xref: /openbmc/linux/net/ipv4/sysctl_net_ipv4.c (revision 90a53e44) 
1 /*
2  * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem.
3  *
4  * Begun April 1, 1996, Mike Shaver.
5  * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS]
6  */
7 
8 #include <linux/mm.h>
9 #include <linux/module.h>
10 #include <linux/sysctl.h>
11 #include <linux/igmp.h>
12 #include <linux/inetdevice.h>
13 #include <linux/seqlock.h>
14 #include <linux/init.h>
15 #include <linux/slab.h>
16 #include <linux/nsproxy.h>
17 #include <linux/swap.h>
18 #include <net/snmp.h>
19 #include <net/icmp.h>
20 #include <net/ip.h>
21 #include <net/route.h>
22 #include <net/tcp.h>
23 #include <net/udp.h>
24 #include <net/cipso_ipv4.h>
25 #include <net/inet_frag.h>
26 #include <net/ping.h>
27 #include <net/protocol.h>
28 
29 static int zero;
30 static int one = 1;
31 static int four = 4;
32 static int thousand = 1000;
33 static int gso_max_segs = GSO_MAX_SEGS;
34 static int tcp_retr1_max = 255;
35 static int ip_local_port_range_min[] = { 1, 1 };
36 static int ip_local_port_range_max[] = { 65535, 65535 };
37 static int tcp_adv_win_scale_min = -31;
38 static int tcp_adv_win_scale_max = 31;
39 static int ip_privileged_port_min;
40 static int ip_privileged_port_max = 65535;
41 static int ip_ttl_min = 1;
42 static int ip_ttl_max = 255;
43 static int tcp_syn_retries_min = 1;
44 static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
45 static int ip_ping_group_range_min[] = { 0, 0 };
46 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
47 
48 /* obsolete */
49 static int sysctl_tcp_low_latency __read_mostly;
50 
51 /* Update system visible IP port range */
52 static void set_local_port_range(struct net *net, int range[2])
53 {
54 	bool same_parity = !((range[0] ^ range[1]) & 1);
55 
56 	write_seqlock_bh(&net->ipv4.ip_local_ports.lock);
57 	if (same_parity && !net->ipv4.ip_local_ports.warned) {
58 		net->ipv4.ip_local_ports.warned = true;
59 		pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n");
60 	}
61 	net->ipv4.ip_local_ports.range[0] = range[0];
62 	net->ipv4.ip_local_ports.range[1] = range[1];
63 	write_sequnlock_bh(&net->ipv4.ip_local_ports.lock);
64 }
65 
66 /* Validate changes from /proc interface. */
67 static int ipv4_local_port_range(struct ctl_table *table, int write,
68 				 void __user *buffer,
69 				 size_t *lenp, loff_t *ppos)
70 {
71 	struct net *net =
72 		container_of(table->data, struct net, ipv4.ip_local_ports.range);
73 	int ret;
74 	int range[2];
75 	struct ctl_table tmp = {
76 		.data = &range,
77 		.maxlen = sizeof(range),
78 		.mode = table->mode,
79 		.extra1 = &ip_local_port_range_min,
80 		.extra2 = &ip_local_port_range_max,
81 	};
82 
83 	inet_get_local_port_range(net, &range[0], &range[1]);
84 
85 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
86 
87 	if (write && ret == 0) {
88 		/* Ensure that the upper limit is not smaller than the lower,
89 		 * and that the lower does not encroach upon the privileged
90 		 * port limit.
91 		 */
92 		if ((range[1] < range[0]) ||
93 		    (range[0] < net->ipv4.sysctl_ip_prot_sock))
94 			ret = -EINVAL;
95 		else
96 			set_local_port_range(net, range);
97 	}
98 
99 	return ret;
100 }
101 
102 /* Validate changes from /proc interface. */
103 static int ipv4_privileged_ports(struct ctl_table *table, int write,
104 				void __user *buffer, size_t *lenp, loff_t *ppos)
105 {
106 	struct net *net = container_of(table->data, struct net,
107 	    ipv4.sysctl_ip_prot_sock);
108 	int ret;
109 	int pports;
110 	int range[2];
111 	struct ctl_table tmp = {
112 		.data = &pports,
113 		.maxlen = sizeof(pports),
114 		.mode = table->mode,
115 		.extra1 = &ip_privileged_port_min,
116 		.extra2 = &ip_privileged_port_max,
117 	};
118 
119 	pports = net->ipv4.sysctl_ip_prot_sock;
120 
121 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
122 
123 	if (write && ret == 0) {
124 		inet_get_local_port_range(net, &range[0], &range[1]);
125 		/* Ensure that the local port range doesn't overlap with the
126 		 * privileged port range.
127 		 */
128 		if (range[0] < pports)
129 			ret = -EINVAL;
130 		else
131 			net->ipv4.sysctl_ip_prot_sock = pports;
132 	}
133 
134 	return ret;
135 }
136 
137 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high)
138 {
139 	kgid_t *data = table->data;
140 	struct net *net =
141 		container_of(table->data, struct net, ipv4.ping_group_range.range);
142 	unsigned int seq;
143 	do {
144 		seq = read_seqbegin(&net->ipv4.ping_group_range.lock);
145 
146 		*low = data[0];
147 		*high = data[1];
148 	} while (read_seqretry(&net->ipv4.ping_group_range.lock, seq));
149 }
150 
151 /* Update system visible IP port range */
152 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high)
153 {
154 	kgid_t *data = table->data;
155 	struct net *net =
156 		container_of(table->data, struct net, ipv4.ping_group_range.range);
157 	write_seqlock(&net->ipv4.ping_group_range.lock);
158 	data[0] = low;
159 	data[1] = high;
160 	write_sequnlock(&net->ipv4.ping_group_range.lock);
161 }
162 
163 /* Validate changes from /proc interface. */
164 static int ipv4_ping_group_range(struct ctl_table *table, int write,
165 				 void __user *buffer,
166 				 size_t *lenp, loff_t *ppos)
167 {
168 	struct user_namespace *user_ns = current_user_ns();
169 	int ret;
170 	gid_t urange[2];
171 	kgid_t low, high;
172 	struct ctl_table tmp = {
173 		.data = &urange,
174 		.maxlen = sizeof(urange),
175 		.mode = table->mode,
176 		.extra1 = &ip_ping_group_range_min,
177 		.extra2 = &ip_ping_group_range_max,
178 	};
179 
180 	inet_get_ping_group_range_table(table, &low, &high);
181 	urange[0] = from_kgid_munged(user_ns, low);
182 	urange[1] = from_kgid_munged(user_ns, high);
183 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
184 
185 	if (write && ret == 0) {
186 		low = make_kgid(user_ns, urange[0]);
187 		high = make_kgid(user_ns, urange[1]);
188 		if (!gid_valid(low) || !gid_valid(high) ||
189 		    (urange[1] < urange[0]) || gid_lt(high, low)) {
190 			low = make_kgid(&init_user_ns, 1);
191 			high = make_kgid(&init_user_ns, 0);
192 		}
193 		set_ping_group_range(table, low, high);
194 	}
195 
196 	return ret;
197 }
198 
199 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
200 				       void __user *buffer, size_t *lenp, loff_t *ppos)
201 {
202 	char val[TCP_CA_NAME_MAX];
203 	struct ctl_table tbl = {
204 		.data = val,
205 		.maxlen = TCP_CA_NAME_MAX,
206 	};
207 	int ret;
208 
209 	tcp_get_default_congestion_control(val);
210 
211 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
212 	if (write && ret == 0)
213 		ret = tcp_set_default_congestion_control(val);
214 	return ret;
215 }
216 
217 static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
218 						 int write,
219 						 void __user *buffer, size_t *lenp,
220 						 loff_t *ppos)
221 {
222 	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
223 	int ret;
224 
225 	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
226 	if (!tbl.data)
227 		return -ENOMEM;
228 	tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
229 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
230 	kfree(tbl.data);
231 	return ret;
232 }
233 
234 static int proc_allowed_congestion_control(struct ctl_table *ctl,
235 					   int write,
236 					   void __user *buffer, size_t *lenp,
237 					   loff_t *ppos)
238 {
239 	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
240 	int ret;
241 
242 	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
243 	if (!tbl.data)
244 		return -ENOMEM;
245 
246 	tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
247 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
248 	if (write && ret == 0)
249 		ret = tcp_set_allowed_congestion_control(tbl.data);
250 	kfree(tbl.data);
251 	return ret;
252 }
253 
254 static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
255 				 void __user *buffer, size_t *lenp,
256 				 loff_t *ppos)
257 {
258 	struct net *net = container_of(table->data, struct net,
259 	    ipv4.sysctl_tcp_fastopen);
260 	struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
261 	struct tcp_fastopen_context *ctxt;
262 	int ret;
263 	u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
264 
265 	tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
266 	if (!tbl.data)
267 		return -ENOMEM;
268 
269 	rcu_read_lock();
270 	ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
271 	if (ctxt)
272 		memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
273 	else
274 		memset(user_key, 0, sizeof(user_key));
275 	rcu_read_unlock();
276 
277 	snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
278 		user_key[0], user_key[1], user_key[2], user_key[3]);
279 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
280 
281 	if (write && ret == 0) {
282 		if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1,
283 			   user_key + 2, user_key + 3) != 4) {
284 			ret = -EINVAL;
285 			goto bad_key;
286 		}
287 		tcp_fastopen_reset_cipher(net, user_key, TCP_FASTOPEN_KEY_LENGTH);
288 	}
289 
290 bad_key:
291 	pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
292 	       user_key[0], user_key[1], user_key[2], user_key[3],
293 	       (char *)tbl.data, ret);
294 	kfree(tbl.data);
295 	return ret;
296 }
297 
298 static void proc_configure_early_demux(int enabled, int protocol)
299 {
300 	struct net_protocol *ipprot;
301 #if IS_ENABLED(CONFIG_IPV6)
302 	struct inet6_protocol *ip6prot;
303 #endif
304 
305 	rcu_read_lock();
306 
307 	ipprot = rcu_dereference(inet_protos[protocol]);
308 	if (ipprot)
309 		ipprot->early_demux = enabled ? ipprot->early_demux_handler :
310 						NULL;
311 
312 #if IS_ENABLED(CONFIG_IPV6)
313 	ip6prot = rcu_dereference(inet6_protos[protocol]);
314 	if (ip6prot)
315 		ip6prot->early_demux = enabled ? ip6prot->early_demux_handler :
316 						 NULL;
317 #endif
318 	rcu_read_unlock();
319 }
320 
321 static int proc_tcp_early_demux(struct ctl_table *table, int write,
322 				void __user *buffer, size_t *lenp, loff_t *ppos)
323 {
324 	int ret = 0;
325 
326 	ret = proc_dointvec(table, write, buffer, lenp, ppos);
327 
328 	if (write && !ret) {
329 		int enabled = init_net.ipv4.sysctl_tcp_early_demux;
330 
331 		proc_configure_early_demux(enabled, IPPROTO_TCP);
332 	}
333 
334 	return ret;
335 }
336 
337 static int proc_udp_early_demux(struct ctl_table *table, int write,
338 				void __user *buffer, size_t *lenp, loff_t *ppos)
339 {
340 	int ret = 0;
341 
342 	ret = proc_dointvec(table, write, buffer, lenp, ppos);
343 
344 	if (write && !ret) {
345 		int enabled = init_net.ipv4.sysctl_udp_early_demux;
346 
347 		proc_configure_early_demux(enabled, IPPROTO_UDP);
348 	}
349 
350 	return ret;
351 }
352 
353 static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
354 					     int write,
355 					     void __user *buffer,
356 					     size_t *lenp, loff_t *ppos)
357 {
358 	struct net *net = container_of(table->data, struct net,
359 	    ipv4.sysctl_tcp_fastopen_blackhole_timeout);
360 	int ret;
361 
362 	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
363 	if (write && ret == 0)
364 		atomic_set(&net->ipv4.tfo_active_disable_times, 0);
365 
366 	return ret;
367 }
368 
369 static int proc_tcp_available_ulp(struct ctl_table *ctl,
370 				  int write,
371 				  void __user *buffer, size_t *lenp,
372 				  loff_t *ppos)
373 {
374 	struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, };
375 	int ret;
376 
377 	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
378 	if (!tbl.data)
379 		return -ENOMEM;
380 	tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX);
381 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
382 	kfree(tbl.data);
383 
384 	return ret;
385 }
386 
387 static struct ctl_table ipv4_table[] = {
388 	{
389 		.procname	= "tcp_retrans_collapse",
390 		.data		= &sysctl_tcp_retrans_collapse,
391 		.maxlen		= sizeof(int),
392 		.mode		= 0644,
393 		.proc_handler	= proc_dointvec
394 	},
395 	{
396 		.procname	= "tcp_max_orphans",
397 		.data		= &sysctl_tcp_max_orphans,
398 		.maxlen		= sizeof(int),
399 		.mode		= 0644,
400 		.proc_handler	= proc_dointvec
401 	},
402 	{
403 		.procname	= "tcp_abort_on_overflow",
404 		.data		= &sysctl_tcp_abort_on_overflow,
405 		.maxlen		= sizeof(int),
406 		.mode		= 0644,
407 		.proc_handler	= proc_dointvec
408 	},
409 	{
410 		.procname	= "tcp_stdurg",
411 		.data		= &sysctl_tcp_stdurg,
412 		.maxlen		= sizeof(int),
413 		.mode		= 0644,
414 		.proc_handler	= proc_dointvec
415 	},
416 	{
417 		.procname	= "tcp_rfc1337",
418 		.data		= &sysctl_tcp_rfc1337,
419 		.maxlen		= sizeof(int),
420 		.mode		= 0644,
421 		.proc_handler	= proc_dointvec
422 	},
423 	{
424 		.procname	= "inet_peer_threshold",
425 		.data		= &inet_peer_threshold,
426 		.maxlen		= sizeof(int),
427 		.mode		= 0644,
428 		.proc_handler	= proc_dointvec
429 	},
430 	{
431 		.procname	= "inet_peer_minttl",
432 		.data		= &inet_peer_minttl,
433 		.maxlen		= sizeof(int),
434 		.mode		= 0644,
435 		.proc_handler	= proc_dointvec_jiffies,
436 	},
437 	{
438 		.procname	= "inet_peer_maxttl",
439 		.data		= &inet_peer_maxttl,
440 		.maxlen		= sizeof(int),
441 		.mode		= 0644,
442 		.proc_handler	= proc_dointvec_jiffies,
443 	},
444 	{
445 		.procname	= "tcp_fack",
446 		.data		= &sysctl_tcp_fack,
447 		.maxlen		= sizeof(int),
448 		.mode		= 0644,
449 		.proc_handler	= proc_dointvec
450 	},
451 	{
452 		.procname	= "tcp_recovery",
453 		.data		= &sysctl_tcp_recovery,
454 		.maxlen		= sizeof(int),
455 		.mode		= 0644,
456 		.proc_handler	= proc_dointvec,
457 	},
458 	{
459 		.procname	= "tcp_max_reordering",
460 		.data		= &sysctl_tcp_max_reordering,
461 		.maxlen		= sizeof(int),
462 		.mode		= 0644,
463 		.proc_handler	= proc_dointvec
464 	},
465 	{
466 		.procname	= "tcp_dsack",
467 		.data		= &sysctl_tcp_dsack,
468 		.maxlen		= sizeof(int),
469 		.mode		= 0644,
470 		.proc_handler	= proc_dointvec
471 	},
472 	{
473 		.procname	= "tcp_mem",
474 		.maxlen		= sizeof(sysctl_tcp_mem),
475 		.data		= &sysctl_tcp_mem,
476 		.mode		= 0644,
477 		.proc_handler	= proc_doulongvec_minmax,
478 	},
479 	{
480 		.procname	= "tcp_wmem",
481 		.data		= &sysctl_tcp_wmem,
482 		.maxlen		= sizeof(sysctl_tcp_wmem),
483 		.mode		= 0644,
484 		.proc_handler	= proc_dointvec_minmax,
485 		.extra1		= &one,
486 	},
487 	{
488 		.procname	= "tcp_rmem",
489 		.data		= &sysctl_tcp_rmem,
490 		.maxlen		= sizeof(sysctl_tcp_rmem),
491 		.mode		= 0644,
492 		.proc_handler	= proc_dointvec_minmax,
493 		.extra1		= &one,
494 	},
495 	{
496 		.procname	= "tcp_app_win",
497 		.data		= &sysctl_tcp_app_win,
498 		.maxlen		= sizeof(int),
499 		.mode		= 0644,
500 		.proc_handler	= proc_dointvec
501 	},
502 	{
503 		.procname	= "tcp_adv_win_scale",
504 		.data		= &sysctl_tcp_adv_win_scale,
505 		.maxlen		= sizeof(int),
506 		.mode		= 0644,
507 		.proc_handler	= proc_dointvec_minmax,
508 		.extra1		= &tcp_adv_win_scale_min,
509 		.extra2		= &tcp_adv_win_scale_max,
510 	},
511 	{
512 		.procname	= "tcp_frto",
513 		.data		= &sysctl_tcp_frto,
514 		.maxlen		= sizeof(int),
515 		.mode		= 0644,
516 		.proc_handler	= proc_dointvec
517 	},
518 	{
519 		.procname	= "tcp_min_rtt_wlen",
520 		.data		= &sysctl_tcp_min_rtt_wlen,
521 		.maxlen		= sizeof(int),
522 		.mode		= 0644,
523 		.proc_handler	= proc_dointvec
524 	},
525 	{
526 		.procname	= "tcp_low_latency",
527 		.data		= &sysctl_tcp_low_latency,
528 		.maxlen		= sizeof(int),
529 		.mode		= 0644,
530 		.proc_handler	= proc_dointvec
531 	},
532 	{
533 		.procname	= "tcp_no_metrics_save",
534 		.data		= &sysctl_tcp_nometrics_save,
535 		.maxlen		= sizeof(int),
536 		.mode		= 0644,
537 		.proc_handler	= proc_dointvec,
538 	},
539 	{
540 		.procname	= "tcp_moderate_rcvbuf",
541 		.data		= &sysctl_tcp_moderate_rcvbuf,
542 		.maxlen		= sizeof(int),
543 		.mode		= 0644,
544 		.proc_handler	= proc_dointvec,
545 	},
546 	{
547 		.procname	= "tcp_tso_win_divisor",
548 		.data		= &sysctl_tcp_tso_win_divisor,
549 		.maxlen		= sizeof(int),
550 		.mode		= 0644,
551 		.proc_handler	= proc_dointvec,
552 	},
553 	{
554 		.procname	= "tcp_congestion_control",
555 		.mode		= 0644,
556 		.maxlen		= TCP_CA_NAME_MAX,
557 		.proc_handler	= proc_tcp_congestion_control,
558 	},
559 	{
560 		.procname	= "tcp_workaround_signed_windows",
561 		.data		= &sysctl_tcp_workaround_signed_windows,
562 		.maxlen		= sizeof(int),
563 		.mode		= 0644,
564 		.proc_handler	= proc_dointvec
565 	},
566 	{
567 		.procname	= "tcp_limit_output_bytes",
568 		.data		= &sysctl_tcp_limit_output_bytes,
569 		.maxlen		= sizeof(int),
570 		.mode		= 0644,
571 		.proc_handler	= proc_dointvec
572 	},
573 	{
574 		.procname	= "tcp_challenge_ack_limit",
575 		.data		= &sysctl_tcp_challenge_ack_limit,
576 		.maxlen		= sizeof(int),
577 		.mode		= 0644,
578 		.proc_handler	= proc_dointvec
579 	},
580 	{
581 		.procname	= "tcp_slow_start_after_idle",
582 		.data		= &sysctl_tcp_slow_start_after_idle,
583 		.maxlen		= sizeof(int),
584 		.mode		= 0644,
585 		.proc_handler	= proc_dointvec
586 	},
587 #ifdef CONFIG_NETLABEL
588 	{
589 		.procname	= "cipso_cache_enable",
590 		.data		= &cipso_v4_cache_enabled,
591 		.maxlen		= sizeof(int),
592 		.mode		= 0644,
593 		.proc_handler	= proc_dointvec,
594 	},
595 	{
596 		.procname	= "cipso_cache_bucket_size",
597 		.data		= &cipso_v4_cache_bucketsize,
598 		.maxlen		= sizeof(int),
599 		.mode		= 0644,
600 		.proc_handler	= proc_dointvec,
601 	},
602 	{
603 		.procname	= "cipso_rbm_optfmt",
604 		.data		= &cipso_v4_rbm_optfmt,
605 		.maxlen		= sizeof(int),
606 		.mode		= 0644,
607 		.proc_handler	= proc_dointvec,
608 	},
609 	{
610 		.procname	= "cipso_rbm_strictvalid",
611 		.data		= &cipso_v4_rbm_strictvalid,
612 		.maxlen		= sizeof(int),
613 		.mode		= 0644,
614 		.proc_handler	= proc_dointvec,
615 	},
616 #endif /* CONFIG_NETLABEL */
617 	{
618 		.procname	= "tcp_available_congestion_control",
619 		.maxlen		= TCP_CA_BUF_MAX,
620 		.mode		= 0444,
621 		.proc_handler   = proc_tcp_available_congestion_control,
622 	},
623 	{
624 		.procname	= "tcp_allowed_congestion_control",
625 		.maxlen		= TCP_CA_BUF_MAX,
626 		.mode		= 0644,
627 		.proc_handler   = proc_allowed_congestion_control,
628 	},
629 	{
630 		.procname       = "tcp_thin_linear_timeouts",
631 		.data           = &sysctl_tcp_thin_linear_timeouts,
632 		.maxlen         = sizeof(int),
633 		.mode           = 0644,
634 		.proc_handler   = proc_dointvec
635 	},
636 	{
637 		.procname	= "tcp_early_retrans",
638 		.data		= &sysctl_tcp_early_retrans,
639 		.maxlen		= sizeof(int),
640 		.mode		= 0644,
641 		.proc_handler	= proc_dointvec_minmax,
642 		.extra1		= &zero,
643 		.extra2		= &four,
644 	},
645 	{
646 		.procname	= "tcp_min_tso_segs",
647 		.data		= &sysctl_tcp_min_tso_segs,
648 		.maxlen		= sizeof(int),
649 		.mode		= 0644,
650 		.proc_handler	= proc_dointvec_minmax,
651 		.extra1		= &one,
652 		.extra2		= &gso_max_segs,
653 	},
654 	{
655 		.procname	= "tcp_pacing_ss_ratio",
656 		.data		= &sysctl_tcp_pacing_ss_ratio,
657 		.maxlen		= sizeof(int),
658 		.mode		= 0644,
659 		.proc_handler	= proc_dointvec_minmax,
660 		.extra1		= &zero,
661 		.extra2		= &thousand,
662 	},
663 	{
664 		.procname	= "tcp_pacing_ca_ratio",
665 		.data		= &sysctl_tcp_pacing_ca_ratio,
666 		.maxlen		= sizeof(int),
667 		.mode		= 0644,
668 		.proc_handler	= proc_dointvec_minmax,
669 		.extra1		= &zero,
670 		.extra2		= &thousand,
671 	},
672 	{
673 		.procname	= "tcp_autocorking",
674 		.data		= &sysctl_tcp_autocorking,
675 		.maxlen		= sizeof(int),
676 		.mode		= 0644,
677 		.proc_handler	= proc_dointvec_minmax,
678 		.extra1		= &zero,
679 		.extra2		= &one,
680 	},
681 	{
682 		.procname	= "tcp_invalid_ratelimit",
683 		.data		= &sysctl_tcp_invalid_ratelimit,
684 		.maxlen		= sizeof(int),
685 		.mode		= 0644,
686 		.proc_handler	= proc_dointvec_ms_jiffies,
687 	},
688 	{
689 		.procname	= "tcp_available_ulp",
690 		.maxlen		= TCP_ULP_BUF_MAX,
691 		.mode		= 0444,
692 		.proc_handler   = proc_tcp_available_ulp,
693 	},
694 	{
695 		.procname	= "icmp_msgs_per_sec",
696 		.data		= &sysctl_icmp_msgs_per_sec,
697 		.maxlen		= sizeof(int),
698 		.mode		= 0644,
699 		.proc_handler	= proc_dointvec_minmax,
700 		.extra1		= &zero,
701 	},
702 	{
703 		.procname	= "icmp_msgs_burst",
704 		.data		= &sysctl_icmp_msgs_burst,
705 		.maxlen		= sizeof(int),
706 		.mode		= 0644,
707 		.proc_handler	= proc_dointvec_minmax,
708 		.extra1		= &zero,
709 	},
710 	{
711 		.procname	= "udp_mem",
712 		.data		= &sysctl_udp_mem,
713 		.maxlen		= sizeof(sysctl_udp_mem),
714 		.mode		= 0644,
715 		.proc_handler	= proc_doulongvec_minmax,
716 	},
717 	{
718 		.procname	= "udp_rmem_min",
719 		.data		= &sysctl_udp_rmem_min,
720 		.maxlen		= sizeof(sysctl_udp_rmem_min),
721 		.mode		= 0644,
722 		.proc_handler	= proc_dointvec_minmax,
723 		.extra1		= &one
724 	},
725 	{
726 		.procname	= "udp_wmem_min",
727 		.data		= &sysctl_udp_wmem_min,
728 		.maxlen		= sizeof(sysctl_udp_wmem_min),
729 		.mode		= 0644,
730 		.proc_handler	= proc_dointvec_minmax,
731 		.extra1		= &one
732 	},
733 	{ }
734 };
735 
736 static struct ctl_table ipv4_net_table[] = {
737 	{
738 		.procname	= "icmp_echo_ignore_all",
739 		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_all,
740 		.maxlen		= sizeof(int),
741 		.mode		= 0644,
742 		.proc_handler	= proc_dointvec
743 	},
744 	{
745 		.procname	= "icmp_echo_ignore_broadcasts",
746 		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
747 		.maxlen		= sizeof(int),
748 		.mode		= 0644,
749 		.proc_handler	= proc_dointvec
750 	},
751 	{
752 		.procname	= "icmp_ignore_bogus_error_responses",
753 		.data		= &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
754 		.maxlen		= sizeof(int),
755 		.mode		= 0644,
756 		.proc_handler	= proc_dointvec
757 	},
758 	{
759 		.procname	= "icmp_errors_use_inbound_ifaddr",
760 		.data		= &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
761 		.maxlen		= sizeof(int),
762 		.mode		= 0644,
763 		.proc_handler	= proc_dointvec
764 	},
765 	{
766 		.procname	= "icmp_ratelimit",
767 		.data		= &init_net.ipv4.sysctl_icmp_ratelimit,
768 		.maxlen		= sizeof(int),
769 		.mode		= 0644,
770 		.proc_handler	= proc_dointvec_ms_jiffies,
771 	},
772 	{
773 		.procname	= "icmp_ratemask",
774 		.data		= &init_net.ipv4.sysctl_icmp_ratemask,
775 		.maxlen		= sizeof(int),
776 		.mode		= 0644,
777 		.proc_handler	= proc_dointvec
778 	},
779 	{
780 		.procname	= "ping_group_range",
781 		.data		= &init_net.ipv4.ping_group_range.range,
782 		.maxlen		= sizeof(gid_t)*2,
783 		.mode		= 0644,
784 		.proc_handler	= ipv4_ping_group_range,
785 	},
786 	{
787 		.procname	= "tcp_ecn",
788 		.data		= &init_net.ipv4.sysctl_tcp_ecn,
789 		.maxlen		= sizeof(int),
790 		.mode		= 0644,
791 		.proc_handler	= proc_dointvec
792 	},
793 	{
794 		.procname	= "tcp_ecn_fallback",
795 		.data		= &init_net.ipv4.sysctl_tcp_ecn_fallback,
796 		.maxlen		= sizeof(int),
797 		.mode		= 0644,
798 		.proc_handler	= proc_dointvec
799 	},
800 	{
801 		.procname	= "ip_dynaddr",
802 		.data		= &init_net.ipv4.sysctl_ip_dynaddr,
803 		.maxlen		= sizeof(int),
804 		.mode		= 0644,
805 		.proc_handler	= proc_dointvec
806 	},
807 	{
808 		.procname	= "ip_early_demux",
809 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
810 		.maxlen		= sizeof(int),
811 		.mode		= 0644,
812 		.proc_handler	= proc_dointvec
813 	},
814 	{
815 		.procname       = "udp_early_demux",
816 		.data           = &init_net.ipv4.sysctl_udp_early_demux,
817 		.maxlen         = sizeof(int),
818 		.mode           = 0644,
819 		.proc_handler   = proc_udp_early_demux
820 	},
821 	{
822 		.procname       = "tcp_early_demux",
823 		.data           = &init_net.ipv4.sysctl_tcp_early_demux,
824 		.maxlen         = sizeof(int),
825 		.mode           = 0644,
826 		.proc_handler   = proc_tcp_early_demux
827 	},
828 	{
829 		.procname	= "ip_default_ttl",
830 		.data		= &init_net.ipv4.sysctl_ip_default_ttl,
831 		.maxlen		= sizeof(int),
832 		.mode		= 0644,
833 		.proc_handler	= proc_dointvec_minmax,
834 		.extra1		= &ip_ttl_min,
835 		.extra2		= &ip_ttl_max,
836 	},
837 	{
838 		.procname	= "ip_local_port_range",
839 		.maxlen		= sizeof(init_net.ipv4.ip_local_ports.range),
840 		.data		= &init_net.ipv4.ip_local_ports.range,
841 		.mode		= 0644,
842 		.proc_handler	= ipv4_local_port_range,
843 	},
844 	{
845 		.procname	= "ip_local_reserved_ports",
846 		.data		= &init_net.ipv4.sysctl_local_reserved_ports,
847 		.maxlen		= 65536,
848 		.mode		= 0644,
849 		.proc_handler	= proc_do_large_bitmap,
850 	},
851 	{
852 		.procname	= "ip_no_pmtu_disc",
853 		.data		= &init_net.ipv4.sysctl_ip_no_pmtu_disc,
854 		.maxlen		= sizeof(int),
855 		.mode		= 0644,
856 		.proc_handler	= proc_dointvec
857 	},
858 	{
859 		.procname	= "ip_forward_use_pmtu",
860 		.data		= &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
861 		.maxlen		= sizeof(int),
862 		.mode		= 0644,
863 		.proc_handler	= proc_dointvec,
864 	},
865 	{
866 		.procname	= "ip_nonlocal_bind",
867 		.data		= &init_net.ipv4.sysctl_ip_nonlocal_bind,
868 		.maxlen		= sizeof(int),
869 		.mode		= 0644,
870 		.proc_handler	= proc_dointvec
871 	},
872 	{
873 		.procname	= "fwmark_reflect",
874 		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
875 		.maxlen		= sizeof(int),
876 		.mode		= 0644,
877 		.proc_handler	= proc_dointvec,
878 	},
879 	{
880 		.procname	= "tcp_fwmark_accept",
881 		.data		= &init_net.ipv4.sysctl_tcp_fwmark_accept,
882 		.maxlen		= sizeof(int),
883 		.mode		= 0644,
884 		.proc_handler	= proc_dointvec,
885 	},
886 #ifdef CONFIG_NET_L3_MASTER_DEV
887 	{
888 		.procname	= "tcp_l3mdev_accept",
889 		.data		= &init_net.ipv4.sysctl_tcp_l3mdev_accept,
890 		.maxlen		= sizeof(int),
891 		.mode		= 0644,
892 		.proc_handler	= proc_dointvec_minmax,
893 		.extra1		= &zero,
894 		.extra2		= &one,
895 	},
896 #endif
897 	{
898 		.procname	= "tcp_mtu_probing",
899 		.data		= &init_net.ipv4.sysctl_tcp_mtu_probing,
900 		.maxlen		= sizeof(int),
901 		.mode		= 0644,
902 		.proc_handler	= proc_dointvec,
903 	},
904 	{
905 		.procname	= "tcp_base_mss",
906 		.data		= &init_net.ipv4.sysctl_tcp_base_mss,
907 		.maxlen		= sizeof(int),
908 		.mode		= 0644,
909 		.proc_handler	= proc_dointvec,
910 	},
911 	{
912 		.procname	= "tcp_probe_threshold",
913 		.data		= &init_net.ipv4.sysctl_tcp_probe_threshold,
914 		.maxlen		= sizeof(int),
915 		.mode		= 0644,
916 		.proc_handler	= proc_dointvec,
917 	},
918 	{
919 		.procname	= "tcp_probe_interval",
920 		.data		= &init_net.ipv4.sysctl_tcp_probe_interval,
921 		.maxlen		= sizeof(int),
922 		.mode		= 0644,
923 		.proc_handler	= proc_dointvec,
924 	},
925 	{
926 		.procname	= "igmp_link_local_mcast_reports",
927 		.data		= &init_net.ipv4.sysctl_igmp_llm_reports,
928 		.maxlen		= sizeof(int),
929 		.mode		= 0644,
930 		.proc_handler	= proc_dointvec
931 	},
932 	{
933 		.procname	= "igmp_max_memberships",
934 		.data		= &init_net.ipv4.sysctl_igmp_max_memberships,
935 		.maxlen		= sizeof(int),
936 		.mode		= 0644,
937 		.proc_handler	= proc_dointvec
938 	},
939 	{
940 		.procname	= "igmp_max_msf",
941 		.data		= &init_net.ipv4.sysctl_igmp_max_msf,
942 		.maxlen		= sizeof(int),
943 		.mode		= 0644,
944 		.proc_handler	= proc_dointvec
945 	},
946 #ifdef CONFIG_IP_MULTICAST
947 	{
948 		.procname	= "igmp_qrv",
949 		.data		= &init_net.ipv4.sysctl_igmp_qrv,
950 		.maxlen		= sizeof(int),
951 		.mode		= 0644,
952 		.proc_handler	= proc_dointvec_minmax,
953 		.extra1		= &one
954 	},
955 #endif
956 	{
957 		.procname	= "tcp_keepalive_time",
958 		.data		= &init_net.ipv4.sysctl_tcp_keepalive_time,
959 		.maxlen		= sizeof(int),
960 		.mode		= 0644,
961 		.proc_handler	= proc_dointvec_jiffies,
962 	},
963 	{
964 		.procname	= "tcp_keepalive_probes",
965 		.data		= &init_net.ipv4.sysctl_tcp_keepalive_probes,
966 		.maxlen		= sizeof(int),
967 		.mode		= 0644,
968 		.proc_handler	= proc_dointvec
969 	},
970 	{
971 		.procname	= "tcp_keepalive_intvl",
972 		.data		= &init_net.ipv4.sysctl_tcp_keepalive_intvl,
973 		.maxlen		= sizeof(int),
974 		.mode		= 0644,
975 		.proc_handler	= proc_dointvec_jiffies,
976 	},
977 	{
978 		.procname	= "tcp_syn_retries",
979 		.data		= &init_net.ipv4.sysctl_tcp_syn_retries,
980 		.maxlen		= sizeof(int),
981 		.mode		= 0644,
982 		.proc_handler	= proc_dointvec_minmax,
983 		.extra1		= &tcp_syn_retries_min,
984 		.extra2		= &tcp_syn_retries_max
985 	},
986 	{
987 		.procname	= "tcp_synack_retries",
988 		.data		= &init_net.ipv4.sysctl_tcp_synack_retries,
989 		.maxlen		= sizeof(int),
990 		.mode		= 0644,
991 		.proc_handler	= proc_dointvec
992 	},
993 #ifdef CONFIG_SYN_COOKIES
994 	{
995 		.procname	= "tcp_syncookies",
996 		.data		= &init_net.ipv4.sysctl_tcp_syncookies,
997 		.maxlen		= sizeof(int),
998 		.mode		= 0644,
999 		.proc_handler	= proc_dointvec
1000 	},
1001 #endif
1002 	{
1003 		.procname	= "tcp_reordering",
1004 		.data		= &init_net.ipv4.sysctl_tcp_reordering,
1005 		.maxlen		= sizeof(int),
1006 		.mode		= 0644,
1007 		.proc_handler	= proc_dointvec
1008 	},
1009 	{
1010 		.procname	= "tcp_retries1",
1011 		.data		= &init_net.ipv4.sysctl_tcp_retries1,
1012 		.maxlen		= sizeof(int),
1013 		.mode		= 0644,
1014 		.proc_handler	= proc_dointvec_minmax,
1015 		.extra2		= &tcp_retr1_max
1016 	},
1017 	{
1018 		.procname	= "tcp_retries2",
1019 		.data		= &init_net.ipv4.sysctl_tcp_retries2,
1020 		.maxlen		= sizeof(int),
1021 		.mode		= 0644,
1022 		.proc_handler	= proc_dointvec
1023 	},
1024 	{
1025 		.procname	= "tcp_orphan_retries",
1026 		.data		= &init_net.ipv4.sysctl_tcp_orphan_retries,
1027 		.maxlen		= sizeof(int),
1028 		.mode		= 0644,
1029 		.proc_handler	= proc_dointvec
1030 	},
1031 	{
1032 		.procname	= "tcp_fin_timeout",
1033 		.data		= &init_net.ipv4.sysctl_tcp_fin_timeout,
1034 		.maxlen		= sizeof(int),
1035 		.mode		= 0644,
1036 		.proc_handler	= proc_dointvec_jiffies,
1037 	},
1038 	{
1039 		.procname	= "tcp_notsent_lowat",
1040 		.data		= &init_net.ipv4.sysctl_tcp_notsent_lowat,
1041 		.maxlen		= sizeof(unsigned int),
1042 		.mode		= 0644,
1043 		.proc_handler	= proc_douintvec,
1044 	},
1045 	{
1046 		.procname	= "tcp_tw_reuse",
1047 		.data		= &init_net.ipv4.sysctl_tcp_tw_reuse,
1048 		.maxlen		= sizeof(int),
1049 		.mode		= 0644,
1050 		.proc_handler	= proc_dointvec
1051 	},
1052 	{
1053 		.procname	= "tcp_max_tw_buckets",
1054 		.data		= &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets,
1055 		.maxlen		= sizeof(int),
1056 		.mode		= 0644,
1057 		.proc_handler	= proc_dointvec
1058 	},
1059 	{
1060 		.procname	= "tcp_max_syn_backlog",
1061 		.data		= &init_net.ipv4.sysctl_max_syn_backlog,
1062 		.maxlen		= sizeof(int),
1063 		.mode		= 0644,
1064 		.proc_handler	= proc_dointvec
1065 	},
1066 	{
1067 		.procname	= "tcp_fastopen",
1068 		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1069 		.maxlen		= sizeof(int),
1070 		.mode		= 0644,
1071 		.proc_handler	= proc_dointvec,
1072 	},
1073 	{
1074 		.procname	= "tcp_fastopen_key",
1075 		.mode		= 0600,
1076 		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1077 		.maxlen		= ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
1078 		.proc_handler	= proc_tcp_fastopen_key,
1079 	},
1080 	{
1081 		.procname	= "tcp_fastopen_blackhole_timeout_sec",
1082 		.data		= &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout,
1083 		.maxlen		= sizeof(int),
1084 		.mode		= 0644,
1085 		.proc_handler	= proc_tfo_blackhole_detect_timeout,
1086 		.extra1		= &zero,
1087 	},
1088 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1089 	{
1090 		.procname	= "fib_multipath_use_neigh",
1091 		.data		= &init_net.ipv4.sysctl_fib_multipath_use_neigh,
1092 		.maxlen		= sizeof(int),
1093 		.mode		= 0644,
1094 		.proc_handler	= proc_dointvec_minmax,
1095 		.extra1		= &zero,
1096 		.extra2		= &one,
1097 	},
1098 	{
1099 		.procname	= "fib_multipath_hash_policy",
1100 		.data		= &init_net.ipv4.sysctl_fib_multipath_hash_policy,
1101 		.maxlen		= sizeof(int),
1102 		.mode		= 0644,
1103 		.proc_handler	= proc_dointvec_minmax,
1104 		.extra1		= &zero,
1105 		.extra2		= &one,
1106 	},
1107 #endif
1108 	{
1109 		.procname	= "ip_unprivileged_port_start",
1110 		.maxlen		= sizeof(int),
1111 		.data		= &init_net.ipv4.sysctl_ip_prot_sock,
1112 		.mode		= 0644,
1113 		.proc_handler	= ipv4_privileged_ports,
1114 	},
1115 #ifdef CONFIG_NET_L3_MASTER_DEV
1116 	{
1117 		.procname	= "udp_l3mdev_accept",
1118 		.data		= &init_net.ipv4.sysctl_udp_l3mdev_accept,
1119 		.maxlen		= sizeof(int),
1120 		.mode		= 0644,
1121 		.proc_handler	= proc_dointvec_minmax,
1122 		.extra1		= &zero,
1123 		.extra2		= &one,
1124 	},
1125 #endif
1126 	{
1127 		.procname	= "tcp_sack",
1128 		.data		= &init_net.ipv4.sysctl_tcp_sack,
1129 		.maxlen		= sizeof(int),
1130 		.mode		= 0644,
1131 		.proc_handler	= proc_dointvec
1132 	},
1133 	{
1134 		.procname	= "tcp_window_scaling",
1135 		.data		= &init_net.ipv4.sysctl_tcp_window_scaling,
1136 		.maxlen		= sizeof(int),
1137 		.mode		= 0644,
1138 		.proc_handler	= proc_dointvec
1139 	},
1140 	{
1141 		.procname	= "tcp_timestamps",
1142 		.data		= &init_net.ipv4.sysctl_tcp_timestamps,
1143 		.maxlen		= sizeof(int),
1144 		.mode		= 0644,
1145 		.proc_handler	= proc_dointvec
1146 	},
1147 	{ }
1148 };
1149 
1150 static __net_init int ipv4_sysctl_init_net(struct net *net)
1151 {
1152 	struct ctl_table *table;
1153 
1154 	table = ipv4_net_table;
1155 	if (!net_eq(net, &init_net)) {
1156 		int i;
1157 
1158 		table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
1159 		if (!table)
1160 			goto err_alloc;
1161 
1162 		/* Update the variables to point into the current struct net */
1163 		for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++)
1164 			table[i].data += (void *)net - (void *)&init_net;
1165 	}
1166 
1167 	net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
1168 	if (!net->ipv4.ipv4_hdr)
1169 		goto err_reg;
1170 
1171 	net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
1172 	if (!net->ipv4.sysctl_local_reserved_ports)
1173 		goto err_ports;
1174 
1175 	return 0;
1176 
1177 err_ports:
1178 	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1179 err_reg:
1180 	if (!net_eq(net, &init_net))
1181 		kfree(table);
1182 err_alloc:
1183 	return -ENOMEM;
1184 }
1185 
1186 static __net_exit void ipv4_sysctl_exit_net(struct net *net)
1187 {
1188 	struct ctl_table *table;
1189 
1190 	kfree(net->ipv4.sysctl_local_reserved_ports);
1191 	table = net->ipv4.ipv4_hdr->ctl_table_arg;
1192 	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1193 	kfree(table);
1194 }
1195 
1196 static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
1197 	.init = ipv4_sysctl_init_net,
1198 	.exit = ipv4_sysctl_exit_net,
1199 };
1200 
1201 static __init int sysctl_ipv4_init(void)
1202 {
1203 	struct ctl_table_header *hdr;
1204 
1205 	hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
1206 	if (!hdr)
1207 		return -ENOMEM;
1208 
1209 	if (register_pernet_subsys(&ipv4_sysctl_ops)) {
1210 		unregister_net_sysctl_table(hdr);
1211 		return -ENOMEM;
1212 	}
1213 
1214 	return 0;
1215 }
1216 
1217 __initcall(sysctl_ipv4_init);
1218