LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Executable path to the component.

Default value: <opt_dir>/bin/drweb-icapd.

•For GNU/Linux: /opt/drweb.com/bin/drweb-icapd.

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-icapd

RunAsUser

{UID | user name}

The parameter determines the user on behalf of which user the component shoud be run. You can specify either the user's UID or login. If the login consists of numbers and cannot be distinguished fro, the UID, it is preceded with the “name:” prefix, for example: RunAsUser = name:123456.

If the username is not specified, the component terminates with an error after the startup.

Default value: drweb

Start

{Boolean}

Launch/do not launch the component by the Dr.Web ConfigD configuration daemon.

When you specify the Yes value for this parameter, it the configuration daemon will start the component immediately; and when you specify the No value, the configuration daemon will terminate the component immediately.

Default value: No

DebugDumpIcap

{Boolean}

Include detailed ICAP messages into the log file on the debug level (i.e. when you set LogLevel = DEBUG).

Default value: No

ListenAddress

{network socket}

Specifies the network socket (IP address and port) on which Dr.Web ICAPD listens for connections from HTTP proxy servers.

Default value: 127.0.0.1:1344

UsePreview

{Boolean}

Enable/disable the ICAP preview mode.

Do not change the default value of this parameter, unless it is necessary.

Default value: Yes

Use204

{Boolean}

Return the response code 204 if ICAP preview mode is not enabled.

Do not change the default value of this parameter, unless it is necessary.

Default value: Yes

AllowEarlyResponse

{Boolean}

Enable the ICAP early response mode, i.e. allow Dr.Web ICAPD to send the response to the client before the entire request has been received from the HTTP proxy server.

Do not change the default value of this parameter, unless it is necessary.

Default value: Yes

TemplatesDir

{path to directory}

Path to the directory that contains the templates for the HTML notifications sent upon blocking a web resource.

Default value: <var_dir>/templates/icapd.

•For GNU/Linux: /var/opt/drweb.com/templates/icapd.

•For FreeBSD: /var/drweb.com/templates/icapd

Whitelist

{domain list}

White list of domains. The domains (as well as their subdomains) included in this list will always be accessible to users even if included in unwanted resource list.

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding values to the configuration file.

•Two values per line:

•Two lines (a value per line):

2.Adding values via the drweb-ctl cfset command:

Default value: (not set)

Blacklist

{domain list}

Black list of domains. The domains (as well as their subdomains) included in this list will always be accessible to users even if included in unwanted resource list.

The values in the list are separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding values to the configuration file.

•Two values in a line:

•Two lines (a value per line):

2.Adding values via the drweb-ctl cfset command:

Default value: (not set)

Adlist

{list of strings}

A list of regular expressions that describe advertisement URLs: URL that matches any of the regular expressions listed here is considered to be an advertisement URL.

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list the following expressions '.*ads.+' and '.*/ad/.*\.gif$'.

1.Adding values to the configuration file.

•Two values in a line:

•Two lines (a value per line):

2.Adding values via the drweb-ctl cfset command:

Regular expressions are specified using either the POSIX syntax (BRE, ERE) or the Perl syntax (PCRE, PCRE2).

Default value: (not set)

BlockInfectionSource

{Boolean}

Block connections attempts to websites containing malicious software (included into the InfectionSource category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockNotRecommended

{Boolean}

Block connection attempts to non-recommended websites (included into the NotRecommended category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockAdultContent

{Boolean}

Block connection attempts to websites containing adult content (included into the AdultContent category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockViolence

{Boolean}

Block connection attempts to websites containing graphic violence (included into the Violence category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockWeapons

{Boolean}

Block connection attempts to websites dedicated to weapons (included into the Weapons category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockGambling

{Boolean}

Block connection attempts to gambling websites (included into the Gambling category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockDrugs

{Boolean}

Block connection attempts to websites dedicated to drugs (included into the Drugs category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockObsceneLanguage

{Boolean}

Block connection attempts to websites containing obscene language (included into the ObsceneLanguage category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockChats

{Boolean}

Block connection attempts to chat websites (included into the Chats category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockTerrorism

{Boolean}

Block connection attempts to websites dedicated to terrorism (included into the Terrorism category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockFreeEmail

{Boolean}

Block connection attempts to websites of free email services (included into the FreeEmail category).

To activate blocking, add the following rule to the settings (see the details below):

Default value: No

BlockSocialNetworks

{Boolean}

Block connection attempts to social networking websites (included into the SocialNetworks category).

To enable blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockDueToCopyrightNotice

{Boolean}

Block connection attempts to websites that were added according to copyright holder requests (included into the DueToCopyrightNotice category).

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockOnlineGames

{Boolean}

Block connection attempts to Online games websites (included into OnlineGames category).

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockAnonymizers

{Boolean}

Block connection attempts to anonymizers (included into Anonymizers category).

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockCryptocurrencyMiningPools

{Boolean}

Block connection attempts to websites providing an access to common services for cryptocurrencies mining (included into CryptocurrencyMiningPool category).

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockJobs

{Boolean}

Block connection attempts to job search websites (included into Jobs category).

To enable blocking, add the following rule to the settings (see the details below):

Default value: No

ScanTimeout

{time interval}

Time-out for scanning one file initiated by Dr.Web ICAPD.

Acceptable values: from 1 second (1s) to 1 hour (1h).

Default value: 30s

HeuristicAnalysis

{On | Off}

Enable/disable heuristic analysis for detection of unknown threats during. The use of heuristic analysis raises the level of protection, but increases the duration of scanning.

Action applied to threats detected by the heuristic analyzer is specified as the BlockSuspicious parameter value.

Allowed values:

•On—enable heuristic analysis;

•Off—disable heuristic analysis.

Default value: On

PackerMaxLevel

{integer}

Maximum nesting level for packed objects. A packed object is executable code compressed with special software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects. etc. he value of this parameter specifies the nesting limit beyond which packed objects inside other packed objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

ArchiveMaxLevel

{integer}

Maximum nesting level for archives (zip, rar, and so on) in which other archives may be enclosed (and these archives may also include other archives, and so on). The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 0

MailMaxLevel

{integer}

Maximum nesting level for files of mailers (pst, tbb and so on) in which other files may be enclosed (and these files may also include other files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 0

ContainerMaxLevel

{integer}

Maximum nesting level for other types of objects inside which other objects are enclosed (HTML pages, jar-files, etc.). The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

MaxCompressionRatio

{integer}

Maximum compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio for an object exceeds the limit, this object is skipped during data scanning initiated by Dr.Web ICAPD.

The compression ratio must not be smaller than 2.

Default value: 500

BlockKnownVirus

{Boolean}

Block either incoming or outgoing data containing known threats.

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockSuspicious

{Boolean}

Block either incoming or outgoing data containing unknown threats (detected by the heuristic analyzer).

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockAdware

{Boolean}

Block either incoming or outgoing data containing adware.

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockDialers

{Boolean}

Block either incoming or outgoing data containing dialer programs.

To enable blocking, add the following rule to the settings (see the details below):

Default value: Yes

BlockJokes

{Boolean}

Block either incoming or outgoing data containing joke programs.

To enable blocking, add the following rule to the settings (see the details below):

Default value: No

BlockRiskware

{Boolean}

Block either incoming or outgoing data containing riskware.

To enable blocking, add the following rule to the settings (see the details below):

Default value: No

BlockHacktools

{Boolean}

Block either incoming or outgoing data containing hacktools.

To enable blocking, add the following rule to the settings (see the details below):

Default value: No

BlockUnchecked

{Boolean}

Block either incoming or outgoing data that cannot be scanned.

Default value: No

MessageHook

{path to file | Lua function}

Script for processing HTTP messages in Lua or path to the file containing the script (see the HTTP Messages Processing in Lua section).

If the Lua function or the file path are not specified, the messages will be processed in accordance with the rules. If the specified file is not available, the component launch will return an error.

Default value: Generated automatically. For default settings, the script looks as following:

local dw = require "drweb"
local cfg = require "drweb.config"
local dwl = require "drweb.lookup"
local rx = require "drweb.regex"

function message_hook(ctx)
  if ctx.direction == "request" then
    local url = ctx.request.url
    if url.in_list(cfg.blacklist) then
      return "block"
    end
    if not url.in_list(cfg.whitelist) then
      if rx.search(cfg.adlist, url) or rx.search(cfg.adlist, url.raw) then
          return "block"
      end
      if url.in_categories(cfg.block_url_categories) then
          return "block"
      end
    end
  end
  if ctx.body.has_threat{category = cfg.block_threats} then
    return "block"
  end
  if cfg.block_unchecked and ctx.body.scan_error then
    return "block"
  end
  return "pass"
end