j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Releasing 1.1pre3.

Browse source
This commit is contained in:
Guus Sliepen 2012-10-14 19:22:30 +02:00
parent 3254e75afe
commit 0db9e471ea
3 changed files with 61 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

26
NEWS
View file

@ -1,4 +1,28 @@
Version 1.1pre2 Juli 17 2011 Version 1.1pre3 October 14 2012
* New experimental protocol:
* Uses 521 bit ECDSA keys for authentication.
* Uses AES-256-CTR and HMAC-SHA256.
* Always provides perfect forward secrecy.
* Used for both meta-connections and VPN packets.
* VPN packets are encrypted end-to-end.
* Many improvements to tincctl:
* "config" command shows/adds/changes configuration variables.
* "export" and "import" commands help exchange configuration files.
* "init" command sets up initial configuration files.
* "info" command shows details about a node, subnet or address.
* "log" command shows live log messages.
* Without a command it acts as a shell, with history and TAB completion.
* Improved starting/stopping tincd.
* Improved graph output.
* When trying to directly send UDP packets to a node for which multiple
addresses are known, all of them are tried.
* Many small fixes, code cleanups and documentation updates.
Version 1.1pre2 July 17 2011
* .cookie files are renamed to .pid files, which are compatible with 1.0.x. * .cookie files are renamed to .pid files, which are compatible with 1.0.x.

85
README
View file

@ -1,4 +1,4 @@
This is the README file for tinc version 1.1pre2. Installation This is the README file for tinc version 1.1pre3. Installation
instructions may be found in the INSTALL file. instructions may be found in the INSTALL file.
tinc is Copyright (C) 1998-2012 by: tinc is Copyright (C) 1998-2012 by:
@ -29,81 +29,66 @@ protocol is not fixed yet.
Security statement Security statement
------------------ ------------------
This version uses an experimental and unfinished cryptographic protocol. Use This version uses an experimental and unfinished cryptographic protocol. Use it
it at your own risk. at your own risk.
Compatibility Compatibility
------------- -------------
Version 1.1pre2 is compatible with 1.0pre8, 1.0 and later, but not with older Version 1.1pre3 is compatible with 1.0pre8, 1.0 and later, but not with older
versions of tinc. versions of tinc.
When the ExperimentalProtocol option is used, tinc is still compatible with When the ExperimentalProtocol option is used, tinc is still compatible with
1.0.X and 1.1pre2 itself, but not with any other 1.1preX version. 1.0.X and 1.1pre3 itself, but not with any other 1.1preX version.
Requirements Requirements
------------ ------------
OpenSSL (http://www.openssl.org/) version 1.0.0 or later.
The zlib library is used for optional compression. You can find it at
http://www.gzip.org/zlib/.
The lzo library is also used for optional compression. You can find it at
http://www.oberhumer.com/opensource/lzo/.
Since 1.1, the libevent library is used for the main event loop. You can find
it at http://monkey.org/~provos/libevent/.
In order to compile tinc, you will need a GNU C compiler environment. Please In order to compile tinc, you will need a GNU C compiler environment. Please
ensure you have the latest stable versions of all the required libraries. ensure you have the latest stable versions of all the required libraries:
- OpenSSL (http://www.openssl.org/) version 1.0.0 or later.
- Libevent (http://monkey.org/~provos/libevent/)
The following libraries are used by default, but can be disabled if necessary:
- zlib (http://www.gzip.org/zlib/)
- lzo (http://www.oberhumer.com/opensource/lzo/)
- ncurses (http://invisible-island.net/ncurses/)
- readline (ftp://ftp.gnu.org/pub/gnu/readline/)
Features Features
-------- --------
This version of tinc supports multiple virtual networks at once. To Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number
use this feature, you may supply a netname via the -n or --net of nodes. Instead of configuring tunnels, you give tinc the location and
options. The standard locations for the config files will then be public key of a few nodes in the VPN. After making the initial connections to
/etc/tinc/<net>/. those nodes, tinc will learn about all other nodes on the VPN, and will make
connections automatically. When direct connections are not possible, data will
be forwarded by intermediate nodes.
tincd regenerates its encryption key pairs. It does this on the first By default, nodes authenticate each other using 2048 bit RSA (or 521 bit
activity after the keys have expired. This period is adjustable in the ECDSA*) keys. Traffic is encrypted using Blowfish in CBC mode (or AES-256 in
configuration file, and the default time is 3600 seconds (one hour). CTR mode*), authenticated using HMAC-SHA1 (or HMAC-SHA-256*), and is protected
against replay attacks.
This version supports multiple subnets at once. They are also sorted *) When using the ExperimentalProtocol option.
on subnet mask size. This means that it is possible to have
overlapping subnets on the VPN, as long as their subnet mask sizes
differ.
Since pre5, tinc can operate in several routing modes. The default mode, Tinc fully supports IPv6.
"router", works exactly like the older version, and uses Subnet lines to
determine the destination of packets. The other two modes, "switch" and "hub",
allow the tinc daemons to work together like a single network switch or hub.
This is useful for bridging networks. The latter modes only work properly on
Linux, FreeBSD and Windows.
The algorithms used for encryption and generating message authentication codes Tinc can operate in several routing modes. In the default mode, "router", every
can now be changed in the configuration files. All cipher and digest algorithms node is associated with one or more IPv4 and/or IPv6 Subnets. The other two
supported by OpenSSL can be used. Useful ciphers are "blowfish" (default), modes, "switch" and "hub", let the tinc daemons work together to form a virtual
"bf-ofb", "des", "des3", etcetera. Useful digests are "sha1" (default), "md5", Ethernet network switch or hub.
etcetera.
Support for routing IPv6 packets has been added. Just add Subnet lines with
IPv6 addresses (without using :: abbreviations) and use ifconfig or ip (from
the iproute package) to give the virtual network interface corresponding IPv6
addresses. tinc does not provide autoconfiguration for IPv6 hosts, if you need
it use radvd or zebra.
It is also possible to make tunnels to other tinc daemons over IPv6 networks,
if the operating system supports IPv6. tinc will automatically use both IPv6
and IPv4 when available, but this can be changed by adding the option
"AddressFamily = ipv4" or "AddressFamily = ipv6" to the tinc.conf file.
Normally, when started tinc will detach and run in the background. In a native Normally, when started tinc will detach and run in the background. In a native
Windows environment this means tinc will intall itself as a service, which will Windows environment this means tinc will intall itself as a service, which will
restart after reboots. To prevent tinc from detaching or running as a service, restart after reboots. To prevent tinc from detaching or running as a service,
use the -D option. use the -D option.
The status of the VPN can be queried using the "tincctl" tool, which connects
to a running tinc daemon via a control connection. The same tool also makes it
easy to start and stop tinc, and to change its configuration.

2
configure.in
View file

@ -4,7 +4,7 @@ AC_PREREQ(2.61)
AC_INIT AC_INIT
AC_CONFIG_SRCDIR([src/tincd.c]) AC_CONFIG_SRCDIR([src/tincd.c])
AC_GNU_SOURCE AC_GNU_SOURCE
AM_INIT_AUTOMAKE(tinc, 1.1pre2) AM_INIT_AUTOMAKE(tinc, 1.1pre3)
AC_CONFIG_HEADERS([config.h]) AC_CONFIG_HEADERS([config.h])
AM_MAINTAINER_MODE AM_MAINTAINER_MODE