I've been running some tests lately, and I can not make clam block files that exceed ArchiveMaxRecursion. I guess the same goes for the other limits too, although I haven't tested them. clamd.conf attached inline
Sorry for the do-do, forgot to attach config. It doesnt matter though, because a quick browse through the sources indicate that ArchiveBlockMax is not applied for ArchiveMaxRecursion.
In cli_scanzip() BLOCKMAX is applied for ArchiveMaxFileSize, ArchiveMaxFiles, ArchiveMaxCompressionRatio and ArchiveBlockEncrypted, returning CL_VIRUS. This is good.
In cli_magic_scandesc(), it tests for maxreclevel but returns CL_CLEAN when exceeded. This is no good, because in the config file it states:
# Mark archives as viruses if ArchiveMaxFiles, ArchiveMaxFileSize, or # ArchiveMaxRecursion limit is reached. # Default: disabled ArchiveBlockMax
Devel team: You probably want to change this; either the code to return CL_VIRUS, or the doc/man/config to state that the files will in fact NOT be blocked!
regards, HR _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
