Donate Share

Fail2Ban

Tracker: Patches

5 Patch for iptables issues when adding rules parallel - ID: 2857096
Last Update: Comment added ( junderwood )

Hey guys,

I had some issues with fail2ban when running more than 1 jail.
So I wrote a patch or even workaround to get all chains into iptables.
It might be good enough to apply it into the next release but thats up to
you... maybe you guys are able to find a better solution since I didn't
spent much time into it.


idl0r ( idl0r ) - 2009-09-11 19:30

5

Open

None

Nobody/Anonymous

None

None

Public


Comments ( 4 )




Date: 2010-01-04 15:09
Sender: junderwood

The fix with adding random sleeps is a workaround, but not the right long
term fix. It's a design flaw to have the action{start,stop} executing in
parallel IMO. Either they should be serialized, or a locking mechanism put
in place to ensure that multiline commands are treated atomicly.


Date: 2009-11-11 13:43
Sender: yarikoptic

For more details see http://bugs.debian.org/554162


Date: 2009-11-11 13:42
Sender: yarikoptic

This patch unfortunately breaks commands with multiline string arguments in
them (e.g. sending an email notifications).
Original problem is with concurrent execution of iptables commands by
separate threads (there is 1 thread per jail in fail2ban) upon jail
initiation. Possible solution is to sleep some random amount of time before
executing the command. It could be accomplished with adding smth like

sleep ${RANDOM:0:1}.${RANDOM: -1:1}

to the beginning of actionstart/actionstop if you use bash for your shell


Date: 2009-10-01 19:57
Sender: mcgege

Hi idl0r, thanks for your patch - I nearly got crazy with this bug ...


Log in to comment.




Attached File ( 1 )

Filename Description Download
action.py.patch action.py.patch Download

Change ( 1 )

Field Old Value Date By
File Added 342623: action.py.patch 2009-09-11 19:30 idl0r