[TCP]: Restrict congestion control choices.

Allow normal users to only choose among a restricted set of congestion
control choices.  The default is reno and what ever has been configured
as default. But the policy can be changed by administrator at any time.

For example, to allow any choice:
    cp /proc/sys/net/ipv4/tcp_available_congestion_control \
       /proc/sys/net/ipv4/tcp_allowed_congestion_control

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 52 insertions, 0 deletions

diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 2e770f45d82..dfcf47f10f8 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -146,6 +146,50 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
         return ret;
 }
 
+static int proc_allowed_congestion_control(ctl_table *ctl,
+                                           int write, struct file * filp,
+                                           void __user *buffer, size_t *lenp,
+                                           loff_t *ppos)
+{
+        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
+        int ret;
+
+        tbl.data = kmalloc(tbl.maxlen, GFP_USER);
+        if (!tbl.data)
+                return -ENOMEM;
+
+        tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
+        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        if (write && ret == 0)
+                ret = tcp_set_allowed_congestion_control(tbl.data);
+        kfree(tbl.data);
+        return ret;
+}
+
+static int strategy_allowed_congestion_control(ctl_table *table, int __user *name,
+                                               int nlen, void __user *oldval,
+                                               size_t __user *oldlenp,
+                                               void __user *newval, size_t newlen,
+                                               void **context)
+{
+        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
+        int ret;
+
+        tbl.data = kmalloc(tbl.maxlen, GFP_USER);
+        if (!tbl.data)
+                return -ENOMEM;
+
+        tcp_get_available_congestion_control(tbl.data, tbl.maxlen);
+        ret = sysctl_string(&tbl, name, nlen, oldval, oldlenp, newval, newlen,
+                            context);
+        if (ret == 0 && newval && newlen)
+                ret = tcp_set_allowed_congestion_control(tbl.data);
+        kfree(tbl.data);
+
+        return ret;
+
+}
+
 ctl_table ipv4_table[] = {
         {
                 .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
@@ -755,6 +799,14 @@ ctl_table ipv4_table[] = {
                 .mode           = 0444,
                 .proc_handler   = &proc_tcp_available_congestion_control,
         },
+        {
+                .ctl_name       = NET_TCP_ALLOWED_CONG_CONTROL,
+                .procname       = "tcp_allowed_congestion_control",
+                .maxlen         = TCP_CA_BUF_MAX,
+                .mode           = 0644,
+                .proc_handler   = &proc_allowed_congestion_control,
+                .strategy       = &strategy_allowed_congestion_control,
+        },
         { .ctl_name = 0 }
 };