Do not allow client_ip_max_connections+1 connections (#2168)

Previously, setting client_ip_max_connections to a non-negative N would
allow N+1 client connections, due to an off-by-one error.

diff --git a/doc/release-notes/release-7.sgml.in b/doc/release-notes/release-7.sgml.in
index e1f6b985e58808dbcf332df1088ddb8d6cf92f07..b0075b3428c83b2ae65b0c8975cb9c8f365b1e70 100644 (file)
--- a/doc/release-notes/release-7.sgml.in
+++ b/doc/release-notes/release-7.sgml.in
@@ -184,6 +184,14 @@ This section gives an account of those changes in three categories:
        <p>Removed the <em>non_peers</em> action. See the Cache Manager
        <ref id="mgr" name="section"> for details.
 
+
+       <tag>client_ip_max_connections</tag>
+       <p>Fixed off-by-one enforcement. Squid now allows at most <em>N</em>
+       concurrent connections per client IP (not <em>N</em>+1), where <em>N</em>
+       is the configured directive value. Deployments that relied on the extra
+       connection should increase the configured limit by one to preserve
+       previous behavior.
+
        <tag>dns_packet_max</tag>
        <p>Honor positive <em>dns_packet_max</em> values when sending DNS A queries
        and PTR queries containing IPv4 addresses. Prior to this change, Squid did

diff --git a/src/comm/TcpAcceptor.cc b/src/comm/TcpAcceptor.cc
index 094fa3a52de0ba7f6af5cd3da2098efca1e0ee7f..4cf8d4896a75c40b3264ef954a7fbbbf4620e0c9 100644 (file)
--- a/src/comm/TcpAcceptor.cc
+++ b/src/comm/TcpAcceptor.cc
@@ -413,7 +413,7 @@ Comm::TcpAcceptor::acceptInto(Comm::ConnectionPointer &details)
     details->nfConnmark = Ip::Qos::getNfConnmark(details, Ip::Qos::dirAccepted);
 
     if (Config.client_ip_max_connections >= 0) {
-        if (clientdbEstablished(details->remote, 0) > Config.client_ip_max_connections) {
+        if (clientdbEstablished(details->remote, 0) >= Config.client_ip_max_connections) {
             debugs(50, DBG_IMPORTANT, "WARNING: " << details->remote << " attempting more than " << Config.client_ip_max_connections << " connections.");
             return false;
         }