|
|
|
|
/*
|
|
|
|
|
* Load, verify and execute ClamAV bytecode.
|
|
|
|
|
*
|
|
|
|
|
* Copyright (C) 2013-2023 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
|
|
|
|
|
* Copyright (C) 2009-2013 Sourcefire, Inc.
|
|
|
|
|
*
|
|
|
|
|
* Authors: Török Edvin
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
|
|
|
|
* MA 02110-1301, USA.
|
|
|
|
|
*/
|
|
|
|
|
#ifndef BYTECODE_H
|
|
|
|
|
#define BYTECODE_H
|
|
|
|
|
#include "clamav-types.h"
|
|
|
|
|
#include "clambc.h"
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include "fmap.h"
|
|
|
|
|
#include "bytecode_detect.h"
|
Add CMake build tooling
This patch adds experimental-quality CMake build tooling.
The libmspack build required a modification to use "" instead of <> for
header #includes. This will hopefully be included in the libmspack
upstream project when adding CMake build tooling to libmspack.
Removed use of libltdl when using CMake.
Flex & Bison are now required to build.
If -DMAINTAINER_MODE, then GPERF is also required, though it currently
doesn't actually do anything. TODO!
I found that the autotools build system was generating the lexer output
but not actually compiling it, instead using previously generated (and
manually renamed) lexer c source. As a consequence, changes to the .l
and .y files weren't making it into the build. To resolve this, I
removed generated flex/bison files and fixed the tooling to use the
freshly generated files. Flex and bison are now required build tools.
On Windows, this adds a dependency on the winflexbison package,
which can be obtained using Chocolatey or may be manually installed.
CMake tooling only has partial support for building with external LLVM
library, and no support for the internal LLVM (to be removed in the
future). I.e. The CMake build currently only supports the bytecode
interpreter.
Many files used include paths relative to the top source directory or
relative to the current project, rather than relative to each build
target. Modern CMake support requires including internal dependency
headers the same way you would external dependency headers (albeit
with "" instead of <>). This meant correcting all header includes to
be relative to the build targets and not relative to the workspace.
For example, ...
```c
include "../libclamav/clamav.h"
include "clamd/clamd_others.h"
```
... becomes:
```c
// libclamav
include "clamav.h"
// clamd
include "clamd_others.h"
```
Fixes header name conflicts by renaming a few of the files.
Converted the "shared" code into a static library, which depends on
libclamav. The ironically named "shared" static library provides
features common to the ClamAV apps which are not required in
libclamav itself and are not intended for use by downstream projects.
This change was required for correct modern CMake practices but was
also required to use the automake "subdir-objects" option.
This eliminates warnings when running autoreconf which, in the next
version of autoconf & automake are likely to break the build.
libclamav used to build in multiple stages where an earlier stage is
a static library containing utils required by the "shared" code.
Linking clamdscan and clamdtop with this libclamav utils static lib
allowed these two apps to function without libclamav. While this is
nice in theory, the practical gains are minimal and it complicates
the build system. As such, the autotools and CMake tooling was
simplified for improved maintainability and this feature was thrown
out. clamdtop and clamdscan now require libclamav to function.
Removed the nopthreads version of the autotools
libclamav_internal_utils static library and added pthread linking to
a couple apps that may have issues building on some platforms without
it, with the intention of removing needless complexity from the
source. Kept the regular version of libclamav_internal_utils.la
though it is no longer used anywhere but in libclamav.
Added an experimental doxygen build option which attempts to build
clamav.h and libfreshclam doxygen html docs.
The CMake build tooling also may build the example program(s), which
isn't a feature in the Autotools build system.
Changed C standard to C90+ due to inline linking issues with socket.h
when linking libfreshclam.so on Linux.
Generate common.rc for win32.
Fix tabs/spaces in shared Makefile.am, and remove vestigial ifndef
from misc.c.
Add CMake files to the automake dist, so users can try the new
CMake tooling w/out having to build from a git clone.
clamonacc changes:
- Renamed FANOTIFY macro to HAVE_SYS_FANOTIFY_H to better match other
similar macros.
- Added a new clamav-clamonacc.service systemd unit file, based on
the work of ChadDevOps & Aaron Brighton.
- Added missing clamonacc man page.
Updates to clamdscan man page, add missing options.
Remove vestigial CL_NOLIBCLAMAV definitions (all apps now use
libclamav).
Rename Windows mspack.dll to libmspack.dll so all ClamAV-built
libraries have the lib-prefix with Visual Studio as with CMake.
5 years ago
|
|
|
#include "platform.h"
|
|
|
|
|
|
|
|
|
|
struct cli_dbio;
|
|
|
|
|
struct cli_bc_ctx;
|
|
|
|
|
struct cli_bc_func;
|
|
|
|
|
struct cli_bc_value;
|
|
|
|
|
struct cli_bc_inst;
|
|
|
|
|
struct cli_bc_type;
|
|
|
|
|
struct cli_bc_engine;
|
|
|
|
|
struct cli_bc_dbgnode;
|
|
|
|
|
struct bitset_tag;
|
|
|
|
|
struct cl_engine;
|
|
|
|
|
|
|
|
|
|
enum bc_state {
|
|
|
|
|
bc_skip,
|
|
|
|
|
bc_loaded,
|
|
|
|
|
bc_jit,
|
|
|
|
|
bc_interp,
|
|
|
|
|
bc_disabled
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct cli_bc {
|
|
|
|
|
struct bytecode_metadata metadata;
|
|
|
|
|
unsigned id;
|
|
|
|
|
unsigned kind;
|
|
|
|
|
unsigned num_types;
|
|
|
|
|
unsigned num_func;
|
|
|
|
|
struct cli_bc_func *funcs;
|
|
|
|
|
struct cli_bc_type *types;
|
|
|
|
|
uint64_t **globals;
|
|
|
|
|
uint16_t *globaltys;
|
|
|
|
|
size_t num_globals;
|
|
|
|
|
enum bc_state state;
|
|
|
|
|
struct bitset_tag *uses_apis;
|
|
|
|
|
char *lsig;
|
|
|
|
|
char *vnameprefix;
|
|
|
|
|
char **vnames;
|
|
|
|
|
unsigned vnames_cnt;
|
|
|
|
|
uint16_t start_tid;
|
|
|
|
|
struct cli_bc_dbgnode *dbgnodes;
|
|
|
|
|
unsigned dbgnode_cnt;
|
|
|
|
|
unsigned hook_lsig_id;
|
|
|
|
|
unsigned trusted;
|
|
|
|
|
uint32_t numGlobalBytes;
|
|
|
|
|
uint8_t *globalBytes;
|
|
|
|
|
uint32_t sigtime_id, sigmatch_id;
|
|
|
|
|
char *hook_name;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct cli_all_bc {
|
|
|
|
|
struct cli_bc *all_bcs;
|
|
|
|
|
unsigned count;
|
|
|
|
|
struct cli_bcengine *engine;
|
|
|
|
|
struct cli_environment env;
|
|
|
|
|
int inited;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct cli_pe_hook_data;
|
|
|
|
|
struct cli_exe_section;
|
|
|
|
|
struct pdf_obj;
|
|
|
|
|
struct cli_bc_ctx *cli_bytecode_context_alloc(void);
|
|
|
|
|
/* FIXME: we can't include others.h because others.h includes us...*/
|
|
|
|
|
void cli_bytecode_context_setctx(struct cli_bc_ctx *ctx, void *cctx);
|
|
|
|
|
cl_error_t cli_bytecode_context_setfuncid(struct cli_bc_ctx *ctx, const struct cli_bc *bc, unsigned funcid);
|
|
|
|
|
cl_error_t cli_bytecode_context_setparam_int(struct cli_bc_ctx *ctx, unsigned i, uint64_t c);
|
|
|
|
|
cl_error_t cli_bytecode_context_setparam_ptr(struct cli_bc_ctx *ctx, unsigned i, void *data, unsigned datalen);
|
|
|
|
|
cl_error_t cli_bytecode_context_setfile(struct cli_bc_ctx *ctx, fmap_t *map);
|
|
|
|
|
cl_error_t cli_bytecode_context_setpe(struct cli_bc_ctx *ctx, const struct cli_pe_hook_data *data, const struct cli_exe_section *sections);
|
|
|
|
|
cl_error_t cli_bytecode_context_setpdf(struct cli_bc_ctx *ctx, unsigned phase, unsigned nobjs, struct pdf_obj **objs, uint32_t *pdf_flags, uint32_t pdfsize, uint32_t pdfstartoff);
|
|
|
|
|
|
|
|
|
|
/* returns file descriptor, sets tempfile. Caller takes ownership, and is
|
|
|
|
|
* responsible for freeing/unlinking */
|
|
|
|
|
int cli_bytecode_context_getresult_file(struct cli_bc_ctx *ctx, char **tempfilename);
|
|
|
|
|
uint64_t cli_bytecode_context_getresult_int(struct cli_bc_ctx *ctx);
|
|
|
|
|
void cli_bytecode_context_destroy(struct cli_bc_ctx *ctx);
|
|
|
|
|
|
|
|
|
|
#ifdef __cplusplus
|
|
|
|
|
extern "C" {
|
|
|
|
|
#endif
|
|
|
|
|
extern LIBCLAMAV_EXPORT bool have_clamjit(void);
|
|
|
|
|
#ifdef __cplusplus
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
cl_error_t cli_bytecode_init(struct cli_all_bc *allbc);
|
|
|
|
|
cl_error_t cli_bytecode_load(struct cli_bc *bc, FILE *f, struct cli_dbio *dbio, int security, int sigperf);
|
|
|
|
|
cl_error_t cli_bytecode_prepare2(struct cl_engine *engine, struct cli_all_bc *allbc, unsigned dconfmask);
|
|
|
|
|
cl_error_t cli_bytecode_run(const struct cli_all_bc *bcs, const struct cli_bc *bc, struct cli_bc_ctx *ctx);
|
|
|
|
|
void cli_bytecode_destroy(struct cli_bc *bc);
|
|
|
|
|
cl_error_t cli_bytecode_done(struct cli_all_bc *allbc);
|
|
|
|
|
|
|
|
|
|
/* Bytecode IR descriptions */
|
|
|
|
|
void cli_bytecode_describe(const struct cli_bc *bc);
|
|
|
|
|
void cli_bytetype_describe(const struct cli_bc *bc);
|
|
|
|
|
void cli_bytevalue_describe(const struct cli_bc *bc, unsigned funcid);
|
|
|
|
|
void cli_byteinst_describe(const struct cli_bc_inst *inst, unsigned *bbnum);
|
|
|
|
|
void cli_bytefunc_describe(const struct cli_bc *bc, unsigned funcid);
|
|
|
|
|
|
|
|
|
|
/* Hooks */
|
|
|
|
|
struct cli_exe_info;
|
|
|
|
|
struct cli_ctx_tag;
|
|
|
|
|
struct cli_target_info;
|
|
|
|
|
cl_error_t cli_bytecode_runlsig(struct cli_ctx_tag *ctx, struct cli_target_info *info, const struct cli_all_bc *bcs, unsigned bc_idx, const uint32_t *lsigcnt, const uint32_t *lsigsuboff, fmap_t *map);
|
|
|
|
|
cl_error_t cli_bytecode_runhook(struct cli_ctx_tag *cctx, const struct cl_engine *engine, struct cli_bc_ctx *ctx, unsigned id, fmap_t *map);
|
|
|
|
|
|
|
|
|
|
#ifdef __cplusplus
|
|
|
|
|
extern "C" {
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
cl_error_t bytecode_init(void);
|
|
|
|
|
/* Bytecode internal debug API */
|
|
|
|
|
void cli_bytecode_debug(int argc, char **argv);
|
|
|
|
|
void cli_bytecode_printversion(void);
|
|
|
|
|
void cli_bytecode_debug_printsrc(const struct cli_bc_ctx *ctx);
|
|
|
|
|
void cli_printcxxver(void);
|
|
|
|
|
|
|
|
|
|
typedef void (*bc_dbg_callback_trace)(struct cli_bc_ctx *, unsigned event);
|
|
|
|
|
typedef void (*bc_dbg_callback_trace_op)(struct cli_bc_ctx *, const char *op);
|
|
|
|
|
typedef void (*bc_dbg_callback_trace_val)(struct cli_bc_ctx *, const char *name, uint32_t value);
|
|
|
|
|
typedef void (*bc_dbg_callback_trace_ptr)(struct cli_bc_ctx *, const void *val);
|
|
|
|
|
void cli_bytecode_context_set_trace(struct cli_bc_ctx *, unsigned level,
|
|
|
|
|
bc_dbg_callback_trace,
|
|
|
|
|
bc_dbg_callback_trace_op,
|
|
|
|
|
bc_dbg_callback_trace_val,
|
|
|
|
|
bc_dbg_callback_trace_ptr);
|
|
|
|
|
void cli_sigperf_print(void);
|
|
|
|
|
void cli_sigperf_events_destroy(void);
|
|
|
|
|
#ifdef __cplusplus
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#endif
|
