name_internal = NULL;
682 scanrequest = string_sprintf("GET %s", eml_filename);
684 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
687 scanrequest = string_sprintf("%s%s%s", scanrequest,
688 par_count ? "%20" : "?", fp_scan_option);
691 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
692 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
693 scanner_name, scanrequest);
695 /* send scan request */
696 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
697 return m_panic_defer(scanent, CUS callout_address, errstr);
699 while ((len = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) >= 0)
702 if (Ustrstr(buf, US"<detected type=\"") != NULL)
704 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
706 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
709 malware_name_internal = string_copy(strhelper+6);
712 else if (Ustrstr(buf, US"<summary code=\""))
714 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
715 ? malware_name_internal : NULL;
721 (void)close(malware_daemon_ctx.sock);
728 #ifndef DISABLE_MAL_FFROT6D
729 case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
734 uschar * scanrequest;
735 uschar av_buffer[1024];
737 if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
738 || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
739 return malware_panic_defer(errstr);
741 scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
742 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
743 scanner_name, scanrequest);
745 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
746 return m_panic_defer(scanent, CUS callout_address, errstr);
748 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
751 return m_panic_defer_3(scanent, CUS callout_address,
752 string_sprintf("unable to read from socket (%s)", strerror(errno)),
753 malware_daemon_ctx.sock);
755 if (bread == sizeof(av_buffer))
756 return m_panic_defer_3(scanent, CUS callout_address,
757 US"buffer too small", malware_daemon_ctx.sock);
759 av_buffer[bread] = '\0';
760 linebuffer = string_copy(av_buffer);
762 m_sock_send(malware_daemon_ctx.sock, US"QUIT\n", 5, 0);
764 if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
765 return m_panic_defer_3(scanent, CUS callout_address,
766 string_sprintf("scanner reported error (%s)", e), malware_daemon_ctx.sock);
768 if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
775 #ifndef DISABLE_MAL_DRWEB
776 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
777 /* v0.1 - added support for tcp sockets */
778 /* v0.0 - initial release -- support for unix sockets */
782 unsigned int fsize_uint;
783 uschar * tmpbuf, *drweb_fbuf;
784 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
785 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
787 /* prepare variables */
788 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
789 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
791 if (*scanner_options != '/')
794 if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
795 return m_panic_defer_3(scanent, NULL,
796 string_sprintf("can't open spool file %s: %s",
797 eml_filename, strerror(errno)),
798 malware_daemon_ctx.sock);
800 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
803 badseek: err = errno;
804 (void)close(drweb_fd);
805 return m_panic_defer_3(scanent, NULL,
806 string_sprintf("can't seek spool file %s: %s",
807 eml_filename, strerror(err)),
808 malware_daemon_ctx.sock);
810 fsize_uint = (unsigned int) fsize;
811 if ((off_t)fsize_uint != fsize)
813 (void)close(drweb_fd);
814 return m_panic_defer_3(scanent, NULL,
815 string_sprintf("seeking spool file %s, size overflow",
817 malware_daemon_ctx.sock);
819 drweb_slen = htonl(fsize);
820 if (lseek(drweb_fd, 0, SEEK_SET) < 0)
823 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
824 scanner_name, scanner_options);
826 /* send scan request */
827 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
828 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
829 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
830 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
832 (void)close(drweb_fd);
833 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
834 "unable to send commands to socket (%s)", scanner_options),
835 malware_daemon_ctx.sock);
838 if (!(drweb_fbuf = US malloc(fsize_uint)))
840 (void)close(drweb_fd);
841 return m_panic_defer_3(scanent, NULL,
842 string_sprintf("unable to allocate memory %u for file (%s)",
843 fsize_uint, eml_filename),
844 malware_daemon_ctx.sock);
847 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
850 (void)close(drweb_fd);
852 return m_panic_defer_3(scanent, NULL,
853 string_sprintf("can't read spool file %s: %s",
854 eml_filename, strerror(err)),
855 malware_daemon_ctx.sock);
857 (void)close(drweb_fd);
859 /* send file body to socket */
860 if (send(malware_daemon_ctx.sock, drweb_fbuf, fsize, 0) < 0)
863 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
864 "unable to send file body to socket (%s)", scanner_options),
865 malware_daemon_ctx.sock);
870 drweb_slen = htonl(Ustrlen(eml_filename));
872 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
873 scanner_name, scanner_options);
875 /* send scan request */
876 if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
877 (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
878 (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
879 (send(malware_daemon_ctx.sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
880 (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
881 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
882 "unable to send commands to socket (%s)", scanner_options),
883 malware_daemon_ctx.sock);
886 /* wait for result */
887 if (!recv_len(malware_daemon_ctx.sock, &drweb_rc, sizeof(drweb_rc), tmo))
888 return m_panic_defer_3(scanent, CUS callout_address,
889 US"unable to read return code", malware_daemon_ctx.sock);
890 drweb_rc = ntohl(drweb_rc);
892 if (!recv_len(malware_daemon_ctx.sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
893 return m_panic_defer_3(scanent, CUS callout_address,
894 US"unable to read the number of viruses", malware_daemon_ctx.sock);
895 drweb_vnum = ntohl(drweb_vnum);
897 /* "virus(es) found" if virus number is > 0 */
902 /* setup default virus name */
903 malware_name = US"unknown";
905 /* set up match regex */
907 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
909 /* read and concatenate virus names into one string */
910 for (int i = 0; i < drweb_vnum; i++)
914 /* read the size of report */
915 if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
916 return m_panic_defer_3(scanent, CUS callout_address,
917 US"cannot read report size", malware_daemon_ctx.sock);
918 drweb_slen = ntohl(drweb_slen);
919 tmpbuf = store_get(drweb_slen);
921 /* read report body */
922 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
923 return m_panic_defer_3(scanent, CUS callout_address,
924 US"cannot read report string", malware_daemon_ctx.sock);
925 tmpbuf[drweb_slen] = '\0';
927 /* try matcher on the line, grab substring */
928 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
929 ovector, nelem(ovector));
932 const char * pre_malware_nb;
934 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
936 if (i==0) /* the first name we just copy to malware_name */
937 g = string_cat(NULL, US pre_malware_nb);
939 /*XXX could be string_append_listele? */
940 else /* concatenate each new virus name to previous */
941 g = string_append(g, 2, "/", pre_malware_nb);
943 pcre_free_substring(pre_malware_nb);
946 malware_name = string_from_gstring(g);
950 const char *drweb_s = NULL;
952 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
953 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
954 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
955 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
956 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
957 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
958 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
959 * and others are ignored */
961 return m_panic_defer_3(scanent, CUS callout_address,
962 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
963 malware_daemon_ctx.sock);
972 #ifndef DISABLE_MAL_AVE
973 case M_AVES: /* "aveserver" scanner type -------------------------------- */
978 /* read aveserver's greeting and see if it is ready (2xx greeting) */
980 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
982 if (buf[0] != '2') /* aveserver is having problems */
983 return m_panic_defer_3(scanent, CUS callout_address,
984 string_sprintf("unavailable (Responded: %s).",
985 ((buf[0] != 0) ? buf : US "nothing") ),
986 malware_daemon_ctx.sock);
988 /* prepare our command */
989 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
993 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
995 if (m_sock_send(malware_daemon_ctx.sock, buf, Ustrlen(buf), &errstr) < 0)
996 return m_panic_defer(scanent, CUS callout_address, errstr);
1000 /* read response lines, find malware name and final response */
1001 while (recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo) > 0)
1005 if (buf[0] == '5') /* aveserver is having problems */
1007 result = m_panic_defer(scanent, CUS callout_address,
1008 string_sprintf("unable to scan file %s (Responded: %s).",
1009 eml_filename, buf));
1012 if (Ustrncmp(buf,"322",3) == 0)
1014 uschar *p = Ustrchr(&buf[4], ' ');
1016 malware_name = string_copy(&buf[4]);
1020 if (m_sock_send(malware_daemon_ctx.sock, US"quit\r\n", 6, &errstr) < 0)
1021 return m_panic_defer(scanent, CUS callout_address, errstr);
1023 /* read aveserver's greeting and see if it is ready (2xx greeting) */
1025 recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo);
1027 if (buf[0] != '2') /* aveserver is having problems */
1028 return m_panic_defer_3(scanent, CUS callout_address,
1029 string_sprintf("unable to quit dialogue (Responded: %s).",
1030 ((buf[0] != 0) ? buf : US "nothing") ),
1031 malware_daemon_ctx.sock);
1033 if (result == DEFER)
1035 (void)close(malware_daemon_ctx.sock);
1042 #ifndef DISABLE_MAL_FSECURE
1043 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
1047 uschar av_buffer[1024];
1048 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
1049 US"CONFIGURE\tTIMEOUT\t0\n",
1050 US"CONFIGURE\tMAXARCH\t5\n",
1051 US"CONFIGURE\tMIME\t1\n" };
1053 malware_name = NULL;
1055 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1056 scanner_name, scanner_options);
1058 memset(av_buffer, 0, sizeof(av_buffer));
1059 for (i = 0; i != nelem(cmdopt); i++)
1062 if (m_sock_send(malware_daemon_ctx.sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
1063 return m_panic_defer(scanent, CUS callout_address, errstr);
1065 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1066 if (bread > 0) av_buffer[bread]='\0';
1068 return m_panic_defer_3(scanent, CUS callout_address,
1069 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
1070 malware_daemon_ctx.sock);
1071 for (int j = 0; j < bread; j++)
1072 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
1076 /* pass the mailfile to fsecure */
1077 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
1079 if (m_sock_send(malware_daemon_ctx.sock, file_name, Ustrlen(file_name), &errstr) < 0)
1080 return m_panic_defer(scanent, CUS callout_address, errstr);
1083 /* todo also SUSPICION\t */
1085 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
1087 /* read report, linewise. Apply a timeout as the Fsecure daemon
1088 sometimes wants an answer to "PING" but they won't tell us what */
1090 uschar * p = av_buffer;
1096 i = av_buffer+sizeof(av_buffer)-p;
1097 if ((bread= ip_recv(&malware_daemon_ctx, p, i-1, tmo-time(NULL))) < 0)
1098 return m_panic_defer_3(scanent, CUS callout_address,
1099 string_sprintf("unable to read result (%s)", strerror(errno)),
1100 malware_daemon_ctx.sock);
1102 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
1106 /* Really search for virus again? */
1108 /* try matcher on the line, grab substring */
1109 malware_name = m_pcre_exec(fsec_re, p);
1111 if (Ustrstr(p, "OK\tScan ok."))
1115 /* copy down the trailing partial line then read another chunk */
1116 i = av_buffer+sizeof(av_buffer)-p;
1117 memmove(av_buffer, p, i);
1127 #ifndef DISABLE_MAL_KAV
1128 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
1131 uschar tmpbuf[1024];
1132 uschar * scanrequest;
1134 unsigned long kav_reportlen;
1139 /* get current date and time, build scan request */
1141 /* pdp note: before the eml_filename parameter, this scanned the
1142 directory; not finding documentation, so we'll strip off the directory.
1143 The side-effect is that the test framework scanning may end up in
1144 scanning more than was requested, but for the normal interface, this is
1147 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
1148 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
1149 p = Ustrrchr(scanrequest, '/');
1153 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1154 scanner_name, scanner_options);
1156 /* send scan request */
1157 if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
1158 return m_panic_defer(scanent, CUS callout_address, errstr);
1160 /* wait for result */
1161 if (!recv_len(malware_daemon_ctx.sock, tmpbuf, 2, tmo))
1162 return m_panic_defer_3(scanent, CUS callout_address,
1163 US"unable to read 2 bytes from socket.", malware_daemon_ctx.sock);
1165 /* get errorcode from one nibble */
1166 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
1169 case 5: case 6: /* improper kavdaemon configuration */
1170 return m_panic_defer_3(scanent, CUS callout_address,
1171 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
1172 malware_daemon_ctx.sock);
1174 return m_panic_defer_3(scanent, CUS callout_address,
1175 US"reported 'scanning not completed' (code 1).", malware_daemon_ctx.sock);
1177 return m_panic_defer_3(scanent, CUS callout_address,
1178 US"reported 'kavdaemon damaged' (code 7).", malware_daemon_ctx.sock);
1181 /* code 8 is not handled, since it is ambiguous. It appears mostly on
1182 bounces where part of a file has been cut off */
1184 /* "virus found" return codes (2-4) */
1185 if (kav_rc > 1 && kav_rc < 5)
1187 int report_flag = 0;
1189 /* setup default virus name */
1190 malware_name = US"unknown";
1192 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
1194 /* read the report, if available */
1195 if (report_flag == 1)
1197 /* read report size */
1198 if (!recv_len(malware_daemon_ctx.sock, &kav_reportlen, 4, tmo))
1199 return m_panic_defer_3(scanent, CUS callout_address,
1200 US"cannot read report size", malware_daemon_ctx.sock);
1202 /* it's possible that avp returns av_buffer[1] == 1 but the
1203 reportsize is 0 (!?) */
1204 if (kav_reportlen > 0)
1206 /* set up match regex, depends on retcode */
1209 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1210 kav_re = kav_re_sus;
1214 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1215 kav_re = kav_re_inf;
1218 /* read report, linewise. Using size from stream to read amount of data
1219 from same stream is safe enough. */
1220 /* coverity[tainted_data] */
1221 while (kav_reportlen > 0)
1223 if ((bread = recv_line(malware_daemon_ctx.sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
1225 kav_reportlen -= bread+1;
1227 /* try matcher on the line, grab substring */
1228 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1234 else /* no virus found */
1235 malware_name = NULL;
1241 #ifndef DISABLE_MAL_CMDLINE
1242 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1244 const uschar *cmdline_scanner = scanner_options;
1245 const pcre *cmdline_trigger_re;
1246 const pcre *cmdline_regex_re;
1248 uschar * commandline;
1249 void (*eximsigchld)(int);
1250 void (*eximsigpipe)(int);
1251 FILE *scanner_out = NULL;
1253 FILE *scanner_record = NULL;
1254 uschar linebuffer[32767];
1259 if (!cmdline_scanner)
1260 return m_panic_defer(scanent, NULL, errstr);
1262 /* find scanner output trigger */
1263 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1264 "missing trigger specification", &errstr);
1265 if (!cmdline_trigger_re)
1266 return m_panic_defer(scanent, NULL, errstr);
1268 /* find scanner name regex */
1269 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1270 "missing virus name regex specification", &errstr);
1271 if (!cmdline_regex_re)
1272 return m_panic_defer(scanent, NULL, errstr);
1274 /* prepare scanner call; despite the naming, file_name holds a directory
1275 name which is documented as the value given to %s. */
1277 file_name = string_copy(eml_filename);
1278 p = Ustrrchr(file_name, '/');
1281 commandline = string_sprintf(CS cmdline_scanner, file_name);
1283 /* redirect STDERR too */
1284 commandline = string_sprintf("%s 2>&1", commandline);
1286 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1287 scanner_name, commandline);
1289 /* store exims signal handlers */
1290 eximsigchld = signal(SIGCHLD,SIG_DFL);
1291 eximsigpipe = signal(SIGPIPE,SIG_DFL);
1293 if (!(scanner_out = popen(CS commandline,"r")))
1296 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1297 return m_panic_defer(scanent, NULL,
1298 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1300 scanner_fd = fileno(scanner_out);
1302 file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
1304 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1307 (void) pclose(scanner_out);
1308 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1309 return m_panic_defer(scanent, NULL, string_sprintf(
1310 "opening scanner output file (%s) failed: %s.",
1311 file_name, strerror(err)));
1314 /* look for trigger while recording output */
1315 while ((rcnt = recv_line(scanner_fd, linebuffer,
1316 sizeof(linebuffer), tmo)))
1323 (void) pclose(scanner_out);
1324 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1325 return m_panic_defer(scanent, NULL, string_sprintf(
1326 "unable to read from scanner (%s): %s",
1327 commandline, strerror(err)));
1330 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1333 (void) pclose(scanner_out);
1334 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1335 return m_panic_defer(scanent, NULL, string_sprintf(
1336 "short write on scanner output file (%s).", file_name));
1338 putc('\n', scanner_record);
1339 /* try trigger match */
1341 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1346 (void)fclose(scanner_record);
1347 sep = pclose(scanner_out);
1348 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1350 return m_panic_defer(scanent, NULL,
1352 ? string_sprintf("running scanner failed: %s", strerror(sep))
1353 : string_sprintf("scanner returned error code: %d", sep));
1358 /* setup default virus name */
1359 malware_name = US"unknown";
1361 /* re-open the scanner output file, look for name match */
1362 scanner_record = fopen(CS file_name, "rb");
1363 while (fgets(CS linebuffer, sizeof(linebuffer), scanner_record))
1366 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
1369 (void)fclose(scanner_record);
1371 else /* no virus found */
1372 malware_name = NULL;
1377 #ifndef DISABLE_MAL_SOPHIE
1378 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1383 uschar av_buffer[1024];
1385 /* pass the scan directory to sophie */
1386 file_name = string_copy(eml_filename);
1387 if ((p = Ustrrchr(file_name, '/')))
1390 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
1391 scanner_name, scanner_options);
1393 if ( write(malware_daemon_ctx.sock, file_name, Ustrlen(file_name)) < 0
1394 || write(malware_daemon_ctx.sock, "\n", 1) != 1
1396 return m_panic_defer_3(scanent, CUS callout_address,
1397 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
1398 malware_daemon_ctx.sock);
1400 /* wait for result */
1401 memset(av_buffer, 0, sizeof(av_buffer));
1402 if ((bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
1403 return m_panic_defer_3(scanent, CUS callout_address,
1404 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
1405 malware_daemon_ctx.sock);
1408 if (av_buffer[0] == '1') {
1409 uschar * s = Ustrchr(av_buffer, '\n');
1412 malware_name = string_copy(&av_buffer[2]);
1414 else if (!strncmp(CS av_buffer, "-1", 2))
1415 return m_panic_defer_3(scanent, CUS callout_address,
1416 US"scanner reported error", malware_daemon_ctx.sock);
1417 else /* all ok, no virus */
1418 malware_name = NULL;
1424 #ifndef DISABLE_MAL_CLAM
1425 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1427 /* This code was originally contributed by David Saez */
1428 /* There are three scanning methods available to us:
1429 * (1) Use the SCAN command, pointing to a file in the filesystem
1430 * (2) Use the STREAM command, send the data on a separate port
1431 * (3) Use the zINSTREAM command, send the data inline
1432 * The zINSTREAM command was introduced with ClamAV 0.95, which marked
1433 * STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1434 * In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
1435 * the TCP-connected daemon is actually local; otherwise we use zINSTREAM
1436 * See Exim bug 926 for details. */
1438 uschar *p, *vname, *result_tag;
1440 uschar av_buffer[1024];
1441 uschar *hostname = US"";
1443 uschar *clamav_fbuf;
1444 int clam_fd, result;
1446 unsigned int fsize_uint;
1447 BOOL use_scan_command = FALSE;
1448 clamd_address * cv[MAX_CLAMD_SERVERS];
1449 int num_servers = 0;
1450 uint32_t send_size, send_final_zeroblock;
1453 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1454 there's no reason we should not mix local and remote servers */
1456 if (*scanner_options == '/')
1459 const uschar * sublist;
1462 /* Local file; so we def want to use_scan_command and don't want to try
1463 * passing IP/port combinations */
1464 use_scan_command = TRUE;
1465 cd = (clamd_address *) store_get(sizeof(clamd_address));
1467 /* extract socket-path part */
1468 sublist = scanner_options;
1469 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1472 if (clamd_option(cd, sublist, &subsep) != OK)
1473 return m_panic_defer(scanent, NULL,
1474 string_sprintf("bad option '%s'", scanner_options));
1479 /* Go through the rest of the list of host/port and construct an array
1480 * of servers to try. The first one is the bit we just passed from
1481 * scanner_options so process that first and then scan the remainder of
1482 * the address buffer */
1486 const uschar * sublist;
1490 /* The 'local' option means use the SCAN command over the network
1491 * socket (ie common file storage in use) */
1492 /*XXX we could accept this also as a local option? */
1493 if (strcmpic(scanner_options, US"local") == 0)
1495 use_scan_command = TRUE;
1499 cd = (clamd_address *) store_get(sizeof(clamd_address));
1501 /* extract host and port part */
1502 sublist = scanner_options;
1503 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1505 (void) m_panic_defer(scanent, NULL,
1506 string_sprintf("missing address: '%s'", scanner_options));
1509 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
1511 (void) m_panic_defer(scanent, NULL,
1512 string_sprintf("missing port: '%s'", scanner_options));
1515 cd->tcp_port = atoi(CS s);
1518 /*XXX should these options be common over scanner types? */
1519 if (clamd_option(cd, sublist, &subsep) != OK)
1520 return m_panic_defer(scanent, NULL,
1521 string_sprintf("bad option '%s'", scanner_options));
1523 cv[num_servers++] = cd;
1524 if (num_servers >= MAX_CLAMD_SERVERS)
1526 (void) m_panic_defer(scanent, NULL,
1527 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1528 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1531 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1534 /* check if we have at least one server */
1536 return m_panic_defer(scanent, NULL,
1537 US"no useable server addresses in malware configuration option.");
1540 /* See the discussion of response formats below to see why we really
1541 don't like colons in filenames when passing filenames to ClamAV. */
1542 if (use_scan_command && Ustrchr(eml_filename, ':'))
1543 return m_panic_defer(scanent, NULL,
1544 string_sprintf("local/SCAN mode incompatible with" \
1545 " : in path to email filename [%s]", eml_filename));
1547 /* Set up the very first data we will be sending */
1548 if (!use_scan_command)
1549 { cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
1552 cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
1553 cmd_str.len = Ustrlen(cmd_str.data);
1556 /* We have some network servers specified */
1559 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1560 * only supports AF_INET, but we should probably be looking to the
1561 * future and rewriting this to be protocol-independent anyway. */
1563 while (num_servers > 0)
1565 int i = random_number(num_servers);
1566 clamd_address * cd = cv[i];
1568 DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
1569 cd->hostspec, cd->tcp_port);
1571 /* Lookup the host. This is to ensure that we connect to the same IP
1572 * on both connections (as one host could resolve to multiple ips) */
1575 /*XXX we trust that the cmd_str is ideempotent */
1576 if ((malware_daemon_ctx.sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
1577 &connhost, &errstr, &cmd_str)) >= 0)
1579 /* Connection successfully established with a server */
1580 hostname = cd->hostspec;
1584 if (cd->retry <= 0) break;
1585 while (cd->retry > 0) cd->retry = sleep(cd->retry);
1587 if (malware_daemon_ctx.sock >= 0)
1590 (void) m_panic_defer(scanent, CUS callout_address, errstr);
1592 /* Remove the server from the list. XXX We should free the memory */
1594 for (; i < num_servers; i++)
1598 if (num_servers == 0)
1599 return m_panic_defer(scanent, NULL, US"all servers failed");
1604 if ((malware_daemon_ctx.sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
1606 hostname = cv[0]->hostspec;
1609 if (cv[0]->retry <= 0)
1610 return m_panic_defer(scanent, CUS callout_address, errstr);
1611 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1614 /* have socket in variable "sock"; command to use is semi-independent of
1615 * the socket protocol. We use SCAN if is local (either Unix/local
1616 * domain socket, or explicitly told local) else we stream the data.
1617 * How we stream the data depends upon how we were built. */
1619 if (!use_scan_command)
1621 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1622 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1625 DEBUG(D_acl) debug_printf_indent(
1626 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1629 /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
1631 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
1632 return m_panic_defer_3(scanent, CUS hostname,
1633 string_sprintf("unable to send zINSTREAM to socket (%s)",
1635 malware_daemon_ctx.sock);
1637 /* calc file size */
1638 if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0)
1641 return m_panic_defer_3(scanent, NULL,
1642 string_sprintf("can't open spool file %s: %s",
1643 eml_filename, strerror(err)),
1644 malware_daemon_ctx.sock);
1646 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1649 b_seek: err = errno;
1650 (void)close(clam_fd);
1651 return m_panic_defer_3(scanent, NULL,
1652 string_sprintf("can't seek spool file %s: %s",
1653 eml_filename, strerror(err)),
1654 malware_daemon_ctx.sock);
1656 fsize_uint = (unsigned int) fsize;
1657 if ((off_t)fsize_uint != fsize)
1659 (void)close(clam_fd);
1660 return m_panic_defer_3(scanent, NULL,
1661 string_sprintf("seeking spool file %s, size overflow",
1663 malware_daemon_ctx.sock);
1665 if (lseek(clam_fd, 0, SEEK_SET) < 0)
1668 if (!(clamav_fbuf = US malloc(fsize_uint)))
1670 (void)close(clam_fd);
1671 return m_panic_defer_3(scanent, NULL,
1672 string_sprintf("unable to allocate memory %u for file (%s)",
1673 fsize_uint, eml_filename),
1674 malware_daemon_ctx.sock);
1677 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1680 free(clamav_fbuf); (void)close(clam_fd);
1681 return m_panic_defer_3(scanent, NULL,
1682 string_sprintf("can't read spool file %s: %s",
1683 eml_filename, strerror(err)),
1684 malware_daemon_ctx.sock);
1686 (void)close(clam_fd);
1688 /* send file body to socket */
1689 send_size = htonl(fsize_uint);
1690 send_final_zeroblock = 0;
1691 if ((send(malware_daemon_ctx.sock, &send_size, sizeof(send_size), 0) < 0) ||
1692 (send(malware_daemon_ctx.sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1693 (send(malware_daemon_ctx.sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
1696 return m_panic_defer_3(scanent, NULL,
1697 string_sprintf("unable to send file body to socket (%s)", hostname),
1698 malware_daemon_ctx.sock);
1704 { /* use scan command */
1705 /* Send a SCAN command pointing to a filename; then in the then in the
1706 * scan-method-neutral part, read the response back */
1708 /* ================================================================= */
1710 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1711 which dates to when ClamAV needed us to break apart the email into the
1712 MIME parts (eg, with the now deprecated demime condition coming first).
1713 Some time back, ClamAV gained the ability to deconstruct the emails, so
1714 doing this would actually have resulted in the mail attachments being
1715 scanned twice, in the broken out files and from the original .eml.
1716 Since ClamAV now handles emails (and has for quite some time) we can
1717 just use the email file itself. */
1718 /* Pass the string to ClamAV (7 = "SCAN \n" + \0), if not already sent */
1720 DEBUG(D_acl) debug_printf_indent(
1721 "Malware scan: issuing %s local-path scan [%s]\n",
1722 scanner_name, scanner_options);
1725 if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
1726 return m_panic_defer_3(scanent, CUS callout_address,
1727 string_sprintf("unable to write to socket (%s)", strerror(errno)),
1728 malware_daemon_ctx.sock);
1730 /* Do not shut down the socket for writing; a user report noted that
1731 * clamd 0.70 does not react well to this. */
1733 /* Commands have been sent, no matter which scan method or connection
1734 * type we're using; now just read the result, independent of method. */
1736 /* Read the result */
1737 memset(av_buffer, 0, sizeof(av_buffer));
1738 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1739 (void)close(malware_daemon_ctx.sock);
1740 malware_daemon_ctx.sock = -1;
1741 malware_daemon_ctx.tls_ctx = NULL;
1744 return m_panic_defer(scanent, CUS callout_address,
1745 string_sprintf("unable to read from socket (%s)",
1746 errno == 0 ? "EOF" : strerror(errno)));
1748 if (bread == sizeof(av_buffer))
1749 return m_panic_defer(scanent, CUS callout_address,
1750 US"buffer too small");
1751 /* We're now assured of a NULL at the end of av_buffer */
1753 /* Check the result. ClamAV returns one of two result formats.
1754 In the basic mode, the response is of the form:
1755 infected: -> "<filename>: <virusname> FOUND"
1756 not-infected: -> "<filename>: OK"
1757 error: -> "<filename>: <errcode> ERROR
1758 If the ExtendedDetectionInfo option has been turned on, then we get:
1759 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1760 for the infected case. Compare:
1761 /tmp/eicar.com: Eicar-Test-Signature FOUND
1762 /tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1764 In the streaming case, clamd uses the filename "stream" which you should
1765 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1766 client app will replace "stream" with the original filename before returning
1767 results to stdout, but the trace shows the data).
1769 We will assume that the pathname passed to clamd from Exim does not contain
1770 a colon. We will have whined loudly above if the eml_filename does (and we're
1771 passing a filename to clamd). */
1774 return m_panic_defer(scanent, CUS callout_address,
1775 US"ClamAV returned null");
1777 /* strip newline at the end (won't be present for zINSTREAM)
1778 (also any trailing whitespace, which shouldn't exist, but we depend upon
1779 this below, so double-check) */
1780 p = av_buffer + Ustrlen(av_buffer) - 1;
1781 if (*p == '\n') *p = '\0';
1783 DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
1785 while (isspace(*--p) && (p > av_buffer))
1789 /* colon in returned output? */
1790 if(!(p = Ustrchr(av_buffer,':')))
1791 return m_panic_defer(scanent, CUS callout_address, string_sprintf(
1792 "ClamAV returned malformed result (missing colon): %s",
1795 /* strip filename */
1796 while (*p && isspace(*++p)) /**/;
1799 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1800 but we should at least be resistant to it. */
1801 p = Ustrrchr(vname, ' ');
1802 result_tag = p ? p+1 : vname;
1804 if (Ustrcmp(result_tag, "FOUND") == 0)
1806 /* p should still be the whitespace before the result_tag */
1807 while (isspace(*p)) --p;
1809 /* Strip off the extended information too, which will be in parens
1810 after the virus name, with no intervening whitespace. */
1813 /* "(hash:size)", so previous '(' will do; if not found, we have
1814 a curious virus name, but not an error. */
1815 p = Ustrrchr(vname, '(');
1819 malware_name = string_copy(vname);
1820 DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
1823 else if (Ustrcmp(result_tag, "ERROR") == 0)
1824 return m_panic_defer(scanent, CUS callout_address,
1825 string_sprintf("ClamAV returned: %s", av_buffer));
1827 else if (Ustrcmp(result_tag, "OK") == 0)
1829 /* Everything should be OK */
1830 malware_name = NULL;
1831 DEBUG(D_acl) debug_printf_indent("Malware not found\n");
1835 return m_panic_defer(scanent, CUS callout_address,
1836 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1842 #ifndef DISABLE_MAL_SOCK
1843 case M_SOCK: /* "sock" scanner type ------------------------------------- */
1844 /* This code was derived by Martin Poole from the clamd code contributed
1845 by David Saez and the cmdline code
1849 uschar * commandline;
1850 uschar av_buffer[1024];
1851 uschar * linebuffer;
1852 uschar * sockline_scanner;
1853 uschar sockline_scanner_default[] = "%s\n";
1854 const pcre *sockline_trig_re;
1855 const pcre *sockline_name_re;
1857 /* find scanner command line */
1858 if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1860 && *sockline_scanner
1862 { /* check for no expansions apart from one %s */
1863 uschar * s = Ustrchr(sockline_scanner, '%');
1865 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
1866 return m_panic_defer_3(scanent, NULL,
1867 US"unsafe sock scanner call spec", malware_daemon_ctx.sock);
1870 sockline_scanner = sockline_scanner_default;
1871 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
1872 string_printing(sockline_scanner));
1874 /* find scanner output trigger */
1875 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1876 "missing trigger specification", &errstr);
1877 if (!sockline_trig_re)
1878 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
1880 /* find virus name regex */
1881 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1882 "missing virus name regex specification", &errstr);
1883 if (!sockline_name_re)
1884 return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
1886 /* prepare scanner call - security depends on expansions check above */
1887 commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
1888 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
1889 string_printing(commandline));
1891 /* Pass the command string to the socket */
1892 if (m_sock_send(malware_daemon_ctx.sock, commandline, Ustrlen(commandline), &errstr) < 0)
1893 return m_panic_defer(scanent, CUS callout_address, errstr);
1895 /* Read the result */
1896 bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1899 return m_panic_defer_3(scanent, CUS callout_address,
1900 string_sprintf("unable to read from socket (%s)", strerror(errno)),
1901 malware_daemon_ctx.sock);
1903 if (bread == sizeof(av_buffer))
1904 return m_panic_defer_3(scanent, CUS callout_address,
1905 US"buffer too small", malware_daemon_ctx.sock);
1906 av_buffer[bread] = '\0';
1907 linebuffer = string_copy(av_buffer);
1908 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
1909 string_printing(linebuffer));
1911 /* try trigger match */
1912 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1914 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1915 malware_name = US "unknown";
1916 DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
1917 string_printing(malware_name));
1919 else /* no virus found */
1920 malware_name = NULL;
1925 #ifndef DISABLE_MAL_MKS
1926 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1928 char *mksd_options_end;
1929 int mksd_maxproc = 1; /* default, if no option supplied */
1932 if (scanner_options)
1934 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1935 if ( *scanner_options == '\0'
1936 || *mksd_options_end != '\0'
1938 || mksd_maxproc > 32
1940 return m_panic_defer(scanent, CUS callout_address,
1941 string_sprintf("invalid option '%s'", scanner_options));
1944 if((malware_daemon_ctx.sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
1945 return m_panic_defer(scanent, CUS callout_address, errstr);
1947 malware_name = NULL;
1949 DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
1951 if ((retval = mksd_scan_packed(scanent, malware_daemon_ctx.sock, eml_filename, tmo)) != OK)
1953 close (malware_daemon_ctx.sock);
1960 #ifndef DISABLE_MAL_AVAST
1961 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1964 uschar * scanrequest;
1965 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
1967 uschar * error_message = NULL;
1968 BOOL more_data = FALSE;
1971 /* According to Martin Tuma @avast the protocol uses "escaped
1972 whitespace", that is, every embedded whitespace is backslash
1973 escaped, as well as backslash is protected by backslash.
1974 The returned lines contain the name of the scanned file, a tab
1978 [E] - some error occured
1979 Such marker follows the first non-escaped TAB. For more information
1980 see avast-protocol(5)
1982 We observed two cases:
1984 <- /file [E]0.0 Error 13 Permission denied
1985 <- 451 SCAN Engine error 13 permission denied
1988 <- /file… [E]3.0 Error 41120 The file is a decompression bomb
1990 <- /file… [+]2.0 0 Eicar Test Virus!!!
1993 If the scanner returns 4xx, DEFER is a good decision, combined
1994 with a panic log entry, to get the admin's attention.
1996 If the scanner returns 200, we reject it as malware, if found any,
1997 or, in case of an error, we set the malware message to the error
2000 Some of the >= 42000 errors are message related - usually some
2001 broken archives etc, but some of them are e.g. license related.
2002 Once the license expires the engine starts returning errors for
2003 every scanning attempt. I¹ have the full list of the error codes
2004 but it is not a public API and is subject to change. It is hard
2005 for me to say what you should do in case of an engine error. You
2006 can have a “Treat * unscanned file as infection” policy or “Treat
2007 unscanned file as clean” policy. ¹) Jakub Bednar
2011 if ( ( !ava_re_clean
2012 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
2014 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
2016 && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
2018 return malware_panic_defer(errstr);
2020 /* wait for result */
2021 for (avast_stage = AVA_HELO;
2022 (nread = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) > 0;
2025 int slen = Ustrlen(buf);
2029 /* Multi line responses are bracketed between 210 … and nnn … */
2030 if (Ustrncmp(buf, "210", 3) == 0)
2035 else if (more_data && isdigit(buf[0])) more_data = 0;
2037 switch (avast_stage)
2040 if (more_data) continue;
2041 if (Ustrncmp(buf, "220", 3) != 0)
2042 goto endloop; /* require a 220 */
2046 if (more_data) continue;
2047 if (Ustrncmp(buf, "200", 3) != 0)
2048 goto endloop; /* require a 200 */
2053 /* Check for another option to send. Newline-terminate it. */
2054 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
2057 if (Ustrcmp(scanrequest, "pass_unscanned") == 0)
2059 DEBUG(D_acl) debug_printf_indent("pass unscanned files as clean\n");
2063 scanrequest = string_sprintf("%s\n", scanrequest);
2064 avast_stage = AVA_OPT; /* just sent option */
2065 DEBUG(D_acl) debug_printf_indent("send to avast OPTION: %s", scanrequest);
2069 scanrequest = string_sprintf("SCAN %s\n", eml_dir);
2070 avast_stage = AVA_RSP; /* just sent command */
2071 DEBUG(D_acl) debug_printf_indent("send to avast REQUEST: SCAN %s\n", eml_dir);
2074 /* send config-cmd or scan-request to socket */
2075 len = Ustrlen(scanrequest);
2076 if (send(malware_daemon_ctx.sock, scanrequest, len, 0) == -1)
2078 scanrequest[len-1] = '\0';
2079 return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
2080 "unable to send request '%s' to socket (%s): %s",
2081 scanrequest, scanner_options, strerror(errno)), malware_daemon_ctx.sock);
2088 if (isdigit(buf[0])) /* We're done */
2091 if (malware_name) /* Nothing else matters, just read on */
2094 if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2097 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
2099 unescape(malware_name);
2101 debug_printf_indent("unescaped malware name: '%s'\n", malware_name);
2105 if (strict) /* treat scanner errors as malware */
2107 if ((malware_name = m_pcre_exec(ava_re_error, buf)))
2109 unescape(malware_name);
2111 debug_printf_indent("unescaped error message: '%s'\n", malware_name);
2115 else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
2117 log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
2121 /* here also for any unexpected response from the scanner */
2122 DEBUG(D_acl) debug_printf("avast response not handled: '%s'\n", buf);
2126 default: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
2127 __FILE__, __LINE__, __FUNCTION__);
2134 if (nread == -1) error_message = US"EOF from scanner";
2135 else if (nread < 0) error_message = US"timeout from scanner";
2136 else if (nread == 0) error_message = US"got nothing from scanner";
2137 else if (buf[0] != '2') error_message = buf;
2139 DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n");
2140 if (send(malware_daemon_ctx.sock, "QUIT\n", 5, 0) == -1)
2141 return m_panic_defer_3(scanent, CUS callout_address,
2142 string_sprintf("unable to send quit request to socket (%s): %s",
2143 scanner_options, strerror(errno)), malware_daemon_ctx.sock);
2146 return m_panic_defer_3(scanent, CUS callout_address, error_message, malware_daemon_ctx.sock);
2150 } /* scanner type switch */
2152 if (malware_daemon_ctx.sock >= 0)
2153 (void) close (malware_daemon_ctx.sock);
2154 malware_ok = TRUE; /* set "been here, done that" marker */
2157 /* match virus name against pattern (caseless ------->----------v) */
2158 if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
2160 DEBUG(D_acl) debug_printf_indent(
2161 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
2169 /*************************************************
2170 * Scan an email for malware *
2171 *************************************************/
2173 /* This is the normal interface for scanning an email, which doesn't need a
2174 filename; it's a wrapper around the malware_file function.
2177 malware_re match condition for "malware="
2178 timeout if nonzero, timeout in seconds
2180 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2181 where true means malware was found (condition applies)
2184 malware(const uschar * malware_re, int timeout)
2186 int ret = malware_internal(malware_re, NULL, timeout);
2188 if (ret == DEFER) av_failed = TRUE;
2193 /*************************************************
2194 * Scan a file for malware *
2195 *************************************************/
2197 /* This is a test wrapper for scanning an email, which is not used in
2198 normal processing. Scan any file, using the Exim scanning interface.
2199 This function tampers with various global variables so is unsafe to use
2200 in any other context.
2203 eml_filename a file holding the message to be scanned
2205 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
2206 where true means malware was found (condition applies)
2209 malware_in_file(uschar *eml_filename)
2211 uschar message_id_buf[64];
2214 /* spool_mbox() assumes various parameters exist, when creating
2215 the relevant directory and the email within */
2217 (void) string_format(message_id_buf, sizeof(message_id_buf),
2218 "dummy-%d", vaguely_random_number(INT_MAX));
2219 message_id = message_id_buf;
2220 sender_address = US"malware-sender@example.net";
2222 recipients_list = NULL;
2223 receive_add_recipient(US"malware-victim@example.net", -1);
2224 f.enable_dollar_recipients = TRUE;
2226 ret = malware_internal(US"*", eml_filename, 0);
2228 Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
2231 /* don't set no_mbox_unspool; at present, there's no way for it to become
2232 set, but if that changes, then it should apply to these tests too */
2236 /* silence static analysis tools */
2246 if (!malware_default_re)
2247 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
2249 #ifndef DISABLE_MAL_DRWEB
2251 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
2253 #ifndef DISABLE_MAL_FSECURE
2255 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
2257 #ifndef DISABLE_MAL_KAV
2259 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2261 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
2263 #ifndef DISABLE_MAL_AVAST
2265 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2267 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
2269 ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
2271 #ifndef DISABLE_MAL_FFROT6D
2272 if (!fprot6d_re_error)
2273 fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
2274 if (!fprot6d_re_virus)
2275 fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
2281 malware_show_supported(FILE * f)
2283 fprintf(f, "Malware:");
2284 for (struct scan * sc = m_scans; sc->scancode != (scanner_t)-1; sc++) fprintf(f, " %s", sc->name);
2289 # endif /*!MACRO_PREDEF*/
2290 #endif /*WITH_CONTENT_SCAN*/