Commit graph

2456 commits

Author SHA1 Message Date
Guus Sliepen
1ce0f76139 Return non-zero exit code when "tinc get" does not find the requested variable. 2014-06-15 12:14:01 +02:00
Guus Sliepen
ef5e8b6920 Fix base64 decoding of Ed25519 keys. 2014-06-03 11:02:58 +02:00
Guus Sliepen
b0d80c7f28 Allow Cipher and Digest "none".
This is for backwards compatibility with tinc 1.0, it has no effect on
the SPTPS protocol.
2014-05-18 21:51:42 +02:00
Guus Sliepen
666718998e Implement a PEM-like format for Ed25519 keys.
We don't require compatibility with any other software, but we do want Ed25519 keys to work
the same as RSA keys for now.
2014-05-18 20:49:35 +02:00
Guus Sliepen
f0e7e6b03e Rename ECDSA to Ed25519. 2014-05-18 20:47:04 +02:00
Guus Sliepen
35437a50e2 Add sanity checks when generating new RSA keys.
The key size should be a multiple of 8 bits, and it should be between 1024 and
8192 bits.
2014-05-13 20:33:20 +02:00
Guus Sliepen
66f325f467 Fix PMTU discovery via datagram SPTPS.
In send_sptps_data(), the len variable contains the length of the whole
datagram that needs to be sent to the peer, including the overhead from SPTPS
itself.
2014-05-12 15:57:40 +02:00
Guus Sliepen
c35bfa18ec Fix a crash when we have a malformed public ECDSA key of another node. 2014-05-12 15:56:29 +02:00
Guus Sliepen
c32fcdfc1d Add missing closedir(). 2014-05-12 14:35:56 +02:00
Guus Sliepen
75e5b2e906 Use void pointers to opaque buffers. 2014-05-12 14:35:12 +02:00
Guus Sliepen
332b55d472 Change AutoConnect from int to bool.
The proper value is 3, not 2 or 4, and 5 is right out. So just hardcode this value,
and only have the option to turn AutoConnect on or off.
2014-05-06 14:11:55 +02:00
Guus Sliepen
27acb5d047 Fix compiler warnings. 2014-05-06 13:01:48 +02:00
Guus Sliepen
bc33a073d8 Nexthop calculation should always use the shortest path.
When tinc runs the graph algorithms and updates the nexthop and via pointers,
it uses a breadth-first search, but it can sometimes revisit nodes that have
already been visited if the previous path is marked as being indirect, and
there is a longer path that is "direct". The via pointer should be updated in
this case, because this points to the closest hop to the destination that can
be reached directly. However, the nexthop pointer should not be updated.

This fixes a bug where there could potentially be a routing loop if a node in
the graph has an edge with the indirect flag set, and some other edge without
that flag, the indirect edge is part of the minimum spanning tree, and a
broadcast packet is being sent.
2014-05-06 12:58:25 +02:00
Saverio Proto
b6e2b416bf Fix typo in comment 2014-05-05 15:23:25 +02:00
Guus Sliepen
18698c4e12 Put brackets around IPv6 addresses in invitation URL, even if there is no port number. 2014-04-25 17:00:55 +02:00
Guus Sliepen
475088ed77 sptps_test: allow using a tun device instead of stdio. 2014-04-15 17:26:08 +02:00
Guus Sliepen
2980173ee7 Use the ChaCha-Poly1305 cipher for the SPTPS protocol.
The main reason to switch from AES-256-GCM to ChaCha-Poly1305 is to remove a
dependency on OpenSSL, whose behaviour of the AES-256-GCM decryption function
changes between versions. The source code for ChaCha-Pol1305 is small and in
the public domain, and can therefore be easily included in tinc itself.
Moreover, it is very fast even without using any optimized assembler, easily
outperforming AES-256-GCM on platforms that don't have special AES instructions
in hardware.
2014-04-14 21:43:45 +02:00
Guus Sliepen
49e3baec20 Merge branch '1.1-ed25519' into 1.1 2014-04-14 20:50:16 +02:00
Guus Sliepen
37b729d7fd Properly initialize buffers.
Valgrind complained about use of uninitialized data.
2014-04-13 12:09:48 +02:00
Guus Sliepen
2f01744f82 Use Ed25519 keys.
This uses the portable Ed25519 library made by Orson Peters, which in turn uses
the reference implementation made by Daniel J. Bernstein.

This implementation also allows Ed25519 keys to be used for key exchange, so
there is no need to add a separate implementation of Curve25519.
2014-04-06 22:47:26 +02:00
Guus Sliepen
d6734a2da4 Fix return value of b64encode(). 2014-04-06 22:46:06 +02:00
Guus Sliepen
f134bd0c9c Handle a disconnecting tincd better.
- Try to prevent SIGPIPE from being sent for errors sending to the control
  socket. We don't outright block the SIGPIPE signal because we still want the
  tinc CLI to exit when its output is actually sent to a real (broken) pipe.

- Don't call exit() from top(), and properly detect when the control socket is
  closed by the tincd.
2014-03-09 15:32:10 +01:00
Guus Sliepen
09e000ba54 Rewind the file before trying to use PEM_read_RSA_PUBKEY(). 2014-02-26 17:27:57 +01:00
Guus Sliepen
44c7f554c7 Add "network" command to list or switch networks. 2014-02-26 11:04:42 +01:00
Guus Sliepen
48ecff6ddb Add missing attribution for 1.1pre10 to the NEWS file. 2014-02-07 23:06:26 +01:00
Guus Sliepen
9f7e2dffb2 Really fix compiling under Windows. 2014-02-07 23:05:33 +01:00
Guus Sliepen
173072ff07 Releasing 1.1pre10. 2014-02-07 21:40:42 +01:00
Guus Sliepen
cb5c1b5986 Check whether OpenSSL has support for GCM. 2014-02-07 21:40:29 +01:00
Guus Sliepen
cdda0388a8 Fix compiling for Windows. 2014-02-07 21:14:41 +01:00
Guus Sliepen
06a4a8c153 Update copyright notices. 2014-02-07 20:38:48 +01:00
Guus Sliepen
bc9347042b Attribution for Dennis Joachimsthaler. 2014-02-07 19:57:06 +01:00
Guus Sliepen
ac7f82cb23 Handle errors from TAP-Win32/64 adapter in a better way.
Before, the tapreader thread would just exit immediately after encountering the
first error, without notifying the main thread. Now, the tapreader thead never
exits itself, but tells the main thread to stop when more than ten errors are
encountered in a row.
2014-02-07 19:55:31 +01:00
Guus Sliepen
2f41780023 Attribution for various contributors.
Conflicts:
	THANKS
2014-02-07 19:55:28 +01:00
Guus Sliepen
e717e424c2 Use addresses learned from other nodes when making outgoing connections.
Before, when making a meta-connection to a node (either because of a ConnectTo
or because AutoConnect is set), tinc required one or more Address statements
in the corresponding host config file. However, tinc learns addresses from
other nodes that it uses for UDP connections. We can use those just as well for
TCP connections.
2014-01-30 17:10:30 +01:00
Guus Sliepen
995444c4f9 Document Weight and also allow it to be set from tinc.conf. 2014-01-29 17:32:18 +01:00
Guus Sliepen
2e318f3799 Don't ask questions if we are not running interactively.
When creating invitations or using them to join a VPN, and the tinc command is
not run interactively (ie, when stdin and stdout are not connected or
redirected to/from a file), don't ask questions. If normally tinc would ask for
a confirmation, just assume the default answer instead. If tinc really needs
some input, just print an error message instead.

In case an invitation is used for a VPN which uses a netname that is already in
use on the local host, tinc will store the configuration in a temporary
directory. Normally it asks for an alternative netname and then renames the
temporary directory, but when not run interactively, it now just prints the
location of the unchanged temporary directory.
2014-01-29 17:17:59 +01:00
Guus Sliepen
00398a60ec Add missing newlines when copying variables from tinc.conf to an invitation file. 2014-01-27 23:21:25 +01:00
Guus Sliepen
fa1e9b0461 Test two tinc daemons using network namespaces.
Testing multiple daemons connecting to each other on the same computer is
usually difficult, because connections to local IP addresses will bypass most
of the network stack. However, recent versions of Linux support network
namespaces, which can isolate network interfaces. We use this to isolate the
virtual interface of the daemons from each other, so we get the behaviour as if
the daemons were each running on their own machine. This can also be used for
more complicated tests (including those with firewall rules) without disturbing
the real network setup of the host computer.
2014-01-24 16:17:09 +01:00
Guus Sliepen
38adc8bf54 Add the ListenAddress option.
ListenAddress works the same as BindToAddress, except that from now on,
explicitly binding outgoing packets to the address of a socket is only done for
sockets specified with BindToAddress.
2014-01-20 21:19:13 +01:00
Guus Sliepen
e187758a7e Document that 1.1 uses AES-256 in GCM mode. 2014-01-20 20:21:15 +01:00
Guus Sliepen
1a115d1d1c Document clearly that tinc depends on curses and readline libraries. 2014-01-20 20:16:58 +01:00
Guus Sliepen
a3decd0951 Let tinc-gui use correct address family when connecting to tincd via TCP. 2014-01-19 21:15:23 +01:00
Dennis Joachimsthaler
c10f3105b3 Ensure tinc-gui running in 64 bits mode can find tinc's 32 bit registry key. 2014-01-17 18:15:40 +01:00
Dennis Joachimsthaler
ab583f7e8c Fix tinc-gui on Windows. 2014-01-17 16:10:10 +01:00
Guus Sliepen
11d562e9b2 Add index entries for the CLI commands. 2014-01-16 14:52:44 +01:00
Guus Sliepen
d8ea66ff1f Update the documentation of the tinc command. 2014-01-16 14:46:44 +01:00
Guus Sliepen
8af6d64fd9 Clarify StrictSubnets. 2014-01-16 14:29:35 +01:00
Florent Clairambault
c8543bbe6b Adding "conf.d" configuration dir support.
Any file matching the pattern /etc/tinc/$NETNAME/conf.d/*.conf will be
parsed after the tinc.conf file.
2013-12-29 23:11:54 +01:00
Guus Sliepen
e6b32936c5 Fix handling of --with-libgcrypt. 2013-12-10 17:13:15 +01:00
Guus Sliepen
b7d59f035b Don't enable -fstack-protector-all.
It is not supported on all architectures and is problematic on some
platforms.
2013-12-10 17:09:16 +01:00