[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+mtBx8zm=VQBFiacuzU6GK8DH65fTRUGYEJZrvk4c8kzLrJCg@mail.gmail.com>
Date: Sun, 14 Aug 2011 20:20:34 -0700
From: Tom Herbert <therbert@...gle.com>
To: Eric Dumazet <eric.dumazet@...il.com>
Cc: David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()
> [PATCH] tcp: Use LIMIT_NETDEBUG in syn_flood_warning()
>
> LIMIT_NETDEBUG allows the admin to disable some warning messages :
> echo 0 > /proc/sys/net/core/warnings
>
> Use it to avoid filling syslog on busy servers.
>
> Based on a previous patch from Tom Herbert
>
> Factorize syn_flood_warning() IPv4/IPv6 implementations
>
Acked-by: Tom Herbert <therbert@...gle.coml>
> Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
> CC: Tom Herbert <therbert@...gle.com>
> ---
> include/net/tcp.h | 1 +
> net/ipv4/tcp_ipv4.c | 14 ++++++--------
> net/ipv6/tcp_ipv6.c | 17 +----------------
> 3 files changed, 8 insertions(+), 24 deletions(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 149a415..964341c 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -460,6 +460,7 @@ extern int tcp_write_wakeup(struct sock *);
> extern void tcp_send_fin(struct sock *sk);
> extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
> extern int tcp_send_synack(struct sock *);
> +extern void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto);
> extern void tcp_push_one(struct sock *, unsigned int mss_now);
> extern void tcp_send_ack(struct sock *sk);
> extern void tcp_send_delayed_ack(struct sock *sk);
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 1c12b8e..9e622da 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -808,20 +808,19 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
> kfree(inet_rsk(req)->opt);
> }
>
> -static void syn_flood_warning(const struct sk_buff *skb)
> +void tcp_syn_flood_warning(const struct sk_buff *skb, const char *proto)
> {
> - const char *msg;
> + const char *msg = "Dropping request";
>
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies)
> msg = "Sending cookies";
> - else
> #endif
> - msg = "Dropping request";
>
> - pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
> - ntohs(tcp_hdr(skb)->dest), msg);
> + LIMIT_NETDEBUG(KERN_INFO "%s: Possible SYN flooding on port %d. %s.\n",
> + proto, ntohs(tcp_hdr(skb)->dest), msg);
> }
> +EXPORT_SYMBOL(tcp_syn_flood_warning);
>
> /*
> * Save and compile IPv4 options into the request_sock if needed.
> @@ -1250,8 +1249,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
> * evidently real one.
> */
> if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> - if (net_ratelimit())
> - syn_flood_warning(skb);
> + tcp_syn_flood_warning(skb, "TCP");
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies) {
> want_cookie = 1;
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index d1fb63f..a043386 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -531,20 +531,6 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
> return tcp_v6_send_synack(sk, req, rvp);
> }
>
> -static inline void syn_flood_warning(struct sk_buff *skb)
> -{
> -#ifdef CONFIG_SYN_COOKIES
> - if (sysctl_tcp_syncookies)
> - printk(KERN_INFO
> - "TCPv6: Possible SYN flooding on port %d. "
> - "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
> - else
> -#endif
> - printk(KERN_INFO
> - "TCPv6: Possible SYN flooding on port %d. "
> - "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
> -}
> -
> static void tcp_v6_reqsk_destructor(struct request_sock *req)
> {
> kfree_skb(inet6_rsk(req)->pktopts);
> @@ -1192,8 +1178,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
> goto drop;
>
> if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> - if (net_ratelimit())
> - syn_flood_warning(skb);
> + tcp_syn_flood_warning(skb, "TCPv6");
> #ifdef CONFIG_SYN_COOKIES
> if (sysctl_tcp_syncookies)
> want_cookie = 1;
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists