Merge branch 'master' into _tent/ipv6_adapter_cmd

* master:
  ENH: BF (forgotten import) for prev commit + removed duplicate Author, adjusted __ fields for that in fail2ban-* scripts
  ENH: until we make it proper module -- adjust sys.path only if system-wide run

config/action.d/common.conf

@@ -0,0 +1,12 @@
+[INCLUDES]
+
+# Load customizations if any available
+after = common.local
+
+[DEFAULT]
+
+# Use ip v4/v6 dispatcher for iptables
+iptables = fail2ban-46 iptables ip6tables
+
+# for shorewall
+shorewall = fail2ban-46 shorewall shorewall6

config/action.d/iptables-allports.conf

@@ -2,34 +2,38 @@
 #
 # Author: Cyril Jaquier
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
-# 			made active on all ports from original iptables.conf
-#
-# $Revision$
+# 			made active on all ports from original fail2ban-iptables.conf
+# Modified by Paul J aka Thanat0s for ipv6 support
 #
 
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
+
 [Definition]
 
 # Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -j fail2ban-<name>
+actionstart = %(iptables)s -N fail2ban-<name>
+              %(iptables)s -A fail2ban-<name> -j RETURN
+              %(iptables)s -I <chain> -p <protocol> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = %(iptables)s -D <chain> -p <protocol> -j fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>
+             %(iptables)s -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = %(iptables)s -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -39,7 +43,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = %(iptables)s -I fail2ban-<name> 1 -s <ip> -j DROP
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,7 +53,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = %(iptables)s -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
@@ -64,7 +68,7 @@ name = default
 protocol = tcp
 
 # Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
+# Notes    specifies the fail2ban-iptables chain to which the fail2ban rules should be
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT

config/action.d/iptables-multiport-log.conf

@@ -2,13 +2,17 @@
 #
 # Author: Guido Bozzetto
 # Modified: Cyril Jaquier
+# Modified by Paul J aka Thanat0s for ipv6 support
 #
 # make "fail2ban-<name>" chain to match drop IP
 # make "fail2ban-<name>-log" chain to log and drop
 # insert a jump to fail2ban-<name> from -I <chain> if proto/port match
 #
-# $Revision$
-#
+
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
 
 [Definition]
 
@@ -16,28 +20,28 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-              iptables -N fail2ban-<name>-log
-              iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              iptables -A fail2ban-<name>-log -j DROP
+actionstart = %(iptables)s -N fail2ban-<name>
+              %(iptables)s -A fail2ban-<name> -j RETURN
+              %(iptables)s -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+              %(iptables)s -N fail2ban-<name>-log
+              %(iptables)s -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
+              %(iptables)s -A fail2ban-<name>-log -j DROP
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -F fail2ban-<name>-log
-             iptables -X fail2ban-<name>
-             iptables -X fail2ban-<name>-log
+actionstop = %(iptables)s -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>-log
+             %(iptables)s -X fail2ban-<name>
+             %(iptables)s -X fail2ban-<name>-log
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
+actioncheck = %(iptables)s -n -L fail2ban-<name>-log >/dev/null
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -47,7 +51,7 @@ actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
+actionban = %(iptables)s -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -57,7 +61,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
+actionunban = %(iptables)s -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
 
 [Init]
 
@@ -78,7 +82,7 @@ port = ssh
 protocol = tcp
 
 # Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
+# Notes    specifies the fail2ban-iptables chain to which the fail2ban rules should be
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT

config/action.d/iptables-multiport.conf

@@ -2,32 +2,37 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# $Revision$
+# Modified by Paul J aka Thanat0s for ipv6 support
 #
 
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
+
 [Definition]
 
 # Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+actionstart = %(iptables)s -N fail2ban-<name>
+              %(iptables)s -A fail2ban-<name> -j RETURN
+              %(iptables)s -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = %(iptables)s -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>
+             %(iptables)s -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = %(iptables)s -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -37,7 +42,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = %(iptables)s -I fail2ban-<name> 1 -s <ip> -j DROP
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -47,7 +52,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = %(iptables)s -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
@@ -68,7 +73,7 @@ port = ssh
 protocol = tcp
 
 # Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
+# Notes    specifies the fail2ban-iptables chain to which the fail2ban rules should be
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT

config/action.d/iptables-new.conf

@@ -1,11 +1,15 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
-# Copied from iptables.conf and modified by Yaroslav Halchenko 
+# Copied from fail2ban-iptables.conf and modified by Yaroslav Halchenko
 #  to fullfill the needs of bugreporter dbts#350746.
+# Modified by Paul J aka Thanat0s for ipv6 support
 #
-# $Revision$
-#
+
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
 
 [Definition]
 
@@ -13,23 +17,23 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+actionstart = %(iptables)s -N fail2ban-<name>
+              %(iptables)s -A fail2ban-<name> -j RETURN
+              %(iptables)s -I <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = %(iptables)s -D <chain> -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>
+             %(iptables)s -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = %(iptables)s -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -39,7 +43,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = %(iptables)s -I fail2ban-<name> 1 -s <ip> -j DROP
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -49,7 +53,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = %(iptables)s -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
@@ -70,7 +74,7 @@ port = ssh
 protocol = tcp
 
 # Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
+# Notes    specifies the fail2ban-iptables chain to which the fail2ban rules should be
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT

config/action.d/iptables.conf

@@ -1,9 +1,14 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
+# Modified: Yaroslav Halchenko
+# Modified by Paul J aka Thanat0s for ipv6 support
 #
-# $Revision$
-#
+
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
 
 [Definition]
 
@@ -11,23 +16,23 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = iptables -N fail2ban-<name>
-              iptables -A fail2ban-<name> -j RETURN
-              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
+actionstart = %(iptables)s -N fail2ban-<name>
+              %(iptables)s -A fail2ban-<name> -j RETURN
+              %(iptables)s -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
-             iptables -F fail2ban-<name>
-             iptables -X fail2ban-<name>
+actionstop = %(iptables)s -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
+             %(iptables)s -F fail2ban-<name>
+             %(iptables)s -X fail2ban-<name>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
+actioncheck = %(iptables)s -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -37,7 +42,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = %(iptables)s -I fail2ban-<name> 1 -s <ip> -j DROP
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -47,7 +52,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = %(iptables)s -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
@@ -68,7 +73,7 @@ port = ssh
 protocol = tcp
 
 # Option:  chain
-# Notes    specifies the iptables chain to which the fail2ban rules should be
+# Notes    specifies the fail2ban-iptables chain to which the fail2ban rules should be
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT

config/action.d/shorewall.conf

@@ -2,8 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
-#
 # The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
 # file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
 # new shorewall rule to ban an IP address, that rule will affect only new
@@ -11,7 +9,12 @@
 # he could even log in. In order to get the same behavior of the iptable
 # action (so that the ban is immediate) the /etc/shorewall/shorewall.conf
 # file should me modified with "BLACKLISTNEWONLY=No".
-# 
+#
+
+[INCLUDES]
+
+# Read common definitions, e.g. for %(iptables)s.
+before = common.conf
 
 [Definition]
 
@@ -41,7 +44,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = shorewall drop <ip>
+actionban = %(shorewall)s drop <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -51,4 +54,4 @@ actionban = shorewall drop <ip>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = shorewall allow <ip>
+actionunban = %(shorewall)s allow <ip>

config/fail2ban.conf

@@ -36,3 +36,10 @@ logtarget = /var/log/fail2ban.log
 #
 socket = /var/run/fail2ban/fail2ban.sock
 
+# Option: ipv6
+# Notes.: Activate IPv6 support
+#         Warning : only with iptables action supported
+# Values: BOOLEAN Default:  disabled
+#
+ipv6 = enabled
+

fail2ban-46

@@ -0,0 +1,75 @@
+#!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: nil -*-
+# vi: set ft=python sts=4 ts=4 sw=4 et :
+#
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# Wrapper to dispatch different commands depending of the IP address
+# space present in the command line.
+#
+# Author: Paul J Aka "Thanat0s"
+
+import sys
+import re, subprocess
+
+# Main procedure
+def main(cmd4, cmd6, argv):
+    pline = " ".join(argv)
+    regv4 = re.compile('([0-9]{1,3}\.){3}[0-9]{1,3}')
+    if regv4.search(pline):
+        # we are facing to an ipv4
+        ret = subprocess.call([cmd4] + argv)
+        sys.exit(ret)
+    else:
+        # if not, maybe it's an ipv6
+        regv6 = re.compile('::[A-Fa-f0-9]{1,4}|(:[A-Fa-f0-9]{1,4}){2,}')
+        if regv6.search(pline):
+            ret6 = subprocess.call([cmd6] + argv)
+            sys.exit(ret6)
+        else:
+            # if it's not an ipv6 either, we call both
+            proc = subprocess.Popen([cmd4] + argv)
+            proc6 = subprocess.Popen([cmd6] + argv)
+
+            # Splitting the Popen and wait() calls lets us run them in
+            # parallel, rather than one after the other
+            ret = proc.wait()
+            ret6 = proc6.wait()
+
+            # return worst error code
+            sys.exit(max(ret, ret6))
+
+
+def dispUsage(exit_code=None):
+    print """Usage: %s ipv4_command ipv6_command [options]
+
+Fail2Ban's ipv4/ipv6 dispatcher would call ipv4_command if detects an
+IPv4 address among options, and ipv6_command if an IPv6.  If none --
+it would call both ipv4_command and ipv6_command.
+[options] are passed to each corresponding ipv*_command call.
+""" % argv[0]
+    if exit_code is not None:
+        sys.exit(exit_code)
+
+# Main call, pass all variables
+if __name__ == "__main__":
+    argv = sys.argv
+    if len(argv)>1 and argv[1] in ('-h', '--help'):
+        dispUsage(0)
+    if len(argv) < 3:
+        dispUsage(1)
+    main(argv[1], argv[2], argv[3:])

server/failregex.py

@@ -47,7 +47,7 @@ class Regex:
 		self._matchCache = None
 		# Perform shortcuts expansions.
 		# Replace "<HOST>" with default regular expression for host.
-		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]+)")
+		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_:]+)")
 		if regex.lstrip() == '':
 			raise RegexException("Cannot add empty regex")
 		try:

server/filter.py

@@ -582,7 +582,8 @@ import socket, struct
 
 class DNSUtils:
 
-	IP_CRE = re.compile("^(?:\d{1,3}\.){3}\d{1,3}$")
+	IPv4_CRE = re.compile("^(?:\d{1,3}\.){3}\d{1,3}$")
+	IPv6_CRE = re.compile("^[0-9:A-Fa-f]{3,}$")
 
 	#@staticmethod
 	def dnsToIp(dns):
@@ -599,49 +600,52 @@ class DNSUtils:
 
 	#@staticmethod
 	def searchIP(text):
-		""" Search if an IP address if directly available and return
+		""" Search if an IP address is directly available and return
 			it.
 		"""
-		match = DNSUtils.IP_CRE.match(text)
-		if match:
-			return match
-		else:
-			return None
+		match = DNSUtils.IPv4_CRE.match(text) \
+		     or DNSUtils.IPv6_CRE.match(text)
+		# return None if no match (so and fails right away)
+		# or actual match (string) otherwise
+		return match and match.group(0)
+
 	searchIP = staticmethod(searchIP)
 
 	#@staticmethod
 	def isValidIP(string):
-		""" Return true if str is a valid IP
-		"""
+		# Return true if str is a valid IP
 		s = string.split('/', 1)
+		# try to convert to ipv4
 		try:
 			socket.inet_aton(s[0])
-			return True
 		except socket.error:
-			return False
+			# if it had failed try to convert ipv6
+			try:
+				socket.inet_pton(socket.AF_INET6, s[0])
+			except socket.error:
+				# not a valid address in both stacks
+				return False
+		return True
+
 	isValidIP = staticmethod(isValidIP)
 
 	#@staticmethod
-	def textToIp(text, useDns):
-		""" Return the IP of DNS found in a given text.
+	def textToIp(text, useDns='no'):
+		""" Converts text to an IP optionally performing DNS resolution.
 		"""
-		ipList = list()
+		ipList = []
 		# Search for plain IP
 		plainIP = DNSUtils.searchIP(text)
-		if not plainIP is None:
-			plainIPStr = plainIP.group(0)
-			if DNSUtils.isValidIP(plainIPStr):
-				ipList.append(plainIPStr)
-
-		# If we are allowed to resolve -- give it a try if nothing was found
-		if useDns in ("yes", "warn") and not ipList:
+		if plainIP and DNSUtils.isValidIP(plainIP):
+			ipList.append(plainIP)
+		elif useDns in ("yes", "warn"):
+			# If we are allowed to resolve -- give it a try if it is not IP
 			# Try to get IP from possible DNS
 			ip = DNSUtils.dnsToIp(text)
 			ipList.extend(ip)
 			if ip and useDns == "warn":
 				logSys.warning("Determined IP using DNS Reverse Lookup: %s = %s",
 					text, ipList)
-
 		return ipList
 	textToIp = staticmethod(textToIp)
 

setup.py

@@ -48,7 +48,8 @@ setup(
 	scripts =	[
 					'fail2ban-client', 
 					'fail2ban-server', 
-					'fail2ban-regex'
+					'fail2ban-regex' ,
+					'fail2ban-46'
 				], 
 	packages =	[
 					'common', 

testcases/filtertestcase.py

@@ -605,6 +605,51 @@ class GetFailures(unittest.TestCase):
 		self.assertRaises(FailManagerEmpty, self.filter.failManager.toBan)
 
 class DNSUtilsTests(unittest.TestCase):
+	_ips_hosts = [
+		'1.2.3.4',
+		'1.2.3.255',
+		'255.255.255.255',
+		'2001:0:0:0:0:0:0:3F',
+		'2001::3F',
+		'0:0:0:0:0:0:0:1',
+		'::1',
+		'2001::1:0:0:0:3F',
+		'2001:0:0:1::3F'
+		]
+	_ips_nets =  [
+		'1.2.3.0/24',
+		# and now ipv6
+		'::1/128',
+		'2001:0:53ab:63c:418:2bbf:e7c3:123e/32',
+		'fe80::ffff:ffff:ffff/64',
+		]
+	_ips_v6_same = [
+		# the 3 views of the same ip
+		'2001:0000:0234:C1AB:0000:00A0:AABC:003F',
+		'2001:0:234:C1AB:0:A0:AABC:3F',
+		'2001:0:0234:C1ab:0:A0:aabc:3F',
+		]
+
+	def testIsValidIP(self):
+		# just a basic check if works
+		for ip in self._ips_hosts + self._ips_nets + self._ips_v6_same:
+			self.assertTrue(DNSUtils.isValidIP(ip),
+							 msg="%r IS a valid IP" % ip)
+
+		for ip in ['1.2.3.256',
+				   '::ffffffff',
+				   '2001::0234:C1ab::A0:aabc:003F']:
+			self.assertFalse(DNSUtils.isValidIP(ip),
+							 msg="%r is not a valid IP" % ip)
+
+	def testSearchIP(self):
+		# just sweep through a set of them and see if returns the same
+		for ip in self._ips_hosts + self._ips_v6_same:
+			self.assertEqual(ip, DNSUtils.searchIP(ip))
+
+		# should be None for networks
+		for ip in self._ips_nets:
+			self.assertEqual(None, DNSUtils.searchIP(ip))
 
 	def testUseDns(self):
 		res = DNSUtils.textToIp('www.example.com', 'no')
@@ -620,13 +665,23 @@ class DNSUtilsTests(unittest.TestCase):
 			'www.example.com',
 			'doh1.2.3.4.buga.xxxxx.yyy.invalid',
 			'1.2.3.4.buga.xxxxx.yyy.invalid',
+			'1.2.3.',
+			# '1.2.3',  # socket manages to resolve it to 1.2.0.3
 			]
 		for s in hostnames:
 			res = DNSUtils.textToIp(s, 'yes')
 			if s == 'www.example.com':
 				self.assertEqual(res, ['192.0.43.10'])
 			else:
-				self.assertEqual(res, [])
+				self.assertEqual(res, [],
+					msg="Should have failed to get ip for %r. "
+					    "Got %s" % (s, res))
+
+		# make sure that normal IPs are not cut anyhow
+		for useDns in ('yes', 'no'):
+			for s in self._ips_hosts + self._ips_v6_same:
+				res = DNSUtils.textToIp(s, useDns)
+				self.assertEqual([s], res)
 
 class JailTests(unittest.TestCase):