Now that I have three different AV packages installed, I want to find a
way to run all three in a random fashion (rather than just one after
another). I can't think of a way to use the plugin wrapping API, since
I want to have a single place where I check to see if the message is
multi-part and skip all. I also want to assign percentages to each
scanner so that one might run more often than another.
I wonder if this wouldn't be best handled by making the config file YAML
aware, so I could have something like this:
antivirus_wrapper:
- scanner: exe_filter
freq: 1.0
- scanner: uvscan
args: "deny_viruses yes"
freq: 0.35
- scanner: bitdefender
args: "deny_viruses yes"
freq: 0.35
- scanner: clamav
args: "clamscan_path=/usr/local/bin/clamdscan action=reject"
freq: 0.55
where 'antivirus_wrapper' is given the rest of the lines and winds up
registering each of the other plugins to a custom event. Then some sort
of fancy math can happen where the three later plugins are randomly
selected (sometimes more than one runs but never all three), and the
exe_filter always runs (and if the message isn't multipart, they are all
skipped).
Thoughts?
John
Thread Next