lagertonne/tinc
1
0
Fork 0
Code Issues Pull requests Projects Releases 6 Wiki Activity

Import Upstream version 1.1~pre6

Browse source
This commit is contained in:
Guus Sliepen 2019-08-26 13:44:50 +02:00
parent ff64081061
commit 26033edb96
52 changed files with 3850 additions and 14921 deletions
Download patch file Download diff file Expand all files Collapse all files

19
doc/tinc.conf.5.in
View file

@ -1,4 +1,4 @@
.Dd 2012-09-27
.Dd 2013-01-14
.Dt TINC.CONF 5
.\" Manual page created by:
.\" Ivo Timmermans
@ -343,7 +343,7 @@ This option selects the way packets are routed to other daemons.
In this mode
.Va Subnet
variables in the host configuration files will be used to form a routing table.
Only unicast packets of routable protocols (IPv4 and IPv6) are supported in this mode.
Only packets of routable protocols (IPv4 and IPv6) are supported in this mode.
.Pp
This is the default mode, and unless you really know you need another mode, don't change it.
.It switch
@ -361,7 +361,7 @@ while no routing table is managed.
.It Va Name Li = Ar name Bq required
This is the name which identifies this tinc daemon.
It must be unique for the virtual private network this daemon will connect to.
The Name may only consist of alphanumeric and underscore characters.
The Name may only consist of alphanumeric and underscore characters (a-z, A-Z, 0-9 and _), and is case sensitive.
If
.Va Name
starts with a
@ -372,7 +372,7 @@ If
.Va Name
is
.Li $HOST ,
but no such environment variable exist, the hostname will be read using the gethostnname() system call.
but no such environment variable exist, the hostname will be read using the gethostname() system call.
.It Va PingInterval Li = Ar seconds Pq 60
The number of seconds of inactivity that
.Nm tinc
@ -428,7 +428,7 @@ and
are available.
.El
.It Va ReplayWindow Li = Ar bytes Pq 16
vhis is the size of the replay tracking window for each remote node, in bytes.
This is the size of the replay tracking window for each remote node, in bytes.
The window is a bitfield which tracks 1 packet per bit, so for example
the default setting of 16 will track up to 128 packets in the window. In high
bandwidth scenarios, setting this to a higher value can reduce packet loss from
@ -497,12 +497,9 @@ Furthermore, specifying
.Qq none
will turn off packet authentication.
.It Va IndirectData Li = yes | no Pq no
This option specifies whether other tinc daemons besides the one you specified with
.Va ConnectTo
can make a direct connection to you.
This is especially useful if you are behind a firewall
and it is impossible to make a connection from the outside to your tinc daemon.
Otherwise, it is best to leave this option out or set it to no.
When set to yes, other nodes which do not already have a meta connection to you
will not try to establish direct communication with you.
It is best to leave this option out or set it to no.
.It Va MACLength Li = Ar length Pq 4
The length of the message authentication code used to authenticate UDP packets.
Can be anything from

177
doc/tinc.info
View file

@ -5,10 +5,10 @@ START-INFO-DIR-ENTRY
* tinc: (tinc). The tinc Manual.
END-INFO-DIR-ENTRY
This is the info manual for tinc version 1.1pre4, a Virtual Private
This is the info manual for tinc version 1.1pre5, a Virtual Private
Network daemon.
Copyright (C) 1998-2012 Ivo Timmermans, Guus Sliepen
Copyright (C) 1998-2013 Ivo Timmermans, Guus Sliepen
<guus@tinc-vpn.org> and Wessel Dankers <wsl@tinc-vpn.org>.
Permission is granted to make and distribute verbatim copies of this
@ -989,9 +989,8 @@ Mode = <router|switch|hub> (router)
router
In this mode Subnet variables in the host configuration files
will be used to form a routing table. Only unicast packets
of routable protocols (IPv4 and IPv6) are supported in this
mode.
will be used to form a routing table. Only packets of
routable protocols (IPv4 and IPv6) are supported in this mode.
This is the default mode, and unless you really know you need
another mode, don't change it.
@ -1026,13 +1025,13 @@ MACExpire = <SECONDS> (600)
Name = <NAME> [required]
This is a symbolic name for this connection. The name should
consist only of alfanumeric and underscore characters (a-z, A-Z,
0-9 and _).
0-9 and _), and is case sensitive.
If Name starts with a $, then the contents of the environment
variable that follows will be used. In that case, invalid
characters will be converted to underscores. If Name is $HOST,
but no such environment variable exist, the hostname will be read
using the gethostnname() system call.
using the gethostname() system call.
PingInterval = <SECONDS> (60)
The number of seconds of inactivity that tinc will wait before
@ -1157,12 +1156,9 @@ Digest = <DIGEST> (sha1)
"none" will turn off packet authentication.
IndirectData = <yes|no> (no)
This option specifies whether other tinc daemons besides the one
you specified with ConnectTo can make a direct connection to you.
This is especially useful if you are behind a firewall and it is
impossible to make a connection from the outside to your tinc
daemon. Otherwise, it is best to leave this option out or set it
to no.
When set to yes, other nodes which do not already have a meta
connection to you will not try to establish direct communication
with you. It is best to leave this option out or set it to no.
MACLength = <BYTES> (4)
The length of the message authentication code used to authenticate
@ -1412,10 +1408,11 @@ copy&paste the email:
If you are the owner of bar yourself, and you have SSH access to
that computer, you can also swap the host configuration files using the
following commands:
following command:
tincctl -n NETNAME export | ssh bar.example.org tincctl -n NETNAME import
ssh bar.example.org tincctl -n NETNAME export | tincctl -n NETNAME import
tincctl -n NETNAME export \
| ssh bar.example.org tincctl -n NETNAME exchange \
| tincctl -n NETNAME import
You should repeat this for all nodes you ConnectTo, or which
ConnectTo you. However, remember that you do not need to ConnectTo all
@ -1722,6 +1719,8 @@ command line options.
shared private keys to be written to the system swap
files/partitions.
This option is not supported on all platforms.
`--logfile[=FILE]'
Write log entries to a file instead of to the system logging
facility. If FILE is omitted, the default is
@ -1744,11 +1743,15 @@ command line options.
or host-up), unless it's setup to be runnable inside chroot
environment.
This option is not supported on all platforms.
`-U, --user=USER'
Switch to the given USER after initialization, at the same time as
chroot is performed (see -chroot above). With this option tinc
drops privileges, for added security.
This option is not supported on all platforms.
`--help'
Display a short reminder of these runtime options and terminate.
@ -2077,9 +2080,15 @@ File: tinc.info, Node: tincctl commands, Next: tincctl examples, Prev: tincct
Export all host configuration files to standard output.
`import [--force]'
Import host configuration file(s) from standard input. Already
existing host configuration files are not overwritten unless the
option -force is used.
Import host configuration file(s) generated by the tincctl export
command from standard input. Already existing host configuration
files are not overwritten unless the option -force is used.
`exchange [--force]'
The same as export followed by import.
`exchange-all [--force]'
The same as export-all followed by import.
`start [tincd options]'
Start `tincd', optionally with the given extra options.
@ -2840,7 +2849,7 @@ Concept Index
* CHALLENGE: Authentication protocol.
(line 10)
* CIDR notation: Host configuration variables.
(line 91)
(line 88)
* Cipher: Host configuration variables.
(line 12)
* ClampMSS: Host configuration variables.
@ -2882,7 +2891,7 @@ Concept Index
* example: Example configuration.
(line 6)
* exec: Main configuration variables.
(line 322)
(line 321)
* ExperimentalProtocol: Main configuration variables.
(line 164)
* Forwarding: Main configuration variables.
@ -2891,9 +2900,9 @@ Concept Index
* Hostnames: Main configuration variables.
(line 193)
* http: Main configuration variables.
(line 319)
(line 318)
* hub: Main configuration variables.
(line 246)
(line 245)
* ID: Authentication protocol.
(line 10)
* IndirectData: Host configuration variables.
@ -2904,7 +2913,7 @@ Concept Index
* IRC: Contact information. (line 9)
* KEY_CHANGED: The meta-protocol. (line 64)
* KeyExpire: Main configuration variables.
(line 251)
(line 250)
* libcurses: libcurses. (line 6)
* libraries: Libraries. (line 6)
* libreadline: libreadline. (line 6)
@ -2913,9 +2922,9 @@ Concept Index
(line 212)
* lzo: lzo. (line 6)
* MACExpire: Main configuration variables.
(line 257)
(line 256)
* MACLength: Host configuration variables.
(line 42)
(line 39)
* meta-protocol: The meta-connection. (line 18)
* META_KEY: Authentication protocol.
(line 10)
@ -2926,7 +2935,7 @@ Concept Index
* multiple networks: Multiple networks. (line 6)
* NAME: Scripts. (line 52)
* Name: Main configuration variables.
(line 262)
(line 261)
* netmask: Network interfaces. (line 39)
* NETNAME <1>: tincctl environment variables.
(line 6)
@ -2938,44 +2947,44 @@ Concept Index
* OpenSSL: OpenSSL. (line 6)
* options: Runtime options. (line 9)
* PEM format: Host configuration variables.
(line 67)
(line 64)
* PING: The meta-protocol. (line 89)
* PingInterval: Main configuration variables.
(line 273)
(line 272)
* PingTimeout: Main configuration variables.
(line 277)
(line 276)
* platforms: Supported platforms. (line 6)
* PMTU: Host configuration variables.
(line 47)
(line 44)
* PMTUDiscovery: Host configuration variables.
(line 50)
(line 47)
* PONG: The meta-protocol. (line 89)
* Port: Host configuration variables.
(line 55)
(line 52)
* port numbers: Other files. (line 17)
* PriorityInheritance: Main configuration variables.
(line 283)
(line 282)
* private: Virtual Private Networks.
(line 10)
* PrivateKey: Main configuration variables.
(line 288)
(line 287)
* PrivateKeyFile: Main configuration variables.
(line 294)
(line 293)
* ProcessPriority: Main configuration variables.
(line 299)
(line 298)
* Proxy: Main configuration variables.
(line 304)
(line 303)
* PublicKey: Host configuration variables.
(line 59)
(line 56)
* PublicKeyFile: Host configuration variables.
(line 62)
(line 59)
* raw_socket: Main configuration variables.
(line 100)
* release: Supported platforms. (line 14)
* REMOTEADDRESS: Scripts. (line 67)
* REMOTEPORT: Scripts. (line 70)
* ReplayWindow: Main configuration variables.
(line 327)
(line 326)
* REQ_KEY: The meta-protocol. (line 64)
* requirements: Libraries. (line 6)
* router: Main configuration variables.
@ -2987,20 +2996,20 @@ Concept Index
(line 18)
* signals: Signals. (line 6)
* socks4: Main configuration variables.
(line 308)
(line 307)
* socks5: Main configuration variables.
(line 313)
(line 312)
* StrictSubnets: Main configuration variables.
(line 338)
(line 337)
* SUBNET: Scripts. (line 74)
* Subnet: Host configuration variables.
(line 74)
(line 71)
* SVPN: Security. (line 11)
* switch: Main configuration variables.
(line 235)
(line 234)
* TCP: The meta-connection. (line 10)
* TCPonly: Host configuration variables.
(line 103)
(line 100)
* TINC: Security. (line 6)
* tinc: Introduction. (line 6)
* tinc-down: Scripts. (line 18)
@ -3011,16 +3020,16 @@ Concept Index
* tunifhead: Main configuration variables.
(line 142)
* TunnelServer: Main configuration variables.
(line 343)
(line 342)
* tunnohead: Main configuration variables.
(line 136)
* UDP <1>: Encryption of network packets.
(line 12)
* UDP: The UDP tunnel. (line 30)
* UDPRcvBuf: Main configuration variables.
(line 350)
(line 349)
* UDPSndBuf: Main configuration variables.
(line 355)
(line 354)
* UML: Main configuration variables.
(line 118)
* Universal tun/tap: Configuration of Linux kernels.
@ -3073,39 +3082,39 @@ Node: Multiple networks23835
Node: How connections work25215
Node: Configuration files27788
Node: Main configuration variables29321
Node: Host configuration variables45731
Node: Scripts50961
Node: How to configure53640
Node: Network interfaces58258
Node: Example configuration60659
Node: Running tinc65811
Node: Runtime options66404
Node: Signals69108
Node: Debug levels69958
Node: Solving problems70894
Node: Error messages72324
Node: Sending bug reports76646
Node: Controlling tinc77598
Node: tincctl runtime options77995
Node: tincctl environment variables78694
Node: tincctl commands79038
Node: tincctl examples83343
Node: tincctl top83948
Node: Technical information85546
Node: The connection85781
Node: The UDP tunnel86093
Node: The meta-connection89154
Node: The meta-protocol90623
Node: Security95632
Node: Authentication protocol96762
Node: Encryption of network packets101766
Node: Security issues103139
Node: Platform specific information104756
Node: Interface configuration104984
Node: Routes107437
Node: About us109353
Node: Contact information109528
Node: Authors109932
Node: Concept Index110337
Node: Host configuration variables45735
Node: Scripts50810
Node: How to configure53489
Node: Network interfaces58079
Node: Example configuration60480
Node: Running tinc65632
Node: Runtime options66225
Node: Signals69088
Node: Debug levels69938
Node: Solving problems70874
Node: Error messages72304
Node: Sending bug reports76626
Node: Controlling tinc77578
Node: tincctl runtime options77975
Node: tincctl environment variables78674
Node: tincctl commands79018
Node: tincctl examples83503
Node: tincctl top84108
Node: Technical information85706
Node: The connection85941
Node: The UDP tunnel86253
Node: The meta-connection89314
Node: The meta-protocol90783
Node: Security95792
Node: Authentication protocol96922
Node: Encryption of network packets101926
Node: Security issues103299
Node: Platform specific information104916
Node: Interface configuration105144
Node: Routes107597
Node: About us109513
Node: Contact information109688
Node: Authors110092
Node: Concept Index110497

End Tag Table

38
doc/tinc.texi
View file

@ -15,7 +15,7 @@
This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.
Copyright @copyright{} 1998-2012 Ivo Timmermans,
Copyright @copyright{} 1998-2013 Ivo Timmermans,
Guus Sliepen <guus@@tinc-vpn.org> and
Wessel Dankers <wsl@@tinc-vpn.org>.
@ -39,7 +39,7 @@ permission notice identical to this one.
@vskip 0pt plus 1filll
This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.
Copyright @copyright{} 1998-2012 Ivo Timmermans,
Copyright @copyright{} 1998-2013 Ivo Timmermans,
Guus Sliepen <guus@@tinc-vpn.org> and
Wessel Dankers <wsl@@tinc-vpn.org>.
@ -1063,7 +1063,7 @@ This option selects the way packets are routed to other daemons.
@item router
In this mode Subnet
variables in the host configuration files will be used to form a routing table.
Only unicast packets of routable protocols (IPv4 and IPv6) are supported in this mode.
Only packets of routable protocols (IPv4 and IPv6) are supported in this mode.
This is the default mode, and unless you really know you need another mode, don't change it.
@ -1098,12 +1098,12 @@ This only has effect when Mode is set to "switch".
@cindex Name
@item Name = <@var{name}> [required]
This is a symbolic name for this connection.
The name should consist only of alfanumeric and underscore characters (a-z, A-Z, 0-9 and _).
The name should consist only of alfanumeric and underscore characters (a-z, A-Z, 0-9 and _), and is case sensitive.
If Name starts with a $, then the contents of the environment variable that follows will be used.
In that case, invalid characters will be converted to underscores.
If Name is $HOST, but no such environment variable exist,
the hostname will be read using the gethostnname() system call.
the hostname will be read using the gethostname() system call.
@cindex PingInterval
@item PingInterval = <@var{seconds}> (60)
@ -1242,11 +1242,9 @@ Furthermore, specifying "none" will turn off packet authentication.
@cindex IndirectData
@item IndirectData = <yes|no> (no)
This option specifies whether other tinc daemons besides the one you
specified with ConnectTo can make a direct connection to you. This is
especially useful if you are behind a firewall and it is impossible to
make a connection from the outside to your tinc daemon. Otherwise, it
is best to leave this option out or set it to no.
When set to yes, other nodes which do not already have a meta connection to you
will not try to establish direct communication with you.
It is best to leave this option out or set it to no.
@cindex MACLength
@item MACLength = <@var{bytes}> (4)
@ -1515,11 +1513,12 @@ tincctl -n @var{netname} import
@end example
If you are the owner of bar yourself, and you have SSH access to that computer,
you can also swap the host configuration files using the following commands:
you can also swap the host configuration files using the following command:
@example
tincctl -n @var{netname} export | ssh bar.example.org tincctl -n @var{netname} import
ssh bar.example.org tincctl -n @var{netname} export | tincctl -n @var{netname} import
tincctl -n @var{netname} export \
| ssh bar.example.org tincctl -n @var{netname} exchange \
| tincctl -n @var{netname} import
@end example
You should repeat this for all nodes you ConnectTo, or which ConnectTo you.
@ -1849,6 +1848,8 @@ This option can be used more than once to specify multiple configuration variabl
Lock tinc into main memory.
This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
This option is not supported on all platforms.
@item --logfile[=@var{file}]
Write log entries to a file instead of to the system logging facility.
If @var{file} is omitted, the default is @file{@value{localstatedir}/log/tinc.@var{netname}.log}.
@ -1869,11 +1870,14 @@ Note that this option alone does not do any good without -U/--user, below.
Note also that tinc can't run scripts anymore (such as tinc-down or host-up),
unless it's setup to be runnable inside chroot environment.
This option is not supported on all platforms.
@item -U, --user=@var{user}
Switch to the given @var{user} after initialization, at the same time as
chroot is performed (see --chroot above). With this option tinc drops
privileges, for added security.
This option is not supported on all platforms.
@item --help
Display a short reminder of these runtime options and terminate.
@ -2196,9 +2200,15 @@ Export the host configuration file of the local node to standard output.
Export all host configuration files to standard output.
@item import [--force]
Import host configuration file(s) from standard input.
Import host configuration file(s) generated by the tincctl export command from standard input.
Already existing host configuration files are not overwritten unless the option --force is used.
@item exchange [--force]
The same as export followed by import.
@item exchange-all [--force]
The same as export-all followed by import.
@item start [tincd options]
Start @samp{tincd}, optionally with the given extra options.

12
doc/tincctl.8.in
View file

@ -1,4 +1,4 @@
.Dd 2012-10-14
.Dd 2013-01-15
.Dt TINCCTL 8
.\" Manual page created by:
.\" Scott Lamb
@ -80,10 +80,16 @@ Export the host configuration file of the local node to standard output.
.It export-all
Export all host configuration files to standard output.
.It import Op Fl -force
Import host configuration file(s) from standard input.
Import host configuration data generated by the
.Nm
export command from standard input.
Already existing host configuration files are not overwritten unless the option
.Fl -force
is used.
.It exchange Op Fl -force
The same as export followed by import.
.It exchange-all Op Fl -force
The same as export-all followed by import.
.It start Op tincd options
Start
.Xr tincd 8 ,
@ -206,7 +212,7 @@ Fractional seconds are honored.
Intervals lower than 0.1 seconds are not allowed.
.It Ic c
Toggle between displaying current traffic rates (in packets and bytes per second)
and cummulative traffic (total packets and bytes since the tinc daemon started).
and cumulative traffic (total packets and bytes since the tinc daemon started).
.It Ic n
Sort the list of nodes by name.
.It Ic i

5
doc/tincd.8.in
View file

@ -1,4 +1,4 @@
.Dd 2012-02-22
.Dd 2013-01-14
.Dt TINCD 8
.\" Manual page created by:
.\" Ivo Timmermans
@ -81,6 +81,7 @@ This option can be used more than once to specify multiple configuration variabl
.It Fl L, -mlock
Lock tinc into main memory.
This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
This option is not supported on all platforms.
.It Fl -logfile Ns Op = Ns Ar FILE
Write log entries to a file instead of to the system logging facility.
If
@ -104,10 +105,12 @@ Only useful for debugging.
With this option tinc chroots into the directory where network
config is located (@sysconfdir@/tinc/NETNAME if -n option is used,
or to the directory specified with -c option) after initialization.
This option is not supported on all platforms.
.It Fl U, -user Ns = Ns Ar USER
setuid to the specified
.Ar USER
after initialization.
This option is not supported on all platforms.
.It Fl -help
Display short list of options.
.It Fl -version