#!/usr/bin/perl -w
#
# $Id: vscan_whitelist.pl,v 1.3 2005/10/23 22:25:20 jmates Exp $
#
# Copyright (c) 2005, Alex Dioso.
# All rights reserved.
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including
# without limitation the rights to use, copy, modify, merge, publish,
# distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so, subject to
# the following conditions:
#
# The above copyright notice and this permission notice shall be
# included in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
#####################################################################
#
# Add or remove a program specified on the command line from VirusScan's
# whitelist

use strict;
use Getopt::Long;
use Win32::TieRegistry ( Delimiter => "/" );

my %opts;
GetOptions( \%opts, "a", "d", "p=s", "e=s" );

usage()
  unless ( ( exists $opts{'a'} or exists $opts{'d'} )
  and exists $opts{'p'}
  and exists $opts{'e'} );

my $VScan =
  $Registry->{
  "LMachine/SOFTWARE/Network Associates/TVD/Shared Components/On Access Scanner/BehaviourBlocking"
  };

my $num;
for my $key ( keys %{$VScan} ) {
  if ( $VScan->{$key} =~ m/^$opts{'p'}$/ ) {
    ($num) = $key =~ m/(\d+)$/;
  }
}

if ( exists $opts{'a'} ) {
  unless ( $VScan->{"PortBlockWhiteList_$num"} =~ m/$opts{'e'}/ ) {
    my @programs = split( /,/, $VScan->{"PortBlockWhiteList_$num"} );
    push @programs, $opts{'e'};
    $VScan->{"PortBlockWhiteList_$num"} = join( ",", @programs );
  }

} else {
  if ( $VScan->{"PortBlockWhiteList_$num"} =~ m/$opts{'e'}/ ) {
    my @programs = split( /,/, $VScan->{"PortBlockWhiteList_$num"} );
    my @new_programs;
    for ( 0 .. ( scalar(@programs) - 1 ) ) {
      push( @new_programs, shift(@programs) )
        unless $programs[0] =~ m/$opts{'e'}/;
    }
    $VScan->{"PortBlockWhiteList_$num"} = join( ",", @new_programs );
  }
}

sub usage {
  print <<EOF;
\n usage: $0 (-a | -d) -p PORTRANGE -e EXE_NAME\n
EOF
  exit;
}