------------------------------------------------------------
revno: 14039
revision-id: squid3@treenet.co.nz-20160502105118-439bpj8scun54k2d
parent: squid3@treenet.co.nz-20160502033935-ne2aqlnch2asje28
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4501
committer: Amos Jeffries <squid3@treenet.co.nz>
branch nick: 3.5
timestamp: Mon 2016-05-02 22:51:18 +1200
message:
  Bug 4501: HTTP/1.1: normalize Host header
  
  When absolute-URI is provided Host header should be ignored. However some
  code still uses Host directly so normalize it using the URL authority
  value before doing any further request processing.
  
  For now preserve the case where Host is completely absent. That matters
  to the CVE-2009-0801 protection.
  
  This also has the desirable side effect of removing multiple or duplicate
  Host header entries, and invalid port values.
------------------------------------------------------------
# Bazaar merge directive format 2 (Bazaar 0.90)
# revision_id: squid3@treenet.co.nz-20160502105118-439bpj8scun54k2d
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
# testament_sha1: 6fa669fa7a2f64254798c5231a1198b9e61f928f
# timestamp: 2016-05-02 11:50:55 +0000
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
# base_revision_id: squid3@treenet.co.nz-20160502033935-\
#   ne2aqlnch2asje28
# 
# Begin patch
=== modified file 'src/client_side.cc'
--- src/client_side.cc	2016-04-19 15:04:09 +0000
+++ src/client_side.cc	2016-05-02 10:51:18 +0000
@@ -2661,6 +2661,20 @@
             clientProcessRequestFinished(conn, request);
             return;
         }
+
+        // when absolute-URI is provided Host header should be ignored. However
+        // some code still uses Host directly so normalize it.
+        // For now preserve the case where Host is completely absent. That matters.
+        if (request->header.has(HDR_HOST)) {
+            const char *host = request->header.getStr(HDR_HOST);
+            SBuf authority(request->GetHost());
+            if (request->port != urlDefaultPort(request->url.getScheme()))
+                authority.appendf(":%d", request->port);
+            debugs(33, 5, "URL domain " << authority << " overrides header Host: " << host);
+            // URL authority overrides Host header
+            request->header.delById(HDR_HOST);
+            request->header.putStr(HDR_HOST, authority.c_str());
+        }
     }
 
     // Some blobs below are still HTTP-specific, but we would have to rewrite