-
Notifications
You must be signed in to change notification settings - Fork 13
/
Copy pathdefine.go
200 lines (178 loc) · 9.79 KB
/
define.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
package goclamav
/*
#include <clamav.h>
#include <stdlib.h>
*/
import "C"
import "errors"
// ErrorCode models ClamAV errors
type ErrorCode C.cl_error_t
// scan options
type SCAN_OPTIONS struct {
General uint
Parse uint
Heuristic uint
Mail uint
Dev uint
}
const (
/* general */
CL_SCAN_GENERAL_ALLMATCHES = 0x1 /* scan in all-match mode */
CL_SCAN_GENERAL_COLLECT_METADATA = 0x2 /* collect metadata (--gen-json) */
CL_SCAN_GENERAL_HEURISTICS = 0x4 /* option to enable heuristic alerts */
CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE = 0x8 /* allow heuristic match to take precedence. */
CL_SCAN_GENERAL_UNPRIVILEGED = 0x10 /* scanner will not have read access to files. */
/* parsing capabilities options */
CL_SCAN_PARSE_ARCHIVE = 0x1
CL_SCAN_PARSE_ELF = 0x2
CL_SCAN_PARSE_PDF = 0x4
CL_SCAN_PARSE_SWF = 0x8
CL_SCAN_PARSE_HWP3 = 0x10
CL_SCAN_PARSE_XMLDOCS = 0x20
CL_SCAN_PARSE_MAIL = 0x40
CL_SCAN_PARSE_OLE2 = 0x80
CL_SCAN_PARSE_HTML = 0x100
CL_SCAN_PARSE_PE = 0x200
/* heuristic alerting options */
CL_SCAN_HEURISTIC_BROKEN = 0x2 /* alert on broken PE and broken ELF files */
CL_SCAN_HEURISTIC_EXCEEDS_MAX = 0x4 /* alert when files exceed scan limits (filesize, max scansize, or max recursion depth) */
CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH = 0x8 /* alert on SSL mismatches */
CL_SCAN_HEURISTIC_PHISHING_CLOAK = 0x10 /* alert on cloaked URLs in emails */
CL_SCAN_HEURISTIC_MACROS = 0x20 /* alert on OLE2 files containing macros */
CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE = 0x40 /* alert if archive is encrypted (rar, zip, etc) */
CL_SCAN_HEURISTIC_ENCRYPTED_DOC = 0x80 /* alert if a document is encrypted (pdf, docx, etc) */
CL_SCAN_HEURISTIC_PARTITION_INTXN = 0x100 /* alert if partition table size doesn't make sense */
CL_SCAN_HEURISTIC_STRUCTURED = 0x200 /* data loss prevention options, i.e. alert when detecting personal information */
CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL = 0x400 /* alert when detecting social security numbers */
CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED = 0x800 /* alert when detecting stripped social security numbers */
CL_SCAN_HEURISTIC_STRUCTURED_CC = 0x1000 /* alert when detecting credit card numbers */
CL_SCAN_HEURISTIC_BROKEN_MEDIA = 0x2000 /* alert if a file does not match the identified file format, works with JPEG, TIFF, GIF, PNG */
/* mail scanning options */
CL_SCAN_MAIL_PARTIAL_MESSAGE = 0x1
/* dev options */
CL_SCAN_DEV_COLLECT_SHA = 0x1 /* Enables hash output in sha-collect builds - for internal use only */
CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO = 0x2 /* collect performance timings */
/* cl_countsigs options */
CL_COUNTSIGS_OFFICIAL = 0x1
CL_COUNTSIGS_UNOFFICIAL = 0x2
CL_COUNTSIGS_ALL = (CL_COUNTSIGS_OFFICIAL | CL_COUNTSIGS_UNOFFICIAL)
)
// Fmap models in-memory files
type Fmap C.cl_fmap_t
const (
/* libclamav specific */
CL_CLEAN ErrorCode = C.CL_CLEAN
CL_SUCCESS ErrorCode = C.CL_SUCCESS
CL_VIRUS ErrorCode = C.CL_VIRUS
CL_ENULLARG ErrorCode = C.CL_ENULLARG
CL_EARG ErrorCode = C.CL_EARG
CL_EMALFDB ErrorCode = C.CL_EMALFDB
CL_ECVD ErrorCode = C.CL_ECVD
CL_EVERIFY ErrorCode = C.CL_EVERIFY
CL_EUNPACK ErrorCode = C.CL_EUNPACK
/* I/O and memory errors */
CL_EOPEN ErrorCode = C.CL_EOPEN
CL_ECREAT ErrorCode = C.CL_ECREAT
CL_EUNLINK ErrorCode = C.CL_EUNLINK
CL_ESTAT ErrorCode = C.CL_ESTAT
CL_EREAD ErrorCode = C.CL_EREAD
CL_ESEEK ErrorCode = C.CL_ESEEK
CL_EWRITE ErrorCode = C.CL_EWRITE
CL_EDUP ErrorCode = C.CL_EDUP
CL_EACCES ErrorCode = C.CL_EACCES
CL_ETMPFILE ErrorCode = C.CL_ETMPFILE
CL_ETMPDIR ErrorCode = C.CL_ETMPDIR
CL_EMAP ErrorCode = C.CL_EMAP
CL_EMEM ErrorCode = C.CL_EMEM
CL_ETIMEOUT ErrorCode = C.CL_ETIMEOUT
/* internal (not reported outside libclamav) */
CL_BREAK ErrorCode = C.CL_BREAK
CL_EMAXREC ErrorCode = C.CL_EMAXREC
CL_EMAXSIZE ErrorCode = C.CL_EMAXSIZE
CL_EMAXFILES ErrorCode = C.CL_EMAXFILES
CL_EFORMAT ErrorCode = C.CL_EFORMAT
CL_EPARSE ErrorCode = C.CL_EPARSE
CL_EBYTECODE ErrorCode = C.CL_EBYTECODE /* may be reported in testmode */
CL_EBYTECODE_TESTFAIL ErrorCode = C.CL_EBYTECODE_TESTFAIL /* may be reported in testmode */
/* c4w error codes */
CL_ELOCK ErrorCode = C.CL_ELOCK
CL_EBUSY ErrorCode = C.CL_EBUSY
CL_ESTATE ErrorCode = C.CL_ESTATE
CL_VERIFIED ErrorCode = C.CL_VERIFIED /* The binary has been deemed trusted */
CL_ERROR ErrorCode = C.CL_ERROR /* Unspecified / generic error */
/* no error codes below this line please */
CL_ELAST_ERROR ErrorCode = C.CL_ELAST_ERROR
)
// CL_INIT_DEFAULT is a macro that can be passed to cl_init() representing the default initialization settings
const CL_INIT_DEFAULT C.uint = C.CL_INIT_DEFAULT
// Wraps the corresponding error message
func Strerr(code ErrorCode) error {
err := errors.New(C.GoString(C.cl_strerror(C.cl_error_t(code))))
return err
}
/* db options */
// clang-format off
type DBOptions uint
const (
CL_DB_PHISHING DBOptions = C.CL_DB_PHISHING
CL_DB_PHISHING_URLS DBOptions = C.CL_DB_PHISHING_URLS
CL_DB_PUA DBOptions = C.CL_DB_PUA
CL_DB_CVDNOTMP DBOptions = C.CL_DB_CVDNOTMP /* obsolete */
CL_DB_OFFICIAL DBOptions = C.CL_DB_OFFICIAL /* internal */
CL_DB_PUA_MODE DBOptions = C.CL_DB_PUA_MODE
CL_DB_PUA_INCLUDE DBOptions = C.CL_DB_PUA_INCLUDE
CL_DB_PUA_EXCLUDE DBOptions = C.CL_DB_PUA_EXCLUDE
CL_DB_COMPILED DBOptions = C.CL_DB_COMPILED /* internal */
CL_DB_DIRECTORY DBOptions = C.CL_DB_DIRECTORY /* internal */
CL_DB_OFFICIAL_ONLY DBOptions = C.CL_DB_OFFICIAL_ONLY
CL_DB_BYTECODE DBOptions = C.CL_DB_BYTECODE
CL_DB_SIGNED DBOptions = C.CL_DB_SIGNED /* internal */
CL_DB_BYTECODE_UNSIGNED DBOptions = C.CL_DB_BYTECODE_UNSIGNED /* Caution: You should never run bytecode signatures from untrusted sources. Doing so may result in arbitrary code execution. */
CL_DB_UNSIGNED DBOptions = C.CL_DB_UNSIGNED /* internal */
CL_DB_BYTECODE_STATS DBOptions = C.CL_DB_BYTECODE_STATS
CL_DB_ENHANCED DBOptions = C.CL_DB_ENHANCED
CL_DB_PCRE_STATS DBOptions = C.CL_DB_PCRE_STATS
CL_DB_YARA_EXCLUDE DBOptions = C.CL_DB_YARA_EXCLUDE
CL_DB_YARA_ONLY DBOptions = C.CL_DB_YARA_ONLY
)
// EngineField selects a particular engine settings field
type EngineField C.enum_cl_engine_field
// Engine settings
const (
CL_ENGINE_MAX_SCANSIZE EngineField = C.CL_ENGINE_MAX_SCANSIZE /* uint64_t */
CL_ENGINE_MAX_FILESIZE EngineField = C.CL_ENGINE_MAX_FILESIZE /* uint64_t */
CL_ENGINE_MAX_RECURSION EngineField = C.CL_ENGINE_MAX_RECURSION /* uint32_t */
CL_ENGINE_MAX_FILES EngineField = C.CL_ENGINE_MAX_FILES /* uint32_t */
CL_ENGINE_MIN_CC_COUNT EngineField = C.CL_ENGINE_MIN_CC_COUNT /* uint32_t */
CL_ENGINE_MIN_SSN_COUNT EngineField = C.CL_ENGINE_MIN_SSN_COUNT /* uint32_t */
CL_ENGINE_PUA_CATEGORIES EngineField = C.CL_ENGINE_PUA_CATEGORIES /* (char *) */
CL_ENGINE_DB_OPTIONS EngineField = C.CL_ENGINE_DB_OPTIONS /* uint32_t */
CL_ENGINE_DB_VERSION EngineField = C.CL_ENGINE_DB_VERSION /* uint32_t */
CL_ENGINE_DB_TIME EngineField = C.CL_ENGINE_DB_TIME /* time_t */
CL_ENGINE_AC_ONLY EngineField = C.CL_ENGINE_AC_ONLY /* uint32_t */
CL_ENGINE_AC_MINDEPTH EngineField = C.CL_ENGINE_AC_MINDEPTH /* uint32_t */
CL_ENGINE_AC_MAXDEPTH EngineField = C.CL_ENGINE_AC_MAXDEPTH /* uint32_t */
CL_ENGINE_TMPDIR EngineField = C.CL_ENGINE_TMPDIR /* (char *) */
CL_ENGINE_KEEPTMP EngineField = C.CL_ENGINE_KEEPTMP /* uint32_t */
CL_ENGINE_BYTECODE_SECURITY EngineField = C.CL_ENGINE_BYTECODE_SECURITY /* uint32_t */
CL_ENGINE_BYTECODE_TIMEOUT EngineField = C.CL_ENGINE_BYTECODE_TIMEOUT /* uint32_t */
CL_ENGINE_BYTECODE_MODE EngineField = C.CL_ENGINE_BYTECODE_MODE /* uint32_t */
CL_ENGINE_MAX_EMBEDDEDPE EngineField = C.CL_ENGINE_MAX_EMBEDDEDPE /* uint64_t */
CL_ENGINE_MAX_HTMLNORMALIZE EngineField = C.CL_ENGINE_MAX_HTMLNORMALIZE /* uint64_t */
CL_ENGINE_MAX_HTMLNOTAGS EngineField = C.CL_ENGINE_MAX_HTMLNOTAGS /* uint64_t */
CL_ENGINE_MAX_SCRIPTNORMALIZE EngineField = C.CL_ENGINE_MAX_SCRIPTNORMALIZE /* uint64_t */
CL_ENGINE_MAX_ZIPTYPERCG EngineField = C.CL_ENGINE_MAX_ZIPTYPERCG /* uint64_t */
CL_ENGINE_FORCETODISK EngineField = C.CL_ENGINE_FORCETODISK /* uint32_t */
CL_ENGINE_DISABLE_CACHE EngineField = C.CL_ENGINE_DISABLE_CACHE /* uint32_t */
CL_ENGINE_DISABLE_PE_STATS EngineField = C.CL_ENGINE_DISABLE_PE_STATS /* uint32_t */
CL_ENGINE_STATS_TIMEOUT EngineField = C.CL_ENGINE_STATS_TIMEOUT /* uint32_t */
CL_ENGINE_MAX_PARTITIONS EngineField = C.CL_ENGINE_MAX_PARTITIONS /* uint32_t */
CL_ENGINE_MAX_ICONSPE EngineField = C.CL_ENGINE_MAX_ICONSPE /* uint32_t */
CL_ENGINE_MAX_RECHWP3 EngineField = C.CL_ENGINE_MAX_RECHWP3 /* uint32_t */
CL_ENGINE_MAX_SCANTIME EngineField = C.CL_ENGINE_MAX_SCANTIME /* uint32_t */
CL_ENGINE_PCRE_MATCH_LIMIT EngineField = C.CL_ENGINE_PCRE_MATCH_LIMIT /* uint64_t */
CL_ENGINE_PCRE_RECMATCH_LIMIT EngineField = C.CL_ENGINE_PCRE_RECMATCH_LIMIT /* uint64_t */
CL_ENGINE_PCRE_MAX_FILESIZE EngineField = C.CL_ENGINE_PCRE_MAX_FILESIZE /* uint64_t */
CL_ENGINE_DISABLE_PE_CERTS EngineField = C.CL_ENGINE_DISABLE_PE_CERTS /* uint32_t */
CL_ENGINE_PE_DUMPCERTS EngineField = C.CL_ENGINE_PE_DUMPCERTS /* uint32_t */
)