-
Notifications
You must be signed in to change notification settings - Fork 180
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
enhancement: Support Skyhigh Security ICAP as an ICAP server
- Loading branch information
Showing
10 changed files
with
330 additions
and
21 deletions.
There are no files selected for viewing
7 changes: 7 additions & 0 deletions
7
changelog/unreleased/enhancement-skyhigh-security-icap-support.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| Enhancement: Support Skyhigh Security ICAP as an ICAP server | ||
|
|
||
| We have upgraded the antivirus ICAP client library, bringing enhanced performance and reliability to our antivirus scanning service. | ||
| With this update, the Skyhigh Security ICAP can now be used as an ICAP server, providing robust and scalable antivirus solutions. | ||
|
|
||
| https://github.com/owncloud/ocis/issues/9720 | ||
| https://github.com/fschade/icap-client/pull/6 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| with-expecter: true | ||
| filename: "{{.InterfaceName | snakecase }}.go" | ||
| dir: "pkg/{{.PackageName}}/mocks" | ||
| mockname: "{{.InterfaceName}}" | ||
| outpkg: "mocks" | ||
| packages: | ||
| github.com/owncloud/ocis/v2/services/antivirus/pkg/scanners: | ||
| interfaces: | ||
| Scanner: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,186 @@ | ||
| package scanners_test | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "errors" | ||
| "net/http" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/mock" | ||
|
|
||
| ic "github.com/egirna/icap-client" | ||
| "github.com/owncloud/ocis/v2/services/antivirus/pkg/scanners" | ||
| "github.com/owncloud/ocis/v2/services/antivirus/pkg/scanners/mocks" | ||
| ) | ||
|
|
||
| func TestICAP_Scan(t *testing.T) { | ||
| var ( | ||
| earlyExitErr = errors.New("stop here") | ||
| testUrl = "icap://test" | ||
| client = mocks.NewScanner(t) | ||
| scanner = &scanners.ICAP{Client: client, URL: testUrl} | ||
| ) | ||
|
|
||
| t.Run("it sends a OPTIONS request to determine details", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, ic.MethodOPTIONS, request.Method) | ||
| assert.Equal(t, testUrl, request.URL.String()) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{}) | ||
| assert.ErrorIs(t, earlyExitErr, err) // we can exit early, just in case check the error to be identical to the early exit error | ||
| }) | ||
|
|
||
| t.Run("it sends a REQMOD request with all the details", func(t *testing.T) { | ||
|
|
||
| t.Run("request with ContentLength", func(t *testing.T) { | ||
| t.Run("with size", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, ic.MethodREQMOD, request.Method) | ||
| assert.Equal(t, testUrl, request.URL.String()) | ||
| assert.EqualValues(t, 999, request.HTTPRequest.ContentLength) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Size: 999}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
|
|
||
| t.Run("without size", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, ic.MethodREQMOD, request.Method) | ||
| assert.Equal(t, testUrl, request.URL.String()) | ||
| assert.EqualValues(t, 0, request.HTTPRequest.ContentLength) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
| }) | ||
|
|
||
| t.Run("request with Content-Type header", func(t *testing.T) { | ||
| t.Run("name contains known extension", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, "application/pdf", request.HTTPRequest.Header.Get("Content-Type")) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Name: "report.pdf"}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
|
|
||
| t.Run("name with unknown extension", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, "application/octet-stream", request.HTTPRequest.Header.Get("Content-Type")) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Name: "report.unknown"}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
|
|
||
| t.Run("name without extension", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, "httpd/unix-directory", request.HTTPRequest.Header.Get("Content-Type")) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Name: "report"}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
| }) | ||
|
|
||
| t.Run("request with the OPTIONS response preview size ", func(t *testing.T) { | ||
| t.Run("with PreviewBytes set", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{PreviewBytes: 444}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, 444, request.PreviewBytes) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Body: bytes.NewReader(make([]byte, 888))}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
|
|
||
| t.Run("without PreviewBytes set", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, 0, request.PreviewBytes) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Body: bytes.NewReader(make([]byte, 888))}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
| }) | ||
| }) | ||
|
|
||
| t.Run("request with the OPTIONS response preview size ", func(t *testing.T) { | ||
| t.Run("with PreviewBytes set", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{PreviewBytes: 444}, nil).Once() | ||
|
|
||
| client.EXPECT().Do(mock.Anything).RunAndReturn(func(request ic.Request) (ic.Response, error) { | ||
| assert.Equal(t, 444, request.PreviewBytes) | ||
| return ic.Response{}, earlyExitErr | ||
| }).Once() | ||
|
|
||
| _, err := scanner.Scan(scanners.Input{Body: bytes.NewReader(make([]byte, 888))}) | ||
| assert.ErrorIs(t, earlyExitErr, err) | ||
| }) | ||
|
|
||
| t.Run("it handles virus scan results", func(t *testing.T) { | ||
| t.Run("no virus", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
|
|
||
| result, err := scanner.Scan(scanners.Input{}) | ||
| assert.Nil(t, err) | ||
| assert.False(t, result.Infected) | ||
| }) | ||
|
|
||
| // clamav returns an X-Infection-Found header with the threat description | ||
| t.Run("X-Infection-Found header ", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{Header: http.Header{"X-Infection-Found": []string{"Threat=bad threat;"}}}, nil).Once() | ||
|
|
||
| result, err := scanner.Scan(scanners.Input{}) | ||
| assert.Nil(t, err) | ||
| assert.True(t, result.Infected) | ||
| assert.Equal(t, "bad threat", result.Description) | ||
| }) | ||
|
|
||
| // skyhigh returns the information via the content response | ||
| t.Run("X-Infection-Found header", func(t *testing.T) { | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{ContentResponse: &http.Response{StatusCode: http.StatusForbidden, Status: "some status"}}, nil).Once() | ||
|
|
||
| result, err := scanner.Scan(scanners.Input{}) | ||
| assert.Nil(t, err) | ||
| assert.True(t, result.Infected) | ||
| assert.Equal(t, "some status", result.Description) | ||
|
|
||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{}, nil).Once() | ||
| client.EXPECT().Do(mock.Anything).Return(ic.Response{ContentResponse: &http.Response{StatusCode: http.StatusOK}}, nil).Once() | ||
|
|
||
| result, err = scanner.Scan(scanners.Input{}) | ||
| assert.Nil(t, err) | ||
| assert.False(t, result.Infected) | ||
| }) | ||
| }) | ||
| }) | ||
| } |
Oops, something went wrong.