Hello,
I'm new to this list. I'm familiar with regular expressions but
there's one aspect of failregex's that I do not understand - the
nesting aspect. Take, for instance, this example from "apache-
badbots.conf" which comes with the installer in the filters.d/
directory:
badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou
music spider
badbots =
Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent
...etc...etc...etc...
failregex = ^<HOST> -
.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
The part that I don't understand is this:
"(?:%(badbots)s|%(badbotscustom)s)"
...If that is a part of standard Posix regular expressions (or perl
extensions), I was not aware of it. So what is it? I can see that
the "%(badbots)" is probably getting replaced by the big long or'ed
regular expression above ...but what about the "s" after the last
closing parenthesis? And I do not understand the "(? ... )" ...what
does it mean to have an expression that is entirely enclosed in this
parenthesized expression with a question mark after the first opening
parenthesis?
Thanks in advance for any help.
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
