sysctl_net_ipv4.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975
  1. /*
  2. * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem.
  3. *
  4. * Begun April 1, 1996, Mike Shaver.
  5. * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS]
  6. */
  7. #include <linux/mm.h>
  8. #include <linux/module.h>
  9. #include <linux/sysctl.h>
  10. #include <linux/igmp.h>
  11. #include <linux/inetdevice.h>
  12. #include <linux/seqlock.h>
  13. #include <linux/init.h>
  14. #include <linux/slab.h>
  15. #include <linux/nsproxy.h>
  16. #include <linux/swap.h>
  17. #include <net/snmp.h>
  18. #include <net/icmp.h>
  19. #include <net/ip.h>
  20. #include <net/route.h>
  21. #include <net/tcp.h>
  22. #include <net/udp.h>
  23. #include <net/cipso_ipv4.h>
  24. #include <net/inet_frag.h>
  25. #include <net/ping.h>
  26. #include <net/tcp_memcontrol.h>
  27. static int zero;
  28. static int one = 1;
  29. static int four = 4;
  30. static int gso_max_segs = GSO_MAX_SEGS;
  31. static int tcp_retr1_max = 255;
  32. static int ip_local_port_range_min[] = { 1, 1 };
  33. static int ip_local_port_range_max[] = { 65535, 65535 };
  34. static int tcp_adv_win_scale_min = -31;
  35. static int tcp_adv_win_scale_max = 31;
  36. static int ip_ttl_min = 1;
  37. static int ip_ttl_max = 255;
  38. static int tcp_syn_retries_min = 1;
  39. static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
  40. static int ip_ping_group_range_min[] = { 0, 0 };
  41. static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
  42. /* Update system visible IP port range */
  43. static void set_local_port_range(struct net *net, int range[2])
  44. {
  45. write_seqlock(&net->ipv4.sysctl_local_ports.lock);
  46. net->ipv4.sysctl_local_ports.range[0] = range[0];
  47. net->ipv4.sysctl_local_ports.range[1] = range[1];
  48. write_sequnlock(&net->ipv4.sysctl_local_ports.lock);
  49. }
  50. /* Validate changes from /proc interface. */
  51. static int ipv4_local_port_range(struct ctl_table *table, int write,
  52. void __user *buffer,
  53. size_t *lenp, loff_t *ppos)
  54. {
  55. struct net *net =
  56. container_of(table->data, struct net, ipv4.sysctl_local_ports.range);
  57. int ret;
  58. int range[2];
  59. struct ctl_table tmp = {
  60. .data = &range,
  61. .maxlen = sizeof(range),
  62. .mode = table->mode,
  63. .extra1 = &ip_local_port_range_min,
  64. .extra2 = &ip_local_port_range_max,
  65. };
  66. inet_get_local_port_range(net, &range[0], &range[1]);
  67. ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
  68. if (write && ret == 0) {
  69. if (range[1] < range[0])
  70. ret = -EINVAL;
  71. else
  72. set_local_port_range(net, range);
  73. }
  74. return ret;
  75. }
  76. static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high)
  77. {
  78. kgid_t *data = table->data;
  79. struct net *net =
  80. container_of(table->data, struct net, ipv4.sysctl_ping_group_range);
  81. unsigned int seq;
  82. do {
  83. seq = read_seqbegin(&net->ipv4.sysctl_local_ports.lock);
  84. *low = data[0];
  85. *high = data[1];
  86. } while (read_seqretry(&net->ipv4.sysctl_local_ports.lock, seq));
  87. }
  88. /* Update system visible IP port range */
  89. static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high)
  90. {
  91. kgid_t *data = table->data;
  92. struct net *net =
  93. container_of(table->data, struct net, ipv4.sysctl_ping_group_range);
  94. write_seqlock(&net->ipv4.sysctl_local_ports.lock);
  95. data[0] = low;
  96. data[1] = high;
  97. write_sequnlock(&net->ipv4.sysctl_local_ports.lock);
  98. }
  99. /* Validate changes from /proc interface. */
  100. static int ipv4_ping_group_range(struct ctl_table *table, int write,
  101. void __user *buffer,
  102. size_t *lenp, loff_t *ppos)
  103. {
  104. struct user_namespace *user_ns = current_user_ns();
  105. int ret;
  106. gid_t urange[2];
  107. kgid_t low, high;
  108. struct ctl_table tmp = {
  109. .data = &urange,
  110. .maxlen = sizeof(urange),
  111. .mode = table->mode,
  112. .extra1 = &ip_ping_group_range_min,
  113. .extra2 = &ip_ping_group_range_max,
  114. };
  115. inet_get_ping_group_range_table(table, &low, &high);
  116. urange[0] = from_kgid_munged(user_ns, low);
  117. urange[1] = from_kgid_munged(user_ns, high);
  118. ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
  119. if (write && ret == 0) {
  120. low = make_kgid(user_ns, urange[0]);
  121. high = make_kgid(user_ns, urange[1]);
  122. if (!gid_valid(low) || !gid_valid(high) ||
  123. (urange[1] < urange[0]) || gid_lt(high, low)) {
  124. low = make_kgid(&init_user_ns, 1);
  125. high = make_kgid(&init_user_ns, 0);
  126. }
  127. set_ping_group_range(table, low, high);
  128. }
  129. return ret;
  130. }
  131. static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
  132. void __user *buffer, size_t *lenp, loff_t *ppos)
  133. {
  134. char val[TCP_CA_NAME_MAX];
  135. struct ctl_table tbl = {
  136. .data = val,
  137. .maxlen = TCP_CA_NAME_MAX,
  138. };
  139. int ret;
  140. tcp_get_default_congestion_control(val);
  141. ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
  142. if (write && ret == 0)
  143. ret = tcp_set_default_congestion_control(val);
  144. return ret;
  145. }
  146. static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
  147. int write,
  148. void __user *buffer, size_t *lenp,
  149. loff_t *ppos)
  150. {
  151. struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
  152. int ret;
  153. tbl.data = kmalloc(tbl.maxlen, GFP_USER);
  154. if (!tbl.data)
  155. return -ENOMEM;
  156. tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
  157. ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
  158. kfree(tbl.data);
  159. return ret;
  160. }
  161. static int proc_allowed_congestion_control(struct ctl_table *ctl,
  162. int write,
  163. void __user *buffer, size_t *lenp,
  164. loff_t *ppos)
  165. {
  166. struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
  167. int ret;
  168. tbl.data = kmalloc(tbl.maxlen, GFP_USER);
  169. if (!tbl.data)
  170. return -ENOMEM;
  171. tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
  172. ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
  173. if (write && ret == 0)
  174. ret = tcp_set_allowed_congestion_control(tbl.data);
  175. kfree(tbl.data);
  176. return ret;
  177. }
  178. static int ipv4_tcp_mem(struct ctl_table *ctl, int write,
  179. void __user *buffer, size_t *lenp,
  180. loff_t *ppos)
  181. {
  182. int ret;
  183. unsigned long vec[3];
  184. struct net *net = current->nsproxy->net_ns;
  185. #ifdef CONFIG_MEMCG_KMEM
  186. struct mem_cgroup *memcg;
  187. #endif
  188. struct ctl_table tmp = {
  189. .data = &vec,
  190. .maxlen = sizeof(vec),
  191. .mode = ctl->mode,
  192. };
  193. if (!write) {
  194. ctl->data = &net->ipv4.sysctl_tcp_mem;
  195. return proc_doulongvec_minmax(ctl, write, buffer, lenp, ppos);
  196. }
  197. ret = proc_doulongvec_minmax(&tmp, write, buffer, lenp, ppos);
  198. if (ret)
  199. return ret;
  200. #ifdef CONFIG_MEMCG_KMEM
  201. rcu_read_lock();
  202. memcg = mem_cgroup_from_task(current);
  203. tcp_prot_mem(memcg, vec[0], 0);
  204. tcp_prot_mem(memcg, vec[1], 1);
  205. tcp_prot_mem(memcg, vec[2], 2);
  206. rcu_read_unlock();
  207. #endif
  208. net->ipv4.sysctl_tcp_mem[0] = vec[0];
  209. net->ipv4.sysctl_tcp_mem[1] = vec[1];
  210. net->ipv4.sysctl_tcp_mem[2] = vec[2];
  211. return 0;
  212. }
  213. static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
  214. void __user *buffer, size_t *lenp,
  215. loff_t *ppos)
  216. {
  217. struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
  218. struct tcp_fastopen_context *ctxt;
  219. int ret;
  220. u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
  221. tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
  222. if (!tbl.data)
  223. return -ENOMEM;
  224. rcu_read_lock();
  225. ctxt = rcu_dereference(tcp_fastopen_ctx);
  226. if (ctxt)
  227. memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
  228. else
  229. memset(user_key, 0, sizeof(user_key));
  230. rcu_read_unlock();
  231. snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
  232. user_key[0], user_key[1], user_key[2], user_key[3]);
  233. ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
  234. if (write && ret == 0) {
  235. if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1,
  236. user_key + 2, user_key + 3) != 4) {
  237. ret = -EINVAL;
  238. goto bad_key;
  239. }
  240. tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
  241. }
  242. bad_key:
  243. pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
  244. user_key[0], user_key[1], user_key[2], user_key[3],
  245. (char *)tbl.data, ret);
  246. kfree(tbl.data);
  247. return ret;
  248. }
  249. static struct ctl_table ipv4_table[] = {
  250. {
  251. .procname = "tcp_timestamps",
  252. .data = &sysctl_tcp_timestamps,
  253. .maxlen = sizeof(int),
  254. .mode = 0644,
  255. .proc_handler = proc_dointvec
  256. },
  257. {
  258. .procname = "tcp_window_scaling",
  259. .data = &sysctl_tcp_window_scaling,
  260. .maxlen = sizeof(int),
  261. .mode = 0644,
  262. .proc_handler = proc_dointvec
  263. },
  264. {
  265. .procname = "tcp_sack",
  266. .data = &sysctl_tcp_sack,
  267. .maxlen = sizeof(int),
  268. .mode = 0644,
  269. .proc_handler = proc_dointvec
  270. },
  271. {
  272. .procname = "tcp_retrans_collapse",
  273. .data = &sysctl_tcp_retrans_collapse,
  274. .maxlen = sizeof(int),
  275. .mode = 0644,
  276. .proc_handler = proc_dointvec
  277. },
  278. {
  279. .procname = "ip_default_ttl",
  280. .data = &sysctl_ip_default_ttl,
  281. .maxlen = sizeof(int),
  282. .mode = 0644,
  283. .proc_handler = proc_dointvec_minmax,
  284. .extra1 = &ip_ttl_min,
  285. .extra2 = &ip_ttl_max,
  286. },
  287. {
  288. .procname = "ip_no_pmtu_disc",
  289. .data = &ipv4_config.no_pmtu_disc,
  290. .maxlen = sizeof(int),
  291. .mode = 0644,
  292. .proc_handler = proc_dointvec
  293. },
  294. {
  295. .procname = "ip_nonlocal_bind",
  296. .data = &sysctl_ip_nonlocal_bind,
  297. .maxlen = sizeof(int),
  298. .mode = 0644,
  299. .proc_handler = proc_dointvec
  300. },
  301. {
  302. .procname = "tcp_syn_retries",
  303. .data = &sysctl_tcp_syn_retries,
  304. .maxlen = sizeof(int),
  305. .mode = 0644,
  306. .proc_handler = proc_dointvec_minmax,
  307. .extra1 = &tcp_syn_retries_min,
  308. .extra2 = &tcp_syn_retries_max
  309. },
  310. {
  311. .procname = "tcp_synack_retries",
  312. .data = &sysctl_tcp_synack_retries,
  313. .maxlen = sizeof(int),
  314. .mode = 0644,
  315. .proc_handler = proc_dointvec
  316. },
  317. {
  318. .procname = "tcp_max_orphans",
  319. .data = &sysctl_tcp_max_orphans,
  320. .maxlen = sizeof(int),
  321. .mode = 0644,
  322. .proc_handler = proc_dointvec
  323. },
  324. {
  325. .procname = "tcp_max_tw_buckets",
  326. .data = &tcp_death_row.sysctl_max_tw_buckets,
  327. .maxlen = sizeof(int),
  328. .mode = 0644,
  329. .proc_handler = proc_dointvec
  330. },
  331. {
  332. .procname = "ip_early_demux",
  333. .data = &sysctl_ip_early_demux,
  334. .maxlen = sizeof(int),
  335. .mode = 0644,
  336. .proc_handler = proc_dointvec
  337. },
  338. {
  339. .procname = "ip_dynaddr",
  340. .data = &sysctl_ip_dynaddr,
  341. .maxlen = sizeof(int),
  342. .mode = 0644,
  343. .proc_handler = proc_dointvec
  344. },
  345. {
  346. .procname = "tcp_keepalive_time",
  347. .data = &sysctl_tcp_keepalive_time,
  348. .maxlen = sizeof(int),
  349. .mode = 0644,
  350. .proc_handler = proc_dointvec_jiffies,
  351. },
  352. {
  353. .procname = "tcp_keepalive_probes",
  354. .data = &sysctl_tcp_keepalive_probes,
  355. .maxlen = sizeof(int),
  356. .mode = 0644,
  357. .proc_handler = proc_dointvec
  358. },
  359. {
  360. .procname = "tcp_keepalive_intvl",
  361. .data = &sysctl_tcp_keepalive_intvl,
  362. .maxlen = sizeof(int),
  363. .mode = 0644,
  364. .proc_handler = proc_dointvec_jiffies,
  365. },
  366. {
  367. .procname = "tcp_retries1",
  368. .data = &sysctl_tcp_retries1,
  369. .maxlen = sizeof(int),
  370. .mode = 0644,
  371. .proc_handler = proc_dointvec_minmax,
  372. .extra2 = &tcp_retr1_max
  373. },
  374. {
  375. .procname = "tcp_retries2",
  376. .data = &sysctl_tcp_retries2,
  377. .maxlen = sizeof(int),
  378. .mode = 0644,
  379. .proc_handler = proc_dointvec
  380. },
  381. {
  382. .procname = "tcp_fin_timeout",
  383. .data = &sysctl_tcp_fin_timeout,
  384. .maxlen = sizeof(int),
  385. .mode = 0644,
  386. .proc_handler = proc_dointvec_jiffies,
  387. },
  388. #ifdef CONFIG_SYN_COOKIES
  389. {
  390. .procname = "tcp_syncookies",
  391. .data = &sysctl_tcp_syncookies,
  392. .maxlen = sizeof(int),
  393. .mode = 0644,
  394. .proc_handler = proc_dointvec
  395. },
  396. #endif
  397. {
  398. .procname = "tcp_fastopen",
  399. .data = &sysctl_tcp_fastopen,
  400. .maxlen = sizeof(int),
  401. .mode = 0644,
  402. .proc_handler = proc_dointvec,
  403. },
  404. {
  405. .procname = "tcp_fastopen_key",
  406. .mode = 0600,
  407. .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
  408. .proc_handler = proc_tcp_fastopen_key,
  409. },
  410. {
  411. .procname = "tcp_tw_recycle",
  412. .data = &tcp_death_row.sysctl_tw_recycle,
  413. .maxlen = sizeof(int),
  414. .mode = 0644,
  415. .proc_handler = proc_dointvec
  416. },
  417. {
  418. .procname = "tcp_abort_on_overflow",
  419. .data = &sysctl_tcp_abort_on_overflow,
  420. .maxlen = sizeof(int),
  421. .mode = 0644,
  422. .proc_handler = proc_dointvec
  423. },
  424. {
  425. .procname = "tcp_stdurg",
  426. .data = &sysctl_tcp_stdurg,
  427. .maxlen = sizeof(int),
  428. .mode = 0644,
  429. .proc_handler = proc_dointvec
  430. },
  431. {
  432. .procname = "tcp_rfc1337",
  433. .data = &sysctl_tcp_rfc1337,
  434. .maxlen = sizeof(int),
  435. .mode = 0644,
  436. .proc_handler = proc_dointvec
  437. },
  438. {
  439. .procname = "tcp_max_syn_backlog",
  440. .data = &sysctl_max_syn_backlog,
  441. .maxlen = sizeof(int),
  442. .mode = 0644,
  443. .proc_handler = proc_dointvec
  444. },
  445. {
  446. .procname = "ip_local_reserved_ports",
  447. .data = NULL, /* initialized in sysctl_ipv4_init */
  448. .maxlen = 65536,
  449. .mode = 0644,
  450. .proc_handler = proc_do_large_bitmap,
  451. },
  452. {
  453. .procname = "igmp_max_memberships",
  454. .data = &sysctl_igmp_max_memberships,
  455. .maxlen = sizeof(int),
  456. .mode = 0644,
  457. .proc_handler = proc_dointvec
  458. },
  459. {
  460. .procname = "igmp_max_msf",
  461. .data = &sysctl_igmp_max_msf,
  462. .maxlen = sizeof(int),
  463. .mode = 0644,
  464. .proc_handler = proc_dointvec
  465. },
  466. {
  467. .procname = "inet_peer_threshold",
  468. .data = &inet_peer_threshold,
  469. .maxlen = sizeof(int),
  470. .mode = 0644,
  471. .proc_handler = proc_dointvec
  472. },
  473. {
  474. .procname = "inet_peer_minttl",
  475. .data = &inet_peer_minttl,
  476. .maxlen = sizeof(int),
  477. .mode = 0644,
  478. .proc_handler = proc_dointvec_jiffies,
  479. },
  480. {
  481. .procname = "inet_peer_maxttl",
  482. .data = &inet_peer_maxttl,
  483. .maxlen = sizeof(int),
  484. .mode = 0644,
  485. .proc_handler = proc_dointvec_jiffies,
  486. },
  487. {
  488. .procname = "tcp_orphan_retries",
  489. .data = &sysctl_tcp_orphan_retries,
  490. .maxlen = sizeof(int),
  491. .mode = 0644,
  492. .proc_handler = proc_dointvec
  493. },
  494. {
  495. .procname = "tcp_fack",
  496. .data = &sysctl_tcp_fack,
  497. .maxlen = sizeof(int),
  498. .mode = 0644,
  499. .proc_handler = proc_dointvec
  500. },
  501. {
  502. .procname = "tcp_reordering",
  503. .data = &sysctl_tcp_reordering,
  504. .maxlen = sizeof(int),
  505. .mode = 0644,
  506. .proc_handler = proc_dointvec
  507. },
  508. {
  509. .procname = "tcp_dsack",
  510. .data = &sysctl_tcp_dsack,
  511. .maxlen = sizeof(int),
  512. .mode = 0644,
  513. .proc_handler = proc_dointvec
  514. },
  515. {
  516. .procname = "tcp_wmem",
  517. .data = &sysctl_tcp_wmem,
  518. .maxlen = sizeof(sysctl_tcp_wmem),
  519. .mode = 0644,
  520. .proc_handler = proc_dointvec_minmax,
  521. .extra1 = &one,
  522. },
  523. {
  524. .procname = "tcp_notsent_lowat",
  525. .data = &sysctl_tcp_notsent_lowat,
  526. .maxlen = sizeof(sysctl_tcp_notsent_lowat),
  527. .mode = 0644,
  528. .proc_handler = proc_dointvec,
  529. },
  530. {
  531. .procname = "tcp_rmem",
  532. .data = &sysctl_tcp_rmem,
  533. .maxlen = sizeof(sysctl_tcp_rmem),
  534. .mode = 0644,
  535. .proc_handler = proc_dointvec_minmax,
  536. .extra1 = &one,
  537. },
  538. {
  539. .procname = "tcp_app_win",
  540. .data = &sysctl_tcp_app_win,
  541. .maxlen = sizeof(int),
  542. .mode = 0644,
  543. .proc_handler = proc_dointvec
  544. },
  545. {
  546. .procname = "tcp_adv_win_scale",
  547. .data = &sysctl_tcp_adv_win_scale,
  548. .maxlen = sizeof(int),
  549. .mode = 0644,
  550. .proc_handler = proc_dointvec_minmax,
  551. .extra1 = &tcp_adv_win_scale_min,
  552. .extra2 = &tcp_adv_win_scale_max,
  553. },
  554. {
  555. .procname = "tcp_tw_reuse",
  556. .data = &sysctl_tcp_tw_reuse,
  557. .maxlen = sizeof(int),
  558. .mode = 0644,
  559. .proc_handler = proc_dointvec
  560. },
  561. {
  562. .procname = "tcp_frto",
  563. .data = &sysctl_tcp_frto,
  564. .maxlen = sizeof(int),
  565. .mode = 0644,
  566. .proc_handler = proc_dointvec
  567. },
  568. {
  569. .procname = "tcp_low_latency",
  570. .data = &sysctl_tcp_low_latency,
  571. .maxlen = sizeof(int),
  572. .mode = 0644,
  573. .proc_handler = proc_dointvec
  574. },
  575. {
  576. .procname = "tcp_no_metrics_save",
  577. .data = &sysctl_tcp_nometrics_save,
  578. .maxlen = sizeof(int),
  579. .mode = 0644,
  580. .proc_handler = proc_dointvec,
  581. },
  582. {
  583. .procname = "tcp_moderate_rcvbuf",
  584. .data = &sysctl_tcp_moderate_rcvbuf,
  585. .maxlen = sizeof(int),
  586. .mode = 0644,
  587. .proc_handler = proc_dointvec,
  588. },
  589. {
  590. .procname = "tcp_tso_win_divisor",
  591. .data = &sysctl_tcp_tso_win_divisor,
  592. .maxlen = sizeof(int),
  593. .mode = 0644,
  594. .proc_handler = proc_dointvec,
  595. },
  596. {
  597. .procname = "tcp_congestion_control",
  598. .mode = 0644,
  599. .maxlen = TCP_CA_NAME_MAX,
  600. .proc_handler = proc_tcp_congestion_control,
  601. },
  602. {
  603. .procname = "tcp_mtu_probing",
  604. .data = &sysctl_tcp_mtu_probing,
  605. .maxlen = sizeof(int),
  606. .mode = 0644,
  607. .proc_handler = proc_dointvec,
  608. },
  609. {
  610. .procname = "tcp_base_mss",
  611. .data = &sysctl_tcp_base_mss,
  612. .maxlen = sizeof(int),
  613. .mode = 0644,
  614. .proc_handler = proc_dointvec,
  615. },
  616. {
  617. .procname = "tcp_workaround_signed_windows",
  618. .data = &sysctl_tcp_workaround_signed_windows,
  619. .maxlen = sizeof(int),
  620. .mode = 0644,
  621. .proc_handler = proc_dointvec
  622. },
  623. {
  624. .procname = "tcp_limit_output_bytes",
  625. .data = &sysctl_tcp_limit_output_bytes,
  626. .maxlen = sizeof(int),
  627. .mode = 0644,
  628. .proc_handler = proc_dointvec
  629. },
  630. {
  631. .procname = "tcp_challenge_ack_limit",
  632. .data = &sysctl_tcp_challenge_ack_limit,
  633. .maxlen = sizeof(int),
  634. .mode = 0644,
  635. .proc_handler = proc_dointvec
  636. },
  637. #ifdef CONFIG_NET_DMA
  638. {
  639. .procname = "tcp_dma_copybreak",
  640. .data = &sysctl_tcp_dma_copybreak,
  641. .maxlen = sizeof(int),
  642. .mode = 0644,
  643. .proc_handler = proc_dointvec
  644. },
  645. #endif
  646. {
  647. .procname = "tcp_slow_start_after_idle",
  648. .data = &sysctl_tcp_slow_start_after_idle,
  649. .maxlen = sizeof(int),
  650. .mode = 0644,
  651. .proc_handler = proc_dointvec
  652. },
  653. #ifdef CONFIG_NETLABEL
  654. {
  655. .procname = "cipso_cache_enable",
  656. .data = &cipso_v4_cache_enabled,
  657. .maxlen = sizeof(int),
  658. .mode = 0644,
  659. .proc_handler = proc_dointvec,
  660. },
  661. {
  662. .procname = "cipso_cache_bucket_size",
  663. .data = &cipso_v4_cache_bucketsize,
  664. .maxlen = sizeof(int),
  665. .mode = 0644,
  666. .proc_handler = proc_dointvec,
  667. },
  668. {
  669. .procname = "cipso_rbm_optfmt",
  670. .data = &cipso_v4_rbm_optfmt,
  671. .maxlen = sizeof(int),
  672. .mode = 0644,
  673. .proc_handler = proc_dointvec,
  674. },
  675. {
  676. .procname = "cipso_rbm_strictvalid",
  677. .data = &cipso_v4_rbm_strictvalid,
  678. .maxlen = sizeof(int),
  679. .mode = 0644,
  680. .proc_handler = proc_dointvec,
  681. },
  682. #endif /* CONFIG_NETLABEL */
  683. {
  684. .procname = "tcp_available_congestion_control",
  685. .maxlen = TCP_CA_BUF_MAX,
  686. .mode = 0444,
  687. .proc_handler = proc_tcp_available_congestion_control,
  688. },
  689. {
  690. .procname = "tcp_allowed_congestion_control",
  691. .maxlen = TCP_CA_BUF_MAX,
  692. .mode = 0644,
  693. .proc_handler = proc_allowed_congestion_control,
  694. },
  695. {
  696. .procname = "tcp_max_ssthresh",
  697. .data = &sysctl_tcp_max_ssthresh,
  698. .maxlen = sizeof(int),
  699. .mode = 0644,
  700. .proc_handler = proc_dointvec,
  701. },
  702. {
  703. .procname = "tcp_thin_linear_timeouts",
  704. .data = &sysctl_tcp_thin_linear_timeouts,
  705. .maxlen = sizeof(int),
  706. .mode = 0644,
  707. .proc_handler = proc_dointvec
  708. },
  709. {
  710. .procname = "tcp_thin_dupack",
  711. .data = &sysctl_tcp_thin_dupack,
  712. .maxlen = sizeof(int),
  713. .mode = 0644,
  714. .proc_handler = proc_dointvec
  715. },
  716. {
  717. .procname = "tcp_early_retrans",
  718. .data = &sysctl_tcp_early_retrans,
  719. .maxlen = sizeof(int),
  720. .mode = 0644,
  721. .proc_handler = proc_dointvec_minmax,
  722. .extra1 = &zero,
  723. .extra2 = &four,
  724. },
  725. {
  726. .procname = "tcp_min_tso_segs",
  727. .data = &sysctl_tcp_min_tso_segs,
  728. .maxlen = sizeof(int),
  729. .mode = 0644,
  730. .proc_handler = proc_dointvec_minmax,
  731. .extra1 = &zero,
  732. .extra2 = &gso_max_segs,
  733. },
  734. {
  735. .procname = "udp_mem",
  736. .data = &sysctl_udp_mem,
  737. .maxlen = sizeof(sysctl_udp_mem),
  738. .mode = 0644,
  739. .proc_handler = proc_doulongvec_minmax,
  740. },
  741. {
  742. .procname = "udp_rmem_min",
  743. .data = &sysctl_udp_rmem_min,
  744. .maxlen = sizeof(sysctl_udp_rmem_min),
  745. .mode = 0644,
  746. .proc_handler = proc_dointvec_minmax,
  747. .extra1 = &one
  748. },
  749. {
  750. .procname = "udp_wmem_min",
  751. .data = &sysctl_udp_wmem_min,
  752. .maxlen = sizeof(sysctl_udp_wmem_min),
  753. .mode = 0644,
  754. .proc_handler = proc_dointvec_minmax,
  755. .extra1 = &one
  756. },
  757. { }
  758. };
  759. static struct ctl_table ipv4_net_table[] = {
  760. {
  761. .procname = "icmp_echo_ignore_all",
  762. .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
  763. .maxlen = sizeof(int),
  764. .mode = 0644,
  765. .proc_handler = proc_dointvec
  766. },
  767. {
  768. .procname = "icmp_echo_ignore_broadcasts",
  769. .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
  770. .maxlen = sizeof(int),
  771. .mode = 0644,
  772. .proc_handler = proc_dointvec
  773. },
  774. {
  775. .procname = "icmp_ignore_bogus_error_responses",
  776. .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
  777. .maxlen = sizeof(int),
  778. .mode = 0644,
  779. .proc_handler = proc_dointvec
  780. },
  781. {
  782. .procname = "icmp_errors_use_inbound_ifaddr",
  783. .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
  784. .maxlen = sizeof(int),
  785. .mode = 0644,
  786. .proc_handler = proc_dointvec
  787. },
  788. {
  789. .procname = "icmp_ratelimit",
  790. .data = &init_net.ipv4.sysctl_icmp_ratelimit,
  791. .maxlen = sizeof(int),
  792. .mode = 0644,
  793. .proc_handler = proc_dointvec_ms_jiffies,
  794. },
  795. {
  796. .procname = "icmp_ratemask",
  797. .data = &init_net.ipv4.sysctl_icmp_ratemask,
  798. .maxlen = sizeof(int),
  799. .mode = 0644,
  800. .proc_handler = proc_dointvec
  801. },
  802. {
  803. .procname = "ping_group_range",
  804. .data = &init_net.ipv4.sysctl_ping_group_range,
  805. .maxlen = sizeof(gid_t)*2,
  806. .mode = 0644,
  807. .proc_handler = ipv4_ping_group_range,
  808. },
  809. {
  810. .procname = "tcp_ecn",
  811. .data = &init_net.ipv4.sysctl_tcp_ecn,
  812. .maxlen = sizeof(int),
  813. .mode = 0644,
  814. .proc_handler = proc_dointvec
  815. },
  816. {
  817. .procname = "ip_local_port_range",
  818. .maxlen = sizeof(init_net.ipv4.sysctl_local_ports.range),
  819. .data = &init_net.ipv4.sysctl_local_ports.range,
  820. .mode = 0644,
  821. .proc_handler = ipv4_local_port_range,
  822. },
  823. {
  824. .procname = "tcp_mem",
  825. .maxlen = sizeof(init_net.ipv4.sysctl_tcp_mem),
  826. .mode = 0644,
  827. .proc_handler = ipv4_tcp_mem,
  828. },
  829. { }
  830. };
  831. static __net_init int ipv4_sysctl_init_net(struct net *net)
  832. {
  833. struct ctl_table *table;
  834. table = ipv4_net_table;
  835. if (!net_eq(net, &init_net)) {
  836. table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
  837. if (table == NULL)
  838. goto err_alloc;
  839. table[0].data =
  840. &net->ipv4.sysctl_icmp_echo_ignore_all;
  841. table[1].data =
  842. &net->ipv4.sysctl_icmp_echo_ignore_broadcasts;
  843. table[2].data =
  844. &net->ipv4.sysctl_icmp_ignore_bogus_error_responses;
  845. table[3].data =
  846. &net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr;
  847. table[4].data =
  848. &net->ipv4.sysctl_icmp_ratelimit;
  849. table[5].data =
  850. &net->ipv4.sysctl_icmp_ratemask;
  851. table[6].data =
  852. &net->ipv4.sysctl_ping_group_range;
  853. table[7].data =
  854. &net->ipv4.sysctl_tcp_ecn;
  855. table[8].data =
  856. &net->ipv4.sysctl_local_ports.range;
  857. /* Don't export sysctls to unprivileged users */
  858. if (net->user_ns != &init_user_ns)
  859. table[0].procname = NULL;
  860. }
  861. /*
  862. * Sane defaults - nobody may create ping sockets.
  863. * Boot scripts should set this to distro-specific group.
  864. */
  865. net->ipv4.sysctl_ping_group_range[0] = make_kgid(&init_user_ns, 1);
  866. net->ipv4.sysctl_ping_group_range[1] = make_kgid(&init_user_ns, 0);
  867. /*
  868. * Set defaults for local port range
  869. */
  870. seqlock_init(&net->ipv4.sysctl_local_ports.lock);
  871. net->ipv4.sysctl_local_ports.range[0] = 32768;
  872. net->ipv4.sysctl_local_ports.range[1] = 61000;
  873. tcp_init_mem(net);
  874. net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
  875. if (net->ipv4.ipv4_hdr == NULL)
  876. goto err_reg;
  877. return 0;
  878. err_reg:
  879. if (!net_eq(net, &init_net))
  880. kfree(table);
  881. err_alloc:
  882. return -ENOMEM;
  883. }
  884. static __net_exit void ipv4_sysctl_exit_net(struct net *net)
  885. {
  886. struct ctl_table *table;
  887. table = net->ipv4.ipv4_hdr->ctl_table_arg;
  888. unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
  889. kfree(table);
  890. }
  891. static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
  892. .init = ipv4_sysctl_init_net,
  893. .exit = ipv4_sysctl_exit_net,
  894. };
  895. static __init int sysctl_ipv4_init(void)
  896. {
  897. struct ctl_table_header *hdr;
  898. struct ctl_table *i;
  899. for (i = ipv4_table; i->procname; i++) {
  900. if (strcmp(i->procname, "ip_local_reserved_ports") == 0) {
  901. i->data = sysctl_local_reserved_ports;
  902. break;
  903. }
  904. }
  905. if (!i->procname)
  906. return -EINVAL;
  907. hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
  908. if (hdr == NULL)
  909. return -ENOMEM;
  910. if (register_pernet_subsys(&ipv4_sysctl_ops)) {
  911. unregister_net_sysctl_table(hdr);
  912. return -ENOMEM;
  913. }
  914. return 0;
  915. }
  916. __initcall(sysctl_ipv4_init);