// Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of the License "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// f32test\virus\t_vshook.cpp

// 

//

#include "t_vshook.h"

#include <f32pluginutils.h>

_LIT(KVirusScannerName, "This is a test virus scanner");

/**

Leaving New function for the plugin

@internalComponent

*/

CTestVirusHook* CTestVirusHook::NewL()

	{

	return new(ELeave) CTestVirusHook;

	}

/**

Constructor for the plugin

@internalComponent

*/

CTestVirusHook::CTestVirusHook()

	{

//	RDebug::Print(_L("EMaxClientOperations %d, size of CFsPlugin %d, iSignatureOffset %d"), EMaxClientOperations, sizeof(CFsPlugin), _FOFF(CTestVirusHook, iSignature));

	ASSERT(iSignature == 0);

	iSignature = 0x1234;

	}

/**

The destructor for the test virus scanner hook.  This would

not be a part of a normal virus scanner implementation as

normal virus scanners cannot be unloaded - it must be 

provided in the test virus scanner server so that it can

be tested with the F32 test suite.

@internalComponent

*/

CTestVirusHook::~CTestVirusHook()

	{

	iFs.Close();

	for (TInt i = 0; i < iSignaturesLoaded; i++)

		{

		if (iKnownSignatures[i])

			{

			delete iKnownSignatures[i];

			}

		}

	ASSERT(iSignature == 0x1234);

	}

/**

Initialise the virus scanner.

Reads the virus definition file and then waits for

notification that files containing a virus have been

detected.

@internalComponent

*/

void CTestVirusHook::InitialiseL()

	{

	User::LeaveIfError(RegisterIntercept(EFsFileOpen,			EPreIntercept));

	User::LeaveIfError(RegisterIntercept(EFsFileSubClose,		EPostIntercept));

	User::LeaveIfError(RegisterIntercept(EFsFileRename,			EPreIntercept));

	User::LeaveIfError(RegisterIntercept(EFsRename,				EPreIntercept));

	User::LeaveIfError(RegisterIntercept(EFsDelete,				EPreIntercept));

	User::LeaveIfError(RegisterIntercept(EFsReplace,			EPreIntercept));

	User::LeaveIfError(RegisterIntercept(EFsReadFileSection,	EPreIntercept));

	ReadVirusDefinitionFile();

	}

/**

Read the virus definition file C:\virusdef.txt and parse

its contents.  Any virus definitions found in that file

are added to the KnownSignatures array so they can be

used by the virus scanning hook.

@internalComponent

@return KErrNone if the file was read and parsed

successfuly.

*/

TInt CTestVirusHook::ReadVirusDefinitionFile()

	{

	TInt r = iFs.Connect();

	if (r != KErrNone)

		return r;

	r = iFs.SetNotifyChange(EFalse);	// Disable change notifications

	if (r != KErrNone)

		return r;

	//Open the virus definition file

	RFile vsDefFile;

	r = vsDefFile.Open(iFs, _L("C:\\virusdef.txt"), EFileShareAny);

	if (r != KErrNone)

		return r;

	TInt fileSize=0;

	r = vsDefFile.Size(fileSize);

	if (r != KErrNone)

		{

		vsDefFile.Close();

		return r;

		}

	HBufC8* defBuf=NULL;

	TRAP(r,defBuf = HBufC8::NewL(fileSize));

	if (r != KErrNone)

		{

		vsDefFile.Close();

		return r;

		}

	TPtr8 ptr(defBuf->Des());

	r = vsDefFile.Read(ptr);

	if (r != KErrNone)

		{

		delete defBuf;

		vsDefFile.Close();

		return r;

		}

	//Now parse the definition file, putting the definitions into the hook's

	//array of known virus signatures.

	TInt bytesParsed     = 0;

	TInt stringBeginPos  = 0;

	TInt stringEndPos    = 0;

	TInt stringLength    = 0;

	HBufC8* signatureBuf = NULL;

	while (bytesParsed < fileSize)

		{

		ptr.Set(defBuf->Des());

		ptr.Set(&ptr[bytesParsed], fileSize-bytesParsed, fileSize-bytesParsed);

		if (stringBeginPos < 0)

			{

			break;

			}

		stringBeginPos += bytesParsed;

		ptr.Set(defBuf->Des());

		ptr.Set(&ptr[stringBeginPos], fileSize-stringBeginPos, fileSize-stringBeginPos);

		if (stringEndPos < 0)

			{

			break;

			}

		stringEndPos += bytesParsed;

		ptr.Set(defBuf->Des());

		TRAP(r,signatureBuf = HBufC8::NewL(stringLength));

		TPtrC8 actualSig(ptr.Mid(stringBeginPos, stringLength));

		TPtr8 ptr2(signatureBuf->Des());

		ptr2.Append(actualSig);

		iKnownSignatures[iSignaturesLoaded] = signatureBuf;

		iSignaturesLoaded++;

		bytesParsed += stringLength;

		}

	//Cleanup

	delete defBuf;

	vsDefFile.Close();

	return r;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::DoRequestL(TFsPluginRequest& aRequest)

	{

	TInt err = KErrNotSupported;

	TInt function = aRequest.Function();

	iDrvNumber = aRequest.DriveNumber();

	switch(function)

		{

		case EFsFileOpen:

			err = VsFileOpen(aRequest);

			break;

		case EFsFileSubClose:

			VsFileClose(aRequest);

			break;

		case EFsFileRename:

		case EFsRename:

		case EFsReplace:

			err = VsFileRename(aRequest);

			break;

		case EFsDelete:

			err = VsFileDelete(aRequest);

			break;

		case EFsReadFileSection:

			err = VsReadFileSection(aRequest);

			break;

		default:

			break;

		}

	return err;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VsFileOpen(TFsPluginRequest& aRequest)

	{

	TFileName fileName;

	TInt err = ValidateRequest(aRequest, fileName);

	if (err == KErrNone)

		{

		err = ScanFile(fileName);

		if (err != KErrNone)

			{

			// Clean the infected file

			CleanFile(fileName, EFileOpen);

			}

		}	

	return err;

	}

/**

@internalComponent

*/

void CTestVirusHook::VsFileClose(TFsPluginRequest& aRequest)

	{

	TFileName fileName;

	TInt err = GetName(&aRequest, fileName);

	if(err == KErrNone)

		{

		err = ScanFile(fileName);

		if (err != KErrNone)

			{

			// Clean the infected file

			CleanFile(fileName, EFileClose);

			}

		}

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VsFileRename(TFsPluginRequest& aRequest)

	{

	TInt err = VsDirRename(aRequest);

	if(err != KErrAccessDenied)

		{

		TFileName fileName;

		err = ValidateRequest(aRequest, fileName);

		if (err == KErrNone)

			{

			err = ScanFile(fileName);

			if (err != KErrNone)

				{

				// Clean the infected file

				CleanFile(fileName, EFileRename);

				}

			}

		}

	return err;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VsDirRename(TFsPluginRequest& aRequest)

	{

	TFileName fileName;

	TInt err = GetName(&aRequest, fileName);

	if(err != KErrNone)

		return(err);

	err = fileName.Find(_L("\\system\\lib\\"));

	if (err != KErrNotFound)

		{

		//Don't allow sys\bin to be ever renamed

		return KErrAccessDenied;

		}

	err = fileName.Find(_L("\\sys\\bin\\"));

	if (err != KErrNotFound)

		{

		//Don't allow sys\bin to be ever renamed

		return KErrAccessDenied;

		}

	return err;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VsFileDelete(TFsPluginRequest& aRequest)

	{

	TFileName fileName;

	TInt err = ValidateRequest(aRequest, fileName);

	return err;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VsReadFileSection(TFsPluginRequest& aRequest)

	{

	// The t_virus test uses a filename clean.txt, a read length of 8 and a read position of 0.

	TFileName fileName;

	TInt len;

	TInt pos;

	// test getting name on read file section intercept

	TInt err = GetName(&aRequest, fileName);

	if(err != KErrNone)

		{

		return(err);

		}

	TParse parse;

	parse.Set(fileName,NULL,NULL);

	TPtrC name = parse.Name();

	if(name.CompareF(_L("clean"))!=0)

		{

		return(KErrGeneral);

		}

	TPtrC ext = parse.Ext();

	if(ext.CompareF(_L(".txt"))!=0)

		{

		return(KErrGeneral);

		}

	// test getting read length and required file position on read file section intercept

	err = GetFileAccessInfo(&aRequest, len, pos);

	if(err != KErrNone)

		{

		return(err);

		}

	if ((len != 8) || (pos != 0))

		{

		return(KErrGeneral);

		}

	return KErrNone;

	}

/**

@internalComponent

*/

TInt CTestVirusHook::VirusScannerName(TDes& aName)

	{

	aName = KVirusScannerName;

	return KErrNone;

	}

/**

Reads the contents of the file passed in and checks

whether it contains any of the specified virus

signatures

@return A value depending on whether a known virus is

found within the file.

@param aFile A CFileCB object which can be used to read the file.

@internalComponent

*/

TInt CTestVirusHook::ScanFile(const TDesC& aName)

	{

	TInt r    = KErrNone;

	TInt pos  = 0;

	TInt size = 0;

	// Rename the file	

	TPtrC tmpFile = _L("VS_RENAMED.VSH");

	TParse parse;

	parse.Set(aName, NULL, NULL);

	parse.Set(parse.DriveAndPath(), &tmpFile, NULL);

	r = iFs.Rename(aName, parse.FullName());

	if(r != KErrNone)

		return r;

	RFile file;

	r = file.Open(iFs, parse.FullName(), EFileRead);

	if(r == KErrNone)

		{

		r = file.Size(size);

		}

	//If the file size is 0, then the file

	//has just been created - so it can't contain

	//a virus.

	if(r != KErrNone || size == 0)

		{

		file.Close();

		// Rename the file back

		TInt err = iFs.Rename(parse.FullName(), aName);

		if(err != KErrNone)

			return err;

		return r;

		}

	do

		{

		r = file.Read(pos, iScanBuf);

		if (r != KErrNone)

			{

			break;

			}

		r = ScanBuffer();

		pos += iScanBuf.Length();

		} while ((r == KErrNotFound) && (iScanBuf.Length() == iScanBuf.MaxLength()));

	file.Close();

	// Rename the file back

	TInt err = iFs.Rename(parse.FullName(), aName);

	if(err != KErrNone)

		return err;

	if (r > 0)

		{

		//We've found an infection

		return KErrAccessDenied;

		}

	else

		{

		return KErrNone;

		}

	}

/**

Scans the internal buffer which has been loaded with fresh

file contents, to see if it contains any known virus

signatures.

@return A value depending on whether a known virus signature

is found within the buffer.

@internalComponent

*/

TInt CTestVirusHook::ScanBuffer()

	{

	//Look through the internal buffer for all known virus signatures.

	TInt r;

	for (TInt i = 0; i < iSignaturesLoaded; i++)

		{

		r = iScanBuf.Find(iKnownSignatures[i]->Des());

		if (r != KErrNotFound)

			{

			return r;

			}

		}

	return KErrNone;

	}

/**

Validate that nobody is trying to touch the virus scanner files.

@internalComponent

@return A value depending on whethe the virus scanner files are

being fiddled with.

@param aDriveNum The drive number of the request which called into

the test virus scanning hook.

@param aName The full pathname of the file being accessed by the

request to the file server hook.

*/

TInt CTestVirusHook::ValidateRequest(TFsPluginRequest& aRequest, TFileName& aFileName)

	{

	TInt driveNumber = aRequest.DriveNumber();

	TInt err = GetName(&aRequest, aFileName);

	if(err != KErrNone)

		return(err);

	if (driveNumber == EDriveC)

		{

		TInt r = aFileName.Find(_L("\\virusdef.txt"));