Compare commits
10 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
3f3081af25 | ||
|
|
3ef7191ecf | ||
|
|
817805f598 | ||
|
|
cfcfbd4360 | ||
|
|
69c0d2a4e1 | ||
|
|
690024f64a | ||
|
|
d8621d034e | ||
|
|
946c4b64ba | ||
|
|
4fee3e0db2 | ||
|
|
23c4b7a54c |
1
.gitattributes
vendored
Normal file
1
.gitattributes
vendored
Normal file
@@ -0,0 +1 @@
|
|||||||
|
*.yar linguist-vendored
|
||||||
10
clamav.go
10
clamav.go
@@ -176,8 +176,12 @@ func (c *Clamav) EngineGetNum(field EngineField) (uint64, error) {
|
|||||||
|
|
||||||
// Free the memory allocated to clamav instance, Free should be called
|
// Free the memory allocated to clamav instance, Free should be called
|
||||||
// when the engine is no longer in use.
|
// when the engine is no longer in use.
|
||||||
func (c *Clamav) Free() int {
|
func (c *Clamav) Free() error {
|
||||||
return int(C.cl_engine_free((*C.struct_cl_engine)(c.engine)))
|
ret := ErrorCode(C.cl_engine_free((*C.struct_cl_engine)(c.engine)))
|
||||||
|
if ret == CL_SUCCESS {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return Strerr(ret)
|
||||||
}
|
}
|
||||||
|
|
||||||
// ScanMapCB scans custom data
|
// ScanMapCB scans custom data
|
||||||
@@ -198,7 +202,7 @@ func (c *Clamav) ScanMapCB(fmap *Fmap, fileName string, context interface{}) (ui
|
|||||||
defer CloseMemory(fmap)
|
defer CloseMemory(fmap)
|
||||||
// clean
|
// clean
|
||||||
if ret == CL_SUCCESS {
|
if ret == CL_SUCCESS {
|
||||||
return 0, "", nil
|
return uint(scanned), "", nil
|
||||||
}
|
}
|
||||||
// virus
|
// virus
|
||||||
if ret == CL_VIRUS {
|
if ret == CL_VIRUS {
|
||||||
|
|||||||
60
define.go
60
define.go
@@ -19,6 +19,54 @@ type SCAN_OPTIONS struct {
|
|||||||
Dev uint
|
Dev uint
|
||||||
}
|
}
|
||||||
|
|
||||||
|
const (
|
||||||
|
/* general */
|
||||||
|
CL_SCAN_GENERAL_ALLMATCHES = 0x1 /* scan in all-match mode */
|
||||||
|
CL_SCAN_GENERAL_COLLECT_METADATA = 0x2 /* collect metadata (--gen-json) */
|
||||||
|
CL_SCAN_GENERAL_HEURISTICS = 0x4 /* option to enable heuristic alerts */
|
||||||
|
CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE = 0x8 /* allow heuristic match to take precedence. */
|
||||||
|
CL_SCAN_GENERAL_UNPRIVILEGED = 0x10 /* scanner will not have read access to files. */
|
||||||
|
|
||||||
|
/* parsing capabilities options */
|
||||||
|
CL_SCAN_PARSE_ARCHIVE = 0x1
|
||||||
|
CL_SCAN_PARSE_ELF = 0x2
|
||||||
|
CL_SCAN_PARSE_PDF = 0x4
|
||||||
|
CL_SCAN_PARSE_SWF = 0x8
|
||||||
|
CL_SCAN_PARSE_HWP3 = 0x10
|
||||||
|
CL_SCAN_PARSE_XMLDOCS = 0x20
|
||||||
|
CL_SCAN_PARSE_MAIL = 0x40
|
||||||
|
CL_SCAN_PARSE_OLE2 = 0x80
|
||||||
|
CL_SCAN_PARSE_HTML = 0x100
|
||||||
|
CL_SCAN_PARSE_PE = 0x200
|
||||||
|
|
||||||
|
/* heuristic alerting options */
|
||||||
|
CL_SCAN_HEURISTIC_BROKEN = 0x2 /* alert on broken PE and broken ELF files */
|
||||||
|
CL_SCAN_HEURISTIC_EXCEEDS_MAX = 0x4 /* alert when files exceed scan limits (filesize, max scansize, or max recursion depth) */
|
||||||
|
CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH = 0x8 /* alert on SSL mismatches */
|
||||||
|
CL_SCAN_HEURISTIC_PHISHING_CLOAK = 0x10 /* alert on cloaked URLs in emails */
|
||||||
|
CL_SCAN_HEURISTIC_MACROS = 0x20 /* alert on OLE2 files containing macros */
|
||||||
|
CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE = 0x40 /* alert if archive is encrypted (rar, zip, etc) */
|
||||||
|
CL_SCAN_HEURISTIC_ENCRYPTED_DOC = 0x80 /* alert if a document is encrypted (pdf, docx, etc) */
|
||||||
|
CL_SCAN_HEURISTIC_PARTITION_INTXN = 0x100 /* alert if partition table size doesn't make sense */
|
||||||
|
CL_SCAN_HEURISTIC_STRUCTURED = 0x200 /* data loss prevention options, i.e. alert when detecting personal information */
|
||||||
|
CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL = 0x400 /* alert when detecting social security numbers */
|
||||||
|
CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED = 0x800 /* alert when detecting stripped social security numbers */
|
||||||
|
CL_SCAN_HEURISTIC_STRUCTURED_CC = 0x1000 /* alert when detecting credit card numbers */
|
||||||
|
CL_SCAN_HEURISTIC_BROKEN_MEDIA = 0x2000 /* alert if a file does not match the identified file format, works with JPEG, TIFF, GIF, PNG */
|
||||||
|
|
||||||
|
/* mail scanning options */
|
||||||
|
CL_SCAN_MAIL_PARTIAL_MESSAGE = 0x1
|
||||||
|
|
||||||
|
/* dev options */
|
||||||
|
CL_SCAN_DEV_COLLECT_SHA = 0x1 /* Enables hash output in sha-collect builds - for internal use only */
|
||||||
|
CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO = 0x2 /* collect performance timings */
|
||||||
|
|
||||||
|
/* cl_countsigs options */
|
||||||
|
CL_COUNTSIGS_OFFICIAL = 0x1
|
||||||
|
CL_COUNTSIGS_UNOFFICIAL = 0x2
|
||||||
|
CL_COUNTSIGS_ALL = (CL_COUNTSIGS_OFFICIAL | CL_COUNTSIGS_UNOFFICIAL)
|
||||||
|
)
|
||||||
|
|
||||||
// Fmap models in-memory files
|
// Fmap models in-memory files
|
||||||
type Fmap C.cl_fmap_t
|
type Fmap C.cl_fmap_t
|
||||||
|
|
||||||
@@ -81,18 +129,6 @@ func Strerr(code ErrorCode) error {
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
/* parsing capabilities options */
|
|
||||||
const CL_SCAN_PARSE_ARCHIVE = C.CL_SCAN_PARSE_ARCHIVE
|
|
||||||
const CL_SCAN_PARSE_ELF = C.CL_SCAN_PARSE_ELF
|
|
||||||
const CL_SCAN_PARSE_PDF = C.CL_SCAN_PARSE_PDF
|
|
||||||
const CL_SCAN_PARSE_SWF = C.CL_SCAN_PARSE_SWF
|
|
||||||
const CL_SCAN_PARSE_HWP3 = C.CL_SCAN_PARSE_HWP3
|
|
||||||
const CL_SCAN_PARSE_XMLDOCS = C.CL_SCAN_PARSE_XMLDOCS
|
|
||||||
const CL_SCAN_PARSE_MAIL = C.CL_SCAN_PARSE_MAIL
|
|
||||||
const CL_SCAN_PARSE_OLE2 = C.CL_SCAN_PARSE_OLE2
|
|
||||||
const CL_SCAN_PARSE_HTML = C.CL_SCAN_PARSE_HTML
|
|
||||||
const CL_SCAN_PARSE_PE = C.CL_SCAN_PARSE_PE
|
|
||||||
|
|
||||||
/* db options */
|
/* db options */
|
||||||
// clang-format off
|
// clang-format off
|
||||||
type DBOptions uint
|
type DBOptions uint
|
||||||
|
|||||||
Reference in New Issue
Block a user