History

tcp: Change possible SYN flooding messages

"Possible SYN flooding on port xxxx " messages can fill logs on servers. Change logic to log the message only once per listener, and add two new SNMP counters to track : TCPReqQFullDoCookies : number of times a SYNCOOKIE was replied to client TCPReqQFullDrop : number of times a SYN request was dropped because syncookies were not enabled. Based on a prior patch from Tom Herbert, and suggestions from David.

Eric Dumazet committed 15 years ago

Commit 946cedc1 parent 27e95a86 files · +40 −50Browse files

Showing the changes to include (3 of 6 files). Show all

Unified · Split

3 files
  1. include/linux/snmp.h +2 −0
  2. include/net/request_sock.h +2 −1
  3. include/net/tcp.h +3 −0
include/linux/snmp.h+2−0
@@ -231,6 +231,8 @@ enum · 230 unmodified lines
231 LINUX_MIB_TCPDEFERACCEPTDROP,231 LINUX_MIB_TCPDEFERACCEPTDROP,
232 LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */232 LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */
233 LINUX_MIB_TCPTIMEWAITOVERFLOW, /* TCPTimeWaitOverflow */233 LINUX_MIB_TCPTIMEWAITOVERFLOW, /* TCPTimeWaitOverflow */
234 LINUX_MIB_TCPREQQFULLDOCOOKIES, /* TCPReqQFullDoCookies */
235 LINUX_MIB_TCPREQQFULLDROP, /* TCPReqQFullDrop */
234 __LINUX_MIB_MAX236 __LINUX_MIB_MAX
235};237};
236 238
include/net/request_sock.h+2−1
@@ -96,7 +96,8 @@ extern int sysctl_max_syn_backlog; · 95 unmodified lines
96 */96 */
97struct listen_sock {97struct listen_sock {
98 u8 max_qlen_log;98 u8 max_qlen_log;
99 /* 3 bytes hole, try to use */99 u8 synflood_warned;
100 /* 2 bytes hole, try to use */
100 int qlen;101 int qlen;
101 int qlen_young;102 int qlen_young;
102 int clock_hand;103 int clock_hand;
include/net/tcp.h+3−0
@@ -460,6 +460,9 @@ extern int tcp_write_wakeup(struct sock *); · 459 unmodified lines
460extern void tcp_send_fin(struct sock *sk);460extern void tcp_send_fin(struct sock *sk);
461extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);461extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
462extern int tcp_send_synack(struct sock *);462extern int tcp_send_synack(struct sock *);
463extern int tcp_syn_flood_action(struct sock *sk,
464 const struct sk_buff *skb,
465 const char *proto);
463extern void tcp_push_one(struct sock *, unsigned int mss_now);466extern void tcp_push_one(struct sock *, unsigned int mss_now);
464extern void tcp_send_ack(struct sock *sk);467extern void tcp_send_ack(struct sock *sk);
465extern void tcp_send_delayed_ack(struct sock *sk);468extern void tcp_send_delayed_ack(struct sock *sk);