From: Heiko Schlittermann (HS12-RIPE) Date: Fri, 30 Mar 2018 22:06:47 +0000 (+0200) Subject: Avast: improve compliance with avast-protocol(5) X-Git-Tag: exim-4_91_RC3~2 X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/ad93c40fe70f7de49ffb8601a589e9ffa117d512 Avast: improve compliance with avast-protocol(5) Treat scanner errors as malware. Defer on scanner tmpfail only. --- diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 16d276ee8..6353e29fb 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -31895,7 +31895,12 @@ $ socat UNIX:/var/run/avast/scan.sock STDIO: PACK .endd -Only the first virus detected will be reported. +A paniclog entry is logged and the message is deferred (except the +malware condition uses "defer_ok") if the scanner returns a tmpfail +(e.g. on license issues, or permission problems). If the scanner can't +scan a file for internal reasons (e.g. decompression bomb), this is +treated as an infection and malware_name is set to the error message. +We do this err on the safe side. .vitem &%aveserver%& diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 221c808bb..837b38083 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -190,6 +190,12 @@ JH/35 Cutthrough: for a final-dot response timeout (and nonunderstood responses) PP/02 DANE: add dane_require_tls_ciphers SMTP Transport option; if unset, tls_require_ciphers is used as before. +HS/03 Malware Avast: Better match the Avast multiline protocol. + Only tmpfails from the scanner are written to the paniclog, as + they may require admin intervention (permission denied, license + issues). Other scanner errors (like decompression bombs) do not + cause a paniclog entry. + Exim version 4.90 ----------------- diff --git a/src/src/malware.c b/src/src/malware.c index d24f09b88..7c57c0090 100644 --- a/src/src/malware.c +++ b/src/src/malware.c @@ -137,9 +137,11 @@ static const pcre * kav_re_inf = NULL; #ifndef DISABLE_MAL_AVAST static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]"; -static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\s(.*)"; +static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d+\\.0\\t0\\s(.*)"; +static const uschar * ava_re_error_str = US "(?!\\\\)\\t\\[E\\]\\d+\\.0\\tError\\s\\d+\\s(.*)"; static const pcre * ava_re_clean = NULL; static const pcre * ava_re_virus = NULL; +static const pcre * ava_re_error = NULL; #endif #ifndef DISABLE_MAL_FFROT6D @@ -176,27 +178,58 @@ extern int spool_mbox_ok; extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1]; +/* Some (currently avast only) use backslash escaped whitespace, +this function undoes these escapes */ +static inline void +unescape(char *p) { + uschar *p0; + for (; *p; ++p) + if (*p == '\\' && (isspace(p[1]) || p[1] == '\\')) + for (p0 = p; *p0; ++p0) *p0 = p0[1]; +} +/* --- malware_*_defer --- */ static inline int -malware_errlog_defer(const uschar * str) +malware_panic_defer(const uschar * str) { log_write(0, LOG_MAIN|LOG_PANIC, "malware acl condition: %s", str); return DEFER; } - -static int -m_errlog_defer(struct scan * scanent, const uschar * hostport, +static inline int +malware_log_defer(const uschar * str) +{ +log_write(0, LOG_MAIN, "malware acl condition: %s", str); +return DEFER; +} +/* --- m_*_defer --- */ +static inline int +m_panic_defer(struct scan * scanent, const uschar * hostport, const uschar * str) { -return malware_errlog_defer(string_sprintf("%s %s : %s", +return malware_panic_defer(string_sprintf("%s %s : %s", scanent->name, hostport ? hostport : CUS"", str)); } -static int -m_errlog_defer_3(struct scan * scanent, const uschar * hostport, +static inline int +m_log_defer(struct scan * scanent, const uschar * hostport, + const uschar * str) +{ +return malware_log_defer(string_sprintf("%s %s : %s", + scanent->name, hostport ? hostport : CUS"", str)); +} +/* --- m_*_defer_3 */ +static inline int +m_panic_defer_3(struct scan * scanent, const uschar * hostport, + const uschar * str, int fd_to_close) +{ +(void) close(fd_to_close); +return m_panic_defer(scanent, hostport, str); +} +static inline int +m_log_defer_3(struct scan * scanent, const uschar * hostport, const uschar * str, int fd_to_close) { (void) close(fd_to_close); -return m_errlog_defer(scanent, hostport, str); +return m_log_defer(scanent, hostport, str); } /*************************************************/ @@ -341,7 +374,7 @@ for (;;) while (i < 0 && errno == EINTR); if (i <= 0) { - (void) malware_errlog_defer( + (void) malware_panic_defer( US"unable to write to mksd UNIX socket (/var/run/mksd/socket)"); return -1; } @@ -373,7 +406,7 @@ do i = ip_recv(sock, av_buffer+offset, av_buffer_size-offset, tmo-time(NULL)); if (i <= 0) { - (void) malware_errlog_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)"); + (void) malware_panic_defer(US"unable to read from mksd UNIX socket (/var/run/mksd/socket)"); return -1; } @@ -381,7 +414,7 @@ do /* offset == av_buffer_size -> buffer full */ if (offset == av_buffer_size) { - (void) malware_errlog_defer(US"malformed reply received from mksd"); + (void) malware_panic_defer(US"malformed reply received from mksd"); return -1; } } while (av_buffer[offset-1] != '\n'); @@ -404,7 +437,7 @@ switch (*line) case 'A': /* ERR */ if ((p = strchr (line, '\n')) != NULL) *p = '\0'; - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("scanner failed: %s", line)); default: /* VIR */ @@ -422,7 +455,7 @@ switch (*line) return OK; } } - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("malformed reply received: %s", line)); } } @@ -515,7 +548,7 @@ if (!malware_re) /* Ensure the eml mbox file is spooled up */ if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename))) - return malware_errlog_defer(US"error while creating mbox spool file"); + return malware_panic_defer(US"error while creating mbox spool file"); /* None of our current scanners need the mbox file as a stream (they use the name), so we can close it right away. Get the directory too. */ @@ -535,20 +568,20 @@ if ( strcmpic(malware_re,US"true") == 0 { if ( !malware_default_re && !(malware_default_re = m_pcre_compile(malware_regex_default, &errstr))) - return malware_errlog_defer(errstr); + return malware_panic_defer(errstr); malware_re = malware_regex_default; re = malware_default_re; } /* compile the regex, see if it works */ else if (!(re = m_pcre_compile(malware_re, &errstr))) - return malware_errlog_defer(errstr); + return malware_panic_defer(errstr); /* if av_scanner starts with a dollar, expand it first */ if (*av_scanner == '$') { if (!(av_scanner_work = expand_string(av_scanner))) - return malware_errlog_defer( + return malware_panic_defer( string_sprintf("av_scanner starts with $, but expansion failed: %s", expand_string_message)); @@ -564,14 +597,14 @@ if (!malware_ok) { /* find the scanner type from the av_scanner option */ if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0))) - return malware_errlog_defer(US"av_scanner configuration variable is empty"); + return malware_panic_defer(US"av_scanner configuration variable is empty"); if (!timeout) timeout = MALWARE_TIMEOUT; tmo = time(NULL) + timeout; for (scanent = m_scans; ; scanent++) { if (!scanent->name) - return malware_errlog_defer(string_sprintf("unknown scanner type '%s'", + return malware_panic_defer(string_sprintf("unknown scanner type '%s'", scanner_name)); if (strcmpic(scanner_name, US scanent->name) != 0) continue; @@ -592,7 +625,7 @@ if (!malware_ok) default: /* compiler quietening */ break; } if (sock < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); break; } @@ -623,7 +656,7 @@ if (!malware_ok) /* send scan request */ if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0) if (len > 0) @@ -665,24 +698,24 @@ if (!malware_ok) if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr))) || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr)))) - return malware_errlog_defer(errstr); + return malware_panic_defer(errstr); scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename); DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n", scanner_name, scanrequest); if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL)); if (bread <= 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to read from socket (%s)", strerror(errno)), sock); if (bread == sizeof(av_buffer)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"buffer too small", sock); av_buffer[bread] = '\0'; @@ -691,7 +724,7 @@ if (!malware_ok) m_sock_send(sock, US"QUIT\n", 5, 0); if ((e = m_pcre_exec(fprot6d_re_error, linebuffer))) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("scanner reported error (%s)", e), sock); if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer))) @@ -721,7 +754,7 @@ if (!malware_ok) { /* calc file size */ if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1) - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't open spool file %s: %s", eml_filename, strerror(errno)), sock); @@ -731,7 +764,7 @@ if (!malware_ok) int err; badseek: err = errno; (void)close(drweb_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't seek spool file %s: %s", eml_filename, strerror(err)), sock); @@ -740,7 +773,7 @@ badseek: err = errno; if ((off_t)fsize_uint != fsize) { (void)close(drweb_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("seeking spool file %s, size overflow", eml_filename), sock); @@ -759,7 +792,7 @@ badseek: err = errno; (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) { (void)close(drweb_fd); - return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf( + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf( "unable to send commands to socket (%s)", scanner_options), sock); } @@ -767,7 +800,7 @@ badseek: err = errno; if (!(drweb_fbuf = US malloc(fsize_uint))) { (void)close(drweb_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("unable to allocate memory %u for file (%s)", fsize_uint, eml_filename), sock); @@ -778,7 +811,7 @@ badseek: err = errno; int err = errno; (void)close(drweb_fd); free(drweb_fbuf); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't read spool file %s: %s", eml_filename, strerror(err)), sock); @@ -789,7 +822,7 @@ badseek: err = errno; if (send(sock, drweb_fbuf, fsize, 0) < 0) { free(drweb_fbuf); - return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf( + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf( "unable to send file body to socket (%s)", scanner_options), sock); } @@ -807,19 +840,19 @@ badseek: err = errno; (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) || (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) || (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) - return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf( + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf( "unable to send commands to socket (%s)", scanner_options), sock); } /* wait for result */ if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"unable to read return code", sock); drweb_rc = ntohl(drweb_rc); if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"unable to read the number of viruses", sock); drweb_vnum = ntohl(drweb_vnum); @@ -843,14 +876,14 @@ badseek: err = errno; /* read the size of report */ if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"cannot read report size", sock); drweb_slen = ntohl(drweb_slen); tmpbuf = store_get(drweb_slen); /* read report body */ if (!recv_len(sock, tmpbuf, drweb_slen, tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"cannot read report string", sock); tmpbuf[drweb_slen] = '\0'; @@ -888,7 +921,7 @@ badseek: err = errno; * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR * and others are ignored */ if (drweb_s) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s), sock); @@ -910,7 +943,7 @@ badseek: err = errno; recv_line(sock, buf, sizeof(buf), tmo); if (buf[0] != '2') /* aveserver is having problems */ - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unavailable (Responded: %s).", ((buf[0] != 0) ? buf : US "nothing") ), sock); @@ -923,7 +956,7 @@ badseek: err = errno; DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n", scanner_name, buf); if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); malware_name = NULL; result = 0; @@ -934,7 +967,7 @@ badseek: err = errno; break; if (buf[0] == '5') /* aveserver is having problems */ { - result = m_errlog_defer(scanent, CUS callout_address, + result = m_panic_defer(scanent, CUS callout_address, string_sprintf("unable to scan file %s (Responded: %s).", eml_filename, buf)); break; @@ -948,14 +981,14 @@ badseek: err = errno; } if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); /* read aveserver's greeting and see if it is ready (2xx greeting) */ buf[0] = 0; recv_line(sock, buf, sizeof(buf), tmo); if (buf[0] != '2') /* aveserver is having problems */ - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to quit dialogue (Responded: %s).", ((buf[0] != 0) ? buf : US "nothing") ), sock); @@ -990,12 +1023,12 @@ badseek: err = errno; { if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL)); if (bread > 0) av_buffer[bread]='\0'; if (bread < 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to read answer %d (%s)", i, strerror(errno)), sock); for (j = 0; j < bread; j++) @@ -1007,7 +1040,7 @@ badseek: err = errno; file_name = string_sprintf("SCAN\t%s\n", eml_filename); if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); /* set up match */ /* todo also SUSPICION\t */ @@ -1025,7 +1058,7 @@ badseek: err = errno; errno = ETIMEDOUT; i = av_buffer+sizeof(av_buffer)-p; if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to read result (%s)", strerror(errno)), sock); @@ -1085,11 +1118,11 @@ badseek: err = errno; /* send scan request */ if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); /* wait for result */ if (!recv_len(sock, tmpbuf, 2, tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"unable to read 2 bytes from socket.", sock); /* get errorcode from one nibble */ @@ -1097,14 +1130,14 @@ badseek: err = errno; switch(kav_rc) { case 5: case 6: /* improper kavdaemon configuration */ - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"please reconfigure kavdaemon to NOT disinfect or remove infected files.", sock); case 1: - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"reported 'scanning not completed' (code 1).", sock); case 7: - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"reported 'kavdaemon damaged' (code 7).", sock); } @@ -1126,7 +1159,7 @@ badseek: err = errno; { /* read report size */ if (!recv_len(sock, &kav_reportlen, 4, tmo)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"cannot read report size", sock); /* it's possible that avp returns av_buffer[1] == 1 but the @@ -1187,19 +1220,19 @@ badseek: err = errno; uschar *p; if (!cmdline_scanner) - return m_errlog_defer(scanent, NULL, errstr); + return m_panic_defer(scanent, NULL, errstr); /* find scanner output trigger */ cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep, "missing trigger specification", &errstr); if (!cmdline_trigger_re) - return m_errlog_defer(scanent, NULL, errstr); + return m_panic_defer(scanent, NULL, errstr); /* find scanner name regex */ cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep, "missing virus name regex specification", &errstr); if (!cmdline_regex_re) - return m_errlog_defer(scanent, NULL, errstr); + return m_panic_defer(scanent, NULL, errstr); /* prepare scanner call; despite the naming, file_name holds a directory name which is documented as the value given to %s. */ @@ -1224,7 +1257,7 @@ badseek: err = errno; { int err = errno; signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe); - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("call (%s) failed: %s.", commandline, strerror(err))); } scanner_fd = fileno(scanner_out); @@ -1236,7 +1269,7 @@ badseek: err = errno; int err = errno; (void) pclose(scanner_out); signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe); - return m_errlog_defer(scanent, NULL, string_sprintf( + return m_panic_defer(scanent, NULL, string_sprintf( "opening scanner output file (%s) failed: %s.", file_name, strerror(err))); } @@ -1252,7 +1285,7 @@ badseek: err = errno; break; (void) pclose(scanner_out); signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe); - return m_errlog_defer(scanent, NULL, string_sprintf( + return m_panic_defer(scanent, NULL, string_sprintf( "unable to read from scanner (%s): %s", commandline, strerror(err))); } @@ -1262,7 +1295,7 @@ badseek: err = errno; /* short write */ (void) pclose(scanner_out); signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe); - return m_errlog_defer(scanent, NULL, string_sprintf( + return m_panic_defer(scanent, NULL, string_sprintf( "short write on scanner output file (%s).", file_name)); } putc('\n', scanner_record); @@ -1277,7 +1310,7 @@ badseek: err = errno; sep = pclose(scanner_out); signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe); if (sep != 0) - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, sep == -1 ? string_sprintf("running scanner failed: %s", strerror(sep)) : string_sprintf("scanner returned error code: %d", sep)); @@ -1323,14 +1356,14 @@ badseek: err = errno; if ( write(sock, file_name, Ustrlen(file_name)) < 0 || write(sock, "\n", 1) != 1 ) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to write to UNIX socket (%s)", scanner_options), sock); /* wait for result */ memset(av_buffer, 0, sizeof(av_buffer)); if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to read from UNIX socket (%s)", scanner_options), sock); @@ -1342,7 +1375,7 @@ badseek: err = errno; malware_name = string_copy(&av_buffer[2]); } else if (!strncmp(CS av_buffer, "-1", 2)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"scanner reported error", sock); else /* all ok, no virus */ malware_name = NULL; @@ -1400,7 +1433,7 @@ badseek: err = errno; /* parse options */ if (clamd_option(cd, sublist, &subsep) != OK) - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("bad option '%s'", scanner_options)); cv[0] = cd; } @@ -1432,13 +1465,13 @@ badseek: err = errno; sublist = scanner_options; if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0))) { - (void) m_errlog_defer(scanent, NULL, + (void) m_panic_defer(scanent, NULL, string_sprintf("missing address: '%s'", scanner_options)); continue; } if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0))) { - (void) m_errlog_defer(scanent, NULL, + (void) m_panic_defer(scanent, NULL, string_sprintf("missing port: '%s'", scanner_options)); continue; } @@ -1447,13 +1480,13 @@ badseek: err = errno; /* parse options */ /*XXX should these options be common over scanner types? */ if (clamd_option(cd, sublist, &subsep) != OK) - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("bad option '%s'", scanner_options)); cv[num_servers++] = cd; if (num_servers >= MAX_CLAMD_SERVERS) { - (void) m_errlog_defer(scanent, NULL, + (void) m_panic_defer(scanent, NULL, US"More than " MAX_CLAMD_SERVERS_S " clamd servers " "specified; only using the first " MAX_CLAMD_SERVERS_S ); break; @@ -1463,14 +1496,14 @@ badseek: err = errno; /* check if we have at least one server */ if (!num_servers) - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, US"no useable server addresses in malware configuration option."); } /* See the discussion of response formats below to see why we really don't like colons in filenames when passing filenames to ClamAV. */ if (use_scan_command && Ustrchr(eml_filename, ':')) - return m_errlog_defer(scanent, NULL, + return m_panic_defer(scanent, NULL, string_sprintf("local/SCAN mode incompatible with" \ " : in path to email filename [%s]", eml_filename)); @@ -1516,7 +1549,7 @@ badseek: err = errno; if (sock >= 0) break; - (void) m_errlog_defer(scanent, CUS callout_address, errstr); + (void) m_panic_defer(scanent, CUS callout_address, errstr); /* Remove the server from the list. XXX We should free the memory */ num_servers--; @@ -1525,7 +1558,7 @@ badseek: err = errno; } if (num_servers == 0) - return m_errlog_defer(scanent, NULL, US"all servers failed"); + return m_panic_defer(scanent, NULL, US"all servers failed"); } else for (;;) @@ -1536,7 +1569,7 @@ badseek: err = errno; break; } if (cv[0]->retry <= 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry); } @@ -1558,7 +1591,7 @@ badseek: err = errno; /* Pass the string to ClamAV (10 = "zINSTREAM\0"), if not already sent */ if (cmd_str.len) if (send(sock, cmd_str.data, cmd_str.len, 0) < 0) - return m_errlog_defer_3(scanent, CUS hostname, + return m_panic_defer_3(scanent, CUS hostname, string_sprintf("unable to send zINSTREAM to socket (%s)", strerror(errno)), sock); @@ -1567,7 +1600,7 @@ badseek: err = errno; if ((clam_fd = open(CS eml_filename, O_RDONLY)) < 0) { int err = errno; - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't open spool file %s: %s", eml_filename, strerror(err)), sock); @@ -1577,7 +1610,7 @@ badseek: err = errno; int err; b_seek: err = errno; (void)close(clam_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't seek spool file %s: %s", eml_filename, strerror(err)), sock); @@ -1586,7 +1619,7 @@ b_seek: err = errno; if ((off_t)fsize_uint != fsize) { (void)close(clam_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("seeking spool file %s, size overflow", eml_filename), sock); @@ -1597,7 +1630,7 @@ b_seek: err = errno; if (!(clamav_fbuf = US malloc(fsize_uint))) { (void)close(clam_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("unable to allocate memory %u for file (%s)", fsize_uint, eml_filename), sock); @@ -1607,7 +1640,7 @@ b_seek: err = errno; { int err = errno; free(clamav_fbuf); (void)close(clam_fd); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("can't read spool file %s: %s", eml_filename, strerror(err)), sock); @@ -1622,7 +1655,7 @@ b_seek: err = errno; (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0)) { free(clamav_fbuf); - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, string_sprintf("unable to send file body to socket (%s)", hostname), sock); } @@ -1652,7 +1685,7 @@ b_seek: err = errno; if (cmd_str.len) if (send(sock, cmd_str.data, cmd_str.len, 0) < 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to write to socket (%s)", strerror(errno)), sock); @@ -1669,12 +1702,12 @@ b_seek: err = errno; sock = -1; if (bread <= 0) - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, string_sprintf("unable to read from socket (%s)", errno == 0 ? "EOF" : strerror(errno))); if (bread == sizeof(av_buffer)) - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, US"buffer too small"); /* We're now assured of a NULL at the end of av_buffer */ @@ -1699,7 +1732,7 @@ b_seek: err = errno; passing a filename to clamd). */ if (!(*av_buffer)) - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, US"ClamAV returned null"); /* strip newline at the end (won't be present for zINSTREAM) @@ -1716,7 +1749,7 @@ b_seek: err = errno; /* colon in returned output? */ if(!(p = Ustrchr(av_buffer,':'))) - return m_errlog_defer(scanent, CUS callout_address, string_sprintf( + return m_panic_defer(scanent, CUS callout_address, string_sprintf( "ClamAV returned malformed result (missing colon): %s", av_buffer)); @@ -1749,7 +1782,7 @@ b_seek: err = errno; } else if (Ustrcmp(result_tag, "ERROR") == 0) - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, string_sprintf("ClamAV returned: %s", av_buffer)); else if (Ustrcmp(result_tag, "OK") == 0) @@ -1760,7 +1793,7 @@ b_seek: err = errno; } else - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, string_sprintf("unparseable response from ClamAV: {%s}", av_buffer)); break; @@ -1791,7 +1824,7 @@ b_seek: err = errno; uschar * s = Ustrchr(sockline_scanner, '%'); if (s++) if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%')) - return m_errlog_defer_3(scanent, NULL, + return m_panic_defer_3(scanent, NULL, US"unsafe sock scanner call spec", sock); } else @@ -1803,13 +1836,13 @@ b_seek: err = errno; sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep, "missing trigger specification", &errstr); if (!sockline_trig_re) - return m_errlog_defer_3(scanent, NULL, errstr, sock); + return m_panic_defer_3(scanent, NULL, errstr, sock); /* find virus name regex */ sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep, "missing virus name regex specification", &errstr); if (!sockline_name_re) - return m_errlog_defer_3(scanent, NULL, errstr, sock); + return m_panic_defer_3(scanent, NULL, errstr, sock); /* prepare scanner call - security depends on expansions check above */ commandline = string_sprintf( CS sockline_scanner, CS eml_filename); @@ -1818,18 +1851,18 @@ b_seek: err = errno; /* Pass the command string to the socket */ if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); /* Read the result */ bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL)); if (bread <= 0) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf("unable to read from socket (%s)", strerror(errno)), sock); if (bread == sizeof(av_buffer)) - return m_errlog_defer_3(scanent, CUS callout_address, + return m_panic_defer_3(scanent, CUS callout_address, US"buffer too small", sock); av_buffer[bread] = '\0'; linebuffer = string_copy(av_buffer); @@ -1865,12 +1898,12 @@ b_seek: err = errno; || mksd_maxproc < 1 || mksd_maxproc > 32 ) - return m_errlog_defer(scanent, CUS callout_address, + return m_panic_defer(scanent, CUS callout_address, string_sprintf("invalid option '%s'", scanner_options)); } if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0) - return m_errlog_defer(scanent, CUS callout_address, errstr); + return m_panic_defer(scanent, CUS callout_address, errstr); malware_name = NULL; @@ -1888,12 +1921,13 @@ b_seek: err = errno; #ifndef DISABLE_MAL_AVAST case M_AVAST: /* "avast" scanner type ----------------------------------- */ { - int ovector[1*3]; + int ovector[10*3]; uschar buf[1024]; uschar * scanrequest; enum {AVA_HELO, AVA_OPT, AVA_RSP, AVA_DONE} avast_stage; int nread; int more_data; + uschar * error_message = NULL; /* According to Martin Tuma @avast the protocol uses "escaped whitespace", that is, every embedded whitespace is backslash @@ -1905,13 +1939,44 @@ b_seek: err = errno; [E] - some error occured Such marker follows the first non-escaped TAB. For more information see avast-protocol(5) - */ + + We observed two cases: + -> SCAN /file + <- /file [E]0.0 Error 13 Permission denied + <- 451 SCAN Engine error 13 permission denied + + -> SCAN /file + <- /file… [E]3.0 Error 41120 The file is a decompression bomb + <- /file… [+]2.0 + <- /file… [+]2.0 0 Eicar Test Virus!!! + <- 200 SCAN OK + + If the scanner returns 4xx, DEFER is a good decision, combined + with a panic log entry, to get the admin's attention. + + If the scanner returns 200, we reject it as malware, if found any, + or, in case of an error, we set the malware message to the error + string. + + Some of the >= 42000 errors are message related - usually some + broken archives etc, but some of them are e.g. license related. + Once the license expires the engine starts returning errors for + every scanning attempt. I¹ have the full list of the error codes + but it is not a public API and is subject to change. It is hard + for me to say what you should do in case of an engine error. You + can have a “Treat * unscanned file as infection” policy or “Treat + unscanned file as clean” policy. ¹) Jakub Bednar + + */ + if ( ( !ava_re_clean && !(ava_re_clean = m_pcre_compile(ava_re_clean_str, &errstr))) || ( !ava_re_virus && !(ava_re_virus = m_pcre_compile(ava_re_virus_str, &errstr))) + || ( !ava_re_error + && !(ava_re_error = m_pcre_compile(ava_re_error_str, &errstr))) ) - return malware_errlog_defer(errstr); + return malware_panic_defer(errstr); /* wait for result */ for (avast_stage = AVA_HELO; @@ -1963,10 +2028,10 @@ b_seek: err = errno; /* send config-cmd or scan-request to socket */ len = Ustrlen(scanrequest); - if (send(sock, scanrequest, len, 0) < 0) + if (send(sock, scanrequest, len, 0) == -1) { scanrequest[len-1] = '\0'; - return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf( + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf( "unable to send request '%s' to socket (%s): %s", scanrequest, scanner_options, strerror(errno)), sock); } @@ -1975,36 +2040,52 @@ b_seek: err = errno; case AVA_RSP: - if (Ustrncmp(buf, "200", 3) == 0) - { /* we're done finally */ - if (send(sock, "QUIT\n", 5, 0) < 0) /* courtesy */ - return m_errlog_defer_3(scanent, CUS callout_address, + if (isdigit(buf[0])) + { /* we're done, this is the last response line from the scanner */ + DEBUG(D_acl) debug_printf_indent("sent to avast QUIT\n"); + if (send(sock, "QUIT\n", 5, 0) == -1) /* courtesy */ + return m_panic_defer_3(scanent, CUS callout_address, string_sprintf( "unable to send quit request to socket (%s): %s", scanner_options, strerror(errno)), sock); + if (buf[0] != '2') error_message = buf; avast_stage = AVA_DONE; goto endloop; } - if (malware_name) break; /* found malware already, nothing to do anymore */ + #if 0 + /* found malware or another error already, nothing to do anymore, just read on */ + if (malware_name || error_message) + break; + #endif if (pcre_exec(ava_re_clean, NULL, CS buf, slen, 0, 0, ovector, nelem(ovector)) > 0) break; - if (malware_name = m_pcre_exec(ava_re_virus, buf)) - { /* remove backslash in front of [whitespace|backslash] */ - uschar * p, * p0; - for (p = malware_name; *p; ++p) - if (*p == '\\' && (isspace(p[1]) || p[1] == '\\')) - for (p0 = p; *p0; ++p0) *p0 = p0[1]; - - DEBUG(D_acl) - debug_printf_indent("unescaped malware name: '%s'\n", malware_name); - break; - } + if (malware_name) + break; + + if (malware_name = m_pcre_exec(ava_re_virus, buf)) + { + unescape(malware_name); + DEBUG(D_acl) + debug_printf_indent("unescaped malware name: '%s'\n", malware_name); + break; + } + + /*if (pcre_exec(ava_re_error, NULL, CS buf, nread, 0, 0, ovector, nelem(ovector)) == 2) + unescape(malware_name = buf + ovector[1*2]); + */ + if (malware_name = m_pcre_exec(ava_re_error, buf)) + { + unescape(malware_name); + DEBUG(D_acl) + debug_printf_indent("unescaped error message: '%s'\n", malware_name); + break; + } /* here also for any unexpected response from the scanner */ goto endloop; @@ -2020,14 +2101,14 @@ b_seek: err = errno; { case AVA_HELO: case AVA_OPT: - case AVA_RSP: return m_errlog_defer_3(scanent, CUS callout_address, - nread >= 0 - ? string_sprintf( - "invalid response from scanner: '%s'", buf) - : nread == -1 - ? US"EOF from scanner" - : US"timeout from scanner", - sock); + case AVA_RSP: + if (nread == -1) error_message = "EOF from scanner"; + else if (nread < 0) error_message = "timeout from scanner"; + + case AVA_DONE: + if (error_message) + return m_panic_defer_3(scanent, CUS callout_address, error_message, sock); + default: break; } break; @@ -2151,6 +2232,8 @@ if (!ava_re_clean) ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE); if (!ava_re_virus) ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE); +if (!ava_re_error) + ava_re_error = regex_must_compile(ava_re_error_str, FALSE, TRUE); #endif #ifndef DISABLE_MAL_FFROT6D if (!fprot6d_re_error) diff --git a/test/log/4007 b/test/log/4007 index bd0ec8720..960d6babd 100644 --- a/test/log/4007 +++ b/test/log/4007 @@ -1,7 +1,7 @@ -1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" -1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: R=r -1999-03-02 09:44:33 10HmbB-0005vi-00 Completed -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah [E]' +1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" +1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: R=r +1999-03-02 09:44:33 10HmbC-0005vi-00 Completed +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F= temporarily rejected after DATA 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F= rejected after DATA @@ -11,3 +11,5 @@ 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout" 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: R=r 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed +1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name The file is a decompression bomb +1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F= rejected after DATA diff --git a/test/log/4017 b/test/log/4017 index cd53a5c39..480ac5d19 100644 --- a/test/log/4017 +++ b/test/log/4017 @@ -1,7 +1,9 @@ -1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" -1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: R=r -1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" +1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: R=r +1999-03-02 09:44:33 10HmbA-0005vi-00 Completed +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F= temporarily rejected after DATA -1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This ist not even an EICAR test virus. +1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This is not even an EICAR test virus. 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F= rejected after DATA +1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name The file is a decompression bomb +1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F= rejected after DATA diff --git a/test/paniclog/4007 b/test/paniclog/4007 index 5236f07f2..9a02eadf4 100644 --- a/test/paniclog/4007 +++ b/test/paniclog/4007 @@ -1,3 +1,3 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah [E]' +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner diff --git a/test/paniclog/4017 b/test/paniclog/4017 index b6fcc0527..de97faf37 100644 --- a/test/paniclog/4017 +++ b/test/paniclog/4017 @@ -1 +1 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied diff --git a/test/rejectlog/4007 b/test/rejectlog/4007 index 6ba3a2659..f46e9e71e 100644 --- a/test/rejectlog/4007 +++ b/test/rejectlog/4007 @@ -34,3 +34,15 @@ P Received: from CALLER (helo=test.ex) Subject: message should be tmp-rejected due to timeout I Message-Id: F From: CALLER_NAME +1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F= rejected after DATA +Envelope-from: +Envelope-to: +P Received: from CALLER (helo=test.ex) + by myhost.test.ex with local-esmtp (Exim x.yz) + (envelope-from ) + id 10HmbB-0005vi-00 + for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000 + Date: Tue, 2 Mar 1999 09:44:33 +0000 + Subject: defer this one, the scanner had an error +I Message-Id: +F From: CALLER_NAME diff --git a/test/rejectlog/4017 b/test/rejectlog/4017 index f14a316b7..ca3f3888f 100644 --- a/test/rejectlog/4017 +++ b/test/rejectlog/4017 @@ -22,3 +22,15 @@ P Received: from CALLER (helo=test.ex) Subject: message should be rejected I Message-Id: F From: CALLER_NAME +1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F= rejected after DATA +Envelope-from: +Envelope-to: +P Received: from CALLER (helo=test.ex) + by myhost.test.ex with local-esmtp (Exim x.yz) + (envelope-from ) + id 10HmaZ-0005vi-00 + for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000 + Date: Tue, 2 Mar 1999 09:44:33 +0000 + Subject: message should be rejected +I Message-Id: +F From: CALLER_NAME diff --git a/test/scripts/4007_scan_avast/4007 b/test/scripts/4007_scan_avast/4007 index 0611f2a96..fc6c627cf 100644 --- a/test/scripts/4007_scan_avast/4007 +++ b/test/scripts/4007_scan_avast/4007 @@ -28,13 +28,13 @@ quit **** # # -# +### (non-internal) scanner error -> paniclog server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA ->LF>blah [E] ->LF>200 SCAN OK +>LF>blah [E]0.0 Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied LF>220 ready LF>210 SCAN DATA ->LF>b\\ l\\ a\\ h [L]9.9 9 VNAME +>LF>b\\ l\\ a\\ h [L]9.0 0 VNAME >LF>200 SCAN OK LF>220 ready +LF>210 SCAN DATA +>LF>blah [E]0.0 Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>200 SCAN OK + +rcpt to: +data +Date: Fri, 17 Dec 2004 14:35:01 +0100 +Subject: defer this one, the scanner had an error + +. +quit +**** diff --git a/test/scripts/4017_scan_avast_multiline/4017 b/test/scripts/4017_scan_avast_multiline/4017 index d075825b8..3e6b06713 100644 --- a/test/scripts/4017_scan_avast_multiline/4017 +++ b/test/scripts/4017_scan_avast_multiline/4017 @@ -31,15 +31,13 @@ quit **** # # -### clean and error | multiline response +### scanner tmpfail -> defer server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA ->LF>/bin/ok [+] ->LF>/bin/error [E]0.0 ->LF>/bin/infected [L]0.0 0 This is not even EICAR! ->LF>200 SCAN OK +>LF>/bin/error [E]0.0 Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied reject +server DIR/eximdir/avast_sock +>LF>220 ready +LF>210 SCAN DATA +>LF>/bin/clean [+] +>LF>v\\ i\\ a\\ r\\ u\\ s [L]9.0 0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. +>LF>200 SCAN OK + +rcpt to: +data +Date: Fri, 17 Dec 2004 14:35:01 +0100 +Subject: message should be rejected + +. +quit +**** +# +# +# clean, error, infected -> reject server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA >LF>/bin/clean [+] ->LF>v\\ i\\ a\\ r\\ u\\ s [L]9.9 9 This ist not even an EICAR test virus. +>LF>/bin/error [E]0.0 Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>v\\ i\\ a\\ r\\ u\\ s [L]9.0 0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. >LF>200 SCAN OK paniclog +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner +### internal scanner error, no panic log + +******** SERVER ******** +### (non-internal) scanner error -> paniclog +### internal scanner error, no panic log diff --git a/test/stderr/4017 b/test/stderr/4017 index 22157c3d1..287cd30ce 100644 --- a/test/stderr/4017 +++ b/test/stderr/4017 @@ -1,7 +1,7 @@ ### clean | multiline response -### clean and error | multiline response -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +### scanner tmpfail -> defer +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied ******** SERVER ******** ### clean | multiline response -### clean and error | multiline response +### scanner tmpfail -> defer diff --git a/test/stdout/4007 b/test/stdout/4007 index 603de1521..32adb0910 100644 --- a/test/stdout/4007 +++ b/test/stdout/4007 @@ -7,8 +7,9 @@ 250 OK 250 Accepted 354 Enter message, ending with "." on a line by itself -250 OK id=10HmbB-0005vi-00 +250 OK id=10HmbC-0005vi-00 221 myhost.test.ex closing connection +### (non-internal) scanner error -> paniclog 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 250-myhost.test.ex Hello CALLER at test.ex 250-SIZE 52428800 @@ -53,6 +54,18 @@ 354 Enter message, ending with "." on a line by itself 250 OK id=10HmaZ-0005vi-00 221 myhost.test.ex closing connection +### internal scanner error, no panic log +220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 +250-myhost.test.ex Hello CALLER at test.ex +250-SIZE 52428800 +250-8BITMIME +250-PIPELINING +250 HELP +250 OK +250 Accepted +354 Enter message, ending with "." on a line by itself +550 Administrative prohibition +221 myhost.test.ex closing connection ******** SERVER ******** Listening on TESTSUITE/eximdir/avast_sock ... @@ -61,27 +74,30 @@ Connection request LF>210 FLAGS DATA >LF>200 FLAGS OK -LF>210 SCAN DATA >LF>blah\x09[+] >LF>200 SCAN OK paniclog Listening on TESTSUITE/eximdir/avast_sock ... Connection request >LF>220 ready LF>210 SCAN DATA ->LF>blah\x09[E] ->LF>200 SCAN OK -Unexpected EOF read from client +>LF>blah\x09[E]0.0\x09Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied +LF>220 ready LF>210 SCAN DATA ->LF>b\\ l\\ a\\ h\x09[L]9.9\x099 VNAME +>LF>b\\ l\\ a\\ h\x09[L]9.0\x090 VNAME >LF>200 SCAN OK LF>220 ready +LF>210 SCAN DATA +>LF>blah\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>200 SCAN OK + defer 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 250-myhost.test.ex Hello CALLER at test.ex 250-SIZE 52428800 @@ -33,6 +33,17 @@ 354 Enter message, ending with "." on a line by itself 550 Administrative prohibition 221 myhost.test.ex closing connection +220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 +250-myhost.test.ex Hello CALLER at test.ex +250-SIZE 52428800 +250-8BITMIME +250-PIPELINING +250 HELP +250 OK +250 Accepted +354 Enter message, ending with "." on a line by itself +550 Administrative prohibition +221 myhost.test.ex closing connection ******** SERVER ******** ### clean | multiline response @@ -44,7 +55,7 @@ Connection request >LF>FLAGS -fullfiles >LF>FLAGS +extra >LF>200 FLAGS OK -LF>210 SCAN DATA >LF>/bin/clean1\x09[+] >LF>/bin/clean2\x09[+] @@ -52,24 +63,36 @@ Connection request defer Listening on TESTSUITE/eximdir/avast_sock ... Connection request >LF>220 ready LF>210 SCAN DATA ->LF>/bin/ok\x09[+] ->LF>/bin/error\x09[E]0.0 ->LF>/bin/infected\x09[L]0.0\x090 This is not even EICAR! ->LF>200 SCAN OK -Unexpected EOF read from client +>LF>/bin/error\x09[E]0.0\x09Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied +LF>220 ready LF>210 SCAN DATA >LF>/bin/clean\x09[+] ->LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.9\x099 This ist not even an EICAR test virus. +>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. +>LF>200 SCAN OK +LF>220 ready +LF>210 SCAN DATA +>LF>/bin/clean\x09[+] +>LF>/bin/error\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. >LF>200 SCAN OK