Replace PacketAliasRedirectPptp() (which had nothing specific

to PPTP) with more generic PacketAliasRedirectProto().

Major number is not bumped because it is believed that noone
has started using PacketAliasRedirectPptp() yet.

5 files changed, 88 insertions, 111 deletions

diff --git a/sys/netinet/libalias/alias.c b/sys/netinet/libalias/alias.c
index 39a7e4f..eaaedac 100644
--- a/sys/netinet/libalias/alias.c
+++ b/sys/netinet/libalias/alias.c
@@ -178,6 +178,7 @@ TcpMonitorOut(struct ip *pip, struct alias_link *link)
 
     IcmpAliasIn(), IcmpAliasIn1(), IcmpAliasIn2(), IcmpAliasIn3()
     IcmpAliasOut(), IcmpAliasOut1(), IcmpAliasOut2(), IcmpAliasOut3()
+    ProtoAliasIn(), ProtoAliasOut()
     UdpAliasIn(), UdpAliasOut()
     TcpAliasIn(), TcpAliasOut()
 
@@ -224,6 +225,9 @@ static int IcmpAliasOut2(struct ip *);
 static int IcmpAliasOut3(struct ip *);
 static int IcmpAliasOut (struct ip *);
 
+static int ProtoAliasIn(struct ip *);
+static int ProtoAliasOut(struct ip *);
+
 static int UdpAliasOut(struct ip *);
 static int UdpAliasIn (struct ip *);
 
@@ -653,10 +657,10 @@ IcmpAliasOut(struct ip *pip)
 
 
 static int
-PptpAliasIn(struct ip *pip)
+ProtoAliasIn(struct ip *pip)
 {
 /*
-  Handle incoming PPTP packets. The
+  Handle incoming IP packets. The
   only thing which is done in this case is to alias
   the dest IP address of the packet to our inside
   machine.
@@ -667,10 +671,7 @@ PptpAliasIn(struct ip *pip)
     if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
         return PKT_ALIAS_OK;
 
-    if (packetAliasMode & PKT_ALIAS_DENY_PPTP)
-        return PKT_ALIAS_IGNORED;
-
-    link = FindPptpIn(pip->ip_src, pip->ip_dst);
+    link = FindProtoIn(pip->ip_src, pip->ip_dst, pip->ip_p);
     if (link != NULL)
     {
         struct in_addr original_address;
@@ -691,10 +692,10 @@ PptpAliasIn(struct ip *pip)
 
 
 static int
-PptpAliasOut(struct ip *pip)
+ProtoAliasOut(struct ip *pip)
 {
 /*
-  Handle outgoing PPTP packets. The
+  Handle outgoing IP packets. The
   only thing which is done in this case is to alias
   the source IP address of the packet.
 */
@@ -704,10 +705,7 @@ PptpAliasOut(struct ip *pip)
     if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
         return PKT_ALIAS_OK;
 
-    if (packetAliasMode & PKT_ALIAS_DENY_PPTP)
-        return PKT_ALIAS_IGNORED;
-
-    link = FindPptpOut(pip->ip_src, pip->ip_dst);
+    link = FindProtoOut(pip->ip_src, pip->ip_dst, pip->ip_p);
     if (link != NULL)
     {
         struct in_addr alias_address;
@@ -1303,10 +1301,8 @@ PacketAliasIn(char *ptr, int maxpacketsize)
             case IPPROTO_TCP:
                 iresult = TcpAliasIn(pip);
                 break;
-            case IPPROTO_GRE:
-            case IPPROTO_ESP:
-            case IPPROTO_AH:
-		iresult = PptpAliasIn(pip);
+	    default:
+		iresult = ProtoAliasIn(pip);
                 break;
         }
 
@@ -1411,10 +1407,8 @@ PacketAliasOut(char *ptr,           /* valid IP packet */
             case IPPROTO_TCP:
                 iresult = TcpAliasOut(pip, maxpacketsize);
                 break;
-            case IPPROTO_GRE:
-            case IPPROTO_ESP:
-            case IPPROTO_AH:
-		iresult = PptpAliasOut(pip);
+	    default:
+		iresult = ProtoAliasOut(pip);
                 break;
         }
     }
diff --git a/sys/netinet/libalias/alias.h b/sys/netinet/libalias/alias.h
index 9f15579..ace911d 100644
--- a/sys/netinet/libalias/alias.h
+++ b/sys/netinet/libalias/alias.h
@@ -60,7 +60,10 @@ struct alias_link;
     PacketAliasPptp(struct in_addr);
 
     extern struct alias_link *
-    PacketAliasRedirectPptp(struct in_addr, struct in_addr, struct in_addr);
+    PacketAliasRedirectProto(struct in_addr,
+                             struct in_addr,
+                             struct in_addr,
+                             u_char);
 
     extern struct alias_link *
     PacketAliasRedirectAddr(struct in_addr,
@@ -157,10 +160,6 @@ struct alias_link;
       and PacketAliasOut() are reversed */
 #define PKT_ALIAS_REVERSE 0x80
 
-/* If PKT_ALIAS_DENY_PPTP is set, then PPTP sessions will be
-	prevented by the aliasing engine.  */
-#define PKT_ALIAS_DENY_PPTP 0x200
-
 /* Return Codes */
 #define PKT_ALIAS_ERROR -1
 #define PKT_ALIAS_OK 1
diff --git a/sys/netinet/libalias/alias_db.c b/sys/netinet/libalias/alias_db.c
index bc020f3..09bdcac 100644
--- a/sys/netinet/libalias/alias_db.c
+++ b/sys/netinet/libalias/alias_db.c
@@ -147,7 +147,7 @@
 /* Timeouts (in seconds) for different link types */
 #define ICMP_EXPIRE_TIME             60
 #define UDP_EXPIRE_TIME              60
-#define PPTP_EXPIRE_TIME             60
+#define PROTO_EXPIRE_TIME            60
 #define FRAGMENT_ID_EXPIRE_TIME      10
 #define FRAGMENT_PTR_EXPIRE_TIME     30
 
@@ -256,16 +256,15 @@ struct alias_link                /* Main data structure */
     u_short proxy_port;
     struct server *server;
 
-    int link_type;               /* Type of link: TCP, UDP, ICMP, PPTP, frag */
+    int link_type;               /* Type of link: TCP, UDP, ICMP, proto, frag */
 
 /* values for link_type */
-#define LINK_ICMP                     1
-#define LINK_UDP                      2
-#define LINK_TCP                      3
-#define LINK_FRAGMENT_ID              4
-#define LINK_FRAGMENT_PTR             5
-#define LINK_ADDR                     6
-#define LINK_PPTP                     7
+#define LINK_ICMP                     IPPROTO_ICMP
+#define LINK_UDP                      IPPROTO_UDP
+#define LINK_TCP                      IPPROTO_TCP
+#define LINK_FRAGMENT_ID              (IPPROTO_MAX + 1)
+#define LINK_FRAGMENT_PTR             (IPPROTO_MAX + 2)
+#define LINK_ADDR                     (IPPROTO_MAX + 3)
 
     int flags;                   /* indicates special characteristics   */
 
@@ -329,7 +328,7 @@ linkTableIn[LINK_TABLE_IN_SIZE];     /*   into input and output lookup  */
 static int icmpLinkCount;            /* Link statistics                 */
 static int udpLinkCount;
 static int tcpLinkCount;
-static int pptpLinkCount;
+static int protoLinkCount;
 static int fragmentIdLinkCount;
 static int fragmentPtrLinkCount;
 static int sockCount;
@@ -455,18 +454,18 @@ ShowAliasStats(void)
 
    if (monitorFile)
    {
-      fprintf(monitorFile, "icmp=%d, udp=%d, tcp=%d, pptp=%d, frag_id=%d frag_ptr=%d",
+      fprintf(monitorFile, "icmp=%d, udp=%d, tcp=%d, proto=%d, frag_id=%d frag_ptr=%d",
               icmpLinkCount,
               udpLinkCount,
               tcpLinkCount,
-              pptpLinkCount,
+              protoLinkCount,
               fragmentIdLinkCount,
               fragmentPtrLinkCount);
 
       fprintf(monitorFile, " / tot=%d  (sock=%d)\n",
               icmpLinkCount + udpLinkCount
                             + tcpLinkCount
-                            + pptpLinkCount
+                            + protoLinkCount
                             + fragmentIdLinkCount
                             + fragmentPtrLinkCount,
               sockCount);
@@ -738,17 +737,6 @@ IncrementalCleanup(void)
         idelta = timeStamp - link->timestamp;
         switch (link->link_type)
         {
-            case LINK_ICMP:
-            case LINK_UDP:
-            case LINK_FRAGMENT_ID:
-            case LINK_FRAGMENT_PTR:
-            case LINK_PPTP:
-                if (idelta > link->expire_time)
-                {
-                    DeleteLink(link);
-                    icount++;
-                }
-                break;
             case LINK_TCP:
                 if (idelta > link->expire_time)
                 {
@@ -763,6 +751,13 @@ IncrementalCleanup(void)
                     }
                 }
                 break;
+            default:
+                if (idelta > link->expire_time)
+                {
+                    DeleteLink(link);
+                    icount++;
+                }
+                break;
         }
         link = link_next;
     }
@@ -842,9 +837,6 @@ DeleteLink(struct alias_link *link)
             if (link->data.tcp != NULL)
                 free(link->data.tcp);
             break;
-        case LINK_PPTP:
-            pptpLinkCount--;
-            break;
         case LINK_FRAGMENT_ID:
             fragmentIdLinkCount--;
             break;
@@ -853,6 +845,11 @@ DeleteLink(struct alias_link *link)
             if (link->data.frag_ptr != NULL)
                 free(link->data.frag_ptr);
             break;
+	case LINK_ADDR:
+	    break;
+        default:
+            protoLinkCount--;
+            break;
     }
 
 /* Free memory */
@@ -908,15 +905,17 @@ AddLink(struct in_addr  src_addr,
         case LINK_TCP:
             link->expire_time = TCP_EXPIRE_INITIAL;
             break;
-        case LINK_PPTP:
-            link->expire_time = PPTP_EXPIRE_TIME;
-            break;
         case LINK_FRAGMENT_ID:
             link->expire_time = FRAGMENT_ID_EXPIRE_TIME;
             break;
         case LINK_FRAGMENT_PTR:
             link->expire_time = FRAGMENT_PTR_EXPIRE_TIME;
             break;
+	case LINK_ADDR:
+	    break;
+        default:
+            link->expire_time = PROTO_EXPIRE_TIME;
+            break;
         }
 
     /* Determine alias flags */
@@ -994,15 +993,17 @@ AddLink(struct in_addr  src_addr,
 #endif
                 }
                 break;
-            case LINK_PPTP:
-                pptpLinkCount++;
-                break;
             case LINK_FRAGMENT_ID:
                 fragmentIdLinkCount++;
                 break;
             case LINK_FRAGMENT_PTR:
                 fragmentPtrLinkCount++;
                 break;
+	    case LINK_ADDR:
+		break;
+            default:
+                protoLinkCount++;
+                break;
         }
     }
     else
@@ -1303,7 +1304,7 @@ FindLinkIn(struct in_addr dst_addr,
     FindIcmpIn(), FindIcmpOut()
     FindFragmentIn1(), FindFragmentIn2()
     AddFragmentPtrLink(), FindFragmentPtr()
-    FindPptpIn(), FindPptpOut()
+    FindProtoIn(), FindProtoOut()
     FindUdpTcpIn(), FindUdpTcpOut()
     FindOriginalAddress(), FindAliasAddress()
 
@@ -1400,14 +1401,15 @@ FindFragmentPtr(struct in_addr dst_addr,
 
 
 struct alias_link *
-FindPptpIn(struct in_addr dst_addr,
-           struct in_addr alias_addr)
+FindProtoIn(struct in_addr dst_addr,
+            struct in_addr alias_addr,
+	    u_char proto)
 {
     struct alias_link *link;
 
     link = FindLinkIn(dst_addr, alias_addr,
                       NO_DEST_PORT, 0,
-                      LINK_PPTP, 1);
+                      proto, 1);
 
     if (link == NULL && !(packetAliasMode & PKT_ALIAS_DENY_INCOMING))
     {
@@ -1416,7 +1418,7 @@ FindPptpIn(struct in_addr dst_addr,
         target_addr = FindOriginalAddress(alias_addr);
         link = AddLink(target_addr, dst_addr, alias_addr,
                        NO_SRC_PORT, NO_DEST_PORT, 0,
-                       LINK_PPTP);
+                       proto);
     }
 
     return (link);
@@ -1424,14 +1426,15 @@ FindPptpIn(struct in_addr dst_addr,
 
 
 struct alias_link *
-FindPptpOut(struct in_addr src_addr,
-            struct in_addr dst_addr)
+FindProtoOut(struct in_addr src_addr,
+             struct in_addr dst_addr,
+             u_char proto)
 {
     struct alias_link *link;
 
     link = FindLinkOut(src_addr, dst_addr,
                        NO_SRC_PORT, NO_DEST_PORT,
-                       LINK_PPTP, 1);
+                       proto, 1);
 
     if (link == NULL)
     {
@@ -1440,7 +1443,7 @@ FindPptpOut(struct in_addr src_addr,
         alias_addr = FindAliasAddress(src_addr);
         link = AddLink(src_addr, dst_addr, alias_addr,
                        NO_SRC_PORT, NO_DEST_PORT, 0,
-                       LINK_PPTP);
+                       proto);
     }
 
     return (link);
@@ -2063,7 +2066,7 @@ UninitPacketAliasLog(void)
 
     PacketAliasRedirectPort()
     PacketAliasAddServer()
-    PacketAliasRedirectPptp()
+    PacketAliasRedirectProto()
     PacketAliasRedirectAddr()
     PacketAliasRedirectDelete()
     PacketAliasSetAddress()
@@ -2151,32 +2154,32 @@ PacketAliasAddServer(struct alias_link *link, struct in_addr addr, u_short port)
 }
 
 /* Translate PPTP packets to a machine on the inside
- * XXX This function is made obsolete by PacketAliasRedirectPptp().
+ * XXX This function is made obsolete by PacketAliasRedirectProto().
  */
 int
 PacketAliasPptp(struct in_addr src_addr)
 {
 
-    if (src_addr.s_addr == INADDR_NONE)
-	packetAliasMode |= PKT_ALIAS_DENY_PPTP;
-    else
-	(void)PacketAliasRedirectPptp(src_addr, nullAddress, nullAddress);
+    if (src_addr.s_addr != INADDR_NONE)
+	(void)PacketAliasRedirectProto(src_addr, nullAddress, nullAddress,
+				       IPPROTO_GRE);
 
     return 1;
 }
 
-/* Redirect PPTP packets from a specific
+/* Redirect packets of a given IP protocol from a specific
    public address to a private address */
 struct alias_link *
-PacketAliasRedirectPptp(struct in_addr src_addr,
-                        struct in_addr dst_addr,
-                        struct in_addr alias_addr)
+PacketAliasRedirectProto(struct in_addr src_addr,
+                         struct in_addr dst_addr,
+                         struct in_addr alias_addr,
+                         u_char proto)
 {
     struct alias_link *link;
 
     link = AddLink(src_addr, dst_addr, alias_addr,
                    NO_SRC_PORT, NO_DEST_PORT, 0,
-                   LINK_PPTP);
+                   proto);
 
     if (link != NULL)
     {
@@ -2185,7 +2188,7 @@ PacketAliasRedirectPptp(struct in_addr src_addr,
 #ifdef DEBUG
     else
     {
-        fprintf(stderr, "PacketAliasRedirectPptp(): " 
+        fprintf(stderr, "PacketAliasRedirectProto(): " 
                         "call to AddLink() failed\n");
     }
 #endif
@@ -2286,7 +2289,7 @@ PacketAliasInit(void)
     icmpLinkCount = 0;
     udpLinkCount = 0;
     tcpLinkCount = 0;
-    pptpLinkCount = 0;
+    protoLinkCount = 0;
     fragmentIdLinkCount = 0;
     fragmentPtrLinkCount = 0;
     sockCount = 0;
diff --git a/sys/netinet/libalias/alias_local.h b/sys/netinet/libalias/alias_local.h
index a5d3cd7..ca93151 100644
--- a/sys/netinet/libalias/alias_local.h
+++ b/sys/netinet/libalias/alias_local.h
@@ -96,10 +96,10 @@ struct alias_link *
 FindFragmentPtr(struct in_addr, u_short);
 
 struct alias_link *
-FindPptpIn(struct in_addr, struct in_addr);
+FindProtoIn(struct in_addr, struct in_addr, u_char);
 
 struct alias_link *
-FindPptpOut(struct in_addr, struct in_addr);
+FindProtoOut(struct in_addr, struct in_addr, u_char);
 
 struct alias_link *
 FindUdpTcpIn (struct in_addr, struct in_addr, u_short, u_short, u_char);
diff --git a/sys/netinet/libalias/libalias.3 b/sys/netinet/libalias/libalias.3
index 924262b..0344af5 100644
--- a/sys/netinet/libalias/libalias.3
+++ b/sys/netinet/libalias/libalias.3
@@ -227,15 +227,6 @@ Normal packet aliasing is not performed.
 See
 .Fn PacketAliasProxyRule
 below for details.
-.It Dv PKT_ALIAS_DENY_PPTP
-If this mode bit is set, all PPTP packets will be marked for being ignored
-(both
-.Fn PacketAliasIn
-and
-.Fn PacketAliasOut
-return
-.Dv PKT_ALIAS_IGNORED
-code).
 .El
 .Ed
 .Pp
@@ -647,25 +638,17 @@ access, or to restrict access to certain external machines.
 .Ed
 .Pp
 .Ft struct alias_link *
-.Fo PacketAliasRedirectPptp
+.Fo PacketAliasRedirectProto
 .Fa "struct in_addr local_addr"
 .Fa "struct in_addr remote_addr"
 .Fa "struct in_addr alias_addr"
+.Fa "u_char proto"
 .Fc
 .Bd -ragged -offset indent
-This function specifies that any Point to Point Tunneling Protocol
-(PPTP) traffic from a given remote address to an alias address be
+This function specifies that any IP packet with protocol number of
+.Fa proto
+from a given remote address to an alias address be
 redirected to a specified local address.
-Currently supported PPTP protocols include:
-.Pp
-.Bl -tag -width "IPPROTO_GRE" -compact
-.It IPPROTO_GRE
-Generic Routing Encapsulation (RFC 1702)
-.It IPPROTO_ESP
-IP Encapsulating Security Payload (RFC 1827)
-.It IPPROTO_AH
-IP Authentication Header (RFC 1826)
-.El
 .Pp
 If
 .Fa local_addr
@@ -678,16 +661,16 @@ is to be used.
 Even if
 .Fn PacketAliasSetAddress
 is called to change the address after
-.Fn PacketAliasRedirectPptp
+.Fn PacketAliasRedirectProto
 is called, a zero reference will track this change.
 .Pp
 If
 .Fa remote_addr
-is zero, this indicates to redirect PPTP packets from any remote address.
+is zero, this indicates to redirect packets from any remote address.
 Non-zero remote addresses can sometimes be useful for firewalling.
 .Pp
 If two calls to
-.Fn PacketAliasRedirectPptp
+.Fn PacketAliasRedirectProto
 overlap in their address specifications, then the most recent call
 will have precedence.
 .Pp
@@ -713,10 +696,8 @@ then PPTP aliasing is disabled.
 .Pp
 .Bf -symbolic
 This function is made obsolete by
-.Fn PacketAliasRedirectPptp
-and
-.Dv PKT_ALIAS_DENY_PPTP
-mode bit, and is provided only for backward compatibility.
+.Fn PacketAliasRedirectProto ,
+and is provided only for backward compatibility.
 .Ef
 .Ed
 .Sh FRAGMENT HANDLING