clamav/unit_tests/sigtool_test.py

# Copyright (C) 2020-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

"""
Run sigtool tests.
"""

import os
from pathlib import Path
import platform
import shutil
import subprocess
import sys
import time
import unittest

import testcase


os_platform = platform.platform()
operating_system = os_platform.split('-')[0].lower()


class TC(testcase.TestCase):
    @classmethod
    def setUpClass(cls):
        super(TC, cls).setUpClass()

        # Prepare a directory to host our test databases
        TC.path_www = TC.path_tmp / 'www'
        TC.path_www.mkdir()
        shutil.copy(
            str(TC.path_build / 'unit_tests' / 'input' / 'clamav.hdb'),
            str(TC.path_www),
        )

        TC.path_db = TC.path_tmp / 'database'
        TC.sigtool_pid = TC.path_tmp / 'sigtool-test.pid'
        TC.sigtool_config = TC.path_tmp / 'sigtool-test.conf'
        TC.sigtool_config.write_text('''
            DatabaseMirror localhost
            PidFile {sigtool_pid}
            LogVerbose yes
            LogFileMaxSize 0
            LogTime yes
            DatabaseDirectory {path_db}
            DatabaseCustomURL file://{path_www}/clamav.hdb
            ExcludeDatabase daily
            ExcludeDatabase main
            ExcludeDatabase bytecode
        '''.format(
            sigtool_pid=TC.sigtool_pid,
            path_db=TC.path_db,
            path_www=TC.path_www
        ))

    @classmethod
    def tearDownClass(cls):
        super(TC, cls).tearDownClass()

    def setUp(self):
        TC.original_cwd = os.getcwd()
        super(TC, self).setUp()

    def tearDown(self):
        super(TC, self).tearDown()
        self.verify_valgrind_log()
        os.chdir(TC.original_cwd)

    def test_sigtool_00_version(self):
        self.step_name('sigtool version test')

        self.log.warning('VG: {}'.format(os.getenv("VG")))
        command = '{valgrind} {valgrind_args} {sigtool} -V'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        expected_results = [
            'ClamAV {}'.format(TC.version),
        ]
        self.verify_output(output.out, expected=expected_results)

    def test_sigtool_01_run_cdiff(self):
        self.step_name('sigtool run cdiff test')
        # In addition to testing that running a cdiff works, this also tests a regression.
        # Applying test-3.cdiff was failing because UNLINK wasn't properly implemented (since 0.105.0).
        # We didn't notice it because logging wasn't enabled, and leniency in our freshclam cdiff process
        # allowed the test to pass without noticing the bug.

        self.log.warning('VG: {}'.format(os.getenv("VG")))

        (TC.path_tmp / 'run_cdiff').mkdir()
        os.chdir(str(TC.path_tmp / 'run_cdiff'))

        command = '{valgrind} {valgrind_args} {sigtool} --unpack {cvd}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            cvd=TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-1.cvd'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        # Apply 1st cdiff.

        command = '{valgrind} {valgrind_args} {sigtool} --run-cdiff={cdiff}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            cdiff=TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-2.cdiff'
        )
        output = self.execute_command(command)

        # Apply 2nd cdiff. This one failed because the CLOSE operation should create a file
        # if it didn't exist, and it was only appending but not creating.

        command = '{valgrind} {valgrind_args} {sigtool} --run-cdiff={cdiff}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            cdiff=TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-3.cdiff'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

    def test_sigtool_02_rust_logs_messages_work(self):
        self.step_name('sigtool test rust log macros work')
        # In addition to testing that running a cdiff works, this also tests a regression.
        # Applying test-3.cdiff was failing because UNLINK wasn't properly implemented (since 0.105.0).
        # We didn't notice it because logging wasn't enabled, and leniency in our freshclam cdiff process
        # allowed the test to pass without noticing the bug.

        self.log.warning('VG: {}'.format(os.getenv("VG")))

        (TC.path_tmp / 'run_cdiff_log').mkdir()
        os.chdir(str(TC.path_tmp / 'run_cdiff_log'))

        command = '{valgrind} {valgrind_args} {sigtool} --unpack {cvd}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            cvd=TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-1.cvd'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        # Apply cdiffs in wrong order. Should fail and print a message.

        command = '{valgrind} {valgrind_args} {sigtool} --run-cdiff={cdiff}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            cdiff=TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-3.cdiff'
        )
        output = self.execute_command(command)

        assert output.ec == 1  # failure

        # Verify that the `error!()` message was printed to stderr.
        # This didn't happen before when we didn't initialize the rust logging lib at the top of sigtool.
        expected_results = [
            'LibClamAV Error',
        ]
        self.verify_output(output.err, expected=expected_results)

    def test_sigtool_03_sign_and_verify(self):
        self.step_name('sigtool test for --sign and --verify')
        # Verify that you can sign and verify any file.

        # Create a file to sign.
        (TC.path_tmp / 'file_to_sign').write_text('This is a file to sign.')

        self.log.warning('VG: {}'.format(os.getenv("VG")))

        command = '{valgrind} {valgrind_args} {sigtool} --sign {input} --key {signing_key} --cert {signing_cert} --cert {intermediate_cert}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            input=TC.path_tmp / 'file_to_sign',
            signing_key=TC.path_build / 'unit_tests' / 'input' / 'signing' / 'sign' / 'signing-test.key',
            signing_cert=TC.path_source / 'unit_tests' / 'input' / 'signing' / 'sign' / 'signing-test.crt',
            intermediate_cert=TC.path_source / 'unit_tests' / 'input' / 'signing' / 'sign' / 'intermediate-test.crt'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        # Verify the signed file (should pass)

        command = '{valgrind} {valgrind_args} {sigtool} --verify {input} --cvdcertsdir {cvdcertsdir}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            input=TC.path_tmp / 'file_to_sign',
            cvdcertsdir=TC.path_source / 'unit_tests' / 'input' / 'signing' / 'verify'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        expected_results = [
            'Successfully verified file',
            "signed by 'ClamAV TEST CVD Signing Cert'",
        ]
        self.verify_output(output.out, expected=expected_results)

        # Modify the signed file

        (TC.path_tmp / 'file_to_sign').write_text(' Modified.')

        # verify the signed file (should fail now)

        command = '{valgrind} {valgrind_args} {sigtool} --verify {input} --cvdcertsdir {cvdcertsdir}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            input=TC.path_tmp / 'file_to_sign',
            cvdcertsdir=TC.path_source / 'unit_tests' / 'input' / 'signing' / 'verify'
        )
        output = self.execute_command(command)

        assert output.ec != 0  # not success

        expected_results = [
            'Failed to verify file',
        ]
        unexpected_results = [
            'Successfully verified file',
            "signed by 'ClamAV TEST CVD Signing Cert'",
        ]
        self.verify_output(output.err, expected=expected_results, )
        self.verify_output(output.out, unexpected=unexpected_results)

    def test_sigtool_04_diff(self):
        self.step_name('sigtool test for --diff')
        # Verify that you can diff two versions of a CVD.

        # Get two CVD's. The '.script' diff file will be placed in the same
        # directory as the CVD's, so we'll put them inour temp directory.
        (TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles'/ 'test-5.cvd')
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-5.cvd'),
                    str(TC.path_tmp))
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-5.cvd.sign'),
                    str(TC.path_tmp))
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-6.cvd'),
                    str(TC.path_tmp / 'test.cvd'))
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-6.cvd.sign'),
                    str(TC.path_tmp / 'test-6.cvd.sign'))

        # Run the diff command.
        self.log.warning('VG: {}'.format(os.getenv("VG")))

        command = '{valgrind} {valgrind_args} {sigtool} --diff {old_cvd} {new_cvd}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            old_cvd=TC.path_tmp / 'test-5.cvd',
            new_cvd=TC.path_tmp / 'test.cvd'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        expected_results = [
            'Generated diff file',
            'correctly applies to',
        ]
        self.verify_output(output.out, expected=expected_results)

    def test_sigtool_05_build(self):
        self.step_name('sigtool test for --build')
        # Verify that you can build a CUD (not signed with legacy-method).

        # This test starts with an existing CVD, adding a new signature to it.
        # The CVD will be unpacked, a new signature will be added, and then a new CUD will be built.

        # Get a CVD.
        (TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles'/ 'test-5.cvd')
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-6.cvd'),
                    str(TC.path_tmp / 'test.cvd'))
        shutil.copy(str(TC.path_source / 'unit_tests' / 'input' / 'freshclam_testfiles' / 'test-6.cvd.sign'),
                    str(TC.path_tmp / 'test-6.cvd.sign'))

        # Unpack it to the tmp directory.
        self.log.warning('VG: {}'.format(os.getenv("VG")))

        command = '{valgrind} {valgrind_args} {sigtool} --unpack {old_cvd} --debug'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            old_cvd=TC.path_tmp / 'test.cvd'
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        expected_results = [
            'CVD unpacked successfully',
        ]
        self.verify_output(output.err, expected=expected_results)

        # Add a line to one of the signature files.
        with (TC.path_tmp / 'test.ldb').open('ab') as f:
            f.write(
                b'What.a.Silly.Sig.Name-123-0;Engine:51-255,Target:0;0;deadbeefcafe\n'
            )

        # Set 'SIGNDUSER' environment variable to 'pytest' to avoid permission issues.
        os.environ['SIGNDUSER'] = 'pytest'

        # Build a new CVD.
        command = '{valgrind} {valgrind_args} {sigtool} --build=test.cud --unsigned --debug --datadir={path_tmp}'.format(
            valgrind=TC.valgrind, valgrind_args=TC.valgrind_args, sigtool=TC.sigtool,
            path_tmp=TC.path_tmp
        )
        output = self.execute_command(command)

        assert output.ec == 0  # success

        expected_results = [
            'Total sigs: 42',
            'New sigs: 28',
            'Created test.cud',
            'Generated diff file test-7.script',
            'Verification',
            'test-7.script correctly applies to the previous version',
        ]
        self.verify_output(output.out, expected=expected_results)

        # Check that the new CUD file was created, and that the '.cud.script' file was created.
        assert (TC.path_tmp / 'test.cud').exists()
        assert (TC.path_tmp / 'test-7.script').exists()