Integration with Squid Proxy Server

In this section

Configuring Dr.Web ICAPD

To integrate Dr.Web ICAPD with a Squid HTTP proxy server, you will need to review the current values of parameters in the Dr.Web ICAPD settings section (the [ICAPD] section) and change them if necessary:

•In the ListenAddress parameter, specify the address of the network socket (<IP address>:<port>) that will be listened to by Dr.Web ICAPD waiting for connections from an HTTP proxy server (by default, socket 127.0.0.1:1344 is used).

•In the Block* settings, enable or disable categories of websites and threat types that Dr.Web ICAPD should block or allow.

•If required, specify the list of websites to be blocked as the value of the BlackList parameter. The value of the WhiteList parameter specifies the list of websites that should not be blocked.

The BlackList parameter takes precedence over WhiteList. If the same domain is specified by both parameters, it will be blocked.

•To configure access to websites in depth (on the basis of various conditions), edit the traffic monitoring rules.

The default values of the UsePreview, Use204 and AllowEarlyResponse parameters in the Dr.Web ICAPD settings section allow the component to use the corresponding features of the Internet Content Adaptation Protocol (ICAP) (i.e. allow it to use the ICAP preview mode, to return the 204 status code not only in ICAP preview mode, and to start sending an “early” response before the entire request has been received from the proxy server). It is recommended that you do not change the default values if no issues with HTTP request processing occur.

After all settings are adjusted, restart Dr.Web Gateway Security Suite with the command:

# drweb-ctl reload

You can also restart Dr.Web Gateway Security Suite by restarting the Dr.Web ConfigD configuration management daemon using the command:

# service drweb-configd restart

Configuring Squid

To enable the interaction between Squid and Dr.Web ICAPD, edit the squid.conf configuration file (usually located in the /etc/squid3/ directory) to enable ICAP. To integrate ICAP with Dr.Web Gateway Security Suite, proceed as follows:

1.Enablе the ICAP in the settings of Squid.

2.Register Dr.Web ICAPD as the ICAP service for Squid.

3.Enable the ICAP preview mode (optionally).

4.Allow transferring the client data (i.e. the IP address and the user name of a user who has passed authentication at the proxy server) for using in the rules of Dr.Web ICAPD (optionally).

5.Enable the support of persistent connections between Dr.Web ICAPD and Squid (optional; though enabling persistent connections is not necessary, it increases the performance of Squid operating together with Dr.Web ICAPD).

•To make Squid check HTTP requests (REQMOD) and HTTP responses (RESPMOD) via ICAP, add two ICAP services of the corresponding types.

•To make Squid use Dr.Web ICAPD as an ICAP service, the address and the port specified in icap_service must match the address and the port specified by the ListenAddress parameter in the Dr.Web ICAPD settings.

•Dr.Web ICAPD will not work with Squid if the icap_preview_size parameter value is not 0.

•The IP address and the username are generated by Squid itself and sent to Dr.Web ICAPD in an ICAP request in X-Client-Username and X-Client-IP headers. The values of these headers must be encoded by the methods used in Squid by default. The settings of Squid that affect the encoding methods (icap_client_username_encode and icap_client_username_header) should not be modified.

To integrate with Dr.Web Gateway Security Suite, Squid should be built with ICAP support (that is, compiled with the --enable-icap-client option). Otherwise, it is not possible to establish the connection between Squid and Dr.Web ICAPD.

To use HTTPS, Squid must be built with the support of SSL certificates (that is, compiled with the --with-openssl and --enable-ssl-crtd options). Squid settings must have SSL bumping enabled.

Settings for different Squid versions can differ. This section provides three configuration variants for the following Squid versions: 3.2 and earlier, 3.1 and 3.0. Edit your Squid configuration file according to the examples.
If the lines from the examples below are commented out in your configuration file, uncomment them. If the lines from the examples are absent, add them to your configuration file.

Only the parameters from sections #1 and #2 are obligatory for configuring the interaction between Dr.Web ICAPD and Squid. The parameters from sections #3 and #4 are optional.

For Squid 3.2 and later

#1
icap_enable on

#2
icap_service i_req reqmod_precache bypass=0 icap://127.0.0.1:1344/reqmod
icap_service i_res respmod_precache bypass=0 icap://127.0.0.1:1344/respmod

adaptation_access i_req allow all
adaptation_access i_res allow all

#3
icap_preview_enable on
icap_preview_size 0

#4 (in Squid 3.2, the icap_send_client_ip and icap_send_client_username parameters have been renamed)
adaptation_send_client_ip on
adaptation_send_username on

#5
icap_persistent_connections on

For Squid 3.1

#1
icap_enable on

#2 (in Squid 3.1, the format used to configure a service has been changed and the icap_access parameter has been renamed)
icap_service i_req reqmod_precache bypass=0 icap://127.0.0.1:1344/reqmod
icap_service i_res respmod_precache bypass=0 icap://127.0.0.1:1344/respmod

adaptation_access i_req allow all
adaptation_access i_res allow all

#3
icap_preview_enable on
icap_preview_size 0

#4
icap_send_client_ip on
icap_send_client_username on

#5
icap_persistent_connections on

For Squid 3.0

#1
icap_enable on

#2
icap_service i_req reqmod_precache 0 icap://127.0.0.1:1344/reqmod
icap_service i_res respmod_precache 0 icap://127.0.0.1:1344/respmod

icap_class icapd_class_req i_req
icap_class icapd_class_resp i_res

icap_access icapd_class_req allow all
icap_access icapd_class_resp allow all

#3
icap_preview_enable on
icap_preview_size 0

#4
icap_send_client_ip on
icap_send_client_username on

#5
icap_persistent_connections on

Restart Squid after editing the configuration file and saving the changes.

Advanced Squid Settings: Data Size Restrictions

If necessary, you can limit the size of data that Squid sends for scanning via ICAP. To do this, specify a specific data size in bytes or a regular expression in the configuration file the value of the Content-Length header, for example:

acl <name> rep_header Content-Length ^[0-9]{7,}$

In this example the condition <name> is observed if the Content-Length header value is greater than 999999.

The condition from the example above can be used to allow (allow) or deny (deny) scanning of the server response via ICAP (replace all with the condition name <name> in Squid connection parameters).
The following example shows the settings used to deny scanning of responses for which the condition <name> is observed:

#Squid 3.1 and later
adaptation_access i_res deny <name>

#Squid 3.0 and later
icap_access icapd_class_resp deny <name>

The Content-Length header can be absent in the web server response. In this case, the settings provided above will not be applied.

The detailed information on configuring the restrictions for web traffic monitoring in Squid can be found in the official documentation.

Restart Squid to apply changes.