more software signatures

src/plugins/analysis/software_components/signatures/crypto.yara

@@ -1,3 +1,15 @@
+rule mbed_TLS {
+	meta:
+		software_name = "mbed TLS"
+		open_source = true
+		website = "https://github.com/Mbed-TLS/mbedtls"
+		description = "embedded library for cryptography, X.509 certificate manipulation and the SSL/TLS and DTLS protocols"
+    strings:
+        $a = /mbed TLS \d+\.\d+\.\d+/ ascii
+    condition:
+        $a and no_text_file
+}
+
 rule OpenSSL
 {
 	meta:
@@ -24,4 +36,3 @@ rule SSLeay
     condition:
         $a and no_text_file
 }
-

src/plugins/analysis/software_components/signatures/software.yara

@@ -54,6 +54,35 @@ rule jQuery
 		$a
 }
 
+rule libmagic_file {
+	meta:
+		software_name = "file"
+		open_source = true
+		website = "https://www.darwinsys.com/file/"
+		description = "file type guesser"
+		version_regex = "\\d\\.\\d+"
+		format_string = true
+	strings:
+		$a =  "%s-%s" ascii
+		$b =  "File: file.c,v" ascii
+	condition:
+		$a and $b
+}
+
+rule OPKG {
+	meta:
+		software_name = "OPKG"
+		open_source = true
+		website = "https://openwrt.org/docs/guide-user/additional-software/opkg"
+		description = "Opkg lightweight embedded package manager"
+		version_regex = "[0-9a-z]{40} \\(\\d{4}-\\d{2}-\\d{2}\\)"
+	strings:
+		$a =  "opkg version %s\n" nocase ascii
+		$b =  /[0-9a-z]{40} \(\d{4}-\d{2}-\d{2}\)/ ascii
+	condition:
+		$a and $b
+}
+
 rule Perl
 {
 	meta:

src/plugins/analysis/software_components/test/data/software_component_test_list.txt

@@ -65,6 +65,7 @@ libpcap version 1.5.2
 libsqlite3-3.8.11.1.so
 libupnp-1.6.18
 lighttpd-1.4.18
+mbed TLS 2.16.3
 nc -h for help
 netatalk-2.2.0
 nginx version: nginx/1.13.3