clamav/libclamav/fmap.h

279 lines
8.9 KiB
C
Raw Normal View History

2009-08-20 01:34:03 +02:00
/*
2020-01-03 15:44:07 -05:00
* Copyright (C) 2013-2020 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2009-2013 Sourcefire, Inc.
2009-08-20 01:34:03 +02:00
*
* Authors: aCaB <acab@clamav.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
2009-08-20 02:19:57 +02:00
#ifndef __FMAP_H
#define __FMAP_H
2009-08-20 01:34:03 +02:00
2011-12-16 12:00:12 +01:00
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#include <limits.h>
2009-12-11 21:12:38 +02:00
#include <time.h>
#include <string.h>
#include "clamav.h"
2009-08-31 04:41:06 +02:00
struct cl_fmap;
typedef cl_fmap_t fmap_t;
struct cl_fmap {
/* handle interface */
void *handle;
clcb_pread pread_cb;
/* internal */
2009-08-31 04:41:06 +02:00
time_t mtime;
unsigned int pages;
uint64_t pgsz;
2009-08-31 04:41:06 +02:00
unsigned int paged;
unsigned short aging;
unsigned short dont_cache_flag;
unsigned short handle_is_fd;
/* memory interface */
const void *data;
/* common interface */
size_t offset; /* file offset */
size_t nested_offset; /* buffer offset for nested scan*/
size_t real_len; /* amount of data mapped from file, starting at offset */
size_t len; /* length of data accessible via current fmap */
/* real_len = nested_offset + len
* file_offset = offset + nested_offset + need_offset
* maximum offset, length accessible via fmap API: len
* offset in cached buffer: nested_offset + need_offset
*
* This allows scanning a portion of an already mapped file without dumping
* to disk and remapping (for uncompressed archives for example) */
/* vtable for implementation */
void (*unmap)(fmap_t *);
const void *(*need)(fmap_t *, size_t at, size_t len, int lock);
const void *(*need_offstr)(fmap_t *, size_t at, size_t len_hint);
const void *(*gets)(fmap_t *, char *dst, size_t *at, size_t max_len);
void (*unneed_off)(fmap_t *, size_t at, size_t len);
2009-10-10 20:46:05 +02:00
#ifdef _WIN32
2009-10-10 19:10:15 +02:00
HANDLE fh;
HANDLE mh;
2009-09-10 03:19:43 +02:00
#endif
unsigned char maphash[16];
uint32_t *bitmap;
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
char *name;
};
2009-08-20 01:34:03 +02:00
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
/**
* @brief Create a new fmap given a file descriptor.
*
* @param fd File descriptor of file to be mapped.
* @param offset Offset into file for start of map.
* @param len Length from offset for size of map.
* @param name (optional) Original name of the file (to set fmap name metadata)
* @return fmap_t* The newly created fmap. Free it with `funmap()`
*/
fmap_t *fmap(int fd, off_t offset, size_t len, const char *name);
/**
* @brief Create new fmap given a file descriptor.
*
* This variant of fmap() provides a boolean output variable to indicate on
* failure if the failure was because the file is empty (not really a failure).
*
* @param fd File descriptor of file to be mapped.
* @param offset Offset into file for start of map.
* @param len Length from offset for size of map.
* @param empty [out] Boolean will be non-zero if the file couldn't be mapped because it is empty.
* @param name (optional) Original name of the file (to set fmap name metadata)
* @return fmap_t* The newly created fmap. Free it with `funmap()`
*/
fmap_t *fmap_check_empty(int fd, off_t offset, size_t len, int *empty, const char *name);
/**
* @brief Create a new fmap given a buffer.
*
* @param start Start of a buffer that the fmap will reference.
* @param len Length of the buffer.
* @param name (optional) Original name of the file (to set fmap name metadata)
* @return fmap_t*
*/
fmap_t *fmap_open_memory(const void *start, size_t len, const char *name);
/**
* @brief Create a new fmap view into another fmap.
*
* @param map The parent fmap.
* @param offset Offset for the start of the new fmap into the parent fmap.
* @param length Length of the data from the offset for the new fmap.
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
* @param name (optional) Original name of the file (to set fmap name metadata)
* @return fmap_t* NULL if failure or a special fmap that the caller must free with free_duplicate_fmap()
*/
fmap_t *fmap_duplicate(cl_fmap_t *map, off_t offset, size_t length, const char *name);
/**
* @brief Deallocate a _duplicated_ fmap. Does not unmap the mapped region.
*
* This function should be used instead of `free()` to cleanup the optional fmap name.
*
* @param m The map to be free'd.
*/
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
void free_duplicate_fmap(cl_fmap_t *map);
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
/**
* @brief Unmap/deallocate an fmap.
*
* @param m The map to be free'd.
*/
static inline void funmap(fmap_t *m)
{
m->unmap(m);
}
static inline const void *fmap_need_off(fmap_t *m, size_t at, size_t len)
{
return m->need(m, at, len, 1);
}
static inline const void *fmap_need_off_once(fmap_t *m, size_t at, size_t len)
{
return m->need(m, at, len, 0);
}
2011-06-14 22:54:44 +03:00
static inline size_t fmap_ptr2off(const fmap_t *m, const void *ptr)
{
Record names of extracted files A way is needed to record scanned file names for two purposes: 1. File names (and extensions) must be stored in the json metadata properties recorded when using the --gen-json clamscan option. Future work may use this to compare file extensions with detected file types. 2. File names are useful when interpretting tmp directory output when using the --leave-temps option. This commit enables file name retention for later use by storing file names in the fmap header structure, if a file name exists. To store the names in fmaps, an optional name argument has been added to any internal scan API's that create fmaps and every call to these APIs has been modified to pass a file name or NULL if a file name is not required. The zip and gpt parsers required some modification to record file names. The NSIS and XAR parsers fail to collect file names at all and will require future work to support file name extraction. Also: - Added recursive extraction to the tmp directory when the --leave-temps option is enabled. When not enabled, the tmp directory structure remains flat so as to prevent the likelihood of exceeding MAX_PATH. The current tmp directory is stored in the scan context. - Made the cli_scanfile() internal API non-static and added it to scanners.h so it would be accessible outside of scanners.c in order to remove code duplication within libmspack.c. - Added function comments to scanners.h and matcher.h - Converted a TDB-type macros and LSIG-type macros to enums for improved type safey. - Converted more return status variables from `int` to `cl_error_t` for improved type safety, and corrected ooxml file typing functions so they use `cli_file_t` exclusively rather than mixing types with `cl_error_t`. - Restructured the magic_scandesc() function to use goto's for error handling and removed the early_ret_from_magicscan() macro and magic_scandesc_cleanup() function. This makes the code easier to read and made it easier to add the recursive tmp directory cleanup to magic_scandesc(). - Corrected zip, egg, rar filename extraction issues. - Removed use of extra sub-directory layer for zip, egg, and rar file extraction. For Zip, this also involved changing the extracted filenames to be randomly generated rather than using the "zip.###" file name scheme.
2020-03-19 21:23:54 -04:00
return (size_t)((const char *)ptr - (const char *)m->data) - m->nested_offset;
2011-06-14 22:54:44 +03:00
}
2012-01-05 14:16:09 +02:00
static inline const void *fmap_need_ptr(fmap_t *m, const void *ptr, size_t len)
{
2011-06-14 22:54:44 +03:00
return m->need(m, fmap_ptr2off(m, ptr), len, 1);
}
2012-01-05 14:16:09 +02:00
static inline const void *fmap_need_ptr_once(fmap_t *m, const void *ptr, size_t len)
{
2011-06-14 22:54:44 +03:00
return m->need(m, fmap_ptr2off(m, ptr), len, 0);
}
static inline void fmap_unneed_off(fmap_t *m, size_t at, size_t len)
{
m->unneed_off(m, at, len);
}
2012-01-05 14:16:09 +02:00
static inline void fmap_unneed_ptr(fmap_t *m, const void *ptr, size_t len)
{
2011-06-14 22:54:44 +03:00
fmap_unneed_off(m, fmap_ptr2off(m, ptr), len);
}
/**
* @brief Read bytes from fmap at offset into destinatio buffer.
*
* @param m fmap
* @param dst destination buffer
* @param at offset into fmap
* @param len # of bytes to read
* @return size_t # of bytes read
* @return size_t (size_t)-1 if error
*/
static inline size_t fmap_readn(fmap_t *m, void *dst, size_t at, size_t len)
{
const void *src;
if (at == m->len || !len)
return 0;
if (at > m->len)
return (size_t)-1;
if (len > m->len - at)
len = m->len - at;
src = fmap_need_off_once(m, at, len);
if (!src)
return (size_t)-1;
memcpy(dst, src, len);
return (len <= INT_MAX) ? len : (size_t)-1;
}
2012-01-05 14:16:09 +02:00
static inline const void *fmap_need_str(fmap_t *m, const void *ptr, size_t len_hint)
{
2011-06-14 22:54:44 +03:00
return m->need_offstr(m, fmap_ptr2off(m, ptr), len_hint);
}
static inline const void *fmap_need_offstr(fmap_t *m, size_t at, size_t len_hint)
{
return m->need_offstr(m, at, len_hint);
}
static inline const void *fmap_gets(fmap_t *m, char *dst, size_t *at, size_t max_len)
{
return m->gets(m, dst, at, max_len);
}
2011-06-10 17:02:10 +03:00
static inline const void *fmap_need_off_once_len(fmap_t *m, size_t at, size_t len, size_t *lenout)
{
2011-06-13 11:55:34 +03:00
const void *p;
if (at >= m->len) {
*lenout = 0;
return NULL; /* EOF, not read error */
2011-06-10 17:02:10 +03:00
}
if (len > m->len - at)
len = m->len - at;
p = fmap_need_off_once(m, at, len);
*lenout = p ? len : 0;
2011-06-13 11:55:34 +03:00
return p;
2011-06-10 17:02:10 +03:00
}
static inline const void *fmap_need_ptr_once_len(fmap_t *m, const void *ptr, size_t len, size_t *lenout)
{
2011-06-14 22:54:44 +03:00
return fmap_need_off_once_len(m, fmap_ptr2off(m, ptr), len, lenout);
2011-06-10 17:02:10 +03:00
}
/**
* @brief Dump a specified range of data from an fmap to a new temp file.
*
* @param map The file map in question
* @param filepath (Optional) The full filepath of the file being dumped.
* @param tmpdir The directory to drop the file to.
* @param outname The filename chosen for the temp file.
* @param outfd The file descriptor of the new file, open and seeked to the start of the file.
* @param start_offset The start offset of the data that you wish to write to the temp file. Must be less than the length of the fmap and must be less than end_offset.
* @param end_offset The end offset of the data you wish to write to the temp file. May be larger than the size of the fmap. Use SIZE_MAX to write the entire fmap.
* @return cl_error_t CL_SUCCESS on success, else CL_EARG, CL_EWRITE, CL_ECREAT, or CL_EMEM for self-explanatory reasons.
*/
cl_error_t fmap_dump_to_file(fmap_t *map, const char *filepath, const char *tmpdir, char **outname, int *outfd, size_t start_offset, size_t end_offset);
/* deprecated */
/**
* @brief Return the open file desciptor for the fmap (if available).
*
* This function will only provide the file descriptor if the fmap handle is set,
* and if the handle is in fact a file descriptor (handle_is_fd != 0).
*
* @param m The fmap.
* @return int The file descriptor, or -1 if not available.
*/
int fmap_fd(fmap_t *m);
cl_error_t fmap_get_MD5(unsigned char *hash, fmap_t *map);
2009-08-20 02:19:57 +02:00
#endif