j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity
2493 commits 2 branches 0 tags 10 MiB
Commit graph

143 commits

Author SHA1 Message Date
Guus Sliepen
b50d6a7f2a Fix compiler warnings. 2011-12-26 23:04:40 +01:00
Guus Sliepen
2f4ccfe247 Fix tinc 1.0.x daemons connecting when ExperimentalProtocol = yes. 2011-07-19 21:11:11 +02:00
Guus Sliepen
cff27a258f Use ECDSA to sign ECDH key exchange for UDP session keys. 
The ECDSA public keys will also be included in the ANS_KEY requests,
but are only used when no ECDSA public key is known yet.
 2011-07-16 20:21:44 +02:00
Guus Sliepen
2ba61742d4 Use the correct direction flag when setting cipher keys. 
The flag was set incorrectly, but for most ciphers this does not have
any effect. AES in any of the block modes is picky about it though.
 2011-07-16 15:15:29 +02:00
Guus Sliepen
303dd1e702 Fix compiler warnings. 2011-07-13 22:52:52 +02:00
Guus Sliepen
fec279a9c5 Make use of the improved hex and base64 functions. 
Also, use base64 for all EC related data, it is shorter and easy to
distinguish from the legacy protocol.
 2011-07-12 23:43:12 +02:00
Guus Sliepen
bbeab00f46 Require ExperimentalProtocol = yes for new features, update documentation. 2011-07-11 21:54:01 +02:00
Guus Sliepen
30ef2a981e Automatically exchange ECDSA keys and upgrade to new authentication protocol. 
If we don't have ECDSA keys for the node we connect to, set protocol_minor
to 1, to indicate this to the other end. This will first complete the
old way of authentication with RSA keys, and will then exchange ECDSA keys.
The connection will be terminated right afterwards, and the next attempt
will use ECDSA keys.
 2011-07-10 22:34:17 +02:00
Guus Sliepen
8132be8fbd Very primitive ECDSA signed ECDH key exchange for the meta protocol. 
Nonces and hash of the ID requests should be included in the seed for the PRF.
 2011-07-07 22:30:55 +02:00
Guus Sliepen
86d83bd9bd Bump minor protocol to indicate ECDH capability for UDP session keys. 2011-07-05 21:29:31 +02:00
Guus Sliepen
9708bbfa8e Add a minor number to the protocol version. 2011-07-05 21:19:48 +02:00
Guus Sliepen
9e3ca39773 Use variable length arrays instead of alloca(). 2010-11-13 15:55:38 +01:00
Guus Sliepen
a22041922f Merge branch 'master' into 1.1 
Conflicts:
	doc/tincd.8.in
	lib/pidfile.c
	src/graph.c
	src/net.c
	src/net.h
	src/net_packet.c
	src/net_setup.c
	src/net_socket.c
	src/netutl.c
	src/node.c
	src/node.h
	src/protocol_auth.c
	src/protocol_key.c
	src/tincd.c
 2010-11-12 16:15:29 +01:00
Guus Sliepen
ff71f28902 Merge local host configuration with server configuration. 
With some exceptions, tinc only accepted host configuration options for the
local node from the corresponding host configuration file. Although this is
documented, many people expect that they can also put those options in
tinc.conf. Tinc now internally merges the contents of both tinc.conf and the
local host configuration file.
 2010-10-22 12:47:12 +02:00
Guus Sliepen
113458c286 Use correct digest length when checking a received key. 2010-04-30 23:11:48 +02:00
Guus Sliepen
79e46d08a4 Merge branch 'master' into 1.1 
Conflicts:
	NEWS
	README
	configure.in
	src/net.c
	src/net.h
 2010-04-17 12:21:53 +02:00
Guus Sliepen
f75e71bc69 Convert Port to numeric form before sending it to other nodes. 
If one uses a symbolic name for the Port option, tinc will send that name
literally to other nodes.  However, it is not guaranteed that all nodes have
the same contents in /etc/services, or have such a file at all.
 2010-04-03 09:46:45 +01:00
Sven-Haegar Koch
103543aa2c Merge branch 'master' into 1.1 
Conflicts:
	NEWS
	README
	configure.in
	have.h
	src/conf.c
	src/conf.h
	src/net.c
	src/net_packet.c
	src/protocol_key.c
	src/protocol_subnet.c
	src/route.c
	src/tincd.c
 2010-03-26 16:51:03 +01:00
Guus Sliepen
40d91ff619 Update copyright notices. 2010-02-02 22:49:21 +01:00
Guus Sliepen
b455111184 Make MSS clamping configurable, but enabled by default. 
It can either be set globally in tinc.conf, or per-node in host config files.
 2010-01-16 20:16:33 +01:00
Guus Sliepen
edebf579f2 Use the TCP socket infrastructure for control sockets. 
The control socket code was completely different from how meta connections are
handled, resulting in lots of extra code to handle requests.  Also, not every
operating system has UNIX sockets, so we have to resort to another type of
sockets or pipes for those anyway.  To reduce code duplication and make control
sockets work the same on all platforms, we now just connect to the TCP port
where tincd is already listening on.

To authenticate, the program that wants to control a running tinc daemon must
send the contents of a cookie file. The cookie is a random 256 bits number that
is regenerated every time tincd starts. The cookie file should only be readable
by the same user that can start a tincd.

Instead of the binary-ish protocol previously used, we now use an ASCII
protocol similar to that of the meta connections, but this can still change.
 2009-11-07 23:43:25 +01:00
Guus Sliepen
108b238915 Merge branch 'master' into 1.1 
Conflicts:
	NEWS
	README
	configure.in
	doc/tinc.texi
	doc/tincd.8.in
	src/Makefile.am
	src/connection.c
	src/edge.c
	src/meta.c
	src/net.c
	src/net.h
	src/net_packet.c
	src/net_setup.c
	src/net_socket.c
	src/node.c
	src/openssl/rsagen.h
	src/protocol_auth.c
	src/protocol_edge.c
	src/subnet.c
 2009-11-02 14:24:27 +01:00
Guus Sliepen
5cbddc68ba Use uint32_t instead of long int for connection options. 
Options should have a fixed width anyway, but this also fixes a possible MinGW
compiler bug where %lx tries to print a 64 bit value, even though a long int is
only 32 bits.
 2009-10-24 16:15:24 +02:00
Guus Sliepen
07a560eab6 Drop localisation and checkpoint tracing in files not covered by the merge. 2009-09-29 15:19:55 +02:00
Guus Sliepen
7ea85043ac Merge branch 'master' into 1.1 
Conflicts:
	NEWS
	configure.in
	lib/Makefile.am
	lib/pidfile.c
	lib/pidfile.h
	lib/utils.c
	po/POTFILES.in
	po/nl.po
	src/Makefile.am
	src/bsd/device.c
	src/conf.c
	src/connection.c
	src/cygwin/device.c
	src/edge.c
	src/event.c
	src/graph.c
	src/linux/device.c
	src/meta.c
	src/mingw/device.c
	src/net.c
	src/net_packet.c
	src/net_setup.c
	src/net_socket.c
	src/netutl.c
	src/node.c
	src/process.c
	src/protocol.c
	src/protocol_auth.c
	src/protocol_edge.c
	src/protocol_key.c
	src/protocol_misc.c
	src/protocol_subnet.c
	src/raw_socket/device.c
	src/route.c
	src/solaris/device.c
	src/subnet.c
	src/tincd.c
	src/uml_socket/device.c
 2009-09-29 14:55:29 +02:00
Guus Sliepen
4c85542894 Drop support for localisation. 
Localised messages don't make much sense for a daemon, and there is only the
Dutch translation which costs time to maintain.
 2009-09-25 00:54:07 +02:00
Guus Sliepen
a227843b73 Remove checkpoint tracing. 
This feature is not necessary anymore since we have tools like valgrind today
that can catch stack overflow errors before they make a backtrace in gdb
impossible.
 2009-09-25 00:33:04 +02:00
Guus Sliepen
5dde6461a3 K&R style braces. 
This is essentially commit f02d3ed3e1 from the
1.1 branch, making it easier to merge between master and 1.1.
 2009-09-25 00:14:03 +02:00
Guus Sliepen
ab7c61b06f Update the address of the Free Software Foundation in all copyright headers. 2009-09-25 00:01:00 +02:00
Guus Sliepen
c217d214f4 Remove all occurences of $Id$. 2009-09-24 23:39:16 +02:00
Guus Sliepen
4124b9682f Handle truncated message authentication codes. 2009-06-06 19:04:04 +02:00
Guus Sliepen
5a132550de Merge branch 'master' into 1.1 
Conflicts:
	doc/tincd.8.in
	lib/pidfile.c
	src/graph.c
	src/net.c
	src/net.h
	src/net_packet.c
	src/net_setup.c
	src/net_socket.c
	src/netutl.c
	src/node.c
	src/node.h
	src/protocol_auth.c
	src/protocol_key.c
	src/tincd.c
 2009-06-05 23:14:13 +02:00
Guus Sliepen
7034338bc3 Use xrealloc instead of if(ptr) ptr = xmalloc(). 2009-05-24 19:35:51 +02:00
Guus Sliepen
08aabbf931 Merge branch 'master' into 1.1 
Conflicts:
	NEWS
	README
	doc/tinc.conf.5.in
	doc/tinc.texi
	po/nl.po
	src/conf.c
	src/connection.c
	src/event.c
	src/graph.c
	src/net.c
	src/net_packet.c
	src/net_socket.c
	src/node.c
	src/node.h
	src/openssl/rsagen.h
	src/protocol_auth.c
	src/protocol_key.c
	src/protocol_misc.c
	src/subnet.c
	src/subnet.h
	src/tincd.c
 2009-03-09 19:02:24 +01:00
Guus Sliepen
d5b56bbba5 Disable PMTUDiscovery in switch and hub modes. 
In switch and hub modes, tinc does not generate ICMP packets in response to
packets that are larger than the path MTU.  However, if PMTUDiscovery is
enabled, the IP_MTU_DISCOVER and IPV6_MTU_DISCOVER option is set on the UDP
sockets, which causes all UDP packets to be sent with the DF bit set, causing
large packets to be dropped, even if they would otherwise be routed fine.
 2009-03-09 13:48:54 +01:00
Guus Sliepen
78fc59e994 Update THANKS and copyright information. 2009-03-05 14:12:36 +01:00
Michael Tokarev
76a1bcaffc Enable PMTUDiscovery only if BOTH sides wants it. 
Don't enable PMTUDiscovery if at least one side does not support it.
Before it was enabled if at least one side supported it, now both are required.
 2009-03-04 21:12:20 +01:00
Guus Sliepen
0e4d419aae Enable PMTU discovery by default. 2008-12-22 20:35:45 +00:00
Guus Sliepen
e9576632dc Update copyright information. 2008-12-22 20:27:52 +00:00
Guus Sliepen
76165488f8 Backport fixes from trunk since revision 1555. 2008-12-11 15:21:40 +00:00
Guus Sliepen
046158a216 Use the crypto wrappers again instead of calling OpenSSL directly. 
This theoretically allows other cryptographic libraries to be used,
and it improves the readability of the code.
 2008-12-11 14:44:44 +00:00
Guus Sliepen
38c2d6c1da Correct debug message. 2008-12-05 14:17:39 +00:00
Scott Lamb
40731d030f Temporarily revert to old crypto code 
(The new code is still segfaulting for me, and I'd like to proceed with other
work.)

This largely rolls back to the revision 1545 state of the existing code
(new crypto layer is still there with no callers), though I reintroduced
the segfault fix of revision 1562.
 2007-11-07 02:47:05 +00:00
Guus Sliepen
269892f70b Prevent double free() of a used challenge nonce. 2007-10-20 11:21:44 +00:00
Guus Sliepen
54892b2e3e Fix connection weight estimation. 2007-10-19 18:53:48 +00:00
Guus Sliepen
1b8f891836 Finish crypto wrapping. Also provide wrappers for OpenSSL. 
Disable libgcrypt by default. Since it doesn't support the OFB cipher mode,
we can't use it in a backwards compatible way.
 2007-05-23 13:45:49 +00:00
Guus Sliepen
465837dd7f Parse PEM RSA keys ourself, and use libgcrypt to do RSA encryption and decryption. 2007-05-20 22:28:49 +00:00
Guus Sliepen
fbf305c09d Use libevent for meta socket input/output buffering. 2007-05-19 22:23:02 +00:00
Guus Sliepen
29fbce4497 Detect duplicate outgoing connections. 2007-05-18 10:29:10 +00:00
Guus Sliepen
fb0cfccf7d Use splay trees instead of AVL trees. 2007-05-18 10:05:26 +00:00
Guus Sliepen
f02d3ed3e1 K&R style braces 2007-05-18 10:00:00 +00:00
Guus Sliepen
6ea1dfc995 Port fixes from release 1.0.8. 2007-05-17 19:15:48 +00:00
Guus Sliepen
480dd127c8 Make sure connection->name is never NULL. 2007-05-16 14:42:08 +00:00
Guus Sliepen
de78d79db8 Update copyright notices, remove Ivo's email address. 2006-04-26 13:52:58 +00:00
Guus Sliepen
af95368c0f Fix signedness compiler warnings. 2006-03-19 13:06:21 +00:00
Guus Sliepen
e810545dc2 Prevent possible buffer overflows when using very large (>= 8192 bit) RSA keys. 
Thanks to Tonnerre Lombard for noticing!
 2005-06-03 10:16:03 +00:00
Guus Sliepen
df3220a154 Update copyright notices. 2005-05-04 18:09:30 +00:00
Guus Sliepen
dc09f6fe89 Be on the safe side with initialisation of c->name. 2005-05-04 15:51:45 +00:00
Guus Sliepen
7926a156e5 Update copyrights, links, email addresses and let Subversion update $Id$ keywords. 2004-03-21 14:21:22 +00:00
Guus Sliepen
35399784b6 Improvements for PMTU discovery and IPv4 packet fragmentation. 2003-12-22 11:04:17 +00:00
Guus Sliepen
6d41b429a2 Better name, show probed MTU in dump. 2003-12-20 21:25:17 +00:00
Guus Sliepen
9bab08e972 More sensible name, and try to set PMTU discovery on IPv6 sockets as well. 2003-12-20 21:09:33 +00:00
Guus Sliepen
6b12bea62f Let tinc figure out the exact MTU of the link. 2003-12-20 19:47:53 +00:00
Guus Sliepen
e3220cacb5 Replace Opaque and Strict options with a TunnelServer option. 2003-11-17 15:30:18 +00:00
Guus Sliepen
0e59fb022c Add Opaque option which prevent information from being forwarded to certain nodes. 2003-11-10 22:31:53 +00:00
Guus Sliepen
258b7ce220 Parentheses in the wrong spots. 2003-10-11 12:28:48 +00:00
Guus Sliepen
a1ab57e275 Check all EVP_ function calls. 2003-10-11 12:16:13 +00:00
Guus Sliepen
6c5f3d8b74 We don't have to tell GCC how to cast. 2003-08-28 21:05:11 +00:00
Guus Sliepen
eefa28059a Use bools and enums where appropriate. 2003-07-22 20:55:21 +00:00
Guus Sliepen
e449d94cae Big header file cleanup: everything that has to do with standard system 
libraries is moved to system.h.
 2003-07-17 15:06:27 +00:00
Guus Sliepen
5db596c684 Simplify logging, update copyrights and some minor cleanups. 2003-07-12 17:41:48 +00:00
Guus Sliepen
1401faf608 Sprinkling the source with static and attributes. 2003-07-06 23:16:29 +00:00
Guus Sliepen
0b9175e998 Define logger(), cleans up source code and allows us to write log entries 
to a separate file.
 2003-07-06 22:11:37 +00:00
Guus Sliepen
81f5713ab7 - simplify configure.in 
- drop support for OpenSSL < 0.9.7
- add some missing definitions/includes
 2003-07-06 17:15:25 +00:00
Guus Sliepen
c08858baa9 - Fix indentation in some places. 
- Optimise select loop.
- Remove unused function setup_outgoing_socket().
- Clear EVP_CIPHER_CTX structures before using them.
 2003-01-17 00:37:20 +00:00
Guus Sliepen
44b87ddb7a Run graph algorithm when replacing a second connection from the same host 
replaces an older one.
 2003-01-12 17:02:23 +00:00
Guus Sliepen
6f9f6779e6 Remove redundant spaces. 2002-09-09 22:33:31 +00:00
Guus Sliepen
f75dcef72a Switch to K&R style indentation. 2002-09-09 21:25:28 +00:00
Guus Sliepen
5fc1ed17f4 Cleanups: 
- Convert cp to cp(); so that automatic indenters work.
 - Convert constructions like if(x == NULL) to if(!x).
 - Move all assignments out of conditions.
 2002-09-09 19:40:12 +00:00
Guus Sliepen
8b2b67e26c Generalized request broadcasting/forwarding. 2002-09-04 16:26:45 +00:00
Guus Sliepen
431fa10b37 Small fixes. 2002-09-04 14:17:28 +00:00
Guus Sliepen
82ebfc923d Revert to edge and graph stuff. This time, use a directed graph. 2002-09-04 13:48:52 +00:00
Guus Sliepen
2af0bcc8fd Don't forget to set prevhop to myself for new connections. 2002-09-04 08:36:34 +00:00
Guus Sliepen
d134c4542d Drop graph and edge stuff. Use new node stuff instead. 2002-09-03 20:43:26 +00:00
Guus Sliepen
627f7c22b4 s/sliepen.warande.net/sliepen.eu.org/g 
s/itimmermans@bigfoot.com/ivo@o2w.nl/g
 2002-06-21 10:11:37 +00:00
Guus Sliepen
c6d2f6c620 Remove cruft. 2002-03-27 15:26:44 +00:00
Guus Sliepen
594d5b5d15 Reset retry timeout when receiving the first PONG, not right after receiving the ACK. 2002-03-23 20:21:10 +00:00
Guus Sliepen
ccea26e004 send_ack() was broken. 2002-03-23 20:01:05 +00:00
Guus Sliepen
3c5655f59e Fix compiler warnings, strictly use long int and %lx for options. 2002-03-22 13:31:18 +00:00
Guus Sliepen
52e7699273 - Added support for jumbograms. 
- Remove tcpaddress from edges, it is not used at all.
- Last bits of code to prevent looping requests.
 2002-03-22 11:43:48 +00:00
Guus Sliepen
c6d0158831 Protocol now also exchanges cipher/digest/maclength/compression for the 
meta connection.
 2002-02-20 19:25:09 +00:00
Guus Sliepen
c2b9c06062 - Non-blocking connect()s. 
- Socket handling revamped to use sockaddr_t.
- tinc can now tunnel over IPv6.
- Handle all addresses and subnets in network byte order.
  Only convert them when they need to be printed.
- IPv6 subnets bigger than /128 now work.
- Use %s and strerror(errno) instead of %m.
 2002-02-18 16:25:19 +00:00
Guus Sliepen
5bf4b88666 Forgot to merge new files from pre5. 2002-02-11 10:05:58 +00:00