Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
c789d056b2
|
||
|
|
364368e3a5
|
||
|
|
8bacce743e
|
||
|
|
4ca7542a1d
|
||
|
|
090922d958
|
||
|
|
393c87db08
|
||
|
|
792ba7c1aa
|
||
|
|
a5d5448001
|
||
|
|
d507b84266 |
@@ -1,3 +0,0 @@
|
|||||||
include LICENSE README.md
|
|
||||||
recursive-include docs *
|
|
||||||
recursive-include misc *
|
|
||||||
@@ -1,5 +1,50 @@
|
|||||||
# uvscand
|
# uvscand
|
||||||
A python daemon to perform virus scans with uvscan (McAfee) over TCP socket, mainly used in conjunction with the antivirus module of rspamd.
|
A python daemon to perform virus scans with uvscan (McAfee) over TCP socket, mainly used in conjunction with the antivirus module of rspamd.
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/spacefreak86/uvscand
|
||||||
|
cd uvscand
|
||||||
|
|
||||||
|
# build and install uvscand package
|
||||||
|
python3 -m build
|
||||||
|
python3 -m pip install .
|
||||||
|
|
||||||
|
# copy config file
|
||||||
|
cp docs/uvscand.conf /etc/
|
||||||
|
|
||||||
|
# install systemd service
|
||||||
|
cat << 'EOF'>> /etc/systemd/system/uvscand.service
|
||||||
|
[Unit]
|
||||||
|
Description=uvscand Service
|
||||||
|
After=multi-user.target
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
Restart=always
|
||||||
|
ExecStart=/usr/bin/python3 /usr/local/bin/uvscand
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl restart uvscand
|
||||||
|
systemctl status uvscand
|
||||||
|
systemctl enable uvscand
|
||||||
|
|
||||||
|
cat <<'EOF' >>/etc/rspamd/local.d/antivirus.conf
|
||||||
|
uvscan {
|
||||||
|
scan_mime_parts = true;
|
||||||
|
scan_text_mime = true;
|
||||||
|
scan_image_mime = true;
|
||||||
|
type = "clamav";
|
||||||
|
symbol = "MCAFEE_VIRUS";
|
||||||
|
servers = "127.0.0.1:10060";
|
||||||
|
action = "reject";
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
systemctl restart rspamd
|
||||||
|
```
|
||||||
|
|
||||||
## Developer information
|
## Developer information
|
||||||
|
|
||||||
Everyone who wants to improve or extend this project is very welcome.
|
Everyone who wants to improve or extend this project is very welcome.
|
||||||
|
|||||||
@@ -0,0 +1,25 @@
|
|||||||
|
[tool.setuptools.packages.find]
|
||||||
|
include = ["uvscand"]
|
||||||
|
|
||||||
|
[project]
|
||||||
|
name = "uvscand"
|
||||||
|
version = "0.0.6"
|
||||||
|
requires-python = ">=3.11"
|
||||||
|
authors = [
|
||||||
|
{name = "Thomas Oettli", email = "spacefreak@noop.ch"}
|
||||||
|
]
|
||||||
|
maintainers = [
|
||||||
|
{name = "Thomas Oettli", email = "spacefreak@noop.ch"}
|
||||||
|
]
|
||||||
|
description = "A python daemon to perform virus scans with uvscan (McAfee) over TCP socket."
|
||||||
|
readme = "README.md"
|
||||||
|
license = "GPL-3.0-only"
|
||||||
|
keywords = ["uvscan", "virus", "rspamd", "mail"]
|
||||||
|
classifiers = [
|
||||||
|
"Development Status :: 4 - Beta",
|
||||||
|
"Intended Audience :: System Administrators",
|
||||||
|
"Programming Language :: Python :: 3"
|
||||||
|
]
|
||||||
|
|
||||||
|
[project.scripts]
|
||||||
|
uvscand = "uvscand:main"
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
from setuptools import setup
|
|
||||||
|
|
||||||
def read_file(fname):
|
|
||||||
with open(fname, 'r') as f:
|
|
||||||
return f.read()
|
|
||||||
|
|
||||||
setup(name = "uvscand",
|
|
||||||
version = "0.0.4",
|
|
||||||
author = "Thomas Oettli",
|
|
||||||
author_email = "spacefreak@noop.ch",
|
|
||||||
description = "A python daemon to perform virus scans with uvscan (McAfee) over TCP socket.",
|
|
||||||
license = "GPL 3",
|
|
||||||
keywords = "rspamd uvscan",
|
|
||||||
url = "https://github.com/spacefreak86/uvscand",
|
|
||||||
packages = ["uvscand"],
|
|
||||||
long_description = read_file("README.md"),
|
|
||||||
classifiers = [
|
|
||||||
# 3 - Alpha
|
|
||||||
# 4 - Beta
|
|
||||||
# 5 - Production/Stable
|
|
||||||
"Development Status :: 3 - Alpha",
|
|
||||||
"License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
|
|
||||||
"Operating System :: OS Independent",
|
|
||||||
"Programming Language :: Python",
|
|
||||||
"Programming Language :: Python :: 3",
|
|
||||||
"Topic :: Communications :: Email :: Virus"
|
|
||||||
],
|
|
||||||
entry_points = {
|
|
||||||
"console_scripts": [
|
|
||||||
"uvscand=uvscand:main"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
python_requires = ">=3"
|
|
||||||
)
|
|
||||||
+69
-72
@@ -4,12 +4,12 @@
|
|||||||
# it under the terms of the GNU General Public License as published by
|
# it under the terms of the GNU General Public License as published by
|
||||||
# the Free Software Foundation, either version 3 of the License, or
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
# (at your option) any later version.
|
# (at your option) any later version.
|
||||||
#
|
#
|
||||||
# uvscand is distributed in the hope that it will be useful,
|
# uvscand is distributed in the hope that it will be useful,
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
# GNU General Public License for more details.
|
# GNU General Public License for more details.
|
||||||
#
|
#
|
||||||
# You should have received a copy of the GNU General Public License
|
# You should have received a copy of the GNU General Public License
|
||||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||||
#
|
#
|
||||||
@@ -25,8 +25,6 @@ import struct
|
|||||||
import sys
|
import sys
|
||||||
import time
|
import time
|
||||||
|
|
||||||
from subprocess import Popen, PIPE
|
|
||||||
|
|
||||||
|
|
||||||
uvscan_regex = re.compile(r"Found:?(?: the| potentially unwanted program| (?:virus|trojan) or variant)? (.+?)(?:\.| (?:virus |trojan )?)", re.MULTILINE)
|
uvscan_regex = re.compile(r"Found:?(?: the| potentially unwanted program| (?:virus|trojan) or variant)? (.+?)(?:\.| (?:virus |trojan )?)", re.MULTILINE)
|
||||||
|
|
||||||
@@ -40,10 +38,11 @@ async def uvscan_worker(queue):
|
|||||||
uvscan, filename, cb = job
|
uvscan, filename, cb = job
|
||||||
proc = await asyncio.create_subprocess_exec(uvscan, "--secure", "--mime", "--noboot", "--panalyse", "--manalyse", filename, stdout=asyncio.subprocess.PIPE)
|
proc = await asyncio.create_subprocess_exec(uvscan, "--secure", "--mime", "--noboot", "--panalyse", "--manalyse", filename, stdout=asyncio.subprocess.PIPE)
|
||||||
stdout, _ = await proc.communicate()
|
stdout, _ = await proc.communicate()
|
||||||
|
os.remove(filename)
|
||||||
if proc.returncode == 13:
|
if proc.returncode == 13:
|
||||||
match = uvscan_regex.search(stdout.decode())
|
match = uvscan_regex.search(stdout.decode())
|
||||||
name = match.group(1) if match else "UNKNOWN"
|
name = match.group(1) if match else "UNKNOWN"
|
||||||
result = "stream: {} FOUND".format(name)
|
result = f"stream: {name} FOUND"
|
||||||
else:
|
else:
|
||||||
result = "stream: OK"
|
result = "stream: OK"
|
||||||
cb(result)
|
cb(result)
|
||||||
@@ -60,34 +59,32 @@ class AIO(asyncio.Protocol):
|
|||||||
if not AIO.queue:
|
if not AIO.queue:
|
||||||
raise RuntimeError("queue not set")
|
raise RuntimeError("queue not set")
|
||||||
self.logger = logging.getLogger(__name__)
|
self.logger = logging.getLogger(__name__)
|
||||||
|
self.tmpfile = None
|
||||||
|
|
||||||
def _send_response(self, response):
|
def _send_response(self, response):
|
||||||
response = response.encode() + AIO.separator
|
response = response.encode() + AIO.separator
|
||||||
self.logger.debug("{} sending response: {}".format(self.peer, response))
|
self.logger.debug(f"{self.peer} sending response: {response}")
|
||||||
self.transport.write(response)
|
self.transport.write(response)
|
||||||
self.transport.close()
|
self.transport.close()
|
||||||
|
|
||||||
|
|
||||||
def connection_made(self, transport):
|
def connection_made(self, transport):
|
||||||
self.peer = transport.get_extra_info("peername")
|
self.peer = transport.get_extra_info("peername")
|
||||||
self.logger.info("new connection from {}".format(self.peer))
|
self.logger.info(f"new connection from {self.peer}")
|
||||||
self.transport = transport
|
self.transport = transport
|
||||||
self.request_time = str(time.time())
|
self.request_time = str(time.time())
|
||||||
self.buffer = bytearray()
|
self.buffer = bytearray()
|
||||||
self.tmpfile = None
|
self.data = bytearray()
|
||||||
self.fh = None
|
|
||||||
self.fsize = 0
|
|
||||||
self.command = None
|
self.command = None
|
||||||
self.length = None
|
self.length = None
|
||||||
self.all_chunks = False
|
self.all_chunks = False
|
||||||
self.completed = False
|
|
||||||
|
|
||||||
def data_received(self, data):
|
def data_received(self, data):
|
||||||
try:
|
try:
|
||||||
|
nbytes = len(data)
|
||||||
if self.all_chunks:
|
if self.all_chunks:
|
||||||
self.logger.warning("{} received {} bytes of garbage after last chunk".format(self.peer, len(data)))
|
self.logger.warning(f"{self.peer} received {nbytes} bytes of garbage after last chunk")
|
||||||
return
|
return
|
||||||
self.logger.debug("{} received {} bytes".format(self.peer, len(data)))
|
self.logger.debug(f"{self.peer} received {nbytes} bytes")
|
||||||
self.buffer.extend(data)
|
self.buffer.extend(data)
|
||||||
|
|
||||||
if not self.command:
|
if not self.command:
|
||||||
@@ -101,7 +98,7 @@ class AIO(asyncio.Protocol):
|
|||||||
if command != "zINSTREAM":
|
if command != "zINSTREAM":
|
||||||
raise RuntimeError("unknown command")
|
raise RuntimeError("unknown command")
|
||||||
self.command = command
|
self.command = command
|
||||||
self.logger.debug("{} command is {}".format(self.peer, command))
|
self.logger.debug(f"{self.peer} command is {command}")
|
||||||
pos += 1
|
pos += 1
|
||||||
self.buffer = self.buffer[pos:]
|
self.buffer = self.buffer[pos:]
|
||||||
if self.command:
|
if self.command:
|
||||||
@@ -112,74 +109,74 @@ class AIO(asyncio.Protocol):
|
|||||||
self.length = struct.unpack(">I", self.buffer[0:4])[0]
|
self.length = struct.unpack(">I", self.buffer[0:4])[0]
|
||||||
self.buffer = self.buffer[4:]
|
self.buffer = self.buffer[4:]
|
||||||
if self.length == 0:
|
if self.length == 0:
|
||||||
self.logger.debug("{} got all chunks".format(self.peer))
|
|
||||||
self.all_chunks = True
|
self.all_chunks = True
|
||||||
self.fh.close()
|
suffix = str(self.peer[1])
|
||||||
self.fh = None
|
tmpfile = os.path.join(AIO.config["tmpdir"], f"uvscan_{self.request_time}_{suffix}")
|
||||||
AIO.queue.put_nowait((AIO.config["uvscan_path"], self.tmpfile, self.process_uvscan_result))
|
self.logger.debug(f"{self.peer} got last chunk, save data to {tmpfile}")
|
||||||
self.logger.info("{} queued uvscan of {}, queue size is {}".format(self.peer, self.tmpfile, AIO.queue.qsize()))
|
with open(tmpfile, "wb") as f:
|
||||||
|
self.tmpfile = tmpfile
|
||||||
|
f.write(self.data)
|
||||||
|
AIO.queue.put_nowait((AIO.config["uvscan_path"], tmpfile, self.process_uvscan_result))
|
||||||
|
queuesize = AIO.queue.qsize()
|
||||||
|
self.logger.info(f"{self.peer} queued uvscan of {tmpfile}, queue size is {queuesize}")
|
||||||
break
|
break
|
||||||
self.logger.debug("{} chunk size is {} bytes".format(self.peer, self.length))
|
self.logger.debug(f"{self.peer} got chunk size of {self.length} bytes")
|
||||||
else:
|
else:
|
||||||
if len(self.buffer) == 0:
|
if len(self.buffer) < self.length:
|
||||||
|
nbytes = len(self.buffer)
|
||||||
|
self.logger.debug(f"{self.peer} got {nbytes} of {self.length} bytes")
|
||||||
break
|
break
|
||||||
if not self.fh:
|
self.logger.debug(f"{self.peer} chunk complete ({self.length} bytes)")
|
||||||
tmpfile = os.path.join(AIO.config["tmpdir"], "uvscan_{}_{}".format(self.request_time, str(self.peer[1])))
|
self.data.extend(self.buffer[0:self.length])
|
||||||
self.logger.debug("{} saving data to {}".format(self.peer, tmpfile))
|
self.buffer = self.buffer[self.length:]
|
||||||
self.fh = open(tmpfile, "wb")
|
self.length = None
|
||||||
self.tmpfile = tmpfile
|
|
||||||
left = self.length - self.fsize
|
|
||||||
data = self.buffer[0:left]
|
|
||||||
self.fh.write(data)
|
|
||||||
self.buffer = self.buffer[len(data):]
|
|
||||||
self.fsize += len(data)
|
|
||||||
if self.fsize < self.length:
|
|
||||||
self.logger.debug("{} got {} of {} bytes".format(self.peer, self.fsize, self.length))
|
|
||||||
else:
|
|
||||||
self.logger.debug("{} chunk complete ({} bytes)".format(self.peer, self.length))
|
|
||||||
self.length = None
|
|
||||||
self.fsize = 0
|
|
||||||
|
|
||||||
except (RuntimeError, IndexError, IOError, struct.error) as e:
|
except (RuntimeError, IndexError, IOError, struct.error) as e:
|
||||||
self.logger.warning("{} warning: {}".format(self.peer, e))
|
self.logger.warning(f"{self.peer} warning: {e}")
|
||||||
self._send_response(str(e))
|
self._send_response(str(e))
|
||||||
|
|
||||||
def process_uvscan_result(self, result):
|
def process_uvscan_result(self, result):
|
||||||
self.logger.info("{} received uvscan result of {}: {}".format(self.peer, self.tmpfile, result))
|
if not self.tmpfile:
|
||||||
self.completed = True
|
return
|
||||||
|
|
||||||
|
self.logger.info(f"{self.peer} received uvscan result of {self.tmpfile}: {result}")
|
||||||
self._send_response(result)
|
self._send_response(result)
|
||||||
|
self.tmpfile = None
|
||||||
|
|
||||||
def connection_lost(self, exc):
|
def connection_lost(self, exc):
|
||||||
|
if not self.tmpfile:
|
||||||
|
self.logger.info(f"closed connection to {self.peer}")
|
||||||
|
return
|
||||||
|
|
||||||
|
entries = []
|
||||||
|
try:
|
||||||
|
for entry in iter(AIO.queue.get_nowait, None):
|
||||||
|
if not entry:
|
||||||
|
continue
|
||||||
|
if self.tmpfile and entry[1] == self.tmpfile:
|
||||||
|
self.logger.warning(f"{self.peer} client prematurely closed connection, skipping scan of {self.tmpfile}")
|
||||||
|
os.remove(self.tmpfile)
|
||||||
|
self.tmpfile = None
|
||||||
|
continue
|
||||||
|
entries.append(entry)
|
||||||
|
except asyncio.QueueEmpty:
|
||||||
|
pass
|
||||||
|
for entry in entries:
|
||||||
|
AIO.queue.put_nowait(entry)
|
||||||
|
|
||||||
if self.tmpfile:
|
if self.tmpfile:
|
||||||
if not self.completed:
|
self.logger.warning(f"{self.peer} client prematurely closed connection, but scan is already running")
|
||||||
self.logger.warning("{} client prematurely closed connection, removing {} from scan queue".format(self.peer, self.tmpfile))
|
self.tmpfile = None
|
||||||
entries = []
|
|
||||||
try:
|
|
||||||
for entry in iter(AIO.queue.get_nowait, None):
|
|
||||||
if not entry:
|
|
||||||
continue
|
|
||||||
if entry[1] != self.tmpfile:
|
|
||||||
entries.append(entry)
|
|
||||||
except asyncio.QueueEmpty:
|
|
||||||
pass
|
|
||||||
for entry in entries:
|
|
||||||
AIO.queue.put_nowait(entry)
|
|
||||||
self.logger.debug("{} removing temporary file {}".format(self.peer, self.tmpfile))
|
|
||||||
if self.fh:
|
|
||||||
self.fh.close()
|
|
||||||
os.remove(self.tmpfile)
|
|
||||||
self.logger.info("closed connection to {}".format(self.peer))
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
def main():
|
||||||
"Run uvscand."
|
"Run uvscand."
|
||||||
# parse command line
|
# parse command line
|
||||||
parser = argparse.ArgumentParser(description="uvscand daemon",
|
parser = argparse.ArgumentParser(
|
||||||
|
description="uvscand daemon",
|
||||||
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=45, width=140))
|
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=45, width=140))
|
||||||
parser.add_argument("-c", "--config", help="List of config files to read.", nargs="+",
|
parser.add_argument("-c", "--config", help="List of config files to read.", nargs="+", default=["/etc/uvscand.conf"])
|
||||||
default=["/etc/uvscand.conf"])
|
parser.add_argument("-m", "--maxprocs", help="Maximum number of parallel scan processes.", type=int, default=8)
|
||||||
parser.add_argument("-m", "--maxprocs", help="Maximum number of parallel scan processes.",
|
|
||||||
type=int, default=8)
|
|
||||||
parser.add_argument("-d", "--debug", help="Log debugging messages.", action="store_true")
|
parser.add_argument("-d", "--debug", help="Log debugging messages.", action="store_true")
|
||||||
args = parser.parse_args()
|
args = parser.parse_args()
|
||||||
|
|
||||||
@@ -189,8 +186,8 @@ def main():
|
|||||||
syslog_name = logname
|
syslog_name = logname
|
||||||
if args.debug:
|
if args.debug:
|
||||||
loglevel = logging.DEBUG
|
loglevel = logging.DEBUG
|
||||||
logname = "{}[%(name)s]".format(logname)
|
logname = f"{logname}[%(name)s]"
|
||||||
syslog_name = "{}: [%(name)s] %(levelname)s".format(syslog_name)
|
syslog_name = f"{syslog_name}: [%(name)s] %(levelname)s"
|
||||||
|
|
||||||
root_logger = logging.getLogger()
|
root_logger = logging.getLogger()
|
||||||
root_logger.setLevel(loglevel)
|
root_logger.setLevel(loglevel)
|
||||||
@@ -198,14 +195,14 @@ def main():
|
|||||||
# setup console log
|
# setup console log
|
||||||
stdouthandler = logging.StreamHandler(sys.stdout)
|
stdouthandler = logging.StreamHandler(sys.stdout)
|
||||||
stdouthandler.setLevel(loglevel)
|
stdouthandler.setLevel(loglevel)
|
||||||
formatter = logging.Formatter("%(asctime)s {}: [%(levelname)s] %(message)s".format(logname), datefmt="%Y-%m-%d %H:%M:%S")
|
formatter = logging.Formatter(f"%(asctime)s {logname}: [%(levelname)s] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
|
||||||
stdouthandler.setFormatter(formatter)
|
stdouthandler.setFormatter(formatter)
|
||||||
root_logger.addHandler(stdouthandler)
|
root_logger.addHandler(stdouthandler)
|
||||||
|
|
||||||
# setup syslog
|
# setup syslog
|
||||||
sysloghandler = logging.handlers.SysLogHandler(address="/dev/log")
|
sysloghandler = logging.handlers.SysLogHandler(address="/dev/log")
|
||||||
sysloghandler.setLevel(loglevel)
|
sysloghandler.setLevel(loglevel)
|
||||||
formatter = logging.Formatter("{}: %(message)s".format(syslog_name))
|
formatter = logging.Formatter(f"{syslog_name}: %(message)s")
|
||||||
sysloghandler.setFormatter(formatter)
|
sysloghandler.setFormatter(formatter)
|
||||||
root_logger.addHandler(sysloghandler)
|
root_logger.addHandler(sysloghandler)
|
||||||
|
|
||||||
@@ -222,7 +219,7 @@ def main():
|
|||||||
config = dict(parser.items("uvscand"))
|
config = dict(parser.items("uvscand"))
|
||||||
for option in ["bind_address", "bind_port", "tmpdir", "uvscan_path", "loglevel"]:
|
for option in ["bind_address", "bind_port", "tmpdir", "uvscan_path", "loglevel"]:
|
||||||
if option not in config.keys():
|
if option not in config.keys():
|
||||||
logger.error("option '{}' not present in config section 'uvscand'".format(option))
|
logger.error(f"option '{option}' not present in config section 'uvscand'")
|
||||||
sys.exit(1)
|
sys.exit(1)
|
||||||
|
|
||||||
if not args.debug:
|
if not args.debug:
|
||||||
@@ -232,14 +229,14 @@ def main():
|
|||||||
|
|
||||||
# check if uvscan binary exists and is executable
|
# check if uvscan binary exists and is executable
|
||||||
if not os.path.isfile(config["uvscan_path"]) or not os.access(config["uvscan_path"], os.X_OK):
|
if not os.path.isfile(config["uvscan_path"]) or not os.access(config["uvscan_path"], os.X_OK):
|
||||||
logger.error("uvscan binary '{}' does not exist or is not executable".format(config["uvscan_path"]))
|
logger.error(f"uvscan binary '{config['uvscan_path']}' does not exist or is not executable")
|
||||||
sys.exit(1)
|
sys.exit(1)
|
||||||
|
|
||||||
# setup protocol
|
# setup protocol
|
||||||
AIO.config = config
|
AIO.config = config
|
||||||
|
|
||||||
# start uvscan workers
|
# start uvscan workers
|
||||||
loop = asyncio.get_event_loop()
|
loop = asyncio.new_event_loop()
|
||||||
workers = [loop.create_task(uvscan_worker(AIO.queue)) for _ in range(args.maxprocs)]
|
workers = [loop.create_task(uvscan_worker(AIO.queue)) for _ in range(args.maxprocs)]
|
||||||
|
|
||||||
# start server
|
# start server
|
||||||
|
|||||||
Reference in New Issue
Block a user