Name

MAVP-758 — ICAP server responded by unclear response

Severity

W (warning)

Message text

ICAP server %s responded by %d, assuming positive check

Description

The ICAP server used as an antivirus engine should respond by by the X-Infection-Found header (or similar ones). If it does not to do it, the result should be estimated from the ICAP protocol status code:

  • 200 OK (with included response body) is evaluated as positive answer

  • 200 OK (without body) is evaluated according to the ICAP-PASS-200-WITH-PURE-BODY item setting

  • 201 Created is evaluated as positive answer

  • 204 Data OK is evaluated as negative answer.

This message reports a case of 200 or 201 positive answer (i.e. virus found).

See also

MAVP-759(6), antivirus(5), logging(7)

Authors

This man page is a part of Kernun Firewall.
Copyright © 2000–2023 Trusted Network Solutions, a. s.
All rights reserved.