Move into nested docroot

web/core/modules/ban/ban.info.yml

@@ -0,0 +1,7 @@
+name: Ban
+type: module
+description: 'Enables banning of IP addresses.'
+package: Core
+version: VERSION
+core: 8.x
+configure: ban.admin_page

web/core/modules/ban/ban.install

@@ -0,0 +1,35 @@
+<?php
+
+/**
+ * @file
+ * Install, update and uninstall functions for the Ban module.
+ */
+
+/**
+ * Implements hook_schema().
+ */
+function ban_schema() {
+  $schema['ban_ip'] = array(
+    'description' => 'Stores banned IP addresses.',
+    'fields' => array(
+      'iid' => array(
+        'description' => 'Primary Key: unique ID for IP addresses.',
+        'type' => 'serial',
+        'unsigned' => TRUE,
+        'not null' => TRUE,
+      ),
+      'ip' => array(
+        'description' => 'IP address',
+        'type' => 'varchar_ascii',
+        'length' => 40,
+        'not null' => TRUE,
+        'default' => '',
+      ),
+    ),
+    'indexes' => array(
+      'ip' => array('ip'),
+    ),
+    'primary key' => array('iid'),
+  );
+  return $schema;
+}

web/core/modules/ban/ban.links.menu.yml

@@ -0,0 +1,6 @@
+ban.admin_page:
+  title: 'IP address bans'
+  description: 'Ban visits from specific IP addresses.'
+  route_name: ban.admin_page
+  weight: 10
+  parent: user.admin_index

web/core/modules/ban/ban.module

@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @file
+ * Allows to ban individual IP addresses.
+ */
+
+use Drupal\Core\Routing\RouteMatchInterface;
+
+/**
+ * Implements hook_help().
+ */
+function ban_help($route_name, RouteMatchInterface $route_match) {
+  switch ($route_name) {
+    case 'help.page.ban':
+      $output = '';
+      $output .= '<h3>' . t('About') . '</h3>';
+      $output .= '<p>' . t('The Ban module allows administrators to ban visits to their site from individual IP addresses. For more information, see the <a href=":url">online documentation for the Ban module</a>.', array(':url' => 'https://www.drupal.org/documentation/modules/ban')) . '</p>';
+      $output .= '<h3>' . t('Uses') . '</h3>';
+      $output .= '<dl>';
+      $output .= '<dt>' . t('Banning IP addresses') . '</dt>';
+      $output .= '<dd>' . t('Administrators can enter IP addresses to ban on the <a href=":bans">IP address bans</a> page.', array(':bans' => \Drupal::url('ban.admin_page'))) . '</dd>';
+      $output .= '</dl>';
+      return $output;
+
+    case 'ban.admin_page':
+      return '<p>' . t('IP addresses listed here are banned from your site. Banned addresses are completely forbidden from accessing the site and instead see a brief message explaining the situation.') . '</p>';
+  }
+}

web/core/modules/ban/ban.permissions.yml

@@ -0,0 +1,2 @@
+ban IP addresses:
+  title: 'Ban IP addresses'

web/core/modules/ban/ban.routing.yml

@@ -0,0 +1,16 @@
+ban.admin_page:
+  path: '/admin/config/people/ban/{default_ip}'
+  defaults:
+    _form: '\Drupal\ban\Form\BanAdmin'
+    _title: 'IP address bans'
+    default_ip: ''
+  requirements:
+    _permission: 'ban IP addresses'
+
+ban.delete:
+  path: '/admin/config/people/ban/delete/{ban_id}'
+  defaults:
+    _form: '\Drupal\ban\Form\BanDelete'
+    _title: 'Delete IP address'
+  requirements:
+    _permission: 'ban IP addresses'

web/core/modules/ban/ban.services.yml

@@ -0,0 +1,13 @@
+services:
+  ban.ip_manager:
+    class: Drupal\ban\BanIpManager
+    arguments: ['@database']
+    tags:
+      - { name: backend_overridable }
+  ban.middleware:
+    class: Drupal\ban\BanMiddleware
+    arguments: ['@ban.ip_manager']
+    tags:
+      # Ensure to come before page caching, so you don't serve cached pages to
+      # banned users.
+      - { name: http_middleware, priority: 250 }

web/core/modules/ban/migration_templates/d7_blocked_ips.yml

@@ -0,0 +1,10 @@
+id: d7_blocked_ips
+label: Blocked IPs
+migration_tags:
+  - Drupal 7
+source:
+  plugin: d7_blocked_ips
+process:
+  ip: ip
+destination:
+  plugin: blocked_ip

web/core/modules/ban/src/BanIpManager.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Drupal\ban;
+
+use Drupal\Core\Database\Connection;
+
+/**
+ * Ban IP manager.
+ */
+class BanIpManager implements BanIpManagerInterface {
+
+  /**
+   * The database connection used to check the IP against.
+   *
+   * @var \Drupal\Core\Database\Connection
+   */
+  protected $connection;
+
+  /**
+   * Construct the BanSubscriber.
+   *
+   * @param \Drupal\Core\Database\Connection $connection
+   *   The database connection which will be used to check the IP against.
+   */
+  public function __construct(Connection $connection) {
+    $this->connection = $connection;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function isBanned($ip) {
+    return (bool) $this->connection->query("SELECT * FROM {ban_ip} WHERE ip = :ip", array(':ip' => $ip))->fetchField();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function findAll() {
+    return $this->connection->query('SELECT * FROM {ban_ip}');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function banIp($ip) {
+    $this->connection->merge('ban_ip')
+      ->key(array('ip' => $ip))
+      ->fields(array('ip' => $ip))
+      ->execute();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function unbanIp($id) {
+    $this->connection->delete('ban_ip')
+      ->condition('ip', $id)
+      ->execute();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function findById($ban_id) {
+    return $this->connection->query("SELECT ip FROM {ban_ip} WHERE iid = :iid", array(':iid' => $ban_id))->fetchField();
+  }
+
+}

web/core/modules/ban/src/BanIpManagerInterface.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace Drupal\ban;
+
+/**
+ * Provides an interface defining a BanIp manager.
+ */
+interface BanIpManagerInterface {
+
+  /**
+   * Returns if this IP address is banned.
+   *
+   * @param string $ip
+   *   The IP address to check.
+   *
+   * @return bool
+   *   TRUE if the IP address is banned, FALSE otherwise.
+   */
+  public function isBanned($ip);
+
+  /**
+   * Finds all banned IP addresses.
+   *
+   * @return \Drupal\Core\Database\StatementInterface
+   *   The result of the database query.
+   */
+  public function findAll();
+
+  /**
+   * Bans an IP address.
+   *
+   * @param string $ip
+   *   The IP address to ban.
+   */
+  public function banIp($ip);
+
+  /**
+   * Unbans an IP address.
+   *
+   * @param string $id
+   *   The IP address to unban.
+   */
+  public function unbanIp($id);
+
+  /**
+   * Finds a banned IP address by its ID.
+   *
+   * @param int $ban_id
+   *   The ID for a banned IP address.
+   *
+   * @return string|false
+   *   Either the banned IP address or FALSE if none exist with that ID.
+   */
+  public function findById($ban_id);
+
+}

web/core/modules/ban/src/BanMiddleware.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Drupal\ban;
+
+use Drupal\Component\Utility\SafeMarkup;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+
+/**
+ * Provides a HTTP middleware to implement IP based banning.
+ */
+class BanMiddleware implements HttpKernelInterface {
+
+  /**
+   * The decorated kernel.
+   *
+   * @var \Symfony\Component\HttpKernel\HttpKernelInterface
+   */
+  protected $httpKernel;
+
+  /**
+   * The ban IP manager.
+   *
+   * @var \Drupal\ban\BanIpManagerInterface
+   */
+  protected $banIpManager;
+
+  /**
+   * Constructs a BanMiddleware object.
+   *
+   * @param \Symfony\Component\HttpKernel\HttpKernelInterface $http_kernel
+   *   The decorated kernel.
+   * @param \Drupal\ban\BanIpManagerInterface $manager
+   *   The ban IP manager.
+   */
+  public function __construct(HttpKernelInterface $http_kernel, BanIpManagerInterface $manager) {
+    $this->httpKernel = $http_kernel;
+    $this->banIpManager = $manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function handle(Request $request, $type = self::MASTER_REQUEST, $catch = TRUE) {
+    $ip = $request->getClientIp();
+    if ($this->banIpManager->isBanned($ip)) {
+      return new Response(SafeMarkup::format('@ip has been banned', ['@ip' => $ip]), 403);
+    }
+    return $this->httpKernel->handle($request, $type, $catch);
+  }
+
+}

web/core/modules/ban/src/Form/BanAdmin.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace Drupal\ban\Form;
+
+use Drupal\Core\Form\FormBase;
+use Drupal\ban\BanIpManagerInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Url;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Displays banned IP addresses.
+ */
+class BanAdmin extends FormBase {
+
+  /**
+   * @var \Drupal\ban\BanIpManagerInterface
+   */
+  protected $ipManager;
+
+  /**
+   * Constructs a new BanAdmin object.
+   *
+   * @param \Drupal\ban\BanIpManagerInterface $ip_manager
+   */
+  public function __construct(BanIpManagerInterface $ip_manager) {
+    $this->ipManager = $ip_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('ban.ip_manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'ban_ip_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * @param string $default_ip
+   *   (optional) IP address to be passed on to
+   *   \Drupal::formBuilder()->getForm() for use as the default value of the IP
+   *   address form field.
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, $default_ip = '') {
+    $rows = array();
+    $header = array($this->t('banned IP addresses'), $this->t('Operations'));
+    $result = $this->ipManager->findAll();
+    foreach ($result as $ip) {
+      $row = array();
+      $row[] = $ip->ip;
+      $links = array();
+      $links['delete'] = array(
+        'title' => $this->t('Delete'),
+        'url' => Url::fromRoute('ban.delete', ['ban_id' => $ip->iid]),
+      );
+      $row[] = array(
+        'data' => array(
+          '#type' => 'operations',
+          '#links' => $links,
+        ),
+      );
+      $rows[] = $row;
+    }
+
+    $form['ip'] = array(
+      '#title' => $this->t('IP address'),
+      '#type' => 'textfield',
+      '#size' => 48,
+      '#maxlength' => 40,
+      '#default_value' => $default_ip,
+      '#description' => $this->t('Enter a valid IP address.'),
+    );
+    $form['actions'] = array('#type' => 'actions');
+    $form['actions']['submit'] = array(
+      '#type' => 'submit',
+      '#value' => $this->t('Add'),
+    );
+
+    $form['ban_ip_banning_table'] = array(
+      '#type' => 'table',
+      '#header' => $header,
+      '#rows' => $rows,
+      '#empty' => $this->t('No blocked IP addresses available.'),
+      '#weight' => 120,
+    );
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateForm(array &$form, FormStateInterface $form_state) {
+    $ip = trim($form_state->getValue('ip'));
+    if ($this->ipManager->isBanned($ip)) {
+      $form_state->setErrorByName('ip', $this->t('This IP address is already banned.'));
+    }
+    elseif ($ip == $this->getRequest()->getClientIP()) {
+      $form_state->setErrorByName('ip', $this->t('You may not ban your own IP address.'));
+    }
+    elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE) == FALSE) {
+      $form_state->setErrorByName('ip', $this->t('Enter a valid IP address.'));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $ip = trim($form_state->getValue('ip'));
+    $this->ipManager->banIp($ip);
+    drupal_set_message($this->t('The IP address %ip has been banned.', array('%ip' => $ip)));
+    $form_state->setRedirect('ban.admin_page');
+  }
+
+}

web/core/modules/ban/src/Form/BanDelete.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace Drupal\ban\Form;
+
+use Drupal\Core\Form\ConfirmFormBase;
+use Drupal\ban\BanIpManagerInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Url;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Provides a form to unban IP addresses.
+ */
+class BanDelete extends ConfirmFormBase {
+
+  /**
+   * The banned IP address.
+   *
+   * @var string
+   */
+  protected $banIp;
+
+  /**
+   * The IP manager.
+   *
+   * @var \Drupal\ban\BanIpManagerInterface
+   */
+  protected $ipManager;
+
+  /**
+   * Constructs a new BanDelete object.
+   *
+   * @param \Drupal\ban\BanIpManagerInterface $ip_manager
+   *   The IP manager.
+   */
+  public function __construct(BanIpManagerInterface $ip_manager) {
+    $this->ipManager = $ip_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('ban.ip_manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'ban_ip_delete_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getQuestion() {
+    return $this->t('Are you sure you want to unblock %ip?', array('%ip' => $this->banIp));
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getConfirmText() {
+    return $this->t('Delete');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getCancelUrl() {
+    return new Url('ban.admin_page');
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * @param string $ban_id
+   *   The IP address record ID to unban.
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, $ban_id = '') {
+    if (!$this->banIp = $this->ipManager->findById($ban_id)) {
+      throw new NotFoundHttpException();
+    }
+    return parent::buildForm($form, $form_state);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $this->ipManager->unbanIp($this->banIp);
+    $this->logger('user')->notice('Deleted %ip', array('%ip' => $this->banIp));
+    drupal_set_message($this->t('The IP address %ip was deleted.', array('%ip' => $this->banIp)));
+    $form_state->setRedirectUrl($this->getCancelUrl());
+  }
+
+}

web/core/modules/ban/src/Plugin/migrate/destination/BlockedIp.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace Drupal\ban\Plugin\migrate\destination;
+
+use Drupal\ban\BanIpManagerInterface;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\migrate\Plugin\MigrationInterface;
+use Drupal\migrate\Plugin\migrate\destination\DestinationBase;
+use Drupal\migrate\Row;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Destination for blocked IP addresses.
+ *
+ * @MigrateDestination(
+ *   id = "blocked_ip"
+ * )
+ */
+class BlockedIP extends DestinationBase implements ContainerFactoryPluginInterface {
+
+  /**
+   * The IP ban manager.
+   *
+   * @var \Drupal\ban\BanIpManagerInterface
+   */
+  protected $banManager;
+
+  /**
+   * Constructs a BlockedIP object.
+   *
+   * @param array $configuration
+   *   Plugin configuration.
+   * @param string $plugin_id
+   *   The plugin ID.
+   * @param mixed $plugin_definition
+   *   The plugin definiiton.
+   * @param \Drupal\migrate\Plugin\MigrationInterface $migration
+   *   The current migration.
+   * @param \Drupal\ban\BanIpManagerInterface $ban_manager
+   *   The IP manager service.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, MigrationInterface $migration, BanIpManagerInterface $ban_manager) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition, $migration);
+    $this->banManager = $ban_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition, MigrationInterface $migration = NULL) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $migration,
+      $container->get('ban.ip_manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getIds() {
+    return ['ip' => ['type' => 'string']];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fields(MigrationInterface $migration = NULL) {
+    return [
+      'ip' => $this->t('The blocked IP address.'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function import(Row $row, array $old_destination_id_values = array()) {
+    $this->banManager->banIp($row->getDestinationProperty('ip'));
+  }
+
+}

web/core/modules/ban/src/Plugin/migrate/source/d7/BlockedIps.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\ban\Plugin\migrate\source\d7;
+
+use Drupal\migrate_drupal\Plugin\migrate\source\DrupalSqlBase;
+
+/**
+ * Drupal 7 blocked IPs from database.
+ *
+ * @MigrateSource(
+ *   id = "d7_blocked_ips",
+ *   source_provider = "system"
+ * )
+ */
+class BlockedIps extends DrupalSqlBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function query() {
+    return $this->select('blocked_ips', 'bi')->fields('bi', ['ip']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fields() {
+    return [
+      'ip' => $this->t('The blocked IP address.'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getIds() {
+    return ['ip' => ['type' => 'string']];
+  }
+
+}

web/core/modules/ban/tests/src/Functional/IpAddressBlockingTest.php

@@ -0,0 +1,102 @@
+<?php
+
+namespace Drupal\Tests\ban\Functional;
+
+use Drupal\Tests\BrowserTestBase;
+use Drupal\Core\Database\Database;
+use Drupal\ban\BanIpManager;
+
+/**
+ * Tests IP address banning.
+ *
+ * @group ban
+ */
+class IpAddressBlockingTest extends BrowserTestBase {
+
+  /**
+   * Modules to install.
+   *
+   * @var array
+   */
+  public static $modules = array('ban');
+
+  /**
+   * Tests various user input to confirm correct validation and saving of data.
+   */
+  function testIPAddressValidation() {
+    // Create user.
+    $admin_user = $this->drupalCreateUser(array('ban IP addresses'));
+    $this->drupalLogin($admin_user);
+    $this->drupalGet('admin/config/people/ban');
+
+    // Ban a valid IP address.
+    $edit = array();
+    $edit['ip'] = '1.2.3.3';
+    $this->drupalPostForm('admin/config/people/ban', $edit, t('Add'));
+    $ip = db_query("SELECT iid from {ban_ip} WHERE ip = :ip", array(':ip' => $edit['ip']))->fetchField();
+    $this->assertTrue($ip, 'IP address found in database.');
+    $this->assertRaw(t('The IP address %ip has been banned.', array('%ip' => $edit['ip'])), 'IP address was banned.');
+
+    // Try to block an IP address that's already blocked.
+    $edit = array();
+    $edit['ip'] = '1.2.3.3';
+    $this->drupalPostForm('admin/config/people/ban', $edit, t('Add'));
+    $this->assertText(t('This IP address is already banned.'));
+
+    // Try to block a reserved IP address.
+    $edit = array();
+    $edit['ip'] = '255.255.255.255';
+    $this->drupalPostForm('admin/config/people/ban', $edit, t('Add'));
+    $this->assertText(t('Enter a valid IP address.'));
+
+    // Try to block a reserved IP address.
+    $edit = array();
+    $edit['ip'] = 'test.example.com';
+    $this->drupalPostForm('admin/config/people/ban', $edit, t('Add'));
+    $this->assertText(t('Enter a valid IP address.'));
+
+    // Submit an empty form.
+    $edit = array();
+    $edit['ip'] = '';
+    $this->drupalPostForm('admin/config/people/ban', $edit, t('Add'));
+    $this->assertText(t('Enter a valid IP address.'));
+
+    // Pass an IP address as a URL parameter and submit it.
+    $submit_ip = '1.2.3.4';
+    $this->drupalPostForm('admin/config/people/ban/' . $submit_ip, array(), t('Add'));
+    $ip = db_query("SELECT iid from {ban_ip} WHERE ip = :ip", array(':ip' => $submit_ip))->fetchField();
+    $this->assertTrue($ip, 'IP address found in database');
+    $this->assertRaw(t('The IP address %ip has been banned.', array('%ip' => $submit_ip)), 'IP address was banned.');
+
+    // Submit your own IP address. This fails, although it works when testing
+    // manually.
+    // TODO: On some systems this test fails due to a bug/inconsistency in cURL.
+    // $edit = array();
+    // $edit['ip'] = \Drupal::request()->getClientIP();
+    // $this->drupalPostForm('admin/config/people/ban', $edit, t('Save'));
+    // $this->assertText(t('You may not ban your own IP address.'));
+
+    // Test duplicate ip address are not present in the 'blocked_ips' table.
+    // when they are entered programmatically.
+    $connection = Database::getConnection();
+    $banIp = new BanIpManager($connection);
+    $ip = '1.0.0.0';
+    $banIp->banIp($ip);
+    $banIp->banIp($ip);
+    $banIp->banIp($ip);
+    $query = db_select('ban_ip', 'bip');
+    $query->fields('bip', array('iid'));
+    $query->condition('bip.ip', $ip);
+    $ip_count = $query->execute()->fetchAll();
+    $this->assertEqual(1, count($ip_count));
+    $ip = '';
+    $banIp->banIp($ip);
+    $banIp->banIp($ip);
+    $query = db_select('ban_ip', 'bip');
+    $query->fields('bip', array('iid'));
+    $query->condition('bip.ip', $ip);
+    $ip_count = $query->execute()->fetchAll();
+    $this->assertEqual(1, count($ip_count));
+  }
+
+}

web/core/modules/ban/tests/src/Kernel/Migrate/d7/MigrateBlockedIPsTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\Tests\ban\Kernel\Migrate\d7;
+
+use Drupal\config\Tests\SchemaCheckTestTrait;
+use Drupal\Tests\migrate_drupal\Kernel\d7\MigrateDrupal7TestBase;
+
+/**
+ * Migrate blocked IPs.
+ *
+ * @group ban
+ */
+class MigrateBlockedIPsTest extends MigrateDrupal7TestBase {
+
+  use SchemaCheckTestTrait;
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = ['ban'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+    $this->installSchema('ban', ['ban_ip']);
+    $this->executeMigration('d7_blocked_ips');
+  }
+
+  /**
+   * Tests migration of blocked IPs.
+   */
+  public function testBlockedIPs() {
+    $this->assertTrue(\Drupal::service('ban.ip_manager')->isBanned('111.111.111.111'));
+  }
+
+}

web/core/modules/ban/tests/src/Kernel/Plugin/migrate/source/d7/BlockedIpsTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\Tests\ban\Kernel\Plugin\migrate\source\d7;
+
+use Drupal\Tests\migrate\Kernel\MigrateSqlSourceTestBase;
+
+/**
+ * Tests D7 blocked_ip source plugin.
+ *
+ * @covers \Drupal\ban\Plugin\migrate\source\d7\BlockedIps
+ * @group ban
+ */
+class BlockedIpsTest extends MigrateSqlSourceTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static $modules = ['ban', 'migrate_drupal'];
+
+  /**
+   * {@inheritdoc}
+   */
+  public function providerSource() {
+    $tests = [];
+
+    $tests[0]['source_data']['blocked_ips'] = [
+      [
+        'iid' => 1,
+        'ip' => '127.0.0.1',
+      ]
+    ];
+    $tests[0]['expected_data'] = [
+      [
+        'ip' => '127.0.0.1',
+      ],
+    ];
+    return $tests;
+  }
+
+}

web/core/modules/ban/tests/src/Unit/BanMiddlewareTest.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace Drupal\Tests\ban\Unit;
+
+use Drupal\ban\BanMiddleware;
+use Drupal\Tests\UnitTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+
+/**
+ * @coversDefaultClass \Drupal\ban\BanMiddleware
+ * @group ban
+ */
+class BanMiddlewareTest extends UnitTestCase {
+
+  /**
+   * The mocked wrapped kernel.
+   *
+   * @var \Symfony\Component\HttpKernel\HttpKernelInterface|\PHPUnit_Framework_MockObject_MockObject
+   */
+  protected $kernel;
+
+  /**
+   * The mocked ban IP manager.
+   *
+   * @var \Drupal\ban\BanIpManagerInterface|\PHPUnit_Framework_MockObject_MockObject
+   */
+  protected $banManager;
+
+  /**
+   * The tested ban middleware.
+   *
+   * @var \Drupal\ban\BanMiddleware
+   */
+  protected $banMiddleware;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    $this->kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface');
+    $this->banManager = $this->getMock('Drupal\ban\BanIpManagerInterface');
+    $this->banMiddleware = new BanMiddleware($this->kernel, $this->banManager);
+  }
+
+  /**
+   * Tests a banned IP.
+   */
+  public function testBannedIp() {
+    $banned_ip = '17.0.0.2';
+    $this->banManager->expects($this->once())
+      ->method('isBanned')
+      ->with($banned_ip)
+      ->willReturn(TRUE);
+
+    $this->kernel->expects($this->never())
+      ->method('handle');
+
+    $request = Request::create('/test-path');
+    $request->server->set('REMOTE_ADDR', $banned_ip);
+    $response = $this->banMiddleware->handle($request);
+
+    $this->assertEquals(403, $response->getStatusCode());
+  }
+
+  /**
+   * Tests an unbanned IP.
+   */
+  public function testUnbannedIp() {
+    $unbanned_ip = '18.0.0.2';
+    $this->banManager->expects($this->once())
+      ->method('isBanned')
+      ->with($unbanned_ip)
+      ->willReturn(FALSE);
+
+    $request = Request::create('/test-path');
+    $request->server->set('REMOTE_ADDR', $unbanned_ip);
+    $expected_response = new Response(200);
+    $this->kernel->expects($this->once())
+      ->method('handle')
+      ->with($request, HttpKernelInterface::MASTER_REQUEST, TRUE)
+      ->willReturn($expected_response);
+
+    $response = $this->banMiddleware->handle($request);
+
+    $this->assertSame($expected_response, $response);
+  }
+
+}