A new parameter "EnableContainerEngineNameResp" has been introduced in SPE 7.8.
- configuration.xml
<ICAP>
...
<EnableContainerEngineNameResp value="false"/>
This parameter controls malformity handling in ICAP response. It decides whether container engine name should appear in ICAP response or not.
e.g.)
- "EnableContainerEngineNameResp" set to "false" (default)
===========================================
-> RESPMOD icap://127.0.0.1:1344/SYMCScanResp-AV ICAP/1.0
-> Host: 127.0.0.1:1344
-> Connection: close
-> Encapsulated: req-hdr=0, res-hdr=63, res-body=82
->
-> get Malformed-In-Zip.zip HTTP/1.1
-> Host:icheck.symantec.com
->
-> HTTP/1.1 200 OK
->
-> 3f9
-> Sending chunk of size 1017 bytes
->
-> 0
->
<- ICAP/1.0 201 Created
<- ISTag: "EA320D91B9D39E2F33977F3E857B5C84"
<- Date: Mon May 29 05:25:07 2017 GMT
<- Service: Symantec Protection Engine/7.8.1.12
<- Service-ID: SYMCSCANRESP-AV
<- X-Violations-Found: 1
<- Malformed-In-Zip.zip/name-colon.eml
<- Malformed container violation
<- -8
<- 0
<- X-Outer-Container-Is-Mime: 0
<- Encapsulated: res-hdr=0, res-body=83
<-
<- HTTP/1.1 200 OK
<- Content-Length: 649
<- Pragma: no-cache
<- Content-Type: text/html
<-
<- 289
<- Getting chunk of size 649 bytes
<-
<- 0
<-
Normal termination.
===========================================
- "EnableContainerEngineNameResp" set to "true"
===========================================
-> RESPMOD icap://127.0.0.1:1344/SYMCScanResp-AV ICAP/1.0
-> Host: 127.0.0.1:1344
-> Connection: close
-> Encapsulated: req-hdr=0, res-hdr=63, res-body=82
->
-> get Malformed-In-Zip.zip HTTP/1.1
-> Host:icheck.symantec.com
->
-> HTTP/1.1 200 OK
->
-> 3f9
-> Sending chunk of size 1017 bytes
->
-> 0
->
<- ICAP/1.0 201 Created
<- ISTag: "EA320D91B9D39E2F33977F3E857B5C84"
<- Date: Mon May 29 05:30:23 2017 GMT
<- Service: Symantec Protection Engine/7.8.1.12
<- Service-ID: SYMCSCANRESP-AV
<- X-Violations-Found: 1
<- Malformed-In-Zip.zip/name-colon.eml
<- Malformed container violation| EngineName=MIME
<- -8
<- 0
<- X-Outer-Container-Is-Mime: 0
<- Encapsulated: res-hdr=0, res-body=83
<-
<- HTTP/1.1 200 OK
<- Content-Length: 649
<- Pragma: no-cache
<- Content-Type: text/html
<-
<- 289
<- Getting chunk of size 649 bytes
<-
<- 0
<-
Normal termination.
===========================================
SPE log output is not affected by this parameter.