From edb92297ce703c50c8726776998496f6d7e248d2 Mon Sep 17 00:00:00 2001 From: A13501350 <18516149786@163.com> Date: Thu, 17 Sep 2026 21:30:33 +0800 Subject: [PATCH] fix(iis): strip IPv6 zone/scope id from client IP string Windows GetNameInfo() appends the zone/scope identifier (e.g. "%6") to link-local IPv6 addresses (fe80::/10) in their string form, because sin6_scope_id is the interface index for link-local addresses (per Microsoft docs: "fe80::208:74ff:feda:625c%5"). ModSecurity's IP-match parser rejects addresses containing a zone suffix, causing "IPmatch: bad IPv6 specification" and rule processing failures (e.g. id=905110) for clients connecting from link-local IPv6. Strip the "%" suffix from the textual IP passed to ModSecurity in GetIpAddr(). The binary address (sin6_addr) used for the actual socket is unaffected, and the zone id is irrelevant for IP matching. --- iis/mymodule.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/iis/mymodule.cpp b/iis/mymodule.cpp index dfaee4b2cb..b1741b14a0 100644 --- a/iis/mymodule.cpp +++ b/iis/mymodule.cpp @@ -22,6 +22,7 @@ // IIS7 Server API header file #include #include +#include #include #include "httpserv.h" @@ -104,7 +105,14 @@ char *GetIpAddr(apr_pool_t *pool, PSOCKADDR pAddr) if (GetNameInfo(pAddr, addrSize, buf, NI_MAXHOST, nullptr, 0, NI_NUMERICHOST) != 0) { return apr_pstrdup(pool, ""); } - + + if (pAddr->sa_family == AF_INET6) { + char *zone = strchr(buf, '%'); + if (zone != nullptr) { + *zone = '\0'; + } + } + return buf; }