1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015 */
8 /* Code for calling virus (malware) scanners. Called from acl.c. */
11 #ifdef WITH_CONTENT_SCAN
13 typedef enum {M_FPROTD, M_DRWEB, M_AVES, M_FSEC, M_KAVD, M_CMDL,
14 M_SOPHIE, M_CLAMD, M_SOCK, M_MKSD, M_AVAST} scanner_t;
15 typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
20 const uschar * options_default;
24 { M_FPROTD, US"f-protd", US"localhost 10200-10204", MC_TCP },
25 { M_DRWEB, US"drweb", US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
26 { M_AVES, US"aveserver", US"/var/run/aveserver", MC_UNIX },
27 { M_FSEC, US"fsecure", US"/var/run/.fsav", MC_UNIX },
28 { M_KAVD, US"kavdaemon", US"/var/run/AvpCtl", MC_UNIX },
29 { M_CMDL, US"cmdline", NULL, MC_NONE },
30 { M_SOPHIE, US"sophie", US"/var/run/sophie", MC_UNIX },
31 { M_CLAMD, US"clamd", US"/tmp/clamd", MC_NONE },
32 { M_SOCK, US"sock", US"/tmp/malware.sock", MC_STRM },
33 { M_MKSD, US"mksd", NULL, MC_NONE },
34 { M_AVAST, US"avast", US"/var/run/avast/scan.sock", MC_STRM },
35 { -1, NULL, NULL, MC_NONE } /* end-marker */
38 /* The maximum number of clamd servers that are supported in the configuration */
39 #define MAX_CLAMD_SERVERS 32
40 #define MAX_CLAMD_SERVERS_S "32"
42 typedef struct clamd_address {
49 # define nelements(arr) (sizeof(arr) / sizeof(arr[0]))
53 #define MALWARE_TIMEOUT 120 /* default timeout, seconds */
56 #define DRWEBD_SCAN_CMD (1) /* scan file, buffer or diskfile */
57 #define DRWEBD_RETURN_VIRUSES (1<<0) /* ask daemon return to us viruses names from report */
58 #define DRWEBD_IS_MAIL (1<<19) /* say to daemon that format is "archive MAIL" */
60 #define DERR_READ_ERR (1<<0) /* read error */
61 #define DERR_NOMEMORY (1<<2) /* no memory */
62 #define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
63 #define DERR_BAD_CALL (1<<15) /* wrong command */
66 static const uschar * malware_regex_default = US ".+";
67 static const pcre * malware_default_re = NULL;
69 static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
70 static const pcre * drweb_re = NULL;
72 static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
73 static const pcre * fsec_re = NULL;
75 static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
76 static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
77 static const pcre * kav_re_sus = NULL;
78 static const pcre * kav_re_inf = NULL;
80 static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
81 static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\s(.*)";
82 static const pcre * ava_re_clean = NULL;
83 static const pcre * ava_re_virus = NULL;
87 /******************************************************************************/
89 /* Routine to check whether a system is big- or little-endian.
90 Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
91 Needed for proper kavdaemon implementation. Sigh. */
92 #define BIG_MY_ENDIAN 0
93 #define LITTLE_MY_ENDIAN 1
94 static int test_byte_order(void);
98 short int word = 0x0001;
99 char *byte = (char *) &word;
100 return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
103 BOOL malware_ok = FALSE;
105 /* Gross hacks for the -bmalware option; perhaps we should just create
106 the scan directory normally for that case, but look into rigging up the
107 needed header variables if not already set on the command-line? */
108 extern int spool_mbox_ok;
109 extern uschar spooled_message_id[17];
114 malware_errlog_defer(const uschar * str)
116 log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str);
121 m_errlog_defer(struct scan * scanent, const uschar * hostport,
124 return malware_errlog_defer(string_sprintf("%s %s : %s",
125 scanent->name, hostport ? hostport : CUS"", str));
128 m_errlog_defer_3(struct scan * scanent, const uschar * hostport,
129 const uschar * str, int fd_to_close)
131 (void) close(fd_to_close);
132 return m_errlog_defer(scanent, hostport, str);
135 /*************************************************/
137 /* Only used by the Clamav code, which is working from a list of servers and
138 uses the returned in_addr to get a second connection to the same system.
141 m_tcpsocket(const uschar * hostname, unsigned int port,
142 host_item * host, uschar ** errstr)
144 return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5, host, errstr);
148 m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
150 if (send(sock, buf, cnt, 0) < 0)
154 *errstr = string_sprintf("unable to send to socket (%s): %s",
162 m_pcre_compile(const uschar * re, uschar ** errstr)
164 const uschar * rerror;
168 cre = pcre_compile(CS re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
170 *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
171 re, rerror, roffset);
176 m_pcre_exec(const pcre * cre, uschar * text)
179 int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
180 ovector, nelements(ovector));
181 uschar * substr = NULL;
182 if (i >= 2) /* Got it */
183 pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
188 m_pcre_nextinlist(const uschar ** list, int * sep,
189 char * listerr, uschar ** errstr)
191 const uschar * list_ele;
192 const pcre * cre = NULL;
194 if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
195 *errstr = US listerr;
197 cre = m_pcre_compile(CUS list_ele, errstr);
202 Simple though inefficient wrapper for reading a line. Drop CRs and the
203 trailing newline. Can return early on buffer full. Null-terminate.
204 Apply initial timeout if no data ready.
206 Return: number of chars - zero for an empty line
208 -2 on timeout or error
211 recv_line(int fd, uschar * buffer, int bsize, int tmo)
217 if (!fd_ready(fd, tmo-time(NULL)))
220 /*XXX tmo handling assumes we always get a whole line */
223 while ((rcv = read(fd, p, 1)) > 0)
226 if (p-buffer > bsize-2) break;
227 if (*p == '\n') break;
232 DEBUG(D_acl) debug_printf("Malware scan: read %s (%s)\n",
233 rcv==0 ? "EOF" : "error", strerror(errno));
234 return rcv==0 ? -1 : -2;
238 DEBUG(D_acl) debug_printf("Malware scan: read '%s'\n", buffer);
242 /* return TRUE iff size as requested */
244 recv_len(int sock, void * buf, int size, int tmo)
246 return fd_ready(sock, tmo-time(NULL))
247 ? recv(sock, buf, size, 0) == size
253 /* ============= private routines for the "mksd" scanner type ============== */
258 mksd_writev (int sock, struct iovec * iov, int iovcnt)
265 i = writev (sock, iov, iovcnt);
266 while (i < 0 && errno == EINTR);
269 (void) malware_errlog_defer(
270 US"unable to write to mksd UNIX socket (/var/run/mksd/socket)");
273 for (;;) /* check for short write */
274 if (i >= iov->iov_len)
284 iov->iov_base = CS iov->iov_base + i;
291 mksd_read_lines (int sock, uschar *av_buffer, int av_buffer_size, int tmo)
298 i = ip_recv(sock, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL));
301 (void) malware_errlog_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)");
306 /* offset == av_buffer_size -> buffer full */
307 if (offset == av_buffer_size)
309 (void) malware_errlog_defer(US"malformed reply received from mksd");
312 } while (av_buffer[offset-1] != '\n');
314 av_buffer[offset] = '\0';
319 mksd_parse_line(struct scan * scanent, char * line)
330 if ((p = strchr (line, '\n')) != NULL)
332 return m_errlog_defer(scanent, NULL,
333 string_sprintf("scanner failed: %s", line));
336 if ((p = strchr (line, '\n')) != NULL)
341 && (p = strchr(line+4, ' ')) != NULL
346 malware_name = string_copy(US line+4);
350 return m_errlog_defer(scanent, NULL,
351 string_sprintf("malformed reply received: %s", line));
356 mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
360 const char *cmd = "MSQ\n";
361 uschar av_buffer[1024];
363 iov[0].iov_base = (void *) cmd;
365 iov[1].iov_base = (void *) scan_filename;
366 iov[1].iov_len = Ustrlen(scan_filename);
367 iov[2].iov_base = (void *) (cmd + 3);
370 if (mksd_writev (sock, iov, 3) < 0)
373 if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
376 return mksd_parse_line (scanent, CS av_buffer);
381 clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
386 while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
387 if (Ustrncmp(s, "retry=", 6) == 0)
389 int sec = readconf_readtime((s += 6), '\0', FALSE);
399 /*************************************************
400 * Scan content for malware *
401 *************************************************/
403 /* This is an internal interface for scanning an email; the normal interface
404 is via malware(), or there's malware_in_file() used for testing/debugging.
407 malware_re match condition for "malware="
408 eml_filename the file holding the email to be scanned
409 timeout if nonzero, non-default timeoutl
410 faking whether or not we're faking this up for the -bmalware test
412 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
413 where true means malware was found (condition applies)
416 malware_internal(const uschar * malware_re, const uschar * eml_filename,
417 int timeout, BOOL faking)
420 const uschar *av_scanner_work = av_scanner;
421 uschar *scanner_name;
422 unsigned long mbox_size;
426 struct scan * scanent;
427 const uschar * scanner_options;
431 /* make sure the eml mbox file is spooled up */
432 if (!(mbox_file = spool_mbox(&mbox_size, faking ? eml_filename : NULL)))
433 return malware_errlog_defer(US"error while creating mbox spool file");
435 /* none of our current scanners need the mbox
436 file as a stream, so we can close it right away */
437 (void)fclose(mbox_file);
440 return FAIL; /* empty means "don't match anything" */
442 /* parse 1st option */
443 if ( (strcmpic(malware_re, US"false") == 0) ||
444 (Ustrcmp(malware_re,"0") == 0) )
445 return FAIL; /* explicitly no matching */
447 /* special cases (match anything except empty) */
448 if ( strcmpic(malware_re,US"true") == 0
449 || Ustrcmp(malware_re,"*") == 0
450 || Ustrcmp(malware_re,"1") == 0
453 if ( !malware_default_re
454 && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
455 return malware_errlog_defer(errstr);
456 malware_re = malware_regex_default;
457 re = malware_default_re;
460 /* compile the regex, see if it works */
461 else if (!(re = m_pcre_compile(malware_re, &errstr)))
462 return malware_errlog_defer(errstr);
464 /* Reset sep that is set by previous string_nextinlist() call */
467 /* if av_scanner starts with a dollar, expand it first */
468 if (*av_scanner == '$')
470 if (!(av_scanner_work = expand_string(av_scanner)))
471 return malware_errlog_defer(
472 string_sprintf("av_scanner starts with $, but expansion failed: %s",
473 expand_string_message));
476 debug_printf("Expanded av_scanner global: %s\n", av_scanner_work);
477 /* disable result caching in this case */
482 /* Do not scan twice (unless av_scanner is dynamic). */
485 /* find the scanner type from the av_scanner option */
486 if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
487 return malware_errlog_defer(US"av_scanner configuration variable is empty");
488 if (!timeout) timeout = MALWARE_TIMEOUT;
489 tmo = time(NULL) + timeout;
491 for (scanent = m_scans; ; scanent++)
494 return malware_errlog_defer(string_sprintf("unknown scanner type '%s'",
496 if (strcmpic(scanner_name, US scanent->name) != 0)
498 if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
499 scanner_options = scanent->options_default;
500 if (scanent->conn == MC_NONE)
502 switch(scanent->conn)
504 case MC_TCP: sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
505 case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr); break;
506 case MC_STRM: sock = ip_streamsocket(scanner_options, &errstr, 5); break;
507 default: /* compiler quietening */ break;
510 return m_errlog_defer(scanent, CUS callout_address, errstr);
513 DEBUG(D_acl) debug_printf("Malware scan: %s tmo %s\n", scanner_name, readconf_printtime(timeout));
515 switch (scanent->scancode)
517 case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
519 uschar *fp_scan_option;
520 unsigned int detected=0, par_count=0;
521 uschar * scanrequest;
522 uschar buf[32768], *strhelper, *strhelper2;
523 uschar * malware_name_internal = NULL;
526 scanrequest = string_sprintf("GET %s", eml_filename);
528 while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
531 scanrequest = string_sprintf("%s%s%s", scanrequest,
532 par_count ? "%20" : "?", fp_scan_option);
535 scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
536 DEBUG(D_acl) debug_printf("Malware scan: issuing %s: %s\n",
537 scanner_name, scanrequest);
539 /* send scan request */
540 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
541 return m_errlog_defer(scanent, CUS callout_address, errstr);
543 while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0)
546 if (Ustrstr(buf, US"<detected type=\"") != NULL)
548 else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
550 if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
553 malware_name_internal = string_copy(strhelper+6);
556 else if (Ustrstr(buf, US"<summary code=\""))
558 malware_name = Ustrstr(buf, US"<summary code=\"11\">")
559 ? malware_name_internal : NULL;
571 case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
572 /* v0.1 - added support for tcp sockets */
573 /* v0.0 - initial release -- support for unix sockets */
577 unsigned int fsize_uint;
578 uschar * tmpbuf, *drweb_fbuf;
579 int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
580 drweb_vnum, drweb_slen, drweb_fin = 0x0000;
582 /* prepare variables */
583 drweb_cmd = htonl(DRWEBD_SCAN_CMD);
584 drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
586 if (*scanner_options != '/')
589 if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
590 return m_errlog_defer_3(scanent, NULL,
591 string_sprintf("can't open spool file %s: %s",
592 eml_filename, strerror(errno)),
595 if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
598 (void)close(drweb_fd);
599 return m_errlog_defer_3(scanent, NULL,
600 string_sprintf("can't seek spool file %s: %s",
601 eml_filename, strerror(err)),
604 fsize_uint = (unsigned int) fsize;
605 if ((off_t)fsize_uint != fsize)
607 (void)close(drweb_fd);
608 return m_errlog_defer_3(scanent, NULL,
609 string_sprintf("seeking spool file %s, size overflow",
613 drweb_slen = htonl(fsize);
614 lseek(drweb_fd, 0, SEEK_SET);
616 DEBUG(D_acl) debug_printf("Malware scan: issuing %s remote scan [%s]\n",
617 scanner_name, scanner_options);
619 /* send scan request */
620 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
621 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
622 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
623 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
625 (void)close(drweb_fd);
626 return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
627 "unable to send commands to socket (%s)", scanner_options),
631 if (!(drweb_fbuf = (uschar *) malloc (fsize_uint)))
633 (void)close(drweb_fd);
634 return m_errlog_defer_3(scanent, NULL,
635 string_sprintf("unable to allocate memory %u for file (%s)",
636 fsize_uint, eml_filename),
640 if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
643 (void)close(drweb_fd);
645 return m_errlog_defer_3(scanent, NULL,
646 string_sprintf("can't read spool file %s: %s",
647 eml_filename, strerror(err)),
650 (void)close(drweb_fd);
652 /* send file body to socket */
653 if (send(sock, drweb_fbuf, fsize, 0) < 0)
656 return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
657 "unable to send file body to socket (%s)", scanner_options),
660 (void)close(drweb_fd);
664 drweb_slen = htonl(Ustrlen(eml_filename));
666 DEBUG(D_acl) debug_printf("Malware scan: issuing %s local scan [%s]\n",
667 scanner_name, scanner_options);
669 /* send scan request */
670 if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
671 (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
672 (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
673 (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
674 (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
675 return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
676 "unable to send commands to socket (%s)", scanner_options),
680 /* wait for result */
681 if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo))
682 return m_errlog_defer_3(scanent, CUS callout_address,
683 US"unable to read return code", sock);
684 drweb_rc = ntohl(drweb_rc);
686 if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
687 return m_errlog_defer_3(scanent, CUS callout_address,
688 US"unable to read the number of viruses", sock);
689 drweb_vnum = ntohl(drweb_vnum);
691 /* "virus(es) found" if virus number is > 0 */
696 /* setup default virus name */
697 malware_name = US"unknown";
699 /* set up match regex */
701 drweb_re = m_pcre_compile(drweb_re_str, &errstr);
703 /* read and concatenate virus names into one string */
704 for (i = 0; i < drweb_vnum; i++)
706 int size = 0, off = 0, ovector[10*3];
707 /* read the size of report */
708 if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo))
709 return m_errlog_defer_3(scanent, CUS callout_address,
710 US"cannot read report size", sock);
711 drweb_slen = ntohl(drweb_slen);
712 tmpbuf = store_get(drweb_slen);
714 /* read report body */
715 if (!recv_len(sock, tmpbuf, drweb_slen, tmo))
716 return m_errlog_defer_3(scanent, CUS callout_address,
717 US"cannot read report string", sock);
718 tmpbuf[drweb_slen] = '\0';
720 /* try matcher on the line, grab substring */
721 result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
722 ovector, nelements(ovector));
725 const char * pre_malware_nb;
727 pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
729 if (i==0) /* the first name we just copy to malware_name */
730 malware_name = string_append(NULL, &size, &off,
733 else /* concatenate each new virus name to previous */
734 malware_name = string_append(malware_name, &size, &off,
735 2, "/", pre_malware_nb);
737 pcre_free_substring(pre_malware_nb);
743 const char *drweb_s = NULL;
745 if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
746 if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
747 if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
748 if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
749 /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
750 * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
751 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
752 * and others are ignored */
754 return m_errlog_defer_3(scanent, CUS callout_address,
755 string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
764 case M_AVES: /* "aveserver" scanner type -------------------------------- */
769 /* read aveserver's greeting and see if it is ready (2xx greeting) */
771 recv_line(sock, buf, sizeof(buf), tmo);
773 if (buf[0] != '2') /* aveserver is having problems */
774 return m_errlog_defer_3(scanent, CUS callout_address,
775 string_sprintf("unavailable (Responded: %s).",
776 ((buf[0] != 0) ? buf : (uschar *)"nothing") ),
779 /* prepare our command */
780 (void)string_format(buf, sizeof(buf), "SCAN bPQRSTUW %s\r\n",
784 DEBUG(D_acl) debug_printf("Malware scan: issuing %s %s\n",
786 if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
787 return m_errlog_defer(scanent, CUS callout_address, errstr);
791 /* read response lines, find malware name and final response */
792 while (recv_line(sock, buf, sizeof(buf), tmo) > 0)
796 if (buf[0] == '5') /* aveserver is having problems */
798 result = m_errlog_defer(scanent, CUS callout_address,
799 string_sprintf("unable to scan file %s (Responded: %s).",
803 if (Ustrncmp(buf,"322",3) == 0)
805 uschar *p = Ustrchr(&buf[4], ' ');
807 malware_name = string_copy(&buf[4]);
811 if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0)
812 return m_errlog_defer(scanent, CUS callout_address, errstr);
814 /* read aveserver's greeting and see if it is ready (2xx greeting) */
816 recv_line(sock, buf, sizeof(buf), tmo);
818 if (buf[0] != '2') /* aveserver is having problems */
819 return m_errlog_defer_3(scanent, CUS callout_address,
820 string_sprintf("unable to quit dialogue (Responded: %s).",
821 ((buf[0] != 0) ? buf : (uschar *)"nothing") ),
832 case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
836 uschar av_buffer[1024];
837 static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
838 US"CONFIGURE\tTIMEOUT\t0\n",
839 US"CONFIGURE\tMAXARCH\t5\n",
840 US"CONFIGURE\tMIME\t1\n" };
844 DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
845 scanner_name, scanner_options);
847 memset(av_buffer, 0, sizeof(av_buffer));
848 for (i = 0; i != nelements(cmdopt); i++)
851 if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
852 return m_errlog_defer(scanent, CUS callout_address, errstr);
854 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
855 if (bread > 0) av_buffer[bread]='\0';
857 return m_errlog_defer_3(scanent, CUS callout_address,
858 string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
860 for (j = 0; j < bread; j++)
861 if (av_buffer[j] == '\r' || av_buffer[j] == '\n')
865 /* pass the mailfile to fsecure */
866 file_name = string_sprintf("SCAN\t%s\n", eml_filename);
868 if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0)
869 return m_errlog_defer(scanent, CUS callout_address, errstr);
872 /* todo also SUSPICION\t */
874 fsec_re = m_pcre_compile(fsec_re_str, &errstr);
876 /* read report, linewise. Apply a timeout as the Fsecure daemon
877 sometimes wants an answer to "PING" but they won't tell us what */
879 uschar * p = av_buffer;
885 i = av_buffer+sizeof(av_buffer)-p;
886 if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0)
887 return m_errlog_defer_3(scanent, CUS callout_address,
888 string_sprintf("unable to read result (%s)", strerror(errno)),
891 for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
895 /* Really search for virus again? */
897 /* try matcher on the line, grab substring */
898 malware_name = m_pcre_exec(fsec_re, p);
900 if (Ustrstr(p, "OK\tScan ok."))
904 /* copy down the trailing partial line then read another chunk */
905 i = av_buffer+sizeof(av_buffer)-p;
906 memmove(av_buffer, p, i);
915 case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
919 uschar * scanrequest;
921 unsigned long kav_reportlen, bread;
925 /* get current date and time, build scan request */
927 /* pdp note: before the eml_filename parameter, this scanned the
928 directory; not finding documentation, so we'll strip off the directory.
929 The side-effect is that the test framework scanning may end up in
930 scanning more than was requested, but for the normal interface, this is
933 strftime(CS tmpbuf, sizeof(tmpbuf), "%d %b %H:%M:%S", localtime(&t));
934 scanrequest = string_sprintf("<0>%s:%s", CS tmpbuf, eml_filename);
935 p = Ustrrchr(scanrequest, '/');
939 DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
940 scanner_name, scanner_options);
942 /* send scan request */
943 if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
944 return m_errlog_defer(scanent, CUS callout_address, errstr);
946 /* wait for result */
947 if (!recv_len(sock, tmpbuf, 2, tmo))
948 return m_errlog_defer_3(scanent, CUS callout_address,
949 US"unable to read 2 bytes from socket.", sock);
951 /* get errorcode from one nibble */
952 kav_rc = tmpbuf[ test_byte_order()==LITTLE_MY_ENDIAN ? 0 : 1 ] & 0x0F;
955 case 5: case 6: /* improper kavdaemon configuration */
956 return m_errlog_defer_3(scanent, CUS callout_address,
957 US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
960 return m_errlog_defer_3(scanent, CUS callout_address,
961 US"reported 'scanning not completed' (code 1).", sock);
963 return m_errlog_defer_3(scanent, CUS callout_address,
964 US"reported 'kavdaemon damaged' (code 7).", sock);
967 /* code 8 is not handled, since it is ambigous. It appears mostly on
968 bounces where part of a file has been cut off */
970 /* "virus found" return codes (2-4) */
971 if (kav_rc > 1 && kav_rc < 5)
975 /* setup default virus name */
976 malware_name = US"unknown";
978 report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
980 /* read the report, if available */
981 if (report_flag == 1)
983 /* read report size */
984 if (!recv_len(sock, &kav_reportlen, 4, tmo))
985 return m_errlog_defer_3(scanent, CUS callout_address,
986 US"cannot read report size", sock);
988 /* it's possible that avp returns av_buffer[1] == 1 but the
989 reportsize is 0 (!?) */
990 if (kav_reportlen > 0)
992 /* set up match regex, depends on retcode */
995 if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
1000 if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
1001 kav_re = kav_re_inf;
1004 /* read report, linewise */
1005 while (kav_reportlen > 0)
1007 if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
1009 kav_reportlen -= bread+1;
1011 /* try matcher on the line, grab substring */
1012 if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
1018 else /* no virus found */
1019 malware_name = NULL;
1024 case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
1026 const uschar *cmdline_scanner = scanner_options;
1027 const pcre *cmdline_trigger_re;
1028 const pcre *cmdline_regex_re;
1030 uschar * commandline;
1031 void (*eximsigchld)(int);
1032 void (*eximsigpipe)(int);
1033 FILE *scanner_out = NULL;
1035 FILE *scanner_record = NULL;
1036 uschar linebuffer[32767];
1041 if (!cmdline_scanner)
1042 return m_errlog_defer(scanent, NULL, errstr);
1044 /* find scanner output trigger */
1045 cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1046 "missing trigger specification", &errstr);
1047 if (!cmdline_trigger_re)
1048 return m_errlog_defer(scanent, NULL, errstr);
1050 /* find scanner name regex */
1051 cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1052 "missing virus name regex specification", &errstr);
1053 if (!cmdline_regex_re)
1054 return m_errlog_defer(scanent, NULL, errstr);
1056 /* prepare scanner call; despite the naming, file_name holds a directory
1057 name which is documented as the value given to %s. */
1059 file_name = string_copy(eml_filename);
1060 p = Ustrrchr(file_name, '/');
1063 commandline = string_sprintf(CS cmdline_scanner, file_name);
1065 /* redirect STDERR too */
1066 commandline = string_sprintf("%s 2>&1", commandline);
1068 DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
1069 scanner_name, commandline);
1071 /* store exims signal handlers */
1072 eximsigchld = signal(SIGCHLD,SIG_DFL);
1073 eximsigpipe = signal(SIGPIPE,SIG_DFL);
1075 if (!(scanner_out = popen(CS commandline,"r")))
1078 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1079 return m_errlog_defer(scanent, NULL,
1080 string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
1082 scanner_fd = fileno(scanner_out);
1084 file_name = string_sprintf("%s/scan/%s/%s_scanner_output",
1085 spool_directory, message_id, message_id);
1087 if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
1090 (void) pclose(scanner_out);
1091 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1092 return m_errlog_defer(scanent, NULL, string_sprintf(
1093 "opening scanner output file (%s) failed: %s.",
1094 file_name, strerror(err)));
1097 /* look for trigger while recording output */
1098 while ((rcnt = recv_line(scanner_fd, linebuffer,
1099 sizeof(linebuffer), tmo)))
1106 (void) pclose(scanner_out);
1107 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1108 return m_errlog_defer(scanent, NULL, string_sprintf(
1109 "unable to read from scanner (%s): %s",
1110 commandline, strerror(err)));
1113 if (Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record))
1116 (void) pclose(scanner_out);
1117 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1118 return m_errlog_defer(scanent, NULL, string_sprintf(
1119 "short write on scanner output file (%s).", file_name));
1121 putc('\n', scanner_record);
1122 /* try trigger match */
1124 && regex_match_and_setup(cmdline_trigger_re, linebuffer, 0, -1)
1129 (void)fclose(scanner_record);
1130 sep = pclose(scanner_out);
1131 signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
1133 return m_errlog_defer(scanent, NULL,
1135 ? string_sprintf("running scanner failed: %s", strerror(sep))
1136 : string_sprintf("scanner returned error code: %d", sep));
1141 /* setup default virus name */
1142 malware_name = US"unknown";
1144 /* re-open the scanner output file, look for name match */
1145 scanner_record = fopen(CS file_name, "rb");
1146 while (fgets(CS linebuffer, sizeof(linebuffer), scanner_record))
1149 if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
1152 (void)fclose(scanner_record);
1154 else /* no virus found */
1155 malware_name = NULL;
1159 case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
1164 uschar av_buffer[1024];
1166 /* pass the scan directory to sophie */
1167 file_name = string_copy(eml_filename);
1168 if ((p = Ustrrchr(file_name, '/')))
1171 DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
1172 scanner_name, scanner_options);
1174 if ( write(sock, file_name, Ustrlen(file_name)) < 0
1175 || write(sock, "\n", 1) != 1
1177 return m_errlog_defer_3(scanent, CUS callout_address,
1178 string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
1181 /* wait for result */
1182 memset(av_buffer, 0, sizeof(av_buffer));
1183 if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
1184 return m_errlog_defer_3(scanent, CUS callout_address,
1185 string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
1189 if (av_buffer[0] == '1') {
1190 uschar * s = Ustrchr(av_buffer, '\n');
1193 malware_name = string_copy(&av_buffer[2]);
1195 else if (!strncmp(CS av_buffer, "-1", 2))
1196 return m_errlog_defer_3(scanent, CUS callout_address,
1197 US"scanner reported error", sock);
1198 else /* all ok, no virus */
1199 malware_name = NULL;
1204 case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
1206 /* This code was originally contributed by David Saez */
1207 /* There are three scanning methods available to us:
1208 * (1) Use the SCAN command, pointing to a file in the filesystem
1209 * (2) Use the STREAM command, send the data on a separate port
1210 * (3) Use the zINSTREAM command, send the data inline
1211 * The zINSTREAM command was introduced with ClamAV 0.95, which marked
1212 * STREAM deprecated; see: http://wiki.clamav.net/bin/view/Main/UpgradeNotes095
1213 * In Exim, we use SCAN if using a Unix-domain socket or explicitly told that
1214 * the TCP-connected daemon is actually local; otherwise we use zINSTREAM unless
1215 * WITH_OLD_CLAMAV_STREAM is defined.
1216 * See Exim bug 926 for details. */
1218 uschar *p, *vname, *result_tag;
1221 uschar av_buffer[1024];
1222 uschar *hostname = US"";
1224 uschar *clamav_fbuf;
1225 int clam_fd, result;
1227 unsigned int fsize_uint;
1228 BOOL use_scan_command = FALSE;
1229 clamd_address * cv[MAX_CLAMD_SERVERS];
1230 int num_servers = 0;
1231 #ifdef WITH_OLD_CLAMAV_STREAM
1233 uschar av_buffer2[1024];
1236 uint32_t send_size, send_final_zeroblock;
1239 /*XXX if unixdomain socket, only one server supported. Needs fixing;
1240 there's no reason we should not mix local and remote servers */
1242 if (*scanner_options == '/')
1245 const uschar * sublist;
1248 /* Local file; so we def want to use_scan_command and don't want to try
1249 * passing IP/port combinations */
1250 use_scan_command = TRUE;
1251 cd = (clamd_address *) store_get(sizeof(clamd_address));
1253 /* extract socket-path part */
1254 sublist = scanner_options;
1255 cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0);
1258 if (clamd_option(cd, sublist, &subsep) != OK)
1259 return m_errlog_defer(scanent, NULL,
1260 string_sprintf("bad option '%s'", scanner_options));
1265 /* Go through the rest of the list of host/port and construct an array
1266 * of servers to try. The first one is the bit we just passed from
1267 * scanner_options so process that first and then scan the remainder of
1268 * the address buffer */
1272 const uschar * sublist;
1276 /* The 'local' option means use the SCAN command over the network
1277 * socket (ie common file storage in use) */
1278 /*XXX we could accept this also as a local option? */
1279 if (strcmpic(scanner_options, US"local") == 0)
1281 use_scan_command = TRUE;
1285 cd = (clamd_address *) store_get(sizeof(clamd_address));
1287 /* extract host and port part */
1288 sublist = scanner_options;
1289 if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
1291 (void) m_errlog_defer(scanent, NULL,
1292 string_sprintf("missing address: '%s'", scanner_options));
1295 if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
1297 (void) m_errlog_defer(scanent, NULL,
1298 string_sprintf("missing port: '%s'", scanner_options));
1301 cd->tcp_port = atoi(CS s);
1304 /*XXX should these options be common over scanner types? */
1305 if (clamd_option(cd, sublist, &subsep) != OK)
1307 return m_errlog_defer(scanent, NULL,
1308 string_sprintf("bad option '%s'", scanner_options));
1312 cv[num_servers++] = cd;
1313 if (num_servers >= MAX_CLAMD_SERVERS)
1315 (void) m_errlog_defer(scanent, NULL,
1316 US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
1317 "specified; only using the first " MAX_CLAMD_SERVERS_S );
1320 } while ((scanner_options = string_nextinlist(&av_scanner_work, &sep,
1323 /* check if we have at least one server */
1325 return m_errlog_defer(scanent, NULL,
1326 US"no useable server addresses in malware configuration option.");
1329 /* See the discussion of response formats below to see why we really
1330 don't like colons in filenames when passing filenames to ClamAV. */
1331 if (use_scan_command && Ustrchr(eml_filename, ':'))
1332 return m_errlog_defer(scanent, NULL,
1333 string_sprintf("local/SCAN mode incompatible with" \
1334 " : in path to email filename [%s]", eml_filename));
1336 /* We have some network servers specified */
1339 /* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
1340 * only supports AF_INET, but we should probably be looking to the
1341 * future and rewriting this to be protocol-independent anyway. */
1343 while (num_servers > 0)
1345 int i = random_number( num_servers );
1346 clamd_address * cd = cv[i];
1348 DEBUG(D_acl) debug_printf("trying server name %s, port %u\n",
1349 cd->hostspec, cd->tcp_port);
1351 /* Lookup the host. This is to ensure that we connect to the same IP
1352 * on both connections (as one host could resolve to multiple ips) */
1355 sock= m_tcpsocket(cd->hostspec, cd->tcp_port, &connhost, &errstr);
1358 /* Connection successfully established with a server */
1359 hostname = cd->hostspec;
1362 if (cd->retry <= 0) break;
1363 while (cd->retry > 0) cd->retry = sleep(cd->retry);
1368 (void) m_errlog_defer(scanent, CUS callout_address, errstr);
1370 /* Remove the server from the list. XXX We should free the memory */
1372 for (; i < num_servers; i++)
1376 if (num_servers == 0)
1377 return m_errlog_defer(scanent, NULL, US"all servers failed");
1382 if ((sock = ip_unixsocket(cv[0]->hostspec, &errstr)) >= 0)
1384 hostname = cv[0]->hostspec;
1387 if (cv[0]->retry <= 0)
1388 return m_errlog_defer(scanent, CUS callout_address, errstr);
1389 while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
1392 /* have socket in variable "sock"; command to use is semi-independent of
1393 * the socket protocol. We use SCAN if is local (either Unix/local
1394 * domain socket, or explicitly told local) else we stream the data.
1395 * How we stream the data depends upon how we were built. */
1397 if (!use_scan_command)
1399 #ifdef WITH_OLD_CLAMAV_STREAM
1400 /* "STREAM\n" command, get back a "PORT <N>\n" response, send data to
1401 * that port on a second connection; then in the scan-method-neutral
1402 * part, read the response back on the original connection. */
1404 DEBUG(D_acl) debug_printf(
1405 "Malware scan: issuing %s old-style remote scan (PORT)\n",
1408 /* Pass the string to ClamAV (7 = "STREAM\n") */
1409 if (m_sock_send(sock, US"STREAM\n", 7, &errstr) < 0)
1410 return m_errlog_defer(scanent, CUS callout_address, errstr);
1412 memset(av_buffer2, 0, sizeof(av_buffer2));
1413 bread = ip_recv(sock, av_buffer2, sizeof(av_buffer2), tmo-time(NULL));
1416 return m_errlog_defer_3(scanent, CUS callout_address,
1417 string_sprintf("unable to read PORT from socket (%s)",
1421 if (bread == sizeof(av_buffer2))
1422 return m_errlog_defer_3(scanent, CUS callout_address,
1423 "buffer too small", sock);
1426 return m_errlog_defer_3(scanent, CUS callout_address,
1427 "ClamAV returned null", sock);
1429 av_buffer2[bread] = '\0';
1430 if( sscanf(CS av_buffer2, "PORT %u\n", &port) != 1 )
1431 return m_errlog_defer_3(scanent, CUS callout_address,
1432 string_sprintf("Expected port information from clamd, got '%s'",
1436 sockData = m_tcpsocket(connhost.address, port, NULL, &errstr);
1438 return m_errlog_defer_3(scanent, CUS callout_address, errstr, sock);
1440 # define CLOSE_SOCKDATA (void)close(sockData)
1441 #else /* WITH_OLD_CLAMAV_STREAM not defined */
1442 /* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
1443 chunks, <n> a 4-byte number (network order), terminated by a zero-length
1446 DEBUG(D_acl) debug_printf(
1447 "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
1450 /* Pass the string to ClamAV (10 = "zINSTREAM\0") */
1451 if (send(sock, "zINSTREAM", 10, 0) < 0)
1452 return m_errlog_defer_3(scanent, CUS hostname,
1453 string_sprintf("unable to send zINSTREAM to socket (%s)",
1457 # define CLOSE_SOCKDATA /**/
1460 /* calc file size */
1461 if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0)
1465 return m_errlog_defer_3(scanent, NULL,
1466 string_sprintf("can't open spool file %s: %s",
1467 eml_filename, strerror(err)),
1470 if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
1473 CLOSE_SOCKDATA; (void)close(clam_fd);
1474 return m_errlog_defer_3(scanent, NULL,
1475 string_sprintf("can't seek spool file %s: %s",
1476 eml_filename, strerror(err)),
1479 fsize_uint = (unsigned int) fsize;
1480 if ((off_t)fsize_uint != fsize)
1482 CLOSE_SOCKDATA; (void)close(clam_fd);
1483 return m_errlog_defer_3(scanent, NULL,
1484 string_sprintf("seeking spool file %s, size overflow",
1488 lseek(clam_fd, 0, SEEK_SET);
1490 if (!(clamav_fbuf = (uschar *) malloc (fsize_uint)))
1492 CLOSE_SOCKDATA; (void)close(clam_fd);
1493 return m_errlog_defer_3(scanent, NULL,
1494 string_sprintf("unable to allocate memory %u for file (%s)",
1495 fsize_uint, eml_filename),
1499 if ((result = read(clam_fd, clamav_fbuf, fsize_uint)) < 0)
1502 free(clamav_fbuf); CLOSE_SOCKDATA; (void)close(clam_fd);
1503 return m_errlog_defer_3(scanent, NULL,
1504 string_sprintf("can't read spool file %s: %s",
1505 eml_filename, strerror(err)),
1508 (void)close(clam_fd);
1510 /* send file body to socket */
1511 #ifdef WITH_OLD_CLAMAV_STREAM
1512 if (send(sockData, clamav_fbuf, fsize_uint, 0) < 0)
1514 free(clamav_fbuf); CLOSE_SOCKDATA;
1515 return m_errlog_defer_3(scanent, NULL,
1516 string_sprintf("unable to send file body to socket (%s:%u)",
1521 send_size = htonl(fsize_uint);
1522 send_final_zeroblock = 0;
1523 if ((send(sock, &send_size, sizeof(send_size), 0) < 0) ||
1524 (send(sock, clamav_fbuf, fsize_uint, 0) < 0) ||
1525 (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
1528 return m_errlog_defer_3(scanent, NULL,
1529 string_sprintf("unable to send file body to socket (%s)", hostname),
1537 #undef CLOSE_SOCKDATA
1540 { /* use scan command */
1541 /* Send a SCAN command pointing to a filename; then in the then in the
1542 * scan-method-neutral part, read the response back */
1544 /* ================================================================= */
1546 /* Prior to the reworking post-Exim-4.72, this scanned a directory,
1547 which dates to when ClamAV needed us to break apart the email into the
1548 MIME parts (eg, with the now deprecated demime condition coming first).
1549 Some time back, ClamAV gained the ability to deconstruct the emails, so
1550 doing this would actually have resulted in the mail attachments being
1551 scanned twice, in the broken out files and from the original .eml.
1552 Since ClamAV now handles emails (and has for quite some time) we can
1553 just use the email file itself. */
1554 /* Pass the string to ClamAV (7 = "SCAN \n" + \0) */
1555 file_name = string_sprintf("SCAN %s\n", eml_filename);
1557 DEBUG(D_acl) debug_printf(
1558 "Malware scan: issuing %s local-path scan [%s]\n",
1559 scanner_name, scanner_options);
1561 if (send(sock, file_name, Ustrlen(file_name), 0) < 0)
1562 return m_errlog_defer_3(scanent, CUS callout_address,
1563 string_sprintf("unable to write to socket (%s)", strerror(errno)),
1566 /* Do not shut down the socket for writing; a user report noted that
1567 * clamd 0.70 does not react well to this. */
1569 /* Commands have been sent, no matter which scan method or connection
1570 * type we're using; now just read the result, independent of method. */
1572 /* Read the result */
1573 memset(av_buffer, 0, sizeof(av_buffer));
1574 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1579 return m_errlog_defer(scanent, CUS callout_address,
1580 string_sprintf("unable to read from socket (%s)",
1581 errno == 0 ? "EOF" : strerror(errno)));
1583 if (bread == sizeof(av_buffer))
1584 return m_errlog_defer(scanent, CUS callout_address,
1585 US"buffer too small");
1586 /* We're now assured of a NULL at the end of av_buffer */
1588 /* Check the result. ClamAV returns one of two result formats.
1589 In the basic mode, the response is of the form:
1590 infected: -> "<filename>: <virusname> FOUND"
1591 not-infected: -> "<filename>: OK"
1592 error: -> "<filename>: <errcode> ERROR
1593 If the ExtendedDetectionInfo option has been turned on, then we get:
1594 "<filename>: <virusname>(<virushash>:<virussize>) FOUND"
1595 for the infected case. Compare:
1596 /tmp/eicar.com: Eicar-Test-Signature FOUND
1597 /tmp/eicar.com: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND
1599 In the streaming case, clamd uses the filename "stream" which you should
1600 be able to verify with { ktrace clamdscan --stream /tmp/eicar.com }. (The
1601 client app will replace "stream" with the original filename before returning
1602 results to stdout, but the trace shows the data).
1604 We will assume that the pathname passed to clamd from Exim does not contain
1605 a colon. We will have whined loudly above if the eml_filename does (and we're
1606 passing a filename to clamd). */
1609 return m_errlog_defer(scanent, CUS callout_address,
1610 US"ClamAV returned null");
1612 /* strip newline at the end (won't be present for zINSTREAM)
1613 (also any trailing whitespace, which shouldn't exist, but we depend upon
1614 this below, so double-check) */
1615 p = av_buffer + Ustrlen(av_buffer) - 1;
1616 if (*p == '\n') *p = '\0';
1618 DEBUG(D_acl) debug_printf("Malware response: %s\n", av_buffer);
1620 while (isspace(*--p) && (p > av_buffer))
1624 /* colon in returned output? */
1625 if(!(p = Ustrchr(av_buffer,':')))
1626 return m_errlog_defer(scanent, CUS callout_address, string_sprintf(
1627 "ClamAV returned malformed result (missing colon): %s",
1630 /* strip filename */
1631 while (*p && isspace(*++p)) /**/;
1634 /* It would be bad to encounter a virus with "FOUND" in part of the name,
1635 but we should at least be resistant to it. */
1636 p = Ustrrchr(vname, ' ');
1637 result_tag = p ? p+1 : vname;
1639 if (Ustrcmp(result_tag, "FOUND") == 0)
1641 /* p should still be the whitespace before the result_tag */
1642 while (isspace(*p)) --p;
1644 /* Strip off the extended information too, which will be in parens
1645 after the virus name, with no intervening whitespace. */
1648 /* "(hash:size)", so previous '(' will do; if not found, we have
1649 a curious virus name, but not an error. */
1650 p = Ustrrchr(vname, '(');
1654 malware_name = string_copy(vname);
1655 DEBUG(D_acl) debug_printf("Malware found, name \"%s\"\n", malware_name);
1658 else if (Ustrcmp(result_tag, "ERROR") == 0)
1659 return m_errlog_defer(scanent, CUS callout_address,
1660 string_sprintf("ClamAV returned: %s", av_buffer));
1662 else if (Ustrcmp(result_tag, "OK") == 0)
1664 /* Everything should be OK */
1665 malware_name = NULL;
1666 DEBUG(D_acl) debug_printf("Malware not found\n");
1670 return m_errlog_defer(scanent, CUS callout_address,
1671 string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
1676 case M_SOCK: /* "sock" scanner type ------------------------------------- */
1677 /* This code was derived by Martin Poole from the clamd code contributed
1678 by David Saez and the cmdline code
1682 uschar * commandline;
1683 uschar av_buffer[1024];
1684 uschar * linebuffer;
1685 uschar * sockline_scanner;
1686 uschar sockline_scanner_default[] = "%s\n";
1687 const pcre *sockline_trig_re;
1688 const pcre *sockline_name_re;
1690 /* find scanner command line */
1691 if ((sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
1693 { /* check for no expansions apart from one %s */
1694 uschar * s = Ustrchr(sockline_scanner, '%');
1696 if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
1697 return m_errlog_defer_3(scanent, NULL,
1698 US"unsafe sock scanner call spec", sock);
1701 sockline_scanner = sockline_scanner_default;
1703 /* find scanner output trigger */
1704 sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1705 "missing trigger specification", &errstr);
1706 if (!sockline_trig_re)
1707 return m_errlog_defer_3(scanent, NULL, errstr, sock);
1709 /* find virus name regex */
1710 sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
1711 "missing virus name regex specification", &errstr);
1712 if (!sockline_name_re)
1713 return m_errlog_defer_3(scanent, NULL, errstr, sock);
1715 /* prepare scanner call - security depends on expansions check above */
1716 commandline = string_sprintf("%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
1717 commandline = string_sprintf( CS sockline_scanner, CS commandline);
1720 /* Pass the command string to the socket */
1721 if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
1722 return m_errlog_defer(scanent, CUS callout_address, errstr);
1724 /* Read the result */
1725 bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
1728 return m_errlog_defer_3(scanent, CUS callout_address,
1729 string_sprintf("unable to read from socket (%s)", strerror(errno)),
1732 if (bread == sizeof(av_buffer))
1733 return m_errlog_defer_3(scanent, CUS callout_address,
1734 US"buffer too small", sock);
1735 av_buffer[bread] = '\0';
1736 linebuffer = string_copy(av_buffer);
1738 /* try trigger match */
1739 if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
1741 if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
1742 malware_name = US "unknown";
1744 else /* no virus found */
1745 malware_name = NULL;
1749 case M_MKSD: /* "mksd" scanner type ------------------------------------- */
1751 char *mksd_options_end;
1752 int mksd_maxproc = 1; /* default, if no option supplied */
1755 if (scanner_options)
1757 mksd_maxproc = (int)strtol(CS scanner_options, &mksd_options_end, 10);
1758 if ( *scanner_options == '\0'
1759 || *mksd_options_end != '\0'
1761 || mksd_maxproc > 32
1763 return m_errlog_defer(scanent, CUS callout_address,
1764 string_sprintf("invalid option '%s'", scanner_options));
1767 if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
1768 return m_errlog_defer(scanent, CUS callout_address, errstr);
1770 malware_name = NULL;
1772 DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan\n", scanner_name);
1774 if ((retval = mksd_scan_packed(scanent, sock, eml_filename, tmo)) != OK)
1782 case M_AVAST: /* "avast" scanner type ----------------------------------- */
1786 uschar * scanrequest;
1787 enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
1790 /* According to Martin Tuma @avast the protocol uses "escaped
1791 whitespace", that is, every embedded whitespace is backslash
1792 escaped, as well as backslash is protected by backslash.
1793 The returned lines contain the name of the scanned file, a tab
1797 [E] - some error occured
1798 Such marker follows the first non-escaped TAB. */
1799 if ( ( !ava_re_clean
1800 && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
1802 && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
1804 return malware_errlog_defer(errstr);
1806 /* wait for result */
1807 for (avast_stage = AVA_HELO;
1808 (nread = recv_line(sock, buf, sizeof(buf), tmo)) > 0;
1811 int slen = Ustrlen(buf);
1814 DEBUG(D_acl) debug_printf("got from avast: %s\n", buf);
1815 switch (avast_stage)
1818 if (Ustrncmp(buf, "220", 3) != 0)
1819 goto endloop; /* require a 220 */
1823 if (Ustrncmp(buf, "210", 3) == 0)
1824 break; /* ignore 210 responses */
1825 if (Ustrncmp(buf, "200", 3) != 0)
1826 goto endloop; /* require a 200 */
1831 /* Check for another option to send. Newline-terminate it. */
1832 if ((scanrequest = string_nextinlist(&av_scanner_work, &sep,
1835 scanrequest = string_sprintf("%s\n", scanrequest);
1836 avast_stage = AVA_OPT; /* just sent option */
1840 scanrequest = string_sprintf("SCAN %s/scan/%s\n",
1841 spool_directory, message_id);
1842 avast_stage = AVA_RSP; /* just sent command */
1845 /* send config-cmd or scan-request to socket */
1846 len = Ustrlen(scanrequest);
1847 if (send(sock, scanrequest, len, 0) < 0)
1849 scanrequest[len-1] = '\0';
1850 return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
1851 "unable to send request '%s' to socket (%s): %s",
1852 scanrequest, scanner_options, strerror(errno)), sock);
1858 if (Ustrncmp(buf, "210", 3) == 0)
1859 break; /* ignore the "210 SCAN DATA" message */
1861 if (pcre_exec(ava_re_clean, NULL, CS buf, slen,
1862 0, 0, ovector, nelements(ovector)) > 0)
1865 if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
1866 { /* remove backslash in front of [whitespace|backslash] */
1868 for (p = malware_name; *p; ++p)
1869 if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
1870 for (p0 = p; *p0; ++p0) *p0 = p0[1];
1872 avast_stage = AVA_DONE;
1876 if (Ustrncmp(buf, "200 SCAN OK", 11) == 0)
1877 { /* we're done finally */
1878 if (send(sock, "QUIT\n", 5, 0) < 0) /* courtesy */
1879 return m_errlog_defer_3(scanent, CUS callout_address,
1881 "unable to send quit request to socket (%s): %s",
1882 scanner_options, strerror(errno)),
1884 malware_name = NULL;
1885 avast_stage = AVA_DONE;
1889 /* here for any unexpected response from the scanner */
1892 case AVA_DONE: log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
1893 __FILE__, __LINE__, __FUNCTION__);
1903 case AVA_RSP: return m_errlog_defer_3(scanent, CUS callout_address,
1906 "invalid response from scanner: '%s'", buf)
1908 ? US"EOF from scanner"
1909 : US"timeout from scanner",
1915 } /* scanner type switch */
1918 (void) close (sock);
1919 malware_ok = TRUE; /* set "been here, done that" marker */
1922 /* match virus name against pattern (caseless ------->----------v) */
1923 if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
1925 DEBUG(D_acl) debug_printf(
1926 "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
1934 /*************************************************
1935 * Scan an email for malware *
1936 *************************************************/
1938 /* This is the normal interface for scanning an email, which doesn't need a
1939 filename; it's a wrapper around the malware_file function.
1942 malware_re match condition for "malware="
1943 timeout if nonzero, timeout in seconds
1945 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
1946 where true means malware was found (condition applies)
1949 malware(const uschar * malware_re, int timeout)
1951 uschar * scan_filename;
1954 scan_filename = string_sprintf("%s/scan/%s/%s.eml",
1955 spool_directory, message_id, message_id);
1956 ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
1957 if (ret == DEFER) av_failed = TRUE;
1963 /*************************************************
1964 * Scan a file for malware *
1965 *************************************************/
1967 /* This is a test wrapper for scanning an email, which is not used in
1968 normal processing. Scan any file, using the Exim scanning interface.
1969 This function tampers with various global variables so is unsafe to use
1970 in any other context.
1973 eml_filename a file holding the message to be scanned
1975 Returns: Exim message processing code (OK, FAIL, DEFER, ...)
1976 where true means malware was found (condition applies)
1979 malware_in_file(uschar *eml_filename)
1981 uschar message_id_buf[64];
1984 /* spool_mbox() assumes various parameters exist, when creating
1985 the relevant directory and the email within */
1986 (void) string_format(message_id_buf, sizeof(message_id_buf),
1987 "dummy-%d", vaguely_random_number(INT_MAX));
1988 message_id = message_id_buf;
1989 sender_address = US"malware-sender@example.net";
1991 recipients_list = NULL;
1992 receive_add_recipient(US"malware-victim@example.net", -1);
1993 enable_dollar_recipients = TRUE;
1995 ret = malware_internal(US"*", eml_filename, 0, TRUE);
1997 Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
1999 /* don't set no_mbox_unspool; at present, there's no way for it to become
2000 set, but if that changes, then it should apply to these tests too */
2003 /* silence static analysis tools */
2013 if (!malware_default_re)
2014 malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
2016 drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
2018 fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
2020 kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
2022 kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
2024 ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
2026 ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
2029 #endif /*WITH_CONTENT_SCAN*/