c-icap service does not start

[gsanchietti]

EPEL has released the following new RPMS:

• c-icap-libs-0.5.11-13.20230621git7a7b929.el7.x86_64
• c-icap-0.5.11-13.20230621git7a7b929.el7.x86_64

These packages override existing ones available inside nethserver-update repository.

Steps to reproduce

• Install a machine with web proxy and antivirus enabled, but make sure to have the following c-icap RPMS: c-icap-libs-0.5.2-1.ns7.x86_64 and c-icap-0.5.11-13.20230621git7a7b929.el7.x86_64:

  yum --disablerepo=epel install nethserver-squidclamav
  

• Update the machine from EPEL and make sure to have the new c-icap pckages

Expected behavior

The c-icap service must be up&running and correctly scan files.

Actual behavior

1. the c-icap service doesn't start, to start it again execute:

   rm -f /var/log/c-icap/server.log /var/run/c-icap/*
   systemctl start c-icap
   

2. the c-icap service doesn't filter virus file and dies with an error like this one from /var/log/messages:

   kernel: traps: c-icap[15347] trap divide error ip:419fac sp:7fffe62d6a98 error:0 in c-icap[400000+2e000]
   

[nethbot]

in 7.9.2009/testing:

• squidclamav-6.16-2.ns7.x86_64.rpm x86_64

[nethbot]

in 7.9.2009/testing:

• nethserver-squidclamav-3.1.1-1.3.g71054b0.ns7.noarch.rpm x86_64 armhfp aarch64

[gsanchietti]

Test case

• Update a machine where c-icap is not running
• Verify c-icap is started
• Verify c-icap can identify EICAR test file:

  cd /tmp
  wget https://secure.eicar.org/eicar.com.txt c-icap-client -f eicar.com.txt -s "squidclamav?allow204=on&force=on&sizelimit=off&mode=simple" -v
  

  The above command should return something similar to:

  ICAP HEADERS:
   ICAP/1.0 200 OK
   Server: C-ICAP/master-7a7b929
   Connection: keep-alive
   ISTag: "CI0001-1-squidclamav-10"
   X-Virus-ID: Eicar-Test-Signature.UNOFFICIAL
   X-Infection-Found: Type=0; Resolution=2; Threat=Eicar-Test-Signature.UNOFFICIAL;
   Encapsulated: res-hdr=0, res-body=475
  
  RESPMOD HEADERS:
   HTTP/1.0 307 Temporary Redirect
   Location: http://192.168.4.166/cgi-bin/nethserver-block.cgi?url=(null)&source=(null)&user=(null)&virus=stream: Eicar-Test-Signature.UNOFFICIAL FOUND
   Server: C-ICAP
   Connection: close
   Content-Type: text/html
   Content-Language: en
   X-Virus-ID: Eicar-Test-Signature.UNOFFICIAL
   X-Infection-Found: Type=0; Resolution=2; Threat=Eicar-Test-Signature.UNOFFICIAL;
   Via: ICAP/1.0 nethserver (C-ICAP/master-7a7b929 SquidClamav/Antivirus service )
  

[mamengoni]

Tested and verified.

[nethbot]

in 7.9.2009/updates:

• squidclamav-6.16-2.ns7.x86_64.rpm x86_64

[nethbot]

in 7.9.2009/updates:

• nethserver-squidclamav-3.1.2-1.ns7.noarch.rpm x86_64 armhfp aarch64

[filippocarletti]

[root@nethsec7 ~]# rpm -qa | grep -E "squidclam|icap"
nethserver-c-icap-1.1.1-1.ns7.noarch
c-icap-libs-0.5.2-1.ns7.x86_64
c-icap-0.5.2-1.ns7.x86_64
nethserver-squidclamav-3.1.1-1.ns7.noarch
squidclamav-6.16-1.ns7.x86_64

c-icap   25775     1  9 12:38 ?        00:00:00 /usr/sbin/clamd -c /etc/clamd.d/squidclamav.conf
root     26608     1  0 12:38 ?        00:00:00 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
root     26609 26608  0 12:38 ?        00:00:00 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
root     26610 26608  0 12:38 ?        00:00:00 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
root     26611 26608  0 12:38 ?        00:00:00 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf

[root@nethsec7 ~]# ls -la /var/run/clamd.squidclamav/
total 4
drwxr-xr-x  2 c-icap c-icap   80 Aug 23 12:38 .
drwxr-xr-x 43 root   root   1280 Aug 23 12:36 ..
-rw-rw-r--  1 root   root      6 Aug 23 12:38 clamd.pid
srw-rw-rw-  1 c-icap c-icap    0 Aug 23 12:38 clamd.sock

[root@nethsec7 ~]# ls -la /var/run/c-icap/
total 4
drwxr-x---  2 c-icap c-icap   80 Aug 23 12:38 .
drwxr-xr-x 43 root   root   1280 Aug 23 12:36 ..
prw--w----  1 root   root      0 Aug 23 12:38 c-icap.ctl
-rw-r--r--  1 root   root      5 Aug 23 12:38 c-icap.pid

[root@nethsec7 ~]# ls -la /var/log/c-icap/
total 12
drwxr-x---   2 c-icap c-icap   24 Aug 23 12:38 .
drwxr-xr-x. 20 root   root   8192 Aug 23 11:01 ..
-rw-r--r--   1 root   root      0 Aug 23 12:38 server.log

Dependency Installed:
  lmdb-libs.x86_64 0:0.9.22-2.el7                                                                                                   

Updated:
  c-icap.x86_64 0:0.5.11-13.20230621git7a7b929.el7                                                                                  

Dependency Updated:
  c-icap-libs.x86_64 0:0.5.11-13.20230621git7a7b929.el7                                                                             

Complete!
[root@nethsec7 ~]# systemctl status c-icap
● c-icap.service - c-icap is an implementation of an ICAP server
   Loaded: loaded (/usr/lib/systemd/system/c-icap.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/c-icap.service.d
           └─squidclamav.conf
   Active: failed (Result: exit-code) since Wed 2023-08-23 12:40:26 UTC; 7s ago
  Process: 27476 ExecStart=/usr/sbin/c-icap -f /etc/c-icap/c-icap.conf (code=exited, status=255)
 Main PID: 27476 (code=exited, status=255)

Aug 23 12:40:26 nethsec7.neth.net systemd[1]: Started c-icap is an implementation of an ICAP server.
Aug 23 12:40:26 nethsec7.neth.net systemd[1]: c-icap.service: main process exited, code=exited, status=255/n/a
Aug 23 12:40:26 nethsec7.neth.net systemd[1]: Unit c-icap.service entered failed state.
Aug 23 12:40:26 nethsec7.neth.net systemd[1]: c-icap.service failed.

Updated:
  nethserver-squidclamav.noarch 0:3.1.1-1.2.pr11.g47d1460.ns7                    squidclamav.x86_64 0:6.16-2.ns7                   

Complete!
[root@nethsec7 ~]# systemctl status c-icap
● c-icap.service - c-icap is an implementation of an ICAP server
   Loaded: loaded (/usr/lib/systemd/system/c-icap.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/c-icap.service.d
           └─squidclamav.conf
   Active: active (running) since Wed 2023-08-23 12:43:51 UTC; 23s ago
 Main PID: 28490 (c-icap)
   CGroup: /system.slice/c-icap.service
           ├─28490 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
           ├─28491 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
           ├─28492 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf
           └─28493 /usr/sbin/c-icap -f /etc/c-icap/c-icap.conf

Aug 23 12:43:51 nethsec7.neth.net systemd[1]: Starting c-icap is an implementation of an ICAP server...
Aug 23 12:43:51 nethsec7.neth.net systemd[1]: Started c-icap is an implementation of an ICAP server.

[root@nethsec7 ~]# ls -la /var/run/c-icap/
total 4
drwxr-xr-x  2 c-icap c-icap   80 Aug 23 12:43 .
drwxr-xr-x 43 root   root   1280 Aug 23 12:43 ..
prw-------  1 c-icap c-icap    0 Aug 23 12:43 c-icap.ctl
-rw-r--r--  1 c-icap c-icap    5 Aug 23 12:43 c-icap.pid

[root@nethsec7 ~]# rpm -qa | grep -E "squidclam|icap"
nethserver-squidclamav-3.1.1-1.2.pr11.g47d1460.ns7.noarch
nethserver-c-icap-1.1.1-1.ns7.noarch
squidclamav-6.16-2.ns7.x86_64
c-icap-0.5.11-13.20230621git7a7b929.el7.x86_64
c-icap-libs-0.5.11-13.20230621git7a7b929.el7.x86_64