Whitelisting by subnet does not work

[delameter]

Hello. Plugin's config reading fails with an error "not valid".

Prerequisites:

Traefik version 2.9.5
fail2ban version v0.6.6

middlewares.yml:

http:
  middlewares:
    mw-fail2ban:
      plugin:
        fail2ban:
          rules:
            bantime: 1h
            findtime: 1s
            enabled: true
            maxretry: 50
            ports:
              - 443
          blacklist:
            ip: []
          whitelist:
            ip:
              - 192.168.1.0/24

The result:

$ docker-compose up traefik 
Starting dup-traefik ... done
Attaching to dup-traefik
dup-traefik   | time="2023-06-08T20:05:41+03:00" level=info msg="Configuration loaded from flags."
dup-traefik   | IPChecking: 2023/06/08 20:05:42 restricted.go:51: &{%!e(string=CIDR address) %!e(string=║24║192.168.1.0/24)}
dup-traefik   | IPChecking: 2023/06/08 20:05:42 restricted.go:51: Error: ║24║192.168.1.0/24 not valid

Suggestions

After looking through ipChecking.go I can assume that the problem is around line 46 -- according to docs, net.ParseIP does not expect a subnet in an input string, that's what net.ParseCIDR is for.

[delameter]

um...

dup-traefik   | IPChecking: 2023/06/08 20:21:34 restricted.go:51: ║24║192.168.1.3 is not a valid IP or IP/Net
dup-traefik   | IPChecking: 2023/06/08 20:21:34 restricted.go:51: Error: ║24║192.168.1.3 not valid

dup-traefik   | IPChecking: 2023/06/08 20:23:05 restricted.go:51: ║24║1.1.1.1 is not a valid IP or IP/Net
dup-traefik   | IPChecking: 2023/06/08 20:23:05 restricted.go:51: Error: ║24║1.1.1.1 not valid

maybe I'm doing something wrong

[tomMoulard]

Hello @delameter,

Thanks for your interest in this Traefik plugin!

This is not due to how this Plugin parses IPs, but more on how Traefik deserialize yaml.
Instead of using an IP list, can you try just to give it as a string list?

From:

          whitelist:
            ip:
              - 192.168.1.0/24

To:

          whitelist:
            ip: 192.168.1.0/24

Does that fixes your issue?

[delameter]

That helped, thanks.

Maybe consider updating the docs then? I took the configuration example from there and this one also didnt work properly.

testData:
  blacklist:
    files:
      - "tests/test-ipfile.txt"
    ip:
      - "::1"
      - "127.0.0.1"

[tomMoulard]

Yes, you are right. This should be fixed!