31#include <openssl/ssl.h>
32#include <openssl/err.h>
35#if (!defined(__FreeBSD__) && !defined(__APPLE__))
41#if defined(HAVE_STAT64) && STAT64_OK
45#define STATBUF struct stat64
46#define CLAMSTAT stat64
49#define safe_open(a, b) open(a, b | O_LARGEFILE)
53#define STATBUF struct stat
64#define UNUSEDPARAM(x) (void)(x)
70#include "clamav-types.h"
71#include "clamav-version.h"
77#define CL_COUNT_PRECISION 4096
80typedef enum cl_error_t {
116 CL_EBYTECODE_TESTFAIL,
132#define CL_DB_PHISHING 0x2
133#define CL_DB_PHISHING_URLS 0x8
134#define CL_DB_PUA 0x10
135#define CL_DB_CVDNOTMP 0x20
136#define CL_DB_OFFICIAL 0x40
137#define CL_DB_PUA_MODE 0x80
138#define CL_DB_PUA_INCLUDE 0x100
139#define CL_DB_PUA_EXCLUDE 0x200
140#define CL_DB_COMPILED 0x400
141#define CL_DB_DIRECTORY 0x800
142#define CL_DB_OFFICIAL_ONLY 0x1000
143#define CL_DB_BYTECODE 0x2000
144#define CL_DB_SIGNED 0x4000
145#define CL_DB_BYTECODE_UNSIGNED 0x8000
146#define CL_DB_UNSIGNED 0x10000
147#define CL_DB_BYTECODE_STATS 0x20000
148#define CL_DB_ENHANCED 0x40000
149#define CL_DB_PCRE_STATS 0x80000
150#define CL_DB_YARA_EXCLUDE 0x100000
151#define CL_DB_YARA_ONLY 0x200000
154#define CL_DB_STDOPT (CL_DB_PHISHING | CL_DB_PHISHING_URLS | CL_DB_BYTECODE)
166#define CL_SCAN_GENERAL_ALLMATCHES 0x1
167#define CL_SCAN_GENERAL_COLLECT_METADATA 0x2
168#define CL_SCAN_GENERAL_HEURISTICS 0x4
169#define CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE 0x8
170#define CL_SCAN_GENERAL_UNPRIVILEGED 0x10
173#define CL_SCAN_PARSE_ARCHIVE 0x1
174#define CL_SCAN_PARSE_ELF 0x2
175#define CL_SCAN_PARSE_PDF 0x4
176#define CL_SCAN_PARSE_SWF 0x8
177#define CL_SCAN_PARSE_HWP3 0x10
178#define CL_SCAN_PARSE_XMLDOCS 0x20
179#define CL_SCAN_PARSE_MAIL 0x40
180#define CL_SCAN_PARSE_OLE2 0x80
181#define CL_SCAN_PARSE_HTML 0x100
182#define CL_SCAN_PARSE_PE 0x200
183#define CL_SCAN_PARSE_ONENOTE 0x400
186#define CL_SCAN_HEURISTIC_BROKEN 0x2
187#define CL_SCAN_HEURISTIC_EXCEEDS_MAX 0x4
188#define CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH 0x8
189#define CL_SCAN_HEURISTIC_PHISHING_CLOAK 0x10
190#define CL_SCAN_HEURISTIC_MACROS 0x20
191#define CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE 0x40
192#define CL_SCAN_HEURISTIC_ENCRYPTED_DOC 0x80
193#define CL_SCAN_HEURISTIC_PARTITION_INTXN 0x100
194#define CL_SCAN_HEURISTIC_STRUCTURED 0x200
195#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL 0x400
196#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED 0x800
197#define CL_SCAN_HEURISTIC_STRUCTURED_CC 0x1000
198#define CL_SCAN_HEURISTIC_BROKEN_MEDIA 0x2000
201#define CL_SCAN_MAIL_PARTIAL_MESSAGE 0x1
204#define CL_SCAN_DEV_COLLECT_SHA 0x1
205#define CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO 0x2
208#define CL_COUNTSIGS_OFFICIAL 0x1
209#define CL_COUNTSIGS_UNOFFICIAL 0x2
210#define CL_COUNTSIGS_ALL (CL_COUNTSIGS_OFFICIAL | CL_COUNTSIGS_UNOFFICIAL)
213#define ENGINE_OPTIONS_NONE 0x0
214#define ENGINE_OPTIONS_DISABLE_CACHE 0x1
215#define ENGINE_OPTIONS_FORCE_TO_DISK 0x2
216#define ENGINE_OPTIONS_DISABLE_PE_STATS 0x4
217#define ENGINE_OPTIONS_DISABLE_PE_CERTS 0x8
218#define ENGINE_OPTIONS_PE_DUMPCERTS 0x10
231extern void cl_debug(
void);
238extern void cl_always_gen_section_hash(
void);
252int cl_initialize_crypto(
void);
260void cl_cleanup_crypto(
void);
262#define CL_INIT_DEFAULT 0x0
269extern cl_error_t cl_init(
unsigned int initoptions);
278extern struct cl_engine *cl_engine_new(
void);
280enum cl_engine_field {
281 CL_ENGINE_MAX_SCANSIZE,
282 CL_ENGINE_MAX_FILESIZE,
283 CL_ENGINE_MAX_RECURSION,
285 CL_ENGINE_MIN_CC_COUNT,
286 CL_ENGINE_MIN_SSN_COUNT,
287 CL_ENGINE_PUA_CATEGORIES,
288 CL_ENGINE_DB_OPTIONS,
289 CL_ENGINE_DB_VERSION,
292 CL_ENGINE_AC_MINDEPTH,
293 CL_ENGINE_AC_MAXDEPTH,
296 CL_ENGINE_BYTECODE_SECURITY,
297 CL_ENGINE_BYTECODE_TIMEOUT,
298 CL_ENGINE_BYTECODE_MODE,
299 CL_ENGINE_MAX_EMBEDDEDPE,
300 CL_ENGINE_MAX_HTMLNORMALIZE,
301 CL_ENGINE_MAX_HTMLNOTAGS,
302 CL_ENGINE_MAX_SCRIPTNORMALIZE,
303 CL_ENGINE_MAX_ZIPTYPERCG,
304 CL_ENGINE_FORCETODISK,
305 CL_ENGINE_CACHE_SIZE,
306 CL_ENGINE_DISABLE_CACHE,
307 CL_ENGINE_DISABLE_PE_STATS,
308 CL_ENGINE_STATS_TIMEOUT,
309 CL_ENGINE_MAX_PARTITIONS,
310 CL_ENGINE_MAX_ICONSPE,
311 CL_ENGINE_MAX_RECHWP3,
312 CL_ENGINE_MAX_SCANTIME,
313 CL_ENGINE_PCRE_MATCH_LIMIT,
314 CL_ENGINE_PCRE_RECMATCH_LIMIT,
315 CL_ENGINE_PCRE_MAX_FILESIZE,
316 CL_ENGINE_DISABLE_PE_CERTS,
317 CL_ENGINE_PE_DUMPCERTS,
320enum bytecode_security {
321 CL_BYTECODE_TRUST_ALL = 0,
322 CL_BYTECODE_TRUST_SIGNED,
323 CL_BYTECODE_TRUST_NOTHING
327 CL_BYTECODE_MODE_AUTO = 0,
328 CL_BYTECODE_MODE_JIT,
329 CL_BYTECODE_MODE_INTERPRETER,
330 CL_BYTECODE_MODE_TEST,
335 unsigned char md5[16];
356extern cl_error_t cl_engine_set_num(
struct cl_engine *engine,
enum cl_engine_field field,
long long num);
366extern long long cl_engine_get_num(
const struct cl_engine *engine,
enum cl_engine_field field,
int *err);
384extern cl_error_t cl_engine_set_str(
struct cl_engine *engine,
enum cl_engine_field field,
const char *str);
394extern const char *cl_engine_get_str(
const struct cl_engine *engine,
enum cl_engine_field field,
int *err);
404extern struct cl_settings *cl_engine_settings_copy(
const struct cl_engine *engine);
416extern cl_error_t cl_engine_settings_apply(
struct cl_engine *engine,
const struct cl_settings *settings);
425extern cl_error_t cl_engine_settings_free(
struct cl_settings *settings);
437extern cl_error_t cl_engine_compile(
struct cl_engine *engine);
451extern cl_error_t cl_engine_addref(
struct cl_engine *engine);
463extern cl_error_t cl_engine_free(
struct cl_engine *engine);
483typedef cl_error_t (*clcb_pre_cache)(
int fd,
const char *type,
void *context);
492extern void cl_engine_set_clcb_pre_cache(
struct cl_engine *engine, clcb_pre_cache callback);
497#define LAYER_ATTRIBUTES_NONE 0x0
498#define LAYER_ATTRIBUTES_NORMALIZED 0x1
499#define LAYER_ATTRIBUTES_DECRYPTED 0x2
524typedef cl_error_t (*clcb_file_inspection)(
int fd,
const char *type,
const char **ancestors,
size_t parent_file_size,
525 const char *file_name,
size_t file_size,
const char *file_buffer,
526 uint32_t recursion_level, uint32_t layer_attributes,
void *context);
538extern void cl_engine_set_clcb_file_inspection(
struct cl_engine *engine, clcb_file_inspection callback);
555typedef cl_error_t (*clcb_pre_scan)(
int fd,
const char *type,
void *context);
564extern void cl_engine_set_clcb_pre_scan(
struct cl_engine *engine, clcb_pre_scan callback);
582typedef cl_error_t (*clcb_post_scan)(
int fd,
int result,
const char *virname,
void *context);
591extern void cl_engine_set_clcb_post_scan(
struct cl_engine *engine, clcb_post_scan callback);
607typedef void (*clcb_virus_found)(
int fd,
const char *virname,
void *context);
616extern void cl_engine_set_clcb_virus_found(
struct cl_engine *engine, clcb_virus_found callback);
634typedef int (*clcb_sigload)(
const char *type,
const char *name,
unsigned int custom,
void *context);
644extern void cl_engine_set_clcb_sigload(
struct cl_engine *engine, clcb_sigload callback,
void *context);
648 CL_MSG_INFO_VERBOSE = 32,
667typedef cl_error_t (*clcb_progress)(
size_t total_items,
size_t now_completed,
void *context);
679extern void cl_engine_set_clcb_sigload_progress(
struct cl_engine *engine, clcb_progress callback,
void *context);
695extern void cl_engine_set_clcb_engine_compile_progress(
struct cl_engine *engine, clcb_progress callback,
void *context);
711extern void cl_engine_set_clcb_engine_free_progress(
struct cl_engine *engine, clcb_progress callback,
void *context);
736typedef void (*clcb_msg)(
enum cl_msg severity,
const char *fullmsg,
const char *msg,
void *context);
742extern void cl_set_clcb_msg(clcb_msg callback);
756typedef void (*clcb_hash)(
int fd,
unsigned long long size,
const unsigned char *md5,
const char *virname,
void *context);
765extern void cl_engine_set_clcb_hash(
struct cl_engine *engine, clcb_hash callback);
786typedef cl_error_t (*clcb_meta)(
const char *container_type,
unsigned long fsize_container,
const char *filename,
787 unsigned long fsize_real,
int is_encrypted,
unsigned int filepos_container,
void *context);
796extern void cl_engine_set_clcb_meta(
struct cl_engine *engine, clcb_meta callback);
808typedef int (*clcb_file_props)(
const char *j_propstr,
int rc,
void *cbdata);
817extern void cl_engine_set_clcb_file_props(
struct cl_engine *engine, clcb_file_props callback);
828typedef int (*clcb_generic_data)(
const unsigned char *
const data,
const size_t data_len,
void *cbdata);
838extern void cl_engine_set_clcb_vba(
struct cl_engine *engine, clcb_generic_data callback);
861extern void cl_engine_set_stats_set_cbdata(
struct cl_engine *engine,
void *cbdata);
872typedef void (*clcb_stats_add_sample)(
const char *virname,
const unsigned char *md5,
size_t size,
stats_section_t *sections,
void *cbdata);
881extern void cl_engine_set_clcb_stats_add_sample(
struct cl_engine *engine, clcb_stats_add_sample callback);
891typedef void (*clcb_stats_remove_sample)(
const char *virname,
const unsigned char *md5,
size_t size,
void *cbdata);
900extern void cl_engine_set_clcb_stats_remove_sample(
struct cl_engine *engine, clcb_stats_remove_sample callback);
910typedef void (*clcb_stats_decrement_count)(
const char *virname,
const unsigned char *md5,
size_t size,
void *cbdata);
919extern void cl_engine_set_clcb_stats_decrement_count(
struct cl_engine *engine, clcb_stats_decrement_count callback);
927typedef void (*clcb_stats_submit)(
struct cl_engine *engine,
void *cbdata);
936extern void cl_engine_set_clcb_stats_submit(
struct cl_engine *engine, clcb_stats_submit callback);
944typedef void (*clcb_stats_flush)(
struct cl_engine *engine,
void *cbdata);
953extern void cl_engine_set_clcb_stats_flush(
struct cl_engine *engine, clcb_stats_flush callback);
960typedef size_t (*clcb_stats_get_num)(
void *cbdata);
969extern void cl_engine_set_clcb_stats_get_num(
struct cl_engine *engine, clcb_stats_get_num callback);
976typedef size_t (*clcb_stats_get_size)(
void *cbdata);
985extern void cl_engine_set_clcb_stats_get_size(
struct cl_engine *engine, clcb_stats_get_size callback);
992typedef char *(*clcb_stats_get_hostid)(
void *cbdata);
1001extern void cl_engine_set_clcb_stats_get_hostid(
struct cl_engine *engine, clcb_stats_get_hostid callback);
1008extern void cl_engine_stats_enable(
struct cl_engine *engine);
1025extern cl_error_t cl_scandesc(
int desc,
const char *filename,
const char **virname,
unsigned long int *scanned,
const struct cl_engine *engine,
struct cl_scan_options *scanoptions);
1041extern cl_error_t cl_scandesc_callback(
int desc,
const char *filename,
const char **virname,
unsigned long int *scanned,
const struct cl_engine *engine,
struct cl_scan_options *scanoptions,
void *context);
1053extern cl_error_t cl_scanfile(
const char *filename,
const char **virname,
unsigned long int *scanned,
const struct cl_engine *engine,
struct cl_scan_options *scanoptions);
1068extern cl_error_t cl_scanfile_callback(
const char *filename,
const char **virname,
unsigned long int *scanned,
const struct cl_engine *engine,
struct cl_scan_options *scanoptions,
void *context);
1083extern cl_error_t cl_load(
const char *path,
struct cl_engine *engine,
unsigned int *signo,
unsigned int dboptions);
1090extern const char *cl_retdbdir(
void);
1098 unsigned int version;
1116extern struct cl_cvd *cl_cvdhead(
const char *file);
1129extern struct cl_cvd *cl_cvdparse(
const char *head);
1137extern cl_error_t cl_cvdverify(
const char *file);
1144extern void cl_cvdfree(
struct cl_cvd *cvd);
1156extern cl_error_t cl_cvdunpack(
const char *file,
const char *dir,
bool dont_verify);
1168extern cl_error_t cl_cvdgetage(
const char *path, time_t *age_seconds);
1179 unsigned int entries;
1191extern cl_error_t cl_statinidir(
const char *dirname,
struct cl_stat *dbstat);
1200extern int cl_statchkdir(
const struct cl_stat *dbstat);
1209extern cl_error_t cl_statfree(
struct cl_stat *dbstat);
1219extern cl_error_t cl_countsigs(
const char *path,
unsigned int countoptions,
unsigned int *sigs);
1230extern unsigned int cl_retflevel(
void);
1239extern const char *cl_retver(
void);
1244extern const char *cl_strerror(cl_error_t clerror);
1250typedef struct cl_fmap cl_fmap_t;
1274typedef off_t (*clcb_pread)(
void *handle,
void *buf,
size_t count, off_t offset);
1293extern cl_fmap_t *cl_fmap_open_handle(
void *handle,
size_t offset,
size_t len,
1294 clcb_pread pread_cb,
int use_aging);
1308extern cl_fmap_t *cl_fmap_open_memory(
const void *start,
size_t len);
1318extern void cl_fmap_close(cl_fmap_t *);
1337extern cl_error_t cl_scanmap_callback(cl_fmap_t *map,
const char *filename,
const char **virname,
unsigned long int *scanned,
const struct cl_engine *engine,
struct cl_scan_options *scanoptions,
void *context);
1342#define MD5_HASH_SIZE 16
1343#define SHA1_HASH_SIZE 20
1344#define SHA256_HASH_SIZE 32
1345#define SHA384_HASH_SIZE 48
1346#define SHA512_HASH_SIZE 64
1358unsigned char *cl_hash_data(
const char *alg,
const void *buf,
size_t len,
unsigned char *obuf,
unsigned int *olen);
1368unsigned char *cl_hash_file_fd_ctx(EVP_MD_CTX *ctx,
int fd,
unsigned int *olen);
1378unsigned char *cl_hash_file_fd(
int fd,
const char *alg,
unsigned int *olen);
1388unsigned char *cl_hash_file_fp(FILE *fp,
const char *alg,
unsigned int *olen);
1399unsigned char *cl_sha256(
const void *buf,
size_t len,
unsigned char *obuf,
unsigned int *olen);
1410unsigned char *cl_sha384(
const void *buf,
size_t len,
unsigned char *obuf,
unsigned int *olen);
1421unsigned char *cl_sha512(
const void *buf,
size_t len,
unsigned char *obuf,
unsigned int *olen);
1432unsigned char *cl_sha1(
const void *buf,
size_t len,
unsigned char *obuf,
unsigned int *olen);
1446int cl_verify_signature(EVP_PKEY *pkey,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *data,
size_t datalen,
int decode);
1458int cl_verify_signature_hash(EVP_PKEY *pkey,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *digest);
1470int cl_verify_signature_fd(EVP_PKEY *pkey,
const char *alg,
unsigned char *sig,
unsigned int siglen,
int fd);
1482int cl_verify_signature_hash_x509_keyfile(
char *x509path,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *digest);
1494int cl_verify_signature_fd_x509_keyfile(
char *x509path,
const char *alg,
unsigned char *sig,
unsigned int siglen,
int fd);
1508int cl_verify_signature_x509_keyfile(
char *x509path,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *data,
size_t datalen,
int decode);
1520int cl_verify_signature_hash_x509(X509 *x509,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *digest);
1532int cl_verify_signature_fd_x509(X509 *x509,
const char *alg,
unsigned char *sig,
unsigned int siglen,
int fd);
1546int cl_verify_signature_x509(X509 *x509,
const char *alg,
unsigned char *sig,
unsigned int siglen,
unsigned char *data,
size_t datalen,
int decode);
1555X509 *cl_get_x509_from_mem(
void *data,
unsigned int len);
1564int cl_validate_certificate_chain_ts_dir(
char *tsdir,
char *certpath);
1574int cl_validate_certificate_chain(
char **authorities,
char *crlpath,
char *certpath);
1581X509 *cl_load_cert(
const char *certpath);
1589struct tm *cl_ASN1_GetTimeT(ASN1_TIME *timeobj);
1597X509_CRL *cl_load_crl(
const char *timeobj);
1609unsigned char *cl_sign_data_keyfile(
char *keypath,
const char *alg,
unsigned char *hash,
unsigned int *olen,
int encode);
1621unsigned char *cl_sign_data(EVP_PKEY *pkey,
const char *alg,
unsigned char *hash,
unsigned int *olen,
int encode);
1633unsigned char *cl_sign_file_fd(
int fd, EVP_PKEY *pkey,
const char *alg,
unsigned int *olen,
int encode);
1645unsigned char *cl_sign_file_fp(FILE *fp, EVP_PKEY *pkey,
const char *alg,
unsigned int *olen,
int encode);
1653EVP_PKEY *cl_get_pkey_file(
char *keypath);
1655void *cl_hash_init(
const char *alg);
1656int cl_update_hash(
void *ctx,
const void *data,
size_t sz);
1657int cl_finish_hash(
void *ctx,
void *buf);
1658void cl_hash_destroy(
void *ctx);