gateway: clear bans through durable unban queue

gateway/usr/bin/eterban.sh

@@ -84,8 +84,7 @@ if [ "$command" = "clear" ] ; then
         echo "Usage: eterban clear --force" >&2
         exit 2
     fi
-    ipset flush $setname
-    ipset flush $setname_ipv6
+    /usr/share/eterban/autoban_cli.py clear
     exit
 fi
 

gateway/usr/share/eterban/autoban_cli.py

@@ -21,6 +21,7 @@ CONFIG_PATH = '/etc/eterban/settings.ini'
 META_PREFIX = 'eterban:meta:'
 SCHEDULE_KEY = 'eterban:unban_schedule'
 PERMANENT_KEY = 'eterban:permanent'
+ACTIVE_BANS_KEY = 'eterban:active_bans'
 
 
 def format_duration(seconds):
@@ -173,6 +174,26 @@ def cmd_permanent():
             print(f"  {ip}")
 
 
+def cmd_clear():
+    """Queue durable unban commands for every authoritative active ban."""
+    r = get_redis()
+    pipeline = r.pipeline(transaction=False)
+    queued = 0
+    for member in r.sscan_iter(ACTIVE_BANS_KEY):
+        ip = member.decode() if isinstance(member, bytes) else member
+        pipeline.xadd('eterban:commands', {
+            'command': 'unban',
+            'ip': ip,
+            'by': 'all bans cleared by administrator',
+        })
+        queued += 1
+        if queued % 1000 == 0:
+            pipeline.execute()
+    if queued % 1000:
+        pipeline.execute()
+    print(f"Queued {queued} unban commands")
+
+
 def usage():
     print("""Usage: autoban_cli.py <command> [args]
 
@@ -181,6 +202,7 @@ Commands:
     reset <ip>  - reset offense counter for IP
     pending     - list pending auto-unbans
     permanent   - list permanent bans
+    clear       - queue unban for every active ban
 """)
     sys.exit(1)
 
@@ -209,6 +231,9 @@ def main():
     elif cmd == 'permanent':
         cmd_permanent()
 
+    elif cmd == 'clear':
+        cmd_clear()
+
     else:
         print(f"Unknown command: {cmd}")
         usage()