> On Tue, 22 Feb 2005 09:36:44 +0100 > "Christian Hilgers" <[EMAIL PROTECTED]> wrote: > > > Hi, > > > > I'm working on an http anti virus scanner. The main goal are > > continuous and non-blocking downloads. > > Therefore I need libclamav to start scanning even with a small amount > > of received data. > > I figured out that changing SCANBUFF will work for me. Is there a > > disadvantage decreasing this buffer to 25000? I guess it is only a > > performance and not a safety issue. > > Please do not use cl_scanbuff at all, it's to be removed in 0.90. This > function only supports old type signature scanning and will miss many > viruses (just try to scan test/clam.exe). You should definitely use > cl_scanfile/cl_scandesc instead. Due to performance reasons you can > suggest your users to use a memory based filesystem for proxy file > operations (then also add some option to havp that will allow to set > that directory in libclamav with cl_settempdir()) I don't use the scanbuff funktion. I'm using cl_scandesc. I think I have to explain the functionality of my proxy. The proxy download requested data in a tempfile and hard lock alway the last byte of this file. A second thread starts the virus scanner on this tempfile so downloading and scanning run simultaneous. There is only on problem: Your scanner try to read SCANBUFF byte ( ca. 130 KB) from the locked tempfile. If the read comes to the locked byte it blocks and wait till the tempfile is larger than SCANBUFF. But most webfiles are smaller than 130KB. No I want to decrease SCANBUFF to start scanning earlier. I think SCANBUFF with a size of 25000 will work for me. I did some testing with this size and could not find any problems. What do you think? If I should not change SCANBUFF I have to increase my "hold back data" and I relay don't want this. If you have further questions on the proxy please look at www.server-side.de Documentation. There is also a picture and I think it makes no sense posting the complete design. > > PS: Is it possible to put my proxy in your "Third party software" > > section in your documentation? > > My proxy is called havp http://www.server-side.de/ > > Yes, of course! Thank you. Christian
------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
