Content Scanning Server

[msimerson]

Having recently tested AVG, and started testing ESET, and with Kaspersky testing on my TODO list, it occurred to me that a Reasonably Good Idea would be a little node.js http server that:

1. accepts a HTTP request (params in HTTP headers, email message in HTTP body)
2. runs that message past as many content scanners as are requested (default: all) or as many are configured.
3. Returns a JSON result with the scan results from each scanner

   Pros

   • Haraka would need only a very simple data_post plugin
   • Scan the message against many scanners concurrently (default: 1 per CPU). This would be faster than Haraka plugins which execute serially, or SMTP pipelines.
   • Other MTAs could use this
   • Faster and more efficient: rather than streaming the message via TCP to each content scanner (once for SA, once for ClamAV, once for ....), this would stream the content once via TCP, and then this little server would use the file system or Unix Domain Sockets to pass the message to each content scanner.
   • Haraka could load balance requests to a pool of these scanning hosts.

     Cons

   • requires time and effort

     Planned Initial Content Scanner Support

   • ClamAV
   • AVG
   • ESET
   • Kaspersky
   • SpamAssassin

     Potential Future Additions

   • dcc
   • messagesniffer
   • dspam
   • VirusTotal (see also #1124)

[msimerson]

• Requests can be run according to preferences:
  • async.each: most efficient, as soon as any scanner says "junk," end processing
  • async.parallel: best for raw speed and measuring scanner efficacy (all scanners get run, report results of each)

[Dexus]

Hey, if you have a repository i will help you. I can help to add other av services etc.

[msimerson]

@Dexus , I created the repo here. Thanks for helping!

[Dexus]

@msimerson Do you already have a project initialization performed? Or can I start directly and make an init commit?

[msimerson]

not yet, go ahead.

[msimerson]

This idea is growing over here