<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";
panose-1:2 11 5 3 3 4 3 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Arial",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Arial",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Hi all,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">I'm trying to integrate a Squid Cache version 3.5.20 for x86_64-redhat-linux-gnu with a Symantec Protection Engine 8.1 to do virus scaning in a reverse proxy setup.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">I do send all POST requests to our virus scan engine. But icap integration does not work as expected. Squid does send a OPTIONS request to the icap server.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">We get a valid answer from Symantec Protection Engine. But squid fails afterwards with a parsing exception:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">2020/08/26 10:04:54.590| 58,3| HttpMsg.cc(173) parse: HttpMsg::parse: failed to find end of headers (eof: 0) in 'ICAP/1.0 200 OK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Date: Wed Aug 26 08:04:54 2020 GMT<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Methods: REQMOD<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Service: Symantec Protection Engine/8.1.0.29<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Service-ID: SYMCSCANREQ-AV<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">ISTag: "0FF01DDE4872272B6F445AED8643888C"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-Definition-Info: 20200825.022<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Max-Connections: 32<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-Allow-Out: X-Outer-Container-Is-Mime, X-Infection-Found, X-Definition-Info, X-AV-License<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-Allow-Out: X-Violations-Found<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-Allow-Out: X-SYMANTEC-URL-Definition-Info, X-CAIC-URL-Definition-Info, X-SYMANTEC-URLReputation-Definition-Info, X-URL-License, X-URL-Reputation-License<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Allow: 204<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Options-TTL: 3600<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Preview: 4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Transfer-Preview: *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-AV-License: 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-URL-License: 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">X-URL-Reputation-License: 1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Does somebody has an idea what's going wrong here? Is this a known squid/icap bug?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Attached: log, config and tcpdumps from
</span><span lang="DE-CH">icap server 1 and 2 (squid does connect thru a loadbalancer to the icap server)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="DE-CH">IPs in the tcpdump: <o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="DE-CH">Squid has IP 10.64.7.145<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="DE-CH">ICAP Server has IP: 10.140.28.144<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="DE-CH"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="DE-CH">Relevant Time in squid.log: 2020/08/26 10:04:54 (= 2020/08/26 08:04:54 icap server time)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif">Thanks and kind regards,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"> Andy<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:3.0pt;margin-right:0cm;margin-bottom:3.0pt;margin-left:0cm">
<b><span lang="DE-CH" style="font-size:10.0pt;color:#103184">Andreas von Euw<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE-CH" style="font-size:9.0pt;mso-fareast-language:DE-CH"><br>
</span><span lang="DE-CH" style="font-size:10.0pt;font-family:"Source Sans Pro",sans-serif;mso-fareast-language:EN-GB">Java Dev Support<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="DE-CH" style="font-size:10.0pt;font-family:"Source Sans Pro",sans-serif;mso-fareast-language:EN-GB">AXA Group Operations<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH" style="font-size:10.0pt;color:#103184"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="DE-CH" style="font-size:10.0pt;color:#103184"><a href="mailto:andreas.voneuw@axa-tech.com">andreas.voneuw@axa.com</a>
</span><span lang="DE-CH" style="font-size:7.5pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-CH"><o:p> </o:p></span></p>
</div>
<DIV>
Ce message est confidentiel; Son contenu ne represente en aucun cas<BR>
un engagement de la part de AXA sous reserve de tout accord conclu<BR>
par ecrit entre vous et AXA. Toute publication, utilisation ou <BR>
diffusion, meme partielle, doit etre autorisee prealablement. Si<BR>
vous n'etes pas destinataire de ce message, merci d'en avertir <BR>
immediatement l'expediteur.<BR>
<BR>
This message is confidential; its contents do not constitute a<BR>
commitment by AXA except where provided for in a written agreement <BR>
between you and AXA. Any unauthorised disclosure, use or dissemi-<BR>
nation, either whole or partial, is prohibited. If you are not the<BR>
intended recipient of the message, please notify the sender imme-<BR>
diately.<BR>
</DIV></body>
</html>