Hello - I think either I am setting up my regex filter for processing
log file lines from the Apache James email filter or I have found a bug
in fail2ban-regex and perhaps in fail2ban itself, so I need some kind
guru to help me with this.
I ran the following test, trying to see what is matched by the
variable used in the regex expression for my filter. Below is shown the
command for fail2ban-regex and the output from it. This shows both a
sample log file line that appears to be failing to get the address
banned, and the regex expression I am using.
To my untrained eyes, the variable/pattern for should match the
IP4 address 87.246.7.246 but it appears that the actual match is
7.246.7.246 ie the leading 8 is missing in the matched IP address. Why?
Is my regex expression wrong or is this a bug? If so, how to I report
the bug?
Many thanks in advance for helping me with this issue! Marc...
fail2ban-regex -v -v -l HEAVYDEBUG "2022-03-05 09:30:18,739 ERROR |
org.apache.james.protocols.api.handler.CommandHandler | AUTH method
LOGIN failed from r...@marcchamberlin.com@87.246.7.246"
"^\s*ERROR(\s*\|)?(\s+[\w+\.]+\w+\s+\|)?\s+AUTH method LOGIN failed
from.*\s*$"
Running tests
=
2022-03-05 10:06:27,753 7F3161E20740 DEBUG Setting usedns = warn for
Filter(None)
2022-03-05 10:06:27,753 7F3161E20740 DEBUG Created Filter(None)
Use failregex line : ^\s*ERROR(\s*\|)?(\s+[\w+\.]+\w+\s+\|)?\s+AUTH
met...
Use single line : 2022-03-05 09:30:18,739 ERROR |
org.apache.james.p...
2022-03-05 10:06:27,754 7F3161E20740 TRACE Working on line
'2022-03-05 09:30:18,739 ERROR |
org.apache.james.protocols.api.handler.CommandHandler | AUTH method
LOGIN failed from r...@marcchamberlin.com@87.246.7.246'
2022-03-05 10:06:27,754 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)((?P202\d)(?P<_sep>[-/.])(?P1[0-2]|0[1-9]|[1-9])(?P=_sep)(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])(?:T|
?)(?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)(?:[.,](?P[0-9]{1,6}))?(?:\s*(?PZ|UTC|GMT|[+-][01]\d(?::?\d{2})?))?)(?=\b|\W|$)
2022-03-05 10:06:27,755 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)(?iu)((?:(?Pmon|tue|wed|thu|fri|sat|sun)
)?(?Pjan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)
(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]| [1-9])
?(?P[0-2]?\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)(?:\.(?P[0-9]{1,6}))?(?:
(?P202\d))?)(?=\b|\W|$)
2022-03-05 10:06:27,755 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)(?iu)((?:(?Pmon|tue|wed|thu|fri|sat|sun)
)?(?Pjan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)
(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]| [1-9]) (?P202\d)
?(?P[0-2]?\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)(?:\.(?P[0-9]{1,6}))?)(?=\b|\W|$)
2022-03-05 10:06:27,755 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)((?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])(?P<_sep>[-/])(?P1[0-2]|0[1-9]|[1-9])(?P=_sep)(?:(?P202\d)|(?P2\d))
?(?P[0-2]?\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d))(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)(?iu)((?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])(?P<_sep>[-/])(?Pjan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)(?P=_sep)(?P202\d)[
:]?(?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)(?:\.(?P[0-9]{1,6}))?(?:
(?PZ|UTC|GMT|[+-][01]\d(?::?\d{2})?))?)(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)((?P1[0-2]|0[1-9]|[1-9])/(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])/(?P202\d):(?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d))(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)((?P1[0-2]|0[1-9]|[1-9])-(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])-(?P202\d)
?(?P[0-2]?\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)(?:\.(?P[0-9]{1,6}))?)(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
((?:^|(?P(?<=^\[))|(?P(?<=\baudit\()))\d{10,11}\b(?:\.\d{3,6})?)(?:(?(selinux)(?=:\d+\)))|(?(square)(?=\])))(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
^(?:\W{0,2})?((?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d))(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
^(<(?P1[0-2]|0[1-9]|[1-9])/(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])/(?P2\d)@(?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)>)(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)((?P2\d)(?P1[0-2]|0[1-9])(?P3[0-1]|[1-2]\d|0[1-9])
?(?P2[0-3]|[0-1]\d|\d):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d))(?=\b|\W|$)
2022-03-05 10:06:27,756 7F3161E20740 TRACE constructed regex
(?=^|\b|\W)(?iu)((?Pjan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)
(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]| [1-9]), (?P202\d)
(?P1[0-2]|0[1-9]|[1-9]):(?P[0-5]\d|\d):(?P6[0-1]|[0-5]\d|\d)
(?Pam|pm))(?=\b|\W|$)
2022-03-05 10:06:27,757 7F3161E20740 TRACE constructed regex
(?iu)^((?Pjan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)-(?P3[0-1]|[1-2]\d|0[1-9]|[1-9]|
[1-9])-(?P2\d)
