| 1 | /* SAMHAIN file system integrity testing */
|
|---|
| 2 | /* Copyright (C) 1999 Rainer Wichmann */
|
|---|
| 3 | /* */
|
|---|
| 4 | /* This program is free software; you can redistribute it */
|
|---|
| 5 | /* and/or modify */
|
|---|
| 6 | /* it under the terms of the GNU General Public License as */
|
|---|
| 7 | /* published by */
|
|---|
| 8 | /* the Free Software Foundation; either version 2 of the License, or */
|
|---|
| 9 | /* (at your option) any later version. */
|
|---|
| 10 | /* */
|
|---|
| 11 | /* This program is distributed in the hope that it will be useful, */
|
|---|
| 12 | /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
|
|---|
| 13 | /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
|
|---|
| 14 | /* GNU General Public License for more details. */
|
|---|
| 15 | /* */
|
|---|
| 16 | /* You should have received a copy of the GNU General Public License */
|
|---|
| 17 | /* along with this program; if not, write to the Free Software */
|
|---|
| 18 | /* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
|
|---|
| 19 |
|
|---|
| 20 |
|
|---|
| 21 | #ifndef SH_HASH_H
|
|---|
| 22 | #define SH_HASH_H
|
|---|
| 23 |
|
|---|
| 24 | #include <limits.h>
|
|---|
| 25 |
|
|---|
| 26 | #include "samhain.h"
|
|---|
| 27 | #include "sh_unix.h"
|
|---|
| 28 | #include "sh_error.h"
|
|---|
| 29 |
|
|---|
| 30 | /* format a uint64
|
|---|
| 31 | */
|
|---|
| 32 | char * sh_hash_size_format(void);
|
|---|
| 33 |
|
|---|
| 34 | /* report on a missing file
|
|---|
| 35 | */
|
|---|
| 36 | int hashreport_missing( char *fullpath, int level);
|
|---|
| 37 |
|
|---|
| 38 | /* remove internal db record for a file
|
|---|
| 39 | */
|
|---|
| 40 | void sh_hash_remove (const char * path);
|
|---|
| 41 |
|
|---|
| 42 | /* write database to stdout
|
|---|
| 43 | */
|
|---|
| 44 | int sh_hash_pushdata_stdout (const char * str);
|
|---|
| 45 |
|
|---|
| 46 | /* version string for database
|
|---|
| 47 | */
|
|---|
| 48 | int sh_hash_version_string(const char * str);
|
|---|
| 49 |
|
|---|
| 50 | /* Dont report on ctm/mtm change for directories
|
|---|
| 51 | */
|
|---|
| 52 | int sh_hash_loosedircheck(const char * str);
|
|---|
| 53 |
|
|---|
| 54 | /* List database content
|
|---|
| 55 | */
|
|---|
| 56 | int sh_hash_list_db (const char * db_file);
|
|---|
| 57 |
|
|---|
| 58 | /* List database content for a single file
|
|---|
| 59 | */
|
|---|
| 60 | int set_list_file (const char * c);
|
|---|
| 61 |
|
|---|
| 62 | /* List database content with full detail
|
|---|
| 63 | */
|
|---|
| 64 | int set_full_detail (const char * c);
|
|---|
| 65 |
|
|---|
| 66 | /* List database content with full detail, comma delimited
|
|---|
| 67 | */
|
|---|
| 68 | int set_list_delimited (const char * c);
|
|---|
| 69 |
|
|---|
| 70 | /* Read the database from disk.
|
|---|
| 71 | */
|
|---|
| 72 | void sh_hash_init (void);
|
|---|
| 73 |
|
|---|
| 74 | /* Check whether a file is present in the database.
|
|---|
| 75 | */
|
|---|
| 76 | int sh_hash_have_it (const char * newname);
|
|---|
| 77 |
|
|---|
| 78 | /* Get a file if it is present in the database.
|
|---|
| 79 | * If fileHash != NULL also return checksum.
|
|---|
| 80 | */
|
|---|
| 81 | int sh_hash_get_it (const char * newname, file_type * tmpFile, char * fileHash);
|
|---|
| 82 |
|
|---|
| 83 | /* Delete the database from memory.
|
|---|
| 84 | */
|
|---|
| 85 | void sh_hash_hashdelete (void);
|
|---|
| 86 |
|
|---|
| 87 | /* Insert a file into the database.
|
|---|
| 88 | */
|
|---|
| 89 | void sh_hash_pushdata (file_type * buf, char * fileHash);
|
|---|
| 90 |
|
|---|
| 91 | /* reset sh_hash_pushdata to use 'update' in daemon mode
|
|---|
| 92 | */
|
|---|
| 93 | void sh_hash_pushdata_reset (void);
|
|---|
| 94 |
|
|---|
| 95 | /* Insert a file into the in-memory database.
|
|---|
| 96 | */
|
|---|
| 97 | void sh_hash_pushdata_memory (file_type * theFile, char * fileHash);
|
|---|
| 98 |
|
|---|
| 99 | /* Get file flags from in-memory database
|
|---|
| 100 | */
|
|---|
| 101 | int sh_hash_getflags (char * filename);
|
|---|
| 102 |
|
|---|
| 103 | /* Set file flags in in-memory database
|
|---|
| 104 | */
|
|---|
| 105 | int sh_hash_setflags (char * filename, int flags);
|
|---|
| 106 |
|
|---|
| 107 | /* Set a file flag in in-memory database
|
|---|
| 108 | */
|
|---|
| 109 | void sh_hash_addflag (char * filename, int flag);
|
|---|
| 110 |
|
|---|
| 111 | /* Compare a file with its status in the database.
|
|---|
| 112 | */
|
|---|
| 113 | int sh_hash_compdata (int class, file_type * theFile, char * fileHash,
|
|---|
| 114 | char * policy_override, int severity_override);
|
|---|
| 115 |
|
|---|
| 116 | /* Search for files in the database that have been deleted from disk.
|
|---|
| 117 | */
|
|---|
| 118 | void sh_hash_unvisited (ShErrLevel level);
|
|---|
| 119 |
|
|---|
| 120 | /* Search for unvisited entries in the database, custom error handler.
|
|---|
| 121 | */
|
|---|
| 122 | void sh_hash_unvisited_custom (char prefix, void(*handler)(const char * key));
|
|---|
| 123 |
|
|---|
| 124 | /* Set a file's status to 'visited'. This is required for
|
|---|
| 125 | * files that should be ignored, and may be present in the
|
|---|
| 126 | * database, but not on disk.
|
|---|
| 127 | */
|
|---|
| 128 | int sh_hash_set_visited (char * newname);
|
|---|
| 129 |
|
|---|
| 130 | /* As above, but only set the 'visited' flag
|
|---|
| 131 | */
|
|---|
| 132 | int sh_hash_set_visited_true (char * newname);
|
|---|
| 133 |
|
|---|
| 134 | /* cause the record to be deleted without a 'missing' message
|
|---|
| 135 | */
|
|---|
| 136 | int sh_hash_set_missing (char * newname);
|
|---|
| 137 |
|
|---|
| 138 | /* Make a complete directory tree invisible
|
|---|
| 139 | */
|
|---|
| 140 | int hash_remove_tree (char * s);
|
|---|
| 141 |
|
|---|
| 142 | /* Make every entry visible
|
|---|
| 143 | */
|
|---|
| 144 | int hash_full_tree (void);
|
|---|
| 145 |
|
|---|
| 146 | /* Insert data.
|
|---|
| 147 | * 'key' -> path
|
|---|
| 148 | * 'str' -> binary with size 'size'
|
|---|
| 149 | */
|
|---|
| 150 | struct store2db {
|
|---|
| 151 | UINT64 val0;
|
|---|
| 152 | UINT64 val1;
|
|---|
| 153 | UINT64 val2;
|
|---|
| 154 | UINT64 val3;
|
|---|
| 155 | char checksum[KEY_LEN+1];
|
|---|
| 156 | unsigned char * str;
|
|---|
| 157 | int size;
|
|---|
| 158 | };
|
|---|
| 159 |
|
|---|
| 160 | void sh_hash_push2db (const char * key, struct store2db * save);
|
|---|
| 161 |
|
|---|
| 162 |
|
|---|
| 163 | /* Retrieve data
|
|---|
| 164 | */
|
|---|
| 165 | char * sh_hash_db2pop (const char * key, struct store2db * get);
|
|---|
| 166 |
|
|---|
| 167 |
|
|---|
| 168 | /* Write out database
|
|---|
| 169 | */
|
|---|
| 170 | int sh_hash_writeout(void);
|
|---|
| 171 | #endif
|
|---|
