Question

First let me state, clamd has been proven to respond correctly:

$ echo PING | nc -U /var/run/clamav/clamd.sock
PONG

the scanner was setup as follows:

#set up a Clamav scanner
use File::VirusScan;
use File::VirusScan::ResultSet;
my $scanner = File::VirusScan->new({
    engines => {
            '-Daemon::ClamAV::Clamd' => {
                    socket_name => '/var/run/clamav/clamd.sock',
            },
    },
});

and the whole script works fine on a Solaris 11 box. I’m running this on a Linux CentOS 5.3 (Final) I did have a problem installing File::VirusScan from CPAN, the latest version 0.102 won’t compile and CPAN testers seems to confirm this as 435 fails out of 437. So I downloaded the prev 0.101 version from CPAN, the version I’m also running in Solaris and manually installed apparently ok

perl -v
This is perl, v5.8.8 built for x86_64-linux-thread-multi


sub scanner {
        $|++; # buffer disabled
        (my $path, my $logClean) = @_;



    my $recurse = 5;
    print color "yellow";
    print "[i] Building file scan queue - recurse deepth $recurse \n";
    print color "green";
    print "SCAN QUEUE:0";

    #Get list of files

    if( $rootPath){
     use File::Find::Rule;
    my $finder = File::Find::Rule->maxdepth($recurse)->file->relative->start("$$path");
        while( my $file = $finder->match()  ){
           $|++;
           #$file = substr($file,length($rootPath)); #remove path bloat
           push(@scanList,"/$file");
           print "\rSCAN QUEUE:" .scalar(@scanList);  #update screen
        }
    }else{
     push(@scanList,"$$path");
    }


    print "\rSCANING:0";
    #set up a Clamav scanner
    use File::VirusScan;
    use File::VirusScan::ResultSet;
    my $scanner = File::VirusScan->new({
        engines => {
                '-Daemon::ClamAV::Clamd' => {
                        socket_name => '/var/run/clamav/clamd.sock',
                },
        },
    });



    #scan each file
    my $scanning  = 0;
    my $complete = -1;

    foreach $scanFile (@scanList){
             $scanning++;
             ##################################################
             #scan this file
             $results = $scanner->scan($rootPath.$scanFile);
             ##################################################
                  #array of hashes
             my $centDone = int(($scanning/scalar(@scanList))*100);

             if($centDone > $complete){
                 $complete = $centDone;
             }
             if($centDone < 100){
                  #\r to clear/update line
                  $format = "%-9s %-60s %-15s %-5s";
                  printf $format, ("\rSCANING:", substr($scanFile,-50), "$scanning/".scalar(@scanList), "$centDone%");
             }else{
                  print "\rSCAN COMPLETE                                                                            ";
             }

             # array ref
             foreach $result (@$results) {
                        #array of pointers to hashes
                      #print 'data:'
                      #print 'state:'
                       if($$result{state} ne "clean"){
                           if($$result{data} =~ /^Clamd returned error: 2/){
                               $$result{data} = "File too big to scan";
                           }
                           push(@scanResults,[$scanFile,$$result{state},$$result{data}]); # results
                      }elsif($$logClean){
                           push(@scanResults,[$scanFile,$$result{state},$$result{data}]);
                      }
                      unless($$result{state} eq "clean"){
                                    print color "red";
                                    print "\r$scanFile,$$result{state},$$result{data}\n";
                                    print color "green";
                                    print "\rSCANING: $scanning/".scalar(@scanList)." : $centDone%";
                               if($$result{state} eq "virus"){
                                    push(@scanVirus,scalar(@scanResults)-1);  #scanResuts index of virus

                               }elsif($$result{state} eq "error"){
                                    push(@scanError,scalar(@scanResults)-1);  #scanResuts index of Error
                               }
                      }
             }

    } print "\n";

}

Answer 1

Looking at the source code for the Clamd package the following script should approximate the call it is attempting and will hopefully give you a better idea of how it’s failing. Try saving it to a separate file (like test.pl) and run it using “perl test.pl”:

use IO::Socket::UNIX;
use IO::Select;

my $socket_name = '/var/run/clamav/clamd.sock';
my $sock = IO::Socket::UNIX->new(Peer => $socket_name);

if(!defined($sock)) {
    die("Couldn't create socket for path $socket_name");
}

my $s = IO::Select->new($sock);

if(!$s->can_write(5)) {
    $sock->close;
    die("Timeout waiting to write PING to clamd daemon at $socket_name");
}

if(!$sock->print("SESSION\nPING\n")) {
    $sock->close;
    die('Could not ping clamd');
}

if(!$sock->flush) {
    $sock->close;
    die('Could not flush clamd socket');
}

if(!$s->can_read($self->{5})) {
    $sock->close;
    die("Timeout reading from clamd daemon at $socket_name");
}

my $ping_response;
if(!$sock->sysread($ping_response, 256)) {
    $sock->close;
    die('Did not get ping response from clamd');
}

if(!defined $ping_response || $ping_response ne "PONG\n") {
    $sock->close;
    die("Unexpected response from clamd: $ping_response");
}