ICAP [was Re: Antivirus]

[Matt Bernstein]

On Jan 15 Henrique de Moraes Holschuh wrote:

>> Maybe a hook could be bolted in whenever an IMAP fetch or store command is 
>> requested. There is a possible protocol for this called ICAP, for which 
>> patches to squid exist. At least Symantec offer a commercial ICAP server; 
>> there's a GPLish one written in Python IIRC.
>
>I know nothing about ICAP, but it might be an interesting idea... go ahead
>;-)

[months pass..]

A month ago ICAP became RFC3507! It stands for "Internet Content
Adaptation Protocol", and says in the future could be used for:

# Language translation
# Virus checking
# Family ( PG/R/X ) content filtering
# Local real-time ad insertion
# Wireless protocol translation
# Anonymous Web usage profiling (perhaps for a dating service)
# Transcoding or image enhancement
# Image magnification for the elderly
# Digest production/batch download of Web content

Granted some of that lot not strictly relevant to Cyrus IMAP! However, I'd
love to see configurable hooks put in to imapd so that at least you could
do a virus check per STORE command.. This, in combination with lmtpd being
protected by your MTA's scanner and a one-time scan, would protect your
IMAP store with not too big a CPU hit :)

http://www.i-cap.org/home.html
http://www.i-cap.org/spec/rfc3507.txt

I won't have time to dive in myself for at least a month, and I'd probably
look at cyrus-imapd 2.1.x as that's what we're running. Otoh, for someone
who knows the code it shouldn't take too much time or effort to bolt this
in, and if it's only available for 2.2 I could be persuaded to be an early 
adopter!

Matt