[Avcheck] sophie error strings

[Michael Tokarev]

[Answering an old post, again]

Max Kalika wrote at Thu, 20 Jun 2002 23:40:52 -0700:
> 
> I haven't had a chance to look at the code, but I figure this isn't a
> terribly complicated question.  Does avcheck support sophie's extended
> error strings (if sophie is built with --enable-error-strings).  I am
> getting some mail queued up because some attachments are encrypted or
> corrupt archives.  Avcheck only sees the -1 error and queues the mail.  If
> I enable error strings in sophie will avcheck know to look at that and not
> queue if the error is unrecoverable?  Thanks.

I looked at sophie today, finally.  This option, --enable-error-strings,
adds an error *message text* (description) to an output, in addition to
error code (always -1).  Well, avcheck may call a bunch of strcmp()s to
compare this error description with a predefined set of descriptions built
into avcheck.  Here is a list of such errors defined in sophie_code.h,
as of 1.40rc1:

Error: SAVI initialization failed
Error: Error occured while unloading SAVI
Error: Virus scan failed
Error: Engine not initialized
Error: InterCheck client not compatible with this version of SAV
Error: Insufficient right - unable to disable InterCheck client
Error: InterCheck client could not be disabled.  Request to scan the file has been denied.
Error: Disinfection failed
Error: Disinfection attempted on an uninfected file
Error: Attempt to upgrade virus engine failed
Error: Sophos Anti-Virus is not installed
Error: Attempt to get/set SAVI configuration with incorrect name
Error: Attempt to get/set SAVI configuration with incorrect type
Error: Could not configure SAVI
Error: Not supported in this SAVI implementation
Error: File could not be accessed
Error: File was compressed, but no virus was found on the outer level
Error: File was encrypted
Error: Additional virus location is unavailable (whatever that means ;)
Error: Attempt to initialize SAVI when it is already initialized
Error: Attempt to use stub library
Error: Buffer supplied was too small
Error: Returned from a callback function to continue with the current file.
Error: Returned from a callback function to skip to the next file.
Error: Returned from a callback function to stop the current operation.
Error: File corrupted, Sophie could not proceed.
Error: An attempt to re-enter SAVI from a callback notification was detected
Error: An error was encountered in the SAVI client's callback function.
Error: A call requesting several pieces of information did not return them all.
Error: The main body of virus data is out of date.
Error: No valid temporary directory found.
Error: The main body of virus data is missing.
Error: The InterCheck client is active, and could not be disabled.
Error: The virus data main body has an invalid version.
Error: SAVI must be reinitialized (the virus engine has a version higher than the running version of SAVI supports.
Error: Cannot set option value - the virus engine will not permit its value to be changed, as this option is immutable.
Error: The file passed for scanning represented part of a multi volume archive. The file cannot be scanned.
Error: Default error case.

This is not a small list, but the only one message, "Error: File was encrypted",
is of any interest (if I not missed some more).  Ok, this may be done, and I perhaps
will do that (and will allow logging of error text if available).  But it's interesting:

 a) why sophie/trophie not uses more verbose error *code* instead of message text,
  like other virusscanners do?!  Why always -1?  This one case at least may be handled
  differently, and maybe "Error: File corrupted, Sophie could not proceed." too (another
  candidate for such list of interesting error messages).

 b) what virge will do with such errors? ;)

/mjt