/*
* Copyright ( C ) 2013 - 2024 Cisco Systems , Inc . and / or its affiliates . All rights reserved .
* Copyright ( C ) 2008 - 2013 Sourcefire , Inc .
*
* Author : Tomasz Kojm < tkojm @ clamav . net >
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
*
* You should have received a copy of the GNU General Public License
* along with this program ; if not , write to the Free Software
* Foundation , Inc . , 51 Franklin Street , Fifth Floor , Boston ,
* MA 02110 - 1301 , USA .
*/
/*
* TODO :
* - clamconf , milter
* - clamconf : generation / verification / updating of config files and man page entries
* - automatically generate - - help pages ( use the first line from the description )
*/
# if HAVE_CONFIG_H
# include "clamav-config.h"
# endif
# include <stdio.h>
# include <stdlib.h>
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# include <stdbool.h>
# include <string.h>
# include <errno.h>
# ifdef HAVE_STRINGS_H
# include <strings.h>
# endif
# include <ctype.h>
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
// libclamav
# include "clamav.h"
# include "regex/regex.h"
# include "default.h"
# include "others.h"
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# include "optparser.h"
# include "misc.h"
# include "getopt.h"
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# ifdef _WIN32
# include "libgen.h"
# endif
GIF, PNG bugfixes; Add AlertBrokenMedia option
Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files.
To enable this feature, set `AlertBrokenMedia yes` in clamd.conf, or
use the `--alert-broken-media` option when using `clamscan`.
These options are disabled by default for now.
Application developers may enable this scan option by enabling
`CL_SCAN_HEURISTIC_BROKEN_MEDIA` for the `heuristic` scan option bit
field.
Fixed PNG parser logic bugs that caused an excess of parsing errors
and fixed a stack exhaustion issue affecting some systems when
scanning PNG files. PNG file type detection was disabled via
signature database update for 0.103.0 to mitigate effects from these
bugs.
Fixed an issue where PNG and GIF files no longer work with Target:5
(graphics) signatures if detected as CL_TYPE_PNG/GIF rather than as
CL_TYPE_GRAPHICS. Target types now support up to 10 possible file
types to make way for additional graphics types in future releases.
Scanning JPEG, TIFF, PNG, and GIF files will no longer return "parse"
errors when file format validation fails. Instead, the scan will alert
with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media"
feature is enabled.
GIF format validation will no longer fail if the GIF image is missing
the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIF files.
Added a TIFF dynamic configuration (DCONF) option, which was missing.
This will allow us to disable TIFF format validation via signature
database update in the event that it proves to be problematic.
This feature already exists for many other file types.
Added CL_TYPE_JPEG and CL_TYPE_TIFF types.
5 years ago
/* clang-format off */
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# ifdef _WIN32
# define CLAMKEY "Software\\ClamAV"
# endif
# define MAXCMDOPTS 150
# define MATCH_NUMBER "^[0-9]+$"
# define MATCH_SIZE "^[0-9]+[KMG]?$"
GIF, PNG bugfixes; Add AlertBrokenMedia option
Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files.
To enable this feature, set `AlertBrokenMedia yes` in clamd.conf, or
use the `--alert-broken-media` option when using `clamscan`.
These options are disabled by default for now.
Application developers may enable this scan option by enabling
`CL_SCAN_HEURISTIC_BROKEN_MEDIA` for the `heuristic` scan option bit
field.
Fixed PNG parser logic bugs that caused an excess of parsing errors
and fixed a stack exhaustion issue affecting some systems when
scanning PNG files. PNG file type detection was disabled via
signature database update for 0.103.0 to mitigate effects from these
bugs.
Fixed an issue where PNG and GIF files no longer work with Target:5
(graphics) signatures if detected as CL_TYPE_PNG/GIF rather than as
CL_TYPE_GRAPHICS. Target types now support up to 10 possible file
types to make way for additional graphics types in future releases.
Scanning JPEG, TIFF, PNG, and GIF files will no longer return "parse"
errors when file format validation fails. Instead, the scan will alert
with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media"
feature is enabled.
GIF format validation will no longer fail if the GIF image is missing
the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIF files.
Added a TIFF dynamic configuration (DCONF) option, which was missing.
This will allow us to disable TIFF format validation via signature
database update in the event that it proves to be problematic.
This feature already exists for many other file types.
Added CL_TYPE_JPEG and CL_TYPE_TIFF types.
5 years ago
# define MATCH_BOOL "^(yes|true|1|no|false|0)$"
# define FLAG_MULTIPLE 1 /* option can be used multiple times */
# define FLAG_REQUIRED 2 /* arg is required, even if there's a default value */
GIF, PNG bugfixes; Add AlertBrokenMedia option
Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files.
To enable this feature, set `AlertBrokenMedia yes` in clamd.conf, or
use the `--alert-broken-media` option when using `clamscan`.
These options are disabled by default for now.
Application developers may enable this scan option by enabling
`CL_SCAN_HEURISTIC_BROKEN_MEDIA` for the `heuristic` scan option bit
field.
Fixed PNG parser logic bugs that caused an excess of parsing errors
and fixed a stack exhaustion issue affecting some systems when
scanning PNG files. PNG file type detection was disabled via
signature database update for 0.103.0 to mitigate effects from these
bugs.
Fixed an issue where PNG and GIF files no longer work with Target:5
(graphics) signatures if detected as CL_TYPE_PNG/GIF rather than as
CL_TYPE_GRAPHICS. Target types now support up to 10 possible file
types to make way for additional graphics types in future releases.
Scanning JPEG, TIFF, PNG, and GIF files will no longer return "parse"
errors when file format validation fails. Instead, the scan will alert
with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media"
feature is enabled.
GIF format validation will no longer fail if the GIF image is missing
the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIF files.
Added a TIFF dynamic configuration (DCONF) option, which was missing.
This will allow us to disable TIFF format validation via signature
database update in the event that it proves to be problematic.
This feature already exists for many other file types.
Added CL_TYPE_JPEG and CL_TYPE_TIFF types.
5 years ago
# define FLAG_HIDDEN 4 /* don't print in clamconf --generate-config */
# define FLAG_REG_CASE 8 /* case-sensitive regex matching */
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# ifdef _WIN32
static bool is_initialized = false ;
# ifndef BACKUP_DATADIR
# define BACKUP_DATADIR "C:\\ClamAV\\database"
# endif
# ifndef BACKUP_CONFDIR
# define BACKUP_CONFDIR "C:\\ClamAV"
# endif
char _DATADIR [ MAX_PATH ] = BACKUP_DATADIR ;
char _CONFDIR [ MAX_PATH ] = BACKUP_CONFDIR ;
char _CONFDIR_CLAMD [ MAX_PATH ] = BACKUP_CONFDIR " \\ clamd.conf " ;
char _CONFDIR_FRESHCLAM [ MAX_PATH ] = BACKUP_CONFDIR " \\ freshclam.conf " ;
char _CONFDIR_MILTER [ MAX_PATH ] = BACKUP_CONFDIR " \\ clamav-milter.conf " ;
# define CONST_DATADIR _DATADIR
# define CONST_CONFDIR _CONFDIR
# define CONST_CONFDIR_CLAMD _CONFDIR_CLAMD
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# define CONST_CONFDIR_FRESHCLAM _CONFDIR_FRESHCLAM
# define CONST_CONFDIR_MILTER _CONFDIR_MILTER
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# else
# define CONST_DATADIR DATADIR
# define CONST_CONFDIR CONFDIR
# define CONST_CONFDIR_CLAMD CONFDIR_CLAMD
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# define CONST_CONFDIR_FRESHCLAM CONFDIR_FRESHCLAM
# define CONST_CONFDIR_MILTER CONFDIR_MILTER
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# endif
GIF, PNG bugfixes; Add AlertBrokenMedia option
Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files.
To enable this feature, set `AlertBrokenMedia yes` in clamd.conf, or
use the `--alert-broken-media` option when using `clamscan`.
These options are disabled by default for now.
Application developers may enable this scan option by enabling
`CL_SCAN_HEURISTIC_BROKEN_MEDIA` for the `heuristic` scan option bit
field.
Fixed PNG parser logic bugs that caused an excess of parsing errors
and fixed a stack exhaustion issue affecting some systems when
scanning PNG files. PNG file type detection was disabled via
signature database update for 0.103.0 to mitigate effects from these
bugs.
Fixed an issue where PNG and GIF files no longer work with Target:5
(graphics) signatures if detected as CL_TYPE_PNG/GIF rather than as
CL_TYPE_GRAPHICS. Target types now support up to 10 possible file
types to make way for additional graphics types in future releases.
Scanning JPEG, TIFF, PNG, and GIF files will no longer return "parse"
errors when file format validation fails. Instead, the scan will alert
with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media"
feature is enabled.
GIF format validation will no longer fail if the GIF image is missing
the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIF files.
Added a TIFF dynamic configuration (DCONF) option, which was missing.
This will allow us to disable TIFF format validation via signature
database update in the event that it proves to be problematic.
This feature already exists for many other file types.
Added CL_TYPE_JPEG and CL_TYPE_TIFF types.
5 years ago
/* clang-format on */
const struct clam_option __clam_options [ ] = {
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
/* name, longopt, sopt, argtype, regex, num, str, flags, owner, description, suggested */
/* cmdline only */
{ NULL , " help " , ' h ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_MILTER | OPT_CLAMCONF | OPT_CLAMDTOP | OPT_CLAMBC | OPT_CLAMONACC , " " , " " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ NULL , " config-file " , ' c ' , CLOPT_TYPE_STRING , NULL , 0 , CONST_CONFDIR_CLAMD , FLAG_REQUIRED , OPT_CLAMD | OPT_CLAMDSCAN | OPT_CLAMDTOP | OPT_CLAMONACC , " " , " " } ,
{ NULL , " config-file " , 0 , CLOPT_TYPE_STRING , NULL , 0 , CONST_CONFDIR_FRESHCLAM , FLAG_REQUIRED , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " config-file " , ' c ' , CLOPT_TYPE_STRING , NULL , 0 , CONST_CONFDIR_MILTER , FLAG_REQUIRED , OPT_MILTER , " " , " " } ,
{ NULL , " version " , ' V ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_MILTER | OPT_CLAMCONF | OPT_CLAMDTOP | OPT_CLAMBC | OPT_CLAMONACC , " " , " " } ,
{ NULL , " debug " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC | OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_SIGTOOL , " " , " " } ,
{ NULL , " gen-json " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN | OPT_SIGTOOL , " " , " " } ,
{ NULL , " verbose " , ' v ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_CLAMONACC , " " , " " } ,
{ NULL , " dumpcerts " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " Dump authenticode certificate chain. " , " " } ,
{ NULL , " quiet " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_CLAMONACC , " " , " " } ,
{ NULL , " leave-temps " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_SIGTOOL , " " , " " } ,
{ NULL , " no-warnings " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " show-progress " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " stdout " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_SIGTOOL | OPT_CLAMONACC , " " , " " } ,
{ NULL , " daemon " , ' d ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " no-dns " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " list-mirrors " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " update-db " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " " , " " } ,
{ NULL , " reload " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDSCAN , " " , " " } ,
{ NULL , " multiscan " , ' m ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " fdpass " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " stream " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " allmatch " , ' z ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " normalize " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMSCAN , " Perform HTML, script, and text normalization " , " " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ NULL , " database " , ' d ' , CLOPT_TYPE_STRING , NULL , - 1 , CONST_DATADIR , FLAG_REQUIRED | FLAG_MULTIPLE , OPT_CLAMSCAN , " " , " " } , /* merge it with DatabaseDirectory (and fix conflict with --datadir */
{ NULL , " recursive " , ' r ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " gen-mdb " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " Always generate MDB entries for PE sections " , " " } ,
{ NULL , " follow-dir-symlinks " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 1 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " follow-file-symlinks " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 1 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " bell " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " no-summary " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN , " " , " " } ,
{ NULL , " file-list " , ' f ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN , " " , " " } ,
{ NULL , " infected " , ' i ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " ping " , ' p ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " wait " , ' w ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " suppress-ok-results " , ' o ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " move " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " copy " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " remove " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " " , " " } ,
{ NULL , " exclude " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " exclude-dir " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " include " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " include-dir " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " structured-ssn-format " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
{ NULL , " hex-dump " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " md5 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " sha1 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " sha256 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " mdb " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " imp " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " fuzzy-img " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " print-certs " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " html-normalise " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " ascii-normalise " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " utf16-decode " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " build " , ' b ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " max-bad-sigs " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 3000 , NULL , 0 , OPT_SIGTOOL , " Maximum number of mismatched signatures when building a CVD. Zero disables this limit. " , " 3000 " } ,
{ NULL , " flevel " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CL_FLEVEL , NULL , 0 , OPT_SIGTOOL , " Feature level to put in the CVD " , " " } ,
{ NULL , " cvd-version " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_SIGTOOL , " Version number of the CVD to build " , " " } ,
{ NULL , " unsigned " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " no-cdiff " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " server " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " unpack " , ' u ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " unpack-current " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " info " , ' i ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ NULL , " list-sigs " , ' l ' , CLOPT_TYPE_STRING , NULL , - 1 , CONST_DATADIR , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " find-sigs " , ' f ' , CLOPT_TYPE_STRING , NULL , - 1 , CONST_DATADIR , FLAG_REQUIRED , OPT_SIGTOOL , " " , " " } ,
{ NULL , " decode-sigs " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " test-sigs " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " vba " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " vba-hex " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " diff " , ' d ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " compare " , ' c ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " run-cdiff " , ' r ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " verify-cdiff " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_SIGTOOL , " " , " " } ,
{ NULL , " hybrid " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_SIGTOOL , " Create a hybrid (standard and bytecode) database file " , " " } ,
{ NULL , " defaultcolors " , ' d ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMDTOP , " " , " " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ NULL , " config-dir " , ' c ' , CLOPT_TYPE_STRING , NULL , 0 , CONST_CONFDIR , FLAG_REQUIRED , OPT_CLAMCONF , " " , " " } ,
{ NULL , " non-default " , ' n ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMCONF , " " , " " } ,
{ NULL , " generate-config " , ' g ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMCONF , " " , " " } ,
{ NULL , " force-interpreter " , ' f ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC , " Force using the interpreter instead of the JIT " , " " } ,
{ NULL , " trust-bytecode " , ' t ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMBC , " Trust loaded bytecode (default yes) " , " " } ,
{ NULL , " info " , ' i ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC , " Load and print bytecode information without executing " , " " } ,
{ NULL , " printsrc " , ' p ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC , " Print source code of bytecode " , " " } ,
{ NULL , " printbcir " , ' c ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC , " Print IR of bytecode signature " , " " } ,
{ NULL , " input " , ' r ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMBC , " Input file to run the bytecode n " , " " } ,
{ NULL , " trace " , ' T ' , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 7 , NULL , 0 , OPT_CLAMBC , " bytecode trace level " , " " } ,
{ NULL , " no-trace-showsource " , ' s ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMBC , " Don't show source line during tracing " , " " } ,
{ NULL , " archive-verbose " , ' a ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN , " " , " " } ,
# ifdef _WIN32
{ NULL , " install-service " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM , " " , " " } ,
{ NULL , " uninstall-service " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM , " " , " " } ,
{ NULL , " daemon " , ' d ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " " , " " } ,
{ NULL , " service-mode " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM , " " , " " } ,
# endif
/* cmdline only - deprecated */
{ NULL , " bytecode-trust-all " , ' t ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " http-proxy " , 0 , CLOPT_TYPE_STRING , NULL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_DEPRECATED , " " , " " } ,
{ NULL , " proxy-user " , 0 , CLOPT_TYPE_STRING , NULL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_DEPRECATED , " " , " " } ,
{ NULL , " log-verbose " , 0 , CLOPT_TYPE_BOOL , NULL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_DEPRECATED , " " , " " } ,
{ NULL , " force " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " disable-summary " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " disable-archive " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-archive " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-pe " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-elf " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-ole2 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-pdf " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-html " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-mail " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-phishing-sigs " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-phishing-scan-urls " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-algorithmic " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " no-phishing-restrictedscan " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " max-ratio " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " max-space " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " unzip " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " unrar " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " arj " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " unzoo " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " lha " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " jar " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " tar " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " tgz " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ NULL , " deb " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " foo " , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
# ifdef _WIN32
{ NULL , " memory " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN , " " , " " } ,
{ NULL , " kill " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN , " " , " " } ,
{ NULL , " unload " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_CLAMDSCAN , " " , " " } ,
# endif
/* config file/cmdline options */
{ " AlertExceedsMax " , " alert-exceeds-max " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
{ " CacheSize " , " cache-size " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_CACHE_SIZE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Number of entries the cache can store. " , " 65536 " } ,
{ " PreludeEnable " , " prelude-enable " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Enable prelude " , " " } ,
{ " PreludeAnalyzerName " , " prelude-analyzer-name " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD , " Name of the analyzer as seen in prewikka " , " " } ,
{ " LogFile " , " log " , ' l ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_MILTER | OPT_CLAMSCAN | OPT_CLAMDSCAN | OPT_CLAMONACC , " Save all reports to a log file. " , " /tmp/clamav.log " } ,
{ " LogFileUnlock " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_MILTER , " By default the log file is locked for writing and only a single \n daemon process can write to it. This option disables the lock. " , " yes " } ,
{ " LogFileMaxSize " , NULL , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , 1048576 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Maximum size of the log file. \n Value of 0 disables the limit. " , " 5M " } ,
{ " LogTime " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Log time with each message. " , " yes " } ,
{ " LogClean " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Log all clean files. \n Useful in debugging but drastically increases the log size. " , " yes " } ,
{ " LogSyslog " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Use the system logger (can work together with LogFile). " , " yes " } ,
{ " LogFacility " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " LOG_LOCAL6 " , FLAG_REQUIRED , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Type of syslog messages. \n Please refer to 'man syslog' for the facility names. " , " LOG_MAIL " } ,
{ " LogVerbose " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Enable verbose logging. " , " yes " } ,
{ " LogRotate " , " log-rotate " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Rotate log file. Requires LogFileMaxSize option set prior to this option. " , " yes " } ,
{ " ExtendedDetectionInfo " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Log additional information about the infected file, such as its \n size and hash, together with the virus name. " , " yes " } ,
{ " PidFile " , " pid " , ' p ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER , " Save the process ID to a file. " , " /run/clamav/clam.pid " } ,
{ " TemporaryDirectory " , " tempdir " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_MILTER | OPT_CLAMSCAN | OPT_SIGTOOL , " This option allows you to change the default temporary directory. " , " /tmp " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ " DatabaseDirectory " , " datadir " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , CONST_DATADIR , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_SIGTOOL , " This option allows you to change the default database directory. \n If you enable it, please make sure it points to the same directory in \n both clamd and freshclam. " , " /var/lib/clamav " } ,
{ " OfficialDatabaseOnly " , " official-db-only " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Only load the official signatures published by the ClamAV project. " , " no " } ,
{ " FailIfCvdOlderThan " , " fail-if-cvd-older-than " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Return with a nonzero error code if the virus database is older than the specified number of days. " , " -1 " } ,
{ " YaraRules " , " yara-rules " , 0 , CLOPT_TYPE_STRING , NULL , 0 , NULL , 0 , OPT_CLAMSCAN , " By default, yara rules will be loaded. This option allows you to exclude yara rules when scanning and also to scan only using yara rules. Valid options are yes|no|only " , " yes " } ,
{ " LocalSocket " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD , " Path to a local socket file the daemon will listen on. " , " /run/clamav/clamd.sock " } ,
{ " LocalSocketGroup " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD , " Sets the group ownership on the unix socket. " , " virusgroup " } ,
{ " LocalSocketMode " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD , " Sets the permissions on the unix socket to the specified mode. " , " 660 " } ,
{ " FixStaleSocket " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_MILTER , " Remove a stale socket after unclean shutdown " , " yes " } ,
{ " TCPSocket " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_CLAMD , " A TCP port number the daemon will listen on. " , " 3310 " } ,
/* FIXME: add a regex for IP addr */
{ " TCPAddr " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " By default clamd binds to INADDR_ANY. \n This option allows you to restrict the TCP address and provide \n some degree of protection from the outside world. " , " localhost " } ,
{ " MaxConnectionQueueLength " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 200 , NULL , 0 , OPT_CLAMD , " Maximum length the queue of pending connections may grow to. " , " 30 " } ,
{ " StreamMaxLength " , NULL , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXFILESIZE , NULL , 0 , OPT_CLAMD , " Close the STREAM session when the data size limit is exceeded. \n The value should match your MTA's limit for the maximum attachment size. " , " 100M " } ,
{ " StreamMinPort " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 1024 , NULL , 0 , OPT_CLAMD , " The STREAM command uses an FTP-like protocol. \n This option sets the lower boundary for the port range. " , " 1024 " } ,
{ " StreamMaxPort " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 2048 , NULL , 0 , OPT_CLAMD , " This option sets the upper boundary for the port range. " , " 2048 " } ,
{ " MaxThreads " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 10 , NULL , 0 , OPT_CLAMD | OPT_MILTER , " Maximum number of threads running at the same time. " , " 20 " } ,
{ " ReadTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 120 , NULL , 0 , OPT_CLAMD , " This option specifies the time (in seconds) after which clamd should \n timeout if a client doesn't provide any data. " , " 120 " } ,
{ " CommandReadTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 30 , NULL , 0 , OPT_CLAMD , " This option specifies the time (in seconds) after which clamd should \n timeout if a client doesn't provide any initial command after connecting. " , " 30 " } ,
{ " SendBufTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 500 , NULL , 0 , OPT_CLAMD , " This option specifies how long to wait (in milliseconds) if the send buffer \n is full. Keep this value low to prevent clamd hanging. " , " 200 " } ,
{ " ReadTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 120 , NULL , 0 , OPT_MILTER , " Waiting for data from clamd will timeout after this time (seconds). " , " 300 " } ,
{ " MaxQueue " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 100 , NULL , 0 , OPT_CLAMD , " Maximum number of queued items (including those being processed by MaxThreads \n threads). It is recommended to have this value at least twice MaxThreads \n if possible. \n WARNING: you shouldn't increase this too much to avoid running out of file \n descriptors, the following condition should hold: \n MaxThreads*MaxRecursion + MaxQueue - MaxThreads + 6 < RLIMIT_NOFILE \n (usual max for RLIMIT_NOFILE is 1024) \n " , " 200 " } ,
{ " IdleTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 30 , NULL , 0 , OPT_CLAMD , " This option specifies how long (in seconds) the process should wait \n for a new job. " , " 60 " } ,
{ " ExcludePath " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " Don't scan files/directories whose names match the provided \n regular expression. This option can be specified multiple times. " , " ^/proc/ \n ^/sys/ " } ,
{ " MaxDirectoryRecursion " , " max-dir-recursion " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 15 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Maximum depth the directories are scanned at. " , " 15 " } ,
{ " FollowDirectorySymlinks " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Follow directory symlinks. " , " no " } ,
{ " FollowFileSymlinks " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Follow symlinks to regular files. " , " no " } ,
{ " CrossFilesystems " , " cross-fs " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Scan files and directories on other filesystems. " , " yes " } ,
{ " SelfCheck " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 600 , NULL , 0 , OPT_CLAMD , " This option specifies the time intervals (in seconds) in which clamd \n should perform a database check. " , " 600 " } ,
{ " ConcurrentDatabaseReload " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD , " Enable non-blocking (multi-threaded/concurrent) database reloads. This feature \n will temporarily load a second scanning engine while scanning continues using \n the first engine. Once loaded, the new engine takes over. The old engine is \n removed as soon as all scans using the old engine have completed. This feature \n requires more RAM, so this option is provided in case users are willing to \n block scans during reload in exchange for lower RAM requirements. " , " yes " } ,
{ " DisableCache " , " disable-cache " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option allows you to disable clamd's caching feature. " , " no " } ,
{ " VirusEvent " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD , " Execute a command when virus is found. \n Use the following environment variables to identify the file and virus names: \n - $CLAM_VIRUSEVENT_FILENAME \n - $CLAM_VIRUSEVENT_VIRUSNAME \n In the command string, '%v' will also be replaced with the virus name. \n Note: The '%f' filename format character has been disabled and will no longer \n be replaced with the file name, due to command injection security concerns. \n Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead. \n For the same reason, you should NOT use the environment variables in the \n command directly, but should use it carefully from your executed script. " , " /opt/send_virus_alert_sms.sh " } ,
{ " ExitOnOOM " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Stop the daemon when libclamav reports an out of memory condition. " , " yes " } ,
{ " AllowAllMatchScan " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD , " Permit use of the ALLMATCHSCAN command. " , " yes " } ,
{ " Foreground " , " foreground " , ' F ' , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER | OPT_CLAMONACC , " Don't fork into background. " , " no " } ,
{ " Debug " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM , " Enable debug messages in libclamav. " , " no " } ,
{ " LeaveTemporaryFiles " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Don't remove temporary files (for debugging purposes). " , " no " } ,
{ " GenerateMetadataJson " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Record metadata about the file being scanned. \n Scan metadata is useful for file analysis purposes and for debugging scan behavior. \n The JSON metadata will be printed after the scan is complete if Debug is enabled. \n A metadata.json file will be written to the scan temp directory if LeaveTemporaryFiles is enabled. " , " no " } ,
{ " User " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_MILTER , " Run the daemon as a specified user (the process must be started by root). " , " clamav " } ,
/* Scan options */
{ " Bytecode " , " bytecode " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled ClamAV will load bytecode from the database. It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses. " , " yes " } ,
{ " BytecodeSecurity " , NULL , 0 , CLOPT_TYPE_STRING , " ^(TrustSigned|Paranoid)$ " , - 1 , " TrustSigned " , 0 , OPT_CLAMD ,
" Set bytecode security level. \n Possible values: \n \t TrustSigned - trust bytecode loaded from signed .c[lv]d files, \n \t \t insert runtime safety checks for bytecode loaded from other sources \n \t Paranoid - don't trust any bytecode, insert runtime checks for all \n Recommended: TrustSigned, because bytecode in .cvd files already has these checks. " , " TrustSigned " } ,
{ " BytecodeTimeout " , " bytecode-timeout " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 10000 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN ,
" Set bytecode timeout in milliseconds. " , " 10000 " } ,
{ " BytecodeUnsigned " , " bytecode-unsigned " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN ,
" Allow loading bytecode from outside digitally signed .c[lv]d files. " , " no " } ,
{ " BytecodeMode " , " bytecode-mode " , 0 , CLOPT_TYPE_STRING , " ^(Auto|ForceJIT|ForceInterpreter|Test)$ " , - 1 , " Auto " , FLAG_REQUIRED , OPT_CLAMD | OPT_CLAMSCAN ,
" Set bytecode execution mode. \n Possible values: \n \t Auto - automatically choose JIT if possible, fallback to interpreter \n ForceJIT - always choose JIT, fail if not possible \n ForceInterpreter - always choose interpreter \n Test - run with both JIT and interpreter and compare results. Make all failures fatal. " , " Auto " } ,
{ " Statistics " , " statistics " , 0 , CLOPT_TYPE_STRING , " ^(none|None|bytecode|Bytecode|pcre|PCRE)$ " , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMSCAN | OPT_CLAMBC , " Collect and print execution statistics. \n Possible values: \n \t Bytecode - reports bytecode statistics \n PCRE - reports PCRE execution statistics \n None - reports no statistics " , " None " } ,
{ " DetectPUA " , " detect-pua " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Detect Potentially Unwanted Applications. " , " yes " } ,
{ " ExcludePUA " , " exclude-pua " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD | OPT_CLAMSCAN , " Exclude a specific PUA category. This directive can be used multiple times. \n See https://docs.clamav.net/faq/faq-pua.html for the complete list of PUA \n categories. " , " NetTool \n PWTool " } ,
{ " IncludePUA " , " include-pua " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD | OPT_CLAMSCAN , " Only include a specific PUA category. This directive can be used multiple \n times. " , " Spy \n Scanner \n RAT " } ,
{ " ScanPE " , " scan-pe " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " PE stands for Portable Executable - it's an executable file format used \n in all 32- and 64-bit versions of Windows operating systems. This option \n allows ClamAV to perform a deeper analysis of executable files and it's also \n required for decompression of popular executable packers such as UPX or FSG. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanELF " , " scan-elf " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Executable and Linking Format is a standard format for UN*X executables. \n This option allows you to control the scanning of ELF files. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanMail " , " scan-mail " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Enable the built in email scanner. \n If you turn off this option, the original files will still be scanned, but \n without parsing individual messages/attachments. " , " yes " } ,
{ " ScanPartialMessages " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Scan RFC1341 messages split over many emails. You will need to \n periodically clean up $TemporaryDirectory/clamav-partial directory. \n WARNING: This option may open your system to a DoS attack. Please don't use \n this feature on highly loaded servers. " , " no " } ,
{ " PhishingSignatures " , " phishing-sigs " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled ClamAV will try to detect phishing attempts by using \n signatures. " , " yes " } ,
{ " PhishingScanURLs " , " phishing-scan-urls " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Scan URLs found in mails for phishing attempts using heuristics. " , " yes " } ,
{ " HeuristicAlerts " , " heuristic-alerts " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " In some cases (eg. complex malware, exploits in graphic files, and others), \n ClamAV uses special algorithms to provide accurate detection. This option \n controls the algorithmic detection. " , " yes " } ,
{ " HeuristicScanPrecedence " , " heuristic-scan-precedence " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Allow heuristic match to take precedence. \n When enabled, if a heuristic scan (such as phishingScan) detects \n a possible virus/phish it will stop scan immediately. Recommended, saves CPU \n scan-time. \n When disabled, virus/phish detected by heuristic scans will be reported only \n at the end of a scan. If an archive contains both a heuristically detected \n virus/phish, and a real malware, the real malware will be reported. \n Keep this disabled if you intend to handle \" Heuristics.* \" viruses \n differently from \" real \" malware. \n If a non-heuristically-detected virus (signature-based) is found first, \n the scan is interrupted immediately, regardless of this config option. " , " yes " } ,
{ " StructuredDataDetection " , " detect-structured " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Enable the Data Loss Prevention module. " , " no " } ,
{ " StructuredMinCreditCardCount " , " structured-cc-count " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MIN_CC_COUNT , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the lowest number of Credit Card numbers found in a file \n to generate a detect. " , " 5 " } ,
{ " StructuredMinSSNCount " , " structured-ssn-count " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MIN_SSN_COUNT , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the lowest number of Social Security Numbers found \n in a file to generate a detect. " , " 5 " } ,
{ " StructuredSSNFormatNormal " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD , " With this option enabled the DLP module will search for valid \n SSNs formatted as xxx-yy-zzzz. " , " yes " } ,
{ " StructuredSSNFormatStripped " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " With this option enabled the DLP module will search for valid \n SSNs formatted as xxxyyzzzz " , " no " } ,
{ " ScanHTML " , " scan-html " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Perform HTML/JavaScript/ScriptEncoder normalisation and decryption. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanOLE2 " , " scan-ole2 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning of OLE2 files, such as Microsoft Office \n documents and .msi files. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
GIF, PNG bugfixes; Add AlertBrokenMedia option
Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files.
To enable this feature, set `AlertBrokenMedia yes` in clamd.conf, or
use the `--alert-broken-media` option when using `clamscan`.
These options are disabled by default for now.
Application developers may enable this scan option by enabling
`CL_SCAN_HEURISTIC_BROKEN_MEDIA` for the `heuristic` scan option bit
field.
Fixed PNG parser logic bugs that caused an excess of parsing errors
and fixed a stack exhaustion issue affecting some systems when
scanning PNG files. PNG file type detection was disabled via
signature database update for 0.103.0 to mitigate effects from these
bugs.
Fixed an issue where PNG and GIF files no longer work with Target:5
(graphics) signatures if detected as CL_TYPE_PNG/GIF rather than as
CL_TYPE_GRAPHICS. Target types now support up to 10 possible file
types to make way for additional graphics types in future releases.
Scanning JPEG, TIFF, PNG, and GIF files will no longer return "parse"
errors when file format validation fails. Instead, the scan will alert
with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media"
feature is enabled.
GIF format validation will no longer fail if the GIF image is missing
the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIF files.
Added a TIFF dynamic configuration (DCONF) option, which was missing.
This will allow us to disable TIFF format validation via signature
database update in the event that it proves to be problematic.
This feature already exists for many other file types.
Added CL_TYPE_JPEG and CL_TYPE_TIFF types.
5 years ago
{ " AlertBrokenExecutables " , " alert-broken " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled clamav will try to detect broken executables \n (PE, ELF, & Mach-O) and alert on them with a Broken.Executable heuristic signature. " , " yes " } ,
{ " AlertBrokenMedia " , " alert-broken-media " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled clamav will try to detect broken media files \n (JPEG, TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature. " , " yes " } ,
{ " AlertEncrypted " , " alert-encrypted " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). " , " no " } ,
{ " StructuredCCOnly " , " structured-cc-mode " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled the DLP module will search for valid Credit Card \n numbers only. Debit and Private Label cards will not be searched. " , " no " } ,
{ " AlertEncryptedArchive " , " alert-encrypted-archive " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on encrypted archives (encrypted .zip, .7zip, .rar). " , " no " } ,
{ " AlertEncryptedDoc " , " alert-encrypted-doc " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on encrypted documents (encrypted .pdf). " , " no " } ,
{ " AlertOLE2Macros " , " alert-macros " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled OLE2 files with VBA macros, which were not \n detected by signatures will be marked as \" Heuristics.OLE2.ContainsMacros \" . " , " no " } ,
{ " AlertPhishingSSLMismatch " , " alert-phishing-ssl " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on SSL mismatches in URLs, even if they're not in the database. \n This feature can lead to false positives. " , " " } ,
{ " AlertPhishingCloak " , " alert-phishing-cloak " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on cloaked URLs, even if they're not in the database. \n This feature can lead to false positives. " , " no " } ,
{ " AlertPartitionIntersection " , " alert-partition-intersection " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Alert on raw DMG image files containing partition intersections. " , " yes " } ,
{ " ScanPDF " , " scan-pdf " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning within PDF files. \n If you turn off this option, the original files will still be scanned, but \n without decoding and additional processing. " , " yes " } ,
{ " ScanSWF " , " scan-swf " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning within SWF files. \n If you turn off this option, the original files will still be scanned, but \n without decoding and additional processing. " , " yes " } ,
{ " ScanXMLDOCS " , " scan-xmldocs " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning xml-based document files supported by libclamav. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanHWP3 " , " scan-hwp3 " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning HWP3 files. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanOneNote " , " scan-onenote " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning OneNote files. \n If you turn off this option, the original files will still be scanned, but \n without additional processing. " , " yes " } ,
{ " ScanArchive " , " scan-archive " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Scan within archives and compressed files. \n If you turn off this option, the original files will still be scanned, but \n without unpacking and additional processing. " , " yes " } ,
{ " ScanImage " , " scan-image " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables scanning of image (graphics). \n If you turn off this option, the original files will still be scanned, but without additional processing. " , " yes " } ,
{ " ScanImageFuzzyHash " , " scan-image-fuzzy-hash " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option enables detection by calculating a fuzzy hash of image (graphics) \n files \n Signatures using image fuzzy hashes typically match files and documents by \n identifying images embedded or attached to those files. \n If you turn off this option, then some files may no longer be detected. " , " yes " } ,
{ " ForceToDisk " , " force-to-disk " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option causes memory or nested map scans to dump the content to disk. \n If you turn on this option, more data is written to disk and is available \n when the leave-temps option is enabled at the cost of more disk writes. " , " no " } ,
{ " MaxScanTime " , " max-scantime " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum amount of time a scan may take to complete. \n The value of 0 disables the limit. \n WARNING: disabling this limit or setting it too high may result allow scanning \n of certain files to lock up the scanning process/threads resulting in a Denial of Service. \n The value is in milliseconds. " , " 120000 " } ,
{ " MaxScanSize " , " max-scansize " , 0 , CLOPT_TYPE_SIZE64 , MATCH_SIZE , CLI_DEFAULT_MAXSCANSIZE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum amount of data to be scanned for each input file. \n Archives and other containers are recursively extracted and scanned up to this \n value. \n The value of 0 disables the limit. \n WARNING: disabling this limit or setting it too high may result in severe \n damage. " , " 400M " } ,
{ " MaxFileSize " , " max-filesize " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXFILESIZE , NULL , 0 , OPT_CLAMD | OPT_MILTER | OPT_CLAMSCAN , " Files/messages larger than this limit won't be scanned. Affects the input \n file itself as well as files contained inside it (when the input file is \n an archive, a document or some other kind of container). \n The value of 0 disables the limit. \n WARNING: disabling this limit or setting it too high may result in severe \n damage to the system. " , " 100M " } ,
libclamav: Fix scan recursion tracking
Scan recursion is the process of identifying files embedded in other
files and then scanning them, recursively.
Internally this process is more complex than it may sound because a file
may have multiple layers of types before finding a new "file".
At present we treat the recursion count in the scanning context as an
index into both our fmap list AND our container list. These two lists
are conceptually a part of the same thing and should be unified.
But what's concerning is that the "recursion level" isn't actually
incremented or decremented at the same time that we add a layer to the
fmap or container lists but instead is more touchy-feely, increasing
when we find a new "file".
To account for this shadiness, the size of the fmap and container lists
has always been a little longer than our "max scan recursion" limit so
we don't accidentally overflow the fmap or container arrays (!).
I've implemented a single recursion-stack as an array, similar to before,
which includes a pointer to each fmap at each layer, along with the size
and type. Push and pop functions add and remove layers whenever a new
fmap is added. A boolean argument when pushing indicates if the new layer
represents a new buffer or new file (descriptor). A new buffer will reset
the "nested fmap level" (described below).
This commit also provides a solution for an issue where we detect
embedded files more than once during scan recursion.
For illustration, imagine a tarball named foo.tar.gz with this structure:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| foo.tar.gz | GZ | 0 | 0 |
| └── foo.tar | TAR | 1 | 0 |
| ├── bar.zip | ZIP | 2 | 1 |
| │ └── hola.txt | ASCII | 3 | 0 |
| └── baz.exe | PE | 2 | 1 |
But suppose baz.exe embeds a ZIP archive and a 7Z archive, like this:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| baz.exe | PE | 0 | 0 |
| ├── sfx.zip | ZIP | 1 | 1 |
| │ └── hello.txt | ASCII | 2 | 0 |
| └── sfx.7z | 7Z | 1 | 1 |
| └── world.txt | ASCII | 2 | 0 |
(A) If we scan for embedded files at any layer, we may detect:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| foo.tar.gz | GZ | 0 | 0 |
| ├── foo.tar | TAR | 1 | 0 |
| │ ├── bar.zip | ZIP | 2 | 1 |
| │ │ └── hola.txt | ASCII | 3 | 0 |
| │ ├── baz.exe | PE | 2 | 1 |
| │ │ ├── sfx.zip | ZIP | 3 | 1 |
| │ │ │ └── hello.txt | ASCII | 4 | 0 |
| │ │ └── sfx.7z | 7Z | 3 | 1 |
| │ │ └── world.txt | ASCII | 4 | 0 |
| │ ├── sfx.zip | ZIP | 2 | 1 |
| │ │ └── hello.txt | ASCII | 3 | 0 |
| │ └── sfx.7z | 7Z | 2 | 1 |
| │ └── world.txt | ASCII | 3 | 0 |
| ├── sfx.zip | ZIP | 1 | 1 |
| └── sfx.7z | 7Z | 1 | 1 |
(A) is bad because it scans content more than once.
Note that for the GZ layer, it may detect the ZIP and 7Z if the
signature hits on the compressed data, which it might, though
extracting the ZIP and 7Z will likely fail.
The reason the above doesn't happen now is that we restrict embedded
type scans for a bunch of archive formats to include GZ and TAR.
(B) If we scan for embedded files at the foo.tar layer, we may detect:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| foo.tar.gz | GZ | 0 | 0 |
| └── foo.tar | TAR | 1 | 0 |
| ├── bar.zip | ZIP | 2 | 1 |
| │ └── hola.txt | ASCII | 3 | 0 |
| ├── baz.exe | PE | 2 | 1 |
| ├── sfx.zip | ZIP | 2 | 1 |
| │ └── hello.txt | ASCII | 3 | 0 |
| └── sfx.7z | 7Z | 2 | 1 |
| └── world.txt | ASCII | 3 | 0 |
(B) is almost right. But we can achieve it easily enough only scanning for
embedded content in the current fmap when the "nested fmap level" is 0.
The upside is that it should safely detect all embedded content, even if
it may think the sfz.zip and sfx.7z are in foo.tar instead of in baz.exe.
The biggest risk I can think of affects ZIPs. SFXZIP detection
is identical to ZIP detection, which is why we don't allow SFXZIP to be
detected if insize of a ZIP. If we only allow embedded type scanning at
fmap-layer 0 in each buffer, this will fail to detect the embedded ZIP
if the bar.exe was not compressed in foo.zip and if non-compressed files
extracted from ZIPs aren't extracted as new buffers:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| foo.zip | ZIP | 0 | 0 |
| └── bar.exe | PE | 1 | 1 |
| └── sfx.zip | ZIP | 2 | 2 |
Provided that we ensure all files extracted from zips are scanned in
new buffers, option (B) should be safe.
(C) If we scan for embedded files at the baz.exe layer, we may detect:
| description | type | rec level | nested fmap level |
| ------------------------- | ----- | --------- | ----------------- |
| foo.tar.gz | GZ | 0 | 0 |
| └── foo.tar | TAR | 1 | 0 |
| ├── bar.zip | ZIP | 2 | 1 |
| │ └── hola.txt | ASCII | 3 | 0 |
| └── baz.exe | PE | 2 | 1 |
| ├── sfx.zip | ZIP | 3 | 1 |
| │ └── hello.txt | ASCII | 4 | 0 |
| └── sfx.7z | 7Z | 3 | 1 |
| └── world.txt | ASCII | 4 | 0 |
(C) is right. But it's harder to achieve. For this example we can get it by
restricting 7ZSFX and ZIPSFX detection only when scanning an executable.
But that may mean losing detection of archives embedded elsewhere.
And we'd have to identify allowable container types for each possible
embedded type, which would be very difficult.
So this commit aims to solve the issue the (B)-way.
Note that in all situations, we still have to scan with file typing
enabled to determine if we need to reassign the current file type, such
as re-identifying a Bzip2 archive as a DMG that happens to be Bzip2-
compressed. Detection of DMG and a handful of other types rely on
finding data partway through or near the ned of a file before
reassigning the entire file as the new type.
Other fixes and considerations in this commit:
- The utf16 HTML parser has weak error handling, particularly with respect
to creating a nested fmap for scanning the ascii decoded file.
This commit cleans up the error handling and wraps the nested scan with
the recursion-stack push()/pop() for correct recursion tracking.
Before this commit, each container layer had a flag to indicate if the
container layer is valid.
We need something similar so that the cli_recursion_stack_get_*()
functions ignore normalized layers. Details...
Imagine an LDB signature for HTML content that specifies a ZIP
container. If the signature actually alerts on the normalized HTML and
you don't ignore normalized layers for the container check, it will
appear as though the alert is in an HTML container rather than a ZIP
container.
This commit accomplishes this with a boolean you set in the scan context
before scanning a new layer. Then when the new fmap is created, it will
use that flag to set similar flag for the layer. The context flag is
reset those that anything after this doesn't have that flag.
The flag allows the new recursion_stack_get() function to ignore
normalized layers when iterating the stack to return a layer at a
requested index, negative or positive.
Scanning normalized extracted/normalized javascript and VBA should also
use the 'layer is normalized' flag.
- This commit also fixes Heuristic.Broken.Executable alert for ELF files
to make sure that:
A) these only alert if cli_append_virus() returns CL_VIRUS (aka it
respects the FP check).
B) all broken-executable alerts for ELF only happen if the
SCAN_HEURISTIC_BROKEN option is enabled.
- This commit also cleans up the error handling in cli_magic_scan_dir().
This was needed so we could correctly apply the layer-is-normalized-flag
to all VBA macros extracted to a directory when scanning the directory.
- Also fix an issue where exceeding scan maximums wouldn't cause embedded
file detection scans to abort. Granted we don't actually want to abort
if max filesize or max recursion depth are exceeded... only if max
scansize, max files, and max scantime are exceeded.
Add 'abort_scan' flag to scan context, to protect against depending on
correct error propagation for fatal conditions. Instead, setting this
flag in the scan context should guarantee that a fatal condition deep in
scan recursion isn't lost which result in more stuff being scanned
instead of aborting. This shouldn't be necessary, but some status codes
like CL_ETIMEOUT never used to be fatal and it's easier to do this than
to verify every parser only returns CL_ETIMEOUT and other "fatal
status codes" in fatal conditions.
- Remove duplicate is_tar() prototype from filestypes.c and include
is_tar.h instead.
- Presently we create the fmap hash when creating the fmap.
This wastes a bit of CPU if the hash is never needed.
Now that we're creating fmap's for all embedded files discovered with
file type recognition scans, this is a much more frequent occurence and
really slows things down.
This commit fixes the issue by only creating fmap hashes as needed.
This should not only resolve the perfomance impact of creating fmap's
for all embedded files, but also should improve performance in general.
- Add allmatch check to the zip parser after the central-header meta
match. That way we don't multiple alerts with the same match except in
allmatch mode. Clean up error handling in the zip parser a tiny bit.
- Fixes to ensure that the scan limits such as scansize, filesize,
recursion depth, # of embedded files, and scantime are always reported
if AlertExceedsMax (--alert-exceeds-max) is enabled.
- Fixed an issue where non-fatal alerts for exceeding scan maximums may
mask signature matches later on. I changed it so these alerts use the
"possibly unwanted" alert-type and thus only alert if no other alerts
were found or if all-match or heuristic-precedence are enabled.
- Added the "Heuristics.Limits.Exceeded.*" events to the JSON metadata
when the --gen-json feature is enabled. These will show up once under
"ParseErrors" the first time a limit is exceeded. In the present
implementation, only one limits-exceeded events will be added, so as to
prevent a malicious or malformed sample from filling the JSON buffer
with millions of events and using a tonne of RAM.
4 years ago
{ " MaxRecursion " , " max-recursion " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MAXRECLEVEL , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR \n file, all files within it will also be scanned. This option specifies how \n deeply the process should be continued. \n The value of 0 disables the limit. \n WARNING: disabling this limit or setting it too high may result in severe \n damage to the system. " , " 17 " } ,
{ " MaxFiles " , " max-files " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MAXFILES , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Number of files to be scanned within an archive, a document, or any other \n container file. \n The value of 0 disables the limit. \n WARNING: disabling this limit or setting it too high may result in severe \n damage to the system. " , " 10000 " } ,
/* Engine maximums */
{ " MaxEmbeddedPE " , " max-embeddedpe " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXEMBEDDEDPE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum size of a file to check for embedded PE. \n Files larger than this value will skip the additional analysis step. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 40M " } ,
{ " MaxHTMLNormalize " , " max-htmlnormalize " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXHTMLNORMALIZE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum size of a HTML file to normalize. \n HTML files larger than this value will not be normalized or scanned. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 40M " } ,
{ " MaxHTMLNoTags " , " max-htmlnotags " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXHTMLNOTAGS , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum size of a normalized HTML file to scan. \n HTML files larger than this value after normalization will not be scanned. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 8M " } ,
{ " MaxScriptNormalize " , " max-scriptnormalize " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXSCRIPTNORMALIZE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum size of a script file to normalize. \n Script content larger than this value will not be normalized or scanned. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 20M " } ,
{ " MaxZipTypeRcg " , " max-ziptypercg " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_MAXZIPTYPERCG , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum size of a ZIP file to reanalyze type recognition. \n ZIP files larger than this value will skip the step to potentially reanalyze as PE. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 1M " } ,
{ " MaxPartitions " , " max-partitions " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MAXPARTITIONS , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum number of partitions of a raw disk image to be scanned. \n Raw disk images with more partitions than this value will have up to the value number partitions scanned. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 128 " } ,
{ " MaxIconsPE " , " max-iconspe " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MAXICONSPE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum number of icons within a PE to be scanned. \n PE files with more icons than this value will have up to the value number icons scanned. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 100 " } ,
{ " MaxRecHWP3 " , " max-rechwp3 " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_MAXRECHWP3 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum recursive calls to HWP3 parsing function. \n HWP3 files using more than this limit will be terminated and alert the user. \n Scans will be unable to scan any HWP3 attachments if the recursive limit is reached. \n Negative values are not allowed. \n WARNING: setting this limit too high may result in severe damage or impact performance. " , " 16 " } ,
{ " PCREMatchLimit " , " pcre-match-limit " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_PCRE_MATCH_LIMIT , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum calls to the PCRE match function during an instance of regex matching. \n Instances using more than this limit will be terminated and alert the user but the scan will continue. \n For more information on match_limit, see the PCRE documentation. \n Negative values are not allowed. \n WARNING: setting this limit too high may severely impact performance. " , " 100000 " } ,
{ " PCRERecMatchLimit " , " pcre-recmatch-limit " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , CLI_DEFAULT_PCRE_RECMATCH_LIMIT , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum recursive calls to the PCRE match function during an instance of regex matching. \n Instances using more than this limit will be terminated and alert the user but the scan will continue. \n For more information on match_limit_recursion, see the PCRE documentation. \n Negative values are not allowed and values > PCREMatchLimit are superfluous. \n WARNING: setting this limit too high may severely impact performance. " , " 5000 " } ,
{ " PCREMaxFileSize " , " pcre-max-filesize " , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , CLI_DEFAULT_PCRE_MAX_FILESIZE , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " This option sets the maximum filesize for which PCRE subsigs will be executed. \n Files exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer. \n Negative values are not allowed. \n Setting this value to zero disables the limit. \n WARNING: setting this limit too high or disabling it may severely impact performance. " , " 100M " } ,
/* OnAccess settings */
{ " OnAccessMountPath " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " This option specifies a directory or mount point which should be scanned on access. The mount point specified, or the mount point containing the specified directory will be watched, but only notifications will occur. If any directories are specified, this option will preempt the DDD system. It can also be used multiple times. " , " / \n /home/user " } ,
{ " OnAccessIncludePath " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " This option specifies a directory (including all files and directories \n inside it), which should be scanned on access. This option can \n be used multiple times. " , " /home \n /students " } ,
{ " OnAccessExcludePath " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " This option allows excluding directories from on-access scanning. It can \n be used multiple times. Only works with DDD system. " , " /home/bofh \n /root " } ,
{ " OnAccessExcludeRootUID " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_CLAMD , " Use this option to exclude the root UID (0) and allow any processes run under root to access all watched files without triggering scans. " , " no " } ,
{ " OnAccessExcludeUID " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " With this option you can exclude specific UIDs. Processes with these UIDs \n will be able to access all files. \n This option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To exclude the root UID please enable the OnAccessExcludeRootUID option. " , " 0 " } ,
{ " OnAccessExcludeUname " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_CLAMD , " This option allows exclusions via user names when using the on-access scanning client. It can \n be used multiple times. " , " clamuser " } ,
{ " OnAccessMaxFileSize " , NULL , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , 5242880 , NULL , 0 , OPT_CLAMD , " Files larger than this value will not be scanned in on access. " , " 5M " } ,
{ " OnAccessDisableDDD " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " This option toggles the dynamic directory determination system for on-access scanning (Linux only). " , " no " } ,
{ " OnAccessPrevention " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " This option changes fanotify behavior to prevent access attempts on malicious files instead of simply notifying the user (On Access scan only). " , " yes " } ,
{ " OnAccessExtraScanning " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " Enables extra scanning and notification after catching certain inotify events. Only works with the DDD system enabled. " , " yes " } ,
{ " OnAccessCurlTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 5000l , NULL , 0 , OPT_CLAMD , " Max amount of time (in milliseconds) that the OnAccess client should spend for every connect, send, and receive attempt when communicating with clamd via curl (5s default) " , " 10000L " } ,
{ " OnAccessMaxThreads " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 5 , NULL , 0 , OPT_CLAMD , " Max number of scanning threads to allocate to the OnAccess thread pool at startup--these threads are the ones responsible for creating a connection with the daemon and kicking off scanning after an event has been processed. To prevent clamonacc from consuming all clamd's resources keep this lower than clamd's max threads. Default is 5 " , " 10 " } ,
{ " OnAccessRetryAttempts " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_CLAMD , " Number of times the OnAccess client will retry a failed scan due to connection problems (or other issues). Defaults to no retries. " , " 3 " } ,
{ " OnAccessDenyOnError " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD , " When using prevention, if this option is turned on, any errors that occur during scanning will result in the event attempt being denied. This could potentially lead to unwanted system behaviour with certain configurations, so the client defaults to off and allowing access events in case of error. " , " yes " } ,
/* clamonacc cmdline options */
{ NULL , " watch-list " , ' W ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMONACC , " " , " " } ,
{ NULL , " exclude-list " , ' e ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_CLAMONACC , " " , " " } ,
/* FIXME: mark these as private and don't output into clamd.conf/man */
{ " DevACOnly " , " dev-ac-only " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , FLAG_HIDDEN , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
{ " DevACDepth " , " dev-ac-depth " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , FLAG_HIDDEN , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
# ifdef HAVE__INTERNAL__SHA_COLLECT
{ " DevCollectHashes " , " dev-collect-hashes " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , FLAG_HIDDEN , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
# endif
{ " DevPerformance " , " dev-performance " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , FLAG_HIDDEN , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
{ " DevLiblog " , " dev-liblog " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , FLAG_HIDDEN , OPT_CLAMD , " " , " " } ,
/* FreshClam-only entries */
/* FIXME: drop this entry and use LogFile */
{ " UpdateLogFile " , " log " , ' l ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " Save all reports to a log file. " , " /var/log/freshclam.log " } ,
{ " DatabaseOwner " , " user " , ' u ' , CLOPT_TYPE_STRING , NULL , - 1 , CLAMAVUSER , FLAG_REQUIRED , OPT_FRESHCLAM , " When started by root freshclam will drop privileges and switch to the user \n defined in this option. " , CLAMAVUSER } ,
{ " Checks " , " checks " , ' c ' , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 12 , NULL , 0 , OPT_FRESHCLAM , " This option defined how many times daily freshclam should check for \n a database update. " , " 24 " } ,
{ " DNSDatabaseInfo " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , " current.cvd.clamav.net " , FLAG_REQUIRED , OPT_FRESHCLAM , " Use DNS to verify the virus database version. FreshClam uses DNS TXT records \n to verify the versions of the database and software itself. With this \n directive you can change the database verification domain. \n WARNING: Please don't change it unless you're configuring freshclam to use \n your own database verification domain. " , " current.cvd.clamav.net " } ,
{ " DatabaseMirror " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " DatabaseMirror specifies to which mirror(s) freshclam should connect. \n You should have at least one entry: database.clamav.net. " , " database.clamav.net " } ,
{ " PrivateMirror " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " This option allows you to easily point freshclam to private mirrors. \n If PrivateMirror is set, freshclam does not attempt to use DNS \n to determine whether its databases are out-of-date, instead it will \n use the If-Modified-Since request or directly check the headers of the \n remote database files. For each database, freshclam first attempts \n to download the CLD file. If that fails, it tries to download the \n CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo \n and Scripted Updates. It can be used multiple times to provide \n fall-back mirrors. " , " mirror1.mynetwork.com \n mirror2.mynetwork.com " } ,
{ " MaxAttempts " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 3 , NULL , 0 , OPT_FRESHCLAM , " This option defines how many attempts freshclam should make before giving up. " , " 5 " } ,
{ " ScriptedUpdates " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_FRESHCLAM , " With this option you can control scripted updates. It's highly recommended to keep them enabled. " , " yes " } ,
{ " TestDatabases " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_FRESHCLAM , " With this option enabled, freshclam will attempt to load new \n databases into memory to make sure they are properly handled \n by libclamav before replacing the old ones. Tip: This feature uses a lot of RAM. If your system has limited RAM and you are actively running ClamD or ClamScan during the update, then you may need to set `TestDatabases no`. " , " yes " } ,
{ " CompressLocalDatabase " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM , " By default freshclam will keep the local databases (.cld) uncompressed to \n make their handling faster. With this option you can enable the compression. \n The change will take effect with the next database update. " , " " } ,
{ " ExtraDatabase " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " Include an optional signature databases (opt-in). This option can be used multiple times. " , " dbname1 \n dbname2 " } ,
{ " ExcludeDatabase " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " Exclude a standard signature database (opt-out). This option can be used multiple times. " , " dbname1 \n dbname2 " } ,
{ " DatabaseCustomURL " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_FRESHCLAM , " With this option you can provide custom sources (http:// or file://) for database files. \n This option can be used multiple times. " , " http://myserver.com/mysigs.ndb \n file:///mnt/nfs/local.hdb " } ,
{ " HTTPProxyServer " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " If you're behind a proxy, please enter its address here. " , " your-proxy " } ,
{ " HTTPProxyPort " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_FRESHCLAM , " HTTP proxy's port " , " 8080 " } ,
{ " HTTPProxyUsername " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " A user name for the HTTP proxy authentication. " , " username " } ,
{ " HTTPProxyPassword " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " A password for the HTTP proxy authentication. " , " pass " } ,
{ " HTTPUserAgent " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " If your servers are behind a firewall/proxy which does a User-Agent \n filtering you can use this option to force the use of a different \n User-Agent header. " , " default " } ,
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
{ " NotifyClamd " , " daemon-notify " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , CONST_CONFDIR_CLAMD , 0 , OPT_FRESHCLAM , " Send the RELOAD command to clamd after a successful update. " , " yes " } ,
{ " OnUpdateExecute " , " on-update-execute " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " Run a command after a successful database update. Use EXIT_1 to return 1 after successful database update. " , " command " } ,
{ " OnErrorExecute " , " on-error-execute " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " Run a command when a database update error occurs. " , " command " } ,
{ " OnOutdatedExecute " , " on-outdated-execute " , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " Run a command when freshclam reports an outdated version. \n In the command string %v will be replaced with the new version number. " , " command " } ,
/* FIXME: MATCH_IPADDR */
{ " LocalIPAddress " , " local-address " , ' a ' , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_FRESHCLAM , " With this option you can provide a client address for the database downloading. \n Useful for multi-homed systems. " , " aaa.bbb.ccc.ddd " } ,
{ " ConnectTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 30 , NULL , 0 , OPT_FRESHCLAM , " Timeout in seconds when connecting to database server. " , " 30 " } ,
{ " ReceiveTimeout " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 60 , NULL , 0 , OPT_FRESHCLAM , " Timeout in seconds when reading from database server. 0 means no timeout. " , " 60 " } ,
{ " Bytecode " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_FRESHCLAM , " This option enables downloading of bytecode.cvd, which includes additional \n detection mechanisms and improvements to the ClamAV engine. " , " yes " } ,
{ " DisableCertCheck " , " nocerts " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Disable authenticode certificate chain verification in PE files. " , " no " } ,
/* Deprecated options */
{ " SafeBrowsing " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_FRESHCLAM | OPT_DEPRECATED , " Deprecated option to download signatures derived from the Google Safe Browsing API. See https://blog.clamav.net/2020/06/the-future-of-clamav-safebrowsing.html for more details. " , " no " } ,
{ " TimeLimit " , " timelimit " , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , 0 , NULL , 0 , OPT_CLAMSCAN | OPT_DEPRECATED , " Deprecated option to set the max-scantime. \n The value is in milliseconds. " , " 120000 " } ,
{ " DetectBrokenExecutables " , " detect-broken " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED , " Deprecated option to alert on broken PE and ELF executable files. " , " no " } ,
{ " AlgorithmicDetection " , " algorithmic-detection " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Deprecated option to enable heuristic alerts (e.g. \" Heuristics.<sig name> \" ) " , " no " } ,
{ " BlockMax " , " block-max " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " " , " " } ,
{ " PhishingAlwaysBlockSSLMismatch " , " phishing-ssl " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database. \n This feature can lead to false positives. " , " no " } ,
{ " PhishingAlwaysBlockCloak " , " phishing-cloak " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Deprecated option to alert on cloaked URLs, even if they're not in the database. \n This feature can lead to false positives. " , " no " } ,
{ " PartitionIntersection " , " partition-intersection " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Deprecated option to alert on raw DMG image files containing partition intersections. " , " no " } ,
{ " OLE2BlockMacros " , " block-macros " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " With this option enabled OLE2 files with VBA macros, which were not \n detected by signatures will be marked as \" Heuristics.OLE2.ContainsMacros \" . " , " no " } ,
{ " ArchiveBlockEncrypted " , " block-encrypted " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN , " Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). " , " no " } ,
{ " MailMaxRecursion " , NULL , 0 , CLOPT_TYPE_NUMBER , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveMaxScanSize " , NULL , 0 , CLOPT_TYPE_SIZE , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveMaxRecursion " , NULL , 0 , CLOPT_TYPE_NUMBER , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveMaxFiles " , NULL , 0 , CLOPT_TYPE_NUMBER , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveMaxCompressionRatio " , NULL , 0 , CLOPT_TYPE_NUMBER , NULL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveBlockMax " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " ArchiveLimitMemoryUsage " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
{ " MailFollowURLs " , " mail-follow-urls " , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED , " " , " " } ,
{ " AllowSupplementaryGroups " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER | OPT_DEPRECATED , " Initialize a supplementary group access (the process must be started by root). " , " no " } ,
{ " ScanOnAccess " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_CLAMD | OPT_DEPRECATED , " " , " " } ,
/* Milter specific options */
{ " ClamdSocket " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_MILTER , " Define the clamd socket to connect to for scanning. \n This option is mandatory! Syntax: \n ClamdSocket unix:path \n ClamdSocket tcp:host:port \n The first syntax specifies a local unix socket (needs an absolute path) e.g.: \n ClamdSocket unix:/run/clamav/clamd.sock \n The second syntax specifies a tcp local or remote tcp socket: the \n host can be a hostname or an ip address; the \" :port \" field is only required \n for IPv6 addresses, otherwise it defaults to 3310 \n ClamdSocket tcp:192.168.0.1 \n This option can be repeated several times with different sockets or even \n with the same socket: clamd servers will be selected in a round-robin fashion. " , " tcp:scanner.mydomain:7357 " } ,
{ " MilterSocket " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Define the interface through which we communicate with sendmail. \n This option is mandatory! Possible formats are: \n [[unix|local]:]/path/to/file - to specify a unix domain socket; \n inet:port@[hostname|ip-address] - to specify an ipv4 socket; \n inet6:port@[hostname|ip-address] - to specify an ipv6 socket. " , " /tmp/clamav-milter.sock \n inet:7357 " } ,
{ " MilterSocketGroup " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Define the group ownership for the (unix) milter socket. " , " virusgroup " } ,
{ " MilterSocketMode " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Sets the permissions on the (unix) milter socket to the specified mode. " , " 660 " } ,
{ " LocalNet " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , FLAG_MULTIPLE , OPT_MILTER , " Messages originating from these hosts/networks will not be scanned \n This option takes a host(name)/mask pair in CIRD notation and can be \n repeated several times. If \" /mask \" is omitted, a host is assumed. \n To specify a locally originated, non-smtp, email use the keyword \" local \" . " , " local \n 192.168.0.0/24 \n 1111:2222:3333::/48 " } ,
{ " OnClean " , NULL , 0 , CLOPT_TYPE_STRING , " ^(Accept|Reject|Defer|Blackhole|Quarantine)$ " , - 1 , " Accept " , 0 , OPT_MILTER , " Action to be performed on clean messages (mostly useful for testing). \n The following actions are available: \n Accept: the message is accepted for delivery \n Reject: immediately refuse delivery (a 5xx error is returned to the peer) \n Defer: return a temporary failure message (4xx) to the peer \n Blackhole: like Accept but the message is sent to oblivion \n Quarantine: like Accept but message is quarantined instead of being delivered " , " Accept " } ,
{ " OnInfected " , NULL , 0 , CLOPT_TYPE_STRING , " ^(Accept|Reject|Defer|Blackhole|Quarantine)$ " , - 1 , " Quarantine " , 0 , OPT_MILTER , " Action to be performed on clean messages (mostly useful for testing). \n The following actions are available: \n Accept: the message is accepted for delivery \n Reject: immediately refuse delivery (a 5xx error is returned to the peer) \n Defer: return a temporary failure message (4xx) to the peer \n Blackhole: like Accept but the message is sent to oblivion \n Quarantine: like Accept but message is quarantined instead of being delivered " , " Quarantine " } ,
{ " OnFail " , NULL , 0 , CLOPT_TYPE_STRING , " ^(Accept|Reject|Defer)$ " , - 1 , " Defer " , 0 , OPT_MILTER , " Action to be performed on error conditions (this includes failure to \n allocate data structures, no scanners available, network timeouts, unknown \n scanner replies and the like. \n The following actions are available: \n Accept: the message is accepted for delivery; \n Reject: immediately refuse delivery (a 5xx error is returned to the peer); \n Defer: return a temporary failure message (4xx) to the peer. " , " Defer " } ,
{ " RejectMsg " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " This option allows you to set a specific rejection reason for infected messages \n and it's therefore only useful together with \" OnInfected Reject \" \n The string \" %v \" , if present, will be replaced with the virus name. " , " MTA specific " } ,
{ " AddHeader " , NULL , 0 , CLOPT_TYPE_STRING , " ^(No|Replace|Yes|Add)$ " , - 1 , " no " , 0 , OPT_MILTER , " If this option is set to \" Replace \" (or \" Yes \" ), an \" X-Virus-Scanned \" and an \n \" X-Virus-Status \" headers will be attached to each processed message, possibly \n replacing existing headers. \n If it is set to Add, the X-Virus headers are added possibly on top of the \n existing ones. \n Note that while \" Replace \" can potentially break DKIM signatures, \" Add \" may \n confuse procmail and similar filters. " , " Replace " } ,
{ " ReportHostname " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " When AddHeader is in use, this option allows you to set the reported \n hostname. This may be desirable in order to avoid leaking internal names. \n If unset the real machine name is used. " , " my.mail.server.name " } ,
{ " VirusAction " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Execute a command when an infected message is processed. \n The following parameters are passed to the invoked program in this order: \n virus name, queue id, sender, destination, subject, message id, message date. \n Note #1: this requires MTA macroes to be available (see LogInfected below) \n Note #2: the process is invoked in the context of clamav-milter \n Note #3: clamav-milter will wait for the process to exit. Be quick or fork to \n avoid unnecessary delays in email delivery " , " /usr/local/bin/my_infected_message_handler " } ,
{ " Chroot " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Chroot to the specified directory. \n Chrooting is performed just after reading the config file and before \n dropping privileges. " , " /newroot " } ,
{ " AllowList " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " This option specifies a file which contains a list of basic POSIX regular \n expressions. Addresses (sent to or from - see below) matching these regexes \n will not be scanned. Optionally each line can start with the string \" From: \" \n or \" To: \" (note: no whitespace after the colon) indicating if it is, \n respectively, the sender or recipient that is to be allowed. \n If the field is missing, \" To: \" is assumed. \n Lines starting with #, : or ! are ignored. " , " /etc/allowed_addresses " } ,
// The Whitelist option should remain functional for a version or two, but has been deprecated in the documentation in favor of "AllowList".
{ " Whitelist " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " This option specifies a file which contains a list of basic POSIX regular \n expressions. Addresses (sent to or from - see below) matching these regexes \n will not be scanned. Optionally each line can start with the string \" From: \" \n or \" To: \" (note: no whitespace after the colon) indicating if it is, \n respectively, the sender or recipient that is to be allowed. \n If the field is missing, \" To: \" is assumed. \n Lines starting with #, : or ! are ignored. " , " /etc/allowed_addresses " } ,
{ " SkipAuthenticated " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " Messages from authenticated SMTP users matching this extended POSIX \n regular expression (egrep-like) will not be scanned. \n As an alternative, a file containing a plain (not regex) list of names (one \n per line) can be specified using the prefix \" file: \" . \n e.g. SkipAuthenticated file:/etc/good_guys \n \n Note: this is the AUTH login name! " , " SkipAuthenticated ^(tom|dick|henry)$ " } ,
{ " LogInfected " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " This option allows you to tune what is logged when a message is infected. \n Possible values are Off (the default - nothing is logged), \n Basic (minimal info logged), Full (verbose info logged) \n Note: \n For this to work properly in sendmail, make sure the msg_id, mail_addr, \n rcpt_addr and i macroes are available in eom. In other words add a line like: \n Milter.macros.eom={msg_id}, {mail_addr}, {rcpt_addr}, i \n to your .cf file. Alternatively use the macro: \n define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i') \n Postfix should be working fine with the default settings. " , " Basic " } ,
{ " LogClean " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER , " This option allows you to tune what is logged when no threat is found in a scanned message. \n See LogInfected for possible values and caveats. \n Useful in debugging but drastically increases the log size. " , " Basic " } ,
{ " SupportMultipleRecipients " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , 0 , NULL , 0 , OPT_MILTER , " This option affects the behaviour of LogInfected, LogClean and VirusAction \n when a message with multiple recipients is scanned: \n If SupportMultipleRecipients is off (the default) \n then one single log entry is generated for the message and, in case the \n message is determined to be malicious, the command indicated by VirusAction \n is executed just once. In both cases only the last recipient is reported. \n If SupportMultipleRecipients is on: \n then one line is logged for each recipient and the command indicated \n by VirusAction is also executed once for each recipient. \n \n Note: although it's probably a good idea to enable this option, the default value \n is currently set to off for legacy reasons. " , " yes " } ,
/* Deprecated milter options */
{ " ArchiveBlockEncrypted " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " DatabaseDirectory " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " Debug " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " DetectBrokenExecutables " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " LeaveTemporaryFiles " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " LocalSocket " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " MailFollowURLs " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " MaxScanSize " , NULL , 0 , CLOPT_TYPE_SIZE64 , MATCH_SIZE , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " MaxFiles " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " MaxRecursion " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " PhishingSignatures " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " ScanArchive " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " ScanHTML " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " ScanMail " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " ScanOLE2 " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " ScanPE " , NULL , 0 , CLOPT_TYPE_BOOL , MATCH_BOOL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " StreamMaxLength " , NULL , 0 , CLOPT_TYPE_SIZE , MATCH_SIZE , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " TCPAddr " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " TCPSocket " , NULL , 0 , CLOPT_TYPE_NUMBER , MATCH_NUMBER , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ " TemporaryDirectory " , NULL , 0 , CLOPT_TYPE_STRING , NULL , - 1 , NULL , 0 , OPT_MILTER | OPT_DEPRECATED , " " , " " } ,
{ NULL , NULL , 0 , 0 , NULL , 0 , NULL , 0 , 0 , NULL , NULL } } ;
const struct clam_option * clam_options = __clam_options ;
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# ifdef _WIN32
void fix_paths ( void )
{
int have_ddir = 0 , have_cdir = 0 ;
char path [ MAX_PATH ] = " " ;
DWORD sizof ;
HKEY key ;
if ( RegOpenKeyEx ( HKEY_LOCAL_MACHINE , CLAMKEY , 0 , KEY_QUERY_VALUE , & key ) = = ERROR_SUCCESS | | RegOpenKeyEx ( HKEY_CURRENT_USER , CLAMKEY , 0 , KEY_QUERY_VALUE , & key ) = = ERROR_SUCCESS ) {
sizof = sizeof ( path ) ;
if ( RegQueryValueEx ( key , " DataDir " , 0 , NULL , path , & sizof ) = = ERROR_SUCCESS ) {
have_ddir = 1 ;
memcpy ( _DATADIR , path , sizof ) ;
}
sizof = sizeof ( path ) ;
if ( RegQueryValueEx ( key , " ConfDir " , 0 , NULL , path , & sizof ) = = ERROR_SUCCESS ) {
have_cdir = 1 ;
memcpy ( _CONFDIR , path , sizof ) ;
}
RegCloseKey ( key ) ;
}
if ( ! ( have_ddir | have_cdir ) & & GetModuleFileName ( NULL , path , sizeof ( path ) ) ) {
char * dir ;
path [ sizeof ( path ) - 1 ] = ' \0 ' ;
dir = dirname ( path ) ;
if ( ! have_ddir )
snprintf ( _DATADIR , sizeof ( _DATADIR ) , " %s \\ database " , dir ) ;
if ( ! have_cdir ) {
strncpy ( _CONFDIR , dir , sizeof ( _CONFDIR ) ) ;
have_cdir = 1 ;
}
}
_DATADIR [ sizeof ( _DATADIR ) - 1 ] = ' \0 ' ;
_CONFDIR [ sizeof ( _CONFDIR ) - 1 ] = ' \0 ' ;
if ( have_cdir ) {
snprintf ( _CONFDIR_CLAMD , sizeof ( _CONFDIR_CLAMD ) , " %s \\ %s " , _CONFDIR , " clamd.conf " ) ;
snprintf ( _CONFDIR_FRESHCLAM , sizeof ( _CONFDIR_FRESHCLAM ) , " %s \\ %s " , _CONFDIR , " freshclam.conf " ) ;
snprintf ( _CONFDIR_MILTER , sizeof ( _CONFDIR_MILTER ) , " %s \\ %s " , _CONFDIR , " clamav-milter.conf " ) ;
}
}
# endif
const struct optstruct * optget ( const struct optstruct * opts , const char * name )
{
while ( opts ) {
if ( ( opts - > name & & ! strcmp ( opts - > name , name ) ) | | ( opts - > cmd & & ! strcmp ( opts - > cmd , name ) ) )
return opts ;
opts = opts - > next ;
}
return NULL ;
}
static struct optstruct * optget_i ( struct optstruct * opts , const char * name )
{
while ( opts ) {
if ( ( opts - > name & & ! strcmp ( opts - > name , name ) ) | | ( opts - > cmd & & ! strcmp ( opts - > cmd , name ) ) )
return opts ;
opts = opts - > next ;
}
return NULL ;
}
/*
static void optprint ( const struct optstruct * opts )
{
const struct optstruct * h ;
printf ( " \n OPTIONS: \n \n " ) ;
while ( opts ) {
printf ( " OPT_NAME: %s \n " , opts - > name ) ;
printf ( " OPT_CMD: %s \n " , opts - > cmd ) ;
printf ( " OPT_STRARG: %s \n " , opts - > strarg ? opts - > strarg : " NONE " ) ;
printf ( " OPT_NUMARG: %d \n " , opts - > numarg ) ;
h = opts ;
while ( ( h = h - > nextarg ) ) {
printf ( " SUBARG_OPT_STRARG: %s \n " , h - > strarg ? h - > strarg : " NONE " ) ;
printf ( " SUBARG_OPT_NUMARG: %d \n " , h - > numarg ) ;
}
printf ( " ---------------- \n " ) ;
opts = opts - > next ;
}
}
*/
static int optadd ( struct optstruct * * opts , struct optstruct * * opts_last , const char * name , const char * cmd , const char * strarg , long long numarg , int flags , int idx )
{
struct optstruct * newnode ;
newnode = ( struct optstruct * ) malloc ( sizeof ( struct optstruct ) ) ;
if ( ! newnode )
return - 1 ;
if ( name ) {
newnode - > name = strdup ( name ) ;
if ( ! newnode - > name ) {
free ( newnode ) ;
return - 1 ;
}
} else {
newnode - > name = NULL ;
}
if ( cmd ) {
newnode - > cmd = strdup ( cmd ) ;
if ( ! newnode - > cmd ) {
free ( newnode - > name ) ;
free ( newnode ) ;
return - 1 ;
}
} else {
newnode - > cmd = NULL ;
}
if ( strarg ) {
newnode - > strarg = strdup ( strarg ) ;
if ( ! newnode - > strarg ) {
free ( newnode - > cmd ) ;
free ( newnode - > name ) ;
free ( newnode ) ;
return - 1 ;
}
newnode - > enabled = 1 ;
} else {
newnode - > strarg = NULL ;
newnode - > enabled = 0 ;
}
newnode - > numarg = numarg ;
if ( numarg & & numarg ! = - 1 )
newnode - > enabled = 1 ;
newnode - > nextarg = NULL ;
newnode - > next = NULL ;
newnode - > active = 0 ;
newnode - > flags = flags ;
newnode - > idx = idx ;
newnode - > filename = NULL ;
if ( ! * opts_last ) {
newnode - > next = * opts ;
* opts = newnode ;
* opts_last = * opts ;
} else {
( * opts_last ) - > next = newnode ;
* opts_last = newnode ;
}
return 0 ;
}
static int optaddarg ( struct optstruct * opts , const char * name , const char * strarg , long long numarg )
{
struct optstruct * pt , * h , * new ;
if ( ! ( pt = optget_i ( opts , name ) ) ) {
fprintf ( stderr , " ERROR: optaddarg: Unregistered option %s \n " , name ) ;
return - 1 ;
}
if ( pt - > flags & FLAG_MULTIPLE ) {
if ( ! pt - > active ) {
if ( strarg ) {
free ( pt - > strarg ) ;
pt - > strarg = strdup ( strarg ) ;
if ( ! pt - > strarg ) {
fprintf ( stderr , " ERROR: optaddarg: strdup() failed \n " ) ;
return - 1 ;
}
}
pt - > numarg = numarg ;
} else {
new = ( struct optstruct * ) calloc ( 1 , sizeof ( struct optstruct ) ) ;
if ( ! new ) {
fprintf ( stderr , " ERROR: optaddarg: malloc() failed \n " ) ;
return - 1 ;
}
if ( strarg ) {
new - > strarg = strdup ( strarg ) ;
if ( ! new - > strarg ) {
fprintf ( stderr , " ERROR: optaddarg: strdup() failed \n " ) ;
free ( new ) ;
return - 1 ;
}
}
new - > numarg = numarg ;
h = pt ;
while ( h - > nextarg )
h = h - > nextarg ;
h - > nextarg = new ;
}
} else {
if ( pt - > active )
return 0 ;
if ( strarg ) {
free ( pt - > strarg ) ;
pt - > strarg = strdup ( strarg ) ;
if ( ! pt - > strarg ) {
fprintf ( stderr , " ERROR: optaddarg: strdup() failed \n " ) ;
return - 1 ;
}
}
pt - > numarg = numarg ;
}
pt - > active = 1 ;
if ( pt - > strarg | | ( pt - > numarg & & pt - > numarg ! = - 1 ) )
pt - > enabled = 1 ;
else
pt - > enabled = 0 ;
return 0 ;
}
void optfree ( struct optstruct * opts )
{
struct optstruct * h , * a ;
int i ;
if ( opts & & opts - > filename ) {
for ( i = 0 ; opts - > filename [ i ] ; i + + )
free ( opts - > filename [ i ] ) ;
free ( opts - > filename ) ;
}
while ( opts ) {
a = opts - > nextarg ;
while ( a ) {
if ( a - > strarg ) {
free ( a - > name ) ;
free ( a - > cmd ) ;
free ( a - > strarg ) ;
h = a ;
a = a - > nextarg ;
free ( h ) ;
} else {
a = a - > nextarg ;
}
}
free ( opts - > name ) ;
free ( opts - > cmd ) ;
free ( opts - > strarg ) ;
h = opts ;
opts = opts - > next ;
free ( h ) ;
}
return ;
}
struct optstruct * optparse ( const char * cfgfile , int argc , char * * argv , int verbose , int toolmask , int ignore , struct optstruct * oldopts )
{
FILE * fs = NULL ;
const struct clam_option * optentry ;
char * pt ;
const char * name = NULL , * arg ;
int i , err = 0 , lc = 0 , sc = 0 , opt_index , line = 0 , ret ;
struct optstruct * opts = NULL , * opts_last = NULL , * opt ;
char buffer [ 1024 ] , * buff ;
struct option longopts [ MAXCMDOPTS ] ;
char shortopts [ MAXCMDOPTS ] ;
regex_t regex ;
long long numarg , lnumarg , lnumlimit ;
int regflags = REG_EXTENDED | REG_NOSUB ;
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
# ifdef _WIN32
if ( ! is_initialized ) {
fix_paths ( ) ;
is_initialized = true ;
}
# endif
if ( oldopts )
opts = oldopts ;
shortopts [ sc + + ] = ' : ' ;
for ( i = 0 ; ; i + + ) {
optentry = & clam_options [ i ] ;
if ( ! optentry - > name & & ! optentry - > longopt )
break ;
if ( ( ( optentry - > owner & toolmask ) & & ( ( optentry - > owner & toolmask ) ! = OPT_DEPRECATED ) ) | | ( ignore & & ( optentry - > owner & ignore ) ) ) {
if ( ! oldopts & & optadd ( & opts , & opts_last , optentry - > name , optentry - > longopt , optentry - > strarg , optentry - > numarg , optentry - > flags , i ) < 0 ) {
fprintf ( stderr , " ERROR: optparse: Can't register new option (not enough memory) \n " ) ;
optfree ( opts ) ;
return NULL ;
}
if ( ! cfgfile ) {
if ( optentry - > longopt ) {
if ( lc > = MAXCMDOPTS ) {
fprintf ( stderr , " ERROR: optparse: longopts[] is too small \n " ) ;
optfree ( opts ) ;
return NULL ;
}
longopts [ lc ] . name = optentry - > longopt ;
if ( ! ( optentry - > flags & FLAG_REQUIRED ) & & ( optentry - > argtype = = CLOPT_TYPE_BOOL | | optentry - > strarg ) )
longopts [ lc ] . has_arg = 2 ;
else
longopts [ lc ] . has_arg = 1 ;
longopts [ lc ] . flag = NULL ;
longopts [ lc + + ] . val = optentry - > shortopt ;
}
if ( optentry - > shortopt ) {
if ( sc + 2 > = MAXCMDOPTS ) {
fprintf ( stderr , " ERROR: optparse: shortopts[] is too small \n " ) ;
optfree ( opts ) ;
return NULL ;
}
shortopts [ sc + + ] = optentry - > shortopt ;
if ( optentry - > argtype ! = CLOPT_TYPE_BOOL ) {
shortopts [ sc + + ] = ' : ' ;
if ( ! ( optentry - > flags & FLAG_REQUIRED ) & & optentry - > strarg )
shortopts [ sc + + ] = ' : ' ;
}
}
}
}
}
if ( cfgfile ) {
if ( ( fs = fopen ( cfgfile , " r " ) ) = = NULL ) {
/* don't print error messages here! */
optfree ( opts ) ;
return NULL ;
}
} else {
if ( MAX ( sc , lc ) > MAXCMDOPTS ) {
fprintf ( stderr , " ERROR: optparse: (short|long)opts[] is too small \n " ) ;
optfree ( opts ) ;
return NULL ;
}
shortopts [ sc ] = 0 ;
longopts [ lc ] . name = NULL ;
longopts [ lc ] . flag = NULL ;
longopts [ lc ] . has_arg = longopts [ lc ] . val = 0 ;
}
while ( 1 ) {
if ( cfgfile ) {
if ( ! fgets ( buffer , sizeof ( buffer ) , fs ) )
break ;
buff = buffer ;
for ( i = 0 ; i < ( int ) strlen ( buff ) - 1 & & ( buff [ i ] = = ' ' | | buff [ i ] = = ' \t ' ) ; i + + )
;
buff + = i ;
line + + ;
if ( strlen ( buff ) < = 2 | | buff [ 0 ] = = ' # ' )
continue ;
if ( ! strncmp ( " Example " , buff , 7 ) ) {
if ( verbose )
fprintf ( stderr , " ERROR: Please edit the example config file %s \n " , cfgfile ) ;
err = 1 ;
break ;
}
if ( ! ( pt = strpbrk ( buff , " \t " ) ) ) {
if ( verbose )
fprintf ( stderr , " ERROR: Missing argument for option at %s:%d \n " , cfgfile , line ) ;
err = 1 ;
break ;
}
name = buff ;
* pt + + = 0 ;
for ( i = 0 ; i < ( int ) strlen ( pt ) - 1 & & ( pt [ i ] = = ' ' | | pt [ i ] = = ' \t ' ) ; i + + )
;
pt + = i ;
for ( i = strlen ( pt ) ; i > = 1 & & ( pt [ i - 1 ] = = ' ' | | pt [ i - 1 ] = = ' \t ' | | pt [ i - 1 ] = = ' \n ' ) ; i - - )
;
if ( ! i ) {
if ( verbose )
fprintf ( stderr , " ERROR: Missing argument for option at %s:%d \n " , cfgfile , line ) ;
err = 1 ;
break ;
}
pt [ i ] = 0 ;
arg = pt ;
if ( * arg = = ' " ' ) {
arg + + ;
pt + + ;
pt = strrchr ( pt , ' " ' ) ;
if ( ! pt ) {
if ( verbose )
fprintf ( stderr , " ERROR: Missing closing parenthesis in option %s at %s:%d \n " , name , cfgfile , line ) ;
err = 1 ;
break ;
}
* pt = 0 ;
if ( ! strlen ( arg ) ) {
if ( verbose )
fprintf ( stderr , " ERROR: Empty argument for option %s at %s:%d \n " , name , cfgfile , line ) ;
err = 1 ;
break ;
}
}
} else {
opt_index = 0 ;
ret = my_getopt_long ( argc , argv , shortopts , longopts , & opt_index ) ;
if ( ret = = - 1 )
break ;
if ( ret = = ' : ' ) {
fprintf ( stderr , " ERROR: Incomplete option passed (missing argument) \n " ) ;
err = 1 ;
break ;
} else if ( ! ret | | strchr ( shortopts , ret ) ) {
name = NULL ;
if ( ret ) {
for ( i = 0 ; i < lc ; i + + ) {
if ( ret = = longopts [ i ] . val ) {
name = longopts [ i ] . name ;
break ;
}
}
} else {
name = longopts [ opt_index ] . name ;
}
if ( ! name ) {
fprintf ( stderr , " ERROR: optparse: No corresponding long name for option '-%c' \n " , ( char ) ret ) ;
err = 1 ;
break ;
}
optarg ? ( arg = optarg ) : ( arg = NULL ) ;
} else {
fprintf ( stderr , " ERROR: Unknown option passed \n " ) ;
err = 1 ;
break ;
}
}
if ( ! name ) {
fprintf ( stderr , " ERROR: Problem parsing options (name == NULL) \n " ) ;
err = 1 ;
break ;
}
opt = optget_i ( opts , name ) ;
if ( ! opt ) {
if ( cfgfile ) {
if ( verbose )
fprintf ( stderr , " ERROR: Parse error at %s:%d: Unknown option %s \n " , cfgfile , line , name ) ;
}
err = 1 ;
break ;
}
optentry = & clam_options [ opt - > idx ] ;
if ( ignore & & ( optentry - > owner & ignore ) & & ! ( optentry - > owner & toolmask ) ) {
if ( cfgfile ) {
if ( verbose )
fprintf ( stderr , " WARNING: Ignoring unsupported option %s at %s:%d \n " , opt - > name , cfgfile , line ) ;
} else {
if ( verbose ) {
if ( optentry - > shortopt )
fprintf ( stderr , " WARNING: Ignoring unsupported option --%s (-%c) \n " , optentry - > longopt , optentry - > shortopt ) ;
else
fprintf ( stderr , " WARNING: Ignoring unsupported option --%s \n " , optentry - > longopt ) ;
}
}
continue ;
}
if ( optentry - > owner & OPT_DEPRECATED ) {
if ( toolmask & OPT_DEPRECATED ) {
if ( optaddarg ( opts , name , " foo " , 1 ) < 0 ) {
if ( cfgfile )
fprintf ( stderr , " ERROR: Can't register argument for option %s \n " , name ) ;
else
fprintf ( stderr , " ERROR: Can't register argument for option --%s \n " , optentry - > longopt ) ;
err = 1 ;
break ;
}
} else {
if ( cfgfile ) {
if ( verbose )
fprintf ( stderr , " WARNING: Ignoring deprecated option %s at %s:%d \n " , opt - > name , cfgfile , line ) ;
} else {
if ( verbose ) {
if ( optentry - > shortopt )
fprintf ( stderr , " WARNING: Ignoring deprecated option --%s (-%c) \n " , optentry - > longopt , optentry - > shortopt ) ;
else
fprintf ( stderr , " WARNING: Ignoring deprecated option --%s \n " , optentry - > longopt ) ;
}
}
}
continue ;
}
if ( ! cfgfile & & ! arg & & optentry - > argtype = = CLOPT_TYPE_BOOL ) {
arg = " yes " ; /* default to yes */
} else if ( optentry - > regex ) {
if ( ! ( optentry - > flags & FLAG_REG_CASE ) )
regflags | = REG_ICASE ;
if ( cli_regcomp ( & regex , optentry - > regex , regflags ) ) {
fprintf ( stderr , " ERROR: optparse: Can't compile regular expression %s for option %s \n " , optentry - > regex , name ) ;
err = 1 ;
break ;
}
ret = cli_regexec ( & regex , arg , 0 , NULL , 0 ) ;
cli_regfree ( & regex ) ;
if ( ret = = REG_NOMATCH ) {
if ( cfgfile ) {
fprintf ( stderr , " ERROR: Incorrect argument format for option %s \n " , name ) ;
} else {
if ( optentry - > shortopt )
fprintf ( stderr , " ERROR: Incorrect argument format for option --%s (-%c) \n " , optentry - > longopt , optentry - > shortopt ) ;
else
fprintf ( stderr , " ERROR: Incorrect argument format for option --%s \n " , optentry - > longopt ) ;
}
err = 1 ;
break ;
}
}
numarg = - 1 ;
switch ( optentry - > argtype ) {
case CLOPT_TYPE_STRING :
if ( ! arg )
arg = optentry - > strarg ;
if ( ! cfgfile & & ! strlen ( arg ) ) {
if ( optentry - > shortopt )
fprintf ( stderr , " ERROR: Option --%s (-%c) requires a non-empty string argument \n " , optentry - > longopt , optentry - > shortopt ) ;
else
fprintf ( stderr , " ERROR: Option --%s requires a non-empty string argument \n " , optentry - > longopt ) ;
err = 1 ;
break ;
}
break ;
case CLOPT_TYPE_NUMBER :
if ( arg )
numarg = atoi ( arg ) ;
else
numarg = 0 ;
arg = NULL ;
break ;
case CLOPT_TYPE_SIZE :
case CLOPT_TYPE_SIZE64 :
if ( optentry - > argtype = = CLOPT_TYPE_SIZE64 )
/* guaranteed to be "long long" (64 bit but possibly signed) further down the line */
lnumlimit = LLONG_MAX ;
else
/* probably mostly "unsigned long int" (32 or 64 bit unsigned depending on platform),
* but may be expected to fit into a " long long " ( 64 - bit signed ) */
lnumlimit = LLONG_MAX < ULONG_MAX ? LLONG_MAX : ULONG_MAX ;
errno = 0 ;
if ( arg )
lnumarg = strtoll ( arg , & buff , 0 ) ;
else {
numarg = 0 ;
break ;
}
if ( errno ! = ERANGE ) {
switch ( * buff ) {
case ' G ' :
case ' g ' :
if ( lnumarg < = lnumlimit / ( 1024 * 1024 * 1024 ) )
lnumarg * = 1024 * 1024 * 1024 ;
else
errno = ERANGE ;
break ;
case ' M ' :
case ' m ' :
if ( lnumarg < = lnumlimit / ( 1024 * 1024 ) )
lnumarg * = 1024 * 1024 ;
else
errno = ERANGE ;
break ;
case ' K ' :
case ' k ' :
if ( lnumarg < = lnumlimit / 1024 )
lnumarg * = 1024 ;
else
errno = ERANGE ;
break ;
case ' \0 ' :
break ;
default :
if ( cfgfile ) {
fprintf ( stderr , " ERROR: Can't parse numerical argument for option %s \n " , name ) ;
} else {
if ( optentry - > shortopt )
fprintf ( stderr , " ERROR: Can't parse numerical argument for option --%s (-%c) \n " , optentry - > longopt , optentry - > shortopt ) ;
else
fprintf ( stderr , " ERROR: Can't parse numerical argument for option --%s \n " , optentry - > longopt ) ;
}
err = 1 ;
}
}
arg = NULL ;
if ( err ) break ;
if ( errno = = ERANGE ) {
if ( cfgfile ) {
fprintf ( stderr , " WARNING: Numerical value for option %s too high, resetting to %lld \n " , name , lnumlimit ) ;
} else {
if ( optentry - > shortopt )
fprintf ( stderr , " WARNING: Numerical value for option --%s (-%c) too high, resetting to %lld \n " , optentry - > longopt , optentry - > shortopt , lnumlimit ) ;
else
fprintf ( stderr , " WARNING: Numerical value for option %s too high, resetting to %lld \n " , optentry - > longopt , lnumlimit ) ;
}
lnumarg = lnumlimit ;
}
numarg = lnumarg ? lnumarg : lnumlimit ;
break ;
case CLOPT_TYPE_BOOL :
if ( ! strcasecmp ( arg , " yes " ) | | ! strcmp ( arg , " 1 " ) | | ! strcasecmp ( arg , " true " ) )
numarg = 1 ;
else
numarg = 0 ;
arg = NULL ;
break ;
}
if ( err )
break ;
if ( optaddarg ( opts , name , arg , numarg ) < 0 ) {
if ( cfgfile )
fprintf ( stderr , " ERROR: Can't register argument for option %s \n " , name ) ;
else
fprintf ( stderr , " ERROR: Can't register argument for option --%s \n " , optentry - > longopt ) ;
err = 1 ;
break ;
}
}
if ( fs )
fclose ( fs ) ;
if ( err ) {
optfree ( opts ) ;
return NULL ;
}
if ( ! cfgfile & & opts & & ( optind < argc ) ) {
opts - > filename = ( char * * ) calloc ( argc - optind + 1 , sizeof ( char * ) ) ;
if ( ! opts - > filename ) {
fprintf ( stderr , " ERROR: optparse: calloc failed \n " ) ;
optfree ( opts ) ;
return NULL ;
}
for ( i = optind ; i < argc ; i + + ) {
opts - > filename [ i - optind ] = strdup ( argv [ i ] ) ;
if ( ! opts - > filename [ i - optind ] ) {
fprintf ( stderr , " ERROR: optparse: strdup failed \n " ) ;
optfree ( opts ) ;
return NULL ;
}
}
}
/* optprint(opts); */
return opts ;
}
struct optstruct * optadditem ( const char * name , const char * arg , int verbose , int toolmask , int ignore ,
struct optstruct * oldopts )
{
int i , err = 0 , sc = 0 , lc = 0 , ret ;
struct optstruct * opts = NULL , * opts_last = NULL , * opt ;
char * buff ;
regex_t regex ;
long long numarg , lnumarg , lnumlimit ;
int regflags = REG_EXTENDED | REG_NOSUB ;
const struct clam_option * optentry = NULL ;
if ( oldopts )
opts = oldopts ;
for ( i = 0 ; ; i + + ) {
optentry = & clam_options [ i ] ;
if ( ! optentry - > name & & ! optentry - > longopt )
break ;
if ( ( ( optentry - > owner & toolmask ) & & ( ( optentry - > owner & toolmask ) ! = OPT_DEPRECATED ) ) | | ( ignore & & ( optentry - > owner & ignore ) ) ) {
if ( ! oldopts & & optadd ( & opts , & opts_last , optentry - > name , optentry - > longopt , optentry - > strarg , optentry - > numarg , optentry - > flags , i ) < 0 ) {
fprintf ( stderr , " ERROR: optparse: Can't register new option (not enough memory) \n " ) ;
optfree ( opts ) ;
return NULL ;
}
}
}
if ( MAX ( sc , lc ) > MAXCMDOPTS ) {
fprintf ( stderr , " ERROR: optparse: (short|long)opts[] is too small \n " ) ;
optfree ( opts ) ;
return NULL ;
}
while ( 1 ) {
if ( ! name ) {
fprintf ( stderr , " ERROR: Problem parsing options (name == NULL) \n " ) ;
err = 1 ;
break ;
}
opt = optget_i ( opts , name ) ;
if ( ! opt ) {
if ( verbose )
fprintf ( stderr , " ERROR: Parse error: Unknown option %s \n " , name ) ;
err = 1 ;
break ;
}
optentry = & clam_options [ opt - > idx ] ;
if ( ignore & & ( optentry - > owner & ignore ) & & ! ( optentry - > owner & toolmask ) ) {
if ( verbose )
fprintf ( stderr , " WARNING: Ignoring unsupported option %s \n " , opt - > name ) ;
continue ;
}
if ( optentry - > owner & OPT_DEPRECATED ) {
if ( toolmask & OPT_DEPRECATED ) {
if ( optaddarg ( opts , name , " foo " , 1 ) < 0 ) {
fprintf ( stderr , " ERROR: Can't register argument for option %s \n " , name ) ;
err = 1 ;
break ;
}
} else {
if ( verbose )
fprintf ( stderr , " WARNING: Ignoring deprecated option %s \n " , opt - > name ) ;
}
continue ;
}
if ( optentry - > regex ) {
if ( ! ( optentry - > flags & FLAG_REG_CASE ) )
regflags | = REG_ICASE ;
if ( cli_regcomp ( & regex , optentry - > regex , regflags ) ) {
fprintf ( stderr , " ERROR: optparse: Can't compile regular expression %s for option %s \n " , optentry - > regex , name ) ;
err = 1 ;
break ;
}
ret = cli_regexec ( & regex , arg , 0 , NULL , 0 ) ;
cli_regfree ( & regex ) ;
if ( ret = = REG_NOMATCH ) {
fprintf ( stderr , " ERROR: Incorrect argument format for option %s \n " , name ) ;
err = 1 ;
break ;
}
}
numarg = - 1 ;
switch ( optentry - > argtype ) {
case CLOPT_TYPE_STRING :
if ( ! arg )
arg = optentry - > strarg ;
break ;
case CLOPT_TYPE_NUMBER :
if ( arg )
numarg = atoi ( arg ) ;
else
numarg = 0 ;
arg = NULL ;
break ;
case CLOPT_TYPE_SIZE :
case CLOPT_TYPE_SIZE64 :
if ( optentry - > argtype = = CLOPT_TYPE_SIZE64 )
/* guaranteed to be "long long" (64 bit but possibly signed) further down the line */
lnumlimit = LLONG_MAX ;
else
/* probably mostly "unsigned long int" (32 or 64 bit unsigned depending on platform),
* but may be expected to fit into a " long long " ( 64 - bit signed ) */
lnumlimit = LLONG_MAX < ULONG_MAX ? LLONG_MAX : ULONG_MAX ;
errno = 0 ;
if ( arg )
lnumarg = strtoll ( arg , & buff , 0 ) ;
else {
numarg = 0 ;
break ;
}
if ( errno ! = ERANGE ) {
switch ( * buff ) {
case ' G ' :
case ' g ' :
if ( lnumarg < = lnumlimit / ( 1024 * 1024 * 1024 ) )
lnumarg * = 1024 * 1024 * 1024 ;
else
errno = ERANGE ;
break ;
case ' M ' :
case ' m ' :
if ( lnumarg < = lnumlimit / ( 1024 * 1024 ) )
lnumarg * = 1024 * 1024 ;
else
errno = ERANGE ;
break ;
case ' K ' :
case ' k ' :
if ( lnumarg < = lnumlimit / 1024 )
lnumarg * = 1024 ;
else
errno = ERANGE ;
break ;
case ' \0 ' :
break ;
default :
fprintf ( stderr , " ERROR: Can't parse numerical argument for option %s \n " , name ) ;
err = 1 ;
}
}
arg = NULL ;
if ( err ) break ;
if ( errno = = ERANGE ) {
fprintf ( stderr , " WARNING: Numerical value for option %s too high, resetting to 4G \n " , name ) ;
lnumarg = UINT_MAX ;
}
numarg = lnumarg ? lnumarg : UINT_MAX ;
break ;
case CLOPT_TYPE_BOOL :
if ( ! strcasecmp ( arg , " yes " ) | | ! strcmp ( arg , " 1 " ) | | ! strcasecmp ( arg , " true " ) )
numarg = 1 ;
else
numarg = 0 ;
arg = NULL ;
break ;
}
if ( err )
break ;
if ( optaddarg ( opts , name , arg , numarg ) < 0 ) {
fprintf ( stderr , " ERROR: Can't register argument for option --%s \n " , optentry - > longopt ) ;
err = 1 ;
}
break ;
}
if ( err ) {
optfree ( opts ) ;
return NULL ;
}
return opts ;
}
