|
(0001198)
|
|
Falk Reichbott
|
2018-10-18 14:56
(edited on: 2018-10-18 16:52) |
|
ClamAV (http://www.clamav.net [^]) would be the first and standard FAVE implementation by limes datentechnik gmbh. Other anti virus solutions requires licenses and must be implemented by customers it self.
libclamav is GLP based, but we plan to support simply the clamd deamon with the instream command below. The client part are written by our self (uses IDSESSION is with non-blocking sockets, and a select()/poll() loop) and the deamon must be available behind a IPv4/6 address and port. The main configuration are done for the deamon and is not related to the client. The client (FLAM) will support a command like this:
CNVAVS/AVSCAN(METHOD=DELETE/ERROR/WARNING/REMSEG,LIBRARY='favelib',FUNC='clamav',PARAMETER="HOST='ClamAV.server',PORT='4711'")
The default method will be "DELETE", the default library will be "favelib", the default function "clamav" and the DNS and port number for cmald can be configured over a new environment variable FL_CLAMAV_CONNECTION=host:port.
INSTREAM
It is mandatory to prefix this command with n or z.
Scan a stream of data. The stream is sent to clamd in chunks, after INSTREAM,
on the same socket on which the command was sent. This avoids the overhead
of establishing new TCP connections and problems with NAT. The format of the
chunk is: <length><data> where <length> is the size of the following data in
bytes expressed as a 4 byte unsigned integer in network byte order and <data> is
the actual chunk. Streaming is terminated by sending a zero-length chunk. Note:
do not exceed StreamMaxLength as defined in clamd.conf, otherwise clamd will
reply with INSTREAM size limit exceeded and close the connection.
|
|