Clamdscan - clamd: client with have small file that clamd server can't see or scan, the file only few kb and text ASCII only

Sengtocxoen commented 1 month ago

Describe the bug

I got the client and server, when the server run clamd and the client run the clamdscan. But when runing the folder with diferent file, the file with small capacity is runing ok, but the larger one can't. All the file about smaller than 10mb which i set configure in clamd.conf in the server.

How to reproduce the problem

make the file for checking is some simple text like: " Time, the relentless river, flows ever onward, shaping our lives, memories, and the world around us. It is a force that both creates and destroys, a paradox of constancy and change.

From the grandest scales of cosmic evolution to the fleeting moments of a butterfly's wingbeat, time's influence is pervasive. Galaxies swirl and collide over eons, while the seasons dance their annual waltz across the Earth.

Within our own lives, time marks milestones, from the joyous laughter of a child's first steps to the quiet wisdom of old age. Each birthday, each anniversary, each shared experience adds another chapter to the story of our existence.

Yet, time is also a thief, stealing away youth and vitality, leaving behind wrinkles and faded photographs. It erodes monuments, reduces empires to dust, and eventually claims even the stars themselves.

But even in its destructiveness, time holds a certain beauty. The weathered ruins of ancient civilizations whisper tales of past glories, while the ever-changing patterns of nature inspire awe and wonder.

In the face of time's relentless march, we seek to leave our mark, to create something that will outlive us, whether it be a work of art, a scientific discovery, or simply the love and kindness we share with others.

For time may be a river, but we are the boats that navigate its currents, choosing our own course and leaving behind a wake that ripples through the ages. " (This text is approximately 2.1 KB in size) and make some file with more copy of this text to make the larger one

Config file: clamd.conf - Server

LogFile = "/var/log/clamav/clamav.log" LogFileMaxSize = "4294967295" LogTime = "yes" LogClean = "yes" LogVerbose = "yes" LogRotate = "yes" ExtendedDetectionInfo = "yes" TemporaryDirectory = "/var/tmp" DatabaseDirectory = "/var/lib/clamav" LocalSocket = "/tmp/clamd.socket" LocalSocketGroup = "clamav" LocalSocketMode = "666" FixStaleSocket disabled TCPSocket = "3310" StreamMaxLength = "262144000" StreamMaxPort = "32000" MaxThreads = "20" ReadTimeout = "180" CommandReadTimeout = "180" SendBufTimeout = "50" MaxQueue = "200" IdleTimeout = "120" MaxDirectoryRecursion = "20" SelfCheck = "3600" Debug = "yes" LeaveTemporaryFiles = "yes" BytecodeTimeout = "60000" ScanPartialMessages = "yes" HeuristicScanPrecedence = "yes" StructuredDataDetection = "yes" AlertBrokenMedia = "yes" MaxScanSize = "1048576000" MaxFileSize = "524288000" MaxRecursion = "20" MaxEmbeddedPE = "10485760" MaxHTMLNormalize = "10485760" MaxHTMLNoTags = "20971520" MaxScriptNormalize = "52428800" MaxZipTypeRcg = "10485760" PCREMatchLimit = "10000" PCRERecMatchLimit = "5000" PCREMaxFileSize = "262144000" OnAccessIncludePath = "/home" OnAccessMaxFileSize = "52428800"

Config file: freshclam.conf - Server

LogTime = "yes" LogSyslog = "yes" LogVerbose = "yes" PidFile = "/var/run/freshclam.pid" DatabaseDirectory = "/var/lib/clamav" UpdateLogFile = "/var/log/freshclam.log" Checks = "24" DatabaseMirror = "database.clamav.net" MaxAttempts = "5" ReceiveTimeout disabled

clamav-milter.conf not found

Software settings - Server

Version: 1.0.6 Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON RAR

Database information - Server

Database directory: /var/lib/clamav bytecode.cvd: version 335, sigs: 86, built on Tue Feb 27 22:37:24 2024 daily.cvd: version 27353, sigs: 2065022, built on Wed Jul 31 15:27:25 2024 main.cvd: version 62, sigs: 6647427, built on Thu Sep 16 19:32:42 2021 Total number of signatures: 8712535

Platform information - Server

uname: Linux 5.15.0-52-generic #58-Ubuntu SMP Thu Oct 13 08:03:55 UTC 2022 x86_64 OS: Linux, ARCH: x86_64, CPU: x86_64 Full OS version: Ubuntu 22.04.1 LTS zlib version: 1.3.1 (1.3.1), compile flags: a9 platform id: 0x0a21a6a60800000000070500

Build information - Server

GNU C: 7.5.0 (7.5.0) sizeof(void*) = 8 Engine flevel: 166, dconf: 166 Attachments

Config file: clamd.conf - client

LogFile = "/var/log/clamav/clamav-test.log" LogFileMaxSize = "4294967295" LogTime = "yes" LogClean = "yes" LogSyslog = "yes" LogRotate = "yes" ExtendedDetectionInfo = "yes" TemporaryDirectory = "/var/tmp" DatabaseDirectory = "/var/lib/clamav" LocalSocketGroup = "clamav" LocalSocketMode = "666" TCPSocket = "3310" TCPAddr = "ip_server_clamd" MaxConnectionQueueLength = "10" StreamMaxLength = "26214400" MaxThreads = "2" ReadTimeout = "180" SendBufTimeout = "200" ExcludePath = "^/sys/", "^/dev/", "^/proc/", "^/home/cloudian*" SelfCheck = "3600" User = "clamav" BytecodeTimeout = "60000" MaxScanTime = "120000" MaxScanSize = "104857600" MaxFileSize = "26214400" MaxRecursion = "16" MaxEmbeddedPE = "10485760" MaxHTMLNormalize = "10485760" MaxHTMLNoTags = "2097152" MaxScriptNormalize = "5242880" PCREMatchLimit = "10000" PCRERecMatchLimit = "5000" PCREMaxFileSize = "26214400"

Config file: freshclam.conf - client

DatabaseMirror = "database.clamav.net"

clamav-milter.conf not found

Software settings

Version: 1.0.6 Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON RAR

Database information - client

Database directory: /usr/local/share/clamav WARNING: freshclam.conf and clamd.conf point to different database directories print_dbs: Can't open directory /usr/local/share/clamav

Platform information - client

uname: Linux 5.15.0-117-generic #127-Ubuntu SMP Fri Jul 5 20:13:28 UTC 2024 x86_64 OS: Linux, ARCH: x86_64, CPU: x86_64 Full OS version: Ubuntu 22.04.1 LTS zlib version: 1.3.1 (1.3.1), compile flags: a9 platform id: 0x0a21a6a60800000000070500

Build information - client

GNU C: 7.5.0 (7.5.0) sizeof(void*) = 8 Engine flevel: 166, dconf: 166

screenshots to help explain my problem.

teoberi commented 1 month ago

Old news, this has been known for years without a solution. https://github.com/Cisco-Talos/clamav/issues/590

micahsnyder commented 1 month ago

@teoberi this issue has nothing to do with the slow scan time issue.

It looks like @Sengtocxoen is seeing a "Communication error" for the second (4kb file) scan.

I could not reproduce this issue.

This is what I see:

clamav-micah-7/build on  main [$] via C v9.4.0-gcc via △ v3.30.0
❯ ./install/bin/clamdscan ~/gh-1325-2kbfile
/home/micah/gh-1325-2kbfile: OK

----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.012 sec (0 m 0 s)
Start Date: 2024:08:05 15:31:11
End Date:   2024:08:05 15:31:11

clamav-micah-7/build on  main [$] via C v9.4.0-gcc via △ v3.30.0
❯ ./install/bin/clamdscan ~/gh-1325-4kbfile
/home/micah/gh-1325-4kbfile: OK

----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.012 sec (0 m 0 s)
Start Date: 2024:08:05 15:31:11
End Date:   2024:08:05 15:31:11

clamav-micah-7/build on  main [$] via C v9.4.0-gcc via △ v3.30.0
❯ cat ~/gh-1325-2kbfile
Time, the relentless river, flows ever onward, shaping our lives, memories, and the world around us. It is a force that both creates and destroys, a paradox of constancy and change.

From the grandest scales of cosmic evolution to the fleeting moments of a butterfly's wingbeat, time's influence is pervasive. Galaxies swirl and collide over eons, while the seasons dance their annual waltz across the Earth.

Within our own lives, time marks milestones, from the joyous laughter of a child's first steps to the quiet wisdom of old age. Each birthday, each anniversary, each shared experience adds another chapter to the story of our existence.

Yet, time is also a thief, stealing away youth and vitality, leaving behind wrinkles and faded photographs. It erodes monuments, reduces empires to dust, and eventually claims even the stars themselves.

But even in its destructiveness, time holds a certain beauty. The weathered ruins of ancient civilizations whisper tales of past glories, while the ever-changing patterns of nature inspire awe and wonder.

In the face of time's relentless march, we seek to leave our mark, to create something that will outlive us, whether it be a work of art, a scientific discovery, or simply the love and kindness we share with others.

For time may be a river, but we are the boats that navigate its currents, choosing our own course and leaving behind a wake that ripples through the ages.

clamav-micah-7/build on  main [$] via C v9.4.0-gcc via △ v3.30.0
❯ cat  ~/gh-1325-4kbfile
Time, the relentless river, flows ever onward, shaping our lives, memories, and the world around us. It is a force that both creates and destroys, a paradox of constancy and change.

From the grandest scales of cosmic evolution to the fleeting moments of a butterfly's wingbeat, time's influence is pervasive. Galaxies swirl and collide over eons, while the seasons dance their annual waltz across the Earth.

Within our own lives, time marks milestones, from the joyous laughter of a child's first steps to the quiet wisdom of old age. Each birthday, each anniversary, each shared experience adds another chapter to the story of our existence.

Yet, time is also a thief, stealing away youth and vitality, leaving behind wrinkles and faded photographs. It erodes monuments, reduces empires to dust, and eventually claims even the stars themselves.

But even in its destructiveness, time holds a certain beauty. The weathered ruins of ancient civilizations whisper tales of past glories, while the ever-changing patterns of nature inspire awe and wonder.

In the face of time's relentless march, we seek to leave our mark, to create something that will outlive us, whether it be a work of art, a scientific discovery, or simply the love and kindness we share with others.

For time may be a river, but we are the boats that navigate its currents, choosing our own course and leaving behind a wake that ripples through the ages. Time, the relentless river, flows ever onward, shaping our lives, memories, and the world around us. It is a force that both creates and destroys, a paradox of constancy and change.

From the grandest scales of cosmic evolution to the fleeting moments of a butterfly's wingbeat, time's influence is pervasive. Galaxies swirl and collide over eons, while the seasons dance their annual waltz across the Earth.

Within our own lives, time marks milestones, from the joyous laughter of a child's first steps to the quiet wisdom of old age. Each birthday, each anniversary, each shared experience adds another chapter to the story of our existence.

Yet, time is also a thief, stealing away youth and vitality, leaving behind wrinkles and faded photographs. It erodes monuments, reduces empires to dust, and eventually claims even the stars themselves.

But even in its destructiveness, time holds a certain beauty. The weathered ruins of ancient civilizations whisper tales of past glories, while the ever-changing patterns of nature inspire awe and wonder.

In the face of time's relentless march, we seek to leave our mark, to create something that will outlive us, whether it be a work of art, a scientific discovery, or simply the love and kindness we share with others.

For time may be a river, but we are the boats that navigate its currents, choosing our own course and leaving behind a wake that ripples through the ages.

For my testing, to try reproduce the issue with your clamd.conf config options, I have:

Config file: clamd.conf
-----------------------
LogFile = "/tmp/clamd.log"
LogFileMaxSize = "4294967295"
LogTime = "yes"
LogClean = "yes"
LogRotate = "yes"
ExtendedDetectionInfo = "yes"
TCPSocket = "3310"
TCPAddr = "localhost"
MaxConnectionQueueLength = "10"
MaxThreads = "2"
ReadTimeout = "180"
SendBufTimeout = "200"
BytecodeTimeout = "60000"
MaxScanTime = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "16"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
PCREMatchLimit = "10000"
PCRERecMatchLimit = "5000"
PCREMaxFileSize = "26214400"

I don't have any idea why your second scan is getting that error.

Sengtocxoen commented 1 month ago

thank @micahsnyder, that not my point that the clamav dont scan that file, i mean i have some simular files like this and it don't scan and the files are the hidden file like the ".viminfo "or ".bashsrc". Those file should not be like being disconect or something like that why clamdscan to clamd server. Here the image that show folder i runing scan which each file in side by using my own bash srcipt

Sengtocxoen commented 1 month ago

Oh, it seem like i have the prolem with the network one, not the clamav. So maybe it some one have same error like me, Please check the network setting fist. Thank you

Cisco-Talos / clamav