novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

A jail's pattern names <HOST> once, and is refused by name when it does not (hq ADR 0179) #221

Merged
mesh-admin merged 1 commits from fix/a-jails-pattern-names-the-host-once into main 2026-10-02 15:32:14 +00:00
Conversation 0 Commits 1 Files Changed 1
+39
mesh-admin commented 2026-10-02 15:25:43 +00:00
Contributor
Copy Link
Copy Source

fail2ban expands the host placeholder into a named capture group, so a pattern naming it twice is a duplicate group name: the daemon refuses its whole configuration and exits, and the machine keeps no bans at all, for every jail rather than the one at fault. That happened live on the control node the day the jails shipped, and cost fail2ban on both servers for about ten minutes.

The manifest check refuses it at merge time with what it would cost. A jail with no name, no pattern, or a name another of the same module's jails took is refused too. Tests in internal/catalogue/jail_problems_test.go.

fail2ban expands the host placeholder into a named capture group, so a pattern naming it twice is a duplicate group name: the daemon refuses its whole configuration and exits, and the machine keeps no bans at all, for every jail rather than the one at fault. That happened live on the control node the day the jails shipped, and cost fail2ban on both servers for about ten minutes. The manifest check refuses it at merge time with what it would cost. A jail with no name, no pattern, or a name another of the same module's jails took is refused too. Tests in `internal/catalogue/jail_problems_test.go`.
mesh-admin added 1 commit 2026-10-02 15:25:44 +00:00
A jail's pattern names <HOST> once, and is refused by name when it does not (hq ADR 0179) 99c4c4ef04 
fail2ban expands <HOST> into a named capture group, so a pattern naming it twice is a duplicate
group name: the daemon refuses its whole configuration and exits, and the machine keeps no bans at
all — for every jail, not the one at fault. Hit live on the control node the day the jails shipped.
A jail with no name, no pattern, or a name another of the module's jails took is refused too.
mesh-admin merged commit 689dd060b0 into main 2026-10-02 15:32:14 +00:00
mesh-admin deleted branch fix/a-jails-pattern-names-the-host-once 2026-10-02 15:32:14 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#221