1. clamav-devel
  2. Commit 0255f29a72dcd207c97590108234340802d01a80
Browse code

Blacklist & Whitelist verbiage

Improvements to use modern block list and allow list verbiage.

blacklist -> block list
whitelist -> allow listed
blacklisted -> blocked
whitelisted -> allowed

In the case of certificate verification, use "trust" or "verify" when
something is allowed.

Also changed domainlist -> domain list (or DomainList) to match.

Micah Snyder authored on 2021/05/28 05:15:52
Showing 40 changed files
NEWS.md
History View file @ 0255f29
... ... 
@@ -695,8 +695,8 @@ changes.
695 695
696 696 
 ### Other improvements
697 697
698 
-- Improved Windows executable Authenticode handling, enabling both whitelisting
699 
-  and blacklisting of files based on code-signing certificates. Additional
698 
+- Improved Windows executable Authenticode handling, enabling both allowing
699 
+  and blocking of files based on code-signing certificates. Additional
700 700 
   improvements to Windows executable (PE file) parsing.
701 701 
   Work courtesy of Andrew Williams.
702 702 
 - Added support for creating bytecode signatures for Mach-O and
... ... 
@@ -1085,7 +1085,7 @@ we've cooked up over the past 6 months.
1085 1085 
   request by Andrew Williams.
1086 1086 
   - Added support for Authenticode signature properties commonly used by
1087 1087 
     Windows system files. These files are now much more likely to be
1088 
-    whitelisted correctly.
1088 
+    trusted correctly.
1089 1089 
   - Signature parsing now works correctly on big endian systems.
1090 1090
1091 1091 
 - Some simplification to freshclam mirror management code, including changes
... ... 
@@ -1769,7 +1769,7 @@ support for additional filetypes, and internal upgrades.
1769 1769
1770 1770 
 - Authenticode: ClamAV is now aware of the certificate chains when
1771 1771 
   scanning signed PE files. When the database contains signatures for
1772 
-  trusted root certificate authorities, the engine can whitelist
1772 
+  trusted root certificate authorities, the engine can trust
1773 1773 
   PE files with a valid signature. The same database file can also
1774 1774 
   include known compromised certificates to be rejected! This
1775 1775 
   feature can also be disabled in clamd.conf (DisableCertCheck) or
... ... 
@@ -1998,7 +1998,7 @@ The following are the key features of this release:
1998 1998
1999 1999 
 - Google Safe Browsing support: in addition to the heuristic and signature
2000 2000 
   based phishing detection mechanisms already available in ClamAV, the
2001 
-  scanner can now make use of the Google's blacklists of suspected
2001 
+  scanner can now make use of the Google's block lists of suspected
2002 2002 
   phishing and malware sites. The ClamAV Project distributes a constantly
2003 2003 
   updated Safe Browsing database, which can be automatically fetched by
2004 2004 
   freshclam. For more information, please see freshclam.conf(5) and
... ... 
@@ -2395,7 +2395,7 @@ Detailed list of changes:
2395 2395 
     - PhishingAlwaysBlockCloak
2396 2396
2397 2397 
 - clamav-milter:
2398 
-  - Black list mode: optionally black lists an IP for a configurable amount
2398 
+  - Block list mode: optionally block lists an IP for a configurable amount
2399 2399 
     of time
2400 2400 
   - Black hole mode: detects emails that will be discarded and refrains from
2401 2401 
     scanning them
clam-format
History View file @ 0255f29
... ... 
@@ -48,7 +48,7 @@ clang-format -i -verbose unit_tests/*.h
48 48 
 clang-format -i -verbose win32/compat/*.c
49 49 
 clang-format -i -verbose win32/compat/*.h
50 50
51 
-# Undo changes to specific files (whitelist)
51 
+# Undo changes to specific files that we don't really want to reformat
52 52 
 git checkout libclamav/iana_cctld.h
53 53 
 git checkout libclamav/bytecode_api_decl.c
54 54 
 git checkout libclamav/bytecode_api_impl.h
clamav-milter/CMakeLists.txt
History View file @ 0255f29
... ... 
@@ -11,8 +11,8 @@ target_sources( clamav-milter
11 11 
         connpool.h
12 12 
         netcode.c
13 13 
         netcode.h
14 
-        whitelist.c
15 
-        whitelist.h )
14 
+        allow_list.c
15 
+        allow_list.h )
16 16 
 target_include_directories( clamav-milter
17 17 
     PRIVATE ${CMAKE_BINARY_DIR} # For clamav-config.h
18 18 
 )
clamav-milter/allow_list.c
History View file @ 0255f29
19 19 
new file mode 100644
... ... 
@@ -0,0 +1,229 @@
0 
+/*
1 
+ *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
2 
+ *  Copyright (C) 2008-2013 Sourcefire, Inc.
3 
+ *
4 
+ *  Author: aCaB <acab@clamav.net>
5 
+ *
6 
+ *  This program is free software; you can redistribute it and/or modify
7 
+ *  it under the terms of the GNU General Public License version 2 as
8 
+ *  published by the Free Software Foundation.
9 
+ *
10 
+ *  This program is distributed in the hope that it will be useful,
11 
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12 
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13 
+ *  GNU General Public License for more details.
14 
+ *
15 
+ *  You should have received a copy of the GNU General Public License
16 
+ *  along with this program; if not, write to the Free Software
17 
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
18 
+ *  MA 02110-1301, USA.
19 
+ */
20 
+
21 
+#if HAVE_CONFIG_H
22 
+#include "clamav-config.h"
23 
+#endif
24 
+
25 
+#include <stdio.h>
26 
+#include <string.h>
27 
+#include <sys/types.h>
28 
+
29 
+// libclamav
30 
+#include "regex/regex.h"
31 
+
32 
+// common
33 
+#include "output.h"
34 
+
35 
+#include "allow_list.h"
36 
+
37 
+struct WHLST {
38 
+    regex_t preg;
39 
+    struct WHLST *next;
40 
+};
41 
+
42 
+struct WHLST *wfrom = NULL;
43 
+struct WHLST *wto   = NULL;
44 
+
45 
+int skipauth = 0;
46 
+regex_t authreg;
47 
+
48 
+void allow_list_free(void)
49 
+{
50 
+    struct WHLST *w;
51 
+    while (wfrom) {
52 
+        w = wfrom->next;
53 
+        cli_regfree(&wfrom->preg);
54 
+        free(wfrom);
55 
+        wfrom = w;
56 
+    }
57 
+    while (wto) {
58 
+        w = wto->next;
59 
+        cli_regfree(&wto->preg);
60 
+        free(wto);
61 
+        wto = w;
62 
+    }
63 
+}
64 
+
65 
+int allow_list_init(const char *fname)
66 
+{
67 
+    char buf[2048];
68 
+    FILE *f;
69 
+    struct WHLST *w;
70 
+
71 
+    if (!(f = fopen(fname, "r"))) {
72 
+        logg("!Cannot open allow list file '%s'\n", fname);
73 
+        return 1;
74 
+    }
75 
+
76 
+    while (fgets(buf, sizeof(buf), f) != NULL) {
77 
+        struct WHLST **addto = &wto;
78 
+        char *ptr            = buf;
79 
+        int len;
80 
+
81 
+        if (*buf == '#' || *buf == ':' || *buf == '!')
82 
+            continue;
83 
+
84 
+        if (!strncasecmp("From:", buf, 5)) {
85 
+            ptr += 5;
86 
+            addto = &wfrom;
87 
+        } else if (!strncasecmp("To:", buf, 3))
88 
+            ptr += 3;
89 
+
90 
+        len = strlen(ptr) - 1;
91 
+        for (; len >= 0; len--) {
92 
+            if (ptr[len] != '\n' && ptr[len] != '\r') break;
93 
+            ptr[len] = '\0';
94 
+        }
95 
+        if (!len) continue;
96 
+        if (!(w = (struct WHLST *)malloc(sizeof(*w)))) {
97 
+            logg("!Out of memory loading allow list file\n");
98 
+            allow_list_free();
99 
+            fclose(f);
100 
+            return 1;
101 
+        }
102 
+        w->next  = (*addto);
103 
+        (*addto) = w;
104 
+        if (cli_regcomp(&w->preg, ptr, REG_ICASE | REG_NOSUB)) {
105 
+            logg("!Failed to compile regex '%s' in allow list file\n", ptr);
106 
+            allow_list_free();
107 
+            fclose(f);
108 
+            return 1;
109 
+        }
110 
+    }
111 
+    fclose(f);
112 
+    return 0;
113 
+}
114 
+
115 
+int allowed(const char *addr, int from)
116 
+{
117 
+    struct WHLST *w;
118 
+
119 
+    if (from)
120 
+        w = wfrom;
121 
+    else
122 
+        w = wto;
123 
+
124 
+    while (w) {
125 
+        if (!cli_regexec(&w->preg, addr, 0, NULL, 0))
126 
+            return 1;
127 
+        w = w->next;
128 
+    }
129 
+    return 0;
130 
+}
131 
+
132 
+int smtpauth_init(const char *r)
133 
+{
134 
+    char *regex = NULL;
135 
+
136 
+    if (!strncmp(r, "file:", 5)) {
137 
+        char buf[2048];
138 
+        FILE *f    = fopen(r + 5, "r");
139 
+        int rxsize = 0, rxavail = 0, rxused = 0;
140 
+
141 
+        if (!f) {
142 
+            logg("!Cannot open allow list file '%s'\n", r + 5);
143 
+            return 1;
144 
+        }
145 
+        while (fgets(buf, sizeof(buf), f) != NULL) {
146 
+            int len;
147 
+            char *ptr;
148 
+
149 
+            if (*buf == '#' || *buf == ':' || *buf == '!')
150 
+                continue;
151 
+            len = strlen(buf) - 1;
152 
+            for (; len >= 0; len--) {
153 
+                if (buf[len] != '\n' && buf[len] != '\r') break;
154 
+                buf[len] = '\0';
155 
+            }
156 
+            if (len <= 0) continue;
157 
+            if (len * 3 + 1 > rxavail) {
158 
+                ptr   = regex;
159 
+                regex = realloc(regex, rxsize + 2048);
160 
+                if (!regex) {
161 
+                    logg("!Cannot allocate memory for SkipAuthenticated file\n");
162 
+                    fclose(f);
163 
+                    return 1;
164 
+                }
165 
+                rxavail = 2048;
166 
+                rxsize += 2048;
167 
+                if (!ptr) {
168 
+                    regex[0] = '^';
169 
+                    regex[1] = '(';
170 
+                    rxavail -= 2;
171 
+                    rxused = 2;
172 
+                }
173 
+            }
174 
+            ptr = buf;
175 
+            while (*ptr) {
176 
+                if ((*ptr >= 'A' && *ptr <= 'Z') || (*ptr >= 'a' && *ptr <= 'z') || (*ptr >= '0' && *ptr <= '9') || *ptr == '@') {
177 
+                    regex[rxused] = *ptr;
178 
+                    rxused++;
179 
+                    rxavail--;
180 
+                } else {
181 
+                    regex[rxused]     = '[';
182 
+                    regex[rxused + 1] = *ptr;
183 
+                    regex[rxused + 2] = ']';
184 
+                    rxused += 3;
185 
+                    rxavail -= 3;
186 
+                }
187 
+                ptr++;
188 
+            }
189 
+            regex[rxused++] = '|';
190 
+            rxavail--;
191 
+        }
192 
+        if (rxavail < 4 && !(regex = realloc(regex, rxsize + 4))) {
193 
+            logg("!Cannot allocate memory for SkipAuthenticated file\n");
194 
+            fclose(f);
195 
+            return 1;
196 
+        }
197 
+        regex[rxused - 1] = ')';
198 
+        regex[rxused]     = '$';
199 
+        regex[rxused + 1] = '\0';
200 
+        r                 = regex;
201 
+        fclose(f);
202 
+    }
203 
+
204 
+    if (cli_regcomp(&authreg, r, REG_ICASE | REG_NOSUB | REG_EXTENDED)) {
205 
+        logg("!Failed to compile regex '%s' for SkipAuthenticated\n", r);
206 
+        if (regex) free(regex);
207 
+        return 1;
208 
+    }
209 
+    if (regex) free(regex);
210 
+    skipauth = 1;
211 
+    return 0;
212 
+}
213 
+
214 
+int smtpauthed(const char *login)
215 
+{
216 
+    if (skipauth && !cli_regexec(&authreg, login, 0, NULL, 0))
217 
+        return 1;
218 
+    return 0;
219 
+}
220 
+
221 
+/*
222 
+ * Local Variables:
223 
+ * mode: c
224 
+ * c-basic-offset: 4
225 
+ * tab-width: 8
226 
+ * End:
227 
+ * vim: set cindent smartindent autoindent softtabstop=4 shiftwidth=4 tabstop=8:
228 
+ */
clamav-milter/allow_list.h
History View file @ 0255f29
0 229 
new file mode 100644
... ... 
@@ -0,0 +1,30 @@
0 
+/*
1 
+ *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
2 
+ *  Copyright (C) 2008-2013 Sourcefire, Inc.
3 
+ *
4 
+ *  Author: aCaB <acab@clamav.net>
5 
+ *
6 
+ *  This program is free software; you can redistribute it and/or modify
7 
+ *  it under the terms of the GNU General Public License version 2 as
8 
+ *  published by the Free Software Foundation.
9 
+ *
10 
+ *  This program is distributed in the hope that it will be useful,
11 
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12 
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13 
+ *  GNU General Public License for more details.
14 
+ *
15 
+ *  You should have received a copy of the GNU General Public License
16 
+ *  along with this program; if not, write to the Free Software
17 
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
18 
+ *  MA 02110-1301, USA.
19 
+ */
20 
+
21 
+#ifndef _ALLOW_LIST_H
22 
+#define _ALLOW_LIST_H
23 
+
24 
+int allow_list_init(const char *fname);
25 
+void allow_list_free(void);
26 
+int allowed(const char *addr, int from);
27 
+int smtpauth_init(const char *r);
28 
+int smtpauthed(const char *login);
29 
+#endif
clamav-milter/clamav-milter.c
History View file @ 0255f29
... ... 
@@ -49,7 +49,7 @@
49 49 
 #include "connpool.h"
50 50 
 #include "netcode.h"
51 51 
 #include "clamfi.h"
52 
-#include "whitelist.h"
52 
+#include "allow_list.h"
53 53
54 54 
 #ifndef _WIN32
55 55 
 #include <sys/wait.h>
... ... 
@@ -80,7 +80,7 @@ static void milter_exit(int sig)
80 80 
     logg_close();
81 81 
     cpool_free();
82 82 
     localnets_free();
83 
-    whitelist_free();
83 
+    allow_list_free();
84 84 
 }
85 85
86 86 
 int main(int argc, char **argv)
... ... 
@@ -349,7 +349,7 @@ int main(int argc, char **argv)
349 349 
         return 1;
350 350 
     }
351 351
352 
-    if ((opt = optget(opts, "Whitelist"))->enabled && whitelist_init(opt->strarg)) {
352 
+    if (((opt = optget(opts, "Whitelist"))->enabled || (opt = optget(opts, "AllowList"))->enabled) && allow_list_init(opt->strarg)) {
353 353 
         localnets_free();
354 354 
         logg_close();
355 355 
         optfree(opts);
... ... 
@@ -358,7 +358,7 @@ int main(int argc, char **argv)
358 358
359 359 
     if ((opt = optget(opts, "SkipAuthenticated"))->enabled && smtpauth_init(opt->strarg)) {
360 360 
         localnets_free();
361 
-        whitelist_free();
361 
+        allow_list_free();
362 362 
         logg_close();
363 363 
         optfree(opts);
364 364 
         return 1;
... ... 
@@ -371,7 +371,7 @@ int main(int argc, char **argv)
371 371 
         if (-1 == daemonize_parent_wait(user_name, logg_file)) {
372 372 
             logg("!daemonize() failed\n");
373 373 
             localnets_free();
374 
-            whitelist_free();
374 
+            allow_list_free();
375 375 
             cpool_free();
376 376 
             logg_close();
377 377 
             optfree(opts);
... ... 
@@ -410,7 +410,7 @@ int main(int argc, char **argv)
410 410 
     if (!cp) {
411 411 
         logg("!Failed to init the socket pool\n");
412 412 
         localnets_free();
413 
-        whitelist_free();
413 
+        allow_list_free();
414 414 
         logg_close();
415 415 
         optfree(opts);
416 416 
         return 1;
... ... 
@@ -451,7 +451,7 @@ int main(int argc, char **argv)
451 451
452 452 
         if (err) {
453 453 
             localnets_free();
454 
-            whitelist_free();
454 
+            allow_list_free();
455 455 
             logg_close();
456 456 
             optfree(opts);
457 457 
             return 2;
clamav-milter/clamfi.c
History View file @ 0255f29
... ... 
@@ -44,7 +44,7 @@
44 44
45 45 
 #include "connpool.h"
46 46 
 #include "netcode.h"
47 
-#include "whitelist.h"
47 
+#include "allow_list.h"
48 48 
 #include "clamfi.h"
49 49
50 50 
 #if __GNUC__ >= 3 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7)
... ... 
@@ -87,7 +87,7 @@ struct CLAMFI {
87 87 
     int alt;
88 88 
     unsigned int totsz;
89 89 
     unsigned int bufsz;
90 
-    unsigned int all_whitelisted;
90 
+    unsigned int all_allowed;
91 91 
     unsigned int gotbody;
92 92 
     unsigned int scanned_count;
93 93 
     unsigned int status_count;
... ... 
@@ -227,8 +227,8 @@ sfsistat clamfi_header(SMFICTX *ctx, char *headerf, char *headerv)
227 227 
     if (!(cf = (struct CLAMFI *)smfi_getpriv(ctx)))
228 228 
         return SMFIS_CONTINUE; /* whatever */
229 229
230 
-    if (!cf->totsz && cf->all_whitelisted) {
231 
-        logg("*Skipping scan (all destinations whitelisted)\n");
230 
+    if (!cf->totsz && cf->all_allowed) {
231 
+        logg("*Skipping scan (all destinations allowed)\n");
232 232 
         nullify(ctx, cf, CF_NONE);
233 233 
         free(cf);
234 234 
         return SMFIS_ACCEPT;
... ... 
@@ -712,8 +712,8 @@ sfsistat clamfi_envfrom(SMFICTX *ctx, char **argv)
712 712 
         return SMFIS_ACCEPT;
713 713 
     }
714 714
715 
-    if (whitelisted(argv[0], 1)) {
716 
-        logg("*Skipping scan for %s (whitelisted from)\n", argv[0]);
715 
+    if (allowed(argv[0], 1)) {
716 
+        logg("*Skipping scan for %s (allowed from)\n", argv[0]);
717 717 
         return SMFIS_ACCEPT;
718 718 
     }
719 719
... ... 
@@ -724,7 +724,7 @@ sfsistat clamfi_envfrom(SMFICTX *ctx, char **argv)
724 724 
     cf->totsz = 0;
725 725 
     cf->bufsz = 0;
726 726 
     cf->main = cf->alt  = -1;
727 
-    cf->all_whitelisted = 1;
727 
+    cf->all_allowed     = 1;
728 728 
     cf->gotbody         = 0;
729 729 
     cf->msg_subj = cf->msg_date = cf->msg_id = NULL;
730 730 
     if (multircpt) {
... ... 
@@ -747,8 +747,8 @@ sfsistat clamfi_envrcpt(SMFICTX *ctx, char **argv)
747 747 
     if (!(cf = (struct CLAMFI *)smfi_getpriv(ctx)))
748 748 
         return SMFIS_CONTINUE; /* whatever */
749 749
750 
-    if (cf->all_whitelisted)
751 
-        cf->all_whitelisted &= whitelisted(argv[0], 0);
750 
+    if (cf->all_allowed)
751 
+        cf->all_allowed &= allowed(argv[0], 0);
752 752
753 753 
     if (multircpt) {
754 754 
         void *new_rcpt = realloc(cf->recipients, (cf->nrecipients + 1) * sizeof(*(cf->recipients)));
clamav-milter/whitelist.c
History View file @ 0255f29
755 755 
deleted file mode 100644
... ... 
@@ -1,229 +0,0 @@
1 
-/*
2 
- *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
3 
- *  Copyright (C) 2008-2013 Sourcefire, Inc.
4 
- *
5 
- *  Author: aCaB <acab@clamav.net>
6 
- *
7 
- *  This program is free software; you can redistribute it and/or modify
8 
- *  it under the terms of the GNU General Public License version 2 as
9 
- *  published by the Free Software Foundation.
10 
- *
11 
- *  This program is distributed in the hope that it will be useful,
12 
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13 
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 
- *  GNU General Public License for more details.
15 
- *
16 
- *  You should have received a copy of the GNU General Public License
17 
- *  along with this program; if not, write to the Free Software
18 
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
19 
- *  MA 02110-1301, USA.
20 
- */
21 
-
22 
-#if HAVE_CONFIG_H
23 
-#include "clamav-config.h"
24 
-#endif
25 
-
26 
-#include <stdio.h>
27 
-#include <string.h>
28 
-#include <sys/types.h>
29 
-
30 
-// libclamav
31 
-#include "regex/regex.h"
32 
-
33 
-// common
34 
-#include "output.h"
35 
-
36 
-#include "whitelist.h"
37 
-
38 
-struct WHLST {
39 
-    regex_t preg;
40 
-    struct WHLST *next;
41 
-};
42 
-
43 
-struct WHLST *wfrom = NULL;
44 
-struct WHLST *wto   = NULL;
45 
-
46 
-int skipauth = 0;
47 
-regex_t authreg;
48 
-
49 
-void whitelist_free(void)
50 
-{
51 
-    struct WHLST *w;
52 
-    while (wfrom) {
53 
-        w = wfrom->next;
54 
-        cli_regfree(&wfrom->preg);
55 
-        free(wfrom);
56 
-        wfrom = w;
57 
-    }
58 
-    while (wto) {
59 
-        w = wto->next;
60 
-        cli_regfree(&wto->preg);
61 
-        free(wto);
62 
-        wto = w;
63 
-    }
64 
-}
65 
-
66 
-int whitelist_init(const char *fname)
67 
-{
68 
-    char buf[2048];
69 
-    FILE *f;
70 
-    struct WHLST *w;
71 
-
72 
-    if (!(f = fopen(fname, "r"))) {
73 
-        logg("!Cannot open whitelist file '%s'\n", fname);
74 
-        return 1;
75 
-    }
76 
-
77 
-    while (fgets(buf, sizeof(buf), f) != NULL) {
78 
-        struct WHLST **addto = &wto;
79 
-        char *ptr            = buf;
80 
-        int len;
81 
-
82 
-        if (*buf == '#' || *buf == ':' || *buf == '!')
83 
-            continue;
84 
-
85 
-        if (!strncasecmp("From:", buf, 5)) {
86 
-            ptr += 5;
87 
-            addto = &wfrom;
88 
-        } else if (!strncasecmp("To:", buf, 3))
89 
-            ptr += 3;
90 
-
91 
-        len = strlen(ptr) - 1;
92 
-        for (; len >= 0; len--) {
93 
-            if (ptr[len] != '\n' && ptr[len] != '\r') break;
94 
-            ptr[len] = '\0';
95 
-        }
96 
-        if (!len) continue;
97 
-        if (!(w = (struct WHLST *)malloc(sizeof(*w)))) {
98 
-            logg("!Out of memory loading whitelist file\n");
99 
-            whitelist_free();
100 
-            fclose(f);
101 
-            return 1;
102 
-        }
103 
-        w->next  = (*addto);
104 
-        (*addto) = w;
105 
-        if (cli_regcomp(&w->preg, ptr, REG_ICASE | REG_NOSUB)) {
106 
-            logg("!Failed to compile regex '%s' in whitelist file\n", ptr);
107 
-            whitelist_free();
108 
-            fclose(f);
109 
-            return 1;
110 
-        }
111 
-    }
112 
-    fclose(f);
113 
-    return 0;
114 
-}
115 
-
116 
-int whitelisted(const char *addr, int from)
117 
-{
118 
-    struct WHLST *w;
119 
-
120 
-    if (from)
121 
-        w = wfrom;
122 
-    else
123 
-        w = wto;
124 
-
125 
-    while (w) {
126 
-        if (!cli_regexec(&w->preg, addr, 0, NULL, 0))
127 
-            return 1;
128 
-        w = w->next;
129 
-    }
130 
-    return 0;
131 
-}
132 
-
133 
-int smtpauth_init(const char *r)
134 
-{
135 
-    char *regex = NULL;
136 
-
137 
-    if (!strncmp(r, "file:", 5)) {
138 
-        char buf[2048];
139 
-        FILE *f    = fopen(r + 5, "r");
140 
-        int rxsize = 0, rxavail = 0, rxused = 0;
141 
-
142 
-        if (!f) {
143 
-            logg("!Cannot open whitelist file '%s'\n", r + 5);
144 
-            return 1;
145 
-        }
146 
-        while (fgets(buf, sizeof(buf), f) != NULL) {
147 
-            int len;
148 
-            char *ptr;
149 
-
150 
-            if (*buf == '#' || *buf == ':' || *buf == '!')
151 
-                continue;
152 
-            len = strlen(buf) - 1;
153 
-            for (; len >= 0; len--) {
154 
-                if (buf[len] != '\n' && buf[len] != '\r') break;
155 
-                buf[len] = '\0';
156 
-            }
157 
-            if (len <= 0) continue;
158 
-            if (len * 3 + 1 > rxavail) {
159 
-                ptr   = regex;
160 
-                regex = realloc(regex, rxsize + 2048);
161 
-                if (!regex) {
162 
-                    logg("!Cannot allocate memory for SkipAuthenticated file\n");
163 
-                    fclose(f);
164 
-                    return 1;
165 
-                }
166 
-                rxavail = 2048;
167 
-                rxsize += 2048;
168 
-                if (!ptr) {
169 
-                    regex[0] = '^';
170 
-                    regex[1] = '(';
171 
-                    rxavail -= 2;
172 
-                    rxused = 2;
173 
-                }
174 
-            }
175 
-            ptr = buf;
176 
-            while (*ptr) {
177 
-                if ((*ptr >= 'A' && *ptr <= 'Z') || (*ptr >= 'a' && *ptr <= 'z') || (*ptr >= '0' && *ptr <= '9') || *ptr == '@') {
178 
-                    regex[rxused] = *ptr;
179 
-                    rxused++;
180 
-                    rxavail--;
181 
-                } else {
182 
-                    regex[rxused]     = '[';
183 
-                    regex[rxused + 1] = *ptr;
184 
-                    regex[rxused + 2] = ']';
185 
-                    rxused += 3;
186 
-                    rxavail -= 3;
187 
-                }
188 
-                ptr++;
189 
-            }
190 
-            regex[rxused++] = '|';
191 
-            rxavail--;
192 
-        }
193 
-        if (rxavail < 4 && !(regex = realloc(regex, rxsize + 4))) {
194 
-            logg("!Cannot allocate memory for SkipAuthenticated file\n");
195 
-            fclose(f);
196 
-            return 1;
197 
-        }
198 
-        regex[rxused - 1] = ')';
199 
-        regex[rxused]     = '$';
200 
-        regex[rxused + 1] = '\0';
201 
-        r                 = regex;
202 
-        fclose(f);
203 
-    }
204 
-
205 
-    if (cli_regcomp(&authreg, r, REG_ICASE | REG_NOSUB | REG_EXTENDED)) {
206 
-        logg("!Failed to compile regex '%s' for SkipAuthenticated\n", r);
207 
-        if (regex) free(regex);
208 
-        return 1;
209 
-    }
210 
-    if (regex) free(regex);
211 
-    skipauth = 1;
212 
-    return 0;
213 
-}
214 
-
215 
-int smtpauthed(const char *login)
216 
-{
217 
-    if (skipauth && !cli_regexec(&authreg, login, 0, NULL, 0))
218 
-        return 1;
219 
-    return 0;
220 
-}
221 
-
222 
-/*
223 
- * Local Variables:
224 
- * mode: c
225 
- * c-basic-offset: 4
226 
- * tab-width: 8
227 
- * End:
228 
- * vim: set cindent smartindent autoindent softtabstop=4 shiftwidth=4 tabstop=8:
229 
- */
clamav-milter/whitelist.h
History View file @ 0255f29
230 1 
deleted file mode 100644
... ... 
@@ -1,30 +0,0 @@
1 
-/*
2 
- *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
3 
- *  Copyright (C) 2008-2013 Sourcefire, Inc.
4 
- *
5 
- *  Author: aCaB <acab@clamav.net>
6 
- *
7 
- *  This program is free software; you can redistribute it and/or modify
8 
- *  it under the terms of the GNU General Public License version 2 as
9 
- *  published by the Free Software Foundation.
10 
- *
11 
- *  This program is distributed in the hope that it will be useful,
12 
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13 
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 
- *  GNU General Public License for more details.
15 
- *
16 
- *  You should have received a copy of the GNU General Public License
17 
- *  along with this program; if not, write to the Free Software
18 
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
19 
- *  MA 02110-1301, USA.
20 
- */
21 
-
22 
-#ifndef _WHITELIST_H
23 
-#define _WHITELIST_H
24 
-
25 
-int whitelist_init(const char *fname);
26 
-void whitelist_free(void);
27 
-int whitelisted(const char *addr, int from);
28 
-int smtpauth_init(const char *r);
29 
-int smtpauthed(const char *login);
30 
-#endif
common/optparser.c
History View file @ 0255f29
... ... 
@@ -458,9 +458,9 @@ const struct clam_option __clam_options[] = {
458 458
459 459 
     {"OnAccessExcludePath", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option allows excluding directories from on-access scanning. It can\nbe used multiple times. Only works with DDD system.", "/home/bofh\n/root"},
460 460
461 
-    {"OnAccessExcludeRootUID", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_CLAMD, "Use this option to whitelist the root UID (0) and allow any processes run under root to access all watched files without triggering scans.", "no"},
461 
+    {"OnAccessExcludeRootUID", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_CLAMD, "Use this option to exclude the root UID (0) and allow any processes run under root to access all watched files without triggering scans.", "no"},
462 462
463 
-    {"OnAccessExcludeUID", NULL, 0, CLOPT_TYPE_NUMBER, MATCH_NUMBER, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "With this option you can whitelist specific UIDs. Processes with these UIDs\nwill be able to access all files.\nThis option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To whitelist the root UID please enable the OnAccessExcludeRootUID option.", "0"},
463 
+    {"OnAccessExcludeUID", NULL, 0, CLOPT_TYPE_NUMBER, MATCH_NUMBER, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "With this option you can exclude specific UIDs. Processes with these UIDs\nwill be able to access all files.\nThis option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To exclude the root UID please enable the OnAccessExcludeRootUID option.", "0"},
464 464
465 465 
     {"OnAccessExcludeUname", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option allows exclusions via user names when using the on-access scanning client. It can\nbe used multiple times.", "clamuser"},
466 466
... ... 
@@ -605,7 +605,9 @@ const struct clam_option __clam_options[] = {
605 605
606 606 
     {"Chroot", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "Chroot to the specified directory.\nChrooting is performed just after reading the config file and before\ndropping privileges.", "/newroot"},
607 607
608 
-    {"Whitelist", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "This option specifies a file which contains a list of basic POSIX regular\nexpressions. Addresses (sent to or from - see below) matching these regexes\nwill not be scanned.  Optionally each line can start with the string \"From:\"\nor \"To:\" (note: no whitespace after the colon) indicating if it is,\nrespectively, the sender or recipient that is to be whitelisted.\nIf the field is missing, \"To:\" is assumed.\nLines starting with #, : or ! are ignored.", "/etc/whitelisted_addresses"},
608 
+    {"AllowList", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "This option specifies a file which contains a list of basic POSIX regular\nexpressions. Addresses (sent to or from - see below) matching these regexes\nwill not be scanned.  Optionally each line can start with the string \"From:\"\nor \"To:\" (note: no whitespace after the colon) indicating if it is,\nrespectively, the sender or recipient that is to be allowed.\nIf the field is missing, \"To:\" is assumed.\nLines starting with #, : or ! are ignored.", "/etc/allowed_addresses"},
609 
+    // The Whitelist option should remain functional for a version or two, but has been deprecated in the documentation in favor of "AllowList".
610 
+    {"Whitelist", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "This option specifies a file which contains a list of basic POSIX regular\nexpressions. Addresses (sent to or from - see below) matching these regexes\nwill not be scanned.  Optionally each line can start with the string \"From:\"\nor \"To:\" (note: no whitespace after the colon) indicating if it is,\nrespectively, the sender or recipient that is to be allowed.\nIf the field is missing, \"To:\" is assumed.\nLines starting with #, : or ! are ignored.", "/etc/allowed_addresses"},
609 611
610 612 
     {"SkipAuthenticated", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_MILTER, "Messages from authenticated SMTP users matching this extended POSIX\nregular expression (egrep-like) will not be scanned.\nAs an alternative, a file containing a plain (not regex) list of names (one\nper line) can be specified using the prefix \"file:\".\ne.g. SkipAuthenticated file:/etc/good_guys\n\nNote: this is the AUTH login name!", "SkipAuthenticated ^(tom|dick|henry)$"},
611 613
docs/man/clamav-milter.conf.5.in
History View file @ 0255f29
... ... 
@@ -1,29 +1,29 @@
1 1 
 .TH "clamav-milter.conf" "5" "Feb 25, 2009" "ClamAV @VERSION@" "Clam AntiVirus"
2 2 
 .SH "NAME"
3 
-.LP
3 
+.LP
4 4 
 \fBclamav-milter.conf\fR \- Configuration file for clamav-milter
5 5 
 .SH "DESCRIPTION"
6 
-.LP
6 
+.LP
7 7 
 clamav-milter.conf contains the configuration options for clamav-milter(8).
8 8 
 .SH "FILE FORMAT"
9 9 
 The file consists of comments and options with arguments. Each line which starts with a hash (\fB#\fR) symbol is ignored by the parser. Options and arguments are case sensitive and of the form \fBOption Argument\fR. The arguments are of the following types:
10 
-.TP
10 
+.TP
11 11 
 \fBBOOL\fR
12 12 
 Boolean value (yes/no or true/false or 1/0).
13 
-.TP
13 
+.TP
14 14 
 \fBSTRING\fR
15 15 
 String without blank characters.
16 
-.TP
16 
+.TP
17 17 
 \fBSIZE\fR
18 18 
 Size in bytes. You can use 'M' or 'm' modifiers for megabytes and 'K' or 'k' for kilobytes.
19 
-.TP
19 
+.TP
20 20 
 \fBNUMBER\fR
21 21 
 Unsigned integer.
22 22 
 .SH "MAIN OPTIONS"
23 
-.TP
23 
+.TP
24 24 
 \fBExample\fR
25 25 
 If this option is set clamav-milter will not run.
26 
-.TP
26 
+.TP
27 27 
 \fBMilterSocket STRING\fR
28 28 
 Define the interface through which we communicate with sendmail. This option is mandatory!
29 29 
 .br
... ... 
@@ -34,19 +34,19 @@ Possible formats are:
34 34 
 inet:port@[hostname|ip-address] - to specify an ipv4 socket
35 35 
 .br
36 36 
 inet6:port@[hostname|ip-address] - to specify an ipv6 socket
37 
-.br
37 
+.br
38 38 
 Default: unset
39 
-.TP
39 
+.TP
40 40 
 \fBMilterSocketGroup STRING\fR
41 41 
 Define the group ownership for the (unix) milter socket.
42 42 
 .br
43 43 
 Default: disabled (the primary group of the user running clamd)
44 
-.TP
44 
+.TP
45 45 
 \fBMilterSocketMode STRING\fR
46 46 
 Sets the permissions on the (unix) milter socket to the specified mode.
47 47 
 .br
48 48 
 Default: disabled (obey umask)
49 
-.TP
49 
+.TP
50 50 
 \fBFixStaleSocket BOOL\fR
51 51 
 Remove stale socket after unclean shutdown.
52 52 
 .br
... ... 
@@ -56,33 +56,33 @@ Default: yes
56 56 
 Run as another user (clamav-milter must be started by root for this option to work)
57 57 
 .br
58 58 
 Default: unset (don\'t drop privileges)
59 
-.TP
59 
+.TP
60 60 
 \fBReadTimeout NUMBER\fR
61 61 
 Waiting for data from clamd will timeout after this time (seconds).
62 
-.br
62 
+.br
63 63 
 Default: 120
64 
-.TP
64 
+.TP
65 65 
 \fBForeground BOOL\fR
66 66 
 Don\'t fork into background.
67 
-.br
67 
+.br
68 68 
 Default: no
69 
-.TP
69 
+.TP
70 70 
 \fBChroot STRING\fR
71 71 
 Chroot to the specified directory. Chrooting is performed just after reading the config file and before dropping privileges.
72 72 
 .br
73 73 
 Default: unset (don\'t chroot)
74 
-.TP
74 
+.TP
75 75 
 \fBPidFile STRING\fR
76 76 
 Save the process identifier of a clamav-milter (main thread) to a specified file.
77 
-.br
77 
+.br
78 78 
 Default: disabled
79 
-.TP
79 
+.TP
80 80 
 \fBTemporaryDirectory STRING\fR
81 81 
 Optional path to the global temporary directory.
82 
-.br
82 
+.br
83 83 
 Default: system specific (usually /tmp or /var/tmp).
84 84 
 .SH "CLAMD OPTIONS"
85 
-.TP
85 
+.TP
86 86 
 \fBClamdSocket STRING\fR
87 87 
 Define the clamd socket to connect to for scanning. This option is mandatory! Syntax:
88 88 
 .br
... ... 
@@ -102,22 +102,22 @@ This option can be repeated several times with different sockets or even with th
102 102 
 .br
103 103 
 Default: no default
104 104 
 .SH "EXCLUSIONS"
105 
-.TP
105 
+.TP
106 106 
 \fBLocalNet STRING\fR
107 107 
 Messages originating from these hosts/networks will not be scanned. This option takes a host(name)/mask pair in CIRD notation and can be repeated several times. If "/mask" is omitted, a host is assumed. To specify a locally originated, non-smtp, email use the keyword "local"
108 108 
 .br
109 109 
 Default: unset (scan everything regardless of the origin)
110 
-.TP
111 
-\fBWhitelist STRING\fR
112 
-This option specifies a file which contains a list of basic POSIX regular expressions. Addresses (sent to or from - see below) matching these regexes  will not be scanned.  Optionally each line can start with the string "From:" or "To:" (note: no whitespace after the colon) indicating if it is,  respectively, the sender or recipient that is to be whitelisted. If the field is missing, "To:" is assumed.  Lines starting with #, : or ! are ignored.
110 
+.TP
111 
+\fBAllowList STRING\fR
112 
+This option specifies a file which contains a list of basic POSIX regular expressions. Addresses (sent to or from - see below) matching these regexes  will not be scanned.  Optionally each line can start with the string "From:" or "To:" (note: no whitespace after the colon) indicating if it is,  respectively, the sender or recipient that is to be allowed. If the field is missing, "To:" is assumed.  Lines starting with #, : or ! are ignored.
113 113 
 .br
114 114 
 Default: unset (no exclusion applied)
115 
-.TP
115 
+.TP
116 116 
 \fBSkipAuthenticated STRING\fR
117 117 
 Messages from authenticated SMTP users matching this extended POSIX regular expression (egrep-like) will not be scanned.  As an alternative, a file containing a plain (not regex) list of names (one per line) can be specified using the prefix "file:".  e.g. SkipAuthenticated file:/etc/good_guys. Note: this is the AUTH login name!
118 118 
 .br
119 
-Default: unset (no whitelisting based on SMTP auth)
120 
-.TP
119 
+Default: unset (no allowing based on SMTP auth)
120 
+.TP
121 121 
 \fBMaxFileSize SIZE\fR
122 122 
 Messages larger than this value won\'t be scanned. Make sure this value is lower or equal than StreamMaxLength in clamd.conf
123 123 
 .br
... ... 
@@ -134,78 +134,78 @@ The following group of options controls the delivery process under  different ci
134 134 
 - Blackhole (not available for OnFail): Like Accept but the message is sent to oblivion
135 135 
 .br
136 136 
 - Quarantine (not available for OnFail): Like Accept but message is quarantined instead of being delivered. NOTE: In Sendmail the quarantine queue can be examined via mailq \-qQ. For Postfix this causes the message to be placed on hold.
137 
-.TP
137 
+.TP
138 138 
 \fBOnClean STRING\fR
139 139 
 Action to be performed on clean messages (mostly useful for testing)
140 140 
 .br
141 141 
 Default: Accept
142 
-.TP
142 
+.TP
143 143 
 \fBOnInfected STRING\fR
144 144 
 Action to be performed on infected messages
145 145 
 .br
146 146 
 Default: Quarantine
147 
-.TP
147 
+.TP
148 148 
 \fBOnFail STRING\fR
149 149 
 Action to be performed on error conditions (this includes failure to allocate data structures, no scanners available, network timeouts, unknown scanner replies and the like)
150 150 
 .br
151 151 
 Default: Defer
152 
-.TP
152 
+.TP
153 153 
 \fBRejectMsg STRING\fR
154 154 
 This option allows you to set a specific rejection reason for infected messages and it\'s therefore only useful together with "OnInfected Reject". The string "%v", if present, will be replaced with the virus name.
155 155 
 .br
156 156 
 Default: MTA specific
157 
-.TP
157 
+.TP
158 158 
 \fBAddHeader STRING\fR
159 159 
 If this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an "X-Virus-Status" headers will be attached to each processed message, possibly replacing existing headers.  If it is set to Add, the X-Virus headers are added possibly on top of the existing ones. Note that while "Replace" can potentially break DKIM signatures, "Add" may confuse procmail and similar filters.
160 160 
 .br
161 161 
 Default: no
162 
-.TP
162 
+.TP
163 163 
 \fBReportHostname STRING\fr
164 164 
 When AddHeader is in use, this option allows you to set the reported hostname. This may be desirable in order to avoid leaking internal names. If unset the real machine name is used.
165 165 
 .br
166 166 
 Default: disabled
167 
-.TP
167 
+.TP
168 168 
 \fBVirusAction STRING\fr
169 169 
 Execute a command (possibly searching PATH) when an infected message is found. The following parameters are passed to the invoked program in this order: virus name, queue id, sender, destination, subject, message id, message date. Note #1: this requires MTA macroes to be available (see LogInfected below). Note #2: the process is invoked in the context of clamav-milter. Note #3: clamav-milter will wait for the process to exit. Be quick or fork to avoid unnecessary delays in email delivery.
170 170 
 .br
171 171 
 Default: disabled
172 172 
 .SH "LOGGING OPTIONS"
173 
-.TP
173 
+.TP
174 174 
 \fBLogFile STRING\fR
175 175 
 Enable logging to selected file.
176 
-.br
176 
+.br
177 177 
 Default: no
178 
-.TP
178 
+.TP
179 179 
 \fBLogFileUnlock BOOL\fR
180 180 
 Disable a system lock that protects against running clamd with the same configuration file multiple times.
181 
-.br
181 
+.br
182 182 
 Default: no
183 
-.TP
183 
+.TP
184 184 
 \fBLogFileMaxSize SIZE\fR
185 185 
 Limit the size of the log file. The logger will be automatically disabled if the file is greater than SIZE. Value of 0 disables the limit.
186 
-.br
186 
+.br
187 187 
 Default: 1M
188 
-.TP
188 
+.TP
189 189 
 \fBLogTime BOOL\fR
190 190 
 Log time for each message.
191 
-.br
191 
+.br
192 192 
 Default: no
193 
-.TP
193 
+.TP
194 194 
 \fBLogSyslog BOOL\fR
195 195 
 Use system logger (can work together with LogFile).
196 
-.br
196 
+.br
197 197 
 Default: no
198 
-.TP
198 
+.TP
199 199 
 \fBLogFacility STRING\fR
200 200 
 Specify the type of syslog messages \- please refer to 'man syslog' for facility names.
201 
-.br
201 
+.br
202 202 
 Default: LOG_LOCAL6
203 
-.TP
203 
+.TP
204 204 
 \fBLogVerbose BOOL\fR
205 205 
 Enable verbose logging.
206 
-.br
206 
+.br
207 207 
 Default: no
208 
-.TP
208 
+.TP
209 209 
 \fBLogInfected STRING\fR
210 210 
 This option allows you to tune what is logged when a message is infected. Possible values are Off (the default \- nothing is logged), Basic (minimal info logged), Full (verbose info logged)
211 211 
 .br
... ... 
@@ -214,7 +214,7 @@ Note: For this to work properly in sendmail, make sure the msg_id, mail_addr, rc
214 214 
 Postfix should be working fine with the default settings.
215 215 
 .br
216 216 
 Default: disabled
217 
-.TP
217 
+.TP
218 218 
 \fBLogClean STRING\fR
219 219 
 This option allows you to tune what is logged when no threat is found in a scanned message.
220 220 
 .br
... ... 
@@ -235,14 +235,14 @@ Note: although it's probably a good idea to enable this option, the default valu
235 235 
 .br
236 236 
 Default: no
237 237 
 .SH "NOTES"
238 
-.LP
238 
+.LP
239 239 
 All options expressing a size are limited to max 4GB. Values in excess will be reset to the maximum.
240 240 
 .SH "FILES"
241 
-.LP
241 
+.LP
242 242 
 @CFGDIR@/clamav-milter.conf
243 243 
 .SH "AUTHOR"
244 
-.LP
244 
+.LP
245 245 
 aCaB <acab@clamav.net>
246 246 
 .SH "SEE ALSO"
247 
-.LP
247 
+.LP
248 248 
 clamav-milter(8), clamd(8), clamd.conf(5)
docs/man/clamd.conf.5.in
History View file @ 0255f29
... ... 
@@ -687,18 +687,18 @@ This option allows excluding directories from on-access scanning. It can be used
687 687 
 Default: disabled
688 688 
 .TP
689 689 
 \fBOnAccessExcludeRootUID BOOL\fR
690 
-With this option you can whitelist the root UID (0). Processes run under root will be able to access all files without triggering scans or permission denied events.
690 
+With this option you can exclude the root UID (0). Processes run under root will be able to access all files without triggering scans or permission denied events.
691 691 
 .br
692 692 
 Note that if clamd cannot check the uid of the process that generated an on-access scan event (e.g., because \fBOnAccessPrevention\fR was not enabled, and the process already exited), clamd will perform a scan.  Thus, setting \fBOnAccessExcludeRootUID\fR is not \fIguaranteed\fR to prevent every access by the root user from triggering a scan (unless \fBOnAccessPrevention\fR is enabled).
693 693 
 .br
694 694 
 Default: no
695 695 
 .TP
696 696 
 \fBOnAccessExcludeUID NUMBER\fR
697 
-With this option you can whitelist specific UIDs. Processes with these UIDs will be able to access all files without triggering scans or permission denied events.
697 
+With this option you can exclude specific UIDs. Processes with these UIDs will be able to access all files without triggering scans or permission denied events.
698 698 
 .br
699 699 
 This option can be used multiple times (one per line).
700 700 
 .br
701 
-Note: using a value of 0 on any line will disable this option entirely. To whitelist the root UID (0) please enable the OnAccessExcludeRootUID option.
701 
+Note: using a value of 0 on any line will disable this option entirely. To exclude the root UID (0) please enable the OnAccessExcludeRootUID option.
702 702 
 .br
703 703 
 Also note that if clamd cannot check the uid of the process that generated an on-access scan event (e.g., because \fBOnAccessPrevention\fR was not enabled, and the process already exited), clamd will perform a scan.  Thus, setting \fBOnAccessExcludeUID\fR is not \fIguaranteed\fR to prevent every access by the specified uid from triggering a scan (unless \fBOnAccessPrevention\fR is enabled).
704 704 
 .br
docs/man/freshclam.conf.5.in
History View file @ 0255f29
... ... 
@@ -144,7 +144,7 @@ With this option you can provide custom sources for database files. This option
144 144 
 Support for:
145 145 
   http(s)://, ftp(s)://, or file://
146 146 
 Example usage:
147 
-  DatabaseCustomURL https://myserver.com:4567/whitelist.wdb
147 
+  DatabaseCustomURL https://myserver.com:4567/allow_list.wdb
148 148 
 .br
149 149 
 Default: disabled
150 150 
 .TP
etc/clamav-milter.conf.sample
History View file @ 0255f29
... ... 
@@ -59,7 +59,7 @@ Example
59 59
60 60 
 # This option allows you to save a process identifier of the listening
61 61 
 # daemon (main thread).
62 
-# This file will be owned by root, as long as clamav-milter was started by
62 
+# This file will be owned by root, as long as clamav-milter was started by
63 63 
 # root.  It is recommended that the directory where this file is stored is
64 64 
 # also owned by root to keep other users from tampering with it.
65 65 
 #
... ... 
@@ -111,13 +111,13 @@ Example
111 111 
 # This option specifies a file which contains a list of basic POSIX regular
112 112 
 # expressions. Addresses (sent to or from - see below) matching these regexes
113 113 
 # will not be scanned.  Optionally each line can start with the string "From:"
114 
-# or "To:" (note: no whitespace after the colon) indicating if it is,
115 
-# respectively, the sender or recipient that is to be whitelisted.
114 
+# or "To:" (note: no whitespace after the colon) indicating if it is,
115 
+# respectively, the sender or recipient that is to be allowed.
116 116 
 # If the field is missing, "To:" is assumed.
117 117 
 # Lines starting with #, : or ! are ignored.
118 118 
 #
119 119 
 # Default unset (no exclusion applied)
120 
-#Whitelist /etc/whitelisted_addresses
120 
+#AllowList /etc/allowed_addresses
121 121
122 122 
 # Messages from authenticated SMTP users matching this extended POSIX
123 123 
 # regular expression (egrep-like) will not be scanned.
... ... 
@@ -127,7 +127,7 @@ Example
127 127 
 #
128 128 
 # Note: this is the AUTH login name!
129 129 
 #
130 
-# Default: unset (no whitelisting based on SMTP auth)
130 
+# Default: unset (no allowing based on SMTP auth)
131 131 
 #SkipAuthenticated ^(tom|dick|henry)$
132 132
133 133 
 # Messages larger than this value won't be scanned.
... ... 
@@ -157,7 +157,7 @@ Example
157 157 
 #
158 158 
 # NOTE: In Sendmail the quarantine queue can be examined via mailq -qQ
159 159 
 # For Postfix this causes the message to be placed on hold
160 
-#
160 
+#
161 161 
 # Action to be performed on clean messages (mostly useful for testing)
162 162 
 # Default: Accept
163 163 
 #OnClean Accept
... ... 
@@ -176,7 +176,7 @@ Example
176 176 
 # and it's therefore only useful together with "OnInfected Reject"
177 177 
 # The string "%v", if present, will be replaced with the virus name.
178 178 
 # Default: MTA specific
179 
-#RejectMsg
179 
+#RejectMsg
180 180
181 181 
 # If this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an
182 182 
 # "X-Virus-Status" headers will be attached to each processed message, possibly
... ... 
@@ -288,10 +288,9 @@ Example
288 288 
 # If SupportMultipleRecipients is on:
289 289 
 # then one line is logged for each recipient and the command indicated
290 290 
 # by VirusAction is also executed once for each recipient.
291 
-#
291 
+#
292 292 
 # Note: although it's probably a good idea to enable this option, the default
293 293 
 # value
294 294 
 # is currently set to off for legacy reasons.
295 295 
 # Default: no
296 296 
 #SupportMultipleRecipients yes
297 
-
etc/clamd.conf.sample
History View file @ 0255f29
... ... 
@@ -359,7 +359,7 @@ Example
359 359 
 # the signature chain in the PE file against a database of trusted and
360 360 
 # revoked certificates if the file being scanned is marked as a virus.
361 361 
 # If any certificate in the chain validates against any trusted root, but
362 
-# does not match any revoked certificate, the file is marked as whitelisted.
362 
+# does not match any revoked certificate, the file is marked as trusted.
363 363 
 # If the file does match a revoked certificate, the file is marked as virus.
364 364 
 # The following setting completely turns off authenticode verification.
365 365 
 # Default: no
... ... 
@@ -717,7 +717,7 @@ Example
717 717 
 #OnAccessMountPath /
718 718 
 #OnAccessMountPath /home/user
719 719
720 
-# With this option you can whitelist the root UID (0). Processes run under
720 
+# With this option you can exclude the root UID (0). Processes run under
721 721 
 # root with be able to access all files without triggering scans or
722 722 
 # permission denied events.
723 723 
 # Note that if clamd cannot check the uid of the process that generated an
... ... 
@@ -728,12 +728,12 @@ Example
728 728 
 # Default: no
729 729 
 #OnAccessExcludeRootUID no
730 730
731 
-# With this option you can whitelist specific UIDs. Processes with these UIDs
731 
+# With this option you can exclude specific UIDs. Processes with these UIDs
732 732 
 # will be able to access all files without triggering scans or permission
733 733 
 # denied events.
734 734 
 # This option can be used multiple times (one per line).
735 735 
 # Using a value of 0 on any line will disable this option entirely.
736 
-# To whitelist the root UID (0) please enable the OnAccessExcludeRootUID
736 
+# To exclude the root UID (0) please enable the OnAccessExcludeRootUID
737 737 
 # option.
738 738 
 # Also note that if clamd cannot check the uid of the process that generated an
739 739 
 # on-access scan event (e.g., because OnAccessPrevention was not enabled, and
etc/freshclam.conf.sample
History View file @ 0255f29
... ... 
@@ -95,7 +95,7 @@ DatabaseMirror database.clamav.net
95 95 
 # Default: no custom URLs
96 96 
 #DatabaseCustomURL http://myserver.example.com/mysigs.ndb
97 97 
 #DatabaseCustomURL https://myserver.example.com/mysigs.ndb
98 
-#DatabaseCustomURL https://myserver.example.com:4567/whitelist.wdb
98 
+#DatabaseCustomURL https://myserver.example.com:4567/allow_list.wdb
99 99 
 #DatabaseCustomURL ftp://myserver.example.com/example.ldb
100 100 
 #DatabaseCustomURL ftps://myserver.example.com:4567/example.ndb
101 101 
 #DatabaseCustomURL file:///mnt/nfs/local.hdb
libclamav/CMakeLists.txt
History View file @ 0255f29
... ... 
@@ -439,7 +439,7 @@ target_sources( clamav_obj
439 439 
         mbox.c              mbox.h
440 440 
         message.c           message.h
441 441 
         phish_domaincheck_db.c phish_domaincheck_db.h
442 
-        phish_whitelist.c   phish_whitelist.h
442 
+        phish_allow_list.c  phish_allow_list.h
443 443 
         phishcheck.c        phishcheck.h
444 444 
         regex_list.c        regex_list.h
445 445 
         regex_suffix.c      regex_suffix.h
libclamav/asn1.c
History View file @ 0255f29
... ... 
@@ -1608,10 +1608,10 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1608 1608 
                     x509 = newcerts.crts;
1609 1609 
                 }
1610 1610
1611 
-                /* Determine whether the embedded certificate is blacklisted or
1612 
-                 * whitelisted. If an embedded cert matches a blacklist rule,
1611 
+                /* Determine whether the embedded certificate is blocked or
1612 
+                 * trusted. If an embedded cert matches a block list rule,
1613 1613 
                  * we can return immediately indicating that a sig matched.
1614 
-                 * This isn't true for whitelist matches, since otherwise an
1614 
+                 * This isn't true for allow list matches, since otherwise an
1615 1615 
                  * attacker could just include a known-good certificate in the
1616 1616 
                  * signature and not use it. Instead, for those we will add the
1617 1617 
                  * embedded cert to the trust store and continue on to ensure
... ... 
@@ -1620,14 +1620,14 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1620 1620 
                     cli_crt *crt;
1621 1621
1622 1622 
                     /* Use &(engine->cmgr) for this check, since we don't copy
1623 
-                     * blacklist certs into cmgr and so that if there's a
1623 
+                     * block list certs into cmgr and so that if there's a
1624 1624 
                      * match, we have a long-lived pointer that we can pass
1625 1625 
                      * back (via cli_append_virus) indicating the name of the
1626 1626 
                      * sigs that matched (we can't just malloc new space for
1627 1627 
                      * one, since nothing above here knows to free it.) */
1628 
-                    if (NULL != (crt = crtmgr_blacklist_lookup(&(engine->cmgr), x509))) {
1628 
+                    if (NULL != (crt = crtmgr_block_list_lookup(&(engine->cmgr), x509))) {
1629 1629 
                         ret = CL_VIRUS;
1630 
-                        cli_dbgmsg("asn1_parse_mscat: Found Authenticode certificate blacklisted by %s\n", crt->name ? crt->name : "(unnamed CRB rule)");
1630 
+                        cli_dbgmsg("asn1_parse_mscat: Found Authenticode certificate blocked by %s\n", crt->name ? crt->name : "(unnamed CRB rule)");
1631 1631 
                         if (NULL != ctx) {
1632 1632 
                             ret = cli_append_virus(ctx, crt->name ? crt->name : "(unnamed CRB rule)");
1633 1633 
                             if ((ret == CL_VIRUS) && !SCAN_ALLMATCHES) {
... ... 
@@ -1636,7 +1636,7 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1636 1636 
                             }
1637 1637 
                         }
1638 1638 
                         /* In the case where ctx is NULL, we don't care about
1639 
-                         * blacklist matches - we are either using this
1639 
+                         * block list matches - we are either using this
1640 1640 
                          * function to parse .cat rules that were loaded in,
1641 1641 
                          * or it's sigtool doing cert printing. */
1642 1642 
                     }
... ... 
@@ -1647,13 +1647,13 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1647 1647 
                      * store for doing the time/code digital signature checks.
1648 1648 
                      * This isn't required for cert-signing certs that
1649 1649 
                      * we discover this way, since the CRB cli_crts have enough
1650 
-                     * info to be able to whitelist other certs, but executing
1650 
+                     * info to be able to trust other certs, but executing
1651 1651 
                      * the following code for those has the benefit of removing
1652 1652 
                      * them from newcerts so they aren't processed again while
1653 1653 
                      * looking for chained trust. */
1654 
-                    if (NULL != (crt = crtmgr_whitelist_lookup(cmgr, x509, 1))) {
1654 
+                    if (NULL != (crt = crtmgr_trust_list_lookup(cmgr, x509, 1))) {
1655 1655 
                         cli_crt *tmp = x509->next;
1656 
-                        cli_dbgmsg("asn1_parse_mscat: Directly whitelisting embedded cert based on %s\n", (crt->name ? crt->name : "(no name)"));
1656 
+                        cli_dbgmsg("asn1_parse_mscat: Directly trusting embedded cert based on %s\n", (crt->name ? crt->name : "(no name)"));
1657 1657 
                         if (cli_debug_flag && crt->name) {
1658 1658 
                             // Copy the name from the CRB entry for printing below
1659 1659 
                             x509->name = strdup(crt->name);
... ... 
@@ -1695,7 +1695,7 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1695 1695 
                      * assuming tries to prevent us from doing the expensive
1696 1696 
                      * RSA verification in the case where the same cert is
1697 1697 
                      * embedded multiple times?  Sure, why not */
1698 
-                    if (crtmgr_whitelist_lookup(cmgr, x509, 0)) {
1698 
+                    if (crtmgr_trust_list_lookup(cmgr, x509, 0)) {
1699 1699 
                         cli_crt *tmp = x509->next;
1700 1700 
                         cli_dbgmsg("asn1_parse_mscat: found embedded certificate matching one in the trust store\n");
1701 1701 
                         crtmgr_del(&newcerts, x509);
... ... 
@@ -1709,7 +1709,7 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
1709 1709
1710 1710 
                     if (parent) {
1711 1711
1712 
-                        cli_dbgmsg("asn1_parse_mscat: Indirectly whitelisting embedded cert based on %s\n", (parent->name ? parent->name : "(no name)"));
1712 
+                        cli_dbgmsg("asn1_parse_mscat: Indirectly trusting embedded cert based on %s\n", (parent->name ? parent->name : "(no name)"));
1713 1713
1714 1714 
                         // TODO Why is this done?  It seems like you should be
1715 1715 
                         // able to have a parent cert can only do cert signing
... ... 
@@ -2005,7 +2005,7 @@ static cl_error_t asn1_parse_mscat(struct cl_engine *engine, fmap_t *map, size_t
2005 2005 
          * signature has a time-stamping countersignature, then we just need to
2006 2006 
          * verify that countersignature.  Otherwise, we should determine
2007 2007 
          * whether the signing certificate is still valid (time-based, since at
2008 
-         * this point in the code no matching blacklist rules fired). */
2008 
+         * this point in the code no matching block list rules fired). */
2009 2009
2010 2010 
         if (!size) {
2011 2011 
             time_t now;
... ... 
@@ -2155,7 +2155,7 @@ int asn1_load_mscat(fmap_t *map, struct cl_engine *engine)
2155 2155 
     int i;
2156 2156
2157 2157 
     // TODO As currently implemented, loading in a .cat file with -d requires
2158 
-    // an accompanying .crb with whitelist entries that will cause the .cat
2158 
+    // an accompanying .crb with trust entries that will cause the .cat
2159 2159 
     // file signatures to verify successfully.  If a user is specifying a .cat
2160 2160 
     // file to use, though, we should assume they trust it and at least add the
2161 2161 
     // covered hashes from it to hm_fp
... ... 
@@ -2311,10 +2311,10 @@ int asn1_load_mscat(fmap_t *map, struct cl_engine *engine)
2311 2311 
 /* Check an embedded PE Authenticode section to determine whether it's trusted.
2312 2312 
  * This will return CL_VERIFIED if the file should be trusted, CL_EPARSE if an
2313 2313 
  * error occurred while parsing the signature, CL_EVERIFY if parsing was
2314 
- * successful but there were no whitelist rules for the signature, and
2315 
- * CL_VIRUS if a blacklist rule was found for an embedded certificate.
2314 
+ * successful but there were no trust rules for the signature, and
2315 
+ * CL_VIRUS if a block list rule was found for an embedded certificate.
2316 2316 
  *
2317 
- * If CL_VIRUS is returned, certname will be set to the certname of blacklist
2317 
+ * If CL_VIRUS is returned, certname will be set to the certname of block list
2318 2318 
  * rule that matched (unless certname is NULL). */
2319 2319 
 cl_error_t asn1_check_mscat(struct cl_engine *engine, fmap_t *map, size_t offset, unsigned int size, struct cli_mapped_region *regions, uint32_t nregions, cli_ctx *ctx)
2320 2320 
 {
... ... 
@@ -2331,7 +2331,7 @@ cl_error_t asn1_check_mscat(struct cl_engine *engine, fmap_t *map, size_t offset
2331 2331
2332 2332 
     cli_dbgmsg("in asn1_check_mscat (offset: %llu)\n", (long long unsigned)offset);
2333 2333 
     crtmgr_init(&certs);
2334 
-    /* Get a copy of all certs in the trust store, excluding blacklist certs */
2334 
+    /* Get a copy of all certs in the trust store, excluding block list certs */
2335 2335 
     if (crtmgr_add_roots(engine, &certs, 1)) {
2336 2336 
         crtmgr_free(&certs);
2337 2337 
         return CL_EVERIFY;
... ... 
@@ -2404,6 +2404,6 @@ cl_error_t asn1_check_mscat(struct cl_engine *engine, fmap_t *map, size_t offset
2404 2404 
         return CL_EPARSE;
2405 2405 
     }
2406 2406
2407 
-    cli_dbgmsg("asn1_check_mscat: file with valid authenticode signature, whitelisted\n");
2407 
+    cli_dbgmsg("asn1_check_mscat: file with valid authenticode signature, trusted\n");
2408 2408 
     return CL_VERIFIED;
2409 2409 
 }
libclamav/clamav.h
History View file @ 0255f29
... ... 
@@ -33,12 +33,12 @@
33 33
34 34 
 /* Certain OSs already use 64bit variables in their stat struct */
35 35 
 #if (!defined(__FreeBSD__) && !defined(__APPLE__))
36 
-#define STAT64_BLACKLIST 1
36 
+#define STAT64_OK 1
37 37 
 #else
38 
-#define STAT64_BLACKLIST 0
38 
+#define STAT64_OK 0
39 39 
 #endif
40 40
41 
-#if defined(HAVE_STAT64) && STAT64_BLACKLIST
41 
+#if defined(HAVE_STAT64) && STAT64_OK
42 42
43 43 
 #include <unistd.h>
44 44
... ... 
@@ -47,6 +47,7 @@
47 47 
 #define LSTAT lstat64
48 48 
 #define FSTAT fstat64
49 49 
 #define safe_open(a, b) open(a, b | O_LARGEFILE)
50 
+
50 51 
 #else
51 52
52 53 
 #define STATBUF struct stat
... ... 
@@ -473,8 +474,8 @@ extern cl_error_t cl_engine_free(struct cl_engine *engine);
473 473 
  * @param type      File type detected via magic - i.e. NOT on the fly - (e.g. "CL_TYPE_MSEXE").
474 474 
  * @param context   Opaque application provided data.
475 475 
  * @return          CL_CLEAN = File is scanned.
476 
- * @return          CL_BREAK = Whitelisted by callback - file is skipped and marked as clean.
477 
- * @return          CL_VIRUS = Blacklisted by callback - file is skipped and marked as infected.
476 
+ * @return          CL_BREAK = Allowed by callback - file is skipped and marked as clean.
477 
+ * @return          CL_VIRUS = Blocked by callback - file is skipped and marked as infected.
478 478 
  */
479 479 
 typedef cl_error_t (*clcb_pre_cache)(int fd, const char *type, void *context);
480 480 
 /**
... ... 
@@ -499,8 +500,8 @@ extern void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cach
499 499 
  * @param type      File type detected via magic - i.e. NOT on the fly - (e.g. "CL_TYPE_MSEXE").
500 500 
  * @param context   Opaque application provided data.
501 501 
  * @return          CL_CLEAN = File is scanned.
502 
- * @return          CL_BREAK = Whitelisted by callback - file is skipped and marked as clean.
503 
- * @return          CL_VIRUS = Blacklisted by callback - file is skipped and marked as infected.
502 
+ * @return          CL_BREAK = Allowed by callback - file is skipped and marked as clean.
503 
+ * @return          CL_VIRUS = Blocked by callback - file is skipped and marked as infected.
504 504 
  */
505 505 
 typedef cl_error_t (*clcb_pre_scan)(int fd, const char *type, void *context);
506 506 
 /**
... ... 
@@ -526,8 +527,8 @@ extern void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan
526 526 
  * @param virname   A signature name if there was one or more matches.
527 527 
  * @param context   Opaque application provided data.
528 528 
  * @return          Scan result is not overridden.
529 
- * @return          CL_BREAK = Whitelisted by callback - scan result is set to CL_CLEAN.
530 
- * @return          Blacklisted by callback - scan result is set to CL_VIRUS.
529 
+ * @return          CL_BREAK = Allowed by callback - scan result is set to CL_CLEAN.
530 
+ * @return          Blocked by callback - scan result is set to CL_VIRUS.
531 531 
  */
532 532 
 typedef cl_error_t (*clcb_post_scan)(int fd, int result, const char *virname, void *context);
533 533 
 /**
... ... 
@@ -541,14 +542,14 @@ typedef cl_error_t (*clcb_post_scan)(int fd, int result, const char *virname, vo
541 541 
 extern void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);
542 542
543 543 
 /**
544 
- * @brief Post-scan callback.
544 
+ * @brief Virus-found callback.
545 545 
  *
546 546 
  * Called for each signature match.
547 547 
  * If all-match is enabled, clcb_virus_found() may be called multiple times per
548 548 
  * scan.
549 549 
  *
550 550 
  * In addition, clcb_virus_found() does not have a return value and thus.
551 
- * can not be used to whitelist the match.
551 
+ * can not be used to ignore the match.
552 552 
  *
553 553 
  * @param fd        File descriptor which was scanned.
554 554 
  * @param virname   Virus name.
... ... 
@@ -657,7 +658,7 @@ extern void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback
657 657 
 /**
658 658 
  * @brief Archive meta matching callback function.
659 659 
  *
660 
- * May be used to blacklist archive/container samples based on archive metadata.
660 
+ * May be used to block archive/container samples based on archive metadata.
661 661 
  * Function is invoked multiple times per archive. Typically once per contained file.
662 662 
  *
663 663 
  * Note: Used by the --archive-verbose clamscan option. Overriding this will alter
... ... 
@@ -670,7 +671,7 @@ extern void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback
670 670 
  * @param is_encrypted      Boolean non-zero if the contained file is encrypted.
671 671 
  * @param filepos_container File index in container.
672 672 
  * @param context           Opaque application provided data.
673 
- * @return                  CL_VIRUS to blacklist
673 
+ * @return                  CL_VIRUS to block (alert on)
674 674 
  * @return                  CL_CLEAN to continue scanning
675 675 
  */
676 676 
 typedef cl_error_t (*clcb_meta)(const char *container_type, unsigned long fsize_container, const char *filename,
libclamav/crtmgr.c
History View file @ 0255f29
... ... 
@@ -61,13 +61,13 @@ void cli_crt_clear(cli_crt *x509)
61 61 
     mp_clear_multi(&x509->n, &x509->e, &x509->sig, NULL);
62 62 
 }
63 63
64 
-/* Look for an existing certificate in the trust store m.  This search allows
64 
+/* Look for an existing certificate in the trust store `m`.  This search allows
65 65 
  * the not_before / not_after / certSign / codeSign / timeSign fields to be
66 66 
  * more restrictive than the values associated with a cert in the trust store,
67 67 
  * but not less.  It's probably overkill to not do exact matching on those
68 68 
  * fields... TODO Is there a case where this is needed
69 69 
  *
70 
- * There are two ways that things get added to the whitelist - through the CRB
70 
+ * There are two ways that things get added to the trust list - through the CRB
71 71 
  * rules, and through embedded signatures / catalog files that we parse.  CRB
72 72 
  * rules don't currently allow the issuer and hashtype to be specified, so the
73 73 
  * code sets those to sentinel values (0xca repeating and CLI_HASHTYPE_ANY
... ... 
@@ -98,12 +98,12 @@ void cli_crt_clear(cli_crt *x509)
98 98 
  * hashtype fields.
99 99 
  *
100 100 
  */
101 
-cli_crt *crtmgr_whitelist_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only)
101 
+cli_crt *crtmgr_trust_list_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only)
102 102 
 {
103 103 
     cli_crt *i;
104 104 
     for (i = m->crts; i; i = i->next) {
105 105
106 
-        if (i->isBlacklisted) {
106 
+        if (i->isBlocked) {
107 107 
             continue;
108 108 
         }
109 109
... ... 
@@ -145,29 +145,29 @@ cli_crt *crtmgr_whitelist_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only)
145 145 
     return NULL;
146 146 
 }
147 147
148 
-cli_crt *crtmgr_blacklist_lookup(crtmgr *m, cli_crt *x509)
148 
+cli_crt *crtmgr_block_list_lookup(crtmgr *m, cli_crt *x509)
149 149 
 {
150 150 
     cli_crt *i;
151 151 
     for (i = m->crts; i; i = i->next) {
152 152 
         /* The CRB rules are based on subject, serial, and public key,
153 
-         * so do blacklist lookups based on those fields. The serial
154 
-         * number field can also be blank, which effectively blacklists
153 
+         * so do block list lookups based on those fields. The serial
154 
+         * number field can also be blank, which effectively blocks
155 155 
          * all possible serial numbers using the specified subject and
156 156 
          * public key. Sometimes when people go to have their cert
157 157 
          * renewed, they'll opt to have the subject and public key be
158 158 
          * the same, but the CA must issue a new serial number for the
159 
-         * new cert. A blank issuer in a CRB rule allows blacklisting
159 
+         * new cert. A blank issuer in a CRB rule allows blocking
160 160 
          * all of these at once. */
161 161
162 162 
         // TODO the rule format specifies CodeSign / TimeSign / CertSign
163 163 
         // which we could also match on, but we just ignore those fields
164 
-        // for blacklist certs for now
164 
+        // for blocked certs for now
165 165
166 166 
         // TODO the rule format allows the exponent to be specified as well,
167 167 
         // but that gets ignored when CRB rules are parsed (and set to a fixed
168 168 
         // value), so ignore that field when looking at certs
169 169
170 
-        if (!i->isBlacklisted ||
170 
+        if (!i->isBlocked ||
171 171 
             memcmp(i->subject, x509->subject, sizeof(i->subject)) ||
172 172 
             mp_cmp(&x509->n, &i->n)) {
173 173 
             continue;
... ... 
@@ -184,13 +184,13 @@ cli_crt *crtmgr_blacklist_lookup(crtmgr *m, cli_crt *x509)
184 184 
 }
185 185
186 186 
 /* Determine whether x509 already exists in m. The fields compared depend on
187 
- * whether x509 is a blacklist entry or a trusted certificate */
187 
+ * whether x509 is a block entry or a trusted certificate */
188 188 
 cli_crt *crtmgr_lookup(crtmgr *m, cli_crt *x509)
189 189 
 {
190 
-    if (x509->isBlacklisted) {
191 
-        return crtmgr_blacklist_lookup(m, x509);
190 
+    if (x509->isBlocked) {
191 
+        return crtmgr_block_list_lookup(m, x509);
192 192 
     } else {
193 
-        return crtmgr_whitelist_lookup(m, x509, 0);
193 
+        return crtmgr_trust_list_lookup(m, x509, 0);
194 194 
     }
195 195 
 }
196 196
... ... 
@@ -199,13 +199,13 @@ int crtmgr_add(crtmgr *m, cli_crt *x509)
199 199 
     cli_crt *i;
200 200 
     int ret = 0;
201 201
202 
-    if (x509->isBlacklisted) {
203 
-        if (crtmgr_blacklist_lookup(m, x509)) {
204 
-            cli_dbgmsg("crtmgr_add: duplicate blacklist entry detected - not adding\n");
202 
+    if (x509->isBlocked) {
203 
+        if (crtmgr_block_list_lookup(m, x509)) {
204 
+            cli_dbgmsg("crtmgr_add: duplicate blocked certificate detected - not adding\n");
205 205 
             return 0;
206 206 
         }
207 207 
     } else {
208 
-        if (crtmgr_whitelist_lookup(m, x509, 0)) {
208 
+        if (crtmgr_trust_list_lookup(m, x509, 0)) {
209 209 
             cli_dbgmsg("crtmgr_add: duplicate trusted certificate detected - not adding\n");
210 210 
             return 0;
211 211 
         }
... ... 
@@ -246,7 +246,7 @@ int crtmgr_add(crtmgr *m, cli_crt *x509)
246 246 
     i->certSign      = x509->certSign;
247 247 
     i->codeSign      = x509->codeSign;
248 248 
     i->timeSign      = x509->timeSign;
249 
-    i->isBlacklisted = x509->isBlacklisted;
249 
+    i->isBlocked     = x509->isBlocked;
250 250 
     i->next          = m->crts;
251 251 
     i->prev          = NULL;
252 252 
     if (m->crts)
... ... 
@@ -472,17 +472,17 @@ cli_crt *crtmgr_verify_crt(crtmgr *m, cli_crt *x509)
472 472 
     // Loop through each of the certificates in our trust store and see whether
473 473 
     // x509 is signed with it.  If it is, it's trusted
474 474
475 
-    // TODO Technically we should loop through all of the blacklisted certs
475 
+    // TODO Technically we should loop through all of the blocked certs
476 476 
     // first to see whether one of those is used to sign x509.  This case
477 
-    // will get handled if the blacklisted certificate is embedded, since we
478 
-    // will call crtmgr_verify_crt on it and match against the blacklist entry
477 
+    // will get handled if the blocked certificate is embedded, since we
478 
+    // will call crtmgr_verify_crt on it and match against the block entry
479 479 
     // that way, but the cert doesn't HAVE to be embedded.  This case seems
480 
-    // unlikely enough to ignore, though.  If we ever want to blacklist a
480 
+    // unlikely enough to ignore, though.  If we ever want to block a
481 481 
     // stolen CA cert or something, then we will need to revisit this.
482 482
483 483 
     for (i = m->crts; i; i = i->next) {
484 484 
         if (i->certSign &&
485 
-            !i->isBlacklisted &&
485 
+            !i->isBlocked &&
486 486 
             !memcmp(i->subject, x509->issuer, sizeof(i->subject)) &&
487 487 
             !crtmgr_rsa_verify(i, &x509->sig, x509->hashtype, x509->tbshash)) {
488 488 
             int curscore;
... ... 
@@ -550,7 +550,7 @@ int crtmgr_add_roots(struct cl_engine *engine, crtmgr *m, int exclude_bl_crts)
550 550 
      */
551 551 
     if (m != &(engine->cmgr)) {
552 552 
         for (crt = engine->cmgr.crts; crt != NULL; crt = crt->next) {
553 
-            if (exclude_bl_crts && crt->isBlacklisted) {
553 
+            if (exclude_bl_crts && crt->isBlocked) {
554 554 
                 continue;
555 555 
             }
556 556 
             if (crtmgr_add(m, crt)) {
libclamav/crtmgr.h
History View file @ 0255f29
... ... 
@@ -72,7 +72,7 @@ typedef struct cli_crt_t {
72 72 
     int certSign;
73 73 
     int codeSign;
74 74 
     int timeSign;
75 
-    int isBlacklisted;
75 
+    int isBlocked;
76 76 
     struct cli_crt_t *prev;
77 77 
     struct cli_crt_t *next;
78 78 
 } cli_crt;
... ... 
@@ -88,8 +88,8 @@ void crtmgr_init(crtmgr *m);
88 88 
 void crtmgr_free(crtmgr *m);
89 89 
 int crtmgr_add(crtmgr *m, cli_crt *x509);
90 90 
 cli_crt *crtmgr_lookup(crtmgr *m, cli_crt *x509);
91 
-cli_crt *crtmgr_blacklist_lookup(crtmgr *m, cli_crt *x509);
92 
-cli_crt *crtmgr_whitelist_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only);
91 
+cli_crt *crtmgr_block_list_lookup(crtmgr *m, cli_crt *x509);
92 
+cli_crt *crtmgr_trust_list_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only);
93 93 
 void crtmgr_del(crtmgr *m, cli_crt *x509);
94 94 
 cli_crt *crtmgr_verify_crt(crtmgr *m, cli_crt *x509);
95 95 
 cli_crt *crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const uint8_t *serial, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash, cli_vrfy_type vrfytype);
libclamav/matcher.c
History View file @ 0255f29
... ... 
@@ -1015,7 +1015,7 @@ cl_error_t cli_scan_fmap(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct
1015 1015
1016 1016 
     /* If it's a PE, check the Authenticode header.  This would be more
1017 1017 
      * appropriate in cli_scanpe, but scanraw->cli_scan_fmap gets
1018 
-     * called first for PEs, and we want to determine the whitelist/blacklist
1018 
+     * called first for PEs, and we want to determine the trust/block
1019 1019 
      * status early on so we can skip things like embedded PE extraction
1020 1020 
      * (which is broken for signed binaries within signed binaries).
1021 1021 
      *
... ... 
@@ -1352,7 +1352,7 @@ cl_error_t cli_matchmeta(cli_ctx *ctx, const char *fname, size_t fsizec, size_t
1352 1352
1353 1353 
     if (ctx->engine && ctx->engine->cb_meta)
1354 1354 
         if (ctx->engine->cb_meta(cli_ftname(cli_get_container(ctx, -1)), fsizec, fname, fsizer, encrypted, filepos, ctx->cb_ctx) == CL_VIRUS) {
1355 
-            cli_dbgmsg("inner file blacklisted by callback: %s\n", fname);
1355 
+            cli_dbgmsg("inner file blocked by callback: %s\n", fname);
1356 1356
1357 1357 
             ret = cli_append_virus(ctx, "Detected.By.Callback");
1358 1358 
             viruses_found++;
libclamav/others.h
History View file @ 0255f29
... ... 
@@ -312,15 +312,15 @@ struct cl_engine {
312 312 
     struct cli_matcher *hm_mdb;
313 313 
     /* hash matcher for MD5 sigs for PE import tables */
314 314 
     struct cli_matcher *hm_imp;
315 
-    /* hash matcher for whitelist db */
315 
+    /* hash matcher for allow list db */
316 316 
     struct cli_matcher *hm_fp;
317 317
318 318 
     /* Container metadata */
319 319 
     struct cli_cdb *cdb;
320 320
321 321 
     /* Phishing .pdb and .wdb databases*/
322 
-    struct regex_matcher *whitelist_matcher;
323 
-    struct regex_matcher *domainlist_matcher;
322 
+    struct regex_matcher *allow_list_matcher;
323 
+    struct regex_matcher *domain_list_matcher;
324 324 
     struct phishcheck *phishcheck;
325 325
326 326 
     /* Dynamic configuration */
... ... 
@@ -639,8 +639,8 @@ static inline void cli_writeint32(void *offset, uint32_t value)
639 639 
 /**
640 640 
  * @brief Append an alert.
641 641 
  *
642 
- * An FP-check will verify that the file is not whitelisted.
643 
- * The whitelist check does not happen before the scan because file whitelisting
642 
+ * An FP-check will verify that the file is not allowed.
643 
+ * The allow list check does not happen before the scan because allowing files
644 644 
  * is so infrequent that such action would be detrimental to performance.
645 645 
  *
646 646 
  * TODO: Replace implementation with severity scale, and severity threshold
libclamav/pe.c
History View file @ 0255f29
... ... 
@@ -5537,12 +5537,12 @@ static int sort_sects(const void *first, const void *second)
5537 5537 
  *
5538 5538 
  * If peinfo is NULL, one will be created internally and used
5539 5539 
  *
5540 
- * CL_VERIFIED will be returned if the file was whitelisted based on its
5541 
- * signature.  CL_VIRUS will be returned if the file was blacklisted based on
5540 
+ * CL_VERIFIED will be returned if the file was trusted based on its
5541 
+ * signature.  CL_VIRUS will be returned if the file was blocked based on
5542 5542 
  * its signature.  Otherwise, a cl_error_t error value will be returned.
5543 5543 
  *
5544 5544 
  * If CL_VIRUS is returned, cli_append_virus will get called, adding the
5545 
- * name associated with the blacklist CRB rules to the list of found viruses.*/
5545 
+ * name associated with the block list CRB rules to the list of found viruses.*/
5546 5546 
 cl_error_t cli_check_auth_header(cli_ctx *ctx, struct cli_exe_info *peinfo)
5547 5547 
 {
5548 5548 
     size_t at;
... ... 
@@ -5678,7 +5678,7 @@ cl_error_t cli_check_auth_header(cli_ctx *ctx, struct cli_exe_info *peinfo)
5678 5678 
                  * bytes in the security directory) is now opt-in via a registry
5679 5679 
                  * key.  Given that most machines will treat these binaries as
5680 5680 
                  * valid, we'll still parse the signature and just trust that
5681 
-                 * our whitelist signatures are tailored enough to where any
5681 
+                 * our trust signatures are tailored enough to where any
5682 5682 
                  * instances of this are reasonable (for instance, I saw one
5683 5683 
                  * binary that appeared to use this to embed a license key.) */
5684 5684 
             cli_dbgmsg("cli_check_auth_header: MS13-098 violation detected, but continuing on to verify certificate\n");
... ... 
@@ -5693,7 +5693,7 @@ cl_error_t cli_check_auth_header(cli_ctx *ctx, struct cli_exe_info *peinfo)
5693 5693 
             // We validated the embedded signature.  Hooray!
5694 5694 
             goto finish;
5695 5695 
         } else if (CL_VIRUS == ret) {
5696 
-            // A blacklist rule hit - don't continue on to check hm_fp for a match
5696 
+            // A block list rule hit - don't continue on to check hm_fp for a match
5697 5697 
             goto finish;
5698 5698 
         }
5699 5699
... ... 
@@ -5740,7 +5740,7 @@ cl_error_t cli_check_auth_header(cli_ctx *ctx, struct cli_exe_info *peinfo)
5740 5740 
     hashctx = NULL;
5741 5741
5742 5742 
     if (cli_hm_scan(authsha1, 2, NULL, ctx->engine->hm_fp, CLI_HASH_SHA1) == CL_VIRUS) {
5743 
-        cli_dbgmsg("cli_check_auth_header: PE file whitelisted by catalog file\n");
5743 
+        cli_dbgmsg("cli_check_auth_header: PE file trusted by catalog file\n");
5744 5744 
         ret = CL_CLEAN;
5745 5745 
         goto finish;
5746 5746 
     }
libclamav/phish_allow_list.c
History View file @ 0255f29
5747 5747 
new file mode 100644
... ... 
@@ -0,0 +1,80 @@
0 
+/*
1 
+ *  Phishing module: allow list implementation.
2 
+ *
3 
+ *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
4 
+ *  Copyright (C) 2007-2013 Sourcefire, Inc.
5 
+ *
6 
+ *  Authors: Török Edvin
7 
+ *
8 
+ *  This program is free software; you can redistribute it and/or modify
9 
+ *  it under the terms of the GNU General Public License version 2 as
10 
+ *  published by the Free Software Foundation.
11 
+ *
12 
+ *  This program is distributed in the hope that it will be useful,
13 
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14 
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 
+ *  GNU General Public License for more details.
16 
+ *
17 
+ *  You should have received a copy of the GNU General Public License
18 
+ *  along with this program; if not, write to the Free Software
19 
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
20 
+ *  MA 02110-1301, USA.
21 
+ */
22 
+
23 
+#if HAVE_CONFIG_H
24 
+#include "clamav-config.h"
25 
+#endif
26 
+
27 
+#ifdef CL_THREAD_SAFE
28 
+#ifndef _REENTRANT
29 
+#define _REENTRANT
30 
+#endif
31 
+#endif
32 
+
33 
+#include <stdio.h>
34 
+#include <string.h>
35 
+#include <ctype.h>
36 
+
37 
+#include "clamav.h"
38 
+#include "others.h"
39 
+#include "phish_allow_list.h"
40 
+#include "regex_list.h"
41 
+
42 
+#include "mpool.h"
43 
+
44 
+cl_error_t allow_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly)
45 
+{
46 
+    const char* info; /*unused*/
47 
+    cli_dbgmsg("Phishing: looking up in allow list: %s:%s; host-only:%d\n", real_url, display_url, hostOnly);
48 
+    return engine->allow_list_matcher ? regex_list_match(engine->allow_list_matcher, real_url, display_url, NULL, hostOnly, &info, 1) : 0;
49 
+}
50 
+
51 
+cl_error_t init_allow_list(struct cl_engine* engine)
52 
+{
53 
+    if (engine) {
54 
+        engine->allow_list_matcher = (struct regex_matcher*)MPOOL_MALLOC(engine->mempool, sizeof(struct regex_matcher));
55 
+        if (!engine->allow_list_matcher) {
56 
+            cli_errmsg("Phish_allow_list: Unable to allocate memory for allow_list_match\n");
57 
+            return CL_EMEM;
58 
+        }
59 
+#ifdef USE_MPOOL
60 
+        ((struct regex_matcher*)(engine->allow_list_matcher))->mempool = engine->mempool;
61 
+#endif
62 
+        return init_regex_list(engine->allow_list_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
63 
+    } else
64 
+        return CL_ENULLARG;
65 
+}
66 
+
67 
+int is_allow_list_ok(const struct cl_engine* engine)
68 
+{
69 
+    return (engine && engine->allow_list_matcher) ? is_regex_ok(engine->allow_list_matcher) : 1;
70 
+}
71 
+
72 
+void allow_list_done(struct cl_engine* engine)
73 
+{
74 
+    if (engine && engine->allow_list_matcher) {
75 
+        regex_list_done(engine->allow_list_matcher);
76 
+        MPOOL_FREE(engine->mempool, engine->allow_list_matcher);
77 
+        engine->allow_list_matcher = NULL;
78 
+    }
79 
+}
libclamav/phish_allow_list.h
History View file @ 0255f29
0 80 
new file mode 100644
... ... 
@@ -0,0 +1,35 @@
0 
+/*
1 
+ *  Phishing module: Allow list implementation.
2 
+ *
3 
+ *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
4 
+ *  Copyright (C) 2007-2013 Sourcefire, Inc.
5 
+ *
6 
+ *  Authors: Török Edvin
7 
+ *
8 
+ *  This program is free software; you can redistribute it and/or modify
9 
+ *  it under the terms of the GNU General Public License version 2 as
10 
+ *  published by the Free Software Foundation.
11 
+ *
12 
+ *  This program is distributed in the hope that it will be useful,
13 
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14 
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 
+ *  GNU General Public License for more details.
16 
+ *
17 
+ *  You should have received a copy of the GNU General Public License
18 
+ *  along with this program; if not, write to the Free Software
19 
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
20 
+ *  MA 02110-1301, USA.
21 
+ */
22 
+
23 
+#ifndef _PHISH_ALLOW_LIST_H
24 
+#define _PHISH_ALLOW_LIST_H
25 
+
26 
+#include "clamav.h"
27 
+
28 
+cl_error_t init_allow_list(struct cl_engine* engine);
29 
+void allow_list_done(struct cl_engine* engine);
30 
+void allow_list_cleanup(const struct cl_engine* engine);
31 
+int is_allow_list_ok(const struct cl_engine* engine);
32 
+cl_error_t allow_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly);
33 
+
34 
+#endif
libclamav/phish_domaincheck_db.c
History View file @ 0255f29
... ... 
@@ -41,38 +41,38 @@
41 41 
 #include "phish_domaincheck_db.h"
42 42 
 #include "regex_list.h"
43 43
44 
-int domainlist_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly)
44 
+int domain_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly)
45 45 
 {
46 46 
     const char* info;
47 
-    int rc = engine->domainlist_matcher ? regex_list_match(engine->domainlist_matcher, real_url, display_url, hostOnly ? pre_fixup : NULL, hostOnly, &info, 0) : 0;
47 
+    int rc = engine->domain_list_matcher ? regex_list_match(engine->domain_list_matcher, real_url, display_url, hostOnly ? pre_fixup : NULL, hostOnly, &info, 0) : 0;
48 48 
     return rc;
49 49 
 }
50 50
51 
-int init_domainlist(struct cl_engine* engine)
51 
+int init_domain_list(struct cl_engine* engine)
52 52 
 {
53 53 
     if (engine) {
54 
-        engine->domainlist_matcher = (struct regex_matcher*)cli_malloc(sizeof(struct regex_matcher));
55 
-        if (!engine->domainlist_matcher) {
56 
-            cli_errmsg("Phishcheck: Unable to allocate memory for init_domainlist\n");
54 
+        engine->domain_list_matcher = (struct regex_matcher*)cli_malloc(sizeof(struct regex_matcher));
55 
+        if (!engine->domain_list_matcher) {
56 
+            cli_errmsg("Phishcheck: Unable to allocate memory for init_domain_list\n");
57 57 
             return CL_EMEM;
58 58 
         }
59 59 
 #ifdef USE_MPOOL
60 
-        ((struct regex_matcher*)engine->domainlist_matcher)->mempool = engine->mempool;
60 
+        ((struct regex_matcher*)engine->domain_list_matcher)->mempool = engine->mempool;
61 61 
 #endif
62 
-        return init_regex_list(engine->domainlist_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
62 
+        return init_regex_list(engine->domain_list_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
63 63 
     } else
64 64 
         return CL_ENULLARG;
65 65 
 }
66 66
67 
-int is_domainlist_ok(const struct cl_engine* engine)
67 
+int is_domain_list_ok(const struct cl_engine* engine)
68 68 
 {
69 
-    return (engine && engine->domainlist_matcher) ? is_regex_ok(engine->domainlist_matcher) : 1;
69 
+    return (engine && engine->domain_list_matcher) ? is_regex_ok(engine->domain_list_matcher) : 1;
70 70 
 }
71 71
72 
-void domainlist_done(struct cl_engine* engine)
72 
+void domain_list_done(struct cl_engine* engine)
73 73 
 {
74 
-    if (engine && engine->domainlist_matcher) {
75 
-        regex_list_done(engine->domainlist_matcher);
76 
-        free(engine->domainlist_matcher);
74 
+    if (engine && engine->domain_list_matcher) {
75 
+        regex_list_done(engine->domain_list_matcher);
76 
+        free(engine->domain_list_matcher);
77 77 
     }
78 78 
 }
libclamav/phish_domaincheck_db.h
History View file @ 0255f29
... ... 
@@ -25,10 +25,10 @@
25 25 
 #define _PHISH_DOMAINCHECK_DB_H
26 26 
 #include "clamav.h"
27 27
28 
-int init_domainlist(struct cl_engine* engine);
29 
-void domainlist_done(struct cl_engine* engine);
30 
-void domainlist_cleanup(const struct cl_engine* engine);
31 
-int is_domainlist_ok(const struct cl_engine* engine);
32 
-int domainlist_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly);
28 
+int init_domain_list(struct cl_engine* engine);
29 
+void domain_list_done(struct cl_engine* engine);
30 
+void domain_list_cleanup(const struct cl_engine* engine);
31 
+int is_domain_list_ok(const struct cl_engine* engine);
32 
+int domain_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly);
33 33
34 34 
 #endif
libclamav/phish_whitelist.c
History View file @ 0255f29
35 35 
deleted file mode 100644
... ... 
@@ -1,80 +0,0 @@
1 
-/*
2 
- *  Phishing module: whitelist implementation.
3 
- *
4 
- *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
5 
- *  Copyright (C) 2007-2013 Sourcefire, Inc.
6 
- *
7 
- *  Authors: Török Edvin
8 
- *
9 
- *  This program is free software; you can redistribute it and/or modify
10 
- *  it under the terms of the GNU General Public License version 2 as
11 
- *  published by the Free Software Foundation.
12 
- *
13 
- *  This program is distributed in the hope that it will be useful,
14 
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15 
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 
- *  GNU General Public License for more details.
17 
- *
18 
- *  You should have received a copy of the GNU General Public License
19 
- *  along with this program; if not, write to the Free Software
20 
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21 
- *  MA 02110-1301, USA.
22 
- */
23 
-
24 
-#if HAVE_CONFIG_H
25 
-#include "clamav-config.h"
26 
-#endif
27 
-
28 
-#ifdef CL_THREAD_SAFE
29 
-#ifndef _REENTRANT
30 
-#define _REENTRANT
31 
-#endif
32 
-#endif
33 
-
34 
-#include <stdio.h>
35 
-#include <string.h>
36 
-#include <ctype.h>
37 
-
38 
-#include "clamav.h"
39 
-#include "others.h"
40 
-#include "phish_whitelist.h"
41 
-#include "regex_list.h"
42 
-
43 
-#include "mpool.h"
44 
-
45 
-cl_error_t whitelist_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly)
46 
-{
47 
-    const char* info; /*unused*/
48 
-    cli_dbgmsg("Phishing: looking up in whitelist: %s:%s; host-only:%d\n", real_url, display_url, hostOnly);
49 
-    return engine->whitelist_matcher ? regex_list_match(engine->whitelist_matcher, real_url, display_url, NULL, hostOnly, &info, 1) : 0;
50 
-}
51 
-
52 
-cl_error_t init_whitelist(struct cl_engine* engine)
53 
-{
54 
-    if (engine) {
55 
-        engine->whitelist_matcher = (struct regex_matcher*)MPOOL_MALLOC(engine->mempool, sizeof(struct regex_matcher));
56 
-        if (!engine->whitelist_matcher) {
57 
-            cli_errmsg("Phish_whitelist: Unable to allocate memory for whitelist_match\n");
58 
-            return CL_EMEM;
59 
-        }
60 
-#ifdef USE_MPOOL
61 
-        ((struct regex_matcher*)(engine->whitelist_matcher))->mempool = engine->mempool;
62 
-#endif
63 
-        return init_regex_list(engine->whitelist_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
64 
-    } else
65 
-        return CL_ENULLARG;
66 
-}
67 
-
68 
-int is_whitelist_ok(const struct cl_engine* engine)
69 
-{
70 
-    return (engine && engine->whitelist_matcher) ? is_regex_ok(engine->whitelist_matcher) : 1;
71 
-}
72 
-
73 
-void whitelist_done(struct cl_engine* engine)
74 
-{
75 
-    if (engine && engine->whitelist_matcher) {
76 
-        regex_list_done(engine->whitelist_matcher);
77 
-        MPOOL_FREE(engine->mempool, engine->whitelist_matcher);
78 
-        engine->whitelist_matcher = NULL;
79 
-    }
80 
-}
libclamav/phish_whitelist.h
History View file @ 0255f29
81 1 
deleted file mode 100644
... ... 
@@ -1,35 +0,0 @@
1 
-/*
2 
- *  Phishing module: whitelist implementation.
3 
- *
4 
- *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
5 
- *  Copyright (C) 2007-2013 Sourcefire, Inc.
6 
- *
7 
- *  Authors: Török Edvin
8 
- *
9 
- *  This program is free software; you can redistribute it and/or modify
10 
- *  it under the terms of the GNU General Public License version 2 as
11 
- *  published by the Free Software Foundation.
12 
- *
13 
- *  This program is distributed in the hope that it will be useful,
14 
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15 
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 
- *  GNU General Public License for more details.
17 
- *
18 
- *  You should have received a copy of the GNU General Public License
19 
- *  along with this program; if not, write to the Free Software
20 
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21 
- *  MA 02110-1301, USA.
22 
- */
23 
-
24 
-#ifndef _PHISH_WHITELIST_H
25 
-#define _PHISH_WHITELIST_H
26 
-
27 
-#include "clamav.h"
28 
-
29 
-cl_error_t init_whitelist(struct cl_engine* engine);
30 
-void whitelist_done(struct cl_engine* engine);
31 
-void whitelist_cleanup(const struct cl_engine* engine);
32 
-int is_whitelist_ok(const struct cl_engine* engine);
33 
-cl_error_t whitelist_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly);
34 
-
35 
-#endif
libclamav/phishcheck.c
History View file @ 0255f29
... ... 
@@ -40,7 +40,7 @@
40 40 
 #include "htmlnorm.h"
41 41 
 #include "phishcheck.h"
42 42 
 #include "phish_domaincheck_db.h"
43 
-#include "phish_whitelist.h"
43 
+#include "phish_allow_list.h"
44 44 
 #include "regex_list.h"
45 45 
 #include "iana_tld.h"
46 46 
 #include "iana_cctld.h"
... ... 
@@ -82,25 +82,25 @@ Steps:
82 82 
 - convert hostname to lowercase
83 83 
 - normalize \ to /
84 84
85 
-3. Matched the urls against a _whitelist_:
86 
-a _realLink_, _displayedLink_ pair is matched against the _whitelist_.
87 
-the _whitelist_ is a list of pairs of realLink, displayedLink. Any of the elements of those pairs can be a _regex_.
88 
- if url *is found* in _whitelist_ --> *CLEAN*
85 
+3. Matched the urls against an _allow_list_:
86 
+a _realLink_, _displayedLink_ pair is matched against the _allow_list_.
87 
+the _allow_list_ is a list of pairs of realLink, displayedLink. Any of the elements of those pairs can be a _regex_.
88 
+ if url *is found* in _allow_list_ --> *CLEAN*
89 89
90 
-4. URL is looked up in the _domainlist_
91 
-The _domainlist_ is a list of pairs of realLink, displayedLink (any of which can be regex).
90 
+4. URL is looked up in the _domain_list_
91 
+The _domain_list_ is a list of pairs of realLink, displayedLink (any of which can be regex).
92 92 
 This is the list of domains we do phishing detection for (such as ebay,paypal,chase,....)
93 93 
 We can't decide to stop processing here or not, so we just set a flag.
94 94
95 
-Note(*!*): the flags are modified by the the domainlist checker. If domain is found, then the flags associated with it filter the default compile-time flags.
95 
+Note(*!*): the flags are modified by the the domain list checker. If domain is found, then the flags associated with it filter the default compile-time flags.
96 96
97 97 
 5. _Hostname_ is extracted from the _displayed URL_.
98 
-It is checked against the _whitelist_, and _domainlist_.
98 
+It is checked against the _allow_list_, and _domain_list_.
99 99
100 100 
 6. Now we know if we want to stop processing.
101 
-If we are only scanning domains in the _domainlist_ (default behaviour), and the url/domain
101 
+If we are only scanning domains in the _domain_list_ (default behaviour), and the url/domain
102 102 
 isn't found in it, we return (and mark url as not_list/clean).
103 
-If we scan all domains, then the domainlist isn't even checked.
103 
+If we scan all domains, then the domain list isn't even checked.
104 104
105 105 
 7. URL cloak check.
106 106 
 check for %00, and hex-encoded IPs in URL.
... ... 
@@ -127,7 +127,7 @@ if not -> clean
127 127
128 128 
 16. Do DNS lookups/reverse lookups. Disabled now (too much load/too many lookups). *
129 129
130 
-For the Whitelist(.wdb)/Domainlist(.pdb) format see regex_list.c (search for Flags)
130 
+For the AllowList(.wdb)/DomainList(.pdb) format see regex_list.c (search for Flags)
131 131 
  *
132 132 
  */
133 133
... ... 
@@ -727,7 +727,7 @@ cl_error_t phishingScan(cli_ctx* ctx, tag_arguments_t* hrefs)
727 727 
     /* TODO: get_host and then apply regex, etc. */
728 728 
     int i;
729 729 
     struct phishcheck* pchk = (struct phishcheck*)ctx->engine->phishcheck;
730 
-    /* check for status of whitelist fatal error, etc. */
730 
+    /* check for status of allow list fatal error, etc. */
731 731 
     if (!pchk || pchk->is_disabled) {
732 732 
         goto done;
733 733 
     }
... ... 
@@ -791,7 +791,7 @@ cl_error_t phishingScan(cli_ctx* ctx, tag_arguments_t* hrefs)
791 791 
                 status = cli_append_possibly_unwanted(ctx, "Heuristics.Safebrowsing.Suspected-malware_safebrowsing.clamav.net");
792 792 
                 break;
793 793 
             case CL_PHISH_HASH1:
794 
-                status = cli_append_possibly_unwanted(ctx, "Heuristics.Phishing.URL.Blacklisted");
794 
+                status = cli_append_possibly_unwanted(ctx, "Heuristics.Phishing.URL.Blocked");
795 795 
                 break;
796 796 
             case CL_PHISH_HASH2:
797 797 
                 status = cli_append_possibly_unwanted(ctx, "Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net");
... ... 
@@ -863,8 +863,8 @@ void phishing_done(struct cl_engine* engine)
863 863 
     if (pchk && !pchk->is_disabled) {
864 864 
         free_regex(&pchk->preg_numeric);
865 865 
     }
866 
-    whitelist_done(engine);
867 
-    domainlist_done(engine);
866 
+    allow_list_done(engine);
867 
+    domain_list_done(engine);
868 868 
     if (pchk) {
869 869 
         cli_dbgmsg("Freeing phishcheck struct\n");
870 870 
         MPOOL_FREE(engine->mempool, pchk);
... ... 
@@ -1141,9 +1141,9 @@ static enum phish_status phishy_map(int phishy, enum phish_status fallback)
1141 1141 
         return fallback;
1142 1142 
 }
1143 1143
1144 
-static cl_error_t whitelist_check(const struct cl_engine* engine, struct url_check* urls, int hostOnly)
1144 
+static cl_error_t allow_list_check(const struct cl_engine* engine, struct url_check* urls, int hostOnly)
1145 1145 
 {
1146 
-    return whitelist_match(engine, urls->realLink.data, urls->displayLink.data, hostOnly);
1146 
+    return allow_list_match(engine, urls->realLink.data, urls->displayLink.data, hostOnly);
1147 1147 
 }
1148 1148
1149 1149 
 static cl_error_t hash_match(const struct regex_matcher* rlist,
... ... 
@@ -1204,7 +1204,7 @@ static cl_error_t hash_match(const struct regex_matcher* rlist,
1204 1204 
             cli_dbgmsg("This hash matched: %s\n", h);
1205 1205 
             switch (*virname) {
1206 1206 
                 case 'W':
1207 
-                    cli_dbgmsg("Hash is whitelisted, skipping\n");
1207 
+                    cli_dbgmsg("Hash is allowed, skipping\n");
1208 1208 
                     break;
1209 1209 
                 case '1':
1210 1210 
                     *phishing_verdict = CL_PHISH_HASH1;
... ... 
@@ -1479,7 +1479,7 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1479 1479 
         goto done;
1480 1480 
     }
1481 1481
1482 
-    if (CL_SUCCESS != (status = url_hash_match(ctx->engine->domainlist_matcher,
1482 
+    if (CL_SUCCESS != (status = url_hash_match(ctx->engine->domain_list_matcher,
1483 1483 
                                                urls->realLink.data,
1484 1484 
                                                strlen(urls->realLink.data),
1485 1485 
                                                &phishing_verdict))) {
... ... 
@@ -1523,11 +1523,11 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1523 1523 
     }
1524 1524
1525 1525 
     /*
1526 
-     * Whitelist X-type WDB signatures:  X:RealURL:DisplayedURL
1526 
+     * AllowList X-type WDB signatures:  X:RealURL:DisplayedURL
1527 1527 
      * Eg:
1528 1528 
      *      X:.+\.benign\.com([/?].*)?:.+\.benign\.de
1529 1529 
      */
1530 
-    if (whitelist_check(ctx->engine, urls, 0)) { /* if url is whitelisted don't perform further checks */
1530 
+    if (allow_list_check(ctx->engine, urls, 0)) { /* if url is allowed don't perform further checks */
1531 1531 
         phishing_verdict = CL_PHISH_CLEAN;
1532 1532 
         goto done;
1533 1533 
     }
... ... 
@@ -1537,7 +1537,7 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1537 1537 
      * Eg:
1538 1538 
      *      R:.+\.malicious\.net([/?].*)?:.+\.benign\.com
1539 1539 
      */
1540 
-    /* Provide copies of the oirinal URL's, because domainlist_match() may modify the buffer,
1540 
+    /* Provide copies of the oirinal URL's, because domain_list_match() may modify the buffer,
1541 1541 
        and we don't want that to happen in this case. */
1542 1542 
     realData = cli_strdup(urls->realLink.data);
1543 1543 
     if (!realData) {
... ... 
@@ -1551,7 +1551,7 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1551 1551 
         phishing_verdict = CL_PHISH_CLEAN;
1552 1552 
         goto done;
1553 1553 
     }
1554 
-    if (domainlist_match(ctx->engine, realData, displayData, &urls->pre_fixup, 0)) {
1554 
+    if (domain_list_match(ctx->engine, realData, displayData, &urls->pre_fixup, 0)) {
1555 1555 
         phishy |= DOMAIN_LISTED;
1556 1556 
     }
1557 1557
... ... 
@@ -1576,11 +1576,11 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1576 1576 
     }
1577 1577
1578 1578 
     /*
1579 
-     * Whitelist M-type WDB signatures: M:RealHostname:DisplayedHostname
1579 
+     * Allow List M-type WDB signatures: M:RealHostname:DisplayedHostname
1580 1580 
      * Eg:
1581 1581 
      *      M:email.isbenign.com:benign.com
1582 1582 
      */
1583 
-    if (whitelist_check(ctx->engine, &host_url, 1)) {
1583 
+    if (allow_list_check(ctx->engine, &host_url, 1)) {
1584 1584 
         phishing_verdict = CL_PHISH_CLEAN;
1585 1585 
         goto done;
1586 1586 
     }
... ... 
@@ -1590,14 +1590,14 @@ static enum phish_status phishingCheck(cli_ctx* ctx, struct url_check* urls)
1590 1590 
      * Eg:
1591 1591 
      *      H:malicious.com
1592 1592 
      */
1593 
-    if (domainlist_match(ctx->engine, host_url.displayLink.data, host_url.realLink.data, &urls->pre_fixup, 1)) {
1593 
+    if (domain_list_match(ctx->engine, host_url.displayLink.data, host_url.realLink.data, &urls->pre_fixup, 1)) {
1594 1594 
         phishy |= DOMAIN_LISTED;
1595 1595 
     } else {
1596 1596 
         urls->flags &= urls->always_check_flags;
1597 1597 
         /* don't return, we may need to check for ssl/cloaking */
1598 1598 
     }
1599 1599
1600 
-    /* link type filtering must occur after last domainlist_match */
1600 
+    /* link type filtering must occur after last domain_list_match */
1601 1601 
     if (urls->link_type & LINKTYPE_IMAGE && !(urls->flags & CHECK_IMG_URL)) {
1602 1602 
         /* its listed, but this link type is filtered */
1603 1603 
         phishing_verdict = CL_PHISH_CLEAN;
... ... 
@@ -1675,7 +1675,7 @@ static const char* phishing_ret_toString(enum phish_status phishing_verdict)
1675 1675 
         case CL_PHISH_HASH0:
1676 1676 
         case CL_PHISH_HASH1:
1677 1677 
         case CL_PHISH_HASH2:
1678 
-            return "Blacklisted";
1678 
+            return "Blocked";
1679 1679 
         default:
1680 1680 
             return "Unknown return code";
1681 1681 
     }
libclamav/readdb.c
History View file @ 0255f29
... ... 
@@ -68,7 +68,7 @@
68 68 
 #include "asn1.h"
69 69
70 70 
 #include "phishcheck.h"
71 
-#include "phish_whitelist.h"
71 
+#include "phish_allow_list.h"
72 72 
 #include "phish_domaincheck_db.h"
73 73 
 #include "regex_list.h"
74 74 
 #include "hashtab.h"
... ... 
@@ -1207,13 +1207,13 @@ static int cli_loadwdb(FILE *fs, struct cl_engine *engine, unsigned int options,
1207 1207 
     if (!(engine->dconf->phishing & PHISHING_CONF_ENGINE))
1208 1208 
         return CL_SUCCESS;
1209 1209
1210 
-    if (!engine->whitelist_matcher) {
1211 
-        if (CL_SUCCESS != (ret = init_whitelist(engine))) {
1210 
+    if (!engine->allow_list_matcher) {
1211 
+        if (CL_SUCCESS != (ret = init_allow_list(engine))) {
1212 1212 
             return ret;
1213 1213 
         }
1214 1214 
     }
1215 1215
1216 
-    if (CL_SUCCESS != (ret = load_regex_matcher(engine, engine->whitelist_matcher, fs, NULL, options, 1, dbio, engine->dconf->other & OTHER_CONF_PREFILTERING))) {
1216 
+    if (CL_SUCCESS != (ret = load_regex_matcher(engine, engine->allow_list_matcher, fs, NULL, options, 1, dbio, engine->dconf->other & OTHER_CONF_PREFILTERING))) {
1217 1217 
         return ret;
1218 1218 
     }
1219 1219
... ... 
@@ -1227,13 +1227,13 @@ static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int *signo,
1227 1227 
     if (!(engine->dconf->phishing & PHISHING_CONF_ENGINE))
1228 1228 
         return CL_SUCCESS;
1229 1229
1230 
-    if (!engine->domainlist_matcher) {
1231 
-        if (CL_SUCCESS != (ret = init_domainlist(engine))) {
1230 
+    if (!engine->domain_list_matcher) {
1231 
+        if (CL_SUCCESS != (ret = init_domain_list(engine))) {
1232 1232 
             return ret;
1233 1233 
         }
1234 1234 
     }
1235 1235
1236 
-    if (CL_SUCCESS != (ret = load_regex_matcher(engine, engine->domainlist_matcher, fs, signo, options, 0, dbio, engine->dconf->other & OTHER_CONF_PREFILTERING))) {
1236 
+    if (CL_SUCCESS != (ret = load_regex_matcher(engine, engine->domain_list_matcher, fs, signo, options, 0, dbio, engine->dconf->other & OTHER_CONF_PREFILTERING))) {
1237 1237 
         return ret;
1238 1238 
     }
1239 1239
... ... 
@@ -1956,7 +1956,7 @@ static int cli_loadcbc(FILE *fs, struct cl_engine *engine, unsigned int *signo,
1956 1956 
     unsigned security_trust = 0;
1957 1957 
     unsigned i;
1958 1958
1959 
-    /* TODO: virusname have a common prefix, and whitelist by that */
1959 
+    /* TODO: virusname have a common prefix, and allow by that */
1960 1960 
     if ((rc = cli_initroots(engine, options)))
1961 1961 
         return rc;
1962 1962
... ... 
@@ -3000,10 +3000,10 @@ static int cli_loadcrt(FILE *fs, struct cl_engine *engine, struct cli_dbio *dbio
3000 3000
3001 3001 
         switch (tokens[1][0]) {
3002 3002 
             case '1':
3003 
-                ca.isBlacklisted = 0;
3003 
+                ca.isBlocked = 0;
3004 3004 
                 break;
3005 3005 
             case '0':
3006 
-                ca.isBlacklisted = 1;
3006 
+                ca.isBlocked = 1;
3007 3007 
                 break;
3008 3008 
             default:
3009 3009 
                 cli_errmsg("cli_loadcrt: line %u: Invalid trust specification. Expected 0 or 1\n", (unsigned int)line);
... ... 
@@ -4635,7 +4635,7 @@ static cl_error_t cli_loaddbdir(const char *dirname, struct cl_engine *engine, u
4635 4635
4636 4636 
         } else if (cli_strbcasestr(dent->d_name, ".crb")) {
4637 4637 
             /* .cat files cannot be loaded successfully unless there are .crb
4638 
-             * rules that whitelist the certs used to sign the catalog files.
4638 
+             * rules that trust the certs used to sign the catalog files.
4639 4639 
              * Therefore, we need to ensure the .crb rules are loaded prior */
4640 4640 
             load_priority = DB_LOAD_PRIORITY_CRB;
4641 4641
... ... 
@@ -5283,10 +5283,10 @@ cl_error_t cl_engine_compile(struct cl_engine *engine)
5283 5283 
     if (engine->hm_fp)
5284 5284 
         hm_flush(engine->hm_fp);
5285 5285
5286 
-    if ((ret = cli_build_regex_list(engine->whitelist_matcher))) {
5286 
+    if ((ret = cli_build_regex_list(engine->allow_list_matcher))) {
5287 5287 
         return ret;
5288 5288 
     }
5289 
-    if ((ret = cli_build_regex_list(engine->domainlist_matcher))) {
5289 
+    if ((ret = cli_build_regex_list(engine->domain_list_matcher))) {
5290 5290 
         return ret;
5291 5291 
     }
5292 5292 
     if (engine->ignored) {
... ... 
@@ -5395,12 +5395,12 @@ static int countsigs(const char *dbname, unsigned int options, unsigned int *sig
5395 5395 
             (*sigs)++;
5396 5396
5397 5397 
     } else if (cli_strbcasestr(dbname, ".wdb") || cli_strbcasestr(dbname, ".fp") || cli_strbcasestr(dbname, ".sfp") || cli_strbcasestr(dbname, ".ign") || cli_strbcasestr(dbname, ".ign2") || cli_strbcasestr(dbname, ".ftm") || cli_strbcasestr(dbname, ".cfg") || cli_strbcasestr(dbname, ".cat")) {
5398 
-        /* ignore whitelist/FP signatures and metadata files */
5398 
+        /* ignore allow list/FP signatures and metadata files */
5399 5399
5400 
-        // TODO .crb sigs can contain both whitelist and blacklist signatures.
5400 
+        // TODO .crb sigs can contain both allow/trust and block signatures.
5401 5401 
         // For now we will just include both in the count by not excluding this
5402 5402 
         // sig type here, but in the future we could extract just the number of
5403 
-        // blacklist rules manually so that the count is more accurate.
5403 
+        // block list rules manually so that the count is more accurate.
5404 5404
5405 5405 
         // NOTE: We implicitly ignore .info files because they aren't currently
5406 5406 
         // in the list of ones checked for by CLI_DBEXT
libclamav/regex_list.c
History View file @ 0255f29
... ... 
@@ -73,7 +73,7 @@ static cl_error_t add_static_pattern(struct regex_matcher *matcher, char *patter
73 73 
 static void fatal_error(struct regex_matcher *matcher)
74 74 
 {
75 75 
     regex_list_done(matcher);
76 
-    matcher->list_inited = -1; /* the phishing module will know we tried to load a whitelist, and failed, so it will disable itself too*/
76 
+    matcher->list_inited = -1; /* the phishing module will know we tried to load an allow list, and failed, so it will disable itself too*/
77 77 
 }
78 78
79 79 
 static inline char get_char_at_pos_with_skip(const struct pre_fixup_info *info, const char *buffer, size_t pos)
... ... 
@@ -140,7 +140,7 @@ static int validate_subdomain(const struct regex_list *regex, const struct pre_f
140 140 
  * @real_url - href target
141 141 
  * @display_url - <a> tag contents
142 142 
  * @hostOnly - if you want to match only the host part
143 
- * @is_whitelist - is this a lookup in whitelist?
143 
+ * @is_allow_list_lookup - is this a lookup in an allow list?
144 144 
  *
145 145 
  * @return - CL_SUCCESS - url doesn't match
146 146 
  *         - CL_VIRUS - url matches list
... ... 
@@ -148,7 +148,7 @@ static int validate_subdomain(const struct regex_list *regex, const struct pre_f
148 148 
  * Do not send NULL pointers to this function!!
149 149 
  *
150 150 
  */
151 
-cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const char *display_url, const struct pre_fixup_info *pre_fixup, int hostOnly, const char **info, int is_whitelist)
151 
+cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const char *display_url, const struct pre_fixup_info *pre_fixup, int hostOnly, const char **info, int is_allow_list_lookup)
152 152 
 {
153 153 
     char *orig_real_url = real_url;
154 154 
     struct regex_list *regex;
... ... 
@@ -174,7 +174,7 @@ cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const
174 174 
     if (display_url[0] == '.') display_url++;
175 175 
     real_len    = strlen(real_url);
176 176 
     display_len = strlen(display_url);
177 
-    buffer_len  = (hostOnly && !is_whitelist) ? real_len + 1 : real_len + display_len + 1 + 1;
177 
+    buffer_len  = (hostOnly && !is_allow_list_lookup) ? real_len + 1 : real_len + display_len + 1 + 1;
178 178 
     if (buffer_len < 3) {
179 179 
         /* too short, no match possible */
180 180 
         return CL_SUCCESS;
... ... 
@@ -186,13 +186,13 @@ cl_error_t regex_list_match(struct regex_matcher *matcher, char *real_url, const
186 186 
     }
187 187
188 188 
     strncpy(buffer, real_url, real_len);
189 
-    buffer[real_len] = (!is_whitelist && hostOnly) ? '/' : ':';
189 
+    buffer[real_len] = (!is_allow_list_lookup && hostOnly) ? '/' : ':';
190 190
191 191 
     /*
192 192 
      * For H-type PDB signatures, real_url is actually the DisplayedHostname.
193 193 
      * RealHostname is not used.
194 194 
      */
195 
-    if (!hostOnly || is_whitelist) {
195 
+    if (!hostOnly || is_allow_list_lookup) {
196 196 
         /* For all other PDB and WDB signatures concatenate Real:Displayed. */
197 197 
         strncpy(buffer + real_len + 1, display_url, display_len);
198 198 
     }
... ... 
@@ -392,7 +392,7 @@ static int add_hash(struct regex_matcher *matcher, char *pattern, const char fl,
392 392 
         cli_hashset_contains(&matcher->sha256_pfx_set, cli_readint32(pat->pattern)) &&
393 393 
         cli_bm_scanbuff(pat->pattern, 32, &vname, NULL, &matcher->sha256_hashes, 0, NULL, NULL, NULL) == CL_VIRUS) {
394 394 
         if (*vname == 'W') {
395 
-            /* hash is whitelisted in local.gdb */
395 
+            /* hash is allowed in local.gdb */
396 396 
             cli_dbgmsg("Skipping hash %s\n", pattern);
397 397 
             MPOOL_FREE(matcher->mempool, pat->pattern);
398 398 
             MPOOL_FREE(matcher->mempool, pat);
... ... 
@@ -418,7 +418,7 @@ static int add_hash(struct regex_matcher *matcher, char *pattern, const char fl,
418 418 
 }
419 419
420 420 
 /* Load patterns/regexes from file */
421 
-cl_error_t load_regex_matcher(struct cl_engine *engine, struct regex_matcher *matcher, FILE *fd, unsigned int *signo, unsigned int options, int is_whitelist, struct cli_dbio *dbio, uint8_t dconf_prefiltering)
421 
+cl_error_t load_regex_matcher(struct cl_engine *engine, struct regex_matcher *matcher, FILE *fd, unsigned int *signo, unsigned int options, int is_allow_list_lookup, struct cli_dbio *dbio, uint8_t dconf_prefiltering)
422 422 
 {
423 423 
     cl_error_t rc;
424 424 
     int line = 0, entry = 0;
... ... 
@@ -443,7 +443,8 @@ cl_error_t load_regex_matcher(struct cl_engine *engine, struct regex_matcher *ma
443 443 
         }
444 444 
     }
445 445 
     /*
446 
-	 * Regexlist db format (common to .wdb(whitelist) and .pdb(domainlist) files:
446 
+	 * Regexlist db format, common to .wdb (allow list) and .pdb (domain list) files.
447 
+     *
447 448 
 	 * Multiple lines of form, (empty lines are skipped):
448 449 
  	 * Flags RealURL DisplayedURL
449 450 
 	 * Where:
... ... 
@@ -504,15 +505,15 @@ cl_error_t load_regex_matcher(struct cl_engine *engine, struct regex_matcher *ma
504 504 
             return CL_EMALFDB;
505 505 
         }
506 506
507 
-        if ((buffer[0] == 'R' && !is_whitelist) || ((buffer[0] == 'X' || buffer[0] == 'Y') && is_whitelist)) {
507 
+        if ((buffer[0] == 'R' && !is_allow_list_lookup) || ((buffer[0] == 'X' || buffer[0] == 'Y') && is_allow_list_lookup)) {
508 508 
             /* regex for hostname*/
509 509 
             if ((rc = regex_list_add_pattern(matcher, pattern)))
510 510 
                 return rc == CL_EMEM ? CL_EMEM : CL_EMALFDB;
511 
-        } else if ((buffer[0] == 'H' && !is_whitelist) || (buffer[0] == 'M' && is_whitelist)) {
511 
+        } else if ((buffer[0] == 'H' && !is_allow_list_lookup) || (buffer[0] == 'M' && is_allow_list_lookup)) {
512 512 
             /*matches displayed host*/
513 513 
             if ((rc = add_static_pattern(matcher, pattern)))
514 514 
                 return rc == CL_EMEM ? CL_EMEM : CL_EMALFDB;
515 
-        } else if (buffer[0] == 'S' && (!is_whitelist || pattern[0] == 'W')) {
515 
+        } else if (buffer[0] == 'S' && (!is_allow_list_lookup || pattern[0] == 'W')) {
516 516 
             pattern[pattern_len] = '\0';
517 517 
             if (pattern[0] == 'W')
518 518 
                 flags[0] = 'W';
libclamav/regex_list.h
History View file @ 0255f29
... ... 
@@ -60,9 +60,9 @@ struct regex_matcher {
60 60
61 61 
 cl_error_t cli_build_regex_list(struct regex_matcher* matcher);
62 62 
 cl_error_t regex_list_add_pattern(struct regex_matcher* matcher, char* pattern);
63 
-cl_error_t regex_list_match(struct regex_matcher* matcher, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly, const char** info, int is_whitelist);
63 
+cl_error_t regex_list_match(struct regex_matcher* matcher, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly, const char** info, int is_allow_list_lookup);
64 64 
 cl_error_t init_regex_list(struct regex_matcher* matcher, uint8_t dconf_prefiltering);
65 
-cl_error_t load_regex_matcher(struct cl_engine* engine, struct regex_matcher* matcher, FILE* fd, unsigned int* signo, unsigned int options, int is_whitelist, struct cli_dbio* dbio, uint8_t dconf_prefiltering);
65 
+cl_error_t load_regex_matcher(struct cl_engine* engine, struct regex_matcher* matcher, FILE* fd, unsigned int* signo, unsigned int options, int is_allow_list_lookup, struct cli_dbio* dbio, uint8_t dconf_prefiltering);
66 66 
 void regex_list_cleanup(struct regex_matcher* matcher);
67 67 
 void regex_list_done(struct regex_matcher* matcher);
68 68 
 int is_regex_ok(struct regex_matcher* matcher);
libclamav/scanners.c
History View file @ 0255f29
... ... 
@@ -3562,14 +3562,14 @@ static cl_error_t dispatch_prescan_callback(clcb_pre_scan cb, cli_ctx *ctx, cons
3562 3562 
         perf_start(ctx, PERFT_PRECB);
3563 3563 
         switch (cb(fmap_fd(*ctx->fmap), filetype, ctx->cb_ctx)) {
3564 3564 
             case CL_BREAK:
3565 
-                cli_dbgmsg("dispatch_prescan_callback: file whitelisted by callback\n");
3565 
+                cli_dbgmsg("dispatch_prescan_callback: file allowed by callback\n");
3566 3566 
                 perf_stop(ctx, PERFT_PRECB);
3567 3567 
                 ctx->hook_lsig_matches = old_hook_lsig_matches;
3568 3568 
                 /* returns CL_CLEAN */
3569 3569 
                 *run_cleanup = 1;
3570 3570 
                 break;
3571 3571 
             case CL_VIRUS:
3572 
-                cli_dbgmsg("dispatch_prescan_callback: file blacklisted by callback\n");
3572 
+                cli_dbgmsg("dispatch_prescan_callback: file blocked by callback\n");
3573 3573 
                 cli_append_virus(ctx, "Detected.By.Callback");
3574 3574 
                 perf_stop(ctx, PERFT_PRECB);
3575 3575 
                 ctx->hook_lsig_matches = old_hook_lsig_matches;
... ... 
@@ -4456,12 +4456,12 @@ done:
4456 4456 
             virusname = cli_get_last_virus(ctx);
4457 4457 
         switch (ctx->engine->cb_post_scan(fmap_fd(*ctx->fmap), cb_retcode, virusname, ctx->cb_ctx)) {
4458 4458 
             case CL_BREAK:
4459 
-                cli_dbgmsg("cli_magic_scan_desc: file whitelisted by post_scan callback\n");
4459 
+                cli_dbgmsg("cli_magic_scan_desc: file allowed by post_scan callback\n");
4460 4460 
                 perf_stop(ctx, PERFT_POSTCB);
4461 4461 
                 ret = CL_CLEAN;
4462 4462 
                 break;
4463 4463 
             case CL_VIRUS:
4464 
-                cli_dbgmsg("cli_magic_scan_desc: file blacklisted by post_scan callback\n");
4464 
+                cli_dbgmsg("cli_magic_scan_desc: file blocked by post_scan callback\n");
4465 4465 
                 cli_append_virus(ctx, "Detected.By.Callback");
4466 4466 
                 perf_stop(ctx, PERFT_POSTCB);
4467 4467 
                 if (ret != CL_VIRUS) {
libfreshclam/libfreshclam.c
History View file @ 0255f29
... ... 
@@ -451,8 +451,8 @@ fc_error_t fc_test_database(const char *dbFilename, int bBytecodeEnabled)
451 451 
 done:
452 452
453 453 
     if (NULL != engine) {
454 
-        if (engine->domainlist_matcher && engine->domainlist_matcher->sha256_pfx_set.keys)
455 
-            cli_hashset_destroy(&engine->domainlist_matcher->sha256_pfx_set);
454 
+        if (engine->domain_list_matcher && engine->domain_list_matcher->sha256_pfx_set.keys)
455 
+            cli_hashset_destroy(&engine->domain_list_matcher->sha256_pfx_set);
456 456
457 457 
         cl_engine_free(engine);
458 458 
     }
sigtool/sigtool.c
History View file @ 0255f29
... ... 
@@ -3488,7 +3488,7 @@ static int dumpcerts(const struct optstruct *opts)
3488 3488 
             break;
3489 3489 
         case CL_EVERIFY:
3490 3490 
             // The Authenticode header was parsed successfully but there were
3491 
-            // no applicable whitelist/blacklist rules
3491 
+            // no applicable trust/block rules
3492 3492 
             break;
3493 3493 
         case CL_BREAK:
3494 3494 
             mprintf("*dumpcerts: No Authenticode signature detected\n");
unit_tests/check_regex.c
History View file @ 0255f29
... ... 
@@ -41,7 +41,7 @@
41 41 
 #include "regex_suffix.h"
42 42 
 #include "regex_list.h"
43 43 
 #include "phish_domaincheck_db.h"
44 
-#include "phish_whitelist.h"
44 
+#include "phish_allow_list.h"
45 45
46 46 
 #include "checks.h"
47 47
... ... 
@@ -183,14 +183,14 @@ static void rteardown(void)
183 183
184 184 
 typedef enum rtest_result {
185 185 
     RTR_PHISH,
186 
-    RTR_WHITELISTED,
186 
+    RTR_ALLOWED,
187 187 
     RTR_CLEAN,
188 
-    RTR_BLACKLISTED, // if 2nd db is loaded
188 
+    RTR_BLOCKED, // if 2nd db is loaded
189 189 
     RTR_INVALID_REGEX
190 190 
 } rtr_t;
191 191
192 192 
 static const struct rtest {
193 
-    const char *pattern; /* NULL if not meant for whitelist testing */
193 
+    const char *pattern; /* NULL if not meant for allow list testing */
194 194 
     const char *realurl;
195 195 
     const char *displayurl;
196 196 
     rtr_t result;
... ... 
@@ -208,43 +208,43 @@ static const struct rtest {
208 208 
     {".+\\.ebayrtm\\.com([/?].*)?:.+\\.ebay\\.(de|com|co\\.uk)([/?].*)?/",
209 209 
      "http://srx.main.ebayrtm.com",
210 210 
      "pages.ebay.de",
211 
-     RTR_WHITELISTED /* should be whitelisted */},
211 
+     RTR_ALLOWED /* should be allowed */},
212 212 
     {".+\\.ebayrtm\\.com([/?].*)?:.+\\.ebay\\.(de|com|co\\.uk)([/?].*)?/",
213 213 
      "http://srx.main.ebayrtm.com.evil.example.com",
214 214 
      "pages.ebay.de",
215 215 
      RTR_PHISH},
216 216 
     {".+\\.ebayrtm\\.com([/?].*)?:.+\\.ebay\\.(de|com|co\\.uk)([/?].*)?/",
217 217 
      "www.www.ebayrtm.com?somecgi",
218 
-     "www.ebay.com/something", RTR_WHITELISTED},
218 
+     "www.ebay.com/something", RTR_ALLOWED},
219 219 
     {NULL,
220 220 
      "http://key.com", "go to key.com", RTR_CLEAN},
221 221 
     {":.+\\.paypal\\.(com|de|fr|it)([/?].*)?:.+\\.ebay\\.(at|be|ca|ch|co\\.uk|de|es|fr|ie|in|it|nl|ph|pl|com(\\.(au|cn|hk|my|sg))?)([/?].*)?/",
222 
-     "http://www.paypal.com", "pics.ebay.com", RTR_WHITELISTED},
222 
+     "http://www.paypal.com", "pics.ebay.com", RTR_ALLOWED},
223 223 
     {NULL, "http://somefakeurl.example.com", "someotherdomain-key.com", RTR_CLEAN},
224 224 
     {NULL, "http://somefakeurl.example.com", "someotherdomain.key.com", RTR_PHISH},
225 
-    {NULL, "http://malware-test.example.com/something", "test", RTR_BLACKLISTED},
226 
-    {NULL, "http://phishing-test.example.com/something", "test", RTR_BLACKLISTED},
227 
-    {NULL, "http://sub.malware-test.example.com/2", "test", RTR_BLACKLISTED},
228 
-    {NULL, "http://sub.phishing-test.example.com/2", "test", RTR_BLACKLISTED},
229 
-    {NULL, "http://user@malware-test.example.com/2", "test", RTR_BLACKLISTED},
230 
-    {NULL, "http://user@phishing-test.example.com/2", "test", RTR_BLACKLISTED},
231 
-    {NULL, "http://user@malware-test.example.com/2/test", "test", RTR_BLACKLISTED},
232 
-    {NULL, "http://user@phishing-test.example.com/2/test", "test", RTR_BLACKLISTED},
233 
-    {NULL, "http://user@malware-test.example.com/", "test", RTR_BLACKLISTED},
234 
-    {NULL, "http://user@phishing-test.example.com/", "test", RTR_BLACKLISTED},
225 
+    {NULL, "http://malware-test.example.com/something", "test", RTR_BLOCKED},
226 
+    {NULL, "http://phishing-test.example.com/something", "test", RTR_BLOCKED},
227 
+    {NULL, "http://sub.malware-test.example.com/2", "test", RTR_BLOCKED},
228 
+    {NULL, "http://sub.phishing-test.example.com/2", "test", RTR_BLOCKED},
229 
+    {NULL, "http://user@malware-test.example.com/2", "test", RTR_BLOCKED},
230 
+    {NULL, "http://user@phishing-test.example.com/2", "test", RTR_BLOCKED},
231 
+    {NULL, "http://user@malware-test.example.com/2/test", "test", RTR_BLOCKED},
232 
+    {NULL, "http://user@phishing-test.example.com/2/test", "test", RTR_BLOCKED},
233 
+    {NULL, "http://user@malware-test.example.com/", "test", RTR_BLOCKED},
234 
+    {NULL, "http://user@phishing-test.example.com/", "test", RTR_BLOCKED},
235 235 
     {NULL, "http://x.exe", "http:///x.exe", RTR_CLEAN},
236 236 
     {".+\\.ebayrtm\\.com([/?].*)?:[^.]+\\.ebay\\.(de|com|co\\.uk)/",
237 237 
      "http://srx.main.ebayrtm.com",
238 238 
      "pages.ebay.de",
239 
-     RTR_WHITELISTED /* should be whitelisted */},
239 
+     RTR_ALLOWED /* should be allowed */},
240 240 
     {".+\\.ebayrtm\\.com([/?].*)?:.+[r-t]\\.ebay\\.(de|com|co\\.uk)/",
241 241 
      "http://srx.main.ebayrtm.com",
242 242 
      "pages.ebay.de",
243 
-     RTR_WHITELISTED /* should be whitelisted */},
243 
+     RTR_ALLOWED /* should be allowed */},
244 244 
     {".+\\.ebayrtm\\.com([/?].*)?:.+[r-t]\\.ebay\\.(de|com|co\\.uk)/",
245 245 
      "http://srx.main.ebayrtm.com",
246 246 
      "pages.ebay.de",
247 
-     RTR_WHITELISTED /* should be whitelisted */},
247 
+     RTR_ALLOWED /* should be allowed */},
248 248 
     {"[t-", "", "", RTR_INVALID_REGEX},
249 249 
     {NULL, "http://co.uk", "http:// co.uk", RTR_CLEAN},
250 250 
     {NULL, "http://co.uk", "     ", RTR_CLEAN},
... ... 
@@ -263,14 +263,14 @@ START_TEST(regex_list_match_test)
263 263 
     cl_error_t rc;
264 264
265 265 
     if (!rtest->pattern) {
266 
-        ck_assert_msg(rtest->result != RTR_WHITELISTED,
267 
-                      "whitelist test must have pattern set");
268 
-        /* this test entry is not meant for whitelist testing */
266 
+        ck_assert_msg(rtest->result != RTR_ALLOWED,
267 
+                      "Allow list test must have pattern set");
268 
+        /* this test entry is not meant for allow_list testing */
269 269 
         return;
270 270 
     }
271 271
272 
-    ck_assert_msg(rtest->result == RTR_PHISH || rtest->result == RTR_WHITELISTED || rtest->result == RTR_INVALID_REGEX,
273 
-                  "whitelist test result must be either RTR_PHISH or RTR_WHITELISTED or RTR_INVALID_REGEX");
272 
+    ck_assert_msg(rtest->result == RTR_PHISH || rtest->result == RTR_ALLOWED || rtest->result == RTR_INVALID_REGEX,
273 
+                  "Allow list test result must be either RTR_PHISH or RTR_ALLOWED or RTR_INVALID_REGEX");
274 274 
     pattern = cli_strdup(rtest->pattern);
275 275 
     ck_assert_msg(!!pattern, "cli_strdup");
276 276
... ... 
@@ -314,13 +314,13 @@ static void psetup_impl(int load2)
314 314 
     phishing_init(engine);
315 315 
     ck_assert_msg(!!engine->phishcheck, "phishing_init");
316 316
317 
-    rc = init_domainlist(engine);
318 
-    ck_assert_msg(rc == CL_SUCCESS, "init_domainlist");
317 
+    rc = init_domain_list(engine);
318 
+    ck_assert_msg(rc == CL_SUCCESS, "init_domain_list");
319 319
320 320 
     f = fdopen(open_testfile("input" PATHSEP "daily.pdb", O_RDONLY | O_BINARY), "r");
321 321 
     ck_assert_msg(!!f, "fopen daily.pdb");
322 322
323 
-    rc = load_regex_matcher(engine, engine->domainlist_matcher, f, &signo, 0, 0, NULL, 1);
323 
+    rc = load_regex_matcher(engine, engine->domain_list_matcher, f, &signo, 0, 0, NULL, 1);
324 324 
     ck_assert_msg(rc == CL_SUCCESS, "load_regex_matcher");
325 325 
     fclose(f);
326 326
... ... 
@@ -331,7 +331,7 @@ static void psetup_impl(int load2)
331 331 
         ck_assert_msg(!!f, "fopen daily.gdb");
332 332
333 333 
         signo = 0;
334 
-        rc    = load_regex_matcher(engine, engine->domainlist_matcher, f, &signo, 0, 0, NULL, 1);
334 
+        rc    = load_regex_matcher(engine, engine->domain_list_matcher, f, &signo, 0, 0, NULL, 1);
335 335 
         ck_assert_msg(rc == CL_SUCCESS, "load_regex_matcher");
336 336 
         fclose(f);
337 337
... ... 
@@ -339,25 +339,25 @@ static void psetup_impl(int load2)
339 339 
     }
340 340 
     loaded_2 = load2;
341 341
342 
-    rc = init_whitelist(engine);
343 
-    ck_assert_msg(rc == CL_SUCCESS, "init_whitelist");
342 
+    rc = init_allow_list(engine);
343 
+    ck_assert_msg(rc == CL_SUCCESS, "init_allow_list");
344 344
345 345 
     f     = fdopen(open_testfile("input" PATHSEP "daily.wdb", O_RDONLY | O_BINARY), "r");
346 346 
     signo = 0;
347 
-    rc    = load_regex_matcher(engine, engine->whitelist_matcher, f, &signo, 0, 1, NULL, 1);
347 
+    rc    = load_regex_matcher(engine, engine->allow_list_matcher, f, &signo, 0, 1, NULL, 1);
348 348 
     ck_assert_msg(rc == CL_SUCCESS, "load_regex_matcher");
349 349 
     fclose(f);
350 350
351 351 
     ck_assert_msg(signo == 31, "Incorrect number of signatures: %u, expected %u", signo, 31);
352 352
353 
-    rc = cli_build_regex_list(engine->whitelist_matcher);
353 
+    rc = cli_build_regex_list(engine->allow_list_matcher);
354 354 
     ck_assert_msg(rc == CL_SUCCESS, "cli_build_regex_list");
355 355
356 
-    rc = cli_build_regex_list(engine->domainlist_matcher);
356 
+    rc = cli_build_regex_list(engine->domain_list_matcher);
357 357 
     ck_assert_msg(rc == CL_SUCCESS, "cli_build_regex_list");
358 358
359 
-    ck_assert_msg(is_regex_ok(engine->whitelist_matcher), "is_regex_ok");
360 
-    ck_assert_msg(is_regex_ok(engine->domainlist_matcher), "is_regex_ok");
359 
+    ck_assert_msg(is_regex_ok(engine->allow_list_matcher), "is_regex_ok");
360 
+    ck_assert_msg(is_regex_ok(engine->domain_list_matcher), "is_regex_ok");
361 361 
 }
362 362
363 363 
 static void psetup(void)
... ... 
@@ -418,9 +418,9 @@ static void do_phishing_test(const struct rtest *rtest)
418 418 
                           "this should be phishing, realURL: %s, displayURL: %s",
419 419 
                           rtest->realurl, rtest->displayurl);
420 420 
             break;
421 
-        case RTR_WHITELISTED:
421 
+        case RTR_ALLOWED:
422 422 
             ck_assert_msg(!ctx.found_possibly_unwanted,
423 
-                          "this should be whitelisted, realURL: %s, displayURL: %s",
423 
+                          "this should be allowed, realURL: %s, displayURL: %s",
424 424 
                           rtest->realurl, rtest->displayurl);
425 425 
             break;
426 426 
         case RTR_CLEAN:
... ... 
@@ -428,14 +428,14 @@ static void do_phishing_test(const struct rtest *rtest)
428 428 
                           "this should be clean, realURL: %s, displayURL: %s",
429 429 
                           rtest->realurl, rtest->displayurl);
430 430 
             break;
431 
-        case RTR_BLACKLISTED:
431 
+        case RTR_BLOCKED:
432 432 
             if (!loaded_2)
433 433 
                 ck_assert_msg(!ctx.found_possibly_unwanted,
434 434 
                               "this should be clean, realURL: %s, displayURL: %s",
435 435 
                               rtest->realurl, rtest->displayurl);
436 436 
             else {
437 437 
                 ck_assert_msg(ctx.found_possibly_unwanted,
438 
-                              "this should be blacklisted, realURL: %s, displayURL: %s",
438 
+                              "this should be blocked, realURL: %s, displayURL: %s",
439 439 
                               rtest->realurl, rtest->displayurl);
440 440 
                 if (*ctx.virname) {
441 441 
                     char *phishingFound = NULL;
... ... 
@@ -446,7 +446,7 @@ static void do_phishing_test(const struct rtest *rtest)
446 446 
                     } else if (strstr(rtest->realurl, "phishing-test")) {
447 447 
                         detectionName = "Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net";
448 448 
                     }
449 
-                    ck_assert_msg(detectionName != NULL, "\n\t Blacklist test case error - malware-test or phishing-test not found in: %s\n", rtest->realurl);
449 
+                    ck_assert_msg(detectionName != NULL, "\n\t Block list test case error - malware-test or phishing-test not found in: %s\n", rtest->realurl);
450 450 
                     phishingFound = strstr((const char *)*ctx.virname, detectionName);
451 451 
                     ck_assert_msg(phishingFound != NULL, "\n\t should be: %s,\n\t but is:    %s\n", detectionName, *ctx.virname);
452 452 
                 }
... ... 
@@ -492,7 +492,7 @@ static void do_phishing_test_allscan(const struct rtest *rtest)
492 492 
     rc = phishingScan(&ctx, &hrefs);
493 493
494 494 
     html_tag_arg_free(&hrefs);
495 
-    if (rtest->result == RTR_PHISH || (loaded_2 != 0 && rtest->result == RTR_BLACKLISTED)) {
495 
+    if (rtest->result == RTR_PHISH || (loaded_2 != 0 && rtest->result == RTR_BLOCKED)) {
496 496 
         ck_assert_msg(rc == CL_VIRUS, "phishingScan returned \"%s\", expected \"%s\". \n\trealURL: %s \n\tdisplayURL: %s",
497 497 
                       cl_strerror(rc),
498 498 
                       cl_strerror(CL_VIRUS),
... ... 
@@ -509,9 +509,9 @@ static void do_phishing_test_allscan(const struct rtest *rtest)
509 509 
                           "this should be phishing, realURL: %s, displayURL: %s",
510 510 
                           rtest->realurl, rtest->displayurl);
511 511 
             break;
512 
-        case RTR_WHITELISTED:
512 
+        case RTR_ALLOWED:
513 513 
             ck_assert_msg(!ctx.num_viruses,
514 
-                          "this should be whitelisted, realURL: %s, displayURL: %s",
514 
+                          "this should be allowed, realURL: %s, displayURL: %s",
515 515 
                           rtest->realurl, rtest->displayurl);
516 516 
             break;
517 517 
         case RTR_CLEAN:
... ... 
@@ -519,14 +519,14 @@ static void do_phishing_test_allscan(const struct rtest *rtest)
519 519 
                           "this should be clean, realURL: %s, displayURL: %s",
520 520 
                           rtest->realurl, rtest->displayurl);
521 521 
             break;
522 
-        case RTR_BLACKLISTED:
522 
+        case RTR_BLOCKED:
523 523 
             if (!loaded_2)
524 524 
                 ck_assert_msg(!ctx.num_viruses,
525 525 
                               "this should be clean, realURL: %s, displayURL: %s",
526 526 
                               rtest->realurl, rtest->displayurl);
527 527 
             else {
528 528 
                 ck_assert_msg(ctx.num_viruses,
529 
-                              "this should be blacklisted, realURL: %s, displayURL: %s",
529 
+                              "this should be blocked, realURL: %s, displayURL: %s",
530 530 
                               rtest->realurl, rtest->displayurl);
531 531 
                 if (*ctx.virname) {
532 532 
                     char *phishingFound = NULL;
... ... 
@@ -537,7 +537,7 @@ static void do_phishing_test_allscan(const struct rtest *rtest)
537 537 
                     } else if (strstr(rtest->realurl, "phishing-test")) {
538 538 
                         detectionName = "Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net";
539 539 
                     }
540 
-                    ck_assert_msg(detectionName != NULL, "\n\t Blacklist test case error - malware-test or phishing-test not found in: %s\n", rtest->realurl);
540 
+                    ck_assert_msg(detectionName != NULL, "\n\t Block list test case error - malware-test or phishing-test not found in: %s\n", rtest->realurl);
541 541 
                     phishingFound = strstr((const char *)*ctx.virname, detectionName);
542 542 
                     ck_assert_msg(phishingFound != NULL, "\n\t should be: %s,\n\t but is:    %s\n", detectionName, *ctx.virname);
543 543 
                 }
win32/conf_examples/clamd.conf.sample
History View file @ 0255f29
... ... 
@@ -332,7 +332,7 @@ TCPAddr 127.0.0.1
332 332 
 # the signature chain in the PE file against a database of trusted and
333 333 
 # revoked certificates if the file being scanned is marked as a virus.
334 334 
 # If any certificate in the chain validates against any trusted root, but
335 
-# does not match any revoked certificate, the file is marked as whitelisted.
335 
+# does not match any revoked certificate, the file is marked as trusted.
336 336 
 # If the file does match a revoked certificate, the file is marked as virus.
337 337 
 # The following setting completely turns off authenticode verification.
338 338 
 # Default: no
win32/conf_examples/freshclam.conf.sample
History View file @ 0255f29
... ... 
@@ -92,7 +92,7 @@ DatabaseMirror database.clamav.net
92 92 
 # Default: no custom URLs
93 93 
 #DatabaseCustomURL http://myserver.example.com/mysigs.ndb
94 94 
 #DatabaseCustomURL https://myserver.example.com/mysigs.ndb
95 
-#DatabaseCustomURL https://myserver.example.com:4567/whitelist.wdb
95 
+#DatabaseCustomURL https://myserver.example.com:4567/allow_list.wdb
96 96 
 #DatabaseCustomURL ftp://myserver.example.com/example.ldb
97 97 
 #DatabaseCustomURL ftps://myserver.example.com:4567/example.ndb
98 98 
 #DatabaseCustomURL file://E:\Share\local.hdb