Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

after talking to seth - change host_a field in record back to host.

Browse source
This commit is contained in:
Bernhard Amann 2011-12-08 14:25:46 -08:00
parent 7e3ebc1817
commit 311cd1b116
4 changed files with 77 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

50
scripts/base/frameworks/software/main.bro
View file

@ -34,7 +34,7 @@ export {
## The time at which the software was first detected. ## The time at which the software was first detected.
ts: time &log; ts: time &log;
## The IP address detected running the software. ## The IP address detected running the software.
host_a: addr &log; host: addr &log;
## The Port on which the software is running. Only sensible for server software. ## The Port on which the software is running. Only sensible for server software.
host_p: port &log &optional; host_p: port &log &optional;
## The transport protocol that is being used. Only sensible for server software. ## The transport protocol that is being used. Only sensible for server software.
@ -75,13 +75,13 @@ export {
## still many cases where scripts may have to have their own specific ## still many cases where scripts may have to have their own specific
## version parsing though. ## version parsing though.
global parse: function(unparsed_version: string, global parse: function(unparsed_version: string,
host_a: addr, host: addr,
software_type: Type): Info; software_type: Type): Info;
## This function is the equivalent to parse for software that has a specific ## This function is the equivalent to parse for software that has a specific
## source port (i.e. server software) ## source port (i.e. server software)
global parse_with_port: function(unparsed_version: string, global parse_with_port: function(unparsed_version: string,
host_a: addr, host_p: port, host: addr, host_p: port,
software_type: Type): Info; software_type: Type): Info;
## Compare two versions. ## Compare two versions.
@ -117,7 +117,7 @@ event bro_init()
} }
function parse_mozilla(unparsed_version: string, function parse_mozilla(unparsed_version: string,
host_a: addr, host: addr,
software_type: Type): Info software_type: Type): Info
{ {
local software_name = "<unknown browser>"; local software_name = "<unknown browser>";
@ -129,7 +129,7 @@ function parse_mozilla(unparsed_version: string,
software_name = "Opera"; software_name = "Opera";
parts = split_all(unparsed_version, /Opera [0-9\.]*$/); parts = split_all(unparsed_version, /Opera [0-9\.]*$/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
else if ( / MSIE / in unparsed_version ) else if ( / MSIE / in unparsed_version )
{ {
@ -144,7 +144,7 @@ function parse_mozilla(unparsed_version: string,
{ {
parts = split_all(unparsed_version, /MSIE [0-9]{1,2}\.*[0-9]*b?[0-9]*/); parts = split_all(unparsed_version, /MSIE [0-9]{1,2}\.*[0-9]*b?[0-9]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
} }
else if ( /Version\/.*Safari\// in unparsed_version ) else if ( /Version\/.*Safari\// in unparsed_version )
@ -153,7 +153,7 @@ function parse_mozilla(unparsed_version: string,
parts = split_all(unparsed_version, /Version\/[0-9\.]*/); parts = split_all(unparsed_version, /Version\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
{ {
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
if ( / Mobile\/?.* Safari/ in unparsed_version ) if ( / Mobile\/?.* Safari/ in unparsed_version )
v$addl = "Mobile"; v$addl = "Mobile";
} }
@ -163,7 +163,7 @@ function parse_mozilla(unparsed_version: string,
parts = split_all(unparsed_version, /(Firefox|Netscape|Thunderbird)\/[0-9\.]*/); parts = split_all(unparsed_version, /(Firefox|Netscape|Thunderbird)\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
{ {
local tmp_s = parse(parts[2], host_a, software_type); local tmp_s = parse(parts[2], host, software_type);
software_name = tmp_s$name; software_name = tmp_s$name;
v = tmp_s$version; v = tmp_s$version;
} }
@ -173,7 +173,7 @@ function parse_mozilla(unparsed_version: string,
software_name = "Chrome"; software_name = "Chrome";
parts = split_all(unparsed_version, /Chrome\/[0-9\.]*/); parts = split_all(unparsed_version, /Chrome\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
else if ( /^Opera\// in unparsed_version ) else if ( /^Opera\// in unparsed_version )
{ {
@ -184,12 +184,12 @@ function parse_mozilla(unparsed_version: string,
software_name = parts[2]; software_name = parts[2];
parts = split_all(unparsed_version, /Version\/[0-9\.]*/); parts = split_all(unparsed_version, /Version\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
else else
{ {
parts = split_all(unparsed_version, /Opera Mini\/[0-9\.]*/); parts = split_all(unparsed_version, /Opera Mini\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
} }
else else
@ -197,7 +197,7 @@ function parse_mozilla(unparsed_version: string,
software_name = "Opera"; software_name = "Opera";
parts = split_all(unparsed_version, /Version\/[0-9\.]*/); parts = split_all(unparsed_version, /Version\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
} }
else if ( /AppleWebKit\/[0-9\.]*/ in unparsed_version ) else if ( /AppleWebKit\/[0-9\.]*/ in unparsed_version )
@ -205,17 +205,17 @@ function parse_mozilla(unparsed_version: string,
software_name = "Unspecified WebKit"; software_name = "Unspecified WebKit";
parts = split_all(unparsed_version, /AppleWebKit\/[0-9\.]*/); parts = split_all(unparsed_version, /AppleWebKit\/[0-9\.]*/);
if ( 2 in parts ) if ( 2 in parts )
v = parse(parts[2], host_a, software_type)$version; v = parse(parts[2], host, software_type)$version;
} }
return [$ts=network_time(), $host_a=host_a, $name=software_name, $version=v, return [$ts=network_time(), $host=host, $name=software_name, $version=v,
$software_type=software_type, $unparsed_version=unparsed_version]; $software_type=software_type, $unparsed_version=unparsed_version];
} }
# Don't even try to understand this now, just make sure the tests are # Don't even try to understand this now, just make sure the tests are
# working. # working.
function parse(unparsed_version: string, function parse(unparsed_version: string,
host_a: addr, host: addr,
software_type: Type): Info software_type: Type): Info
{ {
local software_name = "<parse error>"; local software_name = "<parse error>";
@ -224,7 +224,7 @@ function parse(unparsed_version: string,
# Parse browser-alike versions separately # Parse browser-alike versions separately
if ( /^(Mozilla|Opera)\/[0-9]\./ in unparsed_version ) if ( /^(Mozilla|Opera)\/[0-9]\./ in unparsed_version )
{ {
return parse_mozilla(unparsed_version, host_a, software_type); return parse_mozilla(unparsed_version, host, software_type);
} }
else else
{ {
@ -286,17 +286,17 @@ function parse(unparsed_version: string,
v$major = extract_count(version_numbers[1]); v$major = extract_count(version_numbers[1]);
} }
} }
return [$ts=network_time(), $host_a=host_a, $name=software_name, return [$ts=network_time(), $host=host, $name=software_name,
$version=v, $unparsed_version=unparsed_version, $version=v, $unparsed_version=unparsed_version,
$software_type=software_type]; $software_type=software_type];
} }
function parse_with_port(unparsed_version: string, function parse_with_port(unparsed_version: string,
host_a: addr, host_p: port, host: addr, host_p: port,
software_type: Type): Info software_type: Type): Info
{ {
local i: Info; local i: Info;
i = parse(unparsed_version, host_a, software_type); i = parse(unparsed_version, host, software_type);
i$host_p = host_p; i$host_p = host_p;
i$proto = get_port_transport_proto(host_p); i$proto = get_port_transport_proto(host_p);
@ -362,9 +362,9 @@ function cmp_versions(v1: Version, v2: Version): int
} }
} }
function software_endpoint_name(id: conn_id, host_a: addr): string function software_endpoint_name(id: conn_id, host: addr): string
{ {
return fmt("%s %s", host_a, (host_a == id$orig_h ? "client" : "server")); return fmt("%s %s", host, (host == id$orig_h ? "client" : "server"));
} }
# Convert a version into a string "a.b.c-x". # Convert a version into a string "a.b.c-x".
@ -388,10 +388,10 @@ function software_fmt(i: Info): string
event software_register(id: conn_id, info: Info) event software_register(id: conn_id, info: Info)
{ {
# Host already known? # Host already known?
if ( info$host_a !in tracked ) if ( info$host !in tracked )
tracked[info$host_a] = table(); tracked[info$host] = table();
local ts = tracked[info$host_a]; local ts = tracked[info$host];
# Software already registered for this host? We don't want to endlessly # Software already registered for this host? We don't want to endlessly
# log the same thing. # log the same thing.
if ( info$name in ts ) if ( info$name in ts )
@ -411,7 +411,7 @@ event software_register(id: conn_id, info: Info)
function found(id: conn_id, info: Info): bool function found(id: conn_id, info: Info): bool
{ {
if ( info$force_log || addr_matches_host(info$host_a, asset_tracking) ) if ( info$force_log || addr_matches_host(info$host, asset_tracking) )
{ {
event software_register(id, info); event software_register(id, info);
return T; return T;

4
scripts/policy/frameworks/software/version-changes.bro
View file

@ -27,7 +27,7 @@ export {
event log_software(rec: Info) event log_software(rec: Info)
{ {
local ts = tracked[rec$host_a]; local ts = tracked[rec$host];
if ( rec$name in ts ) if ( rec$name in ts )
{ {
@ -40,7 +40,7 @@ event log_software(rec: Info)
network_time(), rec$software_type, network_time(), rec$software_type,
software_fmt_version(old$version), software_fmt_version(old$version),
software_fmt(rec), rec$software_type); software_fmt(rec), rec$software_type);
NOTICE([$note=Software_Version_Change, $src=rec$host_a, NOTICE([$note=Software_Version_Change, $src=rec$host,
$msg=msg, $sub=software_fmt(rec)]); $msg=msg, $sub=software_fmt(rec)]);
} }
} }

2
scripts/policy/frameworks/software/vulnerable.bro
View file

@ -18,6 +18,6 @@ event log_software(rec: Info)
if ( rec$name in vulnerable_versions && if ( rec$name in vulnerable_versions &&
cmp_versions(rec$version, vulnerable_versions[rec$name]) <= 0 ) cmp_versions(rec$version, vulnerable_versions[rec$name]) <= 0 )
{ {
NOTICE([$note=Vulnerable_Version, $src=rec$host_a, $msg=software_fmt(rec)]); NOTICE([$note=Vulnerable_Version, $src=rec$host, $msg=software_fmt(rec)]);
} }
} }

98
testing/btest/scripts/base/frameworks/software/version-parsing.bro
View file

@ -2,112 +2,112 @@
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
global ts = network_time(); global ts = network_time();
global host_a = 0.0.0.0; global host = 0.0.0.0;
global matched_software: table[string] of Software::Info = { global matched_software: table[string] of Software::Info = {
["OpenSSH_4.4"] = ["OpenSSH_4.4"] =
[$name="OpenSSH", $version=[$major=4,$minor=4], $host_a=host_a, $ts=ts], [$name="OpenSSH", $version=[$major=4,$minor=4], $host=host, $ts=ts],
["OpenSSH_5.2"] = ["OpenSSH_5.2"] =
[$name="OpenSSH", $version=[$major=5,$minor=2], $host_a=host_a, $ts=ts], [$name="OpenSSH", $version=[$major=5,$minor=2], $host=host, $ts=ts],
["Apache/2.0.63 (Unix) mod_auth_kerb/5.3 mod_ssl/2.0.63 OpenSSL/0.9.7a mod_fastcgi/2.4.2"] = ["Apache/2.0.63 (Unix) mod_auth_kerb/5.3 mod_ssl/2.0.63 OpenSSL/0.9.7a mod_fastcgi/2.4.2"] =
[$name="Apache", $version=[$major=2,$minor=0,$minor2=63,$addl="Unix"], $host_a=host_a, $ts=ts], [$name="Apache", $version=[$major=2,$minor=0,$minor2=63,$addl="Unix"], $host=host, $ts=ts],
["Apache/1.3.19 (Unix)"] = ["Apache/1.3.19 (Unix)"] =
[$name="Apache", $version=[$major=1,$minor=3,$minor2=19,$addl="Unix"], $host_a=host_a, $ts=ts], [$name="Apache", $version=[$major=1,$minor=3,$minor2=19,$addl="Unix"], $host=host, $ts=ts],
["ProFTPD 1.2.5rc1 Server (Debian)"] = ["ProFTPD 1.2.5rc1 Server (Debian)"] =
[$name="ProFTPD", $version=[$major=1,$minor=2,$minor2=5,$addl="rc1"], $host_a=host_a, $ts=ts], [$name="ProFTPD", $version=[$major=1,$minor=2,$minor2=5,$addl="rc1"], $host=host, $ts=ts],
["wu-2.4.2-academ[BETA-18-VR14](1)"] = ["wu-2.4.2-academ[BETA-18-VR14](1)"] =
[$name="wu", $version=[$major=2,$minor=4,$minor2=2,$addl="academ"], $host_a=host_a, $ts=ts], [$name="wu", $version=[$major=2,$minor=4,$minor2=2,$addl="academ"], $host=host, $ts=ts],
["wu-2.6.2(1)"] = ["wu-2.6.2(1)"] =
[$name="wu", $version=[$major=2,$minor=6,$minor2=2,$addl="1"], $host_a=host_a, $ts=ts], [$name="wu", $version=[$major=2,$minor=6,$minor2=2,$addl="1"], $host=host, $ts=ts],
["Java1.2.2-JDeveloper"] = ["Java1.2.2-JDeveloper"] =
[$name="Java", $version=[$major=1,$minor=2,$minor2=2,$addl="JDeveloper"], $host_a=host_a, $ts=ts], [$name="Java", $version=[$major=1,$minor=2,$minor2=2,$addl="JDeveloper"], $host=host, $ts=ts],
["Java/1.6.0_13"] = ["Java/1.6.0_13"] =
[$name="Java", $version=[$major=1,$minor=6,$minor2=0,$addl="13"], $host_a=host_a, $ts=ts], [$name="Java", $version=[$major=1,$minor=6,$minor2=0,$addl="13"], $host=host, $ts=ts],
["Python-urllib/3.1"] = ["Python-urllib/3.1"] =
[$name="Python-urllib", $version=[$major=3,$minor=1], $host_a=host_a, $ts=ts], [$name="Python-urllib", $version=[$major=3,$minor=1], $host=host, $ts=ts],
["libwww-perl/5.820"] = ["libwww-perl/5.820"] =
[$name="libwww-perl", $version=[$major=5,$minor=820], $host_a=host_a, $ts=ts], [$name="libwww-perl", $version=[$major=5,$minor=820], $host=host, $ts=ts],
["Wget/1.9+cvs-stable (Red Hat modified)"] = ["Wget/1.9+cvs-stable (Red Hat modified)"] =
[$name="Wget", $version=[$major=1,$minor=9,$addl="+cvs"], $host_a=host_a, $ts=ts], [$name="Wget", $version=[$major=1,$minor=9,$addl="+cvs"], $host=host, $ts=ts],
["Wget/1.11.4 (Red Hat modified)"] = ["Wget/1.11.4 (Red Hat modified)"] =
[$name="Wget", $version=[$major=1,$minor=11,$minor2=4,$addl="Red Hat modified"], $host_a=host_a, $ts=ts], [$name="Wget", $version=[$major=1,$minor=11,$minor2=4,$addl="Red Hat modified"], $host=host, $ts=ts],
["curl/7.15.1 (i486-pc-linux-gnu) libcurl/7.15.1 OpenSSL/0.9.8a zlib/1.2.3 libidn/0.5.18"] = ["curl/7.15.1 (i486-pc-linux-gnu) libcurl/7.15.1 OpenSSL/0.9.8a zlib/1.2.3 libidn/0.5.18"] =
[$name="curl", $version=[$major=7,$minor=15,$minor2=1,$addl="i486-pc-linux-gnu"], $host_a=host_a, $ts=ts], [$name="curl", $version=[$major=7,$minor=15,$minor2=1,$addl="i486-pc-linux-gnu"], $host=host, $ts=ts],
["Apache"] = ["Apache"] =
[$name="Apache", $host_a=host_a, $ts=ts], [$name="Apache", $host=host, $ts=ts],
["Zope/(Zope 2.7.8-final, python 2.3.5, darwin) ZServer/1.1 Plone/Unknown"] = ["Zope/(Zope 2.7.8-final, python 2.3.5, darwin) ZServer/1.1 Plone/Unknown"] =
[$name="Zope/(Zope", $version=[$major=2,$minor=7,$minor2=8,$addl="final"], $host_a=host_a, $ts=ts], [$name="Zope/(Zope", $version=[$major=2,$minor=7,$minor2=8,$addl="final"], $host=host, $ts=ts],
["The Bat! (v2.00.9) Personal"] = ["The Bat! (v2.00.9) Personal"] =
[$name="The Bat!", $version=[$major=2,$minor=0,$minor2=9,$addl="Personal"], $host_a=host_a, $ts=ts], [$name="The Bat!", $version=[$major=2,$minor=0,$minor2=9,$addl="Personal"], $host=host, $ts=ts],
["Flash/10,2,153,1"] = ["Flash/10,2,153,1"] =
[$name="Flash", $version=[$major=10,$minor=2,$minor2=153,$addl="1"], $host_a=host_a, $ts=ts], [$name="Flash", $version=[$major=10,$minor=2,$minor2=153,$addl="1"], $host=host, $ts=ts],
["mt2/1.2.3.967 Oct 13 2010-13:40:24 ord-pixel-x2 pid 0x35a3 13731"] = ["mt2/1.2.3.967 Oct 13 2010-13:40:24 ord-pixel-x2 pid 0x35a3 13731"] =
[$name="mt2", $version=[$major=1,$minor=2,$minor2=3,$addl="967"], $host_a=host_a, $ts=ts], [$name="mt2", $version=[$major=1,$minor=2,$minor2=3,$addl="967"], $host=host, $ts=ts],
["CacheFlyServe v26b"] = ["CacheFlyServe v26b"] =
[$name="CacheFlyServe", $version=[$major=26,$addl="b"], $host_a=host_a, $ts=ts], [$name="CacheFlyServe", $version=[$major=26,$addl="b"], $host=host, $ts=ts],
["Apache/2.0.46 (Win32) mod_ssl/2.0.46 OpenSSL/0.9.7b mod_jk2/2.0.4"] = ["Apache/2.0.46 (Win32) mod_ssl/2.0.46 OpenSSL/0.9.7b mod_jk2/2.0.4"] =
[$name="Apache", $version=[$major=2,$minor=0,$minor2=46,$addl="Win32"], $host_a=host_a, $ts=ts], [$name="Apache", $version=[$major=2,$minor=0,$minor2=46,$addl="Win32"], $host=host, $ts=ts],
# I have no clue how I'd support this without a special case. # I have no clue how I'd support this without a special case.
#["Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635"] = #["Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635"] =
# [$name="Apache", $version=[], $host_a=host_a, $ts=ts], # [$name="Apache", $version=[], $host=host, $ts=ts],
["Apple iPhone v4.3.1 Weather v1.0.0.8G4"] = ["Apple iPhone v4.3.1 Weather v1.0.0.8G4"] =
[$name="Apple iPhone", $version=[$major=4,$minor=3,$minor2=1,$addl="Weather"], $host_a=host_a, $ts=ts], [$name="Apple iPhone", $version=[$major=4,$minor=3,$minor2=1,$addl="Weather"], $host=host, $ts=ts],
["Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_2 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8H7 Safari/6533.18.5"] = ["Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_2 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8H7 Safari/6533.18.5"] =
[$name="Safari", $version=[$major=5,$minor=0,$minor2=2,$addl="Mobile"], $host_a=host_a, $ts=ts], [$name="Safari", $version=[$major=5,$minor=0,$minor2=2,$addl="Mobile"], $host=host, $ts=ts],
["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16"] = ["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16"] =
[$name="Chrome", $version=[$major=10,$minor=0,$minor2=648,$addl="205"], $host_a=host_a, $ts=ts], [$name="Chrome", $version=[$major=10,$minor=0,$minor2=648,$addl="205"], $host=host, $ts=ts],
["Opera/9.80 (Windows NT 6.1; U; sv) Presto/2.7.62 Version/11.01"] = ["Opera/9.80 (Windows NT 6.1; U; sv) Presto/2.7.62 Version/11.01"] =
[$name="Opera", $version=[$major=11,$minor=1], $host_a=host_a, $ts=ts], [$name="Opera", $version=[$major=11,$minor=1], $host=host, $ts=ts],
["Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.11) Gecko/20101013 Lightning/1.0b2 Thunderbird/3.1.5"] = ["Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.11) Gecko/20101013 Lightning/1.0b2 Thunderbird/3.1.5"] =
[$name="Thunderbird", $version=[$major=3,$minor=1,$minor2=5], $host_a=host_a, $ts=ts], [$name="Thunderbird", $version=[$major=3,$minor=1,$minor2=5], $host=host, $ts=ts],
["iTunes/9.0 (Macintosh; Intel Mac OS X 10.5.8) AppleWebKit/531.9"] = ["iTunes/9.0 (Macintosh; Intel Mac OS X 10.5.8) AppleWebKit/531.9"] =
[$name="iTunes", $version=[$major=9,$minor=0,$addl="Macintosh"], $host_a=host_a, $ts=ts], [$name="iTunes", $version=[$major=9,$minor=0,$addl="Macintosh"], $host=host, $ts=ts],
["Java1.3.1_04"] = ["Java1.3.1_04"] =
[$name="Java", $version=[$major=1,$minor=3,$minor2=1,$addl="04"], $host_a=host_a, $ts=ts], [$name="Java", $version=[$major=1,$minor=3,$minor2=1,$addl="04"], $host=host, $ts=ts],
["Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"] = ["Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"] =
[$name="Safari", $version=[$major=4,$minor=0,$addl="Mobile"], $host_a=host_a, $ts=ts], [$name="Safari", $version=[$major=4,$minor=0,$addl="Mobile"], $host=host, $ts=ts],
["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-us) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27"] = ["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-us) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27"] =
[$name="Safari", $version=[$major=5,$minor=0,$minor2=4], $host_a=host_a, $ts=ts], [$name="Safari", $version=[$major=5,$minor=0,$minor2=4], $host=host, $ts=ts],
["Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8A293 Safari/6531.22.7"] = ["Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8A293 Safari/6531.22.7"] =
[$name="Safari", $version=[$major=4,$minor=0,$minor2=5,$addl="Mobile"], $host_a=host_a, $ts=ts], [$name="Safari", $version=[$major=4,$minor=0,$minor2=5,$addl="Mobile"], $host=host, $ts=ts],
["Opera/9.80 (J2ME/MIDP; Opera Mini/9.80 (S60; SymbOS; Opera Mobi/23.348; U; en) Presto/2.5.25 Version/10.54"] = ["Opera/9.80 (J2ME/MIDP; Opera Mini/9.80 (S60; SymbOS; Opera Mobi/23.348; U; en) Presto/2.5.25 Version/10.54"] =
[$name="Opera Mini", $version=[$major=10,$minor=54], $host_a=host_a, $ts=ts], [$name="Opera Mini", $version=[$major=10,$minor=54], $host=host, $ts=ts],
["Opera/9.80 (J2ME/MIDP; Opera Mini/5.0.18741/18.794; U; en) Presto/2.4.15"] = ["Opera/9.80 (J2ME/MIDP; Opera Mini/5.0.18741/18.794; U; en) Presto/2.4.15"] =
[$name="Opera Mini", $version=[$major=5,$minor=0,$minor2=18741], $host_a=host_a, $ts=ts], [$name="Opera Mini", $version=[$major=5,$minor=0,$minor2=18741], $host=host, $ts=ts],
["Opera/9.80 (Windows NT 5.1; Opera Mobi/49; U; en) Presto/2.4.18 Version/10.00"] = ["Opera/9.80 (Windows NT 5.1; Opera Mobi/49; U; en) Presto/2.4.18 Version/10.00"] =
[$name="Opera Mobi", $version=[$major=10,$minor=0], $host_a=host_a, $ts=ts], [$name="Opera Mobi", $version=[$major=10,$minor=0], $host=host, $ts=ts],
["Mozilla/4.0 (compatible; MSIE 8.0; Android 2.2.2; Linux; Opera Mobi/ADR-1103311355; en) Opera 11.00"] = ["Mozilla/4.0 (compatible; MSIE 8.0; Android 2.2.2; Linux; Opera Mobi/ADR-1103311355; en) Opera 11.00"] =
[$name="Opera", $version=[$major=11,$minor=0], $host_a=host_a, $ts=ts], [$name="Opera", $version=[$major=11,$minor=0], $host=host, $ts=ts],
["Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax)"] = ["Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax)"] =
[$name="Netscape", $version=[$major=7,$minor=2], $host_a=host_a, $ts=ts], [$name="Netscape", $version=[$major=7,$minor=2], $host=host, $ts=ts],
["Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)"] = ["Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)"] =
[$name="MSIE", $version=[$major=7,$minor=0], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=7,$minor=0], $host=host, $ts=ts],
["Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; Media Center PC 3.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)"] = ["Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; Media Center PC 3.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)"] =
[$name="MSIE", $version=[$major=7,$minor=0,$addl="b"], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=7,$minor=0,$addl="b"], $host=host, $ts=ts],
["Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; InfoPath.2; InfoPath.3)"] = ["Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; InfoPath.2; InfoPath.3)"] =
[$name="MSIE", $version=[$major=8,$minor=0], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=8,$minor=0], $host=host, $ts=ts],
["Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"] = ["Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"] =
[$name="MSIE", $version=[$major=9,$minor=0], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=9,$minor=0], $host=host, $ts=ts],
["Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; Creative AutoUpdate v1.40.02)"] = ["Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; Creative AutoUpdate v1.40.02)"] =
[$name="MSIE", $version=[$major=9,$minor=0], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=9,$minor=0], $host=host, $ts=ts],
["Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"] = ["Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"] =
[$name="MSIE", $version=[$major=10,$minor=0], $host_a=host_a, $ts=ts], [$name="MSIE", $version=[$major=10,$minor=0], $host=host, $ts=ts],
["The Bat! (3.0.1 RC3) Professional"] = ["The Bat! (3.0.1 RC3) Professional"] =
[$name="The Bat!", $version=[$major=3,$minor=0,$minor2=1,$addl="RC3"], $host_a=host_a, $ts=ts], [$name="The Bat!", $version=[$major=3,$minor=0,$minor2=1,$addl="RC3"], $host=host, $ts=ts],
# This is an FTP client (found with CLNT command) # This is an FTP client (found with CLNT command)
["Total Commander"] = ["Total Commander"] =
[$name="Total Commander", $version=[], $host_a=host_a, $ts=ts], [$name="Total Commander", $version=[], $host=host, $ts=ts],
["(vsFTPd 2.0.5)"] = ["(vsFTPd 2.0.5)"] =
[$name="vsFTPd", $version=[$major=2,$minor=0,$minor2=5], $host_a=host_a, $ts=ts], [$name="vsFTPd", $version=[$major=2,$minor=0,$minor2=5], $host=host, $ts=ts],
["Apple Mail (2.1084)"] = ["Apple Mail (2.1084)"] =
[$name="Apple Mail", $version=[$major=2,$minor=1084], $host_a=host_a, $ts=ts], [$name="Apple Mail", $version=[$major=2,$minor=1084], $host=host, $ts=ts],
}; };
event bro_init() event bro_init()
{ {
for ( sw in matched_software ) for ( sw in matched_software )
{ {
local output = Software::parse(sw, host_a, Software::UNKNOWN); local output = Software::parse(sw, host, Software::UNKNOWN);
local baseline: Software::Info; local baseline: Software::Info;
baseline = matched_software[sw]; baseline = matched_software[sw];
if ( baseline$name == output$name && if ( baseline$name == output$name &&