8000d078 |
/* |
33872a43 |
* Copyright (C) 2007-2009 Sourcefire, Inc. |
1a2906f4 |
* |
2023340a |
* Authors: Tomasz Kojm |
8000d078 |
*
* This program is free software; you can redistribute it and/or modify |
bb34cb31 |
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation. |
8000d078 |
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software |
48b7b4a7 |
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA. |
8000d078 |
*/
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
#include <stdio.h>
#include <string.h>
#include <stdlib.h> |
677fc4ba |
#include <ctype.h> |
6bb841e8 |
#include <sys/stat.h> |
563582a1 |
#include <assert.h> |
b58fdfc2 |
#ifdef HAVE_UNISTD_H |
8000d078 |
#include <unistd.h> |
b58fdfc2 |
#endif |
8000d078 |
#include "clamav.h"
#include "others.h" |
b68d11d2 |
#include "matcher.h" |
8000d078 |
#include "matcher-ac.h"
#include "filetypes.h" |
227f8f7c |
#include "cltypes.h" |
fbcef1b0 |
#include "str.h" |
b5513f8d |
#include "readdb.h" |
589d8d8e |
#include "default.h" |
02eabc6d |
#include "filtering.h" |
8000d078 |
|
b94e66c4 |
#include "mpool.h"
|
a6d4c62e |
#define AC_SPECIAL_ALT_CHAR 1
#define AC_SPECIAL_ALT_STR 2 |
723a44d5 |
#define AC_SPECIAL_LINE_MARKER 3
#define AC_SPECIAL_BOUNDARY 4
#define AC_BOUNDARY_LEFT 1
#define AC_BOUNDARY_LEFT_NEGATIVE 2
#define AC_BOUNDARY_RIGHT 4
#define AC_BOUNDARY_RIGHT_NEGATIVE 8
#define AC_LINE_MARKER_LEFT 16
#define AC_LINE_MARKER_LEFT_NEGATIVE 32
#define AC_LINE_MARKER_RIGHT 64
#define AC_LINE_MARKER_RIGHT_NEGATIVE 128 |
8c3c77b4 |
static char boundary[256] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
3, 0, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 3, 1, 3,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 2, 0,
1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};
|
5612732c |
int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern) |
8000d078 |
{ |
65064125 |
struct cli_ac_node *pt, *next; |
e38ab7c1 |
struct cli_ac_patt *ph; |
65064125 |
void *newtable; |
a6d4c62e |
struct cli_ac_special *a1, *a2; |
9187ef90 |
uint8_t i, match; |
fbcef1b0 |
uint16_t len = MIN(root->ac_maxdepth, pattern->length); |
8000d078 |
|
fbcef1b0 |
for(i = 0; i < len; i++) {
if(pattern->pattern[i] & CLI_MATCH_WILDCARD) {
len = i;
break;
}
}
|
871177cd |
if(len < root->ac_mindepth) {
/* cli_errmsg("cli_ac_addpatt: Signature for %s is too short\n", pattern->virname); */
return CL_EMALFDB;
} |
8000d078 |
|
fbcef1b0 |
pt = root->ac_root;
for(i = 0; i < len; i++) {
if(!pt->trans) { |
47d40feb |
pt->trans = (struct cli_ac_node **) mpool_calloc(root->mempool, 256, sizeof(struct cli_ac_node *)); |
fbcef1b0 |
if(!pt->trans) {
cli_errmsg("cli_ac_addpatt: Can't allocate memory for pt->trans\n");
return CL_EMEM;
}
} |
8000d078 |
|
fbcef1b0 |
next = pt->trans[(unsigned char) (pattern->pattern[i] & 0xff)]; |
8000d078 |
if(!next) { |
47d40feb |
next = (struct cli_ac_node *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_node)); |
8000d078 |
if(!next) { |
fbcef1b0 |
cli_errmsg("cli_ac_addpatt: Can't allocate memory for AC node\n"); |
8000d078 |
return CL_EMEM;
}
|
fbcef1b0 |
if(i != len - 1) { |
47d40feb |
next->trans = (struct cli_ac_node **) mpool_calloc(root->mempool, 256, sizeof(struct cli_ac_node *)); |
fbcef1b0 |
if(!next->trans) {
cli_errmsg("cli_ac_addpatt: Can't allocate memory for next->trans\n"); |
47d40feb |
mpool_free(root->mempool, next); |
fbcef1b0 |
return CL_EMEM;
}
}
|
8000d078 |
root->ac_nodes++; |
47d40feb |
newtable = mpool_realloc(root->mempool, root->ac_nodetable, root->ac_nodes * sizeof(struct cli_ac_node *)); |
cdfcca0c |
if(!newtable) {
root->ac_nodes--; |
fbcef1b0 |
cli_errmsg("cli_ac_addpatt: Can't realloc ac_nodetable\n");
if(next->trans) |
47d40feb |
mpool_free(root->mempool, next->trans);
mpool_free(root->mempool, next); |
8000d078 |
return CL_EMEM;
} |
65064125 |
root->ac_nodetable = (struct cli_ac_node **) newtable;
root->ac_nodetable[root->ac_nodes - 1] = next; |
8000d078 |
|
fbcef1b0 |
pt->trans[(unsigned char) (pattern->pattern[i] & 0xff)] = next; |
8000d078 |
}
|
fbcef1b0 |
pt = next; |
8000d078 |
}
|
fbcef1b0 |
root->ac_patterns++; |
47d40feb |
newtable = mpool_realloc(root->mempool, root->ac_pattable, root->ac_patterns * sizeof(struct cli_ac_patt *)); |
65064125 |
if(!newtable) {
root->ac_patterns--; |
fbcef1b0 |
cli_errmsg("cli_ac_addpatt: Can't realloc ac_pattable\n");
return CL_EMEM;
} |
65064125 |
root->ac_pattable = (struct cli_ac_patt **) newtable; |
fbcef1b0 |
root->ac_pattable[root->ac_patterns - 1] = pattern; |
8000d078 |
|
fbcef1b0 |
pattern->depth = i; |
e38ab7c1 |
ph = pt->list;
while(ph) { |
746bc181 |
if((ph->length == pattern->length) && (ph->prefix_length == pattern->prefix_length) && (ph->ch[0] == pattern->ch[0]) && (ph->ch[1] == pattern->ch[1])) { |
e38ab7c1 |
if(!memcmp(ph->pattern, pattern->pattern, ph->length * sizeof(uint16_t)) && !memcmp(ph->prefix, pattern->prefix, ph->prefix_length * sizeof(uint16_t))) { |
a6d4c62e |
if(!ph->special && !pattern->special) { |
9187ef90 |
match = 1; |
a6d4c62e |
} else if(ph->special == pattern->special) { |
9187ef90 |
match = 1; |
a6d4c62e |
for(i = 0; i < ph->special; i++) {
a1 = ph->special_table[i];
a2 = pattern->special_table[i]; |
1a648b37 |
if(a1->num != a2->num) { |
9187ef90 |
match = 0;
break;
} |
a6d4c62e |
if(a1->negative != a2->negative) { |
1a648b37 |
match = 0;
break; |
a6d4c62e |
}
if(a1->type != a2->type) {
match = 0;
break;
} else if(a1->type == AC_SPECIAL_ALT_CHAR) { |
1a648b37 |
if(memcmp(a1->str, a2->str, a1->num)) {
match = 0;
break;
} |
a6d4c62e |
} else if(a1->type == AC_SPECIAL_ALT_STR) { |
1a648b37 |
while(a1 && a2) {
if((a1->len != a2->len) || memcmp(a1->str, a2->str, a1->len))
break;
a1 = a1->next;
a2 = a2->next;
}
if(a1 || a2) {
match = 0;
break;
}
} |
9187ef90 |
}
} else {
match = 0;
}
if(match) {
pattern->next_same = ph->next_same;
ph->next_same = pattern;
return CL_SUCCESS;
} |
e38ab7c1 |
}
}
ph = ph->next;
}
|
fbcef1b0 |
pattern->next = pt->list;
pt->list = pattern; |
8000d078 |
|
8d3aca30 |
return CL_SUCCESS; |
8000d078 |
}
|
fbcef1b0 |
struct bfs_list {
struct cli_ac_node *node;
struct bfs_list *next;
};
|
1a648b37 |
static int bfs_enqueue(struct bfs_list **bfs, struct bfs_list **last, struct cli_ac_node *n) |
8000d078 |
{ |
fbcef1b0 |
struct bfs_list *new;
|
8000d078 |
|
fbcef1b0 |
new = (struct bfs_list *) cli_malloc(sizeof(struct bfs_list));
if(!new) {
cli_errmsg("bfs_enqueue: Can't allocate memory for bfs_list\n"); |
8000d078 |
return CL_EMEM;
} |
1a648b37 |
new->next = NULL; |
8000d078 |
new->node = n; |
1a648b37 |
if(*last) {
(*last)->next = new;
*last = new;
} else {
*bfs = *last = new;
} |
fbcef1b0 |
|
8d3aca30 |
return CL_SUCCESS; |
8000d078 |
}
|
a2f97877 |
static struct cli_ac_node *bfs_dequeue(struct bfs_list **bfs, struct bfs_list **last) |
8000d078 |
{ |
1a648b37 |
struct bfs_list *lpt; |
8000d078 |
struct cli_ac_node *pt;
|
1a648b37 |
if(!(lpt = *bfs)) { |
8000d078 |
return NULL;
} else { |
1a648b37 |
*bfs = (*bfs)->next; |
fbcef1b0 |
pt = lpt->node; |
a2f97877 |
if(lpt == *last)
*last = NULL; |
fbcef1b0 |
free(lpt); |
8000d078 |
return pt;
}
}
|
fbcef1b0 |
static int ac_maketrans(struct cli_matcher *root) |
8000d078 |
{ |
1a648b37 |
struct bfs_list *bfs = NULL, *bfs_last = NULL; |
fbcef1b0 |
struct cli_ac_node *ac_root = root->ac_root, *child, *node, *fail;
struct cli_ac_patt *patt; |
8000d078 |
int i, ret;
|
fbcef1b0 |
for(i = 0; i < 256; i++) {
node = ac_root->trans[i];
if(!node) {
ac_root->trans[i] = ac_root;
} else {
node->fail = ac_root; |
1a648b37 |
if((ret = bfs_enqueue(&bfs, &bfs_last, node))) |
fbcef1b0 |
return ret;
} |
8000d078 |
}
|
a2f97877 |
while((node = bfs_dequeue(&bfs, &bfs_last))) { |
fc0493d2 |
if(IS_LEAF(node)) { |
a305a261 |
struct cli_ac_node *failtarget = node->fail; |
fc0493d2 |
while(IS_LEAF(failtarget)) |
a305a261 |
failtarget = failtarget->fail;
node->fail = failtarget; |
8000d078 |
continue; |
a305a261 |
} |
8000d078 |
for(i = 0; i < 256; i++) {
child = node->trans[i]; |
fbcef1b0 |
if(child) {
fail = node->fail; |
fc0493d2 |
while(IS_LEAF(fail) || !fail->trans[i]) |
fbcef1b0 |
fail = fail->fail; |
8000d078 |
|
fbcef1b0 |
child->fail = fail->trans[i];
if(child->list) {
patt = child->list;
while(patt->next)
patt = patt->next;
patt->next = child->fail->list;
} else {
child->list = child->fail->list; |
8000d078 |
} |
fbcef1b0 |
|
1a648b37 |
if((ret = bfs_enqueue(&bfs, &bfs_last, child)) != 0) |
fbcef1b0 |
return ret; |
8000d078 |
}
}
} |
fbcef1b0 |
|
a305a261 |
bfs = bfs_last = NULL;
for(i = 0; i < 256; i++) {
node = ac_root->trans[i];
if(node != ac_root) {
if((ret = bfs_enqueue(&bfs, &bfs_last, node)))
return ret;
}
}
while((node = bfs_dequeue(&bfs, &bfs_last))) { |
fc0493d2 |
if(IS_LEAF(node)) |
a305a261 |
continue;
for(i = 0; i < 256; i++) {
child = node->trans[i]; |
551e73b7 |
if (!child || (!IS_FINAL(child) && IS_LEAF(child))) { |
a305a261 |
struct cli_ac_node *failtarget = node->fail; |
fc0493d2 |
while(IS_LEAF(failtarget) || !failtarget->trans[i]) |
a305a261 |
failtarget = failtarget->fail;
node->trans[i] = failtarget->trans[i];
} else {
if((ret = bfs_enqueue(&bfs, &bfs_last, child)) != 0)
return ret;
}
}
}
|
8d3aca30 |
return CL_SUCCESS; |
8000d078 |
}
|
5612732c |
int cli_ac_buildtrie(struct cli_matcher *root) |
8000d078 |
{
if(!root)
return CL_EMALFDB;
if(!root->ac_root) { |
fbcef1b0 |
cli_dbgmsg("cli_ac_buildtrie: AC pattern matcher is not initialised\n"); |
8d3aca30 |
return CL_SUCCESS; |
8000d078 |
}
|
380ae304 |
if (root->filter) |
fed7cf97 |
cli_dbgmsg("Using filter for trie %d\n", root->type); |
fbcef1b0 |
return ac_maketrans(root); |
8000d078 |
}
|
5b74e89a |
int cli_ac_init(struct cli_matcher *root, uint8_t mindepth, uint8_t maxdepth, uint8_t dconf_prefiltering) |
8000d078 |
{ |
563582a1 |
#ifdef USE_MPOOL
assert(root->mempool && "mempool must be initialized");
#endif |
8000d078 |
|
47d40feb |
root->ac_root = (struct cli_ac_node *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_node)); |
fbcef1b0 |
if(!root->ac_root) {
cli_errmsg("cli_ac_init: Can't allocate memory for ac_root\n");
return CL_EMEM;
} |
8000d078 |
|
47d40feb |
root->ac_root->trans = (struct cli_ac_node **) mpool_calloc(root->mempool, 256, sizeof(struct cli_ac_node *)); |
fbcef1b0 |
if(!root->ac_root->trans) {
cli_errmsg("cli_ac_init: Can't allocate memory for ac_root->trans\n"); |
47d40feb |
mpool_free(root->mempool, root->ac_root); |
fbcef1b0 |
return CL_EMEM; |
8000d078 |
} |
fbcef1b0 |
root->ac_mindepth = mindepth;
root->ac_maxdepth = maxdepth;
|
5b74e89a |
if (cli_mtargets[root->type].enable_prefiltering && dconf_prefiltering) { |
02eabc6d |
root->filter = mpool_malloc(root->mempool, sizeof(*root->filter));
if (!root->filter) {
cli_errmsg("cli_ac_init: Can't allocate memory for ac_root->filter\n");
mpool_free(root->mempool, root->ac_root->trans);
mpool_free(root->mempool, root->ac_root);
return CL_EMEM;
}
filter_init(root->filter);
}
|
fbcef1b0 |
return CL_SUCCESS; |
8000d078 |
}
|
b94e66c4 |
#ifdef USE_MPOOL |
a6d4c62e |
#define mpool_ac_free_special(a, b) ac_free_special(a, b)
static void ac_free_special(mpool_t *mempool, struct cli_ac_patt *p) |
b94e66c4 |
#else |
a6d4c62e |
#define mpool_ac_free_special(a, b) ac_free_special(b)
static void ac_free_special(struct cli_ac_patt *p) |
b94e66c4 |
#endif |
1a648b37 |
{ |
a6d4c62e |
unsigned int i;
struct cli_ac_special *a1, *a2; |
1a648b37 |
|
a6d4c62e |
if(!p->special) |
1a648b37 |
return;
|
a6d4c62e |
for(i = 0; i < p->special; i++) {
a1 = p->special_table[i]; |
1a648b37 |
while(a1) {
a2 = a1;
a1 = a1->next;
if(a2->str) |
47d40feb |
mpool_free(mempool, a2->str);
mpool_free(mempool, a2); |
1a648b37 |
}
} |
a6d4c62e |
mpool_free(mempool, p->special_table); |
1a648b37 |
}
|
5612732c |
void cli_ac_free(struct cli_matcher *root) |
8000d078 |
{ |
20c2455d |
uint32_t i; |
fbcef1b0 |
struct cli_ac_patt *patt; |
8000d078 |
|
fbcef1b0 |
for(i = 0; i < root->ac_patterns; i++) {
patt = root->ac_pattable[i]; |
47d40feb |
mpool_free(root->mempool, patt->prefix ? patt->prefix : patt->pattern);
mpool_free(root->mempool, patt->virname); |
a6d4c62e |
if(patt->special)
mpool_ac_free_special(root->mempool, patt); |
47d40feb |
mpool_free(root->mempool, patt); |
fbcef1b0 |
}
if(root->ac_pattable) |
47d40feb |
mpool_free(root->mempool, root->ac_pattable); |
fbcef1b0 |
|
33872a43 |
if(root->ac_reloff)
mpool_free(root->mempool, root->ac_reloff);
|
8000d078 |
for(i = 0; i < root->ac_nodes; i++) { |
fc0493d2 |
if(!IS_LEAF(root->ac_nodetable[i])) |
47d40feb |
mpool_free(root->mempool, root->ac_nodetable[i]->trans);
mpool_free(root->mempool, root->ac_nodetable[i]); |
8000d078 |
}
if(root->ac_nodetable) |
47d40feb |
mpool_free(root->mempool, root->ac_nodetable); |
fbcef1b0 |
if(root->ac_root) { |
47d40feb |
mpool_free(root->mempool, root->ac_root->trans);
mpool_free(root->mempool, root->ac_root); |
fbcef1b0 |
} |
02eabc6d |
if (root->filter)
mpool_free(root->mempool, root->filter); |
8000d078 |
}
|
677fc4ba |
/*
* In parse_only mode this function returns -1 on error or the max subsig id
*/ |
ee8bd2fb |
int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigned int *cnt, uint64_t *ids, unsigned int parse_only) |
677fc4ba |
{
unsigned int i, len = end - expr, pth = 0, opoff = 0, op1off = 0, val; |
ee8bd2fb |
unsigned int blkend = 0, id, modval1, modval2 = 0, lcnt = 0, rcnt = 0, tcnt, modoff = 0;
uint64_t lids = 0, rids = 0, tids; |
677fc4ba |
int ret, lval, rval;
char op = 0, op1 = 0, mod = 0, blkmod = 0;
const char *lstart = expr, *lend = NULL, *rstart = NULL, *rend = end, *pt;
for(i = 0; i < len; i++) {
switch(expr[i]) {
case '(':
pth++;
break;
case ')':
if(!pth) {
cli_errmsg("cli_ac_chklsig: Syntax error: Missing opening parenthesis\n");
return -1;
}
pth--;
case '>':
case '<':
case '=':
mod = expr[i];
modoff = i;
break;
default:
if(strchr("&|", expr[i])) {
if(!pth) {
op = expr[i];
opoff = i;
} else if(pth == 1) {
op1 = expr[i];
op1off = i;
}
}
}
if(op)
break;
if(op1 && !pth) {
blkend = i;
if(expr[i + 1] == '>' || expr[i + 1] == '<' || expr[i + 1] == '=') {
blkmod = expr[i + 1]; |
ee8bd2fb |
ret = sscanf(&expr[i + 2], "%u,%u", &modval1, &modval2);
if(ret != 2)
ret = sscanf(&expr[i + 2], "%u", &modval1); |
677fc4ba |
if(!ret || ret == EOF) {
cli_errmsg("chklexpr: Syntax error: Missing number after '%c'\n", expr[i + 1]);
return -1;
} |
ee8bd2fb |
for(i += 2; i + 1 < len && (isdigit(expr[i + 1]) || expr[i + 1] == ','); i++); |
677fc4ba |
}
if(&expr[i + 1] == rend)
break;
else
blkmod = 0;
}
}
if(pth) {
cli_errmsg("cli_ac_chklsig: Syntax error: Missing closing parenthesis\n");
return -1;
}
if(!op && !op1) {
if(expr[0] == '(') |
ee8bd2fb |
return cli_ac_chklsig(++expr, --end, lsigcnt, cnt, ids, parse_only); |
677fc4ba |
ret = sscanf(expr, "%u", &id);
if(!ret || ret == EOF) {
cli_errmsg("cli_ac_chklsig: Can't parse %s\n", expr);
return -1;
}
if(parse_only)
val = id;
else
val = lsigcnt[id];
if(mod) { |
41486c42 |
pt = expr + modoff + 1; |
ee8bd2fb |
ret = sscanf(pt, "%u", &modval1); |
677fc4ba |
if(!ret || ret == EOF) {
cli_errmsg("chklexpr: Syntax error: Missing number after '%c'\n", mod);
return -1;
} |
ee8bd2fb |
if(!parse_only) {
switch(mod) {
case '=':
if(val != modval1)
return 0;
break;
case '<':
if(val >= modval1)
return 0;
break;
case '>':
if(val <= modval1)
return 0;
break;
default: |
677fc4ba |
return 0; |
ee8bd2fb |
}
*cnt += val;
*ids |= (uint64_t) 1 << id;
return 1; |
677fc4ba |
}
}
if(parse_only) {
return val;
} else { |
ee8bd2fb |
if(val) {
*cnt += val;
*ids |= (uint64_t) 1 << id;
return 1;
} else {
return 0;
} |
677fc4ba |
}
}
if(!op) {
op = op1;
opoff = op1off;
lstart++;
rend = &expr[blkend];
}
if(!opoff) {
cli_errmsg("cli_ac_chklsig: Syntax error: Missing left argument\n");
return -1;
}
lend = &expr[opoff];
if(opoff + 1 == len) {
cli_errmsg("cli_ac_chklsig: Syntax error: Missing right argument\n");
return -1;
}
rstart = &expr[opoff + 1];
|
ee8bd2fb |
lval = cli_ac_chklsig(lstart, lend, lsigcnt, &lcnt, &lids, parse_only); |
677fc4ba |
if(lval == -1) {
cli_errmsg("cli_ac_chklsig: Calculation of lval failed\n");
return -1;
}
|
ee8bd2fb |
rval = cli_ac_chklsig(rstart, rend, lsigcnt, &rcnt, &rids, parse_only); |
677fc4ba |
if(rval == -1) {
cli_errmsg("cli_ac_chklsig: Calculation of rval failed\n");
return -1;
}
if(parse_only) {
switch(op) {
case '&':
case '|':
return MAX(lval, rval);
default:
cli_errmsg("cli_ac_chklsig: Incorrect operator type\n");
return -1;
}
} else {
switch(op) {
case '&':
ret = lval && rval;
break;
case '|':
ret = lval || rval;
break;
default:
cli_errmsg("cli_ac_chklsig: Incorrect operator type\n");
return -1;
}
if(!blkmod) { |
ee8bd2fb |
if(ret) { |
677fc4ba |
*cnt += lcnt + rcnt; |
ee8bd2fb |
*ids |= lids | rids;
} |
677fc4ba |
return ret;
} else { |
ee8bd2fb |
if(ret) { |
677fc4ba |
tcnt = lcnt + rcnt; |
ee8bd2fb |
tids = lids | rids;
} else { |
677fc4ba |
tcnt = 0; |
ee8bd2fb |
tids = 0;
} |
677fc4ba |
switch(blkmod) {
case '=': |
ee8bd2fb |
if(tcnt != modval1) |
677fc4ba |
return 0;
break;
case '<': |
ee8bd2fb |
if(tcnt >= modval1) |
677fc4ba |
return 0;
break;
case '>': |
ee8bd2fb |
if(tcnt <= modval1) |
677fc4ba |
return 0; |
ee8bd2fb |
break; |
677fc4ba |
default:
return 0;
} |
ee8bd2fb |
if(modval2) {
val = 0;
while(tids) {
val += tids & (uint64_t) 1;
tids >>= 1;
}
if(val < modval2)
return 0;
}
*cnt += tcnt;
return 1; |
677fc4ba |
}
}
}
|
1a648b37 |
/*
* FIXME: the current support for string alternatives uses a brute-force
* approach and doesn't perform any kind of verification and
* backtracking. This may easily lead to false negatives, eg. when
* an alternative contains strings of different lengths and
* more than one of them can match at the current position.
*/
|
a6d4c62e |
#define AC_MATCH_CHAR(p,b) \
switch(wc = p & CLI_MATCH_WILDCARD) { \
case CLI_MATCH_CHAR: \
if((unsigned char) p != b) \
match = 0; \
break; \
\
case CLI_MATCH_IGNORE: \
break; \
\
case CLI_MATCH_SPECIAL: \
special = pattern->special_table[specialcnt]; \
match = special->negative; \
switch(special->type) { \
case AC_SPECIAL_ALT_CHAR: \
for(j = 0; j < special->num; j++) { \
if(special->str[j] == b) { \
match = !special->negative; \
break; \
} else if(special->str[j] > b) \
break; \
} \
break; \
\
case AC_SPECIAL_ALT_STR: \
while(special) { \
if(bp + special->len <= length) { \
if(!memcmp(&buffer[bp], special->str, special->len)) { \
match = !special->negative; \
bp += special->len - 1; \
break; \
} \
} \
special = special->next; \
} \
break; \
\ |
723a44d5 |
case AC_SPECIAL_LINE_MARKER: \
if(b == '\n') { \
match = !special->negative; \
} else if(b == '\r' && (bp + 1 < length && buffer[bp + 1] == '\n')) { \
bp++; \
match = !special->negative; \
} \
break; \
\ |
a6d4c62e |
case AC_SPECIAL_BOUNDARY: \ |
8c3c77b4 |
if(boundary[b]) \ |
a6d4c62e |
match = !special->negative; \
break; \
\
default: \
cli_errmsg("ac_findmatch: Unknown special\n"); \
match = 0; \
} \
specialcnt++; \
break; \
\
case CLI_MATCH_NIBBLE_HIGH: \
if((unsigned char) (p & 0x00f0) != (b & 0xf0)) \
match = 0; \
break; \
\
case CLI_MATCH_NIBBLE_LOW: \
if((unsigned char) (p & 0x000f) != (b & 0x0f)) \
match = 0; \
break; \
\
default: \
cli_errmsg("ac_findmatch: Unknown wildcard 0x%x\n", wc); \
match = 0; \ |
fbcef1b0 |
}
|
8c3c77b4 |
inline static int ac_findmatch(const unsigned char *buffer, uint32_t offset, uint32_t fileoffset, uint32_t length, const struct cli_ac_patt *pattern, uint32_t *end) |
8000d078 |
{ |
1a2906f4 |
uint32_t bp, match; |
a6d4c62e |
uint16_t wc, i, j, specialcnt = pattern->special_pattern;
struct cli_ac_special *special; |
f1f75e19 |
|
8000d078 |
|
e38ab7c1 |
if((offset + pattern->length > length) || (pattern->prefix_length > offset)) |
2242da43 |
return 0;
|
fbcef1b0 |
bp = offset + pattern->depth; |
8000d078 |
|
1a2906f4 |
match = 1; |
42860228 |
for(i = pattern->depth; i < pattern->length && bp < length; i++) { |
fbcef1b0 |
AC_MATCH_CHAR(pattern->pattern[i],buffer[bp]); |
1a2906f4 |
if(!match)
return 0; |
fbcef1b0 |
bp++; |
8000d078 |
} |
42860228 |
*end = bp; |
8000d078 |
|
8c3c77b4 |
if(pattern->boundary & AC_BOUNDARY_LEFT) {
match = !!(pattern->boundary & AC_BOUNDARY_LEFT_NEGATIVE);
if(!fileoffset || (offset && (boundary[buffer[offset - 1]] == 1 || boundary[buffer[offset - 1]] == 3)))
match = !match;
if(!match)
return 0;
}
if(pattern->boundary & AC_BOUNDARY_RIGHT) {
match = !!(pattern->boundary & AC_BOUNDARY_RIGHT_NEGATIVE);
if((length <= SCANBUFF) && (bp == length || boundary[buffer[bp]] >= 2))
match = !match;
if(!match)
return 0;
}
|
723a44d5 |
if(pattern->boundary & AC_LINE_MARKER_LEFT) {
match = !!(pattern->boundary & AC_LINE_MARKER_LEFT_NEGATIVE);
if(!fileoffset || (offset && (buffer[offset - 1] == '\n')))
match = !match;
if(!match)
return 0;
}
if(pattern->boundary & AC_LINE_MARKER_RIGHT) {
match = !!(pattern->boundary & AC_LINE_MARKER_RIGHT_NEGATIVE);
if((length <= SCANBUFF) && (bp == length || buffer[bp] == '\n' || (buffer[bp] == '\r' && bp + 1 < length && buffer[bp + 1] == '\n')))
match = !match;
if(!match)
return 0;
}
|
1a2906f4 |
if(!(pattern->ch[1] & CLI_MATCH_IGNORE)) {
bp += pattern->ch_mindist[1];
for(i = pattern->ch_mindist[1]; i <= pattern->ch_maxdist[1]; i++) {
if(bp >= length)
return 0;
match = 1;
AC_MATCH_CHAR(pattern->ch[1],buffer[bp]);
if(match)
break;
bp++;
}
if(!match)
return 0;
}
|
f1f75e19 |
if(pattern->prefix) { |
a6d4c62e |
specialcnt = 0; |
fbcef1b0 |
bp = offset - pattern->prefix_length; |
1a2906f4 |
match = 1; |
f1f75e19 |
for(i = 0; i < pattern->prefix_length; i++) { |
fbcef1b0 |
AC_MATCH_CHAR(pattern->prefix[i],buffer[bp]); |
1a2906f4 |
if(!match)
return 0; |
fbcef1b0 |
bp++; |
f1f75e19 |
}
}
|
1a2906f4 |
if(!(pattern->ch[0] & CLI_MATCH_IGNORE)) {
bp = offset - pattern->prefix_length; |
a45c7039 |
if(pattern->ch_mindist[0] + (uint32_t) 1 > bp) |
1a2906f4 |
return 0;
bp -= pattern->ch_mindist[0] + 1;
for(i = pattern->ch_mindist[0]; i <= pattern->ch_maxdist[0]; i++) {
match = 1;
AC_MATCH_CHAR(pattern->ch[0],buffer[bp]);
if(match)
break;
if(!bp)
return 0;
else
bp--;
}
if(!match)
return 0;
}
|
8000d078 |
return 1;
}
|
aca9ea82 |
int cli_ac_initdata(struct cli_ac_data *data, uint32_t partsigs, uint32_t lsigs, uint32_t reloffsigs, uint8_t tracklen) |
4e9ab8ed |
{ |
baf2e702 |
unsigned int i, j; |
677fc4ba |
|
4e9ab8ed |
if(!data) { |
fbcef1b0 |
cli_errmsg("cli_ac_init: data == NULL\n"); |
4e9ab8ed |
return CL_ENULLARG;
}
|
145a1886 |
cli_hashset_init_noalloc(&data->vinfo); |
d2ba6f98 |
|
aca9ea82 |
data->reloffsigs = reloffsigs;
if(reloffsigs) {
data->offset = (uint32_t *) cli_malloc(reloffsigs * 2 * sizeof(uint32_t));
if(!data->offset) {
cli_errmsg("cli_ac_init: Can't allocate memory for data->offset\n");
return CL_EMEM;
}
for(i = 0; i < reloffsigs * 2; i += 2)
data->offset[i] = CLI_OFF_NONE;
} |
4e9ab8ed |
|
aca9ea82 |
data->partsigs = partsigs; |
677fc4ba |
if(partsigs) {
data->offmatrix = (int32_t ***) cli_calloc(partsigs, sizeof(int32_t **));
if(!data->offmatrix) {
cli_errmsg("cli_ac_init: Can't allocate memory for data->offmatrix\n"); |
aca9ea82 |
if(reloffsigs)
free(data->offset); |
677fc4ba |
return CL_EMEM;
} |
4e9ab8ed |
} |
677fc4ba |
data->lsigs = lsigs;
if(lsigs) {
data->lsigcnt = (uint32_t **) cli_malloc(lsigs * sizeof(uint32_t *));
if(!data->lsigcnt) {
if(partsigs)
free(data->offmatrix); |
aca9ea82 |
if(reloffsigs)
free(data->offset); |
677fc4ba |
cli_errmsg("cli_ac_init: Can't allocate memory for data->lsigcnt\n");
return CL_EMEM;
}
data->lsigcnt[0] = (uint32_t *) cli_calloc(lsigs * 64, sizeof(uint32_t));
if(!data->lsigcnt[0]) {
free(data->lsigcnt);
if(partsigs)
free(data->offmatrix); |
aca9ea82 |
if(reloffsigs)
free(data->offset); |
677fc4ba |
cli_errmsg("cli_ac_init: Can't allocate memory for data->lsigcnt[0]\n");
return CL_EMEM;
}
for(i = 1; i < lsigs; i++)
data->lsigcnt[i] = data->lsigcnt[0] + 64 * i; |
baf2e702 |
/* subsig offsets */
data->lsigsuboff = (uint32_t **) cli_malloc(lsigs * sizeof(uint32_t *));
if(!data->lsigsuboff) {
free(data->lsigcnt[0]);
free(data->lsigcnt);
if(partsigs)
free(data->offmatrix);
if(reloffsigs)
free(data->offset);
cli_errmsg("cli_ac_init: Can't allocate memory for data->lsigsuboff\n");
return CL_EMEM;
}
data->lsigsuboff[0] = (uint32_t *) cli_calloc(lsigs * 64, sizeof(uint32_t));
if(!data->lsigsuboff[0]) {
free(data->lsigsuboff);
free(data->lsigcnt[0]);
free(data->lsigcnt);
if(partsigs)
free(data->offmatrix);
if(reloffsigs)
free(data->offset);
cli_errmsg("cli_ac_init: Can't allocate memory for data->lsigsuboff[0]\n");
return CL_EMEM;
}
for(j = 0; j < 64; j++)
data->lsigsuboff[0][j] = CLI_OFF_NONE;
for(i = 1; i < lsigs; i++) {
data->lsigsuboff[i] = data->lsigsuboff[0] + 64 * i;
for(j = 0; j < 64; j++)
data->lsigsuboff[i][j] = CLI_OFF_NONE;
} |
aca9ea82 |
} |
ab893605 |
for (i=0;i<32;i++)
data->macro_lastmatch[i] = CLI_OFF_NONE; |
aca9ea82 |
|
fbcef1b0 |
return CL_SUCCESS;
} |
4e9ab8ed |
|
294558a5 |
int cli_ac_caloff(const struct cli_matcher *root, struct cli_ac_data *data, const struct cli_target_info *info) |
33872a43 |
{
int ret;
unsigned int i;
struct cli_ac_patt *patt;
|
294558a5 |
/* info.exeinfo.vinfo = &data->vinfo; */ |
d2ba6f98 |
|
33872a43 |
for(i = 0; i < root->ac_reloff_num; i++) {
patt = root->ac_reloff[i]; |
294558a5 |
if(!info) { |
aca9ea82 |
data->offset[patt->offset_min] = CLI_OFF_NONE; |
294558a5 |
} else if((ret = cli_caloff(NULL, info, root->type, patt->offdata, &data->offset[patt->offset_min], &data->offset[patt->offset_max]))) { |
33872a43 |
cli_errmsg("cli_ac_caloff: Can't calculate relative offset in signature for %s\n", patt->virname);
return ret; |
294558a5 |
} else if((data->offset[patt->offset_min] != CLI_OFF_NONE) && (data->offset[patt->offset_min] + patt->length > info->fsize)) { |
6bb841e8 |
data->offset[patt->offset_min] = CLI_OFF_NONE; |
33872a43 |
}
}
return CL_SUCCESS;
}
|
fbcef1b0 |
void cli_ac_freedata(struct cli_ac_data *data)
{
uint32_t i; |
4e9ab8ed |
|
d2ba6f98 |
cli_hashset_destroy(&data->vinfo); |
227f8f7c |
|
fbcef1b0 |
if(data && data->partsigs) {
for(i = 0; i < data->partsigs; i++) {
if(data->offmatrix[i]) {
free(data->offmatrix[i][0]);
free(data->offmatrix[i]);
}
}
free(data->offmatrix); |
677fc4ba |
data->partsigs = 0;
}
if(data && data->lsigs) {
free(data->lsigcnt[0]);
free(data->lsigcnt); |
baf2e702 |
free(data->lsigsuboff[0]);
free(data->lsigsuboff); |
677fc4ba |
data->lsigs = 0; |
227f8f7c |
} |
aca9ea82 |
if(data && data->reloffsigs) {
free(data->offset);
data->reloffsigs = 0;
} |
fbcef1b0 |
} |
227f8f7c |
|
5025967e |
inline static int ac_addtype(struct cli_matched_type **list, cli_file_t type, off_t offset, const cli_ctx *ctx) |
fbcef1b0 |
{
struct cli_matched_type *tnode, *tnode_last; |
4e9ab8ed |
|
5025967e |
if(type == CL_TYPE_ZIPSFX) { |
724b2bf7 |
if(*list && ctx && ctx->engine->maxfiles && (*list)->cnt > ctx->engine->maxfiles) |
5025967e |
return CL_SUCCESS;
} else if(*list && (*list)->cnt >= MAX_EMBEDDED_OBJ) |
fbcef1b0 |
return CL_SUCCESS; |
4e9ab8ed |
|
fbcef1b0 |
if(!(tnode = cli_calloc(1, sizeof(struct cli_matched_type)))) {
cli_errmsg("cli_ac_addtype: Can't allocate memory for new type node\n"); |
4e9ab8ed |
return CL_EMEM;
}
|
fbcef1b0 |
tnode->type = type;
tnode->offset = offset; |
4e9ab8ed |
|
fbcef1b0 |
tnode_last = *list;
while(tnode_last && tnode_last->next)
tnode_last = tnode_last->next; |
4e9ab8ed |
|
fbcef1b0 |
if(tnode_last)
tnode_last->next = tnode;
else
*list = tnode; |
4e9ab8ed |
|
fbcef1b0 |
(*list)->cnt++; |
4e9ab8ed |
return CL_SUCCESS;
}
|
ab893605 |
static inline void lsig_sub_matched(const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t lsigid1, uint32_t lsigid2, uint32_t realoff)
{ |
70b3c2cc |
const struct cli_lsig_tdb *tdb = &root->ac_lsigtable[lsigid1]->tdb;
if(realoff != CLI_OFF_NONE) {
if(mdata->lsigsuboff[lsigid1][lsigid2] != CLI_OFF_NONE && realoff <= mdata->lsigsuboff[lsigid1][lsigid2])
return; |
94f8946c |
mdata->lsigcnt[lsigid1][lsigid2]++; |
70b3c2cc |
if(mdata->lsigcnt[lsigid1][lsigid2] <= 1 || !tdb->macro_ptids || !tdb->macro_ptids[lsigid2])
mdata->lsigsuboff[lsigid1][lsigid2] = realoff;
} |
94f8946c |
|
70b3c2cc |
if (mdata->lsigcnt[lsigid1][lsigid2] > 1) { |
ab893605 |
/* Check that the previous match had a macro match following it at the
* correct distance. This check is only done after the 1st match.*/
const struct cli_ac_patt *macropt;
uint32_t id, last_macro_match, smin, smax, last_macroprev_match;
if (!tdb->macro_ptids)
return;
id = tdb->macro_ptids[lsigid2];
if (!id)
return;
macropt = root->ac_pattable[id];
smin = macropt->ch_mindist[0];
smax = macropt->ch_maxdist[0];
/* start of last macro match */
last_macro_match = mdata->macro_lastmatch[macropt->sigid];
/* start of previous lsig subsig match */
last_macroprev_match = mdata->lsigsuboff[lsigid1][lsigid2];
if (last_macro_match != CLI_OFF_NONE)
cli_dbgmsg("Checking macro match: %u + (%u - %u) == %u\n",
last_macroprev_match, smin, smax, last_macro_match);
if (last_macro_match == CLI_OFF_NONE ||
last_macroprev_match + smin > last_macro_match ||
last_macroprev_match + smax < last_macro_match) {
cli_dbgmsg("Canceled false lsig macro match\n"); |
94f8946c |
/* Previous match was false - cancel it */
mdata->lsigcnt[lsigid1][lsigid2]--; |
ab893605 |
mdata->lsigsuboff[lsigid1][lsigid2] = realoff;
} else {
/* mark the macro sig itself matched */
mdata->lsigcnt[lsigid1][lsigid2+1]++;
mdata->lsigsuboff[lsigid1][lsigid2+1] = last_macro_match;
}
}
}
void cli_ac_chkmacro(struct cli_matcher *root, struct cli_ac_data *data, unsigned lsigid1)
{
const struct cli_lsig_tdb *tdb = &root->ac_lsigtable[lsigid1]->tdb;
unsigned i;
/* Loop through all subsigs, and if they are tied to macros check that the
* macro matched at a correct distance */
for (i=0;i<tdb->subsigs;i++) {
lsig_sub_matched(root, data, lsigid1, i, CLI_OFF_NONE);
}
}
|
33872a43 |
int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx) |
8000d078 |
{
struct cli_ac_node *current; |
e38ab7c1 |
struct cli_ac_patt *patt, *pt; |
42860228 |
uint32_t i, bp, realoff, matchend; |
fbcef1b0 |
uint16_t j; |
157ba240 |
int32_t **offmatrix; |
fbcef1b0 |
uint8_t found;
int type = CL_CLEAN; |
710a22f1 |
struct cli_ac_result *newres; |
8000d078 |
|
cdbf8c8e |
if(!root->ac_root) |
8000d078 |
return CL_CLEAN;
|
04133ff9 |
if(!mdata && (root->ac_partsigs || root->ac_lsigs || root->ac_reloff_num)) { |
fbcef1b0 |
cli_errmsg("cli_ac_scanbuff: mdata == NULL\n"); |
8000d078 |
return CL_ENULLARG;
}
current = root->ac_root;
for(i = 0; i < length; i++) { |
fbcef1b0 |
current = current->trans[buffer[i]];
|
fc0493d2 |
if(IS_FINAL(current)) { |
e38ab7c1 |
patt = current->list; |
551e73b7 |
if (IS_LEAF(current))
current = current->fail; |
e38ab7c1 |
while(patt) {
bp = i + 1 - patt->depth; |
ab893605 |
if(patt->offdata[0] != CLI_OFF_VERSION && patt->offdata[0] != CLI_OFF_MACRO && !patt->next_same && (patt->offset_min != CLI_OFF_ANY) && (!patt->sigid || patt->partno == 1)) { |
6bb841e8 |
if(patt->offset_min == CLI_OFF_NONE) {
patt = patt->next; |
33872a43 |
continue;
} |
6bb841e8 |
realoff = offset + bp - patt->prefix_length;
if(patt->offdata[0] == CLI_OFF_ABSOLUTE) {
if(patt->offset_max < realoff || patt->offset_min > realoff) {
patt = patt->next;
continue;
}
} else {
if(mdata->offset[patt->offset_min] == CLI_OFF_NONE || mdata->offset[patt->offset_max] < realoff || mdata->offset[patt->offset_min] > realoff) {
patt = patt->next; |
33872a43 |
continue;
}
}
} |
6bb841e8 |
pt = patt; |
8c3c77b4 |
if(ac_findmatch(buffer, bp, offset + bp - patt->prefix_length, length, patt, &matchend)) { |
e38ab7c1 |
while(pt) { |
6038397e |
if((pt->type && !(mode & AC_SCAN_FT)) || (!pt->type && !(mode & AC_SCAN_VIR))) {
pt = pt->next_same;
continue;
} |
e38ab7c1 |
realoff = offset + bp - pt->prefix_length; |
8ff82a68 |
if(pt->offdata[0] == CLI_OFF_VERSION) { |
145a1886 |
if(!cli_hashset_contains_maybe_noalloc(&mdata->vinfo, realoff)) { |
d2ba6f98 |
pt = pt->next_same;
continue;
} |
1e7afd20 |
cli_dbgmsg("cli_ac_scanbuff: VI match for offset %x\n", realoff); |
8ff82a68 |
} else if(pt->offdata[0] == CLI_OFF_MACRO) { |
ab893605 |
mdata->macro_lastmatch[patt->offdata[1]] = realoff;
pt = pt->next_same;
continue; |
d2ba6f98 |
} else if(pt->offset_min != CLI_OFF_ANY && (!pt->sigid || pt->partno == 1)) { |
6bb841e8 |
if(pt->offset_min == CLI_OFF_NONE) {
pt = pt->next_same;
continue;
} |
aca9ea82 |
if(pt->offdata[0] == CLI_OFF_ABSOLUTE) {
if(pt->offset_max < realoff || pt->offset_min > realoff) {
pt = pt->next_same;
continue;
}
} else {
if(mdata->offset[pt->offset_min] == CLI_OFF_NONE || mdata->offset[pt->offset_max] < realoff || mdata->offset[pt->offset_min] > realoff) {
pt = pt->next_same;
continue;
} |
e38ab7c1 |
} |
7ec67e94 |
} |
e38ab7c1 |
if(pt->sigid) { /* it's a partial signature */ |
8000d078 |
|
e38ab7c1 |
if(pt->partno != 1 && (!mdata->offmatrix[pt->sigid - 1] || !mdata->offmatrix[pt->sigid - 1][pt->partno - 2][0])) {
pt = pt->next_same;
continue; |
fbcef1b0 |
} |
227f8f7c |
|
e38ab7c1 |
if(!mdata->offmatrix[pt->sigid - 1]) {
mdata->offmatrix[pt->sigid - 1] = cli_malloc(pt->parts * sizeof(int32_t *));
if(!mdata->offmatrix[pt->sigid - 1]) {
cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u]\n", pt->sigid - 1);
return CL_EMEM;
}
|
157ba240 |
mdata->offmatrix[pt->sigid - 1][0] = cli_malloc(pt->parts * (CLI_DEFAULT_AC_TRACKLEN + 2) * sizeof(int32_t)); |
e38ab7c1 |
if(!mdata->offmatrix[pt->sigid - 1][0]) {
cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u][0]\n", pt->sigid - 1);
free(mdata->offmatrix[pt->sigid - 1]);
mdata->offmatrix[pt->sigid - 1] = NULL;
return CL_EMEM;
} |
157ba240 |
memset(mdata->offmatrix[pt->sigid - 1][0], -1, pt->parts * (CLI_DEFAULT_AC_TRACKLEN + 2) * sizeof(int32_t)); |
e38ab7c1 |
mdata->offmatrix[pt->sigid - 1][0][0] = 0;
for(j = 1; j < pt->parts; j++) { |
157ba240 |
mdata->offmatrix[pt->sigid - 1][j] = mdata->offmatrix[pt->sigid - 1][0] + j * (CLI_DEFAULT_AC_TRACKLEN + 2); |
e38ab7c1 |
mdata->offmatrix[pt->sigid - 1][j][0] = 0;
} |
4e9ab8ed |
} |
e38ab7c1 |
offmatrix = mdata->offmatrix[pt->sigid - 1];
if(pt->partno != 1) {
found = 0; |
157ba240 |
for(j = 1; j <= CLI_DEFAULT_AC_TRACKLEN + 1 && offmatrix[pt->partno - 2][j] != -1; j++) { |
f0370390 |
found = j; |
e38ab7c1 |
if(pt->maxdist)
if(realoff - offmatrix[pt->partno - 2][j] > pt->maxdist)
found = 0;
if(found && pt->mindist)
if(realoff - offmatrix[pt->partno - 2][j] < pt->mindist)
found = 0;
if(found)
break;
} |
4e9ab8ed |
}
|
157ba240 |
if(pt->partno == 2 && found > 1) |
f0370390 |
offmatrix[0][1] = offmatrix[0][found];
|
e38ab7c1 |
if(pt->partno == 1 || (found && (pt->partno != pt->parts))) { |
157ba240 |
if(offmatrix[pt->partno - 1][0] == CLI_DEFAULT_AC_TRACKLEN + 1)
offmatrix[pt->partno - 1][0] = 1; |
e38ab7c1 |
offmatrix[pt->partno - 1][0]++; |
42860228 |
offmatrix[pt->partno - 1][offmatrix[pt->partno - 1][0]] = offset + matchend; |
e38ab7c1 |
if(pt->partno == 1) /* save realoff for the first part */
offmatrix[pt->parts - 1][offmatrix[pt->partno - 1][0]] = realoff;
} else if(found && pt->partno == pt->parts) {
if(pt->type) { |
6038397e |
|
33872a43 |
if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype)) |
6038397e |
return CL_TYPE_IGNORED;
if((pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) && (!pt->rtype || ftype == pt->rtype)) {
cli_dbgmsg("Matched signature for file type %s\n", pt->virname);
type = pt->type; |
8df99a92 |
if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ || type == CL_TYPE_ZIPSFX) && (type >= CL_TYPE_SFX || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP || ftype == CL_TYPE_MSOLE2) && type == CL_TYPE_MSEXE))) { |
f0370390 |
/* FIXME: the first offset in the array is most likely the correct one but
* it may happen it is not
*/ |
157ba240 |
for(j = 1; j <= CLI_DEFAULT_AC_TRACKLEN + 1 && offmatrix[0][j] != -1; j++) |
33872a43 |
if(ac_addtype(ftoffset, type, offmatrix[pt->parts - 1][j], ctx)) |
6038397e |
return CL_EMEM; |
e38ab7c1 |
} |
6038397e |
|
157ba240 |
memset(offmatrix[0], -1, pt->parts * (CLI_DEFAULT_AC_TRACKLEN + 2) * sizeof(int32_t)); |
6038397e |
for(j = 0; j < pt->parts; j++)
offmatrix[j][0] = 0; |
e38ab7c1 |
}
} else { /* !pt->type */ |
677fc4ba |
if(pt->lsigid[0]) { |
70b3c2cc |
lsig_sub_matched(root, mdata, pt->lsigid[1], pt->lsigid[2], offmatrix[pt->parts - 1][1]); |
417b7509 |
pt = pt->next_same; |
677fc4ba |
continue;
}
|
710a22f1 |
if(res) {
newres = (struct cli_ac_result *) malloc(sizeof(struct cli_ac_result)); |
33872a43 |
if(!newres) |
710a22f1 |
return CL_EMEM;
newres->virname = pt->virname;
newres->customdata = pt->customdata;
newres->next = *res; |
f0370390 |
newres->offset = offmatrix[pt->parts - 1][1]; |
710a22f1 |
*res = newres; |
e38ab7c1 |
|
417b7509 |
pt = pt->next_same; |
710a22f1 |
continue;
} else {
if(virname)
*virname = pt->virname;
if(customdata)
*customdata = pt->customdata;
return CL_VIRUS;
} |
e38ab7c1 |
}
}
} else { /* old type signature */ |
fbcef1b0 |
if(pt->type) { |
33872a43 |
if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype)) |
6038397e |
return CL_TYPE_IGNORED; |
33872a43 |
|
6038397e |
if((pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) && (!pt->rtype || ftype == pt->rtype)) {
cli_dbgmsg("Matched signature for file type %s at %u\n", pt->virname, realoff);
type = pt->type; |
8df99a92 |
if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ || type == CL_TYPE_ZIPSFX) && (type >= CL_TYPE_SFX || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP || ftype == CL_TYPE_MSOLE2) && type == CL_TYPE_MSEXE))) { |
6038397e |
|
33872a43 |
if(ac_addtype(ftoffset, type, realoff, ctx)) |
6038397e |
return CL_EMEM; |
8000d078 |
}
} |
e38ab7c1 |
} else { |
677fc4ba |
if(pt->lsigid[0]) { |
ab893605 |
lsig_sub_matched(root, mdata, pt->lsigid[1], pt->lsigid[2], realoff); |
417b7509 |
pt = pt->next_same; |
677fc4ba |
continue;
}
|
710a22f1 |
if(res) {
newres = (struct cli_ac_result *) malloc(sizeof(struct cli_ac_result)); |
33872a43 |
if(!newres) |
710a22f1 |
return CL_EMEM;
newres->virname = pt->virname;
newres->customdata = pt->customdata; |
2e4fd44f |
newres->offset = realoff; |
710a22f1 |
newres->next = *res;
*res = newres;
|
417b7509 |
pt = pt->next_same; |
710a22f1 |
continue;
} else {
if(virname)
*virname = pt->virname;
if(customdata)
*customdata = pt->customdata;
return CL_VIRUS;
} |
8000d078 |
}
} |
e38ab7c1 |
pt = pt->next_same; |
8000d078 |
}
} |
e38ab7c1 |
patt = patt->next; |
8000d078 |
}
}
}
|
6038397e |
return (mode & AC_SCAN_FT) ? type : CL_CLEAN; |
8000d078 |
} |
fbcef1b0 |
|
57e5af13 |
static int qcompare(const void *a, const void *b)
{ |
bb1e844c |
return *(const unsigned char *)a - *(const unsigned char *)b; |
57e5af13 |
}
|
fbcef1b0 |
/* FIXME: clean up the code */ |
341faf60 |
int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hexsig, uint32_t sigid, uint16_t parts, uint16_t partno, uint16_t rtype, uint16_t type, uint32_t mindist, uint32_t maxdist, const char *offset, const uint32_t *lsigid, unsigned int options) |
fbcef1b0 |
{
struct cli_ac_patt *new; |
1a2906f4 |
char *pt, *pt2, *hex = NULL, *hexcpy = NULL; |
3b934d1e |
uint16_t i, j, ppos = 0, pend, *dec, nzpos = 0;
uint8_t wprefix = 0, zprefix = 1, plen = 0, nzplen = 0; |
a6d4c62e |
struct cli_ac_special *newspecial, *specialpt, **newtable; |
1a648b37 |
int ret, error = CL_SUCCESS; |
fbcef1b0 |
|
677fc4ba |
if(!root) {
cli_errmsg("cli_ac_addsig: root == NULL\n");
return CL_ENULLARG;
}
|
871177cd |
if(strlen(hexsig) / 2 < root->ac_mindepth) {
cli_errmsg("cli_ac_addsig: Signature for %s is too short\n", virname);
return CL_EMALFDB;
}
|
47d40feb |
if((new = (struct cli_ac_patt *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_patt))) == NULL) |
fbcef1b0 |
return CL_EMEM;
|
6038397e |
new->rtype = rtype; |
fbcef1b0 |
new->type = type;
new->sigid = sigid;
new->parts = parts;
new->partno = partno;
new->mindist = mindist;
new->maxdist = maxdist; |
10290ba3 |
new->customdata = NULL; |
1a2906f4 |
new->ch[0] |= CLI_MATCH_IGNORE;
new->ch[1] |= CLI_MATCH_IGNORE; |
677fc4ba |
if(lsigid) {
new->lsigid[0] = 1;
memcpy(&new->lsigid[1], lsigid, 2 * sizeof(uint32_t));
} |
1a2906f4 |
if(strchr(hexsig, '[')) {
if(!(hexcpy = cli_strdup(hexsig))) { |
47d40feb |
mpool_free(root->mempool, new); |
1a2906f4 |
return CL_EMEM;
}
hex = hexcpy;
for(i = 0; i < 2; i++) {
unsigned int n1, n2;
if(!(pt = strchr(hex, '[')))
break;
*pt++ = 0;
if(!(pt2 = strchr(pt, ']'))) {
cli_dbgmsg("cli_ac_addsig: missing closing square bracket\n");
error = CL_EMALFDB;
break;
}
*pt2++ = 0;
if(sscanf(pt, "%u-%u", &n1, &n2) != 2) {
cli_dbgmsg("cli_ac_addsig: incorrect range inside square brackets\n");
error = CL_EMALFDB;
break;
}
if((n1 > n2) || (n2 > AC_CH_MAXDIST)) {
cli_dbgmsg("cli_ac_addsig: incorrect range inside square brackets\n");
error = CL_EMALFDB;
break;
}
if(strlen(hex) == 2) {
if(i) {
error = CL_EMALFDB;
break;
}
dec = cli_hex2ui(hex);
if(!dec) {
error = CL_EMALFDB;
break;
}
new->ch[i] = *dec;
free(dec);
new->ch_mindist[i] = n1;
new->ch_maxdist[i] = n2;
hex = pt2;
} else if(strlen(pt2) == 2) {
i = 1;
dec = cli_hex2ui(pt2);
if(!dec) {
error = CL_EMALFDB;
break;
}
new->ch[i] = *dec;
free(dec);
new->ch_mindist[i] = n1;
new->ch_maxdist[i] = n2;
} else {
error = CL_EMALFDB;
break;
}
}
if(error) {
free(hexcpy); |
47d40feb |
mpool_free(root->mempool, new); |
1a2906f4 |
return error;
}
hex = cli_strdup(hex);
free(hexcpy);
if(!hex) { |
47d40feb |
mpool_free(root->mempool, new); |
1a2906f4 |
return CL_EMEM;
}
} |
fbcef1b0 |
if(strchr(hexsig, '(')) { |
1a2906f4 |
char *hexnew, *start, *h, *c; |
fbcef1b0 |
|
1a2906f4 |
if(hex) {
hexcpy = hex;
} else if(!(hexcpy = cli_strdup(hexsig))) { |
47d40feb |
mpool_free(root->mempool, new); |
fbcef1b0 |
return CL_EMEM;
}
if(!(hexnew = (char *) cli_calloc(strlen(hexsig) + 1, 1))) {
free(new); |
b94e66c4 |
free(hexcpy); |
fbcef1b0 |
return CL_EMEM;
}
start = pt = hexcpy;
while((pt = strchr(start, '('))) {
*pt++ = 0;
if(!start) { |
1a648b37 |
error = CL_EMALFDB; |
fbcef1b0 |
break;
} |
a6d4c62e |
newspecial = (struct cli_ac_special *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_special));
if(!newspecial) {
cli_errmsg("cli_ac_addsig: Can't allocate newspecial\n"); |
95ac9eff |
error = CL_EMEM;
break;
}
if(pt >= hexcpy + 2) {
if(pt[-2] == '!') { |
a6d4c62e |
newspecial->negative = 1; |
95ac9eff |
pt[-2] = 0;
}
} |
fbcef1b0 |
strcat(hexnew, start);
if(!(start = strchr(pt, ')'))) { |
a6d4c62e |
mpool_free(root->mempool, newspecial); |
1a648b37 |
error = CL_EMALFDB; |
fbcef1b0 |
break;
}
*start++ = 0; |
a6d4c62e |
if(!strlen(pt)) {
cli_errmsg("cli_ac_addsig: Empty block\n");
error = CL_EMALFDB;
break;
} |
8c3c77b4 |
if(!strcmp(pt, "B")) {
if(!*start) {
new->boundary |= AC_BOUNDARY_RIGHT;
if(newspecial->negative)
new->boundary |= AC_BOUNDARY_RIGHT_NEGATIVE;
mpool_free(root->mempool, newspecial);
continue;
} else if(pt - 1 == hexcpy) {
new->boundary |= AC_BOUNDARY_LEFT;
if(newspecial->negative)
new->boundary |= AC_BOUNDARY_LEFT_NEGATIVE;
mpool_free(root->mempool, newspecial);
continue;
} |
723a44d5 |
} else if(!strcmp(pt, "L")) {
if(!*start) {
new->boundary |= AC_LINE_MARKER_RIGHT;
if(newspecial->negative)
new->boundary |= AC_LINE_MARKER_RIGHT_NEGATIVE;
mpool_free(root->mempool, newspecial);
continue;
} else if(pt - 1 == hexcpy) {
new->boundary |= AC_LINE_MARKER_LEFT;
if(newspecial->negative)
new->boundary |= AC_LINE_MARKER_LEFT_NEGATIVE;
mpool_free(root->mempool, newspecial);
continue;
} |
8c3c77b4 |
}
strcat(hexnew, "()"); |
a6d4c62e |
new->special++;
newtable = (struct cli_ac_special **) mpool_realloc(root->mempool, new->special_table, new->special * sizeof(struct cli_ac_special *)); |
1a648b37 |
if(!newtable) { |
a6d4c62e |
new->special--;
mpool_free(root->mempool, newspecial);
cli_errmsg("cli_ac_addsig: Can't realloc new->special_table\n"); |
1a648b37 |
error = CL_EMEM;
break;
} |
a6d4c62e |
newtable[new->special - 1] = newspecial;
new->special_table = newtable;
if(!strcmp(pt, "B")) {
newspecial->type = AC_SPECIAL_BOUNDARY; |
723a44d5 |
} else if(!strcmp(pt, "L")) {
newspecial->type = AC_SPECIAL_LINE_MARKER;
/* |
a6d4c62e |
} else if(strcmp(pt, "W")) {
newspecial->type = AC_SPECIAL_WHITE;
*/
} else {
for(i = 0; i < strlen(pt); i++)
if(pt[i] == '|')
newspecial->num++; |
fbcef1b0 |
|
a6d4c62e |
if(!newspecial->num) { |
1a648b37 |
error = CL_EMALFDB; |
fbcef1b0 |
break; |
a6d4c62e |
} else
newspecial->num++;
if(3 * newspecial->num - 1 == (uint16_t) strlen(pt)) {
newspecial->type = AC_SPECIAL_ALT_CHAR;
newspecial->str = (unsigned char *) mpool_malloc(root->mempool, newspecial->num);
if(!newspecial->str) {
cli_errmsg("cli_ac_addsig: Can't allocate newspecial->str\n");
error = CL_EMEM;
break;
}
} else {
newspecial->type = AC_SPECIAL_ALT_STR; |
fbcef1b0 |
}
|
a6d4c62e |
for(i = 0; i < newspecial->num; i++) {
if(!(h = cli_strtok(pt, i, "|"))) {
error = CL_EMALFDB;
break;
} |
fbcef1b0 |
|
e4a0f2c9 |
if(!(c = (char*)cli_mpool_hex2str(root->mempool, h))) { |
a6d4c62e |
free(h);
error = CL_EMALFDB;
break;
} |
1a648b37 |
|
a6d4c62e |
if(newspecial->type == AC_SPECIAL_ALT_CHAR) {
newspecial->str[i] = *c;
mpool_free(root->mempool, c); |
1a648b37 |
} else { |
a6d4c62e |
if(i) {
specialpt = newspecial;
while(specialpt->next)
specialpt = specialpt->next;
specialpt->next = (struct cli_ac_special *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_special));
if(!specialpt->next) {
cli_errmsg("cli_ac_addsig: Can't allocate specialpt->next\n");
error = CL_EMEM;
free(c);
free(h);
break;
}
specialpt->next->str = (unsigned char *) c;
specialpt->next->len = strlen(h) / 2;
} else {
newspecial->str = (unsigned char *) c;
newspecial->len = strlen(h) / 2;
} |
1a648b37 |
} |
a6d4c62e |
free(h); |
1a648b37 |
} |
a6d4c62e |
if(newspecial->type == AC_SPECIAL_ALT_CHAR)
cli_qsort(newspecial->str, newspecial->num, sizeof(unsigned char), qcompare); |
1a648b37 |
|
a6d4c62e |
if(error)
break; |
fbcef1b0 |
}
}
if(start)
strcat(hexnew, start);
hex = hexnew;
free(hexcpy);
if(error) { |
a6d4c62e |
if(new->special) { |
1a648b37 |
free(hex); |
a6d4c62e |
mpool_ac_free_special(root->mempool, new); |
1a648b37 |
} |
47d40feb |
mpool_free(root->mempool, new); |
1a648b37 |
return error; |
fbcef1b0 |
}
}
|
47d40feb |
new->pattern = cli_mpool_hex2ui(root->mempool, hex ? hex : hexsig); |
b94e66c4 |
if(new->pattern == NULL) { |
a6d4c62e |
if(new->special)
mpool_ac_free_special(root->mempool, new); |
47d40feb |
mpool_free(root->mempool, new); |
1a2906f4 |
free(hex); |
fbcef1b0 |
return CL_EMALFDB;
} |
b94e66c4 |
|
1a2906f4 |
new->length = strlen(hex ? hex : hexsig) / 2;
free(hex); |
fbcef1b0 |
|
02eabc6d |
if (root->filter) {
/* so that we can show meaningful messages */
new->virname = (char*)virname;
if (filter_add_acpatt(root->filter, new) == -1) {
cli_warnmsg("cli_ac_addpatt: cannot use filter for trie\n");
mpool_free(root->mempool, root->filter);
root->filter = NULL;
} |
380ae304 |
/* TODO: should this affect maxpatlen? */ |
02eabc6d |
}
|
fbcef1b0 |
for(i = 0; i < root->ac_maxdepth && i < new->length; i++) {
if(new->pattern[i] & CLI_MATCH_WILDCARD) {
wprefix = 1;
break;
} |
c01ff22d |
if(zprefix && new->pattern[i])
zprefix = 0; |
fbcef1b0 |
}
|
c01ff22d |
if(wprefix || zprefix) { |
fbcef1b0 |
pend = new->length - root->ac_mindepth + 1;
for(i = 0; i < pend; i++) {
for(j = i; j < i + root->ac_maxdepth && j < new->length; j++) {
if(new->pattern[j] & CLI_MATCH_WILDCARD) {
break;
} else { |
e38ab7c1 |
if(j - i + 1 >= plen) { |
fbcef1b0 |
plen = j - i + 1;
ppos = i;
}
} |
3b934d1e |
if(new->pattern[ppos] || new->pattern[ppos + 1]) {
if(plen >= root->ac_maxdepth) {
break;
} else if(plen >= root->ac_mindepth && plen > nzplen) {
nzplen = plen;
nzpos = ppos;
}
} |
fbcef1b0 |
} |
e38ab7c1 |
if(plen >= root->ac_maxdepth && (new->pattern[ppos] || new->pattern[ppos + 1])) |
fbcef1b0 |
break;
} |
3b934d1e |
if(!new->pattern[ppos] && !new->pattern[ppos + 1] && nzplen) {
plen = nzplen;
ppos = nzpos;
} |
fbcef1b0 |
if(plen < root->ac_mindepth) {
cli_errmsg("cli_ac_addsig: Can't find a static subpattern of length %u\n", root->ac_mindepth); |
a6d4c62e |
mpool_ac_free_special(root->mempool, new); |
47d40feb |
mpool_free(root->mempool, new->pattern);
mpool_free(root->mempool, new); |
fbcef1b0 |
return CL_EMALFDB;
}
new->prefix = new->pattern;
new->prefix_length = ppos;
new->pattern = &new->prefix[ppos];
new->length -= ppos;
for(i = 0; i < new->prefix_length; i++) |
a6d4c62e |
if((new->prefix[i] & CLI_MATCH_WILDCARD) == CLI_MATCH_SPECIAL)
new->special_pattern++; |
fbcef1b0 |
}
|
8cf6cab9 |
if(new->length + new->prefix_length > root->maxpatlen) |
0354e962 |
root->maxpatlen = new->length + new->prefix_length; |
fbcef1b0 |
|
bb1e844c |
new->virname = cli_mpool_virname(root->mempool, virname, options & CL_DB_OFFICIAL); |
b5513f8d |
if(!new->virname) { |
47d40feb |
mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern); |
a6d4c62e |
mpool_ac_free_special(root->mempool, new); |
47d40feb |
mpool_free(root->mempool, new); |
fbcef1b0 |
return CL_EMEM;
}
|
677fc4ba |
if(new->lsigid[0])
root->ac_lsigtable[new->lsigid[1]]->virname = new->virname;
|
294558a5 |
ret = cli_caloff(offset, NULL, root->type, new->offdata, &new->offset_min, &new->offset_max); |
33872a43 |
if(ret != CL_SUCCESS) {
mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern); |
a6d4c62e |
mpool_ac_free_special(root->mempool, new); |
33872a43 |
mpool_free(root->mempool, new->virname);
mpool_free(root->mempool, new);
return ret; |
1a648b37 |
}
|
fbcef1b0 |
if((ret = cli_ac_addpatt(root, new))) { |
47d40feb |
mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern);
mpool_free(root->mempool, new->virname); |
a6d4c62e |
mpool_ac_free_special(root->mempool, new); |
47d40feb |
mpool_free(root->mempool, new); |
fbcef1b0 |
return ret;
}
|
ab893605 |
if(new->offdata[0] != CLI_OFF_ANY && new->offdata[0] != CLI_OFF_ABSOLUTE && new->offdata[0] != CLI_OFF_MACRO) { |
33872a43 |
root->ac_reloff = (struct cli_ac_patt **) mpool_realloc2(root->mempool, root->ac_reloff, (root->ac_reloff_num + 1) * sizeof(struct cli_ac_patt *));
if(!root->ac_reloff) {
cli_errmsg("cli_ac_addsig: Can't allocate memory for root->ac_reloff\n");
return CL_EMEM;
}
root->ac_reloff[root->ac_reloff_num] = new; |
aca9ea82 |
new->offset_min = root->ac_reloff_num * 2;
new->offset_max = new->offset_min + 1; |
33872a43 |
root->ac_reloff_num++;
}
|
fbcef1b0 |
return CL_SUCCESS;
} |