libclamav/phishcheck.h
bd912dd8
 /*
43ecd9a1
bd912dd8
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 2 of the License, or
  *  (at your option) any later version.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.
  */
 
 
 #ifndef _PHISH_CHECK_H
 #define _PHISH_CHECK_H
 
ec481027
 #ifdef	HAVE_REGEX_H
 #include <regex.h>
 #endif
bd912dd8
 
 #define CL_PHISH_BASE 100
 enum phish_status {CL_PHISH_NODECISION=0,CL_PHISH_CLEAN=CL_PHISH_BASE, CL_PHISH_CLEANUP_OK,CL_PHISH_HOST_OK, CL_PHISH_DOMAIN_OK,
 	CL_PHISH_HOST_NOT_LISTED,
 	CL_PHISH_REDIR_OK, CL_PHISH_HOST_REDIR_OK, CL_PHISH_DOMAIN_REDIR_OK,
 	CL_PHISH_HOST_REVERSE_OK,CL_PHISH_DOMAIN_REVERSE_OK,
 	CL_PHISH_WHITELISTED,CL_PHISH_HOST_WHITELISTED,
 	CL_PHISH_CLEAN_CID,
 	CL_PHISH_TEXTURL, CL_PHISH_MAILTO_OK,
 	CL_PHISH_CLOAKED_UIU, CL_PHISH_NUMERIC_IP,CL_PHISH_HEX_URL,CL_PHISH_CLOAKED_NULL,CL_PHISH_SSL_SPOOF, CL_PHISH_NOMATCH};
 
 #define HOST_SUFFICIENT   1
 #define DOMAIN_SUFFICIENT (HOST_SUFFICIENT | 2)
 #define DO_REVERSE_LOOKUP 4
 #define CHECK_REDIR       8
 #define CHECK_SSL         16
 #define CHECK_CLOAKING    32
 #define CLEANUP_URL       64
 #define CHECK_DOMAIN_REVERSE 128
 #define CHECK_IMG_URL        256
 #define DOMAINLIST_REQUIRED  512
 /* img checking disabled by default */
 
c7090d88
 #define LINKTYPE_IMAGE     1
bd912dd8
 
6e965052
 #define CL_PHISH_ALL_CHECKS (CLEANUP_URL|DOMAIN_SUFFICIENT|CHECK_SSL|CHECK_CLOAKING|CHECK_IMG_URL)
bd912dd8
 
 struct string {
 	int refcount;
 	struct string* ref;
 	char* data;
 };
 
ec481027
 struct phishcheck {
 	regex_t preg;
 	regex_t preg_tld;
 	regex_t preg_cctld;
 	regex_t preg_numeric;
19b3e182
 	regex_t preg_hexurl;
ec481027
 	char*    url_regex;
 	int      is_disabled;
 };
 
bd912dd8
 struct url_check {
 	struct string realLink;
 	struct string displayLink;
 	unsigned short       flags;
19b3e182
 	unsigned short always_check_flags;
c7090d88
 	unsigned short       link_type;
bd912dd8
 };
 
fc83da82
 #ifdef _MESSAGE_H
bd912dd8
 int phishingScan(message* m,const char* dir,cli_ctx* ctx,tag_arguments_t* hrefs);
fc83da82
 #endif
3da4dd4c
 
ec481027
 void phish_disable(struct cl_engine* engine,const char* reason);
3da4dd4c
 /* Global, non-thread-safe functions, call only once! */
ec481027
 int phishing_init(struct cl_engine* engine);
3da4dd4c
 void phishing_done(struct cl_engine* engine);
 /* end of non-thread-safe functions */
 
bd912dd8
 
 #endif