DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Antivirus actions virus scan messages via ICAP server.

    Posted Tue October 08, 2024 10:51 PM

    We have a processing policy in MPG with with Anti Virus action via ICAP server .I am tested below 2 test cases.

    1)Scan entire message.

    I have MPG with  request Type and response Type set to non xml and in processing rule with antivirus action to  . When testing through soapui, I have selected mediatype as multipart/formdata and I have an attachment of PDF file and also I have Json message in the body.  I have enabled the probe in the call being made to Symantec from Processing rule I see empty body. I am not sure if the request body along with attachments is being sent to Symantec or not. 

    I would like to understand does Data power support multipart/form-data for Symantec anti virus action? Can someone please provide more information on what type of media types does data power support for Antivirus actions virus scan messages via ICAP server.



    ------------------------------
    vijaya k
    ------------------------------


  • 2.  RE: Antivirus actions virus scan messages via ICAP server.

    Posted Thu October 10, 2024 02:46 PM

    Requesting inputs over here please .

    I would like to understand does Data power support multipart/form-data for Symantec anti virus action? Can someone please provide more information on what type of media types does data power support for Antivirus actions virus scan messages via ICAP server.I have tried below scenorio's

    1)Scan entire message.

    I have MPG with  request Type and response Type set to non xml and in processing rule with antivirus action to  . When testing through soapui, I have selected mediatype as multipart/formdata and I have an attachment of PDF file and also I have Json message in the body.  I have enabled the probe in the call being made to Symantec from Processing rule I see empty body. I am not sure if the request body along with attachments is being sent to Symantec or not. Symantec Team has confirmed they received them as .MSG file.

    2)Scan all attachments

    I have MPG with  request Type and response Type set to non xml and in processing rule with antivirus action to  . When testing through soapui, I have selected mediatype as multipart/formdata and I have an attachment of PDF file and also I have JSON message in the body.  I have enabled the probe, , I don't see any call being made to Symantec. Why is Symantec not receiving  calls, as the only change I made was change from Scan entire message to Scan all attachments.



    ------------------------------
    vijaya k
    ------------------------------



  • 3.  RE: Antivirus actions virus scan messages via ICAP server.

    Posted Fri October 11, 2024 07:25 AM

    Hi Vijaya,

    I have never tried to use ICAP ation with multipart. We have always just sent the actual file that needs to be scanned in binary format to the ICAP server. For example, the attachment comes in as base64 encoded payload in JSON or XML message. The base64 encoded file content is extracted, decoded and then sent to the ICAP server. The response from our ICAP server contains the analysis results in the HTTP headers. Decoding of base64 content is done just simply using binary transform action and base64Binary.ffd as output mapping. Hope this helps.

    <xsl:stylesheet version="1.0" 
      xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
      xmlns:dp="http://www.datapower.com/extensions" 
      extension-element-prefixes="dp">
    	
    	<dp:output-mapping  href="base64Binary.ffd" type="ffd"/>
    
    	<xsl:template match="/">
    		<xsl:copy-of select="."/>
    	</xsl:template>
    </xsl:stylesheet>


    ------------------------------
    Hermanni Pernaa
    Solutions Architect
    Digia Plc
    Helsinki
    ------------------------------



  • 4.  RE: Antivirus actions virus scan messages via ICAP server.

    Posted Tue October 15, 2024 02:37 PM
    Edited by Hermann Stamm-Wilbrandt Tue October 15, 2024 02:38 PM

    base64Binary.ffd is described on slide 7 of this 2011 WSTE webcast:

    https://www.ibm.com/support/pages/webcast-replay-non-xml-data-processing-websphere-datapower-soa-appliances-stylesheets-12-basics-and-encodings



    ------------------------------
    Hermann Stamm-Wilbrandt
    Compiler Level 3 support, IBM DataPower Gateways
    IBM
    Boeblingen
    ------------------------------



  • 5.  RE: Antivirus actions virus scan messages via ICAP server.

    Posted Fri October 11, 2024 09:08 AM

    Hi Vijaya, I believe Hermanni's approach is the right way to go here. DataPower can process multipart/formdata but only a text; not binary attachments; so for you it would be better to try it his way; or you could use multipart/related instead



    ------------------------------
    Matthias Siebler
    MA
    ------------------------------