From 58370e7aabe34b108f20c33f6ac3c63238bf179b Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Tue, 26 Apr 2011 15:24:25 -0400
Subject: [PATCH] Added software detection for unspecified WebKit based
 browsers.

---
 policy/software/base.bro | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/policy/software/base.bro b/policy/software/base.bro
index 44ec4fccba..144c15e9c4 100644
--- a/policy/software/base.bro
+++ b/policy/software/base.bro
@@ -182,6 +182,13 @@ function parse_mozilla(unparsed_version: string,
 				v = parse(parts[2], host, software_type)$version;
 			}
 		}
+	else if ( /AppleWebKit\/[0-9\.]*/ in unparsed_version )
+		{
+		software_name = "Unspecified WebKit";
+		parts = split_all(unparsed_version, /AppleWebKit\/[0-9\.]*/);
+		if ( 2 in parts )
+			v = parse(parts[2], host, software_type)$version;
+		}
 
 	return [$ts=network_time(), $host=host, $name=software_name, $version=v,
 	        $software_type=software_type, $unparsed_version=unparsed_version];