netdev - Re: [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 14 Aug 2011 20:20:34 -0700
From:	Tom Herbert <therbert@...gle.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()

> [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()
>
> LIMIT_NETDEBUG allows the admin to disable some warning messages :
> echo 0 > /proc/sys/net/core/warnings
>
> Use it to avoid filling syslog on busy servers.
>
> Based on a previous patch from Tom Herbert
>
> Factorize syn_flood_warning() IPv4/IPv6 implementations
>

Acked-by: Tom Herbert <therbert@...gle.coml>

> Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
> CC: Tom Herbert <therbert@...gle.com>
> ---
>  include/net/tcp.h   |    1 +
>  net/ipv4/tcp_ipv4.c |   14 ++++++--------
>  net/ipv6/tcp_ipv6.c |   17 +----------------
>  3 files changed, 8 insertions(+), 24 deletions(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 149a415..964341c 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -460,6 +460,7 @@ extern int tcp_write_wakeup(struct sock *);
>  extern void tcp_send_fin(struct sock *sk);
>  extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
>  extern int tcp_send_synack(struct sock *);
> +extern void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto);
>  extern void tcp_push_one(struct sock *, unsigned int mss_now);
>  extern void tcp_send_ack(struct sock *sk);
>  extern void tcp_send_delayed_ack(struct sock *sk);
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 1c12b8e..9e622da 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -808,20 +808,19 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
>        kfree(inet_rsk(req)->opt);
>  }
>
> -static void syn_flood_warning(const struct sk_buff *skb)
> +void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto)
>  {
> -       const char *msg;
> +       const char *msg = "Dropping request";
>
>  #ifdef CONFIG_SYN_COOKIES
>        if (sysctl_tcp_syncookies)
>                msg = "Sending cookies";
> -       else
>  #endif
> -               msg = "Dropping request";
>
> -       pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
> -                               ntohs(tcp_hdr(skb)->dest), msg);
> +       LIMIT_NETDEBUG(KERN_INFO "%s: Possible SYN flooding on port %d. %s.\n",
> +                      proto, ntohs(tcp_hdr(skb)->dest), msg);
>  }
> +EXPORT_SYMBOL(tcp_syn_flood_warning);
>
>  /*
>  * Save and compile IPv4 options into the request_sock if needed.
> @@ -1250,8 +1249,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
>         * evidently real one.
>         */
>        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> -               if (net_ratelimit())
> -                       syn_flood_warning(skb);
> +               tcp_syn_flood_warning(skb, "TCP");
>  #ifdef CONFIG_SYN_COOKIES
>                if (sysctl_tcp_syncookies) {
>                        want_cookie = 1;
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index d1fb63f..a043386 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -531,20 +531,6 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
>        return tcp_v6_send_synack(sk, req, rvp);
>  }
>
> -static inline void syn_flood_warning(struct sk_buff *skb)
> -{
> -#ifdef CONFIG_SYN_COOKIES
> -       if (sysctl_tcp_syncookies)
> -               printk(KERN_INFO
> -                      "TCPv6: Possible SYN flooding on port %d. "
> -                      "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
> -       else
> -#endif
> -               printk(KERN_INFO
> -                      "TCPv6: Possible SYN flooding on port %d. "
> -                      "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
> -}
> -
>  static void tcp_v6_reqsk_destructor(struct request_sock *req)
>  {
>        kfree_skb(inet6_rsk(req)->pktopts);
> @@ -1192,8 +1178,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
>                goto drop;
>
>        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> -               if (net_ratelimit())
> -                       syn_flood_warning(skb);
> +               tcp_syn_flood_warning(skb, "TCPv6");
>  #ifdef CONFIG_SYN_COOKIES
>                if (sysctl_tcp_syncookies)
>                        want_cookie = 1;
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html