From: "Steven Levine" <ecs-isp@2rosenthals.com>
Message-ID: <652a1aa7.15.mr2ice.fgrirsq@earthlink.net>
Date: Fri, 13 Oct 2023 20:35:51 -0800
To: "eCS ISP Mailing List" <ecs-isp@2rosenthals.com>
In-Reply-To: <list-8111172@2rosenthals.com>
Subject: Re: [eCS-ISP] ClamAV

In <list-8111172@2rosenthals.com>, on 10/13/23
   at 04:25 PM, "Paul Smedley" <ecs-isp@2rosenthals.com> said:

Hi there,

>https://smedley.id.au/tmp/clamav-0.103.6-os2-20231013-debug.zip is 
>refreshed to use bww curl. Fails in the same way for me - but hopefully 
>gets @Steven further along...

This appears to fix the curl problem.

freshclam --debug --verbose
--config-file=/Internet/clamav/etc/freshclam.conf Current working dir is
/Internet/clamav/lib/clamav/
Loaded freshclam.dat:
  version:    1
  uuid:       cf7346ca-6cc9-4f1b-91f9-981ee6f9d7b9
ClamAV update process started at Fri Oct 13 20:36:42 2023
Current working dir is /Internet/clamav/lib/clamav/
Querying current.cvd.clamav.net
TTL: 731
fc_dns_query_update_info: Software version from DNS: 0.103.10 WARNING:
Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.103.6 Recommended version: 0.103.10 DON'T PANIC!
Read https://docs.clamav.net/manual/Installing.html Current working dir is
/Internet/clamav/lib/clamav/
check_for_new_database_version: No local copy of "daily" database.
query_remote_database_version: daily.cvd version from DNS: 27060 daily
database available for download (remote version: 27060) Retrieving
https://database.clamav.net/daily.cvd
downloadFile: Download source:      https://database.clamav.net/daily.cvd
downloadFile: Download destination:
/Internet/clamav/lib/clamav/tmp.a6eee73b89/clamav-2be74efa91add909b73feea0330d0175.tmp
*   Trying 104.16.218.84:443...
* Connected to database.clamav.net (104.16.218.84) port 443 (#0) * ALPN,
offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /@unixroot/etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.;
CN=sni.cloudflaressl.com *  start date: May 15 00:00:00 2023 GMT
*  expire date: May 14 23:59:59 2024 GMT
*  subjectAltName: host "database.clamav.net" matched cert's
"database.clamav.net" *  issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare
Inc ECC CA-3 *  SSL certificate verify ok.
> GET /daily.cvd HTTP/1.1
Host: database.clamav.net
User-Agent: ClamAV/0.103.6 (OS: os2-emx, ARCH: i386, CPU: i386, UUID:
cf7346ca-6cc9-4f1b-91f9-981ee6f9d7b9) Accept: */*
Connection: close

* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 429 Too Many Requests
< Date: Sat, 14 Oct 2023 03:36:43 GMT
< Content-Type: text/plain; charset=UTF-8
< Content-Length: 16
< Connection: close
< Retry-After: 86304
< X-Frame-Options: SAMEORIGIN
< Referrer-Policy: same-origin
< Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate,
post-check=0, pre-check=0 < Expires: Thu, 01 Jan 1970 00:00:01 GMT
< Set-Cookie:
__cf_bm=ZhMAL5sak9PgUaYX4BqmR0YTiD_6KTq6KjUIQoF1fTQ-1697254603-0-AbbZm+aWD8qa3QXEgCG1TZMqycSPzfstTFCayzLNQQ8KZrTuoV8/oJ75z8kbOKODoheZkFqpCnAglR/WozryJhw=;
path=/; expires=Sat, 14-Oct-23 04:06:43 GMT; domain=.clamav.net; HttpOnly;
Secure; SameSite=None < Strict-Transport-Security: max-age=15552000
< X-Content-Type-Options: nosniff
< Server: cloudflare
< CF-RAY: 815cc79668587cf2-LAX

However, as the above shows there's always the next thing.  As you might
notice the output stops unexpectedly.  Popuplog tells us why:

10-13-2023  20:36:43  SYS2070  PID 07cf  TID 0001  Slot 00dd
D:\INTERNET\CLAMAV\BIN\FRESHCLAM.EXE
FRESHCLAM->LIBCN0.2026
182

I get to update libc later.  On a positive note, I learned something new
about the kernel.  In the past whenever, I've run into the missing ordinal
problem, the application seemed to die before any attempt was made to run
it.  Turns out this is not true.  The missing ordinal does not cause the
process to die until the code attempts to use the ordinal.  If this wasn't
the case the output show above could never have been generated.

When you way

>Fails in the same way for me

I assume you mean freshclam runs out of memory.

I do find it interesting that you never ran into the missing cert issue.

Steven

-- 
----------------------------------------------------------------------
"Steven Levine" <steve53@earthlink.net>  Warp/DIY/BlueLion etc.
www.scoug.com www.arcanoae.com www.warpcave.com
----------------------------------------------------------------------