Icap protocol error

genesislubrigas

I am having icap protocol error when I enable antivirus on squid proxy. I can disable it so that there will be internet connection but I need this feature. How to resolve this ?

tohil

Hi,

Same issue I have…what underlaying hardware do you use?

werwasw94

same here
after enable -> Package -> Proxy Server: AntivirusAntivirus -> "Enable Squid antivirus check using ClamAV." i got an error (see error.PNG):

what can i do?

2.3.2-RELEASE (amd64)
built on Tue Jul 19 12:44:43 CDT 2016
FreeBSD 10.3-RELEASE-p5

error.PNG_thumb

werwasw94

maybe the problem is in the squid.conf:

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all

and should be:

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squidclamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squidclamav bypass=on
adaptation_access service_avi_resp allow all

genesislubrigas

Is there no solution to this problem ?

werwasw94

now it is working
i have installed pfsense from the scratch.
installing only squid-package (with dep)
activating claimav and it is working now (see attached squid.conf - file)

Unbenannt.GIF_thumb
laptopsq.txt

genesislubrigas

I wonder if snort or suricata breaks squid clamav or icap. The icap error occurs when i install snort and suricata but i dont know exactly if snort or suricata breaks it.

tohil

@werwasw94:

maybe the problem is in the squid.conf:

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all

and should be:

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squidclamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squidclamav bypass=on
adaptation_access service_avi_resp allow all

Same Here, have squid_clamav in the config.

is this a bug of the webgui Configurator?

tohil

@werwasw94:

now it is working
i have installed pfsense from the scratch.
installing only squid-package (with dep)
activating claimav and it is working now (see attached squid.conf - file)

I'had also Snort installed on my APU Board. do you think that snort can crash icap?

now I reinstalled my box from scratch again… no packeges installed and removed everthing from the XML... unsure, if i already should retry to install just squid...

tohil

hi

tested squid with clamav in a VM right now… also these ICAP protocol errors, when i try to surf some pages.
no ramdisk

regards

genesislubrigas

Is there an update fix to this icap error ?

tohil

there is a comment in the icap package -> it is currently not mainainted. a volunteer is needed

genesislubrigas

if there is only a step by step procedure how to maintain it, i will volunteer.