1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Copyright (c) 1982, 1986, 1993
|
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
|
|
* must display the following acknowledgement:
|
|
|
|
* This product includes software developed by the University of
|
|
|
|
* California, Berkeley and its contributors.
|
|
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* @(#)tcp.h 8.1 (Berkeley) 6/10/93
|
1999-08-28 01:08:13 +00:00
|
|
|
* $FreeBSD$
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
|
1994-08-21 05:27:42 +00:00
|
|
|
#ifndef _NETINET_TCP_H_
|
|
|
|
#define _NETINET_TCP_H_
|
|
|
|
|
2002-10-02 04:22:34 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
|
2002-10-02 04:19:47 +00:00
|
|
|
#if __BSD_VISIBLE
|
|
|
|
|
1998-07-13 11:09:52 +00:00
|
|
|
typedef u_int32_t tcp_seq;
|
|
|
|
typedef u_int32_t tcp_cc; /* connection count per rfc1644 */
|
1995-02-08 20:18:48 +00:00
|
|
|
|
2000-01-09 19:17:30 +00:00
|
|
|
#define tcp6_seq tcp_seq /* for KAME src sync over BSD*'s */
|
|
|
|
#define tcp6hdr tcphdr /* for KAME src sync over BSD*'s */
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* TCP header.
|
|
|
|
* Per RFC 793, September, 1981.
|
|
|
|
*/
|
|
|
|
struct tcphdr {
|
|
|
|
u_short th_sport; /* source port */
|
|
|
|
u_short th_dport; /* destination port */
|
|
|
|
tcp_seq th_seq; /* sequence number */
|
|
|
|
tcp_seq th_ack; /* acknowledgement number */
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
1998-06-08 09:47:47 +00:00
|
|
|
u_int th_x2:4, /* (unused) */
|
1994-05-24 10:09:53 +00:00
|
|
|
th_off:4; /* data offset */
|
|
|
|
#endif
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == BIG_ENDIAN
|
1998-06-08 09:47:47 +00:00
|
|
|
u_int th_off:4, /* data offset */
|
1994-05-24 10:09:53 +00:00
|
|
|
th_x2:4; /* (unused) */
|
|
|
|
#endif
|
|
|
|
u_char th_flags;
|
|
|
|
#define TH_FIN 0x01
|
|
|
|
#define TH_SYN 0x02
|
|
|
|
#define TH_RST 0x04
|
|
|
|
#define TH_PUSH 0x08
|
|
|
|
#define TH_ACK 0x10
|
|
|
|
#define TH_URG 0x20
|
o IPFW incorrectly handled filtering in the presence of previously
reserved and now allocated TCP flags in incoming packets. This patch
stops overloading those bits in the IP firewall rules, and moves
colliding flags to a seperate field, ipflg. The IPFW userland
management tool, ipfw(8), is updated to reflect this change. New TCP
flags related to ECN are now included in tcp.h for reference, although
we don't currently implement TCP+ECN.
o To use this fix without completely rebuilding, it is sufficient to copy
ip_fw.h and tcp.h into your appropriate include directory, then rebuild
the ipfw kernel module, and ipfw tool, and install both. Note that a
mismatch between module and userland tool will result in incorrect
installation of firewall rules that may have unexpected effects. This
is an MFC candidate, following shakedown. This bug does not appear
to affect ipfilter.
Reviewed by: security-officer, billf
Reported by: Aragon Gouveia <aragon@phat.za.net>
2001-01-09 03:10:30 +00:00
|
|
|
#define TH_ECE 0x40
|
|
|
|
#define TH_CWR 0x80
|
2001-01-09 18:26:17 +00:00
|
|
|
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
|
1995-02-14 02:35:19 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
u_short th_win; /* window */
|
|
|
|
u_short th_sum; /* checksum */
|
|
|
|
u_short th_urp; /* urgent pointer */
|
|
|
|
};
|
|
|
|
|
|
|
|
#define TCPOPT_EOL 0
|
|
|
|
#define TCPOPT_NOP 1
|
|
|
|
#define TCPOPT_MAXSEG 2
|
|
|
|
#define TCPOLEN_MAXSEG 4
|
|
|
|
#define TCPOPT_WINDOW 3
|
|
|
|
#define TCPOLEN_WINDOW 3
|
|
|
|
#define TCPOPT_SACK_PERMITTED 4 /* Experimental */
|
|
|
|
#define TCPOLEN_SACK_PERMITTED 2
|
|
|
|
#define TCPOPT_SACK 5 /* Experimental */
|
|
|
|
#define TCPOPT_TIMESTAMP 8
|
|
|
|
#define TCPOLEN_TIMESTAMP 10
|
|
|
|
#define TCPOLEN_TSTAMP_APPA (TCPOLEN_TIMESTAMP+2) /* appendix A */
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TCPOPT_TSTAMP_HDR \
|
1994-05-24 10:09:53 +00:00
|
|
|
(TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP)
|
|
|
|
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TCPOPT_CC 11 /* CC options: RFC-1644 */
|
|
|
|
#define TCPOPT_CCNEW 12
|
|
|
|
#define TCPOPT_CCECHO 13
|
|
|
|
#define TCPOLEN_CC 6
|
|
|
|
#define TCPOLEN_CC_APPA (TCPOLEN_CC+2)
|
|
|
|
#define TCPOPT_CC_HDR(ccopt) \
|
|
|
|
(TCPOPT_NOP<<24|TCPOPT_NOP<<16|(ccopt)<<8|TCPOLEN_CC)
|
Initial import of RFC 2385 (TCP-MD5) digest support.
This is the first of two commits; bringing in the kernel support first.
This can be enabled by compiling a kernel with options TCP_SIGNATURE
and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of
authenticating TCP sessions which came into being before IPSEC. It is
still relevant today, however, as it is used by many commercial router
vendors, particularly with BGP, and as such has become a requirement for
interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload,
are digested with MD5, including a shared secret. The PF_KEY interface
is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow
per-port back to an SPI without polluting tcpcb or using the SPD; the
code to do the latter is unstable at this time. Therefore this code only
supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6),
TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective
users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when
responding to a host initiating a TCP session, but no effort is made
[yet] to authenticate inbound traffic. This is, however, sufficient to
interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with
local patches. Patches for tcpdump to validate TCP-MD5 sessions are also
available from me upon request.
Sponsored by: sentex.net
2004-02-11 04:26:04 +00:00
|
|
|
#define TCPOPT_SIGNATURE 19 /* Keyed MD5: RFC 2385 */
|
|
|
|
#define TCPOLEN_SIGNATURE 18
|
1995-02-08 20:18:48 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Default maximum segment size for TCP.
|
2004-01-08 17:40:07 +00:00
|
|
|
* With an IP MTU of 576, this is 536,
|
1994-05-24 10:09:53 +00:00
|
|
|
* but 512 is probably more convenient.
|
|
|
|
* This should be defined as MIN(512, IP_MSS - sizeof (struct tcpiphdr)).
|
|
|
|
*/
|
|
|
|
#define TCP_MSS 512
|
2004-01-08 17:40:07 +00:00
|
|
|
/*
|
2004-01-09 14:14:10 +00:00
|
|
|
* TCP_MINMSS is defined to be 216 which is fine for the smallest
|
|
|
|
* link MTU (256 bytes, AX.25 packet radio) in the Internet.
|
2004-01-08 17:40:07 +00:00
|
|
|
* However it is very unlikely to come across such low MTU interfaces
|
|
|
|
* these days (anno dato 2003).
|
|
|
|
* See tcp_subr.c tcp_minmss SYSCTL declaration for more comments.
|
|
|
|
* Setting this to "0" disables the minmss check.
|
|
|
|
*/
|
2004-01-09 14:14:10 +00:00
|
|
|
#define TCP_MINMSS 216
|
2004-01-08 17:40:07 +00:00
|
|
|
/*
|
|
|
|
* TCP_MINMSSOVERLOAD is defined to be 1000 which should cover any type
|
|
|
|
* of interactive TCP session.
|
|
|
|
* See tcp_subr.c tcp_minmssoverload SYSCTL declaration and tcp_input.c
|
|
|
|
* for more comments.
|
|
|
|
* Setting this to "0" disables the minmssoverload check.
|
|
|
|
*/
|
2004-01-12 15:46:04 +00:00
|
|
|
#define TCP_MINMSSOVERLOAD 0 /* XXX: Disabled until refined */
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
/*
|
|
|
|
* Default maximum segment size for TCP6.
|
|
|
|
* With an IP6 MSS of 1280, this is 1220,
|
|
|
|
* but 1024 is probably more convenient. (xxx kazu in doubt)
|
|
|
|
* This should be defined as MIN(1024, IP6_MSS - sizeof (struct tcpip6hdr))
|
|
|
|
*/
|
|
|
|
#define TCP6_MSS 1024
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCP_MAXWIN 65535 /* largest value for (unscaled) window */
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TTCP_CLIENT_SND_WND 4096 /* dflt send window for T/TCP client */
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
#define TCP_MAX_WINSHIFT 14 /* maximum window shift */
|
|
|
|
|
2000-05-06 03:31:09 +00:00
|
|
|
#define TCP_MAXBURST 4 /* maximum segments in a burst */
|
|
|
|
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TCP_MAXHLEN (0xf<<2) /* max length of header in bytes */
|
|
|
|
#define TCP_MAXOLEN (TCP_MAXHLEN - sizeof(struct tcphdr))
|
|
|
|
/* max space left for options */
|
2002-10-02 04:19:47 +00:00
|
|
|
#endif /* __BSD_VISIBLE */
|
1995-02-08 20:18:48 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* User-settable options (used with setsockopt).
|
|
|
|
*/
|
|
|
|
#define TCP_NODELAY 0x01 /* don't delay send to coalesce packets */
|
2002-10-02 04:19:47 +00:00
|
|
|
#if __BSD_VISIBLE
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCP_MAXSEG 0x02 /* set maximum segment size */
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TCP_NOPUSH 0x04 /* don't push last block of write */
|
|
|
|
#define TCP_NOOPT 0x08 /* don't use TCP options */
|
2004-02-16 22:21:16 +00:00
|
|
|
#define TCP_MD5SIG 0x10 /* use MD5 digests (RFC2385) */
|
1994-08-21 05:27:42 +00:00
|
|
|
#endif
|
2002-10-02 04:19:47 +00:00
|
|
|
|
|
|
|
#endif /* !_NETINET_TCP_H_ */
|