SAVDI Release Notes

Product version: 3.4

Document date: December 2023

Package contents

main package

-   savdid: the SAVDI server executable

-   version.txt: SAVDI version file

-   Docs

    -   release_notes.txt: this document
    -   LICENSE.txt: 3rd party licenses
    -   quick_start_guide.txt: a document describing how to get the
        SAVDI server running

-   Configuration samples

    -   savdid-ICAP-SUSI.conf: sample configuration for running a SUSI
        scanner on ICAP
    -   savdid-SSSP-SUSI.conf: sample configuration for running a SUSI
        scanner on ICAP
    -   savdid-ICAP-SAVI.conf: sample configuration for running a SAVI
        scanner on ICAP
    -   savdid-SSSP-SAVI.conf: sample configuration for running a SAVI
        scanner on SSSP

docs

-   SAVDI-Quick_Start_Guide.pdf: a document describing how to get the
    SAVDI server running
-   SAVDI-ICAP.pdf: a document describing the ICAP
    elements used in this implementation and the ICAP AV extensions
-   SAVDI-User_Manual.pdf: a document describing SAVDI and its
    configuration
-   savi_sen.pdf: a document describing the SAVI configuration options
    and scan return codes
-   SAVDI-SSSP.pdf: a document describing SSSP protocol
-   sample applications

Change log


Version 3.4

-   Code improvements
-   Installer script improvements

Version 3.3

-   Code improvements
-   Installer script improvements

Version 3.2

-   Added support for SUSI 2.0

Version 3.1

-   Windows & Linux release
-   REQMOD support
-   Fixed ICAP response status code
-   Fixed handling data of more than 2GB

Version 3.0

-   Linux only release.
-   32 bit builds are no longer available.
-   Sophie protocol is no longer supported.
-   Added support for SUSI scanners.
-   Added scripts for updating SUSI and SAVI scanners.

Version 2.7.0

-   Added support for ICAP message previews (RFC 3507 Section 4.5)

Version 2.6.2

-   When a client is having a persistent ICAP connection to SAVDI, this
    version will update ISTag header after virus data is updated. This
    behaviour is expected by some OEM customers.

Version 2.6.1

-   Made ICAP tolerant of additional blank lines in HTTP headers. Blank
    lines in the HTTP request and response headers are ignored.

Version 2.6.0

-   Added a new configuration option for ICAP and SSSP allowing the True
    File Type reporting of the scanned file.
-   (Linux only) The dependency on shared library libssp has been
    removed.
-   (Linux only) There are two 32-bit packages,
    savdi-linux.intel.libc6.glibc.2.3.tar and
    savdi-linux.intel.libc6.glibc.2.2.tar, the latter provided for
    systems which cannot use the former.
-   (Linux only) There are two 64-bit packages,
    savdi-linux.amd64.glibc.2.3.tar and
    savdi-linux.amd64.glibc.2.3.ssp.tar. The latter build includes stack
    smashing protection. The former build is provided for systems which
    do not have the stack smashing support functions in glibc.
-   (Linux only) Fixed a bug. When SAV Dynamic Interface ran on a system
    on which Sophos Anti-Virus on-access scanning was active, SAVDI
    leaked a handle for each file it scanned, eventually reporting "too
    many open files" on attempts to scan a file.

Version 2.5.0

-   Added a new mode for ICAP allowing the use of the ICAP statuses 204
    and 200 to indicate clean and not clean results respectively.
-   Fixed a bug in a sample script, icap.pl, that prevented files with a
    ‘-‘ in its name from being scanned.
-   (*nix only) Fixed a bug that caused child processes to crash on
    32-bits Linux systems.

Version 2.4.0

-   The location of the language file is now configurable with a –m
    command line option.
-   (*nix only) Installing SAVDI to a custom location could fail on a 64
    bit system.
-   New configuration option to output long detection name.
-   Added new SAVDI sample-apps:
    -   savi.py – A simple Python module using SSSP
    -   savitest.py – To illustrate the use of savi.py above
    -   sssp.c – A simple SSSP client in C
-   SAVDIClient.java – a simple Java client using SSSP
-   Long HTTP header lines could cause an '500 Server Error’ to be
    returned.
-   (Windows only) SAVDI could prevent Windows SAV updating its drivers.
-   (*nix only) SAVDI could fail to install properly on non-English
    locales.
-   Running out of temporary disk space could result in SAVDI failing.
-   Solaris 11 (sparc) is supported.
-   An exception in the virus engine could cause SAVDI to fail.

Version 2.3.0

-   (*nix 64bit only) The install script would fail to find the SAV
    directories containing the engine and virus data. The install script
    will in addition create a configuration file containing the
    discovered directories
-   (*nix 32 bit only) Files of a size greater than 2GB were rejected as
    non-existent.
-   (Windows only) The messages that are logged when an engine update
    has been detected have been made more explanatory and relevant.
-   (ICAP) The retain: ALL option did not work.
-   (ICAP) The virus data version has been added to the ISTag. The
    engine and virus data version details have been added to the
    response to the OPTIONS request.
-   (SSSP) Incorrect SSSP commands are rejected with a REJ response but
    are not logged. All REJ responses will now cause a log entry.
-   (SSSP) The engine and virus data version details have been added to
    the response to the QUERY ENGINE request.
-   When a new log file was started, the old log file was held open.
-   A SAVI option that should be set last was incorrectly being set too
    early.

Version 2.2.0

-   ICAP will tolerate a trailing ‘/’ on the service name.
-   The reporting of virus data load errors has been improved
-   Log file handling has been improved so that if SAVDI is unable to
    write to the log file it will revert to a backup log. In daemon or
    service mode the backup log is the syslog or event log depending on
    the OS. If that fails SAVDI will continue without logging, and not
    exit.
-   If SAVDI is unable to create a temporary file in the configured
    directory, it will attempt to create one in the system standard
    temporary directory instead. If that fails, it will fail the scan
    request and SAVDI will continue and not exit.
-   (*nix only) Internal improvements to signal handling and logging
    that could have resulted in a deadlock.

Version 2.1.1

-   On Windows, SAVDI service was failing to exit appropriately to be
    restarted by the SCM.

Version 2.1.0

-   The second line of the ICAP header is ignored. Depending on the
    order of the ICAP headers, this may result in failure to complete
    the request.
-   %XX sequences in HTTP headers that are included in an ICAP request
    are incorrectly decoded. This results in failure of the request.
-   On Windows, SAVDI/SSSP and SAVDI/SOPHIE are not fully impersonating
    the client. This results in VMWare VMDK files that are mounted as
    volumes being inaccessible.

Version 2.0.0 details

This version of SAVDI adds an ICAP capability to the existing SAVDI
protocols. The ICAP capability adds an AV service using the ICAP OPTIONS
and RESPMOD methods with the ICAP AV extensions.

Existing capabilities are unchanged.

The communications, service and Sophos AV engine are configurable via a
configuration file, an example of which is supplied. The supplied sample
configuration file is set for a general case and will need some
modification to make the server usable and secure on the target system.
See the SAVDI User Manual and sample configuration file for details.

Known problems

-   File paths of a length greater than MAX_PATH characters will be
    rejected

Technical support

For technical support, visit www.sophos.com/support.

If you contact technical support, provide as much information as
possible, including the following:

-   Sophos software version number(s)
-   Operating system(s) and patch level(s)
-   The exact text of any error messages
