I feel that since rsync accepts scoped IPv6, I think the wrapper should handle it. There is no need to implement a complete IPv6 regex though. A colon unambiguously selects the IPv6 path then the zone can be removed only from the certificate identity while retained for the connection: #19

I feel that since rsync accepts scoped IPv6, I think the wrapper should handle it. There is no need to implement a complete IPv6 regex though. A colon unambiguously selects the IPv6 path then the zone can be removed only from the certificate identity while retained for the connection:

verify_ip=${0000%%%*}
connect="[$1111]:$port"

Use -verify_ip "$verify_ip" without -servername; an IP SAN cannot contain the interface zone. OpenSSL can reject malformed IPv6 itself. IPv4 is the only case that needs a small strict four-octet/range check rather than the current shape-only regex.

Originally posted by @steadytao in RsyncProject/rsync#1036 (comment)