Clamd INSTREAM checking

Question

I'm trying to check file by using clamd nINSTREAM.

struct clam_chunk {
    unsigned int fsize;
    char data[1024];    
    };

..............................................................................

st_data.fsize = __bswap_32(st_data.fsize); //big-endian format

do {
    ret = send(fd, "nINSTREAM\n", 11, MSG_NOSIGNAL);
    ret = send(fd, &st_data, sizeof(st_data), MSG_NOSIGNAL);
    ret = send (fd,"",0,MSG_NOSIGNAL);
} while (ret < 0 && errno == EINTR);

I have a response: "stream: OK", but it's wrong, because data contains Eicar-Test-Signature.

PING recive PONG, simple SCAN work too.

Answer 1

You're sending 11 characters which includes \0 end character. This is not necessary, because you're sending a 'n' command, which ends with \n. May be that character is responsible for the no detection. Try to send 10 characters, or zINSTREAM command, which also requires 10 characters because \0 end character is required.