Bug 1047363

Summary:	fail2ban [asterisk] jail doesn't create both tcp and udp iptables rules
Product:	[Fedora] Fedora EPEL	Reporter:	Greg Bailey <gbailey>
Component:	fail2ban	Assignee:	Orion Poplawski <orion>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	el6	CC:	admiller, orion, vonsch
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	fail2ban-0.9.2-1.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-03-09 21:40:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Greg Bailey 2013-12-30 16:56:57 UTC

Description of problem:

I run asterisk 1.8.20.0 on a CentOS 6.5 system with the EPEL repository.  After upgrading to fail2ban-0.8.11-2.el6, I enabled the following jail in /etc/fail2ban/jail.local as suggested by comments in the /etc/fail2ban/jail.conf file:

# cat jail.local 
[asterisk]
enabled = true

After restarting fail2ban, I see the chain "fail2ban-asterisk-udp" created, but not the expected "fail2ban-asterisk-tcp" chain.  There is the expected rule added in the INPUT chain to direct UDP packets on ports 5060 and 5061 to the newly created "fail2ban-asterisk-udp" chain, but again, no corresponding INPUT chain rule to redirect TCP packets on ports 5060 and 5061 to the missing "fail2ban-asterisk-tcp" chain.

Version-Release number of selected component (if applicable):

fail2ban-0.8.11-2.el6

How reproducible:

Always

Steps to Reproduce:
1.  Add [asterisk] jail to /etc/fail2ban/jail.local
2.  Restart fail2ban
3.  Observe via iptables -L that no chain was created to catch TCP connections

Actual results:

No filtering of TCP connections to ports 5060,5061 to fail2ban chains

Expected results:

Either the INPUT rule would pass both TCP *and* UDP traffic on ports 5060,5061 to one fail2ban created chain, or separate TCP and UDP chains and rules would be created.

Additional info:

iptables -L output:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-asterisk-udp  udp  --  anywhere             anywhere            multiport dports sip,sip-tls 
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:sip 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:sip 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-asterisk-udp (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

Comment 1 Fedora Update System 2014-07-21 23:07:24 UTC

fail2ban-0.8.13-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/fail2ban-0.8.13-1.el6

Comment 2 Fedora Update System 2014-07-22 18:09:39 UTC

Package fail2ban-0.8.13-1.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-1.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-1.el6
then log in and leave karma (feedback).

Comment 3 Greg Bailey 2014-07-27 13:24:32 UTC

After upgrading to fail2ban-0.8.13-1.el6.noarch from the epel-testing repo, I still see the same behavior as described in the original report.

If I just define [asterisk] in jail.local, only the "fail2ban-asterisk-udp" chain is created, and not the additional expected "fail2ban-asterisk-tcp" chain.

Comment 4 Fedora Update System 2014-07-30 19:34:55 UTC

Package fail2ban-0.8.13-2.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-2.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-2.el6
then log in and leave karma (feedback).

Comment 5 Greg Bailey 2014-09-03 00:36:20 UTC

Upstream issue filed at:
https://github.com/fail2ban/fail2ban/issues/798

Comment 6 Orion Poplawski 2015-04-07 22:03:34 UTC

See https://copr.fedoraproject.org/coprs/orion/fail2ban-el6/ if you'd like to test out 0.9.1.