clamav

Documentation

Overview

Package clamav implements a ClamAV CLAMD protocol client (INSTREAM scanning) over Unix domain sockets or TCP, with zero external API dependency. It is a self-contained leaf (stdlib only, no Culvert coupling) extracted from the flat package main per ADR-0002.

Protocol: CLAMD INSTREAM command

1. Send "zINSTREAM\0" (null-terminated command prefix)
2. Stream data as length-prefixed chunks (4-byte big-endian uint32 + bytes)
3. Terminate with a zero-length chunk ({0,0,0,0})
4. Read null-terminated response: "stream: OK\0" → clean "stream: <VirusName> FOUND\0" → malicious "stream: ... ERROR\0" → scan error

Reference: https://linux.die.net/man/8/clamd

Index

• type Client
  • func New(addr string) *Client
  • func (c *Client) Ping() error
  • func (c *Client) Scan(data []byte) (virusName string, isMalicious bool, err error)
  • func (c *Client) Version() (Version, error)
• type Version

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is a ClamAV CLAMD protocol client.

func New

func New(addr string) *Client

New creates a client from an address string.

"unix:/var/run/clamav/clamd.sock"  → Unix domain socket
"tcp:localhost:3310"               → TCP connection
""                                 → default Unix socket path

func (*Client) Ping

func (c *Client) Ping() error

Ping verifies the ClamAV daemon is reachable and responding correctly. Returns nil on success, error otherwise.

func (*Client) Scan

func (c *Client) Scan(data []byte) (virusName string, isMalicious bool, err error)

Scan submits data to the ClamAV daemon via the INSTREAM command. Returns (virusName, isMalicious, error). virusName is non-empty only when isMalicious is true. Concurrent scans are limited by clamSem to prevent overwhelming the daemon.

func (*Client) Version

func (c *Client) Version() (Version, error)

Version queries the ClamAV daemon for its engine and signature-database version via the VERSION command. The daemon replies with a single line like:

ClamAV 0.103.8/26982/Wed Apr 12 09:30:00 2023

where the three "/"-separated fields are the engine version, the signature database version (main+daily counter), and the database build date. Older or minimally-configured daemons may reply with just the engine string and no "/" fields; DBVersion/DBDate are then empty. Raw is always the full reply.

type Version

type Version struct {
	Engine    string `json:"engine"`               // e.g. "ClamAV 0.103.8"
	DBVersion string `json:"db_version,omitempty"` // signature database counter, e.g. "26982"
	DBDate    string `json:"db_date,omitempty"`    // database build date, e.g. "Wed Apr 12 09:30:00 2023"
	Raw       string `json:"raw"`                  // full unparsed reply
}

Version holds the parsed ClamAV VERSION response.