From 374560ac093f61e320745a9d9cd66083f4d3c711 Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Wed, 18 Mar 2015 16:13:41 -0500
Subject: [PATCH 01/11] add new example for comware ssh

---
 xml/ssh_banners.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index c5089469..d27be88f 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -778,10 +778,11 @@ fingerprint SSH servers.
       <param pos="0" name="os.product" value="Windows"/>
    </fingerprint>
    
-   <fingerprint pattern="^Comware-(\d+\.?\d*\.?\d*)$">
+   <fingerprint pattern="^(?:SSH-[1|2]\.\d{1,2}-)?Comware-(\d+\.?\d*\.?\d*)$">
       <description>SSH on H3C Comware</description>
       <example os.version="5.20.105">Comware-5.20.105</example>
       <example os.version="5.20">Comware-5.20</example>
+      <example os.version="5.20">SSH-1.99-Comware-5.20</example>
       <param pos="0" name="service.vendor" value="H3C"/>
       <param pos="0" name="service.product" value="SSH"/>
       <param pos="0" name="os.vendor" value="H3C"/>

From d5943228f9dc12fa883541df1280d42ace0500ae Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Wed, 18 Mar 2015 16:44:56 -0500
Subject: [PATCH 02/11] Add OpenVMS SSH banners

---
 xml/ssh_banners.xml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index d27be88f..6e4ae703 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -790,6 +790,42 @@ fingerprint SSH servers.
       <param pos="0" name="os.family" value="Comware"/>
       <param pos="1" name="os.version"/>
    </fingerprint>
+
+   <fingerprint pattern="^(?:SSH-2\.0-)?(\d\.\d\.\d) SSH Secure Shell OpenVMS V\d\.\d$">
+      <description>SSH for OpenVMS </description>
+      <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5</example>
+      <example>SSH-2.0-3.2.0 SSH Secure Shell OpenVMS V5.5</example>
+      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->		
+      <param pos="1" name="service.component.version"/>
+      <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
+      <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		
+      <param pos="2" name="service.version"/>      
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="SSH Server"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+   </fingerprint>
+
+   <fingerprint pattern="^SSH-2\.0-(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
+      <description>SSH for OpenVMS sftp</description>
+      <example service.component.version="3.2.0">SSH-2.0-3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
+      <example service.component.version="3.2.0" >SSH-2.0-3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>	
+      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
+      <param pos="1" name="service.component.version"/>		
+      <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
+      <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="SSH Server"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+   </fingerprint>
+
 <!--
 1.2.22j4rad
 2.40

From 94d69f41186b6fd61cb6fb9c841785b59d2163c9 Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Fri, 20 Mar 2015 11:25:11 -0500
Subject: [PATCH 03/11] Fixing banner match and adding custom certainty for
 OpenVMS SSH

---
 xml/ssh_banners.xml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index 6e4ae703..5d9b3a3f 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -791,28 +791,27 @@ fingerprint SSH servers.
       <param pos="1" name="os.version"/>
    </fingerprint>
 
-   <fingerprint pattern="^(?:SSH-2\.0-)?(\d\.\d\.\d) SSH Secure Shell OpenVMS V\d\.\d$">
+   <fingerprint pattern="^(\d\.\d\.\d) SSH Secure Shell OpenVMS V\d\.\d$">
       <description>SSH for OpenVMS </description>
       <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5</example>
-      <example>SSH-2.0-3.2.0 SSH Secure Shell OpenVMS V5.5</example>
       <!--V5.5 refers to TCP/IP Services for OpenVMS version -->		
       <param pos="1" name="service.component.version"/>
       <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
       <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
-      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		
-      <param pos="2" name="service.version"/>      
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		  
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenVMS"/>
       <param pos="0" name="service.product" value="SSH Server"/>
       <param pos="0" name="os.vendor" value="HP"/>
       <param pos="0" name="os.device" value="General"/>
       <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.certainty" value="0.75"/>
    </fingerprint>
 
-   <fingerprint pattern="^SSH-2\.0-(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
+   <fingerprint pattern="^(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
       <description>SSH for OpenVMS sftp</description>
-      <example service.component.version="3.2.0">SSH-2.0-3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
-      <example service.component.version="3.2.0" >SSH-2.0-3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>	
+      <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
+      <example service.component.version="3.2.0" >3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>	
       <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
       <param pos="1" name="service.component.version"/>		
       <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
@@ -820,10 +819,12 @@ fingerprint SSH servers.
       <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenVMS"/>
-      <param pos="0" name="service.product" value="SSH Server"/>
+      <param pos="0" name="service.product" value="VMS SFTP Server"/>
+      <param pos="2" name="service.version"/> 
       <param pos="0" name="os.vendor" value="HP"/>
       <param pos="0" name="os.device" value="General"/>
       <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.certainty" value="0.75"/>
    </fingerprint>
 
 <!--

From 844976c3ec173201eeed36de43a580aac4b6aa8b Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Fri, 20 Mar 2015 12:50:14 -0500
Subject: [PATCH 04/11] OpenVMS  add POP banner & change NTP vendor

---
 xml/ntp_banners.xml |  2 +-
 xml/pop_banners.xml | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/xml/ntp_banners.xml b/xml/ntp_banners.xml
index d6522323..f666ab2f 100644
--- a/xml/ntp_banners.xml
+++ b/xml/ntp_banners.xml
@@ -791,7 +791,7 @@ NTP "banners", taken from a readvar response
     </example>
     <param pos="0" name="service.family" value="NTP"/>
     <param pos="0" name="service.product" value="NTP"/>
-    <param pos="0" name="os.vendor" value="OpenVMS"/>
+    <param pos="0" name="os.vendor" value="HP"/>
     <param pos="0" name="os.product" value="OpenVMS"/>
     <param pos="1" name="service.version"/>
     <param pos="2" name="os.arch"/>
diff --git a/xml/pop_banners.xml b/xml/pop_banners.xml
index 7292d15a..34173ab3 100644
--- a/xml/pop_banners.xml
+++ b/xml/pop_banners.xml
@@ -225,6 +225,20 @@ matched against these patterns to fingerprint POP3 servers.
       <param pos="0" name="os.certainty" value="0.5"/>
    </fingerprint>
 
+   <fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d) .*$">
+      <description>TCP/IP Services for OpenVMS POP server</description>
+      <example os.version="7.3-2">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
+      <!--V5.4J-15A refers to TCP/IP Services for OpenVMS version-->
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="TCPIP POP server"/>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.product" value="OpenVMS"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="1" name="os.version"/>
+	</fingerprint>
+
 <!--
 
 ; Mandrake 8.1 - uses UW IMAP

From 4e3ae93ff8e453d41cbf961e68ef90d2be0fd394 Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Fri, 20 Mar 2015 13:05:56 -0500
Subject: [PATCH 05/11] remove bad comware example

---
 xml/ssh_banners.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index 5d9b3a3f..baeaf16a 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -778,11 +778,10 @@ fingerprint SSH servers.
       <param pos="0" name="os.product" value="Windows"/>
    </fingerprint>
    
-   <fingerprint pattern="^(?:SSH-[1|2]\.\d{1,2}-)?Comware-(\d+\.?\d*\.?\d*)$">
+   <fingerprint pattern="^Comware-(\d+\.?\d*\.?\d*)$">
       <description>SSH on H3C Comware</description>
       <example os.version="5.20.105">Comware-5.20.105</example>
       <example os.version="5.20">Comware-5.20</example>
-      <example os.version="5.20">SSH-1.99-Comware-5.20</example>
       <param pos="0" name="service.vendor" value="H3C"/>
       <param pos="0" name="service.product" value="SSH"/>
       <param pos="0" name="os.vendor" value="H3C"/>

From 705e0a293b44b9560e3be403b7d4d81831ab56fc Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Fri, 20 Mar 2015 13:31:58 -0500
Subject: [PATCH 06/11] Update pop_banners.xml

fix indent
---
 xml/pop_banners.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xml/pop_banners.xml b/xml/pop_banners.xml
index 34173ab3..a486e87a 100644
--- a/xml/pop_banners.xml
+++ b/xml/pop_banners.xml
@@ -237,7 +237,7 @@ matched against these patterns to fingerprint POP3 servers.
       <param pos="0" name="os.product" value="OpenVMS"/>
       <param pos="0" name="os.device" value="General"/>
       <param pos="1" name="os.version"/>
-	</fingerprint>
+   </fingerprint>
 
 <!--
 

From 8dd55e1ec48283b0518f4affb73e867c2becb7ae Mon Sep 17 00:00:00 2001
From: Jon Hart <jon_hart@rapid7.com>
Date: Mon, 23 Mar 2015 10:56:00 -0700
Subject: [PATCH 07/11] Extract host.name from OpenVMS POP banner

---
 xml/pop_banners.xml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xml/pop_banners.xml b/xml/pop_banners.xml
index a486e87a..dd2ba4b2 100644
--- a/xml/pop_banners.xml
+++ b/xml/pop_banners.xml
@@ -225,9 +225,9 @@ matched against these patterns to fingerprint POP3 servers.
       <param pos="0" name="os.certainty" value="0.5"/>
    </fingerprint>
 
-   <fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d) .*$">
+   <fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d)(?:\s+\S+)?\s+at\s+(\S+), .*$">
       <description>TCP/IP Services for OpenVMS POP server</description>
-      <example os.version="7.3-2">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
+      <example os.version="7.3-2" host.name="example.com">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
       <!--V5.4J-15A refers to TCP/IP Services for OpenVMS version-->
       <param pos="0" name="service.family" value="OpenVMS"/>
       <param pos="0" name="service.product" value="TCPIP POP server"/>
@@ -237,6 +237,7 @@ matched against these patterns to fingerprint POP3 servers.
       <param pos="0" name="os.product" value="OpenVMS"/>
       <param pos="0" name="os.device" value="General"/>
       <param pos="1" name="os.version"/>
+      <param pos="2" name="host.name"/>
    </fingerprint>
 
 <!--

From 7370decb1407d753e35156bc4fa9a243d075ea99 Mon Sep 17 00:00:00 2001
From: Jon Hart <jon_hart@rapid7.com>
Date: Mon, 23 Mar 2015 10:56:29 -0700
Subject: [PATCH 08/11] Kill trailing whitespace

---
 xml/ssh_banners.xml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index baeaf16a..f7559647 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -777,7 +777,7 @@ fingerprint SSH servers.
       <param pos="0" name="os.family" value="Windows"/>
       <param pos="0" name="os.product" value="Windows"/>
    </fingerprint>
-   
+
    <fingerprint pattern="^Comware-(\d+\.?\d*\.?\d*)$">
       <description>SSH on H3C Comware</description>
       <example os.version="5.20.105">Comware-5.20.105</example>
@@ -793,11 +793,11 @@ fingerprint SSH servers.
    <fingerprint pattern="^(\d\.\d\.\d) SSH Secure Shell OpenVMS V\d\.\d$">
       <description>SSH for OpenVMS </description>
       <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5</example>
-      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->		
+      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
       <param pos="1" name="service.component.version"/>
       <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
       <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
-      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		  
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenVMS"/>
       <param pos="0" name="service.product" value="SSH Server"/>
@@ -810,16 +810,16 @@ fingerprint SSH servers.
    <fingerprint pattern="^(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
       <description>SSH for OpenVMS sftp</description>
       <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
-      <example service.component.version="3.2.0" >3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>	
+      <example service.component.version="3.2.0" >3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>
       <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
-      <param pos="1" name="service.component.version"/>		
+      <param pos="1" name="service.component.version"/>
       <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
       <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
-      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>		
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenVMS"/>
       <param pos="0" name="service.product" value="VMS SFTP Server"/>
-      <param pos="2" name="service.version"/> 
+      <param pos="2" name="service.version"/>
       <param pos="0" name="os.vendor" value="HP"/>
       <param pos="0" name="os.device" value="General"/>
       <param pos="0" name="os.family" value="OpenVMS"/>

From 2e45ed43c031afc8b20fd763ff11d42a0d746f7b Mon Sep 17 00:00:00 2001
From: Jon Hart <jon_hart@rapid7.com>
Date: Mon, 23 Mar 2015 11:01:21 -0700
Subject: [PATCH 09/11] Test service.version extraction for OpenVMS SSH

---
 xml/ssh_banners.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index f7559647..5f4d2880 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -809,8 +809,8 @@ fingerprint SSH servers.
 
    <fingerprint pattern="^(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
       <description>SSH for OpenVMS sftp</description>
-      <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
-      <example service.component.version="3.2.0" >3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>
+      <example service.component.version="3.2.0" service.version="3">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
+      <example service.component.version="3.2.0" service.version="3">3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>
       <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
       <param pos="1" name="service.component.version"/>
       <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>

From e52db3d10b517eeaafe394e82a6fa9d926f0b0ae Mon Sep 17 00:00:00 2001
From: alynn71 <alynn71@users.noreply.github.com>
Date: Tue, 24 Mar 2015 10:53:19 -0500
Subject: [PATCH 10/11] Update ssh_banners.xml

made ssh version regex more flexible based on @jhart-r7's suggestion
---
 xml/ssh_banners.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
index 5f4d2880..ae2f965c 100644
--- a/xml/ssh_banners.xml
+++ b/xml/ssh_banners.xml
@@ -790,7 +790,7 @@ fingerprint SSH servers.
       <param pos="1" name="os.version"/>
    </fingerprint>
 
-   <fingerprint pattern="^(\d\.\d\.\d) SSH Secure Shell OpenVMS V\d\.\d$">
+   <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d\.\d$">
       <description>SSH for OpenVMS </description>
       <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5</example>
       <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
@@ -807,7 +807,7 @@ fingerprint SSH servers.
       <param pos="0" name="os.certainty" value="0.75"/>
    </fingerprint>
 
-   <fingerprint pattern="^(\d\.\d\.\d) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
+   <fingerprint pattern="^(\d\.\d+\.\d+) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
       <description>SSH for OpenVMS sftp</description>
       <example service.component.version="3.2.0" service.version="3">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
       <example service.component.version="3.2.0" service.version="3">3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>

From 1191d43165473a4e0fdf0278fd86c0284b9cbaf0 Mon Sep 17 00:00:00 2001
From: Jon Hart <jon_hart@rapid7.com>
Date: Tue, 24 Mar 2015 17:00:46 -0700
Subject: [PATCH 11/11] Bump to 1.0.24 for #43

---
 lib/recog/version.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/recog/version.rb b/lib/recog/version.rb
index 13a92b9a..d70a2207 100644
--- a/lib/recog/version.rb
+++ b/lib/recog/version.rb
@@ -1,3 +1,3 @@
 module Recog
-  VERSION = '1.0.23'
+  VERSION = '1.0.24'
 end