#define DERR_TIMEOUT (1<<9) /* scan timeout has run out */
#define DERR_BAD_CALL (1<<15) /* wrong command */
+
+static const uschar * malware_regex_default = US ".+";
+static const pcre * malware_default_re = NULL;
+
+static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
+static const pcre * drweb_re = NULL;
+
+static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
+static const pcre * fsec_re = NULL;
+
+static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
+static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
+static const pcre * kav_re_sus = NULL;
+static const pcre * kav_re_inf = NULL;
+
+static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
+static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\s(.*)";
+static const pcre * ava_re_clean = NULL;
+static const pcre * ava_re_virus = NULL;
+
+
+
+/******************************************************************************/
+
/* Routine to check whether a system is big- or little-endian.
Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
Needed for proper kavdaemon implementation. Sigh. */
return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5, host, errstr);
}
-static int
-m_tcpsocket_fromdef(const uschar * hostport, uschar ** errstr)
-{
- int scan;
- uschar hostname[256];
- unsigned int portlow, porthigh;
-
- /* extract host and port part */
- scan = sscanf(CS hostport, "%255s %u-%u", hostname, &portlow, &porthigh);
- if ( scan != 3 ) {
- if ( scan != 2 ) {
- *errstr = string_sprintf("invalid socket '%s'", hostport);
- return -1;
- }
- porthigh = portlow;
- }
-
- return ip_connectedsocket(SOCK_STREAM, hostname, portlow, porthigh,
- 5, NULL, errstr);
-}
-
-static int
-m_unixsocket(const uschar * path, uschar ** errstr)
-{
- int sock;
- struct sockaddr_un server;
-
- if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
- *errstr = US"can't open UNIX socket.";
- return -1;
- }
-
- server.sun_family = AF_UNIX;
- Ustrncpy(server.sun_path, path, sizeof(server.sun_path)-1);
- server.sun_path[sizeof(server.sun_path)-1] = '\0';
- if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {
- int err = errno;
- (void)close(sock);
- *errstr = string_sprintf("unable to connect to UNIX socket (%s): %s",
- path, strerror(err));
- return -1;
- }
- return sock;
-}
-
-static inline int
-m_streamsocket(const uschar * spec, uschar ** errstr)
-{
- return *spec == '/'
- ? m_unixsocket(spec, errstr) : m_tcpsocket_fromdef(spec, errstr);
-}
-
static int
m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
{
int sep = 0;
uschar *av_scanner_work = av_scanner;
uschar *scanner_name;
-uschar malware_regex_default[] = ".+";
unsigned long mbox_size;
FILE *mbox_file;
const pcre *re;
return FAIL; /* explicitly no matching */
/* special cases (match anything except empty) */
-if ( (strcmpic(malware_re,US"true") == 0) ||
- (Ustrcmp(malware_re,"*") == 0) ||
- (Ustrcmp(malware_re,"1") == 0) )
+if ( strcmpic(malware_re,US"true") == 0
+ || Ustrcmp(malware_re,"*") == 0
+ || Ustrcmp(malware_re,"1") == 0
+ )
+ {
+ if ( !malware_default_re
+ && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
+ return malware_errlog_defer(errstr);
malware_re = malware_regex_default;
-
-/* Reset sep that is set by previous string_nextinlist() call */
-sep = 0;
+ re = malware_default_re;
+ }
/* compile the regex, see if it works */
-if (!(re = m_pcre_compile(malware_re, &errstr)))
+else if (!(re = m_pcre_compile(malware_re, &errstr)))
return malware_errlog_defer(errstr);
+/* Reset sep that is set by previous string_nextinlist() call */
+sep = 0;
+
/* if av_scanner starts with a dollar, expand it first */
if (*av_scanner == '$')
{
if (!timeout) timeout = MALWARE_TIMEOUT;
tmo = time(NULL) + timeout;
- for (scanent = m_scans; ; scanent++) {
+ for (scanent = m_scans; ; scanent++)
+ {
if (!scanent->name)
return malware_errlog_defer(string_sprintf("unknown scanner type '%s'",
scanner_name));
break;
switch(scanent->conn)
{
- case MC_TCP: sock = m_tcpsocket_fromdef(scanner_options, &errstr); break;
- case MC_UNIX: sock = m_unixsocket(scanner_options, &errstr); break;
- case MC_STRM: sock = m_streamsocket(scanner_options, &errstr); break;
+ case MC_TCP: sock = ip_tcpsocket(scanner_options, &errstr, 5); break;
+ case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr); break;
+ case MC_STRM: sock = ip_streamsocket(scanner_options, &errstr, 5); break;
default: /* compiler quietening */ break;
}
if (sock < 0)
uschar * tmpbuf, *drweb_fbuf;
int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
drweb_vnum, drweb_slen, drweb_fin = 0x0000;
- const pcre *drweb_re;
/* prepare variables */
drweb_cmd = htonl(DRWEBD_SCAN_CMD);
malware_name = US"unknown";
/* set up match regex */
- drweb_re = m_pcre_compile(US"infected\\swith\\s*(.+?)$", &errstr);
+ if (!drweb_re)
+ drweb_re = m_pcre_compile(drweb_re_str, &errstr);
/* read and concatenate virus names into one string */
for (i = 0; i < drweb_vnum; i++)
int i, j, bread = 0;
uschar * file_name;
uschar av_buffer[1024];
- const pcre * fs_inf;
static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
US"CONFIGURE\tTIMEOUT\t0\n",
US"CONFIGURE\tMAXARCH\t5\n",
/* set up match */
/* todo also SUSPICION\t */
- fs_inf = m_pcre_compile(US"\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$", &errstr);
+ if (!fsec_re)
+ fsec_re = m_pcre_compile(fsec_re_str, &errstr);
/* read report, linewise. Apply a timeout as the Fsecure daemon
sometimes wants an answer to "PING" but they won't tell us what */
/* Really search for virus again? */
if (!malware_name)
/* try matcher on the line, grab substring */
- malware_name = m_pcre_exec(fs_inf, p);
+ malware_name = m_pcre_exec(fsec_re, p);
if (Ustrstr(p, "OK\tScan ok."))
goto fsec_found;
if (kav_reportlen > 0)
{
/* set up match regex, depends on retcode */
- kav_re = m_pcre_compile( kav_rc == 3
- ? US"suspicion:\\s*(.+?)\\s*$"
- : US"infected:\\s*(.+?)\\s*$",
- &errstr );
+ if (kav_rc == 3)
+ {
+ if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
+ kav_re = kav_re_sus;
+ }
+ else
+ {
+ if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
+ kav_re = kav_re_inf;
+ }
/* read report, linewise */
while (kav_reportlen > 0)
break;
}
- (void) m_errlog_defer(scanent, errstr);
+ log_write(0, LOG_MAIN, "malware acl condition: %s: %s",
+ scanent->name, errstr);
/* Remove the server from the list. XXX We should free the memory */
num_servers--;
}
else
{
- if ((sock = m_unixsocket(scanner_options, &errstr)) < 0)
+ if ((sock = ip_unixsocket(scanner_options, &errstr)) < 0)
return m_errlog_defer(scanent, errstr);
}
string_sprintf("invalid option '%s'", scanner_options));
}
- if((sock = m_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
+ if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
return m_errlog_defer(scanent, errstr);
malware_name = NULL;
int ovector[1*3];
uschar buf[1024];
uschar * scanrequest;
- const pcre * avast_clean_re, * avast_virus_re;
enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage;
int nread;
[L] - infected
[E] - some error occured
Such marker follows the first non-escaped TAB. */
- if ( !(avast_clean_re =
- m_pcre_compile(US"(?!\\\\)\\t\\[\\+\\]", &errstr))
- || !(avast_virus_re =
- m_pcre_compile(US"(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\s(.*)",
- &errstr))
+ if ( ( !ava_re_clean
+ && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
+ || ( !ava_re_virus
+ && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
)
return malware_errlog_defer(errstr);
if (Ustrncmp(buf, "210", 3) == 0)
break; /* ignore the "210 SCAN DATA" message */
- if (pcre_exec(avast_clean_re, NULL, CS buf, slen,
+ if (pcre_exec(ava_re_clean, NULL, CS buf, slen,
0, 0, ovector, nelements(ovector)) > 0)
break;
- if ((malware_name = m_pcre_exec(avast_virus_re, buf)))
+ if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
{ /* remove backslash in front of [whitespace|backslash] */
uschar * p, * p0;
for (p = malware_name; *p; ++p)
return ret;
}
+
+void
+malware_init(void)
+{
+if (!malware_default_re)
+ malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
+if (!drweb_re)
+ drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
+if (!fsec_re)
+ fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
+if (!kav_re_sus)
+ kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
+if (!kav_re_inf)
+ kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
+if (!ava_re_clean)
+ ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
+if (!ava_re_virus)
+ ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
+}
+
#endif /*WITH_CONTENT_SCAN*/
/*
* vi: aw ai sw=2
git://git.exim.org / exim.git / blobdiff