1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
|
--[[
Copyright (c) 2022, Vsevolod Stakhov <vsevolod@rspamd.com>
Copyright (c) 2019, Carsten Rosenberg <c.rosenberg@heinlein-support.de>
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
]]--
--[[
@module icap
This module contains icap access functions.
Currently tested with
- C-ICAP Squidclamav / echo
- Checkpoint Sandblast
- F-Secure Internet Gatekeeper
- Kaspersky Web Traffic Security
- Kaspersky Scan Engine 2.0
- McAfee Web Gateway 9/10/11
- Sophos Savdi
- Symantec (Rspamd <3.2, >=3.2 untested)
- Trend Micro IWSVA 6.0
- Trend Micro Web Gateway
@TODO
- Preview / Continue
- Reqmod URL's
- Content-Type / Filename
]] --
--[[
Configuration Notes:
C-ICAP Squidclamav
scheme = "squidclamav";
Checkpoint Sandblast example:
scheme = "sandblast";
ESET Gateway Security / Antivirus for Linux example:
scheme = "scan";
F-Secure Internet Gatekeeper example:
scheme = "respmod";
x_client_header = true;
x_rcpt_header = true;
x_from_header = true;
Kaspersky Web Traffic Security example:
scheme = "av/respmod";
x_client_header = true;
Kaspersky Web Traffic Security (as configured in kavicapd.xml):
scheme = "resp";
x_client_header = true;
McAfee Web Gateway 10/11 (Headers must be activated with personal extra Rules)
scheme = "respmod";
x_client_header = true;
Sophos SAVDI example:
# scheme as configured in savdi.conf (name option in service section)
scheme = "respmod";
Symantec example:
scheme = "avscan";
Trend Micro IWSVA example (X-Virus-ID/X-Infection-Found headers must be activated):
scheme = "avscan";
x_client_header = true;
Trend Micro Web Gateway example (X-Virus-ID/X-Infection-Found headers must be activated):
scheme = "interscan";
x_client_header = true;
]] --
local lua_util = require "lua_util"
local tcp = require "rspamd_tcp"
local upstream_list = require "rspamd_upstream_list"
local rspamd_logger = require "rspamd_logger"
local common = require "lua_scanners/common"
local rspamd_util = require "rspamd_util"
local rspamd_version = rspamd_version
local N = 'icap'
local function icap_config(opts)
local icap_conf = {
name = N,
scan_mime_parts = true,
scan_all_mime_parts = true,
scan_text_mime = false,
scan_image_mime = false,
scheme = "scan",
default_port = 1344,
ssl = false,
no_ssl_verify = false,
timeout = 10.0,
log_clean = false,
retransmits = 2,
cache_expire = 7200, -- expire redis in one hour
message = '${SCANNER}: threat found with icap scanner: "${VIRUS}"',
detection_category = "virus",
default_score = 1,
action = false,
dynamic_scan = false,
user_agent = "Rspamd",
x_client_header = false,
x_rcpt_header = false,
x_from_header = false,
req_headers_enabled = true,
req_fake_url = "http://127.0.0.1/mail",
http_headers_enabled = true,
use_http_result_header = true,
use_http_3xx_as_threat = false,
use_specific_content_type = false, -- Use content type from a part where possible
}
icap_conf = lua_util.override_defaults(icap_conf, opts)
if not icap_conf.prefix then
icap_conf.prefix = 'rs_' .. icap_conf.name .. '_'
end
if not icap_conf.log_prefix then
icap_conf.log_prefix = icap_conf.name .. ' (' .. icap_conf.type .. ')'
end
if not icap_conf.log_prefix then
if icap_conf.name:lower() == icap_conf.type:lower() then
icap_conf.log_prefix = icap_conf.name
else
icap_conf.log_prefix = icap_conf.name .. ' (' .. icap_conf.type .. ')'
end
end
if not icap_conf.servers then
rspamd_logger.errx(rspamd_config, 'no servers defined')
return nil
end
icap_conf.upstreams = upstream_list.create(rspamd_config,
icap_conf.servers,
icap_conf.default_port)
if icap_conf.upstreams then
lua_util.add_debug_alias('external_services', icap_conf.name)
return icap_conf
end
rspamd_logger.errx(rspamd_config, 'cannot parse servers %s',
icap_conf.servers)
return nil
end
local function icap_check(task, content, digest, rule, maybe_part)
local function icap_check_uncached ()
local upstream = rule.upstreams:get_upstream_round_robin()
local addr = upstream:get_addr()
local retransmits = rule.retransmits
local http_headers = {}
local req_headers = {}
local tcp_options = {}
local threat_table = {}
-- Build extended User Agent
if rule.user_agent == "extended" then
rule.user_agent = string.format("Rspamd/%s-%s (%s/%s)",
rspamd_version('main'),
rspamd_version('id'),
rspamd_util.get_hostname(),
string.sub(task:get_uid(), 1, 6))
end
-- Build the icap queries
local options_request = {
string.format("OPTIONS icap://%s/%s ICAP/1.0\r\n", addr:to_string(), rule.scheme),
string.format('Host: %s\r\n', addr:to_string()),
string.format("User-Agent: %s\r\n", rule.user_agent),
"Connection: keep-alive\r\n",
"Encapsulated: null-body=0\r\n\r\n",
}
if rule.user_agent == "none" then
table.remove(options_request, 3)
end
local respond_headers = {
-- Add main RESPMOD header before any other
string.format('RESPMOD icap://%s/%s ICAP/1.0\r\n', addr:to_string(), rule.scheme),
string.format('Host: %s\r\n', addr:to_string()),
}
local size = tonumber(#content)
local chunked_size = string.format("%x", size)
local function icap_callback(err, conn)
local function icap_requery(err_m, info)
-- retry with another upstream until retransmits exceeds
if retransmits > 0 then
retransmits = retransmits - 1
lua_util.debugm(rule.name, task,
'%s: %s Request Error: %s - retries left: %s',
rule.log_prefix, info, err_m, retransmits)
-- Select a different upstream!
upstream = rule.upstreams:get_upstream_round_robin()
addr = upstream:get_addr()
lua_util.debugm(rule.name, task, '%s: retry IP: %s:%s',
rule.log_prefix, addr, addr:get_port())
tcp_options.host = addr:to_string()
tcp_options.port = addr:get_port()
tcp_options.callback = icap_callback
tcp_options.data = options_request
tcp_options.upstream = upstream
tcp.request(tcp_options)
else
rspamd_logger.errx(task, '%s: failed to scan, maximum retransmits ' ..
'exceed - error: %s', rule.log_prefix, err_m or '')
common.yield_result(task, rule, string.format('failed - error: %s', err_m),
0.0, 'fail', maybe_part)
end
end
local function get_req_headers()
local in_client_ip = task:get_from_ip()
local req_hlen = 2
if maybe_part then
table.insert(req_headers,
string.format('GET http://%s/%s HTTP/1.0\r\n', in_client_ip, lua_util.url_encode_string(maybe_part:get_filename())))
if rule.use_specific_content_type then
table.insert(http_headers, string.format('Content-Type: %s/%s\r\n', maybe_part:get_detected_type()))
--else
-- To test: what content type is better for icap servers?
--table.insert(http_headers, 'Content-Type: text/plain\r\n')
end
else
table.insert(req_headers, string.format('GET %s HTTP/1.0\r\n', rule.req_fake_url))
table.insert(http_headers, string.format('Content-Type: application/octet-stream\r\n'))
end
table.insert(req_headers, string.format('Date: %s\r\n', rspamd_util.time_to_string(rspamd_util.get_time())))
if rule.user_agent ~= "none" then
table.insert(req_headers, string.format("User-Agent: %s\r\n", rule.user_agent))
end
for _, h in ipairs(req_headers) do
req_hlen = req_hlen + tonumber(#h)
end
return req_hlen, req_headers
end
local function get_http_headers()
local http_hlen = 2
table.insert(http_headers, 'HTTP/1.0 200 OK\r\n')
table.insert(http_headers, string.format('Date: %s\r\n', rspamd_util.time_to_string(rspamd_util.get_time())))
table.insert(http_headers, string.format('Server: %s\r\n', 'Apache/2.4'))
if rule.user_agent ~= "none" then
table.insert(http_headers, string.format("User-Agent: %s\r\n", rule.user_agent))
end
--table.insert(http_headers, string.format('Content-Type: %s\r\n', 'text/html'))
table.insert(http_headers, string.format('Content-Length: %s\r\n', size))
for _, h in ipairs(http_headers) do
http_hlen = http_hlen + tonumber(#h)
end
return http_hlen, http_headers
end
local function get_respond_query()
local req_hlen = 0
local resp_req_headers
local http_hlen = 0
local resp_http_headers
-- Append all extra headers
if rule.user_agent ~= "none" then
table.insert(respond_headers,
string.format("User-Agent: %s\r\n", rule.user_agent))
end
if rule.req_headers_enabled then
req_hlen, resp_req_headers = get_req_headers()
end
if rule.http_headers_enabled then
http_hlen, resp_http_headers = get_http_headers()
end
if rule.req_headers_enabled and rule.http_headers_enabled then
local res_body_hlen = req_hlen + http_hlen
table.insert(respond_headers,
string.format('Encapsulated: req-hdr=0, res-hdr=%s, res-body=%s\r\n',
req_hlen, res_body_hlen))
elseif rule.http_headers_enabled then
table.insert(respond_headers,
string.format('Encapsulated: res-hdr=0, res-body=%s\r\n',
http_hlen))
else
table.insert(respond_headers, 'Encapsulated: res-body=0\r\n')
end
table.insert(respond_headers, '\r\n')
for _, h in ipairs(resp_req_headers) do
table.insert(respond_headers, h)
end
table.insert(respond_headers, '\r\n')
for _, h in ipairs(resp_http_headers) do
table.insert(respond_headers, h)
end
table.insert(respond_headers, '\r\n')
table.insert(respond_headers, chunked_size .. '\r\n')
table.insert(respond_headers, content)
table.insert(respond_headers, '\r\n0\r\n\r\n')
return respond_headers
end
local function add_respond_header(name, value)
if name and value then
table.insert(respond_headers, string.format('%s: %s\r\n', name, value))
end
end
local function result_header_table(result)
local icap_headers = {}
for s in result:gmatch("[^\r\n]+") do
if string.find(s, '^ICAP') then
icap_headers['icap'] = tostring(s)
elseif string.find(s, '^HTTP') then
icap_headers['http'] = tostring(s)
elseif string.find(s, '[%a%d-+]-:') then
local _, _, key, value = tostring(s):find("([%a%d-+]-):%s?(.+)")
if key ~= nil then
icap_headers[key:lower()] = tostring(value)
end
end
end
lua_util.debugm(rule.name, task, '%s: icap_headers: %s',
rule.log_prefix, icap_headers)
return icap_headers
end
local function threat_table_add(icap_threat, maybe_split)
if maybe_split and string.find(icap_threat, ',') then
local threats = lua_util.str_split(string.gsub(icap_threat, "%s", ""), ',') or {}
for _, v in ipairs(threats) do
table.insert(threat_table, v)
end
else
table.insert(threat_table, icap_threat)
end
return true
end
local function icap_parse_result(headers)
--[[
@ToDo: handle type in response
Generic Strings:
icap: X-Infection-Found: Type=0; Resolution=2; Threat=Troj/DocDl-OYC;
icap: X-Infection-Found: Type=0; Resolution=2; Threat=W97M.Downloader;
Symantec String:
icap: X-Infection-Found: Type=2; Resolution=2; Threat=Container size violation
icap: X-Infection-Found: Type=2; Resolution=2; Threat=Encrypted container violation;
Sophos Strings:
icap: X-Virus-ID: Troj/DocDl-OYC
http: X-Blocked: Virus found during virus scan
http: X-Blocked-By: Sophos Anti-Virus
Kaspersky Web Traffic Security Strings:
icap: X-Virus-ID: HEUR:Backdoor.Java.QRat.gen
icap: X-Response-Info: blocked
icap: X-Virus-ID: no threats
icap: X-Response-Info: blocked
icap: X-Response-Info: passed
http: HTTP/1.1 403 Forbidden
Kaspersky Scan Engine 2.0 (ICAP mode)
icap: X-Virus-ID: EICAR-Test-File
http: HTTP/1.0 403 Forbidden
Trend Micro Strings:
icap: X-Virus-ID: Trojan.W97M.POWLOAD.SMTHF1
icap: X-Infection-Found: Type=0; Resolution=2; Threat=Trojan.W97M.POWLOAD.SMTHF1;
http: HTTP/1.1 403 Forbidden (TMWS Blocked)
http: HTTP/1.1 403 Forbidden
F-Secure Internet Gatekeeper Strings:
icap: X-FSecure-Scan-Result: infected
icap: X-FSecure-Infection-Name: "Malware.W97M/Agent.32584203"
icap: X-FSecure-Infected-Filename: "virus.doc"
ESET File Security for Linux 7.0
icap: X-Infection-Found: Type=0; Resolution=0; Threat=VBA/TrojanDownloader.Agent.JOA;
icap: X-Virus-ID: Trojaner
icap: X-Response-Info: Blocked
McAfee Web Gateway 10/11 (Headers must be activated with personal extra Rules)
icap: X-Virus-ID: EICAR test file
icap: X-Media-Type: text/plain
icap: X-Block-Result: 80
icap: X-Block-Reason: Malware found
icap: X-Block-Reason: Archive not supported
icap: X-Block-Reason: Media Type (Block List)
http: HTTP/1.0 403 VirusFound
C-ICAP Squidclamav
icap/http: X-Infection-Found: Type=0; Resolution=2; Threat={HEX}EICAR.TEST.3.UNOFFICIAL;
icap/http: X-Virus-ID: {HEX}EICAR.TEST.3.UNOFFICIAL
http: HTTP/1.0 307 Temporary Redirect
]] --
-- Generic ICAP Headers
if headers['x-infection-found'] then
local _, _, icap_type, _, icap_threat = headers['x-infection-found']:find("Type=(.-); Resolution=(.-); Threat=(.-);$")
-- Type=2 is typical for scan error returns
if icap_type and icap_type == '2' then
lua_util.debugm(rule.name, task,
'%s: icap error X-Infection-Found: %s', rule.log_prefix, icap_threat)
common.yield_result(task, rule, icap_threat, 0,
'fail', maybe_part)
return true
elseif icap_threat ~= nil then
lua_util.debugm(rule.name, task,
'%s: icap X-Infection-Found: %s', rule.log_prefix, icap_threat)
threat_table_add(icap_threat, false)
-- stupid workaround for unuseable x-infection-found header
-- but also x-virus-name set (McAfee Web Gateway 9)
elseif not icap_threat and headers['x-virus-name'] then
threat_table_add(headers['x-virus-name'], true)
else
threat_table_add(headers['x-infection-found'], true)
end
elseif headers['x-virus-name'] and headers['x-virus-name'] ~= "no threats" then
lua_util.debugm(rule.name, task,
'%s: icap X-Virus-Name: %s', rule.log_prefix, headers['x-virus-name'])
threat_table_add(headers['x-virus-name'], true)
elseif headers['x-virus-id'] and headers['x-virus-id'] ~= "no threats" then
lua_util.debugm(rule.name, task,
'%s: icap X-Virus-ID: %s', rule.log_prefix, headers['x-virus-id'])
threat_table_add(headers['x-virus-id'], true)
-- FSecure X-Headers
elseif headers['x-fsecure-scan-result'] and headers['x-fsecure-scan-result'] ~= "clean" then
local infected_filename = ""
local infection_name = "-unknown-"
if headers['x-fsecure-infected-filename'] then
infected_filename = string.gsub(headers['x-fsecure-infected-filename'], '[%s"]', '')
end
if headers['x-fsecure-infection-name'] then
infection_name = string.gsub(headers['x-fsecure-infection-name'], '[%s"]', '')
end
lua_util.debugm(rule.name, task,
'%s: icap X-FSecure-Infection-Name (X-FSecure-Infected-Filename): %s (%s)',
rule.log_prefix, infection_name, infected_filename)
threat_table_add(infection_name, true)
-- McAfee Web Gateway manual extra headers
elseif headers['x-mwg-block-reason'] and headers['x-mwg-block-reason'] ~= "" then
threat_table_add(headers['x-mwg-block-reason'], false)
-- Sophos SAVDI special http headers
elseif headers['x-blocked'] and headers['x-blocked'] ~= "" then
threat_table_add(headers['x-blocked'], false)
elseif headers['x-block-reason'] and headers['x-block-reason'] ~= "" then
threat_table_add(headers['x-block-reason'], false)
-- last try HTTP [4]xx return
elseif headers.http and string.find(headers.http, '^HTTP%/[12]%.. [4]%d%d') then
threat_table_add(
string.format("pseudo-virus (blocked): %s", string.gsub(headers.http, 'HTTP%/[12]%.. ', '')), false)
elseif rule.use_http_3xx_as_threat and
headers.http and
string.find(headers.http, '^HTTP%/[12]%.. [3]%d%d')
then
threat_table_add(
string.format("pseudo-virus (redirect): %s",
string.gsub(headers.http, 'HTTP%/[12]%.. ', '')), false)
end
if #threat_table > 0 then
common.yield_result(task, rule, threat_table, rule.default_score, nil, maybe_part)
common.save_cache(task, digest, rule, threat_table, rule.default_score, maybe_part)
return true
else
return false
end
end
local function icap_r_respond_http_cb(err_m, data, connection)
if err_m or connection == nil then
icap_requery(err_m, "icap_r_respond_http_cb")
else
local result = tostring(data)
local icap_http_headers = result_header_table(result) or {}
-- Find HTTP/[12].x [234]xx response
if icap_http_headers.http and string.find(icap_http_headers.http, 'HTTP%/[12]%.. [234]%d%d') then
local icap_http_header_result = icap_parse_result(icap_http_headers)
if icap_http_header_result then
-- Threat found - close connection
connection:close()
else
common.save_cache(task, digest, rule, 'OK', 0, maybe_part)
common.log_clean(task, rule)
end
else
rspamd_logger.errx(task, '%s: unhandled response |%s|',
rule.log_prefix, string.gsub(result, "\r\n", ", "))
common.yield_result(task, rule, string.format('unhandled icap response: %s', icap_http_headers.icap),
0.0, 'fail', maybe_part)
end
end
end
local function icap_r_respond_cb(err_m, data, connection)
if err_m or connection == nil then
icap_requery(err_m, "icap_r_respond_cb")
else
local result = tostring(data)
local icap_headers = result_header_table(result) or {}
-- Find ICAP/1.x 2xx response
if icap_headers.icap and string.find(icap_headers.icap, 'ICAP%/1%.. 2%d%d') then
local icap_header_result = icap_parse_result(icap_headers)
if icap_header_result then
-- Threat found - close connection
connection:close()
elseif not icap_header_result
and rule.use_http_result_header
and icap_headers.encapsulated
and not string.find(icap_headers.encapsulated, 'null%-body=0')
then
-- Try to read encapsulated HTTP Headers
lua_util.debugm(rule.name, task, '%s: no ICAP virus header found - try HTTP headers',
rule.log_prefix)
connection:add_read(icap_r_respond_http_cb, '\r\n\r\n')
else
connection:close()
common.save_cache(task, digest, rule, 'OK', 0, maybe_part)
common.log_clean(task, rule)
end
elseif icap_headers.icap and string.find(icap_headers.icap, 'ICAP%/1%.. [45]%d%d') then
-- Find ICAP/1.x 5/4xx response
--[[
Symantec String:
ICAP/1.0 539 Aborted - No AV scanning license
SquidClamAV/C-ICAP:
ICAP/1.0 500 Server error
Eset:
ICAP/1.0 405 Forbidden
TrendMicro:
ICAP/1.0 400 Bad request
McAfee:
ICAP/1.0 418 Bad composition
]]--
rspamd_logger.errx(task, '%s: ICAP ERROR: %s', rule.log_prefix, icap_headers.icap)
common.yield_result(task, rule, icap_headers.icap, 0.0,
'fail', maybe_part)
return false
else
rspamd_logger.errx(task, '%s: unhandled response |%s|',
rule.log_prefix, string.gsub(result, "\r\n", ", "))
common.yield_result(task, rule, string.format('unhandled icap response: %s', icap_headers.icap),
0.0, 'fail', maybe_part)
end
end
end
local function icap_w_respond_cb(err_m, connection)
if err_m or connection == nil then
icap_requery(err_m, "icap_w_respond_cb")
else
connection:add_read(icap_r_respond_cb, '\r\n\r\n')
end
end
local function icap_r_options_cb(err_m, data, connection)
if err_m or connection == nil then
icap_requery(err_m, "icap_r_options_cb")
else
local icap_headers = result_header_table(tostring(data))
if icap_headers.icap and string.find(icap_headers.icap, 'ICAP%/1%.. 2%d%d') then
if icap_headers['methods'] and string.find(icap_headers['methods'], 'RESPMOD') then
-- Allow "204 No Content" responses
-- https://datatracker.ietf.org/doc/html/rfc3507#section-4.6
if icap_headers['allow'] and string.find(icap_headers['allow'], '204') then
add_respond_header('Allow', '204')
end
if rule.x_client_header then
local client = task:get_from_ip()
if client then
add_respond_header('X-Client-IP', client:to_string())
end
end
-- F-Secure extra headers
if icap_headers['server'] and string.find(icap_headers['server'], 'f-secure icap server') then
if rule.x_rcpt_header then
local rcpt_to = task:get_principal_recipient()
if rcpt_to then
add_respond_header('X-Rcpt-To', rcpt_to)
end
end
if rule.x_from_header then
local mail_from = task:get_principal_recipient()
if mail_from and mail_from[1] then
add_respond_header('X-Rcpt-To', mail_from[1].addr)
end
end
end
if icap_headers.connection and icap_headers.connection:lower() == 'close' then
lua_util.debugm(rule.name, task, '%s: OPTIONS request Connection: %s - using new connection',
rule.log_prefix, icap_headers.connection)
connection:close()
tcp_options.callback = icap_w_respond_cb
tcp_options.data = get_respond_query()
tcp.request(tcp_options)
else
connection:add_write(icap_w_respond_cb, get_respond_query())
end
else
rspamd_logger.errx(task, '%s: RESPMOD method not advertised: Methods: %s',
rule.log_prefix, icap_headers['methods'])
common.yield_result(task, rule, 'NO RESPMOD', 0.0,
'fail', maybe_part)
end
else
rspamd_logger.errx(task, '%s: OPTIONS query failed: %s',
rule.log_prefix, icap_headers.icap or "-")
common.yield_result(task, rule, 'OPTIONS query failed', 0.0,
'fail', maybe_part)
end
end
end
if err or conn == nil then
icap_requery(err, "options_request")
else
conn:add_read(icap_r_options_cb, '\r\n\r\n')
end
end
tcp_options.task = task
tcp_options.stop_pattern = '\r\n'
tcp_options.read = false
tcp_options.timeout = rule.timeout
tcp_options.callback = icap_callback
tcp_options.data = options_request
if rule.ssl then
tcp_options.ssl = true
if rule.no_ssl_verify then
tcp_options.no_ssl_verify = true
end
end
tcp_options.host = addr:to_string()
tcp_options.port = addr:get_port()
tcp_options.upstream = upstream
tcp.request(tcp_options)
end
if common.condition_check_and_continue(task, content, rule, digest,
icap_check_uncached, maybe_part) then
return
else
icap_check_uncached()
end
end
return {
type = { N, 'virus', 'virus', 'scanner' },
description = 'generic icap antivirus',
configure = icap_config,
check = icap_check,
name = N
}
|