Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.19k stars 684 forks source link

Clamd can't start if clamd.conf contains inline comments #1175

Open jmlrt opened 6 months ago

jmlrt commented 6 months ago

Describe the bug

Clamd start is failing when some comment are added on the same line as a config value in the clamd.conf file.

How to reproduce the problem

Edit clamd.conf and add MaxRecursion 20 # set to 20 for example.

$ grep MaxRecursion /etc/clamav/clamd.conf
MaxRecursion 20 # set to 20
$ clamd
ERROR: Incorrect argument format for option MaxRecursion
ERROR: Can't open/parse the config file /etc/clamav/clamd.conf

Move the inline comment to its own line and it's starting again:

$ grep -B1 MaxRecursion /etc/clamav/clamd.conf
# set to 20
MaxRecursion 20
$ clamd
$ echo $?
0
$ ps -ef | grep clamd | grep -v grep
  121 clamav    0:16 {clamd} /run/rosetta/rosetta /usr/sbin/clamd clamd

Attachments

If applicable, add screenshots to help explain your problem.

If the issue is reproducible only when scanning a specific file, attach it to the ticket.

micahsnyder commented 6 months ago

I agree, it would be nice if clamav's config files would support inline comments.

userwiths commented 1 month ago

Here is an attempt at a solution. I've tested it locally by manually editing the clamd.conf file and I'm open to suggestions in case you see anything that should be improved/changed. Hope it helps.

Cause of issue:

The first issue I see is that inline comments are not accepted due to failed Regex checks. This would be the case for MATCH_NUMBER, MATCH_SIZE and MATCH_BOOL because of the end line assertion $ not allowing for anything (comment in this case) between the value and the end of the line. Because of it, lines with an inline comment fail the check that is done here.

In case we fix the Regex expression, we would need to account for the inline comments in the following switch/case branches (I've accounted for them right before the switch so we don't have code repetition). The approach I took was to check if the value of the argument contains the # character and in case it does, use strtok to get the content on its left side.