|
2 | 2 | pcx_content_type: concept |
3 | 3 | title: AV scanning |
4 | 4 | sidebar: |
5 | | - order: 8 |
6 | | - |
| 5 | + order: 5 |
7 | 6 | --- |
8 | 7 |
|
9 | | -Cloudflare Gateway protects users as they browse the Internet. When users download or upload a file to an origin on the Internet, that file could potentially contain malicious code that may cause their device to perform undesired behavior. |
| 8 | +import { Render, Details } from "~/components"; |
10 | 9 |
|
11 | | -To prevent this, Cloudflare Gateway allows admins to enable **Anti-Virus (AV) scanning** of files that are uploaded or downloaded by users as the file passes through Gateway. |
| 10 | +Cloudflare Gateway protects users as they browse the Internet. When users download or upload a file to an origin on the Internet, that file could potentially contain malicious code that may cause their device to perform undesired behavior. To prevent this, Cloudflare Gateway allows admins to turn on anti-virus (AV) scanning of files that are uploaded or downloaded by users as the file passes through Gateway. |
12 | 11 |
|
13 | | -AV scanning of files requires organizations to go to **Settings** > **Network** > **Firewall** and enable **AV inspection**. |
| 12 | +In addition to scanning files, Gateway can quarantine files as your users download them. Quarantining files helps protect organizations from zero-day vulnerabilities not yet available in anti-virus databases. For more information, refer to [File sandboxing](/cloudflare-one/policies/gateway/http-policies/file-sandboxing/). |
14 | 13 |
|
15 | | -## Enable AV scanning |
| 14 | +## Get started |
16 | 15 |
|
17 | | -To enable AV scanning: |
| 16 | +To turn on AV scanning: |
18 | 17 |
|
19 | 18 | 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Network**. |
20 | | -2. In **Firewall**, enable **AV inspection**. |
| 19 | +2. In **Firewall**, turn on **AV inspection**. |
21 | 20 | 3. Choose whether to scan files for malicious payloads during uploads, downloads, or both. You can also block requests containing [non-scannable files](#non-scannable-files). |
22 | 21 |
|
23 | 22 | When a request is blocked due to the presence of malware, Gateway will log the match as a Block decision in your [HTTP logs](/cloudflare-one/insights/logs/gateway-logs/#http-logs). |
24 | 23 |
|
25 | | -## How Gateway determines if a file should be scanned |
26 | | - |
27 | | -If AV scanning is enabled, Gateway will use the following to determine whether a file is present in a request or response, and whether to scan that file (first match will result in the file being scanned): |
28 | | - |
29 | | -* If the Content-Disposition HTTP header is `Attachment` |
30 | | - |
31 | | -* If the byte signature of the body of the request matches a signature we identify as one of the following file type categories: |
| 24 | +## File scan criteria |
32 | 25 |
|
33 | | - * **Executable** (e.g., `.exe`, `.bat`, `.dll`, `.wasm`) |
34 | | - * **Documents** (e.g., `.doc`, `.docx`, `.pdf`, `.ppt`, `.xls`) |
35 | | - * **Compressed** (e.g., `.7z`, `.gz`, `.zip`, `.rar`) |
| 26 | +If AV scanning is turned on, Gateway will use the following criteria to determine whether a file is present in a request or response, and whether to scan that file. The first match will result in the file being scanned. |
36 | 27 |
|
37 | | -* If the file name in the Content-Disposition header contains a file extension that indicates it is one of the file type categories above |
| 28 | +- If the `Content-Disposition` HTTP header is `Attachment` |
| 29 | +- If the byte signature of the body of the request matches a signature Gateway identifies as one of the following file type categories: |
| 30 | + - **Executable** (for example, `.exe`, `.bat`, `.dll`, and `.wasm`) |
| 31 | + - **Documents** (for example, `.doc`, `.docx`, `.pdf`, `.ppt`, and `.xls`) |
| 32 | + - **Compressed** (for example, `.7z`, `.gz`, `.zip`, and `.rar`) |
| 33 | +- If the file name in the `Content-Disposition` header contains a file extension that indicates it is one of the file type categories above |
38 | 34 |
|
39 | | -If none of the above conditions trigger a file to be scanned, Gateway will use the origin's Content-Type header to determine whether or not to scan the file. Additionally, Gateway will not scan files it determines to be in the Image, Video, or Audio file type categories. |
| 35 | +If none of the above conditions trigger a file to be scanned, Gateway will use the origin's `Content-Type` header to determine whether or not to scan the file. Additionally, Gateway will not scan files it determines to be image, video, or audio files. |
40 | 36 |
|
41 | 37 | If a file does not trigger a scan based on the three methods above but also does not match criteria to be exempted from scanning, Gateway will default to scanning the file for malware. |
42 | 38 |
|
43 | | -## Non-scannable files |
44 | | - |
45 | | -Not all files are able to be scanned. For example, this is the case for password protected files that cannot be opened due to encryption. Admins can choose whether to **fail open** (allow the file to pass through unscanned) or to **fail closed** (deny the file transfer). |
46 | | - |
47 | | -The following files cannot be scanned and will be blocked or allowed based on whether the admin configured Gateway to fail open or closed: |
48 | | - |
49 | | -* Files larger than 15MB cannot be scanned. |
50 | | -* Password protected archives |
51 | | -* Archives with more than 3 recursion levels |
52 | | -* Archives with more than 300 files |
53 | | -* PGP encrypted files |
54 | | - |
55 | 39 | ## Opt content out from scanning |
56 | 40 |
|
57 | | -When an admin enables AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning by leveraging the HTTP rules. All [HTTP selectors](/cloudflare-one/policies/gateway/http-policies/#selectors) can be used to opt HTTP traffic out from AV scanning using the Do Not Scan action. For example, to prevent AV scanning of files uploaded to or downloaded from `example.com`, an admin would configure the following rule: |
| 41 | +When an admin turns on AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning using HTTP policies. All [HTTP selectors](/cloudflare-one/policies/gateway/http-policies/#selectors) can opt HTTP traffic out from AV scanning using the **Do Not Scan** action. When traffic matches a Do Not Scan policy, nothing is scanned, regardless of file size or whether the file type is supported or not. For example, to prevent AV scanning of files uploaded to or downloaded from `example.com`, you can create the following policy: |
58 | 42 |
|
59 | 43 | | Selector | Operator | Value | Action | |
60 | 44 | | -------- | ------------- | ------------- | ----------- | |
61 | 45 | | Hostname | matches regex | `example.com` | Do Not Scan | |
62 | 46 |
|
63 | | -Opting out of AV scanning applies to both uploads and downloads of files (i.e., it matches the global AV scanning setting). If an admin has chosen, for example, to only globally scan uploads, then opting out of AV scanning only applies to uploads. |
| 47 | +Opting out of AV scanning applies to uploads and/or downloads of files, matching your account's global AV scanning setting. For example, if you have configured Gateway to globally scan uploads only, then opting out of AV scanning will only apply to uploads. |
64 | 48 |
|
65 | | -When traffic matches a Do Not Scan rule, nothing is scanned, regardless of file size or whether the file type is supported or not. |
| 49 | +## Compatibility |
66 | 50 |
|
67 | | -## Supported compressed file types |
| 51 | +### Supported compressed file types |
68 | 52 |
|
69 | 53 | In addition to standard object files like PDFs, Zero Trust supports AV scanning for the following archive types: |
70 | 54 |
|
71 | | -* 7-Zip |
72 | | -* 7-Zip SFX |
73 | | -* ACE |
74 | | -* ACE SFX |
75 | | -* AutoHotkey |
76 | | -* AutoIt |
77 | | -* BASE64 |
78 | | -* BZ2 |
79 | | -* CHM Help Files |
80 | | -* CPIO SVR4 |
81 | | -* Chrome Extension (CRX) Package Format |
82 | | -* eXtensible ARchive format (XAR) |
83 | | -* GZIP compressed files |
84 | | -* ISO 9660 |
85 | | -* Inno Setup |
86 | | -* Indigo Rose Setup Factory |
87 | | -* Java ARchive |
88 | | -* LZH/LHA |
89 | | -* MacBinary |
90 | | -* MIME base64 |
91 | | -* MSCOMPRESS |
92 | | -* Microsoft CAB |
93 | | -* Microsoft TNEF |
94 | | -* NSIS Nullsoft Installer |
95 | | -* Office Legacy XML |
96 | | -* PGP signed message, document, etc. |
97 | | -* RPM |
98 | | -* RAR |
99 | | -* SAPCar |
100 | | -* Self-extracting ARJ |
101 | | -* Self-extracting CA |
102 | | -* Self-extracting LZH/LHA |
103 | | -* Self-extracting RAR |
104 | | -* Self-extracting ZIP |
105 | | -* Smart Install Maker |
106 | | -* TAR |
107 | | -* UUE and XXE compressed files |
108 | | -* Windows Imaging File (WIM) |
109 | | -* XE compressed files (UUE and XXE) |
110 | | -* XZ file format |
111 | | -* ZIP |
112 | | -* ZOO |
| 55 | +<Details header="Supported compressed file types"> |
| 56 | + |
| 57 | +- 7-Zip |
| 58 | +- 7-Zip SFX |
| 59 | +- ACE |
| 60 | +- ACE SFX |
| 61 | +- AutoHotkey |
| 62 | +- AutoIt |
| 63 | +- BASE64 |
| 64 | +- BZ2 |
| 65 | +- CHM Help Files |
| 66 | +- CPIO SVR4 |
| 67 | +- Chrome Extension (CRX) Package Format |
| 68 | +- eXtensible ARchive format (XAR) |
| 69 | +- GZIP compressed files |
| 70 | +- ISO 9660 |
| 71 | +- Inno Setup |
| 72 | +- Indigo Rose Setup Factory |
| 73 | +- Java ARchive |
| 74 | +- LZH/LHA |
| 75 | +- MacBinary |
| 76 | +- MIME base64 |
| 77 | +- MSCOMPRESS |
| 78 | +- Microsoft CAB |
| 79 | +- Microsoft TNEF |
| 80 | +- NSIS Nullsoft Installer |
| 81 | +- Office Legacy XML |
| 82 | +- PGP signed message, document, etc. |
| 83 | +- RPM |
| 84 | +- RAR |
| 85 | +- SAPCar |
| 86 | +- Self-extracting ARJ |
| 87 | +- Self-extracting CA |
| 88 | +- Self-extracting LZH/LHA |
| 89 | +- Self-extracting RAR |
| 90 | +- Self-extracting ZIP |
| 91 | +- Smart Install Maker |
| 92 | +- TAR |
| 93 | +- UUE and XXE compressed files |
| 94 | +- Windows Imaging File (WIM) |
| 95 | +- XE compressed files (UUE and XXE) |
| 96 | +- XZ file format |
| 97 | +- ZIP |
| 98 | +- ZOO |
| 99 | + |
| 100 | +</Details> |
| 101 | + |
| 102 | +Gateway cannot scan [certain archive files](#non-scannable-files) regardless of file type, such as large or encrypted files. |
| 103 | + |
| 104 | +### Non-scannable files |
| 105 | + |
| 106 | +Gateway cannot scan all files for malware. When Gateway encounters a non-scannable file, you can configure AV scanning whether to fail open (allow the file to pass through unscanned) or to fail closed (deny the file transfer). |
| 107 | + |
| 108 | +<Render file="gateway/nonscannable-files" /> |
| 109 | + |
| 110 | +- Password protected archives |
| 111 | +- Archives with more than three recursion levels |
| 112 | +- Archives with more than 300 files |
0 commit comments