ClamAV INSTREAM scanning by default, unless built with WITH_OLD_CLAMAV_STREAM.

New command-line option, -bmalware (restricted to admin_user).
Fixes: #926

3 files changed, 56 insertions, 5 deletions

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 2a69fcf59..5cd8f1c0d 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -1,4 +1,4 @@
-. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.76 2010/06/05 10:04:43 pdp Exp $
+. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.77 2010/06/05 11:13:29 pdp Exp $
 .
 . /////////////////////////////////////////////////////////////////////////////
 . This is the primary source of the Exim Manual. It is an xfpt document that is
@@ -3169,6 +3169,17 @@ above concerning senders and qualification do not apply. In this situation,
 Exim behaves in exactly the same way as it does when receiving a message via
 the listening daemon.
 
+.vitem &%-bmalware%&&~<&'filename'&>
+.oindex "&%-bmalware%&"
+.cindex "testing", "malware"
+.cindex "malware scan test"
+This debugging option causes Exim to scan the given file,
+using the malware scanning framework.  The option of av_scanner influences
+this option, so if av_scanner's value is dependent upon an expansion then
+the expansion should have defaults which apply to this invocation.  Exim will
+have changed working directory before resolving the filename, so using fully
+qualified pathnames is advisable.  This option requires admin privileges.
+
 .vitem &%-bt%&
 .oindex "&%-bt%&"
 .cindex "testing" "addresses"
@@ -13952,6 +13963,14 @@ an oversized message is logged in both the main and the reject logs. See also
 the generic transport option &%message_size_limit%&, which limits the size of
 message that an individual transport can process.
 
+If you use a virus-scanner and set this option to to a value larger than the
+maximum size that your virus-scanner is configured to support, you may get
+failures triggered by large mails.  The right size to configure for the
+virus-scanner depends upon what data is passed and the options in use but it's
+probably safest to just set it to a little larger than this value.  Eg, with a
+default Exim message size of 50M and a default ClamAV StreamMaxLength of 10M,
+some problems may result.
+
 
 .option move_frozen_messages main boolean false
 .cindex "frozen messages" "moving"
@@ -27884,8 +27903,16 @@ required: either the path and name of a UNIX socket file, or a hostname or IP
 number, and a port, separated by space, as in the second of these examples:
 .code
 av_scanner = clamd:/opt/clamd/socket
-av_scanner = clamd:192.168.2.100 1234
-.endd
+av_scanner = clamd:192.0.2.3 1234
+av_scanner = clamd:192.0.2.3 1234:local
+.endd
+If the value of av_scanner points to a UNIX socket file or contains the local
+keyword, then the ClamAV interface will pass a filename containing the data
+to be scanned, which will should normally result in less I/O happening and be
+more efficient.  Normally in the TCP case, the data is streamed to ClamAV as
+Exim does not assume that there is a common filesystem with the remote host.
+There is an option WITH_OLD_CLAMAV_STREAM in &_src/EDITME_& available, should
+you be running a version of ClamAV prior to 0.95.
 If the option is unset, the default is &_/tmp/clamd_&. Thanks to David Saez for
 contributing the code for this scanner.
 
@@ -28025,6 +28052,9 @@ If your virus scanner cannot unpack MIME and TNEF containers itself, you should
 use the &%demime%& condition (see section &<<SECTdemimecond>>&) before the
 &%malware%& condition.
 
+Beware the interaction of Exim's &%message_size_limit%& with any size limits
+imposed by your anti-virus scanner.
+
 Here is a very simple scanning example:
 .code
 deny message = This message contains malware ($malware_name)
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 828e72fb2..421997b01 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.620 2010/06/05 10:34:29 pdp Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.621 2010/06/05 11:13:29 pdp Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -27,6 +27,10 @@ PP/07 If TLS negotiated an anonymous cipher, we could end up with SSL but
       an assumption that peers always have certificates.  Be a little more
       paranoid.  Problem reported by Martin Tscholak.
 
+PP/08 Bugzilla 926: switch ClamAV to use the new zINSTREAM API for content
+      filtering; old API available if built with WITH_OLD_CLAMAV_STREAM=yes
+      NB: ClamAV planning to remove STREAM in "middle of 2010".
+
 
 Exim version 4.72
 -----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index c2c49379f..c4d38fd4f 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/NewStuff,v 1.167 2010/06/05 10:04:43 pdp Exp $
+$Cambridge: exim/doc/doc-txt/NewStuff,v 1.168 2010/06/05 11:13:29 pdp Exp $
 
 New Features in Exim
 --------------------
@@ -26,6 +26,23 @@ Version 4.73
     so that safety mechanism would have to be overriden for this option to
     be able to take effect.
 
+ 3. ClamAV 0.95 is now required for ClamAV support in Exim, unless
+    Local/Makefile sets: WITH_OLD_CLAMAV_STREAM=yes
+    Note that this switches Exim to use a new API ("INSTREAM") and a future
+    release of ClamAV will remove support for the old API ("STREAM").
+
+    The av_scanner option, when set to "clamd", now takes an optional third
+    part, "local", which causes Exim to pass a filename to ClamAV instead of
+    the file content.  This is the same behaviour as when clamd is pointed at
+    a Unix-domain socket.  For example:
+
+      av_scanner = clamd:192.0.2.3 1234:local
+
+ 4. There is now a -bmalware option, restricted to admin users.  This option
+    takes one parameter, a filename, and scans that file with Exim's
+    malware-scanning framework.  This is intended purely as a debugging aid
+    to ensure that Exim's scanning is working, not to replace other tools.
+
 
 Version 4.72
 ------------