From ab0ff452377050e84c90fa71491a4b072fe41b12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Mon, 25 Jan 2021 22:13:58 +0100
Subject: [PATCH 01/10] turning up version numbers

---
 Source/EvlWatcher/EvlWatcher/NSIS/make.nsi    |  2 +-
 .../EvlWatcher/Properties/AssemblyInfo.cs     |  4 +--
 .../EvlWatcherConsole.csproj                  | 28 ++++++++++++++++++-
 .../Properties/AssemblyInfo.cs                | 10 +++----
 .../EvlWatcherConsole/app.manifest            |  2 +-
 5 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
index 44015f1..f5eccff 100644
--- a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
+++ b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
@@ -2,7 +2,7 @@ Name "EvlWatcher"
 
 ; The file to write
 Icon EvlWatcher.ico
-OutFile "EvlWatcher-v2.0 setup.exe"
+OutFile "EvlWatcher-v2.1.2-setup.exe"
 
 ; The default installation directory
 InstallDir $PROGRAMFILES\EvlWatcher
diff --git a/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs b/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs
index ea9317d..e112698 100644
--- a/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs
+++ b/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs
@@ -28,5 +28,5 @@
 //      Build Number
 //      Revision
 //
-[assembly: AssemblyVersion("2.0.0.0")]
-[assembly: AssemblyFileVersion("2.0.0.0")]
+[assembly: AssemblyVersion("2.1.2.0")]
+[assembly: AssemblyFileVersion("2.1.2.0")]
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
index 13c27b8..5ca9f62 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
@@ -20,6 +20,21 @@
     <SccLocalPath>SAK</SccLocalPath>
     <SccAuxPath>SAK</SccAuxPath>
     <SccProvider>SAK</SccProvider>
+    <PublishUrl>publish\</PublishUrl>
+    <Install>true</Install>
+    <InstallFrom>Disk</InstallFrom>
+    <UpdateEnabled>false</UpdateEnabled>
+    <UpdateMode>Foreground</UpdateMode>
+    <UpdateInterval>7</UpdateInterval>
+    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
+    <UpdatePeriodically>false</UpdatePeriodically>
+    <UpdateRequired>false</UpdateRequired>
+    <MapFileExtensions>true</MapFileExtensions>
+    <ApplicationRevision>0</ApplicationRevision>
+    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
+    <IsWebBootstrapper>false</IsWebBootstrapper>
+    <UseApplicationTrust>false</UseApplicationTrust>
+    <BootstrapperEnabled>true</BootstrapperEnabled>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|x86' ">
     <PlatformTarget>x86</PlatformTarget>
@@ -138,7 +153,18 @@
   <ItemGroup>
     <Resource Include="Resources\Dtjohnnymonkey-Stopwatch-no-shading.png" />
   </ItemGroup>
-  <ItemGroup />
+  <ItemGroup>
+    <BootstrapperPackage Include=".NETFramework,Version=v4.7.2">
+      <Visible>False</Visible>
+      <ProductName>Microsoft .NET Framework 4.7.2 %28x86 and x64%29</ProductName>
+      <Install>true</Install>
+    </BootstrapperPackage>
+    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
+      <Visible>False</Visible>
+      <ProductName>.NET Framework 3.5 SP1</ProductName>
+      <Install>false</Install>
+    </BootstrapperPackage>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/Properties/AssemblyInfo.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/Properties/AssemblyInfo.cs
index 872752d..5d1574d 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/Properties/AssemblyInfo.cs
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/Properties/AssemblyInfo.cs
@@ -1,6 +1,4 @@
 using System.Reflection;
-using System.Resources;
-using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using System.Windows;
 
@@ -8,11 +6,11 @@
 // Attribute gesteuert. Ändern Sie diese Attributwerte, um die Informationen zu ändern,
 // die mit einer Assembly verknüpft sind.
 [assembly: AssemblyTitle("EvlWatcherConsole")]
-[assembly: AssemblyDescription("")]
+[assembly: AssemblyDescription("management console for EvlWatcher")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
 [assembly: AssemblyProduct("EvlWatcherConsole")]
-[assembly: AssemblyCopyright("Copyright ©  2013")]
+[assembly: AssemblyCopyright("2020 Michael Schönbauer")]
 [assembly: AssemblyTrademark("")]
 [assembly: AssemblyCulture("")]
 
@@ -51,5 +49,5 @@
 // Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern 
 // übernehmen, indem Sie "*" eingeben:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("2.1.2.0")]
+[assembly: AssemblyFileVersion("2.1.2.0")]
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/app.manifest b/Source/EvlWatcherConsole/EvlWatcherConsole/app.manifest
index e567017..28d4227 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/app.manifest
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/app.manifest
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
-  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
+  <assemblyIdentity version="2.1.2.0" name="EvlWatcher.EvlWatcherConsole.app"/>
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
     <security>
       <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">

From b79262efe95bd4b2ac12de887f5fc5dfeab70b19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Mon, 25 Jan 2021 22:34:05 +0100
Subject: [PATCH 02/10] fixing a small issue in the license

---
 LICENSE                                  | 2 +-
 Source/EvlWatcher/EvlWatcher/license.txt | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE b/LICENSE
index 01ae71a..5ede003 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 Michael Schönbauer
+Copyright (c) 2019 Michael Schoenbauer
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/Source/EvlWatcher/EvlWatcher/license.txt b/Source/EvlWatcher/EvlWatcher/license.txt
index 6937275..bc4893d 100644
--- a/Source/EvlWatcher/EvlWatcher/license.txt
+++ b/Source/EvlWatcher/EvlWatcher/license.txt
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Michael Schönbauer
+Copyright (c) 2020 Michael Schoenbauer
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

From 44621b09e9b4b67913f26ef013a1c292fea236ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Thu, 28 Jan 2021 07:11:22 +0100
Subject: [PATCH 03/10] classify messages about found ips as verbose #44

---
 Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
index 7627b09..2b95b7b 100644
--- a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
+++ b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
@@ -139,7 +139,7 @@ protected override void OnComputeEvents(List<ExtractedEventRecord> events)
                         else
                             sourceToCount[ipAddress]++;
 
-                        _logger.Dump($"{Name}: found {ipAddress}, trigger count is {sourceToCount[ipAddress]}", SeverityLevel.Info);
+                        _logger.Dump($"{Name}: found {ipAddress}, trigger count is {sourceToCount[ipAddress]}", SeverityLevel.Verbose);
                     }
                 }
             }

From 2ad8843c33017b32a266d3d5a598b68b49c29808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sat, 30 Jan 2021 22:47:14 +0100
Subject: [PATCH 04/10] a small readability thing

---
 Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs b/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs
index a9abfc8..6beebf6 100644
--- a/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs
+++ b/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs
@@ -64,7 +64,7 @@ private INetFwRule GetOrCreateEvlWatcherRule(bool create)
                 rule.EdgeTraversal = false;
                 rule.LocalAddresses = "*";
                 rule.Name = "EvlWatcher";
-                rule.Profiles = 2147483647; // = means all Profiles
+                rule.Profiles = int.MaxValue;// = means all Profiles
                 rule.Protocol = 256;
                 policies.Rules.Add(rule);
             }

From 41a7ca25af579a56a62cdb480fe7c5265e7d4e1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sat, 30 Jan 2021 23:20:58 +0100
Subject: [PATCH 05/10] added_start_menu #42

---
 Source/EvlWatcher/EvlWatcher/NSIS/make.nsi | 40 ++++++----------------
 1 file changed, 10 insertions(+), 30 deletions(-)

diff --git a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
index f5eccff..af20e85 100644
--- a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
+++ b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi
@@ -43,20 +43,12 @@ Section "EvlWatcher Service"
 
   ;;;;;;;;MODULES HERE;;;;;;;;;;
 
-  Delete $INSTDIR\BlockRDPBruters.dll
-  Delete $INSTDIR\BlockFTPBruters.dll
-  Delete $INSTDIR\BlockFTPBruters.cfg
-
   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-  Delete $INSTDIR\Interop.NetFwTypeLib.dll
   Delete $INSTDIR\EvlWatcher.exe
-  Delete $INSTDIR\gpl-3.0.txt
   Delete $INSTDIR\license.txt
-  Delete $INSTDIR\source.zip
   Delete $INSTDIR\config.xml
   Delete $INSTDIR\EvlWatcherConsole.exe
-  Delete $INSTDIR\EvlWatcher.ico
   Delete $INSTDIR\EvlWatcher.WCF.dll
 
   ; Set output path to the installation directory.
@@ -91,6 +83,13 @@ Section "EvlWatcher Service"
 
 SectionEnd
 
+Section "Start Menu Entry"
+
+  CreateDirectory "$SMPROGRAMS\EvlWatcher"
+  CreateShortCut "$SMPROGRAMS\EvlWatcher\EvlWatcherConsole.lnk" "$INSTDIR\EvlWatcherConsole.exe"
+
+SectionEnd
+
 ;;;;;;;MODULES HERE;;;;;;;;;;
 
 
@@ -108,6 +107,9 @@ Section "Uninstall"
 
   Sleep 5000
 
+	Delete "$SMPROGRAMS\EvlWatcher\EvlWatcherConsole.lnk"
+	rmDir "$SMPROGRAMS\EvlWatcher"
+
   ; Remove registry keys
   DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\EvlWatcher"
   DeleteRegKey HKLM SOFTWARE\EvlWatcher
@@ -116,36 +118,14 @@ Section "Uninstall"
 
   ;;;;;;;;MODULES HERE;;;;;;;;;;;
 
-  Delete $INSTDIR\BlockRDPBruters.dll
-  Delete $INSTDIR\BlockFTPBruters.dll
-  Delete $INSTDIR\BlockFTPBruters.cfg
-
   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-  Delete $INSTDIR\Interop.NetFwTypeLib.dll
   Delete $INSTDIR\EvlWatcher.exe
-  Delete $INSTDIR\gpl-3.0.txt
   Delete $INSTDIR\license.txt
   Delete $INSTDIR\config.xml
   Delete $INSTDIR\EvlWatcherConsole.exe
-  Delete $INSTDIR\source.zip
-  Delete $INSTDIR\EvlWatcher.ico
   Delete $INSTDIR\EvlWatcher.WCF.dll
-
-  Delete $INSTDIR\Source\Constants.cs
-  Delete $INSTDIR\Source\FirewallAPI.cs
-  Delete $INSTDIR\Source\Installer.cs
-  Delete $INSTDIR\Source\IPBlockingLogTask.cs
-  Delete $INSTDIR\Source\EvlWatcher.cs
-  Delete $INSTDIR\Source\LogTask.cs
   
-  ;;;;;;;;;MODULES HERE;;;;;;;;;;;;;;;;
-  
-  Delete $INSTDIR\Source\LogTaskBlockRDPBruters.cs
-  Delete $INSTDIR\Source\LogTaskBlockFTPBruters.cs
-  Delete $INSTDIR\Source\BlockFTPBruters.cfg
-
-  ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
   Delete $INSTDIR\uninstall.exe
 

From de2e1266b39d170ab7fe67404b8615376317e3e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sat, 30 Jan 2021 23:47:49 +0100
Subject: [PATCH 06/10] some beauty fixes for the console (icon..) (#51)

* removed dead code

* set icon for the app
---
 .../EvlWatcherConsole/EvlWatcherConsole.csproj              | 4 +++-
 .../EvlWatcherConsole/Model/EvlWatcherModel.cs              | 6 ------
 .../EvlWatcherConsole/Model/EvlWatcherTask.cs               | 6 ------
 3 files changed, 3 insertions(+), 13 deletions(-)
 delete mode 100644 Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherTask.cs

diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
index 5ca9f62..ec6ccd8 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
@@ -60,6 +60,9 @@
   <PropertyGroup>
     <ApplicationManifest>app.manifest</ApplicationManifest>
   </PropertyGroup>
+  <PropertyGroup>
+    <ApplicationIcon>Resources\EvlWatcher.ico</ApplicationIcon>
+  </PropertyGroup>
   <ItemGroup>
     <Reference Include="EvlWatcher.WCF">
       <HintPath>..\..\EvlWatcher\EvlWatcher.WCF\bin\Debug\EvlWatcher.WCF.dll</HintPath>
@@ -86,7 +89,6 @@
       <SubType>Designer</SubType>
     </ApplicationDefinition>
     <Compile Include="Model\EvlWatcherModel.cs" />
-    <Compile Include="Model\EvlWatcherTask.cs" />
     <Compile Include="ViewModel\MainWindowViewModel.cs" />
     <Compile Include="MVVMBase\GuiObject.cs" />
     <Compile Include="MVVMBase\RelayCommand.cs" />
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
index 8a7290f..e30dffd 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
@@ -76,12 +76,6 @@ public IQueryable<LogEntryDTO> GetConsoleHistory(SeverityLevelDTO severityLevel)
             }
         }
 
-        public IQueryable<EvlWatcherTask> GetTasks()
-        {
-            //var tasks = Service.GetTasks();
-            throw new NotImplementedException();
-        }
-
         public void AddWhiteListEntry(string s)
         {
             lock (_syncObject)
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherTask.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherTask.cs
deleted file mode 100644
index 4f8d8b9..0000000
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherTask.cs
+++ /dev/null
@@ -1,6 +0,0 @@
-namespace EvlWatcherConsole.Model
-{
-    public class EvlWatcherTask
-    {
-    }
-}
\ No newline at end of file

From e94da625e71a74e0706314b33b91447587574d64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Fri, 5 Feb 2021 23:42:18 +0100
Subject: [PATCH 07/10] ability to remove temp bans (#47)

* service gets ability to remove temp bans

* forgetting IPS needs to ignore re-supplied events

* console feature to remove temporary bans

* tested and tweaked the server feature to remove temp ban #45
---
 .../EvlWatcher.WCF/IEvlWatcherService.cs      |  4 +
 Source/EvlWatcher/EvlWatcher/EvlWatcher.cs    | 19 +++-
 .../EvlWatcher/tasks/GenericIPBlockingTask.cs | 96 +++++++++++++------
 .../EvlWatcher/tasks/IPBlockingLogTask.cs     |  2 +
 .../Model/EvlWatcherModel.cs                  |  5 +
 .../EvlWatcherConsole/View/MainWindow.xaml    |  8 +-
 .../ViewModel/MainWindowViewModel.cs          | 10 ++
 7 files changed, 108 insertions(+), 36 deletions(-)

diff --git a/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs b/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs
index 26d4097..5cb03b8 100644
--- a/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs
+++ b/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs
@@ -42,5 +42,9 @@ public interface IEvlWatcherService
         [OperationContract]
         [FaultContract(typeof(ServiceFaultDTO))]
         void SaveGlobalConfig(SeverityLevelDTO logLevel, int consoleBackLog, int checkInterval);
+
+        [OperationContract]
+        [FaultContract(typeof(ServiceFaultDTO))]
+        void RemoveTemporaryBan(IPAddress address);
     }
 }
diff --git a/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs b/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs
index a5a0c03..2a539bf 100644
--- a/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs
+++ b/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs
@@ -394,7 +394,6 @@ private void Run()
                     }
                 }
 
-
                 //start monitoring the logs
                 while (true)
                 {
@@ -469,7 +468,6 @@ private void Run()
 
                         _logger.Dump($"Scanning finished in {DateTime.Now.Subtract(scanStart).TotalMilliseconds}[ms] ", SeverityLevel.Debug);
 
-
                         //then supply the events to the requesting tasks
                         foreach (string key in requiredEventTypesToLogTasks.Keys)
                         {
@@ -514,7 +512,6 @@ private void Run()
 
                                 List<IPAddress> blockedIPs = ipTask.GetTempBanVictims();
 
-
                                 _logger.Dump($"Polled {t.Name} and got {blockedIPs.Count} temporary and {_serviceconfiguration.BlacklistAddresses.Count()} permanent ban(s)", SeverityLevel.Verbose);
 
                                 foreach (IPAddress blockedIP in blockedIPs)
@@ -611,6 +608,22 @@ public void SaveGlobalConfig(SeverityLevelDTO logLevel, int consoleBackLog, int
             _serviceconfiguration.EventLogInterval = checkInterval;
         }
 
+        public void RemoveTemporaryBan(IPAddress address)
+        {
+            EnsureClientPrivileges();
+
+            lock (_syncObject)
+            {
+                _logger.Dump($"Removing IP {address} from temporary ban list", SeverityLevel.Info);
+                foreach (var ipBlockingTask in _logTasks.Where(t => t is IPBlockingLogTask).Select(t => t as IPBlockingLogTask))
+                {
+                    ipBlockingTask.Forget(address);
+                }
+                _lastPolledTempBans.Remove(address);
+                PushBanList();
+            }
+        }
+
         #endregion
     }
 }
diff --git a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
index 2b95b7b..8197a66 100644
--- a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
+++ b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
@@ -36,7 +36,9 @@ internal static GenericIPBlockingTask FromConfiguration(IPersistentTaskConfigura
 
         #region private members
 
+        private readonly object _syncObject = new object();
         private readonly Dictionary<IPAddress, DateTime> _blockedIPsToDate = new Dictionary<IPAddress, DateTime>();
+        private readonly Dictionary<IPAddress, DateTime> _forgetIPsToDate = new Dictionary<IPAddress, DateTime>();
         private readonly Dictionary<IPAddress, int> _bannedCount = new Dictionary<IPAddress, int>();
         private readonly ILogger _logger;
 
@@ -64,40 +66,51 @@ internal GenericIPBlockingTask(ILogger logger)
         #region public operations
         public override List<IPAddress> GetTempBanVictims()
         {
-            List<IPAddress> ipsToRemove = new List<IPAddress>();
-            List<IPAddress> ipsToBlock = new List<IPAddress>();
-
-            //also remove IPS from ban list when they have been blocked "long enough"
-            foreach (KeyValuePair<IPAddress, DateTime> kvp in _blockedIPsToDate)
+            lock (_syncObject)
             {
-                if (kvp.Value.Add(new TimeSpan(0, 0, LockTime)) < System.DateTime.Now)
-                {
-                    ipsToRemove.Add(kvp.Key);
-                }
-                else
+                List<IPAddress> ipsToRemove = new List<IPAddress>();
+                List<IPAddress> ipsToBlock = new List<IPAddress>();
+
+                //also remove IPS from ban list when they have been blocked "long enough"
+                foreach (KeyValuePair<IPAddress, DateTime> kvp in _blockedIPsToDate)
                 {
-                    ipsToBlock.Add(kvp.Key);
+                    if (kvp.Value.Add(new TimeSpan(0, 0, LockTime)) < DateTime.Now)
+                    {
+                        ipsToRemove.Add(kvp.Key);
+                    }
+                    else
+                    {
+                        ipsToBlock.Add(kvp.Key);
+                    }
                 }
-            }
 
-            foreach (IPAddress ipToRemove in ipsToRemove)
-                _blockedIPsToDate.Remove(ipToRemove);
+                //also remove forgotten IPs when its been a while
+                List<IPAddress> removeFromForgottenList = _forgetIPsToDate.Where(p => DateTime.Now.AddHours(-1) > p.Value).Select(p=>p.Key).ToList();
+                foreach (var ip in removeFromForgottenList)
+                    removeFromForgottenList.Remove(ip);
+
+                foreach (IPAddress ipToRemove in ipsToRemove)
+                    _blockedIPsToDate.Remove(ipToRemove);
 
-            return ipsToBlock;
+                return ipsToBlock;
+            }
         }
 
         public override List<IPAddress> GetPermaBanVictims()
         {
-            List<IPAddress> permaList = new List<IPAddress>();
-            foreach (KeyValuePair<IPAddress, int> kvp in _bannedCount.Where(p=>p.Value>=PermaBanCount))
+            lock (_syncObject)
             {
-                permaList.Add(kvp.Key);
-                _logger.Dump($"Permanently banned {kvp.Value} (strike count was over {PermaBanCount}) ", SeverityLevel.Info);
-            }
-            foreach (IPAddress ip in permaList)
-                _bannedCount.Remove(ip);
+                List<IPAddress> permaList = new List<IPAddress>();
+                foreach (KeyValuePair<IPAddress, int> kvp in _bannedCount.Where(p => p.Value >= PermaBanCount))
+                {
+                    permaList.Add(kvp.Key);
+                    _logger.Dump($"Permanently banned {kvp.Value} (strike count was over {PermaBanCount}) ", SeverityLevel.Info);
+                }
+                foreach (IPAddress ip in permaList)
+                    _bannedCount.Remove(ip);
 
-            return permaList;
+                return permaList;
+            }
         }
 
         protected override void OnComputeEvents(List<ExtractedEventRecord> events)
@@ -133,6 +146,11 @@ protected override void OnComputeEvents(List<ExtractedEventRecord> events)
                 {
                     if (m.Groups.Count == 2 && IPAddress.TryParse(m.Groups[1].Value, out IPAddress ipAddress))
                     {
+                        if (_forgetIPsToDate.ContainsKey(ipAddress) && _forgetIPsToDate[ipAddress] > e.TimeCreated )
+                        {
+                            _logger.Dump($"{Name}: found {ipAddress} but ignored it (was recently removed from autoban list)", SeverityLevel.Info);
+                            continue;
+                        }
                         
                         if (!sourceToCount.ContainsKey(ipAddress))
                             sourceToCount.Add(ipAddress, 1);
@@ -144,21 +162,37 @@ protected override void OnComputeEvents(List<ExtractedEventRecord> events)
                 }
             }
 
-            foreach (KeyValuePair<IPAddress, int> kvp in sourceToCount)
+            lock (_syncObject)
             {
-                if (kvp.Value >= TriggerCount && !_blockedIPsToDate.ContainsKey(kvp.Key))
+                foreach (KeyValuePair<IPAddress, int> kvp in sourceToCount)
                 {
-                    _blockedIPsToDate.Add(kvp.Key, DateTime.Now);
-                    if (!_bannedCount.ContainsKey(kvp.Key))
-                        _bannedCount[kvp.Key] = 1;
-                    else
-                        _bannedCount[kvp.Key] += 1;
+                    if (kvp.Value >= TriggerCount && !_blockedIPsToDate.ContainsKey(kvp.Key))
+                    {
+                        _blockedIPsToDate.Add(kvp.Key, DateTime.Now);
+                        if (!_bannedCount.ContainsKey(kvp.Key))
+                            _bannedCount[kvp.Key] = 1;
+                        else
+                            _bannedCount[kvp.Key] += 1;
 
-                    _logger.Dump($"Temporarily banning {kvp.Key}, this is strike {_bannedCount[kvp.Key]}", SeverityLevel.Info);
+                        _logger.Dump($"Temporarily banning {kvp.Key}, this is strike {_bannedCount[kvp.Key]}", SeverityLevel.Info);
+                    }
                 }
             }
         }
 
+        public override void Forget(IPAddress address)
+        {
+            lock (_syncObject)
+            {
+                _blockedIPsToDate.Remove(address);
+
+                if (!_forgetIPsToDate.ContainsKey(address))
+                    _forgetIPsToDate.Add(address, DateTime.Now);
+
+                _bannedCount.Remove(address);
+            }
+        }
+
         #endregion
     }
 }
diff --git a/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs
index a4ff253..67b9d2a 100644
--- a/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs
+++ b/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs
@@ -10,5 +10,7 @@ public abstract class IPBlockingLogTask : LogTask
     {
         public abstract List<IPAddress> GetTempBanVictims();
         public abstract List<IPAddress> GetPermaBanVictims();
+
+        public abstract void Forget(IPAddress address);
     }
 }
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
index e30dffd..3521cf0 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherModel.cs
@@ -138,6 +138,11 @@ internal void SaveGlobalConfig(SeverityLevelDTO logLevel, int consoleBackLog, in
             Service.SaveGlobalConfig(logLevel, consoleBackLog, checkInterval);
         }
 
+        internal void RemoveTemporaryBan(IPAddress selectedTemporaryIP)
+        {
+            Service.RemoveTemporaryBan(selectedTemporaryIP);
+        }
+
         #endregion
     }
 }
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/View/MainWindow.xaml b/Source/EvlWatcherConsole/EvlWatcherConsole/View/MainWindow.xaml
index 70dbcf0..b7d6f80 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/View/MainWindow.xaml
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/View/MainWindow.xaml
@@ -40,11 +40,15 @@
                                 <ColumnDefinition></ColumnDefinition>
                                 <ColumnDefinition Width="30"></ColumnDefinition>
                                 <ColumnDefinition Width="30"></ColumnDefinition>
+                                <ColumnDefinition Width="30"></ColumnDefinition>
                             </Grid.ColumnDefinitions>
-                            <Button Grid.Column="1" Command="{Binding MoveTemporaryToPermaCommand}" Margin="5,5,5,5" Grid.Row="2" IsEnabled="{Binding IsServiceResponding}" ToolTip="Move to permanent ban list">
+                            <Button Grid.Column="1" Margin="5,5,5,5" Command="{Binding RemoveTemporaryBanCommand}" IsEnabled="{Binding IsServiceResponding}" ToolTip="Remove the selected IP from the temporary ban list">
+                                <Image Source="pack://application:,,,/Resources/close_32.ico"></Image>
+                            </Button>
+                            <Button Grid.Column="2" Command="{Binding MoveTemporaryToPermaCommand}" Margin="5,5,5,5" Grid.Row="2" IsEnabled="{Binding IsServiceResponding}" ToolTip="Move to permanent ban list">
                                 <Image Source="pack://application:,,,/Resources/lock_32.ico"></Image>
                             </Button>
-                            <Button Grid.Column="2" Command="{Binding MoveTemporaryToWhiteListCommand}" Margin="5,5,5,5" Grid.Row="2" IsEnabled="{Binding IsServiceResponding}" ToolTip="Whitelist this IP">
+                            <Button Grid.Column="3" Command="{Binding MoveTemporaryToWhiteListCommand}" Margin="5,5,5,5" Grid.Row="2" IsEnabled="{Binding IsServiceResponding}" ToolTip="Whitelist this IP">
                                 <Image Source="pack://application:,,,/Resources/lock_open_32.ico"></Image>
                             </Button>
                         </Grid>
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/ViewModel/MainWindowViewModel.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/ViewModel/MainWindowViewModel.cs
index ff0f668..05d22b8 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/ViewModel/MainWindowViewModel.cs
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/ViewModel/MainWindowViewModel.cs
@@ -472,6 +472,16 @@ public IList<string> AvailableTaskNames
             }
         }
 
+        
+        public ICommand RemoveTemporaryBanCommand
+        {
+            get
+            {
+                return new RelayCommand(p =>
+                { _model.RemoveTemporaryBan(SelectedTemporaryIP); }, p => SelectedTemporaryIP != null && IsServiceResponding );
+            }
+        }
+
         public ICommand AddPermaBanCommand
         {
             get

From b1b03c139062c2e9dd3e9bc412e9aafa801f1516 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sat, 6 Feb 2021 10:22:17 +0100
Subject: [PATCH 08/10] fixed a bug with forgetting ips

fixed a bug where a task will not forget an ip it has already forgotten earlier
---
 Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
index 8197a66..da062db 100644
--- a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
+++ b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs
@@ -188,6 +188,8 @@ public override void Forget(IPAddress address)
 
                 if (!_forgetIPsToDate.ContainsKey(address))
                     _forgetIPsToDate.Add(address, DateTime.Now);
+                else
+                    _forgetIPsToDate[address] = DateTime.Now;
 
                 _bannedCount.Remove(address);
             }

From 927e3cb2cea959ff600d8d2c44b3fa3336d16934 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sun, 18 Apr 2021 22:33:41 +0200
Subject: [PATCH 09/10] wip

---
 .../EvlWatcherConsole/EvlWatcherConsole.csproj       |  1 +
 .../EvlWatcherConsole/WhoisModel/IWhoisProvider.cs   | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs

diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
index ec6ccd8..b2bdbcf 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
@@ -92,6 +92,7 @@
     <Compile Include="ViewModel\MainWindowViewModel.cs" />
     <Compile Include="MVVMBase\GuiObject.cs" />
     <Compile Include="MVVMBase\RelayCommand.cs" />
+    <Compile Include="WhoisModel\IWhoisProvider.cs" />
     <Page Include="View\MainWindow.xaml">
       <Generator>MSBuild:Compile</Generator>
       <SubType>Designer</SubType>
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs
new file mode 100644
index 0000000..f973123
--- /dev/null
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs
@@ -0,0 +1,12 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace EvlWatcherConsole.WhoisModel
+{
+    interface IWhoisProvider
+    {
+    }
+}

From 619fd86665926e62b8f3ddff1e8e3b4ca54b39e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= <michael.schoenbauer@gmx.at>
Date: Sun, 18 Apr 2021 22:33:41 +0200
Subject: [PATCH 10/10] wip

---
 .../EvlWatcherConsole/EvlWatcherConsole.csproj       |  1 +
 .../EvlWatcherConsole/WhoisModel/IWhoisProvider.cs   | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs

diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
index e357939..8f1451b 100644
--- a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj
@@ -92,6 +92,7 @@
     <Compile Include="ViewModel\MainWindowViewModel.cs" />
     <Compile Include="MVVMBase\GuiObject.cs" />
     <Compile Include="MVVMBase\RelayCommand.cs" />
+    <Compile Include="WhoisModel\IWhoisProvider.cs" />
     <Page Include="View\MainWindow.xaml">
       <Generator>MSBuild:Compile</Generator>
       <SubType>Designer</SubType>
diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs b/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs
new file mode 100644
index 0000000..f973123
--- /dev/null
+++ b/Source/EvlWatcherConsole/EvlWatcherConsole/WhoisModel/IWhoisProvider.cs
@@ -0,0 +1,12 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace EvlWatcherConsole.WhoisModel
+{
+    interface IWhoisProvider
+    {
+    }
+}