{"update": {"autokarma": true, "autotime": true, "stable_karma": 3, "stable_days": 14, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "Change default from firewalld-ipset to firewalld-rich-rules, fixes #1823746.", "type": "bugfix", "status": "stable", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2020-04-22 14:28:13", "date_modified": null, "date_approved": null, "date_testing": "2020-04-22 19:26:36", "date_stable": "2020-05-07 00:40:27", "alias": "FEDORA-EPEL-2020-f5c952ab51", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2020-05-07 00:40:27", "meets_testing_requirements": true, "url": "https://bodhi.stg.fedoraproject.org/updates/FEDORA-EPEL-2020-f5c952ab51", "title": "fail2ban-0.11.1-6.el8", "version_hash": "f9f58eb2413d33fa8f0ebf5314897609ceb3d2b7", "release": {"name": "EPEL-8", "long_name": "Fedora EPEL 8", "version": "8", "id_prefix": "FEDORA-EPEL", "branch": "epel8", "dist_tag": "epel8", "stable_tag": "epel8", "testing_tag": "epel8-testing", "candidate_tag": "epel8-testing-candidate", "pending_signing_tag": "epel8-signing-pending", "pending_testing_tag": "epel8-testing-pending", "pending_stable_tag": "epel8-pending", "override_tag": "epel8-override", "mail_template": "fedora_epel_legacy_errata_template", "state": "current", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "unspecified", "testing_repository": null, "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "hobbes1069", "email": "hobbes1069@gmail.com", "id": 174, "avatar": "https://seccdn.libravatar.org/avatar/d46bee4659f1a3c55b116ac575aa0e319e583e5cc56bea70f12a4f5fe4350365?s=24&d=retro", "openid": "hobbes1069.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by hobbes1069. ", "timestamp": "2020-04-22 14:28:13", "update_id": 201916, "user_id": 91, "id": 1339559, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2020-04-22 14:28:14", "update_id": 201916, "user_id": 91, "id": 1339560, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2020-04-22 14:28:18", "update_id": 201916, "user_id": 91, "id": 1339568, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2020-04-22 19:27:21", "update_id": 201916, "user_id": 91, "id": 1339956, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "After a fresh centos8 install, I was disappointed that fail2ban would mark an IP as failing, yet it wasn't getting blocked at any level.  Thanks for fixing this, it's working now for me. -mdomsch", "timestamp": "2020-05-03 03:57:14", "update_id": 201916, "user_id": 579, "id": 1354231, "bug_feedback": [{"karma": 1, "comment_id": 1354231, "bug_id": 1823746, "bug": {"bug_id": 1823746, "title": "fail2ban-firewalld default action uses unsupport direct rule, should use rich-rule", "security": false, "parent": false}}], "testcase_feedback": [], "user": {"name": "mdomsch", "email": "matt@domsch.com", "id": 579, "avatar": "https://seccdn.libravatar.org/avatar/101447afb49ebed00dbcd193f89d3102b0397386443486db3f4f2644ad86c3e8?s=24&d=retro", "openid": "mdomsch.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fedora-hams"}, {"name": "cvsfedora"}, {"name": "gitcorrespondingsource"}, {"name": "altvideos"}, {"name": "trust admins"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update can be pushed to stable now if the maintainer wishes", "timestamp": "2020-05-06 19:29:14", "update_id": 201916, "user_id": 91, "id": 1360086, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2020-05-06 19:29:15", "update_id": 201916, "user_id": 91, "id": 1360087, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2020-05-07 00:41:00", "update_id": 201916, "user_id": 91, "id": 1360378, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "fail2ban-0.11.1-6.el8", "signed": true, "release_id": 34, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1823746, "title": "fail2ban-firewalld default action uses unsupport direct rule, should use rich-rule", "security": false, "parent": false, "feedback": [{"karma": 0, "comment_id": 1351356, "bug_id": 1823746, "comment": {"karma": 0, "karma_critpath": 0, "text": "With recidive jail enabled with bantime   =  -1 I see these failures with <code>banaction = firewallcmd-rich-rules</code> in [DEFAULT]\n\n<code>\n2020-04-30 11:42:06,772 fail2ban.actions        [941370]: NOTICE  [recidive] Restore Ban 106.13.58.170\n\n2020-04-30 11:42:07,232 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- exec: ports=\"0:65535\"; for p in $(echo $ports | tr \", \" \" \"); do firewall-cmd --add-rich-rule=\"rule family='ipv4' source address='106.13.58.170' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'\"; done\n\n2020-04-30 11:42:07,232 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- stderr: 'Error: INVALID_PORT: 0:65535'\n\n2020-04-30 11:42:07,232 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- returned 102\n\n2020-04-30 11:42:07,232 fail2ban.actions        [941370]: ERROR   Failed to execute ban jail 'recidive' action 'firewallcmd-rich-rules' info 'ActionInfo({'ip': '106.13.58.170', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7f52537e2680>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7f52537e2d40>})': Error banning 106.13.58.170\n\n2020-04-30 11:42:07,233 fail2ban.actions        [941370]: NOTICE  [recidive] Restore Ban 106.13.70.85\n\n2020-04-30 11:42:07,695 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- exec: ports=\"0:65535\"; for p in $(echo $ports | tr \", \" \" \"); do firewall-cmd --add-rich-rule=\"rule family='ipv4' source address='106.13.70.85' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'\"; done\n2020-04-30 11:42:07,696 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- stderr: 'Error: INVALID_PORT: 0:65535'\n\n2020-04-30 11:42:07,696 fail2ban.utils          [941370]: ERROR   7f52537d2580 -- returned 102\n\n2020-04-30 11:42:07,696 fail2ban.actions        [941370]: ERROR   Failed to execute ban jail 'recidive' action 'firewallcmd-rich-rules' info 'ActionInfo({'ip': '106.13.70.85', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7f52537e2680>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7f52537e2d40>})': Error banning 106.13.70.85\n2020-04-30 11:42:07,696 fail2ban.actions        [941370]: NOTICE  [recidive] Restore Ban 106.51.44.4</code>\n\n<code>\nfail2ban-client get sshd banip ?sep-char|--with-time?\n\n-bash: --with-time?: command not found\n\n2020-04-30 11:48:31,235 fail2ban                [944560]: ERROR   [Errno 32] Broken pipe\nTraceback (most recent call last):\n\n  File \"/usr/bin/fail2ban-client\", line 37, in <module>\n    exec_command_line(sys.argv)\n\n  File \"/usr/lib/python3.7/site-packages/fail2ban/client/fail2banclient.py\", line 502, in exec_command_line\n    exit(255)\n\n  File \"/usr/lib/python3.7/site-packages/fail2ban/client/fail2bancmdline.py\", line 317, in exit\n    sys.stdout.flush()\n\nBrokenPipeError: [Errno 32] Broken pipe\n\nException ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='UTF-8'>\n\nBrokenPipeError: [Errno 32] Broken pipe\n</code>", "timestamp": "2020-04-30 15:49:34", "update_id": 201917, "user_id": 3410, "id": 1351356, "testcase_feedback": [], "user": {"name": "robbiethek", "email": "rkudyba@fordham.edu", "id": 3410, "avatar": "https://seccdn.libravatar.org/avatar/62d7bff9f28067c1419a713458a9900dc9b9f0a1a2980de737cbf861c8dc33a9?s=24&d=retro", "openid": "robbiethek.id.stg.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1352608, "bug_id": 1823746, "comment": {"karma": -1, "karma_critpath": 0, "text": "As noted in the BZ entry https://bugzilla.redhat.com/show_bug.cgi?id=1823746#c19, you can use  <code>port = 0-65535</code> for the <code>port</code> option.\n\nHowever I could not get the <code>recidive</code> jail to work with this  and had to use the <code>iptables</code> options.", "timestamp": "2020-05-01 15:56:26", "update_id": 201917, "user_id": 3410, "id": 1352608, "testcase_feedback": [], "user": {"name": "robbiethek", "email": "rkudyba@fordham.edu", "id": 3410, "avatar": "https://seccdn.libravatar.org/avatar/62d7bff9f28067c1419a713458a9900dc9b9f0a1a2980de737cbf861c8dc33a9?s=24&d=retro", "openid": "robbiethek.id.stg.fedoraproject.org", "groups": []}}}, {"karma": 1, "comment_id": 1354231, "bug_id": 1823746, "comment": {"karma": 1, "karma_critpath": 0, "text": "After a fresh centos8 install, I was disappointed that fail2ban would mark an IP as failing, yet it wasn't getting blocked at any level.  Thanks for fixing this, it's working now for me. -mdomsch", "timestamp": "2020-05-03 03:57:14", "update_id": 201916, "user_id": 579, "id": 1354231, "testcase_feedback": [], "user": {"name": "mdomsch", "email": "matt@domsch.com", "id": 579, "avatar": "https://seccdn.libravatar.org/avatar/101447afb49ebed00dbcd193f89d3102b0397386443486db3f4f2644ad86c3e8?s=24&d=retro", "openid": "mdomsch.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fedora-hams"}, {"name": "cvsfedora"}, {"name": "gitcorrespondingsource"}, {"name": "altvideos"}, {"name": "trust admins"}]}}}]}], "updateid": "FEDORA-EPEL-2020-f5c952ab51", "karma": 1, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}