Whitelisting by subnet does not work

delameter commented 1 year ago

Hello. Plugin's config reading fails with an error "not valid".

Prerequisites:

Traefik version 2.9.5 fail2ban version v0.6.6

middlewares.yml:

http:
  middlewares:
    mw-fail2ban:
      plugin:
        fail2ban:
          rules:
            bantime: 1h
            findtime: 1s
            enabled: true
            maxretry: 50
            ports:
              - 443
          blacklist:
            ip: []
          whitelist:
            ip:
              - 192.168.1.0/24

The result:

$ docker-compose up traefik 
Starting dup-traefik ... done
Attaching to dup-traefik
dup-traefik   | time="2023-06-08T20:05:41+03:00" level=info msg="Configuration loaded from flags."
dup-traefik   | IPChecking: 2023/06/08 20:05:42 restricted.go:51: &{%!e(string=CIDR address) %!e(string=║24║192.168.1.0/24)}
dup-traefik   | IPChecking: 2023/06/08 20:05:42 restricted.go:51: Error: ║24║192.168.1.0/24 not valid

Suggestions

After looking through ipChecking.go I can assume that the problem is around line 46 -- according to docs, net.ParseIP does not expect a subnet in an input string, that's what net.ParseCIDR is for.

delameter commented 1 year ago

um...

dup-traefik   | IPChecking: 2023/06/08 20:21:34 restricted.go:51: ║24║192.168.1.3 is not a valid IP or IP/Net
dup-traefik   | IPChecking: 2023/06/08 20:21:34 restricted.go:51: Error: ║24║192.168.1.3 not valid

dup-traefik   | IPChecking: 2023/06/08 20:23:05 restricted.go:51: ║24║1.1.1.1 is not a valid IP or IP/Net
dup-traefik   | IPChecking: 2023/06/08 20:23:05 restricted.go:51: Error: ║24║1.1.1.1 not valid

maybe I'm doing something wrong

tomMoulard commented 1 year ago

Hello @delameter,

Thanks for your interest in this Traefik plugin!

This is not due to how this Plugin parses IPs, but more on how Traefik deserialize yaml. Instead of using an IP list, can you try just to give it as a string list?

From:

          whitelist:
            ip:
              - 192.168.1.0/24

To:

          whitelist:
            ip: 192.168.1.0/24

Does that fixes your issue?

delameter commented 1 year ago

That helped, thanks.

Maybe consider updating the docs then? I took the configuration example from there and this one also didnt work properly.

testData:
  blacklist:
    files:
      - "tests/test-ipfile.txt"
    ip:
      - "::1"
      - "127.0.0.1"

tomMoulard commented 1 year ago

Yes, you are right. This should be fixed!

tomMoulard / fail2ban