Bug 1525134 - Banned IPv6 address not getting added to ipset
Summary: Banned IPv6 address not getting added to ipset
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: fail2ban
Version: 27
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Orion Poplawski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1525065 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-12 16:40 UTC by dan
Modified: 2018-01-10 02:04 UTC (History)
8 users (show)

Fixed In Version: fail2ban-0.10.1-3.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-10 02:04:00 UTC


Attachments (Terms of Use)

Description dan 2017-12-12 16:40:11 UTC
The added IPv6 support in fail2ban is not working properly in FC27.  This was tested between 2 hosts using ssh over IPv4 and IPv6.

Password failures meeting the threshold added both the IPv4 and IPv6 to the banned list as shown by:

fail2ban> status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	16
|  |- Total failed:	1934
|  `- Journal matches:	_SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned:	10
   |- Total banned:	10
   `- Banned IP list:	218.65.30.251 121.18.238.125 164.52.0.140 190.214.207.241 192.129.227.186 221.194.47.221 190.114.236.85 195.154.51.124 2601:3c04::f03c:91ff:fe59:2177 33.43.61.61
fail2ban> 

The IPv6 addresses are NOT being added to the ipset:

dan@ears ~]$ sudo ipset -L
Name: f2b-sshd
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536 timeout 86400
Size in memory: 952
References: 1
Number of entries: 9
Members:
33.43.61.61 timeout 86390
221.194.47.221 timeout 84621
218.65.30.251 timeout 84621
195.154.51.124 timeout 86000
192.129.227.186 timeout 84621
190.214.207.241 timeout 84621
190.114.236.85 timeout 85623
121.18.238.125 timeout 84621
164.52.0.140 timeout 84621

Name: f2b-sshd6
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536 timeout 86400
Size in memory: 88
References: 0
Number of entries: 0
Members:


Ipset v6 is installed:

ipset v6.32, protocol version: 6

Comment 1 dan 2017-12-12 18:18:04 UTC
From fail2ban.log after another test, IP changed to ficticious value and reverse IP redacted for brevity:

017-12-12 13:09:44,861 fail2ban.filter         [1392]: INFO    [sshd] Found 2622:3c23::d03c:95ff:fe33:2467 - 2017-12-12 13:09:44
2017-12-12 13:09:47,066 fail2ban.filter         [1392]: INFO    [sshd] Found 2622:3c23::d03c:95ff:fe33:2467 - 2017-12-12 13:09:46
2017-12-12 13:09:47,369 fail2ban.actions        [1392]: NOTICE  [sshd] Ban 2622:3c23::d03c:95ff:fe33:2467
2017-12-12 13:09:47,688 fail2ban.utils          [1392]: Level 39 7ffb59530870 -- exec: ipset create f2b-sshd6 hash:ip timeout 86400
firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p tcp -m multiport --dports ssh -m set --match-set f2b-sshd6 src -j REJECT --reject-with icmp6-port-unreachable
2017-12-12 13:09:47,689 fail2ban.utils          [1392]: ERROR   7ffb59530870 -- stderr: 'ipset v6.32: Set cannot be created: set with the same name already exists'
2017-12-12 13:09:47,689 fail2ban.utils          [1392]: ERROR   7ffb59530870 -- stderr: '\x1b[91mError: COMMAND_FAILED\x1b[00m'
2017-12-12 13:09:47,689 fail2ban.utils          [1392]: ERROR   7ffb59530870 -- returned 13
2017-12-12 13:09:47,689 fail2ban.actions        [1392]: ERROR   Failed to execute ban jail 'sshd' action 'firewallcmd-ipset' info 'ActionInfo({'ip': 2622:3c23::d03c:95ff:fe33:2467, 'family': 'inet6', 'ip-rev': 'redacted reverse ip', 'ip-host': 'other.myhost.com', 'fid': 2622:3c23::d03c:95ff:fe33:2467, 'failures': 3, 'time': 1513102186.719978, 'matches': '2017-12-12T11:31:44.483292myhost.com sshd[3844]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33414 ssh2\n2017-12-12T13:09:46.719978myhost.com sshd[9365]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33462 ssh2', 'restored': 0, 'F-*': {'matches': [('', '2017-12-12T11:31:44.483292', 'myhost.com sshd[3844]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33414 ssh2'), '2017-12-12T13:09:46.719978myhost.com sshd[9365]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33462 ssh2'], 'failures': 3, 'mlfid': 'myhost.com sshd[3844]: ', 'user': 'dan', 'ip6': '2622:3c23::d03c:95ff:fe33:2467'}, 'ipmatches': '2017-12-12T11:31:44.483292myhost.com sshd[3844]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33414 ssh2\n2017-12-12T13:09:46.719978myhost.com sshd[9365]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33462 ssh2', 'ipjailmatches': '2017-12-12T11:31:44.483292myhost.com sshd[3844]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33414 ssh2\n2017-12-12T13:09:46.719978myhost.com sshd[9365]: Failed password for dan from 2622:3c23::d03c:95ff:fe33:2467 port 33462 ssh2', 'ipfailures': 3, 'ipjailfailures': 3, 'fq-hostname': 'ears.private', 'sh-hostname': 'myhost.com'})': Error starting action Jail('sshd')/firewallcmd-ipset

Comment 2 dan 2017-12-13 18:29:06 UTC
This seems to go back to firewall-cmd.  Manually trying:

sudo firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p tcp -m multiport --dports ssh -m set --match-set f2b-sshd6 src -j REJECT --reject-with icmp6-port-unreachable

It logs:

Dec 13 13:22:56 myhost.com firewalld[1026]: WARNING: '/usr/sbin/ip6tables-restore --wait=2 -n' failed:
Dec 13 13:22:56 myhost.com firewalld[1026]: ERROR: COMMAND_FAILED

Perhaps this should be transferred to the firewalld team?

Comment 3 dan 2017-12-16 23:43:53 UTC
Seem to relate to this upstream issue on fail2ban:

https://github.com/fail2ban/fail2ban/issues/1990

Comment 4 Georges Racinet 2017-12-17 16:41:36 UTC
Hi, I'm also affected by this issue, and I can confirm this is the aforementionned upstream issue 1990

ip6tables-restore is presenting the error only because it acts as a backend of firewalld in this case (that explains the apparent difference with the upstream issue).
I'm not sure what Fedora policy says in that case, but either packaging a future 0.10.2 or backporting the upstream maintainer's very simple fix would solve the present issue.

To back this up, here are my investigations (done before getting knowledge of the upstream bug).

By turning on firewalld debug log at level >=3, one can see what it
tried to load with ip6tables-restore:

    2017-12-15 02:31:08 DEBUG1: direct.addRule('ipv6', 'filter',
'INPUT', 0,
'-p','tcp','-m','multiport','--dports','ssh','-m','set','--match-set','f2b-sshd6','src','-j','REJECT','--reject-with','icmp6-port-unreachable')
    2017-12-15 02:31:08 DEBUG2: <class
'firewall.core.ipXtables.ip6tables'>: /usr/sbin/ip6tables-restore
/run/firewalld/temp.pxn873ip: 146
           1: *filter
           2: -I INPUT_direct 1 -p tcp -m multiport --dports ssh -m set
--match-set f2b-sshd6 src -j REJECT --reject-with icmp6-port-unreachable
           3: COMMIT

Now I tried the same directly to get a grasp :

    $ sudo ip6tables -I INPUT_direct 1 -p tcp -m multiport --dports ssh
-m set --match-set f2b-sshd6 src -j REJECT --reject-with
icmp6-port-unreachable

    ip6tables v1.6.1: The protocol family of set f2b-sshd6 is IPv4,
which is not applicable.

And indeed :

$ sudo ipset list
    Name: f2b-sshd6
    Type: hash:ip
    Revision: 4
    Header: family inet hashsize 1024 maxelem 65536 timeout 600
    Size in memory: 88
    References: 0
    Number of entries: 0
    Members:

Comment 5 Fedora Update System 2017-12-30 20:07:08 UTC
fail2ban-0.10.1-3.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-d1257bf9ca

Comment 6 dan 2017-12-30 20:51:17 UTC
Seems to resolve this issue.  An IPv6 was correctly added to the ipset and blocked as expected.

Comment 7 Fedora Update System 2017-12-31 19:32:32 UTC
fail2ban-0.10.1-3.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d1257bf9ca

Comment 8 Orion Poplawski 2017-12-31 20:09:28 UTC
*** Bug 1525065 has been marked as a duplicate of this bug. ***

Comment 9 Fedora Update System 2018-01-10 02:04:00 UTC
fail2ban-0.10.1-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.