direction

HTTP message type:

•request—an HTTP request.

•response—an HTTP response.

String

icap

Information about ICAP request headers.

ICAP Table

request

Information about HTTP request headers.

Request Table

response

Information about HTTP request headers.

Response Table

body

Information about the HTTP message body.

Body Table

Overridden metamethods: None

user

Information about the user obtained from the X-Client-Username header of the ICAP request.

User Table

src

IP address of a client who sent the request (the address is contained in the X-Client-IP header of the ICAP request from the proxy server), or nil, if the address is unknown.

IpAddress Table

field

Array of ICAP request headers.

Array of HeaderField tables

search

Function for searching a header by a regular expression. It accepts one mandatory argument—patterns—search patterns, i.e. one (string) or several (array of strings) regular expressions in the Perl syntax (PCRE). The search is performed in all available headers.

Returns a Boolean value:

•true—if the field.name .. ": " .. field.value.decoded string matches at least one of the specified regular expressions for at least one of the headers;

•false—if no matches have been found.

Function

value

Function that accepts one mandatory argument—the header name (string). It returns the value of the first header with the specified name or nil, if there is no header with this name.

Function

Overridden metamethods: None

user

User name

String

domain

User domain

String

Overridden metamethods:

•__tostring—function that returns the User content as a string (in the UTF-8 encoding);

•__concat—function that concatenates the User string value and another string.

name

Header name

String

value

Header value

String

Overridden metamethods: None

method

HTTP protocol method used in the request (for example, POST) or nil, if the ICAP request does not contain the HTTP request header.

String

url

URL of the resource at which the HTTP request is sent.

Url Table

content_type

Information from the Content-Type header of the HTTP request.

ContentType Table

field

Array of HTTP request headers.

Array of HeaderField tables

search

Function for searching a header by a regular expression. It accepts one mandatory argument—patterns—search patterns, i.e. one (string) or several (array of strings) regular expressions in the Perl syntax (PCRE). The search is performed in all available headers.

Returns a Boolean value:

•true—if the field.name .. ": " .. field.value.decoded string matches at least one of the specified regular expressions for at least one of the headers;

•false—if no matches have been found.

Function

value

Function that accepts one mandatory argument—the header name (string). It returns the value of the first header with the specified name or nil, if there is no header with this name.

Function

Overridden metamethods: None

type

MIME type of the message part

String

subtype

Subtype of the message part

String

param

Header parameters in the form of a table array with the following fields:

•name is the name of a parameter (string);

•value is the value of a parameter (string).

Table array

match

Function that accepts one mandatory argument—media_types, which is an array of strings describing MIME types. Each string in the list must be formatted as follows: "type/subtype", "type/*" or "*/*".

Returns a Boolean value:

•true—if the MIME type of the body matches any of the specified strings (case-insensitively), or the passed array contains the "*/*" string;

•false—if no matches have been found.

Function

Overridden metamethods:

•__tostring—function that returns the decoded header value;

•__concat—function that concatenates the decrypted value of the header and a string.

scheme

Scheme (protocol) prefix, for example, http. If absent, the value is nil.

String

host

Host name or IP address, for example, example.com. If absent, the value is nil.

String

port

Port number, for example, 80. If absent, the value is nil.

Number

path

Path to a resource, for example, index.html. If absent, the value is nil.

String

query

Decoded request parameters. If absent, the value is nil.

String

legal_url

If the URL belongs to the owners_notice category, the field contains a URL of the owner’s website; otherwise, it is nil.

String

in_list

Function that accepts one mandatory argument—hosts, i.e. the host list (an array of strings). It returns a Boolean value:

•true—if host is a subdomain of one of the specified domains or matches one of them;

•false—if no matches have been found.

Function

categories

Function that accepts one optional argument—filter, i.e. the UrlCategoryFilter table (no argument is equivalent of using an empty table). It returns an iterator function using which you can iterate over all categories that meet the conditions specified by filter and to which URL relates.

Function

in_categories

Function that accepts one mandatory argument—categories, i.e. the URL category list (an array of strings). It returns a Boolean value:

•true—if the URL belongs to at least one of the specified categories;

•false—if the URL does not belong to any of the categories.

If the categories array is empty, false is always returned. See the possible category values in the description of the category field in the UrlCategoryFilter table.

Function

raw

Raw undecoded URL.

RawUrl Table

Overridden metamethods:

•__tostring—function that returns the Url content as a string (in the UTF-8 encoding);

•__concat—function that concatenates the Url string value and another string.

scheme

Scheme (protocol) prefix, for example, http. If absent, the value is nil.

String

host

Host name or IP address, for example, example.com. If absent, the value is nil.

String

port

Port number, for example, 80. If absent, the value is nil.

Number

path

Path to a resource, for example, index.html. If absent, the value is nil.

String

query

Decoded request parameters. If absent, the value is nil.

String

Overridden metamethods:

•__tostring—function that returns the RawUrl content as a string (in the UTF-8 encoding);

•__concat—function that concatenates the RawUrl string value and another string.

category

List of categories that the URL must match (case-insensitive):

•infection_source—infection source;

•not_recommended—source that is not recommended for visiting;

•adult_content—adult content;

•violence—violence;

•weapons—weapons;

•gambling—gambling;

•drugs—drugs;

•obscene_language—obscene language;

•chats—chats;

•terrorism—terrorism;

•free_email—free email;

•social_networks—social networks;

•owners_notice—websites added due to a notice from a copyright owner;

•online_games—online games;

•anonymizers—anonymizers;

•cryptocurrency_mining_pools—cryptocurrency mining pools;

•jobs—job search websites;

•black_list—black list.

String or table of strings

category_not

List of categories that the URL must not match (case-insensitive).

String or table of strings

Overridden metamethods: None

status

HTTP response code or nil, if the ICAP request does not contain the HTTP response header.

Number

reason

Comment to the response code or nil if absent.

String

content_type

Contains information obtained from the Content-Type header of the HTTP response.

ContentType Table

field

Array of HTTP response headers

Array of HeaderField tables

search

Function for searching a header by a regular expression. It accepts one mandatory argument—patterns—search patterns, i.e. one (string) or several (array of strings) regular expressions in the Perl syntax (PCRE). The search is performed in all available headers.

Returns a Boolean value:

•true—if the field.name .. ": " .. field.value.decoded string matches at least one of the specified regular expressions for at least one of the headers;

•false—if no matches have been found.

Function

value

Function that accepts one mandatory argument—the header name (string). It returns the value of the first header with the specified name or nil, if there is no header with this name.

Function

Overridden metamethods: None

has_threat

Function that accepts one optional argument—filter, i.e. the ThreatFilter table (the absence of an argument is equivalent to using an empty table). It returns a Boolean value:

•true—if the HTTP message body contains a threat that meets the specified filter condition;

•false—if no matches have been found.

Function

threats

Function that accepts one optional argument—filter, i.e. the ThreatFilter table (the absence of the argument is equivalent to using an empty table). It returns an iterator function using which you can iterate over all threats detected in the HTTP message body. The threats are described using the Virus table.

Function

content_type

Contains information on the MIME type of the body obtained from the Content-Type header of the HTTP request or response (depending on the type of the message being analyzed).

ContentType Table

scan_error

Body scanning error, if occurred, nil otherwise. Allowed values:

•path_not_absolute—the specified path is not absolute;

•file_not_found—the file has not been found;

•file_not_regular—the file is not regular;

•file_not_block_device—not a block device;

•name_too_long—the name is too long;

•no_access—access is denied;

•read_error—a reading error has occurred;

•write_error—a writing error has occurred;

•file_too_large—the file is too large;

•file_busy—the file is being used;

•unpacking_error—an unpacking error has occurred;

•password_protected—the archive is password-protected;

•arch_crc_error—an archive CRC error;

•arch_invalid_header—an invalid archive header;

•arch_no_memory—not enough memory to unpack the archive;

•arch_incomplete—the archive is incomplete;

•can_not_be_cured—the file cannot be cured;

•packer_level_limit—the packed object nesting level limit has been exceeded;

•archive_level_limit—the archive nesting level limit has been exceeded;

•mail_level_limit—the mail file nesting level limit has been exceeded;

•container_level_limit—the container nesting level limit has been exceeded;

•compression_limit—the compression rate limit has been exceeded;

•report_size_limit—the report size limit has been exceeded;

•scan_timeout—the scanning timeout limit has been exceeded;

•engine_crash—a scanning engine failure;

•engine_hangup—a scanning engine hangup;

•engine_error—a scanning engine error;

•no_license—no active license has been found;

•multiscan_too_late—a multiscanning error has occurred;

•curing_limit_reached—the limit of curing attempts has been exceeded;

•non_supported_disk—a disk type is not supported;

•unexpected_error—an unexpected error.

String

Overridden metamethods: None

name

Threat name (according to the Doctor Web classification)

String

type

Threat type (according to the Doctor Web classification). Allowed values:

•known_virus—a known threat (i.e., a threat that is covered by virus databases);

•virus_modification—a modification of the known threat;

•unknown_virus—an unknown threat, a suspicious object;

•adware—adware;

•dialer—a dialer program;

•joke—a joke program;

•riskware—a potentially dangerous program;

•hacktool—a hacktool.

String

Overridden metamethods: None

category

List of categories that the threat must match (case-insensitive). See the list of categories in description of the type field of the Virus table.

String or table of strings

category_not

List of categories that the threat cannot match (case-insensitive).

String or table of strings

Overridden metamethods: None

drweb

Module that provides functions for writing messages from the Lua program to the log of the Dr.Web Gateway Security Suite component which has started the Lua program, as well as the means to run Lua procedures asynchronously

drweb.lookup

Module that provides tools to query data from external sources using the Dr.Web LookupD module

drweb.regex

Module that provides an interface to match strings with regular expressions

drweb.config

Module that provides a table with the Dr.Web ICAPD configuration parameter values

wait

Function that returns a result of the function started using the async function. If the function has not completed its execution yet, it waits for the completion and returns its result. If the function is completed before wait is called, the result is returned immediately. If the started function fails, the wait call generates the same error.

Function

Overridden metamethods: None

belongs

Function checks an IP address stored in the IpAddress table for belonging to specified subnets (IP address ranges).

Accepts a single argument—an array of strings such as <IP address> or <IP address>/<mask>, where <IP address> is a host address or a network address (for example, 127.0.0.1), and <mask> is a subnet mask (can be specified as an IP address, for example, 255.0.0.0, or as an integer, for example, 8).

Returns a Boolean value:

•true indicates that the address matches at least one of the specified IP addresses or belongs to at least one of the specified subnets (a range of IP addresses);

•false—if the address does not match any one of the specified IP addresses or does not belong to any of the specified subnets

Function

Overridden metamethods:

•__tostring is a function that transforms IpAddress into a string, for example, 127.0.0.1 (IPv4) or ::1 (IPv6);

•__concat is a function that joins IpAddress to a string;

•__eq is a function that checks whether two IpAddress are equal;

•__band is a function that allows applying a mask, for example: dw.ip('192.168.1.2') & dw.ip('255.255.254.0')

whitelist

Value of the Whitelist configuration parameter.

String array

blacklist

Value of the Blacklist configuration parameter.

String array

adlist

Value of the Adlist configuration parameter.

String array

block_url_categories

List of blocked URL categories (based on the Block* parameter values set to Yes).

String array

block_threats

List of blocked threat categories (based in Block* parameter values, set to Yes).

String array

block_unchecked

Value of the BlockUnchecked configuration parameter.

Logical

Overridden metamethods: None