Re: [or-cvs] [metrics-utils/master 2/4] Match full Torbutton user agents.

[Karsten Loesing <karsten.loesing@xxxxxxx>]

On 11/25/10 10:22 PM, Robert Ransom wrote:
> On Thu, 25 Nov 2010 18:47:07 +0000 (UTC)
> karsten@xxxxxxxxxxxxxx wrote:
> 
>> Author: Karsten Loesing <karsten.loesing@xxxxxxx>
>> Date: Thu, 25 Nov 2010 19:42:49 +0100
>> Subject: Match full Torbutton user agents.
>> Commit: 157c0dfe0722113bef50cea73be74600bde9414e
>>
>> ---
>>  visitor/visitor.py |   16 ++++++++--------
>>  1 files changed, 8 insertions(+), 8 deletions(-)
>>
>> diff --git a/visitor/visitor.py b/visitor/visitor.py
>> index 06288b1..466bd52 100644
>> --- a/visitor/visitor.py
>> +++ b/visitor/visitor.py
>> @@ -16,18 +16,18 @@ from cStringIO import StringIO
>>  # regexes used in the script
>>  IP_RE = re.compile(r'(\d+\.){3}\d+')
>>  APACHE_DATETIME = re.compile(r'\[(\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}) ([+-]\d{4})\]')
>> -TOR_USERAGENTS = [('torbutton1_2_0', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>> +TOR_USERAGENTS = [('torbutton1_2_0', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>>                                                  r'[a-z]{2}-[A-Z]{2}; rv\:1\.8\.1\.16\) '
>> -                                                r'Gecko/20080702 Firefox/2\.0\.0\.16')),
>> -                  ('torbutton1_2_0rc1', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>> +                                                r'Gecko/20080702 Firefox/2\.0\.0\.16"$')),
>> +                  ('torbutton1_2_0rc1', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>>                                                     r'en-US; rv\:1\.8\.1\.14\) '
>> -                                                   r'Gecko/20080404 Firefox/2\.0\.0\.14')),
>> -                  ('torbutton1_2_1', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>> +                                                   r'Gecko/20080404 Firefox/2\.0\.0\.14"$')),
>> +                  ('torbutton1_2_1', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
>>                                                  r'en-US; rv\:1\.9\.0\.7\) '
>> -                                                r'Gecko/2009021910 Firefox/3\.0\.7')),
>> -                  ('torbutton1_2_5', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 6\.1; '
>> +                                                r'Gecko/2009021910 Firefox/3\.0\.7"$')),
>> +                  ('torbutton1_2_5', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 6\.1; '
>>                                                  r'[a-z]{2}-[A-Z]{2}; rv:1\.9\.2\.3\) '
>> -                                                r'Gecko/20100401 Firefox/3\.6\.3'))
>> +                                                r'Gecko/20100401 Firefox/3\.6\.3"$'))
>>                    ]
>>  
>>  
> 
> This list is not complete -- TAILS 0.5, and presumably other
> installations of Torbutton 1.2.5, produce the following User-Agent
> string:
> 
> Mozilla/5.0 (Windows; U; Windows NT 6.1; chrome://global/locale/intl.properties; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
> 
> See <https://amnesia.boum.org/security/Iceweasel_exposes_a_rare_User-Agent/>.
> 
> (Nobody should still be using TAILS 0.5, due to this and other security
> issues, but your script is intended to be useful for analyzing older
> logs as well as new ones.)

I just added this user-agent string:

  https://gitweb.torproject.org/metrics-utils.git/commitdiff/e3e9ec8

Thanks!
Karsten