Import Upstream version 1.0.35

2019-08-26 13:44:49 +02:00 · 2019-08-26 13:44:49 +02:00 · a04a7bcd67
commit a04a7bcd67
parent b28bb7b29b
44 changed files with 4173 additions and 2323 deletions
--- a/23
+++ b/23
@ -1,3 +1,26 @@
+Version 1.0.35                                           October 05 2018
+------------------------------------------------------------------------
+
+Guus Sliepen (12):
+      Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738)
+      Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758)
+      Check the return value from snprintf().
+      Check the return values from BN_hex2bn() and RAND_load_file().
+      Fix all warnings when compiling with -Wall -W -pedantic.
+      Fix two small memory leaks.
+      Don't check for NULL-pointers before calling free().
+      Update THANKS.
+      Fix checks for Cygwin-related macros.
+      Fix spelling errors.
+      Update README and links to required libraries.
+      Releasing 1.0.35.
+
+AMRI Amine (1):
+      Fixing typo
+
+Rafael Sadowski (1):
+      OpenBSD has a proper tap device.
+
 Version 1.0.34                                              June 12 2018
 ------------------------------------------------------------------------

--- a/Makefile.in
+++ b/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.1 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2018 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -141,7 +141,7 @@ am__recursive_targets = \
  $(RECURSIVE_CLEAN_TARGETS) \
  $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	cscope distdir dist dist-all distcheck
+	cscope distdir distdir-am dist dist-all distcheck
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
 	$(LISP)config.h.in
 # Read a list of newline-separated strings from the standard input,
@ -166,7 +166,7 @@ CSCOPE = cscope
 DIST_SUBDIRS = $(SUBDIRS)
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in AUTHORS \
 	COPYING ChangeLog INSTALL NEWS README THANKS compile \
-	config.guess config.sub depcomp install-sh missing
+	config.guess config.sub install-sh missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@ -335,8 +335,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' $(SHELL) ./config.status'; \
 	    $(SHELL) ./config.status;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -469,7 +469,10 @@ distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files

-distdir: $(DISTFILES)
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
 	@case `sed 15q $(srcdir)/NEWS` in \
 	*"$(VERSION)"*) : ;; \
 	*) \
--- a/5
+++ b/5
@ -1,3 +1,8 @@
+Version 1.0.35               October 5 2018
+
+ * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
+ * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).
+
 Version 1.0.34               June 12 2018

 * Fix a potential segmentation fault when connecting to an IPv6 peer via a
--- a/43
+++ b/43
@ -1,4 +1,4 @@
-This is the README file for tinc version 1.0.34. Installation
+This is the README file for tinc version 1.0.35. Installation
 instructions may be found in the INSTALL file.

 tinc is Copyright (C) 1998-2018 by:
@ -41,24 +41,25 @@ issues are being addressed in the tinc 1.1 branch.

 The Sweet32 attack affects versions of tinc prior to 1.0.30.

+On September 6th, 2018, Michael Yonly contacted us and provided
+proof-of-concept code that allowed a remote attacker to create an
+authenticated, one-way connection with a node, and also that there was a
+possibility for a man-in-the-middle to force UDP packets from a node to be sent
+in plaintext. The first issue was trivial to exploit on tinc versions prior to
+1.0.30, but the changes in 1.0.30 to mitigate the Sweet32 attack made this
+weakness much harder to exploit. These issues have been fixed in tinc 1.0.35.
+The new protocol in the tinc 1.1 branch is not susceptible to these issues.
+
 Cryptography is a hard thing to get right. We cannot make any
 guarantees. Time, review and feedback are the only things that can
 prove the security of any cryptographic product. If you wish to review
 tinc or give us feedback, you are strongly encouraged to do so.


-Changes to configuration file format since 1.0pre5
--------------------------------------------------
-
-Some configuration variables have different names now. Most notably "TapDevice"
-should be changed into "Device", and "Device" should be changed into
-"BindToDevice".
-
-
 Compatibility
 -------------

-Version 1.0.31 is compatible with 1.0pre8, 1.0 and later, but not with older
+Version 1.0.35 is compatible with 1.0pre8, 1.0 and later, but not with older
 versions of tinc. Note that since version 1.0.30, tinc requires all nodes in
 the VPN to be compiled with a version of LibreSSL or OpenSSL that supports the
 AES256 and SHA256 algorithms.
@ -67,21 +68,21 @@ AES256 and SHA256 algorithms.
 Requirements
 ------------

-Since 1.0pre3, we use OpenSSL for all cryptographic functions.  So you need to
-install this library first; grab it from http://www.openssl.org/. You will
-need version 1.0.1 or later with support for AES256 and SHA256 enabled. If
-this library is not installed on you system, configure will fail. The manual
-in doc/tinc.texi contains more detailed information on how to install this
-library. Alternatively, you may also use LibreSSL.
+The OpenSSL library is used for all cryptographic functions. You can find it at
+https://www.openssl.org/. You will need version 1.0.1 or later with support for
+AES256 and SHA256 enabled. If this library is not installed on your system, the
+configure script will fail.  The manual in doc/tinc.texi contains more detailed
+information on how to install this library. Alternatively, you may also use the
+LibreSSL library.

-Since 1.0pre6, the zlib library is used for optional compression. You can
-find it at http://www.gzip.org/zlib/. Because of a possible exploit in
+The zlib library is used for optional compression. You can
+find it at https://zlib.net/. Because of a possible exploit in
 earlier versions we recommend that you download version 1.1.4 or later.

-Since 1.0, the lzo library is also used for optional compression. You can
-find it at http://www.oberhumer.com/opensource/lzo/.
+The LZO library is also used for optional compression. You can
+find it at https://www.oberhumer.com/opensource/lzo/.

-In order to compile tinc, you will need a GNU C compiler environment.
+In order to compile tinc, you will need a C99 compliant compiler.


 Features
--- a/3
+++ b/3
@ -5,6 +5,7 @@ We would like to thank the following people for their contributions to tinc:
 * Alexis Hildebrandt
 * Allesandro Gatti
 * Andreas van Cranenburgh
+* Andrew Hahn
 * Anthony G. Basile
 * Armijn Hemel
 * Armin Fisslthaler
@ -43,6 +44,7 @@ We would like to thank the following people for their contributions to tinc:
 * Jamie Briggs
 * Jason Harper
 * Jason Livesay
+* Jasper Krijgsman
 * Jelle de Jong
 * Jeroen Domburg
 * Jeroen Ubbink
@ -70,6 +72,7 @@ We would like to thank the following people for their contributions to tinc:
 * Menno Smits
 * Mesar Hameed
 * Michael Tokarev
+* Michael Yonli
 * Miles Nordin
 * Nathan Stratton Treadway
 * Murat Donmez
--- a/aclocal.m4
+++ b/aclocal.m4
@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-

-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -20,7 +20,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])

-# Copyright (C) 2002-2017 Free Software Foundation, Inc.
+# Copyright (C) 2002-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -32,10 +32,10 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN([AM_AUTOMAKE_VERSION],
-[am__api_version='1.15'
+[am__api_version='1.16'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.15.1], [],
+m4_if([$1], [1.16.1], [],
      [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])

@ -51,14 +51,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.15.1])dnl
+[AM_AUTOMAKE_VERSION([1.16.1])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
  [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])

 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -110,7 +110,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`

 # AM_CONDITIONAL                                            -*- Autoconf -*-

-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -141,7 +141,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])

-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -332,13 +332,12 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl

 # Generate code to set up dependency tracking.              -*- Autoconf -*-

-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.

-
 # _AM_OUTPUT_DEPENDENCY_COMMANDS
 # ------------------------------
 AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
@ -346,49 +345,41 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
  # Older Autoconf quotes --file arguments for eval, but not when files
  # are listed without --file.  Let's play safe and only enable the eval
  # if we detect the quoting.
-  case $CONFIG_FILES in
-  *\'*) eval set x "$CONFIG_FILES" ;;
-  *)   set x $CONFIG_FILES ;;
-  esac
+  # TODO: see whether this extra hack can be removed once we start
+  # requiring Autoconf 2.70 or later.
+  AS_CASE([$CONFIG_FILES],
+          [*\'*], [eval set x "$CONFIG_FILES"],
+          [*], [set x $CONFIG_FILES])
  shift
-  for mf
+  # Used to flag and report bootstrapping failures.
+  am_rc=0
+  for am_mf
  do
    # Strip MF so we end up with the name of the file.
-    mf=`echo "$mf" | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile or not.
-    # We used to match only the files named 'Makefile.in', but
-    # some people rename them; so instead we look at the file content.
-    # Grep'ing the first line is not enough: some people post-process
-    # each Makefile.in and add a new line on top of each file to say so.
-    # Grep'ing the whole file is not good either: AIX grep has a line
+    am_mf=`AS_ECHO(["$am_mf"]) | sed -e 's/:.*$//'`
+    # Check whether this is an Automake generated Makefile which includes
+    # dependency-tracking related rules and includes.
+    # Grep'ing the whole file directly is not great: AIX grep has a line
    # limit of 2048, but all sed's we know have understand at least 4000.
-    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
-      dirpart=`AS_DIRNAME("$mf")`
-    else
-      continue
+    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+      || continue
+    am_dirpart=`AS_DIRNAME(["$am_mf"])`
+    am_filepart=`AS_BASENAME(["$am_mf"])`
+    AM_RUN_LOG([cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles]) || am_rc=$?
+  done
+  if test $am_rc -ne 0; then
+    AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
+    for automatic dependency tracking.  Try re-running configure with the
+    '--disable-dependency-tracking' option to at least be able to build
+    the package (albeit without support for automatic dependency tracking).])
  fi
-    # Extract the definition of DEPDIR, am__include, and am__quote
-    # from the Makefile without running 'make'.
-    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
-    test -z "$DEPDIR" && continue
-    am__include=`sed -n 's/^am__include = //p' < "$mf"`
-    test -z "$am__include" && continue
-    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
-    # Find all dependency output files, they are included files with
-    # $(DEPDIR) in their names.  We invoke sed twice because it is the
-    # simplest approach to changing $(DEPDIR) to its actual value in the
-    # expansion.
-    for file in `sed -n "
-      s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
-      # Make sure the directory exists.
-      test -f "$dirpart/$file" && continue
-      fdir=`AS_DIRNAME(["$file"])`
-      AS_MKDIR_P([$dirpart/$fdir])
-      # echo "creating $dirpart/$file"
-      echo '# dummy' > "$dirpart/$file"
-    done
-  done
+  AS_UNSET([am_dirpart])
+  AS_UNSET([am_filepart])
+  AS_UNSET([am_mf])
+  AS_UNSET([am_rc])
+  rm -f conftest-deps.mk
 }
 ])# _AM_OUTPUT_DEPENDENCY_COMMANDS

@ -397,18 +388,17 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
 # -----------------------------
 # This macro should only be invoked once -- use via AC_REQUIRE.
 #
-# This code is only required when automatic dependency tracking
-# is enabled.  FIXME.  This creates each '.P' file that we will
-# need in order to bootstrap the dependency handling code.
+# This code is only required when automatic dependency tracking is enabled.
+# This creates each '.Po' and '.Plo' makefile fragment that we'll need in
+# order to bootstrap the dependency handling code.
 AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
 [AC_CONFIG_COMMANDS([depfiles],
     [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS],
-     [AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"])
-])
+     [AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"])])

 # Do all the work for Automake.                             -*- Autoconf -*-

-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -495,8 +485,8 @@ AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl
 AC_REQUIRE([AC_PROG_MKDIR_P])dnl
 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST([mkdir_p], ['$(MKDIR_P)'])
 # We need awk for the "check" target (and possibly the TAP driver).  The
 # system "awk" is bad on some platforms.
@ -563,7 +553,7 @@ END
 Aborting the configuration process, to ensure you take notice of the issue.

 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.

 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@ -605,7 +595,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -626,7 +616,7 @@ if test x"${install_sh+set}" != xset; then
 fi
 AC_SUBST([install_sh])])

-# Copyright (C) 2003-2017 Free Software Foundation, Inc.
+# Copyright (C) 2003-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -647,7 +637,7 @@ AC_SUBST([am__leading_dot])])

 # Check to see how 'make' treats includes.	            -*- Autoconf -*-

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -655,49 +645,42 @@ AC_SUBST([am__leading_dot])])

 # AM_MAKE_INCLUDE()
 # -----------------
-# Check to see how make treats includes.
+# Check whether make has an 'include' directive that can support all
+# the idioms we need for our automatic dependency tracking code.
 AC_DEFUN([AM_MAKE_INCLUDE],
-[am_make=${MAKE-make}
-cat > confinc << 'END'
+[AC_MSG_CHECKING([whether ${MAKE-make} supports the include directive])
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-AC_MSG_CHECKING([for style of include used by $am_make])
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
-  am__include=include
-  am__quote=
-  _am_result=GNU
-  ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
-   echo '.include "confinc"' > confmf
-   case `$am_make -s -f confmf 2> /dev/null` in #(
-   *the\ am__doit\ target*)
-     am__include=.include
-     am__quote="\""
-     _am_result=BSD
-     ;;
-   esac
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+  AM_RUN_LOG([${MAKE-make} -f confmf.$s && cat confinc.out])
+  AS_CASE([$?:`cat confinc.out 2>/dev/null`],
+      ['0:this is the am__doit target'],
+      [AS_CASE([$s],
+          [BSD], [am__include='.include' am__quote='"'],
+          [am__include='include' am__quote=''])])
+  if test "$am__include" != "#"; then
+    _am_result="yes ($s style)"
+    break
  fi
-AC_SUBST([am__include])
-AC_SUBST([am__quote])
-AC_MSG_RESULT([$_am_result])
-rm -f confinc confmf
-])
+done
+rm -f confinc.* confmf.*
+AC_MSG_RESULT([${_am_result}])
+AC_SUBST([am__include])])
+AC_SUBST([am__quote])])

 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-

-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -736,7 +719,7 @@ fi

 # Helper functions for option handling.                     -*- Autoconf -*-

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -765,7 +748,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])

-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -812,7 +795,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -831,7 +814,7 @@ AC_DEFUN([AM_RUN_LOG],

 # Check to make sure that the build environment is sane.    -*- Autoconf -*-

-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -912,7 +895,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])

-# Copyright (C) 2009-2017 Free Software Foundation, Inc.
+# Copyright (C) 2009-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -972,7 +955,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])

-# Copyright (C) 2001-2017 Free Software Foundation, Inc.
+# Copyright (C) 2001-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -1000,7 +983,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])

-# Copyright (C) 2006-2017 Free Software Foundation, Inc.
+# Copyright (C) 2006-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -1019,7 +1002,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])

 # Check how to create a tarball.                            -*- Autoconf -*-

-# Copyright (C) 2004-2017 Free Software Foundation, Inc.
+# Copyright (C) 2004-2018 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
--- a/13
+++ b/13
@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.

-scriptversion=2012-10-14.11; # UTC
+scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@ -17,7 +17,7 @@ scriptversion=2012-10-14.11; # UTC
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.

 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -255,7 +255,8 @@ EOF
    echo "compile $scriptversion"
    exit $?
    ;;
-  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe )
+  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
+  icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
    func_cl_wrapper "$@"      # Doesn't return...
    ;;
 esac
@ -339,9 +340,9 @@ exit $ret
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:
--- a/225
+++ b/225
@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for tinc 1.0.34.
+# Generated by GNU Autoconf 2.69 for tinc 1.0.35.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@ -577,8 +577,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='tinc'
 PACKAGE_TARNAME='tinc'
-PACKAGE_VERSION='1.0.34'
-PACKAGE_STRING='tinc 1.0.34'
+PACKAGE_VERSION='1.0.35'
+PACKAGE_STRING='tinc 1.0.35'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''

@ -662,7 +662,6 @@ am__nodep
 AMDEPBACKSLASH
 AMDEP_FALSE
 AMDEP_TRUE
-am__quote
 am__include
 DEPDIR
 OBJEXT
@ -737,7 +736,8 @@ PACKAGE_VERSION
 PACKAGE_TARNAME
 PACKAGE_NAME
 PATH_SEPARATOR
-SHELL'
+SHELL
+am__quote'
 ac_subst_files=''
 ac_user_opts='
 enable_option_checking
@ -1321,7 +1321,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures tinc 1.0.34 to adapt to many kinds of systems.
+\`configure' configures tinc 1.0.35 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@ -1392,7 +1392,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of tinc 1.0.34:";;
+     short | recursive ) echo "Configuration of tinc 1.0.35:";;
   esac
  cat <<\_ACEOF

@ -1509,7 +1509,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-tinc configure 1.0.34
+tinc configure 1.0.35
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@ -1974,7 +1974,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by tinc $as_me 1.0.34, which was
+It was created by tinc $as_me 1.0.35, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@ -2323,7 +2323,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu



-am__api_version='1.15'
+am__api_version='1.16'

 ac_aux_dir=
 for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
@ -2838,7 +2838,7 @@ fi

 # Define the identity of the package.
 PACKAGE='tinc'
- VERSION='1.0.34'
+ VERSION='1.0.35'


 cat >>confdefs.h <<_ACEOF
@ -2868,8 +2868,8 @@ MAKEINFO=${MAKEINFO-"${am_missing_run}makeinfo"}

 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 mkdir_p='$(MKDIR_P)'

 # We need awk for the "check" target (and possibly the TAP driver).  The
@ -2920,7 +2920,7 @@ END
 Aborting the configuration process, to ensure you take notice of the issue.

 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.

 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@ -2981,45 +2981,45 @@ DEPDIR="${am__leading_dot}deps"

 ac_config_commands="$ac_config_commands depfiles"

-
-am_make=${MAKE-make}
-cat > confinc << 'END'
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} supports the include directive" >&5
+$as_echo_n "checking whether ${MAKE-make} supports the include directive... " >&6; }
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for style of include used by $am_make" >&5
-$as_echo_n "checking for style of include used by $am_make... " >&6; }
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
-  am__include=include
-  am__quote=
-  _am_result=GNU
-  ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
-   echo '.include "confinc"' > confmf
-   case `$am_make -s -f confmf 2> /dev/null` in #(
-   *the\ am__doit\ target*)
-     am__include=.include
-     am__quote="\""
-     _am_result=BSD
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+  { echo "$as_me:$LINENO: ${MAKE-make} -f confmf.$s && cat confinc.out" >&5
+   (${MAKE-make} -f confmf.$s && cat confinc.out) >&5 2>&5
+   ac_status=$?
+   echo "$as_me:$LINENO: \$? = $ac_status" >&5
+   (exit $ac_status); }
+  case $?:`cat confinc.out 2>/dev/null` in #(
+  '0:this is the am__doit target') :
+    case $s in #(
+  BSD) :
+    am__include='.include' am__quote='"' ;; #(
+  *) :
+    am__include='include' am__quote='' ;;
+esac ;; #(
+  *) :
     ;;
 esac
+  if test "$am__include" != "#"; then
+    _am_result="yes ($s style)"
+    break
  fi
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $_am_result" >&5
-$as_echo "$_am_result" >&6; }
-rm -f confinc confmf
+done
+rm -f confinc.* confmf.*
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${_am_result}" >&5
+$as_echo "${_am_result}" >&6; }

 # Check whether --enable-dependency-tracking was given.
 if test "${enable_dependency_tracking+set}" = set; then :
@ -7333,7 +7333,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by tinc $as_me 1.0.34, which was
+This file was extended by tinc $as_me 1.0.35, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@ -7399,7 +7399,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-tinc config.status 1.0.34
+tinc config.status 1.0.35
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@ -7518,7 +7518,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 #
 # INIT-COMMANDS
 #
-AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"
+AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"

 _ACEOF

@ -8133,29 +8133,35 @@ $as_echo "$as_me: executing $ac_file commands" >&6;}
  # Older Autoconf quotes --file arguments for eval, but not when files
  # are listed without --file.  Let's play safe and only enable the eval
  # if we detect the quoting.
-  case $CONFIG_FILES in
-  *\'*) eval set x "$CONFIG_FILES" ;;
-  *)   set x $CONFIG_FILES ;;
+  # TODO: see whether this extra hack can be removed once we start
+  # requiring Autoconf 2.70 or later.
+  case $CONFIG_FILES in #(
+  *\'*) :
+    eval set x "$CONFIG_FILES" ;; #(
+  *) :
+    set x $CONFIG_FILES ;; #(
+  *) :
+     ;;
 esac
  shift
-  for mf
+  # Used to flag and report bootstrapping failures.
+  am_rc=0
+  for am_mf
  do
    # Strip MF so we end up with the name of the file.
-    mf=`echo "$mf" | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile or not.
-    # We used to match only the files named 'Makefile.in', but
-    # some people rename them; so instead we look at the file content.
-    # Grep'ing the first line is not enough: some people post-process
-    # each Makefile.in and add a new line on top of each file to say so.
-    # Grep'ing the whole file is not good either: AIX grep has a line
+    am_mf=`$as_echo "$am_mf" | sed -e 's/:.*$//'`
+    # Check whether this is an Automake generated Makefile which includes
+    # dependency-tracking related rules and includes.
+    # Grep'ing the whole file directly is not great: AIX grep has a line
    # limit of 2048, but all sed's we know have understand at least 4000.
-    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
-      dirpart=`$as_dirname -- "$mf" ||
-$as_expr X"$mf" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	 X"$mf" : 'X\(//\)[^/]' \| \
-	 X"$mf" : 'X\(//\)$' \| \
-	 X"$mf" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$mf" |
+    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+      || continue
+    am_dirpart=`$as_dirname -- "$am_mf" ||
+$as_expr X"$am_mf" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$am_mf" : 'X\(//\)[^/]' \| \
+	 X"$am_mf" : 'X\(//\)$' \| \
+	 X"$am_mf" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$am_mf" |
    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
 	    s//\1/
 	    q
@ -8173,53 +8179,48 @@ $as_echo X"$mf" |
 	    q
 	  }
 	  s/.*/./; q'`
-    else
-      continue
+    am_filepart=`$as_basename -- "$am_mf" ||
+$as_expr X/"$am_mf" : '.*/\([^/][^/]*\)/*$' \| \
+	 X"$am_mf" : 'X\(//\)$' \| \
+	 X"$am_mf" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X/"$am_mf" |
+    sed '/^.*\/\([^/][^/]*\)\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+    { echo "$as_me:$LINENO: cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles" >&5
+   (cd "$am_dirpart" \
+      && sed -e '/# am--include-marker/d' "$am_filepart" \
+        | $MAKE -f - am--depfiles) >&5 2>&5
+   ac_status=$?
+   echo "$as_me:$LINENO: \$? = $ac_status" >&5
+   (exit $ac_status); } || am_rc=$?
+  done
+  if test $am_rc -ne 0; then
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "Something went wrong bootstrapping makefile fragments
+    for automatic dependency tracking.  Try re-running configure with the
+    '--disable-dependency-tracking' option to at least be able to build
+    the package (albeit without support for automatic dependency tracking).
+See \`config.log' for more details" "$LINENO" 5; }
  fi
-    # Extract the definition of DEPDIR, am__include, and am__quote
-    # from the Makefile without running 'make'.
-    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
-    test -z "$DEPDIR" && continue
-    am__include=`sed -n 's/^am__include = //p' < "$mf"`
-    test -z "$am__include" && continue
-    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
-    # Find all dependency output files, they are included files with
-    # $(DEPDIR) in their names.  We invoke sed twice because it is the
-    # simplest approach to changing $(DEPDIR) to its actual value in the
-    # expansion.
-    for file in `sed -n "
-      s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
-      # Make sure the directory exists.
-      test -f "$dirpart/$file" && continue
-      fdir=`$as_dirname -- "$file" ||
-$as_expr X"$file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	 X"$file" : 'X\(//\)[^/]' \| \
-	 X"$file" : 'X\(//\)$' \| \
-	 X"$file" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$file" |
-    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\/\)[^/].*/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\/\)$/{
-	    s//\1/
-	    q
-	  }
-	  /^X\(\/\).*/{
-	    s//\1/
-	    q
-	  }
-	  s/.*/./; q'`
-      as_dir=$dirpart/$fdir; as_fn_mkdir_p
-      # echo "creating $dirpart/$file"
-      echo '# dummy' > "$dirpart/$file"
-    done
-  done
+  { am_dirpart=; unset am_dirpart;}
+  { am_filepart=; unset am_filepart;}
+  { am_mf=; unset am_mf;}
+  { am_rc=; unset am_rc;}
+  rm -f conftest-deps.mk
 }
 ;;

--- a/configure.ac
+++ b/configure.ac
@ -1,7 +1,7 @@
 dnl Process this file with autoconf to produce a configure script.

 AC_PREREQ(2.61)
-AC_INIT([tinc], [1.0.34])
+AC_INIT([tinc], [1.0.35])
 AC_CONFIG_SRCDIR([src/tincd.c])
 AM_INIT_AUTOMAKE([1.11 check-news std-options subdir-objects nostdinc silent-rules -Wall])
 AC_CONFIG_HEADERS([config.h])
--- a/8
+++ b/8
@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects

-scriptversion=2016-01-11.22; # UTC
+scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
+# Copyright (C) 1999-2018 Free Software Foundation, Inc.

 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@ -16,7 +16,7 @@ scriptversion=2016-01-11.22; # UTC
 # GNU General Public License for more details.

 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.

 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -783,7 +783,7 @@ exit 0
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
--- a/doc/Makefile.in
+++ b/doc/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.1 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2018 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -329,8 +329,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -575,7 +575,10 @@ ctags CTAGS:
 cscope cscopelist:


-distdir: $(DISTFILES)
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
--- a/doc/texinfo.tex
+++ b/doc/texinfo.tex
--- a/doc/tinc.info
+++ b/doc/tinc.info
@ -5,7 +5,7 @@ START-INFO-DIR-ENTRY
 * tinc: (tinc).              The tinc Manual.
 END-INFO-DIR-ENTRY

-This is the info manual for tinc version 1.0.34, a Virtual Private
+This is the info manual for tinc version 1.0.35, a Virtual Private
 Network daemon.

   Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen
@ -373,9 +373,9 @@ if available.  Make sure you install the development AND runtime
 versions of this package.

   If you have to install zlib manually, you can get the source code
-from <http://www.zlib.net/>.  Instructions on how to configure, build
-and install this package are included within the package.  Please make
-sure you build development and runtime libraries (which is the default).
+from <https://zlib.net/>.  Instructions on how to configure, build and
+install this package are included within the package.  Please make sure
+you build development and runtime libraries (which is the default).


 File: tinc.info,  Node: lzo,  Prev: zlib,  Up: Libraries
@ -1939,8 +1939,7 @@ correct destination MAC address.  In those modes every interface should
 have a unique MAC address, so make sure they are not the same.  Because
 switch and hub modes rely on MAC addresses to function correctly, these
 modes cannot be used on the following operating systems which don't have
-a 'tap' style virtual network device: OpenBSD, NetBSD, Darwin and
-Solaris.
+a 'tap' style virtual network device: NetBSD, Darwin and Solaris.


 File: tinc.info,  Node: The meta-connection,  Prev: The UDP tunnel,  Up: The connection
@ -2330,11 +2329,6 @@ Solaris             'ifconfig' INTERFACE 'inet6 plumb up'
 Darwin (Mac OS X)   'ifconfig' INTERFACE 'inet6' ADDRESS 'prefixlen' PREFIXLENGTH
 Windows             'netsh interface ipv6 add address' INTERFACE 'static' ADDRESS/PREFIXLENGTH

-   On some platforms, when running tinc in switch mode, the VPN
-interface must be set to tap mode with an ifconfig command:
-
-OpenBSD             'ifconfig' INTERFACE 'link0'
-
   On Linux, it is possible to create a persistent tun/tap interface
 which will continue to exist even if tinc quit, although this is
 normally not required.  It can be useful to set up a tun/tap interface
@ -2739,53 +2733,53 @@ Node: Configuration of Windows10097
 Node: Libraries10637
 Node: LibreSSL/OpenSSL11046
 Node: zlib13588
-Node: lzo14620
-Node: Installation15603
-Node: Building and installing tinc16513
-Node: Darwin (Mac OS X) build environment17173
-Node: Cygwin (Windows) build environment17738
-Node: MinGW (Windows) build environment18327
-Node: System files18921
-Node: Device files19186
-Node: Other files19602
-Node: Configuration20215
-Node: Configuration introduction20526
-Node: Multiple networks21794
-Node: How connections work23220
-Node: Configuration files24442
-Node: Main configuration variables25936
-Node: Host configuration variables42192
-Node: Scripts47724
-Node: How to configure50990
-Node: Generating keypairs52248
-Node: Network interfaces52747
-Node: Example configuration54595
-Node: Running tinc59920
-Node: Runtime options60510
-Node: Signals64139
-Node: Debug levels65330
-Node: Solving problems66266
-Node: Error messages67818
-Node: Sending bug reports71827
-Node: Technical information72774
-Node: The connection73005
-Node: The UDP tunnel73317
-Node: The meta-connection76378
-Node: The meta-protocol77847
-Node: Security82864
-Node: Authentication protocol84006
-Node: Encryption of network packets89051
-Node: Security issues90427
-Node: Platform specific information92066
-Node: Interface configuration92326
-Node: Routes94797
-Node: Automatically starting tinc96847
-Node: Linux97070
-Node: Windows98291
-Node: Other platforms98796
-Node: About us99078
-Node: Contact information99253
-Node: Authors99656
-Node: Concept Index100061
+Node: lzo14617
+Node: Installation15600
+Node: Building and installing tinc16510
+Node: Darwin (Mac OS X) build environment17170
+Node: Cygwin (Windows) build environment17735
+Node: MinGW (Windows) build environment18324
+Node: System files18918
+Node: Device files19183
+Node: Other files19599
+Node: Configuration20212
+Node: Configuration introduction20523
+Node: Multiple networks21791
+Node: How connections work23217
+Node: Configuration files24439
+Node: Main configuration variables25933
+Node: Host configuration variables42189
+Node: Scripts47721
+Node: How to configure50987
+Node: Generating keypairs52245
+Node: Network interfaces52744
+Node: Example configuration54592
+Node: Running tinc59917
+Node: Runtime options60507
+Node: Signals64136
+Node: Debug levels65327
+Node: Solving problems66263
+Node: Error messages67815
+Node: Sending bug reports71824
+Node: Technical information72771
+Node: The connection73002
+Node: The UDP tunnel73314
+Node: The meta-connection76366
+Node: The meta-protocol77835
+Node: Security82852
+Node: Authentication protocol83994
+Node: Encryption of network packets89039
+Node: Security issues90415
+Node: Platform specific information92054
+Node: Interface configuration92314
+Node: Routes94610
+Node: Automatically starting tinc96660
+Node: Linux96883
+Node: Windows98104
+Node: Other platforms98609
+Node: About us98891
+Node: Contact information99066
+Node: Authors99469
+Node: Concept Index99874

 End Tag Table
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
@ -421,7 +421,7 @@ available.  Make sure you install the development AND runtime versions
 of this package.

 If you have to install zlib manually, you can get the source code
-from @url{http://www.zlib.net/}.  Instructions on how to configure,
+from @url{https://zlib.net/}.  Instructions on how to configure,
 build and install this package are included within the package.  Please
 make sure you build development and runtime libraries (which is the
 default).
@ -2075,7 +2075,7 @@ In switch or hub modes ARP does work so the sender already knows the correct des
 In those modes every interface should have a unique MAC address, so make sure they are not the same.
 Because switch and hub modes rely on MAC addresses to function correctly,
 these modes cannot be used on the following operating systems which don't have a `tap' style virtual network device:
-OpenBSD, NetBSD, Darwin and Solaris.
+NetBSD, Darwin and Solaris.


@c ==================================================================
@ -2500,13 +2500,6 @@ For IPv6 addresses:
@tab @code{netsh interface ipv6 add address} @var{interface} @code{static} @var{address}/@var{prefixlength}
@end multitable

-On some platforms, when running tinc in switch mode, the VPN interface must be set to tap mode with an ifconfig command:
-
-@multitable {Darwin (Mac OS X)} {ifconfig route add -bla network address netmask netmask prefixlength interface}
-@item OpenBSD
-@tab @code{ifconfig} @var{interface} @code{link0}
-@end multitable
-
 On Linux, it is possible to create a persistent tun/tap interface which will
 continue to exist even if tinc quit, although this is normally not required.
 It can be useful to set up a tun/tap interface owned by a non-root user, so
--- a/doc/tincinclude.texi
+++ b/doc/tincinclude.texi
@ -1,4 +1,4 @@
-@set VERSION 1.0.34
+@set VERSION 1.0.35
@set PACKAGE tinc
@set sysconfdir /etc
@set localstatedir /var
--- a/36
+++ b/36
@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile

-scriptversion=2014-09-12.12; # UTC
+scriptversion=2018-03-11.20; # UTC

 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@ -271,15 +271,18 @@ do
    fi
    dst=$dst_arg

-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
+    # If destination is a directory, append the input filename.
    if test -d "$dst"; then
      if test "$is_target_a_directory" = never; then
        echo "$0: $dst_arg: Is a directory" >&2
        exit 1
      fi
      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
+      dstbase=`basename "$src"`
+      case $dst in
+	*/) dst=$dst$dstbase;;
+	*)  dst=$dst/$dstbase;;
+      esac
      dstdir_status=0
    else
      dstdir=`dirname "$dst"`
@ -288,6 +291,11 @@ do
    fi
  fi

+  case $dstdir in
+    */) dstdirslash=$dstdir;;
+    *)  dstdirslash=$dstdir/;;
+  esac
+
  obsolete_mkdir_used=false

  if test $dstdir_status != 0; then
@ -324,14 +332,16 @@ do
            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
            ;;
          *)
-            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # lower collision chance
+            # Note that $RANDOM variable is not portable (e.g. dash);  Use it
+            # here however when possible just to lower collision chance.
            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+
            trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0

-            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # that nobody tries to guess the $tmpdir name.
+            # Because "mkdir -p" follows existing symlinks and we likely work
+            # directly in world-writeable /tmp, make sure that the '$tmpdir'
+            # directory is successfully created first before we actually test
+            # 'mkdir -p' feature.
            if (umask $mkdir_umask &&
                $mkdirprog $mkdir_mode "$tmpdir" &&
                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
@ -434,8 +444,8 @@ do
  else

    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
+    dsttmp=${dstdirslash}_inst.$$_
+    rmtmp=${dstdirslash}_rm.$$_

    # Trap to clean up those temp files at exit.
    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
@ -500,9 +510,9 @@ do
 done

 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:
--- a/16
+++ b/16
@ -1,9 +1,9 @@
 #! /bin/sh
 # Common wrapper for a few potentially missing GNU programs.

-scriptversion=2013-10-28.13; # UTC
+scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.

 # This program is free software; you can redistribute it and/or modify
@ -17,7 +17,7 @@ scriptversion=2013-10-28.13; # UTC
 # GNU General Public License for more details.

 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.

 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -101,9 +101,9 @@ else
  exit $st
 fi

-perl_URL=http://www.perl.org/
-flex_URL=http://flex.sourceforge.net/
-gnu_software_URL=http://www.gnu.org/software
+perl_URL=https://www.perl.org/
+flex_URL=https://github.com/westes/flex
+gnu_software_URL=https://www.gnu.org/software

 program_details ()
 {
@ -207,9 +207,9 @@ give_advice "$1" | sed -e '1s/^/WARNING: /' \
 exit $st

 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:
--- a/src/Makefile.in
+++ b/src/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.1 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2018 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -178,7 +178,29 @@ am__v_at_0 = @
 am__v_at_1 = 
 DEFAULT_INCLUDES = 
 depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/avl_tree.Po ./$(DEPDIR)/conf.Po \
+	./$(DEPDIR)/connection.Po ./$(DEPDIR)/dropin.Po \
+	./$(DEPDIR)/dummy_device.Po ./$(DEPDIR)/edge.Po \
+	./$(DEPDIR)/event.Po ./$(DEPDIR)/fake-getaddrinfo.Po \
+	./$(DEPDIR)/fake-getnameinfo.Po ./$(DEPDIR)/getopt.Po \
+	./$(DEPDIR)/getopt1.Po ./$(DEPDIR)/graph.Po \
+	./$(DEPDIR)/list.Po ./$(DEPDIR)/logger.Po ./$(DEPDIR)/meta.Po \
+	./$(DEPDIR)/multicast_device.Po ./$(DEPDIR)/net.Po \
+	./$(DEPDIR)/net_packet.Po ./$(DEPDIR)/net_setup.Po \
+	./$(DEPDIR)/net_socket.Po ./$(DEPDIR)/netutl.Po \
+	./$(DEPDIR)/node.Po ./$(DEPDIR)/pidfile.Po \
+	./$(DEPDIR)/process.Po ./$(DEPDIR)/protocol.Po \
+	./$(DEPDIR)/protocol_auth.Po ./$(DEPDIR)/protocol_edge.Po \
+	./$(DEPDIR)/protocol_key.Po ./$(DEPDIR)/protocol_misc.Po \
+	./$(DEPDIR)/protocol_subnet.Po ./$(DEPDIR)/proxy.Po \
+	./$(DEPDIR)/raw_socket_device.Po ./$(DEPDIR)/route.Po \
+	./$(DEPDIR)/subnet.Po ./$(DEPDIR)/tincd.Po \
+	./$(DEPDIR)/uml_device.Po ./$(DEPDIR)/utils.Po \
+	./$(DEPDIR)/vde_device.Po bsd/$(DEPDIR)/device.Po \
+	bsd/$(DEPDIR)/tunemu.Po cygwin/$(DEPDIR)/device.Po \
+	linux/$(DEPDIR)/device.Po mingw/$(DEPDIR)/device.Po \
+	solaris/$(DEPDIR)/device.Po
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@ -354,8 +376,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -482,50 +504,56 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c

-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/avl_tree.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/connection.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dropin.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dummy_device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/edge.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/event.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/fake-getaddrinfo.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/fake-getnameinfo.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt1.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/graph.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/list.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/logger.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/meta.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/multicast_device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_packet.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_setup.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_socket.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/netutl.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/node.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pidfile.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/process.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_auth.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_edge.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_key.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_misc.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_subnet.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/proxy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/raw_socket_device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/route.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/subnet.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tincd.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/uml_device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/utils.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vde_device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@bsd/$(DEPDIR)/device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@bsd/$(DEPDIR)/tunemu.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@cygwin/$(DEPDIR)/device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@linux/$(DEPDIR)/device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@mingw/$(DEPDIR)/device.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@solaris/$(DEPDIR)/device.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/avl_tree.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/connection.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dropin.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dummy_device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/edge.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/event.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/fake-getaddrinfo.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/fake-getnameinfo.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt1.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/graph.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/list.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/logger.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/meta.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/multicast_device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_packet.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_setup.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/net_socket.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/netutl.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/node.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pidfile.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/process.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_auth.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_edge.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_key.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_misc.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/protocol_subnet.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/proxy.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/raw_socket_device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/route.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/subnet.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tincd.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/uml_device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/utils.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vde_device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@bsd/$(DEPDIR)/device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@bsd/$(DEPDIR)/tunemu.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@cygwin/$(DEPDIR)/device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@linux/$(DEPDIR)/device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@mingw/$(DEPDIR)/device.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@solaris/$(DEPDIR)/device.Po@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@echo '# dummy' >$@-t && $(am__mv) $@-t $@
+
+am--depfiles: $(am__depfiles_remade)

 .c.o:
@am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
@ -595,7 +623,10 @@ cscopelist-am: $(am__tagged_files)
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags

-distdir: $(DISTFILES)
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@ -677,7 +708,50 @@ clean: clean-am
 clean-am: clean-generic clean-sbinPROGRAMS mostlyclean-am

 distclean: distclean-am
-	-rm -rf ./$(DEPDIR) bsd/$(DEPDIR) cygwin/$(DEPDIR) linux/$(DEPDIR) mingw/$(DEPDIR) solaris/$(DEPDIR)
+		-rm -f ./$(DEPDIR)/avl_tree.Po
+	-rm -f ./$(DEPDIR)/conf.Po
+	-rm -f ./$(DEPDIR)/connection.Po
+	-rm -f ./$(DEPDIR)/dropin.Po
+	-rm -f ./$(DEPDIR)/dummy_device.Po
+	-rm -f ./$(DEPDIR)/edge.Po
+	-rm -f ./$(DEPDIR)/event.Po
+	-rm -f ./$(DEPDIR)/fake-getaddrinfo.Po
+	-rm -f ./$(DEPDIR)/fake-getnameinfo.Po
+	-rm -f ./$(DEPDIR)/getopt.Po
+	-rm -f ./$(DEPDIR)/getopt1.Po
+	-rm -f ./$(DEPDIR)/graph.Po
+	-rm -f ./$(DEPDIR)/list.Po
+	-rm -f ./$(DEPDIR)/logger.Po
+	-rm -f ./$(DEPDIR)/meta.Po
+	-rm -f ./$(DEPDIR)/multicast_device.Po
+	-rm -f ./$(DEPDIR)/net.Po
+	-rm -f ./$(DEPDIR)/net_packet.Po
+	-rm -f ./$(DEPDIR)/net_setup.Po
+	-rm -f ./$(DEPDIR)/net_socket.Po
+	-rm -f ./$(DEPDIR)/netutl.Po
+	-rm -f ./$(DEPDIR)/node.Po
+	-rm -f ./$(DEPDIR)/pidfile.Po
+	-rm -f ./$(DEPDIR)/process.Po
+	-rm -f ./$(DEPDIR)/protocol.Po
+	-rm -f ./$(DEPDIR)/protocol_auth.Po
+	-rm -f ./$(DEPDIR)/protocol_edge.Po
+	-rm -f ./$(DEPDIR)/protocol_key.Po
+	-rm -f ./$(DEPDIR)/protocol_misc.Po
+	-rm -f ./$(DEPDIR)/protocol_subnet.Po
+	-rm -f ./$(DEPDIR)/proxy.Po
+	-rm -f ./$(DEPDIR)/raw_socket_device.Po
+	-rm -f ./$(DEPDIR)/route.Po
+	-rm -f ./$(DEPDIR)/subnet.Po
+	-rm -f ./$(DEPDIR)/tincd.Po
+	-rm -f ./$(DEPDIR)/uml_device.Po
+	-rm -f ./$(DEPDIR)/utils.Po
+	-rm -f ./$(DEPDIR)/vde_device.Po
+	-rm -f bsd/$(DEPDIR)/device.Po
+	-rm -f bsd/$(DEPDIR)/tunemu.Po
+	-rm -f cygwin/$(DEPDIR)/device.Po
+	-rm -f linux/$(DEPDIR)/device.Po
+	-rm -f mingw/$(DEPDIR)/device.Po
+	-rm -f solaris/$(DEPDIR)/device.Po
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-tags
@ -723,7 +797,50 @@ install-ps-am:
 installcheck-am: installcheck-sbinPROGRAMS

 maintainer-clean: maintainer-clean-am
-	-rm -rf ./$(DEPDIR) bsd/$(DEPDIR) cygwin/$(DEPDIR) linux/$(DEPDIR) mingw/$(DEPDIR) solaris/$(DEPDIR)
+		-rm -f ./$(DEPDIR)/avl_tree.Po
+	-rm -f ./$(DEPDIR)/conf.Po
+	-rm -f ./$(DEPDIR)/connection.Po
+	-rm -f ./$(DEPDIR)/dropin.Po
+	-rm -f ./$(DEPDIR)/dummy_device.Po
+	-rm -f ./$(DEPDIR)/edge.Po
+	-rm -f ./$(DEPDIR)/event.Po
+	-rm -f ./$(DEPDIR)/fake-getaddrinfo.Po
+	-rm -f ./$(DEPDIR)/fake-getnameinfo.Po
+	-rm -f ./$(DEPDIR)/getopt.Po
+	-rm -f ./$(DEPDIR)/getopt1.Po
+	-rm -f ./$(DEPDIR)/graph.Po
+	-rm -f ./$(DEPDIR)/list.Po
+	-rm -f ./$(DEPDIR)/logger.Po
+	-rm -f ./$(DEPDIR)/meta.Po
+	-rm -f ./$(DEPDIR)/multicast_device.Po
+	-rm -f ./$(DEPDIR)/net.Po
+	-rm -f ./$(DEPDIR)/net_packet.Po
+	-rm -f ./$(DEPDIR)/net_setup.Po
+	-rm -f ./$(DEPDIR)/net_socket.Po
+	-rm -f ./$(DEPDIR)/netutl.Po
+	-rm -f ./$(DEPDIR)/node.Po
+	-rm -f ./$(DEPDIR)/pidfile.Po
+	-rm -f ./$(DEPDIR)/process.Po
+	-rm -f ./$(DEPDIR)/protocol.Po
+	-rm -f ./$(DEPDIR)/protocol_auth.Po
+	-rm -f ./$(DEPDIR)/protocol_edge.Po
+	-rm -f ./$(DEPDIR)/protocol_key.Po
+	-rm -f ./$(DEPDIR)/protocol_misc.Po
+	-rm -f ./$(DEPDIR)/protocol_subnet.Po
+	-rm -f ./$(DEPDIR)/proxy.Po
+	-rm -f ./$(DEPDIR)/raw_socket_device.Po
+	-rm -f ./$(DEPDIR)/route.Po
+	-rm -f ./$(DEPDIR)/subnet.Po
+	-rm -f ./$(DEPDIR)/tincd.Po
+	-rm -f ./$(DEPDIR)/uml_device.Po
+	-rm -f ./$(DEPDIR)/utils.Po
+	-rm -f ./$(DEPDIR)/vde_device.Po
+	-rm -f bsd/$(DEPDIR)/device.Po
+	-rm -f bsd/$(DEPDIR)/tunemu.Po
+	-rm -f cygwin/$(DEPDIR)/device.Po
+	-rm -f linux/$(DEPDIR)/device.Po
+	-rm -f mingw/$(DEPDIR)/device.Po
+	-rm -f solaris/$(DEPDIR)/device.Po
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic

@ -743,19 +860,19 @@ uninstall-am: uninstall-sbinPROGRAMS

 .MAKE: install-am install-strip

-.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
-	clean-sbinPROGRAMS cscopelist-am ctags ctags-am distclean \
-	distclean-compile distclean-generic distclean-tags distdir dvi \
-	dvi-am html html-am info info-am install install-am \
-	install-data install-data-am install-dvi install-dvi-am \
-	install-exec install-exec-am install-html install-html-am \
-	install-info install-info-am install-man install-pdf \
-	install-pdf-am install-ps install-ps-am install-sbinPROGRAMS \
-	install-strip installcheck installcheck-am \
-	installcheck-sbinPROGRAMS installdirs maintainer-clean \
-	maintainer-clean-generic mostlyclean mostlyclean-compile \
-	mostlyclean-generic pdf pdf-am ps ps-am tags tags-am uninstall \
-	uninstall-am uninstall-sbinPROGRAMS
+.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
+	clean-generic clean-sbinPROGRAMS cscopelist-am ctags ctags-am \
+	distclean distclean-compile distclean-generic distclean-tags \
+	distdir dvi dvi-am html html-am info info-am install \
+	install-am install-data install-data-am install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am install-man \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-sbinPROGRAMS install-strip installcheck \
+	installcheck-am installcheck-sbinPROGRAMS installdirs \
+	maintainer-clean maintainer-clean-generic mostlyclean \
+	mostlyclean-compile mostlyclean-generic pdf pdf-am ps ps-am \
+	tags tags-am uninstall uninstall-am uninstall-sbinPROGRAMS

 .PRECIOUS: Makefile

--- a/src/conf.c
+++ b/src/conf.c
@ -81,18 +81,9 @@ config_t *new_config(void) {
 }

 void free_config(config_t *cfg) {
-	if(cfg->variable) {
 	free(cfg->variable);
-	}
-
-	if(cfg->value) {
 	free(cfg->value);
-	}
-
-	if(cfg->file) {
 	free(cfg->file);
-	}
-
 	free(cfg);
 }

@ -204,7 +195,7 @@ bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 }

 bool get_config_subnet(const config_t *cfg, subnet_t **result) {
-	subnet_t subnet = {};
+	subnet_t subnet = {0};

 	if(!cfg) {
 		return false;
@ -432,7 +423,11 @@ bool read_server_config(void) {

 				// And we try to read the ones that end with ".conf"
 				if(l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
-					snprintf(fname, sizeof(fname), "%s/%s", dname, ep->d_name);
+					if((size_t)snprintf(fname, sizeof(fname), "%s/%s", dname, ep->d_name) >= sizeof(fname)) {
+						logger(LOG_ERR, "Pathname too long: %s/%s", dname, ep->d_name);
+						return false;
+					}
+
 					x = read_config_file(config_tree, fname);
 				}
 			}
@ -573,7 +568,12 @@ FILE *ask_and_open(const char *filename, const char *what) {
 #endif
 		/* The directory is a relative path or a filename. */
 		getcwd(directory, sizeof(directory));
-		snprintf(abspath, sizeof(abspath), "%s/%s", directory, fn);
+
+		if((size_t)snprintf(abspath, sizeof(abspath), "%s/%s", directory, fn) >= sizeof(abspath)) {
+			fprintf(stderr, "Pathname too long: %s/%s\n", directory, fn);
+			return NULL;
+		}
+
 		fn = abspath;
 	}

--- a/src/connection.h
+++ b/src/connection.h
@ -42,7 +42,8 @@ typedef struct connection_status_t {
 	unsigned int decryptin: 1;      /* 1 if we have to decrypt incoming traffic */
 	unsigned int mst: 1;            /* 1 if this connection is part of a minimum spanning tree */
 	unsigned int proxy_passed: 1;   /* 1 if we are connecting via a proxy and we have finished talking with it */
-	unsigned int unused: 22;
+	unsigned int tarpit: 1;         /* 1 if the connection should be added to the tarpit */
+	unsigned int unused: 21;
 } connection_status_t;

 #include "edge.h"
--- a/src/dummy_device.c
+++ b/src/dummy_device.c
@ -37,6 +37,8 @@ static bool setup_device(void) {
 }

 static void close_device(void) {
+	free(device);
+	free(iface);
 }

 static bool read_packet(vpn_packet_t *packet) {
--- a/src/fake-getaddrinfo.c
+++ b/src/fake-getaddrinfo.c
@ -2,10 +2,10 @@
 * fake library for ssh
 *
 * This file includes getaddrinfo(), freeaddrinfo() and gai_strerror().
- * These funtions are defined in rfc2133.
+ * These functions are defined in rfc2133.
 *
 * But these functions are not implemented correctly. The minimum subset
- * is implemented for ssh use only. For exapmle, this routine assumes
+ * is implemented for ssh use only. For example, this routine assumes
 * that ai_family is AF_INET. Don't use it for another purpose.
 */

--- a/src/fake-getnameinfo.c
+++ b/src/fake-getnameinfo.c
@ -2,10 +2,10 @@
 * fake library for ssh
 *
 * This file includes getnameinfo().
- * These funtions are defined in rfc2133.
+ * These functions are defined in rfc2133.
 *
 * But these functions are not implemented correctly. The minimum subset
- * is implemented for ssh use only. For exapmle, this routine assumes
+ * is implemented for ssh use only. For example, this routine assumes
 * that ai_family is AF_INET. Don't use it for another purpose.
 */

--- a/src/getopt.c
+++ b/src/getopt.c
@ -83,7 +83,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 #endif
 #endif

-#if defined (WIN32) && !defined (__CYGWIN32__32)
+#if defined (WIN32) && !defined (__CYGWIN32__)
 /* It's not Unix, really.  See?  Capital letters.  */
 #include <windows.h>
 #define getpid() GetCurrentProcessId()
--- a/src/graph.c
+++ b/src/graph.c
@ -274,9 +274,9 @@ static void sssp_bfs(void) {
 				n->mtuevent = NULL;
 			}

-			xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
-			xasprintf(&envp[1], "DEVICE=%s", device ? : "");
-			xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
+			xasprintf(&envp[0], "NETNAME=%s", netname ? netname : "");
+			xasprintf(&envp[1], "DEVICE=%s", device ? device : "");
+			xasprintf(&envp[2], "INTERFACE=%s", iface ? iface : "");
 			xasprintf(&envp[3], "NODE=%s", n->name);
 			sockaddr2str(&n->address, &address, &port);
 			xasprintf(&envp[4], "REMOTEADDRESS=%s", address);
--- a/src/net.c
+++ b/src/net.c
@ -180,6 +180,22 @@ static int build_fdset(fd_set *readset, fd_set *writeset) {
 	return max;
 }

+/* Put a misbehaving connection in the tarpit */
+void tarpit(int fd) {
+	static int pits[10] = {-1, -1, -1, -1, -1, -1, -1, -1, -1, -1};
+	static int next_pit = 0;
+
+	if(pits[next_pit] != -1) {
+		closesocket(pits[next_pit]);
+	}
+
+	pits[next_pit++] = fd;
+
+	if(next_pit >= (int)(sizeof pits / sizeof pits[0])) {
+		next_pit = 0;
+	}
+}
+
 /*
  Terminate a connection:
  - Close the socket
@ -203,8 +219,12 @@ void terminate_connection(connection_t *c, bool report) {
 	}

 	if(c->socket) {
+		if(c->status.tarpit) {
+			tarpit(c->socket);
+		} else {
 			closesocket(c->socket);
 		}
+	}

 	if(c->edge) {
 		if(!c->node) {
@ -299,6 +319,7 @@ static void check_dead_connections(void) {
 					closesocket(c->socket);
 					do_outgoing_connection(c);
 				} else {
+					c->status.tarpit = true;
 					terminate_connection(c, false);
 				}
 			}
@ -380,6 +401,7 @@ static void check_network_activity(fd_set *readset, fd_set *writeset) {

 		if(FD_ISSET(c->socket, readset)) {
 			if(!receive_meta(c)) {
+				c->status.tarpit = true;
 				terminate_connection(c, c->status.active);
 				continue;
 			}
--- a/src/net.h
+++ b/src/net.h
@ -150,6 +150,7 @@ extern void flush_queue(struct node_t *n);
 extern bool read_rsa_public_key(struct connection_t *c);
 extern void send_mtu_probe(struct node_t *n);
 extern void load_all_subnets(void);
+extern void tarpit(int fd);

 #ifndef HAVE_MINGW
 #define closesocket(s) close(s)
--- a/src/net_setup.c
+++ b/src/net_setup.c
@ -239,7 +239,7 @@ static bool read_rsa_private_key(void) {
 		return false;
 	}

-#if !defined(HAVE_MINGW) && !defined(HAVE___CYGWIN32__)
+#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN)
 	struct stat s;

 	if(!fstat(fileno(fp), &s)) {
@ -388,8 +388,8 @@ static bool setup_myself(void) {
 	char *address = NULL;
 	char *proxy = NULL;
 	char *space;
-	char *envp[5] = {};
-	struct addrinfo *ai, *aip, hint = {};
+	char *envp[5] = {0};
+	struct addrinfo *ai, *aip, hint = {0};
 	bool choice;
 	int i, err;
 	int replaywin_int;
@ -852,15 +852,15 @@ static bool setup_myself(void) {
 	}

 	/* Run tinc-up script to further initialize the tap interface */
-	xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
-	xasprintf(&envp[1], "DEVICE=%s", device ? : "");
-	xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
+	xasprintf(&envp[0], "NETNAME=%s", netname ? netname : "");
+	xasprintf(&envp[1], "DEVICE=%s", device ? device : "");
+	xasprintf(&envp[2], "INTERFACE=%s", iface ? iface : "");
 	xasprintf(&envp[3], "NAME=%s", myself->name);

 #ifdef HAVE_MINGW
 	Sleep(1000);
 #endif
-#ifdef HAVE___CYGWIN32__
+#ifdef HAVE_CYGWIN
 	sleep(1);
 #endif
 	execute_script("tinc-up", envp);
@ -1068,7 +1068,7 @@ bool setup_network(void) {
 void close_network_connections(void) {
 	avl_node_t *node, *next;
 	connection_t *c;
-	char *envp[5] = {};
+	char *envp[5] = {0};
 	int i;

 	for(node = connection_tree->head; node; node = next) {
@ -1099,9 +1099,9 @@ void close_network_connections(void) {
 		close(listen_socket[i].udp);
 	}

-	xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
-	xasprintf(&envp[1], "DEVICE=%s", device ? : "");
-	xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
+	xasprintf(&envp[0], "NETNAME=%s", netname ? netname : "");
+	xasprintf(&envp[1], "DEVICE=%s", device ? device : "");
+	xasprintf(&envp[2], "INTERFACE=%s", iface ? iface : "");
 	xasprintf(&envp[3], "NAME=%s", myself->name);

 	exit_requests();
--- a/src/net_socket.c
+++ b/src/net_socket.c
@ -639,6 +639,9 @@ void setup_outgoing_connection(outgoing_t *outgoing) {
  new connection
 */
 bool handle_new_meta_connection(int sock) {
+	static const int max_accept_burst = 10;
+	static int last_accept_burst;
+	static int last_accept_time;
 	connection_t *c;
 	sockaddr_t sa;
 	int fd;
@ -651,6 +654,22 @@ bool handle_new_meta_connection(int sock) {
 		return false;
 	}

+	if(last_accept_time == now) {
+		last_accept_burst++;
+
+		if(last_accept_burst >= max_accept_burst) {
+			if(last_accept_burst == max_accept_burst) {
+				ifdebug(CONNECTIONS) logger(LOG_WARNING, "Throttling incoming connections");
+			}
+
+			tarpit(fd);
+			return false;
+		}
+	} else {
+		last_accept_burst = 0;
+		last_accept_time = now;
+	}
+
 	sockaddrunmap(&sa);

 	c = new_connection();
@ -672,7 +691,6 @@ bool handle_new_meta_connection(int sock) {
 	connection_add(c);

 	c->allow_request = ID;
-	send_id(c);

 	return true;
 }
--- a/src/netutl.c
+++ b/src/netutl.c
@ -33,7 +33,7 @@ bool hostnames = false;
  Return NULL on failure.
 */
 struct addrinfo *str2addrinfo(const char *address, const char *service, int socktype) {
-	struct addrinfo *ai = NULL, hint = {};
+	struct addrinfo *ai = NULL, hint = {0};
 	int err;

 	hint.ai_family = addressfamily;
@ -55,7 +55,7 @@ struct addrinfo *str2addrinfo(const char *address, const char *service, int sock
 }

 sockaddr_t str2sockaddr(const char *address, const char *port) {
-	struct addrinfo *ai = NULL, hint = {};
+	struct addrinfo *ai = NULL, hint = {0};
 	sockaddr_t result;
 	int err;

--- a/src/node.c
+++ b/src/node.c
@ -140,7 +140,7 @@ void node_del(node_t *n) {
 }

 node_t *lookup_node(char *name) {
-	node_t n = {};
+	node_t n = {0};

 	n.name = name;

@ -148,7 +148,7 @@ node_t *lookup_node(char *name) {
 }

 node_t *lookup_node_udp(const sockaddr_t *sa) {
-	node_t n = {};
+	node_t n = {0};

 	n.address = *sa;
 	n.name = NULL;
--- a/src/protocol.c
+++ b/src/protocol.c
@ -193,7 +193,7 @@ void exit_requests(void) {
 }

 bool seen_request(char *request) {
-	past_request_t *new, p = {};
+	past_request_t *new, p = {0};

 	p.request = request;

--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@ -60,7 +60,7 @@ bool id_h(connection_t *c) {

 	/* Check if identity is a valid name */

-	if(!check_id(name)) {
+	if(!check_id(name) || !strcmp(name, myself->name)) {
 		logger(LOG_ERR, "Got bad %s from %s (%s): %s", "ID", c->name,
 		       c->hostname, "invalid name");
 		return false;
@ -96,6 +96,11 @@ bool id_h(connection_t *c) {
 		}

 		c->allow_request = ACK;
+
+		if(!c->outgoing) {
+			send_id(c);
+		}
+
 		return send_ack(c);
 	}

@ -115,6 +120,10 @@ bool id_h(connection_t *c) {

 	c->allow_request = METAKEY;

+	if(!c->outgoing) {
+		send_id(c);
+	}
+
 	return send_metakey(c);
 }

@ -301,7 +310,8 @@ bool metakey_h(connection_t *c) {
 		c->inbudget = byte_budget(c->incipher);
 		c->status.decryptin = true;
 	} else {
-		c->incipher = NULL;
+		logger(LOG_ERR, "%s (%s) uses null cipher!", c->name, c->hostname);
+		return false;
 	}

 	c->inmaclength = maclength;
@ -319,7 +329,8 @@ bool metakey_h(connection_t *c) {
 			return false;
 		}
 	} else {
-		c->indigest = NULL;
+		logger(LOG_ERR, "%s (%s) uses null digest!", c->name, c->hostname);
+		return false;
 	}

 	c->incompression = compression;
@ -393,7 +404,11 @@ bool challenge_h(connection_t *c) {

 	/* Rest is done by send_chal_reply() */

+	if(c->outgoing) {
 		return send_chal_reply(c);
+	} else {
+		return true;
+	}
 }

 bool send_chal_reply(connection_t *c) {
@ -495,6 +510,10 @@ bool chal_reply_h(connection_t *c) {

 	c->allow_request = ACK;

+	if(!c->outgoing) {
+		send_chal_reply(c);
+	}
+
 	return send_ack(c);
 }

--- a/src/protocol_edge.c
+++ b/src/protocol_edge.c
@ -70,7 +70,7 @@ bool add_edge_h(connection_t *c) {

 	/* Check if names are valid */

-	if(!check_id(from_name) || !check_id(to_name)) {
+	if(!check_id(from_name) || !check_id(to_name) || !strcmp(from_name, to_name)) {
 		logger(LOG_ERR, "Got bad %s from %s (%s): %s", "ADD_EDGE", c->name,
 		       c->hostname, "invalid name");
 		return false;
@ -197,7 +197,7 @@ bool del_edge_h(connection_t *c) {

 	/* Check if names are valid */

-	if(!check_id(from_name) || !check_id(to_name)) {
+	if(!check_id(from_name) || !check_id(to_name) || !strcmp(from_name, to_name)) {
 		logger(LOG_ERR, "Got bad %s from %s (%s): %s", "DEL_EDGE", c->name,
 		       c->hostname, "invalid name");
 		return false;
--- a/src/protocol_key.c
+++ b/src/protocol_key.c
@ -286,6 +286,11 @@ bool ans_key_h(connection_t *c) {
 			return true;
 		}
 	} else {
+		if(from->outkeylength != 1) {
+			logger(LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname);
+			return true;
+		}
+
 		from->outcipher = NULL;
 	}

--- a/src/protocol_subnet.c
+++ b/src/protocol_subnet.c
@ -46,7 +46,7 @@ bool add_subnet_h(connection_t *c) {
 	char subnetstr[MAX_STRING_SIZE];
 	char name[MAX_STRING_SIZE];
 	node_t *owner;
-	subnet_t s = {}, *new, *old;
+	subnet_t s = {0}, *new, *old;

 	if(sscanf(c->buffer, "%*d %*x " MAX_STRING " " MAX_STRING, name, subnetstr) != 2) {
 		logger(LOG_ERR, "Got bad %s from %s (%s)", "ADD_SUBNET", c->name,
@ -160,7 +160,7 @@ bool del_subnet_h(connection_t *c) {
 	char subnetstr[MAX_STRING_SIZE];
 	char name[MAX_STRING_SIZE];
 	node_t *owner;
-	subnet_t s = {}, *find;
+	subnet_t s = {0}, *find;

 	if(sscanf(c->buffer, "%*d %*x " MAX_STRING " " MAX_STRING, name, subnetstr) != 2) {
 		logger(LOG_ERR, "Got bad %s from %s (%s)", "DEL_SUBNET", c->name,
--- a/src/route.c
+++ b/src/route.c
@ -116,8 +116,8 @@ static void swap_mac_addresses(vpn_packet_t *packet) {
 /* RFC 792 */

 static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
-	struct ip ip = {};
-	struct icmp icmp = {};
+	struct ip ip = {0};
+	struct icmp icmp = {0};

 	struct in_addr ip_src;
 	struct in_addr ip_dst;
@ -218,7 +218,7 @@ static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, length_

 static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
 	struct ip6_hdr ip6;
-	struct icmp6_hdr icmp6 = {};
+	struct icmp6_hdr icmp6 = {0};
 	uint16_t checksum;

 	struct {
@ -632,11 +632,13 @@ static void route_ipv4_unicast(node_t *source, vpn_packet_t *packet) {
 	}

 	if(!subnet->owner->status.reachable) {
-		return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
+		route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
+		return;
 	}

 	if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself) {
-		return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
+		route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
+		return;
 	}

 	if(decrement_ttl && source != myself && subnet->owner != myself)
@ -656,7 +658,8 @@ static void route_ipv4_unicast(node_t *source, vpn_packet_t *packet) {
 	}

 	if(directonly && subnet->owner != via) {
-		return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
+		route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
+		return;
 	}

 	if(via && packet->len > MAX(via->mtu, 590) && via != myself) {
@ -723,17 +726,20 @@ static void route_ipv6_unicast(node_t *source, vpn_packet_t *packet) {
 	}

 	if(!subnet->owner->status.reachable) {
-		return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
+		route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
+		return;
 	}

 	if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself) {
-		return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
+		route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
+		return;
 	}

-	if(decrement_ttl && source != myself && subnet->owner != myself)
+	if(decrement_ttl && source != myself && subnet->owner != myself) {
 		if(!do_decrement_ttl(source, packet)) {
 			return;
 		}
+	}

 	if(priorityinheritance) {
 		packet->priority = ((packet->data[14] & 0x0f) << 4) | (packet->data[15] >> 4);
@ -747,7 +753,8 @@ static void route_ipv6_unicast(node_t *source, vpn_packet_t *packet) {
 	}

 	if(directonly && subnet->owner != via) {
-		return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
+		route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
+		return;
 	}

 	if(via && packet->len > MAX(via->mtu, 1294) && via != myself) {
@ -875,7 +882,7 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
 	memcpy(packet->data, packet->data + ETH_ALEN, ETH_ALEN);        /* copy destination address */
 	packet->data[ETH_ALEN * 2 - 1] ^= 0xFF; /* mangle source address so it looks like it's not from us */

-	ip6.ip6_dst = ip6.ip6_src;                      /* swap destination and source protocoll address */
+	ip6.ip6_dst = ip6.ip6_src;                      /* swap destination and source protocol address */
 	ip6.ip6_src = ns.nd_ns_target;

 	if(has_opt) {
--- a/src/subnet.c
+++ b/src/subnet.c
@ -387,7 +387,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {

 bool net2str(char *netstr, int len, const subnet_t *subnet) {
 	if(!netstr || !subnet) {
-		logger(LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", netstr, subnet);
+		logger(LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", (void *)netstr, (void *)subnet);
 		return false;
 	}

@ -592,9 +592,9 @@ void subnet_update(node_t *owner, subnet_t *subnet, bool up) {

 	// Prepare environment variables to be passed to the script

-	xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
-	xasprintf(&envp[1], "DEVICE=%s", device ? : "");
-	xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
+	xasprintf(&envp[0], "NETNAME=%s", netname ? netname : "");
+	xasprintf(&envp[1], "DEVICE=%s", device ? device : "");
+	xasprintf(&envp[2], "INTERFACE=%s", iface ? iface : "");
 	xasprintf(&envp[3], "NODE=%s", owner->name);
 	xasprintf(&envp[4], "NAME=%s", myself->name);

@ -627,13 +627,8 @@ void subnet_update(node_t *owner, subnet_t *subnet, bool up) {
 			}

 			// Prepare the SUBNET and WEIGHT variables
-			if(envp[5]) {
 			free(envp[5]);
-			}
-
-			if(envp[6]) {
 			free(envp[6]);
-			}

 			xasprintf(&envp[5], "SUBNET=%s", netstr);
 			xasprintf(&envp[6], "WEIGHT=%s", weight);
@ -659,7 +654,7 @@ void subnet_update(node_t *owner, subnet_t *subnet, bool up) {
 		}
 	}

-	for(i = 0; envp[i] && i < 9; i++) {
+	for(i = 0; i < 9; i++) {
 		free(envp[i]);
 	}
 }
--- a/src/tincd.c
+++ b/src/tincd.c
@ -434,7 +434,10 @@ static bool keygen(int bits) {
 	BN_GENCB_set(cb, indicator, NULL);

 	rsa_key = RSA_new();
-	BN_hex2bn(&e, "10001");
+
+	if(BN_hex2bn(&e, "10001") == 0) {
+		abort();
+	}

 	if(!rsa_key || !e) {
 		abort();
@ -559,26 +562,12 @@ static void make_names(void) {
 }

 static void free_names() {
-	if(identname) {
 	free(identname);
-	}
-
-	if(netname) {
 	free(netname);
-	}
-
-	if(pidfilename) {
 	free(pidfilename);
-	}
-
-	if(logfilename) {
 	free(logfilename);
-	}
-
-	if(confbase) {
 	free(confbase);
 }
-}

 static bool drop_privs() {
 #ifdef HAVE_MINGW
@ -698,7 +687,10 @@ int main(int argc, char **argv) {

 	/* Slllluuuuuuurrrrp! */

-	RAND_load_file("/dev/urandom", 1024);
+	if(RAND_load_file("/dev/urandom", 1024) != 1024) {
+		logger(LOG_ERR, "Error initializing RNG!");
+		return 1;
+	}

 	ENGINE_load_builtin_engines();
 	ENGINE_register_all_complete();
--- a/src/uml_device.c
+++ b/src/uml_device.c
@ -181,11 +181,8 @@ void close_device(void) {
 	unlink(device);

 	free(device);
-
-	if(iface) {
 	free(iface);
 }
-}

 static bool read_packet(vpn_packet_t *packet) {
 	int lenin;
--- a/src/utils.c
+++ b/src/utils.c
@ -54,8 +54,8 @@ void bin2hex(char *src, char *dst, int length) {
 	}
 }

-#if defined(HAVE_MINGW) || defined(HAVE___CYGWIN32__)
-#ifdef HAVE___CYGWIN32__
+#if defined(HAVE_MINGW) || defined(HAVE_CYGWIN)
+#ifdef HAVE_CYGWIN
 #include <w32api/windows.h>
 #endif

--- a/src/utils.h
+++ b/src/utils.h
@ -24,8 +24,11 @@
 extern bool hex2bin(char *src, char *dst, int length);
 extern void bin2hex(char *src, char *dst, int length);

-#ifdef HAVE_MINGW
+#if defined(HAVE_MINGW) || defined(HAVE_CYGWIN)
 extern const char *winerror(int);
+#endif
+
+#ifdef HAVE_MINGW
 #define strerror(x) ((x)>0?strerror(x):winerror(GetLastError()))
 #define sockerrno WSAGetLastError()
 #define sockstrerror(x) winerror(x)
--- a/src/xalloc.h
+++ b/src/xalloc.h
@ -2,7 +2,7 @@
 #define TINC_XALLOC_H

 /*
-   xalloc.h -- malloc and related fuctions with out of memory checking
+   xalloc.h -- malloc and related functions with out of memory checking
   Copyright (C) 1990, 91, 92, 93, 94, 95, 96, 97 Free Software Foundation, Inc.
   Copyright (C) 2011-2017 Guus Sliepen <guus@tinc-vpn.org>

--- a/systemd/Makefile.in
+++ b/systemd/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.1 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2018 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -281,8 +281,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -321,7 +321,10 @@ ctags CTAGS:
 cscope cscopelist:


-distdir: $(DISTFILES)
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \