bin/pmg-smtp-filter

   1 #!/usr/bin/perl
   2
   3 use strict;
   4 use warnings;
   5
   6 use Carp;
   7 use Getopt::Long;
   8 use Time::HiRes qw (gettimeofday tv_interval);
   9 use POSIX qw(:sys_wait_h errno_h signal_h);
  10
  11 use MIME::Parser;
  12 use File::Path;
  13 use Net::Server::PreFork;
  14 use Net::Server::SIG qw(register_sig check_sigs);
  15 use Fcntl ':flock';
  16 use File::Basename;
  17 use Xdgmime;
  18
  19 use PVE::SafeSyslog;
  20 use PVE::ProcFSTools;
  21 use PVE::INotify;
  22
  23 use Mail::SpamAssassin;
  24 use Mail::SpamAssassin::NetSet;
  25
  26 use PMG::pmgcfg;
  27 use PMG::Utils;
  28 use PMG::Cluster;
  29
  30 use PMG::DBTools;
  31 use PMG::RuleDB;
  32 use PMG::RuleCache;
  33 use PMG::ModGroup;
  34 use PMG::AtomicFile;
  35 use PMG::LDAPSet;
  36 use PMG::Config;
  37 use PMG::MailQueue;
  38
  39 use Proxmox::SMTP;
  40 use Proxmox::Unpack;
  41
  42 use base qw(Net::Server::PreFork);
  43
  44 my $opt_commandline = [$0, @ARGV];
  45 my $opt_max_dequeue = 1;
  46 my $opt_dequeue_time = 60*2;
  47
  48 my $opt_ext_port = 10024;
  49 my $opt_int_port = 10023;
  50 my $opt_inject_port = 10025;
  51
  52 my $opt_testmode;
  53 my $opt_untrusted;
  54 my $opt_pidfile;
  55 my $opt_database;
  56
  57 initlog ('proxprox', 'mail');
  58
  59 if (!GetOptions ('testmode=s' => \$opt_testmode,
  60                  'pidfile=s' => \$opt_pidfile,
  61                  'untrusted' => \$opt_untrusted,
  62                  'database=s' => \$opt_database)) {
  63     die "usage error\n";
  64     exit (-1);
  65 }
  66
  67 $opt_pidfile = "/var/run/proxprox.pid" if !$opt_pidfile;
  68
  69 my $max_servers = 1;
  70 my $min_servers = 1;
  71 my $min_spare_servers = 0;
  72 my $max_spare_servers = 0;
  73 my $max_requests = 1;
  74
  75 if (!$opt_testmode) {
  76
  77     my $pmg_cfg = PMG::Config->new();
  78
  79     my $demo = $pmg_cfg->get('administration', 'demo');
  80
  81     if ($demo) {
  82         syslog ('info', 'demo mode detected - not starting server');
  83         exit (0);
  84     }
  85
  86     $max_servers = $pmg_cfg->get('mail', 'max_filters') + 2;
  87     $min_servers = 2;
  88     $min_spare_servers = 1;
  89     $max_spare_servers = 4;
  90     $max_requests = 20;
  91 }
  92
  93 $opt_max_dequeue = 0 if $opt_testmode;
  94
  95 my $daemonize = 1;
  96 if (defined ($ENV{BOUND_SOCKETS})) {
  97     $daemonize = undef;
  98 }
  99
 100 my $server_attr = {
 101     port => [ $opt_int_port, $opt_ext_port ],
 102     host => '127.0.0.1',
 103     min_servers => $min_servers,
 104     max_servers => $max_servers,
 105     min_spare_servers => $min_spare_servers,
 106     max_spare_servers => $max_spare_servers,
 107     max_requests => $max_requests,
 108     serialize => 'flock',
 109     max_dequeue => $opt_max_dequeue,
 110     check_for_dequeue => $opt_dequeue_time,
 111     log_level => 3,
 112     pid_file => $opt_pidfile,
 113     no_close_by_child => 1,
 114     no_client_stdout => 1,
 115     commandline => $opt_commandline,
 116 };
 117
 118 $server_attr->{setsid} = $daemonize if !$opt_testmode;
 119
 120 my $database;
 121
 122 if (defined($opt_database)) {
 123     $database = $opt_database;
 124 } else {
 125     $database = $opt_testmode ? "Proxmox_testdb" : "Proxmox_ruledb";
 126 }
 127
 128 $SIG{'__WARN__'} = sub {
 129     my $err = $@;
 130     my $t = $_[0];
 131     chomp $t;
 132     syslog('warning', "WARNING: %s", $t);
 133     $@ = $err;
 134 };
 135
 136 sub get_prox_vars {
 137     my ($self, $queue, $entity, $msginfo, $rule, $targets, $spaminfo) = @_;
 138
 139     $spaminfo = {
 140         sa_score => $queue->{sa_score},
 141         sa_hits => $queue->{sa_hits},
 142         sa_data => $queue->{sa_data},
 143         sa_max => $queue->{sa_max}
 144     } if !$spaminfo;
 145
 146     my $vars = {
 147         'SUBJECT' => $entity->head->get ('subject', 0) || 'No Subject',
 148         'RULE' => $rule->{name},
 149         'RULE_INFO' => $msginfo->{rule_info},
 150         'SENDER' => $msginfo->{sender},
 151         'SENDER_IP' => $msginfo->{xforward}->{addr},
 152         'TARGETS' => join (', ', @$targets),
 153         'RECEIVERS' => join (', ', @{$msginfo->{targets}}),
 154         'SPAMLEVEL' => $spaminfo->{sa_score},
 155         'SPAMSTARS' => '*' x (($spaminfo->{sa_score} || 0) > 100 ? 100 : $spaminfo->{sa_score} || 0),
 156         'ADMIN' =>  $self->{pmg_cfg}->get('administration', 'email'),
 157         'HOST' =>  $msginfo->{hostname},
 158         'DOMAIN' =>  $msginfo->{domain},
 159         'FQDN' => $msginfo->{fqdn},
 160         'MSGID' => $queue->{msgid},
 161         'VERSION' => PMG::pmgcfg::package() . "/" . PMG::pmgcfg::version() . "/" . PMG::pmgcfg::repoid(),
 162     };
 163
 164     $vars->{__spaminfo} = $spaminfo;
 165
 166     if ($opt_testmode) {
 167         if ($queue->{vinfo_avira} || $queue->{vinfo_clam} || $queue->{vinfo_commtouch}) {
 168             $vars->{'VIRUS_INFO'} = "Virus Info:";
 169             $vars->{'VIRUS_INFO'} .= " clam: $queue->{vinfo_clam}" if $queue->{vinfo_clam};
 170             $vars->{'VIRUS_INFO'} .= " avira: $queue->{vinfo_avira}" if $queue->{vinfo_avira};
 171             $vars->{'VIRUS_INFO'} .= " commtouch: $queue->{vinfo_commtouch}" if $queue->{vinfo_commtouch};
 172         } else {
 173             $vars->{'VIRUS_INFO'} = '';
 174         }
 175     } else {
 176         if ($queue->{vinfo}) {
 177             $vars->{'VIRUS_INFO'} = "Virus Info: $queue->{vinfo}\n";
 178         } else {
 179             $vars->{'VIRUS_INFO'} = '';
 180         }
 181     }
 182
 183     $vars->{'SPAM_HITS'} = $spaminfo->{sa_hits};
 184
 185     $vars->{'SPAM_INFO'} = '';
 186     my $sscores = $spaminfo->{sa_data};
 187
 188     if (defined ($sscores) && @$sscores != -1) {
 189         my $sa_text;
 190         if ($opt_testmode) {
 191             $sa_text = "Spam detection results:  100\n";
 192         } else {
 193             $sa_text = "Spam detection results:  $spaminfo->{sa_score}\n";
 194         }
 195
 196         foreach my $s (@$sscores) {
 197             if ($opt_testmode) {
 198                 $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
 199                                      1, $s->{desc} || '-');
 200             } else {
 201                 $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
 202                                      $s->{score}, $s->{desc} || '-');
 203             }
 204         }
 205         $vars->{'SPAM_INFO'} = $sa_text;
 206     }
 207
 208     if ($opt_testmode) {
 209         delete ($vars->{'ADMIN'});
 210         #delete ($vars->{'SPAM_INFO'});
 211     }
 212
 213     return $vars;
 214 }
 215
 216 sub apply_rules {
 217     my ($self, $queue, $msginfo, $entity, $ldap) = @_;
 218
 219     my $final;
 220     my %rule_targets;
 221     my %rule_actions;
 222     my %rule_marks;
 223     my $matching_rules = [];
 224
 225     my $rulecache = $self->{rulecache};
 226     my $rules = $rulecache->rules ();
 227     my $dbh = $self->{ruledb}->{dbh};
 228
 229     # first, we remove all conditional written 'X-' header attributes
 230     foreach my $rule (@$rules) {
 231         next if !$rule->{active};
 232         next if ($rule->{direction} == 0) &&  $msginfo->{trusted};
 233         next if ($rule->{direction} == 1) &&  !$msginfo->{trusted};
 234
 235         my $actions = $rulecache->get_actions ($rule->{id});
 236         if ($actions) {
 237             foreach my $action (@$actions) {
 238                 if ($action->isa ("Proxmox::RuleDB::ModField")) {
 239                     my $fname = $action->{field};
 240                     next if $fname !~ m/^X-/i;
 241                     $entity->head->delete($fname);
 242                 }
 243             }
 244         }
 245     }
 246
 247     foreach my $rule (@$rules) {
 248         next if !$rule->{active};
 249         next if ($rule->{direction} == 0) &&  $msginfo->{trusted};
 250         next if ($rule->{direction} == 1) &&  !$msginfo->{trusted};
 251
 252         # match from, when and what classes (not target dependent)
 253         if (!($rulecache->from_match ($rule->{id}, $msginfo->{sender}, $msginfo->{xforward}->{addr}, $ldap) &&
 254               $rulecache->when_match ($rule->{id}, time))) {
 255             next;
 256         }
 257
 258         $rule_marks{$rule->{id}} =
 259             $rulecache->what_match ($rule->{id}, $queue, $entity, $msginfo, $dbh);
 260
 261         $rule_actions{$rule->{id}} = $rulecache->get_actions ($rule->{id});
 262         my $fin = $rulecache->final ($rule->{id});
 263
 264         # match targets
 265         foreach my $target (@{$msginfo->{targets}}) {
 266             next if $final->{$target};
 267             next if !defined ($rule_marks{$rule->{id}});
 268             next if !defined ($rule_marks{$rule->{id}}->{$target});
 269             next if !defined ($rule_marks{$rule->{id}}->{$target}->{marks});
 270             next if !$rulecache->to_match ($rule->{id}, $target, $ldap);
 271
 272             $final->{$target} = $fin;
 273
 274             push @{$rule_targets{$rule->{id}}}, $target;
 275         }
 276     }
 277
 278     # Compute rule_info (summary about matching rule)
 279     # this can be used for debugging
 280     my $rule_info = "";
 281     foreach my $rule (@$rules) {
 282         next if !$rule_targets{$rule->{id}};
 283
 284         push @$matching_rules, $rule->{id};
 285
 286         $rule_info .= "Rule: $rule->{name}\n";
 287
 288         foreach my $target (@{$rule_targets{$rule->{id}}}) {
 289             $rule_info .= "  Receiver: $target\n";
 290         }
 291         foreach my $action (@{$rule_actions{$rule->{id}}}) {
 292             $rule_info .= "  Action: " . $action->short_desc () . "\n";
 293         }
 294
 295     }
 296     $msginfo->{rule_info} = $rule_info;
 297
 298     if ($msginfo->{testmode}) {
 299         my $vars = $self->get_prox_vars ($queue, $entity, $msginfo, undef, [], undef);
 300         my $out = "__RULE_INFO__";
 301         $out = PMG::Utils::subst_values ($out, $vars);
 302         my $fh = $msginfo->{test_fh};
 303         print $fh $out;
 304     }
 305
 306     # apply actions
 307
 308     my $mod_group = PMG::ModGroup->new($entity, $msginfo->{targets});
 309
 310     foreach my $rule (@$rules) {
 311         my $targets = $rule_targets{$rule->{id}};
 312         next if !$targets;
 313
 314         my $spaminfo;
 315         foreach my $t (@$targets) {
 316             if ($rule_marks{$rule->{id}}->{$t} && $rule_marks{$rule->{id}}->{$t}->{spaminfo}) {
 317                 $spaminfo = $rule_marks{$rule->{id}}->{$t}->{spaminfo};
 318                 # we assume spam info is the same for all matching targets
 319                 last;
 320             }
 321         }
 322
 323         my $vars = $self->get_prox_vars ($queue, $entity, $msginfo, $rule,
 324                                          $rule_targets{$rule->{id}}, $spaminfo);
 325
 326
 327         my @sorted_actions =
 328             sort {$a->priority <=> $b->priority} @{$rule_actions{$rule->{id}}};
 329
 330         foreach my $action (@sorted_actions) {
 331             $action->execute ($queue, $self->{ruledb}, $mod_group,
 332                               $rule_targets{$rule->{id}},
 333                               $msginfo, $vars, $rule_marks{$rule->{id}}->{marks}, $ldap);
 334             last if $action->final;
 335         }
 336     }
 337
 338     # we deliver all mail not matched by any rule
 339     # (default action = accept)
 340     my $unmatched;
 341     foreach my $target (@{$msginfo->{targets}}) {
 342         next if $final->{$target};
 343
 344         push @$unmatched, $target;
 345     }
 346
 347     if ($unmatched) {
 348         my $accept = Proxmox::RuleDB::Accept->new ();
 349         $accept->execute ($queue, $self->{ruledb}, $mod_group, $unmatched,
 350                           $msginfo, undef, undef, undef);
 351     }
 352
 353     return $matching_rules;
 354 }
 355
 356 # reload ruledb and pmg config
 357 sub load_config {
 358     my $self = shift;
 359     my $prop = $self->{server};
 360
 361     if ($self->{ruledb}) {
 362         $self->log (0, "reloading configuration $database");
 363         $self->{ruledb}->close ();
 364     }
 365
 366     $self->{pmg_cfg} = PMG::Config->new();
 367     $self->{cinfo} = PVE::INotify::read_file("cluster.conf");
 368
 369     eval {
 370         my $dbh = PMG::DBTools::open_ruledb ($database);
 371         $self->{ruledb} = PMG::RuleDB->new ($dbh);
 372
 373         # load rulecache
 374         $self->{rulecache} = PMG::RuleCache->new ($self->{ruledb});
 375     };
 376
 377     my $err = $@;
 378
 379     if ($err) {
 380         sleep (10); # reduce restart rate when postgres is down
 381         die $err;
 382     }
 383
 384     # create LDAP object
 385     $self->{ldap} = PMG::LDAPSet->new_from_pmg_cfg($self->{pmg_cfg}, 1);
 386
 387     $self->{reload_config} = 0;
 388 }
 389
 390 my $syslog_map = {
 391     0 => 'err',
 392     1 => 'warning',
 393     2 => 'notice',
 394     3 => 'info',
 395     4 => 'debug'
 396 };
 397
 398 sub log {
 399     my ($self, $level, $msg, @therest) = @_;
 400     my $prop = $self->{server};
 401
 402     return if $level =~ /^\d+$/ && $level > $prop->{log_level};
 403
 404     $level = $syslog_map->{$level} || $level;
 405     if (@therest) {
 406         syslog($level, $msg, @therest);
 407     } else {
 408         syslog ($level, $msg);
 409     }
 410 }
 411
 412 sub pre_loop_hook {
 413     my $self = shift;
 414     my $prop = $self->{server};
 415
 416     $prop->{log_level} = 3;
 417
 418     $self->log (0, "Filter daemon (re)started (max. $max_servers processes)");
 419
 420     eval {  Proxmox::MailQueue::cleanup_active(); };
 421     $self->log (0, "Cleanup failures: $@") if $@;
 422
 423     my $sig_set = POSIX::SigSet->new;
 424     $sig_set->addset (&POSIX::SIGHUP);
 425     $sig_set->addset (&POSIX::SIGCHLD);
 426     my $old_sig_set = POSIX::SigSet->new();
 427
 428     sigprocmask (SIG_UNBLOCK, $sig_set, $old_sig_set);
 429
 430     my ($backup_umask) = umask;
 431
 432     my $pmg_cfg = PMG::Config->new();
 433
 434     # Note: you need to restart the daemon when you change 'rbl_checks'
 435     my $rbl_checks = $pmg_cfg->get('spam', 'rbl_checks');
 436
 437     $self->{sa} = Mail::SpamAssassin->new ({
 438         debug => 0,
 439         local_tests_only => $opt_testmode || !$rbl_checks,
 440         home_dir_for_helpers => '/root',
 441         userstate_dir => '/root/.spamassassin',
 442         dont_copy_prefs   => 1,
 443         stop_at_threshold => 0,
 444     });
 445
 446     $self->{sa}->compile_now;
 447
 448     alarm (0); # SA forgets to clear alarm in some cases
 449     umask ($backup_umask);
 450     initlog ('proxprox', 'mail');
 451
 452     $SIG{'USR1'} = sub {
 453         # reloading server configuration
 454         if (defined $prop->{children}) {
 455             foreach my $pid (keys %{$prop->{children}}) {
 456                 kill (10, $pid); # SIGUSR1 childs
 457             }
 458         }
 459     }
 460 }
 461
 462 sub child_init_hook {
 463     my $self = shift;
 464
 465     $0 = 'proxprox child';
 466
 467     # $self->log (3, "init child");
 468
 469     eval {
 470         $self->load_config ();
 471     };
 472
 473     if ($@) {
 474         $self->log (0, $@);
 475         $self->child_finish_hook;
 476         exit;
 477     }
 478
 479     $SIG{'USR1'} = sub {
 480         $self->{reload_config} = 1;
 481     }
 482 }
 483
 484 sub child_finish_hook {
 485     my $self = shift;
 486
 487     # $self->log (3, "finish child");
 488     $self->{ruledb}->close () if $self->{ruledb};
 489 }
 490
 491 sub run_dequeue {
 492     my $self = shift;
 493
 494     # do database maintainance here
 495
 496     $self->log (2, "starting database maintainance");
 497
 498     my ($csec, $usec) = gettimeofday ();
 499
 500     my $cinfo = PVE::INotify::read_file("cluster.conf");
 501
 502     my $dbh;
 503
 504     eval {
 505         $dbh = PMG::DBTools::open_ruledb($database);
 506     };
 507     my $err = $@;
 508
 509     if ($err) {
 510         $self->log (0, msgquote("ERROR: $err"));
 511         return;
 512     }
 513
 514     eval {
 515         Proxmox::Statistic::update_stats($dbh, $cinfo);
 516     };
 517     $err = $@;
 518
 519     my ($csec_end, $usec_end) = gettimeofday ();
 520     my $ptime = int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 521
 522     if ($err) {
 523         $self->log (0, msgquote($err));
 524     } else {
 525         $self->log (2, "end database maintainance ($ptime ms)");
 526     }
 527
 528     $dbh->disconnect() if $dbh;
 529 }
 530
 531
 532 sub unpack_entity {
 533     my ($self, $unpack, $entity, $msginfo, $queue) = @_;
 534
 535     my $magic;
 536     my $path;
 537
 538     if (($magic = $entity->{PMX_magic_ct}) &&
 539         ($path = $entity->{PMX_decoded_path})) {
 540
 541         my $filename = basename ($path);
 542
 543         if (Proxmox::Unpack::is_archive ($magic)) {
 544             $self->log (3, "$queue->{logid}: found archive '$filename' ($magic)");
 545
 546             my $start = [gettimeofday];
 547
 548             $unpack->{mime} = {};
 549
 550             eval {
 551                 $unpack->unpack_archive ($path, $magic);
 552             };
 553
 554             $self->log (3, "$queue->{logid}: unpack failed - $@") if $@;
 555
 556             $entity->{PMX_content_types} = $unpack->{mime};
 557
 558             if ($opt_testmode) {
 559                 my $types = join (", ", sort keys (%{$entity->{PMX_content_types}}));
 560                 my $fh = $msginfo->{test_fh};
 561                 $filename =~ s/\d+/X/g if $filename =~ m/^msg-\d+-\d+.msg/;
 562                 print $fh "Types:$filename: $types\n" if $types;
 563             }
 564
 565             my $elapsed = int(tv_interval ($start) * 1000);
 566
 567             $self->log (3, "$queue->{logid}: unpack archive '$filename' done ($elapsed ms)");
 568         }
 569     }
 570
 571     foreach my $part ($entity->parts)  {
 572         $self->unpack_entity ($unpack, $part, $msginfo, $queue);
 573     }
 574
 575 }
 576
 577 sub handle_smtp {
 578     my ($self, $smtp) = @_;
 579
 580     my ($csec, $usec) = gettimeofday ();
 581
 582     my $queue;
 583     my $msginfo = {};
 584     my $pmg_cfg = $self->{pmg_cfg};
 585     my $ldap = $self->{ldap};
 586     my $cinfo = $self->{cinfo};
 587     my $lcid = $cinfo->{local}->{cid};
 588
 589     $msginfo->{test_fh} = PMG::AtomicFile->new("testresult.out", "w")
 590         if $opt_testmode;
 591
 592     $msginfo->{trusted} = $self->{trusted};
 593
 594
 595 # PHASE 1 - save incoming mail (already done)
 596 # on error: exit
 597
 598     $queue = $smtp->{queue};
 599     $queue->{sa} = $self->{sa};
 600
 601     $queue->{lic_valid} = 1;
 602
 603     my $matching_rules;
 604
 605     eval {
 606         $msginfo->{testmode} = $opt_testmode;
 607         $msginfo->{sender} = $smtp->{from};
 608         $msginfo->{xforward} = $smtp->{xforward};
 609         $msginfo->{targets} = $smtp->{to};
 610
 611         $msginfo->{hostname} = PVE::INotify::nodename();
 612         my $resolv = PVE::INotify::read_file('resolvconf');
 613
 614         $msginfo->{domain} = $resolv->{search};
 615         $msginfo->{fqdn} = "$msginfo->{hostname}.$msginfo->{domain}";
 616         $msginfo->{lcid} = $lcid;
 617
 618         # $msginfo->{targets} is case sensitive,
 619         # but pmail is always lower case!
 620
 621         foreach my $t (@{$msginfo->{targets}}) {
 622             my $res;
 623             if ($ldap && ($res = $ldap->account_info ($t))) {
 624                 $msginfo->{pmail}->{$t} = $res->{pmail};
 625             } else {
 626                 $msginfo->{pmail}->{$t} = lc ($t);
 627             }
 628         }
 629
 630 # PHASE 2 - parse mail
 631 # on error: exit
 632
 633         my $maxfiles = $pmg_cfg->get('clamav', 'archivemaxfiles');
 634
 635         my $entity = $queue->parse_mail($maxfiles);
 636
 637         $self->log (3, "$queue->{logid}: new mail message-id=%s", $queue->{msgid});
 638
 639 # PHASE 3 - run external content analyzers
 640 # (SPAM analyzer is run on demand later)
 641 # on error: log error messages
 642
 643
 644         # test for virus first
 645         $queue->{vinfo} = PMG::Utils::analyze_virus(
 646             $queue, $queue->{dataname}, $pmg_cfg, $opt_testmode);
 647
 648         # commtouch scanner
 649         # only run with valid license
 650         # do not run when we already detected a virus
 651         # do not run for outbound mail (requires separate ctasd)
 652
 653         $queue->{ptime_commtouch} = 0;
 654
 655         if ($opt_testmode ||
 656             ($queue->{lic_valid} && !$queue->{vinfo} && !$msginfo->{trusted})) {
 657             my ($ct_refid, $ct_spam, $ct_vod, $ct_virus);
 658             my ($csec, $usec) = gettimeofday ();
 659             eval {
 660
 661                 ($ct_refid, $ct_spam, $ct_vod, $ct_virus) =
 662                     Proxmox::Commtouch::ctasd_classify($queue->{dataname}, $queue->{from});
 663             };
 664             my $err = $@;
 665
 666             my ($csec_end, $usec_end) = gettimeofday ();
 667             $queue->{ptime_commtouch} =
 668                 int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 669
 670             if ($err) {
 671                 syslog ('err', "ctasd error: %s", $err);
 672                 $queue->{errors} = 1;
 673             } else {
 674                 if ($ct_virus) {
 675                     syslog ('info', "$queue->{logid}: virus detected: $ct_virus (commtouch)");
 676                     $queue->{vinfo_commtouch} = $ct_virus;
 677                     $queue->{vinfo} = "$ct_virus (commtouch)";
 678                 }
 679
 680                 if ($ct_spam && $ct_spam eq 'Confirmed') {
 681                     syslog ('info', "$queue->{logid}: known spam mail (confirmed by commtouch)");
 682                 }
 683
 684                 $queue->{commtouch_spam} = $ct_spam;
 685                 $queue->{commtouch_vod} = $ct_vod;
 686
 687                 if ($opt_testmode) {
 688                     $queue->{commtouch_refid} = "FAKEK_COMTOUCH_REFID(testmode)";
 689                 } else {
 690                     $queue->{commtouch_refid} = $ct_refid;
 691                 }
 692             }
 693         }
 694
 695         # always add this headers to incoming mails
 696         # to enable user to report false negatives
 697         if (!$msginfo->{trusted}) {
 698             if (!$queue->{lic_valid}) {
 699                 $entity->head->replace('X-Proxmox-License', 'Invalid');
 700             }
 701
 702             if ($queue->{vinfo}) {
 703                 $entity->head->replace('X-Proxmox-VInfo', $queue->{vinfo});
 704             }
 705
 706             if ($queue->{commtouch_refid}) {
 707                 $entity->head->replace('X-Proxmox-CTCH-Refid', $queue->{commtouch_refid});
 708             }
 709         }
 710
 711         # we unpack after virus scanning, because this is more secure.
 712         # This way virus scanners gets the whole mail files and are able
 713         # to detect phishing signature for example - which would not work
 714         # if we decompose first and only analyze the decomposed attachments.
 715         # Disadvantage is that we need to unpack more than
 716         # once (bad performance).
 717
 718         # should we scan content types inside archives
 719
 720
 721         my $rulecache = $self->{rulecache};
 722
 723         my $scan_archives = 0;
 724
 725         if (($rulecache->{archivefilter_in} && !$msginfo->{trusted}) ||
 726             ($rulecache->{archivefilter_out} && $msginfo->{trusted})) {
 727             $scan_archives = 1;
 728         }
 729
 730         if ($scan_archives && !$queue->{vinfo}) {
 731
 732             # unpack all archives - determine contained content types
 733
 734             my $decdir = $queue->{dumpdir} . "/__decoded_archives";
 735             mkdir $decdir;
 736
 737             my $start = [gettimeofday];
 738
 739             my $unpack;
 740             eval {
 741
 742                 # limits: We use clamav limit for maxfiles, and scan
 743                 # only 4 levels, timeout of 30 seconds
 744
 745                 $unpack = Proxmox::Unpack->new (tmpdir => $decdir,
 746                                                 timeout => 30,
 747                                                 ctonly => 1, # only detect CTs
 748                                                 maxrec => -4,
 749                                                 maxfiles => $maxfiles);
 750
 751                 $self->unpack_entity ($unpack, $entity, $msginfo, $queue);
 752             };
 753
 754             my $err = $@;
 755
 756             $unpack->cleanup() if $unpack;
 757
 758             my $elapsed = int(tv_interval ($start) * 1000);
 759
 760             if ($err) {
 761                 $self->log (3, "$queue->{logid}: unpack archive failed ($elapsed ms) - $err");
 762             }
 763         }
 764
 765 # PHASE 4 - apply rules
 766 # on error: exit (cleanup process should do the rest)
 767         $msginfo->{maxspamsize} = $pmg_cfg->get('spam', 'maxspamsize');
 768         if ($msginfo->{maxspamsize} <= 1024*64) {
 769             $msginfo->{maxspamsize} = 1024*64;
 770         }
 771
 772         if ($msginfo->{trusted}) {
 773             my $hide = $pmg_cfg->get('mail', 'hide_received');
 774             $entity->head->delete("Received") if $hide;
 775         }
 776
 777         $matching_rules = $self->apply_rules($queue, $msginfo, $entity, $ldap);
 778     };
 779
 780     my $err = $@;
 781
 782     $self->{errors} = $queue->{errors};
 783
 784     # restart on error
 785     $self->{errors} = 1 if $err;
 786
 787     $queue->close ();
 788
 789     die $err if $err;
 790
 791     my ($csec_end, $usec_end) = gettimeofday ();
 792     my $time_total =
 793         int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 794
 795 # PHASE 5 - log statistics
 796 # on error: log error messages
 797
 798     eval {
 799         my $dbh = $self->{ruledb}->{dbh};
 800         my $where = "";
 801         foreach my $rid (@$matching_rules) {
 802             $where .= $where ? " OR ID = $rid" : "ID = $rid";
 803         }
 804         if ($where) {
 805             $dbh->do ("UPDATE Rule " .
 806                       "SET Count = Count + 1 " .
 807                       "WHERE $where");
 808         }
 809
 810         my $insert_cmds = "SELECT nextval ('cstatistic_id_seq');INSERT INTO CStatistic " .
 811             "(CID, RID, ID, Time, Bytes, Direction, Spamlevel, VirusInfo, PTime, Sender) VALUES (" .
 812             "$lcid, currval ('cstatistic_id_seq'), currval ('cstatistic_id_seq'),";
 813
 814         $insert_cmds .= $queue->{rtime} . ',';
 815         $insert_cmds .= $queue->{bytes} . ',';
 816         $insert_cmds .= $dbh->quote ($msginfo->{trusted} ? 0 : 1) . ',';
 817         $insert_cmds .= ($queue->{sa_score} || 0) . ',';
 818         $insert_cmds .= $dbh->quote ($queue->{vinfo}) . ',';
 819         $insert_cmds .= $time_total . ',';
 820         $insert_cmds .= $dbh->quote ($msginfo->{sender}) . ');';
 821
 822         foreach my $r (@{$msginfo->{targets}}) {
 823             my $tmp = $dbh->quote ($r);
 824             my $blocked = $queue->{status}->{$r} eq 'blocked' ? 1 : 0;
 825             $insert_cmds .= "INSERT INTO CReceivers (CStatistic_CID, CStatistic_RID, Receiver, Blocked) " .
 826                 "VALUES ($lcid, currval ('cstatistic_id_seq'), $tmp, '$blocked'); ";
 827         }
 828
 829         $dbh->do ($insert_cmds);
 830     };
 831
 832     # save $err (because log clears $@)
 833     $err = $@;
 834
 835     $time_total = $time_total/1000;
 836
 837     my $ptspam = ($queue->{ptime_spam} || 0)/1000;
 838     my $ptcommtouch = ($queue->{ptime_commtouch} || 0)/1000;
 839     my $ptavira = ($queue->{ptime_avira} || 0)/1000;
 840     my $ptclam = ($queue->{ptime_clam} || 0)/1000;
 841
 842     $self->log (3, "$queue->{logid}: processing time: ${time_total} seconds ($ptcommtouch, $ptspam, $ptclam, $ptavira)");
 843
 844     $msginfo->{test_fh}->close if $opt_testmode;
 845
 846     die $err if ($err);
 847 }
 848
 849
 850 sub process_request {
 851   my $self = shift;
 852   my $prop = $self->{server};
 853   my $sock = $prop->{client};
 854
 855   eval {
 856
 857       # make sure the ldap cache is up to date
 858       $self->{ldap}->update (1);
 859
 860       $self->load_config() if $self->{reload_config};
 861
 862       $self->{trusted} = 0;
 863       if ($prop->{sockport} == $opt_int_port && !$opt_untrusted) {
 864           $self->{trusted} = 1;
 865       }
 866
 867       my $smtp = Proxmox::SMTP->new ($sock);
 868
 869       my $maxcount = $max_requests - $prop->{requests};
 870
 871       my $count = $smtp->loop (\&handle_smtp, $self, $maxcount);
 872       if ($count > 1) {
 873           $prop->{requests} += $count - 1;
 874       }
 875   };
 876
 877   my $err = $@;
 878
 879   $self->log (0, $err) if $err;
 880
 881   kill (15, $prop->{ppid}) if $opt_testmode;
 882
 883   my $mem = PVE::ProcFSTools::read_memory_usage();
 884
 885   if ($opt_testmode) {
 886       $self->log (0, "memory usage: $mem->{size} bytes");
 887   } else {
 888       if ($self->{errors}) {
 889           $self->log (0, "fast exit because of errors (free $mem->{size} bytes)");
 890           $self->done (1);
 891       } elsif ($mem->{size} > (300*1024*1024)) {
 892           $self->log (0, "fast exit to reduce server load (free $mem->{size} bytes)");
 893           $self->done (1);
 894      }
 895   }
 896
 897   $self->done (1) if $err;
 898 }
 899
 900 # test sig_hup with: for ((;;)) ;do kill -HUP  `cat /var/run/proxprox.pid`; done;
 901 # wrapper to avoid multiple calls to sig_hup
 902 sub sig_hup {
 903   my $self = shift;
 904   my $prop = $self->{server};
 905
 906   return if defined ($prop->{_HUP}); # do not call twice
 907
 908   $self->SUPER::sig_hup();
 909 }
 910
 911 sub restart_close_hook {
 912   my $self = shift;
 913
 914   my $sig_set = POSIX::SigSet->new;
 915   $sig_set->addset (&POSIX::SIGHUP);
 916   $sig_set->addset (&POSIX::SIGCHLD); # to avoid zombies
 917   my $old_sig_set = POSIX::SigSet->new();
 918
 919   sigprocmask (SIG_BLOCK, $sig_set, $old_sig_set);
 920 }
 921
 922 sub pre_server_close_hook {
 923     my $self = shift;
 924     my $prop = $self->{server};
 925
 926     if (defined $prop->{_HUP}) {
 927         undef $prop->{pid_file_unlink};
 928     }
 929
 930     if (defined $prop->{children}) {
 931         foreach my $pid (keys %{$prop->{children}}) {
 932             kill (1, $pid); # HUP childs
 933         }
 934     }
 935
 936     # nicely shutdown childs (give them max 30 seconds to shut down)
 937     my $previous_alarm = alarm (30);
 938     eval {
 939         local $SIG{ALRM} = sub { die "Timed Out!\n" };
 940
 941         my $pid;
 942         1 while ((($pid = waitpid (-1, 0)) > 0) || ($! == EINTR));
 943     };
 944     alarm ($previous_alarm);
 945 }
 946
 947 # initialize mime system before fork
 948 xdg_mime_get_mime_type_for_file ($0);
 949
 950 my $server = bless {
 951     server => $server_attr,
 952 };
 953
 954 if (!$opt_testmode) {
 955     $server->run ();
 956 } else {
 957     if (fork) {
 958         $server->run ();
 959     } else {
 960         sleep (1);
 961         my $sender ='sender@proxtest.com';
 962         my $targets = ['target1@proxtest.com',
 963                        'target2@proxtest.com',
 964                        'target3@proxtest.com'];
 965
 966         my $smtp = Net::SMTP->new ('127.0.0.1', Port => 10023);
 967
 968         die "unable to connect $!" if !$smtp;
 969
 970         # syslog ('info', "connected to " . $smtp->domain);
 971
 972         $smtp->mail ($sender);
 973         $smtp->to (@$targets);
 974
 975         $smtp->data();
 976
 977         open (TMP, $opt_testmode) ||
 978             die "unable to upen file '$opt_testmode' - $! :ERROR";
 979         while (<TMP>) {
 980             $smtp->datasend ($_);
 981         }
 982         close TMP;
 983
 984         $smtp->datasend ("\n");
 985         $smtp->dataend ();
 986
 987         $smtp->quit;
 988     }
 989 }
 990
 991 exit (0);
 992
 993 __END__
 994
 995 =head1 NAME
 996
 997 pmg-smtp-filter - the Proxmox mail filter
 998
 999 =head1 SYNOPSIS
1000
1001 pmg-smtp-filter [-u] [-t testfile]
1002
1003 =head1 DESCRIPTION
1004
1005 Documentation is available at www.proxmox.com