LogLevel

{logging level}

Logging level of the component.

If a parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Component executable path.

Default value:

•for GNU/Linux: /opt/drweb.com/bin/drweb-icapd

•for FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-icapd

RunAsUser

{UID | user name}

User on behalf of whom the component is started. Either a numerical UID of the user or a user name (login) can be specified. If the user name consists of numbers (that is, the name is similar to a numerical UID), it must be specified with the “name:” prefix, for example: RunAsUser = name:123456.

If the user name is not specified, the component shuts down with an error upon startup.

Default value: drweb

Start

{logical}

The component is started by the Dr.Web ConfigD configuration management daemon.

Setting the value of this parameter to Yes instructs the configuration daemon to start the component immediately, and setting the value of this parameter to No—to shut down the component immediately.

Default value: No

DebugDumpIcap

{logical}

Log or do not log messages transmitted via ICAP at the debug level (with LogLevel = DEBUG).

Default value: No

ListenAddress

{network socket}

Network socket (IP address and port) listened by Dr.Web ICAPD for connections from HTTP proxy servers.

Default value: 127.0.0.1:1344

UsePreview

{logical}

Enable or disable an ICAP preview mode for Dr.Web ICAPD.

Do not change the value of this parameter unless necessary.

Default value: Yes

Use204

{logical}

Return response code 204 not only in ICAP preview mode.

Do not change the value of this parameter unless necessary.

Default value: Yes

AllowEarlyResponse

{logical}

Allow or do not allow Dr.Web ICAPD to use an ICAP early response mode, that is, start sending a response to the client before the entire request has been received from the HTTP proxy server.

Do not change the value of this parameter unless necessary.

Default value: Yes

TemplatesDir

{path to directory}

Path to a directory with the templates for the HTML notifications sent upon blocking a web resource.

Default value:

•for GNU/Linux: /var/opt/drweb.com/templates/icapd

•for FreeBSD: /var/drweb.com/templates/icapd

Whitelist

{domain list}

White list of domains. All domains included in this list will be accessible to users even if belonging to unwanted web resource categories. All subdomains of these domains will also be accessible.

The values of the list must be comma-separated (each value put in quotation marks). The parameter can be specified more than once in the section (in this case, all parameter values are combined into one list).

Example: Add example.com and example.net domains to the list.

1.Adding values to the configuration file.

•Two values per line:

•Two lines (one value per line):

2.Adding values with the drweb-ctl cfset command:

Default value: (not specified)

Blacklist

{domain list}

Black list of domains. All domains included in this list will not be accessible to users even if not belonging to unwanted web resource categories. All subdomains of these domains will also be blocked.

The values of the list must be comma-separated (each value put in quotation marks). The parameter can be specified more than once in the section (in this case, all parameter values are combined into one list).

Example: Add example.com and example.net domains to the list.

1.Adding values to the configuration file.

•Two values per line:

•Two lines (one value per line):

2.Adding values with the drweb-ctl cfset command:

Default value: (not specified)

Adlist

{list of strings}

List of regular expressions covering websites. A URL that matches any of the regular expressions from this list is considered to be the advertising URL.

The values of the list must be comma-separated (each value put in quotation marks). The parameter can be specified more than once in the section (in this case, all parameter values are combined into one list).

Example: Add the '.*ads.+' and '.*/ad/.*\.gif$' expressions to the list.

1.Adding values to the configuration file.

•Two values per line:

•Two lines (one value per line):

2.Adding values with the drweb-ctl cfset command:

Regular expressions are specified using either the POSIX syntax (BRE or ERE) or the Perl syntax (PCRE or PCRE2).

Default value: (not specified)

BlockInfectionSource

{logical}

Block attempts to connect to websites containing malware (belonging to the InfectionSource category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockNotRecommended

{logical}

Block attempts to connect to non-recommended websites (belonging to the NotRecommended category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockAdultContent

{logical}

Block attempts to connect to websites containing adult content (belonging to the AdultContent category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockViolence

{logical}

Block attempts to connect to websites containing graphic violence (belonging to the Violence category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockWeapons

{logical}

Block attempts to connect to websites dedicated to weapons (belonging to the Weapons category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockGambling

{logical}

Block attempts to connect to gambling websites (belonging to the Gambling category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockDrugs

{logical}

Block attempts to connect to websites dedicated to drugs (belonging to the Drugs category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockObsceneLanguage

{logical}

Block attempts to connect to websites with obscene language (belonging to the ObsceneLanguage category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockChats

{logical}

Block attempts to connect to chat websites (belonging to the Chats category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockTerrorism

{logical}

Block attempts to connect to websites dedicated to terrorism (belonging to the Terrorism category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockFreeEmail

{logical}

Block attempts to connect to websites of free email services (belonging to the FreeEmail category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockSocialNetworks

{logical}

Block attempts to connect to social networking websites (belonging to the SocialNetworks category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockDueToCopyrightNotice

{logical}

Block attempts to connect to websites that were added at the request of a copyright holder (belonging to the DueToCopyrightNotice category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockOnlineGames

{logical}

Block attempts to connect to online gaming websites (belonging to the OnlineGames category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockAnonymizers

{logical}

Block attempts to connect to anonymizer websites (belonging to the Anonymizers category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockCryptocurrencyMiningPools

{logical}

Block attempts to connect to websites combining users to mine cryptocurrencies (belonging to the CryptocurrencyMiningPool category).

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockJobs

{logical}

Block attempts to connect to job search websites (belonging to the Jobs category).

To enable blocking, the settings must contain the following rule (see below):

Default value: No

ScanTimeout

{time interval}

Timeout for scanning one file at the request of Dr.Web ICAPD.

Allowed values: from 1 second (1s) to 1 hour (1h).

Default value: 30s

HeuristicAnalysis

{On | Off}

Enable or disable the heuristic analysis for detection of unknown threats. The heuristic analysis provides higher detection reliability but increases the duration of scanning.

An action applied to threats detected by the heuristic analyzer is defined by the BlockSuspicious parameter.

Allowed values:

•On—enable the heuristic analysis while scanning;

•Off—disable the heuristic analysis.

Default value: On

PackerMaxLevel

{integer}

Maximum nesting level for packed objects. A packed object is executable code compressed with special software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects that may also include packed objects and so on. The value of this parameter specifies the nesting limit beyond which packed objects inside other packed objects are not scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

ArchiveMaxLevel

{integer}

Maximum nesting level for archives (.zip, .rar and so on) in which other archives may be enclosed, whereas these archives may also include other archives and so on. The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives are not scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 0

MailMaxLevel

{integer}

Maximum nesting level for files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects are not scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 0

ContainerMaxLevel

{integer}

Maximum nesting level while scanning other types of objects containing nested objects (HTML pages, .jar files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

MaxCompressionRatio

{integer}

Maximum compression ratio of compressed/packed objects (a ratio between a compressed size and an uncompressed size). If the ratio for an object exceeds the limit, this object is skipped during the data scanning initiated by Dr.Web ICAPD.

The compression ratio must be no less than 2.

Default value: 500

BlockKnownVirus

{logical}

Block incoming and outgoing data if it contains a known threat.

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockSuspicious

{logical}

Block incoming and outgoing data if it contains an unknown threat detected by the heuristic analyzer.

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockAdware

{logical}

Block incoming and outgoing data if it contains adware.

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockDialers

{logical}

Block incoming and outgoing data if it contains a dialer.

To enable blocking, the settings must contain the following rule (see below):

Default value: Yes

BlockJokes

{logical}

Block incoming and outgoing data if it contains a joke program.

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockRiskware

{logical}

Block incoming and outgoing data if it contains riskware.

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockHacktools

{logical}

Block incoming and outgoing data if it contains a hack tool.

To enable blocking, the settings must contain the following rule (see below):

Default value: No

BlockUnchecked

{logical}

Block incoming and outgoing data if it cannot be scanned.

Default value: No

MessageHook

{path to file | Lua function}

Script for processing HTTP messages in the Lua language or a path to the script file (see the HTTP Message Processing in Lua section).

If the Lua function or the file path are not specified, the messages will be processed in accordance with the rules. If the specified file is not available, the component will fail to start.

Default value: Generated automatically. In case of default settings, the script is as follows:

local dw = require "drweb"
local cfg = require "drweb.config"
local dwl = require "drweb.lookup"
local rx = require "drweb.regex"

function message_hook(ctx)
  if ctx.direction == "request" then
    local url = ctx.request.url
    if url.in_list(cfg.blacklist) then
      return "block"
    end
    if not url.in_list(cfg.whitelist) then
      if rx.search(cfg.adlist, url) or rx.search(cfg.adlist, url.raw) then
          return "block"
      end
      if url.in_categories(cfg.block_url_categories) then
          return "block"
      end
    end
  end
  if ctx.body.has_threat{category = cfg.block_threats} then
    return "block"
  end
  if cfg.block_unchecked and ctx.body.scan_error then
    return "block"
  end
  return "pass"
end