I'm trying to check file by using clamd nINSTREAM.
struct clam_chunk {
unsigned int fsize;
char data[1024];
};
..............................................................................
st_data.fsize = __bswap_32(st_data.fsize); //big-endian format
do {
ret = send(fd, "nINSTREAM\n", 11, MSG_NOSIGNAL);
ret = send(fd, &st_data, sizeof(st_data), MSG_NOSIGNAL);
ret = send (fd,"",0,MSG_NOSIGNAL);
} while (ret < 0 && errno == EINTR);
I have a response: "stream: OK", but it's wrong, because data contains Eicar-Test-Signature.
PING recive PONG, simple SCAN work too.