IIS parser: add support for IPv6 addresses with zone index
Opened this issue · 0 comments
pyllyukko commented
Problem
Plaso's IIS parser is unable to cope with IPv6 addresses with zone index (e.g. %3
suffix). pyparsing's common.ipv6_address doesn't seem to take this into account.
To Reproduce
- Plaso version: 20240826 (via Docker)
- OS: Debian 12
To reproduce you can try to parse the following log line with Plaso:
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2021-08-07 00:00:01
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2022-01-01 00:01:24 fe80::1ff:fe23:4567:890a%3 POST /powershell clientApplication=ActiveMonitor;PSVersion=5.1.14393.4467 444 random\ranuser1 ::1 Microsoft+WinRM+Client - 200 0 0 15
The method used to install Plaso: Docker
Expected behavior
Plaso should be able to parse log lines that have IPv6 addresses with zone index.
Observed behavior
Plaso produces an extraction warning with "unable to parse log line":
******************* Extraction warnings generated per parser *******************
Parser (plugin) name : Number of warnings
--------------------------------------------------------------------------------
text/winiis : 1
--------------------------------------------------------------------------------
************** Path specifications with most extraction warnings ***************
Number of warnings : Pathspec
--------------------------------------------------------------------------------
1 : type: OS, location: /data/evidences/iis10_edge_cases.log
--------------------------------------------------------------------------------
**************************** Extraction warning: 0 *****************************
Message : unable to parse log line: 5 "2022-01-01 00:01:24
fe80::1ff:fe23:4567:890a%3 POST /powershell
clientApplica..."
Parser chain : text/winiis
Path specification : type: OS, location: /data/evidences/iis10_edge_cases.log
--------------------------------------------------------------------------------
Additional context
Related issue: Unable to parse MS Exchange IIS 10 log lines #4566