netinet/libalias/alias_db.c

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2001 Charles Mott <cm@linktel.net>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/cdefs.h>
#ifdef _KERNEL
#include <machine/stdarg.h>
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/systm.h>
#include <sys/lock.h>
#include <sys/module.h>
#include <sys/rwlock.h>
#include <sys/syslog.h>
#else
#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <unistd.h>
#endif

#include <sys/socket.h>
#include <netinet/tcp.h>

#ifdef _KERNEL
#include <netinet/libalias/alias.h>
#include <netinet/libalias/alias_local.h>
#include <netinet/libalias/alias_mod.h>
#include <net/if.h>
#else
#include "alias.h"
#include "alias_local.h"
#include "alias_mod.h"
#endif

#include "alias_db.h"

static LIST_HEAD(, libalias) instancehead = LIST_HEAD_INITIALIZER(instancehead);
int LibAliasTime;

/* Kernel module definition. */
#ifdef _KERNEL
MALLOC_DEFINE(M_ALIAS, "libalias", "packet aliasing");

MODULE_VERSION(libalias, 1);

static int
alias_mod_handler(module_t mod, int type, void *data)
{
	switch (type) {
	case MOD_QUIESCE:
	case MOD_UNLOAD:
		finishoff();
	case MOD_LOAD:
		return (0);
	default:
		return (EINVAL);
	}
}

static moduledata_t alias_mod = {
       "alias", alias_mod_handler, NULL
};

DECLARE_MODULE(alias, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
#endif

SPLAY_GENERATE(splay_out, alias_link, all.out, cmp_out);
SPLAY_GENERATE(splay_in, group_in, in, cmp_in);
SPLAY_GENERATE(splay_internal_endpoint, alias_link, all.internal_endpoint,
    cmp_internal_endpoint);

static struct group_in *
StartPointIn(struct libalias *la,
    struct in_addr alias_addr, u_short alias_port, int link_type,
    int create)
{
	struct group_in *grp;
	struct group_in needle = {
		.alias_addr = alias_addr,
		.alias_port = alias_port,
		.link_type = link_type
	};

	grp = SPLAY_FIND(splay_in, &la->linkSplayIn, &needle);
	if (grp != NULL || !create || (grp = malloc(sizeof(*grp))) == NULL)
		return (grp);
	grp->alias_addr = alias_addr;
	grp->alias_port = alias_port;
	grp->link_type = link_type;
	LIST_INIT(&grp->full);
	LIST_INIT(&grp->partial);
	SPLAY_INSERT(splay_in, &la->linkSplayIn, grp);
	return (grp);
}

static int
SeqDiff(u_long x, u_long y)
{
/* Return the difference between two TCP sequence numbers
 * This function is encapsulated in case there are any unusual
 * arithmetic conditions that need to be considered.
 */
	return (ntohl(y) - ntohl(x));
}

#ifdef _KERNEL
static void
AliasLog(char *str, const char *format, ...)
{
	va_list ap;

	va_start(ap, format);
	vsnprintf(str, LIBALIAS_BUF_SIZE, format, ap);
	va_end(ap);
}
#else
static void
AliasLog(FILE *stream, const char *format, ...)
{
	va_list ap;

	va_start(ap, format);
	vfprintf(stream, format, ap);
	va_end(ap);
	fflush(stream);
}
#endif

static void
ShowAliasStats(struct libalias *la)
{
	LIBALIAS_LOCK_ASSERT(la);
	/* Used for debugging */
	if (la->logDesc) {
		int tot  = la->icmpLinkCount + la->udpLinkCount +
		    (la->sctpLinkCount>>1) + /* sctp counts half associations */
		    la->tcpLinkCount + la->pptpLinkCount +
		    la->protoLinkCount + la->fragmentIdLinkCount +
		    la->fragmentPtrLinkCount;

		AliasLog(la->logDesc,
		    "icmp=%u, udp=%u, tcp=%u, sctp=%u, pptp=%u, proto=%u, frag_id=%u frag_ptr=%u / tot=%u",
		    la->icmpLinkCount,
		    la->udpLinkCount,
		    la->tcpLinkCount,
		    la->sctpLinkCount>>1, /* sctp counts half associations */
		    la->pptpLinkCount,
		    la->protoLinkCount,
		    la->fragmentIdLinkCount,
		    la->fragmentPtrLinkCount,
		    tot);
#ifndef _KERNEL
		AliasLog(la->logDesc, " (sock=%u)\n", la->sockCount);
#endif
	}
}

void SctpShowAliasStats(struct libalias *la)
{
	ShowAliasStats(la);
}

/* get random port in network byte order */
static u_short
_RandomPort(struct libalias *la) {
	u_short port;

	port = la->aliasPortLower +
	    arc4random_uniform(la->aliasPortLength);

	return ntohs(port);
}

/* GetNewPort() allocates port numbers.  Note that if a port number
   is already in use, that does not mean that it cannot be used by
   another link concurrently.  This is because GetNewPort() looks for
   unused triplets: (dest addr, dest port, alias port). */

static int
GetNewPort(struct libalias *la, struct alias_link *lnk, int alias_port_param)
{
	int i;
	int max_trials;
	u_short port;

	LIBALIAS_LOCK_ASSERT(la);
	/*
	 * Description of alias_port_param for GetNewPort().  When
	 * this parameter is zero or positive, it precisely specifies
	 * the port number.  GetNewPort() will return this number
	 * without check that it is in use.
	*
	 * The aliasing port is automatically selected by one of
	 * two methods below:
	 *
	 * When this parameter is GET_ALIAS_PORT, it indicates to get
	 * a randomly selected port number.
	 */
	if (alias_port_param >= 0 && alias_port_param < 0x10000) {
		lnk->alias_port = (u_short) alias_port_param;
		return (0);
	}
	if (alias_port_param != GET_ALIAS_PORT) {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/GetNewPort(): ");
		fprintf(stderr, "input parameter error\n");
#endif
		return (-1);
	}

	max_trials = GET_NEW_PORT_MAX_ATTEMPTS;

	if ((la->packetAliasMode & PKT_ALIAS_UDP_EIM) &&
	    lnk->link_type == LINK_UDP) {
		/* Try reuse the same alias address:port for all destinations
		 * from the same internal address:port, as per RFC 4787.
		 */
		struct alias_link *search_result = FindLinkByInternalEndpoint(
		    la, lnk->src_addr, lnk->src_port, lnk->link_type);
		if (search_result != NULL) {
			lnk->alias_port = search_result->alias_port;
			return (0);
		}
	}

	/*
	 * When the PKT_ALIAS_SAME_PORTS option is chosen,
	 * the first try will be the actual source port. If
	 * this is already in use, the remainder of the
	 * trials will be random.
	 */
	port = (la->packetAliasMode & PKT_ALIAS_SAME_PORTS)
	    ? lnk->src_port
	    : _RandomPort(la);

	/* Port number search */
	for (i = 0; i < max_trials; i++, port = _RandomPort(la)) {
		struct group_in *grp;
		struct alias_link *search_result;

		grp = StartPointIn(la, lnk->alias_addr, port, lnk->link_type, 0);
		if (grp == NULL)
			break;

		/* As per RFC 4787, UDP cannot share the same alias port among
		 * multiple internal endpoints
		 */
		if ((la->packetAliasMode & PKT_ALIAS_UDP_EIM) &&
		    lnk->link_type == LINK_UDP)
			continue;

		LIST_FOREACH(search_result, &grp->full, all.in) {
			if (lnk->dst_addr.s_addr ==
			    search_result->dst_addr.s_addr &&
			    lnk->dst_port == search_result->dst_port)
				break;     /* found match */
		}
		if (search_result == NULL)
			break;
	}

	if (i >= max_trials) {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/GetNewPort(): ");
		fprintf(stderr, "could not find free port\n");
#endif
		return (-1);
	}

#ifndef NO_USE_SOCKETS
	if ((la->packetAliasMode & PKT_ALIAS_USE_SOCKETS) &&
	    (lnk->flags & LINK_PARTIALLY_SPECIFIED) &&
	    ((lnk->link_type == LINK_TCP) ||
	     (lnk->link_type == LINK_UDP))) {
		if (!GetSocket(la, port, &lnk->sockfd, lnk->link_type)) {
			return (-1);
		}
	}
#endif
	lnk->alias_port = port;

	return (0);
}

#ifndef NO_USE_SOCKETS
static		u_short
GetSocket(struct libalias *la, u_short port_net, int *sockfd, int link_type)
{
	int err;
	int sock;
	struct sockaddr_in sock_addr;

	LIBALIAS_LOCK_ASSERT(la);
	if (link_type == LINK_TCP)
		sock = socket(AF_INET, SOCK_STREAM, 0);
	else if (link_type == LINK_UDP)
		sock = socket(AF_INET, SOCK_DGRAM, 0);
	else {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/GetSocket(): ");
		fprintf(stderr, "incorrect link type\n");
#endif
		return (0);
	}

	if (sock < 0) {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/GetSocket(): ");
		fprintf(stderr, "socket() error %d\n", *sockfd);
#endif
		return (0);
	}
	sock_addr.sin_family = AF_INET;
	sock_addr.sin_addr.s_addr = htonl(INADDR_ANY);
	sock_addr.sin_port = port_net;

	err = bind(sock,
	    (struct sockaddr *)&sock_addr,
	    sizeof(sock_addr));
	if (err == 0) {
		la->sockCount++;
		*sockfd = sock;
		return (1);
	} else {
		close(sock);
		return (0);
	}
}
#endif

/* FindNewPortGroup() returns a base port number for an available
   range of contiguous port numbers. Note that if a port number
   is already in use, that does not mean that it cannot be used by
   another link concurrently.  This is because FindNewPortGroup()
   looks for unused triplets: (dest addr, dest port, alias port). */

int
FindNewPortGroup(struct libalias *la,
    struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short src_port,
    u_short dst_port,
    u_short port_count,
    u_char proto,
    u_char align)
{
	int i, j;
	int max_trials;
	u_short port;
	int link_type;

	LIBALIAS_LOCK_ASSERT(la);
	/*
	 * Get link_type from protocol
	 */

	switch (proto) {
	case IPPROTO_UDP:
		link_type = LINK_UDP;
		break;
	case IPPROTO_TCP:
		link_type = LINK_TCP;
		break;
	default:
		return (0);
		break;
	}

	/*
	 * The aliasing port is automatically selected by one of two
	 * methods below:
	 */
	max_trials = GET_NEW_PORT_MAX_ATTEMPTS;

	if (la->packetAliasMode & PKT_ALIAS_SAME_PORTS) {
		/*
		 * When the ALIAS_SAME_PORTS option is chosen, the first
		 * try will be the actual source port. If this is already
		 * in use, the remainder of the trials will be random.
		 */
		port = src_port;

	} else {
		port = _RandomPort(la);
	}

	/* Port number search */
	for (i = 0; i < max_trials; i++, port = _RandomPort(la)) {
		struct alias_link *search_result;

		if (align)
			port &= htons(0xfffe);

		for (j = 0; j < port_count; j++) {
			u_short port_j = ntohs(port) + j;

			if ((search_result = FindLinkIn(la, dst_addr,
			    alias_addr, dst_port, htons(port_j),
			    link_type, 0)) != NULL)
				break;
		}

		/* Found a good range, return base */
		if (j == port_count)
			return (port);
	}

#ifdef LIBALIAS_DEBUG
	fprintf(stderr, "PacketAlias/FindNewPortGroup(): ");
	fprintf(stderr, "could not find free port(s)\n");
#endif

	return (0);
}

static void
CleanupAliasData(struct libalias *la, int deletePermanent)
{
	struct alias_link *lnk, *lnk_tmp;

	LIBALIAS_LOCK_ASSERT(la);

	/* permanent entries may stay */
	TAILQ_FOREACH_SAFE(lnk, &la->checkExpire, expire.list, lnk_tmp)
		DeleteLink(&lnk, deletePermanent);
}
static void
CleanupLink(struct libalias *la, struct alias_link **lnk, int deletePermanent)
{
	LIBALIAS_LOCK_ASSERT(la);

	if (lnk == NULL || *lnk == NULL)
		return;

	if (LibAliasTime - (*lnk)->timestamp > (*lnk)->expire.time) {
		DeleteLink(lnk, deletePermanent);
		if ((*lnk) == NULL)
			return;
	}

	/* move to end, swap may fail on a single entry list */
	TAILQ_REMOVE(&la->checkExpire, (*lnk), expire.list);
	TAILQ_INSERT_TAIL(&la->checkExpire, (*lnk), expire.list);
}

static struct alias_link *
UseLink(struct libalias *la, struct alias_link *lnk)
{
	CleanupLink(la, &lnk, 0);
	if (lnk != NULL)
		lnk->timestamp = LibAliasTime;
	return (lnk);
}

static void
DeleteLink(struct alias_link **plnk, int deletePermanent)
{
	struct alias_link *lnk = *plnk;
	struct libalias *la = lnk->la;

	LIBALIAS_LOCK_ASSERT(la);
	/* Don't do anything if the link is marked permanent */
	if (!deletePermanent && (lnk->flags & LINK_PERMANENT))
		return;

#ifndef NO_FW_PUNCH
	/* Delete associated firewall hole, if any */
	ClearFWHole(lnk);
#endif

	switch (lnk->link_type) {
	case LINK_PPTP:
		LIST_REMOVE(lnk, pptp.list);
		break;
	default: {
		struct group_in *grp;

		/* Free memory allocated for LSNAT server pool */
		if (lnk->server != NULL) {
			struct server *head, *curr, *next;

			head = curr = lnk->server;
			do {
				next = curr->next;
				free(curr);
			} while ((curr = next) != head);
		} else {
			/* Adjust output table pointers */
			SPLAY_REMOVE(splay_out, &la->linkSplayOut, lnk);
		}

		/* Adjust input table pointers */
		LIST_REMOVE(lnk, all.in);

		/* Adjust "internal endpoint" table pointer */
		SPLAY_REMOVE(splay_internal_endpoint,
		    &la->linkSplayInternalEndpoint, lnk);

		/* Remove intermediate node, if empty */
		grp = StartPointIn(la, lnk->alias_addr, lnk->alias_port, lnk->link_type, 0);
		if (grp != NULL &&
		    LIST_EMPTY(&grp->full) &&
		    LIST_EMPTY(&grp->partial)) {
			SPLAY_REMOVE(splay_in, &la->linkSplayIn, grp);
			free(grp);
		}
	}
		break;
	}

	/* remove from housekeeping */
	TAILQ_REMOVE(&la->checkExpire, lnk, expire.list);

#ifndef NO_USE_SOCKETS
	/* Close socket, if one has been allocated */
	if (lnk->sockfd != -1) {
		la->sockCount--;
		close(lnk->sockfd);
	}
#endif
	/* Link-type dependent cleanup */
	switch (lnk->link_type) {
	case LINK_ICMP:
		la->icmpLinkCount--;
		break;
	case LINK_UDP:
		la->udpLinkCount--;
		break;
	case LINK_TCP:
		la->tcpLinkCount--;
		free(lnk->data.tcp);
		break;
	case LINK_PPTP:
		la->pptpLinkCount--;
		break;
	case LINK_FRAGMENT_ID:
		la->fragmentIdLinkCount--;
		break;
	case LINK_FRAGMENT_PTR:
		la->fragmentPtrLinkCount--;
		if (lnk->data.frag_ptr != NULL)
			free(lnk->data.frag_ptr);
		break;
	case LINK_ADDR:
		break;
	default:
		la->protoLinkCount--;
		break;
	}

	/* Free memory */
	free(lnk);
	*plnk = NULL;

	/* Write statistics, if logging enabled */
	if (la->packetAliasMode & PKT_ALIAS_LOG) {
		ShowAliasStats(la);
	}
}

struct alias_link *
AddLink(struct libalias *la, struct in_addr src_addr, struct in_addr dst_addr,
    struct in_addr alias_addr, u_short src_port, u_short dst_port,
    int alias_port_param, int link_type)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	lnk = malloc(sizeof(struct alias_link));
	if (lnk == NULL) {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/AddLink(): ");
		fprintf(stderr, "malloc() call failed.\n");
#endif
		return (NULL);
	}
	/* Basic initialization */
	lnk->la = la;
	lnk->src_addr = src_addr;
	lnk->dst_addr = dst_addr;
	lnk->alias_addr = alias_addr;
	lnk->proxy_addr.s_addr = INADDR_ANY;
	lnk->src_port = src_port;
	lnk->dst_port = dst_port;
	lnk->proxy_port = 0;
	lnk->server = NULL;
	lnk->link_type = link_type;
#ifndef NO_USE_SOCKETS
	lnk->sockfd = -1;
#endif
	lnk->flags = 0;
	lnk->pflags = 0;
	lnk->timestamp = LibAliasTime;

	/* Expiration time */
	switch (link_type) {
	case LINK_ICMP:
		lnk->expire.time = ICMP_EXPIRE_TIME;
		break;
	case LINK_UDP:
		lnk->expire.time = UDP_EXPIRE_TIME;
		break;
	case LINK_TCP:
		lnk->expire.time = TCP_EXPIRE_INITIAL;
		break;
	case LINK_FRAGMENT_ID:
		lnk->expire.time = FRAGMENT_ID_EXPIRE_TIME;
		break;
	case LINK_FRAGMENT_PTR:
		lnk->expire.time = FRAGMENT_PTR_EXPIRE_TIME;
		break;
	default:
		lnk->expire.time = PROTO_EXPIRE_TIME;
		break;
	}

	/* Determine alias flags */
	if (dst_addr.s_addr == INADDR_ANY)
		lnk->flags |= LINK_UNKNOWN_DEST_ADDR;
	if (dst_port == 0)
		lnk->flags |= LINK_UNKNOWN_DEST_PORT;

	/* Determine alias port */
	if (GetNewPort(la, lnk, alias_port_param) != 0) {
		free(lnk);
		return (NULL);
	}
	/* Link-type dependent initialization */
	switch (link_type) {
	case LINK_ICMP:
		la->icmpLinkCount++;
		break;
	case LINK_UDP:
		la->udpLinkCount++;
		break;
	case LINK_TCP: {
		struct tcp_dat *aux_tcp;
		int i;

		aux_tcp = malloc(sizeof(struct tcp_dat));
		if (aux_tcp == NULL) {
#ifdef LIBALIAS_DEBUG
			fprintf(stderr, "PacketAlias/AddLink: ");
			fprintf(stderr, " cannot allocate auxiliary TCP data\n");
#endif
			free(lnk);
			return (NULL);
		}

		la->tcpLinkCount++;
		aux_tcp->state.in = ALIAS_TCP_STATE_NOT_CONNECTED;
		aux_tcp->state.out = ALIAS_TCP_STATE_NOT_CONNECTED;
		aux_tcp->state.index = 0;
		aux_tcp->state.ack_modified = 0;
		for (i = 0; i < N_LINK_TCP_DATA; i++)
			aux_tcp->ack[i].active = 0;
		aux_tcp->fwhole = -1;
		lnk->data.tcp = aux_tcp;
	}
		break;
	case LINK_PPTP:
		la->pptpLinkCount++;
		break;
	case LINK_FRAGMENT_ID:
		la->fragmentIdLinkCount++;
		break;
	case LINK_FRAGMENT_PTR:
		la->fragmentPtrLinkCount++;
		break;
	case LINK_ADDR:
		break;
	default:
		la->protoLinkCount++;
		break;
	}

	switch (link_type) {
	case LINK_PPTP:
		LIST_INSERT_HEAD(&la->pptpList, lnk, pptp.list);
		break;
	default: {
		struct group_in *grp;

		grp = StartPointIn(la, alias_addr, lnk->alias_port, link_type, 1);
		if (grp == NULL) {
			free(lnk);
			return (NULL);
		}

		/* Set up pointers for output lookup table */
		SPLAY_INSERT(splay_out, &la->linkSplayOut, lnk);

		/* Set up pointers for input lookup table */
		if (lnk->flags & LINK_PARTIALLY_SPECIFIED)
			LIST_INSERT_HEAD(&grp->partial, lnk, all.in);
		else
			LIST_INSERT_HEAD(&grp->full, lnk, all.in);

		/* Set up pointers for "internal endpoint" lookup table */
		SPLAY_INSERT(splay_internal_endpoint,
		    &la->linkSplayInternalEndpoint, lnk);
	}
		break;
	}

	/* Include the element into the housekeeping list */
	TAILQ_INSERT_TAIL(&la->checkExpire, lnk, expire.list);

	if (la->packetAliasMode & PKT_ALIAS_LOG)
		ShowAliasStats(la);

	return (lnk);
}

/*
 * If alias_port_param is less than zero, alias port will be automatically
 * chosen. If greater than zero, equal to alias port
 */
static struct alias_link *
ReLink(struct alias_link *old_lnk,
    struct in_addr src_addr,
    struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short src_port,
    u_short dst_port,
    int alias_port_param,
    int link_type,
    int deletePermanent)
{
	struct alias_link *new_lnk;
	struct libalias *la = old_lnk->la;

	LIBALIAS_LOCK_ASSERT(la);
	new_lnk = AddLink(la, src_addr, dst_addr, alias_addr,
	    src_port, dst_port, alias_port_param,
	    link_type);
#ifndef NO_FW_PUNCH
	if (new_lnk != NULL &&
	    old_lnk->link_type == LINK_TCP &&
	    old_lnk->data.tcp->fwhole > 0) {
		PunchFWHole(new_lnk);
	}
#endif
	DeleteLink(&old_lnk, deletePermanent);
	return (new_lnk);
}

static struct alias_link *
_SearchLinkOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short src_port,
    u_short dst_port,
    int link_type) {
	struct alias_link *lnk;
	struct alias_link needle = {
		.src_addr = src_addr,
		.dst_addr = dst_addr,
		.src_port = src_port,
		.dst_port = dst_port,
		.link_type = link_type
	};

	lnk = SPLAY_FIND(splay_out, &la->linkSplayOut, &needle);
	return (UseLink(la, lnk));
}

static struct alias_link *
_FindLinkOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short src_port,
    u_short dst_port,
    int link_type,
    int replace_partial_links)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = _SearchLinkOut(la, src_addr, dst_addr, src_port, dst_port, link_type);
	if (lnk != NULL || !replace_partial_links)
		return (lnk);

	/* Search for partially specified links. */
	if (dst_port != 0 && dst_addr.s_addr != INADDR_ANY) {
		lnk = _SearchLinkOut(la, src_addr, dst_addr, src_port, 0,
		    link_type);
		if (lnk == NULL)
			lnk = _SearchLinkOut(la, src_addr, ANY_ADDR, src_port,
			    dst_port, link_type);
	}
	if (lnk == NULL &&
	    (dst_port != 0 || dst_addr.s_addr != INADDR_ANY)) {
		lnk = _SearchLinkOut(la, src_addr, ANY_ADDR, src_port, 0,
		    link_type);
	}
	if (lnk != NULL) {
		lnk = ReLink(lnk,
		    src_addr, dst_addr, lnk->alias_addr,
		    src_port, dst_port, lnk->alias_port,
		    link_type, 0);
	}
	return (lnk);
}

static struct alias_link *
FindLinkOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short src_port,
    u_short dst_port,
    int link_type,
    int replace_partial_links)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = _FindLinkOut(la, src_addr, dst_addr, src_port, dst_port,
	    link_type, replace_partial_links);

	if (lnk == NULL) {
		/*
		 * The following allows permanent links to be specified as
		 * using the default source address (i.e. device interface
		 * address) without knowing in advance what that address
		 * is.
		 */
		if (la->aliasAddress.s_addr != INADDR_ANY &&
		    src_addr.s_addr == la->aliasAddress.s_addr) {
			lnk = _FindLinkOut(la, ANY_ADDR, dst_addr, src_port, dst_port,
			    link_type, replace_partial_links);
		}
	}
	return (lnk);
}

static struct alias_link *
_FindLinkIn(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short dst_port,
    u_short alias_port,
    int link_type,
    int replace_partial_links)
{
	int flags_in;
	struct group_in *grp;
	struct alias_link *lnk;
	struct alias_link *lnk_unknown_all;
	struct alias_link *lnk_unknown_dst_addr;
	struct alias_link *lnk_unknown_dst_port;
	struct in_addr src_addr;
	u_short src_port;

	LIBALIAS_LOCK_ASSERT(la);
	/* Initialize pointers */
	lnk_unknown_all = NULL;
	lnk_unknown_dst_addr = NULL;
	lnk_unknown_dst_port = NULL;

	/* If either the dest addr or port is unknown, the search
	 * loop will have to know about this. */
	flags_in = 0;
	if (dst_addr.s_addr == INADDR_ANY)
		flags_in |= LINK_UNKNOWN_DEST_ADDR;
	if (dst_port == 0)
		flags_in |= LINK_UNKNOWN_DEST_PORT;

	/* Search loop */
	grp = StartPointIn(la, alias_addr, alias_port, link_type, 0);
	if (grp == NULL)
		return (NULL);

	switch (flags_in) {
	case 0:
		LIST_FOREACH(lnk, &grp->full, all.in) {
			if (lnk->dst_addr.s_addr == dst_addr.s_addr &&
			    lnk->dst_port == dst_port) {
				struct alias_link *found;

				found = UseLink(la, lnk);
				if (found != NULL)
					return (found);
				/* link expired */
				grp = StartPointIn(la, alias_addr, alias_port, link_type, 0);
				if (grp == NULL)
					return (NULL);
				break;
			}
		}
		break;
	case LINK_UNKNOWN_DEST_PORT:
		LIST_FOREACH(lnk, &grp->full, all.in) {
			if(lnk->dst_addr.s_addr == dst_addr.s_addr) {
				lnk_unknown_dst_port = lnk;
				break;
			}
		}
		break;
	case LINK_UNKNOWN_DEST_ADDR:
		LIST_FOREACH(lnk, &grp->full, all.in) {
			if(lnk->dst_port == dst_port) {
				lnk_unknown_dst_addr = lnk;
				break;
			}
		}
		break;
	case LINK_PARTIALLY_SPECIFIED:
		lnk_unknown_all = LIST_FIRST(&grp->full);
		break;
	}

	if (lnk_unknown_dst_port == NULL) {
		LIST_FOREACH(lnk, &grp->partial, all.in) {
			int flags = (flags_in | lnk->flags) & LINK_PARTIALLY_SPECIFIED;

			if (flags == LINK_PARTIALLY_SPECIFIED &&
			    lnk_unknown_all == NULL)
				lnk_unknown_all = lnk;
			if (flags == LINK_UNKNOWN_DEST_ADDR &&
			    lnk->dst_port == dst_port &&
			    lnk_unknown_dst_addr == NULL)
				lnk_unknown_dst_addr = lnk;
			if (flags == LINK_UNKNOWN_DEST_PORT &&
			    lnk->dst_addr.s_addr == dst_addr.s_addr) {
				lnk_unknown_dst_port = lnk;
				break;
			}
		}
	}

	lnk = (lnk_unknown_dst_port != NULL) ? lnk_unknown_dst_port
	    : (lnk_unknown_dst_addr != NULL) ? lnk_unknown_dst_addr
	    : lnk_unknown_all;

	if (lnk == NULL || !replace_partial_links)
		return (lnk);

	if (lnk->server != NULL) {	/* LSNAT link */
		src_addr = lnk->server->addr;
		src_port = lnk->server->port;
		lnk->server = lnk->server->next;
	} else {
		src_addr = lnk->src_addr;
		src_port = lnk->src_port;
	}

	if (link_type == LINK_SCTP) {
		lnk->src_addr = src_addr;
		lnk->src_port = src_port;
	} else {
		lnk = ReLink(lnk,
		    src_addr, dst_addr, alias_addr,
		    src_port, dst_port, alias_port,
		    link_type, 0);
	}
	return (lnk);
}

static struct alias_link *
FindLinkIn(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short dst_port,
    u_short alias_port,
    int link_type,
    int replace_partial_links)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = _FindLinkIn(la, dst_addr, alias_addr, dst_port, alias_port,
	    link_type, replace_partial_links);

	if (lnk == NULL &&
	    (la->packetAliasMode & PKT_ALIAS_UDP_EIM) &&
	    link_type == LINK_UDP &&
	    !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
		lnk = _FindLinkIn(la, ANY_ADDR, alias_addr, 0, alias_port,
		    link_type, replace_partial_links);
	}

	if (lnk == NULL) {
		/*
		 * The following allows permanent links to be specified as
		 * using the default aliasing address (i.e. device
		 * interface address) without knowing in advance what that
		 * address is.
		 */
		if (la->aliasAddress.s_addr != INADDR_ANY &&
		    alias_addr.s_addr == la->aliasAddress.s_addr) {
			lnk = _FindLinkIn(la, dst_addr, ANY_ADDR, dst_port, alias_port,
			    link_type, replace_partial_links);
		}
	}
	return (lnk);
}

static struct alias_link *
FindLinkByInternalEndpoint(struct libalias *la, struct in_addr src_addr,
    u_short src_port,
    int link_type)
{
	struct alias_link needle = {
		.src_addr = src_addr,
		.src_port = src_port,
		.link_type = link_type
	};
	LIBALIAS_LOCK_ASSERT(la);
	return SPLAY_FIND(splay_internal_endpoint, &la->linkSplayInternalEndpoint, &needle);
}

/* External routines for finding/adding links

-- "external" means outside alias_db.c, but within alias*.c --

    FindIcmpIn(), FindIcmpOut()
    FindFragmentIn1(), FindFragmentIn2()
    AddFragmentPtrLink(), FindFragmentPtr()
    FindProtoIn(), FindProtoOut()
    FindUdpTcpIn(), FindUdpTcpOut()
    AddPptp(), FindPptpOutByCallId(), FindPptpInByCallId(),
    FindPptpOutByPeerCallId(), FindPptpInByPeerCallId()
    FindOriginalAddress(), FindAliasAddress()

(prototypes in alias_local.h)
*/

int
FindIcmpIn(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short id_alias,
    int create,
    struct alias_link **lnkp)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	lnk = FindLinkIn(la, dst_addr, alias_addr,
	    NO_DEST_PORT, id_alias,
	    LINK_ICMP, 0);
	if (lnk == NULL && create && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
		struct in_addr target_addr;

		target_addr = FindOriginalAddress(la, alias_addr);
		lnk = AddLink(la, target_addr, dst_addr, alias_addr,
		    id_alias, NO_DEST_PORT, id_alias,
		    LINK_ICMP);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);
	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

int
FindIcmpOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short id,
    int create,
    struct alias_link **lnkp)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	lnk = FindLinkOut(la, src_addr, dst_addr,
	    id, NO_DEST_PORT,
	    LINK_ICMP, 0);
	if (lnk == NULL && create) {
		struct in_addr alias_addr;

		alias_addr = FindAliasAddress(la, src_addr);
		lnk = AddLink(la, src_addr, dst_addr, alias_addr,
		    id, NO_DEST_PORT, GET_ALIAS_ID,
		    LINK_ICMP);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);
	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

struct alias_link *
FindFragmentIn1(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short ip_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = FindLinkIn(la, dst_addr, alias_addr,
	    NO_DEST_PORT, ip_id,
	    LINK_FRAGMENT_ID, 0);

	if (lnk == NULL) {
		lnk = AddLink(la, ANY_ADDR, dst_addr, alias_addr,
		    NO_SRC_PORT, NO_DEST_PORT, ip_id,
		    LINK_FRAGMENT_ID);
	}
	return (lnk);
}

/* Doesn't add a link if one is not found. */
struct alias_link *
FindFragmentIn2(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr, u_short ip_id)
{
	LIBALIAS_LOCK_ASSERT(la);
	return FindLinkIn(la, dst_addr, alias_addr,
	    NO_DEST_PORT, ip_id,
	    LINK_FRAGMENT_ID, 0);
}

struct alias_link *
AddFragmentPtrLink(struct libalias *la, struct in_addr dst_addr,
    u_short ip_id)
{
	LIBALIAS_LOCK_ASSERT(la);
	return AddLink(la, ANY_ADDR, dst_addr, ANY_ADDR,
	    NO_SRC_PORT, NO_DEST_PORT, ip_id,
	    LINK_FRAGMENT_PTR);
}

struct alias_link *
FindFragmentPtr(struct libalias *la, struct in_addr dst_addr,
    u_short ip_id)
{
	LIBALIAS_LOCK_ASSERT(la);
	return FindLinkIn(la, dst_addr, ANY_ADDR,
	    NO_DEST_PORT, ip_id,
	    LINK_FRAGMENT_PTR, 0);
}

int
FindProtoIn(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_char proto,
    struct alias_link **lnkp)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	lnk = FindLinkIn(la, dst_addr, alias_addr,
	    NO_DEST_PORT, 0,
	    proto, 1);
	if (lnk == NULL && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
		struct in_addr target_addr;

		target_addr = FindOriginalAddress(la, alias_addr);
		lnk = AddLink(la, target_addr, dst_addr, alias_addr,
		    NO_SRC_PORT, NO_DEST_PORT, 0,
		    proto);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);
	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

int
FindProtoOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_char proto,
    struct alias_link **lnkp)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	lnk = FindLinkOut(la, src_addr, dst_addr,
	    NO_SRC_PORT, NO_DEST_PORT,
	    proto, 1);
	if (lnk == NULL) {
		struct in_addr alias_addr;

		alias_addr = FindAliasAddress(la, src_addr);
		lnk = AddLink(la, src_addr, dst_addr, alias_addr,
		    NO_SRC_PORT, NO_DEST_PORT, 0,
		    proto);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);
	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

int
FindUdpTcpIn(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_short dst_port,
    u_short alias_port,
    u_char proto,
    int create,
    struct alias_link **lnkp)
{
	int link_type;
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	switch (proto) {
	case IPPROTO_UDP:
		link_type = LINK_UDP;
		break;
	case IPPROTO_TCP:
		link_type = LINK_TCP;
		break;
	default:
		return (PKT_ALIAS_IGNORED);
	}

	lnk = FindLinkIn(la, dst_addr, alias_addr,
	    dst_port, alias_port,
	    link_type, create);

	if (lnk == NULL && create && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
		struct in_addr target_addr;

		target_addr = FindOriginalAddress(la, alias_addr);
		lnk = AddLink(la, target_addr, dst_addr, alias_addr,
		    alias_port, dst_port, alias_port,
		    link_type);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);

	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

int
FindUdpTcpOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short src_port,
    u_short dst_port,
    u_char proto,
    int create,
    struct alias_link **lnkp)
{
	int link_type;
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	*lnkp = NULL;

	switch (proto) {
	case IPPROTO_UDP:
		link_type = LINK_UDP;
		break;
	case IPPROTO_TCP:
		link_type = LINK_TCP;
		break;
	default:
		return (PKT_ALIAS_IGNORED);
	}

	lnk = FindLinkOut(la, src_addr, dst_addr, src_port, dst_port, link_type, create);
	if (lnk == NULL && create) {
		struct in_addr alias_addr;

		alias_addr = FindAliasAddress(la, src_addr);
		lnk = AddLink(la, src_addr, dst_addr, alias_addr,
		    src_port, dst_port, GET_ALIAS_PORT,
		    link_type);
		if (lnk == NULL)
			return (PKT_ALIAS_ERROR);
	}
	*lnkp = lnk;
	return (lnk != NULL ? PKT_ALIAS_OK : PKT_ALIAS_IGNORED);
}

struct alias_link *
AddPptp(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_int16_t src_call_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = AddLink(la, src_addr, dst_addr, alias_addr,
	    src_call_id, 0, GET_ALIAS_PORT,
	    LINK_PPTP);

	return (lnk);
}

struct alias_link *
FindPptpOutByCallId(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_int16_t src_call_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	LIST_FOREACH(lnk, &la->pptpList, pptp.list)
		if (lnk->src_addr.s_addr == src_addr.s_addr &&
		    lnk->dst_addr.s_addr == dst_addr.s_addr &&
		    lnk->src_port == src_call_id)
			break;

	return (UseLink(la, lnk));
}

struct alias_link *
FindPptpOutByPeerCallId(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_int16_t dst_call_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	LIST_FOREACH(lnk, &la->pptpList, pptp.list)
		if (lnk->src_addr.s_addr == src_addr.s_addr &&
		    lnk->dst_addr.s_addr == dst_addr.s_addr &&
		    lnk->dst_port == dst_call_id)
			break;

	return (UseLink(la, lnk));
}

struct alias_link *
FindPptpInByCallId(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_int16_t dst_call_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);

	LIST_FOREACH(lnk, &la->pptpList, pptp.list)
		if (lnk->dst_port == dst_call_id &&
		    lnk->dst_addr.s_addr == dst_addr.s_addr &&
		    lnk->alias_addr.s_addr == alias_addr.s_addr)
			break;

	return (UseLink(la, lnk));
}

struct alias_link *
FindPptpInByPeerCallId(struct libalias *la, struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_int16_t alias_call_id)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	LIST_FOREACH(lnk, &la->pptpList, pptp.list)
		if (lnk->alias_port == alias_call_id &&
		    lnk->dst_addr.s_addr == dst_addr.s_addr &&
		    lnk->alias_addr.s_addr == alias_addr.s_addr)
			break;

	return (lnk);
}

struct alias_link *
FindRtspOut(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    u_short src_port,
    u_short alias_port,
    u_char proto)
{
	int link_type;
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	switch (proto) {
	case IPPROTO_UDP:
		link_type = LINK_UDP;
		break;
	case IPPROTO_TCP:
		link_type = LINK_TCP;
		break;
	default:
		return (NULL);
		break;
	}

	lnk = FindLinkOut(la, src_addr, dst_addr, src_port, 0, link_type, 1);

	if (lnk == NULL) {
		struct in_addr alias_addr;

		alias_addr = FindAliasAddress(la, src_addr);
		lnk = AddLink(la, src_addr, dst_addr, alias_addr,
		    src_port, 0, alias_port,
		    link_type);
	}
	return (lnk);
}

struct in_addr
FindOriginalAddress(struct libalias *la, struct in_addr alias_addr)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = FindLinkIn(la, ANY_ADDR, alias_addr,
	    0, 0, LINK_ADDR, 0);
	if (lnk == NULL) {
		if (la->targetAddress.s_addr == INADDR_ANY)
			return (alias_addr);
		else if (la->targetAddress.s_addr == INADDR_NONE)
			return (la->aliasAddress.s_addr != INADDR_ANY) ?
			    la->aliasAddress : alias_addr;
		else
			return (la->targetAddress);
	} else {
		if (lnk->server != NULL) {	/* LSNAT link */
			struct in_addr src_addr;

			src_addr = lnk->server->addr;
			lnk->server = lnk->server->next;
			return (src_addr);
		} else if (lnk->src_addr.s_addr == INADDR_ANY)
			return (la->aliasAddress.s_addr != INADDR_ANY) ?
			    la->aliasAddress : alias_addr;
		else
			return (lnk->src_addr);
	}
}

struct in_addr
FindAliasAddress(struct libalias *la, struct in_addr original_addr)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = FindLinkOut(la, original_addr, ANY_ADDR,
	    0, 0, LINK_ADDR, 0);
	if (lnk == NULL) {
		return (la->aliasAddress.s_addr != INADDR_ANY) ?
		    la->aliasAddress : original_addr;
	} else {
		if (lnk->alias_addr.s_addr == INADDR_ANY)
			return (la->aliasAddress.s_addr != INADDR_ANY) ?
			    la->aliasAddress : original_addr;
		else
			return (lnk->alias_addr);
	}
}

/* External routines for getting or changing link data
   (external to alias_db.c, but internal to alias*.c)

    SetFragmentData(), GetFragmentData()
    SetFragmentPtr(), GetFragmentPtr()
    SetStateIn(), SetStateOut(), GetStateIn(), GetStateOut()
    GetOriginalAddress(), GetDestAddress(), GetAliasAddress()
    GetOriginalPort(), GetAliasPort()
    SetAckModified(), GetAckModified()
    GetDeltaAckIn(), GetDeltaSeqOut(), AddSeq()
    SetProtocolFlags(), GetProtocolFlags()
    SetDestCallId()
*/

void
SetFragmentAddr(struct alias_link *lnk, struct in_addr src_addr)
{
	lnk->data.frag_addr = src_addr;
}

void
GetFragmentAddr(struct alias_link *lnk, struct in_addr *src_addr)
{
	*src_addr = lnk->data.frag_addr;
}

void
SetFragmentPtr(struct alias_link *lnk, void *fptr)
{
	lnk->data.frag_ptr = fptr;
}

void
GetFragmentPtr(struct alias_link *lnk, void **fptr)
{
	*fptr = lnk->data.frag_ptr;
}

void
SetStateIn(struct alias_link *lnk, int state)
{
	/* TCP input state */
	switch (state) {
		case ALIAS_TCP_STATE_DISCONNECTED:
		if (lnk->data.tcp->state.out != ALIAS_TCP_STATE_CONNECTED)
			lnk->expire.time = TCP_EXPIRE_DEAD;
		else
			lnk->expire.time = TCP_EXPIRE_SINGLEDEAD;
		break;
	case ALIAS_TCP_STATE_CONNECTED:
		if (lnk->data.tcp->state.out == ALIAS_TCP_STATE_CONNECTED)
			lnk->expire.time = TCP_EXPIRE_CONNECTED;
		break;
	default:
#ifdef _KERNEL
		panic("libalias:SetStateIn() unknown state");
#else
		abort();
#endif
	}
	lnk->data.tcp->state.in = state;
}

void
SetStateOut(struct alias_link *lnk, int state)
{
	/* TCP output state */
	switch (state) {
		case ALIAS_TCP_STATE_DISCONNECTED:
		if (lnk->data.tcp->state.in != ALIAS_TCP_STATE_CONNECTED)
			lnk->expire.time = TCP_EXPIRE_DEAD;
		else
			lnk->expire.time = TCP_EXPIRE_SINGLEDEAD;
		break;
	case ALIAS_TCP_STATE_CONNECTED:
		if (lnk->data.tcp->state.in == ALIAS_TCP_STATE_CONNECTED)
			lnk->expire.time = TCP_EXPIRE_CONNECTED;
		break;
	default:
#ifdef _KERNEL
		panic("libalias:SetStateOut() unknown state");
#else
		abort();
#endif
	}
	lnk->data.tcp->state.out = state;
}

int
GetStateIn(struct alias_link *lnk)
{
	/* TCP input state */
	return (lnk->data.tcp->state.in);
}

int
GetStateOut(struct alias_link *lnk)
{
	/* TCP output state */
	return (lnk->data.tcp->state.out);
}

struct in_addr
GetOriginalAddress(struct alias_link *lnk)
{
	if (lnk->src_addr.s_addr == INADDR_ANY)
		return (lnk->la->aliasAddress);
	else
		return (lnk->src_addr);
}

struct in_addr
GetDestAddress(struct alias_link *lnk)
{
	return (lnk->dst_addr);
}

struct in_addr
GetAliasAddress(struct alias_link *lnk)
{
	if (lnk->alias_addr.s_addr == INADDR_ANY)
		return (lnk->la->aliasAddress);
	else
		return (lnk->alias_addr);
}

struct in_addr
GetDefaultAliasAddress(struct libalias *la)
{
	LIBALIAS_LOCK_ASSERT(la);
	return (la->aliasAddress);
}

void
SetDefaultAliasAddress(struct libalias *la, struct in_addr alias_addr)
{
	LIBALIAS_LOCK_ASSERT(la);
	la->aliasAddress = alias_addr;
}

u_short
GetOriginalPort(struct alias_link *lnk)
{
	return (lnk->src_port);
}

u_short
GetAliasPort(struct alias_link *lnk)
{
	return (lnk->alias_port);
}

#ifndef NO_FW_PUNCH
static u_short
GetDestPort(struct alias_link *lnk)
{
	return (lnk->dst_port);
}

#endif

/* Indicate that ACK numbers have been modified in a TCP connection */
void
SetAckModified(struct alias_link *lnk)
{
	lnk->data.tcp->state.ack_modified = 1;
}

struct in_addr
GetProxyAddress(struct alias_link *lnk)
{
	return (lnk->proxy_addr);
}

void
SetProxyAddress(struct alias_link *lnk, struct in_addr addr)
{
	lnk->proxy_addr = addr;
}

u_short
GetProxyPort(struct alias_link *lnk)
{
	return (lnk->proxy_port);
}

void
SetProxyPort(struct alias_link *lnk, u_short port)
{
	lnk->proxy_port = port;
}

/* See if ACK numbers have been modified */
int
GetAckModified(struct alias_link *lnk)
{
	return (lnk->data.tcp->state.ack_modified);
}

/*
 * Find out how much the ACK number has been altered for an
 * incoming TCP packet.  To do this, a circular list of ACK
 * numbers where the TCP packet size was altered is searched.
 */
// XXX ip free
int
GetDeltaAckIn(u_long ack, struct alias_link *lnk)
{
	int i, j;
	int delta, ack_diff_min;

	delta = 0;
	ack_diff_min = -1;
	i = lnk->data.tcp->state.index;
	for (j = 0; j < N_LINK_TCP_DATA; j++) {
		struct ack_data_record x;

		if (i == 0)
			i = N_LINK_TCP_DATA;
		i--;
		x = lnk->data.tcp->ack[i];
		if (x.active == 1) {
			int ack_diff;

			ack_diff = SeqDiff(x.ack_new, ack);
			if (ack_diff >= 0) {
				if (ack_diff_min >= 0) {
					if (ack_diff < ack_diff_min) {
						delta = x.delta;
						ack_diff_min = ack_diff;
					}
				} else {
					delta = x.delta;
					ack_diff_min = ack_diff;
				}
			}
		}
	}
	return (delta);
}

/*
 * Find out how much the sequence number has been altered for an
 * outgoing TCP packet.  To do this, a circular list of ACK numbers
 * where the TCP packet size was altered is searched.
 */
// XXX ip free
int
GetDeltaSeqOut(u_long seq, struct alias_link *lnk)
{
	int i, j;
	int delta, seq_diff_min;

	delta = 0;
	seq_diff_min = -1;
	i = lnk->data.tcp->state.index;
	for (j = 0; j < N_LINK_TCP_DATA; j++) {
		struct ack_data_record x;

		if (i == 0)
			i = N_LINK_TCP_DATA;
		i--;
		x = lnk->data.tcp->ack[i];
		if (x.active == 1) {
			int seq_diff;

			seq_diff = SeqDiff(x.ack_old, seq);
			if (seq_diff >= 0) {
				if (seq_diff_min >= 0) {
					if (seq_diff < seq_diff_min) {
						delta = x.delta;
						seq_diff_min = seq_diff;
					}
				} else {
					delta = x.delta;
					seq_diff_min = seq_diff;
				}
			}
		}
	}
	return (delta);
}

/*
 * When a TCP packet has been altered in length, save this
 * information in a circular list.  If enough packets have been
 * altered, then this list will begin to overwrite itself.
 */
// XXX ip free
void
AddSeq(struct alias_link *lnk, int delta, u_int ip_hl, u_short ip_len,
    u_long th_seq, u_int th_off)
{
	struct ack_data_record x;
	int hlen, tlen, dlen;
	int i;

	hlen = (ip_hl + th_off) << 2;
	tlen = ntohs(ip_len);
	dlen = tlen - hlen;

	x.ack_old = htonl(ntohl(th_seq) + dlen);
	x.ack_new = htonl(ntohl(th_seq) + dlen + delta);
	x.delta = delta;
	x.active = 1;

	i = lnk->data.tcp->state.index;
	lnk->data.tcp->ack[i] = x;

	i++;
	if (i == N_LINK_TCP_DATA)
		lnk->data.tcp->state.index = 0;
	else
		lnk->data.tcp->state.index = i;
}

void
SetExpire(struct alias_link *lnk, int expire)
{
	if (expire == 0) {
		lnk->flags &= ~LINK_PERMANENT;
		DeleteLink(&lnk, 0);
	} else if (expire == -1) {
		lnk->flags |= LINK_PERMANENT;
	} else if (expire > 0) {
		lnk->expire.time = expire;
	} else {
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAlias/SetExpire(): ");
		fprintf(stderr, "error in expire parameter\n");
#endif
	}
}

void
SetProtocolFlags(struct alias_link *lnk, int pflags)
{
	lnk->pflags = pflags;
}

int
GetProtocolFlags(struct alias_link *lnk)
{
	return (lnk->pflags);
}

void
SetDestCallId(struct alias_link *lnk, u_int16_t cid)
{
	LIBALIAS_LOCK_ASSERT(lnk->la);
	ReLink(lnk, lnk->src_addr, lnk->dst_addr, lnk->alias_addr,
	    lnk->src_port, cid, lnk->alias_port, lnk->link_type, 1);
}

/* Miscellaneous Functions

    HouseKeeping()
    InitPacketAliasLog()
    UninitPacketAliasLog()
*/

/*
    Whenever an outgoing or incoming packet is handled, HouseKeeping()
    is called to find and remove timed-out aliasing links.  Logic exists
    to sweep through the entire table and linked list structure
    every 60 seconds.

    (prototype in alias_local.h)
*/

void
HouseKeeping(struct libalias *la)
{
	static unsigned int packets = 0;
	static unsigned int packet_limit = 1000;

	LIBALIAS_LOCK_ASSERT(la);
	packets++;

	/*
	 * User space time/gettimeofday/... is very expensive.
	 * Kernel space cache trashing is unnecessary.
	 *
	 * Save system time (seconds) in global variable LibAliasTime
	 * for use by other functions. This is done so as not to
	 * unnecessarily waste timeline by making system calls.
	 *
	 * Reduce the amount of house keeping work substantially by
	 * sampling over the packets.
	 */
	if (packet_limit <= 1 || packets % packet_limit == 0) {
		time_t now;

#ifdef _KERNEL
		now = time_uptime;
#else
		now = time(NULL);
#endif
		if (now != LibAliasTime) {
			/* retry three times a second */
			packet_limit = packets / 3;
			packets = 0;
			LibAliasTime = now;
		}

	}
	/* Do a cleanup for the first packets of the new second only */
	if (packets < (la->udpLinkCount + la->tcpLinkCount)) {
		struct alias_link * lnk = TAILQ_FIRST(&la->checkExpire);

		CleanupLink(la, &lnk, 0);
	}
}

/* Init the log file and enable logging */
static int
InitPacketAliasLog(struct libalias *la)
{
	LIBALIAS_LOCK_ASSERT(la);
	if (~la->packetAliasMode & PKT_ALIAS_LOG) {
#ifdef _KERNEL
		if ((la->logDesc = malloc(LIBALIAS_BUF_SIZE)))
			;
#else
		if ((la->logDesc = fopen("/var/log/alias.log", "w")))
			fprintf(la->logDesc, "PacketAlias/InitPacketAliasLog: Packet alias logging enabled.\n");
#endif
		else
			return (ENOMEM); /* log initialization failed */
		la->packetAliasMode |= PKT_ALIAS_LOG;
	}

	return (1);
}

/* Close the log-file and disable logging. */
static void
UninitPacketAliasLog(struct libalias *la)
{
	LIBALIAS_LOCK_ASSERT(la);
	if (la->logDesc) {
#ifdef _KERNEL
		free(la->logDesc);
#else
		fclose(la->logDesc);
#endif
		la->logDesc = NULL;
	}
	la->packetAliasMode &= ~PKT_ALIAS_LOG;
}

/* Outside world interfaces

-- "outside world" means other than alias*.c routines --

    PacketAliasRedirectPort()
    PacketAliasAddServer()
    PacketAliasRedirectProto()
    PacketAliasRedirectAddr()
    PacketAliasRedirectDynamic()
    PacketAliasRedirectDelete()
    PacketAliasSetAddress()
    PacketAliasInit()
    PacketAliasUninit()
    PacketAliasSetMode()

(prototypes in alias.h)
*/

/* Redirection from a specific public addr:port to a
   private addr:port */
struct alias_link *
LibAliasRedirectPort(struct libalias *la, struct in_addr src_addr, u_short src_port,
    struct in_addr dst_addr, u_short dst_port,
    struct in_addr alias_addr, u_short alias_port,
    u_char proto)
{
	int link_type;
	struct alias_link *lnk;

	LIBALIAS_LOCK(la);
	switch (proto) {
	case IPPROTO_UDP:
		link_type = LINK_UDP;
		break;
	case IPPROTO_TCP:
		link_type = LINK_TCP;
		break;
	case IPPROTO_SCTP:
		link_type = LINK_SCTP;
		break;
	default:
#ifdef LIBALIAS_DEBUG
		fprintf(stderr, "PacketAliasRedirectPort(): ");
		fprintf(stderr, "only SCTP, TCP and UDP protocols allowed\n");
#endif
		lnk = NULL;
		goto getout;
	}

	lnk = AddLink(la, src_addr, dst_addr, alias_addr,
	    src_port, dst_port, alias_port,
	    link_type);

	if (lnk != NULL) {
		lnk->flags |= LINK_PERMANENT;
	}
#ifdef LIBALIAS_DEBUG
	else {
		fprintf(stderr, "PacketAliasRedirectPort(): "
		    "call to AddLink() failed\n");
	}
#endif

getout:
	LIBALIAS_UNLOCK(la);
	return (lnk);
}

/* Add server to the pool of servers */
int
LibAliasAddServer(struct libalias *la, struct alias_link *lnk, struct in_addr addr, u_short port)
{
	struct server *server;
	int res;

	LIBALIAS_LOCK(la);
	(void)la;

	switch (lnk->link_type) {
	case LINK_PPTP:
		server = NULL;
		break;
	default:
		server = malloc(sizeof(struct server));
		break;
	}

	if (server != NULL) {
		struct server *head;

		server->addr = addr;
		server->port = port;

		head = lnk->server;
		if (head == NULL) {
			server->next = server;
			/* not usable for outgoing connections */
			SPLAY_REMOVE(splay_out, &la->linkSplayOut, lnk);
		} else {
			struct server *s;

			for (s = head; s->next != head; s = s->next)
				;
			s->next = server;
			server->next = head;
		}
		lnk->server = server;
		res = 0;
	} else
		res = -1;

	LIBALIAS_UNLOCK(la);
	return (res);
}

/* Redirect packets of a given IP protocol from a specific
   public address to a private address */
struct alias_link *
LibAliasRedirectProto(struct libalias *la, struct in_addr src_addr,
    struct in_addr dst_addr,
    struct in_addr alias_addr,
    u_char proto)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK(la);
	lnk = AddLink(la, src_addr, dst_addr, alias_addr,
	    NO_SRC_PORT, NO_DEST_PORT, 0,
	    proto);

	if (lnk != NULL) {
		lnk->flags |= LINK_PERMANENT;
	}
#ifdef LIBALIAS_DEBUG
	else {
		fprintf(stderr, "PacketAliasRedirectProto(): "
		    "call to AddLink() failed\n");
	}
#endif

	LIBALIAS_UNLOCK(la);
	return (lnk);
}

/* Static address translation */
struct alias_link *
LibAliasRedirectAddr(struct libalias *la, struct in_addr src_addr,
    struct in_addr alias_addr)
{
	struct alias_link *lnk;

	LIBALIAS_LOCK(la);
	lnk = AddLink(la, src_addr, ANY_ADDR, alias_addr,
	    0, 0, 0,
	    LINK_ADDR);

	if (lnk != NULL) {
		lnk->flags |= LINK_PERMANENT;
	}
#ifdef LIBALIAS_DEBUG
	else {
		fprintf(stderr, "PacketAliasRedirectAddr(): "
		    "call to AddLink() failed\n");
	}
#endif

	LIBALIAS_UNLOCK(la);
	return (lnk);
}

/* Mark the aliasing link dynamic */
int
LibAliasRedirectDynamic(struct libalias *la, struct alias_link *lnk)
{
	int res;

	LIBALIAS_LOCK(la);
	(void)la;

	if (lnk->flags & LINK_PARTIALLY_SPECIFIED)
		res = -1;
	else {
		lnk->flags &= ~LINK_PERMANENT;
		res = 0;
	}
	LIBALIAS_UNLOCK(la);
	return (res);
}

/* This is a dangerous function to put in the API,
   because an invalid pointer can crash the program. */
void
LibAliasRedirectDelete(struct libalias *la, struct alias_link *lnk)
{
	LIBALIAS_LOCK(la);
	(void)la;
	DeleteLink(&lnk, 1);
	LIBALIAS_UNLOCK(la);
}

void
LibAliasSetAddress(struct libalias *la, struct in_addr addr)
{
	LIBALIAS_LOCK(la);
	if (la->packetAliasMode & PKT_ALIAS_RESET_ON_ADDR_CHANGE
	    && la->aliasAddress.s_addr != addr.s_addr)
		CleanupAliasData(la, 0);

	la->aliasAddress = addr;
	LIBALIAS_UNLOCK(la);
}

void
LibAliasSetAliasPortRange(struct libalias *la, u_short port_low,
    u_short port_high)
{
	LIBALIAS_LOCK(la);
	if (port_low) {
		la->aliasPortLower = port_low;
		/* Add 1 to the aliasPortLength as modulo has range of 1 to n-1 */
		la->aliasPortLength = port_high - port_low + 1;
	} else {
		/* Set default values */
		la->aliasPortLower = 0x8000;
		la->aliasPortLength = 0x8000;
	}
	LIBALIAS_UNLOCK(la);
}

void
LibAliasSetTarget(struct libalias *la, struct in_addr target_addr)
{
	LIBALIAS_LOCK(la);
	la->targetAddress = target_addr;
	LIBALIAS_UNLOCK(la);
}

static void
finishoff(void)
{
	while (!LIST_EMPTY(&instancehead))
		LibAliasUninit(LIST_FIRST(&instancehead));
}

struct libalias *
LibAliasInit(struct libalias *la)
{
	if (la == NULL) {
#ifdef _KERNEL
#undef malloc	/* XXX: ugly */
		la = malloc(sizeof *la, M_ALIAS, M_WAITOK | M_ZERO);
#else
		la = calloc(sizeof *la, 1);
		if (la == NULL)
			return (la);
#endif

#ifndef _KERNEL
		/* kernel cleans up on module unload */
		if (LIST_EMPTY(&instancehead))
			atexit(finishoff);
#endif
		LIST_INSERT_HEAD(&instancehead, la, instancelist);

#ifdef _KERNEL
		LibAliasTime = time_uptime;
#else
		LibAliasTime = time(NULL);
#endif

		SPLAY_INIT(&la->linkSplayIn);
		SPLAY_INIT(&la->linkSplayOut);
		SPLAY_INIT(&la->linkSplayInternalEndpoint);
		LIST_INIT(&la->pptpList);
		TAILQ_INIT(&la->checkExpire);
#ifdef _KERNEL
		AliasSctpInit(la);
#endif
		LIBALIAS_LOCK_INIT(la);
		LIBALIAS_LOCK(la);
	} else {
		LIBALIAS_LOCK(la);
		CleanupAliasData(la, 1);
#ifdef _KERNEL
		AliasSctpTerm(la);
		AliasSctpInit(la);
#endif
	}

	la->aliasAddress.s_addr = INADDR_ANY;
	la->targetAddress.s_addr = INADDR_ANY;
	la->aliasPortLower = 0x8000;
	la->aliasPortLength = 0x8000;

	la->icmpLinkCount = 0;
	la->udpLinkCount = 0;
	la->tcpLinkCount = 0;
	la->sctpLinkCount = 0;
	la->pptpLinkCount = 0;
	la->protoLinkCount = 0;
	la->fragmentIdLinkCount = 0;
	la->fragmentPtrLinkCount = 0;
	la->sockCount = 0;

	la->packetAliasMode = PKT_ALIAS_SAME_PORTS
#ifndef NO_USE_SOCKETS
	    | PKT_ALIAS_USE_SOCKETS
#endif
	    | PKT_ALIAS_RESET_ON_ADDR_CHANGE;
#ifndef NO_FW_PUNCH
	la->fireWallFD = -1;
#endif
#ifndef _KERNEL
	LibAliasRefreshModules();
#endif
	LIBALIAS_UNLOCK(la);
	return (la);
}

void
LibAliasUninit(struct libalias *la)
{
	LIBALIAS_LOCK(la);
#ifdef _KERNEL
	AliasSctpTerm(la);
#endif
	CleanupAliasData(la, 1);
	UninitPacketAliasLog(la);
#ifndef NO_FW_PUNCH
	UninitPunchFW(la);
#endif
	LIST_REMOVE(la, instancelist);
	LIBALIAS_UNLOCK(la);
	LIBALIAS_LOCK_DESTROY(la);
	free(la);
}

/* Change mode for some operations */
unsigned int
LibAliasSetMode(
    struct libalias *la,
    unsigned int flags,		/* Which state to bring flags to */
    unsigned int mask		/* Mask of which flags to affect (use 0 to
				 * do a probe for flag values) */
)
{
	int res = -1;

	LIBALIAS_LOCK(la);
	if (flags & mask & PKT_ALIAS_LOG) {
		/* Enable logging */
		if (InitPacketAliasLog(la) == ENOMEM)
			goto getout;
	} else if (~flags & mask & PKT_ALIAS_LOG)
		/* _Disable_ logging */
		UninitPacketAliasLog(la);

#ifndef NO_FW_PUNCH
	if (flags & mask & PKT_ALIAS_PUNCH_FW)
		/* Start punching holes in the firewall? */
		InitPunchFW(la);
	else if (~flags & mask & PKT_ALIAS_PUNCH_FW)
		/* Stop punching holes in the firewall? */
		UninitPunchFW(la);
#endif

	/* Other flags can be set/cleared without special action */
	la->packetAliasMode = (flags & mask) | (la->packetAliasMode & ~mask);
	res = la->packetAliasMode;
getout:
	LIBALIAS_UNLOCK(la);
	return (res);
}

#ifndef NO_FW_PUNCH

/*****************
  Code to support firewall punching.  This shouldn't really be in this
  file, but making variables global is evil too.
  ****************/

/* Firewall include files */
#include <net/if.h>
#include <netinet/ip_fw.h>
#include <string.h>
#include <err.h>

/*
 * helper function, updates the pointer to cmd with the length
 * of the current command, and also cleans up the first word of
 * the new command in case it has been clobbered before.
 */
static ipfw_insn *
next_cmd(ipfw_insn * cmd)
{
	cmd += F_LEN(cmd);
	bzero(cmd, sizeof(*cmd));
	return (cmd);
}

/*
 * A function to fill simple commands of size 1.
 * Existing flags are preserved.
 */
static ipfw_insn *
fill_cmd(ipfw_insn * cmd, enum ipfw_opcodes opcode, int size,
    int flags, u_int16_t arg)
{
	cmd->opcode = opcode;
	cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | (size & F_LEN_MASK);
	cmd->arg1 = arg;
	return next_cmd(cmd);
}

static ipfw_insn *
fill_ip(ipfw_insn * cmd1, enum ipfw_opcodes opcode, u_int32_t addr)
{
	ipfw_insn_ip *cmd = (ipfw_insn_ip *)cmd1;

	cmd->addr.s_addr = addr;
	return fill_cmd(cmd1, opcode, F_INSN_SIZE(ipfw_insn_u32), 0, 0);
}

static ipfw_insn *
fill_one_port(ipfw_insn * cmd1, enum ipfw_opcodes opcode, u_int16_t port)
{
	ipfw_insn_u16 *cmd = (ipfw_insn_u16 *)cmd1;

	cmd->ports[0] = cmd->ports[1] = port;
	return fill_cmd(cmd1, opcode, F_INSN_SIZE(ipfw_insn_u16), 0, 0);
}

static int
fill_rule(void *buf, int bufsize, int rulenum,
    enum ipfw_opcodes action, int proto,
    struct in_addr sa, u_int16_t sp, struct in_addr da, u_int16_t dp)
{
	struct ip_fw *rule = (struct ip_fw *)buf;
	ipfw_insn *cmd = (ipfw_insn *)rule->cmd;

	bzero(buf, bufsize);
	rule->rulenum = rulenum;

	cmd = fill_cmd(cmd, O_PROTO, F_INSN_SIZE(ipfw_insn), 0, proto);
	cmd = fill_ip(cmd, O_IP_SRC, sa.s_addr);
	cmd = fill_one_port(cmd, O_IP_SRCPORT, sp);
	cmd = fill_ip(cmd, O_IP_DST, da.s_addr);
	cmd = fill_one_port(cmd, O_IP_DSTPORT, dp);

	rule->act_ofs = (u_int32_t *)cmd - (u_int32_t *)rule->cmd;
	cmd = fill_cmd(cmd, action, F_INSN_SIZE(ipfw_insn), 0, 0);

	rule->cmd_len = (u_int32_t *)cmd - (u_int32_t *)rule->cmd;

	return ((char *)cmd - (char *)buf);
}

static void
InitPunchFW(struct libalias *la)
{
	la->fireWallField = malloc(la->fireWallNumNums);
	if (la->fireWallField) {
		memset(la->fireWallField, 0, la->fireWallNumNums);
		if (la->fireWallFD < 0) {
			la->fireWallFD = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
		}
		ClearAllFWHoles(la);
		la->fireWallActiveNum = la->fireWallBaseNum;
	}
}

static void
UninitPunchFW(struct libalias *la)
{
	ClearAllFWHoles(la);
	if (la->fireWallFD >= 0)
		close(la->fireWallFD);
	la->fireWallFD = -1;
	if (la->fireWallField)
		free(la->fireWallField);
	la->fireWallField = NULL;
	la->packetAliasMode &= ~PKT_ALIAS_PUNCH_FW;
}

/* Make a certain link go through the firewall */
void
PunchFWHole(struct alias_link *lnk)
{
	struct libalias *la;
	int r;			/* Result code */
	struct ip_fw rule;	/* On-the-fly built rule */
	int fwhole;		/* Where to punch hole */

	la = lnk->la;

	/* Don't do anything unless we are asked to */
	if (!(la->packetAliasMode & PKT_ALIAS_PUNCH_FW) ||
	    la->fireWallFD < 0 ||
	    lnk->link_type != LINK_TCP)
		return;

	memset(&rule, 0, sizeof rule);

	/** Build rule **/

	/* Find empty slot */
	for (fwhole = la->fireWallActiveNum;
	    fwhole < la->fireWallBaseNum + la->fireWallNumNums &&
	    fw_tstfield(la, la->fireWallField, fwhole);
	    fwhole++);
	if (fwhole == la->fireWallBaseNum + la->fireWallNumNums) {
		for (fwhole = la->fireWallBaseNum;
		    fwhole < la->fireWallActiveNum &&
		    fw_tstfield(la, la->fireWallField, fwhole);
		    fwhole++);
		if (fwhole == la->fireWallActiveNum) {
			/* No rule point empty - we can't punch more holes. */
			la->fireWallActiveNum = la->fireWallBaseNum;
#ifdef LIBALIAS_DEBUG
			fprintf(stderr, "libalias: Unable to create firewall hole!\n");
#endif
			return;
		}
	}
	/* Start next search at next position */
	la->fireWallActiveNum = fwhole + 1;

	/*
	 * generate two rules of the form
	 *
	 * add fwhole accept tcp from OAddr OPort to DAddr DPort add fwhole
	 * accept tcp from DAddr DPort to OAddr OPort
	 */
	if (GetOriginalPort(lnk) != 0 && GetDestPort(lnk) != 0) {
		u_int32_t rulebuf[255];
		int i;

		i = fill_rule(rulebuf, sizeof(rulebuf), fwhole,
		    O_ACCEPT, IPPROTO_TCP,
		    GetOriginalAddress(lnk), ntohs(GetOriginalPort(lnk)),
		    GetDestAddress(lnk), ntohs(GetDestPort(lnk)));
		r = setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_ADD, rulebuf, i);
		if (r)
			err(1, "alias punch inbound(1) setsockopt(IP_FW_ADD)");

		i = fill_rule(rulebuf, sizeof(rulebuf), fwhole,
		    O_ACCEPT, IPPROTO_TCP,
		    GetDestAddress(lnk), ntohs(GetDestPort(lnk)),
		    GetOriginalAddress(lnk), ntohs(GetOriginalPort(lnk)));
		r = setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_ADD, rulebuf, i);
		if (r)
			err(1, "alias punch inbound(2) setsockopt(IP_FW_ADD)");
	}

	/* Indicate hole applied */
	lnk->data.tcp->fwhole = fwhole;
	fw_setfield(la, la->fireWallField, fwhole);
}

/* Remove a hole in a firewall associated with a particular alias
   lnk.  Calling this too often is harmless. */
static void
ClearFWHole(struct alias_link *lnk)
{
	struct libalias *la;

	la = lnk->la;
	if (lnk->link_type == LINK_TCP) {
		int fwhole = lnk->data.tcp->fwhole;  /* Where is the firewall hole? */
		struct ip_fw rule;

		if (fwhole < 0)
			return;

		memset(&rule, 0, sizeof rule);	/* useless for ipfw2 */
		while (!setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_DEL,
		    &fwhole, sizeof fwhole));
		fw_clrfield(la, la->fireWallField, fwhole);
		lnk->data.tcp->fwhole = -1;
	}
}

/* Clear out the entire range dedicated to firewall holes. */
static void
ClearAllFWHoles(struct libalias *la)
{
	struct ip_fw rule;	/* On-the-fly built rule */
	int i;

	if (la->fireWallFD < 0)
		return;

	memset(&rule, 0, sizeof rule);
	for (i = la->fireWallBaseNum; i < la->fireWallBaseNum + la->fireWallNumNums; i++) {
		int r = i;

		while (!setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_DEL, &r, sizeof r));
	}
	/* XXX: third arg correct here ? /phk */
	memset(la->fireWallField, 0, la->fireWallNumNums);
}

#endif /* !NO_FW_PUNCH */

void
LibAliasSetFWBase(struct libalias *la, unsigned int base, unsigned int num)
{
	LIBALIAS_LOCK(la);
#ifndef NO_FW_PUNCH
	la->fireWallBaseNum = base;
	la->fireWallNumNums = num;
#endif
	LIBALIAS_UNLOCK(la);
}

void
LibAliasSetSkinnyPort(struct libalias *la, unsigned int port)
{
	LIBALIAS_LOCK(la);
	la->skinnyPort = port;
	LIBALIAS_UNLOCK(la);
}

/*
 * Find the address to redirect incoming packets
 */
struct in_addr
FindSctpRedirectAddress(struct libalias *la,  struct sctp_nat_msg *sm)
{
	struct alias_link *lnk;
	struct in_addr redir;

	LIBALIAS_LOCK_ASSERT(la);
	lnk = FindLinkIn(la, sm->ip_hdr->ip_src, sm->ip_hdr->ip_dst,
	    sm->sctp_hdr->dest_port,sm->sctp_hdr->dest_port, LINK_SCTP, 1);
	if (lnk != NULL) {
		/* port redirect */
		return (lnk->src_addr);
	} else {
		redir = FindOriginalAddress(la,sm->ip_hdr->ip_dst);
		if (redir.s_addr == la->aliasAddress.s_addr ||
		    redir.s_addr == la->targetAddress.s_addr) {
			/* No address found */
			lnk = FindLinkIn(la, sm->ip_hdr->ip_src, sm->ip_hdr->ip_dst,
			    NO_DEST_PORT, 0, LINK_SCTP, 1);
			if (lnk != NULL)
				/* redirect proto */
				return (lnk->src_addr);
		}
		return (redir); /* address redirect */
	}
}