[Rspamd-Users] Problems using ESET via ICAP

[Ronny Seffner]

Hi folks,

since one of the last eset updates (now 10.1.176.0), rspamd logs "icap (icap): ICAP ERROR: ICAP/1.0 400 Bad request".

My local.d/external_services.conf looks like:
    icap {
      servers = "127.0.0.1:1344"
      symbol = "ICAP_VIRUS";
      type = "icap";
      scheme = "scan";
      user_agent = "none"
    }

As of c-icap-client, sets icpad seems to work:

    root at ns2:/opt/eset/efs/bin# c-icap-client
    ICAP server:localhost, ip:127.0.0.1, port:1344
    
    OPTIONS:
        Allow 204: No
        Preview: 16384
        Keep alive: Yes

    ICAP HEADERS:
        ICAP/1.0 200 OK
        Methods: RESPMOD
        Encapsulated: null-body=0
        Preview: 16384
        Transfer-Preview: *
        ISTag: "116819c1ec46eb3c-1699538850"
        Max-Connections: 1024

What else to check? How to use c-icap-client the rspamd way? Found this at kaspersky https://support.kaspersky.com/ScanEngine/1.0/en-US/179903.htm but none of the *.txt examples works here.
Need to use another "scheme" now?


kind regards

Ronny Seffner