History

tcp: Change possible SYN flooding messages

"Possible SYN flooding on port xxxx " messages can fill logs on servers. Change logic to log the message only once per listener, and add two new SNMP counters to track : TCPReqQFullDoCookies : number of times a SYNCOOKIE was replied to client TCPReqQFullDrop : number of times a SYN request was dropped because syncookies were not enabled. Based on a prior patch from Tom Herbert, and suggestions from David.

Eric Dumazet committed 15 years ago

Commit 946cedc1 parent 27e95a86 files · +40 −50Browse files

Showing the changes to include (3 of 6 files). Show all

Unified · Split

3 files
  1. include/linux/snmp.h +2 −0
  2. include/net/request_sock.h +2 −1
  3. include/net/tcp.h +3 −0
include/linux/snmp.h+2−0
@@ -231,6 +231,8 @@ enum · 230 unmodified lines
231231 LINUX_MIB_TCPDEFERACCEPTDROP,
232232 LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */
233233 LINUX_MIB_TCPTIMEWAITOVERFLOW, /* TCPTimeWaitOverflow */
234+ LINUX_MIB_TCPREQQFULLDOCOOKIES, /* TCPReqQFullDoCookies */
235+ LINUX_MIB_TCPREQQFULLDROP, /* TCPReqQFullDrop */
234236 __LINUX_MIB_MAX
235237 };
236238
include/net/request_sock.h+2−1
@@ -96,7 +96,8 @@ extern int sysctl_max_syn_backlog; · 95 unmodified lines
9696 */
9797 struct listen_sock {
9898 u8 max_qlen_log;
99− /* 3 bytes hole, try to use */
99+ u8 synflood_warned;
100+ /* 2 bytes hole, try to use */
100101 int qlen;
101102 int qlen_young;
102103 int clock_hand;
include/net/tcp.h+3−0
@@ -460,6 +460,9 @@ extern int tcp_write_wakeup(struct sock *); · 459 unmodified lines
460460 extern void tcp_send_fin(struct sock *sk);
461461 extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
462462 extern int tcp_send_synack(struct sock *);
463+extern int tcp_syn_flood_action(struct sock *sk,
464+ const struct sk_buff *skb,
465+ const char *proto);
463466 extern void tcp_push_one(struct sock *, unsigned int mss_now);
464467 extern void tcp_send_ack(struct sock *sk);
465468 extern void tcp_send_delayed_ack(struct sock *sk);