diff options
| author | Carsten Rosenberg <c.rosenberg@heinlein-support.de> | 2019-10-08 21:00:31 +0200 |
|---|---|---|
| committer | Carsten Rosenberg <c.rosenberg@heinlein-support.de> | 2019-10-08 21:00:31 +0200 |
| commit | e45b99bdb699922e4558b2ff28ea5f85a8968d93 (patch) | |
| tree | 4c191bd928bd457f797123f0bd5852c52420583e /lualib/lua_scanners | |
| parent | f6f3788672ea1bc06a03e6d86e0827fee5429c0e (diff) | |
| download | rspamd-e45b99bdb699922e4558b2ff28ea5f85a8968d93.tar.gz rspamd-e45b99bdb699922e4558b2ff28ea5f85a8968d93.zip | |
[Minor] lua_scanners - adopt excrypted / macro support
Diffstat (limited to 'lualib/lua_scanners')
| -rw-r--r-- | lualib/lua_scanners/clamav.lua | 4 | ||||
| -rw-r--r-- | lualib/lua_scanners/oletools.lua | 7 |
2 files changed, 10 insertions, 1 deletions
diff --git a/lualib/lua_scanners/clamav.lua b/lualib/lua_scanners/clamav.lua index f95f96d92..2862ce025 100644 --- a/lualib/lua_scanners/clamav.lua +++ b/lualib/lua_scanners/clamav.lua @@ -140,6 +140,10 @@ local function clamav_check(task, content, digest, rule) rspamd_logger.errx(task, '%s: File is encrypted', rule.log_prefix) common.yield_result(task, rule, 'File is encrypted: '.. vname, 0.0, 'encrypted') cached = 'encrypted' + elseif string.find(vname, '^Heuristics%.OLE2%.ContainsMacros') then + rspamd_logger.errx(task, '%s: ClamAV Found an OLE2 Office Macro', rule.log_prefix) + common.yield_result(task, rule, vname, 0.0, 'macro') + elseif vname then elseif string.find(vname, '^Heuristics%.Limits%.Exceeded') then rspamd_logger.errx(task, '%s: ClamAV Limits Exceeded', rule.log_prefix) common.yield_result(task, rule, 'Limits Exceeded: '.. vname, 0.0, 'fail') diff --git a/lualib/lua_scanners/oletools.lua b/lualib/lua_scanners/oletools.lua index 4bdf7747d..8474a1847 100644 --- a/lualib/lua_scanners/oletools.lua +++ b/lualib/lua_scanners/oletools.lua @@ -184,6 +184,11 @@ local function oletools_check(task, content, digest, rule) end elseif result[3]['return_code'] == 9 then rspamd_logger.warnx(task, '%s: File is encrypted.', rule.log_prefix) + common.yield_result(task, rule, 'failed - err: ' .. oletools_rc[result[3]['return_code']], 0.0, 'encrypted') + common.save_cache(task, digest, rule, 'encrypted') + elseif result[3]['return_code'] == 5 then + rspamd_logger.warnx(task, '%s: olefy could not open the file - error: %s', rule.log_prefix, + result[2]['message']) common.yield_result(task, rule, 'failed - err: ' .. oletools_rc[result[3]['return_code']], 0.0, 'fail') elseif result[3]['return_code'] > 6 then rspamd_logger.errx(task, '%s: Error Returned: %s', @@ -196,7 +201,7 @@ local function oletools_check(task, content, digest, rule) rule.log_prefix, result[2]['message']) oletools_requery(oletools_rc[result[3]['return_code']]) elseif type(result[2]['analysis']) == 'table' and #result[2]['analysis'] == 0 - and #result[2]['macros'] == 0 then + and #result[2]['macros'] == 0 then rspamd_logger.warnx(task, '%s: maybe unhandled python or oletools error', rule.log_prefix) common.yield_result(task, rule, 'oletools unhandled error', 0.0, 'fail') elseif type(result[2]['analysis']) ~= 'table' and #result[2]['macros'] == 0 then |