string search and modification

[Jim Britain]

I know absolutely nothing about Python. My background is shell
scripts assembly language and C programming. Currently I work network
support.

This is a portion of a Python script written by aaronsinclair. the
full script can be found at:

http://forums.ev1servers.net/printthread.php?t=50435&page=3&pp=25

It monitors sendmail logfiles for dictionary attacks, and blocks with
additions to iptables.



The part I am having a problem with is the regular expression in the
re.search function.

Basicly, it is insufficiently qualified.

Troublesome example logfile line:
Sep 6 00:46:32 tabor sendmail[26642]: k867kMH5026642:
dsl-kk-dynamic-013.38.22.125.t ouchtelindia.ne t [125.22.38.13] (may be
forged)
Possible SMTP RCPT flood, throttling.

(all one line in the logfile)

What is happenning, is there are two sections that will qualify in
this logfile line, and it matches on the wrong one.

What I would like to happen, is to return the value from within the
brackets, in every successful match.

I have tried putting \[ in the beginning of the string, but am
unsuccessful editting the qualifying character back out again, and
returning the real ip string. (If indeed I did even get a match).

This script runs in the background, and I would have to build a
complete test environ, and rewrite the whole darn thing to run
visibly, and use different files.

I thought asking -- like a beginner -- for the trivial solution.
(besides being up all night and all day).

Thanks in advance for any help. Quick searches online for tutorial
documentation and the books I have.. met with horrible results in
finding a solution.

I would like to match [123.123.123.123] (including the qualifying
brackets), but be able to simply return the contents, without the
brackets.

(Perl would be easy, but it's not Python)

def identifyHost(se lf):

for line in self.fileConten ts:
if re.search("thro ttling", line.lower()):
ip = re.search("[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}",
line)

if ip.group() in self.ignoreList :
continue
if not ip.group() in self.banList:
self.banList.ap pend(ip.group() )

[Paul Rubin]

Re: string search and modification

Jim Britain <nomail2me@char ter.netwrites:

I would like to match [123.123.123.123] (including the qualifying
brackets), but be able to simply return the contents, without the
brackets.

>>p=r'\[((\d{1,3}\.){3} \d{1,3})\]'
>>m = 'dsl-kk-dynamic-013.38.22.125.t ouchtelindia.ne t [125.22.38.13] (may be'
>>g=re.search(p ,m)
>>g.group(1)

'125.22.38.13'

g.group(1) matches the stuff in the first set of parens, which excludes
the square brackets.

[Jim Britain]

Re: string search and modification

On 06 Sep 2006 13:23:43 -0700, Paul Rubin
<http://phr.cx@NOSPAM.i nvalidwrote:

>Jim Britain <nomail2me@char ter.netwrites:

>I would like to match [123.123.123.123] (including the qualifying
>brackets), but be able to simply return the contents, without the
>brackets.

>
>

>p=r'\[((\d{1,3}\.){3} \d{1,3})\]'
>m = 'dsl-kk-dynamic-013.38.22.125.t ouchtelindia.ne t [125.22.38.13] (may be'
>g=re.search(p, m)
>g.group(1)

>'125.22.38.1 3'
>
>g.group(1) matches the stuff in the first set of parens, which excludes
>the square brackets.

Final integration:

def identifyHost(se lf):
for line in self.fileConten ts:
if re.search("thro ttling", line.lower()):
p=r'\[((\d{1,3}\.){3} \d{1,3})\]'
ip=re.search(p, line)
if ip.group(1) in self.ignoreList :
continue
if not ip.group(1) in self.banList:
self.banList.ap pend(ip.group(1 ))


Thanks for the help.
Jim
--

[John Machin]

Re: string search and modification


Jim Britain wrote:

>
Final integration:
>
def identifyHost(se lf):
for line in self.fileConten ts:
if re.search("thro ttling", line.lower()):
p=r'\[((\d{1,3}\.){3} \d{1,3})\]'
ip=re.search(p, line)

A prudent pessimist might test for the complete absence of an IP
address:
if not ip:
print "Huh?" # or whatever

if ip.group(1) in self.ignoreList :
continue
if not ip.group(1) in self.banList:
self.banList.ap pend(ip.group(1 ))
>
>