Re: [PATCH 12/13 net-next] net: ipv4: disable IPv4-only sysctls when CONFIG_IPV4=n

[Joel Granados]

On Thu, Sep 10, 2026 at 04:48:37PM +0200, Fernando Fernandez Mancera wrote:
> To avoid noise and unexpected problems, let's hide all the sysctls that
> are related to IPv4 only when the kernel is compiled without IPv4
> support.
> 
> Signed-off-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>
> ---
>  net/ipv4/sysctl_net_ipv4.c | 30 +++++++++++++++++++++++++++---
>  1 file changed, 27 insertions(+), 3 deletions(-)
> 
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index f6c7b755fa7e..f86883ea0c20 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -31,8 +31,8 @@ static int tcp_min_snd_mss_max = 65535;
>  static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
>  static int ip_privileged_port_min;
>  static int ip_privileged_port_max = 65535;
> -static int ip_ttl_min = 1;
> -static int ip_ttl_max = 255;
> +static int ip_ttl_min __maybe_unused = 1;
> +static int ip_ttl_max __maybe_unused = 255;
>  static int tcp_syn_retries_min = 1;
>  static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
>  static int tcp_syn_linear_timeouts_max = MAX_TCP_SYNCNT;
> @@ -48,7 +48,7 @@ static int tcp_plb_max_rounds = 31;
>  static int tcp_plb_max_cong_thresh = 256;
>  static unsigned int tcp_tw_reuse_delay_max = TCP_PAWS_MSL * MSEC_PER_SEC;
>  static int tcp_ecn_mode_max = 5;
> -static u32 icmp_errors_extension_mask_all =
> +static u32 icmp_errors_extension_mask_all __maybe_unused =
>  	GENMASK_U8(ICMP_ERR_EXT_COUNT - 1, 0);
>  
>  /* obsolete */
> @@ -199,6 +199,7 @@ static int ipv4_ping_group_range(const struct ctl_table *table, int write,
>  	return ret;
>  }
>  
> +#if IS_ENABLED(CONFIG_IPV4)
>  static int ipv4_fwd_update_priority(const struct ctl_table *table, int write,
>  				    void *buffer, size_t *lenp, loff_t *ppos)
>  {
> @@ -214,6 +215,7 @@ static int ipv4_fwd_update_priority(const struct ctl_table *table, int write,
>  
>  	return ret;
>  }
> +#endif
>  
>  static int proc_tcp_congestion_control(const struct ctl_table *ctl, int write,
>  				       void *buffer, size_t *lenp, loff_t *ppos)
> @@ -439,6 +441,7 @@ static int proc_udp_hash_entries(const struct ctl_table *table, int write,
>  }
>  
>  #ifdef CONFIG_IP_ROUTE_MULTIPATH
> +#if IS_ENABLED(CONFIG_IPV4)
>  static int proc_fib_multipath_hash_policy(const struct ctl_table *table, int write,
>  					  void *buffer, size_t *lenp,
>  					  loff_t *ppos)
> @@ -469,6 +472,7 @@ static int proc_fib_multipath_hash_fields(const struct ctl_table *table, int wri
>  
>  	return ret;
>  }
> +#endif
>  
>  static u32 proc_fib_multipath_hash_rand_seed __ro_after_init;
>  
> @@ -490,6 +494,7 @@ static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed)
>  	WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.mp_seed, new.mp_seed);
>  }
>  
> +#if IS_ENABLED(CONFIG_IPV4)
>  static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write,
>  					void *buffer, size_t *lenp,
>  					loff_t *ppos)
> @@ -515,6 +520,7 @@ static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write
>  
>  	return ret;
>  }
> +#endif
>  #else
>  
>  static void proc_fib_multipath_hash_init_rand_seed(void)
> @@ -634,6 +640,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dointvec
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "icmp_echo_ignore_all",
>  		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_all,
> @@ -643,6 +650,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= SYSCTL_ZERO,
>  		.extra2		= SYSCTL_ONE
>  	},
> +#endif
>  	{
>  		.procname	= "icmp_echo_enable_probe",
>  		.data		= &init_net.ipv4.sysctl_icmp_echo_enable_probe,
> @@ -652,6 +660,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= SYSCTL_ZERO,
>  		.extra2		= SYSCTL_ONE
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "icmp_echo_ignore_broadcasts",
>  		.data		= &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
> @@ -702,6 +711,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dointvec
>  	},
> +#endif
>  	{
>  		.procname	= "icmp_msgs_per_sec",
>  		.data		= &init_net.ipv4.sysctl_icmp_msgs_per_sec,
> @@ -772,6 +782,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= SYSCTL_ZERO,
>  		.extra2		= SYSCTL_ONE,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "ip_dynaddr",
>  		.data		= &init_net.ipv4.sysctl_ip_dynaddr,
> @@ -779,6 +790,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dou8vec_minmax,
>  	},
> +#endif
>  	{
>  		.procname	= "ip_early_demux",
>  		.data		= &init_net.ipv4.sysctl_ip_early_demux,
> @@ -809,6 +821,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= SYSCTL_ZERO,
>  		.extra2		= SYSCTL_ONE,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "ip_default_ttl",
>  		.data		= &init_net.ipv4.sysctl_ip_default_ttl,
> @@ -818,6 +831,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= &ip_ttl_min,
>  		.extra2		= &ip_ttl_max,
>  	},
> +#endif
>  	{
>  		.procname	= "ip_local_port_range",
>  		.maxlen		= 0,
> @@ -839,6 +853,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_do_large_bitmap,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "ip_no_pmtu_disc",
>  		.data		= &init_net.ipv4.sysctl_ip_no_pmtu_disc,
> @@ -869,6 +884,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dou8vec_minmax,
>  	},
> +#endif
>  	{
>  		.procname	= "ip_autobind_reuse",
>  		.data		= &init_net.ipv4.sysctl_ip_autobind_reuse,
> @@ -878,6 +894,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1         = SYSCTL_ZERO,
>  		.extra2         = SYSCTL_ONE,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "fwmark_reflect",
>  		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
> @@ -885,6 +902,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dou8vec_minmax,
>  	},
> +#endif
>  	{
>  		.procname	= "tcp_fwmark_accept",
>  		.data		= &init_net.ipv4.sysctl_tcp_fwmark_accept,
> @@ -950,6 +968,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.proc_handler	= proc_douintvec_minmax,
>  		.extra2		= &u32_max_div_HZ,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
That is a *lot* of #if IS_ENABLED....#endif.

Is it possible to just have one #if...#endif and put all the related IPV4 sysctl
together?


>  	{
>  		.procname	= "igmp_link_local_mcast_reports",
>  		.data		= &init_net.ipv4.sysctl_igmp_llm_reports,
> @@ -980,6 +999,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.proc_handler	= proc_dointvec_minmax,
>  		.extra1		= SYSCTL_ONE
>  	},
> +#endif
>  #endif
>  	{
>  		.procname	= "tcp_congestion_control",
> @@ -1152,6 +1172,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.proc_handler	= proc_tfo_blackhole_detect_timeout,
>  		.extra1		= SYSCTL_ZERO,
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  #ifdef CONFIG_IP_ROUTE_MULTIPATH
>  	{
>  		.procname	= "fib_multipath_use_neigh",
> @@ -1187,6 +1208,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_fib_multipath_hash_seed,
>  	},
> +#endif
>  #endif
>  	{
>  		.procname	= "ip_unprivileged_port_start",
> @@ -1561,6 +1583,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.proc_handler	= proc_dointvec_minmax,
>  		.extra1		= SYSCTL_ONE
>  	},
> +#if IS_ENABLED(CONFIG_IPV4)
>  	{
>  		.procname	= "fib_notify_on_flag_change",
>  		.data		= &init_net.ipv4.sysctl_fib_notify_on_flag_change,
> @@ -1570,6 +1593,7 @@ static const struct ctl_table ipv4_net_table[] = {
>  		.extra1		= SYSCTL_ZERO,
>  		.extra2		= SYSCTL_TWO,
>  	},
> +#endif
>  	{
>  		.procname       = "tcp_plb_enabled",
>  		.data           = &init_net.ipv4.sysctl_tcp_plb_enabled,
> -- 
> 2.55.0
>

Attachment: signature.asc
Description: PGP signature