[clamav-users] Freshclam updates problem

[Micah Snyder (micasnyd)]

Paul,

I think this is probably the same behavior you faced before, exacerbated by the fact that we used a zero-byte patch to force freshclam to download the whole cvd.  I have a pretty good idea on how to solve this in a future clamav version, but for now we're working to un-stick the stuck 0.103.1-0.103.3 freshclam clients.  

All:

We created another new version of main.cvd (version 61) along with a small main-61.cdiff file.  We did some testing internally and then published it on the CDN.  I've confirmed that it's live now and that the main database update is working as expected again on versions 0.102.4 and 0.103.3.  

The daily database is still stuck for freshclam versions 0.103.1-0.103.3.  We're building a new daily database & daily cdiff to un-stick this one. The build is expected to take about 4 hours.  After that, everyone should be able to update normally again.

Regards,
Micah

> -----Original Message-----
> From: clamav-users <clamav-users-bounces at lists.clamav.net> On Behalf Of
> Paul Kosinski via clamav-users
> Sent: Wednesday, July 14, 2021 7:37 PM
> To: clamav-users at lists.clamav.net
> Cc: Paul Kosinski <clamav-users at iment.com>
> Subject: Re: [clamav-users] Freshclam updates problem
> 
> On Wed, 14 Jul 2021 23:55:06 +0000
> "Micah Snyder \(micasnyd\) via clamav-users" <clamav-
> users at lists.clamav.net> wrote:
> 
> > Hi Paul, all:
> >
> > We're triaging this issue now, also reported by a user on Discord.
> >
> > We issue a zero-byte CDIFF database patch file whenever we want
> Freshclam to download a whole CVD instead of doing the incremental/patch
> update.
> > Today we published a zero-byte patch file for both daily and main, as we've
> migrated about half of the daily signatures over to the main database.
> >
> > Unfortunately it appears we have a bug in 0.102 and 0.103 where Freshclam
> will complain loudly about the zero-byte CDIFF patch file. I suspect we didn't
> notice it before because, despite the error message, Freshclam will still do
> the right thing (at least in 0.102).
> >
> > But it seems 0.103 has a second bug where it will patiently wait until it's at
> least 2 versions behind before it downloads the whole CVD database. This
> behavior is supposed to happen when a private mirror doesn't have the
> latest patch file yet, but wasn't supposed to happen for a zero-byte patch
> file. So we clearly have 2 bugs to fix ASAP.
> >
> > The good news is, I believe that if we publish 1 more version of daily.cvd
> and main.cvd, we will see the 0.103 Freshclam clients all download the new
> daily & main and they'll be good again. I will work with our signature
> publishing team here to get an update for daily & main out as soon as we're
> able.
> >
> > I'm sorry about the bug everyone. Thank you for your patience!
> >
> > I will write again a soon as I have an update.
> >
> > -Micah
> 
> 
> More details on the new 'main' misbehavior. Don't know if it is helpful.
> 
> I'm running 0.103.3 on all 3 of my ClamAV installations. On one of the systems
> (where I have very detailed logging of freshclam), main was still at 59 (today
> at 7:43 AM EDT), and freshclam correctly downloaded daily 26231 over 26230.
> 
> Later on, from the same system, main was allegedly (DNS TXT) supposed to
> be at 60, and daily was supposed to be at 26232, but *both* failed to
> download at least 7 times (15:43 EDT through 21:43).
> 
> This may, of course, be essentially the same problem I had with Cloudflare's
> BOS (Anycast) POP a couple of years ago, which made me give up putting any
> more work into setting up my own mirror.
> 
> 
> 
> _______________________________________________
> 
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml