All of lore.kernel.org
 help / color / mirror / Atom feed
From: Franchoze Eric <franchoze@yandex.ru>
To: netdev@vger.kernel.org
Subject: why do we need printk on sending syn flood cookie?
Date: Mon, 02 Aug 2010 11:58:14 +0400	[thread overview]
Message-ID: <480391280735894@web102.yandex.ru> (raw)

 Just sirious why do we need printk each 1 second (60*HZ) about possible syn-flood? It really floods dmesg. Is there something dengerous? I have suggestion to turn off printk about sending tcp cookie each 1 second.

Something like this:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fe193e5..5574adc 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1230,8 +1230,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	__u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
 	int want_cookie = 0;
+	int want_cookie_no_warn = 0;
 #else
 #define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
+#define want_cookie_no_warn 0 
 #endif
 
 	/* Never answer to SYNs send to broadcast or multicast */
@@ -1246,7 +1248,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 #ifdef CONFIG_SYN_COOKIES
 		if (sysctl_tcp_syncookies) {
 			want_cookie = 1;
-		} else
+			if (sysctl_tcp_syncookies == 2)
+				want_cookie_no_warn = 1;
+		}
+		else
 #endif
 		goto drop;
 	}
@@ -1296,6 +1301,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_SYN_COOKIES
 		want_cookie = 0;	/* not our kind of cookie */
+		want_cookie_no_warn = 0;	/* no printk on syn flood */
 #endif
 		tmp_ext.cookie_out_never = 0; /* false */
 		tmp_ext.cookie_plus = tmp_opt.cookie_plus;
@@ -1328,7 +1334,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
 	if (want_cookie) {
 #ifdef CONFIG_SYN_COOKIES
-		syn_flood_warning(skb);
+		if (!want_cookie_no_warn)
+			syn_flood_warning(skb);
 		req->cookie_ts = tmp_opt.tstamp_ok;
 #endif
 		isn = cookie_v4_init_sequence(sk, skb, &req->mss);

             reply	other threads:[~2010-08-02  7:58 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-08-02  7:58 Franchoze Eric [this message]
2010-08-02  8:17 ` why do we need printk on sending syn flood cookie? Florian Westphal
2010-08-02 16:11   ` Franchoze Eric
2010-08-02 18:10     ` Mitchell Erblich
2010-08-02 21:14       ` Franchoze Eric
2010-08-02 22:30         ` Mitchell Erblich
2010-08-02 22:48           ` Franchoze Eric
2010-08-02 22:49           ` Mitchell Erblich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=480391280735894@web102.yandex.ru \
    --to=franchoze@yandex.ru \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.