libalias.3 revision 44546
1.Dd July, 1997 2.Dt "libalias" 3 3.Os 4.Sh NAME 5.Nm "libalias" 6Packet Aliasing Library. A collection of 7functions for aliasing and de-aliasing 8of IP packets, intended for masquerading and 9network address translation (NAT). 10 11.Sh SYNOPSIS 12.Fd #include <sys/types.h> 13.Fd #include <netinet/in.h> 14.Fd #include <alias.h> 15 16Function prototypes are given in the main body 17of the text. 18 19.Sh CONTENTS 20.Bd -literal -offset left 211. Introduction 222. Initialization and Control 23 2.1 PacketAliasInit() 24 2.2 PacketAliasUninit() 25 2.3 PacketAliasSetAddress() 26 2.4 PacketAliasSetMode() 27 2.5 PacketAliasSetFWBase() 283. Packet Handling 29 3.1 PacketAliasIn() 30 3.2 PacketAliasOut() 314. Port and Address Redirection 32 4.1 PacketAliasRedirectPort() 33 4.2 PacketAliasRedirectAddr() 34 4.3 PacketAliasRedirectDelete() 35 4.4 PacketAliasProxyRule() 365. Fragment Handling 37 5.1 PacketAliasSaveFragment() 38 5.2 PacketAliasGetFragment() 39 5.3 PacketAliasFragmentIn() 406. Miscellaneous Functions 41 6.1 PacketAliasSetTarget() 42 6.2 PacketAliasCheckNewLink() 43 6.3 PacketAliasInternetChecksum() 447. Authors 458. Acknowledgments 46 47Appendix A: Conceptual Background 48 A.1 Aliasing Links 49 A.2 Static and Dynamic Links 50 A.3 Partially Specified Links 51 A.4 Dynamic Link Creation 52.Ed 53 54.Sh 1. Introduction 55This library is a moderately portable 56set of functions designed to assist 57in the process of IP masquerading and 58network address translation. Outgoing 59packets from a local network with 60unregistered IP addresses can be aliased 61to appear as if they came from an 62accessible IP address. Incoming packets 63are then de-aliased so that they are sent 64to the correct machine on the local network. 65 66A certain amount of flexibility is built 67into the packet aliasing engine. In 68the simplest mode of operation, a 69many-to-one address mapping takes place 70between local network and the packet 71aliasing host. This is known as IP 72masquerading. In addition, one-to-one 73mappings between local and public addresses 74can also be implemented, which is known as 75static NAT. In between these extremes, 76different groups of private addresses 77can be linked to different public addresses, 78comprising several distinct many-to-one 79mappings. Also, a given public address 80and port can be statically redirected to 81a private address/port. 82 83The packet aliasing engine was designed 84to operate in user space outside of the 85kernel, without any access to private 86kernel data structure, but the source code 87can also be ported to a kernel environment. 88 89.Sh 2. Initialization and Control 90Two specific functions, PacketAliasInit() 91and PacketAliasSetAddress(), must always be 92called before any packet handling may be 93performed. In addition, the operating mode 94of the packet aliasing engine can be customized 95by calling PacketAliasSetMode(). 96.Ss 2.1 PacketAliasInit() 97 98.Ft void 99.Fn PacketAliasInit "void" 100 101This function has no argument or return 102value and is used to initialize internal 103data structures. The following mode bits 104are always set after calling 105PacketAliasInit(). See section 2.3 for 106the meaning of these mode bits. 107.Bd -literal -offset indent 108 PKT_ALIAS_USE_SAME_PORTS 109 PKT_ALIAS_USE_SOCKETS 110 PKT_ALIAS_RESET_ON_ADDR_CHANGE 111 112.Ed 113This function will always return the packet 114aliasing engine to the same initial state. 115PacketAliasSetAddress() must be called afterwards, 116and any desired changes from the default mode 117bits listed above require a call to 118PacketAliasSetMode(). 119 120It is mandatory that this function be called 121at the beginning of a program prior to any 122packet handling. 123.Ss 2.2 PacketAliasUninit() 124 125.Ft void 126.Fn PacketAliasUninit "void" 127 128This function has no argument or return 129value and is used to clear any resources 130attached to internal data structures. 131 132This functions should be called when a 133program stop using the aliasing engine; 134it do, among other things, clear out any 135firewall holes. To provide backwards 136compatibility and extra security, it is 137added to the atexit() chain by 138PacketAliasInit(). Calling it multiple 139times is harmless. 140.Ss 2.3 PacketAliasSetAddress() 141 142.Ft void 143.Fn PacketAliasSetAddress "struct in_addr addr" 144 145This function sets the source address to which 146outgoing packets from the local area network 147are aliased. All outgoing packets are remapped 148to this address unless overridden by a static 149address mapping established by 150PacketAliasRedirectAddr(). 151 152If the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit 153is set (the default mode of operation), then 154the internal aliasing link tables will be reset 155any time the aliasing address changes, as if 156PacketAliasReset() were called. This is useful 157for interfaces such as ppp where the IP 158address may or may not change on successive 159dial-up attempts. 160 161If the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit 162is set to zero, this function can also be used to 163dynamically change the aliasing address on a 164packet to packet basis (it is a low overhead 165call). 166 167It is mandatory that this function be called 168prior to any packet handling. 169.Ss 2.4 PacketAliasSetMode() 170 171.Ft unsigned int 172.Fn PacketAliasSetMode "unsigned int mode" "unsigned int mask" 173 174This function sets or clears mode bits 175according to the value of 176.Em mode . 177Only bits marked in 178.Em mask 179are affected. The following mode bits are 180defined in alias.h: 181.Bl -hang -offset left 182.It PKT_ALIAS_LOG. 183Enables logging /var/log/alias.log. The log file 184shows total numbers of links (icmp, tcp, udp) each 185time an aliasing link is created or deleted. Mainly 186useful for debugging when the log file is viewed 187continuously with "tail -f". 188.It PKT_ALIAS_DENY_INCOMING. 189If this mode bit is set, all incoming packets 190associated with new TCP connections or new 191UDP transactions will be marked for being 192ignored (PacketAliasIn() return code 193PKT_ALIAS_IGNORED) by the calling program. 194Response packets to connections or transactions 195initiated from the packet aliasing host or 196local network will be unaffected. This mode 197bit is useful for implementing a one-way firewall. 198.It PKT_ALIAS_SAME_PORTS. 199If this mode bit is set, the packet aliasing 200engine will attempt to leave the alias port 201numbers unchanged from the actual local port 202number. This can be done as long as the 203quintuple (proto, alias addr, alias port, 204remote addr, remote port) is unique. If a 205conflict exists, an new aliasing port number is 206chosen even if this mode bit is set. 207.It PKT_ALIAS_USE_SOCKETS. 208This bit should be set when the the packet 209aliasing host originates network traffic as 210well as forwards it. When the packet aliasing 211host is waiting for a connection from an 212unknown host address or unknown port number 213(e.g. an FTP data connection), this mode bit 214specifies that a socket be allocated as a place 215holder to prevent port conflicts. Once a 216connection is established, usually within a 217minute or so, the socket is closed. 218.It PKT_ALIAS_UNREGISTERED_ONLY. 219If this mode bit is set, traffic on the 220local network which does not originate from 221unregistered address spaces will be ignored. 222Standard Class A, B and C unregistered addresses 223are: 224.Bd -literal -offset indent 225 10.0.0.0 -> 10.255.255.255 (Class A subnet) 226 172.16.0.0 -> 172.31.255.255 (Class B subnets) 227 192.168.0.0 -> 192.168.255.255 (Class C subnets) 228 229.Ed 230This option is useful in the case that 231packet aliasing host has both registered and 232unregistered subnets on different interfaces. 233The registered subnet is fully accessible to 234the outside world, so traffic from it doesn't 235need to be passed through the packet aliasing 236engine. 237.It PKT_ALIAS_RESET_ON_ADDR_CHANGE. 238When this mode bit is set and 239PacketAliasSetAddress() is called to change 240the aliasing address, the internal link table 241of the packet aliasing engine will be cleared. 242This operating mode is useful for ppp links 243where the interface address can sometimes 244change or remain the same between dial-ups. 245If this mode bit is not set, it the link table 246will never be reset in the event of an 247address change. 248.It PKT_ALIAS_PUNCH_FW. 249This option make libalias `punch holes' in an 250ipfw based firewall for FTP/IRC DCC connections. 251The holes punched are bound by from/to IP address 252and port; it will not be possible to use a hole 253for another connection. A hole is removed when 254the connection that use it die. To cater for 255unexpected death of a program using libalias (e.g 256kill -9), changing the state of the flag will 257clear the entire ipfw range allocated for holes. 258This will also happen on the initial call to 259PacketAliasSetFWBase(). This call must happen 260prior to setting this flag. 261 262.El 263 264.Ss 2.5 PacketAliasSetFWBase() 265 266.Ft void 267.Fn PacketAliasSetFWBase "unsigned int base" "unsigned int num" 268 269Set IPFW range allocated for punching firewall holes (with the 270PKT_ALIAS_PUNCH_FW flag). The range will be cleared for all rules on 271initialization. 272 273.Sh 3. Packet Handling 274The packet handling functions are used to 275modify incoming (remote->local) and outgoing 276(local->remote) packets. The calling program 277is responsible for receiving and sending 278packets via network interfaces. 279 280Along with PacketAliasInit() and PacketAliasSetAddress(), 281the two packet handling functions, PacketAliasIn() 282and PacketAliasOut(), comprise minimal set of functions 283needed for a basic IP masquerading implementation. 284.Ss 3.1 PacketAliasIn() 285 286.Ft int 287.Fn PacketAliasIn "char *buffer" "int maxpacketsize" 288 289An incoming packet coming from a remote machine to 290the local network is de-aliased by this function. 291The IP packet is pointed to by 292.Em buffer , 293and 294.Em maxpacketsize 295indicates the size of the data structure containing 296the packet and should be at least as large as the 297actual packet size. 298 299Return codes: 300.Bl -hang -offset left 301.It PKT_ALIAS_ERROR. 302An internal error within the packet aliasing 303engine occurred. 304.It PKT_ALIAS_OK. 305The packet aliasing process was successful. 306.It PKT_ALIAS_IGNORED. 307The packet was ignored and not de-aliased. 308This can happen if the protocal is unrecognized, 309possibly an ICMP message type is not handled or 310if incoming packets for new connections are being 311ignored (see PKT_ALIAS_DENY_INCOMING in section 3122.2). 313.It PKT_ALIAS_UNRESOLVED_FRAGMENT. 314This is returned when a fragment cannot be 315resolved because the header fragment has not 316been sent yet. In this situation, fragments 317must be saved with PacketAliasSaveFragment() 318until a header fragment is found. 319.It PKT_ALIAS_FOUND_HEADER_FRAGMENT. 320The packet aliasing process was successful, 321and a header fragment was found. This is a 322signal to retrieve any unresolved fragments 323with PacketAliasGetFragment() and de-alias 324them with PacketAliasFragmentIn(). 325.El 326.Ss 3.2 PacketAliasOut() 327 328.Ft int 329.Fn PacketAliasOut "char *buffer" "int maxpacketsize" 330 331An outgoing packet coming from the local network 332to a remote machine is aliased by this function. 333The IP packet is pointed to by 334.Em buffer r, 335and 336.Em maxpacketsize 337indicates the maximum packet size permissible 338should the packet length be changed. IP encoding 339protocols place address and port information in 340the encapsulated data stream which have to be 341modified and can account for changes in packet 342length. Well known examples of such protocols 343are FTP and IRC DCC. 344 345Return codes: 346.Bl -hang -offset left 347.It PKT_ALIAS_ERROR. 348An internal error within the packet aliasing 349engine occurred. 350.It PKT_ALIAS_OK. 351The packet aliasing process was successful. 352.It PKT_ALIAS_IGNORED. 353The packet was ignored and not de-aliased. 354This can happen if the protocal is unrecognized, 355or possibly an ICMP message type is not handled. 356.El 357 358.Sh 4. Port and Address Redirection 359The functions described in this section allow machines 360on the local network to be accessible in some degree 361to new incoming connections from the external network. 362Individual ports can be re-mapped or static network 363address translations can be designated. 364.Ss 4.1 PacketAliasRedirectPort() 365 366.Ft struct alias_link * 367.Fo PacketAliasRedirectPort 368.Fa "struct in_addr local_addr" 369.Fa "u_short local_port" 370.Fa "struct in_addr remote_addr" 371.Fa "u_short remote_port" 372.Fa "struct in_addr alias_addr" 373.Fa "u_short alias_port" 374.Fa "u_char proto" 375.Fc 376 377This function specifies that traffic from a 378given remote address/port to an alias address/port 379be redirected to a specified local address/port. 380The parameter 381.Em proto 382can be either IPPROTO_TCP or IPPROTO_UDP, as 383defined in <netinet/in.h>. 384 385If 386.Em local_addr 387or 388.Em alias_addr 389is zero, this indicates that the packet aliasing 390address as established by PacketAliasSetAddress() 391is to be used. Even if PacketAliasAddress() is 392called to change the address after PacketAliasRedirectPort() 393is called, a zero reference will track this change. 394 395If 396.Em remote_addr 397is zero, this indicates to redirect packets from 398any remote address. Likewise, if 399.Em remote_port 400is zero, this indicates to redirect packets originating 401from any remote port number. Almost always, the remote 402port specification will be zero, but non-zero remote 403addresses can be sometimes be useful for firewalling. 404If two calls to PacketAliasRedirectPort() overlap in 405their address/port specifications, then the most recent 406call will have precedence. 407 408This function returns a pointer which can subsequently 409be used by PacketAliasRedirectDelete(). If NULL is 410returned, then the function call did not complete 411successfully. 412 413All port numbers are in network address byte order, 414so it is necessary to use htons() to convert these 415parameters from internally readable numbers to 416network byte order. Addresses are also in network 417byte order, which is implicit in the use of the 418.Em struct in_addr 419data type. 420.Ss 4.2 PacketAliasRedirectAddr() 421 422.Ft struct alias_link * 423.Fo PacketAliasRedirectAddr 424.Fa "struct in_addr local_addr" 425.Fa "struct in_addr alias_addr" 426.Fc 427 428This function desgnates that all incoming 429traffic to 430.Em alias_addr 431be redirected to 432.Em local_addr. 433Similarly, all outgoing traffic from 434.Em local_addr 435is aliased to 436.Em alias_addr . 437 438If 439.Em local_addr 440or 441.Em alias_addr 442is zero, this indicates that the packet aliasing 443address as established by PacketAliasSetAddress() 444is to be used. Even if PacketAliasAddress() is 445called to change the address after PacketAliasRedirectAddr() 446is called, a zero reference will track this change. 447 448If subsequent calls to PacketAliasRedirectAddr() 449use the same aliasing address, all new incoming 450traffic to this aliasing address will be redirected 451to the local address made in the last function call, 452but new traffic all of the local machines designated 453in the several function calls will be aliased to 454the same address. Consider the following example: 455.Bd -literal -offset left 456 PacketAliasRedirectAddr(inet_aton("192.168.0.2"), 457 inet_aton("141.221.254.101")); 458 PacketAliasRedirectAddr(inet_aton("192.168.0.3"), 459 inet_aton("141.221.254.101")); 460 PacketAliasRedirectAddr(inet_aton("192.168.0.4"), 461 inet_aton("141.221.254.101")); 462.Ed 463 464Any outgoing connections such as telnet or ftp 465from 192.168.0.2, 102.168.0.3, 192.168.0.4 will 466appear to come from 141.221.254.101. Any incoming 467connections to 141.221.254.101 will be directed 468to 192.168.0.4. 469 470Any calls to PacketAliasRedirectPort() will 471have precedence over address mappings designated 472by PacketAliasRedirectAddr(). 473 474This function returns a pointer which can subsequently 475be used by PacketAliasRedirectDelete(). If NULL is 476returned, then the function call did not complete 477successfully. 478.Ss 4.3 PacketAliasRedirectDelete() 479 480.Ft void 481.Fn PacketAliasRedirectDelete "struct alias_link *ptr" 482 483This function will delete a specific static redirect 484rule entered by PacketAliasRedirectPort() or 485PacketAliasRedirectAddr(). The parameter 486.Em ptr 487is the pointer returned by either of the redirection 488functions. If an invalid pointer is passed to 489PacketAliasRedirectDelete(), then a program crash 490or unpredictable operation could result, so it is 491necessary to be careful using this function. 492 493.Sh 5. Fragment Handling 494The functions in this section are used to deal with 495incoming fragments. 496 497Outgoing fragments are handled within PacketAliasOut() 498by changing the address according to any 499applicable mapping set by PacketAliasRedirectAddress(), 500or the default aliasing address set by 501PacketAliasSetAddress(). 502 503Incoming fragments are handled in one of two ways. 504If the header of a fragmented IP packet has already 505been seen, then all subsequent fragments will be 506re-mapped in the same manner the header fragment 507was. Fragments which arrive before the header 508are saved and then retrieved once the header fragment 509has been resolved. 510.Ss 4.4 PacketAliasProxyRule() 511 512.Ft int 513.Fn PacketAliasProxyRule "char *cmd" 514 515The passed 516.Ar cmd 517string consists of one or more pairs of words. The first word in each 518pair is a token and the second is the value that should be applied for 519that token. Tokens and their argument types are as follows: 520 521.Bl -tag -offset XXX -width XXX 522.It type encode_ip_hdr|encode_tcp_stream|no_encode 523In order to support transparent proxying, it is necessary to somehow 524pass the original address and port information into the new destination 525server. If 526.Dq encode_ip_hdr 527is specified, the original address and port is passed as an extra IP 528option. If 529.Dq encode_tcp_stream 530is specified, the original address and port is passed as the first 531piece of data in the tcp stream in the format 532.Dq DEST Ar IP port . 533.It port Ar portnum 534Only packets with the destination port 535.Ar portnum 536are proxied. 537.It server Ar host[:portnum] 538This specifies the 539.Ar host 540and 541.Ar portnum 542that the data is to be redirected to. 543.Ar host 544must be an IP address rather than a DNS host name. If 545.Ar portnum 546is not specified, the destination port number is not changed. 547.Pp 548The 549.Ar server 550specification is mandatory unless the 551.Dq delete 552command is being used. 553.It rule Ar index 554Normally, each call to 555.Fn PacketAliasProxyRule 556inserts the next rule at the start of a linear list of rules. If an 557.Ar index 558is specified, the new rule will be checked after all rules with lower 559indices. Calls to 560.Fn PacketAliasProxyRule 561that do not specify a rule are assigned rule 0. 562.It delete Ar index 563This token and its argument must not be used with any other tokens. When 564used, all existing rules with the given 565.Ar index 566are deleted. 567.It proto tcp|udp 568If specified, only packets of the given protocol type are matched. 569.It src Ar IP[/bits] 570If specified, only packets with a source address matching the given 571.Ar IP 572are matched. If 573.Ar bits 574is also specified, then the first 575.Ar bits 576bits of 577.Ar IP 578are taken as a network specification, and all IP addresses from that 579network will be matched. 580.It dest Ar IP[/bits] 581If specified, only packets with a destination address matching the given 582.Ar IP 583are matched. If 584.Ar bits 585is also specified, then the first 586.Ar bits 587bits of 588.Ar IP 589are taken as a network specification, and all IP addresses from that 590network will be matched. 591.El 592 593This function is usually used to redirect outgoing connections for 594internal machines that are not permitted certain types of internet 595access, or to restrict access to certain external machines. 596 597.Ss 5.1 PacketAliasSaveFragment() 598 599.Ft int 600.Fn PacketAliasSaveFragment "char *ptr" 601 602When PacketAliasIn() returns 603PKT_ALIAS_UNRESOLVED_FRAGMENT, this 604function can be used to save the pointer to 605the unresolved fragment. 606 607It is implicitly assumed that 608.Em ptr 609points to a block of memory allocated by 610malloc(). If the fragment is never 611resolved, the packet aliasing engine will 612automatically free the memory after a 613timeout period. [Eventually this function 614should be modified so that a callback 615function for freeing memory is passed as 616an argument.] 617 618This function returns PKT_ALIAS_OK if it 619was successful and PKT_ALIAS_ERROR if there 620was an error. 621 622.Ss 5.2 PacketAliasGetFragment() 623 624.Ft char * 625.Fn PacketAliasGetFragment "char *buffer" 626 627This function can be used to retrieve fragment 628pointers saved by PacketAliasSaveFragment(). 629The IP header fragment pointed to by 630Em buffer 631is the header fragment indicated when 632PacketAliasIn() returns PKT_ALIAS_FOUND_HEADER_FRAGMENT. 633Once a a fragment pointer is retrieved, it 634becomes the calling program's responsibility 635to free the dynamically allocated memory for 636the fragment. 637 638PacketAliasGetFragment() can be called 639sequentially until there are no more fragments 640available, at which time it returns NULL. 641.Ss 5.3 PacketAliasFragmentIn() 642 643.Ft void 644.Fn PacketAliasFragmentIn "char *header" "char *fragment" 645 646When a fragment is retrieved with 647PacketAliasGetFragment(), it can then be 648de-aliased with a call to PacketAliasFragmentIn(). 649.Em header 650is the pointer to a header fragment used as a 651template, and 652.Em fragment 653is the pointer to the packet to be de-aliased. 654 655.Sh 6. Miscellaneous Functions 656 657.Ss 6.1 PacketAliasSetTarget() 658 659.Ft void 660.Fn PacketAliasSetTarget "struct in_addr addr" 661 662When an incoming packet not associated with 663any pre-existing aliasing link arrives at the 664host machine, it will be sent to the address 665indicated by a call to PacketAliasSetTarget(). 666 667If this function is not called, or is called 668with a zero address argument, then all new 669incoming packets go to the address set by 670PacketAliasSetAddress. 671.Ss 6.2 PacketAliasCheckNewLink() 672 673.Ft int 674.Fn PacketAliasCheckNewLink "void" 675 676This function returns a non-zero value when 677a new aliasing link is created. In circumstances 678where incoming traffic is being sequentially 679sent to different local servers, this function 680can be used to trigger when PacketAliasSetTarget() 681is called to change the default target address. 682.Ss 6.3 PacketAliasInternetChecksum() 683 684.Ft u_short 685.Fn PacketAliasInternetChecksum "u_short *buffer" "int nbytes" 686 687This is a utility function that does not seem 688to be available elswhere and is included as a 689convenience. It computes the internet checksum, 690which is used in both IP and protocol-specific 691headers (TCP, UDP, ICMP). 692 693.Em buffer 694points to the data block to be checksummed, and 695.Em nbytes 696is the number of bytes. The 16-bit checksum 697field should be zeroed before computing the checksum. 698 699Checksums can also be verified by operating on a block 700of data including its checksum. If the checksum is 701valid, PacketAliasInternetChecksum() will return zero. 702 703.Sh 7. Authors 704Charles Mott (cmott@srv.net), versions 1.0 - 1.8, 2.0 - 2.4. 705 706Eivind Eklund (eivind@freebsd.org), versions 1.8b, 1.9 and 7072.5. Added IRC DCC support as well as contributing a number of 708architectural improvements; added the firewall bypass 709for FTP/IRC DCC. 710 711.Sh 8. Acknowledgments 712 713Listed below, in approximate chronological 714order, are individuals who have provided 715valuable comments and/or debugging assistance. 716 717.Bl -inset -compact -offset left 718.It Gary Roberts 719.It Tom Torrance 720.It Reto Burkhalter 721.It Martin Renters 722.It Brian Somers 723.It Paul Traina 724.It Ari Suutari 725.It Dave Remien 726.It J. Fortes 727.It Andrzej Bialeki 728.It Gordon Burditt 729.El 730 731.Sh Appendix: Conceptual Background 732This appendix is intended for those who 733are planning to modify the source code or want 734to create somewhat esoteric applications using 735the packet aliasing functions. 736 737The conceptual framework under which the 738packet aliasing engine operates is described here. 739Central to the discussion is the idea of an 740"aliasing link" which describes the relationship 741for a given packet transaction between the local 742machine, aliased identity and remote machine. It 743is discussed how such links come into existence 744and are destroyed. 745.Ss A.1 Aliasing Links 746There is a notion of an "aliasing link", 747which is 7-tuple describing a specific 748translation: 749.Bd -literal -offset indent 750(local addr, local port, alias addr, alias port, 751 remote addr, remote port, protocol) 752.Ed 753 754Outgoing packets have the local address and 755port number replaced with the alias address 756and port number. Incoming packets undergo the 757reverse process. The packet aliasing engine 758attempts to match packets against an internal 759table of aliasing links to determine how to 760modify a given IP packet. Both the IP 761header and protocol dependent headers are 762modified as necessary. Aliasing links are 763created and deleted as necessary according 764to network traffic. 765 766Protocols can be TCP, UDP or even ICMP in 767certain circumstances. (Some types of ICMP 768packets can be aliased according to sequence 769or id number which acts as an equivalent port 770number for identifying how individual packets 771should be handled.) 772 773Each aliasing link must have a unique 774combination of the following five quantities: 775alias address/port, remote address/port 776and protocol. This ensures that several 777machines on a local network can share the 778same aliased IP address. In cases where 779conflicts might arise, the aliasing port 780is chosen so that uniqueness is maintained. 781.Ss A.2 Static and Dynamic Links 782Aliasing links can either be static or dynamic. 783Static links persist indefinitely and represent 784fixed rules for translating IP packets. Dynamic 785links come into existence for a specific TCP 786connection or UDP transaction or ICMP echo 787sequence. For the case of TCP, the connection 788can be monitored to see when the associated 789aliasing link should be deleted. Aliasing links 790for UDP transactions (and ICMP echo and timestamp 791requests) work on a simple timeout rule. When 792no activity is observed on a dynamic link for 793a certain amount of time it is automatically 794deleted. Timeout rules also apply to TCP 795connections which do not open or close 796properly. 797.Ss A.3 Partially Specified Aliasing Links 798Aliasing links can be partially specified, 799meaning that the remote address and/or remote 800ports are unknown. In this case, when a packet 801matching the incomplete specification is found, 802a fully specified dynamic link is created. If 803the original partially specified link is dynamic, 804it will be deleted after the fully specified link 805is created, otherwise it will persist. 806 807For instance, a partially specified link might 808be 809.Bd -literal -offset indent 810(192.168.0.4, 23, 204.228.203.215, 8066, 0, 0, tcp) 811.Ed 812 813The zeros denote unspecified components for 814the remote address and port. If this link were 815static it would have the effect of redirecting 816all incoming traffic from port 8066 of 817204.228.203.215 to port 23 (telnet) of machine 818192.168.0.4 on the local network. Each 819individual telnet connection would initiate 820the creation of a distinct dynamic link. 821.Ss A.4 Dynamic Link Creation 822In addition to aliasing links, there are 823also address mappings that can be stored 824within the internal data table of the packet 825aliasing mechanism. 826.Bd -literal -offset indent 827(local addr, alias addr) 828.Ed 829 830Address mappings are searched when creating 831new dynamic links. 832 833All outgoing packets from the local network 834automatically create a dynamic link if 835they do not match an already existing fully 836specified link. If an address mapping exists 837for the the outgoing packet, this determines 838the alias address to be used. If no mapping 839exists, then a default address, usually the 840address of the packet aliasing host, is used. 841If necessary, this default address can be 842changed as often as each individual packet 843arrives. 844 845The aliasing port number is determined 846such that the new dynamic link does not 847conflict with any existing links. In the 848default operating mode, the packet aliasing 849engine attempts to set the aliasing port 850equal to the local port number. If this 851results in a conflict, then port numbers 852are randomly chosen until a unique aliasing 853link can be established. In an alternate 854operating mode, the first choice of an 855aliasing port is also random and unrelated 856to the local port number. 857 858