Commit 06e6c88f authored by Alexander Kuznetsov's avatar Alexander Kuznetsov Committed by David S. Miller
Browse files

ipv6: enable net.ipv6.route.max_size sysctl in network namespace 



We want to increase route cache size in network namespace
created with user namespace. Currently ipv6 route settings
are disabled for non-initial network namespaces.
We can allow this sysctl and it will be safe since
commit <6126891c> because route cache account to kmem,
that is why users from user namespace can not DOS system.

Signed-off-by: default avatarAlexander Kuznetsov <wwfq@yandex-team.ru>
Acked-by: default avatarDmitry Yakunin <zeil@yandex-team.ru>
Acked-by: default avatarDmitry Monakhov <dmtrmonakhov@yandex-team.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e0b4f1cd

net/ipv6/route.c

+12 −12
Original line number Diff line number Diff line
@@ -6306,11 +6306,11 @@ static int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write, 


static struct ctl_table ipv6_route_table_template[] = {

	{

		.procname	=	"flush",

		.data		=	&init_net.ipv6.sysctl.flush_delay,

		.procname	=	"max_size",

		.data		=	&init_net.ipv6.sysctl.ip6_rt_max_size,

		.maxlen		=	sizeof(int),

		.mode		=	0200,

		.proc_handler	=	ipv6_sysctl_rtcache_flush

		.mode		=	0644,

		.proc_handler	=	proc_dointvec,

	},

	{

		.procname	=	"gc_thresh",
@@ -6320,11 +6320,11 @@ static struct ctl_table ipv6_route_table_template[] = { 
		.proc_handler	=	proc_dointvec,

	},

	{

		.procname	=	"max_size",

		.data		=	&init_net.ipv6.sysctl.ip6_rt_max_size,

		.procname	=	"flush",

		.data		=	&init_net.ipv6.sysctl.flush_delay,

		.maxlen		=	sizeof(int),

		.mode		=	0644,

		.proc_handler	=	proc_dointvec,

		.mode		=	0200,

		.proc_handler	=	ipv6_sysctl_rtcache_flush

	},

	{

		.procname	=	"gc_min_interval",
@@ -6396,10 +6396,10 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net) 
			GFP_KERNEL);



	if (table) {

		table[0].data = &net->ipv6.sysctl.flush_delay;

		table[0].extra1 = net;

		table[0].data = &net->ipv6.sysctl.ip6_rt_max_size;

		table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;

		table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;

		table[2].data = &net->ipv6.sysctl.flush_delay;

		table[2].extra1 = net;

		table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;

		table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;

		table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
@@ -6411,7 +6411,7 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net) 


		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

			table[0].procname = NULL;

			table[1].procname = NULL;

	}



	return table;