clamav.h

/*
 *  Copyright (C) 2013-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
 *  Copyright (C) 2007-2013 Sourcefire, Inc.
 *
 *  Authors: Tomasz Kojm
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *  MA 02110-1301, USA.
 */
 
#ifndef __CLAMAV_H
#define __CLAMAV_H
 
#ifdef _WIN32
#ifndef OWN_WINSOCK
#include <winsock2.h>
#endif
#endif
 
#include <openssl/ssl.h>
#include <openssl/err.h>
 
/* Certain OSs already use 64bit variables in their stat struct */
#if (!defined(__FreeBSD__) && !defined(__APPLE__))
#define STAT64_OK 1
#else
#define STAT64_OK 0
#endif
 
#if defined(HAVE_STAT64) && STAT64_OK
 
#include <unistd.h>
 
#define STATBUF struct stat64
#define CLAMSTAT stat64
#define LSTAT lstat64
#define FSTAT fstat64
#define safe_open(a, b) open(a, b | O_LARGEFILE)
 
#else
 
#define STATBUF struct stat
#define CLAMSTAT stat
#define LSTAT lstat
#define FSTAT fstat
/* Nothing is safe in windows, not even open, safe_open defined under /win32 */
#ifndef _WIN32
#define safe_open open
#endif
 
#endif
 
/* Apple does not define __pid_t */
#ifdef __APPLE__
typedef pid_t __pid_t;
#endif
 
#define UNUSEDPARAM(x) (void)(x)
 
#include <sys/types.h>
#include <sys/stat.h>
#include <stdbool.h>
 
#include "clamav-types.h"
#include "clamav-version.h"
 
#ifdef __cplusplus
extern "C" {
#endif
 
#define CL_COUNT_PRECISION 4096
 
typedef enum cl_verdict_t {
    CL_VERDICT_NOTHING_FOUND = 0,    
    CL_VERDICT_TRUSTED,              
    CL_VERDICT_STRONG_INDICATOR,     
    CL_VERDICT_POTENTIALLY_UNWANTED, 
} cl_verdict_t;
 
typedef enum cl_error_t {
    /* libclamav specific */
    CL_CLEAN   = 0,
    CL_SUCCESS = 0,
    CL_VIRUS,
    CL_ENULLARG,
    CL_EARG,
    CL_EMALFDB,
    CL_ECVD,
    CL_EVERIFY,
    CL_EUNPACK,
 
    /* I/O and memory errors */
    CL_EOPEN,
    CL_ECREAT,
    CL_EUNLINK,
    CL_ESTAT,
    CL_EREAD,
    CL_ESEEK,
    CL_EWRITE,
    CL_EDUP,
    CL_EACCES,
    CL_ETMPFILE,
    CL_ETMPDIR,
    CL_EMAP,
    CL_EMEM,
    CL_ETIMEOUT,
 
    /* internal (not reported outside libclamav) */
    CL_BREAK,
    CL_EMAXREC,
    CL_EMAXSIZE,
    CL_EMAXFILES,
    CL_EFORMAT,
    CL_EPARSE,
    CL_EBYTECODE,          
    CL_EBYTECODE_TESTFAIL, 
    CL_ELOCK,
    CL_EBUSY,
    CL_ESTATE,
 
    CL_VERIFIED, 
    CL_ERROR,    
    /* no error codes below this line please */
    CL_ELAST_ERROR
} cl_error_t;
 
/* db options */
// clang-format off
#define CL_DB_PHISHING          0x2
#define CL_DB_PHISHING_URLS     0x8
#define CL_DB_PUA               0x10
#define CL_DB_CVDNOTMP          0x20    
#define CL_DB_OFFICIAL          0x40    
#define CL_DB_PUA_MODE          0x80
#define CL_DB_PUA_INCLUDE       0x100
#define CL_DB_PUA_EXCLUDE       0x200
#define CL_DB_COMPILED          0x400   
#define CL_DB_DIRECTORY         0x800   
#define CL_DB_OFFICIAL_ONLY     0x1000
#define CL_DB_BYTECODE          0x2000
#define CL_DB_SIGNED            0x4000  
#define CL_DB_BYTECODE_UNSIGNED 0x8000  
#define CL_DB_UNSIGNED          0x10000 
#define CL_DB_BYTECODE_STATS    0x20000
#define CL_DB_ENHANCED          0x40000
#define CL_DB_PCRE_STATS        0x80000
#define CL_DB_YARA_EXCLUDE      0x100000
#define CL_DB_YARA_ONLY         0x200000
#define CL_DB_FIPS_LIMITS       0x400000 
/* recommended db settings */
#define CL_DB_STDOPT (CL_DB_PHISHING | CL_DB_PHISHING_URLS | CL_DB_BYTECODE)
 
/*** scan options ***/
struct cl_scan_options {
    uint32_t general;
    uint32_t parse;
    uint32_t heuristic;
    uint32_t mail;
    uint32_t dev;
};
 
/* general */
#define CL_SCAN_GENERAL_ALLMATCHES                  0x1  
#define CL_SCAN_GENERAL_COLLECT_METADATA            0x2  
#define CL_SCAN_GENERAL_HEURISTICS                  0x4  
#define CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE        0x8  
#define CL_SCAN_GENERAL_UNPRIVILEGED                0x10 
#define CL_SCAN_GENERAL_STORE_HTML_URIS             0x20 
#define CL_SCAN_GENERAL_STORE_PDF_URIS              0x40 
#define CL_SCAN_GENERAL_STORE_EXTRA_HASHES          0x80 
/* parsing capabilities options */
#define CL_SCAN_PARSE_ARCHIVE                       0x1
#define CL_SCAN_PARSE_ELF                           0x2
#define CL_SCAN_PARSE_PDF                           0x4
#define CL_SCAN_PARSE_SWF                           0x8
#define CL_SCAN_PARSE_HWP3                          0x10
#define CL_SCAN_PARSE_XMLDOCS                       0x20
#define CL_SCAN_PARSE_MAIL                          0x40
#define CL_SCAN_PARSE_OLE2                          0x80
#define CL_SCAN_PARSE_HTML                          0x100
#define CL_SCAN_PARSE_PE                            0x200
#define CL_SCAN_PARSE_ONENOTE                       0x400
#define CL_SCAN_PARSE_IMAGE                         0x800  
#define CL_SCAN_PARSE_IMAGE_FUZZY_HASH              0x1000 
/* heuristic alerting options */
#define CL_SCAN_HEURISTIC_BROKEN                    0x2    
#define CL_SCAN_HEURISTIC_EXCEEDS_MAX               0x4    
#define CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH     0x8    
#define CL_SCAN_HEURISTIC_PHISHING_CLOAK            0x10   
#define CL_SCAN_HEURISTIC_MACROS                    0x20   
#define CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE         0x40   
#define CL_SCAN_HEURISTIC_ENCRYPTED_DOC             0x80   
#define CL_SCAN_HEURISTIC_PARTITION_INTXN           0x100  
#define CL_SCAN_HEURISTIC_STRUCTURED                0x200  
#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL     0x400  
#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED   0x800  
#define CL_SCAN_HEURISTIC_STRUCTURED_CC             0x1000 
#define CL_SCAN_HEURISTIC_BROKEN_MEDIA              0x2000 
/* mail scanning options */
#define CL_SCAN_MAIL_PARTIAL_MESSAGE                0x1
 
/* dev options */
#define CL_SCAN_DEV_COLLECT_SHA                     0x1 
#define CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO        0x2 
/* cl_countsigs options */
#define CL_COUNTSIGS_OFFICIAL                       0x1
#define CL_COUNTSIGS_UNOFFICIAL                     0x2
#define CL_COUNTSIGS_ALL                            (CL_COUNTSIGS_OFFICIAL | CL_COUNTSIGS_UNOFFICIAL)
 
/* For the new engine_options bit field in the engine */
#define ENGINE_OPTIONS_NONE             0x0
#define ENGINE_OPTIONS_DISABLE_CACHE    0x1
#define ENGINE_OPTIONS_FORCE_TO_DISK    0x2
#define ENGINE_OPTIONS_DISABLE_PE_STATS 0x4
#define ENGINE_OPTIONS_DISABLE_PE_CERTS 0x8
#define ENGINE_OPTIONS_PE_DUMPCERTS     0x10
#define ENGINE_OPTIONS_TMPDIR_RECURSION 0x20
#define ENGINE_OPTIONS_FIPS_LIMITS      0x40
// clang-format on
 
struct cl_engine;
struct cl_settings;
 
/* ----------------------------------------------------------------------------
 * Enable global libclamav features.
 */
 
extern void cl_debug(void);
 
extern void cl_always_gen_section_hash(void);
 
/* ----------------------------------------------------------------------------
 * Scan engine functions.
 */
 
int cl_initialize_crypto(void);
 
void cl_cleanup_crypto(void);
 
#define CL_INIT_DEFAULT 0x0
extern cl_error_t cl_init(unsigned int initoptions);
 
extern struct cl_engine *cl_engine_new(void);
 
enum cl_engine_field {
    CL_ENGINE_MAX_SCANSIZE,        
    CL_ENGINE_MAX_FILESIZE,        
    CL_ENGINE_MAX_RECURSION,       
    CL_ENGINE_MAX_FILES,           
    CL_ENGINE_MIN_CC_COUNT,        
    CL_ENGINE_MIN_SSN_COUNT,       
    CL_ENGINE_PUA_CATEGORIES,      
    CL_ENGINE_DB_OPTIONS,          
    CL_ENGINE_DB_VERSION,          
    CL_ENGINE_DB_TIME,             
    CL_ENGINE_AC_ONLY,             
    CL_ENGINE_AC_MINDEPTH,         
    CL_ENGINE_AC_MAXDEPTH,         
    CL_ENGINE_TMPDIR,              
    CL_ENGINE_KEEPTMP,             
    CL_ENGINE_BYTECODE_SECURITY,   
    CL_ENGINE_BYTECODE_TIMEOUT,    
    CL_ENGINE_BYTECODE_MODE,       
    CL_ENGINE_MAX_EMBEDDEDPE,      
    CL_ENGINE_MAX_HTMLNORMALIZE,   
    CL_ENGINE_MAX_HTMLNOTAGS,      
    CL_ENGINE_MAX_SCRIPTNORMALIZE, 
    CL_ENGINE_MAX_ZIPTYPERCG,      
    CL_ENGINE_FORCETODISK,         
    CL_ENGINE_CACHE_SIZE,          
    CL_ENGINE_DISABLE_CACHE,       
    CL_ENGINE_DISABLE_PE_STATS,    
    CL_ENGINE_STATS_TIMEOUT,       
    CL_ENGINE_MAX_PARTITIONS,      
    CL_ENGINE_MAX_ICONSPE,         
    CL_ENGINE_MAX_RECHWP3,         
    CL_ENGINE_MAX_SCANTIME,        
    CL_ENGINE_PCRE_MATCH_LIMIT,    
    CL_ENGINE_PCRE_RECMATCH_LIMIT, 
    CL_ENGINE_PCRE_MAX_FILESIZE,   
    CL_ENGINE_DISABLE_PE_CERTS,    
    CL_ENGINE_PE_DUMPCERTS,        
    CL_ENGINE_CVDCERTSDIR,         
    CL_ENGINE_TMPDIR_RECURSION,    
    CL_ENGINE_FIPS_LIMITS,         
};
 
enum bytecode_security {
    CL_BYTECODE_TRUST_ALL = 0, 
    CL_BYTECODE_TRUST_SIGNED,  
    CL_BYTECODE_TRUST_NOTHING  
};
 
enum bytecode_mode {
    CL_BYTECODE_MODE_AUTO = 0,    
    CL_BYTECODE_MODE_JIT,         
    CL_BYTECODE_MODE_INTERPRETER, 
    CL_BYTECODE_MODE_TEST,        
    CL_BYTECODE_MODE_OFF          
};
 
struct cli_section_hash {
    unsigned char md5[16];
    size_t len;
};
 
typedef struct cli_stats_sections {
    size_t nsections;
    struct cli_section_hash *sections;
} stats_section_t;
 
extern cl_error_t cl_engine_set_num(struct cl_engine *engine, enum cl_engine_field field, long long num);
 
extern long long cl_engine_get_num(const struct cl_engine *engine, enum cl_engine_field field, int *err);
 
extern cl_error_t cl_engine_set_str(struct cl_engine *engine, enum cl_engine_field field, const char *str);
 
extern const char *cl_engine_get_str(const struct cl_engine *engine, enum cl_engine_field field, int *err);
 
extern struct cl_settings *cl_engine_settings_copy(const struct cl_engine *engine);
 
extern cl_error_t cl_engine_settings_apply(struct cl_engine *engine, const struct cl_settings *settings);
 
extern cl_error_t cl_engine_settings_free(struct cl_settings *settings);
 
extern cl_error_t cl_engine_compile(struct cl_engine *engine);
 
extern cl_error_t cl_engine_addref(struct cl_engine *engine);
 
extern cl_error_t cl_engine_free(struct cl_engine *engine);
 
/* ----------------------------------------------------------------------------
 * ClamAV File Map Abstraction Public API.
 */
struct cl_fmap;
typedef struct cl_fmap cl_fmap_t;
 
typedef off_t (*clcb_pread)(void *handle, void *buf, size_t count, off_t offset);
 
extern cl_fmap_t *cl_fmap_open_handle(
    void *handle,
    size_t offset,
    size_t len,
    clcb_pread pread_cb,
    int use_aging);
 
extern cl_fmap_t *cl_fmap_open_memory(const void *start, size_t len);
 
extern cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name);
 
extern cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out);
 
extern cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path);
 
extern cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, size_t *offset_out, size_t *len_out);
 
extern cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t *offset_out, size_t *len_out);
 
extern cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t *size_out);
 
extern cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char *hash_alg, char hash);
 
extern cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char *hash_alg, bool *have_hash_out);
 
extern cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const char *hash_alg);
 
extern cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char *hash_alg, char **hash_out);
 
extern cl_error_t cl_fmap_get_data(
    const cl_fmap_t *map,
    size_t offset,
    size_t len,
    const uint8_t **data_out,
    size_t *data_len_out);
 
extern void cl_fmap_close(cl_fmap_t *);
 
/* ----------------------------------------------------------------------------
 * ClamAV Recursive Scan Layer Public API.
 */
struct cl_scan_layer;
typedef struct cl_scan_layer cl_scan_layer_t;
 
extern cl_error_t cl_scan_layer_get_fmap(
    cl_scan_layer_t *layer,
    cl_fmap_t **fmap_out);
 
extern cl_error_t cl_scan_layer_get_parent_layer(
    cl_scan_layer_t *layer,
    cl_scan_layer_t **parent_layer_out);
 
extern cl_error_t cl_scan_layer_get_type(
    cl_scan_layer_t *layer,
    const char **type_out);
 
extern cl_error_t cl_scan_layer_get_recursion_level(
    cl_scan_layer_t *layer,
    uint32_t *recursion_level_out);
 
extern cl_error_t cl_scan_layer_get_object_id(
    cl_scan_layer_t *layer,
    uint64_t *object_id_out);
 
extern cl_error_t cl_scan_layer_get_last_alert(
    cl_scan_layer_t *layer,
    const char **alert_name_out);
 
/*
 * Attributes of each layer in scan.
 */
#define LAYER_ATTRIBUTES_NONE 0x0       
#define LAYER_ATTRIBUTES_NORMALIZED 0x1 
#define LAYER_ATTRIBUTES_DECRYPTED 0x2  
#define LAYER_ATTRIBUTES_RETYPED 0x4    
#define LAYER_ATTRIBUTES_EMBEDDED 0x8   
extern cl_error_t cl_scan_layer_get_attributes(
    cl_scan_layer_t *layer,
    uint32_t *attributes_out);
 
/* ----------------------------------------------------------------------------
 * Callback function type definitions.
 */
 
typedef enum scan_callback {
    CL_SCAN_CALLBACK_PRE_HASH,
 
    CL_SCAN_CALLBACK_PRE_SCAN,
 
    CL_SCAN_CALLBACK_POST_SCAN,
 
    CL_SCAN_CALLBACK_ALERT,
 
    CL_SCAN_CALLBACK_FILE_TYPE
} cl_scan_callback_t;
 
typedef cl_error_t (*clcb_scan)(cl_scan_layer_t *layer, void *context);
extern void cl_engine_set_scan_callback(struct cl_engine *engine, clcb_scan callback, cl_scan_callback_t location);
 
typedef cl_error_t (*clcb_pre_cache)(int fd, const char *type, void *context);
extern void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cache callback);
 
typedef cl_error_t (*clcb_file_inspection)(
    int fd,
    const char *type,
    const char **ancestors,
    size_t parent_file_size,
    const char *file_name,
    size_t file_size,
    const char *file_buffer,
    uint32_t recursion_level,
    uint32_t layer_attributes,
    void *context);
extern void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, clcb_file_inspection callback);
 
typedef cl_error_t (*clcb_pre_scan)(int fd, const char *type, void *context);
extern void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan callback);
 
typedef cl_error_t (*clcb_post_scan)(int fd, int result, const char *virname, void *context);
extern void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);
 
typedef void (*clcb_virus_found)(int fd, const char *virname, void *context);
extern void cl_engine_set_clcb_virus_found(struct cl_engine *engine, clcb_virus_found callback);
 
typedef int (*clcb_sigload)(const char *type, const char *name, unsigned int custom, void *context);
extern void cl_engine_set_clcb_sigload(struct cl_engine *engine, clcb_sigload callback, void *context);
 
enum cl_msg {
    /* leave room for more message levels in the future */
    CL_MSG_INFO_VERBOSE = 32, /* verbose */
    CL_MSG_WARN         = 64, /* LibClamAV WARNING: */
    CL_MSG_ERROR        = 128 /* LibClamAV ERROR: */
};
 
typedef cl_error_t (*clcb_progress)(size_t total_items, size_t now_completed, void *context);
 
extern void cl_engine_set_clcb_sigload_progress(struct cl_engine *engine, clcb_progress callback, void *context);
 
extern void cl_engine_set_clcb_engine_compile_progress(struct cl_engine *engine, clcb_progress callback, void *context);
 
extern void cl_engine_set_clcb_engine_free_progress(struct cl_engine *engine, clcb_progress callback, void *context);
 
typedef void (*clcb_msg)(enum cl_msg severity, const char *fullmsg, const char *msg, void *context);
extern void cl_set_clcb_msg(clcb_msg callback);
 
typedef void (*clcb_hash)(int fd, unsigned long long size, const char *md5, const char *virname, void *context);
extern void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback);
 
typedef cl_error_t (*clcb_meta)(
    const char *container_type,
    unsigned long fsize_container,
    const char *filename,
    unsigned long fsize_real,
    int is_encrypted,
    unsigned int filepos_container,
    void *context);
extern void cl_engine_set_clcb_meta(struct cl_engine *engine, clcb_meta callback);
 
typedef int (*clcb_file_props)(const char *j_propstr, int rc, void *cbdata);
extern void cl_engine_set_clcb_file_props(struct cl_engine *engine, clcb_file_props callback);
 
typedef int (*clcb_generic_data)(const unsigned char *const data, const size_t data_len, void *cbdata);
 
extern void cl_engine_set_clcb_vba(struct cl_engine *engine, clcb_generic_data callback);
 
/* ----------------------------------------------------------------------------
 * Statistics/telemetry gathering callbacks.
 *
 * The statistics callback functions may be used to implement a telemetry
 * gathering feature.
 *
 * The structure definition for `cbdata` is entirely up to the caller, as are
 * the implementations of each of the callback functions defined below.
 */
 
extern void cl_engine_set_stats_set_cbdata(struct cl_engine *engine, void *cbdata);
 
typedef void (*clcb_stats_add_sample)(
    const char *virname,
    const unsigned char *md5,
    size_t size,
    stats_section_t *sections,
    void *cbdata);
extern void cl_engine_set_clcb_stats_add_sample(struct cl_engine *engine, clcb_stats_add_sample callback);
 
typedef void (*clcb_stats_remove_sample)(const char *virname, const unsigned char *md5, size_t size, void *cbdata);
extern void cl_engine_set_clcb_stats_remove_sample(struct cl_engine *engine, clcb_stats_remove_sample callback);
 
typedef void (*clcb_stats_decrement_count)(const char *virname, const unsigned char *md5, size_t size, void *cbdata);
extern void cl_engine_set_clcb_stats_decrement_count(struct cl_engine *engine, clcb_stats_decrement_count callback);
 
typedef void (*clcb_stats_submit)(struct cl_engine *engine, void *cbdata);
extern void cl_engine_set_clcb_stats_submit(struct cl_engine *engine, clcb_stats_submit callback);
 
typedef void (*clcb_stats_flush)(struct cl_engine *engine, void *cbdata);
extern void cl_engine_set_clcb_stats_flush(struct cl_engine *engine, clcb_stats_flush callback);
 
typedef size_t (*clcb_stats_get_num)(void *cbdata);
extern void cl_engine_set_clcb_stats_get_num(struct cl_engine *engine, clcb_stats_get_num callback);
 
typedef size_t (*clcb_stats_get_size)(void *cbdata);
extern void cl_engine_set_clcb_stats_get_size(struct cl_engine *engine, clcb_stats_get_size callback);
 
typedef char *(*clcb_stats_get_hostid)(void *cbdata);
extern void cl_engine_set_clcb_stats_get_hostid(struct cl_engine *engine, clcb_stats_get_hostid callback);
 
extern void cl_engine_stats_enable(struct cl_engine *engine);
 
/* ----------------------------------------------------------------------------
 * File scanning.
 */
 
extern cl_error_t cl_scandesc(
    int desc,
    const char *filename,
    const char **virname,
    unsigned long int *scanned,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions);
 
extern cl_error_t cl_scandesc_callback(
    int desc,
    const char *filename,
    const char **virname,
    unsigned long int *scanned,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context);
 
extern cl_error_t cl_scandesc_ex(
    int desc,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);
 
extern cl_error_t cl_scanfile(
    const char *filename,
    const char **virname,
    unsigned long int *scanned,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions);
 
extern cl_error_t cl_scanfile_callback(
    const char *filename,
    const char **virname,
    unsigned long int *scanned,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context);
 
extern cl_error_t cl_scanfile_ex(
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);
 
extern cl_error_t cl_scanmap_callback(
    cl_fmap_t *map,
    const char *filename,
    const char **virname,
    unsigned long int *scanned,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context);
 
extern cl_error_t cl_scanmap_ex(
    cl_fmap_t *map,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);
 
/* ----------------------------------------------------------------------------
 * Database handling.
 */
 
extern cl_error_t cl_load(const char *path, struct cl_engine *engine, unsigned int *signo, unsigned int dboptions);
 
extern const char *cl_retdbdir(void);
 
/* ----------------------------------------------------------------------------
 * CVD / database functions
 */
 
struct cl_cvd {           /* field no. */
    char *time;           /* 2 */
    unsigned int version; /* 3 */
    unsigned int sigs;    /* 4 */
    unsigned int fl;      /* 5 */
                          /* padding */
    char *md5;            /* 6 */
    char *dsig;           /* 7 */
    char *builder;        /* 8 */
    unsigned int stime;   /* 9 */
};
 
extern struct cl_cvd *cl_cvdhead(const char *file);
 
extern struct cl_cvd *cl_cvdparse(const char *head);
 
extern cl_error_t cl_cvdverify(const char *file);
 
extern cl_error_t cl_cvdverify_ex(const char *file, const char *certs_directory, uint32_t dboptions);
 
extern void cl_cvdfree(struct cl_cvd *cvd);
 
extern cl_error_t cl_cvdunpack(const char *file, const char *dir, bool dont_verify);
 
cl_error_t cl_cvdunpack_ex(const char *file, const char *dir, const char *certs_directory, uint32_t dboptions);
 
extern cl_error_t cl_cvdgetage(const char *path, time_t *age_seconds);
 
/* ----------------------------------------------------------------------------
 * DB directory stat functions.
 * Use these functions to watch for database changes.
 */
 
struct cl_stat {
    char *dir;
    STATBUF *stattab;
    char **statdname;
    unsigned int entries;
};
 
extern cl_error_t cl_statinidir(const char *dirname, struct cl_stat *dbstat);
 
extern int cl_statchkdir(const struct cl_stat *dbstat);
 
extern cl_error_t cl_statfree(struct cl_stat *dbstat);
 
extern cl_error_t cl_countsigs(const char *path, unsigned int countoptions, unsigned int *sigs);
 
/* ----------------------------------------------------------------------------
 * Software versions.
 */
 
extern unsigned int cl_retflevel(void);
 
extern const char *cl_retver(void);
 
/* ----------------------------------------------------------------------------
 * Others.
 */
extern const char *cl_strerror(cl_error_t clerror);
 
/* ----------------------------------------------------------------------------
 * Hashing functions.
 */
#define MD5_HASH_SIZE 16
#define SHA1_HASH_SIZE 20
#define SHA256_HASH_SIZE 32
#define SHA384_HASH_SIZE 48
#define SHA512_HASH_SIZE 64
 
#define CL_HASH_FLAG_NONE 0x00        /* None */
#define CL_HASH_FLAG_ALLOCATE 0x01    /* Use CL_HASH_FLAG_ALLOCATE to dynamically allocate the output buffer.                 \
                                       * If this flag is set, the function will allocate a buffer for the hash and return it. \
                                       * The caller is responsible for freeing the buffer using free().                       \
                                       * If this flag is not set, the caller must provide a buffer to store the hash. */
#define CL_HASH_FLAG_FIPS_BYPASS 0x02 /* Use CL_HASH_FLAG_FIPS_BYPASS to bypass FIPS restrictions on which algorithms can be \
                                       * used. This is useful if you want to use algorithms that are not FIPS-approved.      \
                                       * For example, you might want to use this flag if you want to use "md5" or "sha1".    \
                                       * You should only do this when the hash is used for non-cryptographic purposes.       \
                                       * Note: If OpenSSL's FIPS provider is not available, this flag has no effect. */
 
extern cl_error_t cl_hash_data_ex(
    const char *alg,
    const uint8_t *data,
    size_t data_len,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);
 
struct cl_hash_ctx;
typedef struct cl_hash_ctx cl_hash_ctx_t;
 
extern cl_error_t cl_hash_init_ex(
    const char *alg,
    uint32_t flags,
    cl_hash_ctx_t **ctx_out);
 
extern cl_error_t cl_update_hash_ex(
    cl_hash_ctx_t *ctx,
    const uint8_t *data,
    size_t length);
 
extern cl_error_t cl_finish_hash_ex(
    cl_hash_ctx_t *ctx,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);
 
extern void cl_hash_destroy_ex(cl_hash_ctx_t *ctx);
 
extern cl_error_t cl_hash_file_fd_ex(
    const char *alg,
    int fd,
    size_t offset,
    size_t length,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);
 
extern unsigned char *cl_hash_data(const char *alg, const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
 
extern unsigned char *cl_hash_file_fd_ctx(EVP_MD_CTX *ctx, int fd, unsigned int *olen);
 
extern unsigned char *cl_hash_file_fd(int fd, const char *alg, unsigned int *olen);
 
extern unsigned char *cl_hash_file_fp(FILE *fp, const char *alg, unsigned int *olen);
 
extern unsigned char *cl_sha256(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
 
extern unsigned char *cl_sha384(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
 
extern unsigned char *cl_sha512(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
 
extern unsigned char *cl_sha1(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
 
extern void *cl_hash_init(const char *alg);
 
extern int cl_update_hash(void *ctx, const void *data, size_t sz);
 
extern int cl_finish_hash(void *ctx, void *buf);
 
extern void cl_hash_destroy(void *ctx);
 
/* -------------------------------------------------------------------------------
 * Signing and verification functions.
 */
 
extern int cl_verify_signature(
    EVP_PKEY *pkey,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *data,
    size_t datalen,
    int decode);
 
extern int cl_verify_signature_hash(
    EVP_PKEY *pkey,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *digest);
 
extern int cl_verify_signature_fd(
    EVP_PKEY *pkey,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    int fd);
 
extern int cl_verify_signature_hash_x509_keyfile(
    char *x509path,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *digest);
 
extern int cl_verify_signature_fd_x509_keyfile(
    char *x509path,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    int fd);
 
extern int cl_verify_signature_x509_keyfile(
    char *x509path,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *data,
    size_t datalen,
    int decode);
 
extern int cl_verify_signature_hash_x509(
    X509 *x509,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *digest);
 
extern int cl_verify_signature_fd_x509(X509 *x509, const char *alg, unsigned char *sig, unsigned int siglen, int fd);
 
extern int cl_verify_signature_x509(
    X509 *x509,
    const char *alg,
    unsigned char *sig,
    unsigned int siglen,
    unsigned char *data,
    size_t datalen,
    int decode);
 
extern X509 *cl_get_x509_from_mem(void *data, unsigned int len);
 
extern int cl_validate_certificate_chain_ts_dir(char *tsdir, char *certpath);
 
extern int cl_validate_certificate_chain(char **authorities, char *crlpath, char *certpath);
 
extern X509 *cl_load_cert(const char *certpath);
 
extern struct tm *cl_ASN1_GetTimeT(ASN1_TIME *timeobj);
 
extern X509_CRL *cl_load_crl(const char *timeobj);
 
extern unsigned char *cl_sign_data_keyfile(
    char *keypath,
    const char *alg,
    unsigned char *hash,
    unsigned int *olen,
    int encode);
 
extern unsigned char *cl_sign_data(EVP_PKEY *pkey, const char *alg, unsigned char *hash, unsigned int *olen, int encode);
 
extern unsigned char *cl_sign_file_fd(int fd, EVP_PKEY *pkey, const char *alg, unsigned int *olen, int encode);
 
extern unsigned char *cl_sign_file_fp(FILE *fp, EVP_PKEY *pkey, const char *alg, unsigned int *olen, int encode);
 
extern EVP_PKEY *cl_get_pkey_file(char *keypath);
 
#ifdef __cplusplus
}
#endif
 
#endif /* __CLAMAV_H */