Avast: improve compliance with avast-protocol(5)

Treat scanner errors as malware. Defer on scanner tmpfail
only.

12 files changed, 178 insertions, 42 deletions

diff --git a/test/log/4007 b/test/log/4007
index bd0ec8720..960d6babd 100644
--- a/test/log/4007
+++ b/test/log/4007
@@ -1,7 +1,7 @@
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
@@ -11,3 +11,5 @@
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name The file is a decompression bomb
+1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/log/4017 b/test/log/4017
index cd53a5c39..480ac5d19 100644
--- a/test/log/4017
+++ b/test/log/4017
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error	[E]0.0'
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This ist not even an EICAR test virus.
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This is not even an EICAR test virus.
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name The file is a decompression bomb
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/paniclog/4007 b/test/paniclog/4007
index 5236f07f2..9a02eadf4 100644
--- a/test/paniclog/4007
+++ b/test/paniclog/4007
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
diff --git a/test/paniclog/4017 b/test/paniclog/4017
index b6fcc0527..de97faf37 100644
--- a/test/paniclog/4017
+++ b/test/paniclog/4017
@@ -1 +1 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error	[E]0.0'
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
diff --git a/test/rejectlog/4007 b/test/rejectlog/4007
index 6ba3a2659..f46e9e71e 100644
--- a/test/rejectlog/4007
+++ b/test/rejectlog/4007
@@ -34,3 +34,15 @@ P Received: from CALLER (helo=test.ex)
   Subject: message should be tmp-rejected due to timeout
 I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: defer this one, the scanner had an error
+I Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4017 b/test/rejectlog/4017
index f14a316b7..ca3f3888f 100644
--- a/test/rejectlog/4017
+++ b/test/rejectlog/4017
@@ -22,3 +22,15 @@ P Received: from CALLER (helo=test.ex)
   Subject: message should be rejected
 I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaZ-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: message should be rejected
+I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/scripts/4007_scan_avast/4007 b/test/scripts/4007_scan_avast/4007
index 0611f2a96..fc6c627cf 100644
--- a/test/scripts/4007_scan_avast/4007
+++ b/test/scripts/4007_scan_avast/4007
@@ -28,13 +28,13 @@ quit
 ****
 #
 #
-#
+### (non-internal) scanner error -> paniclog
 server DIR/eximdir/avast_sock
 >LF>220 ready
 <SCAN
 >LF>210 SCAN DATA
->LF>blah	[E]
->LF>200 SCAN OK
+>LF>blah	[E]0.0	Error 13 Permission\\ denied
+>LF>451 SCAN Engine error 13 Permission denied
 <QUIT
 *eof
 ****
@@ -59,7 +59,7 @@ server DIR/eximdir/avast_sock
 >LF>220 ready
 <SCAN
 >LF>210 SCAN DATA
->LF>b\\ l\\ a\\ h	[L]9.9	9 VNAME
+>LF>b\\ l\\ a\\ h	[L]9.0	0 VNAME
 >LF>200 SCAN OK
 <QUIT
 *eof
@@ -118,3 +118,29 @@ Subject: message should be accepted despite timeout
 .
 quit
 ****
+#
+#
+### internal scanner error, no panic log
+server DIR/eximdir/avast_sock
+>LF>220 ready
+<SCAN
+>LF>210 SCAN DATA
+>LF>blah	[E]0.0	Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb
+>LF>200 SCAN OK
+<QUIT
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPTION= -DINSERT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: defer this one, the scanner had an error
+
+.
+quit
+****
diff --git a/test/scripts/4017_scan_avast_multiline/4017 b/test/scripts/4017_scan_avast_multiline/4017
index d075825b8..3e6b06713 100644
--- a/test/scripts/4017_scan_avast_multiline/4017
+++ b/test/scripts/4017_scan_avast_multiline/4017
@@ -31,15 +31,13 @@ quit
 ****
 #
 #
-### clean and error | multiline response
+### scanner tmpfail -> defer
 server DIR/eximdir/avast_sock
 >LF>220 ready
 <SCAN
 >LF>210 SCAN DATA
->LF>/bin/ok	[+]
->LF>/bin/error	[E]0.0
->LF>/bin/infected	[L]0.0	0 This is not even EICAR!
->LF>200 SCAN OK
+>LF>/bin/error	[E]0.0	Error 13 Permission\\ denied
+>LF>451 SCAN Engine error 13 Permission denied
 <QUIT
 *eof
 ****
@@ -59,13 +57,41 @@ quit
 ****
 #
 #
-# clean and infected | multiline response
+# clean and infected -> reject
+server DIR/eximdir/avast_sock
+>LF>220 ready
+<SCAN
+>LF>210 SCAN DATA
+>LF>/bin/clean	[+]
+>LF>v\\ i\\ a\\ r\\ u\\ s	[L]9.0	0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus.
+>LF>200 SCAN OK
+<QUIT
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPTION= -DINSERT="/defer_ok"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected
+
+.
+quit
+****
+#
+#
+# clean, error, infected -> reject
 server DIR/eximdir/avast_sock
 >LF>220 ready
 <SCAN
 >LF>210 SCAN DATA
 >LF>/bin/clean	[+]
->LF>v\\ i\\ a\\ r\\ u\\ s	[L]9.9	9 This ist not even an EICAR test virus.
+>LF>/bin/error	[E]0.0	Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb
+>LF>v\\ i\\ a\\ r\\ u\\ s	[L]9.0	0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus.
 >LF>200 SCAN OK
 <QUIT
 *eof
diff --git a/test/stderr/4007 b/test/stderr/4007
index 5236f07f2..2a5493e96 100644
--- a/test/stderr/4007
+++ b/test/stderr/4007
@@ -1,3 +1,9 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+### (non-internal) scanner error -> paniclog
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+### internal scanner error, no panic log
+
+******** SERVER ********
+### (non-internal) scanner error -> paniclog
+### internal scanner error, no panic log
diff --git a/test/stderr/4017 b/test/stderr/4017
index 22157c3d1..287cd30ce 100644
--- a/test/stderr/4017
+++ b/test/stderr/4017
@@ -1,7 +1,7 @@
 ### clean |  multiline response
-### clean and error | multiline response
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error	[E]0.0'
+### scanner tmpfail -> defer
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied
 
 ******** SERVER ********
 ### clean |  multiline response
-### clean and error | multiline response
+### scanner tmpfail -> defer
diff --git a/test/stdout/4007 b/test/stdout/4007
index 603de1521..32adb0910 100644
--- a/test/stdout/4007
+++ b/test/stdout/4007
@@ -7,8 +7,9 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbB-0005vi-00

+250 OK id=10HmbC-0005vi-00

 221 myhost.test.ex closing connection

+### (non-internal) scanner error -> paniclog
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

@@ -53,6 +54,18 @@
 354 Enter message, ending with "." on a line by itself

 250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

+### internal scanner error, no panic log
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

+221 myhost.test.ex closing connection

 
 ******** SERVER ********
 Listening on TESTSUITE/eximdir/avast_sock ... 
@@ -61,27 +74,30 @@ Connection request
 <FLAGS -fullfiles
 >LF>210 FLAGS DATA
 >LF>200 FLAGS OK
-<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00
+<SCAN TESTSUITE/spool/scan/10HmbC-0005vi-00
 >LF>210 SCAN DATA
 >LF>blah\x09[+]
 >LF>200 SCAN OK
 <QUIT
 Expected EOF read from client
 End of script
+### (non-internal) scanner error -> paniclog
 Listening on TESTSUITE/eximdir/avast_sock ... 
 Connection request
 >LF>220 ready
 <SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00
 >LF>210 SCAN DATA
->LF>blah\x09[E]
->LF>200 SCAN OK
-Unexpected EOF read from client
+>LF>blah\x09[E]0.0\x09Error 13 Permission\\ denied
+>LF>451 SCAN Engine error 13 Permission denied
+<QUIT
+Expected EOF read from client
+End of script
 Listening on TESTSUITE/eximdir/avast_sock ... 
 Connection request
 >LF>220 ready
 <SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00
 >LF>210 SCAN DATA
->LF>b\\ l\\ a\\ h\x09[L]9.9\x099 VNAME
+>LF>b\\ l\\ a\\ h\x09[L]9.0\x090 VNAME
 >LF>200 SCAN OK
 <QUIT
 Expected EOF read from client
@@ -94,3 +110,14 @@ Listening on TESTSUITE/eximdir/avast_sock ...
 Connection request
 *sleep 3
 End of script
+### internal scanner error, no panic log
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+>LF>220 ready
+<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00
+>LF>210 SCAN DATA
+>LF>blah\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb
+>LF>200 SCAN OK
+<QUIT
+Expected EOF read from client
+End of script
diff --git a/test/stdout/4017 b/test/stdout/4017
index e46e8f3fd..388af3dd4 100644
--- a/test/stdout/4017
+++ b/test/stdout/4017
@@ -8,9 +8,9 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

+250 OK id=10HmbA-0005vi-00

 221 myhost.test.ex closing connection

-### clean and error | multiline response
+### scanner tmpfail -> defer
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

@@ -33,6 +33,17 @@
 354 Enter message, ending with "." on a line by itself

 550 Administrative prohibition

 221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

+221 myhost.test.ex closing connection

 
 ******** SERVER ********
 ### clean |  multiline response
@@ -44,7 +55,7 @@ Connection request
 >LF>FLAGS -fullfiles
 >LF>FLAGS +extra
 >LF>200 FLAGS OK
-<SCAN TESTSUITE/spool/scan/10HmaZ-0005vi-00
+<SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00
 >LF>210 SCAN DATA
 >LF>/bin/clean1\x09[+]
 >LF>/bin/clean2\x09[+]
@@ -52,24 +63,36 @@ Connection request
 <QUIT
 Expected EOF read from client
 End of script
-### clean and error | multiline response
+### scanner tmpfail -> defer
 Listening on TESTSUITE/eximdir/avast_sock ... 
 Connection request
 >LF>220 ready
 <SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00
 >LF>210 SCAN DATA
->LF>/bin/ok\x09[+]
->LF>/bin/error\x09[E]0.0
->LF>/bin/infected\x09[L]0.0\x090 This is not even EICAR!
->LF>200 SCAN OK
-Unexpected EOF read from client
+>LF>/bin/error\x09[E]0.0\x09Error 13 Permission\\ denied
+>LF>451 SCAN Engine error 13 Permission denied
+<QUIT
+Expected EOF read from client
+End of script
 Listening on TESTSUITE/eximdir/avast_sock ... 
 Connection request
 >LF>220 ready
 <SCAN TESTSUITE/spool/scan/10HmaY-0005vi-00
 >LF>210 SCAN DATA
 >LF>/bin/clean\x09[+]
->LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.9\x099 This ist not even an EICAR test virus.
+>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus.
+>LF>200 SCAN OK
+<QUIT
+Expected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+>LF>220 ready
+<SCAN TESTSUITE/spool/scan/10HmaZ-0005vi-00
+>LF>210 SCAN DATA
+>LF>/bin/clean\x09[+]
+>LF>/bin/error\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb
+>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus.
 >LF>200 SCAN OK
 <QUIT
 Expected EOF read from client