Sophie 3.05 Released: Q about scandir patch

Dirk Kraemer <[email protected]> Tue, 20 Dec 2005 16:07:17 +0100
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi all!

On Nov 24 2003 I posted following to the list about the
scandir patch which seems now to be part of sophie 3.05.
There seemed to be a problem for me when handling encrypted,
compressed etc. files if sophie is used within an
environment where such errors lead to a requeueing.
If sophie cannot decrypt a file because the password
is missing, then it will not be able to decrypt it
in future attempts.

It's not really a problem of sophie, we should just
be aware when using it, because now behaviour is
different.

I did not inspect new sophie in detail, maybe I am wrong,
would be glad to get some comments.

Regards

Dirk

Here is my old posting:

 > Hi list!
 >
 > I think Sebastian's scandir patch looks good and should be applied.
 >
 > However, consequences should be clear:
 >
 > Without configure option --enable-only-fatal-err each internal
 > error would be reported as -1. It depends on calling program
 > what happens then. Amavis, e.g. has an internal switch
 > called $requeue_on_scanner_errors (default = "yes") which
 > would make amavis requeue the mail. But that would make no sense
 > for a corrupted or encrypted mail, it will not be different
 > next time. There was a discussion on the list about it some
 > time ago. So in this environment --enable-only-fatal-err
 > should be strongly recommended, otherwise such mails would
 > be blocked (and a mail scanner should not block mails he
 > cannot decrypt).
 >
 >                       virus   non fatal error   fatal error
 > ----------------------------------------------------------------
 > sophie3.03              1          0                 0
 >
 > sophie-3.04rc1          1          0                 0
 >
 > sophie-3.04rc1          1         -1                -1
 >  with scandir-patch
 >
 > sophie-3.04rc1          1          0                -1
 >  with scandir-patch
 >  --enable-only-fatal-err
 >
 >
 > Those who would prefer to completely keep old behavior
 > of sophie must make the calling program treat -1 return
 > code always the same as 0.
 >
 > I think it should be mentioned within docs because the patch
 > would change sophie's behaviour.
 >
 >
 > Dirk