[packages/fail2ban] add patches: restore bans before filter start, shorter GIL switch interval; rel 6 ban restore was GI

[arekm]

commit 66ddf22349b582824bf745366880c425f47e11b6
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Jul 22 10:24:23 2026 +0200

    add patches: restore bans before filter start, shorter GIL switch interval; rel 6
    ban restore was GIL-starved by filters chewing log backlog (~14/s vs ~2400/s), leaving the host unprotected for minutes after restart

 fail2ban-gil-switchinterval.patch    | 16 ++++++++++++++++
 fail2ban-restore-before-filter.patch | 32 ++++++++++++++++++++++++++++++++
 fail2ban.spec                        |  6 +++++-
 3 files changed, 53 insertions(+), 1 deletion(-)
---
diff --git a/fail2ban.spec b/fail2ban.spec
index 7c9db97..3e05127 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -2,7 +2,7 @@ Summary:	Ban IPs that make too many password failures
 Summary(pl.UTF-8):	Blokowanie IP powodujących zbyt dużo prób logowań z błędnym hasłem
 Name:		fail2ban
 Version:	1.1.0
-Release:	5
+Release:	6
 License:	GPL
 Group:		Daemons
 Source0:	https://github.com/fail2ban/fail2ban/archive/%{version}.tar.gz
@@ -17,6 +17,8 @@ Patch2:		%{name}-config_banaction.patch
 Patch3:		%{name}-no-distutils.patch
 Patch4:		%{name}-exec_module.patch
 Patch5:		%{name}-lag-visibility.patch
+Patch6:		%{name}-restore-before-filter.patch
+Patch7:		%{name}-gil-switchinterval.patch
 URL:		http://fail2ban.sourceforge.net/
 BuildRequires:	python3-devel
 BuildRequires:	python3-modules
@@ -52,6 +54,8 @@ z sshd czy plikami logów serwera WWW Apache.
 %patch -P3 -p1
 %patch -P4 -p1
 %patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
 rm setup.cfg
 
 sed -E -i -e '1s,#!\s*/usr/bin/env\s+python2(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/env\s+python(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/python(\s|$),#!%{__python3}\1,' \
diff --git a/fail2ban-gil-switchinterval.patch b/fail2ban-gil-switchinterval.patch
new file mode 100644
index 0000000..7c7eaf5
--- /dev/null
+++ b/fail2ban-gil-switchinterval.patch
@@ -0,0 +1,16 @@
+diff -ru a/fail2ban/server/server.py b/fail2ban/server/server.py
+--- a/fail2ban/server/server.py	2026-07-22 10:03:43.714857606 +0200
++++ b/fail2ban/server/server.py	2026-07-22 10:03:43.715214163 +0200
+@@ -138,6 +138,12 @@
+ 
+ 		logSys.info("-"*50)
+ 		logSys.info("Starting Fail2ban v%s", version.version)
++
++		# The banning thread releases the GIL for every action step (netlink,
++		# exec) and with the default switch interval (5ms) it gets starved by
++		# CPU-bound filter threads on log backlog/flood, so bans lag minutes
++		# behind matches; a shorter interval speeds up GIL hand-over (~15x).
++		sys.setswitchinterval(1e-3)
+ 		
+ 		if self.__daemon: # pragma: no cover
+ 			logSys.info("Daemon started")
diff --git a/fail2ban-restore-before-filter.patch b/fail2ban-restore-before-filter.patch
new file mode 100644
index 0000000..be70fe0
--- /dev/null
+++ b/fail2ban-restore-before-filter.patch
@@ -0,0 +1,32 @@
+diff -ru a/fail2ban/server/jail.py b/fail2ban/server/jail.py
+--- a/fail2ban/server/jail.py	2026-07-22 10:03:43.707981781 +0200
++++ b/fail2ban/server/jail.py	2026-07-22 10:03:43.708517179 +0200
+@@ -29,6 +29,7 @@
+ import queue
+ 
+ from .actions import Actions
++from .utils import Utils
+ from ..helpers import getLogger, _as_bool, extractOptions, MyTime
+ from .mytime import MyTime
+ 
+@@ -321,9 +322,19 @@
+ 		any valid bans.
+ 		"""
+ 		logSys.debug("Starting jail %r", self.name)
+-		self.filter.start()
+ 		self.actions.start()
+ 		self.restoreCurrentBans()
++		# Let the actions thread execute restored bans before the filter starts:
++		# the filter may face a large log backlog (grown while fail2ban was down)
++		# and its CPU-bound matching starves the banning thread of the GIL,
++		# slowing restore by orders of magnitude while the still unprotected
++		# system keeps being flooded.  Bounded wait, so a broken action cannot
++		# delay the jail start indefinitely.
++		if self.hasFailTickets:
++			Utils.wait_for(
++				lambda: not self.actions.active or not self.hasFailTickets,
++				max(60, self.__queue.qsize() * 0.05))
++		self.filter.start()
+ 		logSys.info("Jail %r started", self.name)
+ 
+ 	def stop(self, stop=True, join=True):
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/fail2ban.git/commitdiff/74083ff58ee91ed27548f48338c086408de24f7f