2005-01-07 01:45:51 +00:00
|
|
|
/*-
|
1994-05-24 10:09:53 +00:00
|
|
|
* Copyright (c) 1982, 1986, 1993
|
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* @(#)tcp.h 8.1 (Berkeley) 6/10/93
|
1999-08-28 01:08:13 +00:00
|
|
|
* $FreeBSD$
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
|
1994-08-21 05:27:42 +00:00
|
|
|
#ifndef _NETINET_TCP_H_
|
|
|
|
#define _NETINET_TCP_H_
|
|
|
|
|
2002-10-02 04:22:34 +00:00
|
|
|
#include <sys/cdefs.h>
|
2011-10-21 12:58:34 +00:00
|
|
|
#include <sys/types.h>
|
2002-10-02 04:22:34 +00:00
|
|
|
|
2002-10-02 04:19:47 +00:00
|
|
|
#if __BSD_VISIBLE
|
|
|
|
|
1998-07-13 11:09:52 +00:00
|
|
|
typedef u_int32_t tcp_seq;
|
1995-02-08 20:18:48 +00:00
|
|
|
|
2000-01-09 19:17:30 +00:00
|
|
|
#define tcp6_seq tcp_seq /* for KAME src sync over BSD*'s */
|
|
|
|
#define tcp6hdr tcphdr /* for KAME src sync over BSD*'s */
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* TCP header.
|
|
|
|
* Per RFC 793, September, 1981.
|
|
|
|
*/
|
|
|
|
struct tcphdr {
|
|
|
|
u_short th_sport; /* source port */
|
|
|
|
u_short th_dport; /* destination port */
|
|
|
|
tcp_seq th_seq; /* sequence number */
|
|
|
|
tcp_seq th_ack; /* acknowledgement number */
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char th_x2:4, /* (unused) */
|
1994-05-24 10:09:53 +00:00
|
|
|
th_off:4; /* data offset */
|
|
|
|
#endif
|
1995-05-30 08:16:23 +00:00
|
|
|
#if BYTE_ORDER == BIG_ENDIAN
|
2010-02-01 14:13:44 +00:00
|
|
|
u_char th_off:4, /* data offset */
|
1994-05-24 10:09:53 +00:00
|
|
|
th_x2:4; /* (unused) */
|
|
|
|
#endif
|
|
|
|
u_char th_flags;
|
|
|
|
#define TH_FIN 0x01
|
|
|
|
#define TH_SYN 0x02
|
|
|
|
#define TH_RST 0x04
|
|
|
|
#define TH_PUSH 0x08
|
|
|
|
#define TH_ACK 0x10
|
|
|
|
#define TH_URG 0x20
|
o IPFW incorrectly handled filtering in the presence of previously
reserved and now allocated TCP flags in incoming packets. This patch
stops overloading those bits in the IP firewall rules, and moves
colliding flags to a seperate field, ipflg. The IPFW userland
management tool, ipfw(8), is updated to reflect this change. New TCP
flags related to ECN are now included in tcp.h for reference, although
we don't currently implement TCP+ECN.
o To use this fix without completely rebuilding, it is sufficient to copy
ip_fw.h and tcp.h into your appropriate include directory, then rebuild
the ipfw kernel module, and ipfw tool, and install both. Note that a
mismatch between module and userland tool will result in incorrect
installation of firewall rules that may have unexpected effects. This
is an MFC candidate, following shakedown. This bug does not appear
to affect ipfilter.
Reviewed by: security-officer, billf
Reported by: Aragon Gouveia <aragon@phat.za.net>
2001-01-09 03:10:30 +00:00
|
|
|
#define TH_ECE 0x40
|
|
|
|
#define TH_CWR 0x80
|
2006-02-18 16:50:08 +00:00
|
|
|
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG|TH_ECE|TH_CWR)
|
2007-05-25 21:28:49 +00:00
|
|
|
#define PRINT_TH_FLAGS "\20\1FIN\2SYN\3RST\4PUSH\5ACK\6URG\7ECE\10CWR"
|
1995-02-14 02:35:19 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
u_short th_win; /* window */
|
|
|
|
u_short th_sum; /* checksum */
|
|
|
|
u_short th_urp; /* urgent pointer */
|
|
|
|
};
|
|
|
|
|
|
|
|
#define TCPOPT_EOL 0
|
2007-03-15 15:59:28 +00:00
|
|
|
#define TCPOLEN_EOL 1
|
2008-04-07 18:43:59 +00:00
|
|
|
#define TCPOPT_PAD 0 /* padding after EOL */
|
|
|
|
#define TCPOLEN_PAD 1
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCPOPT_NOP 1
|
2007-03-15 15:59:28 +00:00
|
|
|
#define TCPOLEN_NOP 1
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCPOPT_MAXSEG 2
|
|
|
|
#define TCPOLEN_MAXSEG 4
|
|
|
|
#define TCPOPT_WINDOW 3
|
|
|
|
#define TCPOLEN_WINDOW 3
|
2007-03-15 15:59:28 +00:00
|
|
|
#define TCPOPT_SACK_PERMITTED 4
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCPOLEN_SACK_PERMITTED 2
|
2007-03-15 15:59:28 +00:00
|
|
|
#define TCPOPT_SACK 5
|
|
|
|
#define TCPOLEN_SACKHDR 2
|
2004-06-23 21:04:37 +00:00
|
|
|
#define TCPOLEN_SACK 8 /* 2*sizeof(tcp_seq) */
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCPOPT_TIMESTAMP 8
|
|
|
|
#define TCPOLEN_TIMESTAMP 10
|
|
|
|
#define TCPOLEN_TSTAMP_APPA (TCPOLEN_TIMESTAMP+2) /* appendix A */
|
2007-04-20 15:08:09 +00:00
|
|
|
#define TCPOPT_SIGNATURE 19 /* Keyed MD5: RFC 2385 */
|
Initial import of RFC 2385 (TCP-MD5) digest support.
This is the first of two commits; bringing in the kernel support first.
This can be enabled by compiling a kernel with options TCP_SIGNATURE
and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of
authenticating TCP sessions which came into being before IPSEC. It is
still relevant today, however, as it is used by many commercial router
vendors, particularly with BGP, and as such has become a requirement for
interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload,
are digested with MD5, including a shared secret. The PF_KEY interface
is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow
per-port back to an SPI without polluting tcpcb or using the SPD; the
code to do the latter is unstable at this time. Therefore this code only
supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6),
TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective
users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when
responding to a host initiating a TCP session, but no effort is made
[yet] to authenticate inbound traffic. This is, however, sufficient to
interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with
local patches. Patches for tcpdump to validate TCP-MD5 sessions are also
available from me upon request.
Sponsored by: sentex.net
2004-02-11 04:26:04 +00:00
|
|
|
#define TCPOLEN_SIGNATURE 18
|
1995-02-08 20:18:48 +00:00
|
|
|
|
2004-06-23 21:04:37 +00:00
|
|
|
/* Miscellaneous constants */
|
2005-08-24 02:47:16 +00:00
|
|
|
#define MAX_SACK_BLKS 6 /* Max # SACK blocks stored at receiver side */
|
2005-05-23 19:22:48 +00:00
|
|
|
#define TCP_MAX_SACK 4 /* MAX # SACKs sent in any segment */
|
2004-06-23 21:04:37 +00:00
|
|
|
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
2010-09-15 10:39:30 +00:00
|
|
|
* The default maximum segment size (MSS) to be used for new TCP connections
|
|
|
|
* when path MTU discovery is not enabled.
|
|
|
|
*
|
|
|
|
* RFC879 derives the default MSS from the largest datagram size hosts are
|
|
|
|
* minimally required to handle directly or through IP reassembly minus the
|
|
|
|
* size of the IP and TCP header. With IPv6 the minimum MTU is specified
|
|
|
|
* in RFC2460.
|
|
|
|
*
|
|
|
|
* For IPv4 the MSS is 576 - sizeof(struct tcpiphdr)
|
|
|
|
* For IPv6 the MSS is IPV6_MMTU - sizeof(struct ip6_hdr) - sizeof(struct tcphdr)
|
|
|
|
*
|
|
|
|
* We use explicit numerical definition here to avoid header pollution.
|
2004-01-08 17:40:07 +00:00
|
|
|
*/
|
2010-09-15 10:39:30 +00:00
|
|
|
#define TCP_MSS 536
|
|
|
|
#define TCP6_MSS 1220
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
/*
|
2010-09-16 12:13:06 +00:00
|
|
|
* Limit the lowest MSS we accept for path MTU discovery and the TCP SYN MSS
|
|
|
|
* option. Allowing low values of MSS can consume significant resources and
|
|
|
|
* be used to mount a resource exhaustion attack.
|
2010-09-15 10:39:30 +00:00
|
|
|
* Connections requesting lower MSS values will be rounded up to this value
|
2010-09-16 12:13:06 +00:00
|
|
|
* and the IP_DF flag will be cleared to allow fragmentation along the path.
|
2010-09-15 10:39:30 +00:00
|
|
|
*
|
|
|
|
* See tcp_subr.c tcp_minmss SYSCTL declaration for more comments. Setting
|
|
|
|
* it to "0" disables the minmss check.
|
|
|
|
*
|
2010-09-16 12:13:06 +00:00
|
|
|
* The default value is fine for TCP across the Internet's smallest official
|
|
|
|
* link MTU (256 bytes for AX.25 packet radio). However, a connection is very
|
|
|
|
* unlikely to come across such low MTU interfaces these days (anno domini 2003).
|
1999-11-05 14:41:39 +00:00
|
|
|
*/
|
2010-09-15 10:39:30 +00:00
|
|
|
#define TCP_MINMSS 216
|
1999-11-05 14:41:39 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
#define TCP_MAXWIN 65535 /* largest value for (unscaled) window */
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TTCP_CLIENT_SND_WND 4096 /* dflt send window for T/TCP client */
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
#define TCP_MAX_WINSHIFT 14 /* maximum window shift */
|
|
|
|
|
2004-08-16 18:32:07 +00:00
|
|
|
#define TCP_MAXBURST 4 /* maximum segments in a burst */
|
2000-05-06 03:31:09 +00:00
|
|
|
|
1995-02-08 20:18:48 +00:00
|
|
|
#define TCP_MAXHLEN (0xf<<2) /* max length of header in bytes */
|
|
|
|
#define TCP_MAXOLEN (TCP_MAXHLEN - sizeof(struct tcphdr))
|
|
|
|
/* max space left for options */
|
2002-10-02 04:19:47 +00:00
|
|
|
#endif /* __BSD_VISIBLE */
|
1995-02-08 20:18:48 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
2013-01-22 19:45:04 +00:00
|
|
|
* User-settable options (used with setsockopt). These are discrete
|
|
|
|
* values and are not masked together. Some values appear to be
|
|
|
|
* bitmasks for historical reasons.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
2013-01-22 19:45:04 +00:00
|
|
|
#define TCP_NODELAY 1 /* don't delay send to coalesce packets */
|
2002-10-02 04:19:47 +00:00
|
|
|
#if __BSD_VISIBLE
|
2013-01-22 19:45:04 +00:00
|
|
|
#define TCP_MAXSEG 2 /* set maximum segment size */
|
|
|
|
#define TCP_NOPUSH 4 /* don't push last block of write */
|
|
|
|
#define TCP_NOOPT 8 /* don't use TCP options */
|
|
|
|
#define TCP_MD5SIG 16 /* use MD5 digests (RFC2385) */
|
|
|
|
#define TCP_INFO 32 /* retrieve tcp_info structure */
|
|
|
|
#define TCP_CONGESTION 64 /* get/set congestion control algorithm */
|
|
|
|
#define TCP_KEEPINIT 128 /* N, time to establish connection */
|
|
|
|
#define TCP_KEEPIDLE 256 /* L,N,X start keeplives after this period */
|
|
|
|
#define TCP_KEEPINTVL 512 /* L,N interval between keepalives */
|
|
|
|
#define TCP_KEEPCNT 1024 /* L,N number of keepalives before close */
|
There are times when it would be really nice to have a record of the last few
packets and/or state transitions from each TCP socket. That would help with
narrowing down certain problems we see in the field that are hard to reproduce
without understanding the history of how we got into a certain state. This
change provides just that.
It saves copies of the last N packets in a list in the tcpcb. When the tcpcb is
destroyed, the list is freed. I thought this was likely to be more
performance-friendly than saving copies of the tcpcb. Plus, with the packets,
you should be able to reverse-engineer what happened to the tcpcb.
To enable the feature, you will need to compile a kernel with the TCPPCAP
option. Even then, the feature defaults to being deactivated. You can activate
it by setting a positive value for the number of captured packets. You can do
that on either a global basis or on a per-socket basis (via a setsockopt call).
There is no way to get the packets out of the kernel other than using kmem or
getting a coredump. I thought that would help some of the legal/privacy concerns
regarding such a feature. However, it should be possible to add a future effort
to export them in PCAP format.
I tested this at low scale, and found that there were no mbuf leaks and the peak
mbuf usage appeared to be unchanged with and without the feature.
The main performance concern I can envision is the number of mbufs that would be
used on systems with a large number of sockets. If you save five packets per
direction per socket and have 3,000 sockets, that will consume at least 30,000
mbufs just to keep these packets. I tried to reduce the concerns associated with
this by limiting the number of clusters (not mbufs) that could be used for this
feature. Again, in my testing, that appears to work correctly.
Differential Revision: D3100
Submitted by: Jonathan Looney <jlooney at juniper dot net>
Reviewed by: gnn, hiren
2015-10-14 00:35:37 +00:00
|
|
|
#define TCP_PCAP_OUT 2048 /* number of output packets to keep */
|
|
|
|
#define TCP_PCAP_IN 4096 /* number of input packets to keep */
|
2015-12-16 00:56:45 +00:00
|
|
|
#define TCP_FUNCTION_BLK 8192 /* Set the tcp function pointers to the specified stack */
|
2013-02-01 15:32:20 +00:00
|
|
|
/* Start of reserved space for third-party user-settable options. */
|
|
|
|
#define TCP_VENDOR SO_VENDOR
|
|
|
|
|
2007-12-16 03:30:07 +00:00
|
|
|
#define TCP_CA_NAME_MAX 16 /* max congestion control name length */
|
2004-11-26 18:58:46 +00:00
|
|
|
|
|
|
|
#define TCPI_OPT_TIMESTAMPS 0x01
|
|
|
|
#define TCPI_OPT_SACK 0x02
|
|
|
|
#define TCPI_OPT_WSCALE 0x04
|
|
|
|
#define TCPI_OPT_ECN 0x08
|
2008-05-05 20:13:31 +00:00
|
|
|
#define TCPI_OPT_TOE 0x10
|
2004-11-26 18:58:46 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* The TCP_INFO socket option comes from the Linux 2.6 TCP API, and permits
|
|
|
|
* the caller to query certain information about the state of a TCP
|
|
|
|
* connection. We provide an overlapping set of fields with the Linux
|
|
|
|
* implementation, but since this is a fixed size structure, room has been
|
|
|
|
* left for growth. In order to maximize potential future compatibility with
|
|
|
|
* the Linux API, the same variable names and order have been adopted, and
|
|
|
|
* padding left to make room for omitted fields in case they are added later.
|
|
|
|
*
|
|
|
|
* XXX: This is currently an unstable ABI/API, in that it is expected to
|
|
|
|
* change.
|
|
|
|
*/
|
|
|
|
struct tcp_info {
|
|
|
|
u_int8_t tcpi_state; /* TCP FSM state. */
|
|
|
|
u_int8_t __tcpi_ca_state;
|
|
|
|
u_int8_t __tcpi_retransmits;
|
|
|
|
u_int8_t __tcpi_probes;
|
|
|
|
u_int8_t __tcpi_backoff;
|
|
|
|
u_int8_t tcpi_options; /* Options enabled on conn. */
|
|
|
|
u_int8_t tcpi_snd_wscale:4, /* RFC1323 send shift value. */
|
|
|
|
tcpi_rcv_wscale:4; /* RFC1323 recv shift value. */
|
|
|
|
|
2009-12-22 15:47:40 +00:00
|
|
|
u_int32_t tcpi_rto; /* Retransmission timeout (usec). */
|
2004-11-26 18:58:46 +00:00
|
|
|
u_int32_t __tcpi_ato;
|
2009-12-22 15:47:40 +00:00
|
|
|
u_int32_t tcpi_snd_mss; /* Max segment size for send. */
|
|
|
|
u_int32_t tcpi_rcv_mss; /* Max segment size for receive. */
|
2004-11-26 18:58:46 +00:00
|
|
|
|
|
|
|
u_int32_t __tcpi_unacked;
|
|
|
|
u_int32_t __tcpi_sacked;
|
|
|
|
u_int32_t __tcpi_lost;
|
|
|
|
u_int32_t __tcpi_retrans;
|
|
|
|
u_int32_t __tcpi_fackets;
|
|
|
|
|
|
|
|
/* Times; measurements in usecs. */
|
|
|
|
u_int32_t __tcpi_last_data_sent;
|
|
|
|
u_int32_t __tcpi_last_ack_sent; /* Also unimpl. on Linux? */
|
2009-12-22 15:47:40 +00:00
|
|
|
u_int32_t tcpi_last_data_recv; /* Time since last recv data. */
|
2004-11-26 18:58:46 +00:00
|
|
|
u_int32_t __tcpi_last_ack_recv;
|
|
|
|
|
|
|
|
/* Metrics; variable units. */
|
|
|
|
u_int32_t __tcpi_pmtu;
|
|
|
|
u_int32_t __tcpi_rcv_ssthresh;
|
2007-02-02 18:34:18 +00:00
|
|
|
u_int32_t tcpi_rtt; /* Smoothed RTT in usecs. */
|
|
|
|
u_int32_t tcpi_rttvar; /* RTT variance in usecs. */
|
2004-11-26 18:58:46 +00:00
|
|
|
u_int32_t tcpi_snd_ssthresh; /* Slow start threshold. */
|
|
|
|
u_int32_t tcpi_snd_cwnd; /* Send congestion window. */
|
|
|
|
u_int32_t __tcpi_advmss;
|
|
|
|
u_int32_t __tcpi_reordering;
|
|
|
|
|
|
|
|
u_int32_t __tcpi_rcv_rtt;
|
2004-11-27 20:20:11 +00:00
|
|
|
u_int32_t tcpi_rcv_space; /* Advertised recv window. */
|
2004-11-26 18:58:46 +00:00
|
|
|
|
|
|
|
/* FreeBSD extensions to tcp_info. */
|
|
|
|
u_int32_t tcpi_snd_wnd; /* Advertised send window. */
|
2010-09-16 21:06:45 +00:00
|
|
|
u_int32_t tcpi_snd_bwnd; /* No longer used. */
|
2008-05-05 20:13:31 +00:00
|
|
|
u_int32_t tcpi_snd_nxt; /* Next egress seqno */
|
|
|
|
u_int32_t tcpi_rcv_nxt; /* Next ingress seqno */
|
|
|
|
u_int32_t tcpi_toe_tid; /* HWTID for TOE endpoints */
|
2010-11-17 18:55:12 +00:00
|
|
|
u_int32_t tcpi_snd_rexmitpack; /* Retransmitted packets */
|
|
|
|
u_int32_t tcpi_rcv_ooopack; /* Out-of-order packets */
|
|
|
|
u_int32_t tcpi_snd_zerowin; /* Zero-sized windows sent */
|
2008-05-05 20:13:31 +00:00
|
|
|
|
2004-11-26 18:58:46 +00:00
|
|
|
/* Padding to grow without breaking ABI. */
|
2010-11-17 18:55:12 +00:00
|
|
|
u_int32_t __tcpi_pad[26]; /* Padding. */
|
2004-11-26 18:58:46 +00:00
|
|
|
};
|
1994-08-21 05:27:42 +00:00
|
|
|
#endif
|
2015-12-16 00:56:45 +00:00
|
|
|
#define TCP_FUNCTION_NAME_LEN_MAX 32
|
|
|
|
|
|
|
|
struct tcp_function_set {
|
|
|
|
char function_set_name[TCP_FUNCTION_NAME_LEN_MAX];
|
|
|
|
uint32_t pcbcnt;
|
|
|
|
};
|
2002-10-02 04:19:47 +00:00
|
|
|
|
|
|
|
#endif /* !_NETINET_TCP_H_ */
|