- updated to 2.5.STABLE13

[packages/squid.git] / squid-2.5.STABLE7-wccp_denial_of_service.patch

Index: squid/src/wccp.c
diff -c squid/src/wccp.c:1.19.2.5 squid/src/wccp.c:1.19.2.6
*** squid/src/wccp.c:1.19.2.5	Thu Oct 24 12:51:14 2002
--- squid/src/wccp.c	Tue Jan 11 23:07:12 2005
***************
*** 245,250 ****
--- 245,260 ----
  	return;
      if (ntohl(wccp_i_see_you.type) != WCCP_I_SEE_YOU)
  	return;
+     if (ntohl(wccp_i_see_you.number) > WCCP_ACTIVE_CACHES) {
+ 	debug(80, 1) ("Ignoring WCCP_I_SEE_YOU from %s with number of caches set to %d\n",
+ 	    inet_ntoa(from.sin_addr), (int) ntohl(wccp_i_see_you.number));
+ 	return;
+     }
+     if (ntohl(wccp_i_see_you.number) <= 0) {
+ 	debug(80, 1) ("Ignoring WCCP_I_SEE_YOU from %s with non-positive number of caches\n",
+ 	    inet_ntoa(from.sin_addr));
+ 	return;
+     }
      if ((0 == change) && (number_caches == ntohl(wccp_i_see_you.number))) {
  	if (last_assign_buckets_change == wccp_i_see_you.change) {
  	    /*
***************
*** 274,280 ****
--- 284,294 ----
  wccpLowestIP(void)
  {
      int loop;
+     /*
+      * We sanity checked wccp_i_see_you.number back in wccpHandleUdp()
+      */
      for (loop = 0; loop < ntohl(wccp_i_see_you.number); loop++) {
+ 	assert(loop < WCCP_ACTIVE_CACHES);
  	if (wccp_i_see_you.wccp_cache_entry[loop].ip_addr.s_addr < local_ip.s_addr)
  	    return 0;
      }
***************
*** 311,318 ****
  
      debug(80, 6) ("wccpAssignBuckets: Called\n");
      number_caches = ntohl(wccp_i_see_you.number);
!     if (number_caches > WCCP_ACTIVE_CACHES)
! 	number_caches = WCCP_ACTIVE_CACHES;
      wab_len = sizeof(struct wccp_assign_bucket_t);
      cache_len = WCCP_CACHE_LEN * number_caches;
  
--- 325,332 ----
  
      debug(80, 6) ("wccpAssignBuckets: Called\n");
      number_caches = ntohl(wccp_i_see_you.number);
!     assert(number_caches > 0);
!     assert(number_caches <= WCCP_ACTIVE_CACHES);
      wab_len = sizeof(struct wccp_assign_bucket_t);
      cache_len = WCCP_CACHE_LEN * number_caches;