0.11-alt1: bump version, add IPv6 whitelist checks

common/etc/eterban/whitelist.txt

+# eterban whitelist
+# One IPv4/IPv6 address or CIDR network per line.
+# Lines starting with '#' and blank lines are ignored.
+# Entries in this file are never banned (ban requests for them are skipped,
+# and matching source traffic is ACCEPTed before DNAT to ban_server).
+#
+# Examples:
+#10.0.0.0/8
+#192.168.0.0/16
+#172.16.0.0/12
+#127.0.0.1
+#::1
+#fd00::/8

eterban.spec

 %define defphp php%php_defver
 
 Name: eterban
-Version: 0.10
+Version: 0.11
 Release: alt1
 
 Summary: Etersoft ban service
@@ -108,6 +108,7 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/
 
 %files common
 %config(noreplace) /etc/%name/settings.ini
+%config(noreplace) /etc/%name/whitelist.txt
 
 %files gateway
 %systemd_unitdir/eterban.service
@@ -134,6 +135,10 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/
 %config(noreplace) /etc/fail2ban/action.d/eterban.conf
 
 %changelog
+* Tue Jul 08 2026 Vitaly Lipatov <lav@altlinux.ru> 0.11-alt1
+- gateway: support list of WAN interfaces via i_interfaces config option
+- spec: add whitelist.txt to common package
+
 * Thu Jan 29 2026 Vitaly Lipatov <lav@altlinux.ru> 0.10-alt1
 - eterban_switcher.py: return error on redis connection error
 - add auto-unban with exponential backoff

gateway/usr/bin/eterban.sh

@@ -43,6 +43,10 @@ if [ "$command" = "check" ] ; then
             echo "$ip is BANNED (in $setname_ipv6)"
             found=1
         fi
+        if ipset test eterban_white_ipv6 "$ip" 2>/dev/null ; then
+            echo "$ip is WHITELISTED (in eterban_white_ipv6)"
+            found=1
+        fi
     else
         # IPv4
         if ipset test $setname "$ip" 2>/dev/null ; then
@@ -54,7 +58,7 @@ if [ "$command" = "check" ] ; then
             found=1
         fi
         if ipset test eterban_white "$ip" 2>/dev/null ; then
-            echo "$ip is WHITELISTED"
+            echo "$ip is WHITELISTED (in eterban_white)"
             found=1
         fi
     fi

gateway/usr/share/eterban/eterban_api.py

@@ -16,6 +16,7 @@ IPSET_V4 = 'eterban_1'
 IPSET_V6 = 'eterban_1_ipv6'
 IPSET_FIREHOL = 'firehol_level1'
 IPSET_WHITE = 'eterban_white'
+IPSET_WHITE_V6 = 'eterban_white_ipv6'
 
 path_to_config = '/etc/eterban/settings.ini'
 
@@ -54,7 +55,9 @@ def check_ip(ip_str):
         result['firehol'] = ipset_test(IPSET_FIREHOL, ip_str)
 
     # Check whitelist
-    if isinstance(addr, ipaddress.IPv4Address):
+    if isinstance(addr, ipaddress.IPv6Address):
+        result['whitelisted'] = ipset_test(IPSET_WHITE_V6, ip_str)
+    else:
         result['whitelisted'] = ipset_test(IPSET_WHITE, ip_str)
 
     return result