rschwend/ubuntu-c_icap_client repository overview

⁠Ubuntu c-icap-client Docker Image

⁠Description

This image provides a lightweight c-icap client based on Ubuntu Jammy (22.04). It is designed to interact with ICAP servers for testing, debugging, or integrating ICAP-based content adaptation workflows.

The container includes the c-icap-client utility and the required dependencies from the Ubuntu Jammy repositories, offering a simple and reliable environment to send ICAP requests to compatible servers.

⁠Features

• Based on Ubuntu 22.04 (Jammy Jellyfish)
• Includes the c-icap-client tool
• Quick start: cd /usr/local/c-icap/bin && ./c-icap-client
• Suitable for testing and debugging ICAP servers
• Minimal and easy to integrate into CI/CD pipelines or containerized environments

⁠Typical Use Cases

• Testing ICAP services
• Debugging ICAP request/response flows
• Integration testing with proxies or security gateways

⁠Quick Start

Credentials:

• User: root
• Password: root

⁠Docker Run

docker run -d \
  --name ubuntu-c_icap_client \
  --hostname ubuntu-c_icap_client \
  -p 2022:22 \
  --restart on-failure \
  rschwend/ubuntu-c_icap_client:latest

⁠Docker Pull

docker pull rschwend/ubuntu-c_icap_client:latest

⁠Docker Compose

services:
  ubuntu-c_icap_client:
    image: rschwend/ubuntu-c_icap_client:latest
    hostname: ubuntu-c_icap_client
    container_name: ubuntu-c_icap_client
    ports:
      - "2022:22"
    restart: on-failure
    networks:
      - ubuntu-c_icap_client
    volumes:
      - Transfer:/tmp

volumes:
  Transfer:
    external: true

networks:
  ubuntu-c_icap_client:
    driver: bridge

Optimized for copy&paste experience with SSH port forwarding enabled on port 2022.

⁠c-icap-client: REQ Mode vs. RESP Mode

⁠Difference in the ICAP Protocol

The difference in the ICAP protocol (Internet Content Adaptation Protocol) lies in the point at which web content is inspected or modified during data transmission. It is distinguished between REQMOD (Request Modification) and RESPMOD (Response Modification):

• REQMOD (Request Mode): The ICAP client sends the HTTP request from the user (before it reaches the web server) to the ICAP server.
• RESPMOD (Response Mode): The ICAP client sends the HTTP response from the web server (before it reaches the user) to the ICAP server.

⁠ICAP Request Mode (REQMOD / -req)

• Timing: Before a requested web page or file is loaded from the target server.
• Main Purpose: Check URLs, control access rights, or block requests.
• Advantage: If a page is blocked, no content is downloaded at all, which saves bandwidth.

Usage Example:

c-icap-client -i 192.168.1.100 -p 1344 -s REQ-Mode -f /tmp/upload.pdf -req

⁠ICAP Response Mode (RESPMOD / -resp)

• Timing: After the web server has sent the data, but before the user's browser displays it.
• Main Purpose: Scan downloaded files or web content for viruses (antivirus protection) or search for malware and data leaks.
• Advantage: The actual file content (payload) can be inspected afterwards and cleaned or stopped.

Usage Example:

c-icap-client -i 192.168.1.100 -p 1344 -s interscan -f /tmp/download.exe -resp

⁠Summary for File Scanning

⁠Usage Examples

⁠c-icap-client Parameters

⁠Example 1: Upload Scenario (REQ) – File is being uploaded

c-icap-client -i 192.168.1.100 -p 1344 -s REQ-Mode -f /tmp/upload.pdf -req

Simulates: Client uploads /tmp/upload.pdf → ICAP scans before upload to server

⁠Example 2: Download Scenario (RESP) – File is being downloaded

c-icap-client -i 192.168.1.100 -p 1344 -s interscan -f /tmp/download.exe -resp

Simulates: Server responds with file → ICAP scans before download to client

⁠Example 3: REQ Mode with Verbose Output

c-icap-client -i icap.example.com -p 1344 -s REQ-Mode -f /tmp/document.docx -req -v

⁠Example 4: RESP Mode Debug Mode

c-icap-client -h icap.internal -p 1344 -s interscan -f /tmp/response-file.bin -resp -d

⁠TrendAI Documentation

TrendAI related Filesecurity options and guidelines:

TrendAI Filesecurity - ICAP⁠