clamav

package
v1.0.21 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 4, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Overview

Package clamav implements a ClamAV CLAMD protocol client (INSTREAM scanning) over Unix domain sockets or TCP, with zero external API dependency. It is a self-contained leaf (stdlib only, no Culvert coupling) extracted from the flat package main per ADR-0002.

Protocol: CLAMD INSTREAM command

  1. Send "zINSTREAM\0" (null-terminated command prefix)
  2. Stream data as length-prefixed chunks (4-byte big-endian uint32 + bytes)
  3. Terminate with a zero-length chunk ({0,0,0,0})
  4. Read null-terminated response: "stream: OK\0" → clean "stream: <VirusName> FOUND\0" → malicious "stream: ... ERROR\0" → scan error

Reference: https://linux.die.net/man/8/clamd

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is a ClamAV CLAMD protocol client.

func New

func New(addr string) *Client

New creates a client from an address string.

"unix:/var/run/clamav/clamd.sock"  → Unix domain socket
"tcp:localhost:3310"               → TCP connection
""                                 → default Unix socket path

func (*Client) Ping

func (c *Client) Ping() error

Ping verifies the ClamAV daemon is reachable and responding correctly. Returns nil on success, error otherwise.

func (*Client) Scan

func (c *Client) Scan(data []byte) (virusName string, isMalicious bool, err error)

Scan submits data to the ClamAV daemon via the INSTREAM command. Returns (virusName, isMalicious, error). virusName is non-empty only when isMalicious is true. Concurrent scans are limited by clamSem to prevent overwhelming the daemon.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL