return(byte[0] ? LITTLE_MY_ENDIAN : BIG_MY_ENDIAN);
}
-static uschar * malware_name_internal = NULL;
-int malware_ok = 0;
+BOOL malware_ok = FALSE;
/* Gross hacks for the -bmalware option; perhaps we should just create
the scan directory normally for that case, but look into rigging up the
{
return m_scanner_errlog_defer("mksd", str);
}
+static int
+sock_errlog_defer(const uschar * str)
+{
+ return m_scanner_errlog_defer("sock", str);
+}
static void
clmd_errlog(const uschar * str)
static int
m_unixsocket(const uschar * path, uschar ** errstr)
{
-int sock;
-struct sockaddr_un server;
-
-if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
- *errstr = "can't open UNIX socket.";
- return -1;
-}
+ int sock;
+ struct sockaddr_un server;
-server.sun_family = AF_UNIX;
-Ustrcpy(server.sun_path, path);
-if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {
- int err = errno;
- (void)close(sock);
- *errstr = string_sprintf("unable to connect to UNIX socket (%s): %s",
- path, strerror(err));
- return -1;
+ if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+ *errstr = "can't open UNIX socket.";
+ return -1;
}
-return sock;
+
+ server.sun_family = AF_UNIX;
+ Ustrcpy(server.sun_path, path);
+ if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {
+ int err = errno;
+ (void)close(sock);
+ *errstr = string_sprintf("unable to connect to UNIX socket (%s): %s",
+ path, strerror(err));
+ return -1;
+ }
+ return sock;
}
static int
m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
{
-if (send(sock, buf, cnt, 0) < 0) {
- int err = errno;
- (void)close(sock);
- *errstr = string_sprintf("unable to send to socket (%s): %s",
- buf, strerror(err));
- return -1;
- }
-return sock;
+ if (send(sock, buf, cnt, 0) < 0) {
+ int err = errno;
+ (void)close(sock);
+ *errstr = string_sprintf("unable to send to socket (%s): %s",
+ buf, strerror(err));
+ return -1;
+ }
+ return sock;
+}
+
+static const pcre *
+m_pcre_compile(const uschar * re, uschar ** errstr)
+{
+ const uschar * rerror;
+ int roffset;
+ const pcre * cre;
+
+ cre = pcre_compile(re, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
+ if (!cre)
+ *errstr= string_sprintf("regular expression error in '%s': %s at offset %d",
+ re, rerror, roffset);
+ return cre;
+}
+
+uschar *
+m_pcre_exec(const pcre * cre, uschar * text)
+{
+ int ovector[10*3];
+ int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
+ ovector, nelements(ovector));
+ uschar * substr = NULL;
+ if (i >= 2) /* Got it */
+ pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
+ return substr;
+}
+
+static const pcre *
+m_pcre_nextinlist(uschar ** list, int * sep, char * listerr, uschar ** errstr)
+{
+ const uschar * list_ele;
+ const pcre * cre = NULL;
+
+ if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
+ *errstr = US listerr;
+ else
+ cre = m_pcre_compile(CS list_ele, errstr);
+ return cre;
}
/*************************************************
*************************************************/
typedef enum {M_FPROTD, M_DRWEB, M_AVES, M_FSEC, M_KAVD, M_CMDL,
- M_SOPHIE, M_CLAMD, M_MKSD} scanner_t;
+ M_SOPHIE, M_CLAMD, M_SOCK, M_MKSD} scanner_t;
static struct scan
{
scanner_t scancode;
{ M_CMDL, "cmdline", NULL },
{ M_SOPHIE, "sophie", "/var/run/sophie" },
{ M_CLAMD, "clamd", "/tmp/clamd" },
+ { M_SOCK, "sock", "/tmp/malware.sock" },
{ M_MKSD, "mksd", NULL },
{ -1, NULL, NULL } /* end-marker */
};
uschar malware_regex_default[] = ".+";
unsigned long mbox_size;
FILE *mbox_file;
- int roffset;
const pcre *re;
- const uschar *rerror;
uschar * errstr;
struct scan * scanent;
const uschar * scanner_options;
/* make sure the eml mbox file is spooled up */
- mbox_file = spool_mbox(&mbox_size, faking ? eml_filename : NULL);
- if (mbox_file == NULL) /* error while spooling */
+ if (!(mbox_file = spool_mbox(&mbox_size, faking ? eml_filename : NULL)))
return malware_errlog_defer("error while creating mbox spool file");
/* none of our current scanners need the mbox
file as a stream, so we can close it right away */
+ /*XXX drweb and clamd do!! */
(void)fclose(mbox_file);
/* extract the malware regex to match against from the option list */
/* parse 1st option */
if ( (strcmpic(malware_regex,US"false") == 0) ||
- (Ustrcmp(malware_regex,"0") == 0) ) {
- /* explicitly no matching */
- return FAIL;
- }
+ (Ustrcmp(malware_regex,"0") == 0) )
+ return FAIL; /* explicitly no matching */
/* special cases (match anything except empty) */
if ( (strcmpic(malware_regex,US"true") == 0) ||
(Ustrcmp(malware_regex,"*") == 0) ||
- (Ustrcmp(malware_regex,"1") == 0) ) {
+ (Ustrcmp(malware_regex,"1") == 0) )
malware_regex = malware_regex_default;
- }
}
else /* empty means "don't match anything" */
return FAIL;
sep = 0;
/* compile the regex, see if it works */
- re = pcre_compile(CS malware_regex, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
- if (!re)
- return malware_errlog_defer(
- string_sprintf("regular expression error in '%s': %s at offset %d",
- malware_regex, rerror, roffset));
+ if (!(re = m_pcre_compile(CS malware_regex, &errstr)))
+ return malware_errlog_defer(errstr);
/* if av_scanner starts with a dollar, expand it first */
if (*av_scanner == '$') {
- av_scanner_work = expand_string(av_scanner);
- if (!av_scanner_work)
+ if (!(av_scanner_work = expand_string(av_scanner)))
return malware_errlog_defer(
string_sprintf("av_scanner starts with $, but expansion failed: %s",
expand_string_message));
- else {
- debug_printf("Expanded av_scanner global: %s\n", av_scanner_work);
- /* disable result caching in this case */
- malware_name = NULL;
- malware_ok = 0;
- }
+
+ debug_printf("Expanded av_scanner global: %s\n", av_scanner_work);
+ /* disable result caching in this case */
+ malware_name = NULL;
+ malware_ok = FALSE;
}
/* Do not scan twice. */
- if (malware_ok == 0) {
+ if (!malware_ok) {
/* find the scanner type from the av_scanner option */
if (!(scanner_name = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
int sock;
uschar * scanrequest;
uschar buf[32768], *strhelper, *strhelper2;
+ uschar * malware_name_internal = NULL;
if ((sock = m_tcpsocket_fromdef(scanner_options, &errstr)) < 0)
return fprotd_errlog_defer(errstr);
/* We get a lot of empty lines, so we need this hack to check for any data at all */
while( recv(sock, buf, 1, MSG_PEEK) > 0 ) {
- if ( recv_line(sock, buf, 32768) > 0) {
+ if ( recv_line(sock, buf, sizeof(buf)) > 0) {
if ( Ustrstr(buf, US"<detected type=\"") != NULL )
detected = 1;
else if ( detected && (strhelper = Ustrstr(buf, US"<name>")) ) {
/* v0.0 - initial release -- support for unix sockets */
{
struct sockaddr_un server;
- int sock, result, ovector[10*3];
+ int sock, result;
unsigned int fsize;
uschar * tmpbuf, *drweb_fbuf;
int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
drweb_vnum, drweb_slen, drweb_fin = 0x0000;
unsigned long bread;
- pcre *drweb_re;
+ const pcre *drweb_re;
if (*scanner_options != '/') {
if ((sock = m_tcpsocket_fromdef(scanner_options, &errstr)) < 0)
string_sprintf("unable to send file body to socket (%s)", scanner_options));
}
(void)close(drweb_fd);
- }
- else {
+
+ } else {
+
if((sock = m_unixsocket(scanner_options, &errstr)) < 0)
return drweb_errlog_defer(errstr);
int i;
/* setup default virus name */
- malware_name_internal = "unknown";
- malware_name = malware_name_internal;
+ malware_name = "unknown";
/* set up match regex */
- drweb_re = pcre_compile( "infected\\swith\\s*(.+?)$", PCRE_COPT,
- (const char **)&rerror, &roffset, NULL );
+ drweb_re = m_pcre_compile( "infected\\swith\\s*(.+?)$", &errstr);
/* read and concatenate virus names into one string */
for (i=0;i<drweb_vnum;i++)
{
- int size = 0, off = 0;
+ int size = 0, off = 0, ovector[10*3];
/* read the size of report */
if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
(void)close(sock);
pcre_get_substring(CS tmpbuf, ovector, result, 1, &pre_malware_nb);
- /* the first name we just copy to malware_name */
- if (i==0)
- malware_name_internal = string_append(NULL, &size, &off,
+ if (i==0) /* the first name we just copy to malware_name */
+ malware_name = string_append(NULL, &size, &off,
1, pre_malware_nb);
- else
- /* concatenate each new virus name to previous */
- malware_name_internal = string_append(malware_name_internal,
- &size, &off, 2, "/", pre_malware_nb);
+
+ else /* concatenate each new virus name to previous */
+ malware_name = string_append(malware_name, &size, &off,
+ 2, "/", pre_malware_nb);
pcre_free_substring(pre_malware_nb);
}
debug_printf("aveserver: %s\n", buf);
if (buf[0] == '2')
break;
- if (buf[0] == '5') {
- /* aveserver is having problems */
- log_write(0, LOG_MAIN|LOG_PANIC,
- "malware acl condition: unable to scan file %s (Responded: %s).",
- eml_filename, buf);
- result = DEFER;
+ if (buf[0] == '5') { /* aveserver is having problems */
+ result = aves_errlog_defer(
+ string_sprintf("unable to scan file %s (Responded: %s).",
+ eml_filename, buf));
break;
} else if (Ustrncmp(buf,"322",3) == 0) {
uschar *p = Ustrchr(&buf[4],' ');
*p = '\0';
- malware_name_internal = string_copy(&buf[4]);
- malware_name = malware_name_internal;
+ malware_name = string_copy(&buf[4]);
}
}
- /* prepare our command */
- (void)string_format(buf, sizeof(buf), "quit\r\n");
-
/* and send it */
- if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
+ if (m_sock_send(sock, "quit\r\n", 6, &errstr) < 0)
return aves_errlog_defer(errstr);
/* read aveserver's greeting and see if it is ready (2xx greeting) */
int sock, i, j, bread = 0;
uschar * file_name;
uschar av_buffer[1024];
- pcre * fs_inf;
+ const pcre * fs_inf;
static uschar *cmdopt[] = { US"CONFIGURE\tARCHIVE\t1\n",
US"CONFIGURE\tTIMEOUT\t0\n",
US"CONFIGURE\tMAXARCH\t5\n",
/* set up match */
/* todo also SUSPICION\t */
- fs_inf = pcre_compile("\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$", PCRE_COPT, (const char **)&rerror, &roffset, NULL);
+ fs_inf = m_pcre_compile("\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$", &errstr);
/* read report, linewise */
do {
- int ovector[10*3];
i = 0;
memset(av_buffer, 0, sizeof(av_buffer));
do {
/* debug_printf("got line \"%s\"\n",av_buffer); */
/* Really search for virus again? */
- if (malware_name == NULL) {
+ if (malware_name == NULL)
/* try matcher on the line, grab substring */
- i = pcre_exec(fs_inf, NULL, CS av_buffer, Ustrlen(av_buffer), 0, 0,
- ovector, nelements(ovector));
- if (i >= 2) {
- /* Got it */
- pcre_get_substring(CS av_buffer, ovector, i, 1,
- (const char **) &malware_name_internal);
- malware_name = malware_name_internal;
- }
- }
+ malware_name = m_pcre_exec(fs_inf, av_buffer);
}
while (Ustrstr(av_buffer, "OK\tScan ok.") == NULL);
(void)close(sock);
uschar * scanrequest;
int kav_rc;
unsigned long kav_reportlen, bread;
- pcre *kav_re;
+ const pcre *kav_re;
uschar *p;
if((sock = m_unixsocket(scanner_options, &errstr)) < 0)
int report_flag = 0;
/* setup default virus name */
- malware_name_internal = string_copy("unknown");
- malware_name = malware_name_internal;
+ malware_name = "unknown";
report_flag = tmpbuf[ test_byte_order() == LITTLE_MY_ENDIAN ? 1 : 0 ];
reportsize is 0 (!?) */
if (kav_reportlen > 0) {
/* set up match regex, depends on retcode */
- kav_re = pcre_compile( kav_rc == 3
- ? "suspicion:\\s*(.+?)\\s*$"
- : "infected:\\s*(.+?)\\s*$",
- PCRE_COPT,
- (const char **)&rerror,
- &roffset,
- NULL );
+ kav_re = m_pcre_compile( kav_rc == 3
+ ? "suspicion:\\s*(.+?)\\s*$"
+ : "infected:\\s*(.+?)\\s*$",
+ &errstr );
/* read report, linewise */
while (kav_reportlen > 0) {
- int result = 0;
- int ovector[10*3];
-
bread = 0;
while ( recv(sock, &tmpbuf[bread], 1, 0) == 1 ) {
kav_reportlen--;
tmpbuf[bread] = '\0';
/* try matcher on the line, grab substring */
- result = pcre_exec(kav_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
- ovector, nelements(ovector));
- if (result >= 2) {
- pcre_get_substring(CS tmpbuf, ovector, result, 1,
- (const char **) &malware_name_internal);
+ if ((malware_name = m_pcre_exec(kav_re, tmpbuf)))
break;
- }
}
}
}
case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
{
const uschar *cmdline_scanner = scanner_options;
- uschar *cmdline_trigger;
const pcre *cmdline_trigger_re;
- uschar *cmdline_regex;
const pcre *cmdline_regex_re;
uschar * file_name;
uschar * commandline;
FILE *scanner_record = NULL;
uschar linebuffer[32767];
int trigger = 0;
- int result;
- int ovector[10*3];
uschar *p;
BOOL fits;
return cmdl_errlog_defer("missing commandline specification");
/* find scanner output trigger */
- if (!(cmdline_trigger = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
- return cmdl_errlog_defer("missing trigger specification");
-
- /* precompile trigger regex */
- cmdline_trigger_re = pcre_compile(CS cmdline_trigger, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
- if (cmdline_trigger_re == NULL)
- return cmdl_errlog_defer(
- string_sprintf("regular expression error in '%s': %s at offset %d",
- cmdline_trigger, rerror, roffset));
+ cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ "missing trigger specification", &errstr);
+ if (!cmdline_trigger_re)
+ return cmdl_errlog_defer(errstr);
/* find scanner name regex */
- if (!(cmdline_regex = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
- return cmdl_errlog_defer("missing virus name regex specification");
-
- /* precompile name regex */
- cmdline_regex_re = pcre_compile(CS cmdline_regex, PCRE_COPT, (const char **)&rerror, &roffset, NULL);
- if (cmdline_regex_re == NULL)
- return cmdl_errlog_defer(
- string_sprintf("regular expression error in '%s': %s at offset %d",
- cmdline_regex, rerror, roffset));
+ cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ "missing virus name regex specification", &errstr);
+ if (!cmdline_regex_re)
+ return cmdl_errlog_defer(errstr);
/* prepare scanner call; despite the naming, file_name holds a directory
name which is documented as the value given to %s. */
}
/* look for trigger while recording output */
- while(fgets(CS linebuffer, sizeof(linebuffer), scanner_out) != NULL) {
+ while(fgets(CS linebuffer, sizeof(linebuffer), scanner_out)) {
if ( Ustrlen(linebuffer) > fwrite(linebuffer, 1, Ustrlen(linebuffer), scanner_record) ) {
/* short write */
pclose(scanner_out);
signal(SIGPIPE,eximsigpipe);
if (trigger) {
+ uschar * s;
/* setup default virus name */
malware_name = US"unknown";
/* re-open the scanner output file, look for name match */
scanner_record = fopen(CS file_name, "rb");
- while(fgets(CS linebuffer,32767,scanner_record) != NULL) {
+ while(fgets(CS linebuffer, sizeof(linebuffer), scanner_record)) {
/* try match */
- result = pcre_exec(cmdline_regex_re, NULL,
- CS linebuffer, Ustrlen(linebuffer), 0, 0,
- ovector, nelements(ovector));
- if (result >= 2)
- pcre_get_substring(CS linebuffer, ovector, result, 1,
- (const char **) &malware_name_internal);
+ if ((s = m_pcre_exec(cmdline_regex_re, linebuffer)))
+ malware_name = s;
}
(void)fclose(scanner_record);
}
/* infected ? */
if (av_buffer[0] == '1') {
- if (Ustrchr(av_buffer, '\n')) *Ustrchr(av_buffer, '\n') = '\0';
- malware_name_internal = string_copy(&av_buffer[2]);
- malware_name = malware_name_internal;
+ uschar * s = Ustrchr(av_buffer, '\n');
+ if (s)
+ *s = '\0';
+ malware_name = string_copy(&av_buffer[2]);
}
else if (!strncmp(CS av_buffer, "-1", 2))
return soph_errlog_defer("scanner reported error");
if (p)
*p = '\0';
}
- malware_name_internal = string_copy(vname);
- malware_name = malware_name_internal;
+ malware_name = string_copy(vname);
DEBUG(D_acl) debug_printf("Malware found, name \"%s\"\n", malware_name);
} else if (Ustrcmp(result_tag, "ERROR") == 0)
break;
} /* clamd */
+ case M_SOCK: /* "sock" scanner type ------------------------------------- */
+ /* This code was derived by Martin Poole from the clamd code contributed
+ by David Saez and the cmdline code
+ */
+ {
+ int sock, bread=0;
+ uschar * commandline;
+ uschar av_buffer[1024];
+ uschar * linebuffer;
+ uschar *sockline_scanner;
+ uschar sockline_scanner_default[] = "%s\n";
+ const pcre *sockline_trig_re;
+ const pcre *sockline_name_re;
+
+ /* find scanner command line */
+ if (!(sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
+ NULL, 0)))
+ sockline_scanner = sockline_scanner_default;
+
+ /* find scanner output trigger */
+ sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ "missing trigger specification", &errstr);
+ if (!sockline_trig_re)
+ return sock_errlog_defer(errstr);
+
+ /* find virus name regex */
+ sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
+ "missing virus name regex specification", &errstr);
+ if (!sockline_name_re)
+ return sock_errlog_defer(errstr);
+
+ /* prepare scanner call */
+ commandline = string_sprintf("%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
+ commandline = string_sprintf( CS sockline_scanner, CS commandline);
+
+
+ /* socket does not start with '/' -> network socket */
+ sock = *scanner_options != '/'
+ ? m_tcpsocket_fromdef(scanner_options, &errstr)
+ : m_unixsocket(scanner_options, &errstr);
+ if (sock < 0)
+ return sock_errlog_defer(errstr);
+
+ /* Pass the command string to the socket */
+ if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
+ return sock_errlog_defer(errstr);
+
+ /* We're done sending, close socket for writing. */
+ /* shutdown(sock, SHUT_WR); */
+
+ /* Read the result */
+ memset(av_buffer, 0, sizeof(av_buffer));
+ bread = read(sock, av_buffer, sizeof(av_buffer));
+ (void)close(sock);
+
+ if (!(bread > 0))
+ return sock_errlog_defer(
+ string_sprintf("unable to read from socket (%s)", strerror(errno)));
+
+ if (bread == sizeof(av_buffer))
+ return sock_errlog_defer("buffer too small");
+ linebuffer = string_copy(av_buffer);
+
+ /* try trigger match */
+ if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1)) {
+ if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
+ malware_name = US "unknown";
+ }
+ else /* no virus found */
+ malware_name = NULL;
+ }
+
case M_MKSD: /* "mksd" scanner type ------------------------------------- */
{
char *mksd_options_end;
int mksd_maxproc = 1; /* default, if no option supplied */
- struct sockaddr_un server;
int sock;
int retval;
}
}
- /* set "been here, done that" marker */
- malware_ok = 1;
+ malware_ok = TRUE; /* set "been here, done that" marker */
}
/* match virus name against pattern (caseless ------->----------v) */
- if ( (malware_name != NULL) &&
- (regex_match_and_setup(re, malware_name, 0, -1)) ) {
+ if ( malware_name && (regex_match_and_setup(re, malware_name, 0, -1)) ) {
DEBUG(D_acl) debug_printf("Matched regex to malware [%s] [%s]\n", malware_regex, malware_name);
return OK;
}
if (((p-line) > 5) && (line[3] == ' '))
if (((p = strchr (line+4, ' ')) != NULL) && ((p-line) > 4)) {
*p = '\0';
- malware_name_internal = string_copy(line+4);
- malware_name = malware_name_internal;
+ malware_name = string_copy(line+4);
return OK;
}
}
git://git.exim.org / users / jgh / exim.git / blobdiff