[Rspamd-Users] Avast antivirus - IO timeout

[Carsten Rosenberg]

On 15.03.24 11:36, Tomasz Kaźmierczak wrote:
> W dniu 14.03.2024 o 16:00, Vsevolod Stakhov pisze:
>> On 14/03/2024 14:03, Tomasz Kaźmierczak wrote:
> 
> Sorry, I chose the wrong button for the reply...
> 
> 
> in other case i use CLAMAV - its really great.
> 
> in this case, the client requires one of the commercial AV.
> 
> i'm testing:
> 
> - F-Secure Atlant (successor GateKeeper) by ICAP - write to support for 
> help
> 
> - Avast - timeout error
> 
> 
> i increase task_timeout to 30s and still the same, maybe it is AVAST error?
> 
> is any chance to see what exacly rspamd send to AVAST
> 
> 
> kazix
> 

Your configuration for avast cannot work. And here is why: There is an 
old Avast plugin (w/o rest-api usage) which seem never was documented.

And there was a new one which was never merged into the main code:

https://github.com/rspamd/rspamd/pull/4284

We agreed to rework it a bit an then ...

But the documentation was merged into rspamd.com :-/


Here is what you can try now:

Use the old plugin by trying to set server to the unix socket of the 
scanner:


avast {

   symbol = "AVAST_VIRUS";
   servers = "/var/run/avast/scan.sock";
   tmpdir = '/tmp'

}

tmpdir must be accessable by both services.


Or you integrate the code from the PR above. We are also use it in 
production.

But then need to add type = "avast_rest"; to the config section.


And for the Atlant. Its strange that there seems to be no valid options 
reply (as its a must have in thr RFC). The old F-Secure ICAP was pretty 
good. Maybe only your URL (scheme).

Have you got any reply from F-Secure?


Carsten