-/* run_check: v0.1
- * Read the database and check if the binary has changed
- */
-void run_check()
-{
- char c_sum[256 +2];
- char alert_msg[912 +2];
- char buf[MAX_LINE +2];
- int file_count = 0;
-
-
- /* Cleaning buffer */
- memset(buf, '\0', MAX_LINE +1);
- memset(alert_msg, '\0', 912 +1);
- memset(c_sum, '\0', 256 +1);
-
- /* fgets garantee the null termination */
- while(fgets(buf, MAX_LINE, syscheck.fp) != NULL)
- {
- /* Buf should be in the following format:
- * header checksum file_name (checksum space filename)
- */
- char *n_file; /* file read from the db */
- char *n_sum; /* md5sum read from the db */
- char *tmp_c; /* tmp_char */
-
-
- /* Avoiding wrong formats in the database. Alert about them */
- if(buf[0] == '#' || buf[0] == ' ' || buf[0] == '\n')
- {
- merror("%s: Invalid entry in the integrity database: '%s'",
- ARGV0, buf);
- continue;
- }
-
- /* Adding a sleep in here -- avoid floods and extreme CPU usage
- * on the client side -- speed not necessary
- */
- file_count++;
- if(file_count >= (syscheck.sleep_after))
- {
- sleep(syscheck.tsleep);
- file_count = 0;
- }
-
-
- /* Finding the file name */
- n_file = strchr(buf, ' ');
- if(n_file == NULL)
- {
- merror("%s: Invalid entry in the integrity check database.",ARGV0);
- continue;
- }
-
- /* Zeroing the ' ' and messing up with buf */
- *n_file = '\0';
-
-
- /* Setting n_file to the begining of the file name */
- n_file++;
-
-
- /* Removing the '\n' if present and setting it to \0 */
- tmp_c = strchr(n_file,'\n');
- if(tmp_c)
- {
- *tmp_c = '\0';
- }
-
-
- /* Setting n_sum to the begining of buf */
- n_sum = buf;
-
-
- /* Cleaning up c_sum */
- memset(c_sum, '\0', 16);
- c_sum[255] = '\0';
-
-
- /* If it returns < 0, we will already have alerted. */
- if(c_read_file(n_file, n_sum, c_sum) < 0)
- continue;
-
-
- if(strcmp(c_sum, n_sum+6) != 0)
- {
- /* Sending the new checksum to the analysis server */
- alert_msg[912 +1] = '\0';
- snprintf(alert_msg, 912, "%s %s", c_sum, n_file);
- send_syscheck_msg(alert_msg);
-
- continue;
- }
-
- /* FILE OK if reached here */
- }
-}