2 * scannedonly VFS module for Samba 3.5
4 * Copyright 2007,2008,2009,2010 (C) Olivier Sessink
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 * scannedonly implements a 'filter' like vfs module that talks over a
23 * unix domain socket or over UDP to a anti-virus engine.
25 * files that are clean have a corresponding .scanned:{filename} file
26 * in the same directory. So why the .scanned: files? They take up
27 * only an inode, because they are 0 bytes. To test if the file is
28 * scanned only a stat() call on the filesystem is needed which is
29 * very quick compared to a database lookup. All modern filesystems
30 * use database technology such as balanced trees for lookups anyway.
31 * The number of inodes in modern filesystems is also not limiting
32 * anymore. The .scanned: files are also easy scriptable. You can
33 * remove them with a simple find command or create them with a
34 * simple touch command. Extended filesystem attributes have similar
35 * properties, but are not supported on all filesystems, so that
36 * would limit the usage of the module (and attributes are not as
39 * files that are not clean are sent to the AV-engine. Only the
40 * filename is sent over the socket. The protocol is very simple:
41 * a newline separated list of filenames inside each datagram.
43 * a file AV-scan may be requested multiple times, the AV-engine
44 * should also check if the file has been scanned already. Requests
45 * can also be dropped by the AV-engine (and we thus don't need the
46 * reliability of TCP).
51 #include "smbd/smbd.h"
52 #include "system/filesys.h"
56 #define SENDBUFFERSIZE 1450
59 #define SUN_LEN(sunp) ((size_t)((struct sockaddr_un *)0)->sun_path \
60 + strlen((sunp)->sun_path))
68 int scanning_message_len;
69 int recheck_time_open;
70 int recheck_tries_open;
71 int recheck_size_open;
72 int recheck_time_readdir;
73 int recheck_tries_readdir;
74 bool show_special_files;
75 bool rm_hidden_files_on_rmdir;
76 bool hide_nonscanned_files;
77 bool allow_nonscanned_files;
78 const char *socketname;
80 const char *scanning_message;
81 const char *p_scanned; /* prefix for scanned files */
82 const char *p_virus; /* prefix for virus containing files */
83 const char *p_failed; /* prefix for failed to scan files */
84 char gsendbuffer[SENDBUFFERSIZE + 1];
87 #define STRUCTSCANO(var) ((struct Tscannedonly *)var)
89 struct scannedonly_DIR {
94 #define SCANNEDONLY_DEBUG 9
95 /*********************/
96 /* utility functions */
97 /*********************/
99 static char *real_path_from_notify_path(TALLOC_CTX *ctx,
100 struct Tscannedonly *so,
106 name = strrchr(path, '/');
110 pathlen = name - path;
113 if (len <= so->scanning_message_len) {
117 if (strcmp(name + (len - so->scanning_message_len),
118 so->scanning_message) != 0) {
122 return talloc_strndup(ctx,path,
123 pathlen + len - so->scanning_message_len);
126 static char *cachefile_name(TALLOC_CTX *ctx,
127 const char *shortname,
129 const char *p_scanned)
131 return talloc_asprintf(ctx, "%s%s%s", base, p_scanned, shortname);
134 static char *name_w_ending_slash(TALLOC_CTX *ctx, const char *name)
136 int len = strlen(name);
137 if (name[len - 1] == '/') {
138 return talloc_strdup(ctx,name);
140 return talloc_asprintf(ctx, "%s/", name);
144 static char *cachefile_name_f_fullpath(TALLOC_CTX *ctx,
145 const char *fullpath,
146 const char *p_scanned)
149 char *tmp, *cachefile;
150 const char *shortname;
151 tmp = strrchr(fullpath, '/');
153 base = talloc_strndup(ctx, fullpath, (tmp - fullpath) + 1);
157 shortname = (const char *)fullpath;
159 cachefile = cachefile_name(ctx, shortname, base, p_scanned);
160 DEBUG(SCANNEDONLY_DEBUG,
161 ("cachefile_name_f_fullpath cachefile=%s\n", cachefile));
165 static char *construct_full_path(TALLOC_CTX *ctx, vfs_handle_struct * handle,
166 const char *somepath, bool ending_slash)
173 if (somepath[0] == '/') {
175 return name_w_ending_slash(ctx,somepath);
177 return talloc_strdup(ctx,somepath);
180 if (tmp[0]=='.'&&tmp[1]=='/') {
183 /* vfs_GetWd() seems to return a path with a slash */
185 return talloc_asprintf(ctx, "%s/%s/",
186 vfs_GetWd(ctx, handle->conn),tmp);
188 return talloc_asprintf(ctx, "%s/%s",
189 vfs_GetWd(ctx, handle->conn),tmp);
192 static int connect_to_scanner(vfs_handle_struct * handle)
194 struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
196 if (so->domain_socket) {
197 struct sockaddr_un saun;
198 DEBUG(SCANNEDONLY_DEBUG, ("socket=%s\n", so->socketname));
199 if ((so->socket = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) {
200 DEBUG(2, ("failed to create socket %s\n",
204 saun.sun_family = AF_UNIX;
205 strncpy(saun.sun_path, so->socketname,
206 sizeof(saun.sun_path) - 1);
207 if (connect(so->socket, (struct sockaddr *)(void *)&saun,
208 SUN_LEN(&saun)) < 0) {
209 DEBUG(2, ("failed to connect to socket %s\n",
213 DEBUG(SCANNEDONLY_DEBUG,("bound %s to socket %d\n",
214 saun.sun_path, so->socket));
217 so->socket = open_udp_socket(so->scanhost, so->portnum);
218 if (so->socket < 0) {
219 DEBUG(2,("failed to open UDP socket to %s:%d\n",
220 so->scanhost,so->portnum));
225 {/* increasing the socket buffer is done because we have large bursts
226 of UDP packets or DGRAM's on a domain socket whenever we hit a
227 large directory with lots of unscanned files. */
229 socklen_t size = sizeof(int);
230 getsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
231 (char *)&sndsize, &size);
232 DEBUG(SCANNEDONLY_DEBUG, ("current socket buffer size=%d\n",
235 if (setsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
237 (int)sizeof(sndsize)) != 0) {
238 DEBUG(SCANNEDONLY_DEBUG,
239 ("error setting socket buffer %s (%d)\n",
240 strerror(errno), errno));
243 set_blocking(so->socket, false);
247 static void flush_sendbuffer(vfs_handle_struct * handle)
249 struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
250 int ret, len, loop = 10;
251 if (so->gsendbuffer[0] == '\0') {
257 len = strlen(so->gsendbuffer);
258 ret = send(so->socket, so->gsendbuffer, len, 0);
260 so->gsendbuffer[0] = '\0';
264 DEBUG(3,("scannedonly flush_sendbuffer: "
265 "error sending on socket %d to scanner:"
267 so->socket, strerror(errno), errno));
268 if (errno == ECONNREFUSED || errno == ENOTCONN
269 || errno == ECONNRESET) {
270 if (connect_to_scanner(handle) == -1)
271 break; /* connecting fails, abort */
273 } else if (errno != EINTR) {
274 /* on EINTR we just try again, all remaining
275 other errors we log the error
276 and try again ONCE */
278 DEBUG(3,("scannedonly flush_sendbuffer: "
279 "error sending data to scanner: %s "
280 "(%d)\n", strerror(errno), errno));
283 /* --> partial write: Resend all filenames that were
284 not or not completely written. a partial filename
285 written means the filename will not arrive correctly,
286 so resend it completely */
289 char *tmp = strchr(so->gsendbuffer+pos, '\n');
290 if (tmp && tmp - so->gsendbuffer < ret)
291 pos = tmp - so->gsendbuffer + 1;
295 memmove(so->gsendbuffer, so->gsendbuffer + pos,
296 SENDBUFFERSIZE - ret);
301 if (so->gsendbuffer[0] != '\0') {
303 ("scannedonly flush_sendbuffer: "
304 "failed to send files to AV scanner, "
305 "discarding files."));
306 so->gsendbuffer[0] = '\0';
310 static void notify_scanner(vfs_handle_struct * handle, const char *scanfile)
313 int tmplen, gsendlen;
314 struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
315 TALLOC_CTX *ctx=talloc_tos();
316 if (scanfile[0] != '/') {
317 tmp = construct_full_path(ctx,handle, scanfile, false);
319 tmp = (const char *)scanfile;
321 tmplen = strlen(tmp);
322 gsendlen = strlen(so->gsendbuffer);
323 DEBUG(SCANNEDONLY_DEBUG,
324 ("scannedonly notify_scanner: tmp=%s, tmplen=%d, gsendlen=%d\n",
325 tmp, tmplen, gsendlen));
326 if (gsendlen + tmplen >= SENDBUFFERSIZE) {
327 flush_sendbuffer(handle);
329 strlcat(so->gsendbuffer, tmp, SENDBUFFERSIZE + 1);
330 strlcat(so->gsendbuffer, "\n", SENDBUFFERSIZE + 1);
333 static bool is_scannedonly_file(struct Tscannedonly *so, const char *shortname)
335 if (shortname[0]!='.') {
338 if (strncmp(shortname, so->p_scanned, strlen(so->p_scanned)) == 0) {
341 if (strncmp(shortname, so->p_virus, strlen(so->p_virus)) == 0) {
344 if (strncmp(shortname, so->p_failed, strlen(so->p_failed)) == 0) {
350 static bool timespec_is_newer(struct timespec *base, struct timespec *test)
352 return timespec_compare(base,test) < 0;
356 vfs_handle_struct *handle the scannedonly handle
357 scannedonly_DIR * sDIR the scannedonly struct if called from _readdir()
359 fullpath is a full path starting from / or a relative path to the
360 current working directory
361 shortname is the filename without directory components
362 basename, is the directory without file name component
363 allow_nonexistant return TRUE if stat() on the requested file fails
364 recheck_time, the time in milliseconds to wait for the daemon to
365 create a .scanned file
366 recheck_tries, the number of tries to wait
367 recheck_size, size in Kb of files that should not be waited for
368 loop : boolean if we should try to loop over all files in the directory
369 and send a notify to the scanner for all files that need scanning
371 static bool scannedonly_allow_access(vfs_handle_struct * handle,
372 struct scannedonly_DIR *sDIR,
373 struct smb_filename *smb_fname,
374 const char *shortname,
375 const char *base_name,
376 int allow_nonexistant,
377 int recheck_time, int recheck_tries,
378 int recheck_size, int loop)
380 struct smb_filename *cache_smb_fname;
381 TALLOC_CTX *ctx=talloc_tos();
385 DEBUG(SCANNEDONLY_DEBUG,
386 ("smb_fname->base_name=%s, shortname=%s, base_name=%s\n"
387 ,smb_fname->base_name,shortname,base_name));
389 if (ISDOT(shortname) || ISDOTDOT(shortname)) {
392 if (is_scannedonly_file(STRUCTSCANO(handle->data), shortname)) {
393 DEBUG(SCANNEDONLY_DEBUG,
394 ("scannedonly_allow_access, %s is a scannedonly file, "
395 "return 0\n", shortname));
399 if (!VALID_STAT(smb_fname->st)) {
400 DEBUG(SCANNEDONLY_DEBUG,("stat %s\n",smb_fname->base_name));
401 retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
403 /* failed to stat this file?!? --> hide it */
404 DEBUG(SCANNEDONLY_DEBUG,("no valid stat, return"
405 " allow_nonexistant=%d\n",
407 return allow_nonexistant;
410 if (!S_ISREG(smb_fname->st.st_ex_mode)) {
411 DEBUG(SCANNEDONLY_DEBUG,
412 ("%s is not a regular file, ISDIR=%d\n",
413 smb_fname->base_name,
414 S_ISDIR(smb_fname->st.st_ex_mode)));
415 return (STRUCTSCANO(handle->data)->
416 show_special_files ||
417 S_ISDIR(smb_fname->st.st_ex_mode));
419 if (smb_fname->st.st_ex_size == 0) {
420 DEBUG(SCANNEDONLY_DEBUG,("empty file, return 1\n"));
421 return true; /* empty files cannot contain viruses ! */
423 cachefile = cachefile_name(ctx,
426 STRUCTSCANO(handle->data)->p_scanned);
427 create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,&cache_smb_fname);
428 if (!VALID_STAT(cache_smb_fname->st)) {
429 retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
431 if (retval == 0 && VALID_STAT(cache_smb_fname->st)) {
432 if (timespec_is_newer(&smb_fname->st.st_ex_ctime,
433 &cache_smb_fname->st.st_ex_ctime)) {
434 talloc_free(cache_smb_fname);
437 /* no cachefile or too old */
438 SMB_VFS_NEXT_UNLINK(handle, cache_smb_fname);
442 notify_scanner(handle, smb_fname->base_name);
445 if (loop && sDIR && !sDIR->notify_loop_done) {
446 /* check the rest of the directory and notify the
447 scanner if some file needs scanning */
449 SMB_STRUCT_DIRENT *dire;
451 offset = SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
452 dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, NULL);
455 struct smb_filename *smb_fname2;
456 fpath2 = talloc_asprintf(ctx, "%s%s", base_name,dire->d_name);
457 DEBUG(SCANNEDONLY_DEBUG,
458 ("scannedonly_allow_access in loop, "
459 "found %s\n", fpath2));
460 create_synthetic_smb_fname(ctx, fpath2,NULL,NULL,
462 scannedonly_allow_access(handle, NULL,
465 base_name, 0, 0, 0, 0, 0);
467 talloc_free(smb_fname2);
468 dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR,NULL);
470 sDIR->notify_loop_done = 1;
472 SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
475 && ((recheck_size > 0
476 && smb_fname->st.st_ex_size < (1024 * recheck_size))
479 flush_sendbuffer(handle);
480 while (retval != 0 /*&& errno == ENOENT */
481 && i < recheck_tries) {
482 DEBUG(SCANNEDONLY_DEBUG,
483 ("scannedonly_allow_access, wait (try=%d "
484 "(max %d), %d ms) for %s\n",
486 recheck_time, cache_smb_fname->base_name));
487 smb_msleep(recheck_time);
488 retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
492 /* still no cachefile, or still too old, return 0 */
494 || !timespec_is_newer(&smb_fname->st.st_ex_ctime,
495 &cache_smb_fname->st.st_ex_ctime)) {
496 DEBUG(SCANNEDONLY_DEBUG,
497 ("retval=%d, return 0\n",retval));
503 /*********************/
505 /*********************/
507 static SMB_STRUCT_DIR *scannedonly_opendir(vfs_handle_struct * handle,
509 const char *mask, uint32 attr)
511 SMB_STRUCT_DIR *DIRp;
512 struct scannedonly_DIR *sDIR;
514 DIRp = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
519 sDIR = talloc(NULL, struct scannedonly_DIR);
520 if (fname[0] != '/') {
521 sDIR->base = construct_full_path(sDIR,handle, fname, true);
523 sDIR->base = name_w_ending_slash(sDIR, fname);
525 DEBUG(SCANNEDONLY_DEBUG,
526 ("scannedonly_opendir, fname=%s, base=%s\n",fname,sDIR->base));
528 sDIR->notify_loop_done = 0;
529 return (SMB_STRUCT_DIR *) sDIR;
532 static SMB_STRUCT_DIR *scannedonly_fdopendir(vfs_handle_struct * handle,
534 const char *mask, uint32 attr)
536 SMB_STRUCT_DIR *DIRp;
537 struct scannedonly_DIR *sDIR;
540 DIRp = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
545 fname = (const char *)fsp->fsp_name->base_name;
547 sDIR = talloc(NULL, struct scannedonly_DIR);
548 if (fname[0] != '/') {
549 sDIR->base = construct_full_path(sDIR,handle, fname, true);
551 sDIR->base = name_w_ending_slash(sDIR, fname);
553 DEBUG(SCANNEDONLY_DEBUG,
554 ("scannedonly_fdopendir, fname=%s, base=%s\n",fname,sDIR->base));
556 sDIR->notify_loop_done = 0;
557 return (SMB_STRUCT_DIR *) sDIR;
561 static SMB_STRUCT_DIRENT *scannedonly_readdir(vfs_handle_struct *handle,
562 SMB_STRUCT_DIR * dirp,
563 SMB_STRUCT_STAT *sbuf)
565 SMB_STRUCT_DIRENT *result;
568 struct smb_filename *smb_fname;
571 SMB_STRUCT_DIRENT *newdirent;
572 TALLOC_CTX *ctx=talloc_tos();
574 struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
579 result = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, sbuf);
584 if (is_scannedonly_file(STRUCTSCANO(handle->data), result->d_name)) {
585 DEBUG(SCANNEDONLY_DEBUG,
586 ("scannedonly_readdir, %s is a scannedonly file, "
587 "skip to next entry\n", result->d_name));
588 return scannedonly_readdir(handle, dirp, NULL);
590 tmp = talloc_asprintf(ctx, "%s%s", sDIR->base, result->d_name);
591 DEBUG(SCANNEDONLY_DEBUG,
592 ("scannedonly_readdir, check access to %s (sbuf=%p)\n",
595 /* even if we don't hide nonscanned files or we allow non scanned
596 files we call allow_access because it will notify the daemon to
598 create_synthetic_smb_fname(ctx, tmp,NULL,
599 sbuf?VALID_STAT(*sbuf)?sbuf:NULL:NULL,
601 allowed = scannedonly_allow_access(
602 handle, sDIR, smb_fname,
605 STRUCTSCANO(handle->data)->hide_nonscanned_files
606 ? STRUCTSCANO(handle->data)->recheck_time_readdir
608 STRUCTSCANO(handle->data)->recheck_tries_readdir,
611 DEBUG(SCANNEDONLY_DEBUG,
612 ("scannedonly_readdir access to %s (%s) = %d\n", tmp,
613 result->d_name, allowed));
617 DEBUG(SCANNEDONLY_DEBUG,
618 ("hide_nonscanned_files=%d, allow_nonscanned_files=%d\n",
619 STRUCTSCANO(handle->data)->hide_nonscanned_files,
620 STRUCTSCANO(handle->data)->allow_nonscanned_files
623 if (!STRUCTSCANO(handle->data)->hide_nonscanned_files
624 || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
628 DEBUG(SCANNEDONLY_DEBUG,
629 ("scannedonly_readdir, readdir listing for %s not "
630 "allowed, notify user\n", result->d_name));
631 notify_name = talloc_asprintf(
632 ctx,"%s %s",result->d_name,
633 STRUCTSCANO(handle->data)->scanning_message);
634 namelen = strlen(notify_name);
635 newdirent = (SMB_STRUCT_DIRENT *)talloc_array(
636 ctx, char, sizeof(SMB_STRUCT_DIRENT) + namelen + 1);
640 memcpy(newdirent, result, sizeof(SMB_STRUCT_DIRENT));
641 memcpy(&newdirent->d_name, notify_name, namelen + 1);
642 DEBUG(SCANNEDONLY_DEBUG,
643 ("scannedonly_readdir, return newdirent at %p with "
644 "notification %s\n", newdirent, newdirent->d_name));
648 static void scannedonly_seekdir(struct vfs_handle_struct *handle,
649 SMB_STRUCT_DIR * dirp, long offset)
651 struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
652 SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
655 static long scannedonly_telldir(struct vfs_handle_struct *handle,
656 SMB_STRUCT_DIR * dirp)
658 struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
659 return SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
662 static void scannedonly_rewinddir(struct vfs_handle_struct *handle,
663 SMB_STRUCT_DIR * dirp)
665 struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
666 SMB_VFS_NEXT_REWINDDIR(handle, sDIR->DIR);
669 static int scannedonly_closedir(vfs_handle_struct * handle,
670 SMB_STRUCT_DIR * dirp)
673 struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
674 flush_sendbuffer(handle);
675 retval = SMB_VFS_NEXT_CLOSEDIR(handle, sDIR->DIR);
680 static int scannedonly_stat(vfs_handle_struct * handle,
681 struct smb_filename *smb_fname)
684 ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
685 DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_stat: %s returned %d\n",
686 smb_fname->base_name, ret));
687 if (ret != 0 && errno == ENOENT) {
688 TALLOC_CTX *ctx=talloc_tos();
689 char *test_base_name, *tmp_base_name = smb_fname->base_name;
690 /* possibly this was a fake name (file is being scanned for
691 viruses.txt): check for that and create the real name and
692 stat the real name */
693 test_base_name = real_path_from_notify_path(
695 STRUCTSCANO(handle->data),
696 smb_fname->base_name);
697 if (test_base_name) {
698 smb_fname->base_name = test_base_name;
699 ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
700 DEBUG(5, ("_stat: %s returned %d\n",
701 test_base_name, ret));
702 smb_fname->base_name = tmp_base_name;
708 static int scannedonly_lstat(vfs_handle_struct * handle,
709 struct smb_filename *smb_fname)
712 ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
713 DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_lstat: %s returned %d\n",
714 smb_fname->base_name, ret));
715 if (ret != 0 && errno == ENOENT) {
716 TALLOC_CTX *ctx=talloc_tos();
717 char *test_base_name, *tmp_base_name = smb_fname->base_name;
718 /* possibly this was a fake name (file is being scanned for
719 viruses.txt): check for that and create the real name and
720 stat the real name */
721 test_base_name = real_path_from_notify_path(
722 ctx, STRUCTSCANO(handle->data), smb_fname->base_name);
723 if (test_base_name) {
724 smb_fname->base_name = test_base_name;
725 ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
726 DEBUG(5, ("_lstat: %s returned %d\n",
727 test_base_name, ret));
728 smb_fname->base_name = tmp_base_name;
734 static int scannedonly_open(vfs_handle_struct * handle,
735 struct smb_filename *smb_fname,
736 files_struct * fsp, int flags, mode_t mode)
739 char *tmp, *shortname;
740 int allowed, write_access = 0;
741 TALLOC_CTX *ctx=talloc_tos();
742 /* if open for writing ignore it */
743 if ((flags & O_ACCMODE) == O_WRONLY) {
744 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
746 if ((flags & O_ACCMODE) == O_RDWR) {
749 /* check if this file is scanned already */
750 tmp = strrchr(smb_fname->base_name, '/');
752 base = talloc_strndup(ctx,smb_fname->base_name,
753 (tmp - smb_fname->base_name) + 1);
757 shortname = (char *)smb_fname->base_name;
759 allowed = scannedonly_allow_access(
760 handle, NULL, smb_fname, shortname,
763 STRUCTSCANO(handle->data)->recheck_time_open,
764 STRUCTSCANO(handle->data)->recheck_tries_open,
765 STRUCTSCANO(handle->data)->recheck_size_open,
767 flush_sendbuffer(handle);
768 DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_open: allow=%d for %s\n",
769 allowed, smb_fname->base_name));
771 || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
772 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
778 static int scannedonly_close(vfs_handle_struct * handle, files_struct * fsp)
780 /* we only have to notify the scanner
781 for files that were open readwrite or writable. */
782 if (fsp->can_write) {
783 TALLOC_CTX *ctx = talloc_tos();
784 notify_scanner(handle, construct_full_path(
786 fsp->fsp_name->base_name,false));
787 flush_sendbuffer(handle);
789 return SMB_VFS_NEXT_CLOSE(handle, fsp);
792 static int scannedonly_rename(vfs_handle_struct * handle,
793 const struct smb_filename *smb_fname_src,
794 const struct smb_filename *smb_fname_dst)
796 /* rename the cache file before we pass the actual rename on */
797 struct smb_filename *smb_fname_src_tmp = NULL;
798 struct smb_filename *smb_fname_dst_tmp = NULL;
799 char *cachefile_src, *cachefile_dst;
800 bool needscandst=false;
802 TALLOC_CTX *ctx = talloc_tos();
804 /* Setup temporary smb_filename structs. */
805 cachefile_src = cachefile_name_f_fullpath(
807 smb_fname_src->base_name,
808 STRUCTSCANO(handle->data)->p_scanned);
809 cachefile_dst = cachefile_name_f_fullpath(
811 smb_fname_dst->base_name,
812 STRUCTSCANO(handle->data)->p_scanned);
813 create_synthetic_smb_fname(ctx, cachefile_src,NULL,NULL,
815 create_synthetic_smb_fname(ctx, cachefile_dst,NULL,NULL,
818 ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src_tmp, smb_fname_dst_tmp);
821 } else if (ret != 0) {
822 DEBUG(SCANNEDONLY_DEBUG,
823 ("failed to rename %s into %s error %d: %s\n", cachefile_src,
824 cachefile_dst, ret, strerror(ret)));
827 ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
828 if (ret == 0 && needscandst) {
829 notify_scanner(handle, smb_fname_dst->base_name);
830 flush_sendbuffer(handle);
835 static int scannedonly_unlink(vfs_handle_struct * handle,
836 const struct smb_filename *smb_fname)
838 /* unlink the 'scanned' file too */
839 struct smb_filename *smb_fname_cache = NULL;
841 TALLOC_CTX *ctx = talloc_tos();
843 cachefile = cachefile_name_f_fullpath(
845 smb_fname->base_name,
846 STRUCTSCANO(handle->data)->p_scanned);
847 create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,
849 if (SMB_VFS_NEXT_UNLINK(handle, smb_fname_cache) != 0) {
850 DEBUG(SCANNEDONLY_DEBUG, ("_unlink: failed to unlink %s\n",
851 smb_fname_cache->base_name));
853 return SMB_VFS_NEXT_UNLINK(handle, smb_fname);
856 static int scannedonly_rmdir(vfs_handle_struct * handle, const char *path)
858 /* if there are only .scanned: .virus: or .failed: files, we delete
859 those, because the client cannot see them */
861 SMB_STRUCT_DIRENT *dire;
862 TALLOC_CTX *ctx = talloc_tos();
863 bool only_deletable_files = true, have_files = false;
866 if (!STRUCTSCANO(handle->data)->rm_hidden_files_on_rmdir)
867 return SMB_VFS_NEXT_RMDIR(handle, path);
869 path_w_slash = name_w_ending_slash(ctx,path);
870 dirp = SMB_VFS_NEXT_OPENDIR(handle, path, NULL, 0);
874 while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL)) != NULL) {
875 if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
879 if (!is_scannedonly_file(STRUCTSCANO(handle->data),
881 struct smb_filename *smb_fname = NULL;
885 if (STRUCTSCANO(handle->data)->show_special_files) {
886 only_deletable_files = false;
889 /* stat the file and see if it is a
891 fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
893 create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
895 retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
897 && S_ISREG(smb_fname->st.st_ex_mode)) {
898 only_deletable_files = false;
900 TALLOC_FREE(fullpath);
901 TALLOC_FREE(smb_fname);
905 DEBUG(SCANNEDONLY_DEBUG,
906 ("path=%s, have_files=%d, only_deletable_files=%d\n",
907 path, have_files, only_deletable_files));
908 if (have_files && only_deletable_files) {
909 DEBUG(SCANNEDONLY_DEBUG,
910 ("scannedonly_rmdir, remove leftover scannedonly "
911 "files from %s\n", path_w_slash));
912 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
913 while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL))
916 struct smb_filename *smb_fname = NULL;
917 if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
920 fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
922 create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
924 DEBUG(SCANNEDONLY_DEBUG, ("unlink %s\n", fullpath));
925 SMB_VFS_NEXT_UNLINK(handle, smb_fname);
926 TALLOC_FREE(fullpath);
927 TALLOC_FREE(smb_fname);
930 SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
931 return SMB_VFS_NEXT_RMDIR(handle, path);
934 static void free_scannedonly_data(void **data)
939 static int scannedonly_connect(struct vfs_handle_struct *handle,
940 const char *service, const char *user)
943 struct Tscannedonly *so;
945 so = SMB_MALLOC_P(struct Tscannedonly);
946 handle->data = (void *)so;
947 handle->free_data = free_scannedonly_data;
948 so->gsendbuffer[0]='\0';
950 lp_parm_bool(SNUM(handle->conn), "scannedonly",
951 "domain_socket", True);
952 so->socketname = lp_parm_const_string(SNUM(handle->conn),
953 "scannedonly", "socketname",
954 "/var/lib/scannedonly/scan");
957 lp_parm_int(SNUM(handle->conn), "scannedonly", "portnum",
959 so->scanhost = lp_parm_const_string(SNUM(handle->conn),
960 "scannedonly", "scanhost",
963 so->show_special_files =
964 lp_parm_bool(SNUM(handle->conn), "scannedonly",
965 "show_special_files", True);
966 so->rm_hidden_files_on_rmdir =
967 lp_parm_bool(SNUM(handle->conn), "scannedonly",
968 "rm_hidden_files_on_rmdir", True);
969 so->hide_nonscanned_files =
970 lp_parm_bool(SNUM(handle->conn), "scannedonly",
971 "hide_nonscanned_files", False);
972 so->allow_nonscanned_files =
973 lp_parm_bool(SNUM(handle->conn), "scannedonly",
974 "allow_nonscanned_files", False);
975 so->scanning_message = lp_parm_const_string(SNUM(handle->conn),
978 "is being scanned for viruses");
979 so->scanning_message_len = strlen(so->scanning_message);
980 so->recheck_time_open =
981 lp_parm_int(SNUM(handle->conn), "scannedonly",
982 "recheck_time_open", 50);
983 so->recheck_tries_open =
984 lp_parm_int(SNUM(handle->conn), "scannedonly",
985 "recheck_tries_open", 100);
986 so->recheck_size_open =
987 lp_parm_int(SNUM(handle->conn), "scannedonly",
988 "recheck_size_open", 100);
989 so->recheck_time_readdir =
990 lp_parm_int(SNUM(handle->conn), "scannedonly",
991 "recheck_time_readdir", 50);
992 so->recheck_tries_readdir =
993 lp_parm_int(SNUM(handle->conn), "scannedonly",
994 "recheck_tries_readdir", 20);
997 lp_parm_const_string(SNUM(handle->conn),
1002 lp_parm_const_string(SNUM(handle->conn),
1007 lp_parm_const_string(SNUM(handle->conn),
1011 connect_to_scanner(handle);
1013 return SMB_VFS_NEXT_CONNECT(handle, service, user);
1016 /* VFS operations structure */
1017 static struct vfs_fn_pointers vfs_scannedonly_fns = {
1018 .opendir = scannedonly_opendir,
1019 .fdopendir = scannedonly_fdopendir,
1020 .readdir = scannedonly_readdir,
1021 .seekdir = scannedonly_seekdir,
1022 .telldir = scannedonly_telldir,
1023 .rewind_dir = scannedonly_rewinddir,
1024 .closedir = scannedonly_closedir,
1025 .rmdir = scannedonly_rmdir,
1026 .stat = scannedonly_stat,
1027 .lstat = scannedonly_lstat,
1028 .open_fn = scannedonly_open,
1029 .close_fn = scannedonly_close,
1030 .rename = scannedonly_rename,
1031 .unlink = scannedonly_unlink,
1032 .connect_fn = scannedonly_connect
1035 NTSTATUS vfs_scannedonly_init(void)
1037 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "scannedonly",
1038 &vfs_scannedonly_fns);