1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * PRIVATE header file for the icap client vs_icap.c 28 */ 29 30 #ifndef _VS_ICAP_H_ 31 #define _VS_ICAP_H_ 32 33 #ifdef __cplusplus 34 extern "C" { 35 #endif 36 37 /* macros */ 38 #define MATCH(a, b) (!strncasecmp((a), (b), strlen((b)))) 39 40 #define VS_ICAP_VER "ICAP/1.0" 41 42 /* max sizes for vs_options_t */ 43 #define VS_DEFN_SZ 32 44 #define VS_SERVICE_SZ 64 45 46 #define VS_BUF_SZ 4096 /* keep this a power-of-two value. */ 47 #define VS_HDR_SZ 8 /* > length of VS_BUF_SZ in hex + 2 for \r\n */ 48 #define VS_TAIL_SZ 8 /* > \r\n */ 49 #define VS_ENCAP_SZ 64 /* space reserved in header for encap offsets */ 50 #define VS_TERMINATION "0\r\n\r\n" 51 52 /* 53 * The Symantec ICAP server REQUIRES the "avscan" resource name 54 * after the IP address in the OPTIONS and RESPMOD requests 55 * This is ignored by the other ICAP servers. 56 */ 57 #define VS_SERVICE_NAME "avscan" 58 59 /* infection/violation record processing */ 60 #define VS_VIOLATION_LINES 4 61 #define VS_INFECTION_FIELDS 3 62 63 /* previewing files */ 64 #define VS_MIN_PREVIEW_LEN 4 65 66 /* defines which files types should be previewed */ 67 typedef enum { 68 VS_PREVIEW_ALL = 1, /* preview all files */ 69 VS_PREVIEW_NONE, /* preview no files, transfer all complete */ 70 VS_PREVIEW_LIST, /* preview only files of listed types */ 71 VS_PREVIEW_EXCEPT /* preview all files except listed types */ 72 } vs_preview_t; 73 74 /* valid ICAP response codes */ 75 typedef enum { 76 VS_RESP_CONTINUE = 100, 77 VS_RESP_OK = 200, 78 VS_RESP_CREATED = 201, /* file repaired. */ 79 VS_RESP_NO_CONT_NEEDED = 204, 80 VS_RESP_BAD_REQ = 400, 81 VS_RESP_FORBIDDEN = 403, /* virus found but not repairable */ 82 VS_RESP_NOT_FOUND = 404, 83 VS_RESP_NOT_ALLOWED = 405, 84 VS_RESP_TIMEOUT = 408, 85 VS_RESP_INTERNAL_ERR = 500, 86 VS_RESP_NOT_IMPL = 501, 87 VS_RESP_SERV_UNAVAIL = 503, /* service unavailable or overloaded */ 88 VS_RESP_ICAP_VER_UNSUPP = 505, 89 /* Symantec additions - not ICAP standard */ 90 VS_RESP_SCAN_ERR = 533, 91 VS_RESP_NO_LICENSE = 539, 92 VS_RESP_RES_UNAVAIL = 551, 93 /* all else */ 94 VS_RESP_UNKNOWN 95 } vs_icap_resp_t; 96 97 98 /* the ICAP OPTIONS HEADERS used by NAS AVA */ 99 typedef enum { 100 VS_OPT_SERVICE = 1, 101 VS_OPT_ISTAG, 102 VS_OPT_METHODS, 103 VS_OPT_ALLOW, 104 VS_OPT_PREVIEW, 105 VS_OPT_XFER_PREVIEW, 106 VS_OPT_XFER_COMPLETE, 107 VS_OPT_MAX_CONNECTIONS, 108 VS_OPT_TTL, 109 VS_OPT_X_DEF_INFO, 110 VS_OPT_HDR_MAX = VS_OPT_X_DEF_INFO 111 } vs_option_hdr_t; 112 113 114 /* 115 * the ICAP RESPMOD RESPONSE HEADERS used by NAS AVA 116 * 117 * Do NOT change the order of: 118 * VS_RESP_X_VIRUS_ID, VS_RESP_X_INFECTION, VS_RESP_X_VIOLATIONS 119 * Virus data saved from any one of these headers may be replaced 120 * with data found in a preferable header (one with more info). 121 * They are listed in order of preference. 122 */ 123 typedef enum { 124 VS_RESP_ENCAPSULATED = 1, 125 VS_RESP_ISTAG, 126 VS_RESP_X_VIRUS_ID, 127 VS_RESP_X_INFECTION, 128 VS_RESP_X_VIOLATIONS, 129 VS_RESP_HDR_MAX = VS_RESP_X_VIOLATIONS 130 } vs_resp_hdr_t; 131 132 133 /* 134 * vs_options_t 135 * vs_impl.c manages an array of vs_options_t, one per scan engine. 136 * vs_options_t is used to store the scan engine configuration info 137 * returned from the scan engine in the ICAP OPTIONS RESPONSE. 138 * This information is then used to determine how to communicate with 139 * the scan engines (eg which files to preview), when to resend the 140 * ICAP OPTIONS REQUEST, and the istag is used as the scanstamp of 141 * the file. The istag is also returned in the ICAP RESPMOD RESPONSE 142 * and is used to update the stored one if it has changed. 143 */ 144 typedef struct vs_options { 145 /* host & port used to detect config changes */ 146 char vso_host[MAXHOSTNAMELEN]; 147 int vso_port; 148 149 /* configuration options returned from scan engine */ 150 int vso_preview_len; /* the preview supported */ 151 int vso_allow; /* allow 204 */ 152 vs_scanstamp_t vso_scanstamp; /* from istag received */ 153 char vso_defninfo[VS_DEFN_SZ]; /* virus definition info */ 154 char vso_service[VS_SERVICE_SZ]; /* name of SE service */ 155 int vso_respmod; /* set if RESPMOD method supported */ 156 vs_preview_t vso_xfer_how; /* transfer preview or complete */ 157 iovec_t *vso_xfer_preview; /* file exts supporting preview */ 158 iovec_t *vso_xfer_complete; /* file exts to be sent complete */ 159 long vso_ttl; /* after this expiry, re-get options */ 160 time_t vso_req_time; /* time when option was last sent */ 161 } vs_options_t; 162 163 164 /* 165 * vs_info_t 166 * 167 * vs_info_t is part of the context created for each scan engine request. 168 * It contains send/recv buffers and other temporary storage required 169 * during the processing of the request/response. 170 * threat_hdr_t defines from which header the virus information was 171 * obtained. This is used to determine whether to overwrite existing 172 * info if a 'better' header is found. 173 */ 174 typedef struct vs_info { 175 char vsi_send_hdr[VS_HDR_SZ]; 176 char vsi_send_buf[VS_BUF_SZ + VS_TAIL_SZ]; 177 char vsi_recv_buf[VS_BUF_SZ]; 178 179 /* response header information */ 180 boolean_t vsi_res_hdr; 181 boolean_t vsi_res_body; 182 boolean_t vsi_html_content; /* L8R - set, not used */ 183 int vsi_content_len; /* L8R - set, not used */ 184 int vsi_icap_rc; 185 int vsi_http_rc; 186 int vsi_threat_hdr; 187 } vs_info_t; 188 189 190 /* 191 * vs_scan_ctx_t 192 * 193 * A vs_scan_ctx_t is created for each scan request. It will contain 194 * everything that is needed to process the scan request and return 195 * the response to the caller. 196 * - engine connection information used to identify which scan engine 197 * the request is being sent to, 198 * - information about the file being scanned, 199 * - a place to store information about the file that will be created 200 * to hold cleaned data if the scan engine detects an infection 201 * and returns a cleaned version of the file, 202 * - a copy of the vs_options_t for the scan engine. This allows the 203 * NAS AVA scan engine connection parameters to be reconfigured without 204 * affecting any in-progress requests, 205 * - a vs_info_t - the temporary storage needed to process the request, 206 * - a vs_result_t - a place to store the scan result information to be 207 * returned to the caller. 208 */ 209 typedef struct vs_scan_ctx { 210 /* scan engine idx and connection info */ 211 int vsc_idx; 212 char vsc_host[MAXHOSTNAMELEN]; 213 int vsc_port; 214 int vsc_sockfd; 215 216 /* info about file to be scanned */ 217 int vsc_fd; 218 char *vsc_fname; 219 uint64_t vsc_fsize; 220 int vsc_flags; 221 222 /* file to hold repaired data */ 223 boolean_t vsc_repair; 224 int vsc_repair_fd; 225 char *vsc_repair_fname; 226 227 vs_options_t vsc_options; 228 vs_info_t vsc_info; 229 vs_result_t *vsc_result; 230 } vs_scan_ctx_t; 231 232 233 /* 234 * vs_icap_hdr_t 235 * 236 * vs_icap.c defines tables of handlers for each ICAP OPTIONS RESPONSE HEADER 237 * and each ICAP RESPMOD RESPONSE HEADER which NAS AVA uses. 238 * Each entry in these tables is an vs_hdr_t. 239 */ 240 typedef struct vs_hdr { 241 int vsh_id; 242 char *vsh_name; 243 int (*vsh_func)(vs_scan_ctx_t *, int, char *); 244 }vs_hdr_t; 245 246 247 /* 248 * vs_resp_msg_t 249 * 250 * vs_icap.c defines a table mapping ICAP response code values to text strings. 251 * Each entry in this tables is a vs_resp_msg_t. 252 */ 253 typedef struct vs_resp_msg { 254 int vsm_rc; 255 char *vsm_msg; 256 } vs_resp_msg_t; 257 258 #ifdef __cplusplus 259 } 260 #endif 261 262 #endif /* _VS_ICAP_H_ */ 263