samba-vscan/f-secure vscan-fsav_core.c,1.1.2.6,1.1.2.7 vscan-fsav_core.h,1.1.2.3,1.1.2.4

Update of /cvsroot/openantivirus/samba-vscan/f-secure
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv27590

Modified Files:
      Tag: VSCAN_0_3
	vscan-fsav_core.c vscan-fsav_core.h 
Log Message:
report virus name via syslog (it's actually virus name + Engine; only one virus
name is reported from the last engine)


Index: vscan-fsav_core.c
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav_core.c,v
retrieving revision 1.1.2.6
retrieving revision 1.1.2.7
diff -u -d -r1.1.2.6 -r1.1.2.7
--- vscan-fsav_core.c	30 Mar 2004 12:59:43 -0000	1.1.2.6
+++ vscan-fsav_core.c	3 Apr 2004 16:11:40 -0000	1.1.2.7
@@ -57,7 +57,6 @@
 	}
 
 	/* allocate buffer for result */
-
 	h->buffer = (char *) malloc((BUFFERSIZE + 1));
 	if (!h->buffer) {
 		fsav_free_handle(h);
@@ -70,6 +69,15 @@
 		fsav_free_handle(h);
 		return NULL;
 	}
+
+	/* allocate buffer for virusname */
+        h->virusname = (char *) malloc((BUFFERSIZE + 1));
+        if (!h->virusname) {
+                fsav_free_handle(h);
+                return NULL;
+        }
+
+
 	h->uid = -1;
 	DEBUG(5, ("samba-vscan (%s) create handle success\n", module_id));
 	return h;
@@ -278,6 +286,38 @@
 	}
 }
 
+void vscan_fsav_log_virus(char *infected_file, char *result, char* client_ip)
+{
+        char *str;
+        size_t len;
+
+	/* format is: "INFECTED\t/path/file\t<virusname>\n" */
+
+        /* some sanity checks ... */
+        len = strlen(result);
+	/*				 \t                         \t   \n (see later) */
+        if ( len < (strlen("INFECTED") + 1 + strlen(infected_file) + 1 + 1)  ) {
+                /* hum, sth went wrong */
+                vscan_syslog_alert("ALERT - Scan result: '%s' infected with virus 'UNKNOWN', client: '%s'", infected_file, 
+client_ip);
+                if ( send_warning_message )
+                        vscan_send_warning_message(infected_file, "UNKNOWN", client_ip);
+
+        } else {
+                str = result;
+                str+= strlen("INFECTED") + 1 + strlen(infected_file) + 1;
+		if ( str[strlen(str) - 1] == '\n' )
+			str[strlen(str) - 1] = '\0';
+
+                vscan_syslog_alert("ALERT - Scan result: '%s' infected with virus '%s', client: '%s'", infected_file, str, 
+client_ip);
+                if ( send_warning_message )
+                        vscan_send_warning_message(infected_file, str, client_ip);
+
+        }
+        
+}
+
 
 /**
  * scan a file 
@@ -306,9 +346,8 @@
 	if (h->infected) {
 		/* virus found */
 		h->rc = 1;
-		 /* FIXME: is parsing of virus name possible based on fsavd resonse?!? */
-                vscan_syslog_alert("ALERT - Scan result: '%s' infected with virus, client: '%s'",
-                        file, client_ip);
+		/* FIXME: is parsing of virus name possible based on fsavd resonse?!? */
+		vscan_fsav_log_virus(file, h->virusname, client_ip);
 	} else {
 		if (h->fail) {
 			/* error */
@@ -641,8 +680,10 @@
 		 * search for tokens
 		 */
 
-		if (strstr(h->buffer, "INFECTED"))
+		if (strstr(h->buffer, "INFECTED")) {
+			pstrcpy(h->virusname, h->buffer);
 			h->infected = 1;
+		}
 
 		if (strstr(h->buffer, "FAILURE"))
 			h->fail = 1;

Index: vscan-fsav_core.h
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav_core.h,v
retrieving revision 1.1.2.3
retrieving revision 1.1.2.4
diff -u -d -r1.1.2.3 -r1.1.2.4
--- vscan-fsav_core.h	10 Mar 2004 16:29:03 -0000	1.1.2.3
+++ vscan-fsav_core.h	3 Apr 2004 16:11:40 -0000	1.1.2.4
@@ -61,6 +61,7 @@
 	char *binary;           /* location of the fsavd deamon */
 	char *user;
 	char *socket;
+	char *virusname;
 } fsav_handle;
 
 fsav_handle * fsav_create_handle();



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click