From 8da0a99cdeaae5711bd0094d682eab98dba3d986 Mon Sep 17 00:00:00 2001
From: Vladimir Varlamov <bes.internal@gmail.com>
Date: Fri, 22 Mar 2024 22:01:31 +0300
Subject: [PATCH] pid part may contain full hostname
---
config/filter.d/exim-common.conf | 2 +-
fail2ban/tests/files/logs/exim | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/config/filter.d/exim-common.conf b/config/filter.d/exim-common.conf
index 4d622b7b..0f8c91ff 100644
--- a/config/filter.d/exim-common.conf
+++ b/config/filter.d/exim-common.conf
@@ -11,7 +11,7 @@ after = exim-common.local
_fields_grp = (?: (?!H=)[A-Za-z]{1,4}(?:=\S+)?)*
host_info = %(_fields_grp)s (?:H=)?(?:[\w.-]+)? ?(?:\(\S+\))? ?\[<ADDR>\](?::\d+)?%(_fields_grp)s
-pid = (?: \[\d+\]| \w+ exim\[\d+\]:)?
+pid = (?: \[\d+\]| [\w\.-]+ exim\[\d+\]:)?
# DEV Notes
diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim
index da7e2bc6..c66a0f98 100644
--- a/fail2ban/tests/files/logs/exim
+++ b/fail2ban/tests/files/logs/exim
@@ -47,8 +47,8 @@
# failJSON: { "time": "2014-01-12T02:07:48", "match": true , "host": "85.214.85.40" }
2014-01-12 02:07:48 dovecot_login authenticator failed for h1832461.stratoserver.net (User) [85.214.85.40]: 535 Incorrect authentication data (set_id=scanner)
-# failJSON: { "time": "2019-10-22T03:39:17", "match": true , "host": "192.0.2.37", "desc": "pid-prefix in form of 'mx1 exim[...]:', gh-2553" }
-2019-10-22 03:39:17 mx1 exim[29786]: dovecot_login authenticator failed for (User) [192.0.2.37]: 535 Incorrect authentication data (set_id=test@domain.com)
+# failJSON: { "time": "2019-10-22T03:39:17", "match": true , "host": "192.0.2.37", "desc": "pid-prefix in form of 'hostname exim[...]:', gh-2553" }
+2019-10-22 03:39:17 mx1.fqdn.local exim[29786]: dovecot_login authenticator failed for (User) [192.0.2.37]: 535 Incorrect authentication data (set_id=test@domain.com)
# failJSON: { "time": "2014-12-02T03:00:23", "match": true , "host": "193.254.202.35" }
2014-12-02 03:00:23 auth_plain authenticator failed for (rom182) [193.254.202.35]:41556 I=[10.0.0.1]:25: 535 Incorrect authentication data (set_id=webmaster)