summaryrefslogtreecommitdiffstats
path: root/lib/libalias
Commit message (Collapse)AuthorAgeFilesLines
* A bit of indentation reformatting.ru2000-10-021-33/+21
|
* Fixed the calculations with UDP header length field.ru2000-09-211-2/+2
| | | | | | | The field is in network byte order and contains the size of the header. Reviewed by: brian
* Add -Wmissing-prototypes.ru2000-09-152-5/+8
|
* Match IPPROTO_ICMP with IP protocol field of the original IPru2000-09-011-2/+2
| | | | | | | datagram embedded into ICMP error message, not with protocol field of ICMP message itself (which is always IPPROTO_ICMP). Pointed by: Erik Salander <erik@whistle.com>
* Changed the way we handle outgoing ICMP error messages -- doru2000-09-011-12/+22
| | | | | | | | not alias `ip_src' unless it comes from the host an original datagram that triggered this error message was destined for. PR: 20712 Reviewed by: brian, Charles Mott <cmott@scientech.com>
* Grab ADJUST_CHECKSUM() macro from alias_local.h.ru2000-08-311-17/+0
|
* Create aliasing links for incoming ICMP echo/timestamp requests.ru2000-08-312-47/+24
| | | | | This makes outgoing ICMP echo/timestamp replies to be de-aliased with the right source IP, not exactly the primary aliasing IP.
* strtok -> strsep (no strtok allowed in libraries)ache2000-08-291-3/+6
| | | | add unsigned char cast to ctype macro
* Fixed PunchFW code segmentation violation bug.ru2000-08-141-5/+4
| | | | Reported by: Christian Schade <chris@cube.sax.de>
* Use queue(3) LIST_* macros for doubly-linked lists.ru2000-08-141-65/+18
|
* - Do not modify Peer's Call ID in outgoing Incoming-Call-Connectedru2000-08-091-18/+25
| | | | | | | | PPTP control messages. - Cosmetics: replace `GRE link' with `PPTP link'. Reviewed by: Erik Salander <erik@whistle.com>
* Adjust TCP checksum rather than compute it afresh.ru2000-08-071-4/+8
| | | | Submitted by: Erik Salander <erik@whistle.com>
* Whitespace only:sheldonh2000-07-311-4/+4
| | | | | Fix an overlong line and trailing whitespace that crept in, in the previous commit.
* Add address translation support for RTSP/RTP used by RealPlayer andarchie2000-07-268-3/+819
| | | | | | | | Quicktime streaming media applications. Add a BUGS section to the man page. Submitted by: Erik Salander <erik@whistle.com>
* Fixed PunchFWHole():ru2000-06-271-2/+3
| | | | | - ipfw always rejected rule with `neither in nor out' diagnostics. - number of src/dst ports was not set properly.
* - Removed PacketAliasPptp() API function.ru2000-06-204-38/+1
| | | | - SHLIB_MAJOR++.
* Added true support for PPTP aliasing. Some nice features include:ru2000-06-207-11/+422
| | | | | | | | | | | | | | | | | | | | - Multiple PPTP clients behind NAT to the same or different servers. - Single PPTP server behind NAT -- you just need to redirect TCP port 1723 to a local machine. Multiple servers behind NAT is possible but would require a simple API change. - No API changes! For more information on how this works see comments at the start of the alias_pptp.c. PacketAliasPptp() is no longer necessary and will be removed soon. Submitted by: Erik Salander <erik@whistle.com> Reviewed by: ru Rewritten by: ru Reviewed by: Erik Salander <erik@whistle.com>
* - Improved passive mode FTP support by aliasing 229 replies.ru2000-06-161-312/+337
| | | | | - Stricter checking of PORT/EPRT/227/229 messages format. - Moved all security checks into one place.
* - Added support for passive mode FTP by aliasing 227 replies.ru2000-06-143-15/+228
| | | | | | | | | | | | | | | It does mean that it is now possible to run passive-mode FTP server behind NAT. - SECURITY: FTP aliasing engine now ensures that: o the segment preceding a PORT/227 segment terminates with a \r\n; o the IP address in the PORT/227 matches the source IP address of the packet; o the port number in the PORT command or 277 reply is greater than or equal to 1024. Submitted by: Erik Salander <erik@whistle.com> Reviewed by: ru
* Revert the default behaviour for incoming connections sobrian2000-05-112-3/+3
| | | | | | | | that they (once again) go to the target machine rather than the alias address. PR: 18354 Submitted by: ru
* Replace PacketAliasRedirectPptp() (which had nothing specificru2000-04-285-111/+88
| | | | | | | to PPTP) with more generic PacketAliasRedirectProto(). Major number is not bumped because it is believed that noone has started using PacketAliasRedirectPptp() yet.
* Spell PacketAliasRedirectAddr() correctly.ru2000-04-271-1/+1
|
* Load Sharing using IP Network Address Translation (RFC 2391, LSNAT).ru2000-04-273-27/+150
| | | | | | LSNAT links are first created by either PacketAliasRedirectPort() or PacketAliasRedirectAddress() and then set up by one or more calls to PacketAliasAddServer().
* Add support for multiple PPTP sessions:ru2000-04-185-88/+265
| | | | | | | - new API function: PacketAliasRedirectPptp() - new mode bit: PKT_ALIAS_DENY_PPTP Please see manual page for details.
* Apply TCP_EXPIRE_CONNECTED (86400 seconds) timeout only to establishedru2000-04-141-16/+10
| | | | | | | | | | | | | | connections, after SYN packets were seen from both ends. Before this, it would get applied right after the first SYN packet was seen (either from client or server). With broken TCP connection attempts, when the remote end does not respond with SYNACK nor with RST, this resulted in having a useless (ie, no actual TCP connection associated with it) TCP link with 86400 seconds TTL, wasting system memory. With high rate of such broken connection attempts (for example, remote end simply blocks these connection attempts with ipfw(8) without sending RST back), this could result in a denial-of-service. PR: bin/17963
* A complete reformatting of manual page.ru2000-04-131-724/+686
|
* Make partially specified permanent links without `dst_addr'ru2000-04-121-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | but with `dst_port' work for outgoing packets. This case was not handled properly when I first fixed this in revision 1.17. This change is also required for the upcoming improved PPTP support patches -- that is how I found the problem. Before this change: # natd -v -a aliasIP \ -redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to [TCP] aliasIP:localPORT -> remoteIP:remotePORT After this change: # natd -v -a aliasIP \ -redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to [TCP] publicIP:publicPORT -> remoteIP:remotePORT
* - Add support for FTP EPRT (RFC 2428) command.ru2000-04-061-63/+169
| | | | | | | | | - Minor optimizations. - Minor spelling fixes. PR: 14305 Submitted by: ume Rewritten by: ru
* - Remove unused includes.ru2000-04-051-24/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Minor spelling fixes. - Make IcmpAliasOut2() really work. Before this change: # natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P natd[87923]: Aliasing to A.A.A.A, mtu 1500 bytes In [UDP] [UDP] X.X.X.X:49562 -> P.P.P.P:50000 aliased to [UDP] X.X.X.X:49562 -> 192.168.1.1:50000 Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to [ICMP] A.A.A.A -> X.X.X.X 3(3) # tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)" tcpdump: listening on PUB_IFACE X.X.X.X.49562 > P.P.P.P.50000: udp 3 A.A.A.A > X.X.X.X: icmp: A.A.A.A udp port 50000 unreachable After this change: # natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P natd[89360]: Aliasing to A.A.A.A, mtu 1500 bytes In [UDP] [UDP] X.X.X.X:49563 -> P.P.P.P:50000 aliased to [UDP] X.X.X.X:49563 -> 192.168.1.1:50000 Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to [ICMP] P.P.P.P -> X.X.X.X 3(3) # tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)" tcpdump: listening on PUB_IFACE X.X.X.X.49563 > P.P.P.P.50000: udp 3 P.P.P.P > X.X.X.X: icmp: P.P.P.P udp port 50000 unreachable
* - Moved NULL definition into private include file.ru2000-04-052-7/+6
| | | | - Minor spelling fixes.
* Minor spelling fixes.ru2000-04-052-5/+7
|
* Correct Charles Mott's email addressbrian2000-04-021-1/+1
| | | | Requested by: Charles Mott <cmott@scientech.com>
* Allow PacketAliasSetTarget() to be passed the following:brian2000-03-312-13/+22
| | | | | | | | | | INADDR_NONE: Incoming packets go to the alias address (the default) INADDR_ANY: Incoming packets are not NAT'd (direct access to the internal network from outside) anything else: Incoming packets go to the specified address Change a few inaddr::s_addr == 0 to inaddr::s_addr == INADDR_ANY while I'm there.
* When an incoming packet is received that is not specificallybrian2000-03-311-1/+1
| | | | | | | redirected and when no target address has been specified, NAT the destination address to the alias address rather than allowing people direct access to your internal network from outside.
* Make _FindLinkIn() static and only define GetDestPort whenbrian2000-03-191-2/+4
| | | | NO_FW_PUNCH isn't defined.
* Remove single-space hard sentence breaks. These degrade the qualitysheldonh2000-03-021-1/+2
| | | | | of the typeset output, tend to make diffs harder to read and provide bad examples for new-comers to mdoc.
* -it do, among other things, clear out anyalfred2000-02-281-1/+1
| | | | | | +it does, amongst other things, clear out any The old sentance didn't seem to make sense.
* The flags PKT_ALIAS_PUNCH_FW and PKT_ALIAS_PROXY_ONLY were botharchie2000-02-021-1/+1
| | | | | | | being defined as 0x40. Change the former to be 0x100. Submitted by: Erik Salander <erik@whistle.com> Approved by: jkh
* Mention what PKT_ALIAS_PROXY_ONLY does.brian2000-02-021-1/+6
| | | | Prompted by: archie
* Replace beforeinstall target with new variables used by .mk system.rgrimes2000-01-141-4/+1
| | | | Reviewed by: marcel, and make world
* Fix a '&&' that should have been a '&'.archie1999-12-101-1/+1
| | | | Submitted by: Erik Salander <erik@whistle.com>
* Fix several typos.archie1999-12-091-17/+17
| | | | Submitted by: Erik Salander <erik@whistle.com>
* Restore sub-chapters order.phantom1999-11-091-19/+16
| | | | | PR: docs/14766 Submitted by: Kazutoshi Kubota <kazu@iworks.co.jp>
* Properly handle the case when either the aliasing or source address ofru1999-09-271-26/+66
| | | | | | | | | | | | | the link are equal to the default aliasing address. Do not zero them! This will fix the problem with non-working links added with the source and/or aliasing address equal to the default aliasing address, but the default aliasing address is set later, after the link has been set up, like both natd(8) and ppp(8) do (for objective reasons). Reviewed by: Brian Somers <brian@FreeBSD.org>, Eivind Eklund <eivind@FreeBSD.org>, Charles Mott <cmott@srv.net>
* ReLink() partial links in FindLinkOut() in the same manner as we do itru1999-09-221-7/+15
| | | | | | in FindLinkIn(). This will make TcpMonitorIn()/TcpMonitorOut() happy. Reviewed by: eivind
* Restore previous version of FindLinkIn().ru1999-09-211-9/+8
| | | | | Instead, natd(8) should be fixed to call PacketAliasSetAddress() as part of initialization, as required by libalias(3).
* - Make partially specified permanent links (without `dst_addr' and/orru1999-09-211-11/+25
| | | | | | | | | | | `dst_port') work for outgoing packets. - Make permanent links whose `alias_addr' matches the primary aliasing address `aliasAddress' work for incoming packets. - Typo fixes. Reviewed by: brian, eivind
* sys/errno.h -> errno.hbrian1999-09-211-1/+1
|
* - Optimization to the previous (rev 1.15) commit.ru1999-09-101-9/+11
| | | | | | Requested by: eivind Discussed with: eivind Reviewed by: brian, eivind
* Handle TCP reset sequence properly.ru1999-09-091-2/+2
| | | | | | | | | | | | | | | | | | | In the words of originator: :If an incoming connection is initiated through natd and deny_incoming is :not set, then a new alias_link structure is created to handle the link. :If there is nothing listening for the incoming connection, then the kernel :responds with a RST for the connection. However, this is not processed :correctly in libalias/alias.c:TcpMonitor{In,Out} and :libalias/alias_db.c:SetState{In,Out} as it thinks a connection :has been established and therefore applies a timeout of 86400 seconds :to the link. : :If many of these half-connections are initiated (during, for example, a :port scan of the host), then many thousands of unnecessary links are :created and the resident size of natd balloons to 20MB or more. PR: 13639 Reviewed by: brian
OpenPOWER on IntegriCloud