2007-12-29 09:08:05 +00:00
|
|
|
CLAMAV_PUBLIC {
|
|
|
|
|
global:
|
2007-12-31 12:46:26 +00:00
|
|
|
cl_cvdfree;
|
|
|
|
|
cl_cvdhead;
|
|
|
|
|
cl_cvdparse;
|
|
|
|
|
cl_cvdverify;
|
|
|
|
|
cl_debug;
|
2008-11-10 17:39:58 +00:00
|
|
|
cl_init;
|
|
|
|
|
cl_engine_new;
|
2009-03-12 15:21:36 +00:00
|
|
|
cl_engine_set_num;
|
|
|
|
|
cl_engine_get_num;
|
|
|
|
|
cl_engine_set_str;
|
|
|
|
|
cl_engine_get_str;
|
2010-11-02 12:26:33 +02:00
|
|
|
cl_engine_set_clcb_hash;
|
2011-08-22 15:22:55 +03:00
|
|
|
cl_engine_set_clcb_meta;
|
2014-06-03 14:22:24 -04:00
|
|
|
cl_engine_set_clcb_file_props;
|
2010-11-02 12:26:33 +02:00
|
|
|
cl_set_clcb_msg;
|
2010-06-22 15:41:19 +02:00
|
|
|
cl_engine_set_clcb_pre_scan;
|
|
|
|
|
cl_engine_set_clcb_post_scan;
|
2015-10-01 17:47:37 -04:00
|
|
|
cl_engine_set_clcb_virus_found;
|
2010-06-22 15:41:19 +02:00
|
|
|
cl_engine_set_clcb_sigload;
|
2011-06-15 12:37:51 +03:00
|
|
|
cl_engine_set_clcb_pre_cache;
|
2009-03-02 18:56:03 +00:00
|
|
|
cl_engine_settings_copy;
|
|
|
|
|
cl_engine_settings_apply;
|
|
|
|
|
cl_engine_settings_free;
|
2008-11-10 17:39:58 +00:00
|
|
|
cl_engine_compile;
|
2008-11-13 15:55:35 +00:00
|
|
|
cl_engine_addref;
|
2008-11-10 17:39:58 +00:00
|
|
|
cl_engine_free;
|
2007-12-31 12:46:26 +00:00
|
|
|
cl_load;
|
|
|
|
|
cl_retdbdir;
|
|
|
|
|
cl_retflevel;
|
|
|
|
|
cl_retver;
|
|
|
|
|
cl_scandesc;
|
2010-11-02 12:26:33 +02:00
|
|
|
cl_scandesc_callback;
|
2007-12-31 12:46:26 +00:00
|
|
|
cl_scanfile;
|
2010-11-02 12:26:33 +02:00
|
|
|
cl_scanfile_callback;
|
2007-12-31 12:46:26 +00:00
|
|
|
cl_statchkdir;
|
|
|
|
|
cl_statfree;
|
|
|
|
|
cl_statinidir;
|
2010-02-12 15:52:19 +01:00
|
|
|
cl_countsigs;
|
2007-12-31 12:46:26 +00:00
|
|
|
cl_strerror;
|
2011-06-14 22:35:03 +03:00
|
|
|
cl_fmap_open_handle;
|
|
|
|
|
cl_fmap_open_memory;
|
|
|
|
|
cl_scanmap_callback;
|
2011-06-17 23:20:01 +03:00
|
|
|
cl_fmap_close;
|
2013-10-09 15:57:56 -04:00
|
|
|
cl_always_gen_section_hash;
|
2013-10-25 10:17:22 -04:00
|
|
|
cl_engine_set_stats_set_cbdata;
|
|
|
|
|
cl_engine_set_clcb_stats_add_sample;
|
|
|
|
|
cl_engine_set_clcb_stats_remove_sample;
|
|
|
|
|
cl_engine_set_clcb_stats_decrement_count;
|
|
|
|
|
cl_engine_set_clcb_stats_submit;
|
|
|
|
|
cl_engine_set_clcb_stats_flush;
|
|
|
|
|
cl_engine_set_clcb_stats_get_num;
|
|
|
|
|
cl_engine_set_clcb_stats_get_size;
|
|
|
|
|
cl_engine_set_clcb_stats_get_hostid;
|
2014-02-28 12:12:30 -05:00
|
|
|
cl_hash_init;
|
|
|
|
|
cl_update_hash;
|
|
|
|
|
cl_finish_hash;
|
|
|
|
|
cl_hash_destroy;
|
2014-03-07 13:09:37 -05:00
|
|
|
cl_engine_stats_enable;
|
2014-11-10 12:09:12 -05:00
|
|
|
lsig_sub_matched;
|
2022-11-19 16:16:04 -07:00
|
|
|
cl_engine_set_clcb_engine_compile_progress;
|
2023-03-18 19:16:06 -07:00
|
|
|
cl_engine_set_clcb_engine_free_progress;
|
2022-11-19 16:16:04 -07:00
|
|
|
cl_engine_set_clcb_sigload_progress;
|
|
|
|
|
cl_cvdunpack;
|
2023-03-18 19:16:06 -07:00
|
|
|
cl_engine_set_clcb_file_inspection;
|
2023-03-29 00:22:48 +03:00
|
|
|
cl_cvdgetage;
|
2023-03-02 17:23:46 -08:00
|
|
|
cl_engine_set_clcb_vba;
|
FIPS-compliant CVD signing and verification
Add X509 certificate chain based signing with PKCS7-PEM external
signatures distributed alongside CVD's in a custom .cvd.sign format.
This new signing and verification mechanism is primarily in support
of FIPS compliance.
Fixes: https://github.com/Cisco-Talos/clamav/issues/564
Add a Rust implementation for parsing, verifying, and unpacking CVD
files.
Now installs a 'certs' directory in the app config directory
(e.g. <prefix>/etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
`-D CVD_CERTS_DIRECTORY=PATH`
New options to set an alternative CVD certs directory:
- Commandline for freshclam, clamd, clamscan, and sigtool is:
`--cvdcertsdir PATH`
- Env variable for freshclam, clamd, clamscan, and sigtool is:
`CVD_CERTS_DIR`
- Config option for freshclam and clamd is:
`CVDCertsDirectory PATH`
Sigtool:
- Add sign/verify commands.
- Also verify CDIFF external digital signatures when applying CDIFFs.
- Place commonly used commands at the top of --help string.
- Fix up manpage.
Freshclam:
- Will try to download .sign files to verify CVDs and CDIFFs.
- Fix an issue where making a CLD would only include the CFG file for
daily and not if patching any other database.
libclamav.so:
- Bump version to 13:0:1 (aka 12.1.0).
- Also remove libclamav.map versioning.
Resolves: https://github.com/Cisco-Talos/clamav/issues/1304
- Add two new API's to the public clamav.h header:
```c
extern cl_error_t cl_cvdverify_ex(const char *file,
const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
const char *dir,
bool dont_verify,
const char *certs_directory);
```
The original `cl_cvdverify` and `cl_cvdunpack` are deprecated.
- Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`.
You may set this option with `cl_engine_set_str` and get it
with `cl_engine_get_str`, to override the compiled in default
CVD certs directory.
libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).
Add sigtool sign/verify tests and test certs.
Make it so downloadFile doesn't throw a warning if the server
doesn't have the .sign file.
Replace use of md5-based FP signatures in the unit tests with
sha256-based FP signatures because the md5 implementation used
by Python may be disabled in FIPS mode.
Fixes: https://github.com/Cisco-Talos/clamav/issues/1411
CMake: Add logic to enable the Rust openssl-sys / openssl-rs crates
to build against the same OpenSSL library as is used for the C build.
The Rust unit test application must also link directly with libcrypto
and libssl.
Fix some log messages with missing new lines.
Fix missing environment variable notes in --help messages and manpages.
Deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in
clamav-config.h.in for libclamav from variable that had the same name
for use in clamav applications that use the optparser.
The 'clamav-test' certs for the unit tests will live for 10 years.
The 'clamav-beta.crt' public cert will only live for 120 days and will
be replaced before the stable release with a production 'clamav.crt'.
2024-11-21 14:01:09 -05:00
|
|
|
cl_cvdunpack_ex;
|
|
|
|
|
cl_cvdverify_ex;
|
2025-06-16 12:27:51 -04:00
|
|
|
cl_scandesc_ex;
|
|
|
|
|
cl_scanmap_ex;
|
|
|
|
|
cl_scanfile_ex;
|
libclamav: scan-layer callback API functions
Add the following scan callbacks:
```c
cl_engine_set_scan_callback(engine, &pre_hash_callback, CL_SCAN_CALLBACK_PRE_HASH);
cl_engine_set_scan_callback(engine, &pre_scan_callback, CL_SCAN_CALLBACK_PRE_SCAN);
cl_engine_set_scan_callback(engine, &post_scan_callback, CL_SCAN_CALLBACK_POST_SCAN);
cl_engine_set_scan_callback(engine, &alert_callback, CL_SCAN_CALLBACK_ALERT);
cl_engine_set_scan_callback(engine, &file_type_callback, CL_SCAN_CALLBACK_FILE_TYPE);
```
Each callback may alter scan behavior using the following return codes:
* CL_BREAK
Scan aborted by callback (the rest of the scan is skipped).
This does not mark the file as clean or infected, it just skips the rest of the scan.
* CL_SUCCESS / CL_CLEAN
File scan will continue.
This is different than CL_VERIFIED because it does not affect prior or future alerts.
Return CL_VERIFIED instead if you want to remove prior alerts for this layer and skip
the rest of the scan for this layer.
* CL_VIRUS
This means you don't trust the file. A new alert will be added.
For CL_SCAN_CALLBACK_ALERT: Means you agree with the alert (no extra alert needed).
* CL_VERIFIED
Layer explicitly trusted by the callback and previous alerts removed FOR THIS layer.
You might want to do this if you trust the hash or verified a digital signature.
The rest of the scan will be skipped FOR THIS layer.
For contained files, this does NOT mean that the parent or adjacent layers are trusted.
Each callback is given a pointer to the current scan layer from which
they can get previous layers, can get the the layer's fmap, and then
various attributes of the layer and of the fmap such as:
- layer recursion level
- layer object id
- layer file type
- layer attributes (was decerypted, normalized, embedded, or re-typed)
- layer last alert
- fmap name
- fmap hash (md5, sha1, or sha2-256)
- fmap data (pointer and size)
- fmap file descriptor, if any (fd, offset, size)
- fmap filepath, if any (filepath, offset, size)
To make this possible, this commits introduced a handful of new APIs to
query scan-layer details and fmap details:
- `cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name);`
- `cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out);`
- `cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path);`
- `cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, size_t *offset_out, size_t *len_out);`
- `cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t *offset_out, size_t *len_out);`
- `cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t *size_out);`
- `cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char *hash_alg, char hash);`
- `cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char *hash_alg, bool *have_hash_out);`
- `cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const char *hash_alg);`
- `cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char *hash_alg, const char **hash_out);`
- `cl_error_t cl_fmap_get_data(const cl_fmap_t *map, size_t offset, size_t len, const uint8_t **data_out, size_t *data_len_out);`
- `cl_error_t cl_scan_layer_get_fmap(cl_scan_layer_t *layer, cl_fmap_t **fmap_out);`
- `cl_error_t cl_scan_layer_get_parent_layer(cl_scan_layer_t *layer, cl_scan_layer_t **parent_layer_out);`
- `cl_error_t cl_scan_layer_get_type(cl_scan_layer_t *layer, const char **type_out);`
- `cl_error_t cl_scan_layer_get_recursion_level(cl_scan_layer_t *layer, uint32_t *recursion_level_out);`
- `cl_error_t cl_scan_layer_get_object_id(cl_scan_layer_t *layer, uint64_t *object_id_out);`
- `cl_error_t cl_scan_layer_get_last_alert(cl_scan_layer_t *layer, const char **alert_name_out);`
- `cl_error_t cl_scan_layer_get_attributes(cl_scan_layer_t *layer, uint32_t *attributes_out);`
This commit deprecates but does not remove the existing scan callbacks:
- `void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cache callback);`
- `void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, clcb_file_inspection callback);`
- `void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan callback);`
- `void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);`
- `void cl_engine_set_clcb_virus_found(struct cl_engine *engine, clcb_virus_found callback);`
- `void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback);`
This commit also adds an interactive test program to demonstrate the callbacks.
See: `examples/ex_scan_callbacks.c`
CLAM-255
CLAM-2485
CLAM-2626
2025-06-22 14:37:03 -04:00
|
|
|
cl_fmap_set_name;
|
|
|
|
|
cl_fmap_get_name;
|
|
|
|
|
cl_fmap_set_path;
|
|
|
|
|
cl_fmap_get_path;
|
|
|
|
|
cl_fmap_get_fd;
|
|
|
|
|
cl_fmap_get_size;
|
|
|
|
|
cl_fmap_set_hash;
|
|
|
|
|
cl_fmap_have_hash;
|
|
|
|
|
cl_fmap_will_need_hash_later;
|
|
|
|
|
cl_fmap_get_hash;
|
|
|
|
|
cl_fmap_get_data;
|
|
|
|
|
cl_scan_layer_get_fmap;
|
|
|
|
|
cl_scan_layer_get_parent_layer;
|
|
|
|
|
cl_scan_layer_get_type;
|
|
|
|
|
cl_scan_layer_get_recursion_level;
|
|
|
|
|
cl_scan_layer_get_object_id;
|
|
|
|
|
cl_scan_layer_get_last_alert;
|
|
|
|
|
cl_scan_layer_get_attributes;
|
|
|
|
|
cl_engine_set_scan_callback;
|
FIPS-compliant CVD signing and verification
Add X509 certificate chain based signing with PKCS7-PEM external
signatures distributed alongside CVD's in a custom .cvd.sign format.
This new signing and verification mechanism is primarily in support
of FIPS compliance.
Fixes: https://github.com/Cisco-Talos/clamav/issues/564
Add a Rust implementation for parsing, verifying, and unpacking CVD
files.
Now installs a 'certs' directory in the app config directory
(e.g. <prefix>/etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
`-D CVD_CERTS_DIRECTORY=PATH`
New options to set an alternative CVD certs directory:
- Commandline for freshclam, clamd, clamscan, and sigtool is:
`--cvdcertsdir PATH`
- Env variable for freshclam, clamd, clamscan, and sigtool is:
`CVD_CERTS_DIR`
- Config option for freshclam and clamd is:
`CVDCertsDirectory PATH`
Sigtool:
- Add sign/verify commands.
- Also verify CDIFF external digital signatures when applying CDIFFs.
- Place commonly used commands at the top of --help string.
- Fix up manpage.
Freshclam:
- Will try to download .sign files to verify CVDs and CDIFFs.
- Fix an issue where making a CLD would only include the CFG file for
daily and not if patching any other database.
libclamav.so:
- Bump version to 13:0:1 (aka 12.1.0).
- Also remove libclamav.map versioning.
Resolves: https://github.com/Cisco-Talos/clamav/issues/1304
- Add two new API's to the public clamav.h header:
```c
extern cl_error_t cl_cvdverify_ex(const char *file,
const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
const char *dir,
bool dont_verify,
const char *certs_directory);
```
The original `cl_cvdverify` and `cl_cvdunpack` are deprecated.
- Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`.
You may set this option with `cl_engine_set_str` and get it
with `cl_engine_get_str`, to override the compiled in default
CVD certs directory.
libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).
Add sigtool sign/verify tests and test certs.
Make it so downloadFile doesn't throw a warning if the server
doesn't have the .sign file.
Replace use of md5-based FP signatures in the unit tests with
sha256-based FP signatures because the md5 implementation used
by Python may be disabled in FIPS mode.
Fixes: https://github.com/Cisco-Talos/clamav/issues/1411
CMake: Add logic to enable the Rust openssl-sys / openssl-rs crates
to build against the same OpenSSL library as is used for the C build.
The Rust unit test application must also link directly with libcrypto
and libssl.
Fix some log messages with missing new lines.
Fix missing environment variable notes in --help messages and manpages.
Deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in
clamav-config.h.in for libclamav from variable that had the same name
for use in clamav applications that use the optparser.
The 'clamav-test' certs for the unit tests will live for 10 years.
The 'clamav-beta.crt' public cert will only live for 120 days and will
be replaced before the stable release with a production 'clamav.crt'.
2024-11-21 14:01:09 -05:00
|
|
|
};
|
2007-12-29 09:08:05 +00:00
|
|
|
CLAMAV_PRIVATE {
|
|
|
|
|
global:
|
2019-01-22 14:05:05 -05:00
|
|
|
cli_sigperf_print;
|
|
|
|
|
cli_sigperf_events_destroy;
|
2014-09-16 15:56:56 -04:00
|
|
|
cli_pcre_perf_print;
|
|
|
|
|
cli_pcre_perf_events_destroy;
|
2015-06-03 15:28:39 -04:00
|
|
|
cli_pcre_build;
|
|
|
|
|
cli_pcre_scanbuf;
|
|
|
|
|
cli_pcre_recaloff;
|
|
|
|
|
cli_pcre_freeoff;
|
2012-12-05 15:48:52 -08:00
|
|
|
|
2009-09-24 16:21:51 +02:00
|
|
|
cli_gettmpdir;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_strtok;
|
2009-04-27 15:42:35 +00:00
|
|
|
cli_strtokenize;
|
2015-07-21 17:30:14 -04:00
|
|
|
cli_ldbtokenize;
|
2014-12-11 18:13:17 -05:00
|
|
|
cli_strlcat;
|
|
|
|
|
cli_strlcpy;
|
2020-01-28 14:21:31 -05:00
|
|
|
cli_strntoul;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_regcomp;
|
|
|
|
|
cli_regexec;
|
|
|
|
|
cli_regfree;
|
|
|
|
|
cli_strrcpy;
|
|
|
|
|
cli_strbcasestr;
|
2008-01-30 20:04:02 +00:00
|
|
|
cli_isnumber;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_gentemp;
|
|
|
|
|
cli_gentempfd;
|
|
|
|
|
cli_rmdirs;
|
|
|
|
|
cli_chomp;
|
|
|
|
|
cli_rndnum;
|
|
|
|
|
|
|
|
|
|
cli_ole2_extract;
|
|
|
|
|
cli_errmsg;
|
2008-02-15 20:45:51 +00:00
|
|
|
cli_debug_flag;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_vba_readdir;
|
|
|
|
|
cli_vba_inflate;
|
|
|
|
|
cli_ppt_vba_read;
|
|
|
|
|
cli_wm_readdir;
|
|
|
|
|
cli_wm_decrypt_macro;
|
2019-01-22 14:05:05 -05:00
|
|
|
cli_free_vba_project;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_readn;
|
|
|
|
|
cli_str2hex;
|
2011-01-18 15:00:37 +01:00
|
|
|
cli_hashfile;
|
|
|
|
|
cli_hashstream;
|
2015-07-07 16:46:19 -04:00
|
|
|
text_normalize_init;
|
|
|
|
|
text_normalize_reset;
|
|
|
|
|
text_normalize_map;
|
2009-08-31 06:16:12 +02:00
|
|
|
html_normalise_map;
|
2007-12-29 09:08:05 +00:00
|
|
|
cli_utf16toascii;
|
|
|
|
|
|
|
|
|
|
cli_memstr;
|
2024-01-09 17:44:33 -05:00
|
|
|
cli_safer_strdup;
|
2022-05-09 14:28:34 -07:00
|
|
|
cli_max_calloc;
|
|
|
|
|
cli_max_malloc;
|
|
|
|
|
cli_max_realloc;
|
|
|
|
|
cli_safer_realloc;
|
2008-02-03 19:23:20 +00:00
|
|
|
cli_ctime;
|
2007-12-29 09:08:05 +00:00
|
|
|
tableCreate;
|
|
|
|
|
tableDestroy;
|
|
|
|
|
tableRemove;
|
|
|
|
|
tableFind;
|
|
|
|
|
tableIterate;
|
|
|
|
|
tableUpdate;
|
|
|
|
|
tableInsert;
|
|
|
|
|
cli_warnmsg;
|
|
|
|
|
cli_strtokbuf;
|
2008-07-08 19:02:15 +00:00
|
|
|
cli_js_init;
|
|
|
|
|
cli_js_process_buffer;
|
|
|
|
|
cli_js_parse_done;
|
|
|
|
|
cli_js_destroy;
|
|
|
|
|
cli_js_output;
|
2008-07-08 19:37:18 +00:00
|
|
|
cli_unescape;
|
|
|
|
|
cli_textbuffer_append_normalize;
|
2008-07-14 19:31:56 +00:00
|
|
|
cli_dconf_init;
|
2008-07-24 18:48:31 +00:00
|
|
|
cli_regex2suffix;
|
2008-07-14 19:31:56 +00:00
|
|
|
html_normalise_mem;
|
2008-07-25 16:03:04 +00:00
|
|
|
init_regex_list;
|
|
|
|
|
is_regex_ok;
|
|
|
|
|
regex_list_done;
|
|
|
|
|
regex_list_add_pattern;
|
|
|
|
|
cli_build_regex_list;
|
|
|
|
|
regex_list_match;
|
2010-06-29 13:51:59 +02:00
|
|
|
cli_hashset_destroy;
|
2008-07-25 16:03:04 +00:00
|
|
|
phishing_init;
|
|
|
|
|
phishing_done;
|
|
|
|
|
blobCreate;
|
|
|
|
|
blobAddData;
|
|
|
|
|
phishingScan;
|
|
|
|
|
blobDestroy;
|
|
|
|
|
load_regex_matcher;
|
2008-07-25 20:01:40 +00:00
|
|
|
html_tag_arg_free;
|
2008-07-28 19:22:15 +00:00
|
|
|
disasmbuf;
|
2008-08-04 00:01:14 +00:00
|
|
|
uniq_init;
|
|
|
|
|
uniq_free;
|
|
|
|
|
uniq_add;
|
|
|
|
|
uniq_get;
|
2008-08-01 14:50:38 +00:00
|
|
|
cli_hex2str;
|
2008-08-07 12:40:41 +00:00
|
|
|
cli_ac_init;
|
|
|
|
|
cli_ac_initdata;
|
|
|
|
|
cli_ac_buildtrie;
|
|
|
|
|
cli_ac_scanbuff;
|
|
|
|
|
cli_ac_freedata;
|
|
|
|
|
cli_ac_free;
|
2009-11-26 19:43:32 +01:00
|
|
|
cli_ac_chklsig;
|
2015-06-09 11:12:20 -04:00
|
|
|
cli_sigopts_handler;
|
2008-08-07 12:40:41 +00:00
|
|
|
cli_bm_init;
|
|
|
|
|
cli_bm_scanbuff;
|
|
|
|
|
cli_bm_free;
|
2009-12-09 23:32:34 +01:00
|
|
|
cli_initroots;
|
2020-03-21 14:15:28 -04:00
|
|
|
cli_scan_buff;
|
|
|
|
|
cli_scan_fmap;
|
2019-02-12 15:10:04 -05:00
|
|
|
cli_check_auth_header;
|
2016-06-29 18:21:39 -04:00
|
|
|
cli_genhash_pe;
|
2008-10-11 13:56:29 +00:00
|
|
|
html_screnc_decode;
|
2009-01-26 19:47:02 +00:00
|
|
|
mpool_create;
|
2010-02-09 12:01:31 +02:00
|
|
|
mpool_calloc;
|
2009-01-26 19:47:02 +00:00
|
|
|
mpool_destroy;
|
|
|
|
|
mpool_free;
|
|
|
|
|
mpool_getstats;
|
2009-01-27 10:57:54 +00:00
|
|
|
cli_versig;
|
2010-01-20 15:02:13 +01:00
|
|
|
cli_versig2;
|
2009-02-03 18:47:18 +00:00
|
|
|
cli_filecopy;
|
2009-02-12 16:40:35 +00:00
|
|
|
cli_ftw;
|
|
|
|
|
cli_unlink;
|
|
|
|
|
cli_writen;
|
2009-02-18 14:54:16 +00:00
|
|
|
cli_url_canon;
|
2009-03-11 19:11:09 +00:00
|
|
|
cli_strerror;
|
2024-01-29 10:25:29 -07:00
|
|
|
cli_ftname;
|
|
|
|
|
cli_ftcode;
|
2009-03-22 16:55:41 +00:00
|
|
|
decodeLine;
|
|
|
|
|
messageCreate;
|
|
|
|
|
messageDestroy;
|
|
|
|
|
base64Flush;
|
2024-01-29 10:25:29 -07:00
|
|
|
cli_unrar_open;
|
|
|
|
|
cli_unrar_peek_file_header;
|
|
|
|
|
cli_unrar_extract_file;
|
|
|
|
|
cli_unrar_skip_file;
|
|
|
|
|
cli_unrar_close;
|
2009-04-27 15:42:35 +00:00
|
|
|
have_rar;
|
2009-08-28 20:07:25 +03:00
|
|
|
have_clamjit;
|
2009-06-26 16:30:46 +03:00
|
|
|
cli_bytecode_load;
|
2010-08-11 13:39:49 +03:00
|
|
|
cli_bytecode_prepare2;
|
2009-06-26 16:30:46 +03:00
|
|
|
cli_bytecode_run;
|
|
|
|
|
cli_bytecode_destroy;
|
2009-07-07 19:58:37 +03:00
|
|
|
cli_bytecode_context_alloc;
|
|
|
|
|
cli_bytecode_context_destroy;
|
|
|
|
|
cli_bytecode_context_setfuncid;
|
|
|
|
|
cli_bytecode_context_setparam_int;
|
|
|
|
|
cli_bytecode_context_setparam_ptr;
|
2009-09-08 22:25:33 +03:00
|
|
|
cli_bytecode_context_setfile;
|
2009-07-08 12:45:06 +03:00
|
|
|
cli_bytecode_context_getresult_int;
|
2023-10-12 04:14:53 +09:00
|
|
|
|
2009-08-25 18:54:14 +03:00
|
|
|
cli_bytecode_init;
|
|
|
|
|
cli_bytecode_done;
|
2009-08-27 18:12:39 +03:00
|
|
|
cli_bytecode_debug;
|
2009-11-19 20:18:39 +02:00
|
|
|
cli_hex2ui;
|
2025-06-08 01:12:33 -04:00
|
|
|
fmap_new;
|
2009-12-09 16:50:55 +02:00
|
|
|
cli_bytecode_context_set_trace;
|
|
|
|
|
cli_bytecode_debug_printsrc;
|
2009-12-11 20:43:58 +02:00
|
|
|
cli_bytecode_printversion;
|
2010-01-22 16:50:16 +02:00
|
|
|
cli_bytecode_describe;
|
2014-05-22 14:30:03 -04:00
|
|
|
cli_bytetype_describe;
|
|
|
|
|
cli_bytevalue_describe;
|
|
|
|
|
cli_byteinst_describe;
|
|
|
|
|
cli_bytefunc_describe;
|
2010-04-19 18:35:30 +03:00
|
|
|
cli_printcxxver;
|
2010-07-29 13:11:52 +03:00
|
|
|
cli_detect_environment;
|
2010-09-30 00:03:51 +03:00
|
|
|
cli_disasm_one;
|
2011-06-17 22:20:31 +03:00
|
|
|
cli_utf16_to_utf8;
|
2013-10-31 12:54:50 -04:00
|
|
|
get_fpu_endian;
|
2014-02-08 00:31:12 -05:00
|
|
|
cl_initialize_crypto;
|
|
|
|
|
cl_cleanup_crypto;
|
|
|
|
|
cl_hash_data;
|
|
|
|
|
cl_hash_file_fd;
|
|
|
|
|
cl_hash_file_fp;
|
|
|
|
|
cl_hash_file_fd_ctx;
|
|
|
|
|
cl_sha256;
|
|
|
|
|
cl_sha1;
|
|
|
|
|
cl_verify_signature;
|
|
|
|
|
cl_verify_signature_x509_keyfile;
|
|
|
|
|
cl_verify_signature_x509;
|
|
|
|
|
cl_get_x509_from_mem;
|
|
|
|
|
cl_validate_certificate_chain_ts_dir;
|
|
|
|
|
cl_validate_certificate_chain;
|
|
|
|
|
cl_verify_signature_fd;
|
|
|
|
|
cl_verify_signature_fd_x509;
|
|
|
|
|
cl_verify_signature_fd_x509_keyfile;
|
|
|
|
|
cl_verify_signature_hash;
|
|
|
|
|
cl_verify_signature_hash_x509;
|
|
|
|
|
cl_verify_signature_hash_x509_keyfile;
|
|
|
|
|
cl_load_cert;
|
|
|
|
|
cl_ASN1_GetTimeT;
|
|
|
|
|
cl_load_crl;
|
2014-03-11 10:50:59 -04:00
|
|
|
cl_sign_data_keyfile;
|
2014-02-08 00:31:12 -05:00
|
|
|
cl_sign_data;
|
|
|
|
|
cl_sign_file_fd;
|
|
|
|
|
cl_sign_file_fp;
|
|
|
|
|
cl_get_pkey_file;
|
|
|
|
|
cl_base64_decode;
|
|
|
|
|
cl_base64_encode;
|
2019-03-02 13:05:17 -05:00
|
|
|
cli_sanitize_filepath;
|
2019-12-24 08:13:47 -05:00
|
|
|
cli_gentemp_with_prefix;
|
CMake: Add CTest support to match Autotools checks
An ENABLE_TESTS CMake option is provided so that users can disable
testing if they don't want it. Instructions for how to use this
included in the INSTALL.cmake.md file.
If you run `ctest`, each testcase will write out a log file to the
<build>/unit_tests directory.
As with Autotools' make check, the test files are from test/.split
and unit_tests/.split files, but for CMake these are generated at
build time instead of at test time.
On Posix systems, sets the LD_LIBRARY_PATH so that ClamAV-compiled
libraries can be loaded when running tests.
On Windows systems, CTest will identify and collect all library
dependencies and assemble a temporarily install under the
build/unit_tests directory so that the libraries can be loaded when
running tests.
The same feature is used on Windows when using CMake to install to
collect all DLL dependencies so that users don't have to install them
manually afterwards.
Each of the CTest tests are run using a custom wrapper around Python's
unittest framework, which is also responsible for finding and inserting
valgrind into the valgrind tests on Posix systems.
Unlike with Autotools, the CMake CTest Valgrind-tests are enabled by
default, if Valgrind can be found. There's no need to set VG=1.
CTest's memcheck module is NOT supported, because we use Python to
orchestrate our tests.
Added a bunch of Windows compatibility changes to the unit tests.
These were primarily changing / to PATHSEP and making adjustments
to use Win32 C headers and ifdef out the POSIX ones which aren't
available on Windows. Also disabled a bunch of tests on Win32
that don't work on Windows, notably the mmap ones and FD-passing
(i.e. FILEDES) ones.
Add JSON_C_HAVE_INTTYPES_H definition to clamav-config.h to eliminate
warnings on Windows where json.h is included after inttypes.h because
json-c's inttypes replacement relies on it.
This is a it of a hack and may be removed if json-c fixes their
inttypes header stuff in the future.
Add preprocessor definitions on Windows to disable MSVC warnings about
CRT secure and nonstandard functions. While there may be a better
solution, this is needed to be able to see other more serious warnings.
Add missing file comment block and copyright statement for clamsubmit.c.
Also change json-c/json.h include filename to json.h in clamsubmit.c.
The directory name is not required.
Changed the hash table data integer type from long, which is poorly
defined, to size_t -- which is capable of storing a pointer. Fixed a
bunch of casts regarding this variable to eliminate warnings.
Fixed two bugs causing utf8 encoding unit tests to fail on Windows:
- The in_size variable should be the number of bytes, not the character
count. This was was causing the SHIFT_JIS (japanese codepage) to UTF8
transcoding test to only transcode half the bytes.
- It turns out that the MultiByteToWideChar() API can't transcode
UTF16-BE to UTF16-LE. The solution is to just iterate over the buffer
and flip the bytes on each uint16_t. This but was causing the UTF16-BE
to UTF8 tests to fail.
I also split up the utf8 transcoding tests into separate tests so I
could see all of the failures instead of just the first one.
Added a flags parameter to the unit test function to open testfiles
because it turns out that on Windows if a file contains the \r\n it will
replace it with just \n if you opened the file as a text file instead of
as binary. However, if we open the CBC files as binary, then a bunch of
bytecode tests fail. So I've changed the tests to open the CBC files in
the bytecode tests as text files and open all other files as binary.
Ported the feature tests from shell scripts to Python using a modified
version of our QA test-framework, which is largely compatible and will
allow us to migrate some QA tests into this repo. I'd like to add GitHub
Actions pipelines in the future so that all public PR's get some testing
before anyone has to manually review them.
The clamd --log option was missing from the help string, though it
definitely works. I've added it in this commit.
It appears that clamd.c was never clang-format'd, so this commit also
reformats clamd.c.
Some of the check_clamd tests expected the path returned by clamd to
match character for character with original path sent to clamd. However,
as we now evaluate real paths before a scan, the path returned by clamd
isn't going to match the relative (and possibly symlink-ridden) path
passed to clamdscan. I fixed this test by changing the test to search
for the basename: <signature> FOUND within the response instead of
matching the exact path.
Autotools: Link check_clamd with libclamav so we can use our utility
functions in check_clamd.c.
2020-08-25 23:14:23 -07:00
|
|
|
cli_gentempfd_with_prefix;
|
clamd clients: Mitigate move/remove symlink attack
A malicious user could replace a scan target's directory with a symlink
to another path to trick clamscan, clamdscan, or clamonacc into removing
or moving a different file (eg. a critical system file). The issue would
affect users that use the `--move` or `--remove` options for clamscan,
clamdscan, and clamonacc.
This patch gets the real path for the scan target before the scan,
and if the file alerts and the --move or --remove quarantine features
are used, it mitigates the symlink attack by traversing the path one
directory at a time until reaching the leaf directory where the scan
target file resides before unlinking (or renaming) the file directly.
This commit applies a similar tactic used in the previous commit for
Windows builds, using the Win32 Native API to traverse a path and delete
or move files by handle rather than by file path.
I had some trouble using SetFileInformationByHandle to rename a file by
handle, so for Windows instead it will copy the file to the new location
and then use the safe unlink technique to remove the old file. If the
symlink attack occurs, the unlink will fail, and the system will not be
damaged.
For more information about AV quarantine attacks using links, see the
[RACK911 Lab's report](https://www.rack911labs.com/research/exploiting-almost-every-antivirus-software)
2020-07-01 22:21:40 -07:00
|
|
|
cli_basename;
|
|
|
|
|
cli_realpath;
|
2020-07-24 14:45:44 -07:00
|
|
|
cli_codepage_to_utf8;
|
2021-01-25 20:31:41 -08:00
|
|
|
cli_get_filepath_from_filedesc;
|
2021-01-23 16:41:41 -08:00
|
|
|
fmap_duplicate;
|
|
|
|
|
free_duplicate_fmap;
|
2022-11-19 16:16:04 -07:00
|
|
|
cli_add_content_match_pattern;
|
|
|
|
|
cli_dbgmsg;
|
|
|
|
|
cli_dbgmsg_no_inline;
|
|
|
|
|
cli_get_debug_flag;
|
|
|
|
|
cli_get_last_virus_str;
|
|
|
|
|
cli_getdsig;
|
|
|
|
|
cli_infomsg_simple;
|
|
|
|
|
cli_set_debug_flag;
|
|
|
|
|
fmap_dump_to_file;
|
|
|
|
|
init_allow_list;
|
|
|
|
|
init_domain_list;
|
|
|
|
|
lsig_increment_subsig_match;
|
|
|
|
|
readdb_parse_ldb_subsignature;
|
2023-06-28 14:10:35 -07:00
|
|
|
fuzzy_hash_calculate_image;
|
|
|
|
|
ffierror_fmt;
|
2023-09-29 12:49:29 -07:00
|
|
|
cli_magic_scan_buff;
|
2023-11-07 23:00:30 -05:00
|
|
|
cli_checklimits;
|
|
|
|
|
cli_matchmeta;
|
FIPS-compliant CVD signing and verification
Add X509 certificate chain based signing with PKCS7-PEM external
signatures distributed alongside CVD's in a custom .cvd.sign format.
This new signing and verification mechanism is primarily in support
of FIPS compliance.
Fixes: https://github.com/Cisco-Talos/clamav/issues/564
Add a Rust implementation for parsing, verifying, and unpacking CVD
files.
Now installs a 'certs' directory in the app config directory
(e.g. <prefix>/etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
`-D CVD_CERTS_DIRECTORY=PATH`
New options to set an alternative CVD certs directory:
- Commandline for freshclam, clamd, clamscan, and sigtool is:
`--cvdcertsdir PATH`
- Env variable for freshclam, clamd, clamscan, and sigtool is:
`CVD_CERTS_DIR`
- Config option for freshclam and clamd is:
`CVDCertsDirectory PATH`
Sigtool:
- Add sign/verify commands.
- Also verify CDIFF external digital signatures when applying CDIFFs.
- Place commonly used commands at the top of --help string.
- Fix up manpage.
Freshclam:
- Will try to download .sign files to verify CVDs and CDIFFs.
- Fix an issue where making a CLD would only include the CFG file for
daily and not if patching any other database.
libclamav.so:
- Bump version to 13:0:1 (aka 12.1.0).
- Also remove libclamav.map versioning.
Resolves: https://github.com/Cisco-Talos/clamav/issues/1304
- Add two new API's to the public clamav.h header:
```c
extern cl_error_t cl_cvdverify_ex(const char *file,
const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
const char *dir,
bool dont_verify,
const char *certs_directory);
```
The original `cl_cvdverify` and `cl_cvdunpack` are deprecated.
- Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`.
You may set this option with `cl_engine_set_str` and get it
with `cl_engine_get_str`, to override the compiled in default
CVD certs directory.
libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).
Add sigtool sign/verify tests and test certs.
Make it so downloadFile doesn't throw a warning if the server
doesn't have the .sign file.
Replace use of md5-based FP signatures in the unit tests with
sha256-based FP signatures because the md5 implementation used
by Python may be disabled in FIPS mode.
Fixes: https://github.com/Cisco-Talos/clamav/issues/1411
CMake: Add logic to enable the Rust openssl-sys / openssl-rs crates
to build against the same OpenSSL library as is used for the C build.
The Rust unit test application must also link directly with libcrypto
and libssl.
Fix some log messages with missing new lines.
Fix missing environment variable notes in --help messages and manpages.
Deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in
clamav-config.h.in for libclamav from variable that had the same name
for use in clamav applications that use the optparser.
The 'clamav-test' certs for the unit tests will live for 10 years.
The 'clamav-beta.crt' public cert will only live for 120 days and will
be replaced before the stable release with a production 'clamav.crt'.
2024-11-21 14:01:09 -05:00
|
|
|
cli_cvdunpack_and_verify;
|
FIPS & FIPS-like limits on hash algs for cryptographic uses
ClamAV will not function when using a FIPS-enabled OpenSSL 3.x.
This is because ClamAV uses MD5 and SHA1 algorithms for a variety of
purposes including matching for malware detection, matching to prevent
false positives on known-clean files, and for verification of MD5-based
RSA digital signatures for determining CVD (signature database archive)
authenticity.
Interestingly, FIPS had been intentionally bypassed when creating hashes
based whole buffers and whole files (by descriptor or `FILE`-pointer):
https://github.com/Cisco-Talos/clamav/commit/78d4a9985a06a418dd1338c94ee5db461035d75b
Note: this bypassed FIPS the 1.x way with:
`EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);`
It was NOT disabled when using `cl_hash_init()` / `cl_update_hash()` /
`cl_finish_hash()`. That likely worked by coincidence in that the hash
was already calculated most of the time. It certainly would have made
use of those functions if the hash had not been calculated prior:
https://github.com/Cisco-Talos/clamav/blob/78d4a9985a06a418dd1338c94ee5db461035d75b/libclamav/matcher.c#L743
Regardless, bypassing FIPS entirely is not the correct solution.
The FIPS restrictions against using MD5 and SHA1 are valid, particularly
when verifying CVD digital siganatures, but also I think when using a
hash to determine if the file is known-clean (i.e. the "clean cache" and
also MD5-based and SHA1-based FP signatures).
This commit extends the work to bypass FIPS using the newer 3.x method:
`md = EVP_MD_fetch(NULL, alg, "-fips");`
It does this for the legacy `cl_hash*()` functions including
`cl_hash_init()` / `cl_update_hash()` / `cl_finish_hash()`.
It also introduces extended versions that allow the caller to choose if
they want to bypass FIPS:
- `cl_hash_data_ex()`
- `cl_hash_init_ex()`
- `cl_update_hash_ex()`
- `cl_finish_hash_ex()`
- `cl_hash_destroy_ex()`
- `cl_hash_file_fd_ex()`
See the `flags` parameter for each.
Ironically, this commit does NOT use the new functions at this time.
The rational is that ClamAV may need MD5, SHA1, and SHA-256 hashes of
the same files both for determining if the file is malware, and for
determining if the file is clean.
So instead, this commit will do a checks when:
1. Creating a new ClamAV scanning engine. If FIPS-mode enabled, it will
automatically toggle the "FIPS limits" engine option.
When loading signatures, if the engine "FIPS limits" option is enabled,
then MD5 and SHA1 FP signatures will be skipped.
2. Before verifying a CVD (e.g. also for loading, unpacking when
verification enabled).
If "FIPS limits" or FIPS-mode are enabled, then the legacy MD5-based RSA
method is disabled.
Note: This commit also refactors the interface for `cl_cvdverify_ex()`
and `cl_cvdunpack_ex()` so they take a `flags` parameters, rather than a
single `bool`. As these functions are new in this version, it does not
break the ABI.
The cache was already switched to use SHA2-256, so that's not a concern
for checking FIPS-mode / FIPS limits options.
This adds an option for `freshclam.conf` and `clamd.conf`:
FIPSCryptoHashLimits yes
And an equivalent command-line option for `clamscan` and `sigtool`:
--fips-limits
You may programmatically enable FIPS-limits for a ClamAV engine like this:
```C
cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);
```
CLAM-2792
2025-07-01 20:41:47 -04:00
|
|
|
cli_cvdverify;
|
2019-08-22 16:51:01 -04:00
|
|
|
|
|
|
|
|
__cli_strcasestr;
|
|
|
|
|
__cli_strndup;
|
|
|
|
|
__cli_strnlen;
|
|
|
|
|
__cli_strnstr;
|
2007-12-29 09:08:05 +00:00
|
|
|
local:
|
|
|
|
|
*;
|
|
|
|
|
};
|