PMG/Utils.pm

   1 package PMG::Utils;
   2
   3 use strict;
   4 use warnings;
   5 use DBI;
   6 use Net::Cmd;
   7 use Net::SMTP;
   8 use IO::File;
   9 use File::stat;
  10 use POSIX qw(strftime);
  11 use File::stat;
  12 use File::Basename;
  13 use MIME::Words;
  14 use MIME::Parser;
  15 use Time::HiRes qw (gettimeofday);
  16 use Xdgmime;
  17 use Data::Dumper;
  18 use Net::IP;
  19 use Socket;
  20
  21 use PVE::Network;
  22 use PVE::Tools;
  23 use PVE::SafeSyslog;
  24 use PVE::ProcFSTools;
  25 use PMG::AtomicFile;
  26 use PMG::MailQueue;
  27 use PMG::SMTPPrinter;
  28
  29 sub msgquote {
  30     my $msg = shift || '';
  31     $msg =~ s/%/%%/g;
  32     return $msg;
  33 }
  34
  35 sub lastid {
  36     my ($dbh, $seq) = @_;
  37
  38     return $dbh->last_insert_id(
  39         undef, undef, undef, undef, { sequence => $seq});
  40 }
  41
  42 sub file_older_than {
  43     my ($filename, $lasttime) = @_;
  44
  45     my $st = stat($filename);
  46
  47     return 0 if !defined($st);
  48
  49     return ($lasttime >= $st->ctime);
  50 }
  51
  52 sub extract_filename {
  53     my ($head) = @_;
  54
  55     if (my $value = $head->recommended_filename()) {
  56         chomp $value;
  57         if (my $decvalue = MIME::Words::decode_mimewords($value)) {
  58             $decvalue =~ s/\0/ /g;
  59             $decvalue = PVE::Tools::trim($decvalue);
  60             return $decvalue;
  61         }
  62     }
  63
  64     return undef;
  65 }
  66
  67 sub remove_marks {
  68     my ($entity, $add_id, $id) = @_;
  69
  70     $id //= 1;
  71
  72     foreach my $tag (grep {/^x-proxmox-tmp/i} $entity->head->tags) {
  73         $entity->head->delete ($tag);
  74     }
  75
  76     $entity->head->replace('X-Proxmox-tmp-AID', $id) if $add_id;
  77
  78     foreach my $part ($entity->parts)  {
  79         $id = remove_marks($part, $add_id, $id + 1);
  80     }
  81
  82     return $id;
  83 }
  84
  85 sub subst_values {
  86     my ($body, $dh) = @_;
  87
  88     return if !$body;
  89
  90     foreach my $k (keys %$dh) {
  91         my $v = $dh->{$k};
  92         if (defined($v)) {
  93             $body =~ s/__\Q${k}\E__/$v/gs;
  94         }
  95     }
  96
  97     return $body;
  98 }
  99
 100 sub reinject_mail {
 101     my ($entity, $sender, $targets, $xforward, $me, $nodsn) = @_;
 102
 103     my $smtp;
 104     my $resid;
 105     my $rescode;
 106     my $resmess;
 107
 108     eval {
 109         my $smtp = Net::SMTP->new('127.0.0.1', Port => 10025, Hello => $me) ||
 110             die "unable to connect to localhost at port 10025";
 111
 112         if (defined($xforward)) {
 113             my $xfwd;
 114
 115             foreach my $attr (keys %{$xforward}) {
 116                 $xfwd .= " $attr=$xforward->{$attr}";
 117             }
 118
 119             if ($xfwd && $smtp->command("XFORWARD", $xfwd)->response() != CMD_OK) {
 120                 syslog('err', "xforward error - got: %s %s", $smtp->code, scalar($smtp->message));
 121             }
 122         }
 123
 124         if (!$smtp->mail($sender)) {
 125             syslog('err', "smtp error - got: %s %s", $smtp->code, scalar ($smtp->message));
 126             die "smtp from: ERROR";
 127         }
 128
 129         my $dsnopts = $nodsn ? {Notify => ['NEVER']} : {};
 130
 131         if (!$smtp->to (@$targets, $dsnopts)) {
 132             syslog ('err', "smtp error - got: %s %s", $smtp->code, scalar($smtp->message));
 133             die "smtp to: ERROR";
 134         }
 135
 136         # Output the head:
 137         #$entity->sync_headers ();
 138         $smtp->data();
 139
 140         my $out = PMG::SMTPPrinter->new($smtp);
 141         $entity->print($out);
 142
 143         # make sure we always have a newline at the end of the mail
 144         # else dataend() fails
 145         $smtp->datasend("\n");
 146
 147         if ($smtp->dataend()) {
 148             my @msgs = $smtp->message;
 149             $resmess = $msgs[$#msgs];
 150             ($resid) = $resmess =~ m/Ok: queued as ([0-9A-Z]+)/;
 151             $rescode = $smtp->code;
 152             if (!$resid) {
 153                 die sprintf("unexpected SMTP result - got: %s %s : WARNING", $smtp->code, $resmess);
 154             }
 155         } else {
 156             my @msgs = $smtp->message;
 157             $resmess = $msgs[$#msgs];
 158             $rescode = $smtp->code;
 159             die sprintf("sending data failed - got: %s %s : ERROR", $smtp->code, $resmess);
 160         }
 161     };
 162     my $err = $@;
 163
 164     $smtp->quit if $smtp;
 165
 166     if ($err) {
 167         syslog ('err', $err);
 168     }
 169
 170     return wantarray ? ($resid, $rescode, $resmess) : $resid;
 171 }
 172
 173 sub analyze_virus_clam {
 174     my ($queue, $dname, $pmg_cfg) = @_;
 175
 176     my $timeout = 60*5;
 177     my $vinfo;
 178
 179     my $clamdscan_opts = "--stdout";
 180
 181     my ($csec, $usec) = gettimeofday();
 182
 183     my $previous_alarm;
 184
 185     eval {
 186
 187         $previous_alarm = alarm($timeout);
 188
 189         $SIG{ALRM} = sub {
 190             die "$queue->{logid}: Maximum time ($timeout sec) exceeded. " .
 191                 "virus analyze (clamav) failed: ERROR";
 192         };
 193
 194         open(CMD, "/usr/bin/clamdscan $clamdscan_opts '$dname'|") ||
 195             die "$queue->{logid}: can't exec clamdscan: $! : ERROR";
 196
 197         my $ifiles;
 198
 199         my $response = '';
 200         while (defined(my $line = <CMD>)) {
 201             if ($line =~ m/^$dname.*:\s+([^ :]*)\s+FOUND$/) {
 202                 # we just use the first detected virus name
 203                 $vinfo = $1 if !$vinfo;
 204             } elsif ($line =~ m/^Infected files:\s(\d*)$/i) {
 205                 $ifiles = $1;
 206             }
 207
 208             $response .= $line;
 209         }
 210
 211         close(CMD);
 212
 213         alarm(0); # avoid race conditions
 214
 215         if (!defined($ifiles)) {
 216             die "$queue->{logid}: got undefined output from " .
 217                 "virus detector: $response : ERROR";
 218         }
 219
 220         if ($vinfo) {
 221             syslog('info', "$queue->{logid}: virus detected: $vinfo (clamav)");
 222         }
 223     };
 224     my $err = $@;
 225
 226     alarm($previous_alarm);
 227
 228     my ($csec_end, $usec_end) = gettimeofday();
 229     $queue->{ptime_clam} =
 230         int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);
 231
 232     if ($err) {
 233         syslog ('err', $err);
 234         $vinfo = undef;
 235         $queue->{errors} = 1;
 236     }
 237
 238     $queue->{vinfo_clam} = $vinfo;
 239
 240     return $vinfo ? "$vinfo (clamav)" : undef;
 241 }
 242
 243 sub analyze_virus {
 244     my ($queue, $filename, $pmg_cfg, $testmode) = @_;
 245
 246     # TODO: support other virus scanners?
 247
 248     # always scan with clamav
 249     return analyze_virus_clam($queue, $filename, $pmg_cfg);
 250 }
 251
 252 sub magic_mime_type_for_file {
 253     my ($filename) = @_;
 254
 255     # we do not use get_mime_type_for_file, because that considers
 256     # filename extensions - we only want magic type detection
 257
 258     my $bufsize = Xdgmime::xdg_mime_get_max_buffer_extents();
 259     die "got strange value for max_buffer_extents" if $bufsize > 4096*10;
 260
 261     my $ct = "application/octet-stream";
 262
 263     my $fh = IO::File->new("<$filename") ||
 264         die "unable to open file '$filename' - $!";
 265
 266     my ($buf, $len);
 267     if (($len = $fh->read($buf, $bufsize)) > 0) {
 268         $ct = xdg_mime_get_mime_type_for_data($buf, $len);
 269     }
 270     $fh->close();
 271
 272     die "unable to read file '$filename' - $!" if ($len < 0);
 273
 274     return $ct;
 275 }
 276
 277 sub add_ct_marks {
 278     my ($entity) = @_;
 279
 280     if (my $path = $entity->{PMX_decoded_path}) {
 281
 282         # set a reasonable default if magic does not give a result
 283         $entity->{PMX_magic_ct} = $entity->head->mime_attr('content-type');
 284
 285         if (my $ct = magic_mime_type_for_file($path)) {
 286             if ($ct ne 'application/octet-stream' || !$entity->{PMX_magic_ct}) {
 287                 $entity->{PMX_magic_ct} = $ct;
 288             }
 289         }
 290
 291         my $filename = $entity->head->recommended_filename;
 292         $filename = basename($path) if !defined($filename) || $filename eq '';
 293
 294         if (my $ct = xdg_mime_get_mime_type_from_file_name($filename)) {
 295             $entity->{PMX_glob_ct} = $ct;
 296         }
 297     }
 298
 299     foreach my $part ($entity->parts)  {
 300         add_ct_marks ($part);
 301     }
 302 }
 303
 304 # x509 certificate utils
 305
 306 # only write output if something fails
 307 sub run_silent_cmd {
 308     my ($cmd) = @_;
 309
 310     my $outbuf = '';
 311
 312     my $record_output = sub {
 313         $outbuf .= shift;
 314         $outbuf .= "\n";
 315     };
 316
 317     eval {
 318         PVE::Tools::run_command($cmd, outfunc => $record_output,
 319                                 errfunc => $record_output);
 320     };
 321     my $err = $@;
 322
 323     if ($err) {
 324         print STDERR $outbuf;
 325         die $err;
 326     }
 327 }
 328
 329 my $proxmox_tls_cert_fn = "/etc/pmg/pmg-tls.pem";
 330
 331 sub gen_proxmox_tls_cert {
 332     my ($force) = @_;
 333
 334     my $resolv = PVE::INotify::read_file('resolvconf');
 335     my $domain = $resolv->{search};
 336
 337     my $company = $domain; # what else ?
 338     my $cn = "*.$domain";
 339
 340    return if !$force && -f $proxmox_tls_cert_fn;
 341
 342     my $sslconf = <<__EOD__;
 343 RANDFILE = /root/.rnd
 344 extensions = v3_req
 345
 346 [ req ]
 347 default_bits = 4096
 348 distinguished_name = req_distinguished_name
 349 req_extensions = v3_req
 350 prompt = no
 351 string_mask = nombstr
 352
 353 [ req_distinguished_name ]
 354 organizationalUnitName = Proxmox Mail Gateway
 355 organizationName = $company
 356 commonName = $cn
 357
 358 [ v3_req ]
 359 basicConstraints = CA:FALSE
 360 nsCertType = server
 361 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 362 __EOD__
 363
 364     my $cfgfn = "/tmp/pmgtlsconf-$$.tmp";
 365     my $fh = IO::File->new ($cfgfn, "w");
 366     print $fh $sslconf;
 367     close ($fh);
 368
 369     eval {
 370         my $cmd = ['openssl', 'req', '-batch', '-x509', '-new', '-sha256',
 371                    '-config', $cfgfn, '-days', 3650, '-nodes',
 372                    '-out', $proxmox_tls_cert_fn,
 373                    '-keyout', $proxmox_tls_cert_fn];
 374         run_silent_cmd($cmd);
 375     };
 376
 377     if (my $err = $@) {
 378         unlink $proxmox_tls_cert_fn;
 379         unlink $cfgfn;
 380         die "unable to generate proxmox certificate request:\n$err";
 381     }
 382
 383     unlink $cfgfn;
 384 }
 385
 386 sub find_local_network_for_ip {
 387     my ($ip) = @_;
 388
 389     my $testip = Net::IP->new($ip);
 390
 391     my $isv6 = $testip->version == 6;
 392     my $routes = $isv6 ?
 393         PVE::ProcFSTools::read_proc_net_ipv6_route() :
 394         PVE::ProcFSTools::read_proc_net_route();
 395
 396     foreach my $entry (@$routes) {
 397         my $mask;
 398         if ($isv6) {
 399             $mask = $entry->{prefix};
 400             next if !$mask; # skip the default route...
 401         } else {
 402             $mask = $PVE::Network::ipv4_mask_hash_localnet->{$entry->{mask}};
 403             next if !defined($mask);
 404         }
 405         my $cidr = "$entry->{dest}/$mask";
 406         my $testnet = Net::IP->new($cidr);
 407         my $overlap = $testnet->overlaps($testip);
 408         if ($overlap == $Net::IP::IP_B_IN_A_OVERLAP ||
 409             $overlap == $Net::IP::IP_IDENTICAL)
 410         {
 411             return $cidr;
 412         }
 413     }
 414
 415     die "unable to detect local network for ip '$ip'\n";
 416 }
 417
 418 sub service_cmd {
 419     my ($service, $cmd) = @_;
 420
 421     die "unknown service command '$cmd'\n"
 422         if $cmd !~ m/^(start|stop|restart|reload)$/;
 423
 424     if ($service eq 'pmgdaemon' || $service eq 'pmgproxy') {
 425         if ($cmd eq 'restart') {
 426             # OK
 427         } else {
 428             die "invalid service cmd '$service $cmd': ERROR";
 429         }
 430     }
 431
 432     $service = 'postfix@-' if $service eq 'postfix';
 433     PVE::Tools::run_command(['systemctl', $cmd, $service]);
 434 };
 435
 436 # this is also used to get the IP of the local node
 437 sub lookup_node_ip {
 438     my ($nodename, $noerr) = @_;
 439
 440     my ($family, $packed_ip);
 441
 442     eval {
 443         my @res = PVE::Tools::getaddrinfo_all($nodename);
 444         $family = $res[0]->{family};
 445         $packed_ip = (PVE::Tools::unpack_sockaddr_in46($res[0]->{addr}))[2];
 446     };
 447
 448     if ($@) {
 449         die "hostname lookup failed:\n$@" if !$noerr;
 450         return undef;
 451     }
 452
 453     my $ip = Socket::inet_ntop($family, $packed_ip);
 454     if ($ip =~ m/^127\.|^::1$/) {
 455         die "hostname lookup failed - got local IP address ($nodename = $ip)\n" if !$noerr;
 456         return undef;
 457     }
 458
 459     return wantarray ? ($ip, $family) : $ip;
 460 }
 461
 462 sub run_postmap {
 463     my ($filename) = @_;
 464
 465     # make sure the file exists (else postmap fails)
 466     IO::File->new($filename, 'a', 0644);
 467
 468     eval {
 469         PVE::Tools::run_command(
 470             ['/usr/sbin/postmap', $filename],
 471             errmsg => "unable to update postfix table $filename");
 472     };
 473     my $err = $@;
 474
 475     warn $err if $err;
 476 }
 477
 478 sub clamav_dbstat {
 479
 480     my $res = [];
 481
 482     my $read_cvd_info = sub {
 483         my ($dbname, $dbfile) = @_;
 484
 485         my $header;
 486         my $fh = IO::File->new("<$dbfile");
 487         if (!$fh) {
 488             warn "cant open ClamAV Database $dbname ($dbfile) - $!\n";
 489             return;
 490         }
 491         $fh->read($header, 512);
 492         $fh->close();
 493
 494         ## ClamAV-VDB:16 Mar 2016 23-17 +0000:57:4218790:60:06386f34a16ebeea2733ab037f0536be:
 495         if ($header =~ m/^(ClamAV-VDB):([^:]+):(\d+):(\d+):/) {
 496             my ($ftype, $btime, $version, $nsigs) = ($1, $2, $3, $4);
 497             push @$res, {
 498                 name => $dbname,
 499                 type => $ftype,
 500                 build_time => $btime,
 501                 version => $version,
 502                 nsigs => $nsigs,
 503             };
 504         } else {
 505             warn "unable to parse ClamAV Database $dbname ($dbfile)\n";
 506         }
 507     };
 508
 509     # main database
 510     my $filename = "/var/lib/clamav/main.inc/main.info";
 511     $filename = "/var/lib/clamav/main.cvd" if ! -f $filename;
 512
 513     $read_cvd_info->('main', $filename) if -f $filename;
 514
 515     # daily database
 516     $filename = "/var/lib/clamav/daily.inc/daily.info";
 517     $filename = "/var/lib/clamav/daily.cvd" if ! -f $filename;
 518     $filename = "/var/lib/clamav/daily.cld" if ! -f $filename;
 519
 520     $read_cvd_info->('daily', $filename) if -f $filename;
 521
 522     $filename = "/var/lib/clamav/bytecode.cvd";
 523     $read_cvd_info->('bytecode', $filename) if -f $filename;
 524
 525     my $last = 0;
 526     my $nsigs = 0;
 527     foreach $filename (</var/lib/clamav/*>) {
 528         next if $filename !~ m/\.(ndb|hdb)$/;
 529         my $fh = IO::File->new("<$filename");
 530         next if !defined($fh);
 531         my $st = stat($fh);
 532         next if !$st;
 533         my $mtime = $st->mtime();
 534         $last = $mtime if $mtime > $last;
 535         while (defined(my $line = <$fh>)) { $nsigs++; }
 536     }
 537
 538     if ($nsigs > 0) {
 539         push @$res, {
 540             name => 'Sanesecurity',
 541             type => 'unofficial',
 542             build_time => strftime("%d %b %Y %H-%M", localtime($last)),
 543             nsigs => $nsigs,
 544         };
 545     }
 546
 547     return $res;
 548 }
 549
 550 1;