samba3-vscan/antivir vscan-antivir.c,1.4,1.5

Rainer Link <[email protected]> Wed, 27 Jul 2005 18:35:36 +0000
Newsgroups gmane.comp.security.virus.openantivirus.cvs
Message-ID <[email protected]>
Update of /cvsroot/openantivirus/samba3-vscan/antivir
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv32264/antivir

Modified Files:
	vscan-antivir.c 
Log Message:
changed the logic in vscan_open


Index: vscan-antivir.c
===================================================================
RCS file: /cvsroot/openantivirus/samba3-vscan/antivir/vscan-antivir.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -d -r1.4 -r1.5
--- vscan-antivir.c	27 Jul 2005 07:59:15 -0000	1.4
+++ vscan-antivir.c	27 Jul 2005 18:35:33 -0000	1.5
@@ -206,12 +206,10 @@
 
 static int vscan_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode)
 {
-	int retval, must_be_checked;
+	int retval, must_be_checked, rc, sockfd;
 	SMB_STRUCT_STAT stat_buf;
-	int sockfd;
 	pstring filepath;
 	char client_ip[CLIENT_IP_SIZE];
-	int rc;
 
 	/* Assemble complete file path */
 	pstrcpy(filepath, conn->connectpath);
@@ -246,6 +244,19 @@
 	else if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) {
 		if ( vscan_config.common.verbose_file_logging )
 			vscan_syslog("INFO: file '%s' not scanned as file type is on exclude list", filepath);
+	} else if ( (must_be_checked = lrufiles_must_be_checked(filepath, stat_buf.st_mtime)) == VSCAN_LRU_DENY_ACCESS ) {
+		/* file has already been checked and marked as infected */
+		/* deny access */
+		if ( vscan_config.common.verbose_file_logging )
+			vscan_syslog("INFO: File '%s' has already been scanned and marked as infected. Not scanned any more. Access denied", filepath);
+
+		/* deny access */
+		errno = EACCES;
+		return -1;
+	} else if ( must_be_checked == VSCAN_LRU_GRANT_ACCESS )  {
+		/* file has already been checked, not marked as infected and not modified */
+		if ( vscan_config.common.verbose_file_logging )
+			vscan_syslog("INFO: File '%s' has already been scanned, not marked as infected and not modified. Not scanned anymore. Access granted", filepath);
 	} else
 	{
 		/* prepare file scan, (re)open connection to the scanner */
@@ -259,33 +270,6 @@
 			/* we now have a scanner */
 			safe_strcpy(client_ip, conn->client_address, CLIENT_IP_SIZE -1);
 
-			/* must file actually be scanned? */
-			must_be_checked = lrufiles_must_be_checked(filepath, stat_buf.st_mtime);
-			if ( must_be_checked == VSCAN_LRU_DENY_ACCESS ) {
-				/* file has already been checked and marked as containing an alert */
-				/* deny access */
-				if ( vscan_config.common.verbose_file_logging )
-					vscan_syslog("INFO: file '%s' has already been scanned and marked as containing an alert. Not scanned any more. Access denied", filepath);
-
-				/* postprocess file scan */
-				vscan_antivir_end(sockfd);
-
-				/* deny access */
-				errno = EACCES;
-				return -1;
-			} else if ( must_be_checked == VSCAN_LRU_GRANT_ACCESS )  {
-				/* file has already been checked, not marked as containing an alert and not modified */
-				if ( vscan_config.common.verbose_file_logging )
-					vscan_syslog("INFO: file '%s' has already been scanned, not marked as containing an alert and not modified. Not scanned anymore. Access granted", filepath);
-
-				/* postprocess file scan */
-				vscan_antivir_end(sockfd);
-
-				/* grant access */
-				return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
-			}
-			/* ok, we must check the file */
-
 			/* scan file */
 			retval = vscan_antivir_scanfile(sockfd, filepath, client_ip);
 			if ( retval == VSCAN_SCAN_MINOR_ERROR && vscan_config.common.deny_access_on_minor_error ) {



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click