diff mbox series

[v3] tcp: Add listening address to SYN flood message

Message ID 4fedab7ce54a389aeadbdc639f6b4f4988e9d2d7.1668386107.git.jamie.bainbridge@gmail.com
State New
Headers
Series [v3] tcp: Add listening address to SYN flood message |

Commit Message

Jamie Bainbridge Nov. 14, 2022, 1 a.m. UTC 
  The SYN flood message prints the listening port number, but with many
processes bound to the same port on different IPs, it's impossible to
tell which socket is the problem.

Add the listen IP address to the SYN flood message.

For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
copy-paste to "ss" filters. For IPv4 use "IP:port" to match.

Each protcol's "any" address and a host address now look like:

 Possible SYN flooding on port 0.0.0.0:9001.
 Possible SYN flooding on port 127.0.0.1:9001.
 Possible SYN flooding on port [::]:9001.
 Possible SYN flooding on port [fc00::1]:9001.

Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
---
v2: Place IS_ENABLED() inside if condition c/o Andrew Lunn.
    Change port printf to unsigned c/o Stephen Hemminger.
    Remove long and unhelpful "Check SNMP counters" c/o Stephen H.
v3: Use "IP:port" format c/o Eric Duamzet and Stephen H.
---
 net/ipv4/tcp_input.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

Comments

Eric Dumazet Nov. 14, 2022, 5:31 p.m. UTC | #1 
On Sun, Nov 13, 2022 at 5:00 PM Jamie Bainbridge
<jamie.bainbridge@gmail.com> wrote:
>
> The SYN flood message prints the listening port number, but with many
> processes bound to the same port on different IPs, it's impossible to
> tell which socket is the problem.
>
> Add the listen IP address to the SYN flood message.
>
> For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
> copy-paste to "ss" filters. For IPv4 use "IP:port" to match.
>
> Each protcol's "any" address and a host address now look like:
>
>  Possible SYN flooding on port 0.0.0.0:9001.
>  Possible SYN flooding on port 127.0.0.1:9001.
>  Possible SYN flooding on port [::]:9001.
>  Possible SYN flooding on port [fc00::1]:9001.
>
> Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
> ---

Reviewed-by: Eric Dumazet <edumazet@google.com>
Stephen Hemminger Nov. 15, 2022, 2:02 a.m. UTC | #2 
On Mon, 14 Nov 2022 09:31:38 -0800
Eric Dumazet <edumazet@google.com> wrote:

> On Sun, Nov 13, 2022 at 5:00 PM Jamie Bainbridge
> <jamie.bainbridge@gmail.com> wrote:
> >
> > The SYN flood message prints the listening port number, but with many
> > processes bound to the same port on different IPs, it's impossible to
> > tell which socket is the problem.
> >
> > Add the listen IP address to the SYN flood message.
> >
> > For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
> > copy-paste to "ss" filters. For IPv4 use "IP:port" to match.
> >
> > Each protcol's "any" address and a host address now look like:
> >
> >  Possible SYN flooding on port 0.0.0.0:9001.
> >  Possible SYN flooding on port 127.0.0.1:9001.
> >  Possible SYN flooding on port [::]:9001.
> >  Possible SYN flooding on port [fc00::1]:9001.
> >
> > Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
> > ---  
> 
> Reviewed-by: Eric Dumazet <edumazet@google.com>

Thanks for cleaning this up.
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
patchwork-bot+netdevbpf@kernel.org Nov. 15, 2022, 5:40 a.m. UTC | #3 
Hello:

This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 14 Nov 2022 12:00:08 +1100 you wrote:
> The SYN flood message prints the listening port number, but with many
> processes bound to the same port on different IPs, it's impossible to
> tell which socket is the problem.
> 
> Add the listen IP address to the SYN flood message.
> 
> For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
> copy-paste to "ss" filters. For IPv4 use "IP:port" to match.
> 
> [...]

Here is the summary with links:
  - [v3] tcp: Add listening address to SYN flood message
    https://git.kernel.org/netdev/net-next/c/d9282e48c608

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0640453fce54b6daae0861d948f3db075830daf6..6e51d8eefe19075721ec6d31036ecae9b6e0d698 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6831,9 +6831,17 @@  static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
 
 	if (!queue->synflood_warned && syncookies != 2 &&
-	    xchg(&queue->synflood_warned, 1) == 0)
-		net_info_ratelimited("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
-				     proto, sk->sk_num, msg);
+	    xchg(&queue->synflood_warned, 1) == 0) {
+		if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
+			net_info_ratelimited("%s: Possible SYN flooding on port [%pI6c]:%u. %s.\n",
+					proto, &sk->sk_v6_rcv_saddr,
+					sk->sk_num, msg);
+		} else {
+			net_info_ratelimited("%s: Possible SYN flooding on port %pI4:%u. %s.\n",
+					proto, &sk->sk_rcv_saddr,
+					sk->sk_num, msg);
+		}
+	}
 
 	return want_cookie;
 }