filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix Auto-ban: IP block expiration ignores per-reason ban durations

Browse Source
This commit is contained in:
Maurus Decimus
2026-07-05 10:26:18 +02:00
parent fb6f0c65a2
commit eb42a8272d
2 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
crates/common/src/network/security.rs
View File

@@ -36,7 +36,10 @@ pub struct Security {
pub allowed_ip_addresses: AHashSet<IpWithTtl<IpAddr>>,
pub allowed_ip_networks: Vec<IpWithTtl<IpAddrOrMask>>,
pub has_allowed_networks: bool,
pub blocked_ip_expiration: Option<u64>,
pub auth_ban_period: Option<u64>,
pub abuse_ban_period: Option<u64>,
pub loiter_ban_period: Option<u64>,
pub scan_ban_period: Option<u64>,
pub http_banned_paths: Vec<MatchType>,
pub scanner_fail_rate: Option<Rate>,
@@ -164,7 +167,10 @@ impl Security {
has_allowed_networks: !allowed_ip_networks.is_empty(),
allowed_ip_addresses,
allowed_ip_networks,
blocked_ip_expiration: security.auth_ban_period.map(|v| v.as_secs()),
auth_ban_period: security.auth_ban_period.map(|v| v.as_secs()),
abuse_ban_period: security.abuse_ban_period.map(|v| v.as_secs()),
loiter_ban_period: security.loiter_ban_period.map(|v| v.as_secs()),
scan_ban_period: security.scan_ban_period.map(|v| v.as_secs()),
auth_fail_rate: security.auth_ban_rate,
rcpt_fail_rate: security.abuse_ban_rate,
loiter_fail_rate: security.loiter_ban_rate,
@@ -191,6 +197,16 @@ impl Security {
password_default_expiration: auth.password_default_expiry.map(|v| v.as_secs()),
}
}
fn ban_period(&self, reason: BlockReason) -> Option<u64> {
match reason {
BlockReason::RcptToFailure => self.abuse_ban_period,
BlockReason::AuthFailure => self.auth_ban_period,
BlockReason::Loitering => self.loiter_ban_period,
BlockReason::PortScanning => self.scan_ban_period,
BlockReason::Manual | BlockReason::Other => None,
}
}
}
impl Server {
@@ -304,7 +320,7 @@ impl Server {
.core
.network
.security
.blocked_ip_expiration
.ban_period(reason)
.map(|v| now + v);
self.inner
.data