Description of problem:

Auditd option tcp_max_per_addr is given a numeric value representing how many concurrent connections from one IP address is allowed. Thus setting tcp_max_per_addr = 1 should allow exactly one connection per IP address. Checking the number of concurrent connection is done in auditd-listen.c:

static int check_num_connections(struct sockaddr_in *aaddr)
{
        int num = 0;
        struct ev_tcp *client = client_chain;

        while (client) {
                if (memcmp(&aaddr->sin_addr, &client->addr.sin_addr,
                                        sizeof(struct in_addr)) == 0) {
                        num++;
                        if (num > max_per_addr)
                                return 1;
                }
                client = client->next;
        }
        return 0;
}

Suppose there is only a single connection from IP address A, then num = 1 in while-loop and since 1 > 1 is false, function check_num_connections returns 0 and another connection from IP address A is allowed, any further connection from A will be rejected. 

The problem can be easily fixed by changing '>' to '>=' in check_num_connection.

Version-Release number of selected component (if applicable):

audit-2.2-2.el6

How reproducible:

100%

Steps to Reproduce:

1. set tcp_max_per_addr = 1 and tcp_listen_port = 60 in /etc/audit/auditd.conf
2. restart auditd service
3. nc localhost 60 -v &
4. nc localhost 60 -v &
5. nc localhost 60 -v &
6. ausearch -m DAEMON_ACCEPT -ts recent 

Actual results:

----
time->Sun Apr  8 18:35:08 2012
type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success
----
time->Sun Apr  8 18:35:10 2012
type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): addr=127.0.0.1 port=34346 res=success
----
time->Sun Apr  8 18:35:12 2012
type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no

Expected results:

----
time->Sun Apr  8 18:35:08 2012
type=DAEMON_ACCEPT msg=audit(1333924508.849:1878): addr=127.0.0.1 port=34345 res=success
----
time->Sun Apr  8 18:35:10 2012
type=DAEMON_ACCEPT msg=audit(1333924510.002:1879): op=dup addr=127.0.0.1 port=34346 res=no
----
time->Sun Apr  8 18:35:12 2012
type=DAEMON_ACCEPT msg=audit(1333924512.441:1880): op=dup addr=127.0.0.1 port=34347 res=no