open-dsi
/
clamav
mirror of https://github.com/Cisco-Talos/clamav
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libclamav: count .pdb entries as signatures

Browse Source 
freshclam, sigtool: add support for safebrowsing.cvd (bb#1056)


git-svn: trunk@4901
0.95
Tomasz Kojm 17 years ago
parent af449e4756
commit 03527bee64
7 changed files with 61 additions and 26 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 5
      ChangeLog
  2. 15
      freshclam/manager.c
  3. 8
      libclamav/readdb.c
  4. 9
      libclamav/regex_list.c
  5. 2
      libclamav/regex_list.h
  6. 3
      shared/optparser.c
  7. 45
      sigtool/sigtool.c

5
ChangeLog
Unescape View File

@ -1,3 +1,8 @@
Thu Mar 5 20:10:00 CET 2009 (tk)
---------------------------------
* libclamav: count .pdb entries as signatures
* freshclam, sigtool: add support for safebrowsing.cvd (bb#1056)
Thu Mar 5 16:43:46 CET 2009 (acab)
-----------------------------------
* libclamav/mpool.c: enable mmap poisoning (compile with --enable-debug)

15
freshclam/manager.c
Unescape View File

@ -1484,6 +1484,8 @@ static int updatedb(const char *dbname, const char *hostname, char *ip, int *sig
field = 1;
} else if(!strcmp(dbname, "daily")) {
field = 2;
} else if(!strcmp(dbname, "safebrowsing")) {
field = 6;
} else {
logg("!updatedb: Unknown database name (%s) passed.\n", dbname);
cl_cvdfree(current);
@ -1829,6 +1831,19 @@ int downloadmanager(const struct optstruct *opts, const char *hostname, const ch
} else if(ret == 0)
updated = 1;
/* if ipaddr[0] != 0 it will use it to connect to the web host */
if(optget(opts, "SafeBrowsing")->enabled && (ret = updatedb("safebrowsing", hostname, ipaddr, &signo, opts, dnsreply, localip, outdated, &mdat, logerr)) > 50) {
if(dnsreply)
free(dnsreply);
if(newver)
free(newver);
mirman_write("mirrors.dat", &mdat);
return ret;
} else if(ret == 0)
updated = 1;
if(dnsreply)
free(dnsreply);

8
libclamav/readdb.c
Unescape View File

@ -489,14 +489,14 @@ static int cli_loadwdb(FILE *fs, struct cl_engine *engine, unsigned int options,
}
}
if((ret = load_regex_matcher(engine->whitelist_matcher, fs, options, 1, dbio))) {
if((ret = load_regex_matcher(engine->whitelist_matcher, fs, NULL, options, 1, dbio))) {
return ret;
}
return CL_SUCCESS;
}
static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int options, struct cli_dbio *dbio)
static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int *signo, unsigned int options, struct cli_dbio *dbio)
{
int ret = 0;
@ -510,7 +510,7 @@ static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int options,
}
}
if((ret = load_regex_matcher(engine->domainlist_matcher, fs, options, 0, dbio))) {
if((ret = load_regex_matcher(engine->domainlist_matcher, fs, signo, options, 0, dbio))) {
return ret;
}
@ -1516,7 +1516,7 @@ int cli_load(const char *filename, struct cl_engine *engine, unsigned int *signo
skipped = 1;
} else if(cli_strbcasestr(dbname, ".pdb")) {
if(options & CL_DB_PHISHING_URLS) {
ret = cli_loadpdb(fs, engine, options, dbio);
ret = cli_loadpdb(fs, engine, signo, options, dbio);
} else
skipped = 1;
} else if(cli_strbcasestr(dbname, ".ftm")) {

9
libclamav/regex_list.c
Unescape View File

@ -453,9 +453,9 @@ static int add_hash(struct regex_matcher *matcher, char* pattern, const char fl)
/* Load patterns/regexes from file */
int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int options,int is_whitelist,struct cli_dbio *dbio)
int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int *signo,unsigned int options,int is_whitelist,struct cli_dbio *dbio)
{
int rc,line=0;
int rc,line=0,entry=0;
char buffer[FILEBUFF];
assert(matcher);
@ -502,13 +502,14 @@ int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int optio
size_t pattern_len;
cli_chomp(buffer);
line++;
if(!*buffer)
continue;/* skip empty lines */
if(functionality_level_check(buffer))
continue;
line++;
entry++;
pattern = strchr(buffer,':');
if(!pattern) {
cli_errmsg("Malformed regex list line %d\n",line);
@ -550,6 +551,8 @@ int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int optio
}
}
matcher->list_loaded = 1;
if(signo)
*signo += entry;
return CL_SUCCESS;
}

2
libclamav/regex_list.h
Unescape View File

@ -66,7 +66,7 @@ int cli_build_regex_list(struct regex_matcher* matcher);
int regex_list_add_pattern(struct regex_matcher *matcher, char *pattern);
int regex_list_match(struct regex_matcher* matcher, char* real_url,const char* display_url,const struct pre_fixup_info* pre_fixup, int hostOnly,const char **info, int is_whitelist);
int init_regex_list(struct regex_matcher* matcher);
int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int options,int is_whitelist,struct cli_dbio *dbio);
int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int *signo,unsigned int options,int is_whitelist,struct cli_dbio *dbio);
void regex_list_cleanup(struct regex_matcher* matcher);
void regex_list_done(struct regex_matcher* matcher);
int is_regex_ok(struct regex_matcher* matcher);

3
shared/optparser.c
Unescape View File

@ -98,6 +98,7 @@ const struct clam_option clam_options[] = {
{ NULL, "html-normalise", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "utf16-decode", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "build", 'b', TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "no-cdiff", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "server", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "unpack", 'u', TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
{ NULL, "unpack-current", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },
@ -349,6 +350,8 @@ const struct clam_option clam_options[] = {
{ "DetectionStatsCountry", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM, "Country of origin of malware/detection statistics (for statistical\npurposes only). The statistics collector at ClamAV.net will look up\nyour IP address to determine the geographical origin of the malware\nreported by your installation. If this installation is mainly used to\nscan data which comes from a different location, please enable this\noption and enter a two-letter code (see http://www.iana.org/domains/root/db/)\nof the country of origin.", "country-code" },
{ "SafeBrowsing", NULL, 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_FRESHCLAM, "FIXME", "yes" },
/* Deprecated options */
{ "MailMaxRecursion", NULL, 0, TYPE_NUMBER, NULL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", "" },

45
sigtool/sigtool.c
Unescape View File

@ -95,12 +95,26 @@ static const struct dblist_s {
{ "main.zmd", 1 }, { "daily.zmd", 1 },
{ "main.rmd", 1 }, { "daily.rmd", 1 },
{ "main.fp", 0 }, { "daily.fp", 0 },
{ "main.pdb", 0 }, { "daily.pdb", 0 },
{ "main.wdb", 0 }, { "daily.wdb", 0 },
{ "main.pdb", 1 }, { "daily.pdb", 1 }, { "safebrowsing.pdb", 1 },
{ "main.wdb", 0 }, { "daily.wdb", 0 }, { "safebrowsing.wdb", 0 },
{ NULL, 0 }
};
static const char *getdbname(const char *str)
{
if(strstr(str, "main"))
return "main";
else if(strstr(str, "daily"))
return "daily";
else if(strstr(str, "safebrowsing"))
return "safebrowsing";
else {
mprintf("!getdbname: Can't extract db name\n");
return "UNKNOWN";
}
}
static int hexdump(void)
{
char buffer[FILEBUFF], *pt;
@ -559,7 +573,7 @@ static int build(const struct optstruct *opts)
return -1;
}
dbname = strstr(optget(opts, "build")->strarg, "main") ? "main" : "daily";
dbname = getdbname(optget(opts, "build")->strarg);
if(!(engine = cl_engine_new())) {
mprintf("!build: Can't initialize antivirus engine\n");
@ -803,6 +817,11 @@ static int build(const struct optstruct *opts)
mprintf("Created %s\n", newcvd);
if(optget(opts, "no-cdiff")->enabled) {
mprintf("Skipping .cdiff creation\n");
return 0;
}
/* generate patch */
if(!(pt = cli_gentemp(NULL))) {
mprintf("!build: Can't generate temporary name\n");
@ -852,11 +871,7 @@ static int build(const struct optstruct *opts)
return -1;
}
if(!strcmp(dbname, "main"))
snprintf(patch, sizeof(patch), "main-%u.script", version);
else
snprintf(patch, sizeof(patch), "daily-%u.script", version);
snprintf(patch, sizeof(patch), "%s-%u.script", dbname, version);
ret = diffdirs(olddb, pt, patch);
cli_rmdirs(pt);
@ -1239,15 +1254,12 @@ static int vbadump(const struct optstruct *opts)
static int comparemd5(const char *dbname)
{
char info[16], buff[256], *md5, *pt;
char info[32], buff[256], *md5, *pt;
FILE *fh;
int ret = 0;
if(strstr(dbname, "main"))
strcpy(info, "main.info");
else
strcpy(info, "daily.info");
snprintf(info, sizeof(info), "%s.info", getdbname(dbname));
if(!(fh = fopen(info, "r"))) {
mprintf("!verifydiff: Can't open %s\n", info);
@ -1731,11 +1743,7 @@ static int makediff(const struct optstruct *opts)
return -1;
}
if(strstr(opts->filename[0], "main"))
snprintf(name, sizeof(name), "main-%u.script", newver);
else
snprintf(name, sizeof(name), "daily-%u.script", newver);
snprintf(name, sizeof(name), "%s-%u.script", getdbname(opts->filename[0]), newver);
ret = diffdirs(odir, ndir, name);
cli_rmdirs(odir);
@ -1781,6 +1789,7 @@ static void help(void)
mprintf(" --utf16-decode=FILE decode UTF16 encoded files\n");
mprintf(" --info=FILE -i FILE print database information\n");
mprintf(" --build=NAME [cvd] -b NAME build a CVD file\n");
mprintf(" --no-cdiff Don't generate .cdiff file\n");
mprintf(" --server=ADDR ClamAV Signing Service address\n");
mprintf(" --unpack=FILE -u FILE Unpack a CVD/CLD file\n");
mprintf(" --unpack-current=SHORTNAME Unpack local CVD/CLD into cwd\n");

Write Preview
Loading…
Cancel
Save