Clam open source unix antivirus scanner development

Jacek Zapala | 4 Oct 2010 14:31

Picon

freshclam and getaddrinfo()

Hi.

Starting from the last upgrade (0.96.3 on debian) freshclam randomly chooses
between ipv6/ipv4 connecting to the name that has addresses in both
protocols.

freshclam uses getaddrinfo() for resolving mirror dns name (wwwconnect in
manager.c), but then it randomizes the list returned as a result.
This way it breaks the algorithm of ipv6 address selection from rfc3484
implemented in getaddrinfo().

What is the reason for doing this?

Regards,
	Jacek
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

Török Edwin | 4 Oct 2010 14:43

Re: freshclam and getaddrinfo()

On Mon, 4 Oct 2010 14:31:21 +0200
Jacek Zapala <jacek <at> it.pl> wrote:

> Hi.
> 
> Starting from the last upgrade (0.96.3 on debian) freshclam randomly
> chooses between ipv6/ipv4 connecting to the name that has addresses
> in both protocols.
> 
> freshclam uses getaddrinfo() for resolving mirror dns name
> (wwwconnect in manager.c), but then it randomizes the list returned
> as a result. This way it breaks the algorithm of ipv6 address
> selection from rfc3484 implemented in getaddrinfo().

It is not intended to mix IPv4 and IPv6. It should be possible to
randomize only IPv4 and IPv6 separately.

Is the problem that your IPv6 link is slower than IPv4, or that you
don't have an IPv6 connection at all?

> 
> What is the reason for doing this?

Because otherwise the list returned by getaddrinfo() is always in
sorted order (on Linux at least), so it would only use the first mirror.

See this:
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2021#c1

Best regards,

(Continue reading)

Jacek Zapala | 4 Oct 2010 15:14

Picon

Re: freshclam and getaddrinfo()

* Török Edwin (edwin <at> clamav.net) [101004 14:45] wrote:
> On Mon, 4 Oct 2010 14:31:21 +0200
> Jacek Zapala <jacek <at> it.pl> wrote:
> 
> > Hi.
> > 
> > Starting from the last upgrade (0.96.3 on debian) freshclam randomly
> > chooses between ipv6/ipv4 connecting to the name that has addresses
> > in both protocols.
> > 
> > freshclam uses getaddrinfo() for resolving mirror dns name
> > (wwwconnect in manager.c), but then it randomizes the list returned
> > as a result. This way it breaks the algorithm of ipv6 address
> > selection from rfc3484 implemented in getaddrinfo().
> 
> It is not intended to mix IPv4 and IPv6. It should be possible to
> randomize only IPv4 and IPv6 separately.
> 
> Is the problem that your IPv6 link is slower than IPv4, or that you
> don't have an IPv6 connection at all?

No, I have good IPv6 connection to my local mirror
clamavmirror.ipartners.pl, but I found it strange to behave randomly.

And sometimes it's better to choose IPv6 address over the IPv4 one, but
this is not always true.

I know we currently setup freshclam to use either IPv6 address set
(db.ipv6.clamav.net) or the IPv4 one, but I think some day we will just add
IPv6 addresses to db.<country>.clamav.net and leave making the decision up to

(Continue reading)

Török Edwin | 4 Oct 2010 15:29

Re: freshclam and getaddrinfo()

On Mon, 4 Oct 2010 15:14:06 +0200
Jacek Zapala <jacek <at> it.pl> wrote:

> * Török Edwin (edwin <at> clamav.net) [101004 14:45] wrote:
> > On Mon, 4 Oct 2010 14:31:21 +0200
> > Jacek Zapala <jacek <at> it.pl> wrote:
> > 
> > > Hi.
> > > 
> > > Starting from the last upgrade (0.96.3 on debian) freshclam
> > > randomly chooses between ipv6/ipv4 connecting to the name that
> > > has addresses in both protocols.
> > > 
> > > freshclam uses getaddrinfo() for resolving mirror dns name
> > > (wwwconnect in manager.c), but then it randomizes the list
> > > returned as a result. This way it breaks the algorithm of ipv6
> > > address selection from rfc3484 implemented in getaddrinfo().
> > 
> > It is not intended to mix IPv4 and IPv6. It should be possible to
> > randomize only IPv4 and IPv6 separately.
> > 
> > Is the problem that your IPv6 link is slower than IPv4, or that you
> > don't have an IPv6 connection at all?
> 
> No, I have good IPv6 connection to my local mirror
> clamavmirror.ipartners.pl, but I found it strange to behave randomly.
> 
> And sometimes it's better to choose IPv6 address over the IPv4 one,
> but this is not always true.
>

(Continue reading)

Tomasz Kojm | 19 Oct 2010 16:24

Upcoming release of ClamAV

Dear Users,

we're going to release a new version of ClamAV on Monday, October 25.
ClamAV 0.96.4 will fix some issues with the PDF parser, logical
signatures and other problems reported for 0.96.3:

https://wwws.clamav.net/bugzilla/buglist.cgi?resolution=FIXED&query_format=advanced&bug_status=RESOLVED&product=ClamAV&target_milestone=0.96.4

You can help by testing (or just running ./configure && make check) the
latest code available in our Git repository - the latest snapshot
tarball can be grabbed here:

http://git.clamav.net/gitweb?p=clamav-devel.git;a=snapshot;h=refs/heads/master;sf=tgz

Thanks in advance,

--

-- 
   oo    .....         Tomasz Kojm <tkojm <at> clamav.net>
  (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
     \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
       //\   /\              Tue Oct 19 16:21:33 CEST 2010
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

Renato Botelho | 19 Oct 2010 16:32

Picon

Re: Upcoming release of ClamAV

On Tue, Oct 19, 2010 at 12:24 PM, Tomasz Kojm <tkojm <at> clamav.net> wrote:
> Dear Users,
>
> we're going to release a new version of ClamAV on Monday, October 25.
> ClamAV 0.96.4 will fix some issues with the PDF parser, logical
> signatures and other problems reported for 0.96.3:
>
> https://wwws.clamav.net/bugzilla/buglist.cgi?resolution=FIXED&query_format=advanced&bug_status=RESOLVED&product=ClamAV&target_milestone=0.96.4
>
> You can help by testing (or just running ./configure && make check) the
> latest code available in our Git repository - the latest snapshot
> tarball can be grabbed here:
>
> http://git.clamav.net/gitweb?p=clamav-devel.git;a=snapshot;h=refs/heads/master;sf=tgz

Does update clamav-devel FreeBSD port to 20101019 help?

--

-- 
Renato Botelho
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

Török Edwin | 19 Oct 2010 16:36

Re: Upcoming release of ClamAV

On Tue, 19 Oct 2010 12:32:06 -0200
Renato Botelho <rbgarga <at> gmail.com> wrote:

> On Tue, Oct 19, 2010 at 12:24 PM, Tomasz Kojm <tkojm <at> clamav.net>
> wrote:
> > Dear Users,
> >
> > we're going to release a new version of ClamAV on Monday, October
> > 25. ClamAV 0.96.4 will fix some issues with the PDF parser, logical
> > signatures and other problems reported for 0.96.3:
> >
> > https://wwws.clamav.net/bugzilla/buglist.cgi?resolution=FIXED&query_format=advanced&bug_status=RESOLVED&product=ClamAV&target_milestone=0.96.4
> >
> > You can help by testing (or just running ./configure && make check)
> > the latest code available in our Git repository - the latest
> > snapshot tarball can be grabbed here:
> >
> > http://git.clamav.net/gitweb?p=clamav-devel.git;a=snapshot;h=refs/heads/master;sf=tgz
> 
> Does update clamav-devel FreeBSD port to 20101019 help?
> 

Rather -20101020 to include today's commits.

If the current version in the ports is clamav-devel-20101015, then
definetely yes. 
The -20101015 version has a bug (see
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2332)

Best regards,

(Continue reading)

Renato Botelho | 19 Oct 2010 16:40

Picon

Re: Upcoming release of ClamAV

2010/10/19 Török Edwin <edwin <at> clamav.net>:
> On Tue, 19 Oct 2010 12:32:06 -0200
> Renato Botelho <rbgarga <at> gmail.com> wrote:
>
>> On Tue, Oct 19, 2010 at 12:24 PM, Tomasz Kojm <tkojm <at> clamav.net>
>> wrote:
>> > Dear Users,
>> >
>> > we're going to release a new version of ClamAV on Monday, October
>> > 25. ClamAV 0.96.4 will fix some issues with the PDF parser, logical
>> > signatures and other problems reported for 0.96.3:
>> >
>> > https://wwws.clamav.net/bugzilla/buglist.cgi?resolution=FIXED&query_format=advanced&bug_status=RESOLVED&product=ClamAV&target_milestone=0.96.4
>> >
>> > You can help by testing (or just running ./configure && make check)
>> > the latest code available in our Git repository - the latest
>> > snapshot tarball can be grabbed here:
>> >
>> > http://git.clamav.net/gitweb?p=clamav-devel.git;a=snapshot;h=refs/heads/master;sf=tgz
>>
>> Does update clamav-devel FreeBSD port to 20101019 help?
>>
>
> Rather -20101020 to include today's commits.
>
> If the current version in the ports is clamav-devel-20101015, then
> definetely yes.
> The -20101015 version has a bug (see
> https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2332)

(Continue reading)

Amr Thabet | 24 Oct 2010 01:11

Picon

Supporting Emulators

Hello everyone

First I want to say it's a great antivirus and seems it will have a good
future

Second I want to say when I read some portions of the source code I see it
doesn't have an emulator (except yc emulator) to detect polymorphic viruses
or support heuristic detections .

I suggest to add an open source emulator to the application to make it run
when the md5 scan failed to detect any virus .

I suggest to use Pokas x86 Emulator (http://sourceforge.net/projects/x86emu/
)
(as I'm the Author of it) or support ida-emulator by Crist Eagle

Thanks
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

Brandon Perry | 24 Oct 2010 01:20

Picon

Re: Supporting Emulators

I think if a discussion were to take place on this, Bochs should
certainly be an option.

http://bochs.sourceforge.net/

It is very mature and used in great projects like qemu.

On Sat, Oct 23, 2010 at 6:11 PM, Amr Thabet
<amr.thabet <at> student.alx.edu.eg> wrote:
> Hello everyone
>
> First I want to say it's a great antivirus and seems it will have a good
> future
>
> Second I want to say when I read some portions of the source code I see it
> doesn't have an emulator (except yc emulator) to detect polymorphic viruses
> or support heuristic detections .
>
> I suggest to add an open source emulator to the application to make it run
> when the md5 scan failed to detect any virus .
>
> I suggest to use Pokas x86 Emulator (http://sourceforge.net/projects/x86emu/
> )
> (as I'm the Author of it) or support ida-emulator by Crist Eagle
>
> Thanks
> _______________________________________________
> http://lurker.clamav.net/list/clamav-devel.html
> Please submit your patches to our Bugzilla: http://bugs.clamav.net
>

(Continue reading)

Group

gmane.comp.security.virus.clamav.devel.

Project Web Page

Clam open source unix antivirus scanner development

Search Archive

Page

1 | 2

Articles in period: 17

October 2010

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Contribution: libclamav.dll + Python (22 May 2013)
clamav-devel Digest, Vol 100, Issue 6 (23 Mar 2013)
Does clamav work with hex or characters? (23 Mar 2013)
New Version of ClamAV (22 Mar 2013)
New Version of ClamAV (20 Mar 2013)
ClamAV 0.97.7 has been released! (19 Mar 2013)
Contribute signatures (17 Mar 2013)
ClamAV 0.97.7 has been released! (16 Mar 2013)
ClamAV 0.97.7 has been released! (16 Mar 2013)
ClamAV 0.97.7 has been released! (15 Mar 2013)
smaller db ? (25 Feb 2013)
JIT code generation on Windows x64 / MSVC (9 Jan 2013)
New Contributor - Loïc Maury (28 Dec 2012)
Contribution. (10 Nov 2012)
Placebo - A ClamAV Central Management Toolkit (18 Oct 2012)
Interesting Project for a 6-month Internship (12 Sep 2012)
Libclamav - filetype detection functionality (11 Sep 2012)
Patch: add jitter to freshclam's update period (22 Aug 2012)
Question about matcher-bm.c (2 Jul 2012)
Mail backlog on clamav-users? (14 Jun 2012)
Test suit cannot fork process for debugging with clamav. (10 May 2012)

Archives

2	May 2013
25	March 2013
6	February 2013
5	January 2013
2	December 2012
2	November 2012
1	October 2012
3	September 2012
9	August 2012
2	July 2012
1	June 2012
3	May 2012
27	April 2012
4	March 2012
24	February 2012
7	January 2012
15	December 2011
12	October 2011
7	September 2011
6	August 2011
22	July 2011
11	June 2011
5	May 2011
5	March 2011
6	February 2011
7	January 2011
12	December 2010
7	November 2010
17	October 2010
15	September 2010
16	August 2010
5	July 2010
16	June 2010
23	May 2010
95	April 2010
54	March 2010
13	January 2010
27	December 2009
8	November 2009
1	October 2009
7	September 2009
5	August 2009
6	July 2009
6	June 2009
14	May 2009
9	April 2009
46	March 2009
8	February 2009
15	January 2009
42	December 2008
17	November 2008
5	October 2008
5	September 2008
31	August 2008
10	July 2008
10	June 2008
13	May 2008
15	April 2008
15	March 2008
9	February 2008
9	January 2008
30	December 2007
22	November 2007
18	October 2007
12	September 2007
4	August 2007
3	July 2007
24	June 2007
26	May 2007
18	April 2007
75	March 2007
52	February 2007
20	January 2007
15	December 2006
36	November 2006
43	October 2006
61	September 2006
9	August 2006
20	July 2006
33	June 2006
39	May 2006
42	April 2006
40	March 2006
12	February 2006
75	January 2006
26	December 2005
39	November 2005
22	October 2005
18	September 2005
26	August 2005
52	July 2005
58	June 2005
89	May 2005
67	April 2005
122	March 2005
124	February 2005
102	January 2005
82	December 2004
83	November 2004
103	October 2004
54	September 2004
56	August 2004
64	July 2004
79	June 2004
58	May 2004
106	April 2004
145	March 2004
80	February 2004
39	January 2004
53	December 2003
82	November 2003
39	October 2003
137	September 2003
70	August 2003
2	July 2003
1	March 2003

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template