+ return m_panic_defer(scanent, NULL,
+ string_sprintf("malformed reply received: %s", line));
+ }
+}
+
+static int
+mksd_scan_packed(struct scan * scanent, int sock, const uschar * scan_filename,
+ time_t tmo)
+{
+struct iovec iov[3];
+const char *cmd = "MSQ\n";
+uschar av_buffer[1024];
+
+iov[0].iov_base = (void *) cmd;
+iov[0].iov_len = 3;
+iov[1].iov_base = (void *) scan_filename;
+iov[1].iov_len = Ustrlen(scan_filename);
+iov[2].iov_base = (void *) (cmd + 3);
+iov[2].iov_len = 1;
+
+if (mksd_writev (sock, iov, 3) < 0)
+ return DEFER;
+
+if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
+ return DEFER;
+
+return mksd_parse_line (scanent, CS av_buffer);
+}
+#endif /* MKSD */
+
+
+#ifndef DISABLE_MAL_CLAM
+static int
+clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
+{
+uschar * s;
+
+cd->retry = 0;
+while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
+ if (Ustrncmp(s, "retry=", 6) == 0)
+ {
+ int sec = readconf_readtime((s += 6), '\0', FALSE);
+ if (sec < 0)
+ return FAIL;
+ cd->retry = sec;
+ }
+ else
+ return FAIL;
+return OK;
+}
+#endif
+
+
+
+/*************************************************
+* Scan content for malware *
+*************************************************/
+
+/* This is an internal interface for scanning an email; the normal interface
+is via malware(), or there's malware_in_file() used for testing/debugging.
+
+Arguments:
+ malware_re match condition for "malware="
+ scan_filename the file holding the email to be scanned, if we're faking
+ this up for the -bmalware test, else NULL
+ timeout if nonzero, non-default timeoutl
+
+Returns: Exim message processing code (OK, FAIL, DEFER, ...)
+ where true means malware was found (condition applies)
+*/
+static int
+malware_internal(const uschar * malware_re, const uschar * scan_filename,
+ int timeout)
+{
+int sep = 0;
+const uschar *av_scanner_work = av_scanner;
+uschar *scanner_name;
+unsigned long mbox_size;
+FILE *mbox_file;
+const pcre *re;
+uschar * errstr;
+struct scan * scanent;
+const uschar * scanner_options;
+client_conn_ctx malware_daemon_ctx = {.sock = -1};
+time_t tmo;
+uschar * eml_filename, * eml_dir;
+
+if (!malware_re)
+ return FAIL; /* empty means "don't match anything" */
+
+/* Ensure the eml mbox file is spooled up */
+
+if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
+ return malware_panic_defer(US"error while creating mbox spool file");
+
+/* None of our current scanners need the mbox file as a stream (they use
+the name), so we can close it right away. Get the directory too. */
+
+(void) fclose(mbox_file);
+eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
+
+/* parse 1st option */
+if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
+ return FAIL; /* explicitly no matching */
+
+/* special cases (match anything except empty) */
+if ( strcmpic(malware_re,US"true") == 0
+ || Ustrcmp(malware_re,"*") == 0
+ || Ustrcmp(malware_re,"1") == 0
+ )
+ {
+ if ( !malware_default_re
+ && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
+ return malware_panic_defer(errstr);
+ malware_re = malware_regex_default;
+ re = malware_default_re;
+ }
+
+/* compile the regex, see if it works */
+else if (!(re = m_pcre_compile(malware_re, &errstr)))
+ return malware_panic_defer(errstr);
+
+/* if av_scanner starts with a dollar, expand it first */
+if (*av_scanner == '$')
+ {
+ if (!(av_scanner_work = expand_string(av_scanner)))
+ return malware_panic_defer(
+ string_sprintf("av_scanner starts with $, but expansion failed: %s",
+ expand_string_message));
+
+ DEBUG(D_acl)
+ debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
+ /* disable result caching in this case */
+ malware_name = NULL;
+ malware_ok = FALSE;
+ }
+
+/* Do not scan twice (unless av_scanner is dynamic). */
+if (!malware_ok)
+ {
+ /* find the scanner type from the av_scanner option */
+ if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
+ return malware_panic_defer(US"av_scanner configuration variable is empty");
+ if (!timeout) timeout = MALWARE_TIMEOUT;
+ tmo = time(NULL) + timeout;
+
+ for (scanent = m_scans; ; scanent++)
+ {
+ if (!scanent->name)
+ return malware_panic_defer(string_sprintf("unknown scanner type '%s'",
+ scanner_name));
+ if (strcmpic(scanner_name, US scanent->name) != 0)
+ continue;
+ DEBUG(D_acl) debug_printf_indent("Malware scan: %s tmo=%s\n",
+ scanner_name, readconf_printtime(timeout));
+
+ if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
+ scanner_options = scanent->options_default;
+ if (scanent->conn == MC_NONE)
+ break;
+
+ DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
+ switch(scanent->conn)
+ {
+ case MC_TCP:
+ malware_daemon_ctx.sock = ip_tcpsocket(scanner_options, &errstr, 5, NULL); break;
+ case MC_UNIX:
+ malware_daemon_ctx.sock = ip_unixsocket(scanner_options, &errstr); break;
+ case MC_STRM:
+ malware_daemon_ctx.sock = ip_streamsocket(scanner_options, &errstr, 5, NULL); break;
+ default:
+ /* compiler quietening */ break;
+ }
+ if (malware_daemon_ctx.sock < 0)
+ return m_panic_defer(scanent, CUS callout_address, errstr);
+ break;
+ }
+
+ switch (scanent->scancode)
+ {
+#ifndef DISABLE_MAL_FFROTD
+ case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
+ {
+ uschar *fp_scan_option;
+ unsigned int detected=0, par_count=0;
+ uschar * scanrequest;
+ uschar buf[32768], *strhelper, *strhelper2;
+ uschar * malware_name_internal = NULL;
+ int len;
+
+ scanrequest = string_sprintf("GET %s", eml_filename);
+
+ while ((fp_scan_option = string_nextinlist(&av_scanner_work, &sep,
+ NULL, 0)))
+ {
+ scanrequest = string_sprintf("%s%s%s", scanrequest,
+ par_count ? "%20" : "?", fp_scan_option);
+ par_count++;
+ }
+ scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
+ DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
+ scanner_name, scanrequest);
+
+ /* send scan request */
+ if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
+ return m_panic_defer(scanent, CUS callout_address, errstr);
+
+ while ((len = recv_line(malware_daemon_ctx.sock, buf, sizeof(buf), tmo)) >= 0)
+ if (len > 0)
+ {
+ if (Ustrstr(buf, US"<detected type=\"") != NULL)
+ detected = 1;
+ else if (detected && (strhelper = Ustrstr(buf, US"<name>")))
+ {
+ if ((strhelper2 = Ustrstr(buf, US"</name>")) != NULL)
+ {
+ *strhelper2 = '\0';
+ malware_name_internal = string_copy(strhelper+6);
+ }
+ }
+ else if (Ustrstr(buf, US"<summary code=\""))
+ {
+ malware_name = Ustrstr(buf, US"<summary code=\"11\">")
+ ? malware_name_internal : NULL;
+ break;
+ }
+ }
+ if (len < -1)
+ {
+ (void)close(malware_daemon_ctx.sock);
+ return DEFER;
+ }
+ break;
+ } /* f-protd */
+#endif
+
+#ifndef DISABLE_MAL_FFROT6D
+ case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
+ {
+ int bread;
+ uschar * e;
+ uschar * linebuffer;
+ uschar * scanrequest;
+ uschar av_buffer[1024];
+
+ if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
+ || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
+ return malware_panic_defer(errstr);
+
+ scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
+ DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
+ scanner_name, scanrequest);
+
+ if (m_sock_send(malware_daemon_ctx.sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
+ return m_panic_defer(scanent, CUS callout_address, errstr);
+
+ bread = ip_recv(&malware_daemon_ctx, av_buffer, sizeof(av_buffer), tmo);
+
+ if (bread <= 0)
+ return m_panic_defer_3(scanent, CUS callout_address,
+ string_sprintf("unable to read from socket (%s)", strerror(errno)),
+ malware_daemon_ctx.sock);
+
+ if (bread == sizeof(av_buffer))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ US"buffer too small", malware_daemon_ctx.sock);
+
+ av_buffer[bread] = '\0';
+ linebuffer = string_copy(av_buffer);
+
+ m_sock_send(malware_daemon_ctx.sock, US"QUIT\n", 5, 0);
+
+ if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ string_sprintf("scanner reported error (%s)", e), malware_daemon_ctx.sock);
+
+ if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
+ malware_name = NULL;
+
+ break;
+ } /* f-prot6d */
+#endif
+
+#ifndef DISABLE_MAL_DRWEB
+ case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
+ /* v0.1 - added support for tcp sockets */
+ /* v0.0 - initial release -- support for unix sockets */
+ {
+ int result;
+ off_t fsize;
+ unsigned int fsize_uint;
+ uschar * tmpbuf, *drweb_fbuf;
+ int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
+ drweb_vnum, drweb_slen, drweb_fin = 0x0000;
+
+ /* prepare variables */
+ drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+ drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
+
+ if (*scanner_options != '/')
+ {
+ /* calc file size */
+ if ((drweb_fd = exim_open2(CCS eml_filename, O_RDONLY)) == -1)
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("can't open spool file %s: %s",
+ eml_filename, strerror(errno)),
+ malware_daemon_ctx.sock);
+
+ if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
+ {
+ int err;
+badseek: err = errno;
+ (void)close(drweb_fd);
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("can't seek spool file %s: %s",
+ eml_filename, strerror(err)),
+ malware_daemon_ctx.sock);
+ }
+ fsize_uint = (unsigned int) fsize;
+ if ((off_t)fsize_uint != fsize)
+ {
+ (void)close(drweb_fd);
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("seeking spool file %s, size overflow",
+ eml_filename),
+ malware_daemon_ctx.sock);
+ }
+ drweb_slen = htonl(fsize);
+ if (lseek(drweb_fd, 0, SEEK_SET) < 0)
+ goto badseek;
+
+ DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
+ scanner_name, scanner_options);
+
+ /* send scan request */
+ if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
+ {
+ (void)close(drweb_fd);
+ return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
+ "unable to send commands to socket (%s)", scanner_options),
+ malware_daemon_ctx.sock);
+ }
+
+ if (!(drweb_fbuf = store_malloc(fsize_uint)))
+ {
+ (void)close(drweb_fd);
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("unable to allocate memory %u for file (%s)",
+ fsize_uint, eml_filename),
+ malware_daemon_ctx.sock);
+ }
+
+ if ((result = read (drweb_fd, drweb_fbuf, fsize)) == -1)
+ {
+ int err = errno;
+ (void)close(drweb_fd);
+ store_free(drweb_fbuf);
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("can't read spool file %s: %s",
+ eml_filename, strerror(err)),
+ malware_daemon_ctx.sock);
+ }
+ (void)close(drweb_fd);
+
+ /* send file body to socket */
+ if (send(malware_daemon_ctx.sock, drweb_fbuf, fsize, 0) < 0)
+ {
+ store_free(drweb_fbuf);
+ return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
+ "unable to send file body to socket (%s)", scanner_options),
+ malware_daemon_ctx.sock);
+ }
+ store_free(drweb_fbuf);
+ }
+ else
+ {
+ drweb_slen = htonl(Ustrlen(eml_filename));
+
+ DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
+ scanner_name, scanner_options);
+
+ /* send scan request */
+ if ((send(malware_daemon_ctx.sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
+ (send(malware_daemon_ctx.sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
+ return m_panic_defer_3(scanent, CUS callout_address, string_sprintf(
+ "unable to send commands to socket (%s)", scanner_options),
+ malware_daemon_ctx.sock);
+ }
+
+ /* wait for result */
+ if (!recv_len(malware_daemon_ctx.sock, &drweb_rc, sizeof(drweb_rc), tmo))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ US"unable to read return code", malware_daemon_ctx.sock);
+ drweb_rc = ntohl(drweb_rc);
+
+ if (!recv_len(malware_daemon_ctx.sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ US"unable to read the number of viruses", malware_daemon_ctx.sock);
+ drweb_vnum = ntohl(drweb_vnum);
+
+ /* "virus(es) found" if virus number is > 0 */
+ if (drweb_vnum)
+ {
+ gstring * g = NULL;
+
+ /* setup default virus name */
+ malware_name = US"unknown";
+
+ /* set up match regex */
+ if (!drweb_re)
+ drweb_re = m_pcre_compile(drweb_re_str, &errstr);
+
+ /* read and concatenate virus names into one string */
+ for (int i = 0; i < drweb_vnum; i++)
+ {
+ int ovector[10*3];
+
+ /* read the size of report */
+ if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ US"cannot read report size", malware_daemon_ctx.sock);
+ drweb_slen = ntohl(drweb_slen);
+
+ /* assume tainted, since it is external input */
+ tmpbuf = store_get(drweb_slen, TRUE);
+
+ /* read report body */
+ if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
+ return m_panic_defer_3(scanent, CUS callout_address,
+ US"cannot read report string", malware_daemon_ctx.sock);
+ tmpbuf[drweb_slen] = '\0';
+
+ /* try matcher on the line, grab substring */
+ result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
+ ovector, nelem(ovector));
+ if (result >= 2)
+ {
+ const char * pre_malware_nb;
+
+ pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
+
+ if (i==0) /* the first name we just copy to malware_name */
+ g = string_cat(NULL, US pre_malware_nb);
+
+ /*XXX could be string_append_listele? */
+ else /* concatenate each new virus name to previous */
+ g = string_append(g, 2, "/", pre_malware_nb);
+
+ pcre_free_substring(pre_malware_nb);
+ }
+ }
+ malware_name = string_from_gstring(g);
+ }
+ else
+ {
+ const char *drweb_s = NULL;
+
+ if (drweb_rc & DERR_READ_ERR) drweb_s = "read error";
+ if (drweb_rc & DERR_NOMEMORY) drweb_s = "no memory";
+ if (drweb_rc & DERR_TIMEOUT) drweb_s = "timeout";
+ if (drweb_rc & DERR_BAD_CALL) drweb_s = "wrong command";
+ /* retcodes DERR_SYMLINK, DERR_NO_REGFILE, DERR_SKIPPED.
+ * DERR_TOO_BIG, DERR_TOO_COMPRESSED, DERR_SPAM,
+ * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
+ * and others are ignored */
+ if (drweb_s)
+ return m_panic_defer_3(scanent, CUS callout_address,
+ string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
+ malware_daemon_ctx.sock);
+
+ /* no virus found */
+ malware_name = NULL;
+ }
+ break;
+ } /* drweb */
+#endif
+
+#ifndef DISABLE_MAL_AVE
+ case M_AVES: /* "aveserver" scanner type -------------------------------- */
+ {
+ uschar buf[32768];
+ int result;
+