From: Tom Herbert <therbert@google.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David Miller <davem@davemloft.net>, netdev@vger.kernel.org
Subject: Re: [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()
Date: Sun, 14 Aug 2011 20:20:34 -0700 [thread overview]
Message-ID: <CA+mtBx8zm=VQBFiacuzU6GK8DH65fTRUGYEJZrvk4c8kzLrJCg@mail.gmail.com> (raw)
In-Reply-To: <1313129310.2669.19.camel@edumazet-laptop>
> [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()
>
> LIMIT_NETDEBUG allows the admin to disable some warning messages :
> echo 0 > /proc/sys/net/core/warnings
>
> Use it to avoid filling syslog on busy servers.
>
> Based on a previous patch from Tom Herbert
>
> Factorize syn_flood_warning() IPv4/IPv6 implementations
>
Acked-by: Tom Herbert <therbert@google.coml>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> CC: Tom Herbert <therbert@google.com>
> ---
> include/net/tcp.h | 1 +
> net/ipv4/tcp_ipv4.c | 14 ++++++--------
> net/ipv6/tcp_ipv6.c | 17 +----------------
> 3 files changed, 8 insertions(+), 24 deletions(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 149a415..964341c 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -460,6 +460,7 @@ extern int tcp_write_wakeup(struct sock *);
> extern void tcp_send_fin(struct sock *sk);
> extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
> extern int tcp_send_synack(struct sock *);
> +extern void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto);
> extern void tcp_push_one(struct sock *, unsigned int mss_now);
> extern void tcp_send_ack(struct sock *sk);
> extern void tcp_send_delayed_ack(struct sock *sk);
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 1c12b8e..9e622da 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -808,20 +808,19 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
> kfree(inet_rsk(req)->opt);
> }
>
> -static void syn_flood_warning(const struct sk_buff *skb)
> +void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto)
> {
> - const char *msg;
> + const char *msg = "Dropping request";
>
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies)
> msg = "Sending cookies";
> - else
> #endif
> - msg = "Dropping request";
>
> - pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
> - ntohs(tcp_hdr(skb)->dest), msg);
> + LIMIT_NETDEBUG(KERN_INFO "%s: Possible SYN flooding on port %d. %s.\n",
> + proto, ntohs(tcp_hdr(skb)->dest), msg);
> }
> +EXPORT_SYMBOL(tcp_syn_flood_warning);
>
> /*
> * Save and compile IPv4 options into the request_sock if needed.
> @@ -1250,8 +1249,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
> * evidently real one.
> */
> if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> - if (net_ratelimit())
> - syn_flood_warning(skb);
> + tcp_syn_flood_warning(skb, "TCP");
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies) {
> want_cookie = 1;
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index d1fb63f..a043386 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -531,20 +531,6 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
> return tcp_v6_send_synack(sk, req, rvp);
> }
>
> -static inline void syn_flood_warning(struct sk_buff *skb)
> -{
> -#ifdef CONFIG_SYN_COOKIES
> - if (sysctl_tcp_syncookies)
> - printk(KERN_INFO
> - "TCPv6: Possible SYN flooding on port %d. "
> - "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
> - else
> -#endif
> - printk(KERN_INFO
> - "TCPv6: Possible SYN flooding on port %d. "
> - "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
> -}
> -
> static void tcp_v6_reqsk_destructor(struct request_sock *req)
> {
> kfree_skb(inet6_rsk(req)->pktopts);
> @@ -1192,8 +1178,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
> goto drop;
>
> if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> - if (net_ratelimit())
> - syn_flood_warning(skb);
> + tcp_syn_flood_warning(skb, "TCPv6");
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies)
> want_cookie = 1;
>
>
>
next prev parent reply other threads:[~2011-08-15 3:20 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-11 5:38 [RFC PATCH] tcp: Replace possible syn attack msg by counters Tom Herbert
2011-08-11 6:13 ` David Miller
2011-08-11 6:33 ` Eric Dumazet
2011-08-12 6:08 ` [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning() Eric Dumazet
2011-08-15 3:20 ` Tom Herbert [this message]
2011-08-15 6:39 ` David Miller
2011-08-30 13:21 ` [PATCH v2] tcp: Change possible SYN flooding messages Eric Dumazet
2011-09-15 19:06 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CA+mtBx8zm=VQBFiacuzU6GK8DH65fTRUGYEJZrvk4c8kzLrJCg@mail.gmail.com' \
--to=therbert@google.com \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).