@@ -1,3 +1,10 @@

+Tue Sep 12 20:42:04 CEST 2006 (acab)

+------------------------------------

+  * sigtool: Merge of the related part of the phishing module from

+             Torok Edvin <edwintorok*gmail.com>

+             Part of the Google Summer of Code program

+  * libclamav: Initial merge of the phishing module - inactive

+

 Tue Sep 12 01:04:39 CEST 2006 (tk)

 ----------------------------------

   * clamd, clamdscan: add support for hardware acceleration

@@ -90,6 +90,8 @@ extern "C"

 #define CL_SCAN_MAILURL		128

 #define CL_SCAN_BLOCKMAX	256

 #define CL_SCAN_ALGO		512

+#define CL_SCAN_NOPHISHING      1024

+#define CL_PHISH_NO_DOMAINLIST    4096

 /* recommended options */

 #define CL_SCAN_STDOPT		(CL_SCAN_ARCHIVE | CL_SCAN_MAIL | CL_SCAN_OLE2 | CL_SCAN_HTML | CL_SCAN_PE | CL_SCAN_ALGO) 

new file mode 100644

@@ -0,0 +1,33 @@

+/*

+ *  Phishing module: domain list implementation.

+ *

+ *

+ *  This program is free software; you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License as published by

+ *  the Free Software Foundation; either version 2 of the License, or

+ *  (at your option) any later version.

+ *

+ *  This program is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with this program; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

+ *  MA 02110-1301, USA.

+ *

+ */

+#ifndef _PHISH_DOMAINCHECK_DB_H

+#define _PHISH_DOMAINCHECK_DB_H

+

+int cli_loadpdb(FILE* fd, unsigned int options);

+int build_domainlist(void);

+int init_domainlist(void);

+void domainlist_done(void);

+void domainlist_cleanup(void);

+int is_domainlist_ok(void);

+int domainlist_match(const char* real_url,const char* display_url,int hostOnly,unsigned short* flags);

+

+#endif

new file mode 100644

@@ -0,0 +1,34 @@

+/*

+ *  Phishing module: whitelist implementation.

+ *

+ *

+ *  This program is free software; you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License as published by

+ *  the Free Software Foundation; either version 2 of the License, or

+ *  (at your option) any later version.

+ *

+ *  This program is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with this program; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

+ *  MA 02110-1301, USA.

+ *

+ */

+

+#ifndef _WHITELIST_H

+#define _WHITELIST_H

+

+int cli_loadwdb(FILE* fd, unsigned int options);

+int build_whitelist(void);

+int init_whitelist(void);

+void whitelist_done(void);

+void whitelist_cleanup(void);

+int is_whitelist_ok(void);

+int whitelist_match(const char* real_url,const char* display_url,int hostOnly);

+

+#endif

@@ -41,6 +41,14 @@

 #include "str.h"

 #include "defaults.h"

+#ifdef CL_EXPERIMENTAL

+/*

+#include "phish_whitelist.h"

+#include "phish_domaincheck_db.h"

+*/

+#endif

+

+

 #if defined(HAVE_READDIR_R_3) || defined(HAVE_READDIR_R_2)

 #include <limits.h>

 #include <stddef.h>

@@ -1085,7 +1093,20 @@ static int cli_load(const char *filename, struct cl_engine **engine, unsigned in

 	else

 #endif

 	    skipped = 1;

-

+#ifdef CL_EXPERIMENTAL

+/*

+    } else if(cli_strbcasestr(filename, ".wdb")) {

+	if(!(options & CL_SCAN_NOPHISHING))

+	    ret = cli_loadwdb(fd, options);

+	else

+	    skipped = 1;

+    } else if(cli_strbcasestr(filename, ".pdb")) {

+	if(!(options & CL_SCAN_NOPHISHING))

+	    ret = cli_loadpdb(fd, options);

+	else

+	    skipped = 1;

+*/

+#endif

     } else {

 	cli_dbgmsg("cli_load: unknown extension - assuming old database format\n");

 	ret = cli_loaddb(fd, engine, signo, options);

@@ -1150,6 +1171,12 @@ static int cli_loaddbdir(const char *dirname, struct cl_engine **engine, unsigne

 	     cli_strbcasestr(dent->d_name, ".sdb")  ||

 	     cli_strbcasestr(dent->d_name, ".zmd")  ||

 	     cli_strbcasestr(dent->d_name, ".rmd")  ||

+#ifdef CL_EXPERIMENTAL

+/*

+	     cli_strbcasestr(dent->d_name, ".pdb")  ||

+	     cli_strbcasestr(dent->d_name, ".wdb")  ||

+*/

+#endif

 	     cli_strbcasestr(dent->d_name, ".hw")  ||

 	     cli_strbcasestr(dent->d_name, ".inc")  ||

 	     cli_strbcasestr(dent->d_name, ".cvd"))) {

@@ -1266,6 +1293,12 @@ int cl_statinidir(const char *dirname, struct cl_stat *dbstat)

 	    cli_strbcasestr(dent->d_name, ".sdb")  || 

 	    cli_strbcasestr(dent->d_name, ".zmd")  || 

 	    cli_strbcasestr(dent->d_name, ".rmd")  || 

+#ifdef CL_EXPERIMENTAL

+/*

+	    cli_strbcasestr(dent->d_name, ".pdb")  ||

+	    cli_strbcasestr(dent->d_name, ".wdb")  ||

+*/

+#endif

 	    cli_strbcasestr(dent->d_name, ".hw")   ||

 	    cli_strbcasestr(dent->d_name, ".inc")   ||

 	    cli_strbcasestr(dent->d_name, ".cvd"))) {

@@ -1340,6 +1373,12 @@ int cl_statchkdir(const struct cl_stat *dbstat)

 	    cli_strbcasestr(dent->d_name, ".sdb")  || 

 	    cli_strbcasestr(dent->d_name, ".zmd")  || 

 	    cli_strbcasestr(dent->d_name, ".rmd")  || 

+#ifdef CL_EXPERIMENTAL

+/*

+	    cli_strbcasestr(dent->d_name, ".pdb")  ||

+	    cli_strbcasestr(dent->d_name, ".wdb")  ||

+*/

+#endif

 	    cli_strbcasestr(dent->d_name, ".hw")   ||

 	    cli_strbcasestr(dent->d_name, ".inc")   ||

 	    cli_strbcasestr(dent->d_name, ".cvd"))) {

@@ -481,7 +481,12 @@ static int build(struct optstruct *opt)

 				 "main.ndb", "daily.ndb", "main.sdb",

 				 "daily.sdb", "main.zmd", "daily.zmd",

 				 "main.rmd", "daily.rmd", "main.fp",

-				 "daily.fp", "daily.info", "main.info", NULL };

+				 "daily.fp", "daily.info", "main.info",

+#ifdef CL_EXPERIMENTAL

+				 /* TODO: add support for main.[wp]db */

+				 "daily.wdb","daily.pdb",

+#endif

+				 NULL };

 		args[2] = tarfile;

 		if(!opt_check(opt, "debug")) {

 		    if((dn = open("/dev/null", O_WRONLY)) == -1) {