# Debugging level, 0=errors only, 1=return status, init messages,
#   2=smtp server communication, 3=detailed smtp server communication,
#   4=tracebacks, 5=smtp client communication
#   Do not use debug level higher than 9!
DEBUG_LEVEL=4

LANG=['sk_SK']
LOCALE_DIR='/tmp/sagator/usr/local/share/locale'

# Where is new root path. For example '/var/spool/vscan'
CHROOT='/var/spool/vscan'
#CHROOT='/'

# Logfile (use logfile in chroot to allow rotating)
LOGFILE=CHROOT+'/tmp/sagator.log'
PID_FILE="/tmp/sagator.pid"

# User and group, under which this program runs.
USER,GROUP='vscan','vscan'

# SMTP server host and port. You must define this smtp server
# in postfix without filtering.
SMTP_SERVER=('127.0.0.1', 25)

# Scanners and services
from scanners import *
from srv import *

from avlib import ascanner, mail, is_infected
import re

DB_ENGINE=db.pymysql(host='127.0.0.1', port=3306, dbname='sagator',
                     dbuser='sagator', dbpasswd='sagator')
#DB_ENGINE = db.sqlite(dbname='/var/lib/sagator/sqlitedb')
#DB_ENGINE=db.sqlite()
#DB_TXT='/var/lib/sagator/antivir.conf'

## Local IPs
LOCAL_IPS = br'^(192\.168|172\.(1[6789]|2[0-9]|3[01])|10|127)\.'

from avir.libclamav.const6 import *

CLAMAV=libclam(
  #options=CL_SCAN_STDOPT|CL_SCAN_BLOCKENCRYPTED,
  #limits={'maxratio':250},
  #db_options=libclam.CL_DB_PHISHING,
  #datadir='/var/lib/clamav',
  #datadir="/home/ondrejj/tmp/clamav-empty",
  #solib='/home/ondrejj/c/CVS/clamav/clamav-devel/libclamav/.libs/libclamav.so.6'
)

class ssleep(ascanner):
  def scanbuffer(self, buffer, args={}):
      debug.echo(0, "SLEEPING...")
      time.sleep(300)
      return 0.0, '', []

class bf_and_sa(match_all):
  name="bf_and_sa()"
  def __init__(self, bf, sa):
      self.scanners = [bf, sa]
  def scanbuffer(self, buffer, args={}):
      self.scanners[0].scanbuffer(buffer, args)
      xbuffer = 'X-Bogosity: %s\r\n%s' % (
        mail.xhdra.get('X-Bogosity'), buffer)
      return self.scanners[1].scanbuffer(xbuffer, args)

# Define scanners
SCANNERS = [
  #spf_check(),
  #remove_headers('Received'),
  #add_header('X-Loop', 'bonehead', const(0.0, 'XXX')),
  #log_syslog('ip=$SENTBY_IP, name=$SENTBY_NAME, helo=$SENTBY_HELO, recip=$RECIPIENTS, sender=$SENDER',

  #regexp_scan({
  #   '':[b'Subject: MailLog report '],
  #  'D':[b'.*']
  #},-1) &

  #log_sql(DB_ENGINE, log_sql.FORMAT,
  log(1, log.SUMMARY_REPORT,
    status("Virus",
      report(['$SENDER'], report.MSG_TMPL,
#        custom_action('.', 556,
#          'E-mail (%(QNAME)s) rejected due spam or virus content',
        quarantine('/tmp/quarantine/%Y%m','',
          drop('.',
            #b2f(cmd_fprot()),
            #max_file_size(1500) &
            # ((const(1.0)-max_file_size(200*1024))) &
            #   const(1.0,'TESTRUS'),
            # ClamAV
            #alternatives(
            #nod2pac(logfile='/var/log/esets/daemon.log'),
#          check_level(
              b2f(CLAMAV),
              #const(1.0, "CONST"),
              #add_listed(DB_ENGINE,'GA',-1,'greylist',b2f(CLAMAV)),
              #rcpt_in_sql(DB_ENGINE,'ClamAV') &
              #(const(1.0)-smtp_comm([['X', '^XFORWARD .* ADDR=127']],re.I|re.M)) &
              #time_limit(0.3,parsemail(b2f(CLAMAV))),
              #mimeparse(b2f(CLAMAV)),
              #parsemail(buffer2file(decompress(CLAMAV))),
              ##parsemail(b2f(CLAMAV)),
              #buffer2file(decompress(CLAMAV)),
              #clamd(['localhost', 3310]),
              #clamd('/run/clamav/clamd.sock'),
              #buffer2mbox(clamscan(['/usr/bin/clamscan','--stdout','--infected','--no-summary','-r'])),
            #),
            # Simple scanners
            #max_file_size(10),
            #parsemail(
            #  b2f(
            #    decompress(
            #      f2b(
            #        file_type({b'exe': b'Executable'}),
            #        #attach_name({b'Executable': b'\.(exe|com|vxd|dll|cpl|scr|pif|lnk|bat|vbs|js|doc)$'}),
            #      )
            #    )
            #  )
            #),
            #string_scan(VIR_PATTERNS),
            #regexp_scan({'virname':['___PATTERN___']}),
            #mime_ext(mime_ext.EXECUTABLES),
            # AVG7 for linux
            #parsemail(b2f(avgd(chroot=CHROOT))),
            #b2f(avgd(chroot=CHROOT)),
            #parsemail(b2f(avgd())),
            # Bitdefender bdc
            #b2f(bdc(['/opt/bdc/bdc','--log=/tmp/bdc.log','--mail','--all','--arc'])),
            #b2f(cmd_bdc('/opt/bdc/bdc')),
            # NOD
            #scanc(),
            #buffer2mbox(nod2()),
            #buffer2mbox(cmd_uvscan('/opt/uvscan/uvscan')),
            #nod2d('/tmp/dazuko/mb-','/var/log/nod32fac.log'),
            # Sophie
            #parsemail(b2f(decompress(sophie('/tmp/sophie',CHROOT)))),
            # exec any program
            #b2f(exec_any(['/bin/grep','-q','^TVqQ'],[1],[0])),
            # Kaspersky kav
            #buffer2mbox(CLAMAV),
            #b2f(kavclient('/run/aveserver')),
            #b2f(kav()),
            # Symantec antivirus scan engine.
            #savse('localhost',1344),
            #parsemail(savse('localhost'))
            #parsemail(
            #    file_type({b'exe': b'Executable'}),
            #    attach_name({b'Forbidden attachment': b'\.(exe|com|vxd|dll|cpl|scr|pif|lnk|bat|vbs|js|docm|jar|rar|arj|iso|hta)$'})
            #),
            #parsemail(
            # b2f(
            #  decompress(
            #   f2b(
            #    attach_name({b'Forbidden attachment in zip': b'\.(exe|com|vxd|dll|cpl|scr|pif|lnk|bat|vbs|docm|js|jar|jse|wsf|hta)$'})
            #      )
            #    )
            #  )
            )
        )
        )
#      )
    ),
    status("Spam",
      quarantine('/tmp/quarantine', '',
        drop(".", # drop all spams
        #check_level(
          spamassassind(['127.0.0.1', 783]),
          #spamassassind(['127.0.0.1', 783],
          #  filter=True, sa_user=USER),
          #{
          #  (0.0, 1.0): deliver(check_level()),
          #  (1.0, 2.0): deliver(
          #    modify_subject('[SPAM:%L]',
          #      check_level()
          #    )
          #  ),
          #  (2.0, 99999.0): drop('.', check_level())
          #}
          #),
          #dspam('/tmp/dspam'),
          #dspam()
          #dspam_classify_spam()
          #dspam_classify_innocent()
          # SpamAssassin
          #alternatives(
            #(const(1.0)-max_file_size(200*1024)) &
            #modify_subject('[%V]', rename('SPAM:$LEVEL',
            #rcpt_in_sql(DB_ENGINE,'AntiSpam') &
            #  spamassassind(['localhost',783],
            #    sa_user=['vscan%d' % i for i in range(1, core_count()+1)]
            #  ),
            #)),
          #),
          #bogofilter(['/usr/bin/bogofilter','-v']),
          #qsf(['/usr/bin/qsf','-r']),
        )
      )
    )
  ),
  #rcpt_no_match('AntiVir') &
  #  buffer2file(CLAMAV),
#  filter(['/tmp/as/sanitizer.pl'])
  # forward special emails
  # forward special emails
  #deliver_to(['ondrejj@home.salstar.sk'],
  #  smtp_comm({'CRCZ':['MAIL FROM:.*test@tester.salxstar.sk']})
  #).onlyif('CRCZ')&const(0.0),
  #cache('firstpass')
]

SCANNERS_TEST = [
  log(1, log.SUMMARY_REPORT,
  log_sql(DB_ENGINE, log_sql.FORMAT,
    status("VIRUS",
      report(['root@localhost'], report.MSG_TMPL,
        drop(drop.DEFAULT,
          quarantine('/tmp/quarantine/%Y/%m/%d', '',
            max_file_size(10*1024),
            parsemail(file_type({b'exe': b'Executable'})),
            string_scan([["EICAR", "EICAR"]]),
            #regexp_scan({'Eicar_virname': ['EICAR']}),
            b2f(cmd(['/bin/grep', '-q', '^TVqQ'], [1], [0])),
            #b2f(libclam()),
          )
        )
      ).ifscan(sender_regexp({b'LOCAL_IP': [LOCAL_IPS]}))
    ),
    status("SPAM",
      spamassassind(['127.0.0.1', 783], sa_user=USER),
    )
  )
  )
]
#SCANNERS = SCANNERS_TEST

#try:
#  SCANNERS=[
#    drop('.',
#      smtp_comm({'SPAM':['^RCPT TO:<spam@']})
#        & (dspam(classify=DSR_ISSPAM,source=DSS_ERROR,train=DST_TOE)
#           +const(1.0,'TRAINED')),
#      smtp_comm({'HAM':['^RCPT TO:<ham@']})
#        & (dspam(classify=DSR_ISINNOCENT,source=DSS_ERROR,train=DST_TOE)
#           +const(1.0,'TRAINED'))
#    ),
#    quarantine('/tmp/quarantine/%Y%m', '',
#      dspam()
#    )
#  ]
#except:
#  pass

ecce_SCANNERS = [ # ECCE
  # Check for marked message
  cache('REALLY_CLEAN',
    rename('',regexp_scan({'':[b'^Subject: NOSPAM'],'&':['.']},-1))
  ) & const(0),
  # Check for viruses
  report(['root@localhost'],report.MSG_TMPL,
    quarantine('/tmp/quarantine/%Y%m', '',
      drop(drop.DEFAULT_EXT % "SPAM",
        #buffer2mbox(CLAMAV),
        cache('REALLY_CLEAN') & (
          parsemail(
            #file_magic({'Executable_magic': '/.*exec'},re.I),
            #file_type({'exe': 'Executable'}),
            attach_name({'Executable':r'\.(exe|com|vxd|dll|cpl|scr|pif|lnk|bat|vbs|js)$'})
          ) | const(0)
        )
      )
    )
  ),
  # Check for spams
  quarantine('/tmp/quarantine/%Y%m','',
    # SPAMASSASSIN
    cache('REALLY_CLEAN') & spamassassind(['localhost',783], sa_user=USER)
  )
]

SCANS = {
  'DEFAULT':
    #SCANNERS[0]
    drop('.', buffer2file(CLAMAV))
    #log_sql(DB_ENGINE,log_sql.FORMAT,
      #drop('.',string_scan([['sEicar','STANDARD']]))
    #)
    #spamassassind(filter=True, mydestination='.', sa_user=USER)
    ,
  #'LEVEL1': spamassassind(reqspamlevel=5.0,filter=True,mydestination='.'),
  #'LEVEL2': spamassassind(reqspamlevel=2.0,filter=True,mydestination='.')
  #'AV1': drop('.',b2f(CLAMAV)),
  #'AS1': drop('.',spamassassind(['localhost',783],mydestination='^salstar.sk$'))
}

#for xx in range(10):
#  SCANS['LEVEL%s' % xx]=drop('.', CLAMAV, spamassassind())

POLICY=[
  #dns_check(True),
  spf_check(),
  #list_cleanup(),
  #auto_whitelist(5),
  #status('Blacklist',listed('B')),
  #not_listed('W')
  status('Greylist',
    not_listed('W') &
    rbl_check('bl.spamcop.net.', 'zen.spamhaus.org.') &
    #listed('G') &
    greylist(60)
  ),
  policy_quota_cleanup(),
  #status('Quota',
  #  geoip_country(['SK'], allow=False) &
  #    policy_quota_auth_limit([60, 600], [3, 5], [6, 10])
  #),
  set_action('dunno')
]

POLICY_QUOTA = [
  ## user quotas
  status('Quota',
    policy_quota_auth_limit(
      interval = [  60,  600, 3600], # seconds
      max_conn = [  20,   60,  720], # count
      max_rcpt = [ 100,  300,  720]  # recipients
    ),
  ),
  ## return "dunno" to leave postfix's other restriction to effect
  set_action('dunno')
]

CLEANUP={
  DB_ENGINE: [ list_cleanup(), auto_whitelist(5), log_cleanup() ]
}

# Define services
SRV = [
  # external daemons
  #chroot_execvp('/usr/sbin/clamd', '-c', '/etc/clamav.conf'),
  #chroot_execvpe('/opt/grisoft/avg7/bin/avgscan', ['-d'],
  #               {'LANG':'C'}, pgrp_file='/run/avgd.pgrp'),
  #chroot_execvp('/opt/kav/5.5/kav4mailservers/bin/aveserver'),
  #scand(
  #  nod2pac(logfile='/var/log/esets/daemon.log')#+usrquota('.')
  #  ,'/opt/eset/esets/lib/libesets_pac.so'
  #  #,as_root=True
  #),
  # statistics collector
  #collector(),
  #collector(statfile="/tmp/status"),
  collector('localhost', 2800),
  # resources
  #rlimit(AS=200*MB),
  # SMTP daemon (for posfix etc.)
  #recipient_policy(POLICY,DB_ENGINE),
  smtpd_policy(POLICY, DB_ENGINE, '127.0.0.1', 2929),
  smtpd_policy(POLICY_QUOTA, DB_ENGINE, '127.0.0.1', 3030),
  smtpd(SCANNERS, '0.0.0.0', 2727, core_count()),
  #smtpd([],'127.0.0.1',2727,2),
  #lmtpd(SCANNERS, '0.0.0.0', 2728),
  # Milter daemon
  #milter(SCANNERS, "sagator", "inet:3333@0.0.0.0"),
  # fuse
  #fusefs([CLAMAV], '/tmp/fuse', '/tmp/e'),
  # Filter
  #avfilter(SCANNERS),
  #sgfilterd(SCANNERS, port=2727),
  #reporter(groups=[['a@','women@localhost'], ['.', 'men@localhost']]),
  # http proxy
  #http_proxy([b2f(CLAMAV)],'0.0.0.0',3129,10),
  # virtual web service
  #webq_apache(db=DB_ENGINE, scanner=b2f(CLAMAV), admin=['ondrejj'])
  #webq(port=8009, db=DB_ENGINE, scanner=b2f(CLAMAV)),
  webq_jinja(db=DB_ENGINE, scanner=b2f(CLAMAV))
]

#CLAMAV.reinit()
#CLAMAV.av.so.cl_debug()
#print CLAMAV.av.retver()