From patchwork Tue Dec 16 20:00:12 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Engelhardt X-Patchwork-Id: 14326 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 1467DDDF58 for ; Wed, 17 Dec 2008 07:00:24 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752613AbYLPUAQ (ORCPT ); Tue, 16 Dec 2008 15:00:16 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752858AbYLPUAQ (ORCPT ); Tue, 16 Dec 2008 15:00:16 -0500 Received: from sovereign.computergmbh.de ([85.214.69.204]:57077 "EHLO sovereign.computergmbh.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752303AbYLPUAO (ORCPT ); Tue, 16 Dec 2008 15:00:14 -0500 Received: by sovereign.computergmbh.de (Postfix, from userid 25121) id A887D1811DF56; Tue, 16 Dec 2008 21:00:12 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by sovereign.computergmbh.de (Postfix) with ESMTP id A65E61C3DE709; Tue, 16 Dec 2008 21:00:12 +0100 (CET) Date: Tue, 16 Dec 2008 21:00:12 +0100 (CET) From: Jan Engelhardt To: Dave Jones cc: Jozsef Kadlecsik , David Miller , ajax@redhat.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy Subject: Re: [PATCH] net: Remove a noisy printk In-Reply-To: <20081214200353.GA2994@redhat.com> Message-ID: References: <1229033625-30825-1-git-send-email-ajax@redhat.com> <20081211.203243.124017657.davem@davemloft.net> <20081214200353.GA2994@redhat.com> User-Agent: Alpine 1.10 (LNX 962 2008-03-14) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Sunday 2008-12-14 21:03, Dave Jones wrote: > > > >> @@ -147,8 +147,6 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum, > > > >> /* root is playing with raw sockets. */ > > > >> if (skb->len < sizeof(struct iphdr) || > > > >> ip_hdrlen(skb) < sizeof(struct iphdr)) { > > > >> - if (net_ratelimit()) > > > >> - printk("ipt_hook: happy cracking.\n"); > > > >> return NF_ACCEPT; > > > >> } > > > >> return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb); > > > > > > I think this change is ok. > > > > In a >normal< system one usually does not use raw sockets. So if > > a root process do use raw socket, at least netfilter sends a > > notification and there's a chance that someone take notice it by > > checking the kernel logs. > >'normal' systems are irrelevant here. This message is triggerable remotely. >Even though it's ratelimited, anyone can flood another boxes logs by >sending enough packets. > >The message is also utterly useless. What kind of action would you take >to a few gigabytes of "ipt_hook: happy cracking.\n" ? >There's no IP address logged, or any other useful information. Here is a patch that attempts silence both the fraction that wants to keep the printk and those to get rid of it. It trips up on the bloatmeters, though. (No, this patch is not serious, but should give you some thinking as to why the printk is in there at all.) --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index 4a7c352..ac72770 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -27,6 +27,9 @@ #include #include +static unsigned int happy_cracking; +module_param(happy_cracking, bool, S_IRUGO | S_IWUSR); + int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo); @@ -147,7 +150,7 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum, /* root is playing with raw sockets. */ if (skb->len < sizeof(struct iphdr) || ip_hdrlen(skb) < sizeof(struct iphdr)) { - if (net_ratelimit()) + if (happy_cracking && net_ratelimit()) printk("ipt_hook: happy cracking.\n"); return NF_ACCEPT; }