bin/pmg-smtp-filter

   1 #!/usr/bin/perl
   2
   3 use strict;
   4 use warnings;
   5
   6 use Carp;
   7 use Getopt::Long;
   8 use Time::HiRes qw (usleep gettimeofday tv_interval);
   9 use POSIX qw(:sys_wait_h errno_h signal_h);
  10
  11 use MIME::Parser;
  12 use File::Path;
  13 use Net::Server::PreFork;
  14 use Net::Server::SIG qw(register_sig check_sigs);
  15 use Net::SMTP;
  16
  17 use Fcntl ':flock';
  18 use File::Basename;
  19 use Xdgmime;
  20
  21 use PVE::SafeSyslog;
  22 use PVE::ProcFSTools;
  23 use PVE::INotify;
  24
  25 use Mail::SpamAssassin;
  26 use Mail::SpamAssassin::NetSet;
  27
  28 use PMG::pmgcfg;
  29 use PMG::Utils;
  30 use PMG::Cluster;
  31 use PMG::ClusterConfig;
  32
  33 use PMG::DBTools;
  34 use PMG::RuleDB;
  35 use PMG::RuleCache;
  36 use PMG::ModGroup;
  37 use PMG::AtomicFile;
  38 use PMG::LDAPConfig;
  39 use PMG::LDAPSet;
  40 use PMG::Config;
  41 use PMG::MailQueue;
  42 use PMG::Unpack;
  43 use PMG::SMTP;
  44
  45 use PMG::Unpack;
  46 use PMG::Statistic;
  47
  48 use base qw(Net::Server::PreFork);
  49
  50 my $opt_commandline = [$0, @ARGV];
  51 my $opt_max_dequeue = 1;
  52 my $opt_dequeue_time = 30;
  53
  54 my $opt_ext_port = 10024;
  55 my $opt_int_port = 10023;
  56 my $opt_inject_port = 10025;
  57
  58 my $opt_testmode;
  59 my $opt_untrusted;
  60 my $opt_pidfile;
  61 my $opt_database;
  62
  63 my $prog_name = 'pmg-smtp-filter';
  64
  65 initlog($prog_name, 'mail');
  66
  67 if (!GetOptions ('testmode=s' => \$opt_testmode,
  68                  'pidfile=s' => \$opt_pidfile,
  69                  'untrusted' => \$opt_untrusted,
  70                  'database=s' => \$opt_database)) {
  71     die "usage error\n";
  72     exit (-1);
  73 }
  74
  75 $opt_pidfile = "/var/run/${prog_name}.pid" if !$opt_pidfile;
  76
  77 my $max_servers = 1;
  78 my $min_servers = 1;
  79 my $min_spare_servers = 0;
  80 my $max_spare_servers = 0;
  81 my $max_requests = 1;
  82
  83 # create spool directories
  84 PMG::MailQueue::create_sppoldirs();
  85
  86 if (!$opt_testmode) {
  87
  88     my $pmg_cfg = PMG::Config->new();
  89
  90     my $demo = $pmg_cfg->get('admin', 'demo');
  91
  92     if ($demo) {
  93         syslog ('info', 'demo mode detected - not starting server');
  94         exit (0);
  95     }
  96
  97     $max_servers = $pmg_cfg->get('mail', 'max_filters') + 2;
  98     $min_servers = 2;
  99     $min_spare_servers = 1;
 100     $max_spare_servers = 4;
 101     $max_requests = 20;
 102 }
 103
 104 $opt_max_dequeue = 0 if $opt_testmode;
 105
 106 my $daemonize = 1;
 107 if (defined ($ENV{BOUND_SOCKETS})) {
 108     $daemonize = undef;
 109 }
 110
 111 my $server_attr = {
 112     port => [ $opt_int_port, $opt_ext_port ],
 113     host => '127.0.0.1',
 114     min_servers => $min_servers,
 115     max_servers => $max_servers,
 116     min_spare_servers => $min_spare_servers,
 117     max_spare_servers => $max_spare_servers,
 118     max_requests => $max_requests,
 119     serialize => 'flock',
 120     max_dequeue => $opt_max_dequeue,
 121     check_for_dequeue => $opt_dequeue_time,
 122     log_level => 3,
 123     pid_file => $opt_pidfile,
 124     no_close_by_child => 1,
 125     no_client_stdout => 1,
 126     commandline => $opt_commandline,
 127 };
 128
 129 $server_attr->{setsid} = $daemonize if !$opt_testmode;
 130
 131 my $database;
 132
 133 if (defined($opt_database)) {
 134     $database = $opt_database;
 135 } else {
 136     $database = $opt_testmode ? "Proxmox_testdb" : "Proxmox_ruledb";
 137 }
 138
 139 $SIG{'__WARN__'} = sub {
 140     my $err = $@;
 141     my $t = $_[0];
 142     chomp $t;
 143     syslog('warning', "WARNING: %s", $t);
 144     $@ = $err;
 145 };
 146
 147 sub get_prox_vars {
 148     my ($self, $queue, $entity, $msginfo, $rule, $targets, $spaminfo) = @_;
 149
 150     $spaminfo = {
 151         sa_score => $queue->{sa_score},
 152         sa_hits => $queue->{sa_hits},
 153         sa_data => $queue->{sa_data},
 154         sa_max => $queue->{sa_max}
 155     } if !$spaminfo;
 156
 157     my $vars = {
 158         'SUBJECT' => $entity->head->get ('subject', 0) || 'No Subject',
 159         'RULE' => $rule->{name},
 160         'RULE_INFO' => $msginfo->{rule_info},
 161         'SENDER' => $msginfo->{sender},
 162         'SENDER_IP' => $msginfo->{xforward}->{addr},
 163         'TARGETS' => join (', ', @$targets),
 164         'RECEIVERS' => join (', ', @{$msginfo->{targets}}),
 165         'SPAMLEVEL' => $spaminfo->{sa_score},
 166         'SPAMSTARS' => '*' x (($spaminfo->{sa_score} || 0) > 100 ? 100 : $spaminfo->{sa_score} || 0),
 167         'ADMIN' =>  $self->{pmg_cfg}->get('admin', 'email'),
 168         'HOST' =>  $msginfo->{hostname},
 169         'DOMAIN' =>  $msginfo->{domain},
 170         'FQDN' => $msginfo->{fqdn},
 171         'MSGID' => $queue->{msgid},
 172         'VERSION' => PMG::pmgcfg::package() . "/" . PMG::pmgcfg::version() . "/" . PMG::pmgcfg::repoid(),
 173     };
 174
 175     $vars->{__spaminfo} = $spaminfo;
 176
 177     if ($opt_testmode) {
 178         if ($queue->{vinfo_clam}) {
 179             $vars->{'VIRUS_INFO'} = "Virus Info:";
 180             $vars->{'VIRUS_INFO'} .= " clam: $queue->{vinfo_clam}" if $queue->{vinfo_clam};
 181         } else {
 182             $vars->{'VIRUS_INFO'} = '';
 183         }
 184     } else {
 185         if ($queue->{vinfo}) {
 186             $vars->{'VIRUS_INFO'} = "Virus Info: $queue->{vinfo}\n";
 187         } else {
 188             $vars->{'VIRUS_INFO'} = '';
 189         }
 190     }
 191
 192     $vars->{'SPAM_HITS'} = $spaminfo->{sa_hits};
 193
 194     $vars->{'SPAM_INFO'} = '';
 195     my $sscores = $spaminfo->{sa_data};
 196
 197     if (defined ($sscores) && @$sscores != -1) {
 198         my $sa_text;
 199         if ($opt_testmode) {
 200             $sa_text = "Spam detection results:  100\n";
 201         } else {
 202             $sa_text = "Spam detection results:  $spaminfo->{sa_score}\n";
 203         }
 204
 205         foreach my $s (@$sscores) {
 206             if ($opt_testmode) {
 207                 $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
 208                                      1, $s->{desc} || '-');
 209             } else {
 210                 $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
 211                                      $s->{score}, $s->{desc} || '-');
 212             }
 213         }
 214         $vars->{'SPAM_INFO'} = $sa_text;
 215     }
 216
 217     if ($opt_testmode) {
 218         delete ($vars->{'ADMIN'});
 219         #delete ($vars->{'SPAM_INFO'});
 220     }
 221
 222     return $vars;
 223 }
 224
 225 sub apply_rules {
 226     my ($self, $queue, $msginfo, $entity, $ldap) = @_;
 227
 228     my $final;
 229     my %rule_targets;
 230     my %rule_actions;
 231     my %rule_marks;
 232     my $matching_rules = [];
 233
 234     my $rulecache = $self->{rulecache};
 235     my $rules = $rulecache->rules ();
 236     my $dbh = $self->{ruledb}->{dbh};
 237
 238     # first, we remove all conditional written 'X-' header attributes
 239     foreach my $rule (@$rules) {
 240         next if !$rule->{active};
 241         next if ($rule->{direction} == 0) &&  $msginfo->{trusted};
 242         next if ($rule->{direction} == 1) &&  !$msginfo->{trusted};
 243
 244         my $actions = $rulecache->get_actions ($rule->{id});
 245         if ($actions) {
 246             foreach my $action (@$actions) {
 247                 if ($action->isa ("PMG::RuleDB::ModField")) {
 248                     my $fname = $action->{field};
 249                     next if $fname !~ m/^X-/i;
 250                     $entity->head->delete($fname);
 251                 }
 252             }
 253         }
 254     }
 255
 256     foreach my $rule (@$rules) {
 257         next if !$rule->{active};
 258         next if ($rule->{direction} == 0) &&  $msginfo->{trusted};
 259         next if ($rule->{direction} == 1) &&  !$msginfo->{trusted};
 260
 261         # match from, when and what classes (not target dependent)
 262         if (!($rulecache->from_match ($rule->{id}, $msginfo->{sender}, $msginfo->{xforward}->{addr}, $ldap) &&
 263               $rulecache->when_match ($rule->{id}, time))) {
 264             next;
 265         }
 266
 267         $rule_marks{$rule->{id}} =
 268             $rulecache->what_match ($rule->{id}, $queue, $entity, $msginfo, $dbh);
 269
 270         $rule_actions{$rule->{id}} = $rulecache->get_actions ($rule->{id});
 271         my $fin = $rulecache->final ($rule->{id});
 272
 273         # match targets
 274         foreach my $target (@{$msginfo->{targets}}) {
 275             next if $final->{$target};
 276             next if !defined ($rule_marks{$rule->{id}});
 277             next if !defined ($rule_marks{$rule->{id}}->{$target});
 278             next if !defined ($rule_marks{$rule->{id}}->{$target}->{marks});
 279             next if !$rulecache->to_match ($rule->{id}, $target, $ldap);
 280
 281             $final->{$target} = $fin;
 282
 283             push @{$rule_targets{$rule->{id}}}, $target;
 284         }
 285     }
 286
 287     # Compute rule_info (summary about matching rule)
 288     # this can be used for debugging
 289     my $rule_info = "";
 290     foreach my $rule (@$rules) {
 291         next if !$rule_targets{$rule->{id}};
 292
 293         push @$matching_rules, $rule->{id};
 294
 295         $rule_info .= "Rule: $rule->{name}\n";
 296
 297         foreach my $target (@{$rule_targets{$rule->{id}}}) {
 298             $rule_info .= "  Receiver: $target\n";
 299         }
 300         foreach my $action (@{$rule_actions{$rule->{id}}}) {
 301             $rule_info .= "  Action: " . $action->short_desc () . "\n";
 302         }
 303
 304     }
 305     $msginfo->{rule_info} = $rule_info;
 306
 307     if ($msginfo->{testmode}) {
 308         my $vars = $self->get_prox_vars($queue, $entity, $msginfo, undef, [], undef);
 309         my $fh = $msginfo->{test_fh};
 310         print $fh $rule_info;
 311     }
 312
 313     # apply actions
 314
 315     my $mod_group = PMG::ModGroup->new($entity, $msginfo->{targets});
 316
 317     foreach my $rule (@$rules) {
 318         my $targets = $rule_targets{$rule->{id}};
 319         next if !$targets;
 320
 321         my $spaminfo;
 322         foreach my $t (@$targets) {
 323             if ($rule_marks{$rule->{id}}->{$t} && $rule_marks{$rule->{id}}->{$t}->{spaminfo}) {
 324                 $spaminfo = $rule_marks{$rule->{id}}->{$t}->{spaminfo};
 325                 # we assume spam info is the same for all matching targets
 326                 last;
 327             }
 328         }
 329
 330         my $vars = $self->get_prox_vars ($queue, $entity, $msginfo, $rule,
 331                                          $rule_targets{$rule->{id}}, $spaminfo);
 332
 333
 334         my @sorted_actions =
 335             sort {$a->priority <=> $b->priority} @{$rule_actions{$rule->{id}}};
 336
 337         foreach my $action (@sorted_actions) {
 338             $action->execute ($queue, $self->{ruledb}, $mod_group,
 339                               $rule_targets{$rule->{id}},
 340                               $msginfo, $vars, $rule_marks{$rule->{id}}->{marks}, $ldap);
 341             last if $action->final;
 342         }
 343     }
 344
 345     # we deliver all mail not matched by any rule
 346     # (default action = accept)
 347     my $unmatched;
 348     foreach my $target (@{$msginfo->{targets}}) {
 349         next if $final->{$target};
 350
 351         push @$unmatched, $target;
 352     }
 353
 354     if ($unmatched) {
 355         my $accept = PMG::RuleDB::Accept->new ();
 356         $accept->execute ($queue, $self->{ruledb}, $mod_group, $unmatched,
 357                           $msginfo, undef, undef, undef);
 358     }
 359
 360     return $matching_rules;
 361 }
 362
 363 # reload ruledb and pmg config
 364 sub load_config {
 365     my $self = shift;
 366     my $prop = $self->{server};
 367
 368     if ($self->{ruledb}) {
 369         $self->log (0, "reloading configuration $database");
 370         $self->{ruledb}->close ();
 371     }
 372
 373     $self->{pmg_cfg} = PMG::Config->new();
 374     $self->{cinfo} = PVE::INotify::read_file("cluster.conf");
 375
 376     eval {
 377         my $dbh = PMG::DBTools::open_ruledb ($database);
 378         $self->{ruledb} = PMG::RuleDB->new ($dbh);
 379
 380         # load rulecache
 381         $self->{rulecache} = PMG::RuleCache->new ($self->{ruledb});
 382     };
 383
 384     my $err = $@;
 385
 386     if ($err) {
 387         sleep (10); # reduce restart rate when postgres is down
 388         die $err;
 389     }
 390
 391     # create LDAP object
 392     my $ldapconf = PVE::INotify::read_file('pmg-ldap.conf');
 393     $self->{ldap} = PMG::LDAPSet->new_from_ldap_cfg($ldapconf, 1);
 394
 395     $self->{reload_config} = 0;
 396 }
 397
 398 my $syslog_map = {
 399     0 => 'err',
 400     1 => 'warning',
 401     2 => 'notice',
 402     3 => 'info',
 403     4 => 'debug'
 404 };
 405
 406 sub log {
 407     my ($self, $level, $msg, @therest) = @_;
 408     my $prop = $self->{server};
 409
 410     return if $level =~ /^\d+$/ && $level > $prop->{log_level};
 411
 412     $level = $syslog_map->{$level} || $level;
 413     if (@therest) {
 414         syslog($level, $msg, @therest);
 415     } else {
 416         syslog ($level, $msg);
 417     }
 418 }
 419
 420 sub pre_loop_hook {
 421     my $self = shift;
 422     my $prop = $self->{server};
 423
 424     $prop->{log_level} = 3;
 425
 426     $self->log (0, "Filter daemon (re)started (max. $max_servers processes)");
 427
 428     eval {  PMG::MailQueue::cleanup_active(); };
 429     $self->log (0, "Cleanup failures: $@") if $@;
 430
 431     my $sig_set = POSIX::SigSet->new;
 432     $sig_set->addset (&POSIX::SIGHUP);
 433     $sig_set->addset (&POSIX::SIGCHLD);
 434     my $old_sig_set = POSIX::SigSet->new();
 435
 436     sigprocmask (SIG_UNBLOCK, $sig_set, $old_sig_set);
 437
 438     my ($backup_umask) = umask;
 439
 440     my $pmg_cfg = PMG::Config->new();
 441
 442     # Note: you need to restart the daemon when you change 'rbl_checks'
 443     my $rbl_checks = $pmg_cfg->get('spam', 'rbl_checks');
 444
 445     $self->{sa} = Mail::SpamAssassin->new ({
 446         debug => 0,
 447         local_tests_only => $opt_testmode || !$rbl_checks,
 448         home_dir_for_helpers => '/root',
 449         userstate_dir => '/root/.spamassassin',
 450         dont_copy_prefs   => 1,
 451         stop_at_threshold => 0,
 452     });
 453
 454     $self->{sa}->compile_now;
 455
 456     alarm (0); # SA forgets to clear alarm in some cases
 457     umask ($backup_umask);
 458     initlog ($prog_name, 'mail');
 459
 460     $SIG{'USR1'} = sub {
 461         # reloading server configuration
 462         if (defined $prop->{children}) {
 463             foreach my $pid (keys %{$prop->{children}}) {
 464                 kill (10, $pid); # SIGUSR1 childs
 465             }
 466         }
 467     }
 468 }
 469
 470 sub child_init_hook {
 471     my $self = shift;
 472
 473     $0 = "$prog_name child";
 474
 475     # $self->log (3, "init child");
 476
 477     eval {
 478         $self->load_config ();
 479     };
 480
 481     if ($@) {
 482         $self->log (0, $@);
 483         $self->child_finish_hook;
 484         exit;
 485     }
 486
 487     $SIG{'USR1'} = sub {
 488         $self->{reload_config} = 1;
 489     }
 490 }
 491
 492 sub child_finish_hook {
 493     my $self = shift;
 494
 495     # $self->log (3, "finish child");
 496     $self->{ruledb}->close () if $self->{ruledb};
 497 }
 498
 499 my $last_dequeue_time = 0;
 500
 501 sub run_dequeue {
 502     my $self = shift;
 503
 504     my $err;
 505
 506     # do database maintainance here
 507
 508     my $ctime = time();
 509     my $tdiff = $ctime - $last_dequeue_time;
 510     $last_dequeue_time = $ctime;
 511
 512     eval {
 513         PMG::Utils::update_node_status_rrd();
 514     };
 515     if ($err = $@) {
 516         $self->log(0, PMG::Utils::msgquote("ERROR: $err"));
 517         # continue
 518     }
 519
 520     return if $tdiff < 2*60;
 521
 522     $self->log (2, "starting database maintainance");
 523
 524     my ($csec, $usec) = gettimeofday ();
 525
 526     my $cinfo = PVE::INotify::read_file("cluster.conf");
 527
 528     my $dbh;
 529
 530     eval {
 531         $dbh = PMG::DBTools::open_ruledb($database);
 532     };
 533     if ($err = $@) {
 534         $self->log (0, PMG::Utils::msgquote("ERROR: $err"));
 535         return;
 536     }
 537
 538     eval {
 539         PMG::Statistic::update_stats($dbh, $cinfo);
 540     };
 541     $err = $@;
 542
 543     my ($csec_end, $usec_end) = gettimeofday ();
 544     my $ptime = int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 545
 546     if ($err) {
 547         $self->log (0, PMG::Utils::msgquote($err));
 548     } else {
 549         $self->log (2, "end database maintainance ($ptime ms)");
 550     }
 551
 552     $dbh->disconnect() if $dbh;
 553 }
 554
 555
 556 sub unpack_entity {
 557     my ($self, $unpack, $entity, $msginfo, $queue) = @_;
 558
 559     my $magic;
 560     my $path;
 561
 562     if (($magic = $entity->{PMX_magic_ct}) &&
 563         ($path = $entity->{PMX_decoded_path})) {
 564
 565         my $filename = basename ($path);
 566
 567         if (PMG::Unpack::is_archive ($magic)) {
 568             $self->log (3, "$queue->{logid}: found archive '$filename' ($magic)");
 569
 570             my $start = [gettimeofday];
 571
 572             $unpack->{mime} = {};
 573
 574             eval {
 575                 $unpack->unpack_archive ($path, $magic);
 576             };
 577
 578             $self->log (3, "$queue->{logid}: unpack failed - $@") if $@;
 579
 580             $entity->{PMX_content_types} = $unpack->{mime};
 581
 582             if ($opt_testmode) {
 583                 my $types = join (", ", sort keys (%{$entity->{PMX_content_types}}));
 584                 my $fh = $msginfo->{test_fh};
 585                 $filename =~ s/\d+/X/g if $filename =~ m/^msg-\d+-\d+.msg/;
 586                 print $fh "Types:$filename: $types\n" if $types;
 587             }
 588
 589             my $elapsed = int(tv_interval ($start) * 1000);
 590
 591             $self->log (3, "$queue->{logid}: unpack archive '$filename' done ($elapsed ms)");
 592         }
 593     }
 594
 595     foreach my $part ($entity->parts)  {
 596         $self->unpack_entity ($unpack, $part, $msginfo, $queue);
 597     }
 598
 599 }
 600
 601 sub handle_smtp {
 602     my ($self, $smtp) = @_;
 603
 604     my ($csec, $usec) = gettimeofday ();
 605
 606     my $queue;
 607     my $msginfo = {};
 608     my $pmg_cfg = $self->{pmg_cfg};
 609     my $ldap = $self->{ldap};
 610     my $cinfo = $self->{cinfo};
 611     my $lcid = $cinfo->{local}->{cid};
 612
 613     $msginfo->{test_fh} = PMG::AtomicFile->new("testresult.out", "w")
 614         if $opt_testmode;
 615
 616     $msginfo->{trusted} = $self->{trusted};
 617
 618
 619 # PHASE 1 - save incoming mail (already done)
 620 # on error: exit
 621
 622     $queue = $smtp->{queue};
 623     $queue->{sa} = $self->{sa};
 624
 625     $queue->{lic_valid} = 1;
 626
 627     my $matching_rules;
 628
 629     eval {
 630         $msginfo->{testmode} = $opt_testmode;
 631         $msginfo->{sender} = $smtp->{from};
 632         $msginfo->{xforward} = $smtp->{xforward};
 633         $msginfo->{targets} = $smtp->{to};
 634
 635         $msginfo->{hostname} = PVE::INotify::nodename();
 636         my $resolv = PVE::INotify::read_file('resolvconf');
 637
 638         $msginfo->{domain} = $resolv->{search};
 639         $msginfo->{fqdn} = "$msginfo->{hostname}.$msginfo->{domain}";
 640         $msginfo->{lcid} = $lcid;
 641
 642         # $msginfo->{targets} is case sensitive,
 643         # but pmail is always lower case!
 644
 645         foreach my $t (@{$msginfo->{targets}}) {
 646             my $res;
 647             if ($ldap && ($res = $ldap->account_info ($t))) {
 648                 $msginfo->{pmail}->{$t} = $res->{pmail};
 649             } else {
 650                 $msginfo->{pmail}->{$t} = lc ($t);
 651             }
 652         }
 653
 654 # PHASE 2 - parse mail
 655 # on error: exit
 656
 657         my $maxfiles = $pmg_cfg->get('clamav', 'archivemaxfiles');
 658
 659         my $entity = $queue->parse_mail($maxfiles);
 660
 661         $self->log (3, "$queue->{logid}: new mail message-id=%s", $queue->{msgid});
 662
 663 # PHASE 3 - run external content analyzers
 664 # (SPAM analyzer is run on demand later)
 665 # on error: log error messages
 666
 667
 668         # test for virus first
 669         $queue->{vinfo} = PMG::Utils::analyze_virus(
 670             $queue, $queue->{dataname}, $pmg_cfg, $opt_testmode);
 671
 672         # always add this headers to incoming mails
 673         # to enable user to report false negatives
 674         if (!$msginfo->{trusted}) {
 675             if ($queue->{vinfo}) {
 676                 $entity->head->replace('X-Proxmox-VInfo', $queue->{vinfo});
 677             }
 678         }
 679
 680         # we unpack after virus scanning, because this is more secure.
 681         # This way virus scanners gets the whole mail files and are able
 682         # to detect phishing signature for example - which would not work
 683         # if we decompose first and only analyze the decomposed attachments.
 684         # Disadvantage is that we need to unpack more than
 685         # once (bad performance).
 686
 687         # should we scan content types inside archives
 688
 689         my $rulecache = $self->{rulecache};
 690
 691         my $scan_archives = 0;
 692
 693         if (($rulecache->{archivefilter_in} && !$msginfo->{trusted}) ||
 694             ($rulecache->{archivefilter_out} && $msginfo->{trusted})) {
 695             $scan_archives = 1;
 696         }
 697
 698         if ($scan_archives && !$queue->{vinfo}) {
 699
 700             # unpack all archives - determine contained content types
 701
 702             my $decdir = $queue->{dumpdir} . "/__decoded_archives";
 703             mkdir $decdir;
 704
 705             my $start = [gettimeofday];
 706
 707             my $unpack;
 708             eval {
 709
 710                 # limits: We use clamav limit for maxfiles, and scan
 711                 # only 4 levels, timeout of 30 seconds
 712
 713                 $unpack = PMG::Unpack->new (
 714                     tmpdir => $decdir,
 715                     timeout => 30,
 716                     ctonly => 1, # only detect CTs
 717                     maxrec => -4,
 718                     maxfiles => $maxfiles);
 719
 720                 $self->unpack_entity ($unpack, $entity, $msginfo, $queue);
 721             };
 722
 723             my $err = $@;
 724
 725             $unpack->cleanup() if $unpack;
 726
 727             my $elapsed = int(tv_interval ($start) * 1000);
 728
 729             if ($err) {
 730                 $self->log (3, "$queue->{logid}: unpack archive failed ($elapsed ms) - $err");
 731             }
 732         }
 733
 734 # PHASE 4 - apply rules
 735 # on error: exit (cleanup process should do the rest)
 736         $msginfo->{maxspamsize} = $pmg_cfg->get('spam', 'maxspamsize');
 737         if ($msginfo->{maxspamsize} <= 1024*64) {
 738             $msginfo->{maxspamsize} = 1024*64;
 739         }
 740
 741         if ($msginfo->{trusted}) {
 742             my $hide = $pmg_cfg->get('mail', 'hide_received');
 743             $entity->head->delete("Received") if $hide;
 744         }
 745
 746         $matching_rules = $self->apply_rules($queue, $msginfo, $entity, $ldap);
 747     };
 748
 749     my $err = $@;
 750
 751     $self->{errors} = $queue->{errors};
 752
 753     # restart on error
 754     $self->{errors} = 1 if $err;
 755
 756     $queue->close ();
 757
 758     die $err if $err;
 759
 760     my ($csec_end, $usec_end) = gettimeofday ();
 761     my $time_total =
 762         int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 763
 764 # PHASE 5 - log statistics
 765 # on error: log error messages
 766
 767     eval {
 768         my $dbh = $self->{ruledb}->{dbh};
 769         my $where = "";
 770         foreach my $rid (@$matching_rules) {
 771             $where .= $where ? " OR ID = $rid" : "ID = $rid";
 772         }
 773         if ($where) {
 774             $dbh->do ("UPDATE Rule " .
 775                       "SET Count = Count + 1 " .
 776                       "WHERE $where");
 777         }
 778
 779         my $insert_cmds = "SELECT nextval ('cstatistic_id_seq');INSERT INTO CStatistic " .
 780             "(CID, RID, ID, Time, Bytes, Direction, Spamlevel, VirusInfo, PTime, Sender) VALUES (" .
 781             "$lcid, currval ('cstatistic_id_seq'), currval ('cstatistic_id_seq'),";
 782
 783         $insert_cmds .= $queue->{rtime} . ',';
 784         $insert_cmds .= $queue->{bytes} . ',';
 785         $insert_cmds .= $dbh->quote ($msginfo->{trusted} ? 0 : 1) . ',';
 786         $insert_cmds .= ($queue->{sa_score} || 0) . ',';
 787         $insert_cmds .= $dbh->quote ($queue->{vinfo}) . ',';
 788         $insert_cmds .= $time_total . ',';
 789         $insert_cmds .= $dbh->quote ($msginfo->{sender}) . ');';
 790
 791         foreach my $r (@{$msginfo->{targets}}) {
 792             my $tmp = $dbh->quote ($r);
 793             my $blocked = $queue->{status}->{$r} eq 'blocked' ? 1 : 0;
 794             $insert_cmds .= "INSERT INTO CReceivers (CStatistic_CID, CStatistic_RID, Receiver, Blocked) " .
 795                 "VALUES ($lcid, currval ('cstatistic_id_seq'), $tmp, '$blocked'); ";
 796         }
 797
 798         $dbh->do ($insert_cmds);
 799     };
 800
 801     # save $err (because log clears $@)
 802     $err = $@;
 803
 804     $time_total = $time_total/1000;
 805
 806     my $ptspam = ($queue->{ptime_spam} || 0)/1000;
 807     my $ptclam = ($queue->{ptime_clam} || 0)/1000;
 808
 809     $self->log (3, "$queue->{logid}: processing time: ${time_total} seconds ($ptspam, $ptclam)");
 810
 811     $msginfo->{test_fh}->close if $opt_testmode;
 812
 813     die $err if ($err);
 814 }
 815
 816
 817 sub process_request {
 818   my $self = shift;
 819   my $prop = $self->{server};
 820   my $sock = $prop->{client};
 821
 822   eval {
 823
 824       # make sure the ldap cache is up to date
 825       $self->{ldap}->update (1);
 826
 827       $self->load_config() if $self->{reload_config};
 828
 829       $self->{trusted} = 0;
 830       if ($prop->{sockport} == $opt_int_port && !$opt_untrusted) {
 831           $self->{trusted} = 1;
 832       }
 833
 834       my $smtp = PMG::SMTP->new ($sock);
 835
 836       my $maxcount = $max_requests - $prop->{requests};
 837
 838       my $count = $smtp->loop (\&handle_smtp, $self, $maxcount);
 839       if ($count > 1) {
 840           $prop->{requests} += $count - 1;
 841       }
 842   };
 843
 844   my $err = $@;
 845
 846   $self->log (0, $err) if $err;
 847
 848   kill(15, $prop->{ppid}) if $opt_testmode;
 849
 850   my $mem = PVE::ProcFSTools::read_memory_usage();
 851
 852   if ($opt_testmode) {
 853       $self->log (0, "memory usage: $mem->{size} bytes");
 854   } else {
 855       if ($self->{errors}) {
 856           $self->log (0, "fast exit because of errors (free $mem->{size} bytes)");
 857           $self->done (1);
 858       } elsif ($mem->{size} > (400*1024*1024)) {
 859           $self->log (0, "fast exit to reduce server load (free $mem->{size} bytes)");
 860           $self->done (1);
 861      }
 862   }
 863
 864   $self->done (1) if $err;
 865 }
 866
 867 # test sig_hup with: for ((;;)) ;do kill -HUP  `cat /var/run/${prog_name}.pid`; done;
 868 # wrapper to avoid multiple calls to sig_hup
 869 sub sig_hup {
 870   my $self = shift;
 871   my $prop = $self->{server};
 872
 873   return if defined ($prop->{_HUP}); # do not call twice
 874
 875   $self->SUPER::sig_hup();
 876 }
 877
 878 sub restart_close_hook {
 879   my $self = shift;
 880
 881   my $sig_set = POSIX::SigSet->new;
 882   $sig_set->addset (&POSIX::SIGHUP);
 883   $sig_set->addset (&POSIX::SIGCHLD); # to avoid zombies
 884   my $old_sig_set = POSIX::SigSet->new();
 885
 886   sigprocmask (SIG_BLOCK, $sig_set, $old_sig_set);
 887 }
 888
 889 sub pre_server_close_hook {
 890     my $self = shift;
 891     my $prop = $self->{server};
 892
 893     if (defined $prop->{_HUP}) {
 894         undef $prop->{pid_file_unlink};
 895     }
 896
 897     if (defined $prop->{children}) {
 898         foreach my $pid (keys %{$prop->{children}}) {
 899             kill (1, $pid); # HUP childs
 900         }
 901     }
 902
 903     # nicely shutdown childs (give them max 30 seconds to shut down)
 904     my $previous_alarm = alarm(30);
 905     eval {
 906         local $SIG{ALRM} = sub { die "Timed Out!\n" };
 907
 908         my $pid;
 909         1 while ((($pid = waitpid (-1, 0)) > 0) || ($! == EINTR));
 910
 911         alarm(0); # avoid race
 912     };
 913     alarm ($previous_alarm);
 914 }
 915
 916 # initialize mime system before fork
 917 xdg_mime_get_mime_type_for_file ($0);
 918
 919 my $server = bless {
 920     server => $server_attr,
 921 };
 922
 923 if (!$opt_testmode) {
 924     $server->run ();
 925 } else {
 926     if (fork) {
 927         $server->run();
 928     } else {
 929
 930         my $sender ='sender@proxtest.com';
 931         my $targets = ['target1@proxtest.com',
 932                        'target2@proxtest.com',
 933                        'target3@proxtest.com'];
 934
 935         my $smtp;
 936         while (!$smtp) {
 937             $smtp = Net::SMTP->new ('127.0.0.1', Port => 10023);
 938             last if $smtp;
 939             usleep(10);
 940         }
 941
 942         # syslog ('info', "connected to " . $smtp->domain);
 943
 944         $smtp->mail ($sender);
 945         $smtp->to (@$targets);
 946
 947         $smtp->data();
 948
 949         open (TMP, $opt_testmode) ||
 950             die "unable to upen file '$opt_testmode' - $! :ERROR";
 951         while (<TMP>) {
 952             $smtp->datasend ($_);
 953         }
 954         close TMP;
 955
 956         $smtp->datasend ("\n");
 957         $smtp->dataend ();
 958
 959         $smtp->quit;
 960     }
 961 }
 962
 963 exit (0);
 964
 965 __END__
 966
 967 =head1 NAME
 968
 969 pmg-smtp-filter - the Proxmox mail filter
 970
 971 =head1 SYNOPSIS
 972
 973 pmg-smtp-filter [-u] [-t testfile]
 974
 975 =head1 DESCRIPTION
 976
 977 Documentation is available at www.proxmox.com