Why does Membrane API Gateway return Virus scanner error?

The clamav plugin scans the original request with a ClamAV daemon. The error is returned both when the scan could not be done and when the daemon did not report the content as clean.

How do I fix Virus scanner error in Membrane?

Check that clamd is running and reachable at the configured host and port, and check the clamd log to tell a detected virus apart from a scan failure. Raise the stream size limit if large requests fail.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

500 Internal Server Error: Virus Scanner Error

Membrane API Gateway returns 500 Internal Server Error with the title Virus scanner error! when the clamav plugin could not scan the request, or the ClamAV daemon did not report it as clean. The response of the backend is replaced with this error.

The Error Response

The plugin runs in the response flow, so the client receives 500 Internal Server Error instead of the backend's response. The response contains the title Virus scanner error!, the detail Could not execute virus scan., the problem type https://membrane-api.io/problems/internal and a link to this page. The type internal means that the gateway failed while processing the exchange.

Currently, a detected virus and a failed scan produce the same response and the same log line, Could not reach clamav daemon. Use the log of the ClamAV daemon to tell them apart.

What the clamav Plugin Does

The clamav plugin sends the headers and body of the original request to a ClamAV daemon (clamd) for scanning. The default address is localhost:3310:

api:
  port: 2000
  flow:
    - clamav:
        host: localhost
        port: "3310"
  target:
    url: https://api.example.com

api:
  port: 2000
  flow:
    - clamav:
        host: localhost
        port: "3310"
  target:
    url: https://api.example.com

Common Causes

The ClamAV Daemon Cannot Be Reached

The daemon is not running, or it cannot be reached at the configured host and port.

The Daemon Rejected the Scan

For example, the request exceeds the maximum stream size of the daemon.

The Request Contains Malicious Content

ClamAV detected malicious content in the request headers or body. In this case, the client is responsible.

An Unexpected Exception in the clamav Plugin

The same link is also used when the clamav plugin throws an exception that it does not handle itself. The detail then starts with Aborting! Exception caused in ... and names the flow. Membrane logs such exceptions at warn level with the stack trace. If the plugin is nested in request, response or abort, the exception message and stack trace are sent to the client even in production mode. Unless the exception points to your configuration or to the message content, this usually indicates a bug in Membrane.

How to Fix It

Check that clamd is running and listening on the configured address, and that the gateway can connect to it.
Check the clamd log to tell a detected virus apart from a scan failure.
If large requests fail, raise the stream size limit of the daemon in the ClamAV configuration.
Client side: if the content was flagged as malicious, do not send it.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem, including the link to this page. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

In production mode, the title of this error is replaced by Internal Server Error, and the response only says Internal details are hidden. See server log (key: ...). Search the gateway log for that key to find the full error message.