Browse code

Correction to logic enabling/disabling heuristic alerts.

Micah Snyder (micasnyd) authored on 2018/10/24 05:20:12
Showing 3 changed files
... ...
@@ -990,16 +990,15 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi
990 990
     }
991 991
 
992 992
     /* TODO: Remove deprecated option in a future feature release. */
993
-    if (optget(opts, "AlgorithmicDetection")->enabled) {
994
-        logg("^Using deprecated option \"AlgorithmicDetection\" to enable "
993
+    if (!optget(opts, "AlgorithmicDetection")->enabled) {
994
+        logg("^Using deprecated option \"AlgorithmicDetection\" to disable "
995 995
              "heuristic alerts. Please update your configuration to use "
996 996
              "replacement option \"HeuristicAlerts\".\n");
997
-        options.heuristic |= CL_SCAN_GENERAL_HEURISTICS;
998
-    } else if (optget(opts, "HeuristicAlerts")->enabled) {
999
-        logg("Heuristic alerts enabled.\n");
1000
-        options.general |= CL_SCAN_GENERAL_HEURISTICS;
1001
-    } else {
997
+    } else if (!optget(opts, "HeuristicAlerts")->enabled) {
1002 998
         logg("Heuristic alerts disabled.\n");
999
+	} else {
1000
+		logg("Heuristic alerts enabled.\n");
1001
+		options.general |= CL_SCAN_GENERAL_HEURISTICS;
1003 1002
     }
1004 1003
 
1005 1004
     if(optget(opts, "ScanPE")->enabled) {
... ...
@@ -1090,8 +1090,11 @@ int scanmanager(const struct optstruct *opts)
1090 1090
     if(optget(opts, "scan-hwp3")->enabled)
1091 1091
         options.parse |= CL_SCAN_PARSE_HWP3;
1092 1092
 
1093
-    if(optget(opts, "algorithmic-detection")->enabled)
1093
+    /* TODO: Remove deprecated option in a future feature release */
1094
+    if ((optget(opts, "algorithmic-detection")->enabled) && /* && used due to default-yes for both options */
1095
+        (optget(opts, "heuristic-alerts")->enabled)) {
1094 1096
         options.general |= CL_SCAN_GENERAL_HEURISTICS;
1097
+    }
1095 1098
 
1096 1099
     /* TODO: Remove deprecated option in a future feature release */
1097 1100
     if ((optget(opts, "block-max")->enabled) || 
... ...
@@ -492,13 +492,13 @@ const struct clam_option __clam_options[] = {
492 492
     /* Deprecated options */
493 493
 
494 494
     { "DetectBrokenExecutables", "detect-broken", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to alert on broken PE and ELF executable files.", "no" },
495
-    { "AlgorithmicDetection", "algorithmic-detection", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to enable heuristic alerts (e.g. \"Heuristics.<sig name>\")", "no" },
496
-    { "BlockMax", "block-max", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "", "" },
497
-    { "PhishingAlwaysBlockSSLMismatch", "phishing-ssl", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.", "no" },
498
-    { "PhishingAlwaysBlockCloak", "phishing-cloak", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to alert on cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.", "no" },
499
-    { "PartitionIntersection", "partition-intersection", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to alert on raw DMG image files containing partition intersections.", "no" },
500
-    { "OLE2BlockMacros", "block-macros", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".", "no" },
501
-    { "ArchiveBlockEncrypted", "block-encrypted", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).", "no" },
495
+    { "AlgorithmicDetection", "algorithmic-detection", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Deprecated option to enable heuristic alerts (e.g. \"Heuristics.<sig name>\")", "no" },
496
+    { "BlockMax", "block-max", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "", "" },
497
+    { "PhishingAlwaysBlockSSLMismatch", "phishing-ssl", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Deprecated option to alert on SSL mismatches in URLs, even if they're not in the database.\nThis feature can lead to false positives.", "no" },
498
+    { "PhishingAlwaysBlockCloak", "phishing-cloak", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Deprecated option to alert on cloaked URLs, even if they're not in the database.\nThis feature can lead to false positives.", "no" },
499
+    { "PartitionIntersection", "partition-intersection", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Deprecated option to alert on raw DMG image files containing partition intersections.", "no" },
500
+    { "OLE2BlockMacros", "block-macros", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "With this option enabled OLE2 files with VBA macros, which were not\ndetected by signatures will be marked as \"Heuristics.OLE2.ContainsMacros\".", "no" },
501
+    { "ArchiveBlockEncrypted", "block-encrypted", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Deprecated option to alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).", "no" },
502 502
     { "MailMaxRecursion", NULL, 0, CLOPT_TYPE_NUMBER, NULL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", "" },
503 503
     { "ArchiveMaxScanSize", NULL, 0, CLOPT_TYPE_SIZE, NULL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", "" },
504 504
     { "ArchiveMaxRecursion", NULL, 0, CLOPT_TYPE_NUMBER, NULL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", "" },