/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#ifndef _ESET_RTP_H
#define _ESET_RTP_H

#define ESET_RTP_FULL_NAME "ESET Real-time file system protection module"
#define ESET_RTP "eset_rtp"
#define ERTP "ertp"

#define ERTP_PROTOCOL_VERSION 3

#include <linux/ioctl.h>
#include <linux/types.h>

#define ERTP_DEV "/dev/" ESET_RTP

#pragma pack(4)

struct eset_rtp_init {
  uint32_t version;
  uint32_t scanner_timeout_ms;
  uint32_t mem_dev_timeout_ms;
  uint32_t signal_delay_ms;
};

struct eset_rtp_flexible_member {
  uint32_t size;
  uint32_t offset;
};

struct eset_rtp_time_member {
  int64_t tv_sec;
  int64_t tv_nsec;
};

enum eset_rtp_event_flags {
  ERTP_EVENT_FLAG_MODIFIED = 0x1,
};

struct eset_rtp_event_generic {
  int32_t id;
  int32_t fd;
  int32_t pid;
  uint32_t uid;
  uint32_t gid;
  uint64_t file_id;
  uint64_t device_number;
  bool under_fuse;
  bool mnt_namespace;
  uint64_t file_size;
  uint32_t mode;
  uint32_t flags;

  struct eset_rtp_time_member ctime;
  struct eset_rtp_time_member mtime;

  struct eset_rtp_flexible_member file_path;
  struct eset_rtp_flexible_member process_path;
};

struct eset_rtp_event_memory {
  int32_t id;
  int32_t fd;
  int32_t pid;
  uint32_t uid;
  uint32_t gid;
  uint64_t file_size;

  struct eset_rtp_flexible_member process_path;
};

struct eset_rtp_event_remove {
  int32_t id;
  uint64_t file_id;
  uint64_t device_number;
};

enum eset_rtp_event_type {
  ERTP_TYPE_OPEN_EVENT = 1,
  ERTP_TYPE_CLOSE_EVENT = 2,
  ERTP_TYPE_EXEC_EVENT = 3,
  ERTP_TYPE_REMOVE_EVENT = 4,
  ERTP_TYPE_MEMORY_EXEC_EVENT = 5,
};

struct eset_rtp_event {
  uint32_t type;
  union {
    struct eset_rtp_event_generic generic;
    struct eset_rtp_event_memory memory;
    struct eset_rtp_event_remove remove;
  } data;
};

struct eset_rtp_get_event {
  uint32_t version;
  struct eset_rtp_event *event;
  void *data;
  uint32_t data_size;
};

enum eset_rtp_av_result {
  ERTP_RESULT_ALLOW = 1,
  ERTP_RESULT_DENY = 2,
};

enum eset_rtp_av_result_flags {
  ERTP_AV_RESULT_FLAG_SHOULD_CACHE = 0x1,
};

enum eset_rtp_cache_data_type {
  ERTP_TYPE_CACHE_OPEN = 1,
  ERTP_TYPE_CACHE_CLOSE = 2,
  ERTP_TYPE_CACHE_EXEC = 3,
};

struct eset_rtp_cache_data {
  uint32_t type;
  uint64_t ino;
  uint64_t dev;

  struct eset_rtp_time_member ctime;
};

struct eset_rtp_set_av_status {
  uint32_t version;
  int32_t id;
  uint32_t result;
  uint32_t flags;

  struct eset_rtp_cache_data cache_data;
};

struct eset_rtp_remove_event_finished {
  uint32_t version;
  int32_t id;
};

enum eset_rtp_exclusions_type {
  ERTP_EXCLUSIONS_TYPE_FILE_DEFAULT = 1,
  ERTP_EXCLUSIONS_TYPE_PROCESS_DEFAULT = 2,
  ERTP_EXCLUSIONS_TYPE_FILE_USER = 3,
  ERTP_EXCLUSIONS_TYPE_PROCESS_USER = 4,
};

#define ERTP_EXCLUSIONS_MAX 131072u

struct eset_rtp_set_exclusions {
  uint32_t version;
  uint32_t type;
  uint32_t size;
  const char **paths;
};

enum eset_rtp_action {
  ERTP_ACTION_FLUSH_CACHE = 1,
};

struct eset_rtp_do_action {
  uint32_t version;
  uint32_t action;
};

#define ERTP_OP_INIT _IOR('e', 1, struct eset_rtp_init *)

#define ERTP_OP_GET_EVENT _IOWR('e', 10, struct eset_rtp_get_event *)

#define ERTP_OP_SET_AV_STATUS _IOR('e', 20, struct eset_rtp_set_av_status *)
#define ERTP_OP_SET_EXCLUSIONS _IOR('e', 21, struct eset_rtp_set_exclusions *)
#define ERTP_OP_DO_ACTION _IOR('e', 22, struct eset_rtp_do_action *)
#define ERTP_OP_REMOVE_EVENT_FINISHED \
  _IOR('e', 23, struct eset_rtp_remove_event_finished *)

#pragma pack()
#endif