@@ -1,3 +1,7 @@

+Thu Mar 19 19:25:08 CET 2009 (acab)

+-----------------------------------

+ * clamav-milter: add option LogInfected

+

 Mon Mar 16 20:12:47 CET 2009 (tk)

 ---------------------------------

  * V 0.95rc2

@@ -54,12 +54,20 @@ static char *rejectfmt = NULL;

 int addxvirus = 0;

 char xvirushdr[255];

+enum {

+    LOGINF_NONE,

+    LOGINF_BASIC,

+    LOGINF_FULL

+} loginfected;

 #define CLAMFIBUFSZ 1424

 struct CLAMFI {

     char buffer[CLAMFIBUFSZ];

     const char *virusname;

+    char *msg_subj;

+    char *msg_date;

+    char *msg_id;

     int local;

     int main;

     int alt;

@@ -83,11 +91,22 @@ enum CFWHAT {

 };

+void makesanehdr(char *hdr) {

+    while(*hdr) {

+	if(*hdr=='\'' || *hdr=='\t' || *hdr=='\r' || *hdr=='\n' || !isprint(*hdr))

+	    *hdr = ' ';

+	hdr++;

+    }

+}

+

 static void nullify(SMFICTX *ctx, struct CLAMFI *cf, enum CFWHAT closewhat) {

     if(closewhat & CF_MAIN || ((closewhat & CF_ANY) && cf->main >= 0))

 	close(cf->main);

     if(closewhat & CF_ALT || ((closewhat & CF_ANY) && cf->alt >= 0))

 	close(cf->alt);

+    if(cf->msg_subj) free(cf->msg_subj);

+    if(cf->msg_date) free(cf->msg_date);

+    if(cf->msg_id) free(cf->msg_id);

     smfi_setpriv(ctx, NULL);

     free(cf);

 }

@@ -147,6 +166,15 @@ sfsistat clamfi_header(SMFICTX *ctx, char *headerf, char *headerv) {

     if(!(cf = (struct CLAMFI *)smfi_getpriv(ctx)))

 	return SMFIS_CONTINUE; /* whatever */

+    if(loginfected == LOGINF_FULL) {

+	if(headerf && !strcasecmp(headerf, "Subject") && !cf->msg_subj)

+	    cf->msg_subj = strdup(headerv);

+	if(headerf && !strcasecmp(headerf, "Date") && !cf->msg_date)

+	    cf->msg_date = strdup(headerv);

+	if(headerf && !strcasecmp(headerf, "Message-ID") && !cf->msg_id)

+	    cf->msg_id = strdup(headerv);

+    }

+

     if(!cf->totsz) {

 	if(cf->all_whitelisted) {

 	    logg("*Skipping scan (all destinations whitelisted)\n");

@@ -239,7 +267,7 @@ sfsistat clamfi_eom(SMFICTX *ctx) {

 	ret = CleanAction(ctx);

     } else if (len>7 && !strcmp(reply + len - 7, " FOUND\n")) {

 	cf->virusname = NULL;

-	if(addxvirus || rejectfmt) {

+	if(loginfected || addxvirus || rejectfmt) {

 	    char *vir;

 	    reply[len-7] = '\0';

@@ -247,14 +275,31 @@ sfsistat clamfi_eom(SMFICTX *ctx) {

 	    if(vir) {

 		vir++;

-		if(rejectfmt) {

+		if(rejectfmt)

 		    cf->virusname = vir;

-		} else {

+

+		if(addxvirus) {

 		    char msg[255];

 		    snprintf(msg, sizeof(msg), "Infected (%s)", vir);

 		    msg[sizeof(msg)-1] = '\0';

 		    add_x_header(ctx, msg);

 		}

+

+		if(loginfected) {

+		    const char *from = smfi_getsymval(ctx, "{mail_addr}"), *to = smfi_getsymval(ctx, "{rcpt_addr}");

+		    

+		    if(!from) from = "UNKNOWN";

+		    if(!to) to = "UNKNOWN";

+		    

+		    if(loginfected == LOGINF_FULL) {

+			const char *id = smfi_getsymval(ctx, "{i}");

+

+			makesanehdr(cf->msg_subj);

+			makesanehdr(cf->msg_date);

+			makesanehdr(cf->msg_id);

+			logg("~Message %s from <%s> to <%s> with subject '%s' message-id '%s' date '%s' infected by %s\n", id ? id : "UNKNOWN", from, to, cf->msg_subj, cf->msg_id, cf->msg_date, vir);

+		    } else logg("~Message from <%s> to <%s> infected by %s\n", from, to, vir);

+		}

 	    }

 	}

 	ret = InfectedAction(ctx);

@@ -345,6 +390,17 @@ static sfsistat action_reject_msg(SMFICTX *ctx) {

 int init_actions(struct optstruct *opts) {

     const struct optstruct *opt;

+    if(!(opt = optget(opts, "LogInfected"))->enabled || !strcasecmp(opt->strarg, "Off"))

+	loginfected = LOGINF_NONE;

+    else if(!strcasecmp(opt->strarg, "Basic"))

+	loginfected = LOGINF_BASIC;

+    else if(!strcasecmp(opt->strarg, "Full"))

+	loginfected = LOGINF_FULL;

+    else {

+	logg("!Invalid setting %s for option LogInfected\n", opt->strarg);

+	return 1;

+    }

+

     if((opt = optget(opts, "OnFail"))->enabled) {

 	switch(parse_action(opt->strarg)) {

 	case 0:

@@ -462,6 +518,7 @@ sfsistat clamfi_envfrom(SMFICTX *ctx, char **argv) {

     cf->bufsz = 0;

     cf->main = cf->alt = -1;

     cf->all_whitelisted = 1;

+    cf->msg_subj = cf->msg_date = cf->msg_id = NULL;

     smfi_setpriv(ctx, (void *)cf);

     return SMFIS_CONTINUE;

@@ -474,7 +531,8 @@ sfsistat clamfi_envrcpt(SMFICTX *ctx, char **argv) {

     if(!(cf = (struct CLAMFI *)smfi_getpriv(ctx)))

 	return SMFIS_CONTINUE; /* whatever */

-    cf->all_whitelisted &= whitelisted(argv[0], 0);

+    if(cf->all_whitelisted)

+	cf->all_whitelisted &= whitelisted(argv[0], 0);

     return SMFIS_CONTINUE;

 }

@@ -206,13 +206,21 @@ Example

 # Default: no

 #LogVerbose yes

+# This option allows to tune what is logged when a message is infected.

+# Possible values are Off (the default - nothing is logged),

+# Basic (minimal info logged), Full (verbose info logged)

+#

+# Default: disabled

+#LogInfected Basic

+

 ##

 ## Limits

 ##

 # Messages larger than this value won't be scanned.

-# Make sure this value is lower than StreamMaxLength in clamd.conf

+# Make sure this value is lower or equal than StreamMaxLength in clamd.conf

+#

 # Default: 25M

 #MaxFileSize 10M

@@ -384,6 +384,8 @@ const struct clam_option clam_options[] = {

     { "Whitelist", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "This option specifies a file which contains a list of POSIX regular\nexpressions. Addresses (sent to or from - see below) matching these regexes\nwill not be scanned.  Optionally each line can start with the string \"From:\"\nor \"To:\" (note: no whitespace after the colon) indicating if it is,\nrespectively, the sender or recipient that is to be whitelisted.\nIf the field is missing, \"To:\" is assumed.\nLines starting with #, : or ! are ignored.", "/etc/whitelisted_addresses" },

+    { "LogInfected", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "This option allows to tune what is logged when a message is infected.\nPossible values are Off (the default - nothing is logged),\nBasic (minimal info logged), Full (verbose info logged)", "Basic" },

+

     /* Deprecated milter options */

     { "ArchiveBlockEncrypted", NULL, 0, TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_MILTER | OPT_DEPRECATED, "", "" },