#!/usr/bin/bash
# fail2ban ignorecommand bridge for trusted-lists CIDRs.
#
# Returns 0 if the given IP matches any CIDR in /usr/share/trusted-lists/plain/*.txt,
# returns 1 otherwise. fail2ban interprets 0 as "ignore this match" and proceeds
# with normal ban logic on non-zero.
#
# Wired into fail2ban via /etc/fail2ban/jail.d/00-trusted-lists.local:
#   [DEFAULT]
#   ignorecommand = /usr/share/trusted-lists/scripts/fail2ban-ignoreip-check <ip>
#
# Requires: grepcidr
set -eu

ip="${1:-}"
[ -n "$ip" ] || exit 1

shopt -s nullglob
files=(/usr/share/trusted-lists/plain/*.txt)
[ ${#files[@]} -gt 0 ] || exit 1

# Concatenate every installed list once and let grepcidr scan in C.
echo "$ip" | grepcidr -f <(cat "${files[@]}") >/dev/null 2>&1
