Beta release 4.39.4

[Rick Cooper]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Rakesh
> Sent: Saturday, March 05, 2005 1:29 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Beta release 4.39.4
>
>
> Rick,
>
> Have you tried this with Clamav versions > 0.82 ?. I tried to do the
> same thing and tried to pass some extra parameters from the
> clamav-wrapper of MailScanner. But it seems that the recent releases of
> clamav like to be instructed only from the conf file and it started
> showing warings in the maillog.

As I recall clamscan will attempt to use it's internal unrar first and
(if --unrar= is set) if it fails it uses the one passed to it. I just tried
that with 0.83 and that is just what it does. Note the first line after the
clamscan command.

[rcooper at srv2 tmp]$ clamscan --unrar=/usr/bin/unrar Test.rar
/tmp/Test.rar: RAR module failure

RAR 3.41   Copyright (c) 1993-2004 Alexander Roshal   2 Nov 2004
Registered to Rick Cooper


Extracting from /tmp/Test.rar

Extracting  FreeBSD.html                                              OK
Extracting  docs.html                                                 OK
Extracting  index.html                                                OK
Extracting  index.new.html                                            OK
Extracting  phishing.html                                             OK
Extracting  presentations.html                                        OK
Extracting  press.html                                                OK
Extracting  pressreleases.html                                        OK
Extracting  reject.html                                               OK
Extracting  sobig.html                                                OK
Extracting  support.html                                              OK
All OK

>
> Also Clamav seems to be using the unrarlib library
> (http://www.unrarlib.org/faq.html) for its support to RAR archives. But
> the website of its library claims that support for RAR3 is not currently
> scheduled (it doesnt seem to be under any active development anymore)
> and is hoping for some one to contribute the support. Also currently
> there is not Perl module that is based on unrarlib. The only available I
> came across was Archive::Rar and that too needs the unrar command to be
> installed on your system.

There is no RAR3 library because of some licensing issue. ClamAV could use
the 3+ version but there is some language within the library that would
cause issue. The ClamAV maintainers have said (say in every version of the
docs and api) they will never include 3.+ support. This would be the reason,
I would think, that Archive::Rar would need the external rar. The "RAR
module failure" error from clam is specifically the result of 3.+ Rars (from
looking at the source) which is why that error has been won't show up in the
MailScanner log anymore.

Rick


>
> I am looking at building RAR archive support in MailScanner, but that
> definitely involves a lot of work, like first building RAR3 support in
> unrarlib, then creating a Perl module from unrarlib and then build the
> support in MailScanner itself.
>
> Rakesh
>
> Rick Cooper wrote:
>
> >It's important to note that ClamAV only supports RAR v2, so the
> answer is:
> >
> >        Uncomment the ScanRar line in the config file
> >
> >but pass the --unrar[=FULLPATH] option (and of course have the
> latest unrar)
> >if you really want to handle rar files because v2 is quite old and not
> >likely to be used much anymore. If you are using clamavmodule then you
> >cannot use the external unrar (which is why I patch my MS versions with
> >specific unrar code/function every release).
> >
> >
>
>
> --
>
> regards,
> Rakesh B. Pal,
> Project Leader,
> Emergic CleanMail Team.
> Netcore Solutions Pvt. Ltd.
>
> ==================================================
> I came, I saw, I conquered
> ==================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>
>


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!