Clam 2677 2678 FIPS compliant CVD codesigning

[val-ms]

Add FIPS-compliant CVD signing and verification.

This change bears similarities to #1344, adding external code signing signature files (.cvd.sign) to accompany existing .cvd databases.

The .sign take a form similar to other clamav signatures where comment lines start with a # and all other lines are signatures. Each signature line takes the form:

min_flevel : max_flevel (optional) : sig_format : public_key_fingerprint : signature_text

min_flevel:  the minimum flevel required to support the signature format.
max_flevel:  the maximum flevel supporting the signature format. This is optional, and may be empty. 
signature_format:  for the initial implementation, it must be: "pkcs7-pem".
signature_text:  must be printable ascii with no new lines. If "sig_format" is "pkcs7-pem" it is the base64 encoded part of the a PEM signature (aka header and footer removed) with all new-lines removed. if additional formats are added, this field would be used to store things like the hash of the file, the algorithm, plus any other required signing details. 

Adds X509 certificate chain based signing with PKCS7-PEM external signatures distributed alongside CVD's in a custom .cvd.sign format.

Adds a Rust implementation for parsing, verifying, and unpacking CVD files.

Now installs a 'certs' directory in the app config directory (e.g. /etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
-D CVD_CERTS_DIRECTORY=PATH

New options to set an alternative CVD certs directory:

• Commandline for freshclam, clamd, clamscan, and sigtool is:
  --cvdcertsdir PATH
• Env variable for freshclam, clamd, clamscan, and sigtool is:
  CVD_CERTS_DIR
• Config option for freshclam and clamd is:
  CVDCertsDirectory PATH

Sigtool:

• Add sign/verify commands.
• Also verify CDIFF external digital signatures when applying CDIFFs.
• Place commonly used commands at the top of --help string.
• Fix up manpage.

Freshclam:

• Will try to download .sign files to verify CVDs and CDIFFs.
• Fix an issue where making a CLD would only include the CFG file for daily and not if patching any other database.

libclamav.so:

• Bump version to 13:0:1 (aka 12.1.0).
• Also remove libclamav.map versioning.
  Resolves: libclamav.map: Remove CLAMAV_1.0.0…CLAMAV_0.104.0 #1304
• Add two new API's to the public clamav.h header:

  extern cl_error_t cl_cvdverify_ex(const char *file,
                                    const char *certs_directory);
  
  extern cl_error_t cl_cvdunpack_ex(const char *file,
                                    const char *dir,
                                    bool dont_verify,
                                    const char *certs_directory);

  The original cl_cvdverify and cl_cvdunpack are deprecated.
• Add cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
  You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.

libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).

Adds sigtool sign/verify tests and test certs.

Make it so downloadFile doesn't throw a warning if the server doesn't have the .sign file.

Replace use of md5-based FP signatures in the unit tests with sha256-based FP signatures because the md5 implementation used by Python may be disabled in FIPS mode.

Fixes: #564
Fixes: #1411

Replaces: #1344

[val-ms]

Do we want to also check this for CUD? Probably. This would be a case where database is not signed with old MD5-RSA, and only signed with external PKCS7 sig.

[val-ms]

Consider if we want to make a config or commandline option to disable the older md5-based RSA checks, or simply let it fail if FIPS is enabled and the cert-based method doesn't work/isn't available.

I think it's okay either way.

[val-ms]

sigtool --sign: After debug-logging the certs for the cert stack, should info-print:

• cert Serial
• CommonName
• the issuer commonName (if an issuer exists)

[val-ms]

For verifying,

1. Load all ca certs from the ca certs directory into the x509 store and put the x509 store into the Verifier.

2. The Verifier should be stored in the cl_engine.

Edit: done.

[TheRaynMan]

Consolidating out-of-date version markers seems clear, but shouldn't CLAMAV_PUBLIC remain? Maybe moved to new line 71?

[val-ms]

It does remain (it's line 1). You're looking at the equivalent of html closing tag (a la </CLAMAV_PUBLIC>).

Ref: how we used to do it back in 0.103 https://github.com/Cisco-Talos/clamav/blob/rel/0.103/libclamav/libclamav.map

[TheRaynMan]

Ah, just a bookend to line 1. Nevermind.

[TheRaynMan]

Ok for beta, will be root CA only for release.