JBCS & ClamAV Antivirus
All,
I've written some code that integrates ClamAV with JBCS to provide server-side antivirus protection, and thought I'd share it with the community. I'm putting together a page detailing how to install everything -- I'll post that shortly as well as the code I've written.
BACKGROUND
There are 3 components to JBCS Antivirus.
First is ClamAV, a server-based, opensource antivirus project, which can be downloaded from their site, and will need to be installed.
Second and third are 2 JBCS MBeans (and a small tidbit of config XML to integrate this into JBCS). The first is the ClamAV service MBean, which provides functionality that bridges JBCS/Java to the ClamAV daemon (running either locally or on a remote machine).
The second MBean is a JBCS Maillistener that can be plugged into any of the JBCS mailListenerChains.
Unfortunately, ClamAV is not Java, and it provides only 2 facilities to scan for viruses: 1.) Scan a file; 2.) Scan a binary STREAM over a socket.
PRESENT CONSIDERATIONS
My implementation uses the latter via a network stream. In my testing I have gotten everything working, although I am forced to scan a whole message at a time. So, for example, if a given message has 3 message bodies, but only one is infected, the code will basically just report back that a virus was found (it doesn't specify in which message body).
There is another set of functionality that I have implemented which allows ClamAV to check a single message body at a time, such that in the example above, a message with 3 bodies, and only 1 infected, would report back which MessageBody ids are infected. That way, the ClamAVMailListener code could lose the infected body but retain the UN-infected bodies. Unfortunately (again), in my testing of this, ClamAV does not detect a sample virus in this scenario. I beleive this because ClamAV is designed to be able to scan an entire message, not individual message components. Thus, if a Base64 encoded "attachment" is sent to clamAV without the rest of the contextual information found in a MIME message, ClamAV does not know to "inspect" the Base64 data, and thus a virus signature is not detected.
Once JBCS has better MIME message support (Andy alluded to forking the MIME4j code) I should be able to get a MimeBody part, decode the base64 attachment (if it exists), and send that to ClamAV. Thus, in version 2 of this plugin, we should be able to deal with infected message bodies individually.
MOVING FORWARD
For the moment, I would appreciate some information from the community as to how this should function:
1.) If a message has a single infection, but 1 or more uninfected message bodies, what should happen to the message?
2.) If a message has a single attachment that is infected, what should happen to the message? Should it bounce? Should it be "cleansed" (i.e., reset the subject, remove the infected body, and add a note in the message body saying that it was cleaned), or some other functionality?
Thanks!
David
