DHCP DoS Logger for DHCP DoS Mitigation Feature #18947
Conversation
asraza07
changed the title
| logger.log_info(f"Port {port}: Current DHCP drop counter is {dropped_count}") | ||
| drop_pkts[port] = dropped_count | ||
| else: | ||
| logger.log_warning(f"No new dropped packets found on port {port}") |
There was a problem hiding this comment.
Why no dropped packets (Line 47 and line 49 log_warning) is treated as abnormal but dropped packets is treated as expected(line 44 log_info)? With this logic, whether actual DHCP packet rate low than tc rate treated as abnormal?
There was a problem hiding this comment.
Hi @yaqiangz , thanks for pointing that out. I have fixed this in the code. The systemd process will only log when dropped packets are observed, and it will do so as a warning, not as info.
|
Hi @qiluo-msft can you pls help review and merged this PR. HLD is merged. |
|
@qiluo-msft pls help merge this one |
|
@qiluo-msft please help review this PR |
|
|
||
| # Main handler function | ||
| def handler(): | ||
| """ |
There was a problem hiding this comment.
Could you add test case and check test coverage?
There was a problem hiding this comment.
test coverage required for handler? currently, as per practice we don't add test cases and coverage here. The same is followed by all other features in image_config.
|
Hi Qi, Please review this PR. |
|
Hi @qiluo-msft / @xincunli-sonic Changes have been made as per your suggestions, please review to merge this PR. Regards |
|
Hi @qiluo-msft / @lguohan Kindly review and help merge this PR. We are reaching out weekly, requesting for the above. Please support. Regards |
|
@qiluo-msft help merge this PR, pending for long, unable to understand merge delay! |
|
@lguohan this PR has been approved by reviewers, can you please check if you are ok to merge it? Thanks. |
Why I did it
Added code for new daemon process responsible for detecting and logging DHCP DoS attack attempts (violation of DHCP rate limit)
How I did it
Added service and handler files for new systemd process dhcp_dos_logger
How to verify it
tc show command is used to identify dropped packets due to rate limiting