2 Mar
2007
2 Mar
'07
1:27 p.m.
On Thu, 2007-03-01 at 10:07 -0800, Evan Rempel wrote:
Suggestion:
allow syntax that specified user definable macro names for expansion.
host("^([^\.]+)\." fullmatch shorthost) match("bad login from ([^ ]+) " fullmatch ip)
and the filter becomes filter fail_login { host("^([^\.]+)\." shorthost) and match("bad login from ([^ ]+) " ip); };
and then a template can be written as
template my_template{ template("$ISODATE $HOST $shorthost is being attacked from $ip\n"); template_escape(no)); };
The "fullmatch" is in keeping with the regexp matching syntax of many languages.
An additional concern is that users might attempt to use new macronames that conflict with existing ones, but that should be easy to handle.
I like this idea. -- Bazsi