fix: restore fail2ban after firewall start (#13364)

agent/app/service/firewall.go

@@ -18,7 +18,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
 	fireClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall/client/iptables"
-	"github.com/1Panel-dev/1Panel/agent/utils/toolbox"
 	"github.com/jinzhu/copier"
 )
 
@@ -167,9 +166,11 @@ func (u *FirewallService) OperateFirewall(req dto.FirewallOperation) error {
 	if err != nil {
 		return err
 	}
-	var bannedIPs []string
-	if req.Operation == "start" || req.Operation == "restart" {
-		bannedIPs = loadFail2BanBannedIPs()
+	fail2BanState := newFirewallFail2BanState()
+	if client.Name() == "firewalld" && req.Operation == "stop" {
+		if err := fail2BanState.rememberBeforeFirewallStop(); err != nil {
+			return err
+		}
 	}
 	needRestartDocker := false
 	switch req.Operation {
@@ -215,36 +216,14 @@ func (u *FirewallService) OperateFirewall(req dto.FirewallOperation) error {
 			return fmt.Errorf("failed to restart Docker: %v", err)
 		}
 	}
-	if len(bannedIPs) != 0 {
-		fail2Ban, err := toolbox.NewFail2Ban()
-		if err != nil {
-			return fmt.Errorf("load Fail2Ban failed: %v", err)
-		}
-		if err := fail2Ban.ReBanIPs(bannedIPs); err != nil {
-			return fmt.Errorf("restore Fail2Ban banned IPs failed: %v", err)
+	if client.Name() == "firewalld" && req.Operation == "start" {
+		if err := fail2BanState.restoreAfterFirewallStart(); err != nil {
+			return err
 		}
 	}
 	return nil
 }
 
-func loadFail2BanBannedIPs() []string {
-	fail2Ban, err := toolbox.NewFail2Ban()
-	if err != nil {
-		global.LOG.Errorf("load Fail2Ban failed, err: %v", err)
-		return nil
-	}
-	_, isActive, isExist := fail2Ban.Status()
-	if !isExist || !isActive {
-		return nil
-	}
-	bannedIPs, err := fail2Ban.ListBanned()
-	if err != nil {
-		global.LOG.Errorf("load Fail2Ban banned IPs failed, err: %v", err)
-		return nil
-	}
-	return bannedIPs
-}
-
 func (u *FirewallService) OperatePortRule(req dto.PortRuleOperate, reload bool) error {
 	client, err := firewall.NewFirewallClient()
 	if err != nil {

agent/app/service/firewall_fail2ban_state.go

@@ -0,0 +1,78 @@
+package service
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/controller"
+)
+
+const fail2BanRestoreWithFirewallMarker = "/run/1panel_fail2ban_restore_with_firewall"
+
+type firewallFail2BanState struct {
+	markerPath string
+	isExist    func(string) bool
+	isActive   func(string) bool
+	start      func(string) error
+}
+
+func newFirewallFail2BanState() *firewallFail2BanState {
+	return &firewallFail2BanState{
+		markerPath: fail2BanRestoreWithFirewallMarker,
+		isExist: func(serviceName string) bool {
+			exists, err := controller.CheckExist(serviceName)
+			if err != nil {
+				global.LOG.Warnf("check %s installation before stopping the firewall failed: %v", serviceName, err)
+			}
+			return exists
+		},
+		isActive: func(serviceName string) bool {
+			active, err := controller.CheckActive(serviceName)
+			if err != nil {
+				global.LOG.Warnf("check %s status before stopping the firewall failed: %v", serviceName, err)
+			}
+			return active
+		},
+		start: controller.HandleStart,
+	}
+}
+
+func (s *firewallFail2BanState) rememberBeforeFirewallStop() error {
+	if !s.isExist("fail2ban.service") {
+		return nil
+	}
+	if !s.isActive("fail2ban.service") {
+		return nil
+	}
+	return s.markForRestore()
+}
+
+func (s *firewallFail2BanState) markForRestore() error {
+	if err := os.WriteFile(s.markerPath, nil, 0600); err != nil {
+		return fmt.Errorf("mark Fail2Ban for restoration with the firewall: %w", err)
+	}
+	return nil
+}
+
+func (s *firewallFail2BanState) restoreAfterFirewallStart() error {
+	_, err := os.Stat(s.markerPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return fmt.Errorf("load Fail2Ban restore marker after starting the firewall: %w", err)
+	}
+
+	if err := s.start("fail2ban.service"); err != nil {
+		return fmt.Errorf("restore Fail2Ban after starting the firewall: %w", err)
+	}
+	return s.clearRestoreMarker()
+}
+
+func (s *firewallFail2BanState) clearRestoreMarker() error {
+	if err := os.Remove(s.markerPath); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("clear Fail2Ban firewall restore status: %w", err)
+	}
+	return nil
+}