[packages/fail2ban] add patch: pause other jails' filters while a jail starts/restores; rel 7 makes jail start order irr

[arekm]

commit 74083ff58ee91ed27548f48338c086408de24f7f
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Jul 22 10:56:31 2026 +0200

    add patch: pause other jails' filters while a jail starts/restores; rel 7
    makes jail start order irrelevant - every jail restores bans uncontended (19.5k bans in 19s vs 10min)

 fail2ban-restore-idle-gate.patch | 24 ++++++++++++++++++++++++
 fail2ban.spec                    |  4 +++-
 2 files changed, 27 insertions(+), 1 deletion(-)
---
diff --git a/fail2ban.spec b/fail2ban.spec
index 3e05127..6790be9 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -2,7 +2,7 @@ Summary:	Ban IPs that make too many password failures
 Summary(pl.UTF-8):	Blokowanie IP powodujących zbyt dużo prób logowań z błędnym hasłem
 Name:		fail2ban
 Version:	1.1.0
-Release:	6
+Release:	7
 License:	GPL
 Group:		Daemons
 Source0:	https://github.com/fail2ban/fail2ban/archive/%{version}.tar.gz
@@ -19,6 +19,7 @@ Patch4:		%{name}-exec_module.patch
 Patch5:		%{name}-lag-visibility.patch
 Patch6:		%{name}-restore-before-filter.patch
 Patch7:		%{name}-gil-switchinterval.patch
+Patch8:		%{name}-restore-idle-gate.patch
 URL:		http://fail2ban.sourceforge.net/
 BuildRequires:	python3-devel
 BuildRequires:	python3-modules
@@ -56,6 +57,7 @@ z sshd czy plikami logów serwera WWW Apache.
 %patch -P5 -p1
 %patch -P6 -p1
 %patch -P7 -p1
+%patch -P8 -p1
 rm setup.cfg
 
 sed -E -i -e '1s,#!\s*/usr/bin/env\s+python2(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/env\s+python(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/python(\s|$),#!%{__python3}\1,' \
diff --git a/fail2ban-restore-idle-gate.patch b/fail2ban-restore-idle-gate.patch
new file mode 100644
index 0000000..3090c18
--- /dev/null
+++ b/fail2ban-restore-idle-gate.patch
@@ -0,0 +1,24 @@
+diff -ru a/fail2ban/server/server.py b/fail2ban/server/server.py
+--- a/fail2ban/server/server.py	2026-07-22 10:48:15.519971293 +0200
++++ b/fail2ban/server/server.py	2026-07-22 10:48:15.520479676 +0200
+@@ -267,7 +267,19 @@
+ 		with self.__lock:
+ 			jail = self.__jails[name]
+ 			if not jail.isAlive():
+-				jail.start()
++				# pause log processing of the other jails while this jail starts:
++				# the ban restore (GIL-releasing netlink/exec per ticket) would be
++				# starved by their CPU-bound matching, prolonging restore from
++				# seconds to minutes; this also makes jail start order irrelevant
++				paused = [j for j in self.__jails.values()
++					if j is not jail and j.isAlive() and not j.filter.idle]
++				for j in paused:
++					j.filter.idle = True
++				try:
++					jail.start()
++				finally:
++					for j in paused:
++						j.filter.idle = False
+ 			elif name in self.__reload_state:
+ 				logSys.info("Jail %r reloaded", name)
+ 				del self.__reload_state[name]
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/fail2ban.git/commitdiff/74083ff58ee91ed27548f48338c086408de24f7f