A bug when Host header contain IPv6 address

Server NGINX
1

For a request with an IPv6 Host header like:

Host: Host: [2001:250:1800:1::88]

The function “ngx_http_validate_host” will consider the trailing “:88]”
as a port number and trim it. Therefore the value of
“r->headers_in.server” and “$host” will become:

[2001:250:1800:1:

Test (in Nginx - 1.1.1):
Test config:

 listen [::]:80
 location / {
       add_header MYHEADER $host;
       return 200;
 }

Test input:

telnet 2001:250:1800:1::88
Trying 2001:250:1800:1::88…
Connected to 2001:250:1800:1::88.
Escape character is ‘^]’.
GET / HTTP/1.0
Host: [2001:250:1800:1::88]

Test output:

HTTP/1.1 200 OK
Server: nginx/1.0.3
Date: Wed, 24 Aug 2011 12:11:07 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: close
MYHEADER: [2001:250:1800:1:

Posted at Nginx Forum:

2

A patch has been submitted in nginx-devel maillist, please review. After
the fix, the test result is:

telnet 2001:250:1800:1::88
Trying 2001:250:1800:1::88…
Connected to 2001:250:1800:1::88.
Escape character is ‘^]’.
GET / HTTP/1.0
Host: [2001:250:1800:1::88]

HTTP/1.1 200 OK
Server: nginx/1.1.1
Date: Wed, 24 Aug 2011 12:26:00 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: close
MYHEADER: [2001:250:1800:1::88]

Posted at Nginx Forum:

3

Hello!

On Wed, Aug 31, 2011 at 03:37:28AM -0400, speedfirst wrote:

For a request with an IPv6 Host header like:

Host: Host: [2001:250:1800:1::88]

The function “ngx_http_validate_host” will consider the trailing “:88]”
as a port number and trim it. Therefore the value of
“r->headers_in.server” and “$host” will become:

This is a known problem, please see

http://trac.nginx.org/nginx/ticket/1

The same applies to the patch submitted.

Maxim D.

4

Thanks. the general idea of that patch is similar to mine but better. So
I’ll apply it.

If you can tell me why you feel that patch is not enough, I can help to
improve it.

Posted at Nginx Forum: