Subject: Bug#740004: amavisd-new: Sophos SAVI configuration in ./15-av_scanners outdated

From: Max Techter <[email-masked]>
Date: Mon, 24 Feb 2014 21:49:03 +0100

Package: amavisd-new
Version: 1:2.7.1-2
Severity: normal

Hi,

in the debian package in /etc/amavis/conf.d/15-av_scanners we have:

   # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
   # ['Sophos SAVI', \&sophos_savi ],

in the upstream source in ./amavisd-new-2.7.1/amavisd.conf we have:

   # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
   # ['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],

configuring

   ['Sophos SAVI', \&sophos_savi ],

I end up with: `ALL VIRUS SCANNERS FAILED' in ./mail.log, due to `&Amavis::Conf::sophos_savi' being Undefined:

	Creating db in /var/lib/amavis/db/; BerkeleyDB 0.51, libdb 5.1
        (!)Sophos SAVI av-scanner FAILED: Undefined subroutine &Amavis::Conf::sophos_savi called at (eval 117)[/usr/sbin/amavisd-new:15931] line 939.
	(!)WARN: all primary virus scanners failed, considering backups
	(!!)AV: ALL VIRUS SCANNERS FAILED

configuring

   ['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],

there seems to be no problem, SAVI does its job.

Starting as `/etc/init.d/amavis debug'

   telneting a test mail leads to debug output

	invoking av-scanner Sophos SAVI
	ask_daemon: proto=savi-perl, spawn=0, (Sophos SAVI) savi-perl:
	run_av (Sophos SAVI): query template(1,0): *
	get_deadline run_av_pre - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_pre: timer 336, was 336, deadline in 479.9 s
	get_deadline run_av_scan - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_scan: timer 336, was 336, deadline in 479.9 s
	run_av Using (Sophos SAVI): (code) p001
	get_deadline run_av_3 - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_3: timer 336, was 336, deadline in 479.9 s
	run_av (Sophos SAVI) result: CLEAN p001
	run_av (Sophos SAVI): CLEAN
	run_av (Sophos SAVI) result: clean

   telneting an eicar test mail leads to debug output

	invoking av-scanner Sophos SAVI
	ask_daemon: proto=savi-perl, spawn=0, (Sophos SAVI) savi-perl:
	run_av (Sophos SAVI): query template(1,0): *
	get_deadline run_av_pre - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_pre: timer 336, was 336, deadline in 479.9 s
	get_deadline run_av_scan - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_scan: timer 336, was 336, deadline in 479.9 s
	run_av Using (Sophos SAVI): (code) p001
	get_deadline run_av_3 - deadline in 479.9 s, set to 336.000 s
	prolong_timer run_av_3: timer 336, was 336, deadline in 479.9 s
	run_av (Sophos SAVI) result: EICAR-AV-Test FOUND
	run_av (Sophos SAVI): p001 INFECTED: EICAR-AV-Test
	lookup_re("EICAR-AV-Test"), no matches
	lookup [virus_name_to_spam_score] => undef, "EICAR-AV-Test" does not match
	virus_scan: (EICAR-AV-Test), detected by 1 scanners: Sophos SAVI

ie. in /etc/amavis/conf.d/15-av_scanners

it should be, as in the upstream conf file:

   # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
   # ['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],

instead of

   # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
   # ['Sophos SAVI', \&sophos_savi ],

regards
max.

-- System Information:
Debian Release: 7.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 3.2.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages amavisd-new depends on:
ii  adduser                             3.113+nmu3
ii  debconf [debconf-2.0]               1.5.49
ii  file                                5.11-2+deb7u1
ii  libarchive-zip-perl                 1.30-6
ii  libberkeleydb-perl                  0.51-1
ii  libconvert-tnef-perl                0.17-11
ii  libconvert-uulib-perl               1:1.4~dfsg-1+b1
pn  libdigest-md5-perl                  <none>
ii  libio-stringy-perl                  2.110-5
ii  libmail-dkim-perl                   0.39-1
ii  libmailtools-perl                   2.09-1
pn  libmime-base64-perl                 <none>
ii  libmime-tools-perl                  5.503-1
ii  libnet-server-perl                  2.006-1+deb7u1
ii  libunix-syslog-perl                 1.1-2+b2
ii  pax                                 1:20120606-2
ii  perl [libtime-hires-perl]           5.14.2-21+deb7u1
ii  perl-modules [libarchive-tar-perl]  5.14.2-21+deb7u1

Versions of packages amavisd-new recommends:
ii  altermime              0.3.10-7
pn  libnet-patricial-perl  <none>
ii  ripole                 0.2.0+20081101.0215-1

Versions of packages amavisd-new suggests:
ii  apt-listchanges      2.85.11
pn  arj                  <none>
pn  cabextract           <none>
pn  clamav               <none>
pn  clamav-daemon        <none>
ii  cpio                 2.11+dfsg-0.1
pn  dspam                <none>
pn  lha                  <none>
pn  lhasa                <none>
pn  libauthen-sasl-perl  <none>
pn  libdbi-perl          <none>
ii  libmail-dkim-perl    0.39-1
pn  libnet-ldap-perl     <none>
pn  libsnmp-perl         <none>
pn  lzop                 <none>
pn  nomarch              <none>
pn  p7zip                <none>
pn  rpm                  <none>
pn  spamassassin         <none>
pn  unrar                <none>
pn  unrar-free           <none>
pn  zoo                  <none>

-- Configuration Files:
/etc/amavis/conf.d/15-av_scanners changed:
use strict;
@av_scanners = (
['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],
  ### http://www.kaspersky.com/  (kav4mailservers)
  ['KasperskyLab AVP - aveclient',
    ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
     '/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
    '-p /var/run/aveserver -s {}/*',
    [0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
    qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
  ],
  # NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
  # currupted or protected archives are to be handled
  ### http://www.kaspersky.com/
  ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
    '-* -P -B -Y -O- {}', [0,3,6,8], [2,4],    # any use for -A -K   ?
    qr/infected: (.+)/m,
    sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
  ],
  ### The kavdaemon and AVPDaemonClient have been removed from Kasperky
  ### products and replaced by aveserver and aveclient
  ['KasperskyLab AVPDaemonClient',
    [ '/opt/AVP/kavdaemon',       'kavdaemon',
      '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
      '/opt/AVP/AvpTeamDream',    'AvpTeamDream',
      '/opt/AVP/avpdc', 'avpdc' ],
    "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/m ],
    # change the startup-script in /etc/init.d/kavd to:
    #   DPARMS="-* -Y -dl -f=/var/amavis /var/amavis"
    #   (or perhaps:   DPARMS="-I0 -Y -* /var/amavis" )
    # adjusting /var/amavis above to match your $TEMPBASE.
    # The '-f=/var/amavis' is needed if not running it as root, so it
    # can find, read, and write its pid file, etc., see 'man kavdaemon'.
    # defUnix.prf: there must be an entry "*/var/amavis" (or whatever
    #   directory $TEMPBASE specifies) in the 'Names=' section.
    # cd /opt/AVP/DaemonClients; configure; cd Sample; make
    # cp AvpDaemonClient /opt/AVP/
    # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
  ### http://www.centralcommand.com/
  ['CentralCommand Vexira (new) vascan',
    ['vascan','/usr/lib/Vexira/vascan'],
    "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ".
    "--log=/var/log/vascan.log {}",
    [0,3], [1,2,5],
    qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ /m ],
    # Adjust the path of the binary and the virus database as needed.
    # 'vascan' does not allow to have the temp directory to be the same as
    # the quarantine directory, and the quarantine option can not be disabled.
    # If $QUARANTINEDIR is not used, then another directory must be specified
    # to appease 'vascan'. Move status 3 to the second list if password
    # protected files are to be considered infected.
  ### http://www.avira.com/
  ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus
  ['Avira AntiVir', ['antivir','vexira'],
    '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/m,
    qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
         (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/m ],
    # NOTE: if you only have a demo version, remove -z and add 214, as in:
    #  '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
  ### http://www.commandsoftware.com/
  ['Command AntiVirus for Linux', 'csav',
    '-all -archive -packed {}', [50], [51,52,53],
    qr/Infection: (.+)/m ],
  ### http://www.symantec.com/
  ['Symantec CarrierScan via Symantec CommandLineScanner',
    'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
    qr/^Files Infected:\s+0$/m, qr/^Infected\b/m,
    qr/^(?:Info|Virus Name):\s+(.+)/m ],
  ### http://www.symantec.com/
  ['Symantec AntiVirus Scan Engine',
    'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
    [0], qr/^Infected\b/m,
    qr/^(?:Info|Virus Name):\s+(.+)/m ],
    # NOTE: check options and patterns to see which entry better applies
  ### http://www.f-secure.com/products/anti-virus/  version 5.52
   ['F-Secure Antivirus for Linux servers',
    ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
    '--virus-action1=report --archive=yes --auto=yes '.
    '--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8],
    qr/(?:infection|Infected|Suspected|Riskware): (.+)/m ],
    # NOTE: internal archive handling may be switched off by '--archive=no'
    #   to prevent fsav from exiting with status 9 on broken archives
  ['CAI InoculateIT', 'inocucmd',  # retired product
    '-sec -nex {}', [0], [100],
    qr/was infected by virus (.+)/m ],
  # see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html
  ### http://www3.ca.com/Solutions/Product.asp?ID=156  (ex InoculateIT)
  ['CAI eTrust Antivirus', 'etrust-wrapper',
    '-arc -nex -spm h {}', [0], [101],
    qr/is infected by virus: (.+)/m ],
    # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
    # see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783
  ### http://mks.com.pl/english.html
  ['MkS_Vir for Linux (beta)', ['mks32','mks'],
    '-s {}/*', [0], [1,2],
    qr/--[ \t]*(.+)/m ],
  ### http://mks.com.pl/english.html
  ['MkS_Vir daemon', 'mksscan',
    '-s -q {}', [0], [1..7],
    qr/^... (\S+)/m ],
  ### http://www.eset.com/, version 3.0
  ['ESET Software ESETS Command Line Interface',
    ['/usr/bin/esets_cli', 'esets_cli'],
    '--subdir {}', [0], [2,3],
    qr/:\s*action="(?!accepted)[^"]*"\n.*:\s*virus="([^"]*)"/m ],
  ## http://www.nod32.com/,  NOD32LFS version 2.5 and above
  ['ESET NOD32 for Linux File servers',
    ['/opt/eset/nod32/sbin/nod32','nod32'],
    '--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '.
    '-w -a --action=1 -b {}',
    [0], [1,10], qr/^object=.*, virus="(.*?)",/m ],
  ### http://www.norman.com/products_nvc.shtml
  ['Norman Virus Control v5 / Linux', 'nvcc',
    '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
    qr/(?i).* virus in .* -> \'(.+)\'/m ],
  ### http://www.pandasoftware.com/
  ['Panda CommandLineSecure 9 for Linux',
    ['/opt/pavcl/usr/bin/pavcl','pavcl'],
    '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}',
    qr/Number of files infected[ .]*: 0+(?!\d)/m,
    qr/Number of files infected[ .]*: 0*[1-9]/m,
    qr/Found virus :\s*(\S+)/m ],
  # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr'
  # before starting amavisd - the bases are then loaded only once at startup.
  # To reload bases in a signature update script:
  #   /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr
  # Please review other options of pavcl, for example:
  #  -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies
  ### http://www.nai.com/
  ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
    '--secure -rv --mime --summary --noboot - {}', [0], [13],
    qr/(?x) Found (?:
        \ the\ (.+)\ (?:virus|trojan)  |
        \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
        :\ (.+)\ NOT\ a\ virus)/m,
  # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
  # sub {delete $ENV{LD_PRELOAD}},
  ],
  # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
  # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
  # and then clear it when finished to avoid confusing anything else.
  # NOTE2: to treat encrypted files as viruses replace the [13] with:
  #  qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
  ### http://www.virusbuster.hu/en/
  ['VirusBuster', ['vbuster', 'vbengcl'],
    "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
    qr/: '(.*)' - Virus/m ],
  # VirusBuster Ltd. does not support the daemon version for the workstation
  # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
  # binaries, some parameters AND return codes have changed (from 3 to 1).
  # See also the new Vexira entry 'vascan' which is possibly related.
  ### http://www.cyber.com/
  ['CyberSoft VFind', 'vfind',
    '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/m,
  # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
  ],
  ### http://www.avast.com/
  ['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'],
    '-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/m ],
  ### http://www.ikarus-software.com/
  ['Ikarus AntiVirus for Linux', 'ikarus',
    '{}', [0], [40], qr/Signature (.+) found/m ],
  ### http://www.bitdefender.com/
  ['BitDefender', 'bdscan',  # new version
    '--action=ignore --no-list {}', qr/^Infected files *:0+(?!\d)/m,
    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
    qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
  ### http://www.bitdefender.com/
  ['BitDefender', 'bdc',  # old version
    '--arc --mail {}', qr/^Infected files *:0+(?!\d)/m,
    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
    qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
  # consider also: --all --nowarn --alev=15 --flev=15.  The --all argument may
  # not apply to your version of bdc, check documentation and see 'bdc --help'
  ### ArcaVir for Linux and Unix http://www.arcabit.pl/
  ['ArcaVir for Linux', ['arcacmd','arcacmd.static'],
    '-v 1 -summary 0 -s {}', [0], [1,2],
    qr/(?:VIR|WIR):[ \t]*(.+)/m ],
);
@av_scanners_backup = (
  ### http://www.clamav.net/   - backs up clamd or Mail::ClamAV
  ['ClamAV-clamscan', 'clamscan',
    "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
    [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
  ### http://www.f-prot.com/   - backs up F-Prot Daemon, V6
  ['F-PROT Antivirus for UNIX', ['fpscan'],
    '--report --mount --adware {}',  # consider: --applications -s 4 -u 3 -z 10
    [0,8,64],  [1,2,3, 4+1,4+2,4+3, 8+1,8+2,8+3, 12+1,12+2,12+3],
    qr/^\[Found\s+[^\]]*\]\s+<([^ \t(>]*)/m ],
  ### http://www.f-prot.com/   - backs up F-Prot Daemon (old)
  ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
    '-dumb -archive -packed {}', [0,8], [3,6],   # or: [0], [3,6,8],
    qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/m ],
  ### http://www.trendmicro.com/   - backs up Trophie
  ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
    '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ],
  ### http://www.sald.com/, http://drweb.imshop.de/   - backs up DrWebD
  ['drweb - DrWeb Antivirus',  # security LHA hole in Dr.Web 4.33 and earlier
    ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
    '-path={} -al -go -ot -cn -upn -ok-',
    [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'m ],
   ### http://www.kaspersky.com/
   ['Kaspersky Antivirus v5.5',
     ['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner',
      '/opt/kav/5.5/kav4unix/bin/kavscanner',
      '/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'],
     '-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25],
     qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/m,
   ],
);
1;  # ensure a defined return

/etc/amavis/conf.d/15-content_filter_mode changed:
use strict;
@bypass_virus_checks_maps = (
   \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
1;  # ensure a defined return

/etc/init.d/amavis changed:
PATH=/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/sbin/amavisd-new
DAEMON2=/usr/bin/perl
NAME=amavisd
DAEMONNAME=amavisd-new
DESC=amavisd
PIDFILE=/var/run/amavis/${NAME}.pid
. /lib/lsb/init-functions
test -f ${DAEMON} || exit 0
set -e
START="--start --quiet --pidfile $PIDFILE --startas ${DAEMON}"
STOP="--stop --quiet --pidfile $PIDFILE"
PARAMS=
check_noncompatible_upgrade() {
	for i in /etc/amavisd.conf /etc/amavis/amavisd.conf ; do
		if [ -e "${i}.disabled" ] ; then
			echo "Found incompatible config file flag!" >&2
			echo "Due to safety concerns, amavisd-new will not be started." >&2
			echo "Refer to /usr/share/doc/amavisd-new/README.Debian for instructions." >&2
			exit 1
		fi
	done
}
createdir() {
        [ -d "$4" ] || mkdir -p "$4"
        chown -c -h "$1:$2" "$4"
        chmod -c "$3" "$4"
}
fixdirs() {
	dir=$(dpkg-statoverride --list /var/run/amavis) || {
		echo "You are missing a dpkg-statoverride on /var/run/amavis.  Fix it, otherwise you risk silent breakage on upgrades." >&2
		exit 1
	}
	[ -z "$dir" ] || createdir $dir
	:
}
cleanup() {
	[ -d /var/lib/amavis ] &&
	  find /var/lib/amavis -maxdepth 1 -name 'amavis-*' -type d \
	  	-exec rm -rf "{}" \; >/dev/null 2>&1 || true
	[ -d /var/lib/amavis/tmp ] &&
	  find /var/lib/amavis/tmp -maxdepth 1 -name 'amavis-*' -type d \
	  	-exec rm -rf "{}" \; >/dev/null 2>&1 || true
	:
}
case "$1" in
  start)
	echo -n "Starting $DESC: "
	fixdirs
  	check_noncompatible_upgrade
	if start-stop-daemon ${START} -- ${PARAMS} start >/dev/null ; then
		echo "amavisd-new."
	else
		if start-stop-daemon --test ${START} >/dev/null 2>&1; then
			echo "(failed)."
			exit 1
		else
			echo "(already running)."
			exit 0
		fi
	fi
	;;
  stop)
	echo -n "Stopping $DESC: "
	if start-stop-daemon ${STOP} --retry 10 >/dev/null ; then
		cleanup
		echo "amavisd-new."
	else
		if start-stop-daemon --test ${START} >/dev/null 2>&1; then
			echo "(not running)."
			exit 0
		else
			echo "(failed)."
			exit 1
		fi
	fi
	;;
  restart|force-reload)
	$0 stop
	exec $0 start
	;;
  debug|debug-sa)
  	mode="$1"
  	echo "Trying to run amavisd-new in ${mode} mode..."
  	fixdirs
  	check_noncompatible_upgrade
	exec ${DAEMON} ${PARAMS} "${mode}"
	;;
  status)
	status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
	;;
  *)
	N=/etc/init.d/amavis
	#echo "Usage: $N {start|stop|restart|reload|force-reload|debug}" >&2
	echo "Usage: $N {start|stop|restart|force-reload|status|debug}" >&2
	exit 1
	;;
esac
exit 0

-- debconf information:
  amavisd-new/outdated_config_style_warning: