daniell/parserfilter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Robustify parser, and chomp up messages not in [preauth]

Browse Source
This commit is contained in:
Daniel Lysfjord
2024-03-24 13:29:24 +01:00
parent 3b9ab1864d
commit c4ef60e38f
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/ssh_parser.pm
View File

@ -47,13 +47,13 @@ sub parser {
m/(from\ ($re_host)) /gcix && do {
$host = $2;
};
} elsif($string =~ m/(Disconnecting|Received disconnect from|Disconnected from|Connection closed by|Connection reset by) (authenticating |invalid |)(user .* |)$re_host port [0-9]{1,6}.*\[preauth\]/) {
} elsif($string =~ m/(Disconnecting|Received disconnect from|Disconnected from|Connection closed by|Connection reset by) (authenticating |invalid |)(user .* |)$re_host port [0-9]{1,6}(\: Too many authentication failures|)( \[preauth\]|)/) {
$_ = $string;
$reply = 'Received disconnect';
$hostile = 1;
PARSER:
m/\ ($re_host)\ /gcix && do {
$host = $1;
m/(\ ($re_host)\ port\ [0-9]{1,6})/gcix && do {
$host = $2;
};
} elsif($string =~ m/refused connect from .* \($re_host\)/) {
$_ = $string;