clam.cxx

   1 /*
   2  * inoclam - Inotify+ClamAV virus scanner
   3  * Copyright (C) 2007 Vermont Department of Taxes
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18  *
  19  * Contributor(s):
  20  *   Tom Cort <tom.cort@state.vt.us>
  21  */
  22
  23 #include <unistd.h>
  24 #include <clamav.h>
  25 #include <errno.h>
  26 #include <stdio.h>
  27 #include <string.h>
  28 #include <libdaemon/dlog.h>
  29 #include <pthread.h>
  30
  31 #include "clam.hxx"
  32 #include "monitor.hxx"
  33 #include "signal.hxx"
  34
  35 /**
  36  * A lock used to serialize access to the engine. Serialized access is
  37  * needed to keep clam_refresh() from changing the engine while
  38  * contains_virus() is using it.
  39  * @see clam_refresh()
  40  * @see contains_virus()
  41  */
  42 pthread_mutex_t engine_lock;
  43
  44 /**
  45  * Thread attributes used by the clam_refresh() thread. This is
  46  * a global so that main() can free them when its cleaning up.
  47  * @see main()
  48  * @see clam_refresh()
  49  */
  50 pthread_attr_t ta;
  51
  52 /**
  53  * Multiple threads are using and altering "engine".
  54  * Use the engine_lock to prevent concurrency issues.
  55  */
  56 struct cl_engine *engine = NULL;
  57
  58 /**
  59  * Load the virus definition files and prepare the engine.
  60  */
  61 void clam_init()
  62 {
  63         unsigned int sigs = 0;
  64         int ret;
  65
  66         pthread_t tt;
  67
  68         memset(&engine_lock, '\0', sizeof(pthread_mutex_t));
  69         pthread_mutex_init(&engine_lock, 0);
  70
  71         pthread_mutex_lock(&engine_lock);
  72
  73         /* Load virus definition files */
  74         ret = cl_load(cl_retdbdir(), &engine, &sigs, CL_DB_STDOPT);
  75         if (CL_SUCCESS != ret) {
  76                 pthread_mutex_unlock(&engine_lock);
  77                 daemon_log(LOG_ERR, "(%s:%u) cl_load() error: %s", __FILE__, __LINE__, cl_strerror(ret));
  78                 engine = NULL;
  79                 return;
  80         }
  81
  82         daemon_log(LOG_INFO, "(%s:%u) Virus definitions loaded (%d signatures).", __FILE__, __LINE__, sigs);
  83
  84         /* prepare the detection engine */
  85         ret = cl_build(engine);
  86         if (CL_SUCCESS != ret) {
  87                 pthread_mutex_unlock(&engine_lock);
  88                 daemon_log(LOG_ERR, "(%s:%u) cl_build() error: %s", __FILE__, __LINE__, cl_strerror(ret));
  89                 cl_free(engine);
  90                 engine = NULL;
  91                 return;
  92         }
  93
  94         daemon_log(LOG_INFO, "(%s:%u) Virus detection engine ready.", __FILE__, __LINE__);
  95         pthread_mutex_unlock(&engine_lock);
  96
  97         monitor_inc();
  98         pthread_attr_init(&ta);
  99         pthread_attr_setdetachstate(&ta, PTHREAD_CREATE_DETACHED);
 100         ret = pthread_create(&tt, &ta, (void *(*)(void *)) clam_refresh, (void *) NULL);
 101         if (ret) {
 102                 monitor_dec();
 103                 daemon_log(LOG_ERR, "(%s:%u) Can't create clam_refresh thread: %s", __FILE__, __LINE__, strerror(errno));
 104         }
 105 }
 106
 107 /**
 108  * Thread that reloads virus definitions as needed
 109  */
 110 void clam_refresh()
 111 {
 112         unsigned int sigs;
 113         int ret;
 114         struct cl_stat dbstat;
 115
 116         memset(&dbstat, 0, sizeof(struct cl_stat));
 117         cl_statinidir(cl_retdbdir(), &dbstat);
 118
 119         do {
 120                 if (cl_statchkdir(&dbstat) == 1) {
 121                         struct cl_engine *tmp_engine = NULL;
 122                         struct cl_engine *old_engine = NULL;
 123
 124                         daemon_log(LOG_INFO, "(%s:%u) Reloading new virus definitions", __FILE__, __LINE__);
 125
 126                         /* TODO: make options configurable. */
 127                         /* For example: enable/disable CL_DB_NCORE, CL_DB_PHISHING_URLS, etc. */
 128
 129                         /* Load virus definition files */
 130                         ret = cl_load(cl_retdbdir(), &tmp_engine, &sigs, CL_DB_STDOPT);
 131                         if (CL_SUCCESS != ret) {
 132                                 daemon_log(LOG_ERR, "(%s:%u) cl_load() error: %s", __FILE__, __LINE__, cl_strerror(ret));
 133                                 tmp_engine = NULL;
 134                                 continue;
 135                         }
 136
 137                         daemon_log(LOG_INFO, "(%s:%u) Virus definitions loaded (%d signatures).", __FILE__, __LINE__, sigs);
 138
 139                         /* prepare the detection engine */
 140                         ret = cl_build(tmp_engine);
 141                         if (CL_SUCCESS != ret) {
 142                                 daemon_log(LOG_ERR, "(%s:%u) cl_build() error: %s", __FILE__, __LINE__, cl_strerror(ret));
 143                                 cl_free(tmp_engine);
 144                                 tmp_engine = NULL;
 145                                 continue;
 146                         }
 147
 148                         /* Swap tmp_engine and engine, free resources from old engine */
 149                         pthread_mutex_lock(&engine_lock);
 150                         old_engine = engine;
 151                         engine = tmp_engine;
 152                         tmp_engine = NULL;
 153                         daemon_log(LOG_INFO, "(%s:%u) Virus detection engine ready.", __FILE__, __LINE__);
 154                         pthread_mutex_unlock(&engine_lock);
 155
 156                         cl_free(old_engine);
 157                         old_engine = NULL;
 158
 159                         cl_statfree(&dbstat);
 160                         memset(&dbstat, 0, sizeof(struct cl_stat));
 161                         cl_statinidir(cl_retdbdir(), &dbstat);
 162                 }
 163
 164                 sleep(5);
 165         } while (!exit_now);
 166
 167         cl_statfree(&dbstat);
 168
 169         monitor_dec();
 170 /*      pthread_exit(NULL);
 171  */ return;
 172 }
 173
 174 /**
 175  * Scans a file for virus.
 176  * @return -1 Error || 0 No Virus || +1 Virus Found
 177  */
 178 int contains_virus(char *filename)
 179 {
 180         int ret;
 181         struct cl_limits limits;
 182         const char *virname;
 183
 184         pthread_mutex_lock(&engine_lock);
 185
 186         memset(&limits, 0, sizeof(struct cl_limits));
 187         limits.maxfiles = 1;
 188         limits.maxfilesize = 10 * 1048576;
 189         limits.maxreclevel = 1;
 190         limits.maxmailrec = 1;
 191         limits.maxratio = 200;
 192
 193         /* TODO: make options configurable. */
 194         /* For example: enable/disable CL_SCAN_BLOCKENCRYPTED, CL_SCAN_BLOCKMAX, CL_SCAN_OLE2, etc. */
 195
 196         ret = cl_scanfile(filename, &virname, NULL, engine, &limits, CL_SCAN_STDOPT);
 197         if (CL_VIRUS == ret) {
 198                 pthread_mutex_unlock(&engine_lock);
 199                 daemon_log(LOG_INFO, "(%s:%u) %s: %s FOUND", __FILE__, __LINE__, filename, virname);
 200                 return 1;
 201         } else if (CL_CLEAN == ret) {
 202                 pthread_mutex_unlock(&engine_lock);
 203                 daemon_log(LOG_INFO, "(%s:%u) %s: OK", __FILE__, __LINE__, filename);
 204                 return 0;
 205         } else {
 206                 pthread_mutex_unlock(&engine_lock);
 207                 daemon_log(LOG_ERR, "(%s:%u) Scan Error: %s (%s)", __FILE__, __LINE__, cl_strerror(ret), filename);
 208                 return -1;
 209         }
 210 }
 211
 212 /**
 213  * Free resources used by the engine.
 214  */
 215 void clam_exit()
 216 {
 217         pthread_mutex_lock(&engine_lock);
 218
 219         if (engine) {
 220                 cl_free(engine);
 221                 engine = NULL;
 222         }
 223
 224         pthread_mutex_unlock(&engine_lock);
 225 }