Multiple failures need different parsing

diff --git a/bouncer.c b/bouncer.c
index e5edf9e1150fee491e46fc4f1e9a090f13572120..6fffcea4b17eca4c369e99d615cba9952c285256 100644 (file)
--- a/bouncer.c
+++ b/bouncer.c
@@ -363,6 +363,48 @@ static bool check_next(char **pp, char *want)
   return 1;
 }
 
+static void parse_failure(char *p, int cnt)
+{
+  DBG("Parse 4: <%s> cnt=%d", p, cnt);
+
+  // Decode attributes
+  bool done = 0;
+  char *rhost = NULL;
+  while (!done)
+    {
+      while (*p == ' ')
+       p++;
+      if (!*p)
+       break;
+
+      char *key = p;
+      while (*p && *p != ' ' && *p != '=')
+       p++;
+      if (*p != '=')
+       continue;
+      *p++ = 0;
+
+      char *val = p;
+      while (*p && *p != ' ')
+       p++;
+      if (*p)
+       *p++ = 0;
+      else
+       done = 1;
+
+      DBG("Parse KV: %s=<%s>", key, val);
+      if (!strcmp(key, "rhost"))
+       rhost = val;
+    }
+
+  // Act on the message
+  struct addr addr;
+  if (addr_parse(&addr, rhost))
+    handle_failed_login(addr, cnt);
+  else
+    msg(L_WARN, "Unable to parse address %s", rhost);
+}
+
 static void process_msg(char *line)
 {
   DBG("Parse: <%s>", line);
@@ -391,72 +433,39 @@ static void process_msg(char *line)
   DBG("Parse 2: <%s>", p);
 
   // pam_unix(something), colon, space
-  if (!check_next(&p, "pam_unix("))
-    return;
-  do
+  if (check_next(&p, "pam_unix("))
     {
-      c = *p++;
-      if (!c || c == ' ')
+      do
+       {
+         c = *p++;
+         if (!c || c == ' ')
+           return;
+       }
+      while (c != ')');
+      if (!check_next(&p, ": "))
+       return;
+      DBG("Parse 3: <%s>", p);
+
+      if (!check_next(&p, "authentication failure; "))
        return;
+
+      parse_failure(p, 1);
     }
-  while (c != ')');
-  if (!check_next(&p, ": "))
-    return;
-  DBG("Parse 3: <%s>", p);
 
-  // "authentication failure;"
-  int cnt = 1;
-  if (!check_next(&p, "authentication failure; "))
+  // "PAM <n> more authentication failures;"
+  if (check_next(&p, "PAM "))
     {
-      // "PAM <n> more authentication failures;"
-      if (!check_next(&p, "PAM "))
-       return;
       if (!(*p >= '0' && *p <= '9'))
        return;
-      cnt = atoi(p);
+      int cnt = atoi(p);
       while (*p >= '0' && *p <= '9')
        p++;
+
       if (!check_next(&p, " more authentication failures; "))
        return;
-    }
-  DBG("Parse 4: <%s> cnt=%d", p, cnt);
 
-  // Decode attributes
-  bool done = 0;
-  char *rhost = NULL;
-  while (!done)
-    {
-      while (*p == ' ')
-       p++;
-      if (!*p)
-       break;
-
-      char *key = p;
-      while (*p && *p != ' ' && *p != '=')
-       p++;
-      if (*p != '=')
-       continue;
-      *p++ = 0;
-
-      char *val = p;
-      while (*p && *p != ' ')
-       p++;
-      if (*p)
-       *p++ = 0;
-      else
-       done = 1;
-
-      DBG("Parse KV: %s=<%s>", key, val);
-      if (!strcmp(key, "rhost"))
-       rhost = val;
+      parse_failure(p, cnt);
     }
-
-  // Act on the message
-  struct addr addr;
-  if (addr_parse(&addr, rhost))
-    handle_failed_login(addr, cnt);
-  else
-    msg(L_WARN, "Unable to parse address %s", rhost);
 }
 
 /*** Socket for receiving messages from rsyslog ***/