owasp-modsecurity / owasp-modsecurity/ModSecurity

IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification")

Open
#3,630 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x Platform - IIS
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Description

On Windows, when a client connects to the ModSecurity IIS module from an
IPv6 link-local address (fe80::/10), rule processing fails with:

ModSecurity: IPmatch: bad IPv6 specification "fe80::186d:7ec:8f88:4a0a%6".
ModSecurity: Rule processing failed (id=905110, msg=).

Any rule that matches against REMOTE_ADDR / client IP (e.g. id=905110) is
affected for such clients.

Root cause

In iis/mymodule.cpp, GetIpAddr() converts the client sockaddr to a string
with GetNameInfo(..., NI_NUMERICHOST). On Windows, GetNameInfo appends the
IPv6 zone/scope identifier ("%") to link-local addresses,
because sin6_scope_id is the interface index for fe80::/10 addresses
(Microsoft docs: "fe80::208:74ff:feda:625c%5").

ModSecurity's IP-match parser only accepts plain RFC 4291 addresses and
rejects the "%6" zone suffix, so the rule aborts.

Impact

False rule-processing failures (and effectively bypassed IP-based rules)
for any client arriving over a link-local IPv6 address on Windows/IIS.

Fix

Strip the "%" suffix from the textual IP passed to ModSecurity in
GetIpAddr(). The binary address (sin6_addr) used for the socket is
unchanged, and the zone id is irrelevant for IP matching.

See PR: https://github.com/owasp-modsecurity/ModSecurity/pull/3631

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in iis/mymodule.cpp at GetIpAddr() and inspect how GetNameInfo formats IPv6 link-local client addresses. Verify the behavior with a Windows/IIS link-local address and confirm that IP matching completes without the zone suffix causing a parser error; PR #3631 is already linked for comparison.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.