scripte/wireguard-ui-multi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add bulk import for global firewall allow/block lists

Browse Source 
Paste-in import: one CIDR/IP per line, optional comment after '#',
blank/comment-only lines ignored - matches the format used by common
public blocklist feeds (Spamhaus DROP, blocklist.de, etc.) so those can
mostly be pasted in directly. Whole batch gets one list_type (allow or
block). Reuses the existing single-entry validation, skips duplicates
(by list_type+CIDR, including within the same paste), caps at 5000 lines,
and reports imported/skipped/invalid counts plus per-line errors.

New route: POST /firewall-lists/entries/import (admin-only). UI: a
collapsible "Bulk import" section on the Global Firewall Lists page.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
sysops
2026-07-12 17:50:58 +02:00
co-authored by Claude Sonnet 5
parent eb1913d400
commit 77ba2b4799
3 changed files with 155 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
handler/routes.go
+99
View File
@@ -1843,6 +1843,105 @@ func DeleteIPListEntryHandler(db store.IStore) echo.HandlerFunc {
}
}
// maxBulkImportLines caps the number of lines accepted by
// BulkImportIPListEntries, to avoid pathological input.
const maxBulkImportLines = 5000
// BulkImportIPListEntries imports many allow/block list entries at once from
// a pasted block of text, one CIDR/IP per line. Lines may have an optional
// "# comment" suffix. Blank lines and lines starting with '#' are ignored.
// All imported entries share the same list_type for the whole batch.
func BulkImportIPListEntries(db store.IStore) echo.HandlerFunc {
return func(c echo.Context) error {
var payload struct {
ListType string `json:"list_type"`
Text string `json:"text"`
}
if err := c.Bind(&payload); err != nil {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if payload.ListType != "allow" && payload.ListType != "block" {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "list_type must be 'allow' or 'block'"})
}
lines := strings.Split(payload.Text, "\n")
if len(lines) > maxBulkImportLines {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false,
fmt.Sprintf("Too many lines: %d (max %d)", len(lines), maxBulkImportLines)})
}
existing, err := db.GetIPListEntries()
if err != nil {
return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()})
}
existingSet := make(map[string]bool, len(existing))
for _, e := range existing {
existingSet[e.ListType+"|"+e.CIDR] = true
}
type invalidLine struct {
Line int `json:"line"`
Text string `json:"text"`
Error string `json:"error"`
}
imported := 0
skippedDuplicates := 0
var invalidLines []invalidLine
for i, raw := range lines {
lineNum := i + 1
trimmed := strings.TrimSpace(raw)
if trimmed == "" || strings.HasPrefix(trimmed, "#") {
continue
}
cidr := trimmed
comment := ""
if idx := strings.Index(trimmed, "#"); idx >= 0 {
cidr = strings.TrimSpace(trimmed[:idx])
comment = strings.TrimSpace(trimmed[idx+1:])
}
if cidr == "" {
continue
}
entry := model.IPListEntry{
ListType: payload.ListType,
CIDR: cidr,
Comment: comment,
}
if err := validateIPListEntry(entry); err != nil {
invalidLines = append(invalidLines, invalidLine{Line: lineNum, Text: raw, Error: err.Error()})
continue
}
key := entry.ListType + "|" + entry.CIDR
if existingSet[key] {
skippedDuplicates++
continue
}
entry.ID = xid.New().String()
entry.CreatedAt = time.Now().UTC()
if err := db.CreateIPListEntry(entry); err != nil {
invalidLines = append(invalidLines, invalidLine{Line: lineNum, Text: raw, Error: err.Error()})
continue
}
existingSet[key] = true
imported++
}
return c.JSON(http.StatusOK, map[string]interface{}{
"success": true,
"imported": imported,
"skipped_duplicates": skippedDuplicates,
"invalid_count": len(invalidLines),
"invalid_lines": invalidLines,
})
}
}
// GetGlobalFirewallPreview returns the generated host-wide allow/block list
// ruleset as plain text. Preview only.
func GetGlobalFirewallPreview(db store.IStore) echo.HandlerFunc {
main.go
+1
View File
@@ -241,6 +241,7 @@ func main() {
app.GET(util.BasePath+"/firewall-lists/entries", handler.GetIPListEntries(db), handler.ValidSession, handler.NeedsAdmin)
app.POST(util.BasePath+"/firewall-lists/entries", handler.CreateIPListEntryHandler(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
app.POST(util.BasePath+"/firewall-lists/entries/:id/delete", handler.DeleteIPListEntryHandler(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
app.POST(util.BasePath+"/firewall-lists/entries/import", handler.BulkImportIPListEntries(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
app.GET(util.BasePath+"/firewall-lists/preview", handler.GetGlobalFirewallPreview(db), handler.ValidSession, handler.NeedsAdmin)
app.POST(util.BasePath+"/firewall-lists/apply", handler.ApplyGlobalFirewallHandler(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
app.GET(util.BasePath+"/_health", handler.Health())
templates/firewall_lists.html
+55
View File
@@ -47,6 +47,28 @@ Global Firewall Lists
<button type="submit" class="btn btn-primary btn-sm mb-1">Add entry</button>
</form>
<hr>
<p><a data-toggle="collapse" href="#collapse_bulk_import" role="button" aria-expanded="false" aria-controls="collapse_bulk_import">Bulk import &#9660;</a></p>
<div class="collapse" id="collapse_bulk_import">
<div class="card card-body">
<form id="frm_iplist_import">
<div class="form-group">
<label for="_iplist_import_type">List type for this batch</label>
<select class="form-control form-control-sm" id="_iplist_import_type" style="width:10em">
<option value="block">block</option>
<option value="allow">allow</option>
</select>
</div>
<div class="form-group">
<label for="_iplist_import_text">Entries (one CIDR/IP per line)</label>
<textarea class="form-control" id="_iplist_import_text" rows="10"
placeholder="One CIDR or IP per line. Optional comment after '#'.&#10;Blank lines and lines starting with '#' are ignored.&#10;&#10;203.0.113.0/24&#10;198.51.100.5 # known scanner&#10;# this whole line is a comment"></textarea>
</div>
<button type="submit" class="btn btn-primary btn-sm">Import</button>
</form>
</div>
</div>
<hr>
<p class="text-muted mb-1">Ruleset preview:</p>
<pre id="_iplist_preview_text" style="max-height: 30vh; overflow:auto;"></pre>
@@ -135,6 +157,39 @@ Global Firewall Lists
});
});
$("#frm_iplist_import").on('submit', function (e) {
e.preventDefault();
const data = {
list_type: $("#_iplist_import_type").val(),
text: $("#_iplist_import_text").val()
};
$.ajax({
cache: false,
method: 'POST',
url: '{{.basePath}}/firewall-lists/entries/import',
dataType: 'json',
contentType: "application/json",
data: JSON.stringify(data),
success: function (result) {
let summary = "Imported " + result.imported + ", skipped " + result.skipped_duplicates + " duplicates";
if (result.invalid_count > 0) {
summary += ", " + result.invalid_count + " invalid lines";
console.warn("Bulk import invalid lines:", result.invalid_lines);
toastr.warning(summary);
} else {
toastr.success(summary);
}
$("#_iplist_import_text").val("");
loadIPList();
refreshGlobalPreview();
},
error: function (jqXHR) {
const responseJson = jQuery.parseJSON(jqXHR.responseText);
toastr.error(responseJson['message'] || "Import failed");
}
});
});
$("#_iplist_tbody").on('click', '.btn-delete-iplist', function () {
const id = $(this).data('id');
if (!confirm("Delete this entry?")) return;