samba-vscan/antivir vscan-antivir.c,1.1.2.4,1.1.2.5 vscan-antivir.conf,1.1.2.3,1.1.2.4

Rainer Link <[email protected]> Sun, 10 Apr 2005 15:22:52 +0000
Newsgroups gmane.comp.security.virus.openantivirus.cvs
Message-ID <[email protected]>
Update of /cvsroot/openantivirus/samba-vscan/antivir
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv8392/antivir

Modified Files:
      Tag: VSCAN_0_3
	vscan-antivir.c vscan-antivir.conf 
Log Message:
use file regexp stuff
modified some syslog satements to contain the INFO tag
some other small changes


Index: vscan-antivir.conf
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/antivir/Attic/vscan-antivir.conf,v
retrieving revision 1.1.2.3
retrieving revision 1.1.2.4
diff -u -d -r1.1.2.3 -r1.1.2.4
--- vscan-antivir.conf	18 Jan 2005 20:03:14 -0000	1.1.2.3
+++ vscan-antivir.conf	10 Apr 2005 15:22:50 -0000	1.1.2.4
@@ -57,6 +57,9 @@
 ; seperated list (default: empty list). Use this with care!
 exclude file types =
 
+; exclude files from being scanned via regular expression (PCRE)
+; (default: empty)
+exclude file regexp =
 
 ; executable name of antivir (default: /usr/lib/AntiVir/antivir)
 antivir program name = /usr/lib/AntiVir/antivir

Index: vscan-antivir.c
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/antivir/Attic/vscan-antivir.c,v
retrieving revision 1.1.2.4
retrieving revision 1.1.2.5
diff -u -d -r1.1.2.4 -r1.1.2.5
--- vscan-antivir.c	23 Feb 2005 02:49:22 -0000	1.1.2.4
+++ vscan-antivir.c	10 Apr 2005 15:22:50 -0000	1.1.2.5
@@ -194,6 +194,10 @@
 	DEBUG(5, ("init file type\n"));
 	filetype_init(0, vscan_config.common.exclude_file_types);
 
+	/* initialise file regexp */
+	DEBUG(5, ("init file regexp\n"));
+	fileregexp_init(vscan_config.common.exclude_file_regexp);
+
 	/* tell core we have a(nother) session, ignore return code */
 	(void)vscan_antivir_connect();
 
@@ -270,16 +274,20 @@
 		return default_vfs_ops.open(conn, fname, flags, mode);
 #endif
 	else if ( ( stat_buf.st_size > vscan_config.common.max_size ) && ( vscan_config.common.max_size > 0 ) ) /* file is too large */
-		vscan_syslog("INFO: File %s is larger than specified maximum file size! Not scanned!", fname);
+		vscan_syslog("INFO: file %s is larger than specified maximum file size! Not scanned!", fname);
 	else if ( stat_buf.st_size == 0 ) /* do not scan empty files */
 #if (SMB_VFS_INTERFACE_VERSION >= 6)
 		return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
 #else
 		return default_vfs_ops.open(conn, fname, flags, mode);
 #endif
+	else if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) {
+		if ( vscan_config.common.verbose_file_logging )
+			vscan_syslog("INFO: file '%s' not scanned as file is machted by exclude regexp", filepath);
+	}
 	else if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) {
 		if ( vscan_config.common.verbose_file_logging )
-			vscan_syslog("File '%s' not scanned as file type is on exclude list", filepath);
+			vscan_syslog("INFO: file '%s' not scanned as file type is on exclude list", filepath);
 #if (SMB_VFS_INTERFACE_VERSION >= 6)
 		return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
 #else
@@ -305,7 +313,7 @@
 				/* file has already been checked and marked as containing an alert */
 				/* deny access */
 				if ( vscan_config.common.verbose_file_logging )
-					vscan_syslog("File '%s' has already been scanned and marked as containing an alert. Not scanned any more. Access denied", filepath);
+					vscan_syslog("INFO: file '%s' has already been scanned and marked as containing an alert. Not scanned any more. Access denied", filepath);
 
 				/* postprocess file scan */
 				vscan_antivir_end(sockfd);
@@ -316,7 +324,7 @@
 			} else if ( must_be_checked == VSCAN_LRU_GRANT_ACCESS )  {
 				/* file has already been checked, not marked as containing an alert and not modified */
 				if ( vscan_config.common.verbose_file_logging )
-					vscan_syslog("File '%s' has already been scanned, not marked as containing an alert and not modified. Not scanned anymore. Access granted", filepath);
+					vscan_syslog("INFO: file '%s' has already been scanned, not marked as containing an alert and not modified. Not scanned anymore. Access granted", filepath);
 
 				/* postprocess file scan */
 				vscan_antivir_end(sockfd);
@@ -427,10 +435,17 @@
 		return retval;
 	}
 
+	/* dont' scan file which matches exclude regexp */
+	if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) {
+		if ( vscan_config.common.verbose_file_logging )
+			vscan_syslog("INFO: file '%s' not scanned as file is machted by exclude regexp", filepath);
+		return retval;
+	}
+
 	/* don't scan files which are in the list of exclude file types */
 	if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) {
 		if ( vscan_config.common.verbose_file_logging )
-			vscan_syslog("File '%s' not scanned as file type is on exclude list", filepath);
+			vscan_syslog("INFO: file '%s' not scanned as file type is on exclude list", filepath);
 		return retval;
 	}
 



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click