From 3d23a44bb162534470974dd1209ae47e6a631a30 Mon Sep 17 00:00:00 2001
From: bill <git@billforsyth.net>
Date: Wed, 10 Sep 2025 13:27:30 -0400
Subject: [PATCH 1/3] fix `dig` to filter out warnings from email address
 capture

---
 config/action.d/xarf-login-attack.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index f348b2c4..a0121966 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -44,7 +44,8 @@ actioncheck =
 actionban = oifs=${IFS};
             RESOLVER_ADDR="%(addr_resolver)s"
             if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
-            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
+            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | grep -v ';;' | tr -d '"')
+            if [ "<debug>" -gt 0 ]; then echo "returned address $ADDRESSES"; fi
             IFS=,; ADDRESSES=$(echo $ADDRESSES)
             IFS=${oifs}
             IP=<ip>

From 85cfb8178263cf9a612a0e6996eb7095c1db27fd Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <github@sebres.de>
Date: Wed, 10 Sep 2025 20:04:10 +0200
Subject: [PATCH 2/3] lets see an error (with debug messages) in debug case

---
 config/action.d/xarf-login-attack.conf | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index a0121966..00da7f79 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -46,6 +46,11 @@ actionban = oifs=${IFS};
             if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
             ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | grep -v ';;' | tr -d '"')
             if [ "<debug>" -gt 0 ]; then echo "returned address $ADDRESSES"; fi
+            if [ -z "$ADDRESSES" ]; then
+               echo "address for $RESOLVER_ADDR cannot be found or timeout from dig";
+               if [ "<debug>" -gt 0 ]; then exit 1; fi
+               exit 0
+            fi
             IFS=,; ADDRESSES=$(echo $ADDRESSES)
             IFS=${oifs}
             IP=<ip>
@@ -56,13 +61,11 @@ actionban = oifs=${IFS};
             TLP=<tlp>
             PORT=<port>
             DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
-            if [ ! -z "$ADDRESSES" ]; then
-                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
-                IFS=${oifs}
-                (printf -- %%b "<header>\n<message>\n<report>\n\n";
-                 date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
-            fi
+            oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
+            IFS=${oifs}
+            (printf -- %%b "<header>\n<message>\n<report>\n\n";
+             date '+Note: Local timezone is %%z (%%Z)';
+             printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
 
 actionunban =
 

From 4539e6719c433aa0af5bc7e5fbd8f2e4e7e0d65f Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <github@sebres.de>
Date: Wed, 10 Sep 2025 20:19:34 +0200
Subject: [PATCH 3/3] Update ChangeLog

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index 3879d226..cb4dc856 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
   - postfix backend switched to `systemd` (gh-3527)
 * `action.d/firewallcmd-ipset.conf`:
   - rename `ipsettype` to `ipsetbackend` (gh-2620), parameter `ipsettype` will be used now to the real set type (gh-3760)
+* `action.d/xarf-login-attack.conf` - ignore errors or warnings in output of `dig` provided as comment (gh-4068)
 * `filter.d/apache-noscript.conf` - consider new log-format with "AH02811: stderr from /..." (gh-3900)
 * `filter.d/apache-overflows.conf` - consider AH10244: invalid URI path (gh-3778, gh-3900)
 * `filter.d/asterisk.conf` - fixed RE for "no matching endpoint" with retry info (like `after X tries in Y ms`) at end,