fix: WebSocket ban handling and unban support

Major improvements to WebSocket ban synchronization:

1. Real ban application via WebSocket:
   - handleWSBan now actually applies bans via firewall manager
   - Was only logging before, not actually banning

2. Ban sync with unban support:
   - Added handleWSBanSync for full ban list synchronization
   - Removes local bans that no longer exist in Core (deleted in UI)
   - Prevents spam logs by only logging changes (new/removed bans)

3. Reduced log spam:
   - Individual 'New ban received' logs removed from ban_sync
   - Now logs summary: 'Ban sync complete: X new bans, Y removed'
   - Individual ban logs only for real-time 'ban' messages

4. Added GetAllBannedIPs() to IPTablesManager:
   - Returns all currently banned IPs from in-memory cache
   - Used for detecting which bans to remove during sync

Technical changes:
- WebSocketClient now accepts onBanSync callback
- Ban sync compares Core ban list with local bans
- Missing bans in Core list are automatically unbanned locally
- All WebSocket bans use reportToSync=false to prevent loops

Author: Rxflex

config/manager.go

@@ -12,6 +12,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/defenra/agent/firewall"
 )
 
 type ConfigManager struct {
@@ -96,8 +98,9 @@ func (cm *ConfigManager) initWebSocket() {
 		cm.agentID,
 		cm.agentKey,
 		cm.coreURL,
-		cm.handleWSConfig, // callback for config updates
-		cm.handleWSBan,    // callback for ban updates
+		cm.handleWSConfig,  // callback for config updates
+		cm.handleWSBan,     // callback for individual ban
+		cm.handleWSBanSync, // callback for ban sync (with unban support)
 	)
 }
 
@@ -109,8 +112,104 @@ func (cm *ConfigManager) handleWSConfig(config *Config) {
 }
 
 func (cm *ConfigManager) handleWSBan(ban BanInfo) {
-	// Forward to firewall manager
-	log.Printf("[WebSocket] New ban received: %s", ban.IP)
+	// Apply ban via firewall manager
+	firewallMgr := firewall.GetIPTablesManager()
+	if firewallMgr == nil {
+		return
+	}
+
+	// Check if already banned to avoid spam logs
+	if firewallMgr.IsBanned(ban.IP) {
+		return
+	}
+
+	// Calculate duration
+	now := time.Now()
+	if ban.ExpiresAt.Before(now) {
+		// Ban already expired, skip
+		return
+	}
+	duration := ban.ExpiresAt.Sub(now)
+
+	// Apply ban without reporting back to Core (came from Core via WebSocket)
+	var err error
+	if ban.IsCIDR {
+		err = firewallMgr.BanIPRangeWithSync(ban.IP, duration, ban.Reason+" (global)", false)
+	} else if ban.IsPermanent {
+		err = firewallMgr.AddToPermanentBlacklistWithSync(ban.IP, ban.Reason+" (global)", false)
+	} else {
+		err = firewallMgr.BanIPWithSync(ban.IP, duration, ban.Reason+" (global)", false)
+	}
+
+	if err != nil {
+		log.Printf("[WebSocket] Failed to apply ban for %s: %v", ban.IP, err)
+	} else {
+		log.Printf("[WebSocket] Applied ban: %s (%s, expires: %v)", ban.IP, ban.Reason, duration.Round(time.Minute))
+	}
+}
+
+func (cm *ConfigManager) handleWSBanSync(bans []BanInfo) {
+	// Apply all bans from sync and remove local bans that are not in the list
+	firewallMgr := firewall.GetIPTablesManager()
+	if firewallMgr == nil {
+		return
+	}
+
+	// Track which bans were applied in this sync
+	appliedBans := make(map[string]bool)
+	newBansCount := 0
+
+	for _, ban := range bans {
+		appliedBans[ban.IP] = true
+
+		// Skip if already banned
+		if firewallMgr.IsBanned(ban.IP) {
+			continue
+		}
+
+		// Check if expired
+		now := time.Now()
+		if ban.ExpiresAt.Before(now) {
+			continue
+		}
+		duration := ban.ExpiresAt.Sub(now)
+
+		// Apply ban without reporting back to Core
+		var err error
+		if ban.IsCIDR {
+			err = firewallMgr.BanIPRangeWithSync(ban.IP, duration, ban.Reason+" (global)", false)
+		} else if ban.IsPermanent {
+			err = firewallMgr.AddToPermanentBlacklistWithSync(ban.IP, ban.Reason+" (global)", false)
+		} else {
+			err = firewallMgr.BanIPWithSync(ban.IP, duration, ban.Reason+" (global)", false)
+		}
+
+		if err != nil {
+			log.Printf("[WebSocket] Failed to apply ban for %s: %v", ban.IP, err)
+		} else {
+			newBansCount++
+		}
+	}
+
+	// Remove local bans that are not in the Core list (unban)
+	// This handles case when ban was removed in UI
+	locallyBannedIPs := firewallMgr.GetAllBannedIPs()
+	removedCount := 0
+	for _, ip := range locallyBannedIPs {
+		if !appliedBans[ip] {
+			// This ban exists locally but not in Core - remove it
+			if err := firewallMgr.UnbanIP(ip); err != nil {
+				log.Printf("[WebSocket] Failed to unban %s: %v", ip, err)
+			} else {
+				removedCount++
+				log.Printf("[WebSocket] Removed ban (deleted in UI): %s", ip)
+			}
+		}
+	}
+
+	if newBansCount > 0 || removedCount > 0 {
+		log.Printf("[WebSocket] Ban sync complete: %d new bans, %d removed", newBansCount, removedCount)
+	}
 }
 
 func (cm *ConfigManager) poll() {

config/websocket.go

@@ -51,12 +51,13 @@ type WebSocketClient struct {
 	cancel            context.CancelFunc
 	onConfig          func(*Config)
 	onBan             func(BanInfo)
+	onBanSync         func([]BanInfo)
 	isRunning         bool
 	reconnectInterval time.Duration
 }
 
 // NewWebSocketClient creates a new WebSocket client
-func NewWebSocketClient(agentId, agentKey, coreURL string, onConfig func(*Config), onBan func(BanInfo)) *WebSocketClient {
+func NewWebSocketClient(agentId, agentKey, coreURL string, onConfig func(*Config), onBan func(BanInfo), onBanSync func([]BanInfo)) *WebSocketClient {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &WebSocketClient{
 		agentId:           agentId,
@@ -66,6 +67,7 @@ func NewWebSocketClient(agentId, agentKey, coreURL string, onConfig func(*Config
 		cancel:            cancel,
 		onConfig:          onConfig,
 		onBan:             onBan,
+		onBanSync:         onBanSync,
 		reconnectInterval: 5 * time.Second,
 	}
 }
@@ -216,10 +218,11 @@ func (w *WebSocketClient) processMessage(data []byte) error {
 			return fmt.Errorf("unmarshal ban_sync error: %w", err)
 		}
 
-		log.Printf("[WebSocket] Received ban sync with %d bans", banSync.Total)
-
-		// Forward to ban handler if set
-		if w.onBan != nil {
+		// Use onBanSync callback for full sync (handles new bans and unbans)
+		if w.onBanSync != nil {
+			w.onBanSync(banSync.Bans)
+		} else if w.onBan != nil {
+			// Fallback: forward to individual ban handler
 			for _, ban := range banSync.Bans {
 				w.onBan(ban)
 			}

firewall/iptables.go

@@ -242,6 +242,25 @@ func (m *IPTablesManager) IsBanned(ip string) bool {
 	return exists && time.Now().Before(expiresAt)
 }
 
+// GetAllBannedIPs returns all currently banned IPs from in-memory cache
+// Note: This only works for fallback mode (no ipset). For ipset mode,
+// this returns the in-memory cache which may not include all IPs from ipset.
+func (m *IPTablesManager) GetAllBannedIPs() []string {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	ips := make([]string, 0, len(m.bannedIPs))
+	now := time.Now()
+
+	for ip, expiresAt := range m.bannedIPs {
+		if now.Before(expiresAt) {
+			ips = append(ips, ip)
+		}
+	}
+
+	return ips
+}
+
 func (m *IPTablesManager) cleanupExpired() {
 	ticker := time.NewTicker(m.checkInterval)
 	defer ticker.Stop()