in.h revision 33440
112119Sdyson/*
212119Sdyson * Copyright (c) 1982, 1986, 1990, 1993
312119Sdyson *	The Regents of the University of California.  All rights reserved.
412119Sdyson *
512119Sdyson * Redistribution and use in source and binary forms, with or without
612119Sdyson * modification, are permitted provided that the following conditions
712119Sdyson * are met:
812119Sdyson * 1. Redistributions of source code must retain the above copyright
912119Sdyson *    notice, this list of conditions and the following disclaimer.
1012119Sdyson * 2. Redistributions in binary form must reproduce the above copyright
1112119Sdyson *    notice, this list of conditions and the following disclaimer in the
1212119Sdyson *    documentation and/or other materials provided with the distribution.
1312119Sdyson * 3. All advertising materials mentioning features or use of this software
1412119Sdyson *    must display the following acknowledgement:
1512119Sdyson *	This product includes software developed by the University of
1612119Sdyson *	California, Berkeley and its contributors.
1712119Sdyson * 4. Neither the name of the University nor the names of its contributors
1812119Sdyson *    may be used to endorse or promote products derived from this software
1912119Sdyson *    without specific prior written permission.
2012119Sdyson *
2112119Sdyson * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
2212119Sdyson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2312119Sdyson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2412119Sdyson * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
2512119Sdyson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2612119Sdyson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2712119Sdyson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2812119Sdyson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2912119Sdyson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
3012119Sdyson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3112119Sdyson * SUCH DAMAGE.
3212119Sdyson *
3312119Sdyson *	@(#)in.h	8.3 (Berkeley) 1/3/94
3412119Sdyson * $Id: in.h,v 1.27 1997/09/25 00:34:35 wollman Exp $
35122622Sjohan */
3612119Sdyson
3712119Sdyson#ifndef _NETINET_IN_H_
3812119Sdyson#define _NETINET_IN_H_
3912119Sdyson
4012119Sdyson/*
4115770Swollman * Constants and structures defined by the internet system,
4212119Sdyson * Per RFC 790, September 1981, and numerous additions.
4315770Swollman */
4415770Swollman
4550476Speter/*
4612119Sdyson * Protocols
4712119Sdyson */
4812119Sdyson#define	IPPROTO_IP		0		/* dummy for IP */
4912119Sdyson#define	IPPROTO_ICMP		1		/* control message protocol */
50101829Smux#define	IPPROTO_IGMP		2		/* group mgmt protocol */
5112119Sdyson#define	IPPROTO_GGP		3		/* gateway^2 (deprecated) */
5212119Sdyson#define IPPROTO_IPIP		4 		/* IP encapsulation in IP */
5312119Sdyson#define	IPPROTO_TCP		6		/* tcp */
5412119Sdyson#define	IPPROTO_EGP		8		/* exterior gateway protocol */
5512119Sdyson#define	IPPROTO_PUP		12		/* pup */
5615770Swollman#define	IPPROTO_UDP		17		/* user datagram protocol */
5712119Sdyson#define	IPPROTO_IDP		22		/* xns idp */
5812119Sdyson#define	IPPROTO_TP		29 		/* tp-4 w/ class negotiation */
5912119Sdyson#define IPPROTO_RSVP		46 		/* resource reservation */
6012119Sdyson#define	IPPROTO_EON		80		/* ISO cnlp */
6112119Sdyson#define	IPPROTO_ENCAP		98		/* encapsulation header */
6212119Sdyson
6339008Sbde#define	IPPROTO_DIVERT		254		/* divert pseudo-protocol */
6439008Sbde#define	IPPROTO_RAW		255		/* raw IP packet */
6512119Sdyson#define	IPPROTO_MAX		256
6612119Sdyson
6712119Sdyson
6812119Sdyson/*
6992882Simp * Local port number conventions:
7012119Sdyson *
7112119Sdyson * When a user does a bind(2) or connect(2) with a port number of zero,
7212119Sdyson * a non-conflicting local port address is chosen.
7312119Sdyson * The default range is IPPORT_RESERVED through
7412119Sdyson * IPPORT_USERRESERVED, although that is settable by sysctl.
7512119Sdyson *
7697256Smux * A user may set the IPPROTO_IP option IP_PORTRANGE to change this
7715770Swollman * default assignment range.
7897256Smux *
7912119Sdyson * The value IP_PORTRANGE_DEFAULT causes the default behavior.
8012119Sdyson *
8115770Swollman * The value IP_PORTRANGE_HIGH changes the range of candidate port numbers
8224359Simp * into the "high" range.  These are reserved for client outbound connections
8312119Sdyson * which do not want to be filtered by any firewalls.
8412119Sdyson *
8517260Speter * The value IP_PORTRANGE_LOW changes the range to the "low" are
8612119Sdyson * that is (by convention) restricted to privileged processes.  This
8712119Sdyson * convention is based on "vouchsafe" principles only.  It is only secure
8812119Sdyson * if you trust the remote host to restrict these ports.
8912119Sdyson *
9012119Sdyson * The default range of ports and the high range can be changed by
9112119Sdyson * sysctl(3).  (net.inet.ip.port{hi,low}{first,last}_auto)
9212119Sdyson *
9312119Sdyson * Changing those values has bad security implications if you are
9412119Sdyson * using a a stateless firewall that is allowing packets outside of that
9512119Sdyson * range in order to allow transparent outgoing connections.
9612119Sdyson *
9797256Smux * Such a firewall configuration will generally depend on the use of these
9812119Sdyson * default values.  If you change them, you may find your Security
9912119Sdyson * Administrator looking for you with a heavy object.
10052055Sphk */
10152055Sphk
10252055Sphk/*
10352055Sphk * Ports < IPPORT_RESERVED are reserved for
10452055Sphk * privileged processes (e.g. root).         (IP_PORTRANGE_LOW)
10597256Smux * Ports > IPPORT_USERRESERVED are reserved
10652055Sphk * for servers, not necessarily privileged.  (IP_PORTRANGE_DEFAULT)
10797256Smux */
10897256Smux#define	IPPORT_RESERVED		1024
109101270Smux#define	IPPORT_USERRESERVED	5000
110101270Smux
11197256Smux/*
11297256Smux * Default local port range to use by setting IP_PORTRANGE_HIGH
11397256Smux */
11497256Smux#define	IPPORT_HIFIRSTAUTO	40000
11597256Smux#define	IPPORT_HILASTAUTO	44999
11697256Smux
11797256Smux/*
11897256Smux * Scanning for a free reserved port return a value below IPPORT_RESERVED,
11997256Smux * but higher than IPPORT_RESERVEDSTART.  Traditionally the start value was
12097256Smux * 512, but that conflicts with some well-known-services that firewalls may
12112119Sdyson * have a fit if we use.
12212119Sdyson */
12312119Sdyson#define IPPORT_RESERVEDSTART	600
12412119Sdyson
12512119Sdyson/*
12612119Sdyson * Internet address (a structure for historical reasons)
12712119Sdyson */
12812119Sdysonstruct in_addr {
12915770Swollman	u_long s_addr;
13012119Sdyson};
131
132/*
133 * Definitions of bits in internet address integers.
134 * On subnets, the decomposition of addresses to host and net parts
135 * is done according to subnet mask, not the masks here.
136 */
137#define	IN_CLASSA(i)		(((long)(i) & 0x80000000) == 0)
138#define	IN_CLASSA_NET		0xff000000
139#define	IN_CLASSA_NSHIFT	24
140#define	IN_CLASSA_HOST		0x00ffffff
141#define	IN_CLASSA_MAX		128
142
143#define	IN_CLASSB(i)		(((long)(i) & 0xc0000000) == 0x80000000)
144#define	IN_CLASSB_NET		0xffff0000
145#define	IN_CLASSB_NSHIFT	16
146#define	IN_CLASSB_HOST		0x0000ffff
147#define	IN_CLASSB_MAX		65536
148
149#define	IN_CLASSC(i)		(((long)(i) & 0xe0000000) == 0xc0000000)
150#define	IN_CLASSC_NET		0xffffff00
151#define	IN_CLASSC_NSHIFT	8
152#define	IN_CLASSC_HOST		0x000000ff
153
154#define	IN_CLASSD(i)		(((long)(i) & 0xf0000000) == 0xe0000000)
155#define	IN_CLASSD_NET		0xf0000000	/* These ones aren't really */
156#define	IN_CLASSD_NSHIFT	28		/* net and host fields, but */
157#define	IN_CLASSD_HOST		0x0fffffff	/* routing needn't know.    */
158#define	IN_MULTICAST(i)		IN_CLASSD(i)
159
160#define	IN_EXPERIMENTAL(i)	(((long)(i) & 0xf0000000) == 0xf0000000)
161#define	IN_BADCLASS(i)		(((long)(i) & 0xf0000000) == 0xf0000000)
162
163#define	INADDR_ANY		(u_long)0x00000000
164#define	INADDR_LOOPBACK		(u_long)0x7f000001
165#define	INADDR_BROADCAST	(u_long)0xffffffff	/* must be masked */
166#ifndef KERNEL
167#define	INADDR_NONE		0xffffffff		/* -1 return */
168#endif
169
170#define	INADDR_UNSPEC_GROUP	(u_long)0xe0000000	/* 224.0.0.0 */
171#define	INADDR_ALLHOSTS_GROUP	(u_long)0xe0000001	/* 224.0.0.1 */
172#define	INADDR_ALLRTRS_GROUP	(u_long)0xe0000002	/* 224.0.0.2 */
173#define	INADDR_MAX_LOCAL_GROUP	(u_long)0xe00000ff	/* 224.0.0.255 */
174
175#define	IN_LOOPBACKNET		127			/* official! */
176
177/*
178 * Socket address, internet style.
179 */
180struct sockaddr_in {
181	u_char	sin_len;
182	u_char	sin_family;
183	u_short	sin_port;
184	struct	in_addr sin_addr;
185	char	sin_zero[8];
186};
187
188/*
189 * Structure used to describe IP options.
190 * Used to store options internally, to pass them to a process,
191 * or to restore options retrieved earlier.
192 * The ip_dst is used for the first-hop gateway when using a source route
193 * (this gets put into the header proper).
194 */
195struct ip_opts {
196	struct	in_addr ip_dst;		/* first hop, 0 w/o src rt */
197	char	ip_opts[40];		/* actually variable in size */
198};
199
200/*
201 * Options for use with [gs]etsockopt at the IP level.
202 * First word of comment is data type; bool is stored in int.
203 */
204#define	IP_OPTIONS		1    /* buf/ip_opts; set/get IP options */
205#define	IP_HDRINCL		2    /* int; header is included with data */
206#define	IP_TOS			3    /* int; IP type of service and preced. */
207#define	IP_TTL			4    /* int; IP time to live */
208#define	IP_RECVOPTS		5    /* bool; receive all IP opts w/dgram */
209#define	IP_RECVRETOPTS		6    /* bool; receive IP opts for response */
210#define	IP_RECVDSTADDR		7    /* bool; receive IP dst addr w/dgram */
211#define	IP_RETOPTS		8    /* ip_opts; set/get IP options */
212#define	IP_MULTICAST_IF		9    /* u_char; set/get IP multicast i/f  */
213#define	IP_MULTICAST_TTL	10   /* u_char; set/get IP multicast ttl */
214#define	IP_MULTICAST_LOOP	11   /* u_char; set/get IP multicast loopback */
215#define	IP_ADD_MEMBERSHIP	12   /* ip_mreq; add an IP group membership */
216#define	IP_DROP_MEMBERSHIP	13   /* ip_mreq; drop an IP group membership */
217#define IP_MULTICAST_VIF	14   /* set/get IP mcast virt. iface */
218#define IP_RSVP_ON		15   /* enable RSVP in kernel */
219#define IP_RSVP_OFF		16   /* disable RSVP in kernel */
220#define IP_RSVP_VIF_ON		17   /* set RSVP per-vif socket */
221#define IP_RSVP_VIF_OFF		18   /* unset RSVP per-vif socket */
222#define IP_PORTRANGE		19   /* int; range to choose for unspec port */
223#define	IP_RECVIF		20   /* bool; receive reception if w/dgram */
224
225#define IP_FW_ADD     		50   /* add a firewall rule to chain */
226#define IP_FW_DEL    		51   /* delete a firewall rule from chain */
227#define IP_FW_FLUSH   		52   /* flush firewall rule chain */
228#define IP_FW_ZERO    		53   /* clear single/all firewall counter(s) */
229#define IP_FW_GET     		54   /* get entire firewall rule chain */
230#define IP_NAT			55   /* set/get NAT opts */
231
232/*
233 * Defaults and limits for options
234 */
235#define	IP_DEFAULT_MULTICAST_TTL  1	/* normally limit m'casts to 1 hop  */
236#define	IP_DEFAULT_MULTICAST_LOOP 1	/* normally hear sends if a member  */
237#define	IP_MAX_MEMBERSHIPS	20	/* per socket */
238
239/*
240 * Argument structure for IP_ADD_MEMBERSHIP and IP_DROP_MEMBERSHIP.
241 */
242struct ip_mreq {
243	struct	in_addr imr_multiaddr;	/* IP multicast address of group */
244	struct	in_addr imr_interface;	/* local IP address of interface */
245};
246
247/*
248 * Argument for IP_PORTRANGE:
249 * - which range to search when port is unspecified at bind() or connect()
250 */
251#define	IP_PORTRANGE_DEFAULT	0	/* default range */
252#define	IP_PORTRANGE_HIGH	1	/* "high" - request firewall bypass */
253#define	IP_PORTRANGE_LOW	2	/* "low" - vouchsafe security */
254
255/*
256 * Definitions for inet sysctl operations.
257 *
258 * Third level is protocol number.
259 * Fourth level is desired variable within that protocol.
260 */
261#define	IPPROTO_MAXID	(IPPROTO_IDP + 1)	/* don't list to IPPROTO_MAX */
262
263#define	CTL_IPPROTO_NAMES { \
264	{ "ip", CTLTYPE_NODE }, \
265	{ "icmp", CTLTYPE_NODE }, \
266	{ "igmp", CTLTYPE_NODE }, \
267	{ "ggp", CTLTYPE_NODE }, \
268	{ 0, 0 }, \
269	{ 0, 0 }, \
270	{ "tcp", CTLTYPE_NODE }, \
271	{ 0, 0 }, \
272	{ "egp", CTLTYPE_NODE }, \
273	{ 0, 0 }, \
274	{ 0, 0 }, \
275	{ 0, 0 }, \
276	{ "pup", CTLTYPE_NODE }, \
277	{ 0, 0 }, \
278	{ 0, 0 }, \
279	{ 0, 0 }, \
280	{ 0, 0 }, \
281	{ "udp", CTLTYPE_NODE }, \
282	{ 0, 0 }, \
283	{ 0, 0 }, \
284	{ 0, 0 }, \
285	{ 0, 0 }, \
286	{ "idp", CTLTYPE_NODE }, \
287}
288
289/*
290 * Names for IP sysctl objects
291 */
292#define	IPCTL_FORWARDING	1	/* act as router */
293#define	IPCTL_SENDREDIRECTS	2	/* may send redirects when forwarding */
294#define	IPCTL_DEFTTL		3	/* default TTL */
295#ifdef notyet
296#define	IPCTL_DEFMTU		4	/* default MTU */
297#endif
298#define IPCTL_RTEXPIRE		5	/* cloned route expiration time */
299#define IPCTL_RTMINEXPIRE	6	/* min value for expiration time */
300#define IPCTL_RTMAXCACHE	7	/* trigger level for dynamic expire */
301#define	IPCTL_SOURCEROUTE	8	/* may perform source routes */
302#define	IPCTL_DIRECTEDBROADCAST	9	/* may re-broadcast received packets */
303#define IPCTL_INTRQMAXLEN	10	/* max length of netisr queue */
304#define IPCTL_INTRQDROPS	11	/* number of netisr q drops */
305#define	IPCTL_STATS		12	/* ipstat structure */
306#define	IPCTL_ACCEPTSOURCEROUTE	13	/* may accept source routed packets */
307#define	IPCTL_MAXID		14
308
309#define	IPCTL_NAMES { \
310	{ 0, 0 }, \
311	{ "forwarding", CTLTYPE_INT }, \
312	{ "redirect", CTLTYPE_INT }, \
313	{ "ttl", CTLTYPE_INT }, \
314	{ "mtu", CTLTYPE_INT }, \
315	{ "rtexpire", CTLTYPE_INT }, \
316	{ "rtminexpire", CTLTYPE_INT }, \
317	{ "rtmaxcache", CTLTYPE_INT }, \
318	{ "sourceroute", CTLTYPE_INT }, \
319 	{ "directed-broadcast", CTLTYPE_INT }, \
320	{ "intr-queue-maxlen", CTLTYPE_INT }, \
321	{ "intr-queue-drops", CTLTYPE_INT }, \
322	{ "stats", CTLTYPE_STRUCT }, \
323	{ "accept_sourceroute", CTLTYPE_INT }, \
324}
325
326
327#ifdef KERNEL
328struct ifnet; struct mbuf;	/* forward declarations for Standard C */
329
330int	 in_broadcast __P((struct in_addr, struct ifnet *));
331int	 in_canforward __P((struct in_addr));
332int	 in_cksum __P((struct mbuf *, int));
333int	 in_localaddr __P((struct in_addr));
334char 	*inet_ntoa __P((struct in_addr)); /* in libkern */
335
336/* Firewall hooks */
337struct ip;
338typedef	int ip_fw_chk_t __P((struct ip**, int, struct ifnet*, int, struct mbuf**));
339typedef	int ip_fw_ctl_t __P((int, struct mbuf**));
340extern	ip_fw_chk_t *ip_fw_chk_ptr;
341extern	ip_fw_ctl_t *ip_fw_ctl_ptr;
342
343/* IP NAT hooks */
344typedef	int ip_nat_t __P((struct ip**, struct mbuf**, struct ifnet*, int));
345typedef	int ip_nat_ctl_t __P((int, struct mbuf**));
346extern	ip_nat_t *ip_nat_ptr;
347extern	ip_nat_ctl_t *ip_nat_ctl_ptr;
348#define	IP_NAT_IN	0x00000001
349#define	IP_NAT_OUT	0x00000002
350
351#endif /* KERNEL */
352
353#endif
354