@@ -1,3 +1,11 @@

+Sun Feb 20 05:08:54 CET 2005 (tk)

+---------------------------------

+  * libclamav: add support for detection based on analysis of archive metadata

+	       (currently only zip is supported)

+  * libclamav/clamav.h, libclamav/matcher.c: handle cli_zip_node list

+  * libclamav/readdb.c: load *.zmd (zip metadata signatures)

+  * libclamav/str.c: new function cli_hex2num()

+

 Fri Feb 18 21:29:16 GMT 2005 (njh)

 ----------------------------------

   * libclamav/message.c: Handle broken RFC2231 messages reported by Maxim

@@ -120,6 +120,12 @@ struct cli_md5_node {

     struct cli_md5_node *next;

 };

+struct cli_zip_node {

+    int compr, csize, size, encrypted, crc32;

+    char *filename, *virname;

+    struct cli_zip_node *next;

+};

+

 struct cl_node {

     unsigned int maxpatlen; /* maximal length of pattern in db */

@@ -133,6 +139,9 @@ struct cl_node {

     /* MD5 */

     struct cli_md5_node **md5_hlist;

+

+    /* Zip metadata */

+    struct cli_zip_node *zip_mlist;

 };

 struct cl_limits {

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2002 - 2004 Tomasz Kojm <tkojm@clamav.net>

+ *  Copyright (C) 2002 - 2005 Tomasz Kojm <tkojm@clamav.net>

  *

  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License as published by

@@ -325,8 +325,8 @@ int cl_build(struct cl_node *root)

 void cl_free(struct cl_node *root)

 {

 	int i;

-	struct cli_md5_node *pt, *h;

-

+	struct cli_md5_node *md5pt, *md5h;

+	struct cli_zip_node *zippt, *ziph;

     if(!root) {

 	cli_errmsg("cl_free: root == NULL\n");

@@ -338,20 +338,30 @@ void cl_free(struct cl_node *root)

     if(root->md5_hlist) {

 	for(i = 0; i < 256; i++) {

-	    pt = root->md5_hlist[i];

-	    while(pt) {

-		h = pt;

-		pt = pt->next;

-		free(h->md5);

-		free(h->virname);

-		if(h->viralias)

-		    free(h->viralias);

-		free(h);

+	    md5pt = root->md5_hlist[i];

+	    while(md5pt) {

+		md5h = md5pt;

+		md5pt = md5pt->next;

+		free(md5h->md5);

+		free(md5h->virname);

+		if(md5h->viralias)

+		    free(md5h->viralias);

+		free(md5h);

 	    }

 	}

 	free(root->md5_hlist);

     }

+    zippt = root->zip_mlist;

+    while(zippt) {

+	ziph = zippt;

+	zippt = zippt->next;

+	free(ziph->virname);

+	if(ziph->filename)

+	    free(ziph->filename);

+	free(ziph);

+    }

+

     free(root);

 }

@@ -700,6 +700,146 @@ static int cli_loadhdb(FILE *fd, struct cl_node **root, unsigned int *signo)

     return 0;

 }

+static int cli_loadzmd(FILE *fd, struct cl_node **root, unsigned int *signo)

+{

+	char buffer[FILEBUFF], *pt;

+	int line = 0, comments = 0, ret = 0;

+	struct cli_zip_node *new;

+

+

+    if(!*root) {

+	cli_dbgmsg("Initializing main node\n");

+	*root = (struct cl_node *) cli_calloc(1, sizeof(struct cl_node));

+	if(!*root)

+	    return CL_EMEM;

+    }

+

+    while(fgets(buffer, FILEBUFF, fd)) {

+	line++;

+	if(buffer[0] == '#') {

+	    comments++;

+	    continue;

+	}

+

+	cli_chomp(buffer);

+

+	new = (struct cli_zip_node *) cli_calloc(1, sizeof(struct cli_zip_node));

+	if(!new) {

+	    ret = CL_EMEM;

+	    break;

+	}

+

+	if(!(new->virname = cli_strtok(buffer, 0, ":"))) {

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	}

+

+	if(!(pt = cli_strtok(buffer, 1, ":"))) {

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    new->encrypted = atoi(pt);

+	    free(pt);

+	}

+

+	if(!(new->filename = cli_strtok(buffer, 2, ":"))) {

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    if(!strcmp(new->filename, "*")) {

+		free(new->filename);

+		new->filename = NULL;

+	    }

+	}

+

+	if(!(pt = cli_strtok(buffer, 3, ":"))) {

+	    free(new->filename);

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    if(!strcmp(pt, "*"))

+		new->size = -1;

+	    else

+		new->size = atoi(pt);

+	    free(pt);

+	}

+

+	if(!(pt = cli_strtok(buffer, 4, ":"))) {

+	    free(new->filename);

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    if(!strcmp(pt, "*"))

+		new->csize = -1;

+	    else

+		new->csize = atoi(pt);

+	    free(pt);

+	}

+

+	if(!(pt = cli_strtok(buffer, 5, ":"))) {

+	    free(new->filename);

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    if(!strcmp(pt, "*")) {

+		new->crc32 = 0;

+	    } else {

+		new->crc32 = cli_hex2num(pt);

+		if(new->crc32 == -1) {

+		    ret = CL_EMALFDB;

+		    break;

+		}

+	    }

+	    free(pt);

+	}

+

+	if(!(pt = cli_strtok(buffer, 6, ":"))) {

+	    free(new->filename);

+	    free(new->virname);

+	    free(new);

+	    ret = CL_EMALFDB;

+	    break;

+	} else {

+	    if(!strcmp(pt, "*"))

+		new->compr = -1;

+	    else

+		new->compr = atoi(pt);

+	    free(pt);

+	}

+

+	new->next = (*root)->zip_mlist;

+	(*root)->zip_mlist = new;

+    }

+

+    if(!line) {

+	cli_errmsg("Empty database file\n");

+	cl_free(*root);

+	return CL_EMALFDB;

+    }

+

+    if(ret) {

+	cli_errmsg("Problem parsing database at line %d\n", line);

+	cl_free(*root);

+	return ret;

+    }

+

+    if(signo)

+	*signo += (line - comments);

+

+    return 0;

+}

+

 int cl_loaddb(const char *filename, struct cl_node **root, unsigned int *signo)

 {

 	FILE *fd;

@@ -730,6 +870,9 @@ int cl_loaddb(const char *filename, struct cl_node **root, unsigned int *signo)

     } else if(cli_strbcasestr(filename, ".ndb")) {

 	ret = cli_loadndb(fd, root, signo);

+    } else if(cli_strbcasestr(filename, ".zmd")) {

+	ret = cli_loadzmd(fd, root, signo);

+

     } else {

 	cli_dbgmsg("cl_loaddb: unknown extension - assuming old database format\n");

 	ret = cli_loaddb(fd, root, signo);

@@ -296,8 +296,9 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	ZZIP_FILE *zfp;

 	FILE *tmp = NULL;

 	char *buff;

-	int fd, bytes, files = 0, ret = CL_CLEAN;

+	int fd, bytes, files = 0, ret = CL_CLEAN, encrypted;

 	struct stat source;

+	struct cli_zip_node *mdata;

 	zzip_error_t err;

@@ -327,7 +328,9 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	    break;

 	}

-	cli_dbgmsg("Zip: %s, compressed: %u, normal: %u, ratio: %d (max: %d)\n", zdirent.d_name, zdirent.d_csize, zdirent.st_size, zdirent.d_csize ? (zdirent.st_size / zdirent.d_csize) : 0, limits ? limits->maxratio : -1 );

+	encrypted = zdirent.d_flags;

+

+	cli_dbgmsg("Zip: %s, crc32: 0x%x, encrypted: %d, compressed: %u, normal: %u, ratio: %d (max: %d)\n", zdirent.d_name, zdirent.d_crc32, encrypted, zdirent.d_csize, zdirent.st_size, zdirent.d_csize ? (zdirent.st_size / zdirent.d_csize) : 0, limits ? limits->maxratio : -1);

 	if(!zdirent.st_size) {

 	    files++;

@@ -340,6 +343,39 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	    continue;

 	}

+	/* Scan metadata */

+	mdata = root->zip_mlist;

+	do {

+	    if(mdata->encrypted != encrypted)

+		continue;

+

+	    if(mdata->crc32 && mdata->crc32 != zdirent.d_crc32)

+		continue;

+

+	    if(mdata->csize > 0 && mdata->csize != zdirent.d_csize)

+		continue;

+

+	    if(mdata->size >= 0 && mdata->size != zdirent.st_size)

+		continue;

+

+	    if(mdata->compr >= 0 && mdata->compr != zdirent.d_compr)

+		continue;

+

+	    /* FIXME: add support for regex */

+	    /*if(mdata->filename && !strstr(zdirent.d_name, mdata->filename))*/

+	    if(mdata->filename && strcmp(zdirent.d_name, mdata->filename))

+		continue;

+

+	    break; /* matched */

+

+	} while((mdata = mdata->next));

+

+	if(mdata) {

+	    *virname = mdata->virname;

+	    ret = CL_VIRUS;

+	    break;

+	}

+

 	/* 

 	 * Workaround for archives created with ICEOWS.

 	 * ZZIP_DIRENT does not contain information on file type

@@ -365,7 +401,7 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	    break;

         }

-	if(DETECT_ENCRYPTED && (zdirent.d_flags & 1 )) {

+	if(DETECT_ENCRYPTED && encrypted) {

 	    files++;

 	    cli_dbgmsg("Zip: Encrypted files found in archive.\n");

 	    lseek(desc, 0, SEEK_SET);

@@ -129,6 +129,28 @@ char *cli_hex2str(const char *hex)

     return str;

 }

+int cli_hex2num(const char *hex)

+{

+	int numChars = 0;

+	int hexval, ret = 0, len, i;

+

+

+    len = strlen(hex);

+

+    if(len % 2 != 0) {

+	cli_errmsg("cli_hex2num(): Malformed hexstring: %s (length: %d)\n", hex, len);

+	return -1;

+    }

+

+    for(i = 0; i < len; i++) {

+	if((hexval = cli_hex2int(hex[i])) < 0)

+	    break;

+	ret = (ret << 4) | hexval;

+    }

+

+    return ret;

+}

+

 char *cli_str2hex(const char *string, unsigned int len)

 {

 	char *hexstr;

@@ -24,6 +24,7 @@ int cli_chomp(char *string);

 char *cli_strtok(const char *line, int field, const char *delim);

 short int *cli_hex2si(const char *hex);

 char *cli_hex2str(const char *hex);

+int cli_hex2num(const char *hex);

 char *cli_str2hex(const char *string, unsigned int len);

 char *cli_strtokbuf(const char *input, int fieldno, const char *delim, char *output);

 const char *cli_memstr(const char *haystack, int hs, const char *needle, int ns);