Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updated software framework to support parsing IE11 user-agent strings.

Browse source
This commit is contained in:
Seth Hall 2013-12-05 15:05:11 -05:00
parent 4484b8d60d
commit 6d782e6834
3 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/frameworks/software/main.bro
View file

@ -209,7 +209,7 @@ function parse_mozilla(unparsed_version: string): Description
if ( 2 in parts )
v = parse(parts[2])$version;
}
else if ( / MSIE / in unparsed_version )
else if ( / MSIE |Trident\// in unparsed_version )
{
software_name = "MSIE";
if ( /Trident\/4\.0/ in unparsed_version )
@ -218,6 +218,8 @@ function parse_mozilla(unparsed_version: string): Description
v = [$major=9,$minor=0];
else if ( /Trident\/6\.0/ in unparsed_version )
v = [$major=10,$minor=0];
else if ( /Trident\/7\.0/ in unparsed_version )
v = [$major=11,$minor=0];
else
{
parts = split_all(unparsed_version, /MSIE [0-9]{1,2}\.*[0-9]*b?[0-9]*/);

2
testing/btest/Baseline/scripts.base.frameworks.software.version-parsing/output
View file

@ -2,6 +2,7 @@ success on: Apache/1.3.19 (Unix)
success on: Python-urllib/3.1
success on: Apache
success on: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; Creative AutoUpdate v1.40.02)
success on: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C)
success on: Java/1.6.0_13
success on: Wget/1.11.4 (Red Hat modified)
success on: curl/7.15.1 (i486-pc-linux-gnu) libcurl/7.15.1 OpenSSL/0.9.8a zlib/1.2.3 libidn/0.5.18
@ -38,6 +39,7 @@ success on: Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40
success on: wu-2.6.2(1)
success on: Opera/9.80 (J2ME/MIDP; Opera Mini/5.0.18741/18.794; U; en) Presto/2.4.15
success on: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; InfoPath.2; InfoPath.3)
success on: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
success on: Flash/10,2,153,1
success on: CacheFlyServe v26b
success on: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.11) Gecko/20101013 Lightning/1.0b2 Thunderbird/3.1.5

6
testing/btest/scripts/base/frameworks/software/version-parsing.bro
View file

@ -91,6 +91,12 @@ global matched_software: table[string] of Software::Description = {
[$name="MSIE", $version=[$major=9,$minor=0], $unparsed_version=""],
["Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"] =
[$name="MSIE", $version=[$major=10,$minor=0], $unparsed_version=""],
# IE 11 normal mode.
["Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"] =
[$name="MSIE", $version=[$major=11,$minor=0], $unparsed_version=""],
# IE 11 compatibility mode
["Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C)"] =
[$name="MSIE", $version=[$major=11,$minor=0], $unparsed_version=""],
["The Bat! (3.0.1 RC3) Professional"] =
[$name="The Bat!", $version=[$major=3,$minor=0,$minor2=1,$addl="RC3"], $unparsed_version=""],
# This is an FTP client (found with CLNT command)