Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Better software version parsing.

Browse source 
* $addl field now parsed out in many cases.
* A few new tests for web browser versions.
  * Browers user-agents need preprocessed though.
* All tests pass.
This commit is contained in:
Seth Hall 2011-03-14 15:41:45 -04:00
parent c212f28130
commit febfd4cf04
2 changed files with 40 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

21
testing/btest/software/default-version-parsing.bro
View file

@ -10,15 +10,26 @@ global matched_software: table[string] of Software::Info = {
["OpenSSH_5.2"] =
[$name="OpenSSH", $version=[$major=5,$minor=2,$minor2=0], $ts=ts],
["Apache/2.0.63 (Unix) mod_auth_kerb/5.3 mod_ssl/2.0.63 OpenSSL/0.9.7a mod_fastcgi/2.4.2"] =
[$name="Apache", $version=[$major=2,$minor=0,$minor2=63], $ts=ts],
[$name="Apache", $version=[$major=2,$minor=0,$minor2=63,$addl="Unix"], $ts=ts],
["Apache/1.3.19 (Unix)"] =
[$name="Apache", $version=[$major=1,$minor=3,$minor2=19], $ts=ts],
[$name="Apache", $version=[$major=1,$minor=3,$minor2=19,$addl="Unix"], $ts=ts],
# $addl is not quite right here, but it's close enough.
["ProFTPD 1.2.5rc1 Server (Debian)"] =
[$name="ProFTPD", $version=[$major=1,$minor=2,$minor2=5], $ts=ts],
[$name="ProFTPD", $version=[$major=1,$minor=2,$minor2=5,$addl="rc"], $ts=ts],
["wu-2.4.2-academ[BETA-18-VR14](1)"] =
[$name="wu", $version=[$major=2,$minor=4,$minor2=2], $ts=ts],
[$name="wu", $version=[$major=2,$minor=4,$minor2=2,$addl="academ"], $ts=ts],
["wu-2.6.2(1)"] =
[$name="wu", $version=[$major=2,$minor=6,$minor2=2], $ts=ts],
[$name="wu", $version=[$major=2,$minor=6,$minor2=2,$addl="1"], $ts=ts],
["Java1.2.2-JDeveloper"] =
[$name="Java", $version=[$major=1,$minor=2,$minor2=2,$addl="JDeveloper"], $ts=ts],
["Java/1.6.0_13"] =
[$name="Java", $version=[$major=1,$minor=6,$minor2=0,$addl="13"], $ts=ts],
# Web Browers are going to have to be pre processed before sending here.
# They can't be handled generically by the software framework.
["Firefox/3.6.7"] =
[$name="Firefox", $version=[$major=3,$minor=6,$minor2=7], $ts=ts],
["Firefox/4.0b9pre"] =
[$name="Firefox", $version=[$major=4,$minor=0,$minor2=0,$addl="b9pre"], $ts=ts],
};
event bro_init()