1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 4 * 5 * Begun April 1, 1996, Mike Shaver. 6 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 7 */ 8 9 #include <linux/sysctl.h> 10 #include <linux/seqlock.h> 11 #include <linux/init.h> 12 #include <linux/slab.h> 13 #include <net/icmp.h> 14 #include <net/ip.h> 15 #include <net/ip_fib.h> 16 #include <net/tcp.h> 17 #include <net/udp.h> 18 #include <net/cipso_ipv4.h> 19 #include <net/ping.h> 20 #include <net/protocol.h> 21 #include <net/netevent.h> 22 23 static int tcp_retr1_max = 255; 24 static int ip_local_port_range_min[] = { 1, 1 }; 25 static int ip_local_port_range_max[] = { 65535, 65535 }; 26 static int tcp_adv_win_scale_min = -31; 27 static int tcp_adv_win_scale_max = 31; 28 static int tcp_app_win_max = 31; 29 static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; 30 static int tcp_min_snd_mss_max = 65535; 31 static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC; 32 static int ip_privileged_port_min; 33 static int ip_privileged_port_max = 65535; 34 static int ip_ttl_min = 1; 35 static int ip_ttl_max = 255; 36 static int tcp_syn_retries_min = 1; 37 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 38 static int tcp_syn_linear_timeouts_max = MAX_TCP_SYNCNT; 39 static unsigned long ip_ping_group_range_min[] = { 0, 0 }; 40 static unsigned long ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 41 static u32 u32_max_div_HZ = UINT_MAX / HZ; 42 static int one_day_secs = 24 * 3600; 43 static u32 fib_multipath_hash_fields_all_mask __maybe_unused = 44 FIB_MULTIPATH_HASH_FIELD_ALL_MASK; 45 static unsigned int tcp_child_ehash_entries_max = 16 * 1024 * 1024; 46 static unsigned int udp_child_hash_entries_max = UDP_HTABLE_SIZE_MAX; 47 static int tcp_plb_max_rounds = 31; 48 static int tcp_plb_max_cong_thresh = 256; 49 static unsigned int tcp_tw_reuse_delay_max = TCP_PAWS_MSL * MSEC_PER_SEC; 50 static int tcp_ecn_mode_max = 5; 51 static u32 icmp_errors_extension_mask_all = 52 GENMASK_U8(ICMP_ERR_EXT_COUNT - 1, 0); 53 54 static int tcp_min_rcvbuf = 4096; 55 56 /* obsolete */ 57 static int sysctl_tcp_low_latency __read_mostly; 58 59 /* Update system visible IP port range */ 60 static void set_local_port_range(struct net *net, unsigned int low, unsigned int high) 61 { 62 bool same_parity = !((low ^ high) & 1); 63 64 if (same_parity && !net->ipv4.ip_local_ports.warned) { 65 net->ipv4.ip_local_ports.warned = true; 66 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 67 } 68 WRITE_ONCE(net->ipv4.ip_local_ports.range, high << 16 | low); 69 } 70 71 /* Validate changes from /proc interface. */ 72 static int ipv4_local_port_range(const struct ctl_table *table, int write, 73 void *buffer, size_t *lenp, loff_t *ppos) 74 { 75 struct net *net = table->data; 76 int ret; 77 int range[2]; 78 struct ctl_table tmp = { 79 .data = &range, 80 .maxlen = sizeof(range), 81 .mode = table->mode, 82 .extra1 = &ip_local_port_range_min, 83 .extra2 = &ip_local_port_range_max, 84 }; 85 86 inet_get_local_port_range(net, &range[0], &range[1]); 87 88 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 89 90 if (write && ret == 0) { 91 /* Ensure that the upper limit is not smaller than the lower, 92 * and that the lower does not encroach upon the privileged 93 * port limit. 94 */ 95 if ((range[1] < range[0]) || 96 (range[0] < READ_ONCE(net->ipv4.sysctl_ip_prot_sock))) 97 ret = -EINVAL; 98 else 99 set_local_port_range(net, range[0], range[1]); 100 } 101 102 return ret; 103 } 104 105 /* Validate changes from /proc interface. */ 106 static int ipv4_privileged_ports(const struct ctl_table *table, int write, 107 void *buffer, size_t *lenp, loff_t *ppos) 108 { 109 struct net *net = container_of(table->data, struct net, 110 ipv4.sysctl_ip_prot_sock); 111 int ret; 112 int pports; 113 int range[2]; 114 struct ctl_table tmp = { 115 .data = &pports, 116 .maxlen = sizeof(pports), 117 .mode = table->mode, 118 .extra1 = &ip_privileged_port_min, 119 .extra2 = &ip_privileged_port_max, 120 }; 121 122 pports = READ_ONCE(net->ipv4.sysctl_ip_prot_sock); 123 124 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 125 126 if (write && ret == 0) { 127 inet_get_local_port_range(net, &range[0], &range[1]); 128 /* Ensure that the local port range doesn't overlap with the 129 * privileged port range. 130 */ 131 if (range[0] < pports) 132 ret = -EINVAL; 133 else 134 WRITE_ONCE(net->ipv4.sysctl_ip_prot_sock, pports); 135 } 136 137 return ret; 138 } 139 140 static void inet_get_ping_group_range_table(const struct ctl_table *table, 141 kgid_t *low, kgid_t *high) 142 { 143 kgid_t *data = table->data; 144 struct net *net = 145 container_of(table->data, struct net, ipv4.ping_group_range.range); 146 unsigned int seq; 147 do { 148 seq = read_seqbegin(&net->ipv4.ping_group_range.lock); 149 150 *low = data[0]; 151 *high = data[1]; 152 } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); 153 } 154 155 /* Update system visible IP port range */ 156 static void set_ping_group_range(const struct ctl_table *table, 157 kgid_t low, kgid_t high) 158 { 159 kgid_t *data = table->data; 160 struct net *net = 161 container_of(table->data, struct net, ipv4.ping_group_range.range); 162 write_seqlock(&net->ipv4.ping_group_range.lock); 163 data[0] = low; 164 data[1] = high; 165 write_sequnlock(&net->ipv4.ping_group_range.lock); 166 } 167 168 /* Validate changes from /proc interface. */ 169 static int ipv4_ping_group_range(const struct ctl_table *table, int write, 170 void *buffer, size_t *lenp, loff_t *ppos) 171 { 172 struct user_namespace *user_ns = current_user_ns(); 173 int ret; 174 unsigned long urange[2]; 175 kgid_t low, high; 176 struct ctl_table tmp = { 177 .data = &urange, 178 .maxlen = sizeof(urange), 179 .mode = table->mode, 180 .extra1 = &ip_ping_group_range_min, 181 .extra2 = &ip_ping_group_range_max, 182 }; 183 184 inet_get_ping_group_range_table(table, &low, &high); 185 urange[0] = from_kgid_munged(user_ns, low); 186 urange[1] = from_kgid_munged(user_ns, high); 187 ret = proc_doulongvec_minmax(&tmp, write, buffer, lenp, ppos); 188 189 if (write && ret == 0) { 190 low = make_kgid(user_ns, urange[0]); 191 high = make_kgid(user_ns, urange[1]); 192 if (!gid_valid(low) || !gid_valid(high)) 193 return -EINVAL; 194 if (urange[1] < urange[0] || gid_lt(high, low)) { 195 low = make_kgid(&init_user_ns, 1); 196 high = make_kgid(&init_user_ns, 0); 197 } 198 set_ping_group_range(table, low, high); 199 } 200 201 return ret; 202 } 203 204 static int ipv4_fwd_update_priority(const struct ctl_table *table, int write, 205 void *buffer, size_t *lenp, loff_t *ppos) 206 { 207 struct net *net; 208 int ret; 209 210 net = container_of(table->data, struct net, 211 ipv4.sysctl_ip_fwd_update_priority); 212 ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos); 213 if (write && ret == 0) 214 call_netevent_notifiers(NETEVENT_IPV4_FWD_UPDATE_PRIORITY_UPDATE, 215 net); 216 217 return ret; 218 } 219 220 static int proc_tcp_congestion_control(const struct ctl_table *ctl, int write, 221 void *buffer, size_t *lenp, loff_t *ppos) 222 { 223 struct net *net = container_of(ctl->data, struct net, 224 ipv4.tcp_congestion_control); 225 char val[TCP_CA_NAME_MAX]; 226 struct ctl_table tbl = { 227 .data = val, 228 .maxlen = TCP_CA_NAME_MAX, 229 }; 230 int ret; 231 232 tcp_get_default_congestion_control(net, val); 233 234 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 235 if (write && ret == 0) 236 ret = tcp_set_default_congestion_control(net, val); 237 return ret; 238 } 239 240 static int proc_tcp_available_congestion_control(const struct ctl_table *ctl, 241 int write, void *buffer, 242 size_t *lenp, loff_t *ppos) 243 { 244 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 245 int ret; 246 247 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 248 if (!tbl.data) 249 return -ENOMEM; 250 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 251 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 252 kfree(tbl.data); 253 return ret; 254 } 255 256 static int proc_allowed_congestion_control(const struct ctl_table *ctl, 257 int write, void *buffer, 258 size_t *lenp, loff_t *ppos) 259 { 260 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 261 int ret; 262 263 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 264 if (!tbl.data) 265 return -ENOMEM; 266 267 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 268 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 269 if (write && ret == 0) 270 ret = tcp_set_allowed_congestion_control(tbl.data); 271 kfree(tbl.data); 272 return ret; 273 } 274 275 static int sscanf_key(char *buf, __le32 *key) 276 { 277 u32 user_key[4]; 278 int i, ret = 0; 279 280 if (sscanf(buf, "%x-%x-%x-%x", user_key, user_key + 1, 281 user_key + 2, user_key + 3) != 4) { 282 ret = -EINVAL; 283 } else { 284 for (i = 0; i < ARRAY_SIZE(user_key); i++) 285 key[i] = cpu_to_le32(user_key[i]); 286 } 287 pr_debug("proc TFO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 288 user_key[0], user_key[1], user_key[2], user_key[3], buf, ret); 289 290 return ret; 291 } 292 293 static int proc_tcp_fastopen_key(const struct ctl_table *table, int write, 294 void *buffer, size_t *lenp, loff_t *ppos) 295 { 296 struct net *net = container_of(table->data, struct net, 297 ipv4.sysctl_tcp_fastopen); 298 /* maxlen to print the list of keys in hex (*2), with dashes 299 * separating doublewords and a comma in between keys. 300 */ 301 struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 302 2 * TCP_FASTOPEN_KEY_MAX) + 303 (TCP_FASTOPEN_KEY_MAX * 5)) }; 304 u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)]; 305 __le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)]; 306 char *backup_data; 307 int ret, i = 0, off = 0, n_keys; 308 309 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 310 if (!tbl.data) 311 return -ENOMEM; 312 313 n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key); 314 if (!n_keys) { 315 memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH); 316 n_keys = 1; 317 } 318 319 for (i = 0; i < n_keys * 4; i++) 320 user_key[i] = le32_to_cpu(key[i]); 321 322 for (i = 0; i < n_keys; i++) { 323 off += snprintf(tbl.data + off, tbl.maxlen - off, 324 "%08x-%08x-%08x-%08x", 325 user_key[i * 4], 326 user_key[i * 4 + 1], 327 user_key[i * 4 + 2], 328 user_key[i * 4 + 3]); 329 330 if (WARN_ON_ONCE(off >= tbl.maxlen - 1)) 331 break; 332 333 if (i + 1 < n_keys) 334 off += snprintf(tbl.data + off, tbl.maxlen - off, ","); 335 } 336 337 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 338 339 if (write && ret == 0) { 340 backup_data = strchr(tbl.data, ','); 341 if (backup_data) { 342 *backup_data = '\0'; 343 backup_data++; 344 } 345 if (sscanf_key(tbl.data, key)) { 346 ret = -EINVAL; 347 goto bad_key; 348 } 349 if (backup_data) { 350 if (sscanf_key(backup_data, key + 4)) { 351 ret = -EINVAL; 352 goto bad_key; 353 } 354 } 355 tcp_fastopen_reset_cipher(net, NULL, key, 356 backup_data ? key + 4 : NULL); 357 } 358 359 bad_key: 360 kfree(tbl.data); 361 return ret; 362 } 363 364 static int proc_tfo_blackhole_detect_timeout(const struct ctl_table *table, 365 int write, void *buffer, 366 size_t *lenp, loff_t *ppos) 367 { 368 struct net *net = container_of(table->data, struct net, 369 ipv4.sysctl_tcp_fastopen_blackhole_timeout); 370 int ret; 371 372 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 373 if (write && ret == 0) 374 atomic_set(&net->ipv4.tfo_active_disable_times, 0); 375 376 return ret; 377 } 378 379 static int proc_tcp_available_ulp(const struct ctl_table *ctl, 380 int write, void *buffer, size_t *lenp, 381 loff_t *ppos) 382 { 383 struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, }; 384 int ret; 385 386 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 387 if (!tbl.data) 388 return -ENOMEM; 389 tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX); 390 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 391 kfree(tbl.data); 392 393 return ret; 394 } 395 396 static int proc_tcp_ehash_entries(const struct ctl_table *table, int write, 397 void *buffer, size_t *lenp, loff_t *ppos) 398 { 399 struct net *net = container_of(table->data, struct net, 400 ipv4.sysctl_tcp_child_ehash_entries); 401 struct inet_hashinfo *hinfo = net->ipv4.tcp_death_row.hashinfo; 402 int tcp_ehash_entries; 403 struct ctl_table tbl; 404 405 tcp_ehash_entries = hinfo->ehash_mask + 1; 406 407 /* A negative number indicates that the child netns 408 * shares the global ehash. 409 */ 410 if (!net_eq(net, &init_net) && !hinfo->pernet) 411 tcp_ehash_entries *= -1; 412 413 memset(&tbl, 0, sizeof(tbl)); 414 tbl.data = &tcp_ehash_entries; 415 tbl.maxlen = sizeof(int); 416 417 return proc_dointvec(&tbl, write, buffer, lenp, ppos); 418 } 419 420 static int proc_udp_hash_entries(const struct ctl_table *table, int write, 421 void *buffer, size_t *lenp, loff_t *ppos) 422 { 423 struct net *net = container_of(table->data, struct net, 424 ipv4.sysctl_udp_child_hash_entries); 425 int udp_hash_entries; 426 struct ctl_table tbl; 427 428 udp_hash_entries = net->ipv4.udp_table->mask + 1; 429 430 /* A negative number indicates that the child netns 431 * shares the global udp_table. 432 */ 433 if (!net_eq(net, &init_net) && net->ipv4.udp_table == &udp_table) 434 udp_hash_entries *= -1; 435 436 memset(&tbl, 0, sizeof(tbl)); 437 tbl.data = &udp_hash_entries; 438 tbl.maxlen = sizeof(int); 439 440 return proc_dointvec(&tbl, write, buffer, lenp, ppos); 441 } 442 443 #ifdef CONFIG_IP_ROUTE_MULTIPATH 444 static int proc_fib_multipath_hash_policy(const struct ctl_table *table, int write, 445 void *buffer, size_t *lenp, 446 loff_t *ppos) 447 { 448 struct net *net = container_of(table->data, struct net, 449 ipv4.sysctl_fib_multipath_hash_policy); 450 int ret; 451 452 ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos); 453 if (write && ret == 0) 454 call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net); 455 456 return ret; 457 } 458 459 static int proc_fib_multipath_hash_fields(const struct ctl_table *table, int write, 460 void *buffer, size_t *lenp, 461 loff_t *ppos) 462 { 463 struct net *net; 464 int ret; 465 466 net = container_of(table->data, struct net, 467 ipv4.sysctl_fib_multipath_hash_fields); 468 ret = proc_douintvec_minmax(table, write, buffer, lenp, ppos); 469 if (write && ret == 0) 470 call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net); 471 472 return ret; 473 } 474 475 static u32 proc_fib_multipath_hash_rand_seed __ro_after_init; 476 477 static void proc_fib_multipath_hash_init_rand_seed(void) 478 { 479 get_random_bytes(&proc_fib_multipath_hash_rand_seed, 480 sizeof(proc_fib_multipath_hash_rand_seed)); 481 } 482 483 static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed) 484 { 485 struct sysctl_fib_multipath_hash_seed new = { 486 .user_seed = user_seed, 487 .mp_seed = (user_seed ? user_seed : 488 proc_fib_multipath_hash_rand_seed), 489 }; 490 491 WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.user_seed, new.user_seed); 492 WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.mp_seed, new.mp_seed); 493 } 494 495 static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write, 496 void *buffer, size_t *lenp, 497 loff_t *ppos) 498 { 499 struct sysctl_fib_multipath_hash_seed *mphs; 500 struct net *net = table->data; 501 struct ctl_table tmp; 502 u32 user_seed; 503 int ret; 504 505 mphs = &net->ipv4.sysctl_fib_multipath_hash_seed; 506 user_seed = READ_ONCE(mphs->user_seed); 507 508 tmp = *table; 509 tmp.data = &user_seed; 510 511 ret = proc_douintvec_minmax(&tmp, write, buffer, lenp, ppos); 512 513 if (write && ret == 0) { 514 proc_fib_multipath_hash_set_seed(net, user_seed); 515 call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net); 516 } 517 518 return ret; 519 } 520 #else 521 522 static void proc_fib_multipath_hash_init_rand_seed(void) 523 { 524 } 525 526 static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed) 527 { 528 } 529 530 #endif 531 532 static struct ctl_table ipv4_table[] = { 533 { 534 .procname = "tcp_max_orphans", 535 .data = &sysctl_tcp_max_orphans, 536 .maxlen = sizeof(int), 537 .mode = 0644, 538 .proc_handler = proc_dointvec 539 }, 540 { 541 .procname = "inet_peer_threshold", 542 .data = &inet_peer_threshold, 543 .maxlen = sizeof(int), 544 .mode = 0644, 545 .proc_handler = proc_dointvec 546 }, 547 { 548 .procname = "inet_peer_minttl", 549 .data = &inet_peer_minttl, 550 .maxlen = sizeof(int), 551 .mode = 0644, 552 .proc_handler = proc_dointvec_jiffies, 553 }, 554 { 555 .procname = "inet_peer_maxttl", 556 .data = &inet_peer_maxttl, 557 .maxlen = sizeof(int), 558 .mode = 0644, 559 .proc_handler = proc_dointvec_jiffies, 560 }, 561 { 562 .procname = "tcp_mem", 563 .maxlen = sizeof(sysctl_tcp_mem), 564 .data = &sysctl_tcp_mem, 565 .mode = 0644, 566 .proc_handler = proc_doulongvec_minmax, 567 }, 568 { 569 .procname = "tcp_low_latency", 570 .data = &sysctl_tcp_low_latency, 571 .maxlen = sizeof(int), 572 .mode = 0644, 573 .proc_handler = proc_dointvec 574 }, 575 #ifdef CONFIG_NETLABEL 576 { 577 .procname = "cipso_cache_enable", 578 .data = &cipso_v4_cache_enabled, 579 .maxlen = sizeof(int), 580 .mode = 0644, 581 .proc_handler = proc_dointvec, 582 }, 583 { 584 .procname = "cipso_cache_bucket_size", 585 .data = &cipso_v4_cache_bucketsize, 586 .maxlen = sizeof(int), 587 .mode = 0644, 588 .proc_handler = proc_dointvec, 589 }, 590 { 591 .procname = "cipso_rbm_optfmt", 592 .data = &cipso_v4_rbm_optfmt, 593 .maxlen = sizeof(int), 594 .mode = 0644, 595 .proc_handler = proc_dointvec, 596 }, 597 { 598 .procname = "cipso_rbm_strictvalid", 599 .data = &cipso_v4_rbm_strictvalid, 600 .maxlen = sizeof(int), 601 .mode = 0644, 602 .proc_handler = proc_dointvec, 603 }, 604 #endif /* CONFIG_NETLABEL */ 605 { 606 .procname = "tcp_available_ulp", 607 .maxlen = TCP_ULP_BUF_MAX, 608 .mode = 0444, 609 .proc_handler = proc_tcp_available_ulp, 610 }, 611 { 612 .procname = "udp_mem", 613 .data = &sysctl_udp_mem, 614 .maxlen = sizeof(sysctl_udp_mem), 615 .mode = 0644, 616 .proc_handler = proc_doulongvec_minmax, 617 }, 618 { 619 .procname = "fib_sync_mem", 620 .data = &sysctl_fib_sync_mem, 621 .maxlen = sizeof(sysctl_fib_sync_mem), 622 .mode = 0644, 623 .proc_handler = proc_douintvec_minmax, 624 .extra1 = &sysctl_fib_sync_mem_min, 625 .extra2 = &sysctl_fib_sync_mem_max, 626 }, 627 }; 628 629 static const struct ctl_table ipv4_net_table[] = { 630 { 631 .procname = "tcp_max_tw_buckets", 632 .data = &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets, 633 .maxlen = sizeof(int), 634 .mode = 0644, 635 .proc_handler = proc_dointvec 636 }, 637 { 638 .procname = "icmp_echo_ignore_all", 639 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 640 .maxlen = sizeof(u8), 641 .mode = 0644, 642 .proc_handler = proc_dou8vec_minmax, 643 .extra1 = SYSCTL_ZERO, 644 .extra2 = SYSCTL_ONE 645 }, 646 { 647 .procname = "icmp_echo_enable_probe", 648 .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe, 649 .maxlen = sizeof(u8), 650 .mode = 0644, 651 .proc_handler = proc_dou8vec_minmax, 652 .extra1 = SYSCTL_ZERO, 653 .extra2 = SYSCTL_ONE 654 }, 655 { 656 .procname = "icmp_echo_ignore_broadcasts", 657 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 658 .maxlen = sizeof(u8), 659 .mode = 0644, 660 .proc_handler = proc_dou8vec_minmax, 661 .extra1 = SYSCTL_ZERO, 662 .extra2 = SYSCTL_ONE 663 }, 664 { 665 .procname = "icmp_ignore_bogus_error_responses", 666 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 667 .maxlen = sizeof(u8), 668 .mode = 0644, 669 .proc_handler = proc_dou8vec_minmax, 670 .extra1 = SYSCTL_ZERO, 671 .extra2 = SYSCTL_ONE 672 }, 673 { 674 .procname = "icmp_errors_use_inbound_ifaddr", 675 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 676 .maxlen = sizeof(u8), 677 .mode = 0644, 678 .proc_handler = proc_dou8vec_minmax, 679 .extra1 = SYSCTL_ZERO, 680 .extra2 = SYSCTL_ONE 681 }, 682 { 683 .procname = "icmp_errors_extension_mask", 684 .data = &init_net.ipv4.sysctl_icmp_errors_extension_mask, 685 .maxlen = sizeof(u8), 686 .mode = 0644, 687 .proc_handler = proc_dou8vec_minmax, 688 .extra1 = SYSCTL_ZERO, 689 .extra2 = &icmp_errors_extension_mask_all, 690 }, 691 { 692 .procname = "icmp_ratelimit", 693 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 694 .maxlen = sizeof(int), 695 .mode = 0644, 696 .proc_handler = proc_dointvec_ms_jiffies, 697 }, 698 { 699 .procname = "icmp_ratemask", 700 .data = &init_net.ipv4.sysctl_icmp_ratemask, 701 .maxlen = sizeof(int), 702 .mode = 0644, 703 .proc_handler = proc_dointvec 704 }, 705 { 706 .procname = "icmp_msgs_per_sec", 707 .data = &init_net.ipv4.sysctl_icmp_msgs_per_sec, 708 .maxlen = sizeof(int), 709 .mode = 0644, 710 .proc_handler = proc_dointvec_minmax, 711 .extra1 = SYSCTL_ZERO, 712 }, 713 { 714 .procname = "icmp_msgs_burst", 715 .data = &init_net.ipv4.sysctl_icmp_msgs_burst, 716 .maxlen = sizeof(int), 717 .mode = 0644, 718 .proc_handler = proc_dointvec_minmax, 719 .extra1 = SYSCTL_ZERO, 720 }, 721 { 722 .procname = "ping_group_range", 723 .data = &init_net.ipv4.ping_group_range.range, 724 .maxlen = sizeof(gid_t)*2, 725 .mode = 0644, 726 .proc_handler = ipv4_ping_group_range, 727 }, 728 #ifdef CONFIG_NET_L3_MASTER_DEV 729 { 730 .procname = "raw_l3mdev_accept", 731 .data = &init_net.ipv4.sysctl_raw_l3mdev_accept, 732 .maxlen = sizeof(u8), 733 .mode = 0644, 734 .proc_handler = proc_dou8vec_minmax, 735 .extra1 = SYSCTL_ZERO, 736 .extra2 = SYSCTL_ONE, 737 }, 738 #endif 739 { 740 .procname = "tcp_ecn", 741 .data = &init_net.ipv4.sysctl_tcp_ecn, 742 .maxlen = sizeof(u8), 743 .mode = 0644, 744 .proc_handler = proc_dou8vec_minmax, 745 .extra1 = SYSCTL_ZERO, 746 .extra2 = &tcp_ecn_mode_max, 747 }, 748 { 749 .procname = "tcp_ecn_option", 750 .data = &init_net.ipv4.sysctl_tcp_ecn_option, 751 .maxlen = sizeof(u8), 752 .mode = 0644, 753 .proc_handler = proc_dou8vec_minmax, 754 .extra1 = SYSCTL_ZERO, 755 .extra2 = SYSCTL_THREE, 756 }, 757 { 758 .procname = "tcp_ecn_option_beacon", 759 .data = &init_net.ipv4.sysctl_tcp_ecn_option_beacon, 760 .maxlen = sizeof(u8), 761 .mode = 0644, 762 .proc_handler = proc_dou8vec_minmax, 763 .extra1 = SYSCTL_ZERO, 764 .extra2 = SYSCTL_THREE, 765 }, 766 { 767 .procname = "tcp_ecn_fallback", 768 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 769 .maxlen = sizeof(u8), 770 .mode = 0644, 771 .proc_handler = proc_dou8vec_minmax, 772 .extra1 = SYSCTL_ZERO, 773 .extra2 = SYSCTL_ONE, 774 }, 775 { 776 .procname = "ip_dynaddr", 777 .data = &init_net.ipv4.sysctl_ip_dynaddr, 778 .maxlen = sizeof(u8), 779 .mode = 0644, 780 .proc_handler = proc_dou8vec_minmax, 781 }, 782 { 783 .procname = "ip_early_demux", 784 .data = &init_net.ipv4.sysctl_ip_early_demux, 785 .maxlen = sizeof(u8), 786 .mode = 0644, 787 .proc_handler = proc_dou8vec_minmax, 788 }, 789 { 790 .procname = "udp_early_demux", 791 .data = &init_net.ipv4.sysctl_udp_early_demux, 792 .maxlen = sizeof(u8), 793 .mode = 0644, 794 .proc_handler = proc_dou8vec_minmax, 795 }, 796 { 797 .procname = "tcp_early_demux", 798 .data = &init_net.ipv4.sysctl_tcp_early_demux, 799 .maxlen = sizeof(u8), 800 .mode = 0644, 801 .proc_handler = proc_dou8vec_minmax, 802 }, 803 { 804 .procname = "nexthop_compat_mode", 805 .data = &init_net.ipv4.sysctl_nexthop_compat_mode, 806 .maxlen = sizeof(u8), 807 .mode = 0644, 808 .proc_handler = proc_dou8vec_minmax, 809 .extra1 = SYSCTL_ZERO, 810 .extra2 = SYSCTL_ONE, 811 }, 812 { 813 .procname = "ip_default_ttl", 814 .data = &init_net.ipv4.sysctl_ip_default_ttl, 815 .maxlen = sizeof(u8), 816 .mode = 0644, 817 .proc_handler = proc_dou8vec_minmax, 818 .extra1 = &ip_ttl_min, 819 .extra2 = &ip_ttl_max, 820 }, 821 { 822 .procname = "ip_local_port_range", 823 .maxlen = 0, 824 .data = &init_net, 825 .mode = 0644, 826 .proc_handler = ipv4_local_port_range, 827 }, 828 { 829 .procname = "ip_local_port_step_width", 830 .maxlen = sizeof(u32), 831 .data = &init_net.ipv4.sysctl_ip_local_port_step_width, 832 .mode = 0644, 833 .proc_handler = proc_douintvec, 834 }, 835 { 836 .procname = "ip_local_reserved_ports", 837 .data = &init_net.ipv4.sysctl_local_reserved_ports, 838 .maxlen = 65536, 839 .mode = 0644, 840 .proc_handler = proc_do_large_bitmap, 841 }, 842 { 843 .procname = "ip_no_pmtu_disc", 844 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 845 .maxlen = sizeof(u8), 846 .mode = 0644, 847 .proc_handler = proc_dou8vec_minmax, 848 }, 849 { 850 .procname = "ip_forward_use_pmtu", 851 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 852 .maxlen = sizeof(u8), 853 .mode = 0644, 854 .proc_handler = proc_dou8vec_minmax, 855 }, 856 { 857 .procname = "ip_forward_update_priority", 858 .data = &init_net.ipv4.sysctl_ip_fwd_update_priority, 859 .maxlen = sizeof(u8), 860 .mode = 0644, 861 .proc_handler = ipv4_fwd_update_priority, 862 .extra1 = SYSCTL_ZERO, 863 .extra2 = SYSCTL_ONE, 864 }, 865 { 866 .procname = "ip_nonlocal_bind", 867 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 868 .maxlen = sizeof(u8), 869 .mode = 0644, 870 .proc_handler = proc_dou8vec_minmax, 871 }, 872 { 873 .procname = "ip_autobind_reuse", 874 .data = &init_net.ipv4.sysctl_ip_autobind_reuse, 875 .maxlen = sizeof(u8), 876 .mode = 0644, 877 .proc_handler = proc_dou8vec_minmax, 878 .extra1 = SYSCTL_ZERO, 879 .extra2 = SYSCTL_ONE, 880 }, 881 { 882 .procname = "fwmark_reflect", 883 .data = &init_net.ipv4.sysctl_fwmark_reflect, 884 .maxlen = sizeof(u8), 885 .mode = 0644, 886 .proc_handler = proc_dou8vec_minmax, 887 }, 888 { 889 .procname = "tcp_fwmark_accept", 890 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 891 .maxlen = sizeof(u8), 892 .mode = 0644, 893 .proc_handler = proc_dou8vec_minmax, 894 }, 895 #ifdef CONFIG_NET_L3_MASTER_DEV 896 { 897 .procname = "tcp_l3mdev_accept", 898 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 899 .maxlen = sizeof(u8), 900 .mode = 0644, 901 .proc_handler = proc_dou8vec_minmax, 902 .extra1 = SYSCTL_ZERO, 903 .extra2 = SYSCTL_ONE, 904 }, 905 #endif 906 { 907 .procname = "tcp_mtu_probing", 908 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 909 .maxlen = sizeof(u8), 910 .mode = 0644, 911 .proc_handler = proc_dou8vec_minmax, 912 }, 913 { 914 .procname = "tcp_base_mss", 915 .data = &init_net.ipv4.sysctl_tcp_base_mss, 916 .maxlen = sizeof(int), 917 .mode = 0644, 918 .proc_handler = proc_dointvec, 919 }, 920 { 921 .procname = "tcp_min_snd_mss", 922 .data = &init_net.ipv4.sysctl_tcp_min_snd_mss, 923 .maxlen = sizeof(int), 924 .mode = 0644, 925 .proc_handler = proc_dointvec_minmax, 926 .extra1 = &tcp_min_snd_mss_min, 927 .extra2 = &tcp_min_snd_mss_max, 928 }, 929 { 930 .procname = "tcp_mtu_probe_floor", 931 .data = &init_net.ipv4.sysctl_tcp_mtu_probe_floor, 932 .maxlen = sizeof(int), 933 .mode = 0644, 934 .proc_handler = proc_dointvec_minmax, 935 .extra1 = &tcp_min_snd_mss_min, 936 .extra2 = &tcp_min_snd_mss_max, 937 }, 938 { 939 .procname = "tcp_probe_threshold", 940 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 941 .maxlen = sizeof(int), 942 .mode = 0644, 943 .proc_handler = proc_dointvec, 944 }, 945 { 946 .procname = "tcp_probe_interval", 947 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 948 .maxlen = sizeof(u32), 949 .mode = 0644, 950 .proc_handler = proc_douintvec_minmax, 951 .extra2 = &u32_max_div_HZ, 952 }, 953 { 954 .procname = "igmp_link_local_mcast_reports", 955 .data = &init_net.ipv4.sysctl_igmp_llm_reports, 956 .maxlen = sizeof(u8), 957 .mode = 0644, 958 .proc_handler = proc_dou8vec_minmax, 959 }, 960 { 961 .procname = "igmp_max_memberships", 962 .data = &init_net.ipv4.sysctl_igmp_max_memberships, 963 .maxlen = sizeof(int), 964 .mode = 0644, 965 .proc_handler = proc_dointvec 966 }, 967 { 968 .procname = "igmp_max_msf", 969 .data = &init_net.ipv4.sysctl_igmp_max_msf, 970 .maxlen = sizeof(int), 971 .mode = 0644, 972 .proc_handler = proc_dointvec 973 }, 974 #ifdef CONFIG_IP_MULTICAST 975 { 976 .procname = "igmp_qrv", 977 .data = &init_net.ipv4.sysctl_igmp_qrv, 978 .maxlen = sizeof(int), 979 .mode = 0644, 980 .proc_handler = proc_dointvec_minmax, 981 .extra1 = SYSCTL_ONE 982 }, 983 #endif 984 { 985 .procname = "tcp_congestion_control", 986 .data = &init_net.ipv4.tcp_congestion_control, 987 .mode = 0644, 988 .maxlen = TCP_CA_NAME_MAX, 989 .proc_handler = proc_tcp_congestion_control, 990 }, 991 { 992 .procname = "tcp_available_congestion_control", 993 .maxlen = TCP_CA_BUF_MAX, 994 .mode = 0444, 995 .proc_handler = proc_tcp_available_congestion_control, 996 }, 997 { 998 .procname = "tcp_allowed_congestion_control", 999 .maxlen = TCP_CA_BUF_MAX, 1000 .mode = 0644, 1001 .proc_handler = proc_allowed_congestion_control, 1002 }, 1003 { 1004 .procname = "tcp_keepalive_time", 1005 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 1006 .maxlen = sizeof(int), 1007 .mode = 0644, 1008 .proc_handler = proc_dointvec_jiffies, 1009 }, 1010 { 1011 .procname = "tcp_keepalive_probes", 1012 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 1013 .maxlen = sizeof(u8), 1014 .mode = 0644, 1015 .proc_handler = proc_dou8vec_minmax, 1016 }, 1017 { 1018 .procname = "tcp_keepalive_intvl", 1019 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 1020 .maxlen = sizeof(int), 1021 .mode = 0644, 1022 .proc_handler = proc_dointvec_jiffies, 1023 }, 1024 { 1025 .procname = "tcp_syn_retries", 1026 .data = &init_net.ipv4.sysctl_tcp_syn_retries, 1027 .maxlen = sizeof(u8), 1028 .mode = 0644, 1029 .proc_handler = proc_dou8vec_minmax, 1030 .extra1 = &tcp_syn_retries_min, 1031 .extra2 = &tcp_syn_retries_max 1032 }, 1033 { 1034 .procname = "tcp_synack_retries", 1035 .data = &init_net.ipv4.sysctl_tcp_synack_retries, 1036 .maxlen = sizeof(u8), 1037 .mode = 0644, 1038 .proc_handler = proc_dou8vec_minmax, 1039 }, 1040 #ifdef CONFIG_SYN_COOKIES 1041 { 1042 .procname = "tcp_syncookies", 1043 .data = &init_net.ipv4.sysctl_tcp_syncookies, 1044 .maxlen = sizeof(u8), 1045 .mode = 0644, 1046 .proc_handler = proc_dou8vec_minmax, 1047 }, 1048 #endif 1049 { 1050 .procname = "tcp_migrate_req", 1051 .data = &init_net.ipv4.sysctl_tcp_migrate_req, 1052 .maxlen = sizeof(u8), 1053 .mode = 0644, 1054 .proc_handler = proc_dou8vec_minmax, 1055 .extra1 = SYSCTL_ZERO, 1056 .extra2 = SYSCTL_ONE 1057 }, 1058 { 1059 .procname = "tcp_reordering", 1060 .data = &init_net.ipv4.sysctl_tcp_reordering, 1061 .maxlen = sizeof(int), 1062 .mode = 0644, 1063 .proc_handler = proc_dointvec_minmax, 1064 .extra1 = SYSCTL_ONE, 1065 .extra2 = &init_net.ipv4.sysctl_tcp_max_reordering, 1066 }, 1067 { 1068 .procname = "tcp_retries1", 1069 .data = &init_net.ipv4.sysctl_tcp_retries1, 1070 .maxlen = sizeof(u8), 1071 .mode = 0644, 1072 .proc_handler = proc_dou8vec_minmax, 1073 .extra2 = &tcp_retr1_max 1074 }, 1075 { 1076 .procname = "tcp_retries2", 1077 .data = &init_net.ipv4.sysctl_tcp_retries2, 1078 .maxlen = sizeof(u8), 1079 .mode = 0644, 1080 .proc_handler = proc_dou8vec_minmax, 1081 }, 1082 { 1083 .procname = "tcp_orphan_retries", 1084 .data = &init_net.ipv4.sysctl_tcp_orphan_retries, 1085 .maxlen = sizeof(u8), 1086 .mode = 0644, 1087 .proc_handler = proc_dou8vec_minmax, 1088 }, 1089 { 1090 .procname = "tcp_fin_timeout", 1091 .data = &init_net.ipv4.sysctl_tcp_fin_timeout, 1092 .maxlen = sizeof(int), 1093 .mode = 0644, 1094 .proc_handler = proc_dointvec_jiffies, 1095 }, 1096 { 1097 .procname = "tcp_notsent_lowat", 1098 .data = &init_net.ipv4.sysctl_tcp_notsent_lowat, 1099 .maxlen = sizeof(unsigned int), 1100 .mode = 0644, 1101 .proc_handler = proc_douintvec, 1102 }, 1103 { 1104 .procname = "tcp_tw_reuse", 1105 .data = &init_net.ipv4.sysctl_tcp_tw_reuse, 1106 .maxlen = sizeof(u8), 1107 .mode = 0644, 1108 .proc_handler = proc_dou8vec_minmax, 1109 .extra1 = SYSCTL_ZERO, 1110 .extra2 = SYSCTL_TWO, 1111 }, 1112 { 1113 .procname = "tcp_tw_reuse_delay", 1114 .data = &init_net.ipv4.sysctl_tcp_tw_reuse_delay, 1115 .maxlen = sizeof(unsigned int), 1116 .mode = 0644, 1117 .proc_handler = proc_douintvec_minmax, 1118 .extra1 = SYSCTL_ONE, 1119 .extra2 = &tcp_tw_reuse_delay_max, 1120 }, 1121 { 1122 .procname = "tcp_max_syn_backlog", 1123 .data = &init_net.ipv4.sysctl_max_syn_backlog, 1124 .maxlen = sizeof(int), 1125 .mode = 0644, 1126 .proc_handler = proc_dointvec 1127 }, 1128 { 1129 .procname = "tcp_fastopen", 1130 .data = &init_net.ipv4.sysctl_tcp_fastopen, 1131 .maxlen = sizeof(int), 1132 .mode = 0644, 1133 .proc_handler = proc_dointvec, 1134 }, 1135 { 1136 .procname = "tcp_fastopen_key", 1137 .mode = 0600, 1138 .data = &init_net.ipv4.sysctl_tcp_fastopen, 1139 /* maxlen to print the list of keys in hex (*2), with dashes 1140 * separating doublewords and a comma in between keys. 1141 */ 1142 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 1143 2 * TCP_FASTOPEN_KEY_MAX) + 1144 (TCP_FASTOPEN_KEY_MAX * 5)), 1145 .proc_handler = proc_tcp_fastopen_key, 1146 }, 1147 { 1148 .procname = "tcp_fastopen_blackhole_timeout_sec", 1149 .data = &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout, 1150 .maxlen = sizeof(int), 1151 .mode = 0644, 1152 .proc_handler = proc_tfo_blackhole_detect_timeout, 1153 .extra1 = SYSCTL_ZERO, 1154 }, 1155 #ifdef CONFIG_IP_ROUTE_MULTIPATH 1156 { 1157 .procname = "fib_multipath_use_neigh", 1158 .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh, 1159 .maxlen = sizeof(u8), 1160 .mode = 0644, 1161 .proc_handler = proc_dou8vec_minmax, 1162 .extra1 = SYSCTL_ZERO, 1163 .extra2 = SYSCTL_ONE, 1164 }, 1165 { 1166 .procname = "fib_multipath_hash_policy", 1167 .data = &init_net.ipv4.sysctl_fib_multipath_hash_policy, 1168 .maxlen = sizeof(u8), 1169 .mode = 0644, 1170 .proc_handler = proc_fib_multipath_hash_policy, 1171 .extra1 = SYSCTL_ZERO, 1172 .extra2 = SYSCTL_THREE, 1173 }, 1174 { 1175 .procname = "fib_multipath_hash_fields", 1176 .data = &init_net.ipv4.sysctl_fib_multipath_hash_fields, 1177 .maxlen = sizeof(u32), 1178 .mode = 0644, 1179 .proc_handler = proc_fib_multipath_hash_fields, 1180 .extra1 = SYSCTL_ONE, 1181 .extra2 = &fib_multipath_hash_fields_all_mask, 1182 }, 1183 { 1184 .procname = "fib_multipath_hash_seed", 1185 .data = &init_net, 1186 .maxlen = sizeof(u32), 1187 .mode = 0644, 1188 .proc_handler = proc_fib_multipath_hash_seed, 1189 }, 1190 #endif 1191 { 1192 .procname = "ip_unprivileged_port_start", 1193 .maxlen = sizeof(int), 1194 .data = &init_net.ipv4.sysctl_ip_prot_sock, 1195 .mode = 0644, 1196 .proc_handler = ipv4_privileged_ports, 1197 }, 1198 #ifdef CONFIG_NET_L3_MASTER_DEV 1199 { 1200 .procname = "udp_l3mdev_accept", 1201 .data = &init_net.ipv4.sysctl_udp_l3mdev_accept, 1202 .maxlen = sizeof(u8), 1203 .mode = 0644, 1204 .proc_handler = proc_dou8vec_minmax, 1205 .extra1 = SYSCTL_ZERO, 1206 .extra2 = SYSCTL_ONE, 1207 }, 1208 #endif 1209 { 1210 .procname = "tcp_sack", 1211 .data = &init_net.ipv4.sysctl_tcp_sack, 1212 .maxlen = sizeof(u8), 1213 .mode = 0644, 1214 .proc_handler = proc_dou8vec_minmax, 1215 }, 1216 { 1217 .procname = "tcp_window_scaling", 1218 .data = &init_net.ipv4.sysctl_tcp_window_scaling, 1219 .maxlen = sizeof(u8), 1220 .mode = 0644, 1221 .proc_handler = proc_dou8vec_minmax, 1222 }, 1223 { 1224 .procname = "tcp_timestamps", 1225 .data = &init_net.ipv4.sysctl_tcp_timestamps, 1226 .maxlen = sizeof(u8), 1227 .mode = 0644, 1228 .proc_handler = proc_dou8vec_minmax, 1229 }, 1230 { 1231 .procname = "tcp_early_retrans", 1232 .data = &init_net.ipv4.sysctl_tcp_early_retrans, 1233 .maxlen = sizeof(u8), 1234 .mode = 0644, 1235 .proc_handler = proc_dou8vec_minmax, 1236 .extra1 = SYSCTL_ZERO, 1237 .extra2 = SYSCTL_FOUR, 1238 }, 1239 { 1240 .procname = "tcp_recovery", 1241 .data = &init_net.ipv4.sysctl_tcp_recovery, 1242 .maxlen = sizeof(u8), 1243 .mode = 0644, 1244 .proc_handler = proc_dou8vec_minmax, 1245 }, 1246 { 1247 .procname = "tcp_thin_linear_timeouts", 1248 .data = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts, 1249 .maxlen = sizeof(u8), 1250 .mode = 0644, 1251 .proc_handler = proc_dou8vec_minmax, 1252 }, 1253 { 1254 .procname = "tcp_slow_start_after_idle", 1255 .data = &init_net.ipv4.sysctl_tcp_slow_start_after_idle, 1256 .maxlen = sizeof(u8), 1257 .mode = 0644, 1258 .proc_handler = proc_dou8vec_minmax, 1259 }, 1260 { 1261 .procname = "tcp_retrans_collapse", 1262 .data = &init_net.ipv4.sysctl_tcp_retrans_collapse, 1263 .maxlen = sizeof(u8), 1264 .mode = 0644, 1265 .proc_handler = proc_dou8vec_minmax, 1266 }, 1267 { 1268 .procname = "tcp_stdurg", 1269 .data = &init_net.ipv4.sysctl_tcp_stdurg, 1270 .maxlen = sizeof(u8), 1271 .mode = 0644, 1272 .proc_handler = proc_dou8vec_minmax, 1273 }, 1274 { 1275 .procname = "tcp_rfc1337", 1276 .data = &init_net.ipv4.sysctl_tcp_rfc1337, 1277 .maxlen = sizeof(u8), 1278 .mode = 0644, 1279 .proc_handler = proc_dou8vec_minmax, 1280 }, 1281 { 1282 .procname = "tcp_abort_on_overflow", 1283 .data = &init_net.ipv4.sysctl_tcp_abort_on_overflow, 1284 .maxlen = sizeof(u8), 1285 .mode = 0644, 1286 .proc_handler = proc_dou8vec_minmax, 1287 }, 1288 { 1289 .procname = "tcp_fack", 1290 .data = &init_net.ipv4.sysctl_tcp_fack, 1291 .maxlen = sizeof(u8), 1292 .mode = 0644, 1293 .proc_handler = proc_dou8vec_minmax, 1294 }, 1295 { 1296 .procname = "tcp_max_reordering", 1297 .data = &init_net.ipv4.sysctl_tcp_max_reordering, 1298 .maxlen = sizeof(int), 1299 .mode = 0644, 1300 .proc_handler = proc_dointvec_minmax, 1301 .extra1 = SYSCTL_ONE, 1302 }, 1303 { 1304 .procname = "tcp_dsack", 1305 .data = &init_net.ipv4.sysctl_tcp_dsack, 1306 .maxlen = sizeof(u8), 1307 .mode = 0644, 1308 .proc_handler = proc_dou8vec_minmax, 1309 }, 1310 { 1311 .procname = "tcp_app_win", 1312 .data = &init_net.ipv4.sysctl_tcp_app_win, 1313 .maxlen = sizeof(u8), 1314 .mode = 0644, 1315 .proc_handler = proc_dou8vec_minmax, 1316 .extra1 = SYSCTL_ZERO, 1317 .extra2 = &tcp_app_win_max, 1318 }, 1319 { 1320 .procname = "tcp_adv_win_scale", 1321 .data = &init_net.ipv4.sysctl_tcp_adv_win_scale, 1322 .maxlen = sizeof(int), 1323 .mode = 0644, 1324 .proc_handler = proc_dointvec_minmax, 1325 .extra1 = &tcp_adv_win_scale_min, 1326 .extra2 = &tcp_adv_win_scale_max, 1327 }, 1328 { 1329 .procname = "tcp_frto", 1330 .data = &init_net.ipv4.sysctl_tcp_frto, 1331 .maxlen = sizeof(u8), 1332 .mode = 0644, 1333 .proc_handler = proc_dou8vec_minmax, 1334 }, 1335 { 1336 .procname = "tcp_no_metrics_save", 1337 .data = &init_net.ipv4.sysctl_tcp_nometrics_save, 1338 .maxlen = sizeof(u8), 1339 .mode = 0644, 1340 .proc_handler = proc_dou8vec_minmax, 1341 }, 1342 { 1343 .procname = "tcp_no_ssthresh_metrics_save", 1344 .data = &init_net.ipv4.sysctl_tcp_no_ssthresh_metrics_save, 1345 .maxlen = sizeof(u8), 1346 .mode = 0644, 1347 .proc_handler = proc_dou8vec_minmax, 1348 .extra1 = SYSCTL_ZERO, 1349 .extra2 = SYSCTL_ONE, 1350 }, 1351 { 1352 .procname = "tcp_moderate_rcvbuf", 1353 .data = &init_net.ipv4.sysctl_tcp_moderate_rcvbuf, 1354 .maxlen = sizeof(u8), 1355 .mode = 0644, 1356 .proc_handler = proc_dou8vec_minmax, 1357 }, 1358 { 1359 .procname = "tcp_rcvbuf_low_rtt", 1360 .data = &init_net.ipv4.sysctl_tcp_rcvbuf_low_rtt, 1361 .maxlen = sizeof(int), 1362 .mode = 0644, 1363 .proc_handler = proc_dointvec_minmax, 1364 .extra1 = SYSCTL_ZERO, 1365 .extra2 = SYSCTL_INT_MAX, 1366 }, 1367 { 1368 .procname = "tcp_tso_win_divisor", 1369 .data = &init_net.ipv4.sysctl_tcp_tso_win_divisor, 1370 .maxlen = sizeof(u8), 1371 .mode = 0644, 1372 .proc_handler = proc_dou8vec_minmax, 1373 }, 1374 { 1375 .procname = "tcp_workaround_signed_windows", 1376 .data = &init_net.ipv4.sysctl_tcp_workaround_signed_windows, 1377 .maxlen = sizeof(u8), 1378 .mode = 0644, 1379 .proc_handler = proc_dou8vec_minmax, 1380 }, 1381 { 1382 .procname = "tcp_limit_output_bytes", 1383 .data = &init_net.ipv4.sysctl_tcp_limit_output_bytes, 1384 .maxlen = sizeof(int), 1385 .mode = 0644, 1386 .proc_handler = proc_dointvec 1387 }, 1388 { 1389 .procname = "tcp_challenge_ack_limit", 1390 .data = &init_net.ipv4.sysctl_tcp_challenge_ack_limit, 1391 .maxlen = sizeof(int), 1392 .mode = 0644, 1393 .proc_handler = proc_dointvec 1394 }, 1395 { 1396 .procname = "tcp_min_tso_segs", 1397 .data = &init_net.ipv4.sysctl_tcp_min_tso_segs, 1398 .maxlen = sizeof(u8), 1399 .mode = 0644, 1400 .proc_handler = proc_dou8vec_minmax, 1401 .extra1 = SYSCTL_ONE, 1402 }, 1403 { 1404 .procname = "tcp_tso_rtt_log", 1405 .data = &init_net.ipv4.sysctl_tcp_tso_rtt_log, 1406 .maxlen = sizeof(u8), 1407 .mode = 0644, 1408 .proc_handler = proc_dou8vec_minmax, 1409 }, 1410 { 1411 .procname = "tcp_min_rtt_wlen", 1412 .data = &init_net.ipv4.sysctl_tcp_min_rtt_wlen, 1413 .maxlen = sizeof(int), 1414 .mode = 0644, 1415 .proc_handler = proc_dointvec_minmax, 1416 .extra1 = SYSCTL_ZERO, 1417 .extra2 = &one_day_secs 1418 }, 1419 { 1420 .procname = "tcp_autocorking", 1421 .data = &init_net.ipv4.sysctl_tcp_autocorking, 1422 .maxlen = sizeof(u8), 1423 .mode = 0644, 1424 .proc_handler = proc_dou8vec_minmax, 1425 .extra1 = SYSCTL_ZERO, 1426 .extra2 = SYSCTL_ONE, 1427 }, 1428 { 1429 .procname = "tcp_invalid_ratelimit", 1430 .data = &init_net.ipv4.sysctl_tcp_invalid_ratelimit, 1431 .maxlen = sizeof(int), 1432 .mode = 0644, 1433 .proc_handler = proc_dointvec_ms_jiffies, 1434 }, 1435 { 1436 .procname = "tcp_pacing_ss_ratio", 1437 .data = &init_net.ipv4.sysctl_tcp_pacing_ss_ratio, 1438 .maxlen = sizeof(int), 1439 .mode = 0644, 1440 .proc_handler = proc_dointvec_minmax, 1441 .extra1 = SYSCTL_ZERO, 1442 .extra2 = SYSCTL_ONE_THOUSAND, 1443 }, 1444 { 1445 .procname = "tcp_pacing_ca_ratio", 1446 .data = &init_net.ipv4.sysctl_tcp_pacing_ca_ratio, 1447 .maxlen = sizeof(int), 1448 .mode = 0644, 1449 .proc_handler = proc_dointvec_minmax, 1450 .extra1 = SYSCTL_ZERO, 1451 .extra2 = SYSCTL_ONE_THOUSAND, 1452 }, 1453 { 1454 .procname = "tcp_wmem", 1455 .data = &init_net.ipv4.sysctl_tcp_wmem, 1456 .maxlen = sizeof(init_net.ipv4.sysctl_tcp_wmem), 1457 .mode = 0644, 1458 .proc_handler = proc_dointvec_minmax, 1459 .extra1 = SYSCTL_ONE, 1460 }, 1461 { 1462 .procname = "tcp_rmem", 1463 .data = &init_net.ipv4.sysctl_tcp_rmem, 1464 .maxlen = sizeof(init_net.ipv4.sysctl_tcp_rmem), 1465 .mode = 0644, 1466 .proc_handler = proc_dointvec_minmax, 1467 .extra1 = &tcp_min_rcvbuf, 1468 }, 1469 { 1470 .procname = "tcp_comp_sack_delay_ns", 1471 .data = &init_net.ipv4.sysctl_tcp_comp_sack_delay_ns, 1472 .maxlen = sizeof(unsigned long), 1473 .mode = 0644, 1474 .proc_handler = proc_doulongvec_minmax, 1475 }, 1476 { 1477 .procname = "tcp_comp_sack_rtt_percent", 1478 .data = &init_net.ipv4.sysctl_tcp_comp_sack_rtt_percent, 1479 .maxlen = sizeof(int), 1480 .mode = 0644, 1481 .proc_handler = proc_dointvec_minmax, 1482 .extra1 = SYSCTL_ONE, 1483 .extra2 = SYSCTL_ONE_THOUSAND, 1484 }, 1485 { 1486 .procname = "tcp_comp_sack_slack_ns", 1487 .data = &init_net.ipv4.sysctl_tcp_comp_sack_slack_ns, 1488 .maxlen = sizeof(unsigned long), 1489 .mode = 0644, 1490 .proc_handler = proc_doulongvec_minmax, 1491 }, 1492 { 1493 .procname = "tcp_comp_sack_nr", 1494 .data = &init_net.ipv4.sysctl_tcp_comp_sack_nr, 1495 .maxlen = sizeof(u8), 1496 .mode = 0644, 1497 .proc_handler = proc_dou8vec_minmax, 1498 .extra1 = SYSCTL_ZERO, 1499 }, 1500 { 1501 .procname = "tcp_backlog_ack_defer", 1502 .data = &init_net.ipv4.sysctl_tcp_backlog_ack_defer, 1503 .maxlen = sizeof(u8), 1504 .mode = 0644, 1505 .proc_handler = proc_dou8vec_minmax, 1506 .extra1 = SYSCTL_ZERO, 1507 .extra2 = SYSCTL_ONE, 1508 }, 1509 { 1510 .procname = "tcp_reflect_tos", 1511 .data = &init_net.ipv4.sysctl_tcp_reflect_tos, 1512 .maxlen = sizeof(u8), 1513 .mode = 0644, 1514 .proc_handler = proc_dou8vec_minmax, 1515 .extra1 = SYSCTL_ZERO, 1516 .extra2 = SYSCTL_ONE, 1517 }, 1518 { 1519 .procname = "tcp_ehash_entries", 1520 .data = &init_net.ipv4.sysctl_tcp_child_ehash_entries, 1521 .mode = 0444, 1522 .proc_handler = proc_tcp_ehash_entries, 1523 }, 1524 { 1525 .procname = "tcp_child_ehash_entries", 1526 .data = &init_net.ipv4.sysctl_tcp_child_ehash_entries, 1527 .maxlen = sizeof(unsigned int), 1528 .mode = 0644, 1529 .proc_handler = proc_douintvec_minmax, 1530 .extra1 = SYSCTL_ZERO, 1531 .extra2 = &tcp_child_ehash_entries_max, 1532 }, 1533 { 1534 .procname = "udp_hash_entries", 1535 .data = &init_net.ipv4.sysctl_udp_child_hash_entries, 1536 .mode = 0444, 1537 .proc_handler = proc_udp_hash_entries, 1538 }, 1539 { 1540 .procname = "udp_child_hash_entries", 1541 .data = &init_net.ipv4.sysctl_udp_child_hash_entries, 1542 .maxlen = sizeof(unsigned int), 1543 .mode = 0644, 1544 .proc_handler = proc_douintvec_minmax, 1545 .extra1 = SYSCTL_ZERO, 1546 .extra2 = &udp_child_hash_entries_max, 1547 }, 1548 { 1549 .procname = "udp_rmem_min", 1550 .data = &init_net.ipv4.sysctl_udp_rmem_min, 1551 .maxlen = sizeof(init_net.ipv4.sysctl_udp_rmem_min), 1552 .mode = 0644, 1553 .proc_handler = proc_dointvec_minmax, 1554 .extra1 = SYSCTL_ONE 1555 }, 1556 { 1557 .procname = "udp_wmem_min", 1558 .data = &init_net.ipv4.sysctl_udp_wmem_min, 1559 .maxlen = sizeof(init_net.ipv4.sysctl_udp_wmem_min), 1560 .mode = 0644, 1561 .proc_handler = proc_dointvec_minmax, 1562 .extra1 = SYSCTL_ONE 1563 }, 1564 { 1565 .procname = "fib_notify_on_flag_change", 1566 .data = &init_net.ipv4.sysctl_fib_notify_on_flag_change, 1567 .maxlen = sizeof(u8), 1568 .mode = 0644, 1569 .proc_handler = proc_dou8vec_minmax, 1570 .extra1 = SYSCTL_ZERO, 1571 .extra2 = SYSCTL_TWO, 1572 }, 1573 { 1574 .procname = "tcp_plb_enabled", 1575 .data = &init_net.ipv4.sysctl_tcp_plb_enabled, 1576 .maxlen = sizeof(u8), 1577 .mode = 0644, 1578 .proc_handler = proc_dou8vec_minmax, 1579 .extra1 = SYSCTL_ZERO, 1580 .extra2 = SYSCTL_ONE, 1581 }, 1582 { 1583 .procname = "tcp_plb_idle_rehash_rounds", 1584 .data = &init_net.ipv4.sysctl_tcp_plb_idle_rehash_rounds, 1585 .maxlen = sizeof(u8), 1586 .mode = 0644, 1587 .proc_handler = proc_dou8vec_minmax, 1588 .extra2 = &tcp_plb_max_rounds, 1589 }, 1590 { 1591 .procname = "tcp_plb_rehash_rounds", 1592 .data = &init_net.ipv4.sysctl_tcp_plb_rehash_rounds, 1593 .maxlen = sizeof(u8), 1594 .mode = 0644, 1595 .proc_handler = proc_dou8vec_minmax, 1596 .extra2 = &tcp_plb_max_rounds, 1597 }, 1598 { 1599 .procname = "tcp_plb_suspend_rto_sec", 1600 .data = &init_net.ipv4.sysctl_tcp_plb_suspend_rto_sec, 1601 .maxlen = sizeof(u8), 1602 .mode = 0644, 1603 .proc_handler = proc_dou8vec_minmax, 1604 }, 1605 { 1606 .procname = "tcp_plb_cong_thresh", 1607 .data = &init_net.ipv4.sysctl_tcp_plb_cong_thresh, 1608 .maxlen = sizeof(int), 1609 .mode = 0644, 1610 .proc_handler = proc_dointvec_minmax, 1611 .extra1 = SYSCTL_ZERO, 1612 .extra2 = &tcp_plb_max_cong_thresh, 1613 }, 1614 { 1615 .procname = "tcp_syn_linear_timeouts", 1616 .data = &init_net.ipv4.sysctl_tcp_syn_linear_timeouts, 1617 .maxlen = sizeof(u8), 1618 .mode = 0644, 1619 .proc_handler = proc_dou8vec_minmax, 1620 .extra1 = SYSCTL_ZERO, 1621 .extra2 = &tcp_syn_linear_timeouts_max, 1622 }, 1623 { 1624 .procname = "tcp_shrink_window", 1625 .data = &init_net.ipv4.sysctl_tcp_shrink_window, 1626 .maxlen = sizeof(u8), 1627 .mode = 0644, 1628 .proc_handler = proc_dou8vec_minmax, 1629 .extra1 = SYSCTL_ZERO, 1630 .extra2 = SYSCTL_ONE, 1631 }, 1632 { 1633 .procname = "tcp_pingpong_thresh", 1634 .data = &init_net.ipv4.sysctl_tcp_pingpong_thresh, 1635 .maxlen = sizeof(u8), 1636 .mode = 0644, 1637 .proc_handler = proc_dou8vec_minmax, 1638 .extra1 = SYSCTL_ONE, 1639 }, 1640 { 1641 .procname = "tcp_rto_min_us", 1642 .data = &init_net.ipv4.sysctl_tcp_rto_min_us, 1643 .maxlen = sizeof(int), 1644 .mode = 0644, 1645 .proc_handler = proc_dointvec_minmax, 1646 .extra1 = SYSCTL_ONE, 1647 }, 1648 { 1649 .procname = "tcp_rto_max_ms", 1650 .data = &init_net.ipv4.sysctl_tcp_rto_max_ms, 1651 .maxlen = sizeof(int), 1652 .mode = 0644, 1653 .proc_handler = proc_dointvec_minmax, 1654 .extra1 = SYSCTL_ONE_THOUSAND, 1655 .extra2 = &tcp_rto_max_max, 1656 }, 1657 }; 1658 1659 static const struct ctl_table *ipv4_net_table_dup(struct net *net) 1660 { 1661 size_t table_size = ARRAY_SIZE(ipv4_net_table); 1662 struct ctl_table *table; 1663 int i; 1664 1665 table = kmemdup(ipv4_net_table, sizeof(ipv4_net_table), GFP_KERNEL); 1666 if (!table) 1667 return NULL; 1668 1669 for (i = 0; i < table_size; i++) { 1670 if (table[i].data) { 1671 /* Update the variables to point into 1672 * the current struct net 1673 */ 1674 table[i].data += (void *)net - (void *)&init_net; 1675 } else { 1676 /* Entries without data pointer are global; 1677 * Make them read-only in non-init_net ns 1678 */ 1679 table[i].mode &= ~0222; 1680 } 1681 if (table[i].extra2 >= (void *)&init_net.ipv4 && 1682 table[i].extra2 < (void *)(&init_net.ipv4 + 1)) 1683 table[i].extra2 += (void *)net - (void *)&init_net; 1684 } 1685 return table; 1686 } 1687 1688 static __net_init int ipv4_sysctl_init_net(struct net *net) 1689 { 1690 size_t table_size = ARRAY_SIZE(ipv4_net_table); 1691 const struct ctl_table *table; 1692 1693 table = ipv4_net_table; 1694 if (!net_eq(net, &init_net)) { 1695 table = ipv4_net_table_dup(net); 1696 if (!table) 1697 goto err_alloc; 1698 } 1699 1700 net->ipv4.ipv4_hdr = register_net_sysctl_sz(net, "net/ipv4", table, 1701 table_size); 1702 if (!net->ipv4.ipv4_hdr) 1703 goto err_reg; 1704 1705 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 1706 if (!net->ipv4.sysctl_local_reserved_ports) 1707 goto err_ports; 1708 1709 proc_fib_multipath_hash_set_seed(net, 0); 1710 1711 return 0; 1712 1713 err_ports: 1714 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1715 err_reg: 1716 if (!net_eq(net, &init_net)) 1717 kfree(table); 1718 err_alloc: 1719 return -ENOMEM; 1720 } 1721 1722 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1723 { 1724 const struct ctl_table *table; 1725 1726 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1727 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1728 kfree(table); 1729 kfree(net->ipv4.sysctl_local_reserved_ports); 1730 } 1731 1732 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1733 .init = ipv4_sysctl_init_net, 1734 .exit = ipv4_sysctl_exit_net, 1735 }; 1736 1737 static __init int sysctl_ipv4_init(void) 1738 { 1739 struct ctl_table_header *hdr; 1740 1741 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1742 if (!hdr) 1743 return -ENOMEM; 1744 1745 proc_fib_multipath_hash_init_rand_seed(); 1746 1747 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1748 unregister_net_sysctl_table(hdr); 1749 return -ENOMEM; 1750 } 1751 1752 return 0; 1753 } 1754 1755 __initcall(sysctl_ipv4_init); 1756