* Exim - an Internet mail transport agent *
*************************************************/
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+/*
+ * Copyright (c) The Exim Maintainers 2015 - 2022
+ * Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
* License: GPL
- * Copyright (c) The Exim Maintainers 2015 - 2020
*/
/* Code for calling virus (malware) scanners. Called from acl.c. */
{
const uschar * s;
uschar * t;
-uschar buf[64];
+uschar buf[EXIM_DRIVERNAME_MAX];
spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
#define MALWARE_TIMEOUT 120 /* default timeout, seconds */
static const uschar * malware_regex_default = US ".+";
-static const pcre * malware_default_re = NULL;
-
+static const pcre2_code * malware_default_re = NULL;
#ifndef DISABLE_MAL_CLAM
# define DERR_BAD_CALL (1<<15) /* wrong command */
static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
-static const pcre * drweb_re = NULL;
+static const pcre2_code * drweb_re = NULL;
#endif
#ifndef DISABLE_MAL_FSECURE
static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
-static const pcre * fsec_re = NULL;
+static const pcre2_code * fsec_re = NULL;
#endif
#ifndef DISABLE_MAL_KAV
static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
-static const pcre * kav_re_sus = NULL;
-static const pcre * kav_re_inf = NULL;
+static const pcre2_code * kav_re_sus = NULL;
+static const pcre2_code * kav_re_inf = NULL;
#endif
#ifndef DISABLE_MAL_AVAST
static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)";
static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)";
-static const pcre * ava_re_clean = NULL;
-static const pcre * ava_re_virus = NULL;
-static const pcre * ava_re_error = NULL;
+static const pcre2_code * ava_re_clean = NULL;
+static const pcre2_code * ava_re_virus = NULL;
+static const pcre2_code * ava_re_error = NULL;
#endif
#ifndef DISABLE_MAL_FFROT6D
static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
-static const pcre * fprot6d_re_error = NULL;
-static const pcre * fprot6d_re_virus = NULL;
+static const pcre2_code * fprot6d_re_error = NULL;
+static const pcre2_code * fprot6d_re_virus = NULL;
#endif
m_tcpsocket(const uschar * hostname, unsigned int port,
host_item * host, uschar ** errstr, const blob * fastopen_blob)
{
-return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
+int fd = ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
host, errstr, fastopen_blob);
+#ifdef EXIM_TFO_FREEBSD
+/* Under some fault conditions, FreeBSD 12.2 seen to send a (non-TFO) SYN
+and, getting no response, wait for a long time. Impose a 5s max. */
+if (fd >= 0)
+ (void) poll_one_fd(fd, POLLOUT, 5 * 1000);
+#endif
+return fd;
}
#endif
return sock;
}
-static const pcre *
+static const pcre2_code *
m_pcre_compile(const uschar * re, uschar ** errstr)
{
-const uschar * rerror;
-int roffset;
-const pcre * cre;
+int err;
+PCRE2_SIZE roffset;
+const pcre2_code * cre;
-if (!(cre = pcre_compile(CS re, PCRE_COPT, CCSS &rerror, &roffset, NULL)))
- *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
- re, rerror, roffset);
+if (!(cre = pcre2_compile((PCRE2_SPTR)re, PCRE2_ZERO_TERMINATED,
+ PCRE_COPT, &err, &roffset, pcre_cmp_ctx)))
+ {
+ uschar errbuf[128];
+ pcre2_get_error_message(err, errbuf, sizeof(errbuf));
+ *errstr= string_sprintf("regular expression error in '%s': %s at offset %ld",
+ re, errbuf, (long)roffset);
+ }
return cre;
}
uschar *
-m_pcre_exec(const pcre * cre, uschar * text)
+m_pcre_exec(const pcre2_code * cre, uschar * text)
{
-int ovector[10*3];
-int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
- ovector, nelem(ovector));
-uschar * substr = NULL;
+pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx);
+int i = pcre2_match(cre, text, PCRE2_ZERO_TERMINATED, 0, 0, md, pcre_mtc_ctx);
+PCRE2_UCHAR * substr = NULL;
+PCRE2_SIZE slen;
+
if (i >= 2) /* Got it */
- pcre_get_substring(CS text, ovector, i, 1, CCSS &substr);
-return substr;
+ pcre2_substring_get_bynumber(md, 1, &substr, &slen);
+return US substr;
}
-static const pcre *
+static const pcre2_code *
m_pcre_nextinlist(const uschar ** list, int * sep,
char * listerr, uschar ** errstr)
{
const uschar * list_ele;
-const pcre * cre = NULL;
+const pcre2_code * cre = NULL;
if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
*errstr = US listerr;
uschar *scanner_name;
unsigned long mbox_size;
FILE *mbox_file;
-const pcre *re;
+const pcre2_code *re;
uschar * errstr;
struct scan * scanent;
const uschar * scanner_options;
/* read and concatenate virus names into one string */
for (int i = 0; i < drweb_vnum; i++)
{
- int ovector[10*3];
+ pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx);
/* read the size of report */
if (!recv_len(malware_daemon_ctx.sock, &drweb_slen, sizeof(drweb_slen), tmo))
drweb_slen = ntohl(drweb_slen);
/* assume tainted, since it is external input */
- tmpbuf = store_get(drweb_slen, TRUE);
+ tmpbuf = store_get(drweb_slen, GET_TAINTED);
/* read report body */
if (!recv_len(malware_daemon_ctx.sock, tmpbuf, drweb_slen, tmo))
tmpbuf[drweb_slen] = '\0';
/* try matcher on the line, grab substring */
- result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
- ovector, nelem(ovector));
+ result = pcre2_match(drweb_re, (PCRE2_SPTR)tmpbuf, PCRE2_ZERO_TERMINATED,
+ 0, 0, md, pcre_mtc_ctx);
if (result >= 2)
{
- const char * pre_malware_nb;
-
- pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
+ PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md);
if (i==0) /* the first name we just copy to malware_name */
- g = string_cat(NULL, US pre_malware_nb);
+ g = string_catn(NULL, US ovec[2], ovec[3] - ovec[2]);
- /*XXX could be string_append_listele? */
else /* concatenate each new virus name to previous */
- g = string_append(g, 2, "/", pre_malware_nb);
-
- pcre_free_substring(pre_malware_nb);
+ {
+ g = string_catn(g, US"/", 1);
+ g = string_catn(g, US ovec[2], ovec[3] - ovec[2]);
+ }
}
}
malware_name = string_from_gstring(g);
int kav_rc;
unsigned long kav_reportlen;
int bread;
- const pcre *kav_re;
+ const pcre2_code *kav_re;
uschar *p;
/* get current date and time, build scan request */
case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
{
const uschar *cmdline_scanner = scanner_options;
- const pcre *cmdline_trigger_re;
- const pcre *cmdline_regex_re;
+ const pcre2_code *cmdline_trigger_re;
+ const pcre2_code *cmdline_regex_re;
uschar * file_name;
uschar * commandline;
void (*eximsigchld)(int);
uschar av_buffer[1024];
uschar *hostname = US"";
host_item connhost;
- uschar *clamav_fbuf;
- int clam_fd, result;
+ int clam_fd;
unsigned int fsize_uint;
BOOL use_scan_command = FALSE;
clamd_address * cv[MAX_CLAMD_SERVERS];
int subsep = ' ';
/* Local file; so we def want to use_scan_command and don't want to try
- * passing IP/port combinations */
+ passing IP/port combinations */
use_scan_command = TRUE;
- cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
+ cd = (clamd_address *) store_get(sizeof(clamd_address), GET_UNTAINTED);
/* extract socket-path part */
sublist = scanner_options;
continue;
}
- cd = (clamd_address *) store_get(sizeof(clamd_address), FALSE);
+ cd = (clamd_address *) store_get(sizeof(clamd_address), GET_UNTAINTED);
/* extract host and port part */
sublist = scanner_options;
{ cmd_str.data = US"zINSTREAM"; cmd_str.len = 10; }
else
{
- cmd_str.data = string_sprintf("SCAN %s\n", eml_filename);
- cmd_str.len = Ustrlen(cmd_str.data);
+ int n;
+ cmd_str.data = string_sprintf("SCAN %s\n%n", eml_filename, &n);
+ cmd_str.len = n; /* .len is a size_t */
}
/* We have some network servers specified */
if (num_servers)
{
/* Confirmed in ClamAV source (0.95.3) that the TCPAddr option of clamd
- * only supports AF_INET, but we should probably be looking to the
- * future and rewriting this to be protocol-independent anyway. */
+ only supports AF_INET, but we should probably be looking to the
+ future and rewriting this to be protocol-independent anyway. */
while (num_servers > 0)
{
cd->hostspec, cd->tcp_port);
/* Lookup the host. This is to ensure that we connect to the same IP
- * on both connections (as one host could resolve to multiple ips) */
+ on both connections (as one host could resolve to multiple ips) */
for (;;)
{
- /*XXX we trust that the cmd_str is ideempotent */
+ /*XXX we trust that the cmd_str is idempotent */
if ((malware_daemon_ctx.sock = m_tcpsocket(cd->hostspec, cd->tcp_port,
- &connhost, &errstr, &cmd_str)) >= 0)
+ &connhost, &errstr,
+ use_scan_command ? &cmd_str : NULL)) >= 0)
{
/* Connection successfully established with a server */
hostname = cd->hostspec;
- cmd_str.len = 0;
+ if (use_scan_command) cmd_str.len = 0;
break;
}
if (cd->retry <= 0) break;
}
/* have socket in variable "sock"; command to use is semi-independent of
- * the socket protocol. We use SCAN if is local (either Unix/local
- * domain socket, or explicitly told local) else we stream the data.
- * How we stream the data depends upon how we were built. */
+ the socket protocol. We use SCAN if is local (either Unix/local
+ domain socket, or explicitly told local) else we stream the data.
+ How we stream the data depends upon how we were built. */
if (!use_scan_command)
{
struct stat st;
+#if defined(EXIM_TCP_CORK) && !defined(OS_SENDFILE)
+ BOOL corked = TRUE;
+#endif
/* New protocol: "zINSTREAM\n" followed by a sequence of <length><data>
chunks, <n> a 4-byte number (network order), terminated by a zero-length
- chunk. */
+ chunk. We only send one chunk. */
DEBUG(D_acl) debug_printf_indent(
"Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
scanner_name);
+#if defined(EXIM_TCP_CORK)
+ (void) setsockopt(malware_daemon_ctx.sock, IPPROTO_TCP, EXIM_TCP_CORK,
+ US &on, sizeof(on));
+#endif
/* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */
if (cmd_str.len)
if (send(malware_daemon_ctx.sock, cmd_str.data, cmd_str.len, 0) < 0)
malware_daemon_ctx.sock);
}
- /* send file body to socket */
+ /* send file size */
send_size = htonl(fsize_uint);
if (send(malware_daemon_ctx.sock, &send_size, sizeof(send_size), 0) < 0)
return m_panic_defer_3(scanent, NULL,
string_sprintf("unable to send file size to socket (%s)", hostname),
malware_daemon_ctx.sock);
+ /* send file body */
while (fsize_uint)
{
- unsigned n = MIN(fsize_uint, big_buffer_size);
+#ifdef OS_SENDFILE
+ int n = os_sendfile(malware_daemon_ctx.sock, clam_fd, NULL, (size_t)fsize_uint);
+ if (n < 0)
+ return m_panic_defer_3(scanent, NULL,
+ string_sprintf("unable to send file body to socket (%s): %s", hostname, strerror(errno)),
+ malware_daemon_ctx.sock);
+ fsize_uint -= n;
+#else
+ int n = MIN(fsize_uint, big_buffer_size);
if ((n = read(clam_fd, big_buffer, n)) < 0)
return m_panic_defer_3(scanent, NULL,
string_sprintf("can't read spool file %s: %s",
eml_filename, strerror(errno)),
malware_daemon_ctx.sock);
- if ((n = send(malware_daemon_ctx.sock, clamav_fbuf, n, 0)) < 0)
+ if (send(malware_daemon_ctx.sock, big_buffer, (size_t)n, 0) < 0)
return m_panic_defer_3(scanent, NULL,
- string_sprintf("unable to send file body to socket (%s)", hostname),
+ string_sprintf("unable to send file body to socket (%s): %s", hostname, strerror(errno)),
malware_daemon_ctx.sock);
fsize_uint -= n;
+# ifdef EXIM_TCP_CORK
+ if (corked)
+ {
+ corked = FALSE;
+ (void) setsockopt(malware_daemon_ctx.sock, IPPROTO_TCP, EXIM_TCP_CORK,
+ US &off, sizeof(off));
+ }
+# endif
+#endif /*!OS_SENDFILE*/
+
}
send_final_zeroblock = 0;
return m_panic_defer_3(scanent, NULL,
string_sprintf("unable to send file terminator to socket (%s)", hostname),
malware_daemon_ctx.sock);
+#ifdef OS_SENDFILE
+ (void) setsockopt(malware_daemon_ctx.sock, IPPROTO_TCP, EXIM_TCP_CORK,
+ US &off, sizeof(off));
+#endif
}
else
{ /* use scan command */
/* Send a SCAN command pointing to a filename; then in the then in the
- * scan-method-neutral part, read the response back */
+ scan-method-neutral part, read the response back */
/* ================================================================= */
malware_daemon_ctx.sock);
/* Do not shut down the socket for writing; a user report noted that
- * clamd 0.70 does not react well to this. */
+ clamd 0.70 does not react well to this. */
}
/* Commands have been sent, no matter which scan method or connection
- * type we're using; now just read the result, independent of method. */
+ type we're using; now just read the result, independent of method. */
/* Read the result */
memset(av_buffer, 0, sizeof(av_buffer));
/* strip newline at the end (won't be present for zINSTREAM)
(also any trailing whitespace, which shouldn't exist, but we depend upon
this below, so double-check) */
+
p = av_buffer + Ustrlen(av_buffer) - 1;
if (*p == '\n') *p = '\0';
if (*p) ++p;
/* colon in returned output? */
- if(!(p = Ustrchr(av_buffer,':')))
+ if (!(p = Ustrchr(av_buffer,':')))
return m_panic_defer(scanent, CUS callout_address, string_sprintf(
"ClamAV returned malformed result (missing colon): %s",
av_buffer));
uschar * linebuffer;
uschar * sockline_scanner;
uschar sockline_scanner_default[] = "%s\n";
- const pcre *sockline_trig_re;
- const pcre *sockline_name_re;
+ const pcre2_code *sockline_trig_re;
+ const pcre2_code *sockline_name_re;
/* find scanner command line */
if ( (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
if (malware_name) /* Nothing else matters, just read on */
break;
- if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
+ if (regex_match(ava_re_clean, buf, slen, NULL))
break;
if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
break;
}
}
- else if (pcre_exec(ava_re_error, NULL, CS buf, slen, 0, 0, NULL, 0) == 0)
+ else if (regex_match(ava_re_error, buf, slen, NULL))
{
log_write(0, LOG_MAIN, "internal scanner error (ignored): %s", buf);
break;