git: d72c8f5dea66 - 2026Q3 - security/sshguard: Backport upstream patch

The branch 2026Q3 has been updated by nxjoseph:

URL: https://cgit.FreeBSD.org/ports/commit/?id=d72c8f5dea6611d43b9ae0cb684cd1681028deab

commit d72c8f5dea6611d43b9ae0cb684cd1681028deab
Author:     SASAKI Katuhiro <crest@sahiro.org>
AuthorDate: 2026-09-25 05:36:47 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-09-25 05:42:04 +0000

    security/sshguard: Backport upstream patch
    
    To fix HOSTNAME field in syslog header handling.
    
    PR:             298836
    Approved by:    Kevin Zheng <kevinz5000@gmail.com> (maintainer)
    Approved by:    osa, vvd (Mentors, implicit)
    MFH:            2026Q3
    
    (cherry picked from commit 15f83b9d89941e55ac06600250304bcd7b00db3a)
---
 security/sshguard/Makefile                              |  2 +-
 .../sshguard/files/patch-src_parser_attack__scanner.l   | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/security/sshguard/Makefile b/security/sshguard/Makefile
index b514eb48943e..824a3d205d1f 100644
--- a/security/sshguard/Makefile
+++ b/security/sshguard/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	sshguard
 PORTVERSION=	2.5.1
-PORTREVISION=	1
+PORTREVISION=	2
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	SF/sshguard/sshguard/${PORTVERSION}
diff --git a/security/sshguard/files/patch-src_parser_attack__scanner.l b/security/sshguard/files/patch-src_parser_attack__scanner.l
new file mode 100644
index 000000000000..a5043735bfc5
--- /dev/null
+++ b/security/sshguard/files/patch-src_parser_attack__scanner.l
@@ -0,0 +1,17 @@
+https://github.com/SSHGuard/sshguard/commit/06caf25a6abccdbba51e67ac99d83df9d412dc3f
+https://github.com/SSHGuard/sshguard/commit/f180843f6da34f9ca7a2557fa1b51ca85c561634
+
+--- src/parser/attack_scanner.l.orig	2025-04-28 18:20:39 UTC
++++ src/parser/attack_scanner.l
+@@ -95,8 +95,9 @@ HTTP_VERSION    HTTP"/"[0-9]("."[0-9])?
+ HTTP_REQUEST    (GET|HEAD|PUT|POST|DELETE)
+ HTTP_VERSION    HTTP"/"[0-9]("."[0-9])?
+ 
+- // host part of a hostname (without any domain parts)
+-SYSLOG_HOSTNAME   {WORD}
++ // RFC 5424 says HOSTNAME header field SHOULD contain the FQDN.
++ // IP addresss and hostname may also be present in HOSTNAME.
++SYSLOG_HOSTNAME   {WORD}|{HOSTADDR}
+ 
+  // timestamp (optional PRI) hostname
+ SYSLOG_HEADER     ({TIMESTAMP_SYSLOG}|{TIMESTAMP_ISO8601})[ ]+{FACLEVEL}?[ ]*{SYSLOG_HOSTNAME}[ ]+