diff --git a/fail2ban/server/actions.py b/fail2ban/server/actions.py index c7b01d08..31680b58 100644 --- a/fail2ban/server/actions.py +++ b/fail2ban/server/actions.py @@ -82,6 +82,8 @@ class Actions(JailThread, Mapping): self._actions = OrderedDict() ## The ban manager. self.__banManager = BanManager() + ## precedence of ban (over unban), so max number of tickets banned (to call an unban check): + self.banPrecedence = 10 @staticmethod def _load_python_module(pythonModule): @@ -307,6 +309,7 @@ class Actions(JailThread, Mapping): bool True when the thread exits nicely. """ + cnt = 0 for name, action in self._actions.iteritems(): try: action.start() @@ -321,8 +324,14 @@ class Actions(JailThread, Mapping): lambda: False, self.sleeptime) logSys.debug("Actions: leave idle mode") continue - if not Utils.wait_for(lambda: not self.active or self.__checkBan(), self.sleeptime): - self.__checkUnBan() + # wait for ban (stop if gets inactive): + bancnt = Utils.wait_for(lambda: not self.active or self.__checkBan(), self.sleeptime) + cnt += bancnt + # unban if nothing is banned not later than banned tickets >= banPrecedence + if not bancnt or cnt >= self.banPrecedence: + if self.active: + self.__checkUnBan() + cnt = 0 self.__flushBan() self.stopActions() @@ -443,7 +452,7 @@ class Actions(JailThread, Mapping): """ cnt = 0 if not tickets: - tickets = self.__getFailTickets() + tickets = self.__getFailTickets(self.banPrecedence) for ticket in tickets: bTicket = BanTicket.wrap(ticket) diff --git a/fail2ban/tests/actionstestcase.py b/fail2ban/tests/actionstestcase.py index 39c5b22a..c46dcb46 100644 --- a/fail2ban/tests/actionstestcase.py +++ b/fail2ban/tests/actionstestcase.py @@ -32,7 +32,7 @@ from ..server.actions import Actions from ..server.ticket import FailTicket from ..server.utils import Utils from .dummyjail import DummyJail -from .utils import LogCaptureTestCase +from .utils import LogCaptureTestCase, with_alt_time, MyTime TEST_FILES_DIR = os.path.join(os.path.dirname(__file__), "files") @@ -173,3 +173,39 @@ class ExecuteActions(LogCaptureTestCase): self.assertNotLogged("Failed to execute unban") self.assertLogged("action1 unban deleted aInfo IP") self.assertLogged("action2 unban deleted aInfo IP") + + @with_alt_time + def testUnbanOnBusyBanBombing(self): + # check unban happens in-between of "ban bombing" despite lower precedence, + # if it is not work, we'll see "Unbanned 25" earliest at flushing (after stop) + + # each 3rd ban we should see an unban check (and tickets gets unbanned): + self.__actions.banPrecedence = 3 + self.__actions.setBanTime(100) + + self.__actions.start() + + MyTime.setTime(0); # avoid "expired bantime" (in 0.11) + i = 0 + while i < 25: + ip = "192.0.2.%d" % i + self.__jail.putFailTicket(FailTicket(ip, 0)) + i += 1 + + # wait for last ban (all 25 tickets gets banned): + self.assertLogged(' / 25,', wait=True) + + MyTime.setTime(200); # unban time for 25 tickets reached + + while i < 50: + ip = "192.0.2.%d" % i + self.__jail.putFailTicket(FailTicket(ip, 200)) + i += 1 + + # wait for last ban (all 50 tickets gets banned): + self.assertLogged(' / 50,', wait=True) + self.__actions.stop() + self.__actions.join() + + self.assertLogged('Unbanned 25, 0 ticket(s)') + self.assertNotLogged('Unbanned 50, 0 ticket(s)')