On Thu, 25 Nov 2010 18:47:07 +0000 (UTC)
karsten@xxxxxxxxxxxxxx wrote:
> Author: Karsten Loesing <karsten.loesing@xxxxxxx>
> Date: Thu, 25 Nov 2010 19:42:49 +0100
> Subject: Match full Torbutton user agents.
> Commit: 157c0dfe0722113bef50cea73be74600bde9414e
>
> ---
> visitor/visitor.py | 16 ++++++++--------
> 1 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/visitor/visitor.py b/visitor/visitor.py
> index 06288b1..466bd52 100644
> --- a/visitor/visitor.py
> +++ b/visitor/visitor.py
> @@ -16,18 +16,18 @@ from cStringIO import StringIO
> # regexes used in the script
> IP_RE = re.compile(r'(\d+\.){3}\d+')
> APACHE_DATETIME = re.compile(r'\[(\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}) ([+-]\d{4})\]')
> -TOR_USERAGENTS = [('torbutton1_2_0', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> +TOR_USERAGENTS = [('torbutton1_2_0', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> r'[a-z]{2}-[A-Z]{2}; rv\:1\.8\.1\.16\) '
> - r'Gecko/20080702 Firefox/2\.0\.0\.16')),
> - ('torbutton1_2_0rc1', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> + r'Gecko/20080702 Firefox/2\.0\.0\.16"$')),
> + ('torbutton1_2_0rc1', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> r'en-US; rv\:1\.8\.1\.14\) '
> - r'Gecko/20080404 Firefox/2\.0\.0\.14')),
> - ('torbutton1_2_1', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> + r'Gecko/20080404 Firefox/2\.0\.0\.14"$')),
> + ('torbutton1_2_1', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 5\.1; '
> r'en-US; rv\:1\.9\.0\.7\) '
> - r'Gecko/2009021910 Firefox/3\.0\.7')),
> - ('torbutton1_2_5', re.compile(r'Mozilla/5\.0 \(Windows; U; Windows NT 6\.1; '
> + r'Gecko/2009021910 Firefox/3\.0\.7"$')),
> + ('torbutton1_2_5', re.compile(r'^"Mozilla/5\.0 \(Windows; U; Windows NT 6\.1; '
> r'[a-z]{2}-[A-Z]{2}; rv:1\.9\.2\.3\) '
> - r'Gecko/20100401 Firefox/3\.6\.3'))
> + r'Gecko/20100401 Firefox/3\.6\.3"$'))
> ]
>
>
This list is not complete -- TAILS 0.5, and presumably other
installations of Torbutton 1.2.5, produce the following User-Agent
string:
Mozilla/5.0 (Windows; U; Windows NT 6.1; chrome://global/locale/intl.properties; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
See <https://amnesia.boum.org/security/Iceweasel_exposes_a_rare_User-Agent/>.
(Nobody should still be using TAILS 0.5, due to this and other security
issues, but your script is intended to be useful for analyzing older
logs as well as new ones.)
Robert Ransom
Attachment:
signature.asc
Description: PGP signature