It is possible that a ProxySG enabled for ICAP processing could restart spontaneously when encountering and attempting to process Literal Address IPv6 URLs.
This issue is a result of an error in parsing the bracketed format of the hostname part of an IPv6 URL.
The bracketed syntax is a valid syntax as stated in RFC: 2732. In the section of the RFC entitled “Format for Literal IPv6 Addresses in URLs”, it is specified that “To use a literal IPv6 address in a URL, the literal address should be enclosed in "[" and "]" characters.
This results in URLs with a format of http[s]://[host name or host ip]/path
When encountering this URL type and trying to access the file for ICAP transmission, the ProxySG will restart. The signature of the crash dump file (mini-context, context, or full) will be something of the following nature.
PF in HTTP SW BF1E5EC0 for BFB2BEC0" in "ce_admin.dll"
You can look at the crash dump signature in your sysinfo file, by looking at the URL https://<proxy name> or <proxy_ip>:8082/sysinfo. Search for “Minicontext”.
It may not be immediately obvious that the data stream contains such a URL, since it is likely served from a server within an HTML response. This also makes it difficult to locate the offending URL except via a packet trace or core dump analysis.
Increased use of IPv6 and of embedding literal IPV6 URLs in web pages will make this issue more likely to occur over time.