1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 #include <net/tcp_memcontrol.h> 28 29 static int zero; 30 static int one = 1; 31 static int four = 4; 32 static int gso_max_segs = GSO_MAX_SEGS; 33 static int tcp_retr1_max = 255; 34 static int ip_local_port_range_min[] = { 1, 1 }; 35 static int ip_local_port_range_max[] = { 65535, 65535 }; 36 static int tcp_adv_win_scale_min = -31; 37 static int tcp_adv_win_scale_max = 31; 38 static int ip_ttl_min = 1; 39 static int ip_ttl_max = 255; 40 static int tcp_syn_retries_min = 1; 41 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 42 static int ip_ping_group_range_min[] = { 0, 0 }; 43 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 44 45 /* Update system visible IP port range */ 46 static void set_local_port_range(struct net *net, int range[2]) 47 { 48 bool same_parity = !((range[0] ^ range[1]) & 1); 49 50 write_seqlock(&net->ipv4.ip_local_ports.lock); 51 if (same_parity && !net->ipv4.ip_local_ports.warned) { 52 net->ipv4.ip_local_ports.warned = true; 53 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 54 } 55 net->ipv4.ip_local_ports.range[0] = range[0]; 56 net->ipv4.ip_local_ports.range[1] = range[1]; 57 write_sequnlock(&net->ipv4.ip_local_ports.lock); 58 } 59 60 /* Validate changes from /proc interface. */ 61 static int ipv4_local_port_range(struct ctl_table *table, int write, 62 void __user *buffer, 63 size_t *lenp, loff_t *ppos) 64 { 65 struct net *net = 66 container_of(table->data, struct net, ipv4.ip_local_ports.range); 67 int ret; 68 int range[2]; 69 struct ctl_table tmp = { 70 .data = &range, 71 .maxlen = sizeof(range), 72 .mode = table->mode, 73 .extra1 = &ip_local_port_range_min, 74 .extra2 = &ip_local_port_range_max, 75 }; 76 77 inet_get_local_port_range(net, &range[0], &range[1]); 78 79 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 80 81 if (write && ret == 0) { 82 if (range[1] < range[0]) 83 ret = -EINVAL; 84 else 85 set_local_port_range(net, range); 86 } 87 88 return ret; 89 } 90 91 92 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 93 { 94 kgid_t *data = table->data; 95 struct net *net = 96 container_of(table->data, struct net, ipv4.ping_group_range.range); 97 unsigned int seq; 98 do { 99 seq = read_seqbegin(&net->ipv4.ip_local_ports.lock); 100 101 *low = data[0]; 102 *high = data[1]; 103 } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq)); 104 } 105 106 /* Update system visible IP port range */ 107 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 108 { 109 kgid_t *data = table->data; 110 struct net *net = 111 container_of(table->data, struct net, ipv4.ping_group_range.range); 112 write_seqlock(&net->ipv4.ip_local_ports.lock); 113 data[0] = low; 114 data[1] = high; 115 write_sequnlock(&net->ipv4.ip_local_ports.lock); 116 } 117 118 /* Validate changes from /proc interface. */ 119 static int ipv4_ping_group_range(struct ctl_table *table, int write, 120 void __user *buffer, 121 size_t *lenp, loff_t *ppos) 122 { 123 struct user_namespace *user_ns = current_user_ns(); 124 int ret; 125 gid_t urange[2]; 126 kgid_t low, high; 127 struct ctl_table tmp = { 128 .data = &urange, 129 .maxlen = sizeof(urange), 130 .mode = table->mode, 131 .extra1 = &ip_ping_group_range_min, 132 .extra2 = &ip_ping_group_range_max, 133 }; 134 135 inet_get_ping_group_range_table(table, &low, &high); 136 urange[0] = from_kgid_munged(user_ns, low); 137 urange[1] = from_kgid_munged(user_ns, high); 138 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 139 140 if (write && ret == 0) { 141 low = make_kgid(user_ns, urange[0]); 142 high = make_kgid(user_ns, urange[1]); 143 if (!gid_valid(low) || !gid_valid(high) || 144 (urange[1] < urange[0]) || gid_lt(high, low)) { 145 low = make_kgid(&init_user_ns, 1); 146 high = make_kgid(&init_user_ns, 0); 147 } 148 set_ping_group_range(table, low, high); 149 } 150 151 return ret; 152 } 153 154 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 155 void __user *buffer, size_t *lenp, loff_t *ppos) 156 { 157 char val[TCP_CA_NAME_MAX]; 158 struct ctl_table tbl = { 159 .data = val, 160 .maxlen = TCP_CA_NAME_MAX, 161 }; 162 int ret; 163 164 tcp_get_default_congestion_control(val); 165 166 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 167 if (write && ret == 0) 168 ret = tcp_set_default_congestion_control(val); 169 return ret; 170 } 171 172 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 173 int write, 174 void __user *buffer, size_t *lenp, 175 loff_t *ppos) 176 { 177 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 178 int ret; 179 180 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 181 if (!tbl.data) 182 return -ENOMEM; 183 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 184 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 185 kfree(tbl.data); 186 return ret; 187 } 188 189 static int proc_allowed_congestion_control(struct ctl_table *ctl, 190 int write, 191 void __user *buffer, size_t *lenp, 192 loff_t *ppos) 193 { 194 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 195 int ret; 196 197 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 198 if (!tbl.data) 199 return -ENOMEM; 200 201 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 202 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 203 if (write && ret == 0) 204 ret = tcp_set_allowed_congestion_control(tbl.data); 205 kfree(tbl.data); 206 return ret; 207 } 208 209 static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, 210 void __user *buffer, size_t *lenp, 211 loff_t *ppos) 212 { 213 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 214 struct tcp_fastopen_context *ctxt; 215 int ret; 216 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 217 218 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 219 if (!tbl.data) 220 return -ENOMEM; 221 222 rcu_read_lock(); 223 ctxt = rcu_dereference(tcp_fastopen_ctx); 224 if (ctxt) 225 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 226 else 227 memset(user_key, 0, sizeof(user_key)); 228 rcu_read_unlock(); 229 230 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 231 user_key[0], user_key[1], user_key[2], user_key[3]); 232 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 233 234 if (write && ret == 0) { 235 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 236 user_key + 2, user_key + 3) != 4) { 237 ret = -EINVAL; 238 goto bad_key; 239 } 240 /* Generate a dummy secret but don't publish it. This 241 * is needed so we don't regenerate a new key on the 242 * first invocation of tcp_fastopen_cookie_gen 243 */ 244 tcp_fastopen_init_key_once(false); 245 tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); 246 } 247 248 bad_key: 249 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 250 user_key[0], user_key[1], user_key[2], user_key[3], 251 (char *)tbl.data, ret); 252 kfree(tbl.data); 253 return ret; 254 } 255 256 static struct ctl_table ipv4_table[] = { 257 { 258 .procname = "tcp_timestamps", 259 .data = &sysctl_tcp_timestamps, 260 .maxlen = sizeof(int), 261 .mode = 0644, 262 .proc_handler = proc_dointvec 263 }, 264 { 265 .procname = "tcp_window_scaling", 266 .data = &sysctl_tcp_window_scaling, 267 .maxlen = sizeof(int), 268 .mode = 0644, 269 .proc_handler = proc_dointvec 270 }, 271 { 272 .procname = "tcp_sack", 273 .data = &sysctl_tcp_sack, 274 .maxlen = sizeof(int), 275 .mode = 0644, 276 .proc_handler = proc_dointvec 277 }, 278 { 279 .procname = "tcp_retrans_collapse", 280 .data = &sysctl_tcp_retrans_collapse, 281 .maxlen = sizeof(int), 282 .mode = 0644, 283 .proc_handler = proc_dointvec 284 }, 285 { 286 .procname = "ip_default_ttl", 287 .data = &sysctl_ip_default_ttl, 288 .maxlen = sizeof(int), 289 .mode = 0644, 290 .proc_handler = proc_dointvec_minmax, 291 .extra1 = &ip_ttl_min, 292 .extra2 = &ip_ttl_max, 293 }, 294 { 295 .procname = "tcp_syn_retries", 296 .data = &sysctl_tcp_syn_retries, 297 .maxlen = sizeof(int), 298 .mode = 0644, 299 .proc_handler = proc_dointvec_minmax, 300 .extra1 = &tcp_syn_retries_min, 301 .extra2 = &tcp_syn_retries_max 302 }, 303 { 304 .procname = "tcp_synack_retries", 305 .data = &sysctl_tcp_synack_retries, 306 .maxlen = sizeof(int), 307 .mode = 0644, 308 .proc_handler = proc_dointvec 309 }, 310 { 311 .procname = "tcp_max_orphans", 312 .data = &sysctl_tcp_max_orphans, 313 .maxlen = sizeof(int), 314 .mode = 0644, 315 .proc_handler = proc_dointvec 316 }, 317 { 318 .procname = "tcp_max_tw_buckets", 319 .data = &tcp_death_row.sysctl_max_tw_buckets, 320 .maxlen = sizeof(int), 321 .mode = 0644, 322 .proc_handler = proc_dointvec 323 }, 324 { 325 .procname = "ip_early_demux", 326 .data = &sysctl_ip_early_demux, 327 .maxlen = sizeof(int), 328 .mode = 0644, 329 .proc_handler = proc_dointvec 330 }, 331 { 332 .procname = "ip_dynaddr", 333 .data = &sysctl_ip_dynaddr, 334 .maxlen = sizeof(int), 335 .mode = 0644, 336 .proc_handler = proc_dointvec 337 }, 338 { 339 .procname = "tcp_keepalive_time", 340 .data = &sysctl_tcp_keepalive_time, 341 .maxlen = sizeof(int), 342 .mode = 0644, 343 .proc_handler = proc_dointvec_jiffies, 344 }, 345 { 346 .procname = "tcp_keepalive_probes", 347 .data = &sysctl_tcp_keepalive_probes, 348 .maxlen = sizeof(int), 349 .mode = 0644, 350 .proc_handler = proc_dointvec 351 }, 352 { 353 .procname = "tcp_keepalive_intvl", 354 .data = &sysctl_tcp_keepalive_intvl, 355 .maxlen = sizeof(int), 356 .mode = 0644, 357 .proc_handler = proc_dointvec_jiffies, 358 }, 359 { 360 .procname = "tcp_retries1", 361 .data = &sysctl_tcp_retries1, 362 .maxlen = sizeof(int), 363 .mode = 0644, 364 .proc_handler = proc_dointvec_minmax, 365 .extra2 = &tcp_retr1_max 366 }, 367 { 368 .procname = "tcp_retries2", 369 .data = &sysctl_tcp_retries2, 370 .maxlen = sizeof(int), 371 .mode = 0644, 372 .proc_handler = proc_dointvec 373 }, 374 { 375 .procname = "tcp_fin_timeout", 376 .data = &sysctl_tcp_fin_timeout, 377 .maxlen = sizeof(int), 378 .mode = 0644, 379 .proc_handler = proc_dointvec_jiffies, 380 }, 381 #ifdef CONFIG_SYN_COOKIES 382 { 383 .procname = "tcp_syncookies", 384 .data = &sysctl_tcp_syncookies, 385 .maxlen = sizeof(int), 386 .mode = 0644, 387 .proc_handler = proc_dointvec 388 }, 389 #endif 390 { 391 .procname = "tcp_fastopen", 392 .data = &sysctl_tcp_fastopen, 393 .maxlen = sizeof(int), 394 .mode = 0644, 395 .proc_handler = proc_dointvec, 396 }, 397 { 398 .procname = "tcp_fastopen_key", 399 .mode = 0600, 400 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 401 .proc_handler = proc_tcp_fastopen_key, 402 }, 403 { 404 .procname = "tcp_tw_recycle", 405 .data = &tcp_death_row.sysctl_tw_recycle, 406 .maxlen = sizeof(int), 407 .mode = 0644, 408 .proc_handler = proc_dointvec 409 }, 410 { 411 .procname = "tcp_abort_on_overflow", 412 .data = &sysctl_tcp_abort_on_overflow, 413 .maxlen = sizeof(int), 414 .mode = 0644, 415 .proc_handler = proc_dointvec 416 }, 417 { 418 .procname = "tcp_stdurg", 419 .data = &sysctl_tcp_stdurg, 420 .maxlen = sizeof(int), 421 .mode = 0644, 422 .proc_handler = proc_dointvec 423 }, 424 { 425 .procname = "tcp_rfc1337", 426 .data = &sysctl_tcp_rfc1337, 427 .maxlen = sizeof(int), 428 .mode = 0644, 429 .proc_handler = proc_dointvec 430 }, 431 { 432 .procname = "tcp_max_syn_backlog", 433 .data = &sysctl_max_syn_backlog, 434 .maxlen = sizeof(int), 435 .mode = 0644, 436 .proc_handler = proc_dointvec 437 }, 438 { 439 .procname = "igmp_max_memberships", 440 .data = &sysctl_igmp_max_memberships, 441 .maxlen = sizeof(int), 442 .mode = 0644, 443 .proc_handler = proc_dointvec 444 }, 445 { 446 .procname = "igmp_max_msf", 447 .data = &sysctl_igmp_max_msf, 448 .maxlen = sizeof(int), 449 .mode = 0644, 450 .proc_handler = proc_dointvec 451 }, 452 #ifdef CONFIG_IP_MULTICAST 453 { 454 .procname = "igmp_qrv", 455 .data = &sysctl_igmp_qrv, 456 .maxlen = sizeof(int), 457 .mode = 0644, 458 .proc_handler = proc_dointvec_minmax, 459 .extra1 = &one 460 }, 461 #endif 462 { 463 .procname = "inet_peer_threshold", 464 .data = &inet_peer_threshold, 465 .maxlen = sizeof(int), 466 .mode = 0644, 467 .proc_handler = proc_dointvec 468 }, 469 { 470 .procname = "inet_peer_minttl", 471 .data = &inet_peer_minttl, 472 .maxlen = sizeof(int), 473 .mode = 0644, 474 .proc_handler = proc_dointvec_jiffies, 475 }, 476 { 477 .procname = "inet_peer_maxttl", 478 .data = &inet_peer_maxttl, 479 .maxlen = sizeof(int), 480 .mode = 0644, 481 .proc_handler = proc_dointvec_jiffies, 482 }, 483 { 484 .procname = "tcp_orphan_retries", 485 .data = &sysctl_tcp_orphan_retries, 486 .maxlen = sizeof(int), 487 .mode = 0644, 488 .proc_handler = proc_dointvec 489 }, 490 { 491 .procname = "tcp_fack", 492 .data = &sysctl_tcp_fack, 493 .maxlen = sizeof(int), 494 .mode = 0644, 495 .proc_handler = proc_dointvec 496 }, 497 { 498 .procname = "tcp_reordering", 499 .data = &sysctl_tcp_reordering, 500 .maxlen = sizeof(int), 501 .mode = 0644, 502 .proc_handler = proc_dointvec 503 }, 504 { 505 .procname = "tcp_max_reordering", 506 .data = &sysctl_tcp_max_reordering, 507 .maxlen = sizeof(int), 508 .mode = 0644, 509 .proc_handler = proc_dointvec 510 }, 511 { 512 .procname = "tcp_dsack", 513 .data = &sysctl_tcp_dsack, 514 .maxlen = sizeof(int), 515 .mode = 0644, 516 .proc_handler = proc_dointvec 517 }, 518 { 519 .procname = "tcp_mem", 520 .maxlen = sizeof(sysctl_tcp_mem), 521 .data = &sysctl_tcp_mem, 522 .mode = 0644, 523 .proc_handler = proc_doulongvec_minmax, 524 }, 525 { 526 .procname = "tcp_wmem", 527 .data = &sysctl_tcp_wmem, 528 .maxlen = sizeof(sysctl_tcp_wmem), 529 .mode = 0644, 530 .proc_handler = proc_dointvec_minmax, 531 .extra1 = &one, 532 }, 533 { 534 .procname = "tcp_notsent_lowat", 535 .data = &sysctl_tcp_notsent_lowat, 536 .maxlen = sizeof(sysctl_tcp_notsent_lowat), 537 .mode = 0644, 538 .proc_handler = proc_dointvec, 539 }, 540 { 541 .procname = "tcp_rmem", 542 .data = &sysctl_tcp_rmem, 543 .maxlen = sizeof(sysctl_tcp_rmem), 544 .mode = 0644, 545 .proc_handler = proc_dointvec_minmax, 546 .extra1 = &one, 547 }, 548 { 549 .procname = "tcp_app_win", 550 .data = &sysctl_tcp_app_win, 551 .maxlen = sizeof(int), 552 .mode = 0644, 553 .proc_handler = proc_dointvec 554 }, 555 { 556 .procname = "tcp_adv_win_scale", 557 .data = &sysctl_tcp_adv_win_scale, 558 .maxlen = sizeof(int), 559 .mode = 0644, 560 .proc_handler = proc_dointvec_minmax, 561 .extra1 = &tcp_adv_win_scale_min, 562 .extra2 = &tcp_adv_win_scale_max, 563 }, 564 { 565 .procname = "tcp_tw_reuse", 566 .data = &sysctl_tcp_tw_reuse, 567 .maxlen = sizeof(int), 568 .mode = 0644, 569 .proc_handler = proc_dointvec 570 }, 571 { 572 .procname = "tcp_frto", 573 .data = &sysctl_tcp_frto, 574 .maxlen = sizeof(int), 575 .mode = 0644, 576 .proc_handler = proc_dointvec 577 }, 578 { 579 .procname = "tcp_low_latency", 580 .data = &sysctl_tcp_low_latency, 581 .maxlen = sizeof(int), 582 .mode = 0644, 583 .proc_handler = proc_dointvec 584 }, 585 { 586 .procname = "tcp_no_metrics_save", 587 .data = &sysctl_tcp_nometrics_save, 588 .maxlen = sizeof(int), 589 .mode = 0644, 590 .proc_handler = proc_dointvec, 591 }, 592 { 593 .procname = "tcp_moderate_rcvbuf", 594 .data = &sysctl_tcp_moderate_rcvbuf, 595 .maxlen = sizeof(int), 596 .mode = 0644, 597 .proc_handler = proc_dointvec, 598 }, 599 { 600 .procname = "tcp_tso_win_divisor", 601 .data = &sysctl_tcp_tso_win_divisor, 602 .maxlen = sizeof(int), 603 .mode = 0644, 604 .proc_handler = proc_dointvec, 605 }, 606 { 607 .procname = "tcp_congestion_control", 608 .mode = 0644, 609 .maxlen = TCP_CA_NAME_MAX, 610 .proc_handler = proc_tcp_congestion_control, 611 }, 612 { 613 .procname = "tcp_workaround_signed_windows", 614 .data = &sysctl_tcp_workaround_signed_windows, 615 .maxlen = sizeof(int), 616 .mode = 0644, 617 .proc_handler = proc_dointvec 618 }, 619 { 620 .procname = "tcp_limit_output_bytes", 621 .data = &sysctl_tcp_limit_output_bytes, 622 .maxlen = sizeof(int), 623 .mode = 0644, 624 .proc_handler = proc_dointvec 625 }, 626 { 627 .procname = "tcp_challenge_ack_limit", 628 .data = &sysctl_tcp_challenge_ack_limit, 629 .maxlen = sizeof(int), 630 .mode = 0644, 631 .proc_handler = proc_dointvec 632 }, 633 { 634 .procname = "tcp_slow_start_after_idle", 635 .data = &sysctl_tcp_slow_start_after_idle, 636 .maxlen = sizeof(int), 637 .mode = 0644, 638 .proc_handler = proc_dointvec 639 }, 640 #ifdef CONFIG_NETLABEL 641 { 642 .procname = "cipso_cache_enable", 643 .data = &cipso_v4_cache_enabled, 644 .maxlen = sizeof(int), 645 .mode = 0644, 646 .proc_handler = proc_dointvec, 647 }, 648 { 649 .procname = "cipso_cache_bucket_size", 650 .data = &cipso_v4_cache_bucketsize, 651 .maxlen = sizeof(int), 652 .mode = 0644, 653 .proc_handler = proc_dointvec, 654 }, 655 { 656 .procname = "cipso_rbm_optfmt", 657 .data = &cipso_v4_rbm_optfmt, 658 .maxlen = sizeof(int), 659 .mode = 0644, 660 .proc_handler = proc_dointvec, 661 }, 662 { 663 .procname = "cipso_rbm_strictvalid", 664 .data = &cipso_v4_rbm_strictvalid, 665 .maxlen = sizeof(int), 666 .mode = 0644, 667 .proc_handler = proc_dointvec, 668 }, 669 #endif /* CONFIG_NETLABEL */ 670 { 671 .procname = "tcp_available_congestion_control", 672 .maxlen = TCP_CA_BUF_MAX, 673 .mode = 0444, 674 .proc_handler = proc_tcp_available_congestion_control, 675 }, 676 { 677 .procname = "tcp_allowed_congestion_control", 678 .maxlen = TCP_CA_BUF_MAX, 679 .mode = 0644, 680 .proc_handler = proc_allowed_congestion_control, 681 }, 682 { 683 .procname = "tcp_thin_linear_timeouts", 684 .data = &sysctl_tcp_thin_linear_timeouts, 685 .maxlen = sizeof(int), 686 .mode = 0644, 687 .proc_handler = proc_dointvec 688 }, 689 { 690 .procname = "tcp_thin_dupack", 691 .data = &sysctl_tcp_thin_dupack, 692 .maxlen = sizeof(int), 693 .mode = 0644, 694 .proc_handler = proc_dointvec 695 }, 696 { 697 .procname = "tcp_early_retrans", 698 .data = &sysctl_tcp_early_retrans, 699 .maxlen = sizeof(int), 700 .mode = 0644, 701 .proc_handler = proc_dointvec_minmax, 702 .extra1 = &zero, 703 .extra2 = &four, 704 }, 705 { 706 .procname = "tcp_min_tso_segs", 707 .data = &sysctl_tcp_min_tso_segs, 708 .maxlen = sizeof(int), 709 .mode = 0644, 710 .proc_handler = proc_dointvec_minmax, 711 .extra1 = &one, 712 .extra2 = &gso_max_segs, 713 }, 714 { 715 .procname = "tcp_autocorking", 716 .data = &sysctl_tcp_autocorking, 717 .maxlen = sizeof(int), 718 .mode = 0644, 719 .proc_handler = proc_dointvec_minmax, 720 .extra1 = &zero, 721 .extra2 = &one, 722 }, 723 { 724 .procname = "tcp_invalid_ratelimit", 725 .data = &sysctl_tcp_invalid_ratelimit, 726 .maxlen = sizeof(int), 727 .mode = 0644, 728 .proc_handler = proc_dointvec_ms_jiffies, 729 }, 730 { 731 .procname = "icmp_msgs_per_sec", 732 .data = &sysctl_icmp_msgs_per_sec, 733 .maxlen = sizeof(int), 734 .mode = 0644, 735 .proc_handler = proc_dointvec_minmax, 736 .extra1 = &zero, 737 }, 738 { 739 .procname = "icmp_msgs_burst", 740 .data = &sysctl_icmp_msgs_burst, 741 .maxlen = sizeof(int), 742 .mode = 0644, 743 .proc_handler = proc_dointvec_minmax, 744 .extra1 = &zero, 745 }, 746 { 747 .procname = "udp_mem", 748 .data = &sysctl_udp_mem, 749 .maxlen = sizeof(sysctl_udp_mem), 750 .mode = 0644, 751 .proc_handler = proc_doulongvec_minmax, 752 }, 753 { 754 .procname = "udp_rmem_min", 755 .data = &sysctl_udp_rmem_min, 756 .maxlen = sizeof(sysctl_udp_rmem_min), 757 .mode = 0644, 758 .proc_handler = proc_dointvec_minmax, 759 .extra1 = &one 760 }, 761 { 762 .procname = "udp_wmem_min", 763 .data = &sysctl_udp_wmem_min, 764 .maxlen = sizeof(sysctl_udp_wmem_min), 765 .mode = 0644, 766 .proc_handler = proc_dointvec_minmax, 767 .extra1 = &one 768 }, 769 { } 770 }; 771 772 static struct ctl_table ipv4_net_table[] = { 773 { 774 .procname = "icmp_echo_ignore_all", 775 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 776 .maxlen = sizeof(int), 777 .mode = 0644, 778 .proc_handler = proc_dointvec 779 }, 780 { 781 .procname = "icmp_echo_ignore_broadcasts", 782 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 783 .maxlen = sizeof(int), 784 .mode = 0644, 785 .proc_handler = proc_dointvec 786 }, 787 { 788 .procname = "icmp_ignore_bogus_error_responses", 789 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 790 .maxlen = sizeof(int), 791 .mode = 0644, 792 .proc_handler = proc_dointvec 793 }, 794 { 795 .procname = "icmp_errors_use_inbound_ifaddr", 796 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 797 .maxlen = sizeof(int), 798 .mode = 0644, 799 .proc_handler = proc_dointvec 800 }, 801 { 802 .procname = "icmp_ratelimit", 803 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 804 .maxlen = sizeof(int), 805 .mode = 0644, 806 .proc_handler = proc_dointvec_ms_jiffies, 807 }, 808 { 809 .procname = "icmp_ratemask", 810 .data = &init_net.ipv4.sysctl_icmp_ratemask, 811 .maxlen = sizeof(int), 812 .mode = 0644, 813 .proc_handler = proc_dointvec 814 }, 815 { 816 .procname = "ping_group_range", 817 .data = &init_net.ipv4.ping_group_range.range, 818 .maxlen = sizeof(gid_t)*2, 819 .mode = 0644, 820 .proc_handler = ipv4_ping_group_range, 821 }, 822 { 823 .procname = "tcp_ecn", 824 .data = &init_net.ipv4.sysctl_tcp_ecn, 825 .maxlen = sizeof(int), 826 .mode = 0644, 827 .proc_handler = proc_dointvec 828 }, 829 { 830 .procname = "tcp_ecn_fallback", 831 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 832 .maxlen = sizeof(int), 833 .mode = 0644, 834 .proc_handler = proc_dointvec 835 }, 836 { 837 .procname = "ip_local_port_range", 838 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 839 .data = &init_net.ipv4.ip_local_ports.range, 840 .mode = 0644, 841 .proc_handler = ipv4_local_port_range, 842 }, 843 { 844 .procname = "ip_local_reserved_ports", 845 .data = &init_net.ipv4.sysctl_local_reserved_ports, 846 .maxlen = 65536, 847 .mode = 0644, 848 .proc_handler = proc_do_large_bitmap, 849 }, 850 { 851 .procname = "ip_no_pmtu_disc", 852 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 853 .maxlen = sizeof(int), 854 .mode = 0644, 855 .proc_handler = proc_dointvec 856 }, 857 { 858 .procname = "ip_forward_use_pmtu", 859 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 860 .maxlen = sizeof(int), 861 .mode = 0644, 862 .proc_handler = proc_dointvec, 863 }, 864 { 865 .procname = "ip_nonlocal_bind", 866 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 867 .maxlen = sizeof(int), 868 .mode = 0644, 869 .proc_handler = proc_dointvec 870 }, 871 { 872 .procname = "fwmark_reflect", 873 .data = &init_net.ipv4.sysctl_fwmark_reflect, 874 .maxlen = sizeof(int), 875 .mode = 0644, 876 .proc_handler = proc_dointvec, 877 }, 878 { 879 .procname = "tcp_fwmark_accept", 880 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 881 .maxlen = sizeof(int), 882 .mode = 0644, 883 .proc_handler = proc_dointvec, 884 }, 885 { 886 .procname = "tcp_mtu_probing", 887 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 888 .maxlen = sizeof(int), 889 .mode = 0644, 890 .proc_handler = proc_dointvec, 891 }, 892 { 893 .procname = "tcp_base_mss", 894 .data = &init_net.ipv4.sysctl_tcp_base_mss, 895 .maxlen = sizeof(int), 896 .mode = 0644, 897 .proc_handler = proc_dointvec, 898 }, 899 { 900 .procname = "tcp_probe_threshold", 901 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 902 .maxlen = sizeof(int), 903 .mode = 0644, 904 .proc_handler = proc_dointvec, 905 }, 906 { 907 .procname = "tcp_probe_interval", 908 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 909 .maxlen = sizeof(int), 910 .mode = 0644, 911 .proc_handler = proc_dointvec, 912 }, 913 { } 914 }; 915 916 static __net_init int ipv4_sysctl_init_net(struct net *net) 917 { 918 struct ctl_table *table; 919 920 table = ipv4_net_table; 921 if (!net_eq(net, &init_net)) { 922 int i; 923 924 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 925 if (!table) 926 goto err_alloc; 927 928 /* Update the variables to point into the current struct net */ 929 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 930 table[i].data += (void *)net - (void *)&init_net; 931 } 932 933 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 934 if (!net->ipv4.ipv4_hdr) 935 goto err_reg; 936 937 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 938 if (!net->ipv4.sysctl_local_reserved_ports) 939 goto err_ports; 940 941 return 0; 942 943 err_ports: 944 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 945 err_reg: 946 if (!net_eq(net, &init_net)) 947 kfree(table); 948 err_alloc: 949 return -ENOMEM; 950 } 951 952 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 953 { 954 struct ctl_table *table; 955 956 kfree(net->ipv4.sysctl_local_reserved_ports); 957 table = net->ipv4.ipv4_hdr->ctl_table_arg; 958 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 959 kfree(table); 960 } 961 962 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 963 .init = ipv4_sysctl_init_net, 964 .exit = ipv4_sysctl_exit_net, 965 }; 966 967 static __init int sysctl_ipv4_init(void) 968 { 969 struct ctl_table_header *hdr; 970 971 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 972 if (!hdr) 973 return -ENOMEM; 974 975 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 976 unregister_net_sysctl_table(hdr); 977 return -ENOMEM; 978 } 979 980 return 0; 981 } 982 983 __initcall(sysctl_ipv4_init); 984