@@ -4474,9 +4474,40 @@ int cli_load(const char *filename, struct cl_engine *engine, unsigned int *signo

     return ret;

 }

+struct db_ll_entry {

+    char *path;

+    unsigned int load_priority;

+    struct db_ll_entry *next;

+};

+

+static void

+cli_insertdbtoll(struct db_ll_entry **head, struct db_ll_entry *entry)

+{

+    struct db_ll_entry *iter, *prev;

+    if (NULL == *head) {

+        *head       = entry;

+        entry->next = NULL;

+        return;

+    }

+    for (prev = NULL, iter = *head; iter != NULL; prev = iter, iter = iter->next) {

+        if (entry->load_priority < iter->load_priority) {

+            if (NULL == prev) {

+                *head = entry;

+            } else {

+                prev->next = entry;

+            }

+            entry->next = iter;

+            return;

+        }

+    }

+    prev->next  = entry;

+    entry->next = NULL;

+    return;

+}

+

 static int cli_loaddbdir(const char *dirname, struct cl_engine *engine, unsigned int *signo, unsigned int options)

 {

-    DIR *dd;

+    DIR *dd = NULL;

     struct dirent *dent;

 #if defined(HAVE_READDIR_R_3) || defined(HAVE_READDIR_R_2)

     union {

@@ -4484,16 +4515,21 @@ static int cli_loaddbdir(const char *dirname, struct cl_engine *engine, unsigned

         char b[offsetof(struct dirent, d_name) + NAME_MAX + 1];

     } result;

 #endif

-    char *dbfile;

-    int ret = CL_EOPEN, have_cld, ends_with_sep = 0;

+    char *dbfile = NULL;

+    int ret = CL_EOPEN, have_daily_cld = 0, have_daily_cvd = 0, ends_with_sep = 0;

     size_t dirname_len;

-    struct cl_cvd *daily_cld, *daily_cvd;

+    struct cl_cvd *daily_cld = NULL;

+    struct cl_cvd *daily_cvd = NULL;

+    struct db_ll_entry *head = NULL;

+    struct db_ll_entry *iter;

+    struct db_ll_entry *next;

     cli_dbgmsg("Loading databases from %s\n", dirname);

     if ((dd = opendir(dirname)) == NULL) {

         cli_errmsg("cli_loaddbdir(): Can't open directory %s\n", dirname);

-        return CL_EOPEN;

+        ret = CL_EOPEN;

+        goto cleanup;

     }

     dirname_len = strlen(dirname);

@@ -4504,7 +4540,6 @@ static int cli_loaddbdir(const char *dirname, struct cl_engine *engine, unsigned

         }

     }

-    /* first round - load .ign and .ign2 files */

 #ifdef HAVE_READDIR_R_3

     while (!readdir_r(dd, &result.d, &dent) && dent) {

 #elif defined(HAVE_READDIR_R_2)

@@ -4512,159 +4547,156 @@ static int cli_loaddbdir(const char *dirname, struct cl_engine *engine, unsigned

 #else

     while ((dent = readdir(dd))) {

 #endif

-        if (dent->d_ino) {

-            if (cli_strbcasestr(dent->d_name, ".ign") || cli_strbcasestr(dent->d_name, ".ign2")) {

-                dbfile = (char *)cli_malloc(strlen(dent->d_name) + dirname_len + 2);

-                if (!dbfile) {

-                    cli_errmsg("cli_loaddbdir(): dbfile == NULL\n");

-                    closedir(dd);

-                    return CL_EMEM;

+        struct db_ll_entry *entry;

+        unsigned int load_priority;

+

+        if (!dent->d_ino) {

+            continue;

+        }

+        if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, "..")) {

+            continue;

+        }

+        if (!CLI_DBEXT(dent->d_name)) {

+            continue;

+        }

+

+        dbfile = (char *)cli_malloc(strlen(dent->d_name) + dirname_len + 2);

+        if (!dbfile) {

+            cli_errmsg("cli_loaddbdir(): dbfile == NULL\n");

+            ret = CL_EMEM;

+            goto cleanup;

+        }

+        if (ends_with_sep)

+            sprintf(dbfile, "%s%s", dirname, dent->d_name);

+        else

+            sprintf(dbfile, "%s" PATHSEP "%s", dirname, dent->d_name);

+

+#define DB_LOAD_PRIORITY_IGN 1

+#define DB_LOAD_PRIORITY_DAILY_CLD 2

+#define DB_LOAD_PRIORITY_DAILY_CVD 3

+#define DB_LOAD_PRIORITY_LOCAL_GDB 4

+#define DB_LOAD_PRIORITY_DAILY_CFG 5

+#define DB_LOAD_PRIORITY_CRB 6

+#define DB_LOAD_PRIORITY_NORMAL 7

+

+        if (cli_strbcasestr(dent->d_name, ".ign") || cli_strbcasestr(dent->d_name, ".ign2")) {

+            /* load .ign and .ign2 files first */

+            load_priority = DB_LOAD_PRIORITY_IGN;

+

+        } else if (!strcmp(dent->d_name, "daily.cld")) {

+            /* the daily db must be loaded before main */

+            load_priority = DB_LOAD_PRIORITY_DAILY_CLD;

+

+            have_daily_cld = !access(dbfile, R_OK);

+            if (have_daily_cld) {

+                daily_cld = cl_cvdhead(dbfile);

+                if (!daily_cld) {

+                    cli_errmsg("cli_loaddbdir(): error parsing header of %s\n", dbfile);

+                    ret = CL_EMALFDB;

+                    goto cleanup;

                 }

-                if (ends_with_sep)

-                    sprintf(dbfile, "%s%s", dirname, dent->d_name);

-                else

-                    sprintf(dbfile, "%s" PATHSEP "%s", dirname, dent->d_name);

-                ret = cli_load(dbfile, engine, signo, options, NULL);

-                if (ret) {

-                    cli_errmsg("cli_loaddbdir(): error loading database %s\n", dbfile);

-                    free(dbfile);

-                    closedir(dd);

-                    return ret;

+            }

+

+        } else if (!strcmp(dent->d_name, "daily.cvd")) {

+            load_priority = DB_LOAD_PRIORITY_DAILY_CVD;

+

+            have_daily_cvd = !access(dbfile, R_OK);

+            if (have_daily_cvd) {

+                daily_cvd = cl_cvdhead(dbfile);

+                if (!daily_cvd) {

+                    cli_errmsg("cli_loaddbdir(): error parsing header of %s\n", dbfile);

+                    ret = CL_EMALFDB;

+                    goto cleanup;

                 }

-                free(dbfile);

             }

-        }

-    }

-    /* the daily db must be loaded before main */

-    dbfile = (char *)cli_malloc(dirname_len + 20);

-    if (!dbfile) {

-        closedir(dd);

-        cli_errmsg("cli_loaddbdir: Can't allocate memory for dbfile\n");

-        return CL_EMEM;

-    }

+        } else if (!strcmp(dent->d_name, "local.gdb")) {

+            load_priority = DB_LOAD_PRIORITY_LOCAL_GDB;

-    if (ends_with_sep)

-        sprintf(dbfile, "%sdaily.cld", dirname);

-    else

-        sprintf(dbfile, "%s" PATHSEP "daily.cld", dirname);

-    have_cld = !access(dbfile, R_OK);

-    if (have_cld) {

-        daily_cld = cl_cvdhead(dbfile);

-        if (!daily_cld) {

-            cli_errmsg("cli_loaddbdir(): error parsing header of %s\n", dbfile);

+        } else if (!strcmp(dent->d_name, "daily.cfg")) {

+            load_priority = DB_LOAD_PRIORITY_DAILY_CFG;

+

+        } else if ((options & CL_DB_OFFICIAL_ONLY) && !strstr(dirname, "clamav-") && !cli_strbcasestr(dent->d_name, ".cld") && !cli_strbcasestr(dent->d_name, ".cvd")) {

+            // TODO Should this be higher up in the list? Should we

+            // ignore .ign/.ign2 files and the local.gdb file when this

+            // flag is set?

+            cli_dbgmsg("Skipping unofficial database %s\n", dent->d_name);

             free(dbfile);

-            closedir(dd);

-            return CL_EMALFDB;

+            dbfile = NULL;

+            continue;

+

+        } else if (cli_strbcasestr(dent->d_name, ".crb")) {

+            /* .cat files cannot be loaded successfully unless there are .crb

+         * rules that whitelist the certs used to sign the catalog files.

+         * Therefore, we need to ensure the .crb rules are loaded prior */

+            load_priority = DB_LOAD_PRIORITY_CRB;

+

+        } else {

+            load_priority = DB_LOAD_PRIORITY_NORMAL;

+        }

+

+        entry = malloc(sizeof(*entry));

+        if (NULL == entry) {

+            cli_errmsg("cli_loaddbdir(): entry == NULL\n");

+            ret = CL_EMEM;

+            goto cleanup;

         }

+

+        entry->path          = dbfile;

+        dbfile               = NULL;

+        entry->load_priority = load_priority;

+        cli_insertdbtoll(&head, entry);

     }

-    if (ends_with_sep)

-        sprintf(dbfile, "%sdaily.cvd", dirname);

-    else

-        sprintf(dbfile, "%s" PATHSEP "daily.cvd", dirname);

-    if (!access(dbfile, R_OK)) {

-        if (have_cld) {

-            daily_cvd = cl_cvdhead(dbfile);

-            if (!daily_cvd) {

-                cli_errmsg("cli_loaddbdir(): error parsing header of %s\n", dbfile);

-                free(dbfile);

-                cl_cvdfree(daily_cld);

-                closedir(dd);

-                return CL_EMALFDB;

+

+    /* The list entries are stored in priority order, so now just loop through

+     * and load everything.

+     * NOTE: If there's a daily.cld and a daily.cvd, we'll only load whichever

+     * has the highest version number. */

+

+    // TODO Should we treat all cld/cvd pairs like we do the daily ones?

+    for (iter = head; iter != NULL; iter = iter->next) {

+

+        if (DB_LOAD_PRIORITY_DAILY_CLD == iter->load_priority && have_daily_cvd) {

+            if (daily_cld->version <= daily_cvd->version) {

+                continue;

             }

+

+        } else if (DB_LOAD_PRIORITY_DAILY_CVD == iter->load_priority && have_daily_cld) {

             if (daily_cld->version > daily_cvd->version) {

-                if (ends_with_sep)

-                    sprintf(dbfile, "%sdaily.cld", dirname);

-                else

-                    sprintf(dbfile, "%s" PATHSEP "daily.cld", dirname);

+                continue;

             }

-            cl_cvdfree(daily_cvd);

         }

-    } else {

-        if (ends_with_sep)

-            sprintf(dbfile, "%sdaily.cld", dirname);

-        else

-            sprintf(dbfile, "%s" PATHSEP "daily.cld", dirname);

+

+        ret = cli_load(iter->path, engine, signo, options, NULL);

+        if (ret) {

+            cli_errmsg("cli_loaddbdir(): error loading database %s\n", iter->path);

+            goto cleanup;

+        }

     }

-    if (have_cld)

-        cl_cvdfree(daily_cld);

-    if (!access(dbfile, R_OK) && (ret = cli_load(dbfile, engine, signo, options, NULL))) {

-        free(dbfile);

-        closedir(dd);

-        return ret;

+cleanup:

+    for (iter = head; iter != NULL; iter = next) {

+        next = iter->next;

+        free(iter->path);

+        free(iter);

     }

-    /* try to load local.gdb next */

-    if (ends_with_sep)

-        sprintf(dbfile, "%slocal.gdb", dirname);

-    else

-        sprintf(dbfile, "%s" PATHSEP "local.gdb", dirname);

-    if (!access(dbfile, R_OK) && (ret = cli_load(dbfile, engine, signo, options, NULL))) {

+    if (NULL != dbfile) {

         free(dbfile);

-        closedir(dd);

-        return ret;

     }

-    /* check for and load daily.cfg */

-    if (ends_with_sep)

-        sprintf(dbfile, "%sdaily.cfg", dirname);

-    else

-        sprintf(dbfile, "%s" PATHSEP "daily.cfg", dirname);

-    if (!access(dbfile, R_OK) && (ret = cli_load(dbfile, engine, signo, options, NULL))) {

-        free(dbfile);

+    if (NULL != dd) {

         closedir(dd);

-        return ret;

     }

-    free(dbfile);

-

-    /* second round - load everything else */

-    rewinddir(dd);

-#ifdef HAVE_READDIR_R_3

-    while (!readdir_r(dd, &result.d, &dent) && dent) {

-#elif defined(HAVE_READDIR_R_2)

-    while ((dent = (struct dirent *)readdir_r(dd, &result.d))) {

-#else

-    while ((dent = readdir(dd))) {

-#endif

-        if (dent->d_ino) {

-            if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, "..")) {

-                continue;

-            }

-

-            /* Skip everything that's already been loaded in or ignored */

-            if (cli_strbcasestr(dent->d_name, ".ign") || cli_strbcasestr(dent->d_name, ".ign2") || !strcmp(dent->d_name, "daily.cvd") || !strcmp(dent->d_name, "daily.cld") || !strcmp(dent->d_name, "local.gdb") || !strcmp(dent->d_name, "daily.cfg")) {

-                continue;

-            }

-            if (CLI_DBEXT(dent->d_name)) {

-                if ((options & CL_DB_OFFICIAL_ONLY) && !strstr(dirname, "clamav-") && !cli_strbcasestr(dent->d_name, ".cld") && !cli_strbcasestr(dent->d_name, ".cvd")) {

-                    cli_dbgmsg("Skipping unofficial database %s\n", dent->d_name);

-                    continue;

-                }

+    if (NULL != daily_cld) {

+        cl_cvdfree(daily_cld);

+    }

-                dbfile = (char *)cli_malloc(strlen(dent->d_name) + dirname_len + 2);

-                if (!dbfile) {

-                    cli_errmsg("cli_loaddbdir(): dbfile == NULL\n");

-                    closedir(dd);

-                    return CL_EMEM;

-                }

-                if (ends_with_sep)

-                    sprintf(dbfile, "%s%s", dirname, dent->d_name);

-                else

-                    sprintf(dbfile, "%s" PATHSEP "%s", dirname, dent->d_name);

-                ret = cli_load(dbfile, engine, signo, options, NULL);

-                if (ret) {

-                    cli_errmsg("cli_loaddbdir(): error loading database %s\n", dbfile);

-                    free(dbfile);

-                    closedir(dd);

-                    return ret;

-                }

-                free(dbfile);

-            }

-        }

+    if (NULL != daily_cvd) {

+        cl_cvdfree(daily_cvd);

     }

-    closedir(dd);

+

     if (ret == CL_EOPEN)

         cli_errmsg("cli_loaddbdir(): No supported database files found in %s\n", dirname);