1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 28 static int zero; 29 static int one = 1; 30 static int four = 4; 31 static int thousand = 1000; 32 static int gso_max_segs = GSO_MAX_SEGS; 33 static int tcp_retr1_max = 255; 34 static int ip_local_port_range_min[] = { 1, 1 }; 35 static int ip_local_port_range_max[] = { 65535, 65535 }; 36 static int tcp_adv_win_scale_min = -31; 37 static int tcp_adv_win_scale_max = 31; 38 static int ip_ttl_min = 1; 39 static int ip_ttl_max = 255; 40 static int tcp_syn_retries_min = 1; 41 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 42 static int ip_ping_group_range_min[] = { 0, 0 }; 43 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 44 45 /* Update system visible IP port range */ 46 static void set_local_port_range(struct net *net, int range[2]) 47 { 48 bool same_parity = !((range[0] ^ range[1]) & 1); 49 50 write_seqlock_bh(&net->ipv4.ip_local_ports.lock); 51 if (same_parity && !net->ipv4.ip_local_ports.warned) { 52 net->ipv4.ip_local_ports.warned = true; 53 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 54 } 55 net->ipv4.ip_local_ports.range[0] = range[0]; 56 net->ipv4.ip_local_ports.range[1] = range[1]; 57 write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); 58 } 59 60 /* Validate changes from /proc interface. */ 61 static int ipv4_local_port_range(struct ctl_table *table, int write, 62 void __user *buffer, 63 size_t *lenp, loff_t *ppos) 64 { 65 struct net *net = 66 container_of(table->data, struct net, ipv4.ip_local_ports.range); 67 int ret; 68 int range[2]; 69 struct ctl_table tmp = { 70 .data = &range, 71 .maxlen = sizeof(range), 72 .mode = table->mode, 73 .extra1 = &ip_local_port_range_min, 74 .extra2 = &ip_local_port_range_max, 75 }; 76 77 inet_get_local_port_range(net, &range[0], &range[1]); 78 79 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 80 81 if (write && ret == 0) { 82 if (range[1] < range[0]) 83 ret = -EINVAL; 84 else 85 set_local_port_range(net, range); 86 } 87 88 return ret; 89 } 90 91 92 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 93 { 94 kgid_t *data = table->data; 95 struct net *net = 96 container_of(table->data, struct net, ipv4.ping_group_range.range); 97 unsigned int seq; 98 do { 99 seq = read_seqbegin(&net->ipv4.ping_group_range.lock); 100 101 *low = data[0]; 102 *high = data[1]; 103 } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); 104 } 105 106 /* Update system visible IP port range */ 107 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 108 { 109 kgid_t *data = table->data; 110 struct net *net = 111 container_of(table->data, struct net, ipv4.ping_group_range.range); 112 write_seqlock(&net->ipv4.ping_group_range.lock); 113 data[0] = low; 114 data[1] = high; 115 write_sequnlock(&net->ipv4.ping_group_range.lock); 116 } 117 118 /* Validate changes from /proc interface. */ 119 static int ipv4_ping_group_range(struct ctl_table *table, int write, 120 void __user *buffer, 121 size_t *lenp, loff_t *ppos) 122 { 123 struct user_namespace *user_ns = current_user_ns(); 124 int ret; 125 gid_t urange[2]; 126 kgid_t low, high; 127 struct ctl_table tmp = { 128 .data = &urange, 129 .maxlen = sizeof(urange), 130 .mode = table->mode, 131 .extra1 = &ip_ping_group_range_min, 132 .extra2 = &ip_ping_group_range_max, 133 }; 134 135 inet_get_ping_group_range_table(table, &low, &high); 136 urange[0] = from_kgid_munged(user_ns, low); 137 urange[1] = from_kgid_munged(user_ns, high); 138 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 139 140 if (write && ret == 0) { 141 low = make_kgid(user_ns, urange[0]); 142 high = make_kgid(user_ns, urange[1]); 143 if (!gid_valid(low) || !gid_valid(high) || 144 (urange[1] < urange[0]) || gid_lt(high, low)) { 145 low = make_kgid(&init_user_ns, 1); 146 high = make_kgid(&init_user_ns, 0); 147 } 148 set_ping_group_range(table, low, high); 149 } 150 151 return ret; 152 } 153 154 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 155 void __user *buffer, size_t *lenp, loff_t *ppos) 156 { 157 char val[TCP_CA_NAME_MAX]; 158 struct ctl_table tbl = { 159 .data = val, 160 .maxlen = TCP_CA_NAME_MAX, 161 }; 162 int ret; 163 164 tcp_get_default_congestion_control(val); 165 166 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 167 if (write && ret == 0) 168 ret = tcp_set_default_congestion_control(val); 169 return ret; 170 } 171 172 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 173 int write, 174 void __user *buffer, size_t *lenp, 175 loff_t *ppos) 176 { 177 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 178 int ret; 179 180 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 181 if (!tbl.data) 182 return -ENOMEM; 183 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 184 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 185 kfree(tbl.data); 186 return ret; 187 } 188 189 static int proc_allowed_congestion_control(struct ctl_table *ctl, 190 int write, 191 void __user *buffer, size_t *lenp, 192 loff_t *ppos) 193 { 194 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 195 int ret; 196 197 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 198 if (!tbl.data) 199 return -ENOMEM; 200 201 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 202 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 203 if (write && ret == 0) 204 ret = tcp_set_allowed_congestion_control(tbl.data); 205 kfree(tbl.data); 206 return ret; 207 } 208 209 static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, 210 void __user *buffer, size_t *lenp, 211 loff_t *ppos) 212 { 213 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 214 struct tcp_fastopen_context *ctxt; 215 int ret; 216 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 217 218 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 219 if (!tbl.data) 220 return -ENOMEM; 221 222 rcu_read_lock(); 223 ctxt = rcu_dereference(tcp_fastopen_ctx); 224 if (ctxt) 225 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 226 else 227 memset(user_key, 0, sizeof(user_key)); 228 rcu_read_unlock(); 229 230 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 231 user_key[0], user_key[1], user_key[2], user_key[3]); 232 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 233 234 if (write && ret == 0) { 235 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 236 user_key + 2, user_key + 3) != 4) { 237 ret = -EINVAL; 238 goto bad_key; 239 } 240 /* Generate a dummy secret but don't publish it. This 241 * is needed so we don't regenerate a new key on the 242 * first invocation of tcp_fastopen_cookie_gen 243 */ 244 tcp_fastopen_init_key_once(false); 245 tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); 246 } 247 248 bad_key: 249 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 250 user_key[0], user_key[1], user_key[2], user_key[3], 251 (char *)tbl.data, ret); 252 kfree(tbl.data); 253 return ret; 254 } 255 256 static struct ctl_table ipv4_table[] = { 257 { 258 .procname = "tcp_timestamps", 259 .data = &sysctl_tcp_timestamps, 260 .maxlen = sizeof(int), 261 .mode = 0644, 262 .proc_handler = proc_dointvec 263 }, 264 { 265 .procname = "tcp_window_scaling", 266 .data = &sysctl_tcp_window_scaling, 267 .maxlen = sizeof(int), 268 .mode = 0644, 269 .proc_handler = proc_dointvec 270 }, 271 { 272 .procname = "tcp_sack", 273 .data = &sysctl_tcp_sack, 274 .maxlen = sizeof(int), 275 .mode = 0644, 276 .proc_handler = proc_dointvec 277 }, 278 { 279 .procname = "tcp_retrans_collapse", 280 .data = &sysctl_tcp_retrans_collapse, 281 .maxlen = sizeof(int), 282 .mode = 0644, 283 .proc_handler = proc_dointvec 284 }, 285 { 286 .procname = "tcp_max_orphans", 287 .data = &sysctl_tcp_max_orphans, 288 .maxlen = sizeof(int), 289 .mode = 0644, 290 .proc_handler = proc_dointvec 291 }, 292 { 293 .procname = "tcp_fastopen", 294 .data = &sysctl_tcp_fastopen, 295 .maxlen = sizeof(int), 296 .mode = 0644, 297 .proc_handler = proc_dointvec, 298 }, 299 { 300 .procname = "tcp_fastopen_key", 301 .mode = 0600, 302 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 303 .proc_handler = proc_tcp_fastopen_key, 304 }, 305 { 306 .procname = "tcp_abort_on_overflow", 307 .data = &sysctl_tcp_abort_on_overflow, 308 .maxlen = sizeof(int), 309 .mode = 0644, 310 .proc_handler = proc_dointvec 311 }, 312 { 313 .procname = "tcp_stdurg", 314 .data = &sysctl_tcp_stdurg, 315 .maxlen = sizeof(int), 316 .mode = 0644, 317 .proc_handler = proc_dointvec 318 }, 319 { 320 .procname = "tcp_rfc1337", 321 .data = &sysctl_tcp_rfc1337, 322 .maxlen = sizeof(int), 323 .mode = 0644, 324 .proc_handler = proc_dointvec 325 }, 326 { 327 .procname = "inet_peer_threshold", 328 .data = &inet_peer_threshold, 329 .maxlen = sizeof(int), 330 .mode = 0644, 331 .proc_handler = proc_dointvec 332 }, 333 { 334 .procname = "inet_peer_minttl", 335 .data = &inet_peer_minttl, 336 .maxlen = sizeof(int), 337 .mode = 0644, 338 .proc_handler = proc_dointvec_jiffies, 339 }, 340 { 341 .procname = "inet_peer_maxttl", 342 .data = &inet_peer_maxttl, 343 .maxlen = sizeof(int), 344 .mode = 0644, 345 .proc_handler = proc_dointvec_jiffies, 346 }, 347 { 348 .procname = "tcp_fack", 349 .data = &sysctl_tcp_fack, 350 .maxlen = sizeof(int), 351 .mode = 0644, 352 .proc_handler = proc_dointvec 353 }, 354 { 355 .procname = "tcp_recovery", 356 .data = &sysctl_tcp_recovery, 357 .maxlen = sizeof(int), 358 .mode = 0644, 359 .proc_handler = proc_dointvec, 360 }, 361 { 362 .procname = "tcp_max_reordering", 363 .data = &sysctl_tcp_max_reordering, 364 .maxlen = sizeof(int), 365 .mode = 0644, 366 .proc_handler = proc_dointvec 367 }, 368 { 369 .procname = "tcp_dsack", 370 .data = &sysctl_tcp_dsack, 371 .maxlen = sizeof(int), 372 .mode = 0644, 373 .proc_handler = proc_dointvec 374 }, 375 { 376 .procname = "tcp_mem", 377 .maxlen = sizeof(sysctl_tcp_mem), 378 .data = &sysctl_tcp_mem, 379 .mode = 0644, 380 .proc_handler = proc_doulongvec_minmax, 381 }, 382 { 383 .procname = "tcp_wmem", 384 .data = &sysctl_tcp_wmem, 385 .maxlen = sizeof(sysctl_tcp_wmem), 386 .mode = 0644, 387 .proc_handler = proc_dointvec_minmax, 388 .extra1 = &one, 389 }, 390 { 391 .procname = "tcp_rmem", 392 .data = &sysctl_tcp_rmem, 393 .maxlen = sizeof(sysctl_tcp_rmem), 394 .mode = 0644, 395 .proc_handler = proc_dointvec_minmax, 396 .extra1 = &one, 397 }, 398 { 399 .procname = "tcp_app_win", 400 .data = &sysctl_tcp_app_win, 401 .maxlen = sizeof(int), 402 .mode = 0644, 403 .proc_handler = proc_dointvec 404 }, 405 { 406 .procname = "tcp_adv_win_scale", 407 .data = &sysctl_tcp_adv_win_scale, 408 .maxlen = sizeof(int), 409 .mode = 0644, 410 .proc_handler = proc_dointvec_minmax, 411 .extra1 = &tcp_adv_win_scale_min, 412 .extra2 = &tcp_adv_win_scale_max, 413 }, 414 { 415 .procname = "tcp_frto", 416 .data = &sysctl_tcp_frto, 417 .maxlen = sizeof(int), 418 .mode = 0644, 419 .proc_handler = proc_dointvec 420 }, 421 { 422 .procname = "tcp_min_rtt_wlen", 423 .data = &sysctl_tcp_min_rtt_wlen, 424 .maxlen = sizeof(int), 425 .mode = 0644, 426 .proc_handler = proc_dointvec 427 }, 428 { 429 .procname = "tcp_low_latency", 430 .data = &sysctl_tcp_low_latency, 431 .maxlen = sizeof(int), 432 .mode = 0644, 433 .proc_handler = proc_dointvec 434 }, 435 { 436 .procname = "tcp_no_metrics_save", 437 .data = &sysctl_tcp_nometrics_save, 438 .maxlen = sizeof(int), 439 .mode = 0644, 440 .proc_handler = proc_dointvec, 441 }, 442 { 443 .procname = "tcp_moderate_rcvbuf", 444 .data = &sysctl_tcp_moderate_rcvbuf, 445 .maxlen = sizeof(int), 446 .mode = 0644, 447 .proc_handler = proc_dointvec, 448 }, 449 { 450 .procname = "tcp_tso_win_divisor", 451 .data = &sysctl_tcp_tso_win_divisor, 452 .maxlen = sizeof(int), 453 .mode = 0644, 454 .proc_handler = proc_dointvec, 455 }, 456 { 457 .procname = "tcp_congestion_control", 458 .mode = 0644, 459 .maxlen = TCP_CA_NAME_MAX, 460 .proc_handler = proc_tcp_congestion_control, 461 }, 462 { 463 .procname = "tcp_workaround_signed_windows", 464 .data = &sysctl_tcp_workaround_signed_windows, 465 .maxlen = sizeof(int), 466 .mode = 0644, 467 .proc_handler = proc_dointvec 468 }, 469 { 470 .procname = "tcp_limit_output_bytes", 471 .data = &sysctl_tcp_limit_output_bytes, 472 .maxlen = sizeof(int), 473 .mode = 0644, 474 .proc_handler = proc_dointvec 475 }, 476 { 477 .procname = "tcp_challenge_ack_limit", 478 .data = &sysctl_tcp_challenge_ack_limit, 479 .maxlen = sizeof(int), 480 .mode = 0644, 481 .proc_handler = proc_dointvec 482 }, 483 { 484 .procname = "tcp_slow_start_after_idle", 485 .data = &sysctl_tcp_slow_start_after_idle, 486 .maxlen = sizeof(int), 487 .mode = 0644, 488 .proc_handler = proc_dointvec 489 }, 490 #ifdef CONFIG_NETLABEL 491 { 492 .procname = "cipso_cache_enable", 493 .data = &cipso_v4_cache_enabled, 494 .maxlen = sizeof(int), 495 .mode = 0644, 496 .proc_handler = proc_dointvec, 497 }, 498 { 499 .procname = "cipso_cache_bucket_size", 500 .data = &cipso_v4_cache_bucketsize, 501 .maxlen = sizeof(int), 502 .mode = 0644, 503 .proc_handler = proc_dointvec, 504 }, 505 { 506 .procname = "cipso_rbm_optfmt", 507 .data = &cipso_v4_rbm_optfmt, 508 .maxlen = sizeof(int), 509 .mode = 0644, 510 .proc_handler = proc_dointvec, 511 }, 512 { 513 .procname = "cipso_rbm_strictvalid", 514 .data = &cipso_v4_rbm_strictvalid, 515 .maxlen = sizeof(int), 516 .mode = 0644, 517 .proc_handler = proc_dointvec, 518 }, 519 #endif /* CONFIG_NETLABEL */ 520 { 521 .procname = "tcp_available_congestion_control", 522 .maxlen = TCP_CA_BUF_MAX, 523 .mode = 0444, 524 .proc_handler = proc_tcp_available_congestion_control, 525 }, 526 { 527 .procname = "tcp_allowed_congestion_control", 528 .maxlen = TCP_CA_BUF_MAX, 529 .mode = 0644, 530 .proc_handler = proc_allowed_congestion_control, 531 }, 532 { 533 .procname = "tcp_thin_linear_timeouts", 534 .data = &sysctl_tcp_thin_linear_timeouts, 535 .maxlen = sizeof(int), 536 .mode = 0644, 537 .proc_handler = proc_dointvec 538 }, 539 { 540 .procname = "tcp_thin_dupack", 541 .data = &sysctl_tcp_thin_dupack, 542 .maxlen = sizeof(int), 543 .mode = 0644, 544 .proc_handler = proc_dointvec 545 }, 546 { 547 .procname = "tcp_early_retrans", 548 .data = &sysctl_tcp_early_retrans, 549 .maxlen = sizeof(int), 550 .mode = 0644, 551 .proc_handler = proc_dointvec_minmax, 552 .extra1 = &zero, 553 .extra2 = &four, 554 }, 555 { 556 .procname = "tcp_min_tso_segs", 557 .data = &sysctl_tcp_min_tso_segs, 558 .maxlen = sizeof(int), 559 .mode = 0644, 560 .proc_handler = proc_dointvec_minmax, 561 .extra1 = &one, 562 .extra2 = &gso_max_segs, 563 }, 564 { 565 .procname = "tcp_pacing_ss_ratio", 566 .data = &sysctl_tcp_pacing_ss_ratio, 567 .maxlen = sizeof(int), 568 .mode = 0644, 569 .proc_handler = proc_dointvec_minmax, 570 .extra1 = &zero, 571 .extra2 = &thousand, 572 }, 573 { 574 .procname = "tcp_pacing_ca_ratio", 575 .data = &sysctl_tcp_pacing_ca_ratio, 576 .maxlen = sizeof(int), 577 .mode = 0644, 578 .proc_handler = proc_dointvec_minmax, 579 .extra1 = &zero, 580 .extra2 = &thousand, 581 }, 582 { 583 .procname = "tcp_autocorking", 584 .data = &sysctl_tcp_autocorking, 585 .maxlen = sizeof(int), 586 .mode = 0644, 587 .proc_handler = proc_dointvec_minmax, 588 .extra1 = &zero, 589 .extra2 = &one, 590 }, 591 { 592 .procname = "tcp_invalid_ratelimit", 593 .data = &sysctl_tcp_invalid_ratelimit, 594 .maxlen = sizeof(int), 595 .mode = 0644, 596 .proc_handler = proc_dointvec_ms_jiffies, 597 }, 598 { 599 .procname = "icmp_msgs_per_sec", 600 .data = &sysctl_icmp_msgs_per_sec, 601 .maxlen = sizeof(int), 602 .mode = 0644, 603 .proc_handler = proc_dointvec_minmax, 604 .extra1 = &zero, 605 }, 606 { 607 .procname = "icmp_msgs_burst", 608 .data = &sysctl_icmp_msgs_burst, 609 .maxlen = sizeof(int), 610 .mode = 0644, 611 .proc_handler = proc_dointvec_minmax, 612 .extra1 = &zero, 613 }, 614 { 615 .procname = "udp_mem", 616 .data = &sysctl_udp_mem, 617 .maxlen = sizeof(sysctl_udp_mem), 618 .mode = 0644, 619 .proc_handler = proc_doulongvec_minmax, 620 }, 621 { 622 .procname = "udp_rmem_min", 623 .data = &sysctl_udp_rmem_min, 624 .maxlen = sizeof(sysctl_udp_rmem_min), 625 .mode = 0644, 626 .proc_handler = proc_dointvec_minmax, 627 .extra1 = &one 628 }, 629 { 630 .procname = "udp_wmem_min", 631 .data = &sysctl_udp_wmem_min, 632 .maxlen = sizeof(sysctl_udp_wmem_min), 633 .mode = 0644, 634 .proc_handler = proc_dointvec_minmax, 635 .extra1 = &one 636 }, 637 { } 638 }; 639 640 static struct ctl_table ipv4_net_table[] = { 641 { 642 .procname = "icmp_echo_ignore_all", 643 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 644 .maxlen = sizeof(int), 645 .mode = 0644, 646 .proc_handler = proc_dointvec 647 }, 648 { 649 .procname = "icmp_echo_ignore_broadcasts", 650 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 651 .maxlen = sizeof(int), 652 .mode = 0644, 653 .proc_handler = proc_dointvec 654 }, 655 { 656 .procname = "icmp_ignore_bogus_error_responses", 657 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 658 .maxlen = sizeof(int), 659 .mode = 0644, 660 .proc_handler = proc_dointvec 661 }, 662 { 663 .procname = "icmp_errors_use_inbound_ifaddr", 664 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 665 .maxlen = sizeof(int), 666 .mode = 0644, 667 .proc_handler = proc_dointvec 668 }, 669 { 670 .procname = "icmp_ratelimit", 671 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 672 .maxlen = sizeof(int), 673 .mode = 0644, 674 .proc_handler = proc_dointvec_ms_jiffies, 675 }, 676 { 677 .procname = "icmp_ratemask", 678 .data = &init_net.ipv4.sysctl_icmp_ratemask, 679 .maxlen = sizeof(int), 680 .mode = 0644, 681 .proc_handler = proc_dointvec 682 }, 683 { 684 .procname = "ping_group_range", 685 .data = &init_net.ipv4.ping_group_range.range, 686 .maxlen = sizeof(gid_t)*2, 687 .mode = 0644, 688 .proc_handler = ipv4_ping_group_range, 689 }, 690 { 691 .procname = "tcp_ecn", 692 .data = &init_net.ipv4.sysctl_tcp_ecn, 693 .maxlen = sizeof(int), 694 .mode = 0644, 695 .proc_handler = proc_dointvec 696 }, 697 { 698 .procname = "tcp_ecn_fallback", 699 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 700 .maxlen = sizeof(int), 701 .mode = 0644, 702 .proc_handler = proc_dointvec 703 }, 704 { 705 .procname = "ip_dynaddr", 706 .data = &init_net.ipv4.sysctl_ip_dynaddr, 707 .maxlen = sizeof(int), 708 .mode = 0644, 709 .proc_handler = proc_dointvec 710 }, 711 { 712 .procname = "ip_early_demux", 713 .data = &init_net.ipv4.sysctl_ip_early_demux, 714 .maxlen = sizeof(int), 715 .mode = 0644, 716 .proc_handler = proc_dointvec 717 }, 718 { 719 .procname = "ip_default_ttl", 720 .data = &init_net.ipv4.sysctl_ip_default_ttl, 721 .maxlen = sizeof(int), 722 .mode = 0644, 723 .proc_handler = proc_dointvec_minmax, 724 .extra1 = &ip_ttl_min, 725 .extra2 = &ip_ttl_max, 726 }, 727 { 728 .procname = "ip_local_port_range", 729 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 730 .data = &init_net.ipv4.ip_local_ports.range, 731 .mode = 0644, 732 .proc_handler = ipv4_local_port_range, 733 }, 734 { 735 .procname = "ip_local_reserved_ports", 736 .data = &init_net.ipv4.sysctl_local_reserved_ports, 737 .maxlen = 65536, 738 .mode = 0644, 739 .proc_handler = proc_do_large_bitmap, 740 }, 741 { 742 .procname = "ip_no_pmtu_disc", 743 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 744 .maxlen = sizeof(int), 745 .mode = 0644, 746 .proc_handler = proc_dointvec 747 }, 748 { 749 .procname = "ip_forward_use_pmtu", 750 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 751 .maxlen = sizeof(int), 752 .mode = 0644, 753 .proc_handler = proc_dointvec, 754 }, 755 { 756 .procname = "ip_nonlocal_bind", 757 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 758 .maxlen = sizeof(int), 759 .mode = 0644, 760 .proc_handler = proc_dointvec 761 }, 762 { 763 .procname = "fwmark_reflect", 764 .data = &init_net.ipv4.sysctl_fwmark_reflect, 765 .maxlen = sizeof(int), 766 .mode = 0644, 767 .proc_handler = proc_dointvec, 768 }, 769 { 770 .procname = "tcp_fwmark_accept", 771 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 772 .maxlen = sizeof(int), 773 .mode = 0644, 774 .proc_handler = proc_dointvec, 775 }, 776 #ifdef CONFIG_NET_L3_MASTER_DEV 777 { 778 .procname = "tcp_l3mdev_accept", 779 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 780 .maxlen = sizeof(int), 781 .mode = 0644, 782 .proc_handler = proc_dointvec_minmax, 783 .extra1 = &zero, 784 .extra2 = &one, 785 }, 786 #endif 787 { 788 .procname = "tcp_mtu_probing", 789 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 790 .maxlen = sizeof(int), 791 .mode = 0644, 792 .proc_handler = proc_dointvec, 793 }, 794 { 795 .procname = "tcp_base_mss", 796 .data = &init_net.ipv4.sysctl_tcp_base_mss, 797 .maxlen = sizeof(int), 798 .mode = 0644, 799 .proc_handler = proc_dointvec, 800 }, 801 { 802 .procname = "tcp_probe_threshold", 803 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 804 .maxlen = sizeof(int), 805 .mode = 0644, 806 .proc_handler = proc_dointvec, 807 }, 808 { 809 .procname = "tcp_probe_interval", 810 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 811 .maxlen = sizeof(int), 812 .mode = 0644, 813 .proc_handler = proc_dointvec, 814 }, 815 { 816 .procname = "igmp_link_local_mcast_reports", 817 .data = &init_net.ipv4.sysctl_igmp_llm_reports, 818 .maxlen = sizeof(int), 819 .mode = 0644, 820 .proc_handler = proc_dointvec 821 }, 822 { 823 .procname = "igmp_max_memberships", 824 .data = &init_net.ipv4.sysctl_igmp_max_memberships, 825 .maxlen = sizeof(int), 826 .mode = 0644, 827 .proc_handler = proc_dointvec 828 }, 829 { 830 .procname = "igmp_max_msf", 831 .data = &init_net.ipv4.sysctl_igmp_max_msf, 832 .maxlen = sizeof(int), 833 .mode = 0644, 834 .proc_handler = proc_dointvec 835 }, 836 #ifdef CONFIG_IP_MULTICAST 837 { 838 .procname = "igmp_qrv", 839 .data = &init_net.ipv4.sysctl_igmp_qrv, 840 .maxlen = sizeof(int), 841 .mode = 0644, 842 .proc_handler = proc_dointvec_minmax, 843 .extra1 = &one 844 }, 845 #endif 846 { 847 .procname = "tcp_keepalive_time", 848 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 849 .maxlen = sizeof(int), 850 .mode = 0644, 851 .proc_handler = proc_dointvec_jiffies, 852 }, 853 { 854 .procname = "tcp_keepalive_probes", 855 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 856 .maxlen = sizeof(int), 857 .mode = 0644, 858 .proc_handler = proc_dointvec 859 }, 860 { 861 .procname = "tcp_keepalive_intvl", 862 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 863 .maxlen = sizeof(int), 864 .mode = 0644, 865 .proc_handler = proc_dointvec_jiffies, 866 }, 867 { 868 .procname = "tcp_syn_retries", 869 .data = &init_net.ipv4.sysctl_tcp_syn_retries, 870 .maxlen = sizeof(int), 871 .mode = 0644, 872 .proc_handler = proc_dointvec_minmax, 873 .extra1 = &tcp_syn_retries_min, 874 .extra2 = &tcp_syn_retries_max 875 }, 876 { 877 .procname = "tcp_synack_retries", 878 .data = &init_net.ipv4.sysctl_tcp_synack_retries, 879 .maxlen = sizeof(int), 880 .mode = 0644, 881 .proc_handler = proc_dointvec 882 }, 883 #ifdef CONFIG_SYN_COOKIES 884 { 885 .procname = "tcp_syncookies", 886 .data = &init_net.ipv4.sysctl_tcp_syncookies, 887 .maxlen = sizeof(int), 888 .mode = 0644, 889 .proc_handler = proc_dointvec 890 }, 891 #endif 892 { 893 .procname = "tcp_reordering", 894 .data = &init_net.ipv4.sysctl_tcp_reordering, 895 .maxlen = sizeof(int), 896 .mode = 0644, 897 .proc_handler = proc_dointvec 898 }, 899 { 900 .procname = "tcp_retries1", 901 .data = &init_net.ipv4.sysctl_tcp_retries1, 902 .maxlen = sizeof(int), 903 .mode = 0644, 904 .proc_handler = proc_dointvec_minmax, 905 .extra2 = &tcp_retr1_max 906 }, 907 { 908 .procname = "tcp_retries2", 909 .data = &init_net.ipv4.sysctl_tcp_retries2, 910 .maxlen = sizeof(int), 911 .mode = 0644, 912 .proc_handler = proc_dointvec 913 }, 914 { 915 .procname = "tcp_orphan_retries", 916 .data = &init_net.ipv4.sysctl_tcp_orphan_retries, 917 .maxlen = sizeof(int), 918 .mode = 0644, 919 .proc_handler = proc_dointvec 920 }, 921 { 922 .procname = "tcp_fin_timeout", 923 .data = &init_net.ipv4.sysctl_tcp_fin_timeout, 924 .maxlen = sizeof(int), 925 .mode = 0644, 926 .proc_handler = proc_dointvec_jiffies, 927 }, 928 { 929 .procname = "tcp_notsent_lowat", 930 .data = &init_net.ipv4.sysctl_tcp_notsent_lowat, 931 .maxlen = sizeof(unsigned int), 932 .mode = 0644, 933 .proc_handler = proc_dointvec, 934 }, 935 { 936 .procname = "tcp_tw_reuse", 937 .data = &init_net.ipv4.sysctl_tcp_tw_reuse, 938 .maxlen = sizeof(int), 939 .mode = 0644, 940 .proc_handler = proc_dointvec 941 }, 942 { 943 .procname = "tcp_max_tw_buckets", 944 .data = &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets, 945 .maxlen = sizeof(int), 946 .mode = 0644, 947 .proc_handler = proc_dointvec 948 }, 949 { 950 .procname = "tcp_tw_recycle", 951 .data = &init_net.ipv4.tcp_death_row.sysctl_tw_recycle, 952 .maxlen = sizeof(int), 953 .mode = 0644, 954 .proc_handler = proc_dointvec 955 }, 956 { 957 .procname = "tcp_max_syn_backlog", 958 .data = &init_net.ipv4.sysctl_max_syn_backlog, 959 .maxlen = sizeof(int), 960 .mode = 0644, 961 .proc_handler = proc_dointvec 962 }, 963 #ifdef CONFIG_IP_ROUTE_MULTIPATH 964 { 965 .procname = "fib_multipath_use_neigh", 966 .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh, 967 .maxlen = sizeof(int), 968 .mode = 0644, 969 .proc_handler = proc_dointvec_minmax, 970 .extra1 = &zero, 971 .extra2 = &one, 972 }, 973 #endif 974 { } 975 }; 976 977 static __net_init int ipv4_sysctl_init_net(struct net *net) 978 { 979 struct ctl_table *table; 980 981 table = ipv4_net_table; 982 if (!net_eq(net, &init_net)) { 983 int i; 984 985 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 986 if (!table) 987 goto err_alloc; 988 989 /* Update the variables to point into the current struct net */ 990 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 991 table[i].data += (void *)net - (void *)&init_net; 992 } 993 994 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 995 if (!net->ipv4.ipv4_hdr) 996 goto err_reg; 997 998 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 999 if (!net->ipv4.sysctl_local_reserved_ports) 1000 goto err_ports; 1001 1002 return 0; 1003 1004 err_ports: 1005 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1006 err_reg: 1007 if (!net_eq(net, &init_net)) 1008 kfree(table); 1009 err_alloc: 1010 return -ENOMEM; 1011 } 1012 1013 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1014 { 1015 struct ctl_table *table; 1016 1017 kfree(net->ipv4.sysctl_local_reserved_ports); 1018 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1019 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1020 kfree(table); 1021 } 1022 1023 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1024 .init = ipv4_sysctl_init_net, 1025 .exit = ipv4_sysctl_exit_net, 1026 }; 1027 1028 static __init int sysctl_ipv4_init(void) 1029 { 1030 struct ctl_table_header *hdr; 1031 1032 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1033 if (!hdr) 1034 return -ENOMEM; 1035 1036 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1037 unregister_net_sysctl_table(hdr); 1038 return -ENOMEM; 1039 } 1040 1041 return 0; 1042 } 1043 1044 __initcall(sysctl_ipv4_init); 1045