xref: /freebsd/sys/netinet/libalias/libalias.3 (revision 9ecd54f24fe9fa373e07c9fd7c052deb2188f545)
1.\"-
2.\" Copyright (c) 2001 Charles Mott <cm@linktel.net>
3.\" All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\"    notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\"    notice, this list of conditions and the following disclaimer in the
12.\"    documentation and/or other materials provided with the distribution.
13.\"
14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24.\" SUCH DAMAGE.
25.\"
26.\" $FreeBSD$
27.\"
28.Dd December 25, 2013
29.Dt LIBALIAS 3
30.Os
31.Sh NAME
32.Nm libalias
33.Nd packet aliasing library for masquerading and network address translation
34.Sh SYNOPSIS
35.In sys/types.h
36.In netinet/in.h
37.In alias.h
38.Pp
39Function prototypes are given in the main body of the text.
40.Sh DESCRIPTION
41The
42.Nm
43library is a collection of functions for aliasing and de-aliasing of IP
44packets, intended for masquerading and network address translation (NAT).
45.Sh INTRODUCTION
46This library is a moderately portable set of functions designed to assist
47in the process of IP masquerading and network address translation.
48Outgoing packets from a local network with unregistered IP addresses can
49be aliased to appear as if they came from an accessible IP address.
50Incoming packets are then de-aliased so that they are sent to the correct
51machine on the local network.
52.Pp
53A certain amount of flexibility is built into the packet aliasing engine.
54In the simplest mode of operation, a many-to-one address mapping takes
55place between the local network and the packet aliasing host.
56This is known as IP masquerading.
57In addition, one-to-one mappings between local and public addresses can
58also be implemented, which is known as static NAT.
59In between these extremes, different groups of private addresses can be
60linked to different public addresses, comprising several distinct
61many-to-one mappings.
62Also, a given public address and port can be statically redirected to a
63private address/port.
64.Sh INITIALIZATION AND CONTROL
65One special function,
66.Fn LibAliasInit ,
67must always be called before any packet handling may be performed, and
68the returned instance pointer must be passed to all the other functions.
69Normally, the
70.Fn LibAliasSetAddress
71function is called afterwards, to set the default aliasing address.
72In addition, the operating mode of the packet aliasing engine can be
73customized by calling
74.Fn LibAliasSetMode .
75.Pp
76.Ft "struct libalias *"
77.Fn LibAliasInit "struct libalias *"
78.Bd -ragged -offset indent
79This function is used to initialize
80internal data structures.
81When called the first time, a
82.Dv NULL
83pointer should be passed as an argument.
84The following mode bits are always set after calling
85.Fn LibAliasInit .
86See the description of
87.Fn LibAliasSetMode
88below for the meaning of these mode bits.
89.Pp
90.Bl -item -offset indent -compact
91.It
92.Dv PKT_ALIAS_SAME_PORTS
93.It
94.Dv PKT_ALIAS_USE_SOCKETS
95.It
96.Dv PKT_ALIAS_RESET_ON_ADDR_CHANGE
97.El
98.Pp
99This function will always return the packet aliasing engine to the same
100initial state.
101The
102.Fn LibAliasSetAddress
103function is normally called afterwards, and any desired changes from the
104default mode bits listed above require a call to
105.Fn LibAliasSetMode .
106.Pp
107It is mandatory that this function be called at the beginning of a program
108prior to any packet handling.
109.Ed
110.Pp
111.Ft void
112.Fn LibAliasUninit "struct libalias *"
113.Bd -ragged -offset indent
114This function has no return value and is used to clear any
115resources attached to internal data structures.
116.Pp
117This function should be called when a program stops using the aliasing
118engine; amongst other things, it clears out any firewall holes.
119To provide backwards compatibility and extra security, it is added to
120the
121.Xr atexit 3
122chain by
123.Fn LibAliasInit .
124.Ed
125.Pp
126.Ft void
127.Fn LibAliasSetAddress "struct libalias *" "struct in_addr addr"
128.Bd -ragged -offset indent
129This function sets the source address to which outgoing packets from the
130local area network are aliased.
131All outgoing packets are re-mapped to this address unless overridden by a
132static address mapping established by
133.Fn LibAliasRedirectAddr .
134If this function has not been called, and no static rules match, an outgoing
135packet retains its source address.
136.Pp
137If the
138.Dv PKT_ALIAS_RESET_ON_ADDR_CHANGE
139mode bit is set (the default mode of operation), then the internal aliasing
140link tables will be reset any time the aliasing address changes.
141This is useful for interfaces such as
142.Xr ppp 8 ,
143where the IP
144address may or may not change on successive dial-up attempts.
145.Pp
146If the
147.Dv PKT_ALIAS_RESET_ON_ADDR_CHANGE
148mode bit is set to zero, this function can also be used to dynamically change
149the aliasing address on a packet-to-packet basis (it is a low overhead call).
150.Pp
151It is mandatory that this function be called prior to any packet handling.
152.Ed
153.Pp
154.Ft unsigned int
155.Fn LibAliasSetMode "struct libalias *" "unsigned int flags" "unsigned int mask"
156.Bd -ragged -offset indent
157This function sets or clears mode bits
158according to the value of
159.Fa flags .
160Only bits marked in
161.Fa mask
162are affected.
163The following mode bits are defined in
164.In alias.h :
165.Bl -tag -width indent
166.It Dv PKT_ALIAS_LOG
167Enables logging into
168.Pa /var/log/alias.log .
169Each time an aliasing link is created or deleted, the log file is appended to
170with the current number of ICMP, TCP and UDP links.
171Mainly useful for debugging when the log file is viewed continuously with
172.Xr tail 1 .
173.It Dv PKT_ALIAS_DENY_INCOMING
174If this mode bit is set, all incoming packets associated with new TCP
175connections or new UDP transactions will be marked for being ignored
176.Fn ( LibAliasIn
177returns
178.Dv PKT_ALIAS_IGNORED
179code)
180by the calling program.
181Response packets to connections or transactions initiated from the packet
182aliasing host or local network will be unaffected.
183This mode bit is useful for implementing a one-way firewall.
184.It Dv PKT_ALIAS_SAME_PORTS
185If this mode bit is set, the packet-aliasing engine will attempt to leave
186the alias port numbers unchanged from the actual local port numbers.
187This can be done as long as the quintuple (proto, alias addr, alias port,
188remote addr, remote port) is unique.
189If a conflict exists, a new aliasing port number is chosen even if this
190mode bit is set.
191.It Dv PKT_ALIAS_USE_SOCKETS
192This bit should be set when the packet aliasing host originates network
193traffic as well as forwards it.
194When the packet aliasing host is waiting for a connection from an unknown
195host address or unknown port number (e.g.\& an FTP data connection), this
196mode bit specifies that a socket be allocated as a place holder to prevent
197port conflicts.
198Once a connection is established, usually within a minute or so, the socket
199is closed.
200.It Dv PKT_ALIAS_UNREGISTERED_ONLY
201If this mode bit is set, traffic on the local network which does not
202originate from unregistered address spaces will be ignored.
203Standard Class A, B and C unregistered addresses are:
204.Pp
20510.0.0.0     ->  10.255.255.255   (Class A subnet)
206172.16.0.0   ->  172.31.255.255   (Class B subnets)
207192.168.0.0  ->  192.168.255.255  (Class C subnets)
208.Pp
209This option is useful in the case that the packet aliasing host has both
210registered and unregistered subnets on different interfaces.
211The registered subnet is fully accessible to the outside world, so traffic
212from it does not need to be passed through the packet aliasing engine.
213.It Dv PKT_ALIAS_RESET_ON_ADDR_CHANGE
214When this mode bit is set and
215.Fn LibAliasSetAddress
216is called to change the aliasing address, the internal link table of the
217packet aliasing engine will be cleared.
218This operating mode is useful for
219.Xr ppp 8
220links where the interface address can sometimes change or remain the same
221between dial-up attempts.
222If this mode bit is not set, the link table will never be reset in the event
223of an address change.
224.It Dv PKT_ALIAS_PUNCH_FW
225This option makes
226.Nm
227.Dq punch holes
228in an
229.Xr ipfirewall 4 -
230based firewall for FTP/IRC DCC connections.
231The holes punched are bound by from/to IP address and port; it will not be
232possible to use a hole for another connection.
233A hole is removed when the connection that uses it dies.
234To cater to unexpected death of a program using
235.Nm
236(e.g.\& kill -9),
237changing the state of the flag will clear the entire firewall range
238allocated for holes.
239This clearing will also happen on the initial call to
240.Fn LibAliasSetFWBase ,
241which must happen prior to setting this flag.
242.It Dv PKT_ALIAS_REVERSE
243This option makes
244.Nm
245reverse the way it handles incoming and outgoing packets, allowing it
246to be fed with data that passes through the internal interface rather
247than the external one.
248.It Dv PKT_ALIAS_PROXY_ONLY
249This option tells
250.Nm
251to obey transparent proxy rules only.
252Normal packet aliasing is not performed.
253See
254.Fn LibAliasProxyRule
255below for details.
256.It Dv PKT_ALIAS_SKIP_GLOBAL
257This option is used by
258.Pa ipfw_nat
259only.
260Specifying it as a flag to
261.Fn LibAliasSetMode
262has no effect.
263See section
264.Sx NETWORK ADDRESS TRANSLATION
265in
266.Xr ipfw 8
267for more details.
268.El
269.Ed
270.Pp
271.Ft void
272.Fn LibAliasSetFWBase "struct libalias *" "unsigned int base" "unsigned int num"
273.Bd -ragged -offset indent
274Set the firewall range allocated for punching firewall holes (with the
275.Dv PKT_ALIAS_PUNCH_FW
276flag).
277The range is cleared for all rules on initialization.
278.Ed
279.Pp
280.Ft void
281.Fn LibAliasSkinnyPort "struct libalias *" "unsigned int port"
282.Bd -ragged -offset indent
283Set the TCP port used by the Skinny Station protocol.
284Skinny is used by Cisco IP phones to communicate with
285Cisco Call Managers to set up voice over IP calls.
286If this is not set, Skinny aliasing will not be done.
287The typical port used by Skinny is 2000.
288.Ed
289.Sh PACKET HANDLING
290The packet handling functions are used to modify incoming (remote to local)
291and outgoing (local to remote) packets.
292The calling program is responsible for receiving and sending packets via
293network interfaces.
294.Pp
295Along with
296.Fn LibAliasInit
297and
298.Fn LibAliasSetAddress ,
299the two packet handling functions,
300.Fn LibAliasIn
301and
302.Fn LibAliasOut ,
303comprise the minimal set of functions needed for a basic IP masquerading
304implementation.
305.Pp
306.Ft int
307.Fn LibAliasIn "struct libalias *" "char *buffer" "int maxpacketsize"
308.Bd -ragged -offset indent
309An incoming packet coming from a remote machine to the local network is
310de-aliased by this function.
311The IP packet is pointed to by
312.Fa buffer ,
313and
314.Fa maxpacketsize
315indicates the size of the data structure containing the packet and should
316be at least as large as the actual packet size.
317.Pp
318Return codes:
319.Bl -tag -width indent
320.It Dv PKT_ALIAS_OK
321The packet aliasing process was successful.
322.It Dv PKT_ALIAS_IGNORED
323The packet was ignored and not de-aliased.
324This can happen if the protocol is unrecognized, as for an ICMP message
325type that is not handled, or if incoming packets for new connections are being
326ignored (if the
327.Dv PKT_ALIAS_DENY_INCOMING
328mode bit was set using
329.Fn LibAliasSetMode ) .
330.It Dv PKT_ALIAS_UNRESOLVED_FRAGMENT
331This is returned when a fragment cannot be resolved because the header
332fragment has not been sent yet.
333In this situation, fragments must be saved with
334.Fn LibAliasSaveFragment
335until a header fragment is found.
336.It Dv PKT_ALIAS_FOUND_HEADER_FRAGMENT
337The packet aliasing process was successful, and a header fragment was found.
338This is a signal to retrieve any unresolved fragments with
339.Fn LibAliasGetFragment
340and de-alias them with
341.Fn LibAliasFragmentIn .
342.It Dv PKT_ALIAS_ERROR
343An internal error within the packet aliasing engine occurred.
344.El
345.Ed
346.Pp
347.Ft int
348.Fn LibAliasOut "struct libalias *" "char *buffer" "int maxpacketsize"
349.Bd -ragged -offset indent
350An outgoing packet coming from the local network to a remote machine is
351aliased by this function.
352The IP packet is pointed to by
353.Fa buffer ,
354and
355.Fa maxpacketsize
356indicates the maximum packet size permissible should the packet length be
357changed.
358IP encoding protocols place address and port information in the encapsulated
359data stream which has to be modified and can account for changes in packet
360length.
361Well known examples of such protocols are FTP and IRC DCC.
362.Pp
363Return codes:
364.Bl -tag -width indent
365.It Dv PKT_ALIAS_OK
366The packet aliasing process was successful.
367.It Dv PKT_ALIAS_IGNORED
368The packet was ignored and not aliased.
369This can happen if the protocol is unrecognized, or possibly an ICMP message
370type is not handled.
371.It Dv PKT_ALIAS_ERROR
372An internal error within the packet aliasing engine occurred.
373.El
374.Ed
375.Sh PORT AND ADDRESS REDIRECTION
376The functions described in this section allow machines on the local network
377to be accessible in some degree to new incoming connections from the external
378network.
379Individual ports can be re-mapped or static network address translations can
380be designated.
381.Pp
382.Ft struct alias_link *
383.Fo LibAliasRedirectPort
384.Fa "struct libalias *"
385.Fa "struct in_addr local_addr"
386.Fa "u_short local_port"
387.Fa "struct in_addr remote_addr"
388.Fa "u_short remote_port"
389.Fa "struct in_addr alias_addr"
390.Fa "u_short alias_port"
391.Fa "u_char proto"
392.Fc
393.Bd -ragged -offset indent
394This function specifies that traffic from a given remote address/port to
395an alias address/port be redirected to a specified local address/port.
396The parameter
397.Fa proto
398can be either
399.Dv IPPROTO_TCP
400or
401.Dv IPPROTO_UDP ,
402as defined in
403.In netinet/in.h .
404.Pp
405If
406.Fa local_addr
407or
408.Fa alias_addr
409is zero, this indicates that the packet aliasing address as established
410by
411.Fn LibAliasSetAddress
412is to be used.
413Even if
414.Fn LibAliasSetAddress
415is called to change the address after
416.Fn LibAliasRedirectPort
417is called, a zero reference will track this change.
418.Pp
419If the link is further set up to operate with load sharing, then
420.Fa local_addr
421and
422.Fa local_port
423are ignored, and are selected dynamically from the server pool, as described in
424.Fn LibAliasAddServer
425below.
426.Pp
427If
428.Fa remote_addr
429is zero, this indicates to redirect packets from any remote address.
430Likewise, if
431.Fa remote_port
432is zero, this indicates to redirect packets originating from any remote
433port number.
434The remote port specification will almost always be zero, but non-zero
435remote addresses can sometimes be useful for firewalling.
436If two calls to
437.Fn LibAliasRedirectPort
438overlap in their address/port specifications, then the most recent call
439will have precedence.
440.Pp
441This function returns a pointer which can subsequently be used by
442.Fn LibAliasRedirectDelete .
443If
444.Dv NULL
445is returned, then the function call did not complete successfully.
446.Pp
447All port numbers should be in network address byte order, so it is necessary
448to use
449.Xr htons 3
450to convert these parameters from internally readable numbers to network byte
451order.
452Addresses are also in network byte order, which is implicit in the use of the
453.Fa struct in_addr
454data type.
455.Ed
456.Pp
457.Ft struct alias_link *
458.Fo LibAliasRedirectAddr
459.Fa "struct libalias *"
460.Fa "struct in_addr local_addr"
461.Fa "struct in_addr alias_addr"
462.Fc
463.Bd -ragged -offset indent
464This function designates that all incoming traffic to
465.Fa alias_addr
466be redirected to
467.Fa local_addr .
468Similarly, all outgoing traffic from
469.Fa local_addr
470is aliased to
471.Fa alias_addr .
472.Pp
473If
474.Fa local_addr
475or
476.Fa alias_addr
477is zero, this indicates that the packet aliasing address as established by
478.Fn LibAliasSetAddress
479is to be used.
480Even if
481.Fn LibAliasSetAddress
482is called to change the address after
483.Fn LibAliasRedirectAddr
484is called, a zero reference will track this change.
485.Pp
486If the link is further set up to operate with load sharing, then the
487.Fa local_addr
488argument is ignored, and is selected dynamically from the server pool,
489as described in
490.Fn LibAliasAddServer
491below.
492.Pp
493If subsequent calls to
494.Fn LibAliasRedirectAddr
495use the same aliasing address, all new incoming traffic to this aliasing
496address will be redirected to the local address made in the last function
497call.
498New traffic generated by any of the local machines, designated in the
499several function calls, will be aliased to the same address.
500Consider the following example:
501.Pp
502LibAliasRedirectAddr(la, inet_aton("192.168.0.2"),
503                        inet_aton("141.221.254.101"));
504LibAliasRedirectAddr(la, inet_aton("192.168.0.3"),
505                        inet_aton("141.221.254.101"));
506LibAliasRedirectAddr(la, inet_aton("192.168.0.4"),
507                        inet_aton("141.221.254.101"));
508.Pp
509Any outgoing connections such as
510.Xr telnet 1
511or
512.Xr ftp 1
513from 192.168.0.2, 192.168.0.3 and 192.168.0.4 will appear to come from
514141.221.254.101.
515Any incoming connections to 141.221.254.101 will be directed to 192.168.0.4.
516.Pp
517Any calls to
518.Fn LibAliasRedirectPort
519will have precedence over address mappings designated by
520.Fn LibAliasRedirectAddr .
521.Pp
522This function returns a pointer which can subsequently be used by
523.Fn LibAliasRedirectDelete .
524If
525.Dv NULL
526is returned, then the function call did not complete successfully.
527.Ed
528.Pp
529.Ft int
530.Fo LibAliasAddServer
531.Fa "struct libalias *"
532.Fa "struct alias_link *link"
533.Fa "struct in_addr addr"
534.Fa "u_short port"
535.Fc
536.Bd -ragged -offset indent
537This function sets the
538.Fa link
539up for Load Sharing using IP Network Address Translation (RFC 2391, LSNAT).
540LSNAT operates as follows.
541A client attempts to access a server by using the server virtual address.
542The LSNAT router transparently redirects the request to one of the hosts
543in the server pool, using a real-time load sharing algorithm.
544Multiple sessions may be initiated from the same client, and each session
545could be directed to a different host based on the load balance across server
546pool hosts when the sessions are initiated.
547If load sharing is desired for just a few specific services, the configuration
548on LSNAT could be defined to restrict load sharing to just the services
549desired.
550.Pp
551Currently, only the simplest selection algorithm is implemented, where a
552host is selected on a round-robin basis only, without regard to load on
553the host.
554.Pp
555First, the
556.Fa link
557is created by either
558.Fn LibAliasRedirectPort
559or
560.Fn LibAliasRedirectAddr .
561Then,
562.Fn LibAliasAddServer
563is called multiple times to add entries to the
564.Fa link Ns 's
565server pool.
566.Pp
567For links created with
568.Fn LibAliasRedirectAddr ,
569the
570.Fa port
571argument is ignored and could have any value, e.g.\& htons(~0).
572.Pp
573This function returns 0 on success, \-1 otherwise.
574.Ed
575.Pp
576.Ft int
577.Fn LibAliasRedirectDynamic "struct libalias *" "struct alias_link *link"
578.Bd -ragged -offset indent
579This function marks the specified static redirect rule entered by
580.Fn LibAliasRedirectPort
581as dynamic.
582This can be used to e.g.\& dynamically redirect a single TCP connection,
583after which the rule is removed.
584Only fully specified links can be made dynamic.
585(See the
586.Sx STATIC AND DYNAMIC LINKS
587and
588.Sx PARTIALLY SPECIFIED ALIASING LINKS
589sections below for a definition of static vs.\& dynamic,
590and partially vs.\& fully specified links.)
591.Pp
592This function returns 0 on success, \-1 otherwise.
593.Ed
594.Pp
595.Ft void
596.Fn LibAliasRedirectDelete "struct libalias *" "struct alias_link *link"
597.Bd -ragged -offset indent
598This function will delete a specific static redirect rule entered by
599.Fn LibAliasRedirectPort
600or
601.Fn LibAliasRedirectAddr .
602The parameter
603.Fa link
604is the pointer returned by either of the redirection functions.
605If an invalid pointer is passed to
606.Fn LibAliasRedirectDelete ,
607then a program crash or unpredictable operation could result, so
608care is needed when using this function.
609.Ed
610.Pp
611.Ft int
612.Fn LibAliasProxyRule "struct libalias *" "const char *cmd"
613.Bd -ragged -offset indent
614The passed
615.Fa cmd
616string consists of one or more pairs of words.
617The first word in each pair is a token and the second is the value that
618should be applied for that token.
619Tokens and their argument types are as follows:
620.Bl -tag -width indent
621.It Cm type encode_ip_hdr | encode_tcp_stream | no_encode
622In order to support transparent proxying, it is necessary to somehow
623pass the original address and port information into the new destination
624server.
625If
626.Cm encode_ip_hdr
627is specified, the original destination address and port are passed
628as an extra IP option.
629If
630.Cm encode_tcp_stream
631is specified, the original destination address and port are passed
632as the first piece of data in the TCP stream in the format
633.Dq Li DEST Ar IP port .
634.It Cm port Ar portnum
635Only packets with the destination port
636.Ar portnum
637are proxied.
638.It Cm server Ar host Ns Op : Ns Ar portnum
639This specifies the
640.Ar host
641and
642.Ar portnum
643that the data is to be redirected to.
644.Ar host
645must be an IP address rather than a DNS host name.
646If
647.Ar portnum
648is not specified, the destination port number is not changed.
649.Pp
650The
651.Ar server
652specification is mandatory unless the
653.Cm delete
654command is being used.
655.It Cm rule Ar index
656Normally, each call to
657.Fn LibAliasProxyRule
658inserts the next rule at the start of a linear list of rules.
659If an
660.Ar index
661is specified, the new rule will be checked after all rules with lower
662indices.
663Calls to
664.Fn LibAliasProxyRule
665that do not specify a rule are assigned rule 0.
666.It Cm delete Ar index
667This token and its argument MUST NOT be used with any other tokens.
668When used, all existing rules with the given
669.Ar index
670are deleted.
671.It Cm proto tcp | udp
672If specified, only packets of the given protocol type are matched.
673.It Cm src Ar IP Ns Op / Ns Ar bits
674If specified, only packets with a source address matching the given
675.Ar IP
676are matched.
677If
678.Ar bits
679is also specified, then the first
680.Ar bits
681bits of
682.Ar IP
683are taken as a network specification, and all IP addresses from that
684network will be matched.
685.It Cm dst Ar IP Ns Op / Ns Ar bits
686If specified, only packets with a destination address matching the given
687.Ar IP
688are matched.
689If
690.Ar bits
691is also specified, then the first
692.Ar bits
693bits of
694.Ar IP
695are taken as a network specification, and all IP addresses from that
696network will be matched.
697.El
698.Pp
699This function is usually used to redirect outgoing connections for
700internal machines that are not permitted certain types of internet
701access, or to restrict access to certain external machines.
702.Ed
703.Pp
704.Ft struct alias_link *
705.Fo LibAliasRedirectProto
706.Fa "struct libalias *"
707.Fa "struct in_addr local_addr"
708.Fa "struct in_addr remote_addr"
709.Fa "struct in_addr alias_addr"
710.Fa "u_char proto"
711.Fc
712.Bd -ragged -offset indent
713This function specifies that any IP packet with protocol number of
714.Fa proto
715from a given remote address to an alias address will be
716redirected to a specified local address.
717.Pp
718If
719.Fa local_addr
720or
721.Fa alias_addr
722is zero, this indicates that the packet aliasing address as established
723by
724.Fn LibAliasSetAddress
725is to be used.
726Even if
727.Fn LibAliasSetAddress
728is called to change the address after
729.Fn LibAliasRedirectProto
730is called, a zero reference will track this change.
731.Pp
732If
733.Fa remote_addr
734is zero, this indicates to redirect packets from any remote address.
735Non-zero remote addresses can sometimes be useful for firewalling.
736.Pp
737If two calls to
738.Fn LibAliasRedirectProto
739overlap in their address specifications, then the most recent call
740will have precedence.
741.Pp
742This function returns a pointer which can subsequently be used by
743.Fn LibAliasRedirectDelete .
744If
745.Dv NULL
746is returned, then the function call did not complete successfully.
747.Ed
748.Sh FRAGMENT HANDLING
749The functions in this section are used to deal with incoming fragments.
750.Pp
751Outgoing fragments are handled within
752.Fn LibAliasOut
753by changing the address according to any applicable mapping set by
754.Fn LibAliasRedirectAddr ,
755or the default aliasing address set by
756.Fn LibAliasSetAddress .
757.Pp
758Incoming fragments are handled in one of two ways.
759If the header of a fragmented IP packet has already been seen, then all
760subsequent fragments will be re-mapped in the same manner the header
761fragment was.
762Fragments which arrive before the header are saved and then retrieved
763once the header fragment has been resolved.
764.Pp
765.Ft int
766.Fn LibAliasSaveFragment "struct libalias *" "char *ptr"
767.Bd -ragged -offset indent
768When
769.Fn LibAliasIn
770returns
771.Dv PKT_ALIAS_UNRESOLVED_FRAGMENT ,
772this function can be used to save the pointer to the unresolved fragment.
773.Pp
774It is implicitly assumed that
775.Fa ptr
776points to a block of memory allocated by
777.Xr malloc 3 .
778If the fragment is never resolved, the packet aliasing engine will
779automatically free the memory after a timeout period.
780[Eventually this function should be modified so that a callback function
781for freeing memory is passed as an argument.]
782.Pp
783This function returns
784.Dv PKT_ALIAS_OK
785if it was successful and
786.Dv PKT_ALIAS_ERROR
787if there was an error.
788.Ed
789.Pp
790.Ft char *
791.Fn LibAliasGetFragment "struct libalias *" "char *buffer"
792.Bd -ragged -offset indent
793This function can be used to retrieve fragment pointers saved by
794.Fn LibAliasSaveFragment .
795The IP header fragment pointed to by
796.Fa buffer
797is the header fragment indicated when
798.Fn LibAliasIn
799returns
800.Dv PKT_ALIAS_FOUND_HEADER_FRAGMENT .
801Once a fragment pointer is retrieved, it becomes the calling program's
802responsibility to free the dynamically allocated memory for the fragment.
803.Pp
804The
805.Fn LibAliasGetFragment
806function can be called sequentially until there are no more fragments
807available, at which time it returns
808.Dv NULL .
809.Ed
810.Pp
811.Ft void
812.Fn LibAliasFragmentIn "struct libalias *" "char *header" "char *fragment"
813.Bd -ragged -offset indent
814When a fragment is retrieved with
815.Fn LibAliasGetFragment ,
816it can then be de-aliased with a call to
817.Fn LibAliasFragmentIn .
818The
819.Fa header
820argument is the pointer to a header fragment used as a template, and
821.Fa fragment
822is the pointer to the packet to be de-aliased.
823.Ed
824.Sh MISCELLANEOUS FUNCTIONS
825.Ft struct alias_link *
826.Fn AddLink "struct libalias *" "struct in_addr src_addr" "struct in_addr dst_addr" \
827"struct in_addr alias_addr" "u_short src_port" "u_short dst_port" \
828"int alias_param" "int link_type"
829.Bd -ragged -offset indent
830This function adds new state to the instance hash table.
831The dst_address and/or dst_port may be given as zero, which
832introduces some dynamic character into the link, since
833LibAliasSetAddress can change the address that is used.
834However, in the current implementation, such links can only be used
835for inbound (ext -> int) traffic.
836.Ed
837.Pp
838.Ft void
839.Fn LibAliasSetTarget "struct libalias *" "struct in_addr addr"
840.Bd -ragged -offset indent
841When an incoming packet not associated with any pre-existing aliasing link
842arrives at the host machine, it will be sent to the address indicated by a
843call to
844.Fn LibAliasSetTarget .
845.Pp
846If this function is called with an
847.Dv INADDR_NONE
848address argument, then all new incoming packets go to the address set by
849.Fn LibAliasSetAddress .
850.Pp
851If this function is not called, or is called with an
852.Dv INADDR_ANY
853address argument, then all new incoming packets go to the address specified
854in the packet.
855This allows external machines to talk directly to internal machines if they
856can route packets to the machine in question.
857.Ed
858.Pp
859.Ft int
860.Fn LibAliasCheckNewLink "struct libalias *"
861.Bd -ragged -offset indent
862This function returns a non-zero value when a new aliasing link is created.
863In circumstances where incoming traffic is being sequentially sent to
864different local servers, this function can be used to trigger when
865.Fn LibAliasSetTarget
866is called to change the default target address.
867.Ed
868.Pp
869.Ft u_short
870.Fn LibAliasInternetChecksum "struct libalias *" "u_short *buffer" "int nbytes"
871.Bd -ragged -offset indent
872This is a utility function that does not seem to be available elsewhere and
873is included as a convenience.
874It computes the internet checksum, which is used in both IP and
875protocol-specific headers (TCP, UDP, ICMP).
876.Pp
877The
878.Fa buffer
879argument points to the data block to be checksummed, and
880.Fa nbytes
881is the number of bytes.
882The 16-bit checksum field should be zeroed before computing the checksum.
883.Pp
884Checksums can also be verified by operating on a block of data including
885its checksum.
886If the checksum is valid,
887.Fn LibAliasInternetChecksum
888will return zero.
889.Ed
890.Pp
891.Ft int
892.Fn LibAliasUnaliasOut "struct libalias *" "char *buffer" "int maxpacketsize"
893.Bd -ragged -offset indent
894An outgoing packet, which has already been aliased,
895has its private address/port information restored by this function.
896The IP packet is pointed to by
897.Fa buffer ,
898and
899.Fa maxpacketsize
900is provided for error checking purposes.
901This function can be used if an already-aliased packet needs to have its
902original IP header restored for further processing (e.g.\& logging).
903.Ed
904.Sh CONCEPTUAL BACKGROUND
905This section is intended for those who are planning to modify the source
906code or want to create somewhat esoteric applications using the packet
907aliasing functions.
908.Pp
909The conceptual framework under which the packet aliasing engine operates
910is described here.
911Central to the discussion is the idea of an
912.Em aliasing link
913which describes the relationship for a given packet transaction between
914the local machine, aliased identity and remote machine.
915It is discussed how such links come into existence and are destroyed.
916.Ss ALIASING LINKS
917There is a notion of an
918.Em aliasing link ,
919which is a 7-tuple describing a specific translation:
920.Bd -literal -offset indent
921(local addr, local port, alias addr, alias port,
922 remote addr, remote port, protocol)
923.Ed
924.Pp
925Outgoing packets have the local address and port number replaced with the
926alias address and port number.
927Incoming packets undergo the reverse process.
928The packet aliasing engine attempts to match packets against an internal
929table of aliasing links to determine how to modify a given IP packet.
930Both the IP header and protocol dependent headers are modified as necessary.
931Aliasing links are created and deleted as necessary according to network
932traffic.
933.Pp
934Protocols can be TCP, UDP or even ICMP in certain circumstances.
935(Some types of ICMP packets can be aliased according to sequence or ID
936number which acts as an equivalent port number for identifying how
937individual packets should be handled.)
938.Pp
939Each aliasing link must have a unique combination of the following five
940quantities: alias address/port, remote address/port and protocol.
941This ensures that several machines on a local network can share the
942same aliasing IP address.
943In cases where conflicts might arise, the aliasing port is chosen so that
944uniqueness is maintained.
945.Ss STATIC AND DYNAMIC LINKS
946Aliasing links can either be static or dynamic.
947Static links persist indefinitely and represent fixed rules for translating
948IP packets.
949Dynamic links come into existence for a specific TCP connection or UDP
950transaction or ICMP ECHO sequence.
951For the case of TCP, the connection can be monitored to see when the
952associated aliasing link should be deleted.
953Aliasing links for UDP transactions (and ICMP ECHO and TIMESTAMP requests)
954work on a simple timeout rule.
955When no activity is observed on a dynamic link for a certain amount of time
956it is automatically deleted.
957Timeout rules also apply to TCP connections which do not open or close
958properly.
959.Ss PARTIALLY SPECIFIED ALIASING LINKS
960Aliasing links can be partially specified, meaning that the remote address
961and/or remote port are unknown.
962In this case, when a packet matching the incomplete specification is found,
963a fully specified dynamic link is created.
964If the original partially specified link is dynamic, it will be deleted
965after the fully specified link is created, otherwise it will persist.
966.Pp
967For instance, a partially specified link might be
968.Bd -literal -offset indent
969(192.168.0.4, 23, 204.228.203.215, 8066, 0, 0, tcp)
970.Ed
971.Pp
972The zeros denote unspecified components for the remote address and port.
973If this link were static it would have the effect of redirecting all
974incoming traffic from port 8066 of 204.228.203.215 to port 23 (telnet)
975of machine 192.168.0.4 on the local network.
976Each individual telnet connection would initiate the creation of a distinct
977dynamic link.
978.Ss DYNAMIC LINK CREATION
979In addition to aliasing links, there are also address mappings that can be
980stored within the internal data table of the packet aliasing mechanism.
981.Bd -literal -offset indent
982(local addr, alias addr)
983.Ed
984.Pp
985Address mappings are searched when creating new dynamic links.
986.Pp
987All outgoing packets from the local network automatically create a dynamic
988link if they do not match an already existing fully specified link.
989If an address mapping exists for the outgoing packet, this determines
990the alias address to be used.
991If no mapping exists, then a default address, usually the address of the
992packet aliasing host, is used.
993If necessary, this default address can be changed as often as each individual
994packet arrives.
995.Pp
996The aliasing port number is determined such that the new dynamic link does
997not conflict with any existing links.
998In the default operating mode, the packet aliasing engine attempts to set
999the aliasing port equal to the local port number.
1000If this results in a conflict, then port numbers are randomly chosen until
1001a unique aliasing link can be established.
1002In an alternate operating mode, the first choice of an aliasing port is also
1003random and unrelated to the local port number.
1004.Sh MODULAR ARCHITECTURE (AND Xr ipfw 4 Sh SUPPORT)
1005One of the latest improvements to
1006.Nm
1007was to make its support
1008for new protocols independent from the rest of the library, giving it
1009the ability to load/unload support for new protocols at run-time.
1010To achieve this feature, all the code for protocol handling was moved
1011to a series of modules outside of the main library.
1012These modules are compiled from the same sources but work in
1013different ways, depending on whether they are compiled to work inside a kernel
1014or as part of the userland library.
1015.Ss LIBALIAS MODULES IN KERNEL LAND
1016When compiled for the kernel,
1017.Nm
1018modules are plain KLDs recognizable with the
1019.Pa alias_
1020prefix.
1021.Pp
1022To add support for a new protocol, load the corresponding module.
1023For example:
1024.Pp
1025.Dl "kldload alias_ftp"
1026.Pp
1027When support for a protocol is no longer needed, its module can be unloaded:
1028.Pp
1029.Dl "kldunload alias_ftp"
1030.Ss LIBALIAS MODULES IN USERLAND
1031Due to the differences between kernel and userland (no KLD mechanism,
1032many different address spaces, etc.), we had to change a bit how to
1033handle module loading/tracking/unloading in userland.
1034.Pp
1035While compiled for a userland
1036.Nm ,
1037all the modules are plain libraries, residing in
1038.Pa /usr/lib ,
1039and recognizable with the
1040.Pa libalias_
1041prefix.
1042.Pp
1043There is a configuration file,
1044.Pa /etc/libalias.conf ,
1045with the following contents (by default):
1046.Bd -literal -offset indent
1047/usr/lib/libalias_cuseeme.so
1048/usr/lib/libalias_ftp.so
1049/usr/lib/libalias_irc.so
1050/usr/lib/libalias_nbt.so
1051/usr/lib/libalias_pptp.so
1052/usr/lib/libalias_skinny.so
1053/usr/lib/libalias_smedia.so
1054.Ed
1055.Pp
1056This file contains the paths to the modules that
1057.Nm
1058will load.
1059To load/unload a new module, just add its path to
1060.Pa libalias.conf
1061and call
1062.Fn LibAliasRefreshModules
1063from the program.
1064In case the application provides a
1065.Dv SIGHUP
1066signal handler, add a call to
1067.Fn LibAliasRefreshModules
1068inside the handler, and everytime you want to refresh the loaded modules,
1069send it the
1070.Dv SIGHUP
1071signal:
1072.Pp
1073.Dl "kill -HUP <process_pid>"
1074.Ss MODULAR ARCHITECURE: HOW IT WORKS
1075The modular architecture of
1076.Nm
1077works similar whether it is running inside the
1078kernel or in userland.
1079From
1080.Pa alias_mod.c :
1081.Bd -literal
1082/* Protocol and userland module handlers chains. */
1083LIST_HEAD(handler_chain, proto_handler) handler_chain ...
1084\&...
1085SLIST_HEAD(dll_chain, dll) dll_chain ...
1086.Ed
1087.Pp
1088.Va handler_chain
1089keeps track of all the protocol handlers loaded, while
1090.Va ddl_chain
1091tracks which userland modules are loaded.
1092.Pp
1093.Va handler_chain
1094is composed of
1095.Vt "struct proto_handler"
1096entries:
1097.Bd -literal
1098struct proto_handler {
1099	u_int pri;
1100	int16_t dir;
1101	uint8_t proto;
1102	int (*fingerprint)(struct libalias *la,
1103		 struct ip *pip, struct alias_data *ah);
1104	int (*protohandler)(struct libalias *la,
1105		 struct ip *pip, struct alias_data *ah);
1106	TAILQ_ENTRY(proto_handler) link;
1107};
1108.Ed
1109.Pp
1110where:
1111.Bl -inset
1112.It Va pri
1113is the priority assigned to a protocol handler; lower priority
1114is better.
1115.It Va dir
1116is the direction of packets: ingoing or outgoing.
1117.It Va proto
1118indicates to which protocol this packet belongs: IP, TCP or UDP.
1119.It Va fingerprint
1120points to the fingerprint function while protohandler points
1121to the protocol handler function.
1122.El
1123.Pp
1124The
1125.Va fingerprint
1126function has the dual role of checking if the
1127incoming packet is found, and if it belongs to any categories that this
1128module can handle.
1129.Pp
1130The
1131.Va protohandler
1132function actually manipulates
1133the packet to make
1134.Nm
1135correctly NAT it.
1136.Pp
1137When a packet enters
1138.Nm ,
1139if it meets a module hook,
1140.Va handler_chain
1141is searched to see if there is an handler that matches
1142this type of a packet (it checks protocol and direction of packet).
1143Then, if more than one handler is found, it starts with the module with
1144the lowest priority number: it calls the
1145.Va fingerprint
1146function and interprets the result.
1147.Pp
1148If the result value is equal to 0 then it calls the protocol handler
1149of this handler and returns.
1150Otherwise, it proceeds to the next eligible module until the
1151.Va handler_chain
1152is exhausted.
1153.Pp
1154Inside
1155.Nm ,
1156the module hook looks like this:
1157.Bd -literal -offset indent
1158struct alias_data ad = {
1159	lnk,
1160	&original_address,
1161	&alias_address,
1162	&alias_port,
1163	&ud->uh_sport,          /* original source port */
1164	&ud->uh_dport,		/* original dest port */
1165	256                     /* maxpacketsize */
1166};
1167
1168\&...
1169
1170/* walk out chain */
1171err = find_handler(IN, UDP, la, pip, &ad);
1172.Ed
1173.Pp
1174All data useful to a module are gathered together in an
1175.Vt alias_data
1176structure, then
1177.Fn find_handler
1178is called.
1179The
1180.Fn find_handler
1181function is responsible for walking the handler
1182chain; it receives as input parameters:
1183.Bl -tag -width indent
1184.It Fa IN
1185direction
1186.It Fa UDP
1187working protocol
1188.It Fa la
1189pointer to this instance of libalias
1190.It Fa pip
1191pointer to a
1192.Vt "struct ip"
1193.It Fa ad
1194pointer to
1195.Vt "struct alias_data"
1196(see above)
1197.El
1198.Pp
1199In this case,
1200.Fn find_handler
1201will search only for modules registered for
1202supporting INcoming UDP packets.
1203.Pp
1204As was mentioned earlier,
1205.Nm
1206in userland is a bit different, as
1207care must be taken in module handling as well (avoiding duplicate load of
1208modules, avoiding modules with same name, etc.) so
1209.Va dll_chain
1210was introduced.
1211.Pp
1212.Va dll_chain
1213contains a list of all userland
1214.Nm
1215modules loaded.
1216.Pp
1217When an application calls
1218.Fn LibAliasRefreshModules ,
1219.Nm
1220first unloads all the loaded modules, then reloads all the modules listed in
1221.Pa /etc/libalias.conf :
1222for every module loaded, a new entry is added to
1223.Va dll_chain .
1224.Pp
1225.Va dll_chain
1226is composed of
1227.Vt "struct dll"
1228entries:
1229.Bd -literal
1230struct dll {
1231	/* name of module */
1232	char            name[DLL_LEN];
1233	/*
1234	 * ptr to shared obj obtained through
1235	 * dlopen() - use this ptr to get access
1236	 * to any symbols from a loaded module
1237	 * via dlsym()
1238	 */
1239	void            *handle;
1240	struct dll      *next;
1241};
1242.Ed
1243.Bl -inset
1244.It Va name
1245is the name of the module.
1246.It Va handle
1247is a pointer to the module obtained through
1248.Xr dlopen 3 .
1249.El
1250Whenever a module is loaded in userland, an entry is added to
1251.Va dll_chain ,
1252then every protocol handler present in that module
1253is resolved and registered in
1254.Va handler_chain .
1255.Ss HOW TO WRITE A MODULE FOR LIBALIAS
1256There is a module (called
1257.Pa alias_dummy.[ch] )
1258in
1259.Nm
1260that can be used as a skeleton for future work.
1261Here we analyse some parts of that module.
1262From
1263.Pa alias_dummy.c :
1264.Bd -literal
1265struct proto_handler handlers[] = {
1266    {
1267	.pri = 666,
1268	.dir = IN|OUT,
1269	.proto = UDP|TCP,
1270	.fingerprint = fingerprint,
1271	.protohandler= protohandler,
1272    },
1273    { EOH }
1274};
1275.Ed
1276.Pp
1277The variable
1278.Va handlers
1279is the
1280.Dq "most important thing"
1281in a module
1282since it describes the handlers present and lets the outside world use
1283it in an opaque way.
1284.Pp
1285It must ALWAYS be present in every module, and it MUST retain
1286the name
1287.Va handlers ,
1288otherwise attempting to load a module in userland will fail and
1289complain about missing symbols: for more information about module
1290load/unload, please refer to
1291.Fn LibAliasRefreshModules ,
1292.Fn LibAliasLoadModule
1293and
1294.Fn LibAliasUnloadModule
1295in
1296.Pa alias.c .
1297.Pp
1298.Va handlers
1299contains all the
1300.Vt proto_handler
1301structures present in a module.
1302.Bd -literal
1303static int
1304mod_handler(module_t mod, int type, void *data)
1305{
1306	int error;
1307
1308	switch (type) {
1309	case MOD_LOAD:
1310		error = LibAliasAttachHandlers(handlers);
1311		break;
1312	case MOD_UNLOAD:
1313		error = LibAliasDetachHandlers(handlers);
1314		break;
1315	default:
1316		error = EINVAL;
1317	}
1318	return (error);
1319}
1320.Ed
1321When running as KLD,
1322.Fn mod_handler
1323registers/deregisters the module using
1324.Fn LibAliasAttachHandlers
1325and
1326.Fn LibAliasDetachHandlers ,
1327respectively.
1328.Pp
1329Every module must contain at least 2 functions: one fingerprint
1330function and a protocol handler function.
1331.Bd -literal
1332#ifdef _KERNEL
1333static
1334#endif
1335int
1336fingerprint(struct libalias *la, struct ip *pip, struct alias_data *ah)
1337{
1338
1339\&...
1340}
1341
1342#ifdef _KERNEL
1343static
1344#endif
1345int
1346protohandler(struct libalias *la, struct ip *pip,
1347             struct alias_data *ah)
1348{
1349
1350\&...
1351}
1352.Ed
1353and they must accept exactly these input parameters.
1354.Ss PATCHING AN APPLICATION FOR USERLAND LIBALIAS MODULES
1355To add module support into an application that uses
1356.Nm ,
1357the following simple steps can be followed.
1358.Bl -enum
1359.It
1360Find the main file of an application
1361(let us call it
1362.Pa main.c ) .
1363.It
1364Add this to the header section of
1365.Pa main.c ,
1366if not already present:
1367.Pp
1368.Dl "#include <signal.h>"
1369.Pp
1370and this just after the header section:
1371.Pp
1372.Dl "static void signal_handler(int);"
1373.It
1374Add the following line to the init function of an application or,
1375if it does not have any init function, put it in
1376.Fn main :
1377.Pp
1378.Dl "signal(SIGHUP, signal_handler);"
1379.Pp
1380and place the
1381.Fn signal_handler
1382function somewhere in
1383.Pa main.c :
1384.Bd -literal -offset indent
1385static void
1386signal_handler(int sig)
1387{
1388
1389	LibAliasRefreshModules();
1390}
1391.Ed
1392.Pp
1393Otherwise, if an application already traps the
1394.Dv SIGHUP
1395signal, just add a call to
1396.Fn LibAliasRefreshModules
1397in the signal handler function.
1398.El
1399For example, to patch
1400.Xr natd 8
1401to use
1402.Nm
1403modules, just add the following line to
1404.Fn RefreshAddr "int sig __unused" :
1405.Pp
1406.Dl "LibAliasRefreshModules()"
1407.Pp
1408recompile and you are done.
1409.Ss LOGGING SUPPORT IN KERNEL LAND
1410When working as KLD,
1411.Nm
1412now has log support that
1413happens on a buffer allocated inside
1414.Vt "struct libalias"
1415(from
1416.Pa alias_local.h ) :
1417.Bd -literal
1418struct libalias {
1419       ...
1420
1421	/* log descriptor        */
1422#ifdef	KERNEL_LOG
1423	char           *logDesc;        /*
1424					 * ptr to an auto-malloced
1425					 * memory buffer when libalias
1426					 * works as kld
1427					 */
1428#else
1429	FILE           *logDesc;	/*
1430					 * ptr to /var/log/alias.log
1431					 * when libalias runs as a
1432					 * userland lib
1433					 */
1434#endif
1435
1436	...
1437}
1438.Ed
1439so all applications using
1440.Nm
1441will be able to handle their
1442own logs, if they want, accessing
1443.Va logDesc .
1444Moreover, every change to a log buffer is automatically added to
1445.Xr syslog 3
1446with the
1447.Dv LOG_SECURITY
1448facility and the
1449.Dv LOG_INFO
1450level.
1451.Sh AUTHORS
1452.An Charles Mott Aq cm@linktel.net ,
1453versions 1.0 - 1.8, 2.0 - 2.4.
1454.An Eivind Eklund Aq eivind@FreeBSD.org ,
1455versions 1.8b, 1.9 and 2.5.
1456Added IRC DCC support as well as contributing a number of architectural
1457improvements; added the firewall bypass for FTP/IRC DCC.
1458.An Erik Salander Aq erik@whistle.com
1459added support for PPTP and RTSP.
1460.An Junichi Satoh Aq junichi@junichi.org
1461added support for RTSP/PNA.
1462.An Ruslan Ermilov Aq ru@FreeBSD.org
1463added support for PPTP and LSNAT as well as general hacking.
1464.An Gleb Smirnoff Aq glebius@FreeBSD.org
1465ported the library to kernel space.
1466.An Paolo Pisati Aq piso@FreeBSD.org
1467made the library modular, moving support for all
1468protocols (except for IP, TCP and UDP) to external modules.
1469.Sh ACKNOWLEDGEMENTS
1470Listed below, in approximate chronological order, are individuals who
1471have provided valuable comments and/or debugging assistance.
1472.Bd -ragged -offset indent
1473.An -split
1474.An Gary Roberts
1475.An Tom Torrance
1476.An Reto Burkhalter
1477.An Martin Renters
1478.An Brian Somers
1479.An Paul Traina
1480.An Ari Suutari
1481.An Dave Remien
1482.An J. Fortes
1483.An Andrzej Bialecki
1484.An Gordon Burditt
1485.Ed
1486