libclamav/phishcheck.h
bd912dd8
ec481027
 #ifdef	HAVE_REGEX_H
 #include <regex.h>
 #endif
bd912dd8
 
 #define CL_PHISH_BASE 100
 enum phish_status {CL_PHISH_NODECISION=0,CL_PHISH_CLEAN=CL_PHISH_BASE, CL_PHISH_CLEANUP_OK,CL_PHISH_HOST_OK, CL_PHISH_DOMAIN_OK,
 	CL_PHISH_HOST_NOT_LISTED,
 	CL_PHISH_REDIR_OK, CL_PHISH_HOST_REDIR_OK, CL_PHISH_DOMAIN_REDIR_OK,
 	CL_PHISH_HOST_REVERSE_OK,CL_PHISH_DOMAIN_REVERSE_OK,
 	CL_PHISH_WHITELISTED,CL_PHISH_HOST_WHITELISTED,
 	CL_PHISH_CLEAN_CID,
 	CL_PHISH_TEXTURL, CL_PHISH_MAILTO_OK,
 	CL_PHISH_CLOAKED_UIU, CL_PHISH_NUMERIC_IP,CL_PHISH_HEX_URL,CL_PHISH_CLOAKED_NULL,CL_PHISH_SSL_SPOOF, CL_PHISH_NOMATCH};
 
 #define HOST_SUFFICIENT   1
 #define DOMAIN_SUFFICIENT (HOST_SUFFICIENT | 2)
 #define DO_REVERSE_LOOKUP 4
 #define CHECK_REDIR       8
 #define CHECK_SSL         16
 #define CHECK_CLOAKING    32
 #define CLEANUP_URL       64
 #define CHECK_DOMAIN_REVERSE 128
 #define CHECK_IMG_URL        256
 #define DOMAINLIST_REQUIRED  512
 /* img checking disabled by default */
 
c7090d88
 #define LINKTYPE_IMAGE     1
bd912dd8
 
6e965052
 #define CL_PHISH_ALL_CHECKS (CLEANUP_URL|DOMAIN_SUFFICIENT|CHECK_SSL|CHECK_CLOAKING|CHECK_IMG_URL)
bd912dd8
 
 struct string {
 	int refcount;
 	struct string* ref;
 	char* data;
 };
 
ec481027
 struct phishcheck {
 	regex_t preg;
 	regex_t preg_tld;
 	regex_t preg_cctld;
 	regex_t preg_numeric;
19b3e182
 	regex_t preg_hexurl;
ec481027
 	char*    url_regex;
 	int      is_disabled;
 };
 
bd912dd8
 struct url_check {
 	struct string realLink;
 	struct string displayLink;
 	unsigned short       flags;
19b3e182
 	unsigned short always_check_flags;
c7090d88
 	unsigned short       link_type;
bd912dd8
 };
 
fc83da82
 #ifdef _MESSAGE_H
bd912dd8
 int phishingScan(message* m,const char* dir,cli_ctx* ctx,tag_arguments_t* hrefs);
fc83da82
 #endif
3da4dd4c
 
ec481027
 void phish_disable(struct cl_engine* engine,const char* reason);
3da4dd4c
 /* Global, non-thread-safe functions, call only once! */
ec481027
 int phishing_init(struct cl_engine* engine);
3da4dd4c
 void phishing_done(struct cl_engine* engine);
 /* end of non-thread-safe functions */
 
bd912dd8
 
 static inline int isPhishing(enum phish_status rc)
 {
 	switch(rc) {
 		case CL_PHISH_CLEAN:
 		case CL_PHISH_CLEANUP_OK:
 		case CL_PHISH_WHITELISTED:
 		case CL_PHISH_HOST_WHITELISTED:
 		case CL_PHISH_HOST_OK:
 		case CL_PHISH_DOMAIN_OK:
 		case CL_PHISH_REDIR_OK:
 		case CL_PHISH_HOST_REDIR_OK:
 		case CL_PHISH_DOMAIN_REDIR_OK:
 		case CL_PHISH_HOST_REVERSE_OK:
 		case CL_PHISH_DOMAIN_REVERSE_OK:
 		case CL_PHISH_MAILTO_OK:
 		case CL_PHISH_TEXTURL:
 		case CL_PHISH_HOST_NOT_LISTED:
 		case CL_PHISH_CLEAN_CID:
 			return 0;
 		case CL_PHISH_HEX_URL:
 		case CL_PHISH_CLOAKED_NULL:
 		case CL_PHISH_SSL_SPOOF:
 		case CL_PHISH_CLOAKED_UIU:
 		case CL_PHISH_NUMERIC_IP:
 		case CL_PHISH_NOMATCH:
 			return 1;
 		default:
 			return 1;
 	}
 }
 #endif
 
 #endif