Re: Question - How many of you run ALL your email through SA?

[Duane Hill]

On Tue, 21 Aug 2007 at 17:43 -0700, [EMAIL PROTECTED] confabulated:

On Aug 21, 2007, at 11:48 AM, Duane Hill wrote:
Ok. I just examined the clamav.pm plugin and it does appear to pass the 
message text directly to the ClamAV daemon through the use of the 
File::Scan::ClamAV perl module. Therefore, it doesn't sound like a temp 
file is created.

Read the code of that module.

The ClamAV plugin passes the test of the message using:

  my ($code, $virus) = $clamav->streamscan(${$fulltext});

$fulltext is the text that was sent to the plugin from SA.

'streamscan' then establishes a TCP connection to the ClamAV daemon and 
feeds the text to it:

  sub streamscan {
   my ($self) = shift;

   my $data = join '', @_;

   $self->_seterrstr;

   my $conn = $self->_get_connection || return;
   $self->_send($conn, "STREAM\n");
   chomp(my $response = $conn->getline);

   my @return;
   if($response =~ /^PORT (\d+)/){
          if((my $c = $self->_get_tcp_connection($1))){
                  $self->_send($c, $data);
                  $c->close;

                  chomp(my $r = $conn->getline);
                  if($r =~ /stream: (.+) FOUND/i){
                          @return = ('FOUND', $1);
                  } else {
                          @return = ('OK');
                  }
          } else {
                  $conn->close;
                  return;
          }
   }
   $conn->close;
   return @return;
  }

-------
  _|_
 (_| |