Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Remove redundant WARNS?=6 overrides and inherit the WARNS setting from
the toplevel directory.

This does not change any WARNS level and survives a make universe.

Approved by: ed (co-mentor)

Bump the version of all non-symbol-versioned shared libraries in
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.

Reviewed by: kib
Approved by: re (rwatson)

-Don't pass down the entire pkt to ProtoAliasIn, ProtoAliasOut, FragmentIn
and FragmentOut.
-Axe the old PacketAlias API: it has been deprecated since 5.x.

- Bump share library version which were missed in last bump

Reported by: jhb
Discussed with: deischen, des, doubg, harti
Approved by: re (kensmith)

Fix a regression: let natd load libalias modules before /usr is mounted
renaming /lib/libalias_*.so.4 to /lib/libalias_*.so.

Approved by: glebius
Reviewed by: glebius, ru

- Removed a copyright from makefile.
- Added ${.CURDIR} to .include "...".
- Whitespace fixes.

OK'ed by: piso

Put back NO_WERROR= to fix sparc64 build.

Summer of Code 2005: improve libalias - part 1 of 2

With the first part of my previous Summer of Code work, we get:

-made libalias modular:

-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime

-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)

-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia

-added logging support for kernel side

-cleanup

After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.

During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.

User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.

The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).

General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.

NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.

Approved by: glebius
Reviewed by: glebius, ru

Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)

Build userland libalias using src/sys/netinet/libalias.

Reviewed by: ru
Repocopy by: peter

natd core dumps when -reverse switch is used because of a bug in
libalias.

In /usr/src/lib/libalias/alias.c, the functions LibAliasIn and
LibAliasOutTry call the legacy PacketAliasIn/PacketAliasOut instead
of LibAliasIn/LibAliasOut when the PKT_ALIAS_REVERSE option is set.
In this case, the context variable "la" gets lost because the legacy
compatibility routines expect "la" to be global. This was obviously
an oversight when rewriting the PacketAlias* functions to the
LibAlias* functions.

The fix (as shown in the patch below) is to remove the legacy
subroutine calls and replace with the new ones using the "la" struct
as the first arg.

Submitted by: Gil Kloepfer <fgil@kloepfer.org>
Confirmed by: <nicolai@catpipe.net>
PR: 76839
MFC after: 3 days

Fix a problem in the Skinny ALG where a specially crafted packet could cause
a libalias application (e.g. natd, ppp, etc.) to crash. Note: Skinny support
is not enabled in natd or ppp by default.

Approved by: secteam (nectar)
MFC after: 1 day
Secuiryt: This fixes a remote DoS exploit

Sort sections.

include "alias.h", not <alias.h>

MFC after: 3 days

For variables that are only checked with defined(), don't provide
any fake value.

Fix outgoing ICMP on global instance.

Fix Skinny and PPTP NAT'ing after the introduction of the {ip,tcp,udp}_next
functions. Basically, the ip_next() function was used to get the PPTP and
Skinny headers when tcp_next() should have been used instead. Symptoms of
this included a segfault in natd when trying to process a PPTP or Skinny
packet.

Approved by: des

Push WARNS back up to 6, but define NO_WERROR; I want the warts out in the
open where people can see them and hopefully fix them.

Introduce inline {ip,udp,tcp}_next() functions which take a pointer to an
{ip,udp,tcp} header and return a void * pointing to the payload (i.e. the
first byte past the end of the header and any required padding). Use them
consistently throughout libalias to a) reduce code duplication, b) improve
code legibility, c) get rid of a bunch of alignment warnings.

Rewrite twowords() to access its argument through a char pointer and not
a short pointer. The previous implementation seems to be in a gray zone
of the C standard, and GCC generates incorrect code for it at -O2 or
higher on some platforms.

Temporarily lower WARNS to 3 while I figure out the alignment issues on
alpha.

Make libalias WARNS?=6-clean. This mostly involves renaming variables
named link, foo_link or link_foo to lnk, foo_lnk or lnk_foo, fixing
signed / unsigned comparisons, and shoving unused function arguments
under the carpet.

I was hoping WARNS?=6 might reveal more serious problems, and perhaps
the source of the -O2 breakage, but found no smoking gun.

Parenthesize return values.

Mechanical whitespace cleanup.

Add LibAliasOutTry() which checks a packet for a hit in the tables, but
does not create a new entry if none is found.

Mechanically kill hard sentence breaks.

Bumped document date.
Fixed markup.
Fixed examples to match the new API.

Unbreak natd.

Reported and submitted by: Sean McNeil (sean at mcneil.com)

Raise WARNS level to 2.

Deal with aliasing warnings.

Reviewed by: ru
Approved by: silence on the lists

Run through indent(1) so I can read the code without getting a headache.
The result isn't quite knf, but it's knfer than the original, and far
more consistent.

Mostly mechanical rework of libalias:

Makes it possible to have multiple packet aliasing instances in a
single process by moving all static and global variables into an
instance structure called "struct libalias".

Redefine a new API based on s/PacketAlias/LibAlias/g

Add new "instance" argument to all functions in the new API.

Implement old API in terms of the new API.

Grrr...add the Skinny alias code forgotten in the last commit.

Add Cisco Skinny Station protocol support to libalias, natd, and ppp.
Skinny is the protocol used by Cisco IP phones to talk to Cisco Call
Managers. With this code, one can use a Cisco IP phone behind a FreeBSD
NAT gateway.

Currently, having the Call Manager behind the NAT gateway is not supported.
More information on enabling Skinny support in libalias, natd, and ppp
can be found in those applications' manpages.

PR: 55843
Reviewed by: ru
Approved by: ru
MFC after: 30 days

Fixed -Wpointer-arith warning.

Submitted by: Stefan Farfeleder
PR: bin/56653

mdoc(7): Use the new feature of the .In macro.

style.Makefile(5)

Stage 3 of dynamic root support. Make all the libraries needed to run
binaries in /bin and /sbin installed in /lib. Only the versioned files
reside in /lib, the .so symlink continues to live /usr/lib so the
toolchain doesn't need to be modified.

In the PKT_ALIAS_PROXY_ONLY mode, make sure to preserve the
original source IP address, as promised in the manual page.

Spotted by: Vaclav Petricek

Removed a couple of .Xo/.Xc that are leftovers of the "ninth-argument
limit" mdoc(7) atavism.

Clarify that original address and port when doing transparent proxying
are _destination_ address and port.

Added myself to the AUTHORS section.

The .Fn function

A new API function PacketAliasRedirectDynamic() can be used
to mark a fully specified static link as dynamic; i.e. make
it a one-time link.

Make the PacketAliasSetAddress() function call optional. If it
is not called, and no static rules match an outgoing packet, the
latter retains its source IP address. This is in support of the
"static NAT only" mode.

style.Makefile(5)

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

Zap now-unused SHLIB_MINOR

Don't forget to recalculate the IP checksum of the original
IP datagram embedded into ICMP error message.

Spotted by: tcpdump 3.7.1 (-vvv)
MFC after: 3 days

Move IPFW2 definition before including ip_fw.h

Make indentation of new parts consistent with the style used for this file.

Fix a bug caused by dereferencing an invalid pointer when
no punch_fw was used.
Fix another couple of bugs which prevented rules from being
installed properly.

On passing, use IPFW2 instead of NEW_IPFW to compile the new code,
and slightly simplify the instruction generation code.

Remove trailing whitespace

The new ipfw code.

This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.

The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).

The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.

I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.

In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.

On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like

ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any

This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.

Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:

10.20.30.0/26{18,44,33,22,9}

which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).

Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.

The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.

Avoid unintentional trigraph.

Fixed the bug in transparent TCP proxying with the "encode_ip_hdr"
option -- TcpAliasOut() did not catch the IP header length change.

Submitted by: Stepachev Andrey <aka50@mail.ru>

When servicing an internal FTP server, punch ipfirewall(4) holes
for passive mode data connections (PASV/EPSV -> 227/229). Well,
the actual punching happens a bit later, when the aliasing link
becomes fully specified.

Prodded by: Danny Carroll <dannycarroll@hotmail.com>
MFC after: 1 week

cmott@scientech.com -> cm@linktel.net

Requested by: Charles Mott <cmott@scientech.com>

mdoc(7) police: Use the new .In macro for #include statements.

Add __FBSDID's to libalias

Fixed the bug that prevented communication with FTP servers behind
NAT in extended passive mode if the server's public IP address was
different from the main NAT address. This caused a wrong aliasing
link to be created that did not route the incoming packets back to
the original IP address of the server.

natd -v -n pub0 -redirect_address localFTP publicFTP

Note that even if localFTP == publicFTP, one still needs to supply
the -redirect_address directive. It is needed as a helper because
extended passive mode's 229 reply does not contain the IP address.

MFC after: 1 week

Added TFTP support.

Submitted by: Joe Clarke <marcus@marcuscom.com>
MFC after: 2 weeks

Close the "IRC DCC" security breach reported recently on Bugtraq.

Submitted by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org>

Make the copyright consistent.

Previously approved by: Charles Mott <cmott@scientech.com>

Handle snprintf() returning -1

MFC after: 2 weeks

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

mdoc(7) police: removed HISTORY info from the .Os call.

Fixed the brain-o in rev. 1.10: the logic check was reversed.

Reported by: Bernd Fuerwitt <bf@fuerwitt.de>

Add BSD-style copyright headers

Approved by: Charles Mott <cmott@scientech.com>

Change to a standard BSD-style copyright

Approved by: Atsushi Murai <amurai@spec.co.jp>

Add an integer field to keep protocol-specific flags with links.

For FTP control connection, keep the CRLF end-of-line termination
status in there.

Fixed the bug when the first FTP command in a session was ignored.

PR: 24048
MFC after: 1 week

MAN[1-9] -> MAN.

Make header files conform to style(9).

Reviewed by (*): bde

(*) alias_local.h only got a cursory glance.

Remove an extraneous declaration.

Remove (non-protected) variable names from function prototypes.

Add a few ``const''s to silence some -Wwrite-strings warnings

Ignore leading witespace in the string given to PacketAliasProxyRule().

mdoc(7) police: use the new feature of the An macro.

Added boolean argument to link searching functions, indicating
whether they should create a link if lookup has failed or not.

A significant rewrite of PPTP aliasing code.

PPTP links are no longer dropped by simple (and inappropriate in this
case) "inactivity timeout" procedure, only when requested through the
control connection.

It is now possible to have multiple PPTP servers running behind NAT.
Just redirect the incoming TCP traffic to port 1723, everything else
is done transparently.

Problems were reported and the fix was tested by:
Michael Adler <Michael.Adler@compaq.com>,
David Andersen <dga@lcs.mit.edu>

A failure to allocate memory for auxiliary TCP data is now fatal.
This fixes a null pointer dereference problem that is unlikely to
happen in normal circumstances.

A bit of indentation reformatting.

Fixed the calculations with UDP header length field.
The field is in network byte order and contains the
size of the header.

Reviewed by: brian

Add -Wmissing-prototypes.

Match IPPROTO_ICMP with IP protocol field of the original IP
datagram embedded into ICMP error message, not with protocol
field of ICMP message itself (which is always IPPROTO_ICMP).

Pointed by: Erik Salander <erik@whistle.com>

Changed the way we handle outgoing ICMP error messages -- do
not alias `ip_src' unless it comes from the host an original
datagram that triggered this error message was destined for.

PR: 20712
Reviewed by: brian, Charles Mott <cmott@scientech.com>

Grab ADJUST_CHECKSUM() macro from alias_local.h.

Create aliasing links for incoming ICMP echo/timestamp requests.
This makes outgoing ICMP echo/timestamp replies to be de-aliased
with the right source IP, not exactly the primary aliasing IP.

strtok -> strsep (no strtok allowed in libraries)
add unsigned char cast to ctype macro

Fixed PunchFW code segmentation violation bug.

Reported by: Christian Schade <chris@cube.sax.de>

Use queue(3) LIST_* macros for doubly-linked lists.

- Do not modify Peer's Call ID in outgoing Incoming-Call-Connected
PPTP control messages.

- Cosmetics: replace `GRE link' with `PPTP link'.

Reviewed by: Erik Salander <erik@whistle.com>

Adjust TCP checksum rather than compute it afresh.

Submitted by: Erik Salander <erik@whistle.com>

Whitespace only:

Fix an overlong line and trailing whitespace that crept in, in the
previous commit.

Add address translation support for RTSP/RTP used by RealPlayer and
Quicktime streaming media applications.

Add a BUGS section to the man page.

Submitted by: Erik Salander <erik@whistle.com>

Fixed PunchFWHole():
- ipfw always rejected rule with `neither in nor out' diagnostics.
- number of src/dst ports was not set properly.

- Removed PacketAliasPptp() API function.
- SHLIB_MAJOR++.

Added true support for PPTP aliasing. Some nice features include:

- Multiple PPTP clients behind NAT to the same or different servers.

- Single PPTP server behind NAT -- you just need to redirect TCP
port 1723 to a local machine. Multiple servers behind NAT is
possible but would require a simple API change.

- No API changes!

For more information on how this works see comments at the start of
the alias_pptp.c.

PacketAliasPptp() is no longer necessary and will be removed soon.

Submitted by: Erik Salander <erik@whistle.com>
Reviewed by: ru
Rewritten by: ru
Reviewed by: Erik Salander <erik@whistle.com>

- Improved passive mode FTP support by aliasing 229 replies.
- Stricter checking of PORT/EPRT/227/229 messages format.
- Moved all security checks into one place.

- Added support for passive mode FTP by aliasing 227 replies.
It does mean that it is now possible to run passive-mode FTP
server behind NAT.

- SECURITY: FTP aliasing engine now ensures that:
o the segment preceding a PORT/227 segment terminates with a \r\n;
o the IP address in the PORT/227 matches the source IP address of
the packet;
o the port number in the PORT command or 277 reply is greater than
or equal to 1024.

Submitted by: Erik Salander <erik@whistle.com>
Reviewed by: ru

Revert the default behaviour for incoming connections so
that they (once again) go to the target machine rather than
the alias address.

PR: 18354
Submitted by: ru

Replace PacketAliasRedirectPptp() (which had nothing specific
to PPTP) with more generic PacketAliasRedirectProto().

Major number is not bumped because it is believed that noone
has started using PacketAliasRedirectPptp() yet.

Spell PacketAliasRedirectAddr() correctly.

Load Sharing using IP Network Address Translation (RFC 2391, LSNAT).

LSNAT links are first created by either PacketAliasRedirectPort() or
PacketAliasRedirectAddress() and then set up by one or more calls to
PacketAliasAddServer().

Add support for multiple PPTP sessions:

- new API function: PacketAliasRedirectPptp()
- new mode bit: PKT_ALIAS_DENY_PPTP

Please see manual page for details.

Apply TCP_EXPIRE_CONNECTED (86400 seconds) timeout only to established
connections, after SYN packets were seen from both ends. Before this,
it would get applied right after the first SYN packet was seen (either
from client or server). With broken TCP connection attempts, when the
remote end does not respond with SYNACK nor with RST, this resulted in
having a useless (ie, no actual TCP connection associated with it) TCP
link with 86400 seconds TTL, wasting system memory. With high rate of
such broken connection attempts (for example, remote end simply blocks
these connection attempts with ipfw(8) without sending RST back), this
could result in a denial-of-service.

PR: bin/17963

A complete reformatting of manual page.

Make partially specified permanent links without `dst_addr'
but with `dst_port' work for outgoing packets.

This case was not handled properly when I first fixed this
in revision 1.17.

This change is also required for the upcoming improved PPTP
support patches -- that is how I found the problem.

Before this change:

# natd -v -a aliasIP \
-redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT

Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to
[TCP] aliasIP:localPORT -> remoteIP:remotePORT

After this change:

# natd -v -a aliasIP \
-redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT

Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to
[TCP] publicIP:publicPORT -> remoteIP:remotePORT

- Add support for FTP EPRT (RFC 2428) command.
- Minor optimizations.
- Minor spelling fixes.

PR: 14305
Submitted by: ume
Rewritten by: ru

- Remove unused includes.
- Minor spelling fixes.
- Make IcmpAliasOut2() really work.

Before this change:

# natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P
natd[87923]: Aliasing to A.A.A.A, mtu 1500 bytes
In [UDP] [UDP] X.X.X.X:49562 -> P.P.P.P:50000 aliased to
[UDP] X.X.X.X:49562 -> 192.168.1.1:50000
Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to
[ICMP] A.A.A.A -> X.X.X.X 3(3)

# tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)"
tcpdump: listening on PUB_IFACE
X.X.X.X.49562 > P.P.P.P.50000: udp 3
A.A.A.A > X.X.X.X: icmp: A.A.A.A udp port 50000 unreachable

After this change:

# natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P
natd[89360]: Aliasing to A.A.A.A, mtu 1500 bytes
In [UDP] [UDP] X.X.X.X:49563 -> P.P.P.P:50000 aliased to
[UDP] X.X.X.X:49563 -> 192.168.1.1:50000
Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to
[ICMP] P.P.P.P -> X.X.X.X 3(3)

# tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)"
tcpdump: listening on PUB_IFACE
X.X.X.X.49563 > P.P.P.P.50000: udp 3
P.P.P.P > X.X.X.X: icmp: P.P.P.P udp port 50000 unreachable

- Moved NULL definition into private include file.
- Minor spelling fixes.

Minor spelling fixes.

Correct Charles Mott's email address

Requested by: Charles Mott <cmott@scientech.com>

Allow PacketAliasSetTarget() to be passed the following:
INADDR_NONE: Incoming packets go to the alias address (the default)
INADDR_ANY: Incoming packets are not NAT'd (direct access to the
internal network from outside)
anything else: Incoming packets go to the specified address

Change a few inaddr::s_addr == 0 to inaddr::s_addr == INADDR_ANY
while I'm there.

When an incoming packet is received that is not specifically
redirected and when no target address has been specified, NAT
the destination address to the alias address rather than
allowing people direct access to your internal network from
outside.

Make _FindLinkIn() static and only define GetDestPort when
NO_FW_PUNCH isn't defined.

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

-it do, among other things, clear out any
+it does, amongst other things, clear out any

The old sentance didn't seem to make sense.

The flags PKT_ALIAS_PUNCH_FW and PKT_ALIAS_PROXY_ONLY were both
being defined as 0x40. Change the former to be 0x100.

Submitted by: Erik Salander <erik@whistle.com>
Approved by: jkh

Mention what PKT_ALIAS_PROXY_ONLY does.

Prompted by: archie

Replace beforeinstall target with new variables used by .mk system.

Reviewed by: marcel, and make world

Fix a '&&' that should have been a '&'.

Submitted by: Erik Salander <erik@whistle.com>

Fix several typos.

Submitted by: Erik Salander <erik@whistle.com>

Restore sub-chapters order.

PR: docs/14766
Submitted by: Kazutoshi Kubota <kazu@iworks.co.jp>

Properly handle the case when either the aliasing or source address of
the link are equal to the default aliasing address. Do not zero them!

This will fix the problem with non-working links added with the source
and/or aliasing address equal to the default aliasing address, but the
default aliasing address is set later, after the link has been set up,
like both natd(8) and ppp(8) do (for objective reasons).

Reviewed by: Brian Somers <brian@FreeBSD.org>,
Eivind Eklund <eivind@FreeBSD.org>,
Charles Mott <cmott@srv.net>

ReLink() partial links in FindLinkOut() in the same manner as we do it
in FindLinkIn(). This will make TcpMonitorIn()/TcpMonitorOut() happy.

Reviewed by: eivind

Restore previous version of FindLinkIn().

Instead, natd(8) should be fixed to call PacketAliasSetAddress()
as part of initialization, as required by libalias(3).

- Make partially specified permanent links (without `dst_addr' and/or
`dst_port') work for outgoing packets.

- Make permanent links whose `alias_addr' matches the primary aliasing
address `aliasAddress' work for incoming packets.

- Typo fixes.

Reviewed by: brian, eivind

sys/errno.h -> errno.h

- Optimization to the previous (rev 1.15) commit.

Requested by: eivind
Discussed with: eivind
Reviewed by: brian, eivind

Handle TCP reset sequence properly.

In the words of originator:
:If an incoming connection is initiated through natd and deny_incoming is
:not set, then a new alias_link structure is created to handle the link.
:If there is nothing listening for the incoming connection, then the kernel
:responds with a RST for the connection. However, this is not processed
:correctly in libalias/alias.c:TcpMonitor{In,Out} and
:libalias/alias_db.c:SetState{In,Out} as it thinks a connection
:has been established and therefore applies a timeout of 86400 seconds
:to the link.
:
:If many of these half-connections are initiated (during, for example, a
:port scan of the host), then many thousands of unnecessary links are
:created and the resident size of natd balloons to 20MB or more.

PR: 13639
Reviewed by: brian

Fix typo.

Add $FreeBSD$ and spell Eklund properly.

Approved by: brian (well, he approved adding $Id$)

$Id$ -> $FreeBSD$

Aallow ppp to work with Nortel Networks Extranet Switch
product and Windows NT tunneling.

Submitted by: Chain Lee <chain@nortelnetworks.com>

Typo: 102 => 192 (PR: docs/13310 - Maxim Sobolev <sobomax@altavista.net>)

Various man page cleanup:

- Sort xrefs
- FreeBSD.ORG -> FreeBSD.org
- Be consistent with section names as outlines in mdoc(7)
- Other misc mdoc cleanup.

PR: doc/13144
Submitted by: Alexy M. Zelkin <phantom@cris.net>

Don't get caught in an infinite recursion when PKT_ALIAS_REVERSE
is set.
Document PKT_ALIAS_REVERSE.

Pointed out by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.home.com>
PR: 12304

brucify
Mentioned by: sprice@hiwaay.net

Make incoming packets work as keepalives, too. This should fix problems
for some games.

Notified of problem by: tim@turbinegames.com

Add missing ``.''.

Work around an egcs optimizer bug (i386). This should fix the active ftp
hang problem. A bug report has been sent to cygnus.

PacketAliasProxyRule takes a const char *
Reminded by: bde

Add a ``const'' and remove some inconsistent prototype args.

Remove duplicate line.

Reviewed by: eivind

Remove all diagnostics to stdout/stderr with #ifdef DEBUG
Statify functions in alias_nbt.c

Document PacketAliasPptp() and allow it to be disabled
by passing INADDR_NONE.

Remove unused function stubs.

Mention that PacketAliasProxyRule() doesn't accept host names,
just IP numbers.

Document PacketAliasProxyRule() and fix a typo.

Version 3.0: January 1, 1999
- Transparent proxying support added.
- PPTP redirecting support added based on patches
contributed by Dru Nelson <dnelson@redwoodsoft.com>.

Submitted by: Charles Mott <cmott@srv.net>

If we can't open alias.log, don't try to write to the
resulting NULL FILE *.
PR: 9403

Reviewed by: freebsd-current

Add bounds checking to netbios NS packet resolving code. This should
prevent natd from crashing on badly formed netbios packets (as might be
heard when the machine is sitting on a cable modem or certain DSL
networks), and also closes potential security holes that might have
exploited the lack of bounds checking in the previous version of the
code.

Fix a couple of typos.

Remove OpenBSD build support - let the Makefile vary per
OS rather than making it a mess and potentially screwing
up cross builds.
Suggested by: bde

Add Id keyword.

Add OpenBSD build support

Add CUSEEME support. This has *not* been tested, nor
could I find anyone to test it, so please report any
problems to me.

Quieten gcc 2.8.1

Don't call PunchFWHole() ifdef NO_FW_PUNCH
Pointed out by: "Steve Sims" <SimsS@IBM.Net>

Spelling corrections.

PR: 6868
Submitted by: Josh Gilliam <josh@quick.net>

Primary verison of NetBIOS over TCP/IP. Now you can connect Windows
DOMAIN as DOMAIN user through NAT function. See also RFC1002 for
futher detail of SMB structure.

Submitted by: Atsushi Murai <amurai@spec.co.jp>

o Support a compile-time -DNO_FW_PUNCH for portability
(and those of us that don't want the functionality).
o Don't assume sizeof(long) == 4.
Ok'd by: Charles Mott <cmott@srv.net>

FixedSpellingErrorInAFunctionname.

1) in CleanupAliasData, don't nullify entry in linkTableOut
since there might be permanent entries still left after
calls to DeleteLink (it will be nullified by DeleteLink
if all entries are deleted, won't it ?)

2) in PacketAliasSetAddress, set the aliasing address
even when PKT_ALIAS_RESET_ON_ADDR_CHANGE is in effect.
Just don't clean up links in this case.

Submitted by: Ari Suutari <ari@suutari.iki.fi>
via: Charles Mott <cmott@srv.net>
PR: 5041

Fixed a missing #include in the synopsis.
Fixed some wrong prototypes.
Fixed a misspelled function name.

The owner of this file should add a copyright and an Id.

Added prototypes for functions that were documented in libalias.3
but not prototyped here.

Remove __libalias_version. Ppp no longer uses it.

Remove use of <osreldate.h>.

Screwed up by: myself

Put back __libalias_version so ppp(8) build again.

Sync with ipfw interface change: fw_pts is now part of a union (a
necessary evil due to the 108 byte setsockopt() limit).

include <net/if.h> and restore this to sanity.

Teach libalias to work with IPFW firewalls (controlled by a flag).

Obtained from: Yes development tree (+ 10 lines of patches from
Charles Mott, original libalias author)

Upgrade to 2.4 (Fix -PKT_ALIAS_UNREGISTERED_ONLY)
Submitted by: Charles Mott <cmott@srv.net>

Add __libalias_version so that ppp can derive the
correct library name for dlopen()

Fix file descriptor leak.

Submitted by: Charles Mott <cmott@srv.net>
Identified by: Gordon Burditt

Update to version 2.2. Only the PacketAlias*()
functions should now be used. The old 2.1 stuff is
there for backwards compatability.
Submitted by: Charles Mott <cmott@snake.srv.net>

This commit was generated by cvs2svn to compensate for changes in r26026,
which included commits to RCS files with non-trunk default branches.