Errors/crashes when ban-list gets too long

[Tristar7]

When the ban-list surpasses 10'000 entries it stops working, eats lots of CPU and throws following error

[Error]: The array bounds are invalid. (Exception from HRESULT: 0x800706C6)

additionally it is not possible to delete the ban-list from within the program as it crashes with

Application: EvlWatcherConsole.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.

Exception Info: System.ServiceModel.FaultException

Server stack trace: 
   at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
   at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(System.Runtime.Remoting.Messaging.IMessage, System.Runtime.Remoting.Messaging.IMessage)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(System.Runtime.Remoting.Proxies.MessageData ByRef, Int32)
   at EvlWatcher.WCF.IEvlWatcherService.ClearPermanentBan(System.Net.IPAddress)
   at EvlWatcherConsole.Model.EvlWatcherModel.RemovePermanentIPBan(System.Net.IPAddress)
   at EvlWatcherConsole.ViewModel.MainWindowViewModel.<get_RemovePermaBanCommand>b__114_0(System.Object)
   at EvlWatcherConsole.MVVMBase.RelayCommand.Execute(System.Object)
   at MS.Internal.Commands.CommandHelpers.CriticalExecuteCommandSource(System.Windows.Input.ICommandSource, Boolean)
   at System.Windows.Controls.Primitives.ButtonBase.OnClick()
   at System.Windows.Controls.Button.OnClick()
   at System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonUp(System.Windows.Input.MouseButtonEventArgs)
   at System.Windows.UIElement.OnMouseLeftButtonUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   at System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   at System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   at System.Windows.UIElement.OnMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   at System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   at System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   at System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   at System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.Input.InputManager.ProcessStagingArea()
   at System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   at System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   at System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   at System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   at System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Application.RunDispatcher(System.Object)
   at System.Windows.Application.RunInternal(System.Windows.Window)
   at System.Windows.Application.Run(System.Windows.Window)
   at EvlWatcherConsole.App.Main()

[devnulli]

Hi.

Thanks for that error report. Looking at the stacktrace, the crash is happening in the console, not in the service.

This means that the service is running normally. For fun, we tried out how many IPs the service could handle a while ago, and it was a LOT. But what happens when such a lot of IPs are banned is, that the (huge) amount of IPs cannot be transferred to the console for displaying via its secured named pipe.

What you can do:

• You can remove the (huge) amount of IPs by editing the config.xml file and removing them. (they are stored there)

• You can additionally uninstall evlwatcher (which will also remove the config where the xml file is stored including the banlist) and reinstall it with default settings. The default settings prevent such huge pile of ip-lists to accumulate (unless its a different thing, see bottom)

• (by the way, I personally dont use the perma-list at all, as it makes no sense to keep track of all the IPs that ever attacked you -> the temporary bans are working fine to annoy the attackers)

• If more users report that problem I will fix the displaying of huge lists in the console, by adding pagination to the service host

• Also, I would be interested if the IPs are IPv6 IPs or IPv4 IPs. If it's IPv6 IPs, there might be a different problem. (attackers switching IPs real fast). In that case, I would have to adjust the ban mechanism for IPv6 so ban subnets instead of single IPs

greetings, Mike

[Tristar7]

Just had this happen again. The error comes from the service. Didn't have to gui running at all this time, so there's clearly more problems at hand. (all IPv4 IPs) Also temporary bans are not good enough or would need to be massively extended to be useful here.

[devnulli]

ill try to reproduce that. how long (circa) is your ban list?

EDIT: - ah its all there, nevermind

[devnulli]

hi, i cant fix this at the moment (WCF limitation) - seems to not occur on other systems tho - or ppl dont have that huge a banlist.

sorry, but im closing this... but i already thinking of replacing WCF with better solution

[Tristar7]

A possible workaround would be to drop oldest IPs before surpassing 10k total.

[devnulli]

will do that