diff -Nru clamav-0.100.3+dfsg/aclocal.m4 clamav-0.101.4+dfsg/aclocal.m4 --- clamav-0.100.3+dfsg/aclocal.m4 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/aclocal.m4 2019-08-20 16:08:49.000000000 +0000 @@ -216,6 +216,66 @@ [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) +# Copyright (C) 2011-2013 Free Software Foundation, Inc. +# +# This file is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# AM_PROG_AR([ACT-IF-FAIL]) +# ------------------------- +# Try to determine the archiver interface, and trigger the ar-lib wrapper +# if it is needed. If the detection of archiver interface fails, run +# ACT-IF-FAIL (default is to abort configure with a proper error message). +AC_DEFUN([AM_PROG_AR], +[AC_BEFORE([$0], [LT_INIT])dnl +AC_BEFORE([$0], [AC_PROG_LIBTOOL])dnl +AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl +AC_REQUIRE_AUX_FILE([ar-lib])dnl +AC_CHECK_TOOLS([AR], [ar lib "link -lib"], [false]) +: ${AR=ar} + +AC_CACHE_CHECK([the archiver ($AR) interface], [am_cv_ar_interface], + [AC_LANG_PUSH([C]) + am_cv_ar_interface=ar + AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int some_variable = 0;]])], + [am_ar_try='$AR cru libconftest.a conftest.$ac_objext >&AS_MESSAGE_LOG_FD' + AC_TRY_EVAL([am_ar_try]) + if test "$ac_status" -eq 0; then + am_cv_ar_interface=ar + else + am_ar_try='$AR -NOLOGO -OUT:conftest.lib conftest.$ac_objext >&AS_MESSAGE_LOG_FD' + AC_TRY_EVAL([am_ar_try]) + if test "$ac_status" -eq 0; then + am_cv_ar_interface=lib + else + am_cv_ar_interface=unknown + fi + fi + rm -f conftest.lib libconftest.a + ]) + AC_LANG_POP([C])]) + +case $am_cv_ar_interface in +ar) + ;; +lib) + # Microsoft lib, so override with the ar-lib wrapper script. + # FIXME: It is wrong to rewrite AR. + # But if we don't then we get into trouble of one sort or another. + # A longer-term fix would be to have automake use am__AR in this case, + # and then we could set am__AR="$am_aux_dir/ar-lib \$(AR)" or something + # similar. + AR="$am_aux_dir/ar-lib $AR" + ;; +unknown) + m4_default([$1], + [AC_MSG_ERROR([could not determine $AR interface])]) + ;; +esac +AC_SUBST([AR])dnl +]) + # AM_AUX_DIR_EXPAND -*- Autoconf -*- # Copyright (C) 2001-2013 Free Software Foundation, Inc. diff -Nru clamav-0.100.3+dfsg/clamav-config.h.in clamav-0.101.4+dfsg/clamav-config.h.in --- clamav-0.100.3+dfsg/clamav-config.h.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamav-config.h.in 2019-08-20 16:08:49.000000000 +0000 @@ -390,6 +390,9 @@ /* Define to 1 if you have the `strnlen' function. */ #undef HAVE_STRNLEN +/* Define to 1 if you have the `strnstr' function. */ +#undef HAVE_STRNSTR + /* Define to 1 if sysconf(_SC_PAGESIZE) is available */ #undef HAVE_SYSCONF_SC_PAGESIZE diff -Nru clamav-0.100.3+dfsg/clamav-milter/Makefile.in clamav-0.101.4+dfsg/clamav-milter/Makefile.in --- clamav-0.100.3+dfsg/clamav-milter/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamav-milter/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -130,6 +130,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -178,14 +179,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)" @@ -225,7 +226,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -350,6 +351,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOLIBCLAMAV DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -364,6 +367,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -378,6 +382,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -459,6 +468,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamav-types.h.in clamav-0.101.4+dfsg/clamav-types.h.in --- clamav-0.100.3+dfsg/clamav-types.h.in 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/clamav-types.h.in 2019-08-20 16:08:49.000000000 +0000 @@ -0,0 +1,84 @@ +/* + * Copyright (C) 2015-2018 Cisco Systems, Inc. and/or its affiliates. All rights reserved. + * Copyright (C) 2007-2008 Sourcefire, Inc. + * + * Authors: Tomasz Kojm, Micah Snyder + * + * @GENERATE_WARNING@ + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301, USA. + */ + +#ifndef __CLAMAV_TYPES_H +#define __CLAMAV_TYPES_H + +@INT_TYPES_HEADER@ + +@INT8_DEF@ +@UINT8_DEF@ + +@INT16_DEF@ +@UINT16_DEF@ + +@INT32_DEF@ +@UINT32_DEF@ + +@INT64_DEF@ +@UINT64_DEF@ + +/* Ensure we have print format types */ +/* PRIu64 should be in */ +#ifndef _SF64_PREFIX + @DEFINE_SF64_PREFIX@ +#endif + +#ifndef PRIu64 + #define PRIu64 _SF64_PREFIX "u" +#endif +#ifndef PRIx64 + #define PRIx64 _SF64_PREFIX "i" +#endif +#ifndef PRIi64 + #define PRIi64 _SF64_PREFIX "x" +#endif + +#ifndef STDu64 + #define STDu64 "%" PRIu64 + #define STDi64 "%" PRIi64 + #define STDx64 "%" PRIx64 +#endif + +/* PRIu32 should also be in */ +#ifndef PRIu32 + #ifndef _SF32_PREFIX + @DEFINE_SF32_PREFIX@ + #endif + + #define PRIu32 _SF32_PREFIX "u" + #define PRIi32 _SF32_PREFIX "i" + #define PRIx32 _SF32_PREFIX "x" +#endif + +#ifndef STDu32 + #define STDu32 "%" PRIu32 + #define STDi32 "%" PRIi32 + #define STDx32 "%" PRIx32 +#endif + +#ifndef INT32_MAX + #define INT32_MAX 2147483647 +#endif + +#endif diff -Nru clamav-0.100.3+dfsg/clambc/bcrun.c clamav-0.101.4+dfsg/clambc/bcrun.c --- clamav-0.100.3+dfsg/clambc/bcrun.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clambc/bcrun.c 2019-08-20 16:08:49.000000000 +0000 @@ -23,7 +23,6 @@ #if HAVE_CONFIG_H #include "clamav-config.h" #endif -#include "cltypes.h" #ifndef _WIN32 #include #endif diff -Nru clamav-0.100.3+dfsg/clambc/Makefile.in clamav-0.101.4+dfsg/clambc/Makefile.in --- clamav-0.100.3+dfsg/clambc/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clambc/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -109,6 +109,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -157,14 +158,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" @@ -189,7 +190,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -284,6 +285,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -298,6 +301,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -312,6 +316,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -393,6 +402,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamconf/clamconf.c clamav-0.101.4+dfsg/clamconf/clamconf.c --- clamav-0.100.3+dfsg/clamconf/clamconf.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamconf/clamconf.c 2019-08-20 16:08:49.000000000 +0000 @@ -40,6 +40,7 @@ #include "shared/optparser.h" #include "shared/misc.h" +#include "clamav-config.h" #include "libclamav/str.h" #include "libclamav/clamav.h" #include "libclamav/others.h" diff -Nru clamav-0.100.3+dfsg/clamconf/Makefile.in clamav-0.101.4+dfsg/clamconf/Makefile.in --- clamav-0.100.3+dfsg/clamconf/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamconf/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -129,6 +129,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -177,14 +178,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" @@ -209,7 +210,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -304,6 +305,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOTHREADS DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -318,6 +321,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -332,6 +336,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -413,6 +422,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamd/clamd.c clamav-0.101.4+dfsg/clamd/clamd.c --- clamav-0.100.3+dfsg/clamd/clamd.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/clamd.c 2019-08-20 16:08:49.000000000 +0000 @@ -90,6 +90,7 @@ printf("\n"); printf(" --help -h Show this help\n"); printf(" --version -V Show version number\n"); + printf(" --foreground -F Run in foreground; do not daemonize\n"); printf(" --debug Enable debug mode\n"); printf(" --config-file=FILE -c FILE Read configuration from FILE\n"); printf("\n"); diff -Nru clamav-0.100.3+dfsg/clamd/Makefile.in clamav-0.101.4+dfsg/clamd/Makefile.in --- clamav-0.100.3+dfsg/clamd/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -132,6 +132,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -180,14 +181,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = clamav-daemon.service clamav-daemon.socket CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(sbindir)" \ @@ -238,7 +239,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -361,6 +362,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -375,6 +378,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -389,6 +393,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -470,6 +479,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_ddd.c clamav-0.101.4+dfsg/clamd/onaccess_ddd.c --- clamav-0.100.3+dfsg/clamd/onaccess_ddd.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_ddd.c 2019-08-20 16:08:49.000000000 +0000 @@ -67,7 +67,7 @@ static void onas_ddd_handle_in_create(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask); static void onas_ddd_handle_in_moved_from(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd); static void onas_ddd_handle_in_delete(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd); -static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int options); +static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options); static void onas_ddd_exit(int sig); @@ -539,8 +539,9 @@ return; } -static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int options) { +static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options) { + int thread_started = 1; struct scth_thrarg *scth_tharg = NULL; pthread_attr_t scth_attr; pthread_t scth_pid = 0; @@ -549,20 +550,37 @@ if (pthread_attr_init(&scth_attr)) break; pthread_attr_setdetachstate(&scth_attr, PTHREAD_CREATE_JOINABLE); - if (!(scth_tharg = (struct scth_thrarg *) malloc(sizeof(struct scth_thrarg)))) break; + /* Allocate memory for arguments. Thread is responsible for freeing it. */ + if (!(scth_tharg = (struct scth_thrarg *) calloc(sizeof(struct scth_thrarg), 1))) break; + if (!(scth_tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break; - scth_tharg->options = options; + (void) memcpy(scth_tharg->options, tharg->options, sizeof(struct cl_scan_options)); + + scth_tharg->extra_options = extra_options; scth_tharg->opts = tharg->opts; scth_tharg->pathname = strdup(pathname); scth_tharg->engine = tharg->engine; - if (!pthread_create(&scth_pid, &scth_attr, onas_scan_th, scth_tharg)) break; - - free(scth_tharg); - scth_tharg = NULL; + thread_started = pthread_create(&scth_pid, &scth_attr, onas_scan_th, scth_tharg); } while(0); - if (!scth_tharg) logg("!ScanOnAccess: Unable to kick off extra scanning.\n"); + if (0 != thread_started) { + /* Failed to create thread. Free anything we may have allocated. */ + logg("!ScanOnAccess: Unable to kick off extra scanning.\n"); + if (NULL != scth_tharg) { + if (NULL != scth_tharg->pathname){ + free(scth_tharg->pathname); + scth_tharg->pathname = NULL; + } + if (NULL != scth_tharg->options) { + free(scth_tharg->options); + scth_tharg->options = NULL; + } + free(scth_tharg); + scth_tharg = NULL; + } + } + return; } diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_ddd.h clamav-0.101.4+dfsg/clamd/onaccess_ddd.h --- clamav-0.100.3+dfsg/clamd/onaccess_ddd.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_ddd.h 2019-08-20 16:08:49.000000000 +0000 @@ -21,19 +21,24 @@ #ifndef __ONAS_IN_H #define __ONAS_IN_H -#define ONAS_IN 0x01 -#define ONAS_FAN 0x02 +#include "shared/optparser.h" +#include "libclamav/clamav.h" + +/* + * Extra options for onas_scan_th(). + */ +#define ONAS_IN 0x01 +#define ONAS_FAN 0x02 #define MAX_WATCH_LEN 7 struct ddd_thrarg { int sid; - int options; + struct cl_scan_options *options; int fan_fd; uint64_t fan_mask; const struct optstruct *opts; const struct cl_engine *engine; - const struct cl_limits *limits; }; diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_fan.c clamav-0.101.4+dfsg/clamd/onaccess_fan.c --- clamav-0.100.3+dfsg/clamd/onaccess_fan.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_fan.c 2019-08-20 16:08:49.000000000 +0000 @@ -72,7 +72,7 @@ static int onas_fan_scanfile(int fan_fd, const char *fname, struct fanotify_event_metadata *fmd, int scan, int extinfo, struct thrarg *tharg) { struct fanotify_response res; - const char *virname; + const char *virname = NULL; int ret = 0; res.fd = fmd->fd; @@ -171,24 +171,36 @@ } } else if (!optget(tharg->opts, "OnAccessDisableDDD")->enabled) { + int thread_started = 1; do { if(pthread_attr_init(&ddd_attr)) break; pthread_attr_setdetachstate(&ddd_attr, PTHREAD_CREATE_JOINABLE); - if(!(ddd_tharg = (struct ddd_thrarg *) malloc(sizeof(struct ddd_thrarg)))) break; + /* Allocate memory for arguments. Thread is responsible for freeing it. */ + if (!(ddd_tharg = (struct ddd_thrarg *) calloc(sizeof(struct ddd_thrarg), 1))) break; + if (!(ddd_tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break; + (void) memcpy(ddd_tharg->options, tharg->options, sizeof(struct cl_scan_options)); ddd_tharg->fan_fd = onas_fan_fd; ddd_tharg->fan_mask = fan_mask; ddd_tharg->opts = tharg->opts; ddd_tharg->engine = tharg->engine; - ddd_tharg->options = tharg->options; - if(!pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg)) break; - - free(ddd_tharg); - ddd_tharg=NULL; + thread_started = pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg); } while(0); - if (!ddd_tharg) logg("!Unable to start dynamic directory determination.\n"); + + if (0 != thread_started) { + /* Failed to create thread. Free anything we may have allocated. */ + logg("!Unable to start dynamic directory determination.\n"); + if (NULL != ddd_tharg) { + if (NULL != ddd_tharg->options) { + free(ddd_tharg->options); + ddd_tharg->options = NULL; + } + free(ddd_tharg); + ddd_tharg = NULL; + } + } } else { if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) { @@ -341,7 +353,7 @@ static int cauth_scanfile(const char *fname, int extinfo, struct thrarg *tharg) { struct cb_context context; - const char *virname; + const char *virname = NULL; int ret = 0, fd; context.filename = fname; @@ -352,7 +364,7 @@ if(fd == -1) return -1; - if(cl_scandesc_callback(fd, &virname, NULL, tharg->engine, tharg->options, &context) == CL_VIRUS) { + if(cl_scandesc_callback(fd, fname, &virname, NULL, tharg->engine, tharg->options, &context) == CL_VIRUS) { if(extinfo && context.virsize) logg("ScanOnAccess: %s: %s(%s:%llu) FOUND\n", fname, virname, context.virhash, context.virsize); else diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_others.c clamav-0.101.4+dfsg/clamd/onaccess_others.c --- clamav-0.100.3+dfsg/clamd/onaccess_others.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_others.c 2019-08-20 16:08:49.000000000 +0000 @@ -94,7 +94,7 @@ return CHK_CLEAN; } -int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, int options, int extinfo) +int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, struct cl_scan_options *options, int extinfo) { int ret = 0; struct cb_context context; @@ -105,7 +105,7 @@ context.virsize = 0; context.scandata = NULL; - ret = cl_scandesc_callback(fd, virname, NULL, engine, options, &context); + ret = cl_scandesc_callback(fd, fname, virname, NULL, engine, options, &context); if (ret) { if (extinfo && context.virsize) diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_others.h clamav-0.101.4+dfsg/clamd/onaccess_others.h --- clamav-0.100.3+dfsg/clamd/onaccess_others.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_others.h 2019-08-20 16:08:49.000000000 +0000 @@ -22,6 +22,7 @@ #define __CLAMD_ONAS_OTHERS_H #include "shared/optparser.h" +#include "libclamav/clamav.h" typedef enum { CHK_CLEAN, @@ -30,6 +31,6 @@ } cli_check_t; int onas_fan_checkowner(int pid, const struct optstruct *opts); -int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, int options, int extinfo); +int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, struct cl_scan_options *options, int extinfo); #endif diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_scth.c clamav-0.101.4+dfsg/clamd/onaccess_scth.c --- clamav-0.100.3+dfsg/clamd/onaccess_scth.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_scth.c 2019-08-20 16:08:49.000000000 +0000 @@ -36,8 +36,9 @@ #include "others.h" #include "priv_fts.h" - +#include "onaccess_others.h" #include "onaccess_scth.h" +#include "onaccess_others.h" #include "libclamav/clamav.h" @@ -57,7 +58,7 @@ static int onas_scth_scanfile(const char *fname, int fd, int extinfo, struct scth_thrarg *tharg) { int ret = 0; - const char *virname; + const char *virname = NULL; return onas_scan(fname, fd, &virname, tharg->engine, tharg->options, extinfo); } @@ -132,16 +133,31 @@ sigaction(SIGUSR1, &act, NULL); sigaction(SIGSEGV, &act, NULL); - if (tharg->options & ONAS_SCTH_ISDIR) { - logg("ScanOnAccess: Performing additional scanning on directory '%s'\n", tharg->pathname); + if (NULL == tharg || NULL == tharg->pathname || NULL == tharg->opts || NULL == tharg->engine) { + logg("ScanOnAccess: Invalid thread arguments for extra scanning\n"); + goto done; + } + + if (tharg->extra_options & ONAS_SCTH_ISDIR) { + logg("*ScanOnAccess: Performing additional scanning on directory '%s'\n", tharg->pathname); onas_scth_handle_dir(tharg->pathname, tharg); - } else if (tharg->options & ONAS_SCTH_ISFILE) { - logg("ScanOnAccess: Performing additional scanning on file '%s'\n", tharg->pathname); + } else if (tharg->extra_options & ONAS_SCTH_ISFILE) { + logg("*ScanOnAccess: Performing additional scanning on file '%s'\n", tharg->pathname); onas_scth_handle_file(tharg->pathname, tharg); } - free(tharg->pathname); - tharg->pathname = NULL; +done: + if (NULL != tharg->pathname){ + free(tharg->pathname); + tharg->pathname = NULL; + } + if (NULL != tharg->options) { + free(tharg->options); + tharg->options = NULL; + } + if (NULL != tharg) { + free(tharg); + } return NULL; } diff -Nru clamav-0.100.3+dfsg/clamd/onaccess_scth.h clamav-0.101.4+dfsg/clamd/onaccess_scth.h --- clamav-0.100.3+dfsg/clamd/onaccess_scth.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/onaccess_scth.h 2019-08-20 16:08:49.000000000 +0000 @@ -21,13 +21,17 @@ #ifndef __ONAS_SCTH_H #define __ONAS_SCTH_H +#include "shared/optparser.h" +#include "libclamav/clamav.h" + #define ONAS_SCTH_ISDIR 0x01 #define ONAS_SCTH_ISFILE 0x02 struct scth_thrarg { - int options; + uint32_t extra_options; + struct cl_scan_options *options; const struct optstruct *opts; - const struct cl_engine *engine; + const struct cl_engine *engine; char *pathname; }; diff -Nru clamav-0.100.3+dfsg/clamd/others.h clamav-0.101.4+dfsg/clamd/others.h --- clamav-0.100.3+dfsg/clamd/others.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/others.h 2019-08-20 16:08:49.000000000 +0000 @@ -29,7 +29,7 @@ #include #include "shared/optparser.h" #include "thrmgr.h" -#include "cltypes.h" +#include "clamav-types.h" enum mode { MODE_COMMAND, diff -Nru clamav-0.100.3+dfsg/clamd/scanner.c clamav-0.101.4+dfsg/clamd/scanner.c --- clamav-0.100.3+dfsg/clamd/scanner.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/scanner.c 2019-08-20 16:08:49.000000000 +0000 @@ -117,7 +117,7 @@ if (d == NULL) return; - if (!(d->options & CL_SCAN_ALLMATCHES) && !(d->options & CL_SCAN_HEURISTIC_PRECEDENCE)) + if (!(d->options->general & CL_SCAN_GENERAL_ALLMATCHES) && !(d->options->general & CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE)) return; if (virname == NULL) return; @@ -277,7 +277,7 @@ if (ret == CL_VIRUS) { - if (scandata->options & CL_SCAN_ALLMATCHES || (scandata->infected && scandata->options & CL_SCAN_HEURISTIC_PRECEDENCE)) { + if (scandata->options->general & CL_SCAN_GENERAL_ALLMATCHES || (scandata->infected && scandata->options->general & CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE)) { if(optget(scandata->opts, "PreludeEnable")->enabled){ prelude_logging(filename, virname, context.virhash, context.virsize); } @@ -353,12 +353,17 @@ return 0; } -int scanfd(const client_conn_t *conn, unsigned long int *scanned, - const struct cl_engine *engine, - unsigned int options, const struct optstruct *opts, int odesc, int stream) +int scanfd( + const client_conn_t *conn, + unsigned long int *scanned, + const struct cl_engine *engine, + struct cl_scan_options *options, + const struct optstruct *opts, + int odesc, + int stream) { int ret, fd = conn->scanfd; - const char *virname; + const char *virname = NULL; STATBUF statbuf; struct cb_context context; char fdstr[32]; @@ -388,8 +393,8 @@ thrmgr_setactivetask(fdstr, NULL); context.filename = fdstr; context.virsize = 0; - context.scandata = NULL; - ret = cl_scandesc_callback(fd, &virname, scanned, engine, options, &context); + context.scandata = NULL; + ret = cl_scandesc_callback(fd, conn->filename, &virname, scanned, engine, options, &context); thrmgr_setactivetask(NULL, NULL); if (thrmgr_group_need_terminate(conn->group)) { @@ -418,14 +423,20 @@ return ret; } -int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, char term) +int scanstream( + int odesc, + unsigned long int *scanned, + const struct cl_engine *engine, + struct cl_scan_options *options, + const struct optstruct *opts, + char term) { int ret, sockfd, acceptd; int tmpd, bread, retval, firsttimeout, timeout, btread; unsigned int port = 0, portscan, min_port, max_port; unsigned long int quota = 0, maxsize = 0; short bound = 0; - const char *virname; + const char *virname = NULL; char buff[FILEBUFF]; char peer_addr[32]; struct cb_context context; @@ -552,13 +563,13 @@ } if(retval == 1) { - lseek(tmpd, 0, SEEK_SET); - thrmgr_setactivetask(peer_addr, NULL); - context.filename = peer_addr; - context.virsize = 0; - context.scandata = NULL; - ret = cl_scandesc_callback(tmpd, &virname, scanned, engine, options, &context); - thrmgr_setactivetask(NULL, NULL); + lseek(tmpd, 0, SEEK_SET); + thrmgr_setactivetask(peer_addr, NULL); + context.filename = peer_addr; + context.virsize = 0; + context.scandata = NULL; + ret = cl_scandesc_callback(tmpd, tmpname, &virname, scanned, engine, options, &context); + thrmgr_setactivetask(NULL, NULL); } else { ret = -1; } diff -Nru clamav-0.100.3+dfsg/clamd/scanner.h clamav-0.101.4+dfsg/clamd/scanner.h --- clamav-0.100.3+dfsg/clamd/scanner.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/scanner.h 2019-08-20 16:08:49.000000000 +0000 @@ -24,6 +24,7 @@ #include +#include "libclamav/others.h" #include "libclamav/clamav.h" #include "shared/optparser.h" #include "thrmgr.h" @@ -42,7 +43,7 @@ const client_conn_t *conn; const char *toplevel_path; unsigned long scanned; - unsigned int options; + struct cl_scan_options *options; struct cl_engine *engine; const struct optstruct *opts; threadpool_t *thr_pool; @@ -57,8 +58,8 @@ struct scan_cb_data *scandata; }; -int scanfd(const client_conn_t *conn, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, int odesc, int stream); -int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, char term); +int scanfd(const client_conn_t *conn, unsigned long int *scanned, const struct cl_engine *engine, struct cl_scan_options *options, const struct optstruct *opts, int odesc, int stream); +int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, struct cl_scan_options *options, const struct optstruct *opts, char term); int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_reason reason, struct cli_ftw_cbdata *data); int scan_pathchk(const char *path, struct cli_ftw_cbdata *data); void hash_callback(int fd, unsigned long long size, const unsigned char *md5, const char *virname, void *ctx); diff -Nru clamav-0.100.3+dfsg/clamd/server.h clamav-0.101.4+dfsg/clamd/server.h --- clamav-0.100.3+dfsg/clamd/server.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/server.h 2019-08-20 16:08:49.000000000 +0000 @@ -32,19 +32,9 @@ #include "session.h" struct thrarg { int sid; - int options; + struct cl_scan_options *options; const struct optstruct *opts; const struct cl_engine *engine; - const struct cl_limits *limits; -}; - -/* thread watcher arguments */ -struct thrwarg { - int socketd; - struct cl_engine **engine; - const struct optstruct *opts; - const struct cl_limits *limits; - unsigned int options; }; int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsigned int dboptions, const struct optstruct *opts); diff -Nru clamav-0.100.3+dfsg/clamd/server-th.c clamav-0.101.4+dfsg/clamd/server-th.c --- clamav-0.100.3+dfsg/clamd/server-th.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/server-th.c 2019-08-20 16:08:49.000000000 +0000 @@ -61,7 +61,6 @@ #include "shared.h" #include "libclamav/others.h" #include "libclamav/readdb.h" -#include "libclamav/cltypes.h" #define BUFFSIZE 1024 @@ -89,7 +88,7 @@ #ifndef _WIN32 /* ignore all signals */ sigfillset(&sigset); - /* The behavior of a process is undefined after it ignores a + /* The behavior of a process is undefined after it ignores a * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */ sigdelset(&sigset, SIGFPE); sigdelset(&sigset, SIGILL); @@ -553,7 +552,7 @@ /* no more commands are accepted */ conn->mode = MODE_WAITREPLY; /* Stop monitoring this FD, it will be closed either - * by us, or by the scanner thread. + * by us, or by the scanner thread. * Never close a file descriptor that is being * monitored by poll()/select() from another thread, * because this can lead to subtle bugs such as: @@ -632,7 +631,7 @@ int rc; size_t pos = *ppos; size_t cmdlen; - + logg("$mode == MODE_STREAM\n"); /* we received some data, set readtimeout */ time(&buf->timeout_at); @@ -718,7 +717,7 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsigned int dboptions, const struct optstruct *opts) { int max_threads, max_queue, readtimeout, ret = 0; - unsigned int options = 0; + struct cl_scan_options options; char timestr[32]; #ifndef _WIN32 struct sigaction sigact; @@ -742,7 +741,7 @@ threadpool_t *thr_pool; #if defined(FANOTIFY) || defined(CLAMAUTH) - pthread_t fan_pid; + pthread_t fan_pid = 0; pthread_attr_t fan_attr; struct thrarg *tharg = NULL; /* shut up gcc */ #endif @@ -751,13 +750,29 @@ memset(&sigact, 0, sizeof(struct sigaction)); #endif + /* Initalize scan options struct */ + memset(&options, 0, sizeof(struct cl_scan_options)); + /* set up limits */ - if((opt = optget(opts, "MaxScanSize"))->active) { - if((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, opt->numarg))) { - logg("!cl_engine_set_num(CL_ENGINE_MAX_SCANSIZE) failed: %s\n", cl_strerror(ret)); - cl_engine_free(engine); - return 1; - } + if ((opt = optget(opts, "MaxScanTime"))->active) { + if ((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, opt->numarg))) { + logg("!cl_engine_set_num(CL_ENGINE_MAX_SCANTIME) failed: %s\n", cl_strerror(ret)); + cl_engine_free(engine); + return 1; + } + } + val = cl_engine_get_num(engine, CL_ENGINE_MAX_SCANTIME, NULL); + if (val) + logg("Limits: Global time limit set to %llu milliseconds.\n", val); + else + logg("^Limits: Global time limit protection disabled.\n"); + + if ((opt = optget(opts, "MaxScanSize"))->active) { + if ((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, opt->numarg))) { + logg("!cl_engine_set_num(CL_ENGINE_MAX_SCANSIZE) failed: %s\n", cl_strerror(ret)); + cl_engine_free(engine); + return 1; + } } val = cl_engine_get_num(engine, CL_ENGINE_MAX_SCANSIZE, NULL); if(val) @@ -920,138 +935,198 @@ val = cl_engine_get_num(engine, CL_ENGINE_PCRE_MAX_FILESIZE, NULL); logg("Limits: PCREMaxFileSize limit set to %llu.\n", val); - if(optget(opts, "ScanArchive")->enabled) { - logg("Archive support enabled.\n"); - options |= CL_SCAN_ARCHIVE; - - if(optget(opts, "ArchiveBlockEncrypted")->enabled) { - logg("Archive: Blocking encrypted archives.\n"); - options |= CL_SCAN_BLOCKENCRYPTED; - } - + if (optget(opts, "ScanArchive")->enabled) { + logg("Archive support enabled.\n"); + options.parse |= CL_SCAN_PARSE_ARCHIVE; } else { - logg("Archive support disabled.\n"); + logg("Archive support disabled.\n"); + } + + /* TODO: Remove deprecated option in a future feature release. */ + if (optget(opts, "ArchiveBlockEncrypted")->enabled) { + if (options.parse & CL_SCAN_PARSE_ARCHIVE) { + logg( + "^Using deprecated option \"ArchiveBlockEncrypted\" to alert on " + "encrypted archives _and_ documents. Please update your " + "configuration to use replacement options \"AlertEncrypted\", or " + "\"AlertEncryptedArchive\" and/or \"AlertEncryptedDoc\".\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } else { + logg( + "^Using deprecated option \"ArchiveBlockEncrypted\" to alert on " + "encrypted documents. Please update your configuration to use " + "replacement options \"AlertEncrypted\", or " + "\"AlertEncryptedArchive\" and/or \"AlertEncryptedDoc\".\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } + } + + if (optget(opts, "AlertEncrypted")->enabled) { + if (options.parse & CL_SCAN_PARSE_ARCHIVE) { + logg("Alerting of encrypted archives _and_ documents enabled.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } else { + logg("Alerting of encrypted documents enabled.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } } + if (optget(opts, "AlertEncryptedArchive")->enabled) { + if (options.parse & CL_SCAN_PARSE_ARCHIVE) { + logg("Alerting of encrypted archives _and_ documents enabled.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; + } else { + logg("^Encrypted archive alerting requested, but archive support " + "is disabled!\n"); + } + } + + if (optget(opts, "AlertEncryptedDoc")->enabled) { + logg("Alerting of encrypted documents enabled.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } + + /* TODO: Remove deprecated option in a future feature release. */ if (optget(opts, "BlockMax")->enabled) { - logg("BlockMax heuristic detection enabled.\n"); - options |= CL_SCAN_BLOCKMAX; + logg("^Using deprecated option \"BlockMax\" to enable heuristic alerts " + "when scans exceed set maximums. Please update your configuration " + "to use replacement option \"AlertExceedsMax\".\n"); + options.heuristic |= CL_SCAN_HEURISTIC_EXCEEDS_MAX; + } else if (optget(opts, "AlertExceedsMax")->enabled) { + logg("Heuristic alerting enabled for scans that exceed set maximums.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_EXCEEDS_MAX; } else { - logg("BlockMax heuristic detection disabled.\n"); + logg("AlertExceedsMax heuristic detection disabled.\n"); } - if(optget(opts, "AlgorithmicDetection")->enabled) { - logg("Algorithmic detection enabled.\n"); - options |= CL_SCAN_ALGORITHMIC; - } else { - logg("Algorithmic detection disabled.\n"); + /* TODO: Remove deprecated option in a future feature release. */ + if (!optget(opts, "AlgorithmicDetection")->enabled) { + logg("^Using deprecated option \"AlgorithmicDetection\" to disable " + "heuristic alerts. Please update your configuration to use " + "replacement option \"HeuristicAlerts\".\n"); + } else if (!optget(opts, "HeuristicAlerts")->enabled) { + logg("Heuristic alerts disabled.\n"); + } else { + logg("Heuristic alerts enabled.\n"); + options.general |= CL_SCAN_GENERAL_HEURISTICS; } if(optget(opts, "ScanPE")->enabled) { logg("Portable Executable support enabled.\n"); - options |= CL_SCAN_PE; + options.parse |= CL_SCAN_PARSE_PE; } else { logg("Portable Executable support disabled.\n"); } if(optget(opts, "ScanELF")->enabled) { logg("ELF support enabled.\n"); - options |= CL_SCAN_ELF; + options.parse |= CL_SCAN_PARSE_ELF; } else { logg("ELF support disabled.\n"); } - if(optget(opts, "ScanPE")->enabled || optget(opts, "ScanELF")->enabled) { - if(optget(opts, "DetectBrokenExecutables")->enabled) { - logg("Detection of broken executables enabled.\n"); - options |= CL_SCAN_BLOCKBROKEN; - } + /* TODO: Remove deprecated option in a future feature release */ + if (optget(opts, "ScanPE")->enabled || optget(opts, "ScanELF")->enabled) { + if ((optget(opts, "DetectBrokenExecutables")->enabled) || + (optget(opts, "AlertBrokenExecutables")->enabled)) { + logg("Alerting on broken executables enabled.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_BROKEN; + } } if(optget(opts, "ScanMail")->enabled) { logg("Mail files support enabled.\n"); - options |= CL_SCAN_MAIL; + options.parse |= CL_SCAN_PARSE_MAIL; if(optget(opts, "ScanPartialMessages")->enabled) { logg("Mail: RFC1341 handling enabled.\n"); - options |= CL_SCAN_PARTIAL_MESSAGE; + options.mail |= CL_SCAN_MAIL_PARTIAL_MESSAGE; } } else { logg("Mail files support disabled.\n"); } - if(optget(opts, "ScanOLE2")->enabled) { - logg("OLE2 support enabled.\n"); - options |= CL_SCAN_OLE2; - if(optget(opts, "OLE2BlockMacros")->enabled) { - logg("OLE2: Blocking all VBA macros.\n"); - options |= CL_SCAN_BLOCKMACROS; - } + if (optget(opts, "ScanOLE2")->enabled) { + logg("OLE2 support enabled.\n"); + options.parse |= CL_SCAN_PARSE_OLE2; + + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "OLE2BlockMacros")->enabled) || + (optget(opts, "AlertOLE2Macros")->enabled)) { + logg("OLE2: Alerting on all VBA macros.\n"); + options.heuristic |= CL_SCAN_HEURISTIC_MACROS; + } } else { - logg("OLE2 support disabled.\n"); + logg("OLE2 support disabled.\n"); } if(optget(opts, "ScanPDF")->enabled) { logg("PDF support enabled.\n"); - options |= CL_SCAN_PDF; + options.parse |= CL_SCAN_PARSE_PDF; } else { logg("PDF support disabled.\n"); } if(optget(opts, "ScanSWF")->enabled) { logg("SWF support enabled.\n"); - options |= CL_SCAN_SWF; + options.parse |= CL_SCAN_PARSE_SWF; } else { logg("SWF support disabled.\n"); } if(optget(opts, "ScanHTML")->enabled) { logg("HTML support enabled.\n"); - options |= CL_SCAN_HTML; + options.parse |= CL_SCAN_PARSE_HTML; } else { logg("HTML support disabled.\n"); } if(optget(opts, "ScanXMLDOCS")->enabled) { logg("XMLDOCS support enabled.\n"); - options |= CL_SCAN_XMLDOCS; + options.parse |= CL_SCAN_PARSE_XMLDOCS; } else { logg("XMLDOCS support disabled.\n"); } if(optget(opts, "ScanHWP3")->enabled) { logg("HWP3 support enabled.\n"); - options |= CL_SCAN_HWP3; + options.parse |= CL_SCAN_PARSE_HWP3; } else { logg("HWP3 support disabled.\n"); } - if(optget(opts,"PhishingScanURLs")->enabled) { - - if(optget(opts,"PhishingAlwaysBlockCloak")->enabled) { - options |= CL_SCAN_PHISHING_BLOCKCLOAK; - logg("Phishing: Always checking for cloaked urls\n"); - } - - if(optget(opts,"PhishingAlwaysBlockSSLMismatch")->enabled) { - options |= CL_SCAN_PHISHING_BLOCKSSL; - logg("Phishing: Always checking for ssl mismatches\n"); - } + if (optget(opts, "PhishingScanURLs")->enabled) { + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "PhishingAlwaysBlockCloak")->enabled) || + (optget(opts, "AlertPhishingCloak")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_CLOAK; + logg("Phishing: Always checking for cloaked urls\n"); + } + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "PhishingAlwaysBlockSSLMismatch")->enabled) || + (optget(opts, "AlertPhishingSSLMismatch")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH; + logg("Phishing: Always checking for ssl mismatches\n"); + } } - if(optget(opts,"PartitionIntersection")->enabled) { - options |= CL_SCAN_PARTITION_INTXN; - logg("Raw DMG: Always checking for partitions intersections\n"); + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts,"PartitionIntersection")->enabled) || + (optget(opts,"AlertPartitionIntersection")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_PARTITION_INTXN; + logg("Raw DMG: Alert on partitions intersections\n"); } if(optget(opts,"HeuristicScanPrecedence")->enabled) { - options |= CL_SCAN_HEURISTIC_PRECEDENCE; + options.general |= CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE; logg("Heuristic: precedence enabled\n"); } if(optget(opts, "StructuredDataDetection")->enabled) { - options |= CL_SCAN_STRUCTURED; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED; if((opt = optget(opts, "StructuredMinCreditCardCount"))->enabled) { if((ret = cl_engine_set_num(engine, CL_ENGINE_MIN_CC_COUNT, opt->numarg))) { @@ -1074,15 +1149,15 @@ logg("Structured: Minimum Social Security Number Count set to %u\n", (unsigned int) val); if(optget(opts, "StructuredSSNFormatNormal")->enabled) - options |= CL_SCAN_STRUCTURED_SSN_NORMAL; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL; if(optget(opts, "StructuredSSNFormatStripped")->enabled) - options |= CL_SCAN_STRUCTURED_SSN_STRIPPED; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED; } #ifdef HAVE__INTERNAL__SHA_COLLECT if(optget(opts, "DevCollectHashes")->enabled) - options |= CL_SCAN_INTERNAL_COLLECT_SHA; + options.dev |= CL_SCAN_DEV_COLLECT_SHA; #endif selfchk = optget(opts, "SelfCheck")->numarg; @@ -1125,7 +1200,7 @@ int solaris_has_extended_stdio = 0; #endif /* Condition to not run out of file descriptors: - * MaxThreads * MaxRecursion + (MaxQueue - MaxThreads) + CLAMDFILES < RLIMIT_NOFILE + * MaxThreads * MaxRecursion + (MaxQueue - MaxThreads) + CLAMDFILES < RLIMIT_NOFILE * CLAMDFILES is 6: 3 standard FD + logfile + 2 FD for reloading the DB * */ #ifdef C_SOLARIS @@ -1209,18 +1284,34 @@ #if defined(FANOTIFY) || defined(CLAMAUTH) { + int thread_started = 1; do { - if(pthread_attr_init(&fan_attr)) break; - pthread_attr_setdetachstate(&fan_attr, PTHREAD_CREATE_JOINABLE); - if(!(tharg = (struct thrarg *) malloc(sizeof(struct thrarg)))) break; - tharg->opts = opts; - tharg->engine = engine; - tharg->options = options; - if(!pthread_create(&fan_pid, &fan_attr, onas_fan_th, tharg)) break; - free(tharg); - tharg=NULL; - } while(0); - if (!tharg) logg("!Unable to start on-access scan\n"); + if(pthread_attr_init(&fan_attr)) break; + pthread_attr_setdetachstate(&fan_attr, PTHREAD_CREATE_JOINABLE); + + /* Allocate memory for arguments. Thread is responsible for freeing it. */ + if (!(tharg = (struct thrarg *) calloc(sizeof(struct thrarg), 1))) break; + if (!(tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break; + + (void) memcpy(tharg->options, &options, sizeof(struct cl_scan_options)); + tharg->opts = opts; + tharg->engine = engine; + + thread_started = pthread_create(&fan_pid, &fan_attr, onas_fan_th, tharg); + } while(0); + + if (0 != thread_started) { + /* Failed to create thread. Free anything we may have allocated. */ + logg("!Unable to start on-access scan.\n"); + if (NULL != tharg) { + if (NULL != tharg->options) { + free(tharg->options); + tharg->options = NULL; + } + free(tharg); + tharg = NULL; + } + } } #else logg("!On-access scan is not available\n"); @@ -1236,12 +1327,12 @@ sigdelset(&sigset, SIGHUP); sigdelset(&sigset, SIGPIPE); sigdelset(&sigset, SIGUSR2); - /* The behavior of a process is undefined after it ignores a + /* The behavior of a process is undefined after it ignores a * SIGFPE, SIGILL, SIGSEGV, or SIGBUS signal */ sigdelset(&sigset, SIGFPE); sigdelset(&sigset, SIGILL); sigdelset(&sigset, SIGSEGV); -#ifdef SIGBUS +#ifdef SIGBUS sigdelset(&sigset, SIGBUS); #endif sigdelset(&sigset, SIGTSTP); @@ -1384,7 +1475,7 @@ conn.scanfd = buf->recvfd; buf->recvfd = -1; conn.sd = buf->fd; - conn.options = options; + conn.options = &options; conn.opts = opts; conn.thrpool = thr_pool; conn.engine = engine; @@ -1585,4 +1676,4 @@ logg("--- Stopped at %s", cli_ctime(¤t_time, timestr, sizeof(timestr))); return ret; -} +} diff -Nru clamav-0.100.3+dfsg/clamd/session.c clamav-0.101.4+dfsg/clamd/session.c --- clamav-0.100.3+dfsg/clamd/session.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/session.c 2019-08-20 16:08:49.000000000 +0000 @@ -191,7 +191,7 @@ { int desc = conn->sd; struct cl_engine *engine = conn->engine; - unsigned int options = conn->options; + struct cl_scan_options *options = conn->options; const struct optstruct *opts = conn->opts; enum scan_type type = TYPE_INIT; int maxdirrec; @@ -369,7 +369,7 @@ return 1; } thrmgr_setactivetask(NULL, "ALLMATCHSCAN"); - scandata.options |= CL_SCAN_ALLMATCHES; + scandata.options->general |= CL_SCAN_GENERAL_ALLMATCHES; type = TYPE_SCAN; break; default: diff -Nru clamav-0.100.3+dfsg/clamd/session.h clamav-0.101.4+dfsg/clamd/session.h --- clamav-0.100.3+dfsg/clamd/session.h 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamd/session.h 2019-08-20 16:08:49.000000000 +0000 @@ -82,7 +82,7 @@ char *filename; int scanfd; int sd; - unsigned int options; + struct cl_scan_options *options; const struct optstruct *opts; struct cl_engine *engine; time_t engine_timestamp; diff -Nru clamav-0.100.3+dfsg/clamdscan/Makefile.in clamav-0.101.4+dfsg/clamdscan/Makefile.in --- clamav-0.100.3+dfsg/clamdscan/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamdscan/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -128,6 +128,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -176,14 +177,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" @@ -219,7 +220,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -314,6 +315,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOTHREADS -DCL_NOLIBCLAMAV DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -328,6 +331,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -342,6 +346,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -423,6 +432,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamdtop/Makefile.in clamav-0.101.4+dfsg/clamdtop/Makefile.in --- clamav-0.100.3+dfsg/clamdtop/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamdtop/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -109,6 +109,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -157,14 +158,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(man1dir)" @@ -194,7 +195,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -319,6 +320,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOTHREADS -DCL_NOLIBCLAMAV DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -333,6 +336,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -347,6 +351,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -428,6 +437,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamscan/clamscan.c clamav-0.101.4+dfsg/clamscan/clamscan.c --- clamav-0.100.3+dfsg/clamscan/clamscan.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamscan/clamscan.c 2019-08-20 16:08:49.000000000 +0000 @@ -68,8 +68,8 @@ struct optstruct *opts; const struct optstruct *opt; - if(check_flevel()) - exit(2); + if (check_flevel()) + exit(2); #if !defined(_WIN32) && !defined(C_BEOS) sigemptyset(&sigset); @@ -145,7 +145,7 @@ optfree(opts); return 2; } - } else + } else logg_file = NULL; if(actsetup(opts)) { @@ -251,13 +251,10 @@ mprintf(" --structured-ssn-count=N Min SSN count to generate a detect\n"); mprintf(" --structured-cc-count=N Min CC count to generate a detect\n"); mprintf(" --scan-mail[=yes(*)/no] Scan mail files\n"); - mprintf(" --phishing-sigs[=yes(*)/no] Signature-based phishing detection\n"); - mprintf(" --phishing-scan-urls[=yes(*)/no] URL-based phishing detection\n"); + mprintf(" --phishing-sigs[=yes(*)/no] Enable email signature-based phishing detection\n"); + mprintf(" --phishing-scan-urls[=yes(*)/no] Enable URL signature-based phishing detection\n"); + mprintf(" --heuristic-alerts[=yes(*)/no] Heuristic alerts\n"); mprintf(" --heuristic-scan-precedence[=yes/no(*)] Stop scanning as soon as a heuristic match is found\n"); - mprintf(" --phishing-ssl[=yes/no(*)] Always block (flag) SSL mismatches in URLs (phishing module)\n"); - mprintf(" --phishing-cloak[=yes/no(*)] Always block (flag) cloaked URLs (phishing module)\n"); - mprintf(" --partition-intersection[=yes/no(*)] Detect partition intersections in raw disk images using heuristics\n"); - mprintf(" --algorithmic-detection[=yes(*)/no] Algorithmic detection\n"); mprintf(" --normalize[=yes(*)/no] Normalize html, script, and text files. Use normalize=no for yara compatibility\n"); mprintf(" --scan-pe[=yes(*)/no] Scan PE files\n"); mprintf(" --scan-elf[=yes(*)/no] Scan ELF files\n"); @@ -268,13 +265,19 @@ mprintf(" --scan-xmldocs[=yes(*)/no] Scan xml-based document files\n"); mprintf(" --scan-hwp3[=yes(*)/no] Scan HWP3 files\n"); mprintf(" --scan-archive[=yes(*)/no] Scan archive files (supported by libclamav)\n"); - mprintf(" --detect-broken[=yes/no(*)] Try to detect broken executable files\n"); - mprintf(" --block-encrypted[=yes/no(*)] Block (flag) encrypted archives\n"); - mprintf(" --block-macros[=yes/no(*)] Block (flag) OLE2 files with VBA macros\n"); - mprintf(" --block-max[=yes/no(*)] Block (flag) files that exceed max file size, max scan size, or max recursion limit\n"); + mprintf(" --alert-broken[=yes/no(*)] Alert on broken executable files (PE & ELF)\n"); + mprintf(" --alert-encrypted[=yes/no(*)] Alert on encrypted archives and documents\n"); + mprintf(" --alert-encrypted-archive[=yes/no(*)] Alert on encrypted archives\n"); + mprintf(" --alert-encrypted-doc[=yes/no(*)] Alert on encrypted documents\n"); + mprintf(" --alert-macros[=yes/no(*)] Alert on OLE2 files containing VBA macros\n"); + mprintf(" --alert-exceeds-max[=yes/no(*)] Alert on files that exceed max file size, max scan size, or max recursion limit\n"); + mprintf(" --alert-phishing-ssl[=yes/no(*)] Alert on emails containing SSL mismatches in URLs\n"); + mprintf(" --alert-phishing-cloak[=yes/no(*)] Alert on emails containing cloaked URLs\n"); + mprintf(" --alert-partition-intersection[=yes/no(*)] Alert on raw DMG image files containing partition intersections\n"); mprintf(" --nocerts Disable authenticode certificate chain verification in PE files\n"); mprintf(" --dumpcerts Dump authenticode certificate chain in PE files\n"); mprintf("\n"); + mprintf(" --max-scantime=#n Scan time longer than this will be skipped and assumed clean\n"); mprintf(" --max-filesize=#n Files larger than this will be skipped and assumed clean\n"); mprintf(" --max-scansize=#n The maximum amount of data to scan for each container file (**)\n"); mprintf(" --max-files=#n The maximum number of files to scan for each container file (**)\n"); diff -Nru clamav-0.100.3+dfsg/clamscan/Makefile.in clamav-0.101.4+dfsg/clamscan/Makefile.in --- clamav-0.100.3+dfsg/clamscan/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamscan/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -131,6 +131,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -179,14 +180,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" @@ -212,7 +213,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -307,6 +308,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOTHREADS DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -321,6 +324,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -335,6 +339,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -416,6 +425,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/clamscan/manager.c clamav-0.101.4+dfsg/clamscan/manager.c --- clamav-0.100.3+dfsg/clamscan/manager.c 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamscan/manager.c 2019-08-20 16:08:49.000000000 +0000 @@ -63,7 +63,6 @@ #include "libclamav/matcher-pcre.h" #include "libclamav/str.h" #include "libclamav/readdb.h" -#include "libclamav/cltypes.h" #ifdef C_LINUX dev_t procdev; @@ -289,12 +288,12 @@ return; } -static void scanfile(const char *filename, struct cl_engine *engine, const struct optstruct *opts, unsigned int options) +static void scanfile(const char *filename, struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options) { int ret = 0, fd, included; unsigned i; const struct optstruct *opt; - const char *virname; + const char *virname = NULL; STATBUF sb; struct metachain chain; struct clamscan_cb_data data; @@ -341,7 +340,7 @@ return; } -#endif +#endif if(!sb.st_size) { if(!printinfected) logg("~%s: Empty file\n", filename); @@ -389,7 +388,7 @@ data.chain = &chain; data.filename = filename; - if((ret = cl_scandesc_callback(fd, &virname, &info.blocks, engine, options, &data)) == CL_VIRUS) { + if((ret = cl_scandesc_callback(fd, filename, &virname, &info.blocks, engine, options, &data)) == CL_VIRUS) { if(optget(opts, "archive-verbose")->enabled) { if (chain.nchains > 1) { char str[128]; @@ -427,7 +426,7 @@ action(filename); } -static void scandirs(const char *dirname, struct cl_engine *engine, const struct optstruct *opts, unsigned int options, unsigned int depth, dev_t dev) +static void scandirs(const char *dirname, struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options, unsigned int depth, dev_t dev) { DIR *dd; struct dirent *dent; @@ -540,7 +539,7 @@ } } -static int scanstdin(const struct cl_engine *engine, const struct optstruct *opts, int options) +static int scanstdin(const struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options) { int ret; unsigned int fsize = 0; @@ -615,7 +614,8 @@ int scanmanager(const struct optstruct *opts) { int ret = 0, i; - unsigned int options = 0, dboptions = 0, dirlnk = 1, filelnk = 1; + struct cl_scan_options options; + unsigned int dboptions = 0, dirlnk = 1, filelnk = 1; struct cl_engine *engine; STATBUF sb; char *file, cwd[1024], *pua_cats = NULL; @@ -625,6 +625,9 @@ struct rlimit rlim; #endif + /* Initalize scan options struct */ + memset(&options, 0, sizeof(struct cl_scan_options)); + dirlnk = optget(opts, "follow-dir-symlinks")->numarg; if(dirlnk > 2) { logg("!--follow-dir-symlinks: Invalid argument\n"); @@ -671,7 +674,7 @@ } cl_engine_set_clcb_virus_found(engine, clamscan_virus_found_cb); - + if (optget(opts, "disable-cache")->enabled) cl_engine_set_num(engine, CL_ENGINE_DISABLE_CACHE, 1); @@ -794,7 +797,7 @@ /* JSON check to prevent engine loading if specified without libjson-c */ #if HAVE_JSON if (optget(opts, "gen-json")->enabled) - options |= CL_SCAN_FILE_PROPERTIES; + options.general |= CL_SCAN_GENERAL_COLLECT_METADATA; #else if (optget(opts, "gen-json")->enabled) { logg("!Can't generate json (gen-json). libjson-c dev library was missing or misconfigured when ClamAV was built.\n"); @@ -870,6 +873,24 @@ /* set limits */ + /* TODO: Remove deprecated option in a future feature release */ + if ((opt = optget(opts, "timelimit"))->active) { + if ((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, opt->numarg))) { + logg("!cli_engine_set_num(CL_ENGINE_MAX_SCANTIME) failed: %s\n", cl_strerror(ret)); + + cl_engine_free(engine); + return 2; + } + } + if ((opt = optget(opts, "max-scantime"))->active) { + if ((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, opt->numarg))) { + logg("!cli_engine_set_num(CL_ENGINE_MAX_SCANTIME) failed: %s\n", cl_strerror(ret)); + + cl_engine_free(engine); + return 2; + } + } + if((opt = optget(opts, "max-scansize"))->active) { if((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, opt->numarg))) { logg("!cli_engine_set_num(CL_ENGINE_MAX_SCANSIZE) failed: %s\n", cl_strerror(ret)); @@ -991,15 +1012,6 @@ } } - if ((opt = optget(opts, "timelimit"))->active) { - if ((ret = cl_engine_set_num(engine, CL_ENGINE_TIME_LIMIT, opt->numarg))) { - logg("!cli_engine_set_num(CL_ENGINE_TIME_LIMIT) failed: %s\n", cl_strerror(ret)); - - cl_engine_free(engine); - return 2; - } - } - if ((opt = optget(opts, "pcre-max-filesize"))->active) { if ((ret = cl_engine_set_num(engine, CL_ENGINE_PCRE_MAX_FILESIZE, opt->numarg))) { logg("!cli_engine_set_num(CL_ENGINE_PCRE_MAX_FILESIZE) failed: %s\n", cl_strerror(ret)); @@ -1010,95 +1022,122 @@ /* set scan options */ if(optget(opts, "allmatch")->enabled) { - options |= CL_SCAN_ALLMATCHES; + options.general |= CL_SCAN_GENERAL_ALLMATCHES; } - if(optget(opts,"phishing-ssl")->enabled) - options |= CL_SCAN_PHISHING_BLOCKSSL; - - if(optget(opts,"phishing-cloak")->enabled) - options |= CL_SCAN_PHISHING_BLOCKCLOAK; - - if(optget(opts,"partition-intersection")->enabled) - options |= CL_SCAN_PARTITION_INTXN; + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts,"phishing-ssl")->enabled) || + (optget(opts,"alert-phishing-ssl")->enabled)) + options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH; + + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts,"phishing-cloak")->enabled) || + (optget(opts,"alert-phishing-cloak")->enabled)) + options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_CLOAK; + + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts,"partition-intersection")->enabled) || + (optget(opts,"alert-partition-intersection")->enabled)) + options.heuristic |= CL_SCAN_HEURISTIC_PARTITION_INTXN; if(optget(opts,"heuristic-scan-precedence")->enabled) - options |= CL_SCAN_HEURISTIC_PRECEDENCE; + options.general |= CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE; if(optget(opts, "scan-archive")->enabled) - options |= CL_SCAN_ARCHIVE; + options.parse |= CL_SCAN_PARSE_ARCHIVE; + + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "detect-broken")->enabled) || + (optget(opts, "alert-broken")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_BROKEN; + } - if(optget(opts, "detect-broken")->enabled) - options |= CL_SCAN_BLOCKBROKEN; + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "block-encrypted")->enabled) || + (optget(opts, "alert-encrypted")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + } - if(optget(opts, "block-encrypted")->enabled) - options |= CL_SCAN_BLOCKENCRYPTED; + if (optget(opts, "alert-encrypted-archive")->enabled) + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; - if(optget(opts, "block-macros")->enabled) - options |= CL_SCAN_BLOCKMACROS; + if (optget(opts, "alert-encrypted-doc")->enabled) + options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; + + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "block-macros")->enabled) || + (optget(opts, "alert-macros")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_MACROS; + } if(optget(opts, "scan-pe")->enabled) - options |= CL_SCAN_PE; + options.parse |= CL_SCAN_PARSE_PE; if(optget(opts, "scan-elf")->enabled) - options |= CL_SCAN_ELF; + options.parse |= CL_SCAN_PARSE_ELF; if(optget(opts, "scan-ole2")->enabled) - options |= CL_SCAN_OLE2; + options.parse |= CL_SCAN_PARSE_OLE2; if(optget(opts, "scan-pdf")->enabled) - options |= CL_SCAN_PDF; + options.parse |= CL_SCAN_PARSE_PDF; if(optget(opts, "scan-swf")->enabled) - options |= CL_SCAN_SWF; + options.parse |= CL_SCAN_PARSE_SWF; if(optget(opts, "scan-html")->enabled && optget(opts, "normalize")->enabled) - options |= CL_SCAN_HTML; + options.parse |= CL_SCAN_PARSE_HTML; if(optget(opts, "scan-mail")->enabled) - options |= CL_SCAN_MAIL; + options.parse |= CL_SCAN_PARSE_MAIL; if(optget(opts, "scan-xmldocs")->enabled) - options |= CL_SCAN_XMLDOCS; + options.parse |= CL_SCAN_PARSE_XMLDOCS; if(optget(opts, "scan-hwp3")->enabled) - options |= CL_SCAN_HWP3; + options.parse |= CL_SCAN_PARSE_HWP3; - if(optget(opts, "algorithmic-detection")->enabled) - options |= CL_SCAN_ALGORITHMIC; + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "algorithmic-detection")->enabled) && /* && used due to default-yes for both options */ + (optget(opts, "heuristic-alerts")->enabled)) { + options.general |= CL_SCAN_GENERAL_HEURISTICS; + } - if(optget(opts, "block-max")->enabled) { - options |= CL_SCAN_BLOCKMAX; + /* TODO: Remove deprecated option in a future feature release */ + if ((optget(opts, "block-max")->enabled) || + (optget(opts, "alert-exceeds-max")->enabled)) { + options.heuristic |= CL_SCAN_HEURISTIC_EXCEEDS_MAX; } #ifdef HAVE__INTERNAL__SHA_COLLECT if(optget(opts, "dev-collect-hashes")->enabled) - options |= CL_SCAN_INTERNAL_COLLECT_SHA; + options.dev |= CL_SCAN_DEV_COLLECT_SHA; #endif if(optget(opts, "dev-performance")->enabled) - options |= CL_SCAN_PERFORMANCE_INFO; + options.dev |= CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO; if(optget(opts, "detect-structured")->enabled) { - options |= CL_SCAN_STRUCTURED; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED; if((opt = optget(opts, "structured-ssn-format"))->enabled) { switch(opt->numarg) { case 0: - options |= CL_SCAN_STRUCTURED_SSN_NORMAL; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL; break; case 1: - options |= CL_SCAN_STRUCTURED_SSN_STRIPPED; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED; break; case 2: - options |= (CL_SCAN_STRUCTURED_SSN_NORMAL | CL_SCAN_STRUCTURED_SSN_STRIPPED); + options.heuristic |= (CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL | CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED); break; default: logg("!Invalid argument for --structured-ssn-format\n"); return 2; } } else { - options |= CL_SCAN_STRUCTURED_SSN_NORMAL; + options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL; } if((opt = optget(opts, "structured-ssn-count"))->active) { @@ -1118,7 +1157,7 @@ } } } else { - options &= ~CL_SCAN_STRUCTURED; + options.heuristic &= ~CL_SCAN_HEURISTIC_STRUCTURED; } #ifdef C_LINUX @@ -1135,11 +1174,11 @@ ret = 2; } else { CLAMSTAT(cwd, &sb); - scandirs(cwd, engine, opts, options, 1, sb.st_dev); + scandirs(cwd, engine, opts, &options, 1, sb.st_dev); } } else if(opts->filename && !optget(opts, "file-list")->enabled && !strcmp(opts->filename[0], "-")) { /* read data from stdin */ - ret = scanstdin(engine, opts, options); + ret = scanstdin(engine, opts, &options); } else { if(opts->filename && optget(opts, "file-list")->enabled) logg("^Only scanning files from --file-list (files passed at cmdline are ignored)\n"); @@ -1163,18 +1202,18 @@ logg("%s: Symbolic link\n", file); } else if(CLAMSTAT(file, &sb) != -1) { if(S_ISREG(sb.st_mode) && filelnk) { - scanfile(file, engine, opts, options); + scanfile(file, engine, opts, &options); } else if(S_ISDIR(sb.st_mode) && dirlnk) { - scandirs(file, engine, opts, options, 1, sb.st_dev); + scandirs(file, engine, opts, &options, 1, sb.st_dev); } else { if(!printinfected) logg("%s: Symbolic link\n", file); } } } else if(S_ISREG(sb.st_mode)) { - scanfile(file, engine, opts, options); + scanfile(file, engine, opts, &options); } else if(S_ISDIR(sb.st_mode)) { - scandirs(file, engine, opts, options, 1, sb.st_dev); + scandirs(file, engine, opts, &options, 1, sb.st_dev); } else { logg("^%s: Not supported file type\n", file); ret = 2; diff -Nru clamav-0.100.3+dfsg/clamsubmit/Makefile.in clamav-0.101.4+dfsg/clamsubmit/Makefile.in --- clamav-0.100.3+dfsg/clamsubmit/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/clamsubmit/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -127,6 +127,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -175,14 +176,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" @@ -207,7 +208,7 @@ am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = -DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) -I$(top_builddir)/libclammspack depcomp = $(SHELL) $(top_srcdir)/config/depcomp am__depfiles_maybe = depfiles am__mv = mv -f @@ -302,6 +303,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ -DCL_NOTHREADS DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -316,6 +319,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -330,6 +334,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -411,6 +420,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/config/ar-lib clamav-0.101.4+dfsg/config/ar-lib --- clamav-0.100.3+dfsg/config/ar-lib 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/config/ar-lib 2019-08-20 16:08:49.000000000 +0000 @@ -0,0 +1,270 @@ +#! /bin/sh +# Wrapper for Microsoft lib.exe + +me=ar-lib +scriptversion=2012-03-01.08; # UTC + +# Copyright (C) 2010-2013 Free Software Foundation, Inc. +# Written by Peter Rosin . +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# As a special exception to the GNU General Public License, if you +# distribute this file as part of a program that contains a +# configuration script generated by Autoconf, you may include it under +# the same distribution terms that you use for the rest of that program. + +# This file is maintained in Automake, please report +# bugs to or send patches to +# . + + +# func_error message +func_error () +{ + echo "$me: $1" 1>&2 + exit 1 +} + +file_conv= + +# func_file_conv build_file +# Convert a $build file to $host form and store it in $file +# Currently only supports Windows hosts. +func_file_conv () +{ + file=$1 + case $file in + / | /[!/]*) # absolute file, and not a UNC file + if test -z "$file_conv"; then + # lazily determine how to convert abs files + case `uname -s` in + MINGW*) + file_conv=mingw + ;; + CYGWIN*) + file_conv=cygwin + ;; + *) + file_conv=wine + ;; + esac + fi + case $file_conv in + mingw) + file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'` + ;; + cygwin) + file=`cygpath -m "$file" || echo "$file"` + ;; + wine) + file=`winepath -w "$file" || echo "$file"` + ;; + esac + ;; + esac +} + +# func_at_file at_file operation archive +# Iterate over all members in AT_FILE performing OPERATION on ARCHIVE +# for each of them. +# When interpreting the content of the @FILE, do NOT use func_file_conv, +# since the user would need to supply preconverted file names to +# binutils ar, at least for MinGW. +func_at_file () +{ + operation=$2 + archive=$3 + at_file_contents=`cat "$1"` + eval set x "$at_file_contents" + shift + + for member + do + $AR -NOLOGO $operation:"$member" "$archive" || exit $? + done +} + +case $1 in + '') + func_error "no command. Try '$0 --help' for more information." + ;; + -h | --h*) + cat <. # @@ -592,8 +592,8 @@ # Identity of this package. PACKAGE_NAME='ClamAV' PACKAGE_TARNAME='clamav' -PACKAGE_VERSION='0.100.3' -PACKAGE_STRING='ClamAV 0.100.3' +PACKAGE_VERSION='0.101.4' +PACKAGE_STRING='ClamAV 0.101.4' PACKAGE_BUGREPORT='https://bugzilla.clamav.net/' PACKAGE_URL='https://www.clamav.net/' @@ -646,11 +646,19 @@ am__EXEEXT_TRUE LTLIBOBJS LIBOBJS +DEFINE_SF64_PREFIX +DEFINE_SF32_PREFIX +INT_TYPES_HEADER +UINT64_DEF +INT64_DEF +UINT32_DEF +INT32_DEF +UINT16_DEF +INT16_DEF +UINT8_DEF +INT8_DEF +GENERATE_WARNING HAVE_STRNI -LIBMSPACK_LIBS -LIBMSPACK_CFLAGS -USE_INTERNAL_MSPACK_FALSE -USE_INTERNAL_MSPACK_TRUE JSON_LDFLAGS JSON_LIBS SSL_LDFLAGS @@ -733,6 +741,10 @@ MAINT MAINTAINER_MODE_FALSE MAINTAINER_MODE_TRUE +LIBMSPACK_LIBS +LIBMSPACK_CFLAGS +USE_INTERNAL_MSPACK_FALSE +USE_INTERNAL_MSPACK_TRUE pcreconfig HAVE_LIBXML2_FALSE HAVE_LIBXML2_TRUE @@ -748,9 +760,6 @@ CHECK_CPPFLAGS CHECK_LIBS CHECK_CFLAGS -PKG_CONFIG_LIBDIR -PKG_CONFIG_PATH -PKG_CONFIG ENABLE_FUZZ_FALSE ENABLE_FUZZ_TRUE BUILD_CONFIGURE_FLAGS @@ -764,6 +773,9 @@ LEXLIB LEX_OUTPUT_ROOT LEX +PKG_CONFIG_LIBDIR +PKG_CONFIG_PATH +PKG_CONFIG LTDLOPEN LT_CONFIG_H CONVENIENCE_LTDL_FALSE @@ -791,8 +803,6 @@ DSYMUTIL MANIFEST_TOOL RANLIB -ac_ct_AR -AR DLLTOOL OBJDUMP LN_S @@ -813,6 +823,8 @@ ac_ct_CC CFLAGS CC +ac_ct_AR +AR AM_BACKSLASH AM_DEFAULT_VERBOSITY AM_DEFAULT_V @@ -937,6 +949,7 @@ with_openssl with_libjson with_pcre +with_system_libmspack enable_maintainer_mode with_zlib enable_zlib_vcheck @@ -976,7 +989,6 @@ enable_prelude with_libprelude_prefix with_libcurl -with_system_libmspack enable_strni enable_largefile ' @@ -994,20 +1006,19 @@ CPP LT_SYS_LIBRARY_PATH CXXCPP -YACC -YFLAGS PKG_CONFIG PKG_CONFIG_PATH PKG_CONFIG_LIBDIR +YACC +YFLAGS CHECK_CFLAGS CHECK_LIBS -SYSTEMD_CFLAGS -SYSTEMD_LIBS LIBMSPACK_CFLAGS -LIBMSPACK_LIBS' +LIBMSPACK_LIBS +SYSTEMD_CFLAGS +SYSTEMD_LIBS' ac_subdirs_all=' -libclamav/c++ -libclamav/libmspack-0.5alpha' +libclamav/c++' # Initialize some variables set by options. ac_init_help= @@ -1547,7 +1558,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures ClamAV 0.100.3 to adapt to many kinds of systems. +\`configure' configures ClamAV 0.101.4 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1618,7 +1629,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of ClamAV 0.100.3:";; + short | recursive ) echo "Configuration of ClamAV 0.101.4:";; esac cat <<\_ACEOF @@ -1709,6 +1720,9 @@ --with-pcre[=DIR] path to directory containing libpcre library, prioritizes PCRE2 over PCRE [default=search PATH environment variable] + --with-system-libmspack Specify system libmspack location or to use internal + package, uses full path to libmspack or bin + directory (default=search PATH environment variable) --with-zlib[=DIR] path to directory containing zlib library [default=/usr/local or /usr if not found in /usr/local] @@ -1735,9 +1749,6 @@ --with-libcurl[=DIR] path to directory containing libcurl [default=/usr/local or /usr if not found in /usr/local] - --with-system-libmspack Specify system libmspack location or to use internal - package, uses full path to libmspack or bin - directory (default=search PATH environment variable) Some influential environment variables: CXX C++ compiler command @@ -1753,28 +1764,28 @@ LT_SYS_LIBRARY_PATH User-defined run-time library search path. CXXCPP C++ preprocessor + PKG_CONFIG path to pkg-config utility + PKG_CONFIG_PATH + directories to add to pkg-config's search path + PKG_CONFIG_LIBDIR + path overriding pkg-config's built-in search path YACC The `Yet Another Compiler Compiler' implementation to use. Defaults to the first program found out of: `bison -y', `byacc', `yacc'. YFLAGS The list of arguments that will be passed by default to $YACC. This script will default YFLAGS to the empty string to avoid a default value of `-d' given by some make applications. - PKG_CONFIG path to pkg-config utility - PKG_CONFIG_PATH - directories to add to pkg-config's search path - PKG_CONFIG_LIBDIR - path overriding pkg-config's built-in search path CHECK_CFLAGS C compiler flags for CHECK, overriding pkg-config CHECK_LIBS linker flags for CHECK, overriding pkg-config - SYSTEMD_CFLAGS - C compiler flags for SYSTEMD, overriding pkg-config - SYSTEMD_LIBS - linker flags for SYSTEMD, overriding pkg-config LIBMSPACK_CFLAGS C compiler flags for LIBMSPACK, overriding pkg-config LIBMSPACK_LIBS linker flags for LIBMSPACK, overriding pkg-config + SYSTEMD_CFLAGS + C compiler flags for SYSTEMD, overriding pkg-config + SYSTEMD_LIBS + linker flags for SYSTEMD, overriding pkg-config Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. @@ -1843,7 +1854,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -ClamAV configure 0.100.3 +ClamAV configure 0.101.4 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2433,7 +2444,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by ClamAV $as_me 0.100.3, which was +It was created by ClamAV $as_me 0.101.4, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -3337,7 +3348,7 @@ ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var. -ac_config_headers="$ac_config_headers clamav-config.h" +ac_config_headers="$ac_config_headers clamav-config.h libclammspack/config.h:libclammspack/config.h.in" @@ -4190,7 +4201,7 @@ # Define the identity of the package. PACKAGE='clamav' - VERSION='0.100.3' + VERSION='0.101.4' # Some tools Automake needs. @@ -4557,9 +4568,6 @@ AM_BACKSLASH='\' - -$as_echo "#define PACKAGE PACKAGE_NAME" >>confdefs.h - ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -5287,6 +5295,181 @@ +if test -n "$ac_tool_prefix"; then + for ac_prog in ar lib "link -lib" + do + # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. +set dummy $ac_tool_prefix$ac_prog; ac_word=$2 +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 +$as_echo_n "checking for $ac_word... " >&6; } +if ${ac_cv_prog_AR+:} false; then : + $as_echo_n "(cached) " >&6 +else + if test -n "$AR"; then + ac_cv_prog_AR="$AR" # Let the user override the test. +else +as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_prog_AR="$ac_tool_prefix$ac_prog" + $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done + done +IFS=$as_save_IFS + +fi +fi +AR=$ac_cv_prog_AR +if test -n "$AR"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5 +$as_echo "$AR" >&6; } +else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi + + + test -n "$AR" && break + done +fi +if test -z "$AR"; then + ac_ct_AR=$AR + for ac_prog in ar lib "link -lib" +do + # Extract the first word of "$ac_prog", so it can be a program name with args. +set dummy $ac_prog; ac_word=$2 +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 +$as_echo_n "checking for $ac_word... " >&6; } +if ${ac_cv_prog_ac_ct_AR+:} false; then : + $as_echo_n "(cached) " >&6 +else + if test -n "$ac_ct_AR"; then + ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test. +else +as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_prog_ac_ct_AR="$ac_prog" + $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done + done +IFS=$as_save_IFS + +fi +fi +ac_ct_AR=$ac_cv_prog_ac_ct_AR +if test -n "$ac_ct_AR"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5 +$as_echo "$ac_ct_AR" >&6; } +else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi + + + test -n "$ac_ct_AR" && break +done + + if test "x$ac_ct_AR" = x; then + AR="false" + else + case $cross_compiling:$ac_tool_warned in +yes:) +{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 +$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} +ac_tool_warned=yes ;; +esac + AR=$ac_ct_AR + fi +fi + +: ${AR=ar} + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the archiver ($AR) interface" >&5 +$as_echo_n "checking the archiver ($AR) interface... " >&6; } +if ${am_cv_ar_interface+:} false; then : + $as_echo_n "(cached) " >&6 +else + ac_ext=c +ac_cpp='$CPP $CPPFLAGS' +ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' +ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' +ac_compiler_gnu=$ac_cv_c_compiler_gnu + + am_cv_ar_interface=ar + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ +int some_variable = 0; +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + am_ar_try='$AR cru libconftest.a conftest.$ac_objext >&5' + { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$am_ar_try\""; } >&5 + (eval $am_ar_try) 2>&5 + ac_status=$? + $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 + test $ac_status = 0; } + if test "$ac_status" -eq 0; then + am_cv_ar_interface=ar + else + am_ar_try='$AR -NOLOGO -OUT:conftest.lib conftest.$ac_objext >&5' + { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$am_ar_try\""; } >&5 + (eval $am_ar_try) 2>&5 + ac_status=$? + $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 + test $ac_status = 0; } + if test "$ac_status" -eq 0; then + am_cv_ar_interface=lib + else + am_cv_ar_interface=unknown + fi + fi + rm -f conftest.lib libconftest.a + +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + ac_ext=c +ac_cpp='$CPP $CPPFLAGS' +ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' +ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' +ac_compiler_gnu=$ac_cv_c_compiler_gnu + +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_ar_interface" >&5 +$as_echo "$am_cv_ar_interface" >&6; } + +case $am_cv_ar_interface in +ar) + ;; +lib) + # Microsoft lib, so override with the ar-lib wrapper script. + # FIXME: It is wrong to rewrite AR. + # But if we don't then we get into trouble of one sort or another. + # A longer-term fix would be to have automake use am__AR in this case, + # and then we could set am__AR="$am_aux_dir/ar-lib \$(AR)" or something + # similar. + AR="$am_aux_dir/ar-lib $AR" + ;; +unknown) + as_fn_error $? "could not determine $AR interface" "$LINENO" 5 + ;; +esac + + + +$as_echo "#define PACKAGE PACKAGE_NAME" >>confdefs.h + ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -5746,11 +5929,11 @@ -VERSION="0.100.3" +VERSION="0.101.4" -LC_CURRENT=8 +LC_CURRENT=9 LC_REVISION=2 -LC_AGE=1 +LC_AGE=0 LIBCLAMAV_VERSION="$LC_CURRENT":"$LC_REVISION":"$LC_AGE" @@ -17775,6 +17958,126 @@ + + + + + + +if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args. +set dummy ${ac_tool_prefix}pkg-config; ac_word=$2 +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 +$as_echo_n "checking for $ac_word... " >&6; } +if ${ac_cv_path_PKG_CONFIG+:} false; then : + $as_echo_n "(cached) " >&6 +else + case $PKG_CONFIG in + [\\/]* | ?:[\\/]*) + ac_cv_path_PKG_CONFIG="$PKG_CONFIG" # Let the user override the test with a path. + ;; + *) + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" + $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done + done +IFS=$as_save_IFS + + ;; +esac +fi +PKG_CONFIG=$ac_cv_path_PKG_CONFIG +if test -n "$PKG_CONFIG"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKG_CONFIG" >&5 +$as_echo "$PKG_CONFIG" >&6; } +else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi + + +fi +if test -z "$ac_cv_path_PKG_CONFIG"; then + ac_pt_PKG_CONFIG=$PKG_CONFIG + # Extract the first word of "pkg-config", so it can be a program name with args. +set dummy pkg-config; ac_word=$2 +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 +$as_echo_n "checking for $ac_word... " >&6; } +if ${ac_cv_path_ac_pt_PKG_CONFIG+:} false; then : + $as_echo_n "(cached) " >&6 +else + case $ac_pt_PKG_CONFIG in + [\\/]* | ?:[\\/]*) + ac_cv_path_ac_pt_PKG_CONFIG="$ac_pt_PKG_CONFIG" # Let the user override the test with a path. + ;; + *) + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_ac_pt_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" + $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done + done +IFS=$as_save_IFS + + ;; +esac +fi +ac_pt_PKG_CONFIG=$ac_cv_path_ac_pt_PKG_CONFIG +if test -n "$ac_pt_PKG_CONFIG"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKG_CONFIG" >&5 +$as_echo "$ac_pt_PKG_CONFIG" >&6; } +else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi + + if test "x$ac_pt_PKG_CONFIG" = x; then + PKG_CONFIG="" + else + case $cross_compiling:$ac_tool_warned in +yes:) +{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 +$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} +ac_tool_warned=yes ;; +esac + PKG_CONFIG=$ac_pt_PKG_CONFIG + fi +else + PKG_CONFIG="$ac_cv_path_PKG_CONFIG" +fi + +fi +if test -n "$PKG_CONFIG"; then + _pkg_min_version=0.16 + { $as_echo "$as_me:${as_lineno-$LINENO}: checking pkg-config is at least version $_pkg_min_version" >&5 +$as_echo_n "checking pkg-config is at least version $_pkg_min_version... " >&6; } + if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } + else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } + PKG_CONFIG="" + fi +fi + ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -20242,6 +20545,17 @@ fi done +for ac_func in strnstr +do : + ac_fn_c_check_func "$LINENO" "strnstr" "ac_cv_func_strnstr" +if test "x$ac_cv_func_strnstr" = xyes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_STRNSTR 1 +_ACEOF + +fi +done + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGEFILE_SOURCE value needed for large files" >&5 $as_echo_n "checking for _LARGEFILE_SOURCE value needed for large files... " >&6; } if ${ac_cv_sys_largefile_source+:} false; then : @@ -20621,126 +20935,6 @@ if test "$enable_check_ut" != "no" ; then - - - - - - -if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then - if test -n "$ac_tool_prefix"; then - # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args. -set dummy ${ac_tool_prefix}pkg-config; ac_word=$2 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 -$as_echo_n "checking for $ac_word... " >&6; } -if ${ac_cv_path_PKG_CONFIG+:} false; then : - $as_echo_n "(cached) " >&6 -else - case $PKG_CONFIG in - [\\/]* | ?:[\\/]*) - ac_cv_path_PKG_CONFIG="$PKG_CONFIG" # Let the user override the test with a path. - ;; - *) - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for ac_exec_ext in '' $ac_executable_extensions; do - if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then - ac_cv_path_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" - $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 - break 2 - fi -done - done -IFS=$as_save_IFS - - ;; -esac -fi -PKG_CONFIG=$ac_cv_path_PKG_CONFIG -if test -n "$PKG_CONFIG"; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKG_CONFIG" >&5 -$as_echo "$PKG_CONFIG" >&6; } -else - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } -fi - - -fi -if test -z "$ac_cv_path_PKG_CONFIG"; then - ac_pt_PKG_CONFIG=$PKG_CONFIG - # Extract the first word of "pkg-config", so it can be a program name with args. -set dummy pkg-config; ac_word=$2 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 -$as_echo_n "checking for $ac_word... " >&6; } -if ${ac_cv_path_ac_pt_PKG_CONFIG+:} false; then : - $as_echo_n "(cached) " >&6 -else - case $ac_pt_PKG_CONFIG in - [\\/]* | ?:[\\/]*) - ac_cv_path_ac_pt_PKG_CONFIG="$ac_pt_PKG_CONFIG" # Let the user override the test with a path. - ;; - *) - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for ac_exec_ext in '' $ac_executable_extensions; do - if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then - ac_cv_path_ac_pt_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" - $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 - break 2 - fi -done - done -IFS=$as_save_IFS - - ;; -esac -fi -ac_pt_PKG_CONFIG=$ac_cv_path_ac_pt_PKG_CONFIG -if test -n "$ac_pt_PKG_CONFIG"; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKG_CONFIG" >&5 -$as_echo "$ac_pt_PKG_CONFIG" >&6; } -else - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } -fi - - if test "x$ac_pt_PKG_CONFIG" = x; then - PKG_CONFIG="" - else - case $cross_compiling:$ac_tool_warned in -yes:) -{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 -$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} -ac_tool_warned=yes ;; -esac - PKG_CONFIG=$ac_pt_PKG_CONFIG - fi -else - PKG_CONFIG="$ac_cv_path_PKG_CONFIG" -fi - -fi -if test -n "$PKG_CONFIG"; then - _pkg_min_version=0.9.0 - { $as_echo "$as_me:${as_lineno-$LINENO}: checking pkg-config is at least version $_pkg_min_version" >&5 -$as_echo_n "checking pkg-config is at least version $_pkg_min_version... " >&6; } - if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 -$as_echo "yes" >&6; } - else - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } - PKG_CONFIG="" - fi -fi - pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CHECK" >&5 $as_echo_n "checking for CHECK... " >&6; } @@ -21925,11 +22119,11 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -#include +#include int main () { -SSL_library_init(); +BN_CTX_new(); ; return 0; } @@ -21943,9 +22137,9 @@ conftest$ac_exeext conftest.$ac_ext -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_EncryptInit in -lcrypto" >&5 -$as_echo_n "checking for EVP_EncryptInit in -lcrypto... " >&6; } -if ${ac_cv_lib_crypto_EVP_EncryptInit+:} false; then : +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CRYPTO_free in -lcrypto" >&5 +$as_echo_n "checking for CRYPTO_free in -lcrypto... " >&6; } +if ${ac_cv_lib_crypto_CRYPTO_free+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS @@ -21959,27 +22153,27 @@ #ifdef __cplusplus extern "C" #endif -char EVP_EncryptInit (); +char CRYPTO_free (); int main () { -return EVP_EncryptInit (); +return CRYPTO_free (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : - ac_cv_lib_crypto_EVP_EncryptInit=yes + ac_cv_lib_crypto_CRYPTO_free=yes else - ac_cv_lib_crypto_EVP_EncryptInit=no + ac_cv_lib_crypto_CRYPTO_free=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_EVP_EncryptInit" >&5 -$as_echo "$ac_cv_lib_crypto_EVP_EncryptInit" >&6; } -if test "x$ac_cv_lib_crypto_EVP_EncryptInit" = xyes; then : +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_CRYPTO_free" >&5 +$as_echo "$ac_cv_lib_crypto_CRYPTO_free" >&6; } +if test "x$ac_cv_lib_crypto_CRYPTO_free" = xyes; then : have_crypto="yes" else as_fn_error $? "Your OpenSSL installation is misconfigured or missing" "$LINENO" 5 @@ -22052,7 +22246,10 @@ find_json="yes" else if test "X$withval" != "Xno"; then - LIBJSON_HOME="$withval" + if test -f "${withval}/include/json/json.h" -o -f "${withval}/include/json-c/json.h"; then + LIBJSON_HOME="$withval" + have_json_header="yes" + fi fi fi @@ -22062,18 +22259,12 @@ if test "X$find_json" = "Xyes"; then - LIBJSON_HOME=/usr/local -fi - -if test -f "$LIBJSON_HOME/include/json/json.h" -o -f "$LIBJSON_HOME/include/json-c/json.h"; then - have_json_header="yes" -else - if test "X$find_json" = "Xyes"; then - LIBJSON_HOME=/usr - if test -f "$LIBJSON_HOME/include/json/json.h" -o -f "$LIBJSON_HOME/include/json-c/json.h"; then + for p in /usr/local /usr ; do + if test -f "${p}/include/json/json.h" -o -f "${p}/include/json-c/json.h"; then + LIBJSON_HOME=$p have_json_header="yes" fi - fi + done fi if test "X$have_json_header" = "Xyes"; then @@ -22475,23 +22666,24 @@ if test $pcrever_major -eq 6 && test $pcrever_minor -lt 5; then as_fn_error $? "This pcre version is missing features used by ClamAV. Please upgrade to a newer version: http://www.pcre.org." "$LINENO" 5 fi + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: pcre (original) detected. We recommend upgrading from pcre to pcre2 10.30 or later: http://www.pcre.org." >&5 +$as_echo "$as_me: WARNING: pcre (original) detected. We recommend upgrading from pcre to pcre2 10.30 or later: http://www.pcre.org." >&2;} fi - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CVE-2015-3210" >&5 -$as_echo_n "checking for CVE-2015-3210... " >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CVE-2017-7186" >&5 +$as_echo_n "checking for CVE-2017-7186... " >&6; } if test "$pcrelib" = "pcre2"; then - if test $pcrever_major -eq 10 && test $pcrever_minor -eq 10; then - { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The installed pcre2 version may contain a security bug. Please upgrade to 10.20 or later: http://www.pcre.org." >&5 -$as_echo "$as_me: WARNING: The installed pcre2 version may contain a security bug. Please upgrade to 10.20 or later: http://www.pcre.org." >&2;} + if test $pcrever_major -eq 10 && test $pcrever_minor -lt 24; then + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The installed pcre2 version may contain security bugs. Please upgrade to 10.30 or later: http://www.pcre.org." >&5 +$as_echo "$as_me: WARNING: The installed pcre2 version may contain security bugs. Please upgrade to 10.30 or later: http://www.pcre.org." >&2;} else { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5 $as_echo "ok" >&6; } fi else - if test $pcrever_major -eq 8 && - test $pcrever_minor -gt 33 && test $pcrever_minor -lt 38; then - { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The installed pcre version may contain a security bug. Please upgrade to 8.38 or later: http://www.pcre.org." >&5 -$as_echo "$as_me: WARNING: The installed pcre version may contain a security bug. Please upgrade to 8.38 or later: http://www.pcre.org." >&2;} + if test $pcrever_major -eq 8 && test $pcrever_minor -lt 41; then + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The installed pcre version may contain security bugs. Please upgrade to 8.41+ or _preferably_ install pcre2 10.30+: http://www.pcre.org." >&5 +$as_echo "$as_me: WARNING: The installed pcre version may contain security bugs. Please upgrade to 8.41+ or _preferably_ install pcre2 10.30+: http://www.pcre.org." >&2;} else { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5 $as_echo "ok" >&6; } @@ -22612,6 +22804,111 @@ +# Check whether --with-system-libmspack was given. +if test "${with_system_libmspack+set}" = set; then : + withval=$with_system_libmspack; system_libmspack=$withval +else + system_libmspack="no" +fi + + +if test "x$system_libmspack" = "xno"; then + use_internal_mspack=yes + if test TRUE; then + USE_INTERNAL_MSPACK_TRUE= + USE_INTERNAL_MSPACK_FALSE='#' +else + USE_INTERNAL_MSPACK_TRUE='#' + USE_INTERNAL_MSPACK_FALSE= +fi + +else + +pkg_failed=no +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBMSPACK" >&5 +$as_echo_n "checking for LIBMSPACK... " >&6; } + +if test -n "$LIBMSPACK_CFLAGS"; then + pkg_cv_LIBMSPACK_CFLAGS="$LIBMSPACK_CFLAGS" + elif test -n "$PKG_CONFIG"; then + if test -n "$PKG_CONFIG" && \ + { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libmspack\""; } >&5 + ($PKG_CONFIG --exists --print-errors "libmspack") 2>&5 + ac_status=$? + $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 + test $ac_status = 0; }; then + pkg_cv_LIBMSPACK_CFLAGS=`$PKG_CONFIG --cflags "libmspack" 2>/dev/null` + test "x$?" != "x0" && pkg_failed=yes +else + pkg_failed=yes +fi + else + pkg_failed=untried +fi +if test -n "$LIBMSPACK_LIBS"; then + pkg_cv_LIBMSPACK_LIBS="$LIBMSPACK_LIBS" + elif test -n "$PKG_CONFIG"; then + if test -n "$PKG_CONFIG" && \ + { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libmspack\""; } >&5 + ($PKG_CONFIG --exists --print-errors "libmspack") 2>&5 + ac_status=$? + $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 + test $ac_status = 0; }; then + pkg_cv_LIBMSPACK_LIBS=`$PKG_CONFIG --libs "libmspack" 2>/dev/null` + test "x$?" != "x0" && pkg_failed=yes +else + pkg_failed=yes +fi + else + pkg_failed=untried +fi + + + +if test $pkg_failed = yes; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } + +if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then + _pkg_short_errors_supported=yes +else + _pkg_short_errors_supported=no +fi + if test $_pkg_short_errors_supported = yes; then + LIBMSPACK_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libmspack" 2>&1` + else + LIBMSPACK_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libmspack" 2>&1` + fi + # Put the nasty error message in config.log where it belongs + echo "$LIBMSPACK_PKG_ERRORS" >&5 + + use_internal_mspack=yes +elif test $pkg_failed = untried; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } + use_internal_mspack=yes +else + LIBMSPACK_CFLAGS=$pkg_cv_LIBMSPACK_CFLAGS + LIBMSPACK_LIBS=$pkg_cv_LIBMSPACK_LIBS + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } + use_internal_mspack=no +fi + if test "x$use_internal_mspack" = "xyes"; then + USE_INTERNAL_MSPACK_TRUE= + USE_INTERNAL_MSPACK_FALSE='#' +else + USE_INTERNAL_MSPACK_TRUE='#' + USE_INTERNAL_MSPACK_FALSE= +fi + +fi + + +if test "x$use_internal_mspack" = "xno"; then + mspack_msg="External, $LIBMSPACK_CFLAGS $LIBMSPACK_LIBS" +fi + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable maintainer-specific portions of Makefiles" >&5 $as_echo_n "checking whether to enable maintainer-specific portions of Makefiles... " >&6; } # Check whether --enable-maintainer-mode was given. @@ -24958,7 +25255,7 @@ if test "$have_milter" = "yes"; then save_LIBS="$LIBS" - CLAMAV_MILTER_LIBS="$CLAMAV_MILTER_LIBS -lpthread" + CLAMAV_MILTER_LIBS="$CLAMAV_MILTER_LIBS $THREAD_LIBS" if test -d /usr/lib/libmilter ; then CLAMAV_MILTER_LIBS="$CLAMAV_MILTER_LIBS -L/usr/lib/libmilter" fi @@ -28561,7 +28858,10 @@ find_curl="yes" else if test "X$withval" != "Xno"; then - LIBCURL_HOME="$withval" + if test -f "${withval}/bin/curl-config"; then + LIBCURL_HOME="$withval" + have_curl="yes" + fi fi fi @@ -28571,17 +28871,12 @@ if test "X$find_curl" = "Xyes"; then - LIBCURL_HOME=/usr/local -fi -if test -f "$LIBCURL_HOME/bin/curl-config"; then - have_curl="yes" -else - if test "X$find_curl" = "Xyes"; then - LIBCURL_HOME=/usr - if test -f "$LIBCURL_HOME/bin/curl-config"; then - have_curl="yes" + for p in /usr/local /usr ; do + if test -f "${p}/bin/curl-config"; then + LIBCURL_HOME=$p + have_curl="yes" fi - fi + done fi if test "X$have_curl" = "Xyes"; then @@ -28691,109 +28986,6 @@ -# Check whether --with-system-libmspack was given. -if test "${with_system_libmspack+set}" = set; then : - withval=$with_system_libmspack; system_libmspack=$withval -else - system_libmspack="no" -fi - - - -if test "x$system_libmspack" = "xno"; then - use_internal_mspack=yes - if test TRUE; then - USE_INTERNAL_MSPACK_TRUE= - USE_INTERNAL_MSPACK_FALSE='#' -else - USE_INTERNAL_MSPACK_TRUE='#' - USE_INTERNAL_MSPACK_FALSE= -fi - - CFLAGS="$CFLAGS -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" -else - -pkg_failed=no -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBMSPACK" >&5 -$as_echo_n "checking for LIBMSPACK... " >&6; } - -if test -n "$LIBMSPACK_CFLAGS"; then - pkg_cv_LIBMSPACK_CFLAGS="$LIBMSPACK_CFLAGS" - elif test -n "$PKG_CONFIG"; then - if test -n "$PKG_CONFIG" && \ - { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libmspack\""; } >&5 - ($PKG_CONFIG --exists --print-errors "libmspack") 2>&5 - ac_status=$? - $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 - test $ac_status = 0; }; then - pkg_cv_LIBMSPACK_CFLAGS=`$PKG_CONFIG --cflags "libmspack" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes -else - pkg_failed=yes -fi - else - pkg_failed=untried -fi -if test -n "$LIBMSPACK_LIBS"; then - pkg_cv_LIBMSPACK_LIBS="$LIBMSPACK_LIBS" - elif test -n "$PKG_CONFIG"; then - if test -n "$PKG_CONFIG" && \ - { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libmspack\""; } >&5 - ($PKG_CONFIG --exists --print-errors "libmspack") 2>&5 - ac_status=$? - $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 - test $ac_status = 0; }; then - pkg_cv_LIBMSPACK_LIBS=`$PKG_CONFIG --libs "libmspack" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes -else - pkg_failed=yes -fi - else - pkg_failed=untried -fi - - - -if test $pkg_failed = yes; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } - -if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then - _pkg_short_errors_supported=yes -else - _pkg_short_errors_supported=no -fi - if test $_pkg_short_errors_supported = yes; then - LIBMSPACK_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libmspack" 2>&1` - else - LIBMSPACK_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libmspack" 2>&1` - fi - # Put the nasty error message in config.log where it belongs - echo "$LIBMSPACK_PKG_ERRORS" >&5 - - use_internal_mspack=yes -elif test $pkg_failed = untried; then - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } - use_internal_mspack=yes -else - LIBMSPACK_CFLAGS=$pkg_cv_LIBMSPACK_CFLAGS - LIBMSPACK_LIBS=$pkg_cv_LIBMSPACK_LIBS - { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 -$as_echo "yes" >&6; } - use_internal_mspack=no -fi - if test "x$use_internal_mspack" = "xyes"; then - USE_INTERNAL_MSPACK_TRUE= - USE_INTERNAL_MSPACK_FALSE='#' -else - USE_INTERNAL_MSPACK_TRUE='#' - USE_INTERNAL_MSPACK_FALSE= -fi - -fi - - # Check whether --enable-strni was given. if test "${enable_strni+set}" = set; then : enableval=$enable_strni; enable_strni=$enableval @@ -28814,8 +29006,6 @@ if test "x$use_internal_mspack" = "xyes"; then mspack_msg="Internal" - subdirs="$subdirs libclamav/libmspack-0.5alpha" - # Check whether --enable-largefile was given. if test "${enable_largefile+set}" = set; then : enableval=$enable_largefile; @@ -29020,8 +29210,148 @@ mspack_msg="External, $LIBMSPACK_CFLAGS $LIBMSPACK_LIBS" fi +ac_config_files="$ac_config_files clamscan/Makefile database/Makefile docs/Makefile clamd/Makefile clamd/clamav-daemon.service clamd/clamav-daemon.socket clamdscan/Makefile clamsubmit/Makefile clamav-milter/Makefile freshclam/clamav-freshclam.service freshclam/Makefile sigtool/Makefile clamconf/Makefile etc/Makefile test/Makefile unit_tests/Makefile fuzz/Makefile clamdtop/Makefile clambc/Makefile libfreshclam/Makefile Makefile clamav-config libclamav.pc platform.h docs/man/clamav-milter.8 docs/man/clamav-milter.conf.5 docs/man/clambc.1 docs/man/clamconf.1 docs/man/clamd.8 docs/man/clamd.conf.5 docs/man/clamdscan.1 docs/man/clamscan.1 docs/man/freshclam.1 docs/man/freshclam.conf.5 docs/man/sigtool.1 docs/man/clamdtop.1 docs/man/clamsubmit.1 clamav-types.h" + + +# Define variables needed to generate clamav-types.h. +# Define a warning for the user, so they don't edit clamav-types.h +GENERATE_WARNING="Warning: This file is generated with ./configure. Do not edit!" + + +# Initialize definitions to empty strings, in case they're not needed. +INT8_DEF="" -ac_config_files="$ac_config_files clamscan/Makefile database/Makefile docs/Makefile clamd/Makefile clamd/clamav-daemon.service clamd/clamav-daemon.socket clamdscan/Makefile clamsubmit/Makefile clamav-milter/Makefile freshclam/clamav-freshclam.service freshclam/Makefile sigtool/Makefile clamconf/Makefile etc/Makefile test/Makefile unit_tests/Makefile fuzz/Makefile clamdtop/Makefile clambc/Makefile libfreshclam/Makefile Makefile clamav-config libclamav.pc platform.h docs/man/clamav-milter.8 docs/man/clamav-milter.conf.5 docs/man/clambc.1 docs/man/clamconf.1 docs/man/clamd.8 docs/man/clamd.conf.5 docs/man/clamdscan.1 docs/man/clamscan.1 docs/man/freshclam.1 docs/man/freshclam.conf.5 docs/man/sigtool.1 docs/man/clamdtop.1 docs/man/clamsubmit.1" +UINT8_DEF="" + +INT16_DEF="" + +UINT16_DEF="" + +INT32_DEF="" + +UINT32_DEF="" + +INT64_DEF="" + +UINT64_DEF="" + + +# Check sys/int_types.h first, to give it higher priority on Solaris +ac_fn_c_check_header_mongrel "$LINENO" "sys/int_types.h" "ac_cv_header_sys_int_types_h" "$ac_includes_default" +if test "x$ac_cv_header_sys_int_types_h" = xyes; then : + INT_TYPES_HEADER="#include " + + +else + ac_fn_c_check_header_mongrel "$LINENO" "inttypes.h" "ac_cv_header_inttypes_h" "$ac_includes_default" +if test "x$ac_cv_header_inttypes_h" = xyes; then : + INT_TYPES_HEADER="#include " + + +else + ac_fn_c_check_header_mongrel "$LINENO" "stdint.h" "ac_cv_header_stdint_h" "$ac_includes_default" +if test "x$ac_cv_header_stdint_h" = xyes; then : + INT_TYPES_HEADER="#include " + + +else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + + + #ifndef _MSC_VER + error: _MSC_VER not found! + #endif + + +int +main () +{ + + ; + return 0; +} + +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + INT_TYPES_HEADER="#include " + + +else + INT8_DEF="typedef signed char int8_t;" + + UINT8_DEF="typedef unsigned char uint8_t;" + + + if test $ac_cv_sizeof_int = 2; then + INT16_DEF="typedef signed int int16_t;" + + UINT16_DEF="typedef unsigned int uint16_t;" + + elif test $ac_cv_sizeof_short = 2; then + INT16_DEF="typedef signed short int16_t;" + + UINT16_DEF="typedef unsigned short uint16_t;" + + fi + + if test $ac_cv_sizeof_int = 4; then + INT32_DEF="typedef signed int int32_t;" + + UINT32_DEF="typedef unsigned int uint32_t;" + + elif test $ac_cv_sizeof_long = 4; then + INT32_DEF="typedef signed long int32_t;" + + UINT32_DEF="typedef unsigned long uint32_t;" + + fi + + if test $ac_cv_sizeof_long = 8; then + INT64_DEF="typedef signed long int64_t;" + + UINT64_DEF="typedef unsigned long uint64_t;" + + elif test $ac_cv_sizeof_long_long = 8; then + INT64_DEF="typedef signed long long int64_t;" + + UINT64_DEF="typedef unsigned long long uint64_t;" + + fi + + +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + +fi + + + +fi + + + +fi + + + +# If _SF64_PREFIX isn't defined, this may be used. +if test $ac_cv_sizeof_int = 4; then + DEFINE_SF32_PREFIX="#define _SF32_PREFIX \"\"" + +elif test $ac_cv_sizeof_long = 4; then + DEFINE_SF32_PREFIX="#define _SF32_PREFIX \"l\"" + +fi + +# If _SF32_PREFIX isn't defined, this may be used. +if test $ac_cv_sizeof_long = 8; then + DEFINE_SF64_PREFIX="#define _SF64_PREFIX \"l\"" + +elif test $ac_cv_sizeof_long_long = 8; then + DEFINE_SF64_PREFIX="#define _SF64_PREFIX \"ll\"" + +fi cat >confcache <<\_ACEOF @@ -29211,6 +29541,14 @@ as_fn_error $? "conditional \"HAVE_LIBXML2\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi +if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then + as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. +Usually this means the macro was only invoked conditionally." "$LINENO" 5 +fi +if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then + as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. +Usually this means the macro was only invoked conditionally." "$LINENO" 5 +fi if test -z "${MAINTAINER_MODE_TRUE}" && test -z "${MAINTAINER_MODE_FALSE}"; then as_fn_error $? "conditional \"MAINTAINER_MODE\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 @@ -29251,14 +29589,6 @@ as_fn_error $? "conditional \"ENABLE_LIBFRESHCLAM\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi -if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then - as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. -Usually this means the macro was only invoked conditionally." "$LINENO" 5 -fi -if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then - as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. -Usually this means the macro was only invoked conditionally." "$LINENO" 5 -fi : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 @@ -29656,7 +29986,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by ClamAV $as_me 0.100.3, which was +This file was extended by ClamAV $as_me 0.101.4, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -29723,7 +30053,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -ClamAV config.status 0.100.3 +ClamAV config.status 0.101.4 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" @@ -30234,6 +30564,7 @@ do case $ac_config_target in "clamav-config.h") CONFIG_HEADERS="$CONFIG_HEADERS clamav-config.h" ;; + "libclammspack/config.h") CONFIG_HEADERS="$CONFIG_HEADERS libclammspack/config.h:libclammspack/config.h.in" ;; "depfiles") CONFIG_COMMANDS="$CONFIG_COMMANDS depfiles" ;; "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;; "libltdl/Makefile") CONFIG_FILES="$CONFIG_FILES libltdl/Makefile" ;; @@ -30274,6 +30605,7 @@ "docs/man/sigtool.1") CONFIG_FILES="$CONFIG_FILES docs/man/sigtool.1" ;; "docs/man/clamdtop.1") CONFIG_FILES="$CONFIG_FILES docs/man/clamdtop.1" ;; "docs/man/clamsubmit.1") CONFIG_FILES="$CONFIG_FILES docs/man/clamsubmit.1" ;; + "clamav-types.h") CONFIG_FILES="$CONFIG_FILES clamav-types.h" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac @@ -32082,6 +32414,14 @@ as_fn_error $? "conditional \"HAVE_LIBXML2\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi +if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then + as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. +Usually this means the macro was only invoked conditionally." "$LINENO" 5 +fi +if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then + as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. +Usually this means the macro was only invoked conditionally." "$LINENO" 5 +fi if test -z "${MAINTAINER_MODE_TRUE}" && test -z "${MAINTAINER_MODE_FALSE}"; then as_fn_error $? "conditional \"MAINTAINER_MODE\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 @@ -32122,14 +32462,6 @@ as_fn_error $? "conditional \"ENABLE_LIBFRESHCLAM\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi -if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then - as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. -Usually this means the macro was only invoked conditionally." "$LINENO" 5 -fi -if test -z "${USE_INTERNAL_MSPACK_TRUE}" && test -z "${USE_INTERNAL_MSPACK_FALSE}"; then - as_fn_error $? "conditional \"USE_INTERNAL_MSPACK\" was never defined. -Usually this means the macro was only invoked conditionally." "$LINENO" 5 -fi if test -z "${am__EXEEXT_TRUE}" && test -z "${am__EXEEXT_FALSE}"; then as_fn_error $? "conditional \"am__EXEEXT\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 @@ -32543,7 +32875,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by ClamAV $as_me 0.100.3, which was +This file was extended by ClamAV $as_me 0.101.4, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -32610,7 +32942,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -ClamAV config.status 0.100.3 +ClamAV config.status 0.101.4 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" @@ -33122,6 +33454,7 @@ do case $ac_config_target in "clamav-config.h") CONFIG_HEADERS="$CONFIG_HEADERS clamav-config.h" ;; + "libclammspack/config.h") CONFIG_HEADERS="$CONFIG_HEADERS libclammspack/config.h:libclammspack/config.h.in" ;; "depfiles") CONFIG_COMMANDS="$CONFIG_COMMANDS depfiles" ;; "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;; "libltdl/Makefile") CONFIG_FILES="$CONFIG_FILES libltdl/Makefile" ;; @@ -33162,6 +33495,7 @@ "docs/man/sigtool.1") CONFIG_FILES="$CONFIG_FILES docs/man/sigtool.1" ;; "docs/man/clamdtop.1") CONFIG_FILES="$CONFIG_FILES docs/man/clamdtop.1" ;; "docs/man/clamsubmit.1") CONFIG_FILES="$CONFIG_FILES docs/man/clamsubmit.1" ;; + "clamav-types.h") CONFIG_FILES="$CONFIG_FILES clamav-types.h" ;; "libclamav/Makefile") CONFIG_FILES="$CONFIG_FILES libclamav/Makefile" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; diff -Nru clamav-0.100.3+dfsg/configure.ac clamav-0.101.4+dfsg/configure.ac --- clamav-0.100.3+dfsg/configure.ac 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/configure.ac 2019-08-25 09:24:30.000000000 +0000 @@ -22,7 +22,7 @@ AC_PREREQ([2.59]) dnl For a release change [devel] to the real version [0.xy] dnl also change VERSION below -AC_INIT([ClamAV], [0.100.3], [https://bugzilla.clamav.net/], [clamav], [https://www.clamav.net/]) +AC_INIT([ClamAV], [0.101.4], [https://bugzilla.clamav.net/], [clamav], [https://www.clamav.net/]) dnl enable C++ AC_PROG_CXX() @@ -30,7 +30,7 @@ AH_BOTTOM([#include "platform.h"]) dnl put configure auxiliary into config AC_CONFIG_AUX_DIR([config]) -AC_CONFIG_HEADER([clamav-config.h]) +AC_CONFIG_HEADERS([clamav-config.h ]) dnl safety check, this used to be a parameter to AC_INIT AC_CONFIG_SRCDIR([clamscan/clamscan.c]) @@ -42,6 +42,8 @@ AM_INIT_AUTOMAKE([1.11 -Wall -Wportability -Wno-override std-options foreign dist-bzip2 no-define color-tests parallel-tests tar-ustar]) AM_SILENT_RULES([yes]) +m4_ifdef([AM_PROG_AR], [AM_PROG_AR]) + dnl we told automake to not define these, since we want to include dnl the date in the version AC_DEFINE([PACKAGE], PACKAGE_NAME, [Name of package]) @@ -52,6 +54,7 @@ LT_CONFIG_LTDL_DIR([libltdl]) LT_INIT([dlopen disable-static]) LTDL_INIT([recursive]) +PKG_PROG_PKG_CONFIG(0.16) m4_include([m4/reorganization/build_tools.m4]) m4_include([m4/reorganization/headers.m4]) @@ -88,6 +91,11 @@ m4_include([m4/reorganization/libs/openssl.m4]) m4_include([m4/reorganization/libs/json.m4]) m4_include([m4/reorganization/libs/pcre.m4]) +m4_include([m4/reorganization/libs/libmspack.m4]) + +if test "x$use_internal_mspack" = "xno"; then + mspack_msg="External, $LIBMSPACK_CFLAGS $LIBMSPACK_LIBS" +fi AM_MAINTAINER_MODE m4_include([m4/reorganization/libs/libz.m4]) @@ -139,18 +147,15 @@ dnl Freshclam dependencies m4_include([m4/reorganization/libs/curl.m4]) m4_include([m4/reorganization/substitutions.m4]) -m4_include([m4/reorganization/libmspack.m4]) m4_include([m4/reorganization/strni.m4]) if test "x$use_internal_mspack" = "xyes"; then mspack_msg="Internal" - AC_CONFIG_SUBDIRS([libclamav/libmspack-0.5alpha]) AC_SYS_LARGEFILE else mspack_msg="External, $LIBMSPACK_CFLAGS $LIBMSPACK_LIBS" fi - AC_CONFIG_FILES([ clamscan/Makefile database/Makefile @@ -189,8 +194,12 @@ docs/man/sigtool.1 docs/man/clamdtop.1 docs/man/clamsubmit.1 +clamav-types.h ]) +# Define variables needed to generate clamav-types.h. +m4_include([m4/reorganization/types.m4]) + AC_OUTPUT if test "$enable_llvm" = "yes" && test "$subdirfailed" != "no"; then @@ -243,7 +252,7 @@ if test "X$have_curl" != "Xyes" && test "X$have_json" != "Xyes"; then CL_MSG_STATUS([clamsubmit ], [no (missing libjson-c-dev AND libcurl-devel. Use the website to submit FPs/FNs.)], [no]) else - if test "X$have_curl" = "Xyes"; then + if test "X$have_curl" = "Xyes"; then CL_MSG_STATUS([clamsubmit ], [no (missing libjson-c-dev. Use the website to submit FPs/FNs.)], [no]) else CL_MSG_STATUS([clamsubmit ], [no (missing libcurl-devel. Use the website to submit FPs/FNs.)], [no]) @@ -285,7 +294,7 @@ CL_MSG_STATUS([pcre ],[$PCRE_HOME],[$have_pcre]) fi CL_MSG_STATUS([libmspack ],[yes],[$mspack_msg]) -if test "x$XML_LIBS" = "x"; then +if test "x$XML_LIBS" = "x"; then CL_MSG_STATUS([libxml2 ],[no],[]) else CL_MSG_STATUS([libxml2 ],[yes, from $XML_HOME],[]) diff -Nru clamav-0.100.3+dfsg/database/Makefile.in clamav-0.101.4+dfsg/database/Makefile.in --- clamav-0.100.3+dfsg/database/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/database/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -127,6 +127,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -175,14 +176,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) @@ -252,6 +253,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -266,6 +269,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -280,6 +284,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -361,6 +370,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ diff -Nru clamav-0.100.3+dfsg/debian/changelog clamav-0.101.4+dfsg/debian/changelog --- clamav-0.100.3+dfsg/debian/changelog 2019-04-04 13:25:12.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/changelog 2019-09-24 09:31:17.000000000 +0000 @@ -1,3 +1,18 @@ +clamav (0.101.4+dfsg-0ubuntu0.18.04.1) bionic-security; urgency=medium + + * Updated to version 0.101.4 to fix security issues. + - debian/patches/*: sync patches with 0.101.4+dfsg-1ubuntu1. + - debian/clamav-daemon.postinst.in: removed DetectBrokenExecutables, + added MaxScanTime, HeuristicAlerts, Alert*. + - debian/*: updated for new library version. + - debian/libclamav9.symbols: updated for new version. + - debian/clamav-docs*, debian/rules: fix doc file locations. + - debian/libclam-dev.install: include new header file. + - CVE-2019-12625 + - CVE-2019-12900 + + -- Marc Deslauriers Tue, 24 Sep 2019 05:31:17 -0400 + clamav (0.100.3+dfsg-0ubuntu0.18.04.1) bionic-security; urgency=medium * Updated to version 0.100.3 to fix security issues. (LP: #1822503) diff -Nru clamav-0.100.3+dfsg/debian/clamav-base.docs clamav-0.101.4+dfsg/debian/clamav-base.docs --- clamav-0.100.3+dfsg/debian/clamav-base.docs 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-base.docs 2019-09-24 09:31:17.000000000 +0000 @@ -1,2 +1,4 @@ -debian/README.Debian debian/NEWS.Debian +debian/README.Debian +NEWS.md +README.md diff -Nru clamav-0.100.3+dfsg/debian/clamav-daemon.postinst.in clamav-0.101.4+dfsg/debian/clamav-daemon.postinst.in --- clamav-0.100.3+dfsg/debian/clamav-daemon.postinst.in 2018-07-19 12:07:50.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-daemon.postinst.in 2019-09-24 09:31:17.000000000 +0000 @@ -183,7 +183,7 @@ [ -z "$ExtendedDetectionInfo" ] && ExtendedDetectionInfo=true [ -z "$DatabaseDirectory" ] && DatabaseDirectory='/var/lib/clamav' [ -z "$OfficialDatabaseOnly" ] && OfficialDatabaseOnly=false - [ -z "$CommandReadTimeout" ] && CommandReadTimeout=5 + [ -z "$CommandReadTimeout" ] && CommandReadTimeout=30 [ -z "$SendBufTimeout" ] && SendBufTimeout=200 [ -z "$MaxQueue" ] && MaxQueue=100 [ -z "$IdleTimeout" ] && IdleTimeout=30 @@ -197,7 +197,6 @@ [ -z "$DisableCache" ] && DisableCache=false [ -z "$ScanPE" ] && ScanPE=true [ -z "$ScanELF" ] && ScanELF=true - [ -z "$DetectBrokenExecutables" ] && DetectBrokenExecutables=false [ -z "$ScanOLE2" ] && ScanOLE2=true [ -z "$OLE2BlockMacros" ] && OLE2BlockMacros=false [ -z "$OnAccessExcludeRootUID" ] && OnAccessExcludeRootUID=no @@ -212,6 +211,7 @@ [ -z "$StructuredDataDetection" ] && StructuredDataDetection=false [ -z "$ScanHTML" ] && ScanHTML=true [ -z "$ArchiveBlockEncrypted" ] && ArchiveBlockEncrypted=false + [ -z "$MaxScanTime" ] && MaxScanTime=120000 [ -z "$MaxScanSize" ] && MaxScanSize=100M [ -z "$MaxFileSize" ] && MaxFileSize=25M [ -z "$MaxRecursion" ] && MaxRecursion=16 @@ -307,7 +307,6 @@ MaxScriptNormalize $MaxScriptNormalize MaxZipTypeRcg $MaxZipTypeRcg ScanSWF $ScanSWF -DetectBrokenExecutables $DetectBrokenExecutables ExitOnOOM $ExitOnOOM LeaveTemporaryFiles $LeaveTemporaryFiles AlgorithmicDetection $AlgorithmicDetection @@ -333,6 +332,7 @@ ForceToDisk $ForceToDisk DisableCertCheck $DisableCertCheck DisableCache $DisableCache +MaxScanTime $MaxScanTime MaxScanSize $MaxScanSize MaxFileSize $MaxFileSize MaxRecursion $MaxRecursion @@ -411,6 +411,16 @@ [ -n "$OnAccessDisableDDD" ] && echo "OnAccessDisableDDD $OnAccessDisableDDD" >> $DEBCONFFILE [ -n "$OnAccessPrevention" ] && echo "OnAccessPrevention $OnAccessPrevention" >> $DEBCONFFILE [ -n "$OnAccessExtraScanning" ] && echo "OnAccessExtraScanning $OnAccessExtraScanning" >> $DEBCONFFILE + [ -n "$HeuristicAlerts" ] && echo "HeuristicAlerts $HeuristicAlerts" >> $DEBCONFFILE + [ -n "$AlertBrokenExecutables" ] && echo "AlertBrokenExecutables $AlertBrokenExecutables" >> $DEBCONFFILE + [ -n "$AlertEncrypted" ] && echo "AlertEncrypted $AlertEncrypted" >> $DEBCONFFILE + [ -n "$AlertEncryptedArchive" ] && echo "AlertEncryptedArchive $AlertEncryptedArchive" >> $DEBCONFFILE + [ -n "$AlertEncryptedDoc" ] && echo "AlertEncryptedDoc $AlertEncryptedDoc" >> $DEBCONFFILE + [ -n "$AlertOLE2Macros" ] && echo "AlertOLE2Macros $AlertOLE2Macros" >> $DEBCONFFILE + [ -n "$AlertPhishingSSLMismatch" ] && echo "AlertPhishingSSLMismatch $AlertPhishingSSLMismatch" >> $DEBCONFFILE + [ -n "$AlertPhishingCloak" ] && echo "AlertPhishingCloak $AlertPhishingCloak" >> $DEBCONFFILE + [ -n "$AlertPartitionIntersection" ] && echo "AlertPartitionIntersection $AlertPartitionIntersection" >> $DEBCONFFILE + [ -n "$AlertExceedsMax" ] && echo "AlertExceedsMax $AlertExceedsMax" >> $DEBCONFFILE # Preserve old, deprecated options. [ -n "$ClamukoScanOnAccess" ] && echo "ClamukoScanOnAccess $ClamukoScanOnAccess" >> $DEBCONFFILE diff -Nru clamav-0.100.3+dfsg/debian/clamav-docs.doc-base clamav-0.101.4+dfsg/debian/clamav-docs.doc-base --- clamav-0.100.3+dfsg/debian/clamav-docs.doc-base 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-docs.doc-base 2019-09-24 09:31:17.000000000 +0000 @@ -4,10 +4,10 @@ Abstract: Documentation for the ClamAV suite Section: System/Security -Format: PDF -Files: /usr/share/doc/clamav-docs/clamdoc.pdf - Format: HTML -Index: /usr/share/doc/clamav-docs/html/index.html -Files: /usr/share/doc/clamav-docs/html/*.html +Index: /usr/share/doc/clamav-docs/html/UserManual.html +Files: /usr/share/doc/clamav-docs/html/UserManual/*.html +Format: Text +Index: /usr/share/doc/clamav-docs/UserManual.md +Files: /usr/share/doc/clamav-docs/UserManual/*.md diff -Nru clamav-0.100.3+dfsg/debian/clamav-docs.docs clamav-0.101.4+dfsg/debian/clamav-docs.docs --- clamav-0.100.3+dfsg/debian/clamav-docs.docs 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-docs.docs 2019-09-24 09:31:17.000000000 +0000 @@ -1,5 +1,7 @@ -docs/*.pdf -docs/*.tex -docs/html -debian/README.Debian debian/NEWS.Debian +debian/README.Debian +docs/html +docs/UserManual +docs/UserManual.md +NEWS.md +README.md diff -Nru clamav-0.100.3+dfsg/debian/clamav-freshclam.docs clamav-0.101.4+dfsg/debian/clamav-freshclam.docs --- clamav-0.100.3+dfsg/debian/clamav-freshclam.docs 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-freshclam.docs 2019-09-24 09:31:17.000000000 +0000 @@ -1 +1,3 @@ debian/mirror-list +NEWS.md +README.md diff -Nru clamav-0.100.3+dfsg/debian/clamav.links clamav-0.101.4+dfsg/debian/clamav.links --- clamav-0.100.3+dfsg/debian/clamav.links 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav.links 2019-09-24 09:31:17.000000000 +0000 @@ -1,2 +1,2 @@ -/usr/share/doc/libclamav7/README.Debian.gz /usr/share/doc/clamav/README.Debian.gz -/usr/share/doc/libclamav7/NEWS.Debian.gz /usr/share/doc/clamav/NEWS.Debian.gz +/usr/share/doc/libclamav9/README.Debian.gz /usr/share/doc/clamav/README.Debian.gz +/usr/share/doc/libclamav9/NEWS.Debian.gz /usr/share/doc/clamav/NEWS.Debian.gz diff -Nru clamav-0.100.3+dfsg/debian/clamav-milter.docs clamav-0.101.4+dfsg/debian/clamav-milter.docs --- clamav-0.100.3+dfsg/debian/clamav-milter.docs 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/clamav-milter.docs 2019-09-24 09:31:17.000000000 +0000 @@ -1,2 +1,4 @@ -debian/README.Debian debian/NEWS.Debian +debian/README.Debian +NEWS.md +README.md diff -Nru clamav-0.100.3+dfsg/debian/control clamav-0.101.4+dfsg/debian/control --- clamav-0.100.3+dfsg/debian/control 2018-07-19 12:07:50.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/control 2019-09-24 09:31:17.000000000 +0000 @@ -109,7 +109,7 @@ Architecture: any Depends: libbz2-dev, libc6-dev | libc-dev, - libclamav7 (= ${binary:Version}), + libclamav9 (= ${binary:Version}), libidn11-dev, libssl-dev, libtommath-dev, @@ -129,12 +129,12 @@ . This library can be used to develop virus scanner applications. -Package: libclamav7 +Package: libclamav9 Section: libs Architecture: any Multi-Arch: same Depends: ${misc:Depends}, ${shlibs:Depends} -Suggests: libclamunrar7 +Suggests: libclamunrar9 Description: anti-virus utility for Unix - library Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment diff -Nru clamav-0.100.3+dfsg/debian/libclamav7.docs clamav-0.101.4+dfsg/debian/libclamav7.docs --- clamav-0.100.3+dfsg/debian/libclamav7.docs 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav7.docs 1970-01-01 00:00:00.000000000 +0000 @@ -1,2 +0,0 @@ -debian/README.Debian -debian/NEWS.Debian diff -Nru clamav-0.100.3+dfsg/debian/libclamav7.install clamav-0.101.4+dfsg/debian/libclamav7.install --- clamav-0.100.3+dfsg/debian/libclamav7.install 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav7.install 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -debian/tmp/usr/lib/*/libclamav.so.7* diff -Nru clamav-0.100.3+dfsg/debian/libclamav7.lintian-overrides clamav-0.101.4+dfsg/debian/libclamav7.lintian-overrides --- clamav-0.100.3+dfsg/debian/libclamav7.lintian-overrides 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav7.lintian-overrides 1970-01-01 00:00:00.000000000 +0000 @@ -1,4 +0,0 @@ -# This is sort of a false positive, because libclamav uses the packaged zlib. -# It still embeds a modified version of zlib to support 64 bit decompression, -# which is not part of zlib, see #308799. -libclamav7 binary: embedded-library usr/lib/*/libclamav.so.7.*: zlib diff -Nru clamav-0.100.3+dfsg/debian/libclamav7.symbols clamav-0.101.4+dfsg/debian/libclamav7.symbols --- clamav-0.100.3+dfsg/debian/libclamav7.symbols 2019-04-04 12:51:41.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav7.symbols 1970-01-01 00:00:00.000000000 +0000 @@ -1,253 +0,0 @@ -libclamav.so.7 libclamav7 #MINVER# - CLAMAV_PRIVATE@CLAMAV_PRIVATE 0.100.3 - CLAMAV_PUBLIC@CLAMAV_PUBLIC 0.99~rc1 - base64Flush@CLAMAV_PRIVATE 0.100.3 - blobAddData@CLAMAV_PRIVATE 0.100.3 - blobCreate@CLAMAV_PRIVATE 0.100.3 - blobDestroy@CLAMAV_PRIVATE 0.100.3 - cl_ASN1_GetTimeT@CLAMAV_PRIVATE 0.100.3 - cl_always_gen_section_hash@CLAMAV_PUBLIC 0.99~rc1 - cl_base64_decode@CLAMAV_PRIVATE 0.100.3 - cl_base64_encode@CLAMAV_PRIVATE 0.100.3 - cl_cleanup_crypto@CLAMAV_PRIVATE 0.100.3 - cl_countsigs@CLAMAV_PUBLIC 0.99~rc1 - cl_cvdfree@CLAMAV_PUBLIC 0.99~rc1 - cl_cvdhead@CLAMAV_PUBLIC 0.99~rc1 - cl_cvdparse@CLAMAV_PUBLIC 0.99~rc1 - cl_cvdverify@CLAMAV_PUBLIC 0.99~rc1 - cl_debug@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_addref@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_compile@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_free@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_get_num@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_get_str@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_new@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_file_props@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_hash@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_meta@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_post_scan@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_pre_cache@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_pre_scan@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_sigload@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_add_sample@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_decrement_count@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_flush@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_get_hostid@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_get_num@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_get_size@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_remove_sample@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_stats_submit@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_clcb_virus_found@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_num@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_stats_set_cbdata@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_set_str@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_settings_apply@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_settings_copy@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_settings_free@CLAMAV_PUBLIC 0.99~rc1 - cl_engine_stats_enable@CLAMAV_PUBLIC 0.99~rc1 - cl_finish_hash@CLAMAV_PUBLIC 0.99~rc1 - cl_fmap_close@CLAMAV_PUBLIC 0.99~rc1 - cl_fmap_open_handle@CLAMAV_PUBLIC 0.99~rc1 - cl_fmap_open_memory@CLAMAV_PUBLIC 0.99~rc1 - cl_get_pkey_file@CLAMAV_PRIVATE 0.100.3 - cl_get_x509_from_mem@CLAMAV_PRIVATE 0.100.3 - cl_hash_data@CLAMAV_PRIVATE 0.100.3 - cl_hash_destroy@CLAMAV_PUBLIC 0.99~rc1 - cl_hash_file_fd@CLAMAV_PRIVATE 0.100.3 - cl_hash_file_fd_ctx@CLAMAV_PRIVATE 0.100.3 - cl_hash_file_fp@CLAMAV_PRIVATE 0.100.3 - cl_hash_init@CLAMAV_PUBLIC 0.99~rc1 - cl_init@CLAMAV_PUBLIC 0.99~rc1 - cl_initialize_crypto@CLAMAV_PRIVATE 0.100.3 - cl_load@CLAMAV_PUBLIC 0.99~rc1 - cl_load_cert@CLAMAV_PRIVATE 0.100.3 - cl_load_crl@CLAMAV_PRIVATE 0.100.3 - cl_retdbdir@CLAMAV_PUBLIC 0.99~rc1 - cl_retflevel@CLAMAV_PUBLIC 0.100.2 - cl_retver@CLAMAV_PUBLIC 0.99~rc1 - cl_scandesc@CLAMAV_PUBLIC 0.99~rc1 - cl_scandesc_callback@CLAMAV_PUBLIC 0.99~rc1 - cl_scanfile@CLAMAV_PUBLIC 0.99~rc1 - cl_scanfile_callback@CLAMAV_PUBLIC 0.99~rc1 - cl_scanmap_callback@CLAMAV_PUBLIC 0.99~rc1 - cl_set_clcb_msg@CLAMAV_PUBLIC 0.99~rc1 - cl_sha1@CLAMAV_PRIVATE 0.100.3 - cl_sha256@CLAMAV_PRIVATE 0.100.3 - cl_sign_data@CLAMAV_PRIVATE 0.100.3 - cl_sign_data_keyfile@CLAMAV_PRIVATE 0.100.3 - cl_sign_file_fd@CLAMAV_PRIVATE 0.100.3 - cl_sign_file_fp@CLAMAV_PRIVATE 0.100.3 - cl_statchkdir@CLAMAV_PUBLIC 0.99~rc1 - cl_statfree@CLAMAV_PUBLIC 0.99~rc1 - cl_statinidir@CLAMAV_PUBLIC 0.99~rc1 - cl_strerror@CLAMAV_PUBLIC 0.99~rc1 - cl_update_hash@CLAMAV_PUBLIC 0.99~rc1 - cl_validate_certificate_chain@CLAMAV_PRIVATE 0.100.3 - cl_validate_certificate_chain_ts_dir@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_fd@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_fd_x509@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_fd_x509_keyfile@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_hash@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_hash_x509@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_hash_x509_keyfile@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_x509@CLAMAV_PRIVATE 0.100.3 - cl_verify_signature_x509_keyfile@CLAMAV_PRIVATE 0.100.3 - cli_ac_buildtrie@CLAMAV_PRIVATE 0.100.3 - cli_ac_chklsig@CLAMAV_PRIVATE 0.100.3 - cli_ac_free@CLAMAV_PRIVATE 0.100.3 - cli_ac_freedata@CLAMAV_PRIVATE 0.100.3 - cli_ac_init@CLAMAV_PRIVATE 0.100.3 - cli_ac_initdata@CLAMAV_PRIVATE 0.100.3 - cli_ac_scanbuff@CLAMAV_PRIVATE 0.100.3 - cli_bm_free@CLAMAV_PRIVATE 0.100.3 - cli_bm_init@CLAMAV_PRIVATE 0.100.3 - cli_bm_scanbuff@CLAMAV_PRIVATE 0.100.3 - cli_build_regex_list@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_alloc@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_clear@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_destroy@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_getresult_int@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_set_trace@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_setfile@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_setfuncid@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_setparam_int@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_context_setparam_ptr@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_debug@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_debug_printsrc@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_describe@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_destroy@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_done@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_init@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_load@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_prepare2@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_printversion@CLAMAV_PRIVATE 0.100.3 - cli_bytecode_run@CLAMAV_PRIVATE 0.100.3 - cli_bytefunc_describe@CLAMAV_PRIVATE 0.100.3 - cli_byteinst_describe@CLAMAV_PRIVATE 0.100.3 - cli_bytetype_describe@CLAMAV_PRIVATE 0.100.3 - cli_bytevalue_describe@CLAMAV_PRIVATE 0.100.3 - cli_calloc@CLAMAV_PRIVATE 0.100.3 - cli_checkfp_pe@CLAMAV_PRIVATE 0.100.3 - cli_chomp@CLAMAV_PRIVATE 0.100.3 - cli_ctime@CLAMAV_PRIVATE 0.100.3 - cli_cvdunpack@CLAMAV_PRIVATE 0.100.3 - cli_dbgmsg_internal@CLAMAV_PRIVATE 0.100.3 - cli_dconf_init@CLAMAV_PRIVATE 0.100.3 - cli_debug_flag@CLAMAV_PRIVATE 0.100.3 - cli_detect_environment@CLAMAV_PRIVATE 0.100.3 - cli_disasm_one@CLAMAV_PRIVATE 0.100.3 - cli_errmsg@CLAMAV_PRIVATE 0.100.3 - cli_filecopy@CLAMAV_PRIVATE 0.100.3 - cli_fmap_scandesc@CLAMAV_PRIVATE 0.100.3 - cli_free_vba_project@CLAMAV_PRIVATE 0.100.3 - cli_ftw@CLAMAV_PRIVATE 0.100.3 - cli_genhash_pe@CLAMAV_PRIVATE 0.100.3 - cli_gentemp@CLAMAV_PRIVATE 0.100.3 - cli_gentempfd@CLAMAV_PRIVATE 0.100.3 - cli_gettmpdir@CLAMAV_PRIVATE 0.100.3 - cli_hashfile@CLAMAV_PRIVATE 0.100.3 - cli_hashset_destroy@CLAMAV_PRIVATE 0.100.3 - cli_hashstream@CLAMAV_PRIVATE 0.100.3 - cli_hex2str@CLAMAV_PRIVATE 0.100.3 - cli_hex2ui@CLAMAV_PRIVATE 0.100.3 - cli_initroots@CLAMAV_PRIVATE 0.100.3 - cli_isnumber@CLAMAV_PRIVATE 0.100.3 - cli_js_destroy@CLAMAV_PRIVATE 0.100.3 - cli_js_init@CLAMAV_PRIVATE 0.100.3 - cli_js_output@CLAMAV_PRIVATE 0.100.3 - cli_js_parse_done@CLAMAV_PRIVATE 0.100.3 - cli_js_process_buffer@CLAMAV_PRIVATE 0.100.3 - cli_ldbtokenize@CLAMAV_PRIVATE 0.100.3 - cli_malloc@CLAMAV_PRIVATE 0.100.3 - cli_memstr@CLAMAV_PRIVATE 0.100.3 - cli_ole2_extract@CLAMAV_PRIVATE 0.100.3 - cli_parse_add@CLAMAV_PRIVATE 0.100.3 - cli_pcre_build@CLAMAV_PRIVATE 0.100.3 - cli_pcre_freeoff@CLAMAV_PRIVATE 0.100.3 - cli_pcre_init@CLAMAV_PRIVATE 0.100.3 - cli_pcre_perf_events_destroy@CLAMAV_PRIVATE 0.100.3 - cli_pcre_perf_print@CLAMAV_PRIVATE 0.100.3 - cli_pcre_recaloff@CLAMAV_PRIVATE 0.100.3 - cli_pcre_scanbuf@CLAMAV_PRIVATE 0.100.3 - cli_ppt_vba_read@CLAMAV_PRIVATE 0.100.3 - cli_printcxxver@CLAMAV_PRIVATE 0.100.3 - cli_readn@CLAMAV_PRIVATE 0.100.3 - cli_realloc@CLAMAV_PRIVATE 0.100.3 - cli_regcomp@CLAMAV_PRIVATE 0.100.3 - cli_regex2suffix@CLAMAV_PRIVATE 0.100.3 - cli_regexec@CLAMAV_PRIVATE 0.100.3 - cli_regfree@CLAMAV_PRIVATE 0.100.3 - cli_rmdirs@CLAMAV_PRIVATE 0.100.3 - cli_rndnum@CLAMAV_PRIVATE 0.100.3 - cli_scanbuff@CLAMAV_PRIVATE 0.100.3 - cli_sigopts_handler@CLAMAV_PRIVATE 0.100.3 - cli_sigperf_events_destroy@CLAMAV_PRIVATE 0.100.3 - cli_sigperf_print@CLAMAV_PRIVATE 0.100.3 - cli_str2hex@CLAMAV_PRIVATE 0.100.3 - cli_strbcasestr@CLAMAV_PRIVATE 0.100.3 - cli_strdup@CLAMAV_PRIVATE 0.100.3 - cli_strerror@CLAMAV_PRIVATE 0.100.3 - cli_strlcat@CLAMAV_PRIVATE 0.100.3 - cli_strlcpy@CLAMAV_PRIVATE 0.100.3 - cli_strrcpy@CLAMAV_PRIVATE 0.100.3 - cli_strtok@CLAMAV_PRIVATE 0.100.3 - cli_strtokbuf@CLAMAV_PRIVATE 0.100.3 - cli_strtokenize@CLAMAV_PRIVATE 0.100.3 - cli_textbuffer_append_normalize@CLAMAV_PRIVATE 0.100.3 - cli_unescape@CLAMAV_PRIVATE 0.100.3 - cli_unlink@CLAMAV_PRIVATE 0.100.3 - cli_url_canon@CLAMAV_PRIVATE 0.100.3 - cli_utf16_to_utf8@CLAMAV_PRIVATE 0.100.3 - cli_utf16toascii@CLAMAV_PRIVATE 0.100.3 - cli_vba_inflate@CLAMAV_PRIVATE 0.100.3 - cli_vba_readdir@CLAMAV_PRIVATE 0.100.3 - cli_versig2@CLAMAV_PRIVATE 0.100.3 - cli_versig@CLAMAV_PRIVATE 0.100.3 - cli_warnmsg@CLAMAV_PRIVATE 0.100.3 - cli_wm_decrypt_macro@CLAMAV_PRIVATE 0.100.3 - cli_wm_readdir@CLAMAV_PRIVATE 0.100.3 - cli_writen@CLAMAV_PRIVATE 0.100.3 - decodeLine@CLAMAV_PRIVATE 0.100.3 - disasmbuf@CLAMAV_PRIVATE 0.100.3 - fmap@CLAMAV_PRIVATE 0.100.3 - get_fpu_endian@CLAMAV_PRIVATE 0.100.3 - have_clamjit@CLAMAV_PRIVATE 0.100.3 - have_rar@CLAMAV_PRIVATE 0.100.3 - html_normalise_map@CLAMAV_PRIVATE 0.100.3 - html_normalise_mem@CLAMAV_PRIVATE 0.100.3 - html_screnc_decode@CLAMAV_PRIVATE 0.100.3 - html_tag_arg_free@CLAMAV_PRIVATE 0.100.3 - init_domainlist@CLAMAV_PRIVATE 0.100.3 - init_regex_list@CLAMAV_PRIVATE 0.100.3 - init_whitelist@CLAMAV_PRIVATE 0.100.3 - is_regex_ok@CLAMAV_PRIVATE 0.100.3 - load_regex_matcher@CLAMAV_PRIVATE 0.100.3 - lsig_sub_matched@CLAMAV_PUBLIC 0.99~rc1 - messageCreate@CLAMAV_PRIVATE 0.100.3 - messageDestroy@CLAMAV_PRIVATE 0.100.3 - mpool_calloc@CLAMAV_PRIVATE 0.100.3 - mpool_create@CLAMAV_PRIVATE 0.100.3 - mpool_destroy@CLAMAV_PRIVATE 0.100.3 - mpool_free@CLAMAV_PRIVATE 0.100.3 - mpool_getstats@CLAMAV_PRIVATE 0.100.3 - phishingScan@CLAMAV_PRIVATE 0.100.3 - phishing_done@CLAMAV_PRIVATE 0.100.3 - phishing_init@CLAMAV_PRIVATE 0.100.3 - regex_list_add_pattern@CLAMAV_PRIVATE 0.100.3 - regex_list_done@CLAMAV_PRIVATE 0.100.3 - regex_list_match@CLAMAV_PRIVATE 0.100.3 - tableCreate@CLAMAV_PRIVATE 0.100.3 - tableDestroy@CLAMAV_PRIVATE 0.100.3 - tableFind@CLAMAV_PRIVATE 0.100.3 - tableInsert@CLAMAV_PRIVATE 0.100.3 - tableIterate@CLAMAV_PRIVATE 0.100.3 - tableRemove@CLAMAV_PRIVATE 0.100.3 - tableUpdate@CLAMAV_PRIVATE 0.100.3 - text_normalize_init@CLAMAV_PRIVATE 0.100.3 - text_normalize_map@CLAMAV_PRIVATE 0.100.3 - text_normalize_reset@CLAMAV_PRIVATE 0.100.3 - uniq_add@CLAMAV_PRIVATE 0.100.3 - uniq_free@CLAMAV_PRIVATE 0.100.3 - uniq_get@CLAMAV_PRIVATE 0.100.3 - uniq_init@CLAMAV_PRIVATE 0.100.3 diff -Nru clamav-0.100.3+dfsg/debian/libclamav9.docs clamav-0.101.4+dfsg/debian/libclamav9.docs --- clamav-0.100.3+dfsg/debian/libclamav9.docs 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav9.docs 2019-09-24 09:31:17.000000000 +0000 @@ -0,0 +1,4 @@ +debian/NEWS.Debian +debian/README.Debian +NEWS.md +README.md diff -Nru clamav-0.100.3+dfsg/debian/libclamav9.install clamav-0.101.4+dfsg/debian/libclamav9.install --- clamav-0.100.3+dfsg/debian/libclamav9.install 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav9.install 2019-09-24 09:31:17.000000000 +0000 @@ -0,0 +1 @@ +debian/tmp/usr/lib/*/libclamav.so.9* diff -Nru clamav-0.100.3+dfsg/debian/libclamav9.lintian-overrides clamav-0.101.4+dfsg/debian/libclamav9.lintian-overrides --- clamav-0.100.3+dfsg/debian/libclamav9.lintian-overrides 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav9.lintian-overrides 2019-09-24 09:31:17.000000000 +0000 @@ -0,0 +1,4 @@ +# This is sort of a false positive, because libclamav uses the packaged zlib. +# It still embeds a modified version of zlib to support 64 bit decompression, +# which is not part of zlib, see #308799. +libclamav9 binary: embedded-library usr/lib/*/libclamav.so.9.*: zlib diff -Nru clamav-0.100.3+dfsg/debian/libclamav9.symbols clamav-0.101.4+dfsg/debian/libclamav9.symbols --- clamav-0.100.3+dfsg/debian/libclamav9.symbols 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav9.symbols 2019-08-25 16:14:12.000000000 +0000 @@ -0,0 +1,255 @@ +libclamav.so.9 libclamav9 #MINVER# +* Build-Depends-Package: libclamav-dev + CLAMAV_PRIVATE@CLAMAV_PRIVATE 0.101.4 + CLAMAV_PUBLIC@CLAMAV_PUBLIC 0.101.0 + base64Flush@CLAMAV_PRIVATE 0.101.4 + blobAddData@CLAMAV_PRIVATE 0.101.4 + blobCreate@CLAMAV_PRIVATE 0.101.4 + blobDestroy@CLAMAV_PRIVATE 0.101.4 + cl_ASN1_GetTimeT@CLAMAV_PRIVATE 0.101.4 + cl_always_gen_section_hash@CLAMAV_PUBLIC 0.101.0 + cl_base64_decode@CLAMAV_PRIVATE 0.101.4 + cl_base64_encode@CLAMAV_PRIVATE 0.101.4 + cl_cleanup_crypto@CLAMAV_PRIVATE 0.101.4 + cl_countsigs@CLAMAV_PUBLIC 0.101.0 + cl_cvdfree@CLAMAV_PUBLIC 0.101.0 + cl_cvdhead@CLAMAV_PUBLIC 0.101.0 + cl_cvdparse@CLAMAV_PUBLIC 0.101.0 + cl_cvdverify@CLAMAV_PUBLIC 0.101.0 + cl_debug@CLAMAV_PUBLIC 0.101.0 + cl_engine_addref@CLAMAV_PUBLIC 0.101.0 + cl_engine_compile@CLAMAV_PUBLIC 0.101.0 + cl_engine_free@CLAMAV_PUBLIC 0.101.0 + cl_engine_get_num@CLAMAV_PUBLIC 0.101.0 + cl_engine_get_str@CLAMAV_PUBLIC 0.101.0 + cl_engine_new@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_file_props@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_hash@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_meta@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_post_scan@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_pre_cache@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_pre_scan@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_sigload@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_add_sample@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_decrement_count@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_flush@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_get_hostid@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_get_num@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_get_size@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_remove_sample@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_stats_submit@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_clcb_virus_found@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_num@CLAMAV_PUBLIC 0.101.4 + cl_engine_set_stats_set_cbdata@CLAMAV_PUBLIC 0.101.0 + cl_engine_set_str@CLAMAV_PUBLIC 0.101.0 + cl_engine_settings_apply@CLAMAV_PUBLIC 0.101.0 + cl_engine_settings_copy@CLAMAV_PUBLIC 0.101.0 + cl_engine_settings_free@CLAMAV_PUBLIC 0.101.0 + cl_engine_stats_enable@CLAMAV_PUBLIC 0.101.0 + cl_finish_hash@CLAMAV_PUBLIC 0.101.0 + cl_fmap_close@CLAMAV_PUBLIC 0.101.0 + cl_fmap_open_handle@CLAMAV_PUBLIC 0.101.0 + cl_fmap_open_memory@CLAMAV_PUBLIC 0.101.0 + cl_get_pkey_file@CLAMAV_PRIVATE 0.101.4 + cl_get_x509_from_mem@CLAMAV_PRIVATE 0.101.4 + cl_hash_data@CLAMAV_PRIVATE 0.101.4 + cl_hash_destroy@CLAMAV_PUBLIC 0.101.0 + cl_hash_file_fd@CLAMAV_PRIVATE 0.101.4 + cl_hash_file_fd_ctx@CLAMAV_PRIVATE 0.101.4 + cl_hash_file_fp@CLAMAV_PRIVATE 0.101.4 + cl_hash_init@CLAMAV_PUBLIC 0.101.0 + cl_init@CLAMAV_PUBLIC 0.101.0 + cl_initialize_crypto@CLAMAV_PRIVATE 0.101.4 + cl_load@CLAMAV_PUBLIC 0.101.0 + cl_load_cert@CLAMAV_PRIVATE 0.101.4 + cl_load_crl@CLAMAV_PRIVATE 0.101.4 + cl_retdbdir@CLAMAV_PUBLIC 0.101.0 + cl_retflevel@CLAMAV_PUBLIC 0.101.4 + cl_retver@CLAMAV_PUBLIC 0.101.0 + cl_scandesc@CLAMAV_PUBLIC 0.101.0 + cl_scandesc_callback@CLAMAV_PUBLIC 0.101.0 + cl_scanfile@CLAMAV_PUBLIC 0.101.0 + cl_scanfile_callback@CLAMAV_PUBLIC 0.101.0 + cl_scanmap_callback@CLAMAV_PUBLIC 0.101.0 + cl_set_clcb_msg@CLAMAV_PUBLIC 0.101.0 + cl_sha1@CLAMAV_PRIVATE 0.101.4 + cl_sha256@CLAMAV_PRIVATE 0.101.4 + cl_sign_data@CLAMAV_PRIVATE 0.101.4 + cl_sign_data_keyfile@CLAMAV_PRIVATE 0.101.4 + cl_sign_file_fd@CLAMAV_PRIVATE 0.101.4 + cl_sign_file_fp@CLAMAV_PRIVATE 0.101.4 + cl_statchkdir@CLAMAV_PUBLIC 0.101.0 + cl_statfree@CLAMAV_PUBLIC 0.101.0 + cl_statinidir@CLAMAV_PUBLIC 0.101.0 + cl_strerror@CLAMAV_PUBLIC 0.101.0 + cl_update_hash@CLAMAV_PUBLIC 0.101.0 + cl_validate_certificate_chain@CLAMAV_PRIVATE 0.101.4 + cl_validate_certificate_chain_ts_dir@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_fd@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_fd_x509@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_fd_x509_keyfile@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_hash@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_hash_x509@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_hash_x509_keyfile@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_x509@CLAMAV_PRIVATE 0.101.4 + cl_verify_signature_x509_keyfile@CLAMAV_PRIVATE 0.101.4 + cli_ac_buildtrie@CLAMAV_PRIVATE 0.101.4 + cli_ac_chklsig@CLAMAV_PRIVATE 0.101.4 + cli_ac_free@CLAMAV_PRIVATE 0.101.4 + cli_ac_freedata@CLAMAV_PRIVATE 0.101.4 + cli_ac_init@CLAMAV_PRIVATE 0.101.4 + cli_ac_initdata@CLAMAV_PRIVATE 0.101.4 + cli_ac_scanbuff@CLAMAV_PRIVATE 0.101.4 + cli_bm_free@CLAMAV_PRIVATE 0.101.4 + cli_bm_init@CLAMAV_PRIVATE 0.101.4 + cli_bm_scanbuff@CLAMAV_PRIVATE 0.101.4 + cli_build_regex_list@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_alloc@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_clear@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_destroy@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_getresult_int@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_set_trace@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_setfile@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_setfuncid@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_setparam_int@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_context_setparam_ptr@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_debug@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_debug_printsrc@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_describe@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_destroy@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_done@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_init@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_load@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_prepare2@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_printversion@CLAMAV_PRIVATE 0.101.4 + cli_bytecode_run@CLAMAV_PRIVATE 0.101.4 + cli_bytefunc_describe@CLAMAV_PRIVATE 0.101.4 + cli_byteinst_describe@CLAMAV_PRIVATE 0.101.4 + cli_bytetype_describe@CLAMAV_PRIVATE 0.101.4 + cli_bytevalue_describe@CLAMAV_PRIVATE 0.101.4 + cli_calloc@CLAMAV_PRIVATE 0.101.4 + cli_checkfp_pe@CLAMAV_PRIVATE 0.101.4 + cli_chomp@CLAMAV_PRIVATE 0.101.4 + cli_ctime@CLAMAV_PRIVATE 0.101.4 + cli_cvdunpack@CLAMAV_PRIVATE 0.101.4 + cli_dbgmsg_internal@CLAMAV_PRIVATE 0.101.4 + cli_dconf_init@CLAMAV_PRIVATE 0.101.4 + cli_debug_flag@CLAMAV_PRIVATE 0.101.4 + cli_detect_environment@CLAMAV_PRIVATE 0.101.4 + cli_disasm_one@CLAMAV_PRIVATE 0.101.4 + cli_errmsg@CLAMAV_PRIVATE 0.101.4 + cli_filecopy@CLAMAV_PRIVATE 0.101.4 + cli_fmap_scandesc@CLAMAV_PRIVATE 0.101.4 + cli_free_vba_project@CLAMAV_PRIVATE 0.101.4 + cli_ftw@CLAMAV_PRIVATE 0.101.4 + cli_genhash_pe@CLAMAV_PRIVATE 0.101.4 + cli_gentemp@CLAMAV_PRIVATE 0.101.4 + cli_gentempfd@CLAMAV_PRIVATE 0.101.4 + cli_gettmpdir@CLAMAV_PRIVATE 0.101.4 + cli_hashfile@CLAMAV_PRIVATE 0.101.4 + cli_hashset_destroy@CLAMAV_PRIVATE 0.101.4 + cli_hashstream@CLAMAV_PRIVATE 0.101.4 + cli_hex2str@CLAMAV_PRIVATE 0.101.4 + cli_hex2ui@CLAMAV_PRIVATE 0.101.4 + cli_initroots@CLAMAV_PRIVATE 0.101.4 + cli_isnumber@CLAMAV_PRIVATE 0.101.4 + cli_js_destroy@CLAMAV_PRIVATE 0.101.4 + cli_js_init@CLAMAV_PRIVATE 0.101.4 + cli_js_output@CLAMAV_PRIVATE 0.101.4 + cli_js_parse_done@CLAMAV_PRIVATE 0.101.4 + cli_js_process_buffer@CLAMAV_PRIVATE 0.101.4 + cli_ldbtokenize@CLAMAV_PRIVATE 0.101.4 + cli_malloc@CLAMAV_PRIVATE 0.101.4 + cli_memstr@CLAMAV_PRIVATE 0.101.4 + cli_ole2_extract@CLAMAV_PRIVATE 0.101.4 + cli_parse_add@CLAMAV_PRIVATE 0.101.4 + cli_pcre_build@CLAMAV_PRIVATE 0.101.4 + cli_pcre_freeoff@CLAMAV_PRIVATE 0.101.4 + cli_pcre_init@CLAMAV_PRIVATE 0.101.4 + cli_pcre_perf_events_destroy@CLAMAV_PRIVATE 0.101.4 + cli_pcre_perf_print@CLAMAV_PRIVATE 0.101.4 + cli_pcre_recaloff@CLAMAV_PRIVATE 0.101.4 + cli_pcre_scanbuf@CLAMAV_PRIVATE 0.101.4 + cli_ppt_vba_read@CLAMAV_PRIVATE 0.101.4 + cli_printcxxver@CLAMAV_PRIVATE 0.101.4 + cli_readn@CLAMAV_PRIVATE 0.101.4 + cli_realloc@CLAMAV_PRIVATE 0.101.4 + cli_regcomp@CLAMAV_PRIVATE 0.101.4 + cli_regex2suffix@CLAMAV_PRIVATE 0.101.4 + cli_regexec@CLAMAV_PRIVATE 0.101.4 + cli_regfree@CLAMAV_PRIVATE 0.101.4 + cli_rmdirs@CLAMAV_PRIVATE 0.101.4 + cli_rndnum@CLAMAV_PRIVATE 0.101.4 + cli_sanitize_filepath@CLAMAV_PRIVATE 0.101.4 + cli_scanbuff@CLAMAV_PRIVATE 0.101.4 + cli_sigopts_handler@CLAMAV_PRIVATE 0.101.4 + cli_sigperf_events_destroy@CLAMAV_PRIVATE 0.101.4 + cli_sigperf_print@CLAMAV_PRIVATE 0.101.4 + cli_str2hex@CLAMAV_PRIVATE 0.101.4 + cli_strbcasestr@CLAMAV_PRIVATE 0.101.4 + cli_strdup@CLAMAV_PRIVATE 0.101.4 + cli_strerror@CLAMAV_PRIVATE 0.101.4 + cli_strlcat@CLAMAV_PRIVATE 0.101.4 + cli_strlcpy@CLAMAV_PRIVATE 0.101.4 + cli_strrcpy@CLAMAV_PRIVATE 0.101.4 + cli_strtok@CLAMAV_PRIVATE 0.101.4 + cli_strtokbuf@CLAMAV_PRIVATE 0.101.4 + cli_strtokenize@CLAMAV_PRIVATE 0.101.4 + cli_textbuffer_append_normalize@CLAMAV_PRIVATE 0.101.4 + cli_unescape@CLAMAV_PRIVATE 0.101.4 + cli_unlink@CLAMAV_PRIVATE 0.101.4 + cli_url_canon@CLAMAV_PRIVATE 0.101.4 + cli_utf16_to_utf8@CLAMAV_PRIVATE 0.101.4 + cli_utf16toascii@CLAMAV_PRIVATE 0.101.4 + cli_vba_inflate@CLAMAV_PRIVATE 0.101.4 + cli_vba_readdir@CLAMAV_PRIVATE 0.101.4 + cli_versig2@CLAMAV_PRIVATE 0.101.4 + cli_versig@CLAMAV_PRIVATE 0.101.4 + cli_warnmsg@CLAMAV_PRIVATE 0.101.4 + cli_wm_decrypt_macro@CLAMAV_PRIVATE 0.101.4 + cli_wm_readdir@CLAMAV_PRIVATE 0.101.4 + cli_writen@CLAMAV_PRIVATE 0.101.4 + decodeLine@CLAMAV_PRIVATE 0.101.4 + disasmbuf@CLAMAV_PRIVATE 0.101.4 + fmap@CLAMAV_PRIVATE 0.101.4 + get_fpu_endian@CLAMAV_PRIVATE 0.101.4 + have_clamjit@CLAMAV_PRIVATE 0.101.4 + have_rar@CLAMAV_PRIVATE 0.101.4 + html_normalise_map@CLAMAV_PRIVATE 0.101.4 + html_normalise_mem@CLAMAV_PRIVATE 0.101.4 + html_screnc_decode@CLAMAV_PRIVATE 0.101.4 + html_tag_arg_free@CLAMAV_PRIVATE 0.101.4 + init_domainlist@CLAMAV_PRIVATE 0.101.4 + init_regex_list@CLAMAV_PRIVATE 0.101.4 + init_whitelist@CLAMAV_PRIVATE 0.101.4 + is_regex_ok@CLAMAV_PRIVATE 0.101.4 + load_regex_matcher@CLAMAV_PRIVATE 0.101.4 + lsig_sub_matched@CLAMAV_PUBLIC 0.101.0 + messageCreate@CLAMAV_PRIVATE 0.101.4 + messageDestroy@CLAMAV_PRIVATE 0.101.4 + mpool_calloc@CLAMAV_PRIVATE 0.101.4 + mpool_create@CLAMAV_PRIVATE 0.101.4 + mpool_destroy@CLAMAV_PRIVATE 0.101.4 + mpool_free@CLAMAV_PRIVATE 0.101.4 + mpool_getstats@CLAMAV_PRIVATE 0.101.4 + phishingScan@CLAMAV_PRIVATE 0.101.4 + phishing_done@CLAMAV_PRIVATE 0.101.4 + phishing_init@CLAMAV_PRIVATE 0.101.4 + regex_list_add_pattern@CLAMAV_PRIVATE 0.101.4 + regex_list_done@CLAMAV_PRIVATE 0.101.4 + regex_list_match@CLAMAV_PRIVATE 0.101.4 + tableCreate@CLAMAV_PRIVATE 0.101.4 + tableDestroy@CLAMAV_PRIVATE 0.101.4 + tableFind@CLAMAV_PRIVATE 0.101.4 + tableInsert@CLAMAV_PRIVATE 0.101.4 + tableIterate@CLAMAV_PRIVATE 0.101.4 + tableRemove@CLAMAV_PRIVATE 0.101.4 + tableUpdate@CLAMAV_PRIVATE 0.101.4 + text_normalize_init@CLAMAV_PRIVATE 0.101.4 + text_normalize_map@CLAMAV_PRIVATE 0.101.4 + text_normalize_reset@CLAMAV_PRIVATE 0.101.4 + uniq_add@CLAMAV_PRIVATE 0.101.4 + uniq_free@CLAMAV_PRIVATE 0.101.4 + uniq_get@CLAMAV_PRIVATE 0.101.4 + uniq_init@CLAMAV_PRIVATE 0.101.4 diff -Nru clamav-0.100.3+dfsg/debian/libclamav-dev.install clamav-0.101.4+dfsg/debian/libclamav-dev.install --- clamav-0.100.3+dfsg/debian/libclamav-dev.install 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav-dev.install 2019-09-24 09:31:17.000000000 +0000 @@ -1,4 +1,4 @@ debian/tmp/usr/bin/clamav-config -debian/tmp/usr/include/clamav.h +debian/tmp/usr/include/clamav*.h debian/tmp/usr/lib/*/libclamav.so debian/tmp/usr/lib/*/pkgconfig/libclamav.pc diff -Nru clamav-0.100.3+dfsg/debian/libclamav-dev.links clamav-0.101.4+dfsg/debian/libclamav-dev.links --- clamav-0.100.3+dfsg/debian/libclamav-dev.links 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/libclamav-dev.links 2019-09-24 09:31:17.000000000 +0000 @@ -1,2 +1,2 @@ -/usr/share/doc/libclamav7/README.Debian.gz /usr/share/doc/libclamav-dev/README.Debian.gz -/usr/share/doc/libclamav7/NEWS.Debian.gz /usr/share/doc/libclamav-dev/NEWS.Debian.gz +/usr/share/doc/libclamav9/README.Debian.gz /usr/share/doc/libclamav-dev/README.Debian.gz +/usr/share/doc/libclamav9/NEWS.Debian.gz /usr/share/doc/libclamav-dev/NEWS.Debian.gz diff -Nru clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.7.patch clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.7.patch --- clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.7.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.7.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From dc6f15816bd9e667c858cd4d6de7876f10fdf3bc Mon Sep 17 00:00:00 2001 +From 67fc7175d7193307fe6787b8068a2a6733291031 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Fri, 14 Oct 2016 20:24:39 +0200 Subject: Add support for LLVM 3.7 @@ -24,10 +24,10 @@ 4 files changed, 244 insertions(+), 19 deletions(-) diff --git a/libclamav/c++/ClamBCRTChecks.cpp b/libclamav/c++/ClamBCRTChecks.cpp -index 54f062b..2e1d59b 100644 +index 56e4b3e..033604e 100644 --- a/libclamav/c++/ClamBCRTChecks.cpp +++ b/libclamav/c++/ClamBCRTChecks.cpp -@@ -201,9 +201,11 @@ namespace llvm { +@@ -200,9 +200,11 @@ namespace llvm { TD = &getAnalysis(); #elif LLVM_VERSION < 35 TD = &getAnalysis(); @@ -40,7 +40,7 @@ #endif SE = &getAnalysis(); PT = &getAnalysis(); -@@ -212,7 +214,11 @@ namespace llvm { +@@ -211,7 +213,11 @@ namespace llvm { #else DT = &getAnalysis().getDomTree(); #endif @@ -52,7 +52,7 @@ std::vector insns; -@@ -351,8 +357,10 @@ namespace llvm { +@@ -350,8 +356,10 @@ namespace llvm { AU.addRequired(); #elif LLVM_VERSION < 35 AU.addRequired(); @@ -64,7 +64,7 @@ #endif #if LLVM_VERSION < 35 AU.addRequired(); -@@ -406,7 +414,11 @@ namespace llvm { +@@ -405,7 +413,11 @@ namespace llvm { if (BaseMap.count(P)) { return BaseMap[Ptr] = BaseMap[P]; } @@ -76,7 +76,7 @@ if (P2 != P) { Value *V = getPointerBase(P2); return BaseMap[Ptr] = V; -@@ -520,7 +532,11 @@ namespace llvm { +@@ -519,7 +531,11 @@ namespace llvm { } } if (LoadInst *LI = dyn_cast(Base)) { @@ -88,7 +88,7 @@ if (Argument *A = dyn_cast(V)) { if (A->getArgNo() == 0) { // pointers from hidden ctx are trusted to be at least the -@@ -674,7 +690,11 @@ namespace llvm { +@@ -673,7 +689,11 @@ namespace llvm { } BasicBlock *BB = I->getParent(); BasicBlock::iterator It = I; @@ -100,7 +100,7 @@ PHINode *PN; unsigned MDDbgKind = I->getContext().getMDKindID("dbg"); //verifyFunction(*BB->getParent()); -@@ -719,9 +739,15 @@ namespace llvm { +@@ -718,9 +738,15 @@ namespace llvm { unsigned locationid = 0; bool Approximate; if (MDNode *Dbg = getLocation(I, Approximate, MDDbgKind)) { @@ -116,7 +116,7 @@ if (col > 254) col = 254; if (Approximate) -@@ -935,7 +961,11 @@ INITIALIZE_PASS_DEPENDENCY(TargetData) +@@ -934,7 +960,11 @@ INITIALIZE_PASS_DEPENDENCY(TargetData) #elif LLVM_VERSION < 35 INITIALIZE_PASS_DEPENDENCY(DataLayout) #else @@ -247,7 +247,7 @@ if (isa(Limit)) { Base = 0; diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp -index 6a462d9..45b0fa5 100644 +index 9313202..80b6fc3 100644 --- a/libclamav/c++/bytecode2llvm.cpp +++ b/libclamav/c++/bytecode2llvm.cpp @@ -63,7 +63,11 @@ diff -Nru clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.8.patch clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.8.patch --- clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.8.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.8.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From fe1e1b6617cdf4bc6c9119584e3fe095212cef83 Mon Sep 17 00:00:00 2001 +From 4fe7217636ff6b00fc1f809f4ea9918a522977e0 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Fri, 14 Oct 2016 20:24:48 +0200 Subject: Add support for LLVM 3.8 @@ -22,10 +22,10 @@ 5 files changed, 119 insertions(+), 14 deletions(-) diff --git a/libclamav/c++/ClamBCRTChecks.cpp b/libclamav/c++/ClamBCRTChecks.cpp -index 2e1d59b..a543998 100644 +index 033604e..8b065e7 100644 --- a/libclamav/c++/ClamBCRTChecks.cpp +++ b/libclamav/c++/ClamBCRTChecks.cpp -@@ -54,7 +54,9 @@ +@@ -53,7 +53,9 @@ #include "llvm/Analysis/ScalarEvolution.h" #include "llvm/Analysis/ScalarEvolutionExpressions.h" #include "llvm/Analysis/ScalarEvolutionExpander.h" @@ -35,7 +35,7 @@ #include "llvm/Pass.h" #include "llvm/Support/CommandLine.h" #if LLVM_VERSION < 35 -@@ -207,7 +209,11 @@ namespace llvm { +@@ -206,7 +208,11 @@ namespace llvm { #else TD = &F.getEntryBlock().getModule()->getDataLayout(); #endif @@ -47,7 +47,7 @@ PT = &getAnalysis(); #if LLVM_VERSION < 35 DT = &getAnalysis(); -@@ -332,7 +338,11 @@ namespace llvm { +@@ -331,7 +337,11 @@ namespace llvm { AbrtC->setDoesNotThrow(); #endif // remove all instructions from entry @@ -59,7 +59,7 @@ while (BBI != BBE) { if (!BBI->use_empty()) BBI->replaceAllUsesWith(UndefValue::get(BBI->getType())); -@@ -367,7 +377,11 @@ namespace llvm { +@@ -366,7 +376,11 @@ namespace llvm { #else AU.addRequired(); #endif @@ -71,7 +71,7 @@ AU.addRequired(); #if LLVM_VERSION < 35 AU.addRequired(); -@@ -398,9 +412,17 @@ namespace llvm { +@@ -397,9 +411,17 @@ namespace llvm { Instruction *getInsertPoint(Value *V) { @@ -89,7 +89,7 @@ ++It; } return &*It; -@@ -427,7 +449,11 @@ namespace llvm { +@@ -426,7 +448,11 @@ namespace llvm { constType *P8Ty = PointerType::getUnqual(Type::getInt8Ty(Ptr->getContext())); if (PHINode *PN = dyn_cast(Ptr)) { @@ -101,7 +101,7 @@ ++It; PHINode *newPN = PHINode::Create(P8Ty, HINT(PN->getNumIncomingValues()) ".verif.base", &*It); Changed = true; -@@ -441,7 +467,11 @@ namespace llvm { +@@ -440,7 +466,11 @@ namespace llvm { return newPN; } if (SelectInst *SI = dyn_cast(Ptr)) { @@ -113,7 +113,7 @@ ++It; Value *TrueB = getPointerBase(SI->getTrueValue()); Value *FalseB = getPointerBase(SI->getFalseValue()); -@@ -575,7 +605,11 @@ namespace llvm { +@@ -574,7 +604,11 @@ namespace llvm { } #endif if (PHINode *PN = dyn_cast(Base)) { @@ -125,7 +125,7 @@ ++It; PHINode *newPN = PHINode::Create(I64Ty, HINT(PN->getNumIncomingValues()) ".verif.bounds", &*It); Changed = true; -@@ -598,7 +632,11 @@ namespace llvm { +@@ -597,7 +631,11 @@ namespace llvm { return BoundsMap[Base] = newPN; } if (SelectInst *SI = dyn_cast(Base)) { @@ -137,7 +137,7 @@ ++It; Value *TrueB = getPointerBounds(SI->getTrueValue()); Value *FalseB = getPointerBounds(SI->getFalseValue()); -@@ -655,7 +693,11 @@ namespace llvm { +@@ -654,7 +692,11 @@ namespace llvm { if (!MDDbgKind) return 0; Approximate = true; @@ -149,7 +149,7 @@ while (It != I->getParent()->begin()) { --It; if (MDNode *Dbg = It->getMetadata(MDDbgKind)) -@@ -689,7 +731,11 @@ namespace llvm { +@@ -688,7 +730,11 @@ namespace llvm { return false; } BasicBlock *BB = I->getParent(); @@ -161,7 +161,7 @@ #if LLVM_VERSION < 37 BasicBlock *newBB = SplitBlock(BB, &*It, this); #else -@@ -972,7 +1018,11 @@ INITIALIZE_PASS_DEPENDENCY(DominatorTree) +@@ -971,7 +1017,11 @@ INITIALIZE_PASS_DEPENDENCY(DominatorTree) #else INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) #endif @@ -214,7 +214,7 @@ } diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp -index 45b0fa5..76a5505 100644 +index 80b6fc3..8bc1937 100644 --- a/libclamav/c++/bytecode2llvm.cpp +++ b/libclamav/c++/bytecode2llvm.cpp @@ -170,7 +170,9 @@ void LLVMInitializePowerPCAsmPrinter(); @@ -442,7 +442,7 @@ dnl acquire the required flags to properly link in external LLVM diff --git a/libclamav/c++/detect.cpp b/libclamav/c++/detect.cpp -index 0466b1d..d53d4e5 100644 +index dea61b5..db3d3bd 100644 --- a/libclamav/c++/detect.cpp +++ b/libclamav/c++/detect.cpp @@ -22,7 +22,9 @@ diff -Nru clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.9.patch clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.9.patch --- clamav-0.100.3+dfsg/debian/patches/Add-support-for-LLVM-3.9.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/Add-support-for-LLVM-3.9.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From 1be5d5c0d2d3a961872ed1344c49b037dd97c853 Mon Sep 17 00:00:00 2001 +From e6e5de56f86171c36b12d1b3d17eba09e407f6c2 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Fri, 14 Oct 2016 20:24:56 +0200 Subject: Add support for LLVM 3.9 @@ -14,7 +14,7 @@ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp -index 76a5505..d6960c5 100644 +index 8bc1937..19325c2 100644 --- a/libclamav/c++/bytecode2llvm.cpp +++ b/libclamav/c++/bytecode2llvm.cpp @@ -787,7 +787,11 @@ class RuntimeLimits : public FunctionPass { diff -Nru clamav-0.100.3+dfsg/debian/patches/add-support-for-system-tomsfastmath.patch clamav-0.101.4+dfsg/debian/patches/add-support-for-system-tomsfastmath.patch --- clamav-0.100.3+dfsg/debian/patches/add-support-for-system-tomsfastmath.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/add-support-for-system-tomsfastmath.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From 69b9bb50d1f05ca3a0f559e912262576c343160f Mon Sep 17 00:00:00 2001 +From 2466dcbede39220e16930ff3406b23081601d0b4 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Wed, 11 Mar 2015 20:03:15 +0100 Subject: add support for system tomsfastmath @@ -14,18 +14,18 @@ create mode 100644 m4/reorganization/libs/tomsfastmath.m4 diff --git a/configure.ac b/configure.ac -index 43f0483..61c075f 100644 +index c0638fc..9a1cf02 100644 --- a/configure.ac +++ b/configure.ac -@@ -82,6 +82,7 @@ m4_include([m4/reorganization/libs/xml.m4]) - m4_include([m4/reorganization/libs/openssl.m4]) - m4_include([m4/reorganization/libs/json.m4]) - m4_include([m4/reorganization/libs/pcre.m4]) +@@ -96,6 +96,7 @@ m4_include([m4/reorganization/libs/libmspack.m4]) + if test "x$use_internal_mspack" = "xno"; then + mspack_msg="External, $LIBMSPACK_CFLAGS $LIBMSPACK_LIBS" + fi +m4_include([m4/reorganization/libs/tomsfastmath.m4]) AM_MAINTAINER_MODE m4_include([m4/reorganization/libs/libz.m4]) -@@ -286,6 +287,7 @@ fi +@@ -302,6 +303,7 @@ fi CL_MSG_STATUS([yara ],[$enable_yara],[$enable_yara]) CL_MSG_STATUS([fts ],[yes],[$lfs_fts_msg]) @@ -34,10 +34,10 @@ # Yep, downgrading the compiler avoids the bug too: # 4.0.x, and 4.1.0 are the known buggy versions diff --git a/libclamav/Makefile.am b/libclamav/Makefile.am -index 43b5154..02596b8 100644 +index 690d70b..fb58761 100644 --- a/libclamav/Makefile.am +++ b/libclamav/Makefile.am -@@ -496,8 +496,10 @@ libclamav_la_SOURCES += yara_arena.c \ +@@ -598,8 +598,10 @@ libclamav_la_SOURCES += yara_arena.c \ yara_clam.h endif @@ -50,7 +50,7 @@ tomsfastmath/addsub/fp_add.c\ tomsfastmath/addsub/fp_add_d.c\ tomsfastmath/addsub/fp_addmod.c\ -@@ -579,6 +581,10 @@ libclamav_la_SOURCES += bignum.h\ +@@ -681,6 +683,10 @@ libclamav_la_SOURCES += bignum.h\ tomsfastmath/sqr/fp_sqr_comba_generic.c\ tomsfastmath/sqr/fp_sqr_comba_small_set.c\ tomsfastmath/sqr/fp_sqrmod.c @@ -81,10 +81,10 @@ #define mp_cmp fp_cmp #define mp_toradix_n(a,b,c,d) fp_toradix_n(a,b,c,d) diff --git a/libclamav/xdp.c b/libclamav/xdp.c -index 00edfa8..674dc7c 100644 +index 8748b44..6e09ce4 100644 --- a/libclamav/xdp.c +++ b/libclamav/xdp.c -@@ -57,7 +57,7 @@ +@@ -52,7 +52,7 @@ #include "scanners.h" #include "conv.h" #include "xdp.h" diff -Nru clamav-0.100.3+dfsg/debian/patches/Change-paths-in-sample-conf-file-to-match-Debian.patch clamav-0.101.4+dfsg/debian/patches/Change-paths-in-sample-conf-file-to-match-Debian.patch --- clamav-0.100.3+dfsg/debian/patches/Change-paths-in-sample-conf-file-to-match-Debian.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/Change-paths-in-sample-conf-file-to-match-Debian.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From 05918f3b619b912b1cde0247fa0a5450227ef4a0 Mon Sep 17 00:00:00 2001 +From 600055d46bada90964bde7573e586ccfbbd15bd4 Mon Sep 17 00:00:00 2001 From: Scott Kitterman Date: Mon, 10 Mar 2014 19:20:18 -0400 Subject: Change paths in sample conf file to match Debian diff -Nru clamav-0.100.3+dfsg/debian/patches/clamd_dont_depend_on_clamav_demon_socket.patch clamav-0.101.4+dfsg/debian/patches/clamd_dont_depend_on_clamav_demon_socket.patch --- clamav-0.100.3+dfsg/debian/patches/clamd_dont_depend_on_clamav_demon_socket.patch 2018-07-10 21:42:47.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/clamd_dont_depend_on_clamav_demon_socket.patch 2019-08-25 16:14:13.000000000 +0000 @@ -1,4 +1,4 @@ -From 5eb65b1b03eab9b10552eb85dc183a960a760d82 Mon Sep 17 00:00:00 2001 +From 17fcedafce4c36ea008261590c4586bc0c3cf980 Mon Sep 17 00:00:00 2001 From: Sebastian Andrzej Siewior Date: Thu, 11 Aug 2016 21:54:10 +0200 Subject: clamd: don't depend on clamav-demon.socket diff -Nru clamav-0.100.3+dfsg/debian/patches/Deprecate-unused-options-instead-of-removing-it.patch clamav-0.101.4+dfsg/debian/patches/Deprecate-unused-options-instead-of-removing-it.patch --- clamav-0.100.3+dfsg/debian/patches/Deprecate-unused-options-instead-of-removing-it.patch 2018-07-26 14:24:21.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/patches/Deprecate-unused-options-instead-of-removing-it.patch 2019-04-23 15:38:59.000000000 +0000 @@ -26,11 +26,11 @@ shared/optparser.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -diff --git a/shared/optparser.c b/shared/optparser.c -index b5a7208..7dea853 100644 ---- a/shared/optparser.c -+++ b/shared/optparser.c -@@ -194,6 +194,14 @@ const struct clam_option __clam_options[] = { +Index: clamav-0.101.2+dfsg/shared/optparser.c +=================================================================== +--- clamav-0.101.2+dfsg.orig/shared/optparser.c 2019-04-23 11:38:57.579172265 -0400 ++++ clamav-0.101.2+dfsg/shared/optparser.c 2019-04-23 11:38:57.575172246 -0400 +@@ -194,6 +194,14 @@ const struct clam_option __clam_options[ { "LogFile", "log", 'l', CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD | OPT_MILTER | OPT_CLAMSCAN | OPT_CLAMDSCAN, "Save all reports to a log file.", "/tmp/clamav.log" }, @@ -45,7 +45,7 @@ { "LogFileUnlock", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_MILTER, "By default the log file is locked for writing and only a single\ndaemon process can write to it. This option disables the lock.", "yes" }, { "LogFileMaxSize", NULL, 0, CLOPT_TYPE_SIZE, MATCH_SIZE, 1048576, NULL, 0, OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER, "Maximum size of the log file.\nValue of 0 disables the limit.", "5M" }, -@@ -479,6 +487,12 @@ const struct clam_option __clam_options[] = { +@@ -483,6 +491,12 @@ const struct clam_option __clam_options[ { "ReceiveTimeout", NULL, 0, CLOPT_TYPE_NUMBER, MATCH_NUMBER, 30, NULL, 0, OPT_FRESHCLAM, "Timeout in seconds when reading from database server.", "30" }, diff -Nru clamav-0.100.3+dfsg/debian/rules clamav-0.101.4+dfsg/debian/rules --- clamav-0.100.3+dfsg/debian/rules 2018-10-10 17:25:28.000000000 +0000 +++ clamav-0.101.4+dfsg/debian/rules 2019-09-24 09:31:17.000000000 +0000 @@ -86,20 +86,20 @@ touch debian/exit; \ fi;\ done; \ - # Check if for library features whih may get upgrade. - if ! grep -q "CL_FLEVEL 93" libclamav/others.h ; then \ + # Check for library features which may have been upgraded. + if ! grep -q "CL_FLEVEL 105" libclamav/others.h ; then \ echo "cl_retflevel needs boosting in symbol file"; \ touch debian/exit; \ fi; sed "s/ \(.*\)@CLAMAV_PRIVATE .*/ \1@CLAMAV_PRIVATE $(shell dpkg-parsechangelog -S Version | sed 's/+dfsg.*//')/" \ - < debian/libclamav7.symbols > debian/libclamav7.symbols.latest - if ! cmp debian/libclamav7.symbols debian/libclamav7.symbols.latest; then \ + < debian/libclamav9.symbols > debian/libclamav9.symbols.latest + if ! cmp debian/libclamav9.symbols debian/libclamav9.symbols.latest; then \ echo "Need to update CLAMAV_PRIVATE symbols"; \ touch debian/exit; \ fi; [ ! -f debian/exit ] || (rm debian/exit && exit 1) - rm debian/libclamav7.symbols.latest + rm debian/libclamav9.symbols.latest # Configure using the specified flags. dh_auto_configure -- $(CONFIG) $(DEBUG_OPTS) @@ -162,4 +162,4 @@ # Don't compress the example configuration files and the documentation PDFs. override_dh_compress: - dh_compress -Xexamples -X.pdf + dh_compress -Xexamples Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/clamdoc.pdf and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/clamdoc.pdf differ diff -Nru clamav-0.100.3+dfsg/docs/clamdoc.tex clamav-0.101.4+dfsg/docs/clamdoc.tex --- clamav-0.100.3+dfsg/docs/clamdoc.tex 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/clamdoc.tex 1970-01-01 00:00:00.000000000 +0000 @@ -1,1352 +0,0 @@ -% Clam AntiVirus: User Manual -% -% Copyright (C) 2016-2018 Cisco Systems, Inc. -% Copyright (C) 2008-2013 Sourcefire, Inc. -% Copyright (C) 2002 - 2007 Tomasz Kojm -% Version 0.2x corrected by Dennis Leeuw -% Version 0.80 corrected by Tomasz Papszun -% -% This program is free software; you can redistribute it and/or modify -% it under the terms of the GNU General Public License as published by -% the Free Software Foundation; either version 2 of the License, or -% (at your option) any later version. -% -% This program is distributed in the hope that it will be useful, -% but WITHOUT ANY WARRANTY; without even the implied warranty of -% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -% GNU General Public License for more details. -% -% You should have received a copy of the GNU General Public License -% along with this program; if not, write to the Free Software -% Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, -% MA 02110-1301, USA. - -\documentclass[a4paper,titlepage,12pt]{article} -\usepackage{amssymb} -\usepackage{pslatex} -\usepackage[dvips]{graphicx} -\usepackage{wrapfig} -\usepackage{boxedminipage} -\usepackage{url} -\usepackage{fancyhdr} -\usepackage{titlesec} -\addtolength{\hoffset}{-0.5cm} -\addtolength{\textwidth}{1cm} -\date{} - -\usepackage{color} -\definecolor{grey1}{gray}{0.8} -\definecolor{grey2}{gray}{0.3} - -% Based on Antonina Liedtke's article in Linux+ 6/2003 -\def\greyp{% - \unitlength=1mm% - \begin{picture}(0,0) - \put(0,-1.5){\textcolor{grey1}{\rule{13.9cm}{5.3mm}}\textcolor{grey2}% - {\rule{9mm}{5.3mm}}\hss} - \end{picture} -} - -\pagestyle{fancy} -\fancyhead{} -\fancyfoot{} -\renewcommand{\headrulewidth}{0pt} -\fancyhead[RO]{\textbf{\sffamily{{\textcolor{white}{\thepage}}~}}} -\fancyhead[RE]{\footnotesize{\nouppercase{\rightmark~}}} -\fancyhead[LO]{\footnotesize{\greyp{\nouppercase{\leftmark}}}} - - -\newcommand{\pl}{\vspace{.3cm}} -\newcommand{\rc}[2]{\textbf{#1: } #2\\[4pt]} -\newcommand{\up}[2]{\textbf{--#1: } #2\\[4pt]} -\newcommand{\email}[1]{\texttt{#1}} -\newcommand{\vbt}[1]{\verb+#1+} -\newcommand{\cons}[1]{\vspace{2mm} \noindent \ovalbox {\sffamily #1} - \vspace{2mm}} - -\begin{document} - \setcounter{page}{0} - - \pagestyle{empty} - \includegraphics[width=353pt]{html/demon.png} - \vspace{3cm} - \begin{flushright} - \rule[-1ex]{8cm}{3pt}\\ - \huge Clam AntiVirus 0.100.3\\ - \huge \emph{User Manual}\\ - \end{flushright} - - \newpage - \pagestyle{fancy} - \tableofcontents - \vspace{1.0cm} - - \noindent - \begin{boxedminipage}[b]{\textwidth} - ClamAV User Manual, -87d -88d -89d - \copyright \ 2018 Cisco Systems, Inc. - Authors: Tomasz Kojm\\ - This document is distributed under the terms of the GNU General - Public License v2.\\ - - Clam AntiVirus is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version.\\ - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details.\\ - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, - MA 02110-1301, USA. - \end{boxedminipage} - - \vspace{0.3cm} - \noindent - \begin{boxedminipage}[b]{\textwidth} - ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc. - \end{boxedminipage} - - \newpage - - \section{Introduction} - Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, - designed especially for e-mail scanning on mail gateways. It provides - a number of utilities including a flexible and scalable multi-threaded - daemon, a command line scanner and advanced tool for automatic database - updates. The core of the package is an anti-virus engine available in a - form of shared library. - - \subsection{Features} - - \begin{itemize} - \item{Licensed under the GNU General Public License, Version 2} - \item{POSIX compliant, portable} - \item{Fast scanning} - \item{Supports on-access scanning (Linux only)} - \item{Detects over 1 million viruses, worms and trojans, including - Microsoft Office macro viruses, mobile malware, and other threats} - \item{Built-in bytecode interpreter allows the ClamAV signature writers - to create and distribute very complex detection routines and - remotely enhance the scanner's functionality} - \item{Scans within archives and compressed files (also protects - against archive bombs), built-in support includes: - \begin{itemize} - \item Zip (including SFX) - \item RAR (including SFX) - \item 7Zip - \item ARJ (including SFX) - \item Tar - \item CPIO - \item Gzip - \item Bzip2 - \item DMG - \item IMG - \item ISO 9660 - \item PKG - \item HFS+ partition - \item HFSX partition - \item APM disk image - \item GPT disk image - \item MBR disk image - \item XAR - \item XZ - \item MS OLE2 - \item MS Cabinet Files (including SFX) - \item MS CHM (Compiled HTML) - \item MS SZDD compression format - \item BinHex - \item SIS (SymbianOS packages) - \item AutoIt - \item InstallShield - \end{itemize}} - \item{Supports Portable Executable (32/64-bit) files compressed or obfuscated with:} - \begin{itemize} - \item AsPack - \item UPX - \item FSG - \item Petite - \item PeSpin - \item NsPack - \item wwpack32 - \item MEW - \item Upack - \item Y0da Cryptor - \end{itemize} - \item{Supports ELF and Mach-O files (both 32- and 64-bit)} - \item{Supports almost all mail file formats} - \item{Support for other special files/formats includes:} - \begin{itemize} - \item HTML - \item RTF - \item PDF - \item Files encrypted with CryptFF and ScrEnc - \item uuencode - \item TNEF (winmail.dat) - \end{itemize} - \item{Advanced database updater with support for scripted updates, - digital signatures and DNS based database version queries} - \end{itemize} - - \subsection{Mailing lists and IRC channel} - If you have a trouble installing or using ClamAV try asking on our mailing - lists. There are four lists available: - \begin{itemize} - \item \textbf{clamav-announce*lists.clamav.net} - info about new versions, - moderated\footnote{Subscribers are not allowed to post to the mailing - list}. - \item \textbf{clamav-users*lists.clamav.net} - user questions - \item \textbf{clamav-devel*lists.clamav.net} - technical discussions - \item \textbf{clamav-virusdb*lists.clamav.net} - database update announcements, moderated - \end{itemize} - \noindent You can subscribe and search the mailing list archives at: - \url{https://www.clamav.net/contact.html#ml}\\ - Alternatively you can try asking on the \verb+#clamav+ IRC channel - launch - your favourite irc client and type: - \begin{verbatim} - /server irc.freenode.net - /join #clamav - \end{verbatim} - - \subsection{Virus submitting} - If you have got a virus which is not detected by your ClamAV with the latest - databases, please submit the sample at our website: - \begin{center} - \url{https://www.clamav.net/reports/malware} - \end{center} - - \section{Base package} - - \subsection{Supported platforms} - Clam AntiVirus is regularly tested on: - \begin{itemize} - \item{GNU/Linux} - \item{Solaris} - \item{FreeBSD} - \item{macOS} - \item{Windows} - \end{itemize} - - \subsection{Binary packages} - You can find the up-to-date list of binary packages at our website: - \url{https://www.clamav.net/download.html#otherversions} - - \section{Installation} - - \subsection{Requirements}\label{sec:components} - The following components are required to compile ClamAV under UNIX: - \footnote{For Windows instructions please see win32/README in the - main source code directory.} - \begin{itemize} - \item zlib and zlib-devel packages - \item openssl version 0.9.8 or higher and libssl-devel packages - \item gcc compiler suite (tested with 2.9x, 3.x and 4.x series)\\ - \textbf{If you are compiling with higher optimization levels - than the default one (\hbox{-O2} for gcc), be aware that there - have been reports of misoptimizations. The build system of ClamAV - only checks for bugs affecting the default settings, it is your - responsibility to check that your compiler version doesn't - have any bugs.} - \item GNU make (gmake) - \end{itemize} - The following packages are optional but \textbf{highly recommended}: - \begin{itemize} - \item bzip2 and bzip2-devel library - \item libxml2 and libxml2-dev library - \item \verb+check+ unit testing framework \footnote{See section \ref{unit-testing} on how to run the unit tests}. - \end{itemize} - The following packages are optional, but \textbf{required for bytecode JIT support}: - \footnote{if not available ClamAV will fall back to an interpreter} - \begin{itemize} - \item GCC C and C++ compilers (minimum 4.1.3, recommended 4.3.4 or newer)\\ - the package for these compilers are usually called: gcc, g++, or gcc-c++. - \footnote{Note that several versions of GCC have bugs when compiling LLVM, see - \url{http://llvm.org/docs/GettingStarted.html#brokengcc} for a - full list.} - \item OSX Xcode versions prior to 5.0 use a g++ compiler frontend (llvm-gcc) that is not - compatible with ClamAV JIT. It is recommended to either compile ClamAV JIT with - clang++ or to compile ClamAV without JIT. - \item A supported CPU for the JIT, either of: X86, X86-64, PowerPC, PowerPC64 - \end{itemize} - The following packages are optional, but needed for the JIT unit tests: - \begin{itemize} - \item GNU Make (version 3.79, recommended 3.81) - \item Python (version 2.5.4 or newer), for running the JIT unit tests - \end{itemize} - The following packages are optional, but required for clamsubmit: - \begin{itemize} - \item libcurl-devel library - \item libjson-c-dev library - \end{itemize} - - \subsection{Installing on shell account} - To install ClamAV locally on an unprivileged shell account you need not - create any additional users or groups. Assuming your home directory is - \verb+/home/gary+ you should build it as follows: - \begin{verbatim} - $ ./configure --prefix=/home/gary/clamav --disable-clamav - $ make; make install - \end{verbatim} - To test your installation execute: - \begin{verbatim} - $ ~/clamav/bin/freshclam - $ ~/clamav/bin/clamscan ~ - \end{verbatim} - The \verb+--disable-clamav+ switch disables the check for existence of - the \emph{clamav} user and group but \verb+clamscan+ would still require an - unprivileged account to work in a superuser mode. - - \subsection{Adding new system user and group} - If you are installing ClamAV for the first time, you have to add a new - user and group to your system: - \begin{verbatim} - # groupadd clamav - # useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav - \end{verbatim} - Consult a system manual if your OS has not \emph{groupadd} and - \emph{useradd} utilities. \textbf{Don't forget to lock access to the - account!} - - \subsection{Compilation of base package} - Once you have created the clamav user and group, please extract the archive: - \begin{verbatim} - $ zcat clamav-x.yz.tar.gz | tar xvf - - $ cd clamav-x.yz - \end{verbatim} - Assuming you want to install the configuration files in /etc, configure - and build the software as follows: - \begin{verbatim} - $ ./configure --sysconfdir=/etc - $ make - $ su -c "make install" - \end{verbatim} - In the last step the software is installed into the /usr/local directory - and the config files into /etc. \textbf{WARNING: Never enable the SUID - or SGID bits for Clam AntiVirus binaries.} - - \subsection{Compilation with clamav-milter enabled} - libmilter and its development files are required. To enable clamav-milter, - configure ClamAV with - \begin{verbatim} - $ ./configure --enable-milter - \end{verbatim} - See section /ref{sec:clamavmilter} for more details on clamav-milter. - - \subsection{Using the system LLVM} - Some problems have been reported when compiling ClamAV's built-in LLVM with recent - C++ compiler releases. These problems may be avoided by installing and using - an external LLVM system library. To configure ClamAV to use LLVM that is installed - as a system library instead of the built-in LLVM JIT, use following: - \begin{verbatim} - $ ./configure --with-system-llvm=/myllvm/bin/llvm-config - $ make - $ sudo make install - \end{verbatim} - The argument to \verb+--with-system-llvm+ is optional, indicating the path name of - the LLVM configuration utility (llvm-config). With no argument to \verb+--with-system-llvm+, - \verb+./configure+ will search for LLVM in /usr/local/ and then /usr. - \\\\ - Recommended versions of LLVM are 3.2, 3.3, 3.4, 3.5, and 3.6. Some installations have - reported problems using earlier LLVM versions. Versions of LLVM beyond 3.6 are not - currently supported in ClamAV. - - \subsection{Running unit tests}\label{unit-testing} - ClamAV includes unit tests that allow you to test that the compiled binaries work correctly on your platform. - \\\\ - The first step is to use your OS's package manager to install the \verb+check+ package. - If your OS doesn't have that package, you can download it from \url{http://check.sourceforge.net/}, - build it and install it. - \\\\ - To help clamav's configure script locate \verb+check+, it is recommended that you install \verb+pkg-config+, preferably - using your OS's package manager, or from \url{http://pkg-config.freedesktop.org}. - \\\\ - The recommended way to run unit-tests is the following, which ensures you will get an error if unit tests cannot be built: - \footnote{The configure script in ClamAV automatically enables the unit tests, if it finds the check framework, however it doesn't consider it a fatal error if unit tests cannot be enabled.} - \begin{verbatim} - $ ./configure --enable-check - $ make - $ make check - \end{verbatim} - When \verb+make check+ is finished, you should get a message similar to this: - \begin{verbatim} -================== -All 8 tests passed -================== - \end{verbatim} - If a unit test fails, you get a message similar to the following. - Note that in older versions of make check may report failures due to - the absence of optional packages. Please make sure you have the - latest versions of the components noted in section /ref{sec:components}. - See the next section on how to report a bug when a unit test fails. - \begin{verbatim} -======================================== -1 of 8 tests failed -Please report to https://bugzilla.clamav.net/ -======================================== - \end{verbatim} - If unit tests are disabled (and you didn't use --enable-check), you will get this message: - \begin{verbatim} -*** Unit tests disabled in this build -*** Use ./configure --enable-check to enable them - -SKIP: check_clamav -PASS: check_clamd.sh -PASS: check_freshclam.sh -PASS: check_sigtool.sh -PASS: check_clamscan.sh -====================== -All 4 tests passed -(1 tests were not run) -====================== - \end{verbatim} - Running \verb+./configure --enable-check+ should tell you why. - - \subsection{Reporting a unit test failure bug} - If \verb+make check+ says that some tests failed we encourage you to report a bug on our bugzilla: \url{https://bugzilla.clamav.net}. - The information we need is: - \begin{itemize} - \item The exact output from \verb+make check+ - \item Output of \verb+uname -mrsp+ - \item your \verb+config.log+ - \item The following files from the \verb+unit_tests/+ directory: - \begin{itemize} - \item \verb+test.log+ - \item \verb+clamscan.log+ - \item \verb+clamdscan.log+ - \end{itemize} - \item \verb+/tmp/clamd-test.log+ if it exists - \item where and how you installed the check package - \item Output of \verb+pkg-config check --cflags --libs+ - \item Optionally if \verb+valgrind+ is available on your platform, the output of the following: - \begin{verbatim} -$ make check -$ CK_FORK=no ./libtool --mode=execute valgrind unit_tests/check_clamav - \end{verbatim} - \end{itemize} - - \subsection{Obtain Latest ClamAV anti-virus signature databases} - Before you can run ClamAV in daemon mode (clamd), 'clamdscan', - or 'clamscan' which is ClamAV's command line virus scanner, - you must have ClamAV Virus Database (.cvd) file(s) installed - in the appropriate location on your system. The default - location for these database files are /usr/local/share/clamav - (in Linux/Unix). - \\\\ - Here is a listing of currently available ClamAV Virus Database Files: - \begin{itemize} - \item bytecode.cvd (signatures to detect bytecode in files) - \item main.cvd (main ClamAV virus database file) - \item daily.cvd (daily update file for ClamAV virus databases) - \item safebrowsing.cvd (virus signatures for safe browsing) - \end{itemize} - These files can be downloaded via HTTP from the main ClamAV website - or via the 'freshclam' utility on a periodic basis. Using 'freshclam' - is the preferred method of keeping the ClamAV virus database files - up to date without manual intervention (see section \ref{conf:freshclam} for - information on how to configure 'freshclam' for automatic updating and section - \ref{sec:freshclam} for additional details on freshclam). - - \section{Configuration} - Before proceeding with the steps below, you should - run the 'clamconf' command, which gives important information - about your ClamAV configuration. See section \ref{sec:clamconf} - for more details. - - \subsection{clamd} - Before you start using the daemon you have to edit the configuration file - (in other case \verb+clamd+ won't run): - \begin{verbatim} - $ clamd - ERROR: Please edit the example config file /etc/clamd.conf. - \end{verbatim} - This shows the location of the default configuration file. The format and - options of this file are fully described in the \emph{clamd.conf(5)} - manual. The config file is well commented and configuration should be - straightforward. - - \subsubsection{On-access scanning} - One of the interesting features of \verb+clamd+ is on-access scanning - based on fanotify, included in Linux since kernel 2.6.36. - \textbf{This is not required to run clamd}. At the moment the fanotify header is - only available for Linux. - \\\\ - Configure on-access scanning in \verb+clamd.conf+ and read the - \ref{On-access} section for on-access scanning usage. - - \subsection{clamav-milter}\label{sec:clamavmilter} - ClamAV $\ge0.95$ includes a new, redesigned clamav-milter. The most notable - difference is that the internal mode has been dropped and now a working - clamd companion is required. The second important difference is that now - the milter has got its own configuration and log files. - \\\\ - To compile ClamAV with the clamav-milter just run \verb+./configure+ - \verb+--enable-milter+ and make as usual. In order to use the - '--enable-milter' option with 'configure', your system MUST have the milter - library installed. If you use the '--enable-milter' option without the - library being installed, you will most likely see output like this during - 'configure': - \begin{verbatim} - checking for libiconv_open in -liconv... no - checking for iconv... yes - checking whether in_port_t is defined... yes - checking for in_addr_t definition... yes - checking for mi_stop in -lmilter... no - checking for library containing strlcpy... no - checking for mi_stop in -lmilter... no - configure: error: Cannot find libmilter - \end{verbatim} - At which point the 'configure' script will stop processing. - \\\\ - Please consult your MTA's manual on how to connect ClamAV with the milter. - - \subsection{Testing} - Try to scan recursively the source directory: - \begin{verbatim} - $ clamscan -r -l scan.txt clamav-x.yz - \end{verbatim} - It should find some test files in the clamav-x.yz/test directory. - The scan result will be saved in the \verb+scan.txt+ log file - \footnote{To get more info on clamscan options run 'man clamscan'}. - To test \verb+clamd+, start it and use \verb+clamdscan+ (or instead connect - directly to its socket and run the SCAN command): - \begin{verbatim} - $ clamdscan -l scan.txt clamav-x.yz - \end{verbatim} - Please note that the scanned files must be accessible by the user running - \verb+clamd+ or you will get an error. - - \subsection{Setting up auto-updating}\label{conf:freshclam} - \verb+freshclam+ is the automatic database update tool for Clam AntiVirus. - It can work in two modes: - \begin{itemize} - \item interactive - on demand from command line - \item daemon - silently in the background - \end{itemize} - \verb+freshclam+ is advanced tool: it supports scripted updates (instead - of transferring the whole CVD file at each update it only transfers the - differences between the latest and the current database via a special - script), database version checks through DNS, proxy servers (with - authentication), digital signatures and various error scenarios. - \textbf{Quick test: run freshclam (as superuser) with no parameters - and check the output.} If everything is OK you may create the log file in - /var/log (owned by \emph{clamav} or another user \verb+freshclam+ will be - running as): - \begin{verbatim} - # touch /var/log/freshclam.log - # chmod 600 /var/log/freshclam.log - # chown clamav /var/log/freshclam.log - \end{verbatim} - Now you \emph{should} edit the configuration file \verb+freshclam.conf+ - and point the \emph{UpdateLogFile} directive to the log file. Finally, to - run \verb+freshclam+ in the daemon mode, execute: - \begin{verbatim} - # freshclam -d - \end{verbatim} - The other way is to use the \emph{cron} daemon. You have to add the - following line to the crontab of \textbf{root} or \textbf{clamav} user: - {\small - \begin{verbatim} -N * * * * /usr/local/bin/freshclam --quiet - \end{verbatim}} - \noindent to check for a new database every hour. \textbf{N should be a - number between 3 and 57 of your choice. Please don't choose any multiple - of 10, because there are already too many clients using those time slots.} - Proxy settings are only configurable via the configuration file and - \verb+freshclam+ will require strict permission settings for the config - file when \verb+HTTPProxyPassword+ is turned on. - \begin{verbatim} - HTTPProxyServer myproxyserver.com - HTTPProxyPort 1234 - HTTPProxyUsername myusername - HTTPProxyPassword mypass - \end{verbatim} - - \subsubsection{Closest mirrors} - The \verb+DatabaseMirror+ directive in the config file specifies the - database server \verb+freshclam+ will attempt (up to \verb+MaxAttempts+ - times) to download the database from. The default database mirror - is \url{database.clamav.net} but multiple directives are allowed. - In order to download the database from the closest mirror you should - configure \verb+freshclam+ to use \url{db.xx.clamav.net} where xx - represents your country code. For example, if your server is in "Ascension - Island" you should have the following lines included in \verb+freshclam.conf+: - \begin{verbatim} - DNSDatabaseInfo current.cvd.clamav.net - DatabaseMirror db.ac.clamav.net - DatabaseMirror database.clamav.net - \end{verbatim} - The second entry acts as a fallback in case the connection to the first - mirror fails for some reason. The full list of two-letters country codes - is available at \url{http://www.iana.org/cctld/cctld-whois.htm} - - \section{Usage} - - \subsection{Clam daemon}\label{clamd} - \verb+clamd+ is a multi-threaded daemon that uses \emph{libclamav} - to scan files for viruses. It may work in one or both modes listening on: - \begin{itemize} - \item Unix (local) socket - \item TCP socket - \end{itemize} - The daemon is fully configurable via the \verb+clamd.conf+ file - \footnote{man 5 clamd.conf}. \verb+clamd+ recognizes the following commands: - \begin{itemize} - \item \textbf{PING}\\ - Check the daemon's state (should reply with "PONG"). - \item \textbf{VERSION}\\ - Print program and database versions. - \item \textbf{RELOAD}\\ - Reload the databases. - \item \textbf{SHUTDOWN}\\ - Perform a clean exit. - \item \textbf{SCAN file/directory}\\ - Scan file or directory (recursively) with archive support - enabled (a full path is required). - \item \textbf{RAWSCAN file/directory}\\ - Scan file or directory (recursively) with archive and special file - support disabled (a full path is required). - \item \textbf{CONTSCAN file/directory}\\ - Scan file or directory (recursively) with archive support - enabled and don't stop the scanning when a virus is found. - \item \textbf{MULTISCAN file/directory}\\ - Scan file in a standard way or scan directory (recursively) using - multiple threads (to make the scanning faster on SMP machines). - \item \textbf{ALLMATCHSCAN file/directory}\\ - ALLMATCHSCAN works just like SCAN except that it sets a mode - where, after finding a virus within a file, continues scanning for - additional viruses. - \item \textbf{INSTREAM}\\ - \emph{It is mandatory to prefix this command with \textbf{n} or - \textbf{z}.}\\ - Scan a stream of data. The stream is sent to clamd in chunks, - after INSTREAM, on the same socket on which the command - was sent. This avoids the overhead of establishing new TCP - connections and problems with NAT. The format of the chunk is: - \verb++ where \verb++ is the size of the - following data in bytes expressed as a 4 byte unsigned integer in - network byte order and \verb++ is the actual chunk. Streaming - is terminated by sending a zero-length chunk. Note: do not exceed - StreamMaxLength as defined in clamd.conf, otherwise clamd will - reply with \emph{INSTREAM size limit exceeded} and close the - connection. - \item \textbf{FILDES}\\ - \emph{It is mandatory to newline terminate this command, or prefix - with \textbf{n} or \textbf{z}. This command only works on UNIX - domain sockets.}\\ - Scan a file descriptor. After issuing a FILDES command a subsequent - rfc2292/bsd4.4 style packet (with at least one dummy character) is - sent to clamd carrying the file descriptor to be scanned inside the - ancillary data. Alternatively the file descriptor may be sent in - the same packet, including the extra character. - \item \textbf{STATS}\\ - \emph{It is mandatory to newline terminate this command, or prefix - with \textbf{n} or \textbf{z}, it is recommended to only use the - \textbf{z} prefix.}\\ - On this command clamd provides statistics about the scan queue, - contents of scan queue, and memory usage. The exact reply format is - subject to changes in future releases. - \item \textbf{IDSESSION, END}\\ - \emph{It is mandatory to prefix this command with \textbf{n} or - \textbf{z}, also all commands inside \textbf{IDSESSION} must be - prefixed.}\\ - Start/end a clamd session. Within a session multiple - SCAN, INSTREAM, FILDES, VERSION, STATS commands can be sent on the - same socket without opening new connections. Replies from clamd - will be in the form \verb+: + where \verb++ is - the request number (in ASCII, starting from 1) and \verb++ - is the usual clamd reply. The reply lines have the same delimiter - as the corresponding command had. Clamd will process the commands - asynchronously, and reply as soon as it has finished processing. - Clamd requires clients to read all the replies it sent, before - sending more commands to prevent send() deadlocks. The recommended - way to implement a client that uses IDSESSION is with non-blocking - sockets, and a select()/poll() loop: whenever send would block, - sleep in select/poll until either you can write more data, or read - more replies. \emph{Note that using non-blocking sockets without - the select/poll loop and alternating recv()/send() doesn't comply - with clamd's requirements.} If clamd detects that a client has - deadlocked, it will close the connection. Note that clamd may - close an IDSESSION connection too if the client doesn't follow the - protocol's requirements. - \item \textbf{STREAM} (deprecated, use \textbf{INSTREAM} instead)\\ - Scan stream: clamd will return a new port number you should - connect to and send data to scan. - \end{itemize} - It's recommended to prefix clamd commands with the letter \textbf{z} - (eg. zSCAN) to indicate that the command will be delimited by a NULL - character and that clamd should continue reading command data until a NULL - character is read. The null delimiter assures that the complete command - and its entire argument will be processed as a single command. Alternatively - commands may be prefixed with the letter \textbf{n} (e.g. nSCAN) to use - a newline character as the delimiter. Clamd replies will honour the - requested terminator in turn. If clamd doesn't recognize the command, or - the command doesn't follow the requirements specified below, it will reply - with an error message, and close the connection. - \noindent - Clamd can handle the following signals: - \begin{itemize} - \item \textbf{SIGTERM} - perform a clean exit - \item \textbf{SIGHUP} - reopen the log file - \item \textbf{SIGUSR2} - reload the database - \end{itemize} - Clamd should not be started in the background using the shell operator - \verb+&+ or external tools. Instead, you should run and wait for clamd - to load the database and daemonize itself. After that, clamd is instantly - ready to accept connections and perform file scanning. - - \subsection{Clam\textbf{d}scan} - \verb+clamdscan+ is a simple \verb+clamd+ client. In many cases you can - use it as a \verb+clamscan+ replacement however you must remember that: - \begin{itemize} - \item it only depends on \verb+clamd+ - \item although it accepts the same command line options as - \verb+clamscan+ most of them are ignored because they must be - enabled directly in \verb+clamd+, i.e. \verb+clamd.conf+ - \item in TCP mode scanned files must be accessible for \verb+clamd+, - if you enabled LocalSocket in clamd.conf then clamdscan will - try to workaround this limitation by using FILDES - \end{itemize} - - \subsection{On-access Scanning}\label{On-access} - There is a special thread in \verb+clamd+ that performs on-access - scanning under Linux and shares internal virus database - with the daemon. By default, this thread will only notify you when - potential threats are discovered. If you turn on prevention via - \verb+clamd.conf+ then \textbf{you must follow some important rules when - using it:} - \begin{itemize} - \item Always stop the daemon cleanly - using the SHUTDOWN command or - the\\ SIGTERM signal. In other case you can lose access - to protected files until the system is restarted. - \item Never protect the directory your mail-scanner software - uses for attachment unpacking. Access to all infected - files will be automatically blocked and the scanner (including - \verb+clamd+!) will not be able to detect any viruses. In the - result \textbf{all infected mails may be delivered.} - \item Watch your entire filesystem only using the \verb+clamd.conf+ - OnAccessMountPath option. While this will disable on-access prevention, - it will avoid potential system lockups caused by fanotify's blocking - functionality. - \item Using the On-Access Scanner to watch a virtual filesystem will result - in undefined behaviour. - \end{itemize} - The default configuration utilizes inotify to recursively keep track of - directories. If you need to protect more than 8192 directories it will - be necessary to change inotify's \verb+max_user_watches+ value. - \\\\ - This can be done temporarily with: - \begin{verbatim} - $ sysctl fs.inotify.max_user_watches= - \end{verbatim} - Where \verb++ is the new maximum desired. - \\\\ - To watch your entire filesystem add the following lines to - \verb+clamd.conf+: - \begin{verbatim} - ScanOnAccess yes - OnAccessMountPath / - \end{verbatim} - Similarly, to protect your home directory add the following lines to - \verb+clamd.conf+: - \begin{verbatim} - ScanOnAccess yes - OnAccessIncludePath /home - OnAccessExcludePath /home/user/temp/dir/of/your/mail/scanning/software - OnAccessPrevention yes - \end{verbatim} - For more configuration options, type 'man clamd.conf' or reference the - example clamd.conf. - - \subsection{Clamdtop} - \verb+clamdtop+ is a tool to monitor one or multiple instances of clamd. It - has a (color) ncurses interface, that shows the jobs in clamd's queue, - memory usage, and information about the loaded signature database. - You can specify on the command-line to which clamd(s) it should connect - to. By default it will attempt to connect to the local clamd as defined - in clamd.conf. - \\\\ - For more detailed help, type 'man clamdtop' or 'clamdtop --help'. - - \subsection{Clamscan} - \verb+clamscan+ is ClamAV's command line virus scanner. It can be used to - scan files and/or directories for viruses. In order for clamscan - to work proper, the ClamAV virus database files must be installed on - the system you are using clamscan on. - \\\\ - The general usage of clamscan is: clamscan [options] [file/directory/-] - \\\\ - For more detailed help, type 'man clamscan' or 'clamscan --help'. - - \subsection{ClamBC} - \verb+clambc+ is Clam Anti-Virus' bytecode testing tool. It can be - used to test files which contain bytecode. For more detailed help, - type 'man clambc' or 'clambc --help'. - - \subsection{Freshclam}\label{sec:freshclam} - \verb+freshclam+ is ClamAV's virus database update tool and reads it's - configuration from the file 'freshclam.conf' (this may be - overridden by command line options). Freshclam's default behavior is to - attempt to update databases that are paired with downloaded cdiffs. - Potentially corrupted databases are not updated and are automatically - fully replaced after several failed attempts unless otherwise specified. - \\\\ - Here is a sample usage including cdiffs: -{\footnotesize - \begin{verbatim} -$ freshclam - -ClamAV update process started at Mon Oct 7 08:15:10 2013 -main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo) -Downloading daily-17945.cdiff [100%] -Downloading daily-17946.cdiff [100%] -Downloading daily-17947.cdiff [100%] -daily.cld updated (version: 17947, sigs: 406951, f-level: 63, builder: neo) -Downloading bytecode-227.cdiff [100%] -Downloading bytecode-228.cdiff [100%] -bytecode.cld updated (version: 228, sigs: 43, f-level: 63, builder: neo) -Database updated (2831219 signatures) from database.clamav.net (IP: 64.6.100.177) - \end{verbatim} -} - For more detailed help, type 'man clamscan' or 'clamscan --help'. - - \subsection{Clamconf}\label{sec:clamconf} - \verb+clamconf+ is the Clam Anti-Virus configuration utility. It is used - for displaying values of configurations options in ClamAV, which - will show the contents of clamd.conf (or tell you if it is not - properly configured), the contents of freshclam.conf, and display - information about software settings, database, platform, and build - information. Here is a sample clamconf output: -{\footnotesize - \begin{verbatim} -$ clamconf - -Checking configuration files in /etc/clamav - -Config file: clamd.conf ------------------------ -ERROR: Please edit the example config file /etc/clamav/clamd.conf - -Config file: freshclam.conf ---------------------------- -ERROR: Please edit the example config file /etc/clamav/freshclam.conf - -clamav-milter.conf not found - -Software settings ------------------ -Version: 0.98.2 -Optional features supported: MEMPOOL IPv6 AUTOIT_EA06 BZIP2 RAR JIT - -Database information --------------------- -Database directory: /xclam/gcc/release/share/clamav -WARNING: freshclam.conf and clamd.conf point to different database directories -print_dbs: Can't open directory /xclam/gcc/release/share/clamav - -Platform information --------------------- -uname: Linux 3.5.0-44-generic #67~precise1-Ubuntu SMP Wed Nov 13 16:20:03 UTC 2013 i686 -OS: linux-gnu, ARCH: i386, CPU: i686 -Full OS version: Ubuntu 12.04.3 LTS -zlib version: 1.2.3.4 (1.2.3.4), compile flags: 55 -Triple: i386-pc-linux-gnu -CPU: i686, Little-endian -platform id: 0x0a114d4d0404060401040604 - -Build information ------------------ -GNU C: 4.6.4 (4.6.4) -GNU C++: 4.6.4 (4.6.4) -CPPFLAGS: -CFLAGS: -g -O0 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -CXXFLAGS: -LDFLAGS: -Configure: '--prefix=/xclam/gcc/release/' '--disable-clamav' '--enable-debug' 'CFLAGS=-g -O0' -sizeof(void*) = 4 -Engine flevel: 77, dconf: 77 - \end{verbatim} -} - For more detailed help, type 'man clamconf' or 'clamconf --help'. - - \subsection{Output format} - - \subsubsection{clamscan} - \verb+clamscan+ writes all regular program messages to \textbf{stdout} and - errors/warnings to \textbf{stderr}. You can use the option \verb+--stdout+ - to redirect all program messages to \textbf{stdout}. Warnings and error - messages from \verb+libclamav+ are always printed to \textbf{stderr}. - A typical output from \verb+clamscan+ looks like this: - \begin{verbatim} - /tmp/test/removal-tool.exe: Worm.Sober FOUND - /tmp/test/md5.o: OK - /tmp/test/blob.c: OK - /tmp/test/message.c: OK - /tmp/test/error.hta: VBS.Inor.D FOUND - \end{verbatim} - When a virus is found its name is printed between the \verb+filename:+ and - \verb+FOUND+ strings. In case of archives the scanner depends on libclamav - and only prints the first virus found within an archive: - \begin{verbatim} - $ clamscan malware.zip - malware.zip: Worm.Mydoom.U FOUND - \end{verbatim} - When using the --allmatch(-z) flag, clamscan may print multiple virus - \verb+FOUND+ lines for archives and files. - - \subsubsection{clamd} - The output format of \verb+clamd+ is very similar to \verb+clamscan+. - \begin{verbatim} - $ telnet localhost 3310 - Trying 127.0.0.1... - Connected to localhost. - Escape character is '^]'. - SCAN /home/zolw/test - /home/zolw/test/clam.exe: ClamAV-Test-File FOUND - Connection closed by foreign host. - \end{verbatim} - In the \textbf{SCAN} mode it closes the connection when the first virus - is found. - \begin{verbatim} - SCAN /home/zolw/test/clam.zip - /home/zolw/test/clam.zip: ClamAV-Test-File FOUND - \end{verbatim} - \textbf{CONTSCAN} and \textbf{MULTISCAN} don't stop scanning in case - a virus is found.\\ - Error messages are printed in the following format: - \begin{verbatim} - SCAN /no/such/file - /no/such/file: Can't stat() the file. ERROR - \end{verbatim} - - \section{LibClamAV} - Libclamav provides an easy and effective way to add a virus protection into - your software. The library is thread-safe and transparently recognizes and - scans within archives, mail files, MS Office document files, executables - and other special formats. - - \subsection{License} - Libclamav is licensed under the GNU GPL v2 license. This means you are - \textbf{not allowed} to link commercial, closed-source software - against it. All software using libclamav must be GPL compliant. - - \subsection{Supported formats and features} - - \subsubsection{Executables} - The library has a built-in support for 32- and 64-bit Portable Executable, - ELF and Mach-O files. Additionally, it can handle PE files compressed or - obfuscated with the following tools: - \begin{itemize} - \item Aspack (2.12) - \item UPX (all versions) - \item FSG (1.3, 1.31, 1.33, 2.0) - \item Petite (2.x) - \item PeSpin (1.1) - \item NsPack - \item wwpack32 (1.20) - \item MEW - \item Upack - \item Y0da Cryptor (1.3) - \end{itemize} - - \subsubsection{Mail files} - Libclamav can handle almost every mail file format including TNEF - (winmail.dat) attachments. - - \subsubsection{Archives and compressed files} - The following archive and compression formats are supported by internal - handlers: - \begin{itemize} - \item Zip (+ SFX) - \item RAR (+ SFX) - \item 7Zip - \item Tar - \item CPIO - \item Gzip - \item Bzip2 - \item DMG - \item IMG - \item ISO 9660 - \item PKG - \item HFS+ partition - \item HFSX partition - \item APM disk image - \item GPT disk image - \item MBR disk image - \item XAR - \item XZ - \item MS OLE2 - \item MS Cabinet Files (+ SFX) - \item MS CHM (Compiled HTML) - \item MS SZDD compression format - \item BinHex - \item SIS (SymbianOS packages) - \item AutoIt - \item NSIS - \item InstallShield - \end{itemize} - - \subsubsection{Documents} - The most popular file formats are supported: - \begin{itemize} - \item MS Office and MacOffice files - \item RTF - \item PDF - \item HTML - \end{itemize} - In the case of Office, RTF and PDF files, libclamav will only extract the - embedded objects and will not decode the text data itself. The text - decoding and normalization is only performed for HTML files. - - \subsubsection{Data Loss Prevention} - Libclamav includes a DLP module which can detect the following - credit card issuers: AMEX, VISA, MasterCard, Discover, Diner's Club, - and JCB and U.S. social security numbers inside text files. - \\\\ - Future versions of Libclamav may include additional features to - detect other credit cards and other forms of PII (Personally - Identifiable Information) which may be transmitted without the - benefit of being encrypted. - - \subsubsection{Others} - Libclamav can handle various obfuscators, encoders, files vulnerable to - security risks such as: - \begin{itemize} - \item JPEG (exploit detection) - \item RIFF (exploit detection) - \item uuencode - \item ScrEnc obfuscation - \item CryptFF - \end{itemize} - - \subsection{API} - - \subsubsection{Header file} - Every program using libclamav must include the header file \verb+clamav.h+: - \begin{verbatim} - #include - \end{verbatim} - - \subsubsection{Initialization} - Before using libclamav, you should call \verb+cl_init()+ to initialize - it. \verb+CL_INIT_DEFAULT+ is a macro that can be passed to \verb+cl_init()+ - representing the default initialization settings. When it's done, you're ready - to create a new scan engine by calling \verb+cl_engine_new()+. To free resources - allocated by the engine use \verb+cl_engine_free()+. Function prototypes: - \begin{verbatim} - int cl_init(unsigned int options); - struct cl_engine *cl_engine_new(void); - int cl_engine_free(struct cl_engine *engine); - \end{verbatim} - \verb+cl_init()+ and \verb+cl_engine_free()+ return \verb+CL_SUCCESS+ - on success or another code on error. \verb+cl_engine_new()+ return - a pointer or NULL if there's not enough memory to allocate a new - engine structure. - - \subsubsection{Database loading} - The following set of functions provides an interface for loading - the virus database: - \begin{verbatim} - const char *cl_retdbdir(void); - - int cl_load(const char *path, struct cl_engine *engine, - unsigned int *signo, unsigned int options); - \end{verbatim} - \verb+cl_retdbdir()+ returns the default (hardcoded) path to the directory - with ClamAV databases. - \verb+cl_load()+ loads a single database file or all databases from a - given directory (when \verb+path+ points to a directory). The second - argument is used for passing in the pointer to the engine that should - be previously allocated with \verb+cl_engine_new()+. A number of loaded - signatures will be \textbf{added} to \verb+signo+ \footnote{Remember to - initialize the virus counter variable with 0.}. The last argument can - pass the following flags: - \begin{itemize} - \item \textbf{CL\_DB\_STDOPT}\\ - This is an alias for a recommended set of scan options. - \item \textbf{CL\_DB\_PHISHING}\\ - Load phishing signatures. - \item \textbf{CL\_DB\_PHISHING\_URLS}\\ - Initialize the phishing detection module and load .wdb and .pdb files. - \item \textbf{CL\_DB\_PUA}\\ - Load signatures for Potentially Unwanted Applications. - \item \textbf{CL\_DB\_OFFICIAL\_ONLY}\\ - Only load official signatures from digitally signed databases. - \item \textbf{CL\_DB\_BYTECODE}\\ - Load bytecode. - \end{itemize} - \verb+cl_load()+ returns \verb+CL_SUCCESS+ on success and another code on - failure. - \begin{verbatim} - ... - struct cl_engine *engine; - unsigned int sigs = 0; - int ret; - - if((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) { - printf("cl_init() error: %s\n", cl_strerror(ret)); - return 1; - } - - if(!(engine = cl_engine_new())) { - printf("Can't create new engine\n"); - return 1; - } - - ret = cl_load(cl_retdbdir(), engine, &sigs, CL_DB_STDOPT); - \end{verbatim} - - \subsubsection{Error handling} - Use \verb+cl_strerror()+ to convert error codes into human readable - messages. The function returns a statically allocated string: - \begin{verbatim} - if(ret != CL_SUCCESS) { - printf("cl_load() error: %s\n", cl_strerror(ret)); - cl_engine_free(engine); - return 1; - } - \end{verbatim} - - \subsubsection{Engine structure} - When all required databases are loaded you should prepare the detection - engine by calling \verb+cl_engine_compile()+. In case of failure you - should still free the memory allocated to the engine with - \verb+cl_engine_free()+: - \begin{verbatim} - int cl_engine_compile(struct cl_engine *engine); - \end{verbatim} - In our example: - \begin{verbatim} - if((ret = cl_engine_compile(engine)) != CL_SUCCESS) { - printf("cl_engine_compile() error: %s\n", cl_strerror(ret)); - cl_engine_free(engine); - return 1; - } - \end{verbatim} - - \subsubsection{Limits} - When you create a new engine with \verb+cl_engine_new()+, it will have - all internal settings set to default values as recommended by the - ClamAV authors. It's possible to check and modify the values (numerical - and strings) using the following set of functions: - \begin{verbatim} -int cl_engine_set_num(struct cl_engine *engine, - enum cl_engine_field field, long long num); - -long long cl_engine_get_num(const struct cl_engine *engine, - enum cl_engine_field field, int *err); - -int cl_engine_set_str(struct cl_engine *engine, - enum cl_engine_field field, const char *str); - -const char *cl_engine_get_str(const struct cl_engine *engine, - enum cl_engine_field field, int *err); - \end{verbatim} - Please don't modify the default values unless you know what you're doing. - Refer to the ClamAV sources (clamscan, clamd) for examples. - - \subsubsection{Database checks} - It's very important to keep the internal instance of the database up to - date. You can watch database changes with the \verb+cl_stat..()+ family - of functions. - \begin{verbatim} - int cl_statinidir(const char *dirname, struct cl_stat *dbstat); - int cl_statchkdir(const struct cl_stat *dbstat); - int cl_statfree(struct cl_stat *dbstat); - \end{verbatim} - Initialization: - \begin{verbatim} - ... - struct cl_stat dbstat; - - memset(&dbstat, 0, sizeof(struct cl_stat)); - cl_statinidir(dbdir, &dbstat); - \end{verbatim} - To check for a change you just need to call \verb+cl_statchkdir+ and check - its return value (0 - no change, 1 - some change occurred). Remember to reset - the \verb+cl_stat+ structure after reloading the database. - \begin{verbatim} - if(cl_statchkdir(&dbstat) == 1) { - reload_database...; - cl_statfree(&dbstat); - cl_statinidir(cl_retdbdir(), &dbstat); - } - \end{verbatim} - Libclamav $\ge0.96$ includes and additional call to check the number of - signatures that can be loaded from a given directory: - \begin{verbatim} - int cl_countsigs(const char *path, unsigned int countoptions, - unsigned int *sigs); - \end{verbatim} - The first argument points to the database directory, the second one - specifies what signatures should be counted: - \verb+CL_COUNTSIGS_OFFICIAL+ (official signatures),\\ - \verb+CL_COUNTSIGS_UNOFFICIAL+ (third party signatures), - \verb+CL_COUNTSIGS_ALL+ (all signatures). The last argument points - to the counter to which the number of detected signatures will - be added (therefore the counter should be initially set to 0). - The call returns \verb+CL_SUCCESS+ or an error code. - - \subsubsection{Data scan functions} - It's possible to scan a file or descriptor using: - \begin{verbatim} - int cl_scanfile(const char *filename, const char **virname, - unsigned long int *scanned, const struct cl_engine *engine, - unsigned int options); - - int cl_scandesc(int desc, const char **virname, unsigned - long int *scanned, const struct cl_engine *engine, - unsigned int options); - \end{verbatim} - Both functions will store a virus name under the pointer \verb+virname+, - the virus name is part of the engine structure and must not be released - directly. If the third argument (\verb+scanned+) is not NULL, the - functions will increase its value with the size of scanned data (in - \verb+CL_COUNT_PRECISION+ units). - The last argument (\verb+options+) specified the scan options and supports - the following flags (which can be combined using bit operators): - \begin{itemize} - \item \textbf{CL\_SCAN\_STDOPT}\\ - This is an alias for a recommended set of scan options. You - should use it to make your software ready for new features - in the future versions of libclamav. - \item \textbf{CL\_SCAN\_RAW}\\ - Use it alone if you want to disable support for special files. - \item \textbf{CL\_SCAN\_ARCHIVE}\\ - This flag enables transparent scanning of various archive formats. - \item \textbf{CL\_SCAN\_BLOCKENCRYPTED}\\ - With this flag the library will mark encrypted archives as viruses - (Encrypted.Zip, Encrypted.RAR). - \item \textbf{CL\_SCAN\_MAIL}\\ - Enable support for mail files. - \item \textbf{CL\_SCAN\_OLE2}\\ - Enables support for OLE2 containers (used by MS Office and .msi - files). - \item \textbf{CL\_SCAN\_PDF}\\ - Enables scanning within PDF files. - \item \textbf{CL\_SCAN\_SWF}\\ - Enables scanning within SWF files, notably compressed SWF. - \item \textbf{CL\_SCAN\_PE}\\ - This flag enables deep scanning of Portable Executable files and - allows libclamav to unpack executables compressed with run-time - unpackers. - \item \textbf{CL\_SCAN\_ELF}\\ - Enable support for ELF files. - \item \textbf{CL\_SCAN\_BLOCKBROKEN}\\ - libclamav will try to detect broken executables and mark them as - Broken.Executable. - \item \textbf{CL\_SCAN\_HTML}\\ - This flag enables HTML normalisation (including ScrEnc - decryption). - \item \textbf{CL\_SCAN\_ALGORITHMIC}\\ - Enable algorithmic detection of viruses. - \item \textbf{CL\_SCAN\_PHISHING\_BLOCKSSL}\\ - Phishing module: always block SSL mismatches in URLs. - \item \textbf{CL\_SCAN\_PHISHING\_BLOCKCLOAK}\\ - Phishing module: always block cloaked URLs. - \item \textbf{CL\_SCAN\_STRUCTURED}\\ - Enable the DLP module which scans for credit card and SSN - numbers. - \item \textbf{CL\_SCAN\_STRUCTURED\_SSN\_NORMAL}\\ - Search for SSNs formatted as xx-yy-zzzz. - \item \textbf{CL\_SCAN\_STRUCTURED\_SSN\_STRIPPED}\\ - Search for SSNs formatted as xxyyzzzz. - \item \textbf{CL\_SCAN\_PARTIAL\_MESSAGE}\\ - Scan RFC1341 messages split over many emails. You will need to - periodically clean up \verb+$TemporaryDirectory/clamav-partial+ - directory. - \item \textbf{CL\_SCAN\_HEURISTIC\_PRECEDENCE}\\ - Allow heuristic match to take precedence. When enabled, if - a heuristic scan (such as phishingScan) detects a possible - virus/phish it will stop scan immediately. Recommended, saves CPU - scan-time. When disabled, virus/phish detected by heuristic scans - will be reported only at the end of a scan. If an archive - contains both a heuristically detected virus/phishing, and a real - malware, the real malware will be reported. - \item \textbf{CL\_SCAN\_BLOCKMACROS}\\ - OLE2 containers, which contain VBA macros will be marked infected - (Heuristics.OLE2.ContainsMacros). - \end{itemize} - All functions return \verb+CL_CLEAN+ when the file seems clean, - \verb+CL_VIRUS+ when a virus is detected and another value on failure. - \begin{verbatim} - ... - const char *virname; - - if((ret = cl_scanfile("/tmp/test.exe", &virname, NULL, engine, - CL_SCAN_STDOPT)) == CL_VIRUS) { - printf("Virus detected: %s\n", virname); - } else { - printf("No virus detected.\n"); - if(ret != CL_CLEAN) - printf("Error: %s\n", cl_strerror(ret)); - } - \end{verbatim} - - \subsubsection{Memory} - Because the engine structure occupies a few megabytes of system memory, you - should release it with \verb+cl_engine_free()+ if you no longer need to - scan files. - - \subsubsection{Forking daemons} - If you're using libclamav with a forking daemon you should call - \verb+srand()+ inside a forked child before making any calls to the - libclamav functions. This will avoid possible collisions with temporary - filenames created by other processes of the daemon. This procedure - is not required for multi-threaded daemons. - - \subsubsection{clamav-config} - Use \verb+clamav-config+ to check compilation information for libclamav. - \begin{verbatim} - $ clamav-config --libs - -L/usr/local/lib -lz -lbz2 -lgmp -lpthread - $ clamav-config --cflags - -I/usr/local/include -g -O2 - \end{verbatim} - - \subsubsection{Example} - You will find an example scanner application in the clamav source - package (/example). Provided you have ClamAV already installed, execute - the following to compile it: - \begin{verbatim} - gcc -Wall ex1.c -o ex1 -lclamav - \end{verbatim} - - \subsection{CVD format} - CVD (ClamAV Virus Database) is a digitally signed tarball containing - one or more databases. The header is a 512-bytes long string with colon - separated fields: - \begin{verbatim} -ClamAV-VDB:build time:version:number of signatures:functionality -level required:MD5 checksum:digital signature:builder name:build time (sec) - \end{verbatim} - \verb+sigtool --info+ displays detailed information on CVD files: - \begin{verbatim} -$ sigtool -i daily.cvd -File: daily.cvd -Build time: 10 Mar 2008 10:45 +0000 -Version: 6191 -Signatures: 59084 -Functionality level: 26 -Builder: ccordes -MD5: 6e6e29dae36b4b7315932c921e568330 -Digital signature: zz9irc9irupR3z7yX6J+OR6XdFPUat4HIM9ERn3kAcOWpcMFxq -Fs4toG5WJsHda0Jj92IUusZ7wAgYjpai1Nr+jFfXHsJxv0dBkS5/XWMntj0T1ctNgqmiF -+RLU6V0VeTl4Oej3Aya0cVpd9K4XXevEO2eTTvzWNCAq0ZzWNdjc -Verification OK. - \end{verbatim} - - \subsection{Graphics} - The current ClamAV logo was created by Alicia Willet, Talos. - - \subsection{OpenAntiVirus} - Our database includes the virus database (about 7000 signatures) from - OpenAntiVirus (\url{http://OpenAntiVirus.org}). - -\end{document} diff -Nru clamav-0.100.3+dfsg/docs/html/clamdoc.css clamav-0.101.4+dfsg/docs/html/clamdoc.css --- clamav-0.100.3+dfsg/docs/html/clamdoc.css 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/clamdoc.css 1970-01-01 00:00:00.000000000 +0000 @@ -1,38 +0,0 @@ -/* Century Schoolbook font is very similar to Computer Modern Math: cmmi */ -.MATH { font-family: "Century Schoolbook", serif; } -.MATH I { font-family: "Century Schoolbook", serif; font-style: italic } -.BOLDMATH { font-family: "Century Schoolbook", serif; font-weight: bold } - -/* implement both fixed-size and relative sizes */ -SMALL.XTINY { font-size : xx-small } -SMALL.TINY { font-size : x-small } -SMALL.SCRIPTSIZE { font-size : smaller } -SMALL.FOOTNOTESIZE { font-size : small } -SMALL.SMALL { } -BIG.LARGE { } -BIG.XLARGE { font-size : large } -BIG.XXLARGE { font-size : x-large } -BIG.HUGE { font-size : larger } -BIG.XHUGE { font-size : xx-large } - -/* heading styles */ -H1 { } -H2 { } -H3 { } -H4 { } -H5 { } - -/* mathematics styles */ -DIV.displaymath { } /* math displays */ -TD.eqno { } /* equation-number cells */ - - -/* document-specific styles come next */ -PRE.preform { } -DIV.center { } -DIV.flushright { } -DIV.navigation { } -SPAN.textbf { font-weight: bold } -SPAN.arabic { } -SPAN.textit { font-style: italic } -#hue36 { color: #ffffff; } diff -Nru clamav-0.100.3+dfsg/docs/html/clamdoc.html clamav-0.101.4+dfsg/docs/html/clamdoc.html --- clamav-0.100.3+dfsg/docs/html/clamdoc.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/clamdoc.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,228 +0,0 @@ - - - - - -clamdoc - - - - - - - - - - - - - - - -
- -next -up -previous - -contents -
- Next: Contents -   Contents -
-
- - -

- - Image demon -
-
-
-
-
-
-
-
-

-
Clam AntiVirus 0.100.3 -
User Manual -
-
- -

- -

- - - - - -
-
-Cisco 2019-02-28 -
- - Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/clam.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/clam.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/contents.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/contents.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/crossref.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/crossref.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/demon.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/demon.png differ diff -Nru clamav-0.100.3+dfsg/docs/html/footnode.html clamav-0.101.4+dfsg/docs/html/footnode.html --- clamav-0.100.3+dfsg/docs/html/footnode.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/footnode.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,360 +0,0 @@ - - - - - -Footnotes - - - - - - - - - - - - - - - - -
-
... moderated1
-
Subscribers are not allowed to post to the mailing - list - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... UNIX:2
-
For Windows instructions please see win32/README in the - main source code directory. - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... framework3
-
See section [*] on how to run the unit tests - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... support:4
-
if not available ClamAV will fall back to an interpreter - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... gcc-c++.5
-
Note that several versions of GCC have bugs when compiling LLVM, see - http://llvm.org/docs/GettingStarted.html#brokengcc for a - full list. - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... built:6
-
The configure script in ClamAV automatically enables the unit tests, if it finds the check framework, however it doesn't consider it a fatal error if unit tests cannot be enabled. - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... file7
-
To get more info on clamscan options run 'man clamscan' - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... file8
-
man 5 clamd.conf - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
... signo9
-
Remember to - initialize the virus counter variable with 0. - -
.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-.
-
-
-
- - Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/img1.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/img1.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/img2.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/img2.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/img3.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/img3.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/img4.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/img4.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/img5.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/img5.png differ diff -Nru clamav-0.100.3+dfsg/docs/html/index.html clamav-0.101.4+dfsg/docs/html/index.html --- clamav-0.100.3+dfsg/docs/html/index.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/index.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,228 +0,0 @@ - - - - - -clamdoc - - - - - - - - - - - - - - - -
- -next -up -previous - -contents -
- Next: Contents -   Contents -
-
- - -

- - Image demon -
-
-
-
-
-
-
-
-

-
Clam AntiVirus 0.100.3 -
User Manual -
-
- -

- -

- - - - - -
-
-Cisco 2019-02-28 -
- - Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/next_g.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/next_g.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/next.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/next.png differ diff -Nru clamav-0.100.3+dfsg/docs/html/node10.html clamav-0.101.4+dfsg/docs/html/node10.html --- clamav-0.100.3+dfsg/docs/html/node10.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node10.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,158 +0,0 @@ - - - - - -Requirements - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Installing on shell account - Up: Installation - Previous: Installation -   Contents -
-
- - -

-
-Requirements -

- The following components are required to compile ClamAV under UNIX: - 2 -
    -
  • zlib and zlib-devel packages -
    • -
  • openssl version 0.9.8 or higher and libssl-devel packages -
    • -
  • gcc compiler suite (tested with 2.9x, 3.x and 4.x series) -
    If you are compiling with higher optimization levels - than the default one (-O2 for gcc), be aware that there - have been reports of misoptimizations. The build system of ClamAV - only checks for bugs affecting the default settings, it is your - responsibility to check that your compiler version doesn't - have any bugs. -
    • -
  • GNU make (gmake) - -
    • -
- The following packages are optional but highly recommended: - -
    -
  • bzip2 and bzip2-devel library -
    • -
  • libxml2 and libxml2-dev library -
    • -
  • check unit testing framework 3. - -
    • -
- The following packages are optional, but required for bytecode JIT support: - 4 -
    -
  • GCC C and C++ compilers (minimum 4.1.3, recommended 4.3.4 or newer) -
    -the package for these compilers are usually called: gcc, g++, or gcc-c++. - 5 -
    • -
  • OSX Xcode versions prior to 5.0 use a g++ compiler frontend (llvm-gcc) that is not - compatible with ClamAV JIT. It is recommended to either compile ClamAV JIT with - clang++ or to compile ClamAV without JIT. -
    • -
  • A supported CPU for the JIT, either of: X86, X86-64, PowerPC, PowerPC64 - -
    • -
- The following packages are optional, but needed for the JIT unit tests: - -
    -
  • GNU Make (version 3.79, recommended 3.81) -
    • -
  • Python (version 2.5.4 or newer), for running the JIT unit tests - -
    • -
- The following packages are optional, but required for clamsubmit: - -
    -
  • libcurl-devel library -
    • -
  • libjson-c-dev library - -
    • -
- -

- -

- - -next - -up - -previous - -contents -
- Next: Installing on shell account - Up: Installation - Previous: Installation -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node11.html clamav-0.101.4+dfsg/docs/html/node11.html --- clamav-0.100.3+dfsg/docs/html/node11.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node11.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Installing on shell account - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Adding new system user - Up: Installation - Previous: Requirements -   Contents -
-
- - -

-Installing on shell account -

- To install ClamAV locally on an unprivileged shell account you need not - create any additional users or groups. Assuming your home directory is - /home/gary you should build it as follows: - 
-	$ ./configure --prefix=/home/gary/clamav --disable-clamav
-	$ make; make install
-
- To test your installation execute: - 
-	$ ~/clamav/bin/freshclam
-	$ ~/clamav/bin/clamscan ~
-
- The --disable-clamav switch disables the check for existence of - the clamav user and group but clamscan would still require an - unprivileged account to work in a superuser mode. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node12.html clamav-0.101.4+dfsg/docs/html/node12.html --- clamav-0.100.3+dfsg/docs/html/node12.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node12.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,74 +0,0 @@ - - - - - -Adding new system user and group - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Compilation of base package - Up: Installation - Previous: Installing on shell account -   Contents -
-
- - -

-Adding new system user and group -

- If you are installing ClamAV for the first time, you have to add a new - user and group to your system: - 
-	# groupadd clamav
-	# useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
-
- Consult a system manual if your OS has not groupadd and - useradd utilities. Don't forget to lock access to the - account! - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node13.html clamav-0.101.4+dfsg/docs/html/node13.html --- clamav-0.100.3+dfsg/docs/html/node13.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node13.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Compilation of base package - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Compilation with clamav-milter enabled - Up: Installation - Previous: Adding new system user -   Contents -
-
- - -

-Compilation of base package -

- Once you have created the clamav user and group, please extract the archive: - 
-	$ zcat clamav-x.yz.tar.gz | tar xvf -
-	$ cd clamav-x.yz
-
- Assuming you want to install the configuration files in /etc, configure - and build the software as follows: - 
-	$ ./configure --sysconfdir=/etc
-	$ make
-	$ su -c "make install"
-
- In the last step the software is installed into the /usr/local directory - and the config files into /etc. WARNING: Never enable the SUID - or SGID bits for Clam AntiVirus binaries. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node14.html clamav-0.101.4+dfsg/docs/html/node14.html --- clamav-0.100.3+dfsg/docs/html/node14.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node14.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,71 +0,0 @@ - - - - - -Compilation with clamav-milter enabled - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Using the system LLVM - Up: Installation - Previous: Compilation of base package -   Contents -
-
- - -

-Compilation with clamav-milter enabled -

- libmilter and its development files are required. To enable clamav-milter, - configure ClamAV with - 
-	$ ./configure --enable-milter
-
- See section /refsec:clamavmilter for more details on clamav-milter. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node15.html clamav-0.101.4+dfsg/docs/html/node15.html --- clamav-0.100.3+dfsg/docs/html/node15.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node15.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,83 +0,0 @@ - - - - - -Using the system LLVM - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Running unit tests - Up: Installation - Previous: Compilation with clamav-milter enabled -   Contents -
-
- - -

-Using the system LLVM -

- Some problems have been reported when compiling ClamAV's built-in LLVM with recent - C++ compiler releases. These problems may be avoided by installing and using - an external LLVM system library. To configure ClamAV to use LLVM that is installed - as a system library instead of the built-in LLVM JIT, use following: - 
-	$ ./configure --with-system-llvm=/myllvm/bin/llvm-config
-	$ make
-	$ sudo make install
-
- The argument to --with-system-llvm is optional, indicating the path name of - the LLVM configuration utility (llvm-config). With no argument to --with-system-llvm, - ./configure will search for LLVM in /usr/local/ and then /usr. - -
-
-Recommended versions of LLVM are 3.2, 3.3, 3.4, 3.5, and 3.6. Some installations have - reported problems using earlier LLVM versions. Versions of LLVM beyond 3.6 are not - currently supported in ClamAV. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node16.html clamav-0.101.4+dfsg/docs/html/node16.html --- clamav-0.100.3+dfsg/docs/html/node16.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node16.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,147 +0,0 @@ - - - - - -Running unit tests - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Reporting a unit test - Up: Installation - Previous: Using the system LLVM -   Contents -
-
- - -

-
-Running unit tests -

- ClamAV includes unit tests that allow you to test that the compiled binaries work correctly on your platform. - -
-
-The first step is to use your OS's package manager to install the check package. - If your OS doesn't have that package, you can download it from http://check.sourceforge.net/, - build it and install it. - -
-
-To help clamav's configure script locate check, it is recommended that you install pkg-config, preferably - using your OS's package manager, or from http://pkg-config.freedesktop.org. - -
-
-The recommended way to run unit-tests is the following, which ensures you will get an error if unit tests cannot be built: - 6 
-	 $ ./configure --enable-check
-	 $ make
-	 $ make check
-
- When make check is finished, you should get a message similar to this: - 
-==================
-All 8 tests passed
-==================
-
- If a unit test fails, you get a message similar to the following. - Note that in older versions of make check may report failures due to - the absence of optional packages. Please make sure you have the - latest versions of the components noted in section /refsec:components. - See the next section on how to report a bug when a unit test fails. - 
-========================================
-1 of 8 tests failed
-Please report to https://bugzilla.clamav.net/
-========================================
-
- If unit tests are disabled (and you didn't use -enable-check), you will get this message: - 
-*** Unit tests disabled in this build
-*** Use ./configure --enable-check to enable them
-
-SKIP: check_clamav
-PASS: check_clamd.sh
-PASS: check_freshclam.sh
-PASS: check_sigtool.sh
-PASS: check_clamscan.sh
-======================
-All 4 tests passed
-(1 tests were not run)
-======================
-
- Running ./configure --enable-check should tell you why. - -

- -

- - -next - -up - -previous - -contents -
- Next: Reporting a unit test - Up: Installation - Previous: Using the system LLVM -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node17.html clamav-0.101.4+dfsg/docs/html/node17.html --- clamav-0.100.3+dfsg/docs/html/node17.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node17.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,101 +0,0 @@ - - - - - -Reporting a unit test failure bug - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Obtain Latest ClamAV anti-virus - Up: Installation - Previous: Running unit tests -   Contents -
-
- - -

-Reporting a unit test failure bug -

- If make check says that some tests failed we encourage you to report a bug on our bugzilla: https://bugzilla.clamav.net. - The information we need is: - -
    -
  • The exact output from make check -
    • -
  • Output of uname -mrsp -
    • -
  • your config.log -
    • -
  • The following files from the unit_tests/ directory: - -
      -
    • test.log -
      • -
    • clamscan.log -
      • -
    • clamdscan.log - -
      • -
    -
    • -
  • /tmp/clamd-test.log if it exists -
    • -
  • where and how you installed the check package -
    • -
  • Output of pkg-config check --cflags --libs -
    • -
  • Optionally if valgrind is available on your platform, the output of the following: - 
    -$ make check
-$ CK_FORK=no ./libtool --mode=execute valgrind unit_tests/check_clamav
-
    -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node18.html clamav-0.101.4+dfsg/docs/html/node18.html --- clamav-0.100.3+dfsg/docs/html/node18.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node18.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,92 +0,0 @@ - - - - - -Obtain Latest ClamAV anti-virus signature databases - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Configuration - Up: Installation - Previous: Reporting a unit test -   Contents -
-
- - -

-Obtain Latest ClamAV anti-virus signature databases -

- Before you can run ClamAV in daemon mode (clamd), 'clamdscan', - or 'clamscan' which is ClamAV's command line virus scanner, - you must have ClamAV Virus Database (.cvd) file(s) installed - in the appropriate location on your system. The default - location for these database files are /usr/local/share/clamav - (in Linux/Unix). - -
-
-Here is a listing of currently available ClamAV Virus Database Files: - -
    -
  • bytecode.cvd (signatures to detect bytecode in files) -
    • -
  • main.cvd (main ClamAV virus database file) -
    • -
  • daily.cvd (daily update file for ClamAV virus databases) -
    • -
  • safebrowsing.cvd (virus signatures for safe browsing) - -
    • -
- These files can be downloaded via HTTP from the main ClamAV website - or via the 'freshclam' utility on a periodic basis. Using 'freshclam' - is the preferred method of keeping the ClamAV virus database files - up to date without manual intervention (see section [*] for - information on how to configure 'freshclam' for automatic updating and section - [*] for additional details on freshclam). - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node19.html clamav-0.101.4+dfsg/docs/html/node19.html --- clamav-0.100.3+dfsg/docs/html/node19.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node19.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,92 +0,0 @@ - - - - - -Configuration - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: clamd - Up: clamdoc - Previous: Obtain Latest ClamAV anti-virus -   Contents -
-
- - -

-Configuration -

- Before proceeding with the steps below, you should - run the 'clamconf' command, which gives important information - about your ClamAV configuration. See section [*] - for more details. - -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node1.html clamav-0.101.4+dfsg/docs/html/node1.html --- clamav-0.100.3+dfsg/docs/html/node1.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node1.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,194 +0,0 @@ - - - - - -Contents - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous -
- Next: Introduction - Up: clamdoc - Previous: clamdoc -
-
- -
- -

-Contents -

- - - -
-
-
- -

- -
-\begin{boxedminipage}[b]{\textwidth} -ClamAV User Manual, -87d -88d -89d -\copyrigh... -... Franklin Street, Fifth Floor, Boston, -MA 02110-1301, USA. -\end{boxedminipage} -
- -

-
-
- -
-\begin{boxedminipage}[b]{\textwidth} -ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc. -\end{boxedminipage} -
- -

- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node20.html clamav-0.101.4+dfsg/docs/html/node20.html --- clamav-0.100.3+dfsg/docs/html/node20.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node20.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,84 +0,0 @@ - - - - - -clamd - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: On-access scanning - Up: Configuration - Previous: Configuration -   Contents -
-
- - -

-clamd -

- Before you start using the daemon you have to edit the configuration file - (in other case clamd won't run): - 
-	$ clamd
-	ERROR: Please edit the example config file /etc/clamd.conf.
-
- This shows the location of the default configuration file. The format and - options of this file are fully described in the clamd.conf(5) - manual. The config file is well commented and configuration should be - straightforward. - -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node21.html clamav-0.101.4+dfsg/docs/html/node21.html --- clamav-0.100.3+dfsg/docs/html/node21.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node21.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,73 +0,0 @@ - - - - - -On-access scanning - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: clamav-milter - Up: clamd - Previous: clamd -   Contents -
-
- - -

-On-access scanning -

- One of the interesting features of clamd is on-access scanning - based on fanotify, included in Linux since kernel 2.6.36. - This is not required to run clamd. At the moment the fanotify header is - only available for Linux. - -
-
-Configure on-access scanning in clamd.conf and read the - [*] section for on-access scanning usage. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node22.html clamav-0.101.4+dfsg/docs/html/node22.html --- clamav-0.100.3+dfsg/docs/html/node22.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node22.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,97 +0,0 @@ - - - - - -clamav-milter - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Testing - Up: Configuration - Previous: On-access scanning -   Contents -
-
- - -

-
-clamav-milter -

- ClamAV $\ge0.95$ includes a new, redesigned clamav-milter. The most notable - difference is that the internal mode has been dropped and now a working - clamd companion is required. The second important difference is that now - the milter has got its own configuration and log files. - -
-
-To compile ClamAV with the clamav-milter just run ./configure - --enable-milter and make as usual. In order to use the - '-enable-milter' option with 'configure', your system MUST have the milter - library installed. If you use the '-enable-milter' option without the - library being installed, you will most likely see output like this during - 'configure': - 
-        checking for libiconv_open in -liconv... no
-        checking for iconv... yes
-        checking whether in_port_t is defined... yes
-        checking for in_addr_t definition... yes
-        checking for mi_stop in -lmilter... no
-        checking for library containing strlcpy... no
-        checking for mi_stop in -lmilter... no
-        configure: error: Cannot find libmilter
-
- At which point the 'configure' script will stop processing. - -
-
-Please consult your MTA's manual on how to connect ClamAV with the milter. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node23.html clamav-0.101.4+dfsg/docs/html/node23.html --- clamav-0.100.3+dfsg/docs/html/node23.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node23.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Testing - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Setting up auto-updating - Up: Configuration - Previous: clamav-milter -   Contents -
-
- - -

-Testing -

- Try to scan recursively the source directory: - 
-	$ clamscan -r -l scan.txt clamav-x.yz
-
- It should find some test files in the clamav-x.yz/test directory. - The scan result will be saved in the scan.txt log file - 7. - To test clamd, start it and use clamdscan (or instead connect - directly to its socket and run the SCAN command): - 
-	$ clamdscan -l scan.txt clamav-x.yz
-
- Please note that the scanned files must be accessible by the user running - clamd or you will get an error. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node24.html clamav-0.101.4+dfsg/docs/html/node24.html --- clamav-0.100.3+dfsg/docs/html/node24.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node24.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,145 +0,0 @@ - - - - - -Setting up auto-updating - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Closest mirrors - Up: Configuration - Previous: Testing -   Contents -
-
- - -

-
-Setting up auto-updating -

- freshclam is the automatic database update tool for Clam AntiVirus. - It can work in two modes: - -
    -
  • interactive - on demand from command line -
    • -
  • daemon - silently in the background - -
    • -
- freshclam is advanced tool: it supports scripted updates (instead - of transferring the whole CVD file at each update it only transfers the - differences between the latest and the current database via a special - script), database version checks through DNS, proxy servers (with - authentication), digital signatures and various error scenarios. - Quick test: run freshclam (as superuser) with no parameters - and check the output. If everything is OK you may create the log file in - /var/log (owned by clamav or another user freshclam will be - running as): - 
-	# touch /var/log/freshclam.log
-	# chmod 600 /var/log/freshclam.log
-	# chown clamav /var/log/freshclam.log
-
- Now you should edit the configuration file freshclam.conf - and point the UpdateLogFile directive to the log file. Finally, to - run freshclam in the daemon mode, execute: - 
-	# freshclam -d
-
- The other way is to use the cron daemon. You have to add the - following line to the crontab of root or clamav user: - 
-N * * * *	/usr/local/bin/freshclam --quiet
-
- to check for a new database every hour. N should be a - number between 3 and 57 of your choice. Please don't choose any multiple - of 10, because there are already too many clients using those time slots. - Proxy settings are only configurable via the configuration file and - freshclam will require strict permission settings for the config - file when HTTPProxyPassword is turned on. - 
-	HTTPProxyServer myproxyserver.com
-	HTTPProxyPort 1234
-	HTTPProxyUsername myusername
-	HTTPProxyPassword mypass
-
- -

-

- -Subsections - - - - -
- - -next - -up - -previous - -contents -
- Next: Closest mirrors - Up: Configuration - Previous: Testing -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node25.html clamav-0.101.4+dfsg/docs/html/node25.html --- clamav-0.100.3+dfsg/docs/html/node25.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node25.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,82 +0,0 @@ - - - - - -Closest mirrors - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Usage - Up: Setting up auto-updating - Previous: Setting up auto-updating -   Contents -
-
- - -

-Closest mirrors -

- The DatabaseMirror directive in the config file specifies the - database server freshclam will attempt (up to MaxAttempts - times) to download the database from. The default database mirror - is database.clamav.net but multiple directives are allowed. - In order to download the database from the closest mirror you should - configure freshclam to use db.xx.clamav.net where xx - represents your country code. For example, if your server is in "Ascension - Island" you should have the following lines included in freshclam.conf: - 
-	DNSDatabaseInfo current.cvd.clamav.net
-	DatabaseMirror db.ac.clamav.net
-	DatabaseMirror database.clamav.net
-
- The second entry acts as a fallback in case the connection to the first - mirror fails for some reason. The full list of two-letters country codes - is available at http://www.iana.org/cctld/cctld-whois.htm -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node26.html clamav-0.101.4+dfsg/docs/html/node26.html --- clamav-0.100.3+dfsg/docs/html/node26.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node26.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,95 +0,0 @@ - - - - - -Usage - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Clam daemon - Up: clamdoc - Previous: Closest mirrors -   Contents -
-
- - -

-Usage -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node27.html clamav-0.101.4+dfsg/docs/html/node27.html --- clamav-0.100.3+dfsg/docs/html/node27.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node27.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,241 +0,0 @@ - - - - - -Clam daemon - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Clamdscan - Up: Usage - Previous: Usage -   Contents -
-
- - -

-
-Clam daemon -

- clamd is a multi-threaded daemon that uses libclamav - to scan files for viruses. It may work in one or both modes listening on: - -
    -
  • Unix (local) socket -
    • -
  • TCP socket - -
    • -
- The daemon is fully configurable via the clamd.conf file - 8. clamd recognizes the following commands: - -
    -
  • PING -
    -Check the daemon's state (should reply with "PONG"). -
    • -
  • VERSION -
    -Print program and database versions. -
    • -
  • RELOAD -
    -Reload the databases. -
    • -
  • SHUTDOWN -
    -Perform a clean exit. -
    • -
  • SCAN file/directory -
    -Scan file or directory (recursively) with archive support - enabled (a full path is required). -
    • -
  • RAWSCAN file/directory -
    -Scan file or directory (recursively) with archive and special file - support disabled (a full path is required). -
    • -
  • CONTSCAN file/directory -
    -Scan file or directory (recursively) with archive support - enabled and don't stop the scanning when a virus is found. -
    • -
  • MULTISCAN file/directory -
    -Scan file in a standard way or scan directory (recursively) using - multiple threads (to make the scanning faster on SMP machines). -
    • -
  • ALLMATCHSCAN file/directory -
    -ALLMATCHSCAN works just like SCAN except that it sets a mode - where, after finding a virus within a file, continues scanning for - additional viruses. -
    • -
  • INSTREAM -
    It is mandatory to prefix this command with n or - z. -
    -Scan a stream of data. The stream is sent to clamd in chunks, - after INSTREAM, on the same socket on which the command - was sent. This avoids the overhead of establishing new TCP - connections and problems with NAT. The format of the chunk is: - <length><data> where <length> is the size of the - following data in bytes expressed as a 4 byte unsigned integer in - network byte order and <data> is the actual chunk. Streaming - is terminated by sending a zero-length chunk. Note: do not exceed - StreamMaxLength as defined in clamd.conf, otherwise clamd will - reply with INSTREAM size limit exceeded and close the - connection. -
    • -
  • FILDES -
    It is mandatory to newline terminate this command, or prefix - with n or z. This command only works on UNIX - domain sockets. -
    -Scan a file descriptor. After issuing a FILDES command a subsequent - rfc2292/bsd4.4 style packet (with at least one dummy character) is - sent to clamd carrying the file descriptor to be scanned inside the - ancillary data. Alternatively the file descriptor may be sent in - the same packet, including the extra character. -
    • -
  • STATS -
    It is mandatory to newline terminate this command, or prefix - with n or z, it is recommended to only use the - z prefix. -
    -On this command clamd provides statistics about the scan queue, - contents of scan queue, and memory usage. The exact reply format is - subject to changes in future releases. -
    • -
  • IDSESSION, END -
    It is mandatory to prefix this command with n or - z, also all commands inside IDSESSION must be - prefixed. -
    -Start/end a clamd session. Within a session multiple - SCAN, INSTREAM, FILDES, VERSION, STATS commands can be sent on the - same socket without opening new connections. Replies from clamd - will be in the form <id>: <response> where <id> is - the request number (in ASCII, starting from 1) and <response> - is the usual clamd reply. The reply lines have the same delimiter - as the corresponding command had. Clamd will process the commands - asynchronously, and reply as soon as it has finished processing. - Clamd requires clients to read all the replies it sent, before - sending more commands to prevent send() deadlocks. The recommended - way to implement a client that uses IDSESSION is with non-blocking - sockets, and a select()/poll() loop: whenever send would block, - sleep in select/poll until either you can write more data, or read - more replies. Note that using non-blocking sockets without - the select/poll loop and alternating recv()/send() doesn't comply - with clamd's requirements. If clamd detects that a client has - deadlocked, it will close the connection. Note that clamd may - close an IDSESSION connection too if the client doesn't follow the - protocol's requirements. -
    • -
  • STREAM (deprecated, use INSTREAM instead) -
    -Scan stream: clamd will return a new port number you should - connect to and send data to scan. - -
    • -
- It's recommended to prefix clamd commands with the letter z - (eg. zSCAN) to indicate that the command will be delimited by a NULL - character and that clamd should continue reading command data until a NULL - character is read. The null delimiter assures that the complete command - and its entire argument will be processed as a single command. Alternatively - commands may be prefixed with the letter n (e.g. nSCAN) to use - a newline character as the delimiter. Clamd replies will honour the - requested terminator in turn. If clamd doesn't recognize the command, or - the command doesn't follow the requirements specified below, it will reply - with an error message, and close the connection. - - Clamd can handle the following signals: - -
    -
  • SIGTERM - perform a clean exit -
    • -
  • SIGHUP - reopen the log file -
    • -
  • SIGUSR2 - reload the database - -
    • -
- Clamd should not be started in the background using the shell operator - & or external tools. Instead, you should run and wait for clamd - to load the database and daemonize itself. After that, clamd is instantly - ready to accept connections and perform file scanning. - -

- -

- - -next - -up - -previous - -contents -
- Next: Clamdscan - Up: Usage - Previous: Usage -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node28.html clamav-0.101.4+dfsg/docs/html/node28.html --- clamav-0.100.3+dfsg/docs/html/node28.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node28.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,81 +0,0 @@ - - - - - -Clamdscan - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: On-access Scanning - Up: Usage - Previous: Clam daemon -   Contents -
-
- - -

-Clamdscan -

- clamdscan is a simple clamd client. In many cases you can - use it as a clamscan replacement however you must remember that: - -
    -
  • it only depends on clamd -
    • -
  • although it accepts the same command line options as - clamscan most of them are ignored because they must be - enabled directly in clamd, i.e. clamd.conf -
    • -
  • in TCP mode scanned files must be accessible for clamd, - if you enabled LocalSocket in clamd.conf then clamdscan will - try to workaround this limitation by using FILDES - -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node29.html clamav-0.101.4+dfsg/docs/html/node29.html --- clamav-0.100.3+dfsg/docs/html/node29.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node29.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,150 +0,0 @@ - - - - - -On-access Scanning - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Clamdtop - Up: Usage - Previous: Clamdscan -   Contents -
-
- - -

-
-On-access Scanning -

- There is a special thread in clamd that performs on-access - scanning under Linux and shares internal virus database - with the daemon. By default, this thread will only notify you when - potential threats are discovered. If you turn on prevention via - clamd.conf then you must follow some important rules when - using it: - -
    -
  • Always stop the daemon cleanly - using the SHUTDOWN command or - the -
    -SIGTERM signal. In other case you can lose access - to protected files until the system is restarted. -
    • -
  • Never protect the directory your mail-scanner software - uses for attachment unpacking. Access to all infected - files will be automatically blocked and the scanner (including - clamd!) will not be able to detect any viruses. In the - result all infected mails may be delivered. -
    • -
  • Watch your entire filesystem only using the clamd.conf - OnAccessMountPath option. While this will disable on-access prevention, - it will avoid potential system lockups caused by fanotify's blocking - functionality. -
    • -
  • Using the On-Access Scanner to watch a virtual filesystem will result - in undefined behaviour. - -
    • -
- The default configuration utilizes inotify to recursively keep track of - directories. If you need to protect more than 8192 directories it will - be necessary to change inotify's max_user_watches value. - -
-
-This can be done temporarily with: - 
-    $ sysctl fs.inotify.max_user_watches=<n>
-
- Where <n> is the new maximum desired. - -
-
-To watch your entire filesystem add the following lines to - clamd.conf: - 
-	ScanOnAccess yes
-	OnAccessMountPath /
-
- Similarly, to protect your home directory add the following lines to - clamd.conf: - 
-	ScanOnAccess yes
-	OnAccessIncludePath /home
-	OnAccessExcludePath /home/user/temp/dir/of/your/mail/scanning/software
-	OnAccessPrevention yes
-
- For more configuration options, type 'man clamd.conf' or reference the - example clamd.conf. - -

- -

- - -next - -up - -previous - -contents -
- Next: Clamdtop - Up: Usage - Previous: Clamdscan -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node2.html clamav-0.101.4+dfsg/docs/html/node2.html --- clamav-0.100.3+dfsg/docs/html/node2.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node2.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,84 +0,0 @@ - - - - - -Introduction - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Features - Up: clamdoc - Previous: Contents -   Contents -
-
- - -

-Introduction -

- Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, - designed especially for e-mail scanning on mail gateways. It provides - a number of utilities including a flexible and scalable multi-threaded - daemon, a command line scanner and advanced tool for automatic database - updates. The core of the package is an anti-virus engine available in a - form of shared library. - -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node30.html clamav-0.101.4+dfsg/docs/html/node30.html --- clamav-0.100.3+dfsg/docs/html/node30.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node30.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,75 +0,0 @@ - - - - - -Clamdtop - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Clamscan - Up: Usage - Previous: On-access Scanning -   Contents -
-
- - -

-Clamdtop -

- clamdtop is a tool to monitor one or multiple instances of clamd. It - has a (color) ncurses interface, that shows the jobs in clamd's queue, - memory usage, and information about the loaded signature database. - You can specify on the command-line to which clamd(s) it should connect - to. By default it will attempt to connect to the local clamd as defined - in clamd.conf. - -
-
-For more detailed help, type 'man clamdtop' or 'clamdtop -help'. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node31.html clamav-0.101.4+dfsg/docs/html/node31.html --- clamav-0.100.3+dfsg/docs/html/node31.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node31.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,77 +0,0 @@ - - - - - -Clamscan - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: ClamBC - Up: Usage - Previous: Clamdtop -   Contents -
-
- - -

-Clamscan -

- clamscan is ClamAV's command line virus scanner. It can be used to - scan files and/or directories for viruses. In order for clamscan - to work proper, the ClamAV virus database files must be installed on - the system you are using clamscan on. - -
-
-The general usage of clamscan is: clamscan [options] [file/directory/-] - -
-
-For more detailed help, type 'man clamscan' or 'clamscan -help'. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node32.html clamav-0.101.4+dfsg/docs/html/node32.html --- clamav-0.100.3+dfsg/docs/html/node32.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node32.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,68 +0,0 @@ - - - - - -ClamBC - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Freshclam - Up: Usage - Previous: Clamscan -   Contents -
-
- - -

-ClamBC -

- clambc is Clam Anti-Virus' bytecode testing tool. It can be - used to test files which contain bytecode. For more detailed help, - type 'man clambc' or 'clambc -help'. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node33.html clamav-0.101.4+dfsg/docs/html/node33.html --- clamav-0.100.3+dfsg/docs/html/node33.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node33.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,91 +0,0 @@ - - - - - -Freshclam - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Clamconf - Up: Usage - Previous: ClamBC -   Contents -
-
- - -

-
-Freshclam -

- freshclam is ClamAV's virus database update tool and reads it's - configuration from the file 'freshclam.conf' (this may be - overridden by command line options). Freshclam's default behavior is to - attempt to update databases that are paired with downloaded cdiffs. - Potentially corrupted databases are not updated and are automatically - fully replaced after several failed attempts unless otherwise specified. - -
-
-Here is a sample usage including cdiffs: - 
-$ freshclam
-
-ClamAV update process started at Mon Oct  7 08:15:10 2013
-main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo)
-Downloading daily-17945.cdiff [100%]
-Downloading daily-17946.cdiff [100%]
-Downloading daily-17947.cdiff [100%]
-daily.cld updated (version: 17947, sigs: 406951, f-level: 63, builder: neo)
-Downloading bytecode-227.cdiff [100%]
-Downloading bytecode-228.cdiff [100%]
-bytecode.cld updated (version: 228, sigs: 43, f-level: 63, builder: neo)
-Database updated (2831219 signatures) from database.clamav.net (IP: 64.6.100.177)
-
- For more detailed help, type 'man clamscan' or 'clamscan -help'. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node34.html clamav-0.101.4+dfsg/docs/html/node34.html --- clamav-0.100.3+dfsg/docs/html/node34.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node34.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,121 +0,0 @@ - - - - - -Clamconf - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Output format - Up: Usage - Previous: Freshclam -   Contents -
-
- - -

-
-Clamconf -

- clamconf is the Clam Anti-Virus configuration utility. It is used - for displaying values of configurations options in ClamAV, which - will show the contents of clamd.conf (or tell you if it is not - properly configured), the contents of freshclam.conf, and display - information about software settings, database, platform, and build - information. Here is a sample clamconf output: - 
-$ clamconf
-
-Checking configuration files in /etc/clamav
-
-Config file: clamd.conf
------------------------
-ERROR: Please edit the example config file /etc/clamav/clamd.conf
-
-Config file: freshclam.conf
----------------------------
-ERROR: Please edit the example config file /etc/clamav/freshclam.conf
-
-clamav-milter.conf not found
-
-Software settings
------------------
-Version: 0.98.2
-Optional features supported: MEMPOOL IPv6 AUTOIT_EA06 BZIP2 RAR JIT
-
-Database information
---------------------
-Database directory: /xclam/gcc/release/share/clamav
-WARNING: freshclam.conf and clamd.conf point to different database directories
-print_dbs: Can't open directory /xclam/gcc/release/share/clamav
-
-Platform information
---------------------
-uname: Linux 3.5.0-44-generic #67~precise1-Ubuntu SMP Wed Nov 13 16:20:03 UTC 2013 i686
-OS: linux-gnu, ARCH: i386, CPU: i686
-Full OS version: Ubuntu 12.04.3 LTS
-zlib version: 1.2.3.4 (1.2.3.4), compile flags: 55
-Triple: i386-pc-linux-gnu
-CPU: i686, Little-endian
-platform id: 0x0a114d4d0404060401040604
-
-Build information
------------------
-GNU C: 4.6.4 (4.6.4)
-GNU C++: 4.6.4 (4.6.4)
-CPPFLAGS:
-CFLAGS: -g -O0 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-CXXFLAGS:
-LDFLAGS:
-Configure: '--prefix=/xclam/gcc/release/' '--disable-clamav' '--enable-debug' 'CFLAGS=-g -O0'
-sizeof(void*) = 4
-Engine flevel: 77, dconf: 77
-
- For more detailed help, type 'man clamconf' or 'clamconf -help'. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node35.html clamav-0.101.4+dfsg/docs/html/node35.html --- clamav-0.100.3+dfsg/docs/html/node35.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node35.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,75 +0,0 @@ - - - - - -Output format - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: clamscan - Up: Usage - Previous: Clamconf -   Contents -
-
- - -

-Output format -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node36.html clamav-0.101.4+dfsg/docs/html/node36.html --- clamav-0.100.3+dfsg/docs/html/node36.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node36.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,86 +0,0 @@ - - - - - -clamscan - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: clamd - Up: Output format - Previous: Output format -   Contents -
-
- - -

-clamscan -

- clamscan writes all regular program messages to stdout and - errors/warnings to stderr. You can use the option --stdout - to redirect all program messages to stdout. Warnings and error - messages from libclamav are always printed to stderr. - A typical output from clamscan looks like this: - 
-	/tmp/test/removal-tool.exe: Worm.Sober FOUND
-	/tmp/test/md5.o: OK
-	/tmp/test/blob.c: OK
-	/tmp/test/message.c: OK
-	/tmp/test/error.hta: VBS.Inor.D FOUND
-
- When a virus is found its name is printed between the filename: and - FOUND strings. In case of archives the scanner depends on libclamav - and only prints the first virus found within an archive: - 
-	$ clamscan malware.zip 
-	malware.zip: Worm.Mydoom.U FOUND
-
- When using the -allmatch(-z) flag, clamscan may print multiple virus - FOUND lines for archives and files. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node37.html clamav-0.101.4+dfsg/docs/html/node37.html --- clamav-0.100.3+dfsg/docs/html/node37.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node37.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,88 +0,0 @@ - - - - - -clamd - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: LibClamAV - Up: Output format - Previous: clamscan -   Contents -
-
- - -

-clamd -

- The output format of clamd is very similar to clamscan. - 
-	$ telnet localhost 3310
-	Trying 127.0.0.1...
-	Connected to localhost.
-	Escape character is '^]'.
-	SCAN /home/zolw/test
-	/home/zolw/test/clam.exe: ClamAV-Test-File FOUND
-	Connection closed by foreign host.
-
- In the SCAN mode it closes the connection when the first virus - is found. - 
-	SCAN /home/zolw/test/clam.zip
-	/home/zolw/test/clam.zip: ClamAV-Test-File FOUND
-
- CONTSCAN and MULTISCAN don't stop scanning in case - a virus is found. -
-Error messages are printed in the following format: - 
-	SCAN /no/such/file
-	/no/such/file: Can't stat() the file. ERROR
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node38.html clamav-0.101.4+dfsg/docs/html/node38.html --- clamav-0.100.3+dfsg/docs/html/node38.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node38.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,129 +0,0 @@ - - - - - -LibClamAV - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: License - Up: clamdoc - Previous: clamd -   Contents -
-
- - -

-LibClamAV -

- Libclamav provides an easy and effective way to add a virus protection into - your software. The library is thread-safe and transparently recognizes and - scans within archives, mail files, MS Office document files, executables - and other special formats. - -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node39.html clamav-0.101.4+dfsg/docs/html/node39.html --- clamav-0.100.3+dfsg/docs/html/node39.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node39.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,68 +0,0 @@ - - - - - -License - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Supported formats and features - Up: LibClamAV - Previous: LibClamAV -   Contents -
-
- - -

-License -

- Libclamav is licensed under the GNU GPL v2 license. This means you are - not allowed to link commercial, closed-source software - against it. All software using libclamav must be GPL compliant. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node3.html clamav-0.101.4+dfsg/docs/html/node3.html --- clamav-0.100.3+dfsg/docs/html/node3.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node3.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,222 +0,0 @@ - - - - - -Features - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Mailing lists and IRC - Up: Introduction - Previous: Introduction -   Contents -
-
- - -

-Features -

- -

- -

    -
  • Licensed under the GNU General Public License, Version 2 -
    • -
  • POSIX compliant, portable -
    • -
  • Fast scanning -
    • -
  • Supports on-access scanning (Linux only) -
    • -
  • Detects over 1 million viruses, worms and trojans, including - Microsoft Office macro viruses, mobile malware, and other threats -
    • -
  • Built-in bytecode interpreter allows the ClamAV signature writers - to create and distribute very complex detection routines and - remotely enhance the scanner's functionality -
    • -
  • Scans within archives and compressed files (also protects - against archive bombs), built-in support includes: - -
      -
    • Zip (including SFX) -
      • -
    • RAR (including SFX) -
      • -
    • 7Zip -
      • -
    • ARJ (including SFX) -
      • -
    • Tar -
      • -
    • CPIO -
      • -
    • Gzip -
      • -
    • Bzip2 -
      • -
    • DMG -
      • -
    • IMG -
      • -
    • ISO 9660 -
      • -
    • PKG -
      • -
    • HFS+ partition -
      • -
    • HFSX partition -
      • -
    • APM disk image -
      • -
    • GPT disk image -
      • -
    • MBR disk image -
      • -
    • XAR -
      • -
    • XZ -
      • -
    • MS OLE2 -
      • -
    • MS Cabinet Files (including SFX) -
      • -
    • MS CHM (Compiled HTML) -
      • -
    • MS SZDD compression format -
      • -
    • BinHex -
      • -
    • SIS (SymbianOS packages) -
      • -
    • AutoIt -
      • -
    • InstallShield - -
      • -
    -
    • -
  • Supports Portable Executable (32/64-bit) files compressed or obfuscated with: - -
      -
    • AsPack -
      • -
    • UPX -
      • -
    • FSG -
      • -
    • Petite -
      • -
    • PeSpin -
      • -
    • NsPack -
      • -
    • wwpack32 -
      • -
    • MEW -
      • -
    • Upack -
      • -
    • Y0da Cryptor - -
      • -
    -
    • -
  • Supports ELF and Mach-O files (both 32- and 64-bit) -
    • -
  • Supports almost all mail file formats -
    • -
  • Support for other special files/formats includes: - -
      -
    • HTML -
      • -
    • RTF -
      • -
    • PDF -
      • -
    • Files encrypted with CryptFF and ScrEnc -
      • -
    • uuencode -
      • -
    • TNEF (winmail.dat) - -
      • -
    -
    • -
  • Advanced database updater with support for scripted updates, - digital signatures and DNS based database version queries - -
    • -
- -

- -

- - -next - -up - -previous - -contents -
- Next: Mailing lists and IRC - Up: Introduction - Previous: Introduction -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node40.html clamav-0.101.4+dfsg/docs/html/node40.html --- clamav-0.100.3+dfsg/docs/html/node40.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node40.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,84 +0,0 @@ - - - - - -Supported formats and features - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Executables - Up: LibClamAV - Previous: License -   Contents -
-
- - -

-Supported formats and features -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node41.html clamav-0.101.4+dfsg/docs/html/node41.html --- clamav-0.100.3+dfsg/docs/html/node41.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node41.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,92 +0,0 @@ - - - - - -Executables - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Mail files - Up: Supported formats and features - Previous: Supported formats and features -   Contents -
-
- - -

-Executables -

- The library has a built-in support for 32- and 64-bit Portable Executable, - ELF and Mach-O files. Additionally, it can handle PE files compressed or - obfuscated with the following tools: - -
    -
  • Aspack (2.12) -
    • -
  • UPX (all versions) -
    • -
  • FSG (1.3, 1.31, 1.33, 2.0) -
    • -
  • Petite (2.x) -
    • -
  • PeSpin (1.1) -
    • -
  • NsPack -
    • -
  • wwpack32 (1.20) -
    • -
  • MEW -
    • -
  • Upack -
    • -
  • Y0da Cryptor (1.3) - -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node42.html clamav-0.101.4+dfsg/docs/html/node42.html --- clamav-0.100.3+dfsg/docs/html/node42.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node42.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,67 +0,0 @@ - - - - - -Mail files - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Archives and compressed files - Up: Supported formats and features - Previous: Executables -   Contents -
-
- - -

-Mail files -

- Libclamav can handle almost every mail file format including TNEF - (winmail.dat) attachments. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node43.html clamav-0.101.4+dfsg/docs/html/node43.html --- clamav-0.100.3+dfsg/docs/html/node43.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node43.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,125 +0,0 @@ - - - - - -Archives and compressed files - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Documents - Up: Supported formats and features - Previous: Mail files -   Contents -
-
- - -

-Archives and compressed files -

- The following archive and compression formats are supported by internal - handlers: - -
    -
  • Zip (+ SFX) -
    • -
  • RAR (+ SFX) -
    • -
  • 7Zip -
    • -
  • Tar -
    • -
  • CPIO -
    • -
  • Gzip -
    • -
  • Bzip2 -
    • -
  • DMG -
    • -
  • IMG -
    • -
  • ISO 9660 -
    • -
  • PKG -
    • -
  • HFS+ partition -
    • -
  • HFSX partition -
    • -
  • APM disk image -
    • -
  • GPT disk image -
    • -
  • MBR disk image -
    • -
  • XAR -
    • -
  • XZ -
    • -
  • MS OLE2 -
    • -
  • MS Cabinet Files (+ SFX) -
    • -
  • MS CHM (Compiled HTML) -
    • -
  • MS SZDD compression format -
    • -
  • BinHex -
    • -
  • SIS (SymbianOS packages) -
    • -
  • AutoIt -
    • -
  • NSIS -
    • -
  • InstallShield - -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node44.html clamav-0.101.4+dfsg/docs/html/node44.html --- clamav-0.100.3+dfsg/docs/html/node44.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node44.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,81 +0,0 @@ - - - - - -Documents - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Data Loss Prevention - Up: Supported formats and features - Previous: Archives and compressed files -   Contents -
-
- - -

-Documents -

- The most popular file formats are supported: - -
    -
  • MS Office and MacOffice files -
    • -
  • RTF -
    • -
  • PDF -
    • -
  • HTML - -
    • -
- In the case of Office, RTF and PDF files, libclamav will only extract the - embedded objects and will not decode the text data itself. The text - decoding and normalization is only performed for HTML files. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node45.html clamav-0.101.4+dfsg/docs/html/node45.html --- clamav-0.100.3+dfsg/docs/html/node45.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node45.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,75 +0,0 @@ - - - - - -Data Loss Prevention - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Others - Up: Supported formats and features - Previous: Documents -   Contents -
-
- - -

-Data Loss Prevention -

- Libclamav includes a DLP module which can detect the following - credit card issuers: AMEX, VISA, MasterCard, Discover, Diner's Club, - and JCB and U.S. social security numbers inside text files. - -
-
-Future versions of Libclamav may include additional features to - detect other credit cards and other forms of PII (Personally - Identifiable Information) which may be transmitted without the - benefit of being encrypted. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node46.html clamav-0.101.4+dfsg/docs/html/node46.html --- clamav-0.100.3+dfsg/docs/html/node46.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node46.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Others - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: API - Up: Supported formats and features - Previous: Data Loss Prevention -   Contents -
-
- - -

-Others -

- Libclamav can handle various obfuscators, encoders, files vulnerable to - security risks such as: - -
    -
  • JPEG (exploit detection) -
    • -
  • RIFF (exploit detection) -
    • -
  • uuencode -
    • -
  • ScrEnc obfuscation -
    • -
  • CryptFF - -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node47.html clamav-0.101.4+dfsg/docs/html/node47.html --- clamav-0.100.3+dfsg/docs/html/node47.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node47.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,96 +0,0 @@ - - - - - -API - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Header file - Up: LibClamAV - Previous: Others -   Contents -
-
- - -

-API -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node48.html clamav-0.101.4+dfsg/docs/html/node48.html --- clamav-0.100.3+dfsg/docs/html/node48.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node48.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,69 +0,0 @@ - - - - - -Header file - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Initialization - Up: API - Previous: API -   Contents -
-
- - -

-Header file -

- Every program using libclamav must include the header file clamav.h: - 
-	#include <clamav.h>
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node49.html clamav-0.101.4+dfsg/docs/html/node49.html --- clamav-0.100.3+dfsg/docs/html/node49.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node49.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,79 +0,0 @@ - - - - - -Initialization - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Database loading - Up: API - Previous: Header file -   Contents -
-
- - -

-Initialization -

- Before using libclamav, you should call cl_init() to initialize - it. CL_INIT_DEFAULT is a macro that can be passed to cl_init() - representing the default initialization settings. When it's done, you're ready - to create a new scan engine by calling cl_engine_new(). To free resources - allocated by the engine use cl_engine_free(). Function prototypes: - 
-	int cl_init(unsigned int options);
-	struct cl_engine *cl_engine_new(void);
-	int cl_engine_free(struct cl_engine *engine);
-
- cl_init() and cl_engine_free() return CL_SUCCESS - on success or another code on error. cl_engine_new() return - a pointer or NULL if there's not enough memory to allocate a new - engine structure. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node4.html clamav-0.101.4+dfsg/docs/html/node4.html --- clamav-0.100.3+dfsg/docs/html/node4.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node4.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,91 +0,0 @@ - - - - - -Mailing lists and IRC channel - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Virus submitting - Up: Introduction - Previous: Features -   Contents -
-
- - -

-Mailing lists and IRC channel -

- If you have a trouble installing or using ClamAV try asking on our mailing - lists. There are four lists available: - -
    -
  • clamav-announce*lists.clamav.net - info about new versions, - moderated1. -
    • -
  • clamav-users*lists.clamav.net - user questions -
    • -
  • clamav-devel*lists.clamav.net - technical discussions -
    • -
  • clamav-virusdb*lists.clamav.net - database update announcements, moderated - -
    • -
- You can subscribe and search the mailing list archives at: - https://www.clamav.net/contact.html#ml -
-Alternatively you can try asking on the #clamav IRC channel - launch - your favourite irc client and type: - 
-	/server irc.freenode.net
-	/join #clamav
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node50.html clamav-0.101.4+dfsg/docs/html/node50.html --- clamav-0.100.3+dfsg/docs/html/node50.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node50.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,130 +0,0 @@ - - - - - -Database loading - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Error handling - Up: API - Previous: Initialization -   Contents -
-
- - -

-Database loading -

- The following set of functions provides an interface for loading - the virus database: - 
-	const char *cl_retdbdir(void);
-
-	int cl_load(const char *path, struct cl_engine *engine,
-		    unsigned int *signo, unsigned int options);
-
- cl_retdbdir() returns the default (hardcoded) path to the directory - with ClamAV databases. - cl_load() loads a single database file or all databases from a - given directory (when path points to a directory). The second - argument is used for passing in the pointer to the engine that should - be previously allocated with cl_engine_new(). A number of loaded - signatures will be added to signo 9. The last argument can - pass the following flags: - -
    -
  • CL_DB_STDOPT -
    -This is an alias for a recommended set of scan options. -
    • -
  • CL_DB_PHISHING -
    -Load phishing signatures. -
    • -
  • CL_DB_PHISHING_URLS -
    -Initialize the phishing detection module and load .wdb and .pdb files. -
    • -
  • CL_DB_PUA -
    -Load signatures for Potentially Unwanted Applications. -
    • -
  • CL_DB_OFFICIAL_ONLY -
    -Only load official signatures from digitally signed databases. -
    • -
  • CL_DB_BYTECODE -
    -Load bytecode. - -
    • -
- cl_load() returns CL_SUCCESS on success and another code on - failure. - 
-	    ...
-	    struct cl_engine *engine;
-	    unsigned int sigs = 0;
-	    int ret;
-
-	if((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) {
-	    printf("cl_init() error: %s\n", cl_strerror(ret));
-	    return 1;
-	}
-
-	if(!(engine = cl_engine_new())) {
-	    printf("Can't create new engine\n");
-	    return 1;
-	}
-
-	ret = cl_load(cl_retdbdir(), engine, &sigs, CL_DB_STDOPT);
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node51.html clamav-0.101.4+dfsg/docs/html/node51.html --- clamav-0.100.3+dfsg/docs/html/node51.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node51.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,74 +0,0 @@ - - - - - -Error handling - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Engine structure - Up: API - Previous: Database loading -   Contents -
-
- - -

-Error handling -

- Use cl_strerror() to convert error codes into human readable - messages. The function returns a statically allocated string: - 
-	if(ret != CL_SUCCESS) {
-	    printf("cl_load() error: %s\n", cl_strerror(ret));
-	    cl_engine_free(engine);
-	    return 1;
-	}
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node52.html clamav-0.101.4+dfsg/docs/html/node52.html --- clamav-0.100.3+dfsg/docs/html/node52.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node52.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Engine structure - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Limits - Up: API - Previous: Error handling -   Contents -
-
- - -

-Engine structure -

- When all required databases are loaded you should prepare the detection - engine by calling cl_engine_compile(). In case of failure you - should still free the memory allocated to the engine with - cl_engine_free(): - 
-	int cl_engine_compile(struct cl_engine *engine);
-
- In our example: - 
-	if((ret = cl_engine_compile(engine)) != CL_SUCCESS) {
-	    printf("cl_engine_compile() error: %s\n", cl_strerror(ret));
-	    cl_engine_free(engine);
-	    return 1;
-	}
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node53.html clamav-0.101.4+dfsg/docs/html/node53.html --- clamav-0.100.3+dfsg/docs/html/node53.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node53.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,84 +0,0 @@ - - - - - -Limits - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Database checks - Up: API - Previous: Engine structure -   Contents -
-
- - -

-Limits -

- When you create a new engine with cl_engine_new(), it will have - all internal settings set to default values as recommended by the - ClamAV authors. It's possible to check and modify the values (numerical - and strings) using the following set of functions: - 
-int cl_engine_set_num(struct cl_engine *engine,
-  enum cl_engine_field field, long long num);
-
-long long cl_engine_get_num(const struct cl_engine *engine,
-  enum cl_engine_field field, int *err);
-
-int cl_engine_set_str(struct cl_engine *engine,
-  enum cl_engine_field field, const char *str);
-
-const char *cl_engine_get_str(const struct cl_engine *engine,
-  enum cl_engine_field field, int *err);
-
- Please don't modify the default values unless you know what you're doing. - Refer to the ClamAV sources (clamscan, clamd) for examples. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node54.html clamav-0.101.4+dfsg/docs/html/node54.html --- clamav-0.100.3+dfsg/docs/html/node54.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node54.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,108 +0,0 @@ - - - - - -Database checks - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Data scan functions - Up: API - Previous: Limits -   Contents -
-
- - -

-Database checks -

- It's very important to keep the internal instance of the database up to - date. You can watch database changes with the cl_stat..() family - of functions. - 
-	int cl_statinidir(const char *dirname, struct cl_stat *dbstat);
-	int cl_statchkdir(const struct cl_stat *dbstat);
-	int cl_statfree(struct cl_stat *dbstat);
-
- Initialization: - 
-	    ...
-	    struct cl_stat dbstat;
-
-	memset(&dbstat, 0, sizeof(struct cl_stat));
-	cl_statinidir(dbdir, &dbstat);
-
- To check for a change you just need to call cl_statchkdir and check - its return value (0 - no change, 1 - some change occurred). Remember to reset - the cl_stat structure after reloading the database. - 
-	if(cl_statchkdir(&dbstat) == 1) {
-	    reload_database...;
-	    cl_statfree(&dbstat);
-	    cl_statinidir(cl_retdbdir(), &dbstat);
-	}
-
- Libclamav $\ge0.96$ includes and additional call to check the number of - signatures that can be loaded from a given directory: - 
-	int cl_countsigs(const char *path, unsigned int countoptions,
-	    unsigned int *sigs);
-
- The first argument points to the database directory, the second one - specifies what signatures should be counted: - CL_COUNTSIGS_OFFICIAL (official signatures), -
CL_COUNTSIGS_UNOFFICIAL (third party signatures), - CL_COUNTSIGS_ALL (all signatures). The last argument points - to the counter to which the number of detected signatures will - be added (therefore the counter should be initially set to 0). - The call returns CL_SUCCESS or an error code. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node55.html clamav-0.101.4+dfsg/docs/html/node55.html --- clamav-0.100.3+dfsg/docs/html/node55.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node55.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,227 +0,0 @@ - - - - - -Data scan functions - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Memory - Up: API - Previous: Database checks -   Contents -
-
- - -

-Data scan functions -

- It's possible to scan a file or descriptor using: - 
-	int cl_scanfile(const char *filename, const char **virname,
-	unsigned long int *scanned, const struct cl_engine *engine,
-	unsigned int options);
-
-	int cl_scandesc(int desc, const char **virname, unsigned
-	long int *scanned, const struct cl_engine *engine,
-	unsigned int options);
-
- Both functions will store a virus name under the pointer virname, - the virus name is part of the engine structure and must not be released - directly. If the third argument (scanned) is not NULL, the - functions will increase its value with the size of scanned data (in - CL_COUNT_PRECISION units). - The last argument (options) specified the scan options and supports - the following flags (which can be combined using bit operators): - -
    -
  • CL_SCAN_STDOPT -
    -This is an alias for a recommended set of scan options. You - should use it to make your software ready for new features - in the future versions of libclamav. -
    • -
  • CL_SCAN_RAW -
    -Use it alone if you want to disable support for special files. -
    • -
  • CL_SCAN_ARCHIVE -
    -This flag enables transparent scanning of various archive formats. -
    • -
  • CL_SCAN_BLOCKENCRYPTED -
    -With this flag the library will mark encrypted archives as viruses - (Encrypted.Zip, Encrypted.RAR). -
    • -
  • CL_SCAN_MAIL -
    -Enable support for mail files. -
    • -
  • CL_SCAN_OLE2 -
    -Enables support for OLE2 containers (used by MS Office and .msi - files). -
    • -
  • CL_SCAN_PDF -
    -Enables scanning within PDF files. -
    • -
  • CL_SCAN_SWF -
    -Enables scanning within SWF files, notably compressed SWF. -
    • -
  • CL_SCAN_PE -
    -This flag enables deep scanning of Portable Executable files and - allows libclamav to unpack executables compressed with run-time - unpackers. -
    • -
  • CL_SCAN_ELF -
    -Enable support for ELF files. -
    • -
  • CL_SCAN_BLOCKBROKEN -
    -libclamav will try to detect broken executables and mark them as - Broken.Executable. -
    • -
  • CL_SCAN_HTML -
    -This flag enables HTML normalisation (including ScrEnc - decryption). -
    • -
  • CL_SCAN_ALGORITHMIC -
    -Enable algorithmic detection of viruses. -
    • -
  • CL_SCAN_PHISHING_BLOCKSSL -
    -Phishing module: always block SSL mismatches in URLs. -
    • -
  • CL_SCAN_PHISHING_BLOCKCLOAK -
    -Phishing module: always block cloaked URLs. -
    • -
  • CL_SCAN_STRUCTURED -
    -Enable the DLP module which scans for credit card and SSN - numbers. -
    • -
  • CL_SCAN_STRUCTURED_SSN_NORMAL -
    -Search for SSNs formatted as xx-yy-zzzz. -
    • -
  • CL_SCAN_STRUCTURED_SSN_STRIPPED -
    -Search for SSNs formatted as xxyyzzzz. -
    • -
  • CL_SCAN_PARTIAL_MESSAGE -
    -Scan RFC1341 messages split over many emails. You will need to - periodically clean up $TemporaryDirectory/clamav-partial - directory. -
    • -
  • CL_SCAN_HEURISTIC_PRECEDENCE -
    -Allow heuristic match to take precedence. When enabled, if - a heuristic scan (such as phishingScan) detects a possible - virus/phish it will stop scan immediately. Recommended, saves CPU - scan-time. When disabled, virus/phish detected by heuristic scans - will be reported only at the end of a scan. If an archive - contains both a heuristically detected virus/phishing, and a real - malware, the real malware will be reported. -
    • -
  • CL_SCAN_BLOCKMACROS -
    -OLE2 containers, which contain VBA macros will be marked infected - (Heuristics.OLE2.ContainsMacros). - -
    • -
- All functions return CL_CLEAN when the file seems clean, - CL_VIRUS when a virus is detected and another value on failure. - 
-	    ...
-	    const char *virname;
-
-	if((ret = cl_scanfile("/tmp/test.exe", &virname, NULL, engine,
-	CL_SCAN_STDOPT)) == CL_VIRUS) {
-	    printf("Virus detected: %s\n", virname);
-	} else {
-	    printf("No virus detected.\n");
-	    if(ret != CL_CLEAN)
-	        printf("Error: %s\n", cl_strerror(ret));
-	}
-
- -

- -

- - -next - -up - -previous - -contents -
- Next: Memory - Up: API - Previous: Database checks -   Contents
- -
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node56.html clamav-0.101.4+dfsg/docs/html/node56.html --- clamav-0.100.3+dfsg/docs/html/node56.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node56.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,68 +0,0 @@ - - - - - -Memory - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Forking daemons - Up: API - Previous: Data scan functions -   Contents -
-
- - -

-Memory -

- Because the engine structure occupies a few megabytes of system memory, you - should release it with cl_engine_free() if you no longer need to - scan files. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node57.html clamav-0.101.4+dfsg/docs/html/node57.html --- clamav-0.100.3+dfsg/docs/html/node57.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node57.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,70 +0,0 @@ - - - - - -Forking daemons - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: clamav-config - Up: API - Previous: Memory -   Contents -
-
- - -

-Forking daemons -

- If you're using libclamav with a forking daemon you should call - srand() inside a forked child before making any calls to the - libclamav functions. This will avoid possible collisions with temporary - filenames created by other processes of the daemon. This procedure - is not required for multi-threaded daemons. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node58.html clamav-0.101.4+dfsg/docs/html/node58.html --- clamav-0.100.3+dfsg/docs/html/node58.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node58.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,72 +0,0 @@ - - - - - -clamav-config - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Example - Up: API - Previous: Forking daemons -   Contents -
-
- - -

-clamav-config -

- Use clamav-config to check compilation information for libclamav. - 
-	$ clamav-config --libs
-	-L/usr/local/lib -lz -lbz2 -lgmp -lpthread
-	$ clamav-config --cflags
-	-I/usr/local/include -g -O2
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node59.html clamav-0.101.4+dfsg/docs/html/node59.html --- clamav-0.100.3+dfsg/docs/html/node59.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node59.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,70 +0,0 @@ - - - - - -Example - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: CVD format - Up: API - Previous: clamav-config -   Contents -
-
- - -

-Example -

- You will find an example scanner application in the clamav source - package (/example). Provided you have ClamAV already installed, execute - the following to compile it: - 
-	gcc -Wall ex1.c -o ex1 -lclamav
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node5.html clamav-0.101.4+dfsg/docs/html/node5.html --- clamav-0.100.3+dfsg/docs/html/node5.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node5.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,70 +0,0 @@ - - - - - -Virus submitting - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Base package - Up: Introduction - Previous: Mailing lists and IRC -   Contents -
-
- - -

-Virus submitting -

- If you have got a virus which is not detected by your ClamAV with the latest - databases, please submit the sample at our website: - - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node60.html clamav-0.101.4+dfsg/docs/html/node60.html --- clamav-0.100.3+dfsg/docs/html/node60.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node60.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,87 +0,0 @@ - - - - - -CVD format - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Graphics - Up: LibClamAV - Previous: Example -   Contents -
-
- - -

-CVD format -

- CVD (ClamAV Virus Database) is a digitally signed tarball containing - one or more databases. The header is a 512-bytes long string with colon - separated fields: - 
-ClamAV-VDB:build time:version:number of signatures:functionality
-level required:MD5 checksum:digital signature:builder name:build time (sec)
-
- sigtool --info displays detailed information on CVD files: - 
-$ sigtool -i daily.cvd 
-File: daily.cvd
-Build time: 10 Mar 2008 10:45 +0000
-Version: 6191
-Signatures: 59084
-Functionality level: 26
-Builder: ccordes
-MD5: 6e6e29dae36b4b7315932c921e568330
-Digital signature: zz9irc9irupR3z7yX6J+OR6XdFPUat4HIM9ERn3kAcOWpcMFxq
-Fs4toG5WJsHda0Jj92IUusZ7wAgYjpai1Nr+jFfXHsJxv0dBkS5/XWMntj0T1ctNgqmiF
-+RLU6V0VeTl4Oej3Aya0cVpd9K4XXevEO2eTTvzWNCAq0ZzWNdjc
-Verification OK.
-
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node61.html clamav-0.101.4+dfsg/docs/html/node61.html --- clamav-0.100.3+dfsg/docs/html/node61.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node61.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,66 +0,0 @@ - - - - - -Graphics - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: OpenAntiVirus - Up: LibClamAV - Previous: CVD format -   Contents -
-
- - -

-Graphics -

- The current ClamAV logo was created by Alicia Willet, Talos. - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node62.html clamav-0.101.4+dfsg/docs/html/node62.html --- clamav-0.100.3+dfsg/docs/html/node62.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node62.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,62 +0,0 @@ - - - - - -OpenAntiVirus - - - - - - - - - - - - - - - - -
-next - -up - -previous - -contents -
- Up: LibClamAV - Previous: Graphics -   Contents -
-
- - -

-OpenAntiVirus -

- Our database includes the virus database (about 7000 signatures) from - OpenAntiVirus (http://OpenAntiVirus.org). - -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node6.html clamav-0.101.4+dfsg/docs/html/node6.html --- clamav-0.100.3+dfsg/docs/html/node6.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node6.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,76 +0,0 @@ - - - - - -Base package - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Supported platforms - Up: clamdoc - Previous: Virus submitting -   Contents -
-
- - -

-Base package -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node7.html clamav-0.101.4+dfsg/docs/html/node7.html --- clamav-0.100.3+dfsg/docs/html/node7.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node7.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,80 +0,0 @@ - - - - - -Supported platforms - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Binary packages - Up: Base package - Previous: Base package -   Contents -
-
- - -

-Supported platforms -

- Clam AntiVirus is regularly tested on: - -
    -
  • GNU/Linux -
    • -
  • Solaris -
    • -
  • FreeBSD -
    • -
  • macOS -
    • -
  • Windows - -
    • -
- -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node8.html clamav-0.101.4+dfsg/docs/html/node8.html --- clamav-0.100.3+dfsg/docs/html/node8.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node8.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,66 +0,0 @@ - - - - - -Binary packages - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Installation - Up: Base package - Previous: Supported platforms -   Contents -
-
- - -

-Binary packages -

- You can find the up-to-date list of binary packages at our website: - https://www.clamav.net/download.html#otherversions -

-

-
-Cisco 2019-02-28 -
- - diff -Nru clamav-0.100.3+dfsg/docs/html/node9.html clamav-0.101.4+dfsg/docs/html/node9.html --- clamav-0.100.3+dfsg/docs/html/node9.html 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/node9.html 1970-01-01 00:00:00.000000000 +0000 @@ -1,90 +0,0 @@ - - - - - -Installation - - - - - - - - - - - - - - - - - - -
- -next - -up - -previous - -contents -
- Next: Requirements - Up: clamdoc - Previous: Binary packages -   Contents -
-
- - -

-Installation -

- -

-

- -Subsections - - - -
-
-Cisco 2019-02-28 -
- - Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/prev_g.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/prev_g.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/prev.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/prev.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/up_g.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/up_g.png differ Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/up.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/up.png differ diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/development.html clamav-0.101.4+dfsg/docs/html/UserManual/development.html --- clamav-0.100.3+dfsg/docs/html/UserManual/development.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/development.html 2019-08-20 16:09:29.000000000 +0000 @@ -0,0 +1,309 @@ + + + + + + + + + + + + +

ClamAV Development

+

Table of Contents

+ +

Introduction

+

This page aims to provide information useful when developing, debugging, or profiling ClamAV.

+

Building ClamAV for Development

+

Below are some recommendations for building ClamAV so that it's easy to debug.

+

Satisfying Build Dependencies

+

To satisify all build dependencies:

+

Debian/Ubuntu

+
sudo apt-get install libxml2-dev libxml2 libbz2-dev bzip2 check make libssl-dev openssl zlib1g zlib1g-dev gcc gettext autoconf automake libtool cmake autoconf-archive pkg-config g++-multilib libmilter1.0.1 libmilter-dev valgrind libcurl4-openssl-dev libjson-c-dev ncurses-dev libpcre3-dev
+

CentOS/RHEL/Fedora

+
sudo yum install libxml2-devel libxml2 bzip2-devel bzip2 check make openssl-devel openssl zlib zlib-devel gcc gettext autoconf automake libtool cmake autoreconf pkg-config g++-multilib sendmail sendmail-devel libtool-ltdl-devel valgrind
+
+sudo yum groupinstall "Development Tools"
+

Solaris (using OpenCSW)

+
sudo /opt/csw/bin/pkgutil -y -i common coreutils automake autoconf libxml2_2 libxml2_dev bzip2 libbz2_dev libcheck0 libcheck_dev gmake cmake libssl1_0_0 libssl_dev openssl_utilslibgcc_s1 libiconv2 zlib1 libstdc++6 libpcre1 libltdl7 lzlib_stub zlib_stub libmilter libtool ggrep gsed pkgconfig ggettext gcc4core gcc4g++ libgcc_s1 libgccpp1
+
+sudo pkg install system/header
+
+sudo ln -sf /opt/csw/bin/gnm /usr/bin/nm
+sudo ln -sf /opt/csw/bin/gsed /usr/bin/sed
+sudo ln -sf /opt/csw/bin/gmake /usr/bin/make
+

If you receive an error message like gcc: error: /opt/csw/lib/libstdc++.so: No such file or directory, change versions with /opt/csw/sbin/alternatives --config automake

+

FreeBSD

+

The easiest way to install dependencies for FreeBSD is to just rely on ports:

+
cd /usr/ports/security/clamav
+make
+

Download the Source

+
git clone https://github.com/Cisco-Talos/clamav-devel.git
+cd clamav-devel
+

If you intend to make changes and submit a pull request, fork the clamav-devel repo first and then clone your fork of the repository.

+

Running ./configure

+

Suggestions:

+
    +

  • Modify the CFLAGS variable as follows (assuming you're build with gcc):

    • +

  • Include gdb debugging information (-ggdb). This will make it easier to debug with gdb.

    • +

  • Disable optimizations (-O0). This will ensure the line numbers you see in gdb match up with what is actually being executed.

    • +

  • Run configure with the following options:

    • +

  • --prefix=`pwd`/build: This will cause make install to install into the specified directory to avoid potentially tainting a release install of ClamAV that you may have.

    • +

  • --enable-debug: This will define CL_DEBUG, which mostly just enables additional print statements that are useful for debugging.

    • +

  • --enable-check: Enables the unit tests, which can be run with make check.

    • +

  • --enable-coverage: If using gcc, sets -fprofile-arcs -ftest-coverage so that code coverage metrics will get generated when the program is run. Note that the code inserted to store program flow data may show up in any generated flame graphs or profiling output, so if you don't care about code coverage, omit this.

    • +

  • --enable-libjson: Enables libjson, which enables the --gen-json option. The json output contains additional metadata that might be helpful when debugging.

    • +

  • --with-systemdsystemunitdir=no: Don't try to register clamd as a systemd service (on systems that use systemd). You likely don't want this development build of clamd to register as a service, and this eliminates the need to run make install with sudo.

    • +

  • You might want to include the following flags also so that the optional functionality is enabled: --enable-experimental --enable-clamdtop --enable-libjson --enable-milter --enable-xml --enable-pcre. Note that this may require you to install additional development libraries.

    • +

  • --disable-llvm: When enabled, LLVM provides the capability to just-in-time compile ClamAV bytecode signatures. Without LLVM, ClamAV uses a built-in bytecode interpreter to execute bytecode signatures. The mechanism is different, but the results are same and the performance overall is comparable. At present only LLVM versions up to LLVM 3.6.2 are supported by ClamAV, and LLVM 3.6.2 is old enough that newer distributions no longer provide it. Therefore, we recommend using the --disable-llvm configure option.

    • +
+

Altogether, the following configure command can be used:

+
CFLAGS="-ggdb -O0" ./configure --prefix=`pwd`/installed --enable-debug --enable-check --enable-coverage --enable-libjson --with-systemdsystemunitdir=no --enable-experimental --enable-clamdtop --enable-libjson --enable-xml --enable-pcre --disable-llvm
+

NOTE: It is possible to build libclamav as a static library and have it statically linked into clamscan/clamd (to do this, run ./configure with --enable-static --disable-shared). This is useful for using tools like gprof that do not support profiling code in shared objects. However, there are two drawbacks to doing this:

+
    +

  • clamscan/clamd will not be able to extract files from RAR archives. Based on the software license of the unrar library that ClamAV uses, the library can only be dynamically loaded. ClamAV will attempt to dlopen the unrar library shared object and will continue on without RAR extraction support if the library can't be found (or if it doesn't get built, which is what happens if you indicate that shared libraries should not be built).

    • +

  • If you make changes to libclamav, you'll need to make clean, make, and make install again to have clamscan/clamd rebuilt using the new libclamav.a. The makefiles don't seem to know to rebuild clamscan/clamd when libclamav.a changes (TODO, fix this).

    • +
+

Running make

+

Run the following to finishing building. -j2 in the code below is used to indicate that the build process should use 2 cores. Increase this if your machine is more powerful.

+
make -j2
+make install
+

Also, you can run make check to run the unit tests

+

Downloading the Official Ruleset

+

If you plan to use custom rules for testing, you can invoke clamscan via ./installed/bin/clamscan, specifying your custom rule files via -d parameters.

+

If you want to download the official ruleset to use with clamscan, do the following:

+
    +
  1. Run mkdir -p installed/share/clamav
    2. +
  2. Comment out line 8 of etc/freshclam.conf.sample
    3. +
  3. Run ./installed/bin/freshclam --config-file etc/freshclam.conf.sample
    4. +
+

General Debugging

+

NOTE: Some of the debugging/profiling tools mentioned in the sections below are specific to Linux

+

Useful clamscan Flags

+

The following are useful flags to include when debugging clamscan:

+
    +

  • --debug --verbose: Print lots of helpful debug information

    • +

  • --gen-json: Print some additional debug information in a JSON format

    • +

  • --statistics=pcre --statistics=bytecode: Print execution statistics on any PCRE and bytecode rules that were evaluated

    • +

  • --dev-performance: Print per-file statistics regarding how long scanning took and the times spent in various scanning stages

    • +

  • --detect-broken: This will attempt to detect broken executable files. If an executable is determined to be broken, some functionality might not get invoked for the sample, and this could be an indication of an issue parsing the PE header or file. This causes those binary to generate an alert instead of just continuing on. NOTE: This will be renamed to --alert-broken starting in ClamAV 0.101.

    • +

  • --max-filesize=2000M --max-scansize=2000M --max-files=2000000 --max-recursion=2000000 --max-embeddedpe=2000M --max-htmlnormalize=2000000 --max-htmlnotags=2000000 --max-scriptnormalize=2000000 --max-ziptypercg=2000000 --max-partitions=2000000 --max-iconspe=2000000 --max-rechwp3=2000000 --pcre-match-limit=2000000 --pcre-recmatch-limit=2000000 --pcre-max-filesize=2000M:

    • +
+

Effectively disables all file limits and maximums for scanning. This is useful if you'd like to ensure that all files in a set get scanned, and would prefer clam to just run slowly or crash rather than skip a file because it encounters one of these thresholds

+

The following are useful flags to include when debugging rules that you're
+writing:

+
    +

  • -d: Allows you to specify a custom ClamAV rule file from the command line

    • +

  • --bytecode-unsigned: If you are testing custom bytecode rules, you'll need this flag so that clamscan actually runs the bytecode signature

    • +

  • --all-match: Allows multiple signatures to match on a file being scanned

    • +

  • --leave-temps --tmpdir=/tmp: By default, ClamAV will attempt to extract embedded files that it finds, normalize certain text files before looking for matches, and unpack packed executables that it has unpacking support for. These flags tell ClamAV to write these intermediate files out to the directory specified. Usually when a file is written, it will mention the file name in the --debug output, so you can have some idea at what stage in the scanning process a tmp file was created.

    • +

  • --dump-certs: For signed PE files that match a rule, display information about the certificates stored within the binary. Note - sigtool has this functionality as well and doesn't require a rule match to view the cert data

    • +
+

Using gdb

+

Given that you might want to pass a lot of arguments to gdb, consider taking advantage of the --args parameter. For example:

+
gdb --args ./installed/bin/clamscan -d /tmp/test.ldb -d /tmp/blacklist.crb -d --dumpcerts --debug --verbose --max-filesize=2000M --max-scansize=2000M --max-files=2000000 --max-recursion=2000000 --max-embeddedpe=2000M --max-iconspe=2000000 f8f101166fec5785b4e240e4b9e748fb6c14fdc3cd7815d74205fc59ce121515
+

When using ClamAV without libclamav statically linked, if you set breakpoints on libclamav functions by name, you'll need to make sure to indicate that the breakpoints should be resolved after libraries have been loaded.

+

For other documentation about how to use gdb, check out the following resources:

+ +

Hunting for Memory Leaks

+

You can easily hunt for memory leaks with valgrind. Check out this guide to get started: Valgrind Quick Start

+

If checking for leaks, be sure to run clamscan with samples that will hit as many of the unique code paths in the code you are testing. An example invocation is as follows:

+
valgrind --leak-check=full ./installed/bin/clamscan -d /tmp/test.ldb --leave-temps --tempdir /tmp/test --debug --verbose /tmp/upx-samples/ > /tmp/upx-results-2.txt 2>&1
+

Alternatively, on Linux, you can use glibc's built-in leak checking functionality:

+
MALLOC_CHECK_=7 ./installed/bin/clamscan
+

See the mallopt man page for more details

+

Computing Code Coverage

+

gcov/lcov can be used to produce a code coverage report indicating which lines of code were executed on a single run or by multiple runs of clamscan. NOTE: for these metrics to be collected, ClamAV needs to have been configured with the --enable-coverage option.

+

First, run the following to zero out all of the performance metrics:

+
lcov -z --directory . --output-file coverage.lcov.data
+

Next, run ClamAV through whatever test cases you have. Then, run lcov again to collect the coverage data as follows:

+
lcov -c --directory . --output-file coverage.lcov.data
+

Finally, run the genhtml tool that ships with lcov to produce the code coverage report:

+
genhtml coverage.lcov.data --output-directory report
+

The report directory will have an index.html page which can be loaded into any web browser.

+

For more information, visit the lcov webpage

+

Profiling - Flame Graphs

+

FlameGraph is a great tool for generating interactive flamegraphs based collected profiling data. The github page has thorough documentation on how to use the tool, but an overview is presented below:

+

First, install perf, which on Linux can be done via:

+
apt-get install linux-tools-common linux-tools-generic linux-tools-`uname -r`
+

Modify the system settings to allow perf record to be run by a standard user:

+
sudo su     # Run the following as root
+cat /proc/sys/kernel/perf_event_paranoid
+echo "1" > /proc/sys/kernel/perf_event_paranoid
+exit
+

Invoke clamscan via perf record as follows, and run perf script to collect the profiling data:

+
perf record -F 100 -g -- ./installed/bin/clamscan -d /tmp/test.ldb /tmp/2aa6b18d509090c60c3e4ecdd8aeb16e5f149807e3404c86892112710eab576d
+perf script > out.perf
+

The -F parameter indicates how many samples should be collected during program execution. If your scan will take a long time to run, a lower value should be sufficient. Otherwise, consider choosing a higher value (on Ubuntu 18.04, 7250 is the max frequency, but it can be increased via /proc/sys/kernel/perf_event_max_sample_rate.

+

Check out the FlameGraph project and run the following commands to generate the flame graph:

+
perl stackcollapse-perf.pl ../clamav-devel/out.perf > /tmp/out.folded
+perl flamegraph.pl /tmp/out.folded > /tmp/test.svg
+

The SVG that is generated is interactive, but some viewers don't support this.
+Be sure to open it in a web browser like Chrome to be able to take full advantage of it.

+

Profiling - Callgrind

+

Callgrind is a profiling tool included with valgrind. This can be done by prepending valgrind --tool=callgrind to the clamscan command.

+

kcachegrind is a follow-on tool that will graphically present the profiling data and allow you to explore it visually, although if you don't already use KDE you'll have to install lots of extra packages to use it.

+

System Call Tracing / Fault Injection

+

strace can be used to track the system calls that are performed and provide the number of calls / time spent in each system call. This can be done by prepending strace -c to a clamscan command. Results will look something like this:

+
% time     seconds  usecs/call     calls    errors syscall
+------ ----------- ----------- --------- --------- ----------------
+ 95.04    0.831430          13     62518           read
+  3.22    0.028172          14      2053           munmap
+  0.69    0.006005           3      2102           mmap
+  0.28    0.002420           7       344           pread64
+  0.16    0.001415           5       305         1 openat
+  0.13    0.001108           3       405           write
+  0.11    0.000932          23        40           mprotect
+  0.07    0.000632           2       310           close
+  0.07    0.000583           9        67        30 access
+  0.05    0.000395           1       444           lseek
+  0.04    0.000344           2       162           fstat
+  0.04    0.000338           1       253           brk
+  0.03    0.000262           1       422           fcntl
+  0.02    0.000218          16        14           futex
+  0.01    0.000119           1       212           getpid
+  0.01    0.000086          14         6           getdents
+  0.00    0.000043           7         6           dup
+  0.00    0.000040           1        31           unlink
+  0.00    0.000038          19         2           rt_sigaction
+  0.00    0.000037          19         2           rt_sigprocmask
+  0.00    0.000029           1        37           stat
+  0.00    0.000022          11         2           prlimit64
+  0.00    0.000021          21         1           sysinfo
+  0.00    0.000020           1        33           clock_gettime
+  0.00    0.000019          19         1           arch_prctl
+  0.00    0.000018          18         1           set_tid_address
+  0.00    0.000018          18         1           set_robust_list
+  0.00    0.000013           0        60           lstat
+  0.00    0.000011           0        65           madvise
+  0.00    0.000002           0        68           geteuid
+  0.00    0.000000           0         1           execve
+  0.00    0.000000           0         1           uname
+  0.00    0.000000           0         1           getcwd
+------ ----------- ----------- --------- --------- ----------------
+100.00    0.874790                 69970        31 total
+

strace can also be used for cool things like system call fault injection. For instance, let's say you are curious whether the read bytecode API call is implemented in such a way that the underlying read system call could handle EINTR being returned (which can happen periodically). To test this, write the following bytecode rule:

+
VIRUSNAME_PREFIX("BC.Heuristic.Test.Read.Passed")
+VIRUSNAMES("")
+TARGET(0)
+
+SIGNATURES_DECL_BEGIN
+DECLARE_SIGNATURE(zeroes)
+SIGNATURES_DECL_END
+
+SIGNATURES_DEF_BEGIN
+DEFINE_SIGNATURE(zeroes, "0:0000")
+SIGNATURES_DEF_END
+
+bool logical_trigger()
+{
+    return matches(Signatures.zeroes);
+}
+
+#define READ_S(value, size) if (read(value, size) != size) return 0;
+
+int entrypoint(void)
+{
+    char buffer[65536];
+    int i;
+
+    for (i = 0; i < 256; i++)
+    {
+        debug(i);
+        debug("\n");
+        READ_S(buffer, sizeof(buffer));
+    }
+
+    foundVirus("");
+    return 0;
+}
+

Compiled the rule, and make a test file to match against it. Then run it under strace to determine what underlying read system call is being used for the bytecode read function:

+
clambc-compiler read_test.bc
+dd if=/dev/zero of=/tmp/zeroes bs=65535 count=256
+strace clamscan -d read_test.cbc --bytecode-unsigned /tmp/zeroes
+

It uses pread64 under the hood, so the following command could be used for fault injection:

+
strace -e fault=pread64:error=EINTR:when=20+10 clamscan -d read_test.cbc --bytecode-unsigned /tmp/zeroes
+

This command tells strace to skip the first 20 pread64 calls (these appear to be used by the loader, which didn't seem to handle EINTR correctly) but to inject EINTR for every 10th call afterward. We can see the injection in action and that the system call is retried successfully:

+
pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15007744) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15073280) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15138816) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15204352) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15269888) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15335424) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15400960) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15466496) = 65536
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15532032) = 65536
+pread64(3, 0x7f6a7ff43000, 65536, 15597568) = -1 EINTR (Interrupted system call) (INJECTED)
+pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 65536, 15597568) = 65536
+

More documentation on using strace to perform system call fault injection, see this presentation from FOSDEM 2017.

+ + Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/html/UserManual/images/demon.png and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/html/UserManual/images/demon.png differ diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-Debian-Ubuntu.html clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-Debian-Ubuntu.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-Debian-Ubuntu.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-Debian-Ubuntu.html 2019-08-20 16:09:35.000000000 +0000 @@ -0,0 +1,261 @@ + + + + + + + + + + + + +

Installation on Debian and Ubuntu Linux Distributions

+

Below are the steps for installing ClamAV from source on Debian and Ubuntu Linux.

+

Install prerequisites

+
    +
  1. Install ClamAV dependencies +
      +

    1. Install the developer tools

      +
      sudo apt-get install build-essential
      2. +

    2. Install library dependencies

      +
      sudo apt-get install openssl libssl-dev libcurl4-openssl-dev zlib1g-dev libpng-dev libxml2-dev libjson-c-dev libbz2-dev libpcre3-dev ncurses-dev
      3. +

    3. (very optional) Those wishing to use clamav-milter may wish to install the following

      +
      sudo apt-get install libmilter1.0.1 libmilter-dev
      4. +
    2. +

  2. Install the unit testing dependencies

    +
    sudo apt-get valgrind check
    3. +
+

Note: LLVM is also an optional dependency. LLVM will not provide any additional features, but is an alternative method for executing bytecode signatures versus using the built-in bytecode interpreter. Limited performance testing between LLVM and the bytecode interpreter did not yield conclusive evidence that one is "better" than the other. For the sake of simplicity, it is not recommended to install LLVM.

+

Download the latest stable release

+
    +
  1. Open a browser and navigate to the ClamAV downloads page
    2. +
  2. Click clamav-<version>.tar.gz link to download the latest stable release.
    3. +
+

Extract the source archive

+
cd ~/Downloads
+tar xzf clamav-<ver>.tar.gz
+cd clamav-<ver>.tar.gz
+

Configure the build

+

ClamAV's configure script should detect each of the above dependencies automatically.

+

Typical ./configure usage

+
./configure --enable-check
+

Once ./configure completes, it will print a summary. Verify that the packages you installed are in fact being detected.

+

Example configure summary output:

+
configure: Summary of detected features follows
+              OS          : linux-gnu
+              pthreads    : yes (-lpthread)
+configure: Summary of miscellaneous features
+              check       : -lcheck_pic -pthread -lrt -lm -lsubunit
+              fanotify    : yes
+              fdpassing   : 1
+              IPv6        : yes
+configure: Summary of optional tools
+              clamdtop    : -lncurses (auto)
+              milter      : yes (disabled)
+              clamsubmit  : yes (libjson-c-dev found at /usr), libcurl-devel found at /usr)
+configure: Summary of engine performance features
+              release mode: yes
+              llvm        : no (disabled)
+              mempool     : yes
+configure: Summary of engine detection features
+              bzip2       : ok
+              zlib        : /usr
+              unrar       : yes
+              preclass    : yes (libjson-c-dev found at /usr)
+              pcre        : /usr
+              libmspack   : yes (Internal)
+              libxml2     : yes, from /usr
+              yara        : yes
+              fts         : yes (libc)
+ +
    +

  • --with-systemdsystemunitdir - Do not install systemd socket files. This option disables systemd support, but will allow you to make install to a user-owned directory without requiring sudo/root privileges:

    +
    ./configure --with-systemdsystemunitdir=no
    • +

  • --sysconfdir - Install the configuration files to /etc instead of /usr/local/etc:

    +
    ./configure -–sysconfdir=/etc
    • +
  • --prefix - Install ClamAV to a directory other than /usr/local/: +
      +

    • Example 1: Install to a local ./install directory.

      +
      ./configure --prefix=`pwd`/install
      • +

    • Example 2: Install ClamAV locally on an unprivileged shell account.

      +
      ./configure --prefix=$HOME/clamav --disable-clamav --with-systemdsystemunitdir=no
      • +
    • +

  • --disable-clamav - Don't drop super-user priveleges to run freshclam or clamd as the clamav* user.

    +
    ./configure --disable-clamav
    +*Tip: Using this --disable-clamav means that freshclam and clamd will run with root privleges if invoked using sudo. Running clamd or clamscan as root is not recommended. Instead of using this option, you can configure freshclam or clamd to drop to any other user by: +
      +
    • setting the DatabaseOwner option in freshclam.conf and
      • +
    • setting the User option in clamd.conf.
      • +
    • +
+

Please see the ./configure --help for additional options.

+

Compile ClamAV

+

Compile ClamAV with:

+
make -j2
+

Run ClamAV Unit Tests (Optional)

+

For peace of mind, it can be helpful to run a small suite of unit and system tests.

+

Run:

+
make check
+

All tests should pass.* Output will look something like this:

+
    ...
+PASS: check_clamav
+PASS: check_freshclam.sh
+PASS: check_sigtool.sh
+PASS: check_unit_vg.sh
+PASS: check1_clamscan.sh
+PASS: check2_clamd.sh
+PASS: check3_clamd.sh
+PASS: check4_clamd.sh
+PASS: check5_clamd_vg.sh
+PASS: check6_clamd_vg.sh
+SKIP: check7_clamd_hg.sh
+PASS: check8_clamd_hg.sh
+PASS: check9_clamscan_vg.sh
+    ...
+============================================================================
+Testsuite summary for ClamAV 0.100.2
+============================================================================
+# TOTAL: 13
+# PASS:  12
+# SKIP:  1
+# XFAIL: 0
+# FAIL:  0
+# XPASS: 0
+# ERROR: 0
+

Notes:

+
    +
  • The *.vg.sh tests will be skipped unless you run make check VG=1.
    • +
  • The check7_clamd.hg.sh (helgrind) is presently disabled and will be skipped.
    • +
  • For details, see: the Git commit
    • +
+

If you have a failure or an error in the unit tests, it could be that you are missing one or more of the prerequisites.

+

If you are investigating a failure, please do the following:

+

cd unit_tests

+

Use less to read the log for the failed test.
+Example:

+
less check4_clamd.sh.log`
+

To submit a bug report regarding unit text failures, please follow these bug reporting steps.

+

Install ClamAV

+

Install ClamAV with:

+
make install
+

Tip: If installing to the default or other system-owned directory, you may need to use sudo.

+

First time set-up

+

Note: The following instructions assume you used the default install paths (i.e. /usr/local). If you modified the install locations using --prefix or --sysconfdir options, replace /usr/local with your chosen install path.

+

freshclam config

+

Before you can use freshclam to download updates, you need to create a freshclam config. A sample config is provided for you.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogRotate
      • +
    • NotifyClamd
      • +
    • DatabaseOwner
      • +
    3. +

  3. Create the database directory. *Tip: You may need to use sudo.

    +
    mkdir /usr/local/share/clamav
    4. +
+

clamd config (optional)

+

You can run clamscan without setting the config options for clamd. However, the clamd scanning daemon allows you to use clamdscan to perform faster a-la-carte scans, allows you to run multi-threaded scans, and allows you to use clamav-milter if you want to use ClamAV as a mail filter if you host an email server.

+

Additionally, if you are a running modern versions of Linux where the FANOTIFY kernel feature is enabled, clamd has a feature run with On-Access Scanning. When properly configured*, On-Access Scanning can scan files as they are accessed and optionally block access to the file in the event that a signature alerted.

+

Note: At this time, for On-Access Scanning to work, clamd must run with sudo/root privileges. For more details, please see our documentation on On-Access Scanning.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/clamd.conf.sample /usr/local/etc/clamd.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    • You also need to select a Socket option for clamd so clamdscan and other utilities can communicate with clamd. You must enable one of the following. +
        +
      • LocalSocket
        • +
      • TCPSocket
        • +
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogClean
      • +
    • LogRotate
      • +
    • User
      • +
    • ScanOnAccess +
        +
      • OnAccessIncludePath
        • +
      • OnAccessExcludePath
        • +
      • OnAccessPrevention
        • +
      • +
    3. +
+

Configure SELinux for ClamAV

+

Certain distributions (notably RedHat variants) when operating with SELinux enabled use the non-standard antivirus_can_scan_system SELinux option instead of clamd_can_scan_system.

+

At this time, libclamav only sets the clamd_can_scan_system option, so you may need to manually enable antivirus_can_scan_system. If you don't perform this step, freshclam will log something like this when it tests the newly downloaded signature databases:

+
During database load : LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied
+

To allow ClamAV to operate under SELinux, run the following:

+
setsebool -P antivirus_can_scan_system 1
+

Download / Update the signature database

+

Before you can run a scan, you'll need to download the signature databases. Once again, you may need to run with sudo/root privileges.

+

If you installed to a location in your system PATH:

+
freshclam
+

If you installed to another location:

+
/<path>/<to>/<clamav>/<bin>/freshclam
+

Important: It is common on Ubuntu after a fresh install to see the following error the first time you use ClamAV:
+bash $ freshclam freshclam: error while loading shared libraries: libclamav.so.7: cannot open shared object file: No such file or directory

+

You can fix this error by using ldconfig to rebuild the library search path.
+bash sudo ldconfig

+

Users and on user privileges

+

If you are running freshclam and clamd as root or with sudo, and you did not explicitely configure with --disable-clamav, you will want to ensure that the DatabaseOwner user specified in freshclam.conf owns the database directory so it can download signature udpates.

+

The user that clamd, clamdscan, and clamscan run as may be the same user, but if it isn't -- it merely needs read access to the database directory.

+

If you choose to use the default clamav user to run freshclam and clamd, you'll need to create the clamav group and the clamav user account the first time you install ClamAV.

+
groupadd clamav
+useradd -g clamav -s /bin/false -c "Clam Antivirus" clamav
+

Finally, you will want to set user ownership of the database directory.
+For example:

+
sudo chown -R clamav:clamav /usr/local/share/clamav
+

Usage

+

You should be all set up to run scans.

+

Take a look at our usage documentation to learn about how to use ClamAV each of the utilities.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-macOS.html clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-macOS.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-macOS.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-macOS.html 2019-08-20 16:09:34.000000000 +0000 @@ -0,0 +1,291 @@ + + + + + + + + + + + + +

Installation on macOS (Mac OS X)

+

Below are the steps for installing ClamAV from source on Apple macOS.

+

Install prerequisites

+

The easiest way to install prerequisites on macOS is to use Homebrew

+
    +

  1. Install Homebrew

    +
    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
    2. +
  2. Install ClamAV dependencies +
      +

    1. Install XCode's Command Line Tools

      +
      xcode-select --install
      2. +

    2. Install library dependencies

      +
      brew install pcre2 openssl json-c
      3. +
    3. +

  3. Install the unit testing dependencies

    +
    sudo apt-get valgrind check
    +

    Tip: Valgrind may not be available in Homebrew for the latest version of macOS.

    4. +
+

Note: LLVM is also an optional dependency. LLVM will not provide any additional features, but is an alternative method for executing bytecode signatures versus using the built-in bytecode interpreter. Limited performance testing between LLVM and the bytecode interpreter did not yield conclusive evidence that one is "better" than the other. For the sake of simplicity, it is not recommended to install LLVM.

+

Download the latest stable release

+
    +
  1. Open a browser and navigate to the ClamAV downloads page
    2. +
  2. Click clamav-<version>.tar.gz link to download the latest stable release.
    3. +
+

Extract the source archive

+
cd ~/Downloads
+tar xzf clamav-<ver>.tar.gz
+cd clamav-<ver>.tar.gz
+

Configure the build

+

Homebrew installs libraries and applications under /usr/local/Cellar/<app>/<ver>/.

+

To configure the ClamAV build using our homebrew-installed dependencies, you may need to reference some of them explicitly. Others may be detected automatically.

+

Typical ./configure usage

+

*Note: Your Homebrew-installed package version directories may differ slightly.

+
./configure --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-libjson=yes --enable-check
+

Once ./configure completes, it will print a summary. Verify that the packages you installed are in fact being detected.

+

Example configure summary output:

+
configure: Summary of detected features follows
+            OS          : darwin17.2.0
+            pthreads    : yes ()
+configure: Summary of miscellaneous features
+            check       : -L/usr/local/lib -lcheck -R/usr/local/lib  (auto)
+            fanotify    : no (disabled)
+            fdpassing   : 1
+            IPv6        : yes
+configure: Summary of optional tools
+            clamdtop    : -lncurses (auto)
+            milter      : yes (disabled)
+            clamsubmit  : yes (libjson-c-dev found at /usr/local), libcurl-devel found at /usr)
+configure: Summary of engine performance features
+            release mode: yes
+            llvm        : no (disabled)
+            mempool     : yes
+configure: Summary of engine detection features
+            bzip2       : ok
+            zlib        : /usr
+            unrar       : yes
+            preclass    : yes (libjson-c-dev found at /usr/local)
+            pcre        : /usr/local/Cellar/pcre2/10.32
+            libmspack   : yes (Internal)
+            libxml2     : yes, from /usr
+            yara        : yes
+            fts         : yes (libc)
+

If you experience an error wherein configure output claims that gcc is unable to build an executable -- please see the Troubleshooting section at the bottom.

+ +
    +

  • --sysconfdir - Install the configuration files to /etc instead of /usr/local/etc:

    +
    ./configure -–sysconfdir=/etc
    • +
  • --prefix - Install ClamAV to a directory other than /usr/local/: +
      +

    • Example 1: Install to a local ./install directory.

      +
      ./configure --prefix=`pwd`/install
      • +

    • Example 2: Install ClamAV locally on an unprivileged shell account.

      +
      ./configure --prefix=$HOME/clamav --disable-clamav
      • +
    • +

  • --disable-clamav - Don't drop super-user priveleges to run freshclam or clamd as the clamav* user.

    +
    ./configure --disable-clamav
    +*Tip: Using this --disable-clamav means that freshclam and clamd will run with root privleges if invoked using sudo. Running clamd or clamscan as root is not recommended. Instead of using this option, you can configure freshclam or clamd to drop to any other user by: +
      +
    • setting the DatabaseOwner option in freshclam.conf and
      • +
    • setting the User option in clamd.conf.
      • +
    • +
+

Please see the ./configure --help for additional options.

+

Compile ClamAV

+

Compile ClamAV with:

+
make -j2
+

If you experience error messages wherein the compiler is unable to find the correct openssl header or library files, you may need to reconfigure and provide explicit header and library paths. See the Troubleshooting section below for details.

+

Run ClamAV Unit Tests (Optional)

+

For peace of mind, it can be helpful to run a small suite of unit and system tests.

+

Run:

+
make check
+

All tests should pass.* Output will look something like this:

+
    ...
+PASS: check_clamav
+PASS: check_freshclam.sh
+PASS: check_sigtool.sh
+PASS: check_unit_vg.sh
+PASS: check1_clamscan.sh
+PASS: check2_clamd.sh
+PASS: check3_clamd.sh
+PASS: check4_clamd.sh
+PASS: check5_clamd_vg.sh
+PASS: check6_clamd_vg.sh
+SKIP: check7_clamd_hg.sh
+PASS: check8_clamd_hg.sh
+PASS: check9_clamscan_vg.sh
+    ...
+============================================================================
+Testsuite summary for ClamAV 0.100.2
+============================================================================
+# TOTAL: 13
+# PASS:  12
+# SKIP:  1
+# XFAIL: 0
+# FAIL:  0
+# XPASS: 0
+# ERROR: 0
+

Notes:

+
    +
  • The *.vg.sh tests will be skipped unless you run make check VG=1.
    • +
  • Under macOS, *.vg.sh (valgrind) tests will fail due to false alerts.
    • +
  • Valgrind may not be available via Homebrew for the latest version of macOS.
    • +
  • The check7_clamd.hg.sh (helgrind) is presently disabled and will be skipped.
    • +
  • For details, see: the Git commit
    • +
+

If you have a failure or an error in the unit tests, it could be that you are missing one or more of the prerequisites or that there is miss-match in the header files after upgrading to a newer version of macOS. If the latter, please see the Troubleshooting section at the bottom.

+

If you are investigating a failure, please do the following:

+

cd unit_tests

+

Use less to read the log for the failed test.
+Example:

+
less check4_clamd.sh.log`
+

To submit a bug report regarding unit text failures, please follow these bug reporting steps.

+

Install ClamAV

+

Install ClamAV with:

+
make install
+

Tip: If installing to the default or other system-owned directory, you may need to use sudo.

+

First time set-up

+

Note: The following instructions assume you used the default install paths (i.e. /usr/local). If you modified the install locations using --prefix or --sysconfdir options, replace /usr/local with your chosen install path.

+

freshclam config

+

Before you can use freshclam to download updates, you need to create a freshclam config. A sample config is provided for you.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogRotate
      • +
    • NotifyClamd
      • +
    • DatabaseOwner
      • +
    3. +

  3. Create the database directory. *Tip: You may need to use sudo.

    +
    mkdir /usr/local/share/clamav
    4. +
+

clamd config (optional)

+

You can run clamscan without setting the config options for clamd. However, the clamd scanning daemon allows you to use clamdscan to perform faster a-la-carte scans, allows you to run multi-threaded scans, and allows you to use clamav-milter if you want to use ClamAV as a mail filter if you host an email server.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/clamd.conf.sample /usr/local/etc/clamd.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    • You also need to select a Socket option for clamd so clamdscan and other utilities can communicate with clamd. You must enable one of the following. +
        +
      • LocalSocket
        • +
      • TCPSocket
        • +
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogClean
      • +
    • LogRotate
      • +
    • User
      • +
    3. +
+

Download / Update the signature database

+

Before you can run a scan, you'll need to download the signature databases. Once again, you may need to run with sudo/root privileges.

+

If you installed to a location in your system PATH:

+
freshclam
+

If you installed to another location:

+
/<path>/<to>/<clamav>/<bin>/freshclam
+

Users and on user privileges

+

If you are running freshclam and clamd as root or with sudo, and you did not explicitely configure with --disable-clamav, you will want to ensure that the DatabaseOwner user specified in freshclam.conf owns the database directory so it can download signature udpates.

+

The user that clamd, clamdscan, and clamscan run as may be the same user, but if it isn't -- it merely needs read access to the database directory.

+

If you choose to use the default clamav user to run freshclam and clamd, you'll need to create the clamav group and the clamav user account the first time you install ClamAV.

+

Prep by identifying an unused group id (gid), and an unused user UniqueID.

+

This command will display all current group PrimaryGroupIDs:

+
dscl . list /Groups PrimaryGroupID | tr -s ' ' | sort -n -t ' ' -k2,2
+

This command will display all current user UniqueIDs:

+
dscl . list /Users UniqueID | tr -s ' ' | sort -n -t ' ' -k2,2
+

Then, these commands can be used to create the clamav group and clamav user.

+
sudo dscl . create /Groups/clamav
+sudo dscl . create /Groups/clamav RealName "Clam Antivirus Group"
+sudo dscl . create /Groups/clamav gid 799           # Ensure this is unique!
+sudo dscl . create /Users/clamav
+sudo dscl . create /Users/clamav RealName "Clam Antivirus User"
+sudo dscl . create /Users/clamav UserShell /bin/false
+sudo dscl . create /Users/clamav UniqueID 599       # Ensure this is unique!
+sudo dscl . create /Users/clamav PrimaryGroupID 799 # Must match the above gid!
+

Finally, you will want to set user ownership of the database directory.
+For example:

+
sudo chown -R clamav:clamav /usr/local/share/clamav
+

Usage

+

You should be all set up to run scans.

+

Take a look at our usage documentation to learn about how to use ClamAV each of the utilities.

+

Troubleshooting

+

Configure -- gcc failed to build executable

+

It is possible that gcc/clang is misconfigured. This is particularly likely after an upgrade to a newer versions of macOS (e.g after an upgrade from macOS High Sierra to macOS Mojave).

+

Open Terminal, and run the following:

+
xcode-select --install
+

This will download and install xcode developer tools and fix the problem. You will be prompted (in the macOS GUI) to accept the license agreement before it will continue.
+As a follow on step, you may need to reset the path to Xcode if you have several versions or want the command line tools to run without Xcode.

+
xcode-select --switch /Applications/Xcode.app
+xcode-select --switch /Library/Developer/CommandLineTools
+
+

Solution shamelessly lifted from apple stackexchange

+
+

Make -- failed to find correct openssl header or library files

+

Homebrew provides symlinks in /usr/local/opt to aid in the linking process:

+
$ ls -l /usr/local/opt/openssl*
+
+lrwxr-xr-x  1 gary  admin    24B Aug 21 12:39 /usr/local/opt/openssl@ -> ../Cellar/openssl/1.0.2p
+lrwxr-xr-x  1 gary  admin    24B Aug 21 12:39 /usr/local/opt/openssl@1.0@ -> ../Cellar/openssl/1.0.2p
+lrwxr-xr-x  1 gary  admin    28B Nov 20  2017 /usr/local/opt/openssl@1.1@ -> ../Cellar/openssl@1.1/1.1.0g
+

If they aren't automatically detected you may experience issues linking openssl. You can work around this by explicitly listing the include -I and library -L paths.

+

For example:

+
./configure --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-libjson=yes --enable-check CPPFLAGS="-I/usr/local/opt/openssl@1.0/include" LDFLAGS="-L/usr/local/opt/openssl@1.0/lib/"
+

Make check -- unit tests failed for seemingly no reason

+

Similar to the above issue, it is possible for a mismatch in your development header files resulting in a working build that may fail the check test suite.

+

If you're seeing one or more failed tests on a stable release of ClamAV on macOS, the following may resolve the issue:

+

Open Terminal, and run the following:

+
sudo installer -pkg /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg -target /
+
+

Solution shamelessly lifted from the pyenv github issue tracker

+
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-Redhat-CentOS.html clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-Redhat-CentOS.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix/Steps-Redhat-CentOS.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix/Steps-Redhat-CentOS.html 2019-08-20 16:09:35.000000000 +0000 @@ -0,0 +1,257 @@ + + + + + + + + + + + + +

Installation on Redhat and CentOS Linux Distributions

+

Below are the steps for installing ClamAV from source on Redhat and CentOS Linux.

+

Install prerequisites

+
    +
  1. Install ClamAV dependencies +
      +

    1. Install the developer tools

      +
      sudo yum groupinstall "Development Tools"
      2. +

    2. Install library dependencies

      +
      sudo yum install openssl openssl-devel libcurl-devel zlib-devel libpng-devel libxml2-devel json-c-devel bzip2-devel pcre2-devel ncurses-devel
      3. +

    3. (very optional) Those wishing to use clamav-milter may wish to install the following

      +
      sudo yum install sendmail sendmail-devel
      4. +
    2. +

  2. Install the unit testing dependencies

    +
    sudo yum valgrind check
    3. +
+

Note: LLVM is also an optional dependency. LLVM will not provide any additional features, but is an alternative method for executing bytecode signatures versus using the built-in bytecode interpreter. Limited performance testing between LLVM and the bytecode interpreter did not yield conclusive evidence that one is "better" than the other. For the sake of simplicity, it is not recommended to install LLVM.

+

Download the latest stable release

+
    +
  1. Open a browser and navigate to the ClamAV downloads page
    2. +
  2. Click clamav-<version>.tar.gz link to download the latest stable release.
    3. +
+

Extract the source archive

+
cd ~/Downloads
+tar xzf clamav-<ver>.tar.gz
+cd clamav-<ver>.tar.gz
+

Configure the build

+

ClamAV's configure script should detect each of the above dependencies automatically.

+

Typical ./configure usage

+
./configure --enable-check
+

Once ./configure completes, it will print a summary. Verify that the packages you installed are in fact being detected.

+

Example configure summary output:

+
configure: Summary of detected features follows
+              OS          : linux-gnu
+              pthreads    : yes (-lpthread)
+configure: Summary of miscellaneous features
+              check       : -lcheck_pic -pthread -lrt -lm -lsubunit
+              fanotify    : yes
+              fdpassing   : 1
+              IPv6        : yes
+configure: Summary of optional tools
+              clamdtop    : -lncurses (auto)
+              milter      : yes (disabled)
+              clamsubmit  : yes (libjson-c-dev found at /usr), libcurl-devel found at /usr)
+configure: Summary of engine performance features
+              release mode: yes
+              llvm        : no (disabled)
+              mempool     : yes
+configure: Summary of engine detection features
+              bzip2       : ok
+              zlib        : /usr
+              unrar       : yes
+              preclass    : yes (libjson-c-dev found at /usr)
+              pcre        : /usr
+              libmspack   : yes (Internal)
+              libxml2     : yes, from /usr
+              yara        : yes
+              fts         : yes (libc)
+ +
    +

  • --with-systemdsystemunitdir - Do not install systemd socket files. This option disables systemd support, but will allow you to make install to a user-owned directory without requiring sudo/root privileges:

    +
    ./configure --with-systemdsystemunitdir=no
    • +

  • --sysconfdir - Install the configuration files to /etc instead of /usr/local/etc:

    +
    ./configure -–sysconfdir=/etc
    • +
  • --prefix - Install ClamAV to a directory other than /usr/local/: +
      +

    • Example 1: Install to a local ./install directory.

      +
      ./configure --prefix=`pwd`/install
      • +

    • Example 2: Install ClamAV locally on an unprivileged shell account.

      +
      ./configure --prefix=$HOME/clamav --disable-clamav --with-systemdsystemunitdir=no
      • +
    • +

  • --disable-clamav - Don't drop super-user priveleges to run freshclam or clamd as the clamav* user.

    +
    ./configure --disable-clamav
    +*Tip: Using this --disable-clamav means that freshclam and clamd will run with root privleges if invoked using sudo. Running clamd or clamscan as root is not recommended. Instead of using this option, you can configure freshclam or clamd to drop to any other user by: +
      +
    • setting the DatabaseOwner option in freshclam.conf and
      • +
    • setting the User option in clamd.conf.
      • +
    • +
+

Please see the ./configure --help for additional options.

+

Compile ClamAV

+

Compile ClamAV with:

+
make -j2
+

Run ClamAV Unit Tests (Optional)

+

For peace of mind, it can be helpful to run a small suite of unit and system tests.

+

Run:

+
make check
+

All tests should pass.* Output will look something like this:

+
    ...
+PASS: check_clamav
+PASS: check_freshclam.sh
+PASS: check_sigtool.sh
+PASS: check_unit_vg.sh
+PASS: check1_clamscan.sh
+PASS: check2_clamd.sh
+PASS: check3_clamd.sh
+PASS: check4_clamd.sh
+PASS: check5_clamd_vg.sh
+PASS: check6_clamd_vg.sh
+SKIP: check7_clamd_hg.sh
+PASS: check8_clamd_hg.sh
+PASS: check9_clamscan_vg.sh
+    ...
+============================================================================
+Testsuite summary for ClamAV 0.100.2
+============================================================================
+# TOTAL: 13
+# PASS:  12
+# SKIP:  1
+# XFAIL: 0
+# FAIL:  0
+# XPASS: 0
+# ERROR: 0
+

Notes:

+
    +
  • The *.vg.sh tests will be skipped unless you run make check VG=1.
    • +
  • The check7_clamd.hg.sh (helgrind) is presently disabled and will be skipped.
    • +
  • For details, see: the Git commit
    • +
+

If you have a failure or an error in the unit tests, it could be that you are missing one or more of the prerequisites.

+

If you are investigating a failure, please do the following:

+

cd unit_tests

+

Use less to read the log for the failed test.
+Example:

+
less check4_clamd.sh.log`
+

To submit a bug report regarding unit text failures, please follow these bug reporting steps.

+

Install ClamAV

+

Install ClamAV with:

+
make install
+

Tip: If installing to the default or other system-owned directory, you may need to use sudo.

+

First time set-up

+

Note: The following instructions assume you used the default install paths (i.e. /usr/local). If you modified the install locations using --prefix or --sysconfdir options, replace /usr/local with your chosen install path.

+

freshclam config

+

Before you can use freshclam to download updates, you need to create a freshclam config. A sample config is provided for you.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogRotate
      • +
    • NotifyClamd
      • +
    • DatabaseOwner
      • +
    3. +

  3. Create the database directory. *Tip: You may need to use sudo.

    +
    mkdir /usr/local/share/clamav
    4. +
+

clamd config (optional)

+

You can run clamscan without setting the config options for clamd. However, the clamd scanning daemon allows you to use clamdscan to perform faster a-la-carte scans, allows you to run multi-threaded scans, and allows you to use clamav-milter if you want to use ClamAV as a mail filter if you host an email server.

+

Additionally, if you are a running modern versions of Linux where the FANOTIFY kernel feature is enabled, clamd has a feature run with On-Access Scanning. When properly configured*, On-Access Scanning can scan files as they are accessed and optionally block access to the file in the event that a signature alerted.

+

Note: At this time, for On-Access Scanning to work, clamd must run with sudo/root privileges. For more details, please see our documentation on On-Access Scanning.

+
    +

  1. Copy the sample config. You may need to use sudo:

    +
    cp /usr/local/etc/clamd.conf.sample /usr/local/etc/clamd.conf
    2. +
  2. Modify the config file using your favourite text editor. Again, you may need to use sudo. +
      +
    • At a minimum, remove the Example line so freshclam can use the config.
      • +
    • You also need to select a Socket option for clamd so clamdscan and other utilities can communicate with clamd. You must enable one of the following. +
        +
      • LocalSocket
        • +
      • TCPSocket
        • +
      • +
    +

    Take the time to look through the options. You can enable the sample options by deleting the # comment characters.

    +

    Some popular options to enable include:

    +
      +
    • LogTime
      • +
    • LogClean
      • +
    • LogRotate
      • +
    • User
      • +
    • ScanOnAccess +
        +
      • OnAccessIncludePath
        • +
      • OnAccessExcludePath
        • +
      • OnAccessPrevention
        • +
      • +
    3. +
+

Configure SELinux for ClamAV

+

Certain distributions (notably RedHat variants) when operating with SELinux enabled use the non-standard antivirus_can_scan_system SELinux option instead of clamd_can_scan_system.

+

At this time, libclamav only sets the clamd_can_scan_system option, so you may need to manually enable antivirus_can_scan_system. If you don't perform this step, freshclam will log something like this when it tests the newly downloaded signature databases:

+
During database load : LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied
+

To allow ClamAV to operate under SELinux, run the following:

+
setsebool -P antivirus_can_scan_system 1
+

Download / Update the signature database

+

Before you can run a scan, you'll need to download the signature databases. Once again, you may need to run with sudo/root privileges.

+

If you installed to a location in your system PATH:

+
freshclam
+

If you installed to another location:

+
/<path>/<to>/<clamav>/<bin>/freshclam
+

Users and on user privileges

+

If you are running freshclam and clamd as root or with sudo, and you did not explicitely configure with --disable-clamav, you will want to ensure that the DatabaseOwner user specified in freshclam.conf owns the database directory so it can download signature udpates.

+

The user that clamd, clamdscan, and clamscan run as may be the same user, but if it isn't -- it merely needs read access to the database directory.

+

If you choose to use the default clamav user to run freshclam and clamd, you'll need to create the clamav group and the clamav user account the first time you install ClamAV.

+
groupadd clamav
+useradd -g clamav -s /bin/false -c "Clam Antivirus" clamav
+

Finally, you will want to set user ownership of the database directory.
+For example:

+
sudo chown -R clamav:clamav /usr/local/share/clamav
+

Usage

+

You should be all set up to run scans.

+

Take a look at our usage documentation to learn about how to use ClamAV each of the utilities.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix.html clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Unix.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Unix.html 2019-08-20 16:09:28.000000000 +0000 @@ -0,0 +1,226 @@ + + + + + + + + + + + + +

Installing ClamAV on Unix / Linux / macOS from Source

+

The TL;DR Step-by-Step Instructions

+ +

Requirements

+

The following is an overview of the tools, libraries, and steps needed to build ClamAV.

+

Required tools:

+
    +
  • gcc or clang
    • +
  • GNU Make (gmake on UNIX systems)
    • +
+

Recommended tools:

+
    +
  • check unit testing framework
    • +
+

Required libraries (including development sources (i.e. ...-dev or ...-devel)):

+
    +
  • zlib
    • +
  • openssl version 0.9.8 or higher
    • +
+

Recommended libraries (including development sources (i.e. ...-dev or ...-devel)):

+
    +
  • pcre2
    • +
  • bzip2
    • +
  • libxml2
    • +
+

Optional libraries (including development sources (i.e. ...-dev or ...-devel)):

+
    +
  • curl library: required for clamsubmit
    • +
  • json-c library: required for clamsubmit
    • +
  • ncurses library: required for clamdtop
    • +
+

ClamAV may execute Bytecode signatures using:

+
    +
  • ClamAV's built-in bytecode interpreter
    • +
  • LLVM for Just-In-Time (JIT) compilation*
    • +
  • System-installed LLVM library (3.2-3.6)
    • +

  • ClamAV's built-in version of LLVM 2.8

    +

    *The performance difference between using LLVM and using the interpeter is negligible. If you prefer to use LLVM / JIT for bytecode signature execution, be advised that we presently only support up to LLVM version 3.6.

    • +
+

The following are thus optional, but required to use LLVM in place of the bytecode interpeter:

+
    +
  • LLVM 3.2 - 3.6
    • +
  • A supported CPU for LLVM JIT, either of: X86, X86-64, PowerPC, PowerPC64
    • +
+

The following are optional, but needed for the LLVM JIT unit tests:

+
    +
  • GNU Make (version 3.79, recommended 3.81 or newer)
    • +
  • Python (version 2.5.4)
    • +
+

Installing ClamAV

+

Private installation on local shell account

+

To install ClamAV locally on an unprivileged shell account you need not create any additional users or groups. Assuming your home directory is /home/gary you should build it as follows:

+
./configure --prefix=/home/gary/clamav --disable-clamav
+make; make install
+

The --disable-clamav switch disables the check for existence of the clamav user and group but clamscan would still require an unprivileged account to work in a superuser mode.

+

Global installation in system-owned directories

+

Adding new system user and group

+

If installing to the system, it is recommended to set up at least one special user account to run freshclam and clamd. You may choose to set up two separate accounts, one for each. You only need to create these accounts the first time you install ClamAV.

+

These are instructions specific to some popular operating systems:

+ +

If your operating system isn't specified above, and your OS does not have the groupadd and useradd utilities, consult a system manual. Don’t forget to lock access to the account!

+

Compiling ClamAV for global installation

+

Once you have created the clamav user and group, please extract the archive:

+
tar xzf clamav-<ver>.tar.gz
+cd clamav-<ver>
+

Assuming you want to install the configuration files in /etc, configure and build the software as follows:

+
./configure --sysconfdir=/etc
+make
+su -c "make install"
+

In the last step, the software is installed into the /usr/local directory and the config files into /etc. WARNING: Never enable the SUID or SGID bits for Clam AntiVirus binaries.

+

First-time set-up

+

First, create a database directory. This would be located under the install path share/clamav. For example:

+
    +
  • /usr/local/share/clamav
    • +
  • ~/clamav/share/clamav
    • +
+

You will need to create freshclam.conf and clamd.conf files in the config directory. In the above example, we chose /etc, so run the following.

+
sudo cp /etc/freshclam.conf.sample /etc/freshclam.conf
+sudo cp /etc/clamd.conf.sample /etc/clamd.conf
+

At a minimum, you will need to edit each file and remove or comment-out the Example line. In addition, for clamd.conf you will need to enable either LocalSocket or TCPSocket.

+

For additional recommendations, please read:

+ +

Test your installation

+

To test your local installation execute:

+
~/clamav/bin/freshclam
+~/clamav/bin/clamscan ~
+

To test your system installation execute:

+
sudo freshclam
+sudo clamscan ~
+

Compilation with clamav-milter enabled

+

The libmilter package and its development files are required. To enable clamav-milter, configure ClamAV with

+
./configure --enable-milter
+

Using a system-installed LLVM library

+

To configure ClamAV to use a system-installed LLVM library:

+
./configure --with-system-llvm=/myllvm/bin/llvm-config
+make
+sudo make install
+

The argument to --with-system-llvm indicates the path name of the LLVM configuration utility (llvm-config). Alternatively, you may use --enable-llvm and ./configure will search for LLVM in /usr/local/ and then /usr.

+

Recommended versions of LLVM are 3.2 - 3.6. Some installations have reported problems using earlier LLVM versions. Versions of LLVM beyond 3.6 are not currently supported in ClamAV.

+

Running unit tests

+

ClamAV includes unit tests that allow you to test that the compiled binaries work correctly on your platform.

+

The first step is to use your OS’s package manager to install the check package. If your OS doesn’t have that package, you can download it from http://check.sourceforge.net/, build it and install it.

+

To help clamav’s configure script locate check, it is recommended that you install pkg-config, preferably using your OS’s package manager, or from http://pkg-config.freedesktop.org.

+

The recommended way to run unit-tests is the following, which ensures you will get an error if unit tests cannot be built:

+
./configure --enable-check
+make
+make check
+

When make check is finished, you should get a message similar to this:

+
==================
+All 8 tests passed
+==================
+

If a unit test fails, you get a message similar to the following. Note that in older versions of make check may report failures due to the absence of optional packages. Please make sure you have the latest versions of the components noted in section /refsec:components. See the next section on how to report a bug when a unit test fails.

+
========================================
+1 of 8 tests failed
+Please report to https://bugzilla.clamav.net/
+========================================
+

If unit tests are disabled (and you didn’t use -–enable-check), you will get this message:

+
*** Unit tests disabled in this build
+*** Use ./configure --enable-check to enable them
+
+SKIP: check_clamav
+PASS: check_clamd.sh
+PASS: check_freshclam.sh
+PASS: check_sigtool.sh
+PASS: check_clamscan.sh
+======================
+All 4 tests passed
+(1 tests were not run)
+======================
+

Running ./configure --enable-check should tell you why.

+

Reporting a unit test failure bug

+

If make check reports failed tests, we encourage you to report a bug on bugzilla.

+

When writing a bug report regarding failed unit tests, please provide the following:

+
    +
  • The exact output from make check
    • +
  • Output of uname -mrsp
    • +
  • your config.log
    • +
  • The following files from the unit_tests/ directory:
    • +
  • test.log
    • +
  • clamscan.log
    • +

  • clamdscan.log

    • +
  • /tmp/clamd-test.log if it exists
    • +
  • where and how you installed the check package
    • +
  • Output of pkg-config check --cflags --libs
    • +

  • Optionally if valgrind is available on your platform, the output of the following:

    +
    make check
+CK_FORK=no ./libtool --mode=execute valgrind unit_tests/check_clamav
    • +
+

Obtain Latest ClamAV anti-virus signature databases

+

Before you can run clamd, clamdscan, or clamscan, you must have ClamAV Virus Database (.cvd) file(s) installed in the appropriate location on your system. The default location for these database files are /usr/local/share/clamav.

+

Here is a listing of currently available ClamAV Virus Database Files:

+
    +
  • bytecode.cvd (signatures to detect bytecode in files)
    • +
  • main.cvd (main ClamAV virus database file)
    • +
  • daily.cvd (daily update file for ClamAV virus databases)
    • +
  • safebrowsing.cvd (virus signatures for safe browsing)
    • +
+

These files should be downloaded using the freshclam utility on a periodic basis. While using HTTPS to directly download the CVDs is possible, using freshclam is the preferred method of keeping the ClamAV virus database files up to date. freshclam can download database difference files (.cdiff) to get the latest signature definitions without downloading whole CVD files. This saves a considerable amount of bandwidth.

+

For more information on how to configure freshclam to do automatic/scheduled updates, see the freshclam configuration section of our Configuration guide.

+

Please see the freshclam usage section for additional details on freshclam).

+

Binary packages

+

As an alternative to building and installing from source, most Linux package managers provide pre-compiled ClamAV packages.

+

For more information about installing ClamAV via a Package Manager, please visit
+the "other versions" section on the ClamAV.net Downloads page.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Windows.html clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Windows.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Installation-Windows.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Installation-Windows.html 2019-08-20 16:09:27.000000000 +0000 @@ -0,0 +1,84 @@ + + + + + + + + + + + +

Installing ClamAV on Windows

+

If you wish to build ClamAV from source using Visual Studio 2015, please head over to the Win32 ClamAV Build Instructions located in our source release materials on ClamAV.net and on GitHub.

+

Install using the ClamAV Windows Installer

+

Important: Installing ClamAV using the Installer will require Administrator privileges.

+
    +
  1. Download: http://www.clamav.net/downloads/production/ClamAV-0.101.4.exe
    2. +
  2. Locate the file in your Downloads directory.
    3. +
  3. Right-click on ClamAV-0.101.4.exe and select Run as administrator. You may receive a warning message along the lines of "Windows protected your PC". Select More info and then select Run anyway.
    4. +
  4. Select I accept the agreement and click Next.
    5. +
  5. Click Next again. If you've removed a previous installation of ClamAV, you may receive the prompt "The folder ... already exists...". If you do, select Yes.
    6. +
  6. Click Install.
    7. +
  7. Click Finish.
    8. +
  8. Press the Windows-key and type powershell but DO NOT press Enter. Right-click on Windows PowerShell at the top of the menu and select Run as administrator. Your computer may warn you Do you want to allow this app to make changes to your device? Click Yes.
    9. +

  9. Verify that the prompt in the PowerShell window looks like this:

    +
    PS C:\WINDOWS\system32>
    10. +

  10. In the Adminstrator PowerShell window, enter the following to navigate to the ClamAV install directory:

    +
    cd "c:\program files\clamav"
    11. +
+

Continue on to "First Time Set-Up" below...

+

Install using the ClamAV Portable Install Package

+
    +
  1. Download: https://www.clamav.net/downloads/production/clamav-0.101.4-win-x64-portable.zip
    2. +
  2. Unzip it.
    3. +
  3. Open the clamav-0.101.4-win-x64-portable directory.
    4. +
  4. Hold down Shift and then right-click on the background in the current directory (but not on one of the files). Select "Open PowerShell window here". If that option doesn't appear, try again.
    5. +
+

Continue on to "First Time Set-Up"...

+

First Time Set-Up

+

In the PowerShell window, perform the following tasks:

+
    +

  • Run:

    +
    copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
    • +

  • Run:

    +
    write.exe .\freshclam.conf
    • +

  • WordPad will pop up. Delete the line that says "Example". Save the file and close WordPad.

    • +
+

Next Steps

+

Download the Signature Databases

+

Before you can start the ClamAV scanning engine (using either clamd or clamscan), you must first have ClamAV Virus Database (.cvd) file(s) installed in the appropriate location on your system. The default location for these database files is C:\Program Files\ClamAV\database, the database directory of your ` (in Windows).

+

Continuing in the PowerShell window:

+
    +

  1. Run:

    +
    .\freshclam.exe
    2. +
  2. freshclam will download some files and drop them in the database directory. This can take a minute or two depending on how fast your internet connection is. The files are a pretty large.
    3. +

  3. You are now ready to perform scans with ClamAV. If you using the portable install package, you may now copy the entire clamav-0.100.1-win-x64-portable directory to the computer(s) you wish to scan.

    4. +
+

Steps to Perform Basic Scanning

+
    +

  • Run this to scan the files in the current directory:

    +
    .\clamscan.exe .
    • +
+

This will scan the current directory. At the end of the scan, it will display a summary. If you notice in the clamscan output, it only scanned something like 60 files, even though there are more files in subdirectories. By default, clamscan will only scan files in the current directory.

+
    +

  • Run this to scan all the files in the current directory:

    +
    .\clamscan.exe --recursive .
    • +

  • Run this to scan ALL the files on your C: drive, it will take quite a while. Keep in mind that you can cancel it at any time by pressing Ctrl-C:

    +
    .\clamscan --recursive C:\
    • +

  • For more information on ways you can use clamscan, run:

    +
    .\clamscan.exe --help
    • +
+

Faster a-la-carte Scanning with clamd

+

You may have noticed that clamscan takes a while to get started. This is because it loads the signature database each time you start a scan. If you require faster scanning of individual files, you will want to use clamd with clamdscan instead.

+

Continuing in the PowerShell window:

+
    +

  1. Run:

    +
    .\clamd.exe
    +The application will take a moment to load and then appear to hang, but it is in fact waiting for scanning commands from clamdscan.
    2. +
  2. Open a second PowerShell window as you did above, in the same directory.
    3. +

  3. In the second PowerShell window, you can now run clamdscan much the same way you did with clamscan above.

    +
    .\clamdscan.exe .
    4. +
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Introduction.html clamav-0.101.4+dfsg/docs/html/UserManual/Introduction.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Introduction.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Introduction.html 2019-08-20 16:09:27.000000000 +0000 @@ -0,0 +1,186 @@ + + + + + + + + + + + + +

Introduction

+

Clam AntiVirus is an open source (GPLv2) anti-virus toolkit, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.

+

Features

+

Capabilities

+
    +
  • ClamAV is designed to scan files quickly.
    • +
  • Real time protection (Linux only). Our scanning daemon supports on-access scanning on modern versions of Linux, including the ability to block file access until a file has been scanned.
    • +
  • ClamAV detects over 1 million viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats.
    • +
  • The built-in bytecode interpreter allows the ClamAV signature writers to create and distribute very complex detection routines and remotely enhance the scanner’s functionality.
    • +
  • Signed signature databases ensure that ClamAV will only execute trusted signature definitions.
    • +
  • ClamAV scans within archives and compressed files but also protects against archive bombs. Built-in archive extraction capabilities include:
    • +
  • Zip (including SFX)
    • +
  • RAR (including SFX)
    • +
  • 7Zip
    • +
  • ARJ (including SFX)
    • +
  • Tar
    • +
  • CPIO
    • +
  • Gzip
    • +
  • Bzip2
    • +
  • DMG
    • +
  • IMG
    • +
  • ISO 9660
    • +
  • PKG
    • +
  • HFS+ partition
    • +
  • HFSX partition
    • +
  • APM disk image
    • +
  • GPT disk image
    • +
  • MBR disk image
    • +
  • XAR
    • +
  • XZ
    • +
  • MS OLE2
    • +
  • MS Cabinet Files (including SFX)
    • +
  • MS CHM (Compiled HTML)
    • +
  • MS SZDD compression format
    • +
  • BinHex
    • +
  • SIS (SymbianOS packages)
    • +
  • AutoIt
    • +
  • InstallShield
    • +
  • Supports Windows executable file parsing, also known as Portable Executables (PE) both 32/64-bit, including PE files that are compressed or obfuscated with:
    • +
  • AsPack
    • +
  • UPX
    • +
  • FSG
    • +
  • Petite
    • +
  • PeSpin
    • +
  • NsPack
    • +
  • wwpack32
    • +
  • MEW
    • +
  • Upack
    • +
  • Y0da Cryptor
    • +
  • Supports ELF and Mach-O files (both 32- and 64-bit)
    • +
  • Supports almost all mail file formats
    • +
  • Support for other special files/formats includes:
    • +
  • HTML
    • +
  • RTF
    • +
  • PDF
    • +
  • Files encrypted with CryptFF and ScrEnc
    • +
  • uuencode
    • +
  • TNEF (winmail.dat)
    • +
  • Advanced database updater with support for scripted updates, digital signatures and DNS based database version queries
    • +
+

License

+

ClamAV is licensed under the GNU General Public License, Version 2.

+

Supported platforms

+

Clam AntiVirus is highly cross-platform. The development team cannot test every OS, so we have chosen to test ClamAV using the two most recent Long Term Support (LTS) versions of each of the most popular desktop operating systems. Our regularly tested operating systems include:

+
    +
  • GNU/Linux
    • +
  • Ubuntu +
      +
    • 16.04
      • +
    • 18.04
      • +
    • +
  • Debian +
      +
    • 7
      • +
    • 8
      • +
    • +
  • CentOS +
      +
    • 6
      • +
    • 7
      • +
    • +
  • UNIX
    • +
  • Solaris +
      +
    • 11
      • +
    • +
  • FreeBSD +
      +
    • 10
      • +
    • 11
      • +
    • +
  • macOS +
      +
    • 10.13 (High Sierra)
      • +
    • 10.14 (Mojave)
      • +
    • +
  • Windows
    • +
  • 7
    • +
  • 10
    • +
+ +

The following minimum recommended system requirements are for using clamscan or clamd and clamdscan binaries with the standard ClamAV signature database provided by Cisco.

+

Minimum recommended RAM:

+
    +
  • FreeBSD and Linux server edition: 1 GiB+
    • +
  • Linux non-server edition: 2 GiB+
    • +
  • Windows 7 & 10 32-bit: 2 GiB+
    • +
  • Windows 7 & 10 64-bit: 3 GiB+
    • +
  • macOS: 3 GiB+
    • +
+

Minimum recommended CPU:

+
    +
  • FreeBSD and Linux systems: 1 CPU 2.0 Ghz+
    • +
  • Windows 7 & 10: 1 CPU 2.0 Ghz+
    • +
  • OSX: 2 CPUs at 2.0 Ghz+
    • +
+

Minimum available hard disk space required:

+

For the ClamAV application we recommend having 5 GB of free space available. This recommendation is in addition to the recommended disk space for each OS.

+

Please note: The tests to determine these minimum requirements were performed on systems that were not running other applications. If other applications are being run on the system, additional resources will be required in addition to our recommended minimums.

+

Mailing lists and IRC channel

+

If you have a trouble installing or using ClamAV try asking on our mailing lists. There are four lists available:

+
    +
  • clamav-announce*lists.clamav.net - info about new versions, moderated
    • +
  • clamav-users*lists.clamav.net - user questions
    • +
  • clamav-devel*lists.clamav.net - technical discussions
    • +
  • clamav-virusdb*lists.clamav.net - database update announcements, moderated
    • +
+

You can subscribe and search the mailing list archives at: https://www.clamav.net/contact.html#ml

+

Alternatively you can try asking on the #clamav IRC channel - launch your favourite irc client and type:

+
    /server irc.freenode.net
+    /join #clamav
+

Submitting New or Otherwise Undetected Malware

+

If you've got a virus which is not detected by the current version of ClamAV using the latest signature databases, please submit the sample for review at our website:

+

https://www.clamav.net/reports/malware

+

Likewise, if you have a benign file that is flagging as a virus and you wish to report a False Positive, please submit the sample for review at our website:

+

https://www.clamav.net/reports/fp

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/libclamav.html clamav-0.101.4+dfsg/docs/html/UserManual/libclamav.html --- clamav-0.100.3+dfsg/docs/html/UserManual/libclamav.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/libclamav.html 2019-08-20 16:09:27.000000000 +0000 @@ -0,0 +1,377 @@ + + + + + + + + + + + + +

LibClamAV

+

Libclamav provides an easy and effective way to add a virus protection into your software. The library is thread-safe and transparently recognizes and scans within archives, mail files, MS Office document files, executables and other special formats.

+

License

+

Libclamav is licensed under the GNU GPL v2 license. This means you are not allowed to link commercial, closed-source software against it. All software using libclamav must be GPL compliant.

+

Supported formats and features

+

Executables

+

The library has a built-in support for 32- and 64-bit Portable Executable, ELF and Mach-O files. Additionally, it can handle PE files compressed or obfuscated with the following tools:

+
    +
  • Aspack (2.12)
    • +
  • UPX (all versions)
    • +
  • FSG (1.3, 1.31, 1.33, 2.0)
    • +
  • Petite (2.x)
    • +
  • PeSpin (1.1)
    • +
  • NsPack
    • +
  • wwpack32 (1.20)
    • +
  • MEW
    • +
  • Upack
    • +
  • Y0da Cryptor (1.3)
    • +
+

Mail files

+

Libclamav can handle almost every mail file format including TNEF (winmail.dat) attachments.

+

Archives and compressed files

+

The following archive and compression formats are supported by internal handlers:

+
    +
  • Zip (+ SFX)
    • +
  • RAR (+ SFX)
    • +
  • 7Zip
    • +
  • Tar
    • +
  • CPIO
    • +
  • Gzip
    • +
  • Bzip2
    • +
  • DMG
    • +
  • IMG
    • +
  • ISO 9660
    • +
  • PKG
    • +
  • HFS+ partition
    • +
  • HFSX partition
    • +
  • APM disk image
    • +
  • GPT disk image
    • +
  • MBR disk image
    • +
  • XAR
    • +
  • XZ
    • +
  • MS OLE2
    • +
  • MS Cabinet Files (+ SFX)
    • +
  • MS CHM (Compiled HTML)
    • +
  • MS SZDD compression format
    • +
  • BinHex
    • +
  • SIS (SymbianOS packages)
    • +
  • AutoIt
    • +
  • NSIS
    • +
  • InstallShield
    • +
+

Documents

+

The most popular file formats are supported:

+
    +
  • MS Office and MacOffice files
    • +
  • RTF
    • +
  • PDF
    • +
  • HTML
    • +
+

In the case of Office, RTF and PDF files, libclamav will only extract the embedded objects and will not decode the text data itself. The text decoding and normalization is only performed for HTML files.

+

Data Loss Prevention

+

Libclamav includes a DLP module which can detect the following credit card issuers: AMEX, VISA, MasterCard, Discover, Diner’s Club, and JCB and U.S. social security numbers inside text files.

+

Future versions of Libclamav may include additional features to detect other credit cards and other forms of PII (Personally Identifiable Information) which may be transmitted without the benefit of being encrypted.

+

Others

+

Libclamav can handle various obfuscators, encoders, files vulnerable to security risks such as:

+
    +
  • JPEG (exploit detection)
    • +
  • RIFF (exploit detection)
    • +
  • uuencode
    • +
  • ScrEnc obfuscation
    • +
  • CryptFF
    • +
+

API

+

Header file

+

Every program using libclamav must include the header file clamav.h:

+
    #include <clamav.h>
+

Initialization

+

Before using libclamav, you should call cl_init() to initialize it. CL_INIT_DEFAULT is a macro that can be passed to cl_init() representing the default initialization settings. When it’s done, you’re ready to create a new scan engine by calling cl_engine_new(). To free resources allocated by the engine use cl_engine_free(). Function prototypes:

+
    int cl_init(unsigned int options);
+    struct cl_engine *cl_engine_new(void);
+    int cl_engine_free(struct cl_engine *engine);
+

cl_init() and cl_engine_free() return CL_SUCCESS on success or another code on error. cl_engine_new() return a pointer or NULL if there’s not enough memory to allocate a new engine structure.

+

Database loading

+

The following set of functions provides an interface for loading the virus database:

+
    const char *cl_retdbdir(void);
+
+    int cl_load(const char *path, struct cl_engine *engine,
+            unsigned int *signo, unsigned int options);
+

cl_retdbdir() returns the default (hardcoded) path to the directory with ClamAV databases. cl_load() loads a single database file or all databases from a given directory (when path points to a directory). The second argument is used for passing in the pointer to the engine that should be previously allocated with cl_engine_new(). A number of loaded signatures will be added to signo. The last argument can pass the following flags:

+
    +
  • CL_DB_STDOPT
    +This is an alias for a recommended set of scan options.
    • +
  • CL_DB_PHISHING
    +Load phishing signatures.
    • +
  • CL_DB_PHISHING_URLS
    +Initialize the phishing detection module and load .wdb and .pdb
    +files.
    • +
  • CL_DB_PUA
    +Load signatures for Potentially Unwanted Applications.
    • +
  • CL_DB_OFFICIAL_ONLY
    +Only load official signatures from digitally signed databases.
    • +
  • CL_DB_BYTECODE
    +Load bytecode.
    • +
+

cl_load() returns CL_SUCCESS on success and another code on failure.

+
        ...
+        struct cl_engine *engine;
+        unsigned int sigs = 0;
+        int ret;
+
+    if((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) {
+        printf("cl_init() error: %s\n", cl_strerror(ret));
+        return 1;
+    }
+
+    if(!(engine = cl_engine_new())) {
+        printf("Can't create new engine\n");
+        return 1;
+    }
+
+    ret = cl_load(cl_retdbdir(), engine, &sigs, CL_DB_STDOPT);
+

Error handling

+

Use cl_strerror() to convert error codes into human readable messages. The function returns a statically allocated string:

+
    if(ret != CL_SUCCESS) {
+        printf("cl_load() error: %s\n", cl_strerror(ret));
+        cl_engine_free(engine);
+        return 1;
+    }
+

Engine structure

+

When all required databases are loaded you should prepare the detection engine by calling cl_engine_compile(). In case of failure you should still free the memory allocated to the engine with cl_engine_free():

+
    int cl_engine_compile(struct cl_engine *engine);
+

In our example:

+
    if((ret = cl_engine_compile(engine)) != CL_SUCCESS) {
+        printf("cl_engine_compile() error: %s\n", cl_strerror(ret));
+        cl_engine_free(engine);
+        return 1;
+    }
+

Limits

+

When you create a new engine with cl_engine_new(), it will have all internal settings set to default values as recommended by the ClamAV authors. It’s possible to check and modify the values (numerical and strings) using the following set of functions:

+
int cl_engine_set_num(struct cl_engine *engine,
+  enum cl_engine_field field, long long num);
+
+long long cl_engine_get_num(const struct cl_engine *engine,
+  enum cl_engine_field field, int *err);
+
+int cl_engine_set_str(struct cl_engine *engine,
+  enum cl_engine_field field, const char *str);
+
+const char *cl_engine_get_str(const struct cl_engine *engine,
+  enum cl_engine_field field, int *err);
+

Please don’t modify the default values unless you know what you’re doing. Refer to the ClamAV sources (clamscan, clamd) for examples.

+

Database checks

+

It’s very important to keep the internal instance of the database up to date. You can watch database changes with the cl_stat..() family of functions.

+
    int cl_statinidir(const char *dirname, struct cl_stat *dbstat);
+    int cl_statchkdir(const struct cl_stat *dbstat);
+    int cl_statfree(struct cl_stat *dbstat);
+

Initialization:

+
        ...
+        struct cl_stat dbstat;
+
+    memset(&dbstat, 0, sizeof(struct cl_stat));
+    cl_statinidir(dbdir, &dbstat);
+

To check for a change you just need to call cl_statchkdir and check its return value (0 - no change, 1 - some change occurred). Remember to reset the cl_stat structure after reloading the database.

+
    if(cl_statchkdir(&dbstat) == 1) {
+        reload_database...;
+        cl_statfree(&dbstat);
+        cl_statinidir(cl_retdbdir(), &dbstat);
+    }
+

Libclamav (\ge0.96) includes and additional call to check the number of signatures that can be loaded from a given directory:

+
    int cl_countsigs(const char *path, unsigned int countoptions,
+        unsigned int *sigs);
+

The first argument points to the database directory, the second one specifies what signatures should be counted: CL_COUNTSIGS_OFFICIAL (official signatures), CL_COUNTSIGS_UNOFFICIAL (third party signatures), CL_COUNTSIGS_ALL (all signatures). The last argument points to the counter to which the number of detected signatures will be added (therefore the counter should be initially set to 0). The call returns CL_SUCCESS or an error code.

+

Data scan functions

+

It’s possible to scan a file or descriptor using:

+
    int cl_scanfile(
+        const char *filename,
+        const char **virname,
+        unsigned long int *scanned,
+        const struct cl_engine *engine,
+        struct cl_scan_options *options);
+
+    int cl_scandesc(
+        int desc,
+        const char *filename,
+        const char **virname,
+        unsigned long int *scanned,
+        const struct cl_engine *engine,
+        struct cl_scan_options *options);
+

Both functions will store a virus name under the pointer virname, the virus name is part of the engine structure and must not be released directly. If the third argument (scanned) is not NULL, the functions will increase its value with the size of scanned data (in CL_COUNT_PRECISION units). The last argument (options) requires a pointer to a data structure that specifies the scan options. The data structure should be memset() Each variable in the structure is a bit-flag field. The structure definition is:

+
    struct cl_scan_options {
+        uint32_t general;
+        uint32_t parse;
+        uint32_t alert;
+        uint32_t heuristic_alert;
+        uint32_t mail;
+        uint32_t dev;
+    };
+

Supported flags for each of the fields are as follows:

+

general - General scanning options.

+
    +
  • CL_SCAN_GENERAL_ALLMATCHES
    +Scan in all-match mode
    • +
  • CL_SCAN_GENERAL_COLLECT_METADATA
    +Collect metadata (--gen-json)
    • +
  • CL_SCAN_GENERAL_HEURISTICS
    +Option to enable heuristic alerts. Required for any of the heuristic alerting options to work.
    • +
+

parse - Options to enable/disable specific parsing capabilities. Generally you will want to enable all parsers. The easiest way to do this is to set the parse flags to ~0.

+
    +
  • CL_SCAN_PARSE_ARCHIVE
    +This flag enables transparent scanning of various archive formats.
    • +
  • CL_SCAN_PARSE_ELF
    +Enable support for ELF files.
    • +
  • CL_SCAN_PARSE_PDF
    +Enables scanning within PDF files.
    • +
  • CL_SCAN_PARSE_SWF
    +Enables scanning within SWF files, notably compressed SWF.
    • +
  • CL_SCAN_PARSE_HWP
    +Enables scanning of Hangul Word Processor (HWP) files.
    • +
  • CL_SCAN_PARSE_XMLDOCS
    +Enables scanning of XML-formatted documents (e.g. Word, Excel, Powerpoint, HWP).
    • +
  • CL_SCAN_PARSE_MAIL
    +Enable support for mail files.
    • +
  • CL_SCAN_PARSE_OLE2
    +Enables support for OLE2 containers (used by MS Office and .msi files).
    • +
  • CL_SCAN_PARSE_HTML
    +This flag enables HTML normalisation (including ScrEnc decryption).
    • +
  • CL_SCAN_PARSE_PE
    +This flag enables deep scanning of Portable Executable files and allows libclamav to unpack executables compressed with run-time unpackers.
    • +
+

heuristic - Options to enable specific heuristic alerts

+
    +
  • CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE
    +Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported.
    • +
  • CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE
    +With this flag the library will mark encrypted archives as viruses (encrypted .zip, .7zip, .rar).
    • +
  • CL_SCAN_HEURISTIC_ENCRYPTED_DOC
    +With this flag the library will mark encrypted docuemnts as viruses (encrypted .pdf).
    • +
  • CL_SCAN_HEURISTIC_BROKEN
    +libclamav will try to detect broken executables and mark them as Broken.Executable.
    • +
  • CL_SCAN_HEURISTIC_EXCEEDS_MAX
    +Alert when the scan of any file exceeds maximums such as max filesize, max scansize, max recursion level.
    • +
  • CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH
    +Heuristic for phishing module: alert on SSL mismatches in URLs.
    • +
  • CL_SCAN_HEURISTIC_PHISHING_CLOAK
    +Heuristic for phishing module: alert on cloaked URLs.
    • +
  • CL_SCAN_HEURISTIC_MACROS
    +OLE2 containers, which contain VBA macros will be marked infected (Heuristics.OLE2.ContainsMacros).
    • +
  • CL_SCAN_HEURISTIC_PARTITION_INTXN
    +alert if partition table size doesn't make sense
    • +
  • CL_SCAN_HEURISTIC_STRUCTURED
    +Enable the data loss prevention (DLP) module which scans for credit card and SSN numbers. i.e. alert when detecting personal information
    • +
  • CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL
    +Search for [and alert when detecting] SSNs formatted as xx-yy-zzzz.
    • +
  • CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED
    +Search for [and alert when detecting] SSNs formatted as xxyyzzzz.
    • +
+

mail - Options to enable specific mail parsing features

+
    +
  • CL_SCAN_MAIL_PARTIAL_MESSAGE
    +Scan RFC1341 messages split over many emails. You will need to periodically clean up $TemporaryDirectory/clamav-partial directory.
    • +
+

dev - Options designed for use by ClamAV developers

+
    +
  • CL_SCAN_DEV_COLLECT_SHA
    +Enables hash output in sha-collect builds - for internal use only
    • +
  • CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO
    +Collect performance timings
    • +
+

All functions return CL_CLEAN when the file seems clean, CL_VIRUS when a virus is detected and another value on failure.

+
        ...
+        const char *virname;
+
+    if((ret = cl_scanfile("/tmp/test.exe", &virname, NULL, engine,
+    &options)) == CL_VIRUS) {
+        printf("Virus detected: %s\n", virname);
+    } else {
+        printf("No virus detected.\n");
+        if(ret != CL_CLEAN)
+            printf("Error: %s\n", cl_strerror(ret));
+    }
+

Memory

+

Because the engine structure occupies a few megabytes of system memory, you should release it with cl_engine_free() if you no longer need to scan files.

+

Forking daemons

+

If you’re using libclamav with a forking daemon you should call srand() inside a forked child before making any calls to the libclamav functions. This will avoid possible collisions with temporary filenames created by other processes of the daemon. This procedure is not required for multi-threaded daemons.

+

clamav-config

+

Use clamav-config to check compilation information for libclamav.

+
    $ clamav-config --libs
+    -L/usr/local/lib -lz -lbz2 -lgmp -lpthread
+    $ clamav-config --cflags
+    -I/usr/local/include -g -O2
+

Example

+

You will find an example scanner application in the clamav source package (/example). Provided you have ClamAV already installed, execute the following to compile it:

+
    gcc -Wall ex1.c -o ex1 -lclamav
+

CVD format

+

CVD (ClamAV Virus Database) is a digitally signed tarball containing one or more databases. The header is a 512-bytes long string with colon separated fields:

+
ClamAV-VDB:build time:version:number of signatures:functionality
+level required:MD5 checksum:digital signature:builder name:build time (sec)
+

sigtool --info displays detailed information on CVD files:

+
$ sigtool -i daily.cvd
+File: daily.cvd
+Build time: 10 Mar 2008 10:45 +0000
+Version: 6191
+Signatures: 59084
+Functionality level: 26
+Builder: ccordes
+MD5: 6e6e29dae36b4b7315932c921e568330
+Digital signature: zz9irc9irupR3z7yX6J+OR6XdFPUat4HIM9ERn3kAcOWpcMFxq
+Fs4toG5WJsHda0Jj92IUusZ7wAgYjpai1Nr+jFfXHsJxv0dBkS5/XWMntj0T1ctNgqmiF
++RLU6V0VeTl4Oej3Aya0cVpd9K4XXevEO2eTTvzWNCAq0ZzWNdjc
+Verification OK.
+

Graphics

+

The current ClamAV logo was created by Alicia Willet, Talos.

+

OpenAntiVirus

+

Our database includes the virus database (about 7000 signatures) from OpenAntiVirus (http://OpenAntiVirus.org).

+
    +

  1. Subscribers are not allowed to post to the mailing list

    2. +

  2. For Windows instructions please see win32/README in the main source code directory.

    3. +

  3. See section 3.7 on how to run the unit tests

    4. +

  4. if not available ClamAV will fall back to an interpreter

    5. +

  5. Note that several versions of GCC have bugs when compiling LLVM, see http://llvm.org/docs/GettingStarted.html#brokengcc for a full list.

    6. +

  6. The configure script in ClamAV automatically enables the unit tests, if it finds the check framework, however it doesn’t consider it a fatal error if unit tests cannot be enabled.

    7. +

  7. To get more info on clamscan options run ’man clamscan’

    8. +

  8. man 5 clamd.conf

    9. +

  9. Remember to initialize the virus counter variable with 0.

    10. +
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/OnAccess.html clamav-0.101.4+dfsg/docs/html/UserManual/OnAccess.html --- clamav-0.100.3+dfsg/docs/html/UserManual/OnAccess.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/OnAccess.html 2019-08-20 16:09:28.000000000 +0000 @@ -0,0 +1,75 @@ + + + + + + + + + + + +

On-Access Scanning

+
+

Purpose

+
+

This guide is for users interested in leveraging and understanding ClamAV's On-Access Scanning feature. It will walk through how to set up and use the On-Access Scanner and step through some common issues and their solutions.

+
+

Requirements

+
+

On-Access is only available on Linux systems. On Linux, On-Access requires a kernel version >= 3.8. This is because it leverages a kernel api called fanotify to perform its blocking.

+
+

General Use

+
+

To use ClamAV's On-Access Scanner, simply open clamd.conf, set the ScanOnAccess option to yes, and then specify the path(s) you would like to recursively watch with the OnAccessIncludePath option. Finally, set OnAccessPrevention to yes. Then, run clamd with elevated permissions (e.g. sudo clamd). If all went well, the On-Access scanner will now be actively protecting the specified path(s). You can test this by dropping an eicar file into the specified path, and attempting to read/access it (e.g. cat eicar.txt). This will result in an "Operation not permitted" message, triggered by fanotify blocking the access attempt at the kernel level.

+
+

## Troubleshooting

+

Some OS distributors have disabled fanotify, despite kernel support. You can check for fanotify support on your kernel by running the command:

+
+

$ cat /boot/config- | grep FANOTIFY

+
+

You should see the following:

+
CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+

If you see:

+
# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
+

Then ClamAV's On-Access Scanner will still function, scanning and alerting on files normally in real time. However, it will be unable to block access attempts on malicious files. We call this notify-only mode.

+
+

ClamAV's On-Access Scanning system uses a scheme called Dynamic Directory Determination (DDD for short) which is a shorthand way of saying that it tracks the layout of every directory specified with OnAccessIncludePath dynamically, and recursively, in real time. It does this by leveraging inotify which by default has a limited number of watchpoints available for use by a process at any given time. Given the complexity of some directory hierarchies, ClamAV may warn you that it has exhausted its supply of inotify watchpoints (8192 by default). To increase the number of inotify watchpoints available for use by ClamAV (to 524288), run the following command:

+
+

$ echo 524288 | sudo tee -a /proc/sys/fs/inotify/max_user_watches

+
+
+

The OnAccessIncludePath option will not accept / as a valid path. This is because fanotify works by blocking a process' access to a file until a access_ok or access_denied determination has been made by the original fanotify calling process. Thus, by placing fanotify watchpoints on the entire filesystem, key system files may have their access blocked at the kernel level, which will result in a system lockup.

+

This restriction was made to prevent users from "shooting themselves in the foot." However, clever users will find it's possible to circumvent this restriction by using multiple OnAccessIncludePath options to protect most all the filesystem anyways, or simply the paths they truly care about.

+
+

The OnAccessMountPath option uses a different fanotify api configuration which makes it incompatible with OnAccessIncludePath and the DDD System. Therefore, inotify will not be a concern when using this option. Unfortunately, this also means OnAccessExtraScanning (which is built around catching inotify events), and OnAccessExcludePath (which is built upon the DDD System) cannot be used in conjunction with OnAccessMountPath.

+
+

Configuration and Recipes

+
+

More nuanced behavior can be coerced from ClamAV's On-Access Scanner via careful modification to clamd.conf. Each option related to On-Access Scanning is easily identified by looking for the OnAccess prefix pre-pended to each option. The default clamd.conf file contains descriptions of each option, along with any documented limitations or safety features.

+

Below are examples of common use cases, recipes for the correct minimal configuration, and the expected behavioral result.

+
+

Use Case 0x0

+
    +
  • User needs to watch the entire file system, but blocking malicious access attempts isn't a concern
    +ScanOnAccess yes OnAccessMountPath / OnAccessExcludeRootUID yes
    • +
+

This configuration will put the On-Access Scanner into notify-only mode. It will also ensure only non-root, non-clam, user processes will trigger scans against the filesystem.

+
+

Use Case 0x1

+
    +
  • System Administrator needs to watch the home directory of multiple Users, but not all users. Blocking access attempts is un-needed.
    +ScanOnAccess yes OnAccessIncludePath /home OnAccessExcludePath /home/user2 OnAccessExcludePath /home/user4
    • +
+

With this configuration, the On-Access Scanner will watch the entirety of the /home directory recursively in notify-only mode. However, it will recursively exclude the /home/user2 and /home/user4 directories.

+
+

Use Case 0x2

+
    +
  • The user needs to protect a single directory non-recursively and ensure all access attempts on malicious files are blocked.
    +ScanOnAccess yes OnAccessIncludePath /home/user/Downloads OnAccessPrevention yes OnAccessDisableDDD yes
    • +
+

The configuration above will result in non-recursive real-time protection of the /home/user/Downloads directory by ClamAV's On-Access Scanner. Any access attempts that ClamAV detects on malicious files within the top level of the directory hierarchy will be blocked by fanotify at the kernel level.

+
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/AuthenticodeRules.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/AuthenticodeRules.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/AuthenticodeRules.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/AuthenticodeRules.html 2019-08-20 16:09:32.000000000 +0000 @@ -0,0 +1,32 @@ + + + + + + + + + + + +

Trusted and Revoked Certificates

+

Clamav 0.98 checks signed PE files for certificates and verifies each certificate in the chain against a database of trusted and revoked certificates. The signature format is

+
    Name;Trusted;Subject;Serial;Pubkey;Exponent;CodeSign;TimeSign;CertSign;
+    NotBefore;Comment[;minFL[;maxFL]]
+

where the corresponding fields are:

+
    +

  • Name: name of the entry

    • +

  • Trusted: bit field, specifying whether the cert is trusted. 1 for trusted. 0 for revoked

    • +

  • Subject: sha1 of the Subject field in hex

    • +

  • Serial: the serial number as clamscan –debug –verbose reports

    • +

  • Pubkey: the public key in hex

    • +

  • Exponent: the exponent in hex. Currently ignored and hardcoded to 010001 (in hex)

    • +

  • CodeSign: bit field, specifying whether this cert can sign code. 1 for true, 0 for false

    • +

  • TimeSign: bit field. 1 for true, 0 for false

    • +

  • CertSign: bit field, specifying whether this cert can sign other certs. 1 for true, 0 for false

    • +

  • NotBefore: integer, cert should not be added before this variable. Defaults to 0 if left empty

    • +

  • Comment: comments for this entry

    • +
+

The signatures for certs are stored inside .crb files.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/BodySignatureFormat.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/BodySignatureFormat.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/BodySignatureFormat.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/BodySignatureFormat.html 2019-08-20 16:09:31.000000000 +0000 @@ -0,0 +1,126 @@ + + + + + + + + + + + + +

Body-based Signature Content Format

+

ClamAV stores all body-based signatures in a hexadecimal format. In this section by a hex-signature we mean a fragment of malware’s body converted into a hexadecimal string which can be additionally extended using various wildcards.

+

Hexadecimal format

+

You can use sigtool --hex-dump to convert any data into a hex-string:

+
zolw@localhost:/tmp/test$ sigtool --hex-dump
+How do I look in hex?
+486f7720646f2049206c6f6f6b20696e206865783f0a
+

Wildcards

+

ClamAV supports the following wildcards for hex-signatures:

+
    +
  • ??
    • +
+

Match any byte.

+
    +
  • a?
    • +
+

Match a high nibble (the four high bits).

+
    +
  • ?a
    • +
+

Match a low nibble (the four low bits).

+
    +
  • *
    • +
+

Match any number of bytes.

+
    +
  • {n}
    • +
+

Match n bytes.

+
    +
  • {-n}
    • +
+

Match n or less bytes.

+
    +
  • {n-}
    • +
+

Match n or more bytes.

+
    +
  • {n-m}
    • +
+

Match between n and m bytes (where m > n).

+
    +
  • HEXSIG[x-y]aa or aa[x-y]HEXSIG
    • +
+

Match aa anchored to a hex-signature, see Bugzilla ticket 776 for discussion and
+examples.

+

The range signatures * and {} virtually separate a hex-signature into two parts, eg. aabbcc*bbaacc is treated as two sub-signatures aabbcc and bbaacc with any number of bytes between them. It’s a requirement that each sub-signature includes a block of two static characters somewhere in its body. Note that there is one exception to this restriction; that is when the range wildcard is of the form {n} with n<128. In this case, ClamAV uses an optimization and translates {n} to the string consisting of n ?? character wildcards. Character wildcards do not divide hex signatures into two parts and so the two static character requirement does not apply.

+

Character classes

+

ClamAV supports the following character classes for hex-signatures:

+
    +
  • (B)
    • +
+

Match word boundary (including file boundaries).

+
    +
  • (L)
    • +
+

Match CR, CRLF or file boundaries.

+
    +
  • (W)
    • +
+

Match a non-alphanumeric character.

+

Alternate strings

+
    +
  • Single-byte alternates (clamav-0.96) (aa|bb|cc|...) or !(aa|bb|cc|...) Match a member from a set of bytes (eg: aa, bb, cc, ...).
    • +
  • Negation operation can be applied to match any non-member, assumed to be one-byte in length.
    • +

  • Signature modifiers and wildcards cannot be applied.

    • +
  • Multi-byte fixed length alternates (aaaa|bbbb|cccc|...) or !(aaaa|bbbb|cccc|...) Match a member from a set of multi-byte alternates (eg: aaaa, bbbb, cccc, ...) of n-length.
    • +
  • All set members must be the same length.
    • +
  • Negation operation can be applied to match any non-member, assumed to be n-bytes in length (clamav-0.98.2).
    • +

  • Signature modifiers and wildcards cannot be applied.

    • +
  • Generic alternates (clamav-0.99) (alt1|alt2|alt3|...) Match a member from a set of alternates (eg: alt1, alt2, alt3, ...) that can be of variable lengths.
    • +
  • Negation operation cannot be applied.
    • +
  • Signature modifiers and nibble wildcards (eg: ??, a?, ?a) can be applied.
    • +

  • Ranged wildcards (eg: {n-m}) are limited to a fixed range of less than 128 bytes (eg: {1} -> {127}).

    • +
+

Note that using signature modifiers and wildcards classifies the alternate type to be a generic alternate. Thus single-byte alternates and multi-byte fixed length alternates can use signature modifiers and wildcards but will be classified as generic alternate. This means that negation cannot be applied in this situation and there is a slight performance impact.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/BytecodeSignatures.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/BytecodeSignatures.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/BytecodeSignatures.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/BytecodeSignatures.html 2019-08-20 16:09:30.000000000 +0000 @@ -0,0 +1,19 @@ + + + + + + + + + + + +

Bytecode Signatures

+

Bytecode Signatures are the means by which more complex matching can be performed by writing C code to parse sample content at various stages in file extraction.

+

It is less complicated than it sounds. Essentially the signature author writes a function in C is compiled down to an intermediate language called "bytecode". This bytecode is encoded in ASCII .cbc file and distributed in bytecode.[cvd|cld]. When the database is loaded, ClamAV can interpret this bytecode to execute the function.

+

Bytecode functions are provided with a set of API's that may be used to access the sample data, and to access what metadata ClamAV already has concerning the sample.

+

The function may at any time call an API to flag the sample as malicious, and may provide the signature/virus name at that time. This means a single bytecode signature (function) is written to handle a given file type and may trigger different alerts with different signature names as additional malicious characteristics for the file type are identified. That isn't to say that only one bytecode signature may be assigned to a given filetype, but that a single author may find it to be more efficient to use a bytecode signature to identify more than one type of malware.

+

The specifics on how to write and compile bytecode signatures are outside of the scope of this documentation. Extensive documentation on ClamAV Bytecode Signatures are provided with the ClamAV Bytecode Compiler.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/ContainerMetadata.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/ContainerMetadata.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/ContainerMetadata.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/ContainerMetadata.html 2019-08-20 16:09:29.000000000 +0000 @@ -0,0 +1,44 @@ + + + + + + + + + + + +

Signatures based on container metadata

+

ClamAV 0.96 allows creating generic signatures matching files stored inside different container types which meet specific conditions. The signature format is:

+
    VirusName:ContainerType:ContainerSize:FileNameREGEX:
+    FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:
+    Res1:Res2[:MinFL[:MaxFL]]
+

where the corresponding fields are:

+
    +

  • VirusName: Virus name to be displayed when signature matches.

    • +
  • ContainerType: The file type containing the target file. For example:
    • +
  • CL_TYPE_ZIP,
    • +
  • CL_TYPE_RAR,
    • +
  • CL_TYPE_ARJ,
    • +
  • CL_TYPE_MSCAB,
    • +
  • CL_TYPE_7Z,
    • +
  • CL_TYPE_MAIL,
    • +
  • CL_TYPE_(POSIX|OLD)_TAR,
    • +

  • CL_TYPE_CPIO_(OLD|ODC|NEWC|CRC)

    • +
+

Use * as a wild card to indicate that container type may be any file type.
+For a full list of ClamAV file types, see the ClamAV File Types Reference.

+
    +

  • ContainerSize: size of the container file itself (eg. size of the zip archive) specified in bytes as absolute value or range x-y.

    • +

  • FileNameREGEX: regular expression describing name of the target file

    • +

  • FileSizeInContainer: usually compressed size; for MAIL, TAR and CPIO == FileSizeReal; specified in bytes as absolute value or range.

    • +

  • FileSizeReal: usually uncompressed size; for MAIL, TAR and CPIO == FileSizeInContainer; absolute value or range.

    • +

  • IsEncrypted: 1 if the target file is encrypted, 0 if it’s not and * to ignore

    • +

  • FilePos: file position in container (counting from 1); absolute value or range.

    • +

  • Res1: when ContainerType is CL_TYPE_ZIP or CL_TYPE_RAR this field is treated as a CRC sum of the target file specified in hexadecimal format; for other container types it’s ignored.

    • +

  • Res2: not used as of ClamAV 0.96.

    • +
+

The signatures for container files are stored inside .cdb files.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/DatabaseInfo.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/DatabaseInfo.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/DatabaseInfo.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/DatabaseInfo.html 2019-08-20 16:09:33.000000000 +0000 @@ -0,0 +1,20 @@ + + + + + + + + + + + +

Database Info

+

The .info file format specifies information about the other database files unpacked from a CVD or CLD database archive. This file exists for the purposes of validating the correctness of the official ClamAV database container files and cannot be loaded a la carte.

+

The format is simply:

+
name:size:sha256
+

name: The database file name.

+

size: The size in bytes of the database.

+

sha256: A SHA256 hash of the database.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/DynamicConfig.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/DynamicConfig.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/DynamicConfig.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/DynamicConfig.html 2019-08-20 16:09:31.000000000 +0000 @@ -0,0 +1,102 @@ + + + + + + + + + + + + +

Dynamic Configuration (DCONF)

+

ClamAV supports a limited set of configuration options that may be enabled or disabled via settings in the *.cfg database. At this time, these settings are distributed in daily.cfg.

+

The goal of DCONF is to enable the ClamAV team to rapidly disable new or experimental features for specific ClamAV versions if a significant defect is discovered after release.

+

This database is small, and the settings are largely vestigial. The team has not had a need to disable many features in a long time, and so the ClamAV versions in the settings at this time should no longer be in use.

+

The strings and values referenced in daily.cfg are best cross-referenced with the macros and structures defined here:

+ +

The format for a DCONF signature is:

+
Category:Flags:StartFlevel:EndFlevel
+

Category may be one of:

+
    +
  • PE
    • +
  • ELF
    • +
  • MACHO
    • +
  • ARCHIVE
    • +
  • DOCUMENT
    • +
  • MAIL
    • +
  • OTHER
    • +
  • PHISHING
    • +
  • BYTECODE
    • +
  • STATS
    • +
  • PCRE
    • +
+

Flags:

+

Every feature that may be configured via DCONF is listed in struct dconf_module modules in libclamav/dconf.c. Any given feature may be default-on or default-off. Default-on features have the 4th field set to a 1 and default off are set to 0. The Flags field for a given Category overrides the defaults for all of the options listed under that category.

+

A settings of 0x0, for example, means that all options the category be disabled.

+

The macros listed in libclamav/dconf.h will help you identify which bits to set to get the desired results.

+

StartFlevel:

+

This is the FLEVEL of the minimum ClamAV engine for which you want the settings to be in effect.

+

EndFlevel:

+

This is the FLEVEL of the maximum ClamAV engine for which you want the settings to be in effect. You may wish to select 255 to override the defaults of future releases.

+

Example

+

Consider the OTHER_CONF_PDFNAMEOBJ option in the category OTHER.

+
#define OTHER_CONF_UUENC        0x1     // Default: 1
+#define OTHER_CONF_SCRENC       0x2     // Default: 1
+#define OTHER_CONF_RIFF         0x4     // Default: 1
+#define OTHER_CONF_JPEG         0x8     // Default: 1
+#define OTHER_CONF_CRYPTFF      0x10    // Default: 1
+#define OTHER_CONF_DLP          0x20    // Default: 1
+#define OTHER_CONF_MYDOOMLOG    0x40    // Default: 1
+#define OTHER_CONF_PREFILTERING 0x80    // Default: 1
+#define OTHER_CONF_PDFNAMEOBJ   0x100   // Default: 1
+#define OTHER_CONF_PRTNINTXN    0x200   // Default: 1
+#define OTHER_CONF_LZW          0x400   // Default: 1
+

All of the OTHER options, including OTHER_CONF_PDFNAMEOBJ are default-on. To disable the option for ClamAV v0.100.X but leave the other options in their default settings, we would need to set the flags to:

+
0110 1111 1111
+   ^pdfnameobj off
+

Or in hex: 0x6FF

+

The example setting to place in daily.cfg then woudl be:

+
OTHER:0x6FF:90:99
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/EncryptedArchives.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/EncryptedArchives.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/EncryptedArchives.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/EncryptedArchives.html 2019-08-20 16:09:31.000000000 +0000 @@ -0,0 +1,28 @@ + + + + + + + + + + + +

Passwords for archive files [experimental]

+

ClamAV 0.99 allows for users to specify password attempts for certain password-compatible archives. Passwords will be attempted in order of appearance in the password signature file which use the extension of .pwdb. If no passwords apply or none are provided, ClamAV will default to the original behavior of parsing the file. Currently, as of ClamAV 0.99 [flevel 81], only .zip archives using the traditional PKWARE encryption are supported. The signature format is

+
SignatureName;TargetDescriptionBlock;PWStorageType;Password
+

where:

+
    +

  • SignatureName: name to be displayed during debug when a password is successful

    • +
  • TargetDescriptionBlock: provides information about the engine and target file with comma separated Arg:Val pairs
    • +
  • Engine:X-Y: Required engine functionality level. See the FLEVEL reference for details.
    • +

  • Container:CL_TYPE_*: File type of applicable containers

    • +
  • PWStorageType: determines how the password field is parsed
    • +
  • 0 = cleartext
    • +

  • 1 = hex

    • +

  • Password: value used in password attempt

    • +
+

The signatures for password attempts are stored inside .pwdb files.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/ExtendedSignatures.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/ExtendedSignatures.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/ExtendedSignatures.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/ExtendedSignatures.html 2019-08-20 16:09:30.000000000 +0000 @@ -0,0 +1,38 @@ + + + + + + + + + + + +

Extended signature format

+

The extended signature format is ClamAV's most basic type of body-based signature since the deprecation of the original .db database format.

+

Extended sigantures allow for specification of additional information beyond just hexidecimal content such as a file "target type", virus offset, or engine functionality level (FLEVEL), making the detection more reliable.

+

The format is:

+
    MalwareName:TargetType:Offset:HexSignature[:min_flevel:[max_flevel]]
+

MalwareName: The virus name. Should conform to the standards defined here.

+

TargetType: A number specifying the type of the target file: Target Types

+

Offset: An asterisk or a decimal number n possibly combined with a special modifier:

+
    +
  • * = any
    • +
  • n = absolute offset
    • +
  • EOF-n = end of file minus n bytes
    • +
+

Signatures for PE, ELF and Mach-O files additionally support:

+
    +
  • EP+n = entry point plus n bytes (EP+0 for EP)
    • +
  • EP-n = entry point minus n bytes
    • +
  • Sx+n = start of section x’s (counted from 0) data plus n bytes
    • +
  • SEx = entire section x (offset must lie within section boundaries)
    • +
  • SL+n = start of last section plus n bytes
    • +
+

All the above offsets except * can be turned into floating offsets and represented as Offset,MaxShift where MaxShift is an unsigned integer. A floating offset will match every offset between Offset and Offset+MaxShift, eg. 10,5 will match all offsets from 10 to 15 and EP+n,y will match all offsets from EP+n to EP+n+y. Versions of ClamAV older than 0.91 will silently ignore the MaxShift extension and only use Offset. Optional MinFL and MaxFL parameters can restrict the signature to specific engine releases. All signatures in the extended format must be placed inside *.ndb files.

+

HexSignature: The body-based content matching format.

+

min_flevel: (optional) The minimum ClamAV engine that the file type signature works with. See the FLEVEL reference for details. To be used in the event that file type support has been recently added.

+

max_flevel: (optional, requires min_flevel) The maximum ClamAV engine that the file type signature works with. To be used in the event that file type support has been recently removed.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FileTypeMagic.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FileTypeMagic.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FileTypeMagic.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FileTypeMagic.html 2019-08-20 16:09:33.000000000 +0000 @@ -0,0 +1,32 @@ + + + + + + + + + + + +

File Type Magic

+

ClamAV's primary mechanism for determining file types is to match the file with a File Type Magic signature. These file type signatures are compiled into ClamAV, and may also be overridden dynamically using the definition founds found in a *.ftm file.

+

The ClamAV standard signature database includes these definitions in daily.ftm.

+

The signature format is not too disimilar from NDB body-based signatures.

+

The format is:

+
    magictype:offset:magicbytes:name:type:type[:min_flevel[:max_flevel]]
+

Where:

+

magictype: Supported magic types include:

+
    +
  • 0 - direct memory comparison of magicbytes for file types
    • +
  • 1 - The magicbytes use the body-based content matching format.
    • +
  • 4 - direct memory comparison of magicbytes for partition types (HFS+, HFSX)
    • +
+

offset: The offset from start of the file to match against. May be * if magictype is 1.

+

name: A descriptive name for the file type.

+

rtype: Usually CL_TYPE_ANY.

+

type: The CL_TYPE corresponding with the file type signature. See the CL_TYPE reference for details.

+

min_flevel: (optional) The minimum ClamAV engine that the file type signature works with. See the FLEVEL reference for details. To be used in the event that file type support has been recently added.

+

max_flevel: (optional, requires min_flevel) The maximum ClamAV engine that the file type signature works with. To be used in the event that file type support has been recently removed.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FileTypes.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FileTypes.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FileTypes.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FileTypes.html 2019-08-20 16:09:34.000000000 +0000 @@ -0,0 +1,352 @@ + + + + + + + + + + + +

ClamAV File Types

+

ClamAV maintains it's own file typing format and assigns these types using either:

+
    +
  • Evaluation of a unique sequence of bytes at the start of a file (File Type Magic).
    • +
  • File type indicators when parsing container files.
    • +
  • For example:
    +CL_TYPE_SCRIPT may be assigned to data contained in a PDF when the PDF indicates that a stream of bytes is "Javascript"
    • +
  • File type determination based on the names or characteristics contained within the file.
    • +
  • For example:
    +CL_TYPE_OOXML_WORD may be assigned to a Zip file containing files with specific names.
    • +
+

Target Types

+

A Target Type is an integer that indicates which kind of file the signature will match against. Target Type notation was first created for the purposes writing efficient signatures. A signature with a target type of 0 will be run against every file type, and thus is not ideal. However, the Target Type notation is limited and it may be unavoidable.

+

Although the newer CL_TYPE string name notation has replaced the Target Type for some signature formats, many signature formats require a target type number.

+

This is the current list of available Targe Types:

+
    +
  • 0 = any file
    • +
  • 1 = Portable Executable, both 32- and 64-bit.
    • +
  • 2 = OLE2 containers, including their specific macros. The OLE2 format is primarily used by MS Office and MSI installation files.
    • +
  • 3 = HTML (normalized)
    • +
  • 4 = Mail file
    • +
  • 5 = Graphics
    • +
  • 6 = ELF
    • +
  • 7 = ASCII text file (normalized)
    • +
  • 8 = Unused
    • +
  • 9 = Mach-O files
    • +
  • 10 = PDF files
    • +
  • 11 = Flash files
    • +
  • 12 = Java class files
    • +
+

**Important: HTML, ASCII, Javascript are all normalized.

+
    +
  • ASCII:
    • +
  • All lowercase.
    • +
  • HTML:
    • +
  • Whitespace transformed to spaces, tags/tag attributes normalized, all lowercase.
    • +
  • Javascript:
    • +
  • All strings are normalized (hex encoding is decoded), numbers are parsed and normalized, local variables/function names are normalized to ’n001’ format, argument to eval() is parsed as JS again, unescape() is handled, some simple JS packers are handled, output is whitespace normalized.
    • +
+

CL_TYPEs

+

ClamAV Types are prefixed with CL_TYPE_. The following is an exhaustive list of all current CL_TYPE's.

+ ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CL_TYPEDescription
CL_TYPE_7Z7-Zip Archive
CL_TYPE_7ZSFXSelf-Extracting 7-Zip Archive
CL_TYPE_APMDisk Image - Apple Partition Map
CL_TYPE_ARJARJ Archive
CL_TYPE_ARJSFXSelf-Extracting ARJ Archive
CL_TYPE_AUTOITAutoIt Automation Executable
CL_TYPE_BINARY_DATAbinary data
CL_TYPE_BINHEXBinHex Macintosh 7-bit ASCII email attachment encoding
CL_TYPE_BZBZip Compressed File
CL_TYPE_CABSFXSelf-Extracting Microsoft CAB Archive
CL_TYPE_CPIO_CRCCPIO Archive (CRC)
CL_TYPE_CPIO_NEWCCPIO Archive (NEWC)
CL_TYPE_CPIO_ODCCPIO Archive (ODC)
CL_TYPE_CPIO_OLDCPIO Archive (OLD, Little Endian or Big Endian)
CL_TYPE_CRYPTFFFiles encrypted by CryptFF malware
CL_TYPE_DMGApple DMG Archive
CL_TYPE_ELFELF Executable (Linux/Unix program or library)
CL_TYPE_GPTDisk Image - GUID Partition Table
CL_TYPE_GRAPHICSTIFF (Little Endian or Big Endian)
CL_TYPE_GZGZip Compressed File
CL_TYPE_HTML_UTF16Wide-Character / UTF16 encoded HTML
CL_TYPE_HTMLHTML data
CL_TYPE_HWP3Hangul Word Processor (3.X)
CL_TYPE_HWPOLE2Hangul Word Processor embedded OLE2
CL_TYPE_INTERNALInternal properties
CL_TYPE_ISHIELD_MSIWindows Install Shield MSI installer
CL_TYPE_ISO9660ISO 9660 file system for optical disc media
CL_TYPE_JAVAJava Class File
CL_TYPE_LNKMicrosoft Windows Shortcut File
CL_TYPE_MACHO_UNIBINUniversal Binary/Java Bytecode
CL_TYPE_MACHOApple/NeXTSTEP Mach-O Executable file format
CL_TYPE_MAILEmail file
CL_TYPE_MBRDisk Image - Master Boot Record
CL_TYPE_MHTMLMHTML Saved Web Page
CL_TYPE_MSCABMicrosoft CAB Archive
CL_TYPE_MSCHMMicrosoft CHM help archive
CL_TYPE_MSEXEMicrosoft EXE / DLL Executable file
CL_TYPE_MSOLE2Microsoft OLE2 Container file
CL_TYPE_MSSZDDMicrosoft Compressed EXE
CL_TYPE_NULSFTNullSoft Scripted Installer program
CL_TYPE_OLD_TARTAR archive (old)
CL_TYPE_OOXML_HWPHangul Office Open Word Processor (5.X)
CL_TYPE_OOXML_PPTMicrosoft Office Open XML PowerPoint
CL_TYPE_OOXML_WORDMicrosoft Office Open Word 2007+
CL_TYPE_OOXML_XLMicrosoft Office Open Excel 2007+
CL_TYPE_PART_HFSPLUSApple HFS+ partition
CL_TYPE_PDFAdobe PDF document
CL_TYPE_POSIX_TARTAR archive
CL_TYPE_PSPostscript
CL_TYPE_RARRAR Archive
CL_TYPE_RARSFXSelf-Extracting RAR Archive
CL_TYPE_RIFFResource Interchange File Format container formatted file
CL_TYPE_RTFRich Text Format document
CL_TYPE_SCRENCFiles encrypted by ScrEnc malware
CL_TYPE_SCRIPTGeneric type for scripts (Javascript, Python, etc)
CL_TYPE_SISSymbian OS Software Installation Script Archive
CL_TYPE_SWFAdobe Flash File (LZMA, Zlib, or uncompressed)
CL_TYPE_TEXT_ASCIIASCII text
CL_TYPE_TEXT_UTF16BEUTF-16BE text
CL_TYPE_TEXT_UTF16LEUTF-16LE text
CL_TYPE_TEXT_UTF8UTF-8 text
CL_TYPE_TNEFMicrosoft Outlook & Exchange email attachment format
CL_TYPE_UUENCODEDUUEncoded (Unix-to-Unix) binary file (Unix email attachment)
CL_TYPE_XARXAR Archive
CL_TYPE_XDPAdobe XDP - Embedded PDF
CL_TYPE_XML_HWPHangul Word Processor XML (HWPML) Document
CL_TYPE_XML_WORDMicrosoft Word 2003 XML Document
CL_TYPE_XML_XLMicrosoft Excel 2003 XML Document
CL_TYPE_XZXZ Archive
CL_TYPE_ZIPZip Archive
CL_TYPE_ZIPSFXSelf-Extracting Zip Archive
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FunctionalityLevels.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FunctionalityLevels.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/FunctionalityLevels.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/FunctionalityLevels.html 2019-08-20 16:09:32.000000000 +0000 @@ -0,0 +1,144 @@ + + + + + + + + + + + +

Functionality Levels (FLEVELs)

+

The Functionality Level (or FLEVEL) is an integer that signatures may use to define which versions of ClamAV the signature features support. It is up to the signature writers to select the correct FLEVEL or range of FLEVELs when writing a signature so that it does not cause failures in older versions of ClamAV.

+

Setting appropriate FLEVELs in signatures is particularly crucial when using features added in the last 3-4 major release versions.

+

ClamAV Version to FLEVEL chart

+ ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
flevelversionreleasenew signature features
410.95.03/2009Ignores use ign format (including line number).
510.96.03/2010Bytecode & CDB sigs. Start using ign2.
560.96.410/2010Min level for bytecode sigs.
600.97.02/2011
740.98.09/2013ISO9660 scanning support. All-match feature.
Wild card bracket notation{} for body-based signatures.
"SE" offset modifier.
Target types 10 - 13: (PDF, (SWF) Flash, Java, Internal).
760.98.11/2014XZ support and ForceToDisk scan option.
Libxml2, XAR, DMG, HFS+/HFSX.
FTM type 4 (in-buffer partition magic, analogous to type 0 for files).
790.98.511/2014File properties (preclass). Target type 13: for preclass feature.
810.99.011/2015Yara and PCRE support. Target type 14: non-listed types ("other").
820.99.12/2016Hangul Word Processor (HWP) type file parser.
900.1004/2018"Intermediates" logical sig expression option.
MHTML and PostScript types.
Substring wildcard (*) fix: order matters, substrings can't overlap.
1000.10112/2018"Byte-Compare" Logical subsignature. Windows Shortcut (LNK) type.
+

For more inforamtion on ClamAV file type support, see the File Types Reference.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/HashSignatures.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/HashSignatures.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/HashSignatures.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/HashSignatures.html 2019-08-20 16:09:31.000000000 +0000 @@ -0,0 +1,86 @@ + + + + + + + + + + + + +

File hash signatures

+

The easiest way to create signatures for ClamAV is to use filehash checksums, however this method can be only used against static malware.

+

MD5 hash-based signatures

+

To create a MD5 signature for test.exe use the --md5 option of
+sigtool:

+
zolw@localhost:/tmp/test$ sigtool --md5 test.exe > test.hdb
+zolw@localhost:/tmp/test$ cat test.hdb
+48c4533230e1ae1c118c741c0db19dfb:17387:test.exe
+

That’s it! The signature is ready for use:

+
zolw@localhost:/tmp/test$ clamscan -d test.hdb test.exe
+test.exe: test.exe FOUND
+
+----------- SCAN SUMMARY -----------
+Known viruses: 1
+Scanned directories: 0
+Engine version: 0.92.1
+Scanned files: 1
+Infected files: 1
+Data scanned: 0.02 MB
+Time: 0.024 sec (0 m 0 s)
+

You can change the name (by default sigtool uses the name of the file) and place it inside a *.hdb file. A single database file can include any number of signatures. To get them automatically loaded each time clamscan/clamd starts just copy the database file(s) into the local virus database directory (eg. /usr/local/share/clamav).

+

The hash-based signatures shall not be used for text files, HTML and any other data that gets internally preprocessed before pattern matching. If you really want to use a hash signature in such a case, run clamscan with --debug and --leave-temps flags as described above and create a signature for a preprocessed file left in /tmp. Please keep in mind that a hash signature will stop matching as soon as a single byte changes in the target file.

+

SHA1 and SHA256 hash-based signatures

+

ClamAV 0.98 has also added support for SHA1 and SHA256 file checksums. The format is the same as for MD5 file checksum. It can differentiate between them based on the length of the hash string in the signature. For best backwards compatibility, these should be placed inside a *.hsb file. The format is:

+
HashString:FileSize:MalwareName
+

Hash signatures with unknown size

+

ClamAV 0.98 has also added support for hash signatures where the size is not known but the hash is. It is much more performance-efficient to use signatures with specific sizes, so be cautious when using this feature. For these cases, the ’*’ character can be used in the size field. To ensure proper backwards compatibility with older versions of ClamAV, these signatures must have a minimum functional level of 73 or higher. Signatures that use the wildcard size without this level set will be rejected as malformed.

+

Sample .hsb signature matching any size:

+
    HashString:*:MalwareName:73
+

Sample .msb signature matching any size:

+
    *:PESectionHash:MalwareName:73
+

PE section based hash signatures

+

You can create a hash signature for a specific section in a PE file. Such signatures shall be stored inside .mdb (MD5) and .msb files in the following format:

+
    PESectionSize:PESectionHash:MalwareName
+

The easiest way to generate MD5 based section signatures is to extract target PE sections into separate files and then run sigtool with the option --mdb

+

ClamAV 0.98 has also added support for SHA1 and SHA256 section based signatures. The format is the same as for MD5 PE section based signatures. It can differentiate between them based on the length of the hash string in the signature. For best backwards compatibility, these should be placed inside a *.msb file.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/LogicalSignatures.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/LogicalSignatures.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/LogicalSignatures.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/LogicalSignatures.html 2019-08-20 16:09:32.000000000 +0000 @@ -0,0 +1,288 @@ + + + + + + + + + + + + +

Logical signatures

+

Logical signatures allow combining of multiple signatures in extended format using logical operators. They can provide both more detailed and flexible pattern matching. The logical sigs are stored inside *.ldb files in the following format:

+
SignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0;
+Subsig1;Subsig2;...
+

where:

+
    +

  • TargetDescriptionBlock provides information about the engine and target file with comma separated Arg:Val pairs. For args where Val is a range, the minimum and maximum values should be expressed as min-max.

    • +

  • LogicalExpression specifies the logical expression describing the relationship between Subsig0...SubsigN. Basis clause: 0,1,...,N decimal indexes are SUB-EXPRESSIONS representing Subsig0, Subsig1,...,SubsigN respectively. Inductive clause: if A and B are SUB-EXPRESSIONS and X, Y are decimal numbers then (A&B), (A|B), A=X, A=X,Y, A>X, A>X,Y, A<X and A<X,Y are SUB-EXPRESSIONS

    • +

  • SubsigN is n-th subsignature in extended format possibly preceded with an offset. There can be specified up to 64 subsigs.

    • +
+

Keywords used in TargetDescriptionBlock:

+
    +

  • Target:X: A number specifying the type of the target file: Target Types.

    • +

  • Engine:X-Y: Required engine functionality level (range; 0.96). Note that if the Engine keyword is used, it must be the first one in the TargetDescriptionBlock for backwards compatibility. See the FLEVEL reference for details.

    • +

  • FileSize:X-Y: Required file size (range in bytes; 0.96)

    • +

  • EntryPoint: Entry point offset (range in bytes; 0.96)

    • +

  • NumberOfSections: Required number of sections in executable (range; 0.96)

    • +

  • Container:CL_TYPE_*: File type of the container which stores the scanned file.

    • +
+

Specifying CL_TYPE_ANY matches on root objects only (i.e. the target file is explicitely not in a container). Chances slim that you would want to use CL_TYPE_ANY in a signature, because placing the malicious file in an archive will then prevent it from alerting.

+

Every ClamAV file type has the potential to be a container for additional files, although some are more likely than others. When a file is parsed and data in the file is identified to be scanned as a unique type, that parent file becomes a container the moment the embedded content is scanned. For a list of possible CL_TYPEs, refer to the File Types Reference.

+
    +
  • Intermediates:CL_TYPE_*>CL_TYPE_*: Specify one or more layers of file types containing the scanned file. This is an alternative to using Container.
    • +
+

You may specify up to 16 layers of file types separated by ’>’ in top-down order. Note that the ’>’ separator is not needed if you only specify a single container. The last type should be the immediate container containing the malicious file. Unlike with the Container option, CL_TYPE_ANY can be used as a wildcard file type. (expr; 0.100.0)

+

For a list of possible CL_TYPEs, refer to the File Types Reference.

+
    +

  • IconGroup1: Icon group name 1 from .idb signature Required engine functionality (range; 0.96)

    • +

  • IconGroup2: Icon group name 2 from .idb signature Required engine functionality (range; 0.96)

    • +
+

Modifiers for subexpressions:

+
    +

  • A=X: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched exactly X times; if it refers to a (logical) block of signatures then this block must generate exactly X matches (with any of its sigs).

    • +

  • A=0 specifies negation (signature or block of signatures cannot be matched)

    • +

  • A=X,Y: If the SUB-EXPRESSION A refers to a single signature then this signature must be matched exactly X times; if it refers to a (logical) block of signatures then this block must generate X matches and at least Y different signatures must get matched.

    • +

  • A>X: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched more than X times; if it refers to a (logical) block of signatures then this block must generate more than X matches (with any of its sigs).

    • +

  • A>X,Y: If the SUB-EXPRESSION A refers to a single signature then this signature must get matched more than X times; if it refers to a (logical) block of signatures then this block must generate more than X matches and at least Y different signatures must be matched.

    • +

  • A<X: Just like A>Z above with the change of "more" to "less".

    • +
+

If the SUB-EXPRESSION A refers to a single signature then this signature must get matched less than X times; if it refers to a (logical) block of signatures then this block must generate less than X matches (with any of its sigs).

+
    +
  • A<X,Y: Similar to A>X,Y. If the SUB-EXPRESSION A refers to a single signature then this signature must get matched less than X times; if it refers to a (logical) block of signatures then this block must generate less than X matches and at least Y different signatures must be matched.
    • +
+

Examples:

+
Sig1;Target:0;(0&1&2&3)&(4|1);6b6f74656b;616c61;7a6f6c77;7374656
+6616e;deadbeef
+
+Sig2;Target:0;((0|1|2)>5,2)&(3|1);6b6f74656b;616c61;7a6f6c77;737
+46566616e
+
+Sig3;Target:0;((0|1|2|3)=2)&(4|1);6b6f74656b;616c61;7a6f6c77;737
+46566616e;deadbeef
+
+Sig4;Engine:51-255,Target:1;((0|1)&(2|3))&4;EP+123:33c06834f04100
+f2aef7d14951684cf04100e8110a00;S2+78:22??232c2d252229{-15}6e6573
+(63|64)61706528;S3+50:68efa311c3b9963cb1ee8e586d32aeb9043e;f9c58
+dcf43987e4f519d629b103375;SL+550:6300680065005c0046006900
+

Subsignature Modifiers

+

ClamAV (clamav-0.99) supports a number of additional subsignature
+modifiers for logical signatures. This is done by specifying ::
+followed by a number of characters representing the desired options.
+Signatures using subsignature modifiers require Engine:81-255 for
+backwards-compatibility.

+
    +
  • Case-Insensitive [i]
    • +
+

Specifying the i modifier causes ClamAV to match all alphabetic hex bytes as case-insensitive. All patterns in ClamAV are case-sensitive by default.

+
    +
  • Wide [w]
    • +
+

Specifying the w causes ClamAV to match all hex bytes encoded with two bytes per character. Note this simply interweaves each character with NULL characters and does not truly support UTF-16 characters. Wildcards for ’wide’ subsignatures are not treated as wide (i.e. there can be an odd number of intermittent characters). This can be combined with a to search for patterns in both wide and ascii.

+
    +
  • Fullword [f]
    • +
+

Match subsignature as a fullword (delimited by non-alphanumeric characters).

+
    +
  • Ascii [a]
    • +
+

Match subsignature as ascii characters. This can be combined with w to search for patterns in both ascii and wide.

+

Examples:

+
clamav-nocase-A;Engine:81-255,Target:0;0&1;41414141::i;424242424242::i
+    -matches 'AAAA'(nocase) and 'BBBBBB'(nocase)
+
+clamav-fullword-A;Engine:81-255,Target:0;0&1;414141;68656c6c6f::f
+    -matches 'AAA' and 'hello'(fullword)
+clamav-fullword-B;Engine:81-255,Target:0;0&1;414141;68656c6c6f::fi
+    -matches 'AAA' and 'hello'(fullword nocase)
+
+clamav-wide-B2;Engine:81-255,Target:0;0&1;414141;68656c6c6f::wa
+    -matches 'AAA' and 'hello'(wide ascii)
+clamav-wide-C0;Engine:81-255,Target:0;0&1;414141;68656c6c6f::iwfa
+    -matches 'AAA' and 'hello'(nocase wide fullword ascii)
+

Special Subsignature Types

+

Macro subsignatures

+

Introduced in ClamAV 0.96

+

Format: ${min-max}MACROID$

+

Macro subsignatures are used to combine a number of existing extended
+signatures (.ndb) into a on-the-fly generated alternate string logical
+signature (.ldb). Signatures using macro subsignatures require
+Engine:51-255 for backwards-compatibility.

+

Example:

+
      test.ldb:
+        TestMacro;Engine:51-255,Target:0;0&1;616161;${6-7}12$
+
+      test.ndb:
+        D1:0:$12:626262
+        D2:0:$12:636363
+        D3:0:$30:626264
+

The example logical signature TestMacro is functionally equivalent
+to:

+
`TestMacro;Engine:51-255,Target:0;0;616161{3-4}(626262|636363)`
+
    +

  • MACROID points to a group of signatures; there can be at most 32 macro groups.

    • +

  • In the example, MACROID is 12 and both D1 and D2 are members of macro group 12. D3 is a member of separate macro group 30.

    • +

  • {min-max} specifies the offset range at which one of the group signatures should match; the offset range is relative to the starting offset of the preceding subsignature. This means a macro subsignature cannot be the first subsignature.

    • +

  • In the example, {min-max} is {6-7} and it is relative to the start of a 616161 match.

    • +

  • For more information and examples please see https://bugzilla.clamav.net/show_bug.cgi?id=164.

    • +
+

Byte Compare Subsignatures

+

Introduced in ClamAV 0.101

+

Format: subsigid_trigger(offset#byte_options#comparisons)

+

Byte compare subsignatures can be used to evaluate a numeric value at a given offset from the start of another (matched) subsignature within the same logical signature. These are executed after all other subsignatures within the logical subsignature are fired, with the exception of PCRE subsignatures. They can evaluate offsets only from a single referenced subsignature, and that subsignature must give a valid match for the evaluation to occur.

+
    +

  • subsigid_trigger is a required field and may refer to any single non-PCRE, non-Byte Compare subsignature within the lsig. The byte compare subsig will evaluate if subsigid_trigger matches. Triggering on multiple subsigs or logic based triggering is not currently supported.

    • +

  • offset is a required field that consists of an offset_modifier and a numeric offset (hex or decimal offsets are okay).

    • +

  • offset_modifier can be either >> or << where the former denotes a positive offset and the latter denotes a negative offset. The offset is calculated from the start of subsigid_trigger, which allows for byte extraction before the specified match, after the match, and within the match itself.

    • +

  • offset must be a positive hex or decimal value. This will be the number of bytes from the start of the referenced subsigid_trigger match within the file buffer to begin the comparison.

    • +

  • byte_options are used to specify the numeric type and endianess of the extracted byte sequence in that order as well as the number of bytes to be read. By default ClamAV will attempt to matchup up to the number of byte specified, unless the e (exact) option is specified or the numeric type is b (binary). This field follows the form [h|d|a|i][l|b][e]num_bytes

    • +

  • h|d|a|i where h specifies the byte sequence will be in hex, d decimal, a automatic detection of hex or decimal at runtime, and i signifies raw binary data.

    • +

  • l|b where l specifies the byte sequence will be in little endian order and b big endian. If decimal d is specified, big-endian is implied and using l will result in a malformed database error.

    • +

  • e specifies that ClamAV will only evaluate the comparison if it can extract the exact number of bytes specified. This option is implicitly declared when using the i flag.

    • +

  • num_bytes specifies the number of bytes to extract. This can be a hex or decimal value. If i is specified only 1, 2, 4, and 8 are valid options.

    • +

  • comparisons are a required field which denotes how to evaluate the extracted byte sequence. Each Byte Compare signature can have one or two comparison_sets separated by a comma. Each comparison_set consists of a Comparison_symbol and a Comparison_value and takes the form Comparison_symbolComparison_value. Thus, comparisons takes the form comparison_set[,comparison_set]

    • +

  • Comparison_symbol denotes the type of comparison to be done. The supported comparison symbols are <, >, =.

    • +

  • Comparison_value is a required field which must be a numeric hex or decimal value. If all other conditions are met, the byte compare subsig will evalutate the extracted byte sequence against this number based on the provided comparison_symbol.

    • +
+

PCRE subsignatures

+

Introduced in ClamAV 0.99

+

Format: Trigger/PCRE/[Flags]

+

PCRE subsignatures are used within a logical signature (.ldb) to specify regex matches that execute once triggered by a conditional based on preceding subsignatures. Signatures using PCRE subsignatures require Engine:81-255 for backwards-compatibility.

+
    +

  • Trigger is a required field that is a valid LogicalExpression and may refer to any subsignatures that precede this subsignature. Triggers cannot be self-referential and cannot refer to subsequent subsignatures.

    • +

  • PCRE is the expression representing the regex to execute. PCRE must be delimited by ’/’ and usage of ’/’ within the expression need to be escaped. For backward compatibility, ’;’ within the expression must be expressed as ’\x3B’. PCRE cannot be empty and (?UTF*) control sequence is not allowed. If debug is specified, named capture groups are displayed in a post-execution report.

    • +

  • Flags are a series of characters which affect the compilation and execution of PCRE within the PCRE compiler and the ClamAV engine. This field is optional.

    • +

  • g [CLAMAV_GLOBAL] specifies to search for ALL matches of PCRE (default is to search for first match). NOTE: INCREASES the time needed to run the PCRE.

    • +

  • r [CLAMAV_ROLLING] specifies to use the given offset as the starting location to search for a match as opposed to the only location; applies to subsigs without maxshifts. By default, in order to facilatate normal ClamAV offset behavior, PCREs are auto-anchored (only attempt match on first offset); using the rolling option disables the auto-anchoring.

    • +

  • e [CLAMAV_ENCOMPASS] specifies to CONFINE matching between the specified offset and maxshift; applies only when maxshift is specified. Note: DECREASES time needed to run the PCRE.

    • +

  • i [PCRE_CASELESS]

    • +

  • s [PCRE_DOTALL]

    • +

  • m [PCRE_MULTILINE]

    • +

  • x [PCRE_EXTENDED]

    • +

  • A [PCRE_ANCHORED]

    • +

  • E [PCRE_DOLLAR_ENODNLY]

    • +

  • U [PCRE_UNGREEDY]

    • +
+

Examples:

+
Find.All.ClamAV;Engine:81-255,Target:0;1;6265676c6164697427736e6f7462797465636f6465;0/clamav/g
+
+Find.ClamAV.OnlyAt.299;Engine:81-255,Target:0;2;7374756c747a67657473;7063726572656765786c6f6c;299:0&1/clamav/
+
+Find.ClamAV.StartAt.300;Engine:81-255,Target:0;3;616c61696e;62756731393238;636c6f736564;300:0&1&2/clamav/r
+
+Find.All.Encompassed.ClamAV;Engine:81-255,Target:0;3;7768796172656e2774;796f757573696e67;79617261;200,300:0&1&2/clamav/ge
+
+Named.CapGroup.Pcre;Engine:81-255,Target:0;3;636f75727479617264;616c62756d;74657272696572;50:0&1&2/variable=(?<nilshell>.{16})end/gr
+
+Firefox.TreeRange.UseAfterFree;Engine:81-255,Target:0,Engine:81-255;0&1&2;2e766965772e73656c656374696f6e;2e696e76616c696461746553656c656374696f6e;0&1/\x2Eview\x2Eselection.*?\x2Etree\s*\x3D\s*null.*?\x2Einvalidate/smi
+
+Firefox.IDB.UseAfterFree;Engine:81-255,Target:0;0&1;4944424b657952616e6765;0/^\x2e(only|lowerBound|upperBound|bound)\x28.*?\x29.*?\x2e(lower|upper|lowerOpen|upperOpen)/smi
+
+Firefox.boundElements;Engine:81-255,Target:0;0&1&2;6576656e742e6
+26f756e64456c656d656e7473;77696e646f772e636c6f7365;0&1/on(load|click)\s*=\s*\x22?window\.close\s*\x28/si
+

Signatures for Version Information (VI) metadata in PE files

+

Starting with ClamAV 0.96 it is possible to easily match certain information built into PE files (executables and dynamic link libraries). Whenever you lookup the properties of a PE executable file in windows, you are presented with a bunch of details about the file itself.

+

These info are stored in a special area of the file resources which goes under the name of VS_VERSION_INFORMATION (or versioninfo for short). It is divided into 2 parts. The first part (which is rather uninteresting) is really a bunch of numbers and flags indicating the product and file version. It was originally intended for use with installers which, after parsing it, should be able to determine whether a certain executable or library are to be upgraded/overwritten or are already up to date. Suffice to say, this approach never really worked and is generally never used.

+

The second block is much more interesting: it is a simple list of key/value strings, intended for user information and completely ignored by the OS. For example, if you look at ping.exe you can see the company being "Microsoft Corporation", the description "TCP/IP Ping command", the internal name "ping.exe" and so on... Depending on the OS version, some keys may be given peculiar visibility in the file properties dialog, however they are internally all the same.

+

To match a versioninfo key/value pair, the special file offset anchor VI was introduced. This is similar to the other anchors (like EP and SL) except that, instead of matching the hex pattern against a single offset, it checks it against each and every key/value pair in the file. The VI token doesn’t need nor accept a +/- offset like e.g. EP+1. As for the hex signature itself, it’s just the utf16 dump of the key and value. Only the ?? and (aa|bb) wildcards are allowed in the signature. Usually, you don’t need to bother figuring it out: each key/value pair together with the corresponding VI-based signature is printed by clamscan when the --debug option is given.

+

For example clamscan --debug freecell.exe produces:

+
[...]
+Recognized MS-EXE/DLL file
+in cli_peheader
+versioninfo_cb: type: 10, name: 1, lang: 410, rva: 9608
+cli_peheader: parsing version info @ rva 9608 (1/1)
+VersionInfo (d2de): 'CompanyName'='Microsoft Corporation' -
+VI:43006f006d00700061006e0079004e0061006d006500000000004d006900
+630072006f0073006f0066007400200043006f00720070006f0072006100740
+069006f006e000000
+VersionInfo (d32a): 'FileDescription'='Entertainment Pack
+FreeCell Game' - VI:460069006c006500440065007300630072006900700
+0740069006f006e000000000045006e007400650072007400610069006e006d
+0065006e00740020005000610063006b0020004600720065006500430065006
+c006c002000470061006d0065000000
+VersionInfo (d396): 'FileVersion'='5.1.2600.0 (xpclient.010817
+-1148)' - VI:460069006c006500560065007200730069006f006e00000000
+0035002e0031002e0032003600300030002e003000200028007800700063006
+c00690065006e0074002e003000310030003800310037002d00310031003400
+380029000000
+VersionInfo (d3fa): 'InternalName'='freecell' - VI:49006e007400
+650072006e0061006c004e0061006d006500000066007200650065006300650
+06c006c000000
+VersionInfo (d4ba): 'OriginalFilename'='freecell' - VI:4f007200
+6900670069006e0061006c00460069006c0065006e0061006d0065000000660
+0720065006500630065006c006c000000
+VersionInfo (d4f6): 'ProductName'='Sistema operativo Microsoft
+Windows' - VI:500072006f0064007500630074004e0061006d00650000000
+000530069007300740065006d00610020006f00700065007200610074006900
+76006f0020004d006900630072006f0073006f0066007400ae0020005700690
+06e0064006f0077007300ae000000
+VersionInfo (d562): 'ProductVersion'='5.1.2600.0' - VI:50007200
+6f006400750063007400560065007200730069006f006e00000035002e00310
+02e0032003600300030002e0030000000
+[...]
+

Although VI-based signatures are intended for use in logical signatures you can test them using ordinary .ndb files. For example:

+
    my_test_vi_sig:1:VI:paste_your_hex_sig_here
+

Final note. If you want to decode a VI-based signature into a human readable form you can use:

+
echo hex_string | xxd -r -p | strings -el
+

For example:

+
$ echo 460069006c0065004400650073006300720069007000740069006f006e
+000000000045006e007400650072007400610069006e006d0065006e007400200
+05000610063006b0020004600720065006500430065006c006c00200047006100
+6d0065000000 | xxd -r -p | strings -el
+FileDescription
+Entertainment Pack FreeCell Game
+

Icon Signatures for PE files

+

While Icon Signatures are stored in a .idb file, they are a feature of Logical Signatures.

+

ClamAV 0.96 includes an approximate/fuzzy icon matcher to help detecting malicious executables disguising themselves as innocent looking image files, office documents and the like.

+

Icon matching is only triggered by Logical Signatures (.ldb) using the special attribute tokens IconGroup1 or IconGroup2. These identify two (optional) groups of icons defined in a .idb database file. The format of the .idb file is:

+
    ICONNAME:GROUP1:GROUP2:ICON_HASH
+

where:

+
    +

  • ICON_NAME is a unique string identifier for a specific icon,

    • +

  • GROUP1 is a string identifier for the first group of icons (IconGroup1)

    • +

  • GROUP2 is a string identifier for the second group of icons (IconGroup2),

    • +

  • ICON_HASH is a fuzzy hash of the icon image

    • +
+

The ICON_HASH field can be obtained from the debug output of libclamav. For example:

+
LibClamAV debug: ICO SIGNATURE:
+ICON_NAME:GROUP1:GROUP2:18e2e0304ce60a0cc3a09053a30000414100057e000afe0000e 80006e510078b0a08910d11ad04105e0811510f084e01040c080a1d0b0021000a39002a41
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/PhishSigs.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/PhishSigs.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/PhishSigs.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/PhishSigs.html 2019-08-20 16:09:30.000000000 +0000 @@ -0,0 +1,573 @@ + + + + + + + + + + + + +

PhishSigs

+

Table of Contents

+ +

Database file format

+

PDB format

+

This file contains urls/hosts that are target of phishing attempts. It
+contains lines in the following format:

+
    R[Filter]:RealURL:DisplayedURL[:FuncLevelSpec]
+    H[Filter]:DisplayedHostname[:FuncLevelSpec]
+
    +
  • R
    • +
+

regular expression, for the concatenated URL

+
    +
  • H
    • +
+

matches the DisplayedHostname as a simple pattern (literally, no regular expression)

+
    +

  • the pattern can match either the full hostname

    • +

  • or a subdomain of the specified hostname

    • +

  • to avoid false matches in case of subdomain matches, the engine checks that there is a dot(.) or a space(` `) before the matched portion

    • +

  • Filter

    • +
+

is ignored for R and H for compatibility reasons

+
    +
  • RealURL
    • +
+

is the URL the user is sent to, example: href attribute of an html anchor (<a> tag)

+
    +
  • DisplayedURL
    • +
+

is the URL description displayed to the user, where its claimed they are sent, example: contents of an html anchor (<a> tag)

+
    +
  • DisplayedHostname
    • +
+

is the hostname portion of the DisplayedURL

+
    +
  • FuncLevelSpec
    • +
+

an (optional) functionality level, 2 formats are possible:

+
    +

  • minlevel all engines having functionality level >= minlevel will load this line

    • +

  • minlevel-maxlevel engines with functionality level (>=) minlevel, and (<) maxlevel will load this line

    • +
+

GDB format

+

This file contains URL hashes in the following format:

+
S:P:HostPrefix[:FuncLevelSpec]
+S:F:Sha256hash[:FuncLevelSpec]
+S1:P:HostPrefix[:FuncLevelSpec]
+S1:F:Sha256hash[:FuncLevelSpec]
+S2:P:HostPrefix[:FuncLevelSpec]
+S2:F:Sha256hash[:FuncLevelSpec]
+S:W:Sha256hash[:FuncLevelSpec]
+
    +
  • S:
    • +
+

These are hashes for Google Safe Browsing - malware sites, and should not be used for other purposes.

+
    +
  • S2:
    • +
+

These are hashes for Google Safe Browsing - phishing sites, and should not be used for other purposes.

+
    +
  • S1:
    • +
+

Hashes for blacklisting phishing sites. Virus name: Phishing.URL.Blacklisted

+
    +
  • S:W:
    • +
+

Locally whitelisted hashes.

+
    +
  • HostPrefix
    • +
+

4-byte prefix of the sha256 hash of the last 2 or 3 components of the hostname. If prefix doesn’t match, no further lookups are performed.

+
    +
  • Sha256hash
    • +
+

sha256 hash of the canonicalized URL, or a sha256 hash of its prefix/suffix according to the Google Safe Browsing “Performing Lookups†rules. There should be a corresponding :P:HostkeyPrefix entry for the hash to be taken into consideration.

+

To see which hash/URL matched, look at the clamscan --debug output, and look for the following strings: Looking up hash, prefix matched, and Hash matched. Local whitelisting of .gdb entries can be done by creating a local.gdb file, and adding a line S:W:<HASH>.

+

WDB format

+

This file contains whitelisted url pairs It contains lines in the following format:

+
    X:RealURL:DisplayedURL[:FuncLevelSpec]
+    M:RealHostname:DisplayedHostname[:FuncLevelSpec]
+
    +
  • X
    • +
+

regular expression, for the entire URL, not just the hostname

+
    +

  • The regular expression is by default anchored to start-of-line and end-of-line, as if you have used ^RegularExpression$

    • +

  • A trailing / is automatically added both to the regex, and the input string to avoid false matches

    • +

  • The regular expression matches the concatenation of the RealURL, a colon(:), and the DisplayedURL as a single string. It doesn’t separately match RealURL and DisplayedURL!

    • +

  • M

    • +
+

matches hostname, or subdomain of it, see notes for H above

+

Hints

+
    +

  • empty lines are ignored

    • +

  • the colons are mandatory

    • +

  • Don’t leave extra spaces on the end of a line!

    • +

  • if any of the lines don’t conform to this format, clamav will abort with a Malformed Database Error

    • +

  • see section Extraction-of-realURL for more details on realURL/displayedURL

    • +
+

Examples of PDB signatures

+

To check for phishing mails that target amazon.com, or subdomains of
+amazon.com:

+
    H:amazon.com
+

To do the same, but for amazon.co.uk:

+
    H:amazon.co.uk
+

To limit the signatures to certain engine versions:

+
    H:amazon.co.uk:20-30
+    H:amazon.co.uk:20-
+    H:amazon.co.uk:0-20
+

First line: engine versions 20, 21, ..., 29 can load it

+

Second line: engine versions >= 20 can load it

+

Third line: engine versions < 20 can load it

+

In a real situation, you’d probably use the second form. A situation like that would be if you are using a feature of the signatures not available in earlier versions, or if earlier versions have bugs with your signature. Its neither case here, the above examples are for illustrative purposes only.

+

Examples of WDB signatures

+

To allow amazon’s country specific domains and amazon.com, to mix domain names in DisplayedURL, and RealURL:

+
X:.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?:17-
+

Explanation of this signature:

+
    +
  • X:
    • +
+

this is a regular expression

+
    +
  • :17-
    • +
+

load signature only for engines with functionality level >= 17 (recommended for type X)

+

The regular expression is the following (X:, :17- stripped, and a / appended)

+
    .+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?/
+

Explanation of this regular expression (note that it is a single regular expression, and not 2 regular expressions splitted at the :).

+
    +
  • .+
    • +
+

any subdomain of

+
    +
  • \.amazon\.
    • +
+

domain we are whitelisting (RealURL part)

+
    +
  • (at|ca|co\.uk|co\.jp|de|fr)
    • +
+

country-domains: at, ca, co.uk, co.jp, de, fr

+
    +
  • ([/?].*)?
    • +
+

recomended way to end real url part of whitelist, this protects against embedded URLs (evilurl.example.com/amazon.co.uk/)

+
    +
  • :
    • +
+

RealURL and DisplayedURL are concatenated via a :, so match a literal : here

+
    +
  • .+
    • +
+

any subdomain of

+
    +
  • \.amazon\.com
    • +
+

whitelisted DisplayedURL

+
    +
  • ([/?].*)?
    • +
+

recommended way to end displayed url part, to protect against embedded URLs

+
    +
  • /
    • +
+

automatically added to further protect against embedded URLs

+

When you whitelist an entry make sure you check that both domains are owned by the same entity. What this whitelist entry allows is: Links claiming to point to amazon.com (DisplayedURL), but really go to country-specific domain of amazon (RealURL).

+

Example for how the URL extractor works

+

Consider the following HTML file:

+
    <html>
+    <a href="http://1.realurl.example.com/">
+      1.displayedurl.example.com
+    </a>
+    <a href="http://2.realurl.example.com">
+      2 d<b>i<p>splayedurl.e</b>xa<i>mple.com
+    </a>
+    <a href="http://3.realurl.example.com"> 
+      3.nested.example.com
+      <a href="http://4.realurl.example.com">
+        4.displayedurl.example.com
+      </a>
+    </a>
+    <form action="http://5.realurl.example.com">
+      sometext
+      <img src="http://5.displayedurl.example.com/img0.gif"/>
+      <a href="http://5.form.nested.displayedurl.example.com">
+        5.form.nested.link-displayedurl.example.com
+      </a>
+    </form>
+    <a href="http://6.realurl.example.com">
+      6.displ
+      <img src="6.displayedurl.example.com/img1.gif"/>
+      ayedurl.example.com
+    </a>
+    <a href="http://7.realurl.example.com">
+      <iframe src="http://7.displayedurl.example.com">
+    </a>
+

The phishing engine extract the following
+RealURL/DisplayedURL pairs from it:

+
    http://1.realurl.example.com/
+    1.displayedurl.example.com
+
+    http://2.realurl.example.com
+    2displayedurl.example.com
+
+    http://3.realurl.example.com
+    3.nested.example.com
+
+    http://4.realurl.example.com
+    4.displayedurl.example.com
+
+    http://5.realurl.example.com
+    http://5.displayedurl.example.com/img0.gif
+
+    http://5.realurl.example.com
+    http://5.form.nested.displayedurl.example.com
+
+    http://5.form.nested.displayedurl.example.com
+    5.form.nested.link-displayedurl.example.com
+
+    http://6.realurl.example.com
+    6.displayedurl.example.com
+
+    http://6.realurl.example.com
+    6.displayedurl.example.com/img1.gif
+

How matching works

+

RealURL, displayedURL concatenation

+

The phishing detection module processes pairs of RealURL/DisplayedURL. Matching against daily.wdb is done as follows: the realURL is concatenated with a :, and with the DisplayedURL, then that line is matched against the lines in daily.wdb/daily.pdb

+

So if you have this line in daily.wdb:

+
M:www.google.ro:www.google.com
+

and this href: <a href='http://www.google.ro'>www.google.com</a> then it will be whitelisted, but: <a href='http://images.google.com'>www.google.com</a> will not.

+

What happens when a match is found

+

In the case of the whitelist, a match means that the RealURL/DisplayedURL combination is considered clean, and no further checks are performed on it.

+

In the case of the domainlist, a match means that the RealURL/displayedURL is going to be checked for phishing attempts.

+

Furthermore you can restrict what checks are to be performed by specifying the 3-digit hexnumber.

+

Extraction of realURL, displayedURL from HTML tags

+

The html parser extracts pairs of realURL/displayedURL based on the following rules.

+

In version 0.93: After URLs have been extracted, they are normalized, and cut after the hostname. http://test.example.com/path/somecgi?queryparameters becomes http://test.example.com/

+
    +
  • a
    • +
+

(anchor) the href is the realURL, its contents is the displayedURL

+
    +
  • contents
    +is the tag-stripped contents of the <a> tags, so for example <b> tags are stripped (but not their contents)
    • +
+

nesting another <a> tag withing an <a> tag (besides being invalid html) is treated as a </a><a..

+
    +
  • form
    • +
+

the action attribute is the realURL, and a nested <a> tag is the displayedURL

+
    +
  • img/area
    • +
+

if nested within an <a> tag, the realURL is the href of the a tag, and the src/dynsrc/area is the displayedURL of the img

+

if nested withing a form tag, then the action attribute of the form tag is the realURL

+
    +
  • iframe
    • +
+

if nested withing an <a> tag the src attribute is the displayedURL, and the href of its parent a tag is the realURL

+

if nested withing a form tag, then the action attribute of the form tag is the realURL

+

Example

+

Consider this html file:

+
<a href=â€evilurlâ€\>www.paypal.com\</a\>*
+
+<a href=â€evilurl2†title=â€www.ebay.comâ€\>click here to sign
+in\</a\>*
+
+<form action=â€evilurl_formâ€\>*
+
+*Please sign in to \<a href=â€cgi.ebay.comâ€\>Ebay\</a\using this
+form*
+
+<input type=’text’ name=’username’\>Username\</input\>*
+
+*....*
+
+</form\>*
+
+<a href=â€evilurlâ€\>\<img src=â€images.paypal.com/secure.jpgâ€\>\</a\>*
+

The resulting realURL/displayedURL pairs will be (note that one tag can generate multiple pairs):

+
    +

  • evilurl / www.paypal.com

    • +

  • evilurl2 / click here to sign in

    • +

  • evilurl2 / www.ebay.com

    • +

  • evilurl_form / cgi.ebay.com

    • +

  • cgi.ebay.com / Ebay

    • +

  • evilurl / image.paypal.com/secure.jpg

    • +
+

Simple patterns

+

Simple patterns are matched literally, i.e. if you say:

+
www.google.com
+

it is going to match www.google.com, and only that. The . (dot) character has no special meaning (see the section on regexes [sec:Regular-expressions] for how the .(dot) character behaves there)

+

Regular expressions

+

POSIX regular expressions are supported, and you can consider that internally it is wrapped by ^, and $. In other words, this means that the regular expression has to match the entire concatenated (see section RealURL,-displayedURL-concatenation for details on concatenation) url.

+

It is recomended that you read section Introduction-to-regular to learn how to write regular expressions, and then come back and read this for hints.

+

Be advised that clamav contains an internal, very basic regex matcher to reduce the load on the regex matching core. Thus it is recomended that you avoid using regex syntax not supported by it at the very beginning of regexes (at least the first few characters).

+

Currently the clamav regex matcher supports:

+
    +

  • . (dot) character

    • +

  • \(\backslash\) (escaping special characters)

    • +

  • | (pipe) alternatives

    • +

  • \[\] (character classes)

    • +

  • () (parenthesis for grouping, but no group extraction is performed)

    • +

  • other non-special characters

    • +
+

Thus the following are not supported:

+
    +

  • \+ repetition

    • +

  • \* repetition

    • +

  • {} repetition

    • +

  • backreferences

    • +

  • lookaround

    • +

  • other “advanced†features not listed in the supported list ;)

    • +
+

This however shouldn’t discourage you from using the “not directly supported features “, because if the internal engine encounters unsupported syntax, it passes it on to the POSIX regex core (beginning from the first unsupported token, everything before that is still processed by the internal matcher). An example might make this more clear:

+

www(\backslash).google(\backslash).(com|ro|it) ([a-zA-Z])+(\backslash).google(\backslash).(com|ro|it)

+

Everything till ([a-zA-Z])+ is processed internally, that parenthesis (and everything beyond) is processed by the posix core.

+

Examples of url pairs that match:

+
    +

  • www.google.ro images.google.ro

    • +

  • www.google.com images.google.ro

    • +
+

Example of url pairs that don’t match:

+
    +

  • www.google.ro images1.google.ro

    • +

  • images.google.com image.google.com

    • +
+

Flags

+

Flags are a binary OR of the following numbers:

+
    +
  • HOST_SUFFICIENT
    • +
+

1

+
    +
  • DOMAIN_SUFFICIENT
    • +
+

2

+
    +
  • DO_REVERSE_LOOKUP
    • +
+

4

+
    +
  • CHECK_REDIR
    • +
+

8

+
    +
  • CHECK_SSL
    • +
+

16

+
    +
  • CHECK_CLOAKING
    • +
+

32

+
    +
  • CLEANUP_URL
    • +
+

64

+
    +
  • CHECK_DOMAIN_REVERSE
    • +
+

128

+
    +
  • CHECK_IMG_URL
    • +
+

256

+
    +
  • DOMAINLIST_REQUIRED
    • +
+

512

+

The names of the constants are self-explanatory.

+

These constants are defined in libclamav/phishcheck.h, you can check there for the latest flags.

+

There is a default set of flags that are enabled, these are currently:

+
( CLEANUP_URL | CHECK_SSL | CHECK_CLOAKING | CHECK_IMG_URL )
+

ssl checking is performed only for a tags currently.

+

You must decide for each line in the domainlist if you want to filter any flags (that is you don’t want certain checks to be done), and then calculate the binary OR of those constants, and then convert it into a 3-digit hexnumber. For example you devide that domain_sufficient shouldn’t be used for ebay.com, and you don’t want to check images either, so you come up with this flag number: (2|256\Rightarrow)258((decimal)\Rightarrow102(hexadecimal))

+

So you add this line to daily.wdb:

+
    +
  • R102 www.ebay.com .+
    • +
+

Introduction to regular expressions

+

Recomended reading:

+ +

Special characters

+
    +
  • [
    • +
+

the opening square bracket - it marks the beginning of a character class, see sectionCharacter-classes

+
    +
  • (\backslash)
    • +
+

the backslash - escapes special characters, see section Escaping

+
    +
  • ^
    • +
+

the caret - matches the beginning of a line (not needed in clamav regexes, this is implied)

+
    +
  • $
    • +
+

the dollar sign - matches the end of a line (not needed in clamav regexes, this is implied)

+
    +
  • ̇
    • +
+

the period or dot - matches any character

+
    +
  • |
    • +
+

the vertical bar or pipe symbol - matches either of the token on its left and right side, see section Alternation

+
    +
  • ?
    • +
+

the question mark - matches optionally the left-side token, see sectionOptional-matching,-and

+
    +
  • *
    • +
+

the asterisk or star - matches 0 or more occurences of the left-side token, see section Optional-matching,-and

+
    +
    • +
    • +
    • +
+

the plus sign - matches 1 or more occurences of the left-side token, see section Optional-matching,-and

+
    +
  • (
    • +
+

the opening round bracket - marks beginning of a group, see section Groups

+
    +
  • )
    • +
+

the closing round bracket - marks end of a group, see sectionGroups

+

Character classes

+

Escaping

+

Escaping has two purposes:

+
    +

  • it allows you to actually match the special characters themselves, for example to match the literal +, you would write (\backslash)+

    • +

  • it also allows you to match non-printable characters, such as the tab ((\backslash)t), newline ((\backslash)n), ..

    • +
+

However since non-printable characters are not valid inside an url, you won’t have a reason to use them.

+

Alternation

+

Optional matching, and repetition

+

Groups

+

Groups are usually used together with repetition, or alternation. For example: (com|it)+ means: match 1 or more repetitions of com or it, that is it matches: com, it, comcom, comcomcom, comit, itit, ititcom,... you get the idea.

+

Groups can also be used to extract substring, but this is not supported by the clam engine, and not needed either in this case.

+

How to create database files

+

How to create and maintain the whitelist (daily.wdb)

+

If the phishing code claims that a certain mail is phishing, but its not, you have 2 choices:

+
    +

  • examine your rules daily.pdb, and fix them if necessary (see: sectionHow-to-create)

    • +

  • add it to the whitelist (discussed here)

    • +
+

Lets assume you are having problems because of links like this in a mail:

+
    <a href=''http://69.0.241.57/bCentral/L.asp?L=XXXXXXXX''>
+      http://www.bcentral.it/
+    </a>
+

After investigating those sites further, you decide they are no threat, and create a line like this in daily.wdb:

+
R http://www\(\backslash\).bcentral\(\backslash\).it/.+
+http://69\(\backslash\).0\(\backslash\).241\(\backslash\).57/bCentral/L\(\backslash\).asp?L=.+
+

Note: urls like the above can be used to track unique mail recipients, and thus know if somebody actually reads mails (so they can send more spam). However since this site required no authentication information, it is safe from a phishing point of view.

+

How to create and maintain the domainlist (daily.pdb)

+

When not using –phish-scan-alldomains (production environments for example), you need to decide which urls you are going to check.

+

Although at a first glance it might seem a good idea to check everything, it would produce false positives. Particularly newsletters, ads, etc. are likely to use URLs that look like phishing attempts.

+

Lets assume that you’ve recently seen many phishing attempts claiming they come from Paypal. Thus you need to add paypal to daily.pdb:

+
R .+ .+\(\backslash\).paypal\(\backslash\).com
+

The above line will block (detect as phishing) mails that contain urls that claim to lead to paypal, but they don’t in fact.

+

Be carefull not to create regexes that match a too broad range of urls though.

+

Dealing with false positives, and undetected phishing mails

+

False positives

+

Whenever you see a false positive (mail that is detected as phishing, but its not), you need to examine why clamav decided that its phishing. You can do this easily by building clamav with debugging (./configure –enable-experimental –enable-debug), and then running a tool:

+
$contrib/phishing/why.py phishing.eml
+

This will show the url that triggers the phish verdict, and a reason why that url is considered phishing attempt.

+

Once you know the reason, you might need to modify daily.pdb (if one of yours rules inthere are too broad), or you need to add the url to daily.wdb. If you think the algorithm is incorrect, please file a bug report on bugzilla.clamav.net, including the output of why.py.

+

Undetected phish mails

+

Using why.py doesn’t help here unfortunately (it will say: clean), so all you can do is:

+
$clamscan/clamscan –phish-scan-alldomains undetected.eml
+

And see if the mail is detected, if yes, then you need to add an appropriate line to daily.pdb (see section How-to-create).

+

If the mail is not detected, then try using:

+
$clamscan/clamscan –debug undetected.eml|less
+

Then see what urls are being checked, see if any of them is in a whitelist, see if all urls are detected, etc.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/Whitelists.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/Whitelists.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/Whitelists.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/Whitelists.html 2019-08-20 16:09:32.000000000 +0000 @@ -0,0 +1,23 @@ + + + + + + + + + + + +

Whitelist databases

+

File whitelists

+

To whitelist a specific file use the MD5 signature format and place it inside a database file with the extension of .fp. To whitelist a specific file with the SHA1 or SHA256 file hash signature format, place the signature inside a database file with the extension of .sfp.

+

Signature whitelists

+

To whitelist a specific signature from the database you just add the signature name into a local file with the .ign2 extension and store it inside the database directory.

+

E.g:

+
    Eicar-Test-Signature
+

Additionally, you can follow the signature name with the MD5 of the entire database entry for this signature. In such a case, the signature will no longer be whitelisted when its entry in the database gets modified (eg. the signature gets updated to avoid false alerts). E.g:

+
    Eicar-Test-Signature:bc356bae4c42f19a3de16e333ba3569c
+

Historically, signature whitelists were added to .ign files. This format is still functional, though it has been replaced by the .ign2 database.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/YaraRules.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/YaraRules.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures/YaraRules.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures/YaraRules.html 2019-08-20 16:09:33.000000000 +0000 @@ -0,0 +1,38 @@ + + + + + + + + + + + +

Using YARA rules in ClamAV

+

ClamAV version 0.99 and above can process YARA rules. ClamAV virus database file names ending with “.yar†or “.yara†are parsed as yara rule files. The link to the YARA rule grammar documentation may be found at http://plusvic.github.io/yara/. There are currently a few limitations on using YARA rules within ClamAV:

+
    +

  • YARA modules are not yet supported by ClamAV. This includes the “import†keyword and any YARA module-specific keywords.

    • +

  • Global rules(“global†keyword) are not supported by ClamAV.

    • +

  • External variables(“contains†and “matches†keywords) are not supported.

    • +

  • YARA rules pre-compiled with the yarac command are not supported.

    • +

  • As in the ClamAV logical and extended signature formats, YARA strings and segments of strings separated by wild cards must represent at least two octets of data.

    • +

  • There is a maximum of 64 strings per YARA rule.

    • +

  • YARA rules in ClamAV must contain at least one literal, hexadecimal, or regular expression string.

    • +
+

In addition, there are a few more ClamAV processing modes that may affect the outcome of YARA rules.

+
    +

  • File decomposition and decompression - Since ClamAV uses file decomposition and decompression to find viruses within de-archived and uncompressed inner files, YARA rules executed by ClamAV will match against these files as well.

    • +

  • Normalization - By default, ClamAV normalizes HTML, JavaScript, and ASCII text files. YARA rules in ClamAV will match against the normalized result. The effects of normalization of these file types may be captured using clamscan --leave-temps --tempdir=mytempdir. YARA rules may then be written using the normalized file(s) found in mytempdir. Alternatively, starting with ClamAV 0.100.0, clamscan --normalize=no will prevent normalization and only scan the raw file. To obtain similar behavior prior to 0.99.2, use clamscan --scan-html=no. The corresponding parameters for clamd.conf are Normalize and ScanHTML.

    • +

  • YARA conditions driven by string matches - All YARA conditions are driven by string matches in ClamAV. This saves from executing every YARA rule on every file. Any YARA condition may be augmented with a string match clause which is always true, such as:

    • +
+
  rule CheckFileSize
+  {
+    strings:
+      $abc = "abc"
+    condition:
+      ($abc or not $abc) and filesize < 200KB
+  }
+

This will ensure that the YARA condition always performs the desired action (checking the file size in this example),

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Signatures.html clamav-0.101.4+dfsg/docs/html/UserManual/Signatures.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Signatures.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Signatures.html 2019-08-20 16:09:29.000000000 +0000 @@ -0,0 +1,374 @@ + + + + + + + + + + + + +

Creating signatures for ClamAV

+

Table of Contents

+ +

Introduction

+

In order to detect malware and other file-based threats, ClamAV relies on signatures to differentiate clean and malicious/unwanted files. ClamAV signatures are primarily text-based and conform to one of the ClamAV-specific signature formats associated with a given method of detection. These formats are explained in the Signature formats section below. In addition, ClamAV 0.99 and above support signatures written in the YARA format. More information on this can be found in the Using YARA rules in ClamAV section.

+

The ClamAV project distributes a collection of signatures in the form of CVD (ClamAV Virus Database) files. The CVD file format provides a digitally-signed container that encapsulates the signatures and ensures that they can't be modified by a malicious third-party. This signature set is actively maintained by Cisco Talos and can be downloaded using the freshclam application that ships with ClamAV. For more details on this, see the CVD file section.

+

Database formats

+

ClamAV CVD and CLD database archives may be unpacked to the current directory using sigtool -u <database name>. For more details on inspecting CVD and CLD files, see Inspecting signatures inside a CVD file. Once unpacked, you'll observe a large collection of database files with various extensions described below.

+

The CVD and CLD database archives may be supplemented with custom database files in the formats described to gain additional detection functionality. This is done simply by adding files of the following formats to the database directory, typically /usr/local/share/clamav or "C:\Program Files\ClamAV\database". Alternatively, clamd and clamscan can be instructed to load the database from an alternative database file or database directory manually using the clamd DatabaseDirectory config option or the clamscan -d command line option.

+

Settings databases

+

ClamAV provides a handful of configuration related databases along side the signature definitions.

+

*.cfg: Dynamic config settings

+

*.cat *.crb: Trusted and revoked PE certs

+

*.ftm: File Type Magic (FTM)

+

Signature databases

+

Note: Signature databases with an extension ending in u are only loaded when Potentially Unwanted Application (PUA) signatures are enabled (default: off).

+

Body-based Signatures

+

Body-based signature content is a definition that matches not based on a hash but based on the specific sequences of bytes exhibited by the target file.

+

ClamAV body-based signature content has a special format to allow regex-like matching of data that is not entirely known. This format is used extensively in both Extended Signatures and Logical Signatures.

+

*.ndb *.ndu: Extended signatures

+

*.ldb *.ldu; *.idb: Logical Signatures

+

*.cdb: Container Metadata Signatures

+

*.cbc: Bytecode Signatures

+

*.pdb *.gdb *.wdb: Phishing URL Signatures

+

Hash-based Signatures

+

*.hdb *.hsb *.hdu *.hsu: File hash signatures

+

*.mdb *.msb *.mdu *.msu: PE section hash signatures

+

Hash-based Signature format

+

Alternative signature support

+

*.yar *.yara: Yara rules

+

Other database files

+

*.fp *.sfp *.ign *.ign2: Whitelisted files, signatures

+

*.pwdb: Encrypted archive passwords

+

*.info: Database information`

+

Signature names

+

ClamAV uses the following prefixes for signature names:

+
    +
  • Worm for Internet worms
    • +
  • Trojan for backdoor programs
    • +
  • Adware for adware
    • +
  • Flooder for flooders
    • +
  • HTML for HTML files
    • +
  • Email for email messages
    • +
  • IRC for IRC trojans
    • +
  • JS for Java Script malware
    • +
  • PHP for PHP malware
    • +
  • ASP for ASP malware
    • +
  • VBS for VBS malware
    • +
  • BAT for BAT malware
    • +
  • W97M, W2000M for Word macro viruses
    • +
  • X97M, X2000M for Excel macro viruses
    • +
  • O97M, O2000M for generic Office macro viruses
    • +
  • DoS for Denial of Service attack software
    • +
  • DOS for old DOS malware
    • +
  • Exploit for popular exploits
    • +
  • VirTool for virus construction kits
    • +
  • Dialer for dialers
    • +
  • Joke for hoaxes
    • +
+

Important rules of the naming convention:

+
    +
  • always use a -zippwd suffix in the malware name for signatures of type zmd,
    • +
  • always use a -rarpwd suffix in the malware name for signatures of type rmd,
    • +
  • only use alphanumeric characters, dash (-), dot (.), underscores (_) in malware names, never use space, apostrophe or quote mark.
    • +
+

Signature Writing Tips and Tricks

+

Testing rules with clamscan

+

To test a new signature, first create a text file with the extension corresponding to the signature type (Ex: .ldb for logical signatures). Then, add the signature as it's own line within the file. This file can be passed to clamscan via the -d option, which tells ClamAV to load signatures from the file specified. If the signature is not formatted correctly, ClamAV will display an error - run clamscan with --debug --verbose to see additional information about the error message. Some common causes of errors include:

+
    +
  • The signature file has the incorrect extension type for the signatures contained within
    • +
  • The file has one or more blank lines
    • +
  • For logical signatures, a semicolon exists at the end of the file
    • +
+

If the rule is formatted correctly, clamscan will load the signature(s) in and scan any files specified via the command line invocation (or all files in the current directory if none are specified). A successful detection will look like the following:

+
clamscan -d test.ldb text.exe
+test.exe: Win.Malware.Agent.UNOFFICIAL FOUND
+
+----------- SCAN SUMMARY -----------
+Known viruses: 1
+Engine version: 0.100.0
+Scanned directories: 0
+Scanned files: 1
+Infected files: 1
+Data scanned: 17.45 MB
+Data read: 17.45 MB (ratio 1.00:1)
+Time: 0.400 sec (0 m 0 s)
+

If the rule did not match as intended:

+
    +
  • The file may have exceeded one or more of the default scanning limits built-in to ClamAV. Try running clamscan with the following options to see if raising the limits addresses the issue: --max-filesize=2000M --max-scansize=2000M --max-files=2000000 --max-recursion=2000000 --max-embeddedpe=2000M --max-htmlnormalize=2000000 --max-htmlnotags=2000000 --max-scriptnormalize=2000000 --max-ziptypercg=2000000 --max-partitions=2000000 --max-iconspe=2000000 --max-rechwp3=2000000 --pcre-match-limit=2000000 --pcre-recmatch-limit=2000000 --pcre-max-filesize=2000M.
    • +
  • If matching on HTML or text files, ClamAV might be performing normalization that causes the content of the scanned file to change. See the HTML and Text file sections for more details.
    • +
  • libclamav may have been unable to unpack or otherwise process the file. See Debug information from libclamav for more details.
    • +
+

NOTE: If you run clamscan with a -d flag, ClamAV will not load in the signatures downloaded via freshclam. This means that:

+
    +
  • some of ClamAV's unpacking support might be disabled, since some unpackers are implemented as bytecode signatures
    • +
  • PE whitelisting based on Authenticode signatures won't work, since this functionality relies on .crb rules
    • +
+

If any of this functionality is needed, load in the CVD files manually with additional -d flags.

+

Debug information from libclamav

+

In order to create efficient signatures for ClamAV it’s important to understand how the engine handles input files. The best way to see how it works is having a look at the debug information from libclamav. You can do it by calling clamscan with the --debug and --leave-temps flags. The first switch makes clamscan display all the interesting information from libclamav and the second one avoids deleting temporary files so they can be analyzed further.

+

The now important part of the info is:

+
$ clamscan --debug attachment.exe
+[...]
+LibClamAV debug: Recognized MS-EXE/DLL file
+LibClamAV debug: Matched signature for file type PE
+LibClamAV debug: File type: Executable
+

The engine recognized a windows executable.

+
LibClamAV debug: Machine type: 80386
+LibClamAV debug: NumberOfSections: 3
+LibClamAV debug: TimeDateStamp: Fri Jan 10 04:57:55 2003
+LibClamAV debug: SizeOfOptionalHeader: e0
+LibClamAV debug: File format: PE
+LibClamAV debug: MajorLinkerVersion: 6
+LibClamAV debug: MinorLinkerVersion: 0
+LibClamAV debug: SizeOfCode: 0x9000
+LibClamAV debug: SizeOfInitializedData: 0x1000
+LibClamAV debug: SizeOfUninitializedData: 0x1e000
+LibClamAV debug: AddressOfEntryPoint: 0x27070
+LibClamAV debug: BaseOfCode: 0x1f000
+LibClamAV debug: SectionAlignment: 0x1000
+LibClamAV debug: FileAlignment: 0x200
+LibClamAV debug: MajorSubsystemVersion: 4
+LibClamAV debug: MinorSubsystemVersion: 0
+LibClamAV debug: SizeOfImage: 0x29000
+LibClamAV debug: SizeOfHeaders: 0x400
+LibClamAV debug: NumberOfRvaAndSizes: 16
+LibClamAV debug: Subsystem: Win32 GUI
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 0
+LibClamAV debug: Section name: UPX0
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0x1e000 0x1e000
+LibClamAV debug: VirtualAddress: 0x1000 0x1000
+LibClamAV debug: SizeOfRawData: 0x0 0x0
+LibClamAV debug: PointerToRawData: 0x400 0x400
+LibClamAV debug: Section's memory is executable
+LibClamAV debug: Section's memory is writeable
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 1
+LibClamAV debug: Section name: UPX1
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0x9000 0x9000
+LibClamAV debug: VirtualAddress: 0x1f000 0x1f000
+LibClamAV debug: SizeOfRawData: 0x8200 0x8200
+LibClamAV debug: PointerToRawData: 0x400 0x400
+LibClamAV debug: Section's memory is executable
+LibClamAV debug: Section's memory is writeable
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 2
+LibClamAV debug: Section name: UPX2
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0x1000 0x1000
+LibClamAV debug: VirtualAddress: 0x28000 0x28000
+LibClamAV debug: SizeOfRawData: 0x200 0x1ff
+LibClamAV debug: PointerToRawData: 0x8600 0x8600
+LibClamAV debug: Section's memory is writeable
+LibClamAV debug: ------------------------------------
+LibClamAV debug: EntryPoint offset: 0x8470 (33904)
+

The section structure displayed above suggests the executable is packed
+with UPX.

+
LibClamAV debug: ------------------------------------
+LibClamAV debug: EntryPoint offset: 0x8470 (33904)
+LibClamAV debug: UPX/FSG/MEW: empty section found - assuming
+                 compression
+LibClamAV debug: UPX: bad magic - scanning for imports
+LibClamAV debug: UPX: PE structure rebuilt from compressed file
+LibClamAV debug: UPX: Successfully decompressed with NRV2B
+LibClamAV debug: UPX/FSG: Decompressed data saved in
+                 /tmp/clamav-90d2d25c9dca42bae6fa9a764a4bcede
+LibClamAV debug: ***** Scanning decompressed file *****
+LibClamAV debug: Recognized MS-EXE/DLL file
+LibClamAV debug: Matched signature for file type PE
+

Indeed, libclamav recognizes the UPX data and saves the decompressed
+(and rebuilt) executable into
+/tmp/clamav-90d2d25c9dca42bae6fa9a764a4bcede. Then it continues by
+scanning this new file:

+
LibClamAV debug: File type: Executable
+LibClamAV debug: Machine type: 80386
+LibClamAV debug: NumberOfSections: 3
+LibClamAV debug: TimeDateStamp: Thu Jan 27 11:43:15 2011
+LibClamAV debug: SizeOfOptionalHeader: e0
+LibClamAV debug: File format: PE
+LibClamAV debug: MajorLinkerVersion: 6
+LibClamAV debug: MinorLinkerVersion: 0
+LibClamAV debug: SizeOfCode: 0xc000
+LibClamAV debug: SizeOfInitializedData: 0x19000
+LibClamAV debug: SizeOfUninitializedData: 0x0
+LibClamAV debug: AddressOfEntryPoint: 0x7b9f
+LibClamAV debug: BaseOfCode: 0x1000
+LibClamAV debug: SectionAlignment: 0x1000
+LibClamAV debug: FileAlignment: 0x1000
+LibClamAV debug: MajorSubsystemVersion: 4
+LibClamAV debug: MinorSubsystemVersion: 0
+LibClamAV debug: SizeOfImage: 0x26000
+LibClamAV debug: SizeOfHeaders: 0x1000
+LibClamAV debug: NumberOfRvaAndSizes: 16
+LibClamAV debug: Subsystem: Win32 GUI
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 0
+LibClamAV debug: Section name: .text
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0xc000 0xc000
+LibClamAV debug: VirtualAddress: 0x1000 0x1000
+LibClamAV debug: SizeOfRawData: 0xc000 0xc000
+LibClamAV debug: PointerToRawData: 0x1000 0x1000
+LibClamAV debug: Section contains executable code
+LibClamAV debug: Section's memory is executable
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 1
+LibClamAV debug: Section name: .rdata
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0x2000 0x2000
+LibClamAV debug: VirtualAddress: 0xd000 0xd000
+LibClamAV debug: SizeOfRawData: 0x2000 0x2000
+LibClamAV debug: PointerToRawData: 0xd000 0xd000
+LibClamAV debug: ------------------------------------
+LibClamAV debug: Section 2
+LibClamAV debug: Section name: .data
+LibClamAV debug: Section data (from headers - in memory)
+LibClamAV debug: VirtualSize: 0x17000 0x17000
+LibClamAV debug: VirtualAddress: 0xf000 0xf000
+LibClamAV debug: SizeOfRawData: 0x17000 0x17000
+LibClamAV debug: PointerToRawData: 0xf000 0xf000
+LibClamAV debug: Section's memory is writeable
+LibClamAV debug: ------------------------------------
+LibClamAV debug: EntryPoint offset: 0x7b9f (31647)
+LibClamAV debug: Bytecode executing hook id 257 (0 hooks)
+attachment.exe: OK
+[...]
+

No additional files get created by libclamav. By writing a signature for the decompressed file you have more chances that the engine will detect the target data when it gets compressed with another packer.

+

This method should be applied to all files for which you want to create signatures. By analyzing the debug information you can quickly see how the engine recognizes and preprocesses the data and what additional files get created. Signatures created for bottom-level temporary files are usually more generic and should help detecting the same malware in different forms.

+

Writing signatures for special files

+

HTML

+

ClamAV contains HTML normalization code which makes it easier to write signatures for HTML data that might differ based on white space, capitalization, and other insignificant differences. Running sigtool --html-normalise on a HTML file can be used to see what a file's contents will look like after normalization. This command should generate the following files:

+
    +

  • nocomment.html - the file is normalized, lower-case, with all comments and superfluous white space removed

    • +

  • notags.html - as above but with all HTML tags removed

    • +

  • javascript - any script contents are normalized and the results appended to this file

    • +
+

The code automatically decodes JScript.encode parts and char ref’s (e.g. &#102;). To create a successful signature for the input file type, the rule must match on the contents of one of the created files. Signatures matching on normalized HTML should have a target type of 3. For reference, see Target Types.

+

Text files

+

Similarly to HTML all ASCII text files get normalized (converted to lower-case, all superfluous white space and control characters removed, etc.) before scanning. Running sigtool --ascii-normalise on a text file will result in a normalized version being written to the file named 'normalised_text'. Rules matching on normalized ASCII text should have a target type of 7. For reference, see Target Types.

+

Compressed Portable Executable files

+

If the file is compressed with UPX, FSG, Petite or another PE packer supported by libclamav, ClamAV will attempt to automatically unpack the executable and evaluate signatures against the unpacked executable. To inspect the executable that results from ClamAV's unpacking process, run clamscan with --debug --leave-temps. Example output for a FSG compressed file:

+
LibClamAV debug: UPX/FSG/MEW: empty section found - assuming compression
+LibClamAV debug: FSG: found old EP @119e0
+LibClamAV debug: FSG: Unpacked and rebuilt executable saved in
+/tmp/clamav-f592b20f9329ac1c91f0e12137bcce6c
+

In the example above, /tmp/clamav-f592b20f9329ac1c91f0e12137bcce6c is the unpacked executable, and a signature can be written based off of this file.

+

Using sigtool

+

sigtool pulls in libclamav and provides shortcuts to doing tasks that clamscan does behind the scenes. These can be really useful when writing a signature or trying to get information about a signature that might be causing FPs or performance problems.

+

The following sigtool flags can be especially useful for signature writing:

+
    +

  • --md5 / --sha1 / --sha256: Generate the MD5/SHA1/SHA256 hash and calculate the file size, outputting both as a properly-formatted .hdb/.hsb signature

    • +

  • --mdb: Generate section hashes of the specified file. This is useful when generating .mdb signatures.

    • +

  • --decode: Given a ClamAV signature from STDIN, show a more user-friendly representation of it. An example usage of this flag is cat test.ldb | sigtool --decode.

    • +

  • --hex-dump: Given a sequence of bytes from STDIN, print the hex equivalent. An example usage of this flag is echo -n "Match on this" | sigtool --hex-dump.

    • +

  • --html-normalise: Normalize the specified HTML file in the way that clamscan will before looking for rule matches. Writing signatures off of these files makes it easier to write rules for target type HTML (you'll know what white space, capitalization, etc. to expect). See the HTML section for more details.

    • +

  • --ascii-normalise: Normalize the specified ASCII text file in the way that clamscan will before looking for rule matches. Writing signatures off of this normalized file data makes it easier to write rules for target type Txt (you'll know what white space, capitalization, etc. to expect). See the Text files sectino for more details.

    • +

  • --print-certs: Print the Authenticode signatures of any PE files specified.
    +This is useful when writing signature-based .crb rule files.

    • +

  • --vba: Extract VBA/Word6 macro code

    • +

  • --test-sigs: Given a signature and a sample, determine whether the signature matches and, if so, display the offset into the file where the match occurred. This can be useful for investigating false positive matches in clean files.

    • +
+

Inspecting signatures inside a CVD file

+

CVD (ClamAV Virus Database) is a digitally signed container that includes signature databases in various text formats. The header of the container is a 512 bytes long string with colon separated fields:

+
ClamAV-VDB:build time:version:number of signatures:functionality level required:MD5 checksum:digital signature:builder name:build time (sec)
+

sigtool --info displays detailed information about a given CVD file:

+
zolw@localhost:/usr/local/share/clamav$ sigtool -i main.cvd
+File: main.cvd
+Build time: 09 Dec 2007 15:50 +0000
+Version: 45
+Signatures: 169676
+Functionality level: 21
+Builder: sven
+MD5: b35429d8d5d60368eea9630062f7c75a
+Digital signature: dxsusO/HWP3/GAA7VuZpxYwVsE9b+tCk+tPN6OyjVF/U8
+JVh4vYmW8mZ62ZHYMlM903TMZFg5hZIxcjQB3SX0TapdF1SFNzoWjsyH53eXvMDY
+eaPVNe2ccXLfEegoda4xU2TezbGfbSEGoU1qolyQYLX674sNA2Ni6l6/CEKYYh
+Verification OK.
+

The ClamAV project distributes a number of CVD files, including main.cvd and daily.cvd.

+

To view the signature associated with a given detection name, the CVD files can be unpacked and the underlying text files searched for a rule definition using a tool like grep. To do this, use sigtool's --unpack flag as follows:

+
$ mkdir /tmp/clamav-sigs
+$ cd /tmp/clamav-sigs/
+$ sigtool --unpack /var/lib/clamav/main.cvd
+$ ls
+COPYING   main.fp   main.hsb   main.mdb  main.ndb
+main.crb  main.hdb  main.info  main.msb  main.sfp
+

External tools

+

Below are tools that can be helpful when writing ClamAV signatures:

+
    +
  • CASC - CASC is a plugin for IDA Pro that allows the user to highlight sections of code and create a signature based on the underlying instructions (with options to ignore bytes associated with registers, addresses, and offsets). It also contains SigAlyzer, a tool to take an existing signature and locate the regions within the binary that match the subsignatures.
    • +
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Usage/Configuration.html clamav-0.101.4+dfsg/docs/html/UserManual/Usage/Configuration.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Usage/Configuration.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Usage/Configuration.html 2019-08-20 16:09:35.000000000 +0000 @@ -0,0 +1,125 @@ + + + + + + + + + + + +

Configuration

+
+ + + +
+

clamconf

+
+

clamconf is a tool ClamAV provides for checking your entire system configuration, as it relates to your ClamAV installation. When run, it displays values used when configuring ClamAV at compilation time, important OS details, the contents (and validity) of both clamd.conf and freshclam.conf, along with other important engine, database, platform, and build information.

+

It can also generate example configuration files for clamd.conf and freshclam.conf.

+

To use clamconf, and see all the information it provides, simply run the following command:

+
+

$ clamconf

+
+

For more detailed information on clamconf, run:

+
+

$ man clamconf

+
+

or

+
+

$ clamconf --help

+
+
+

clamd.conf

+
+

Currently, ClamAV requires users to edit their clamd.conf.example file before they can run the daemon. At a bare minimum, users will need to comment out the line that reads "Example", else clamd will consider the configuration invalid, ala:

+
+  7 # Comment or remove the line below.
+  8 #Example
+
+

You will also need to rename clamd.conf.example to clamd.conf via:

+
+

$ mv ./clamd.conf.example ./clamd.conf

+
+

If you are setting up a simple, local clamd instance then some other configuration options of interests to you will be as follows:

+
+    91 # Path to a local socket file the daemon will listen on.
+    92 # Default: disabled (must be specified by a user)
+    93 LocalSocket /tmp/clamd.socket
+
+    ...
+
+    99 # Sets the permissions on the unix socket to the specified mode.
+    100 # Default: disabled (socket is world accessible)
+    101 LocalSocketMode 660
+
+

Beyond that, clamd.conf is well commented and configuration should be straightforward.

+

If needed, you can find out even more about the formatting and options available in clamd.conf with the command:

+
+

man clamd.conf

+
+
+

On-Access Scanning

+
+

You can configure On-Access Scanning through clamd.conf. Configuration for On-Access Scanning starts at line 613 in clamd.conf.example.

+

Please read the on-access section of the Usage manual for further details on using On-Access Scanning.

+
+

freshclam.conf

+
+

freshclam is the automatic database update tool for Clam AntiVirus. It can be configured to work in two modes:

+
    +
  • interactive - on demand from command line
    • +
  • daemon - silently in the background
    • +
+

freshclam is an advanced tool: it supports scripted updates (instead of transferring the whole CVD file at each update it only transfers the differences between the latest and the current database via a special script), database version checks through DNS, proxy servers (with authentication), digital signatures and various error scenarios.

+

Quick test: run freshclam (as superuser) with no parameters and check the output.

+
+

$ freshclam

+
+

If everything is OK you may create the log file in /var/log (ensure the directory is owned either by clamav or whichever user freshclam will be running as):

+
+    # touch /var/log/freshclam.log
+    # chmod 600 /var/log/freshclam.log
+    # chown clamav /var/log/freshclam.log
+
+

Now you should edit the configuration file freshclam.conf and point the UpdateLogFile directive to the log file. Finally, to run freshclam in the daemon mode, execute:

+
+    # freshclam -d
+
+

The other way is to use the cron daemon. You have to add the following line to the crontab of root or clamav user:

+
+    N * * * *   /usr/local/bin/freshclam --quiet
+
+

to check for a new database every hour. N should be a number between 3 and 57 of your choice. Please don’t choose any multiple of 10, because there are already too many clients using those time slots. Proxy settings are only configurable via the configuration file and freshclam will require strict permission settings for the config file when HTTPProxyPassword is turned on.

+
+    HTTPProxyServer myproxyserver.com
+    HTTPProxyPort 1234
+    HTTPProxyUsername myusername
+    HTTPProxyPassword mypass
+
+
+

clamav-milter

+
+

ClamAV includes a mail filtering tool called clamav-milter. This tool interfaces directly with clamd, and thus requires a working clamd instance to run. However, clamav-milter's configuration and log files are separate from that of clamd.

+

Ensuring ClamAV compiles with clamav-milter must be done at configure time with the command:

+
+

$ ./configure [options] --enable-milter

+
+

This requires having the milter library installed on your system. If libmilter is not installed, ./configure will exit with this error message:

+
+    checking for mi_stop in -lmilter... no
+    configure: error: Cannot find libmilter
+
+

While not necessarily complicated, setting up the clamav-milter is an involved process. Thus, we recommend consulting your MTA’s manual on how to best connect ClamAV with the clamav-milter.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Usage/Scanning.html clamav-0.101.4+dfsg/docs/html/UserManual/Usage/Scanning.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Usage/Scanning.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Usage/Scanning.html 2019-08-20 16:09:36.000000000 +0000 @@ -0,0 +1,127 @@ + + + + + + + + + + + +

Scanning

+ + + +

Daemon

+

clamd

+

clamd is a multi-threaded daemon that uses libclamav to scan files for viruses. Scanning behaviour can be fully configured to fit most needs by modifying clamd.conf.

+

As clamd requires a virus signature database to run, we recommend setting up ClamAV's official signatures before running clamd using freshclam.

+

The daemon works by listening for commands on the sockets specified in clamd.conf. Listening is supported over both unix local sockets and TCP sockets.

+

IMPORTANT: clamd does not currently protect or authenticate traffic coming over the TCP socket, meaning it will accept any and all of the following commands listed from any source. Thus, we strongly recommend following best networking practices when setting up your clamd instance. I.e. don't expose your TCP socket to the Internet.

+

Here is a quick list of the commands accepted by clamd over the socket.

+
    +
  • PING
    • +
  • VERSION
    • +
  • RELOAD
    • +
  • SHUTDOWN
    • +
  • SCAN file/directory
    • +
  • RAWSCAN file/directory
    • +
  • CONTSCAN file/directory
    • +
  • MULTISCAN file/directory
    • +
  • ALLMATCHSCAN file/directory
    • +
  • INSTREAM
    • +
  • FILDES
    • +
  • STATS
    • +
  • IDSESSION, END
    • +
+

As with most ClamAV tools, you can find out more about these by invoking the command:

+
+

$ man clamd

+
+

The daemon also handles the following signals as so:

+
    +
  • SIGTERM - perform a clean exit
    • +
  • SIGHUP - reopen the log file
    • +
  • SIGUSR2 - reload the database
    • +
+

It should be noted that clamd should not be started using the shell operator & or other external tools which would start it as a background process. Instead, you should run clamd which will load the database and then daemonize itself (unless you have specified otherwise in clamd.conf). After that, clamd is ready to accept connections and perform file scanning.

+

Once you have set up your configuration to your liking, and understand how you will be sending commands to the daemon, running clamd itself is simple. Simply execute the command:

+
+

$ clamd

+
+

clamdscan

+

clamdscan is a clamd client, which greatly simplifies the task of scanning files with clamd. It sends commands to the clamd daemon across the socket specified in clamd.conf and generates a scan report after all requested scanning has been completed by the daemon.

+

Thus, to run clamdscan, you must have an instance of clamd already running as well.

+

Please keep in mind, that as a simple scanning client, clamdscan cannot change scanning and engine configurations. These are tied to the clamd instance and the configuration you set up in clamd.conf. Therefore, while clamdscan will accept many of the same commands as its sister tool clamscan, it will simply ignore most of them as (by design) no mechanism exists to make ClamAV engine configuration changes over the clamd socket.

+

Again, running clamdscan, once you have a working clamd instance, is simple:

+
+

$ clamdscan [*options*] [*file/directory/-*]

+
+

clamdtop

+

clamdtop is a tool to monitor one or multiple instances of clamd. It has a colorized ncurses interface, which shows each job queued, memory usage, and information about the loaded signature database for the connected clamd instance(s). By default it will attempt to connect to the local clamd as defined in clamd.conf. However, you can specify other clamd instances at the command line.

+

To learn more, use the commands

+
+

$ man clamdtop

+
+

or

+
+

$ clamdtop --help

+
+

On-Access Scanning

+

The ClamAV daemon can be configured to perform On-Access Scanning under Linux. ClamAV's On-Access Scanning runs alongside the clamd instance, and shares the same engine and virus signature database with the daemon used to kick it off. The On-Access Scanner is capable of blocking access to/from any malicious files it discovers, but by default it is configured to only alert the user if it detects a malicious file.

+

You can can set-up On-Access Scanning through clamd.conf and learn more about the options available to you by reading the On-Access Scanning User Guide.

+

Once you have set up the On-Access Scanner (and clamd) to your liking, you will need to run clamd as root (or another user with elevated permissions) to start it:

+
+

$ sudo clamd

+
+

One-Time Scanning

+

clamscan

+

clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses. Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead, clamscan will create a new engine and load in the virus database each time it is run. It will then scan the files and/or directories specified at the command line, create a scan report, and exit.

+

By default, when loading databases, clamscan will check the location to which freshclam installed the virus database signatures. This behaviour, along with a myriad of other scanning and engine controls, can be modified by providing flags and other options at the command line.

+

There are too many options to list all of them here. So we'll only cover a few common and more interesting ones:

+
    +
  • --log=FILE - save scan report to FILE
    • +
  • --database=FILE/DIR - load virus database from FILE or load all supported db files from DIR
    • +
  • --official-db-only[=yes/no(*)] - only load official signatures
    • +
  • --max-filesize=#n - files larger than this will be skipped and assumed clean
    • +
  • --max-scansize=#n - the maximum amount of data to scan for each container file
    • +
  • --leave-temps[=yes/no(*)]- do not remove temporary files
    • +
  • --file-list=FILE - scan files from FILE
    • +
  • --quiet - only output error messages
    • +
  • --bell - sound bell on virus detection
    • +
  • --cross-fs[=yes(*)/no] - scan files and directories on other filesystems
    • +
  • --move=DIRECTORY - move infected files into DIRECTORY
    • +
  • --copy=DIRECTORY - copy infected files into DIRECTORY
    • +
  • --bytecode-timeout=N - set bytecode timeout (in milliseconds)
    • +
  • --heuristic-alerts[=yes(*)/no] - toggles heuristic alerts
    • +
  • --alert-encrypted[=yes/no(*)] - alert on encrypted archives and documents
    • +
  • --nocerts - disable authenticode certificate chain verification in PE files
    • +
  • --disable-cache - disable caching and cache checks for hash sums of scanned files
    • +
+

To learn more about the options available when using clamscan please reference:

+
+

$ man clamscan

+
+

and

+
+

$ clamscan --help

+
+

Otherwise, the general usage of clamscan is:

+
+

clamscan [options] [file/directory/-]

+
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Usage/SignatureManagement.html clamav-0.101.4+dfsg/docs/html/UserManual/Usage/SignatureManagement.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Usage/SignatureManagement.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Usage/SignatureManagement.html 2019-08-20 16:09:36.000000000 +0000 @@ -0,0 +1,78 @@ + + + + + + + + + + + +

Signature Testing and Management

+
+ + + +
+

freshclam

+
+

The tool freshclam is used to download and update ClamAV’s official virus signature databases. While easy to use in its base configuration, freshclam does require a working freshclam.conf configuration file to run (the location of which can be passed in via command line if the default search location does not fit your needs).

+

Once you have a valid configuration file, you can invoke freshclam with the following command:

+
+

$ freshclam

+
+

By default, freshclam will then attempt to connect to ClamAV's virus signature database distribution network. If no databases exist in the directory specified, freshclam will do a fresh download of the requested databases. Otherwise, freshclam will attempt to update existing databases, pairing them against downloaded cdiffs. If a database is found to be corrupted, it is not updated and instead replaced with a fresh download.

+

Of course, all this behaviour--and more--can be changed to suit your needs by modifying freshclam.conf and/or using various command line options.

+

You can find more information about freshclam with the commands:

+
+

$ man freshclam

+
+

and

+
+

$ freshclam --help

+
+
+

sigtool

+
+

ClamAV provides sigtool as a command-line testing tool for assisting users in their efforts creating and working with virus signatures. While sigtool has many uses--including crafting signatures--of particular note, is sigtool's ability to help users and analysts in determining if a file detected by libclamav's virus signatures is a false positive.

+

This can be accomplished by using the command:

+
+

$ sigtool --unpack=FILE

+
+

Where FILE points to your virus signature databases. Then, once sigtool has finished unpacking the database into the directory from which you ran the command, you can search for the offending signature name (provided either by clamscan scan reports or clamd logs). As an example:

+
+

$ grep "Win.Test.EICAR" ./*

+
+

Or, do all that in one step with:

+
+

$ sigtool --find="Win.Test.EICAR"

+
+

This should give you the offending signature(s) in question, which can then be included as part of your false positive report.

+

To learn more in depth information on how sigtool can be used to help create virus signatures and work with malicious (and non-malicious) files please reference the many online tutorials on the topic.

+

Otherwise, information on available sigtool functions can be easily referenced with:

+
+

$ sigtool --help

+
+

and

+
+

$ man sigtool

+
+
+

clambc

+
+

clambc is Clam Anti-Virus’ bytecode signature testing tool. It can be used to test newly crafted bytecode signatures or to help verify existing bytecode is executing against a sample as expected.

+

For more detailed help, please use:

+
+

$ man clambc

+
+

or

+
+

$ clambc --help

+
+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual/Usage.html clamav-0.101.4+dfsg/docs/html/UserManual/Usage.html --- clamav-0.100.3+dfsg/docs/html/UserManual/Usage.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual/Usage.html 2019-08-20 16:09:28.000000000 +0000 @@ -0,0 +1,61 @@ + + + + + + + + + + + +

Usage

+
+ + + +
+

Purpose

+
+

This User Guide presents an overview of the various ways that libclamav can be used through the tools provided by ClamAV. To learn more about how to better use each facet of ClamAV that interests you, please follow the links provided.

+
+

Daemon

+
+

The ClamAV Daemon, or clamd, is a multi-threaded daemon that uses libclamav to scan files for viruses. ClamAV provides a number of tools which interface with this daemon. They are, as follows:

+ +
+

Scanner

+
+

ClamAV also provides a command-line tool for simple scanning tasks with libclamav called clamscan. Unlike the daemon, clamscan is not a persistent process and is best suited for use cases where one-time scanning with minimal setup is needed.

+
+

Signature Testing and Management

+
+

A number of tools allow for testing and management of signatures. Of note are the following:

+
    +
  • clambc - specifically for testing bytecode
    • +
  • sigtool - for general signature testing and analysis
    • +
  • freshclam - used to update signature database sets to the latest version
    • +
+
+

Configuration

+
+

The more complex tools ClamAV provides each require some degree of configuration. ClamAV supplies two example configuration files:

+
    +
  • clamd.conf - for configuring the behaviour of the ClamAV Daemon clamd and associated tools
    • +
  • freschclam.conf - for configuring the behaviour of the signature database update tool, freshclam
    • +
+

ClamAV also provides a mail filtering tool called clamav-milter which can be attached to a clamd instance for mail scanning purposes.

+

Additionally, a tool called clamconf allows users to check the configurations used by each other tool, pulling information from the configuration files listed above, alongside other relevant information.

+ + diff -Nru clamav-0.100.3+dfsg/docs/html/UserManual.html clamav-0.101.4+dfsg/docs/html/UserManual.html --- clamav-0.100.3+dfsg/docs/html/UserManual.html 1970-01-01 00:00:00.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/html/UserManual.html 2019-08-20 16:09:26.000000000 +0000 @@ -0,0 +1,34 @@ + + + + + + + + + + + +

Clam AntiVirus 0.101.4 User Manual

+

image

+
+

Table Of Contents

+
    +
  1. Introduction to ClamAV
    2. +
  2. Installing ClamAV +
    3. +
  3. Using ClamAV
    4. +
  4. ClamAV Developer Tips and Tricks
    5. +
  5. Build [lib]ClamAV Into Your Programs
    6. +
  6. Writing ClamAV Signatures
    7. +
+
+

ClamAV User Manual © 2019 Cisco Systems, Inc.

+

This document is distributed under the terms of the GNU General Public License v2.

+

Clam AntiVirus is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

+

ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc.

+ + diff -Nru clamav-0.100.3+dfsg/docs/Makefile.am clamav-0.101.4+dfsg/docs/Makefile.am --- clamav-0.100.3+dfsg/docs/Makefile.am 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/Makefile.am 2019-08-20 16:08:49.000000000 +0000 @@ -18,7 +18,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, # MA 02110-1301, USA. -EXTRA_DIST = html $(top_srcdir)/docs/man/*.in clamdoc.pdf clamdoc.tex phishsigs_howto.tex phishsigs_howto.pdf signatures.pdf signatures.tex +EXTRA_DIST = html UserManual UserManual.md $(top_srcdir)/docs/man/*.in man_MANS = man/clamscan.1 man/freshclam.1 man/sigtool.1 man/clamd.8 man/clamd.conf.5 man/clamdscan.1 man/clamav-milter.8 man/clamav-milter.conf.5 man/freshclam.conf.5 man/clamconf.1 man/clamdtop.1 man/clambc.1 if ENABLE_CLAMSUBMIT diff -Nru clamav-0.100.3+dfsg/docs/Makefile.in clamav-0.101.4+dfsg/docs/Makefile.in --- clamav-0.100.3+dfsg/docs/Makefile.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/Makefile.in 2019-08-20 16:08:49.000000000 +0000 @@ -127,6 +127,7 @@ $(top_srcdir)/m4/reorganization/libs/openssl.m4 \ $(top_srcdir)/m4/reorganization/libs/json.m4 \ $(top_srcdir)/m4/reorganization/libs/pcre.m4 \ + $(top_srcdir)/m4/reorganization/libs/libmspack.m4 \ $(top_srcdir)/m4/reorganization/libs/libz.m4 \ $(top_srcdir)/m4/reorganization/libs/bzip.m4 \ $(top_srcdir)/m4/reorganization/libs/unrar.m4 \ @@ -175,14 +176,14 @@ $(top_srcdir)/m4/reorganization/bsd.m4 \ $(top_srcdir)/m4/reorganization/libs/curl.m4 \ $(top_srcdir)/m4/reorganization/substitutions.m4 \ - $(top_srcdir)/m4/reorganization/libmspack.m4 \ - $(top_srcdir)/libclamav/libmspack-0.5alpha/m4/libmspack-opts.m4 \ $(top_srcdir)/m4/reorganization/strni.m4 \ + $(top_srcdir)/m4/reorganization/types.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d -CONFIG_HEADER = $(top_builddir)/clamav-config.h +CONFIG_HEADER = $(top_builddir)/clamav-config.h \ + $(top_builddir)/libclammspack/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) @@ -286,6 +287,8 @@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DBDIR = @DBDIR@ +DEFINE_SF32_PREFIX = @DEFINE_SF32_PREFIX@ +DEFINE_SF64_PREFIX = @DEFINE_SF64_PREFIX@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ @@ -300,6 +303,7 @@ FRESHCLAM_CPPFLAGS = @FRESHCLAM_CPPFLAGS@ FRESHCLAM_LIBS = @FRESHCLAM_LIBS@ GCOV = @GCOV@ +GENERATE_WARNING = @GENERATE_WARNING@ GENHTML = @GENHTML@ GETENT = @GETENT@ GPERF = @GPERF@ @@ -314,6 +318,11 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INT16_DEF = @INT16_DEF@ +INT32_DEF = @INT32_DEF@ +INT64_DEF = @INT64_DEF@ +INT8_DEF = @INT8_DEF@ +INT_TYPES_HEADER = @INT_TYPES_HEADER@ JSON_CPPFLAGS = @JSON_CPPFLAGS@ JSON_LDFLAGS = @JSON_LDFLAGS@ JSON_LIBS = @JSON_LIBS@ @@ -395,6 +404,10 @@ SYSTEMD_LIBS = @SYSTEMD_LIBS@ THREAD_LIBS = @THREAD_LIBS@ TH_SAFE = @TH_SAFE@ +UINT16_DEF = @UINT16_DEF@ +UINT32_DEF = @UINT32_DEF@ +UINT64_DEF = @UINT64_DEF@ +UINT8_DEF = @UINT8_DEF@ VERSION = @VERSION@ VERSIONSCRIPTFLAG = @VERSIONSCRIPTFLAG@ WERR_CFLAGS = @WERR_CFLAGS@ @@ -467,7 +480,7 @@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ -EXTRA_DIST = html $(top_srcdir)/docs/man/*.in clamdoc.pdf clamdoc.tex phishsigs_howto.tex phishsigs_howto.pdf signatures.pdf signatures.tex +EXTRA_DIST = html UserManual UserManual.md $(top_srcdir)/docs/man/*.in man_MANS = man/clamscan.1 man/freshclam.1 man/sigtool.1 man/clamd.8 \ man/clamd.conf.5 man/clamdscan.1 man/clamav-milter.8 \ man/clamav-milter.conf.5 man/freshclam.conf.5 man/clamconf.1 \ diff -Nru clamav-0.100.3+dfsg/docs/man/clamd.8.in clamav-0.101.4+dfsg/docs/man/clamd.8.in --- clamav-0.100.3+dfsg/docs/man/clamd.8.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/man/clamd.8.in 2019-08-20 16:08:49.000000000 +0000 @@ -103,6 +103,12 @@ \fB\-V, \-\-version\fR Print the version number and exit. .TP +\fB\-F, \-\-foreground\fR +Run in foreground; do not daemonize. +.TP +\fB\-\-debug\fR +Enable debug mode. +.TP \fB\-c FILE, \-\-config\-file=FILE\fR Read configuration from FILE. .SH "SIGNALS" diff -Nru clamav-0.100.3+dfsg/docs/man/clamd.conf.5.in clamav-0.101.4+dfsg/docs/man/clamd.conf.5.in --- clamav-0.100.3+dfsg/docs/man/clamd.conf.5.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/man/clamd.conf.5.in 2019-08-20 16:08:49.000000000 +0000 @@ -171,11 +171,13 @@ .TP \fBCommandReadTimeout NUMBER\fR This option specifies the time (in seconds) after which clamd should -timeout if a client doesn't provide any initial command after connecting. +timeout if a client doesn't provide any initial command after connecting. The +default is set to 30 to avoid timeouts with TCP sockets when processing large +messages. If using a Unix socket, the value can be changed to 5. Note: the timeout for subsequents commands, and/or data chunks is specified by ReadTimeout. .br -Default: 5 +Default: 30 .TP \fBSendBufTimeout NUMBER\fR This option specifies how long to wait (in milliseconds) if the send buffer is full. @@ -338,10 +340,15 @@ .br Default: disabled .TP -\fBAlgorithmicDetection BOOL\fR +\fBHeuristicAlerts BOOL\fR In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option controls the algorithmic detection. .br Default: yes +.TP +\fBHeuristicScanPrecedence BOOL\fR +Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phishing it will stop scanning immediately. Recommended, saves CPU scan-time. When disabled, virus/phishing detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported. Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option. +.br +Default: no .TP \fBScanPE BOOL\fR PE stands for Portable Executable \- it's an executable file format used in all 32 and 64\-bit versions of Windows operating systems. This option allows ClamAV to perform a deeper analysis of executable files and it's also required for decompression of popular executable packers such as UPX. @@ -357,11 +364,6 @@ .br Default: yes .TP -\fBDetectBrokenExecutables BOOL\fR -With this option clamd will try to detect broken executables (both PE and ELF) and mark them as Broken.Executable. -.br -Default: no -.TP \fBScanMail BOOL\fR Enable scanning of mail files. .br @@ -375,35 +377,15 @@ Default: no .TP \fBPhishingSignatures BOOL\fR -With this option enabled ClamAV will try to detect phishing attempts by using signatures. +Enable email signature-based phishing detection. .br Default: yes .TP \fBPhishingScanURLs BOOL\fR -Scan URLs found in mails for phishing attempts using heuristics. This will classify "Possibly Unwanted" phishing emails as Phishing.Heuristics.Email.* +Enable URL signature-based phishing detection (Phishing.Heuristics.Email.*) .br Default: yes .TP -\fBPhishingAlwaysBlockCloak BOOL\fR -Always block cloaked URLs, even if URL isn't in database. This can lead to false positives. -.br -Default: no -.TP -\fBPhishingAlwaysBlockSSLMismatch BOOL\fR -Always block SSL mismatches in URLs, even if the URL isn't in the database. This can lead to false positives. -.br -Default: no -.TP -\fBPartitionIntersection BOOL\fR -Detect partition intersections in raw disk images using heuristics. -.br -Default: no -.TP -\fBHeuristicScanPrecedence BOOL\fR -Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phishing it will stop scanning immediately. Recommended, saves CPU scan-time. When disabled, virus/phishing detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phishing, and a real malware, the real malware will be reported. Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option. -.br -Default: no -.TP \fBStructuredDataDetection BOOL\fR Enable the DLP module. .br @@ -443,16 +425,6 @@ .br Default: yes .TP -\fBOLE2BlockMacros BOOL\fR -With this option enabled OLE2 files with VBA macros, which were not detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros". -.br -Default: no -.TP -\fBBlockMax BOOL\fR - Flag files with "Heuristics.Limits.Exceeded" when scanning is incomplete due to exceeding a scan or file size limit. -.br -Default: no -.TP \fBScanPDF BOOL\fR This option enables scanning within PDF files. .br @@ -487,9 +459,49 @@ If you turn off this option, the original files will still be scanned, but without unpacking and additional processing. .br Default: yes +.TP +\fBAlertBrokenExecutables BOOL\fR +Alert on broken executable files (PE & ELF). +.br +Default: no +.TP +\fBAlertEncrypted BOOL\fR +Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). +.br +Default: no +.TP +\fBAlertEncryptedArchive BOOL\fR +Alert on encrypted archives (encrypted .zip, .7zip, .rar). +.br +Default: no .TP -\fBArchiveBlockEncrypted BOOL\fR -Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR). +\fBAlertEncryptedDoc BOOL\fR +Alert on encrypted documents (encrypted .pdf). +.br +Default: no +.TP +\fBAlertOLE2Macros BOOL\fR +Alert on OLE2 files containing VBA macros (Heuristics.OLE2.ContainsMacros). +.br +Default: no +.TP +\fBAlertExceedsMax BOOL\fR +Alert on files that exceed max file size, max scan size, or max recursion limit (Heuristics.Limits.Exceeded). +.br +Default: no +.TP +\fBAlertPhishingSSLMismatch BOOL\fR +Alert on emails containing SSL mismatches in URLs (might lead to false positives!). +.br +Default: no +.TP +\fBAlertPhishingCloak BOOL\fR +Alert on emails containing cloaked URLs (might lead to some false positives). +.br +Default: no +.TP +\fBAlertPartitionIntersection BOOL\fR +Alert on raw DMG image files containing partition intersections. .br Default: no .TP @@ -626,7 +638,7 @@ .br WARNING: setting this limit too high may severely impact performance. .br -Default: 5000 +Default: 2000 .TP \fBPCREMaxFileSize SIZE\fR This option sets the maximum filesize for which PCRE subsigs will be executed. diff -Nru clamav-0.100.3+dfsg/docs/man/clamscan.1.in clamav-0.101.4+dfsg/docs/man/clamscan.1.in --- clamav-0.100.3+dfsg/docs/man/clamscan.1.in 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/man/clamscan.1.in 2019-08-20 16:08:49.000000000 +0000 @@ -103,7 +103,7 @@ Allow loading bytecode from outside digitally signed .c[lv]d files. .TP \fB\-\-bytecode\-timeout=N\fR -Set bytecode timeout in milliseconds (default: 60000 = 60s) +Set bytecode timeout in milliseconds (default: 5000 = 5s) .TP \fB\-\-statistics[=none(*)/bytecode/pcre]\fR Collect and print execution statistics. @@ -133,26 +133,17 @@ Scan mail files. If you turn off this option, the original files will still be scanned, but without parsing individual messages/attachments. .TP \fB\-\-phishing\-sigs[=yes(*)/no]\fR -Use the signature-based phishing detection. +Enable email signature-based phishing detection. .TP \fB\-\-phishing\-scan\-urls[=yes(*)/no]\fR -Use the url-based heuristic phishing detection (Phishing.Heuristics.Email.*) +Enable URL signature-based phishing detection (Phishing.Heuristics.Email.*) +.TP +\fB\-\-heuristic\-alerts[=yes(*)/no]\fR +In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection. .TP \fB\-\-heuristic\-scan\-precedence[=yes/no(*)]\fR Allow heuristic match to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phish, and a real malware, the real malware will be reported Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option. .TP -\fB\-\-phishing\-ssl[=yes/no(*)]\fR -Block SSL mismatches in URLs (might lead to false positives!). -.TP -\fB\-\-phishing\-cloak[=yes/no(*)]\fR -Block cloaked URLs (might lead to some false positives). -.TP -\fB\-\-partition\-intersection[=yes/no(*)]\fR -Detect partition intersections in raw disk images using heuristics. -.TP -\fB\-\-algorithmic\-detection[=yes(*)/no]\fR -In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection. -.TP \fB\-\-normalize[=yes(*)/no]\fR Normalize (compress whitespace, downcase, etc.) html, script, and text files. Use normalize=no for yara compatibility. .TP @@ -183,17 +174,32 @@ \fB\-\-scan\-archive[=yes(*)/no]\fR Scan archives supported by libclamav. If you turn off this option, the original files will still be scanned, but without unpacking and additional processing. .TP -\fB\-\-detect\-broken[=yes/no(*)]\fR -Mark broken executables as viruses (Broken.Executable). +\fB\-\-alert\-broken[=yes/no(*)]\fR +Alert on broken executable files (PE & ELF). +.TP +\fB\-\-alert\-encrypted[=yes/no(*)]\fR +Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf). +.TP +\fB\-\-alert\-encrypted-archive[=yes/no(*)]\fR +Alert on encrypted archives (encrypted .zip, .7zip, .rar, .pdf). +.TP +\fB\-\-alert\-encrypted-doc[=yes/no(*)]\fR +Alert on encrypted documents (encrypted .zip, .7zip, .rar, .pdf). .TP -\fB\-\-block\-encrypted[=yes/no(*)]\fR -Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR). +\fB\-\-alert\-macros[=yes/no(*)]\fR +Alert on OLE2 files containing VBA macros (Heuristics.OLE2.ContainsMacros). .TP -\fB\-\-block\-macros[=yes/no(*)]\fR -Mark OLE2 files containing VBA macros as viruses (Heuristics.OLE2.ContainsMacros). +\fB\-\-alert\-exceeds\-max[=yes/no(*)]\fR +Alert on files that exceed max file size, max scan size, or max recursion limit (Heuristics.Limits.Exceeded). .TP -\fB\-\-block\-max[=yes/no(*)]\fR -Flag files with "Heuristics.Limits.Exceeded" when scanning is incomplete due to exceeding a scan or file size limit. +\fB\-\-alert\-phishing\-ssl[=yes/no(*)]\fR +Alert on emails containing SSL mismatches in URLs (might lead to false positives!). +.TP +\fB\-\-alert\-phishing\-cloak[=yes/no(*)]\fR +Alert on emails containing cloaked URLs (might lead to some false positives). +.TP +\fB\-\-alert\-partition\-intersection[=yes/no(*)]\fR +Detect partition intersections in raw disk images using heuristics. .TP \fB\-\-max\-filesize=#n\fR Extract and scan at most #n bytes from each archive. You may pass the value in kilobytes in format xK or xk, or megabytes in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 25 MB, max: <4 GB) @@ -239,7 +245,7 @@ Maximum calls to the PCRE match function (default: 100000). .TP \fB\-\-pcre-recmatch-limit=#n\fR -Maximum recursive calls to the PCRE match function (default: 5000). +Maximum recursive calls to the PCRE match function (default: 2000). .TP \fB\-\-pcre-max-filesize=#n\fR Maximum size file to perform PCRE subsig matching (default: 25 MB, max: <4 GB). Binary files /tmp/tmpaCtnVn/TDC_TUZRI2/clamav-0.100.3+dfsg/docs/phishsigs_howto.pdf and /tmp/tmpaCtnVn/Y2kYHaV4dN/clamav-0.101.4+dfsg/docs/phishsigs_howto.pdf differ diff -Nru clamav-0.100.3+dfsg/docs/phishsigs_howto.tex clamav-0.101.4+dfsg/docs/phishsigs_howto.tex --- clamav-0.100.3+dfsg/docs/phishsigs_howto.tex 2019-03-13 18:55:45.000000000 +0000 +++ clamav-0.101.4+dfsg/docs/phishsigs_howto.tex 1970-01-01 00:00:00.000000000 +0000 @@ -1,623 +0,0 @@ -%% LyX 1.5.3 created this file. For more info, see http://www.lyx.org/. -%% Do not edit unless you really know what you are doing. -\documentclass[a4paper,english,10pt]{article} -\usepackage{amssymb} -\usepackage{pslatex} -\usepackage[T1]{fontenc} -\usepackage[dvips]{graphicx} -\usepackage{url} -\usepackage{fancyhdr} -\usepackage{varioref} -\usepackage{prettyref} -\date{} - -\begin{document} - -\title{{\huge Phishing signatures creation HOWTO}} -\author{T\"or\"ok Edwin} -\maketitle - -%TODO: define a LaTeX command, instead of using \textsc{RealURL} each time - -\section{Database file format} - -\subsection{PDB format} -This file contains urls/hosts that are target of phishing attempts. -It contains lines in the following format: -\begin{verbatim} -R[Filter]:RealURL:DisplayedURL[:FuncLevelSpec] -H[Filter]:DisplayedHostname[:FuncLevelSpec] -\end{verbatim} - -\begin{description} - \item [{R}] regular expression, for the concatenated URL - \item [{H}] matches the \verb+DisplayedHostname+ as a simple pattern (literally, no regular expression) - \begin{itemize} - \item the pattern can match either the full hostname - \item or a subdomain of the specified hostname - \item to avoid false matches in case of subdomain matches, the engine checks that there is a dot(\verb+.+) or a space(\verb+ +) before the matched portion - \end{itemize} - \item [{Filter}] is ignored for R and H for compatibility reasons - \item [{\textsc{RealURL}}] is the URL the user is sent to, example: \emph{href} attribute of an html anchor (\emph{ tag}) - \item [{\textsc{DisplayedURL}}] is the URL description displayed to the user, where its \emph{claimed} they are sent, example: contents of an html anchor (\emph{ tag}) - \item [{DisplayedHostname}] is the hostname portion of the \textsc{DisplayedURL} - \item [{FuncLevelSpec}] an (optional) functionality level, 2 formats are possible: - \begin{itemize} - \item \verb+minlevel+ all engines having functionality level >= \verb+minlevel+ will load this line - \item \verb+minlevel-maxlevel+ engines with functionality level $>= $ \verb+minlevel+, and $< $ \verb+maxlevel+ will load this line - \end{itemize} -\end{description} - -\subsection{GDB format} -This file contains URL hashes in the following format: -\begin{verbatim} -S:P:HostPrefix[:FuncLevelSpec] -S:F:Sha256hash[:FuncLevelSpec] -S1:P:HostPrefix[:FuncLevelSpec] -S1:F:Sha256hash[:FuncLevelSpec] -S2:P:HostPrefix[:FuncLevelSpec] -S2:F:Sha256hash[:FuncLevelSpec] -S:W:Sha256hash[:FuncLevelSpec] -\end{verbatim} - -\begin{description} - \item [{S:}] - These are hashes for Google Safe Browsing - malware sites, and should not be used for other purposes. - \item [{S2:}] - These are hashes for Google Safe Browsing - phishing sites, and should not be used for other purposes. - \item [{S1:}] - Hashes for blacklisting phishing sites. - Virus name: Phishing.URL.Blacklisted - \item [{S:W}] - Locally whitelisted hashes. - \item [{HostPrefix}] - 4-byte prefix of the sha256 hash of the last 2 or 3 components of the hostname. -If prefix doesn't match, no further lookups are performed. - \item [{Sha256hash}] - sha256 hash of the canonicalized URL, or a sha256 hash of its prefix/suffix according to the Google Safe Browsing ``Performing Lookups'' rules. There should be a corresponding \verb+:P:HostkeyPrefix+ entry for the hash to be taken into consideration. -\end{description} - -To see which hash/URL matched, look at the \verb+clamscan --debug+ output, and look for the following strings: -\verb+Looking up hash+, \verb+prefix matched+, and \verb+Hash matched+. -Local whitelisting of .gdb entries can be done by creating a local.gdb file, and -adding a line \verb+S:W:+. - -\subsection{WDB format} -This file contains whitelisted url pairs -It contains lines in the following format: -\begin{verbatim} -X:RealURL:DisplayedURL[:FuncLevelSpec] -M:RealHostname:DisplayedHostname[:FuncLevelSpec] -\end{verbatim} - -\begin{description} - \item [{X}] regular expression, for the \emph{entire URL}, not just the hostname - \begin{itemize} - \item The regular expression is by default anchored to start-of-line and end-of-line, as if you have used \verb+^RegularExpression$+ - \item A trailing \verb+/+ is automatically added both to the regex, and the input string to avoid false matches - \item The regular expression matches the \emph{concatenation} of the \textsc{RealURL}, a colon(\verb+:+), and the \textsc{DisplayedURL} as a single string. It doesn't separately match \textsc{RealURL} and \textsc{DisplayedURL}! - \end{itemize} - \item [{M}] matches hostname, or subdomain of it, see notes for {H} above -\end{description} - -\subsection{Hints} - -\begin{itemize} - \item empty lines are ignored - \item the colons are mandatory - \item Don't leave extra spaces on the end of a line! - \item if any of the lines don't conform to this format, clamav will abort with a Malformed Database Error - \item see section \vref{sub:Extraction-of-realURL,} for more details on \textsc{realURL/displayedURL} -\end{itemize} - - -\subsection{Examples of PDB signatures} -To check for phishing mails that target amazon.com, or subdomains of amazon.com: -\begin{verbatim} -H:amazon.com -\end{verbatim} - -To do the same, but for amazon.co.uk: -\begin{verbatim} -H:amazon.co.uk -\end{verbatim} - -To limit the signatures to certain engine versions: -\begin{verbatim} -H:amazon.co.uk:20-30 -H:amazon.co.uk:20- -H:amazon.co.uk:0-20 -\end{verbatim} -First line: engine versions 20, 21, ..., 29 can load it - -Second line: engine versions >= 20 can load it - -Third line: engine versions < 20 can load it - -In a real situation, you'd probably use the second form. A situation like that would be if you are using a feature of the signatures -not available in earlier versions, or if earlier versions have bugs with your signature. Its neither case here, the above examples -are for illustrative purposes only. - -\subsection{Examples of WDB signatures} -To allow amazon's country specific domains and amazon.com, to mix domain names in \textsc{DisplayedURL}, and \textsc{RealURL}: -\begin{verbatim} -X:.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?:17- -\end{verbatim} -Explanation of this signature: -\begin{description} - \item [{X:}] this is a regular expression - \item [{:17-}] load signature only for engines with functionality level >= 17 (recommended for type X) -\end{description} - -The regular expression is the following (X:, :17- stripped, and a / appended) -\begin{verbatim} -.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?/ -\end{verbatim} - -Explanation of this regular expression (note that it is a single regular expression, and not 2 regular -expressions splitted at the {:}). -\begin{itemize} - \item \verb;.+; any subdomain of - \item \verb;\.amazon\.; domain we are whitelisting (\textsc{RealURL} part) - \item \verb;(at|ca|co\.uk|co\.jp|de|fr); country-domains: at, ca, co.uk, co.jp, de, fr - \item \verb;([/?].*)?; recomended way to end real url part of whitelist, this protects against embedded URLs (evilurl.example.com/amazon.co.uk/) - \item \verb;:; \textsc{RealURL} and \textsc{DisplayedURL} are concatenated via a {:}, so match a literal {:} here - \item \verb;.+; any subdomain of - \item \verb;\.amazon\.com; whitelisted DisplayedURL - \item \verb;([/?].*)?; recommended way to end displayed url part, to protect against embedded URLs - \item \verb;/; automatically added to further protect against embedded URLs -\end{itemize} - -When you whitelist an entry make sure you check that both domains are owned by the same entity. -What this whitelist entry allows is: -Links claiming to point to amazon.com (\textsc{DisplayedURL}), but really go to country-specific domain of amazon (\textsc{RealURL}). - -\subsection{Example for how the URL extractor works} -Consider the following HTML file: -\begin{verbatim} - - - 1.displayedurl.example.com - - - 2 di

splayedurl.example.com - - - 3.nested.example.com - - 4.displayedurl.example.com - - -

- sometext - - - 5.form.nested.link-displayedurl.example.com - - - - 6.displ - - ayedurl.example.com - - -