<div dir="ltr">Ok .<div><br></div><div>Put simpy: to scan a file i ran: scan path_of_the file.</div><div>Of course a service in backgroud (like clamd) should be up ad running (/bin/avast)</div><div><br></div><div><br></div><div>I've modified sub analyze_virus :</div><div><br></div><div><div> my ($queue, $filename, $pmg_cfg, $testmode) = @_;</div><div><br></div><div> my $virus = undef ;</div><div> my $enable_avast = 1 ;</div><div> my $enable_clamav = 1 ;</div><div><br></div><div> # first analyze with avast</div><div> if ( $enable_avast ) {</div><div> syslog('info', "Starting Avast Scanning...");</div><div> $virus = analyze_virus_avast($queue, $filename, $pmg_cfg) ;</div><div> }</div><div><br></div><div> if ( ! defined $virus && $enable_clamav ) {</div><div> syslog('info', "Starting Clamav Scanning...");</div><div> $virus = analyze_virus_clam($queue, $filename, $pmg_cfg) ;</div><div> }</div><div><br></div><div> return $virus ;</div></div><div><br></div><div>DESC: I've privileged the use of avast vs clamd , so if avast does not find nothing (so $virus is undef) i'm calling the second scan.</div><div><br></div><div>Now the sub <span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">analyze_virus_avast:</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="text-align:start;text-indent:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><div> my ($queue, $dname, $pmg_cfg) = @_;</div><div><br></div><div> my $timeout = 60*5;</div><div> my $vinfo;</div><div><br></div><div> my $clamdscan_opts = "";</div><div><br></div><div> my ($csec, $usec) = gettimeofday();</div><div><br></div><div> my $previous_alarm;</div><div><br></div><div> eval {</div><div><br></div><div> $previous_alarm = alarm($timeout);</div><div><br></div><div> $SIG{ALRM} = sub {</div><div> die "$queue->{logid}: Maximum time ($timeout sec) exceeded. " .</div><div> "virus analyze (avast) failed: ERROR";</div><div> };</div><div><br></div><div> open(CMD, "/bin/scan '$dname'|") ||</div><div> die "$queue->{logid}: can't exec avast: $! : ERROR";</div><div><br></div><div> my $ifiles;</div><div><br></div><div> my $response = '';</div><div> #syslog('info', "file is" . $dname);</div><div> #sleep(300);</div><div><span style="white-space:pre"> </span></div><div> while ( defined(my $line = <CMD>) ) {</div><div> if ($line =~ m/^$dname\s+(.*)\s+$/) {</div><div> # output is: /tmp/pippo.txt<span style="white-space:pre"> </span>EICAR Test-NOT virus!!!</div><div><span style="white-space:pre"> </span> #syslog('info', "grepped virus line is" . $1);</div><div> # we just use the first detected virus name</div><div> $vinfo = $1 if !$vinfo;</div><div><span style="white-space:pre"> </span>$ifiles = 1 ;</div><div> } </div><div><br></div><div> $response .= $line;</div><div> }</div><div><br></div><div><span style="white-space:pre"> </span>close(CMD);</div><div><br></div><div> alarm(0); # avoid race conditions</div><div><br></div><div><span style="white-space:pre"> </span>$ifiles = 0 if ( !$vinfo ) ;</div><div><br></div><div> if (!defined($ifiles)) {</div><div> die "$queue->{logid}: got undefined output from " .</div><div> "virus detector: $response : ERROR";</div><div> }</div><div><br></div><div> if ($vinfo) {</div><div> syslog('info', "$queue->{logid}: virus detected: $vinfo (avast)");</div><div> }</div><div> };</div><div> my $err = $@;</div><div><br></div><div> alarm($previous_alarm);</div><div><br></div><div> my ($csec_end, $usec_end) = gettimeofday();</div><div> $queue->{ptime_clam} =</div><div> int (($csec_end-$csec)*1000 + ($usec_end - $usec)/1000);</div><div><br></div><div> if ($err) {</div><div> syslog ('err', $err);</div><div> $vinfo = undef;</div><div> $queue->{errors} = 1;</div><div> }</div><div><br></div><div> $queue->{vinfo_clam} = $vinfo;</div><div><br></div><div> return $vinfo ? "$vinfo (avast)" : undef;</div><div>}</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px">DESC: as you can see is mostly equal to clamav one, i've just modified the regexp.</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px">1 question: is the sub expected to be called on every single part/file of the undecoded mail ?</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px">2 question: would I expect from the while ONLY one line of output (this is just a natural follow up of question1) </div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px">Thx </div></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div> </div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 20, 2018 at 6:22 PM, Dietmar Maurer <span dir="ltr"><<a href="mailto:dietmar@proxmox.com" target="_blank">dietmar@proxmox.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> I'm just add support for avast (daemonized).<br>
> I've modified the analyze_clamav code to use avast (cmd line scan).<br>
><br>
> Is in your interest to post my code here for a quick review ?<br>
<br>
</span>yes :-)<br>
<br>
______________________________<wbr>_________________<br>
pmg-devel mailing list<br>
<a href="mailto:pmg-devel@pve.proxmox.com">pmg-devel@pve.proxmox.com</a><br>
<a href="https://pve.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel" rel="noreferrer" target="_blank">https://pve.proxmox.com/cgi-<wbr>bin/mailman/listinfo/pmg-devel</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Got problems with Windows? - ReBooT<br>Got problems with Linux? - Be RooT </div>
</div>