Clam 2677 2678 FIPS compliant CVD codesigning #1417

micahsnyder · 2024-12-11T18:06:57Z

Add FIPS-compliant CVD signing and verification.

This change bears similarities to #1344, adding external code signing signature files (.cvd.sign) to accompany existing .cvd databases.

The .sign take a form similar to other clamav signatures where comment lines start with a # and all other lines are signatures. Each signature line takes the form:

min_flevel : max_flevel (optional) : sig_format : public_key_fingerprint : signature_text

min_flevel: the minimum flevel required to support the signature format.
max_flevel: the maximum flevel supporting the signature format. This is optional, and may be empty.
signature_format: for the initial implementation, it must be: "pkcs7-pem".
signature_text: must be printable ascii with no new lines. If "sig_format" is "pkcs7-pem" it is the base64 encoded part of the a PEM signature (aka header and footer removed) with all new-lines removed. if additional formats are added, this field would be used to store things like the hash of the file, the algorithm, plus any other required signing details.

Adds X509 certificate chain based signing with PKCS7-PEM external signatures distributed alongside CVD's in a custom .cvd.sign format.

Adds a Rust implementation for parsing, verifying, and unpacking CVD files.

Now installs a 'certs' directory in the app config directory (e.g. /etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
-D CVD_CERTS_DIRECTORY=PATH

New options to set an alternative CVD certs directory:

Commandline for freshclam, clamd, clamscan, and sigtool is:
--cvdcertsdir PATH
Env variable for freshclam, clamd, clamscan, and sigtool is:
CVD_CERTS_DIR
Config option for freshclam and clamd is:
CVDCertsDirectory PATH

Sigtool:

Add sign/verify commands.
Also verify CDIFF external digital signatures when applying CDIFFs.
Place commonly used commands at the top of --help string.
Fix up manpage.

Freshclam:

Will try to download .sign files to verify CVDs and CDIFFs.
Fix an issue where making a CLD would only include the CFG file for daily and not if patching any other database.

libclamav.so:

Bump version to 13:0:1 (aka 12.1.0).
Also remove libclamav.map versioning.
Resolves: libclamav.map: Remove CLAMAV_1.0.0…CLAMAV_0.104.0 #1304

Add two new API's to the public clamav.h header:

extern cl_error_t cl_cvdverify_ex(const char *file,
                                  const char *certs_directory);

extern cl_error_t cl_cvdunpack_ex(const char *file,
                                  const char *dir,
                                  bool dont_verify,
                                  const char *certs_directory);

The original cl_cvdverify and cl_cvdunpack are deprecated.

Add cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.

libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).

Adds sigtool sign/verify tests and test certs.

Make it so downloadFile doesn't throw a warning if the server doesn't have the .sign file.

Replace use of md5-based FP signatures in the unit tests with sha256-based FP signatures because the md5 implementation used by Python may be disabled in FIPS mode.

Fixes: #564
Fixes: #1411

Replaces: #1344

libclamav_rust/src/codesign.rs

CMakeLists.txt

CMakeOptions.cmake

libclamav/clamav.h

libclamav/cvd.c

micahsnyder · 2024-12-13T17:35:48Z

libclamav/cvd.c

+    }
+
+    /* For actual .cvd files, verify the digital signature. */
+    if (dbtype == CVD_TYPE_CVD) {


Do we want to also check this for CUD? Probably. This would be a case where database is not signed with old MD5-RSA, and only signed with external PKCS7 sig.

micahsnyder · 2024-12-13T17:44:30Z

libclamav/cvd.c

+        if (!cvd_verify(
+                cvd,
+                engine->certs_directory,
+                false,


Consider if we want to make a config or commandline option to disable the older md5-based RSA checks, or simply let it fail if FIPS is enabled and the cert-based method doesn't work/isn't available.

I think it's okay either way.

libclamav_rust/src/cvd.rs

libclamav/others.h

micahsnyder · 2024-12-13T18:07:49Z

libclamav_rust/Cargo.toml

@@ -26,6 +26,13 @@ inflate = "0.4"
 bzip2-rs = "0.1"
 byteorder = "1.5"
 delharc = "0.6"
+clam-sigutil = { path = "../../clamav-signature-util" }


This is temporarily pointing a copy of the rust clam-sigutil project in my workspace. Will change it to a github URL soon.

libclamav_rust/src/codesign.rs

micahsnyder · 2024-12-17T19:51:42Z

sigtool --sign: After debug-logging the certs for the cert stack, should info-print:

cert Serial
CommonName
the issuer commonName (if an issuer exists)

micahsnyder · 2024-12-17T20:27:32Z

For verifying,

Load all ca certs from the ca certs directory into the x509 store and put the x509 store into the Verifier.
The Verifier should be stored in the cl_engine.

Edit: done.

libclamav_rust/src/codesign.rs

libfreshclam/libfreshclam_internal.c

-    if ((NULL != localFilename) && !access(localFilename, R_OK) && strcmp(newLocalFilename, localFilename))
-        if (unlink(localFilename))
+    if ((NULL != localFilename) && !access(localFilename, R_OK) && strcmp(newLocalFilename, localFilename)) {
+        if (unlink(localFilename)) {


Add X509 certificate chain based signing with PKCS7-PEM external signatures distributed alongside CVD's in a custom .cvd.sign format. This new signing and verification mechanism is primarily in support of FIPS compliance. Fixes: Cisco-Talos#564 Add a Rust implementation for parsing, verifying, and unpacking CVD files. Now installs a 'certs' directory in the app config directory (e.g. <prefix>/etc/certs). The install location is configurable. The CMake option to configure the CVD certs directory is: `-D CVD_CERTS_DIRECTORY=PATH` New options to set an alternative CVD certs directory: - Commandline for freshclam, clamd, clamscan, and sigtool is: `--cvdcertsdir PATH` - Env variable for freshclam, clamd, clamscan, and sigtool is: `CVD_CERTS_DIR` - Config option for freshclam and clamd is: `CVDCertsDirectory PATH` Sigtool: - Add sign/verify commands. - Also verify CDIFF external digital signatures when applying CDIFFs. - Place commonly used commands at the top of --help string. - Fix up manpage. Freshclam: - Will try to download .sign files to verify CVDs and CDIFFs. - Fix an issue where making a CLD would only include the CFG file for daily and not if patching any other database. libclamav.so: - Bump version to 13:0:1 (aka 12.1.0). - Also remove libclamav.map versioning. Resolves: Cisco-Talos#1304 - Add two new API's to the public clamav.h header: ```c extern cl_error_t cl_cvdverify_ex(const char *file, const char *certs_directory); extern cl_error_t cl_cvdunpack_ex(const char *file, const char *dir, bool dont_verify, const char *certs_directory); ``` The original `cl_cvdverify` and `cl_cvdunpack` are deprecated. - Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`. You may set this option with `cl_engine_set_str` and get it with `cl_engine_get_str`, to override the compiled in default CVD certs directory. libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0). Add sigtool sign/verify tests and test certs. Make it so downloadFile doesn't throw a warning if the server doesn't have the .sign file. Replace use of md5-based FP signatures in the unit tests with sha256-based FP signatures because the md5 implementation used by Python may be disabled in FIPS mode. Fixes: Cisco-Talos#1411

micahsnyder commented Dec 12, 2024

View reviewed changes

libclamav_rust/src/codesign.rs Outdated Show resolved Hide resolved