qmail-scanner f-prot bug

Hi,

there seems to be a small but very bad bug in the f-prot scanning part of qmail-scanner.

The error codes of f-prot scanner are not evaluated correctly. Thus mail may be rejected/not delivered although scanning was quite ok.

The problem is, that there are error codes (>8) that are actually only warnings. IMHO these warnings should not result in rejecting the whole mail.

Example is an java .jar file. f-prot complains about that files and exits with error code 8.

In the current implementation of qmail-scanner this results in:
"corrupt or unknown F-Prot scanner error or memory/resource/perms problem"
which is not very useful.

I would recommend to throw a warning instead of exiting in that case.
I attach a patch for that.

For possible f-prot error codes see man page:
------><------
PROGRAM EXIT CODES
       0      Normal exit.  Nothing found, nothing done.

       1      Unrecoverable error (e.g., missing virus signature files).

       2      Selftest failed (program has been modified).

       3      At least one virus-infected object was found.

       4      Reserved, not currently in use.

       5      Abnormal termination (scanning did not finish).

       6      At least one virus was removed.

       7      Error, out of memory.

       8      At least one suspicious object was found.

       9      At  least  one  object  was  not scanned (encrypted file, unsup-
              ported/unknown compression method, unsupported/unknown file for-
              mat, corrupted or invalid file).

       10     At lest one archive object was not scanned (contains more then N
              levels of nested archives, as specified with -archive switch).
------><------

Regards,
dimaki

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general

--- qmail-scanner-queue.pl.org	2006-05-09 14:05:09.000000000 +0200
+++ qmail-scanner-queue.pl	2007-04-04 12:08:44.000000000 +0200
@@ -2589,9 +2601,9 @@
   my ($DD,$fprot_status,$efprot_status,$stop_fprot_time,$fprot_time,$fprot_verbose);
   $fprot_verbose="-list" if ($DEBUG);
 
-  &debug("run $fprot_binary  $fprot_verbose -archive -dumb  $ENV{'TMPDIR'}  2>&1");
+  &debug("run $fprot_binary $fprot_verbose -ai -archive -dumb  $ENV{'TMPDIR'}  2>&1");
 
-  $DD=`$fprot_binary -ai -archive -dumb  $ENV{'TMPDIR'} 2>&1`;
+  $DD=`$fprot_binary $fprot_verbose -ai -archive -dumb  $ENV{'TMPDIR'} 2>&1`;
   $fprot_status=$?;
   $efprot_status=($fprot_status >> 8);
 
@@ -2607,8 +2619,13 @@
       $quarantine_event="FPROT:".substr($quarantine_event,0,$QE_LEN);
       $description .= "\n---fprot results ---\n$DD";
     } else {
-      #This implies a corrupt set of DAT files or resource problems...
-      &error_condition("corrupt or unknown F-Prot scanner error or memory/resource/perms problem - exit status $fprot_status/$efprot_status");
+      if ($efprot_status > 8) {
+        #At least one file was not scanned
+        &debug("Warning: At least one file was not scanned - exit status $fprot_status/$efprot_status");
+      } else {
+        #This implies a corrupt set of DAT files or resource problems...
+        &error_condition("corrupt or unknown F-Prot scanner error or memory/resource/perms problem - exit status $fprot_status/$efprot_status");
+      }
     }  
   } elsif ($fprot_status > 0) {
     #This implies a corrupt set of DAT files or resource problems...