7 Commits

Author SHA1 Message Date
8bacce743e change version to 0.0.5 2024-06-16 01:27:29 +02:00
4ca7542a1d remove unused variable 2024-06-16 01:23:52 +02:00
090922d958 update python requirements 2024-06-16 01:19:17 +02:00
393c87db08 refactor code to better handle premature disconnects 2024-06-16 01:15:33 +02:00
792ba7c1aa switch to f-strings 2024-06-16 00:38:14 +02:00
a5d5448001 fix temp file deletion when scan is already running 2024-06-16 00:26:33 +02:00
LarsBel
d507b84266 Update README.md (#1)
* Update README.md

* Update README.md

* Update README.md

* Update README.md

* Update README.md

* Update README.md
2023-01-10 10:43:17 +01:00
3 changed files with 97 additions and 51 deletions

View File

@@ -3,3 +3,40 @@ A python daemon to perform virus scans with uvscan (McAfee) over TCP socket, mai
## Developer information
Everyone who wants to improve or extend this project is very welcome.
## Installation
git clone https://github.com/spacefreak86/uvscand
cd uvscand
python3 setup.py build
python3 setup.py install
cp docs/uvscand.conf /etc/
cat << 'EOF'>> /etc/systemd/system/uvscand.service
[Unit]
Description=uvscand Service
After=multi-user.target
[Service]
Type=simple
Restart=always
ExecStart=/usr/bin/python3 /usr/local/bin/uvscand
[Install]
WantedBy=multi-user.target
EOF
systemctl restart uvscand
systemctl status uvscand
systemctl enable uvscand
cat << 'EOF'>> /etc/rspamd/local.d/antivirus.conf
uvscan {
scan_mime_parts = true;
scan_text_mime = true;
scan_image_mime = true;
type = "clamav";
symbol = "MCAFEE_VIRUS";
servers = "127.0.0.1:10060";
action = "reject";
}
EOF
systemctl restart rspamd

View File

@@ -5,7 +5,7 @@ def read_file(fname):
return f.read()
setup(name = "uvscand",
version = "0.0.4",
version = "0.0.5",
author = "Thomas Oettli",
author_email = "spacefreak@noop.ch",
description = "A python daemon to perform virus scans with uvscan (McAfee) over TCP socket.",
@@ -30,5 +30,5 @@ setup(name = "uvscand",
"uvscand=uvscand:main"
]
},
python_requires = ">=3"
python_requires = ">=3.7"
)

View File

@@ -4,12 +4,12 @@
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
#
# uvscand is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
#
# You should have received a copy of the GNU General Public License
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
#
@@ -25,8 +25,6 @@ import struct
import sys
import time
from subprocess import Popen, PIPE
uvscan_regex = re.compile(r"Found:?(?: the| potentially unwanted program| (?:virus|trojan) or variant)? (.+?)(?:\.| (?:virus |trojan )?)", re.MULTILINE)
@@ -40,10 +38,11 @@ async def uvscan_worker(queue):
uvscan, filename, cb = job
proc = await asyncio.create_subprocess_exec(uvscan, "--secure", "--mime", "--noboot", "--panalyse", "--manalyse", filename, stdout=asyncio.subprocess.PIPE)
stdout, _ = await proc.communicate()
os.remove(filename)
if proc.returncode == 13:
match = uvscan_regex.search(stdout.decode())
name = match.group(1) if match else "UNKNOWN"
result = "stream: {} FOUND".format(name)
result = f"stream: {name} FOUND"
else:
result = "stream: OK"
cb(result)
@@ -64,14 +63,13 @@ class AIO(asyncio.Protocol):
def _send_response(self, response):
response = response.encode() + AIO.separator
self.logger.debug("{} sending response: {}".format(self.peer, response))
self.logger.debug(f"{self.peer} sending response: {response}")
self.transport.write(response)
self.transport.close()
def connection_made(self, transport):
self.peer = transport.get_extra_info("peername")
self.logger.info("new connection from {}".format(self.peer))
self.logger.info(f"new connection from {self.peer}")
self.transport = transport
self.request_time = str(time.time())
self.buffer = bytearray()
@@ -79,14 +77,14 @@ class AIO(asyncio.Protocol):
self.command = None
self.length = None
self.all_chunks = False
self.completed = False
def data_received(self, data):
try:
nbytes = len(data)
if self.all_chunks:
self.logger.warning("{} received {} bytes of garbage after last chunk".format(self.peer, len(data)))
self.logger.warning(f"{self.peer} received {nbytes} bytes of garbage after last chunk")
return
self.logger.debug("{} received {} bytes".format(self.peer, len(data)))
self.logger.debug(f"{self.peer} received {nbytes} bytes")
self.buffer.extend(data)
if not self.command:
@@ -100,7 +98,7 @@ class AIO(asyncio.Protocol):
if command != "zINSTREAM":
raise RuntimeError("unknown command")
self.command = command
self.logger.debug("{} command is {}".format(self.peer, command))
self.logger.debug(f"{self.peer} command is {command}")
pos += 1
self.buffer = self.buffer[pos:]
if self.command:
@@ -112,62 +110,73 @@ class AIO(asyncio.Protocol):
self.buffer = self.buffer[4:]
if self.length == 0:
self.all_chunks = True
tmpfile = os.path.join(AIO.config["tmpdir"], "uvscan_{}_{}".format(self.request_time, str(self.peer[1])))
self.logger.debug("{} got last chunk, save data to {}".format(self.peer, tmpfile))
suffix = str(self.peer[1])
tmpfile = os.path.join(AIO.config["tmpdir"], f"uvscan_{self.request_time}_{suffix}")
self.logger.debug(f"{self.peer} got last chunk, save data to {tmpfile}")
with open(tmpfile, "wb") as f:
self.tmpfile = tmpfile
f.write(self.data)
AIO.queue.put_nowait((AIO.config["uvscan_path"], tmpfile, self.process_uvscan_result))
self.logger.info("{} queued uvscan of {}, queue size is {}".format(self.peer, tmpfile, AIO.queue.qsize()))
queuesize = AIO.queue.qsize()
self.logger.info(f"{self.peer} queued uvscan of {tmpfile}, queue size is {queuesize}")
break
self.logger.debug("{} got chunk size of {} bytes".format(self.peer, self.length))
self.logger.debug(f"{self.peer} got chunk size of {self.length} bytes")
else:
if len(self.buffer) < self.length:
self.logger.debug("{} got {} of {} bytes".format(self.peer, len(self.buffer), self.length))
nbytes = len(self.buffer)
self.logger.debug(f"{self.peer} got {nbytes} of {self.length} bytes")
break
self.logger.debug("{} chunk complete ({} bytes)".format(self.peer, self.length))
self.logger.debug(f"{self.peer} chunk complete ({self.length} bytes)")
self.data.extend(self.buffer[0:self.length])
self.buffer = self.buffer[self.length:]
self.length = None
except (RuntimeError, IndexError, IOError, struct.error) as e:
self.logger.warning("{} warning: {}".format(self.peer, e))
self.logger.warning(f"{self.peer} warning: {e}")
self._send_response(str(e))
def process_uvscan_result(self, result):
self.logger.info("{} received uvscan result of {}: {}".format(self.peer, self.tmpfile, result))
self.completed = True
if not self.tmpfile:
return
self.logger.info(f"{self.peer} received uvscan result of {self.tmpfile}: {result}")
self._send_response(result)
self.tmpfile = None
def connection_lost(self, exc):
if not self.tmpfile:
self.logger.info(f"closed connection to {self.peer}")
return
entries = []
try:
for entry in iter(AIO.queue.get_nowait, None):
if not entry:
continue
if self.tmpfile and entry[1] == self.tmpfile:
self.logger.warning(f"{self.peer} client prematurely closed connection, skipping scan of {self.tmpfile}")
os.remove(self.tmpfile)
self.tmpfile = None
continue
entries.append(entry)
except asyncio.QueueEmpty:
pass
for entry in entries:
AIO.queue.put_nowait(entry)
if self.tmpfile:
if not self.completed:
self.logger.warning("{} client prematurely closed connection, removing {} from scan queue".format(self.peer, self.tmpfile))
entries = []
try:
for entry in iter(AIO.queue.get_nowait, None):
if not entry:
continue
if entry[1] != self.tmpfile:
entries.append(entry)
except asyncio.QueueEmpty:
pass
for entry in entries:
AIO.queue.put_nowait(entry)
self.logger.debug("{} removing temporary file {}".format(self.peer, self.tmpfile))
os.remove(self.tmpfile)
self.logger.info("closed connection to {}".format(self.peer))
self.logger.warning(f"{self.peer} client prematurely closed connection, but scan is already running")
self.tmpfile = None
def main():
"Run uvscand."
# parse command line
parser = argparse.ArgumentParser(description="uvscand daemon",
parser = argparse.ArgumentParser(
description="uvscand daemon",
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=45, width=140))
parser.add_argument("-c", "--config", help="List of config files to read.", nargs="+",
default=["/etc/uvscand.conf"])
parser.add_argument("-m", "--maxprocs", help="Maximum number of parallel scan processes.",
type=int, default=8)
parser.add_argument("-c", "--config", help="List of config files to read.", nargs="+", default=["/etc/uvscand.conf"])
parser.add_argument("-m", "--maxprocs", help="Maximum number of parallel scan processes.", type=int, default=8)
parser.add_argument("-d", "--debug", help="Log debugging messages.", action="store_true")
args = parser.parse_args()
@@ -177,8 +186,8 @@ def main():
syslog_name = logname
if args.debug:
loglevel = logging.DEBUG
logname = "{}[%(name)s]".format(logname)
syslog_name = "{}: [%(name)s] %(levelname)s".format(syslog_name)
logname = f"{logname}[%(name)s]"
syslog_name = f"{syslog_name}: [%(name)s] %(levelname)s"
root_logger = logging.getLogger()
root_logger.setLevel(loglevel)
@@ -186,14 +195,14 @@ def main():
# setup console log
stdouthandler = logging.StreamHandler(sys.stdout)
stdouthandler.setLevel(loglevel)
formatter = logging.Formatter("%(asctime)s {}: [%(levelname)s] %(message)s".format(logname), datefmt="%Y-%m-%d %H:%M:%S")
formatter = logging.Formatter(f"%(asctime)s {logname}: [%(levelname)s] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
stdouthandler.setFormatter(formatter)
root_logger.addHandler(stdouthandler)
# setup syslog
sysloghandler = logging.handlers.SysLogHandler(address="/dev/log")
sysloghandler.setLevel(loglevel)
formatter = logging.Formatter("{}: %(message)s".format(syslog_name))
formatter = logging.Formatter(f"{syslog_name}: %(message)s")
sysloghandler.setFormatter(formatter)
root_logger.addHandler(sysloghandler)
@@ -210,7 +219,7 @@ def main():
config = dict(parser.items("uvscand"))
for option in ["bind_address", "bind_port", "tmpdir", "uvscan_path", "loglevel"]:
if option not in config.keys():
logger.error("option '{}' not present in config section 'uvscand'".format(option))
logger.error(f"option '{option}' not present in config section 'uvscand'")
sys.exit(1)
if not args.debug:
@@ -220,7 +229,7 @@ def main():
# check if uvscan binary exists and is executable
if not os.path.isfile(config["uvscan_path"]) or not os.access(config["uvscan_path"], os.X_OK):
logger.error("uvscan binary '{}' does not exist or is not executable".format(config["uvscan_path"]))
logger.error(f"uvscan binary '{config['uvscan_path']}' does not exist or is not executable")
sys.exit(1)
# setup protocol