Re: [PATCH 11/16 net-next v2] ipv4: disable IPv4-only sysctls when CONFIG_IPV4=n
From: Joel Granados
Date: Tue Sep 29 2026 - 03:14:40 EST
On Mon, Sep 28, 2026 at 09:30:07PM +0200, Fernando Fernandez Mancera wrote:
> To avoid noise and unexpected problems, let's hide all the sysctls that
> are related to IPv4 only when the kernel is compiled without IPv4
> support.
You are hiding the IPV4 sysctl with "#if IS_ENABLED(CONFIG_IPV4)" inside
the sysctl_net_ipv4.c file. That is confusing as I would expect all
sysctl_net_ipv4.c to be ipv4 specific. Wouldn't it be cleaner to just
have an "ipv4" sysctl file and compile that when CONFIG_IPV4 is enabled?
I might be missing something obvious as I just got to see 3 patches of
the series. Ignore, if this is addressed at some other point.
Best
>
> Signed-off-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>
> ---
> net/ipv4/sysctl_net_ipv4.c | 407 +++++++++++++++++++------------------
> 1 file changed, 205 insertions(+), 202 deletions(-)
>
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index 0e7fef5973db..6096e9e4d82d 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -31,8 +31,8 @@ static int tcp_min_snd_mss_max = 65535;
> static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
> static int ip_privileged_port_min;
> static int ip_privileged_port_max = 65535;
> -static int ip_ttl_min = 1;
> -static int ip_ttl_max = 255;
> +static int ip_ttl_min __maybe_unused = 1;
> +static int ip_ttl_max __maybe_unused = 255;
> static int tcp_syn_retries_min = 1;
> static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
> static int tcp_syn_linear_timeouts_max = MAX_TCP_SYNCNT;
> @@ -48,7 +48,7 @@ static int tcp_plb_max_rounds = 31;
> static int tcp_plb_max_cong_thresh = 256;
> static unsigned int tcp_tw_reuse_delay_max = TCP_PAWS_MSL * MSEC_PER_SEC;
> static int tcp_ecn_mode_max = 5;
> -static u32 icmp_errors_extension_mask_all =
> +static u32 icmp_errors_extension_mask_all __maybe_unused =
> GENMASK_U8(ICMP_ERR_EXT_COUNT - 1, 0);
>
> static int tcp_min_rcvbuf = 4096;
> @@ -201,8 +201,9 @@ static int ipv4_ping_group_range(const struct ctl_table *table, int write,
> return ret;
> }
>
> -static int ipv4_fwd_update_priority(const struct ctl_table *table, int write,
> - void *buffer, size_t *lenp, loff_t *ppos)
> +static int __maybe_unused
> +ipv4_fwd_update_priority(const struct ctl_table *table, int write,
> + void *buffer, size_t *lenp, loff_t *ppos)
> {
> struct net *net;
> int ret;
> @@ -441,9 +442,9 @@ static int proc_udp_hash_entries(const struct ctl_table *table, int write,
> }
>
> #ifdef CONFIG_IP_ROUTE_MULTIPATH
> -static int proc_fib_multipath_hash_policy(const struct ctl_table *table, int write,
> - void *buffer, size_t *lenp,
> - loff_t *ppos)
> +static int __maybe_unused
> +proc_fib_multipath_hash_policy(const struct ctl_table *table, int write,
> + void *buffer, size_t *lenp, loff_t *ppos)
> {
> struct net *net = container_of(table->data, struct net,
> ipv4.sysctl_fib_multipath_hash_policy);
> @@ -456,9 +457,9 @@ static int proc_fib_multipath_hash_policy(const struct ctl_table *table, int wri
> return ret;
> }
>
> -static int proc_fib_multipath_hash_fields(const struct ctl_table *table, int write,
> - void *buffer, size_t *lenp,
> - loff_t *ppos)
> +static int __maybe_unused
> +proc_fib_multipath_hash_fields(const struct ctl_table *table, int write,
> + void *buffer, size_t *lenp, loff_t *ppos)
> {
> struct net *net;
> int ret;
> @@ -492,9 +493,9 @@ static void proc_fib_multipath_hash_set_seed(struct net *net, u32 user_seed)
> WRITE_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed.mp_seed, new.mp_seed);
> }
>
> -static int proc_fib_multipath_hash_seed(const struct ctl_table *table, int write,
> - void *buffer, size_t *lenp,
> - loff_t *ppos)
> +static int __maybe_unused
> +proc_fib_multipath_hash_seed(const struct ctl_table *table, int write,
> + void *buffer, size_t *lenp, loff_t *ppos)
> {
> struct sysctl_fib_multipath_hash_seed *mphs;
> struct net *net = table->data;
> @@ -636,15 +637,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .mode = 0644,
> .proc_handler = proc_dointvec
> },
> - {
> - .procname = "icmp_echo_ignore_all",
> - .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE
> - },
> {
> .procname = "icmp_echo_enable_probe",
> .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe,
> @@ -654,56 +646,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE
> },
> - {
> - .procname = "icmp_echo_ignore_broadcasts",
> - .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE
> - },
> - {
> - .procname = "icmp_ignore_bogus_error_responses",
> - .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE
> - },
> - {
> - .procname = "icmp_errors_use_inbound_ifaddr",
> - .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE
> - },
> - {
> - .procname = "icmp_errors_extension_mask",
> - .data = &init_net.ipv4.sysctl_icmp_errors_extension_mask,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = &icmp_errors_extension_mask_all,
> - },
> - {
> - .procname = "icmp_ratelimit",
> - .data = &init_net.ipv4.sysctl_icmp_ratelimit,
> - .maxlen = sizeof(int),
> - .mode = 0644,
> - .proc_handler = proc_dointvec_ms_jiffies,
> - },
> - {
> - .procname = "icmp_ratemask",
> - .data = &init_net.ipv4.sysctl_icmp_ratemask,
> - .maxlen = sizeof(int),
> - .mode = 0644,
> - .proc_handler = proc_dointvec
> - },
> {
> .procname = "icmp_msgs_per_sec",
> .data = &init_net.ipv4.sysctl_icmp_msgs_per_sec,
> @@ -774,13 +716,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE,
> },
> - {
> - .procname = "ip_dynaddr",
> - .data = &init_net.ipv4.sysctl_ip_dynaddr,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> {
> .procname = "ip_early_demux",
> .data = &init_net.ipv4.sysctl_ip_early_demux,
> @@ -811,15 +746,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE,
> },
> - {
> - .procname = "ip_default_ttl",
> - .data = &init_net.ipv4.sysctl_ip_default_ttl,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = &ip_ttl_min,
> - .extra2 = &ip_ttl_max,
> - },
> {
> .procname = "ip_local_port_range",
> .maxlen = 0,
> @@ -841,36 +767,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .mode = 0644,
> .proc_handler = proc_do_large_bitmap,
> },
> - {
> - .procname = "ip_no_pmtu_disc",
> - .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> - {
> - .procname = "ip_forward_use_pmtu",
> - .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> - {
> - .procname = "ip_forward_update_priority",
> - .data = &init_net.ipv4.sysctl_ip_fwd_update_priority,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = ipv4_fwd_update_priority,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE,
> - },
> - {
> - .procname = "ip_nonlocal_bind",
> - .data = &init_net.ipv4.sysctl_ip_nonlocal_bind,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> {
> .procname = "ip_autobind_reuse",
> .data = &init_net.ipv4.sysctl_ip_autobind_reuse,
> @@ -880,13 +776,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .extra1 = SYSCTL_ZERO,
> .extra2 = SYSCTL_ONE,
> },
> - {
> - .procname = "fwmark_reflect",
> - .data = &init_net.ipv4.sysctl_fwmark_reflect,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> {
> .procname = "tcp_fwmark_accept",
> .data = &init_net.ipv4.sysctl_tcp_fwmark_accept,
> @@ -952,37 +841,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .proc_handler = proc_douintvec_minmax,
> .extra2 = &u32_max_div_HZ,
> },
> - {
> - .procname = "igmp_link_local_mcast_reports",
> - .data = &init_net.ipv4.sysctl_igmp_llm_reports,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - },
> - {
> - .procname = "igmp_max_memberships",
> - .data = &init_net.ipv4.sysctl_igmp_max_memberships,
> - .maxlen = sizeof(int),
> - .mode = 0644,
> - .proc_handler = proc_dointvec
> - },
> - {
> - .procname = "igmp_max_msf",
> - .data = &init_net.ipv4.sysctl_igmp_max_msf,
> - .maxlen = sizeof(int),
> - .mode = 0644,
> - .proc_handler = proc_dointvec
> - },
> -#ifdef CONFIG_IP_MULTICAST
> - {
> - .procname = "igmp_qrv",
> - .data = &init_net.ipv4.sysctl_igmp_qrv,
> - .maxlen = sizeof(int),
> - .mode = 0644,
> - .proc_handler = proc_dointvec_minmax,
> - .extra1 = SYSCTL_ONE
> - },
> -#endif
> {
> .procname = "tcp_congestion_control",
> .data = &init_net.ipv4.tcp_congestion_control,
> @@ -1154,42 +1012,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .proc_handler = proc_tfo_blackhole_detect_timeout,
> .extra1 = SYSCTL_ZERO,
> },
> -#ifdef CONFIG_IP_ROUTE_MULTIPATH
> - {
> - .procname = "fib_multipath_use_neigh",
> - .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_ONE,
> - },
> - {
> - .procname = "fib_multipath_hash_policy",
> - .data = &init_net.ipv4.sysctl_fib_multipath_hash_policy,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_fib_multipath_hash_policy,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_THREE,
> - },
> - {
> - .procname = "fib_multipath_hash_fields",
> - .data = &init_net.ipv4.sysctl_fib_multipath_hash_fields,
> - .maxlen = sizeof(u32),
> - .mode = 0644,
> - .proc_handler = proc_fib_multipath_hash_fields,
> - .extra1 = SYSCTL_ONE,
> - .extra2 = &fib_multipath_hash_fields_all_mask,
> - },
> - {
> - .procname = "fib_multipath_hash_seed",
> - .data = &init_net,
> - .maxlen = sizeof(u32),
> - .mode = 0644,
> - .proc_handler = proc_fib_multipath_hash_seed,
> - },
> -#endif
> {
> .procname = "ip_unprivileged_port_start",
> .maxlen = sizeof(int),
> @@ -1563,15 +1385,6 @@ static const struct ctl_table ipv4_net_table[] = {
> .proc_handler = proc_dointvec_minmax,
> .extra1 = SYSCTL_ONE
> },
> - {
> - .procname = "fib_notify_on_flag_change",
> - .data = &init_net.ipv4.sysctl_fib_notify_on_flag_change,
> - .maxlen = sizeof(u8),
> - .mode = 0644,
> - .proc_handler = proc_dou8vec_minmax,
> - .extra1 = SYSCTL_ZERO,
> - .extra2 = SYSCTL_TWO,
> - },
> {
> .procname = "tcp_plb_enabled",
> .data = &init_net.ipv4.sysctl_tcp_plb_enabled,
> @@ -1656,6 +1469,196 @@ static const struct ctl_table ipv4_net_table[] = {
> .extra1 = SYSCTL_ONE_THOUSAND,
> .extra2 = &tcp_rto_max_max,
> },
> +#if IS_ENABLED(CONFIG_IPV4)
> + {
> + .procname = "icmp_echo_ignore_all",
> + .data = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE
> + },
> + {
> + .procname = "icmp_echo_ignore_broadcasts",
> + .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE
> + },
> + {
> + .procname = "icmp_ignore_bogus_error_responses",
> + .data = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE
> + },
> + {
> + .procname = "icmp_errors_use_inbound_ifaddr",
> + .data = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE
> + },
> + {
> + .procname = "icmp_errors_extension_mask",
> + .data = &init_net.ipv4.sysctl_icmp_errors_extension_mask,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = &icmp_errors_extension_mask_all,
> + },
> + {
> + .procname = "icmp_ratelimit",
> + .data = &init_net.ipv4.sysctl_icmp_ratelimit,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec_ms_jiffies,
> + },
> + {
> + .procname = "icmp_ratemask",
> + .data = &init_net.ipv4.sysctl_icmp_ratemask,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec
> + },
> + {
> + .procname = "ip_dynaddr",
> + .data = &init_net.ipv4.sysctl_ip_dynaddr,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "ip_default_ttl",
> + .data = &init_net.ipv4.sysctl_ip_default_ttl,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = &ip_ttl_min,
> + .extra2 = &ip_ttl_max,
> + },
> + {
> + .procname = "ip_no_pmtu_disc",
> + .data = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "ip_forward_use_pmtu",
> + .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "ip_forward_update_priority",
> + .data = &init_net.ipv4.sysctl_ip_fwd_update_priority,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = ipv4_fwd_update_priority,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE,
> + },
> + {
> + .procname = "ip_nonlocal_bind",
> + .data = &init_net.ipv4.sysctl_ip_nonlocal_bind,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "fwmark_reflect",
> + .data = &init_net.ipv4.sysctl_fwmark_reflect,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "igmp_link_local_mcast_reports",
> + .data = &init_net.ipv4.sysctl_igmp_llm_reports,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + },
> + {
> + .procname = "igmp_max_memberships",
> + .data = &init_net.ipv4.sysctl_igmp_max_memberships,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec
> + },
> + {
> + .procname = "igmp_max_msf",
> + .data = &init_net.ipv4.sysctl_igmp_max_msf,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec
> + },
> +#ifdef CONFIG_IP_MULTICAST
> + {
> + .procname = "igmp_qrv",
> + .data = &init_net.ipv4.sysctl_igmp_qrv,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec_minmax,
> + .extra1 = SYSCTL_ONE
> + },
> +#endif
> +#ifdef CONFIG_IP_ROUTE_MULTIPATH
> + {
> + .procname = "fib_multipath_use_neigh",
> + .data = &init_net.ipv4.sysctl_fib_multipath_use_neigh,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_ONE,
> + },
> + {
> + .procname = "fib_multipath_hash_policy",
> + .data = &init_net.ipv4.sysctl_fib_multipath_hash_policy,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_fib_multipath_hash_policy,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_THREE,
> + },
> + {
> + .procname = "fib_multipath_hash_fields",
> + .data = &init_net.ipv4.sysctl_fib_multipath_hash_fields,
> + .maxlen = sizeof(u32),
> + .mode = 0644,
> + .proc_handler = proc_fib_multipath_hash_fields,
> + .extra1 = SYSCTL_ONE,
> + .extra2 = &fib_multipath_hash_fields_all_mask,
> + },
> + {
> + .procname = "fib_multipath_hash_seed",
> + .data = &init_net,
> + .maxlen = sizeof(u32),
> + .mode = 0644,
> + .proc_handler = proc_fib_multipath_hash_seed,
> + },
> +#endif
> + {
> + .procname = "fib_notify_on_flag_change",
> + .data = &init_net.ipv4.sysctl_fib_notify_on_flag_change,
> + .maxlen = sizeof(u8),
> + .mode = 0644,
> + .proc_handler = proc_dou8vec_minmax,
> + .extra1 = SYSCTL_ZERO,
> + .extra2 = SYSCTL_TWO,
> + },
> +#endif
> };
>
> static const struct ctl_table *ipv4_net_table_dup(struct net *net)
> --
> 2.55.0
>
Attachment:
signature.asc
Description: PGP signature