Added IKARUS scan server scan on file open.
authorck
Tue, 26 Nov 2013 16:13:18 +0100
changeset 11f61fe50ab10
parent 0 e840b60f3ea3
child 2 d27473cf6a01
Added IKARUS scan server scan on file open.
config/OsecFS.cfg
src/OsecFS.py
     1.1 --- a/config/OsecFS.cfg	Tue Oct 29 15:13:44 2013 +0100
     1.2 +++ b/config/OsecFS.cfg	Tue Nov 26 16:13:18 2013 +0100
     1.3 @@ -6,4 +6,10 @@
     1.4  Mountpoint: /tmp/virtual_fuse
     1.5  
     1.6  # where the files really are on the filesystem 
     1.7 -Rootpath: /tmp/root_fuse
     1.8 \ No newline at end of file
     1.9 +Rootpath: /tmp/root_fuse
    1.10 +
    1.11 +# the URL of the local scan server
    1.12 +LocalScanserverURL: http://192.168.63.128/virusscan
    1.13 +
    1.14 +# the URL of the remote scan server
    1.15 +RemoteScanserverURL: http://192.168.63.128/virusscan
    1.16 \ No newline at end of file
     2.1 --- a/src/OsecFS.py	Tue Oct 29 15:13:44 2013 +0100
     2.2 +++ b/src/OsecFS.py	Tue Nov 26 16:13:18 2013 +0100
     2.3 @@ -12,15 +12,23 @@
     2.4  import errno
     2.5  
     2.6  # ToDo replace with ikarus
     2.7 -import pyclamav
     2.8 +#import pyclamav
     2.9  import subprocess
    2.10  
    2.11 -MINOPTS = { "Main" : ["Logfile", "Mountpoint", "Rootpath"]}
    2.12 +import requests
    2.13 +
    2.14 +
    2.15 +MINOPTS = { "Main" : ["Logfile", "Mountpoint", "Rootpath", "LocalScanserverURL", "RemoteScanserverURL"]}
    2.16  
    2.17  CONFIG_NOT_READABLE = "Configfile is not readable"
    2.18  CONFIG_WRONG = "Something is wrong with the config"
    2.19  CONFIG_MISSING = "Section: \"%s\" Option: \"%s\" in configfile is missing"
    2.20  LOG = None
    2.21 +LOCAL_SCANSERVER_URL = ""
    2.22 +REMOTE_SCANSERVER_URL = ""
    2.23 +STATUS_CODE_OK = 200
    2.24 +STATUS_CODE_INFECTED = 210
    2.25 +STATUS_CODE_NOT_FOUND = 404
    2.26  
    2.27  SYSTEM_FILE_COMMAND = "file"
    2.28  
    2.29 @@ -92,21 +100,64 @@
    2.30  
    2.31      return m
    2.32  
    2.33 +def scanFileIkarus(path, fileobject):
    2.34 +    files = {'up_file': (path, fileobject)}
    2.35 +    
    2.36 +    try:
    2.37 +        #TODO: chance to remote server
    2.38 +        r = requests.post(LOCAL_SCANSERVER_URL, files=files)
    2.39 +    except requests.exceptions.ConnectionError:
    2.40 +        LOG.info("Remote scan server unreachable, using local scan server.")
    2.41  
    2.42 +        # TODO:
    2.43 +        # Here the local scan server should be contacted.
    2.44 +        # The requests package does not upload content in the second post request,
    2.45 +        # so no fallback server can be used right now (bug?)
    2.46 +        # I did not a find a solution yet, maybe another http package has to be used.
    2.47 +        # Disabled for now.
    2.48  
    2.49 -def scanFile (path):
    2.50 +        #try:
    2.51 +        #    r = requests.post(LOCAL_SCANSERVER_URL, files=files)
    2.52 +        #except requests.exceptions.ConnectionError:
    2.53 +        #    return 2
    2.54 +        return 2
    2.55 +
    2.56 +    if r.status_code == STATUS_CODE_OK:
    2.57 +        return 0
    2.58 +    elif r.status_code == STATUS_CODE_INFECTED:
    2.59 +        # Parse xml for info if desired
    2.60 +        #contentXML = r.content
    2.61 +        #root = ET.fromstring(contentXML)
    2.62 +        #status = root[1][2].text
    2.63 +        return 1
    2.64 +    else:
    2.65 +        return 2
    2.66 +
    2.67 +def scanFile (path, fileobject):
    2.68      infected = False
    2.69  
    2.70      LOG.debug ("Scan File: %s" % (path))
    2.71  
    2.72      # ToDo implement ikarus
    2.73 -    result = pyclamav.scanfile (path)
    2.74 +    #result = pyclamav.scanfile (path)
    2.75 +    #LOG.debug ("Result of file \"%s\": %s" % (path, result))
    2.76 +    #if (result[0] != 0):
    2.77 +    #    infected = True
    2.78 +
    2.79 +    #if (infected == True):
    2.80 +    #    LOG.error ("Virus found deny Access %s" % (result,))
    2.81 +
    2.82 +    result = scanFileIkarus(path, fileobject)
    2.83      LOG.debug ("Result of file \"%s\": %s" % (path, result))
    2.84 -    if (result[0] != 0):
    2.85 +
    2.86 +    if (result == 2):
    2.87 +        LOG.error ("Connection to scan server could not be established.")
    2.88 +
    2.89 +    if (result == 1):
    2.90          infected = True
    2.91  
    2.92      if (infected == True):
    2.93 -        LOG.error ("Virus found deny Access %s" % (result,))
    2.94 +        LOG.error ("Virus found deny Access %s" % (result))
    2.95  
    2.96      return infected
    2.97  
    2.98 @@ -181,7 +232,7 @@
    2.99          self.file = os.fdopen (os.open (fixPath (path), flags), flag2mode (flags))
   2.100          self.fd = self.file.fileno ()
   2.101  
   2.102 -        infected = scanFile (rootPath(self.__rootpath, path))
   2.103 +        infected = scanFile (rootPath(self.__rootpath, path), self.file)
   2.104          if (infected == True):
   2.105              self.file.close ()
   2.106              return -errno.EACCES
   2.107 @@ -259,6 +310,9 @@
   2.108      config = loadConfig ()
   2.109      initLog (config)
   2.110  
   2.111 +    LOCAL_SCANSERVER_URL = config.get("Main", "LocalScanserverURL")
   2.112 +    REMOTE_SCANSERVER_URL = config.get("Main", "RemoteScanserverURL")
   2.113 +
   2.114      osecfs = OsecFS (config.get ("Main", "Rootpath"))
   2.115      osecfs.flags = 0
   2.116      osecfs.multithreaded = 0