netdev - Re: [PATCH net-next] tcp: rate limit synflood warnings further

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAF=yD-Jv-0ngeAr5w_6FSygojfe2vh0cTOsDR=CYrCir254USg@mail.gmail.com>
Date:   Wed, 12 Sep 2018 09:39:42 -0400
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     David Miller <davem@...emloft.net>
Cc:     Network Development <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net-next] tcp: rate limit synflood warnings further

On Wed, Sep 12, 2018 at 2:35 AM David Miller <davem@...emloft.net> wrote:
>
> From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
> Date: Sun,  9 Sep 2018 19:12:12 -0400
>
> > From: Willem de Bruijn <willemb@...gle.com>
> >
> > Convert pr_info to net_info_ratelimited to limit the total number of
> > synflood warnings.
> >
> > Commit 946cedccbd73 ("tcp: Change possible SYN flooding messages")
> > rate limits synflood warnings to one per listener.
> >
> > Workloads that open many listener sockets can still see a high rate of
> > log messages. Syzkaller is one frequent example.
> >
> > Signed-off-by: Willem de Bruijn <willemb@...gle.com>
>
> Applied, thanks Willem.
>
> Is this stable material?

Thanks. Probably not. A process has to keep opening new listeners
at high rate while under load. I've only seen syzkaller do that.