# Is the 607418-ipv6-addresses.diff patch still needed? **URL:** \ **Category:** NGINX\ **Created:** [November 8, 2011, 12:06pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664 "2011-11-08T12:06:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [November 8, 2011, 12:06pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/1 "2011-11-08T12:06:01Z")
Hello, The current version of the debianized Nginx code applies the attached 607418-ipv6-addresses.diff patch. Do you still see any need to apply this patch to the current nginx\_1.1.7 code? Regards, M. ######## 607418-ipv6-addresses.diff patch follows ######## Description: $host variable mis-parses IPv6 literal addresses from HTTP Author: Steven C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Debian-Bug: [http://bugs.debian.org/607418](http://bugs.debian.org/607418) Last-Update: 2010-12-30 # Index: trunk/src/http/ngx\_http\_request.c — trunk.orig/src/http/ngx\_http\_request.c 2010-12-30 01:46:10.308926973 -0600 +++ trunk/src/http/ngx\_http\_request.c 2010-12-30 01:48:21.638927393 -0600 @@ -1650,11 +1650,12 @@ { u\_char \*h, ch; size\_t i, last; - ngx\_uint\_t dot; - ngx\_uint\_t dot, in\_brackets; - in\_brackets = 0; - ``` if (ch == ':') { ``` - ``` if (ch == '[' && i == 0) { ``` - ``` /* start of literal IPv6 address */ ``` - ``` in_brackets = 1; ``` - ``` continue; ``` - ``` } ``` - - ``` /* ``` - ``` * Inside square brackets, the colon is a delimeter for an ``` IPv6 address. - ``` * Otherwise it comes before the port number, so remove it. ``` - ``` */ ``` - ``` if (ch == ':' && !in_brackets) { last = i; continue; } ``` - ``` if (ch == ']') { ``` - ``` /* end of literal IPv6 address */ ``` - ``` in_brackets = 0; ``` - ``` continue; ``` - ``` } ``` - ``` if (ngx_path_separator(ch) || ch == '\0') { return 0; } ``` @@ -1684,6 +1701,11 @@ } } - if (in\_brackets) { - ``` /* missing the closing square bracket for IPv6 address */ ``` - ``` return 0; ``` - } - if (dot) { last–; } ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 12:18pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/2 "2011-11-08T12:18:27Z")
Hi Mark. I think it can be removed. I’m compiling the 1.1.7 packages without the patch, and I will test it after. If this patch is not needed anymore, I will apply the changes in the SVN. Thanks for this remark. On Tue, 8 Nov 2011 11:05:07 +0000, Mark A. wrote: > # M. > > ``` > h = *host; > > ``` > > - > > ``` > if (ch == '[' && i == 0) { > > ``` > > - > > ``` > if (ch == ':' && !in_brackets) { > if (ngx_path_separator(ch) || ch == '\0') { > > ``` > > - if (dot) { > last–; > } > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Cyril “Davromaniak” Lavier ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 12:25pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/3 "2011-11-08T12:25:17Z")
I just tested it. It seems to work without the patch. Thanks for this usefull remark. On Tue, 08 Nov 2011 12:17:43 +0100, Cyril LAVIER wrote: > Thanks for this remark. > > > Regards, > > > > - > > > > ``` > > * Otherwise it comes before the port number, so remove it. > > > > ``` > > > > - > > > > ``` > > } > > > > ``` > > > > - > > > > ``` > > return 0; > > > > ``` > > > > - } > > - if (dot) { > > last–; > > } > > > > * * * > > > > nginx mailing list > > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Cyril “Davromaniak” Lavier ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 1:01pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/4 "2011-11-08T13:01:26Z")
On Tue, 8 Nov 2011 11:52:11 +0000, Mark A. wrote: > a high security nginx-ultralight version. > –prefix=/etc/nginx > –without-http-cache > –without-http\_upstream\_keepalive\_module > –without-http\_userid\_module > –without-http\_uwsgi\_module > $(CONFIGURE\_OPTS) \>$@ > touch $@’ Could you open a Debian Bug on the source package nginx for this purpose ? I think it’s a good idea to have a special nginx build for all CMS related uses, but it needs to be discussed between the maintainers. Thanks. > Regards, > M. > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Cyril “Davromaniak” Lavier ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 2:01pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/5 "2011-11-08T14:01:36Z")
Hello! On Tue, Nov 08, 2011 at 11:05:07AM +0000, Mark A. wrote: > The current version of the debianized Nginx code applies the > attached 607418-ipv6-addresses.diff patch. > > Do you still see any need to apply this patch to the current > nginx\_1.1.7 code? See [#1 (Incorrect parsing of IPv6 literal in Host header) – nginx](http://trac.nginx.org/nginx/ticket/1). Maxim D. ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 2:15pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/6 "2011-11-08T14:15:52Z")
On 08-11-11 13:00, Cyril LAVIER wrote: > Could you open a Debian Bug on the source package nginx for this purpose ? > I think it’s a good idea to have a special nginx build for all CMS > related uses, but it needs to be discussed between the maintainers. +1 for wanting such a package 🙂 Kind regards, Thanks in advance, Jelle de Jong ---
**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\ **Post date:** [November 8, 2011, 12:52pm UTC](https://www.ruby-forum.com/t/is-the-607418-ipv6-addresses-diff-patch-still-needed/213664/7 "2011-11-08T12:52:43Z")
On Tue, 08 Nov 2011 12:24:40 +0100, Cyril LAVIER [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I just tested it. > It seems to work without the patch. > Thanks for this usefull remark. You are welcome. Although unrelated, I should note that there seems to be a market for a high security nginx-ultralight version. Such a version would be especially suited for those websites (most of the current CMS?) that process loads of fastcgi using php5-fpm and php-apc. I am attaching the debian/rules section that I have been using to get such ‘nginx-ultralight’ config.status.ultralight: config.env.ultralight config.sub config.guess \ cd $(BUILDDIR\_ultralight) && ./configure –prefix=/etc/nginx –conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-client-body-temp-path=/var/lib/nginx/body –http-fastcgi-temp-path=/var/lib/nginx/fastcgi –http-log-path=/var/log/nginx/access.log –http-proxy-temp-path=/var/lib/nginx/proxy –lock-path=/var/lock/nginx.lock –pid-path=/var/run/nginx.pid –with-http\_gzip\_static\_module –with-http\_ssl\_module –without-http-cache –without-http\_browser\_module –without-http\_geo\_module –without-http\_limit\_req\_module –without-http\_limit\_zone\_module –without-http\_map\_module –without-http\_memcached\_module –without-http\_referer\_module –without-http\_scgi\_module –without-http\_split\_clients\_module –without-http\_ssi\_module –without-http\_upstream\_keepalive\_module –without-http\_userid\_module –without-http\_uwsgi\_module $(CONFIGURE\_OPTS) \>$@ touch $@’ Regards, M.