[squid-users] ICAP Error while downloading some java script files like https://aproxy.ksgct.de/js/srp.js

[Alex Rousskov]

On 2026-03-17 03:04, Dieter Bloms wrote:
> Hello,
> 
> I run squid 7.5 on debian trixie as follow:
> 
> --snip--
> Squid Cache: Version 7.5
> Service Name: squid
> 
> This binary uses OpenSSL 3.5.5 27 Jan 2026. configure options:  '--prefix=/usr' '--sysconfdir=/etc/squid' '--bindir=/usr/sbin' '--sbindir=/usr/sbin' '--localstatedir=/var' '--libexecdir=/usr/sbin' '--datadir=/usr/share/squid' '--mandir=/usr/share/man' '--with-default-user=squid' '--with-filedescriptors=131072' '--with-logdir=/var/log/squid' '--disable-auto-locale' '--disable-eui' '--disable-carp' '--disable-htcp' '--disable-ident-lookups' '--disable-translation' '--disable-wccp' '--disable-wccpv2' '--disable-arch-native' '--disable-auth-negotiate' '--disable-auth-ntlm' '--enable-async-io=128' '--enable-auth-basic=LDAP,NCSA' '--enable-auth-digest=file,LDAP' '--enable-epoll' '--enable-log-daemon-helpers=file' '--enable-icap-client' '--enable-inline' '--enable-snmp' '--enable-disk-io=AIO,DiskThreads,IpcIo,Blocking' '--enable-storeio=ufs,aufs,rock' '--enable-referer-log' '--enable-useragent-log' '--enable-large-cache-files' '--enable-removal-policies=lru,heap' '--enable-follow-x-forwarded-for' '--enable-ssl-crtd' '--with-openssl' 'CFLAGS=-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -ffile-prefix-map=/=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection'
> --snip--
> 
> It's working very well, but sometimes (very rarely) the ICAP error page ERR_ICAP_FAILURE is displayed.
> I've created network dumps and also run Squid in debug mode.
> It looks to me as though Squid isn’t sending all the data to the ICAP scanner,
> causing it to terminate the connection after the configured 5-minute timeout.
> I’ve tried two ICAP virus scanners (c-icap and Avira ICAP Proxy https://oem.avira.com/en/solutions/anti-malware#ICAP),
> and both exhibited the same behavior.
> 
> Is this a known issue, or should I file a bug report?

FWIW, my quick search did not find any recently changed ICAP bugs with 
similar symptoms. I can volunteer to look through your debugging 
cache.log if you can share a pointer to a compressed file with me, 
privately if needed. I prefer ALL,9 logs from the affected worker, but 
will look at what you have.


HTH,

Alex.