[Netfilter] Further improvements to catch invalid input

data/Dockerfiles/netfilter/server.py

@@ -301,24 +301,25 @@ def watch():
   pubsub.subscribe('F2B_CHANNEL')
 
   while not quit_now:
-    try:
       for item in pubsub.listen():
-        refreshF2bregex()
+        try:
-        for rule_id, rule_regex in f2bregex.items():
+          refreshF2bregex()
-          if item['data'] and item['type'] == 'message':
+          for rule_id, rule_regex in f2bregex.items():
-            try:
+            if item['data'] and item['type'] == 'message':
-              result = re.search(rule_regex, item['data'])
+              try:
-            except re.error:
+                result = re.search(rule_regex, item['data'])
-              result = False
+              except re.error:
-            if result:
+                result = False
-              addr = result.group(1)
+              if result:
-              ip = ipaddress.ip_address(addr)
+                addr = result.group(1)
-              if ip.is_private or ip.is_loopback:
+                ip = ipaddress.ip_address(addr)
-                continue
+                if ip.is_private or ip.is_loopback:
-              logWarn('%s matched rule id %s (%s)' % (addr, rule_id, item['data']))
+                  continue
-              ban(addr)
+                logWarn('%s matched rule id %s (%s)' % (addr, rule_id, item['data']))
-    except Exception as ex:
+                ban(addr)
-      logWarn('Could not read logline from pubsub, skipping...')
+        except Exception as ex:
+          logWarn('Could not read logline from pubsub, skipping...')
+          continue
 
 def snat4(snat_target):
   global lock

docker-compose.yml

@@ -390,7 +390,7 @@ services:
             - acme
 
     netfilter-mailcow:
-      image: mailcow/netfilter:1.40
+      image: mailcow/netfilter:1.41
       stop_grace_period: 30s
       depends_on:
         - dovecot-mailcow