[clamav-users] Scanning a large file through HTTP

[Paul Smith]

On 07/04/2021 15:38, Saurav Sarkar via clamav-users wrote:
>
> We have files like CAD files which can go in GBs and want to send to 
> this malware scanning service.

Why are you scanning CAD files?

Can your CAD files contain arbitrary executable code which is blindly 
executed by the CAD software? If not, there's no reason to scan them? If 
they can, then I'd consider getting different CAD software...


> Is there a possibility to send the file in chunks and get it scanned 
> in the server side in chunks

That would depend on the HTTP scanning service software. Clam AV needs 
the whole file at once to scan it, but the HTTP scanning service may be 
able to upload in chunks and reassemble it before sending it to Clam AV.


>
> I observed that there is a INSTREAM command in clamd for this purpose 
> and also there is a 4GB size limit.
> https://linux.die.net/man/8/clamd <https://linux.die.net/man/8/clamd>

INSTREAM basically lets you send a file to clamd, it saves it as a 
temporary file, and then scans it, then deletes it. It lets you scan 
files that don't exist on the same computer as the clamd daemon without 
having to set up network shares etc. So, all the limits (eg the 4GB 
limit) which apply to normal files also apply to INSTREAM

-- 

Paul
Paul Smith Computer Services
support at pscs.co.uk - 01484 855800


-- 


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe