Use the ban duration supplied by ActionInfo instead of replacing it with the jail default. ActionInfo already falls back to the jail duration when the ticket has no explicit ban time.
Add regression coverage for increased and permanent ticket durations and the default-duration fallback.
Gitlab deprecated application.log in 15.10 in favour of the structured
application_json.log. Add a mode option so the filter can read either
format; text stays the default so existing setups keep working.
Closes#3566
The previous regex was written against an assumed field order/spacing
that doesn't match what Cowrie actually emits: no space after ":",
and "eventid" is not the first key (order is session, protocol,
src_ip, ..., eventid, ..., message). Rework the failregex to match
real-world json output, and correct the datepattern to wrap only the
timestamp value (not the "timestamp": key) in the capture group, since
fail2ban excises the whole captured group from the line before
failregex is applied - wrapping the key too left a broken ",," gap in
the JSON that never matched.
Verified against real Cowrie honeypot log samples (session.connect,
client.version, client.kex, login.success, log.closed) and the
existing test-suite (101 filter sample-regex tests pass).
Replace the custom Python Filter/backend hack with a plain regex
filter, per sebres's review: fail2ban filters shouldn't ship a
custom backend-style parser under config/filter.d, and the previous
prefregex/failregex pair was a no-op catch-all that didn't actually
filter anything.
- Drop cowrie_json.py entirely; parse the JSON log line directly
with a bounded, anchored failregex (no unbounded .* catch-alls)
using <ADDR> instead of <HOST> since only an IP is expected.
- Add the required sample log test file
(fail2ban/tests/files/logs/cowrie_json) covering matched,
non-matching event, and malformed lines.
AH02811 lines can name the CGI directory itself rather than a script
inside it:
stderr from /srv/http/cgi-bin: script not found or unable to stat
The script pattern required 'cgi-bin/', so a path ending in 'cgi-bin:'
never matched. Use a word boundary instead.
Closes gh-4040
The error-log regex hardcoded the file-format prefix, so lines carrying a
systemd journal prefix were missed. Use __prefix_line from
nginx-error-common.conf, as the other nginx error-log filters already do.
Closes gh-3732
review feedback from sebres, the file already has a filterOptions aggressive section, so the sample belongs there rather than in a second one at the end.
Postfix logs this warning when a client's reverse DNS does not resolve
back to its address. Bots trip it constantly, but so does a legitimate
sender with broken rDNS, so it only belongs in aggressive mode.
Regex as given by sebres in gh-4078 and confirmed working by the
reporter.
Closes gh-4078
