@@ -86,6 +86,45 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
8686 return NGX_HTTP_INTERNAL_SERVER_ERROR ;
8787 }
8888
89+ #if defined(MODSECURITY_CHECK_VERSION )
90+ #if MODSECURITY_VERSION_NUM >= 30130100
91+ ngx_str_t hostname ;
92+ hostname .len = 0 ;
93+ // first check if Nginx received a Host header and it's usable
94+ // (i.e. not empty)
95+ // if yes, we can use that
96+ if (r -> headers_in .server .len > 0 ) {
97+ hostname .len = r -> headers_in .server .len ;
98+ hostname .data = r -> headers_in .server .data ;
99+ }
100+ else {
101+ // otherwise we try to use the server config, namely the
102+ // server_name $SERVER_NAME
103+ // directive
104+ // for eg. in default config, server_name is "_"
105+ // possible all requests without a Host header will be
106+ // handled by this server block
107+ ngx_http_core_srv_conf_t * cscf ;
108+ cscf = ngx_http_get_module_srv_conf (r , ngx_http_core_module );
109+ if (cscf -> server_name .len > 0 ) {
110+ hostname .len = cscf -> server_name .len ;
111+ hostname .data = cscf -> server_name .data ;
112+ }
113+ }
114+ if (hostname .len > 0 ) {
115+ const char * host_name = ngx_str_to_char (hostname , r -> pool );
116+ if (host_name == (char * )-1 || host_name == NULL ) {
117+ return NGX_HTTP_INTERNAL_SERVER_ERROR ;
118+ }
119+ else {
120+ // set the hostname in the transaction
121+ // this function is only available in ModSecurity 3.0.13 and later
122+ msc_set_request_hostname (ctx -> modsec_transaction , (const unsigned char * )host_name );
123+ }
124+ }
125+ #endif
126+ #endif
127+ 89128 ngx_str_t s ;
90129 u_char addr [NGX_SOCKADDR_STRLEN ];
91130 s .len = NGX_SOCKADDR_STRLEN ;
0 commit comments