Fix blocklist import: detect UnknownJailException and abort early
_is_not_found_error in jail_service did not match the concatenated form 'unknownjailexception' that fail2ban produces when it serialises UnknownJailException, so JailOperationError was raised instead of JailNotFoundError and every ban attempt in the import loop failed individually, skipping all 27 840 IPs before returning an error. Two changes: - Add 'unknownjail' to the phrase list in _is_not_found_error so that UnknownJailException is correctly mapped to JailNotFoundError. - In blocklist_service.import_source, catch JailNotFoundError explicitly and break out of the loop immediately with a warning log instead of retrying on every IP.
This commit is contained in:
@@ -323,6 +323,20 @@ class TestBanUnban:
|
||||
with pytest.raises(ValueError, match="Invalid IP"):
|
||||
await jail_service.ban_ip(_SOCKET, "sshd", "not-an-ip")
|
||||
|
||||
async def test_ban_ip_unknown_jail_exception_raises_jail_not_found(self) -> None:
|
||||
"""ban_ip raises JailNotFoundError when fail2ban returns UnknownJailException.
|
||||
|
||||
fail2ban serialises the exception without a space (``UnknownJailException``
|
||||
rather than ``Unknown JailException``), so _is_not_found_error must match
|
||||
the concatenated form ``"unknownjail``".
|
||||
"""
|
||||
response = (1, Exception("UnknownJailException('blocklist-import')"))
|
||||
with (
|
||||
_patch_client({"set|missing-jail|banip|1.2.3.4": response}),
|
||||
pytest.raises(JailNotFoundError, match="missing-jail"),
|
||||
):
|
||||
await jail_service.ban_ip(_SOCKET, "missing-jail", "1.2.3.4")
|
||||
|
||||
async def test_ban_ipv6_success(self) -> None:
|
||||
"""ban_ip accepts an IPv6 address."""
|
||||
with _patch_client({"set|sshd|banip|::1": (0, 1)}):
|
||||
|
||||
Reference in New Issue
Block a user