Bug 810749 - audit allows tcp_max_per_addr + 1 connections
audit allows tcp_max_per_addr + 1 connections
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: audit (Show other bugs)
6.2
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Steve Grubb
Ondrej Moriš
:
Depends On:
Blocks: 947775 1070830
  Show dependency treegraph
 
Reported: 2012-04-08 18:37 EDT by Ondrej Moriš
Modified: 2014-10-14 03:14 EDT (History)
2 users (show)

See Also:
Fixed In Version: audit-2.3.7-1.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-14 03:14:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ondrej Moriš 2012-04-08 18:37:01 EDT
Description of problem:

Auditd option tcp_max_per_addr is given a numeric value representing how many concurrent connections from one IP address is allowed. Thus setting tcp_max_per_addr = 1 should allow exactly one connection per IP address. Checking the number of concurrent connection is done in auditd-listen.c:

static int check_num_connections(struct sockaddr_in *aaddr)
{
        int num = 0;
        struct ev_tcp *client = client_chain;

        while (client) {
                if (memcmp(&aaddr->sin_addr, &client->addr.sin_addr,
                                        sizeof(struct in_addr)) == 0) {
                        num++;
                        if (num > max_per_addr)
                                return 1;
                }
                client = client->next;
        }
        return 0;
}

Suppose there is only a single connection from IP address A, then num = 1 in while-loop and since 1 > 1 is false, function check_num_connections returns 0 and another connection from IP address A is allowed, any further connection from A will be rejected. 

The problem can be easily fixed by changing '>' to '>=' in check_num_connection.

Version-Release number of selected component (if applicable):

audit-2.2-2.el6

How reproducible:

100%

Steps to Reproduce:

1. set tcp_max_per_addr = 1 and tcp_listen_port = 60 in /etc/audit/auditd.conf
2. restart auditd service
3. nc localhost 60 -v &
4. nc localhost 60 -v &
5. nc localhost 60 -v &
6. ausearch -m DAEMON_ACCEPT -ts recent 

Actual results:

----
time->Sun Apr  8 18:35:08 2012
type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success
----
time->Sun Apr  8 18:35:10 2012
type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): addr=127.0.0.1 port=34346 res=success
----
time->Sun Apr  8 18:35:12 2012
type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no

Expected results:

----
time->Sun Apr  8 18:35:08 2012
type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success
----
time->Sun Apr  8 18:35:10 2012
type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): op=dup addr=127.0.0.1 port=34346 res=no
----
time->Sun Apr  8 18:35:12 2012
type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no
Comment 1 Steve Grubb 2012-04-09 11:13:52 EDT
Fixed in upstream commit 692. Thanks.
Comment 3 RHEL Product and Program Management 2012-07-10 01:49:15 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 4 RHEL Product and Program Management 2012-07-10 19:05:00 EDT
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 5 RHEL Product and Program Management 2012-09-07 01:13:21 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 6 Steve Grubb 2014-06-03 21:58:41 EDT
audit-2.3.7-1.el6 was built to resolve this issue.
Comment 10 errata-xmlrpc 2014-10-14 03:14:03 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1515.html

Note You need to log in before you can comment on or make changes to this bug.