[packages/fail2ban] restore-before-filter: nie startuj filtra na jailu zatrzymanym w trakcie czekania SIGTERM w oknie dr

[arekm]

commit a6e6b7e9dfb8a0256952760c071333bf9ae32168
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Jul 22 15:58:19 2026 +0200

    restore-before-filter: nie startuj filtra na jailu zatrzymanym w trakcie czekania
    SIGTERM w oknie drain-wait wykonuje quit() reentrancyjnie i usuwa jail, a wznowiony start() odpalał wątek filtra na martwym jailu; do tego twardy limit 600s na czekanie (martwa akcja skalowała je z liczbą banów)

 fail2ban-restore-before-filter.patch | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)
---
diff --git a/fail2ban-restore-before-filter.patch b/fail2ban-restore-before-filter.patch
index be70fe0..e02a051 100644
--- a/fail2ban-restore-before-filter.patch
+++ b/fail2ban-restore-before-filter.patch
@@ -1,6 +1,6 @@
 diff -ru a/fail2ban/server/jail.py b/fail2ban/server/jail.py
---- a/fail2ban/server/jail.py	2026-07-22 10:03:43.707981781 +0200
-+++ b/fail2ban/server/jail.py	2026-07-22 10:03:43.708517179 +0200
+--- a/fail2ban/server/jail.py	2026-07-22 15:57:18.082217451 +0200
++++ b/fail2ban/server/jail.py	2026-07-22 15:57:18.082737114 +0200
 @@ -29,6 +29,7 @@
  import queue
  
@@ -9,24 +9,31 @@ diff -ru a/fail2ban/server/jail.py b/fail2ban/server/jail.py
  from ..helpers import getLogger, _as_bool, extractOptions, MyTime
  from .mytime import MyTime
  
-@@ -321,9 +322,19 @@
+@@ -321,10 +322,25 @@
  		any valid bans.
  		"""
  		logSys.debug("Starting jail %r", self.name)
 -		self.filter.start()
  		self.actions.start()
  		self.restoreCurrentBans()
+-		logSys.info("Jail %r started", self.name)
 +		# Let the actions thread execute restored bans before the filter starts:
 +		# the filter may face a large log backlog (grown while fail2ban was down)
 +		# and its CPU-bound matching starves the banning thread of the GIL,
 +		# slowing restore by orders of magnitude while the still unprotected
-+		# system keeps being flooded.  Bounded wait, so a broken action cannot
-+		# delay the jail start indefinitely.
++		# system keeps being flooded.  Bounded wait (hard cap: a dead or hung
++		# actions thread must not block the start for qsize-scaled minutes).
 +		if self.hasFailTickets:
 +			Utils.wait_for(
 +				lambda: not self.actions.active or not self.hasFailTickets,
-+				max(60, self.__queue.qsize() * 0.05))
-+		self.filter.start()
- 		logSys.info("Jail %r started", self.name)
++				min(600, max(60, self.__queue.qsize() * 0.05)))
++		# the jail may have been stopped while waiting (e.g. SIGTERM handler ran
++		# quit() reentrantly on this thread) - don't start a filter thread then
++		if self.actions.active:
++			self.filter.start()
++			logSys.info("Jail %r started", self.name)
++		else:
++			logSys.warning("Jail %r start aborted - stopped while restoring bans", self.name)
  
  	def stop(self, stop=True, join=True):
+ 		"""Stop the jail, by stopping filter and actions threads.
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/fail2ban.git/commitdiff/74db76d97f2db8dcde983b6ec2568841c1aacf22