From ad93c40fe70f7de49ffb8601a589e9ffa117d512 Mon Sep 17 00:00:00 2001 From: "Heiko Schlittermann (HS12-RIPE)" Date: Sat, 31 Mar 2018 00:06:47 +0200 Subject: Avast: improve compliance with avast-protocol(5) Treat scanner errors as malware. Defer on scanner tmpfail only. --- test/log/4007 | 10 ++++--- test/log/4017 | 12 ++++---- test/paniclog/4007 | 2 +- test/paniclog/4017 | 2 +- test/rejectlog/4007 | 12 ++++++++ test/rejectlog/4017 | 12 ++++++++ test/scripts/4007_scan_avast/4007 | 34 ++++++++++++++++++++--- test/scripts/4017_scan_avast_multiline/4017 | 40 ++++++++++++++++++++++----- test/stderr/4007 | 8 +++++- test/stderr/4017 | 6 ++-- test/stdout/4007 | 39 ++++++++++++++++++++++---- test/stdout/4017 | 43 ++++++++++++++++++++++------- 12 files changed, 178 insertions(+), 42 deletions(-) (limited to 'test') diff --git a/test/log/4007 b/test/log/4007 index bd0ec8720..960d6babd 100644 --- a/test/log/4007 +++ b/test/log/4007 @@ -1,7 +1,7 @@ -1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" -1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: R=r -1999-03-02 09:44:33 10HmbB-0005vi-00 Completed -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah [E]' +1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" +1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: R=r +1999-03-02 09:44:33 10HmbC-0005vi-00 Completed +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F= temporarily rejected after DATA 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F= rejected after DATA @@ -11,3 +11,5 @@ 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout" 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: R=r 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed +1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name The file is a decompression bomb +1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F= rejected after DATA diff --git a/test/log/4017 b/test/log/4017 index cd53a5c39..480ac5d19 100644 --- a/test/log/4017 +++ b/test/log/4017 @@ -1,7 +1,9 @@ -1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" -1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: R=r -1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted" +1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: R=r +1999-03-02 09:44:33 10HmbA-0005vi-00 Completed +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F= temporarily rejected after DATA -1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This ist not even an EICAR test virus. +1999-03-02 09:44:33 10HmaY-0005vi-00 malware_name This is not even an EICAR test virus. 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F= rejected after DATA +1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name The file is a decompression bomb +1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F= rejected after DATA diff --git a/test/paniclog/4007 b/test/paniclog/4007 index 5236f07f2..9a02eadf4 100644 --- a/test/paniclog/4007 +++ b/test/paniclog/4007 @@ -1,3 +1,3 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah [E]' +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner diff --git a/test/paniclog/4017 b/test/paniclog/4017 index b6fcc0527..de97faf37 100644 --- a/test/paniclog/4017 +++ b/test/paniclog/4017 @@ -1 +1 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied diff --git a/test/rejectlog/4007 b/test/rejectlog/4007 index 6ba3a2659..f46e9e71e 100644 --- a/test/rejectlog/4007 +++ b/test/rejectlog/4007 @@ -34,3 +34,15 @@ P Received: from CALLER (helo=test.ex) Subject: message should be tmp-rejected due to timeout I Message-Id: F From: CALLER_NAME +1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F= rejected after DATA +Envelope-from: +Envelope-to: +P Received: from CALLER (helo=test.ex) + by myhost.test.ex with local-esmtp (Exim x.yz) + (envelope-from ) + id 10HmbB-0005vi-00 + for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000 + Date: Tue, 2 Mar 1999 09:44:33 +0000 + Subject: defer this one, the scanner had an error +I Message-Id: +F From: CALLER_NAME diff --git a/test/rejectlog/4017 b/test/rejectlog/4017 index f14a316b7..ca3f3888f 100644 --- a/test/rejectlog/4017 +++ b/test/rejectlog/4017 @@ -22,3 +22,15 @@ P Received: from CALLER (helo=test.ex) Subject: message should be rejected I Message-Id: F From: CALLER_NAME +1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F= rejected after DATA +Envelope-from: +Envelope-to: +P Received: from CALLER (helo=test.ex) + by myhost.test.ex with local-esmtp (Exim x.yz) + (envelope-from ) + id 10HmaZ-0005vi-00 + for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000 + Date: Tue, 2 Mar 1999 09:44:33 +0000 + Subject: message should be rejected +I Message-Id: +F From: CALLER_NAME diff --git a/test/scripts/4007_scan_avast/4007 b/test/scripts/4007_scan_avast/4007 index 0611f2a96..fc6c627cf 100644 --- a/test/scripts/4007_scan_avast/4007 +++ b/test/scripts/4007_scan_avast/4007 @@ -28,13 +28,13 @@ quit **** # # -# +### (non-internal) scanner error -> paniclog server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA ->LF>blah [E] ->LF>200 SCAN OK +>LF>blah [E]0.0 Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied LF>220 ready LF>210 SCAN DATA ->LF>b\\ l\\ a\\ h [L]9.9 9 VNAME +>LF>b\\ l\\ a\\ h [L]9.0 0 VNAME >LF>200 SCAN OK LF>220 ready +LF>210 SCAN DATA +>LF>blah [E]0.0 Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>200 SCAN OK + +rcpt to: +data +Date: Fri, 17 Dec 2004 14:35:01 +0100 +Subject: defer this one, the scanner had an error + +. +quit +**** diff --git a/test/scripts/4017_scan_avast_multiline/4017 b/test/scripts/4017_scan_avast_multiline/4017 index d075825b8..3e6b06713 100644 --- a/test/scripts/4017_scan_avast_multiline/4017 +++ b/test/scripts/4017_scan_avast_multiline/4017 @@ -31,15 +31,13 @@ quit **** # # -### clean and error | multiline response +### scanner tmpfail -> defer server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA ->LF>/bin/ok [+] ->LF>/bin/error [E]0.0 ->LF>/bin/infected [L]0.0 0 This is not even EICAR! ->LF>200 SCAN OK +>LF>/bin/error [E]0.0 Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied reject +server DIR/eximdir/avast_sock +>LF>220 ready +LF>210 SCAN DATA +>LF>/bin/clean [+] +>LF>v\\ i\\ a\\ r\\ u\\ s [L]9.0 0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. +>LF>200 SCAN OK + +rcpt to: +data +Date: Fri, 17 Dec 2004 14:35:01 +0100 +Subject: message should be rejected + +. +quit +**** +# +# +# clean, error, infected -> reject server DIR/eximdir/avast_sock >LF>220 ready LF>210 SCAN DATA >LF>/bin/clean [+] ->LF>v\\ i\\ a\\ r\\ u\\ s [L]9.9 9 This ist not even an EICAR test virus. +>LF>/bin/error [E]0.0 Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>v\\ i\\ a\\ r\\ u\\ s [L]9.0 0 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. >LF>200 SCAN OK paniclog +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied 1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner 1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner +### internal scanner error, no panic log + +******** SERVER ******** +### (non-internal) scanner error -> paniclog +### internal scanner error, no panic log diff --git a/test/stderr/4017 b/test/stderr/4017 index 22157c3d1..287cd30ce 100644 --- a/test/stderr/4017 +++ b/test/stderr/4017 @@ -1,7 +1,7 @@ ### clean | multiline response -### clean and error | multiline response -1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: '/bin/error [E]0.0' +### scanner tmpfail -> defer +1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : 451 SCAN Engine error 13 Permission denied ******** SERVER ******** ### clean | multiline response -### clean and error | multiline response +### scanner tmpfail -> defer diff --git a/test/stdout/4007 b/test/stdout/4007 index 603de1521..32adb0910 100644 --- a/test/stdout/4007 +++ b/test/stdout/4007 @@ -7,8 +7,9 @@ 250 OK 250 Accepted 354 Enter message, ending with "." on a line by itself -250 OK id=10HmbB-0005vi-00 +250 OK id=10HmbC-0005vi-00 221 myhost.test.ex closing connection +### (non-internal) scanner error -> paniclog 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 250-myhost.test.ex Hello CALLER at test.ex 250-SIZE 52428800 @@ -53,6 +54,18 @@ 354 Enter message, ending with "." on a line by itself 250 OK id=10HmaZ-0005vi-00 221 myhost.test.ex closing connection +### internal scanner error, no panic log +220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 +250-myhost.test.ex Hello CALLER at test.ex +250-SIZE 52428800 +250-8BITMIME +250-PIPELINING +250 HELP +250 OK +250 Accepted +354 Enter message, ending with "." on a line by itself +550 Administrative prohibition +221 myhost.test.ex closing connection ******** SERVER ******** Listening on TESTSUITE/eximdir/avast_sock ... @@ -61,27 +74,30 @@ Connection request LF>210 FLAGS DATA >LF>200 FLAGS OK -LF>210 SCAN DATA >LF>blah\x09[+] >LF>200 SCAN OK paniclog Listening on TESTSUITE/eximdir/avast_sock ... Connection request >LF>220 ready LF>210 SCAN DATA ->LF>blah\x09[E] ->LF>200 SCAN OK -Unexpected EOF read from client +>LF>blah\x09[E]0.0\x09Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied +LF>220 ready LF>210 SCAN DATA ->LF>b\\ l\\ a\\ h\x09[L]9.9\x099 VNAME +>LF>b\\ l\\ a\\ h\x09[L]9.0\x090 VNAME >LF>200 SCAN OK LF>220 ready +LF>210 SCAN DATA +>LF>blah\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>200 SCAN OK + defer 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 250-myhost.test.ex Hello CALLER at test.ex 250-SIZE 52428800 @@ -33,6 +33,17 @@ 354 Enter message, ending with "." on a line by itself 550 Administrative prohibition 221 myhost.test.ex closing connection +220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000 +250-myhost.test.ex Hello CALLER at test.ex +250-SIZE 52428800 +250-8BITMIME +250-PIPELINING +250 HELP +250 OK +250 Accepted +354 Enter message, ending with "." on a line by itself +550 Administrative prohibition +221 myhost.test.ex closing connection ******** SERVER ******** ### clean | multiline response @@ -44,7 +55,7 @@ Connection request >LF>FLAGS -fullfiles >LF>FLAGS +extra >LF>200 FLAGS OK -LF>210 SCAN DATA >LF>/bin/clean1\x09[+] >LF>/bin/clean2\x09[+] @@ -52,24 +63,36 @@ Connection request defer Listening on TESTSUITE/eximdir/avast_sock ... Connection request >LF>220 ready LF>210 SCAN DATA ->LF>/bin/ok\x09[+] ->LF>/bin/error\x09[E]0.0 ->LF>/bin/infected\x09[L]0.0\x090 This is not even EICAR! ->LF>200 SCAN OK -Unexpected EOF read from client +>LF>/bin/error\x09[E]0.0\x09Error 13 Permission\\ denied +>LF>451 SCAN Engine error 13 Permission denied +LF>220 ready LF>210 SCAN DATA >LF>/bin/clean\x09[+] ->LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.9\x099 This ist not even an EICAR test virus. +>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. +>LF>200 SCAN OK +LF>220 ready +LF>210 SCAN DATA +>LF>/bin/clean\x09[+] +>LF>/bin/error\x09[E]0.0\x09Error 42110 The\\ file\\ is\\ a\\ decompression\\ bomb +>LF>v\\ i\\ a\\ r\\ u\\ s\x09[L]9.0\x090 This\\ is\\ not\\ even\\ an\\ EICAR\\ test\\ virus. >LF>200 SCAN OK