samba3-vscan/symantec vscan-symantec.c,1.3,1.4

Rainer Link <[email protected]> Thu, 28 Jul 2005 10:15:12 +0000
Newsgroups gmane.comp.security.virus.openantivirus.cvs
Message-ID <[email protected]>
Update of /cvsroot/openantivirus/samba3-vscan/symantec
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv12787/symantec

Modified Files:
	vscan-symantec.c 
Log Message:
bugfix in kaspersky module
stream-lined vscan_close for all modules


Index: vscan-symantec.c
===================================================================
RCS file: /cvsroot/openantivirus/samba3-vscan/symantec/vscan-symantec.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -d -r1.3 -r1.4
--- vscan-symantec.c	27 Jul 2005 18:35:51 -0000	1.3
+++ vscan-symantec.c	28 Jul 2005 10:15:10 -0000	1.4
@@ -264,60 +264,70 @@
 
 static int vscan_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
 {
+	SMB_STRUCT_STAT stat_buf;
 	pstring filepath;
-        int retval, rv, rc;
+        int retval = 0, rv = 0, rc = 0;
 	char client_ip[CLIENT_IP_SIZE];
 
         /* First close the file */
         retval = SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
 
+        /* get the file name */
+        pstrcpy(filepath, fsp->conn->connectpath);
+        pstrcat(filepath, "/");
+        pstrcat(filepath, fsp->fsp_name);
+
         if ( !vscan_config.common.scan_on_close ) {
                 DEBUG(3, ("samba-vscan - close: File '%s' not scanned as scan_on_close is not set\n", fsp->fsp_name));
-                return retval;
         }
-
-
-	/* get the file name */
-        pstrcpy(filepath, fsp->conn->connectpath);
-        pstrcat(filepath, "/"); 
-        pstrcat(filepath, fsp->fsp_name);        
-	
         /* Don't scan directorys */
-        if ( fsp->is_directory )
-            return retval;
-
-
-	if ( !fsp->modified ) {
+        else if ( fsp->is_directory )
+		DEBUG(10, ("don't scan directory\n"));
+	/* Don't scan files which have not been modified */
+	else if ( !fsp->modified ) {
                 if ( vscan_config.common.verbose_file_logging ) 
                         vscan_syslog("INFO: file %s was not modified - not scanned", filepath);
 
-		return retval;
 	}
-
         /* dont' scan file which matches exclude regexp */
-        if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) {
+        else if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) {
                 if ( vscan_config.common.verbose_file_logging )
                         vscan_syslog("INFO: file '%s' not scanned as file is machted by exclude regexp", filepath);
-                return retval;
         }
-
 	/* don't scan files which are in the list of exclude file types */
-	if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) {
+	else if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) {
                 if ( vscan_config.common.verbose_file_logging )
-                        vscan_syslog("File '%s' not scanned as file type is on exclude list", filepath);
-		return retval;
+                        vscan_syslog("INFO: File '%s' not scanned as file type is on exclude list", filepath);
 	}
-
-	if ( cscan_ok ) {
-	    safe_strcpy(client_ip, fsp->conn->client_address, CLIENT_IP_SIZE -1);
-    	    /* scan only file, do nothing */	
-	    rv = vscan_symantec_scanfile(filepath, client_ip);
-	    if ( rv == VSCAN_SCAN_VIRUS_FOUND ) {
-			/* virus was found */
-			rc = vscan_do_infected_file_action(handle, fsp->conn, filepath, vscan_config.common.quarantine_dir, vscan_config.common.quarantine_prefix, vscan_config.common.infected_file_action);
+	else if ( (SMB_VFS_NEXT_STAT(handle, handle->conn, fsp->fsp_name, &stat_buf)) != 0 ) {    /* an error occured */ 
+		if( errno == ENOENT) {
+			if ( vscan_config.common.verbose_file_logging )
+				vscan_syslog("INFO: File %s not found! Not scanned!", fsp->fsp_name);
+		} else {
+			vscan_syslog("ERROR: File %s not readable or an error occured", fsp->fsp_name);
 		}
-
 	}
+	else {
+		if ( cscan_ok ) {
+			safe_strcpy(client_ip, fsp->conn->client_address, CLIENT_IP_SIZE -1);
+			/* scan only file, do nothing */	
+			rv = vscan_symantec_scanfile(filepath, client_ip);
+			if ( rv == VSCAN_SCAN_VIRUS_FOUND ) {
+				/* virus was found */
+				rc = vscan_do_infected_file_action(handle, fsp->conn, filepath, vscan_config.common.quarantine_dir, vscan_config.common.quarantine_prefix, vscan_config.common.infected_file_action);
+				/* add/update file, mark file as infected! */
+				lrufiles_add(filepath, stat_buf.st_mtime, True);
+			else if( rv == VSCAN_SCAN_OK ) {
+				/* add/update file, mark file as clean! */
+				lrufiles_add(filepath, stat_buf.st_mtime, False);
+			}
+			else {
+				/* to be save, delete file from lrufiles */
+				lrufiles_delete(filepath);
+			} /* rv */
+		} /* cscan_ok */
+	} /* pre-scan conditions */
+
 	return retval;
 }
 



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO September
19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf