Repository: fail2ban/fail2ban (language: python)

Issue:
[FR]: lighttpd-auth not matching
<!--
  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
  - Sometimes failregex have been already requested before but are not implemented yet due to various reasons.
  - If there are no hits for your concerns, please proceed otherwise add a comment to the related issue (also if it is closed).
  - If you want to request a new feature, please use "Feature request" instead.
  - If you have rather some question, please open or join to some discussion.
-->

### Environment:

<!--
  Fill out and check (`[x]`) the boxes which apply.
-->
- Fail2Ban version <!-- including any possible distribution suffixes --> : 0.11.2-2
- OS, including release name/version : Debian GNU/Linux 11 (bullseye)
- [x] Fail2Ban installed via OS/distribution mechanisms
- [x] You have not applied any additional foreign patches to the codebase
- [ ] Some customizations were done to the configuration (provide details below is so)


#### Service, project or product which log or journal should be monitored

- Name of filter or jail in Fail2Ban (if already exists) : lighttpd-auth
- Service, project or product name, including release name/version : lighttpd 1.4.59-1
- Repository or URL (if known) : https://github.com/lighttpd/lighttpd1.4
- Service type : web-server
- Ports and protocols the service is listening : 80, 443

#### Log or journal information
<!-- Delete unrelated group -->

<!-- Log file -->

- Log file name(s) : /var/log/lighttpd/error.log

<!-- Systemd journal -->

- Journal identifier or unit name : lighttpd.service

#### Any additional information


### Relevant lines from monitored log files:

#### failures in sense of fail2ban filter (fail2ban must match):
<!-- put your log excerpt between next 2 lines -->
```
2021-09-30 16:05:33: mod_auth.c.828) password doesn't match for /secure/ username: test IP: 123.123.123.123
```

#### legitimate messages (fail2ban should not consider as failures):
<!-- put your log excerpt between next 2 lines -->
```
```



Discussion / hints:
Hmm... strange that it was changed in this weird way (removed first open parenthesis char and comma before IP).

But corresponding the source code the comma is indeed removed (at least for `password doesn't match` message):
https://github.com/lighttpd/lighttpd1.4/blob/6ffabc960789fa284b16006d97456eb070e07824/src/mod_auth.c#L840-L841
Just open parenthesis seems to be still there:
https://github.com/lighttpd/lighttpd1.4/blob/6ffabc960789fa284b16006d97456eb070e07824/src/log.c#L113
However maybe `log_buffer_vprintf` writes the remaining formatted error message to wrong offset (-1 char), so it overwrites this `(`-char in buffer.

The fix would be something like that:
```diff
- failregex = ^: \((?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed), IP: <HOST>\s*$
+ failregex = ^: \(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed),? IP: <HOST>\s*$
```
so making both chars optional.

But to adjust to the source code (and to avoid catch-all's) it could be something like that:
```ini
failregex = ^: \(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+<F-USER>(?:\S+|.*?)</F-USER>\s*|digest: auth failed(?: for\s+<F-ALT_USER>(?:\S+|.*?)</F-ALT_USER>\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: <HOST>\s*$
```
It turns out it's a known bug in lighttpd: https://redmine.lighttpd.net/issues/3105

However, until the upstream lighttpd gets pushed out, I'll try those regexes.
I added the second regex in filter.d/lighttpd-auth.local, and the line matches now
```
[Definition]

failregex = %(known/failregex)s
            ^: \(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+<F-USER>(?:\S+|.*?)</F-USER>\s*|digest: auth failed(?: for\s+<F-ALT_USER>(?:\S+|.*?)</F-ALT_USER>\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: <HOST>\s*$
```
Thanks for the help!



Fix patch:
diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf
index a68f4f4d0f..dcf19d3e87 100644
--- a/config/filter.d/lighttpd-auth.conf
+++ b/config/filter.d/lighttpd-auth.conf
@@ -3,7 +3,7 @@
 
 [Definition]
 
-failregex = ^: \((?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed), IP: <HOST>\s*$
+failregex = ^\s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+<F-USER>(?:\S+|.*?)</F-USER>\s*|digest: auth failed(?: for\s+<F-ALT_USER>(?:\S+|.*?)</F-ALT_USER>\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: <HOST>\s*$
 
 ignoreregex = 
 


Test patch:
diff --git a/fail2ban/tests/files/logs/lighttpd-auth b/fail2ban/tests/files/logs/lighttpd-auth
index 184dba3374..c8a922b528 100644
--- a/fail2ban/tests/files/logs/lighttpd-auth
+++ b/fail2ban/tests/files/logs/lighttpd-auth
@@ -1,4 +1,3 @@
-#authentification failure (mod_auth)
 # failJSON: { "time": "2011-12-25T17:09:20", "match": true , "host": "4.4.4.4" }
 2011-12-25 17:09:20: (http_auth.c.875) password doesn't match for /gitweb/ username: francois, IP: 4.4.4.4
 # failJSON: { "time": "2012-09-26T10:24:35", "match": true , "host": "4.4.4.4" }
@@ -7,3 +6,9 @@
 2013-08-25 00:24:55: (http_auth.c.877) get_password failed, IP: 4.4.4.4
 # failJSON: { "time": "2018-01-16T14:10:32", "match": true , "host": "192.0.2.1", "desc": "http_auth -> mod_auth, gh-2018" }
 2018-01-16 14:10:32: (mod_auth.c.525) password doesn't match for /test-url username: test, IP: 192.0.2.1
+# failJSON: { "time": "2021-09-30T16:05:33", "match": true , "host": "192.0.2.2", "user":"test", "desc": "gh-3116" }
+2021-09-30 16:05:33: mod_auth.c.828) password doesn't match for /secure/ username: test IP: 192.0.2.2
+# failJSON: { "time": "2021-09-30T17:44:37", "match": true , "host": "192.0.2.3", "user":"tester", "desc": "gh-3116" }
+2021-09-30 17:44:37: (mod_auth.c.791) digest: auth failed for  tester : wrong password, IP: 192.0.2.3
+# failJSON: { "time": "2021-09-30T17:44:37", "match": true , "host": "192.0.2.4", "desc": "gh-3116" }
+2021-09-30 17:44:37: (mod_auth.c.791) digest: auth failed: uri mismatch (/uri1 != /uri2), IP: 192.0.2.4