ports/157979: fail2ban fails 2 ban since update of June, 11

[Christoph Theis]

>Number:         157979
>Category:       ports
>Synopsis:       fail2ban fails 2 ban since update of June, 11
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jun 18 06:10:10 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Christoph Theis
>Release:        8.2-RELEASE
>Organization:
>Environment:
FreeBSD galadriel 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Feb 18 02:24:46 UTC 2011     root at almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
Since the last update of June, 11 2011 fail2ban fails to recognize "SSH intruders" with the filter filter.d/bsd-sshd.conf. 
I guess the bug was introduced with the introduction of supporting verbose output of syslog, the patch from June 11.

In filter.d/common.conf the __prefix_line is now defined as
__prefix_line = \s*%(__bsd_verbose_mode)s(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*

But isn't the __bsd_verbose_mode this way not now mandatory?
I think __prefix_line shall be defined as
__prefix_line = \s*%(__bsd_verbose_mode)s?(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
( add a "?" after "%(__bsd_verbose_mode)s" )

I tested with fail2ban-regex: With the original line from the ports I get 0 hits on the log file, with my modified line I get > 1000 hits.

And the comment above that line still reads
# [hostname] [vserver tag] daemon_id spaces
But shouldn't it read
# [verbose] [hostname] [vserver tag] daemon_id spaces
>How-To-Repeat:
In /usr/local/etc/fail2ban run
fail2ban-regex /var/log/auth.log filter.d/bsd-sshd.conf filter.d/bsd-sshd.conf
and check for the number of hits
>Fix:
See above: __bsd_verbose_mode shall be optional (add an "?" added after it)

>Release-Note:
>Audit-Trail:
>Unformatted: