[squid-users] Squid + ecap + clamav

[Alex Rousskov]

On 2024-09-29 12:40, Andrea Venturoli wrote:

> I've been using Squid + C-icap + SquidClamAV + ClamAV for a long time in 
> order to filter web content.
> However this has lately been troublesome, leading to occasional 
> hard-to-diagnose temporary failures ("ICAP protocol error").

> So I'm pondering moving from ICAP to eCAP, like described here:
>> https://wiki.squid-cache.org/ConfigExamples/ContentAdaptation/EcapForClamav

eCAP and ICAP options offer different tradeoffs (i.e. have a different 
set of pros and cons).


> According to that page there are no disadvantages wrt to the previous 
> config.

Disadvantages of using eCAP+ClamAV adapter include being dependent on a 
relatively old libecap and ClamAV eCAP adapter implementation. If things 
go wrong or if you want new features, fewer folks would be able to help 
you compared to a better known ICAP protocol and (more recently updated) 
c-icap server.


> However, I tried compiling the eCAP ClamAV adapter, but the code looks 
> very outdated WRT to C++ standards

Yes, both libecap and eCAP ClamAV adapter were last updated in 2015.


> and possibly 
> also to ClamAV (giving compiling errors due to missing symbols).

If libclamav API has changed in backward incompatible ways, then eCAP 
ClamAV adapter source code would have to be updated to reflect those API 
changes. Unfortunately, I have not recorded what ClamAV version we were 
using when eCAP ClamAV adapter was developed.


> Is this info still relevant?
 > Is this something worth investigating or is it outdated/deprecated?


I would treat that ConfigExamples page as an old configuration example 
that probably worked for the author when that page was written years 
ago. It can be used as a starting point for getting things working in 
your environment. Nothing more, nothing less.


HTH,

Alex.