2005-01-07 01:45:51 +00:00
|
|
|
/*-
|
2017-11-20 19:43:44 +00:00
|
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
*
|
1994-05-24 10:09:53 +00:00
|
|
|
* Copyright (c) 1982, 1986, 1993
|
2007-05-11 11:00:48 +00:00
|
|
|
* The Regents of the University of California.
|
|
|
|
* All rights reserved.
|
1994-05-24 10:09:53 +00:00
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2017-02-28 23:42:47 +00:00
|
|
|
* 3. Neither the name of the University nor the names of its contributors
|
1994-05-24 10:09:53 +00:00
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
1995-09-21 18:04:43 +00:00
|
|
|
* @(#)ip.h 8.2 (Berkeley) 6/1/94
|
1999-08-28 01:08:13 +00:00
|
|
|
* $FreeBSD$
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
|
1994-08-21 05:27:42 +00:00
|
|
|
#ifndef _NETINET_IP_H_
|
2007-05-11 11:00:48 +00:00
|
|
|
#define _NETINET_IP_H_
|
1994-08-21 05:27:42 +00:00
|
|
|
|
2003-03-22 00:25:14 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Definitions for internet protocol version 4.
|
2007-05-11 11:00:48 +00:00
|
|
|
*
|
1994-05-24 10:09:53 +00:00
|
|
|
* Per RFC 791, September 1981.
|
|
|
|
*/
|
|
|
|
#define IPVERSION 4
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Structure of an internet header, naked of options.
|
|
|
|
*/
|
|
|
|
struct ip {
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char ip_hl:4, /* header length */
|
1994-05-24 10:09:53 +00:00
|
|
|
ip_v:4; /* version */
|
|
|
|
#endif
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == BIG_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char ip_v:4, /* version */
|
1994-05-24 10:09:53 +00:00
|
|
|
ip_hl:4; /* header length */
|
|
|
|
#endif
|
|
|
|
u_char ip_tos; /* type of service */
|
1996-10-23 18:35:50 +00:00
|
|
|
u_short ip_len; /* total length */
|
1994-05-24 10:09:53 +00:00
|
|
|
u_short ip_id; /* identification */
|
1996-10-23 18:35:50 +00:00
|
|
|
u_short ip_off; /* fragment offset field */
|
1998-02-26 08:31:53 +00:00
|
|
|
#define IP_RF 0x8000 /* reserved fragment flag */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define IP_DF 0x4000 /* dont fragment flag */
|
|
|
|
#define IP_MF 0x2000 /* more fragments flag */
|
|
|
|
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
|
|
|
|
u_char ip_ttl; /* time to live */
|
|
|
|
u_char ip_p; /* protocol */
|
|
|
|
u_short ip_sum; /* checksum */
|
|
|
|
struct in_addr ip_src,ip_dst; /* source and dest address */
|
Change struct attribute to avoid aligned operations mismatch
Previous __alignment(4) allowed compiler to assume that operations are
performed on aligned region. On ARM processor, this led to alignment fault
as shown below:
trapframe: 0xda9e5b10
FSR=00000001, FAR=a67b680e, spsr=60000113
r0 =00000000, r1 =00000068, r2 =0000007c, r3 =00000000
r4 =a67b6826, r5 =a67b680e, r6 =00000014, r7 =00000068
r8 =00000068, r9 =da9e5bd0, r10=00000011, r11=da9e5c10
r12=da9e5be0, ssp=da9e5b60, slr=a054f164, pc =a054f2cc
<...>
udp_input+0x264: ldmia r5, {r0-r3, r6}
udp_input+0x268: stmia r12, {r0-r3, r6}
This was due to instructions which do not support unaligned access,
whereas for __alignment(2) compiler replaced ldmia/stmia with some
logically equivalent memcpy operations.
In fact, the assumption that 'struct ip' is always 4-byte aligned
is definitely false, as we have no impact on data alignment of packet
stream received.
Another possible solution would be to explicitely perform memcpy()
on objects of 'struct ip' type, which, however, would suffer from
performance drop, and be merely a problem hiding.
Please, note that this has nothing to do with
ARM32_DISABLE_ALIGNMENT_FAULTS option, but is related strictly to
compiler behaviour.
Submitted by: Wojciech Macek <wma@semihalf.com>
Reviewed by: glebius, ian
Obtained from: Semihalf
2015-02-24 12:57:03 +00:00
|
|
|
} __packed __aligned(2);
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
#define IP_MAXPACKET 65535 /* maximum packet size */
|
|
|
|
|
|
|
|
/*
|
2007-05-11 11:00:48 +00:00
|
|
|
* Definitions for IP type of service (ip_tos).
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
#define IPTOS_LOWDELAY 0x10
|
|
|
|
#define IPTOS_THROUGHPUT 0x08
|
|
|
|
#define IPTOS_RELIABILITY 0x04
|
1995-05-05 14:36:38 +00:00
|
|
|
#define IPTOS_MINCOST 0x02
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
/*
|
2015-07-18 06:48:30 +00:00
|
|
|
* Definitions for IP precedence (also in ip_tos) (deprecated).
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
2015-07-18 06:48:30 +00:00
|
|
|
#define IPTOS_PREC_NETCONTROL IPTOS_DSCP_CS7
|
|
|
|
#define IPTOS_PREC_INTERNETCONTROL IPTOS_DSCP_CS6
|
|
|
|
#define IPTOS_PREC_CRITIC_ECP IPTOS_DSCP_CS5
|
|
|
|
#define IPTOS_PREC_FLASHOVERRIDE IPTOS_DSCP_CS4
|
|
|
|
#define IPTOS_PREC_FLASH IPTOS_DSCP_CS3
|
|
|
|
#define IPTOS_PREC_IMMEDIATE IPTOS_DSCP_CS2
|
|
|
|
#define IPTOS_PREC_PRIORITY IPTOS_DSCP_CS1
|
|
|
|
#define IPTOS_PREC_ROUTINE IPTOS_DSCP_CS0
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2018-07-01 08:37:07 +00:00
|
|
|
/*
|
|
|
|
* Offset of Diffserv decimal value to convert it to tos value .
|
|
|
|
*/
|
|
|
|
#define IPTOS_DSCP_OFFSET 2
|
|
|
|
|
2012-05-04 21:00:32 +00:00
|
|
|
/*
|
2015-07-18 06:48:30 +00:00
|
|
|
* Definitions for DiffServ Codepoints as per RFC2474 and RFC5865.
|
2012-05-04 21:00:32 +00:00
|
|
|
*/
|
|
|
|
#define IPTOS_DSCP_CS0 0x00
|
|
|
|
#define IPTOS_DSCP_CS1 0x20
|
|
|
|
#define IPTOS_DSCP_AF11 0x28
|
|
|
|
#define IPTOS_DSCP_AF12 0x30
|
|
|
|
#define IPTOS_DSCP_AF13 0x38
|
|
|
|
#define IPTOS_DSCP_CS2 0x40
|
|
|
|
#define IPTOS_DSCP_AF21 0x48
|
|
|
|
#define IPTOS_DSCP_AF22 0x50
|
|
|
|
#define IPTOS_DSCP_AF23 0x58
|
|
|
|
#define IPTOS_DSCP_CS3 0x60
|
|
|
|
#define IPTOS_DSCP_AF31 0x68
|
|
|
|
#define IPTOS_DSCP_AF32 0x70
|
|
|
|
#define IPTOS_DSCP_AF33 0x78
|
|
|
|
#define IPTOS_DSCP_CS4 0x80
|
|
|
|
#define IPTOS_DSCP_AF41 0x88
|
|
|
|
#define IPTOS_DSCP_AF42 0x90
|
|
|
|
#define IPTOS_DSCP_AF43 0x98
|
|
|
|
#define IPTOS_DSCP_CS5 0xa0
|
2015-07-18 06:48:30 +00:00
|
|
|
#define IPTOS_DSCP_VA 0xb0
|
2012-05-04 21:00:32 +00:00
|
|
|
#define IPTOS_DSCP_EF 0xb8
|
|
|
|
#define IPTOS_DSCP_CS6 0xc0
|
|
|
|
#define IPTOS_DSCP_CS7 0xe0
|
|
|
|
|
2003-10-29 15:07:04 +00:00
|
|
|
/*
|
2007-05-11 11:00:48 +00:00
|
|
|
* ECN (Explicit Congestion Notification) codepoints in RFC3168 mapped to the
|
|
|
|
* lower 2 bits of the TOS field.
|
2003-10-29 15:07:04 +00:00
|
|
|
*/
|
|
|
|
#define IPTOS_ECN_NOTECT 0x00 /* not-ECT */
|
|
|
|
#define IPTOS_ECN_ECT1 0x01 /* ECN-capable transport (1) */
|
|
|
|
#define IPTOS_ECN_ECT0 0x02 /* ECN-capable transport (0) */
|
|
|
|
#define IPTOS_ECN_CE 0x03 /* congestion experienced */
|
|
|
|
#define IPTOS_ECN_MASK 0x03 /* ECN field mask */
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Definitions for options.
|
|
|
|
*/
|
|
|
|
#define IPOPT_COPIED(o) ((o)&0x80)
|
|
|
|
#define IPOPT_CLASS(o) ((o)&0x60)
|
|
|
|
#define IPOPT_NUMBER(o) ((o)&0x1f)
|
|
|
|
|
|
|
|
#define IPOPT_CONTROL 0x00
|
|
|
|
#define IPOPT_RESERVED1 0x20
|
|
|
|
#define IPOPT_DEBMEAS 0x40
|
|
|
|
#define IPOPT_RESERVED2 0x60
|
|
|
|
|
|
|
|
#define IPOPT_EOL 0 /* end of option list */
|
|
|
|
#define IPOPT_NOP 1 /* no operation */
|
|
|
|
|
|
|
|
#define IPOPT_RR 7 /* record packet route */
|
|
|
|
#define IPOPT_TS 68 /* timestamp */
|
|
|
|
#define IPOPT_SECURITY 130 /* provide s,c,h,tcc */
|
|
|
|
#define IPOPT_LSRR 131 /* loose source route */
|
2001-12-14 19:37:32 +00:00
|
|
|
#define IPOPT_ESO 133 /* extended security */
|
2016-05-03 18:05:43 +00:00
|
|
|
#define IPOPT_CIPSO 134 /* commercial security */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define IPOPT_SATID 136 /* satnet id */
|
|
|
|
#define IPOPT_SSRR 137 /* strict source route */
|
1996-03-14 16:59:20 +00:00
|
|
|
#define IPOPT_RA 148 /* router alert */
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Offsets to fields in options other than EOL and NOP.
|
|
|
|
*/
|
|
|
|
#define IPOPT_OPTVAL 0 /* option ID */
|
|
|
|
#define IPOPT_OLEN 1 /* option length */
|
2007-05-11 11:00:48 +00:00
|
|
|
#define IPOPT_OFFSET 2 /* offset within option */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define IPOPT_MINOFF 4 /* min value of above */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Time stamp option structure.
|
|
|
|
*/
|
|
|
|
struct ip_timestamp {
|
|
|
|
u_char ipt_code; /* IPOPT_TS */
|
|
|
|
u_char ipt_len; /* size of structure (variable) */
|
|
|
|
u_char ipt_ptr; /* index of current entry */
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char ipt_flg:4, /* flags, see below */
|
1994-05-24 10:09:53 +00:00
|
|
|
ipt_oflw:4; /* overflow counter */
|
|
|
|
#endif
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == BIG_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char ipt_oflw:4, /* overflow counter */
|
1994-05-24 10:09:53 +00:00
|
|
|
ipt_flg:4; /* flags, see below */
|
|
|
|
#endif
|
|
|
|
union ipt_timestamp {
|
2009-02-13 15:14:43 +00:00
|
|
|
uint32_t ipt_time[1]; /* network format */
|
1994-05-24 10:09:53 +00:00
|
|
|
struct ipt_ta {
|
|
|
|
struct in_addr ipt_addr;
|
2009-02-13 15:14:43 +00:00
|
|
|
uint32_t ipt_time; /* network format */
|
1994-05-24 10:09:53 +00:00
|
|
|
} ipt_ta[1];
|
|
|
|
} ipt_timestamp;
|
|
|
|
};
|
|
|
|
|
2007-05-11 11:00:48 +00:00
|
|
|
/* Flag bits for ipt_flg. */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define IPOPT_TS_TSONLY 0 /* timestamps only */
|
|
|
|
#define IPOPT_TS_TSANDADDR 1 /* timestamps and addresses */
|
|
|
|
#define IPOPT_TS_PRESPEC 3 /* specified modules only */
|
|
|
|
|
2007-05-11 11:00:48 +00:00
|
|
|
/* Bits for security (not byte swapped). */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define IPOPT_SECUR_UNCLASS 0x0000
|
|
|
|
#define IPOPT_SECUR_CONFID 0xf135
|
|
|
|
#define IPOPT_SECUR_EFTO 0x789a
|
|
|
|
#define IPOPT_SECUR_MMMM 0xbc4d
|
|
|
|
#define IPOPT_SECUR_RESTR 0xaf13
|
|
|
|
#define IPOPT_SECUR_SECRET 0xd788
|
|
|
|
#define IPOPT_SECUR_TOPSECRET 0x6bc5
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Internet implementation parameters.
|
|
|
|
*/
|
|
|
|
#define MAXTTL 255 /* maximum time to live (seconds) */
|
|
|
|
#define IPDEFTTL 64 /* default ttl, from RFC 1340 */
|
|
|
|
#define IPFRAGTTL 60 /* time to live for frags, slowhz */
|
|
|
|
#define IPTTLDEC 1 /* subtracted when forwarding */
|
|
|
|
#define IP_MSS 576 /* default maximum segment size */
|
1994-08-21 05:27:42 +00:00
|
|
|
|
Initial import of RFC 2385 (TCP-MD5) digest support.
This is the first of two commits; bringing in the kernel support first.
This can be enabled by compiling a kernel with options TCP_SIGNATURE
and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of
authenticating TCP sessions which came into being before IPSEC. It is
still relevant today, however, as it is used by many commercial router
vendors, particularly with BGP, and as such has become a requirement for
interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload,
are digested with MD5, including a shared secret. The PF_KEY interface
is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow
per-port back to an SPI without polluting tcpcb or using the SPD; the
code to do the latter is unstable at this time. Therefore this code only
supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6),
TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective
users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when
responding to a host initiating a TCP session, but no effort is made
[yet] to authenticate inbound traffic. This is, however, sufficient to
interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with
local patches. Patches for tcpdump to validate TCP-MD5 sessions are also
available from me upon request.
Sponsored by: sentex.net
2004-02-11 04:26:04 +00:00
|
|
|
/*
|
|
|
|
* This is the real IPv4 pseudo header, used for computing the TCP and UDP
|
|
|
|
* checksums. For the Internet checksum, struct ipovly can be used instead.
|
|
|
|
* For stronger checksums, the real thing must be used.
|
|
|
|
*/
|
|
|
|
struct ippseudo {
|
|
|
|
struct in_addr ippseudo_src; /* source internet address */
|
|
|
|
struct in_addr ippseudo_dst; /* destination internet address */
|
2004-02-16 14:40:56 +00:00
|
|
|
u_char ippseudo_pad; /* pad, must be zero */
|
|
|
|
u_char ippseudo_p; /* protocol */
|
|
|
|
u_short ippseudo_len; /* protocol length */
|
|
|
|
};
|
1994-08-21 05:27:42 +00:00
|
|
|
#endif
|