Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758421AbYLPTnS (ORCPT ); Tue, 16 Dec 2008 14:43:18 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753585AbYLPTm6 (ORCPT ); Tue, 16 Dec 2008 14:42:58 -0500 Received: from mx2.redhat.com ([66.187.237.31]:37110 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751344AbYLPTm4 (ORCPT ); Tue, 16 Dec 2008 14:42:56 -0500 Date: Sun, 14 Dec 2008 15:03:53 -0500 From: Dave Jones To: Jozsef Kadlecsik Cc: Jan Engelhardt , David Miller , ajax@redhat.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy Subject: Re: [PATCH] net: Remove a noisy printk Message-ID: <20081214200353.GA2994@redhat.com> Mail-Followup-To: Dave Jones , Jozsef Kadlecsik , Jan Engelhardt , David Miller , ajax@redhat.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy References: <1229033625-30825-1-git-send-email-ajax@redhat.com> <20081211.203243.124017657.davem@davemloft.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1423 Lines: 35 On Sun, Dec 14, 2008 at 06:09:17PM +0100, Jozsef Kadlecsik wrote: > > >> @@ -147,8 +147,6 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum, > > >> /* root is playing with raw sockets. */ > > >> if (skb->len < sizeof(struct iphdr) || > > >> ip_hdrlen(skb) < sizeof(struct iphdr)) { > > >> - if (net_ratelimit()) > > >> - printk("ipt_hook: happy cracking.\n"); > > >> return NF_ACCEPT; > > >> } > > >> return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb); > > > > I think this change is ok. > > In a >normal< system one usually does not use raw sockets. So if a root > process do use raw socket, at least netfilter sends a notification and > there's a chance that someone take notice it by checking the kernel logs. 'normal' systems are irrelevant here. This message is triggerable remotely. Even though it's ratelimited, anyone can flood another boxes logs by sending enough packets. The message is also utterly useless. What kind of action would you take to a few gigabytes of "ipt_hook: happy cracking.\n" ? There's no IP address logged, or any other useful information. Dave -- http://www.codemonkey.org.uk -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/