Dansguardian package for 2.0

rjcrowder

I'll check it this weekend.

OK… believe your if statement had a misplaced closing paren... Should be...
if (is_array($config['installedpackages']['dansguardianblacklist']) && is_array($config['installedpackages']['dansguardianbl
acklist']['config'])){

BTW… the other thing that is strange (but maybe I just never noticed before) is that directory owners seem strange. A lot of stuff under /usr/local/etc/dansguardian/lists is now owned by "clamav"? also, it seems that stuff under the blacklists directory has an owner of "1000" and group of "squid"?

marcelloc

@rjcrowder:

A lot of stuff under /usr/local/etc/dansguardian/lists is now owned by "clamav"?

yes, clamav and dansguardian must be run by the same user.

@rjcrowder:

also, it seems that stuff under the blacklists directory has an owner of "1000" and group of "squid"?

Default file permissions from compressed blacklist download.

Legion

I've made some stupid mistake (maybe when I manually installed clamav a while back and then deleted it again?) and now I can't get clamav to work at all. I've reinstalled DG several times and each time I try to enable clamav via the gui I get:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /usr/local/pkg/dansguardian.inc on line 1137

That's a lot of bytes.

The line in particular is:

$script_file=file($clamav_script);

I'm not sure exactly what is going on. Eventually I'll do a fresh 2.1 install and hopefully that'll get rid of it.

marcelloc

@Legion:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /usr/local/pkg/dansguardian.inc on line 1137

I'm not sure exactly what is going on. Eventually I'll do a fresh 2.1 install and hopefully that'll get rid of it.

remove /usr/local/etc/rc.d/clamav-clamd script after package remove.

or follow instructions from this post http://forum.pfsense.org/index.php/topic,43786.msg332438.html#msg332438

marcelloc

rjcrowder,

take a look(with a package reinstall) if fetch_blacklist and clamav call are fine again. I'll bump version after these small bugs are gone.

att,
Marcello Coutinho

LokisMischief

I seem to have an issue with DG processes exiting with signal 11's ?? It seems dans is still accepting traffic and filtering but my logs have been filled with

Apr 29 11:28:57	kernel: pid 18872 (dansguardian), uid 106: exited on signal 11

Not sure where to start looking for this one :(

Though I don't have the update from this weekend I wouldn't expect any changes to the dansguardian core.

marcelloc

@LokisMischief:

Not sure where to start looking for this one :(

Did you applied the binary patch fot fix web upload bug? you can try to downgrade binaries via pkg_add too.

rjcrowder

@marcelloc:

rjcrowder,

take a look(with a package reinstall) if fetch_blacklist and clamav call are fine again. I'll bump version after these small bugs are gone.

att,
Marcello Coutinho

Looks good from what I can tell… manually checked the code plus all the scenarios that I know of where it starts/stops clamd and dans.

There is one other behavior that is a little annoying that might be fixable... just haven't looked at the code to see how yet. If the dansguardian config is setup to use a different blacklist than the default, then a "reinstall" of the package breaks dans until you do a "fetch_blacklist". Basically, dans won't start because the blacklists in the config files don't match the blacklist directories that are created when a "reinstall" is done. One way to fix it would be to automatically do a "fetch_blacklist" at the end of a package reinstall. Not a big deal... just always have to do it manually after package reinstall...

marcelloc

@rjcrowder:

Basically, dans won't start because the blacklists in the config files don't match the blacklist directories that are created when a "reinstall" is done.

The install/reinstall code does check backlist during process install and apply it. I'll take a last look on it before version bump.

LokisMischief

@marcelloc:

@LokisMischief:

Not sure where to start looking for this one :(

Did you applied the binary patch fot fix web upload bug? you can try to downgrade binaries via pkg_add too.

Well, I have updated to your latest package, still had the same issue, child processes dropping out with sig 11's, applied your upload patch (incidentally I didn't have any web upload issues) but still the same sig 11's

Edit:

For more information on this issue, read here: http://forum.pfsense.org/index.php/topic,61811.0.html

Legion

marcelloc, I mentioned once before that DG fills up my cron table with fetch_blacklist entries:

I'm not sure why it happens. I'm guessing every time I save a config it puts another entry in the crontab? The main reason I noticed was I was doing things on my pfSense box at about midnight and noticed it suddenly spike in CPU, memory, etc so I had a look and it was trying to fetch the blacklist 100s of times at once.

maxxer

Hi. I cannot manage to have DG include blacklists in config.
It's a pfsense 2.1 beta installation, with dg 2.12.
I even tried to upgrade package gui from github, but no change.

Configuration is mostly the default. After adding blackslit url (shallalist) I go to dansguardian > ACLs > Site list, then edit the default entry. I enable the "Banned" checkbox, then select one (or all) the blacklist include, press Save. No domain in the blacklist is taken into consideration.
If I manually add a domain to the "Config" text area just below it works, correctly blocked.
If I manually add

.Include

in the same textarea sites are correcrty blocked.

what's wrong?
thanks

rjcrowder

@maxxer:

Hi. I cannot manage to have DG include blacklists in config.
It's a pfsense 2.1 beta installation, with dg 2.12.
I even tried to upgrade package gui from github, but no change.

Configuration is mostly the default. After adding blackslit url (shallalist) I go to dansguardian > ACLs > Site list, then edit the default entry. I enable the "Banned" checkbox, then select one (or all) the blacklist include, press Save. No domain in the blacklist is taken into consideration.
If I manually add a domain to the "Config" text area just below it works, correctly blocked.
If I manually add
.Include
in the same textarea sites are correcrty blocked.

what's wrong?
thanks

Did you download the new blacklists before trying to select them? The lists are not the same and the categories will change once you download the list.

maxxer

@rjcrowder:

Did you download the new blacklists before trying to select them? The lists are not the same and the categories will change once you download the list.

Yes, I first downloaded the blacklists then tried to add them to the filter. Confirmed by the populated blacklist list in the box…

rjcrowder

@maxxer:

@rjcrowder:

Did you download the new blacklists before trying to select them? The lists are not the same and the categories will change once you download the list.

Yes, I first downloaded the blacklists then tried to add them to the filter. Confirmed by the populated blacklist list in the box…

Is the selection being saved? In other words, are they highlighted in the list (as you ctrl-click them)?

If you want to check that the UI is writing the config correctly, you can do the following… First, check and see if the list is getting written to the config.xml file (in /conf). If you vi the file, search for "banned_includes" - It should occur three times in the config, once for phraselists, once for sites, and once for URL's. It will be an encoded string and you wont be able to make any sense of it, but make sure the config is getting written here first... Next, check that it is getting properly written into the dansguardian config files located in /usr/local/etc/dansguardian/lists... for example, the one for banned sites for the default group is called "bannedsitelist.Default".

marcelloc

version 2.12.0.6(comunity patches) compiled and pushed to my repo.

Thanks to Fredb. :)

amd64
http://e-sac.siteseguro.ws/packages/amd64/8/All/dansguardian-2.12.0.6.tbz

i386
http://e-sac.siteseguro.ws/packages//8/All/dansguardian-2.12.0.6.tbz

both complied with maxfiles=8192

Also, I've removed squid ports compile depend. It will not force any squid version anymore.

see changelog here

maxxer

@rjcrowder:

Is the selection being saved? In other words, are they highlighted in the list (as you ctrl-click them)?

If you want to check that the UI is writing the config correctly, you can do the following… First, check and see if the list is getting written to the config.xml file (in /conf). If you vi the file, search for "banned_includes" - It should occur three times in the config, once for phraselists, once for sites, and once for URL's. It will be an encoded string and you wont be able to make any sense of it, but make sure the config is getting written here first... Next, check that it is getting properly written into the dansguardian config files located in /usr/local/etc/dansguardian/lists... for example, the one for banned sites for the default group is called "bannedsitelist.Default".

thanks for your support!

yes, selection is saved and config.xml is correclty populated. Tough I'm missing bannedsitelist.Default. I just have bannedsitelist. So this should be the problem. I guess 2.1 is not totally supported yet?

rjcrowder

@maxxer:

thanks for your support!

yes, selection is saved and config.xml is correclty populated. Tough I'm missing bannedsitelist.Default. I just have bannedsitelist. So this should be the problem. I guess 2.1 is not totally supported yet?

Hmmm… I'm at a little bit of a loss then. I'm running 2.0.3, so I don't know if there is a problem on 2.1 or not. I would think it would still create "bannedsitelist.Default" though... Is the name "Default" filled in at the top of the page? I suppose it would have to be if it is populating into the config.xml file.

Marcello is the package owner - think he's on 2.1. Maybe he has an idea...

wheelz

Now with the new squid package I'm looking to try to get dansguardian filtering HTTPS traffic as well. I have the CA cert and I created a test server cert and enabled ssl filtering. Do I need to get the latest from your repo first? When I try to access HTTPS through I get:

Secure Connection Failed

An error occurred during a connection to www.google.com.

Improperly formatted time string.

(Error code: sec_error_invalid_time)

marcelloc

@Legion:

marcelloc, I mentioned once before that DG fills up my cron table with fetch_blacklist entries:

Try a package reinstall and then a save config.

I've fixed the cron problem but did not bumped the version.