From eb4731d8b1c40957cd1c68f7fc76be45e6a03bf7 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 7 Nov 2024 19:28:53 +0100 Subject: [PATCH] action.d/*-ipset.conf: workaround sporadic failures by stop if destroying ipset too fast (sleep a bit in error case and repeat); closes gh-3624 --- config/action.d/firewallcmd-ipset.conf | 2 +- config/action.d/iptables-ipset.conf | 2 +- fail2ban/tests/servertestcase.py | 16 ++++++++-------- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/config/action.d/firewallcmd-ipset.conf b/config/action.d/firewallcmd-ipset.conf index ed498084..f5f68bc1 100644 --- a/config/action.d/firewallcmd-ipset.conf +++ b/config/action.d/firewallcmd-ipset.conf @@ -39,7 +39,7 @@ actionstart = ipset -exist create timeout -actionstop = ipset destroy +actionstop = ipset destroy 2>/dev/null || { sleep 1; ipset destroy ; } actionban = ipset -exist add timeout diff --git a/config/action.d/iptables-ipset.conf b/config/action.d/iptables-ipset.conf index 89d90142..7a71a2af 100644 --- a/config/action.d/iptables-ipset.conf +++ b/config/action.d/iptables-ipset.conf @@ -39,7 +39,7 @@ actionflush = ipset flush # actionstop = <_ipt_del_rules> - ipset destroy + ipset destroy 2>/dev/null || { sleep 1; ipset destroy ; } # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py index b3bace78..6524ea26 100644 --- a/fail2ban/tests/servertestcase.py +++ b/fail2ban/tests/servertestcase.py @@ -1596,10 +1596,10 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'stop': ( "`iptables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`", "`ipset flush f2b-j-w-iptables-ipset`", - "`ipset destroy f2b-j-w-iptables-ipset`", + "`ipset destroy f2b-j-w-iptables-ipset 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-iptables-ipset; }`", "`ip6tables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`", "`ipset flush f2b-j-w-iptables-ipset6`", - "`ipset destroy f2b-j-w-iptables-ipset6`", + "`ipset destroy f2b-j-w-iptables-ipset6 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-iptables-ipset6; }`", ), 'ip4-check': ( r"""`iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`""", @@ -1645,10 +1645,10 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'stop': ( "`iptables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`", "`ipset flush f2b-j-w-iptables-ipset-ap`", - "`ipset destroy f2b-j-w-iptables-ipset-ap`", + "`ipset destroy f2b-j-w-iptables-ipset-ap 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-iptables-ipset-ap; }`", "`ip6tables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`", "`ipset flush f2b-j-w-iptables-ipset-ap6`", - "`ipset destroy f2b-j-w-iptables-ipset-ap6`", + "`ipset destroy f2b-j-w-iptables-ipset-ap6 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-iptables-ipset-ap6; }`", ), 'ip4-check': ( r"""`iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`""", @@ -1976,10 +1976,10 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'stop': ( "`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`", "`ipset flush f2b-j-w-fwcmd-ipset`", - "`ipset destroy f2b-j-w-fwcmd-ipset`", + "`ipset destroy f2b-j-w-fwcmd-ipset 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-fwcmd-ipset; }`", "`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`", "`ipset flush f2b-j-w-fwcmd-ipset6`", - "`ipset destroy f2b-j-w-fwcmd-ipset6`", + "`ipset destroy f2b-j-w-fwcmd-ipset6 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-fwcmd-ipset6; }`", ), 'ip4-ban': ( r"`ipset -exist add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0`", @@ -2012,10 +2012,10 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'stop': ( "`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`", "`ipset flush f2b-j-w-fwcmd-ipset-ap`", - "`ipset destroy f2b-j-w-fwcmd-ipset-ap`", + "`ipset destroy f2b-j-w-fwcmd-ipset-ap 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-fwcmd-ipset-ap; }`", "`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`", "`ipset flush f2b-j-w-fwcmd-ipset-ap6`", - "`ipset destroy f2b-j-w-fwcmd-ipset-ap6`", + "`ipset destroy f2b-j-w-fwcmd-ipset-ap6 2>/dev/null || { sleep 1; ipset destroy f2b-j-w-fwcmd-ipset-ap6; }`", ), 'ip4-ban': ( r"`ipset -exist add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0`",