內(nèi)核打印限速函數(shù)net_ratelimit()使用說明_Linux教程
本文主要介紹內(nèi)核打印限速函數(shù)net_ratelimit()的使用說明:
1) net_ratelimit()用于保護(hù)內(nèi)核網(wǎng)絡(luò)調(diào)試信息的打印, 當(dāng)它返回(TRUE)時(shí)則可以打印調(diào)試信息,返回零則禁止信息打印. 它的特性為當(dāng)"極快地"調(diào)用net_ratelimit()時(shí),它最多只允許連續(xù)打印前10條信息, 后繼信息每隔5秒允許打印一次.這樣可防止攻擊者使內(nèi)核不斷產(chǎn)生調(diào)試信息來使系統(tǒng)過載的拒絕服務(wù)攻擊.2) net_ratelimit()定義了一個(gè)時(shí)間計(jì)數(shù)器變量(toks), 它隨著系統(tǒng)時(shí)鐘計(jì)數(shù)線性增長,但不超時(shí)50秒時(shí)鐘計(jì)數(shù)(net_msg_burst). 當(dāng)計(jì)時(shí)器的值大于或等于5秒時(shí)鐘計(jì)數(shù)(net_msg_cost)時(shí),則允許打印信息. 每允許打印一條信息, 計(jì)時(shí)器就減去5秒計(jì)數(shù), 當(dāng)計(jì)時(shí)器的值小于5秒時(shí), 就不允許打印信息了.; net/core/utils.c:
int net_msg_cost = 5*HZ; /*在擁塞時(shí), 每條網(wǎng)絡(luò)消息記錄所間隔的時(shí)間*/
int net_msg_burst = 10*5*HZ; /*連續(xù)記錄網(wǎng)絡(luò)突發(fā)消息的間隔(最多連續(xù)記錄10條消息)*/
/*
* This enforces a rate limit: not more than one kernel message
* every 5secs to make a denial-of-service attack impossible.
*
* All warning printk()s should be guarded by this function.
*/
int net_ratelimit(void)
{
static spinlock_t ratelimit_lock = SPIN_LOCK_UNLOCKED;
static unsigned long toks = 10*5*HZ; /*50秒量程的計(jì)時(shí)器,每打印一條消息,計(jì)時(shí)器減5秒時(shí)間*/
static unsigned long last_msg; /*上一次調(diào)用net_ratelimit()的時(shí)戳*/
static int missed; /*兩次net_ratelimit()調(diào)用之間所丟棄的信息數(shù)量*/
unsigned long flags;
unsigned long now = jiffies; /*取當(dāng)前時(shí)戳*/
spin_lock_irqsave(&ratelimit_lock, flags);
toks += now - last_msg;
/*計(jì)時(shí)器加上兩次net_ratelimit()調(diào)用的時(shí)間差,表現(xiàn)為計(jì)時(shí)時(shí)間的線性增長*/
last_msg = now;
if (toks > net_msg_burst) /*計(jì)時(shí)器累積時(shí)間超時(shí)50秒時(shí)*/
toks = net_msg_burst;/* 設(shè)置計(jì)時(shí)上限*/
if (toks >= net_msg_cost) { /*當(dāng)計(jì)時(shí)大于或等于5秒時(shí)可以打印信息*/
int lost = missed;
missed = 0;
toks -= net_msg_cost; /*減去5秒時(shí)間*/
spin_unlock_irqrestore(&ratelimit_lock, flags);
if (lost)
printk(KERN_WARNING "NET: %d messages suppressed.\n", lost);
return 1;
}
missed++;
spin_unlock_irqrestore(&ratelimit_lock, flags);
return 0;
}
/*linux 2.6內(nèi)核直接調(diào)用__printk_ratelimit()*/
int net_ratelimit(void)
{
return __printk_ratelimit(net_msg_cost, net_msg_burst);
}
kernel/printk.c
/*
* printk rate limiting, lifted from the networking subsystem.
*
* This enforces a rate limit: not more than one kernel message
* every printk_ratelimit_jiffies to make a denial-of-service
* attack impossible.
*/
int __printk_ratelimit(int ratelimit_jiffies, int ratelimit_burst)
{
static DEFINE_SPINLOCK(ratelimit_lock);
static unsigned long toks = 10 * 5 * HZ;
static unsigned long last_msg;
static int missed;
unsigned long flags;
unsigned long now = jiffies;
spin_lock_irqsave(&ratelimit_lock, flags);
toks += now - last_msg;
last_msg = now;
if (toks > (ratelimit_burst * ratelimit_jiffies))
toks = ratelimit_burst * ratelimit_jiffies;
if (toks >= ratelimit_jiffies) {
int lost = mis
sed;
missed = 0;
toks -= ratelimit_jiffies;
spin_unlock_irqrestore(&ratelimit_lock, flags);
if (lost)
printk(KERN_WARNING "printk: %d messages suppressed.\n", lost);
return 1;
}
missed++;
spin_unlock_irqrestore(&ratelimit_lock, flags);
return 0;
}
- Linux系統(tǒng)下TOP命令使用與分析詳解
- 安裝Linux我們需要改變20件事情
- 使用Linux系統(tǒng)架設(shè)VSFTP服務(wù)器
- Linux系統(tǒng)上架設(shè)POP3服務(wù)器
- Linux中“Networking Disabled”的解決方法(解決Ubuntu等系統(tǒng)無法上網(wǎng))
- ubuntu系統(tǒng)清理磁盤教程
- linux下搭建pxe自動(dòng)化安裝環(huán)境
- BIOS不支持導(dǎo)致Linux內(nèi)核耗電增加
- Debian GNU/Linux系統(tǒng)卡片
- Linux操作系統(tǒng)開機(jī)自行啟動(dòng)項(xiàng)目詳細(xì)解析
- Linux菜鳥入門級(jí)命令大全
- Linux操作系統(tǒng)中讀取目錄文件信息的過程
Linux教程Rss訂閱服務(wù)器教程搜索
Linux教程推薦
猜你也喜歡看這些
- Resin在Windows系統(tǒng)下的安裝
- Windows安全認(rèn)證是如何進(jìn)行的?[NTLM篇]
- 個(gè)人服務(wù)器架設(shè)全攻略(83)
- 授予對(duì)Web內(nèi)容的Web服務(wù)器權(quán)限
- “終端服務(wù)器超出了最大允許連接數(shù)”的解決方法匯總
- 安全維護(hù) IIS ASP 站點(diǎn)的高級(jí)技巧(5)
- 和服務(wù)器相關(guān)的幾個(gè)名詞術(shù)語
- windows2003優(yōu)化向?qū)?/a>
- Web服務(wù)器的安全和攻擊防范(9)
- 個(gè)人服務(wù)器架設(shè)全攻略(24)
- 相關(guān)鏈接:
- 教程說明:
Linux教程-內(nèi)核打印限速函數(shù)net_ratelimit()使用說明
。