1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem.
   4 *
   5 * Begun April 1, 1996, Mike Shaver.
   6 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS]
   7 */
   8
   9#include <linux/sysctl.h>
  10#include <linux/seqlock.h>
  11#include <linux/init.h>
  12#include <linux/slab.h>
  13#include <net/icmp.h>
  14#include <net/ip.h>
  15#include <net/ip_fib.h>
  16#include <net/tcp.h>
  17#include <net/udp.h>
  18#include <net/cipso_ipv4.h>
  19#include <net/ping.h>
  20#include <net/protocol.h>
  21#include <net/netevent.h>
  22
  23static int tcp_retr1_max = 255;
  24static int ip_local_port_range_min[] = { 1, 1 };
  25static int ip_local_port_range_max[] = { 65535, 65535 };
  26static int tcp_adv_win_scale_min = -31;
  27static int tcp_adv_win_scale_max = 31;
  28static int tcp_app_win_max = 31;
  29static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
  30static int tcp_min_snd_mss_max = 65535;
  31static int ip_privileged_port_min;
  32static int ip_privileged_port_max = 65535;
  33static int ip_ttl_min = 1;
  34static int ip_ttl_max = 255;
  35static int tcp_syn_retries_min = 1;
  36static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
  37static int tcp_syn_linear_timeouts_max = MAX_TCP_SYNCNT;
  38static unsigned long ip_ping_group_range_min[] = { 0, 0 };
  39static unsigned long ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
  40static u32 u32_max_div_HZ = UINT_MAX / HZ;
  41static int one_day_secs = 24 * 3600;
  42static u32 fib_multipath_hash_fields_all_mask __maybe_unused =
  43	FIB_MULTIPATH_HASH_FIELD_ALL_MASK;
  44static unsigned int tcp_child_ehash_entries_max = 16 * 1024 * 1024;
  45static unsigned int udp_child_hash_entries_max = UDP_HTABLE_SIZE_MAX;
  46static int tcp_plb_max_rounds = 31;
  47static int tcp_plb_max_cong_thresh = 256;
  48
  49/* obsolete */
  50static int sysctl_tcp_low_latency __read_mostly;
  51
  52/* Update system visible IP port range */
  53static void set_local_port_range(struct net *net, unsigned int low, unsigned int high)
  54{
  55	bool same_parity = !((low ^ high) & 1);
  56
  57	if (same_parity && !net->ipv4.ip_local_ports.warned) {
  58		net->ipv4.ip_local_ports.warned = true;
  59		pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n");
  60	}
  61	WRITE_ONCE(net->ipv4.ip_local_ports.range, high << 16 | low);
  62}
  63
  64/* Validate changes from /proc interface. */
  65static int ipv4_local_port_range(const struct ctl_table *table, int write,
  66				 void *buffer, size_t *lenp, loff_t *ppos)
  67{
  68	struct net *net = table->data;
  69	int ret;
  70	int range[2];
  71	struct ctl_table tmp = {
  72		.data = &range,
  73		.maxlen = sizeof(range),
  74		.mode = table->mode,
  75		.extra1 = &ip_local_port_range_min,
  76		.extra2 = &ip_local_port_range_max,
  77	};
  78
  79	inet_get_local_port_range(net, &range[0], &range[1]);
  80
  81	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
  82
  83	if (write && ret == 0) {
  84		/* Ensure that the upper limit is not smaller than the lower,
  85		 * and that the lower does not encroach upon the privileged
  86		 * port limit.
  87		 */
  88		if ((range[1] < range[0]) ||
  89		    (range[0] < READ_ONCE(net->ipv4.sysctl_ip_prot_sock)))
  90			ret = -EINVAL;
  91		else
  92			set_local_port_range(net, range[0], range[1]);
  93	}
  94
  95	return ret;
  96}
  97
  98/* Validate changes from /proc interface. */
  99static int ipv4_privileged_ports(const struct ctl_table *table, int write,
 100				void *buffer, size_t *lenp, loff_t *ppos)
 101{
 102	struct net *net = container_of(table->data, struct net,
 103	    ipv4.sysctl_ip_prot_sock);
 104	int ret;
 105	int pports;
 106	int range[2];
 107	struct ctl_table tmp = {
 108		.data = &pports,
 109		.maxlen = sizeof(pports),
 110		.mode = table->mode,
 111		.extra1 = &ip_privileged_port_min,
 112		.extra2 = &ip_privileged_port_max,
 113	};
 114
 115	pports = READ_ONCE(net->ipv4.sysctl_ip_prot_sock);
 116
 117	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 118
 119	if (write && ret == 0) {
 120		inet_get_local_port_range(net, &range[0], &range[1]);
 121		/* Ensure that the local port range doesn't overlap with the
 122		 * privileged port range.
 123		 */
 124		if (range[0] < pports)
 125			ret = -EINVAL;
 126		else
 127			WRITE_ONCE(net->ipv4.sysctl_ip_prot_sock, pports);
 128	}
 129
 130	return ret;
 131}
 132
 133static void inet_get_ping_group_range_table(const struct ctl_table *table,
 134					    kgid_t *low, kgid_t *high)
 135{
 136	kgid_t *data = table->data;
 137	struct net *net =
 138		container_of(table->data, struct net, ipv4.ping_group_range.range);
 139	unsigned int seq;
 140	do {
 141		seq = read_seqbegin(&net->ipv4.ping_group_range.lock);
 142
 143		*low = data[0];
 144		*high = data[1];
 145	} while (read_seqretry(&net->ipv4.ping_group_range.lock, seq));
 146}
 147
 148/* Update system visible IP port range */
 149static void set_ping_group_range(const struct ctl_table *table,
 150				 kgid_t low, kgid_t high)
 151{
 152	kgid_t *data = table->data;
 153	struct net *net =
 154		container_of(table->data, struct net, ipv4.ping_group_range.range);
 155	write_seqlock(&net->ipv4.ping_group_range.lock);
 156	data[0] = low;
 157	data[1] = high;
 158	write_sequnlock(&net->ipv4.ping_group_range.lock);
 159}
 160
 161/* Validate changes from /proc interface. */
 162static int ipv4_ping_group_range(const struct ctl_table *table, int write,
 163				 void *buffer, size_t *lenp, loff_t *ppos)
 164{
 165	struct user_namespace *user_ns = current_user_ns();
 166	int ret;
 167	unsigned long urange[2];
 168	kgid_t low, high;
 169	struct ctl_table tmp = {
 170		.data = &urange,
 171		.maxlen = sizeof(urange),
 172		.mode = table->mode,
 173		.extra1 = &ip_ping_group_range_min,
 174		.extra2 = &ip_ping_group_range_max,
 175	};
 176
 177	inet_get_ping_group_range_table(table, &low, &high);
 178	urange[0] = from_kgid_munged(user_ns, low);
 179	urange[1] = from_kgid_munged(user_ns, high);
 180	ret = proc_doulongvec_minmax(&tmp, write, buffer, lenp, ppos);
 181
 182	if (write && ret == 0) {
 183		low = make_kgid(user_ns, urange[0]);
 184		high = make_kgid(user_ns, urange[1]);
 185		if (!gid_valid(low) || !gid_valid(high))
 186			return -EINVAL;
 187		if (urange[1] < urange[0] || gid_lt(high, low)) {
 188			low = make_kgid(&init_user_ns, 1);
 189			high = make_kgid(&init_user_ns, 0);
 190		}
 191		set_ping_group_range(table, low, high);
 192	}
 193
 194	return ret;
 195}
 196
 197static int ipv4_fwd_update_priority(const struct ctl_table *table, int write,
 198				    void *buffer, size_t *lenp, loff_t *ppos)
 199{
 200	struct net *net;
 201	int ret;
 202
 203	net = container_of(table->data, struct net,
 204			   ipv4.sysctl_ip_fwd_update_priority);
 205	ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos);
 206	if (write && ret == 0)
 207		call_netevent_notifiers(NETEVENT_IPV4_FWD_UPDATE_PRIORITY_UPDATE,
 208					net);
 209
 210	return ret;
 211}
 212
 213static int proc_tcp_congestion_control(const struct ctl_table *ctl, int write,
 214				       void *buffer, size_t *lenp, loff_t *ppos)
 215{
 216	struct net *net = container_of(ctl->data, struct net,
 217				       ipv4.tcp_congestion_control);
 218	char val[TCP_CA_NAME_MAX];
 219	struct ctl_table tbl = {
 220		.data = val,
 221		.maxlen = TCP_CA_NAME_MAX,
 222	};
 223	int ret;
 224
 225	tcp_get_default_congestion_control(net, val);
 226
 227	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 228	if (write && ret == 0)
 229		ret = tcp_set_default_congestion_control(net, val);
 230	return ret;
 231}
 232
 233static int proc_tcp_available_congestion_control(const struct ctl_table *ctl,
 234						 int write, void *buffer,
 235						 size_t *lenp, loff_t *ppos)
 236{
 237	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
 238	int ret;
 239
 240	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 241	if (!tbl.data)
 242		return -ENOMEM;
 243	tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
 244	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 245	kfree(tbl.data);
 246	return ret;
 247}
 248
 249static int proc_allowed_congestion_control(const struct ctl_table *ctl,
 250					   int write, void *buffer,
 251					   size_t *lenp, loff_t *ppos)
 252{
 253	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
 254	int ret;
 255
 256	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 257	if (!tbl.data)
 258		return -ENOMEM;
 259
 260	tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
 261	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 262	if (write && ret == 0)
 263		ret = tcp_set_allowed_congestion_control(tbl.data);
 264	kfree(tbl.data);
 265	return ret;
 266}
 267
 268static int sscanf_key(char *buf, __le32 *key)
 269{
 270	u32 user_key[4];
 271	int i, ret = 0;
 272
 273	if (sscanf(buf, "%x-%x-%x-%x", user_key, user_key + 1,
 274		   user_key + 2, user_key + 3) != 4) {
 275		ret = -EINVAL;
 276	} else {
 277		for (i = 0; i < ARRAY_SIZE(user_key); i++)
 278			key[i] = cpu_to_le32(user_key[i]);
 279	}
 280	pr_debug("proc TFO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
 281		 user_key[0], user_key[1], user_key[2], user_key[3], buf, ret);
 282
 283	return ret;
 284}
 285
 286static int proc_tcp_fastopen_key(const struct ctl_table *table, int write,
 287				 void *buffer, size_t *lenp, loff_t *ppos)
 288{
 289	struct net *net = container_of(table->data, struct net,
 290	    ipv4.sysctl_tcp_fastopen);
 291	/* maxlen to print the list of keys in hex (*2), with dashes
 292	 * separating doublewords and a comma in between keys.
 293	 */
 294	struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH *
 295					    2 * TCP_FASTOPEN_KEY_MAX) +
 296					    (TCP_FASTOPEN_KEY_MAX * 5)) };
 297	u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)];
 298	__le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)];
 299	char *backup_data;
 300	int ret, i = 0, off = 0, n_keys;
 301
 302	tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
 303	if (!tbl.data)
 304		return -ENOMEM;
 305
 306	n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key);
 307	if (!n_keys) {
 308		memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH);
 309		n_keys = 1;
 310	}
 311
 312	for (i = 0; i < n_keys * 4; i++)
 313		user_key[i] = le32_to_cpu(key[i]);
 314
 315	for (i = 0; i < n_keys; i++) {
 316		off += snprintf(tbl.data + off, tbl.maxlen - off,
 317				"%08x-%08x-%08x-%08x",
 318				user_key[i * 4],
 319				user_key[i * 4 + 1],
 320				user_key[i * 4 + 2],
 321				user_key[i * 4 + 3]);
 322
 323		if (WARN_ON_ONCE(off >= tbl.maxlen - 1))
 324			break;
 325
 326		if (i + 1 < n_keys)
 327			off += snprintf(tbl.data + off, tbl.maxlen - off, ",");
 328	}
 329
 330	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 331
 332	if (write && ret == 0) {
 333		backup_data = strchr(tbl.data, ',');
 334		if (backup_data) {
 335			*backup_data = '\0';
 336			backup_data++;
 337		}
 338		if (sscanf_key(tbl.data, key)) {
 339			ret = -EINVAL;
 340			goto bad_key;
 341		}
 342		if (backup_data) {
 343			if (sscanf_key(backup_data, key + 4)) {
 344				ret = -EINVAL;
 345				goto bad_key;
 346			}
 347		}
 348		tcp_fastopen_reset_cipher(net, NULL, key,
 349					  backup_data ? key + 4 : NULL);
 350	}
 351
 352bad_key:
 353	kfree(tbl.data);
 354	return ret;
 355}
 356
 357static int proc_tfo_blackhole_detect_timeout(const struct ctl_table *table,
 358					     int write, void *buffer,
 359					     size_t *lenp, loff_t *ppos)
 360{
 361	struct net *net = container_of(table->data, struct net,
 362	    ipv4.sysctl_tcp_fastopen_blackhole_timeout);
 363	int ret;
 364
 365	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 366	if (write && ret == 0)
 367		atomic_set(&net->ipv4.tfo_active_disable_times, 0);
 368
 369	return ret;
 370}
 371
 372static int proc_tcp_available_ulp(const struct ctl_table *ctl,
 373				  int write, void *buffer, size_t *lenp,
 374				  loff_t *ppos)
 375{
 376	struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, };
 377	int ret;
 378
 379	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 380	if (!tbl.data)
 381		return -ENOMEM;
 382	tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX);
 383	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 384	kfree(tbl.data);
 385
 386	return ret;
 387}
 388
 389static int proc_tcp_ehash_entries(const struct ctl_table *table, int write,
 390				  void *buffer, size_t *lenp, loff_t *ppos)
 391{
 392	struct net *net = container_of(table->data, struct net,
 393				       ipv4.sysctl_tcp_child_ehash_entries);
 394	struct inet_hashinfo *hinfo = net->ipv4.tcp_death_row.hashinfo;
 395	int tcp_ehash_entries;
 396	struct ctl_table tbl;
 397
 398	tcp_ehash_entries = hinfo->ehash_mask + 1;
 399
 400	/* A negative number indicates that the child netns
 401	 * shares the global ehash.
 402	 */
 403	if (!net_eq(net, &init_net) && !hinfo->pernet)
 404		tcp_ehash_entries *= -1;
 405
 406	memset(&tbl, 0, sizeof(tbl));
 407	tbl.data = &tcp_ehash_entries;
 408	tbl.maxlen = sizeof(int);
 409
 410	return proc_dointvec(&tbl, write, buffer, lenp, ppos);
 411}
 412
 413static int proc_udp_hash_entries(const struct ctl_table *table, int write,
 414				 void *buffer, size_t *lenp, loff_t *ppos)
 415{
 416	struct net *net = container_of(table->data, struct net,
 417				       ipv4.sysctl_udp_child_hash_entries);
 418	int udp_hash_entries;
 419	struct ctl_table tbl;
 420
 421	udp_hash_entries = net->ipv4.udp_table->mask + 1;
 422
 423	/* A negative number indicates that the child netns
 424	 * shares the global udp_table.
 425	 */
 426	if (!net_eq(net, &init_net) && net->ipv4.udp_table == &udp_table)
 427		udp_hash_entries *= -1;
 428
 429	memset(&tbl, 0, sizeof(tbl));
 430	tbl.data = &udp_hash_entries;
 431	tbl.maxlen = sizeof(int);
 432
 433	return proc_dointvec(&tbl, write, buffer, lenp, ppos);
 434}
 435
 436#ifdef CONFIG_IP_ROUTE_MULTIPATH
 437static int proc_fib_multipath_hash_policy(const struct ctl_table *table, int write,
 438					  void *buffer, size_t *lenp,
 439					  loff_t *ppos)
 440{
 441	struct net *net = container_of(table->data, struct net,
 442	    ipv4.sysctl_fib_multipath_hash_policy);
 443	int ret;
 444
 445	ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos);
 446	if (write && ret == 0)
 447		call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net);
 448
 449	return ret;
 450}
 451
 452static int proc_fib_multipath_hash_fields(const struct ctl_table *table, int write,
 453					  void *buffer, size_t *lenp,
 454					  loff_t *ppos)
 455{
 456	struct net *net;
 457	int ret;
 458
 459	net = container_of(table->data, struct net,
 460			   ipv4.sysctl_fib_multipath_hash_fields);
 461	ret = proc_douintvec_minmax(table, write, buffer, lenp, ppos);
 462	if (write && ret == 0)
 463		call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net);
 464
 465	return ret;
 466}
 467
 468static u32 proc_fib_multipath_hash_rand_seed __ro_after_init;
 469
 470static void proc_fib_multipath_hash_init_rand_seed(void)
 471{
 472	get_random_bytes(&proc_fib_multipath_hash_rand_seed,
 473			 sizeof(proc_fib_multipath_hash_rand_seed));
 474}
 475
 476static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed)
 477{
 478	struct sysctl_fib_multipath_hash_seed new = {
 479		.user_seed = user_seed,
 480		.mp_seed = (user_seed ? user_seed :
 481			    proc_fib_multipath_hash_rand_seed),
 482	};
 483
 484	WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed, new);
 485}
 486
 487static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write,
 488					void *buffer, size_t *lenp,
 489					loff_t *ppos)
 490{
 491	struct sysctl_fib_multipath_hash_seed *mphs;
 492	struct net *net = table->data;
 493	struct ctl_table tmp;
 494	u32 user_seed;
 495	int ret;
 496
 497	mphs = &net->ipv4.sysctl_fib_multipath_hash_seed;
 498	user_seed = mphs->user_seed;
 499
 500	tmp = *table;
 501	tmp.data = &user_seed;
 502
 503	ret = proc_douintvec_minmax(&tmp, write, buffer, lenp, ppos);
 504
 505	if (write && ret == 0) {
 506		proc_fib_multipath_hash_set_seed(net, user_seed);
 507		call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net);
 508	}
 509
 510	return ret;
 511}
 512#else
 513
 514static void proc_fib_multipath_hash_init_rand_seed(void)
 515{
 516}
 517
 518static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed)
 519{
 520}
 521
 522#endif
 523
 524static struct ctl_table ipv4_table[] = {
 525	{
 526		.procname	= "tcp_max_orphans",
 527		.data		= &sysctl_tcp_max_orphans,
 528		.maxlen		= sizeof(int),
 529		.mode		= 0644,
 530		.proc_handler	= proc_dointvec
 531	},
 532	{
 533		.procname	= "inet_peer_threshold",
 534		.data		= &inet_peer_threshold,
 535		.maxlen		= sizeof(int),
 536		.mode		= 0644,
 537		.proc_handler	= proc_dointvec
 538	},
 539	{
 540		.procname	= "inet_peer_minttl",
 541		.data		= &inet_peer_minttl,
 542		.maxlen		= sizeof(int),
 543		.mode		= 0644,
 544		.proc_handler	= proc_dointvec_jiffies,
 545	},
 546	{
 547		.procname	= "inet_peer_maxttl",
 548		.data		= &inet_peer_maxttl,
 549		.maxlen		= sizeof(int),
 550		.mode		= 0644,
 551		.proc_handler	= proc_dointvec_jiffies,
 552	},
 553	{
 554		.procname	= "tcp_mem",
 555		.maxlen		= sizeof(sysctl_tcp_mem),
 556		.data		= &sysctl_tcp_mem,
 557		.mode		= 0644,
 558		.proc_handler	= proc_doulongvec_minmax,
 559	},
 560	{
 561		.procname	= "tcp_low_latency",
 562		.data		= &sysctl_tcp_low_latency,
 563		.maxlen		= sizeof(int),
 564		.mode		= 0644,
 565		.proc_handler	= proc_dointvec
 566	},
 567#ifdef CONFIG_NETLABEL
 568	{
 569		.procname	= "cipso_cache_enable",
 570		.data		= &cipso_v4_cache_enabled,
 571		.maxlen		= sizeof(int),
 572		.mode		= 0644,
 573		.proc_handler	= proc_dointvec,
 574	},
 575	{
 576		.procname	= "cipso_cache_bucket_size",
 577		.data		= &cipso_v4_cache_bucketsize,
 578		.maxlen		= sizeof(int),
 579		.mode		= 0644,
 580		.proc_handler	= proc_dointvec,
 581	},
 582	{
 583		.procname	= "cipso_rbm_optfmt",
 584		.data		= &cipso_v4_rbm_optfmt,
 585		.maxlen		= sizeof(int),
 586		.mode		= 0644,
 587		.proc_handler	= proc_dointvec,
 588	},
 589	{
 590		.procname	= "cipso_rbm_strictvalid",
 591		.data		= &cipso_v4_rbm_strictvalid,
 592		.maxlen		= sizeof(int),
 593		.mode		= 0644,
 594		.proc_handler	= proc_dointvec,
 595	},
 596#endif /* CONFIG_NETLABEL */
 597	{
 598		.procname	= "tcp_available_ulp",
 599		.maxlen		= TCP_ULP_BUF_MAX,
 600		.mode		= 0444,
 601		.proc_handler   = proc_tcp_available_ulp,
 602	},
 603	{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 604		.procname	= "udp_mem",
 605		.data		= &sysctl_udp_mem,
 606		.maxlen		= sizeof(sysctl_udp_mem),
 607		.mode		= 0644,
 608		.proc_handler	= proc_doulongvec_minmax,
 609	},
 610	{
 611		.procname	= "fib_sync_mem",
 612		.data		= &sysctl_fib_sync_mem,
 613		.maxlen		= sizeof(sysctl_fib_sync_mem),
 614		.mode		= 0644,
 615		.proc_handler	= proc_douintvec_minmax,
 616		.extra1		= &sysctl_fib_sync_mem_min,
 617		.extra2		= &sysctl_fib_sync_mem_max,
 618	},
 
 619};
 620
 621static struct ctl_table ipv4_net_table[] = {
 622	{
 623		.procname	= "tcp_max_tw_buckets",
 624		.data		= &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets,
 625		.maxlen		= sizeof(int),
 626		.mode		= 0644,
 627		.proc_handler	= proc_dointvec
 628	},
 629	{
 630		.procname	= "icmp_echo_ignore_all",
 631		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_all,
 632		.maxlen		= sizeof(u8),
 633		.mode		= 0644,
 634		.proc_handler	= proc_dou8vec_minmax,
 635		.extra1		= SYSCTL_ZERO,
 636		.extra2		= SYSCTL_ONE
 637	},
 638	{
 639		.procname	= "icmp_echo_enable_probe",
 640		.data		= &init_net.ipv4.sysctl_icmp_echo_enable_probe,
 641		.maxlen		= sizeof(u8),
 642		.mode		= 0644,
 643		.proc_handler	= proc_dou8vec_minmax,
 644		.extra1		= SYSCTL_ZERO,
 645		.extra2		= SYSCTL_ONE
 646	},
 647	{
 648		.procname	= "icmp_echo_ignore_broadcasts",
 649		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
 650		.maxlen		= sizeof(u8),
 651		.mode		= 0644,
 652		.proc_handler	= proc_dou8vec_minmax,
 653		.extra1		= SYSCTL_ZERO,
 654		.extra2		= SYSCTL_ONE
 655	},
 656	{
 657		.procname	= "icmp_ignore_bogus_error_responses",
 658		.data		= &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
 659		.maxlen		= sizeof(u8),
 660		.mode		= 0644,
 661		.proc_handler	= proc_dou8vec_minmax,
 662		.extra1		= SYSCTL_ZERO,
 663		.extra2		= SYSCTL_ONE
 664	},
 665	{
 666		.procname	= "icmp_errors_use_inbound_ifaddr",
 667		.data		= &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
 668		.maxlen		= sizeof(u8),
 669		.mode		= 0644,
 670		.proc_handler	= proc_dou8vec_minmax,
 671		.extra1		= SYSCTL_ZERO,
 672		.extra2		= SYSCTL_ONE
 673	},
 674	{
 675		.procname	= "icmp_ratelimit",
 676		.data		= &init_net.ipv4.sysctl_icmp_ratelimit,
 677		.maxlen		= sizeof(int),
 678		.mode		= 0644,
 679		.proc_handler	= proc_dointvec_ms_jiffies,
 680	},
 681	{
 682		.procname	= "icmp_ratemask",
 683		.data		= &init_net.ipv4.sysctl_icmp_ratemask,
 684		.maxlen		= sizeof(int),
 685		.mode		= 0644,
 686		.proc_handler	= proc_dointvec
 687	},
 688	{
 689		.procname	= "icmp_msgs_per_sec",
 690		.data		= &init_net.ipv4.sysctl_icmp_msgs_per_sec,
 691		.maxlen		= sizeof(int),
 692		.mode		= 0644,
 693		.proc_handler	= proc_dointvec_minmax,
 694		.extra1		= SYSCTL_ZERO,
 695	},
 696	{
 697		.procname	= "icmp_msgs_burst",
 698		.data		= &init_net.ipv4.sysctl_icmp_msgs_burst,
 699		.maxlen		= sizeof(int),
 700		.mode		= 0644,
 701		.proc_handler	= proc_dointvec_minmax,
 702		.extra1		= SYSCTL_ZERO,
 703	},
 704	{
 705		.procname	= "ping_group_range",
 706		.data		= &init_net.ipv4.ping_group_range.range,
 707		.maxlen		= sizeof(gid_t)*2,
 708		.mode		= 0644,
 709		.proc_handler	= ipv4_ping_group_range,
 710	},
 711#ifdef CONFIG_NET_L3_MASTER_DEV
 712	{
 713		.procname	= "raw_l3mdev_accept",
 714		.data		= &init_net.ipv4.sysctl_raw_l3mdev_accept,
 715		.maxlen		= sizeof(u8),
 716		.mode		= 0644,
 717		.proc_handler	= proc_dou8vec_minmax,
 718		.extra1		= SYSCTL_ZERO,
 719		.extra2		= SYSCTL_ONE,
 720	},
 721#endif
 722	{
 723		.procname	= "tcp_ecn",
 724		.data		= &init_net.ipv4.sysctl_tcp_ecn,
 725		.maxlen		= sizeof(u8),
 726		.mode		= 0644,
 727		.proc_handler	= proc_dou8vec_minmax,
 728		.extra1		= SYSCTL_ZERO,
 729		.extra2		= SYSCTL_TWO,
 730	},
 731	{
 732		.procname	= "tcp_ecn_fallback",
 733		.data		= &init_net.ipv4.sysctl_tcp_ecn_fallback,
 734		.maxlen		= sizeof(u8),
 735		.mode		= 0644,
 736		.proc_handler	= proc_dou8vec_minmax,
 737		.extra1		= SYSCTL_ZERO,
 738		.extra2		= SYSCTL_ONE,
 739	},
 740	{
 741		.procname	= "ip_dynaddr",
 742		.data		= &init_net.ipv4.sysctl_ip_dynaddr,
 743		.maxlen		= sizeof(u8),
 744		.mode		= 0644,
 745		.proc_handler	= proc_dou8vec_minmax,
 746	},
 747	{
 748		.procname	= "ip_early_demux",
 749		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 750		.maxlen		= sizeof(u8),
 751		.mode		= 0644,
 752		.proc_handler	= proc_dou8vec_minmax,
 753	},
 754	{
 755		.procname       = "udp_early_demux",
 756		.data           = &init_net.ipv4.sysctl_udp_early_demux,
 757		.maxlen         = sizeof(u8),
 758		.mode           = 0644,
 759		.proc_handler   = proc_dou8vec_minmax,
 760	},
 761	{
 762		.procname       = "tcp_early_demux",
 763		.data           = &init_net.ipv4.sysctl_tcp_early_demux,
 764		.maxlen         = sizeof(u8),
 765		.mode           = 0644,
 766		.proc_handler   = proc_dou8vec_minmax,
 767	},
 768	{
 769		.procname       = "nexthop_compat_mode",
 770		.data           = &init_net.ipv4.sysctl_nexthop_compat_mode,
 771		.maxlen         = sizeof(u8),
 772		.mode           = 0644,
 773		.proc_handler   = proc_dou8vec_minmax,
 774		.extra1		= SYSCTL_ZERO,
 775		.extra2		= SYSCTL_ONE,
 776	},
 777	{
 778		.procname	= "ip_default_ttl",
 779		.data		= &init_net.ipv4.sysctl_ip_default_ttl,
 780		.maxlen		= sizeof(u8),
 781		.mode		= 0644,
 782		.proc_handler	= proc_dou8vec_minmax,
 783		.extra1		= &ip_ttl_min,
 784		.extra2		= &ip_ttl_max,
 785	},
 786	{
 787		.procname	= "ip_local_port_range",
 788		.maxlen		= 0,
 789		.data		= &init_net,
 790		.mode		= 0644,
 791		.proc_handler	= ipv4_local_port_range,
 792	},
 793	{
 794		.procname	= "ip_local_reserved_ports",
 795		.data		= &init_net.ipv4.sysctl_local_reserved_ports,
 796		.maxlen		= 65536,
 797		.mode		= 0644,
 798		.proc_handler	= proc_do_large_bitmap,
 799	},
 800	{
 801		.procname	= "ip_no_pmtu_disc",
 802		.data		= &init_net.ipv4.sysctl_ip_no_pmtu_disc,
 803		.maxlen		= sizeof(u8),
 804		.mode		= 0644,
 805		.proc_handler	= proc_dou8vec_minmax,
 806	},
 807	{
 808		.procname	= "ip_forward_use_pmtu",
 809		.data		= &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
 810		.maxlen		= sizeof(u8),
 811		.mode		= 0644,
 812		.proc_handler	= proc_dou8vec_minmax,
 813	},
 814	{
 815		.procname	= "ip_forward_update_priority",
 816		.data		= &init_net.ipv4.sysctl_ip_fwd_update_priority,
 817		.maxlen		= sizeof(u8),
 818		.mode		= 0644,
 819		.proc_handler   = ipv4_fwd_update_priority,
 820		.extra1		= SYSCTL_ZERO,
 821		.extra2		= SYSCTL_ONE,
 822	},
 823	{
 824		.procname	= "ip_nonlocal_bind",
 825		.data		= &init_net.ipv4.sysctl_ip_nonlocal_bind,
 826		.maxlen		= sizeof(u8),
 827		.mode		= 0644,
 828		.proc_handler	= proc_dou8vec_minmax,
 829	},
 830	{
 831		.procname	= "ip_autobind_reuse",
 832		.data		= &init_net.ipv4.sysctl_ip_autobind_reuse,
 833		.maxlen		= sizeof(u8),
 834		.mode		= 0644,
 835		.proc_handler	= proc_dou8vec_minmax,
 836		.extra1         = SYSCTL_ZERO,
 837		.extra2         = SYSCTL_ONE,
 838	},
 839	{
 840		.procname	= "fwmark_reflect",
 841		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
 842		.maxlen		= sizeof(u8),
 843		.mode		= 0644,
 844		.proc_handler	= proc_dou8vec_minmax,
 845	},
 846	{
 847		.procname	= "tcp_fwmark_accept",
 848		.data		= &init_net.ipv4.sysctl_tcp_fwmark_accept,
 849		.maxlen		= sizeof(u8),
 850		.mode		= 0644,
 851		.proc_handler	= proc_dou8vec_minmax,
 852	},
 853#ifdef CONFIG_NET_L3_MASTER_DEV
 854	{
 855		.procname	= "tcp_l3mdev_accept",
 856		.data		= &init_net.ipv4.sysctl_tcp_l3mdev_accept,
 857		.maxlen		= sizeof(u8),
 858		.mode		= 0644,
 859		.proc_handler	= proc_dou8vec_minmax,
 860		.extra1		= SYSCTL_ZERO,
 861		.extra2		= SYSCTL_ONE,
 862	},
 863#endif
 864	{
 865		.procname	= "tcp_mtu_probing",
 866		.data		= &init_net.ipv4.sysctl_tcp_mtu_probing,
 867		.maxlen		= sizeof(u8),
 868		.mode		= 0644,
 869		.proc_handler	= proc_dou8vec_minmax,
 870	},
 871	{
 872		.procname	= "tcp_base_mss",
 873		.data		= &init_net.ipv4.sysctl_tcp_base_mss,
 874		.maxlen		= sizeof(int),
 875		.mode		= 0644,
 876		.proc_handler	= proc_dointvec,
 877	},
 878	{
 879		.procname	= "tcp_min_snd_mss",
 880		.data		= &init_net.ipv4.sysctl_tcp_min_snd_mss,
 881		.maxlen		= sizeof(int),
 882		.mode		= 0644,
 883		.proc_handler	= proc_dointvec_minmax,
 884		.extra1		= &tcp_min_snd_mss_min,
 885		.extra2		= &tcp_min_snd_mss_max,
 886	},
 887	{
 888		.procname	= "tcp_mtu_probe_floor",
 889		.data		= &init_net.ipv4.sysctl_tcp_mtu_probe_floor,
 890		.maxlen		= sizeof(int),
 891		.mode		= 0644,
 892		.proc_handler	= proc_dointvec_minmax,
 893		.extra1		= &tcp_min_snd_mss_min,
 894		.extra2		= &tcp_min_snd_mss_max,
 895	},
 896	{
 897		.procname	= "tcp_probe_threshold",
 898		.data		= &init_net.ipv4.sysctl_tcp_probe_threshold,
 899		.maxlen		= sizeof(int),
 900		.mode		= 0644,
 901		.proc_handler	= proc_dointvec,
 902	},
 903	{
 904		.procname	= "tcp_probe_interval",
 905		.data		= &init_net.ipv4.sysctl_tcp_probe_interval,
 906		.maxlen		= sizeof(u32),
 907		.mode		= 0644,
 908		.proc_handler	= proc_douintvec_minmax,
 909		.extra2		= &u32_max_div_HZ,
 910	},
 911	{
 912		.procname	= "igmp_link_local_mcast_reports",
 913		.data		= &init_net.ipv4.sysctl_igmp_llm_reports,
 914		.maxlen		= sizeof(u8),
 915		.mode		= 0644,
 916		.proc_handler	= proc_dou8vec_minmax,
 917	},
 918	{
 919		.procname	= "igmp_max_memberships",
 920		.data		= &init_net.ipv4.sysctl_igmp_max_memberships,
 921		.maxlen		= sizeof(int),
 922		.mode		= 0644,
 923		.proc_handler	= proc_dointvec
 924	},
 925	{
 926		.procname	= "igmp_max_msf",
 927		.data		= &init_net.ipv4.sysctl_igmp_max_msf,
 928		.maxlen		= sizeof(int),
 929		.mode		= 0644,
 930		.proc_handler	= proc_dointvec
 931	},
 932#ifdef CONFIG_IP_MULTICAST
 933	{
 934		.procname	= "igmp_qrv",
 935		.data		= &init_net.ipv4.sysctl_igmp_qrv,
 936		.maxlen		= sizeof(int),
 937		.mode		= 0644,
 938		.proc_handler	= proc_dointvec_minmax,
 939		.extra1		= SYSCTL_ONE
 940	},
 941#endif
 942	{
 943		.procname	= "tcp_congestion_control",
 944		.data		= &init_net.ipv4.tcp_congestion_control,
 945		.mode		= 0644,
 946		.maxlen		= TCP_CA_NAME_MAX,
 947		.proc_handler	= proc_tcp_congestion_control,
 948	},
 949	{
 950		.procname	= "tcp_available_congestion_control",
 951		.maxlen		= TCP_CA_BUF_MAX,
 952		.mode		= 0444,
 953		.proc_handler   = proc_tcp_available_congestion_control,
 954	},
 955	{
 956		.procname	= "tcp_allowed_congestion_control",
 957		.maxlen		= TCP_CA_BUF_MAX,
 958		.mode		= 0644,
 959		.proc_handler   = proc_allowed_congestion_control,
 960	},
 961	{
 962		.procname	= "tcp_keepalive_time",
 963		.data		= &init_net.ipv4.sysctl_tcp_keepalive_time,
 964		.maxlen		= sizeof(int),
 965		.mode		= 0644,
 966		.proc_handler	= proc_dointvec_jiffies,
 967	},
 968	{
 969		.procname	= "tcp_keepalive_probes",
 970		.data		= &init_net.ipv4.sysctl_tcp_keepalive_probes,
 971		.maxlen		= sizeof(u8),
 972		.mode		= 0644,
 973		.proc_handler	= proc_dou8vec_minmax,
 974	},
 975	{
 976		.procname	= "tcp_keepalive_intvl",
 977		.data		= &init_net.ipv4.sysctl_tcp_keepalive_intvl,
 978		.maxlen		= sizeof(int),
 979		.mode		= 0644,
 980		.proc_handler	= proc_dointvec_jiffies,
 981	},
 982	{
 983		.procname	= "tcp_syn_retries",
 984		.data		= &init_net.ipv4.sysctl_tcp_syn_retries,
 985		.maxlen		= sizeof(u8),
 986		.mode		= 0644,
 987		.proc_handler	= proc_dou8vec_minmax,
 988		.extra1		= &tcp_syn_retries_min,
 989		.extra2		= &tcp_syn_retries_max
 990	},
 991	{
 992		.procname	= "tcp_synack_retries",
 993		.data		= &init_net.ipv4.sysctl_tcp_synack_retries,
 994		.maxlen		= sizeof(u8),
 995		.mode		= 0644,
 996		.proc_handler	= proc_dou8vec_minmax,
 997	},
 998#ifdef CONFIG_SYN_COOKIES
 999	{
1000		.procname	= "tcp_syncookies",
1001		.data		= &init_net.ipv4.sysctl_tcp_syncookies,
1002		.maxlen		= sizeof(u8),
1003		.mode		= 0644,
1004		.proc_handler	= proc_dou8vec_minmax,
1005	},
1006#endif
1007	{
1008		.procname	= "tcp_migrate_req",
1009		.data		= &init_net.ipv4.sysctl_tcp_migrate_req,
1010		.maxlen		= sizeof(u8),
1011		.mode		= 0644,
1012		.proc_handler	= proc_dou8vec_minmax,
1013		.extra1		= SYSCTL_ZERO,
1014		.extra2		= SYSCTL_ONE
1015	},
1016	{
1017		.procname	= "tcp_reordering",
1018		.data		= &init_net.ipv4.sysctl_tcp_reordering,
1019		.maxlen		= sizeof(int),
1020		.mode		= 0644,
1021		.proc_handler	= proc_dointvec
1022	},
1023	{
1024		.procname	= "tcp_retries1",
1025		.data		= &init_net.ipv4.sysctl_tcp_retries1,
1026		.maxlen		= sizeof(u8),
1027		.mode		= 0644,
1028		.proc_handler	= proc_dou8vec_minmax,
1029		.extra2		= &tcp_retr1_max
1030	},
1031	{
1032		.procname	= "tcp_retries2",
1033		.data		= &init_net.ipv4.sysctl_tcp_retries2,
1034		.maxlen		= sizeof(u8),
1035		.mode		= 0644,
1036		.proc_handler	= proc_dou8vec_minmax,
1037	},
1038	{
1039		.procname	= "tcp_orphan_retries",
1040		.data		= &init_net.ipv4.sysctl_tcp_orphan_retries,
1041		.maxlen		= sizeof(u8),
1042		.mode		= 0644,
1043		.proc_handler	= proc_dou8vec_minmax,
1044	},
1045	{
1046		.procname	= "tcp_fin_timeout",
1047		.data		= &init_net.ipv4.sysctl_tcp_fin_timeout,
1048		.maxlen		= sizeof(int),
1049		.mode		= 0644,
1050		.proc_handler	= proc_dointvec_jiffies,
1051	},
1052	{
1053		.procname	= "tcp_notsent_lowat",
1054		.data		= &init_net.ipv4.sysctl_tcp_notsent_lowat,
1055		.maxlen		= sizeof(unsigned int),
1056		.mode		= 0644,
1057		.proc_handler	= proc_douintvec,
1058	},
1059	{
1060		.procname	= "tcp_tw_reuse",
1061		.data		= &init_net.ipv4.sysctl_tcp_tw_reuse,
1062		.maxlen		= sizeof(u8),
1063		.mode		= 0644,
1064		.proc_handler	= proc_dou8vec_minmax,
1065		.extra1		= SYSCTL_ZERO,
1066		.extra2		= SYSCTL_TWO,
1067	},
1068	{
1069		.procname	= "tcp_max_syn_backlog",
1070		.data		= &init_net.ipv4.sysctl_max_syn_backlog,
1071		.maxlen		= sizeof(int),
1072		.mode		= 0644,
1073		.proc_handler	= proc_dointvec
1074	},
1075	{
1076		.procname	= "tcp_fastopen",
1077		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1078		.maxlen		= sizeof(int),
1079		.mode		= 0644,
1080		.proc_handler	= proc_dointvec,
1081	},
1082	{
1083		.procname	= "tcp_fastopen_key",
1084		.mode		= 0600,
1085		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1086		/* maxlen to print the list of keys in hex (*2), with dashes
1087		 * separating doublewords and a comma in between keys.
1088		 */
1089		.maxlen		= ((TCP_FASTOPEN_KEY_LENGTH *
1090				   2 * TCP_FASTOPEN_KEY_MAX) +
1091				   (TCP_FASTOPEN_KEY_MAX * 5)),
1092		.proc_handler	= proc_tcp_fastopen_key,
1093	},
1094	{
1095		.procname	= "tcp_fastopen_blackhole_timeout_sec",
1096		.data		= &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout,
1097		.maxlen		= sizeof(int),
1098		.mode		= 0644,
1099		.proc_handler	= proc_tfo_blackhole_detect_timeout,
1100		.extra1		= SYSCTL_ZERO,
1101	},
1102#ifdef CONFIG_IP_ROUTE_MULTIPATH
1103	{
1104		.procname	= "fib_multipath_use_neigh",
1105		.data		= &init_net.ipv4.sysctl_fib_multipath_use_neigh,
1106		.maxlen		= sizeof(u8),
1107		.mode		= 0644,
1108		.proc_handler	= proc_dou8vec_minmax,
1109		.extra1		= SYSCTL_ZERO,
1110		.extra2		= SYSCTL_ONE,
1111	},
1112	{
1113		.procname	= "fib_multipath_hash_policy",
1114		.data		= &init_net.ipv4.sysctl_fib_multipath_hash_policy,
1115		.maxlen		= sizeof(u8),
1116		.mode		= 0644,
1117		.proc_handler	= proc_fib_multipath_hash_policy,
1118		.extra1		= SYSCTL_ZERO,
1119		.extra2		= SYSCTL_THREE,
1120	},
1121	{
1122		.procname	= "fib_multipath_hash_fields",
1123		.data		= &init_net.ipv4.sysctl_fib_multipath_hash_fields,
1124		.maxlen		= sizeof(u32),
1125		.mode		= 0644,
1126		.proc_handler	= proc_fib_multipath_hash_fields,
1127		.extra1		= SYSCTL_ONE,
1128		.extra2		= &fib_multipath_hash_fields_all_mask,
1129	},
1130	{
1131		.procname	= "fib_multipath_hash_seed",
1132		.data		= &init_net,
1133		.maxlen		= sizeof(u32),
1134		.mode		= 0644,
1135		.proc_handler	= proc_fib_multipath_hash_seed,
1136	},
1137#endif
1138	{
1139		.procname	= "ip_unprivileged_port_start",
1140		.maxlen		= sizeof(int),
1141		.data		= &init_net.ipv4.sysctl_ip_prot_sock,
1142		.mode		= 0644,
1143		.proc_handler	= ipv4_privileged_ports,
1144	},
1145#ifdef CONFIG_NET_L3_MASTER_DEV
1146	{
1147		.procname	= "udp_l3mdev_accept",
1148		.data		= &init_net.ipv4.sysctl_udp_l3mdev_accept,
1149		.maxlen		= sizeof(u8),
1150		.mode		= 0644,
1151		.proc_handler	= proc_dou8vec_minmax,
1152		.extra1		= SYSCTL_ZERO,
1153		.extra2		= SYSCTL_ONE,
1154	},
1155#endif
1156	{
1157		.procname	= "tcp_sack",
1158		.data		= &init_net.ipv4.sysctl_tcp_sack,
1159		.maxlen		= sizeof(u8),
1160		.mode		= 0644,
1161		.proc_handler	= proc_dou8vec_minmax,
1162	},
1163	{
1164		.procname	= "tcp_window_scaling",
1165		.data		= &init_net.ipv4.sysctl_tcp_window_scaling,
1166		.maxlen		= sizeof(u8),
1167		.mode		= 0644,
1168		.proc_handler	= proc_dou8vec_minmax,
1169	},
1170	{
1171		.procname	= "tcp_timestamps",
1172		.data		= &init_net.ipv4.sysctl_tcp_timestamps,
1173		.maxlen		= sizeof(u8),
1174		.mode		= 0644,
1175		.proc_handler	= proc_dou8vec_minmax,
1176	},
1177	{
1178		.procname	= "tcp_early_retrans",
1179		.data		= &init_net.ipv4.sysctl_tcp_early_retrans,
1180		.maxlen		= sizeof(u8),
1181		.mode		= 0644,
1182		.proc_handler	= proc_dou8vec_minmax,
1183		.extra1		= SYSCTL_ZERO,
1184		.extra2		= SYSCTL_FOUR,
1185	},
1186	{
1187		.procname	= "tcp_recovery",
1188		.data		= &init_net.ipv4.sysctl_tcp_recovery,
1189		.maxlen		= sizeof(u8),
1190		.mode		= 0644,
1191		.proc_handler	= proc_dou8vec_minmax,
1192	},
1193	{
1194		.procname       = "tcp_thin_linear_timeouts",
1195		.data           = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts,
1196		.maxlen         = sizeof(u8),
1197		.mode           = 0644,
1198		.proc_handler   = proc_dou8vec_minmax,
1199	},
1200	{
1201		.procname	= "tcp_slow_start_after_idle",
1202		.data		= &init_net.ipv4.sysctl_tcp_slow_start_after_idle,
1203		.maxlen		= sizeof(u8),
1204		.mode		= 0644,
1205		.proc_handler	= proc_dou8vec_minmax,
1206	},
1207	{
1208		.procname	= "tcp_retrans_collapse",
1209		.data		= &init_net.ipv4.sysctl_tcp_retrans_collapse,
1210		.maxlen		= sizeof(u8),
1211		.mode		= 0644,
1212		.proc_handler	= proc_dou8vec_minmax,
1213	},
1214	{
1215		.procname	= "tcp_stdurg",
1216		.data		= &init_net.ipv4.sysctl_tcp_stdurg,
1217		.maxlen		= sizeof(u8),
1218		.mode		= 0644,
1219		.proc_handler	= proc_dou8vec_minmax,
1220	},
1221	{
1222		.procname	= "tcp_rfc1337",
1223		.data		= &init_net.ipv4.sysctl_tcp_rfc1337,
1224		.maxlen		= sizeof(u8),
1225		.mode		= 0644,
1226		.proc_handler	= proc_dou8vec_minmax,
1227	},
1228	{
1229		.procname	= "tcp_abort_on_overflow",
1230		.data		= &init_net.ipv4.sysctl_tcp_abort_on_overflow,
1231		.maxlen		= sizeof(u8),
1232		.mode		= 0644,
1233		.proc_handler	= proc_dou8vec_minmax,
1234	},
1235	{
1236		.procname	= "tcp_fack",
1237		.data		= &init_net.ipv4.sysctl_tcp_fack,
1238		.maxlen		= sizeof(u8),
1239		.mode		= 0644,
1240		.proc_handler	= proc_dou8vec_minmax,
1241	},
1242	{
1243		.procname	= "tcp_max_reordering",
1244		.data		= &init_net.ipv4.sysctl_tcp_max_reordering,
1245		.maxlen		= sizeof(int),
1246		.mode		= 0644,
1247		.proc_handler	= proc_dointvec
1248	},
1249	{
1250		.procname	= "tcp_dsack",
1251		.data		= &init_net.ipv4.sysctl_tcp_dsack,
1252		.maxlen		= sizeof(u8),
1253		.mode		= 0644,
1254		.proc_handler	= proc_dou8vec_minmax,
1255	},
1256	{
1257		.procname	= "tcp_app_win",
1258		.data		= &init_net.ipv4.sysctl_tcp_app_win,
1259		.maxlen		= sizeof(u8),
1260		.mode		= 0644,
1261		.proc_handler	= proc_dou8vec_minmax,
1262		.extra1		= SYSCTL_ZERO,
1263		.extra2		= &tcp_app_win_max,
1264	},
1265	{
1266		.procname	= "tcp_adv_win_scale",
1267		.data		= &init_net.ipv4.sysctl_tcp_adv_win_scale,
1268		.maxlen		= sizeof(int),
1269		.mode		= 0644,
1270		.proc_handler	= proc_dointvec_minmax,
1271		.extra1		= &tcp_adv_win_scale_min,
1272		.extra2		= &tcp_adv_win_scale_max,
1273	},
1274	{
1275		.procname	= "tcp_frto",
1276		.data		= &init_net.ipv4.sysctl_tcp_frto,
1277		.maxlen		= sizeof(u8),
1278		.mode		= 0644,
1279		.proc_handler	= proc_dou8vec_minmax,
1280	},
1281	{
1282		.procname	= "tcp_no_metrics_save",
1283		.data		= &init_net.ipv4.sysctl_tcp_nometrics_save,
1284		.maxlen		= sizeof(u8),
1285		.mode		= 0644,
1286		.proc_handler	= proc_dou8vec_minmax,
1287	},
1288	{
1289		.procname	= "tcp_no_ssthresh_metrics_save",
1290		.data		= &init_net.ipv4.sysctl_tcp_no_ssthresh_metrics_save,
1291		.maxlen		= sizeof(u8),
1292		.mode		= 0644,
1293		.proc_handler	= proc_dou8vec_minmax,
1294		.extra1		= SYSCTL_ZERO,
1295		.extra2		= SYSCTL_ONE,
1296	},
1297	{
1298		.procname	= "tcp_moderate_rcvbuf",
1299		.data		= &init_net.ipv4.sysctl_tcp_moderate_rcvbuf,
1300		.maxlen		= sizeof(u8),
1301		.mode		= 0644,
1302		.proc_handler	= proc_dou8vec_minmax,
1303	},
1304	{
1305		.procname	= "tcp_tso_win_divisor",
1306		.data		= &init_net.ipv4.sysctl_tcp_tso_win_divisor,
1307		.maxlen		= sizeof(u8),
1308		.mode		= 0644,
1309		.proc_handler	= proc_dou8vec_minmax,
1310	},
1311	{
1312		.procname	= "tcp_workaround_signed_windows",
1313		.data		= &init_net.ipv4.sysctl_tcp_workaround_signed_windows,
1314		.maxlen		= sizeof(u8),
1315		.mode		= 0644,
1316		.proc_handler	= proc_dou8vec_minmax,
1317	},
1318	{
1319		.procname	= "tcp_limit_output_bytes",
1320		.data		= &init_net.ipv4.sysctl_tcp_limit_output_bytes,
1321		.maxlen		= sizeof(int),
1322		.mode		= 0644,
1323		.proc_handler	= proc_dointvec
1324	},
1325	{
1326		.procname	= "tcp_challenge_ack_limit",
1327		.data		= &init_net.ipv4.sysctl_tcp_challenge_ack_limit,
1328		.maxlen		= sizeof(int),
1329		.mode		= 0644,
1330		.proc_handler	= proc_dointvec
1331	},
1332	{
1333		.procname	= "tcp_min_tso_segs",
1334		.data		= &init_net.ipv4.sysctl_tcp_min_tso_segs,
1335		.maxlen		= sizeof(u8),
1336		.mode		= 0644,
1337		.proc_handler	= proc_dou8vec_minmax,
1338		.extra1		= SYSCTL_ONE,
1339	},
1340	{
1341		.procname	= "tcp_tso_rtt_log",
1342		.data		= &init_net.ipv4.sysctl_tcp_tso_rtt_log,
1343		.maxlen		= sizeof(u8),
1344		.mode		= 0644,
1345		.proc_handler	= proc_dou8vec_minmax,
1346	},
1347	{
1348		.procname	= "tcp_min_rtt_wlen",
1349		.data		= &init_net.ipv4.sysctl_tcp_min_rtt_wlen,
1350		.maxlen		= sizeof(int),
1351		.mode		= 0644,
1352		.proc_handler	= proc_dointvec_minmax,
1353		.extra1		= SYSCTL_ZERO,
1354		.extra2		= &one_day_secs
1355	},
1356	{
1357		.procname	= "tcp_autocorking",
1358		.data		= &init_net.ipv4.sysctl_tcp_autocorking,
1359		.maxlen		= sizeof(u8),
1360		.mode		= 0644,
1361		.proc_handler	= proc_dou8vec_minmax,
1362		.extra1		= SYSCTL_ZERO,
1363		.extra2		= SYSCTL_ONE,
1364	},
1365	{
1366		.procname	= "tcp_invalid_ratelimit",
1367		.data		= &init_net.ipv4.sysctl_tcp_invalid_ratelimit,
1368		.maxlen		= sizeof(int),
1369		.mode		= 0644,
1370		.proc_handler	= proc_dointvec_ms_jiffies,
1371	},
1372	{
1373		.procname	= "tcp_pacing_ss_ratio",
1374		.data		= &init_net.ipv4.sysctl_tcp_pacing_ss_ratio,
1375		.maxlen		= sizeof(int),
1376		.mode		= 0644,
1377		.proc_handler	= proc_dointvec_minmax,
1378		.extra1		= SYSCTL_ZERO,
1379		.extra2		= SYSCTL_ONE_THOUSAND,
1380	},
1381	{
1382		.procname	= "tcp_pacing_ca_ratio",
1383		.data		= &init_net.ipv4.sysctl_tcp_pacing_ca_ratio,
1384		.maxlen		= sizeof(int),
1385		.mode		= 0644,
1386		.proc_handler	= proc_dointvec_minmax,
1387		.extra1		= SYSCTL_ZERO,
1388		.extra2		= SYSCTL_ONE_THOUSAND,
1389	},
1390	{
1391		.procname	= "tcp_wmem",
1392		.data		= &init_net.ipv4.sysctl_tcp_wmem,
1393		.maxlen		= sizeof(init_net.ipv4.sysctl_tcp_wmem),
1394		.mode		= 0644,
1395		.proc_handler	= proc_dointvec_minmax,
1396		.extra1		= SYSCTL_ONE,
1397	},
1398	{
1399		.procname	= "tcp_rmem",
1400		.data		= &init_net.ipv4.sysctl_tcp_rmem,
1401		.maxlen		= sizeof(init_net.ipv4.sysctl_tcp_rmem),
1402		.mode		= 0644,
1403		.proc_handler	= proc_dointvec_minmax,
1404		.extra1		= SYSCTL_ONE,
1405	},
1406	{
1407		.procname	= "tcp_comp_sack_delay_ns",
1408		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_delay_ns,
1409		.maxlen		= sizeof(unsigned long),
1410		.mode		= 0644,
1411		.proc_handler	= proc_doulongvec_minmax,
1412	},
1413	{
1414		.procname	= "tcp_comp_sack_slack_ns",
1415		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_slack_ns,
1416		.maxlen		= sizeof(unsigned long),
1417		.mode		= 0644,
1418		.proc_handler	= proc_doulongvec_minmax,
1419	},
1420	{
1421		.procname	= "tcp_comp_sack_nr",
1422		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_nr,
1423		.maxlen		= sizeof(u8),
1424		.mode		= 0644,
1425		.proc_handler	= proc_dou8vec_minmax,
1426		.extra1		= SYSCTL_ZERO,
1427	},
1428	{
1429		.procname	= "tcp_backlog_ack_defer",
1430		.data		= &init_net.ipv4.sysctl_tcp_backlog_ack_defer,
1431		.maxlen		= sizeof(u8),
1432		.mode		= 0644,
1433		.proc_handler	= proc_dou8vec_minmax,
1434		.extra1		= SYSCTL_ZERO,
1435		.extra2		= SYSCTL_ONE,
1436	},
1437	{
1438		.procname       = "tcp_reflect_tos",
1439		.data           = &init_net.ipv4.sysctl_tcp_reflect_tos,
1440		.maxlen         = sizeof(u8),
1441		.mode           = 0644,
1442		.proc_handler   = proc_dou8vec_minmax,
1443		.extra1         = SYSCTL_ZERO,
1444		.extra2         = SYSCTL_ONE,
1445	},
1446	{
1447		.procname	= "tcp_ehash_entries",
1448		.data		= &init_net.ipv4.sysctl_tcp_child_ehash_entries,
1449		.mode		= 0444,
1450		.proc_handler	= proc_tcp_ehash_entries,
1451	},
1452	{
1453		.procname	= "tcp_child_ehash_entries",
1454		.data		= &init_net.ipv4.sysctl_tcp_child_ehash_entries,
1455		.maxlen		= sizeof(unsigned int),
1456		.mode		= 0644,
1457		.proc_handler	= proc_douintvec_minmax,
1458		.extra1		= SYSCTL_ZERO,
1459		.extra2		= &tcp_child_ehash_entries_max,
1460	},
1461	{
1462		.procname	= "udp_hash_entries",
1463		.data		= &init_net.ipv4.sysctl_udp_child_hash_entries,
1464		.mode		= 0444,
1465		.proc_handler	= proc_udp_hash_entries,
1466	},
1467	{
1468		.procname	= "udp_child_hash_entries",
1469		.data		= &init_net.ipv4.sysctl_udp_child_hash_entries,
1470		.maxlen		= sizeof(unsigned int),
1471		.mode		= 0644,
1472		.proc_handler	= proc_douintvec_minmax,
1473		.extra1		= SYSCTL_ZERO,
1474		.extra2		= &udp_child_hash_entries_max,
1475	},
1476	{
1477		.procname	= "udp_rmem_min",
1478		.data		= &init_net.ipv4.sysctl_udp_rmem_min,
1479		.maxlen		= sizeof(init_net.ipv4.sysctl_udp_rmem_min),
1480		.mode		= 0644,
1481		.proc_handler	= proc_dointvec_minmax,
1482		.extra1		= SYSCTL_ONE
1483	},
1484	{
1485		.procname	= "udp_wmem_min",
1486		.data		= &init_net.ipv4.sysctl_udp_wmem_min,
1487		.maxlen		= sizeof(init_net.ipv4.sysctl_udp_wmem_min),
1488		.mode		= 0644,
1489		.proc_handler	= proc_dointvec_minmax,
1490		.extra1		= SYSCTL_ONE
1491	},
1492	{
1493		.procname	= "fib_notify_on_flag_change",
1494		.data		= &init_net.ipv4.sysctl_fib_notify_on_flag_change,
1495		.maxlen		= sizeof(u8),
1496		.mode		= 0644,
1497		.proc_handler	= proc_dou8vec_minmax,
1498		.extra1		= SYSCTL_ZERO,
1499		.extra2		= SYSCTL_TWO,
1500	},
1501	{
1502		.procname       = "tcp_plb_enabled",
1503		.data           = &init_net.ipv4.sysctl_tcp_plb_enabled,
1504		.maxlen         = sizeof(u8),
1505		.mode           = 0644,
1506		.proc_handler   = proc_dou8vec_minmax,
1507		.extra1         = SYSCTL_ZERO,
1508		.extra2         = SYSCTL_ONE,
1509	},
1510	{
1511		.procname       = "tcp_plb_idle_rehash_rounds",
1512		.data           = &init_net.ipv4.sysctl_tcp_plb_idle_rehash_rounds,
1513		.maxlen         = sizeof(u8),
1514		.mode           = 0644,
1515		.proc_handler   = proc_dou8vec_minmax,
1516		.extra2		= &tcp_plb_max_rounds,
1517	},
1518	{
1519		.procname       = "tcp_plb_rehash_rounds",
1520		.data           = &init_net.ipv4.sysctl_tcp_plb_rehash_rounds,
1521		.maxlen         = sizeof(u8),
1522		.mode           = 0644,
1523		.proc_handler   = proc_dou8vec_minmax,
1524		.extra2         = &tcp_plb_max_rounds,
1525	},
1526	{
1527		.procname       = "tcp_plb_suspend_rto_sec",
1528		.data           = &init_net.ipv4.sysctl_tcp_plb_suspend_rto_sec,
1529		.maxlen         = sizeof(u8),
1530		.mode           = 0644,
1531		.proc_handler   = proc_dou8vec_minmax,
1532	},
1533	{
1534		.procname       = "tcp_plb_cong_thresh",
1535		.data           = &init_net.ipv4.sysctl_tcp_plb_cong_thresh,
1536		.maxlen         = sizeof(int),
1537		.mode           = 0644,
1538		.proc_handler   = proc_dointvec_minmax,
1539		.extra1         = SYSCTL_ZERO,
1540		.extra2         = &tcp_plb_max_cong_thresh,
1541	},
1542	{
1543		.procname	= "tcp_syn_linear_timeouts",
1544		.data		= &init_net.ipv4.sysctl_tcp_syn_linear_timeouts,
1545		.maxlen		= sizeof(u8),
1546		.mode		= 0644,
1547		.proc_handler	= proc_dou8vec_minmax,
1548		.extra1		= SYSCTL_ZERO,
1549		.extra2		= &tcp_syn_linear_timeouts_max,
1550	},
1551	{
1552		.procname	= "tcp_shrink_window",
1553		.data		= &init_net.ipv4.sysctl_tcp_shrink_window,
1554		.maxlen		= sizeof(u8),
1555		.mode		= 0644,
1556		.proc_handler	= proc_dou8vec_minmax,
1557		.extra1		= SYSCTL_ZERO,
1558		.extra2		= SYSCTL_ONE,
1559	},
1560	{
1561		.procname	= "tcp_pingpong_thresh",
1562		.data		= &init_net.ipv4.sysctl_tcp_pingpong_thresh,
1563		.maxlen		= sizeof(u8),
1564		.mode		= 0644,
1565		.proc_handler	= proc_dou8vec_minmax,
1566		.extra1		= SYSCTL_ONE,
1567	},
1568	{
1569		.procname	= "tcp_rto_min_us",
1570		.data		= &init_net.ipv4.sysctl_tcp_rto_min_us,
1571		.maxlen		= sizeof(int),
1572		.mode		= 0644,
1573		.proc_handler	= proc_dointvec_minmax,
1574		.extra1		= SYSCTL_ONE,
1575	},
1576};
1577
1578static __net_init int ipv4_sysctl_init_net(struct net *net)
1579{
1580	size_t table_size = ARRAY_SIZE(ipv4_net_table);
1581	struct ctl_table *table;
1582
1583	table = ipv4_net_table;
1584	if (!net_eq(net, &init_net)) {
1585		int i;
1586
1587		table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
1588		if (!table)
1589			goto err_alloc;
1590
1591		for (i = 0; i < table_size; i++) {
1592			if (table[i].data) {
1593				/* Update the variables to point into
1594				 * the current struct net
1595				 */
1596				table[i].data += (void *)net - (void *)&init_net;
1597			} else {
1598				/* Entries without data pointer are global;
1599				 * Make them read-only in non-init_net ns
1600				 */
1601				table[i].mode &= ~0222;
1602			}
1603		}
1604	}
1605
1606	net->ipv4.ipv4_hdr = register_net_sysctl_sz(net, "net/ipv4", table,
1607						    table_size);
1608	if (!net->ipv4.ipv4_hdr)
1609		goto err_reg;
1610
1611	net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
1612	if (!net->ipv4.sysctl_local_reserved_ports)
1613		goto err_ports;
1614
1615	proc_fib_multipath_hash_set_seed(net, 0);
1616
1617	return 0;
1618
1619err_ports:
1620	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1621err_reg:
1622	if (!net_eq(net, &init_net))
1623		kfree(table);
1624err_alloc:
1625	return -ENOMEM;
1626}
1627
1628static __net_exit void ipv4_sysctl_exit_net(struct net *net)
1629{
1630	const struct ctl_table *table;
1631
1632	kfree(net->ipv4.sysctl_local_reserved_ports);
1633	table = net->ipv4.ipv4_hdr->ctl_table_arg;
1634	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1635	kfree(table);
1636}
1637
1638static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
1639	.init = ipv4_sysctl_init_net,
1640	.exit = ipv4_sysctl_exit_net,
1641};
1642
1643static __init int sysctl_ipv4_init(void)
1644{
1645	struct ctl_table_header *hdr;
1646
1647	hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
1648	if (!hdr)
1649		return -ENOMEM;
1650
1651	proc_fib_multipath_hash_init_rand_seed();
1652
1653	if (register_pernet_subsys(&ipv4_sysctl_ops)) {
1654		unregister_net_sysctl_table(hdr);
1655		return -ENOMEM;
1656	}
1657
1658	return 0;
1659}
1660
1661__initcall(sysctl_ipv4_init);