-/* $Cambridge: exim/src/src/malware.c,v 1.2 2004/12/16 15:11:47 tom Exp $ */
+/* $Cambridge: exim/src/src/malware.c,v 1.3 2004/12/17 14:52:44 ph10 Exp $ */
/*************************************************
* Exim - an Internet mail transport agent *
uschar *malware_regex;
uschar malware_regex_buffer[64];
uschar malware_regex_default[] = ".+";
- unsigned long long mbox_size;
+ unsigned long mbox_size;
FILE *mbox_file;
int roffset;
const pcre *re;
return DEFER;
};
- /* "drweb" scanner type ----------------------------------------------- */
- /* v0.1 - added support for tcp sockets */
- /* v0.0 - initial release -- support for unix sockets */
- if (strcmpic(scanner_name,US"drweb") == 0) {
- uschar *drweb_options;
- uschar drweb_options_buffer[1024];
- uschar drweb_options_default[] = "/usr/local/drweb/run/drwebd.sock";
- struct sockaddr_un server;
- int sock, port, result, ovector[30];
- unsigned int fsize;
- uschar tmpbuf[1024], *drweb_fbuf;
- uschar scanrequest[1024];
- uschar drweb_match_string[128];
- int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
- drweb_vnum, drweb_slen, drweb_fin = 0x0000;
- unsigned long bread;
- uschar hostname[256];
- struct hostent *he;
- struct in_addr in;
- pcre *drweb_re;
+ /* "drweb" scanner type ----------------------------------------------- */
+ /* v0.1 - added support for tcp sockets */
+ /* v0.0 - initial release -- support for unix sockets */
+ if (strcmpic(scanner_name,US"drweb") == 0) {
+ uschar *drweb_options;
+ uschar drweb_options_buffer[1024];
+ uschar drweb_options_default[] = "/usr/local/drweb/run/drwebd.sock";
+ struct sockaddr_un server;
+ int sock, result, ovector[30];
+ unsigned int port, fsize;
+ uschar tmpbuf[1024], *drweb_fbuf;
+ uschar scanrequest[1024];
+ uschar drweb_match_string[128];
+ int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
+ drweb_vnum, drweb_slen, drweb_fin = 0x0000;
+ unsigned long bread;
+ uschar hostname[256];
+ struct hostent *he;
+ struct in_addr in;
+ pcre *drweb_re;
- if ((drweb_options = string_nextinlist(&av_scanner_work, &sep,
- drweb_options_buffer, sizeof(drweb_options_buffer))) == NULL) {
- /* no options supplied, use default options */
- drweb_options = drweb_options_default;
- };
+ if ((drweb_options = string_nextinlist(&av_scanner_work, &sep,
+ drweb_options_buffer, sizeof(drweb_options_buffer))) == NULL) {
+ /* no options supplied, use default options */
+ drweb_options = drweb_options_default;
+ };
- if (*drweb_options != '/') {
+ if (*drweb_options != '/') {
- /* extract host and port part */
- if( sscanf(CS drweb_options, "%s %u", hostname, &port) != 2 ) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: invalid socket '%s'", drweb_options);
- return DEFER;
- }
+ /* extract host and port part */
+ if( sscanf(CS drweb_options, "%s %u", hostname, &port) != 2 ) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: invalid socket '%s'", drweb_options);
+ return DEFER;
+ }
- /* Lookup the host */
- if((he = gethostbyname(CS hostname)) == 0) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: failed to lookup host '%s'", hostname);
- return DEFER;
- }
+ /* Lookup the host */
+ if((he = gethostbyname(CS hostname)) == 0) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: failed to lookup host '%s'", hostname);
+ return DEFER;
+ }
- in = *(struct in_addr *) he->h_addr_list[0];
+ in = *(struct in_addr *) he->h_addr_list[0];
- /* Open the drwebd TCP socket */
- if ( (sock = ip_socket(SOCK_STREAM, AF_INET)) < 0) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to acquire socket (%s)",
- strerror(errno));
- return DEFER;
- }
+ /* Open the drwebd TCP socket */
+ if ( (sock = ip_socket(SOCK_STREAM, AF_INET)) < 0) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to acquire socket (%s)",
+ strerror(errno));
+ return DEFER;
+ }
- if (ip_connect(sock, AF_INET, (uschar*)inet_ntoa(in), port, 5) < 0) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: connection to %s, port %u failed (%s)",
- inet_ntoa(in), port, strerror(errno));
- return DEFER;
- }
+ if (ip_connect(sock, AF_INET, (uschar*)inet_ntoa(in), port, 5) < 0) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: connection to %s, port %u failed (%s)",
+ inet_ntoa(in), port, strerror(errno));
+ return DEFER;
+ }
- /* prepare variables */
- drweb_cmd = htonl(DRWEBD_SCAN_CMD);
- drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
- snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml",
- spool_directory, message_id, message_id);
+ /* prepare variables */
+ drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+ drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
+ snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml",
+ spool_directory, message_id, message_id);
- /* calc file size */
- drweb_fd = open(CS scanrequest, O_RDONLY);
- if (drweb_fd == -1) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: can't open spool file %s: %s",
- scanrequest, strerror(errno));
- return DEFER;
- }
- fsize = lseek(drweb_fd, 0, SEEK_END);
- if (fsize == -1) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: can't seek spool file %s: %s",
- scanrequest, strerror(errno));
- return DEFER;
- }
- drweb_slen = htonl(fsize);
- lseek(drweb_fd, 0, SEEK_SET);
+ /* calc file size */
+ drweb_fd = open(CS scanrequest, O_RDONLY);
+ if (drweb_fd == -1) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: can't open spool file %s: %s",
+ scanrequest, strerror(errno));
+ return DEFER;
+ }
+ fsize = lseek(drweb_fd, 0, SEEK_END);
+ if (fsize == -1) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: can't seek spool file %s: %s",
+ scanrequest, strerror(errno));
+ return DEFER;
+ }
+ drweb_slen = htonl(fsize);
+ lseek(drweb_fd, 0, SEEK_SET);
- /* send scan request */
- if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
- (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
- (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
- (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) {
- close(sock);
- close(drweb_fd);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
- return DEFER;
- }
+ /* send scan request */
+ if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
+ (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+ (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
+ (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) {
+ close(sock);
+ close(drweb_fd);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+ return DEFER;
+ }
- drweb_fbuf = (uschar *) malloc (fsize);
- if (!drweb_fbuf) {
- close(sock);
- close(drweb_fd);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to allocate memory %u for file (%s)",
- fsize, scanrequest);
- return DEFER;
- }
+ drweb_fbuf = (uschar *) malloc (fsize);
+ if (!drweb_fbuf) {
+ close(sock);
+ close(drweb_fd);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to allocate memory %u for file (%s)",
+ fsize, scanrequest);
+ return DEFER;
+ }
- result = read (drweb_fd, drweb_fbuf, fsize);
- if (result == -1) {
- close(sock);
- close(drweb_fd);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: can't read spool file %s: %s",
- scanrequest, strerror(errno));
- return DEFER;
- }
-
- /* send file body to socket */
- if (send(sock, drweb_fbuf, fsize, 0) < 0) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options);
- return DEFER;
- }
- close(drweb_fd);
- free(drweb_fbuf);
- }
- else {
- /* open the drwebd UNIX socket */
- sock = socket(AF_UNIX, SOCK_STREAM, 0);
- if (sock < 0) {
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: can't open UNIX socket");
- return DEFER;
- }
- server.sun_family = AF_UNIX;
- Ustrcpy(server.sun_path, drweb_options);
- if (connect(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_un)) < 0) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options, errno);
- return DEFER;
- }
+ result = read (drweb_fd, drweb_fbuf, fsize);
+ if (result == -1) {
+ close(sock);
+ close(drweb_fd);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: can't read spool file %s: %s",
+ scanrequest, strerror(errno));
+ return DEFER;
+ }
+
+ /* send file body to socket */
+ if (send(sock, drweb_fbuf, fsize, 0) < 0) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options);
+ return DEFER;
+ }
+ close(drweb_fd);
+ free(drweb_fbuf);
+ }
+ else {
+ /* open the drwebd UNIX socket */
+ sock = socket(AF_UNIX, SOCK_STREAM, 0);
+ if (sock < 0) {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: can't open UNIX socket");
+ return DEFER;
+ }
+ server.sun_family = AF_UNIX;
+ Ustrcpy(server.sun_path, drweb_options);
+ if (connect(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_un)) < 0) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options, errno);
+ return DEFER;
+ }
- /* prepare variables */
- drweb_cmd = htonl(DRWEBD_SCAN_CMD);
- drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
- snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
- drweb_slen = htonl(Ustrlen(scanrequest));
+ /* prepare variables */
+ drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+ drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
+ snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
+ drweb_slen = htonl(Ustrlen(scanrequest));
- /* send scan request */
- if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
- (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
- (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
- (send(sock, scanrequest, Ustrlen(scanrequest), 0) < 0) ||
- (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
- return DEFER;
- }
- }
+ /* send scan request */
+ if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) ||
+ (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+ (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
+ (send(sock, scanrequest, Ustrlen(scanrequest), 0) < 0) ||
+ (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+ return DEFER;
+ }
+ }
- /* wait for result */
- if ((bread = recv(sock, &drweb_rc, sizeof(drweb_rc), 0) != sizeof(drweb_rc))) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to read return code");
- return DEFER;
- }
- drweb_rc = ntohl(drweb_rc);
+ /* wait for result */
+ if ((bread = recv(sock, &drweb_rc, sizeof(drweb_rc), 0) != sizeof(drweb_rc))) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to read return code");
+ return DEFER;
+ }
+ drweb_rc = ntohl(drweb_rc);
- if ((bread = recv(sock, &drweb_vnum, sizeof(drweb_vnum), 0) != sizeof(drweb_vnum))) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: unable to read the number of viruses");
- return DEFER;
- }
- drweb_vnum = ntohl(drweb_vnum);
-
- /* "virus(es) found" if virus number is > 0 */
- if (drweb_vnum)
- {
- int i;
- uschar pre_malware_nb[256];
-
- malware_name = malware_name_buffer;
-
- /* setup default virus name */
- Ustrcpy(malware_name_buffer,"unknown");
-
- /* read and concatenate virus names into one string */
- for (i=0;i<drweb_vnum;i++)
- {
- /* read the size of report */
- if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: cannot read report size");
- return DEFER;
- };
- drweb_slen = ntohl(drweb_slen);
-
- /* read report body */
- if ((bread = recv(sock, tmpbuf, drweb_slen, 0)) != drweb_slen) {
- close(sock);
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: drweb: cannot read report string");
- return DEFER;
- };
- tmpbuf[drweb_slen] = '\0';
+ if ((bread = recv(sock, &drweb_vnum, sizeof(drweb_vnum), 0) != sizeof(drweb_vnum))) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: unable to read the number of viruses");
+ return DEFER;
+ }
+ drweb_vnum = ntohl(drweb_vnum);
+
+ /* "virus(es) found" if virus number is > 0 */
+ if (drweb_vnum)
+ {
+ int i;
+ uschar pre_malware_nb[256];
+
+ malware_name = malware_name_buffer;
+
+ /* setup default virus name */
+ Ustrcpy(malware_name_buffer,"unknown");
+
+ /* read and concatenate virus names into one string */
+ for (i=0;i<drweb_vnum;i++)
+ {
+ /* read the size of report */
+ if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: cannot read report size");
+ return DEFER;
+ };
+ drweb_slen = ntohl(drweb_slen);
+
+ /* read report body */
+ if ((bread = recv(sock, tmpbuf, drweb_slen, 0)) != drweb_slen) {
+ close(sock);
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "malware acl condition: drweb: cannot read report string");
+ return DEFER;
+ };
+ tmpbuf[drweb_slen] = '\0';
- /* set up match regex, depends on retcode */
- Ustrcpy(drweb_match_string, "infected\\swith\\s*(.+?)$");
+ /* set up match regex, depends on retcode */
+ Ustrcpy(drweb_match_string, "infected\\swith\\s*(.+?)$");
- drweb_re = pcre_compile( CS drweb_match_string,
- PCRE_COPT,
- (const char **)&rerror,
- &roffset,
- NULL );
+ drweb_re = pcre_compile( CS drweb_match_string,
+ PCRE_COPT,
+ (const char **)&rerror,
+ &roffset,
+ NULL );
- /* try matcher on the line, grab substring */
- result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0, ovector, 30);
- if (result >= 2) {
- pcre_copy_substring(CS tmpbuf, ovector, result, 1, CS pre_malware_nb, 255);
- }
- /* the first name we just copy to malware_name */
- if (i==0)
- Ustrcpy(CS malware_name_buffer, CS pre_malware_nb);
- else {
- /* concatenate each new virus name to previous */
- int slen = Ustrlen(malware_name_buffer);
- if (slen < (slen+Ustrlen(pre_malware_nb))) {
- Ustrcat(malware_name_buffer, "/");
- Ustrcat(malware_name_buffer, pre_malware_nb);
- }
- }
- }
- }
- else {
- /* no virus found */
- malware_name = NULL;
- };
- close(sock);
- }
- /* ----------------------------------------------------------------------- */
+ /* try matcher on the line, grab substring */
+ result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0, ovector, 30);
+ if (result >= 2) {
+ pcre_copy_substring(CS tmpbuf, ovector, result, 1, CS pre_malware_nb, 255);
+ }
+ /* the first name we just copy to malware_name */
+ if (i==0)
+ Ustrcpy(CS malware_name_buffer, CS pre_malware_nb);
+ else {
+ /* concatenate each new virus name to previous */
+ int slen = Ustrlen(malware_name_buffer);
+ if (slen < (slen+Ustrlen(pre_malware_nb))) {
+ Ustrcat(malware_name_buffer, "/");
+ Ustrcat(malware_name_buffer, pre_malware_nb);
+ }
+ }
+ }
+ }
+ else {
+ /* no virus found */
+ malware_name = NULL;
+ };
+ close(sock);
+ }
+ /* ----------------------------------------------------------------------- */
else if (strcmpic(scanner_name,US"aveserver") == 0) {
uschar *kav_options;
uschar kav_options_buffer[1024];
uschar kav_options_default[] = "/var/run/aveserver";
uschar buf[32768];
- uschar *p;
struct sockaddr_un server;
int sock;
uschar file_name[1024];
uschar av_buffer[1024];
pcre *fs_inf;
- static uschar *cmdoptions[] = { "CONFIGURE\tARCHIVE\t1\n","CONFIGURE\tTIMEOUT\t0\n","CONFIGURE\tMAXARCH\t5\n","CONFIGURE\tMIME\t1\n" };
+ static uschar *cmdoptions[] = { US"CONFIGURE\tARCHIVE\t1\n",
+ US"CONFIGURE\tTIMEOUT\t0\n",
+ US"CONFIGURE\tMAXARCH\t5\n",
+ US"CONFIGURE\tMIME\t1\n" };
malware_name = NULL;
if ((fsecure_options = string_nextinlist(&av_scanner_work, &sep,
uschar clamd_options_default[] = "/tmp/clamd";
uschar *p,*vname;
struct sockaddr_un server;
- int sock,port,bread=0;
+ int sock,bread=0;
+ unsigned int port;
uschar file_name[1024];
uschar av_buffer[1024];
uschar hostname[256];
/* Check the result. ClamAV Returns
infected: -> "<filename>: <virusname> FOUND"
not-infected: -> "<filename>: OK"
- error: -> "<filename>: <errcode> ERROR */
+ error: -> "<filename>: <errcode> ERROR */
if (!(*av_buffer)) {
log_write(0, LOG_MAIN|LOG_PANIC,
sizeof(mksd_options_buffer))) != NULL) {
mksd_maxproc = (int) strtol(CS mksd_options, &mksd_options_end, 10);
if ((*mksd_options == '\0') || (*mksd_options_end != '\0') ||
- (mksd_maxproc < 1) || (mksd_maxproc > 32)) {
+ (mksd_maxproc < 1) || (mksd_maxproc > 32)) {
log_write(0, LOG_MAIN|LOG_PANIC,
"malware acl condition: mksd: invalid option '%s'", mksd_options);
return DEFER;
git://git.exim.org / exim.git / commitdiff