--- /dev/null
+#!/usr/bin/perl -w
+
+use strict;
+use Carp;
+use Getopt::Long;
+use Time::HiRes qw (gettimeofday tv_interval);
+use Proxmox::SafeSyslog;
+use POSIX qw(:sys_wait_h errno_h signal_h);
+
+use MIME::Parser;
+use File::Path;
+use Net::Server::PreFork;
+use Net::Server::SIG qw(register_sig check_sigs);
+use Fcntl ':flock';
+use File::Basename;
+
+use Proxmox::proxcfg;
+use Proxmox::Utils;
+use Proxmox::RuleDB;
+use Proxmox::ModGroup;
+use Proxmox::Config::System;
+use Proxmox::SMTP;
+use Proxmox::MailQueue;
+use Proxmox::AtomicFile;
+use Proxmox::LDAPCache;
+use Xdgmime;
+use Proxmox::Unpack;
+
+use Mail::SpamAssassin;
+use Mail::SpamAssassin::NetSet;
+use Proxmox::Commtouch;
+
+use vars qw(@ISA);
+@ISA = qw(Net::Server::PreFork);
+
+
+
+my $opt_commandline = [$0, @ARGV];
+my $opt_max_dequeue = 1;
+my $opt_dequeue_time = 60*2;
+
+my $opt_ext_port = 10024;
+my $opt_int_port = 10023;
+my $opt_inject_port = 10025;
+
+my $opt_testmode;
+my $opt_untrusted;
+my $opt_pidfile;
+my $opt_database;
+
+initlog ('proxprox', 'mail');
+
+if (!GetOptions ('testmode=s' => \$opt_testmode,
+ 'pidfile=s' => \$opt_pidfile,
+ 'untrusted' => \$opt_untrusted,
+ 'database=s' => \$opt_database)) {
+ die "usage error\n";
+ exit (-1);
+}
+
+$opt_pidfile = "/var/run/proxprox.pid" if !$opt_pidfile;
+
+my $max_servers = 1;
+my $min_servers = 1;
+my $min_spare_servers = 0;
+my $max_spare_servers = 0;
+my $max_requests = 1;
+
+if (!$opt_testmode) {
+
+ my $system_cfg = Proxmox::Config::System->new ();
+ my $demo = $system_cfg->get ('administration', 'demo');
+
+ if ($demo) {
+ syslog ('info', 'demo mode detected - not starting server');
+ exit (0);
+ }
+
+ $max_servers = $system_cfg->get ('mail', 'max_filters') + 2;
+ $min_servers = 2;
+ $min_spare_servers = 1;
+ $max_spare_servers = 4;
+ $max_requests = 20;
+}
+
+$opt_max_dequeue = 0 if $opt_testmode;
+
+my $daemonize = 1;
+if (defined ($ENV{BOUND_SOCKETS})) {
+ $daemonize = undef;
+}
+
+my $server_attr = {
+ port => [ $opt_int_port, $opt_ext_port ],
+ host => '127.0.0.1',
+ min_servers => $min_servers,
+ max_servers => $max_servers,
+ min_spare_servers => $min_spare_servers,
+ max_spare_servers => $max_spare_servers,
+ max_requests => $max_requests,
+ serialize => 'flock',
+ max_dequeue => $opt_max_dequeue,
+ check_for_dequeue => $opt_dequeue_time,
+ log_level => 3,
+ pid_file => $opt_pidfile,
+ no_close_by_child => 1,
+ no_client_stdout => 1,
+ commandline => $opt_commandline,
+};
+
+$server_attr->{setsid} = $daemonize if !$opt_testmode;
+
+my $database;
+
+if (defined($opt_database)) {
+ $database = $opt_database;
+} else {
+ $database = $opt_testmode ? "Proxmox_testdb" : "Proxmox_ruledb";
+}
+
+$SIG{'__WARN__'} = sub {
+ my $err = $@;
+ my $t = $_[0];
+ chomp $t;
+ syslog('warning', "WARNING: %s", $t);
+ $@ = $err;
+};
+
+sub get_prox_vars {
+ my ($self, $queue, $entity, $msginfo, $rule, $targets, $spaminfo) = @_;
+
+ $spaminfo = {
+ sa_score => $queue->{sa_score},
+ sa_hits => $queue->{sa_hits},
+ sa_data => $queue->{sa_data},
+ sa_max => $queue->{sa_max}
+ } if !$spaminfo;
+
+ my $vars = {
+ 'SUBJECT' => $entity->head->get ('subject', 0) || 'No Subject',
+ 'RULE' => $rule->{name},
+ 'RULE_INFO' => $msginfo->{rule_info},
+ 'SENDER' => $msginfo->{sender},
+ 'SENDER_IP' => $msginfo->{xforward}->{addr},
+ 'TARGETS' => join (', ', @$targets),
+ 'RECEIVERS' => join (', ', @{$msginfo->{targets}}),
+ 'SPAMLEVEL' => $spaminfo->{sa_score},
+ 'SPAMSTARS' => '*' x (($spaminfo->{sa_score} || 0) > 100 ? 100 : $spaminfo->{sa_score} || 0),
+ 'ADMIN' => $self->{system_cfg}->get ('administration', 'email'),
+ 'HOST' => $msginfo->{hostname},
+ 'DOMAIN' => $msginfo->{domain},
+ 'FQDN' => $msginfo->{fqdn},
+ 'MSGID' => $queue->{msgid},
+ 'VERSION' => Proxmox::proxcfg::package() . "/" .Proxmox::proxcfg::version() . "/" . Proxmox::proxcfg::repoid(),
+ };
+
+ $vars->{__spaminfo} = $spaminfo;
+
+ if ($opt_testmode) {
+ if ($queue->{vinfo_avira} || $queue->{vinfo_clam} || $queue->{vinfo_commtouch}) {
+ $vars->{'VIRUS_INFO'} = "Virus Info:";
+ $vars->{'VIRUS_INFO'} .= " clam: $queue->{vinfo_clam}" if $queue->{vinfo_clam};
+ $vars->{'VIRUS_INFO'} .= " avira: $queue->{vinfo_avira}" if $queue->{vinfo_avira};
+ $vars->{'VIRUS_INFO'} .= " commtouch: $queue->{vinfo_commtouch}" if $queue->{vinfo_commtouch};
+ } else {
+ $vars->{'VIRUS_INFO'} = '';
+ }
+ } else {
+ if ($queue->{vinfo}) {
+ $vars->{'VIRUS_INFO'} = "Virus Info: $queue->{vinfo}\n";
+ } else {
+ $vars->{'VIRUS_INFO'} = '';
+ }
+ }
+
+ $vars->{'SPAM_HITS'} = $spaminfo->{sa_hits};
+
+ $vars->{'SPAM_INFO'} = '';
+ my $sscores = $spaminfo->{sa_data};
+
+ if (defined ($sscores) && @$sscores != -1) {
+ my $sa_text;
+ if ($opt_testmode) {
+ $sa_text = "Spam detection results: 100\n";
+ } else {
+ $sa_text = "Spam detection results: $spaminfo->{sa_score}\n";
+ }
+
+ foreach my $s (@$sscores) {
+ if ($opt_testmode) {
+ $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
+ 1, $s->{desc} || '-');
+ } else {
+ $sa_text .= sprintf ("%-22s %6s %s\n", $s->{rule},
+ $s->{score}, $s->{desc} || '-');
+ }
+ }
+ $vars->{'SPAM_INFO'} = $sa_text;
+ }
+
+ if ($opt_testmode) {
+ delete ($vars->{'ADMIN'});
+ #delete ($vars->{'SPAM_INFO'});
+ }
+
+ return $vars;
+}
+
+sub apply_rules {
+ my ($self, $queue, $msginfo, $entity, $ldap) = @_;
+
+ my $final;
+ my %rule_targets;
+ my %rule_actions;
+ my %rule_marks;
+ my $matching_rules = [];
+
+ my $rulecache = $self->{rulecache};
+ my $rules = $rulecache->rules ();
+ my $dbh = $self->{ruledb}->{dbh};
+
+ # first, we remove all conditional written 'X-' header attributes
+ foreach my $rule (@$rules) {
+ next if !$rule->{active};
+ next if ($rule->{direction} == 0) && $msginfo->{trusted};
+ next if ($rule->{direction} == 1) && !$msginfo->{trusted};
+
+ my $actions = $rulecache->get_actions ($rule->{id});
+ if ($actions) {
+ foreach my $action (@$actions) {
+ if ($action->isa ("Proxmox::RuleDB::ModField")) {
+ my $fname = $action->{field};
+ next if $fname !~ m/^X-/i;
+ $entity->head->delete($fname);
+ }
+ }
+ }
+ }
+
+ foreach my $rule (@$rules) {
+ next if !$rule->{active};
+ next if ($rule->{direction} == 0) && $msginfo->{trusted};
+ next if ($rule->{direction} == 1) && !$msginfo->{trusted};
+
+ # match from, when and what classes (not target dependent)
+ if (!($rulecache->from_match ($rule->{id}, $msginfo->{sender}, $msginfo->{xforward}->{addr}, $ldap) &&
+ $rulecache->when_match ($rule->{id}, time))) {
+ next;
+ }
+
+ $rule_marks{$rule->{id}} =
+ $rulecache->what_match ($rule->{id}, $queue, $entity, $msginfo, $dbh);
+
+ $rule_actions{$rule->{id}} = $rulecache->get_actions ($rule->{id});
+ my $fin = $rulecache->final ($rule->{id});
+
+ # match targets
+ foreach my $target (@{$msginfo->{targets}}) {
+ next if $final->{$target};
+ next if !defined ($rule_marks{$rule->{id}});
+ next if !defined ($rule_marks{$rule->{id}}->{$target});
+ next if !defined ($rule_marks{$rule->{id}}->{$target}->{marks});
+ next if !$rulecache->to_match ($rule->{id}, $target, $ldap);
+
+ $final->{$target} = $fin;
+
+ push @{$rule_targets{$rule->{id}}}, $target;
+ }
+ }
+
+ # Compute rule_info (summary about matching rule)
+ # this can be used for debugging
+ my $rule_info = "";
+ foreach my $rule (@$rules) {
+ next if !$rule_targets{$rule->{id}};
+
+ push @$matching_rules, $rule->{id};
+
+ $rule_info .= "Rule: $rule->{name}\n";
+
+ foreach my $target (@{$rule_targets{$rule->{id}}}) {
+ $rule_info .= " Receiver: $target\n";
+ }
+ foreach my $action (@{$rule_actions{$rule->{id}}}) {
+ $rule_info .= " Action: " . $action->short_desc () . "\n";
+ }
+
+ }
+ $msginfo->{rule_info} = $rule_info;
+
+ if ($msginfo->{testmode}) {
+ my $vars = $self->get_prox_vars ($queue, $entity, $msginfo, undef, [], undef);
+ my $out = "__RULE_INFO__";
+ $out = Proxmox::Utils::subst_values ($out, $vars);
+ my $fh = $msginfo->{test_fh};
+ print $fh $out;
+ }
+
+ # apply actions
+
+ my $mod_group = Proxmox::ModGroup->new ($entity, $msginfo->{targets});
+
+ foreach my $rule (@$rules) {
+ my $targets = $rule_targets{$rule->{id}};
+ next if !$targets;
+
+ my $spaminfo;
+ foreach my $t (@$targets) {
+ if ($rule_marks{$rule->{id}}->{$t} && $rule_marks{$rule->{id}}->{$t}->{spaminfo}) {
+ $spaminfo = $rule_marks{$rule->{id}}->{$t}->{spaminfo};
+ # we assume spam info is the same for all matching targets
+ last;
+ }
+ }
+
+ my $vars = $self->get_prox_vars ($queue, $entity, $msginfo, $rule,
+ $rule_targets{$rule->{id}}, $spaminfo);
+
+
+ my @sorted_actions =
+ sort {$a->priority <=> $b->priority} @{$rule_actions{$rule->{id}}};
+
+ foreach my $action (@sorted_actions) {
+ $action->execute ($queue, $self->{ruledb}, $mod_group,
+ $rule_targets{$rule->{id}},
+ $msginfo, $vars, $rule_marks{$rule->{id}}->{marks}, $ldap);
+ last if $action->final;
+ }
+ }
+
+ # we deliver all mail not matched by any rule
+ # (default action = accept)
+ my $unmatched;
+ foreach my $target (@{$msginfo->{targets}}) {
+ next if $final->{$target};
+
+ push @$unmatched, $target;
+ }
+
+ if ($unmatched) {
+ my $accept = Proxmox::RuleDB::Accept->new ();
+ $accept->execute ($queue, $self->{ruledb}, $mod_group, $unmatched,
+ $msginfo, undef, undef, undef);
+ }
+
+ return $matching_rules;
+}
+
+# reload ruledb and system config
+sub load_config {
+ my $self = shift;
+ my $prop = $self->{server};
+
+ if ($self->{ruledb}) {
+ $self->log (0, "reloading configuration $database");
+ $self->{ruledb}->close ();
+ }
+
+ $self->{system_cfg} = Proxmox::Config::System->new ();
+ $self->{cinfo} = $self->{system_cfg}->clusterinfo ();
+
+ eval {
+ my $dbh = Proxmox::Utils::open_ruledb ($database);
+ $self->{ruledb} = Proxmox::RuleDB->new ($dbh);
+
+ # load rulecache
+ $self->{rulecache} = Proxmox::RuleDB::RuleCache->new ($self->{ruledb});
+ };
+
+ my $err = $@;
+
+ if ($err) {
+ sleep (10); # reduce restart rate when postgres is down
+ die $err;
+ }
+
+ # create LDAP object
+ $self->{ldap} = Proxmox::LDAPSet->new_from_system_cfg ($self->{system_cfg}, 1);
+
+ $self->{reload_config} = 0;
+}
+
+sub log {
+ my ($self, $level, $msg, @therest) = @_;
+ my $prop = $self->{server};
+
+ return if $level =~ /^\d+$/ && $level > $prop->{log_level};
+
+ $level = $Proxmox::SafeSyslog::syslog_map->{$level} || $level;
+ if (@therest) {
+ syslog($level, $msg, @therest);
+ } else {
+ syslog ($level, $msg);
+ }
+}
+
+sub pre_loop_hook {
+ my $self = shift;
+ my $prop = $self->{server};
+
+ $prop->{log_level} = 3;
+
+ $self->log (0, "Filter daemon (re)started (max. $max_servers processes)");
+
+ eval { Proxmox::MailQueue::cleanup_active(); };
+ $self->log (0, "Cleanup failures: $@") if $@;
+
+ my $sig_set = POSIX::SigSet->new;
+ $sig_set->addset (&POSIX::SIGHUP);
+ $sig_set->addset (&POSIX::SIGCHLD);
+ my $old_sig_set = POSIX::SigSet->new();
+
+ sigprocmask (SIG_UNBLOCK, $sig_set, $old_sig_set);
+
+ my ($backup_umask) = umask;
+
+ my $system_cfg = Proxmox::Config::System->new ();
+
+ # Note: you ned to restart the daemon when you change 'rbl_checks'
+ $system_cfg->get ('spam', 'rbl_checks');
+
+ $self->{sa} = Mail::SpamAssassin->new ({
+ debug => 0,
+ local_tests_only => $opt_testmode ||
+ !$system_cfg->get('spam', 'rbl_checks'),
+ home_dir_for_helpers => '/root',
+ userstate_dir => '/root/.spamassassin',
+ dont_copy_prefs => 1,
+ stop_at_threshold => 0,
+ });
+
+ $self->{sa}->compile_now;
+
+ alarm (0); # SA forgets to clear alarm in some cases
+ umask ($backup_umask);
+ initlog ('proxprox', 'mail');
+
+ $SIG{'USR1'} = sub {
+ # reloading server configuration
+ if (defined $prop->{children}) {
+ foreach my $pid (keys %{$prop->{children}}) {
+ kill (10, $pid); # SIGUSR1 childs
+ }
+ }
+ }
+}
+
+sub child_init_hook {
+ my $self = shift;
+
+ $0 = 'proxprox child';
+
+ # $self->log (3, "init child");
+
+ eval {
+ $self->load_config ();
+ };
+
+ if ($@) {
+ $self->log (0, $@);
+ $self->child_finish_hook;
+ exit;
+ }
+
+ $SIG{'USR1'} = sub {
+ $self->{reload_config} = 1;
+ }
+}
+
+sub child_finish_hook {
+ my $self = shift;
+
+ # $self->log (3, "finish child");
+ $self->{ruledb}->close () if $self->{ruledb};
+}
+
+sub run_dequeue {
+ my $self = shift;
+
+ # do database maintainance here
+
+ $self->log (2, "starting database maintainance");
+
+ my ($csec, $usec) = gettimeofday ();
+
+ my $system_cfg = Proxmox::Config::System->new ();
+ my $cinfo = $system_cfg->clusterinfo();
+
+ my $dbh;
+
+ eval {
+ $dbh = Proxmox::Utils::open_ruledb ($database);
+ };
+
+ my $err = $@;
+
+ if ($err) {
+ $self->log (0, msgquote ("ERROR: $err"));
+ return;
+ }
+
+ eval {
+ Proxmox::Statistic::update_stats ($dbh, $cinfo);
+ };
+
+ $err = $@;
+
+ my ($csec_end, $usec_end) = gettimeofday ();
+ my $ptime = int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
+
+ if ($err) {
+ $self->log (0, msgquote ($err));
+ } else {
+ $self->log (2, "end database maintainance ($ptime ms)");
+ }
+
+ $dbh->disconnect() if $dbh;
+}
+
+
+sub unpack_entity {
+ my ($self, $unpack, $entity, $msginfo, $queue) = @_;
+
+ my $magic;
+ my $path;
+
+ if (($magic = $entity->{PMX_magic_ct}) &&
+ ($path = $entity->{PMX_decoded_path})) {
+
+ my $filename = basename ($path);
+
+ if (Proxmox::Unpack::is_archive ($magic)) {
+ $self->log (3, "$queue->{logid}: found archive '$filename' ($magic)");
+
+ my $start = [gettimeofday];
+
+ $unpack->{mime} = {};
+
+ eval {
+ $unpack->unpack_archive ($path, $magic);
+ };
+
+ $self->log (3, "$queue->{logid}: unpack failed - $@") if $@;
+
+ $entity->{PMX_content_types} = $unpack->{mime};
+
+ if ($opt_testmode) {
+ my $types = join (", ", sort keys (%{$entity->{PMX_content_types}}));
+ my $fh = $msginfo->{test_fh};
+ $filename =~ s/\d+/X/g if $filename =~ m/^msg-\d+-\d+.msg/;
+ print $fh "Types:$filename: $types\n" if $types;
+ }
+
+ my $elapsed = int(tv_interval ($start) * 1000);
+
+ $self->log (3, "$queue->{logid}: unpack archive '$filename' done ($elapsed ms)");
+ }
+ }
+
+ foreach my $part ($entity->parts) {
+ $self->unpack_entity ($unpack, $part, $msginfo, $queue);
+ }
+
+}
+
+sub handle_smtp {
+ my ($self, $smtp) = @_;
+
+ my ($csec, $usec) = gettimeofday ();
+
+ my $queue;
+ my $msginfo = {};
+ my $system_cfg = $self->{system_cfg};
+ my $ldap = $self->{ldap};
+ my $cinfo = $self->{cinfo};
+ my $lcid = $cinfo->{local}->{cid};
+
+ $msginfo->{test_fh} = Proxmox::AtomicFile->new ("testresult.out", "w")
+ if $opt_testmode;
+
+ $msginfo->{trusted} = $self->{trusted};
+
+
+# PHASE 1 - save incoming mail (already done)
+# on error: exit
+
+ $queue = $smtp->{queue};
+ $queue->{sa} = $self->{sa};
+
+ $queue->{bulk_score} = $system_cfg->get ('spam', 'bulk_score');
+
+ my $lic = $system_cfg->{license};
+ $queue->{lic_valid} = ($lic->valid && !$lic->expired) ? 1 : 0;
+
+ my $matching_rules;
+
+ eval {
+ $msginfo->{testmode} = $opt_testmode;
+ $msginfo->{sender} = $smtp->{from};
+ $msginfo->{xforward} = $smtp->{xforward};
+ $msginfo->{targets} = $smtp->{to};
+
+ $msginfo->{hostname} = $system_cfg->get ('dns', 'hostname');
+ $msginfo->{domain} = $system_cfg->get ('dns', 'domain');
+ $msginfo->{fqdn} = "$msginfo->{hostname}.$msginfo->{domain}";
+ $msginfo->{lcid} = $lcid;
+
+ # $msginfo->{targets} is case sensitive,
+ # but pmail is always lower case!
+
+ foreach my $t (@{$msginfo->{targets}}) {
+ my $res;
+ if ($ldap && ($res = $ldap->account_info ($t))) {
+ $msginfo->{pmail}->{$t} = $res->{pmail};
+ } else {
+ $msginfo->{pmail}->{$t} = lc ($t);
+ }
+ }
+
+# PHASE 2 - parse mail
+# on error: exit
+
+ my $maxfiles = $system_cfg->get ('clamav', 'archivemaxfiles') || 0;
+
+ my $entity = $queue->parse_mail ($maxfiles);
+
+ $self->log (3, "$queue->{logid}: new mail message-id=%s", $queue->{msgid});
+
+# PHASE 3 - run external content analyzers
+# (SPAM analyzer is run on demand later)
+# on error: log error messages
+
+
+ # test for virus first
+ $queue->{vinfo} = Proxmox::Utils::analyze_virus ($queue, $queue->{dataname},
+ $system_cfg, $opt_testmode);
+
+ # commtouch scanner
+ # only run with valid license
+ # do not run when we already detected a virus
+ # do not run for outbound mail (requires separate ctasd)
+
+ $queue->{ptime_commtouch} = 0;
+
+ if ($opt_testmode ||
+ ($queue->{lic_valid} && !$queue->{vinfo} && !$msginfo->{trusted})) {
+ my ($ct_refid, $ct_spam, $ct_vod, $ct_virus);
+ my ($csec, $usec) = gettimeofday ();
+ eval {
+
+ ($ct_refid, $ct_spam, $ct_vod, $ct_virus) =
+ Proxmox::Commtouch::ctasd_classify($queue->{dataname}, $queue->{from});
+ };
+ my $err = $@;
+
+ my ($csec_end, $usec_end) = gettimeofday ();
+ $queue->{ptime_commtouch} =
+ int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
+
+ if ($err) {
+ syslog ('err', "ctasd error: %s", $err);
+ $queue->{errors} = 1;
+ } else {
+ if ($ct_virus) {
+ syslog ('info', "$queue->{logid}: virus detected: $ct_virus (commtouch)");
+ $queue->{vinfo_commtouch} = $ct_virus;
+ $queue->{vinfo} = "$ct_virus (commtouch)";
+ }
+
+ if ($ct_spam && $ct_spam eq 'Confirmed') {
+ syslog ('info', "$queue->{logid}: known spam mail (confirmed by commtouch)");
+ }
+
+ $queue->{commtouch_spam} = $ct_spam;
+ $queue->{commtouch_vod} = $ct_vod;
+
+ if ($opt_testmode) {
+ $queue->{commtouch_refid} = "FAKEK_COMTOUCH_REFID(testmode)";
+ } else {
+ $queue->{commtouch_refid} = $ct_refid;
+ }
+ }
+ }
+
+ # always add this headers to incoming mails
+ # to enable user to report false negatives
+ if (!$msginfo->{trusted}) {
+ if (!$queue->{lic_valid}) {
+ $entity->head->replace('X-Proxmox-License', 'Invalid');
+ }
+
+ if ($queue->{vinfo}) {
+ $entity->head->replace('X-Proxmox-VInfo', $queue->{vinfo});
+ }
+
+ if ($queue->{commtouch_refid}) {
+ $entity->head->replace('X-Proxmox-CTCH-Refid', $queue->{commtouch_refid});
+ }
+ }
+
+ # we unpack after virus scanning, because this is more secure.
+ # This way virus scanners gets the whole mail files and are able
+ # to detect phishing signature for example - which would not work
+ # if we decompose first and only analyze the decomposed attachments.
+ # Disadvantage is that we need to unpack more than
+ # once (bad performance).
+
+ # should we scan content types inside archives
+
+
+ my $rulecache = $self->{rulecache};
+
+ my $scan_archives = 0;
+
+ if (($rulecache->{archivefilter_in} && !$msginfo->{trusted}) ||
+ ($rulecache->{archivefilter_out} && $msginfo->{trusted})) {
+ $scan_archives = 1;
+ }
+
+ if ($scan_archives && !$queue->{vinfo}) {
+
+ # unpack all archives - determine contained content types
+
+ my $decdir = $queue->{dumpdir} . "/__decoded_archives";
+ mkdir $decdir;
+
+ my $start = [gettimeofday];
+
+ my $unpack;
+ eval {
+
+ # limits: We use clamav limit for maxfiles, and scan
+ # only 4 levels, timeout of 30 seconds
+
+ $unpack = Proxmox::Unpack->new (tmpdir => $decdir,
+ timeout => 30,
+ ctonly => 1, # only detect CTs
+ maxrec => -4,
+ maxfiles => $maxfiles);
+
+ $self->unpack_entity ($unpack, $entity, $msginfo, $queue);
+ };
+
+ my $err = $@;
+
+ $unpack->cleanup() if $unpack;
+
+ my $elapsed = int(tv_interval ($start) * 1000);
+
+ if ($err) {
+ $self->log (3, "$queue->{logid}: unpack archive failed ($elapsed ms) - $err");
+ }
+ }
+
+# PHASE 4 - apply rules
+# on error: exit (cleanup process should do the rest)
+ $msginfo->{maxspamsize} = $system_cfg->get ('spam', 'maxspamsize');
+ if ($msginfo->{maxspamsize} <= 1024*64) {
+ $msginfo->{maxspamsize} = 1024*64;
+ }
+
+ if ($msginfo->{trusted}) {
+ my $hide = $system_cfg->get ('mail', 'hide_received');
+ $entity->head->delete("Received") if $hide;
+ }
+
+ $matching_rules = $self->apply_rules ($queue, $msginfo, $entity, $ldap);
+ };
+
+ my $err = $@;
+
+ $self->{errors} = $queue->{errors};
+
+ # restart on error
+ $self->{errors} = 1 if $err;
+
+ $queue->close ();
+
+ die $err if $err;
+
+ my ($csec_end, $usec_end) = gettimeofday ();
+ my $time_total =
+ int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
+
+# PHASE 5 - log statistics
+# on error: log error messages
+
+ eval {
+ my $dbh = $self->{ruledb}->{dbh};
+ my $where = "";
+ foreach my $rid (@$matching_rules) {
+ $where .= $where ? " OR ID = $rid" : "ID = $rid";
+ }
+ if ($where) {
+ $dbh->do ("UPDATE Rule " .
+ "SET Count = Count + 1 " .
+ "WHERE $where");
+ }
+
+ my $insert_cmds = "SELECT nextval ('cstatistic_id_seq');INSERT INTO CStatistic " .
+ "(CID, RID, ID, Time, Bytes, Direction, Spamlevel, VirusInfo, PTime, Sender) VALUES (" .
+ "$lcid, currval ('cstatistic_id_seq'), currval ('cstatistic_id_seq'),";
+
+ $insert_cmds .= $queue->{rtime} . ',';
+ $insert_cmds .= $queue->{bytes} . ',';
+ $insert_cmds .= $dbh->quote ($msginfo->{trusted} ? 0 : 1) . ',';
+ $insert_cmds .= ($queue->{sa_score} || 0) . ',';
+ $insert_cmds .= $dbh->quote ($queue->{vinfo}) . ',';
+ $insert_cmds .= $time_total . ',';
+ $insert_cmds .= $dbh->quote ($msginfo->{sender}) . ');';
+
+ foreach my $r (@{$msginfo->{targets}}) {
+ my $tmp = $dbh->quote ($r);
+ my $blocked = $queue->{status}->{$r} eq 'blocked' ? 1 : 0;
+ $insert_cmds .= "INSERT INTO CReceivers (CStatistic_CID, CStatistic_RID, Receiver, Blocked) " .
+ "VALUES ($lcid, currval ('cstatistic_id_seq'), $tmp, '$blocked'); ";
+ }
+
+ $dbh->do ($insert_cmds);
+ };
+
+ # save $err (because log clears $@)
+ $err = $@;
+
+ $time_total = $time_total/1000;
+
+ my $ptspam = ($queue->{ptime_spam} || 0)/1000;
+ my $ptcommtouch = ($queue->{ptime_commtouch} || 0)/1000;
+ my $ptavira = ($queue->{ptime_avira} || 0)/1000;
+ my $ptclam = ($queue->{ptime_clam} || 0)/1000;
+
+ $self->log (3, "$queue->{logid}: processing time: ${time_total} seconds ($ptcommtouch, $ptspam, $ptclam, $ptavira)");
+
+ $msginfo->{test_fh}->close if $opt_testmode;
+
+ die $err if ($err);
+}
+
+
+sub process_request {
+ my $self = shift;
+ my $prop = $self->{server};
+ my $sock = $prop->{client};
+
+ eval {
+
+ # make sure the ldap cache is up to date
+ $self->{ldap}->update (1);
+
+ $self->load_config() if $self->{reload_config};
+
+ $self->{trusted} = 0;
+ if ($prop->{sockport} == $opt_int_port && !$opt_untrusted) {
+ $self->{trusted} = 1;
+ }
+
+ my $smtp = Proxmox::SMTP->new ($sock);
+
+ my $maxcount = $max_requests - $prop->{requests};
+
+ my $count = $smtp->loop (\&handle_smtp, $self, $maxcount);
+ if ($count > 1) {
+ $prop->{requests} += $count - 1;
+ }
+ };
+
+ my $err = $@;
+
+ $self->log (0, $err) if $err;
+
+ kill (15, $prop->{ppid}) if $opt_testmode;
+
+ my $mem = Proxmox::Utils::get_mem_usage();
+
+ if ($opt_testmode) {
+ $self->log (0, "memory usage: $mem->{size} bytes");
+ } else {
+ if ($self->{errors}) {
+ $self->log (0, "fast exit because of errors (free $mem->{size} bytes)");
+ $self->done (1);
+ } elsif ($mem->{size} > (300*1024*1024)) {
+ $self->log (0, "fast exit to reduce server load (free $mem->{size} bytes)");
+ $self->done (1);
+ }
+ }
+
+ $self->done (1) if $err;
+}
+
+# test sig_hup with: for ((;;)) ;do kill -HUP `cat /var/run/proxprox.pid`; done;
+# wrapper to avoid multiple calls to sig_hup
+sub sig_hup {
+ my $self = shift;
+ my $prop = $self->{server};
+
+ return if defined ($prop->{_HUP}); # do not call twice
+
+ $self->SUPER::sig_hup();
+}
+
+sub restart_close_hook {
+ my $self = shift;
+
+ my $sig_set = POSIX::SigSet->new;
+ $sig_set->addset (&POSIX::SIGHUP);
+ $sig_set->addset (&POSIX::SIGCHLD); # to avoid zombies
+ my $old_sig_set = POSIX::SigSet->new();
+
+ sigprocmask (SIG_BLOCK, $sig_set, $old_sig_set);
+}
+
+sub pre_server_close_hook {
+ my $self = shift;
+ my $prop = $self->{server};
+
+ if (defined $prop->{_HUP}) {
+ undef $prop->{pid_file_unlink};
+ }
+
+ if (defined $prop->{children}) {
+ foreach my $pid (keys %{$prop->{children}}) {
+ kill (1, $pid); # HUP childs
+ }
+ }
+
+ # nicely shutdown childs (give them max 30 seconds to shut down)
+ my $previous_alarm = alarm (30);
+ eval {
+ local $SIG{ALRM} = sub { die "Timed Out!\n" };
+
+ my $pid;
+ 1 while ((($pid = waitpid (-1, 0)) > 0) || ($! == EINTR));
+ };
+ alarm ($previous_alarm);
+}
+
+# initialize mime system before fork
+xdg_mime_get_mime_type_for_file ($0);
+
+my $server = bless {
+ server => $server_attr,
+};
+
+if (!$opt_testmode) {
+ $server->run ();
+} else {
+ if (fork) {
+ $server->run ();
+ } else {
+ sleep (1);
+ my $sender ='sender@proxtest.com';
+ my $targets = ['target1@proxtest.com',
+ 'target2@proxtest.com',
+ 'target3@proxtest.com'];
+
+ my $smtp = Net::SMTP->new ('127.0.0.1', Port => 10023);
+
+ die "unable to connect $!" if !$smtp;
+
+ # syslog ('info', "connected to " . $smtp->domain);
+
+ $smtp->mail ($sender);
+ $smtp->to (@$targets);
+
+ $smtp->data();
+
+ open (TMP, $opt_testmode) ||
+ croak ("unable to upen file '$opt_testmode' - $! :ERROR");
+ while (<TMP>) {
+ $smtp->datasend ($_);
+ }
+ close TMP;
+
+ $smtp->datasend ("\n");
+ $smtp->dataend ();
+
+ $smtp->quit;
+ }
+}
+
+exit (0);
+
+__END__
+
+=head1 NAME
+
+proxprox - the Proxmox mail filter
+
+=head1 SYNOPSIS
+
+proxprox [-u] [-t testfile]
+
+=head1 DESCRIPTION
+
+Documentation is available at www.proxmox.com
+
+
+
projects / pmg-api.git / commitdiff