From 3ca69c8c0a756b58c751707e72905d3f50c4a620 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 11 Aug 2020 17:14:21 +0200 Subject: [PATCH] amend to #2791: unban subnet when subnet is in supplied subnet --- fail2ban/server/actions.py | 6 +----- fail2ban/server/ipdns.py | 5 +++++ fail2ban/tests/fail2banclienttestcase.py | 15 +++++++++++++++ 3 files changed, 21 insertions(+), 5 deletions(-) diff --git a/fail2ban/server/actions.py b/fail2ban/server/actions.py index 4689b9d7..3308d4b2 100644 --- a/fail2ban/server/actions.py +++ b/fail2ban/server/actions.py @@ -277,11 +277,7 @@ class Actions(JailThread, Mapping): if not isinstance(ip, IPAddr): ipa = IPAddr(ip) if not ipa.isSingle: # subnet (mask/cidr) or raw (may be dns/hostname): - ips = filter( - lambda i: ( - isinstance(i, IPAddr) and (i == ipa or i.isSingle and i.isInNet(ipa)) - ), self.__banManager.getBanList() - ) + ips = filter(ipa.contains, self.__banManager.getBanList()) if ips: return self.removeBannedIP(ips, db, ifexists) # not found: diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py index 335fc473..571ccc4f 100644 --- a/fail2ban/server/ipdns.py +++ b/fail2ban/server/ipdns.py @@ -517,6 +517,11 @@ class IPAddr(object): return (self.addr & mask) == net.addr + def contains(self, ip): + """Return whether the object (as network) contains given IP + """ + return isinstance(ip, IPAddr) and (ip == self or ip.isInNet(self)) + # Pre-calculated map: addr to maskplen def __getMaskMap(): m6 = (1 << 128)-1 diff --git a/fail2ban/tests/fail2banclienttestcase.py b/fail2ban/tests/fail2banclienttestcase.py index 104e4c57..bbd6964a 100644 --- a/fail2ban/tests/fail2banclienttestcase.py +++ b/fail2ban/tests/fail2banclienttestcase.py @@ -1179,6 +1179,21 @@ class Fail2banServerTest(Fail2banClientServerBase): "[test-jail1] Unban 192.0.2.8", "192.0.2.100/31 is not banned", all=True, wait=MID_WAITTIME) + # ban/unban subnet(s): + self.pruneLog("[test-phase 6c]") + self.execCmd(SUCCESS, startparams, + "--async", "set", "test-jail1", "banip", "192.0.2.96/28", "192.0.2.112/28") + self.assertLogged( + "[test-jail1] Ban 192.0.2.96/28", + "[test-jail1] Ban 192.0.2.112/28", all=True, wait=MID_WAITTIME + ) + self.execCmd(SUCCESS, startparams, + "--async", "set", "test-jail1", "unbanip", "192.0.2.64/26"); # contains both subnets .96/28 and .112/28 + self.assertLogged( + "[test-jail1] Unban 192.0.2.96/28", + "[test-jail1] Unban 192.0.2.112/28", all=True, wait=MID_WAITTIME + ) + # reload all (one jail) with unban all: self.pruneLog("[test-phase 7]") self.execCmd(SUCCESS, startparams,