1// SPDX-License-Identifier: GPL-2.0 2/* 3 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 4 * 5 * Begun April 1, 1996, Mike Shaver. 6 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 7 */ 8 9#include <linux/mm.h> 10#include <linux/module.h> 11#include <linux/sysctl.h> 12#include <linux/igmp.h> 13#include <linux/inetdevice.h> 14#include <linux/seqlock.h> 15#include <linux/init.h> 16#include <linux/slab.h> 17#include <linux/nsproxy.h> 18#include <linux/swap.h> 19#include <net/snmp.h> 20#include <net/icmp.h> 21#include <net/ip.h> 22#include <net/route.h> 23#include <net/tcp.h> 24#include <net/udp.h> 25#include <net/cipso_ipv4.h> 26#include <net/inet_frag.h> 27#include <net/ping.h> 28#include <net/protocol.h> 29#include <net/netevent.h> 30 31static int two = 2; 32static int four = 4; 33static int thousand = 1000; 34static int tcp_retr1_max = 255; 35static int ip_local_port_range_min[] = { 1, 1 }; 36static int ip_local_port_range_max[] = { 65535, 65535 }; 37static int tcp_adv_win_scale_min = -31; 38static int tcp_adv_win_scale_max = 31; 39static int tcp_app_win_max = 31; 40static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; 41static int tcp_min_snd_mss_max = 65535; 42static int ip_privileged_port_min; 43static int ip_privileged_port_max = 65535; 44static int ip_ttl_min = 1; 45static int ip_ttl_max = 255; 46static int tcp_syn_retries_min = 1; 47static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 48static int ip_ping_group_range_min[] = { 0, 0 }; 49static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 50static int comp_sack_nr_max = 255; 51static u32 u32_max_div_HZ = UINT_MAX / HZ; 52static int one_day_secs = 24 * 3600; 53 54/* obsolete */ 55static int sysctl_tcp_low_latency __read_mostly; 56 57/* Update system visible IP port range */ 58static void set_local_port_range(struct net *net, int range[2]) 59{ 60 bool same_parity = !((range[0] ^ range[1]) & 1); 61 62 write_seqlock_bh(&net->ipv4.ip_local_ports.lock); 63 if (same_parity && !net->ipv4.ip_local_ports.warned) { 64 net->ipv4.ip_local_ports.warned = true; 65 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 66 } 67 net->ipv4.ip_local_ports.range[0] = range[0]; 68 net->ipv4.ip_local_ports.range[1] = range[1]; 69 write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); 70} 71 72/* Validate changes from /proc interface. */ 73static int ipv4_local_port_range(struct ctl_table *table, int write, 74 void *buffer, size_t *lenp, loff_t *ppos) 75{ 76 struct net *net = 77 container_of(table->data, struct net, ipv4.ip_local_ports.range); 78 int ret; 79 int range[2]; 80 struct ctl_table tmp = { 81 .data = &range, 82 .maxlen = sizeof(range), 83 .mode = table->mode, 84 .extra1 = &ip_local_port_range_min, 85 .extra2 = &ip_local_port_range_max, 86 }; 87 88 inet_get_local_port_range(net, &range[0], &range[1]); 89 90 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 91 92 if (write && ret == 0) { 93 /* Ensure that the upper limit is not smaller than the lower, 94 * and that the lower does not encroach upon the privileged 95 * port limit. 96 */ 97 if ((range[1] < range[0]) || 98 (range[0] < READ_ONCE(net->ipv4.sysctl_ip_prot_sock))) 99 ret = -EINVAL; 100 else 101 set_local_port_range(net, range); 102 } 103 104 return ret; 105} 106 107/* Validate changes from /proc interface. */ 108static int ipv4_privileged_ports(struct ctl_table *table, int write, 109 void *buffer, size_t *lenp, loff_t *ppos) 110{ 111 struct net *net = container_of(table->data, struct net, 112 ipv4.sysctl_ip_prot_sock); 113 int ret; 114 int pports; 115 int range[2]; 116 struct ctl_table tmp = { 117 .data = &pports, 118 .maxlen = sizeof(pports), 119 .mode = table->mode, 120 .extra1 = &ip_privileged_port_min, 121 .extra2 = &ip_privileged_port_max, 122 }; 123 124 pports = READ_ONCE(net->ipv4.sysctl_ip_prot_sock); 125 126 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 127 128 if (write && ret == 0) { 129 inet_get_local_port_range(net, &range[0], &range[1]); 130 /* Ensure that the local port range doesn't overlap with the 131 * privileged port range. 132 */ 133 if (range[0] < pports) 134 ret = -EINVAL; 135 else 136 WRITE_ONCE(net->ipv4.sysctl_ip_prot_sock, pports); 137 } 138 139 return ret; 140} 141 142static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 143{ 144 kgid_t *data = table->data; 145 struct net *net = 146 container_of(table->data, struct net, ipv4.ping_group_range.range); 147 unsigned int seq; 148 do { 149 seq = read_seqbegin(&net->ipv4.ping_group_range.lock); 150 151 *low = data[0]; 152 *high = data[1]; 153 } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); 154} 155 156/* Update system visible IP port range */ 157static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 158{ 159 kgid_t *data = table->data; 160 struct net *net = 161 container_of(table->data, struct net, ipv4.ping_group_range.range); 162 write_seqlock(&net->ipv4.ping_group_range.lock); 163 data[0] = low; 164 data[1] = high; 165 write_sequnlock(&net->ipv4.ping_group_range.lock); 166} 167 168/* Validate changes from /proc interface. */ 169static int ipv4_ping_group_range(struct ctl_table *table, int write, 170 void *buffer, size_t *lenp, loff_t *ppos) 171{ 172 struct user_namespace *user_ns = current_user_ns(); 173 int ret; 174 gid_t urange[2]; 175 kgid_t low, high; 176 struct ctl_table tmp = { 177 .data = &urange, 178 .maxlen = sizeof(urange), 179 .mode = table->mode, 180 .extra1 = &ip_ping_group_range_min, 181 .extra2 = &ip_ping_group_range_max, 182 }; 183 184 inet_get_ping_group_range_table(table, &low, &high); 185 urange[0] = from_kgid_munged(user_ns, low); 186 urange[1] = from_kgid_munged(user_ns, high); 187 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 188 189 if (write && ret == 0) { 190 low = make_kgid(user_ns, urange[0]); 191 high = make_kgid(user_ns, urange[1]); 192 if (!gid_valid(low) || !gid_valid(high)) 193 return -EINVAL; 194 if (urange[1] < urange[0] || gid_lt(high, low)) { 195 low = make_kgid(&init_user_ns, 1); 196 high = make_kgid(&init_user_ns, 0); 197 } 198 set_ping_group_range(table, low, high); 199 } 200 201 return ret; 202} 203 204static int ipv4_fwd_update_priority(struct ctl_table *table, int write, 205 void *buffer, size_t *lenp, loff_t *ppos) 206{ 207 struct net *net; 208 int ret; 209 210 net = container_of(table->data, struct net, 211 ipv4.sysctl_ip_fwd_update_priority); 212 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 213 if (write && ret == 0) 214 call_netevent_notifiers(NETEVENT_IPV4_FWD_UPDATE_PRIORITY_UPDATE, 215 net); 216 217 return ret; 218} 219 220static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 221 void *buffer, size_t *lenp, loff_t *ppos) 222{ 223 struct net *net = container_of(ctl->data, struct net, 224 ipv4.tcp_congestion_control); 225 char val[TCP_CA_NAME_MAX]; 226 struct ctl_table tbl = { 227 .data = val, 228 .maxlen = TCP_CA_NAME_MAX, 229 }; 230 int ret; 231 232 tcp_get_default_congestion_control(net, val); 233 234 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 235 if (write && ret == 0) 236 ret = tcp_set_default_congestion_control(net, val); 237 return ret; 238} 239 240static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 241 int write, void *buffer, 242 size_t *lenp, loff_t *ppos) 243{ 244 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 245 int ret; 246 247 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 248 if (!tbl.data) 249 return -ENOMEM; 250 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 251 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 252 kfree(tbl.data); 253 return ret; 254} 255 256static int proc_allowed_congestion_control(struct ctl_table *ctl, 257 int write, void *buffer, 258 size_t *lenp, loff_t *ppos) 259{ 260 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 261 int ret; 262 263 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 264 if (!tbl.data) 265 return -ENOMEM; 266 267 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 268 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 269 if (write && ret == 0) 270 ret = tcp_set_allowed_congestion_control(tbl.data); 271 kfree(tbl.data); 272 return ret; 273} 274 275static int sscanf_key(char *buf, __le32 *key) 276{ 277 u32 user_key[4]; 278 int i, ret = 0; 279 280 if (sscanf(buf, "%x-%x-%x-%x", user_key, user_key + 1, 281 user_key + 2, user_key + 3) != 4) { 282 ret = -EINVAL; 283 } else { 284 for (i = 0; i < ARRAY_SIZE(user_key); i++) 285 key[i] = cpu_to_le32(user_key[i]); 286 } 287 pr_debug("proc TFO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 288 user_key[0], user_key[1], user_key[2], user_key[3], buf, ret); 289 290 return ret; 291} 292 293static int proc_tcp_fastopen_key(struct ctl_table *table, int write, 294 void *buffer, size_t *lenp, loff_t *ppos) 295{ 296 struct net *net = container_of(table->data, struct net, 297 ipv4.sysctl_tcp_fastopen); 298 /* maxlen to print the list of keys in hex (*2), with dashes 299 * separating doublewords and a comma in between keys. 300 */ 301 struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 302 2 * TCP_FASTOPEN_KEY_MAX) + 303 (TCP_FASTOPEN_KEY_MAX * 5)) }; 304 u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)]; 305 __le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)]; 306 char *backup_data; 307 int ret, i = 0, off = 0, n_keys; 308 309 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 310 if (!tbl.data) 311 return -ENOMEM; 312 313 n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key); 314 if (!n_keys) { 315 memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH); 316 n_keys = 1; 317 } 318 319 for (i = 0; i < n_keys * 4; i++) 320 user_key[i] = le32_to_cpu(key[i]); 321 322 for (i = 0; i < n_keys; i++) { 323 off += snprintf(tbl.data + off, tbl.maxlen - off, 324 "%08x-%08x-%08x-%08x", 325 user_key[i * 4], 326 user_key[i * 4 + 1], 327 user_key[i * 4 + 2], 328 user_key[i * 4 + 3]); 329 330 if (WARN_ON_ONCE(off >= tbl.maxlen - 1)) 331 break; 332 333 if (i + 1 < n_keys) 334 off += snprintf(tbl.data + off, tbl.maxlen - off, ","); 335 } 336 337 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 338 339 if (write && ret == 0) { 340 backup_data = strchr(tbl.data, ','); 341 if (backup_data) { 342 *backup_data = '\0'; 343 backup_data++; 344 } 345 if (sscanf_key(tbl.data, key)) { 346 ret = -EINVAL; 347 goto bad_key; 348 } 349 if (backup_data) { 350 if (sscanf_key(backup_data, key + 4)) { 351 ret = -EINVAL; 352 goto bad_key; 353 } 354 } 355 tcp_fastopen_reset_cipher(net, NULL, key, 356 backup_data ? key + 4 : NULL); 357 } 358 359bad_key: 360 kfree(tbl.data); 361 return ret; 362} 363 364static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table, 365 int write, void *buffer, 366 size_t *lenp, loff_t *ppos) 367{ 368 struct net *net = container_of(table->data, struct net, 369 ipv4.sysctl_tcp_fastopen_blackhole_timeout); 370 int ret; 371 372 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 373 if (write && ret == 0) 374 atomic_set(&net->ipv4.tfo_active_disable_times, 0); 375 376 return ret; 377} 378 379static int proc_tcp_available_ulp(struct ctl_table *ctl, 380 int write, void *buffer, size_t *lenp, 381 loff_t *ppos) 382{ 383 struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, }; 384 int ret; 385 386 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 387 if (!tbl.data) 388 return -ENOMEM; 389 tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX); 390 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 391 kfree(tbl.data); 392 393 return ret; 394} 395 396#ifdef CONFIG_IP_ROUTE_MULTIPATH 397static int proc_fib_multipath_hash_policy(struct ctl_table *table, int write, 398 void *buffer, size_t *lenp, 399 loff_t *ppos) 400{ 401 struct net *net = container_of(table->data, struct net, 402 ipv4.sysctl_fib_multipath_hash_policy); 403 int ret; 404 405 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 406 if (write && ret == 0) 407 call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net); 408 409 return ret; 410} 411#endif 412 413static struct ctl_table ipv4_table[] = { 414 { 415 .procname = "tcp_max_orphans", 416 .data = &sysctl_tcp_max_orphans, 417 .maxlen = sizeof(int), 418 .mode = 0644, 419 .proc_handler = proc_dointvec 420 }, 421 { 422 .procname = "inet_peer_threshold", 423 .data = &inet_peer_threshold, 424 .maxlen = sizeof(int), 425 .mode = 0644, 426 .proc_handler = proc_dointvec 427 }, 428 { 429 .procname = "inet_peer_minttl", 430 .data = &inet_peer_minttl, 431 .maxlen = sizeof(int), 432 .mode = 0644, 433 .proc_handler = proc_dointvec_jiffies, 434 }, 435 { 436 .procname = "inet_peer_maxttl", 437 .data = &inet_peer_maxttl, 438 .maxlen = sizeof(int), 439 .mode = 0644, 440 .proc_handler = proc_dointvec_jiffies, 441 }, 442 { 443 .procname = "tcp_mem", 444 .maxlen = sizeof(sysctl_tcp_mem), 445 .data = &sysctl_tcp_mem, 446 .mode = 0644, 447 .proc_handler = proc_doulongvec_minmax, 448 }, 449 { 450 .procname = "tcp_low_latency", 451 .data = &sysctl_tcp_low_latency, 452 .maxlen = sizeof(int), 453 .mode = 0644, 454 .proc_handler = proc_dointvec 455 }, 456#ifdef CONFIG_NETLABEL 457 { 458 .procname = "cipso_cache_enable", 459 .data = &cipso_v4_cache_enabled, 460 .maxlen = sizeof(int), 461 .mode = 0644, 462 .proc_handler = proc_dointvec, 463 }, 464 { 465 .procname = "cipso_cache_bucket_size", 466 .data = &cipso_v4_cache_bucketsize, 467 .maxlen = sizeof(int), 468 .mode = 0644, 469 .proc_handler = proc_dointvec, 470 }, 471 { 472 .procname = "cipso_rbm_optfmt", 473 .data = &cipso_v4_rbm_optfmt, 474 .maxlen = sizeof(int), 475 .mode = 0644, 476 .proc_handler = proc_dointvec, 477 }, 478 { 479 .procname = "cipso_rbm_strictvalid", 480 .data = &cipso_v4_rbm_strictvalid, 481 .maxlen = sizeof(int), 482 .mode = 0644, 483 .proc_handler = proc_dointvec, 484 }, 485#endif /* CONFIG_NETLABEL */ 486 { 487 .procname = "tcp_available_ulp", 488 .maxlen = TCP_ULP_BUF_MAX, 489 .mode = 0444, 490 .proc_handler = proc_tcp_available_ulp, 491 }, 492 { 493 .procname = "icmp_msgs_per_sec", 494 .data = &sysctl_icmp_msgs_per_sec, 495 .maxlen = sizeof(int), 496 .mode = 0644, 497 .proc_handler = proc_dointvec_minmax, 498 .extra1 = SYSCTL_ZERO, 499 }, 500 { 501 .procname = "icmp_msgs_burst", 502 .data = &sysctl_icmp_msgs_burst, 503 .maxlen = sizeof(int), 504 .mode = 0644, 505 .proc_handler = proc_dointvec_minmax, 506 .extra1 = SYSCTL_ZERO, 507 }, 508 { 509 .procname = "udp_mem", 510 .data = &sysctl_udp_mem, 511 .maxlen = sizeof(sysctl_udp_mem), 512 .mode = 0644, 513 .proc_handler = proc_doulongvec_minmax, 514 }, 515 { 516 .procname = "fib_sync_mem", 517 .data = &sysctl_fib_sync_mem, 518 .maxlen = sizeof(sysctl_fib_sync_mem), 519 .mode = 0644, 520 .proc_handler = proc_douintvec_minmax, 521 .extra1 = &sysctl_fib_sync_mem_min, 522 .extra2 = &sysctl_fib_sync_mem_max, 523 }, 524 { 525 .procname = "tcp_rx_skb_cache", 526 .data = &tcp_rx_skb_cache_key.key, 527 .mode = 0644, 528 .proc_handler = proc_do_static_key, 529 }, 530 { 531 .procname = "tcp_tx_skb_cache", 532 .data = &tcp_tx_skb_cache_key.key, 533 .mode = 0644, 534 .proc_handler = proc_do_static_key, 535 }, 536 { } 537}; 538 539static struct ctl_table ipv4_net_table[] = { 540 { 541 .procname = "icmp_echo_ignore_all", 542 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 543 .maxlen = sizeof(u8), 544 .mode = 0644, 545 .proc_handler = proc_dou8vec_minmax, 546 }, 547 { 548 .procname = "icmp_echo_ignore_broadcasts", 549 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 550 .maxlen = sizeof(u8), 551 .mode = 0644, 552 .proc_handler = proc_dou8vec_minmax, 553 }, 554 { 555 .procname = "icmp_ignore_bogus_error_responses", 556 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 557 .maxlen = sizeof(u8), 558 .mode = 0644, 559 .proc_handler = proc_dou8vec_minmax, 560 }, 561 { 562 .procname = "icmp_errors_use_inbound_ifaddr", 563 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 564 .maxlen = sizeof(u8), 565 .mode = 0644, 566 .proc_handler = proc_dou8vec_minmax, 567 }, 568 { 569 .procname = "icmp_ratelimit", 570 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 571 .maxlen = sizeof(int), 572 .mode = 0644, 573 .proc_handler = proc_dointvec_ms_jiffies, 574 }, 575 { 576 .procname = "icmp_ratemask", 577 .data = &init_net.ipv4.sysctl_icmp_ratemask, 578 .maxlen = sizeof(int), 579 .mode = 0644, 580 .proc_handler = proc_dointvec 581 }, 582 { 583 .procname = "ping_group_range", 584 .data = &init_net.ipv4.ping_group_range.range, 585 .maxlen = sizeof(gid_t)*2, 586 .mode = 0644, 587 .proc_handler = ipv4_ping_group_range, 588 }, 589#ifdef CONFIG_NET_L3_MASTER_DEV 590 { 591 .procname = "raw_l3mdev_accept", 592 .data = &init_net.ipv4.sysctl_raw_l3mdev_accept, 593 .maxlen = sizeof(u8), 594 .mode = 0644, 595 .proc_handler = proc_dou8vec_minmax, 596 .extra1 = SYSCTL_ZERO, 597 .extra2 = SYSCTL_ONE, 598 }, 599#endif 600 { 601 .procname = "tcp_ecn", 602 .data = &init_net.ipv4.sysctl_tcp_ecn, 603 .maxlen = sizeof(u8), 604 .mode = 0644, 605 .proc_handler = proc_dou8vec_minmax, 606 }, 607 { 608 .procname = "tcp_ecn_fallback", 609 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 610 .maxlen = sizeof(u8), 611 .mode = 0644, 612 .proc_handler = proc_dou8vec_minmax, 613 }, 614 { 615 .procname = "ip_dynaddr", 616 .data = &init_net.ipv4.sysctl_ip_dynaddr, 617 .maxlen = sizeof(u8), 618 .mode = 0644, 619 .proc_handler = proc_dou8vec_minmax, 620 }, 621 { 622 .procname = "ip_early_demux", 623 .data = &init_net.ipv4.sysctl_ip_early_demux, 624 .maxlen = sizeof(u8), 625 .mode = 0644, 626 .proc_handler = proc_dou8vec_minmax, 627 }, 628 { 629 .procname = "udp_early_demux", 630 .data = &init_net.ipv4.sysctl_udp_early_demux, 631 .maxlen = sizeof(int), 632 .mode = 0644, 633 .proc_handler = proc_douintvec_minmax, 634 }, 635 { 636 .procname = "tcp_early_demux", 637 .data = &init_net.ipv4.sysctl_tcp_early_demux, 638 .maxlen = sizeof(int), 639 .mode = 0644, 640 .proc_handler = proc_douintvec_minmax, 641 }, 642 { 643 .procname = "nexthop_compat_mode", 644 .data = &init_net.ipv4.sysctl_nexthop_compat_mode, 645 .maxlen = sizeof(u8), 646 .mode = 0644, 647 .proc_handler = proc_dou8vec_minmax, 648 .extra1 = SYSCTL_ZERO, 649 .extra2 = SYSCTL_ONE, 650 }, 651 { 652 .procname = "ip_default_ttl", 653 .data = &init_net.ipv4.sysctl_ip_default_ttl, 654 .maxlen = sizeof(u8), 655 .mode = 0644, 656 .proc_handler = proc_dou8vec_minmax, 657 .extra1 = &ip_ttl_min, 658 .extra2 = &ip_ttl_max, 659 }, 660 { 661 .procname = "ip_local_port_range", 662 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 663 .data = &init_net.ipv4.ip_local_ports.range, 664 .mode = 0644, 665 .proc_handler = ipv4_local_port_range, 666 }, 667 { 668 .procname = "ip_local_reserved_ports", 669 .data = &init_net.ipv4.sysctl_local_reserved_ports, 670 .maxlen = 65536, 671 .mode = 0644, 672 .proc_handler = proc_do_large_bitmap, 673 }, 674 { 675 .procname = "ip_no_pmtu_disc", 676 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 677 .maxlen = sizeof(u8), 678 .mode = 0644, 679 .proc_handler = proc_dou8vec_minmax, 680 }, 681 { 682 .procname = "ip_forward_use_pmtu", 683 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 684 .maxlen = sizeof(u8), 685 .mode = 0644, 686 .proc_handler = proc_dou8vec_minmax, 687 }, 688 { 689 .procname = "ip_forward_update_priority", 690 .data = &init_net.ipv4.sysctl_ip_fwd_update_priority, 691 .maxlen = sizeof(int), 692 .mode = 0644, 693 .proc_handler = ipv4_fwd_update_priority, 694 .extra1 = SYSCTL_ZERO, 695 .extra2 = SYSCTL_ONE, 696 }, 697 { 698 .procname = "ip_nonlocal_bind", 699 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 700 .maxlen = sizeof(u8), 701 .mode = 0644, 702 .proc_handler = proc_dou8vec_minmax, 703 }, 704 { 705 .procname = "ip_autobind_reuse", 706 .data = &init_net.ipv4.sysctl_ip_autobind_reuse, 707 .maxlen = sizeof(u8), 708 .mode = 0644, 709 .proc_handler = proc_dou8vec_minmax, 710 .extra1 = SYSCTL_ZERO, 711 .extra2 = SYSCTL_ONE, 712 }, 713 { 714 .procname = "fwmark_reflect", 715 .data = &init_net.ipv4.sysctl_fwmark_reflect, 716 .maxlen = sizeof(u8), 717 .mode = 0644, 718 .proc_handler = proc_dou8vec_minmax, 719 }, 720 { 721 .procname = "tcp_fwmark_accept", 722 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 723 .maxlen = sizeof(u8), 724 .mode = 0644, 725 .proc_handler = proc_dou8vec_minmax, 726 }, 727#ifdef CONFIG_NET_L3_MASTER_DEV 728 { 729 .procname = "tcp_l3mdev_accept", 730 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 731 .maxlen = sizeof(u8), 732 .mode = 0644, 733 .proc_handler = proc_dou8vec_minmax, 734 .extra1 = SYSCTL_ZERO, 735 .extra2 = SYSCTL_ONE, 736 }, 737#endif 738 { 739 .procname = "tcp_mtu_probing", 740 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 741 .maxlen = sizeof(u8), 742 .mode = 0644, 743 .proc_handler = proc_dou8vec_minmax, 744 }, 745 { 746 .procname = "tcp_base_mss", 747 .data = &init_net.ipv4.sysctl_tcp_base_mss, 748 .maxlen = sizeof(int), 749 .mode = 0644, 750 .proc_handler = proc_dointvec, 751 }, 752 { 753 .procname = "tcp_min_snd_mss", 754 .data = &init_net.ipv4.sysctl_tcp_min_snd_mss, 755 .maxlen = sizeof(int), 756 .mode = 0644, 757 .proc_handler = proc_dointvec_minmax, 758 .extra1 = &tcp_min_snd_mss_min, 759 .extra2 = &tcp_min_snd_mss_max, 760 }, 761 { 762 .procname = "tcp_mtu_probe_floor", 763 .data = &init_net.ipv4.sysctl_tcp_mtu_probe_floor, 764 .maxlen = sizeof(int), 765 .mode = 0644, 766 .proc_handler = proc_dointvec_minmax, 767 .extra1 = &tcp_min_snd_mss_min, 768 .extra2 = &tcp_min_snd_mss_max, 769 }, 770 { 771 .procname = "tcp_probe_threshold", 772 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 773 .maxlen = sizeof(int), 774 .mode = 0644, 775 .proc_handler = proc_dointvec, 776 }, 777 { 778 .procname = "tcp_probe_interval", 779 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 780 .maxlen = sizeof(u32), 781 .mode = 0644, 782 .proc_handler = proc_douintvec_minmax, 783 .extra2 = &u32_max_div_HZ, 784 }, 785 { 786 .procname = "igmp_link_local_mcast_reports", 787 .data = &init_net.ipv4.sysctl_igmp_llm_reports, 788 .maxlen = sizeof(int), 789 .mode = 0644, 790 .proc_handler = proc_dointvec 791 }, 792 { 793 .procname = "igmp_max_memberships", 794 .data = &init_net.ipv4.sysctl_igmp_max_memberships, 795 .maxlen = sizeof(int), 796 .mode = 0644, 797 .proc_handler = proc_dointvec 798 }, 799 { 800 .procname = "igmp_max_msf", 801 .data = &init_net.ipv4.sysctl_igmp_max_msf, 802 .maxlen = sizeof(int), 803 .mode = 0644, 804 .proc_handler = proc_dointvec 805 }, 806#ifdef CONFIG_IP_MULTICAST 807 { 808 .procname = "igmp_qrv", 809 .data = &init_net.ipv4.sysctl_igmp_qrv, 810 .maxlen = sizeof(int), 811 .mode = 0644, 812 .proc_handler = proc_dointvec_minmax, 813 .extra1 = SYSCTL_ONE 814 }, 815#endif 816 { 817 .procname = "tcp_congestion_control", 818 .data = &init_net.ipv4.tcp_congestion_control, 819 .mode = 0644, 820 .maxlen = TCP_CA_NAME_MAX, 821 .proc_handler = proc_tcp_congestion_control, 822 }, 823 { 824 .procname = "tcp_available_congestion_control", 825 .maxlen = TCP_CA_BUF_MAX, 826 .mode = 0444, 827 .proc_handler = proc_tcp_available_congestion_control, 828 }, 829 { 830 .procname = "tcp_allowed_congestion_control", 831 .maxlen = TCP_CA_BUF_MAX, 832 .mode = 0644, 833 .proc_handler = proc_allowed_congestion_control, 834 }, 835 { 836 .procname = "tcp_keepalive_time", 837 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 838 .maxlen = sizeof(int), 839 .mode = 0644, 840 .proc_handler = proc_dointvec_jiffies, 841 }, 842 { 843 .procname = "tcp_keepalive_probes", 844 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 845 .maxlen = sizeof(u8), 846 .mode = 0644, 847 .proc_handler = proc_dou8vec_minmax, 848 }, 849 { 850 .procname = "tcp_keepalive_intvl", 851 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 852 .maxlen = sizeof(int), 853 .mode = 0644, 854 .proc_handler = proc_dointvec_jiffies, 855 }, 856 { 857 .procname = "tcp_syn_retries", 858 .data = &init_net.ipv4.sysctl_tcp_syn_retries, 859 .maxlen = sizeof(u8), 860 .mode = 0644, 861 .proc_handler = proc_dou8vec_minmax, 862 .extra1 = &tcp_syn_retries_min, 863 .extra2 = &tcp_syn_retries_max 864 }, 865 { 866 .procname = "tcp_synack_retries", 867 .data = &init_net.ipv4.sysctl_tcp_synack_retries, 868 .maxlen = sizeof(u8), 869 .mode = 0644, 870 .proc_handler = proc_dou8vec_minmax, 871 }, 872#ifdef CONFIG_SYN_COOKIES 873 { 874 .procname = "tcp_syncookies", 875 .data = &init_net.ipv4.sysctl_tcp_syncookies, 876 .maxlen = sizeof(u8), 877 .mode = 0644, 878 .proc_handler = proc_dou8vec_minmax, 879 }, 880#endif 881 { 882 .procname = "tcp_migrate_req", 883 .data = &init_net.ipv4.sysctl_tcp_migrate_req, 884 .maxlen = sizeof(u8), 885 .mode = 0644, 886 .proc_handler = proc_dou8vec_minmax, 887 .extra1 = SYSCTL_ZERO, 888 .extra2 = SYSCTL_ONE 889 }, 890 { 891 .procname = "tcp_reordering", 892 .data = &init_net.ipv4.sysctl_tcp_reordering, 893 .maxlen = sizeof(int), 894 .mode = 0644, 895 .proc_handler = proc_dointvec 896 }, 897 { 898 .procname = "tcp_retries1", 899 .data = &init_net.ipv4.sysctl_tcp_retries1, 900 .maxlen = sizeof(u8), 901 .mode = 0644, 902 .proc_handler = proc_dou8vec_minmax, 903 .extra2 = &tcp_retr1_max 904 }, 905 { 906 .procname = "tcp_retries2", 907 .data = &init_net.ipv4.sysctl_tcp_retries2, 908 .maxlen = sizeof(u8), 909 .mode = 0644, 910 .proc_handler = proc_dou8vec_minmax, 911 }, 912 { 913 .procname = "tcp_orphan_retries", 914 .data = &init_net.ipv4.sysctl_tcp_orphan_retries, 915 .maxlen = sizeof(u8), 916 .mode = 0644, 917 .proc_handler = proc_dou8vec_minmax, 918 }, 919 { 920 .procname = "tcp_fin_timeout", 921 .data = &init_net.ipv4.sysctl_tcp_fin_timeout, 922 .maxlen = sizeof(int), 923 .mode = 0644, 924 .proc_handler = proc_dointvec_jiffies, 925 }, 926 { 927 .procname = "tcp_notsent_lowat", 928 .data = &init_net.ipv4.sysctl_tcp_notsent_lowat, 929 .maxlen = sizeof(unsigned int), 930 .mode = 0644, 931 .proc_handler = proc_douintvec, 932 }, 933 { 934 .procname = "tcp_tw_reuse", 935 .data = &init_net.ipv4.sysctl_tcp_tw_reuse, 936 .maxlen = sizeof(u8), 937 .mode = 0644, 938 .proc_handler = proc_dou8vec_minmax, 939 .extra1 = SYSCTL_ZERO, 940 .extra2 = &two, 941 }, 942 { 943 .procname = "tcp_max_tw_buckets", 944 .data = &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets, 945 .maxlen = sizeof(int), 946 .mode = 0644, 947 .proc_handler = proc_dointvec 948 }, 949 { 950 .procname = "tcp_max_syn_backlog", 951 .data = &init_net.ipv4.sysctl_max_syn_backlog, 952 .maxlen = sizeof(int), 953 .mode = 0644, 954 .proc_handler = proc_dointvec 955 }, 956 { 957 .procname = "tcp_fastopen", 958 .data = &init_net.ipv4.sysctl_tcp_fastopen, 959 .maxlen = sizeof(int), 960 .mode = 0644, 961 .proc_handler = proc_dointvec, 962 }, 963 { 964 .procname = "tcp_fastopen_key", 965 .mode = 0600, 966 .data = &init_net.ipv4.sysctl_tcp_fastopen, 967 /* maxlen to print the list of keys in hex (*2), with dashes 968 * separating doublewords and a comma in between keys. 969 */ 970 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 971 2 * TCP_FASTOPEN_KEY_MAX) + 972 (TCP_FASTOPEN_KEY_MAX * 5)), 973 .proc_handler = proc_tcp_fastopen_key, 974 }, 975 { 976 .procname = "tcp_fastopen_blackhole_timeout_sec", 977 .data = &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout, 978 .maxlen = sizeof(int), 979 .mode = 0644, 980 .proc_handler = proc_tfo_blackhole_detect_timeout, 981 .extra1 = SYSCTL_ZERO, 982 }, 983#ifdef CONFIG_IP_ROUTE_MULTIPATH 984 { 985 .procname = "fib_multipath_use_neigh", 986 .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh, 987 .maxlen = sizeof(int), 988 .mode = 0644, 989 .proc_handler = proc_dointvec_minmax, 990 .extra1 = SYSCTL_ZERO, 991 .extra2 = SYSCTL_ONE, 992 }, 993 { 994 .procname = "fib_multipath_hash_policy", 995 .data = &init_net.ipv4.sysctl_fib_multipath_hash_policy, 996 .maxlen = sizeof(int), 997 .mode = 0644, 998 .proc_handler = proc_fib_multipath_hash_policy, 999 .extra1 = SYSCTL_ZERO, 1000 .extra2 = &two, 1001 }, 1002#endif 1003 { 1004 .procname = "ip_unprivileged_port_start", 1005 .maxlen = sizeof(int), 1006 .data = &init_net.ipv4.sysctl_ip_prot_sock, 1007 .mode = 0644, 1008 .proc_handler = ipv4_privileged_ports, 1009 }, 1010#ifdef CONFIG_NET_L3_MASTER_DEV 1011 { 1012 .procname = "udp_l3mdev_accept", 1013 .data = &init_net.ipv4.sysctl_udp_l3mdev_accept, 1014 .maxlen = sizeof(int), 1015 .mode = 0644, 1016 .proc_handler = proc_dointvec_minmax, 1017 .extra1 = SYSCTL_ZERO, 1018 .extra2 = SYSCTL_ONE, 1019 }, 1020#endif 1021 { 1022 .procname = "tcp_sack", 1023 .data = &init_net.ipv4.sysctl_tcp_sack, 1024 .maxlen = sizeof(u8), 1025 .mode = 0644, 1026 .proc_handler = proc_dou8vec_minmax, 1027 }, 1028 { 1029 .procname = "tcp_window_scaling", 1030 .data = &init_net.ipv4.sysctl_tcp_window_scaling, 1031 .maxlen = sizeof(u8), 1032 .mode = 0644, 1033 .proc_handler = proc_dou8vec_minmax, 1034 }, 1035 { 1036 .procname = "tcp_timestamps", 1037 .data = &init_net.ipv4.sysctl_tcp_timestamps, 1038 .maxlen = sizeof(u8), 1039 .mode = 0644, 1040 .proc_handler = proc_dou8vec_minmax, 1041 }, 1042 { 1043 .procname = "tcp_early_retrans", 1044 .data = &init_net.ipv4.sysctl_tcp_early_retrans, 1045 .maxlen = sizeof(u8), 1046 .mode = 0644, 1047 .proc_handler = proc_dou8vec_minmax, 1048 .extra1 = SYSCTL_ZERO, 1049 .extra2 = &four, 1050 }, 1051 { 1052 .procname = "tcp_recovery", 1053 .data = &init_net.ipv4.sysctl_tcp_recovery, 1054 .maxlen = sizeof(u8), 1055 .mode = 0644, 1056 .proc_handler = proc_dou8vec_minmax, 1057 }, 1058 { 1059 .procname = "tcp_thin_linear_timeouts", 1060 .data = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts, 1061 .maxlen = sizeof(u8), 1062 .mode = 0644, 1063 .proc_handler = proc_dou8vec_minmax, 1064 }, 1065 { 1066 .procname = "tcp_slow_start_after_idle", 1067 .data = &init_net.ipv4.sysctl_tcp_slow_start_after_idle, 1068 .maxlen = sizeof(u8), 1069 .mode = 0644, 1070 .proc_handler = proc_dou8vec_minmax, 1071 }, 1072 { 1073 .procname = "tcp_retrans_collapse", 1074 .data = &init_net.ipv4.sysctl_tcp_retrans_collapse, 1075 .maxlen = sizeof(u8), 1076 .mode = 0644, 1077 .proc_handler = proc_dou8vec_minmax, 1078 }, 1079 { 1080 .procname = "tcp_stdurg", 1081 .data = &init_net.ipv4.sysctl_tcp_stdurg, 1082 .maxlen = sizeof(u8), 1083 .mode = 0644, 1084 .proc_handler = proc_dou8vec_minmax, 1085 }, 1086 { 1087 .procname = "tcp_rfc1337", 1088 .data = &init_net.ipv4.sysctl_tcp_rfc1337, 1089 .maxlen = sizeof(u8), 1090 .mode = 0644, 1091 .proc_handler = proc_dou8vec_minmax, 1092 }, 1093 { 1094 .procname = "tcp_abort_on_overflow", 1095 .data = &init_net.ipv4.sysctl_tcp_abort_on_overflow, 1096 .maxlen = sizeof(u8), 1097 .mode = 0644, 1098 .proc_handler = proc_dou8vec_minmax, 1099 }, 1100 { 1101 .procname = "tcp_fack", 1102 .data = &init_net.ipv4.sysctl_tcp_fack, 1103 .maxlen = sizeof(u8), 1104 .mode = 0644, 1105 .proc_handler = proc_dou8vec_minmax, 1106 }, 1107 { 1108 .procname = "tcp_max_reordering", 1109 .data = &init_net.ipv4.sysctl_tcp_max_reordering, 1110 .maxlen = sizeof(int), 1111 .mode = 0644, 1112 .proc_handler = proc_dointvec 1113 }, 1114 { 1115 .procname = "tcp_dsack", 1116 .data = &init_net.ipv4.sysctl_tcp_dsack, 1117 .maxlen = sizeof(u8), 1118 .mode = 0644, 1119 .proc_handler = proc_dou8vec_minmax, 1120 }, 1121 { 1122 .procname = "tcp_app_win", 1123 .data = &init_net.ipv4.sysctl_tcp_app_win, 1124 .maxlen = sizeof(u8), 1125 .mode = 0644, 1126 .proc_handler = proc_dou8vec_minmax, 1127 .extra1 = SYSCTL_ZERO, 1128 .extra2 = &tcp_app_win_max, 1129 }, 1130 { 1131 .procname = "tcp_adv_win_scale", 1132 .data = &init_net.ipv4.sysctl_tcp_adv_win_scale, 1133 .maxlen = sizeof(int), 1134 .mode = 0644, 1135 .proc_handler = proc_dointvec_minmax, 1136 .extra1 = &tcp_adv_win_scale_min, 1137 .extra2 = &tcp_adv_win_scale_max, 1138 }, 1139 { 1140 .procname = "tcp_frto", 1141 .data = &init_net.ipv4.sysctl_tcp_frto, 1142 .maxlen = sizeof(u8), 1143 .mode = 0644, 1144 .proc_handler = proc_dou8vec_minmax, 1145 }, 1146 { 1147 .procname = "tcp_no_metrics_save", 1148 .data = &init_net.ipv4.sysctl_tcp_nometrics_save, 1149 .maxlen = sizeof(u8), 1150 .mode = 0644, 1151 .proc_handler = proc_dou8vec_minmax, 1152 }, 1153 { 1154 .procname = "tcp_no_ssthresh_metrics_save", 1155 .data = &init_net.ipv4.sysctl_tcp_no_ssthresh_metrics_save, 1156 .maxlen = sizeof(u8), 1157 .mode = 0644, 1158 .proc_handler = proc_dou8vec_minmax, 1159 .extra1 = SYSCTL_ZERO, 1160 .extra2 = SYSCTL_ONE, 1161 }, 1162 { 1163 .procname = "tcp_moderate_rcvbuf", 1164 .data = &init_net.ipv4.sysctl_tcp_moderate_rcvbuf, 1165 .maxlen = sizeof(u8), 1166 .mode = 0644, 1167 .proc_handler = proc_dou8vec_minmax, 1168 }, 1169 { 1170 .procname = "tcp_tso_win_divisor", 1171 .data = &init_net.ipv4.sysctl_tcp_tso_win_divisor, 1172 .maxlen = sizeof(u8), 1173 .mode = 0644, 1174 .proc_handler = proc_dou8vec_minmax, 1175 }, 1176 { 1177 .procname = "tcp_workaround_signed_windows", 1178 .data = &init_net.ipv4.sysctl_tcp_workaround_signed_windows, 1179 .maxlen = sizeof(u8), 1180 .mode = 0644, 1181 .proc_handler = proc_dou8vec_minmax, 1182 }, 1183 { 1184 .procname = "tcp_limit_output_bytes", 1185 .data = &init_net.ipv4.sysctl_tcp_limit_output_bytes, 1186 .maxlen = sizeof(int), 1187 .mode = 0644, 1188 .proc_handler = proc_dointvec 1189 }, 1190 { 1191 .procname = "tcp_challenge_ack_limit", 1192 .data = &init_net.ipv4.sysctl_tcp_challenge_ack_limit, 1193 .maxlen = sizeof(int), 1194 .mode = 0644, 1195 .proc_handler = proc_dointvec 1196 }, 1197 { 1198 .procname = "tcp_min_tso_segs", 1199 .data = &init_net.ipv4.sysctl_tcp_min_tso_segs, 1200 .maxlen = sizeof(u8), 1201 .mode = 0644, 1202 .proc_handler = proc_dou8vec_minmax, 1203 .extra1 = SYSCTL_ONE, 1204 }, 1205 { 1206 .procname = "tcp_min_rtt_wlen", 1207 .data = &init_net.ipv4.sysctl_tcp_min_rtt_wlen, 1208 .maxlen = sizeof(int), 1209 .mode = 0644, 1210 .proc_handler = proc_dointvec_minmax, 1211 .extra1 = SYSCTL_ZERO, 1212 .extra2 = &one_day_secs 1213 }, 1214 { 1215 .procname = "tcp_autocorking", 1216 .data = &init_net.ipv4.sysctl_tcp_autocorking, 1217 .maxlen = sizeof(u8), 1218 .mode = 0644, 1219 .proc_handler = proc_dou8vec_minmax, 1220 .extra1 = SYSCTL_ZERO, 1221 .extra2 = SYSCTL_ONE, 1222 }, 1223 { 1224 .procname = "tcp_invalid_ratelimit", 1225 .data = &init_net.ipv4.sysctl_tcp_invalid_ratelimit, 1226 .maxlen = sizeof(int), 1227 .mode = 0644, 1228 .proc_handler = proc_dointvec_ms_jiffies, 1229 }, 1230 { 1231 .procname = "tcp_pacing_ss_ratio", 1232 .data = &init_net.ipv4.sysctl_tcp_pacing_ss_ratio, 1233 .maxlen = sizeof(int), 1234 .mode = 0644, 1235 .proc_handler = proc_dointvec_minmax, 1236 .extra1 = SYSCTL_ZERO, 1237 .extra2 = &thousand, 1238 }, 1239 { 1240 .procname = "tcp_pacing_ca_ratio", 1241 .data = &init_net.ipv4.sysctl_tcp_pacing_ca_ratio, 1242 .maxlen = sizeof(int), 1243 .mode = 0644, 1244 .proc_handler = proc_dointvec_minmax, 1245 .extra1 = SYSCTL_ZERO, 1246 .extra2 = &thousand, 1247 }, 1248 { 1249 .procname = "tcp_wmem", 1250 .data = &init_net.ipv4.sysctl_tcp_wmem, 1251 .maxlen = sizeof(init_net.ipv4.sysctl_tcp_wmem), 1252 .mode = 0644, 1253 .proc_handler = proc_dointvec_minmax, 1254 .extra1 = SYSCTL_ONE, 1255 }, 1256 { 1257 .procname = "tcp_rmem", 1258 .data = &init_net.ipv4.sysctl_tcp_rmem, 1259 .maxlen = sizeof(init_net.ipv4.sysctl_tcp_rmem), 1260 .mode = 0644, 1261 .proc_handler = proc_dointvec_minmax, 1262 .extra1 = SYSCTL_ONE, 1263 }, 1264 { 1265 .procname = "tcp_comp_sack_delay_ns", 1266 .data = &init_net.ipv4.sysctl_tcp_comp_sack_delay_ns, 1267 .maxlen = sizeof(unsigned long), 1268 .mode = 0644, 1269 .proc_handler = proc_doulongvec_minmax, 1270 }, 1271 { 1272 .procname = "tcp_comp_sack_slack_ns", 1273 .data = &init_net.ipv4.sysctl_tcp_comp_sack_slack_ns, 1274 .maxlen = sizeof(unsigned long), 1275 .mode = 0644, 1276 .proc_handler = proc_doulongvec_minmax, 1277 }, 1278 { 1279 .procname = "tcp_comp_sack_nr", 1280 .data = &init_net.ipv4.sysctl_tcp_comp_sack_nr, 1281 .maxlen = sizeof(int), 1282 .mode = 0644, 1283 .proc_handler = proc_dointvec_minmax, 1284 .extra1 = SYSCTL_ZERO, 1285 .extra2 = &comp_sack_nr_max, 1286 }, 1287 { 1288 .procname = "tcp_reflect_tos", 1289 .data = &init_net.ipv4.sysctl_tcp_reflect_tos, 1290 .maxlen = sizeof(u8), 1291 .mode = 0644, 1292 .proc_handler = proc_dou8vec_minmax, 1293 .extra1 = SYSCTL_ZERO, 1294 .extra2 = SYSCTL_ONE, 1295 }, 1296 { 1297 .procname = "udp_rmem_min", 1298 .data = &init_net.ipv4.sysctl_udp_rmem_min, 1299 .maxlen = sizeof(init_net.ipv4.sysctl_udp_rmem_min), 1300 .mode = 0644, 1301 .proc_handler = proc_dointvec_minmax, 1302 .extra1 = SYSCTL_ONE 1303 }, 1304 { 1305 .procname = "udp_wmem_min", 1306 .data = &init_net.ipv4.sysctl_udp_wmem_min, 1307 .maxlen = sizeof(init_net.ipv4.sysctl_udp_wmem_min), 1308 .mode = 0644, 1309 .proc_handler = proc_dointvec_minmax, 1310 .extra1 = SYSCTL_ONE 1311 }, 1312 { } 1313}; 1314 1315static __net_init int ipv4_sysctl_init_net(struct net *net) 1316{ 1317 struct ctl_table *table; 1318 1319 table = ipv4_net_table; 1320 if (!net_eq(net, &init_net)) { 1321 int i; 1322 1323 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 1324 if (!table) 1325 goto err_alloc; 1326 1327 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) { 1328 if (table[i].data) { 1329 /* Update the variables to point into 1330 * the current struct net 1331 */ 1332 table[i].data += (void *)net - (void *)&init_net; 1333 } else { 1334 /* Entries without data pointer are global; 1335 * Make them read-only in non-init_net ns 1336 */ 1337 table[i].mode &= ~0222; 1338 } 1339 } 1340 } 1341 1342 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 1343 if (!net->ipv4.ipv4_hdr) 1344 goto err_reg; 1345 1346 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 1347 if (!net->ipv4.sysctl_local_reserved_ports) 1348 goto err_ports; 1349 1350 return 0; 1351 1352err_ports: 1353 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1354err_reg: 1355 if (!net_eq(net, &init_net)) 1356 kfree(table); 1357err_alloc: 1358 return -ENOMEM; 1359} 1360 1361static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1362{ 1363 struct ctl_table *table; 1364 1365 kfree(net->ipv4.sysctl_local_reserved_ports); 1366 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1367 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1368 kfree(table); 1369} 1370 1371static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1372 .init = ipv4_sysctl_init_net, 1373 .exit = ipv4_sysctl_exit_net, 1374}; 1375 1376static __init int sysctl_ipv4_init(void) 1377{ 1378 struct ctl_table_header *hdr; 1379 1380 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1381 if (!hdr) 1382 return -ENOMEM; 1383 1384 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1385 unregister_net_sysctl_table(hdr); 1386 return -ENOMEM; 1387 } 1388 1389 return 0; 1390} 1391 1392__initcall(sysctl_ipv4_init); 1393