* [PATCH v2] tcp: Add listening address to SYN flood message
@ 2022-11-11 3:59 Jamie Bainbridge
2022-11-11 17:20 ` Stephen Hemminger
0 siblings, 1 reply; 7+ messages in thread
From: Jamie Bainbridge @ 2022-11-11 3:59 UTC (permalink / raw)
To: Eric Dumazet, David S. Miller, Hideaki YOSHIFUJI, David Ahern,
Jakub Kicinski, Paolo Abeni
Cc: Jamie Bainbridge, netdev, linux-kernel
The SYN flood message prints the listening port number, but with many
processes bound to the same port on different IPs, it's impossible to
tell which socket is the problem.
Add the listen IP address to the SYN flood message in the "IP.port"
format like most other tools (eg: tcpdump).
Each protcol's "any" address and a host address now look like:
Possible SYN flooding on port 0.0.0.0.9001.
Possible SYN flooding on port 127.0.0.1.9001.
Possible SYN flooding on port ::.9001.
Possible SYN flooding on port fc00::1.9001.
Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
---
v2: Place IS_ENABLED() inside if condition c/o Andrew Lunn.
Change port printf to unsigned c/o Stephen Hemminger.
Remove long and unhelpful "Check SNMP counters" c/o Stephen.
Use IP.port format c/o Eric Dumazet.
---
net/ipv4/tcp_input.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0640453fce54b6daae0861d948f3db075830daf6..5b156dfc13b3d45c20e4fe6a45af7c42f39b2c66 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6831,9 +6831,17 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
if (!queue->synflood_warned && syncookies != 2 &&
- xchg(&queue->synflood_warned, 1) == 0)
- net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
- proto, sk->sk_num, msg);
+ xchg(&queue->synflood_warned, 1) == 0) {
+ if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
+ net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
+ proto, &sk->sk_v6_rcv_saddr,
+ sk->sk_num, msg);
+ } else {
+ net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
+ proto, &sk->sk_rcv_saddr,
+ sk->sk_num, msg);
+ }
+ }
return want_cookie;
}
--
2.38.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-11 3:59 [PATCH v2] tcp: Add listening address to SYN flood message Jamie Bainbridge
@ 2022-11-11 17:20 ` Stephen Hemminger
2022-11-11 23:59 ` Jamie Bainbridge
0 siblings, 1 reply; 7+ messages in thread
From: Stephen Hemminger @ 2022-11-11 17:20 UTC (permalink / raw)
To: Jamie Bainbridge
Cc: Eric Dumazet, David S. Miller, Hideaki YOSHIFUJI, David Ahern,
Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Fri, 11 Nov 2022 14:59:32 +1100
Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> + xchg(&queue->synflood_warned, 1) == 0) {
> + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> + proto, &sk->sk_v6_rcv_saddr,
> + sk->sk_num, msg);
> + } else {
> + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> + proto, &sk->sk_rcv_saddr,
> + sk->sk_num, msg);
Minor nit, the standard format for printing addresses would be to use colon seperator before port
if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
} else {
net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-11 17:20 ` Stephen Hemminger
@ 2022-11-11 23:59 ` Jamie Bainbridge
2022-11-12 0:10 ` Eric Dumazet
2022-11-12 0:11 ` Stephen Hemminger
0 siblings, 2 replies; 7+ messages in thread
From: Jamie Bainbridge @ 2022-11-11 23:59 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Eric Dumazet, David S. Miller, Hideaki YOSHIFUJI, David Ahern,
Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Sat, 12 Nov 2022 at 04:20, Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Fri, 11 Nov 2022 14:59:32 +1100
> Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
>
> > + xchg(&queue->synflood_warned, 1) == 0) {
> > + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> > + proto, &sk->sk_v6_rcv_saddr,
> > + sk->sk_num, msg);
> > + } else {
> > + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> > + proto, &sk->sk_rcv_saddr,
> > + sk->sk_num, msg);
>
> Minor nit, the standard format for printing addresses would be to use colon seperator before port
>
> if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
> proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
> } else {
> net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
> proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
I considered this too, though Eric suggested "IP.port" to match tcpdump.
Please let me know which advice to follow?
Jamie
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-11 23:59 ` Jamie Bainbridge
@ 2022-11-12 0:10 ` Eric Dumazet
2022-11-12 0:11 ` Stephen Hemminger
1 sibling, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2022-11-12 0:10 UTC (permalink / raw)
To: Jamie Bainbridge
Cc: Stephen Hemminger, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Fri, Nov 11, 2022 at 4:00 PM Jamie Bainbridge
<jamie.bainbridge@gmail.com> wrote:
>
> On Sat, 12 Nov 2022 at 04:20, Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Fri, 11 Nov 2022 14:59:32 +1100
> > Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> >
> > > + xchg(&queue->synflood_warned, 1) == 0) {
> > > + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> > > + proto, &sk->sk_v6_rcv_saddr,
> > > + sk->sk_num, msg);
> > > + } else {
> > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> > > + proto, &sk->sk_rcv_saddr,
> > > + sk->sk_num, msg);
> >
> > Minor nit, the standard format for printing addresses would be to use colon seperator before port
> >
> > if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
> > proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
> > } else {
> > net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
> > proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
>
> I considered this too, though Eric suggested "IP.port" to match tcpdump.
>
> Please let me know which advice to follow?
IPv6 [address]:port is also a standard (and unambiguous) way.
https://www.rfc-editor.org/rfc/rfc5952#page-11
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-11 23:59 ` Jamie Bainbridge
2022-11-12 0:10 ` Eric Dumazet
@ 2022-11-12 0:11 ` Stephen Hemminger
2022-11-12 0:14 ` Eric Dumazet
1 sibling, 1 reply; 7+ messages in thread
From: Stephen Hemminger @ 2022-11-12 0:11 UTC (permalink / raw)
To: Jamie Bainbridge
Cc: Eric Dumazet, David S. Miller, Hideaki YOSHIFUJI, David Ahern,
Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Sat, 12 Nov 2022 10:59:52 +1100
Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> On Sat, 12 Nov 2022 at 04:20, Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Fri, 11 Nov 2022 14:59:32 +1100
> > Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> >
> > > + xchg(&queue->synflood_warned, 1) == 0) {
> > > + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> > > + proto, &sk->sk_v6_rcv_saddr,
> > > + sk->sk_num, msg);
> > > + } else {
> > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> > > + proto, &sk->sk_rcv_saddr,
> > > + sk->sk_num, msg);
> >
> > Minor nit, the standard format for printing addresses would be to use colon seperator before port
> >
> > if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
> > proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
> > } else {
> > net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
> > proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
>
> I considered this too, though Eric suggested "IP.port" to match tcpdump.
That works, if it happens I doubt it matters.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-12 0:11 ` Stephen Hemminger
@ 2022-11-12 0:14 ` Eric Dumazet
2022-11-14 0:37 ` Jamie Bainbridge
0 siblings, 1 reply; 7+ messages in thread
From: Eric Dumazet @ 2022-11-12 0:14 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Jamie Bainbridge, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Fri, Nov 11, 2022 at 4:11 PM Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Sat, 12 Nov 2022 10:59:52 +1100
> Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
>
> > On Sat, 12 Nov 2022 at 04:20, Stephen Hemminger
> > <stephen@networkplumber.org> wrote:
> > >
> > > On Fri, 11 Nov 2022 14:59:32 +1100
> > > Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> > >
> > > > + xchg(&queue->synflood_warned, 1) == 0) {
> > > > + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> > > > + proto, &sk->sk_v6_rcv_saddr,
> > > > + sk->sk_num, msg);
> > > > + } else {
> > > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> > > > + proto, &sk->sk_rcv_saddr,
> > > > + sk->sk_num, msg);
> > >
> > > Minor nit, the standard format for printing addresses would be to use colon seperator before port
> > >
> > > if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
> > > proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
> > > } else {
> > > net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
> > > proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
> >
> > I considered this too, though Eric suggested "IP.port" to match tcpdump.
>
> That works, if it happens I doubt it matters.
Note that "ss dst" really needs the [] notation for IPv6
ss -t dst "[::1]"
State Recv-Q Send-Q
Local Address:Port Peer Address:Port
Process
CLOSE-WAIT 1 0
[::1]:50584 [::1]:ipp
So we have inconsistency anyway...
As you said, no strong opinion.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] tcp: Add listening address to SYN flood message
2022-11-12 0:14 ` Eric Dumazet
@ 2022-11-14 0:37 ` Jamie Bainbridge
0 siblings, 0 replies; 7+ messages in thread
From: Jamie Bainbridge @ 2022-11-14 0:37 UTC (permalink / raw)
To: Eric Dumazet
Cc: Stephen Hemminger, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, Jakub Kicinski, Paolo Abeni, netdev, linux-kernel
On Sat, 12 Nov 2022 at 10:14, Eric Dumazet <edumazet@google.com> wrote:
>
> On Fri, Nov 11, 2022 at 4:11 PM Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Sat, 12 Nov 2022 10:59:52 +1100
> > Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> >
> > > On Sat, 12 Nov 2022 at 04:20, Stephen Hemminger
> > > <stephen@networkplumber.org> wrote:
> > > >
> > > > On Fri, 11 Nov 2022 14:59:32 +1100
> > > > Jamie Bainbridge <jamie.bainbridge@gmail.com> wrote:
> > > >
> > > > > + xchg(&queue->synflood_warned, 1) == 0) {
> > > > > + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI6c.%u. %s.\n",
> > > > > + proto, &sk->sk_v6_rcv_saddr,
> > > > > + sk->sk_num, msg);
> > > > > + } else {
> > > > > + net_info_ratelimited("%s: Possible SYN flooding on port %pI4.%u. %s.\n",
> > > > > + proto, &sk->sk_rcv_saddr,
> > > > > + sk->sk_num, msg);
> > > >
> > > > Minor nit, the standard format for printing addresses would be to use colon seperator before port
> > > >
> > > > if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
> > > > net_info_ratelimited("%s: Possible SYN flooding on [%pI6c]:%u. %s.\n",
> > > > proto, &sk->sk_v6_rcv_saddr, sk->sk_num, msg);
> > > > } else {
> > > > net_info_ratelimited("%s: Possible SYN flooding on %pI4:%u. %s.\n",
> > > > proto, &sk->sk_rcv_saddr, sk->sk_num, msg);
> > >
> > > I considered this too, though Eric suggested "IP.port" to match tcpdump.
> >
> > That works, if it happens I doubt it matters.
>
> Note that "ss dst" really needs the [] notation for IPv6
>
> ss -t dst "[::1]"
> State Recv-Q Send-Q
> Local Address:Port Peer Address:Port
> Process
> CLOSE-WAIT 1 0
> [::1]:50584 [::1]:ipp
>
> So we have inconsistency anyway...
>
> As you said, no strong opinion.
Following an RFC and ss filter paste is a good reason, I'll do a v3.
Jamie
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-11-14 0:37 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-11 3:59 [PATCH v2] tcp: Add listening address to SYN flood message Jamie Bainbridge
2022-11-11 17:20 ` Stephen Hemminger
2022-11-11 23:59 ` Jamie Bainbridge
2022-11-12 0:10 ` Eric Dumazet
2022-11-12 0:11 ` Stephen Hemminger
2022-11-12 0:14 ` Eric Dumazet
2022-11-14 0:37 ` Jamie Bainbridge
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).