xref: /illumos-gate/usr/src/cmd/vscan/vscand/vs_icap.h (revision 2a8bcb4efb45d99ac41c94a75c396b362c414f7f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * PRIVATE header file for the icap client vs_icap.c
28  */
29 
30 #ifndef _VS_ICAP_H_
31 #define	_VS_ICAP_H_
32 
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36 
37 /* macros */
38 #define	MATCH(a, b)	(!strncasecmp((a), (b), strlen((b))))
39 
40 #define	VS_ICAP_VER	"ICAP/1.0"
41 
42 /* max sizes for vs_options_t */
43 #define	VS_DEFN_SZ	32
44 #define	VS_SERVICE_SZ	64
45 
46 #define	VS_BUF_SZ	4096	/* keep this a power-of-two value. */
47 #define	VS_HDR_SZ	8	/* > length of VS_BUF_SZ in hex + 2 for \r\n */
48 #define	VS_TAIL_SZ	8	/* > \r\n */
49 #define	VS_ENCAP_SZ	64	/* space reserved in header for encap offsets */
50 #define	VS_TERMINATION	"0\r\n\r\n"
51 
52 /*
53  * The Symantec ICAP server REQUIRES the "avscan" resource name
54  * after the IP address in the OPTIONS and  RESPMOD requests
55  * This is ignored by the other ICAP servers.
56  */
57 #define	VS_SERVICE_NAME "avscan"
58 
59 /* infection/violation record processing */
60 #define	VS_VIOLATION_LINES   4
61 #define	VS_INFECTION_FIELDS  3
62 
63 /* previewing files */
64 #define	VS_MIN_PREVIEW_LEN	4
65 
66 /* defines which files types should be previewed */
67 typedef enum {
68 	VS_PREVIEW_ALL = 1,	/* preview all files */
69 	VS_PREVIEW_NONE,	/* preview no files, transfer all complete */
70 	VS_PREVIEW_LIST,	/* preview only files of listed types */
71 	VS_PREVIEW_EXCEPT	/* preview all files except listed types */
72 } vs_preview_t;
73 
74 /* valid ICAP response codes */
75 typedef enum {
76 	VS_RESP_CONTINUE	= 100,
77 	VS_RESP_OK		= 200,
78 	VS_RESP_CREATED		= 201, /* file repaired. */
79 	VS_RESP_NO_CONT_NEEDED	= 204,
80 	VS_RESP_BAD_REQ		= 400,
81 	VS_RESP_FORBIDDEN	= 403, /* virus found but not repairable */
82 	VS_RESP_NOT_FOUND	= 404,
83 	VS_RESP_NOT_ALLOWED	= 405,
84 	VS_RESP_TIMEOUT		= 408,
85 	VS_RESP_INTERNAL_ERR	= 500,
86 	VS_RESP_NOT_IMPL	= 501,
87 	VS_RESP_SERV_UNAVAIL	= 503,  /* service unavailable or overloaded */
88 	VS_RESP_ICAP_VER_UNSUPP	= 505,
89 	/* Symantec additions - not ICAP standard */
90 	VS_RESP_SCAN_ERR	= 533,
91 	VS_RESP_NO_LICENSE	= 539,
92 	VS_RESP_RES_UNAVAIL	= 551,
93 	/* all else */
94 	VS_RESP_UNKNOWN
95 } vs_icap_resp_t;
96 
97 
98 /* the ICAP OPTIONS HEADERS used by NAS AVA */
99 typedef enum {
100 	VS_OPT_SERVICE = 1,
101 	VS_OPT_ISTAG,
102 	VS_OPT_METHODS,
103 	VS_OPT_ALLOW,
104 	VS_OPT_PREVIEW,
105 	VS_OPT_XFER_PREVIEW,
106 	VS_OPT_XFER_COMPLETE,
107 	VS_OPT_MAX_CONNECTIONS,
108 	VS_OPT_TTL,
109 	VS_OPT_X_DEF_INFO,
110 	VS_OPT_HDR_MAX = VS_OPT_X_DEF_INFO
111 } vs_option_hdr_t;
112 
113 
114 /*
115  * the ICAP RESPMOD RESPONSE HEADERS used by NAS AVA
116  *
117  * Do NOT change the order of:
118  * VS_RESP_X_VIRUS_ID, VS_RESP_X_INFECTION, VS_RESP_X_VIOLATIONS
119  * Virus data saved from any one of these headers may be replaced
120  * with data found in a preferable header (one with more info).
121  * They are listed in order of preference.
122  */
123 typedef enum {
124 	VS_RESP_ENCAPSULATED = 1,
125 	VS_RESP_ISTAG,
126 	VS_RESP_X_VIRUS_ID,
127 	VS_RESP_X_INFECTION,
128 	VS_RESP_X_VIOLATIONS,
129 	VS_RESP_HDR_MAX = VS_RESP_X_VIOLATIONS
130 } vs_resp_hdr_t;
131 
132 
133 /*
134  * vs_options_t
135  * vs_impl.c manages an array of vs_options_t, one per scan engine.
136  * vs_options_t is used to store the scan engine configuration info
137  * returned from the scan engine in the ICAP OPTIONS RESPONSE.
138  * This information is then used to determine how to communicate with
139  * the scan engines (eg which files to preview), when to resend the
140  * ICAP OPTIONS REQUEST, and the istag is used as the scanstamp of
141  * the file. The istag is also returned in the ICAP RESPMOD RESPONSE
142  * and is used to update the stored one if it has changed.
143  */
144 typedef struct vs_options {
145 	/* host & port used to detect config changes */
146 	char vso_host[MAXHOSTNAMELEN];
147 	int vso_port;
148 
149 	/* configuration options returned from scan engine */
150 	int vso_preview_len;		/* the preview supported */
151 	int vso_allow;			/* allow 204 */
152 	vs_scanstamp_t vso_scanstamp;	/* from istag received */
153 	char vso_defninfo[VS_DEFN_SZ];	/* virus definition info */
154 	char vso_service[VS_SERVICE_SZ]; /* name of SE service */
155 	int vso_respmod;		/* set if RESPMOD method supported */
156 	vs_preview_t vso_xfer_how;	/* transfer preview or complete */
157 	iovec_t *vso_xfer_preview;	/* file exts supporting preview */
158 	iovec_t *vso_xfer_complete;	/* file exts to be sent complete */
159 	long vso_ttl;			/* after this expiry, re-get options */
160 	time_t vso_req_time;		/* time when option was last sent */
161 } vs_options_t;
162 
163 
164 /*
165  * vs_info_t
166  *
167  * vs_info_t is part of the context created for each scan engine request.
168  * It contains send/recv buffers and other temporary storage required
169  * during the processing of the request/response.
170  * threat_hdr_t defines from which header the virus information was
171  * obtained. This is used to determine whether to overwrite existing
172  * info if a 'better' header is found.
173  */
174 typedef struct vs_info {
175 	char vsi_send_hdr[VS_HDR_SZ];
176 	char vsi_send_buf[VS_BUF_SZ + VS_TAIL_SZ];
177 	char vsi_recv_buf[VS_BUF_SZ];
178 
179 	/*  response header information */
180 	boolean_t vsi_res_hdr;
181 	boolean_t vsi_res_body;
182 	boolean_t vsi_html_content;	/* L8R - set, not used */
183 	int	vsi_content_len;	/* L8R - set, not used */
184 	int	vsi_icap_rc;
185 	int	vsi_http_rc;
186 	int	vsi_threat_hdr;
187 } vs_info_t;
188 
189 
190 /*
191  * vs_scan_ctx_t
192  *
193  * A vs_scan_ctx_t is created for each scan request. It will contain
194  * everything that is needed to process the scan request and return
195  * the response to the caller.
196  * - engine connection information used to identify which scan engine
197  *   the request is being sent to,
198  * - information about the file being scanned,
199  * - a place to store information about the file that will be created
200  *   to hold cleaned data if the scan engine detects an infection
201  *   and returns a cleaned version of the file,
202  * - a copy of the vs_options_t for the scan engine. This allows the
203  *   NAS AVA scan engine connection parameters to be reconfigured without
204  *   affecting any in-progress requests,
205  * - a vs_info_t - the temporary storage needed to process the request,
206  * - a vs_result_t - a place to store the  scan result information to be
207  *   returned to the caller.
208  */
209 typedef struct vs_scan_ctx {
210 	/* scan engine idx and connection info */
211 	int vsc_idx;
212 	char vsc_host[MAXHOSTNAMELEN];
213 	int vsc_port;
214 	int vsc_sockfd;
215 
216 	/* info about file to be scanned */
217 	int vsc_fd;
218 	char *vsc_fname;
219 	uint64_t vsc_fsize;
220 	int vsc_flags;
221 
222 	/* file to hold repaired data */
223 	boolean_t vsc_repair;
224 	int vsc_repair_fd;
225 	char *vsc_repair_fname;
226 
227 	vs_options_t vsc_options;
228 	vs_info_t vsc_info;
229 	vs_result_t *vsc_result;
230 } vs_scan_ctx_t;
231 
232 
233 /*
234  * vs_icap_hdr_t
235  *
236  * vs_icap.c defines tables of handlers for each ICAP OPTIONS RESPONSE HEADER
237  * and each ICAP RESPMOD RESPONSE HEADER which NAS AVA uses.
238  * Each entry in these tables is an vs_hdr_t.
239  */
240 typedef struct vs_hdr {
241 	int  vsh_id;
242 	char *vsh_name;
243 	int  (*vsh_func)(vs_scan_ctx_t *, int, char *);
244 }vs_hdr_t;
245 
246 
247 /*
248  * vs_resp_msg_t
249  *
250  * vs_icap.c defines a table mapping ICAP response code values to text strings.
251  * Each entry in this tables is a vs_resp_msg_t.
252  */
253 typedef struct vs_resp_msg {
254 	int vsm_rc;
255 	char *vsm_msg;
256 } vs_resp_msg_t;
257 
258 #ifdef __cplusplus
259 }
260 #endif
261 
262 #endif /* _VS_ICAP_H_ */
263