From: Franchoze Eric <franchoze@yandex.ru>
To: netdev@vger.kernel.org
Subject: why do we need printk on sending syn flood cookie?
Date: Mon, 02 Aug 2010 11:58:14 +0400 [thread overview]
Message-ID: <480391280735894@web102.yandex.ru> (raw)
Just sirious why do we need printk each 1 second (60*HZ) about possible syn-flood? It really floods dmesg. Is there something dengerous? I have suggestion to turn off printk about sending tcp cookie each 1 second.
Something like this:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fe193e5..5574adc 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1230,8 +1230,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
__u32 isn = TCP_SKB_CB(skb)->when;
#ifdef CONFIG_SYN_COOKIES
int want_cookie = 0;
+ int want_cookie_no_warn = 0;
#else
#define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
+#define want_cookie_no_warn 0
#endif
/* Never answer to SYNs send to broadcast or multicast */
@@ -1246,7 +1248,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
#ifdef CONFIG_SYN_COOKIES
if (sysctl_tcp_syncookies) {
want_cookie = 1;
- } else
+ if (sysctl_tcp_syncookies == 2)
+ want_cookie_no_warn = 1;
+ }
+ else
#endif
goto drop;
}
@@ -1296,6 +1301,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
#ifdef CONFIG_SYN_COOKIES
want_cookie = 0; /* not our kind of cookie */
+ want_cookie_no_warn = 0; /* no printk on syn flood */
#endif
tmp_ext.cookie_out_never = 0; /* false */
tmp_ext.cookie_plus = tmp_opt.cookie_plus;
@@ -1328,7 +1334,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
if (want_cookie) {
#ifdef CONFIG_SYN_COOKIES
- syn_flood_warning(skb);
+ if (!want_cookie_no_warn)
+ syn_flood_warning(skb);
req->cookie_ts = tmp_opt.tstamp_ok;
#endif
isn = cookie_v4_init_sequence(sk, skb, &req->mss);
next reply other threads:[~2010-08-02 7:58 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-08-02 7:58 Franchoze Eric [this message]
2010-08-02 8:17 ` why do we need printk on sending syn flood cookie? Florian Westphal
2010-08-02 16:11 ` Franchoze Eric
2010-08-02 18:10 ` Mitchell Erblich
2010-08-02 21:14 ` Franchoze Eric
2010-08-02 22:30 ` Mitchell Erblich
2010-08-02 22:48 ` Franchoze Eric
2010-08-02 22:49 ` Mitchell Erblich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=480391280735894@web102.yandex.ru \
--to=franchoze@yandex.ru \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.