Commit 83619623 authored by Peter Oskolkov's avatar Peter Oskolkov Committed by David S. Miller
Browse files

net/ipfrag: let ip[6]frag_high_thresh in ns be higher than in init_net 



Currently, ip[6]frag_high_thresh sysctl values in new namespaces are
hard-limited to those of the root/init ns.

There are at least two use cases when it would be desirable to
set the high_thresh values higher in a child namespace vs the global hard
limit:

- a security/ddos protection policy may lower the thresholds in the
  root/init ns but allow for a special exception in a child namespace
- testing: a test running in a namespace may want to set these
  thresholds higher in its namespace than what is in the root/init ns

The new behavior:

 # ip netns add testns
 # ip netns exec testns bash

 # sysctl -w net.ipv4.ipfrag_high_thresh=9000000
 net.ipv4.ipfrag_high_thresh = 9000000

 # sysctl net.ipv4.ipfrag_high_thresh
 net.ipv4.ipfrag_high_thresh = 9000000

 # sysctl -w net.ipv6.ip6frag_high_thresh=9000000
 net.ipv6.ip6frag_high_thresh = 9000000

 # sysctl net.ipv6.ip6frag_high_thresh
 net.ipv6.ip6frag_high_thresh = 9000000

The old behavior:

 # ip netns add testns
 # ip netns exec testns bash

 # sysctl -w net.ipv4.ipfrag_high_thresh=9000000
 net.ipv4.ipfrag_high_thresh = 9000000

 # sysctl net.ipv4.ipfrag_high_thresh
 net.ipv4.ipfrag_high_thresh = 4194304

 # sysctl -w net.ipv6.ip6frag_high_thresh=9000000
 net.ipv6.ip6frag_high_thresh = 9000000

 # sysctl net.ipv6.ip6frag_high_thresh
 net.ipv6.ip6frag_high_thresh = 4194304

Signed-off-by: default avatarPeter Oskolkov <posk@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2475f59c

net/ieee802154/6lowpan/reassembly.c

+0 −1
Original line number Original line Diff line number Diff line
@@ -463,7 +463,6 @@ static int __net_init lowpan_frags_ns_sysctl_register(struct net *net) 




		table[0].data = &ieee802154_lowpan->frags.high_thresh;

		table[0].data = &ieee802154_lowpan->frags.high_thresh;

		table[0].extra1 = &ieee802154_lowpan->frags.low_thresh;

		table[0].extra1 = &ieee802154_lowpan->frags.low_thresh;

		table[0].extra2 = &init_net.ieee802154_lowpan.frags.high_thresh;

		table[1].data = &ieee802154_lowpan->frags.low_thresh;

		table[1].data = &ieee802154_lowpan->frags.low_thresh;

		table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;

		table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;

		table[2].data = &ieee802154_lowpan->frags.timeout;

		table[2].data = &ieee802154_lowpan->frags.timeout;

net/ipv4/ip_fragment.c

+0 −1
Original line number Original line Diff line number Diff line
@@ -822,7 +822,6 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net) 




		table[0].data = &net->ipv4.frags.high_thresh;

		table[0].data = &net->ipv4.frags.high_thresh;

		table[0].extra1 = &net->ipv4.frags.low_thresh;

		table[0].extra1 = &net->ipv4.frags.low_thresh;

		table[0].extra2 = &init_net.ipv4.frags.high_thresh;

		table[1].data = &net->ipv4.frags.low_thresh;

		table[1].data = &net->ipv4.frags.low_thresh;

		table[1].extra2 = &net->ipv4.frags.high_thresh;

		table[1].extra2 = &net->ipv4.frags.high_thresh;

		table[2].data = &net->ipv4.frags.timeout;

		table[2].data = &net->ipv4.frags.timeout;

net/ipv6/reassembly.c

+0 −1
Original line number Original line Diff line number Diff line
@@ -554,7 +554,6 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net) 




		table[0].data = &net->ipv6.frags.high_thresh;

		table[0].data = &net->ipv6.frags.high_thresh;

		table[0].extra1 = &net->ipv6.frags.low_thresh;

		table[0].extra1 = &net->ipv6.frags.low_thresh;

		table[0].extra2 = &init_net.ipv6.frags.high_thresh;

		table[1].data = &net->ipv6.frags.low_thresh;

		table[1].data = &net->ipv6.frags.low_thresh;

		table[1].extra2 = &net->ipv6.frags.high_thresh;

		table[1].extra2 = &net->ipv6.frags.high_thresh;

		table[2].data = &net->ipv6.frags.timeout;

		table[2].data = &net->ipv6.frags.timeout;

CRA Git | Maintained and supported by SUSTech CRA and CCSE