* Exim - an Internet mail transport agent *
*************************************************/
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+/*
+ * Copyright (c) The Exim Maintainers 2015 - 2022
+ * Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
* License: GPL
- * Copyright (c) The Exim Maintainers 2015 - 2020
+ * SPDX-License-Identifier: GPL-2.0-or-later
*/
/* Code for calling virus (malware) scanners. Called from acl.c. */
#define MALWARE_TIMEOUT 120 /* default timeout, seconds */
static const uschar * malware_regex_default = US ".+";
-static const pcre * malware_default_re = NULL;
+static const pcre2_code * malware_default_re = NULL;
#ifndef DISABLE_MAL_CLAM
# define DERR_BAD_CALL (1<<15) /* wrong command */
static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
-static const pcre * drweb_re = NULL;
+static const pcre2_code * drweb_re = NULL;
#endif
#ifndef DISABLE_MAL_FSECURE
static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
-static const pcre * fsec_re = NULL;
+static const pcre2_code * fsec_re = NULL;
#endif
#ifndef DISABLE_MAL_KAV
static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
-static const pcre * kav_re_sus = NULL;
-static const pcre * kav_re_inf = NULL;
+static const pcre2_code * kav_re_sus = NULL;
+static const pcre2_code * kav_re_inf = NULL;
#endif
#ifndef DISABLE_MAL_AVAST
static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
-static const pcre * ava_re_clean = NULL;
-static const pcre * ava_re_virus = NULL;
-static const pcre * ava_re_error = NULL;
+static const pcre2_code * ava_re_clean = NULL;
+static const pcre2_code * ava_re_virus = NULL;
+static const pcre2_code * ava_re_error = NULL;
#endif
#ifndef DISABLE_MAL_FFROT6D
static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
-static const pcre * fprot6d_re_error = NULL;
-static const pcre * fprot6d_re_virus = NULL;
+static const pcre2_code * fprot6d_re_error = NULL;
+static const pcre2_code * fprot6d_re_virus = NULL;
#endif
/* Under some fault conditions, FreeBSD 12.2 seen to send a (non-TFO) SYN
and, getting no response, wait for a long time. Impose a 5s max. */
if (fd >= 0)
- {
- struct timeval tv = {.tv_sec = 5};
- fd_set fds;
- FD_ZERO(&fds); FD_SET(fd, &fds); (void) select(fd+1, NULL, &fds, NULL, &tv);
- }
+ (void) poll_one_fd(fd, POLLOUT, 5 * 1000);
#endif
return fd;
}
return sock;
}
-static const pcre *
-m_pcre_compile(const uschar * re, uschar ** errstr)
+static const pcre2_code *
+m_pcre_compile(const uschar * re, BOOL cacheable, uschar ** errstr)
{
-const uschar * rerror;
-int roffset;
-const pcre * cre;
-
-if (!(cre = pcre_compile(CS re, PCRE_COPT, CCSS &rerror, &roffset, NULL)))
- *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
- re, rerror, roffset);
-return cre;
+return regex_compile(re, cacheable ? MCS_CACHEABLE : MCS_NOFLAGS, errstr,
+ pcre_gen_cmp_ctx);
}
uschar *
-m_pcre_exec(const pcre * cre, uschar * text)
+m_pcre_exec(const pcre2_code * cre, uschar * text)
{
-int ovector[10*3];
-int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
- ovector, nelem(ovector));
+pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx);
+int i = pcre2_match(cre, text, PCRE2_ZERO_TERMINATED, 0, 0, md, pcre_gen_mtc_ctx);
uschar * substr = NULL;
+
if (i >= 2) /* Got it */
- pcre_get_substring(CS text, ovector, i, 1, CCSS &substr);
+ {
+ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md);
+ int len = ovec[3] - ovec[2];
+ substr = string_copyn(text + ovec[2], len);
+ }
+/* pcre2_match_data_free(md); gen ctx needs no free */
return substr;
}
-static const pcre *
+static const pcre2_code *
m_pcre_nextinlist(const uschar ** list, int * sep,
- char * listerr, uschar ** errstr)
+ BOOL cacheable, char * listerr, uschar ** errstr)
{
const uschar * list_ele;
-const pcre * cre = NULL;
+const pcre2_code * cre = NULL;
if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
*errstr = US listerr;
{
DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
string_printing(list_ele));
- cre = m_pcre_compile(CUS list_ele, errstr);
+ cre = m_pcre_compile(CUS list_ele, cacheable, errstr);
}
return cre;
}
Arguments:
malware_re match condition for "malware="
+ cacheable the RE did not use any dynamic elements during expansion
scan_filename the file holding the email to be scanned, if we're faking
this up for the -bmalware test, else NULL
timeout if nonzero, non-default timeoutl
where true means malware was found (condition applies)
*/
static int
-malware_internal(const uschar * malware_re, const uschar * scan_filename,
- int timeout)
+malware_internal(const uschar * malware_re, BOOL cacheable,
+ const uschar * scan_filename, int timeout)
{
int sep = 0;
const uschar *av_scanner_work = av_scanner;
+BOOL av_scanner_textonly;
uschar *scanner_name;
unsigned long mbox_size;
FILE *mbox_file;
-const pcre *re;
+const pcre2_code *re;
uschar * errstr;
struct scan * scanent;
const uschar * scanner_options;
eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
/* parse 1st option */
-if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re,"0") == 0)
+if (strcmpic(malware_re, US"false") == 0 || Ustrcmp(malware_re, "0") == 0)
return FAIL; /* explicitly no matching */
/* special cases (match anything except empty) */
-if ( strcmpic(malware_re,US"true") == 0
- || Ustrcmp(malware_re,"*") == 0
- || Ustrcmp(malware_re,"1") == 0
+if ( strcmpic(malware_re, US"true") == 0
+ || Ustrcmp(malware_re, "*") == 0
+ || Ustrcmp(malware_re, "1") == 0
)
{
if ( !malware_default_re
- && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr)))
+ && !(malware_default_re = m_pcre_compile(malware_regex_default, FALSE, &errstr)))
return malware_panic_defer(errstr);
malware_re = malware_regex_default;
re = malware_default_re;
}
/* compile the regex, see if it works */
-else if (!(re = m_pcre_compile(malware_re, &errstr)))
+else if (!(re = m_pcre_compile(malware_re, cacheable, &errstr)))
return malware_panic_defer(errstr);
/* if av_scanner starts with a dollar, expand it first */
if (*av_scanner == '$')
{
- if (!(av_scanner_work = expand_string(av_scanner)))
+ if (!(av_scanner_work = expand_string_2(av_scanner, &av_scanner_textonly)))
return malware_panic_defer(
string_sprintf("av_scanner starts with $, but expansion failed: %s",
expand_string_message));
malware_name = NULL;
malware_ok = FALSE;
}
+else
+ av_scanner_textonly = TRUE;
/* Do not scan twice (unless av_scanner is dynamic). */
if (!malware_ok)
case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
{
int bread;
- uschar * e;
- uschar * linebuffer;
- uschar * scanrequest;
+ uschar * e, * linebuffer, * scanrequest;
uschar av_buffer[1024];
- if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
- || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
+ if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, FALSE, &errstr)))
+ || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, FALSE, &errstr))))
return malware_panic_defer(errstr);
scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
/* set up match regex */
if (!drweb_re)
- drweb_re = m_pcre_compile(drweb_re_str, &errstr);
+ drweb_re = m_pcre_compile(drweb_re_str, FALSE, &errstr);
/* read and concatenate virus names into one string */
for (int i = 0; i < drweb_vnum; i++)
{
- int ovector[10*3];
+ pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx);
/* read the size of report */
if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
drweb_slen = ntohl(drweb_slen);
/* assume tainted, since it is external input */
- tmpbuf = store_get(drweb_slen, TRUE);
+ tmpbuf = store_get(drweb_slen, GET_TAINTED);
/* read report body */
if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
tmpbuf[drweb_slen] = '\0';
/* try matcher on the line, grab substring */
- result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
- ovector, nelem(ovector));
+ result = pcre2_match(drweb_re, (PCRE2_SPTR)tmpbuf, PCRE2_ZERO_TERMINATED,
+ 0, 0, md, pcre_gen_mtc_ctx);
if (result >= 2)
{
- const char * pre_malware_nb;
-
- pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
+ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md);
if (i==0) /* the first name we just copy to malware_name */
- g = string_cat(NULL, US pre_malware_nb);
+ g = string_catn(NULL, US ovec[2], ovec[3] - ovec[2]);
- /*XXX could be string_append_listele? */
else /* concatenate each new virus name to previous */
- g = string_append(g, 2, "/", pre_malware_nb);
-
- pcre_free_substring(pre_malware_nb);
+ {
+ g = string_catn(g, US"/", 1);
+ g = string_catn(g, US ovec[2], ovec[3] - ovec[2]);
+ }
}
+ /* pcre2_match_data_free(md); gen ctx needs no free */
}
malware_name = string_from_gstring(g);
}
/* set up match */
/* todo also SUSPICION\t */
if (!fsec_re)
- fsec_re = m_pcre_compile(fsec_re_str, &errstr);
+ fsec_re = m_pcre_compile(fsec_re_str, FALSE, &errstr);
/* read report, linewise. Apply a timeout as the Fsecure daemon
sometimes wants an answer to "PING" but they won't tell us what */
int kav_rc;
unsigned long kav_reportlen;
int bread;
- const pcre *kav_re;
+ const pcre2_code *kav_re;
uschar *p;
/* get current date and time, build scan request */
/* set up match regex, depends on retcode */
if (kav_rc == 3)
{
- if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, &errstr);
+ if (!kav_re_sus) kav_re_sus = m_pcre_compile(kav_re_sus_str, FALSE, &errstr);
kav_re = kav_re_sus;
}
else
{
- if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, &errstr);
+ if (!kav_re_inf) kav_re_inf = m_pcre_compile(kav_re_inf_str, FALSE, &errstr);
kav_re = kav_re_inf;
}
case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
{
const uschar *cmdline_scanner = scanner_options;
- const pcre *cmdline_trigger_re;
- const pcre *cmdline_regex_re;
+ const pcre2_code *cmdline_trigger_re;
+ const pcre2_code *cmdline_regex_re;
uschar * file_name;
uschar * commandline;
void (*eximsigchld)(int);
return m_panic_defer(scanent, NULL, errstr);
/* find scanner output trigger */
- cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep, av_scanner_textonly,
"missing trigger specification", &errstr);
if (!cmdline_trigger_re)
return m_panic_defer(scanent, NULL, errstr);
/* find scanner name regex */
- cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep, av_scanner_textonly,
"missing virus name regex specification", &errstr);
if (!cmdline_regex_re)
return m_panic_defer(scanent, NULL, errstr);
uschar av_buffer[1024];
uschar *hostname = US"";
host_item connhost;
- int clam_fd, result;
+ int clam_fd;
unsigned int fsize_uint;
BOOL use_scan_command = FALSE;
clamd_address * cv[MAX_CLAMD_SERVERS];
int subsep = ' ';
/* Local file; so we def want to use_scan_command and don't want to try
- * passing IP/port combinations */
+ passing IP/port combinations */
use_scan_command = TRUE;
- cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
+ cd = (clamd_address *) store_get(sizeof(clamd_address), GET_UNTAINTED);
/* extract socket-path part */
sublist = scanner_options;
continue;
}
- cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
+ cd = (clamd_address *) store_get(sizeof(clamd_address), GET_UNTAINTED);
/* extract host and port part */
sublist = scanner_options;
if (!use_scan_command)
{ cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
else
- cmd_str.data = string_sprintf("SCAN %s\n%n", eml_filename, &cmd_str.len);
+ {
+ int n;
+ cmd_str.data = string_sprintf("SCAN %s\n%n", eml_filename, &n);
+ cmd_str.len = n; /* .len is a size_t */
+ }
/* We have some network servers specified */
if (num_servers)
if (*p) ++p;
/* colon in returned output? */
- if(!(p = Ustrchr(av_buffer,':')))
+ if (!(p = Ustrchr(av_buffer,':')))
return m_panic_defer(scanent, CUS callout_address, string_sprintf(
"ClamAV returned malformed result (missing colon): %s",
av_buffer));
uschar * linebuffer;
uschar * sockline_scanner;
uschar sockline_scanner_default[] = "%s\n";
- const pcre *sockline_trig_re;
- const pcre *sockline_name_re;
+ const pcre2_code *sockline_trig_re;
+ const pcre2_code *sockline_name_re;
/* find scanner command line */
if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
string_printing(sockline_scanner));
/* find scanner output trigger */
- sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep, av_scanner_textonly,
"missing trigger specification", &errstr);
if (!sockline_trig_re)
return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
/* find virus name regex */
- sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep, av_scanner_textonly,
"missing virus name regex specification", &errstr);
if (!sockline_name_re)
return m_panic_defer_3(scanent, NULL, errstr, malware_daemon_ctx.sock);
*/
if ( ( !ava_re_clean
- && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr)))
+ && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, FALSE, &errstr)))
|| ( !ava_re_virus
- && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr)))
+ && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, FALSE, &errstr)))
|| ( !ava_re_error
- && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr)))
+ && !(ava_re_error = m_pcre_compile(ava_re_error_str, FALSE, &errstr)))
)
return malware_panic_defer(errstr);
if (malware_name) /* Nothing else matters, just read on */
break;
- if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
+ if (regex_match(ava_re_clean, buf, slen, NULL))
break;
if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
break;
}
}
- else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
+ else if (regex_match(ava_re_error, buf, slen, NULL))
{
log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
break;
Arguments:
malware_re match condition for "malware="
+ cacheable the RE did not use any dynamic elements during expansion
timeout if nonzero, timeout in seconds
Returns: Exim message processing code (OK, FAIL, DEFER, ...)
where true means malware was found (condition applies)
*/
int
-malware(const uschar * malware_re, int timeout)
+malware(const uschar * malware_re, BOOL cacheable, int timeout)
{
-int ret = malware_internal(malware_re, NULL, timeout);
+int ret = malware_internal(malware_re, cacheable, NULL, timeout);
if (ret == DEFER) av_failed = TRUE;
return ret;
receive_add_recipient(US"malware-victim@example.net", -1);
f.enable_dollar_recipients = TRUE;
-ret = malware_internal(US"*", eml_filename, 0);
+ret = malware_internal(US"*", TRUE, eml_filename, 0);
Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
spool_mbox_ok = 1;
malware_init(void)
{
if (!malware_default_re)
- malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
+ malware_default_re = regex_must_compile(malware_regex_default, MCS_NOFLAGS, TRUE);
#ifndef DISABLE_MAL_DRWEB
if (!drweb_re)
- drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
+ drweb_re = regex_must_compile(drweb_re_str, MCS_NOFLAGS, TRUE);
#endif
#ifndef DISABLE_MAL_FSECURE
if (!fsec_re)
- fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
+ fsec_re = regex_must_compile(fsec_re_str, MCS_NOFLAGS, TRUE);
#endif
#ifndef DISABLE_MAL_KAV
if (!kav_re_sus)
- kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
+ kav_re_sus = regex_must_compile(kav_re_sus_str, MCS_NOFLAGS, TRUE);
if (!kav_re_inf)
- kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
+ kav_re_inf = regex_must_compile(kav_re_inf_str, MCS_NOFLAGS, TRUE);
#endif
#ifndef DISABLE_MAL_AVAST
if (!ava_re_clean)
- ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
+ ava_re_clean = regex_must_compile(ava_re_clean_str, MCS_NOFLAGS, TRUE);
if (!ava_re_virus)
- ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
+ ava_re_virus = regex_must_compile(ava_re_virus_str, MCS_NOFLAGS, TRUE);
if (!ava_re_error)
- ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE);
+ ava_re_error = regex_must_compile(ava_re_error_str, MCS_NOFLAGS, TRUE);
#endif
#ifndef DISABLE_MAL_FFROT6D
if (!fprot6d_re_error)
- fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
+ fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, MCS_NOFLAGS, TRUE);
if (!fprot6d_re_virus)
- fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
+ fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, MCS_NOFLAGS, TRUE);
#endif
}
git://git.exim.org / exim.git / blobdiff