| Summary: | audit allows tcp_max_per_addr + 1 connections | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Ondrej Moriš <omoris> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.2 | CC: | jrieden, pkis |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | audit-2.3.7-1.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-10-14 07:14:03 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | |||
| Bug Blocks: | 947775, 1070830 | ||
Fixed in upstream commit 692. Thanks. This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4. This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux. audit-2.3.7-1.el6 was built to resolve this issue. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1515.html |
Description of problem: Auditd option tcp_max_per_addr is given a numeric value representing how many concurrent connections from one IP address is allowed. Thus setting tcp_max_per_addr = 1 should allow exactly one connection per IP address. Checking the number of concurrent connection is done in auditd-listen.c: static int check_num_connections(struct sockaddr_in *aaddr) { int num = 0; struct ev_tcp *client = client_chain; while (client) { if (memcmp(&aaddr->sin_addr, &client->addr.sin_addr, sizeof(struct in_addr)) == 0) { num++; if (num > max_per_addr) return 1; } client = client->next; } return 0; } Suppose there is only a single connection from IP address A, then num = 1 in while-loop and since 1 > 1 is false, function check_num_connections returns 0 and another connection from IP address A is allowed, any further connection from A will be rejected. The problem can be easily fixed by changing '>' to '>=' in check_num_connection. Version-Release number of selected component (if applicable): audit-2.2-2.el6 How reproducible: 100% Steps to Reproduce: 1. set tcp_max_per_addr = 1 and tcp_listen_port = 60 in /etc/audit/auditd.conf 2. restart auditd service 3. nc localhost 60 -v & 4. nc localhost 60 -v & 5. nc localhost 60 -v & 6. ausearch -m DAEMON_ACCEPT -ts recent Actual results: ---- time->Sun Apr 8 18:35:08 2012 type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success ---- time->Sun Apr 8 18:35:10 2012 type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): addr=127.0.0.1 port=34346 res=success ---- time->Sun Apr 8 18:35:12 2012 type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no Expected results: ---- time->Sun Apr 8 18:35:08 2012 type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success ---- time->Sun Apr 8 18:35:10 2012 type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): op=dup addr=127.0.0.1 port=34346 res=no ---- time->Sun Apr 8 18:35:12 2012 type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no