From 0d6ce7cad3b484a7f05c4595f65ddaaed1bee218 Mon Sep 17 00:00:00 2001
From: K2IE <dan@islenet.com>
Date: Mon, 1 Feb 2021 09:25:43 -0500
Subject: [PATCH 1/2] Add bcc and dontsend capabilities

---
 config/action.d/xarf-login-attack.conf | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index f348b2c4..ccf9f3a0 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -49,6 +49,8 @@ actionban = oifs=${IFS};
             IFS=${oifs}
             IP=<ip>
             FROM=<sender>
+            BCC=<bcc>
+            DONTSEND=<dontsend>
             SERVICE=<service>
             FAILURES=<failures>
             REPORTID=<time>@<fq-hostname>
@@ -56,11 +58,16 @@ actionban = oifs=${IFS};
             PORT=<port>
             DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
             if [ ! -z "$ADDRESSES" ]; then
-                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
-                IFS=${oifs}
+                if [ ! -z "$DONTSEND" ]; then
+                    for ckaddr in "${DONTSEND[@]}"; do
+                        if [[ "$ADDRESSES" == *"$ckaddr"* ]]; then
+                           exit 0   
+                        fi
+                    done
+                 fi
                 (printf -- %%b "<header>\n<message>\n<report>\n\n";
                  date '+Note: Local timezone is %%z (%%Z)';
-                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES
+                 printf -- %%b "\n<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> $ADDRESSES $BCC
             fi
 
 actionunban =
@@ -141,3 +148,11 @@ sender = fail2ban@<fq-hostname>
 # Notes.:  This is the port number that received the login-attack
 port = 0
 
+# Option:  bcc
+# Notes:   Allows the user to specify a user to receive a copy of the email
+bcc =
+
+# Option:  dontsend
+# Notes:   Array of abuse emails to ignore.  Eg.
+# dontsend = ('email@one.com' 'email@two.com' 'email@three.com')
+dontsend =

From 8f6729a491395ee1fa3b0806b46d8e73fa958d47 Mon Sep 17 00:00:00 2001
From: K2IE <dan@islenet.com>
Date: Mon, 1 Feb 2021 10:09:11 -0500
Subject: [PATCH 2/2] Revert removed IFS logic

Address concerns re #2372.
---
 config/action.d/xarf-login-attack.conf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index ccf9f3a0..9795f579 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -58,6 +58,8 @@ actionban = oifs=${IFS};
             PORT=<port>
             DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"`
             if [ ! -z "$ADDRESSES" ]; then
+                oifs=${IFS}; IFS=,; ADDRESSES=$(echo $ADDRESSES)
+                IFS=${oifs}      
                 if [ ! -z "$DONTSEND" ]; then
                     for ckaddr in "${DONTSEND[@]}"; do
                         if [[ "$ADDRESSES" == *"$ckaddr"* ]]; then