[Mimedefang] virus scanner handling in Example filter

Martin Bene martin.bene at icomedias.com
Sat Jul 20 10:34:01 EDT 2002


Hi David,

While upgrading to minedefang 2.16 I based my new filter on the
suggested-minimum-filter-for-windows-clients file; I think the virus scanner
handling in this filter is not yet optimal:

in filter_start, I found:
    # Scan for viruses if any virus-scanners are installed
    my($code, $category, $action) = message_contains_virus();
    $FoundVirus = ($category eq "virus");

several problems with this code; let's first look at the possible return
values. The different interpret_xxx_code functions return:

category
=========
ok
swerr
virus
interrupted
suspicious

action
=======
ok
tempfail
quarantine

Now, picking just "virus" for further action really seems a bit careless.

I much prefer the following:

    if ($action eq "tempfail") {
        return action_tempfail("Internal error in virus scanner, please try
again later");
    }
    $FoundVirus = ($action eq "quarantine");

Oh, and another thing I noticed when compiling the possible return values: in
interpret_rav_code there's a "tmpfail" action on one line instead of
"tempfail", should be fixed as well.

Bye, Martin




More information about the MIMEDefang mailing list