@@ -1,3 +1,8 @@

+Thu Mar  5 20:10:00 CET 2009 (tk)

+---------------------------------

+ * libclamav: count .pdb entries as signatures

+ * freshclam, sigtool: add support for safebrowsing.cvd (bb#1056)

+

 Thu Mar  5 16:43:46 CET 2009 (acab)

 -----------------------------------

  * libclamav/mpool.c: enable mmap poisoning (compile with --enable-debug)

@@ -1484,6 +1484,8 @@ static int updatedb(const char *dbname, const char *hostname, char *ip, int *sig

 	    field = 1;

 	} else if(!strcmp(dbname, "daily")) {

 	    field = 2;

+	} else if(!strcmp(dbname, "safebrowsing")) {

+	    field = 6;

 	} else {

 	    logg("!updatedb: Unknown database name (%s) passed.\n", dbname);

 	    cl_cvdfree(current);

@@ -1829,6 +1831,19 @@ int downloadmanager(const struct optstruct *opts, const char *hostname, const ch

     } else if(ret == 0)

 	updated = 1;

+    /* if ipaddr[0] != 0 it will use it to connect to the web host */

+    if(optget(opts, "SafeBrowsing")->enabled && (ret = updatedb("safebrowsing", hostname, ipaddr, &signo, opts, dnsreply, localip, outdated, &mdat, logerr)) > 50) {

+	if(dnsreply)

+	    free(dnsreply);

+

+	if(newver)

+	    free(newver);

+

+	mirman_write("mirrors.dat", &mdat);

+	return ret;

+    } else if(ret == 0)

+	updated = 1;

+

     if(dnsreply)

 	free(dnsreply);

@@ -489,14 +489,14 @@ static int cli_loadwdb(FILE *fs, struct cl_engine *engine, unsigned int options,

 	}

     }

-    if((ret = load_regex_matcher(engine->whitelist_matcher, fs, options, 1, dbio))) {

+    if((ret = load_regex_matcher(engine->whitelist_matcher, fs, NULL, options, 1, dbio))) {

 	return ret;

     }

     return CL_SUCCESS;

 }

-static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int options, struct cli_dbio *dbio)

+static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int *signo, unsigned int options, struct cli_dbio *dbio)

 {

 	int ret = 0;

@@ -510,7 +510,7 @@ static int cli_loadpdb(FILE *fs, struct cl_engine *engine, unsigned int options,

 	}

     }

-    if((ret = load_regex_matcher(engine->domainlist_matcher, fs, options, 0, dbio))) {

+    if((ret = load_regex_matcher(engine->domainlist_matcher, fs, signo, options, 0, dbio))) {

 	return ret;

     }

@@ -1516,7 +1516,7 @@ int cli_load(const char *filename, struct cl_engine *engine, unsigned int *signo

 	    skipped = 1;

     } else if(cli_strbcasestr(dbname, ".pdb")) {

 	if(options & CL_DB_PHISHING_URLS) {

-	    ret = cli_loadpdb(fs, engine, options, dbio);

+	    ret = cli_loadpdb(fs, engine, signo, options, dbio);

 	} else

 	    skipped = 1;

     } else if(cli_strbcasestr(dbname, ".ftm")) {

@@ -453,9 +453,9 @@ static int add_hash(struct regex_matcher *matcher, char* pattern, const char fl)

 /* Load patterns/regexes from file */

-int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int options,int is_whitelist,struct cli_dbio *dbio)

+int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int *signo,unsigned int options,int is_whitelist,struct cli_dbio *dbio)

 {

-	int rc,line=0;

+	int rc,line=0,entry=0;

 	char buffer[FILEBUFF];

 	assert(matcher);

@@ -502,13 +502,14 @@ int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int optio

 		size_t pattern_len;

 		cli_chomp(buffer);

+		line++;

 		if(!*buffer)

 			continue;/* skip empty lines */

 		if(functionality_level_check(buffer))

 			continue;

-		line++;

+		entry++;

 		pattern = strchr(buffer,':');

 		if(!pattern) {

 			cli_errmsg("Malformed regex list line %d\n",line);

@@ -550,6 +551,8 @@ int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int optio

 		}

 	}

 	matcher->list_loaded = 1;

+	if(signo)

+	    *signo += entry;

 	return CL_SUCCESS;

 }

@@ -66,7 +66,7 @@ int cli_build_regex_list(struct regex_matcher* matcher);

 int regex_list_add_pattern(struct regex_matcher *matcher, char *pattern);

 int regex_list_match(struct regex_matcher* matcher, char* real_url,const char* display_url,const struct pre_fixup_info* pre_fixup, int hostOnly,const char **info, int is_whitelist);

 int init_regex_list(struct regex_matcher* matcher);

-int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int options,int is_whitelist,struct cli_dbio *dbio);

+int load_regex_matcher(struct regex_matcher* matcher,FILE* fd,unsigned int *signo,unsigned int options,int is_whitelist,struct cli_dbio *dbio);

 void regex_list_cleanup(struct regex_matcher* matcher);

 void regex_list_done(struct regex_matcher* matcher);

 int is_regex_ok(struct regex_matcher* matcher);

@@ -98,6 +98,7 @@ const struct clam_option clam_options[] = {

     { NULL, "html-normalise", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

     { NULL, "utf16-decode", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

     { NULL, "build", 'b', TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

+    { NULL, "no-cdiff", 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_SIGTOOL, "", "" },

     { NULL, "server", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

     { NULL, "unpack", 'u', TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

     { NULL, "unpack-current", 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_SIGTOOL, "", "" },

@@ -349,6 +350,8 @@ const struct clam_option clam_options[] = {

     { "DetectionStatsCountry", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM, "Country of origin of malware/detection statistics (for statistical\npurposes only). The statistics collector at ClamAV.net will look up\nyour IP address to determine the geographical origin of the malware\nreported by your installation. If this installation is mainly used to\nscan data which comes from a different location, please enable this\noption and enter a two-letter code (see http://www.iana.org/domains/root/db/)\nof the country of origin.", "country-code" },

+    { "SafeBrowsing", NULL, 0, TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_FRESHCLAM, "FIXME", "yes" },

+

     /* Deprecated options */

     { "MailMaxRecursion", NULL, 0, TYPE_NUMBER, NULL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", "" },

@@ -95,12 +95,26 @@ static const struct dblist_s {

     { "main.zmd",   1 },    { "daily.zmd",  1 },

     { "main.rmd",   1 },    { "daily.rmd",  1 },

     { "main.fp",    0 },    { "daily.fp",   0 },

-    { "main.pdb",   0 },    { "daily.pdb",  0 },

-    { "main.wdb",   0 },    { "daily.wdb",  0 },

+    { "main.pdb",   1 },    { "daily.pdb",  1 },    { "safebrowsing.pdb", 1 },

+    { "main.wdb",   0 },    { "daily.wdb",  0 },    { "safebrowsing.wdb", 0 },

     { NULL,	    0 }

 };

+static const char *getdbname(const char *str)

+{

+    if(strstr(str, "main"))

+	return "main";

+    else if(strstr(str, "daily"))

+	return "daily";

+    else if(strstr(str, "safebrowsing"))

+	return "safebrowsing";

+    else {

+	mprintf("!getdbname: Can't extract db name\n");

+	return "UNKNOWN";

+    }

+}

+

 static int hexdump(void)

 {

 	char buffer[FILEBUFF], *pt;

@@ -559,7 +573,7 @@ static int build(const struct optstruct *opts)

 	return -1;

     }

-    dbname = strstr(optget(opts, "build")->strarg, "main") ? "main" : "daily";

+    dbname = getdbname(optget(opts, "build")->strarg);

     if(!(engine = cl_engine_new())) {

 	mprintf("!build: Can't initialize antivirus engine\n");

@@ -803,6 +817,11 @@ static int build(const struct optstruct *opts)

     mprintf("Created %s\n", newcvd);

+    if(optget(opts, "no-cdiff")->enabled) {

+	mprintf("Skipping .cdiff creation\n");

+	return 0;

+    }

+

     /* generate patch */

     if(!(pt = cli_gentemp(NULL))) {

 	mprintf("!build: Can't generate temporary name\n");

@@ -852,11 +871,7 @@ static int build(const struct optstruct *opts)

 	return -1;

     }

-    if(!strcmp(dbname, "main"))

-	snprintf(patch, sizeof(patch), "main-%u.script", version);

-    else

-	snprintf(patch, sizeof(patch), "daily-%u.script", version);

-

+    snprintf(patch, sizeof(patch), "%s-%u.script", dbname, version);

     ret = diffdirs(olddb, pt, patch);

     cli_rmdirs(pt);

@@ -1239,15 +1254,12 @@ static int vbadump(const struct optstruct *opts)

 static int comparemd5(const char *dbname)

 {

-	char info[16], buff[256], *md5, *pt;

+	char info[32], buff[256], *md5, *pt;

 	FILE *fh;

 	int ret = 0;

-    if(strstr(dbname, "main"))

-	strcpy(info, "main.info");

-    else

-	strcpy(info, "daily.info");

+    snprintf(info, sizeof(info), "%s.info", getdbname(dbname));

     if(!(fh = fopen(info, "r"))) {

 	mprintf("!verifydiff: Can't open %s\n", info);

@@ -1731,11 +1743,7 @@ static int makediff(const struct optstruct *opts)

 	return -1;

     }

-    if(strstr(opts->filename[0], "main"))

-	snprintf(name, sizeof(name), "main-%u.script", newver);

-    else

-	snprintf(name, sizeof(name), "daily-%u.script", newver);

-

+    snprintf(name, sizeof(name), "%s-%u.script", getdbname(opts->filename[0]), newver);

     ret = diffdirs(odir, ndir, name);

     cli_rmdirs(odir);

@@ -1781,6 +1789,7 @@ static void help(void)

     mprintf("    --utf16-decode=FILE                    decode UTF16 encoded files\n");

     mprintf("    --info=FILE            -i FILE         print database information\n");

     mprintf("    --build=NAME [cvd] -b NAME             build a CVD file\n");

+    mprintf("    --no-cdiff                             Don't generate .cdiff file\n");

     mprintf("    --server=ADDR                          ClamAV Signing Service address\n");

     mprintf("    --unpack=FILE          -u FILE         Unpack a CVD/CLD file\n");

     mprintf("    --unpack-current=SHORTNAME             Unpack local CVD/CLD into cwd\n");