Dansguardian package for 2.0

marcelloc

stop clamav and remove the file /var/run/clamd.sock by hand.

Macom2007

stop clamav and remove the file /var/run/clamd.sock by hand.

That works. Thanks for your great support.

samham

I'm still having the issue of duplicate line of "/usr/local/bin/php /usr/local/www/dansguardian.php fetch_blacklist " every time a change is made to Dansguardian in the GUI

marcelloc

@samham:

I'm still having the issue of duplicate line of "/usr/local/bin/php /usr/local/www/dansguardian.php fetch_blacklist " every time a change is made to Dansguardian in the GUI

You mean update fetch blacklist? what option do you have configured? download and update now?

rjcrowder

@marcelloc:

@samham:

I'm still having the issue of duplicate line of "/usr/local/bin/php /usr/local/www/dansguardian.php fetch_blacklist " every time a change is made to Dansguardian in the GUI

You mean update fetch blacklist? what option do you have configured? download and update now?

Marcello - Just curious… did you push a change to the dansguardian package today but keep the version number the same? I did a fresh install on a new machine and ran into another problem with the code in /usr/local/pkg/dansguardian.inc. In the version that was installed, it looks like you changed the variable for the clamav-clamd script to "$clamav_script"... however, you missed a couple of spots - where the script was starting/stopping it was using the "$script" variable. End result is that the clamd daemon was not starting...

rjcrowder

@rjcrowder:

@marcelloc:

@samham:

I'm still having the issue of duplicate line of "/usr/local/bin/php /usr/local/www/dansguardian.php fetch_blacklist " every time a change is made to Dansguardian in the GUI

You mean update fetch blacklist? what option do you have configured? download and update now?

Marcello - Just curious… did you push a change to the dansguardian package today but keep the version number the same? I did a fresh install on a new machine and ran into another problem with the code in /usr/local/pkg/dansguardian.inc. In the version that was installed, it looks like you changed the variable for the clamav-clamd script to "$clamav_script"... however, you missed a couple of spots - where the script was starting/stopping it was using the "$script" variable. End result is that the clamd daemon was not starting...

In addition, the fetch_blacklist function (in /usr/local/www/dansguardian.php) seems to be broken. When you try to fetch, it does nothing. Believe it is because of the if statement you added at the top. If it executes the "else", the url is never set…

marcelloc

I'll check it this weekend.

rjcrowder

@marcelloc:

I'll check it this weekend.

OK… believe your if statement had a misplaced closing paren... Should be...
if (is_array($config['installedpackages']['dansguardianblacklist']) && is_array($config['installedpackages']['dansguardianbl
acklist']['config'])){

BTW… the other thing that is strange (but maybe I just never noticed before) is that directory owners seem strange. A lot of stuff under /usr/local/etc/dansguardian/lists is now owned by "clamav"? also, it seems that stuff under the blacklists directory has an owner of "1000" and group of "squid"?

marcelloc

@rjcrowder:

A lot of stuff under /usr/local/etc/dansguardian/lists is now owned by "clamav"?

yes, clamav and dansguardian must be run by the same user.

@rjcrowder:

also, it seems that stuff under the blacklists directory has an owner of "1000" and group of "squid"?

Default file permissions from compressed blacklist download.

Legion

I've made some stupid mistake (maybe when I manually installed clamav a while back and then deleted it again?) and now I can't get clamav to work at all. I've reinstalled DG several times and each time I try to enable clamav via the gui I get:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /usr/local/pkg/dansguardian.inc on line 1137

That's a lot of bytes.

The line in particular is:

$script_file=file($clamav_script);

I'm not sure exactly what is going on. Eventually I'll do a fresh 2.1 install and hopefully that'll get rid of it.

marcelloc

@Legion:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /usr/local/pkg/dansguardian.inc on line 1137

I'm not sure exactly what is going on. Eventually I'll do a fresh 2.1 install and hopefully that'll get rid of it.

remove /usr/local/etc/rc.d/clamav-clamd script after package remove.

or follow instructions from this post http://forum.pfsense.org/index.php/topic,43786.msg332438.html#msg332438

marcelloc

rjcrowder,

take a look(with a package reinstall) if fetch_blacklist and clamav call are fine again. I'll bump version after these small bugs are gone.

att,
Marcello Coutinho

LokisMischief

I seem to have an issue with DG processes exiting with signal 11's ?? It seems dans is still accepting traffic and filtering but my logs have been filled with

Apr 29 11:28:57	kernel: pid 18872 (dansguardian), uid 106: exited on signal 11

Not sure where to start looking for this one :(

Though I don't have the update from this weekend I wouldn't expect any changes to the dansguardian core.

marcelloc

@LokisMischief:

Not sure where to start looking for this one :(

Did you applied the binary patch fot fix web upload bug? you can try to downgrade binaries via pkg_add too.

rjcrowder

@marcelloc:

rjcrowder,

take a look(with a package reinstall) if fetch_blacklist and clamav call are fine again. I'll bump version after these small bugs are gone.

att,
Marcello Coutinho

Looks good from what I can tell… manually checked the code plus all the scenarios that I know of where it starts/stops clamd and dans.

There is one other behavior that is a little annoying that might be fixable... just haven't looked at the code to see how yet. If the dansguardian config is setup to use a different blacklist than the default, then a "reinstall" of the package breaks dans until you do a "fetch_blacklist". Basically, dans won't start because the blacklists in the config files don't match the blacklist directories that are created when a "reinstall" is done. One way to fix it would be to automatically do a "fetch_blacklist" at the end of a package reinstall. Not a big deal... just always have to do it manually after package reinstall...

marcelloc

@rjcrowder:

Basically, dans won't start because the blacklists in the config files don't match the blacklist directories that are created when a "reinstall" is done.

The install/reinstall code does check backlist during process install and apply it. I'll take a last look on it before version bump.

LokisMischief

@marcelloc:

@LokisMischief:

Not sure where to start looking for this one :(

Did you applied the binary patch fot fix web upload bug? you can try to downgrade binaries via pkg_add too.

Well, I have updated to your latest package, still had the same issue, child processes dropping out with sig 11's, applied your upload patch (incidentally I didn't have any web upload issues) but still the same sig 11's

Edit:

For more information on this issue, read here: http://forum.pfsense.org/index.php/topic,61811.0.html

Legion

marcelloc, I mentioned once before that DG fills up my cron table with fetch_blacklist entries:

I'm not sure why it happens. I'm guessing every time I save a config it puts another entry in the crontab? The main reason I noticed was I was doing things on my pfSense box at about midnight and noticed it suddenly spike in CPU, memory, etc so I had a look and it was trying to fetch the blacklist 100s of times at once.

maxxer

Hi. I cannot manage to have DG include blacklists in config.
It's a pfsense 2.1 beta installation, with dg 2.12.
I even tried to upgrade package gui from github, but no change.

Configuration is mostly the default. After adding blackslit url (shallalist) I go to dansguardian > ACLs > Site list, then edit the default entry. I enable the "Banned" checkbox, then select one (or all) the blacklist include, press Save. No domain in the blacklist is taken into consideration.
If I manually add a domain to the "Config" text area just below it works, correctly blocked.
If I manually add

.Include

in the same textarea sites are correcrty blocked.

what's wrong?
thanks

rjcrowder

@maxxer:

Hi. I cannot manage to have DG include blacklists in config.
It's a pfsense 2.1 beta installation, with dg 2.12.
I even tried to upgrade package gui from github, but no change.

Configuration is mostly the default. After adding blackslit url (shallalist) I go to dansguardian > ACLs > Site list, then edit the default entry. I enable the "Banned" checkbox, then select one (or all) the blacklist include, press Save. No domain in the blacklist is taken into consideration.
If I manually add a domain to the "Config" text area just below it works, correctly blocked.
If I manually add
.Include
in the same textarea sites are correcrty blocked.

what's wrong?
thanks

Did you download the new blacklists before trying to select them? The lists are not the same and the categories will change once you download the list.