diff --git a/AUTHORS b/AUTHORS
index e418996..af11393 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -11,6 +11,7 @@ Significant contributions from:
 - Julien Muchembled <jm@jmuchemb.eu>
 - Timothy Redaelli <timothy@redaelli.eu>
 - Brandon Black <blblack@gmail.com>
+- Loïc Grenié <loic.grenie@gmail.com>
 
 These files are from other sources:
  * lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
diff --git a/ChangeLog b/ChangeLog
index 1a79275..bf7ec06 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,86 @@
-commit f3f7ccfb2890576cb8992ec5e432310cec27627a
+commit 05260f941c2a24eb3f09070a2550cf15e431266a
 Author: Guus Sliepen <guus@tinc-vpn.org>
-Date:   Sun May 8 23:15:25 2011 +0200
+Date:   Fri Jun 24 14:50:20 2011 +0200
+
+    Releasing 1.0.15.
+
+commit 3c0511984f0041f79e64bcc55d58680f86e8e408
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Fri Jun 24 12:27:04 2011 +0200
+
+    Remove redundant @CFLAGS@ from AM_CFLAGS.
+
+commit 4b3fd94b1cc79c24c4092b6b10ed4627a2648d26
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Mon Jun 6 16:26:11 2011 +0200
+
+    Improved --logfile option.
+    
+    Instead of UNIX time, the log messages now start with the time in RFC3339
+    format, which human-readable and still easy for the computer to parse and sort.
+    The HUP signal will also cause the log file to be closed and reopened, which is
+    useful when log rotation is used. If there is an error while opening the log
+    file, this is logged to stderr.
+
+commit b3bbeab6e669795f6f5a6b98590da359178bfdce
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sat Jun 4 11:27:54 2011 +0200
+
+    Attribution for Loïc Grenié.
+
+commit 50af33d01f425983dd2b1d7b61092a6325be3f41
+Author: Loïc Grenié <loic.grenie@gmail.com>
+Date:   Sat Jun 4 09:05:23 2011 +0200
+
+    Nearly tickless tinc.
+    
+    Use pselect instead of select in main_loop (if available). This lets
+    tincd sleeps as long as there is nothing to do.
+
+commit 64771f73ebbff04262defcde59263e98f89f0fa1
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sat May 28 23:46:56 2011 +0200
+
+    Remove a few unnecessary #includes.
+    
+    Some spotted by Michael Tokarev.
+
+commit 5cff8c47c1781a88123c128a4cec6cdd39925aa5
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sat May 28 23:42:18 2011 +0200
+
+    Remove newlines from log messages.
+
+commit 6d08eb1614b59d5f86a43edda9db06fca72b76cd
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sat May 28 23:36:52 2011 +0200
+
+    Fix sparse warnings and add an extra sprinkling of const.
+    
+    This is more or less the equivalent of Sven-Haegar Koch's fixes in the 1.1
+    branch.
+
+commit 07ffb1a19859791d419b83a876ba552dadedbf46
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sun May 22 15:56:04 2011 +0200
+
+    Make return value of SetPriorityClass() behave the same as setpriority().
+
+commit 03b7118139f57033659730afb740bf5cef7c961c
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Fri May 13 12:37:26 2011 +0200
+
+    Reorder checks for libraries to allow ./configure LDFLAGS=-static.
+    
+    OpenSSL depends on libdl and libz. When linking dynamically, libcrypto will
+    automatically link with the other two libraries.  However, when linking
+    statically, these libraries need to be specified explicitly while linking.  By
+    moving the autoconf checks for libdl and libz before those for libcrypto, we
+    ensure the latter test will be done with the proper libraries.
+
+commit 5686ad80b545afa3de9ed2f4176a5346e289aaa8
+Author: Guus Sliepen <guus@tinc-vpn.org>
+Date:   Sun May 8 23:17:46 2011 +0200
 
     Releasing 1.0.14.
 
diff --git a/Makefile.in b/Makefile.in
index 3101701..837e15d 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -37,7 +37,7 @@ subdir = .
 DIST_COMMON = README $(am__configure_deps) $(srcdir)/Makefile.am \
 	$(srcdir)/Makefile.in $(srcdir)/config.h.in \
 	$(top_srcdir)/configure AUTHORS COPYING ChangeLog INSTALL NEWS \
-	THANKS TODO config.guess config.sub depcomp install-sh missing
+	THANKS config.guess config.sub depcomp install-sh missing
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/openssl.m4 \
diff --git a/NEWS b/NEWS
index 792a71f..20a98d8 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,11 @@
+Version 1.0.15               June 24 2011
+
+ * Improved logging to file.
+
+ * Reduced amount of process wakeups on platforms which support pselect().
+
+ * Fixed ProcessPriority option under Windows.
+
 Version 1.0.14               May  8 2011
 
  * Fixed reading configuration files that do not end with a newline. Again.
diff --git a/README b/README
index bc8bea0..52b3356 100644
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-This is the README file for tinc version 1.0.14. Installation
+This is the README file for tinc version 1.0.15. Installation
 instructions may be found in the INSTALL file.
 
 tinc is Copyright (C) 1998-2011 by:
@@ -55,7 +55,7 @@ should be changed into "Device", and "Device" should be changed into
 Compatibility
 -------------
 
-Version 1.0.14 is compatible with 1.0pre8, 1.0 and later, but not with older
+Version 1.0.15 is compatible with 1.0pre8, 1.0 and later, but not with older
 versions of tinc.
 
 
diff --git a/THANKS b/THANKS
index dc1297b..4a6eae2 100644
--- a/THANKS
+++ b/THANKS
@@ -19,6 +19,7 @@ We would like to thank the following people for their contributions to tinc:
 * Jeroen Ubbink
 * Jerome Etienne
 * Julien Muchembled
+* Loïc Grenié
 * Lubomír Bulej
 * Mads Kiilerich
 * Marc A. Lehmann
diff --git a/TODO b/TODO
deleted file mode 100644
index de3fbfe..0000000
--- a/TODO
+++ /dev/null
@@ -1,7 +0,0 @@
-* end-to-end encryption
-* perfect forward secrecy, ECDH
-* AES in counter mode
-* Replay + Delay protection
-* MPLS-like label
-* Conflicting Subnets or key-name pairs: disable both, inform admin
-
diff --git a/config.guess b/config.guess
index c2246a4..40eaed4 100755
--- a/config.guess
+++ b/config.guess
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+#   2011 Free Software Foundation, Inc.
 
-timestamp='2009-12-30'
+timestamp='2011-05-11'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -57,7 +57,7 @@ GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free
+2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free
 Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -181,7 +181,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		fi
 		;;
 	    *)
-	        os=netbsd
+		os=netbsd
 		;;
 	esac
 	# The OS release
@@ -224,7 +224,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
 		;;
 	*5.*)
-	        UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
+		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
 		;;
 	esac
 	# According to Compaq, /usr/sbin/psrinfo has been available on
@@ -270,7 +270,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
 	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	exit ;;
+	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
+	exitcode=$?
+	trap '' 0
+	exit $exitcode ;;
     Alpha\ *:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# Should we change UNAME_MACHINE based on the output of uname instead
@@ -296,7 +299,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	echo s390-ibm-zvmoe
 	exit ;;
     *:OS400:*:*)
-        echo powerpc-ibm-os400
+	echo powerpc-ibm-os400
 	exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
@@ -395,23 +398,23 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     # MiNT.  But MiNT is downward compatible to TOS, so this should
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
+	echo m68k-atari-mint${UNAME_RELEASE}
 	exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
 	echo m68k-atari-mint${UNAME_RELEASE}
-        exit ;;
+	exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
+	echo m68k-atari-mint${UNAME_RELEASE}
 	exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-        echo m68k-milan-mint${UNAME_RELEASE}
-        exit ;;
+	echo m68k-milan-mint${UNAME_RELEASE}
+	exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-        echo m68k-hades-mint${UNAME_RELEASE}
-        exit ;;
+	echo m68k-hades-mint${UNAME_RELEASE}
+	exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-        echo m68k-unknown-mint${UNAME_RELEASE}
-        exit ;;
+	echo m68k-unknown-mint${UNAME_RELEASE}
+	exit ;;
     m68k:machten:*:*)
 	echo m68k-apple-machten${UNAME_RELEASE}
 	exit ;;
@@ -481,8 +484,8 @@ EOF
 	echo m88k-motorola-sysv3
 	exit ;;
     AViiON:dgux:*:*)
-        # DG/UX returns AViiON for all architectures
-        UNAME_PROCESSOR=`/usr/bin/uname -p`
+	# DG/UX returns AViiON for all architectures
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
 	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
 	then
 	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
@@ -495,7 +498,7 @@ EOF
 	else
 	    echo i586-dg-dgux${UNAME_RELEASE}
 	fi
- 	exit ;;
+	exit ;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
 	echo m88k-dolphin-sysv3
 	exit ;;
@@ -552,7 +555,7 @@ EOF
 		echo rs6000-ibm-aix3.2
 	fi
 	exit ;;
-    *:AIX:*:[456])
+    *:AIX:*:[4567])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
@@ -595,52 +598,52 @@ EOF
 	    9000/[678][0-9][0-9])
 		if [ -x /usr/bin/getconf ]; then
 		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
-                    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-                    case "${sc_cpu_version}" in
-                      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
-                      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
-                      532)                      # CPU_PA_RISC2_0
-                        case "${sc_kernel_bits}" in
-                          32) HP_ARCH="hppa2.0n" ;;
-                          64) HP_ARCH="hppa2.0w" ;;
+		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
+		    case "${sc_cpu_version}" in
+		      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
+		      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
+		      532)                      # CPU_PA_RISC2_0
+			case "${sc_kernel_bits}" in
+			  32) HP_ARCH="hppa2.0n" ;;
+			  64) HP_ARCH="hppa2.0w" ;;
 			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
-                        esac ;;
-                    esac
+			esac ;;
+		    esac
 		fi
 		if [ "${HP_ARCH}" = "" ]; then
 		    eval $set_cc_for_build
-		    sed 's/^              //' << EOF >$dummy.c
+		    sed 's/^		//' << EOF >$dummy.c
 
-              #define _HPUX_SOURCE
-              #include <stdlib.h>
-              #include <unistd.h>
+		#define _HPUX_SOURCE
+		#include <stdlib.h>
+		#include <unistd.h>
 
-              int main ()
-              {
-              #if defined(_SC_KERNEL_BITS)
-                  long bits = sysconf(_SC_KERNEL_BITS);
-              #endif
-                  long cpu  = sysconf (_SC_CPU_VERSION);
+		int main ()
+		{
+		#if defined(_SC_KERNEL_BITS)
+		    long bits = sysconf(_SC_KERNEL_BITS);
+		#endif
+		    long cpu  = sysconf (_SC_CPU_VERSION);
 
-                  switch (cpu)
-              	{
-              	case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
-              	case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
-              	case CPU_PA_RISC2_0:
-              #if defined(_SC_KERNEL_BITS)
-              	    switch (bits)
-              		{
-              		case 64: puts ("hppa2.0w"); break;
-              		case 32: puts ("hppa2.0n"); break;
-              		default: puts ("hppa2.0"); break;
-              		} break;
-              #else  /* !defined(_SC_KERNEL_BITS) */
-              	    puts ("hppa2.0"); break;
-              #endif
-              	default: puts ("hppa1.0"); break;
-              	}
-                  exit (0);
-              }
+		    switch (cpu)
+			{
+			case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
+			case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
+			case CPU_PA_RISC2_0:
+		#if defined(_SC_KERNEL_BITS)
+			    switch (bits)
+				{
+				case 64: puts ("hppa2.0w"); break;
+				case 32: puts ("hppa2.0n"); break;
+				default: puts ("hppa2.0"); break;
+				} break;
+		#else  /* !defined(_SC_KERNEL_BITS) */
+			    puts ("hppa2.0"); break;
+		#endif
+			default: puts ("hppa1.0"); break;
+			}
+		    exit (0);
+		}
 EOF
 		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
@@ -731,22 +734,22 @@ EOF
 	exit ;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
 	echo c1-convex-bsd
-        exit ;;
+	exit ;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-        exit ;;
+	exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
 	echo c34-convex-bsd
-        exit ;;
+	exit ;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
 	echo c38-convex-bsd
-        exit ;;
+	exit ;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
 	echo c4-convex-bsd
-        exit ;;
+	exit ;;
     CRAY*Y-MP:*:*:*)
 	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
@@ -770,14 +773,14 @@ EOF
 	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
-        FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-        echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit ;;
+	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
+	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	exit ;;
     5000:UNIX_System_V:4.*:*)
-        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
-        FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
-        echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
 	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
@@ -805,14 +808,14 @@ EOF
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
     i*:windows32*:*)
-    	# uname -m includes "-pc" on this system.
-    	echo ${UNAME_MACHINE}-mingw32
+	# uname -m includes "-pc" on this system.
+	echo ${UNAME_MACHINE}-mingw32
 	exit ;;
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
     *:Interix*:*)
-    	case ${UNAME_MACHINE} in
+	case ${UNAME_MACHINE} in
 	    x86)
 		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
@@ -867,7 +870,7 @@ EOF
 	  EV6)   UNAME_MACHINE=alphaev6 ;;
 	  EV67)  UNAME_MACHINE=alphaev67 ;;
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
+	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
 	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
@@ -879,7 +882,13 @@ EOF
 	then
 	    echo ${UNAME_MACHINE}-unknown-linux-gnu
 	else
-	    echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
+		| grep -q __ARM_PCS_VFP
+	    then
+		echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+	    else
+		echo ${UNAME_MACHINE}-unknown-linux-gnueabihf
+	    fi
 	fi
 	exit ;;
     avr32*:Linux:*:*)
@@ -892,7 +901,7 @@ EOF
 	echo crisv32-axis-linux-gnu
 	exit ;;
     frv:Linux:*:*)
-    	echo frv-unknown-linux-gnu
+	echo frv-unknown-linux-gnu
 	exit ;;
     i*86:Linux:*:*)
 	LIBC=gnu
@@ -960,7 +969,7 @@ EOF
 	echo ${UNAME_MACHINE}-ibm-linux
 	exit ;;
     sh64*:Linux:*:*)
-    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
     sh*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
@@ -968,6 +977,9 @@ EOF
     sparc:Linux:*:* | sparc64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
+    tile*:Linux:*:*)
+	echo ${UNAME_MACHINE}-tilera-linux-gnu
+	exit ;;
     vax:Linux:*:*)
 	echo ${UNAME_MACHINE}-dec-linux-gnu
 	exit ;;
@@ -975,7 +987,7 @@ EOF
 	echo x86_64-unknown-linux-gnu
 	exit ;;
     xtensa*:Linux:*:*)
-    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
@@ -984,11 +996,11 @@ EOF
 	echo i386-sequent-sysv4
 	exit ;;
     i*86:UNIX_SV:4.2MP:2.*)
-        # Unixware is an offshoot of SVR4, but it has its own version
-        # number series starting with 2...
-        # I am not positive that other SVR4 systems won't match this,
+	# Unixware is an offshoot of SVR4, but it has its own version
+	# number series starting with 2...
+	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope.  -- rms.
-        # Use sysv4.2uw... so that sysv4* matches it.
+	# Use sysv4.2uw... so that sysv4* matches it.
 	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
 	exit ;;
     i*86:OS/2:*:*)
@@ -1020,7 +1032,7 @@ EOF
 	fi
 	exit ;;
     i*86:*:5:[678]*)
-    	# UnixWare 7.x, OpenUNIX and OpenServer 6.
+	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
 	    *486*)	     UNAME_MACHINE=i486 ;;
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
@@ -1048,13 +1060,13 @@ EOF
 	exit ;;
     pc:*:*:*)
 	# Left here for compatibility:
-        # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i586.
+	# uname -m prints for DJGPP always 'pc', but it prints nothing about
+	# the processor, so we play safe by assuming i586.
 	# Note: whatever this is, it MUST be the same as what config.sub
 	# prints for the "djgpp" host, or else GDB configury will decide that
 	# this is a cross-build.
 	echo i586-pc-msdosdjgpp
-        exit ;;
+	exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
 	exit ;;
@@ -1089,8 +1101,8 @@ EOF
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
 	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
-        /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && { echo i486-ncr-sysv4; exit; } ;;
+	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
+	  && { echo i486-ncr-sysv4; exit; } ;;
     NCR*:*:4.2:* | MPRAS*:*:4.2:*)
 	OS_REL='.3'
 	test -r /etc/.relid \
@@ -1133,10 +1145,10 @@ EOF
 		echo ns32k-sni-sysv
 	fi
 	exit ;;
-    PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
-                      # says <Richard.M.Bartel@ccMail.Census.GOV>
-        echo i586-unisys-sysv4
-        exit ;;
+    PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
+			# says <Richard.M.Bartel@ccMail.Census.GOV>
+	echo i586-unisys-sysv4
+	exit ;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
@@ -1162,11 +1174,11 @@ EOF
 	exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if [ -d /usr/nec ]; then
-	        echo mips-nec-sysv${UNAME_RELEASE}
+		echo mips-nec-sysv${UNAME_RELEASE}
 	else
-	        echo mips-unknown-sysv${UNAME_RELEASE}
+		echo mips-unknown-sysv${UNAME_RELEASE}
 	fi
-        exit ;;
+	exit ;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
 	echo powerpc-be-beos
 	exit ;;
@@ -1231,6 +1243,9 @@ EOF
     *:QNX:*:4*)
 	echo i386-pc-qnx
 	exit ;;
+    NEO-?:NONSTOP_KERNEL:*:*)
+	echo neo-tandem-nsk${UNAME_RELEASE}
+	exit ;;
     NSE-?:NONSTOP_KERNEL:*:*)
 	echo nse-tandem-nsk${UNAME_RELEASE}
 	exit ;;
@@ -1276,13 +1291,13 @@ EOF
 	echo pdp10-unknown-its
 	exit ;;
     SEI:*:*:SEIUX)
-        echo mips-sei-seiux${UNAME_RELEASE}
+	echo mips-sei-seiux${UNAME_RELEASE}
 	exit ;;
     *:DragonFly:*:*)
 	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
 	exit ;;
     *:*VMS:*:*)
-    	UNAME_MACHINE=`(uname -p) 2>/dev/null`
+	UNAME_MACHINE=`(uname -p) 2>/dev/null`
 	case "${UNAME_MACHINE}" in
 	    A*) echo alpha-dec-vms ; exit ;;
 	    I*) echo ia64-dec-vms ; exit ;;
@@ -1322,11 +1337,11 @@ main ()
 #include <sys/param.h>
   printf ("m68k-sony-newsos%s\n",
 #ifdef NEWSOS4
-          "4"
+	"4"
 #else
-	  ""
+	""
 #endif
-         ); exit (0);
+	); exit (0);
 #endif
 #endif
 
diff --git a/config.h.in b/config.h.in
index bd0cc8a..2389c94 100644
--- a/config.h.in
+++ b/config.h.in
@@ -206,6 +206,9 @@
 /* Define to 1 if you have the <openssl/sha.h> header file. */
 #undef HAVE_OPENSSL_SHA_H
 
+/* Define to 1 if you have the `pselect' function. */
+#undef HAVE_PSELECT
+
 /* Define to 1 if you have the `putenv' function. */
 #undef HAVE_PUTENV
 
@@ -333,6 +336,9 @@
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
 
+/* Define to 1 if you have the <time.h> header file. */
+#undef HAVE_TIME_H
+
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
diff --git a/config.sub b/config.sub
index c2d1257..30fdca8 100755
--- a/config.sub
+++ b/config.sub
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+#   2011 Free Software Foundation, Inc.
 
-timestamp='2010-01-22'
+timestamp='2011-03-23'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -76,7 +76,7 @@ version="\
 GNU config.sub ($timestamp)
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000,
-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free
+2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free
 Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -124,8 +124,9 @@ esac
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
-  uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
+  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
+  linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
+  knetbsd*-gnu* | netbsd*-gnu* | \
   kopensolaris*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
@@ -157,8 +158,8 @@ case $os in
 		os=
 		basic_machine=$1
 		;;
-        -bluegene*)
-	        os=-cnk
+	-bluegene*)
+		os=-cnk
 		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
@@ -174,10 +175,10 @@ case $os in
 		os=-chorusos
 		basic_machine=$1
 		;;
- 	-chorusrdb)
- 		os=-chorusrdb
+	-chorusrdb)
+		os=-chorusrdb
 		basic_machine=$1
- 		;;
+		;;
 	-hiux*)
 		os=-hiuxwe2
 		;;
@@ -282,11 +283,13 @@ case $basic_machine in
 	| moxie \
 	| mt \
 	| msp430 \
+	| nds32 | nds32le | nds32be \
 	| nios | nios2 \
 	| ns16k | ns32k \
+	| open8 \
 	| or32 \
 	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
+	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pyramid \
 	| rx \
 	| score \
@@ -294,15 +297,24 @@ case $basic_machine in
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
-	| spu | strongarm \
-	| tahoe | thumb | tic4x | tic80 | tron \
+	| spu \
+	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
 	| ubicom32 \
 	| v850 | v850e \
 	| we32k \
-	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
+	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
+	c54x)
+		basic_machine=tic54x-unknown
+		;;
+	c55x)
+		basic_machine=tic55x-unknown
+		;;
+	c6x)
+		basic_machine=tic6x-unknown
+		;;
 	m6811 | m68hc11 | m6812 | m68hc12 | picochip)
 		# Motorola 68HC11/12.
 		basic_machine=$basic_machine-unknown
@@ -314,6 +326,18 @@ case $basic_machine in
 		basic_machine=mt-unknown
 		;;
 
+	strongarm | thumb | xscale)
+		basic_machine=arm-unknown
+		;;
+
+	xscaleeb)
+		basic_machine=armeb-unknown
+		;;
+
+	xscaleel)
+		basic_machine=armel-unknown
+		;;
+
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
 	# (2) the word "unknown" tends to confuse beginning users.
@@ -334,7 +358,7 @@ case $basic_machine in
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
 	| bfin-* | bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
+	| c[123]* | c30-* | [cjt]90-* | c4x-* \
 	| clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
@@ -368,26 +392,28 @@ case $basic_machine in
 	| mmix-* \
 	| mt-* \
 	| msp430-* \
+	| nds32-* | nds32le-* | nds32be-* \
 	| nios-* | nios2-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
+	| open8-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
+	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
 	| pyramid-* \
 	| romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
-	| tahoe-* | thumb-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
+	| tahoe-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tile-* | tilegx-* \
 	| tron-* \
 	| ubicom32-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
-	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
+	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
 	| ymp-* \
 	| z8k-* | z80-*)
@@ -412,7 +438,7 @@ case $basic_machine in
 		basic_machine=a29k-amd
 		os=-udi
 		;;
-    	abacus)
+	abacus)
 		basic_machine=abacus-unknown
 		;;
 	adobe68k)
@@ -482,11 +508,20 @@ case $basic_machine in
 		basic_machine=powerpc-ibm
 		os=-cnk
 		;;
+	c54x-*)
+		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	c55x-*)
+		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	c6x-*)
+		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
 		;;
-        cegcc)
+	cegcc)
 		basic_machine=arm-unknown
 		os=-cegcc
 		;;
@@ -518,7 +553,7 @@ case $basic_machine in
 		basic_machine=craynv-cray
 		os=-unicosmp
 		;;
-	cr16)
+	cr16 | cr16-*)
 		basic_machine=cr16-unknown
 		os=-elf
 		;;
@@ -734,7 +769,7 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
-        microblaze)
+	microblaze)
 		basic_machine=microblaze-xilinx
 		;;
 	mingw32)
@@ -841,6 +876,12 @@ case $basic_machine in
 	np1)
 		basic_machine=np1-gould
 		;;
+	neo-tandem)
+		basic_machine=neo-tandem
+		;;
+	nse-tandem)
+		basic_machine=nse-tandem
+		;;
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
@@ -923,9 +964,10 @@ case $basic_machine in
 		;;
 	power)	basic_machine=power-ibm
 		;;
-	ppc)	basic_machine=powerpc-unknown
+	ppc | ppcbe)	basic_machine=powerpc-unknown
 		;;
-	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc-* | ppcbe-*)
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
@@ -1019,6 +1061,9 @@ case $basic_machine in
 		basic_machine=i860-stratus
 		os=-sysv4
 		;;
+	strongarm-* | thumb-*)
+		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	sun2)
 		basic_machine=m68000-sun
 		;;
@@ -1075,20 +1120,8 @@ case $basic_machine in
 		basic_machine=t90-cray
 		os=-unicos
 		;;
-	tic54x | c54x*)
-		basic_machine=tic54x-unknown
-		os=-coff
-		;;
-	tic55x | c55x*)
-		basic_machine=tic55x-unknown
-		os=-coff
-		;;
-	tic6x | c6x*)
-		basic_machine=tic6x-unknown
-		os=-coff
-		;;
-        # This must be matched before tile*.
-        tilegx*)
+	# This must be matched before tile*.
+	tilegx*)
 		basic_machine=tilegx-unknown
 		os=-linux-gnu
 		;;
@@ -1163,6 +1196,9 @@ case $basic_machine in
 	xps | xps100)
 		basic_machine=xps100-honeywell
 		;;
+	xscale-* | xscalee[bl]-*)
+		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
+		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
@@ -1260,11 +1296,11 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-        # First match some system type aliases
-        # that might get confused with valid system types.
+	# First match some system type aliases
+	# that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
-        -auroraux)
-	        os=-auroraux
+	-auroraux)
+		os=-auroraux
 		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
@@ -1301,7 +1337,8 @@ case $os in
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
 	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
+	      | -mingw32* | -linux-gnu* | -linux-android* \
+	      | -linux-newlib* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
@@ -1348,7 +1385,7 @@ case $os in
 	-opened*)
 		os=-openedition
 		;;
-        -os400*)
+	-os400*)
 		os=-os400
 		;;
 	-wince*)
@@ -1397,7 +1434,7 @@ case $os in
 	-sinix*)
 		os=-sysv4
 		;;
-        -tpf*)
+	-tpf*)
 		os=-tpf
 		;;
 	-triton*)
@@ -1442,8 +1479,8 @@ case $os in
 	-dicos*)
 		os=-dicos
 		;;
-        -nacl*)
-	        ;;
+	-nacl*)
+		;;
 	-none)
 		;;
 	*)
@@ -1466,10 +1503,10 @@ else
 # system, and we'll never get to this point.
 
 case $basic_machine in
-        score-*)
+	score-*)
 		os=-elf
 		;;
-        spu-*)
+	spu-*)
 		os=-elf
 		;;
 	*-acorn)
@@ -1481,8 +1518,17 @@ case $basic_machine in
 	arm*-semi)
 		os=-aout
 		;;
-        c4x-* | tic4x-*)
-        	os=-coff
+	c4x-* | tic4x-*)
+		os=-coff
+		;;
+	tic54x-*)
+		os=-coff
+		;;
+	tic55x-*)
+		os=-coff
+		;;
+	tic6x-*)
+		os=-coff
 		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
@@ -1509,7 +1555,7 @@ case $basic_machine in
 	m68*-cisco)
 		os=-aout
 		;;
-        mep-*)
+	mep-*)
 		os=-elf
 		;;
 	mips*-cisco)
@@ -1536,7 +1582,7 @@ case $basic_machine in
 	*-ibm)
 		os=-aix
 		;;
-    	*-knuth)
+	*-knuth)
 		os=-mmixware
 		;;
 	*-wec)
diff --git a/configure b/configure
index fac7ab7..22cdcfd 100755
--- a/configure
+++ b/configure
@@ -707,9 +707,6 @@ enable_maintainer_mode
 enable_dependency_tracking
 enable_tunemu
 with_windows2000
-with_openssl
-with_openssl_include
-with_openssl_lib
 enable_zlib
 with_zlib
 with_zlib_include
@@ -718,6 +715,9 @@ enable_lzo
 with_lzo
 with_lzo_include
 with_lzo_lib
+with_openssl
+with_openssl_include
+with_openssl_lib
 enable_jumbograms
 '
       ac_precious_vars='build_alias
@@ -1362,17 +1362,17 @@ Optional Packages:
   --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
   --with-windows2000      compile with support for Windows 2000. This disables
                           support for tunneling over existing IPv6 networks.
-  --with-openssl=DIR      OpenSSL base directory, or:
-  --with-openssl-include=DIR
-                          OpenSSL headers directory (without trailing
-                          /openssl)
-  --with-openssl-lib=DIR  OpenSSL library directory
   --with-zlib=DIR         zlib base directory, or:
   --with-zlib-include=DIR zlib headers directory
   --with-zlib-lib=DIR     zlib library directory
   --with-lzo=DIR          lzo base directory, or:
   --with-lzo-include=DIR  lzo headers directory
   --with-lzo-lib=DIR      lzo library directory
+  --with-openssl=DIR      OpenSSL base directory, or:
+  --with-openssl-include=DIR
+                          OpenSSL headers directory (without trailing
+                          /openssl)
+  --with-openssl-lib=DIR  OpenSSL library directory
 
 Some influential environment variables:
   CC          C compiler command
@@ -2731,7 +2731,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE=tinc
- VERSION=1.0.14
+ VERSION=1.0.15
 
 
 cat >>confdefs.h <<_ACEOF
@@ -5041,7 +5041,7 @@ $as_echo "#define STDC_HEADERS 1" >>confdefs.h
 
 fi
 
-for ac_header in stdbool.h syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h dirent.h
+for ac_header in stdbool.h syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h dirent.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@@ -5782,7 +5782,7 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 
 
-for ac_func in asprintf daemon fchmod flock ftime fork get_current_dir_name gettimeofday mlockall putenv random select strdup strerror strsignal strtol system unsetenv usleep vsyslog writev
+for ac_func in asprintf daemon fchmod flock ftime fork get_current_dir_name gettimeofday mlockall pselect putenv random select strdup strerror strsignal strtol system unsetenv usleep vsyslog writev
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -6175,178 +6175,6 @@ rm -f confcache
 
 
 
-
-# Check whether --with-openssl was given.
-if test "${with_openssl+set}" = set; then :
-  withval=$with_openssl; openssl="$withval"
-     CPPFLAGS="$CPPFLAGS -I$withval/include"
-     LDFLAGS="$LDFLAGS -L$withval/lib"
-
-fi
-
-
-
-# Check whether --with-openssl-include was given.
-if test "${with_openssl_include+set}" = set; then :
-  withval=$with_openssl_include; openssl_include="$withval"
-     CPPFLAGS="$CPPFLAGS -I$withval"
-
-fi
-
-
-
-# Check whether --with-openssl-lib was given.
-if test "${with_openssl_lib+set}" = set; then :
-  withval=$with_openssl_lib; openssl_lib="$withval"
-     LDFLAGS="$LDFLAGS -L$withval"
-
-fi
-
-
-  for ac_header in openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
-
-else
-  as_fn_error $? "OpenSSL header files not found." "$LINENO" 5; break
-
-fi
-
-done
-
-
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_EncryptInit_ex in -lcrypto" >&5
-$as_echo_n "checking for EVP_EncryptInit_ex in -lcrypto... " >&6; }
-if ${ac_cv_lib_crypto_EVP_EncryptInit_ex+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcrypto  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char EVP_EncryptInit_ex ();
-int
-main ()
-{
-return EVP_EncryptInit_ex ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_crypto_EVP_EncryptInit_ex=yes
-else
-  ac_cv_lib_crypto_EVP_EncryptInit_ex=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_EVP_EncryptInit_ex" >&5
-$as_echo "$ac_cv_lib_crypto_EVP_EncryptInit_ex" >&6; }
-if test "x$ac_cv_lib_crypto_EVP_EncryptInit_ex" = xyes; then :
-  LIBS="-lcrypto $LIBS"
-else
-  as_fn_error $? "OpenSSL libraries not found." "$LINENO" 5
-
-fi
-
-
-case $host_os in
-  *mingw*)
-  ;;
-  *)
-    ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen"
-if test "x$ac_cv_func_dlopen" = xyes; then :
-
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ldl  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char dlopen ();
-int
-main ()
-{
-return dlopen ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_dl_dlopen=yes
-else
-  ac_cv_lib_dl_dlopen=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
-  LIBS="$LIBS -ldl"
-else
-  as_fn_error $? "OpenSSL depends on libdl." "$LINENO" 5; break
-
-fi
-
-
-fi
-
-  ;;
-esac
-
-  for ac_func in RAND_pseudo_bytes EVP_EncryptInit_ex
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-else
-  as_fn_error $? "Missing OpenSSL functionality, make sure you have installed the latest version." "$LINENO" 5; break
-fi
-done
-
-
-  ac_fn_c_check_decl "$LINENO" "OpenSSL_add_all_algorithms" "ac_cv_have_decl_OpenSSL_add_all_algorithms" "#include <openssl/evp.h>
-
-"
-if test "x$ac_cv_have_decl_OpenSSL_add_all_algorithms" = xyes; then :
-
-else
-  as_fn_error $? "Missing OpenSSL functionality, make sure you have installed the latest version." "$LINENO" 5; break
-fi
-
-
-
   # Check whether --enable-zlib was given.
 if test "${enable_zlib+set}" = set; then :
   enableval=$enable_zlib;
@@ -6625,6 +6453,178 @@ done
 fi
 
 
+  case $host_os in
+    *mingw*)
+    ;;
+    *)
+      ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen"
+if test "x$ac_cv_func_dlopen" = xyes; then :
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
+$as_echo_n "checking for dlopen in -ldl... " >&6; }
+if ${ac_cv_lib_dl_dlopen+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-ldl  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char dlopen ();
+int
+main ()
+{
+return dlopen ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_dl_dlopen=yes
+else
+  ac_cv_lib_dl_dlopen=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
+$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
+if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+  LIBS="$LIBS -ldl"
+else
+  as_fn_error $? "OpenSSL depends on libdl." "$LINENO" 5; break
+
+fi
+
+
+fi
+
+    ;;
+  esac
+
+
+# Check whether --with-openssl was given.
+if test "${with_openssl+set}" = set; then :
+  withval=$with_openssl; openssl="$withval"
+     CPPFLAGS="$CPPFLAGS -I$withval/include"
+     LDFLAGS="$LDFLAGS -L$withval/lib"
+
+fi
+
+
+
+# Check whether --with-openssl-include was given.
+if test "${with_openssl_include+set}" = set; then :
+  withval=$with_openssl_include; openssl_include="$withval"
+     CPPFLAGS="$CPPFLAGS -I$withval"
+
+fi
+
+
+
+# Check whether --with-openssl-lib was given.
+if test "${with_openssl_lib+set}" = set; then :
+  withval=$with_openssl_lib; openssl_lib="$withval"
+     LDFLAGS="$LDFLAGS -L$withval"
+
+fi
+
+
+  for ac_header in openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h
+do :
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+else
+  as_fn_error $? "OpenSSL header files not found." "$LINENO" 5; break
+
+fi
+
+done
+
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_EncryptInit_ex in -lcrypto" >&5
+$as_echo_n "checking for EVP_EncryptInit_ex in -lcrypto... " >&6; }
+if ${ac_cv_lib_crypto_EVP_EncryptInit_ex+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lcrypto  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char EVP_EncryptInit_ex ();
+int
+main ()
+{
+return EVP_EncryptInit_ex ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_crypto_EVP_EncryptInit_ex=yes
+else
+  ac_cv_lib_crypto_EVP_EncryptInit_ex=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_EVP_EncryptInit_ex" >&5
+$as_echo "$ac_cv_lib_crypto_EVP_EncryptInit_ex" >&6; }
+if test "x$ac_cv_lib_crypto_EVP_EncryptInit_ex" = xyes; then :
+  LIBS="-lcrypto $LIBS"
+else
+  as_fn_error $? "OpenSSL libraries not found." "$LINENO" 5
+
+fi
+
+
+  for ac_func in RAND_pseudo_bytes EVP_EncryptInit_ex
+do :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+else
+  as_fn_error $? "Missing OpenSSL functionality, make sure you have installed the latest version." "$LINENO" 5; break
+fi
+done
+
+
+  ac_fn_c_check_decl "$LINENO" "OpenSSL_add_all_algorithms" "ac_cv_have_decl_OpenSSL_add_all_algorithms" "#include <openssl/evp.h>
+
+"
+if test "x$ac_cv_have_decl_OpenSSL_add_all_algorithms" = xyes; then :
+
+else
+  as_fn_error $? "Missing OpenSSL functionality, make sure you have installed the latest version." "$LINENO" 5; break
+fi
+
+
+
 # Check whether --enable-jumbograms was given.
 if test "${enable_jumbograms+set}" = set; then :
   enableval=$enable_jumbograms;
diff --git a/configure.in b/configure.in
index a6dd6d6..12938da 100644
--- a/configure.in
+++ b/configure.in
@@ -3,7 +3,7 @@ dnl Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.61)
 AC_INIT
 AC_CONFIG_SRCDIR([src/tincd.c])
-AM_INIT_AUTOMAKE(tinc, 1.0.14)
+AM_INIT_AUTOMAKE(tinc, 1.0.15)
 AC_CONFIG_HEADERS([config.h])
 AM_MAINTAINER_MODE
 
@@ -101,7 +101,7 @@ dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
 
 AC_HEADER_STDC
-AC_CHECK_HEADERS([stdbool.h syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h dirent.h])
+AC_CHECK_HEADERS([stdbool.h syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h dirent.h])
 AC_CHECK_HEADERS([net/if.h net/if_types.h linux/if_tun.h net/if_tun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h],
   [], [], [#include "have.h"]
 )
@@ -130,7 +130,7 @@ dnl Checks for library functions.
 AC_FUNC_MEMCMP
 AC_FUNC_ALLOCA
 AC_TYPE_SIGNAL
-AC_CHECK_FUNCS([asprintf daemon fchmod flock ftime fork get_current_dir_name gettimeofday mlockall putenv random select strdup strerror strsignal strtol system unsetenv usleep vsyslog writev],
+AC_CHECK_FUNCS([asprintf daemon fchmod flock ftime fork get_current_dir_name gettimeofday mlockall pselect putenv random select strdup strerror strsignal strtol system unsetenv usleep vsyslog writev],
   [], [], [#include "have.h"]
 )
 AC_FUNC_MALLOC
@@ -153,9 +153,9 @@ AC_CACHE_SAVE
 
 dnl These are defined in files in m4/
 
-tinc_OPENSSL
 tinc_ZLIB
 tinc_LZO
+tinc_OPENSSL
 
 dnl Check if support for jumbograms is requested 
 AC_ARG_ENABLE(jumbograms,
diff --git a/doc/sample-config.tar.gz b/doc/sample-config.tar.gz
index da56735..17d7c43 100644
Binary files a/doc/sample-config.tar.gz and b/doc/sample-config.tar.gz differ
diff --git a/doc/tinc.info b/doc/tinc.info
index 07244b9..265c685 100644
--- a/doc/tinc.info
+++ b/doc/tinc.info
@@ -5,7 +5,7 @@ START-INFO-DIR-ENTRY
 * tinc: (tinc).              The tinc Manual.
 END-INFO-DIR-ENTRY
 
-   This is the info manual for tinc version 1.0.14, a Virtual Private
+   This is the info manual for tinc version 1.0.15, a Virtual Private
 Network daemon.
 
    Copyright (C) 1998-2011 Ivo Timmermans, Guus Sliepen
@@ -1503,7 +1503,9 @@ You can also send the following signals to a running tincd process:
 `HUP'
      Partially rereads configuration files.  Connections to hosts whose
      host config file are removed are closed.  New outgoing connections
-     specified in `tinc.conf' will be made.
+     specified in `tinc.conf' will be made.  If the -logfile option is
+     used, this will also close and reopen the log file, useful when
+     log rotation is used.
 
 `INT'
      Temporarily increases debug level to 5.  Send this signal again to
@@ -2509,25 +2511,25 @@ Node: Example configuration47500
 Node: Running tinc52823
 Node: Runtime options53413
 Node: Signals56369
-Node: Debug levels57438
-Node: Solving problems58374
-Node: Error messages59926
-Node: Sending bug reports63939
-Node: Technical information64891
-Node: The connection65122
-Node: The UDP tunnel65434
-Node: The meta-connection68495
-Node: The meta-protocol69964
-Node: Security74973
-Node: Authentication protocol76103
-Node: Encryption of network packets81107
-Node: Security issues82480
-Node: Platform specific information84097
-Node: Interface configuration84325
-Node: Routes86224
-Node: About us88140
-Node: Contact information88315
-Node: Authors88719
-Node: Concept Index89124
+Node: Debug levels57561
+Node: Solving problems58497
+Node: Error messages60049
+Node: Sending bug reports64062
+Node: Technical information65014
+Node: The connection65245
+Node: The UDP tunnel65557
+Node: The meta-connection68618
+Node: The meta-protocol70087
+Node: Security75096
+Node: Authentication protocol76226
+Node: Encryption of network packets81230
+Node: Security issues82603
+Node: Platform specific information84220
+Node: Interface configuration84448
+Node: Routes86347
+Node: About us88263
+Node: Contact information88438
+Node: Authors88842
+Node: Concept Index89247
 
 End Tag Table
diff --git a/doc/tinc.texi b/doc/tinc.texi
index 6bbc2e2..52a0ecc 100644
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
@@ -1638,6 +1638,8 @@ it defaults to the maximum time of 15 minutes.
 Partially rereads configuration files.
 Connections to hosts whose host config file are removed are closed.
 New outgoing connections specified in @file{tinc.conf} will be made.
+If the --logfile option is used, this will also close and reopen the log file,
+useful when log rotation is used.
 
 @item INT
 Temporarily increases debug level to 5.
diff --git a/doc/tincd.8.in b/doc/tincd.8.in
index a8ef2fb..5ea08c0 100644
--- a/doc/tincd.8.in
+++ b/doc/tincd.8.in
@@ -130,6 +130,10 @@ Connections to hosts whose host config file are removed are closed.
 New outgoing connections specified in
 .Pa tinc.conf
 will be made.
+If the
+.Fl -logfile
+option is used, this will also close and reopen the log file,
+useful when log rotation is used.
 .It INT
 Temporarily increases debug level to 5.
 Send this signal again to revert to the original level.
diff --git a/have.h b/have.h
index 073fbaa..72af069 100644
--- a/have.h
+++ b/have.h
@@ -71,6 +71,10 @@
 #include <sys/time.h>
 #endif
 
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
diff --git a/lib/pidfile.c b/lib/pidfile.c
index 425b304..6e24d5f 100644
--- a/lib/pidfile.c
+++ b/lib/pidfile.c
@@ -27,6 +27,8 @@
 
 #include "system.h"
 
+#include "pidfile.h"
+
 #ifndef HAVE_MINGW
 /* read_pid
  *
@@ -34,7 +36,7 @@
  * 0 is returned if either there's no pidfile, it's empty
  * or no pid can be read.
  */
-pid_t read_pid (char *pidfile)
+pid_t read_pid (const char *pidfile)
 {
   FILE *f;
   long pid;
@@ -53,7 +55,7 @@ pid_t read_pid (char *pidfile)
  * table (using /proc) to determine if the process already exists. If
  * so the pid is returned, otherwise 0.
  */
-pid_t check_pid (char *pidfile)
+pid_t check_pid (const char *pidfile)
 {
   pid_t pid = read_pid(pidfile);
 
@@ -79,7 +81,7 @@ pid_t check_pid (char *pidfile)
  * Writes the pid to the specified file. If that fails 0 is
  * returned, otherwise the pid.
  */
-pid_t write_pid (char *pidfile)
+pid_t write_pid (const char *pidfile)
 {
   FILE *f;
   int fd;
@@ -124,7 +126,7 @@ pid_t write_pid (char *pidfile)
  * Remove the the specified file. The result from unlink(2)
  * is returned
  */
-int remove_pid (char *pidfile)
+int remove_pid (const char *pidfile)
 {
   return unlink (pidfile);
 }
diff --git a/lib/pidfile.h b/lib/pidfile.h
index d7b970c..590a7bc 100644
--- a/lib/pidfile.h
+++ b/lib/pidfile.h
@@ -26,7 +26,7 @@
  * 0 is returned if either there's no pidfile, it's empty
  * or no pid can be read.
  */
-pid_t read_pid (char *pidfile);
+extern pid_t read_pid (const char *pidfile);
 
 /* check_pid
  *
@@ -34,19 +34,19 @@ pid_t read_pid (char *pidfile);
  * table (using /proc) to determine if the process already exists. If
  * so 1 is returned, otherwise 0.
  */
-pid_t check_pid (char *pidfile);
+extern pid_t check_pid (const char *pidfile);
 
 /* write_pid
  *
  * Writes the pid to the specified file. If that fails 0 is
  * returned, otherwise the pid.
  */
-pid_t write_pid (char *pidfile);
+extern pid_t write_pid (const char *pidfile);
 
 /* remove_pid
  *
  * Remove the the specified file. The result from unlink(2)
  * is returned
  */
-int remove_pid (char *pidfile);
+extern int remove_pid (const char *pidfile);
 #endif
diff --git a/lib/utils.c b/lib/utils.c
index dd7e4de..6ea904a 100644
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -23,9 +23,9 @@
 #include "../src/logger.h"
 #include "utils.h"
 
-const char hexadecimals[] = "0123456789ABCDEF";
+static const char hexadecimals[] = "0123456789ABCDEF";
 
-int charhex2bin(char c) {
+static int charhex2bin(char c) {
 	if(isdigit(c))
 		return c - '0';
 	else
@@ -67,7 +67,7 @@ const char *winerror(int err) {
 }
 #endif
 
-unsigned int bitfield_to_int(void *bitfield, size_t size) {
+unsigned int bitfield_to_int(const void *bitfield, size_t size) {
 	unsigned int value = 0;
 	if(size > sizeof value)
 		size = sizeof value;
diff --git a/lib/utils.h b/lib/utils.h
index 4456616..f6ff705 100644
--- a/lib/utils.h
+++ b/lib/utils.h
@@ -40,6 +40,6 @@ extern const char *winerror(int);
 #define sockinprogress(x) ((x) == EINPROGRESS)
 #endif
 
-extern unsigned int bitfield_to_int(void *bitfield, size_t size);
+extern unsigned int bitfield_to_int(const void *bitfield, size_t size);
 
 #endif							/* __TINC_UTILS_H__ */
diff --git a/lib/xalloc.h b/lib/xalloc.h
index 51f99bd..952f921 100644
--- a/lib/xalloc.h
+++ b/lib/xalloc.h
@@ -16,7 +16,7 @@ extern int xalloc_exit_failure;
 extern char *const xalloc_msg_memory_exhausted;
 
 /* FIXME: describe */
-extern void (*xalloc_fail_func) ();
+extern void (*xalloc_fail_func) (int);
 
 void *xmalloc PARAMS ((size_t n)) __attribute__ ((__malloc__));
 void *xmalloc_and_zero PARAMS ((size_t n)) __attribute__ ((__malloc__));
diff --git a/lib/xmalloc.c b/lib/xmalloc.c
index 4e79aff..e4079ce 100644
--- a/lib/xmalloc.c
+++ b/lib/xmalloc.c
@@ -56,7 +56,7 @@ int xalloc_exit_failure = EXIT_FAILURE;
 char *const xalloc_msg_memory_exhausted = "Memory exhausted";
 
 /* FIXME: describe */
-void (*xalloc_fail_func) (int) = 0;
+void (*xalloc_fail_func) (int) = NULL;
 
 static void
 xalloc_fail (int size)
@@ -70,13 +70,12 @@ xalloc_fail (int size)
 /* Allocate N bytes of memory dynamically, with error checking.  */
 
 void *
-xmalloc (n)
-     size_t n;
+xmalloc (size_t n)
 {
   void *p;
 
   p = malloc (n);
-  if (p == 0)
+  if (p == NULL)
     xalloc_fail ((int)n);
   return p;
 }
@@ -84,13 +83,12 @@ xmalloc (n)
 /* Allocate N bytes of memory dynamically, and set it all to zero. */
 
 void *
-xmalloc_and_zero (n)
-     size_t n;
+xmalloc_and_zero (size_t n)
 {
   void *p;
 
   p = malloc (n);
-  if (p == 0)
+  if (p == NULL)
     xalloc_fail ((int)n);
   memset (p, '\0', n);
   return p;
@@ -101,12 +99,10 @@ xmalloc_and_zero (n)
    If P is NULL, run xmalloc.  */
 
 void *
-xrealloc (p, n)
-     void *p;
-     size_t n;
+xrealloc (void *p, size_t n)
 {
   p = realloc (p, n);
-  if (p == 0)
+  if (p == NULL)
     xalloc_fail (n);
   return p;
 }
@@ -134,7 +130,7 @@ xcalloc (n, s)
   void *p;
 
   p = calloc (n, s);
-  if (p == 0)
+  if (p == NULL)
     xalloc_fail ();
   return p;
 }
diff --git a/m4/ev.m4 b/m4/ev.m4
new file mode 100644
index 0000000..59d767b
--- /dev/null
+++ b/m4/ev.m4
@@ -0,0 +1,33 @@
+dnl Check to find the libev headers/libraries
+
+AC_DEFUN([tinc_LIBEV],
+[
+    AC_ARG_WITH(libev,
+      AS_HELP_STRING([--with-libev=DIR], [libev base directory, or:]),
+      [libev="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval/include"
+       LDFLAGS="$LDFLAGS -L$withval/lib"]
+    )
+
+    AC_ARG_WITH(libev-include,
+      AS_HELP_STRING([--with-libev-include=DIR], [libev headers directory]),
+      [libev_include="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval"]
+    )
+
+    AC_ARG_WITH(libev-lib,
+      AS_HELP_STRING([--with-libev-lib=DIR], [libev library directory]),
+      [libev_lib="$withval"
+       LDFLAGS="$LDFLAGS -L$withval"]
+    )
+
+    AC_CHECK_HEADERS(ev.h,
+      [],
+      [AC_MSG_ERROR("ev header files not found."); break]
+    )
+
+    AC_CHECK_LIB(ev, ev_loop,
+      [LIBS="$LIBS -lev"],
+      [AC_MSG_ERROR("libev libraries not found.")]
+    )
+])
diff --git a/m4/openssl.m4 b/m4/openssl.m4
index 59f0d45..254ea4f 100644
--- a/m4/openssl.m4
+++ b/m4/openssl.m4
@@ -2,6 +2,20 @@ dnl Check to find the OpenSSL headers/libraries
 
 AC_DEFUN([tinc_OPENSSL],
 [
+  case $host_os in
+    *mingw*)
+    ;;
+    *)
+      AC_CHECK_FUNC(dlopen,
+        [],
+        [AC_CHECK_LIB(dl, dlopen,
+          [LIBS="$LIBS -ldl"],
+          [AC_MSG_ERROR([OpenSSL depends on libdl.]); break]
+        )]
+      )
+    ;;
+  esac
+
   AC_ARG_WITH(openssl,
     AS_HELP_STRING([--with-openssl=DIR], [OpenSSL base directory, or:]),
     [openssl="$withval"
@@ -31,20 +45,6 @@ AC_DEFUN([tinc_OPENSSL],
     [AC_MSG_ERROR([OpenSSL libraries not found.])]
   )
 
-case $host_os in
-  *mingw*)
-  ;;
-  *)
-    AC_CHECK_FUNC(dlopen,
-      [],
-      [AC_CHECK_LIB(dl, dlopen,
-        [LIBS="$LIBS -ldl"],
-        [AC_MSG_ERROR([OpenSSL depends on libdl.]); break]
-      )]
-    )
-  ;;
-esac
-
   AC_CHECK_FUNCS([RAND_pseudo_bytes EVP_EncryptInit_ex], ,
     [AC_MSG_ERROR([Missing OpenSSL functionality, make sure you have installed the latest version.]); break],
   )
diff --git a/src/Makefile.am b/src/Makefile.am
index 491f011..ff011f8 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -30,7 +30,7 @@ endif
 tincd_LDADD = \
 	$(top_builddir)/lib/libvpn.a
 
-AM_CFLAGS = @CFLAGS@ -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\"
+AM_CFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\"
 
 dist-hook:
 	rm -f `find . -type l`
diff --git a/src/Makefile.in b/src/Makefile.in
index 98de5f4..cbb8594 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -197,7 +197,7 @@ noinst_HEADERS = conf.h connection.h device.h edge.h event.h graph.h logger.h me
 tincd_LDADD = \
 	$(top_builddir)/lib/libvpn.a
 
-AM_CFLAGS = @CFLAGS@ -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\"
+AM_CFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\"
 all: all-am
 
 .SUFFIXES:
diff --git a/src/bsd/device.c b/src/bsd/device.c
index d6ef0e8..a41827f 100644
--- a/src/bsd/device.c
+++ b/src/bsd/device.c
@@ -22,6 +22,7 @@
 #include "system.h"
 
 #include "conf.h"
+#include "device.h"
 #include "logger.h"
 #include "net.h"
 #include "route.h"
diff --git a/src/conf.c b/src/conf.c
index 5f8fdb1..1560541 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -26,6 +26,7 @@
 #include "avl_tree.h"
 #include "connection.h"
 #include "conf.h"
+#include "list.h"
 #include "logger.h"
 #include "netutl.h"				/* for str2address */
 #include "protocol.h"
@@ -92,7 +93,7 @@ void config_add(avl_tree_t *config_tree, config_t *cfg) {
 	avl_insert(config_tree, cfg);
 }
 
-config_t *lookup_config(avl_tree_t *config_tree, char *variable) {
+config_t *lookup_config(const avl_tree_t *config_tree, char *variable) {
 	config_t cfg, *found;
 
 	cfg.variable = variable;
@@ -110,7 +111,7 @@ config_t *lookup_config(avl_tree_t *config_tree, char *variable) {
 	return found;
 }
 
-config_t *lookup_config_next(avl_tree_t *config_tree, const config_t *cfg) {
+config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg) {
 	avl_node_t *node;
 	config_t *found;
 
@@ -188,7 +189,7 @@ bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 }
 
 bool get_config_subnet(const config_t *cfg, subnet_t ** result) {
-	subnet_t subnet = {0};
+	subnet_t subnet = {NULL};
 
 	if(!cfg)
 		return false;
@@ -368,7 +369,7 @@ void read_config_options(avl_tree_t *config_tree, const char *prefix) {
 	}
 }
 
-bool read_server_config() {
+bool read_server_config(void) {
 	char *fname;
 	bool x;
 
diff --git a/src/conf.h b/src/conf.h
index 3eae4ad..5b0796e 100644
--- a/src/conf.h
+++ b/src/conf.h
@@ -48,8 +48,8 @@ extern void exit_configuration(avl_tree_t **);
 extern config_t *new_config(void) __attribute__ ((__malloc__));
 extern void free_config(config_t *);
 extern void config_add(avl_tree_t *, config_t *);
-extern config_t *lookup_config(avl_tree_t *, char *);
-extern config_t *lookup_config_next(avl_tree_t *, const config_t *);
+extern config_t *lookup_config(const avl_tree_t *, char *);
+extern config_t *lookup_config_next(const avl_tree_t *, const config_t *);
 extern bool get_config_bool(const config_t *, bool *);
 extern bool get_config_int(const config_t *, int *);
 extern bool get_config_string(const config_t *, char **);
diff --git a/src/connection.c b/src/connection.c
index ac946ab..e7ea9b2 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -23,10 +23,7 @@
 
 #include "avl_tree.h"
 #include "conf.h"
-#include "list.h"
 #include "logger.h"
-#include "net.h"				/* Don't ask. */
-#include "netutl.h"
 #include "subnet.h"
 #include "utils.h"
 #include "xalloc.h"
diff --git a/src/connection.h b/src/connection.h
index 05e8b4b..7916a71 100644
--- a/src/connection.h
+++ b/src/connection.h
@@ -32,20 +32,19 @@
 #define OPTION_CLAMP_MSS	0x0008
 
 typedef struct connection_status_t {
-	int pinged:1;				/* sent ping */
-	int active:1;				/* 1 if active.. */
-	int connecting:1;			/* 1 if we are waiting for a non-blocking connect() to finish */
-	int termreq:1;				/* the termination of this connection was requested */
-	int remove:1;				/* Set to 1 if you want this connection removed */
-	int timeout:1;				/* 1 if gotten timeout */
-	int encryptout:1;			/* 1 if we can encrypt outgoing traffic */
-	int decryptin:1;			/* 1 if we have to decrypt incoming traffic */
-	int mst:1;				/* 1 if this connection is part of a minimum spanning tree */
-	int unused:23;
+	unsigned int pinged:1;				/* sent ping */
+	unsigned int active:1;				/* 1 if active.. */
+	unsigned int connecting:1;			/* 1 if we are waiting for a non-blocking connect() to finish */
+	unsigned int termreq:1;				/* the termination of this connection was requested */
+	unsigned int remove:1;				/* Set to 1 if you want this connection removed */
+	unsigned int timeout:1;				/* 1 if gotten timeout */
+	unsigned int encryptout:1;			/* 1 if we can encrypt outgoing traffic */
+	unsigned int decryptin:1;			/* 1 if we have to decrypt incoming traffic */
+	unsigned int mst:1;				/* 1 if this connection is part of a minimum spanning tree */
+	unsigned int unused:23;
 } connection_status_t;
 
 #include "edge.h"
-#include "list.h"
 #include "net.h"
 #include "node.h"
 
diff --git a/src/cygwin/device.c b/src/cygwin/device.c
index 90966cd..42016cb 100644
--- a/src/cygwin/device.c
+++ b/src/cygwin/device.c
@@ -24,6 +24,7 @@
 #include <w32api/winioctl.h>
 
 #include "conf.h"
+#include "device.h"
 #include "logger.h"
 #include "net.h"
 #include "route.h"
diff --git a/src/event.c b/src/event.c
index 99e6a23..89ee022 100644
--- a/src/event.c
+++ b/src/event.c
@@ -28,7 +28,7 @@
 avl_tree_t *event_tree;
 extern time_t now;
 
-int id;
+static int id;
 
 static int event_compare(const event_t *a, const event_t *b) {
 	if(a->time > b->time)
@@ -62,10 +62,10 @@ void expire_events(void) {
 		return;
 
 	event = event_tree->tail->data;
-	if(event->time < now)
+	if(event->time <= now)
 		return;
 
-	diff = 1 + event->time - now;
+	diff = event->time - now;
 	
 	for(node = event_tree->head; node; node = node->next) {
 		event = node->data;
@@ -96,7 +96,7 @@ event_t *get_expired_event(void) {
 	if(event_tree->head) {
 		event = event_tree->head->data;
 
-		if(event->time < now) {
+		if(event->time <= now) {
 			avl_node_t *node = event_tree->head;
 			avl_unlink_node(event_tree, node);
 			free(node);
@@ -106,3 +106,9 @@ event_t *get_expired_event(void) {
 
 	return NULL;
 }
+
+event_t *peek_next_event(void) {
+	if (event_tree->head)
+		return event_tree->head->data;
+	return NULL;
+}
diff --git a/src/event.h b/src/event.h
index da2e741..38a4eb4 100644
--- a/src/event.h
+++ b/src/event.h
@@ -42,5 +42,6 @@ extern void free_event(event_t *);
 extern void event_add(event_t *);
 extern void event_del(event_t *);
 extern event_t *get_expired_event(void);
+extern event_t *peek_next_event(void);
 
 #endif							/* __TINC_EVENT_H__ */
diff --git a/src/graph.c b/src/graph.c
index 3495f23..9aadcd8 100644
--- a/src/graph.c
+++ b/src/graph.c
@@ -49,6 +49,7 @@
 #include "connection.h"
 #include "device.h"
 #include "edge.h"
+#include "graph.h"
 #include "logger.h"
 #include "netutl.h"
 #include "node.h"
@@ -65,7 +66,7 @@ static bool graph_changed = true;
    Please note that sorting on weight is already done by add_edge().
 */
 
-void mst_kruskal(void) {
+static void mst_kruskal(void) {
 	avl_node_t *node, *next;
 	edge_t *e;
 	node_t *n;
@@ -146,7 +147,7 @@ void mst_kruskal(void) {
    Running time: O(E)
 */
 
-void sssp_bfs(void) {
+static void sssp_bfs(void) {
 	avl_node_t *node, *next, *to;
 	edge_t *e;
 	node_t *n;
diff --git a/src/graph.h b/src/graph.h
index 2600601..fb41096 100644
--- a/src/graph.h
+++ b/src/graph.h
@@ -22,8 +22,6 @@
 #define __TINC_GRAPH_H__
 
 extern void graph(void);
-extern void mst_kruskal(void);
-extern void sssp_bfs(void);
 extern void dump_graph(void);
 
 #endif /* __TINC_GRAPH_H__ */
diff --git a/src/linux/device.c b/src/linux/device.c
index 0632d51..c7c1b65 100644
--- a/src/linux/device.c
+++ b/src/linux/device.c
@@ -28,6 +28,7 @@
 #endif
 
 #include "conf.h"
+#include "device.h"
 #include "logger.h"
 #include "net.h"
 #include "route.h"
diff --git a/src/logger.c b/src/logger.c
index bc20438..f886ba4 100644
--- a/src/logger.c
+++ b/src/logger.c
@@ -44,14 +44,18 @@ void openlogger(const char *ident, logmode_t mode) {
 		case LOGMODE_FILE:
 			logpid = getpid();
 			logfile = fopen(logfilename, "a");
-			if(!logfile)
+			if(!logfile) {
+				fprintf(stderr, "Could not open log file %s: %s\n", logfilename, strerror(errno));
 				logmode = LOGMODE_NULL;
+			}
 			break;
 		case LOGMODE_SYSLOG:
 #ifdef HAVE_MINGW
 			loghandle = RegisterEventSource(NULL, logident);
-			if(!loghandle)
+			if(!loghandle) {
+				fprintf(stderr, "Could not open log handle!");
 				logmode = LOGMODE_NULL;
+			}
 			break;
 #else
 #ifdef HAVE_SYSLOG_H
@@ -64,8 +68,24 @@ void openlogger(const char *ident, logmode_t mode) {
 	}
 }
 
+void reopenlogger() {
+	if(logmode != LOGMODE_FILE)
+		return;
+
+	fflush(logfile);
+	FILE *newfile = fopen(logfilename, "a");
+	if(!newfile) {
+		logger(LOG_ERR, "Unable to reopen log file %s: %s\n", logfilename, strerror(errno));
+		return;
+	}
+	fclose(logfile);
+	logfile = newfile;
+}
+
 void logger(int priority, const char *format, ...) {
 	va_list ap;
+	char timestr[32] = "";
+	time_t now;
 
 	va_start(ap, format);
 
@@ -76,7 +96,9 @@ void logger(int priority, const char *format, ...) {
 			fflush(stderr);
 			break;
 		case LOGMODE_FILE:
-			fprintf(logfile, "%ld %s[%ld]: ", time(NULL), logident, (long)logpid);
+			now = time(NULL);
+			strftime(timestr, sizeof timestr, "%Y-%m-%d %H:%M:%S", localtime(&now));
+			fprintf(logfile, "%s %s[%ld]: ", timestr, logident, (long)logpid);
 			vfprintf(logfile, format, ap);
 			fprintf(logfile, "\n");
 			fflush(logfile);
diff --git a/src/logger.h b/src/logger.h
index 9c20ead..ff2cb34 100644
--- a/src/logger.h
+++ b/src/logger.h
@@ -47,6 +47,7 @@ enum {
 
 extern debug_t debug_level;
 extern void openlogger(const char *, logmode_t);
+extern void reopenlogger(void);
 extern void logger(int, const char *, ...) __attribute__ ((__format__(printf, 2, 3)));
 extern void closelogger(void);
 
diff --git a/src/mingw/device.c b/src/mingw/device.c
index fec53cf..1dac3bf 100644
--- a/src/mingw/device.c
+++ b/src/mingw/device.c
@@ -24,6 +24,7 @@
 #include <winioctl.h>
 
 #include "conf.h"
+#include "device.h"
 #include "logger.h"
 #include "net.h"
 #include "route.h"
diff --git a/src/net.c b/src/net.c
index e6a1166..c5193c5 100644
--- a/src/net.c
+++ b/src/net.c
@@ -3,6 +3,7 @@
     Copyright (C) 1998-2005 Ivo Timmermans,
                   2000-2011 Guus Sliepen <guus@tinc-vpn.org>
                   2006      Scott Lamb <slamb@slamb.org>
+		  2011      Loïc Grenié <loic.grenie@gmail.com>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -42,6 +43,9 @@
 
 bool do_purge = false;
 volatile bool running = false;
+#ifdef HAVE_PSELECT
+bool graph_dump = false;
+#endif
 
 time_t now = 0;
 int contradicting_add_edge = 0;
@@ -229,14 +233,14 @@ static void check_dead_connections(void) {
 		next = node->next;
 		c = node->data;
 
-		if(c->last_ping_time + pingtimeout < now) {
+		if(c->last_ping_time + pingtimeout <= now) {
 			if(c->status.active) {
 				if(c->status.pinged) {
 					ifdebug(CONNECTIONS) logger(LOG_INFO, "%s (%s) didn't respond to PING in %ld seconds",
 							   c->name, c->hostname, now - c->last_ping_time);
 					c->status.timeout = true;
 					terminate_connection(c, true);
-				} else if(c->last_ping_time + pinginterval < now) {
+				} else if(c->last_ping_time + pinginterval <= now) {
 					send_ping(c);
 				}
 			} else {
@@ -258,7 +262,7 @@ static void check_dead_connections(void) {
 			}
 		}
 
-		if(c->outbuflen > 0 && c->last_flushed_time + pingtimeout < now) {
+		if(c->outbuflen > 0 && c->last_flushed_time + pingtimeout <= now) {
 			if(c->status.active) {
 				ifdebug(CONNECTIONS) logger(LOG_INFO,
 						"%s (%s) could not flush for %ld seconds (%d bytes remaining)",
@@ -350,7 +354,13 @@ static void check_network_activity(fd_set * readset, fd_set * writeset) {
 */
 int main_loop(void) {
 	fd_set readset, writeset;
+#ifdef HAVE_PSELECT
+	struct timespec tv;
+	sigset_t omask, block_mask;
+	time_t next_event;
+#else
 	struct timeval tv;
+#endif
 	int r, maxfd;
 	time_t last_ping_check, last_config_check, last_graph_dump;
 	event_t *event;
@@ -361,21 +371,48 @@ int main_loop(void) {
 	
 	srand(now);
 
+#ifdef HAVE_PSELECT
+	if(lookup_config(config_tree, "GraphDumpFile"))
+		graph_dump = true;
+	/* Block SIGHUP & SIGALRM */
+	sigemptyset(&block_mask);
+	sigaddset(&block_mask, SIGHUP);
+	sigaddset(&block_mask, SIGALRM);
+	sigprocmask(SIG_BLOCK, &block_mask, &omask);
+#endif
+
 	running = true;
 
 	while(running) {
-		now = time(NULL);
+#ifdef HAVE_PSELECT
+		next_event = last_ping_check + pingtimeout;
+		if(graph_dump && next_event > last_graph_dump + 60)
+			next_event = last_graph_dump + 60;
 
-	//	tv.tv_sec = 1 + (rand() & 7);	/* Approx. 5 seconds, randomized to prevent global synchronisation effects */
+		if((event = peek_next_event()) && next_event > event->time)
+			next_event = event->time;
+
+		if(next_event <= now)
+			tv.tv_sec = 0;
+		else
+			tv.tv_sec = next_event - now;
+		tv.tv_nsec = 0;
+#else
 		tv.tv_sec = 1;
 		tv.tv_usec = 0;
+#endif
 
 		maxfd = build_fdset(&readset, &writeset);
 
 #ifdef HAVE_MINGW
 		LeaveCriticalSection(&mutex);
 #endif
+#ifdef HAVE_PSELECT
+		r = pselect(maxfd + 1, &readset, &writeset, NULL, &tv, &omask);
+#else
 		r = select(maxfd + 1, &readset, &writeset, NULL, &tv);
+#endif
+		now = time(NULL);
 #ifdef HAVE_MINGW
 		EnterCriticalSection(&mutex);
 #endif
@@ -398,7 +435,7 @@ int main_loop(void) {
 
 		/* Let's check if everybody is still alive */
 
-		if(last_ping_check + pingtimeout < now) {
+		if(last_ping_check + pingtimeout <= now) {
 			check_dead_connections();
 			last_ping_check = now;
 
@@ -409,7 +446,7 @@ int main_loop(void) {
 
 			/* Should we regenerate our key? */
 
-			if(keyexpires < now) {
+			if(keyexpires <= now) {
 				avl_node_t *node;
 				node_t *n;
 
@@ -423,7 +460,7 @@ int main_loop(void) {
 					}
 				}
 
-				send_key_changed(broadcast, myself);
+				send_key_changed();
 				keyexpires = now + keylifetime;
 			}
 
@@ -464,6 +501,8 @@ int main_loop(void) {
 			struct stat s;
 			
 			sighup = false;
+
+			reopenlogger();
 			
 			/* Reread our own configuration file */
 
@@ -550,11 +589,16 @@ int main_loop(void) {
 		
 		/* Dump graph if wanted every 60 seconds*/
 
-		if(last_graph_dump + 60 < now) {
+		if(last_graph_dump + 60 <= now) {
 			dump_graph();
 			last_graph_dump = now;
 		}
 	}
 
+#ifdef HAVE_PSELECT
+	/* Restore SIGHUP & SIGALARM mask */
+	sigprocmask(SIG_SETMASK, &omask, NULL);
+#endif
+
 	return 0;
 }
diff --git a/src/net.h b/src/net.h
index 55856e2..b831cdd 100644
--- a/src/net.h
+++ b/src/net.h
@@ -121,6 +121,8 @@ extern time_t now;
 extern int contradicting_add_edge;
 extern int contradicting_del_edge;
 
+extern volatile bool running;
+
 /* Yes, very strange placement indeed, but otherwise the typedefs get all tangled up */
 #include "connection.h"
 #include "node.h"
@@ -133,7 +135,7 @@ extern bool handle_new_meta_connection(int);
 extern int setup_listen_socket(const sockaddr_t *);
 extern int setup_vpn_in_socket(const sockaddr_t *);
 extern void send_packet(const struct node_t *, vpn_packet_t *);
-extern void receive_tcppacket(struct connection_t *, char *, int);
+extern void receive_tcppacket(struct connection_t *, const char *, int);
 extern void broadcast_packet(const struct node_t *, vpn_packet_t *);
 extern bool setup_network(void);
 extern void setup_outgoing_connection(struct outgoing_t *);
@@ -144,7 +146,7 @@ extern void terminate_connection(struct connection_t *, bool);
 extern void flush_queue(struct node_t *);
 extern bool read_rsa_public_key(struct connection_t *);
 extern void send_mtu_probe(struct node_t *);
-extern void load_all_subnets();
+extern void load_all_subnets(void);
 
 #ifndef HAVE_MINGW
 #define closesocket(s) close(s)
diff --git a/src/net_packet.c b/src/net_packet.c
index c7efa88..fe20a25 100644
--- a/src/net_packet.c
+++ b/src/net_packet.c
@@ -43,7 +43,6 @@
 #include "ethernet.h"
 #include "event.h"
 #include "graph.h"
-#include "list.h"
 #include "logger.h"
 #include "net.h"
 #include "netutl.h"
@@ -365,7 +364,7 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 		receive_packet(n, inpkt);
 }
 
-void receive_tcppacket(connection_t *c, char *buffer, int len) {
+void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 	vpn_packet_t outpkt;
 
 	outpkt.len = len;
@@ -404,7 +403,7 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 				   "No valid key known yet for %s (%s), forwarding via TCP",
 				   n->name, n->hostname);
 
-		if(n->last_req_key + 10 < now) {
+		if(n->last_req_key + 10 <= now) {
 			send_req_key(n);
 			n->last_req_key = now;
 		}
diff --git a/src/net_setup.c b/src/net_setup.c
index cc6ef68..f18e3bf 100644
--- a/src/net_setup.c
+++ b/src/net_setup.c
@@ -144,7 +144,7 @@ bool read_rsa_public_key(connection_t *c) {
 	return false;
 }
 
-bool read_rsa_private_key(void) {
+static bool read_rsa_private_key(void) {
 	FILE *fp;
 	char *fname, *key, *pubkey;
 	struct stat s;
@@ -267,7 +267,7 @@ void load_all_subnets(void) {
 /*
   Configure node_t myself and set up the local sockets (listen only)
 */
-bool setup_myself(void) {
+static bool setup_myself(void) {
 	config_t *cfg;
 	subnet_t *subnet;
 	char *name, *hostname, *mode, *afname, *cipher, *digest;
diff --git a/src/net_socket.c b/src/net_socket.c
index 2e6b068..a45bc20 100644
--- a/src/net_socket.c
+++ b/src/net_socket.c
@@ -535,7 +535,7 @@ bool handle_new_meta_connection(int sock) {
 	return true;
 }
 
-void free_outgoing(outgoing_t *outgoing) {
+static void free_outgoing(outgoing_t *outgoing) {
 	if(outgoing->ai)
 		freeaddrinfo(outgoing->ai);
 
diff --git a/src/node.c b/src/node.c
index 36979ef..cf70f83 100644
--- a/src/node.c
+++ b/src/node.c
@@ -124,7 +124,7 @@ void node_del(node_t *n) {
 }
 
 node_t *lookup_node(char *name) {
-	node_t n = {0};
+	node_t n = {NULL};
 
 	n.name = name;
 
@@ -132,7 +132,7 @@ node_t *lookup_node(char *name) {
 }
 
 node_t *lookup_node_udp(const sockaddr_t *sa) {
-	node_t n = {0};
+	node_t n = {NULL};
 
 	n.address = *sa;
 	n.name = NULL;
@@ -142,7 +142,7 @@ node_t *lookup_node_udp(const sockaddr_t *sa) {
 
 void update_node_udp(node_t *n, const sockaddr_t *sa) {
 	if(n == myself) {
-		logger(LOG_WARNING, "Trying to update UDP address of myself!\n");
+		logger(LOG_WARNING, "Trying to update UDP address of myself!");
 		return;
 	}
 
@@ -158,7 +158,7 @@ void update_node_udp(node_t *n, const sockaddr_t *sa) {
 		ifdebug(PROTOCOL) logger(LOG_DEBUG, "UDP address of %s set to %s", n->name, n->hostname);
 	} else {
 		memset(&n->address, 0, sizeof n->address);
-		n->hostname = 0;
+		n->hostname = NULL;
 		ifdebug(PROTOCOL) logger(LOG_DEBUG, "UDP address of %s cleared", n->name);
 	}
 }
diff --git a/src/node.h b/src/node.h
index 7bac28e..07c7c49 100644
--- a/src/node.h
+++ b/src/node.h
@@ -24,17 +24,16 @@
 #include "avl_tree.h"
 #include "connection.h"
 #include "event.h"
-#include "list.h"
 #include "subnet.h"
 
 typedef struct node_status_t {
-	int unused_active:1;			/* 1 if active (not used for nodes) */
-	int validkey:1;				/* 1 if we currently have a valid key for him */
-	int unused_waitingforkey:1;		/* 1 if we already sent out a request */
-	int visited:1;				/* 1 if this node has been visited by one of the graph algorithms */
-	int reachable:1;			/* 1 if this node is reachable in the graph */
-	int indirect:1;				/* 1 if this node is not directly reachable by us */
-	int unused:26;
+	unsigned int unused_active:1;			/* 1 if active (not used for nodes) */
+	unsigned int validkey:1;				/* 1 if we currently have a valid key for him */
+	unsigned int unused_waitingforkey:1;		/* 1 if we already sent out a request */
+	unsigned int visited:1;				/* 1 if this node has been visited by one of the graph algorithms */
+	unsigned int reachable:1;			/* 1 if this node is reachable in the graph */
+	unsigned int indirect:1;				/* 1 if this node is not directly reachable by us */
+	unsigned int unused:26;
 } node_status_t;
 
 typedef struct node_t {
diff --git a/src/process.c b/src/process.c
index e74c1d9..c659237 100644
--- a/src/process.c
+++ b/src/process.c
@@ -25,6 +25,7 @@
 #include "device.h"
 #include "edge.h"
 #include "logger.h"
+#include "net.h"
 #include "node.h"
 #include "pidfile.h"
 #include "process.h"
@@ -41,10 +42,9 @@ extern char *identname;
 extern char *pidfilename;
 extern char **g_argv;
 extern bool use_logfile;
-extern volatile bool running;
 
 #ifndef HAVE_MINGW
-sigset_t emptysigset;
+static sigset_t emptysigset;
 #endif
 
 static int saved_debug_level = -1;
diff --git a/src/protocol.c b/src/protocol.c
index 9d7c349..aec00ee 100644
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -189,7 +189,7 @@ void exit_requests(void) {
 }
 
 bool seen_request(char *request) {
-	past_request_t *new, p = {0};
+	past_request_t *new, p = {NULL};
 
 	p.request = request;
 
@@ -214,7 +214,7 @@ void age_past_requests(void) {
 		next = node->next;
 		p = node->data;
 
-		if(p->firstseen + pinginterval < now)
+		if(p->firstseen + pinginterval <= now)
 			avl_delete_node(past_request_tree, node), deleted++;
 		else
 			left++;
diff --git a/src/protocol.h b/src/protocol.h
index 2aed26d..6c46c72 100644
--- a/src/protocol.h
+++ b/src/protocol.h
@@ -96,10 +96,10 @@ extern bool send_add_subnet(struct connection_t *, const struct subnet_t *);
 extern bool send_del_subnet(struct connection_t *, const struct subnet_t *);
 extern bool send_add_edge(struct connection_t *, const struct edge_t *);
 extern bool send_del_edge(struct connection_t *, const struct edge_t *);
-extern void send_key_changed();
+extern void send_key_changed(void);
 extern bool send_req_key(struct node_t *);
 extern bool send_ans_key(struct node_t *);
-extern bool send_tcppacket(struct connection_t *, struct vpn_packet_t *);
+extern bool send_tcppacket(struct connection_t *, const struct vpn_packet_t *);
 
 /* Request handlers  */
 
diff --git a/src/protocol_key.c b/src/protocol_key.c
index 6ff68d2..f34ebaa 100644
--- a/src/protocol_key.c
+++ b/src/protocol_key.c
@@ -34,9 +34,9 @@
 #include "utils.h"
 #include "xalloc.h"
 
-bool mykeyused = false;
+static bool mykeyused = false;
 
-void send_key_changed() {
+void send_key_changed(void) {
 	avl_node_t *node;
 	connection_t *c;
 
diff --git a/src/protocol_misc.c b/src/protocol_misc.c
index 28571ef..6f7ab03 100644
--- a/src/protocol_misc.c
+++ b/src/protocol_misc.c
@@ -119,7 +119,7 @@ bool pong_h(connection_t *c) {
 
 /* Sending and receiving packets via TCP */
 
-bool send_tcppacket(connection_t *c, vpn_packet_t *packet) {
+bool send_tcppacket(connection_t *c, const vpn_packet_t *packet) {
 	/* If there already is a lot of data in the outbuf buffer, discard this packet.
            We use a very simple Random Early Drop algorithm. */
 
diff --git a/src/protocol_subnet.c b/src/protocol_subnet.c
index 9ae491d..62656c3 100644
--- a/src/protocol_subnet.c
+++ b/src/protocol_subnet.c
@@ -45,7 +45,7 @@ bool add_subnet_h(connection_t *c) {
 	char subnetstr[MAX_STRING_SIZE];
 	char name[MAX_STRING_SIZE];
 	node_t *owner;
-	subnet_t s = {0}, *new, *old;
+	subnet_t s = {NULL}, *new, *old;
 
 	if(sscanf(c->buffer, "%*d %*x " MAX_STRING " " MAX_STRING, name, subnetstr) != 2) {
 		logger(LOG_ERR, "Got bad %s from %s (%s)", "ADD_SUBNET", c->name,
@@ -154,7 +154,7 @@ bool del_subnet_h(connection_t *c) {
 	char subnetstr[MAX_STRING_SIZE];
 	char name[MAX_STRING_SIZE];
 	node_t *owner;
-	subnet_t s = {0}, *find;
+	subnet_t s = {NULL}, *find;
 
 	if(sscanf(c->buffer, "%*d %*x " MAX_STRING " " MAX_STRING, name, subnetstr) != 2) {
 		logger(LOG_ERR, "Got bad %s from %s (%s)", "DEL_SUBNET", c->name,
diff --git a/src/raw_socket/device.c b/src/raw_socket/device.c
index f68e461..abe368a 100644
--- a/src/raw_socket/device.c
+++ b/src/raw_socket/device.c
@@ -23,6 +23,7 @@
 #include <netpacket/packet.h>
 
 #include "conf.h"
+#include "device.h"
 #include "net.h"
 #include "logger.h"
 #include "utils.h"
diff --git a/src/route.c b/src/route.c
index 1caf738..e3bcf3b 100644
--- a/src/route.c
+++ b/src/route.c
@@ -220,7 +220,7 @@ void age_subnets(void) {
 	for(node = myself->subnet_tree->head; node; node = next) {
 		next = node->next;
 		s = node->data;
-		if(s->expires && s->expires < now) {
+		if(s->expires && s->expires <= now) {
 			ifdebug(TRAFFIC) {
 				char netstr[MAXNETSTR];
 				if(net2str(netstr, sizeof netstr, s))
diff --git a/src/solaris/device.c b/src/solaris/device.c
index 3a50b16..0dfffb1 100644
--- a/src/solaris/device.c
+++ b/src/solaris/device.c
@@ -26,6 +26,7 @@
 #include <net/if_tun.h>
 
 #include "conf.h"
+#include "device.h"
 #include "logger.h"
 #include "net.h"
 #include "utils.h"
diff --git a/src/subnet.c b/src/subnet.c
index 67be001..47f1436 100644
--- a/src/subnet.c
+++ b/src/subnet.c
@@ -52,7 +52,7 @@ static subnet_t *cache_mac_subnet[2];
 static bool cache_mac_valid[2];
 static int cache_mac_slot;
 
-void subnet_cache_flush() {
+void subnet_cache_flush(void) {
 	cache_ipv4_valid[0] = cache_ipv4_valid[1] = false;
 	cache_ipv6_valid[0] = cache_ipv6_valid[1] = false;
 	cache_mac_valid[0] = cache_mac_valid[1] = false;
@@ -273,7 +273,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 
 bool net2str(char *netstr, int len, const subnet_t *subnet) {
 	if(!netstr || !subnet) {
-		logger(LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!\n", netstr, subnet);
+		logger(LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", netstr, subnet);
 		return false;
 	}
 
@@ -451,7 +451,7 @@ subnet_t *lookup_subnet_ipv6(const ipv6_t *address) {
 void subnet_update(node_t *owner, subnet_t *subnet, bool up) {
 	avl_node_t *node;
 	int i;
-	char *envp[9] = {0};
+	char *envp[9] = {NULL};
 	char netstr[MAXNETSTR];
 	char *name, *address, *port;
 	char empty[] = "";
diff --git a/src/tincd.c b/src/tincd.c
index 40ac038..b3d911b 100644
--- a/src/tincd.c
+++ b/src/tincd.c
@@ -504,7 +504,7 @@ static bool drop_privs() {
 }
 
 #ifdef HAVE_MINGW
-# define setpriority(level) SetPriorityClass(GetCurrentProcess(), (level))
+# define setpriority(level) !SetPriorityClass(GetCurrentProcess(), (level))
 #else
 # define NORMAL_PRIORITY_CLASS 0
 # define BELOW_NORMAL_PRIORITY_CLASS 10
diff --git a/src/uml_socket/device.c b/src/uml_socket/device.c
index 59551b4..a2da757 100644
--- a/src/uml_socket/device.c
+++ b/src/uml_socket/device.c
@@ -23,6 +23,7 @@
 #include <sys/un.h>
 
 #include "conf.h"
+#include "device.h"
 #include "net.h"
 #include "logger.h"
 #include "utils.h"