From c550390d82169da0566a2ff98c89375a73f070fe Mon Sep 17 00:00:00 2001 From: jkoberg Date: Thu, 16 Mar 2023 15:52:42 +0100 Subject: [PATCH] service checklist Signed-off-by: jkoberg --- .drone.star | 1 + docs/services/antivirus/_index.md | 17 +++++++++++ docs/services/antivirus/configuration.md | 15 ++++++++++ services/antivirus/README.md | 36 ++++++++++++++++++++++++ services/antivirus/pkg/scanners/icap.go | 1 + 5 files changed, 70 insertions(+) create mode 100644 docs/services/antivirus/_index.md create mode 100644 docs/services/antivirus/configuration.md diff --git a/.drone.star b/.drone.star index 5be5c9f620..43bae81045 100644 --- a/.drone.star +++ b/.drone.star @@ -54,6 +54,7 @@ dirs = { config = { "modules": [ # if you add a module here please also add it to the root level Makefile + "services/antivirus", "services/app-provider", "services/app-registry", "services/audit", diff --git a/docs/services/antivirus/_index.md b/docs/services/antivirus/_index.md new file mode 100644 index 0000000000..764dbd11a4 --- /dev/null +++ b/docs/services/antivirus/_index.md @@ -0,0 +1,17 @@ +--- +title: Antivirus +date: 2023-03-16:00:00+00:00 +weight: 20 +geekdocRepo: https://github.com/owncloud/ocis +geekdocEditPath: edit/master/docs/services/antivirus +geekdocFilePath: _index.md +geekdocCollapseSection: true +--- + +## Abstract + +wating for readme to be approved + +## Table of Contents + +{{< toc-tree >}} diff --git a/docs/services/antivirus/configuration.md b/docs/services/antivirus/configuration.md new file mode 100644 index 0000000000..056336e97e --- /dev/null +++ b/docs/services/antivirus/configuration.md @@ -0,0 +1,15 @@ +--- +title: Service Configuration +date: 2023-03-16T00:00:00+00:00 +weight: 20 +geekdocRepo: https://github.com/owncloud/ocis +geekdocEditPath: edit/master/docs/services/antivirus +geekdocFilePath: configuration.md +geekdocCollapseSection: true +--- + +## Example YAML Config + +{{< include file="services/_includes/antivirus.yaml" language="yaml" >}} + +{{< include file="services/_includes/antivirus_configvars.md" >}} diff --git a/services/antivirus/README.md b/services/antivirus/README.md index e69de29bb2..d8f2e4139b 100644 --- a/services/antivirus/README.md +++ b/services/antivirus/README.md @@ -0,0 +1,36 @@ +# Antivirus Service + +The `antivirus` service is responsible for scanning files for viruses + +## Configuration + +### Antivirus Scanner Type + +The antivirus service currently supports `icap` and `clamav` as antivirus scanners. Use `ANTIVIRUS_SCANNER_TYPE` to configure this. +Note that configuration depends heavily on chosen antivirus scanner. See Enviroment Variable descriptions for details. + +### Maximum Scan size + +Since several factors might make need necessary to limit the maximum filesize the `antivirus` service has an option to set a max scan size. +Use `ANTIVIRUS_MAX_SCAN_SIZE` to scan only that amount of bytes of a file. Obviously it is recommended to set this as high as possible, but several factors (scanner type and version, bandwith and performance issues, ...) might force to set this to a certain filesize. + +### Infected File Handling + +The `antivirus` service allows three different ways of handling infected files. Those can be set via the `ANTIVIRUS_INFECTED_FILE_HANDLING` envvar: + - `delete` (default): Infected files will be deleted immediately. Further postprocessing is cancelled. + - `abort`: Infected files will be kept. Further postprocessing is cancelled. Files can be manually retrieved and inspected by an admin. (Advanced option) + - `continue`: Infected files will be marked as infected but postprocessing continues normally. Note: Infected Files are not prevented from download. Risk of spreading viruses. (Obviously not recommended) + +## Operation Modes + +The `antivirus` service can scan files during postprocessing. `on demand` scanning will be added in the future. + +### Postprocessing + +Note: Needs to be configured via the [postprocessing service](https://github.com/owncloud/ocis/tree/master/services/postprocessing) + +The `antivirus` service will scan files during postprocessing. It listens for a postprocessing step called `"virusscan"` + +### On Demand + +On demand scanning is currently not supported diff --git a/services/antivirus/pkg/scanners/icap.go b/services/antivirus/pkg/scanners/icap.go index 7b426c0326..c0b2a8745c 100644 --- a/services/antivirus/pkg/scanners/icap.go +++ b/services/antivirus/pkg/scanners/icap.go @@ -54,6 +54,7 @@ func (s ICAP) Scan(file io.Reader) (ScanResult, error) { return sr, err } + // TODO: make header configurable. See oc10 documentation: https://doc.owncloud.com/server/10.12/admin_manual/configuration/server/virus-scanner-support.html if data, infected := resp.Header["X-Infection-Found"]; infected { sr.Infected = infected re := regexp.MustCompile(`Threat=(.*);`)