Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clam 2677 2678 FIPS compliant CVD codesigning #1417

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

val-ms
Copy link
Contributor

@val-ms val-ms commented Dec 11, 2024

Add FIPS-compliant CVD signing and verification.

This change bears similarities to #1344, adding external code signing signature files (.cvd.sign) to accompany existing .cvd databases.

The .sign take a form similar to other clamav signatures where comment lines start with a # and all other lines are signatures. Each signature line takes the form:

min_flevel : max_flevel (optional) : sig_format : public_key_fingerprint : signature_text

min_flevel:  the minimum flevel required to support the signature format.
max_flevel:  the maximum flevel supporting the signature format. This is optional, and may be empty. 
signature_format:  for the initial implementation, it must be: "pkcs7-pem".
signature_text:  must be printable ascii with no new lines. If "sig_format" is "pkcs7-pem" it is the base64 encoded part of the a PEM signature (aka header and footer removed) with all new-lines removed. if additional formats are added, this field would be used to store things like the hash of the file, the algorithm, plus any other required signing details. 

Adds X509 certificate chain based signing with PKCS7-PEM external signatures distributed alongside CVD's in a custom .cvd.sign format.

Adds a Rust implementation for parsing, verifying, and unpacking CVD files.

Now installs a 'certs' directory in the app config directory (e.g. /etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
-D CVD_CERTS_DIRECTORY=PATH

New options to set an alternative CVD certs directory:

  • Commandline for freshclam, clamd, clamscan, and sigtool is:
    --cvdcertsdir PATH
  • Env variable for freshclam, clamd, clamscan, and sigtool is:
    CVD_CERTS_DIR
  • Config option for freshclam and clamd is:
    CVDCertsDirectory PATH

Sigtool:

  • Add sign/verify commands.
  • Also verify CDIFF external digital signatures when applying CDIFFs.
  • Place commonly used commands at the top of --help string.
  • Fix up manpage.

Freshclam:

  • Will try to download .sign files to verify CVDs and CDIFFs.
  • Fix an issue where making a CLD would only include the CFG file for daily and not if patching any other database.

libclamav.so:

  • Bump version to 13:0:1 (aka 12.1.0).
  • Also remove libclamav.map versioning.
    Resolves: libclamav.map: Remove CLAMAV_1.0.0…CLAMAV_0.104.0 #1304
  • Add two new API's to the public clamav.h header:
    extern cl_error_t cl_cvdverify_ex(const char *file,
                                      const char *certs_directory);
    
    extern cl_error_t cl_cvdunpack_ex(const char *file,
                                      const char *dir,
                                      bool dont_verify,
                                      const char *certs_directory);
    The original cl_cvdverify and cl_cvdunpack are deprecated.
  • Add cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
    You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.

libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).

Adds sigtool sign/verify tests and test certs.

Make it so downloadFile doesn't throw a warning if the server doesn't have the .sign file.

Replace use of md5-based FP signatures in the unit tests with sha256-based FP signatures because the md5 implementation used by Python may be disabled in FIPS mode.

Fixes: #564
Fixes: #1411

Replaces: #1344

}

/* For actual .cvd files, verify the digital signature. */
if (dbtype == CVD_TYPE_CVD) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to also check this for CUD? Probably. This would be a case where database is not signed with old MD5-RSA, and only signed with external PKCS7 sig.

if (!cvd_verify(
cvd,
engine->certs_directory,
false,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider if we want to make a config or commandline option to disable the older md5-based RSA checks, or simply let it fail if FIPS is enabled and the cert-based method doesn't work/isn't available.

I think it's okay either way.

@val-ms
Copy link
Contributor Author

val-ms commented Dec 17, 2024

sigtool --sign: After debug-logging the certs for the cert stack, should info-print:

  • cert Serial
  • CommonName
  • the issuer commonName (if an issuer exists)

@val-ms
Copy link
Contributor Author

val-ms commented Dec 17, 2024

For verifying,

  1. Load all ca certs from the ca certs directory into the x509 store and put the x509 store into the Verifier.

  2. The Verifier should be stored in the cl_engine.

Edit: done.

@val-ms val-ms marked this pull request as ready for review January 2, 2025 15:13
@val-ms val-ms changed the title Work in progress: Clam 2677 2678 codesigning Clam 2677 2678 FIPS compliant CVD codesigning Jan 2, 2025
@val-ms val-ms force-pushed the CLAM-2677-2678-codesigning branch from b371edd to 587862b Compare January 2, 2025 15:32
@rsundriyal rsundriyal self-requested a review January 10, 2025 15:41
rsundriyal
rsundriyal previously approved these changes Jan 10, 2025
Add X509 certificate chain based signing with PKCS7-PEM external
signatures distributed alongside CVD's in a custom .cvd.sign format.
This new signing and verification mechanism is primarily in support
of FIPS compliance.

Fixes: Cisco-Talos#564

Add a Rust implementation for parsing, verifying, and unpacking CVD
files.

Now installs a 'certs' directory in the app config directory
(e.g. <prefix>/etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
  `-D CVD_CERTS_DIRECTORY=PATH`

New options to set an alternative CVD certs directory:
- Commandline for freshclam, clamd, clamscan, and sigtool is:
  `--cvdcertsdir PATH`
- Env variable for freshclam, clamd, clamscan, and sigtool is:
  `CVD_CERTS_DIR`
- Config option for freshclam and clamd is:
  `CVDCertsDirectory PATH`

Sigtool:
- Add sign/verify commands.
- Also verify CDIFF external digital signatures when applying CDIFFs.
- Place commonly used commands at the top of --help string.
- Fix up manpage.

Freshclam:
- Will try to download .sign files to verify CVDs and CDIFFs.
- Fix an issue where making a CLD would only include the CFG file for
daily and not if patching any other database.

libclamav.so:
- Bump version to 13:0:1 (aka 12.1.0).
- Also remove libclamav.map versioning.
  Resolves: Cisco-Talos#1304
- Add two new API's to the public clamav.h header:
  ```c
  extern cl_error_t cl_cvdverify_ex(const char *file,
                                    const char *certs_directory);

  extern cl_error_t cl_cvdunpack_ex(const char *file,
                                    const char *dir,
                                    bool dont_verify,
                                    const char *certs_directory);
  ```
  The original `cl_cvdverify` and `cl_cvdunpack` are deprecated.
- Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`.
  You may set this option with `cl_engine_set_str` and get it
  with `cl_engine_get_str`, to override the compiled in default
  CVD certs directory.

libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).

Add sigtool sign/verify tests and test certs.

Make it so downloadFile doesn't throw a warning if the server
doesn't have the .sign file.

Replace use of md5-based FP signatures in the unit tests with
sha256-based FP signatures because the md5 implementation used
by Python may be disabled in FIPS mode.
Fixes: Cisco-Talos#1411
@val-ms val-ms force-pushed the CLAM-2677-2678-codesigning branch from 5764f52 to 048eed5 Compare January 14, 2025 04:46
Also fix issue when certs directory param for cl_cvdunpack_ex is NULL
@val-ms val-ms force-pushed the CLAM-2677-2678-codesigning branch from ecb0010 to d5e6d20 Compare January 19, 2025 20:18
"fix" toctou "bug" that github think is "high severity" because we check
if a file exists before deleting it. There's no point checking, we can
just try to delete it and if it fails, then well the thing didn't exist.

fix log messages with missing new lines

fix missing environment variable notes in --help messages

deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in clamav-config.h.in for libclamav from variable that had the same name for use in clamav applications that use the optparser.
fix windows cvd_certs_dir issues
@val-ms val-ms force-pushed the CLAM-2677-2678-codesigning branch from baf2d07 to 52f7df5 Compare February 18, 2025 03:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants