[Clamav-devel] ClamAV Webinar on 3rd December Reminder
Hi Everyone, This is a reminder of this week's ClamAV Webcast on Wednesday 3rd December at 1800UTC (1300EST). The presentation will cover common pitfalls in the deployment of ClamAV. It will then recommend the best practices for logging, scan limits, SMP systems, usage of PUA, setting up freshclam, using ClamAV on more hosts on your network and submitting detection statistics, followed by an overview of the engine configuration flags found in 0.94.1. Finally the presentation will describe a recommended upgrade procedure, showing common pitfalls and best practices to avoid them such as forgetting to review configuration changes, testing the new version before deployment and restarting the daemons. The broadcast will include a QA session. For further details, including how to listen to the broadcast and a biography of the speaker, Török Edvin, please visit http://www.clamav.net/2008/10/30/clamav-best-practices-webinar/ As always this session will be recorded and archived on ClamAV.net and Sourcefire.com. Finally, if you have any topic you'd like to see us cover in the future, or if you'd like to give a presentation (we welcome talks from the community), please contact me at [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] or +1 301 518 7944. I hope you can join us. Regards, -Nigel -- Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com http://www.bossconference.com ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] ClamAV Webinar on 3rd December
Per Jessen wrote: Nigel Horne wrote: For further details, including how to listen to the broadcast and a biography of the speaker, Török Edvin, please visit http://www.clamav.net/2008/10/30/clamav-best-practices-webinar/ Did I miss it, or is there no European or a VoIP dial-in point? No, it's still on for 3rd December. -Nigel -- Nigel Horne. Adjudicator, Arranger, Band Trainer, Conductor, Composer, Tutor. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] ClamAV Webinar on 3rd December
Hi Everyone, The next ClamAV Webcast will be on Wednesday 3rd December at 1800UTC (1300EST). The presentation will cover common pitfalls in the deployment of ClamAV. It will then recommend the best practices for logging, scan limits, SMP systems, usage of PUA, setting up freshclam, using ClamAV on more hosts on your network and submitting detection statistics, followed by an overview of the engine configuration flags found in 0.94.1. Finally the presentation will describe a recommended upgrade procedure, showing common pitfalls and best practices to avoid them such as forgetting to review configuration changes, testing the new version before deployment and restarting the daemons. The broadcast will include a QA session. For further details, including how to listen to the broadcast and a biography of the speaker, Török Edvin, please visit http://www.clamav.net/2008/10/30/clamav-best-practices-webinar/ As always this session will be recorded and archived on ClamAV.net and Sourcefire.com. Finally, if you have any topic you'd like to see us cover in the future, or if you'd like to give a presentation (we welcome talks from the community), please contact me at [EMAIL PROTECTED] or +44 1226 241048. I hope you can join us. Regards, Nigel -- Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by November 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] ClamAV 0.94.1
Folks, We are pleased to announce the release of the for ClamAV 0.94.1. There is one new feature in this release. This feature allows ClamAV users optionally to submit statistics to us about what they detect in the field. We will then use this data to determine what types of Malware/Viruses are the most detected in the field and in what geographic area they are. Otherwise this is a bug fix release. For further information please refer to www.clamav.net. -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by November 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] [Clamav-users] Announcing ClamAV 0.94.1 RC1
Folks, 0.94.1 RC1 was published on schedule yesterday. For details of the new features please refer to the Changelog. For an overview please refer to http://www.clamav.net/press/0.94.1-WhatsNew.pdf. We encourage as many people as possible to test this release candidate by downloading it from www.clamav.net. If you don't have access to a test machine you can still help by downloading it and checking for us that it compiles and links on your platform. If you do have a test machine/model/network please help us by loading ClamAV 0.94.1RC1 and testing. All bug reports should be filed at http://bugs.clamav.net. We also encourage all 3rd party developers of products and distribution/port maintainers to download and check this update so that you can go live as soon as the final version is released. Thank you for your continued support and help, -Nigel -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] Announcing ClamAV 0.94.1 RC1
Folks, We are pleased to announce the availability of the first release candidate for ClamAV 0.94.1. 0.94.1RC1 is scheduled for release on Wednesday (15/10/08). There will be one new feature in this release. This feature will allow ClamAV users optionally to submit statistics to us about what they detect in the field. We will then use this data to determine what types of Malware/Viruses are the most detected in the field and in what geographic area they are. Otherwise this will be a bug fix release; it will close the following bugs from http://bugs.clamav.net (please note that this is an initial list and both it and the schedule may change without notice): 684, 777, 828, 832, 954, 1046, 1085, 1092, 1098, 1135, 1137, 1145, 1150, 1154, 1155, 1157, 1158, 1160, 1162, 1165, 1174, 1179, 1181, 1184, 1185, 1186, 1187, 1189, 1192, 1196, 1197, 1199, 1201, 1203, 1204, 1205, 1210 1211, 1212, 1213, 1216, 1217, 1219 and 1221. We encourage as many people as possible to test this release by downloading it from www.clamav.net as soon as it becomes available. If you don't have access to a test machine you can still help by downloading it and checking for us that it compiles and links on your platform. If you do have a test machine/model/network please help us by loading ClamAV 0.94.1RC1 and testing. All bug reports should be filed at http://bugs.clamav.net. We also encourage all 3rd party developers of products and distribution/port maintainers to download and check this update so that you can go live as soon as the full version is released. Regards, -Nigel -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by November 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] ClamAV 0.94 Webinar Reminder
Hi Everyone, My apologies for sending this again if you've already read this. It's a reminder for those who may have missed it last week. The next ClamAV users webcast will be tomorrow at 1700GMT (1800BST; 1900CEST; 1300EDT). The presentation, given by Török Edwin, will cover the new features of ClamAV 0.94, such as logical signatures and unit testing, and also its improvements in areas such as anti-phishing and script scanning. This will be followed by an overview of the evolution of anti-phishing and script malware detection technology in ClamAV from 0.93 to 0.94, and by a live demonstration of how to use some of the new and improved features in 0.94. Registration Details for the live session: Date: Wed 3rd September Time: 1700GMT Registration link: https://sourcefire.webex.com/sourcefire/onstage/g.php?d=799008644t=a As always this session will be recorded and archived on ClamAV.net and Sourcefire.com. I hope you can join us. Regards, Nigel -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by September 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] chm submodule disabled with daily.cvd
Yuri Dario wrote: Hi, thanks to the new test suite in 0.94rc1, I discovered something not working as required in the OS/2 port (and fixed it). Please submit a patch to http://bugs.clamav.net Thanks, -Nigel [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] ClamAV 0.94 Webinar
Hi Everyone, The next ClamAV users webcast will be Wednesday 3rd September at 1700GMT (1800BST; 1900CEST; 1300EDT). The presentation, given by Török Edwin, will cover the new features of ClamAV 0.94, such as logical signatures and unit testing, and also its improvements in areas such as anti-phishing and script scanning. This will be followed by an overview of the evolution of anti-phishing and script malware detection technology in ClamAV from 0.90 to 0.94, and by a live demonstration of how to use some of the new and improved features in 0.94. Registration Details for the live session: Date: Wed 3rd September Time: 1700GMT Registration link: https://sourcefire.webex.com/sourcefire/onstage/g.php?d=799008644t=a As always this session will be recorded and archived on ClamAV.net and Sourcefire.com. I hope you can join us. Regards, Nigel -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by September 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] 0.94RC1 announcement
Folks, We are pleased to announce the availability of the first release candidate for ClamAV 0.94. 0.94RC1 is scheduled for release this Friday (15/8/08); 0.94 is currently scheduled for release on 1/9/08. The primary improvements and new features included in this release are: · Logical signatures · Anti-Phishing Technology · Disassembly engine · Improved scanning of scripts · Data Loss Prevention (DLP) · PUA Detection · IPv6 support · More flexibility when scanning remote file systems · Improved QA and unit testing We encourage as many people as possible to test this release by downloading it from www.clamav.net as soon as it becomes available. If you don't have access to a test machine you can still help by downloading it and checking for us that it compiles and links on your platform. If you do have a test machine/model/network please help us by loading ClamAV 0.94RC1 and testing. All bug reports should be filed at http://bugs.clamav.net. We also encourage all 3rd party developers of products and distribution/port maintainers to download and check this important release so that you can go live as soon as the full version is released. For more details of what is included in this release, please refer to http://www.clamav.net/press/0.94-WhatsNew.pdf. Regards, -Nigel Horne -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by September 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] [Fwd: 0.94RC1 announcement]
Folks, We are pleased to announce the availability of the first release candidate for ClamAV 0.94. 0.94RC1 is scheduled for release this Friday (15/8/08); 0.94 is currently scheduled for release on 1/9/08. The primary improvements and new features included in this release are: · Logical signatures · Anti-Phishing Technology · Disassembly engine · Improved scanning of scripts · Data Loss Prevention (DLP) · PUA Detection · IPv6 support · More flexibility when scanning remote file systems · Improved QA and unit testing We encourage as many people as possible to test this release by downloading it from www.clamav.net as soon as it becomes available. If you don't have access to a test machine you can still help by downloading it and checking for us that it compiles and links on your platform. If you do have a test machine/model/network please help us by loading ClamAV 0.94RC1 and testing. All bug reports should be filed at http://bugs.clamav.net. We also encourage all 3rd party developers of products and distribution/port maintainers to download and check this important release so that you can go live as soon as the full version is released. More more details of what is included in this release, please refer to http://www.clamav.net/press/0.94-WhatsNew.pdf. Regards, -Nigel Horne -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management (ClamAV), Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334, Skype: nigelhorne Come to Las Vegas to see the latest in Sourcefire and open source innovation. Register at www.bossconference.com by September 30th to save $200! ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] ClamAV Webinar Invitation
Dear All, You are all invited to attend what we hope will be the first in a series of ClamAV webinars presented by members of the ClamAV team within Sourcefire. The talk, given by ClamAV author and Sourcefire's ClamAV CTO, Tomasz Kojm, will cover a broad introduction to ClamAV. The presentation will last approximately one hour and cover: a.. An overview of ClamAV b.. Architecture c.. Deployment and installation d.. The detection mechanism e.. Troubleshooting f.. QA Date: Wednesday, 11th June, 2008 Time: 10 AM PDT, 1 PM EDT, 6 PM BST, 7 PM CEDT To register for this webinar please visit https://sourcefire.webex.com/mw0305l/mywebex/default.do?siteurl=sourcefireservice=6. The session will be archived and available later from www.clamav.net. I hope that you join us. -Nigel Horne -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management ClamAV, Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334 ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] 0.93.1RC1
Dear All, As you may have seen, the first release candidate of 0.93.1 was published earlier this week. 0.93.1 http://downloads.sourceforge.net/clamav/clamav-0.93.1rc1.tar.gz is a maintenance release with bug fixes for issues raised with 0.93 for example portability problems and other issues discovered by our internal auditing process. It also features improved handling of PDF, CAB, RTF, OLE2 and HTML files. We welcome any feedback and bugs on this RC prior to the release of 0.93.1, which is currently scheduled for 6th June. It doesn't matter if you don't have a test environment, you can still help us for example by downloading the release candidate and checking it compiles on your system even if you don't install it; we particularly welcome reports on platform compatibility. Please put any problems you find on our Bugzilla system at https://wwws.clamav.net/bugzilla/, don't post them here. For detailed information please refer to http://lurker.clamav.net/message/20080304.110134.02e9c4c4.en.html -Nigel Horne -- Nigel Horne, [EMAIL PROTECTED] Director of Product Management ClamAV, Sourcefire, http://www.sourcefire.com +44 1226 241048 or +1 706 705 4022 FAX: +44 870 705 9334 ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] OS/2 patches for clamav 0.93 - patch-0_93_0 [1/1]
I hope that the official cygwin d_ino.patch that I already sent some really long time ago would be used, since it has a Configure test for the missing d_ino member, and doesn't hardcode wrong OS assumptions. Cygwin had only for a small timeframe this problem. Did you post it to our bugzilla system? That's the best place for patches. Reini Urban -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] Release Candidate Questionnaire
Thank you to all that have taken the time to fill in and respond to the Release Candidate Questionnaire. The response has been very encouraging and we have received many useful and helpful ideas to move the RC process forward. One popular idea was announcing that an RC will be available before publication so that people can set aside time - you can see we've already started this with the pre-announcement of 0.93.1RC1. The survey is still open at https://www.surveymonkey.com/s.aspx?sm=50jD3TV0RLtgwzPAPP4kYg_3d_3d please feel free to carry on filling in forms. The winners of the shopping spree have been contacted. Those forms now received will no longer be entered into a prize draw. Regards, -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] .cld file status
Andy Fiddaman wrote: Does anyone know the status of the new support for .cld files in the SVN code? I've been playing with the latest SVN code on a development box and I'm having problems with the new .cld container files. Everything's fine until an incremental update occurs then a .cld file appears and clamd exits due to a corrupt database. If this new code isn't finished yet I'll leave it for now, but if it's supposed to be working then I'll work out what's going wrong and open a bug. The work around is to remove /usr/local/share/clamav/daily*, rerun freshclam, and restart clamd. Please open a bug report and mark it as CVS only (there's no SVN flag), even though it's known about, by opening a bug you'll keep a place holder there for progress. Thanks, Andy Happy New Year! -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] shutup some warnings
aCaB wrote: Gianluigi Tiesi wrote: j:\microsoft visual studio\local\include\zlib.h(198) : note C6311: j:\devel\clamav\native-clamav\clamav-devel\libclamav\nsis\nsis_zlib.h(196) : see previous definition of 'Z_ASCII' j:\microsoft visual studio\local\include\bzlib.h(125) : note C6311: j:\devel\clamav\native-clamav\clamav-devel\libclamav\nsis\nsis_bzlib.h(77) : see previous definition of 'BZ_API' I'm aware, but thanks again. The nsis code is not yet complete (e.g. it currently doesn't compile on Solaris 8). Or MACOS/X. I'm not sure if the email I sent you got lost, let me know if you need me to send it again. aCaB -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] shutup some warnings
aCaB wrote: Nigel Horne wrote: Or MACOS/X. I'm not sure if the email I sent you got lost, let me know if you need me to send it again. No Nigel I never lose your emails. I know, but my point was I didn't think they'd gone out at this end. -aCaB -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] Patch available on Bugzilla
I posted it on Bugzilla (#505), but still it is tagged for security group visibility only. Is it normal? Flag changed, but please note that all patches should be against SVN, not the released version . Best regards, Benoît Mazzetti -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] clamav-milter: username is used instead of email address
Michael Schaap wrote:
Hi,
I noticed that virus notifications sent by clamav-milter only contain
the recipient's username, and not the full email address.
This is rather unfortunate, since this makes it hard to figure out which
email address has been compromised, if you have multiple aliases /
virtusernames.
I had a look at the code, and noticed:
static sfsistat
clamfi_envrcpt(SMFICTX *ctx, char **argv)
{
(...)
to = smfi_getsymval(ctx, {rcpt_addr});
if(to == NULL)
to = argv[0];
(...)
}
While argv[0] is guaranteed to contain the full recipient email address
(e.g. [EMAIL PROTECTED]), it appears that the {rcpt_addr}
macro only contains the bare username (e.g. myusername). (This is
after applying the virtusertable, but before applying aliases.)
My guess is that {rcpt_addr} is used instead of argv[0] because of
whitelist checking.
No, it was changed because users wanted it to be changed.
– Michael
-Nigel
___
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
RE: [Clamav-devel] clamav-milter sendfile() Error Messages Filled-upMy Console
On Sat, 21 Oct 2006 09:08:01 +0100 Nigel Horne [EMAIL PROTECTED] wrote: Please only send patches against the latest code. This patch is not needed against the version in CVS and hasn't been for some time. Hi. This is imacat from Taiwan. Sorry that I dod not see this change in the newly-released ClamAV 0.88.6. Is it in 0.90? Or is it missed? 0.88.* is old code. 0.90 is newer, and indeed has the latest clamav-milter in it. -- Best regards, imacat ^_*' [EMAIL PROTECTED] PGP Key: http://www.imacat.idv.tw/me/pgpkey.txt ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter sendfile() Error Messages Filled-up My Console
imacat wrote: Dear all, Hi. This is imacat from Taiwan. I'm running clamav-milter ClamAV 0.88.5 on my Debian GNU/Linux 3.1r3 Kernel 2.6.16.14. Please only send patches against the latest code. This patch is not needed against the version in CVS and hasn't been for some time. -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] making concurrent freshclam
Dilyan Palauzov wrote: Hello, On my system clamav-milter crasesh from time to time (disappears, issues clamfi_close, whatever). This happens usually during spam attacks (high load). On my system the cron executes everything twice, instead of once. Thus freshclam is executed twice, sometimes within a very small difference in the time.. *Is it possible, that that the second freshclam blocks the access to the DB and the clamav-milter turns itself off as result? Version of clamav-milter? Operating system? Options given to clamav-milter? I doubt it happens as you describe, but I will look into it. One test is to try --external mode in clamav-milter. -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] making concurrent freshclam
I have found that starting concurrent copies of freshclam can give logg() errors, but I'm yet to find it resulting in anything crashing. The logg problems are, I suspect, because of issues in the logfile locking code, which it's true should be addressed. [EMAIL PROTECTED] freshclam]# freshclamfreshclamfreshclam [1] 5693 [2] 5694 ClamAV update process started at Fri Oct 6 10:57:45 2006 ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log). ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log). [1]- Exit 62 freshclam [EMAIL PROTECTED] freshclam]# Connecting via 192.168.1.1 main.cvd is up to date (version: 40, sigs: 64138, f-level: 8, builder: tkojm) Connecting via 192.168.1.1 daily.cvd is up to date (version: 1999, sigs: 7379, f-level: 8, builder: sven) -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] making concurrent freshclam
Tomasz Kojm wrote: On Fri, 06 Oct 2006 10:59:58 +0100 Nigel Horne [EMAIL PROTECTED] wrote: I have found that starting concurrent copies of freshclam can give logg() errors, but I'm yet to find it resulting in anything crashing. The logg problems are, I suspect, because of issues in the logfile locking code, which it's true should be addressed. What about LogFileUnlock yes? The inference from the comment the lock protects against running clamd multiple times is that one should not use that option. Having said that it doesn't mention about protecting against multiple copies of freshclam. -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] making concurrent freshclam
Tomasz Kojm wrote: On Fri, 06 Oct 2006 11:32:52 +0100 Nigel Horne [EMAIL PROTECTED] wrote: Tomasz Kojm wrote: On Fri, 06 Oct 2006 10:59:58 +0100 Nigel Horne [EMAIL PROTECTED] wrote: I have found that starting concurrent copies of freshclam can give logg() errors, but I'm yet to find it resulting in anything crashing. The logg problems are, I suspect, because of issues in the logfile locking code, which it's true should be addressed. What about LogFileUnlock yes? The inference from the comment the lock protects against running clamd multiple times is that one should not use that option. Having said that it doesn't mention about protecting against multiple copies of freshclam. This doesn't answer my question. Does LogFileUnlock yes added to freshclam.conf solve the issue? That's because 1) LogFileUnlock goes in clamd.conf. If freshclam.conf also supports LogFileUnlock then that should be documented in the freshclam.conf that is included with the distribution. [EMAIL PROTECTED] ~]$ cd src/clamav-devel/etc [EMAIL PROTECTED] etc]$ fgrep -i unlock *.conf clamd.conf:#LogFileUnlock yes [EMAIL PROTECTED] etc]$ 2) The comment tells you to avoid enabling it! -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Patch to allow spaces in file and directorynames in clamd/freshclam config files
Attached is a patch which implements OPT_QUOTESTR. OPT_QUOTESTR
includes everything between quotes (if present), or for backward
compatibility, acts as OPT_STR if the next token doesn't start with a
quote character (' or ). OPT_QUOTESTR is then used for file and
directory paths as in the prior patch.
What happens if there's only one quote character on a line?
- Mark Pizzolato
-Nigel
___
http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Patch to allow spaces in file and directorynames in clamd/freshclam config files
[EMAIL PROTECTED] wrote:
On Tuesday, September 05, 2006 at 12:46 AM Nigel Horne wrote:
Mark Pizzolato wrote:
Attached is a patch which implements OPT_QUOTESTR. OPT_QUOTESTR
includes everything between quotes (if present), or for backward
compatibility, acts as OPT_STR if the next token doesn't start with
a
quote character (' or ). OPT_QUOTESTR is then used for file and
directory paths as in the prior patch.
What happens if there's only one quote character on a line?
The patch will tolerate an opening quote without a closing quote and
strip the opening quote.
It would be better to warn the user and return an error.
- Mark Pizzolato
--
Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor,
Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
___
http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Devising malicious zip files
This is already fixed in the latest CVS, though I'm not sure of the production version: [EMAIL PROTECTED] tmp]$ clamscan --block-max test.zip zip.zip: Archive.ExceededRecursionLimit FOUND --- SCAN SUMMARY --- Known viruses: 60743 Engine version: devel-20060701 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.00 MB Time: 1.843 sec (0 m 1 s) [EMAIL PROTECTED] tmp]$ [EMAIL PROTECTED] wrote: This zip file (see http://iki.fi/v/tmp/test.zip) created with the below script (see http://iki.fi/v/tmp/test.create) is treated worse than it could be by ClamAV. It doesn't cause ClamAV to run out of memory (applause), but ClamAV would probably use infinite time inspecting it and doesn't seem to find the virii (Eicar test virus) buried in it. It seems ClamAV uses breadth-first search to extract the recursive zip, rather than depth-first. F-Prot seems to do depth-first and immediately begins reporting virus infections. I suggest the following to treat this sort of malicious .zip's better: - use depth-first search (will not help, of course, if the virus is _only_ in the last leaf of the zip tree) - (optionally) bail out on first infection. This zip contains millions of virii (depending on which parameters you choose in the script), no point in finding them all - limit recursion depth / cpu time somehow and decide the zip is malicious if these limits are met. Searching through all of this zip would possibly take millions of years. Imagine someone sending a few hundred of these to a mail gateway using virus filtering. Of, course this is not limited to .zip but all archive formats potentially have the same problem. --- # Create test.zip f=foo mkdir $f for i in $(seq 1 10); do # create 10 files full of zero touch $f/$f-$i; perl -e 'truncate '$f/$f-$i', 1024**2'; done # add a test virus wget http://www.eicar.org/download/eicar_com.zip -O foo/foo.zip # recursively create a tree of zips for j in $(seq 1 30); do mkdir $j zip -9 $j/$j-1.zip $f/$f* for i in $(seq 2 20); do ln $j/$j-1.zip $j/$j-$i.zip; done f=$j done zip -9 test.zip $f/$f* --- ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Patch to support domainkeys
Loren M. Lang wrote: Attached is a patch which add a command-line option to tell clamav-milter to insert X-Virus-* headers to the top of the e-mail just above the received line added by the MTA scanning e-mail. From section 3.6 of RFC2822: It is important to note that the header fields are not guaranteed to be in a particular order. -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
[Clamav-devel] Re: [Clamav-announce] ClamAV and Google Summer of Code
Luca Gibelli wrote: Dear ClamAV users, The ClamAV project is happy to join Google's Summer of Code 2006 and get some help from emerging developers to quickly implement some of the features (see http://www.clamav.net/news/soc2006.html) that are currently on our TODO list. Implement generic phishing detection module based on URL spoofing detection. Much of this one is already done (see libclamav/mbox.c) , if anyone decides to take it up please speak to me first to stop re-inventing the wheel! -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
RE: Re: RE: [Clamav-devel] why don't write portable code
GiM,您好！ your said Programming in these environments is totaly different, and creating one universal engine wouldn't be reasonable. YOU COULD NOT PROOF IT. The engine is pure! It only match signature one a file! match signature could use standar c or c++. I strongly suggest that we all stop feeding the troll. BSCH [EMAIL PROTECTED] 2006-04-02 -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter logging
On Thu, Mar 30, 2006 at 01:50:06PM +0500, Sergey wrote: On Friday 13 January 2006 23:05, Nigel Horne wrote: Hello. Which component of clamav-milter write to log [49156] cur 0 new 1 nextmask 2 [49156] got cmd 'D' len 148 [49156] cur 1 new nextmask 2004 [49156] got cmd 'C' len 42 [49156] cur 1 new 2 nextmask 2004 [49156] got cmd 'D' len 1 ? I wish to forbid it, but I can not understand, how. :-( Disable LogVerbose in clamd.conf Hm... I run clamav-milter as clamav-milter --config-file=/etc/clamav/clamav-milter.conf # cat /etc/clamav/clamav-milter.conf|grep Log|grep -v ^# LogFile /var/log/clamav/clamav-milter.log LogSyslog LogVerbose LogFacility LOG_MAIL LogFileMaxSize 5M LogTime # ls -l /var/log/clamav/clamav-milter.log -rw--- 1 mail mail 6807552 ??? 30 12:32 /var/log/clamav/clamav-milter.log Why is size of log more 5M ? I removed clamav-milter.log some minutes ago. And clamav-milter is crashing if log size is 2Gb. It is so big because you haven't followed my instruction to disable LogVersbose. -- Regards, Sergey ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter logging
On Thu, Mar 30, 2006 at 03:04:33PM +0500, Sergey wrote:
On Thursday 30 March 2006 14:30, Sergey wrote:
It is so big because you haven't followed my instruction to disable
LogVersbose.
I can't disable LogVersbose because I need of verbose syslog.
Can You prompt where this file is written? I have found only
static void logger (const char *mess) but this function is
caused only in case of non external mode...
if(cfgopt(copt, LogVerbose)-enabled) {
logVerbose = 1;
#if ((SENDMAIL_VERSION_A 8) || ((SENDMAIL_VERSION_A == 8)
(SENDMAIL_VERSION_B = 13)))
smfi_setdbg(6);
#endif
}
--
Regards,
Sergey
-Nigel Horne
___
http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter logging
Sergey wrote: What do you think about adding clamav-milter.conf in package ? Some parameters for clamd and clamav-milter should not be identical. And it seems to me, that clamav-milter it is necessary to allocate in the separate project as it is absolutely not obligatory to change clamav-milter and clamd simultaneously. Does --config-file not work? -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Worm.VB-8
Dirk Mueller wrote: On Wednesday 18 January 2006 00:11, Nigel Horne wrote: Patch attached. Nope. Yep. I've checked - the patch was attached in the email as it left here. Dirk -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] possible scan evasion
Damian Menscher wrote: I got a virus this morning that made it past clamav-milter 0.87.1. The attachment was double-encoded: after decoding the base64 email, it left a uuencoded file. That file apparently bypassed being scanned because it had a ^M at the end of the line (which violates the spec, but don't tell M$ that!). So uudecode barfed on it with a No `end' line message. But passing it through dos2unix results in a uudecode-able file, which was then recognized as Worm.VB-8. I'm guessing the uudecoder in clamav needs to be modified to strip any ^M from the file to allow for successful decoding? Note that I haven't yet looked at the source, as I wanted to get the warning out quickly. Damian Menscher A patch for this was posted to the clamav-team for testing earlier today. -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
[Clamav-devel] Worm.VB-8
Patch attached. Note 1) This is against the latest CVS 2) There are two new files (uuencode.[ch]). I am not an autoconf guru so they are not built automagically, you will need to build them by hand. 3) All patches go into .../libclamav. Please report back ASAP so that I can commit the changes to CVS to stop the patches becoming redundant and to allow an autoconf guru to address the Makefile issue. -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Patch to fix broken sendfile on Linux 2.6
imacat wrote: Hi, I'm imacat from Taiwan. Has this issue been taken care by someone? I'm experiencing this same problem with my Linux 2.6. But I did not see this issue solved in the just-released ClamAV 0.88. The patch was included in CVS sometime ago. It was an oversight that it was not included within 0.88. ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter logging
On Fri, 2006-01-13 at 15:06 +0400, Sergey wrote: Hello. Which component of clamav-milter write to log [49156] cur 0 new 1 nextmask 2 [49156] got cmd 'D' len 148 [49156] cur 1 new nextmask 2004 [49156] got cmd 'C' len 42 [49156] cur 1 new 2 nextmask 2004 [49156] got cmd 'D' len 1 ? I wish to forbid it, but I can not understand, how. :-( Disable LogVerbose in clamd.conf -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
RE: [Clamav-devel] clamav-milter use smfi_insheader if available
Why does the order of headers matter? -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Two patches
Gianluigi Tiesi wrote: it makes better handle error messages and correcly initialize curl on win32 Patches applied (with one small fix) to CVS. Many thanks, -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Two patches
Gianluigi Tiesi wrote: http://oss.netfarm.it/clamav/patches/curl.diff Thank you for this, however there was no associated documentation which leaves me to guess what the reason for this patch is, and sadly after Christmas my ESP chip is malfunctioning. http://oss.netfarm.it/clamav/patches/curl.diff Bye -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Patch to fix broken sendfile on Linux 2.6
Simon Munton wrote: Hi, After I started using linux kernel 2.6, I found that virus emails were not being moved to the quarantine directory, and an 'Invalid argument' message was being logged. I tracked this down to the call to sendfile in clamav-milter.c. It appears that on kernel 2.6, sendfile will not do a file to file copy. The attached patch detects the sendfile failure, and falls back to a read then write copy loop No attachment received, but I will look into it and provide a fix if needed for myself. Simon -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Tutor, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] ClamAV infinite loop
Stephen Gran wrote:
On Sun, Nov 27, 2005 at 02:03:59PM +, Nigel Horne said:
On Wed, 2005-11-16 at 21:41, Brian Bebeau wrote:
cli_realloc() doesn't fail, so it never breaks out of the loop
from that.
From cli_realloc:
if(!size || size MAX_ALLOCATION) {
cli_errmsg(Attempt to allocate %d bytes. Please report to
[EMAIL PROTECTED], size);
return NULL;
}
Looks like a failure to me!
That only fails if the size parmaeter is NULL or too big.
Untrue, it can also fail if the call to realloc fails.
It is true that from realloc(3): If realloc()
fails the original block is left untouched - it is not freed or moved.
In this case I would argue that it would be better, and more consistent,
for cli_realloc to fail, since for clamAV the action of realloc to
return the original pointer if realloc fails is useless. But that is an
issue with cli_realloc, NOT with mbox.c as implied by the OP.
--
Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
___
http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] ClamAV infinite loop
Try this patch in .../clamav-devel/libclamav:
*** Oothers.c 2005-11-28 09:01:06.0 +
--- others.c2005-11-28 09:02:03.0 +
***
*** 354,360
cli_errmsg(cli_realloc(): Can't re-allocate memory to %d
byte.\n, size);
perror(realloc_problem);
return NULL;
! } else return alloc;
}
unsigned int cli_rndnum(unsigned int max)
--- 354,366
cli_errmsg(cli_realloc(): Can't re-allocate memory to %d
byte.\n, size);
perror(realloc_problem);
return NULL;
! }
! if(alloc == ptr) {
! cli_errmsg(cli_realloc(): Can't re-allocate memory to %u
bytes\n, size);
! free(ptr);
! return NULL;
! }
! return alloc;
}
unsigned int cli_rndnum(unsigned int max)
--
Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
___
http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] help needed on messageDedup routine
Brian Bebeau wrote: Nigel Horne wrote: Brian Bebeau wrote: Could someone please explain how the messageDedup() routine in libclamav/message.c is supposed to work? It doesn't seem to actually be de-allocating anything. It's spinning in the second for() loop. Since t2 is defined as t1-t_next, how will the strcmp() of d1 and d2 ever be 0? If the two lines' contents are the same thus: hello world world Oh, OK, gotcha. So it only deallocates duplicate lines? So in practice it probably won't free up much space. Is there any way to turn this off so large files don't take so long? Yes- fix your ulimit so that the routine doesn't need to be called. ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] help needed on messageDedup routine
Brian Bebeau wrote: Could someone please explain how the messageDedup() routine in libclamav/message.c is supposed to work? It doesn't seem to actually be de-allocating anything. It's spinning in the second for() loop. Since t2 is defined as t1-t_next, how will the strcmp() of d1 and d2 ever be 0? If the two lines' contents are the same thus: hello world world -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Clamscan ported to DJGPP
On Tue, 2005-10-04 at 07:11, Blair Campbell wrote: Here I have a patch for the clamav CVS that allows compiliation of libclamav and clamscan on DJGPP. Note that in addition to the patch, the ./configure script needs to also #define lstat stat and #define d_ino d_namlen for DJGPP. mbox.c: #ifC_SOLARIS __GNUC__ #undef WITH_CURL +#elif defined(__DJGPP__) +#undef WITH_CURL #endif Not needed - just specify --without-curl to configure. The Solaris way is specific to that platform and is not a generic pointer for other systems, which is they way you seem to have treated it. Mind you, if curl isn't supported on DJGPP, how come configure doesn't notice that. You would be better to supply a patch to that, since putting operating system specific mods to code isn't likely to be looked on favourably unless it is absolutely necessary and no other workaround works. The configure program is the place for OS specific code. -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] [patch] Support for some GNU extension in untar.c
Daniel Fahlgren wrote: Here [1] is a patch to support some GNU extension in untar.c, the ones supported now are volume headers [2], long file names [3] and long names for symbolic links [4]. Patch applied, and thanks also for the test cases. Best regards Daniel Fahlgren -Nigel -- Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clam 0.85 doesn't build when configured with --enable-debug
On Saturday 14 May 2005 15:28, Per Jessen wrote: gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I./zziplib -I./mspack -g -O2 -MT tnef.lo -MD -MP -MF .deps/tnef.Tpo -c tnef.c -fPIC -DPIC -o .libs/tnef.lo tnef.c: In function `tnef_message': tnef.c:216: error: `attTNEFVERSION' undeclared (first use in this function) tnef.c:216: error: (Each undeclared identifier is reported only once tnef.c:216: error: for each function it appears in.) tnef.c:218: error: `i32' undeclared (first use in this function) make[2]: *** [tnef.lo] Error 1 Why are you using --enable-debug? -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav-milter 0.85 problems with /dev/console
On Wednesday 11 May 2005 23:36, Brian J. France wrote: Any reason this was removed? Yes. It is true that I forgot the dropped privilege issue (now fixed and ready to be committed), but there was a reason for removing it. Brian -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] request some help on virus samples
On Thursday 28 Apr 2005 07:31, Jin Tao wrote: Now I am working on my undergraduate thesis, the topic is stream based anti-virus engine. And I implement the prototype based on clamav. I plan to deploy the prototype stream av engine on Apache proxy. Could you please do me a fovoar? Currently I couldn't find virus sample. I think you must have some copies. If available, could you please send me some typical bm virus signature, av virus , etc. www.testvirus.com Thanks a lot for your help! Regards, Jin Tao ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Re: [Clamav-announce] announcing ClamAV 0.84rc 1
On Wednesday 20 Apr 2005 14:49, Tomasz Kojm wrote: On Mon, 11 Apr 2005 22:27:44 -0500 (CDT) Damian Menscher [EMAIL PROTECTED] wrote: So, it's been out for about 6 weeks, and I know of at least 4 people using it in production (and weblogs indicate there may be many more). One of those people actually has seen it restart the milter when it had failed. I have fairly high confidence in it, but it might be a good idea for NJH or one of the other developers to review its defaults. Nobody has complained about them, but it probably makes Nigel, could you please review the script? What script is this? -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Re: [Clamav-announce] announcing ClamAV 0.84rc 1
On Wednesday 20 Apr 2005 15:02, Trog wrote: On Wed, 2005-04-20 at 15:00 +0100, Nigel Horne wrote: Nigel, could you please review the script? What script is this? This one: http://www.itg.uiuc.edu/itg_software/clmilter_watch/ I don't see the need for it. Clamav-milter is stable. One of those people actually has seen it restart the milter when it had failed. No bug report was received that the milter is failing. It would be a better use of the author's time to track down alledged problems with existing software than write yet more software. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] [PATCH] performance/correctness/size fix for isnumb()
for(i=0; istrlen(s); i++)... has quadratic run time. Not a problem in current code (it is never called on more than LINE_LENGTH (1024) bytes, thus touches 'only' 500 Kbytes at most), but it is not a good practice anyway. Especially since we don't need strlen() here _at all_. I talked about this in a recent posting to other team members. Indeed I mentioned a solution which, not only removes any calls to strlen but needs no temporary variables at all (your unsigned char c is not needed). So a fix is already in the queue, but thanks anyway. ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] patch for QNX
On Thursday 03 Mar 2005 09:56, -=MikeP=- wrote: +#ifdef C_QNX6 + snprintf(fullname, sizeof(fullname), %s/clamavtmpX, dir); Is that right? QNX's mkstemp takes 13Xs not the standard 6? +#else snprintf(fullname, sizeof(fullname) - 1 - suffixLen, %s/%.*sXX, dir, (int)(sizeof(fullname) - 9 - suffixLen - strlen(dir)), filename); +#endif -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] something seemingly wrong in libClamAV\line.c
On Tuesday 01 Mar 2005 06:24, Jin Tao wrote: Line 60 in libClamAV\Line.c is line_t *ret = (line_t *)li_malloc(sizeof(struct line)); ,which I think should be line_t *ret = (line_t *)cli_malloc(sizeof(struct line)); Is that right? I don't know what li_malloc means. It means this is a typo. Must be something called li_malloc somewhere. Thanks for the keen eye, I'll fix it. jintao -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamscan crash when '--no-mail' option not set
On Sunday 27 Feb 2005 16:24, Robert Allerstorfer wrote: clamscan /usr/share/doc/openssl-0.9.7a/ssleay.txt Seems OK to me, using the latest version from CVS: [EMAIL PROTECTED] ~]$ clamscan /usr/share/doc/openssl-0.9.7a/ssleay.txt /usr/share/doc/openssl-0.9.7a/ssleay.txt: OK --- SCAN SUMMARY --- Known viruses: 31238 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 2.39 MB I/O buffer size: 131072 bytes Time: 1.869 sec (0 m 1 s) [EMAIL PROTECTED] ~]$ -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] MIME header processing glitch
On Friday 25 Feb 2005 05:45, Richard Lyons wrote: On Fri, 2005-02-25 at 11:06 +1000, Richard Lyons wrote: The problem is that clamav is treating the boundary specifier as a comment, with the result that it can't process messages that contain this type of boundary separator. After further testing it seems I was wrong, clamscan does detect a virus in a message with this sort of MIME header. The warning is wrong but the code still does the right thing. The sample you sent had no virus in it so I can't substatiate this claim. Since I have no virus to test against I am unwary about making any changes since I have no idea if the changes would break it. Cheers, Rick. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] MIME header processing glitch
On Friday 25 Feb 2005 15:09, Nigel Horne wrote: On Friday 25 Feb 2005 05:45, Richard Lyons wrote: On Fri, 2005-02-25 at 11:06 +1000, Richard Lyons wrote: The problem is that clamav is treating the boundary specifier as a comment, with the result that it can't process messages that contain this type of boundary separator. After further testing it seems I was wrong, clamscan does detect a virus in a message with this sort of MIME header. The warning is wrong but the code still does the right thing. The sample you sent had no virus in it so I can't substatiate this claim. Since I have no virus to test against I am unwary about making s/unwary/wary/ any changes since I have no idea if the changes would break it. I notice that the boundaries don't have quotes around the bracketed bit. Cheers, Rick. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] Re: Partial MIME support
On Thursday, February 24, 2005, at 08:15 pm, John Peacock wrote: Nigel Horne wrote: Please do NOT apply this without thorough checking of the knock-on effect of scanning bounces and digest emails. If I am not understanding the use of the cli_smagic[] construct, please forgive me. My brief skimming of the code suggests that cli_smagic[] is only used to hint the parser as to what type of file has been presented for scanning. This was just a quick way to clue the scanner into trying to scan the file as mail. It isn't the structure of the table which is the point, you need to think about when cli_filetype() is called. The patch may be OK, but I am warning people to do LOTS of regression testing before using in the wild and am giving clues about why. John -Nigel Horne ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamAV on QNX
On Monday 21 Feb 2005 06:54, -=MikeP=- wrote: It would be great if there would be fixes of that kind in ClamAV: 1) add support for QNX NTO in configure.in: Some good news and some bad news. First the good news: I've found a copy of QNX RTOS 6.1.0 on an old cover CD from PCPlus magazine (issue 181) for those interested. And it boots and installs fine with qemu. Looks a nice interface. Now the bad news: I can't find a C compiler with it. (cc and gcc both not found). I didn't seem to recognise the emulated network card. Both the bad news items may well be because of my lack of knowledge for QNX. All help appreciated. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamAV on QNX
On Wednesday 23 Feb 2005 10:14, Nigel Horne wrote: Now the bad news: I can't find a C compiler with it. (cc and gcc both not found). Sorted (I found the installer program) I didn't seem to recognise the emulated network card. Still to be sorted :-( -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamAV on QNX
On Monday 21 Feb 2005 06:54, -=MikeP=- wrote: It would be great if there would be fixes of that kind in ClamAV: 1) add support for QNX NTO in configure.in: What is NTO? nto*) if test $have_pthreads = yes; then AC_DEFINE(CL_THREAD_SAFE,1,[thread safe]) disable_gethostbyname_r=no fi AC_DEFINE(C_NTO,1,[os is QNX Neutrino]) Does this mean NTO == QNX? In this case why not #define C_QNX? -Nigel ___ http://lurker.clamav.net/list/clamav-devel.html
Re: Re[2]: [Clamav-devel] clamAV on QNX
On Monday 21 Feb 2005 09:25, -=MikeP=- wrote: Hello Nigel, Monday, February 21, 2005, 11:55:13 AM, you wrote: NH On Monday 21 Feb 2005 06:54, -=MikeP=- wrote: It would be great if there would be fixes of that kind in ClamAV: 1) add support for QNX NTO in configure.in: NH What is NTO? nto*) if test $have_pthreads = yes; then AC_DEFINE(CL_THREAD_SAFE,1,[thread safe]) disable_gethostbyname_r=no fi AC_DEFINE(C_NTO,1,[os is QNX Neutrino]) NH Does this mean NTO == QNX? In this case why not #define C_QNX? NH -Nigel NH ___ NH http://lurker.clamav.net/list/clamav-devel.html There are 2 versions of QNX: QNX4 - this system supports building programs in GNU way, but has too many problems with libtool and auto***. In other words - it is not suitable for porting... QNX6 (Neutrino) - usually referred to as QNX NTO so in many other apps and in fixed libtool it is known as NTO. I would not mind against C_QNX, but QNX4 users can misunderstand that and think QNX is supported. I understand, in that case howabout #define C_QNX6? -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-devel.html
Re: [Clamav-devel] clamav 0.83 exponential algorithm
Whilst your diagnosis was wrong, there was indeed an issue with your file which has now been fixed in CVS. Thanks for the bug report. -Nigel Horne -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: Re[2]: [Clamav-devel] ClamAV temporary files
On Thursday 17 Feb 2005 06:39, -=MikeP=- wrote: Hello Nigel, Wednesday, February 16, 2005, 5:43:14 PM, you wrote: NH On Wednesday 16 Feb 2005 14:44, -=MikeP=- wrote: 2) there was a problem with scanning e-mails: I suppose it is the problem of QNX: LibClamAV Error: Can't create temporary file: /tmp/clamav-b6b8e6d1db0cd71b/Snowwhite and the Seven Dwarfs -The Real Story!.eml049122: Filename too long LibClamAV Error: fileblobDestroy: file not saved: report to [EMAIL PROTECTED] NAME_MAX is defined to 255 PATH_MAX is defined to 1024 So then, on your system what are the circumstances under which open(..., O_CREAT) returns ENAMETOOLONG? Please also send me the file which gave that error so that I can check all is OK with other platforms. Send by zipping with the password 'virus' and emailing me. -Nigel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] small qtclamav client
On Thursday 17 Feb 2005 15:24, Giovanni Racciu wrote: Hi, I've just written a small Qt client for ClamAV and released it under the GPLv2 license. l How do you select that you wish to scan a directory? Comments and suggestions are welcome. Hope you find it useful. Ciao Giovanni -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] ClamAV temporary files
On Wednesday 16 Feb 2005 14:44, -=MikeP=- wrote: 2) there was a problem with scanning e-mails: I suppose it is the problem of QNX: LibClamAV Error: Can't create temporary file: /tmp/clamav-b6b8e6d1db0cd71b/Snowwhite and the Seven Dwarfs -The Real Story!.eml049122: Filename too long LibClamAV Error: fileblobDestroy: file not saved: report to [EMAIL PROTECTED] Does QNX have mkstemp()? -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] ClamAV temporary files
On Wednesday 16 Feb 2005 14:44, -=MikeP=- wrote: 2) there was a problem with scanning e-mails: I suppose it is the problem of QNX: LibClamAV Error: Can't create temporary file: /tmp/clamav-b6b8e6d1db0cd71b/Snowwhite and the Seven Dwarfs -The Real Story!.eml049122: Filename too long LibClamAV Error: fileblobDestroy: file not saved: report to [EMAIL PROTECTED] One more question, what is NAME_MAX on your system? -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] milter pidfile removal
On Wednesday 16 Feb 2005 17:36, Stephen Gran wrote: The attached patch removes the pidfile on shutdown for the milter. Low priority, but it would be nice if it could clean up after itself fully Yes, that patch looks reasonable and will be in 0.83a. Thanks for the patch. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] Clamav-milter must agree with the entry in sendmail.cf or sendmail.mc. WHY?
Your patch is out of date. Patches must be against the version in CVS. A fix for this was committed to CVS days ago. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] Sending SCAN command multiple times on the same socket fails.
On Tue, 2005-01-25 at 21:16, Ramon Amat wrote: I am using clamd and sending over a socket multiple times the SCAN command, as shown below. Add a SESSION command as indicated below. *WARNING*: as recently discussed on clamav-users, SESSION can hang freshclam/clamd on BSD. open socket SESSION SCAN filepath-1 SCAN filepath-2 SCAN filepath-3 close socket (I do that and not clamd!!!) ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] LibClamAV - Scanning File
On Friday 21 Jan 2005 06:49, Alexander Hagenah wrote: Can anybody help? You're trying to run cl_scandesc on an uninitialised descriptor (fd). OK. I tried to give fd a value with fopen, bot doesn't work. Same reuslt at executing. Compiling works, without any problems. Can you advise me, hoe to change my code, so that it will work? Use open, rather than fopen. ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter - Whitelist
On Thu, 2005-01-20 at 19:16, [EMAIL PROTECTED] wrote: Hi all, currenty I'm trying to hack this whitelist feature into the clamAV-milter. I hope that the tests will be finished by the end of next week. Right now following features are implemented * reading from a whitelist-file * file could be specified with a new commandline parameter (-W FILE/ --whitelist FILE) * reg-ex are enabled * # comments in the beginning of a line are allowed Some comments, whishes or helpful suggestions? I hope no-one else is doing the same work right now. :) Your hope is in vain... Best regards / Mit freundlichen Gruessen Jens Schwehn ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
[Clamav-devel] Re: mail scanning of Quoted-Printable Transfer-Encodings
I've been thinking long and hard about this. The original code was correct, and the exploit is wrong. The sentence from RFC1521 (now RFC2045) that was quoted originally needs to be read in the context of the entire paragraph. So in this example foo bar = xyzzy plugh= should decode as foo bar xyzzy plugh NOT foo barxyzzy plugh -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] mail scanning of Quoted-Printable Transfer-Encodings
Before you all get even more bogged down with RFCs, remember some things about this 1) This is a virus checker not an RFC validator; and consequently 2) If an incorrectly encoded attachment containing a *real world* virus is decoded by an MTA, ClamAV must be able to decode it no matter how many RFCs that breaks. Naturally we try our best to plug holes before they occur, you will get the best out of the team by being on our side not being antagonistic. -Nigel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] mail scanning of Quoted-Printable Transfer-Encodings
On Mon, 2004-11-29 at 12:56 +0100, Robert Allerstorfer wrote: Content-Transfer-Encoding: quoted-printable; That is the line that causes the confusion, remove the trailing semi-colon and it works fine (there is no semi-colon in the same place in your b64. There is an issue, but you're wrong to say that it's the handling of quoted-printable that doesn't work. rob. -Nigel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] clamscan crash when '--no-mail' option not set
On Monday 22 Nov 2004 01:00, Robert Allerstorfer wrote:
Hi,
recent dev versions of clamscan have crashed on this file:
http://cvs.openssl.org/getfile/openssl/doc/ssleay.txt?v=1.5.2.1
(this text file is included in the current OpenSSL tarball).
3 [main] clamscan 3068 handle_exceptions: Exception:
STATUS_ACCESS_VIOLATION
12741 [main] clamscan 3068 open_stackdumpfile: Dumping stack trace to
clamscan.exe.stackdump
No problems occured when the mail scanning routines have been disabled
('--no-mail' option).
What's in the file clamscan.exe.stackdump?
best,
rob.
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
___
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] clamscan crash when '--no-mail' option not set
On Monday 22 Nov 2004 01:00, Robert Allerstorfer wrote:
recent dev versions of clamscan have crashed on this file:
http://cvs.openssl.org/getfile/openssl/doc/ssleay.txt?v=1.5.2.1
(this text file is included in the current OpenSSL tarball).
3 [main] clamscan 3068 handle_exceptions: Exception:
STATUS_ACCESS_VIOLATION
12741 [main] clamscan 3068 open_stackdumpfile: Dumping stack trace to
clamscan.exe.stackdump
No problems occured when the mail scanning routines have been disabled
('--no-mail' option).
Fixed in CVS.
best,
rob.
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
___
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] Possible MIME decoding / hiding exploit vector
On Tuesday 16 Nov 2004 11:51, Paul L Daniels wrote: I'm usure of who to approach about this, perhaps one of the Clam developers might email me back. All problems should be sent to [EMAIL PROTECTED] Essentially, I have a very simple MIME encoding hiccup which hides attachments from ClamAV, yet are fully visible to the likes of Outlook Express. Which version of ClamAV? Please send the sample to me and I'll look into it. It's quite possible that it's been fixed in CVS ready for 0.81 which has a lot of fixes in this area. Regards. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] LibClamAV Warnings without clamscan's '--no-mail' option
On Sunday 07 Nov 2004 1:51 pm, Robert Allerstorfer wrote: Hi, when clamscan 0.80 is run without its '--no-mail' option, I get LibClamAV Warnings on several files: # clamscan /usr/lib/python2.2/email/test/data/msg_33.txt LibClamAV Warning: messageFindArgument: no '=' sign found in MIME header LibClamAV Warning: Multipart MIME message contains no boundaries /usr/lib/python2.2/email/test/data/msg_33.txt: OK I am working on RFC2231 at the moment. # clamscan /usr/lib/python2.2/test/output/test_MimeWriter LibClamAV Warning: Unsupported multipart format `knowbot' - report to [EMAIL PROTECTED] /usr/lib/python2.2/test/output/test_MimeWriter: OK A workaround for knowbot is already available from CVS. # clamscan /var/spool/mail/roal_TRASH/x-mailer.spam LibClamAV Warning: Unknown encoding type quoted - report to [EMAIL PROTECTED] /var/spool/mail/roal_TRASH/x-mailer.spam: Trojan.Dropper.JS.Zerolin-6 FOUND Please put this one through the version in CVS. It'll still of course print a warning, but it should be better. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] LibClamAV Warnings without clamscan's '--no-mail' option
On Sunday 07 Nov 2004 1:51 pm, Robert Allerstorfer wrote: # clamscan /usr/lib/python2.2/email/test/data/msg_33.txt LibClamAV Warning: messageFindArgument: no '=' sign found in MIME header LibClamAV Warning: Multipart MIME message contains no boundaries /usr/lib/python2.2/email/test/data/msg_33.txt: OK Thanks for the example, it always helps! This should now be OK in CVS. Any more e-mails you have would be appreciated, please send them direct to me. -Nigel rob. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] file types recognition
On Wednesday 27 Oct 2004 23:31, Gianni Arru wrote: --test file--- bla bla bla test test bla bla bla test test bla bla bla test test bla bla bla test test From: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1; format=flowed bla bla bla test test bla bla bla test test bla bla bla test test bla bla bla test test --end test file--- This text file is recognised of type CL_TYPE_MAIL. It is obviuos it is not a mailbox, nor a file containing a true mail message. This behaviour is deliberate to trap viruses included bounce messages. Gianni Arru -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
RE: [Clamav-devel] Patch for sender host name and IP address in reporttemplate
Thanks for patch 1, I'll look into it.
patch 2: SO_BINDTODEVICE was fixed last week, please check against CVS. I'll
look
into INET_ADDRSTRLEN, thanks for that one.
patch 3: was fixed three days ago, please check against CVS.
Please always ensure that you apply patches against the latest CVS (if in
doubt ASK FIRST
before you start work), it saves your time and ours.
All the best,
-Nigel
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Serge Vakulenko
Sent: 05 October 2004 18:17
To: [EMAIL PROTECTED]
Subject: [Clamav-devel] Patch for sender host name and IP address
in reporttemplate
Hi,
Here is a patch for clamav-0.80rc3.
1) Added three new macros for template file:
%n - remote host name
%a - remote IP address
%s - sender e-mail
2) Problems compiling under FreeBSD-3.4 - fixed. Added conditional
define for
INET_ADDRSTRLEN, and ifdef for SO_BINDTODEVICE.
3) Fixed crash on privdata-headers empty when %h used in template
file but no --headers option.
Now it is possible to get sender host name/address in virus
report message.
For example, I use the following template file:
*** VIRUS DETECTED: %v ***
The message has been blocked.
Sender: %s
Host: %n
IP address: %a
--
%h
--
___
Regards,
Serge Vakulenko
--- clamav-milter-old.cTue Sep 28 02:05:49 2004
+++ clamav-milter.cTue Oct 5 20:45:37 2004
@@ -590,6 +590,8 @@
char*received;/* keep track of received from */
constchar*rejectCode;/* 550 or 554? */
char*messageID;/* sendmailID */
+char*remoteHost;/* remote hostname (by [EMAIL PROTECTED]) */
+const char*remoteAddr;/* remote IP address */
intdiscard;/*
* looks like the remote end is playing ping
* pong with us
@@ -1124,6 +1126,7 @@
*/
if(getuid() == 0) {
if(iface) {
+#ifdef SO_BINDTODEVICE
struct ifreq ifr;
memset(ifr, '\0', sizeof(struct ifreq));
@@ -1132,6 +1135,9 @@
perror(iface);
return EX_UNAVAILABLE;
}
+#else
+return EX_UNAVAILABLE;
+#endif
}
if((cpt = cfgopt(copt, User)) != NULL) {
if((user = getpwnam(cpt-strarg)) == NULL) {
@@ -1852,6 +1858,10 @@
}
#endif
+#ifndef INET_ADDRSTRLEN
+#define INET_ADDRSTRLEN 16
+#endif
+
/*
* Sendmail wants to establish a connection to us
*/
@@ -1862,6 +1872,7 @@
char ip[INET_ADDRSTRLEN];/* IPv4 only */
#endif
const char *remoteIP;
+struct privdata *privdata;
if(quitting)
return cl_error;
@@ -1987,6 +1998,17 @@
return SMFIS_ACCEPT;
}
+privdata = (struct privdata *)cli_calloc(1, sizeof(struct privdata));
+if(privdata == NULL)
+return cl_error;
+
+privdata-remoteHost = strdup (hostname);
+privdata-remoteAddr = strdup (remoteIP);
+syslog(LOG_NOTICE, _(clamfi_connect: connection from %s [%s]),
hostname, remoteIP);
+
+if(smfi_setpriv(ctx, privdata) != MI_SUCCESS)
+clamfi_free(privdata);
+
return SMFIS_CONTINUE;
}
@@ -2071,7 +2093,7 @@
}
}
-privdata = (struct privdata *)cli_calloc(1, sizeof(struct privdata));
+privdata = (struct privdata *)smfi_getpriv(ctx);
if(privdata == NULL)
return cl_error;
@@ -2092,12 +2114,7 @@
if(hflag)
privdata-headers = header_list_new();
-if(smfi_setpriv(ctx, privdata) == MI_SUCCESS)
-return SMFIS_CONTINUE;
-
-clamfi_free(privdata);
-
-return cl_error;
+return SMFIS_CONTINUE;
}
static sfsistat
@@ -2909,6 +2926,10 @@
#endif
if(privdata-received)
free(privdata-received);
+if(privdata-remoteHost)
+free(privdata-remoteHost);
+if(privdata-remoteAddr)
+free((void*) privdata-remoteAddr);
free(privdata);
}
@@ -3560,11 +3581,26 @@
case 'v':/* virus name */
fputs(virusname, sendmail);
break;
+case 'n':/* remote hostname */
+fputs(privdata-remoteHost, sendmail);
+break;
+case 'a':/* remote IP address */
+fputs(privdata-remoteAddr, sendmail);
+break;
+case 's': {/* sender */
+char *sender = privdata-from;
+if (sender strcmp(sender, ) == 0)
+sender = 0;
+if (! sender)
+sender = smfi_getsymval(ctx, _);
+fputs(sender, sendmail);
+}
RE: [Clamav-devel] PATCH: improvements for Mac OS X/clamXav
+#ifdef __APPLE_CC__ Remi -Nigel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] Bad format or broken data ERROR
Unfortunately you've removed the history from this post, I get a lot of emails everyday and I can't be expected to remember the text of every one. What problem does this demonstrate? What version of clamav? What operating system? On Thursday 30 Sep 2004 11:16, Oliver Falk wrote: Please send me a copy of an e-mail that reproduces this problem and I'll look into it for you. I'm trying to get one from my customer! Here we go: --- Subject: test2 From: melina [EMAIL PROTECTED] To: etuxx [EMAIL PROTECTED] Content-Type: multipart/encrypted; protocol=application/pgp-encrypted; -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
[Clamav-devel] Re: multipart/encrypted (was Bad format or broken data ERROR)
Thanks, I'll have a think about what (if anything) needs to be done or indeed can be done about e-mails that are encoded as multipart/enctyped. The reason you're seeing Bad format or broken data ERROR is 0.80 whereas previous releases said OK, is that with earlier releases clamAV would silently pass though messages that it couldn't decode, which could let through viruses. Now clamAV warns you that it hasn't been able to scan a file so that you can take the appropriate action (warn the user, forward to [EMAIL PROTECTED] etc. etc.). -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel
Re: [Clamav-devel] contrib/Windows/stdafx.h (nigelhorne)
On Thursday 16 Sep 2004 13:55, Reini Urban wrote: Some files are missing to build this project! stdafx.h, stdafx.c, These should be with Visual C++. stdafx.h is just: #include afxwin.h #include afxdlgs.h stdafx.cpp is just: #include stdafx.h Makefile (This I can guess it by my own) That is created by Visual C++ from the project file. Don't create by hand. I'm thinking of adding clamav as cygwin package. Clamav already compiles under cygwin, though CLI only. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] MAILURL/CHECKURL feature ?
If you don't like a feature don't enable it. No-one is forced to use it. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] zip files within zip files
On Thursday 05 Aug 2004 16:23, Michael L Torrie wrote: I wouldn't. I don't give my users that much credit. On a system like Windows XP, where zip files are displayed in the explorer like normal folders, you had better believe that a user will click through the nested zip files to get to the virus. And that someone will write a program to do it automatically. Michael -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now, one more big change to announce. We are now OSTG- Open Source Technology Group. Come see the changes on the new OSTG site. www.ostg.com ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
[Clamav-devel] F9 (www.f9.co.uk)
From force9.service.customer-feedback: We are not using sophos any more (it is now a heavily modified clamAV) Anybody know what changes they've made and if they're to be fed back to the development team for consideration? -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email sponsored by Black Hat Briefings Training. Attend Black Hat Briefings Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] F9 (www.f9.co.uk)
I have asked them for the changes, but I haven't mentioned the GPL, let's see what they say. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email sponsored by Black Hat Briefings Training. Attend Black Hat Briefings Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamscan -m seg faults on this file.
Output of valgrind below. Whilst it doesn't seg fault, clearly zlib is having difficulties. [EMAIL PROTECTED] test]$ valgrind --num-callers=9 --leak-check=yes clamscan --mbox /home/njh/src/njh/mime/test/clam-seg-fault-file.txt ==13922== Memcheck, a.k.a. Valgrind, a memory error detector for x86-linux. ==13922== Copyright (C) 2002-2003, and GNU GPL'd, by Julian Seward. ==13922== Using valgrind-2.0.0, a program supervision framework for x86-linux. ==13922== Copyright (C) 2000-2003, and GNU GPL'd, by Julian Seward. ==13922== Estimated CPU clock rate is 867 MHz ==13922== For more details, rerun with: -v ==13922== ==13922== pthread_mutex_unlock: mutex is not locked ==13922==at 0x299F8B: __pthread_mutex_unlock (vg_libpthread.c:993) ==13922==by 0x41B15B: _IO_fclose@@GLIBC_2.1 (in /lib/libc-2.3.2.so) ==13922==by 0x45098C: __tzfile_read (in /lib/libc-2.3.2.so) ==13922==by 0x44F3B8: tzset_internal (in /lib/libc-2.3.2.so) ==13922==by 0x44FF65: __tz_convert (in /lib/libc-2.3.2.so) ==13922==by 0x44E381: __GI_localtime (in /lib/libc-2.3.2.so) ==13922==by 0x44E220: ctime (in /lib/libc-2.3.2.so) ==13922==by 0x804AB28: clamscan (in /usr/local/bin/clamscan) ==13922== ==13922== Use of uninitialised value of size 4 ==13922==at 0x3B58AA: inflate_table (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x3B3A6D: inflate (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x3AD9F0: gzread (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x23EE38: cli_scangzip (in /usr/local/lib/libclamav.so.1.0.4) ==13922== ==13922== Use of uninitialised value of size 4 ==13922==at 0x3B58B0: inflate_table (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x3B3A6D: inflate (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x3AD9F0: gzread (in /usr/lib/libz.so.1.2.0.7) ==13922==by 0x23EE38: cli_scangzip (in /usr/local/lib/libclamav.so.1.0.4) /home/njh/src/njh/mime/test/clam-seg-fault-file.txt: OK --- SCAN SUMMARY --- Known viruses: 22548 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.00 MB I/O buffer size: 131072 bytes Time: 66.486 sec (1 m 6 s) ==13922== ==13922== ERROR SUMMARY: 5 errors from 3 contexts (suppressed: 0 from 0) ==13922== malloc/free: in use at exit: 1201 bytes in 47 blocks. ==13922== malloc/free: 96542 allocs, 96495 frees, 162683282 bytes allocated. ==13922== For counts of detected errors, rerun with: -v ==13922== searching for pointers to 47 not-freed blocks. ==13922== checked 5325260 bytes. ==13922== ==13922== LEAK SUMMARY: ==13922==definitely lost: 0 bytes in 0 blocks. ==13922==possibly lost: 0 bytes in 0 blocks. ==13922==still reachable: 1201 bytes in 47 blocks. ==13922== suppressed: 0 bytes in 0 blocks. ==13922== Reachable blocks (those to which a pointer was found) are not shown. ==13922== To see them, rerun with: --show-reachable=yes ==13922== [EMAIL PROTECTED] test]$ -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email sponsored by Black Hat Briefings Training. Attend Black Hat Briefings Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] Compiling 0.74
On Wednesday 30 Jun 2004 15:07, Everton da Silva Marques wrote: Clamav 0.74 is giving me this: mbox.c: In function `cl_mbox': mbox.c:473: error: `SIGSEGV' undeclared (first use in this function) snip OS: Solaris 7 I believe this problem only relates to older systems such as the one you have. I think it is now fixed in CVS, please test. Thanks, Everton -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email sponsored by Black Hat Briefings Training. Attend Black Hat Briefings Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
[Clamav-devel] cli_chomp()
Trog I have been discussing cli_chomp() and would like to rewrite it thus.
Any objections/comments from anyone?
-Nigel
snip
int
cli_chomp(char *string)
{
int l;
if(string == NULL)
return -1;
l = strlen(string);
if(l == 0)
return 0;
--l;
while ((l = 0) ((string[l] == '\n') || (string[l] == '\r')))
string[l--]='\0';
return l + 1;
}
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
---
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
___
Clamav-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] RE: cygwin O_BINARY
Top post for easier reading. flames /dev/null This sounds like a bug in the cygwin version of mkstemp. I had to use mkstemp on cygwin because I was getting 'already exists' errors with mktemp so I moved to mkstemp, which is better anyway. I suggest you pass this on to the authors of cygwin. -Nigel On Thursday 03 Jun 2004 11:08, Andrey Cherezov wrote: I'm sure you meant sending it to other Tomasz - Tomasz Kojm. Yes, sorry. Now using clamav-devel again. One more cygwin issue. In the mbox.c there is such code: /* * TODO: add a HAVE_MKSTEMP property */ #if defined(C_LINUX) || defined(C_BSD) || defined(HAVE_MKSTEMP) || defined(C_SOLARIS) || defined(C_CYGWIN) fd = mkstemp(filename); #else (void)mktemp(filename); fd = open(filename, O_WRONLY|O_CREAT|O_EXCL|O_TRUNC|O_BINARY, 0600); #endif When compiled on my cygwin, it goes to use mkstemp(filename) (because C_CYGWIN defined). And not works properly with the Worm.SomeFool.AB virus. If I force it to use mktemp(filename) ... open(...O_BINARY) - this works OK. -Original Message- From: Tomasz Papszun [mailto:[EMAIL PROTECTED] Sent: 3 Jun 2004 . 12:25 To: Andrey Cherezov Cc: Tomasz Kojm; Nigel Horne Subject: Re: cygwin O_BINARY On Thu, 03 Jun 2004 at 10:35:14 +0300, Andrey Cherezov wrote: Dear Nigel and Tomasz, https://sourceforge.net/tracker/?func=detailatid=641462aid=9 65300group_id =105508 need more |O_BINARY on cygwin - now in scanners.c -Original Message- From: Nigel Horne [mailto:[EMAIL PROTECTED] Sent: 11 Feb 2004 11:42 To: Andrey Cherezov Subject: Re: Handling bounce messages On Wednesday 11 Feb 2004 8:17 am, you wrote: I've solved all these problems. Please add |O_BINARY into the open() calls when create binary files: temp file in the mbox.c and the db file in the manager.c. (described in the maillist). Already done (well mbox.c anyway, manager.c is Tomasz's code) and checked into CVS. Thanks for the tip. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by the new InstallShield X. From Windows to Linux, servers to mobile, InstallShield X is the one installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter.conf ??
On Friday 21 May 2004 2:22 pm, Jerome Loyet wrote: Is it possible to create a new configuration file for clamav-milter ? /etc/clamav-milter.conf With all the option accesible by command-line ? What operating system are you using? Thanks, ++ Jerome -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149alloc_id=8166op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter.conf ??
On Friday 21 May 2004 3:12 pm, Jerome Loyet wrote: With all the option accesible by command-line ? What operating system are you using? OpenBSD 3.5. In that case I can't help you, for the moment the system for clamav-milter configuration works in Linux only (/etc/sysconfig/clamav-milter). In fact, would it be possible to integrate milter configuration into clamav.conf ? Why would you want to do that? Thanks, ++ Jerome -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149alloc_id=8166op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
