+ rc = 0;
+
+err_unk:
+ /* Something went wrong and the protocol can't express what. We should
+ * have logged what the problem actually was.
+ */
+ q->resp = R_ERROR;
+ q->u.error = E_UNKNOWN;
+
+done:
+ /* All done. */
+ dstr_destroy(&d);
+ if (fp) fclose(fp);
+ return (rc);
+}
+
+/* Find out who is responsible for the connection described in the query Q.
+ * Write the answer to Q. Errors are logged and reported via the query
+ * structure.
+ */
+void identify(struct query *q)
+{
+ FILE *fp = 0;
+ dstr d = DSTR_INIT;
+ char *p, *pp;
+ struct socket s[4];
+ int i;
+ int gwp = 0;
+ unsigned fl;
+#define F_SADDR 1u
+#define F_SPORT 2u
+#define F_DADDR 4u
+#define F_DPORT 8u
+#define F_ALL (F_SADDR | F_SPORT | F_DADDR | F_DPORT)
+#define F_ESTAB 16u
+
+ /* If we have a default gateway, and it matches the remote address then
+ * this may be a proxy connection from our NAT, so remember this, and don't
+ * inspect the remote addresses in the TCP tables.
+ */
+ if (!get_default_gw(q->ao->af, &s[0].addr) &&
+ q->ao->addreq(&s[0].addr, &q->s[R].addr))
+ gwp = 1;
+
+ /* Search the main `tcp' table. */
+ if (search_tcp_file(q, gwp, q->ao, q->s)) goto done;