Policy-based content filtering

1. A computer-implemented method for processing application-level content of network service protocols, the method comprising:

defining, within a firewall device, one or more content processing configuration schemes, each of the one or more content processing configuration schemes including a plurality of content processing configuration settings for one or more network service protocols;

storing, by the firewall device, the one or more content processing configuration schemes;

associating, by the firewall device, one or more of the stored content processing configuration schemes with a firewall policy;

receiving an incoming network connection, at a networking subsystem of the firewall device the incoming connection being characterized by a source network address, a destination network address and a network service protocol;

determining, by the networking subsystem, whether to allow or deny the incoming connection by identifying a matching firewall policy based on the source network address, the destination network address and the network service protocol and applying packet-layer firewall rules associated with the matching firewall policy;

if the incoming connection is allowed, then:

redirecting the incoming network connection, by the networking subsystem, to a proxy module of one or more proxy modules within the firewall device that is configured to support the network service protocol;

retrieving, by the proxy module, one or more content processing configuration schemes associated with the matching firewall policy; and

processing, by the proxy module, application-level content of a packet stream associated with the incoming network connection by

reconstructing the application-level content, including extracting and buffering content from a plurality of packets of the packet stream; and

scanning the application-level content based on the retrieved one or more content processing configuration schemes.

2. The method of claim 1 , wherein the network service protocol comprises at least one of a group consisting of HyperText Transfer Protocol (HTTP), File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), Internet Message Access Protocol (IMAP) and Server Message Block/Common Internet File System (SMB/CIFS).

3. The method of claim 1 , further comprising authenticating a user associated with the incoming connection and rejecting the incoming connection if the authentication is unsuccessful.

4. The method of claim 3 , wherein the authenticated user is associated with one or more user groups.

5. The method of claim 4 , wherein the retrieved one or more content processing configuration schemes are assigned to the one or more user groups.

6. The method of claim 5 , wherein the retrieved one or more content processing configuration schemes are determined by an identity of the authenticated user.

7. The method of claim 1 , wherein the one or more content processing configuration schemes have different control levels over the different services.

8. The method of claim 1 , wherein the firewall policy, the one or more configuration schemes and other parameters are stored in a configuration database.

9. A computer system comprising:

non-transitory storage device having tangibly embodied therein instructions representing a security application; and

one or more processors coupled to the non-transitory storage device and operable to execute the security application to perform a method comprising:

defining one or more content processing configuration schemes, each of the one or more content processing configuration schemes including a plurality of content processing configuration settings for one or more network service protocols;

storing the one or more content processing configuration schemes;

associating one or more of the stored content processing configuration schemes with a firewall policy;

receiving an incoming network connection, at a networking subsystem of a firewall device, the incoming connection being characterized by a source network address, a destination network address and a network service protocol;

determining, by the networking subsystem, whether to allow or deny the incoming by identifying a matching firewall policy based on the source network address, the destination network address and the network service protocol and applying packet-layer firewall rules associated with the matching firewall policy;

if the incoming connection is allowed, then:

redirecting the incoming network connection, by the networking subsystem, to a proxy module of one or more proxy modules within the firewall device that is configured to support the network service protocol;

retrieving, by the proxy module, one or more content processing configuration schemes associated with the matching firewall policy; and

processing, by the proxy module, application-level content of a packet stream associated with the incoming network connection by

reconstructing the application-level content, including extracting and buffering content from a plurality of packets of the packet stream; and

scanning the application-level content based on the retrieved one or more content processing configuration schemes.

10. The system of claim 9 , wherein the network service protocol comprises at least one of a group consisting of HyperText Transfer Protocol (HTTP), File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), Internet Message Access Protocol (IMAP) and Server Message Block/Common Internet File System (SMB/CIFS).

11. The system of claim 9 , wherein the method further comprises authenticating a user associated with the incoming connection and rejecting the incoming connection if the authentication is unsuccessful.

12. The system of claim 11 , wherein the authenticated user is associated with one or more user groups.

13. The system of claim 12 , wherein the retrieved one or more content processing configuration schemes are assigned to the one or more user groups.

14. The system of claim 13 , wherein the retrieved one or more content processing configuration schemes are determined by an identity of the authenticated user.

15. The system of claim 9 , wherein the one or more content processing configuration schemes have different control levels over the different services.

16. The system of claim 9 , wherein the firewall policy, the one or more configuration schemes and other parameters are stored in a configuration database.