e3aaff8e |
/* |
2023340a |
* Copyright (C) 2007-2008 Sourcefire, Inc.
*
* Authors: Tomasz Kojm |
e3aaff8e |
*
* This program is free software; you can redistribute it and/or modify |
bb34cb31 |
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation. |
e3aaff8e |
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software |
48b7b4a7 |
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA. |
e3aaff8e |
*/
#ifndef __CLAMAV_H
#define __CLAMAV_H
#include <sys/types.h>
#include <sys/stat.h>
#ifdef __cplusplus
extern "C"
{
#endif
#define CL_COUNT_PRECISION 4096
/* return codes */ |
b5134815 |
#define CL_CLEAN 0 /* no virus found */
#define CL_VIRUS 1 /* virus(es) found */ |
f51e962f |
#define CL_SUCCESS CL_CLEAN |
b9115f1d |
#define CL_BREAK 2 |
414abe87 |
|
d59d41b9 |
#define CL_EMAXREC -100 /* (internal) recursion limit exceeded */
#define CL_EMAXSIZE -101 /* (internal) size limit exceeded */
#define CL_EMAXFILES -102 /* (internal) files limit exceeded */ |
b5134815 |
#define CL_ERAR -103 /* rar handler error */
#define CL_EZIP -104 /* zip handler error */
#define CL_EGZIP -105 /* gzip handler error */
#define CL_EBZIP -106 /* bzip2 handler error */
#define CL_EOLE2 -107 /* OLE2 handler error */
#define CL_EMSCOMP -108 /* MS Expand handler error */
#define CL_EMSCAB -109 /* MS CAB module error */
#define CL_EACCES -110 /* access denied */
#define CL_ENULLARG -111 /* null argument */
#define CL_ETMPFILE -112 /* tmpfile() failed */ |
fd747ed8 |
/* #define CL_EFSYNC -113 *//* fsync() failed */ |
b5134815 |
#define CL_EMEM -114 /* memory allocation error */
#define CL_EOPEN -115 /* file open error */
#define CL_EMALFDB -116 /* malformed database */
#define CL_EPATSHORT -117 /* pattern too short */
#define CL_ETMPDIR -118 /* mkdir() failed */
#define CL_ECVD -119 /* not a CVD file (or broken) */
#define CL_ECVDEXTR -120 /* CVD extraction failure */
#define CL_EMD5 -121 /* MD5 verification error */
#define CL_EDSIG -122 /* digital signature verification error */
#define CL_EIO -123 /* general I/O error */ |
d59d41b9 |
#define CL_EFORMAT -124 /* (internal) bad format or broken file */ |
b5134815 |
#define CL_ESUPPORT -125 /* not supported data format */ |
9d96e4b6 |
#define CL_EARJ -127 /* ARJ handler error */ |
b5134815 |
|
f7470773 |
/* db options */ |
9f8098c0 |
#define CL_DB_PHISHING 0x2 |
b5134815 |
#define CL_DB_ACONLY 0x4 /* WARNING: only for developers */ |
9f8098c0 |
#define CL_DB_PHISHING_URLS 0x8 |
70edb085 |
#define CL_DB_PUA 0x10 |
056d95dc |
#define CL_DB_CVDNOTMP 0x20 |
b5513f8d |
#define CL_DB_OFFICIAL 0x40 |
f7470773 |
|
b5134815 |
/* recommended db settings */ |
692bda68 |
#define CL_DB_STDOPT (CL_DB_PHISHING | CL_DB_PHISHING_URLS) |
cf85d0ca |
|
3805ebcb |
/* scan options */ |
26fbf6bd |
#define CL_SCAN_RAW 0x0
#define CL_SCAN_ARCHIVE 0x1
#define CL_SCAN_MAIL 0x2
#define CL_SCAN_OLE2 0x4
#define CL_SCAN_BLOCKENCRYPTED 0x8
#define CL_SCAN_HTML 0x10
#define CL_SCAN_PE 0x20
#define CL_SCAN_BLOCKBROKEN 0x40
#define CL_SCAN_MAILURL 0x80
#define CL_SCAN_BLOCKMAX 0x100 /* ignored */
#define CL_SCAN_ALGORITHMIC 0x200
#define CL_SCAN_PHISHING_BLOCKSSL 0x800 /* ssl mismatches, not ssl by itself*/
#define CL_SCAN_PHISHING_BLOCKCLOAK 0x1000
#define CL_SCAN_ELF 0x2000
#define CL_SCAN_PDF 0x4000
#define CL_SCAN_STRUCTURED 0x8000
#define CL_SCAN_STRUCTURED_SSN_NORMAL 0x10000
#define CL_SCAN_STRUCTURED_SSN_STRIPPED 0x20000 |
4270f93b |
#define CL_SCAN_PARTIAL_MESSAGE 0x40000 |
b5134815 |
/* recommended scan settings */ |
813864ce |
#define CL_SCAN_STDOPT (CL_SCAN_ARCHIVE | CL_SCAN_MAIL | CL_SCAN_OLE2 | CL_SCAN_HTML | CL_SCAN_PE | CL_SCAN_ALGORITHMIC | CL_SCAN_ELF) |
3805ebcb |
/* aliases for backward compatibility */
#define CL_RAW CL_SCAN_RAW
#define CL_ARCHIVE CL_SCAN_ARCHIVE
#define CL_MAIL CL_SCAN_MAIL
#define CL_OLE2 CL_SCAN_OLE2 |
d262115a |
#define CL_ENCRYPTED CL_SCAN_BLOCKENCRYPTED |
5612732c |
#define cl_node cl_engine |
e53322b1 |
#define cl_perror cl_strerror |
3805ebcb |
|
5612732c |
struct cl_engine {
unsigned int refcount; /* reference counter */ |
555c5390 |
unsigned short sdb; |
616bc3b9 |
unsigned int dboptions; |
5612732c |
/* Roots table */ |
bedc58de |
void **root; |
4048c4f6 |
|
2b459819 |
/* B-M matcher for standard MD5 sigs */
void *md5_hdb; |
e5916a51 |
|
0a3d4094 |
/* B-M matcher for MD5 sigs for PE sections */ |
2b459819 |
void *md5_mdb;
/* B-M matcher for whitelist db */
void *md5_fp; |
c09d6c19 |
|
e5916a51 |
/* Zip metadata */ |
a7ac5978 |
void *zip_mlist; |
a62ae54f |
/* RAR metadata */ |
a7ac5978 |
void *rar_mlist; |
a62ae54f |
|
3da4dd4c |
/* Phishing .pdb and .wdb databases*/
void *whitelist_matcher;
void *domainlist_matcher; |
ec481027 |
void *phishcheck; |
bc93eda0 |
/* Dynamic configuration */
void *dconf; |
7021b545 |
/* Filetype definitions */
void *ftypes; |
ed9753e9 |
/* Ignored signatures */
void *ignored; |
e3aaff8e |
};
struct cl_limits { |
bf45cebe |
unsigned long int maxscansize; /* during the scanning of archives this size
* will never be exceeded
*/
unsigned long int maxfilesize; /* compressed files will only be decompressed
* and scanned up to this size
*/ |
dab42957 |
unsigned int maxreclevel; /* maximum recursion level for archives */ |
b5134815 |
unsigned int maxfiles; /* maximum number of files to be scanned
* within a single archive
*/
unsigned short archivememlim; /* limit memory usage for some unpackers */ |
a6e38800 |
/* This is for structured data detection. You can set the minimum
* number of occurences of an CC# or SSN before the system will
* generate a notification.
*/ |
26fbf6bd |
unsigned int min_cc_count;
unsigned int min_ssn_count; |
e3aaff8e |
};
struct cl_stat {
char *dir; |
b5134815 |
unsigned int entries; |
e3aaff8e |
struct stat *stattab; |
75ccac9f |
char **statdname; |
e3aaff8e |
};
|
b5134815 |
struct cl_cvd { /* field no. */
char *time; /* 2 */
unsigned int version; /* 3 */
unsigned int sigs; /* 4 */
unsigned int fl; /* 5 */
char *md5; /* 6 */
char *dsig; /* 7 */
char *builder; /* 8 */
unsigned int stime; /* 9 */ |
8139fd99 |
};
|
e3aaff8e |
/* file scanning */ |
5612732c |
extern int cl_scandesc(int desc, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options); |
e3aaff8e |
|
5612732c |
extern int cl_scanfile(const char *filename, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options); |
e3aaff8e |
|
b5134815 |
/* database handling */ |
f7470773 |
extern int cl_load(const char *path, struct cl_engine **engine, unsigned int *signo, unsigned int options); |
68a6f51f |
extern const char *cl_retdbdir(void); |
b5134815 |
/* engine handling */
extern int cl_build(struct cl_engine *engine); |
5612732c |
extern struct cl_engine *cl_dup(struct cl_engine *engine); |
b5134815 |
extern void cl_free(struct cl_engine *engine); |
e3aaff8e |
|
8000d078 |
/* CVD */ |
8139fd99 |
extern struct cl_cvd *cl_cvdhead(const char *file); |
e4ae7726 |
extern struct cl_cvd *cl_cvdparse(const char *head);
extern int cl_cvdverify(const char *file); |
8139fd99 |
extern void cl_cvdfree(struct cl_cvd *cvd);
|
b5134815 |
/* db dir stat functions */ |
e3aaff8e |
extern int cl_statinidir(const char *dirname, struct cl_stat *dbstat);
extern int cl_statchkdir(const struct cl_stat *dbstat);
extern int cl_statfree(struct cl_stat *dbstat);
|
b5134815 |
/* enable debug messages */ |
d4d14218 |
extern void cl_debug(void); |
e3aaff8e |
|
b5134815 |
/* software versions */
extern unsigned int cl_retflevel(void);
extern const char *cl_retver(void); |
e3aaff8e |
|
b5134815 |
/* others */
extern void cl_settempdir(const char *dir, short leavetemps); |
68a6f51f |
extern const char *cl_strerror(int clerror); |
e3aaff8e |
#ifdef __cplusplus |
23dc9e0b |
} |
e3aaff8e |
#endif
|
b5134815 |
#endif /* __CLAMAV_H */ |