1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 #include <net/protocol.h> 28 29 static int zero; 30 static int one = 1; 31 static int four = 4; 32 static int thousand = 1000; 33 static int gso_max_segs = GSO_MAX_SEGS; 34 static int tcp_retr1_max = 255; 35 static int ip_local_port_range_min[] = { 1, 1 }; 36 static int ip_local_port_range_max[] = { 65535, 65535 }; 37 static int tcp_adv_win_scale_min = -31; 38 static int tcp_adv_win_scale_max = 31; 39 static int ip_privileged_port_min; 40 static int ip_privileged_port_max = 65535; 41 static int ip_ttl_min = 1; 42 static int ip_ttl_max = 255; 43 static int tcp_syn_retries_min = 1; 44 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 45 static int ip_ping_group_range_min[] = { 0, 0 }; 46 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 47 48 /* obsolete */ 49 static int sysctl_tcp_low_latency __read_mostly; 50 51 /* Update system visible IP port range */ 52 static void set_local_port_range(struct net *net, int range[2]) 53 { 54 bool same_parity = !((range[0] ^ range[1]) & 1); 55 56 write_seqlock_bh(&net->ipv4.ip_local_ports.lock); 57 if (same_parity && !net->ipv4.ip_local_ports.warned) { 58 net->ipv4.ip_local_ports.warned = true; 59 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 60 } 61 net->ipv4.ip_local_ports.range[0] = range[0]; 62 net->ipv4.ip_local_ports.range[1] = range[1]; 63 write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); 64 } 65 66 /* Validate changes from /proc interface. */ 67 static int ipv4_local_port_range(struct ctl_table *table, int write, 68 void __user *buffer, 69 size_t *lenp, loff_t *ppos) 70 { 71 struct net *net = 72 container_of(table->data, struct net, ipv4.ip_local_ports.range); 73 int ret; 74 int range[2]; 75 struct ctl_table tmp = { 76 .data = &range, 77 .maxlen = sizeof(range), 78 .mode = table->mode, 79 .extra1 = &ip_local_port_range_min, 80 .extra2 = &ip_local_port_range_max, 81 }; 82 83 inet_get_local_port_range(net, &range[0], &range[1]); 84 85 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 86 87 if (write && ret == 0) { 88 /* Ensure that the upper limit is not smaller than the lower, 89 * and that the lower does not encroach upon the privileged 90 * port limit. 91 */ 92 if ((range[1] < range[0]) || 93 (range[0] < net->ipv4.sysctl_ip_prot_sock)) 94 ret = -EINVAL; 95 else 96 set_local_port_range(net, range); 97 } 98 99 return ret; 100 } 101 102 /* Validate changes from /proc interface. */ 103 static int ipv4_privileged_ports(struct ctl_table *table, int write, 104 void __user *buffer, size_t *lenp, loff_t *ppos) 105 { 106 struct net *net = container_of(table->data, struct net, 107 ipv4.sysctl_ip_prot_sock); 108 int ret; 109 int pports; 110 int range[2]; 111 struct ctl_table tmp = { 112 .data = &pports, 113 .maxlen = sizeof(pports), 114 .mode = table->mode, 115 .extra1 = &ip_privileged_port_min, 116 .extra2 = &ip_privileged_port_max, 117 }; 118 119 pports = net->ipv4.sysctl_ip_prot_sock; 120 121 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 122 123 if (write && ret == 0) { 124 inet_get_local_port_range(net, &range[0], &range[1]); 125 /* Ensure that the local port range doesn't overlap with the 126 * privileged port range. 127 */ 128 if (range[0] < pports) 129 ret = -EINVAL; 130 else 131 net->ipv4.sysctl_ip_prot_sock = pports; 132 } 133 134 return ret; 135 } 136 137 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 138 { 139 kgid_t *data = table->data; 140 struct net *net = 141 container_of(table->data, struct net, ipv4.ping_group_range.range); 142 unsigned int seq; 143 do { 144 seq = read_seqbegin(&net->ipv4.ping_group_range.lock); 145 146 *low = data[0]; 147 *high = data[1]; 148 } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); 149 } 150 151 /* Update system visible IP port range */ 152 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 153 { 154 kgid_t *data = table->data; 155 struct net *net = 156 container_of(table->data, struct net, ipv4.ping_group_range.range); 157 write_seqlock(&net->ipv4.ping_group_range.lock); 158 data[0] = low; 159 data[1] = high; 160 write_sequnlock(&net->ipv4.ping_group_range.lock); 161 } 162 163 /* Validate changes from /proc interface. */ 164 static int ipv4_ping_group_range(struct ctl_table *table, int write, 165 void __user *buffer, 166 size_t *lenp, loff_t *ppos) 167 { 168 struct user_namespace *user_ns = current_user_ns(); 169 int ret; 170 gid_t urange[2]; 171 kgid_t low, high; 172 struct ctl_table tmp = { 173 .data = &urange, 174 .maxlen = sizeof(urange), 175 .mode = table->mode, 176 .extra1 = &ip_ping_group_range_min, 177 .extra2 = &ip_ping_group_range_max, 178 }; 179 180 inet_get_ping_group_range_table(table, &low, &high); 181 urange[0] = from_kgid_munged(user_ns, low); 182 urange[1] = from_kgid_munged(user_ns, high); 183 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 184 185 if (write && ret == 0) { 186 low = make_kgid(user_ns, urange[0]); 187 high = make_kgid(user_ns, urange[1]); 188 if (!gid_valid(low) || !gid_valid(high) || 189 (urange[1] < urange[0]) || gid_lt(high, low)) { 190 low = make_kgid(&init_user_ns, 1); 191 high = make_kgid(&init_user_ns, 0); 192 } 193 set_ping_group_range(table, low, high); 194 } 195 196 return ret; 197 } 198 199 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 200 void __user *buffer, size_t *lenp, loff_t *ppos) 201 { 202 char val[TCP_CA_NAME_MAX]; 203 struct ctl_table tbl = { 204 .data = val, 205 .maxlen = TCP_CA_NAME_MAX, 206 }; 207 int ret; 208 209 tcp_get_default_congestion_control(val); 210 211 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 212 if (write && ret == 0) 213 ret = tcp_set_default_congestion_control(val); 214 return ret; 215 } 216 217 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 218 int write, 219 void __user *buffer, size_t *lenp, 220 loff_t *ppos) 221 { 222 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 223 int ret; 224 225 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 226 if (!tbl.data) 227 return -ENOMEM; 228 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 229 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 230 kfree(tbl.data); 231 return ret; 232 } 233 234 static int proc_allowed_congestion_control(struct ctl_table *ctl, 235 int write, 236 void __user *buffer, size_t *lenp, 237 loff_t *ppos) 238 { 239 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 240 int ret; 241 242 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 243 if (!tbl.data) 244 return -ENOMEM; 245 246 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 247 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 248 if (write && ret == 0) 249 ret = tcp_set_allowed_congestion_control(tbl.data); 250 kfree(tbl.data); 251 return ret; 252 } 253 254 static int proc_tcp_fastopen_key(struct ctl_table *table, int write, 255 void __user *buffer, size_t *lenp, 256 loff_t *ppos) 257 { 258 struct net *net = container_of(table->data, struct net, 259 ipv4.sysctl_tcp_fastopen); 260 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 261 struct tcp_fastopen_context *ctxt; 262 int ret; 263 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 264 265 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 266 if (!tbl.data) 267 return -ENOMEM; 268 269 rcu_read_lock(); 270 ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx); 271 if (ctxt) 272 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 273 else 274 memset(user_key, 0, sizeof(user_key)); 275 rcu_read_unlock(); 276 277 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 278 user_key[0], user_key[1], user_key[2], user_key[3]); 279 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 280 281 if (write && ret == 0) { 282 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 283 user_key + 2, user_key + 3) != 4) { 284 ret = -EINVAL; 285 goto bad_key; 286 } 287 tcp_fastopen_reset_cipher(net, NULL, user_key, 288 TCP_FASTOPEN_KEY_LENGTH); 289 } 290 291 bad_key: 292 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 293 user_key[0], user_key[1], user_key[2], user_key[3], 294 (char *)tbl.data, ret); 295 kfree(tbl.data); 296 return ret; 297 } 298 299 static void proc_configure_early_demux(int enabled, int protocol) 300 { 301 struct net_protocol *ipprot; 302 #if IS_ENABLED(CONFIG_IPV6) 303 struct inet6_protocol *ip6prot; 304 #endif 305 306 rcu_read_lock(); 307 308 ipprot = rcu_dereference(inet_protos[protocol]); 309 if (ipprot) 310 ipprot->early_demux = enabled ? ipprot->early_demux_handler : 311 NULL; 312 313 #if IS_ENABLED(CONFIG_IPV6) 314 ip6prot = rcu_dereference(inet6_protos[protocol]); 315 if (ip6prot) 316 ip6prot->early_demux = enabled ? ip6prot->early_demux_handler : 317 NULL; 318 #endif 319 rcu_read_unlock(); 320 } 321 322 static int proc_tcp_early_demux(struct ctl_table *table, int write, 323 void __user *buffer, size_t *lenp, loff_t *ppos) 324 { 325 int ret = 0; 326 327 ret = proc_dointvec(table, write, buffer, lenp, ppos); 328 329 if (write && !ret) { 330 int enabled = init_net.ipv4.sysctl_tcp_early_demux; 331 332 proc_configure_early_demux(enabled, IPPROTO_TCP); 333 } 334 335 return ret; 336 } 337 338 static int proc_udp_early_demux(struct ctl_table *table, int write, 339 void __user *buffer, size_t *lenp, loff_t *ppos) 340 { 341 int ret = 0; 342 343 ret = proc_dointvec(table, write, buffer, lenp, ppos); 344 345 if (write && !ret) { 346 int enabled = init_net.ipv4.sysctl_udp_early_demux; 347 348 proc_configure_early_demux(enabled, IPPROTO_UDP); 349 } 350 351 return ret; 352 } 353 354 static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table, 355 int write, 356 void __user *buffer, 357 size_t *lenp, loff_t *ppos) 358 { 359 struct net *net = container_of(table->data, struct net, 360 ipv4.sysctl_tcp_fastopen_blackhole_timeout); 361 int ret; 362 363 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 364 if (write && ret == 0) 365 atomic_set(&net->ipv4.tfo_active_disable_times, 0); 366 367 return ret; 368 } 369 370 static int proc_tcp_available_ulp(struct ctl_table *ctl, 371 int write, 372 void __user *buffer, size_t *lenp, 373 loff_t *ppos) 374 { 375 struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, }; 376 int ret; 377 378 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 379 if (!tbl.data) 380 return -ENOMEM; 381 tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX); 382 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 383 kfree(tbl.data); 384 385 return ret; 386 } 387 388 static struct ctl_table ipv4_table[] = { 389 { 390 .procname = "tcp_max_orphans", 391 .data = &sysctl_tcp_max_orphans, 392 .maxlen = sizeof(int), 393 .mode = 0644, 394 .proc_handler = proc_dointvec 395 }, 396 { 397 .procname = "inet_peer_threshold", 398 .data = &inet_peer_threshold, 399 .maxlen = sizeof(int), 400 .mode = 0644, 401 .proc_handler = proc_dointvec 402 }, 403 { 404 .procname = "inet_peer_minttl", 405 .data = &inet_peer_minttl, 406 .maxlen = sizeof(int), 407 .mode = 0644, 408 .proc_handler = proc_dointvec_jiffies, 409 }, 410 { 411 .procname = "inet_peer_maxttl", 412 .data = &inet_peer_maxttl, 413 .maxlen = sizeof(int), 414 .mode = 0644, 415 .proc_handler = proc_dointvec_jiffies, 416 }, 417 { 418 .procname = "tcp_mem", 419 .maxlen = sizeof(sysctl_tcp_mem), 420 .data = &sysctl_tcp_mem, 421 .mode = 0644, 422 .proc_handler = proc_doulongvec_minmax, 423 }, 424 { 425 .procname = "tcp_wmem", 426 .data = &sysctl_tcp_wmem, 427 .maxlen = sizeof(sysctl_tcp_wmem), 428 .mode = 0644, 429 .proc_handler = proc_dointvec_minmax, 430 .extra1 = &one, 431 }, 432 { 433 .procname = "tcp_rmem", 434 .data = &sysctl_tcp_rmem, 435 .maxlen = sizeof(sysctl_tcp_rmem), 436 .mode = 0644, 437 .proc_handler = proc_dointvec_minmax, 438 .extra1 = &one, 439 }, 440 { 441 .procname = "tcp_low_latency", 442 .data = &sysctl_tcp_low_latency, 443 .maxlen = sizeof(int), 444 .mode = 0644, 445 .proc_handler = proc_dointvec 446 }, 447 { 448 .procname = "tcp_congestion_control", 449 .mode = 0644, 450 .maxlen = TCP_CA_NAME_MAX, 451 .proc_handler = proc_tcp_congestion_control, 452 }, 453 #ifdef CONFIG_NETLABEL 454 { 455 .procname = "cipso_cache_enable", 456 .data = &cipso_v4_cache_enabled, 457 .maxlen = sizeof(int), 458 .mode = 0644, 459 .proc_handler = proc_dointvec, 460 }, 461 { 462 .procname = "cipso_cache_bucket_size", 463 .data = &cipso_v4_cache_bucketsize, 464 .maxlen = sizeof(int), 465 .mode = 0644, 466 .proc_handler = proc_dointvec, 467 }, 468 { 469 .procname = "cipso_rbm_optfmt", 470 .data = &cipso_v4_rbm_optfmt, 471 .maxlen = sizeof(int), 472 .mode = 0644, 473 .proc_handler = proc_dointvec, 474 }, 475 { 476 .procname = "cipso_rbm_strictvalid", 477 .data = &cipso_v4_rbm_strictvalid, 478 .maxlen = sizeof(int), 479 .mode = 0644, 480 .proc_handler = proc_dointvec, 481 }, 482 #endif /* CONFIG_NETLABEL */ 483 { 484 .procname = "tcp_available_congestion_control", 485 .maxlen = TCP_CA_BUF_MAX, 486 .mode = 0444, 487 .proc_handler = proc_tcp_available_congestion_control, 488 }, 489 { 490 .procname = "tcp_allowed_congestion_control", 491 .maxlen = TCP_CA_BUF_MAX, 492 .mode = 0644, 493 .proc_handler = proc_allowed_congestion_control, 494 }, 495 { 496 .procname = "tcp_available_ulp", 497 .maxlen = TCP_ULP_BUF_MAX, 498 .mode = 0444, 499 .proc_handler = proc_tcp_available_ulp, 500 }, 501 { 502 .procname = "icmp_msgs_per_sec", 503 .data = &sysctl_icmp_msgs_per_sec, 504 .maxlen = sizeof(int), 505 .mode = 0644, 506 .proc_handler = proc_dointvec_minmax, 507 .extra1 = &zero, 508 }, 509 { 510 .procname = "icmp_msgs_burst", 511 .data = &sysctl_icmp_msgs_burst, 512 .maxlen = sizeof(int), 513 .mode = 0644, 514 .proc_handler = proc_dointvec_minmax, 515 .extra1 = &zero, 516 }, 517 { 518 .procname = "udp_mem", 519 .data = &sysctl_udp_mem, 520 .maxlen = sizeof(sysctl_udp_mem), 521 .mode = 0644, 522 .proc_handler = proc_doulongvec_minmax, 523 }, 524 { 525 .procname = "udp_rmem_min", 526 .data = &sysctl_udp_rmem_min, 527 .maxlen = sizeof(sysctl_udp_rmem_min), 528 .mode = 0644, 529 .proc_handler = proc_dointvec_minmax, 530 .extra1 = &one 531 }, 532 { 533 .procname = "udp_wmem_min", 534 .data = &sysctl_udp_wmem_min, 535 .maxlen = sizeof(sysctl_udp_wmem_min), 536 .mode = 0644, 537 .proc_handler = proc_dointvec_minmax, 538 .extra1 = &one 539 }, 540 { } 541 }; 542 543 static struct ctl_table ipv4_net_table[] = { 544 { 545 .procname = "icmp_echo_ignore_all", 546 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 547 .maxlen = sizeof(int), 548 .mode = 0644, 549 .proc_handler = proc_dointvec 550 }, 551 { 552 .procname = "icmp_echo_ignore_broadcasts", 553 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 554 .maxlen = sizeof(int), 555 .mode = 0644, 556 .proc_handler = proc_dointvec 557 }, 558 { 559 .procname = "icmp_ignore_bogus_error_responses", 560 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 561 .maxlen = sizeof(int), 562 .mode = 0644, 563 .proc_handler = proc_dointvec 564 }, 565 { 566 .procname = "icmp_errors_use_inbound_ifaddr", 567 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 568 .maxlen = sizeof(int), 569 .mode = 0644, 570 .proc_handler = proc_dointvec 571 }, 572 { 573 .procname = "icmp_ratelimit", 574 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 575 .maxlen = sizeof(int), 576 .mode = 0644, 577 .proc_handler = proc_dointvec_ms_jiffies, 578 }, 579 { 580 .procname = "icmp_ratemask", 581 .data = &init_net.ipv4.sysctl_icmp_ratemask, 582 .maxlen = sizeof(int), 583 .mode = 0644, 584 .proc_handler = proc_dointvec 585 }, 586 { 587 .procname = "ping_group_range", 588 .data = &init_net.ipv4.ping_group_range.range, 589 .maxlen = sizeof(gid_t)*2, 590 .mode = 0644, 591 .proc_handler = ipv4_ping_group_range, 592 }, 593 { 594 .procname = "tcp_ecn", 595 .data = &init_net.ipv4.sysctl_tcp_ecn, 596 .maxlen = sizeof(int), 597 .mode = 0644, 598 .proc_handler = proc_dointvec 599 }, 600 { 601 .procname = "tcp_ecn_fallback", 602 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 603 .maxlen = sizeof(int), 604 .mode = 0644, 605 .proc_handler = proc_dointvec 606 }, 607 { 608 .procname = "ip_dynaddr", 609 .data = &init_net.ipv4.sysctl_ip_dynaddr, 610 .maxlen = sizeof(int), 611 .mode = 0644, 612 .proc_handler = proc_dointvec 613 }, 614 { 615 .procname = "ip_early_demux", 616 .data = &init_net.ipv4.sysctl_ip_early_demux, 617 .maxlen = sizeof(int), 618 .mode = 0644, 619 .proc_handler = proc_dointvec 620 }, 621 { 622 .procname = "udp_early_demux", 623 .data = &init_net.ipv4.sysctl_udp_early_demux, 624 .maxlen = sizeof(int), 625 .mode = 0644, 626 .proc_handler = proc_udp_early_demux 627 }, 628 { 629 .procname = "tcp_early_demux", 630 .data = &init_net.ipv4.sysctl_tcp_early_demux, 631 .maxlen = sizeof(int), 632 .mode = 0644, 633 .proc_handler = proc_tcp_early_demux 634 }, 635 { 636 .procname = "ip_default_ttl", 637 .data = &init_net.ipv4.sysctl_ip_default_ttl, 638 .maxlen = sizeof(int), 639 .mode = 0644, 640 .proc_handler = proc_dointvec_minmax, 641 .extra1 = &ip_ttl_min, 642 .extra2 = &ip_ttl_max, 643 }, 644 { 645 .procname = "ip_local_port_range", 646 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 647 .data = &init_net.ipv4.ip_local_ports.range, 648 .mode = 0644, 649 .proc_handler = ipv4_local_port_range, 650 }, 651 { 652 .procname = "ip_local_reserved_ports", 653 .data = &init_net.ipv4.sysctl_local_reserved_ports, 654 .maxlen = 65536, 655 .mode = 0644, 656 .proc_handler = proc_do_large_bitmap, 657 }, 658 { 659 .procname = "ip_no_pmtu_disc", 660 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 661 .maxlen = sizeof(int), 662 .mode = 0644, 663 .proc_handler = proc_dointvec 664 }, 665 { 666 .procname = "ip_forward_use_pmtu", 667 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 668 .maxlen = sizeof(int), 669 .mode = 0644, 670 .proc_handler = proc_dointvec, 671 }, 672 { 673 .procname = "ip_nonlocal_bind", 674 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 675 .maxlen = sizeof(int), 676 .mode = 0644, 677 .proc_handler = proc_dointvec 678 }, 679 { 680 .procname = "fwmark_reflect", 681 .data = &init_net.ipv4.sysctl_fwmark_reflect, 682 .maxlen = sizeof(int), 683 .mode = 0644, 684 .proc_handler = proc_dointvec, 685 }, 686 { 687 .procname = "tcp_fwmark_accept", 688 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 689 .maxlen = sizeof(int), 690 .mode = 0644, 691 .proc_handler = proc_dointvec, 692 }, 693 #ifdef CONFIG_NET_L3_MASTER_DEV 694 { 695 .procname = "tcp_l3mdev_accept", 696 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 697 .maxlen = sizeof(int), 698 .mode = 0644, 699 .proc_handler = proc_dointvec_minmax, 700 .extra1 = &zero, 701 .extra2 = &one, 702 }, 703 #endif 704 { 705 .procname = "tcp_mtu_probing", 706 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 707 .maxlen = sizeof(int), 708 .mode = 0644, 709 .proc_handler = proc_dointvec, 710 }, 711 { 712 .procname = "tcp_base_mss", 713 .data = &init_net.ipv4.sysctl_tcp_base_mss, 714 .maxlen = sizeof(int), 715 .mode = 0644, 716 .proc_handler = proc_dointvec, 717 }, 718 { 719 .procname = "tcp_probe_threshold", 720 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 721 .maxlen = sizeof(int), 722 .mode = 0644, 723 .proc_handler = proc_dointvec, 724 }, 725 { 726 .procname = "tcp_probe_interval", 727 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 728 .maxlen = sizeof(int), 729 .mode = 0644, 730 .proc_handler = proc_dointvec, 731 }, 732 { 733 .procname = "igmp_link_local_mcast_reports", 734 .data = &init_net.ipv4.sysctl_igmp_llm_reports, 735 .maxlen = sizeof(int), 736 .mode = 0644, 737 .proc_handler = proc_dointvec 738 }, 739 { 740 .procname = "igmp_max_memberships", 741 .data = &init_net.ipv4.sysctl_igmp_max_memberships, 742 .maxlen = sizeof(int), 743 .mode = 0644, 744 .proc_handler = proc_dointvec 745 }, 746 { 747 .procname = "igmp_max_msf", 748 .data = &init_net.ipv4.sysctl_igmp_max_msf, 749 .maxlen = sizeof(int), 750 .mode = 0644, 751 .proc_handler = proc_dointvec 752 }, 753 #ifdef CONFIG_IP_MULTICAST 754 { 755 .procname = "igmp_qrv", 756 .data = &init_net.ipv4.sysctl_igmp_qrv, 757 .maxlen = sizeof(int), 758 .mode = 0644, 759 .proc_handler = proc_dointvec_minmax, 760 .extra1 = &one 761 }, 762 #endif 763 { 764 .procname = "tcp_keepalive_time", 765 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 766 .maxlen = sizeof(int), 767 .mode = 0644, 768 .proc_handler = proc_dointvec_jiffies, 769 }, 770 { 771 .procname = "tcp_keepalive_probes", 772 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 773 .maxlen = sizeof(int), 774 .mode = 0644, 775 .proc_handler = proc_dointvec 776 }, 777 { 778 .procname = "tcp_keepalive_intvl", 779 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 780 .maxlen = sizeof(int), 781 .mode = 0644, 782 .proc_handler = proc_dointvec_jiffies, 783 }, 784 { 785 .procname = "tcp_syn_retries", 786 .data = &init_net.ipv4.sysctl_tcp_syn_retries, 787 .maxlen = sizeof(int), 788 .mode = 0644, 789 .proc_handler = proc_dointvec_minmax, 790 .extra1 = &tcp_syn_retries_min, 791 .extra2 = &tcp_syn_retries_max 792 }, 793 { 794 .procname = "tcp_synack_retries", 795 .data = &init_net.ipv4.sysctl_tcp_synack_retries, 796 .maxlen = sizeof(int), 797 .mode = 0644, 798 .proc_handler = proc_dointvec 799 }, 800 #ifdef CONFIG_SYN_COOKIES 801 { 802 .procname = "tcp_syncookies", 803 .data = &init_net.ipv4.sysctl_tcp_syncookies, 804 .maxlen = sizeof(int), 805 .mode = 0644, 806 .proc_handler = proc_dointvec 807 }, 808 #endif 809 { 810 .procname = "tcp_reordering", 811 .data = &init_net.ipv4.sysctl_tcp_reordering, 812 .maxlen = sizeof(int), 813 .mode = 0644, 814 .proc_handler = proc_dointvec 815 }, 816 { 817 .procname = "tcp_retries1", 818 .data = &init_net.ipv4.sysctl_tcp_retries1, 819 .maxlen = sizeof(int), 820 .mode = 0644, 821 .proc_handler = proc_dointvec_minmax, 822 .extra2 = &tcp_retr1_max 823 }, 824 { 825 .procname = "tcp_retries2", 826 .data = &init_net.ipv4.sysctl_tcp_retries2, 827 .maxlen = sizeof(int), 828 .mode = 0644, 829 .proc_handler = proc_dointvec 830 }, 831 { 832 .procname = "tcp_orphan_retries", 833 .data = &init_net.ipv4.sysctl_tcp_orphan_retries, 834 .maxlen = sizeof(int), 835 .mode = 0644, 836 .proc_handler = proc_dointvec 837 }, 838 { 839 .procname = "tcp_fin_timeout", 840 .data = &init_net.ipv4.sysctl_tcp_fin_timeout, 841 .maxlen = sizeof(int), 842 .mode = 0644, 843 .proc_handler = proc_dointvec_jiffies, 844 }, 845 { 846 .procname = "tcp_notsent_lowat", 847 .data = &init_net.ipv4.sysctl_tcp_notsent_lowat, 848 .maxlen = sizeof(unsigned int), 849 .mode = 0644, 850 .proc_handler = proc_douintvec, 851 }, 852 { 853 .procname = "tcp_tw_reuse", 854 .data = &init_net.ipv4.sysctl_tcp_tw_reuse, 855 .maxlen = sizeof(int), 856 .mode = 0644, 857 .proc_handler = proc_dointvec 858 }, 859 { 860 .procname = "tcp_max_tw_buckets", 861 .data = &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets, 862 .maxlen = sizeof(int), 863 .mode = 0644, 864 .proc_handler = proc_dointvec 865 }, 866 { 867 .procname = "tcp_max_syn_backlog", 868 .data = &init_net.ipv4.sysctl_max_syn_backlog, 869 .maxlen = sizeof(int), 870 .mode = 0644, 871 .proc_handler = proc_dointvec 872 }, 873 { 874 .procname = "tcp_fastopen", 875 .data = &init_net.ipv4.sysctl_tcp_fastopen, 876 .maxlen = sizeof(int), 877 .mode = 0644, 878 .proc_handler = proc_dointvec, 879 }, 880 { 881 .procname = "tcp_fastopen_key", 882 .mode = 0600, 883 .data = &init_net.ipv4.sysctl_tcp_fastopen, 884 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 885 .proc_handler = proc_tcp_fastopen_key, 886 }, 887 { 888 .procname = "tcp_fastopen_blackhole_timeout_sec", 889 .data = &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout, 890 .maxlen = sizeof(int), 891 .mode = 0644, 892 .proc_handler = proc_tfo_blackhole_detect_timeout, 893 .extra1 = &zero, 894 }, 895 #ifdef CONFIG_IP_ROUTE_MULTIPATH 896 { 897 .procname = "fib_multipath_use_neigh", 898 .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh, 899 .maxlen = sizeof(int), 900 .mode = 0644, 901 .proc_handler = proc_dointvec_minmax, 902 .extra1 = &zero, 903 .extra2 = &one, 904 }, 905 { 906 .procname = "fib_multipath_hash_policy", 907 .data = &init_net.ipv4.sysctl_fib_multipath_hash_policy, 908 .maxlen = sizeof(int), 909 .mode = 0644, 910 .proc_handler = proc_dointvec_minmax, 911 .extra1 = &zero, 912 .extra2 = &one, 913 }, 914 #endif 915 { 916 .procname = "ip_unprivileged_port_start", 917 .maxlen = sizeof(int), 918 .data = &init_net.ipv4.sysctl_ip_prot_sock, 919 .mode = 0644, 920 .proc_handler = ipv4_privileged_ports, 921 }, 922 #ifdef CONFIG_NET_L3_MASTER_DEV 923 { 924 .procname = "udp_l3mdev_accept", 925 .data = &init_net.ipv4.sysctl_udp_l3mdev_accept, 926 .maxlen = sizeof(int), 927 .mode = 0644, 928 .proc_handler = proc_dointvec_minmax, 929 .extra1 = &zero, 930 .extra2 = &one, 931 }, 932 #endif 933 { 934 .procname = "tcp_sack", 935 .data = &init_net.ipv4.sysctl_tcp_sack, 936 .maxlen = sizeof(int), 937 .mode = 0644, 938 .proc_handler = proc_dointvec 939 }, 940 { 941 .procname = "tcp_window_scaling", 942 .data = &init_net.ipv4.sysctl_tcp_window_scaling, 943 .maxlen = sizeof(int), 944 .mode = 0644, 945 .proc_handler = proc_dointvec 946 }, 947 { 948 .procname = "tcp_timestamps", 949 .data = &init_net.ipv4.sysctl_tcp_timestamps, 950 .maxlen = sizeof(int), 951 .mode = 0644, 952 .proc_handler = proc_dointvec 953 }, 954 { 955 .procname = "tcp_early_retrans", 956 .data = &init_net.ipv4.sysctl_tcp_early_retrans, 957 .maxlen = sizeof(int), 958 .mode = 0644, 959 .proc_handler = proc_dointvec_minmax, 960 .extra1 = &zero, 961 .extra2 = &four, 962 }, 963 { 964 .procname = "tcp_recovery", 965 .data = &init_net.ipv4.sysctl_tcp_recovery, 966 .maxlen = sizeof(int), 967 .mode = 0644, 968 .proc_handler = proc_dointvec, 969 }, 970 { 971 .procname = "tcp_thin_linear_timeouts", 972 .data = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts, 973 .maxlen = sizeof(int), 974 .mode = 0644, 975 .proc_handler = proc_dointvec 976 }, 977 { 978 .procname = "tcp_slow_start_after_idle", 979 .data = &init_net.ipv4.sysctl_tcp_slow_start_after_idle, 980 .maxlen = sizeof(int), 981 .mode = 0644, 982 .proc_handler = proc_dointvec 983 }, 984 { 985 .procname = "tcp_retrans_collapse", 986 .data = &init_net.ipv4.sysctl_tcp_retrans_collapse, 987 .maxlen = sizeof(int), 988 .mode = 0644, 989 .proc_handler = proc_dointvec 990 }, 991 { 992 .procname = "tcp_stdurg", 993 .data = &init_net.ipv4.sysctl_tcp_stdurg, 994 .maxlen = sizeof(int), 995 .mode = 0644, 996 .proc_handler = proc_dointvec 997 }, 998 { 999 .procname = "tcp_rfc1337", 1000 .data = &init_net.ipv4.sysctl_tcp_rfc1337, 1001 .maxlen = sizeof(int), 1002 .mode = 0644, 1003 .proc_handler = proc_dointvec 1004 }, 1005 { 1006 .procname = "tcp_abort_on_overflow", 1007 .data = &init_net.ipv4.sysctl_tcp_abort_on_overflow, 1008 .maxlen = sizeof(int), 1009 .mode = 0644, 1010 .proc_handler = proc_dointvec 1011 }, 1012 { 1013 .procname = "tcp_fack", 1014 .data = &init_net.ipv4.sysctl_tcp_fack, 1015 .maxlen = sizeof(int), 1016 .mode = 0644, 1017 .proc_handler = proc_dointvec 1018 }, 1019 { 1020 .procname = "tcp_max_reordering", 1021 .data = &init_net.ipv4.sysctl_tcp_max_reordering, 1022 .maxlen = sizeof(int), 1023 .mode = 0644, 1024 .proc_handler = proc_dointvec 1025 }, 1026 { 1027 .procname = "tcp_dsack", 1028 .data = &init_net.ipv4.sysctl_tcp_dsack, 1029 .maxlen = sizeof(int), 1030 .mode = 0644, 1031 .proc_handler = proc_dointvec 1032 }, 1033 { 1034 .procname = "tcp_app_win", 1035 .data = &init_net.ipv4.sysctl_tcp_app_win, 1036 .maxlen = sizeof(int), 1037 .mode = 0644, 1038 .proc_handler = proc_dointvec 1039 }, 1040 { 1041 .procname = "tcp_adv_win_scale", 1042 .data = &init_net.ipv4.sysctl_tcp_adv_win_scale, 1043 .maxlen = sizeof(int), 1044 .mode = 0644, 1045 .proc_handler = proc_dointvec_minmax, 1046 .extra1 = &tcp_adv_win_scale_min, 1047 .extra2 = &tcp_adv_win_scale_max, 1048 }, 1049 { 1050 .procname = "tcp_frto", 1051 .data = &init_net.ipv4.sysctl_tcp_frto, 1052 .maxlen = sizeof(int), 1053 .mode = 0644, 1054 .proc_handler = proc_dointvec 1055 }, 1056 { 1057 .procname = "tcp_no_metrics_save", 1058 .data = &init_net.ipv4.sysctl_tcp_nometrics_save, 1059 .maxlen = sizeof(int), 1060 .mode = 0644, 1061 .proc_handler = proc_dointvec, 1062 }, 1063 { 1064 .procname = "tcp_moderate_rcvbuf", 1065 .data = &init_net.ipv4.sysctl_tcp_moderate_rcvbuf, 1066 .maxlen = sizeof(int), 1067 .mode = 0644, 1068 .proc_handler = proc_dointvec, 1069 }, 1070 { 1071 .procname = "tcp_tso_win_divisor", 1072 .data = &init_net.ipv4.sysctl_tcp_tso_win_divisor, 1073 .maxlen = sizeof(int), 1074 .mode = 0644, 1075 .proc_handler = proc_dointvec, 1076 }, 1077 { 1078 .procname = "tcp_workaround_signed_windows", 1079 .data = &init_net.ipv4.sysctl_tcp_workaround_signed_windows, 1080 .maxlen = sizeof(int), 1081 .mode = 0644, 1082 .proc_handler = proc_dointvec 1083 }, 1084 { 1085 .procname = "tcp_limit_output_bytes", 1086 .data = &init_net.ipv4.sysctl_tcp_limit_output_bytes, 1087 .maxlen = sizeof(int), 1088 .mode = 0644, 1089 .proc_handler = proc_dointvec 1090 }, 1091 { 1092 .procname = "tcp_challenge_ack_limit", 1093 .data = &init_net.ipv4.sysctl_tcp_challenge_ack_limit, 1094 .maxlen = sizeof(int), 1095 .mode = 0644, 1096 .proc_handler = proc_dointvec 1097 }, 1098 { 1099 .procname = "tcp_min_tso_segs", 1100 .data = &init_net.ipv4.sysctl_tcp_min_tso_segs, 1101 .maxlen = sizeof(int), 1102 .mode = 0644, 1103 .proc_handler = proc_dointvec_minmax, 1104 .extra1 = &one, 1105 .extra2 = &gso_max_segs, 1106 }, 1107 { 1108 .procname = "tcp_min_rtt_wlen", 1109 .data = &init_net.ipv4.sysctl_tcp_min_rtt_wlen, 1110 .maxlen = sizeof(int), 1111 .mode = 0644, 1112 .proc_handler = proc_dointvec 1113 }, 1114 { 1115 .procname = "tcp_autocorking", 1116 .data = &init_net.ipv4.sysctl_tcp_autocorking, 1117 .maxlen = sizeof(int), 1118 .mode = 0644, 1119 .proc_handler = proc_dointvec_minmax, 1120 .extra1 = &zero, 1121 .extra2 = &one, 1122 }, 1123 { 1124 .procname = "tcp_invalid_ratelimit", 1125 .data = &init_net.ipv4.sysctl_tcp_invalid_ratelimit, 1126 .maxlen = sizeof(int), 1127 .mode = 0644, 1128 .proc_handler = proc_dointvec_ms_jiffies, 1129 }, 1130 { 1131 .procname = "tcp_pacing_ss_ratio", 1132 .data = &init_net.ipv4.sysctl_tcp_pacing_ss_ratio, 1133 .maxlen = sizeof(int), 1134 .mode = 0644, 1135 .proc_handler = proc_dointvec_minmax, 1136 .extra1 = &zero, 1137 .extra2 = &thousand, 1138 }, 1139 { 1140 .procname = "tcp_pacing_ca_ratio", 1141 .data = &init_net.ipv4.sysctl_tcp_pacing_ca_ratio, 1142 .maxlen = sizeof(int), 1143 .mode = 0644, 1144 .proc_handler = proc_dointvec_minmax, 1145 .extra1 = &zero, 1146 .extra2 = &thousand, 1147 }, 1148 { } 1149 }; 1150 1151 static __net_init int ipv4_sysctl_init_net(struct net *net) 1152 { 1153 struct ctl_table *table; 1154 1155 table = ipv4_net_table; 1156 if (!net_eq(net, &init_net)) { 1157 int i; 1158 1159 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 1160 if (!table) 1161 goto err_alloc; 1162 1163 /* Update the variables to point into the current struct net */ 1164 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 1165 table[i].data += (void *)net - (void *)&init_net; 1166 } 1167 1168 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 1169 if (!net->ipv4.ipv4_hdr) 1170 goto err_reg; 1171 1172 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 1173 if (!net->ipv4.sysctl_local_reserved_ports) 1174 goto err_ports; 1175 1176 return 0; 1177 1178 err_ports: 1179 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1180 err_reg: 1181 if (!net_eq(net, &init_net)) 1182 kfree(table); 1183 err_alloc: 1184 return -ENOMEM; 1185 } 1186 1187 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1188 { 1189 struct ctl_table *table; 1190 1191 kfree(net->ipv4.sysctl_local_reserved_ports); 1192 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1193 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1194 kfree(table); 1195 } 1196 1197 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1198 .init = ipv4_sysctl_init_net, 1199 .exit = ipv4_sysctl_exit_net, 1200 }; 1201 1202 static __init int sysctl_ipv4_init(void) 1203 { 1204 struct ctl_table_header *hdr; 1205 1206 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1207 if (!hdr) 1208 return -ENOMEM; 1209 1210 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1211 unregister_net_sysctl_table(hdr); 1212 return -ENOMEM; 1213 } 1214 1215 return 0; 1216 } 1217 1218 __initcall(sysctl_ipv4_init); 1219