1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * sysctl_net_ipv4.c: sysctl interface to net IPV4 subsystem.
   4 *
   5 * Begun April 1, 1996, Mike Shaver.
   6 * Added /proc/sys/net/ipv4 directory entry (empty =) ). [MS]
   7 */
   8
 
 
   9#include <linux/sysctl.h>
 
 
  10#include <linux/seqlock.h>
  11#include <linux/init.h>
  12#include <linux/slab.h>
 
 
 
  13#include <net/icmp.h>
  14#include <net/ip.h>
  15#include <net/ip_fib.h>
  16#include <net/tcp.h>
  17#include <net/udp.h>
  18#include <net/cipso_ipv4.h>
 
  19#include <net/ping.h>
  20#include <net/protocol.h>
  21#include <net/netevent.h>
  22
 
 
 
 
 
  23static int tcp_retr1_max = 255;
  24static int ip_local_port_range_min[] = { 1, 1 };
  25static int ip_local_port_range_max[] = { 65535, 65535 };
  26static int tcp_adv_win_scale_min = -31;
  27static int tcp_adv_win_scale_max = 31;
  28static int tcp_app_win_max = 31;
  29static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
  30static int tcp_min_snd_mss_max = 65535;
  31static int ip_privileged_port_min;
  32static int ip_privileged_port_max = 65535;
  33static int ip_ttl_min = 1;
  34static int ip_ttl_max = 255;
  35static int tcp_syn_retries_min = 1;
  36static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
  37static int tcp_syn_linear_timeouts_max = MAX_TCP_SYNCNT;
  38static unsigned long ip_ping_group_range_min[] = { 0, 0 };
  39static unsigned long ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
  40static u32 u32_max_div_HZ = UINT_MAX / HZ;
  41static int one_day_secs = 24 * 3600;
  42static u32 fib_multipath_hash_fields_all_mask __maybe_unused =
  43	FIB_MULTIPATH_HASH_FIELD_ALL_MASK;
  44static unsigned int tcp_child_ehash_entries_max = 16 * 1024 * 1024;
  45static unsigned int udp_child_hash_entries_max = UDP_HTABLE_SIZE_MAX;
  46static int tcp_plb_max_rounds = 31;
  47static int tcp_plb_max_cong_thresh = 256;
  48
  49/* obsolete */
  50static int sysctl_tcp_low_latency __read_mostly;
  51
  52/* Update system visible IP port range */
  53static void set_local_port_range(struct net *net, unsigned int low, unsigned int high)
  54{
  55	bool same_parity = !((low ^ high) & 1);
  56
 
  57	if (same_parity && !net->ipv4.ip_local_ports.warned) {
  58		net->ipv4.ip_local_ports.warned = true;
  59		pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n");
  60	}
  61	WRITE_ONCE(net->ipv4.ip_local_ports.range, high << 16 | low);
 
 
  62}
  63
  64/* Validate changes from /proc interface. */
  65static int ipv4_local_port_range(struct ctl_table *table, int write,
  66				 void *buffer, size_t *lenp, loff_t *ppos)
 
  67{
  68	struct net *net = table->data;
 
  69	int ret;
  70	int range[2];
  71	struct ctl_table tmp = {
  72		.data = &range,
  73		.maxlen = sizeof(range),
  74		.mode = table->mode,
  75		.extra1 = &ip_local_port_range_min,
  76		.extra2 = &ip_local_port_range_max,
  77	};
  78
  79	inet_get_local_port_range(net, &range[0], &range[1]);
  80
  81	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
  82
  83	if (write && ret == 0) {
  84		/* Ensure that the upper limit is not smaller than the lower,
  85		 * and that the lower does not encroach upon the privileged
  86		 * port limit.
  87		 */
  88		if ((range[1] < range[0]) ||
  89		    (range[0] < READ_ONCE(net->ipv4.sysctl_ip_prot_sock)))
  90			ret = -EINVAL;
  91		else
  92			set_local_port_range(net, range[0], range[1]);
  93	}
  94
  95	return ret;
  96}
  97
  98/* Validate changes from /proc interface. */
  99static int ipv4_privileged_ports(struct ctl_table *table, int write,
 100				void *buffer, size_t *lenp, loff_t *ppos)
 101{
 102	struct net *net = container_of(table->data, struct net,
 103	    ipv4.sysctl_ip_prot_sock);
 104	int ret;
 105	int pports;
 106	int range[2];
 107	struct ctl_table tmp = {
 108		.data = &pports,
 109		.maxlen = sizeof(pports),
 110		.mode = table->mode,
 111		.extra1 = &ip_privileged_port_min,
 112		.extra2 = &ip_privileged_port_max,
 113	};
 114
 115	pports = READ_ONCE(net->ipv4.sysctl_ip_prot_sock);
 116
 117	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 118
 119	if (write && ret == 0) {
 120		inet_get_local_port_range(net, &range[0], &range[1]);
 121		/* Ensure that the local port range doesn't overlap with the
 122		 * privileged port range.
 123		 */
 124		if (range[0] < pports)
 125			ret = -EINVAL;
 126		else
 127			WRITE_ONCE(net->ipv4.sysctl_ip_prot_sock, pports);
 128	}
 129
 130	return ret;
 131}
 132
 133static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high)
 134{
 135	kgid_t *data = table->data;
 136	struct net *net =
 137		container_of(table->data, struct net, ipv4.ping_group_range.range);
 138	unsigned int seq;
 139	do {
 140		seq = read_seqbegin(&net->ipv4.ping_group_range.lock);
 141
 142		*low = data[0];
 143		*high = data[1];
 144	} while (read_seqretry(&net->ipv4.ping_group_range.lock, seq));
 145}
 146
 147/* Update system visible IP port range */
 148static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high)
 149{
 150	kgid_t *data = table->data;
 151	struct net *net =
 152		container_of(table->data, struct net, ipv4.ping_group_range.range);
 153	write_seqlock(&net->ipv4.ping_group_range.lock);
 154	data[0] = low;
 155	data[1] = high;
 156	write_sequnlock(&net->ipv4.ping_group_range.lock);
 157}
 158
 159/* Validate changes from /proc interface. */
 160static int ipv4_ping_group_range(struct ctl_table *table, int write,
 161				 void *buffer, size_t *lenp, loff_t *ppos)
 
 162{
 163	struct user_namespace *user_ns = current_user_ns();
 164	int ret;
 165	unsigned long urange[2];
 166	kgid_t low, high;
 167	struct ctl_table tmp = {
 168		.data = &urange,
 169		.maxlen = sizeof(urange),
 170		.mode = table->mode,
 171		.extra1 = &ip_ping_group_range_min,
 172		.extra2 = &ip_ping_group_range_max,
 173	};
 174
 175	inet_get_ping_group_range_table(table, &low, &high);
 176	urange[0] = from_kgid_munged(user_ns, low);
 177	urange[1] = from_kgid_munged(user_ns, high);
 178	ret = proc_doulongvec_minmax(&tmp, write, buffer, lenp, ppos);
 179
 180	if (write && ret == 0) {
 181		low = make_kgid(user_ns, urange[0]);
 182		high = make_kgid(user_ns, urange[1]);
 183		if (!gid_valid(low) || !gid_valid(high))
 184			return -EINVAL;
 185		if (urange[1] < urange[0] || gid_lt(high, low)) {
 186			low = make_kgid(&init_user_ns, 1);
 187			high = make_kgid(&init_user_ns, 0);
 188		}
 189		set_ping_group_range(table, low, high);
 190	}
 191
 192	return ret;
 193}
 194
 195static int ipv4_fwd_update_priority(struct ctl_table *table, int write,
 196				    void *buffer, size_t *lenp, loff_t *ppos)
 197{
 198	struct net *net;
 199	int ret;
 200
 201	net = container_of(table->data, struct net,
 202			   ipv4.sysctl_ip_fwd_update_priority);
 203	ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos);
 204	if (write && ret == 0)
 205		call_netevent_notifiers(NETEVENT_IPV4_FWD_UPDATE_PRIORITY_UPDATE,
 206					net);
 207
 208	return ret;
 209}
 210
 211static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
 212				       void *buffer, size_t *lenp, loff_t *ppos)
 213{
 214	struct net *net = container_of(ctl->data, struct net,
 215				       ipv4.tcp_congestion_control);
 216	char val[TCP_CA_NAME_MAX];
 217	struct ctl_table tbl = {
 218		.data = val,
 219		.maxlen = TCP_CA_NAME_MAX,
 220	};
 221	int ret;
 222
 223	tcp_get_default_congestion_control(net, val);
 224
 225	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 226	if (write && ret == 0)
 227		ret = tcp_set_default_congestion_control(net, val);
 228	return ret;
 229}
 230
 231static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
 232						 int write, void *buffer,
 233						 size_t *lenp, loff_t *ppos)
 
 234{
 235	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
 236	int ret;
 237
 238	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 239	if (!tbl.data)
 240		return -ENOMEM;
 241	tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
 242	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 243	kfree(tbl.data);
 244	return ret;
 245}
 246
 247static int proc_allowed_congestion_control(struct ctl_table *ctl,
 248					   int write, void *buffer,
 249					   size_t *lenp, loff_t *ppos)
 
 250{
 251	struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
 252	int ret;
 253
 254	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 255	if (!tbl.data)
 256		return -ENOMEM;
 257
 258	tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
 259	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 260	if (write && ret == 0)
 261		ret = tcp_set_allowed_congestion_control(tbl.data);
 262	kfree(tbl.data);
 263	return ret;
 264}
 265
 266static int sscanf_key(char *buf, __le32 *key)
 267{
 268	u32 user_key[4];
 269	int i, ret = 0;
 270
 271	if (sscanf(buf, "%x-%x-%x-%x", user_key, user_key + 1,
 272		   user_key + 2, user_key + 3) != 4) {
 273		ret = -EINVAL;
 274	} else {
 275		for (i = 0; i < ARRAY_SIZE(user_key); i++)
 276			key[i] = cpu_to_le32(user_key[i]);
 277	}
 278	pr_debug("proc TFO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
 279		 user_key[0], user_key[1], user_key[2], user_key[3], buf, ret);
 280
 281	return ret;
 282}
 283
 284static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
 285				 void *buffer, size_t *lenp, loff_t *ppos)
 
 286{
 287	struct net *net = container_of(table->data, struct net,
 288	    ipv4.sysctl_tcp_fastopen);
 289	/* maxlen to print the list of keys in hex (*2), with dashes
 290	 * separating doublewords and a comma in between keys.
 291	 */
 292	struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH *
 293					    2 * TCP_FASTOPEN_KEY_MAX) +
 294					    (TCP_FASTOPEN_KEY_MAX * 5)) };
 295	u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)];
 296	__le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)];
 297	char *backup_data;
 298	int ret, i = 0, off = 0, n_keys;
 299
 300	tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
 301	if (!tbl.data)
 302		return -ENOMEM;
 303
 304	n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key);
 305	if (!n_keys) {
 306		memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH);
 307		n_keys = 1;
 308	}
 309
 310	for (i = 0; i < n_keys * 4; i++)
 311		user_key[i] = le32_to_cpu(key[i]);
 312
 313	for (i = 0; i < n_keys; i++) {
 314		off += snprintf(tbl.data + off, tbl.maxlen - off,
 315				"%08x-%08x-%08x-%08x",
 316				user_key[i * 4],
 317				user_key[i * 4 + 1],
 318				user_key[i * 4 + 2],
 319				user_key[i * 4 + 3]);
 320
 321		if (WARN_ON_ONCE(off >= tbl.maxlen - 1))
 322			break;
 323
 324		if (i + 1 < n_keys)
 325			off += snprintf(tbl.data + off, tbl.maxlen - off, ",");
 326	}
 327
 
 
 328	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 329
 330	if (write && ret == 0) {
 331		backup_data = strchr(tbl.data, ',');
 332		if (backup_data) {
 333			*backup_data = '\0';
 334			backup_data++;
 335		}
 336		if (sscanf_key(tbl.data, key)) {
 337			ret = -EINVAL;
 338			goto bad_key;
 339		}
 340		if (backup_data) {
 341			if (sscanf_key(backup_data, key + 4)) {
 342				ret = -EINVAL;
 343				goto bad_key;
 344			}
 345		}
 346		tcp_fastopen_reset_cipher(net, NULL, key,
 347					  backup_data ? key + 4 : NULL);
 348	}
 349
 350bad_key:
 
 
 
 351	kfree(tbl.data);
 352	return ret;
 353}
 354
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 355static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
 356					     int write, void *buffer,
 
 357					     size_t *lenp, loff_t *ppos)
 358{
 359	struct net *net = container_of(table->data, struct net,
 360	    ipv4.sysctl_tcp_fastopen_blackhole_timeout);
 361	int ret;
 362
 363	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 364	if (write && ret == 0)
 365		atomic_set(&net->ipv4.tfo_active_disable_times, 0);
 366
 367	return ret;
 368}
 369
 370static int proc_tcp_available_ulp(struct ctl_table *ctl,
 371				  int write, void *buffer, size_t *lenp,
 
 372				  loff_t *ppos)
 373{
 374	struct ctl_table tbl = { .maxlen = TCP_ULP_BUF_MAX, };
 375	int ret;
 376
 377	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
 378	if (!tbl.data)
 379		return -ENOMEM;
 380	tcp_get_available_ulp(tbl.data, TCP_ULP_BUF_MAX);
 381	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 382	kfree(tbl.data);
 383
 384	return ret;
 385}
 386
 387static int proc_tcp_ehash_entries(struct ctl_table *table, int write,
 388				  void *buffer, size_t *lenp, loff_t *ppos)
 389{
 390	struct net *net = container_of(table->data, struct net,
 391				       ipv4.sysctl_tcp_child_ehash_entries);
 392	struct inet_hashinfo *hinfo = net->ipv4.tcp_death_row.hashinfo;
 393	int tcp_ehash_entries;
 394	struct ctl_table tbl;
 395
 396	tcp_ehash_entries = hinfo->ehash_mask + 1;
 397
 398	/* A negative number indicates that the child netns
 399	 * shares the global ehash.
 400	 */
 401	if (!net_eq(net, &init_net) && !hinfo->pernet)
 402		tcp_ehash_entries *= -1;
 403
 404	memset(&tbl, 0, sizeof(tbl));
 405	tbl.data = &tcp_ehash_entries;
 406	tbl.maxlen = sizeof(int);
 407
 408	return proc_dointvec(&tbl, write, buffer, lenp, ppos);
 409}
 410
 411static int proc_udp_hash_entries(struct ctl_table *table, int write,
 412				 void *buffer, size_t *lenp, loff_t *ppos)
 413{
 414	struct net *net = container_of(table->data, struct net,
 415				       ipv4.sysctl_udp_child_hash_entries);
 416	int udp_hash_entries;
 417	struct ctl_table tbl;
 418
 419	udp_hash_entries = net->ipv4.udp_table->mask + 1;
 420
 421	/* A negative number indicates that the child netns
 422	 * shares the global udp_table.
 423	 */
 424	if (!net_eq(net, &init_net) && net->ipv4.udp_table == &udp_table)
 425		udp_hash_entries *= -1;
 426
 427	memset(&tbl, 0, sizeof(tbl));
 428	tbl.data = &udp_hash_entries;
 429	tbl.maxlen = sizeof(int);
 430
 431	return proc_dointvec(&tbl, write, buffer, lenp, ppos);
 432}
 433
 434#ifdef CONFIG_IP_ROUTE_MULTIPATH
 435static int proc_fib_multipath_hash_policy(struct ctl_table *table, int write,
 436					  void *buffer, size_t *lenp,
 437					  loff_t *ppos)
 438{
 439	struct net *net = container_of(table->data, struct net,
 440	    ipv4.sysctl_fib_multipath_hash_policy);
 441	int ret;
 442
 443	ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos);
 444	if (write && ret == 0)
 445		call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net);
 446
 447	return ret;
 448}
 449
 450static int proc_fib_multipath_hash_fields(struct ctl_table *table, int write,
 451					  void *buffer, size_t *lenp,
 452					  loff_t *ppos)
 453{
 454	struct net *net;
 455	int ret;
 456
 457	net = container_of(table->data, struct net,
 458			   ipv4.sysctl_fib_multipath_hash_fields);
 459	ret = proc_douintvec_minmax(table, write, buffer, lenp, ppos);
 460	if (write && ret == 0)
 461		call_netevent_notifiers(NETEVENT_IPV4_MPATH_HASH_UPDATE, net);
 462
 463	return ret;
 464}
 465#endif
 466
 467static struct ctl_table ipv4_table[] = {
 468	{
 469		.procname	= "tcp_max_orphans",
 470		.data		= &sysctl_tcp_max_orphans,
 471		.maxlen		= sizeof(int),
 472		.mode		= 0644,
 473		.proc_handler	= proc_dointvec
 474	},
 475	{
 476		.procname	= "inet_peer_threshold",
 477		.data		= &inet_peer_threshold,
 478		.maxlen		= sizeof(int),
 479		.mode		= 0644,
 480		.proc_handler	= proc_dointvec
 481	},
 482	{
 483		.procname	= "inet_peer_minttl",
 484		.data		= &inet_peer_minttl,
 485		.maxlen		= sizeof(int),
 486		.mode		= 0644,
 487		.proc_handler	= proc_dointvec_jiffies,
 488	},
 489	{
 490		.procname	= "inet_peer_maxttl",
 491		.data		= &inet_peer_maxttl,
 492		.maxlen		= sizeof(int),
 493		.mode		= 0644,
 494		.proc_handler	= proc_dointvec_jiffies,
 495	},
 496	{
 497		.procname	= "tcp_mem",
 498		.maxlen		= sizeof(sysctl_tcp_mem),
 499		.data		= &sysctl_tcp_mem,
 500		.mode		= 0644,
 501		.proc_handler	= proc_doulongvec_minmax,
 502	},
 503	{
 504		.procname	= "tcp_low_latency",
 505		.data		= &sysctl_tcp_low_latency,
 506		.maxlen		= sizeof(int),
 507		.mode		= 0644,
 508		.proc_handler	= proc_dointvec
 509	},
 510#ifdef CONFIG_NETLABEL
 511	{
 512		.procname	= "cipso_cache_enable",
 513		.data		= &cipso_v4_cache_enabled,
 514		.maxlen		= sizeof(int),
 515		.mode		= 0644,
 516		.proc_handler	= proc_dointvec,
 517	},
 518	{
 519		.procname	= "cipso_cache_bucket_size",
 520		.data		= &cipso_v4_cache_bucketsize,
 521		.maxlen		= sizeof(int),
 522		.mode		= 0644,
 523		.proc_handler	= proc_dointvec,
 524	},
 525	{
 526		.procname	= "cipso_rbm_optfmt",
 527		.data		= &cipso_v4_rbm_optfmt,
 528		.maxlen		= sizeof(int),
 529		.mode		= 0644,
 530		.proc_handler	= proc_dointvec,
 531	},
 532	{
 533		.procname	= "cipso_rbm_strictvalid",
 534		.data		= &cipso_v4_rbm_strictvalid,
 535		.maxlen		= sizeof(int),
 536		.mode		= 0644,
 537		.proc_handler	= proc_dointvec,
 538	},
 539#endif /* CONFIG_NETLABEL */
 540	{
 
 
 
 
 
 
 
 
 
 
 
 
 541		.procname	= "tcp_available_ulp",
 542		.maxlen		= TCP_ULP_BUF_MAX,
 543		.mode		= 0444,
 544		.proc_handler   = proc_tcp_available_ulp,
 545	},
 546	{
 547		.procname	= "icmp_msgs_per_sec",
 548		.data		= &sysctl_icmp_msgs_per_sec,
 549		.maxlen		= sizeof(int),
 550		.mode		= 0644,
 551		.proc_handler	= proc_dointvec_minmax,
 552		.extra1		= SYSCTL_ZERO,
 553	},
 554	{
 555		.procname	= "icmp_msgs_burst",
 556		.data		= &sysctl_icmp_msgs_burst,
 557		.maxlen		= sizeof(int),
 558		.mode		= 0644,
 559		.proc_handler	= proc_dointvec_minmax,
 560		.extra1		= SYSCTL_ZERO,
 561	},
 562	{
 563		.procname	= "udp_mem",
 564		.data		= &sysctl_udp_mem,
 565		.maxlen		= sizeof(sysctl_udp_mem),
 566		.mode		= 0644,
 567		.proc_handler	= proc_doulongvec_minmax,
 568	},
 569	{
 570		.procname	= "fib_sync_mem",
 571		.data		= &sysctl_fib_sync_mem,
 572		.maxlen		= sizeof(sysctl_fib_sync_mem),
 573		.mode		= 0644,
 574		.proc_handler	= proc_douintvec_minmax,
 575		.extra1		= &sysctl_fib_sync_mem_min,
 576		.extra2		= &sysctl_fib_sync_mem_max,
 577	},
 578	{ }
 579};
 580
 581static struct ctl_table ipv4_net_table[] = {
 582	{
 583		.procname	= "tcp_max_tw_buckets",
 584		.data		= &init_net.ipv4.tcp_death_row.sysctl_max_tw_buckets,
 585		.maxlen		= sizeof(int),
 586		.mode		= 0644,
 587		.proc_handler	= proc_dointvec
 588	},
 589	{
 590		.procname	= "icmp_echo_ignore_all",
 591		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_all,
 592		.maxlen		= sizeof(u8),
 593		.mode		= 0644,
 594		.proc_handler	= proc_dou8vec_minmax,
 595		.extra1		= SYSCTL_ZERO,
 596		.extra2		= SYSCTL_ONE
 597	},
 598	{
 599		.procname	= "icmp_echo_enable_probe",
 600		.data		= &init_net.ipv4.sysctl_icmp_echo_enable_probe,
 601		.maxlen		= sizeof(u8),
 602		.mode		= 0644,
 603		.proc_handler	= proc_dou8vec_minmax,
 604		.extra1		= SYSCTL_ZERO,
 605		.extra2		= SYSCTL_ONE
 606	},
 607	{
 608		.procname	= "icmp_echo_ignore_broadcasts",
 609		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
 610		.maxlen		= sizeof(u8),
 611		.mode		= 0644,
 612		.proc_handler	= proc_dou8vec_minmax,
 613		.extra1		= SYSCTL_ZERO,
 614		.extra2		= SYSCTL_ONE
 615	},
 616	{
 617		.procname	= "icmp_ignore_bogus_error_responses",
 618		.data		= &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
 619		.maxlen		= sizeof(u8),
 620		.mode		= 0644,
 621		.proc_handler	= proc_dou8vec_minmax,
 622		.extra1		= SYSCTL_ZERO,
 623		.extra2		= SYSCTL_ONE
 624	},
 625	{
 626		.procname	= "icmp_errors_use_inbound_ifaddr",
 627		.data		= &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
 628		.maxlen		= sizeof(u8),
 629		.mode		= 0644,
 630		.proc_handler	= proc_dou8vec_minmax,
 631		.extra1		= SYSCTL_ZERO,
 632		.extra2		= SYSCTL_ONE
 633	},
 634	{
 635		.procname	= "icmp_ratelimit",
 636		.data		= &init_net.ipv4.sysctl_icmp_ratelimit,
 637		.maxlen		= sizeof(int),
 638		.mode		= 0644,
 639		.proc_handler	= proc_dointvec_ms_jiffies,
 640	},
 641	{
 642		.procname	= "icmp_ratemask",
 643		.data		= &init_net.ipv4.sysctl_icmp_ratemask,
 644		.maxlen		= sizeof(int),
 645		.mode		= 0644,
 646		.proc_handler	= proc_dointvec
 647	},
 648	{
 649		.procname	= "ping_group_range",
 650		.data		= &init_net.ipv4.ping_group_range.range,
 651		.maxlen		= sizeof(gid_t)*2,
 652		.mode		= 0644,
 653		.proc_handler	= ipv4_ping_group_range,
 654	},
 655#ifdef CONFIG_NET_L3_MASTER_DEV
 656	{
 657		.procname	= "raw_l3mdev_accept",
 658		.data		= &init_net.ipv4.sysctl_raw_l3mdev_accept,
 659		.maxlen		= sizeof(u8),
 660		.mode		= 0644,
 661		.proc_handler	= proc_dou8vec_minmax,
 662		.extra1		= SYSCTL_ZERO,
 663		.extra2		= SYSCTL_ONE,
 664	},
 665#endif
 666	{
 667		.procname	= "tcp_ecn",
 668		.data		= &init_net.ipv4.sysctl_tcp_ecn,
 669		.maxlen		= sizeof(u8),
 670		.mode		= 0644,
 671		.proc_handler	= proc_dou8vec_minmax,
 672		.extra1		= SYSCTL_ZERO,
 673		.extra2		= SYSCTL_TWO,
 674	},
 675	{
 676		.procname	= "tcp_ecn_fallback",
 677		.data		= &init_net.ipv4.sysctl_tcp_ecn_fallback,
 678		.maxlen		= sizeof(u8),
 679		.mode		= 0644,
 680		.proc_handler	= proc_dou8vec_minmax,
 681		.extra1		= SYSCTL_ZERO,
 682		.extra2		= SYSCTL_ONE,
 683	},
 684	{
 685		.procname	= "ip_dynaddr",
 686		.data		= &init_net.ipv4.sysctl_ip_dynaddr,
 687		.maxlen		= sizeof(u8),
 688		.mode		= 0644,
 689		.proc_handler	= proc_dou8vec_minmax,
 690	},
 691	{
 692		.procname	= "ip_early_demux",
 693		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 694		.maxlen		= sizeof(u8),
 695		.mode		= 0644,
 696		.proc_handler	= proc_dou8vec_minmax,
 697	},
 698	{
 699		.procname       = "udp_early_demux",
 700		.data           = &init_net.ipv4.sysctl_udp_early_demux,
 701		.maxlen         = sizeof(u8),
 702		.mode           = 0644,
 703		.proc_handler   = proc_dou8vec_minmax,
 704	},
 705	{
 706		.procname       = "tcp_early_demux",
 707		.data           = &init_net.ipv4.sysctl_tcp_early_demux,
 708		.maxlen         = sizeof(u8),
 709		.mode           = 0644,
 710		.proc_handler   = proc_dou8vec_minmax,
 711	},
 712	{
 713		.procname       = "nexthop_compat_mode",
 714		.data           = &init_net.ipv4.sysctl_nexthop_compat_mode,
 715		.maxlen         = sizeof(u8),
 716		.mode           = 0644,
 717		.proc_handler   = proc_dou8vec_minmax,
 718		.extra1		= SYSCTL_ZERO,
 719		.extra2		= SYSCTL_ONE,
 720	},
 721	{
 722		.procname	= "ip_default_ttl",
 723		.data		= &init_net.ipv4.sysctl_ip_default_ttl,
 724		.maxlen		= sizeof(u8),
 725		.mode		= 0644,
 726		.proc_handler	= proc_dou8vec_minmax,
 727		.extra1		= &ip_ttl_min,
 728		.extra2		= &ip_ttl_max,
 729	},
 730	{
 731		.procname	= "ip_local_port_range",
 732		.maxlen		= 0,
 733		.data		= &init_net,
 734		.mode		= 0644,
 735		.proc_handler	= ipv4_local_port_range,
 736	},
 737	{
 738		.procname	= "ip_local_reserved_ports",
 739		.data		= &init_net.ipv4.sysctl_local_reserved_ports,
 740		.maxlen		= 65536,
 741		.mode		= 0644,
 742		.proc_handler	= proc_do_large_bitmap,
 743	},
 744	{
 745		.procname	= "ip_no_pmtu_disc",
 746		.data		= &init_net.ipv4.sysctl_ip_no_pmtu_disc,
 747		.maxlen		= sizeof(u8),
 748		.mode		= 0644,
 749		.proc_handler	= proc_dou8vec_minmax,
 750	},
 751	{
 752		.procname	= "ip_forward_use_pmtu",
 753		.data		= &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
 754		.maxlen		= sizeof(u8),
 755		.mode		= 0644,
 756		.proc_handler	= proc_dou8vec_minmax,
 757	},
 758	{
 759		.procname	= "ip_forward_update_priority",
 760		.data		= &init_net.ipv4.sysctl_ip_fwd_update_priority,
 761		.maxlen		= sizeof(u8),
 762		.mode		= 0644,
 763		.proc_handler   = ipv4_fwd_update_priority,
 764		.extra1		= SYSCTL_ZERO,
 765		.extra2		= SYSCTL_ONE,
 766	},
 767	{
 768		.procname	= "ip_nonlocal_bind",
 769		.data		= &init_net.ipv4.sysctl_ip_nonlocal_bind,
 770		.maxlen		= sizeof(u8),
 771		.mode		= 0644,
 772		.proc_handler	= proc_dou8vec_minmax,
 773	},
 774	{
 775		.procname	= "ip_autobind_reuse",
 776		.data		= &init_net.ipv4.sysctl_ip_autobind_reuse,
 777		.maxlen		= sizeof(u8),
 778		.mode		= 0644,
 779		.proc_handler	= proc_dou8vec_minmax,
 780		.extra1         = SYSCTL_ZERO,
 781		.extra2         = SYSCTL_ONE,
 782	},
 783	{
 784		.procname	= "fwmark_reflect",
 785		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
 786		.maxlen		= sizeof(u8),
 787		.mode		= 0644,
 788		.proc_handler	= proc_dou8vec_minmax,
 789	},
 790	{
 791		.procname	= "tcp_fwmark_accept",
 792		.data		= &init_net.ipv4.sysctl_tcp_fwmark_accept,
 793		.maxlen		= sizeof(u8),
 794		.mode		= 0644,
 795		.proc_handler	= proc_dou8vec_minmax,
 796	},
 797#ifdef CONFIG_NET_L3_MASTER_DEV
 798	{
 799		.procname	= "tcp_l3mdev_accept",
 800		.data		= &init_net.ipv4.sysctl_tcp_l3mdev_accept,
 801		.maxlen		= sizeof(u8),
 802		.mode		= 0644,
 803		.proc_handler	= proc_dou8vec_minmax,
 804		.extra1		= SYSCTL_ZERO,
 805		.extra2		= SYSCTL_ONE,
 806	},
 807#endif
 808	{
 809		.procname	= "tcp_mtu_probing",
 810		.data		= &init_net.ipv4.sysctl_tcp_mtu_probing,
 811		.maxlen		= sizeof(u8),
 812		.mode		= 0644,
 813		.proc_handler	= proc_dou8vec_minmax,
 814	},
 815	{
 816		.procname	= "tcp_base_mss",
 817		.data		= &init_net.ipv4.sysctl_tcp_base_mss,
 818		.maxlen		= sizeof(int),
 819		.mode		= 0644,
 820		.proc_handler	= proc_dointvec,
 821	},
 822	{
 823		.procname	= "tcp_min_snd_mss",
 824		.data		= &init_net.ipv4.sysctl_tcp_min_snd_mss,
 825		.maxlen		= sizeof(int),
 826		.mode		= 0644,
 827		.proc_handler	= proc_dointvec_minmax,
 828		.extra1		= &tcp_min_snd_mss_min,
 829		.extra2		= &tcp_min_snd_mss_max,
 830	},
 831	{
 832		.procname	= "tcp_mtu_probe_floor",
 833		.data		= &init_net.ipv4.sysctl_tcp_mtu_probe_floor,
 834		.maxlen		= sizeof(int),
 835		.mode		= 0644,
 836		.proc_handler	= proc_dointvec_minmax,
 837		.extra1		= &tcp_min_snd_mss_min,
 838		.extra2		= &tcp_min_snd_mss_max,
 839	},
 840	{
 841		.procname	= "tcp_probe_threshold",
 842		.data		= &init_net.ipv4.sysctl_tcp_probe_threshold,
 843		.maxlen		= sizeof(int),
 844		.mode		= 0644,
 845		.proc_handler	= proc_dointvec,
 846	},
 847	{
 848		.procname	= "tcp_probe_interval",
 849		.data		= &init_net.ipv4.sysctl_tcp_probe_interval,
 850		.maxlen		= sizeof(u32),
 851		.mode		= 0644,
 852		.proc_handler	= proc_douintvec_minmax,
 853		.extra2		= &u32_max_div_HZ,
 854	},
 855	{
 856		.procname	= "igmp_link_local_mcast_reports",
 857		.data		= &init_net.ipv4.sysctl_igmp_llm_reports,
 858		.maxlen		= sizeof(u8),
 859		.mode		= 0644,
 860		.proc_handler	= proc_dou8vec_minmax,
 861	},
 862	{
 863		.procname	= "igmp_max_memberships",
 864		.data		= &init_net.ipv4.sysctl_igmp_max_memberships,
 865		.maxlen		= sizeof(int),
 866		.mode		= 0644,
 867		.proc_handler	= proc_dointvec
 868	},
 869	{
 870		.procname	= "igmp_max_msf",
 871		.data		= &init_net.ipv4.sysctl_igmp_max_msf,
 872		.maxlen		= sizeof(int),
 873		.mode		= 0644,
 874		.proc_handler	= proc_dointvec
 875	},
 876#ifdef CONFIG_IP_MULTICAST
 877	{
 878		.procname	= "igmp_qrv",
 879		.data		= &init_net.ipv4.sysctl_igmp_qrv,
 880		.maxlen		= sizeof(int),
 881		.mode		= 0644,
 882		.proc_handler	= proc_dointvec_minmax,
 883		.extra1		= SYSCTL_ONE
 884	},
 885#endif
 886	{
 887		.procname	= "tcp_congestion_control",
 888		.data		= &init_net.ipv4.tcp_congestion_control,
 889		.mode		= 0644,
 890		.maxlen		= TCP_CA_NAME_MAX,
 891		.proc_handler	= proc_tcp_congestion_control,
 892	},
 893	{
 894		.procname	= "tcp_available_congestion_control",
 895		.maxlen		= TCP_CA_BUF_MAX,
 896		.mode		= 0444,
 897		.proc_handler   = proc_tcp_available_congestion_control,
 898	},
 899	{
 900		.procname	= "tcp_allowed_congestion_control",
 901		.maxlen		= TCP_CA_BUF_MAX,
 902		.mode		= 0644,
 903		.proc_handler   = proc_allowed_congestion_control,
 904	},
 905	{
 906		.procname	= "tcp_keepalive_time",
 907		.data		= &init_net.ipv4.sysctl_tcp_keepalive_time,
 908		.maxlen		= sizeof(int),
 909		.mode		= 0644,
 910		.proc_handler	= proc_dointvec_jiffies,
 911	},
 912	{
 913		.procname	= "tcp_keepalive_probes",
 914		.data		= &init_net.ipv4.sysctl_tcp_keepalive_probes,
 915		.maxlen		= sizeof(u8),
 916		.mode		= 0644,
 917		.proc_handler	= proc_dou8vec_minmax,
 918	},
 919	{
 920		.procname	= "tcp_keepalive_intvl",
 921		.data		= &init_net.ipv4.sysctl_tcp_keepalive_intvl,
 922		.maxlen		= sizeof(int),
 923		.mode		= 0644,
 924		.proc_handler	= proc_dointvec_jiffies,
 925	},
 926	{
 927		.procname	= "tcp_syn_retries",
 928		.data		= &init_net.ipv4.sysctl_tcp_syn_retries,
 929		.maxlen		= sizeof(u8),
 930		.mode		= 0644,
 931		.proc_handler	= proc_dou8vec_minmax,
 932		.extra1		= &tcp_syn_retries_min,
 933		.extra2		= &tcp_syn_retries_max
 934	},
 935	{
 936		.procname	= "tcp_synack_retries",
 937		.data		= &init_net.ipv4.sysctl_tcp_synack_retries,
 938		.maxlen		= sizeof(u8),
 939		.mode		= 0644,
 940		.proc_handler	= proc_dou8vec_minmax,
 941	},
 942#ifdef CONFIG_SYN_COOKIES
 943	{
 944		.procname	= "tcp_syncookies",
 945		.data		= &init_net.ipv4.sysctl_tcp_syncookies,
 946		.maxlen		= sizeof(u8),
 947		.mode		= 0644,
 948		.proc_handler	= proc_dou8vec_minmax,
 949	},
 950#endif
 951	{
 952		.procname	= "tcp_migrate_req",
 953		.data		= &init_net.ipv4.sysctl_tcp_migrate_req,
 954		.maxlen		= sizeof(u8),
 955		.mode		= 0644,
 956		.proc_handler	= proc_dou8vec_minmax,
 957		.extra1		= SYSCTL_ZERO,
 958		.extra2		= SYSCTL_ONE
 959	},
 960	{
 961		.procname	= "tcp_reordering",
 962		.data		= &init_net.ipv4.sysctl_tcp_reordering,
 963		.maxlen		= sizeof(int),
 964		.mode		= 0644,
 965		.proc_handler	= proc_dointvec
 966	},
 967	{
 968		.procname	= "tcp_retries1",
 969		.data		= &init_net.ipv4.sysctl_tcp_retries1,
 970		.maxlen		= sizeof(u8),
 971		.mode		= 0644,
 972		.proc_handler	= proc_dou8vec_minmax,
 973		.extra2		= &tcp_retr1_max
 974	},
 975	{
 976		.procname	= "tcp_retries2",
 977		.data		= &init_net.ipv4.sysctl_tcp_retries2,
 978		.maxlen		= sizeof(u8),
 979		.mode		= 0644,
 980		.proc_handler	= proc_dou8vec_minmax,
 981	},
 982	{
 983		.procname	= "tcp_orphan_retries",
 984		.data		= &init_net.ipv4.sysctl_tcp_orphan_retries,
 985		.maxlen		= sizeof(u8),
 986		.mode		= 0644,
 987		.proc_handler	= proc_dou8vec_minmax,
 988	},
 989	{
 990		.procname	= "tcp_fin_timeout",
 991		.data		= &init_net.ipv4.sysctl_tcp_fin_timeout,
 992		.maxlen		= sizeof(int),
 993		.mode		= 0644,
 994		.proc_handler	= proc_dointvec_jiffies,
 995	},
 996	{
 997		.procname	= "tcp_notsent_lowat",
 998		.data		= &init_net.ipv4.sysctl_tcp_notsent_lowat,
 999		.maxlen		= sizeof(unsigned int),
1000		.mode		= 0644,
1001		.proc_handler	= proc_douintvec,
1002	},
1003	{
1004		.procname	= "tcp_tw_reuse",
1005		.data		= &init_net.ipv4.sysctl_tcp_tw_reuse,
1006		.maxlen		= sizeof(u8),
1007		.mode		= 0644,
1008		.proc_handler	= proc_dou8vec_minmax,
1009		.extra1		= SYSCTL_ZERO,
1010		.extra2		= SYSCTL_TWO,
 
 
 
 
 
1011	},
1012	{
1013		.procname	= "tcp_max_syn_backlog",
1014		.data		= &init_net.ipv4.sysctl_max_syn_backlog,
1015		.maxlen		= sizeof(int),
1016		.mode		= 0644,
1017		.proc_handler	= proc_dointvec
1018	},
1019	{
1020		.procname	= "tcp_fastopen",
1021		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1022		.maxlen		= sizeof(int),
1023		.mode		= 0644,
1024		.proc_handler	= proc_dointvec,
1025	},
1026	{
1027		.procname	= "tcp_fastopen_key",
1028		.mode		= 0600,
1029		.data		= &init_net.ipv4.sysctl_tcp_fastopen,
1030		/* maxlen to print the list of keys in hex (*2), with dashes
1031		 * separating doublewords and a comma in between keys.
1032		 */
1033		.maxlen		= ((TCP_FASTOPEN_KEY_LENGTH *
1034				   2 * TCP_FASTOPEN_KEY_MAX) +
1035				   (TCP_FASTOPEN_KEY_MAX * 5)),
1036		.proc_handler	= proc_tcp_fastopen_key,
1037	},
1038	{
1039		.procname	= "tcp_fastopen_blackhole_timeout_sec",
1040		.data		= &init_net.ipv4.sysctl_tcp_fastopen_blackhole_timeout,
1041		.maxlen		= sizeof(int),
1042		.mode		= 0644,
1043		.proc_handler	= proc_tfo_blackhole_detect_timeout,
1044		.extra1		= SYSCTL_ZERO,
1045	},
1046#ifdef CONFIG_IP_ROUTE_MULTIPATH
1047	{
1048		.procname	= "fib_multipath_use_neigh",
1049		.data		= &init_net.ipv4.sysctl_fib_multipath_use_neigh,
1050		.maxlen		= sizeof(u8),
1051		.mode		= 0644,
1052		.proc_handler	= proc_dou8vec_minmax,
1053		.extra1		= SYSCTL_ZERO,
1054		.extra2		= SYSCTL_ONE,
1055	},
1056	{
1057		.procname	= "fib_multipath_hash_policy",
1058		.data		= &init_net.ipv4.sysctl_fib_multipath_hash_policy,
1059		.maxlen		= sizeof(u8),
1060		.mode		= 0644,
1061		.proc_handler	= proc_fib_multipath_hash_policy,
1062		.extra1		= SYSCTL_ZERO,
1063		.extra2		= SYSCTL_THREE,
1064	},
1065	{
1066		.procname	= "fib_multipath_hash_fields",
1067		.data		= &init_net.ipv4.sysctl_fib_multipath_hash_fields,
1068		.maxlen		= sizeof(u32),
1069		.mode		= 0644,
1070		.proc_handler	= proc_fib_multipath_hash_fields,
1071		.extra1		= SYSCTL_ONE,
1072		.extra2		= &fib_multipath_hash_fields_all_mask,
1073	},
1074#endif
1075	{
1076		.procname	= "ip_unprivileged_port_start",
1077		.maxlen		= sizeof(int),
1078		.data		= &init_net.ipv4.sysctl_ip_prot_sock,
1079		.mode		= 0644,
1080		.proc_handler	= ipv4_privileged_ports,
1081	},
1082#ifdef CONFIG_NET_L3_MASTER_DEV
1083	{
1084		.procname	= "udp_l3mdev_accept",
1085		.data		= &init_net.ipv4.sysctl_udp_l3mdev_accept,
1086		.maxlen		= sizeof(u8),
1087		.mode		= 0644,
1088		.proc_handler	= proc_dou8vec_minmax,
1089		.extra1		= SYSCTL_ZERO,
1090		.extra2		= SYSCTL_ONE,
1091	},
1092#endif
1093	{
1094		.procname	= "tcp_sack",
1095		.data		= &init_net.ipv4.sysctl_tcp_sack,
1096		.maxlen		= sizeof(u8),
1097		.mode		= 0644,
1098		.proc_handler	= proc_dou8vec_minmax,
1099	},
1100	{
1101		.procname	= "tcp_window_scaling",
1102		.data		= &init_net.ipv4.sysctl_tcp_window_scaling,
1103		.maxlen		= sizeof(u8),
1104		.mode		= 0644,
1105		.proc_handler	= proc_dou8vec_minmax,
1106	},
1107	{
1108		.procname	= "tcp_timestamps",
1109		.data		= &init_net.ipv4.sysctl_tcp_timestamps,
1110		.maxlen		= sizeof(u8),
1111		.mode		= 0644,
1112		.proc_handler	= proc_dou8vec_minmax,
1113	},
1114	{
1115		.procname	= "tcp_early_retrans",
1116		.data		= &init_net.ipv4.sysctl_tcp_early_retrans,
1117		.maxlen		= sizeof(u8),
1118		.mode		= 0644,
1119		.proc_handler	= proc_dou8vec_minmax,
1120		.extra1		= SYSCTL_ZERO,
1121		.extra2		= SYSCTL_FOUR,
1122	},
1123	{
1124		.procname	= "tcp_recovery",
1125		.data		= &init_net.ipv4.sysctl_tcp_recovery,
1126		.maxlen		= sizeof(u8),
1127		.mode		= 0644,
1128		.proc_handler	= proc_dou8vec_minmax,
1129	},
1130	{
1131		.procname       = "tcp_thin_linear_timeouts",
1132		.data           = &init_net.ipv4.sysctl_tcp_thin_linear_timeouts,
1133		.maxlen         = sizeof(u8),
1134		.mode           = 0644,
1135		.proc_handler   = proc_dou8vec_minmax,
1136	},
1137	{
1138		.procname	= "tcp_slow_start_after_idle",
1139		.data		= &init_net.ipv4.sysctl_tcp_slow_start_after_idle,
1140		.maxlen		= sizeof(u8),
1141		.mode		= 0644,
1142		.proc_handler	= proc_dou8vec_minmax,
1143	},
1144	{
1145		.procname	= "tcp_retrans_collapse",
1146		.data		= &init_net.ipv4.sysctl_tcp_retrans_collapse,
1147		.maxlen		= sizeof(u8),
1148		.mode		= 0644,
1149		.proc_handler	= proc_dou8vec_minmax,
1150	},
1151	{
1152		.procname	= "tcp_stdurg",
1153		.data		= &init_net.ipv4.sysctl_tcp_stdurg,
1154		.maxlen		= sizeof(u8),
1155		.mode		= 0644,
1156		.proc_handler	= proc_dou8vec_minmax,
1157	},
1158	{
1159		.procname	= "tcp_rfc1337",
1160		.data		= &init_net.ipv4.sysctl_tcp_rfc1337,
1161		.maxlen		= sizeof(u8),
1162		.mode		= 0644,
1163		.proc_handler	= proc_dou8vec_minmax,
1164	},
1165	{
1166		.procname	= "tcp_abort_on_overflow",
1167		.data		= &init_net.ipv4.sysctl_tcp_abort_on_overflow,
1168		.maxlen		= sizeof(u8),
1169		.mode		= 0644,
1170		.proc_handler	= proc_dou8vec_minmax,
1171	},
1172	{
1173		.procname	= "tcp_fack",
1174		.data		= &init_net.ipv4.sysctl_tcp_fack,
1175		.maxlen		= sizeof(u8),
1176		.mode		= 0644,
1177		.proc_handler	= proc_dou8vec_minmax,
1178	},
1179	{
1180		.procname	= "tcp_max_reordering",
1181		.data		= &init_net.ipv4.sysctl_tcp_max_reordering,
1182		.maxlen		= sizeof(int),
1183		.mode		= 0644,
1184		.proc_handler	= proc_dointvec
1185	},
1186	{
1187		.procname	= "tcp_dsack",
1188		.data		= &init_net.ipv4.sysctl_tcp_dsack,
1189		.maxlen		= sizeof(u8),
1190		.mode		= 0644,
1191		.proc_handler	= proc_dou8vec_minmax,
1192	},
1193	{
1194		.procname	= "tcp_app_win",
1195		.data		= &init_net.ipv4.sysctl_tcp_app_win,
1196		.maxlen		= sizeof(u8),
1197		.mode		= 0644,
1198		.proc_handler	= proc_dou8vec_minmax,
1199		.extra1		= SYSCTL_ZERO,
1200		.extra2		= &tcp_app_win_max,
1201	},
1202	{
1203		.procname	= "tcp_adv_win_scale",
1204		.data		= &init_net.ipv4.sysctl_tcp_adv_win_scale,
1205		.maxlen		= sizeof(int),
1206		.mode		= 0644,
1207		.proc_handler	= proc_dointvec_minmax,
1208		.extra1		= &tcp_adv_win_scale_min,
1209		.extra2		= &tcp_adv_win_scale_max,
1210	},
1211	{
1212		.procname	= "tcp_frto",
1213		.data		= &init_net.ipv4.sysctl_tcp_frto,
1214		.maxlen		= sizeof(u8),
1215		.mode		= 0644,
1216		.proc_handler	= proc_dou8vec_minmax,
1217	},
1218	{
1219		.procname	= "tcp_no_metrics_save",
1220		.data		= &init_net.ipv4.sysctl_tcp_nometrics_save,
1221		.maxlen		= sizeof(u8),
1222		.mode		= 0644,
1223		.proc_handler	= proc_dou8vec_minmax,
1224	},
1225	{
1226		.procname	= "tcp_no_ssthresh_metrics_save",
1227		.data		= &init_net.ipv4.sysctl_tcp_no_ssthresh_metrics_save,
1228		.maxlen		= sizeof(u8),
1229		.mode		= 0644,
1230		.proc_handler	= proc_dou8vec_minmax,
1231		.extra1		= SYSCTL_ZERO,
1232		.extra2		= SYSCTL_ONE,
1233	},
1234	{
1235		.procname	= "tcp_moderate_rcvbuf",
1236		.data		= &init_net.ipv4.sysctl_tcp_moderate_rcvbuf,
1237		.maxlen		= sizeof(u8),
1238		.mode		= 0644,
1239		.proc_handler	= proc_dou8vec_minmax,
1240	},
1241	{
1242		.procname	= "tcp_tso_win_divisor",
1243		.data		= &init_net.ipv4.sysctl_tcp_tso_win_divisor,
1244		.maxlen		= sizeof(u8),
1245		.mode		= 0644,
1246		.proc_handler	= proc_dou8vec_minmax,
1247	},
1248	{
1249		.procname	= "tcp_workaround_signed_windows",
1250		.data		= &init_net.ipv4.sysctl_tcp_workaround_signed_windows,
1251		.maxlen		= sizeof(u8),
1252		.mode		= 0644,
1253		.proc_handler	= proc_dou8vec_minmax,
1254	},
1255	{
1256		.procname	= "tcp_limit_output_bytes",
1257		.data		= &init_net.ipv4.sysctl_tcp_limit_output_bytes,
1258		.maxlen		= sizeof(int),
1259		.mode		= 0644,
1260		.proc_handler	= proc_dointvec
1261	},
1262	{
1263		.procname	= "tcp_challenge_ack_limit",
1264		.data		= &init_net.ipv4.sysctl_tcp_challenge_ack_limit,
1265		.maxlen		= sizeof(int),
1266		.mode		= 0644,
1267		.proc_handler	= proc_dointvec
1268	},
1269	{
1270		.procname	= "tcp_min_tso_segs",
1271		.data		= &init_net.ipv4.sysctl_tcp_min_tso_segs,
1272		.maxlen		= sizeof(u8),
1273		.mode		= 0644,
1274		.proc_handler	= proc_dou8vec_minmax,
1275		.extra1		= SYSCTL_ONE,
1276	},
1277	{
1278		.procname	= "tcp_tso_rtt_log",
1279		.data		= &init_net.ipv4.sysctl_tcp_tso_rtt_log,
1280		.maxlen		= sizeof(u8),
1281		.mode		= 0644,
1282		.proc_handler	= proc_dou8vec_minmax,
 
 
1283	},
1284	{
1285		.procname	= "tcp_min_rtt_wlen",
1286		.data		= &init_net.ipv4.sysctl_tcp_min_rtt_wlen,
1287		.maxlen		= sizeof(int),
1288		.mode		= 0644,
1289		.proc_handler	= proc_dointvec_minmax,
1290		.extra1		= SYSCTL_ZERO,
1291		.extra2		= &one_day_secs
1292	},
1293	{
1294		.procname	= "tcp_autocorking",
1295		.data		= &init_net.ipv4.sysctl_tcp_autocorking,
1296		.maxlen		= sizeof(u8),
1297		.mode		= 0644,
1298		.proc_handler	= proc_dou8vec_minmax,
1299		.extra1		= SYSCTL_ZERO,
1300		.extra2		= SYSCTL_ONE,
1301	},
1302	{
1303		.procname	= "tcp_invalid_ratelimit",
1304		.data		= &init_net.ipv4.sysctl_tcp_invalid_ratelimit,
1305		.maxlen		= sizeof(int),
1306		.mode		= 0644,
1307		.proc_handler	= proc_dointvec_ms_jiffies,
1308	},
1309	{
1310		.procname	= "tcp_pacing_ss_ratio",
1311		.data		= &init_net.ipv4.sysctl_tcp_pacing_ss_ratio,
1312		.maxlen		= sizeof(int),
1313		.mode		= 0644,
1314		.proc_handler	= proc_dointvec_minmax,
1315		.extra1		= SYSCTL_ZERO,
1316		.extra2		= SYSCTL_ONE_THOUSAND,
1317	},
1318	{
1319		.procname	= "tcp_pacing_ca_ratio",
1320		.data		= &init_net.ipv4.sysctl_tcp_pacing_ca_ratio,
1321		.maxlen		= sizeof(int),
1322		.mode		= 0644,
1323		.proc_handler	= proc_dointvec_minmax,
1324		.extra1		= SYSCTL_ZERO,
1325		.extra2		= SYSCTL_ONE_THOUSAND,
1326	},
1327	{
1328		.procname	= "tcp_wmem",
1329		.data		= &init_net.ipv4.sysctl_tcp_wmem,
1330		.maxlen		= sizeof(init_net.ipv4.sysctl_tcp_wmem),
1331		.mode		= 0644,
1332		.proc_handler	= proc_dointvec_minmax,
1333		.extra1		= SYSCTL_ONE,
1334	},
1335	{
1336		.procname	= "tcp_rmem",
1337		.data		= &init_net.ipv4.sysctl_tcp_rmem,
1338		.maxlen		= sizeof(init_net.ipv4.sysctl_tcp_rmem),
1339		.mode		= 0644,
1340		.proc_handler	= proc_dointvec_minmax,
1341		.extra1		= SYSCTL_ONE,
1342	},
1343	{
1344		.procname	= "tcp_comp_sack_delay_ns",
1345		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_delay_ns,
1346		.maxlen		= sizeof(unsigned long),
1347		.mode		= 0644,
1348		.proc_handler	= proc_doulongvec_minmax,
1349	},
1350	{
1351		.procname	= "tcp_comp_sack_slack_ns",
1352		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_slack_ns,
1353		.maxlen		= sizeof(unsigned long),
1354		.mode		= 0644,
1355		.proc_handler	= proc_doulongvec_minmax,
1356	},
1357	{
1358		.procname	= "tcp_comp_sack_nr",
1359		.data		= &init_net.ipv4.sysctl_tcp_comp_sack_nr,
1360		.maxlen		= sizeof(u8),
1361		.mode		= 0644,
1362		.proc_handler	= proc_dou8vec_minmax,
1363		.extra1		= SYSCTL_ZERO,
1364	},
1365	{
1366		.procname	= "tcp_backlog_ack_defer",
1367		.data		= &init_net.ipv4.sysctl_tcp_backlog_ack_defer,
1368		.maxlen		= sizeof(u8),
1369		.mode		= 0644,
1370		.proc_handler	= proc_dou8vec_minmax,
1371		.extra1		= SYSCTL_ZERO,
1372		.extra2		= SYSCTL_ONE,
1373	},
1374	{
1375		.procname       = "tcp_reflect_tos",
1376		.data           = &init_net.ipv4.sysctl_tcp_reflect_tos,
1377		.maxlen         = sizeof(u8),
1378		.mode           = 0644,
1379		.proc_handler   = proc_dou8vec_minmax,
1380		.extra1         = SYSCTL_ZERO,
1381		.extra2         = SYSCTL_ONE,
1382	},
1383	{
1384		.procname	= "tcp_ehash_entries",
1385		.data		= &init_net.ipv4.sysctl_tcp_child_ehash_entries,
1386		.mode		= 0444,
1387		.proc_handler	= proc_tcp_ehash_entries,
1388	},
1389	{
1390		.procname	= "tcp_child_ehash_entries",
1391		.data		= &init_net.ipv4.sysctl_tcp_child_ehash_entries,
1392		.maxlen		= sizeof(unsigned int),
1393		.mode		= 0644,
1394		.proc_handler	= proc_douintvec_minmax,
1395		.extra1		= SYSCTL_ZERO,
1396		.extra2		= &tcp_child_ehash_entries_max,
1397	},
1398	{
1399		.procname	= "udp_hash_entries",
1400		.data		= &init_net.ipv4.sysctl_udp_child_hash_entries,
1401		.mode		= 0444,
1402		.proc_handler	= proc_udp_hash_entries,
1403	},
1404	{
1405		.procname	= "udp_child_hash_entries",
1406		.data		= &init_net.ipv4.sysctl_udp_child_hash_entries,
1407		.maxlen		= sizeof(unsigned int),
1408		.mode		= 0644,
1409		.proc_handler	= proc_douintvec_minmax,
1410		.extra1		= SYSCTL_ZERO,
1411		.extra2		= &udp_child_hash_entries_max,
1412	},
1413	{
1414		.procname	= "udp_rmem_min",
1415		.data		= &init_net.ipv4.sysctl_udp_rmem_min,
1416		.maxlen		= sizeof(init_net.ipv4.sysctl_udp_rmem_min),
1417		.mode		= 0644,
1418		.proc_handler	= proc_dointvec_minmax,
1419		.extra1		= SYSCTL_ONE
1420	},
1421	{
1422		.procname	= "udp_wmem_min",
1423		.data		= &init_net.ipv4.sysctl_udp_wmem_min,
1424		.maxlen		= sizeof(init_net.ipv4.sysctl_udp_wmem_min),
1425		.mode		= 0644,
1426		.proc_handler	= proc_dointvec_minmax,
1427		.extra1		= SYSCTL_ONE
1428	},
1429	{
1430		.procname	= "fib_notify_on_flag_change",
1431		.data		= &init_net.ipv4.sysctl_fib_notify_on_flag_change,
1432		.maxlen		= sizeof(u8),
1433		.mode		= 0644,
1434		.proc_handler	= proc_dou8vec_minmax,
1435		.extra1		= SYSCTL_ZERO,
1436		.extra2		= SYSCTL_TWO,
1437	},
1438	{
1439		.procname       = "tcp_plb_enabled",
1440		.data           = &init_net.ipv4.sysctl_tcp_plb_enabled,
1441		.maxlen         = sizeof(u8),
1442		.mode           = 0644,
1443		.proc_handler   = proc_dou8vec_minmax,
1444		.extra1         = SYSCTL_ZERO,
1445		.extra2         = SYSCTL_ONE,
1446	},
1447	{
1448		.procname       = "tcp_plb_idle_rehash_rounds",
1449		.data           = &init_net.ipv4.sysctl_tcp_plb_idle_rehash_rounds,
1450		.maxlen         = sizeof(u8),
1451		.mode           = 0644,
1452		.proc_handler   = proc_dou8vec_minmax,
1453		.extra2		= &tcp_plb_max_rounds,
1454	},
1455	{
1456		.procname       = "tcp_plb_rehash_rounds",
1457		.data           = &init_net.ipv4.sysctl_tcp_plb_rehash_rounds,
1458		.maxlen         = sizeof(u8),
1459		.mode           = 0644,
1460		.proc_handler   = proc_dou8vec_minmax,
1461		.extra2         = &tcp_plb_max_rounds,
1462	},
1463	{
1464		.procname       = "tcp_plb_suspend_rto_sec",
1465		.data           = &init_net.ipv4.sysctl_tcp_plb_suspend_rto_sec,
1466		.maxlen         = sizeof(u8),
1467		.mode           = 0644,
1468		.proc_handler   = proc_dou8vec_minmax,
1469	},
1470	{
1471		.procname       = "tcp_plb_cong_thresh",
1472		.data           = &init_net.ipv4.sysctl_tcp_plb_cong_thresh,
1473		.maxlen         = sizeof(int),
1474		.mode           = 0644,
1475		.proc_handler   = proc_dointvec_minmax,
1476		.extra1         = SYSCTL_ZERO,
1477		.extra2         = &tcp_plb_max_cong_thresh,
1478	},
1479	{
1480		.procname	= "tcp_syn_linear_timeouts",
1481		.data		= &init_net.ipv4.sysctl_tcp_syn_linear_timeouts,
1482		.maxlen		= sizeof(u8),
1483		.mode		= 0644,
1484		.proc_handler	= proc_dou8vec_minmax,
1485		.extra1		= SYSCTL_ZERO,
1486		.extra2		= &tcp_syn_linear_timeouts_max,
1487	},
1488	{
1489		.procname	= "tcp_shrink_window",
1490		.data		= &init_net.ipv4.sysctl_tcp_shrink_window,
1491		.maxlen		= sizeof(u8),
1492		.mode		= 0644,
1493		.proc_handler	= proc_dou8vec_minmax,
1494		.extra1		= SYSCTL_ZERO,
1495		.extra2		= SYSCTL_ONE,
1496	},
1497	{
1498		.procname	= "tcp_pingpong_thresh",
1499		.data		= &init_net.ipv4.sysctl_tcp_pingpong_thresh,
1500		.maxlen		= sizeof(u8),
1501		.mode		= 0644,
1502		.proc_handler	= proc_dou8vec_minmax,
1503		.extra1		= SYSCTL_ONE,
1504	},
1505	{ }
1506};
1507
1508static __net_init int ipv4_sysctl_init_net(struct net *net)
1509{
1510	struct ctl_table *table;
1511
1512	table = ipv4_net_table;
1513	if (!net_eq(net, &init_net)) {
1514		int i;
1515
1516		table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
1517		if (!table)
1518			goto err_alloc;
1519
1520		for (i = 0; i < ARRAY_SIZE(ipv4_net_table) - 1; i++) {
1521			if (table[i].data) {
1522				/* Update the variables to point into
1523				 * the current struct net
1524				 */
1525				table[i].data += (void *)net - (void *)&init_net;
1526			} else {
1527				/* Entries without data pointer are global;
1528				 * Make them read-only in non-init_net ns
1529				 */
1530				table[i].mode &= ~0222;
1531			}
1532		}
1533	}
1534
1535	net->ipv4.ipv4_hdr = register_net_sysctl_sz(net, "net/ipv4", table,
1536						    ARRAY_SIZE(ipv4_net_table));
1537	if (!net->ipv4.ipv4_hdr)
1538		goto err_reg;
1539
1540	net->ipv4.sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
1541	if (!net->ipv4.sysctl_local_reserved_ports)
1542		goto err_ports;
1543
1544	return 0;
1545
1546err_ports:
1547	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1548err_reg:
1549	if (!net_eq(net, &init_net))
1550		kfree(table);
1551err_alloc:
1552	return -ENOMEM;
1553}
1554
1555static __net_exit void ipv4_sysctl_exit_net(struct net *net)
1556{
1557	struct ctl_table *table;
1558
1559	kfree(net->ipv4.sysctl_local_reserved_ports);
1560	table = net->ipv4.ipv4_hdr->ctl_table_arg;
1561	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
1562	kfree(table);
1563}
1564
1565static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
1566	.init = ipv4_sysctl_init_net,
1567	.exit = ipv4_sysctl_exit_net,
1568};
1569
1570static __init int sysctl_ipv4_init(void)
1571{
1572	struct ctl_table_header *hdr;
1573
1574	hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
1575	if (!hdr)
1576		return -ENOMEM;
1577
1578	if (register_pernet_subsys(&ipv4_sysctl_ops)) {
1579		unregister_net_sysctl_table(hdr);
1580		return -ENOMEM;
1581	}
1582
1583	return 0;
1584}
1585
1586__initcall(sysctl_ipv4_init);