Nginx lense parsing issue related to empty string value

[erthmeld]

I'm running into a parsing issue with the Nginx documented solution for dropping traffic that contains an empty Host header.

Nginx Request processing documentation

If requests without the “Host” header field should not be allowed, a server that just drops the requests can be defined:

        server {
            listen      80;
            server_name "";
            return      444;
        }

Here, the server name is set to an empty string that will match requests without the “Host” header field, and a special nginx’s non-standard code 444 is returned that closes the connection.

I've identified the point of failure parsing the conf file based on manually running augtool with the get parameter.

/augeas/files/etc/nginx/nginx.conf
/augeas/files/etc/nginx/nginx.conf/path = "/files/etc/nginx/nginx.conf"
/augeas/files/etc/nginx/nginx.conf/mtime = "1579129215"
/augeas/files/etc/nginx/nginx.conf/lens = "Nginx.lns"
/augeas/files/etc/nginx/nginx.conf/lens/info = "/usr/share/augeas/lenses/dist/nginx.aug:121.10-.52:"
/augeas/files/etc/nginx/nginx.conf/error = "parse_failed"
/augeas/files/etc/nginx/nginx.conf/error/pos = "2164"
/augeas/files/etc/nginx/nginx.conf/error/line = "67"
/augeas/files/etc/nginx/nginx.conf/error/char = "14"
/augeas/files/etc/nginx/nginx.conf/error/lens = "/usr/share/augeas/lenses/dist/nginx.aug:121.10-.52:"
/augeas/files/etc/nginx/nginx.conf/error/message = "Syntax error"

Line in question:
server_name "";

I recall seeing other issues related to quote characters as I was trying to resolve this initially, and initially believed it may be similar to this issue.

[raphink]

There seems to be two issues here actually:

• the word server gets special parsing in this context, so server_name fails to parse
• a value of "" cannot be parsed at the moment

I've looked into it and it doesn't seem simple to fix with the code as it is now.

[erthmeld]

Thanks for the response, I'd be amazed if server_name parameter fails to parse wholesale. It's literally the primary identifier for an nginx virtual server, and the underlying means of routing same port traffic to different http endpoints. If that parameter was unable to be parsed/configured via augeas with the nginx lens it would be almost useless in any production configuration.

That said, given that the empty quotes can't be parsed the above is moot in terms of my specific issue. Sounds like a good old fashioned sed -i is in my near future on this one. Cheers.

[raphink]

If you want this implemented in Augeas, you can also send me an email and we'll see what we can do.

[erthmeld]

Thanks, I'll shoot you an email as well. It's a minor issue from an nginx security standpoint but under the wrong circumstances not performing the empty host header rejection can cause an internal IP exposure risk. I believe we have a workaround that doesn't require the empty servername block but it's unnecessarily complicated.