1 /* 2 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem. 3 * 4 * Begun April 1, 1996, Mike Shaver. 5 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS] 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/module.h> 10 #include <linux/sysctl.h> 11 #include <linux/igmp.h> 12 #include <linux/inetdevice.h> 13 #include <linux/seqlock.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <linux/nsproxy.h> 17 #include <linux/swap.h> 18 #include <net/snmp.h> 19 #include <net/icmp.h> 20 #include <net/ip.h> 21 #include <net/route.h> 22 #include <net/tcp.h> 23 #include <net/udp.h> 24 #include <net/cipso_ipv4.h> 25 #include <net/inet_frag.h> 26 #include <net/ping.h> 27 28 static int zero; 29 static int one = 1; 30 static int four = 4; 31 static int thousand = 1000; 32 static int gso_max_segs = GSO_MAX_SEGS; 33 static int tcp_retr1_max = 255; 34 static int ip_local_port_range_min[] = { 1, 1 }; 35 static int ip_local_port_range_max[] = { 65535, 65535 }; 36 static int tcp_adv_win_scale_min = -31; 37 static int tcp_adv_win_scale_max = 31; 38 static int ip_ttl_min = 1; 39 static int ip_ttl_max = 255; 40 static int tcp_syn_retries_min = 1; 41 static int tcp_syn_retries_max = MAX_TCP_SYNCNT; 42 static int ip_ping_group_range_min[] = { 0, 0 }; 43 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; 44 45 /* Update system visible IP port range */ 46 static void set_local_port_range(struct net *net, int range[2]) 47 { 48 bool same_parity = !((range[0] ^ range[1]) & 1); 49 50 write_seqlock_bh(&net->ipv4.ip_local_ports.lock); 51 if (same_parity && !net->ipv4.ip_local_ports.warned) { 52 net->ipv4.ip_local_ports.warned = true; 53 pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); 54 } 55 net->ipv4.ip_local_ports.range[0] = range[0]; 56 net->ipv4.ip_local_ports.range[1] = range[1]; 57 write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); 58 } 59 60 /* Validate changes from /proc interface. */ 61 static int ipv4_local_port_range(struct ctl_table *table, int write, 62 void __user *buffer, 63 size_t *lenp, loff_t *ppos) 64 { 65 struct net *net = 66 container_of(table->data, struct net, ipv4.ip_local_ports.range); 67 int ret; 68 int range[2]; 69 struct ctl_table tmp = { 70 .data = &range, 71 .maxlen = sizeof(range), 72 .mode = table->mode, 73 .extra1 = &ip_local_port_range_min, 74 .extra2 = &ip_local_port_range_max, 75 }; 76 77 inet_get_local_port_range(net, &range[0], &range[1]); 78 79 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 80 81 if (write && ret == 0) { 82 if (range[1] < range[0]) 83 ret = -EINVAL; 84 else 85 set_local_port_range(net, range); 86 } 87 88 return ret; 89 } 90 91 92 static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high) 93 { 94 kgid_t *data = table->data; 95 struct net *net = 96 container_of(table->data, struct net, ipv4.ping_group_range.range); 97 unsigned int seq; 98 do { 99 seq = read_seqbegin(&net->ipv4.ping_group_range.lock); 100 101 *low = data[0]; 102 *high = data[1]; 103 } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); 104 } 105 106 /* Update system visible IP port range */ 107 static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high) 108 { 109 kgid_t *data = table->data; 110 struct net *net = 111 container_of(table->data, struct net, ipv4.ping_group_range.range); 112 write_seqlock(&net->ipv4.ping_group_range.lock); 113 data[0] = low; 114 data[1] = high; 115 write_sequnlock(&net->ipv4.ping_group_range.lock); 116 } 117 118 /* Validate changes from /proc interface. */ 119 static int ipv4_ping_group_range(struct ctl_table *table, int write, 120 void __user *buffer, 121 size_t *lenp, loff_t *ppos) 122 { 123 struct user_namespace *user_ns = current_user_ns(); 124 int ret; 125 gid_t urange[2]; 126 kgid_t low, high; 127 struct ctl_table tmp = { 128 .data = &urange, 129 .maxlen = sizeof(urange), 130 .mode = table->mode, 131 .extra1 = &ip_ping_group_range_min, 132 .extra2 = &ip_ping_group_range_max, 133 }; 134 135 inet_get_ping_group_range_table(table, &low, &high); 136 urange[0] = from_kgid_munged(user_ns, low); 137 urange[1] = from_kgid_munged(user_ns, high); 138 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 139 140 if (write && ret == 0) { 141 low = make_kgid(user_ns, urange[0]); 142 high = make_kgid(user_ns, urange[1]); 143 if (!gid_valid(low) || !gid_valid(high) || 144 (urange[1] < urange[0]) || gid_lt(high, low)) { 145 low = make_kgid(&init_user_ns, 1); 146 high = make_kgid(&init_user_ns, 0); 147 } 148 set_ping_group_range(table, low, high); 149 } 150 151 return ret; 152 } 153 154 static int proc_tcp_congestion_control(struct ctl_table *ctl, int write, 155 void __user *buffer, size_t *lenp, loff_t *ppos) 156 { 157 char val[TCP_CA_NAME_MAX]; 158 struct ctl_table tbl = { 159 .data = val, 160 .maxlen = TCP_CA_NAME_MAX, 161 }; 162 int ret; 163 164 tcp_get_default_congestion_control(val); 165 166 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 167 if (write && ret == 0) 168 ret = tcp_set_default_congestion_control(val); 169 return ret; 170 } 171 172 static int proc_tcp_available_congestion_control(struct ctl_table *ctl, 173 int write, 174 void __user *buffer, size_t *lenp, 175 loff_t *ppos) 176 { 177 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, }; 178 int ret; 179 180 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 181 if (!tbl.data) 182 return -ENOMEM; 183 tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX); 184 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 185 kfree(tbl.data); 186 return ret; 187 } 188 189 static int proc_allowed_congestion_control(struct ctl_table *ctl, 190 int write, 191 void __user *buffer, size_t *lenp, 192 loff_t *ppos) 193 { 194 struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX }; 195 int ret; 196 197 tbl.data = kmalloc(tbl.maxlen, GFP_USER); 198 if (!tbl.data) 199 return -ENOMEM; 200 201 tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen); 202 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 203 if (write && ret == 0) 204 ret = tcp_set_allowed_congestion_control(tbl.data); 205 kfree(tbl.data); 206 return ret; 207 } 208 209 static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, 210 void __user *buffer, size_t *lenp, 211 loff_t *ppos) 212 { 213 struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; 214 struct tcp_fastopen_context *ctxt; 215 int ret; 216 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ 217 218 tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); 219 if (!tbl.data) 220 return -ENOMEM; 221 222 rcu_read_lock(); 223 ctxt = rcu_dereference(tcp_fastopen_ctx); 224 if (ctxt) 225 memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); 226 else 227 memset(user_key, 0, sizeof(user_key)); 228 rcu_read_unlock(); 229 230 snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", 231 user_key[0], user_key[1], user_key[2], user_key[3]); 232 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 233 234 if (write && ret == 0) { 235 if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1, 236 user_key + 2, user_key + 3) != 4) { 237 ret = -EINVAL; 238 goto bad_key; 239 } 240 /* Generate a dummy secret but don't publish it. This 241 * is needed so we don't regenerate a new key on the 242 * first invocation of tcp_fastopen_cookie_gen 243 */ 244 tcp_fastopen_init_key_once(false); 245 tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); 246 } 247 248 bad_key: 249 pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", 250 user_key[0], user_key[1], user_key[2], user_key[3], 251 (char *)tbl.data, ret); 252 kfree(tbl.data); 253 return ret; 254 } 255 256 static struct ctl_table ipv4_table[] = { 257 { 258 .procname = "tcp_timestamps", 259 .data = &sysctl_tcp_timestamps, 260 .maxlen = sizeof(int), 261 .mode = 0644, 262 .proc_handler = proc_dointvec 263 }, 264 { 265 .procname = "tcp_window_scaling", 266 .data = &sysctl_tcp_window_scaling, 267 .maxlen = sizeof(int), 268 .mode = 0644, 269 .proc_handler = proc_dointvec 270 }, 271 { 272 .procname = "tcp_sack", 273 .data = &sysctl_tcp_sack, 274 .maxlen = sizeof(int), 275 .mode = 0644, 276 .proc_handler = proc_dointvec 277 }, 278 { 279 .procname = "tcp_retrans_collapse", 280 .data = &sysctl_tcp_retrans_collapse, 281 .maxlen = sizeof(int), 282 .mode = 0644, 283 .proc_handler = proc_dointvec 284 }, 285 { 286 .procname = "tcp_max_orphans", 287 .data = &sysctl_tcp_max_orphans, 288 .maxlen = sizeof(int), 289 .mode = 0644, 290 .proc_handler = proc_dointvec 291 }, 292 { 293 .procname = "tcp_max_tw_buckets", 294 .data = &tcp_death_row.sysctl_max_tw_buckets, 295 .maxlen = sizeof(int), 296 .mode = 0644, 297 .proc_handler = proc_dointvec 298 }, 299 { 300 .procname = "tcp_fastopen", 301 .data = &sysctl_tcp_fastopen, 302 .maxlen = sizeof(int), 303 .mode = 0644, 304 .proc_handler = proc_dointvec, 305 }, 306 { 307 .procname = "tcp_fastopen_key", 308 .mode = 0600, 309 .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10), 310 .proc_handler = proc_tcp_fastopen_key, 311 }, 312 { 313 .procname = "tcp_tw_recycle", 314 .data = &tcp_death_row.sysctl_tw_recycle, 315 .maxlen = sizeof(int), 316 .mode = 0644, 317 .proc_handler = proc_dointvec 318 }, 319 { 320 .procname = "tcp_abort_on_overflow", 321 .data = &sysctl_tcp_abort_on_overflow, 322 .maxlen = sizeof(int), 323 .mode = 0644, 324 .proc_handler = proc_dointvec 325 }, 326 { 327 .procname = "tcp_stdurg", 328 .data = &sysctl_tcp_stdurg, 329 .maxlen = sizeof(int), 330 .mode = 0644, 331 .proc_handler = proc_dointvec 332 }, 333 { 334 .procname = "tcp_rfc1337", 335 .data = &sysctl_tcp_rfc1337, 336 .maxlen = sizeof(int), 337 .mode = 0644, 338 .proc_handler = proc_dointvec 339 }, 340 { 341 .procname = "tcp_max_syn_backlog", 342 .data = &sysctl_max_syn_backlog, 343 .maxlen = sizeof(int), 344 .mode = 0644, 345 .proc_handler = proc_dointvec 346 }, 347 { 348 .procname = "inet_peer_threshold", 349 .data = &inet_peer_threshold, 350 .maxlen = sizeof(int), 351 .mode = 0644, 352 .proc_handler = proc_dointvec 353 }, 354 { 355 .procname = "inet_peer_minttl", 356 .data = &inet_peer_minttl, 357 .maxlen = sizeof(int), 358 .mode = 0644, 359 .proc_handler = proc_dointvec_jiffies, 360 }, 361 { 362 .procname = "inet_peer_maxttl", 363 .data = &inet_peer_maxttl, 364 .maxlen = sizeof(int), 365 .mode = 0644, 366 .proc_handler = proc_dointvec_jiffies, 367 }, 368 { 369 .procname = "tcp_fack", 370 .data = &sysctl_tcp_fack, 371 .maxlen = sizeof(int), 372 .mode = 0644, 373 .proc_handler = proc_dointvec 374 }, 375 { 376 .procname = "tcp_recovery", 377 .data = &sysctl_tcp_recovery, 378 .maxlen = sizeof(int), 379 .mode = 0644, 380 .proc_handler = proc_dointvec, 381 }, 382 { 383 .procname = "tcp_max_reordering", 384 .data = &sysctl_tcp_max_reordering, 385 .maxlen = sizeof(int), 386 .mode = 0644, 387 .proc_handler = proc_dointvec 388 }, 389 { 390 .procname = "tcp_dsack", 391 .data = &sysctl_tcp_dsack, 392 .maxlen = sizeof(int), 393 .mode = 0644, 394 .proc_handler = proc_dointvec 395 }, 396 { 397 .procname = "tcp_mem", 398 .maxlen = sizeof(sysctl_tcp_mem), 399 .data = &sysctl_tcp_mem, 400 .mode = 0644, 401 .proc_handler = proc_doulongvec_minmax, 402 }, 403 { 404 .procname = "tcp_wmem", 405 .data = &sysctl_tcp_wmem, 406 .maxlen = sizeof(sysctl_tcp_wmem), 407 .mode = 0644, 408 .proc_handler = proc_dointvec_minmax, 409 .extra1 = &one, 410 }, 411 { 412 .procname = "tcp_rmem", 413 .data = &sysctl_tcp_rmem, 414 .maxlen = sizeof(sysctl_tcp_rmem), 415 .mode = 0644, 416 .proc_handler = proc_dointvec_minmax, 417 .extra1 = &one, 418 }, 419 { 420 .procname = "tcp_app_win", 421 .data = &sysctl_tcp_app_win, 422 .maxlen = sizeof(int), 423 .mode = 0644, 424 .proc_handler = proc_dointvec 425 }, 426 { 427 .procname = "tcp_adv_win_scale", 428 .data = &sysctl_tcp_adv_win_scale, 429 .maxlen = sizeof(int), 430 .mode = 0644, 431 .proc_handler = proc_dointvec_minmax, 432 .extra1 = &tcp_adv_win_scale_min, 433 .extra2 = &tcp_adv_win_scale_max, 434 }, 435 { 436 .procname = "tcp_frto", 437 .data = &sysctl_tcp_frto, 438 .maxlen = sizeof(int), 439 .mode = 0644, 440 .proc_handler = proc_dointvec 441 }, 442 { 443 .procname = "tcp_min_rtt_wlen", 444 .data = &sysctl_tcp_min_rtt_wlen, 445 .maxlen = sizeof(int), 446 .mode = 0644, 447 .proc_handler = proc_dointvec 448 }, 449 { 450 .procname = "tcp_low_latency", 451 .data = &sysctl_tcp_low_latency, 452 .maxlen = sizeof(int), 453 .mode = 0644, 454 .proc_handler = proc_dointvec 455 }, 456 { 457 .procname = "tcp_no_metrics_save", 458 .data = &sysctl_tcp_nometrics_save, 459 .maxlen = sizeof(int), 460 .mode = 0644, 461 .proc_handler = proc_dointvec, 462 }, 463 { 464 .procname = "tcp_moderate_rcvbuf", 465 .data = &sysctl_tcp_moderate_rcvbuf, 466 .maxlen = sizeof(int), 467 .mode = 0644, 468 .proc_handler = proc_dointvec, 469 }, 470 { 471 .procname = "tcp_tso_win_divisor", 472 .data = &sysctl_tcp_tso_win_divisor, 473 .maxlen = sizeof(int), 474 .mode = 0644, 475 .proc_handler = proc_dointvec, 476 }, 477 { 478 .procname = "tcp_congestion_control", 479 .mode = 0644, 480 .maxlen = TCP_CA_NAME_MAX, 481 .proc_handler = proc_tcp_congestion_control, 482 }, 483 { 484 .procname = "tcp_workaround_signed_windows", 485 .data = &sysctl_tcp_workaround_signed_windows, 486 .maxlen = sizeof(int), 487 .mode = 0644, 488 .proc_handler = proc_dointvec 489 }, 490 { 491 .procname = "tcp_limit_output_bytes", 492 .data = &sysctl_tcp_limit_output_bytes, 493 .maxlen = sizeof(int), 494 .mode = 0644, 495 .proc_handler = proc_dointvec 496 }, 497 { 498 .procname = "tcp_challenge_ack_limit", 499 .data = &sysctl_tcp_challenge_ack_limit, 500 .maxlen = sizeof(int), 501 .mode = 0644, 502 .proc_handler = proc_dointvec 503 }, 504 { 505 .procname = "tcp_slow_start_after_idle", 506 .data = &sysctl_tcp_slow_start_after_idle, 507 .maxlen = sizeof(int), 508 .mode = 0644, 509 .proc_handler = proc_dointvec 510 }, 511 #ifdef CONFIG_NETLABEL 512 { 513 .procname = "cipso_cache_enable", 514 .data = &cipso_v4_cache_enabled, 515 .maxlen = sizeof(int), 516 .mode = 0644, 517 .proc_handler = proc_dointvec, 518 }, 519 { 520 .procname = "cipso_cache_bucket_size", 521 .data = &cipso_v4_cache_bucketsize, 522 .maxlen = sizeof(int), 523 .mode = 0644, 524 .proc_handler = proc_dointvec, 525 }, 526 { 527 .procname = "cipso_rbm_optfmt", 528 .data = &cipso_v4_rbm_optfmt, 529 .maxlen = sizeof(int), 530 .mode = 0644, 531 .proc_handler = proc_dointvec, 532 }, 533 { 534 .procname = "cipso_rbm_strictvalid", 535 .data = &cipso_v4_rbm_strictvalid, 536 .maxlen = sizeof(int), 537 .mode = 0644, 538 .proc_handler = proc_dointvec, 539 }, 540 #endif /* CONFIG_NETLABEL */ 541 { 542 .procname = "tcp_available_congestion_control", 543 .maxlen = TCP_CA_BUF_MAX, 544 .mode = 0444, 545 .proc_handler = proc_tcp_available_congestion_control, 546 }, 547 { 548 .procname = "tcp_allowed_congestion_control", 549 .maxlen = TCP_CA_BUF_MAX, 550 .mode = 0644, 551 .proc_handler = proc_allowed_congestion_control, 552 }, 553 { 554 .procname = "tcp_thin_linear_timeouts", 555 .data = &sysctl_tcp_thin_linear_timeouts, 556 .maxlen = sizeof(int), 557 .mode = 0644, 558 .proc_handler = proc_dointvec 559 }, 560 { 561 .procname = "tcp_thin_dupack", 562 .data = &sysctl_tcp_thin_dupack, 563 .maxlen = sizeof(int), 564 .mode = 0644, 565 .proc_handler = proc_dointvec 566 }, 567 { 568 .procname = "tcp_early_retrans", 569 .data = &sysctl_tcp_early_retrans, 570 .maxlen = sizeof(int), 571 .mode = 0644, 572 .proc_handler = proc_dointvec_minmax, 573 .extra1 = &zero, 574 .extra2 = &four, 575 }, 576 { 577 .procname = "tcp_min_tso_segs", 578 .data = &sysctl_tcp_min_tso_segs, 579 .maxlen = sizeof(int), 580 .mode = 0644, 581 .proc_handler = proc_dointvec_minmax, 582 .extra1 = &one, 583 .extra2 = &gso_max_segs, 584 }, 585 { 586 .procname = "tcp_pacing_ss_ratio", 587 .data = &sysctl_tcp_pacing_ss_ratio, 588 .maxlen = sizeof(int), 589 .mode = 0644, 590 .proc_handler = proc_dointvec_minmax, 591 .extra1 = &zero, 592 .extra2 = &thousand, 593 }, 594 { 595 .procname = "tcp_pacing_ca_ratio", 596 .data = &sysctl_tcp_pacing_ca_ratio, 597 .maxlen = sizeof(int), 598 .mode = 0644, 599 .proc_handler = proc_dointvec_minmax, 600 .extra1 = &zero, 601 .extra2 = &thousand, 602 }, 603 { 604 .procname = "tcp_autocorking", 605 .data = &sysctl_tcp_autocorking, 606 .maxlen = sizeof(int), 607 .mode = 0644, 608 .proc_handler = proc_dointvec_minmax, 609 .extra1 = &zero, 610 .extra2 = &one, 611 }, 612 { 613 .procname = "tcp_invalid_ratelimit", 614 .data = &sysctl_tcp_invalid_ratelimit, 615 .maxlen = sizeof(int), 616 .mode = 0644, 617 .proc_handler = proc_dointvec_ms_jiffies, 618 }, 619 { 620 .procname = "icmp_msgs_per_sec", 621 .data = &sysctl_icmp_msgs_per_sec, 622 .maxlen = sizeof(int), 623 .mode = 0644, 624 .proc_handler = proc_dointvec_minmax, 625 .extra1 = &zero, 626 }, 627 { 628 .procname = "icmp_msgs_burst", 629 .data = &sysctl_icmp_msgs_burst, 630 .maxlen = sizeof(int), 631 .mode = 0644, 632 .proc_handler = proc_dointvec_minmax, 633 .extra1 = &zero, 634 }, 635 { 636 .procname = "udp_mem", 637 .data = &sysctl_udp_mem, 638 .maxlen = sizeof(sysctl_udp_mem), 639 .mode = 0644, 640 .proc_handler = proc_doulongvec_minmax, 641 }, 642 { 643 .procname = "udp_rmem_min", 644 .data = &sysctl_udp_rmem_min, 645 .maxlen = sizeof(sysctl_udp_rmem_min), 646 .mode = 0644, 647 .proc_handler = proc_dointvec_minmax, 648 .extra1 = &one 649 }, 650 { 651 .procname = "udp_wmem_min", 652 .data = &sysctl_udp_wmem_min, 653 .maxlen = sizeof(sysctl_udp_wmem_min), 654 .mode = 0644, 655 .proc_handler = proc_dointvec_minmax, 656 .extra1 = &one 657 }, 658 { } 659 }; 660 661 static struct ctl_table ipv4_net_table[] = { 662 { 663 .procname = "icmp_echo_ignore_all", 664 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all, 665 .maxlen = sizeof(int), 666 .mode = 0644, 667 .proc_handler = proc_dointvec 668 }, 669 { 670 .procname = "icmp_echo_ignore_broadcasts", 671 .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts, 672 .maxlen = sizeof(int), 673 .mode = 0644, 674 .proc_handler = proc_dointvec 675 }, 676 { 677 .procname = "icmp_ignore_bogus_error_responses", 678 .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses, 679 .maxlen = sizeof(int), 680 .mode = 0644, 681 .proc_handler = proc_dointvec 682 }, 683 { 684 .procname = "icmp_errors_use_inbound_ifaddr", 685 .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr, 686 .maxlen = sizeof(int), 687 .mode = 0644, 688 .proc_handler = proc_dointvec 689 }, 690 { 691 .procname = "icmp_ratelimit", 692 .data = &init_net.ipv4.sysctl_icmp_ratelimit, 693 .maxlen = sizeof(int), 694 .mode = 0644, 695 .proc_handler = proc_dointvec_ms_jiffies, 696 }, 697 { 698 .procname = "icmp_ratemask", 699 .data = &init_net.ipv4.sysctl_icmp_ratemask, 700 .maxlen = sizeof(int), 701 .mode = 0644, 702 .proc_handler = proc_dointvec 703 }, 704 { 705 .procname = "ping_group_range", 706 .data = &init_net.ipv4.ping_group_range.range, 707 .maxlen = sizeof(gid_t)*2, 708 .mode = 0644, 709 .proc_handler = ipv4_ping_group_range, 710 }, 711 { 712 .procname = "tcp_ecn", 713 .data = &init_net.ipv4.sysctl_tcp_ecn, 714 .maxlen = sizeof(int), 715 .mode = 0644, 716 .proc_handler = proc_dointvec 717 }, 718 { 719 .procname = "tcp_ecn_fallback", 720 .data = &init_net.ipv4.sysctl_tcp_ecn_fallback, 721 .maxlen = sizeof(int), 722 .mode = 0644, 723 .proc_handler = proc_dointvec 724 }, 725 { 726 .procname = "ip_dynaddr", 727 .data = &init_net.ipv4.sysctl_ip_dynaddr, 728 .maxlen = sizeof(int), 729 .mode = 0644, 730 .proc_handler = proc_dointvec 731 }, 732 { 733 .procname = "ip_early_demux", 734 .data = &init_net.ipv4.sysctl_ip_early_demux, 735 .maxlen = sizeof(int), 736 .mode = 0644, 737 .proc_handler = proc_dointvec 738 }, 739 { 740 .procname = "ip_default_ttl", 741 .data = &init_net.ipv4.sysctl_ip_default_ttl, 742 .maxlen = sizeof(int), 743 .mode = 0644, 744 .proc_handler = proc_dointvec_minmax, 745 .extra1 = &ip_ttl_min, 746 .extra2 = &ip_ttl_max, 747 }, 748 { 749 .procname = "ip_local_port_range", 750 .maxlen = sizeof(init_net.ipv4.ip_local_ports.range), 751 .data = &init_net.ipv4.ip_local_ports.range, 752 .mode = 0644, 753 .proc_handler = ipv4_local_port_range, 754 }, 755 { 756 .procname = "ip_local_reserved_ports", 757 .data = &init_net.ipv4.sysctl_local_reserved_ports, 758 .maxlen = 65536, 759 .mode = 0644, 760 .proc_handler = proc_do_large_bitmap, 761 }, 762 { 763 .procname = "ip_no_pmtu_disc", 764 .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc, 765 .maxlen = sizeof(int), 766 .mode = 0644, 767 .proc_handler = proc_dointvec 768 }, 769 { 770 .procname = "ip_forward_use_pmtu", 771 .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu, 772 .maxlen = sizeof(int), 773 .mode = 0644, 774 .proc_handler = proc_dointvec, 775 }, 776 { 777 .procname = "ip_nonlocal_bind", 778 .data = &init_net.ipv4.sysctl_ip_nonlocal_bind, 779 .maxlen = sizeof(int), 780 .mode = 0644, 781 .proc_handler = proc_dointvec 782 }, 783 { 784 .procname = "fwmark_reflect", 785 .data = &init_net.ipv4.sysctl_fwmark_reflect, 786 .maxlen = sizeof(int), 787 .mode = 0644, 788 .proc_handler = proc_dointvec, 789 }, 790 { 791 .procname = "tcp_fwmark_accept", 792 .data = &init_net.ipv4.sysctl_tcp_fwmark_accept, 793 .maxlen = sizeof(int), 794 .mode = 0644, 795 .proc_handler = proc_dointvec, 796 }, 797 #ifdef CONFIG_NET_L3_MASTER_DEV 798 { 799 .procname = "tcp_l3mdev_accept", 800 .data = &init_net.ipv4.sysctl_tcp_l3mdev_accept, 801 .maxlen = sizeof(int), 802 .mode = 0644, 803 .proc_handler = proc_dointvec_minmax, 804 .extra1 = &zero, 805 .extra2 = &one, 806 }, 807 #endif 808 { 809 .procname = "tcp_mtu_probing", 810 .data = &init_net.ipv4.sysctl_tcp_mtu_probing, 811 .maxlen = sizeof(int), 812 .mode = 0644, 813 .proc_handler = proc_dointvec, 814 }, 815 { 816 .procname = "tcp_base_mss", 817 .data = &init_net.ipv4.sysctl_tcp_base_mss, 818 .maxlen = sizeof(int), 819 .mode = 0644, 820 .proc_handler = proc_dointvec, 821 }, 822 { 823 .procname = "tcp_probe_threshold", 824 .data = &init_net.ipv4.sysctl_tcp_probe_threshold, 825 .maxlen = sizeof(int), 826 .mode = 0644, 827 .proc_handler = proc_dointvec, 828 }, 829 { 830 .procname = "tcp_probe_interval", 831 .data = &init_net.ipv4.sysctl_tcp_probe_interval, 832 .maxlen = sizeof(int), 833 .mode = 0644, 834 .proc_handler = proc_dointvec, 835 }, 836 { 837 .procname = "igmp_link_local_mcast_reports", 838 .data = &init_net.ipv4.sysctl_igmp_llm_reports, 839 .maxlen = sizeof(int), 840 .mode = 0644, 841 .proc_handler = proc_dointvec 842 }, 843 { 844 .procname = "igmp_max_memberships", 845 .data = &init_net.ipv4.sysctl_igmp_max_memberships, 846 .maxlen = sizeof(int), 847 .mode = 0644, 848 .proc_handler = proc_dointvec 849 }, 850 { 851 .procname = "igmp_max_msf", 852 .data = &init_net.ipv4.sysctl_igmp_max_msf, 853 .maxlen = sizeof(int), 854 .mode = 0644, 855 .proc_handler = proc_dointvec 856 }, 857 #ifdef CONFIG_IP_MULTICAST 858 { 859 .procname = "igmp_qrv", 860 .data = &init_net.ipv4.sysctl_igmp_qrv, 861 .maxlen = sizeof(int), 862 .mode = 0644, 863 .proc_handler = proc_dointvec_minmax, 864 .extra1 = &one 865 }, 866 #endif 867 { 868 .procname = "tcp_keepalive_time", 869 .data = &init_net.ipv4.sysctl_tcp_keepalive_time, 870 .maxlen = sizeof(int), 871 .mode = 0644, 872 .proc_handler = proc_dointvec_jiffies, 873 }, 874 { 875 .procname = "tcp_keepalive_probes", 876 .data = &init_net.ipv4.sysctl_tcp_keepalive_probes, 877 .maxlen = sizeof(int), 878 .mode = 0644, 879 .proc_handler = proc_dointvec 880 }, 881 { 882 .procname = "tcp_keepalive_intvl", 883 .data = &init_net.ipv4.sysctl_tcp_keepalive_intvl, 884 .maxlen = sizeof(int), 885 .mode = 0644, 886 .proc_handler = proc_dointvec_jiffies, 887 }, 888 { 889 .procname = "tcp_syn_retries", 890 .data = &init_net.ipv4.sysctl_tcp_syn_retries, 891 .maxlen = sizeof(int), 892 .mode = 0644, 893 .proc_handler = proc_dointvec_minmax, 894 .extra1 = &tcp_syn_retries_min, 895 .extra2 = &tcp_syn_retries_max 896 }, 897 { 898 .procname = "tcp_synack_retries", 899 .data = &init_net.ipv4.sysctl_tcp_synack_retries, 900 .maxlen = sizeof(int), 901 .mode = 0644, 902 .proc_handler = proc_dointvec 903 }, 904 #ifdef CONFIG_SYN_COOKIES 905 { 906 .procname = "tcp_syncookies", 907 .data = &init_net.ipv4.sysctl_tcp_syncookies, 908 .maxlen = sizeof(int), 909 .mode = 0644, 910 .proc_handler = proc_dointvec 911 }, 912 #endif 913 { 914 .procname = "tcp_reordering", 915 .data = &init_net.ipv4.sysctl_tcp_reordering, 916 .maxlen = sizeof(int), 917 .mode = 0644, 918 .proc_handler = proc_dointvec 919 }, 920 { 921 .procname = "tcp_retries1", 922 .data = &init_net.ipv4.sysctl_tcp_retries1, 923 .maxlen = sizeof(int), 924 .mode = 0644, 925 .proc_handler = proc_dointvec_minmax, 926 .extra2 = &tcp_retr1_max 927 }, 928 { 929 .procname = "tcp_retries2", 930 .data = &init_net.ipv4.sysctl_tcp_retries2, 931 .maxlen = sizeof(int), 932 .mode = 0644, 933 .proc_handler = proc_dointvec 934 }, 935 { 936 .procname = "tcp_orphan_retries", 937 .data = &init_net.ipv4.sysctl_tcp_orphan_retries, 938 .maxlen = sizeof(int), 939 .mode = 0644, 940 .proc_handler = proc_dointvec 941 }, 942 { 943 .procname = "tcp_fin_timeout", 944 .data = &init_net.ipv4.sysctl_tcp_fin_timeout, 945 .maxlen = sizeof(int), 946 .mode = 0644, 947 .proc_handler = proc_dointvec_jiffies, 948 }, 949 { 950 .procname = "tcp_notsent_lowat", 951 .data = &init_net.ipv4.sysctl_tcp_notsent_lowat, 952 .maxlen = sizeof(unsigned int), 953 .mode = 0644, 954 .proc_handler = proc_dointvec, 955 }, 956 { 957 .procname = "tcp_tw_reuse", 958 .data = &init_net.ipv4.sysctl_tcp_tw_reuse, 959 .maxlen = sizeof(int), 960 .mode = 0644, 961 .proc_handler = proc_dointvec 962 }, 963 #ifdef CONFIG_IP_ROUTE_MULTIPATH 964 { 965 .procname = "fib_multipath_use_neigh", 966 .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh, 967 .maxlen = sizeof(int), 968 .mode = 0644, 969 .proc_handler = proc_dointvec_minmax, 970 .extra1 = &zero, 971 .extra2 = &one, 972 }, 973 #endif 974 { } 975 }; 976 977 static __net_init int ipv4_sysctl_init_net(struct net *net) 978 { 979 struct ctl_table *table; 980 981 table = ipv4_net_table; 982 if (!net_eq(net, &init_net)) { 983 int i; 984 985 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL); 986 if (!table) 987 goto err_alloc; 988 989 /* Update the variables to point into the current struct net */ 990 for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) 991 table[i].data += (void *)net - (void *)&init_net; 992 } 993 994 net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table); 995 if (!net->ipv4.ipv4_hdr) 996 goto err_reg; 997 998 net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL); 999 if (!net->ipv4.sysctl_local_reserved_ports) 1000 goto err_ports; 1001 1002 return 0; 1003 1004 err_ports: 1005 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1006 err_reg: 1007 if (!net_eq(net, &init_net)) 1008 kfree(table); 1009 err_alloc: 1010 return -ENOMEM; 1011 } 1012 1013 static __net_exit void ipv4_sysctl_exit_net(struct net *net) 1014 { 1015 struct ctl_table *table; 1016 1017 kfree(net->ipv4.sysctl_local_reserved_ports); 1018 table = net->ipv4.ipv4_hdr->ctl_table_arg; 1019 unregister_net_sysctl_table(net->ipv4.ipv4_hdr); 1020 kfree(table); 1021 } 1022 1023 static __net_initdata struct pernet_operations ipv4_sysctl_ops = { 1024 .init = ipv4_sysctl_init_net, 1025 .exit = ipv4_sysctl_exit_net, 1026 }; 1027 1028 static __init int sysctl_ipv4_init(void) 1029 { 1030 struct ctl_table_header *hdr; 1031 1032 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 1033 if (!hdr) 1034 return -ENOMEM; 1035 1036 if (register_pernet_subsys(&ipv4_sysctl_ops)) { 1037 unregister_net_sysctl_table(hdr); 1038 return -ENOMEM; 1039 } 1040 1041 return 0; 1042 } 1043 1044 __initcall(sysctl_ipv4_init); 1045