@@ -86,6 +86,44 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
8686 return NGX_HTTP_INTERNAL_SERVER_ERROR ;
8787 }
8888
89+ #if defined(MODSECURITY_CHECK_VERSION )
90+ #if MODSECURITY_VERSION_NUM >= 30130100
91+ ngx_str_t hostname ;
92+ // first check if Nginx received a Host header and it's usable
93+ // (i.e. not empty)
94+ // if yes, we can use that
95+ if (r -> headers_in .server .len > 0 ) {
96+ hostname .len = r -> headers_in .server .len ;
97+ hostname .data = r -> headers_in .server .data ;
98+ }
99+ else {
100+ // otherwise we try to use the server config, namely the
101+ // server_name $SERVER_NAME
102+ // directive
103+ // for eg. in default config, server_name is "_"
104+ // possible all requests without a Host header will be
105+ // handled by this server block
106+ ngx_http_core_srv_conf_t * cscf ;
107+ cscf = ngx_http_get_module_srv_conf (r , ngx_http_core_module );
108+ if (cscf -> server_name .len > 0 ) {
109+ hostname .len = cscf -> server_name .len ;
110+ hostname .data = cscf -> server_name .data ;
111+ }
112+ }
113+ if (hostname .len > 0 ) {
114+ const char * host_name = ngx_str_to_char (hostname , r -> pool );
115+ if (host_name == (char * )-1 || host_name == NULL ) {
116+ return NGX_HTTP_INTERNAL_SERVER_ERROR ;
117+ }
118+ else {
119+ // set the hostname in the transaction
120+ // this function is only available in ModSecurity 3.0.13 and later
121+ msc_set_request_hostname (ctx -> modsec_transaction , (const unsigned char * )host_name );
122+ }
123+ }
124+ #endif
125+ #endif
126+ 89127 ngx_str_t s ;
90128 u_char addr [NGX_SOCKADDR_STRLEN ];
91129 s .len = NGX_SOCKADDR_STRLEN ;
0 commit comments