Commit d9282e48 authored Nov 14, 2022 by Jamie Bainbridge Committed by Jakub Kicinski Nov 14, 2022

tcp: Add listening address to SYN flood message



The SYN flood message prints the listening port number, but with many
processes bound to the same port on different IPs, it's impossible to
tell which socket is the problem.

Add the listen IP address to the SYN flood message.

For IPv6 use "[IP]:port" as per RFC-5952 and to provide ease of
copy-paste to "ss" filters. For IPv4 use "IP:port" to match.

Each protcol's "any" address and a host address now look like:

 Possible SYN flooding on port 0.0.0.0:9001.
 Possible SYN flooding on port 127.0.0.1:9001.
 Possible SYN flooding on port [::]:9001.
 Possible SYN flooding on port [fc00::1]:9001.

Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Link: https://lore.kernel.org/r/4fedab7ce54a389aeadbdc639f6b4f4988e9d2d7.1668386107.git.jamie.bainbridge@gmail.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent feba6c67

net/ipv4/tcp_input.c

+11 −3

Original line number	Diff line number	Diff line
		@@ -6842,9 +6842,17 @@ static bool tcp_syn_flood_action(const struct sock sk, const char proto)
		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);

		if (!queue->synflood_warned && syncookies != 2 &&
		xchg(&queue->synflood_warned, 1) == 0)
		net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
		proto, sk->sk_num, msg);
		xchg(&queue->synflood_warned, 1) == 0) {
		if (IS_ENABLED(CONFIG_IPV6) && sk->sk_family == AF_INET6) {
		net_info_ratelimited("%s: Possible SYN flooding on port [%pI6c]:%u. %s.\n",
		proto, &sk->sk_v6_rcv_saddr,
		sk->sk_num, msg);
		} else {
		net_info_ratelimited("%s: Possible SYN flooding on port %pI4:%u. %s.\n",
		proto, &sk->sk_rcv_saddr,
		sk->sk_num, msg);
		}
		}

		return want_cookie;
		}