samba3-vscan/avast vscan-avastd.c,1.1,1.2 vscan-avastd_core.c,1.1,1.2
Rainer Link <[email protected]> Sun, 02 Oct 2005 12:27:46 +0000
| Newsgroups | gmane.comp.security.virus.openantivirus.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/openantivirus/samba3-vscan/avast In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv9923/avast Modified Files: vscan-avastd.c vscan-avastd_core.c Log Message: avastd module now in sync with rest of the modules Index: vscan-avastd.c =================================================================== RCS file: /cvsroot/openantivirus/samba3-vscan/avast/vscan-avastd.c,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- vscan-avastd.c 29 Aug 2005 12:51:22 -0000 1.1 +++ vscan-avastd.c 2 Oct 2005 12:27:43 -0000 1.2 @@ -5,11 +5,8 @@ * Copyright (C) Frantisek Mensik, 2005 * ALWIL Software <[email protected]> * - * base on the F-Prot Daemon module by - * Copyright (C) Rainer Link, 2001-2003 - * OpenAntiVirus.org <rainer-pBPPa8WU5k41Tgt60Rntydi2O/[email protected]> - * Copyright (C) Stefan (metze) Metzmacher, 2003 - * <[email protected]> + * Copyright (C) Rainer Link, 2005 + * OpenAntiVirus.org <rainer-pBPPa8WU5k41Tgt60Rntydi2O/[email protected]> * * based on the audit VFS module by * Copyright (C) Tim Potter, 1999-2000 @@ -45,33 +42,12 @@ #define VSCAN_MODULE_STR "vscan-avastd" +vscan_config_struct vscan_config; /* contains the vscan module configuration */ + fstring config_file; /* location of config file, either PARAMCONF or as set via vfs options */ - -ssize_t max_size; /* do not scan files greater than max_size - if max_size = 0, scan any file - */ - BOOL verbose_file_logging; /* log ever file access */ - -BOOL scan_on_open; /* scan a file before it is opened - Defaults to True - */ - -BOOL scan_on_close; /* scan a new file put on share or - if file was modified - Defaults to False - */ - -BOOL deny_access_on_error; /* if connection to daemon fails, should access to any - file be denied? Defaults to True - */ - - -BOOL deny_access_on_minor_error; /* if daemon returns non-critical error, - should access to the file be denied? */ - BOOL send_warning_message; /* send a warning message using the windows messenger service? */ @@ -79,88 +55,27 @@ pstring avastd_port; /* port number avast! daemon listens on */ fstring avastd_socket_file; /* socket name for avast! daemon */ -fstring quarantine_dir; /* directory for infected files */ -fstring quarantine_prefix; /* prefix for infected files */ - -enum infected_file_action_enum infected_file_action; /* what to do with infected files; - defaults to quarantine */ - -int max_lrufiles; /* specified the maximum entries in lrufiles list */ -time_t lrufiles_invalidate_time; /* specified the time in seconds after the lifetime - of an entry is expired and entry will be invalidated */ - -pstring exclude_file_types; /* list of file types which should be excluded from scanning */ - - - /* module version */ static const char module_id[]=VSCAN_MODULE_STR" "SAMBA_VSCAN_VERSION_STR; static BOOL do_parameter(const char *param, const char *value) { - if ( StrCaseCmp("max file size", param) == 0 ) { - /* FIXME: sanity check missing! what, if value is out of range? - atoi returns int - what about LFS? atoi should be avoided! - */ - max_size = atoi(value); - DEBUG(3, ("max file size is: %d\n", max_size)); - } else if ( StrCaseCmp("verbose file logging", param) == 0 ) { - set_boolean(&verbose_file_logging, value); - DEBUG(3, ("verbose file logging is: %d\n", verbose_file_logging)); - } else if ( StrCaseCmp("scan on open", param) == 0 ) { - set_boolean(&scan_on_open, value); - DEBUG(3, ("scan on open: %d\n", scan_on_open)); - } else if ( StrCaseCmp("scan on close", param) == 0 ) { - set_boolean(&scan_on_close, value); - DEBUG(3, ("scan on close is: %d\n", scan_on_close)); - } else if ( StrCaseCmp("deny access on error", param) == 0 ) { - set_boolean(&deny_access_on_error, value); - DEBUG(3, ("deny access on error is: %d\n", deny_access_on_error)); - } else if ( StrCaseCmp("deny access on minor error", param) == 0 ) { - set_boolean(&deny_access_on_minor_error, value); - DEBUG(3, ("deny access on minor error is: %d\n", deny_access_on_minor_error)); - } else if ( StrCaseCmp("send warning message", param) == 0 ) { - set_boolean(&send_warning_message, value); - DEBUG(3, ("send warning message is: %d\n", send_warning_message)); - } else if ( StrCaseCmp("infected file action", param) == 0 ) { - if (StrCaseCmp("quarantine", value) == 0) { - infected_file_action = INFECTED_QUARANTINE; - } else if (StrCaseCmp("delete", value) == 0) { - infected_file_action = INFECTED_DELETE; - } else if (StrCaseCmp("nothing", value) == 0) { - infected_file_action = INFECTED_DO_NOTHING; - } else { - DEBUG(2, ("samba-vscan: badly formed infected file action in configuration file, parameter %s\n", value)); - } - DEBUG(3, ("infected file action is: %d\n", infected_file_action)); - } else if ( StrCaseCmp("quarantine directory", param) == 0 ) { - fstrcpy(quarantine_dir, value); - DEBUG(3, ("quarantine directory is: %s\n", quarantine_dir)); - } else if ( StrCaseCmp("quarantine prefix", param) == 0 ) { - fstrcpy(quarantine_prefix, value); - DEBUG(3, ("quarantine prefix is: %s\n", quarantine_prefix)); - } else if ( StrCaseCmp("max lru files entries", param) == 0 ) { - max_lrufiles = atoi(value); - DEBUG(3, ("max lru files entries is: %d\n", max_lrufiles)); - } else if ( StrCaseCmp("lru file entry lifetime", param) == 0 ) { - lrufiles_invalidate_time = atol(value); - DEBUG(3, ("lru file entry lifetime is: %li\n", (long)lrufiles_invalidate_time)); - } else if ( StrCaseCmp("exclude file types", param) == 0 ) { - pstrcpy(exclude_file_types, value); - DEBUG(3, ("Exclude list is: %s\n", exclude_file_types)); - } else if ( StrCaseCmp("avastd ip", param) == 0 ) { - fstrcpy(avastd_ip, value); - DEBUG(3, ("avastd ip is: %s\n", avastd_ip)); - } else if ( StrCaseCmp("avastd port", param) == 0 ) { - pstrcpy(avastd_port, value); - DEBUG(3, ("avastd port is: %s\n", avastd_port)); - } else if ( StrCaseCmp("avastd socket file", param) == 0 ) { - fstrcpy(avastd_socket_file, value); - DEBUG(3, ("avastd socket file is %s\n", avastd_socket_file)); - } else - DEBUG(3, ("unknown parameter: %s\n", param)); + if ( do_common_parameter(&vscan_config, param, value) == False ) { + /* parse VFS module-specific configuration values */ + if ( StrCaseCmp("avastd ip", param) == 0 ) { + fstrcpy(avastd_ip, value); + DEBUG(3, ("avastd ip is: %s\n", avastd_ip)); + } else if ( StrCaseCmp("avastd port", param) == 0 ) { + pstrcpy(avastd_port, value); + DEBUG(3, ("avastd port is: %s\n", avastd_port)); + } else if ( StrCaseCmp("avastd socket file", param) == 0 ) { + fstrcpy(avastd_socket_file, value); + DEBUG(3, ("avastd socket file is %s\n", avastd_socket_file)); + } else + DEBUG(3, ("unknown parameter: %s\n", param)); + } return True; } @@ -170,61 +85,14 @@ return True; } - - - -/* Implementation of vfs_ops. */ - -#if (SMB_VFS_INTERFACE_VERSION >= 6) static int vscan_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user) -#else -static int vscan_connect(struct connection_struct *conn, PROTOTYPE_CONST char *svc, PROTOTYPE_CONST char *user) -#endif { - #if (SAMBA_VERSION_MAJOR==2 && SAMBA_VERSION_RELEASE>=4) || SAMBA_VERSION_MAJOR==3 - #if !(SMB_VFS_INTERFACE_VERSION >= 6) - pstring opts_str; - PROTOTYPE_CONST char *p; - #endif - #endif + fstring config_file; /* location of config file, either + PARAMCONF or as set via vfs options + */ int retval; -#if (SMB_VFS_INTERFACE_VERSION >= 6) vscan_syslog("samba-vscan (%s) connected (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org", module_id); -#endif - - /* set default value for configuration files */ - fstrcpy(config_file, PARAMCONF); - - /* set default value for max file size */ - max_size = VSCAN_MAX_SIZE; - - /* set default value for file logging */ - verbose_file_logging = VSCAN_VERBOSE_FILE_LOGGING; - - /* set default value for scan on open() */ - scan_on_open = VSCAN_SCAN_ON_OPEN; - - /* set default value for scan on close() */ - scan_on_close = VSCAN_SCAN_ON_CLOSE; - - /* set default value for deny access on error */ - deny_access_on_error = VSCAN_DENY_ACCESS_ON_ERROR; - - /* set default value for deny access on minor error */ - deny_access_on_minor_error = VSCAN_DENY_ACCESS_ON_MINOR_ERROR; - - /* set default value for send warning message */ - send_warning_message = VSCAN_SEND_WARNING_MESSAGE; - - /* set default value for infected file action */ - infected_file_action = VSCAN_INFECTED_FILE_ACTION; - - /* set default value for quarantine directory */ - fstrcpy(quarantine_dir, VSCAN_QUARANTINE_DIRECTORY); - - /* set default value for quarantine prefix */ - fstrcpy(quarantine_prefix, VSCAN_QUARANTINE_PREFIX); /* set default value for avast! daemon IP */ fstrcpy(avastd_ip, VSCAN_AVASTD_IP); @@ -235,75 +103,37 @@ /* set default value for avast! daemon socket file */ fstrcpy(avastd_socket_file, VSCAN_AVASTD_SOCKET_FILE); - /* set default value for maximum lrufile entries */ - max_lrufiles = VSCAN_MAX_LRUFILES; - - /* time after an entry is considered as expired */ - lrufiles_invalidate_time = VSCAN_LRUFILES_INVALIDATE_TIME; - - /* file type exclude ist */ - pstrcpy(exclude_file_types, VSCAN_FT_EXCLUDE_LIST); - - vscan_syslog("INFO: connect to service %s by user %s", svc, user); - #if (SAMBA_VERSION_MAJOR==2 && SAMBA_VERSION_RELEASE>=4) || SAMBA_VERSION_MAJOR==3 - #if (SMB_VFS_INTERFACE_VERSION >= 6) - fstrcpy(config_file, lp_parm_const_string(SNUM(conn),VSCAN_MODULE_STR,"config-file",PARAMCONF)); - #else - pstrcpy(opts_str, (const char*) lp_vfs_options(SNUM(conn))); - if( !*opts_str ) { - DEBUG(3, ("samba-vscan: no configuration file set - using default value (%s).\n", lp_vfs_options(SNUM(conn)))); - } else { - p = opts_str; - if ( next_token(&p, config_file, "=", sizeof(config_file)) ) { - trim_string(config_file, " ", " "); - if ( !strequal("config-file", config_file) ) { - DEBUG(3, ("samba-vscan - connect: options %s is not config-file\n", config_file)); - /* setting default value */ - fstrcpy(config_file, PARAMCONF); + fstrcpy(config_file, get_configuration_file(conn, VSCAN_MODULE_STR, PARAMCONF)); + DEBUG(3, ("configuration file is: %s\n", config_file)); - } else { - if ( !next_token(&p, config_file," \n",sizeof(config_file)) ) { - DEBUG(3, ("samba-vscan - connect: no option after config-file=\n")); - /* setting default value */ - fstrcpy(config_file, PARAMCONF); - } else { - trim_string(config_file, " ", " "); - DEBUG(3, ("samba-vscan - connect: config file name is %s\n", config_file)); - } - } - } - } - #endif /* #if (SMB_VFS_INTERFACE_VERSION >= 6)*/ - retval = pm_process(config_file, do_section, do_parameter); - DEBUG(10, ("pm_process returned %d\n", retval)); - if (!retval) vscan_syslog("ERROR: could not parse configuration file '%s'. File not found or not read-able. Using compiled-in defaults", config_file); - #endif + retval = pm_process(config_file, do_section, do_parameter); + + /* FIXME: this is lame! */ + verbose_file_logging = vscan_config.common.verbose_file_logging; + send_warning_message = vscan_config.common.send_warning_message; + + DEBUG(10, ("pm_process returned %d\n", retval)); + if (!retval) vscan_syslog("ERROR: could not parse configuration file '%s'. File not found or not read-able. Using compiled-in defaults", config_file); /* initialise lrufiles list */ DEBUG(5, ("init lrufiles list\n")); - lrufiles_init(max_lrufiles, lrufiles_invalidate_time); + lrufiles_init(vscan_config.common.max_lrufiles, vscan_config.common.lrufiles_invalidate_time); /* initialise filetype */ DEBUG(5, ("init file type\n")); - filetype_init(0, exclude_file_types); + filetype_init(0, vscan_config.common.exclude_file_types); + /* initialise file regexp */ + fileregexp_init(vscan_config.common.exclude_file_regexp); - #if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_CONNECT(handle, conn, svc, user); - #else - return default_vfs_ops.connect(conn, svc, user); - #endif + return SMB_VFS_NEXT_CONNECT(handle, conn, svc, user); } -#if (SMB_VFS_INTERFACE_VERSION >= 6) static void vscan_disconnect(vfs_handle_struct *handle, connection_struct *conn) -#else/* Samba 3.0 alphaX */ -static void vscan_disconnect(struct connection_struct *conn) -#endif { vscan_syslog("INFO: disconnected"); @@ -311,29 +141,16 @@ lrufiles_destroy_all(); filetype_close(); - -#if (SMB_VFS_INTERFACE_VERSION >= 6) SMB_VFS_NEXT_DISCONNECT(handle, conn); -#else - default_vfs_ops.disconnect(conn); -#endif } - -#if (SMB_VFS_INTERFACE_VERSION >= 6) static int vscan_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) -#else -static int vscan_open(struct connection_struct *conn, PROTOTYPE_CONST char *fname, int flags, mode_t mode) -#endif { - int retval, must_be_checked; + int retval, must_be_checked, rc, sockfd; SMB_STRUCT_STAT stat_buf; - int sockfd; pstring filepath; char client_ip[CLIENT_IP_SIZE]; - int rc; - /* Assemble complete file path */ pstrcpy(filepath, conn->connectpath); @@ -341,94 +158,68 @@ pstrcat(filepath, fname); /* scan files while opening? */ - if ( !scan_on_open ) { + if ( !vscan_config.common.scan_on_open ) { DEBUG(3, ("samba-vscan - open: File '%s' not scanned as scan_on_open is not set\n", fname)); -#if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif } + else if ( (SMB_VFS_NEXT_STAT(handle, conn, fname, &stat_buf)) != 0 ) { /* an error occured */ + if ( errno == ENOENT ) { + if ( verbose_file_logging ) + vscan_syslog("INFO: File %s not found! Not scanned!", fname); + } + else { + vscan_syslog("ERROR: File %s not readable or an error occured", fname); + } + } + else if ( S_ISDIR(stat_buf.st_mode) ) { /* is it a directory? */ + if ( verbose_file_logging ) + vscan_syslog("INFO: File %s is a directory! Not scanned!", fname); + } + else if ( ( stat_buf.st_size > vscan_config.common.max_size ) && ( vscan_config.common.max_size > 0 ) ) { /* file is +too large */ + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File %s is larger than specified maximum file size! Not scanned!", fname); + } + else if ( stat_buf.st_size == 0 ) { /* do not scan empty files */ + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File %s has size zero! Not scanned!", fname); + } + else if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) { + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File '%s' not scanned as file is machted by exclude regexp", filepath); + } + else if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) { + if ( verbose_file_logging ) + vscan_syslog("INFO: File '%s' not scanned as file type is on exclude list", filepath); + } else if ( (must_be_checked = lrufiles_must_be_checked(filepath, stat_buf.st_mtime)) == VSCAN_LRU_DENY_ACCESS ) { + /* file has already been checked and marked as infected */ + /* deny access */ + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File '%s' has already been scanned and marked as infected. Not scanned any more. Access denied", filepath); -#if (SMB_VFS_INTERFACE_VERSION >= 6) - if ( (SMB_VFS_NEXT_STAT(handle, conn, fname, &stat_buf)) != 0 ) /* an error occured */ - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - if ( (default_vfs_ops.stat(conn, fname, &stat_buf)) != 0 ) /* an error occured */ - return default_vfs_ops.open(conn, fname, flags, mode); -#endif - else if ( S_ISDIR(stat_buf.st_mode) ) /* is it a directory? */ -#if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif - else if ( ( stat_buf.st_size > max_size ) && ( max_size > 0 ) ) /* file is too large */ - vscan_syslog("INFO: File %s is larger than specified maximum file size! Not scanned!", fname); - else if ( stat_buf.st_size == 0 ) /* do not scan empty files */ -#if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif - else if ( filetype_skipscan(filepath) == 1 ) { - if ( verbose_file_logging ) - vscan_syslog("File '%s' not scanned as file type is on exclude list", filepath); -#if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif - } else - { + /* deny access */ + errno = EACCES; + return -1; + } else if ( must_be_checked == VSCAN_LRU_GRANT_ACCESS ) { + /* file has already been checked, not marked as infected and not modified */ + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File '%s' has already been scanned, not marked as infected and not modified. Not scanned anymore. Access granted", filepath); + } else { /* open socket */ sockfd = vscan_avastd_init(); - if ( sockfd == -1 && deny_access_on_error ) { + if ( sockfd == -1 && vscan_config.common.deny_access_on_error ) { /* an error occured - can not communicate to daemon - deny access */ vscan_syslog("ERROR: can not communicate to daemon - access denied"); errno = EACCES; return -1; } else if ( sockfd >= 0 ) { - /* get client IP */ safe_strcpy(client_ip, conn->client_address, CLIENT_IP_SIZE -1); - /* must file actually be scanned? */ - must_be_checked = lrufiles_must_be_checked(filepath, stat_buf.st_mtime); - if ( must_be_checked == -1 ) { - /* file has already been checked and marked as infected */ - /* deny access */ - if ( verbose_file_logging ) - vscan_syslog("File '%s' has already been scanned and marked as infected. Not scanned any more. Access denied", filepath); - - /* close socket */ - vscan_avastd_end(sockfd); - - /* deny access */ - errno = EACCES; - return -1; - } else if ( must_be_checked == 0 ) { - /* file has already been checked, not marked as infected and not modified */ - if ( verbose_file_logging ) - vscan_syslog("File '%s' has already been scanned, not marked as infected and not modified. Not scanned anymore. Access granted", filepath); - - /* close socket */ - vscan_avastd_end(sockfd); - - /* grant access */ -#if (SMB_VFS_INTERFACE_VERSION >= 6) - return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif - } - /* ok, we must check the file */ - /* scan file */ retval = vscan_avastd_scanfile(sockfd, filepath, client_ip); - if ( retval == -2 && deny_access_on_minor_error ) { + if ( retval == VSCAN_SCAN_MINOR_ERROR && vscan_config.common.deny_access_on_minor_error ) { /* a minor error occured - deny access */ vscan_syslog("ERROR: daemon failed with a minor error - access to file %s denied", fname); @@ -441,7 +232,7 @@ /* deny access */ errno = EACCES; return -1; - } else if ( retval == -1 && deny_access_on_error ) { + } else if ( retval == VSCAN_SCAN_ERROR && vscan_config.common.deny_access_on_error ) { /* an error occured - can not communicate to daemon - deny access */ vscan_syslog("ERROR: can not communicate to daemon - access to file %s denied", fname); @@ -452,19 +243,14 @@ lrufiles_delete(filepath); /* deny access */ - errno = EACCES; return -1; - } else if ( retval == 1 ) { + } else if ( retval == VSCAN_SCAN_VIRUS_FOUND ) { /* close socket */ vscan_avastd_end(sockfd); /* do action ... */ - -#if (SMB_VFS_INTERFACE_VERSION >= 6) - rc = vscan_do_infected_file_action(handle, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); -#else - rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); -#endif + + rc = vscan_do_infected_file_action(handle, conn, filepath, vscan_config.common.quarantine_dir, vscan_config.common.quarantine_prefix, vscan_config.common.infected_file_action); /* add/update file. mark file as infected! */ lrufiles_add(filepath, stat_buf.st_mtime, True); @@ -472,7 +258,7 @@ /* virus found, deny acces */ errno = EACCES; return -1; - } else if ( retval == 0 ) { + } else if ( retval == VSCAN_SCAN_OK ) { /* file is clean, add to lrufiles */ lrufiles_add(filepath, stat_buf.st_mtime, False); } @@ -482,84 +268,84 @@ vscan_avastd_end(sockfd); } -#if (SMB_VFS_INTERFACE_VERSION >= 6) return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); -#else - return default_vfs_ops.open(conn, fname, flags, mode); -#endif } -#if (SMB_VFS_INTERFACE_VERSION >= 6) static int vscan_close(vfs_handle_struct *handle, files_struct *fsp, int fd) -#else -static int vscan_close(struct files_struct *fsp, int fd) -#endif { + SMB_STRUCT_STAT stat_buf; pstring filepath; - int retval, rv, rc; - int sockfd; + int retval = 0, rv = 0, rc = 0, sockfd; char client_ip[CLIENT_IP_SIZE]; /* First close the file */ -#if (SMB_VFS_INTERFACE_VERSION >= 6) retval = SMB_VFS_NEXT_CLOSE(handle, fsp, fd); -#else - retval = default_vfs_ops.close(fsp, fd); -#endif - if ( !scan_on_close ) { + /* get the file name */ + pstrcpy(filepath, fsp->conn->connectpath); + pstrcat(filepath, "/"); + pstrcat(filepath, fsp->fsp_name); + + if ( !vscan_config.common.scan_on_close ) { DEBUG(3, ("samba-vscan - close: File '%s' not scanned as scan_on_close is not set\n", fsp->fsp_name)); - return retval; } - - - /* get the file name */ - pstrcpy(filepath, fsp->conn->connectpath); - pstrcat(filepath, "/"); - pstrcat(filepath, fsp->fsp_name); - /* Don't scan directorys */ - if ( fsp->is_directory ) - return retval; - - - if ( !fsp->modified ) { - if ( verbose_file_logging ) + else if ( fsp->is_directory ) + DEBUG(10, ("don't scan directory\n")); + /* Don't scan files which have not been modified */ + else if ( !fsp->modified ) { + if ( vscan_config.common.verbose_file_logging ) vscan_syslog("INFO: file %s was not modified - not scanned", filepath); - return retval; } - + /* dont' scan file which matches exclude regexp */ + else if ( fileregexp_skipscan(filepath) == VSCAN_FR_SKIP_SCAN ) { + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: file '%s' not scanned as file is machted by exclude regexp", filepath); + } /* don't scan files which are in the list of exclude file types */ - if ( filetype_skipscan(filepath) == 1 ) { - if ( verbose_file_logging ) - vscan_syslog("File '%s' not scanned as file type is on exclude list", filepath); - return retval; + else if ( filetype_skipscan(filepath) == VSCAN_FT_SKIP_SCAN ) { + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File '%s' not scanned as file type is on exclude list", filepath); } + else if ( (SMB_VFS_NEXT_STAT(handle, handle->conn, fsp->fsp_name, &stat_buf)) != 0 ) { /* an error occured */ + if( errno == ENOENT) { + if ( vscan_config.common.verbose_file_logging ) + vscan_syslog("INFO: File %s not found! Not scanned!", fsp->fsp_name); + } else { + vscan_syslog("ERROR: File %s not readable or an error occured", fsp->fsp_name); + } + } + else { + /* scan only file, do nothing */ - /* scan only file, do nothing */ + sockfd = vscan_avastd_init(); + if ( sockfd >= 0 ) { + safe_strcpy(client_ip, fsp->conn->client_address, CLIENT_IP_SIZE -1); + rv = vscan_avastd_scanfile(sockfd, filepath, client_ip); + vscan_avastd_end(sockfd); + if ( rv == VSCAN_SCAN_VIRUS_FOUND ) { + /* virus was found */ + rc = vscan_do_infected_file_action(handle, fsp->conn, filepath, vscan_config.common.quarantine_dir, vscan_config.common.quarantine_prefix, vscan_config.common.infected_file_action); - sockfd = vscan_avastd_init(); - if ( sockfd >= 0 ) { - safe_strcpy(client_ip, fsp->conn->client_address, CLIENT_IP_SIZE -1); - rv = vscan_avastd_scanfile(sockfd, filepath, client_ip); - vscan_avastd_end(sockfd); - if ( rv == 1 ) { - /* virus was found */ -#if (SMB_VFS_INTERFACE_VERSION >= 6) - rc = vscan_do_infected_file_action(handle, fsp->conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); -#else - rc = vscan_do_infected_file_action(&default_vfs_ops, fsp->conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); -#endif - } + /* add/update file, mark file as infected! */ + lrufiles_add(filepath, stat_buf.st_mtime, True); + } + else if( rv == VSCAN_SCAN_OK ) { + /* add/update file, mark file as clean! */ + lrufiles_add(filepath, stat_buf.st_mtime, False); + } + else { + /* to be save, delete file from lrufiles */ + lrufiles_delete(filepath); + } /* rv */ + } /* sockfd */ + } /* pre-scan contitions */ - } return retval; } - -#if (SMB_VFS_INTERFACE_VERSION >= 6) /* Samba 3.0 */ NTSTATUS init_module(void) { @@ -571,100 +357,9 @@ return ret; } -#else -/* VFS initialisation function. Return initialised vfs_ops structure - back to SAMBA. */ -#if SAMBA_VERSION_MAJOR==3 - /* Samba 3.0 alphaX */ - vfs_op_tuple *vfs_init(int *vfs_version, struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) -#else - /* Samba 2.2.x */ - #if SAMBA_VERSION_RELEASE>=4 - /* Samba 2.2.4 */ - struct vfs_ops *vfs_init(int *vfs_version, struct vfs_ops *def_vfs_ops) - #elif SAMBA_VERSION_RELEASE==2 - /* Samba 2.2.2 / Samba 2.2.3 !!! */ - struct vfs_ops *vfs_init(int* Version, struct vfs_ops *ops) - #elif SAMBA_VERSION_RELEASE==1 - /* Samba 2.2.1 */ - struct vfs_ops *vfs_module_init(int *vfs_version) - #else - /* Samba 2.2.0 */ - struct vfs_ops *vfs_init(int *vfs_version) - #endif -#endif -{ - #if SAMBA_VERSION_MAJOR!=3 - #if SAMBA_VERSION_RELEASE>=4 - /* Samba 2.2.4 */ - struct vfs_ops tmp_ops; - #endif - #endif - - openlog("smbd_"VSCAN_MODULE_STR, LOG_PID, SYSLOG_FACILITY); - - #if SAMBA_VERSION_MAJOR==3 - /* Samba 3.0 alphaX */ - *vfs_version = SMB_VFS_INTERFACE_VERSION; - vscan_syslog("samba-vscan (%s) loaded (Samba 3.x), (c) by Rainer Link, OpenAntiVirus.org", module_id); - #else - /* Samba 2.2.x */ - #if SAMBA_VERSION_RELEASE>=4 - /* Samba 2.2.4 */ - *vfs_version = SMB_VFS_INTERFACE_VERSION; - vscan_syslog("samba-vscan (%s) loaded (Samba >=2.2.4), (c) by Rainer Link, OpenAntiVirus.org", module_id); - #elif SAMBA_VERSION_RELEASE==2 - /* Samba 2.2.2 / Samba 2.2.3 !!! */ - *Version = SMB_VFS_INTERFACE_VERSION; - vscan_syslog("samba-vscan (%s) loaded (Samba 2.2.2/2.2.3), (c) by Rainer Link, OpenAntiVirus.org", module_id); - #else - /* Samba 2.2.1 / Samba 2.2.0 */ - *vfs_version = SMB_VFS_INTERFACE_VERSION; - vscan_syslog("samba-vscan (%s) loaded (Samba 2.2.0/2.2.1), (c) by Rainer Link, OpenAntiVirus.org", - module_id); - #endif - #endif - - #if SAMBA_VERSION_MAJOR==3 - /* Samba 3.0 alphaX */ - DEBUG(3, ("Initialising default vfs hooks\n")); - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - /* Remember vfs_handle for further allocation and referencing of - private information in vfs_handle->data - */ - vscan_handle = vfs_handle; - return vscan_ops; - #else - /* Samba 2.2.x */ - #if SAMBA_VERSION_RELEASE>=4 - /* Samba 2.2.4 */ - - *vfs_version = SMB_VFS_INTERFACE_VERSION; - memcpy(&tmp_ops, def_vfs_ops, sizeof(struct vfs_ops)); - tmp_ops.connect = vscan_connect; - tmp_ops.disconnect = vscan_disconnect; - tmp_ops.open = vscan_open; - tmp_ops.close = vscan_close; - memcpy(&vscan_ops, &tmp_ops, sizeof(struct vfs_ops)); - return(&vscan_ops); - - #else - /* Samba 2.2.3-2.2.0 */ - return(&vscan_ops); - #endif - #endif -} - - -#if SAMBA_VERSION_MAJOR==3 /* VFS finalization function */ void vfs_done(connection_struct *conn) { DEBUG(3, ("Finalizing default vfs hooks\n")); } -#endif - -#endif /* #if (SMB_VFS_INTERFACE_VERSION >= 6) */ Index: vscan-avastd_core.c =================================================================== RCS file: /cvsroot/openantivirus/samba3-vscan/avast/vscan-avastd_core.c,v retrieving revision 1.1 retrieving revision 1.2 diff -u -d -r1.1 -r1.2 --- vscan-avastd_core.c 29 Aug 2005 12:51:22 -0000 1.1 +++ vscan-avastd_core.c 2 Oct 2005 12:27:43 -0000 1.2 @@ -4,8 +4,8 @@ * Copyright (C) Frantisek Mensik, 2005 * ALWIL Software * - * base on the F-Prot Daemon module by - * Copyright (C) Rainer Link, 2001-2003 + * based on the F-Prot Daemon module by + * Copyright (C) Rainer Link, 2001-2005 * OpenAntiVirus.org <rainer-pBPPa8WU5k41Tgt60Rntydi2O/[email protected]> * * Credits to W. Richard Stevens - RIP @@ -136,7 +136,7 @@ fpin = fdopen(sockfd, "r"); if ( fpin == NULL ) { vscan_syslog("ERROR: Can not open stream for reading - %s", strerror(errno)); - return -1; + return VSCAN_SCAN_ERROR; } fpout = fdopen(sockfd, "w"); @@ -144,7 +144,7 @@ /* close fpin */ fclose(fpin); vscan_syslog("ERROR: Can not open stream for writing - %s", strerror(errno)); - return -1; + return VSCAN_SCAN_ERROR; } /* read from socket-stream */ @@ -153,7 +153,7 @@ fclose(fpin); fclose(fpout); vscan_syslog("ERROR: can not get result from avast! daemon"); - return -1; + return VSCAN_SCAN_ERROR; } /* check for welcome string */ @@ -162,7 +162,7 @@ fclose(fpin); fclose(fpout); vscan_syslog("ERROR: avast! daemon is not available"); - return -1; + return VSCAN_SCAN_ERROR; } if ( verbose_file_logging ) @@ -182,7 +182,7 @@ /* closing streams */ fclose(fpout); fclose(fpin); - return -1; + return VSCAN_SCAN_ERROR; } /* hum, instead of flush()ing, use setvbuf to set to line-buffering? */ @@ -192,7 +192,7 @@ fclose(fpout); fclose(fpin); /* better safe than sorry ... */ - return -1; + return VSCAN_SCAN_ERROR; } @@ -209,7 +209,7 @@ fclose(fpin); fclose(fpout); vscan_syslog("ERROR: file %s not found, not readable or an error occured", scan_file); - return -1; + return VSCAN_SCAN_ERROR; } else { /* ready for reading scanned file result */ receiving_data = True; @@ -223,7 +223,7 @@ /* closing streams */ fclose(fpout); fclose(fpin); - return 1; + return VSCAN_SCAN_VIRUS_FOUND; } else if ( (str = strstr(recvline, "\t[E]\t" )) != NULL ) { received_error = True; } @@ -236,7 +236,7 @@ /* closing streams */ fclose(fpout); fclose(fpin); - return -1; + return VSCAN_SCAN_ERROR; } else { /* OK */ @@ -248,8 +248,8 @@ fclose(fpout); fclose(fpin); - if ( received_error == True ) return -2; - return 0; + if ( received_error == True ) return VSCAN_SCAN_MINOR_ERROR; + return VSCAN_SCAN_OK; } ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl