@ -13,25 +13,10 @@ Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated
fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++
3 files changed, 31 insertions(+), 3 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index fc4beade6e..04401ea866 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,10 @@ ver. 1.0.2-dev-1 (20??/??/??) - development nightly edition
-----------
### Fixes
+* `filter.d/dovecot.conf`:
+ - fixes regression introduced in gh-3210: resolve extremely long search by repeated apply of non-greedy RE-part
+ with following branches (it may be extremely slow up to infinite search depending on message), gh-3370
+ - fixes regression and matches new format in aggressive mode too (amend to gh-3210)
### New Features and Enhancements
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 0415ecb40a..dc3ebbcd42 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
Index: fail2ban-1.0.1/config/filter.d/dovecot.conf
===================================================================
--- fail2ban-1.0.1.orig/config/filter.d/dovecot.conf
+++ fail2ban-1.0.1/config/filter.d/dovecot.conf
@@ -7,19 +7,21 @@ before = common.conf
[Definition]
@ -57,11 +42,11 @@ index 0415ecb40a..dc3ebbcd42 100644
mdre-normal =
diff --git a/fail2ban/tests/files/logs/dovecot b /fail2ban/tests/files/logs/dovecot
index 75934c37bb..0e33296129 100644
--- a/fail2ban/tests/files/logs/dovecot
+++ b/fail2ban/tests/files/logs/dovecot
@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot: imap-login: Disconnected (auth failed,
Index: fail2ban-1.0.1 /fail2ban/tests/files/logs/dovecot
===================================================================
--- f ail2ban-1.0.1.orig /fail2ban/tests/files/logs/dovecot
+++ fail2 ban-1.0.1 /fail2ban/tests/files/logs/dovecot
@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot:
# failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" }
Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test@example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe>
@ -79,7 +64,7 @@ index 75934c37bb..0e33296129 100644
# failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" }
Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0
# failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" }
@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesi eve-login: Disconnected: Too many invali
@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesi
# filterOptions: [{"mode": "aggressive"}]