Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

remove duplicate semicolons where possible.

Approved by: cperciva
MFC after: 1 week

Add missing const keywords.

mdoc: fix a few badly nested blocks.

Fixes to man8 groff mandoc style, usage mistakes, or typos.

PR: 168016
Submitted by: Nobuyuki Koganemaru
Approved by: gjb
MFC after: 3 days

Add missing static keywords for global variables to tools in sbin/.

These tools declare global variables without using the static keyword,
even though their use is limited to a single C-file, or without placing
an extern declaration of them in the proper header file.

Fix a typo.

Approved by: kib

Furthermore condition IP waiting behaviour also on -dynamic flag.
This should preserve POLA in all other cases (foreground || non-dynamic).

MFC after: 2 weeks

Only wait for the IP to appear on the interface if natd is running in the
background.

Suggested by: Garrett Cooper <yanegomi@gmail.com>

Use EAGAIN instead of magic value of -2 to report this condition from the
SetAliasAddressFromIfName routine.

MFC after: 2 weeks

If we can retrieve interface address sleep for one second and try again.
This can happen during start-up, when natd starts before dhclient has a
chance to receive IP address from the upstream provider.

MFC after: 2 weeks

Raise WARNS for various tools where possible.

Submitted by: Marius Nünnerich <marius@nuenneri.ch>

Mute some (hidden) warnings about old-style function definitions.

Submitted by: Marius Nünnerich <marius nuenneri ch>

(S)LIST_HEAD_INITIALIZER takes a (S)LIST_HEAD as an argument.
Fix some wrong usages.
Note: this does not affect generated binaries as this argument is not used.

PR: 137213
Submitted by: Eygene Ryabinkin (initial version)
MFC after: 1 month

Check rule numbers against maximum value to avoid rules cleanup due
to overflow.

MFC after: 5 days.

Add exit_delay parameter to control daemon exit delay after signal.

PR: bin/58696
Submitted by: sp@alkor.ru

Use strdup() instead of static buffer allocation to avoid 128 bytes limit
on -redirect_XXX arguments length.

PR: bin/86647
Submitted by: Stephen Hurd <shurd@sasktel.net>

Don't abend if we get ENOMEM from sysctl(3). The data returned
is sufficient

MFC after: 2 weeks

Improve rev. 1.63. Document -instance and -globalport options.
Add a MULTIPLE INSTANCES section which provides an example of
setting up natd in multi-instance mode (based on the notes.natd
file from phk@).

Submitted by: "Andrey V. Elsukov" <bu7cher@yandex.ru>
Reviewed by: ru

Note that the punch_fw option does not work in securelevel 3 and Xref init.8.
Bump .Dd.

PR: 41807

o Markup and grammar fixes.

Bump .Dd for r1.63; fix small nit from the same.

Add a bit more detailed description about a configuration
file format and about using NAT "instances".

Submitted by: "Andrey V. Elsukov" <bu7cher@yandex.ru>

Summer of Code 2005: improve libalias - part 1 of 2

With the first part of my previous Summer of Code work, we get:

-made libalias modular:

-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime

-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)

-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia

-added logging support for kernel side

-cleanup

After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.

During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.

User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.

The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).

General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.

NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.

Approved by: glebius
Reviewed by: glebius, ru

WARNS=6 and gcc4 cleanup:
- Use const where necessary
- Use __unused where applicable
- Rename variables that is conflicit with global definations

Eliminate macro calls inside literal displays.

Remove unused variable.

Give natd multi-instance capabilities.

This makes it possible to do load-sharing on two xDSL lines etc.

Use strlcpy(3) instead of strcpy(3).

PR: 46761

Philipp Mergenthaler <philipp.mergenthaler@stud.uni-karlsruhe.de>

Replace ROUNDUP/ADVANCE with SA_SIZE

style.Makefile(5):
Use WARNS?= instead of WARNS=.

Add Cisco Skinny Station protocol support to libalias, natd, and ppp.
Skinny is the protocol used by Cisco IP phones to talk to Cisco Call
Managers. With this code, one can use a Cisco IP phone behind a FreeBSD
NAT gateway.

Currently, having the Call Manager behind the NAT gateway is not supported.
More information on enabling Skinny support in libalias, natd, and ppp
can be found in those applications' manpages.

PR: 55843
Reviewed by: ru
Approved by: ru
MFC after: 30 days

- Clarify the port range syntax in -redirect_port.

PR: docs/46286

- "IP number" -> "IP address", for consistency.

Added an option to specify an alternate PID file.

PR: bin/37159
Submitted by: "Aleksandr A. Babaylov" <.@babolo.ru>

If the -proxy_only option is used, the -alias_address/-interface
options are not required.

Suggested by: Vaclav Petricek
MFC after: 2 weeks

Don't pretend natd(8) doesn't work with ppp(8) interfaces.
While there's probably a better way to achieve the same,
nothing precludes us from using natd(8) on tun(4) links.

Noticed by: bde

Use a more standard error message. Add FBSDID.

Reviewed by: ru

Fixed Charles' e-mail here too.

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

can not -> cannot.

mdoc(7) police: canonize FreeBSD in e-mail address.

The .Nm utility

Update my email address.

I don't know what the MAINTAINER means in src/ part of FreeBSD.

I'll still be overseeing the changes that go into natd(8) and
will maintain it the way I see it, non-preventing for the rest
of developers.

I will re-ask for the MAINTAINER bit if the ${MAINTAINER} gets
defined.

Back out part of the revision 1.2 changes -- sendto(2) can
not return ENOBUFS for unreliable protocols like divert.

This should fix an issue when natd(8) keeps spamming already
full dummynet(4) queues with the same packet forever.

Spotted by: chkno@dork.com
Explained by: luigi
Reviewed by: Ari Suutari <ari.suutari@syncrontech.com>
MFC after: 2 weeks

s/sysctl -w/sysctl/

Default to WARNS=2.
Binary builds that cannot handle this must explicitly set WARNS=0.

Reviewed by: mike

Make -log_ipfw_denied active by default with -verbose.

Discussed with: phk

Fixed (local) style bugs in previous revision.

Do not uselessly whine in syslog about packets denied by ipfw rules.

Set 'log_ipfw_denied' option if you want the old behaviour.

PR: 30255
Submitted by: Flemming "F3" Jacobsen <fj@batmule.dk>
Reviewed by: phk
MFC after: 4 weeks

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

mdoc(7) police: removed HISTORY info from the .Os call.

Revert the previous commit on objection from the maintainer. I
missed that natd has a -v option that will give similar functionality.

Requested by: ru

When reporting that a packet can't be written back, usually because
of a restrictive firewall rule, also report detail on the packet
that caused the failure.

MFC after: 3 days

mdoc(7) police: normalize .Nd.

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for sbin/ to 8.

mdoc(7) police: split punctuation characters + misc fixes.

mdoc(7) police: use the new features of the Nm macro.

Describe -deny_incoming better, highlight some keywords,
add myself to the AUTHORS section.

more removal of trailing periods from SEE ALSO.

Suggest looking at rc.conf(5) on how to start natd(8) during boot.

Submitted by: dcs

Don't call warn() with no format string.

"Ease understanding" of how -punch_fw works.

Reviewed by: sheldonh

Added new option (-punch_fw) which allows to `punch holes'
in the ipfirewall(4) for incoming FTP/IRC DCC connections.

Submitted by: Rene de Vries <rene@canyon.demon.nl>
Rewritten by: ru

- mdoc(7) style cleanup
- new version of security note from alex.

Back out both previous commits.
The first one got screwed up by me because of rev 1.33, which was
incorrectly merged into my patches by myself, and so Ruslan (maintainer)
asked me to back them out.

Ruslan was ok with the second one, but since it needs rework, it'll be
readded later, when it doesn't conflict with the backout of the first one.

Pointy hat: alex
Beer on next meeting: ru

Add note about security concerns w/o a firewall but other machines
on your LAN to the "RUNNING NATD" introduction.

In a different way requested by:
PR: 18802
Submitted by: Zachary K Drew <drew0054@tc.umn.edu>

mdoc style cleanup.

Reviewed by: sheldonh

Remove ``pptpalias'' since this is now done transparently by libalias(3).

Remove unused parameter.

Fix a small grammar nit, with the maintainer's implicit approval.

Add new option (-target_addr) to control how to deal with incoming packets
not associated with any pre-existing link.

Submitted by: brian

New option: -redirect_proto.

Fixes a potential buffer overflow with the command line arguments.

Submitted by: Mike Heffner <spock@techfour.net>
Submitted on: audit@freebsd.org

Load Sharing using IP Network Address Translation (RFC 2391, LSNAT).

Correct Charles Mott's email address
Requested by: cmott@scientech.com

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

Suggest ppp -nat, not ppp -alias

Remove the config file line length restriction.

PR: 16900
Reviewed by: "Crist J. Clark" <cjclark@home.com>, jkh
Approved by: jkh

Now that kernel is capable of notifying user processes about
the interface MTU change (src/sys/net/if_sl.c,v 1.83), track
interface MTU with -dynamic option as well.

PR: 15494

Minor grammar fix.

ioctl -> sysctl for interface address changes.

PR: 14169
Reviewed by: Ari Suutari <ari@suutari.iki.fi>

Fixed the description of how packets re-enter IP firewall filter.

Suggested by: Ari Suutari <ari@suutari.iki.fi>

Do not defer setting of the aliasing address from
interface name if not operating in dynamic mode.

Reviewed by: Ari Suutari <ari@suutari.iki.fi>

`permanent_link' is obsolete; update examples.

Add Ari Suutari as a maintainer.

Approved by: Ari Suutari <ari@suutari.iki.fi>

Config file parser changes:

- Trailing spaces and empty lines are ignored.
- A `#' sign will mark the remaining of the line as a comment.

Reviewed by: Ari Suutari <ari@suutari.iki.fi>

Allow signals to interrupt system calls.
Remove redundant signal() call.

PR: 6676
Submitted by: luoqi
Reviewed by: Ari Suutari <ari@suutari.iki.fi>

$Id$ -> $FreeBSD$

Bad cross-reference of getservbyname(2) changed to getservbyname(3)

Reviewed by: ru

Become a maintainer.

Approved by: brian

Back out previous commit.

Mention that data going from one internal address to another will
not be processed by natd.
Requested by: Ludwig Pummer <ludwigp@bigfoot.com>

When incrementing through a SIOCGIFCONF list, enforce a lower limit of
sizeof(ifr->ifr_addr) for the variable length field ifr->ifr_addr.sa_len.
Otherwise the increment will be wrong in certain cases.

Obtained from: Whistle source tree
For the record: Garrett Wollman <wollman@khavrinen.lcs.mit.edu> suggests
SIOCGIFCONF should be dropped in favor of a sysctl mechanism.

Oops - missing parenthesis

/sbin/natd portrange documentation and bugfix
Submitted by: Ruslan Ermilov <ru@ucb.crimea.ua>
PR: 11690

3.2 candidate ?

More egcs warning fixes:
o main returns int not void
o use braces to avoid potentially ambiguous else

Note: The fix to natd is potentially functional in nature since I used
the indentation as the right thing rather than the struct semantics.
Someone more familiar with the code should double check me on this one.

Reviewed by: obrien and chuckr

Typo of `same_ports' directive.
Submitted by: Masaki Nohtomi <noutomi@jbm-net.or.jp>

Add a comment that natd is made for use with NICs, not PPP links - I'm
tired of the five people each day that ask me how to set up natd for
use with PPP.

Disable reads on our ICMP socket. We only use it for sending.
PR: 9253

Add `const's that I forgot to commit. Not bad - I broke
the -stable and -current builds in the space of 1 day !

Pointed out by: jdp

Add some const-cleanliness and avoid some warnings.

Allow port ranges when specifying -redirect_port.

Submitted by: Wes Santee <wes@bogon.net>
PR: 9696

Fix a diagnostic typo
Submitted by: Martin Machacek <mm@i.cz>

Upgrade (almost) to natd 2.0b1

- Transparent proxy support.
- PERMANENT_LINK IS NOW OBSOLETE, use redirect_port instead.
- Drop support for early FreeBSD 2.2 versions
- If separate input & output sockets are being used
use them to find out packet direction instead of
normal mechanism. This can be handy in complex environments
with multiple interfaces.
- PPTP redirect support by Dru Nelson <dnelson@redwoodsoft.com> added.
- Logging enhancements from Martin Machacek <mm@i.cz> added.

Obtained from: Ari Suutari <ari@suutari.iki.fi>

Make this work with the new alias library since, evidently, we're
not providing the backwards-compatability routines in libalias anymore
(which I think may have been a mistake).

Fix inconsistent port numbering in man page.

PR: 7250
Submitted-by: Norihiro Kumagai <kuma@jp.freebsd.org>

Add $Id$.

PR: 7249

Make things clearer.
Submitted (some time ago) by: Ted Mittelstaedt <tedm@portsoft.com>

Suggest port 8668 rather than 6668 for natd.
6668 is IRC.

Fix incorrect flag spec
PR: 6339 (part of)
Submitted by: Chris Dillon <cdillon@wolves.k12.mo.us>

.Sh AUTHOR -> .Sh AUTHORS. Use .An/.Aq.

Make it clear that aliasing is done on the public interface, not
the private one.

Added copyright (taken from natd.c).

Approved by: Ari Suutari <ari@suutari.iki.fi>

Typo/$Id$ police.

natd 1_10 => 1_11
Cosmetic style changes
Use u_short for port values.
Submitted by: Ari Suutari <ari@suutari.iki.fi>

Reverse my previous change and use htons() on an int
instead of htonl() !

This results in the int a,b,c,d changing to b,a,c,d,
but as it's subsequently coerced to a u_short, the
ultimate answer is correct.

If this isn't fixed properly soon (by the author) I'll
have a look at it again.

Noted by: eivind & ari@suutari.iki.fi

Use htonl() rather than htons().

Add -redirect_port and -redirect_address to the
synopsis.

Use err(3). Change firewall to firewall_enable in man page according to
/etc/rc.conf.

Sort cross refereces in section SEE ALSO.

Typo.

Ingored incoming packets are now dropped when
deny_incoming option is set to yes.
Submitted by: Ari Suutari <ari@suutari.iki.fi>

Fix my e-mail address. Old work addres is no good.

- Buffer space problem found by Sergio Lenzi <lenzi@bsi.com.br>
fixed. Natd now waits with select(2) for buffer space
to become available if write fails.
- Packet aliasing library upgraded to 2.2.

Submitted by: Ari Suutari <suutari@iki.fi>

Suggest using /etc/services entry rather than a
number in the "ipfw add divert" example.

sysconfig -> rc.conf

This commit was generated by cvs2svn to compensate for changes in r26781,
which included commits to RCS files with non-trunk default branches.