sysctl_net_ipv4.c 22.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10
/*
 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem.
 *
 * Begun April 1, 1996, Mike Shaver.
 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS]
 */

#include <linux/mm.h>
#include <linux/module.h>
#include <linux/sysctl.h>
11
#include <linux/igmp.h>
12
#include <linux/inetdevice.h>
13
#include <linux/seqlock.h>
14
#include <linux/init.h>
15
#include <linux/slab.h>
16
#include <linux/nsproxy.h>
G
Glauber Costa 已提交
17
#include <linux/swap.h>
L
Linus Torvalds 已提交
18
#include <net/snmp.h>
19
#include <net/icmp.h>
L
Linus Torvalds 已提交
20 21 22
#include <net/ip.h>
#include <net/route.h>
#include <net/tcp.h>
H
Hideo Aoki 已提交
23
#include <net/udp.h>
P
Paul Moore 已提交
24
#include <net/cipso_ipv4.h>
25
#include <net/inet_frag.h>
26
#include <net/ping.h>
27
#include <net/tcp_memcontrol.h>
L
Linus Torvalds 已提交
28

H
Herbert Xu 已提交
29
static int zero;
30
static int one = 1;
N
Nandita Dukkipati 已提交
31
static int four = 4;
E
Eric Dumazet 已提交
32
static int gso_max_segs = GSO_MAX_SEGS;
33
static int tcp_retr1_max = 255;
L
Linus Torvalds 已提交
34 35
static int ip_local_port_range_min[] = { 1, 1 };
static int ip_local_port_range_max[] = { 65535, 65535 };
36 37
static int tcp_adv_win_scale_min = -31;
static int tcp_adv_win_scale_max = 31;
E
Eric Dumazet 已提交
38 39
static int ip_ttl_min = 1;
static int ip_ttl_max = 255;
40 41
static int tcp_syn_retries_min = 1;
static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
42 43
static int ip_ping_group_range_min[] = { 0, 0 };
static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
L
Linus Torvalds 已提交
44

45
/* Update system visible IP port range */
46
static void set_local_port_range(struct net *net, int range[2])
47
{
48 49 50 51
	write_seqlock(&net->ipv4.ip_local_ports.lock);
	net->ipv4.ip_local_ports.range[0] = range[0];
	net->ipv4.ip_local_ports.range[1] = range[1];
	write_sequnlock(&net->ipv4.ip_local_ports.lock);
52 53 54
}

/* Validate changes from /proc interface. */
55
static int ipv4_local_port_range(struct ctl_table *table, int write,
56 57 58
				 void __user *buffer,
				 size_t *lenp, loff_t *ppos)
{
59
	struct net *net =
60
		container_of(table->data, struct net, ipv4.ip_local_ports.range);
61
	int ret;
E
Eric Dumazet 已提交
62
	int range[2];
63
	struct ctl_table tmp = {
64 65 66 67 68 69 70
		.data = &range,
		.maxlen = sizeof(range),
		.mode = table->mode,
		.extra1 = &ip_local_port_range_min,
		.extra2 = &ip_local_port_range_max,
	};

71 72
	inet_get_local_port_range(net, &range[0], &range[1]);

73
	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
74 75

	if (write && ret == 0) {
76
		if (range[1] < range[0])
77 78
			ret = -EINVAL;
		else
79
			set_local_port_range(net, range);
80 81 82 83 84
	}

	return ret;
}

85

86
static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high)
87
{
88
	kgid_t *data = table->data;
89
	struct net *net =
90
		container_of(table->data, struct net, ipv4.ping_group_range.range);
91
	unsigned int seq;
92
	do {
93
		seq = read_seqbegin(&net->ipv4.ip_local_ports.lock);
94 95 96

		*low = data[0];
		*high = data[1];
97
	} while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq));
98 99 100
}

/* Update system visible IP port range */
101
static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high)
102
{
103
	kgid_t *data = table->data;
104
	struct net *net =
105
		container_of(table->data, struct net, ipv4.ping_group_range.range);
106
	write_seqlock(&net->ipv4.ip_local_ports.lock);
107 108
	data[0] = low;
	data[1] = high;
109
	write_sequnlock(&net->ipv4.ip_local_ports.lock);
110 111 112
}

/* Validate changes from /proc interface. */
113
static int ipv4_ping_group_range(struct ctl_table *table, int write,
114 115 116
				 void __user *buffer,
				 size_t *lenp, loff_t *ppos)
{
117
	struct user_namespace *user_ns = current_user_ns();
118
	int ret;
119 120
	gid_t urange[2];
	kgid_t low, high;
121
	struct ctl_table tmp = {
122 123
		.data = &urange,
		.maxlen = sizeof(urange),
124 125 126 127 128
		.mode = table->mode,
		.extra1 = &ip_ping_group_range_min,
		.extra2 = &ip_ping_group_range_max,
	};

129 130 131
	inet_get_ping_group_range_table(table, &low, &high);
	urange[0] = from_kgid_munged(user_ns, low);
	urange[1] = from_kgid_munged(user_ns, high);
132 133
	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);

134 135 136 137 138 139 140 141 142 143
	if (write && ret == 0) {
		low = make_kgid(user_ns, urange[0]);
		high = make_kgid(user_ns, urange[1]);
		if (!gid_valid(low) || !gid_valid(high) ||
		    (urange[1] < urange[0]) || gid_lt(high, low)) {
			low = make_kgid(&init_user_ns, 1);
			high = make_kgid(&init_user_ns, 0);
		}
		set_ping_group_range(table, low, high);
	}
144 145 146 147

	return ret;
}

148
static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
149 150 151
				       void __user *buffer, size_t *lenp, loff_t *ppos)
{
	char val[TCP_CA_NAME_MAX];
152
	struct ctl_table tbl = {
153 154 155 156 157 158 159
		.data = val,
		.maxlen = TCP_CA_NAME_MAX,
	};
	int ret;

	tcp_get_default_congestion_control(val);

160
	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
161 162 163 164 165
	if (write && ret == 0)
		ret = tcp_set_default_congestion_control(val);
	return ret;
}

166
static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
167
						 int write,
168 169 170
						 void __user *buffer, size_t *lenp,
						 loff_t *ppos)
{
171
	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
172 173 174 175 176 177
	int ret;

	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
	if (!tbl.data)
		return -ENOMEM;
	tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
178
	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
179 180 181 182
	kfree(tbl.data);
	return ret;
}

183
static int proc_allowed_congestion_control(struct ctl_table *ctl,
184
					   int write,
185 186 187
					   void __user *buffer, size_t *lenp,
					   loff_t *ppos)
{
188
	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
189 190 191 192 193 194 195
	int ret;

	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
	if (!tbl.data)
		return -ENOMEM;

	tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
196
	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
197 198 199 200 201 202
	if (write && ret == 0)
		ret = tcp_set_allowed_congestion_control(tbl.data);
	kfree(tbl.data);
	return ret;
}

203 204 205
static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
				 void __user *buffer, size_t *lenp,
				 loff_t *ppos)
206
{
207
	struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
208 209 210 211 212 213 214 215 216 217 218 219
	struct tcp_fastopen_context *ctxt;
	int ret;
	u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */

	tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
	if (!tbl.data)
		return -ENOMEM;

	rcu_read_lock();
	ctxt = rcu_dereference(tcp_fastopen_ctx);
	if (ctxt)
		memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
220 221
	else
		memset(user_key, 0, sizeof(user_key));
222 223 224 225 226 227 228 229 230 231 232 233
	rcu_read_unlock();

	snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
		user_key[0], user_key[1], user_key[2], user_key[3]);
	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);

	if (write && ret == 0) {
		if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1,
			   user_key + 2, user_key + 3) != 4) {
			ret = -EINVAL;
			goto bad_key;
		}
234 235 236 237 238
		/* Generate a dummy secret but don't publish it. This
		 * is needed so we don't regenerate a new key on the
		 * first invocation of tcp_fastopen_cookie_gen
		 */
		tcp_fastopen_init_key_once(false);
239 240 241 242 243 244 245 246 247 248 249
		tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
	}

bad_key:
	pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
	       user_key[0], user_key[1], user_key[2], user_key[3],
	       (char *)tbl.data, ret);
	kfree(tbl.data);
	return ret;
}

250
static struct ctl_table ipv4_table[] = {
251
	{
L
Linus Torvalds 已提交
252 253 254 255
		.procname	= "tcp_timestamps",
		.data		= &sysctl_tcp_timestamps,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
256
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
257
	},
258
	{
L
Linus Torvalds 已提交
259 260 261 262
		.procname	= "tcp_window_scaling",
		.data		= &sysctl_tcp_window_scaling,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
263
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
264
	},
265
	{
L
Linus Torvalds 已提交
266 267 268 269
		.procname	= "tcp_sack",
		.data		= &sysctl_tcp_sack,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
270
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
271
	},
272
	{
L
Linus Torvalds 已提交
273 274 275 276
		.procname	= "tcp_retrans_collapse",
		.data		= &sysctl_tcp_retrans_collapse,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
277
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
278
	},
279
	{
L
Linus Torvalds 已提交
280
		.procname	= "ip_default_ttl",
281
		.data		= &sysctl_ip_default_ttl,
L
Linus Torvalds 已提交
282 283
		.maxlen		= sizeof(int),
		.mode		= 0644,
E
Eric Dumazet 已提交
284 285 286
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &ip_ttl_min,
		.extra2		= &ip_ttl_max,
L
Linus Torvalds 已提交
287 288 289 290 291 292
	},
	{
		.procname	= "tcp_syn_retries",
		.data		= &sysctl_tcp_syn_retries,
		.maxlen		= sizeof(int),
		.mode		= 0644,
293 294 295
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &tcp_syn_retries_min,
		.extra2		= &tcp_syn_retries_max
L
Linus Torvalds 已提交
296 297 298 299 300 301
	},
	{
		.procname	= "tcp_synack_retries",
		.data		= &sysctl_tcp_synack_retries,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
302
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
303 304 305 306 307 308
	},
	{
		.procname	= "tcp_max_orphans",
		.data		= &sysctl_tcp_max_orphans,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
309
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
310 311 312
	},
	{
		.procname	= "tcp_max_tw_buckets",
313
		.data		= &tcp_death_row.sysctl_max_tw_buckets,
L
Linus Torvalds 已提交
314 315
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
316
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
317
	},
318 319 320 321 322 323 324
	{
		.procname	= "ip_early_demux",
		.data		= &sysctl_ip_early_demux,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
L
Linus Torvalds 已提交
325 326 327 328 329
	{
		.procname	= "ip_dynaddr",
		.data		= &sysctl_ip_dynaddr,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
330
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
331 332 333 334 335 336
	},
	{
		.procname	= "tcp_keepalive_time",
		.data		= &sysctl_tcp_keepalive_time,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
337
		.proc_handler	= proc_dointvec_jiffies,
L
Linus Torvalds 已提交
338 339 340 341 342 343
	},
	{
		.procname	= "tcp_keepalive_probes",
		.data		= &sysctl_tcp_keepalive_probes,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
344
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
345 346 347 348 349 350
	},
	{
		.procname	= "tcp_keepalive_intvl",
		.data		= &sysctl_tcp_keepalive_intvl,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
351
		.proc_handler	= proc_dointvec_jiffies,
L
Linus Torvalds 已提交
352 353 354 355 356 357
	},
	{
		.procname	= "tcp_retries1",
		.data		= &sysctl_tcp_retries1,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
358
		.proc_handler	= proc_dointvec_minmax,
L
Linus Torvalds 已提交
359 360 361 362 363 364 365
		.extra2		= &tcp_retr1_max
	},
	{
		.procname	= "tcp_retries2",
		.data		= &sysctl_tcp_retries2,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
366
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
367 368 369 370 371 372
	},
	{
		.procname	= "tcp_fin_timeout",
		.data		= &sysctl_tcp_fin_timeout,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
373
		.proc_handler	= proc_dointvec_jiffies,
L
Linus Torvalds 已提交
374 375 376 377 378 379 380
	},
#ifdef CONFIG_SYN_COOKIES
	{
		.procname	= "tcp_syncookies",
		.data		= &sysctl_tcp_syncookies,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
381
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
382 383
	},
#endif
Y
Yuchung Cheng 已提交
384 385 386 387 388 389 390
	{
		.procname	= "tcp_fastopen",
		.data		= &sysctl_tcp_fastopen,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
391 392 393 394 395 396
	{
		.procname	= "tcp_fastopen_key",
		.mode		= 0600,
		.maxlen		= ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
		.proc_handler	= proc_tcp_fastopen_key,
	},
L
Linus Torvalds 已提交
397 398
	{
		.procname	= "tcp_tw_recycle",
399
		.data		= &tcp_death_row.sysctl_tw_recycle,
L
Linus Torvalds 已提交
400 401
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
402
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
403 404 405 406 407 408
	},
	{
		.procname	= "tcp_abort_on_overflow",
		.data		= &sysctl_tcp_abort_on_overflow,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
409
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
410 411 412 413 414 415
	},
	{
		.procname	= "tcp_stdurg",
		.data		= &sysctl_tcp_stdurg,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
416
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
417 418 419 420 421 422
	},
	{
		.procname	= "tcp_rfc1337",
		.data		= &sysctl_tcp_rfc1337,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
423
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
424 425 426 427 428 429
	},
	{
		.procname	= "tcp_max_syn_backlog",
		.data		= &sysctl_max_syn_backlog,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
430
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
431 432 433 434 435 436
	},
	{
		.procname	= "igmp_max_memberships",
		.data		= &sysctl_igmp_max_memberships,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
437
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
438 439 440 441 442 443
	},
	{
		.procname	= "igmp_max_msf",
		.data		= &sysctl_igmp_max_msf,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
444
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
445
	},
446 447 448 449 450 451 452 453 454 455
#ifdef CONFIG_IP_MULTICAST
	{
		.procname	= "igmp_qrv",
		.data		= &sysctl_igmp_qrv,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &one
	},
#endif
L
Linus Torvalds 已提交
456 457 458 459 460
	{
		.procname	= "inet_peer_threshold",
		.data		= &inet_peer_threshold,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
461
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
462 463 464 465 466 467
	},
	{
		.procname	= "inet_peer_minttl",
		.data		= &inet_peer_minttl,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
468
		.proc_handler	= proc_dointvec_jiffies,
L
Linus Torvalds 已提交
469 470 471 472 473 474
	},
	{
		.procname	= "inet_peer_maxttl",
		.data		= &inet_peer_maxttl,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
475
		.proc_handler	= proc_dointvec_jiffies,
L
Linus Torvalds 已提交
476 477 478 479 480 481
	},
	{
		.procname	= "tcp_orphan_retries",
		.data		= &sysctl_tcp_orphan_retries,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
482
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
483 484 485 486 487 488
	},
	{
		.procname	= "tcp_fack",
		.data		= &sysctl_tcp_fack,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
489
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
490 491 492 493 494 495
	},
	{
		.procname	= "tcp_reordering",
		.data		= &sysctl_tcp_reordering,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
496
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
497
	},
498 499 500 501 502 503 504
	{
		.procname	= "tcp_max_reordering",
		.data		= &sysctl_tcp_max_reordering,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
L
Linus Torvalds 已提交
505 506 507 508 509
	{
		.procname	= "tcp_dsack",
		.data		= &sysctl_tcp_dsack,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
510
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
511
	},
512 513 514 515 516 517 518
	{
		.procname	= "tcp_mem",
		.maxlen		= sizeof(sysctl_tcp_mem),
		.data		= &sysctl_tcp_mem,
		.mode		= 0644,
		.proc_handler	= proc_doulongvec_minmax,
	},
L
Linus Torvalds 已提交
519 520 521 522 523
	{
		.procname	= "tcp_wmem",
		.data		= &sysctl_tcp_wmem,
		.maxlen		= sizeof(sysctl_tcp_wmem),
		.mode		= 0644,
524 525
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &one,
L
Linus Torvalds 已提交
526
	},
527 528 529 530 531 532 533
	{
		.procname	= "tcp_notsent_lowat",
		.data		= &sysctl_tcp_notsent_lowat,
		.maxlen		= sizeof(sysctl_tcp_notsent_lowat),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
L
Linus Torvalds 已提交
534 535 536 537 538
	{
		.procname	= "tcp_rmem",
		.data		= &sysctl_tcp_rmem,
		.maxlen		= sizeof(sysctl_tcp_rmem),
		.mode		= 0644,
539 540
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &one,
L
Linus Torvalds 已提交
541 542 543 544 545 546
	},
	{
		.procname	= "tcp_app_win",
		.data		= &sysctl_tcp_app_win,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
547
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
548 549 550 551 552 553
	},
	{
		.procname	= "tcp_adv_win_scale",
		.data		= &sysctl_tcp_adv_win_scale,
		.maxlen		= sizeof(int),
		.mode		= 0644,
554 555 556
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &tcp_adv_win_scale_min,
		.extra2		= &tcp_adv_win_scale_max,
L
Linus Torvalds 已提交
557 558 559 560 561 562
	},
	{
		.procname	= "tcp_tw_reuse",
		.data		= &sysctl_tcp_tw_reuse,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
563
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
564 565 566 567 568 569
	},
	{
		.procname	= "tcp_frto",
		.data		= &sysctl_tcp_frto,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
570
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
571 572 573 574 575 576
	},
	{
		.procname	= "tcp_low_latency",
		.data		= &sysctl_tcp_low_latency,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
577
		.proc_handler	= proc_dointvec
L
Linus Torvalds 已提交
578 579 580 581 582 583
	},
	{
		.procname	= "tcp_no_metrics_save",
		.data		= &sysctl_tcp_nometrics_save,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
584
		.proc_handler	= proc_dointvec,
L
Linus Torvalds 已提交
585 586 587 588 589 590
	},
	{
		.procname	= "tcp_moderate_rcvbuf",
		.data		= &sysctl_tcp_moderate_rcvbuf,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
591
		.proc_handler	= proc_dointvec,
L
Linus Torvalds 已提交
592 593 594 595 596 597
	},
	{
		.procname	= "tcp_tso_win_divisor",
		.data		= &sysctl_tcp_tso_win_divisor,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
598
		.proc_handler	= proc_dointvec,
L
Linus Torvalds 已提交
599 600
	},
	{
601
		.procname	= "tcp_congestion_control",
L
Linus Torvalds 已提交
602
		.mode		= 0644,
603
		.maxlen		= TCP_CA_NAME_MAX,
A
Alexey Dobriyan 已提交
604
		.proc_handler	= proc_tcp_congestion_control,
L
Linus Torvalds 已提交
605
	},
606
	{
607 608 609 610
		.procname	= "tcp_workaround_signed_windows",
		.data		= &sysctl_tcp_workaround_signed_windows,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
611
		.proc_handler	= proc_dointvec
612
	},
E
Eric Dumazet 已提交
613 614 615 616 617 618 619
	{
		.procname	= "tcp_limit_output_bytes",
		.data		= &sysctl_tcp_limit_output_bytes,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
E
Eric Dumazet 已提交
620 621 622 623 624 625 626
	{
		.procname	= "tcp_challenge_ack_limit",
		.data		= &sysctl_tcp_challenge_ack_limit,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
627 628 629 630 631
	{
		.procname	= "tcp_slow_start_after_idle",
		.data		= &sysctl_tcp_slow_start_after_idle,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
632
		.proc_handler	= proc_dointvec
633
	},
P
Paul Moore 已提交
634 635 636 637 638 639
#ifdef CONFIG_NETLABEL
	{
		.procname	= "cipso_cache_enable",
		.data		= &cipso_v4_cache_enabled,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
640
		.proc_handler	= proc_dointvec,
P
Paul Moore 已提交
641 642 643 644 645 646
	},
	{
		.procname	= "cipso_cache_bucket_size",
		.data		= &cipso_v4_cache_bucketsize,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
647
		.proc_handler	= proc_dointvec,
P
Paul Moore 已提交
648 649 650 651 652 653
	},
	{
		.procname	= "cipso_rbm_optfmt",
		.data		= &cipso_v4_rbm_optfmt,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
654
		.proc_handler	= proc_dointvec,
P
Paul Moore 已提交
655 656 657 658 659 660
	},
	{
		.procname	= "cipso_rbm_strictvalid",
		.data		= &cipso_v4_rbm_strictvalid,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
661
		.proc_handler	= proc_dointvec,
P
Paul Moore 已提交
662 663
	},
#endif /* CONFIG_NETLABEL */
664 665 666 667
	{
		.procname	= "tcp_available_congestion_control",
		.maxlen		= TCP_CA_BUF_MAX,
		.mode		= 0444,
A
Alexey Dobriyan 已提交
668
		.proc_handler   = proc_tcp_available_congestion_control,
669
	},
670 671 672 673
	{
		.procname	= "tcp_allowed_congestion_control",
		.maxlen		= TCP_CA_BUF_MAX,
		.mode		= 0644,
A
Alexey Dobriyan 已提交
674
		.proc_handler   = proc_allowed_congestion_control,
675
	},
A
Andreas Petlund 已提交
676 677 678 679 680 681 682
	{
		.procname       = "tcp_thin_linear_timeouts",
		.data           = &sysctl_tcp_thin_linear_timeouts,
		.maxlen         = sizeof(int),
		.mode           = 0644,
		.proc_handler   = proc_dointvec
	},
683
	{
A
Andreas Petlund 已提交
684 685 686 687 688 689
		.procname       = "tcp_thin_dupack",
		.data           = &sysctl_tcp_thin_dupack,
		.maxlen         = sizeof(int),
		.mode           = 0644,
		.proc_handler   = proc_dointvec
	},
Y
Yuchung Cheng 已提交
690 691 692 693 694 695 696
	{
		.procname	= "tcp_early_retrans",
		.data		= &sysctl_tcp_early_retrans,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &zero,
N
Nandita Dukkipati 已提交
697
		.extra2		= &four,
Y
Yuchung Cheng 已提交
698
	},
E
Eric Dumazet 已提交
699 700 701 702 703 704 705 706 707
	{
		.procname	= "tcp_min_tso_segs",
		.data		= &sysctl_tcp_min_tso_segs,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &zero,
		.extra2		= &gso_max_segs,
	},
E
Eric Dumazet 已提交
708 709 710 711 712 713 714 715 716
	{
		.procname	= "tcp_autocorking",
		.data		= &sysctl_tcp_autocorking,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &zero,
		.extra2		= &one,
	},
717 718 719 720 721 722 723
	{
		.procname	= "tcp_invalid_ratelimit",
		.data		= &sysctl_tcp_invalid_ratelimit,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_ms_jiffies,
	},
724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739
	{
		.procname	= "icmp_msgs_per_sec",
		.data		= &sysctl_icmp_msgs_per_sec,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &zero,
	},
	{
		.procname	= "icmp_msgs_burst",
		.data		= &sysctl_icmp_msgs_burst,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &zero,
	},
H
Hideo Aoki 已提交
740 741 742 743 744
	{
		.procname	= "udp_mem",
		.data		= &sysctl_udp_mem,
		.maxlen		= sizeof(sysctl_udp_mem),
		.mode		= 0644,
E
Eric Dumazet 已提交
745
		.proc_handler	= proc_doulongvec_minmax,
H
Hideo Aoki 已提交
746 747 748 749 750 751
	},
	{
		.procname	= "udp_rmem_min",
		.data		= &sysctl_udp_rmem_min,
		.maxlen		= sizeof(sysctl_udp_rmem_min),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
752
		.proc_handler	= proc_dointvec_minmax,
753
		.extra1		= &one
H
Hideo Aoki 已提交
754 755 756 757 758 759
	},
	{
		.procname	= "udp_wmem_min",
		.data		= &sysctl_udp_wmem_min,
		.maxlen		= sizeof(sysctl_udp_wmem_min),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
760
		.proc_handler	= proc_dointvec_minmax,
761
		.extra1		= &one
H
Hideo Aoki 已提交
762
	},
763
	{ }
L
Linus Torvalds 已提交
764
};
765

766 767 768 769 770 771
static struct ctl_table ipv4_net_table[] = {
	{
		.procname	= "icmp_echo_ignore_all",
		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_all,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
772
		.proc_handler	= proc_dointvec
773 774 775 776 777 778
	},
	{
		.procname	= "icmp_echo_ignore_broadcasts",
		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
779
		.proc_handler	= proc_dointvec
780 781 782 783 784 785
	},
	{
		.procname	= "icmp_ignore_bogus_error_responses",
		.data		= &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
786
		.proc_handler	= proc_dointvec
787 788 789 790 791 792
	},
	{
		.procname	= "icmp_errors_use_inbound_ifaddr",
		.data		= &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
793
		.proc_handler	= proc_dointvec
794 795 796 797 798 799
	},
	{
		.procname	= "icmp_ratelimit",
		.data		= &init_net.ipv4.sysctl_icmp_ratelimit,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
800
		.proc_handler	= proc_dointvec_ms_jiffies,
801 802 803 804 805 806
	},
	{
		.procname	= "icmp_ratemask",
		.data		= &init_net.ipv4.sysctl_icmp_ratemask,
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
807
		.proc_handler	= proc_dointvec
808
	},
809 810
	{
		.procname	= "ping_group_range",
811
		.data		= &init_net.ipv4.ping_group_range.range,
812
		.maxlen		= sizeof(gid_t)*2,
813 814 815
		.mode		= 0644,
		.proc_handler	= ipv4_ping_group_range,
	},
816 817 818 819 820 821 822
	{
		.procname	= "tcp_ecn",
		.data		= &init_net.ipv4.sysctl_tcp_ecn,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
823 824
	{
		.procname	= "ip_local_port_range",
825 826
		.maxlen		= sizeof(init_net.ipv4.ip_local_ports.range),
		.data		= &init_net.ipv4.ip_local_ports.range,
827 828 829
		.mode		= 0644,
		.proc_handler	= ipv4_local_port_range,
	},
830 831 832 833 834 835 836
	{
		.procname	= "ip_local_reserved_ports",
		.data		= &init_net.ipv4.sysctl_local_reserved_ports,
		.maxlen		= 65536,
		.mode		= 0644,
		.proc_handler	= proc_do_large_bitmap,
	},
837 838 839 840 841 842 843
	{
		.procname	= "ip_no_pmtu_disc",
		.data		= &init_net.ipv4.sysctl_ip_no_pmtu_disc,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
844 845 846 847 848 849 850
	{
		.procname	= "ip_forward_use_pmtu",
		.data		= &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
851 852 853 854 855 856 857
	{
		.procname	= "ip_nonlocal_bind",
		.data		= &init_net.ipv4.sysctl_ip_nonlocal_bind,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec
	},
858 859 860 861 862 863 864
	{
		.procname	= "fwmark_reflect",
		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
865 866 867 868 869 870 871
	{
		.procname	= "tcp_fwmark_accept",
		.data		= &init_net.ipv4.sysctl_tcp_fwmark_accept,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
F
Fan Du 已提交
872 873 874 875 876 877 878 879 880 881 882 883 884 885
	{
		.procname	= "tcp_mtu_probing",
		.data		= &init_net.ipv4.sysctl_tcp_mtu_probing,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "tcp_base_mss",
		.data		= &init_net.ipv4.sysctl_tcp_base_mss,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
886 887 888 889 890 891 892
	{
		.procname	= "tcp_probe_threshold",
		.data		= &init_net.ipv4.sysctl_tcp_probe_threshold,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
893 894 895
	{ }
};

896 897
static __net_init int ipv4_sysctl_init_net(struct net *net)
{
898 899 900
	struct ctl_table *table;

	table = ipv4_net_table;
O
Octavian Purdila 已提交
901
	if (!net_eq(net, &init_net)) {
902 903
		int i;

904 905 906 907
		table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
		if (table == NULL)
			goto err_alloc;

908 909 910
		/* Update the variables to point into the current struct net */
		for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++)
			table[i].data += (void *)net - (void *)&init_net;
911 912
	}

913
	net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
914 915 916
	if (net->ipv4.ipv4_hdr == NULL)
		goto err_reg;

917 918 919 920
	net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
	if (!net->ipv4.sysctl_local_reserved_ports)
		goto err_ports;

921
	return 0;
922

923 924
err_ports:
	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
925
err_reg:
O
Octavian Purdila 已提交
926
	if (!net_eq(net, &init_net))
927 928 929
		kfree(table);
err_alloc:
	return -ENOMEM;
930 931 932 933
}

static __net_exit void ipv4_sysctl_exit_net(struct net *net)
{
934 935
	struct ctl_table *table;

936
	kfree(net->ipv4.sysctl_local_reserved_ports);
937 938 939
	table = net->ipv4.ipv4_hdr->ctl_table_arg;
	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
	kfree(table);
940 941 942 943 944 945 946
}

static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
	.init = ipv4_sysctl_init_net,
	.exit = ipv4_sysctl_exit_net,
};

947 948 949 950
static __init int sysctl_ipv4_init(void)
{
	struct ctl_table_header *hdr;

951
	hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
952 953 954 955
	if (hdr == NULL)
		return -ENOMEM;

	if (register_pernet_subsys(&ipv4_sysctl_ops)) {
956
		unregister_net_sysctl_table(hdr);
957 958 959 960
		return -ENOMEM;
	}

	return 0;
961 962 963
}

__initcall(sysctl_ipv4_init);