mirror of
https://github.com/Cisco-Talos/clamav.git
synced 2026-04-29 19:24:25 -04:00
8d485b9bfd
Add X509 certificate chain based signing with PKCS7-PEM external signatures distributed alongside CVD's in a custom .cvd.sign format. This new signing and verification mechanism is primarily in support of FIPS compliance. Fixes: https://github.com/Cisco-Talos/clamav/issues/564 Add a Rust implementation for parsing, verifying, and unpacking CVD files. Now installs a 'certs' directory in the app config directory (e.g. <prefix>/etc/certs). The install location is configurable. The CMake option to configure the CVD certs directory is: `-D CVD_CERTS_DIRECTORY=PATH` New options to set an alternative CVD certs directory: - Commandline for freshclam, clamd, clamscan, and sigtool is: `--cvdcertsdir PATH` - Env variable for freshclam, clamd, clamscan, and sigtool is: `CVD_CERTS_DIR` - Config option for freshclam and clamd is: `CVDCertsDirectory PATH` Sigtool: - Add sign/verify commands. - Also verify CDIFF external digital signatures when applying CDIFFs. - Place commonly used commands at the top of --help string. - Fix up manpage. Freshclam: - Will try to download .sign files to verify CVDs and CDIFFs. - Fix an issue where making a CLD would only include the CFG file for daily and not if patching any other database. libclamav.so: - Bump version to 13:0:1 (aka 12.1.0). - Also remove libclamav.map versioning. Resolves: https://github.com/Cisco-Talos/clamav/issues/1304 - Add two new API's to the public clamav.h header: ```c extern cl_error_t cl_cvdverify_ex(const char *file, const char *certs_directory); extern cl_error_t cl_cvdunpack_ex(const char *file, const char *dir, bool dont_verify, const char *certs_directory); ``` The original `cl_cvdverify` and `cl_cvdunpack` are deprecated. - Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`. You may set this option with `cl_engine_set_str` and get it with `cl_engine_get_str`, to override the compiled in default CVD certs directory. libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0). Add sigtool sign/verify tests and test certs. Make it so downloadFile doesn't throw a warning if the server doesn't have the .sign file. Replace use of md5-based FP signatures in the unit tests with sha256-based FP signatures because the md5 implementation used by Python may be disabled in FIPS mode. Fixes: https://github.com/Cisco-Talos/clamav/issues/1411 CMake: Add logic to enable the Rust openssl-sys / openssl-rs crates to build against the same OpenSSL library as is used for the C build. The Rust unit test application must also link directly with libcrypto and libssl. Fix some log messages with missing new lines. Fix missing environment variable notes in --help messages and manpages. Deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in clamav-config.h.in for libclamav from variable that had the same name for use in clamav applications that use the optparser. The 'clamav-test' certs for the unit tests will live for 10 years. The 'clamav-beta.crt' public cert will only live for 120 days and will be replaced before the stable release with a production 'clamav.crt'.
110 lines
3.4 KiB
C
110 lines
3.4 KiB
C
/*
|
|
* Copyright (C) 2013-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
|
|
* Copyright (C) 2008-2013 Sourcefire, Inc.
|
|
*
|
|
* Author: Tomasz Kojm <tkojm@clamav.net>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
|
* MA 02110-1301, USA.
|
|
*/
|
|
|
|
#ifndef __OPTPARSER_H
|
|
#define __OPTPARSER_H
|
|
|
|
/* don't share bits! */
|
|
// clang-format off
|
|
#define OPT_CLAMD 1
|
|
#define OPT_FRESHCLAM 2
|
|
#define OPT_MILTER 4
|
|
#define OPT_CLAMSCAN 8
|
|
#define OPT_CLAMDSCAN 16
|
|
#define OPT_SIGTOOL 32
|
|
#define OPT_CLAMCONF 64
|
|
#define OPT_CLAMDTOP 128
|
|
#define OPT_CLAMBC 256
|
|
#define OPT_CLAMONACC 512
|
|
#define OPT_DEPRECATED 1024
|
|
|
|
#define CLOPT_TYPE_STRING 1 /* quoted/regular string */
|
|
#define CLOPT_TYPE_NUMBER 2 /* raw number */
|
|
#define CLOPT_TYPE_SIZE 3 /* number possibly followed by modifiers (K/k, M/m or G/g) */
|
|
#define CLOPT_TYPE_BOOL 4 /* boolean */
|
|
#define CLOPT_TYPE_SIZE64 5 /* 64-bit number possibly followed by modifiers (K/k, M/m or G/g) */
|
|
|
|
#ifdef _WIN32
|
|
|
|
extern char _DATADIR[MAX_PATH];
|
|
extern char _CONFDIR[MAX_PATH];
|
|
extern char _CERTSDIR[MAX_PATH];
|
|
extern char _CONFDIR_CLAMD[MAX_PATH];
|
|
extern char _CONFDIR_FRESHCLAM[MAX_PATH];
|
|
extern char _CONFDIR_MILTER[MAX_PATH];
|
|
|
|
#define OPT_DATADIR _DATADIR
|
|
#define OPT_CONFDIR _CONFDIR
|
|
#define OPT_CERTSDIR _CERTSDIR
|
|
#define OPT_CONFDIR_CLAMD _CONFDIR_CLAMD
|
|
#define OPT_CONFDIR_FRESHCLAM _CONFDIR_FRESHCLAM
|
|
#define OPT_CONFDIR_MILTER _CONFDIR_MILTER
|
|
|
|
#else /* !_WIN32 */
|
|
|
|
#define OPT_DATADIR DATADIR
|
|
#define OPT_CONFDIR CONFDIR
|
|
#define OPT_CERTSDIR CERTSDIR
|
|
#define OPT_CONFDIR_CLAMD CONFDIR PATHSEP "clamd.conf"
|
|
#define OPT_CONFDIR_FRESHCLAM CONFDIR PATHSEP "freshclam.conf"
|
|
#define OPT_CONFDIR_MILTER CONFDIR PATHSEP "clamav-milter.conf"
|
|
|
|
#endif
|
|
// clang-format on
|
|
|
|
struct optstruct {
|
|
char *name;
|
|
char *cmd;
|
|
char *strarg;
|
|
long long numarg;
|
|
int enabled;
|
|
int active;
|
|
int flags;
|
|
int idx;
|
|
struct optstruct *nextarg;
|
|
struct optstruct *next;
|
|
|
|
char **filename; /* cmdline */
|
|
};
|
|
|
|
struct clam_option {
|
|
const char *name;
|
|
const char *longopt;
|
|
char shortopt;
|
|
int argtype;
|
|
const char *regex;
|
|
long long numarg;
|
|
const char *strarg;
|
|
int flags;
|
|
int owner;
|
|
const char *description;
|
|
const char *suggested;
|
|
};
|
|
|
|
const struct optstruct *optget(const struct optstruct *opts, const char *name);
|
|
|
|
void optfree(struct optstruct *opts);
|
|
|
|
struct optstruct *optparse(const char *cfgfile, int argc, char **argv, int verbose, int toolmask, int ignore, struct optstruct *oldopts);
|
|
struct optstruct *optadditem(const char *name, const char *arg, int verbose, int toolmask, int ignore, struct optstruct *oldopts);
|
|
|
|
#endif
|