@@ -1,3 +1,8 @@

+Wed Dec 20 02:19:45 CET 2006 (tk)

+---------------------------------

+  * libclamav: options cleanup; requires additional changes in mbox.c and

+	       clamav-milter

+

 Tue Dec 19 21:44:13 CET 2006 (tk)

 ---------------------------------

   * libclamav/regex_list.c: strict whitelisting (Edvin)

@@ -308,10 +308,10 @@ int main(int argc, char **argv)

     dbdir = cfgopt(copt, "DatabaseDirectory")->strarg;

     logg("#Reading databases from %s\n", dbdir);

-    if(!cfgopt(copt, "DetectPhishing")->enabled) {

-	dboptions |= CL_DB_NOPHISHING;

+    if(cfgopt(copt, "DetectPhishing")->enabled)

+	dboptions |= CL_DB_PHISHING;

+    else

 	logg("Not loading phishing signatures.\n");

-    }

     if(cfgopt(copt, "NodalCoreAcceleration")->enabled) {

 #ifdef HAVE_NCORE

@@ -300,10 +300,10 @@ int acceptloop_th(int *socketds, int nsockets, struct cl_node *root, unsigned in

     max_threads = cfgopt(copt, "MaxThreads")->numarg;

 #ifdef CL_EXPERIMENTAL

-    if(!cfgopt(copt,"PhishingScanURLs")->enabled)

-	dboptions |= CL_DB_NOPHISHING_URLS;

+    if(cfgopt(copt,"PhishingScanURLs")->enabled)

+	dboptions |= CL_DB_PHISHING_URLS;

     if(cfgopt(copt,"PhishingStrictURLCheck")->enabled)

-	options |= CL_PHISH_NO_DOMAINLIST;

+	options |= CL_SCAN_PHISHING_DOMAINLIST;

 #endif

     if(cfgopt(copt, "ScanArchive")->enabled || cfgopt(copt, "ClamukoScanArchive")->enabled) {

@@ -89,14 +89,14 @@ int scanmanager(const struct optstruct *opt)

     if(opt_check(opt, "ncore"))

 	dboptions |= CL_DB_NCORE;

-    if(opt_check(opt, "no-phishing"))

-	dboptions |= CL_DB_NOPHISHING;

+    if(!opt_check(opt, "no-phishing"))

+	dboptions |= CL_DB_PHISHING;

 #ifdef CL_EXPERIMENTAL

-    if(opt_check(opt,"no-phishing-scan-urls"))

-	dboptions |= CL_DB_NOPHISHING_URLS;

+    if(!opt_check(opt,"no-phishing-scan-urls"))

+	dboptions |= CL_DB_PHISHING_URLS;

     if(opt_check(opt,"phishing-strict-url-check"))

-	options |= CL_PHISH_NO_DOMAINLIST;

+	options |= CL_SCAN_PHISHING_DOMAINLIST;

 #endif

     if(opt_check(opt, "dev-ac-only")) {

@@ -69,27 +69,27 @@ extern "C"

 /* db options */

 #define CL_DB_NCORE	    0x1

-#define CL_DB_NOPHISHING    0x2

+#define CL_DB_PHISHING	    0x2

 #define CL_DB_ACONLY	    0x4 /* WARNING: only for developers */

-#define CL_DB_NOPHISHING_URLS 0x8

+#define CL_DB_PHISHING_URLS 0x8

 /* recommended db settings */

-#define CL_DB_STDOPT	    0x0

+#define CL_DB_STDOPT	    CL_DB_PHISHING

 /* scan options */

-#define CL_SCAN_RAW		0x0

-#define CL_SCAN_ARCHIVE		0x1

-#define CL_SCAN_MAIL		0x2

-#define CL_SCAN_OLE2		0x4

-#define CL_SCAN_BLOCKENCRYPTED	0x8

-#define CL_SCAN_HTML		0x10

-#define CL_SCAN_PE		0x20

-#define CL_SCAN_BLOCKBROKEN	0x40

-#define CL_SCAN_MAILURL		0x80

-#define CL_SCAN_BLOCKMAX	0x100

-#define CL_SCAN_ALGO		0x200

-#define CL_PHISH_NO_DOMAINLIST  0x800

-#define CL_SCAN_ELF		0x1000

+#define CL_SCAN_RAW		    0x0

+#define CL_SCAN_ARCHIVE		    0x1

+#define CL_SCAN_MAIL		    0x2

+#define CL_SCAN_OLE2		    0x4

+#define CL_SCAN_BLOCKENCRYPTED	    0x8

+#define CL_SCAN_HTML		    0x10

+#define CL_SCAN_PE		    0x20

+#define CL_SCAN_BLOCKBROKEN	    0x40

+#define CL_SCAN_MAILURL		    0x80

+#define CL_SCAN_BLOCKMAX	    0x100

+#define CL_SCAN_ALGO		    0x200

+#define CL_SCAN_PHISHING_DOMAINLIST 0x800

+#define CL_SCAN_ELF		    0x1000

 /* recommended scan settings */

 #define CL_SCAN_STDOPT		(CL_SCAN_ARCHIVE | CL_SCAN_MAIL | CL_SCAN_OLE2 | CL_SCAN_HTML | CL_SCAN_PE | CL_SCAN_ALGO | CL_SCAN_ELF) 

@@ -19,6 +19,9 @@

  *  MA 02110-1301, USA.

  *

  *  $Log: phishcheck.c,v $

+ *  Revision 1.16  2006/12/20 01:23:50  tkojm

+ *  options cleanup

+ *

  *  Revision 1.15  2006/12/19 20:30:17  tkojm

  *  fix some compiler warnings

  *

@@ -939,8 +942,8 @@ int phishingScan(message* m,const char* dir,cli_ctx* ctx,tag_arguments_t* hrefs)

 			urls.flags	 = strncmp((char*)hrefs->tag[i],href_text,href_text_len)? (CL_PHISH_ALL_CHECKS&~CHECK_SSL): CL_PHISH_ALL_CHECKS;

 			if (!(urls.flags&CHECK_IMG_URL) && !strncmp((char*)hrefs->tag[i],src_text,src_text_len))

 				continue;

-			if (ctx->options&CL_PHISH_NO_DOMAINLIST)

-				urls.flags &= ~DOMAINLIST_REQUIRED;

+			if (ctx->options&CL_SCAN_PHISHING_DOMAINLIST)

+				urls.flags |= DOMAINLIST_REQUIRED;

 			string_init_c(&urls.realLink,(char*)hrefs->value[i]);

 /*			if(!hrefs->contents[i]->isClosed) {

 				blobAddData(hrefs->contents[i],empty_string,1);

@@ -502,7 +502,7 @@ int cli_initengine(struct cl_engine **engine, unsigned int options)

     }

 #ifdef CL_EXPERIMENTAL

-    if(!(options & CL_DB_NOPHISHING_URLS))

+    if(options & CL_DB_PHISHING_URLS)

 	if((ret = phishing_init(*engine)))

 	    return ret;

 #endif

@@ -673,7 +673,7 @@ static int cli_loadndb(FILE *fd, struct cl_engine **engine, unsigned int *signo,

 	struct cli_matcher *root;

 	int line = 0, sigs = 0, ret = 0;

 	unsigned short target;

-	unsigned int nophish = options & CL_DB_NOPHISHING;

+	unsigned int phish = options & CL_DB_PHISHING;

     if((ret = cli_initengine(engine, options))) {

@@ -692,7 +692,7 @@ static int cli_loadndb(FILE *fd, struct cl_engine **engine, unsigned int *signo,

 	if(!strncmp(buffer, "Exploit.JPEG.Comment", 20)) /* temporary */

 	    continue;

-	if(nophish)

+	if(!phish)

 	    if(!strncmp(buffer, "HTML.Phishing", 13) || !strncmp(buffer, "Email.Phishing", 14))

 		continue;

@@ -1168,12 +1168,12 @@ static int cli_load(const char *filename, struct cl_engine **engine, unsigned in

 	    skipped = 1;

 #ifdef CL_EXPERIMENTAL

     } else if(cli_strbcasestr(filename, ".wdb")) {

-	if(!(options & CL_DB_NOPHISHING_URLS))

+	if(options & CL_DB_PHISHING_URLS)

 	    ret = cli_loadwdb(fd, engine, options);

 	else

 	    skipped = 1;

     } else if(cli_strbcasestr(filename, ".pdb")) {

-	if(!(options & CL_DB_NOPHISHING_URLS))

+	if(options & CL_DB_PHISHING_URLS)

 	    ret = cli_loadpdb(fd, engine, options);

 	else

 	    skipped = 1;