summaryrefslogtreecommitdiffstats
path: root/sys/netinet/libalias
Commit message (Collapse)AuthorAgeFilesLines
* Add support for multiple PPTP sessions:ru2000-04-185-88/+265
| | | | | | | - new API function: PacketAliasRedirectPptp() - new mode bit: PKT_ALIAS_DENY_PPTP Please see manual page for details.
* Apply TCP_EXPIRE_CONNECTED (86400 seconds) timeout only to establishedru2000-04-141-16/+10
| | | | | | | | | | | | | | connections, after SYN packets were seen from both ends. Before this, it would get applied right after the first SYN packet was seen (either from client or server). With broken TCP connection attempts, when the remote end does not respond with SYNACK nor with RST, this resulted in having a useless (ie, no actual TCP connection associated with it) TCP link with 86400 seconds TTL, wasting system memory. With high rate of such broken connection attempts (for example, remote end simply blocks these connection attempts with ipfw(8) without sending RST back), this could result in a denial-of-service. PR: bin/17963
* A complete reformatting of manual page.ru2000-04-131-724/+686
|
* Make partially specified permanent links without `dst_addr'ru2000-04-121-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | but with `dst_port' work for outgoing packets. This case was not handled properly when I first fixed this in revision 1.17. This change is also required for the upcoming improved PPTP support patches -- that is how I found the problem. Before this change: # natd -v -a aliasIP \ -redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to [TCP] aliasIP:localPORT -> remoteIP:remotePORT After this change: # natd -v -a aliasIP \ -redirect_port tcp localIP:localPORT publicIP:publicPORT 0:remotePORT Out [TCP] [TCP] localIP:localPORT -> remoteIP:remotePORT aliased to [TCP] publicIP:publicPORT -> remoteIP:remotePORT
* - Add support for FTP EPRT (RFC 2428) command.ru2000-04-061-63/+169
| | | | | | | | | - Minor optimizations. - Minor spelling fixes. PR: 14305 Submitted by: ume Rewritten by: ru
* - Remove unused includes.ru2000-04-051-24/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Minor spelling fixes. - Make IcmpAliasOut2() really work. Before this change: # natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P natd[87923]: Aliasing to A.A.A.A, mtu 1500 bytes In [UDP] [UDP] X.X.X.X:49562 -> P.P.P.P:50000 aliased to [UDP] X.X.X.X:49562 -> 192.168.1.1:50000 Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to [ICMP] A.A.A.A -> X.X.X.X 3(3) # tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)" tcpdump: listening on PUB_IFACE X.X.X.X.49562 > P.P.P.P.50000: udp 3 A.A.A.A > X.X.X.X: icmp: A.A.A.A udp port 50000 unreachable After this change: # natd -v -n PUB_IFACE -p 12345 -redirect_address 192.168.1.1 P.P.P.P natd[89360]: Aliasing to A.A.A.A, mtu 1500 bytes In [UDP] [UDP] X.X.X.X:49563 -> P.P.P.P:50000 aliased to [UDP] X.X.X.X:49563 -> 192.168.1.1:50000 Out [ICMP] [ICMP] 192.168.1.1 -> X.X.X.X 3(3) aliased to [ICMP] P.P.P.P -> X.X.X.X 3(3) # tcpdump -n -t -i PUB_IFACE host X.X.X.X and "(udp or icmp)" tcpdump: listening on PUB_IFACE X.X.X.X.49563 > P.P.P.P.50000: udp 3 P.P.P.P > X.X.X.X: icmp: P.P.P.P udp port 50000 unreachable
* - Moved NULL definition into private include file.ru2000-04-052-7/+6
| | | | - Minor spelling fixes.
* Minor spelling fixes.ru2000-04-052-5/+7
|
* Correct Charles Mott's email addressbrian2000-04-021-1/+1
| | | | Requested by: Charles Mott <cmott@scientech.com>
* Allow PacketAliasSetTarget() to be passed the following:brian2000-03-312-13/+22
| | | | | | | | | | INADDR_NONE: Incoming packets go to the alias address (the default) INADDR_ANY: Incoming packets are not NAT'd (direct access to the internal network from outside) anything else: Incoming packets go to the specified address Change a few inaddr::s_addr == 0 to inaddr::s_addr == INADDR_ANY while I'm there.
* When an incoming packet is received that is not specificallybrian2000-03-311-1/+1
| | | | | | | redirected and when no target address has been specified, NAT the destination address to the alias address rather than allowing people direct access to your internal network from outside.
* Make _FindLinkIn() static and only define GetDestPort whenbrian2000-03-191-2/+4
| | | | NO_FW_PUNCH isn't defined.
* Remove single-space hard sentence breaks. These degrade the qualitysheldonh2000-03-021-1/+2
| | | | | of the typeset output, tend to make diffs harder to read and provide bad examples for new-comers to mdoc.
* -it do, among other things, clear out anyalfred2000-02-281-1/+1
| | | | | | +it does, amongst other things, clear out any The old sentance didn't seem to make sense.
* The flags PKT_ALIAS_PUNCH_FW and PKT_ALIAS_PROXY_ONLY were botharchie2000-02-021-1/+1
| | | | | | | being defined as 0x40. Change the former to be 0x100. Submitted by: Erik Salander <erik@whistle.com> Approved by: jkh
* Mention what PKT_ALIAS_PROXY_ONLY does.brian2000-02-021-1/+6
| | | | Prompted by: archie
* Replace beforeinstall target with new variables used by .mk system.rgrimes2000-01-141-4/+1
| | | | Reviewed by: marcel, and make world
* Fix a '&&' that should have been a '&'.archie1999-12-101-1/+1
| | | | Submitted by: Erik Salander <erik@whistle.com>
* Fix several typos.archie1999-12-091-17/+17
| | | | Submitted by: Erik Salander <erik@whistle.com>
* Restore sub-chapters order.phantom1999-11-091-19/+16
| | | | | PR: docs/14766 Submitted by: Kazutoshi Kubota <kazu@iworks.co.jp>
* Properly handle the case when either the aliasing or source address ofru1999-09-271-26/+66
| | | | | | | | | | | | | the link are equal to the default aliasing address. Do not zero them! This will fix the problem with non-working links added with the source and/or aliasing address equal to the default aliasing address, but the default aliasing address is set later, after the link has been set up, like both natd(8) and ppp(8) do (for objective reasons). Reviewed by: Brian Somers <brian@FreeBSD.org>, Eivind Eklund <eivind@FreeBSD.org>, Charles Mott <cmott@srv.net>
* ReLink() partial links in FindLinkOut() in the same manner as we do itru1999-09-221-7/+15
| | | | | | in FindLinkIn(). This will make TcpMonitorIn()/TcpMonitorOut() happy. Reviewed by: eivind
* Restore previous version of FindLinkIn().ru1999-09-211-9/+8
| | | | | Instead, natd(8) should be fixed to call PacketAliasSetAddress() as part of initialization, as required by libalias(3).
* - Make partially specified permanent links (without `dst_addr' and/orru1999-09-211-11/+25
| | | | | | | | | | | `dst_port') work for outgoing packets. - Make permanent links whose `alias_addr' matches the primary aliasing address `aliasAddress' work for incoming packets. - Typo fixes. Reviewed by: brian, eivind
* sys/errno.h -> errno.hbrian1999-09-211-1/+1
|
* - Optimization to the previous (rev 1.15) commit.ru1999-09-101-9/+11
| | | | | | Requested by: eivind Discussed with: eivind Reviewed by: brian, eivind
* Handle TCP reset sequence properly.ru1999-09-091-2/+2
| | | | | | | | | | | | | | | | | | | In the words of originator: :If an incoming connection is initiated through natd and deny_incoming is :not set, then a new alias_link structure is created to handle the link. :If there is nothing listening for the incoming connection, then the kernel :responds with a RST for the connection. However, this is not processed :correctly in libalias/alias.c:TcpMonitor{In,Out} and :libalias/alias_db.c:SetState{In,Out} as it thinks a connection :has been established and therefore applies a timeout of 86400 seconds :to the link. : :If many of these half-connections are initiated (during, for example, a :port scan of the host), then many thousands of unnecessary links are :created and the resident size of natd balloons to 20MB or more. PR: 13639 Reviewed by: brian
* Fix typo.ru1999-09-081-1/+1
|
* Add $FreeBSD$ and spell Eklund properly.billf1999-08-297-1/+14
| | | | Approved by: brian (well, he approved adding $Id$)
* $Id$ -> $FreeBSD$peter1999-08-285-5/+5
|
* Aallow ppp to work with Nortel Networks Extranet Switchbrian1999-08-221-0/+6
| | | | | | product and Windows NT tunneling. Submitted by: Chain Lee <chain@nortelnetworks.com>
* Typo: 102 => 192 (PR: docs/13310 - Maxim Sobolev <sobomax@altavista.net>)hoek1999-08-221-2/+2
|
* Various man page cleanup:mpp1999-08-151-17/+12
| | | | | | | | | | - Sort xrefs - FreeBSD.ORG -> FreeBSD.org - Be consistent with section names as outlines in mdoc(7) - Other misc mdoc cleanup. PR: doc/13144 Submitted by: Alexy M. Zelkin <phantom@cris.net>
* Don't get caught in an infinite recursion when PKT_ALIAS_REVERSEbrian1999-06-222-5/+18
| | | | | | | | is set. Document PKT_ALIAS_REVERSE. Pointed out by: Jonathan Hanna <jh@cr1003333-a.crdva1.bc.home.com> PR: 12304
* brucifybrian1999-05-231-2/+2
| | | | Mentioned by: sprice@hiwaay.net
* Make incoming packets work as keepalives, too. This should fix problemseivind1999-05-201-0/+1
| | | | | | for some games. Notified of problem by: tim@turbinegames.com
* Add missing ``.''.brian1999-05-041-1/+1
|
* Work around an egcs optimizer bug (i386). This should fix the active ftpluoqi1999-04-211-2/+4
| | | | hang problem. A bug report has been sent to cygnus.
* PacketAliasProxyRule takes a const char *brian1999-03-251-1/+1
| | | | Reminded by: bde
* Add a ``const'' and remove some inconsistent prototype args.brian1999-03-243-4/+4
|
* Remove duplicate line.billf1999-03-231-1/+0
| | | | Reviewed by: eivind
* Remove all diagnostics to stdout/stderr with #ifdef DEBUGbrian1999-03-094-22/+54
| | | | Statify functions in alias_nbt.c
* Document PacketAliasPptp() and allow it to be disabledbrian1999-03-072-2/+31
| | | | by passing INADDR_NONE.
* Remove unused function stubs.brian1999-03-071-77/+0
|
* Mention that PacketAliasProxyRule() doesn't accept host names,brian1999-03-071-1/+3
| | | | just IP numbers.
* Document PacketAliasProxyRule() and fix a typo.brian1999-03-061-1/+88
|
* Version 3.0: January 1, 1999brian1999-02-277-98/+1176
| | | | | | | | - Transparent proxying support added. - PPTP redirecting support added based on patches contributed by Dru Nelson <dnelson@redwoodsoft.com>. Submitted by: Charles Mott <cmott@srv.net>
* If we can't open alias.log, don't try to write to thebrian1999-01-101-2/+4
| | | | | resulting NULL FILE *. PR: 9403
* Reviewed by: freebsd-currentdillon1998-12-143-44/+192
| | | | | | | | | Add bounds checking to netbios NS packet resolving code. This should prevent natd from crashing on badly formed netbios packets (as might be heard when the machine is sitting on a cable modem or certain DSL networks), and also closes potential security holes that might have exploited the lack of bounds checking in the previous version of the code.
* Fix a couple of typos.jdp1998-11-191-3/+3
|
OpenPOWER on IntegriCloud