clam.c

   1 /*
   2  * inoclam - Inotify+ClamAV virus scanner
   3  * Copyright (C) 2007 Vermont Department of Taxes
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18  *
  19  * Contributor(s):
  20  *   Tom Cort <tom.cort@state.vt.us>
  21  */
  22
  23 #include <clamav.h>
  24 #include <errno.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include <libdaemon/dlog.h>
  28 #include <pthread.h>
  29
  30 #include "clam.h"
  31 #include "monitor.h"
  32 #include "sig.h"
  33
  34 /**
  35  * Multiple threads are using and altering "engine".
  36  * Use the engine_lock to prevent concurrency issues.
  37  */
  38 struct cl_engine *engine = NULL;
  39
  40 /**
  41  * Load the virus definition files and prepare the engine.
  42  */
  43 void clam_init()
  44 {
  45         unsigned int sigs = 0;
  46         int ret;
  47
  48         pthread_t tt;
  49
  50         memset(&engine_lock, '\0', sizeof(pthread_mutex_t));
  51         pthread_mutex_init(&engine_lock, 0);
  52
  53         pthread_mutex_lock(&engine_lock);
  54
  55         /* Load virus definition files */
  56         ret = cl_load(cl_retdbdir(), &engine, &sigs, CL_DB_STDOPT);
  57         if (CL_SUCCESS != ret) {
  58                 pthread_mutex_unlock(&engine_lock);
  59                 daemon_log(LOG_ERR, "(%s:%u) cl_load() error: %s", __FILE__, __LINE__, cl_strerror(ret));
  60                 engine = NULL;
  61                 return;
  62         }
  63
  64         daemon_log(LOG_INFO, "(%s:%u) Virus definitions loaded (%d signatures).", __FILE__, __LINE__, sigs);
  65
  66         /* prepare the detection engine */
  67         ret = cl_build(engine);
  68         if (CL_SUCCESS != ret) {
  69                 pthread_mutex_unlock(&engine_lock);
  70                 daemon_log(LOG_ERR, "(%s:%u) cl_build() error: %s", __FILE__, __LINE__, cl_strerror(ret));
  71                 cl_free(engine);
  72                 engine = NULL;
  73                 return;
  74         }
  75
  76         daemon_log(LOG_INFO, "(%s:%u) Virus detection engine ready.", __FILE__, __LINE__);
  77         pthread_mutex_unlock(&engine_lock);
  78
  79         monitor_inc();
  80         pthread_attr_init(&ta);
  81         pthread_attr_setdetachstate(&ta, PTHREAD_CREATE_DETACHED);
  82         ret = pthread_create(&tt, &ta, (void *(*)(void *)) clam_refresh, (void *) NULL);
  83         if (ret) {
  84                 monitor_dec();
  85                 daemon_log(LOG_ERR, "(%s:%u) Can't create clam_refresh thread: %s", __FILE__, __LINE__, strerror(errno));
  86         }
  87 }
  88
  89 /**
  90  * Thread that reloads virus definitions as needed
  91  */
  92 void clam_refresh()
  93 {
  94         int sigs, ret;
  95         struct cl_stat dbstat;
  96
  97         memset(&dbstat, 0, sizeof(struct cl_stat));
  98         cl_statinidir(cl_retdbdir(), &dbstat);
  99
 100         do {
 101                 if (cl_statchkdir(&dbstat) == 1) {
 102                         struct cl_engine *tmp_engine = NULL;
 103                         struct cl_engine *old_engine = NULL;
 104
 105                         daemon_log(LOG_INFO, "(%s:%u) Reloading new virus definitions", __FILE__, __LINE__);
 106
 107                         /* Load virus definition files */
 108                         ret = cl_load(cl_retdbdir(), &tmp_engine, &sigs, CL_DB_STDOPT);
 109                         if (CL_SUCCESS != ret) {
 110                                 daemon_log(LOG_ERR, "(%s:%u) cl_load() error: %s", __FILE__, __LINE__, cl_strerror(ret));
 111                                 tmp_engine = NULL;
 112                                 continue;
 113                         }
 114
 115                         daemon_log(LOG_INFO, "(%s:%u) Virus definitions loaded (%d signatures).", __FILE__, __LINE__, sigs);
 116
 117                         /* prepare the detection engine */
 118                         ret = cl_build(tmp_engine);
 119                         if (CL_SUCCESS != ret) {
 120                                 daemon_log(LOG_ERR, "(%s:%u) cl_build() error: %s", __FILE__, __LINE__, cl_strerror(ret));
 121                                 cl_free(tmp_engine);
 122                                 tmp_engine = NULL;
 123                                 continue;
 124                         }
 125
 126                         /* Swap tmp_engine and engine, free resources from old engine */
 127                         pthread_mutex_lock(&engine_lock);
 128                         old_engine = engine;
 129                         engine = tmp_engine;
 130                         tmp_engine = NULL;
 131                         daemon_log(LOG_INFO, "(%s:%u) Virus detection engine ready.", __FILE__, __LINE__);
 132                         pthread_mutex_unlock(&engine_lock);
 133
 134                         cl_free(old_engine);
 135                         old_engine = NULL;
 136
 137                         cl_statfree(&dbstat);
 138                         memset(&dbstat, 0, sizeof(struct cl_stat));
 139                         cl_statinidir(cl_retdbdir(), &dbstat);
 140                 }
 141
 142                 sleep(10);
 143         } while (!exit_now);
 144
 145         cl_statfree(&dbstat);
 146
 147         monitor_dec();
 148 /*      pthread_exit(NULL);
 149  */ return;
 150 }
 151
 152 /**
 153  * Scans a file for virus.
 154  * @return -1 Error || 0 No Virus || +1 Virus Found
 155  */
 156 int contains_virus(char *filename)
 157 {
 158         int ret;
 159         struct cl_limits limits;
 160         const char *virname;
 161
 162         pthread_mutex_lock(&engine_lock);
 163
 164         memset(&limits, 0, sizeof(struct cl_limits));
 165         limits.maxfiles = 1;
 166         limits.maxfilesize = 10 * 1048576;
 167         limits.maxreclevel = 1;
 168         limits.maxmailrec = 1;
 169         limits.maxratio = 200;
 170
 171         ret = cl_scanfile(filename, &virname, NULL, engine, &limits, CL_SCAN_STDOPT);
 172         if (CL_VIRUS == ret) {
 173                 pthread_mutex_unlock(&engine_lock);
 174                 daemon_log(LOG_INFO, "(%s:%u) Virus detected: %s (%s)", __FILE__, __LINE__, virname, filename);
 175                 return 1;
 176         } else if (CL_CLEAN == ret) {
 177                 pthread_mutex_unlock(&engine_lock);
 178                 daemon_log(LOG_INFO, "(%s:%u) No virus detected (%s)", __FILE__, __LINE__, filename);
 179                 return 0;
 180         } else {
 181                 pthread_mutex_unlock(&engine_lock);
 182                 daemon_log(LOG_ERR, "(%s:%u) Scan Error: %s (%s)", __FILE__, __LINE__, cl_strerror(ret), filename);
 183                 return -1;
 184         }
 185 }
 186
 187 /**
 188  * Free resources used by the engine.
 189  */
 190 void clam_exit()
 191 {
 192         pthread_mutex_lock(&engine_lock);
 193
 194         if (engine) {
 195                 cl_free(engine);
 196                 engine = NULL;
 197         }
 198
 199         pthread_mutex_unlock(&engine_lock);
 200 }