Bug 3325: option to selectively enable strict host verify checks.

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 079607ce00ccfb0b68450b648f899e0ef4998f32..5fd1c786602a70bdc7353135547c6a2656c4777a 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1777,6 +1777,23 @@ DOC_START
 
 DOC_END
 
+NAME: host_verify_strict
+TYPE: onoff
+DEFAULT: off
+LOC: Config.onoff.hostStrictVerify
+DOC_START
+       By default Squid performs Host vs IP this validation on intercept
+       and tproxy traffic.
+       
+       This option enables additional strict validation comparisons on
+       forward-proxy and reverse-proxy traffic passing through Squid.
+       
+       These additional texts involve textual domain comparison of the
+       authority form URL found in the request-URL and Host: header. To
+       ensure that the client sends a consistent Host header for the
+       destination server with the URL.
+DOC_END
+
 NAME: client_dst_passthru
 TYPE: onoff
 DEFAULT: on

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index f4da4d49b69661e2fdeebb3ed49bf8ffe650362a..3d77176d99e0513b519635853338728f4ab5a5a0 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -634,6 +634,9 @@ ClientRequestContext::hostHeaderVerify()
             // verify the destination DNS is one of the Host: headers IPs
             ipcache_nbgethostbyname(host, hostHeaderIpVerifyWrapper, this);
         }
+    } else if (Config.onoff.hostStrictVerify) {
+        debugs(85, 3, HERE << "validate skipped.");
+        http->doCallouts();
     } else if (strlen(host) != strlen(http->request->GetHost())) {
         // Verify forward-proxy requested URL domain matches the Host: header
         debugs(85, 3, HERE << "FAIL on validate URL domain length " << http->request->GetHost() << " matches Host: " << host);

diff --git a/src/structs.h b/src/structs.h
index 884786d421afc8d21bee4e531eb6bed71b2853fc..4cce1004ab45ad1bf932a393091205c79b72f73f 100644 (file)
--- a/src/structs.h
+++ b/src/structs.h
@@ -460,6 +460,7 @@ struct SquidConfig {
         int WIN32_IpAddrChangeMonitor;
         int memory_cache_first;
         int memory_cache_disk;
+        int hostStrictVerify;
         int client_dst_passthru;
     } onoff;