owasp-modsecurity / owasp-modsecurity/ModSecurity
IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification")
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Description
On Windows, when a client connects to the ModSecurity IIS module from an
IPv6 link-local address (fe80::/10), rule processing fails with:
ModSecurity: IPmatch: bad IPv6 specification "fe80::186d:7ec:8f88:4a0a%6".
ModSecurity: Rule processing failed (id=905110, msg=).
Any rule that matches against REMOTE_ADDR / client IP (e.g. id=905110) is
affected for such clients.
Root cause
In iis/mymodule.cpp, GetIpAddr() converts the client sockaddr to a string
with GetNameInfo(..., NI_NUMERICHOST). On Windows, GetNameInfo appends the
IPv6 zone/scope identifier ("%") to link-local addresses,
because sin6_scope_id is the interface index for fe80::/10 addresses
(Microsoft docs: "fe80::208:74ff:feda:625c%5").
ModSecurity's IP-match parser only accepts plain RFC 4291 addresses and
rejects the "%6" zone suffix, so the rule aborts.
Impact
False rule-processing failures (and effectively bypassed IP-based rules)
for any client arriving over a link-local IPv6 address on Windows/IIS.
Fix
Strip the "%" suffix from the textual IP passed to ModSecurity in
GetIpAddr(). The binary address (sin6_addr) used for the socket is
unchanged, and the zone id is irrelevant for IP matching.
See PR: https://github.com/owasp-modsecurity/ModSecurity/pull/3631
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in iis/mymodule.cpp at GetIpAddr() and inspect how GetNameInfo formats IPv6 link-local client addresses. Verify the behavior with a Windows/IIS link-local address and confirm that IP matching completes without the zone suffix causing a parser error; PR #3631 is already linked for comparison.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100