clamav

README

ClamAV Private Mirror

How To Use

• cf push

OR

• glide install && go build -v . && PRIMARY_MIRROR="https://database.clamav.net" ./clamav

What It Does

1. Starts an asynchronous download of the current antivirus definitions.
   1. Downloads three databases:
      1. main
      2. bytecode
      3. daily
   2. Parses each database's header for similar versions.
   3. If there is a similar/related version, it also gets downloaded.
   4. Downloaded files are stored in-memory in a cache for client downloads.
2. Initialises a cron job to download the new database definitions every hour.
3. Starts the web server and serves from cache.
4. Evicts files from cache every 3 hours to prevent stale definitions.

Mirrors

In order to function properly as a localised cache, you need to set the PRIMARY_MIRROR environment variable. Below is a short list of known mirrors.

• http://database.clamav.net
• https://pivotal-clamav-mirror.s3.amazonaws.com (fast)

If for some reason the primary mirror fails, if you set SECONDARY_MIRROR, it will try that one.

Contributing

• Keep It Simple.
• The standard testing library is awesome. Let's keep using it.

To unzip the CVD files: cd filedefs/ && tail -c $(expr $(wc -c $FILE.cvd | awk '{print $1}') - 512) $FILE.cvd | tar zxvf -

Documentation

Overview

Raw file header example:

ClamAV-VDB:07 Mar 2017 08-02 -0500:23182:1741572:63:c1537143239006af01e814a4dcd58a48:QC2ZncCPK0AzfYPW8OKvde9GFOO1HyH5qbozl9JZbmlOmZnSV55zWaP9yH9tXiS+JmZWA1277X6pBeTHPCcaqUDakke4W58duZ5mavDGJoWekl3q/5RgVeAg39cM1X4zNf6gER8G+HIWDUka0sRQWal1KXAb1UWkFoKsbHVqgVi:neo:1488891746

Field Definitions: ClamAV-VDB: Header, defines file type. 07 Mar 2017 08-02 -0500: Creation time. 23182: Version Number 1741572: Number of signatures. 63: Functionality level. c1...58a48: MD5 checksum. QC...VqgVi: Digital Signature. Type Unknown. neo: Builder Name. Creation time in Epoch Seconds: old file format.

Actual definition: struct cl_cvd { char *time; 2 unsigned int version; 3 unsigned int sigs; 4 unsigned int fl; 5 // padding char *md5; 6 char *dsig; 7 char *builder; 8 unsigned int stime; 9 };