recog 2.3.22 → 2.3.23

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/http_wwwauth.xml CHANGED
@@ -289,7 +289,7 @@
289
289
 
290
290
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
291
291
  <description>Huawei xDSL routers</description>
292
- <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
292
+ <example hw.product="MT882" service.product="MT882" os.product="MT882">Basic realm="SmartAX MT882"</example>
293
293
  <param pos="0" name="service.vendor" value="Huawei"/>
294
294
  <param pos="0" name="service.family" value="MT"/>
295
295
  <param pos="1" name="service.product"/>
@@ -322,10 +322,10 @@
322
322
 
323
323
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
324
324
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
325
- <example hw.product="WRT54G">Basic realm="WRT54G"</example>
326
- <example hw.product="WRT54GL">Basic realm="WRT54GL"</example>
327
- <example hw.product="WRT54GSV4">Basic realm="WRT54GSV4"</example>
328
- <example hw.product="WRT54GCv3">Basic realm="WRT54GCv3"</example>
325
+ <example hw.product="WRT54G" os.product="WRT54G">Basic realm="WRT54G"</example>
326
+ <example hw.product="WRT54GL" os.product="WRT54GL">Basic realm="WRT54GL"</example>
327
+ <example hw.product="WRT54GSV4" os.product="WRT54GSV4">Basic realm="WRT54GSV4"</example>
328
+ <example hw.product="WRT54GCv3" os.product="WRT54GCv3">Basic realm="WRT54GCv3"</example>
329
329
  <param pos="0" name="os.vendor" value="Linksys"/>
330
330
  <param pos="0" name="os.device" value="WAP"/>
331
331
  <param pos="1" name="os.product"/>
@@ -336,9 +336,9 @@
336
336
 
337
337
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
338
338
  <description>TP-LINK SoHo Router - dash variant</description>
339
- <example os.product="TD-W8901G">Basic realm="TD-W8901G"</example>
340
- <example>Basic realm="TD-8840T 2.0"</example>
341
- <example hw.product="TD-8811">Basic realm="TD-8811"</example>
339
+ <example os.product="TD-W8901G" hw.product="TD-W8901G">Basic realm="TD-W8901G"</example>
340
+ <example os.product="TD-8840T" hw.product="TD-8840T">Basic realm="TD-8840T 2.0"</example>
341
+ <example hw.product="TD-8811" os.product="TD-8811">Basic realm="TD-8811"</example>
342
342
  <param pos="0" name="os.vendor" value="TP-LINK"/>
343
343
  <param pos="0" name="os.device" value="Router"/>
344
344
  <param pos="1" name="os.product"/>
@@ -349,10 +349,10 @@
349
349
 
350
350
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
351
351
  <description>TP-LINK SoHo Router</description>
352
- <example os.product="TD854W">Basic realm="TD854W"</example>
353
- <example hw.product="TD811">Basic realm="TD811"</example>
354
- <example>Basic realm="TD821"</example>
355
- <example>Basic realm="TD841"</example>
352
+ <example os.product="TD854W" hw.product="TD854W">Basic realm="TD854W"</example>
353
+ <example hw.product="TD811" os.product="TD811">Basic realm="TD811"</example>
354
+ <example os.product="TD821" hw.product="TD821">Basic realm="TD821"</example>
355
+ <example os.product="TD841" hw.product="TD841">Basic realm="TD841"</example>
356
356
  <param pos="0" name="os.vendor" value="TP-LINK"/>
357
357
  <param pos="0" name="os.device" value="Router"/>
358
358
  <param pos="1" name="os.product"/>
@@ -363,22 +363,22 @@
363
363
 
364
364
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;">
365
365
  <description>TP-LINK SoHo Router - verbose variant</description>
366
- <example os.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
- <example hw.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
368
- <example>Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
369
- <example>Basic realm="TP-LINK Wireless AP WA501G"</example>
370
- <example>Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
371
- <example>Basic realm="TP-LINK Wireless N Access Point WA901ND"</example>
372
- <example>Basic realm="TP-LINK Wireless AP WA601G"</example>
373
- <example>Basic realm="TP-LINK Wireless AP WR710N"</example>
374
- <example>Basic realm="TP-LINK Wireless AP WR700N"</example>
375
- <example>Basic realm="TP-LINK Wireless Range Extender WA750RE"</example>
376
- <example>Basic realm="TP-LINK Wireless AP WR702N"</example>
377
- <example>Basic realm="TP-LINK Wireless AP WR800N"</example>
378
- <example>Basic realm="TP-LINK Wireless Range Extender WA730RE"</example>
379
- <example>Basic realm="TP-LINK Wireless N Access Point WA805N"</example>
380
- <example>Basic realm="TP-LINK Wireless N Access Point WA701N"</example>
381
- <example>Basic realm="TP-LINK Wireless AP WR706N"</example>
366
+ <example os.product="WA801N" hw.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
+ <example hw.product="WA830RE" os.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
368
+ <example os.product="WA850RE" hw.product="WA850RE">Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
369
+ <example os.product="WA501G" hw.product="WA501G">Basic realm="TP-LINK Wireless AP WA501G"</example>
370
+ <example os.product="WA701ND" hw.product="WA701ND">Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
371
+ <example os.product="WA901ND" hw.product="WA901ND">Basic realm="TP-LINK Wireless N Access Point WA901ND"</example>
372
+ <example os.product="WA601G" hw.product="WA601G">Basic realm="TP-LINK Wireless AP WA601G"</example>
373
+ <example os.product="WR710N" hw.product="WR710N">Basic realm="TP-LINK Wireless AP WR710N"</example>
374
+ <example os.product="WR700N" hw.product="WR700N">Basic realm="TP-LINK Wireless AP WR700N"</example>
375
+ <example os.product="WA750RE" hw.product="WA750RE">Basic realm="TP-LINK Wireless Range Extender WA750RE"</example>
376
+ <example os.product="WR702N" hw.product="WR702N">Basic realm="TP-LINK Wireless AP WR702N"</example>
377
+ <example os.product="WR800N" hw.product="WR800N">Basic realm="TP-LINK Wireless AP WR800N"</example>
378
+ <example os.product="WA730RE" hw.product="WA730RE">Basic realm="TP-LINK Wireless Range Extender WA730RE"</example>
379
+ <example os.product="WA805N" hw.product="WA805N">Basic realm="TP-LINK Wireless N Access Point WA805N"</example>
380
+ <example os.product="WA701N" hw.product="WA701N">Basic realm="TP-LINK Wireless N Access Point WA701N"</example>
381
+ <example os.product="WR706N" hw.product="WR706N">Basic realm="TP-LINK Wireless AP WR706N"</example>
382
382
  <param pos="0" name="os.vendor" value="TP-LINK"/>
383
383
  <param pos="0" name="os.device" value="WAP"/>
384
384
  <param pos="1" name="os.product"/>
@@ -389,9 +389,9 @@
389
389
 
390
390
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;">
391
391
  <description>TP-LINK Routers</description>
392
- <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
393
- <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
394
- <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
392
+ <example hw.product="Wireless N Router WR841N">Basic realm="TP-LINK Wireless N Router WR841N"</example>
393
+ <example hw.product="Gigabit Broadband VPN Router R600VPN">Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
394
+ <example hw.product="Wireless Lite N Router WR740N/WR741ND">Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
395
395
  <param pos="0" name="hw.vendor" value="TP-LINK"/>
396
396
  <param pos="0" name="hw.device" value="Router"/>
397
397
  <param pos="1" name="hw.product"/>
@@ -504,7 +504,7 @@
504
504
 
505
505
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;">
506
506
  <description>ZTE ZXHN router</description>
507
- <example>Basic realm="ZXHN H108L"</example>
507
+ <example hw.product="H108L">Basic realm="ZXHN H108L"</example>
508
508
  <param pos="0" name="hw.vendor" value="ZTE"/>
509
509
  <param pos="0" name="hw.device" value="Router"/>
510
510
  <param pos="0" name="hw.family" value="ZXHN"/>
@@ -662,17 +662,41 @@
662
662
  <param pos="0" name="hw.family" value="Eurotherm"/>
663
663
  </fingerprint>
664
664
 
665
+ <fingerprint pattern="(?i)^Basic realm=&quot;TomatoUSB&quot;">
666
+ <description>TomatoUSB Router Firmware</description>
667
+ <example>Basic realm="TomatoUSB"</example>
668
+ <param pos="0" name="os.vendor" value="TomatoUSB"/>
669
+ <param pos="0" name="os.family" value="Linux"/>
670
+ <param pos="0" name="os.product" value="TomatoUSB"/>
671
+ <param pos="0" name="os.device" value="Router"/>
672
+ </fingerprint>
673
+
674
+ <fingerprint pattern="(?i)^Basic realm=&quot;FreshTomato&quot;">
675
+ <description>FreshTomato Router Firmware</description>
676
+ <example>Basic realm="FreshTomato"</example>
677
+ <param pos="0" name="os.vendor" value="FreshTomato"/>
678
+ <param pos="0" name="os.family" value="Linux"/>
679
+ <param pos="0" name="os.product" value="FreshTomato"/>
680
+ <param pos="0" name="os.device" value="Router"/>
681
+ </fingerprint>
682
+
665
683
  <!-- a variety of headers we currently just ignore -->
666
684
 
667
685
  <fingerprint pattern="(?i)^NTLM$">
668
- <description>Ignore NTLM-only</description>
686
+ <description>Ignore NTLM-only -- assert nothing</description>
669
687
  <example>NTLM</example>
670
688
  <example>Ntlm</example>
689
+ <param pos="0" name="hw.certainty" value="0.0"/>
690
+ <param pos="0" name="os.certainty" value="0.0"/>
691
+ <param pos="0" name="service.certainty" value="0.0"/>
671
692
  </fingerprint>
672
693
 
673
694
  <fingerprint pattern="^Negotiate$">
674
- <description>Ignore Negotiate-only</description>
695
+ <description>Ignore Negotiate-only -- assert nothing</description>
675
696
  <example>Negotiate</example>
697
+ <param pos="0" name="hw.certainty" value="0.0"/>
698
+ <param pos="0" name="os.certainty" value="0.0"/>
699
+ <param pos="0" name="service.certainty" value="0.0"/>
676
700
  </fingerprint>
677
701
 
678
702
  <!--
@@ -681,24 +705,33 @@
681
705
  -->
682
706
 
683
707
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
684
- <description>Ignore null/empty/period/index.</description>
708
+ <description>Ignore null/empty/period/index -- assert nothing</description>
685
709
  <example>Basic realm="null"</example>
686
710
  <example>Basic realm="."</example>
687
711
  <example>Basic realm=""</example>
688
712
  <example>Basic realm="/"</example>
689
713
  <example>Basic realm='/'</example>
690
714
  <example>Basic realm="index.html"</example>
715
+ <param pos="0" name="hw.certainty" value="0.0"/>
716
+ <param pos="0" name="os.certainty" value="0.0"/>
717
+ <param pos="0" name="service.certainty" value="0.0"/>
691
718
  </fingerprint>
692
719
 
693
720
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;">
694
- <description>Ignore realms with an IPv4 address</description>
721
+ <description>Ignore realms with an IPv4 address -- assert nothing</description>
695
722
  <example>Basic realm="192.168.0.1"</example>
696
723
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
697
727
  </fingerprint>
698
728
 
699
729
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;">
700
- <description>Ignore generic 'config' realms</description>
730
+ <description>Ignore generic 'config' realms -- assert nothing</description>
701
731
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
732
+ <param pos="0" name="hw.certainty" value="0.0"/>
733
+ <param pos="0" name="os.certainty" value="0.0"/>
734
+ <param pos="0" name="service.certainty" value="0.0"/>
702
735
  </fingerprint>
703
736
 
704
737
  <!--
data/xml/imap_banners.xml CHANGED
@@ -168,8 +168,8 @@
168
168
 
169
169
  <fingerprint pattern="^(\S{1,512}) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
170
170
  <description>Nortel CallPilot</description>
171
- <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
- <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
171
+ <example service.version="42.02.05.22" host.name="nottest.localdomain">nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
+ <example service.version="43.03.19.22" host.name="test.localdomain">test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
173
173
  <param pos="0" name="service.vendor" value="Nortel"/>
174
174
  <param pos="0" name="service.product" value="CallPilot"/>
175
175
  <param pos="2" name="service.version"/>
data/xml/nntp_banners.xml CHANGED
@@ -24,8 +24,8 @@
24
24
 
25
25
  <fingerprint pattern="^NNTP Service (?:.*) Version: (5.0.2195.[0-9]+)">
26
26
  <description>Microsoft IIS NNTP Server on Windows 2000</description>
27
- <example>NNTP Service 5.00.0984 Version: 5.0.2195.7034 Posting Allowed</example>
28
- <example>NNTP Service 5.00.0984 Version: 5.0.2195.5329 Posting Allowed</example>
27
+ <example service.version="5.0.2195.7034" ms.nttp.version="5.0.2195.7034">NNTP Service 5.00.0984 Version: 5.0.2195.7034 Posting Allowed</example>
28
+ <example service.version="5.0.2195.5329" ms.nttp.version="5.0.2195.5329">NNTP Service 5.00.0984 Version: 5.0.2195.5329 Posting Allowed</example>
29
29
  <param pos="0" name="service.vendor" value="Microsoft"/>
30
30
  <param pos="0" name="service.product" value="IIS"/>
31
31
  <param pos="0" name="service.family" value="IIS"/>
@@ -40,8 +40,8 @@
40
40
 
41
41
  <fingerprint pattern="^NNTP Service (?:.*) Version: (6.0.3790.[0-9]+)">
42
42
  <description>Microsoft IIS NNTP Server on Windows Server 2003</description>
43
- <example>NNTP Service 6.0.3790.3959 Version: 6.0.3790.3959 Posting Allowed</example>
44
- <example>NNTP Service 6.0.3790.206 Version: 6.0.3790.206 Posting Allowed</example>
43
+ <example service.version="6.0.3790.3959" ms.nttp.version="6.0.3790.3959">NNTP Service 6.0.3790.3959 Version: 6.0.3790.3959 Posting Allowed</example>
44
+ <example service.version="6.0.3790.206" ms.nttp.version="6.0.3790.206">NNTP Service 6.0.3790.206 Version: 6.0.3790.206 Posting Allowed</example>
45
45
  <param pos="0" name="service.vendor" value="Microsoft"/>
46
46
  <param pos="0" name="service.product" value="IIS"/>
47
47
  <param pos="0" name="service.family" value="IIS"/>
@@ -82,9 +82,12 @@
82
82
  </fingerprint>
83
83
 
84
84
  <fingerprint pattern="^NNTP server ready(?: \(no posting\))?$">
85
- <description>Non-specific NNTP</description>
85
+ <description>Non-specific NNTP -- assert nothing</description>
86
86
  <example>NNTP server ready (no posting)</example>
87
87
  <example>NNTP server ready</example>
88
+ <param pos="0" name="hw.certainty" value="0.0"/>
89
+ <param pos="0" name="os.certainty" value="0.0"/>
90
+ <param pos="0" name="service.certainty" value="0.0"/>
88
91
  </fingerprint>
89
92
 
90
93
  </fingerprints>
data/xml/ntp_banners.xml CHANGED
@@ -92,7 +92,7 @@
92
92
 
93
93
  <fingerprint pattern="version=&quot;ntpd (\S+)[^&quot;]+&quot;,.*system=&quot;Equallogic \(R\) storage array&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
94
94
  <description>ntpd running on an EqualLogic Storage Array that includes the NTP version</description>
95
- <example>
95
+ <example service.version="4.2.0-r">
96
96
  version="ntpd 4.2.0-r Fri Feb 5 15:18:30 EST 2010 (1)",
97
97
  processor="Working", system="EqualLogic (R) storage array", leap=0,
98
98
  stratum=3, precision=-7, rootdelay=102.894, rootdispersion=245.154,
@@ -140,7 +140,7 @@
140
140
 
141
141
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;Linux/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
142
142
  <description>ntpd running on Linux</description>
143
- <example>
143
+ <example service.version="4.2.4p3@1.1502-o" os.arch="i686" os.version="2.4.29">
144
144
  version="ntpd 4.2.4p3@1.1502-o Wed Jul 18 11:45:01 UTC 2007 (1)",
145
145
  processor="i686", system="Linux/2.4.29", leap=00, stratum=3,
146
146
  </example>
@@ -157,7 +157,7 @@
157
157
 
158
158
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?6\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
159
159
  <description>ntpd running on Mac OSX 10.2/Jaguar</description>
160
- <example service.version="4.1.1@1.786" os.version.version="8">
160
+ <example service.version="4.1.1@1.786" os.version.version="8" os.arch="Power Macintosh">
161
161
  version="ntpd 4.1.1@1.786 Tue Nov 12 09:30:41 PST 2002 (1)", processor="Power Macintosh", system="Darwin6.8",
162
162
  </example>
163
163
  <param pos="0" name="service.family" value="NTP"/>
@@ -190,7 +190,7 @@
190
190
 
191
191
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?8\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
192
192
  <description>ntpd running on Mac OSX 10.4/Tiger</description>
193
- <example>
193
+ <example service.version="4.2.0@1.1161-r" os.arch="i386" os.version.version="11.1">
194
194
  version="ntpd 4.2.0@1.1161-r Fri Jan 13 11:36:23 PST 2006 (1)",
195
195
  processor="i386", system="Darwin/8.11.1", leap=11, stratum=16,
196
196
  </example>
@@ -209,7 +209,7 @@
209
209
 
210
210
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?9\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
211
211
  <description>ntpd running on Mac OSX 10.5/Leopard</description>
212
- <example>
212
+ <example service.version="4.2.2@1.1532-o" os.arch="Power Macintosh" os.version.version="0.0">
213
213
  version="ntpd 4.2.2@1.1532-o Mon Sep 24 01:42:27 UTC 2007 (1)",
214
214
  processor="Power Macintosh", system="Darwin/9.0.0", leap=3, stratum=16,
215
215
  </example>
@@ -228,7 +228,7 @@
228
228
 
229
229
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?10\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
230
230
  <description>ntpd running on Mac OSX 10.6/Snow Leopard</description>
231
- <example>
231
+ <example service.version="4.2.4p4@1.1520-o" os.arch="i386" os.version.version="8.0">
232
232
  version="ntpd 4.2.4p4@1.1520-o Mon May 18 19:38:25 UTC 2009 (1)",
233
233
  processor="i386", system="Darwin/10.8.0", leap=0, stratum=3,
234
234
  </example>
@@ -267,7 +267,7 @@
267
267
 
268
268
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?11\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
269
269
  <description>ntpd running on Mac OSX 10.7/Lion</description>
270
- <example>
270
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="2.0">
271
271
  version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
272
272
  processor="x86_64", system="Darwin/11.2.0", leap=11, stratum=16,
273
273
  </example>
@@ -367,7 +367,7 @@
367
367
 
368
368
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;FreeBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
369
369
  <description>ntpd running on FreeBSD</description>
370
- <example>
370
+ <example service.version="4.2.6p2@1.2194" os.arch="i386" os.version="7.4-PRERELEASE">
371
371
  version="ntpd 4.2.6p2@1.2194 Wed Nov 24 15:54:11 UTC 2010 (1)",
372
372
  processor="i386", system="FreeBSD/7.4-PRERELEASE", leap=00, stratum=3,
373
373
  </example>
@@ -400,7 +400,7 @@
400
400
 
401
401
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;NetBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
402
402
  <description>ntpd running on NetBSD</description>
403
- <example>
403
+ <example service.version="4.2.4p6-o" os.arch="sparc64" os.version="5.0_STABLE">
404
404
  version="ntpd 4.2.4p6-o Thu Jan 8 21:02:40 MET 2009 (import)",
405
405
  processor="sparc64", system="NetBSD/5.0_STABLE", leap=00, stratum=1,
406
406
  </example>
@@ -420,34 +420,34 @@
420
420
  <example os.arch="i386" os.version="1.5.3">
421
421
  processor="i386", system="NetBSD1.5.3"
422
422
  </example>
423
- <example>
423
+ <example os.arch="i386" os.version="1.6">
424
424
  processor="i386", system="NetBSD1.6"
425
425
  </example>
426
- <example>
426
+ <example os.arch="i386" os.version="1.6.1">
427
427
  processor="i386", system="NetBSD1.6.1"
428
428
  </example>
429
- <example>
429
+ <example os.arch="i386" os.version="1.6.2_STABLE">
430
430
  processor="i386", system="NetBSD1.6.2_STABLE"
431
431
  </example>
432
- <example>
432
+ <example os.arch="sbmips" os.version="3.0">
433
433
  processor="sbmips", system="NetBSD3.0"
434
434
  </example>
435
- <example>
435
+ <example os.arch="se100" os.version="1.5.3">
436
436
  processor="se100", system="NetBSD1.5.3"
437
437
  </example>
438
- <example>
438
+ <example os.arch="seil3" os.version="1.6.1_STABLE">
439
439
  processor="seil3", system="NetBSD1.6.1_STABLE"
440
440
  </example>
441
- <example>
441
+ <example os.arch="seil3" os.version="1.6.2_STABLE">
442
442
  processor="seil3", system="NetBSD1.6.2_STABLE"
443
443
  </example>
444
- <example>
444
+ <example os.arch="seil4" os.version="1.6.1_STABLE">
445
445
  processor="seil4", system="NetBSD1.6.1_STABLE"
446
446
  </example>
447
- <example>
447
+ <example os.arch="seil4" os.version="1.6.2_STABLE">
448
448
  processor="seil4", system="NetBSD1.6.2_STABLE"
449
449
  </example>
450
- <example>
450
+ <example os.arch="siara2k" os.version="1.5.3">
451
451
  processor="siara2k", system="NetBSD1.5.3"
452
452
  </example>
453
453
  <param pos="0" name="os.vendor" value="NetBSD"/>
@@ -818,7 +818,7 @@
818
818
 
819
819
  <fingerprint pattern="system=&quot;UNIX/SunOS ([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
820
820
  <description>SunOS with no ntp version</description>
821
- <example>
821
+ <example os.version="4.x">
822
822
  system="UNIX/SunOS 4.x",
823
823
  </example>
824
824
  <param pos="0" name="os.vendor" value="Sun"/>
@@ -830,7 +830,7 @@
830
830
 
831
831
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;JUNOS/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
832
832
  <description>ntpd running on Juniper/Netscreen JunOS</description>
833
- <example>
833
+ <example service.version="4.2.0-a" os.arch="i386" os.version="9.3R4.4">
834
834
  version="ntpd 4.2.0-a Wed Aug 12 04:22:47 UTC 2009 (1)",
835
835
  processor="i386", system="JUNOS9.3R4.4", leap=11, stratum=16,
836
836
  </example>
@@ -860,11 +860,11 @@
860
860
 
861
861
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;Windows/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
862
862
  <description>ntpd running on Windows</description>
863
- <example>
863
+ <example service.version="4.2.4p7@copenhagen-o" os.arch="x86">
864
864
  version="ntpd 4.2.4p7@copenhagen-o May 22 11:25:36 (UTC+02:00) 2009 (3)",
865
865
  processor="x86", system="Windows", leap=00, stratum=2, precision=-19,
866
866
  </example>
867
- <example>
867
+ <example service.version="4.2.4p4@1.1520-modena-o" os.arch="unknown" os.version="NT">
868
868
  version="ntpd 4.2.4p4@1.1520-modena-o Dec 05 9:35:28 (UTC+01:00) 2007 (11)",
869
869
  processor="unknown", system="WINDOWS/NT", leap=00, stratum=2,
870
870
  </example>
@@ -881,7 +881,7 @@
881
881
 
882
882
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;HP-UX/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
883
883
  <description>ntpd running on HP-UX</description>
884
- <example>
884
+ <example service.version="4.2.2@1.1532-o" os.arch="9000/800" os.version="B.11.11">
885
885
  version="ntpd 4.2.2@1.1532-o Wed Sep 6 16:49:43 EDT 2006 (2)",
886
886
  processor="9000/800", system="HP-UX/B.11.11", leap=00, stratum=1,
887
887
  </example>
@@ -913,7 +913,7 @@
913
913
 
914
914
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;[^ ]+&quot;,.*system=&quot;([^ ]+)-hp-hpux([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
915
915
  <description>ntpd running on HP-UX, where the processor is in the 'system' variable</description>
916
- <example>
916
+ <example service.version="4.2.5p154@1.1802" os.arch="ia64" os.version="11.31">
917
917
  version="ntpd 4.2.5p154@1.1802 Tue Mar 22 22:09:00 UTC 2011 (39)",
918
918
  processor="unknown", system="ia64-hp-hpux11.31", leap=00, stratum=1,
919
919
  </example>
@@ -935,7 +935,7 @@
935
935
 
936
936
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;VMkernel/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
937
937
  <description>ntpd running on VMware ESXi</description>
938
- <example>
938
+ <example service.version="4.2.4p6@1.1495" os.arch="x86_64" os.version="4.1.0">
939
939
  version="ntpd 4.2.4p6@1.1495 Wed Sep 22 02:33:15 UTC 2010 (1)",
940
940
  processor="x86_64", system="VMkernel/4.1.0", leap=11, stratum=16,
941
941
  </example>
@@ -1031,7 +1031,7 @@
1031
1031
 
1032
1032
  <fingerprint pattern="system=&quot;Data ONTAP/+(\S+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1033
1033
  <description>NetApp file servers</description>
1034
- <example>
1034
+ <example os.version="8.1RC2">
1035
1035
  system="Data ONTAP/8.1RC2"
1036
1036
  </example>
1037
1037
  <param pos="0" name="os.vendor" value="NetApp"/>
@@ -1110,7 +1110,7 @@
1110
1110
 
1111
1111
  <fingerprint pattern="system=&quot;UNIX/Unixware([^ ]+)&quot;" flags="REG_ICASE">
1112
1112
  <description>SCO Unixware NTP</description>
1113
- <example>
1113
+ <example os.product="2">
1114
1114
  system="UNIX/Unixware2", leap=3, stratum=16, rootdelay=0.00,
1115
1115
  rootdispersion=0.00, peer=0, refid=0.0.0.0, reftime=0x00000000.00000000,
1116
1116
  poll=4, clock=0xd1d874b7.051ec000, phase=0.000, freq=0.00, error=0.00
@@ -1134,7 +1134,7 @@
1134
1134
 
1135
1135
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*\s*processor=&quot;([^ ]+)&quot;,.*system=&quot;SecureOS/([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1136
1136
  <description>McAfee Network Firewall Enterprise NTP (SecureOS)</description>
1137
- <example>
1137
+ <example service.version="4.2.0-r" os.arch="i386" os.version="7.0.1.00">
1138
1138
  version="ntpd 4.2.0-r Thu Aug 11 12:41:19 CDT 2005 (1)",
1139
1139
  processor="i386", system="SecureOS/7.0.1.00", leap=0, stratum=3,
1140
1140
  precision=-19, rootdelay=27.044, rootdispersion=87.845, peer=2357,
@@ -1142,7 +1142,7 @@
1142
1142
  clock=0xd2636c8e.d5e2d427, state=4, offset=0.519, frequency=-3.027,
1143
1143
  jitter=5.132, stability=0.394
1144
1144
  </example>
1145
- <example>
1145
+ <example service.version="4.2.0-r" os.arch="i386" os.version="7.0.0.04">
1146
1146
  version="ntpd 4.2.0-r Thu Aug 11 12:41:19 CDT 2005 (1)",
1147
1147
  processor="i386", system="SecureOS/7.0.0.04", leap=0, stratum=2,
1148
1148
  precision=-19, rootdelay=56.480, rootdispersion=35.772, peer=8677,
@@ -1161,14 +1161,14 @@
1161
1161
 
1162
1162
  <fingerprint pattern="processor=&quot;([^ ]+)&quot;.*system=&quot;Linux([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1163
1163
  <description>ntpd running on linux</description>
1164
- <example>
1164
+ <example os.arch="i686" os.version="2.6.10">
1165
1165
  processor="i686", system="Linux2.6.10", leap=0, stratum=2,
1166
1166
  precision=-17, rootdelay=44.644, rootdispersion=29.933, peer=13317,
1167
1167
  refid=A.B.C.D, reftime=0xd2c29f69.407570c5, poll=10,
1168
1168
  clock=0xd2c2a335.360999dc, state=4, phase=1.037, frequency=55.898,
1169
1169
  jitter=0.203, stability=0.004
1170
1170
  </example>
1171
- <example>
1171
+ <example os.arch="i686" os.version="2.6.23.waas">
1172
1172
  processor="i686", system="Linux2.6.23.waas", leap=0, stratum=2,
1173
1173
  precision=-18, rootdelay=37.550, rootdispersion=427.047, peer=40613,
1174
1174
  refid=172.20.62.191, reftime=0xd297a442.8b66c6de, poll=14,
@@ -1188,7 +1188,7 @@
1188
1188
 
1189
1189
  <fingerprint pattern="version=&quot;ntpd (\S+)[^&quot;]+&quot;,.*\s*processor=&quot;([^ ]+)&quot;.*system=&quot;Isilon OneFS/v([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1190
1190
  <description>Isilon OneFS NTP Server</description>
1191
- <example>
1191
+ <example service.version="4.2.4p4-o" os.arch="i386" os.version="5.5.4.21">
1192
1192
  version="ntpd 4.2.4p4-o Thu Feb 4 20:43:00 UTC 2010 (1)",
1193
1193
  processor="i386", system="Isilon OneFS/v5.5.4.21", leap=0, stratum=14,
1194
1194
  precision=-19, rootdelay=0.000, rootdispersion=11.260, peer=60044,