HTTP Anti-Virus Proxy

Hi,

big files seems to pass without scanning:
When you download small files (1M, 2M...) you can see temp files in the mandatory locking directory growing then disapear when fully downloaded.

When you download big files (650M (iso)), you can see a temp file in locking dir that disapear almos instantanly.

It seems to be related to "dynamic scanning" (around line 688) section of proxyhandler.cpp.


Dynamic scanning means there is no temp file and the content is scanned on the fly ?

Bye,
Mat.

What is your MAXSCANSIZE? When you have downloaded this much, the tempfiles are deleted already.

Cheers,
Henrik

The size of the file I'm downloading is 717729792.

My MAXSCANSIZE is 1717729792. --> I realize it's a wrong value... it is greater than MAXFILELOCKSIZE....

(but I also tried MAXSCANSIZE 0).

I'll try to give you a simple example of the issue, with smaller files that shouldn't exceed any MAX values:

9.7Mb iso file:
http://mirrors.ircam.fr/pub/CentOS/4/os ... s/boot.iso
a temp file is created, starts to grow and disapear quickly.

a 12Mb img file:
http://mirrors.ircam.fr/pub/CentOS/4/os ... skboot.img
a temp file is created, grows up to 12Mb and disapear after scanning.

Bye,
Mat.

How do you mean it starts to grow? If you download smaller files than MAXSCANSIZE, it will be fully allocated and it stays the same size. If it does grow, either you have some config error or old buggy version.

If you download something over MAXSCANSIZE, then the file will grow as you download it.

What scanner are you using? It might decide it's not a virus and finish scanning immediately.

Cheers,
Henrik

I mean, a temp file with final size is allocated, then it's filled with downloaded data.


clamd and f-prot (with -dumb) with same results.

Is there any chances that .iso files are bypassed with those two av ?

Cheers,
Henrik[/quote]

It seems neither of them scan into .iso, so that explains it..

Cheers,
Henrik