80 Commits (43a28da37471b2f30efa9e814d9c23bac352fb01)

Author	SHA1	Message	Date
Micah Snyder	fd587c741c	Image fuzzy hash: new logical sub-signature feature ... Add a new logical signature subsignature type for matching on images with image fuzzy hashes. Image fuzzy hash subsigantures follow this format: fuzzy_img#<hash>#<dist> In this initial implementation, the hamming distance (dist) is ignored and only exact fuzzy hash matches will alert. Fuzzy hash matching is only performed for supported image types. Also: removed some excessive debug log messages on start-up. Fixed an issue where the signature name (virname) is being allocated and stored for every subsignature or even ever sub-pattern in an AC-pattern (i.e. NDB sig or LDB subsig) containing a `{n-m}` or `*` wildcard. This fix is only for LDB subsigs though. NDB signatures are still allocaing one virname per sub-pattern. This fix was required because I needed a place to store the virname with fuzzy-hash subsignatures. Storing it in the fuzzy-hash subsig metadatathe way AC-pattern, PCRE, and BComp subsigs were doing it wouldn't work because it would cross the C-Rust FFI boundary and giving pointers to Rust allocated stuff is dicey. Not to mention native Rust strings are different thatn C strings. Anyways, the correct thing to do was to store the virname with the actual logical signature. TODO: Keep track of NDB signatures in the same way and store the virname for NDB sigs there instead of in AC-patterns so that we can get rid of the virname field in the AC-pattern struct.	3 years ago
Micah Snyder	86cff75500	A-C pattern match code cleanup, add comments	3 years ago
micasnyd	140c88aa4e	Bump copyright for 2022 ... Includes minor format corrections.	3 years ago
Micah Snyder (micasnyd)	b9ca6ea103	Update copyright dates for 2021 ... Also fixes up clang-format.	4 years ago
Micah Snyder	206dbaefe8	Update copyright dates for 2020	5 years ago
Micah Snyder (micasnyd)	3dd506a7ee	bb12389 - fast AC sig load - courtesy of Alberto Wu ... This commit addresses the signature load time issue in the following steps: 1. Loaded list items are allocated but left unattached; only a node reference is set on them for further processing. This is done with no increase of memory usage. See changes in insert_list and matcher-ac.h 2. Before the tries are built, the whole list of entries is sorted by node, then by pattern, then by partno. This requires O(N log(N)) time. 3. The list is processed linearly, one node at a time and the `next_same` chain is built. Each next_same chain head is also extracted. This requires O(N) time. 4. The list of heads is sorted by partno. This requires O(M log(M)) time on average with M<=N. 5. The list of heads is processed linearly and the `next` chain is built. This has O(M) complexity. And improves scantime performance, by adding checks to: 1. Place longer lists earlier in the trie. 2. Keep close patterns close, rather than scattering them further apart. This reduced memory cache faults to improve load and scan time performance.	6 years ago
Micah Snyder	5f4f69102d	Correcting types from int to cl_error_t where appropriate. Eliminating unused variables and referencing unused parameters to remove warnings.	6 years ago
Micah Snyder	52cddcbcfd	Updating and cleaning up copyright notices.	6 years ago
Micah Snyder	b3e82e5e61	Replacing libclamav/cltypes.h with clamav-types.h.in, which generates a header clamav-types.h that we install alongside clamav.h.	6 years ago
Micah Snyder	72fd33c8b2	clang-format'd using new .clang-format rules.	6 years ago
Micah Snyder	d0cba11ea7	adding back changes to eliminate warnings from mspack, matcher, others, and readdb.	8 years ago
Micah Snyder	169af0fc67	Revert "eliminating warnings. mostly correcting variable types. also correcting struct initialization in a couple instances (var = {0} does not zero the memory on all platforms). Also some minor formatting corrections in areas I was already working. eliminated some unused variables." ... This reverts commit 84a7f40288.	8 years ago
Micah Snyder	84a7f40288	eliminating warnings. mostly correcting variable types. also correcting struct initialization in a couple instances (var = {0} does not zero the memory on all platforms). Also some minor formatting corrections in areas I was already working. eliminated some unused variables.	8 years ago
Mickey Sola	46a35abe56	mass update of copyright headers	10 years ago
Kevin Lin	6953341f8e	matcher-ac: added calc and storage for min/max lengths	10 years ago
Kevin Lin	f210254408	matcher-ac: converted length fields to arrays	10 years ago
Kevin Lin	b7d0b832f5	ac_special: tracks both the min and max lengths	10 years ago
Steven Morgan	7665e02d5b	Add support for YARA private rules and referencing other rules in a YARA condition.	10 years ago
Kevin Lin	4ffcf308bc	alternative code clean-up (cli_altnmsg)	10 years ago
Kevin Lin	590d402320	altstr: vstr duplicate trimming and uniqueness optimization	10 years ago
Kevin Lin	dda6b05765	matcher-ac: wildcard support for variable alternates (needs optimization)	10 years ago
Kevin Lin	59506ff519	matcher-ac: expansion of nested alternates within alternate expr ... matcher-ac: three types of alternates: byte, fixed, and generic (variable)	10 years ago
Steven Morgan	b7999b89c9	YARA: capture offsets in matcher and use for processing YARA condition 'at' clauses.	10 years ago
Kevin Lin	8ea346810c	moved sigopts handler to separate function ... reason: sigopts weren't handled for yara sigs	10 years ago
Kevin Lin	dc70379a09	converted sigopts from char string to uint8_t	10 years ago
Kevin Lin	6b725bb7c3	added '(W)' special character to match fullword (non-alnum)	10 years ago
Kevin Lin	3e265c461c	added direct memory freeing of cli_ac_list ... cli_ac_pattlist renamed to cli_ac_list	10 years ago
Kevin Lin	51ca644c6b	implemented second nocase AC matcher using full enumerations	10 years ago
Kevin Lin	23d7c6e6f4	removed nocase changes to ac tree operation	10 years ago
Kevin Lin	7fc5eab81a	finished support for AC trie nocase variant ... added check to prevent adding nocase signatures to case-sensitive AC tries	10 years ago
Kevin Lin	a02acd50b6	[WIP] added nocase support to clamav ac algorithm	10 years ago
Kevin Lin	ea3d1e7254	made lsig_sub_matched available to libclamav ... comment clean-up	11 years ago
Steven Morgan	d2092491da	Revert "Support wildcard alternate strings of identical length in Aho-Corasick pattern matcher." ... This reverts commit 1c2b8bd6a4.	11 years ago
Steven Morgan	1c2b8bd6a4	Support wildcard alternate strings of identical length in Aho-Corasick pattern matcher.	12 years ago
Steve Morgan	6ad45a2931	add initial allscan/allmatch mode to libclamav, clamd, clamdscan, and clamscan with unit tests	13 years ago
Tomasz Kojm	0d71068897	libclamav: pass array with initial matches to bytecode (bb#2397)	15 years ago
Tomasz Kojm	b87fe3858e	libclamav/matcher-ac.c: optimize handling of multi-part signatures (bb#2322)	15 years ago
Tomasz Kojm	2db3514c4c	fix warning	15 years ago
Tomasz Kojm	04ec2e1977	libclamav: versioninfo hashset was not properly cached (bb#2065)	15 years ago
Tomasz Kojm	294558a535	libclamav: minimize header parsing (bb#2065)	15 years ago
Török Edvin	2545f9767c	Rearrange some fields in structs to avoid holes.	15 years ago
Török Edvin	5b74e89a35	enable prefiltering, and add to dconf. ... Also downgrade some warnings to debug messages.	16 years ago
Török Edvin	ab89360583	Support for macros in logical subsignatures (bb #164). ... In the LDB there is (one or more) special subsignature ${min-max}MACROID$, which means: must match any signature from group MACROID (for current filetype), and the match must occur at a distance of min-max from the start(!) of the previous logical subsignature match. It also has the sideeffect of making the previous subsignature considered a match only if both that and the macro matches. The offset of first match for the previous logical subsig will be the offset where the {min-max} distance is satisfied. The macro logical subsignature will have a count of 0 (if it didn't match together with the previous subsig), or a count of 1 if it did. The matches can occur anywhere (even in different ac scan buffers), since I don't call cli_ac_scanbuff I just use the offset of first match (which we have for the bytecode anyway). There can be at most 32 macro groups, signatures are added to a macro group by using $MACROID$ as offset. For example pdb entries could be converted to PDB:3:$0:<hexsig of domainname> if we assign macro id 0 to PDB (and we can assign 31 more macro ids to whatever). Example: test.ldb: TestMacro;Target:0;0&1;616161;${3-4}12$ test.ndb: D:0:$12:6262 D:0:$12:6363 D:0:$11:6262 test.dat: aaaaxccdd test-nomatch.dat: aaaaxxxccdd	16 years ago
Tomasz Kojm	baf2e702e2	libclamav: provide information about lsig matches to bytecode (bb#1799)	16 years ago
Tomasz Kojm	2e4fd44f4f	libclamav: provide offset in cli_ac_result (bb#1799)	16 years ago
aCaB	d2ba6f98bb	matching complete	16 years ago
aCaB	49cc1e3c35	s/struct F_MAP/fmap_t/	16 years ago
Tomasz Kojm	8c3c77b49c	libclamav/matcher-ac.c: implement word delimiter (B) as requested in bb#1631	16 years ago
Tomasz Kojm	a6d4c62ee5	libclamav/matcher-ac.c: initial limited support for word boundary (bb#1631)	16 years ago
Tomasz Kojm	95ac9effe4	libclamav/matcher-ac.c: alternatives can now be negated: !(aa|bb|cc)	16 years ago