'''
Dazuko scanner for sagator, version 0.1

(c) 2003-2004 Jan ONDREJ (SAL) <ondrejj(at)salstar.sk>

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
    
'''

from avlib import *
import re,string,os

__all__=['dazuko']

class dazuko(ascanner):
  '''
  Scanner which uses dazuko directory to scan for viruses.
  
  Usage: dazuko('/dazuko_prefix','logfile')

  Where: '/dazuko_prefix' is a string, which defines directory
            and a part of filename to store scanned files,
            by default '/tmp/dazuko'
         'logfile' is a string, which defines full path and filename
            of logfile, by default not logfile used
         'regexp' is a string, which defines how to parse logfile
  '''
  name='dazuko()'
  def __init__(self,dazuko_prefix,logfile='',regexp=''):
      self.prefix=dazuko_prefix
      self.logfile=logfile
      self.reg=re.compile(regexp,re.IGNORECASE)
  def scanstream(self,stream):
      level,detected,virlist=0.0,'',[]
      # open logfile
      if self.logfile:
        log=open(self.logfile,'r')
        log.seek(0,2) # end of file
      # save email
      t=mktemp(self.prefix,'.eml','w',0600).autorm()
      try:
        t.f.write(fromhdr())
        t.f.write(stream)
        t.f.flush()
        open(t.root_name,'r') # IOError1 raised when virus found
      except IOError,(ec,es):
        if ec==1:
          detected='UNKNOWN'
          level+=1.0
          if log:
            l=1
            while l:
              l=log.readline()
              reg1=self.reg.search(l)
              if reg1:
                if reg1.group(1) in [t.root_name,t.name]:
                  detected=reg1.group(2)
                  virlist.append(l)
                  debug.echo(6,"NOD2d: ",l)
        else:
          raise
      # close log
      log.close()
      return level,detected,virlist
