Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
Virus and malware filtering 6
Gateway Antimalware
This section explains the rules in a library rule set for virus and malware filtering.
For general information on understanding and handling rules, see Rules and rule sets.
Library rule set — Gateway Antimalware
Criteria — Always
Cycles — Requests (and IM), responses, embedded objects
The rule set contains the following rules:
Remove partial content for HTTP requests
Cycle.TopName equals “Request” AND (Connection.Protocol equals “http” OR Connection.Protocol
equals “https”) –> Continue — Header.RemoveAll (“Range”)
The rule uses the Cycle.TopName and Connection.Protocol properties to check whether the current
processing cycle is the request cycle and whether a request is sent in HTTP or HTTPS mode. If this
is the case, the Header.RemoveAll event modifies the request by removing the specification that
only partial content is requested.
A request for complete content is then forwarded to the relevant web server and eventually
received from there, so that the complete content of a web object can be processed on the
appliance. For example, a complete archive can be opened and scanned for viruses and other
malware. Malicious content that is distributed over several parts of a file can be detected by
scanning the complete file, while it could go unnoticed if only parts of the file were scanned.
The Continue action lets processing continue with the next rule.
Block partial content for FTP requests
Cycle.TopName equals “Request” AND Connection.Protocol equals “ftp” AND Command.Categories
contains “Partial” –> Block
The rule uses the Cycle.TopName, Connection.Protocol, and Command.Categories properties to
check whether the current processing cycle is the request cycle, the request is sent in FTP mode,
and the command category used for the FTP transfer contains Partial as a string. This allows the
appliance to detect an FTP request for partial content and block it.
Unlike with HTTP or HTTPS requests, an FTP request for partial content cannot be modified to
make it a request for complete content. However, security problems would arise if partial content
was accepted on the appliance, which are the same as the ones that were explained in the
comment on the rule for blocking HTTP and HTTPS requests.
The action settings specify a message to the requesting user.
Allow if user agent matches User Agent Whitelist
Header.Request.Get (“User-Agent”) matches in list User Agent WhiteList –> Stop Rule Set
The rule uses the Header.Request.Get property to check the user agent information that is sent
with the header of a request. If the user agent in question is on the specified whitelist, processing
of the rule set stops, so the blocking rule of the rule set is not processed and cannot block the
request.
A parameter of the property specifies that it is the user agent information that must be checked
when the rule is processed.
Note: This rule is not enabled by default. Using this rule alone for whitelisting will cause a security problem
because usually a client can set whatever user agent it prefers.
McAfee Web Gateway 7.1.5 Product Guide 175