Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758733AbYLPT70 (ORCPT ); Tue, 16 Dec 2008 14:59:26 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753549AbYLPT7L (ORCPT ); Tue, 16 Dec 2008 14:59:11 -0500 Received: from smtp-in.kfki.hu ([148.6.0.28]:56160 "EHLO smtp2.kfki.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752308AbYLPT7J (ORCPT ); Tue, 16 Dec 2008 14:59:09 -0500 Date: Tue, 16 Dec 2008 20:59:05 +0100 (CET) From: Jozsef Kadlecsik To: Dave Jones cc: Jan Engelhardt , David Miller , ajax@redhat.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy Subject: Re: [PATCH] net: Remove a noisy printk In-Reply-To: <20081214200353.GA2994@redhat.com> Message-ID: References: <1229033625-30825-1-git-send-email-ajax@redhat.com> <20081211.203243.124017657.davem@davemloft.net> <20081214200353.GA2994@redhat.com> User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2130 Lines: 48 On Sun, 14 Dec 2008, Dave Jones wrote: > On Sun, Dec 14, 2008 at 06:09:17PM +0100, Jozsef Kadlecsik wrote: > > > > >> @@ -147,8 +147,6 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum, > > > >> /* root is playing with raw sockets. */ > > > >> if (skb->len < sizeof(struct iphdr) || > > > >> ip_hdrlen(skb) < sizeof(struct iphdr)) { > > > >> - if (net_ratelimit()) > > > >> - printk("ipt_hook: happy cracking.\n"); > > > >> return NF_ACCEPT; > > > >> } > > > >> return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb); > > > > > > I think this change is ok. > > > > In a >normal< system one usually does not use raw sockets. So if a root > > process do use raw socket, at least netfilter sends a notification and > > there's a chance that someone take notice it by checking the kernel logs. > > 'normal' systems are irrelevant here. This message is triggerable remotely. > Even though it's ratelimited, anyone can flood another boxes logs by > sending enough packets. The packets in question are shorter than the IP header. How would those be delivered to the host? On the LAN it might be possible to forge such packets with proper HW address and be delivered. But wouldn't the network card or the stack itself throw away the packets?? > The message is also utterly useless. What kind of action would you take > to a few gigabytes of "ipt_hook: happy cracking.\n" ? > There's no IP address logged, or any other useful information. As the packet is shorter than the IP header, what could be logged, besides the fact that something worth to investigate is happening? Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/