1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 28 static int zero; 29 static int one = 1; 30 static int four = 4; 31 static int thousand = 1000; 32 static int gso_max_segs = GSO_MAX_SEGS; 33 static int tcp_retr1_max = 255; 34 static int ip_local_port_range_min[] = { 1, 1 }; 35 static int ip_local_port_range_max[] = { 65535, 65535 }; 36 static int tcp_adv_win_scale_min = -31; 37 static int tcp_adv_win_scale_max = 31; 38 static int ip_ttl_min = 1; 39 static int ip_ttl_max = 255; 40 static int tcp_syn_retries_min = 1; 41 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 42 static int ip_ping_group_range_min[] = { 0, 0 }; 43 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 44 45 /* Update system visible IP port range */ 46 static void set_local_port_range(struct net *net, int range[2]) 47 { 48 bool same_parity = !((range[0] ^ range[1]) & 1); 49 50 write_seqlock_bh(&net->ipv4.ip_local_ports.lock); 51 if (same_parity && !net->ipv4.ip_local_ports.warned) { 52 net->ipv4.ip_local_ports.warned = true; 53 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 54 } 55 net->ipv4.ip_local_ports.range[0] = range[0]; 56 net->ipv4.ip_local_ports.range[1] = range[1]; 57 write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); 58 } 59 60 /* Validate changes from /proc interface. */ 61 static int ipv4_local_port_range(struct ctl_table *table, int write, 62 void __user *buffer, 63 size_t *lenp, loff_t *ppos) 64 { 65 struct net *net = 66 container_of(table->data, struct net, ipv4.ip_local_ports.range); 67 int ret; 68 int range[2]; 69 struct ctl_table tmp = { 70 .data = &range, 71 .maxlen = sizeof(range), 72 .mode = table->mode, 73 .extra1 = &ip_local_port_range_min, 74 .extra2 = &ip_local_port_range_max, 75 }; 76 77 inet_get_local_port_range(net, &range[0], &range[1]); 78 79 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 80 81 if (write && ret == 0) { 82 if (range[1] < range[0]) 83 ret = -EINVAL; 84 else 85 set_local_port_range(net, range); 86 } 87 88 return ret; 89 } 90 91 92 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 93 { 94 kgid_t *data = table->data; 95 struct net *net = 96 container_of(table->data, struct net, ipv4.ping_group_range.range); 97 unsigned int seq; 98 do { 99 seq = read_seqbegin(&net->ipv4.ip_local_ports.lock); 100 101 *low = data[0]; 102 *high = data[1]; 103 } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq)); 104 } 105 106 /* Update system visible IP port range */ 107 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 108 { 109 kgid_t *data = table->data; 110 struct net *net = 111 container_of(table->data, struct net, ipv4.ping_group_range.range); 112 write_seqlock(&net->ipv4.ip_local_ports.lock); 113 data[0] = low; 114 data[1] = high; 115 write_sequnlock(&net->ipv4.ip_local_ports.lock); 116 } 117 118 /* Validate changes from /proc interface. */ 119 static int ipv4_ping_group_range(struct ctl_table *table, int write, 120 void __user *buffer, 121 size_t *lenp, loff_t *ppos) 122 { 123 struct user_namespace *user_ns = current_user_ns(); 124 int ret; 125 gid_t urange[2]; 126 kgid_t low, high; 127 struct ctl_table tmp = { 128 .data = &urange, 129 .maxlen = sizeof(urange), 130 .mode = table->mode, 131 .extra1 = &ip_ping_group_range_min, 132 .extra2 = &ip_ping_group_range_max, 133 }; 134 135 inet_get_ping_group_range_table(table, &low, &high); 136 urange[0] = from_kgid_munged(user_ns, low); 137 urange[1] = from_kgid_munged(user_ns, high); 138 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 139 140 if (write && ret == 0) { 141 low = make_kgid(user_ns, urange[0]); 142 high = make_kgid(user_ns, urange[1]); 143 if (!gid_valid(low) || !gid_valid(high) || 144 (urange[1] < urange[0]) || gid_lt(high, low)) { 145 low = make_kgid(&init_user_ns, 1); 146 high = make_kgid(&init_user_ns, 0); 147 } 148 set_ping_group_range(table, low, high); 149 } 150 151 return ret; 152 } 153 154 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 155 void __user *buffer, size_t *lenp, loff_t *ppos) 156 { 157 char val[TCP_CA_NAME_MAX]; 158 struct ctl_table tbl = { 159 .data = val, 160 .maxlen = TCP_CA_NAME_MAX, 161 }; 162 int ret; 163 164 tcp_get_default_congestion_control(val); 165 166 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 167 if (write && ret == 0) 168 ret = tcp_set_default_congestion_control(val); 169 return ret; 170 } 171 172 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 173 int write, 174 void __user *buffer, size_t *lenp, 175 loff_t *ppos) 176 { 177 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 178 int ret; 179 180 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 181 if (!tbl.data) 182 return -ENOMEM; 183 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 184 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 185 kfree(tbl.data); 186 return ret; 187 } 188 189 static int proc_allowed_congestion_control(struct ctl_table *ctl, 190 int write, 191 void __user *buffer, size_t *lenp, 192 loff_t *ppos) 193 { 194 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 195 int ret; 196 197 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 198 if (!tbl.data) 199 return -ENOMEM; 200 201 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 202 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 203 if (write && ret == 0) 204 ret = tcp_set_allowed_congestion_control(tbl.data); 205 kfree(tbl.data); 206 return ret; 207 } 208 209 static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, 210 void __user *buffer, size_t *lenp, 211 loff_t *ppos) 212 { 213 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 214 struct tcp_fastopen_context *ctxt; 215 int ret; 216 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 217 218 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 219 if (!tbl.data) 220 return -ENOMEM; 221 222 rcu_read_lock(); 223 ctxt = rcu_dereference(tcp_fastopen_ctx); 224 if (ctxt) 225 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 226 else 227 memset(user_key, 0, sizeof(user_key)); 228 rcu_read_unlock(); 229 230 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 231 user_key[0], user_key[1], user_key[2], user_key[3]); 232 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 233 234 if (write && ret == 0) { 235 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 236 user_key + 2, user_key + 3) != 4) { 237 ret = -EINVAL; 238 goto bad_key; 239 } 240 /* Generate a dummy secret but don't publish it. This 241 * is needed so we don't regenerate a new key on the 242 * first invocation of tcp_fastopen_cookie_gen 243 */ 244 tcp_fastopen_init_key_once(false); 245 tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); 246 } 247 248 bad_key: 249 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 250 user_key[0], user_key[1], user_key[2], user_key[3], 251 (char *)tbl.data, ret); 252 kfree(tbl.data); 253 return ret; 254 } 255 256 static struct ctl_table ipv4_table[] = { 257 { 258 .procname = "tcp_timestamps", 259 .data = &sysctl_tcp_timestamps, 260 .maxlen = sizeof(int), 261 .mode = 0644, 262 .proc_handler = proc_dointvec 263 }, 264 { 265 .procname = "tcp_window_scaling", 266 .data = &sysctl_tcp_window_scaling, 267 .maxlen = sizeof(int), 268 .mode = 0644, 269 .proc_handler = proc_dointvec 270 }, 271 { 272 .procname = "tcp_sack", 273 .data = &sysctl_tcp_sack, 274 .maxlen = sizeof(int), 275 .mode = 0644, 276 .proc_handler = proc_dointvec 277 }, 278 { 279 .procname = "tcp_retrans_collapse", 280 .data = &sysctl_tcp_retrans_collapse, 281 .maxlen = sizeof(int), 282 .mode = 0644, 283 .proc_handler = proc_dointvec 284 }, 285 { 286 .procname = "ip_default_ttl", 287 .data = &sysctl_ip_default_ttl, 288 .maxlen = sizeof(int), 289 .mode = 0644, 290 .proc_handler = proc_dointvec_minmax, 291 .extra1 = &ip_ttl_min, 292 .extra2 = &ip_ttl_max, 293 }, 294 { 295 .procname = "tcp_syn_retries", 296 .data = &sysctl_tcp_syn_retries, 297 .maxlen = sizeof(int), 298 .mode = 0644, 299 .proc_handler = proc_dointvec_minmax, 300 .extra1 = &tcp_syn_retries_min, 301 .extra2 = &tcp_syn_retries_max 302 }, 303 { 304 .procname = "tcp_synack_retries", 305 .data = &sysctl_tcp_synack_retries, 306 .maxlen = sizeof(int), 307 .mode = 0644, 308 .proc_handler = proc_dointvec 309 }, 310 { 311 .procname = "tcp_max_orphans", 312 .data = &sysctl_tcp_max_orphans, 313 .maxlen = sizeof(int), 314 .mode = 0644, 315 .proc_handler = proc_dointvec 316 }, 317 { 318 .procname = "tcp_max_tw_buckets", 319 .data = &tcp_death_row.sysctl_max_tw_buckets, 320 .maxlen = sizeof(int), 321 .mode = 0644, 322 .proc_handler = proc_dointvec 323 }, 324 { 325 .procname = "ip_early_demux", 326 .data = &sysctl_ip_early_demux, 327 .maxlen = sizeof(int), 328 .mode = 0644, 329 .proc_handler = proc_dointvec 330 }, 331 { 332 .procname = "ip_dynaddr", 333 .data = &sysctl_ip_dynaddr, 334 .maxlen = sizeof(int), 335 .mode = 0644, 336 .proc_handler = proc_dointvec 337 }, 338 { 339 .procname = "tcp_retries1", 340 .data = &sysctl_tcp_retries1, 341 .maxlen = sizeof(int), 342 .mode = 0644, 343 .proc_handler = proc_dointvec_minmax, 344 .extra2 = &tcp_retr1_max 345 }, 346 { 347 .procname = "tcp_retries2", 348 .data = &sysctl_tcp_retries2, 349 .maxlen = sizeof(int), 350 .mode = 0644, 351 .proc_handler = proc_dointvec 352 }, 353 { 354 .procname = "tcp_fin_timeout", 355 .data = &sysctl_tcp_fin_timeout, 356 .maxlen = sizeof(int), 357 .mode = 0644, 358 .proc_handler = proc_dointvec_jiffies, 359 }, 360 #ifdef CONFIG_SYN_COOKIES 361 { 362 .procname = "tcp_syncookies", 363 .data = &sysctl_tcp_syncookies, 364 .maxlen = sizeof(int), 365 .mode = 0644, 366 .proc_handler = proc_dointvec 367 }, 368 #endif 369 { 370 .procname = "tcp_fastopen", 371 .data = &sysctl_tcp_fastopen, 372 .maxlen = sizeof(int), 373 .mode = 0644, 374 .proc_handler = proc_dointvec, 375 }, 376 { 377 .procname = "tcp_fastopen_key", 378 .mode = 0600, 379 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 380 .proc_handler = proc_tcp_fastopen_key, 381 }, 382 { 383 .procname = "tcp_tw_recycle", 384 .data = &tcp_death_row.sysctl_tw_recycle, 385 .maxlen = sizeof(int), 386 .mode = 0644, 387 .proc_handler = proc_dointvec 388 }, 389 { 390 .procname = "tcp_abort_on_overflow", 391 .data = &sysctl_tcp_abort_on_overflow, 392 .maxlen = sizeof(int), 393 .mode = 0644, 394 .proc_handler = proc_dointvec 395 }, 396 { 397 .procname = "tcp_stdurg", 398 .data = &sysctl_tcp_stdurg, 399 .maxlen = sizeof(int), 400 .mode = 0644, 401 .proc_handler = proc_dointvec 402 }, 403 { 404 .procname = "tcp_rfc1337", 405 .data = &sysctl_tcp_rfc1337, 406 .maxlen = sizeof(int), 407 .mode = 0644, 408 .proc_handler = proc_dointvec 409 }, 410 { 411 .procname = "tcp_max_syn_backlog", 412 .data = &sysctl_max_syn_backlog, 413 .maxlen = sizeof(int), 414 .mode = 0644, 415 .proc_handler = proc_dointvec 416 }, 417 { 418 .procname = "igmp_max_memberships", 419 .data = &sysctl_igmp_max_memberships, 420 .maxlen = sizeof(int), 421 .mode = 0644, 422 .proc_handler = proc_dointvec 423 }, 424 { 425 .procname = "igmp_max_msf", 426 .data = &sysctl_igmp_max_msf, 427 .maxlen = sizeof(int), 428 .mode = 0644, 429 .proc_handler = proc_dointvec 430 }, 431 #ifdef CONFIG_IP_MULTICAST 432 { 433 .procname = "igmp_qrv", 434 .data = &sysctl_igmp_qrv, 435 .maxlen = sizeof(int), 436 .mode = 0644, 437 .proc_handler = proc_dointvec_minmax, 438 .extra1 = &one 439 }, 440 #endif 441 { 442 .procname = "inet_peer_threshold", 443 .data = &inet_peer_threshold, 444 .maxlen = sizeof(int), 445 .mode = 0644, 446 .proc_handler = proc_dointvec 447 }, 448 { 449 .procname = "inet_peer_minttl", 450 .data = &inet_peer_minttl, 451 .maxlen = sizeof(int), 452 .mode = 0644, 453 .proc_handler = proc_dointvec_jiffies, 454 }, 455 { 456 .procname = "inet_peer_maxttl", 457 .data = &inet_peer_maxttl, 458 .maxlen = sizeof(int), 459 .mode = 0644, 460 .proc_handler = proc_dointvec_jiffies, 461 }, 462 { 463 .procname = "tcp_orphan_retries", 464 .data = &sysctl_tcp_orphan_retries, 465 .maxlen = sizeof(int), 466 .mode = 0644, 467 .proc_handler = proc_dointvec 468 }, 469 { 470 .procname = "tcp_fack", 471 .data = &sysctl_tcp_fack, 472 .maxlen = sizeof(int), 473 .mode = 0644, 474 .proc_handler = proc_dointvec 475 }, 476 { 477 .procname = "tcp_recovery", 478 .data = &sysctl_tcp_recovery, 479 .maxlen = sizeof(int), 480 .mode = 0644, 481 .proc_handler = proc_dointvec, 482 }, 483 { 484 .procname = "tcp_reordering", 485 .data = &sysctl_tcp_reordering, 486 .maxlen = sizeof(int), 487 .mode = 0644, 488 .proc_handler = proc_dointvec 489 }, 490 { 491 .procname = "tcp_max_reordering", 492 .data = &sysctl_tcp_max_reordering, 493 .maxlen = sizeof(int), 494 .mode = 0644, 495 .proc_handler = proc_dointvec 496 }, 497 { 498 .procname = "tcp_dsack", 499 .data = &sysctl_tcp_dsack, 500 .maxlen = sizeof(int), 501 .mode = 0644, 502 .proc_handler = proc_dointvec 503 }, 504 { 505 .procname = "tcp_mem", 506 .maxlen = sizeof(sysctl_tcp_mem), 507 .data = &sysctl_tcp_mem, 508 .mode = 0644, 509 .proc_handler = proc_doulongvec_minmax, 510 }, 511 { 512 .procname = "tcp_wmem", 513 .data = &sysctl_tcp_wmem, 514 .maxlen = sizeof(sysctl_tcp_wmem), 515 .mode = 0644, 516 .proc_handler = proc_dointvec_minmax, 517 .extra1 = &one, 518 }, 519 { 520 .procname = "tcp_notsent_lowat", 521 .data = &sysctl_tcp_notsent_lowat, 522 .maxlen = sizeof(sysctl_tcp_notsent_lowat), 523 .mode = 0644, 524 .proc_handler = proc_dointvec, 525 }, 526 { 527 .procname = "tcp_rmem", 528 .data = &sysctl_tcp_rmem, 529 .maxlen = sizeof(sysctl_tcp_rmem), 530 .mode = 0644, 531 .proc_handler = proc_dointvec_minmax, 532 .extra1 = &one, 533 }, 534 { 535 .procname = "tcp_app_win", 536 .data = &sysctl_tcp_app_win, 537 .maxlen = sizeof(int), 538 .mode = 0644, 539 .proc_handler = proc_dointvec 540 }, 541 { 542 .procname = "tcp_adv_win_scale", 543 .data = &sysctl_tcp_adv_win_scale, 544 .maxlen = sizeof(int), 545 .mode = 0644, 546 .proc_handler = proc_dointvec_minmax, 547 .extra1 = &tcp_adv_win_scale_min, 548 .extra2 = &tcp_adv_win_scale_max, 549 }, 550 { 551 .procname = "tcp_tw_reuse", 552 .data = &sysctl_tcp_tw_reuse, 553 .maxlen = sizeof(int), 554 .mode = 0644, 555 .proc_handler = proc_dointvec 556 }, 557 { 558 .procname = "tcp_frto", 559 .data = &sysctl_tcp_frto, 560 .maxlen = sizeof(int), 561 .mode = 0644, 562 .proc_handler = proc_dointvec 563 }, 564 { 565 .procname = "tcp_min_rtt_wlen", 566 .data = &sysctl_tcp_min_rtt_wlen, 567 .maxlen = sizeof(int), 568 .mode = 0644, 569 .proc_handler = proc_dointvec 570 }, 571 { 572 .procname = "tcp_low_latency", 573 .data = &sysctl_tcp_low_latency, 574 .maxlen = sizeof(int), 575 .mode = 0644, 576 .proc_handler = proc_dointvec 577 }, 578 { 579 .procname = "tcp_no_metrics_save", 580 .data = &sysctl_tcp_nometrics_save, 581 .maxlen = sizeof(int), 582 .mode = 0644, 583 .proc_handler = proc_dointvec, 584 }, 585 { 586 .procname = "tcp_moderate_rcvbuf", 587 .data = &sysctl_tcp_moderate_rcvbuf, 588 .maxlen = sizeof(int), 589 .mode = 0644, 590 .proc_handler = proc_dointvec, 591 }, 592 { 593 .procname = "tcp_tso_win_divisor", 594 .data = &sysctl_tcp_tso_win_divisor, 595 .maxlen = sizeof(int), 596 .mode = 0644, 597 .proc_handler = proc_dointvec, 598 }, 599 { 600 .procname = "tcp_congestion_control", 601 .mode = 0644, 602 .maxlen = TCP_CA_NAME_MAX, 603 .proc_handler = proc_tcp_congestion_control, 604 }, 605 { 606 .procname = "tcp_workaround_signed_windows", 607 .data = &sysctl_tcp_workaround_signed_windows, 608 .maxlen = sizeof(int), 609 .mode = 0644, 610 .proc_handler = proc_dointvec 611 }, 612 { 613 .procname = "tcp_limit_output_bytes", 614 .data = &sysctl_tcp_limit_output_bytes, 615 .maxlen = sizeof(int), 616 .mode = 0644, 617 .proc_handler = proc_dointvec 618 }, 619 { 620 .procname = "tcp_challenge_ack_limit", 621 .data = &sysctl_tcp_challenge_ack_limit, 622 .maxlen = sizeof(int), 623 .mode = 0644, 624 .proc_handler = proc_dointvec 625 }, 626 { 627 .procname = "tcp_slow_start_after_idle", 628 .data = &sysctl_tcp_slow_start_after_idle, 629 .maxlen = sizeof(int), 630 .mode = 0644, 631 .proc_handler = proc_dointvec 632 }, 633 #ifdef CONFIG_NETLABEL 634 { 635 .procname = "cipso_cache_enable", 636 .data = &cipso_v4_cache_enabled, 637 .maxlen = sizeof(int), 638 .mode = 0644, 639 .proc_handler = proc_dointvec, 640 }, 641 { 642 .procname = "cipso_cache_bucket_size", 643 .data = &cipso_v4_cache_bucketsize, 644 .maxlen = sizeof(int), 645 .mode = 0644, 646 .proc_handler = proc_dointvec, 647 }, 648 { 649 .procname = "cipso_rbm_optfmt", 650 .data = &cipso_v4_rbm_optfmt, 651 .maxlen = sizeof(int), 652 .mode = 0644, 653 .proc_handler = proc_dointvec, 654 }, 655 { 656 .procname = "cipso_rbm_strictvalid", 657 .data = &cipso_v4_rbm_strictvalid, 658 .maxlen = sizeof(int), 659 .mode = 0644, 660 .proc_handler = proc_dointvec, 661 }, 662 #endif /* CONFIG_NETLABEL */ 663 { 664 .procname = "tcp_available_congestion_control", 665 .maxlen = TCP_CA_BUF_MAX, 666 .mode = 0444, 667 .proc_handler = proc_tcp_available_congestion_control, 668 }, 669 { 670 .procname = "tcp_allowed_congestion_control", 671 .maxlen = TCP_CA_BUF_MAX, 672 .mode = 0644, 673 .proc_handler = proc_allowed_congestion_control, 674 }, 675 { 676 .procname = "tcp_thin_linear_timeouts", 677 .data = &sysctl_tcp_thin_linear_timeouts, 678 .maxlen = sizeof(int), 679 .mode = 0644, 680 .proc_handler = proc_dointvec 681 }, 682 { 683 .procname = "tcp_thin_dupack", 684 .data = &sysctl_tcp_thin_dupack, 685 .maxlen = sizeof(int), 686 .mode = 0644, 687 .proc_handler = proc_dointvec 688 }, 689 { 690 .procname = "tcp_early_retrans", 691 .data = &sysctl_tcp_early_retrans, 692 .maxlen = sizeof(int), 693 .mode = 0644, 694 .proc_handler = proc_dointvec_minmax, 695 .extra1 = &zero, 696 .extra2 = &four, 697 }, 698 { 699 .procname = "tcp_min_tso_segs", 700 .data = &sysctl_tcp_min_tso_segs, 701 .maxlen = sizeof(int), 702 .mode = 0644, 703 .proc_handler = proc_dointvec_minmax, 704 .extra1 = &one, 705 .extra2 = &gso_max_segs, 706 }, 707 { 708 .procname = "tcp_pacing_ss_ratio", 709 .data = &sysctl_tcp_pacing_ss_ratio, 710 .maxlen = sizeof(int), 711 .mode = 0644, 712 .proc_handler = proc_dointvec_minmax, 713 .extra1 = &zero, 714 .extra2 = &thousand, 715 }, 716 { 717 .procname = "tcp_pacing_ca_ratio", 718 .data = &sysctl_tcp_pacing_ca_ratio, 719 .maxlen = sizeof(int), 720 .mode = 0644, 721 .proc_handler = proc_dointvec_minmax, 722 .extra1 = &zero, 723 .extra2 = &thousand, 724 }, 725 { 726 .procname = "tcp_autocorking", 727 .data = &sysctl_tcp_autocorking, 728 .maxlen = sizeof(int), 729 .mode = 0644, 730 .proc_handler = proc_dointvec_minmax, 731 .extra1 = &zero, 732 .extra2 = &one, 733 }, 734 { 735 .procname = "tcp_invalid_ratelimit", 736 .data = &sysctl_tcp_invalid_ratelimit, 737 .maxlen = sizeof(int), 738 .mode = 0644, 739 .proc_handler = proc_dointvec_ms_jiffies, 740 }, 741 { 742 .procname = "icmp_msgs_per_sec", 743 .data = &sysctl_icmp_msgs_per_sec, 744 .maxlen = sizeof(int), 745 .mode = 0644, 746 .proc_handler = proc_dointvec_minmax, 747 .extra1 = &zero, 748 }, 749 { 750 .procname = "icmp_msgs_burst", 751 .data = &sysctl_icmp_msgs_burst, 752 .maxlen = sizeof(int), 753 .mode = 0644, 754 .proc_handler = proc_dointvec_minmax, 755 .extra1 = &zero, 756 }, 757 { 758 .procname = "udp_mem", 759 .data = &sysctl_udp_mem, 760 .maxlen = sizeof(sysctl_udp_mem), 761 .mode = 0644, 762 .proc_handler = proc_doulongvec_minmax, 763 }, 764 { 765 .procname = "udp_rmem_min", 766 .data = &sysctl_udp_rmem_min, 767 .maxlen = sizeof(sysctl_udp_rmem_min), 768 .mode = 0644, 769 .proc_handler = proc_dointvec_minmax, 770 .extra1 = &one 771 }, 772 { 773 .procname = "udp_wmem_min", 774 .data = &sysctl_udp_wmem_min, 775 .maxlen = sizeof(sysctl_udp_wmem_min), 776 .mode = 0644, 777 .proc_handler = proc_dointvec_minmax, 778 .extra1 = &one 779 }, 780 { } 781 }; 782 783 static struct ctl_table ipv4_net_table[] = { 784 { 785 .procname = "icmp_echo_ignore_all", 786 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 787 .maxlen = sizeof(int), 788 .mode = 0644, 789 .proc_handler = proc_dointvec 790 }, 791 { 792 .procname = "icmp_echo_ignore_broadcasts", 793 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 794 .maxlen = sizeof(int), 795 .mode = 0644, 796 .proc_handler = proc_dointvec 797 }, 798 { 799 .procname = "icmp_ignore_bogus_error_responses", 800 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 801 .maxlen = sizeof(int), 802 .mode = 0644, 803 .proc_handler = proc_dointvec 804 }, 805 { 806 .procname = "icmp_errors_use_inbound_ifaddr", 807 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 808 .maxlen = sizeof(int), 809 .mode = 0644, 810 .proc_handler = proc_dointvec 811 }, 812 { 813 .procname = "icmp_ratelimit", 814 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 815 .maxlen = sizeof(int), 816 .mode = 0644, 817 .proc_handler = proc_dointvec_ms_jiffies, 818 }, 819 { 820 .procname = "icmp_ratemask", 821 .data = &init_net.ipv4.sysctl_icmp_ratemask, 822 .maxlen = sizeof(int), 823 .mode = 0644, 824 .proc_handler = proc_dointvec 825 }, 826 { 827 .procname = "ping_group_range", 828 .data = &init_net.ipv4.ping_group_range.range, 829 .maxlen = sizeof(gid_t)*2, 830 .mode = 0644, 831 .proc_handler = ipv4_ping_group_range, 832 }, 833 { 834 .procname = "tcp_ecn", 835 .data = &init_net.ipv4.sysctl_tcp_ecn, 836 .maxlen = sizeof(int), 837 .mode = 0644, 838 .proc_handler = proc_dointvec 839 }, 840 { 841 .procname = "tcp_ecn_fallback", 842 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 843 .maxlen = sizeof(int), 844 .mode = 0644, 845 .proc_handler = proc_dointvec 846 }, 847 { 848 .procname = "ip_local_port_range", 849 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 850 .data = &init_net.ipv4.ip_local_ports.range, 851 .mode = 0644, 852 .proc_handler = ipv4_local_port_range, 853 }, 854 { 855 .procname = "ip_local_reserved_ports", 856 .data = &init_net.ipv4.sysctl_local_reserved_ports, 857 .maxlen = 65536, 858 .mode = 0644, 859 .proc_handler = proc_do_large_bitmap, 860 }, 861 { 862 .procname = "ip_no_pmtu_disc", 863 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 864 .maxlen = sizeof(int), 865 .mode = 0644, 866 .proc_handler = proc_dointvec 867 }, 868 { 869 .procname = "ip_forward_use_pmtu", 870 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 871 .maxlen = sizeof(int), 872 .mode = 0644, 873 .proc_handler = proc_dointvec, 874 }, 875 { 876 .procname = "ip_nonlocal_bind", 877 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 878 .maxlen = sizeof(int), 879 .mode = 0644, 880 .proc_handler = proc_dointvec 881 }, 882 { 883 .procname = "fwmark_reflect", 884 .data = &init_net.ipv4.sysctl_fwmark_reflect, 885 .maxlen = sizeof(int), 886 .mode = 0644, 887 .proc_handler = proc_dointvec, 888 }, 889 { 890 .procname = "tcp_fwmark_accept", 891 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 892 .maxlen = sizeof(int), 893 .mode = 0644, 894 .proc_handler = proc_dointvec, 895 }, 896 #ifdef CONFIG_NET_L3_MASTER_DEV 897 { 898 .procname = "tcp_l3mdev_accept", 899 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 900 .maxlen = sizeof(int), 901 .mode = 0644, 902 .proc_handler = proc_dointvec_minmax, 903 .extra1 = &zero, 904 .extra2 = &one, 905 }, 906 #endif 907 { 908 .procname = "tcp_mtu_probing", 909 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 910 .maxlen = sizeof(int), 911 .mode = 0644, 912 .proc_handler = proc_dointvec, 913 }, 914 { 915 .procname = "tcp_base_mss", 916 .data = &init_net.ipv4.sysctl_tcp_base_mss, 917 .maxlen = sizeof(int), 918 .mode = 0644, 919 .proc_handler = proc_dointvec, 920 }, 921 { 922 .procname = "tcp_probe_threshold", 923 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 924 .maxlen = sizeof(int), 925 .mode = 0644, 926 .proc_handler = proc_dointvec, 927 }, 928 { 929 .procname = "tcp_probe_interval", 930 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 931 .maxlen = sizeof(int), 932 .mode = 0644, 933 .proc_handler = proc_dointvec, 934 }, 935 { 936 .procname = "igmp_link_local_mcast_reports", 937 .data = &sysctl_igmp_llm_reports, 938 .maxlen = sizeof(int), 939 .mode = 0644, 940 .proc_handler = proc_dointvec 941 }, 942 { 943 .procname = "tcp_keepalive_time", 944 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 945 .maxlen = sizeof(int), 946 .mode = 0644, 947 .proc_handler = proc_dointvec_jiffies, 948 }, 949 { 950 .procname = "tcp_keepalive_probes", 951 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 952 .maxlen = sizeof(int), 953 .mode = 0644, 954 .proc_handler = proc_dointvec 955 }, 956 { 957 .procname = "tcp_keepalive_intvl", 958 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 959 .maxlen = sizeof(int), 960 .mode = 0644, 961 .proc_handler = proc_dointvec_jiffies, 962 }, 963 { } 964 }; 965 966 static __net_init int ipv4_sysctl_init_net(struct net *net) 967 { 968 struct ctl_table *table; 969 970 table = ipv4_net_table; 971 if (!net_eq(net, &init_net)) { 972 int i; 973 974 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 975 if (!table) 976 goto err_alloc; 977 978 /* Update the variables to point into the current struct net */ 979 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 980 table[i].data += (void *)net - (void *)&init_net; 981 } 982 983 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 984 if (!net->ipv4.ipv4_hdr) 985 goto err_reg; 986 987 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 988 if (!net->ipv4.sysctl_local_reserved_ports) 989 goto err_ports; 990 991 return 0; 992 993 err_ports: 994 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 995 err_reg: 996 if (!net_eq(net, &init_net)) 997 kfree(table); 998 err_alloc: 999 return -ENOMEM; 1000 } 1001 1002 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1003 { 1004 struct ctl_table *table; 1005 1006 kfree(net->ipv4.sysctl_local_reserved_ports); 1007 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1008 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1009 kfree(table); 1010 } 1011 1012 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1013 .init = ipv4_sysctl_init_net, 1014 .exit = ipv4_sysctl_exit_net, 1015 }; 1016 1017 static __init int sysctl_ipv4_init(void) 1018 { 1019 struct ctl_table_header *hdr; 1020 1021 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1022 if (!hdr) 1023 return -ENOMEM; 1024 1025 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1026 unregister_net_sysctl_table(hdr); 1027 return -ENOMEM; 1028 } 1029 1030 return 0; 1031 } 1032 1033 __initcall(sysctl_ipv4_init); 1034