Lukas
12a859061c
- Add 5-min negative cache (_neg_cache) so failing IPs are throttled rather than hammering the API on every request - Add MaxMind GeoLite2 fallback (init_geoip / _geoip_lookup) that fires when ip-api fails; controlled by BANGUI_GEOIP_DB_PATH env var - Fix lookup_batch bug: failed API results were stored in positive cache - Add _persist_neg_entry: INSERT OR IGNORE into geo_cache with NULL country_code so re-resolve can find historically failed IPs - Add POST /api/geo/re-resolve: clears neg cache, batch-retries all geo_cache rows with country_code IS NULL, returns resolved/total count - BanTable + MapPage: wrap the country — placeholder in a Fluent UI Tooltip explaining the retry behaviour - Add geoip2>=4.8.0 dependency; geoip_db_path config setting - Tests: add TestNegativeCache (4), TestGeoipFallback (4), TestReResolve (4)
147 lines
4.6 KiB
Python
147 lines
4.6 KiB
Python
"""Geo / IP lookup router.
|
|
|
|
Provides the IP enrichment endpoints:
|
|
|
|
* ``GET /api/geo/lookup/{ip}`` — ban status, ban history, and geo info for an IP
|
|
* ``POST /api/geo/re-resolve`` — retry all previously failed geo lookups
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING, Annotated
|
|
|
|
if TYPE_CHECKING:
|
|
import aiohttp
|
|
|
|
import aiosqlite
|
|
from fastapi import APIRouter, Depends, HTTPException, Path, Request, status
|
|
|
|
from app.dependencies import AuthDep, get_db
|
|
from app.models.geo import GeoDetail, IpLookupResponse
|
|
from app.services import geo_service, jail_service
|
|
from app.utils.fail2ban_client import Fail2BanConnectionError
|
|
|
|
router: APIRouter = APIRouter(prefix="/api/geo", tags=["Geo"])
|
|
|
|
_IpPath = Annotated[str, Path(description="IPv4 or IPv6 address to look up.")]
|
|
|
|
|
|
@router.get(
|
|
"/lookup/{ip}",
|
|
response_model=IpLookupResponse,
|
|
summary="Look up ban status and geo information for an IP",
|
|
)
|
|
async def lookup_ip(
|
|
request: Request,
|
|
_auth: AuthDep,
|
|
ip: _IpPath,
|
|
) -> IpLookupResponse:
|
|
"""Return current ban status, geo data, and network information for an IP.
|
|
|
|
Checks every running fail2ban jail to determine whether the IP is
|
|
currently banned, and enriches the result with country, ASN, and
|
|
organisation data from ip-api.com.
|
|
|
|
Args:
|
|
request: Incoming request (used to access ``app.state``).
|
|
_auth: Validated session — enforces authentication.
|
|
ip: The IP address to look up.
|
|
|
|
Returns:
|
|
:class:`~app.models.geo.IpLookupResponse` with ban status and geo data.
|
|
|
|
Raises:
|
|
HTTPException: 400 when *ip* is not a valid IP address.
|
|
HTTPException: 502 when fail2ban is unreachable.
|
|
"""
|
|
socket_path: str = request.app.state.settings.fail2ban_socket
|
|
http_session: aiohttp.ClientSession = request.app.state.http_session
|
|
|
|
async def _enricher(addr: str) -> geo_service.GeoInfo | None:
|
|
return await geo_service.lookup(addr, http_session)
|
|
|
|
try:
|
|
result = await jail_service.lookup_ip(
|
|
socket_path,
|
|
ip,
|
|
geo_enricher=_enricher,
|
|
)
|
|
except ValueError as exc:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail=str(exc),
|
|
) from exc
|
|
except Fail2BanConnectionError as exc:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_502_BAD_GATEWAY,
|
|
detail=f"Cannot reach fail2ban: {exc}",
|
|
) from exc
|
|
|
|
raw_geo = result.get("geo")
|
|
geo_detail: GeoDetail | None = None
|
|
if raw_geo is not None:
|
|
geo_detail = GeoDetail(
|
|
country_code=raw_geo.country_code,
|
|
country_name=raw_geo.country_name,
|
|
asn=raw_geo.asn,
|
|
org=raw_geo.org,
|
|
)
|
|
|
|
return IpLookupResponse(
|
|
ip=result["ip"],
|
|
currently_banned_in=result["currently_banned_in"],
|
|
geo=geo_detail,
|
|
)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# POST /api/geo/re-resolve
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@router.post(
|
|
"/re-resolve",
|
|
summary="Re-resolve all IPs whose country could not be determined",
|
|
)
|
|
async def re_resolve_geo(
|
|
request: Request,
|
|
_auth: AuthDep,
|
|
db: Annotated[aiosqlite.Connection, Depends(get_db)],
|
|
) -> dict[str, int]:
|
|
"""Retry geo resolution for every IP in ``geo_cache`` with a null country.
|
|
|
|
Clears the in-memory negative cache first so that previously failing IPs
|
|
are immediately eligible for a new API attempt.
|
|
|
|
Args:
|
|
request: Incoming request (used to access ``app.state.http_session``).
|
|
_auth: Validated session — enforces authentication.
|
|
db: BanGUI application database (for reading/writing ``geo_cache``).
|
|
|
|
Returns:
|
|
JSON object ``{"resolved": N, "total": M}`` where *N* is the number
|
|
of IPs that gained a country code and *M* is the total number of IPs
|
|
that were retried.
|
|
"""
|
|
# Collect all IPs in geo_cache that still lack a country code.
|
|
unresolved: list[str] = []
|
|
async with db.execute(
|
|
"SELECT ip FROM geo_cache WHERE country_code IS NULL"
|
|
) as cur:
|
|
async for row in cur:
|
|
unresolved.append(str(row[0]))
|
|
|
|
if not unresolved:
|
|
return {"resolved": 0, "total": 0}
|
|
|
|
# Clear negative cache so these IPs bypass the TTL check.
|
|
geo_service.clear_neg_cache()
|
|
|
|
http_session: aiohttp.ClientSession = request.app.state.http_session
|
|
geo_map = await geo_service.lookup_batch(unresolved, http_session, db=db)
|
|
|
|
resolved_count = sum(
|
|
1 for info in geo_map.values() if info.country_code is not None
|
|
)
|
|
return {"resolved": resolved_count, "total": len(unresolved)}
|