***************************************************************************** WebExeBlock Web Filter Sample ***************************************************************************** Copyright (c) Microsoft Corporation. All rights reserved. THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER. USE AND REDISTRIBUTION OF THIS CODE, WITH OR WITHOUT MODIFICATION, IS HEREBY PERMITTED. ***************************************************************************** The WebExeBlock Web filter sample demonstrates the use of server-side notifications to identify a Windows executable (.exe) file and block it. A Windows executable file is identified by the fact that the response body starts with "MZ". Note that this sample filter only handles 200 OK responses, does not support chunked encoding or compression, does not handle 100-continue etc., all of which must be handled by a Web filter used in production. ------------------------ Compilation Instructions ------------------------ - You must use Visual Studio .NET. (Visual C++ 6.0 is NOT supported). - The sample must be located in the original location where it was installed by the SDK installer because the .vcproj file includes relative references to files in the SDK Inc folder. - Open the WebExeBlock.sln file and compile the whole solution. ------------------------- Installation Instructions ------------------------- To install the Web filter: 1. Copy WebExeBlock.dll to a computer running ISA Server 2004. We recommend that you copy it to the ISA Server installation folder. 2. At a command-line prompt, type the following line and then press ENTER: regsvr32 WebExeBlock.dll 3. Open ISA Server Management, expand the Configuration node, and click Add-ins. In the details pane, click the Web Filters tab and verify that the WebExeBlock Web filter is listed. ------------------ Testing the filter ------------------ To test the WebExeBlock Web filter: 1. Configure a policy that allows requests to go through the ISA Server computer (from clients to your Web server). 2. Send a request through the proxy server for a URL which is a Windows executable file. Be sure that the file is not saved in a compressed format, that chunked encoding is not enabled, and that the request does not include a 100-continue expectation. The filter should block the response. You should receive error 502 (The request was aborted). In a reverse proxy scenario, this would appear as a 500 response. 3. Send a request through the proxy server for a URL which is not a Windows executable file. You should receive the response successfully. Note that in DEBUG mode, you can see debug prints in a debug console (such as dbmon). All WebExeBlock debug messages start with a "WEBEXEBLOCK: " prefix. ------------------------ Unregistering the filter ------------------------ At a command-line prompt, type the following line and then press ENTER: regsvr32 /u WebExeBlock.dll