squid_forgery.patch

--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -544,6 +544,16 @@
                 return;
             }
             debugs(85, 3, HERE << "validate IP " << clientConn->local << " non-match from Host: IP " << ia->in_addrs[i]);
+   }
+
+        if (true) {
+            unsigned short port = clientConn->local.port();
+            debugs(85, 3, HERE << "[anti-forgery] Host-non-matched remote IP (" << clientConn->local << ") was replaced with the first Host resolved IP (" << ia->in_addrs[0] << ":" << clientConn->local.port() << ")");
+            clientConn->local = ia->in_addrs[0];
+            clientConn->local.port(port);
+            http->request->flags.hostVerified = true;
+            http->doCallouts();
+            return;
         }
     }
     debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");