ClamAV 1.5.3
ClamAV open source email, web, and end-point anti-virus toolkit.
Loading...
Searching...
No Matches
clamav.h
1/*
2 * Copyright (C) 2013-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
3 * Copyright (C) 2007-2013 Sourcefire, Inc.
4 *
5 * Authors: Tomasz Kojm
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
19 * MA 02110-1301, USA.
20 */
21
22#ifndef __CLAMAV_H
23#define __CLAMAV_H
24
25#ifdef _WIN32
26#ifndef OWN_WINSOCK
27#include <winsock2.h>
28#endif
29#endif
30
31#include <openssl/ssl.h>
32#include <openssl/err.h>
33
34/* Certain OSs already use 64bit variables in their stat struct */
35#if (!defined(__FreeBSD__) && !defined(__APPLE__))
36#define STAT64_OK 1
37#else
38#define STAT64_OK 0
39#endif
40
41#if defined(HAVE_STAT64) && STAT64_OK
42
43#include <unistd.h>
44
45#define STATBUF struct stat64
46#define CLAMSTAT stat64
47#define LSTAT lstat64
48#define FSTAT fstat64
49#define safe_open(a, b) open(a, b | O_LARGEFILE)
50
51#else
52
53#define STATBUF struct stat
54#define CLAMSTAT stat
55#define LSTAT lstat
56#define FSTAT fstat
57/* Nothing is safe in windows, not even open, safe_open defined under /win32 */
58#ifndef _WIN32
59#define safe_open open
60#endif
61
62#endif
63
64/* Apple does not define __pid_t */
65#ifdef __APPLE__
66typedef pid_t __pid_t;
67#endif
68
69#define UNUSEDPARAM(x) (void)(x)
70
71#include <sys/types.h>
72#include <sys/stat.h>
73#include <stdbool.h>
74
75#include "clamav-types.h"
76#include "clamav-version.h"
77
78#ifdef __cplusplus
79extern "C" {
80#endif
81
82#define CL_COUNT_PRECISION 4096
83
87typedef enum cl_verdict_t {
88 CL_VERDICT_NOTHING_FOUND = 0,
89 CL_VERDICT_TRUSTED,
90 CL_VERDICT_STRONG_INDICATOR,
91 CL_VERDICT_POTENTIALLY_UNWANTED,
92} cl_verdict_t;
93
97typedef enum cl_error_t {
98 /* libclamav specific */
99 CL_CLEAN = 0,
100 CL_SUCCESS = 0,
101 CL_VIRUS,
102 CL_ENULLARG,
103 CL_EARG,
104 CL_EMALFDB,
105 CL_ECVD,
106 CL_EVERIFY,
107 CL_EUNPACK,
108
109 /* I/O and memory errors */
110 CL_EOPEN,
111 CL_ECREAT,
112 CL_EUNLINK,
113 CL_ESTAT,
114 CL_EREAD,
115 CL_ESEEK,
116 CL_EWRITE,
117 CL_EDUP,
118 CL_EACCES,
119 CL_ETMPFILE,
120 CL_ETMPDIR,
121 CL_EMAP,
122 CL_EMEM,
123 CL_ETIMEOUT,
124
125 /* internal (not reported outside libclamav) */
126 CL_BREAK,
127 CL_EMAXREC,
128 CL_EMAXSIZE,
129 CL_EMAXFILES,
130 CL_EFORMAT,
131 CL_EPARSE,
132 CL_EBYTECODE,
133 CL_EBYTECODE_TESTFAIL,
134 CL_ELOCK,
135 CL_EBUSY,
136 CL_ESTATE,
137
138 CL_VERIFIED,
139 CL_ERROR,
140
141 /* no error codes below this line please */
142 CL_ELAST_ERROR
143} cl_error_t;
144
145/* db options */
146// clang-format off
147#define CL_DB_PHISHING 0x2
148#define CL_DB_PHISHING_URLS 0x8
149#define CL_DB_PUA 0x10
150#define CL_DB_CVDNOTMP 0x20
151#define CL_DB_OFFICIAL 0x40
152#define CL_DB_PUA_MODE 0x80
153#define CL_DB_PUA_INCLUDE 0x100
154#define CL_DB_PUA_EXCLUDE 0x200
155#define CL_DB_COMPILED 0x400
156#define CL_DB_DIRECTORY 0x800
157#define CL_DB_OFFICIAL_ONLY 0x1000
158#define CL_DB_BYTECODE 0x2000
159#define CL_DB_SIGNED 0x4000
160#define CL_DB_BYTECODE_UNSIGNED 0x8000
162#define CL_DB_UNSIGNED 0x10000
163#define CL_DB_BYTECODE_STATS 0x20000
164#define CL_DB_ENHANCED 0x40000
165#define CL_DB_PCRE_STATS 0x80000
166#define CL_DB_YARA_EXCLUDE 0x100000
167#define CL_DB_YARA_ONLY 0x200000
168#define CL_DB_FIPS_LIMITS 0x400000
171
172/* recommended db settings */
173#define CL_DB_STDOPT (CL_DB_PHISHING | CL_DB_PHISHING_URLS | CL_DB_BYTECODE)
174
175/*** scan options ***/
176struct cl_scan_options {
177 uint32_t general;
178 uint32_t parse;
179 uint32_t heuristic;
180 uint32_t mail;
181 uint32_t dev;
182};
183
184/* general */
185#define CL_SCAN_GENERAL_ALLMATCHES 0x1
186#define CL_SCAN_GENERAL_COLLECT_METADATA 0x2
187#define CL_SCAN_GENERAL_HEURISTICS 0x4
188#define CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE 0x8
189#define CL_SCAN_GENERAL_UNPRIVILEGED 0x10
190#define CL_SCAN_GENERAL_STORE_HTML_URIS 0x20
191#define CL_SCAN_GENERAL_STORE_PDF_URIS 0x40
192#define CL_SCAN_GENERAL_STORE_EXTRA_HASHES 0x80
193
194/* parsing capabilities options */
195#define CL_SCAN_PARSE_ARCHIVE 0x1
196#define CL_SCAN_PARSE_ELF 0x2
197#define CL_SCAN_PARSE_PDF 0x4
198#define CL_SCAN_PARSE_SWF 0x8
199#define CL_SCAN_PARSE_HWP3 0x10
200#define CL_SCAN_PARSE_XMLDOCS 0x20
201#define CL_SCAN_PARSE_MAIL 0x40
202#define CL_SCAN_PARSE_OLE2 0x80
203#define CL_SCAN_PARSE_HTML 0x100
204#define CL_SCAN_PARSE_PE 0x200
205#define CL_SCAN_PARSE_ONENOTE 0x400
206#define CL_SCAN_PARSE_IMAGE 0x800
207#define CL_SCAN_PARSE_IMAGE_FUZZY_HASH 0x1000
208
209/* heuristic alerting options */
210#define CL_SCAN_HEURISTIC_BROKEN 0x2
211#define CL_SCAN_HEURISTIC_EXCEEDS_MAX 0x4
212#define CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH 0x8
213#define CL_SCAN_HEURISTIC_PHISHING_CLOAK 0x10
214#define CL_SCAN_HEURISTIC_MACROS 0x20
215#define CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE 0x40
216#define CL_SCAN_HEURISTIC_ENCRYPTED_DOC 0x80
217#define CL_SCAN_HEURISTIC_PARTITION_INTXN 0x100
218#define CL_SCAN_HEURISTIC_STRUCTURED 0x200
219#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL 0x400
220#define CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED 0x800
221#define CL_SCAN_HEURISTIC_STRUCTURED_CC 0x1000
222#define CL_SCAN_HEURISTIC_BROKEN_MEDIA 0x2000
223
224/* mail scanning options */
225#define CL_SCAN_MAIL_PARTIAL_MESSAGE 0x1
226
227/* dev options */
228#define CL_SCAN_DEV_COLLECT_SHA 0x1
229#define CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO 0x2
230
231/* cl_countsigs options */
232#define CL_COUNTSIGS_OFFICIAL 0x1
233#define CL_COUNTSIGS_UNOFFICIAL 0x2
234#define CL_COUNTSIGS_ALL (CL_COUNTSIGS_OFFICIAL | CL_COUNTSIGS_UNOFFICIAL)
235
236/* For the new engine_options bit field in the engine */
237#define ENGINE_OPTIONS_NONE 0x0
238#define ENGINE_OPTIONS_DISABLE_CACHE 0x1
239#define ENGINE_OPTIONS_FORCE_TO_DISK 0x2
240#define ENGINE_OPTIONS_DISABLE_PE_STATS 0x4
241#define ENGINE_OPTIONS_DISABLE_PE_CERTS 0x8
242#define ENGINE_OPTIONS_PE_DUMPCERTS 0x10
243#define ENGINE_OPTIONS_TMPDIR_RECURSION 0x20
244#define ENGINE_OPTIONS_FIPS_LIMITS 0x40
245// clang-format on
246
247struct cl_engine;
248struct cl_settings;
249
250/* ----------------------------------------------------------------------------
251 * Enable global libclamav features.
252 */
253
257extern void cl_debug(void);
258
264extern void cl_always_gen_section_hash(void);
265
266/* ----------------------------------------------------------------------------
267 * Scan engine functions.
268 */
269
278int cl_initialize_crypto(void);
279
287void cl_cleanup_crypto(void);
288
289#define CL_INIT_DEFAULT 0x0
296extern cl_error_t cl_init(unsigned int initoptions);
297
305extern struct cl_engine *cl_engine_new(void);
306
307enum cl_engine_field {
308 CL_ENGINE_MAX_SCANSIZE,
309 CL_ENGINE_MAX_FILESIZE,
310 CL_ENGINE_MAX_RECURSION,
311 CL_ENGINE_MAX_FILES,
312 CL_ENGINE_MIN_CC_COUNT,
313 CL_ENGINE_MIN_SSN_COUNT,
314 CL_ENGINE_PUA_CATEGORIES,
315 CL_ENGINE_DB_OPTIONS,
316 CL_ENGINE_DB_VERSION,
317 CL_ENGINE_DB_TIME,
318 CL_ENGINE_AC_ONLY,
319 CL_ENGINE_AC_MINDEPTH,
320 CL_ENGINE_AC_MAXDEPTH,
321 CL_ENGINE_TMPDIR,
322 CL_ENGINE_KEEPTMP,
323 CL_ENGINE_BYTECODE_SECURITY,
324 CL_ENGINE_BYTECODE_TIMEOUT,
325 CL_ENGINE_BYTECODE_MODE,
326 CL_ENGINE_MAX_EMBEDDEDPE,
327 CL_ENGINE_MAX_HTMLNORMALIZE,
328 CL_ENGINE_MAX_HTMLNOTAGS,
329 CL_ENGINE_MAX_SCRIPTNORMALIZE,
330 CL_ENGINE_MAX_ZIPTYPERCG,
331 CL_ENGINE_FORCETODISK,
332 CL_ENGINE_CACHE_SIZE,
333 CL_ENGINE_DISABLE_CACHE,
334 CL_ENGINE_DISABLE_PE_STATS,
335 CL_ENGINE_STATS_TIMEOUT,
336 CL_ENGINE_MAX_PARTITIONS,
337 CL_ENGINE_MAX_ICONSPE,
338 CL_ENGINE_MAX_RECHWP3,
339 CL_ENGINE_MAX_SCANTIME,
340 CL_ENGINE_PCRE_MATCH_LIMIT,
341 CL_ENGINE_PCRE_RECMATCH_LIMIT,
342 CL_ENGINE_PCRE_MAX_FILESIZE,
343 CL_ENGINE_DISABLE_PE_CERTS,
344 CL_ENGINE_PE_DUMPCERTS,
345 CL_ENGINE_CVDCERTSDIR,
346 CL_ENGINE_TMPDIR_RECURSION,
347 CL_ENGINE_FIPS_LIMITS,
348};
349
350enum bytecode_security {
351 CL_BYTECODE_TRUST_ALL = 0,
352 CL_BYTECODE_TRUST_SIGNED,
353 CL_BYTECODE_TRUST_NOTHING
354};
355
356enum bytecode_mode {
357 CL_BYTECODE_MODE_AUTO = 0,
358 CL_BYTECODE_MODE_JIT,
359 CL_BYTECODE_MODE_INTERPRETER,
360 CL_BYTECODE_MODE_TEST,
361 CL_BYTECODE_MODE_OFF
362};
363
364struct cli_section_hash {
365 unsigned char md5[16];
366 size_t len;
367};
368
369typedef struct cli_stats_sections {
370 size_t nsections;
371 struct cli_section_hash *sections;
372} stats_section_t;
373
386extern cl_error_t cl_engine_set_num(struct cl_engine *engine, enum cl_engine_field field, long long num);
387
396extern long long cl_engine_get_num(const struct cl_engine *engine, enum cl_engine_field field, int *err);
397
414extern cl_error_t cl_engine_set_str(struct cl_engine *engine, enum cl_engine_field field, const char *str);
415
424extern const char *cl_engine_get_str(const struct cl_engine *engine, enum cl_engine_field field, int *err);
425
434extern struct cl_settings *cl_engine_settings_copy(const struct cl_engine *engine);
435
446extern cl_error_t cl_engine_settings_apply(struct cl_engine *engine, const struct cl_settings *settings);
447
455extern cl_error_t cl_engine_settings_free(struct cl_settings *settings);
456
467extern cl_error_t cl_engine_compile(struct cl_engine *engine);
468
481extern cl_error_t cl_engine_addref(struct cl_engine *engine);
482
493extern cl_error_t cl_engine_free(struct cl_engine *engine);
494
495/* ----------------------------------------------------------------------------
496 * ClamAV File Map Abstraction Public API.
497 */
498struct cl_fmap;
499typedef struct cl_fmap cl_fmap_t;
500
523typedef off_t (*clcb_pread)(void *handle, void *buf, size_t count, off_t offset);
524
549extern cl_fmap_t *cl_fmap_open_handle(
550 void *handle,
551 size_t offset,
552 size_t len,
553 clcb_pread pread_cb,
554 int use_aging);
555
569extern cl_fmap_t *cl_fmap_open_memory(const void *start, size_t len);
570
585extern cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name);
586
596extern cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out);
597
610extern cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path);
611
641extern cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, size_t *offset_out, size_t *len_out);
642
664extern cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t *offset_out, size_t *len_out);
665
677extern cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t *size_out);
678
691extern cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char *hash_alg, char hash);
692
704extern cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char *hash_alg, bool *have_hash_out);
705
720extern cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const char *hash_alg);
721
736extern cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char *hash_alg, char **hash_out);
737
756extern cl_error_t cl_fmap_get_data(
757 const cl_fmap_t *map,
758 size_t offset,
759 size_t len,
760 const uint8_t **data_out,
761 size_t *data_len_out);
762
771extern void cl_fmap_close(cl_fmap_t *);
772
773/* ----------------------------------------------------------------------------
774 * ClamAV Recursive Scan Layer Public API.
775 */
776struct cl_scan_layer;
777typedef struct cl_scan_layer cl_scan_layer_t;
778
786extern cl_error_t cl_scan_layer_get_fmap(
787 cl_scan_layer_t *layer,
788 cl_fmap_t **fmap_out);
789
803extern cl_error_t cl_scan_layer_get_parent_layer(
804 cl_scan_layer_t *layer,
805 cl_scan_layer_t **parent_layer_out);
806
819extern cl_error_t cl_scan_layer_get_type(
820 cl_scan_layer_t *layer,
821 const char **type_out);
822
830extern cl_error_t cl_scan_layer_get_recursion_level(
831 cl_scan_layer_t *layer,
832 uint32_t *recursion_level_out);
833
846extern cl_error_t cl_scan_layer_get_object_id(
847 cl_scan_layer_t *layer,
848 uint64_t *object_id_out);
849
860extern cl_error_t cl_scan_layer_get_last_alert(
861 cl_scan_layer_t *layer,
862 const char **alert_name_out);
863
864/*
865 * Attributes of each layer in scan.
866 */
867#define LAYER_ATTRIBUTES_NONE 0x0
868#define LAYER_ATTRIBUTES_NORMALIZED 0x1
869#define LAYER_ATTRIBUTES_DECRYPTED 0x2
871#define LAYER_ATTRIBUTES_RETYPED 0x4
872#define LAYER_ATTRIBUTES_EMBEDDED 0x8
874
882extern cl_error_t cl_scan_layer_get_attributes(
883 cl_scan_layer_t *layer,
884 uint32_t *attributes_out);
885
886/* ----------------------------------------------------------------------------
887 * Callback function type definitions.
888 */
889
890typedef enum scan_callback {
901 CL_SCAN_CALLBACK_PRE_HASH,
902
909 CL_SCAN_CALLBACK_PRE_SCAN,
910
919 CL_SCAN_CALLBACK_POST_SCAN,
920
927 CL_SCAN_CALLBACK_ALERT,
928
938 CL_SCAN_CALLBACK_FILE_TYPE
939} cl_scan_callback_t;
940
984typedef cl_error_t (*clcb_scan)(cl_scan_layer_t *layer, void *context);
996extern void cl_engine_set_scan_callback(struct cl_engine *engine, clcb_scan callback, cl_scan_callback_t location);
997
1015typedef cl_error_t (*clcb_pre_cache)(int fd, const char *type, void *context);
1027extern void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cache callback);
1028
1055typedef cl_error_t (*clcb_file_inspection)(
1056 int fd,
1057 const char *type,
1058 const char **ancestors,
1059 size_t parent_file_size,
1060 const char *file_name,
1061 size_t file_size,
1062 const char *file_buffer,
1063 uint32_t recursion_level,
1064 uint32_t layer_attributes,
1065 void *context);
1080extern void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, clcb_file_inspection callback);
1081
1099typedef cl_error_t (*clcb_pre_scan)(int fd, const char *type, void *context);
1109extern void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan callback);
1110
1130typedef cl_error_t (*clcb_post_scan)(int fd, int result, const char *virname, void *context);
1139extern void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);
1140
1158typedef void (*clcb_virus_found)(int fd, const char *virname, void *context);
1168extern void cl_engine_set_clcb_virus_found(struct cl_engine *engine, clcb_virus_found callback);
1169
1186typedef int (*clcb_sigload)(const char *type, const char *name, unsigned int custom, void *context);
1196extern void cl_engine_set_clcb_sigload(struct cl_engine *engine, clcb_sigload callback, void *context);
1197
1198enum cl_msg {
1199 /* leave room for more message levels in the future */
1200 CL_MSG_INFO_VERBOSE = 32, /* verbose */
1201 CL_MSG_WARN = 64, /* LibClamAV WARNING: */
1202 CL_MSG_ERROR = 128 /* LibClamAV ERROR: */
1203};
1204
1219typedef cl_error_t (*clcb_progress)(size_t total_items, size_t now_completed, void *context);
1220
1231extern void cl_engine_set_clcb_sigload_progress(struct cl_engine *engine, clcb_progress callback, void *context);
1232
1247extern void cl_engine_set_clcb_engine_compile_progress(struct cl_engine *engine, clcb_progress callback, void *context);
1248
1263extern void cl_engine_set_clcb_engine_free_progress(struct cl_engine *engine, clcb_progress callback, void *context);
1264
1288typedef void (*clcb_msg)(enum cl_msg severity, const char *fullmsg, const char *msg, void *context);
1294extern void cl_set_clcb_msg(clcb_msg callback);
1295
1312typedef void (*clcb_hash)(int fd, unsigned long long size, const char *md5, const char *virname, void *context);
1325extern void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback);
1326
1346typedef cl_error_t (*clcb_meta)(
1347 const char *container_type,
1348 unsigned long fsize_container,
1349 const char *filename,
1350 unsigned long fsize_real,
1351 int is_encrypted,
1352 unsigned int filepos_container,
1353 void *context);
1362extern void cl_engine_set_clcb_meta(struct cl_engine *engine, clcb_meta callback);
1363
1374typedef int (*clcb_file_props)(const char *j_propstr, int rc, void *cbdata);
1383extern void cl_engine_set_clcb_file_props(struct cl_engine *engine, clcb_file_props callback);
1384
1394typedef int (*clcb_generic_data)(const unsigned char *const data, const size_t data_len, void *cbdata);
1395
1404extern void cl_engine_set_clcb_vba(struct cl_engine *engine, clcb_generic_data callback);
1405
1406/* ----------------------------------------------------------------------------
1407 * Statistics/telemetry gathering callbacks.
1408 *
1409 * The statistics callback functions may be used to implement a telemetry
1410 * gathering feature.
1411 *
1412 * The structure definition for `cbdata` is entirely up to the caller, as are
1413 * the implementations of each of the callback functions defined below.
1414 */
1415
1427extern void cl_engine_set_stats_set_cbdata(struct cl_engine *engine, void *cbdata);
1428
1438typedef void (*clcb_stats_add_sample)(
1439 const char *virname,
1440 const unsigned char *md5,
1441 size_t size,
1442 stats_section_t *sections,
1443 void *cbdata);
1452extern void cl_engine_set_clcb_stats_add_sample(struct cl_engine *engine, clcb_stats_add_sample callback);
1453
1462typedef void (*clcb_stats_remove_sample)(const char *virname, const unsigned char *md5, size_t size, void *cbdata);
1471extern void cl_engine_set_clcb_stats_remove_sample(struct cl_engine *engine, clcb_stats_remove_sample callback);
1472
1481typedef void (*clcb_stats_decrement_count)(const char *virname, const unsigned char *md5, size_t size, void *cbdata);
1490extern void cl_engine_set_clcb_stats_decrement_count(struct cl_engine *engine, clcb_stats_decrement_count callback);
1491
1498typedef void (*clcb_stats_submit)(struct cl_engine *engine, void *cbdata);
1507extern void cl_engine_set_clcb_stats_submit(struct cl_engine *engine, clcb_stats_submit callback);
1508
1515typedef void (*clcb_stats_flush)(struct cl_engine *engine, void *cbdata);
1524extern void cl_engine_set_clcb_stats_flush(struct cl_engine *engine, clcb_stats_flush callback);
1525
1531typedef size_t (*clcb_stats_get_num)(void *cbdata);
1540extern void cl_engine_set_clcb_stats_get_num(struct cl_engine *engine, clcb_stats_get_num callback);
1541
1547typedef size_t (*clcb_stats_get_size)(void *cbdata);
1556extern void cl_engine_set_clcb_stats_get_size(struct cl_engine *engine, clcb_stats_get_size callback);
1557
1563typedef char *(*clcb_stats_get_hostid)(void *cbdata);
1572extern void cl_engine_set_clcb_stats_get_hostid(struct cl_engine *engine, clcb_stats_get_hostid callback);
1573
1579extern void cl_engine_stats_enable(struct cl_engine *engine);
1580
1581/* ----------------------------------------------------------------------------
1582 * File scanning.
1583 */
1584
1598extern cl_error_t cl_scandesc(
1599 int desc,
1600 const char *filename,
1601 const char **virname,
1602 unsigned long int *scanned,
1603 const struct cl_engine *engine,
1604 struct cl_scan_options *scanoptions);
1605
1624extern cl_error_t cl_scandesc_callback(
1625 int desc,
1626 const char *filename,
1627 const char **virname,
1628 unsigned long int *scanned,
1629 const struct cl_engine *engine,
1630 struct cl_scan_options *scanoptions,
1631 void *context);
1632
1675extern cl_error_t cl_scandesc_ex(
1676 int desc,
1677 const char *filename,
1678 cl_verdict_t *verdict_out,
1679 const char **last_alert_out,
1680 uint64_t *scanned_out,
1681 const struct cl_engine *engine,
1682 struct cl_scan_options *scanoptions,
1683 void *context,
1684 const char *hash_hint,
1685 char **hash_out,
1686 const char *hash_alg,
1687 const char *file_type_hint,
1688 char **file_type_out);
1689
1702extern cl_error_t cl_scanfile(
1703 const char *filename,
1704 const char **virname,
1705 unsigned long int *scanned,
1706 const struct cl_engine *engine,
1707 struct cl_scan_options *scanoptions);
1708
1726extern cl_error_t cl_scanfile_callback(
1727 const char *filename,
1728 const char **virname,
1729 unsigned long int *scanned,
1730 const struct cl_engine *engine,
1731 struct cl_scan_options *scanoptions,
1732 void *context);
1733
1775extern cl_error_t cl_scanfile_ex(
1776 const char *filename,
1777 cl_verdict_t *verdict_out,
1778 const char **last_alert_out,
1779 uint64_t *scanned_out,
1780 const struct cl_engine *engine,
1781 struct cl_scan_options *scanoptions,
1782 void *context,
1783 const char *hash_hint,
1784 char **hash_out,
1785 const char *hash_alg,
1786 const char *file_type_hint,
1787 char **file_type_out);
1788
1816extern cl_error_t cl_scanmap_callback(
1817 cl_fmap_t *map,
1818 const char *filename,
1819 const char **virname,
1820 unsigned long int *scanned,
1821 const struct cl_engine *engine,
1822 struct cl_scan_options *scanoptions,
1823 void *context);
1824
1873extern cl_error_t cl_scanmap_ex(
1874 cl_fmap_t *map,
1875 const char *filename,
1876 cl_verdict_t *verdict_out,
1877 const char **last_alert_out,
1878 uint64_t *scanned_out,
1879 const struct cl_engine *engine,
1880 struct cl_scan_options *scanoptions,
1881 void *context,
1882 const char *hash_hint,
1883 char **hash_out,
1884 const char *hash_alg,
1885 const char *file_type_hint,
1886 char **file_type_out);
1887
1888/* ----------------------------------------------------------------------------
1889 * Database handling.
1890 */
1891
1901extern cl_error_t cl_load(const char *path, struct cl_engine *engine, unsigned int *signo, unsigned int dboptions);
1902
1908extern const char *cl_retdbdir(void);
1909
1910/* ----------------------------------------------------------------------------
1911 * CVD / database functions
1912 */
1913
1914struct cl_cvd { /* field no. */
1915 char *time; /* 2 */
1916 unsigned int version; /* 3 */
1917 unsigned int sigs; /* 4 */
1918 unsigned int fl; /* 5 */
1919 /* padding */
1920 char *md5; /* 6 */
1921 char *dsig; /* 7 */
1922 char *builder; /* 8 */
1923 unsigned int stime; /* 9 */
1924};
1925
1934extern struct cl_cvd *cl_cvdhead(const char *file);
1935
1947extern struct cl_cvd *cl_cvdparse(const char *head);
1948
1957extern cl_error_t cl_cvdverify(const char *file);
1958
1971extern cl_error_t cl_cvdverify_ex(const char *file, const char *certs_directory, uint32_t dboptions);
1972
1978extern void cl_cvdfree(struct cl_cvd *cvd);
1979
1994extern cl_error_t cl_cvdunpack(const char *file, const char *dir, bool dont_verify);
1995
2009cl_error_t cl_cvdunpack_ex(const char *file, const char *dir, const char *certs_directory, uint32_t dboptions);
2010
2021extern cl_error_t cl_cvdgetage(const char *path, time_t *age_seconds);
2022
2023/* ----------------------------------------------------------------------------
2024 * DB directory stat functions.
2025 * Use these functions to watch for database changes.
2026 */
2027
2028struct cl_stat {
2029 char *dir;
2030 STATBUF *stattab;
2031 char **statdname;
2032 unsigned int entries;
2033};
2034
2044extern cl_error_t cl_statinidir(const char *dirname, struct cl_stat *dbstat);
2045
2053extern int cl_statchkdir(const struct cl_stat *dbstat);
2054
2062extern cl_error_t cl_statfree(struct cl_stat *dbstat);
2063
2072extern cl_error_t cl_countsigs(const char *path, unsigned int countoptions, unsigned int *sigs);
2073
2074/* ----------------------------------------------------------------------------
2075 * Software versions.
2076 */
2077
2083extern unsigned int cl_retflevel(void);
2084
2092extern const char *cl_retver(void);
2093
2094/* ----------------------------------------------------------------------------
2095 * Others.
2096 */
2097extern const char *cl_strerror(cl_error_t clerror);
2098
2099/* ----------------------------------------------------------------------------
2100 * Hashing functions.
2101 */
2102#define MD5_HASH_SIZE 16
2103#define SHA1_HASH_SIZE 20
2104#define SHA256_HASH_SIZE 32
2105#define SHA384_HASH_SIZE 48
2106#define SHA512_HASH_SIZE 64
2107
2108#define CL_HASH_FLAG_NONE 0x00 /* None */
2109#define CL_HASH_FLAG_ALLOCATE 0x01 /* Use CL_HASH_FLAG_ALLOCATE to dynamically allocate the output buffer. \
2110 * If this flag is set, the function will allocate a buffer for the hash and return it. \
2111 * The caller is responsible for freeing the buffer using free(). \
2112 * If this flag is not set, the caller must provide a buffer to store the hash. */
2113#define CL_HASH_FLAG_FIPS_BYPASS 0x02 /* Use CL_HASH_FLAG_FIPS_BYPASS to bypass FIPS restrictions on which algorithms can be \
2114 * used. This is useful if you want to use algorithms that are not FIPS-approved. \
2115 * For example, you might want to use this flag if you want to use "md5" or "sha1". \
2116 * You should only do this when the hash is used for non-cryptographic purposes. \
2117 * Note: If OpenSSL's FIPS provider is not available, this flag has no effect. */
2118
2141extern cl_error_t cl_hash_data_ex(
2142 const char *alg,
2143 const uint8_t *data,
2144 size_t data_len,
2145 uint8_t **hash,
2146 size_t *hash_len,
2147 uint32_t flags);
2148
2149struct cl_hash_ctx;
2150typedef struct cl_hash_ctx cl_hash_ctx_t;
2151
2160extern cl_error_t cl_hash_init_ex(
2161 const char *alg,
2162 uint32_t flags,
2163 cl_hash_ctx_t **ctx_out);
2164
2174extern cl_error_t cl_update_hash_ex(
2175 cl_hash_ctx_t *ctx,
2176 const uint8_t *data,
2177 size_t length);
2178
2193extern cl_error_t cl_finish_hash_ex(
2194 cl_hash_ctx_t *ctx,
2195 uint8_t **hash,
2196 size_t *hash_len,
2197 uint32_t flags);
2198
2204extern void cl_hash_destroy_ex(cl_hash_ctx_t *ctx);
2205
2222extern cl_error_t cl_hash_file_fd_ex(
2223 const char *alg,
2224 int fd,
2225 size_t offset,
2226 size_t length,
2227 uint8_t **hash,
2228 size_t *hash_len,
2229 uint32_t flags);
2230
2249extern unsigned char *cl_hash_data(const char *alg, const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
2250
2262extern unsigned char *cl_hash_file_fd_ctx(EVP_MD_CTX *ctx, int fd, unsigned int *olen);
2263
2278extern unsigned char *cl_hash_file_fd(int fd, const char *alg, unsigned int *olen);
2279
2294extern unsigned char *cl_hash_file_fp(FILE *fp, const char *alg, unsigned int *olen);
2295
2308extern unsigned char *cl_sha256(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
2309
2322extern unsigned char *cl_sha384(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
2323
2336extern unsigned char *cl_sha512(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
2337
2353extern unsigned char *cl_sha1(const void *buf, size_t len, unsigned char *obuf, unsigned int *olen);
2354
2367extern void *cl_hash_init(const char *alg);
2368
2380extern int cl_update_hash(void *ctx, const void *data, size_t sz);
2381
2392extern int cl_finish_hash(void *ctx, void *buf);
2393
2402extern void cl_hash_destroy(void *ctx);
2403
2404/* -------------------------------------------------------------------------------
2405 * Signing and verification functions.
2406 */
2407
2420extern int cl_verify_signature(
2421 EVP_PKEY *pkey,
2422 const char *alg,
2423 unsigned char *sig,
2424 unsigned int siglen,
2425 unsigned char *data,
2426 size_t datalen,
2427 int decode);
2428
2439extern int cl_verify_signature_hash(
2440 EVP_PKEY *pkey,
2441 const char *alg,
2442 unsigned char *sig,
2443 unsigned int siglen,
2444 unsigned char *digest);
2445
2456extern int cl_verify_signature_fd(
2457 EVP_PKEY *pkey,
2458 const char *alg,
2459 unsigned char *sig,
2460 unsigned int siglen,
2461 int fd);
2462
2473extern int cl_verify_signature_hash_x509_keyfile(
2474 char *x509path,
2475 const char *alg,
2476 unsigned char *sig,
2477 unsigned int siglen,
2478 unsigned char *digest);
2479
2490extern int cl_verify_signature_fd_x509_keyfile(
2491 char *x509path,
2492 const char *alg,
2493 unsigned char *sig,
2494 unsigned int siglen,
2495 int fd);
2496
2509extern int cl_verify_signature_x509_keyfile(
2510 char *x509path,
2511 const char *alg,
2512 unsigned char *sig,
2513 unsigned int siglen,
2514 unsigned char *data,
2515 size_t datalen,
2516 int decode);
2517
2528extern int cl_verify_signature_hash_x509(
2529 X509 *x509,
2530 const char *alg,
2531 unsigned char *sig,
2532 unsigned int siglen,
2533 unsigned char *digest);
2534
2545extern int cl_verify_signature_fd_x509(X509 *x509, const char *alg, unsigned char *sig, unsigned int siglen, int fd);
2546
2559extern int cl_verify_signature_x509(
2560 X509 *x509,
2561 const char *alg,
2562 unsigned char *sig,
2563 unsigned int siglen,
2564 unsigned char *data,
2565 size_t datalen,
2566 int decode);
2567
2575extern X509 *cl_get_x509_from_mem(void *data, unsigned int len);
2576
2584extern int cl_validate_certificate_chain_ts_dir(char *tsdir, char *certpath);
2585
2594extern int cl_validate_certificate_chain(char **authorities, char *crlpath, char *certpath);
2595
2601extern X509 *cl_load_cert(const char *certpath);
2602
2609extern struct tm *cl_ASN1_GetTimeT(ASN1_TIME *timeobj);
2610
2617extern X509_CRL *cl_load_crl(const char *timeobj);
2618
2629extern unsigned char *cl_sign_data_keyfile(
2630 char *keypath,
2631 const char *alg,
2632 unsigned char *hash,
2633 unsigned int *olen,
2634 int encode);
2635
2646extern unsigned char *cl_sign_data(EVP_PKEY *pkey, const char *alg, unsigned char *hash, unsigned int *olen, int encode);
2647
2658extern unsigned char *cl_sign_file_fd(int fd, EVP_PKEY *pkey, const char *alg, unsigned int *olen, int encode);
2659
2670extern unsigned char *cl_sign_file_fp(FILE *fp, EVP_PKEY *pkey, const char *alg, unsigned int *olen, int encode);
2671
2678extern EVP_PKEY *cl_get_pkey_file(char *keypath);
2679
2680#ifdef __cplusplus
2681}
2682#endif
2683
2684#endif /* __CLAMAV_H */
cl_cvd
Definition clamav.h:1911
cl_scan_options
Definition clamav.h:173
cl_stat
Definition clamav.h:2025
cli_section_hash
Definition clamav.h:361
cli_stats_sections
Definition clamav.h:366