From: Amos Jeffries <squid3@treenet.co.nz>
Date: Thu, 5 Jun 2014 15:57:23 +0000 (-0700)
Subject: Fix error in rev.13417 "ssl_bump none" mode crashes squid
X-Git-Tag: SQUID_3_5_0_1~198
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bcf9fd86ee413ca0e5850cb71b25deb548cfb162;p=thirdparty%2Fsquid.git

Fix error in rev.13417 "ssl_bump none" mode crashes squid

The fake CONNECT request generated to relay non-bumped traffic needs to
be pre-pended to any existing data in the ConnStateData::In buffer.
Otherwise our new bytes will corrupt any traffic bytes already in there
and our intended CONNECT request will never be recognised as we re-parse
the buffer.
---

diff --git a/src/client_side.cc b/src/client_side.cc
index cd7b74df61..1e889e89e2 100644
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -3620,8 +3620,9 @@ httpsSslBumpAccessCheckDone(allow_t answer, void *data)
         // fake a CONNECT request to force connState to tunnel
         static char ip[MAX_IPSTRLEN];
         connState->clientConnection->local.toUrl(ip, sizeof(ip));
-        // XXX need to *pre-pend* this fake request to the TLS bits already in the buffer
-        connState->in.buf.append("CONNECT ").append(ip).append(" HTTP/1.1\r\nHost: ").append(ip).append("\r\n\r\n");
+        // Pre-pend this fake request to the TLS bits already in the buffer
+        SBuf retStr("CONNECT ").append(ip).append(" HTTP/1.1\r\nHost: ").append(ip).append("\r\n\r\n");
+        connState->in.buf = retStr.append(connState->in.buf);
         bool ret = connState->handleReadData();
         if (ret)
             ret = connState->clientParseRequests();