[Mimedefang] MIMEDefang 2.3 BETA 4 is out -- major virus-scanning rework
David F. Skoll
dfs at roaringpenguin.com
Tue Jan 15 16:42:45 EST 2002
Hi,
Beta 4 is at
http://www.roaringpenguin.com/mimedefang/mimedefang-2.3-BETA-4.tar.gz
Thanks to everyone who e-mailed virus-scanner exit codes. I have
reworked the virus-scanning code. THERE ARE MAJOR CHANGES; do not
upgrade on a production system without reading this:
- There are no more generic entity_contains_virus() and
message_contains_virus() functions. You have to use the specific
ones for your virus scanner (eg entity_contains_virus_nai, etc.)
- You should now call the *_contains_virus_* functions in list context.
Do something like this:
($code, $category, $recommended_action) = message_contains_virus_nai();
$code is set to the actual exit code of the virus scanner.
$category is set to one of the following strings:
"ok" - No viruses detected
"not-installed" - The specified virus scanner is not installed
"cannot-execute" - For some reason, the scanner could not be executed
"virus" - A virus or suspicious file was found
"interrupted" - Virus scanning did not complete
"swerr" - Some other internal software error
$recommended_action is set to one of the following strings:
"ok" - Allow part/message through
"quarantine" - Quarantine the part: Virus was found
"tempfail" - Send an SMTP temporary failure code
New actions:
action_tempfail() - Send an SMTP temporary failure code
action_quarantine_entire_message() - Copy the entire message
to the quarantine directory, but do not otherwise affect
message disposition.
Example virus-scanning filter (NOT TESTED!! May not even be syntactically
correct!) Not optimized for efficiency!
sub filter_begin {
my($code, $category, $action) = message_contains_virus_nai();
if ($action eq "tempfail") {
action_tempfail();
}
}
sub filter {
my($entity, $fname, $ext, $type) = @_;
my($code, $category, $action) = entity_contains_virus_nai($entity);
if ($action eq "tempfail") {
action_tempfail();
return;
}
if ($action eq "quarantine") {
action_quarantine_entire_message();
action_quarantine($entity, "Found a virus");
return;
}
# ... blah blah rest of filter
}
Regards,
David.
Roaring Penguin Software Inc. | http://www.roaringpenguin.com
GPG fingerprint: C523 771C 3710 0F54 B2D2 4B0D C6EF 6991 34AB 95BA
GPG public key: http://www.roaringpenguin.com/dskoll-key-2002.txt ID: 34AB95BA
More information about the MIMEDefang
mailing list