Bug 1101605

Summary:	ipv6 seems not working
Product:	Red Hat Enterprise Linux 7	Reporter:	Patrik Kis <pkis>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	high	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	high
Version:	7.0	CC:	dpal, mjahoda, mthacker, omoris, pkis, pmoore
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	audit-2.8.1-2.el7	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-10 12:18:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1476406

Comment 1 Steve Grubb 2014-05-27 15:53:58 UTC

A quick check of the daemon code shows its IPv4 only.

Comment 12 Steve Grubb 2017-10-02 01:32:59 UTC

Upstream commits:

5bcbfffbd986304861e225302e75fe19b0cc94bf,
986b7374c25212b7e9edd2a730b067f081fb2aca, and
12c69cacc321cb92ac3179ee2240029364101f34

should solve this issue.

Comment 13 Steve Grubb 2017-10-10 19:58:59 UTC

audit-2.8-1.el7 was built to resolve this issue.

Comment 15 Ondrej Moriš 2017-10-17 16:41:10 UTC

It looks like there is still something missing or broken. I am testing with audit-2.8.1-1 and IPv6 connection is refused by remote logging server:

ON CLIENT
=========
# strace -f -p <audisp>
...
[pid 29783] connect(3, {sa_family=AF_INET6, sin6_port=htons(60), inet_pton(AF_INET6, "2620:52:0:25a2:d836:d0ff:fe6e:501d", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 ECONNREFUSED (Connection refused)
...

# journalctl -xe
...
Oct 17 16:28:42 sheep-49.lab.eng.brq.redhat.com audisp-remote[29783]: Error connecting to sheep-29.lab.eng.brq.redhat.
...

ON SERVER
=========
# netstat -ptna | grep :60
tcp        0      0 0.0.0.0:60              0.0.0.0:*               LISTEN      28521/auditd        

Clearly, auditd is not listening on IPv6. Test scenario is as follows: 

 * on server
   - listen on port 60, 
   - firewalld is not running, empty iptables

 * on client
   - active audit-remote plugin with remote_server set to server hostname,
   - no firewalld is not running, empty iptables
   - server hostname mapped to its global ipv6 address in /etc/hosts
   - nsswitch configured to check /etc/hosts only

With IPv4 address set to server hostname in /etc/hosts it works just fine. But with IPv6 connection is dropped by server.

Comment 16 Steve Grubb 2017-10-17 18:34:12 UTC

strange, it worked when I tested it. But clearly something is wrong. Upstream commit 659bfd3 makes the server bind to :::*.

Comment 17 Steve Grubb 2017-11-06 19:26:20 UTC

audit-2.8.1-2.el7 was built to fix the issue in #c15.

Comment 21 errata-xmlrpc 2018-04-10 12:18:47 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0760