1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 #include <net/tcp_memcontrol.h> 28 29 static int zero; 30 static int one = 1; 31 static int four = 4; 32 static int thousand = 1000; 33 static int gso_max_segs = GSO_MAX_SEGS; 34 static int tcp_retr1_max = 255; 35 static int ip_local_port_range_min[] = { 1, 1 }; 36 static int ip_local_port_range_max[] = { 65535, 65535 }; 37 static int tcp_adv_win_scale_min = -31; 38 static int tcp_adv_win_scale_max = 31; 39 static int ip_ttl_min = 1; 40 static int ip_ttl_max = 255; 41 static int tcp_syn_retries_min = 1; 42 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 43 static int ip_ping_group_range_min[] = { 0, 0 }; 44 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 45 46 /* Update system visible IP port range */ 47 static void set_local_port_range(struct net *net, int range[2]) 48 { 49 bool same_parity = !((range[0] ^ range[1]) & 1); 50 51 write_seqlock(&net->ipv4.ip_local_ports.lock); 52 if (same_parity && !net->ipv4.ip_local_ports.warned) { 53 net->ipv4.ip_local_ports.warned = true; 54 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 55 } 56 net->ipv4.ip_local_ports.range[0] = range[0]; 57 net->ipv4.ip_local_ports.range[1] = range[1]; 58 write_sequnlock(&net->ipv4.ip_local_ports.lock); 59 } 60 61 /* Validate changes from /proc interface. */ 62 static int ipv4_local_port_range(struct ctl_table *table, int write, 63 void __user *buffer, 64 size_t *lenp, loff_t *ppos) 65 { 66 struct net *net = 67 container_of(table->data, struct net, ipv4.ip_local_ports.range); 68 int ret; 69 int range[2]; 70 struct ctl_table tmp = { 71 .data = &range, 72 .maxlen = sizeof(range), 73 .mode = table->mode, 74 .extra1 = &ip_local_port_range_min, 75 .extra2 = &ip_local_port_range_max, 76 }; 77 78 inet_get_local_port_range(net, &range[0], &range[1]); 79 80 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 81 82 if (write && ret == 0) { 83 if (range[1] < range[0]) 84 ret = -EINVAL; 85 else 86 set_local_port_range(net, range); 87 } 88 89 return ret; 90 } 91 92 93 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 94 { 95 kgid_t *data = table->data; 96 struct net *net = 97 container_of(table->data, struct net, ipv4.ping_group_range.range); 98 unsigned int seq; 99 do { 100 seq = read_seqbegin(&net->ipv4.ip_local_ports.lock); 101 102 *low = data[0]; 103 *high = data[1]; 104 } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq)); 105 } 106 107 /* Update system visible IP port range */ 108 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 109 { 110 kgid_t *data = table->data; 111 struct net *net = 112 container_of(table->data, struct net, ipv4.ping_group_range.range); 113 write_seqlock(&net->ipv4.ip_local_ports.lock); 114 data[0] = low; 115 data[1] = high; 116 write_sequnlock(&net->ipv4.ip_local_ports.lock); 117 } 118 119 /* Validate changes from /proc interface. */ 120 static int ipv4_ping_group_range(struct ctl_table *table, int write, 121 void __user *buffer, 122 size_t *lenp, loff_t *ppos) 123 { 124 struct user_namespace *user_ns = current_user_ns(); 125 int ret; 126 gid_t urange[2]; 127 kgid_t low, high; 128 struct ctl_table tmp = { 129 .data = &urange, 130 .maxlen = sizeof(urange), 131 .mode = table->mode, 132 .extra1 = &ip_ping_group_range_min, 133 .extra2 = &ip_ping_group_range_max, 134 }; 135 136 inet_get_ping_group_range_table(table, &low, &high); 137 urange[0] = from_kgid_munged(user_ns, low); 138 urange[1] = from_kgid_munged(user_ns, high); 139 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 140 141 if (write && ret == 0) { 142 low = make_kgid(user_ns, urange[0]); 143 high = make_kgid(user_ns, urange[1]); 144 if (!gid_valid(low) || !gid_valid(high) || 145 (urange[1] < urange[0]) || gid_lt(high, low)) { 146 low = make_kgid(&init_user_ns, 1); 147 high = make_kgid(&init_user_ns, 0); 148 } 149 set_ping_group_range(table, low, high); 150 } 151 152 return ret; 153 } 154 155 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 156 void __user *buffer, size_t *lenp, loff_t *ppos) 157 { 158 char val[TCP_CA_NAME_MAX]; 159 struct ctl_table tbl = { 160 .data = val, 161 .maxlen = TCP_CA_NAME_MAX, 162 }; 163 int ret; 164 165 tcp_get_default_congestion_control(val); 166 167 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 168 if (write && ret == 0) 169 ret = tcp_set_default_congestion_control(val); 170 return ret; 171 } 172 173 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 174 int write, 175 void __user *buffer, size_t *lenp, 176 loff_t *ppos) 177 { 178 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 179 int ret; 180 181 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 182 if (!tbl.data) 183 return -ENOMEM; 184 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 185 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 186 kfree(tbl.data); 187 return ret; 188 } 189 190 static int proc_allowed_congestion_control(struct ctl_table *ctl, 191 int write, 192 void __user *buffer, size_t *lenp, 193 loff_t *ppos) 194 { 195 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 196 int ret; 197 198 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 199 if (!tbl.data) 200 return -ENOMEM; 201 202 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 203 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 204 if (write && ret == 0) 205 ret = tcp_set_allowed_congestion_control(tbl.data); 206 kfree(tbl.data); 207 return ret; 208 } 209 210 static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, 211 void __user *buffer, size_t *lenp, 212 loff_t *ppos) 213 { 214 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 215 struct tcp_fastopen_context *ctxt; 216 int ret; 217 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 218 219 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 220 if (!tbl.data) 221 return -ENOMEM; 222 223 rcu_read_lock(); 224 ctxt = rcu_dereference(tcp_fastopen_ctx); 225 if (ctxt) 226 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 227 else 228 memset(user_key, 0, sizeof(user_key)); 229 rcu_read_unlock(); 230 231 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 232 user_key[0], user_key[1], user_key[2], user_key[3]); 233 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 234 235 if (write && ret == 0) { 236 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 237 user_key + 2, user_key + 3) != 4) { 238 ret = -EINVAL; 239 goto bad_key; 240 } 241 /* Generate a dummy secret but don't publish it. This 242 * is needed so we don't regenerate a new key on the 243 * first invocation of tcp_fastopen_cookie_gen 244 */ 245 tcp_fastopen_init_key_once(false); 246 tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); 247 } 248 249 bad_key: 250 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 251 user_key[0], user_key[1], user_key[2], user_key[3], 252 (char *)tbl.data, ret); 253 kfree(tbl.data); 254 return ret; 255 } 256 257 static struct ctl_table ipv4_table[] = { 258 { 259 .procname = "tcp_timestamps", 260 .data = &sysctl_tcp_timestamps, 261 .maxlen = sizeof(int), 262 .mode = 0644, 263 .proc_handler = proc_dointvec 264 }, 265 { 266 .procname = "tcp_window_scaling", 267 .data = &sysctl_tcp_window_scaling, 268 .maxlen = sizeof(int), 269 .mode = 0644, 270 .proc_handler = proc_dointvec 271 }, 272 { 273 .procname = "tcp_sack", 274 .data = &sysctl_tcp_sack, 275 .maxlen = sizeof(int), 276 .mode = 0644, 277 .proc_handler = proc_dointvec 278 }, 279 { 280 .procname = "tcp_retrans_collapse", 281 .data = &sysctl_tcp_retrans_collapse, 282 .maxlen = sizeof(int), 283 .mode = 0644, 284 .proc_handler = proc_dointvec 285 }, 286 { 287 .procname = "ip_default_ttl", 288 .data = &sysctl_ip_default_ttl, 289 .maxlen = sizeof(int), 290 .mode = 0644, 291 .proc_handler = proc_dointvec_minmax, 292 .extra1 = &ip_ttl_min, 293 .extra2 = &ip_ttl_max, 294 }, 295 { 296 .procname = "tcp_syn_retries", 297 .data = &sysctl_tcp_syn_retries, 298 .maxlen = sizeof(int), 299 .mode = 0644, 300 .proc_handler = proc_dointvec_minmax, 301 .extra1 = &tcp_syn_retries_min, 302 .extra2 = &tcp_syn_retries_max 303 }, 304 { 305 .procname = "tcp_synack_retries", 306 .data = &sysctl_tcp_synack_retries, 307 .maxlen = sizeof(int), 308 .mode = 0644, 309 .proc_handler = proc_dointvec 310 }, 311 { 312 .procname = "tcp_max_orphans", 313 .data = &sysctl_tcp_max_orphans, 314 .maxlen = sizeof(int), 315 .mode = 0644, 316 .proc_handler = proc_dointvec 317 }, 318 { 319 .procname = "tcp_max_tw_buckets", 320 .data = &tcp_death_row.sysctl_max_tw_buckets, 321 .maxlen = sizeof(int), 322 .mode = 0644, 323 .proc_handler = proc_dointvec 324 }, 325 { 326 .procname = "ip_early_demux", 327 .data = &sysctl_ip_early_demux, 328 .maxlen = sizeof(int), 329 .mode = 0644, 330 .proc_handler = proc_dointvec 331 }, 332 { 333 .procname = "ip_dynaddr", 334 .data = &sysctl_ip_dynaddr, 335 .maxlen = sizeof(int), 336 .mode = 0644, 337 .proc_handler = proc_dointvec 338 }, 339 { 340 .procname = "tcp_keepalive_time", 341 .data = &sysctl_tcp_keepalive_time, 342 .maxlen = sizeof(int), 343 .mode = 0644, 344 .proc_handler = proc_dointvec_jiffies, 345 }, 346 { 347 .procname = "tcp_keepalive_probes", 348 .data = &sysctl_tcp_keepalive_probes, 349 .maxlen = sizeof(int), 350 .mode = 0644, 351 .proc_handler = proc_dointvec 352 }, 353 { 354 .procname = "tcp_keepalive_intvl", 355 .data = &sysctl_tcp_keepalive_intvl, 356 .maxlen = sizeof(int), 357 .mode = 0644, 358 .proc_handler = proc_dointvec_jiffies, 359 }, 360 { 361 .procname = "tcp_retries1", 362 .data = &sysctl_tcp_retries1, 363 .maxlen = sizeof(int), 364 .mode = 0644, 365 .proc_handler = proc_dointvec_minmax, 366 .extra2 = &tcp_retr1_max 367 }, 368 { 369 .procname = "tcp_retries2", 370 .data = &sysctl_tcp_retries2, 371 .maxlen = sizeof(int), 372 .mode = 0644, 373 .proc_handler = proc_dointvec 374 }, 375 { 376 .procname = "tcp_fin_timeout", 377 .data = &sysctl_tcp_fin_timeout, 378 .maxlen = sizeof(int), 379 .mode = 0644, 380 .proc_handler = proc_dointvec_jiffies, 381 }, 382 #ifdef CONFIG_SYN_COOKIES 383 { 384 .procname = "tcp_syncookies", 385 .data = &sysctl_tcp_syncookies, 386 .maxlen = sizeof(int), 387 .mode = 0644, 388 .proc_handler = proc_dointvec 389 }, 390 #endif 391 { 392 .procname = "tcp_fastopen", 393 .data = &sysctl_tcp_fastopen, 394 .maxlen = sizeof(int), 395 .mode = 0644, 396 .proc_handler = proc_dointvec, 397 }, 398 { 399 .procname = "tcp_fastopen_key", 400 .mode = 0600, 401 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 402 .proc_handler = proc_tcp_fastopen_key, 403 }, 404 { 405 .procname = "tcp_tw_recycle", 406 .data = &tcp_death_row.sysctl_tw_recycle, 407 .maxlen = sizeof(int), 408 .mode = 0644, 409 .proc_handler = proc_dointvec 410 }, 411 { 412 .procname = "tcp_abort_on_overflow", 413 .data = &sysctl_tcp_abort_on_overflow, 414 .maxlen = sizeof(int), 415 .mode = 0644, 416 .proc_handler = proc_dointvec 417 }, 418 { 419 .procname = "tcp_stdurg", 420 .data = &sysctl_tcp_stdurg, 421 .maxlen = sizeof(int), 422 .mode = 0644, 423 .proc_handler = proc_dointvec 424 }, 425 { 426 .procname = "tcp_rfc1337", 427 .data = &sysctl_tcp_rfc1337, 428 .maxlen = sizeof(int), 429 .mode = 0644, 430 .proc_handler = proc_dointvec 431 }, 432 { 433 .procname = "tcp_max_syn_backlog", 434 .data = &sysctl_max_syn_backlog, 435 .maxlen = sizeof(int), 436 .mode = 0644, 437 .proc_handler = proc_dointvec 438 }, 439 { 440 .procname = "igmp_max_memberships", 441 .data = &sysctl_igmp_max_memberships, 442 .maxlen = sizeof(int), 443 .mode = 0644, 444 .proc_handler = proc_dointvec 445 }, 446 { 447 .procname = "igmp_max_msf", 448 .data = &sysctl_igmp_max_msf, 449 .maxlen = sizeof(int), 450 .mode = 0644, 451 .proc_handler = proc_dointvec 452 }, 453 #ifdef CONFIG_IP_MULTICAST 454 { 455 .procname = "igmp_qrv", 456 .data = &sysctl_igmp_qrv, 457 .maxlen = sizeof(int), 458 .mode = 0644, 459 .proc_handler = proc_dointvec_minmax, 460 .extra1 = &one 461 }, 462 #endif 463 { 464 .procname = "inet_peer_threshold", 465 .data = &inet_peer_threshold, 466 .maxlen = sizeof(int), 467 .mode = 0644, 468 .proc_handler = proc_dointvec 469 }, 470 { 471 .procname = "inet_peer_minttl", 472 .data = &inet_peer_minttl, 473 .maxlen = sizeof(int), 474 .mode = 0644, 475 .proc_handler = proc_dointvec_jiffies, 476 }, 477 { 478 .procname = "inet_peer_maxttl", 479 .data = &inet_peer_maxttl, 480 .maxlen = sizeof(int), 481 .mode = 0644, 482 .proc_handler = proc_dointvec_jiffies, 483 }, 484 { 485 .procname = "tcp_orphan_retries", 486 .data = &sysctl_tcp_orphan_retries, 487 .maxlen = sizeof(int), 488 .mode = 0644, 489 .proc_handler = proc_dointvec 490 }, 491 { 492 .procname = "tcp_fack", 493 .data = &sysctl_tcp_fack, 494 .maxlen = sizeof(int), 495 .mode = 0644, 496 .proc_handler = proc_dointvec 497 }, 498 { 499 .procname = "tcp_reordering", 500 .data = &sysctl_tcp_reordering, 501 .maxlen = sizeof(int), 502 .mode = 0644, 503 .proc_handler = proc_dointvec 504 }, 505 { 506 .procname = "tcp_max_reordering", 507 .data = &sysctl_tcp_max_reordering, 508 .maxlen = sizeof(int), 509 .mode = 0644, 510 .proc_handler = proc_dointvec 511 }, 512 { 513 .procname = "tcp_dsack", 514 .data = &sysctl_tcp_dsack, 515 .maxlen = sizeof(int), 516 .mode = 0644, 517 .proc_handler = proc_dointvec 518 }, 519 { 520 .procname = "tcp_mem", 521 .maxlen = sizeof(sysctl_tcp_mem), 522 .data = &sysctl_tcp_mem, 523 .mode = 0644, 524 .proc_handler = proc_doulongvec_minmax, 525 }, 526 { 527 .procname = "tcp_wmem", 528 .data = &sysctl_tcp_wmem, 529 .maxlen = sizeof(sysctl_tcp_wmem), 530 .mode = 0644, 531 .proc_handler = proc_dointvec_minmax, 532 .extra1 = &one, 533 }, 534 { 535 .procname = "tcp_notsent_lowat", 536 .data = &sysctl_tcp_notsent_lowat, 537 .maxlen = sizeof(sysctl_tcp_notsent_lowat), 538 .mode = 0644, 539 .proc_handler = proc_dointvec, 540 }, 541 { 542 .procname = "tcp_rmem", 543 .data = &sysctl_tcp_rmem, 544 .maxlen = sizeof(sysctl_tcp_rmem), 545 .mode = 0644, 546 .proc_handler = proc_dointvec_minmax, 547 .extra1 = &one, 548 }, 549 { 550 .procname = "tcp_app_win", 551 .data = &sysctl_tcp_app_win, 552 .maxlen = sizeof(int), 553 .mode = 0644, 554 .proc_handler = proc_dointvec 555 }, 556 { 557 .procname = "tcp_adv_win_scale", 558 .data = &sysctl_tcp_adv_win_scale, 559 .maxlen = sizeof(int), 560 .mode = 0644, 561 .proc_handler = proc_dointvec_minmax, 562 .extra1 = &tcp_adv_win_scale_min, 563 .extra2 = &tcp_adv_win_scale_max, 564 }, 565 { 566 .procname = "tcp_tw_reuse", 567 .data = &sysctl_tcp_tw_reuse, 568 .maxlen = sizeof(int), 569 .mode = 0644, 570 .proc_handler = proc_dointvec 571 }, 572 { 573 .procname = "tcp_frto", 574 .data = &sysctl_tcp_frto, 575 .maxlen = sizeof(int), 576 .mode = 0644, 577 .proc_handler = proc_dointvec 578 }, 579 { 580 .procname = "tcp_low_latency", 581 .data = &sysctl_tcp_low_latency, 582 .maxlen = sizeof(int), 583 .mode = 0644, 584 .proc_handler = proc_dointvec 585 }, 586 { 587 .procname = "tcp_no_metrics_save", 588 .data = &sysctl_tcp_nometrics_save, 589 .maxlen = sizeof(int), 590 .mode = 0644, 591 .proc_handler = proc_dointvec, 592 }, 593 { 594 .procname = "tcp_moderate_rcvbuf", 595 .data = &sysctl_tcp_moderate_rcvbuf, 596 .maxlen = sizeof(int), 597 .mode = 0644, 598 .proc_handler = proc_dointvec, 599 }, 600 { 601 .procname = "tcp_tso_win_divisor", 602 .data = &sysctl_tcp_tso_win_divisor, 603 .maxlen = sizeof(int), 604 .mode = 0644, 605 .proc_handler = proc_dointvec, 606 }, 607 { 608 .procname = "tcp_congestion_control", 609 .mode = 0644, 610 .maxlen = TCP_CA_NAME_MAX, 611 .proc_handler = proc_tcp_congestion_control, 612 }, 613 { 614 .procname = "tcp_workaround_signed_windows", 615 .data = &sysctl_tcp_workaround_signed_windows, 616 .maxlen = sizeof(int), 617 .mode = 0644, 618 .proc_handler = proc_dointvec 619 }, 620 { 621 .procname = "tcp_limit_output_bytes", 622 .data = &sysctl_tcp_limit_output_bytes, 623 .maxlen = sizeof(int), 624 .mode = 0644, 625 .proc_handler = proc_dointvec 626 }, 627 { 628 .procname = "tcp_challenge_ack_limit", 629 .data = &sysctl_tcp_challenge_ack_limit, 630 .maxlen = sizeof(int), 631 .mode = 0644, 632 .proc_handler = proc_dointvec 633 }, 634 { 635 .procname = "tcp_slow_start_after_idle", 636 .data = &sysctl_tcp_slow_start_after_idle, 637 .maxlen = sizeof(int), 638 .mode = 0644, 639 .proc_handler = proc_dointvec 640 }, 641 #ifdef CONFIG_NETLABEL 642 { 643 .procname = "cipso_cache_enable", 644 .data = &cipso_v4_cache_enabled, 645 .maxlen = sizeof(int), 646 .mode = 0644, 647 .proc_handler = proc_dointvec, 648 }, 649 { 650 .procname = "cipso_cache_bucket_size", 651 .data = &cipso_v4_cache_bucketsize, 652 .maxlen = sizeof(int), 653 .mode = 0644, 654 .proc_handler = proc_dointvec, 655 }, 656 { 657 .procname = "cipso_rbm_optfmt", 658 .data = &cipso_v4_rbm_optfmt, 659 .maxlen = sizeof(int), 660 .mode = 0644, 661 .proc_handler = proc_dointvec, 662 }, 663 { 664 .procname = "cipso_rbm_strictvalid", 665 .data = &cipso_v4_rbm_strictvalid, 666 .maxlen = sizeof(int), 667 .mode = 0644, 668 .proc_handler = proc_dointvec, 669 }, 670 #endif /* CONFIG_NETLABEL */ 671 { 672 .procname = "tcp_available_congestion_control", 673 .maxlen = TCP_CA_BUF_MAX, 674 .mode = 0444, 675 .proc_handler = proc_tcp_available_congestion_control, 676 }, 677 { 678 .procname = "tcp_allowed_congestion_control", 679 .maxlen = TCP_CA_BUF_MAX, 680 .mode = 0644, 681 .proc_handler = proc_allowed_congestion_control, 682 }, 683 { 684 .procname = "tcp_thin_linear_timeouts", 685 .data = &sysctl_tcp_thin_linear_timeouts, 686 .maxlen = sizeof(int), 687 .mode = 0644, 688 .proc_handler = proc_dointvec 689 }, 690 { 691 .procname = "tcp_thin_dupack", 692 .data = &sysctl_tcp_thin_dupack, 693 .maxlen = sizeof(int), 694 .mode = 0644, 695 .proc_handler = proc_dointvec 696 }, 697 { 698 .procname = "tcp_early_retrans", 699 .data = &sysctl_tcp_early_retrans, 700 .maxlen = sizeof(int), 701 .mode = 0644, 702 .proc_handler = proc_dointvec_minmax, 703 .extra1 = &zero, 704 .extra2 = &four, 705 }, 706 { 707 .procname = "tcp_min_tso_segs", 708 .data = &sysctl_tcp_min_tso_segs, 709 .maxlen = sizeof(int), 710 .mode = 0644, 711 .proc_handler = proc_dointvec_minmax, 712 .extra1 = &one, 713 .extra2 = &gso_max_segs, 714 }, 715 { 716 .procname = "tcp_pacing_ss_ratio", 717 .data = &sysctl_tcp_pacing_ss_ratio, 718 .maxlen = sizeof(int), 719 .mode = 0644, 720 .proc_handler = proc_dointvec_minmax, 721 .extra1 = &zero, 722 .extra2 = &thousand, 723 }, 724 { 725 .procname = "tcp_pacing_ca_ratio", 726 .data = &sysctl_tcp_pacing_ca_ratio, 727 .maxlen = sizeof(int), 728 .mode = 0644, 729 .proc_handler = proc_dointvec_minmax, 730 .extra1 = &zero, 731 .extra2 = &thousand, 732 }, 733 { 734 .procname = "tcp_autocorking", 735 .data = &sysctl_tcp_autocorking, 736 .maxlen = sizeof(int), 737 .mode = 0644, 738 .proc_handler = proc_dointvec_minmax, 739 .extra1 = &zero, 740 .extra2 = &one, 741 }, 742 { 743 .procname = "tcp_invalid_ratelimit", 744 .data = &sysctl_tcp_invalid_ratelimit, 745 .maxlen = sizeof(int), 746 .mode = 0644, 747 .proc_handler = proc_dointvec_ms_jiffies, 748 }, 749 { 750 .procname = "icmp_msgs_per_sec", 751 .data = &sysctl_icmp_msgs_per_sec, 752 .maxlen = sizeof(int), 753 .mode = 0644, 754 .proc_handler = proc_dointvec_minmax, 755 .extra1 = &zero, 756 }, 757 { 758 .procname = "icmp_msgs_burst", 759 .data = &sysctl_icmp_msgs_burst, 760 .maxlen = sizeof(int), 761 .mode = 0644, 762 .proc_handler = proc_dointvec_minmax, 763 .extra1 = &zero, 764 }, 765 { 766 .procname = "udp_mem", 767 .data = &sysctl_udp_mem, 768 .maxlen = sizeof(sysctl_udp_mem), 769 .mode = 0644, 770 .proc_handler = proc_doulongvec_minmax, 771 }, 772 { 773 .procname = "udp_rmem_min", 774 .data = &sysctl_udp_rmem_min, 775 .maxlen = sizeof(sysctl_udp_rmem_min), 776 .mode = 0644, 777 .proc_handler = proc_dointvec_minmax, 778 .extra1 = &one 779 }, 780 { 781 .procname = "udp_wmem_min", 782 .data = &sysctl_udp_wmem_min, 783 .maxlen = sizeof(sysctl_udp_wmem_min), 784 .mode = 0644, 785 .proc_handler = proc_dointvec_minmax, 786 .extra1 = &one 787 }, 788 { } 789 }; 790 791 static struct ctl_table ipv4_net_table[] = { 792 { 793 .procname = "icmp_echo_ignore_all", 794 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 795 .maxlen = sizeof(int), 796 .mode = 0644, 797 .proc_handler = proc_dointvec 798 }, 799 { 800 .procname = "icmp_echo_ignore_broadcasts", 801 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 802 .maxlen = sizeof(int), 803 .mode = 0644, 804 .proc_handler = proc_dointvec 805 }, 806 { 807 .procname = "icmp_ignore_bogus_error_responses", 808 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 809 .maxlen = sizeof(int), 810 .mode = 0644, 811 .proc_handler = proc_dointvec 812 }, 813 { 814 .procname = "icmp_errors_use_inbound_ifaddr", 815 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 816 .maxlen = sizeof(int), 817 .mode = 0644, 818 .proc_handler = proc_dointvec 819 }, 820 { 821 .procname = "icmp_ratelimit", 822 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 823 .maxlen = sizeof(int), 824 .mode = 0644, 825 .proc_handler = proc_dointvec_ms_jiffies, 826 }, 827 { 828 .procname = "icmp_ratemask", 829 .data = &init_net.ipv4.sysctl_icmp_ratemask, 830 .maxlen = sizeof(int), 831 .mode = 0644, 832 .proc_handler = proc_dointvec 833 }, 834 { 835 .procname = "ping_group_range", 836 .data = &init_net.ipv4.ping_group_range.range, 837 .maxlen = sizeof(gid_t)*2, 838 .mode = 0644, 839 .proc_handler = ipv4_ping_group_range, 840 }, 841 { 842 .procname = "tcp_ecn", 843 .data = &init_net.ipv4.sysctl_tcp_ecn, 844 .maxlen = sizeof(int), 845 .mode = 0644, 846 .proc_handler = proc_dointvec 847 }, 848 { 849 .procname = "tcp_ecn_fallback", 850 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 851 .maxlen = sizeof(int), 852 .mode = 0644, 853 .proc_handler = proc_dointvec 854 }, 855 { 856 .procname = "ip_local_port_range", 857 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 858 .data = &init_net.ipv4.ip_local_ports.range, 859 .mode = 0644, 860 .proc_handler = ipv4_local_port_range, 861 }, 862 { 863 .procname = "ip_local_reserved_ports", 864 .data = &init_net.ipv4.sysctl_local_reserved_ports, 865 .maxlen = 65536, 866 .mode = 0644, 867 .proc_handler = proc_do_large_bitmap, 868 }, 869 { 870 .procname = "ip_no_pmtu_disc", 871 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 872 .maxlen = sizeof(int), 873 .mode = 0644, 874 .proc_handler = proc_dointvec 875 }, 876 { 877 .procname = "ip_forward_use_pmtu", 878 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 879 .maxlen = sizeof(int), 880 .mode = 0644, 881 .proc_handler = proc_dointvec, 882 }, 883 { 884 .procname = "ip_nonlocal_bind", 885 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 886 .maxlen = sizeof(int), 887 .mode = 0644, 888 .proc_handler = proc_dointvec 889 }, 890 { 891 .procname = "fwmark_reflect", 892 .data = &init_net.ipv4.sysctl_fwmark_reflect, 893 .maxlen = sizeof(int), 894 .mode = 0644, 895 .proc_handler = proc_dointvec, 896 }, 897 { 898 .procname = "tcp_fwmark_accept", 899 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 900 .maxlen = sizeof(int), 901 .mode = 0644, 902 .proc_handler = proc_dointvec, 903 }, 904 { 905 .procname = "tcp_mtu_probing", 906 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 907 .maxlen = sizeof(int), 908 .mode = 0644, 909 .proc_handler = proc_dointvec, 910 }, 911 { 912 .procname = "tcp_base_mss", 913 .data = &init_net.ipv4.sysctl_tcp_base_mss, 914 .maxlen = sizeof(int), 915 .mode = 0644, 916 .proc_handler = proc_dointvec, 917 }, 918 { 919 .procname = "tcp_probe_threshold", 920 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 921 .maxlen = sizeof(int), 922 .mode = 0644, 923 .proc_handler = proc_dointvec, 924 }, 925 { 926 .procname = "tcp_probe_interval", 927 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 928 .maxlen = sizeof(int), 929 .mode = 0644, 930 .proc_handler = proc_dointvec, 931 }, 932 { 933 .procname = "igmp_link_local_mcast_reports", 934 .data = &sysctl_igmp_llm_reports, 935 .maxlen = sizeof(int), 936 .mode = 0644, 937 .proc_handler = proc_dointvec 938 }, 939 { } 940 }; 941 942 static __net_init int ipv4_sysctl_init_net(struct net *net) 943 { 944 struct ctl_table *table; 945 946 table = ipv4_net_table; 947 if (!net_eq(net, &init_net)) { 948 int i; 949 950 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 951 if (!table) 952 goto err_alloc; 953 954 /* Update the variables to point into the current struct net */ 955 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 956 table[i].data += (void *)net - (void *)&init_net; 957 } 958 959 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 960 if (!net->ipv4.ipv4_hdr) 961 goto err_reg; 962 963 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 964 if (!net->ipv4.sysctl_local_reserved_ports) 965 goto err_ports; 966 967 return 0; 968 969 err_ports: 970 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 971 err_reg: 972 if (!net_eq(net, &init_net)) 973 kfree(table); 974 err_alloc: 975 return -ENOMEM; 976 } 977 978 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 979 { 980 struct ctl_table *table; 981 982 kfree(net->ipv4.sysctl_local_reserved_ports); 983 table = net->ipv4.ipv4_hdr->ctl_table_arg; 984 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 985 kfree(table); 986 } 987 988 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 989 .init = ipv4_sysctl_init_net, 990 .exit = ipv4_sysctl_exit_net, 991 }; 992 993 static __init int sysctl_ipv4_init(void) 994 { 995 struct ctl_table_header *hdr; 996 997 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 998 if (!hdr) 999 return -ENOMEM; 1000 1001 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1002 unregister_net_sysctl_table(hdr); 1003 return -ENOMEM; 1004 } 1005 1006 return 0; 1007 } 1008 1009 __initcall(sysctl_ipv4_init); 1010