Bug#327088: [Logcheck-devel] Bug#327088: Dovecot rules doesn't work with ipv6

[Elmar Hoffmann]

Hi,

on Wed, Oct 12, 2005 at 12:46:05 +0100, Jamie L. Penman-Smithson wrote:

> On Wed, 2005-09-07 at 17:44 +0200, Marco Nenciarini wrote:
> > Your rule does not fit the case that the client have an ipv6 ip. Yhis
> > is the log:
> > 
> > Sep  7 17:41:12 lorien pop3-login: Login: mnencia at prato.linux.it [2001:1418:13:10::1]
> 
> Adjusted for next release:
> 
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (imap|pop3)-login: Login:
> [.[:alnum:]@-]+ \[(::ffff:)?[:0-9.]+\]$

While the given example log entry unfortunately does not show it, an
IPv6 address does use hex digits, ie. the address of the box I'm
writing this on is 2001:1638:1810::201:2ff:fe0d:6cec, which would not
be matched by the pattern (::ffff:)?[:0-9.]+ used above (and the other
rules I didn't quote).
Thus a correct pattern to match an IPv4 or IPv6 address would be:
[0-9a-f.:]+

elmar

-- 

 .'"`.                                                            /"\
| :' :   Elmar Hoffmann <elho at elho.net>    ASCII Ribbon Campaign  \ /
`. `'    GPG key available via pgp.net        against HTML email   X
  `-                                                    & vCards  / \
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20051013/fe6d1a63/attachment.pgp