influence of parameter "EnableContainerEngineNameResp"

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

A new parameter "EnableContainerEngineNameResp" has been introduced in SPE 7.8.

- configuration.xml

        <ICAP>
            ...
            <EnableContainerEngineNameResp value="false"/>        

 

Resolution

This parameter controls malformity handling in ICAP response. It decides whether container engine name should appear in ICAP response or not. 

e.g.)

- "EnableContainerEngineNameResp" set to "false" (default)

===========================================
-> RESPMOD icap://127.0.0.1:1344/SYMCScanResp-AV ICAP/1.0
-> Host: 127.0.0.1:1344
-> Connection: close
-> Encapsulated: req-hdr=0, res-hdr=63, res-body=82
->
-> get Malformed-In-Zip.zip HTTP/1.1
-> Host:icheck.symantec.com
->
-> HTTP/1.1 200 OK
->
-> 3f9
-> Sending chunk of size 1017 bytes
->
-> 0
->
<- ICAP/1.0 201 Created
<- ISTag: "EA320D91B9D39E2F33977F3E857B5C84"
<- Date: Mon May 29 05:25:07 2017 GMT
<- Service: Symantec Protection Engine/7.8.1.12
<- Service-ID: SYMCSCANRESP-AV
<- X-Violations-Found: 1
<-      Malformed-In-Zip.zip/name-colon.eml
<-      Malformed container violation
<-      -8
<-      0
<- X-Outer-Container-Is-Mime: 0
<- Encapsulated: res-hdr=0, res-body=83
<-
<- HTTP/1.1 200 OK
<- Content-Length: 649
<- Pragma: no-cache
<- Content-Type: text/html
<-
<- 289
<- Getting chunk of size 649 bytes
<-
<- 0
<-
Normal termination.
===========================================

- "EnableContainerEngineNameResp" set to "true"

===========================================
-> RESPMOD icap://127.0.0.1:1344/SYMCScanResp-AV ICAP/1.0
-> Host: 127.0.0.1:1344
-> Connection: close
-> Encapsulated: req-hdr=0, res-hdr=63, res-body=82
->
-> get Malformed-In-Zip.zip HTTP/1.1
-> Host:icheck.symantec.com
->
-> HTTP/1.1 200 OK
->
-> 3f9
-> Sending chunk of size 1017 bytes
->
-> 0
->
<- ICAP/1.0 201 Created
<- ISTag: "EA320D91B9D39E2F33977F3E857B5C84"
<- Date: Mon May 29 05:30:23 2017 GMT
<- Service: Symantec Protection Engine/7.8.1.12
<- Service-ID: SYMCSCANRESP-AV
<- X-Violations-Found: 1
<-      Malformed-In-Zip.zip/name-colon.eml
<-      Malformed container violation| EngineName=MIME
<-      -8
<-      0
<- X-Outer-Container-Is-Mime: 0
<- Encapsulated: res-hdr=0, res-body=83
<-
<- HTTP/1.1 200 OK
<- Content-Length: 649
<- Pragma: no-cache
<- Content-Type: text/html
<-
<- 289
<- Getting chunk of size 649 bytes
<-
<- 0
<-
Normal termination.
===========================================

SPE log output is not affected by this parameter.