10 files changed, 540 insertions, 194 deletions

diff --git a/lib/libalias/HISTORY b/lib/libalias/HISTORY
index 3d97fd0803b1..575d1b4aa13d 100644
--- a/lib/libalias/HISTORY
+++ b/lib/libalias/HISTORY
@@ -127,3 +127,8 @@ Version 2.5: December, 1997 (ee)
 
 Version 2.6: May, 1998 (amurai)
     - Added supporting routine for NetBios over TCP/IP.
+
+Version 3.0: January 1, 1999
+    - Transparent proxying support added.
+    - PPTP redirecting support added based on patches
+      contributed by Dru Nelson <dnelson@redwoodsoft.com>.
diff --git a/lib/libalias/Makefile b/lib/libalias/Makefile
index 665d14e10b3d..85e8ddfdb1e7 100644
--- a/lib/libalias/Makefile
+++ b/lib/libalias/Makefile
@@ -1,11 +1,11 @@
-#	$Id$
+#	$Id: Makefile,v 1.10 1999/02/27 02:16:01 brian Exp $
 
 LIB=		alias
-SHLIB_MAJOR=	2
-SHLIB_MINOR=	5
+SHLIB_MAJOR=	3
+SHLIB_MINOR=	0
 CFLAGS+=	-Wall -I${.CURDIR}
 SRCS=		alias.c alias_cuseeme.c alias_db.c alias_ftp.c alias_irc.c \
-		alias_nbt.c alias_old.c alias_util.c
+		alias_nbt.c alias_proxy.c alias_util.c
 MAN3=		libalias.3 
 
 beforeinstall:
diff --git a/lib/libalias/alias.c b/lib/libalias/alias.c
index 2384b46de74c..10e0ccc31643 100644
--- a/lib/libalias/alias.c
+++ b/lib/libalias/alias.c
@@ -93,6 +93,10 @@
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 
+#ifndef IPPROTO_GRE
+#define IPPROTO_GRE 47
+#endif
+
 #include "alias_local.h"
 #include "alias.h"
 
@@ -103,38 +107,13 @@
 #define IRC_CONTROL_PORT_NUMBER_2 6668
 #define CUSEEME_PORT_NUMBER 7648
 
-/*
-   The following macro is used to update an
-   internet checksum.  "delta" is a 32-bit
-   accumulation of all the changes to the
-   checksum (adding in new 16-bit words and
-   subtracting out old words), and "cksum"
-   is the checksum value to be updated.
-*/
-#define ADJUST_CHECKSUM(acc, cksum) { \
-    acc += cksum; \
-    if (acc < 0) \
-    { \
-        acc = -acc; \
-        acc = (acc >> 16) + (acc & 0xffff); \
-        acc += acc >> 16; \
-        cksum = (u_short) ~acc; \
-    } \
-    else \
-    { \
-        acc = (acc >> 16) + (acc & 0xffff); \
-        acc += acc >> 16; \
-        cksum = (u_short) acc; \
-    } \
-}
-
 
 
 
 /* TCP Handling Routines
 
     TcpMonitorIn()  -- These routines monitor TCP connections, and
-    TcpMonitorOut() -- delete a link node when a connection is closed.
+    TcpMonitorOut()    delete a link when a connection is closed.
 
 These routines look for SYN, ACK and RST flags to determine when TCP
 connections open and close.  When a TCP connection closes, the data
@@ -405,7 +384,6 @@ fragment contained in ICMP data section */
     return(PKT_ALIAS_IGNORED);
 }
 
-
 static int
 IcmpAliasIn3(struct ip *pip)
 {
@@ -428,6 +406,10 @@ IcmpAliasIn(struct ip *pip)
     int iresult;
     struct icmp *ic;
 
+/* Return if proxy-only mode is enabled */
+    if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
+        return PKT_ALIAS_OK;
+
     ic = (struct icmp *) ((char *) pip + (pip->ip_hl << 2));
 
     iresult = PKT_ALIAS_IGNORED;
@@ -562,6 +544,10 @@ IcmpAliasOut(struct ip *pip)
     int iresult;
     struct icmp *ic;
 
+/* Return if proxy-only mode is enabled */
+    if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
+        return PKT_ALIAS_OK;
+
     ic = (struct icmp *) ((char *) pip + (pip->ip_hl << 2));
 
     iresult = PKT_ALIAS_IGNORED;
@@ -587,12 +573,73 @@ IcmpAliasOut(struct ip *pip)
     return(iresult);
 }
 
+
+
+static int
+PptpAliasIn(struct ip *pip)
+{
+/*
+  Handle incoming PPTP packets. The
+  only thing which is done in this case is to alias
+  the dest IP address of the packet to our inside
+  machine.
+*/
+    struct in_addr alias_addr;
+
+    if (!GetPptpAlias (&alias_addr))
+	return PKT_ALIAS_IGNORED;
+
+    if (pip->ip_src.s_addr != alias_addr.s_addr) {
+
+	    DifferentialChecksum(&pip->ip_sum,
+				 (u_short *) &alias_addr,
+				 (u_short *) &pip->ip_dst,
+				 2);
+	    pip->ip_dst = alias_addr;
+    }
+
+    return PKT_ALIAS_OK;
+}
+
+
+static int
+PptpAliasOut(struct ip *pip)
+{
+/*
+  Handle outgoing PPTP packets. The
+  only thing which is done in this case is to alias
+  the source IP address of the packet.
+*/
+    struct in_addr alias_addr;
+
+    if (!GetPptpAlias (&alias_addr))
+	return PKT_ALIAS_IGNORED;
+
+    if (pip->ip_src.s_addr == alias_addr.s_addr) {
+
+	    alias_addr = FindAliasAddress(pip->ip_src);
+	    DifferentialChecksum(&pip->ip_sum,
+				 (u_short *) &alias_addr,
+				 (u_short *) &pip->ip_src,
+				 2);
+	    pip->ip_src = alias_addr;
+    }
+
+    return PKT_ALIAS_OK;
+}
+
+
+
 static int
 UdpAliasIn(struct ip *pip)
 {
     struct udphdr *ud;
     struct alias_link *link;
 
+/* Return if proxy-only mode is enabled */
+    if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
+        return PKT_ALIAS_OK;
+
     ud = (struct udphdr *) ((char *) pip + (pip->ip_hl << 2));
 
     link = FindUdpTcpIn(pip->ip_src, pip->ip_dst,
@@ -669,6 +716,10 @@ UdpAliasOut(struct ip *pip)
     struct udphdr *ud;
     struct alias_link *link;
 
+/* Return if proxy-only mode is enabled */
+    if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
+        return PKT_ALIAS_OK;
+
     ud = (struct udphdr *) ((char *) pip + (pip->ip_hl << 2));
 
     link = FindUdpTcpOut(pip->ip_src, pip->ip_dst,
@@ -750,14 +801,18 @@ TcpAliasIn(struct ip *pip)
     {
         struct in_addr alias_address;
         struct in_addr original_address;
+        struct in_addr proxy_address;
         u_short alias_port;
+        u_short proxy_port;
         int accumulate;
         u_short *sptr;
 
         alias_address = GetAliasAddress(link);
         original_address = GetOriginalAddress(link);
+        proxy_address = GetProxyAddress(link);
         alias_port = tc->th_dport;
         tc->th_dport = GetOriginalPort(link);
+        proxy_port = GetProxyPort(link);
 
 /* Adjust TCP checksum since destination port is being unaliased */
 /* and destination port is being altered.                        */
@@ -770,6 +825,22 @@ TcpAliasIn(struct ip *pip)
         accumulate -= *sptr++;
         accumulate -= *sptr;
 
+/* If this is a proxy, then modify the tcp source port  and
+   checksum accumulation */
+        if (proxy_port != 0)
+        {
+            accumulate += tc->th_sport;
+            tc->th_sport = proxy_port;
+            accumulate -= tc->th_sport;
+
+            sptr = (u_short *) &pip->ip_src;
+            accumulate += *sptr++;
+            accumulate += *sptr;
+            sptr = (u_short *) &proxy_address;
+            accumulate -= *sptr++;
+            accumulate -= *sptr;
+        }
+
 /* See if ack number needs to be modified */
         if (GetAckModified(link) == 1)
         {
@@ -791,11 +862,28 @@ TcpAliasIn(struct ip *pip)
         ADJUST_CHECKSUM(accumulate, tc->th_sum);
 
 /* Restore original IP address */
-        DifferentialChecksum(&pip->ip_sum,
-                             (u_short *) &original_address,
-                             (u_short *) &pip->ip_dst,
-                             2);
+        sptr = (u_short *) &pip->ip_dst;
+        accumulate  = *sptr++;
+        accumulate += *sptr;
         pip->ip_dst = original_address;
+        sptr = (u_short *) &pip->ip_dst;
+        accumulate -= *sptr++;
+        accumulate -= *sptr;
+
+/* If this is a transparent proxy packet, then modify the source
+   address */
+        if (proxy_address.s_addr != 0)
+        {
+            sptr = (u_short *) &pip->ip_src;
+            accumulate += *sptr++;
+            accumulate += *sptr;
+            pip->ip_src = proxy_address;
+            sptr = (u_short *) &pip->ip_src;
+            accumulate -= *sptr++;
+            accumulate -= *sptr;
+        }
+
+        ADJUST_CHECKSUM(accumulate, pip->ip_sum);
 
 /* Monitor TCP connection state */
         TcpMonitorIn(pip, link);
@@ -808,39 +896,94 @@ TcpAliasIn(struct ip *pip)
 static int
 TcpAliasOut(struct ip *pip, int maxpacketsize)
 {
+    int proxy_type;
+    u_short dest_port;
+    u_short proxy_server_port;
+    struct in_addr dest_address;
+    struct in_addr proxy_server_address;
     struct tcphdr *tc;
     struct alias_link *link;
 
     tc = (struct tcphdr *) ((char *) pip + (pip->ip_hl << 2));
 
+    proxy_type = ProxyCheck(pip, &proxy_server_address, &proxy_server_port);
+
+    if (proxy_type == 0 && (packetAliasMode & PKT_ALIAS_PROXY_ONLY))
+        return PKT_ALIAS_OK;
+
+/* If this is a transparent proxy, save original destination,
+   then alter the destination and adust checksums */
+    dest_port = tc->th_dport;
+    dest_address = pip->ip_dst;
+    if (proxy_type != 0)
+    {
+        int accumulate;
+        u_short *sptr;
+
+        accumulate = tc->th_dport;
+        tc->th_dport = proxy_server_port;
+        accumulate -= tc->th_dport;
+
+        sptr = (u_short *) &(pip->ip_dst);
+        accumulate += *sptr++;
+        accumulate += *sptr;
+        sptr = (u_short *) &proxy_server_address;
+        accumulate -= *sptr++;
+        accumulate -= *sptr;
+
+        ADJUST_CHECKSUM(accumulate, tc->th_sum);
+
+        sptr = (u_short *) &(pip->ip_dst);
+        accumulate  = *sptr++;
+        accumulate += *sptr;
+        pip->ip_dst = proxy_server_address;
+        sptr = (u_short *) &(pip->ip_dst);
+        accumulate -= *sptr++;
+        accumulate -= *sptr;
+
+        ADJUST_CHECKSUM(accumulate, pip->ip_sum);
+    }
+
     link = FindUdpTcpOut(pip->ip_src, pip->ip_dst,
                          tc->th_sport, tc->th_dport,
                          IPPROTO_TCP);
     if (link !=NULL)
     {
-        struct in_addr alias_address;
         u_short alias_port;
+        struct in_addr alias_address;
         int accumulate;
         u_short *sptr;
 
+/* Save original destination address, if this is a proxy packet.
+   Also modify packet to include destination encoding. */
+        if (proxy_type != 0)
+        {
+            SetProxyPort(link, dest_port);
+            SetProxyAddress(link, dest_address);
+            ProxyModify(link, pip, maxpacketsize, proxy_type);
+        }
+
+/* Get alias address and port */
         alias_port = GetAliasPort(link);
         alias_address = GetAliasAddress(link);
 
 /* Monitor tcp connection state */
         TcpMonitorOut(pip, link);
 
-/* Special processing for ftp connection */
+/* Special processing for IP encoding protocols */
         if (ntohs(tc->th_dport) == FTP_CONTROL_PORT_NUMBER
          || ntohs(tc->th_sport) == FTP_CONTROL_PORT_NUMBER)
             AliasHandleFtpOut(pip, link, maxpacketsize);
         if (ntohs(tc->th_dport) == IRC_CONTROL_PORT_NUMBER_1
-                        || ntohs(tc->th_dport) == IRC_CONTROL_PORT_NUMBER_2)
+         || ntohs(tc->th_dport) == IRC_CONTROL_PORT_NUMBER_2)
             AliasHandleIrcOut(pip, link, maxpacketsize);
 
 /* Adjust TCP checksum since source port is being aliased */
 /* and source address is being altered                    */
         accumulate  = tc->th_sport;
-        accumulate -= alias_port;
+        tc->th_sport = alias_port;
+        accumulate -= tc->th_sport;
+
         sptr = (u_short *) &(pip->ip_src);
         accumulate += *sptr++;
         accumulate += *sptr;
@@ -868,15 +1011,16 @@ TcpAliasOut(struct ip *pip, int maxpacketsize)
 
         ADJUST_CHECKSUM(accumulate, tc->th_sum)
 
-/* Put alias address in TCP header */
-        tc->th_sport = alias_port;
-
 /* Change source address */
-        DifferentialChecksum(&pip->ip_sum,
-                             (u_short *) &alias_address,
-                             (u_short *) &pip->ip_src,
-                             2);
+        sptr = (u_short *) &(pip->ip_src);
+        accumulate  = *sptr++;
+        accumulate += *sptr;
         pip->ip_src = alias_address;
+        sptr = (u_short *) &(pip->ip_src);
+        accumulate -= *sptr++;
+        accumulate -= *sptr;
+
+        ADJUST_CHECKSUM(accumulate, pip->ip_sum)
 
         return(PKT_ALIAS_OK);
     }
@@ -1030,6 +1174,9 @@ PacketAliasIn(char *ptr, int maxpacketsize)
     struct ip *pip;
     int iresult;
 
+    if (packetAliasMode & PKT_ALIAS_REVERSE)
+        return PacketAliasOut(ptr, maxpacketsize);
+
     HouseKeeping();
     ClearCheckNewLink();
     pip = (struct ip *) ptr;
@@ -1054,6 +1201,9 @@ PacketAliasIn(char *ptr, int maxpacketsize)
             case IPPROTO_TCP:
                 iresult = TcpAliasIn(pip);
                 break;
+            case IPPROTO_GRE:
+		iresult = PptpAliasIn(pip);
+                break;
         }
 
         if (ntohs(pip->ip_off) & IP_MF)
@@ -1096,8 +1246,6 @@ PacketAliasIn(char *ptr, int maxpacketsize)
 #define UNREG_ADDR_C_LOWER 0xc0a80000
 #define UNREG_ADDR_C_UPPER 0xc0a8ffff
 
-
-
 int
 PacketAliasOut(char *ptr,           /* valid IP packet */
                int  maxpacketsize   /* How much the packet data may grow
@@ -1108,6 +1256,9 @@ PacketAliasOut(char *ptr,           /* valid IP packet */
     struct in_addr addr_save;
     struct ip *pip;
 
+    if (packetAliasMode & PKT_ALIAS_REVERSE)
+        return PacketAliasIn(ptr, maxpacketsize);
+
     HouseKeeping();
     ClearCheckNewLink();
     pip = (struct ip *) ptr;
@@ -1152,6 +1303,9 @@ PacketAliasOut(char *ptr,           /* valid IP packet */
             case IPPROTO_TCP:
                 iresult = TcpAliasOut(pip, maxpacketsize);
                 break;
+            case IPPROTO_GRE:
+		iresult = PptpAliasOut(pip);
+                break;
         }
     }
     else
diff --git a/lib/libalias/alias.h b/lib/libalias/alias.h
index 010db9885a5a..de4f66e8845d 100644
--- a/lib/libalias/alias.h
+++ b/lib/libalias/alias.h
@@ -7,7 +7,7 @@
     This software is placed into the public domain with no restrictions
     on its distribution.
 
-    $Id: alias.h,v 1.7 1998/01/16 12:56:07 bde Exp $
+    $Id: alias.h,v 1.9 1999/02/27 02:16:01 brian Exp $
 */
 
 
@@ -55,6 +55,10 @@ struct alias_link;
                             struct in_addr, u_short,
                             u_char);
 
+    extern int
+    PacketAliasPptp(struct in_addr);
+
+
     extern struct alias_link *
     PacketAliasRedirectAddr(struct in_addr,
                             struct in_addr);
@@ -82,28 +86,10 @@ struct alias_link;
     extern u_short
     PacketAliasInternetChecksum(u_short *, int);
 
+/* Transparent Proxying */
+    extern int
+    PacketAliasProxyRule(char *);
 
-/*
-   In version 2.2, the function names were rationalized
-   to all be of the form PacketAlias...  These are the
-   old function names for backwards compatibility
-*/
-extern int SaveFragmentPtr(char *);
-extern char *GetNextFragmentPtr(char *);
-extern void FragmentAliasIn(char *, char *);
-extern void SetPacketAliasAddress(struct in_addr);
-extern void InitPacketAlias(void);
-extern unsigned int SetPacketAliasMode(unsigned int, unsigned int);
-extern int PacketAliasIn2(char *, struct in_addr, int maxpacketsize);
-extern int PacketAliasOut2(char *, struct in_addr, int maxpacketsize);
-extern int
-PacketAliasPermanentLink(struct in_addr, u_short, 
-                         struct in_addr, u_short,
-                         u_short, u_char);
-extern u_short InternetChecksum(u_short *, int);
-
-/* Obsolete constant */
-#define PKT_ALIAS_NEW_LINK 5
 
 /********************** Mode flags ********************/
 /* Set these flags using SetPacketAliasMode() */
@@ -138,7 +124,6 @@ extern u_short InternetChecksum(u_short *, int);
 	unregistered source addresses will be aliased (along with those
 	of the ppp host maching itself.  Private addresses are those
         in the following ranges:
-
 		10.0.0.0     ->   10.255.255.255
 		172.16.0.0   ->   172.31.255.255
 		192.168.0.0  ->   192.168.255.255  */
@@ -162,6 +147,14 @@ extern u_short InternetChecksum(u_short *, int);
 #define PKT_ALIAS_PUNCH_FW 0x40
 #endif
 
+/* If PKT_ALIAS_PROXY_ONLY is set, then NAT will be disabled and only
+      transparent proxying performed */
+#define PKT_ALIAS_PROXY_ONLY 0x40
+
+/* If PKT_ALIAS_REVERSE is set, the actions of PacketAliasIn()
+      and PacketAliasOut() are reversed */
+#define PKT_ALIAS_REVERSE 0x80
+
 /* Return Codes */
 #define PKT_ALIAS_ERROR -1
 #define PKT_ALIAS_OK 1
diff --git a/lib/libalias/alias_db.c b/lib/libalias/alias_db.c
index dc9d020bd858..d01188e9cd61 100644
--- a/lib/libalias/alias_db.c
+++ b/lib/libalias/alias_db.c
@@ -56,12 +56,12 @@
         Added ability to create an alias port without
         either destination address or port specified.
         port type = ALIAS_PORT_UNKNOWN_DEST_ALL (ee)
- 
+
         Removed K&R style function headers
         and general cleanup. (ee)
 
         Added packetAliasMode to replace compiler #defines's (ee)
- 
+
         Allocates sockets for partially specified
         ports if ALIAS_USE_SOCKETS defined. (cjm)
 
@@ -73,10 +73,10 @@
         links.  (J. Fortes suggested the need for this.)
         Examples:
 
-        (192.168.0.1, port 23)  <-> alias port 6002, unknown dest addr/port 
+        (192.168.0.1, port 23)  <-> alias port 6002, unknown dest addr/port
 
         (192.168.0.2, port 21)  <-> alias port 3604, known dest addr
-                                                     unknown dest port 
+                                                     unknown dest port
 
         These permament links allow for incoming connections to
         machines on the local network.  They can be given with a
@@ -111,7 +111,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <unistd.h>
- 
+
 #include <sys/errno.h>
 #include <sys/socket.h>
 #include <sys/time.h>
@@ -139,7 +139,7 @@
 #define LINK_TABLE_IN_SIZE         4001
 
 /* Parameters used for cleanup of expired links */
-#define ALIAS_CLEANUP_INTERVAL_SECS  60       
+#define ALIAS_CLEANUP_INTERVAL_SECS  60
 #define ALIAS_CLEANUP_MAX_SPOKES     30
 
 /* Timouts (in seconds) for different link types) */
@@ -174,14 +174,14 @@
 
 /* Dummy port number codes used for FindLinkIn/Out() and AddLink().
    These constants can be anything except zero, which indicates an
-   unknown port numbea. */
+   unknown port number. */
 
 #define NO_DEST_PORT     1
 #define NO_SRC_PORT      1
 
 
 
-/* Data Structures 
+/* Data Structures
 
     The fundamental data structure used in this program is
     "struct alias_link".  Whenever a TCP connection is made,
@@ -237,11 +237,13 @@ struct tcp_dat
 struct alias_link                /* Main data structure */
 {
     struct in_addr src_addr;     /* Address and port information        */
-    struct in_addr dst_addr;     /*  .                                  */
-    struct in_addr alias_addr;   /*  .                                  */
-    u_short src_port;            /*  .                                  */
-    u_short dst_port;            /*  .                                  */
-    u_short alias_port;          /*  .                                  */
+    struct in_addr dst_addr;
+    struct in_addr alias_addr;
+    struct in_addr proxy_addr;
+    u_short src_port;
+    u_short dst_port;
+    u_short alias_port;
+    u_short proxy_port;
 
     int link_type;               /* Type of link: tcp, udp, icmp, frag  */
 
@@ -348,6 +350,12 @@ static int fireWallFD = -1;          /* File descriptor to be able to   */
                                      /* flag.                           */
 #endif
 
+static int pptpAliasFlag; 	     /* Indicates if PPTP aliasing is   */
+                                     /* on or off                       */
+static struct in_addr pptpAliasAddr; /* Address of source of PPTP 	*/
+                                     /* packets.           		*/
+
+
 
 
 
@@ -571,8 +579,10 @@ GetNewPort(struct alias_link *link, int alias_port_param)
     }
     else
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/GetNewPort(): ");
         fprintf(stderr, "input parameter error\n");
+#endif
         return(-1);
     }
 
@@ -618,8 +628,10 @@ GetNewPort(struct alias_link *link, int alias_port_param)
         port_net = htons(port_sys);
     }
 
+#ifdef DEBUG
     fprintf(stderr, "PacketAlias/GetnewPort(): ");
     fprintf(stderr, "could not find free port\n");
+#endif
 
     return(-1);
 }
@@ -638,15 +650,19 @@ GetSocket(u_short port_net, int *sockfd, int link_type)
         sock = socket(AF_INET, SOCK_DGRAM, 0);
     else
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/GetSocket(): ");
         fprintf(stderr, "incorrect link type\n");
+#endif
         return(0);
     }
 
     if (sock < 0)
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/GetSocket(): ");
         fprintf(stderr, "socket() error %d\n", *sockfd);
+#endif
         return(0);
     }
 
@@ -853,15 +869,17 @@ AddLink(struct in_addr  src_addr,
             alias_addr.s_addr = 0;
 
     /* Basic initialization */
-        link->src_addr    = src_addr;
-        link->dst_addr    = dst_addr;
-        link->src_port    = src_port;
-        link->alias_addr  = alias_addr;
-        link->dst_port    = dst_port;
-        link->link_type   = link_type;
-        link->sockfd      = -1;
-        link->flags       = 0;
-        link->timestamp   = timeStamp;
+        link->src_addr          = src_addr;
+        link->dst_addr          = dst_addr;
+        link->alias_addr        = alias_addr;
+        link->proxy_addr.s_addr = 0;
+        link->src_port          = src_port;
+        link->dst_port          = dst_port;
+        link->proxy_port        = 0;
+        link->link_type         = link_type;
+        link->sockfd            = -1;
+        link->flags             = 0;
+        link->timestamp         = timeStamp;
 
     /* Expiration time */
         switch (link_type)
@@ -952,8 +970,10 @@ AddLink(struct in_addr  src_addr,
                 }
                 else
                 {
+#ifdef DEBUG
                     fprintf(stderr, "PacketAlias/AddLink: ");
                     fprintf(stderr, " cannot allocate auxiliary TCP data\n");
+#endif
                 }
                 break;
             case LINK_FRAGMENT_ID:
@@ -966,8 +986,10 @@ AddLink(struct in_addr  src_addr,
     }
     else
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/AddLink(): ");
         fprintf(stderr, "malloc() call failed.\n");
+#endif
     }
 
     if (packetAliasMode & PKT_ALIAS_LOG)
@@ -1304,7 +1326,9 @@ FindUdpTcpIn(struct in_addr dst_addr,
                       dst_port, alias_port,
                       link_type, 1);
 
-    if ( !(packetAliasMode & PKT_ALIAS_DENY_INCOMING) && link == NULL)
+    if (!(packetAliasMode & PKT_ALIAS_DENY_INCOMING)
+     && !(packetAliasMode & PKT_ALIAS_PROXY_ONLY)
+     && link == NULL)
     {
         struct in_addr target_addr;
 
@@ -1578,6 +1602,34 @@ SetAckModified(struct alias_link *link)
 }
 
 
+struct in_addr
+GetProxyAddress(struct alias_link *link)
+{
+    return link->proxy_addr;
+}
+
+
+void
+SetProxyAddress(struct alias_link *link, struct in_addr addr)
+{
+    link->proxy_addr = addr;
+}
+
+
+u_short
+GetProxyPort(struct alias_link *link)
+{
+    return link->proxy_port;
+}
+
+
+void
+SetProxyPort(struct alias_link *link, u_short port)
+{
+    link->proxy_port = port;
+}
+
+
 int
 GetAckModified(struct alias_link *link)
 {
@@ -1741,8 +1793,10 @@ SetExpire(struct alias_link *link, int expire)
     }
     else
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/SetExpire(): ");
         fprintf(stderr, "error in expire parameter\n");
+#endif
     }
 }
 
@@ -1811,8 +1865,10 @@ HouseKeeping(void)
     }
     else if (n < 0)
     {
+#ifdef DEBUG
         fprintf(stderr, "PacketAlias/HouseKeeping(): ");
         fprintf(stderr, "something unexpected in time values\n");
+#endif
         lastCleanupTime = timeStamp;
         houseKeepingResidual = 0;
     }
@@ -1884,8 +1940,10 @@ PacketAliasRedirectPort(struct in_addr src_addr,   u_short src_port,
         link_type = LINK_TCP;
         break;
     default:
+#ifdef DEBUG
         fprintf(stderr, "PacketAliasRedirectPort(): ");
         fprintf(stderr, "only TCP and UDP protocols allowed\n");
+#endif
         return NULL;
     }
 
@@ -1897,15 +1955,36 @@ PacketAliasRedirectPort(struct in_addr src_addr,   u_short src_port,
     {
         link->flags |= LINK_PERMANENT;
     }
+#ifdef DEBUG
     else
     {
         fprintf(stderr, "PacketAliasRedirectPort(): " 
                         "call to AddLink() failed\n");
     }
+#endif
 
     return link;
 }
 
+/* Translate PPTP packets to a machine on the inside
+ */
+int
+PacketAliasPptp(struct in_addr src_addr)
+{
+
+    pptpAliasAddr = src_addr; 		/* Address of the inside PPTP machine */
+    pptpAliasFlag = src_addr.s_addr != INADDR_NONE;
+
+    return 1;
+}
+
+int GetPptpAlias (struct in_addr* alias_addr)
+{
+    if (pptpAliasFlag)
+	*alias_addr = pptpAliasAddr;
+
+    return pptpAliasFlag;
+}
 
 /* Static address translation */
 struct alias_link *
@@ -1922,11 +2001,13 @@ PacketAliasRedirectAddr(struct in_addr src_addr,
     {
         link->flags |= LINK_PERMANENT;
     }
+#ifdef DEBUG
     else
     {
         fprintf(stderr, "PacketAliasRedirectAddr(): " 
                         "call to AddLink() failed\n");
     }
+#endif
 
     return link;
 }
@@ -2007,6 +2088,8 @@ PacketAliasInit(void)
     packetAliasMode = PKT_ALIAS_SAME_PORTS
                     | PKT_ALIAS_USE_SOCKETS
                     | PKT_ALIAS_RESET_ON_ADDR_CHANGE;
+
+    pptpAliasFlag = 0;
 }
 
 void
@@ -2159,7 +2242,9 @@ PunchFWHole(struct alias_link *link) {
         if (fwhole == fireWallActiveNum) {
             /* No rule point empty - we can't punch more holes. */
             fireWallActiveNum = fireWallBaseNum;
+#ifdef DEBUG
             fprintf(stderr, "libalias: Unable to create firewall hole!\n");
+#endif
             return;
         }
     }
@@ -2186,15 +2271,19 @@ PunchFWHole(struct alias_link *link) {
        clear optimization) */
     if (rule.fw_uar.fw_pts[0] != 0 && rule.fw_uar.fw_pts[1] != 0) {
         r = setsockopt(fireWallFD, IPPROTO_IP, IP_FW_ADD, &rule, sizeof rule);
+#ifdef DEBUG
         if (r)
             err(1, "alias punch inbound(1) setsockopt(IP_FW_ADD)");
+#endif
         rule.fw_src = GetDestAddress(link);
         rule.fw_dst = GetOriginalAddress(link);
         rule.fw_uar.fw_pts[0] = ntohs(GetDestPort(link));
         rule.fw_uar.fw_pts[1] = ntohs(GetOriginalPort(link));
         r = setsockopt(fireWallFD, IPPROTO_IP, IP_FW_ADD, &rule, sizeof rule);
+#ifdef DEBUG
         if (r)
             err(1, "alias punch inbound(2) setsockopt(IP_FW_ADD)");
+#endif
     }
 /* Indicate hole applied */
     link->data.tcp->fwhole = fwhole;
diff --git a/lib/libalias/alias_ftp.c b/lib/libalias/alias_ftp.c
index c6d449d05723..73769fdc624a 100644
--- a/lib/libalias/alias_ftp.c
+++ b/lib/libalias/alias_ftp.c
@@ -221,7 +221,9 @@ NewFtpPortCommand(struct ip *pip,
     }
     else
     {
+#ifdef DEBUG
         fprintf(stderr,
         "PacketAlias/HandleFtpOut: Cannot allocate FTP data port\n");
+#endif
     }
 }
diff --git a/lib/libalias/alias_local.h b/lib/libalias/alias_local.h
index 38462810733a..da451259cdf0 100644
--- a/lib/libalias/alias_local.h
+++ b/lib/libalias/alias_local.h
@@ -1,9 +1,11 @@
 /* -*- mode: c; tab-width: 3; c-basic-offset: 3; -*-
     Alias_local.h contains the function prototypes for alias.c,
     alias_db.c, alias_util.c and alias_ftp.c, alias_irc.c (as well
-    as any future add-ons).  It is intended to be used only within
-    the aliasing software.  Outside world interfaces are defined
-    in alias.h
+    as any future add-ons).  It also includes macros, globals and
+    struct definitions shared by more than one alias*.c file.
+
+    This include file is intended to be used only within the aliasing
+    software.  Outside world interfaces are defined in alias.h
 
     This software is placed into the public domain with no restrictions
     on its distribution.
@@ -15,9 +17,54 @@
 #ifndef ALIAS_LOCAL_H
 #define ALIAS_LOCAL_H
 
+
+/*
+    Macros
+ */
+
+/*
+   The following macro is used to update an
+   internet checksum.  "delta" is a 32-bit
+   accumulation of all the changes to the
+   checksum (adding in new 16-bit words and
+   subtracting out old words), and "cksum"
+   is the checksum value to be updated.
+*/
+#define ADJUST_CHECKSUM(acc, cksum) { \
+    acc += cksum; \
+    if (acc < 0) \
+    { \
+        acc = -acc; \
+        acc = (acc >> 16) + (acc & 0xffff); \
+        acc += acc >> 16; \
+        cksum = (u_short) ~acc; \
+    } \
+    else \
+    { \
+        acc = (acc >> 16) + (acc & 0xffff); \
+        acc += acc >> 16; \
+        cksum = (u_short) acc; \
+    } \
+}
+
+
+/*
+    Globals
+*/
+
 extern int packetAliasMode;
 
-struct alias_link;
+
+/*
+    Structs
+*/
+
+struct alias_link;    /* Incomplete structure */
+
+
+/*
+    Prototypes
+*/
 
 /* General utilities */
 u_short IpChecksum(struct ip *);
@@ -71,6 +118,10 @@ struct in_addr GetDefaultAliasAddress(void);
 void SetDefaultAliasAddress(struct in_addr);
 u_short GetOriginalPort(struct alias_link *);
 u_short GetAliasPort(struct alias_link *);
+struct in_addr GetProxyAddress(struct alias_link *);
+void SetProxyAddress(struct alias_link *, struct in_addr);
+u_short GetProxyPort(struct alias_link *);
+void SetProxyPort(struct alias_link *, u_short);
 void SetAckModified(struct alias_link *);
 int GetAckModified(struct alias_link *);
 int GetDeltaAckIn(struct ip *, struct alias_link *);
@@ -88,13 +139,24 @@ void HouseKeeping(void);
 
 /* Tcp specfic routines */
 /*lint -save -library Suppress flexelint warnings */
+
+/* FTP routines */
 void AliasHandleFtpOut(struct ip *, struct alias_link *, int);
+
+/* IRC routines */
 void AliasHandleIrcOut(struct ip *pip, struct alias_link *link, int maxsize );
+
+/* NetBIOS routines */
 int AliasHandleUdpNbt(struct ip *, struct alias_link *, struct in_addr *, u_short);
 int AliasHandleUdpNbtNS(struct ip *, struct alias_link *, struct in_addr *, u_short *, struct in_addr *, u_short *);
+
+/* CUSeeMe routines */
 void AliasHandleCUSeeMeOut(struct ip *, struct alias_link *);
 void AliasHandleCUSeeMeIn(struct ip *, struct in_addr);
 
+/* Transparent proxy routines */
+int ProxyCheck(struct ip *, struct in_addr *, u_short *);
+void ProxyModify(struct alias_link *, struct ip *, int, int);
 
 
 enum alias_tcp_state {
@@ -103,5 +165,6 @@ enum alias_tcp_state {
     ALIAS_TCP_STATE_DISCONNECTED
 };
 
+int GetPptpAlias (struct in_addr*);
 /*lint -restore */
 #endif /* defined(ALIAS_LOCAL_H) */
diff --git a/lib/libalias/alias_nbt.c b/lib/libalias/alias_nbt.c
index cd07431f5cbf..d81ed37bb37c 100644
--- a/lib/libalias/alias_nbt.c
+++ b/lib/libalias/alias_nbt.c
@@ -15,7 +15,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * $Id: alias_nbt.c,v 1.1 1998/05/24 03:03:10 amurai Exp $
+ * $Id: alias_nbt.c,v 1.3 1999/03/09 23:44:00 brian Exp $
  *
  *  TODO:
  *       oClean up. 
@@ -101,15 +101,9 @@ typedef struct {
 #define ACT_ERR		0x6
 #define CFT_ERR		0x7
 
-/*******************************************************************
- * copy an IP address from one buffer to another                   *
- *******************************************************************/
-void putip(void *dest,void *src)
-{
-  memcpy(dest,src,4);
-}
 
-void PrintRcode( u_char rcode )  {
+#ifdef DEBUG
+static void PrintRcode( u_char rcode )  {
 
 	switch (rcode) {
 		case FMT_ERR:
@@ -129,10 +123,11 @@ void PrintRcode( u_char rcode )  {
 
 	}	
 }
+#endif
 
 
 /* Handling Name field */
-u_char *AliasHandleName ( u_char *p, char *pmax ) {
+static u_char *AliasHandleName ( u_char *p, char *pmax ) {
 
 	u_char *s;
 	u_char c;
@@ -282,7 +277,7 @@ typedef struct {
 	u_short	class;	/* The class of Request */
 } NBTNsQuestion;
 
-u_char *
+static u_char *
 AliasHandleQuestion(
     u_short count,
 							NBTNsQuestion *q,
@@ -306,7 +301,9 @@ AliasHandleQuestion(
 				q= q+1;
 			break;
 			default:
+#ifdef DEBUG
 				printf("\nUnknown Type on Question %0x\n", ntohs(q->type) );
+#endif
 			break;
 		}
 		count--;
@@ -337,7 +334,7 @@ typedef struct {
 	struct	in_addr	addr;
 } NBTNsRNB;
 
-u_char *
+static u_char *
 AliasHandleResourceNB( 
     NBTNsResource *q,
     char *pmax, 
@@ -406,7 +403,7 @@ typedef struct {
 	struct	in_addr	addr;
 } NBTNsResourceA;
 
-u_char *
+static u_char *
 AliasHandleResourceA( 
     NBTNsResource *q,
     char *pmax,
@@ -463,7 +460,7 @@ typedef struct {
 	u_short opcode:4, flags:8, resv:4;
 } NBTNsResourceNULL;
 
-u_char *
+static u_char *
 AliasHandleResourceNULL( 
     NBTNsResource *q, 
     char *pmax,
@@ -496,7 +493,7 @@ AliasHandleResourceNULL(
 	return ((u_char *)n);
 }
 
-u_char *
+static u_char *
 AliasHandleResourceNS( 
     NBTNsResource *q,
     char *pmax,
@@ -527,7 +524,7 @@ typedef struct {
 	u_short	numnames;
 } NBTNsResourceNBSTAT;
 
-u_char *
+static u_char *
 AliasHandleResourceNBSTAT(
     NBTNsResource *q,
     char *pmax,
@@ -551,7 +548,7 @@ AliasHandleResourceNBSTAT(
 	return ((u_char *)n + bcount);
 }
 
-u_char *
+static u_char *
 AliasHandleResource(
     u_short count, 
 							NBTNsResource *q,
@@ -607,10 +604,12 @@ AliasHandleResource(
 				);
 				break;
 			default: 
+#ifdef DEBUG
 				printf(
 				    "\nUnknown Type of Resource %0x\n", 
 				    ntohs(q->type) 
 				);
+#endif
 				break;
 		}
 		count--;
@@ -710,4 +709,3 @@ int AliasHandleUdpNbtNS(
 #endif
     return ((p == NULL) ? -1 : 0);
 }
-
diff --git a/lib/libalias/alias_old.c b/lib/libalias/alias_old.c
deleted file mode 100644
index 3f634d448411..000000000000
--- a/lib/libalias/alias_old.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
-    This file can be considered a junk pile of old functions that
-    are either obsolete or have had their names changed.  In the
-    transition from alias2.1 to alias2.2, all the function names
-    were rationalized so that they began with "PacketAlias..."
-
-    These functions are included for backwards compatibility.  
-*/
-
-#include <sys/types.h>
-#include <netinet/in_systm.h>
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include "alias.h"
-#include "alias_local.h"
-
-void
-InitPacketAlias(void)
-{
-    PacketAliasInit();
-}
-
-void
-SetPacketAliasAddress(struct in_addr addr)
-{
-    PacketAliasSetAddress(addr);
-}
-
-unsigned int
-SetPacketAliasMode(unsigned int flags, unsigned int mask)
-{
-    return PacketAliasSetMode(flags, mask);
-}
-
-int
-PacketAliasPermanentLink(struct in_addr src_addr,   u_short src_port,
-                         struct in_addr dst_addr,   u_short dst_port,
-                         u_short alias_port, u_char proto)
-{
-    struct alias_link *link;
-    struct in_addr null_address;
-
-    null_address.s_addr = 0;
-    link = PacketAliasRedirectPort(src_addr, src_port,
-                                       dst_addr, dst_port,
-                                       null_address, alias_port,
-                                       proto);
-
-    if (link == NULL)
-        return -1;
-    else
-        return 0;
-}
-
-int
-SaveFragmentPtr(char *ptr)
-{
-    return PacketAliasSaveFragment(ptr);
-}
-
-char *
-GetNextFragmentPtr(char *ptr)
-{
-    return PacketAliasGetFragment(ptr);
-}
-
-void
-FragmentAliasIn(char *header, char *fragment)
-{
-    PacketAliasFragmentIn(header, fragment);
-}
-
-u_short
-InternetChecksum(u_short *ptr, int len)
-{
-    return PacketAliasInternetChecksum(ptr, len);
-}
diff --git a/lib/libalias/libalias.3 b/lib/libalias/libalias.3
index f9b36e6c6d71..38897d422247 100644
--- a/lib/libalias/libalias.3
+++ b/lib/libalias/libalias.3
@@ -32,6 +32,8 @@ of the text.
     4.1 PacketAliasRedirectPort()
     4.2 PacketAliasRedirectAddr()
     4.3 PacketAliasRedirectDelete()
+    4.4 PacketAliasProxyRule()
+    4.5 PacketAliasPptp()
 5. Fragment Handling
     5.1 PacketAliasSaveFragment()
     5.2 PacketAliasGetFragment()
@@ -506,6 +508,122 @@ re-mapped in the same manner the header fragment
 was.  Fragments which arrive before the header
 are saved and then retrieved once the header fragment
 has been resolved.
+
+.Ss 4.4 PacketAliasProxyRule()
+
+.Ft int
+.Fn PacketAliasProxyRule "char *cmd"
+
+The passed
+.Ar cmd
+string consists of one or more pairs of words.  The first word in each
+pair is a token and the second is the value that should be applied for
+that token.  Tokens and their argument types are as follows:
+
+.Bl -tag -offset XXX -width XXX
+.It type encode_ip_hdr|encode_tcp_stream|no_encode
+In order to support transparent proxying, it is necessary to somehow
+pass the original address and port information into the new destination
+server.  If
+.Dq encode_ip_hdr
+is specified, the original address and port is passed as an extra IP
+option.  If
+.Dq encode_tcp_stream
+is specified, the original address and port is passed as the first
+piece of data in the tcp stream in the format
+.Dq DEST Ar IP port .
+.It port Ar portnum
+Only packets with the destination port
+.Ar portnum
+are proxied.
+.It server Ar host[:portnum]
+This specifies the
+.Ar host
+and
+.Ar portnum
+that the data is to be redirected to.
+.Ar host
+must be an IP address rather than a DNS host name.  If
+.Ar portnum
+is not specified, the destination port number is not changed.
+.Pp
+The
+.Ar server
+specification is mandatory unless the
+.Dq delete
+command is being used.
+.It rule Ar index
+Normally, each call to
+.Fn PacketAliasProxyRule
+inserts the next rule at the start of a linear list of rules.  If an
+.Ar index
+is specified, the new rule will be checked after all rules with lower
+indices.  Calls to
+.Fn PacketAliasProxyRule
+that do not specify a rule are assigned rule 0.
+.It delete Ar index
+This token and its argument must not be used with any other tokens.  When
+used, all existing rules with the given
+.Ar index
+are deleted.
+.It proto tcp|udp
+If specified, only packets of the given protocol type are matched.
+.It src Ar IP[/bits]
+If specified, only packets with a source address matching the given
+.Ar IP
+are matched.  If
+.Ar bits
+is also specified, then the first
+.Ar bits
+bits of
+.Ar IP
+are taken as a network specification, and all IP addresses from that
+network will be matched.
+.It dest Ar IP[/bits]
+If specified, only packets with a destination address matching the given
+.Ar IP
+are matched.  If
+.Ar bits
+is also specified, then the first
+.Ar bits
+bits of
+.Ar IP
+are taken as a network specification, and all IP addresses from that
+network will be matched.
+.El
+
+This function is usually used to redirect outgoing connections for
+internal machines that are not permitted certain types of internet
+access, or to restrict access to certain external machines.
+
+.Ss 4.5 PacketAliasPptp()
+
+.Ft extern int
+.Fn PacketAliasPptp "struct in_addr addr"
+
+This function causes any
+.Em G Ns No eneral
+.Em R Ns No outing
+.Em E Ns No encapsulated
+.Pq Dv IPPROTO_GRE
+packets to be aliased using
+.Ar addr
+rather than the address set via
+.Fn PacketAliasSetAddress .
+This allows the uses of the
+.Em P Ns No oint
+to
+.Em P Ns No oint
+.Em T Ns No unneling
+.Em P Ns No rotocol
+on a machine on the internal network.
+.Pp
+If the passed address is
+.Dv INADDR_NONE
+.Pq 255.255.255.255 ,
+.Dv PPTP
+aliasing is disabled.
+
 .Ss 5.1 PacketAliasSaveFragment()
 
 .Ft int
@@ -530,7 +648,8 @@ an argument.]
 This function returns PKT_ALIAS_OK if it
 was successful and PKT_ALIAS_ERROR if there
 was an error.
-.Ss 5.2 PacketAliasGetNextFragment()
+
+.Ss 5.2 PacketAliasGetFragment()
 
 .Ft char *
 .Fn PacketAliasGetFragment "char *buffer"