提交 d9282e48 编写于 作者: J Jamie Bainbridge 提交者: Jakub Kicinski

tcp: Add listening address to SYN flood message

The SYN flood message prints the listening port number, but with many
processes bound to the same port on different IPs, it's impossible to
tell which socket is the problem.

Add the listen IP address to the SYN flood message.

For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
copy-paste to "ss" filters. For IPv4 use "IP:port" to match.

Each protcol's "any" address and a host address now look like:

 Possible SYN flooding on port 0.0.0.0:9001.
 Possible SYN flooding on port 127.0.0.1:9001.
 Possible SYN flooding on port [::]:9001.
 Possible SYN flooding on port [fc00::1]:9001.
Signed-off-by: NJamie Bainbridge <jamie.bainbridge@gmail.com>
Reviewed-by: NEric Dumazet <edumazet@google.com>
Reviewed-by: NStephen Hemminger <stephen@networkplumber.org>
Link: https://lore.kernel.org/r/4fedab7ce54a389aeadbdc639f6b4f4988e9d2d7.1668386107.git.jamie.bainbridge@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
上级 feba6c67
......@@ -6842,9 +6842,17 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
if (!queue->synflood_warned && syncookies != 2 &&
xchg(&queue->synflood_warned, 1) == 0)
net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
proto, sk->sk_num, msg);
xchg(&queue->synflood_warned, 1) == 0) {
if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
net_info_ratelimited("%s: Possible SYN flooding on port [%pI6c]:%u. %s.\n",
proto, &sk->sk_v6_rcv_saddr,
sk->sk_num, msg);
} else {
net_info_ratelimited("%s: Possible SYN flooding on port %pI4:%u. %s.\n",
proto, &sk->sk_rcv_saddr,
sk->sk_num, msg);
}
}
return want_cookie;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册