Commit graph

2667 commits

Author SHA1 Message Date
Guus Sliepen
615ecb7a8a Remove checks for non-C99 compliant compilers. 2016-04-14 23:13:49 +02:00
Guus Sliepen
ed09fa4e03 Fix version_get.h generation on BSD.
It doesn't like .PHONY rules that are actually doing stuff. So make a really
phony rule that does nothing and depend in it in the version_git.h rule.
2016-04-14 23:01:18 +02:00
Guus Sliepen
2802b3a497 Fix typo in Makefile.am. 2016-04-14 22:59:42 +02:00
Guus Sliepen
46ebfbb6eb Use getcwd() instead of get_current_dir_name(). 2016-04-14 17:29:25 +02:00
Guus Sliepen
b5b04910b9 Replace usleep() with nanosleep(). 2016-04-14 17:21:47 +02:00
Guus Sliepen
491839a81a Fix compiling under MinGW. 2016-04-14 17:05:10 +02:00
Guus Sliepen
34ea20af73 Remove checks for headers and functions that are in C99. 2016-04-14 17:03:01 +02:00
Guus Sliepen
fd3800324f Make text files Markdown-compatible. 2016-04-13 15:34:16 +02:00
Guus Sliepen
7f749c7e75 Update .gitignore. 2016-04-11 15:28:26 +02:00
Guus Sliepen
9ba3e95a9a Remove elliptic curve stubs from gcrypt/, add PRF implementation. 2016-04-11 15:27:08 +02:00
Guus Sliepen
20dd1c21dc Really don't compile getopt*.c if the system provides getopt_long(). 2016-04-11 15:20:32 +02:00
Guus Sliepen
9527622abc Enable silent builds by default.
Cleaner build messages make it easier to spot compiler warnings and errors.
Use make V=1 to get the verbose output back.

# Conflicts:
#	configure.ac
#	doc/Makefile.am
2016-04-11 15:07:23 +02:00
Guus Sliepen
413faffca3 Update links in the documentation.
# Conflicts:
#	doc/tinc.conf.5.in
#	doc/tinc.texi
#	src/avl_tree.c
#	src/avl_tree.h
2016-04-11 14:58:27 +02:00
Guus Sliepen
5cbc12b3d4 Explicitly mention that LibreSSL can be used as well.
# Conflicts:
#	doc/tinc.texi
#	m4/openssl.m4
2016-04-11 14:55:23 +02:00
Guus Sliepen
d7f6737cfc Update support for BSD tun/tap devices, add support for OS X utun interfaces. 2016-04-11 14:49:51 +02:00
Guus Sliepen
2a7871990b Update "now" after connect() when making outgoing connections.
It could be that address resolution takes a long time, don't let that
count against a connection. This is especially important when using a
nameserver from the VPN.

# Conflicts:
#	src/net_socket.c
2016-04-10 17:49:23 +02:00
Guus Sliepen
cadbf587a0 Never call putenv() with data on the stack.
Even though we are using putenv() here to remove items from the
environment, there is no guarantee that putenv() doesn't add the
argument to the environment anyway. In that case, we have to make sure
that it doesn't go away. We also don't want a memory leak, so keep a
list of things we unputenv()ed around, so we can reuse things.

Thanks to Poul-Henning Kamp for pointing out this problem.

# Conflicts:
#	src/process.c
2016-04-10 17:42:23 +02:00
Guus Sliepen
0e8e53b4ce Fix --logfile without a filename on Windows.
On Windows, the log filename now defaults to "tinc.log" in the same
directory as tinc.conf.

# Conflicts:
#	src/tincd.c
2016-04-10 17:28:42 +02:00
Guus Sliepen
c544e5e8fe Support ToS/DiffServ for IPv6 meta and UDP connections.
Also remember ToS/DiffServ priority for each socket individually. This
is a port of commits c72e237 and 042a6c1.
2016-04-10 17:24:55 +02:00
Guus Sliepen
e355088535 Use iface instead of interface.
This was accidentally added in commit 2f03a5d.
2016-04-10 17:01:52 +02:00
Guus Sliepen
6f97c00115 Update THANKS. 2016-04-10 17:01:04 +02:00
Guus Sliepen
8be447ac02 Update .gitignore. 2016-04-10 16:51:03 +02:00
Guus Sliepen
9f0fb224a6 Don't compile getopt*.c if the system provides getopt_long().
# Conflicts:
#	configure.ac
#	src/Makefile.am
#	src/tincd.c
2016-04-10 16:47:32 +02:00
Guus Sliepen
c2726dae62 Fix typo.
Found by LunarShaddow.
2016-04-10 16:38:45 +02:00
LunarShaddow
e44c337eae re-arrange include sequence to avoid a mingw introduced bug.
refers: https://www.cygwin.com/ml/cygwin/2012-12/msg00194.html

# Conflicts:
#	src/cygwin/device.c
2016-03-07 21:54:13 +01:00
LunarShaddow
af83d0b9e8 fix typo 2016-03-07 21:51:44 +01:00
Guus Sliepen
bf50b3502a Fix for botched cherry-pick commit 60fb230. 2016-02-28 16:38:49 +01:00
Guus Sliepen
1ceea259c3 Add warnings for bad combinations of Device and Interface.
On Linux, the name of the tun/tap interface can be set freely. However,
on most other operating systems, tinc cannot change the name of the
interface. In those situations, it is possible to specify a Device and
an Interface that conflict with each other. On BSD, this can cause
$INTERFACE to be set incorrectly, on Windows, this results in a
potentially unreliable way in which a TAP-Win32 interface is selected.

# Conflicts:
#	src/bsd/device.c
2016-02-28 16:37:52 +01:00
Guus Sliepen
e3f80e9167 Small fixes for the documentation.
# Conflicts:
#	doc/tinc.texi
2016-02-28 16:36:15 +01:00
Guus Sliepen
72cfd4f047 Clarify that scripts are called synchronously.
# Conflicts:
#	doc/tinc.conf.5.in
#	doc/tinc.texi
2016-02-28 16:35:21 +01:00
Guus Sliepen
4d7469e0da Fix forwarding of edge updates.
Commit e4670fc accidentily prevented ADD_EDGE messages from propagating
in some cases.
2016-02-28 16:31:31 +01:00
Guus Sliepen
60fb2308e5 Improve performance of edge updates. 2016-02-28 16:29:51 +01:00
Vittorio Gambaletta (VittGam)
994adadf27 Remove forward declaration for do_decrement_ttl.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>

# Conflicts:
#	src/route.c
2016-02-28 16:24:12 +01:00
Vittorio Gambaletta (VittGam)
0f3ae1a9f2 s/broadcast_packet_helper/route_broadcast/
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>

# Conflicts:
#	src/route.c
2016-02-28 16:19:00 +01:00
Vittorio Gambaletta (VittGam)
496f775568 Fix DecrementTTL option for packets destined to the local node.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>

# Conflicts:
#	src/route.c
2016-02-28 16:17:23 +01:00
Vittorio Gambaletta (VittGam)
17e54ea0be Try to reply with node address only when decrementing the TTL.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
2016-02-28 15:58:47 +01:00
Vittorio Gambaletta (VittGam)
92203bdbcb Fix source IP address for ICMP unreachable packets generated by tinc.
Try to send ICMP unreachable replies from an address assigned to the
local machine, instead of the destination address of the original
packet.

The address is found by looking up the route towards the sender of
the packet that generated the error; in usual configurations, this
is the tinc interface.

This also fixes the traceroute display in mtr when using the
DecrementTTL option.

Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>

# Conflicts:
#	src/route.c
2016-02-28 15:58:25 +01:00
Vittorio Gambaletta (VittGam)
a8a3a2c8ce Fix DecrementTTL option.
The option was not actually working, as it could be seen on traceroute or mtr.

The problem is that it was checking if the TTL was < 1 (so equal to 0) before decrementing it.

This meant that a packet with a TTL of 1 was being sent with a TTL of 0 on the VPN, instead of being discarded with the ICMP error message.

Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>

# Conflicts:
#	src/route.c
2016-02-28 15:54:33 +01:00
Guus Sliepen
ac9e32ff91 Use nostdinc instead of overriding DEFAULT_INCLUDES. 2016-02-28 15:48:19 +01:00
Guus Sliepen
96dd6e5f6c Only check for -fno-strict-overflow if -fwrapv does not work. 2016-02-28 15:42:04 +01:00
Guus Sliepen
92f0c4db77 Update .gitignore. 2016-02-28 15:41:51 +01:00
Guus Sliepen
d8ca00fe40 Add the ability to sign and verify files. 2016-01-27 00:09:29 +01:00
Guus Sliepen
7418e9077f Merge remote-tracking branch 'mweinelt/tinc-gui' into 1.1 2016-01-17 23:29:23 +01:00
Guus Sliepen
420989e4c3 Only add a reflexive address when we're sure it's working. 2016-01-14 15:39:38 +01:00
Guus Sliepen
cda5a477c8 Use static buffers for recvmmsg(), initialize them only as needed.
As suggested by Michael Tokarev.
2015-12-10 16:45:05 +01:00
Guus Sliepen
e4fd81ed2d Add support for recvmmsg().
Based on a patch from Samuel Thibault and input from Michael Tokarev.
2015-12-10 16:36:10 +01:00
Guus Sliepen
cef40b8b97 list_delete() already free()s the deleted element. 2015-11-26 11:29:54 +01:00
Guus Sliepen
9fdf4278f8 Don't leave dead outgoing_t's in the outgoing_list.
If an outgoing connection cannot be made because no address is known for
it, it should be removed from the outgoing_list, otherwise it will
prevent it from being re-added later when we do know addresses for it.
2015-11-24 16:48:44 +01:00
Etienne Dechamps
c58eba587d Add upnp.h to tincd SOURCES.
This was missing from 513bffe1fe.
2015-11-22 23:03:03 +01:00
Etienne Dechamps
613d586afd Don't unset validkey when receiving SPTPS handshakes over ANS_KEY.
This fixes a hairy race condition that was introduced in
1e89a63f16, which changed
the underlying transport of handshake packets from REQ_KEY to ANS_KEY.
Unfortunately, what I missed in that commit is, on the receiving side,
there is a slight difference between req_key_h() and ans_key_h():
indeed, the latter resets validkey to false.

The reason why this is not a problem during typical operation is
because the normal SPTPS key regeneration procedure looks like this:

    KEX ->
    <- KEX
    SIG ->
    <- SIG

All these messages are sent over ANS_KEY, therefore the receiving side
will unset validkey. However, that's typically not a problem in practice
because upon reception of the last message (SIG), SPTPS will call
sptps_receive_record(), which will set validkey to true again, and
everything works out fine in the end.

However, that was the *typical* scenario. Now let's assume that the
SPTPS channel is in active use at the same time key regeneration
happens. Specifically, let's assume a normal VPN data packet sneaks in
during the key regeneration procedure:

    KEX ->
    <- KEX
    <- (SPTPS packet, over TCP or UDP)
    <- KEX (wtf?)
    SIG -> (refused with Invalid packet seqno: XXX != 0)

At this point, both nodes are extremely confused and the SPTPS channel
becomes unusable with various errors being thrown on both sides. The
channel will stay down until automatic SPTPS channel restart kicks in
after 10 seconds.

(Note: the above is just an example - the race can occur on either side
whenever a packet is sent during the period of time between KEX and SIG
messages are received by the node sending the packet.)

I've seen this race occur in the wild - it is very likely to occur if
key regeneration occurs on a heavily loaded channel. It can be
reproduced fairly easily by setting KeyExpire to a short value (a few
seconds) and then running something like ping -f foobar -i 0.01.

The reason why this occurs is because tinc's TX code path triggers the
following:

 - send_packet()
 - try_tx()
 - try_tx_sptps()
 - validkey is false because we just received an ANS_KEY message
 - waitingforkey is false because it's not used for key regeneration
 - send_req_key()
 - SPTPS channel restart (sptps_stop(), sptps_start()).

Obviously, it all goes downhill from there and the two nodes get very
confused quickly (for example the seqno gets reset, hence the error
messages).

This commit fixes the issue by keeping validkey set when SPTPS data is
received over ANS_KEY messages.
2015-11-22 17:53:52 +00:00