@@ -45,8 +45,12 @@ clamd_SOURCES = \

     others.c \

     others.h \

     shared.h \

-    fan.c \

-    fan.h

+    onaccess_fan.c \

+    onaccess_fan.h \

+    onaccess_ddd.c \

+    onaccess_ddd.h \

+    onaccess_hash.c \

+    onaccess_hash.h

 AM_CFLAGS=@WERR_CFLAGS@

@@ -185,14 +185,17 @@ am__clamd_SOURCES_DIST = $(top_srcdir)/shared/output.c \

 	$(top_srcdir)/shared/misc.h clamd.c tcpserver.c tcpserver.h \

 	localserver.c localserver.h session.c session.h thrmgr.c \

 	thrmgr.h server-th.c server.h scanner.c scanner.h others.c \

-	others.h shared.h fan.c fan.h

+	others.h shared.h onaccess_fan.c onaccess_fan.h onaccess_ddd.c \

+	onaccess_ddd.h onaccess_hash.c onaccess_hash.h

 @BUILD_CLAMD_TRUE@am_clamd_OBJECTS = output.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@	optparser.$(OBJEXT) getopt.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@	misc.$(OBJEXT) clamd.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@	tcpserver.$(OBJEXT) localserver.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@	session.$(OBJEXT) thrmgr.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@	server-th.$(OBJEXT) scanner.$(OBJEXT) \

-@BUILD_CLAMD_TRUE@	others.$(OBJEXT) fan.$(OBJEXT)

+@BUILD_CLAMD_TRUE@	others.$(OBJEXT) onaccess_fan.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@	onaccess_ddd.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@	onaccess_hash.$(OBJEXT)

 clamd_OBJECTS = $(am_clamd_OBJECTS)

 clamd_LDADD = $(LDADD)

 AM_V_lt = $(am__v_lt_@AM_V@)

@@ -485,8 +488,12 @@ top_srcdir = @top_srcdir@

 @BUILD_CLAMD_TRUE@    others.c \

 @BUILD_CLAMD_TRUE@    others.h \

 @BUILD_CLAMD_TRUE@    shared.h \

-@BUILD_CLAMD_TRUE@    fan.c \

-@BUILD_CLAMD_TRUE@    fan.h

+@BUILD_CLAMD_TRUE@    onaccess_fan.c \

+@BUILD_CLAMD_TRUE@    onaccess_fan.h \

+@BUILD_CLAMD_TRUE@    onaccess_ddd.c \

+@BUILD_CLAMD_TRUE@    onaccess_ddd.h \

+@BUILD_CLAMD_TRUE@    onaccess_hash.c \

+@BUILD_CLAMD_TRUE@    onaccess_hash.h

 @BUILD_CLAMD_TRUE@AM_CFLAGS = @WERR_CFLAGS@

 AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

@@ -606,10 +613,12 @@ distclean-compile:

 	-rm -f *.tab.c

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/clamd.Po@am__quote@

-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/fan.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/localserver.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/onaccess_ddd.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/onaccess_fan.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/onaccess_hash.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/optparser.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/others.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output.Po@am__quote@

deleted file mode 100644

@@ -1,358 +0,0 @@

-/*

- *  Copyright (C) 2011 Sourcefire, Inc.

- *

- *  Authors: Tomasz Kojm

- *

- *  This program is free software; you can redistribute it and/or modify

- *  it under the terms of the GNU General Public License version 2 as

- *  published by the Free Software Foundation.

- *

- *  This program is distributed in the hope that it will be useful,

- *  but WITHOUT ANY WARRANTY; without even the implied warranty of

- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

- *  GNU General Public License for more details.

- *

- *  You should have received a copy of the GNU General Public License

- *  along with this program; if not, write to the Free Software

- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

- *  MA 02110-1301, USA.

- */

-

-#if HAVE_CONFIG_H

-#include "clamav-config.h"

-#endif

-

-#ifdef FANOTIFY

-

-#include <stdio.h>

-#include <unistd.h>

-#include <sys/types.h>

-#include <sys/stat.h>

-#include <fcntl.h>

-#include <signal.h>

-#include <pthread.h>

-#include <string.h>

-#include <errno.h>

-

-#include <sys/fanotify.h>

-

-#include "fan.h"

-

-#include "libclamav/clamav.h"

-#include "libclamav/scanners.h"

-

-#include "shared/optparser.h"

-#include "shared/output.h"

-

-#include "server.h"

-#include "others.h"

-#include "scanner.h"

-

-static void fan_exit(int sig)

-{

-

-    logg("*ScanOnAccess: fan_exit(), signal %d\n", sig);

-    pthread_exit(NULL);

-    logg("ScanOnAccess: stopped\n");

-}

-

-static int fan_scanfile(int fan_fd, const char *fname, struct fanotify_event_metadata *fmd, int scan, int extinfo, struct thrarg *tharg)

-{

-	struct fanotify_response res;

-	struct cb_context context;

-	const char *virname;

-	int ret = 0;

-

-    res.fd = fmd->fd;

-    res.response = FAN_ALLOW;

-    context.filename = fname;

-    context.virsize = 0;

-    if(scan && cl_scandesc_callback(fmd->fd, &virname, NULL, tharg->engine, tharg->options, &context) == CL_VIRUS) {

-	if(extinfo && context.virsize)

-	    logg("ScanOnAccess: %s: %s(%s:%llu) FOUND\n", fname, virname, context.virhash, context.virsize);

-	else

-	    logg("ScanOnAccess: %s: %s FOUND\n", fname, virname);

-	virusaction(fname, virname, tharg->opts);

-	res.response = FAN_DENY;

-    }

-

-    if(fmd->mask & FAN_ALL_PERM_EVENTS) {

-	ret = write(fan_fd, &res, sizeof(res));

-	if(ret == -1)

-	    logg("!ScanOnAccess: Internal error (can't write to fanotify)\n");

-    }

-

-    return ret;

-}

-

-void *fan_th(void *arg)

-{

-	struct thrarg *tharg = (struct thrarg *) arg;

-	sigset_t sigset;

-        struct sigaction act;

-	const struct optstruct *pt;

-	short int scan;

-	int sizelimit = 0, extinfo;

-	STATBUF sb;

-        uint64_t fan_mask = FAN_ACCESS | FAN_EVENT_ON_CHILD;

-	int fan_fd;

-        fd_set rfds;

-	char buf[4096];

-	ssize_t bread;

-	struct fanotify_event_metadata *fmd;

-	char fname[1024];

-	int ret, len;

-	char err[128];

-

-    /* ignore all signals except SIGUSR1 */

-    sigfillset(&sigset);

-    sigdelset(&sigset, SIGUSR1);

-    /* The behavior of a process is undefined after it ignores a 

-     * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */

-    sigdelset(&sigset, SIGFPE);

-    sigdelset(&sigset, SIGILL);

-    sigdelset(&sigset, SIGSEGV);

-#ifdef SIGBUS    

-    sigdelset(&sigset, SIGBUS);

-#endif

-    pthread_sigmask(SIG_SETMASK, &sigset, NULL);

-    memset(&act, 0, sizeof(struct sigaction));

-    act.sa_handler = fan_exit;

-    sigfillset(&(act.sa_mask));

-    sigaction(SIGUSR1, &act, NULL);

-    sigaction(SIGSEGV, &act, NULL);

-

-    fan_fd = fanotify_init(0, O_RDONLY);

-    if(fan_fd < 0) {

-	logg("!ScanOnAccess: fanotify_init failed: %s\n", cli_strerror(errno, err, sizeof(err)));

-	if(errno == EPERM)

-	    logg("ScanOnAccess: clamd must be started by root\n");

-	return NULL;

-    }

-

-    if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {

-	while(pt) {

-	    if(fanotify_mark(fan_fd, FAN_MARK_ADD, fan_mask, fan_fd, pt->strarg) != 0) {

-		logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);

-		return NULL;

-	    } else

-		logg("ScanOnAccess: Protecting directory '%s'\n", pt->strarg);

-	    pt = (struct optstruct *) pt->nextarg;

-	}

-    } else {

-	logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");

-	return NULL;

-    }

-

-    if((pt = optget(tharg->opts, "OnAccessExcludePath"))->enabled) {

-	while(pt) {

-            if(fanotify_mark(fan_fd, FAN_MARK_REMOVE, fan_mask, fan_fd, pt->strarg) != 0) {

-		logg("!ScanOnAccess: Can't exclude path %s\n", pt->strarg);

-		return NULL;

-	    } else

-		logg("ScanOnAccess: Excluded path %s\n", pt->strarg);

-	    pt = (struct optstruct *) pt->nextarg;

-	}

-    }

-

-    sizelimit = optget(tharg->opts, "OnAccessMaxFileSize")->numarg;

-    if(sizelimit)

-	logg("ScanOnAccess: Max file size limited to %d bytes\n", sizelimit);

-    else

-	logg("ScanOnAccess: File size limit disabled\n");

-

-    extinfo = optget(tharg->opts, "ExtendedDetectionInfo")->enabled;

-

-    FD_ZERO(&rfds);

-    FD_SET(fan_fd, &rfds);

-    do {

-        ret = select(fan_fd + 1, &rfds, NULL, NULL, NULL);

-    } while(ret == -1 && errno == EINTR);

-

-    while((bread = read(fan_fd, buf, sizeof(buf))) > 0) {

-	fmd = (struct fanotify_event_metadata *) buf;

-	while(FAN_EVENT_OK(fmd, bread)) {

-	    scan = 1;

-	    if(fmd->fd >= 0) {

-		sprintf(fname, "/proc/self/fd/%d", fmd->fd);

-		len = readlink(fname, fname, sizeof(fname) - 1);

-		if(len == -1) {

-		    close(fmd->fd);

-		    logg("!ScanOnAccess: Internal error (readlink() failed)\n");

-		    return NULL;

-		}

-		fname[len] = 0;

-

-		if(fan_checkowner(fmd->pid, tharg->opts)) {

-		    scan = 0;

-		    logg("*ScanOnAccess: %s skipped (excluded UID)\n", fname);

-		}

-

-		if(sizelimit) {

-		    if(FSTAT(fmd->fd, &sb) != 0 || sb.st_size > sizelimit) {

-			scan = 0;

-			/* logg("*ScanOnAccess: %s skipped (size > %d)\n", fname, sizelimit); */

-		    }

-		}

-

-		if(fan_scanfile(fan_fd, fname, fmd, scan, extinfo, tharg) == -1) {

-		    close(fmd->fd);

-		    return NULL;

-		}

-

-		if(close(fmd->fd) == -1) {

-		    printf("!ScanOnAccess: Internal error (close(%d) failed)\n", fmd->fd);

-		    close(fmd->fd);

-		    return NULL;

-		}

-	    }

-	    fmd = FAN_EVENT_NEXT(fmd, bread);

-	}

-	do {

-	    ret = select(fan_fd + 1, &rfds, NULL, NULL, NULL);

-	} while(ret == -1 && errno == EINTR);

-    }

-

-    if(bread < 0)

-	logg("!ScanOnAccess: Internal error (failed to read data)\n");

-

-    return NULL;

-}

-

-#elif defined(CLAMAUTH)

-

-#include <stdio.h>

-#include <unistd.h>

-#include <sys/types.h>

-#include <sys/stat.h>

-#include <sys/uio.h>

-#include <fcntl.h>

-#include <signal.h>

-#include <pthread.h>

-#include <string.h>

-#include <errno.h>

-

-#include "libclamav/clamav.h"

-#include "libclamav/scanners.h"

-

-#include "shared/optparser.h"

-#include "shared/output.h"

-

-#include "server.h"

-#include "others.h"

-#include "scanner.h"

-

-#define SUPPORTED_PROTOCOL  2

-

-static int cauth_fd = -1;

-

-struct ClamAuthEvent {

-    unsigned int action;

-    char path[1024];

-    unsigned int pid;

-};

-

-static void cauth_exit(int sig)

-{

-    logg("*ScanOnAccess: cauth_exit(), signal %d\n", sig);

-    if(cauth_fd > 0)

-	close(cauth_fd);

-    pthread_exit(NULL);

-    logg("ScanOnAccess: stopped\n");

-}

-

-static int cauth_scanfile(const char *fname, int extinfo, struct thrarg *tharg)

-{

-	struct cb_context context;

-	const char *virname;

-	int ret = 0, fd;

-

-    context.filename = fname;

-    context.virsize = 0;

-

-    fd = open(fname, O_RDONLY);

-    if(fd == -1)

-	return -1;

-

-    if(cl_scandesc_callback(fd, &virname, NULL, tharg->engine, tharg->options, &context) == CL_VIRUS) {

-	if(extinfo && context.virsize)

-	    logg("ScanOnAccess: %s: %s(%s:%llu) FOUND\n", fname, virname, context.virhash, context.virsize);

-	else

-	    logg("ScanOnAccess: %s: %s FOUND\n", fname, virname);

-	virusaction(fname, virname, tharg->opts);

-    }

-    close(fd);

-    return ret;

-}

-

-void *fan_th(void *arg)

-{

-	struct thrarg *tharg = (struct thrarg *) arg;

-	sigset_t sigset;

-        struct sigaction act;

-	int eventcnt = 1, extinfo;

-	char err[128];

-	struct ClamAuthEvent event;

-

-    /* ignore all signals except SIGUSR1 */

-    sigfillset(&sigset);

-    sigdelset(&sigset, SIGUSR1);

-    /* The behavior of a process is undefined after it ignores a 

-     * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */

-    sigdelset(&sigset, SIGFPE);

-    sigdelset(&sigset, SIGILL);

-    sigdelset(&sigset, SIGSEGV);

-#ifdef SIGBUS    

-    sigdelset(&sigset, SIGBUS);

-#endif

-    pthread_sigmask(SIG_SETMASK, &sigset, NULL);

-    memset(&act, 0, sizeof(struct sigaction));

-    act.sa_handler = cauth_exit;

-    sigfillset(&(act.sa_mask));

-    sigaction(SIGUSR1, &act, NULL);

-    sigaction(SIGSEGV, &act, NULL);

-

-    extinfo = optget(tharg->opts, "ExtendedDetectionInfo")->enabled;

-

-    cauth_fd = open("/dev/clamauth", O_RDONLY);

-    if(cauth_fd == -1) {

-	logg("!ScanOnAccess: Can't open /dev/clamauth\n");

-	if(errno == ENOENT)

-	    logg("!ScanOnAccess: Please make sure ClamAuth.kext is loaded\n");

-	else if(errno == EACCES)

-	    logg("!ScanOnAccess: This application requires root privileges\n");

-	else

-	    logg("!ScanOnAccess: /dev/clamauth: %s\n", cli_strerror(errno, err, sizeof(err)));

-

-	return NULL;

-    }

-

-    while(1) {

-	if(read(cauth_fd, &event, sizeof(event)) > 0) {

-	    if(eventcnt == 1) {

-		if(event.action != SUPPORTED_PROTOCOL) {

-		    logg("!ScanOnAccess: Protocol version mismatch (tool: %d, driver: %d)\n", SUPPORTED_PROTOCOL, event.action);

-		    close(cauth_fd);

-		    return NULL;

-		}

-		if(strncmp(event.path, "ClamAuth", 8)) {

-		    logg("!ScanOnAccess: Invalid version event\n");

-		    close(cauth_fd);

-		    return NULL;

-		}

-		logg("ScanOnAccess: Driver version: %s, protocol version: %d\n", &event.path[9], event.action);

-	    } else {

-		cauth_scanfile(event.path, extinfo, tharg);

-	    }

-	    eventcnt++;

-	} else {

-	    if(errno == ENODEV) {

-		printf("^ScanOnAccess: ClamAuth module deactivated, terminating\n");

-		close(cauth_fd);

-		return NULL;

-	    }

-	}

-	usleep(200);

-    }

-}

-#endif

deleted file mode 100644

@@ -1,26 +0,0 @@

-/*

- *  Copyright (C) 2011 Sourcefire, Inc.

- *

- *  Authors: Tomasz Kojm

- *

- *  This program is free software; you can redistribute it and/or modify

- *  it under the terms of the GNU General Public License version 2 as

- *  published by the Free Software Foundation.

- *

- *  This program is distributed in the hope that it will be useful,

- *  but WITHOUT ANY WARRANTY; without even the implied warranty of

- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

- *  GNU General Public License for more details.

- *

- *  You should have received a copy of the GNU General Public License

- *  along with this program; if not, write to the Free Software

- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

- *  MA 02110-1301, USA.

- */

-

-#ifndef __FAN_H

-#define __FAN_H

-

-void *fan_th(void *arg);

-

-#endif

new file mode 100644

@@ -0,0 +1,424 @@

+/*

+ *  Copyright (C) 2015 Sourcefire, Inc.

+ *

+ *  Authors: Mickey Sola

+ *

+ *  This program is free software; you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License version 2 as

+ *  published by the Free Software Foundation.

+ *

+ *  This program is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with this program; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

+ *  MA 02110-1301, USA.

+ */

+

+#if HAVE_CONFIG_H

+#include "clamav-config.h"

+#endif

+

+#define PROTOTYPING 1

+#if PROTOTYPING

+

+#include <stdio.h>

+#include <stdlib.h>

+#include <unistd.h>

+#include <sys/types.h>

+#include <sys/stat.h>

+#include <fts.h>

+#include <fcntl.h>

+#include <signal.h>

+#include <pthread.h>

+#include <string.h>

+#include <errno.h>

+#include <stdbool.h>

+

+#include <sys/fanotify.h>

+#include <sys/inotify.h>

+

+#include "onaccess_fan.h"

+#include "onaccess_hash.h"

+#include "onaccess_ddd.h"

+

+#include "libclamav/clamav.h"

+#include "libclamav/scanners.h"

+

+#include "shared/optparser.h"

+#include "shared/output.h"

+

+#include "server.h"

+#include "others.h"

+#include "scanner.h"

+

+/* TODO: Unglobalize these. */

+static struct onas_ht *ddd_ht;

+static char **wdlt;

+static uint32_t wdlt_len;

+

+static int onas_ddd_init_ht(uint32_t ht_size) {

+

+	if (ht_size <= 0)

+		ht_size = ONAS_DEFAULT_HT_SIZE;

+

+	return onas_ht_init(&ddd_ht, ht_size);

+}

+

+static int onas_ddd_init_wdlt(uint32_t nwatches) {

+

+	wdlt = (char **) cli_calloc(nwatches << 1, sizeof(char*));

+	if (!wdlt) return CL_EMEM;

+

+	wdlt_len = nwatches << 1;

+

+	return CL_SUCCESS;

+}

+

+static int onas_ddd_grow_wdlt() {

+

+	char **ptr = NULL;

+

+	ptr = (char **) cli_realloc(wdlt, wdlt_len << 1);

+	if (!ptr) return CL_EMEM;

+

+	if (ptr == wdlt)

+		memset(&ptr[wdlt_len], 0, sizeof(char *) * (wdlt_len - 1));

+	else

+		return CL_EMEM;

+

+	wdlt_len <<= 1;

+

+	return CL_SUCCESS;

+}

+

+

+/* TODO: Support configuration for changing/setting number of inotify watches. */

+int onas_ddd_init(uint32_t nwatches, size_t ht_size) {

+

+	const char* nwatch_file = "/proc/sys/fs/inotify/max_user_watches";

+	int nwfd = 0;

+	int ret = 0;

+	char nwatch_str[MAX_WATCH_LEN];

+	char *p = NULL;

+	nwatches = 0;

+

+	nwfd = open(nwatch_file, O_RDONLY);

+	if (nwfd < 0) return CL_EOPEN;

+

+	ret = read(nwfd, nwatch_str, MAX_WATCH_LEN);

+	close(nwfd);

+	if (ret < 0) return CL_EREAD;

+

+	nwatches = strtol(nwatch_str, &p, 10);

+

+	ret = onas_ddd_init_wdlt(nwatches);

+	if (ret) return ret;

+

+	ret = onas_ddd_init_ht(ht_size);

+	if (ret) return ret;

+

+	return CL_SUCCESS;

+}

+

+static int onas_ddd_watch(const char *pathname, int fan_fd, uint64_t fan_mask, int in_fd, uint64_t in_mask) {

+	if (!pathname || fan_fd <= 0 || in_fd <= 0) return CL_ENULLARG;

+

+	int ret = CL_SUCCESS;

+	size_t len = strlen(pathname);

+

+	ret = onas_ddd_watch_hierarchy(pathname, len, in_fd, in_mask, ONAS_IN);

+	if (ret) return ret;

+

+	ret = onas_ddd_watch_hierarchy(pathname, len, fan_fd, fan_mask, ONAS_FAN);

+	if (ret) return ret;

+

+	return CL_SUCCESS;

+}

+

+static int onas_ddd_watch_hierarchy(const char* pathname, size_t len, int fd, uint64_t mask, uint32_t type) {

+

+	if (!pathname || fd <= 0 || !type) return CL_ENULLARG;

+

+	if (type == (ONAS_IN | ONAS_FAN)) return CL_EARG;

+

+	struct onas_hnode *hnode = NULL;

+	struct onas_element *elem = NULL;

+	int wd = 0;

+

+	if(onas_ht_get(ddd_ht, pathname, len, &elem) != CL_SUCCESS) return CL_EARG;

+

+	hnode = elem->data;

+

+	if (type & ONAS_IN) {

+		wd = inotify_add_watch(fd, pathname, (uint32_t) mask);

+

+		if (wd < 0) return CL_EARG;

+

+		if (wd >= wdlt_len) {

+			onas_ddd_grow_wdlt();

+		}

+

+		/* Link the hash node to the watch descriptor lookup table */

+		hnode->wd = wd;

+		wdlt[wd] = hnode->pathname;

+

+		hnode->watched |= ONAS_INWATCH;

+	} else if (type & ONAS_FAN) {

+		if(fanotify_mark(fd, FAN_MARK_ADD, mask, AT_FDCWD, hnode->pathname) < 0) return CL_EARG;

+		hnode->watched |= ONAS_FANWATCH;

+	} else {

+		return CL_EARG;

+	}

+

+	struct onas_lnode *curr = hnode->childhead;

+

+	while (curr->next != hnode->childtail) {

+		curr = curr->next;

+

+		size_t size = len + strlen(curr->dirname) + 2;

+		char *child_path = (char *) cli_malloc(size);

+		if (hnode->pathname[len-1] == '/')

+			snprintf(child_path, --size, "%s%s", hnode->pathname, curr->dirname);

+		else

+			snprintf(child_path, size, "%s/%s", hnode->pathname, curr->dirname);

+

+		if(onas_ddd_watch_hierarchy(child_path, strlen(child_path), fd, mask, type)) return CL_EARG;

+		free(child_path);

+	}

+

+	return CL_SUCCESS;

+}

+

+static int onas_ddd_unwatch(const char *pathname, int fan_fd, int in_fd) {

+	if (!pathname || fan_fd <= 0 || in_fd <= 0) return CL_ENULLARG;

+

+	int ret = CL_SUCCESS;

+	size_t len = strlen(pathname);

+

+	ret = onas_ddd_unwatch_hierarchy(pathname, len, in_fd, ONAS_IN);

+	if (ret) return ret;

+

+	ret = onas_ddd_unwatch_hierarchy(pathname, len,fan_fd, ONAS_FAN);

+	if (ret) return ret;

+

+	return CL_SUCCESS;

+}

+

+static int onas_ddd_unwatch_hierarchy(const char* pathname, size_t len, int fd, uint32_t type) {

+

+	if (!pathname || fd <= 0 || !type) return CL_ENULLARG;

+

+	if (type == (ONAS_IN | ONAS_FAN)) return CL_EARG;

+

+	struct onas_hnode *hnode = NULL;

+	struct onas_element *elem = NULL;

+	int wd = 0;

+

+	if(onas_ht_get(ddd_ht, pathname, len, &elem)) return CL_EARG;

+

+	hnode = elem->data;

+

+	if (type & ONAS_IN) {

+		wd = hnode->wd;

+

+		if(!inotify_rm_watch(fd, wd)) return CL_EARG;

+

+		/* Unlink the hash node from the watch descriptor lookup table */

+		hnode->wd = 0;

+		wdlt[wd] = NULL;

+

+		hnode->watched = ONAS_STOPWATCH;

+	} else if (type & ONAS_FAN) {

+		if(fanotify_mark(fd, FAN_MARK_REMOVE, 0, AT_FDCWD, hnode->pathname) < 0) return CL_EARG;

+		hnode->watched = ONAS_STOPWATCH;

+	} else {

+		return CL_EARG;

+	}

+

+	struct onas_lnode *curr = hnode->childhead;

+

+	while (curr->next != hnode->childtail) {

+		curr = curr->next;

+

+		size_t size = len + strlen(curr->dirname) + 2;

+		char *child_path = (char *) cli_malloc(size);

+		if (hnode->pathname[len-1] == '/')

+			snprintf(child_path, --size, "%s%s", hnode->pathname, curr->dirname);

+		else

+			snprintf(child_path, size, "%s/%s", hnode->pathname, curr->dirname);

+

+		onas_ddd_unwatch_hierarchy(child_path, strlen(child_path), fd, type);

+		free(child_path);

+	}

+

+	return CL_SUCCESS;

+}

+

+void *onas_ddd_th(void *arg) {

+	struct ddd_thrarg *tharg = (struct ddd_thrarg *) arg;

+	sigset_t sigset;

+	struct sigaction act;

+	const struct optstruct *pt;

+	short int scan;

+	int sizelimit = 0, extinfo;

+	STATBUF sb;

+	uint64_t in_mask = IN_ONLYDIR | IN_MOVE | IN_DELETE | IN_CREATE;

+	int in_fd;

+	fd_set rfds;

+	char buf[4096];

+	ssize_t bread;

+	const struct inotify_event *event;

+	int ret, len;

+

+	/* ignore all signals except SIGUSR1 */

+	sigfillset(&sigset);

+	sigdelset(&sigset, SIGUSR1);

+	/* The behavior of a process is undefined after it ignores a 

+	 * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */

+	sigdelset(&sigset, SIGFPE);

+	sigdelset(&sigset, SIGILL);

+	sigdelset(&sigset, SIGSEGV);

+#ifdef SIGBUS    

+	sigdelset(&sigset, SIGBUS);

+#endif

+	pthread_sigmask(SIG_SETMASK, &sigset, NULL);

+	memset(&act, 0, sizeof(struct sigaction));

+	act.sa_handler = onas_ddd_exit;

+	sigfillset(&(act.sa_mask));

+	sigaction(SIGUSR1, &act, NULL);

+	sigaction(SIGSEGV, &act, NULL);

+

+	in_fd = inotify_init1(IN_NONBLOCK);

+	//in_fd = inotify_init();

+	if (in_fd == -1) {

+		logg("!ScanOnAccess: Could not init inotify.");

+		return NULL;

+	}

+

+	ret = onas_ddd_init(0, ONAS_DEFAULT_HT_SIZE);

+	if (ret) {

+		logg("!ScanOnAccess: Failed to initialize 3D. \n");

+		return NULL;

+	}

+

+	/* Add provided paths recursively. */

+	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {

+		while(pt) {

+			if(onas_ht_get(ddd_ht, pt->strarg, strlen(pt->strarg), NULL) != CL_SUCCESS) {

+				if(onas_ht_add_hierarchy(ddd_ht, pt->strarg)) {

+					logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);

+					return NULL;

+				}

+			}

+

+			pt = (struct optstruct *) pt->nextarg;

+		}

+	} else {

+		logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");

+		return NULL;

+	}

+

+	/* Remove provided paths recursively. */

+	if((pt = optget(tharg->opts, "OnAccessExcludePath"))->enabled) {

+		while(pt) {

+			size_t ptlen = strlen(pt->strarg);

+			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {

+				if(onas_ht_rm_hierarchy(ddd_ht, pt->strarg, ptlen, 0)) {

+					logg("!ScanOnAccess: Can't exclude path '%s'\n", pt->strarg);

+					return NULL;

+				}

+			}

+

+			pt = (struct optstruct *) pt->nextarg;

+		}

+	}

+

+	/* Watch provided paths recursively */

+	if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {

+		while(pt) {

+			size_t ptlen = strlen(pt->strarg);

+			if(onas_ht_get(ddd_ht, pt->strarg, ptlen, NULL) == CL_SUCCESS) {

+				if(onas_ddd_watch(pt->strarg, tharg->fan_fd, tharg->fan_mask, in_fd, in_mask)) {

+					logg("!ScanOnAccess: Could not watch path '%s', %s\n", pt->strarg, strerror(errno));

+					return NULL;

+				}

+			}

+

+			/*onas_print_ht(ddd_ht, pt->strarg, 0);*/

+			pt = (struct optstruct *) pt->nextarg;

+		}

+	}

+

+

+	FD_ZERO(&rfds);

+	FD_SET(in_fd, &rfds);

+

+	while (1) {

+		do {

+			ret = select(in_fd + 1, &rfds, NULL, NULL, NULL);

+		} while(ret == -1 && errno == EINTR);

+

+		while((bread = read(in_fd, buf, sizeof(buf))) > 0) {

+

+			/* Handle events. */

+			int wd;

+			char *p = buf;

+			const char *path = NULL;

+			const char *child = NULL;

+			for(p; p < buf + bread; p += sizeof(struct inotify_event) + event->len) {

+

+				event = (const struct inotify_event *) p;

+				wd = event->wd;

+				path = wdlt[wd];

+				child = event->name;

+

+				len = strlen(path);

+				size_t size = strlen(child) + len + 2;

+				char *child_path = (char *) cli_malloc(size);

+				if (path[len-1] == '/')

+					snprintf(child_path, --size, "%s%s", path, child);

+				else

+					snprintf(child_path, size, "%s/%s", path, child);

+

+				struct stat s;

+				if(stat(child_path, &s) == 0 && S_ISREG(s.st_mode)) continue;

+				if(!(event->mask & IN_ISDIR)) continue;

+

+				if (event->mask & IN_DELETE) {

+					logg("*ddd: DELETE - Removing %s from %s with wd:%d\n", child_path, path, wd);

+					onas_ddd_unwatch(child_path, tharg->fan_fd, in_fd);

+					onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);

+

+				} else if (event->mask & IN_MOVED_FROM) {

+					logg("*ddd: MOVED_FROM - Removing %s from %s with wd:%d\n", child_path, path, wd);

+					onas_ddd_unwatch(child_path, tharg->fan_fd, in_fd);

+					onas_ht_rm_hierarchy(ddd_ht, child_path, strlen(child_path), 0);

+

+				} else if (event->mask & IN_CREATE) {

+					logg("*ddd: CREATE - Adding %s to %s with wd:%d\n", child_path, path, wd);

+					onas_ht_add_hierarchy(ddd_ht, child_path);

+					onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, in_fd, in_mask);

+

+				} else if (event->mask & IN_MOVED_TO) {

+					logg("*ddd: MOVED_TO - Adding %s to %s with wd:%d\n", child_path, path, wd);

+					onas_ht_add_hierarchy(ddd_ht, child_path);

+					onas_ddd_watch(child_path, tharg->fan_fd, tharg->fan_mask, in_fd, in_mask);

+				}

+			}

+		}

+	}

+

+	return NULL;

+}

+

+static void onas_ddd_exit(int sig) {

+	logg("*ScanOnAccess: onas_ddd_exit(), signal %d\n", sig);