Skip to content

Commit 7381fa6

Browse files
jhumlickjhumlick
committed
libclamav: Add support for Y-type signatures in wdb files.
There are some cases where it is desired to allow a single domain to have any displayed address and not count that as phishing. An example of this would be the domain for outlook URL checker, or Google safe browsing. If a wdb file contains a Y type entry only the real domain will be matched, not the real and displayed domain. CLAM-2426
1 parent d4114e0 commit 7381fa6

14 files changed

+281
-104
lines changed

‎libclamav/CMakeLists.txt‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -340,14 +340,15 @@ set(LIBCLAMAV_SOURCES
340340
# mail & phishing
341341
iana_cctld.h
342342
iana_tld.h
343-
line.c line.h
344-
mbox.c mbox.h
345-
message.c message.h
346-
phish_domaincheck_db.c phish_domaincheck_db.h
347-
phish_allow_list.c phish_allow_list.h
348-
phishcheck.c phishcheck.h
349-
regex_list.c regex_list.h
350-
regex_suffix.c regex_suffix.h
343+
line.c line.h
344+
mbox.c mbox.h
345+
message.c message.h
346+
phish_domaincheck_db.c phish_domaincheck_db.h
347+
phish_allow_real_and_display.c phish_allow_real_and_display.h
348+
phish_allow_real_only.c phish_allow_real_only.h
349+
phishcheck.c phishcheck.h
350+
regex_list.c regex_list.h
351+
regex_suffix.c regex_suffix.h
351352
# sis
352353
sis.c sis.h
353354
# tnef

‎libclamav/filtering.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,9 +156,12 @@ static inline int filter_isset(const struct filter *m, unsigned pos, uint16_t va
156156

157157
static inline void filter_set_atpos(struct filter *m, unsigned pos, uint16_t val)
158158
{
159+
cli_dbgmsg("filter_set_atpos: Setting filter value 0x%04x at pos %u (before: B[val]=0x%02x)\n",
160+
val, pos, m->B[val]);
159161
if (!filter_isset(m, pos, val)) {
160162
cli_perf_log_count(FILTER_LOAD, pos);
161163
m->B[val] &= ~(1 << pos);
164+
cli_dbgmsg(" After setting: B[0x%04x] = 0x%02x\n", val, m->B[val]);
162165
}
163166
}
164167

@@ -756,6 +759,7 @@ long filter_search(const struct filter *m, const unsigned char *data, unsigned l
756759
for (j = 0; j < len - 1; j++) {
757760
const uint16_t q0 = cli_readint16(&data[j]);
758761
uint8_t match_end;
762+
759763
state = (state << 1) | B[q0];
760764
/* state marks with a 0 bit all active states
761765
* End[q0] marks with a 0 bit all states where the q-gram 'q' can end a pattern

‎libclamav/others.h‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -340,8 +340,9 @@ struct cl_engine {
340340
struct cli_cdb *cdb;
341341

342342
/* Phishing .pdb and .wdb databases*/
343-
struct regex_matcher *allow_list_matcher;
344-
struct regex_matcher *domain_list_matcher;
343+
struct regex_matcher *phish_allow_real_and_display_matcher;
344+
struct regex_matcher *phish_allow_real_only_matcher;
345+
struct regex_matcher *phish_protected_domain_matcher;
345346
struct phishcheck *phishcheck;
346347

347348
/* Dynamic configuration */
@@ -575,16 +576,16 @@ extern LIBCLAMAV_EXPORT int have_rar;
575576

576577
/* based on macros from A. Melnikoff */
577578
#define cbswap16(v) (((v & 0xff) << 8) | (((v) >> 8) & 0xff))
578-
#define cbswap32(v) ((((v) & 0x000000ff) << 24) | (((v) & 0x0000ff00) << 8) | \
579-
(((v) & 0x00ff0000) >> 8) | (((v) & 0xff000000) >> 24))
580-
#define cbswap64(v) ((((v) & 0x00000000000000ffULL) << 56) | \
581-
(((v) & 0x000000000000ff00ULL) << 40) | \
582-
(((v) & 0x0000000000ff0000ULL) << 24) | \
583-
(((v) & 0x00000000ff000000ULL) << 8) | \
584-
(((v) & 0x000000ff00000000ULL) >> 8) | \
585-
(((v) & 0x0000ff0000000000ULL) >> 24) | \
586-
(((v) & 0x00ff000000000000ULL) >> 40) | \
587-
(((v) & 0xff00000000000000ULL) >> 56))
579+
#define cbswap32(v) ((((v)&0x000000ff) << 24) | (((v)&0x0000ff00) << 8) | \
580+
(((v)&0x00ff0000) >> 8) | (((v)&0xff000000) >> 24))
581+
#define cbswap64(v) ((((v)&0x00000000000000ffULL) << 56) | \
582+
(((v)&0x000000000000ff00ULL) << 40) | \
583+
(((v)&0x0000000000ff0000ULL) << 24) | \
584+
(((v)&0x00000000ff000000ULL) << 8) | \
585+
(((v)&0x000000ff00000000ULL) >> 8) | \
586+
(((v)&0x0000ff0000000000ULL) >> 24) | \
587+
(((v)&0x00ff000000000000ULL) >> 40) | \
588+
(((v)&0xff00000000000000ULL) >> 56))
588589

589590
#ifndef HAVE_ATTRIB_PACKED
590591
#define __attribute__(x)
@@ -833,8 +834,8 @@ cl_error_t cli_dispatch_scan_callback(cli_ctx *ctx, cl_scan_callback_t location)
833834
/* used by: spin, yc (C) aCaB */
834835
#define __SHIFTBITS(a) (sizeof(a) << 3)
835836
#define __SHIFTMASK(a) (__SHIFTBITS(a) - 1)
836-
#define CLI_ROL(a, b) a = (a << ((b) & __SHIFTMASK(a))) | (a >> ((__SHIFTBITS(a) - (b)) & __SHIFTMASK(a)))
837-
#define CLI_ROR(a, b) a = (a >> ((b) & __SHIFTMASK(a))) | (a << ((__SHIFTBITS(a) - (b)) & __SHIFTMASK(a)))
837+
#define CLI_ROL(a, b) a = (a << ((b)&__SHIFTMASK(a))) | (a >> ((__SHIFTBITS(a) - (b)) & __SHIFTMASK(a)))
838+
#define CLI_ROR(a, b) a = (a >> ((b)&__SHIFTMASK(a))) | (a << ((__SHIFTBITS(a) - (b)) & __SHIFTMASK(a)))
838839

839840
/* Implementation independent sign-extended signed right shift */
840841
#ifdef HAVE_SAR

‎libclamav/phish_allow_real_and_display.c‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
/*
2+
* Phishing module: allow list implementation.
3+
*
4+
* Copyright (C) 2013-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
5+
* Copyright (C) 2007-2013 Sourcefire, Inc.
6+
*
7+
* Authors: Török Edvin
8+
*
9+
* This program is free software; you can redistribute it and/or modify
10+
* it under the terms of the GNU General Public License version 2 as
11+
* published by the Free Software Foundation.
12+
*
13+
* This program is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* GNU General Public License for more details.
17+
*
18+
* You should have received a copy of the GNU General Public License
19+
* along with this program; if not, write to the Free Software
20+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21+
* MA 02110-1301, USA.
22+
*/
23+
24+
#if HAVE_CONFIG_H
25+
#include "clamav-config.h"
26+
#endif
27+
28+
#ifdef CL_THREAD_SAFE
29+
#ifndef _REENTRANT
30+
#define _REENTRANT
31+
#endif
32+
#endif
33+
34+
#include <stdio.h>
35+
#include <string.h>
36+
#include <ctype.h>
37+
38+
#include "clamav.h"
39+
#include "others.h"
40+
#include "phish_allow_real_and_display.h"
41+
#include "regex_list.h"
42+
43+
#include "mpool.h"
44+
45+
cl_error_t phish_allow_real_and_display_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly)
46+
{
47+
const char* info; /*unused*/
48+
cli_dbgmsg("Phishing: looking up in real and display allow list: %s:%s; host-only:%d\n", real_url, display_url, hostOnly);
49+
return engine->phish_allow_real_and_display_matcher ? regex_list_match(engine->phish_allow_real_and_display_matcher, real_url, display_url, NULL, hostOnly, &info, 1) : 0;
50+
}
51+
52+
cl_error_t phish_allow_real_and_display_init(struct cl_engine* engine)
53+
{
54+
if (engine) {
55+
engine->phish_allow_real_and_display_matcher = (struct regex_matcher*)MPOOL_MALLOC(engine->mempool, sizeof(struct regex_matcher));
56+
if (!engine->phish_allow_real_and_display_matcher) {
57+
cli_errmsg("Phish_allow_list: Unable to allocate memory for allow_list_match\n");
58+
return CL_EMEM;
59+
}
60+
#ifdef USE_MPOOL
61+
((struct regex_matcher*)(engine->phish_allow_real_and_display_matcher))->mempool = engine->mempool;
62+
#endif
63+
return init_regex_list(engine->phish_allow_real_and_display_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
64+
} else
65+
return CL_ENULLARG;
66+
}
67+
68+
int phish_is_allow_real_and_display_ok(const struct cl_engine* engine)
69+
{
70+
return (engine && engine->phish_allow_real_and_display_matcher) ? is_regex_ok(engine->phish_allow_real_and_display_matcher) : 1;
71+
}
72+
73+
void phish_allow_real_and_display_done(struct cl_engine* engine)
74+
{
75+
if (engine && engine->phish_allow_real_and_display_matcher) {
76+
regex_list_done(engine->phish_allow_real_and_display_matcher);
77+
MPOOL_FREE(engine->mempool, engine->phish_allow_real_and_display_matcher);
78+
engine->phish_allow_real_and_display_matcher = NULL;
79+
}
80+
}

‎libclamav/phish_allow_real_and_display.h‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/*
2+
* Phishing module: Allow list implementation.
3+
*
4+
* Copyright (C) 2013-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
5+
* Copyright (C) 2007-2013 Sourcefire, Inc.
6+
*
7+
* Authors: Török Edvin
8+
*
9+
* This program is free software; you can redistribute it and/or modify
10+
* it under the terms of the GNU General Public License version 2 as
11+
* published by the Free Software Foundation.
12+
*
13+
* This program is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* GNU General Public License for more details.
17+
*
18+
* You should have received a copy of the GNU General Public License
19+
* along with this program; if not, write to the Free Software
20+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21+
* MA 02110-1301, USA.
22+
*/
23+
24+
#ifndef _PHISH_ALLOW_REAL_AND_DISPLAY_H
25+
#define _PHISH_ALLOW_REAL_AND_DISPLAY_H
26+
27+
#include "clamav.h"
28+
29+
cl_error_t phish_allow_real_and_display_init(struct cl_engine* engine);
30+
void phish_allow_real_and_display_done(struct cl_engine* engine);
31+
void allow_list_cleanup(const struct cl_engine* engine);
32+
int phish_is_allow_real_and_display_ok(const struct cl_engine* engine);
33+
cl_error_t phish_allow_real_and_display_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly);
34+
35+
#endif

‎libclamav/phish_allow_list.c‎ renamed to ‎libclamav/phish_allow_real_only.c‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -37,44 +37,44 @@
3737

3838
#include "clamav.h"
3939
#include "others.h"
40-
#include "phish_allow_list.h"
40+
#include "phish_allow_real_only.h"
4141
#include "regex_list.h"
4242

4343
#include "mpool.h"
4444

45-
cl_error_t allow_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly)
45+
cl_error_t phish_allow_real_only_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly)
4646
{
4747
const char* info; /*unused*/
48-
cli_dbgmsg("Phishing: looking up in allow list: %s:%s; host-only:%d\n", real_url, display_url, hostOnly);
49-
return engine->allow_list_matcher ? regex_list_match(engine->allow_list_matcher, real_url, display_url, NULL, hostOnly, &info, 1) : 0;
48+
cli_dbgmsg("Phishing: looking up in real only allow list: %s:%s; host-only:%d\n", real_url, "", hostOnly);
49+
return engine->phish_allow_real_only_matcher ? regex_list_match(engine->phish_allow_real_only_matcher, real_url, "", NULL, hostOnly, &info, 2) : 0;
5050
}
5151

52-
cl_error_t init_allow_list(struct cl_engine* engine)
52+
cl_error_t phish_allow_real_only_init(struct cl_engine* engine)
5353
{
5454
if (engine) {
55-
engine->allow_list_matcher = (struct regex_matcher*)MPOOL_MALLOC(engine->mempool, sizeof(struct regex_matcher));
56-
if (!engine->allow_list_matcher) {
55+
engine->phish_allow_real_only_matcher = (struct regex_matcher*)MPOOL_MALLOC(engine->mempool, sizeof(struct regex_matcher));
56+
if (!engine->phish_allow_real_only_matcher) {
5757
cli_errmsg("Phish_allow_list: Unable to allocate memory for allow_list_match\n");
5858
return CL_EMEM;
5959
}
6060
#ifdef USE_MPOOL
61-
((struct regex_matcher*)(engine->allow_list_matcher))->mempool = engine->mempool;
61+
((struct regex_matcher*)(engine->phish_allow_real_only_matcher))->mempool = engine->mempool;
6262
#endif
63-
return init_regex_list(engine->allow_list_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
63+
return init_regex_list(engine->phish_allow_real_only_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
6464
} else
6565
return CL_ENULLARG;
6666
}
6767

68-
int is_allow_list_ok(const struct cl_engine* engine)
68+
int phish_is_allow_real_only_ok(const struct cl_engine* engine)
6969
{
70-
return (engine && engine->allow_list_matcher) ? is_regex_ok(engine->allow_list_matcher) : 1;
70+
return (engine && engine->phish_allow_real_only_matcher) ? is_regex_ok(engine->phish_allow_real_only_matcher) : 1;
7171
}
7272

73-
void allow_list_done(struct cl_engine* engine)
73+
void phish_allow_real_only_done(struct cl_engine* engine)
7474
{
75-
if (engine && engine->allow_list_matcher) {
76-
regex_list_done(engine->allow_list_matcher);
77-
MPOOL_FREE(engine->mempool, engine->allow_list_matcher);
78-
engine->allow_list_matcher = NULL;
75+
if (engine && engine->phish_allow_real_only_matcher) {
76+
regex_list_done(engine->phish_allow_real_only_matcher);
77+
MPOOL_FREE(engine->mempool, engine->phish_allow_real_only_matcher);
78+
engine->phish_allow_real_only_matcher = NULL;
7979
}
8080
}

‎libclamav/phish_allow_list.h‎ renamed to ‎libclamav/phish_allow_real_only.h‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,14 @@
2121
* MA 02110-1301, USA.
2222
*/
2323

24-
#ifndef _PHISH_ALLOW_LIST_H
25-
#define _PHISH_ALLOW_LIST_H
24+
#ifndef _PHISH_ALLOW_REAL_ONLY_H
25+
#define _PHISH_ALLOW_REAL_ONLY_H
2626

2727
#include "clamav.h"
2828

29-
cl_error_t init_allow_list(struct cl_engine* engine);
30-
void allow_list_done(struct cl_engine* engine);
31-
void allow_list_cleanup(const struct cl_engine* engine);
32-
int is_allow_list_ok(const struct cl_engine* engine);
33-
cl_error_t allow_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly);
29+
cl_error_t phish_allow_real_only_init(struct cl_engine* engine);
30+
void phish_allow_real_only_done(struct cl_engine* engine);
31+
int phish_is_allow_real_only_ok(const struct cl_engine* engine);
32+
cl_error_t phish_allow_real_only_match(const struct cl_engine* engine, char* real_url, const char* display_url, int hostOnly);
3433

3534
#endif

‎libclamav/phish_domaincheck_db.c‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,38 +41,38 @@
4141
#include "phish_domaincheck_db.h"
4242
#include "regex_list.h"
4343

44-
int domain_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly)
44+
int phish_protected_domain_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly)
4545
{
4646
const char* info;
47-
int rc = engine->domain_list_matcher ? regex_list_match(engine->domain_list_matcher, real_url, display_url, hostOnly ? pre_fixup : NULL, hostOnly, &info, 0) : 0;
47+
int rc = engine->phish_protected_domain_matcher ? regex_list_match(engine->phish_protected_domain_matcher, real_url, display_url, hostOnly ? pre_fixup : NULL, hostOnly, &info, 0) : 0;
4848
return rc;
4949
}
5050

51-
int init_domain_list(struct cl_engine* engine)
51+
int phish_protected_domain_init(struct cl_engine* engine)
5252
{
5353
if (engine) {
54-
engine->domain_list_matcher = (struct regex_matcher*)malloc(sizeof(struct regex_matcher));
55-
if (!engine->domain_list_matcher) {
54+
engine->phish_protected_domain_matcher = (struct regex_matcher*)malloc(sizeof(struct regex_matcher));
55+
if (!engine->phish_protected_domain_matcher) {
5656
cli_errmsg("Phishcheck: Unable to allocate memory for init_domain_list\n");
5757
return CL_EMEM;
5858
}
5959
#ifdef USE_MPOOL
60-
((struct regex_matcher*)engine->domain_list_matcher)->mempool = engine->mempool;
60+
((struct regex_matcher*)engine->phish_protected_domain_matcher)->mempool = engine->mempool;
6161
#endif
62-
return init_regex_list(engine->domain_list_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
62+
return init_regex_list(engine->phish_protected_domain_matcher, engine->dconf->other & OTHER_CONF_PREFILTERING);
6363
} else
6464
return CL_ENULLARG;
6565
}
6666

67-
int is_domain_list_ok(const struct cl_engine* engine)
67+
int phish_is_protected_domain_ok(const struct cl_engine* engine)
6868
{
69-
return (engine && engine->domain_list_matcher) ? is_regex_ok(engine->domain_list_matcher) : 1;
69+
return (engine && engine->phish_protected_domain_matcher) ? is_regex_ok(engine->phish_protected_domain_matcher) : 1;
7070
}
7171

72-
void domain_list_done(struct cl_engine* engine)
72+
void phish_protected_domain_done(struct cl_engine* engine)
7373
{
74-
if (engine && engine->domain_list_matcher) {
75-
regex_list_done(engine->domain_list_matcher);
76-
free(engine->domain_list_matcher);
74+
if (engine && engine->phish_protected_domain_matcher) {
75+
regex_list_done(engine->phish_protected_domain_matcher);
76+
free(engine->phish_protected_domain_matcher);
7777
}
7878
}

‎libclamav/phish_domaincheck_db.h‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,9 @@
2525
#define _PHISH_DOMAINCHECK_DB_H
2626
#include "clamav.h"
2727

28-
int init_domain_list(struct cl_engine* engine);
29-
void domain_list_done(struct cl_engine* engine);
30-
void domain_list_cleanup(const struct cl_engine* engine);
31-
int is_domain_list_ok(const struct cl_engine* engine);
32-
int domain_list_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly);
28+
int phish_protected_domain_init(struct cl_engine* engine);
29+
void phish_protected_domain_done(struct cl_engine* engine);
30+
int phish_is_protected_domain_ok(const struct cl_engine* engine);
31+
int phish_protected_domain_match(const struct cl_engine* engine, char* real_url, const char* display_url, const struct pre_fixup_info* pre_fixup, int hostOnly);
3332

3433
#endif

0 commit comments

Comments
 (0)