255 changed files with 40589 additions and 20767 deletions
--- a/22
+++ b/22
@ -1,20 +1,25 @@
 Main tinc authors:
 - Guus Sliepen <guus@tinc-vpn.org>
 - Ivo Timmermans (inactive)
-Significant contributions from:
+Significant code contributions from:
- Michael Tokarev <mjt@tls.msk.ru>
+
 - Brandon Black <blblack@gmail.com>
 - Etienne Dechamps <etienne@edechamps.fr>
 - Florian Forster <octo@verplant.org>
 - Grzegorz Dymarek <gregd72002@googlemail.com>
 - Max Rijevski <maksuf@gmail.com>
 - Scott Lamb <slamb@slamb.org>
 - Julien Muchembled <jm@jmuchemb.eu>
 - Timothy Redaelli <timothy@redaelli.eu>
 - Brandon Black <blblack@gmail.com>
 - Loïc Grenié <loic.grenie@gmail.com>
 - Max Rijevski <maksuf@gmail.com>
 - Michael Tokarev <mjt@tls.msk.ru>
 - Scott Lamb <slamb@slamb.org>
 - Sven-Haegar Koch <haegar@sdinet.de>
 - Timothy Redaelli <timothy@redaelli.eu>
 These files are from other sources:
- * lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
+
 * lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
 the syslog 1.3 sources.
 * src/bsd/tunemu.c and tunemu.h are by Friedrich Schöller
@ -23,5 +28,4 @@ These files are from other sources:
 Also some of the macro files in the directory m4, and their
 accompanying files in lib, were taken from GNU fileutils.
-Please see the file THANKS for more information on contributions from
+Please see the file THANKS for a list of all contributors to tinc.
 users.
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen and others.
+Copyright (C) 1998-2016 Ivo Timmermans, Guus Sliepen and others.
 See the AUTHORS file for a complete list.
 This program is free software; you can redistribute it and/or modify it under
--- a/COPYING.README
+++ b/COPYING.README
@ -1,19 +1,17 @@
 The following applies to tinc:
-This program is released under the GPL with the additional exemption that
+> This program is released under the GPL with the additional exemption that
-compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
+> compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
-packages linked to the OpenSSL libraries, provided that all other requirements
+> packages linked to the OpenSSL libraries, provided that all other requirements
-of the GPL are met.
+> of the GPL are met.
 The following applies to the LZO library:
-  Hereby I grant a special exception to the tinc VPN project
+> Hereby I grant a special exception to the tinc VPN project
-  (http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
+> (https://www.tinc-vpn.org/) to link the LZO library with the OpenSSL library
-  (http://www.openssl.org).
+> (https://openssl.org).
-
+>
-  Markus F.X.J. Oberhumer
+> Markus F.X.J. Oberhumer
 When tinc is compiled with the --enable-tunemu option, the resulting binary
 falls under the GPL version 3 or later.
--- a/1754
+++ b/1754
--- a/316
+++ b/316
@ -1,8 +1,8 @@
 Installation Instructions
 *************************
-   Copyright (C) 1994-1996, 1999-2002, 2004-2016 Free Software
+Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation,
-Foundation, Inc.
+Inc.
   Copying and distribution of this file, with or without modification,
 are permitted in any medium without royalty provided the copyright
@ -12,96 +12,97 @@ without warranty of any kind.
 Basic Installation
 ==================
-   Briefly, the shell command './configure && make && make install'
+   Briefly, the shell command `./configure && make && make install'
 should configure, build, and install this package.  The following
-more-detailed instructions are generic; see the 'README' file for
+more-detailed instructions are generic; see the `README' file for
 instructions specific to this package.  Some packages provide this
-'INSTALL' file but do not implement all of the features documented
+`INSTALL' file but do not implement all of the features documented
 below.  The lack of an optional feature in a given package is not
 necessarily a bug.  More recommendations for GNU packages can be found
 in *note Makefile Conventions: (standards)Makefile Conventions.
-   The 'configure' shell script attempts to guess correct values for
+   The `configure' shell script attempts to guess correct values for
 various system-dependent variables used during compilation.  It uses
-those values to create a 'Makefile' in each directory of the package.
+those values to create a `Makefile' in each directory of the package.
-It may also create one or more '.h' files containing system-dependent
+It may also create one or more `.h' files containing system-dependent
-definitions.  Finally, it creates a shell script 'config.status' that
+definitions.  Finally, it creates a shell script `config.status' that
 you can run in the future to recreate the current configuration, and a
-file 'config.log' containing compiler output (useful mainly for
+file `config.log' containing compiler output (useful mainly for
-debugging 'configure').
+debugging `configure').
-   It can also use an optional file (typically called 'config.cache' and
+   It can also use an optional file (typically called `config.cache'
-enabled with '--cache-file=config.cache' or simply '-C') that saves the
+and enabled with `--cache-file=config.cache' or simply `-C') that saves
-results of its tests to speed up reconfiguring.  Caching is disabled by
+the results of its tests to speed up reconfiguring.  Caching is
-default to prevent problems with accidental use of stale cache files.
+disabled by default to prevent problems with accidental use of stale
 cache files.
   If you need to do unusual things to compile the package, please try
-to figure out how 'configure' could check whether to do them, and mail
+to figure out how `configure' could check whether to do them, and mail
-diffs or instructions to the address given in the 'README' so they can
+diffs or instructions to the address given in the `README' so they can
 be considered for the next release.  If you are using the cache, and at
-some point 'config.cache' contains results you don't want to keep, you
+some point `config.cache' contains results you don't want to keep, you
 may remove or edit it.
-   The file 'configure.ac' (or 'configure.in') is used to create
+   The file `configure.ac' (or `configure.in') is used to create
-'configure' by a program called 'autoconf'.  You need 'configure.ac' if
+`configure' by a program called `autoconf'.  You need `configure.ac' if
-you want to change it or regenerate 'configure' using a newer version of
+you want to change it or regenerate `configure' using a newer version
-'autoconf'.
+of `autoconf'.
   The simplest way to compile this package is:
-  1. 'cd' to the directory containing the package's source code and type
+  1. `cd' to the directory containing the package's source code and type
-     './configure' to configure the package for your system.
+     `./configure' to configure the package for your system.
-     Running 'configure' might take a while.  While running, it prints
+     Running `configure' might take a while.  While running, it prints
     some messages telling which features it is checking for.
-  2. Type 'make' to compile the package.
+  2. Type `make' to compile the package.
-  3. Optionally, type 'make check' to run any self-tests that come with
+  3. Optionally, type `make check' to run any self-tests that come with
     the package, generally using the just-built uninstalled binaries.
-  4. Type 'make install' to install the programs and any data files and
+  4. Type `make install' to install the programs and any data files and
     documentation.  When installing into a prefix owned by root, it is
     recommended that the package be configured and built as a regular
-     user, and only the 'make install' phase executed with root
+     user, and only the `make install' phase executed with root
     privileges.
-  5. Optionally, type 'make installcheck' to repeat any self-tests, but
+  5. Optionally, type `make installcheck' to repeat any self-tests, but
     this time using the binaries in their final installed location.
     This target does not install anything.  Running this target as a
-     regular user, particularly if the prior 'make install' required
+     regular user, particularly if the prior `make install' required
     root privileges, verifies that the installation completed
     correctly.
  6. You can remove the program binaries and object files from the
-     source code directory by typing 'make clean'.  To also remove the
+     source code directory by typing `make clean'.  To also remove the
-     files that 'configure' created (so you can compile the package for
+     files that `configure' created (so you can compile the package for
-     a different kind of computer), type 'make distclean'.  There is
+     a different kind of computer), type `make distclean'.  There is
-     also a 'make maintainer-clean' target, but that is intended mainly
+     also a `make maintainer-clean' target, but that is intended mainly
     for the package's developers.  If you use it, you may have to get
     all sorts of other programs in order to regenerate files that came
     with the distribution.
-  7. Often, you can also type 'make uninstall' to remove the installed
+  7. Often, you can also type `make uninstall' to remove the installed
     files again.  In practice, not all packages have tested that
     uninstallation works correctly, even though it is required by the
     GNU Coding Standards.
-  8. Some packages, particularly those that use Automake, provide 'make
+  8. Some packages, particularly those that use Automake, provide `make
     distcheck', which can by used by developers to test that all other
-     targets like 'make install' and 'make uninstall' work correctly.
+     targets like `make install' and `make uninstall' work correctly.
     This target is generally not run by end users.
 Compilers and Options
 =====================
   Some systems require unusual options for compilation or linking that
-the 'configure' script does not know about.  Run './configure --help'
+the `configure' script does not know about.  Run `./configure --help'
 for details on some of the pertinent environment variables.
-   You can give 'configure' initial values for configuration parameters
+   You can give `configure' initial values for configuration parameters
-by setting variables in the command line or in the environment.  Here is
+by setting variables in the command line or in the environment.  Here
-an example:
+is an example:
     ./configure CC=c99 CFLAGS=-g LIBS=-lposix
@ -112,21 +113,21 @@ Compiling For Multiple Architectures
   You can compile the package for more than one kind of computer at the
 same time, by placing the object files for each architecture in their
-own directory.  To do this, you can use GNU 'make'.  'cd' to the
+own directory.  To do this, you can use GNU `make'.  `cd' to the
 directory where you want the object files and executables to go and run
-the 'configure' script.  'configure' automatically checks for the source
+the `configure' script.  `configure' automatically checks for the
-code in the directory that 'configure' is in and in '..'.  This is known
+source code in the directory that `configure' is in and in `..'.  This
-as a "VPATH" build.
+is known as a "VPATH" build.
-   With a non-GNU 'make', it is safer to compile the package for one
+   With a non-GNU `make', it is safer to compile the package for one
 architecture at a time in the source code directory.  After you have
-installed the package for one architecture, use 'make distclean' before
+installed the package for one architecture, use `make distclean' before
 reconfiguring for another architecture.
   On MacOS X 10.5 and later systems, you can create libraries and
 executables that work on multiple system types--known as "fat" or
-"universal" binaries--by specifying multiple '-arch' options to the
+"universal" binaries--by specifying multiple `-arch' options to the
-compiler but only a single '-arch' option to the preprocessor.  Like
+compiler but only a single `-arch' option to the preprocessor.  Like
 this:
     ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
@ -135,104 +136,105 @@ this:
   This is not guaranteed to produce working output in all cases, you
 may have to build one architecture at a time and combine the results
-using the 'lipo' tool if you have problems.
+using the `lipo' tool if you have problems.
 Installation Names
 ==================
-   By default, 'make install' installs the package's commands under
+   By default, `make install' installs the package's commands under
-'/usr/local/bin', include files under '/usr/local/include', etc.  You
+`/usr/local/bin', include files under `/usr/local/include', etc.  You
-can specify an installation prefix other than '/usr/local' by giving
+can specify an installation prefix other than `/usr/local' by giving
-'configure' the option '--prefix=PREFIX', where PREFIX must be an
+`configure' the option `--prefix=PREFIX', where PREFIX must be an
 absolute file name.
   You can specify separate installation prefixes for
 architecture-specific files and architecture-independent files.  If you
-pass the option '--exec-prefix=PREFIX' to 'configure', the package uses
+pass the option `--exec-prefix=PREFIX' to `configure', the package uses
 PREFIX as the prefix for installing programs and libraries.
 Documentation and other data files still use the regular prefix.
   In addition, if you use an unusual directory layout you can give
-options like '--bindir=DIR' to specify different values for particular
+options like `--bindir=DIR' to specify different values for particular
-kinds of files.  Run 'configure --help' for a list of the directories
+kinds of files.  Run `configure --help' for a list of the directories
-you can set and what kinds of files go in them.  In general, the default
+you can set and what kinds of files go in them.  In general, the
-for these options is expressed in terms of '${prefix}', so that
+default for these options is expressed in terms of `${prefix}', so that
-specifying just '--prefix' will affect all of the other directory
+specifying just `--prefix' will affect all of the other directory
 specifications that were not explicitly provided.
   The most portable way to affect installation locations is to pass the
-correct locations to 'configure'; however, many packages provide one or
+correct locations to `configure'; however, many packages provide one or
 both of the following shortcuts of passing variable assignments to the
-'make install' command line to change installation locations without
+`make install' command line to change installation locations without
 having to reconfigure or recompile.
   The first method involves providing an override variable for each
-affected directory.  For example, 'make install
+affected directory.  For example, `make install
 prefix=/alternate/directory' will choose an alternate location for all
 directory configuration variables that were expressed in terms of
-'${prefix}'.  Any directories that were specified during 'configure',
+`${prefix}'.  Any directories that were specified during `configure',
-but not in terms of '${prefix}', must each be overridden at install time
+but not in terms of `${prefix}', must each be overridden at install
-for the entire installation to be relocated.  The approach of makefile
+time for the entire installation to be relocated.  The approach of
-variable overrides for each directory variable is required by the GNU
+makefile variable overrides for each directory variable is required by
-Coding Standards, and ideally causes no recompilation.  However, some
+the GNU Coding Standards, and ideally causes no recompilation.
-platforms have known limitations with the semantics of shared libraries
+However, some platforms have known limitations with the semantics of
-that end up requiring recompilation when using this method, particularly
+shared libraries that end up requiring recompilation when using this
-noticeable in packages that use GNU Libtool.
+method, particularly noticeable in packages that use GNU Libtool.
-   The second method involves providing the 'DESTDIR' variable.  For
+   The second method involves providing the `DESTDIR' variable.  For
-example, 'make install DESTDIR=/alternate/directory' will prepend
+example, `make install DESTDIR=/alternate/directory' will prepend
-'/alternate/directory' before all installation names.  The approach of
+`/alternate/directory' before all installation names.  The approach of
-'DESTDIR' overrides is not required by the GNU Coding Standards, and
+`DESTDIR' overrides is not required by the GNU Coding Standards, and
 does not work on platforms that have drive letters.  On the other hand,
 it does better at avoiding recompilation issues, and works well even
-when some directory options were not specified in terms of '${prefix}'
+when some directory options were not specified in terms of `${prefix}'
-at 'configure' time.
+at `configure' time.
 Optional Features
 =================
   If the package supports it, you can cause programs to be installed
-with an extra prefix or suffix on their names by giving 'configure' the
+with an extra prefix or suffix on their names by giving `configure' the
-option '--program-prefix=PREFIX' or '--program-suffix=SUFFIX'.
+option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
-   Some packages pay attention to '--enable-FEATURE' options to
+   Some packages pay attention to `--enable-FEATURE' options to
-'configure', where FEATURE indicates an optional part of the package.
+`configure', where FEATURE indicates an optional part of the package.
-They may also pay attention to '--with-PACKAGE' options, where PACKAGE
+They may also pay attention to `--with-PACKAGE' options, where PACKAGE
-is something like 'gnu-as' or 'x' (for the X Window System).  The
+is something like `gnu-as' or `x' (for the X Window System).  The
-'README' should mention any '--enable-' and '--with-' options that the
+`README' should mention any `--enable-' and `--with-' options that the
 package recognizes.
-   For packages that use the X Window System, 'configure' can usually
+   For packages that use the X Window System, `configure' can usually
 find the X include and library files automatically, but if it doesn't,
-you can use the 'configure' options '--x-includes=DIR' and
+you can use the `configure' options `--x-includes=DIR' and
-'--x-libraries=DIR' to specify their locations.
+`--x-libraries=DIR' to specify their locations.
   Some packages offer the ability to configure how verbose the
-execution of 'make' will be.  For these packages, running './configure
+execution of `make' will be.  For these packages, running `./configure
 --enable-silent-rules' sets the default to minimal output, which can be
-overridden with 'make V=1'; while running './configure
+overridden with `make V=1'; while running `./configure
 --disable-silent-rules' sets the default to verbose, which can be
-overridden with 'make V=0'.
+overridden with `make V=0'.
 Particular systems
 ==================
-   On HP-UX, the default C compiler is not ANSI C compatible.  If GNU CC
+   On HP-UX, the default C compiler is not ANSI C compatible.  If GNU
-is not installed, it is recommended to use the following options in
+CC is not installed, it is recommended to use the following options in
 order to use an ANSI C compiler:
     ./configure CC="cc -Ae -D_XOPEN_SOURCE=500"
 and if that doesn't work, install pre-built binaries of GCC for HP-UX.
-   HP-UX 'make' updates targets which have the same time stamps as their
+   HP-UX `make' updates targets which have the same time stamps as
-prerequisites, which makes it generally unusable when shipped generated
+their prerequisites, which makes it generally unusable when shipped
-files such as 'configure' are involved.  Use GNU 'make' instead.
+generated files such as `configure' are involved.  Use GNU `make'
 instead.
   On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
-parse its '<wchar.h>' header file.  The option '-nodtk' can be used as a
+parse its `<wchar.h>' header file.  The option `-nodtk' can be used as
-workaround.  If GNU CC is not installed, it is therefore recommended to
+a workaround.  If GNU CC is not installed, it is therefore recommended
-try
+to try
     ./configure CC="cc"
@ -240,26 +242,26 @@ and if that doesn't work, try
     ./configure CC="cc -nodtk"
-   On Solaris, don't put '/usr/ucb' early in your 'PATH'.  This
+   On Solaris, don't put `/usr/ucb' early in your `PATH'.  This
 directory contains several dysfunctional programs; working variants of
-these programs are available in '/usr/bin'.  So, if you need '/usr/ucb'
+these programs are available in `/usr/bin'.  So, if you need `/usr/ucb'
-in your 'PATH', put it _after_ '/usr/bin'.
+in your `PATH', put it _after_ `/usr/bin'.
-   On Haiku, software installed for all users goes in '/boot/common',
+   On Haiku, software installed for all users goes in `/boot/common',
-not '/usr/local'.  It is recommended to use the following options:
+not `/usr/local'.  It is recommended to use the following options:
     ./configure --prefix=/boot/common
 Specifying the System Type
 ==========================
-   There may be some features 'configure' cannot figure out
+   There may be some features `configure' cannot figure out
 automatically, but needs to determine by the type of machine the package
 will run on.  Usually, assuming the package is built to be run on the
-_same_ architectures, 'configure' can figure that out, but if it prints
+_same_ architectures, `configure' can figure that out, but if it prints
 a message saying it cannot guess the machine type, give it the
-'--build=TYPE' option.  TYPE can either be a short name for the system
+`--build=TYPE' option.  TYPE can either be a short name for the system
-type, such as 'sun4', or a canonical name which has the form:
+type, such as `sun4', or a canonical name which has the form:
     CPU-COMPANY-SYSTEM
@ -268,101 +270,101 @@ where SYSTEM can have one of these forms:
     OS
     KERNEL-OS
-   See the file 'config.sub' for the possible values of each field.  If
+   See the file `config.sub' for the possible values of each field.  If
-'config.sub' isn't included in this package, then this package doesn't
+`config.sub' isn't included in this package, then this package doesn't
 need to know the machine type.
   If you are _building_ compiler tools for cross-compiling, you should
-use the option '--target=TYPE' to select the type of system they will
+use the option `--target=TYPE' to select the type of system they will
 produce code for.
   If you want to _use_ a cross compiler, that generates code for a
 platform different from the build platform, you should specify the
 "host" platform (i.e., that on which the generated programs will
-eventually be run) with '--host=TYPE'.
+eventually be run) with `--host=TYPE'.
 Sharing Defaults
 ================
-   If you want to set default values for 'configure' scripts to share,
+   If you want to set default values for `configure' scripts to share,
-you can create a site shell script called 'config.site' that gives
+you can create a site shell script called `config.site' that gives
-default values for variables like 'CC', 'cache_file', and 'prefix'.
+default values for variables like `CC', `cache_file', and `prefix'.
-'configure' looks for 'PREFIX/share/config.site' if it exists, then
+`configure' looks for `PREFIX/share/config.site' if it exists, then
-'PREFIX/etc/config.site' if it exists.  Or, you can set the
+`PREFIX/etc/config.site' if it exists.  Or, you can set the
-'CONFIG_SITE' environment variable to the location of the site script.
+`CONFIG_SITE' environment variable to the location of the site script.
-A warning: not all 'configure' scripts look for a site script.
+A warning: not all `configure' scripts look for a site script.
 Defining Variables
 ==================
   Variables not defined in a site shell script can be set in the
-environment passed to 'configure'.  However, some packages may run
+environment passed to `configure'.  However, some packages may run
 configure again during the build, and the customized values of these
 variables may be lost.  In order to avoid this problem, you should set
-them in the 'configure' command line, using 'VAR=value'.  For example:
+them in the `configure' command line, using `VAR=value'.  For example:
     ./configure CC=/usr/local2/bin/gcc
-causes the specified 'gcc' to be used as the C compiler (unless it is
+causes the specified `gcc' to be used as the C compiler (unless it is
 overridden in the site shell script).
-Unfortunately, this technique does not work for 'CONFIG_SHELL' due to an
+Unfortunately, this technique does not work for `CONFIG_SHELL' due to
-Autoconf limitation.  Until the limitation is lifted, you can use this
+an Autoconf limitation.  Until the limitation is lifted, you can use
-workaround:
+this workaround:
     CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash
-'configure' Invocation
+`configure' Invocation
 ======================
-   'configure' recognizes the following options to control how it
+   `configure' recognizes the following options to control how it
 operates.
-'--help'
+`--help'
-'-h'
+`-h'
-     Print a summary of all of the options to 'configure', and exit.
+     Print a summary of all of the options to `configure', and exit.
-'--help=short'
+`--help=short'
-'--help=recursive'
+`--help=recursive'
     Print a summary of the options unique to this package's
-     'configure', and exit.  The 'short' variant lists options used only
+     `configure', and exit.  The `short' variant lists options used
-     in the top level, while the 'recursive' variant lists options also
+     only in the top level, while the `recursive' variant lists options
-     present in any nested packages.
+     also present in any nested packages.
-'--version'
+`--version'
-'-V'
+`-V'
-     Print the version of Autoconf used to generate the 'configure'
+     Print the version of Autoconf used to generate the `configure'
     script, and exit.
-'--cache-file=FILE'
+`--cache-file=FILE'
     Enable the cache: use and save the results of the tests in FILE,
-     traditionally 'config.cache'.  FILE defaults to '/dev/null' to
+     traditionally `config.cache'.  FILE defaults to `/dev/null' to
     disable caching.
-'--config-cache'
+`--config-cache'
-'-C'
+`-C'
-     Alias for '--cache-file=config.cache'.
+     Alias for `--cache-file=config.cache'.
-'--quiet'
+`--quiet'
-'--silent'
+`--silent'
-'-q'
+`-q'
     Do not print messages saying which checks are being made.  To
-     suppress all normal output, redirect it to '/dev/null' (any error
+     suppress all normal output, redirect it to `/dev/null' (any error
     messages will still be shown).
-'--srcdir=DIR'
+`--srcdir=DIR'
     Look for the package's source code in directory DIR.  Usually
-     'configure' can determine that directory automatically.
+     `configure' can determine that directory automatically.
-'--prefix=DIR'
+`--prefix=DIR'
-     Use DIR as the installation prefix.  *note Installation Names:: for
+     Use DIR as the installation prefix.  *note Installation Names::
-     more details, including other options available for fine-tuning the
+     for more details, including other options available for fine-tuning
-     installation locations.
+     the installation locations.
-'--no-create'
+`--no-create'
-'-n'
+`-n'
     Run the configure checks, but stop before creating any output
     files.
-'configure' also accepts some other, not widely useful, options.  Run
+`configure' also accepts some other, not widely useful, options.  Run
-'configure --help' for more details.
+`configure --help' for more details.
--- a/Makefile.am
+++ b/Makefile.am
@ -2,14 +2,34 @@
 AUTOMAKE_OPTIONS = gnu
-SUBDIRS = src doc systemd
+SUBDIRS =  src doc gui test systemd
 ACLOCAL_AMFLAGS = -I m4
 EXTRA_DIST = COPYING.README README.android
-ChangeLog:
+# If git describe works, force autoconf to run in order to make sure we have the
-	git log > ChangeLog
+# current version number from git in the resulting configure script.
 configure-version:
 	-cd $(srcdir) && git describe && autoconf --force
-astyle:
+# Triggering the README target means we are building a distribution (make dist).
-	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]
+README: configure-version
 ChangeLog:
 	(cd $(srcdir) && git log) > ChangeLog
 deb:
 	dpkg-buildpackage -rfakeroot
 rpm: dist
 	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
 	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
 	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
 release:
 	rm -f ChangeLog
 	$(MAKE) ChangeLog
 	echo "Please edit the NEWS file now..."
 	/usr/bin/editor $(srcdir)/NEWS
 	$(MAKE) dist
--- a/Makefile.in
+++ b/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.2 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
-# Copyright (C) 1994-2020 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -90,13 +90,12 @@ host_triplet = @host@
 subdir = .
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_append_flag.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
+	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
+	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
-	$(top_srcdir)/configure.ac
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
 	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \
@ -141,9 +140,9 @@ am__recursive_targets = \
  $(RECURSIVE_CLEAN_TARGETS) \
  $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	cscope distdir distdir-am dist dist-all distcheck
+	cscope distdir dist dist-all distcheck
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
-	config.h.in
+	$(LISP)config.h.in
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
 # *not* preserved.
@ -221,6 +220,7 @@ CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@ -238,8 +238,10 @@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@ -250,6 +252,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 READLINE_LIBS = @READLINE_LIBS@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@ -307,7 +310,7 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AUTOMAKE_OPTIONS = gnu
-SUBDIRS = src doc systemd
+SUBDIRS = src doc gui test systemd
 ACLOCAL_AMFLAGS = -I m4
 EXTRA_DIST = COPYING.README README.android
 all: config.h
@ -335,8 +338,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' $(SHELL) ./config.status'; \
 	    $(SHELL) ./config.status;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
 	esac;
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -469,16 +472,7 @@ distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
-distdir: $(BUILT_SOURCES)
+distdir: $(DISTFILES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 distdir-am: $(DISTFILES)
 	@case `sed 15q $(srcdir)/NEWS` in \
 	*"$(VERSION)"*) : ;; \
 	*) \
 	  echo "NEWS not updated; not releasing" 1>&2; \
 	  exit 1;; \
 	esac
 	$(am__remove_distdir)
 	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
@ -543,7 +537,7 @@ distdir-am: $(DISTFILES)
 	  ! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \
 	|| chmod -R a+r "$(distdir)"
 dist-gzip: distdir
-	tardir=$(distdir) && $(am__tar) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).tar.gz
+	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
 	$(am__post_remove_distdir)
 dist-bzip2: distdir
@ -558,10 +552,6 @@ dist-xz: distdir
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__post_remove_distdir)
 dist-zstd: distdir
 	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
 	$(am__post_remove_distdir)
 dist-tarZ: distdir
 	@echo WARNING: "Support for distribution archives compressed with" \
 		       "legacy program 'compress' is deprecated." >&2
@ -573,7 +563,7 @@ dist-shar: distdir
 	@echo WARNING: "Support for shar distribution archives is" \
 	               "deprecated." >&2
 	@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
-	shar $(distdir) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).shar.gz
+	shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz
 	$(am__post_remove_distdir)
 dist-zip: distdir
@ -591,7 +581,7 @@ dist dist-all:
 distcheck: dist
 	case '$(DIST_ARCHIVES)' in \
 	*.tar.gz*) \
-	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).tar.gz | $(am__untar) ;;\
+	  GZIP=$(GZIP_ENV) gzip -dc $(distdir).tar.gz | $(am__untar) ;;\
 	*.tar.bz2*) \
 	  bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\
 	*.tar.lz*) \
@ -601,11 +591,9 @@ distcheck: dist
 	*.tar.Z*) \
 	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
 	*.shar.gz*) \
-	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
+	  GZIP=$(GZIP_ENV) gzip -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
 	*.tar.zst*) \
 	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
@ -782,7 +770,7 @@ uninstall-am:
 	am--refresh check check-am clean clean-cscope clean-generic \
 	cscope cscopelist-am ctags ctags-am dist dist-all dist-bzip2 \
 	dist-gzip dist-lzip dist-shar dist-tarZ dist-xz dist-zip \
-	dist-zstd distcheck distclean distclean-generic distclean-hdr \
+	distcheck distclean distclean-generic distclean-hdr \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
@ -797,11 +785,31 @@ uninstall-am:
 .PRECIOUS: Makefile
-ChangeLog:
+# If git describe works, force autoconf to run in order to make sure we have the
-	git log > ChangeLog
+# current version number from git in the resulting configure script.
 configure-version:
 	-cd $(srcdir) && git describe && autoconf --force
-astyle:
+# Triggering the README target means we are building a distribution (make dist).
-	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]
+README: configure-version
 ChangeLog:
 	(cd $(srcdir) && git log) > ChangeLog
 deb:
 	dpkg-buildpackage -rfakeroot
 rpm: dist
 	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
 	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
 	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
 release:
 	rm -f ChangeLog
 	$(MAKE) ChangeLog
 	echo "Please edit the NEWS file now..."
 	/usr/bin/editor $(srcdir)/NEWS
 	$(MAKE) dist
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
--- a/1079
+++ b/1079
--- a/141
+++ b/141
@ -1,11 +1,7 @@
-This is the README file for tinc version 1.0.36. Installation
+This is the README file for tinc version 1.1pre12. Installation
 instructions may be found in the INSTALL file.
-tinc is Copyright (C) 1998-2019 by:
+tinc is Copyright © 1998-2016 Ivo Timmermans, Guus Sliepen <guus@tinc-vpn.org>, and others.
 Ivo Timmermans,
 Guus Sliepen <guus@tinc-vpn.org>,
 and others.
 For a complete list of authors see the AUTHORS file.
@ -15,119 +11,80 @@ the Free Software Foundation; either version 2 of the License, or (at
 your option) any later version. See the file COPYING for more details.
 This is a pre-release
 ---------------------
 Please note that this is NOT a stable release. Until version 1.1.0 is released,
 please use one of the 1.0.x versions if you need a stable version of tinc.
 Although tinc 1.1 will be protocol compatible with tinc 1.0.x, the
 functionality of the tinc program may still change, and the control socket
 protocol is not fixed yet.
 Security statement
 ------------------
-In August 2000, we discovered the existence of a security hole in all versions
+This version uses an experimental and unfinished cryptographic protocol. Use it
-of tinc up to and including 1.0pre2. This had to do with the way we exchanged
+at your own risk.
 keys. Since then, we have been working on a new authentication scheme to make
 tinc as secure as possible. The current version uses the OpenSSL library and
 uses strong authentication with RSA keys.
 On the 29th of December 2001, Jerome Etienne posted a security analysis of tinc
 1.0pre4. Due to a lack of sequence numbers and a message authentication code
 for each packet, an attacker could possibly disrupt certain network services or
 launch a denial of service attack by replaying intercepted packets. The current
 version adds sequence numbers and message authentication codes to prevent such
 attacks.
 On September the 15th of 2003, Peter Gutmann contacted us and showed us a
 writeup describing various security issues in several VPN daemons. He showed
 that tinc lacks perfect forward security, the connection authentication could
 be done more properly, that the sequence number we use as an IV is not the best
 practice and that the default length of the HMAC for packets is too short in
 his opinion. We do not know of a way to exploit these weaknesses, but these
 issues are being addressed in the tinc 1.1 branch.
 The Sweet32 attack affects versions of tinc prior to 1.0.30.
 On September 6th, 2018, Michael Yonly contacted us and provided
 proof-of-concept code that allowed a remote attacker to create an
 authenticated, one-way connection with a node, and also that there was a
 possibility for a man-in-the-middle to force UDP packets from a node to be sent
 in plaintext. The first issue was trivial to exploit on tinc versions prior to
 1.0.30, but the changes in 1.0.30 to mitigate the Sweet32 attack made this
 weakness much harder to exploit. These issues have been fixed in tinc 1.0.35.
 The new protocol in the tinc 1.1 branch is not susceptible to these issues.
 Cryptography is a hard thing to get right. We cannot make any
 guarantees. Time, review and feedback are the only things that can
 prove the security of any cryptographic product. If you wish to review
 tinc or give us feedback, you are strongly encouraged to do so.
 Compatibility
 -------------
-Version 1.0.35 is compatible with 1.0pre8, 1.0 and later, but not with older
+Version 1.1pre12 is compatible with 1.0pre8, 1.0 and later, but not with older
-versions of tinc. Note that since version 1.0.30, tinc requires all nodes in
+versions of tinc.
-the VPN to be compiled with a version of LibreSSL or OpenSSL that supports the
+
-AES256 and SHA256 algorithms.
+When the ExperimentalProtocol option is used, tinc is still compatible with
 1.0.X, 1.1pre11 and later, but not with any version between 1.1pre1 and
 1.1pre10.
 Requirements
 ------------
-The OpenSSL library is used for all cryptographic functions. You can find it at
+In order to compile tinc, you will need a GNU C compiler environment. Please
-https://www.openssl.org/. You will need version 1.0.1 or later with support for
+ensure you have the latest stable versions of all the required libraries:
 AES256 and SHA256 enabled. If this library is not installed on your system, the
 configure script will fail.  The manual in doc/tinc.texi contains more detailed
 information on how to install this library. Alternatively, you may also use the
 LibreSSL library.
-The zlib library is used for optional compression. You can
+- LibreSSL (http://www.libressl.org/) or OpenSSL (https://openssl.org/) version 1.0.0 or later.
 find it at https://zlib.net/. Because of a possible exploit in
 earlier versions we recommend that you download version 1.1.4 or later.
-The LZO library is also used for optional compression. You can
+The following libraries are used by default, but can be disabled if necessary:
 find it at https://www.oberhumer.com/opensource/lzo/.
-In order to compile tinc, you will need a C99 compliant compiler.
+- zlib (http://www.zlib.net/)
 - LZO (https://www.oberhumer.com/opensource/lzo/)
 - ncurses (http://invisible-island.net/ncurses/)
 - readline (https://cnswww.cns.cwru.edu/php/chet/readline/rltop.html)
 Features
 --------
-This version of tinc supports multiple virtual networks at once. To
+Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number
-use this feature, you may supply a netname via the -n or --net
+of nodes. Instead of configuring tunnels, you give tinc the location and
-options. The standard locations for the config files will then be
+public key of a few nodes in the VPN. After making the initial connections to
-/etc/tinc/<net>/.
+those nodes, tinc will learn about all other nodes on the VPN, and will make
 connections automatically. When direct connections are not possible, data will
 be forwarded by intermediate nodes.
-tincd regenerates its encryption key pairs. It does this on the first
+Tinc 1.1 support two protocols. The first is a legacy protocol that provides
-activity after the keys have expired. This period is adjustable in the
+backwards compatibility with tinc 1.0 nodes, and which by default uses 2048 bit
-configuration file, and the default time is 3600 seconds (one hour).
+RSA keys for authentication, and encrypts traffic using Blowfish in CBC mode
 and HMAC-SHA1. The second is a new protocol which uses Curve25519 keys for
 authentication, and encrypts traffic using Chacha20-Poly1305, and provides
 forward secrecy.
-This version supports multiple subnets at once. They are also sorted
+Tinc fully supports IPv6.
 on subnet mask size. This means that it is possible to have
 overlapping subnets on the VPN, as long as their subnet mask sizes
 differ.
-Since pre5, tinc can operate in several routing modes. The default mode,
+Tinc can operate in several routing modes. In the default mode, "router", every
-"router", works exactly like the older version, and uses Subnet lines to
+node is associated with one or more IPv4 and/or IPv6 Subnets. The other two
-determine the destination of packets. The other two modes, "switch" and "hub",
+modes, "switch" and "hub", let the tinc daemons work together to form a virtual
-allow the tinc daemons to work together like a single network switch or hub.
+Ethernet network switch or hub.
 This is useful for bridging networks. The latter modes only work properly on
 Linux, FreeBSD and Windows.
 The algorithms used for encryption and generating message authentication codes
 can now be changed in the configuration files. All cipher and digest algorithms
 supported by OpenSSL can be used. Useful ciphers are "blowfish" (default),
 "bf-ofb", "des", "des3", et cetera. Useful digests are "sha1" (default), "md5",
 et cetera.
 Support for routing IPv6 packets has been added. Just add Subnet lines with
 IPv6 addresses (without using :: abbreviations) and use ifconfig or ip (from
 the iproute package) to give the virtual network interface corresponding IPv6
 addresses. tinc does not provide autoconfiguration for IPv6 hosts. Consider
 using radvd or zebra if you need it.
 It is also possible to make tunnels to other tinc daemons over IPv6 networks,
 if the operating system supports IPv6.  tinc will automatically use both IPv6
 and IPv4 when available, but this can be changed by adding the option
 "AddressFamily = ipv4" or "AddressFamily = ipv6" to the tinc.conf file.
 Normally, when started tinc will detach and run in the background. In a native
 Windows environment this means tinc will install itself as a service, which will
 restart after reboots.  To prevent tinc from detaching or running as a service,
 use the -D option.
 The status of the VPN can be queried using the "tinc" command, which connects
 to a running tinc daemon via a control connection. The same tool also makes it
 easy to start and stop tinc, and to change its configuration.
--- a/README.android
+++ b/README.android
@ -1,25 +1,23 @@
-Quick how-to cross compile tinc for android (done from $HOME/android/):
+Quick how-to cross compile tinc for Android (done from $HOME/android/):
- Download android NDK and setup local ARM toolchain:
+- Download Android NDK and setup local ARM toolchain:
 wget http://dl.google.com/android/ndk/android-ndk-r9d-linux-x86.tar.bz2
 tar xfj android-ndk-r9d-linux-x86.tar.bz2
 ./android-ndk-r9d/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
- Download and cross-compile openSSL for ARM:
+        wget http://dl.google.com/android/ndk/android-ndk-r8b-linux-x86.tar.bz2
-wget http://www.openssl.org/source/openssl-1.0.1h.tar.gz
+        tar xfj android-ndk-r8b-linux-x86.tar.bz2
-tar xfz openssl-1.0.1h.tar.gz
+        ./android-ndk-r8b/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
-cd openssl-1.0.1h
+
-./Configure dist
+- Download and cross-compile OpenSSL for ARM:
-make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
+
-cd -
+        wget http://www.openssl.org/source/openssl-1.0.1c.tar.gz
        tar xfz openssl-1.0.1c.tar.gz
        cd openssl-1.0.1c
        ./Configure dist
        make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
 - Clone and cross-compile tinc:
 git clone git://tinc-vpn.org/tinc
 cd tinc
 autoreconf -fsi
 CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1g --with-openssl-include=$HOME/android/openssl-1.0.1g/include/ --disable-hardening
 make -j5
 - Strip tincd binary to make it smaller
 /tmp/my-android-toolchain/bin/arm-linux-androideabi-strip src/tincd
        git clone git://tinc-vpn.org/tinc
        cd tinc
        autoreconf -fsi
        CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1c --with-openssl-include=$HOME/android/openssl-1.0.1c/include/
        make -j5
--- a/21
+++ b/21
@ -5,12 +5,9 @@ We would like to thank the following people for their contributions to tinc:
 * Alexis Hildebrandt
 * Allesandro Gatti
 * Andreas van Cranenburgh
 * Andrew Hahn
 * Anthony G. Basile
 * Armijn Hemel
 * Armin Fisslthaler
 * Aron Cowan
 * Ashish Bajaj
 * Baptiste Jonglez
 * Borg
 * Brandon Black
@ -22,31 +19,24 @@ We would like to thank the following people for their contributions to tinc:
 * Delf Eldkraft
 * Dennis Joachimsthaler
 * dnk
 * Егор Палкин
 * Élie Bouttier
 * Enrique Zanardi
 * Erik Tews
 * Etienne Dechamps
 * Florent Clairambault
 * Florian Forster
 * Florian Klink
 * Florian Weik
 * Flynn Marquardt
 * Franz Pletz
 * Gary Kessler and Claudia Gonzalez
 * Grzegorz Dymarek
 * Gusariev Oleksandr
 * Hans Bayle
 * Harvest
 * Ivo van Dong
 * Ivo Smits
 * James Cook
 * James MacLean
 * Jamie Briggs
 * Jan Štembera
 * Jason Harper
 * Jason Livesay
 * Jasper Krijgsman
 * Jelle de Jong
 * Jeroen Domburg
 * Jeroen Ubbink
@ -58,7 +48,6 @@ We would like to thank the following people for their contributions to tinc:
 * Loïc Dachary
 * Loïc Grenié
 * Lubomír Bulej
 * luckyhacky
 * LunarShaddow
 * Mads Kiilerich
 * Marc A. Lehmann
@ -73,9 +62,7 @@ We would like to thank the following people for their contributions to tinc:
 * Max Rijevski
 * Menno Smits
 * Mesar Hameed
 * Michael Taylor
 * Michael Tokarev
 * Michael Yonli
 * Miles Nordin
 * Nathan Stratton Treadway
 * Murat Donmez
@ -84,15 +71,10 @@ We would like to thank the following people for their contributions to tinc:
 * Paul Littlefield
 * Philipp Babel
 * Pierre Emeriaud
 * Pierre-Olivier Mercier
 * Rafael Wolf
 * Rafael Sadowski
 * Rafał Leśniak
 * Rhosyn Celyn
 * Robert van der Meulen
 * Robert Waniek
 * Rumko
 * Ryan Miller
 * Sam Bryan
 * Samuel Thibault
 * Saverio Proto
@ -102,6 +84,7 @@ We would like to thank the following people for their contributions to tinc:
 * Sven-Haegar Koch
 * Teemu Kiviniemi
 * Thomas Tsiakalakis
 * thorkill
 * Timothy Redaelli
 * Tomasz Fortuna
 * Tomislav Čohar
@ -109,9 +92,7 @@ We would like to thank the following people for their contributions to tinc:
 * Tonnerre Lombard
 * Ulrich Seifert
 * Vil Brekin
 * Vincent Laurent
 * Vittorio Gambaletta
 * Wendy Willard
 * Wessel Dankers
 * William A. Kennington III
 * William McArthur
--- a/aclocal.m4
+++ b/aclocal.m4
@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
+# generated automatically by aclocal 1.15 -*- Autoconf -*-
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -20,7 +20,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])
-# Copyright (C) 2002-2020 Free Software Foundation, Inc.
+# Copyright (C) 2002-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -32,10 +32,10 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN([AM_AUTOMAKE_VERSION],
-[am__api_version='1.16'
+[am__api_version='1.15'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.16.2], [],
+m4_if([$1], [1.15], [],
      [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])
@ -51,14 +51,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.16.2])dnl
+[AM_AUTOMAKE_VERSION([1.15])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
  [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -110,7 +110,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`
 # AM_CONDITIONAL                                            -*- Autoconf -*-
-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -141,7 +141,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -332,12 +332,13 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl
 # Generate code to set up dependency tracking.              -*- Autoconf -*-
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
 # _AM_OUTPUT_DEPENDENCY_COMMANDS
 # ------------------------------
 AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
@ -345,43 +346,49 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
  # Older Autoconf quotes --file arguments for eval, but not when files
  # are listed without --file.  Let's play safe and only enable the eval
  # if we detect the quoting.
-  # TODO: see whether this extra hack can be removed once we start
+  case $CONFIG_FILES in
-  # requiring Autoconf 2.70 or later.
+  *\'*) eval set x "$CONFIG_FILES" ;;
-  AS_CASE([$CONFIG_FILES],
+  *)   set x $CONFIG_FILES ;;
-          [*\'*], [eval set x "$CONFIG_FILES"],
+  esac
          [*], [set x $CONFIG_FILES])
  shift
-  # Used to flag and report bootstrapping failures.
+  for mf
  am_rc=0
  for am_mf
  do
    # Strip MF so we end up with the name of the file.
-    am_mf=`AS_ECHO(["$am_mf"]) | sed -e 's/:.*$//'`
+    mf=`echo "$mf" | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile which includes
+    # Check whether this is an Automake generated Makefile or not.
-    # dependency-tracking related rules and includes.
+    # We used to match only the files named 'Makefile.in', but
-    # Grep'ing the whole file directly is not great: AIX grep has a line
+    # some people rename them; so instead we look at the file content.
    # Grep'ing the first line is not enough: some people post-process
    # each Makefile.in and add a new line on top of each file to say so.
    # Grep'ing the whole file is not good either: AIX grep has a line
    # limit of 2048, but all sed's we know have understand at least 4000.
-    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
-      || continue
+      dirpart=`AS_DIRNAME("$mf")`
-    am_dirpart=`AS_DIRNAME(["$am_mf"])`
+    else
-    am_filepart=`AS_BASENAME(["$am_mf"])`
+      continue
-    AM_RUN_LOG([cd "$am_dirpart" \
+    fi
-      && sed -e '/# am--include-marker/d' "$am_filepart" \
+    # Extract the definition of DEPDIR, am__include, and am__quote
-        | $MAKE -f - am--depfiles]) || am_rc=$?
+    # from the Makefile without running 'make'.
    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
    test -z "$DEPDIR" && continue
    am__include=`sed -n 's/^am__include = //p' < "$mf"`
    test -z "$am__include" && continue
    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
    # Find all dependency output files, they are included files with
    # $(DEPDIR) in their names.  We invoke sed twice because it is the
    # simplest approach to changing $(DEPDIR) to its actual value in the
    # expansion.
    for file in `sed -n "
      s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \
 	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
      # Make sure the directory exists.
      test -f "$dirpart/$file" && continue
      fdir=`AS_DIRNAME(["$file"])`
      AS_MKDIR_P([$dirpart/$fdir])
      # echo "creating $dirpart/$file"
      echo '# dummy' > "$dirpart/$file"
    done
  done
  if test $am_rc -ne 0; then
    AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
    for automatic dependency tracking.  If GNU make was not used, consider
    re-running the configure script with MAKE="gmake" (or whatever is
    necessary).  You can also try re-running configure with the
    '--disable-dependency-tracking' option to at least be able to build
    the package (albeit without support for automatic dependency tracking).])
  fi
  AS_UNSET([am_dirpart])
  AS_UNSET([am_filepart])
  AS_UNSET([am_mf])
  AS_UNSET([am_rc])
  rm -f conftest-deps.mk
 }
 ])# _AM_OUTPUT_DEPENDENCY_COMMANDS
@ -390,17 +397,18 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
 # -----------------------------
 # This macro should only be invoked once -- use via AC_REQUIRE.
 #
-# This code is only required when automatic dependency tracking is enabled.
+# This code is only required when automatic dependency tracking
-# This creates each '.Po' and '.Plo' makefile fragment that we'll need in
+# is enabled.  FIXME.  This creates each '.P' file that we will
-# order to bootstrap the dependency handling code.
+# need in order to bootstrap the dependency handling code.
 AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
 [AC_CONFIG_COMMANDS([depfiles],
     [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS],
-     [AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"])])
+     [AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"])
 ])
 # Do all the work for Automake.                             -*- Autoconf -*-
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -487,8 +495,8 @@ AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl
 AC_REQUIRE([AC_PROG_MKDIR_P])dnl
 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST([mkdir_p], ['$(MKDIR_P)'])
 # We need awk for the "check" target (and possibly the TAP driver).  The
 # system "awk" is bad on some platforms.
@ -555,7 +563,7 @@ END
 Aborting the configuration process, to ensure you take notice of the issue.
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <https://www.gnu.org/software/coreutils/>.
+that behaves properly: <http://www.gnu.org/software/coreutils/>.
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@ -597,7 +605,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -618,7 +626,7 @@ if test x"${install_sh+set}" != xset; then
 fi
 AC_SUBST([install_sh])])
-# Copyright (C) 2003-2020 Free Software Foundation, Inc.
+# Copyright (C) 2003-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -639,7 +647,7 @@ AC_SUBST([am__leading_dot])])
 # Check to see how 'make' treats includes.	            -*- Autoconf -*-
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -647,42 +655,49 @@ AC_SUBST([am__leading_dot])])
 # AM_MAKE_INCLUDE()
 # -----------------
-# Check whether make has an 'include' directive that can support all
+# Check to see how make treats includes.
 # the idioms we need for our automatic dependency tracking code.
 AC_DEFUN([AM_MAKE_INCLUDE],
-[AC_MSG_CHECKING([whether ${MAKE-make} supports the include directive])
+[am_make=${MAKE-make}
-cat > confinc.mk << 'END'
+cat > confinc << 'END'
 am__doit:
-	@echo this is the am__doit target >confinc.out
+	@echo this is the am__doit target
 .PHONY: am__doit
 END
 # If we don't find an include directive, just comment out the code.
 AC_MSG_CHECKING([for style of include used by $am_make])
 am__include="#"
 am__quote=
-# BSD make does it like this.
+_am_result=none
-echo '.include "confinc.mk" # ignored' > confmf.BSD
+# First try GNU make style include.
-# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo "include confinc" > confmf
-echo 'include confinc.mk # ignored' > confmf.GNU
+# Ignore all kinds of additional output from 'make'.
-_am_result=no
+case `$am_make -s -f confmf 2> /dev/null` in #(
-for s in GNU BSD; do
+*the\ am__doit\ target*)
-  AM_RUN_LOG([${MAKE-make} -f confmf.$s && cat confinc.out])
+  am__include=include
-  AS_CASE([$?:`cat confinc.out 2>/dev/null`],
+  am__quote=
-      ['0:this is the am__doit target'],
+  _am_result=GNU
-      [AS_CASE([$s],
+  ;;
-          [BSD], [am__include='.include' am__quote='"'],
+esac
-          [am__include='include' am__quote=''])])
+# Now try BSD make style include.
-  if test "$am__include" != "#"; then
+if test "$am__include" = "#"; then
-    _am_result="yes ($s style)"
+   echo '.include "confinc"' > confmf
-    break
+   case `$am_make -s -f confmf 2> /dev/null` in #(
-  fi
+   *the\ am__doit\ target*)
-done
+     am__include=.include
-rm -f confinc.* confmf.*
+     am__quote="\""
-AC_MSG_RESULT([${_am_result}])
+     _am_result=BSD
-AC_SUBST([am__include])])
+     ;;
-AC_SUBST([am__quote])])
+   esac
 fi
 AC_SUBST([am__include])
 AC_SUBST([am__quote])
 AC_MSG_RESULT([$_am_result])
 rm -f confinc confmf
 ])
 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-
-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -721,7 +736,7 @@ fi
 # Helper functions for option handling.                     -*- Autoconf -*-
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -750,7 +765,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -797,7 +812,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -816,7 +831,7 @@ AC_DEFUN([AM_RUN_LOG],
 # Check to make sure that the build environment is sane.    -*- Autoconf -*-
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -897,7 +912,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])
-# Copyright (C) 2009-2020 Free Software Foundation, Inc.
+# Copyright (C) 2009-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -957,7 +972,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -985,7 +1000,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])
-# Copyright (C) 2006-2020 Free Software Foundation, Inc.
+# Copyright (C) 2006-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -1004,7 +1019,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
 # Check how to create a tarball.                            -*- Autoconf -*-
-# Copyright (C) 2004-2020 Free Software Foundation, Inc.
+# Copyright (C) 2004-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -1136,11 +1151,12 @@ AC_SUBST([am__untar])
 ]) # _AM_PROG_TAR
 m4_include([m4/attribute.m4])
 m4_include([m4/ax_append_flag.m4])
 m4_include([m4/ax_cflags_warn_all.m4])
 m4_include([m4/ax_check_compile_flag.m4])
 m4_include([m4/ax_check_link_flag.m4])
-m4_include([m4/ax_require_defined.m4])
+m4_include([m4/curses.m4])
 m4_include([m4/libgcrypt.m4])
 m4_include([m4/lzo.m4])
 m4_include([m4/miniupnpc.m4])
 m4_include([m4/openssl.m4])
 m4_include([m4/readline.m4])
 m4_include([m4/zlib.m4])
--- a/17
+++ b/17
@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2012-10-14.11; # UTC
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@ -17,7 +17,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -53,7 +53,7 @@ func_file_conv ()
 	  MINGW*)
 	    file_conv=mingw
 	    ;;
-	  CYGWIN* | MSYS*)
+	  CYGWIN*)
 	    file_conv=cygwin
 	    ;;
 	  *)
@ -67,7 +67,7 @@ func_file_conv ()
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/* | msys/*)
+	cygwin/*)
 	  file=`cygpath -m "$file" || echo "$file"`
 	  ;;
 	wine/*)
@ -255,8 +255,7 @@ EOF
    echo "compile $scriptversion"
    exit $?
    ;;
-  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
+  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe )
  icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
    func_cl_wrapper "$@"      # Doesn't return...
    ;;
 esac
@ -340,9 +339,9 @@ exit $ret
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:
--- a/config.guess
+++ b/config.guess
--- a/config.h.in
+++ b/config.h.in
@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 /* Disable support for the legacy (tinc 1.0) protocol */
 #undef DISABLE_LEGACY
 /* Support for jumbograms (packets up to 9000 bytes) */
 #undef ENABLE_JUMBOGRAMS
@ -15,18 +18,18 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 /* Define to 1 if you have the <arpa/nameser.h> header file. */
 #undef HAVE_ARPA_NAMESER_H
 /* Define to 1 if you have the `asprintf' function. */
 #undef HAVE_ASPRINTF
 /* Define to 1 if you have the `BN_GENCB_new' function. */
 #undef HAVE_BN_GENCB_NEW
 /* Unknown BSD variant */
 #undef HAVE_BSD
 /* have curses support */
 #undef HAVE_CURSES
 /* Define to 1 if you have the <curses.h> header file. */
 #undef HAVE_CURSES_H
 /* Cygwin */
 #undef HAVE_CYGWIN
@ -36,26 +39,6 @@
 /* Darwin (MacOS/X) */
 #undef HAVE_DARWIN
 /* Define to 1 if you have the declaration of `EVP_aes_256_cfb', and to 0 if
   you don't. */
 #undef HAVE_DECL_EVP_AES_256_CFB
 /* Define to 1 if you have the declaration of `freeaddrinfo', and to 0 if you
   don't. */
 #undef HAVE_DECL_FREEADDRINFO
 /* Define to 1 if you have the declaration of `gai_strerror', and to 0 if you
   don't. */
 #undef HAVE_DECL_GAI_STRERROR
 /* Define to 1 if you have the declaration of `getaddrinfo', and to 0 if you
   don't. */
 #undef HAVE_DECL_GETADDRINFO
 /* Define to 1 if you have the declaration of `getnameinfo', and to 0 if you
   don't. */
 #undef HAVE_DECL_GETNAMEINFO
 /* Define to 1 if you have the declaration of `OpenSSL_add_all_algorithms',
   and to 0 if you don't. */
 #undef HAVE_DECL_OPENSSL_ADD_ALL_ALGORITHMS
@ -73,9 +56,6 @@
 /* DragonFly */
 #undef HAVE_DRAGONFLY
 /* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
 #undef HAVE_EVP_CIPHER_CTX_NEW
 /* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
 #undef HAVE_EVP_ENCRYPTINIT_EX
@ -94,6 +74,12 @@
 /* FreeBSD */
 #undef HAVE_FREEBSD
 /* Define to 1 if you have the `ftime' function. */
 #undef HAVE_FTIME
 /* Define to 1 if you have the <gcrypt.h> header file. */
 #undef HAVE_GCRYPT_H
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
@ -106,9 +92,6 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 /* Define to 1 if you have the `nsl' library (-lnsl). */
 #undef HAVE_LIBNSL
 /* Define to 1 if you have the `resolv' library (-lresolv). */
 #undef HAVE_LIBRESOLV
@ -142,9 +125,18 @@
 /* MinGW */
 #undef HAVE_MINGW
 /* have miniupnpc support */
 #undef HAVE_MINIUPNPC
 /* Define to 1 if you have the <miniupnpc/miniupnpc.h> header file. */
 #undef HAVE_MINIUPNPC_MINIUPNPC_H
 /* Define to 1 if you have the `mlockall' function. */
 #undef HAVE_MLOCKALL
 /* Define to 1 if you have the `nanosleep' function. */
 #undef HAVE_NANOSLEEP
 /* NetBSD */
 #undef HAVE_NETBSD
@ -232,24 +224,27 @@
 /* Define to 1 if you have the <openssl/sha.h> header file. */
 #undef HAVE_OPENSSL_SHA_H
 /* Define to 1 if you have the `pselect' function. */
 #undef HAVE_PSELECT
 /* Define to 1 if you have the `putenv' function. */
 #undef HAVE_PUTENV
-/* Define to 1 if you have the `RAND_bytes' function. */
+/* Define to 1 if you have the `RAND_status' function. */
-#undef HAVE_RAND_BYTES
+#undef HAVE_RAND_STATUS
 /* have readline support */
 #undef HAVE_READLINE
 /* Define to 1 if you have the <readline/history.h> header file. */
 #undef HAVE_READLINE_HISTORY_H
 /* Define to 1 if you have the <readline/readline.h> header file. */
 #undef HAVE_READLINE_READLINE_H
 /* Define to 1 if you have the `recvmmsg' function. */
 #undef HAVE_RECVMMSG
 /* Define to 1 if you have the <resolv.h> header file. */
 #undef HAVE_RESOLV_H
 /* Define to 1 if you have the `RSA_set0_key' function. */
 #undef HAVE_RSA_SET0_KEY
 /* Define to 1 if the system has the type `socklen_t'. */
 #undef HAVE_SOCKLEN_T
 /* Solaris/SunOS */
 #undef HAVE_SOLARIS
@ -268,9 +263,6 @@
 /* Define to 1 if you have the `strsignal' function. */
 #undef HAVE_STRSIGNAL
 /* Define to 1 if the system has the type `struct addrinfo'. */
 #undef HAVE_STRUCT_ADDRINFO
 /* Define to 1 if the system has the type `struct arphdr'. */
 #undef HAVE_STRUCT_ARPHDR
@ -286,12 +278,6 @@
 /* Define to 1 if the system has the type `struct icmp6_hdr'. */
 #undef HAVE_STRUCT_ICMP6_HDR
 /* Define to 1 if the system has the type `struct in6_addr'. */
 #undef HAVE_STRUCT_IN6_ADDR
 /* Define to 1 if the system has the type `struct in_addr'. */
 #undef HAVE_STRUCT_IN_ADDR
 /* Define to 1 if the system has the type `struct ip'. */
 #undef HAVE_STRUCT_IP
@ -304,15 +290,9 @@
 /* Define to 1 if the system has the type `struct nd_opt_hdr'. */
 #undef HAVE_STRUCT_ND_OPT_HDR
 /* Define to 1 if the system has the type `struct sockaddr_in6'. */
 #undef HAVE_STRUCT_SOCKADDR_IN6
 /* Define to 1 if you have the <syslog.h> header file. */
 #undef HAVE_SYSLOG_H
 /* Define to 1 if you have the `system' function. */
 #undef HAVE_SYSTEM
 /* Define to 1 if you have the <sys/file.h> header file. */
 #undef HAVE_SYS_FILE_H
@ -340,8 +320,8 @@
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H
-/* Define to 1 if you have the <sys/uio.h> header file. */
+/* Define to 1 if you have the <sys/un.h> header file. */
-#undef HAVE_SYS_UIO_H
+#undef HAVE_SYS_UN_H
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
@ -352,9 +332,6 @@
 /* Define to 1 if you have the `unsetenv' function. */
 #undef HAVE_UNSETENV
 /* Define to 1 if you have the `usleep' function. */
 #undef HAVE_USLEEP
 /* Define to 1 if you have the `vsyslog' function. */
 #undef HAVE_VSYSLOG
@ -419,9 +396,6 @@
 /* Version number of package */
 #undef VERSION
 /* Compile with support for Windows 2000 */
 #undef WITH_WINDOWS2000
 /* Define to 1 if on MINIX. */
 #undef _MINIX
@ -438,5 +412,5 @@
 /* Defined if the __malloc__ attribute is not supported. */
 #undef __malloc__
-/* Define to `int' if <sys/types.h> does not define. */
+/* Defined if the __warn_unused_result__ attribute is not supported. */
-#undef pid_t
+#undef __warn_unused_result__
--- a/config.sub
+++ b/config.sub
@ -1,8 +1,8 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2018 Free Software Foundation, Inc.
+#   Copyright 1992-2015 Free Software Foundation, Inc.
-timestamp='2018-02-22'
+timestamp='2015-08-20'
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@ -15,7 +15,7 @@ timestamp='2018-02-22'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <https://www.gnu.org/licenses/>.
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -33,7 +33,7 @@ timestamp='2018-02-22'
 # Otherwise, we print the canonical config type on stdout and succeed.
 # You can get the latest version of this script from:
-# https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@ -53,11 +53,12 @@ timestamp='2018-02-22'
 me=`echo "$0" | sed -e 's,.*/,,'`
 usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
+Usage: $0 [OPTION] CPU-MFR-OPSYS
       $0 [OPTION] ALIAS
 Canonicalize a configuration name.
-Options:
+Operation modes:
  -h, --help         print this help, then exit
  -t, --time-stamp   print date of last modification, then exit
  -v, --version      print version number, then exit
@ -67,7 +68,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
-Copyright 1992-2018 Free Software Foundation, Inc.
+Copyright 1992-2015 Free Software Foundation, Inc.
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@ -94,7 +95,7 @@ while test $# -gt 0 ; do
    *local*)
       # First pass through any local machine types.
-       echo "$1"
+       echo $1
       exit ;;
    * )
@ -112,24 +113,24 @@ esac
 # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
 # Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
+maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
-  kopensolaris*-gnu* | cloudabi*-eabi* | \
+  kopensolaris*-gnu* | \
  storm-chaos* | os2-emx* | rtmk-nova*)
    os=-$maybe_os
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
    ;;
  android-linux)
    os=-linux-android
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
    ;;
  *)
-    basic_machine=`echo "$1" | sed 's/-[^-]*$//'`
+    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
-    if [ "$basic_machine" != "$1" ]
+    if [ $basic_machine != $1 ]
-    then os=`echo "$1" | sed 's/.*-/-/'`
+    then os=`echo $1 | sed 's/.*-/-/'`
    else os=; fi
    ;;
 esac
@ -178,44 +179,44 @@ case $os in
 		;;
 	-sco6)
 		os=-sco5v6
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5)
 		os=-sco3.2v5
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco4)
 		os=-sco3.2v4
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2.[4-9]*)
 		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2v[4-9]*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5v6*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco*)
 		os=-sco3.2v2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-udk*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-isc)
 		os=-isc2.2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-clix*)
 		basic_machine=clipper-intergraph
 		;;
 	-isc*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-lynx*178)
 		os=-lynxos178
@ -227,7 +228,10 @@ case $os in
 		os=-lynxos
 		;;
 	-ptx*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-sequent/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
 		;;
 	-windowsnt*)
 		os=`echo $os | sed -e 's/windowsnt/winnt/'`
 		;;
 	-psos*)
 		os=-psos
@ -260,7 +264,7 @@ case $basic_machine in
 	| fido | fr30 | frv | ft32 \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| hexagon \
-	| i370 | i860 | i960 | ia16 | ia64 \
+	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| k1om \
 	| le32 | le64 \
@ -296,9 +300,8 @@ case $basic_machine in
 	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pj | pjl \
+	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pru \
 	| pyramid \
 	| riscv32 | riscv64 \
 	| rl78 | rx \
@ -312,7 +315,7 @@ case $basic_machine in
 	| ubicom32 \
 	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
 	| visium \
-	| wasm32 \
+	| we32k \
 	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
@ -333,7 +336,7 @@ case $basic_machine in
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65)
+	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
 	ms1)
 		basic_machine=mt-unknown
@ -362,7 +365,7 @@ case $basic_machine in
 	  ;;
 	# Object if more than one company name word.
 	*-*-*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 	# Recognize the basic CPU types with company name.
@ -385,7 +388,7 @@ case $basic_machine in
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia16-* | ia64-* \
+	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
 	| k1om-* \
 	| le32-* | le64-* \
@ -426,7 +429,6 @@ case $basic_machine in
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
 	| pru-* \
 	| pyramid-* \
 	| riscv32-* | riscv64-* \
 	| rl78-* | romp-* | rs6000-* | rx-* \
@ -443,7 +445,6 @@ case $basic_machine in
 	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
 	| vax-* \
 	| visium-* \
 	| wasm32-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
@ -457,7 +458,7 @@ case $basic_machine in
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
 	386bsd)
-		basic_machine=i386-pc
+		basic_machine=i386-unknown
 		os=-bsd
 		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
@ -491,7 +492,7 @@ case $basic_machine in
 		basic_machine=x86_64-pc
 		;;
 	amd64-*)
-		basic_machine=x86_64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	amdahl)
 		basic_machine=580-amdahl
@ -520,7 +521,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		os=-aros
 		;;
-	asmjs)
+        asmjs)
 		basic_machine=asmjs-unknown
 		;;
 	aux)
@ -536,7 +537,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	blackfin-*)
-		basic_machine=bfin-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	bluegene*)
@ -544,13 +545,13 @@ case $basic_machine in
 		os=-cnk
 		;;
 	c54x-*)
-		basic_machine=tic54x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c55x-*)
-		basic_machine=tic55x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c6x-*)
-		basic_machine=tic6x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c90)
 		basic_machine=c90-cray
@ -639,18 +640,10 @@ case $basic_machine in
 		basic_machine=rs6000-bull
 		os=-bosx
 		;;
-	dpx2*)
+	dpx2* | dpx2*-bull)
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
 	e500v[12])
 		basic_machine=powerpc-unknown
 		os=$os"spe"
 		;;
 	e500v[12]-*)
 		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		os=$os"spe"
 		;;
 	ebmon29k)
 		basic_machine=a29k-amd
 		os=-ebmon
@ -740,6 +733,9 @@ case $basic_machine in
 	hp9k8[0-9][0-9] | hp8[0-9][0-9])
 		basic_machine=hppa1.0-hp
 		;;
 	hppa-next)
 		os=-nextstep3
 		;;
 	hppaosf)
 		basic_machine=hppa1.1-hp
 		os=-osf
@ -752,26 +748,26 @@ case $basic_machine in
 		basic_machine=i370-ibm
 		;;
 	i*86v32)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv4
 		;;
 	i*86v)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-solaris2
 		;;
 	i386mach)
 		basic_machine=i386-mach
 		os=-mach
 		;;
-	vsta)
+	i386-vsta | vsta)
 		basic_machine=i386-unknown
 		os=-vsta
 		;;
@ -790,16 +786,19 @@ case $basic_machine in
 		os=-sysv
 		;;
 	leon-*|leon[3-9]-*)
-		basic_machine=sparc-`echo "$basic_machine" | sed 's/-.*//'`
+		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
 		;;
 	m68knommu)
 		basic_machine=m68k-unknown
 		os=-linux
 		;;
 	m68knommu-*)
-		basic_machine=m68k-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
 	magnum | m3230)
 		basic_machine=mips-mips
 		os=-sysv
@ -831,10 +830,10 @@ case $basic_machine in
 		os=-mint
 		;;
 	mips3*-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`-unknown
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
 	monitor)
 		basic_machine=m68k-rom68k
@ -853,7 +852,7 @@ case $basic_machine in
 		os=-msdos
 		;;
 	ms1-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/ms1-/mt-/'`
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
 		basic_machine=i686-pc
@ -895,7 +894,7 @@ case $basic_machine in
 		basic_machine=v70-nec
 		os=-sysv
 		;;
-	next | m*-next)
+	next | m*-next )
 		basic_machine=m68k-next
 		case $os in
 		    -nextstep* )
@ -940,12 +939,6 @@ case $basic_machine in
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
 	nsv-tandem)
 		basic_machine=nsv-tandem
 		;;
 	nsx-tandem)
 		basic_machine=nsx-tandem
 		;;
 	op50n-* | op60c-*)
 		basic_machine=hppa1.1-oki
 		os=-proelf
@ -978,7 +971,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	parisc-*)
-		basic_machine=hppa-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	pbd)
@ -994,7 +987,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		;;
 	pc98-*)
-		basic_machine=i386-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
@ -1009,16 +1002,16 @@ case $basic_machine in
 		basic_machine=i786-pc
 		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium4-*)
-		basic_machine=i786-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pn)
 		basic_machine=pn-gould
@ -1028,23 +1021,23 @@ case $basic_machine in
 	ppc | ppcbe)	basic_machine=powerpc-unknown
 		;;
 	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppcle | powerpclittle)
+	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppc64le | powerpc64little)
+	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ps2)
 		basic_machine=i386-ibm
@ -1098,10 +1091,17 @@ case $basic_machine in
 	sequent)
 		basic_machine=i386-sequent
 		;;
 	sh)
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
 	sh5el)
 		basic_machine=sh5le-unknown
 		;;
-	simso-wrs)
+	sh64)
 		basic_machine=sh64-unknown
 		;;
 	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
 		;;
@ -1120,7 +1120,7 @@ case $basic_machine in
 		os=-sysv4
 		;;
 	strongarm-* | thumb-*)
-		basic_machine=arm-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	sun2)
 		basic_machine=m68000-sun
@ -1242,9 +1242,6 @@ case $basic_machine in
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
 	x64)
 		basic_machine=x86_64-pc
 		;;
 	xbox)
 		basic_machine=i686-pc
 		os=-mingw32
@ -1253,12 +1250,20 @@ case $basic_machine in
 		basic_machine=xps100-honeywell
 		;;
 	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo "$basic_machine" | sed 's/^xscale/arm/'`
+		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
 		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
 		;;
 	z8k-*-coff)
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
 	z80-*-coff)
 		basic_machine=z80-unknown
 		os=-sim
 		;;
 	none)
 		basic_machine=none-none
 		os=-none
@ -1287,6 +1292,10 @@ case $basic_machine in
 	vax)
 		basic_machine=vax-dec
 		;;
 	pdp10)
 		# there are many clones, so DEC is not a safe bet
 		basic_machine=pdp10-unknown
 		;;
 	pdp11)
 		basic_machine=pdp11-dec
 		;;
@ -1296,6 +1305,9 @@ case $basic_machine in
 	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
 	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
 		basic_machine=sparc-sun
 		;;
 	cydra)
 		basic_machine=cydra-cydrome
 		;;
@ -1315,7 +1327,7 @@ case $basic_machine in
 		# Make sure to match an already-canonicalized machine name.
 		;;
 	*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 esac
@ -1323,10 +1335,10 @@ esac
 # Here we canonicalize certain aliases for manufacturers.
 case $basic_machine in
 	*-digital*)
-		basic_machine=`echo "$basic_machine" | sed 's/digital.*/dec/'`
+		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
 		;;
 	*-commodore*)
-		basic_machine=`echo "$basic_machine" | sed 's/commodore.*/cbm/'`
+		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
 		;;
 	*)
 		;;
@ -1337,8 +1349,8 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-	# First match some system type aliases that might get confused
+	# First match some system type aliases
-	# with valid system types.
+	# that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
 	-auroraux)
 		os=-auroraux
@ -1349,19 +1361,18 @@ case $os in
 	-solaris)
 		os=-solaris2
 		;;
 	-svr4*)
 		os=-sysv4
 		;;
 	-unixware*)
 		os=-sysv4.2uw
 		;;
 	-gnu/linux*)
 		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
 		;;
-	# es1800 is here to avoid being matched by es* (a different OS)
+	# First accept the basic system types.
 	-es1800*)
 		os=-ose
 		;;
 	# Now accept the basic system types.
 	# The portable systems comes first.
-	# Each alternative MUST end in a * to match a version number.
+	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
@ -1371,26 +1382,24 @@ case $os in
 	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
-	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -windiss* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
 	      | -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox* | -bme* \
 	      | -midnightbsd*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@ -1407,12 +1416,12 @@ case $os in
 	-nto*)
 		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
-	-sim | -xray | -os68k* | -v88r* \
+	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
-		os=`echo "$os" | sed -e 's|mac|macos|'`
+		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
 	-linux-dietlibc)
 		os=-linux-dietlibc
@ -1421,10 +1430,10 @@ case $os in
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
 	-sunos5*)
-		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
+		os=`echo $os | sed -e 's|sunos5|solaris2|'`
 		;;
 	-sunos6*)
-		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
+		os=`echo $os | sed -e 's|sunos6|solaris3|'`
 		;;
 	-opened*)
 		os=-openedition
@ -1435,6 +1444,12 @@ case $os in
 	-wince*)
 		os=-wince
 		;;
 	-osfrose*)
 		os=-osfrose
 		;;
 	-osf*)
 		os=-osf
 		;;
 	-utek*)
 		os=-bsd
 		;;
@ -1459,7 +1474,7 @@ case $os in
 	-nova*)
 		os=-rtmk-nova
 		;;
-	-ns2)
+	-ns2 )
 		os=-nextstep2
 		;;
 	-nsk*)
@ -1481,7 +1496,7 @@ case $os in
 	-oss*)
 		os=-sysv3
 		;;
-	-svr4*)
+	-svr4)
 		os=-sysv4
 		;;
 	-svr3)
@ -1496,38 +1511,32 @@ case $os in
 	-ose*)
 		os=-ose
 		;;
 	-es1800*)
 		os=-ose
 		;;
 	-xenix)
 		os=-xenix
 		;;
 	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 		os=-mint
 		;;
 	-aros*)
 		os=-aros
 		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
 	-dicos*)
 		os=-dicos
 		;;
 	-pikeos*)
 		# Until real need of OS specific support for
 		# particular features comes up, bare metal
 		# configurations are quite functional.
 		case $basic_machine in
 		    arm*)
 			os=-eabi
 			;;
 		    *)
 			os=-elf
 			;;
 		esac
 		;;
 	-nacl*)
 		;;
 	-ios)
 		;;
 	-none)
 		;;
 	*)
 		# Get rid of the `-' at the beginning of $os.
 		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`"$1"\': system \`"$os"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
 		exit 1
 		;;
 esac
@ -1617,12 +1626,12 @@ case $basic_machine in
 	sparc-* | *-sun)
 		os=-sunos4.1.1
 		;;
 	pru-*)
 		os=-elf
 		;;
 	*-be)
 		os=-beos
 		;;
 	*-haiku)
 		os=-haiku
 		;;
 	*-ibm)
 		os=-aix
 		;;
@ -1662,7 +1671,7 @@ case $basic_machine in
 	m88k-omron*)
 		os=-luna
 		;;
-	*-next)
+	*-next )
 		os=-nextstep
 		;;
 	*-sequent)
@ -1677,6 +1686,9 @@ case $basic_machine in
 	i370-*)
 		os=-mvs
 		;;
 	*-next)
 		os=-nextstep3
 		;;
 	*-gould)
 		os=-sysv
 		;;
@ -1786,15 +1798,15 @@ case $basic_machine in
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo "$basic_machine" | sed "s/unknown/$vendor/"`
+		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
 		;;
 esac
-echo "$basic_machine$os"
+echo $basic_machine$os
 exit
 # Local variables:
-# eval: (add-hook 'write-file-functions 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
--- a/2846
+++ b/2846
--- a/configure.ac
+++ b/configure.ac
@ -1,9 +1,10 @@
 dnl Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.61)
-AC_INIT([tinc], [1.0.36])
+AC_INIT([tinc], m4_esyscmd_s((git describe || echo UNKNOWN) | sed 's/release-//'))
 AC_CONFIG_SRCDIR([src/tincd.c])
-AM_INIT_AUTOMAKE([1.11 check-news std-options subdir-objects nostdinc silent-rules -Wall])
+AC_GNU_SOURCE
 AM_INIT_AUTOMAKE([std-options subdir-objects nostdinc silent-rules -Wall])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_SILENT_RULES([yes])
@ -18,6 +19,7 @@ dnl Checks for programs.
 AC_PROG_CC_C99
 AC_PROG_CPP
 AC_PROG_INSTALL
 AC_PROG_LN_S
 AM_PROG_CC_C_O
@ -66,7 +68,9 @@ case $host_os in
  *mingw*)
    mingw=true
    AC_DEFINE(HAVE_MINGW, 1, [MinGW])
-    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32"
+    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32 -liphlpapi"
    LDFLAGS="$LDFLAGS -static"
    CPPFLAGS="$CPPFLAGS -DMINIUPNP_STATICLIB"
  ;;
  *)
    AC_MSG_ERROR("Unknown operating system.")
@ -107,20 +111,13 @@ AC_ARG_ENABLE(tunemu,
  [tunemu=false]
 )
 AC_ARG_WITH(windows2000,
  AS_HELP_STRING([--with-windows2000], [compile with support for Windows 2000. This disables support for tunneling over existing IPv6 networks.]),
  [ AS_IF([test "x$with_windows2000" = "xyes"],
      [AC_DEFINE(WITH_WINDOWS2000, 1, [Compile with support for Windows 2000])])
  ]
 )
 AC_ARG_WITH(systemd,
  AS_HELP_STRING([--with-systemd@<:@=DIR@:>@], [install systemd service files @<:@to DIR if specified@:>@]),
  [ systemd=true; systemd_path="$with_systemd" ],
  [ systemd=false ]
 )
-AS_IF([test "x$with_systemd" = "xyes"], [systemd_path="\${libdir}/systemd/system"],
+AS_IF([test "x$with_systemd" = "xyes"], [systemd_path="/lib/systemd/system"],
      [AS_IF([test "x$with_systemd" = "xno"], [systemd=false])])
 AC_SUBST(systemd_path, $systemd_path)
@ -137,18 +134,12 @@ AM_CONDITIONAL(WITH_SYSTEMD, test "$systemd" = true)
 AC_CACHE_SAVE
-if test -d /sw/include ; then
+AS_IF([test -d /sw/include], [CPPFLAGS="$CPPFLAGS -I/sw/include"])
-  CPPFLAGS="$CPPFLAGS -I/sw/include"
+AS_IF([test -d /sw/lib], [LIBS="$LIBS -L/sw/lib"])
 fi
 if test -d /sw/lib ; then
  LIBS="$LIBS -L/sw/lib"
 fi
 dnl Compiler hardening flags
 dnl No -fstack-protector-all because it doesn't work on all platforms or architectures.
 AX_CFLAGS_WARN_ALL(CFLAGS)
 AC_ARG_ENABLE([hardening], AS_HELP_STRING([--disable-hardening], [disable compiler and linker hardening flags]))
 AS_IF([test "x$enable_hardening" != "xno"],
  [AX_CHECK_COMPILE_FLAG([-DFORTIFY_SOURCE=2], [CPPFLAGS="$CPPFLAGS -DFORTIFY_SOURCE=2"])
@ -169,13 +160,11 @@ AS_IF([test "x$enable_hardening" != "xno"],
  ]
 );
 dnl Checks for libraries.
 dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
-AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h arpa/nameser.h dirent.h getopt.h])
+AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/un.h sys/wait.h netdb.h arpa/inet.h dirent.h getopt.h])
-AC_CHECK_HEADERS([net/if.h net/if_types.h linux/if_tun.h net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
+AC_CHECK_HEADERS([net/if.h net/if_types.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
  [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_HEADERS([netinet/if_ether.h netinet/ip.h netinet/ip6.h resolv.h],
@ -186,48 +175,77 @@ AC_CHECK_HEADERS([netinet/tcp.h netinet/ip_icmp.h netinet/icmp6.h],
 )
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_TYPE_PID_T
 tinc_ATTRIBUTE(__malloc__)
 tinc_ATTRIBUTE(__warn_unused_result__)
-AC_CHECK_TYPES([socklen_t, struct ether_header, struct arphdr, struct ether_arp, struct in_addr, struct addrinfo, struct ip, struct icmp, struct in6_addr, struct sockaddr_in6, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
+AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip, struct icmp, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
  [#include "$srcdir/src/have.h"]
 )
 dnl Checks for library functions.
 AC_TYPE_SIGNAL
-AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall pselect putenv strsignal system unsetenv usleep vsyslog devname fdevname],
+AC_CHECK_FUNCS([asprintf daemon fchmod flock ftime fork gettimeofday mlockall putenv recvmmsg strsignal nanosleep unsetenv vsyslog devname fdevname],
  [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_FUNC(getopt_long, [getopt=true; AC_DEFINE(HAVE_GETOPT_LONG, 1, [getopt_long()])], [getopt=false])
 AM_CONDITIONAL(GETOPT, test "$getopt" = true)
 dnl Support for SunOS
 AC_CHECK_FUNC(socket, [], [
  AC_CHECK_LIB(socket, connect)
 ])
 AC_CHECK_FUNC(gethostbyname, [], [
  AC_CHECK_LIB(nsl, gethostbyname)
 ])
 AC_CHECK_DECLS([freeaddrinfo, gai_strerror, getaddrinfo, getnameinfo],
  [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_DECLS([res_init], [AC_CHECK_LIB(resolv, res_init)], [], [
  #include <netinet/in.h>
  #include <resolv.h>
 ])
 dnl Operating system specific checks
 case $host_os in
  *linux*)
    AC_CHECK_HEADERS([linux/if_tun.h],
      [], [AC_MSG_ERROR([Required header file missng])], [#include "$srcdir/src/have.h"]
    )
  ;;
  *bsd*|*dragonfly*|*darwin*)
    AC_CHECK_HEADERS([net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h],
      [], [], [#include "$srcdir/src/have.h"]
    )
  ;;
  *solaris*)
    AC_CHECK_FUNC(socket, [], [AC_CHECK_LIB(socket, connect)])
  ;;
  *)
  ;;
 esac
 AC_CACHE_SAVE
 AC_ARG_ENABLE(legacy-protocol,
  AS_HELP_STRING([--disable-legacy-protocol], [disable support for the legacy (tinc 1.0) protocol]),
  [ AS_IF([test "x$enable_legacy_protocol" = "xno"],
    [ AC_DEFINE(DISABLE_LEGACY, 1, [Disable support for the legacy (tinc 1.0) protocol]) ])
  ]
 )
 dnl These are defined in files in m4/
 dnl AC_ARG_WITH(libgcrypt, AC_HELP_STRING([--with-libgcrypt], [enable use of libgcrypt instead of OpenSSL])], [])
 dnl AC_ARG_WITH(openssl, AC_HELP_STRING([--without-openssl], [disable support for OpenSSL])], [])
 tinc_CURSES
 tinc_READLINE
 tinc_ZLIB
 tinc_LZO
-tinc_OPENSSL
+
 AS_IF([test "x$enable_legacy_protocol" != "xno"],
      [AS_IF([test -n "$with_libgcrypt"],
 	     [gcrypt=true; tinc_LIBGCRYPT],
 	     [openssl=true; tinc_OPENSSL])
      ]
 )
 AM_CONDITIONAL(OPENSSL, test -n "$openssl")
 AM_CONDITIONAL(GCRYPT, test -n "$gcrypt")
 tinc_MINIUPNPC
 AM_CONDITIONAL(MINIUPNPC, test "x$enable_miniupnpc" = "xyes")
 dnl Check if support for jumbograms is requested
 AC_ARG_ENABLE(jumbograms,
@ -237,11 +255,6 @@ AC_ARG_ENABLE(jumbograms,
  ]
 )
-dnl Ensure runstatedir is set if we are using a version of autoconf that does not support it
+AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile gui/Makefile test/Makefile systemd/Makefile])
 if test "x$runstatedir" = "x"; then
  AC_SUBST([runstatedir], ['${localstatedir}/run'])
 fi
 AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile systemd/Makefile])
 AC_OUTPUT
--- a/debian/NEWS
+++ b/debian/NEWS
@ -1,14 +0,0 @@
 tinc (1.0.27-1) unstable; urgency=medium
  This package now provides native systemd service files, allowing multiple
  instances of tinc to be managed. Existing networks listed in
  /etc/tinc/nets.boot will be converted to service instances once during this
  upgrade. Afterwards, you can enable and disable networks using:
    systemctl enable tinc@<netname>
    systemctl disable tinc@<netname>
  If you do not have systemd installed, the SysV init script will continue to
  work as usual. For more information, see README.Debian.
 -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:33:55 +0200
--- a/debian/README.Debian
+++ b/debian/README.Debian
@ -1,80 +0,0 @@
 tinc for Debian
 ---------------
 The manual for tinc is also available as info pages, type `info tinc'
 to read it.
 There are several ways in which tinc may be automatically started at boot:
 Systemd
 -------
 Since 1.0.27-1, the tinc package comes with native systemd service files.
 To enable and start a net, call:
 systemctl enable tinc@<netname>
 systemctl start tinc@<netname>
 This will cause a tincd to be started which uses the configuration from
 /etc/tinc/<netname>, and also makes sure that it will be started next time your
 system boots.
 Apart from controlling individual instances, you can also start/stop/reload all
 enabled instances simultaneously by omitting @<netname>, for example:
 systemctl reload tinc
 Note that when you have systemd installed on your system, the file
 /etc/tinc/nets.boot will not be used anymore to automatically start tinc
 daemons. If the variable EXTRA is defined in /etc/default/tinc, it will be
 passed on to tinc. The variable LIMITS is however not used.
 The service files that come with this package start tinc unconditionally.
 However, tinc does support socket activation. If you wish to write a socket
 unit for tinc, use the ListenStream option to specify on which port(s) and
 address(es) tinc should listen.
 SysVinit
 --------
 The system startup script for tinc, /etc/init.d/tinc, uses the file
 /etc/tinc/nets.boot to find out which networks have to be started. Use one
 netname per line. Lines starting with a # are ignored.
 /etc/network/interfaces
 -----------------------
 You can create a stanza in /etc/network/interfaces, and add a line with
 "tinc-net <netname>". This will cause a tincd to be started which uses the
 configuration from /etc/tinc/<netname>. You can use an inet static (with
 address and netmask options) or inet dhcp stanza, in which case the ifup will
 configure the VPN interface and you do not need to have a tinc-up script.
 The following options are also recognized and map directly to the corresponding
 command line options for tincd:
 tinc-config <directory>
 tinc-debug <level>
 tinc-mlock yes
 tinc-logfile <filename>
 tinc-pidfile <filename>
 tinc-chroot yes
 tinc-user <username>
 An example stanza:
 iface vpn inet static
 	address 192.168.2.42
 	netmask 255.255.0.0
 	tinc-net myvpn
 	tinc-debug 1
 	tinc-mlock yes
 	tinc-user nobody
 	tinc-pidfile /tmp/tinc.pid
 This will start a tinc daemon that reads its configuration from
 /etc/tinc/myvpn, logs at debug level 1, locks itself in RAM, runs as user
 nobody, and creates a network interface called "vpn". Ifup then sets the
 address and netmask on that interface.
 -- Guus Sliepen <guus@debian.org>, Sun, 10 April 2016, 01:38:08 +0200
--- a/debian/changelog
+++ b/debian/changelog
@ -1,685 +0,0 @@
 tinc (1.0.36-2) unstable; urgency=medium
  * Disable support for libvdeplug. Closes: #973233
 -- Guus Sliepen <guus@debian.org>  Sun, 22 Nov 2020 10:40:27 +0100
 tinc (1.0.36-1) unstable; urgency=medium
  * New upstream version 1.0.36
  * Add Vcs tags to debian/control.
  * Bump Standards-Version.
 -- Guus Sliepen <guus@debian.org>  Mon, 26 Aug 2019 14:17:21 +0200
 tinc (1.0.35-2) unstable; urgency=medium
  * Bump Standards-Version and Build-Depend on debhelper-compat (= 12).
  * Remove calls to dh_installinit and dh_systemd_start from debian/rules,
    compat level 12 does the right thing by default.
  * Ensure we clean up doc/tinc.info.
 -- Guus Sliepen <guus@debian.org>  Mon, 28 Jan 2019 21:54:45 +0100
 tinc (1.0.35-1) unstable; urgency=medium
  * New upstream release.
    - Includes fixes for CVE-2018-16737, CVE-2018-16738, CVE-2018-16758.
 -- Guus Sliepen <guus@debian.org>  Mon, 08 Oct 2018 16:09:06 +0200
 tinc (1.0.34-1) unstable; urgency=medium
  [ Guus Sliepen ]
  * New upstream release.
    - Fixes a potential segmentation fault when connecting to an IPv6
      peer via a proxy. Closes: #887401
  * Add support for the $EXTRA variable in /etc/default/tinc when using
    systemd. Closes: #887116
  [ Benda Xu ]
  * Prevent possible incorrect IPv6 checksums due to function inlining.
    Closes: #891400
 -- Guus Sliepen <guus@debian.org>  Tue, 12 Jun 2018 23:00:49 +0200
 tinc (1.0.33-1) unstable; urgency=medium
  * New upstream release.
  * Test for /etc/default/tinc before trying to source it. Closes: #777262
  * Use --runstatedir=/run.
 -- Guus Sliepen <guus@debian.org>  Sat, 04 Nov 2017 16:22:06 +0100
 tinc (1.0.32-1) unstable; urgency=medium
  * New upstream release.
  * Add a note to new nets.boot files that it is not used with systemd.
    Closes: #841052
  * In the post-down script, read the pid file only once. Closes: #832784
  * Explicitly use /bin/sleep from coreutils. Closes: #772379
  * Bump Standards-Version.
 -- Guus Sliepen <guus@debian.org>  Tue, 05 Sep 2017 20:23:36 +0200
 tinc (1.0.31-1) unstable; urgency=medium
  * New upstream release.
  * Bump Standards-Version.
  * Bump debian/compat.
  * Add missing Depends: lsb-base.
 -- Guus Sliepen <guus@debian.org>  Sun, 15 Jan 2017 16:20:40 +0100
 tinc (1.0.29-2) unstable; urgency=medium
  * Rebuild with libssl-dev from unstable.
 -- Guus Sliepen <guus@debian.org>  Thu, 27 Oct 2016 13:09:46 +0200
 tinc (1.0.29-1) unstable; urgency=medium
  * New upstream release.
  * Bump debian/compat.
 -- Guus Sliepen <guus@debian.org>  Mon, 10 Oct 2016 22:30:25 +0200
 tinc (1.0.28-1) unstable; urgency=medium
  * New upstream release.
    - Fixes FTBFS on kfreebsd.
  * Systemd service files are now provided by upstream.
 -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 15:44:28 +0200
 tinc (1.0.27-2) unstable; urgency=medium
  * Fix tinc@.service.
 -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 12:45:33 +0200
 tinc (1.0.27-1) unstable; urgency=medium
  * New upstream release.
  * Bump Standards-Version.
  * Add native systemd unit files.
  * Automatically convert networks listed in nets.boot to systemd service
    instances on upgrade.
 -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:39:16 +0200
 tinc (1.0.26-1) unstable; urgency=medium
  * New upstream release.
  * Use the contents, not the presence, of the pidfile to check that tincd is
    shut down properly. Closes: #774682
  * Bump Standards-Version.
 -- Guus Sliepen <guus@debian.org>  Sun, 05 Jul 2015 17:23:08 +0200
 tinc (1.0.24-2) unstable; urgency=medium
  * Improve the init script: stopping tinc now waits for the process to
    terminate. If that doesn't happen in 5 seconds, it will send the TERM
    signal again (which helps if tinc is waiting for a script to finish
    executing). It now also detects whether the process mentioned in the PID
    file is actually running, and if not it will exit early and without
    warnings. Closes: #748107
 -- Guus Sliepen <guus@debian.org>  Wed, 14 May 2014 21:44:16 +0200
 tinc (1.0.24-1) unstable; urgency=medium
  [ Guus Sliepen ]
  * New upstream release
  * Add a debian/watch file.
  * Bump Standards-Version.
  [ Gian Piero Carrubba ]
  * Allow resource limits to be set in /etc/default/tinc.
    Closes: #690685, #704702
 -- Guus Sliepen <guus@debian.org>  Sun, 11 May 2014 21:17:13 +0200
 tinc (1.0.23-2) unstable; urgency=low
  * Use if-statements instead of && in shell scripts. Closes: #731279
    The && operator does not clear the error status, and if the next statement
    in a shell script does not change the error status it would cause the
    script to prematurely exit. Thanks to Peter Reinholdtsen for spotting it.
  * Use absolute path to tincd in the if-post-down script.
 -- Guus Sliepen <guus@debian.org>  Thu, 05 Dec 2013 09:41:13 +0000
 tinc (1.0.23-1) unstable; urgency=low
  * New upstream release.
 -- Guus Sliepen <guus@debian.org>  Sat, 19 Oct 2013 21:06:05 +0200
 tinc (1.0.22-1) unstable; urgency=low
  * New upstream release.
    - Handles whitespace between command line flags and optional arguments.
      Closes: #710267
  * Bump Standards-Version.
  * Source /lib/lsb/init-functions in the init.d script.
  * Don't use texi2html anymore, use automake's install-html target which uses
    makeinfo.
 -- Guus Sliepen <guus@debian.org>  Wed, 14 Aug 2013 15:34:29 +0200
 tinc (1.0.21-1) unstable; urgency=low
  * New upstream release.
    - Includes fix for CVE-2013-1428.
 -- Guus Sliepen <guus@debian.org>  Sun, 05 May 2013 10:42:33 +0200
 tinc (1.0.19-3) unstable; urgency=high
  * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).
 -- Guus Sliepen <guus@debian.org>  Fri, 12 Apr 2013 22:52:10 +0200
 tinc (1.0.19-2) unstable; urgency=low
  * Fix behaviour of tinc-pidfile. Closes: #679130
  * Enable parallel building in debian/rules.
 -- Guus Sliepen <guus@debian.org>  Tue, 26 Jun 2012 18:28:34 +0200
 tinc (1.0.19-1) unstable; urgency=low
  * New upstream release.
  * Bump debian/compat so tinc gets built with hardening flags.
  * Allow tinc-pidfile in /etc/network/interfaces.
 -- Guus Sliepen <guus@debian.org>  Mon, 25 Jun 2012 20:29:22 +0200
 tinc (1.0.18-1) unstable; urgency=low
  * New upstream release.
 -- Guus Sliepen <guus@debian.org>  Sun, 25 Mar 2012 18:52:15 +0200
 tinc (1.0.17-1) unstable; urgency=low
  * New upstream release.
  * Enable support for UML and VDE.
 -- Guus Sliepen <guus@debian.org>  Sat, 10 Mar 2012 14:50:00 +0100
 tinc (1.0.16-1) unstable; urgency=low
  * New upstream release.
  * Mention alarm option in /etc/init.d/tinc's usage information.
    Closes: #631761
 -- Guus Sliepen <guus@debian.org>  Sat, 23 Jul 2011 14:37:56 +0200
 tinc (1.0.15-1) unstable; urgency=low
  * New upstream release.
  * Send SIGALRM to running tinc daemons whenever an interface is brought up
    with the ifupdown framework. Based on a patch from Joachim Breitner.
    Closes: #629880
  * Allow tinc daemons to be started using ifupdown.
 -- Guus Sliepen <guus@debian.org>  Fri, 24 Jun 2011 18:21:51 +0200
 tinc (1.0.14-1) unstable; urgency=low
  * New upstream release.
  * Bump Standards-Version.
 -- Guus Sliepen <guus@debian.org>  Mon, 09 May 2011 00:25:37 +0200
 tinc (1.0.13-1) unstable; urgency=low
  * New upstream release.
 -- Guus Sliepen <guus@debian.org>  Tue, 13 Apr 2010 12:06:36 +0200
 tinc (1.0.12-2) unstable; urgency=low
  * Remove debconf questions. Closes: #572116
    Apparently debconf may not be used to ask a question at install time and
    use the answer at upgrade time. Instead of kludging around this
    restriction, no questions are asked anymore, and tinc will now always be
    restarted when upgrading.
  * Wait up to 5 seconds for tinc daemon to stop before restarting it.
 -- Guus Sliepen <guus@debian.org>  Tue, 02 Mar 2010 14:01:36 +0100
 tinc (1.0.12-1) unstable; urgency=low
  * New upstream release.
  * Bump Standards-Version.
  * Migrate from CDBS to debhelper.
  * Convert source package to 3.0 (quilt) format.
  * Remove useless tinc.modules.
  * Use init.d script from Michael Tokarev, allowing per-network arguments to
    tincd.
  * Remove update-rc.d calls from postinst and postrm.
  * Let the init.d script depend on $remote_fs.
 -- Guus Sliepen <guus@debian.org>  Thu, 04 Feb 2010 00:56:45 +0100
 tinc (1.0.11-1) unstable; urgency=low
  * New upstream release.
  * Cope with texi2html arbitrarily changing its output directory.
    Closes: #552927
  * Do not stop tinc when configuring a new version, just restart after
    the upgrade.
 -- Guus Sliepen <guus@debian.org>  Sun, 01 Nov 2009 20:37:16 +0100
 tinc (1.0.10-1) unstable; urgency=low
  * New upstream release.
  * Include Russian debconf translation. Closes: #548759
 -- Guus Sliepen <guus@debian.org>  Sun, 18 Oct 2009 16:31:49 +0200
 tinc (1.0.9-1) unstable; urgency=low
  * New upstream release.
    - Binds IPv6 sockets only to IPv6. Closes: #440150
  * Update copyright file. Closes: #482566
 -- Guus Sliepen <guus@debian.org>  Fri, 26 Dec 2008 13:25:05 +0100
 tinc (1.0.8-2) unstable; urgency=low
  * Include Portugese debconf translation. Closes: #434191
 -- Guus Sliepen <guus@debian.org>  Tue, 14 Aug 2007 13:50:27 +0200
 tinc (1.0.8-1) unstable; urgency=low
  * New upstream release. Closes: #173987
  * Include german debconf translation. Closes: #412351
  * Build-Depend on texinfo. Closes: #424209
 -- Guus Sliepen <guus@debian.org>  Wed, 16 May 2007 17:59:16 +0200
 tinc (1.0.7-1) unstable; urgency=low
  * New upstream release.
 -- Guus Sliepen <guus@debian.org>  Fri,  5 Jan 2007 15:55:42 +0100
 tinc (1.0.6-1) unstable; urgency=low
  * New upstream release.
 -- Guus Sliepen <guus@debian.org>  Mon, 18 Dec 2006 15:41:03 +0100
 tinc (1.0.5-1) unstable; urgency=low
  * New upstream release. Closes: #391610
  * Add an LSB section to the init script.
 -- Guus Sliepen <guus@debian.org>  Tue, 14 Nov 2006 16:32:20 +0100
 tinc (1.0.4-4) unstable; urgency=low
  * Include swedish debconf translation. Closes: #332963
  * Remove nets.boot on purge. Closes: #333303
 -- Guus Sliepen <guus@debian.org>  Mon, 17 Oct 2005 12:34:32 +0200
 tinc (1.0.4-3) unstable; urgency=low
  * Depend on debconf | debconf-2.0.
  * Include vietnamese debconf translation. Closes: #322305
  * Include japanese debconf translation. Closes: #319591
 -- Guus Sliepen <guus@debian.org>  Thu, 29 Sep 2005 11:15:34 +0200
 tinc (1.0.4-2) unstable; urgency=low
  * Compensate for change in texinfo's output directory. Closes: #318562
  * Include Czech translation of the debconf questions. Closes: #312982
 -- Guus Sliepen <guus@debian.org>  Sat, 16 Jul 2005 11:42:04 +0200
 tinc (1.0.4-1) unstable; urgency=low
  * New upstream release. Closes: #294819
  * Update french translation of debconf template. Closes: #293371, #296148
  * Allow dashes in nets.boot. Closes: #296281
 -- Guus Sliepen <guus@debian.org>  Wed,  4 May 2005 21:56:22 +0200
 tinc (1.0.3-4) unstable; urgency=low
  * Call debconf early in postinst so it won't get confused by output
    from other commands in the postinst script. Closes: #292920
  * If MAKEDEV doesn't know about net/tun, fall back to tun.
 -- Guus Sliepen <guus@debian.org>  Mon, 31 Jan 2005 13:27:16 +0100
 tinc (1.0.3-3) unstable; urgency=low
  * Fix clean rule in debian/rules.
 -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 23:16:59 +0000
 tinc (1.0.3-2) unstable; urgency=low
  * Don't check for /dev/tap* in postinst if we don't create them anyway.
  * MAKEDEV expects net/tun instead of tun.
  * Don't ask if /dev/net/tun should be created, just do it.
    Closes: #259489, #292450
  * Move $EXTRA from init.d/tinc to /etc/default/tinc. Closes: #281366
 -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 14:10:02 +0100
 tinc (1.0.3-1) unstable; urgency=low
  * New upstream release.
  * Adopting the package from Ivo.
  * Use invoke-rc.d, and tell user to do so as well. Closes: #223276
  * Let force-reload do the same thing as reload. Closes: #230180
 -- Guus Sliepen <guus@debian.org>  Fri,  1 Oct 2004 21:04:14 +0200
 tinc (1.0.2-2) unstable; urgency=low
  * debian/control: Oops, really make that automake1.7.
 -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 21:53:04 +0100
 tinc (1.0.2-1) unstable; urgency=low
  * New upstream release:
      * Fix broken replies to CHAL_RESP.  (Closes: #217646)
  * debian/control: Updated automake build dependency to automake1.7.
    (Closes: #219360)
 -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 19:56:04 +0100
 tinc (1.0.1-2) unstable; urgency=low
  * debian/dirs: Removed, moved contents to tinc.dirs.
    (Closes: #208591)
  * debian/docs: Renamed to tinc.docs.
  * debian/rules: Install the contents of doc/sample-config.tar.gz in
    /usr/share/doc/tinc/examples instead of /etc/tinc.
  * debian/Makefile*: Removed.
 -- Ivo Timmermans <ivo@debian.org>  Wed, 10 Sep 2003 12:19:32 +0200
 tinc (1.0.1-1) unstable; urgency=low
  * New upstream release.
  * debian/patches/001_openbsd_device.c.patch: Removed.
 -- Ivo Timmermans <ivo@debian.org>  Thu, 14 Aug 2003 17:03:28 +0200
 tinc (1.0release-1) unstable; urgency=low
  * New upstream version.  (Closes: #204639)
      * Fixes switching back to normal logging mode when killing with
        SIGINT twice.  (Closes: #175633)
      * Uses one SSL context struct for each connection, speeding up
        encrypting/decrypting data; don't throw away out of sequence
        packets.  (Closes: #188874)
      * Fixes handling of broadcast messages.  (Closes: #175632)
  * debian/rules: Use cdbs.
  * debian/control: Build-Depend on cdbs, liblzo-dev.
  * debian/patches/001_openbsd_device.c.patch: Sync openbsd/device.c to
    latest CVS version.
 -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Aug 2003 16:13:29 +0200
 tinc (1.0pre8-6) unstable; urgency=low
  * debian/po/fr.po: Added French debconf translation.  (Closes: #201803)
 -- Ivo Timmermans <ivo@debian.org>  Fri, 18 Jul 2003 10:03:20 +0200
 tinc (1.0pre8-5) unstable; urgency=low
  * debian/*: Change to po-debconf, thanks to From: Michel Grentzinger
    <mic.grentz@online.fr> for the patch:
      - change debhelper dependency to 4.1.16 (according to man
        po-debconf),
      - manually add nl translation in old tinc.templates (master),
      - run debconf-gettextize debian/tinc.templates,
      - move old templates files (debian/tinc.templates.*),
      - change construction "If you say no" to "If you refuse",
  * debian/rules: Call po2debconf.
  * debian/rules: Don't copy COPYING.README to the package.
  * debian/control: Update Standards-Version.
  * debian/conffiles: Removed.
  * debian/postinst: No longer use mknod directly, use MAKEDEV.
 -- Ivo Timmermans <ivo@debian.org>  Tue, 15 Jul 2003 20:13:47 +0200
 tinc (1.0pre8-4) unstable; urgency=low
  * src/net.h, src/net_packet.c, src/net_setup.c: Apply fix from CVS
    for OpenSSL-related memory leaks.  (Closes: #189432)
 -- Ivo Timmermans <ivo@debian.org>  Mon,  5 May 2003 15:00:29 +0200
 tinc (1.0pre8-3) unstable; urgency=low
  * m4/openssl.m4: Updated to CVS version.  (Closes: #184400)
 -- Ivo Timmermans <ivo@debian.org>  Thu, 13 Mar 2003 17:24:42 +0100
 tinc (1.0pre8-2) unstable; urgency=low
  * debian/postinst: Create /dev/net/tun if it doesn't exist.
  * debian/tinc.modules: Add alias for /dev/net/tun.
  * debian/rules: Install tinc.modules.
  * These things together: (Closes: #151967, #153156)
 -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Nov 2002 22:45:38 +0100
 tinc (1.0pre8-1) unstable; urgency=low
  * New upstream version.
  * debian/rules:
      - DEB_BUILD_OPTIONS support.
      - Enable --enable-tracing by default.
 -- Ivo Timmermans <ivo@debian.org>  Tue, 17 Sep 2002 13:50:44 +0200
 tinc (1.0pre7-3) unstable; urgency=low
  * Properly install _all_ info pages. (Closes: #144718)
 -- Ivo Timmermans <ivo@debian.org>  Wed, 29 May 2002 14:01:21 +0200
 tinc (1.0pre7-2) unstable; urgency=low
  * Dutch translation wasn't being installed.
 -- Ivo Timmermans <ivo@debian.org>  Thu, 11 Apr 2002 09:26:14 +0200
 tinc (1.0pre7-1) unstable; urgency=medium
  * New upstream release.
 -- Ivo Timmermans <ivo@debian.org>  Tue,  9 Apr 2002 16:04:46 +0200
 tinc (1.0pre6-3) unstable; urgency=medium
  * Synched with upstream CVS.
  * Added build dependency on zlib1g-dev. (Closes: #141705)
 -- Ivo Timmermans <ivo@debian.org>  Mon,  8 Apr 2002 21:19:31 +0200
 tinc (1.0pre6-2) unstable; urgency=low
  * The Section was non-US again, so changed it back to main/net.
 -- Ivo Timmermans <ivo@debian.org>  Thu, 28 Mar 2002 07:26:10 +0100
 tinc (1.0pre6-1) unstable; urgency=low
  * New upstream release.
  * Fixed text in debian/copyright
 -- Ivo Timmermans <ivo@debian.org>  Wed, 27 Mar 2002 23:10:07 +0100
 tinc (1.0pre5-4) unstable; urgency=low
  * Added a debconf question for restarting on upgrade.
  * Added reload option to init.d, start with EXTRA='-d' default.
  * Moved from non-US to main.
  * Install example configuration files.
  * The HTML documentation wasn't installed; fixed.
 -- Ivo Timmermans <ivo@debian.org>  Tue, 26 Mar 2002 20:14:19 +0100
 tinc (1.0pre5-3) unstable; urgency=low
  * Config variables are now treated case sentitivly again.
  * Added a forgotten xstrdup.
 -- Ivo Timmermans <ivo@debian.org>  Fri, 15 Feb 2002 12:35:17 +0100
 tinc (1.0pre5-2) unstable; urgency=low
  * MaxTimeout accidentally wasn't configurable. (Closes: #119653)
 -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Feb 2002 13:36:54 +0100
 tinc (1.0pre5-1) unstable; urgency=low
  * New upstream version. (Closes: #119653)
  * Init script redone in sh.
 -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Feb 2002 16:39:53 +0100
 tinc (1.0pre4-1.cvs010621.6) unstable; urgency=low
  * Somehow po-Makefile.in.in.diff got lost, readded. (Closes: #119157)
 -- Ivo Timmermans <ivo@debian.org>  Thu, 15 Nov 2001 17:00:03 +0100
 tinc (1.0pre4-1.cvs010621.5) unstable; urgency=low
  * Fix a typo in postinst that let it MAKEDEV even on devfs.
    (Closes: #116034)
 -- Ivo Timmermans <ivo@debian.org>  Thu, 18 Oct 2001 09:35:16 +0200
 tinc (1.0pre4-1.cvs010621.4) unstable; urgency=low
  * Ask before creating the device files. (Closes: #111099)
  * Add a section to the info file.
 -- Ivo Timmermans <ivo@debian.org>  Fri, 12 Oct 2001 20:47:09 +0200
 tinc (1.0pre4-1.cvs010621.3) unstable; urgency=low
  * Build and install html documentation. (Closes: #106843)
  * Remove build-time dependency on libc6-dev.
 -- Ivo Timmermans <ivo@debian.org>  Mon, 30 Jul 2001 22:03:52 +0200
 tinc (1.0pre4-1.cvs010621.2) unstable; urgency=low
  * Changed location of the pidfile. (Closes: #102798)
 -- Ivo Timmermans <ivo@debian.org>  Sun,  1 Jul 2001 01:57:43 +0200
 tinc (1.0pre4-1.cvs010621.1) unstable; urgency=low
  * New upstream version. (Closes: #98730)
  * Rebuilding automatically inserted new config.{sub|guess}.
    (Closes: #98165)
  * Updated Standards-Version.
  * Don't include a sample configuration file.
 -- Ivo Timmermans <ivo@debian.org>  Thu, 21 Jun 2001 14:08:49 +0200
 tinc (1.0pre3-5) unstable; urgency=low
  * Fixed an error in the init script that prevented tinc from
    starting correctly.
 -- Ivo Timmermans <ivo@debian.org>  Thu,  8 Feb 2001 02:45:09 +0100
 tinc (1.0pre3-4) unstable; urgency=low
  * Change build-depends for OpenSSL to libssl096-dev
    (Closes: #84197, #84873).
 -- Ivo Timmermans <ivo@debian.org>  Sun,  4 Feb 2001 22:43:22 +0100
 tinc (1.0pre3-3) unstable; urgency=low
  * Set architecture to any (really this time!) (Closes: #80451).
  * Section set to non-US
 -- Ivo Timmermans <ivo@debian.org>  Tue, 23 Jan 2001 22:52:53 +0100
 tinc (1.0pre3-2) unstable; urgency=low
  * Set architecture to any (Closes: #80451).
  * Added tinc.modules with some useful module aliases.
 -- Ivo Timmermans <ivo@debian.org>  Sat, 13 Jan 2001 16:10:57 +0100
 tinc (1.0pre3-1) unstable; urgency=low
  * New upstream version (1.0pre3) (Closes: #71274).
  * Better Depends and Build-Depends lines.
  * Dropped dependencies on libgmp, added libssl.
  * doc-base.tinc: New file.
  * Deleted the file shlibs, as there on longer is a libblowfish.
  * Patch po/Makefile.in.in from po-Makefile.in.in.diff if necessary.
  * Use dh_perl to get accurate perl dependencies.
 -- Ivo Timmermans <ivo@debian.org>  Thu,  9 Nov 2000 21:58:40 +0100
 tinc (1.0pre2-1.1) unstable; urgency=low
  * NMU at Ivo's request as his application is being processed, and his
    sponsor is based in the US.
 -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 Jun 2000 21:52:30 +0200
 tinc (1.0pre2-1) unstable; urgency=low
  * postinst creates a file /etc/tinc/nets.boot, containing all networks
    to be started upon system startup;
  * init.d script starts all networks from that list.
  * postinst script creates tap devices.
 -- Ivo Timmermans <itimmermans@bigfoot.com>  Tue, 16 May 2000 00:06:25 +0200
 tinc (1.0pre1-0.4) unstable; urgency=low
  * postinst script.
 -- Ivo Timmermans <itimmermans@bigfoot.com>  Mon, 15 May 2000 19:22:05 +0200
 tinc (1.0pre1-0.3) unstable; urgency=low
  * system startup script.
 -- Ivo Timmermans <itimmermans@bigfoot.com>  Sun, 14 May 2000 22:58:02 +0200
 tinc (1.0pre1-0.2) unstable; urgency=low
  * Included the blowfish license.
 -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
 tinc (1.0pre1-0.1) unstable; urgency=low
  * Initial Release.
 -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
--- a/debian/control
+++ b/debian/control
@ -1,20 +0,0 @@
 Source: tinc
 Section: net
 Priority: optional
 Maintainer: Guus Sliepen <guus@debian.org>
 Standards-Version: 4.4.0
 Build-Depends: libssl-dev, debhelper-compat (= 12), gettext, texinfo, zlib1g-dev, liblzo2-dev
 Homepage: http://www.tinc-vpn.org/
 Vcs-Browser: https://salsa.debian.org/guus/tinc
 Vcs-Git: https://salsa.debian.org/guus/tinc.git
 Rules-Requires-Root: no
 Package: tinc
 Architecture: any
 Pre-Depends: ${misc:Pre-Depends}
 Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 3.0-6)
 Description: Virtual Private Network daemon
 tinc is a daemon with which you can create a virtual private network
 (VPN). One daemon can handle multiple connections, so you can
 create an entire (moderately sized) VPN with only one daemon per
 participating computer.
--- a/debian/copyright
+++ b/debian/copyright
@ -1,34 +0,0 @@
 This package was debianized by Ivo Timmermans <ivo@debian.org> on
 Fri, 21 Apr 2000 17:07:50 +0200.
 It was downloaded from http://www.tinc-vpn.org/
 Upstream Authors:
 Guus Sliepen <guus@tinc-vpn.org>
 Ivo Timmermans <ivo@tinc-vpn.org>
 Copyright (C) 1998-2005 Ivo Timmermans
              1998-2008 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 On Debian GNU/Linux systems, the complete text of the GNU General Public
 License version 2 can be found in /usr/share/common-licenses/GPL-2.
 The following applies to tinc:
 This program is released under the GPL with the additional exemption
 that compiling, linking, and/or using OpenSSL is allowed.  You may
 provide binary packages linked to the OpenSSL libraries, provided that
 all other requirements of the GPL are met.
 The following applies to the LZO library:
 Hereby I grant a special exception to the tinc VPN project
 (http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
 (http://www.openssl.org).
 Markus F.X.J. Oberhumer
--- a/debian/doc-base.tinc
+++ b/debian/doc-base.tinc
@ -1,10 +0,0 @@
 Document: tinc
 Title: tinc Manual
 Author: Ivo Timmermans, Guus Sliepen
 Abstract: This manual describes how to set up a Virtual Private
 Network with tinc.
 Section: System/Security
 Format: HTML
 Files: /usr/share/doc/tinc/tinc.html/*
 Index: /usr/share/doc/tinc/tinc.html/index.html
--- a/debian/info
+++ b/debian/info
@ -1 +0,0 @@
 doc/tinc.info
--- a/debian/patches/fix-incorrect-icmpv6-checksum
+++ b/debian/patches/fix-incorrect-icmpv6-checksum
@ -1,65 +0,0 @@
 Package: tinc
 Version: 1.0.33-1
 Severity: important
 Dear Guus,
 I have been using tinc since 2009 and it is great!
 When PMTUDiscovery=yes and Mode=switch, and if ipv6 is used inside
 tinc, the ICMPv6 "Packet Too Big" packets have incorrect checksums.
 It can be reproduced by `ping6 <host in tinc> -s 1800` and `tcpdump -i
 <tinc interface>`.  Consequently, the host ignores the tinc-generated
 ICMPv6 packets, PMTUDiscovery does not work and the connections freeze
 when data flows are big.
 I find the bug is gone if the function "inet_checksum" in route.c is
 not inlined, either by compiling tinc with "-O2
 -fno-inline-functions", or apply a patch such as,
 diff --git a/src/route.c b/src/route.c
 index ff82c06e..cd55383a 100644
 --- a/src/route.c
 +++ b/src/route.c
@@ -60,7 +60,7 @@ static const size_t opt_size = sizeof(struct nd_opt_hdr);
 /* RFC 1071 */
 -static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
 +__attribute__ ((noinline)) static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
 	uint16_t *p = data;
 	uint32_t checksum = prevsum ^ 0xFFFF;
 I have tested with gcc-7.3.0 and gcc-5.4.0.  They behaved the same.  I
 am not good at assembly to find out what really happened, but it is
 for sure that inet_checksum does not work as expected if compiled
 inline.
 Thanks!
 Yours,
 Benda
 -- System Information:
 Debian Release: buster/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
 Architecture: amd64 (x86_64)
 Kernel: Linux 4.9.0-5-amd64 (SMP w/8 CPU cores)
 Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
 Shell: /bin/sh linked to /bin/dash
 Init: sysvinit (via /sbin/init)
 Versions of packages tinc depends on:
 ii  libc6      2.26-2
 ii  liblzo2-2  2.08-1.2+b2
 ii  libssl1.1  1.1.0g-2
 ii  lsb-base   9.20170808
 ii  zlib1g     1:1.2.8.dfsg-5
 tinc recommends no packages.
 tinc suggests no packages.
--- a/debian/patches/series
+++ b/debian/patches/series
@ -1,2 +0,0 @@
 fix-incorrect-icmpv6-checksum
 support-etc-defaults-tinc
--- a/debian/patches/support-etc-defaults-tinc
+++ b/debian/patches/support-etc-defaults-tinc
@ -1,12 +0,0 @@
 --- a/systemd/tinc@.service.in
 +++ b/systemd/tinc@.service.in
@@ -9,7 +9,8 @@
 [Service]
 Type=simple
 WorkingDirectory=@sysconfdir@/tinc/%i
 -ExecStart=@sbindir@/tincd -n %i -D
 +EnvironmentFile=/etc/default/tinc
 +ExecStart=@sbindir@/tincd -n %i -D $EXTRA
 ExecReload=@sbindir@/tincd -n %i -kHUP
 KillMode=mixed
 Restart=on-failure
--- a/debian/postinst
+++ b/debian/postinst
@ -1,31 +0,0 @@
 #! /bin/sh
 NETSFILE="/etc/tinc/nets.boot"
 set -e
 case "$1" in
    configure)
 	if [ ! -e /dev/.devfsd ] ; then if [ ! -e /dev/.devfs ] ; then
 		if [ ! -e /dev/net/tun ] ; then if [ ! -e /dev/tun ] ; then if [ -e /dev/MAKEDEV ]; then
 			echo "Creating tun device..."
 			cd /dev && ./MAKEDEV net/tun 2>/dev/null || ./MAKEDEV tun 2>/dev/null || echo "Failed to create tun device."
 		fi; fi; fi
 	fi; fi
 	if [ ! -e $NETSFILE ] ; then
 	    echo "## This file contains all names of the networks to be started on system startup when using sysvinit." > $NETSFILE
 	    echo "## If you are using systemd, use systemctl enable tinc@netname to enable individual networks." >> $NETSFILE
 	fi
    ;;
    abort-upgrade|abort-remove|abort-deconfigure)
    ;;
    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 0
    ;;
 esac
 #DEBHELPER#
--- a/debian/postrm
+++ b/debian/postrm
@ -1,9 +0,0 @@
 #!/bin/sh
 set -e
 if [ "$1" = purge ]; then
    rm -f /etc/tinc/nets.boot
 fi
 #DEBHELPER#
--- a/debian/preinst
+++ b/debian/preinst
@ -1,28 +0,0 @@
 #!/bin/sh
 NETSFILE="/etc/tinc/nets.boot"
 SYSTEM="/lib/systemd/system"
 WANTS="/etc/systemd/system/multi-user.target.wants"
 set -e
 case "$1" in
 	upgrade)
 		if dpkg --compare-versions "$2" '<<' "1.0.27-1"; then
 			if [ -f "$NETSFILE" ]; then
 				echo -n "Creating systemd service instances from nets.boot:"
 				mkdir -p "$WANTS"
 				egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
 					echo -n " $net"
 					ln -s "$SYSTEM/tinc@.service" "$WANTS/tinc@$net.service" 2>/dev/null || true
 				done
 				echo "."
 			fi
 		fi
 	;;
 	*)
 	;;
 esac
 #DEBHELPER#
--- a/debian/rules
+++ b/debian/rules
@ -1,16 +0,0 @@
 #!/usr/bin/make -f
 %:
 	dh $@
 override_dh_clean:
 	dh_clean
 	rm -f doc/tinc.info
 override_dh_auto_configure:
 	dh_auto_configure -- --enable-uml --with-systemd=/lib/systemd/system --runstatedir=/run
 override_dh_auto_install:
 	dh_auto_install -- install-html
 	# Remove info dir file
 	rm -f debian/tinc/usr/share/info/dir
--- a/debian/source/format
+++ b/debian/source/format
@ -1 +0,0 @@
 3.0 (quilt)
--- a/debian/tinc.default
+++ b/debian/tinc.default
@ -1,7 +0,0 @@
 # Extra options to be passed to tincd.
 # EXTRA="-d"
 # Limits to be configured for the tincd process. Please read your shell
 # (pointed by /bin/sh) documentation for ulimit. You probably want to raise the
 # max locked memory value if using both --mlock and --user flags.
 # LIMITS="-l 1024"
--- a/debian/tinc.dirs
+++ b/debian/tinc.dirs
@ -1,7 +0,0 @@
 usr/sbin
 usr/share
 etc
 etc/init.d
 usr/share/locale
 usr/share/doc/tinc
 etc/tinc
--- a/debian/tinc.docs
+++ b/debian/tinc.docs
@ -1,3 +0,0 @@
 NEWS
 README
 AUTHORS
--- a/debian/tinc.files
+++ b/debian/tinc.files
@ -1,6 +0,0 @@
 usr/sbin/tincd
 usr/share/man
 etc
 usr/share/doc/tinc
 usr/share/locale
 usr/share/info
--- a/debian/tinc.if-post-down
+++ b/debian/tinc.if-post-down
@ -1,41 +0,0 @@
 #!/bin/sh
 set -e
 if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
 	exit 0
 fi
 # Determine location of the PID file
 EXTRA=""
 if [ -n "$IF_TINC_PIDFILE" ]; then
 	EXTRA="--pidfile=$IF_TINC_PIDFILE"
 else
 	IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
 fi
 # Stop the tinc daemon
 read pid rest < $IF_TINC_PIDFILE 2>/dev/null
 /usr/sbin/tincd -n "$IF_TINC_NET" -k $EXTRA
 # Wait for it to shut down properly
 /bin/sleep 0.1
 i=0;
 while [ -f $IF_TINC_PIDFILE ] ; do
 	if [ ! -e "/proc/$pid" ] ; then
 		exit 0
 	fi
 	if [ $i = '30' ] ; then
 		echo 'Failed to stop tinc daemon!'
 		exit 1
 	fi
 	/bin/sleep 0.1
 	i=$(($i+1))
 done
 exit 0
--- a/debian/tinc.if-pre-up
+++ b/debian/tinc.if-pre-up
@ -1,70 +0,0 @@
 #!/bin/sh
 set -e
 if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
 	exit 0
 fi
 # Read options from /etc/default
 [ -r /etc/default/tinc ] && . /etc/default/tinc
 # Set process limits
 setlimits() {
  while [ $# -gt 0 ]; do
    parm=$1 ; shift
    if [ -n "$1" -a "${1#-}" = "$1" ]; then
      value=$1 ; shift
      ulimit $parm $value
    else
      ulimit $parm
    fi
  done
 }
 test -n "$LIMITS" && setlimits $LIMITS
 # Read options from /etc/network/interfaces
 [ -n "$IF_TINC_CONFIG" ]          && EXTRA="$EXTRA -c $IF_TINC_CONFIG"
 [ -n "$IF_TINC_DEBUG" ]           && EXTRA="$EXTRA -d$IF_TINC_DEBUG"
 [ -n "$IF_TINC_MLOCK" ]           && EXTRA="$EXTRA --mlock"
 [ -n "$IF_TINC_LOGFILE" ]         && EXTRA="$EXTRA --logfile=$IF_TINC_LOGFILE"
 [ -n "$IF_TINC_PIDFILE" ]         && EXTRA="$EXTRA --pidfile=$IF_TINC_PIDFILE" || IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
 [ -n "$IF_TINC_CHROOT" ]          && EXTRA="$EXTRA --chroot"
 [ -n "$IF_TINC_USER" ]            && EXTRA="$EXTRA --user=$IF_TINC_USER"
 # Start tinc daemon
 /usr/sbin/tincd -n "$IF_TINC_NET" -o "Interface=$IFACE" $EXTRA
 # Wait for it to come up properly
 /bin/sleep 0.1
 i=0;
 while [ ! -f $IF_TINC_PIDFILE ] ; do
 	if [ $i = '30' ] ; then
 		echo 'Failed to start tinc daemon!'
 		exit 1
 	fi
 	/bin/sleep 0.1
 	i=$(($i+1))
 done
 while read pid rest < $IF_TINC_PIDFILE ; do
 	if [ -e "/proc/$pid" ] ; then
 		exit 0
 	fi
 	if [ $i = '30' ] ; then
 		echo 'Failed to start tinc daemon!'
 		exit 1
 	fi
 	/bin/sleep 0.1
 	i=$(($i+1))
 done
 exit 0
--- a/debian/tinc.if-up
+++ b/debian/tinc.if-up
@ -1,9 +0,0 @@
 #!/bin/sh
 set -e
 if [ "$METHOD" = loopback -o -n "$IF_TINC_NET" ]; then
 	exit 0
 fi
 invoke-rc.d tinc alarm || exit 0
--- a/debian/tinc.init
+++ b/debian/tinc.init
@ -1,140 +0,0 @@
 #! /bin/sh
 #
 ### BEGIN INIT INFO
 # Provides:          tinc
 # Required-Start:    $remote_fs $network
 # Required-Stop:     $remote_fs $network
 # Should-Start:      $syslog $named
 # Should-Stop:       $syslog
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # Short-Description: Start tinc daemons
 # Description:       Create a file $NETSFILE (/etc/tinc/nets.boot),
 #                    and put all the names of the networks in there.
 #                    These names must be valid directory names under
 #                    $TCONF (/etc/tinc). Lines starting with a # will be
 #                    ignored in this file.
 ### END INIT INFO
 #
 # Based on Lubomir Bulej's Redhat init script.
 . /lib/lsb/init-functions
 DAEMON="/usr/sbin/tincd"
 NAME="tinc"
 DESC="tinc daemons"
 TCONF="/etc/tinc"
 NETSFILE="$TCONF/nets.boot"
 NETS=""
 test -f $DAEMON || exit 0
 [ -r /etc/default/tinc ] && . /etc/default/tinc
 # foreach_net "what-to-say" action [arguments...]
 foreach_net() {
  if [ ! -f $NETSFILE ] ; then
    echo "Please create $NETSFILE."
    exit 0
  fi
  echo -n "$1"
  shift
  egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
    echo -n " $net"
    "$@" $net $args
  done
  echo "."
 }
 signal_running() {
  for i in /var/run/tinc.*pid; do
    if [ -f "$i" ]; then
      head -1 $i | while read pid; do
        kill -$1 $pid
      done
    fi
  done
 }
 setlimits() {
  while [ $# -gt 0 ]; do
    parm=$1 ; shift
    if [ -n "$1" -a "${1#-}" = "$1" ]; then
      value=$1 ; shift
      ulimit $parm $value
    else
      ulimit $parm
    fi
  done
 }
 test -n "$LIMITS" && setlimits $LIMITS
 start() {
  $DAEMON $EXTRA -n "$@"
 }
 stop() {
  [ -f /var/run/tinc.$1.pid ] || return
  read pid rest </var/run/tinc.$1.pid || return
  kill -0 "$pid" 2>/dev/null || return
  $DAEMON -n $1 -k || return
  i=0;
  /bin/sleep 0.5
  # Wait for the pidfile to disappear
  while [ -f /var/run/tinc.$1.pid ]; do
    # And check that there is an actual process running
    kill -0 "$pid" 2>/dev/null || return
    if [ $i = '10' ] ; then
      # It's still alive, kill it again and give up
        $DAEMON -n $1 -k && /bin/sleep 0.5
      break
    else
      echo -n "."
      i=$(($i+1))
    fi
    /bin/sleep 0.5
  done
 }
 reload() {
  $DAEMON -n $1 -kHUP
 }
 alarm() {
  $DAEMON -n $1 -kALRM
 }
 restart() {
  stop "$@"
  start "$@"
 }
 case "$1" in
  start)
    foreach_net "Starting $DESC:" start
  ;;
  stop)
    foreach_net "Stopping $DESC:" stop
  ;;
  reload|force-reload)
    foreach_net "Reloading $DESC configuration:" reload
  ;;
  restart)
    foreach_net "Restarting $DESC:" restart
  ;;
  alarm)
    signal_running ALRM
  ;;
  *)
    echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|alarm}"
    exit 1
  ;;
 esac
 exit 0
--- a/debian/upstream/signing-key.asc
+++ b/debian/upstream/signing-key.asc
@ -1,70 +0,0 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 Version: GnuPG v1
 mQINBEVZzTABEADawFv/ibQ48uA1eRhL07vdM36Pcq2HDyuyNA+vYEalNH4jLmha
 nGPvDALWwX0DXIWDAG8zeTj8s8zliLIjuPS4WRI2YdKIvWeG9fEvpKSXVWa42ica
 dpzn/H2aBd4Ax6rQaiTXKOvxANAp2Veb+73ssPV5AL00uGTpzhh98xQzfFQCZ9ZL
 YSVPqbMed5oCt/4jM9FBO2CuBtkfiO0dVVYtW7FAVjcIlE2NaZol/KGvz7wsS+yA
 dE42W0l5MdQueLmTF4AIUSSTyPFGMQoyqh+MPif73Y589IGcW6GdfKYWnVDo6Trh
 HOhcEky+uTYKb6NL0vrJgUiYVMzAOXFDdJni1eQGO6EfZRNYtTga3alWq/jVelK7
 BID5JyNbkrTAqdPnhJGivVyk8gGX3+Hng8rkXTfWhp6yAYau1QfBm0F2tIQmpL1C
 +7DoLvFErboQf685jXJBjzyvsJxB2ZLH1OOw6mNL0hy2LFkIyGza/bktY2em4apo
 KWV5AM5LpyW6THH1oDS7706xFNkf4IFhKE0hKPzBiRnMDjRtMI131lkc5+P8Lqf5
 jLTCFUgbEhU6Dz2YjhHAumVm0NWJETUpFDtVvMrqk+mp5xldUOWRNlYQC5aQOyda
 eHOlNzB/BFbPhKMWI/zWlEH6f0t6WjHb4iwpWO47511aVNHF59aPzbAHxwARAQAB
 tC9UaW5jIERldmVsb3BtZW50IFRlYW0gPHRpbmMtZGV2ZWxAdGluYy12cG4ub3Jn
 PokCNgQTAQIAIAUCRVnNMAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEEpg
 hLnA1x9KxOAQAMPhO2WTXv9AaGQBQhyyoGseKoSfcRjtI9YEfE0OInQQ2E+SPYF/
 dkfeLGAUqa4foTYQlMqfw70vBhTdVCb7HLTGn6/ICFUtDwakUQCgUQGlUVQiondA
 8W6jj+QWrh5BQhHuXy2nCVaKnksu0/xQPsJotghxuYqaot3iJ4qVw9iT/Yeo9irH
 Ffftqu0OVCdQ5zQuFNI9YCv/C83L59ecH7bOzYz2efTyobvxrhmgQtgOQwCWOE09
 Kr3veM9KLG33YoXlqv8QN/3CwtsJvSwfhj+R2JowZC7RqHe/yznRzmRMsgbrolxi
 uiJLonGxcNNkD7WhXi7/zL4A/JaC27XrFf1MPLv8aiTwnOIfrXd5jawpauUOZOXK
 UjIZHlIqviB0r5s7A+AFeHW38Tp9VzNuQ7aEl5bHbSXV+s7DTAwGb279z0AVaJ3h
 5hWFxupw7UoGdzROwCBYzeX3sioAL6QvkXua8X6zOH45VEiSwrRX3Hlx/MLo7Z4g
 PWgFLf6WviHQXCG834To1XIwUk9RgNsL7OzGjtaCuRymADImKMNwierq2zTfoRFQ
 v9onIadIMF1fsc70hiBG9yAi36MEuk4VxG8Jc3PQQfSFm4RWazv1k3E0AAIob2Ek
 DLVjvLO62Navo/OQ6D7yyiX0qes5S7/k3F1h8+87eRn3yxZE2kbxPg8KuQENBEVZ
 zYYBCACoYgExmMKEtABL3pir/IXI4exR/45hkP6txFIrkVQb8DGJ9H39kiDr4gtj
 F+pvcgMpec35S3m4fJ7WhDNvbDB4ZvONc1NMKs9cqDXfB+TLWPm4W+SkcKUrs+nK
 i8l7ieggTALJcvRoLTX2EFmUFrD6y870W3rK2SfC/0VJX8Ou5cPbwCeueExjo5x0
 3gNfu0jWUS0cyA9y+1rVVekrLuJY/+SI4jv3gdzrYbxD0f6dpbpC37QHoJdd0KGF
 acPtT2azjY+HxW10EA3Aw9oZWFXnb1nFg2RbDpkaGLmLbaXweltLyw154UmCXxym
 PXPqi9bSfEkj0GiYrapk4mW114u9ABEBAAGJA0QEGAECAA8FAkVZzYcCGwIFCQHh
 M4ABKQkQSmCEucDXH0rAXSAEGQECAAYFAkVZzYcACgkQ017duBDeLmmu3wf/TFZM
 tLKxiyQPtGSTE3eULPdWCEMDZXdSPTY0QHM7Zvh+qn1ei+iFpD0549MYnBEAwDIV
 4o62Nrcg8IPu0CEkZIAn2JiFFGYvMGk91awZGV1GS3umd7Dt349E1oKDPZVzRn+j
 QIKarXxxabRmx2s/dZZgSs/eguWTboBFmvls9tVfe8x/xPvcHFmqHVUoGKEJy6Tm
 no+s4yNjpc5wAaRml+GYf1tK9WMFuZn79qKxkYv4WI96dXR0FL59YbFRkkaI+1/b
 G31MvWTqVjY1nJGslByFPUUB8Ca1djtp1gx6NXnOYr3V5MEDfdbjjPu79No+/y6M
 tIua5yNtSRlk2nKhIqo3D/sGQ/uHijiMRAtoLhiyqYMc9W9vx/KOoCUHoMJqE39a
 Eputvgwwo0rwgSmNfB1dzneFojBdJ47WBSHC8NKtkpJj6mzvvlaI9jmEpK54x3nl
 OmBj3X/xaepoRGAtrmgTBP4A9hSjrTMGu/tUQjlX+Xcr6n3g7GSVe5FpUyIMPXEU
 +JZDTiEUyn1OdzfNGmnWP+KJX5pQVq4czf5XK6otLZJELDVw/Hbjnjmdz5WOKgEH
 jSof3WPeMBgPAcd/cMAZeiGtWM1UpJBHqEXTkthmrpmtRftJKDbooNM9d5OwKiT+
 I3vNBv/plMSr8NDjhTWC+ihrN6RBj1vaqpDgGpucPhoO2hwNqWuI4q5WUKtCyw6J
 An7ErNaH4c0nVaZq6kJ8Vxdt+LpKYmOsJ8y9xtl6StcrkKNn+6ZfCfee7DEo2bvb
 scfpqJqqOqb5KOagTpYs8mo6yQ3leRvFtoeBOQHVQzct23EwOMxbDyeunT50a1eH
 MZTEWuIiuCUudM81QXU46oIcaAtj8tpG0Tmnku9g27EjwxUt+8kVmhlPHMb2TdoF
 k5d0ce+JuxIG5+i+t8sUCorMc8zfp4g1bxZeMOcPnfyO3bSW11EVcN7ZxHlFC+XE
 YOByP50CM3P8lItPlQ+WpY9kYWjiwu9kVPaGQ16G47nspngJInU5dhka3KJGtIZe
 q7kBDQRFWc3GAQgAz/JUs24niKsd0ZtOjUWd4R4y0gjS0kC/vvLL2gbXYkA9tcjG
 5iEvVWJY34QsudX0v1ULsVnJ89X/gsk8hAhAia1TQm+0Qq+MSxEaQkMSaOO8N70U
 XzgH1dielvpea20WO4MyWQuRIJ0K2nsGmEPnt6ZP7fK8HVHFNggP/mQ6LMu1reAF
 gvb8cEtjb9B5QaCUEoLjsbsuo+vLW7AWy4GfIRNESHw2Qt08AUaGrihpu6zi7N2b
 QkHHJtqa63GzYJ+kYzAVvrFJXdwL/TRXLBzv+6yyvYSIHi8uB6/o6CZN6hpjfpME
 ph+oYPqXeNOyMd1E9Kg8ymcPrNyQKfE3WnCRXQARAQABiQIlBBgBAgAPBQJFWc3H
 AhsMBQkB4TOAAAoJEEpghLnA1x9KXYMP/3D9JYti6C8DWuX2hWv+2SUbLcMa5u1e
 ETewIo5S3mqGWSaxX4YLPVRkZ1lOLmFysOLimf0thYm7IsatLcWmBdYUpK92ilvr
 Sk2sKlhrOoBXEX/79Kz+Aj5PjeyiQxgQ7Ba/afwhU6aTqs2Dp1T0YNu2eBvV+1QH
 lZnW2Wh96zzwc0dJUuY9eBk5Fgpu08Wce7o6jxFPtVyAaQa0zcNAmw2TSY7wbunJ
 WTl9OgATAyqVCuhWW7AnPcSqkH8lQigSc00wfqJKOD2Us0FqN6UKDCZTyQkdP6hx
 G+3aUkkvGSOxy7u9bVWmrikuJMoiIY/CH/m+GcJJATVibI7t5MhhtBGySKc3PAwc
 58sVe9AnbDvs84efrNP59j2KG2KKqcqjTGAmKyJnG3N50xJGakDIsqfneIRNWpEE
 pOOPaOqR4qnPAS9OSt9A3hqBpWPjQcScd6AuO+J2PE5y23pTnb9PtLBQb5e4VFiv
 N54u8j4bU2CO0SC2isZ3CR68dPHthWsxt4XbjhgktjbpQRQ8L2EDBQ8oE13GOrOw
 P8x4Q0eC5uzkXNyRqzKOsxlZEuc+75aDDd3M2GDw08FG7GI1p/L+NgenwT+9TmFX
 2hOKVrjgyx+fPut1t5DJJubDWXGOK33qvrL7HTCEv1zz7LNbbPwwNHK4lfMAWuJW
 D9wc3Y9Se/P/
 =5MAs
 -----END PGP PUBLIC KEY BLOCK-----
--- a/debian/watch
+++ b/debian/watch
@ -1,2 +0,0 @@
 version=3
 opts=pgpsigurlmangle=s/$/.sig/ http://www.tinc-vpn.org/packages/tinc-(1\.0\.\d+)\.tar\.gz
--- a/10
+++ b/10
@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2013-05-30.07; # UTC
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@ -16,7 +16,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -783,9 +783,9 @@ exit 0
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@ -1,35 +1,55 @@
 ## Process this file with automake to get Makefile.in
 info_TEXINFOS = tinc.texi
 tinc_TEXINFOS = tincinclude.texi
-man_MANS = tincd.8 tinc.conf.5
+man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config.tar.gz
-CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
+CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi sample-config.tar.gz
-texi2html: tinc.texi
+# Use `ginstall' in the definition of man_MANS to avoid
-	$(AM_V_GEN)texi2html -split=chapter $<
+# confusion with the `install' target.  The install rule transforms `ginstall'
 # to install before applying any user-specified name transformations.
 transform = s/ginstall/install/; @program_transform_name@
 # For additional rules usually of interest only to the maintainer,
 # see GNUmakefile and Makefile.maint.
 sample-config.tar.gz: sample-config
 	$(AM_V_GEN)GZIP=$(GZIP_ENV) $(AMTAR) chozf $@ --exclude .svn $<
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
 tinc.8.html: tinc.8
 	$(AM_V_GEN)w3mman2html $? > $@
 tinc-gui.8.html: tinc-gui.8
 	$(AM_V_GEN)w3mman2html $? > $@
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
 	-e s,'@VERSION\@',"$(VERSION)",g \
 	-e s,'@sysconfdir\@',"$(sysconfdir)",g \
 	-e s,'@runstatedir\@',"$(runstatedir)",g \
 	-e s,'@localstatedir\@',"$(localstatedir)",g
-tincd.8: $(srcdir)/tincd.8.in
+tincd.8: tincd.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
-tinc.conf.5: $(srcdir)/tinc.conf.5.in
+tinc.8: tinc.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
-tincinclude.texi: $(srcdir)/tincinclude.texi.in
+tinc-gui.8: tinc-gui.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincinclude.texi.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
 tinc.conf.5: tinc.conf.5.in
 	$(AM_V_GEN)$(substitute) $? > $@
 tincinclude.texi: tincinclude.texi.in
 	$(AM_V_GEN)$(substitute) $? > $@
 tinc.texi: tincinclude.texi
--- a/doc/Makefile.in
+++ b/doc/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.2 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
-# Copyright (C) 1994-2020 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -78,7 +78,6 @@ install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
 install_sh_SCRIPT = $(install_sh) -c
 INSTALL_HEADER = $(INSTALL_DATA)
 transform = $(program_transform_name)
 NORMAL_INSTALL = :
 PRE_INSTALL = :
 POST_INSTALL = :
@ -90,13 +89,12 @@ host_triplet = @host@
 subdir = doc
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_append_flag.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
+	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
+	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
-	$(top_srcdir)/configure.ac
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
 	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
@ -197,8 +195,13 @@ man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man_MANS)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-am__DIST_COMMON = $(srcdir)/Makefile.in $(tinc_TEXINFOS) texinfo.tex
+am__DIST_COMMON = $(srcdir)/Makefile.in texinfo.tex
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 # Use `ginstall' in the definition of man_MANS to avoid
 # confusion with the `install' target.  The install rule transforms `ginstall'
 # to install before applying any user-specified name transformations.
 transform = s/ginstall/install/; @program_transform_name@
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
@ -211,6 +214,7 @@ CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@ -228,8 +232,10 @@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@ -240,6 +246,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 READLINE_LIBS = @READLINE_LIBS@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@ -297,15 +304,13 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 info_TEXINFOS = tinc.texi
-tinc_TEXINFOS = tincinclude.texi
+man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
-man_MANS = tincd.8 tinc.conf.5
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config.tar.gz
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
+CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi sample-config.tar.gz
 CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
 	-e s,'@VERSION\@',"$(VERSION)",g \
 	-e s,'@sysconfdir\@',"$(sysconfdir)",g \
 	-e s,'@runstatedir\@',"$(runstatedir)",g \
 	-e s,'@localstatedir\@',"$(localstatedir)",g
 all: all-am
@ -329,8 +334,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
 	esac;
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@ -385,10 +390,10 @@ $(am__aclocal_m4_deps):
 	else \
 	  rm -rf $(@:.html=.htp); exit 1; \
 	fi
-$(srcdir)/tinc.info: tinc.texi $(tinc_TEXINFOS)
+$(srcdir)/tinc.info: tinc.texi 
-tinc.dvi: tinc.texi $(tinc_TEXINFOS)
+tinc.dvi: tinc.texi 
-tinc.pdf: tinc.texi $(tinc_TEXINFOS)
+tinc.pdf: tinc.texi 
-tinc.html: tinc.texi $(tinc_TEXINFOS)
+tinc.html: tinc.texi 
 .dvi.ps:
 	$(AM_V_DVIPS)TEXINPUTS="$(am__TEXINFO_TEX_DIR)$(PATH_SEPARATOR)$$TEXINPUTS" \
 	$(DVIPS) $(AM_V_texinfo) -o $@ $<
@ -575,10 +580,7 @@ ctags CTAGS:
 cscope cscopelist:
-distdir: $(BUILT_SOURCES)
+distdir: $(DISTFILES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@ -830,23 +832,40 @@ uninstall-man: uninstall-man5 uninstall-man8
 .PRECIOUS: Makefile
-texi2html: tinc.texi
+# For additional rules usually of interest only to the maintainer,
-	$(AM_V_GEN)texi2html -split=chapter $<
+# see GNUmakefile and Makefile.maint.
 sample-config.tar.gz: sample-config
 	$(AM_V_GEN)GZIP=$(GZIP_ENV) $(AMTAR) chozf $@ --exclude .svn $<
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
 tinc.8.html: tinc.8
 	$(AM_V_GEN)w3mman2html $? > $@
 tinc-gui.8.html: tinc-gui.8
 	$(AM_V_GEN)w3mman2html $? > $@
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
-tincd.8: $(srcdir)/tincd.8.in
+tincd.8: tincd.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
-tinc.conf.5: $(srcdir)/tinc.conf.5.in
+tinc.8: tinc.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
-tincinclude.texi: $(srcdir)/tincinclude.texi.in
+tinc-gui.8: tinc-gui.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincinclude.texi.in > $@
+	$(AM_V_GEN)$(substitute) $? > $@
 tinc.conf.5: tinc.conf.5.in
 	$(AM_V_GEN)$(substitute) $? > $@
 tincinclude.texi: tincinclude.texi.in
 	$(AM_V_GEN)$(substitute) $? > $@
 tinc.texi: tincinclude.texi
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
--- a/doc/sample-config.tar.gz
+++ b/doc/sample-config.tar.gz
--- a/doc/sample-config/hosts/alpha
+++ b/doc/sample-config/hosts/alpha
@ -1,15 +0,0 @@
 # Sample host configuration file
 # The real IP address of this tinc host. Can be used by other tinc hosts.
 Address = 123.234.35.67
 # Portnumber for incoming connections. Default is 655.
 Port = 655
 # Subnet on the virtual private network that is local for this host.
 Subnet = 192.168.1.0/24
 # The public key generated by `tincd -n example -K' is stored here
 -----BEGIN RSA PUBLIC KEY-----
 ...
 -----END RSA PUBLIC KEY-----
--- a/doc/sample-config/hosts/beta
+++ b/doc/sample-config/hosts/beta
@ -1,16 +0,0 @@
 # Sample host configuration file
 # This file was generated by host beta.
 # The real IP address of this tinc host. Can be used by other tinc hosts.
 Address = 123.45.67.189
 # Portnumber for incoming connections. Default is 655.
 Port = 6500
 # Subnet on the virtual private network that is local for this host.
 Subnet = 192.168.2.0/24
 # The public key generated by `tincd -n example -K' is stored here
 -----BEGIN RSA PUBLIC KEY-----
 ...
 -----END RSA PUBLIC KEY-----
--- a/doc/sample-config/rsa_key.priv
+++ b/doc/sample-config/rsa_key.priv
@ -1 +0,0 @@
 # Generate this file with `tincd -n example -K`
--- a/doc/sample-config/tinc-down
+++ b/doc/sample-config/tinc-down
@ -1,4 +0,0 @@
 #!/bin/sh
 # This file closes down the tap device.
 ifconfig $INTERFACE down
--- a/doc/sample-config/tinc-up
+++ b/doc/sample-config/tinc-up
@ -1,11 +0,0 @@
 #!/bin/sh
 # This file sets up the tap device.
 # It gives you the freedom to do anything you want with it.
 # Use the correct name for the tap device:
 # The environment variable $INTERFACE is set to the right name
 # on most platforms, but if it doesn't work try to set it manually.
 # Give it the right ip and netmask. Remember, the subnet of the
 # tap device must be larger than that of the individual Subnets
 # as defined in the host configuration file!
 ifconfig $INTERFACE 192.168.1.1 netmask 255.255.0.0
--- a/doc/sample-config/tinc.conf
+++ b/doc/sample-config/tinc.conf
@ -1,22 +0,0 @@
 # Sample tinc configuration file
 # This is a comment.
 # Spaces and tabs are eliminated.
 # The = sign isn't strictly necessary any longer, though you may want
 # to leave it in as it improves readability :)
 # Variable names are treated case insensitive.
 # The name of this tinc host. Required.
 Name = alpha
 # The internet host to connect with.
 # Comment these out to make yourself a listen-only connection
 # You must use the name of another tinc host.
 # May be used multiple times for redundance.
 ConnectTo = beta
 # The tap device tinc will use.
 # /dev/tap0 for ethertap, FreeBSD or OpenBSD
 # /dev/tun0 for Solaris
 # /dev/net/tun for Linux tun/tap
 Device = /dev/net/tun
--- a/doc/texinfo.tex
+++ b/doc/texinfo.tex
--- a/doc/tinc-gui.8.in
+++ b/doc/tinc-gui.8.in
@ -0,0 +1,57 @@
 .Dd 2011-06-26
 .Dt TINC-GUI 8
 .\" Manual page created by:
 .\" Guus Sliepen <guus@tinc-vpn.org>
 .Sh NAME
 .Nm tinc-gui
 .Nd tinc GUI
 .Sh SYNOPSIS
 .Nm
 .Op Fl n
 .Op Fl -net Ns = Ns Ar NETNAME
 .Op Fl -pidfile Ns = Ns Ar FILENAME
 .Op Fl -help
 .Sh DESCRIPTION
 This is a Python/wxWidgets based graphical user interface for tinc, a secure virtual private network (VPN) project.
 .Nm
 communicates with
 .Xr tincd 8
 to alter and inspect the running VPN's state.
 It can show the current settings, the list of connections, nodes, subnets, and edges.
 For now, the debug level can be changed from the GUI, and by right-clicking on a node in the list of connections,
 a pop-up menu will appear that allows one to disconnect that node.
 .Sh OPTIONS
 .Bl -tag -width indent
 .It Fl n, -net Ns = Ns Ar NETNAME
 Communicate with tincd(8) connected with
 .Ar NETNAME .
 .It Fl -pidfile Ns = Ns Ar FILENAME
 Use the cookie from
 .Ar FILENAME
 to authenticate with a running tinc daemon.
 If unspecified, the default is
 .Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
 .It Fl -help
 Display short list of options.
 .El
 .Sh BUGS
 The GUI is not finished yet, the final version will have much more functionality.
 If you find any bugs, report them to tinc@tinc-vpn.org.
 .Sh SEE ALSO
 .Xr tincd 8 ,
 .Pa http://www.tinc-vpn.org/ .
 .Pp
 The full documentation for tinc is maintained as a Texinfo manual.
 If the info and tinc programs are properly installed at your site,
 the command
 .Ic info tinc
 should give you access to the complete manual.
 .Pp
 tinc comes with ABSOLUTELY NO WARRANTY.
 This is free software, and you are welcome to redistribute it under certain conditions;
 see the file COPYING for details.
 .Sh AUTHORS
 .An "Ivo Timmermans"
 .An "Guus Sliepen" Aq guus@tinc-vpn.org
 .Pp
 And thanks to many others for their contributions to tinc!
--- a/doc/tinc.8.in
+++ b/doc/tinc.8.in
@ -0,0 +1,342 @@
 .Dd 2014-01-16
 .Dt TINCCTL 8
 .\" Manual page created by:
 .\" Scott Lamb
 .Sh NAME
 .Nm tinc
 .Nd tinc VPN control
 .Sh SYNOPSIS
 .Nm
 .Op Fl cn
 .Op Fl -config Ns = Ns Ar DIR
 .Op Fl -net Ns = Ns Ar NETNAME
 .Op Fl -pidfile Ns = Ns Ar FILENAME
 .Op Fl -force
 .Op Fl -help
 .Op Fl -version
 .Op Ar COMMAND
 .Sh DESCRIPTION
 This is the control program of tinc, a secure virtual private network (VPN)
 project.
 .Nm
 can start and stop
 .Xr tincd 8 ,
 and can to alter and inspect the state of a running VPN.
 It can also be used to change the configuration,
 or to import or export host configuration files from other nodes.
 If
 .Nm
 is started with a
 .Ar COMMAND ,
 this command is immediately executed, after which
 .Nm
 exits.
 If no
 .Ar COMMAND
 is given,
 .Nm
 will act as a shell;
 it will display a prompt, and commands can be entered on the prompt.
 If
 .Nm
 is compiled with libreadline, history and command completion are available on the prompt.
 One can also pipe a script containing commands through
 .Nm .
 In that case, lines starting with a # symbol will be ignored.
 .Sh OPTIONS
 .Bl -tag -width indent
 .It Fl n, -net Ns = Ns Ar NETNAME
 Communicate with tincd(8) connected with
 .Ar NETNAME .
 .It Fl -pidfile Ns = Ns Ar FILENAME
 Use the cookie from
 .Ar FILENAME
 to authenticate with a running tinc daemon.
 If unspecified, the default is
 .Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
 .It Fl -force
 Force some commands to work despite warnings.
 .It Fl -help
 Display short list of options.
 .It Fl -version
 Output version information and exit.
 .El
 .Sh ENVIRONMENT VARIABLES
 .Bl -tag -width indent
 .It Ev NETNAME
 If no netname is specified on the command line with the
 .Fl n
 option, the value of this environment variable is used.
 .El
 .Sh COMMANDS
 .Bl -tag -width indent
 .It init Op Ar name
 Create initial configuration files and RSA and Ed25519 keypairs with default length.
 If no
 .Ar name
 for this node is given, it will be asked for.
 .It get Ar variable
 Print the current value of configuration variable
 .Ar variable .
 If more than one variable with the same name exists,
 the value of each of them will be printed on a separate line.
 .It set Ar variable Ar value
 Set configuration variable
 .Ar variable
 to the given
 .Ar value .
 All previously existing configuration variables with the same name are removed.
 To set a variable for a specific host, use the notation
 .Ar host Ns Li . Ns Ar variable .
 .It add Ar variable Ar value
 As above, but without removing any previously existing configuration variables.
 If the variable already exists with the given value, nothing happens.
 .It del Ar variable Op Ar value
 Remove configuration variables with the same name and
 .Ar value .
 If no
 .Ar value
 is given, all configuration variables with the same name will be removed.
 .It edit Ar filename
 Start an editor for the given configuration file.
 You do not need to specify the full path to the file.
 .It export
 Export the host configuration file of the local node to standard output.
 .It export-all
 Export all host configuration files to standard output.
 .It import
 Import host configuration data generated by the
 .Nm
 export command from standard input.
 Already existing host configuration files are not overwritten unless the option
 .Fl -force
 is used.
 .It exchange
 The same as export followed by import.
 .It exchange-all
 The same as export-all followed by import.
 .It invite Ar name
 Prepares an invitation for a new node with the given
 .Ar name ,
 and prints a short invitation URL that can be used with the join command.
 .It join Op Ar URL
 Join an existing VPN using an invitation URL created using the invite command.
 If no
 .Ar URL
 is given, it will be read from standard input.
 .It start Op tincd options
 Start
 .Xr tincd 8 ,
 optionally with the given extra options.
 .It stop
 Stop
 .Xr tincd 8 .
 .It restart Op tincd options
 Restart
 .Xr tincd 8 ,
 optionally with the given extra options.
 .It reload
 Partially rereads configuration files. Connections to hosts whose host
 config files are removed are closed. New outgoing connections specified
 in
 .Xr tinc.conf 5
 will be made.
 .It pid
 Shows the PID of the currently running
 .Xr tincd 8 .
 .It generate-keys Op bits
 Generate both RSA and Ed25519 keypairs (see below) and exit.
 .It generate-ed25519-keys
 Generate public/private Ed25519 keypair and exit.
 .It generate-rsa-keys Op bits
 Generate public/private RSA keypair and exit.
 If
 .Ar bits
 is omitted, the default length will be 2048 bits.
 When saving keys to existing files, tinc will not delete the old keys;
 you have to remove them manually.
 .It dump [reachable] nodes
 Dump a list of all known nodes in the VPN.
 If the keyword reachable is used, only lists reachable nodes.
 .It dump edges
 Dump a list of all known connections in the VPN.
 .It dump subnets
 Dump a list of all known subnets in the VPN.
 .It dump connections
 Dump a list of all meta connections with ourself.
 .It dump graph | digraph
 Dump a graph of the VPN in
 .Xr dotty 1
 format.
 Nodes are colored according to their reachability:
 red nodes are unreachable, orange nodes are indirectly reachable, green nodes are directly reachable.
 Black nodes are either directly or indirectly reachable, but direct reachability has not been tried yet.
 .It dump invitations
 Dump a list of outstanding invitations.
 The filename of the invitation, as well as the name of the node that is being invited is shown for each invitation.
 .It info Ar node | subnet | address
 Show information about a particular node, subnet or address.
 If an address is given, any matching subnet will be shown.
 .It purge
 Purges all information remembered about unreachable nodes.
 .It debug Ar N
 Sets debug level to
 .Ar N .
 .It log Op Ar N
 Capture log messages from a running tinc daemon.
 An optional debug level can be given that will be applied only for log messages sent to
 .Nm tinc .
 .It retry
 Forces
 .Xr tincd 8
 to try to connect to all uplinks immediately.
 Usually
 .Xr tincd 8
 attempts to do this itself,
 but increases the time it waits between the attempts each time it failed,
 and if
 .Xr tincd 8
 didn't succeed to connect to an uplink the first time after it started,
 it defaults to the maximum time of 15 minutes.
 .It disconnect Ar NODE
 Closes the meta connection with the given
 .Ar NODE .
 .It top
 If
 .Nm
 is compiled with libcurses support, this will display live traffic statistics
 for all the known nodes, similar to the UNIX
 .Xr top 1
 command.
 See below for more information.
 .It pcap
 Dump VPN traffic going through the local tinc node in
 .Xr pcap-savefile 5
 format to standard output,
 from where it can be redirected to a file or piped through a program that can parse it directly,
 such as
 .Xr tcpdump 8 .
 .It network Op Ar netname
 If
 .Ar netname
 is given, switch to that network.
 Otherwise, display a list of all networks for which configuration files exist.
 .It fsck
 This will check the configuration files for possible problems,
 such as unsafe file permissions, missing executable bit on script,
 unknown and obsolete configuration variables, wrong public and/or private keys, and so on.
 .Pp
 When problems are found, this will be printed on a line with WARNING or ERROR in front of it.
 Most problems must be corrected by the user itself, however in some cases (like file permissions and missing public keys),
 tinc will ask if it should fix the problem.
 .It sign Op Ar filename
 Sign a file with the local node's private key.
 If no
 .Ar filename
 is given, the file is read from standard input.
 The signed file is written to standard output.
 .It verify Ar name Op Ar filename
 Check the signature of a file against a node's public key.
 The
 .Ar name
 of the node must be given,
 or can be
 .Li .
 to check against the local node's public key, or
 .Li *
 to allow a signature from any node whose public key is known.
 If no
 .Ar filename
 is given, the file is read from standard input.
 If the verification is succesful,
 a copy of the input with the signature removed is written to standard output,
 and the exit code will be zero.
 If the verification failed,
 nothing will be written to standard output, and the exit code will be non-zero.
 .El
 .Sh EXAMPLES
 Examples of some commands:
 .Bd -literal -offset indent
 tinc -n vpn dump graph | circo -Txlib
 tinc -n vpn pcap | tcpdump -r -
 tinc -n vpn top
 .Pp
 .Ed
 Examples of changing the configuration using
 .Nm :
 .Bd -literal -offset indent
 tinc -n vpn init foo
 tinc -n vpn add Subnet 192.168.1.0/24
 tinc -n vpn add bar.Address bar.example.com
 tinc -n vpn add ConnectTo bar
 tinc -n vpn export | gpg --clearsign | mail -s "My config" vpnmaster@example.com
 .Ed
 .Sh TOP
 The top command connects to a running tinc daemon and repeatedly queries its per-node traffic counters.
 It displays a list of all the known nodes in the left-most column,
 and the amount of bytes and packets read from and sent to each node in the other columns.
 By default, the information is updated every second.
 The behaviour of the top command can be changed using the following keys:
 .Bl -tag
 .It Ic s
 Change the interval between updates.
 After pressing the
 .Ic s
 key, enter the desired interval in seconds, followed by enter.
 Fractional seconds are honored.
 Intervals lower than 0.1 seconds are not allowed.
 .It Ic c
 Toggle between displaying current traffic rates (in packets and bytes per second)
 and cumulative traffic (total packets and bytes since the tinc daemon started).
 .It Ic n
 Sort the list of nodes by name.
 .It Ic i
 Sort the list of nodes by incoming amount of bytes.
 .It Ic I
 Sort the list of nodes by incoming amount of packets.
 .It Ic o
 Sort the list of nodes by outgoing amount of bytes.
 .It Ic O
 Sort the list of nodes by outgoing amount of packets.
 .It Ic t
 Sort the list of nodes by sum of incoming and outgoing amount of bytes.
 .It Ic T
 Sort the list of nodes by sum of incoming and outgoing amount of packets.
 .It Ic b
 Show amount of traffic in bytes.
 .It Ic k
 Show amount of traffic in kilobytes.
 .It Ic M
 Show amount of traffic in megabytes.
 .It Ic G
 Show amount of traffic in gigabytes.
 .It Ic q
 Quit.
 .El
 .Sh BUGS
 If you find any bugs, report them to tinc@tinc-vpn.org.
 .Sh SEE ALSO
 .Xr tincd 8 ,
 .Xr tinc.conf 5 ,
 .Xr dotty 1 ,
 .Xr pcap-savefile 5 ,
 .Xr tcpdump 8 ,
 .Xr top 1 ,
 .Pa http://www.tinc-vpn.org/ ,
 .Pa http://www.cabal.org/ .
 .Pp
 The full documentation for tinc is maintained as a Texinfo manual.
 If the info and tinc programs are properly installed at your site,
 the command
 .Ic info tinc
 should give you access to the complete manual.
 .Pp
 tinc comes with ABSOLUTELY NO WARRANTY.
 This is free software, and you are welcome to redistribute it under certain conditions;
 see the file COPYING for details.
 .Sh AUTHORS
 .An "Ivo Timmermans"
 .An "Guus Sliepen" Aq guus@tinc-vpn.org
 .Pp
 And thanks to many others for their contributions to tinc!
--- a/doc/tinc.conf.5.in
+++ b/doc/tinc.conf.5.in
@ -1,4 +1,4 @@
-.Dd 2016-10-29
+.Dd 2016-04-11
 .Dt TINC.CONF 5
 .\" Manual page created by:
 .\" Ivo Timmermans
@ -11,20 +11,12 @@ The files in the
 .Pa @sysconfdir@/tinc/
 directory contain runtime and security information for the tinc daemon.
 .Sh NETWORKS
-It is perfectly ok for you to run more than one tinc daemon.
+To distinguish multiple instances of tinc running on one computer,
-However, in its default form,
+you can use the
 you will soon notice that you can't use two different configuration files without the
 .Fl c
 option.
 .Pp
 We have thought of another way of dealing with this: network names.
 This means that you call
 .Nm
 with the
 .Fl n
-option, which will assign a name to this daemon.
+option to assign a network name to each tinc daemon.
 .Pp
-The effect of this is that the daemon will set its configuration root to
+The effect of this option is that the daemon will set its configuration root to
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa / ,
 where 
 .Ar NETNAME
@ -32,13 +24,14 @@ is your argument to the
 .Fl n
 option.
 You'll notice that messages appear in syslog as coming from
-.Nm tincd. Ns Ar NETNAME .
+.Nm tincd. Ns Ar NETNAME ,
 and on Linux, unless specified otherwise, the name of the virtual network interface will be the same as the network name.
 .Pp
-However, it is not strictly necessary that you call tinc with the
+It is recommended that you use network names even if you run only one instance of tinc.
 However, you can choose not to use the
 .Fl n
 option.
-In this case, the network name would just be empty,
+In this case, the network name would just be empty, and
 and it will be used as such.
 .Nm tinc
 now looks for files in
 .Pa @sysconfdir@/tinc/ ,
@ -48,11 +41,6 @@ the configuration file should be
 .Pa @sysconfdir@/tinc/tinc.conf ,
 and the host configuration files are now expected to be in
 .Pa @sysconfdir@/tinc/hosts/ .
 .Pp
 But it is highly recommended that you use this feature of
 .Nm tinc ,
 because it will be so much clearer whom your daemon talks to.
 Hence, we will assume that you use it.
 .Sh NAMES
 Each tinc daemon must have a name that is unique in the network which it will be part of.
 The name will be used by other tinc daemons for identification.
@ -63,24 +51,34 @@ file.
 To make things easy,
 choose something that will give unique and easy to remember names to your tinc daemon(s).
 You could try things like hostnames, owner surnames or location names.
 However, you are only allowed to use alphanumerical characters (a-z, A-Z, and 0-9) and underscores (_) in the name.
 .Sh INITIAL CONFIGURATION
 If you have not configured tinc yet, you can easily create a basic configuration using the following command:
 .Bd -literal -offset indent
 .Nm tinc Fl n Ar NETNAME Li init Ar NAME
 .Ed
 .Pp
 You can further change the configuration as needed either by manually editing the configuration files,
 or by using
 .Xr tinc 8 .
 .Sh PUBLIC/PRIVATE KEYS
-You should use 
+The
-.Ic tincd -K
+.Nm tinc Li init
-to generate public/private keypairs.
+command will have generated both RSA and Ed25519 public/private keypairs.
-It will generate two keys.
+The private keys should be stored in files named
-The private key should be stored in a separate file
+.Pa rsa_key.priv
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv
+and
-\-\- where 
+.Pa ed25519_key.priv
-.Ar NETNAME
+in the directory
-stands for the network (see 
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /
-.Sx NETWORKS )
+The public keys should be stored in the host configuration file
-above.
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME .
-The public key should be stored in the host configuration file
+The RSA keys are used for backwards compatibility with tinc version 1.0.
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME
+If you are upgrading from version 1.0 to 1.1, you can keep the old configuration files,
-\-\- where
+but you will need to create Ed25519 keys using the following command:
-.Va NAME
+.Bd -literal -offset indent
-stands for the name of the local tinc daemon (see
+.Nm tinc Fl n Ar NETNAME Li generate-ed25519-keys
-.Sx NAMES ) .
+.Ed
 .Sh SERVER CONFIGURATION
 The server configuration of the daemon is done in the file
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc.conf .
@ -103,6 +101,10 @@ Although all configuration options for the local host listed in this document ca
 it is recommended to put host specific configuration options in the host configuration file,
 as this makes it easy to exchange with other nodes.
 .Pp
 You can edit the config file manually, but it is recommended that you use
 .Xr tinc 8
 to change configuration variables for you.
 .Pp
 Here are all valid variables, listed in alphabetical order.
 The default value is given between parentheses.
 .Bl -tag -width indent
@ -112,26 +114,24 @@ If
 .Qq any
 is selected, then depending on the operating system both IPv4 and IPv6 or just
 IPv6 listening sockets will be created.
-.It Va BindToAddress Li = Ar address Oo Ar port Oc Bq experimental
+.It Va AutoConnect Li = yes | no Po no Pc Bq experimental
-If your computer has more than one IPv4 or IPv6 address,
+If set to yes,
 .Nm tinc
-will by default listen on all of them for incoming connections.
+will automatically set up meta connections to other nodes,
-Multiple
+without requiring
 .Va ConnectTo
 variables.
 .Pp
 Note: it is not possible to connect to nodes using zero (system-assigned) ports in this way.
 .It Va BindToAddress Li = Ar address Op Ar port
 This is the same as
 .Va ListenAddress ,
 however the address given with the
 .Va BindToAddress
-variables may be specified,
+option will also be used for outgoing connections. This is useful if your
-in which case listening sockets for each specified address are made.
+computer has more than one IPv4 or IPv6 address, and you want 
-.Pp
+.Nm tinc
-If no
+to only use a specific one for outgoing packets.
 .Ar port
 is specified, the socket will be bound to the port specified by the
 .Va Port
 option, or to port 655 if neither is given.
 To only bind to a specific port but not to a specific address, use
 .Li *
 for the
 .Ar address .
 .Pp
 This option may not work on all platforms.
 .It Va BindToInterface Li = Ar interface Bq experimental
 If your computer has more than one network interface,
 .Nm tinc
@ -157,6 +157,13 @@ Broadcast packets are sent directly to all nodes that can be reached directly.
 Broadcast packets received from other nodes are never forwarded.
 If the IndirectData option is also set, broadcast packets will only be sent to nodes which we have a meta connection to.
 .El
 .It Va BroadcastSubnet Li = Ar address Ns Op Li / Ns Ar prefixlength
 Declares a broadcast subnet. Any packet with a destination address falling into such a subnet will be routed as a broadcast (provided all nodes have it declared).
 This is most useful to declare subnet broadcast addresses (e.g. 10.42.255.255), otherwise
 .Nm tinc
 won't know what to do with them.
 .Pp
 Note that global broadcast addresses (MAC ff:ff:ff:ff:ff:ff, IPv4 255.255.255.255), as well as multicast space (IPv4 224.0.0.0/4, IPv6 ff00::/8) are always considered broadcast addresses and don't need to be declared.
 .It Va ConnectTo Li = Ar name
 Specifies which other tinc daemon to connect to on startup.
 Multiple
@ -169,7 +176,9 @@ The names should be known to this tinc daemon
 line).
 .Pp
 If you don't specify a host with
-.Va ConnectTo ,
+.Va ConnectTo
 and don't enable
 .Va AutoConnect ,
 .Nm tinc
 won't try to connect to other daemons at all,
 and will instead just listen for incoming connections.
@ -193,6 +202,13 @@ instead of
 .Va Device .
 The info pages of the tinc package contain more information
 about configuring the virtual network device.
 .It Va DeviceStandby Li = yes | no Po no Pc
 When disabled,
 .Nm tinc
 calls tinc-up on startup, and tinc-down on shutdown. When enabled,
 .Nm tinc
 will only call tinc-up when at least one node is reachable, and will call tinc-down as soon as no nodes are reachable.
 On Windows, this also determines when the virtual network interface "cable" is "plugged".
 .It Va DeviceType Li = Ar type Pq platform dependent
 The type of the virtual network device.
 Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used.
@ -222,7 +238,7 @@ Also note that this can cause decrypted VPN packets to be sent out on a real net
 Create a UNIX socket with the filename specified by
 .Va Device ,
 or
-.Pa @runstatedir@/ Ns Ar NETNAME Ns Pa .umlsocket
+.Pa @localstatedir@/run/ Ns Ar NETNAME Ns Pa .umlsocket
 if not specified.
 .Nm tinc
 will wait for a User Mode Linux instance to connect to this socket.
@ -231,7 +247,7 @@ Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch,
 using the UNIX socket specified by
 .Va Device ,
 or
-.Pa @runstatedir@/vde.ctl
+.Pa @localstatedir@/run/vde.ctl
 if not specified.
 .El
 Also, in case tinc does not seem to correctly interpret packets received from the virtual network device,
@ -264,6 +280,17 @@ When this option is enabled, packets that cannot be sent directly to the destina
 but which would have to be forwarded by an intermediate node, are dropped instead.
 When combined with the IndirectData option,
 packets for nodes for which we do not have a meta connection with are also dropped.
 .It Va Ed25519PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /ed25519_key.priv Pc
 The file in which the private Ed25519 key of this tinc daemon resides.
 This is only used if
 .Va ExperimentalProtocol
 is enabled.
 .It Va ExperimentalProtocol Li = yes | no Pq yes
 When this option is enabled, the SPTPS protocol will be used when connecting to nodes that also support it.
 Ephemeral ECDH will be used for key exchanges,
 and Ed25519 will be used instead of RSA for authentication.
 When enabled, an Ed25519 key must have been generated before with
 .Nm tinc generate-ed25519-keys .
 .It Va Forwarding Li = off | internal | kernel Po internal Pc Bq experimental
 This option selects the way indirect packets are forwarded.
 .Bl -tag -width indent
@ -279,18 +306,6 @@ Incoming packets are always sent to the TUN/TAP device, even if the packets are
 This is less efficient, but allows the kernel to apply its routing and firewall rules on them,
 and can also help debugging.
 .El
 .It Va GraphDumpFile Li = Ar filename Bq experimental
 If this option is present,
 .Nm tinc
 will dump the current network graph to the file
 .Ar filename
 every minute, unless there were no changes to the graph.
 The file is in a format that can be read by graphviz tools.
 If
 .Ar filename
 starts with a pipe symbol |,
 then the rest of the filename is interpreted as a shell command
 that is executed, the graph is then sent to stdin.
 .It Va Hostnames Li = yes | no Pq no
 This option selects whether IP addresses (both real and on the VPN) should
 be resolved. Since DNS lookups are blocking, it might affect tinc's
@ -312,7 +327,34 @@ this variable is almost always already correctly set.
 This option controls the period the encryption keys used to encrypt the data are valid.
 It is common practice to change keys at regular intervals to make it even harder for crackers,
 even though it is thought to be nearly impossible to crack a single key.
-.It Va LocalDiscovery Li = yes | no Po no Pc Bq experimental
+.It Va ListenAddress Li = Ar address Op Ar port
 If your computer has more than one IPv4 or IPv6 address,
 .Nm tinc
 will by default listen on all of them for incoming connections.
 This option can be used to restrict which addresses tinc listens on.
 Multiple
 .Va ListenAddress
 variables may be specified,
 in which case listening sockets for each specified address are made.
 .Pp
 If no
 .Ar port
 is specified, the socket will listen on the port specified by the
 .Va Port
 option, or to port 655 if neither is given.
 To only listen on a specific port but not on a specific address, use
 .Li *
 for the
 .Ar address .
 .Pp
 If
 .Ar port
 is set to zero, it will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. In this case it is recommended to set
 .Va AddressFamily
 as well, otherwise
 .Nm tinc
 will assign different ports to different address families but other nodes can only know of one.
 .It Va LocalDiscovery Li = yes | no Pq yes
 When enabled,
 .Nm tinc
 will try to detect peers that are on the same local network.
@ -320,14 +362,18 @@ This will allow direct communication using LAN addresses, even if both peers are
 and they only ConnectTo a third node outside the NAT,
 which normally would prevent the peers from learning each other's LAN address.
 .Pp
-Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery.
+Currently, local discovery is implemented by sending some packets to the local address of the node during UDP discovery. This will not work with old nodes that don't transmit their local address.
 This feature may not work in all possible situations.
 .It Va MACExpire Li = Ar seconds Pq 600
 This option controls the amount of time MAC addresses are kept before they are removed.
 This only has effect when
 .Va Mode
 is set to
 .Qq switch .
 .It Va MaxConnectionBurst Li = Ar count Pq 100
 This option controls how many connections tinc accepts in quick succession.
 If there are more connections than the given number in a short time interval,
 tinc will reduce the number of accepted connections to only one per second,
 until the burst has passed.
 .It Va MaxTimeout Li = Ar seconds Pq 900
 This is the maximum delay before trying to reconnect to other tinc daemons.
 .It Va Mode Li = router | switch | hub Pq router
@ -337,7 +383,7 @@ This option selects the way packets are routed to other daemons.
 In this mode
 .Va Subnet
 variables in the host configuration files will be used to form a routing table.
-Only unicast packets of routable protocols (IPv4 and IPv6) are supported in this mode.
+Only packets of routable protocols (IPv4 and IPv6) are supported in this mode.
 .Pp
 This is the default mode, and unless you really know you need another mode, don't change it.
 .It switch
@ -355,7 +401,8 @@ while no routing table is managed.
 .It Va Name Li = Ar name Bq required
 This is the name which identifies this tinc daemon.
 It must be unique for the virtual private network this daemon will connect to.
-The Name may only consist of alphanumeric and underscore characters.
+.Va Name
 may only consist of alphanumeric and underscore characters (a-z, A-Z, 0-9 and _), and is case sensitive.
 If 
 .Va Name
 starts with a
@ -385,7 +432,9 @@ It will allow this tinc daemon to authenticate itself to other daemons.
 .It Va PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv Pc
 The file in which the private RSA key of this tinc daemon resides.
 .It Va ProcessPriority Li = low | normal | high
-When this option is used the priority of the tincd process will be adjusted.
+When this option is used the priority of the 
 .Nm tincd
 process will be adjusted.
 Increasing the priority may help to reduce latency and packet loss on the VPN.
 .It Va Proxy Li = socks4 | socks5 | http | exec Ar ... Bq experimental
 Use a proxy when making outgoing connections.
@ -419,13 +468,13 @@ and
 .Ev REMOTEPORT
 are available.
 .El
-.It Va ReplayWindow Li = Ar bytes Pq 16
+.It Va ReplayWindow Li = Ar bytes Pq 32
 This is the size of the replay tracking window for each remote node, in bytes.
 The window is a bitfield which tracks 1 packet per bit, so for example
-the default setting of 16 will track up to 128 packets in the window.  In high
+the default setting of 32 will track up to 256 packets in the window. In high
 bandwidth scenarios, setting this to a higher value can reduce packet loss from
 the interaction of replay tracking with underlying real packet loss and/or
-reordering.  Setting this to zero will disable replay tracking completely and
+reordering. Setting this to zero will disable replay tracking completely and
 pass all traffic, but leaves tinc vulnerable to replay-based attacks on your
 traffic.
 .It Va StrictSubnets Li = yes | no Po no Pc Bq experimental
@ -440,12 +489,42 @@ and will only allow connections with nodes for which host config files are prese
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 directory.
 Setting this options also implicitly sets StrictSubnets.
-.It Va UDPRcvBuf Li = Ar bytes Pq OS default
+.It Va UDPDiscovery Li = yes | no Po yes Pc
 When this option is enabled tinc will try to establish UDP connectivity to nodes,
 using TCP while it determines if a node is reachable over UDP. If it is disabled,
 tinc always assumes a node is reachable over UDP.
 Note that tinc will never use UDP with nodes that have
 .Va TCPOnly
 enabled.
 .It Va UDPDiscoveryKeepaliveInterval Li = Ar seconds Pq 9
 The minimum amount of time between sending UDP ping datagrams to check UDP connectivity once it has been established.
 Note that these pings are large, since they are used to verify link MTU as well.
 .It Va UDPDiscoveryInterval Li = Ar seconds Pq 2
 The minimum amount of time between sending UDP ping datagrams to try to establish UDP connectivity.
 .It Va UDPDiscoveryTimeout Li = Ar seconds Pq 30
 If tinc doesn't receive any UDP ping replies over the specified interval,
 it will assume UDP communication is broken and will fall back to TCP.
 .It Va UDPInfoInterval Li = Ar seconds Pq 5
 The minimum amount of time between sending periodic updates about UDP addresses, which are mostly useful for UDP hole punching.
 .It Va UDPRcvBuf Li = Ar bytes Pq 1048576
 Sets the socket receive buffer size for the UDP socket, in bytes.
-If unset, the default buffer size will be used by the operating system.
+If set to zero, the default buffer size will be used by the operating system.
-.It Va UDPSndBuf Li = Ar bytes Pq OS default
+Note: this setting can have a significant impact on performance, especially raw throughput.
 .It Va UDPSndBuf Li = Ar bytes Pq 1048576
 Sets the socket send buffer size for the UDP socket, in bytes.
-If unset, the default buffer size will be used by the operating system.
+If set to zero, the default buffer size will be used by the operating system.
 Note: this setting can have a significant impact on performance, especially raw throughput.
 .It Va UPnP Li = yes | udponly | no Po no Pc
 If this option is enabled then tinc will search for UPnP-IGD devices on the local network.
 It will then create and maintain port mappings for tinc's listening TCP and UDP ports.
 If set to "udponly", tinc will only create a mapping for its UDP (data) port, not for its TCP (metaconnection) port.
 Note that tinc must have been built with miniupnpc support for this feature to be available.
 Furthermore, be advised that enabling this can have security implications, because the miniupnpc library that
 tinc uses might not be well-hardened with regard to malicious UPnP replies.
 .It Va UPnPDiscoverWait Li = Ar seconds Pq 5
 The amount of time to wait for replies when probing the local network for UPnP devices.
 .It Va UPnPRefreshPeriod Li = Ar seconds Pq 60
 How often tinc will re-add the port mapping, in case it gets reset on the UPnP device. This also controls the duration of the port mapping itself, which will be set to twice that duration.
 .El
 .Sh HOST CONFIGURATION FILES
 The host configuration files contain all information needed
@ -468,13 +547,15 @@ Multiple
 .Va Address
 variables can be specified, in which case each address will be tried until a working
 connection has been established.
-.It Va Cipher Li = Ar cipher Pq aes-256-cbc
+.It Va Cipher Li = Ar cipher Pq blowfish
 The symmetric cipher algorithm used to encrypt UDP packets.
 Any cipher supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet encryption.
 It is best to use only those ciphers which support CBC mode.
 This option has no effect for connections between nodes using
 .Va ExperimentalProtocol .
 .It Va ClampMSS Li = yes | no Pq yes
 This option specifies whether tinc should clamp the maximum segment size (MSS)
 of TCP packets to the path MTU. This helps in situations where ICMP
@ -483,12 +564,14 @@ Fragmentation Needed or Packet too Big messages are dropped by firewalls.
 This option sets the level of compression used for UDP packets.
 Possible values are 0 (off), 1 (fast zlib) and any integer up to 9 (best zlib),
 10 (fast lzo) and 11 (best lzo).
-.It Va Digest Li = Ar digest Pq sha256
+.It Va Digest Li = Ar digest Pq sha1
 The digest algorithm used to authenticate UDP packets.
 Any digest supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet authentication.
 This option has no effect for connections between nodes using
 .Va ExperimentalProtocol .
 .It Va IndirectData Li = yes | no Pq no
 When set to yes, only nodes which already have a meta connection to you
 will try to establish direct communication with you.
@ -498,16 +581,28 @@ The length of the message authentication code used to authenticate UDP packets.
 Can be anything from
 .Qq 0
 up to the length of the digest produced by the digest algorithm.
 This option has no effect for connections between nodes using
 .Va ExperimentalProtocol .
 .It Va PMTU Li = Ar mtu Po 1514 Pc
 This option controls the initial path MTU to this node.
 .It Va PMTUDiscovery Li = yes | no Po yes Pc
 When this option is enabled, tinc will try to discover the path MTU to this node.
 After the path MTU has been discovered, it will be enforced on the VPN.
 .It Va MTUInfoInterval Li = Ar seconds Pq 5
 The minimum amount of time between sending periodic updates about relay path MTU. Useful for quickly determining MTU to indirect nodes.
 .It Va Port Li = Ar port Pq 655
 The port number on which this tinc daemon is listening for incoming connections,
 which is used if no port number is specified in an
 .Va Address
 statement.
 .Pp
 If this is set to zero, the port will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. When setting
 .Va Port
 to zero it is recommended to set
 .Va AddressFamily
 as well, otherwise
 .Nm tinc
 will assign different ports to different address families but other nodes can only know of one.
 .It Va PublicKey Li = Ar key Bq obsolete
 The public RSA key of this tinc daemon.
 It will be used to cryptographically verify it's identity and to set up a secure connection.
@ -542,7 +637,7 @@ IPv6 subnets are notated like fec0:0:0:1::/64.
 MAC addresses are notated like 0:1a:2b:3c:4d:5e.
 .Pp
 A Subnet can be given a weight to indicate its priority over identical Subnets
-owned by different nodes.  The default weight is 10. Lower values indicate
+owned by different nodes. The default weight is 10. Lower values indicate
 higher priority. Packets will be sent to the node with the highest priority,
 unless that node is not reachable, in which case the node with the next highest
 priority will be tried, and so on.
@ -556,6 +651,12 @@ Setting this options also implicitly sets IndirectData.
 .Pp
 Since version 1.0.10, tinc will automatically detect whether communication via
 UDP is possible or not.
 .It Va Weight Li = Ar weight
 If this variable is set, it overrides the weight given to connections made with
 another host. A higher
 .Ar weight
 means a lower priority is given to this connection when broadcasting or
 forwarding packets.
 .El
 .Sh SCRIPTS
 Apart from reading the server and host configuration files,
@ -569,17 +670,23 @@ This guarantees that scripts will execute in the exact same order as the events
 If you need to run commands asynchronously, you have to ensure yourself that they are being run in the background.
 .Pp
 Under Windows (not Cygwin), the scripts must have the extension
-.Pa .bat .
+.Pa .bat
 or
 .Pa .cmd .
 .Bl -tag -width indent
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
 This is the most important script.
-If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device.
+If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device (or when the first node becomes reachable if
 .Va DeviceStandby
 is used).
 It should be used to set up the corresponding network interface,
 but can also be used to start other things.
 .Pp
 Under Windows you can use the Network Connections control panel instead of creating this script.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-down
-This script is started right before the tinc daemon quits.
+This script is started right before the tinc daemon quits (or when the last node becomes unreachable if
 .Va DeviceStandby
 is used).
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Ar HOST Ns Pa -up
 This script is started when the tinc daemon with name
 .Ar HOST
@ -597,6 +704,10 @@ This script is started when a Subnet becomes reachable.
 The Subnet and the node it belongs to are passed in environment variables.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /subnet-down
 This script is started when a Subnet becomes unreachable.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-created
 This script is started when a new invitation has been created.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-accepted
 This script is started when an invitation has been used.
 .El
 .Pp
 The scripts are started without command line arguments, but can make use of certain environment variables.
@ -605,6 +716,8 @@ Under UNIX like operating systems the names of environment variables must be pre
 in scripts.
 Under Windows, in
 .Pa .bat
 or
 .Pa .cmd
 files, they have to be put between
 .Li %
 signs.
@ -630,6 +743,14 @@ When a host becomes (un)reachable, this is set to the port number it uses for co
 When a subnet becomes (un)reachable, this is set to the subnet.
 .It Ev WEIGHT
 When a subnet becomes (un)reachable, this is set to the subnet weight.
 .It Ev INVITATION_FILE
 When the
 .Pa invitation-created
 script is called, this is set to the file where the invitation details will be stored.
 .It Ev INVITATION_URL
 When the
 .Pa invitation-created
 script is called, this is set to the invitation URL that has been created.
 .El
 .Pp
 Do not forget that under UNIX operating systems, you have to make the scripts executable, using the command
@ -643,7 +764,7 @@ The top directory for configuration files.
 The default name of the server configuration file for net
 .Ar NETNAME .
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /conf.d/
-Optional directory from which any *.conf file will be loaded
+Optional directory from which any .conf file will be loaded
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 Host configuration files are kept in this directory.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
@ -657,6 +778,7 @@ its connection to the virtual network device.
 .El
 .Sh SEE ALSO
 .Xr tincd 8 ,
 .Xr tinc 8 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.tldp.org/LDP/nag2/ .
 .Pp
--- a/doc/tinc.info
+++ b/doc/tinc.info
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
--- a/doc/tincd.8.in
+++ b/doc/tincd.8.in
@ -1,4 +1,4 @@
-.Dd 2014-05-11
+.Dd 2013-01-14
 .Dt TINCD 8
 .\" Manual page created by:
 .\" Ivo Timmermans
@ -8,17 +8,15 @@
 .Nd tinc VPN daemon
 .Sh SYNOPSIS
 .Nm
-.Op Fl cdDkKnoLRU
+.Op Fl cdDKnsoLRU
 .Op Fl -config Ns = Ns Ar DIR
 .Op Fl -no-detach
 .Op Fl -debug Ns Op = Ns Ar LEVEL
 .Op Fl -kill Ns Op = Ns Ar SIGNAL
 .Op Fl -net Ns = Ns Ar NETNAME
 .Op Fl -generate-keys Ns Op = Ns Ar BITS
 .Op Fl -option Ns = Ns Ar [HOST.]KEY=VALUE
 .Op Fl -mlock
 .Op Fl -logfile Ns Op = Ns Ar FILE
-.Op Fl -pidfile Ns = Ns Ar FILE
+.Op Fl -syslog
 .Op Fl -bypass-security
 .Op Fl -chroot
 .Op Fl -user Ns = Ns Ar USER
@ -54,14 +52,6 @@ If not mentioned otherwise, this will show log messages on the standard error ou
 Increase debug level or set it to
 .Ar LEVEL
 (see below).
 .It Fl k, -kill Ns Op = Ns Ar SIGNAL
 Attempt to kill a running
 .Nm
 (optionally with the specified
 .Ar SIGNAL
 instead of SIGTERM) and exit.
 Under Windows (not Cygwin) the optional argument is ignored,
 the service will always be stopped and removed.
 .It Fl n, -net Ns = Ns Ar NETNAME
 Connect to net
 .Ar NETNAME .
@ -73,13 +63,6 @@ for
 .Ar NETNAME
 is the same as not specifying any
 .Ar NETNAME .
 .It Fl K, -generate-keys Ns Op = Ns Ar BITS
 Generate public/private RSA keypair and exit.
 If
 .Ar BITS
 is omitted, the default length will be 2048 bits.
 When saving keys to existing files, tinc will not delete the old keys,
 you have to remove them manually.
 .It Fl o, -option Ns = Ns Ar [HOST.]KEY=VALUE
 Without specifying a
 .Ar HOST ,
@ -99,18 +82,25 @@ This option can be used more than once to specify multiple configuration variabl
 .It Fl L, -mlock
 Lock tinc into main memory.
 This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
 This option is not supported on all platforms.
 .It Fl -logfile Ns Op = Ns Ar FILE
 Write log entries to a file instead of to the system logging facility.
 If
 .Ar FILE
 is omitted, the default is
 .Pa @localstatedir@/log/tinc. Ns Ar NETNAME Ns Pa .log.
-.It Fl -pidfile Ns = Ns Ar FILE
+.It Fl s, -syslog
-Write PID to
+When this option is is set, tinc uses syslog instead of stderr in --no-detach mode.
 .It Fl -pidfile Ns = Ns Ar FILENAME
 Store a cookie in
 .Ar FILENAME
 which allows
 .Xr tinc 8
 to authenticate.
 If
 .Ar FILE
-instead of
+is omitted, the default is
-.Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
+.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
 Under Windows this option will be ignored.
 .It Fl -bypass-security
 Disables encryption and authentication of the meta protocol.
 Only useful for debugging.
@ -118,10 +108,12 @@ Only useful for debugging.
 With this option tinc chroots into the directory where network
 config is located (@sysconfdir@/tinc/NETNAME if -n option is used,
 or to the directory specified with -c option) after initialization.
 This option is not supported on all platforms.
 .It Fl U, -user Ns = Ns Ar USER
 setuid to the specified
 .Ar USER
 after initialization.
 This option is not supported on all platforms.
 .It Fl -help
 Display short list of options.
 .It Fl -version
@ -151,15 +143,6 @@ If the
 .Fl -logfile
 option is used, this will also close and reopen the log file,
 useful when log rotation is used.
 .It INT
 Temporarily increases debug level to 5.
 Send this signal again to revert to the original level.
 .It USR1
 Dumps the connection list to syslog.
 .It USR2
 Dumps virtual network device statistics, all known nodes, edges and subnets to syslog.
 .It WINCH
 Purges all information remembered about unreachable nodes.
 .El
 .Sh DEBUG LEVELS
 The tinc daemon can send a lot of messages to the syslog.
@ -190,7 +173,7 @@ This will log all network traffic over the virtual private network.
 Directory containing the configuration files tinc uses.
 For more information, see
 .Xr tinc.conf 5 .
-.It Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid
+.It Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid
 The PID of the currently running
 .Nm
 is stored in this file.
@ -206,6 +189,7 @@ If you find any bugs, report them to tinc@tinc-vpn.org.
 .Sh TODO
 A lot, especially security auditing.
 .Sh SEE ALSO
 .Xr tinc 8 ,
 .Xr tinc.conf 5 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.cabal.org/ .
--- a/doc/tincinclude.texi
+++ b/doc/tincinclude.texi
@ -1,5 +0,0 @@
@set VERSION 1.0.36
@set PACKAGE tinc
@set sysconfdir /etc
@set localstatedir /var
@set runstatedir /run
--- a/doc/tincinclude.texi.in
+++ b/doc/tincinclude.texi.in
@ -2,4 +2,3 @@
@set PACKAGE @PACKAGE@
@set sysconfdir @sysconfdir@
@set localstatedir @localstatedir@
@set runstatedir @runstatedir@
--- a/gui/Makefile.am
+++ b/gui/Makefile.am
@ -0,0 +1,3 @@
 dist_bin_SCRIPTS = tinc-gui
 extra_DIST = README.gui
--- a/gui/Makefile.in
+++ b/gui/Makefile.in
@ -0,0 +1,504 @@
 # Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
 # Copyright (C) 1994-2014 Free Software Foundation, Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY, to the extent permitted by law; without
 # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE.
@SET_MAKE@
 VPATH = @srcdir@
 am__is_gnu_make = { \
  if test -z '$(MAKELEVEL)'; then \
    false; \
  elif test -n '$(MAKE_HOST)'; then \
    true; \
  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
    true; \
  else \
    false; \
  fi; \
 }
 am__make_running_with_option = \
  case $${target_option-} in \
      ?) ;; \
      *) echo "am__make_running_with_option: internal error: invalid" \
              "target option '$${target_option-}' specified" >&2; \
         exit 1;; \
  esac; \
  has_opt=no; \
  sane_makeflags=$$MAKEFLAGS; \
  if $(am__is_gnu_make); then \
    sane_makeflags=$$MFLAGS; \
  else \
    case $$MAKEFLAGS in \
      *\\[\ \	]*) \
        bs=\\; \
        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
    esac; \
  fi; \
  skip_next=no; \
  strip_trailopt () \
  { \
    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
  }; \
  for flg in $$sane_makeflags; do \
    test $$skip_next = yes && { skip_next=no; continue; }; \
    case $$flg in \
      *=*|--*) continue;; \
        -*I) strip_trailopt 'I'; skip_next=yes;; \
      -*I?*) strip_trailopt 'I';; \
        -*O) strip_trailopt 'O'; skip_next=yes;; \
      -*O?*) strip_trailopt 'O';; \
        -*l) strip_trailopt 'l'; skip_next=yes;; \
      -*l?*) strip_trailopt 'l';; \
      -[dEDm]) skip_next=yes;; \
      -[JT]) skip_next=yes;; \
    esac; \
    case $$flg in \
      *$$target_option*) has_opt=yes; break;; \
    esac; \
  done; \
  test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
 pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
 install_sh_SCRIPT = $(install_sh) -c
 INSTALL_HEADER = $(INSTALL_DATA)
 transform = $(program_transform_name)
 NORMAL_INSTALL = :
 PRE_INSTALL = :
 POST_INSTALL = :
 NORMAL_UNINSTALL = :
 PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = gui
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
 	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
 	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
 	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
 	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(dist_bin_SCRIPTS) \
 	$(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
    *) f=$$p;; \
  esac;
 am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
 am__install_max = 40
 am__nobase_strip_setup = \
  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
 am__nobase_strip = \
  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
 am__nobase_list = $(am__nobase_strip_setup); \
  for p in $$list; do echo "$$p $$p"; done | \
  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
    if (++n[$$2] == $(am__install_max)) \
      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
    END { for (dir in files) print dir, files[dir] }'
 am__base_list = \
  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__uninstall_files_from_dir = { \
  test -z "$$files" \
    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
         $(am__cd) "$$dir" && rm -f $$files; }; \
  }
 am__installdirs = "$(DESTDIR)$(bindir)"
 SCRIPTS = $(dist_bin_SCRIPTS)
 AM_V_P = $(am__v_P_@AM_V@)
 am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
 am__v_P_0 = false
 am__v_P_1 = :
 AM_V_GEN = $(am__v_GEN_@AM_V@)
 am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
 am__v_GEN_0 = @echo "  GEN     " $@;
 am__v_GEN_1 = 
 AM_V_at = $(am__v_at_@AM_V@)
 am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
 am__v_at_0 = @
 am__v_at_1 = 
 SOURCES =
 DIST_SOURCES =
 am__can_run_installinfo = \
  case $$AM_UPDATE_INFO_DIR in \
    n|no|NO) false;; \
    *) (install-info --version) >/dev/null 2>&1;; \
  esac
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 READLINE_LIBS = @READLINE_LIBS@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
 VERSION = @VERSION@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_CC = @ac_ct_CC@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
 am__tar = @am__tar@
 am__untar = @am__untar@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
 build_cpu = @build_cpu@
 build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 datadir = @datadir@
 datarootdir = @datarootdir@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
 host = @host@
 host_alias = @host_alias@
 host_cpu = @host_cpu@
 host_os = @host_os@
 host_vendor = @host_vendor@
 htmldir = @htmldir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
 libdir = @libdir@
 libexecdir = @libexecdir@
 localedir = @localedir@
 localstatedir = @localstatedir@
 mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
 pdfdir = @pdfdir@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
 psdir = @psdir@
 runstatedir = @runstatedir@
 sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
 systemd_path = @systemd_path@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 dist_bin_SCRIPTS = tinc-gui
 extra_DIST = README.gui
 all: all-am
 .SUFFIXES:
 $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
 	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
 	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu gui/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu gui/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
 	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
 	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
 	esac;
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(top_srcdir)/configure:  $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(am__aclocal_m4_deps):
 install-dist_binSCRIPTS: $(dist_bin_SCRIPTS)
 	@$(NORMAL_INSTALL)
 	@list='$(dist_bin_SCRIPTS)'; test -n "$(bindir)" || list=; \
 	if test -n "$$list"; then \
 	  echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \
 	  $(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \
 	fi; \
 	for p in $$list; do \
 	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
 	  if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
 	done | \
 	sed -e 'p;s,.*/,,;n' \
 	    -e 'h;s|.*|.|' \
 	    -e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
 	$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
 	  { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
 	    if ($$2 == $$4) { files[d] = files[d] " " $$1; \
 	      if (++n[d] == $(am__install_max)) { \
 		print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
 	    else { print "f", d "/" $$4, $$1 } } \
 	  END { for (d in files) print "f", d, files[d] }' | \
 	while read type dir files; do \
 	     if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
 	     test -z "$$files" || { \
 	       echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(bindir)$$dir'"; \
 	       $(INSTALL_SCRIPT) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \
 	     } \
 	; done
 uninstall-dist_binSCRIPTS:
 	@$(NORMAL_UNINSTALL)
 	@list='$(dist_bin_SCRIPTS)'; test -n "$(bindir)" || exit 0; \
 	files=`for p in $$list; do echo "$$p"; done | \
 	       sed -e 's,.*/,,;$(transform)'`; \
 	dir='$(DESTDIR)$(bindir)'; $(am__uninstall_files_from_dir)
 installcheck-dist_binSCRIPTS: $(dist_bin_SCRIPTS)
 	bad=0; pid=$$$$; list="$(dist_bin_SCRIPTS)"; for p in $$list; do \
 	  case ' $(AM_INSTALLCHECK_STD_OPTIONS_EXEMPT) ' in \
 	   *" $$p "* | *" $(srcdir)/$$p "*) continue;; \
 	  esac; \
 	  f=`echo "$$p" | sed 's,^.*/,,;$(transform)'`; \
 	  for opt in --help --version; do \
 	    if "$(DESTDIR)$(bindir)/$$f" $$opt >c$${pid}_.out \
 	         2>c$${pid}_.err </dev/null \
 		 && test -n "`cat c$${pid}_.out`" \
 		 && test -z "`cat c$${pid}_.err`"; then :; \
 	    else echo "$$f does not support $$opt" 1>&2; bad=1; fi; \
 	  done; \
 	done; rm -f c$${pid}_.???; exit $$bad
 tags TAGS:
 ctags CTAGS:
 cscope cscopelist:
 distdir: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
 	  dist_files=`for file in $$list; do echo $$file; done | \
 	  sed -e "s|^$$srcdirstrip/||;t" \
 	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
 	case $$dist_files in \
 	  */*) $(MKDIR_P) `echo "$$dist_files" | \
 			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
 			   sort -u` ;; \
 	esac; \
 	for file in $$dist_files; do \
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  if test -d $$d/$$file; then \
 	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
 	    if test -d "$(distdir)/$$file"; then \
 	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
 	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
 	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
 	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
 	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
 	    test -f "$(distdir)/$$file" \
 	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
 check-am: all-am
 check: check-am
 all-am: Makefile $(SCRIPTS)
 installdirs:
 	for dir in "$(DESTDIR)$(bindir)"; do \
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
 install-exec: install-exec-am
 install-data: install-data-am
 uninstall: uninstall-am
 install-am: all-am
 	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
 installcheck: installcheck-am
 install-strip:
 	if test -z '$(STRIP)'; then \
 	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
 	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
 	      install; \
 	else \
 	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
 	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
 	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
 	fi
 mostlyclean-generic:
 clean-generic:
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
 	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
 clean: clean-am
 clean-am: clean-generic mostlyclean-am
 distclean: distclean-am
 	-rm -f Makefile
 distclean-am: clean-am distclean-generic
 dvi: dvi-am
 dvi-am:
 html: html-am
 html-am:
 info: info-am
 info-am:
 install-data-am:
 install-dvi: install-dvi-am
 install-dvi-am:
 install-exec-am: install-dist_binSCRIPTS
 install-html: install-html-am
 install-html-am:
 install-info: install-info-am
 install-info-am:
 install-man:
 install-pdf: install-pdf-am
 install-pdf-am:
 install-ps: install-ps-am
 install-ps-am:
 installcheck-am: installcheck-dist_binSCRIPTS
 maintainer-clean: maintainer-clean-am
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 mostlyclean: mostlyclean-am
 mostlyclean-am: mostlyclean-generic
 pdf: pdf-am
 pdf-am:
 ps: ps-am
 ps-am:
 uninstall-am: uninstall-dist_binSCRIPTS
 .MAKE: install-am install-strip
 .PHONY: all all-am check check-am clean clean-generic cscopelist-am \
 	ctags-am distclean distclean-generic distdir dvi dvi-am html \
 	html-am info info-am install install-am install-data \
 	install-data-am install-dist_binSCRIPTS install-dvi \
 	install-dvi-am install-exec install-exec-am install-html \
 	install-html-am install-info install-info-am install-man \
 	install-pdf install-pdf-am install-ps install-ps-am \
 	install-strip installcheck installcheck-am \
 	installcheck-dist_binSCRIPTS installdirs maintainer-clean \
 	maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
 	pdf-am ps ps-am tags-am uninstall uninstall-am \
 	uninstall-dist_binSCRIPTS
 .PRECIOUS: Makefile
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
--- a/gui/tinc-gui
+++ b/gui/tinc-gui
@ -0,0 +1,634 @@
 #!/usr/bin/env python2
 # tinc-gui -- GUI for controlling a running tincd
 # Copyright (C) 2009-2014 Guus Sliepen <guus@tinc-vpn.org>
 #                    2014 Dennis Joachimsthaler <dennis@efjot.de>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License along
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 import string
 import socket
 import os
 import platform
 import time
 from argparse import ArgumentParser
 import wx
 from wx.lib.mixins.listctrl import ColumnSorterMixin
 from wx.lib.mixins.listctrl import ListCtrlAutoWidthMixin
 if platform.system() == 'Windows':
    import _winreg
 # Classes to interface with a running tinc daemon
 REQ_STOP = 0
 REQ_RELOAD = 1
 REQ_RESTART = 2
 REQ_DUMP_NODES = 3
 REQ_DUMP_EDGES = 4
 REQ_DUMP_SUBNETS = 5
 REQ_DUMP_CONNECTIONS = 6
 REQ_DUMP_GRAPH = 7
 REQ_PURGE = 8
 REQ_SET_DEBUG = 9
 REQ_RETRY = 10
 REQ_CONNECT = 11
 REQ_DISCONNECT = 12
 ID = 0
 ACK = 4
 CONTROL = 18
 class Node(object):
    def __init__(self, args):
        self.name = args[0]
        self.id = args[1]
        self.address = args[2]
        self.port = args[4]
        self.cipher = int(args[5])
        self.digest = int(args[6])
        self.maclength = int(args[7])
        self.compression = int(args[8])
        self.options = int(args[9], 0x10)
        self.status = int(args[10], 0x10)
        self.nexthop = args[11]
        self.via = args[12]
        self.distance = int(args[13])
        self.pmtu = int(args[14])
        self.minmtu = int(args[15])
        self.maxmtu = int(args[16])
        self.last_state_change = float(args[17])
        self.subnets = {}
 class Edge(object):
    def __init__(self, args):
        self.source = args[0]
        self.sink = args[1]
        self.address = args[2]
        self.port = args[4]
        self.options = int(args[-2], 16)
        self.weight = int(args[-1])
 class Subnet(object):
    def __init__(self, args):
        if args[0].find('#') >= 0:
            address, self.weight = args[0].split('#', 1)
        else:
            self.weight = 10
            address = args[0]
        if address.find('/') >= 0:
            self.address, self.prefixlen = address.split('/', 1)
        else:
            self.address = address
            self.prefixlen = '48'
        self.owner = args[1]
 class Connection(object):
    def __init__(self, args):
        self.name = args[0]
        self.address = args[1]
        self.port = args[3]
        self.options = int(args[4], 0x10)
        self.socket = int(args[5])
        self.status = int(args[6], 0x10)
        self.weight = 'n/a'
 class VPN(object):
    def __init__(self, netname=None, pidfile=None, confdir='/etc/tinc', piddir='/run'):
        if platform.system() == 'Windows':
            sam = _winreg.KEY_READ
            if platform.machine().endswith('64'):
                sam = sam | _winreg.KEY_WOW64_64KEY
            try:
                reg = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
                try:
                    key = _winreg.OpenKey(reg, "SOFTWARE\\tinc", 0, sam)
                except WindowsError:
                    key = _winreg.OpenKey(reg, "SOFTWARE\\Wow6432Node\\tinc", 0, sam)
                confdir = _winreg.QueryValue(key, None)
            except WindowsError:
                pass
        if netname:
            self.netname = netname
            self.confbase = os.path.join(confdir, netname)
        else:
            self.confbase = confdir
        self.tincconf = os.path.join(self.confbase, 'tinc.conf')
        if pidfile is not None:
            self.pidfile = pidfile
        else:
            if platform.system() == 'Windows':
                self.pidfile = os.path.join(self.confbase, 'pid')
            else:
                if netname:
                    self.pidfile = os.path.join(piddir, 'tinc.' + netname + '.pid')
                else:
                    self.pidfile = os.path.join(piddir, 'tinc.pid')
        self.sf = None
        self.name = None
        self.port = None
        self.nodes = {}
        self.edges = {}
        self.subnets = {}
        self.connections = {}
    def connect(self):
        # read the pidfile
        f = open(self.pidfile)
        info = string.split(f.readline())
        f.close()
        # check if there is a UNIX socket as well
        if self.pidfile.endswith('.pid'):
            unixfile = self.pidfile.replace('.pid', '.socket');
        else:
            unixfile = self.pidfile + '.socket';
        if os.path.exists(unixfile):
            # use it if it exists
            print(unixfile + " exists!");
            s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
            s.connect(unixfile)
        else:
            # otherwise connect via TCP
            print(unixfile + " does not exist.");
            if ':' in info[2]:
                af = socket.AF_INET6
            else:
                af = socket.AF_INET
            s = socket.socket(af, socket.SOCK_STREAM)
            s.connect((info[2], int(info[4])))
        self.sf = s.makefile()
        s.close()
        hello = string.split(self.sf.readline())
        self.name = hello[1]
        self.sf.write('0 ^' + info[1] + ' 17\r\n')
        self.sf.flush()
        resp = string.split(self.sf.readline())
        self.port = info[4]
        self.refresh()
    def refresh(self):
        for request in (REQ_DUMP_NODES, REQ_DUMP_EDGES, REQ_DUMP_SUBNETS, REQ_DUMP_CONNECTIONS):
            self.sf.write('{} {}\r\n'.format(CONTROL, request))
        self.sf.flush()
        for node in self.nodes.values():
            node.visited = False
        for edge in self.edges.values():
            edge.visited = False
        for subnet in self.subnets.values():
            subnet.visited = False
        for connections in self.connections.values():
            connections.visited = False
        while True:
            resp = string.split(self.sf.readline())
            if len(resp) < 2:
                break
            if resp[0] != '18':
                break
            if resp[1] == '3':
                if len(resp) < 19:
                    continue
                node = self.nodes.get(resp[2]) or Node(resp[2:])
                node.visited = True
                self.nodes[resp[2]] = node
            elif resp[1] == '4':
                if len(resp) < 9:
                    continue
                edge = self.nodes.get((resp[2], resp[3])) or Edge(resp[2:])
                edge.visited = True
                self.edges[(resp[2], resp[3])] = edge
            elif resp[1] == '5':
                if len(resp) < 4:
                    continue
                subnet = self.subnets.get((resp[2], resp[3])) or Subnet(resp[2:])
                subnet.visited = True
                self.subnets[(resp[2], resp[3])] = subnet
                if subnet.owner == "(broadcast)":
                    continue
                self.nodes[subnet.owner].subnets[resp[2]] = subnet
            elif resp[1] == '6':
                if len(resp) < 9:
                    break
                connection = self.connections.get((resp[2], resp[3], resp[5])) or Connection(resp[2:])
                connection.visited = True
                self.connections[(resp[2], resp[3], resp[5])] = connection
            else:
                break
        for key, subnet in self.subnets.items():
            if not subnet.visited:
                del self.subnets[key]
        for key, edge in self.edges.items():
            if not edge.visited:
                del self.edges[key]
        for key, node in self.nodes.items():
            if not node.visited:
                del self.nodes[key]
            else:
                for key, subnet in node.subnets.items():
                    if not subnet.visited:
                        del node.subnets[key]
        for key, connection in self.connections.items():
            if not connection.visited:
                del self.connections[key]
    def close(self):
        self.sf.close()
    def disconnect(self, name):
        self.sf.write('18 12 ' + name + '\r\n')
        self.sf.flush()
        resp = string.split(self.sf.readline())
    def debug(self, level=-1):
        self.sf.write('18 9 ' + str(level) + '\r\n')
        self.sf.flush()
        resp = string.split(self.sf.readline())
        return int(resp[2])
 class SuperListCtrl(wx.ListCtrl, ColumnSorterMixin, ListCtrlAutoWidthMixin):
    def __init__(self, parent, style):
        wx.ListCtrl.__init__(self, parent, -1, style=wx.LC_REPORT | wx.LC_HRULES | wx.LC_VRULES)
        ListCtrlAutoWidthMixin.__init__(self)
        ColumnSorterMixin.__init__(self, 16)
    def GetListCtrl(self):
        return self
 class SettingsPage(wx.Panel):
    def on_debug_level(self, event):
        vpn.debug(self.debug.GetValue())
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
        grid = wx.FlexGridSizer(cols=2)
        grid.AddGrowableCol(1, 1)
        namelabel = wx.StaticText(self, -1, 'Name:')
        self.name = wx.TextCtrl(self, -1, vpn.name)
        grid.Add(namelabel)
        grid.Add(self.name, 1, wx.EXPAND)
        portlabel = wx.StaticText(self, -1, 'Port:')
        self.port = wx.TextCtrl(self, -1, vpn.port)
        grid.Add(portlabel)
        grid.Add(self.port)
        debuglabel = wx.StaticText(self, -1, 'Debug level:')
        self.debug = wx.SpinCtrl(self, min=0, max=5, initial=vpn.debug())
        self.debug.Bind(wx.EVT_SPINCTRL, self.on_debug_level)
        grid.Add(debuglabel)
        grid.Add(self.debug)
        modelabel = wx.StaticText(self, -1, 'Mode:')
        self.mode = wx.ComboBox(self, -1, style=wx.CB_READONLY, value='Router', choices=['Router', 'Switch', 'Hub'])
        grid.Add(modelabel)
        grid.Add(self.mode)
        self.SetSizer(grid)
 class ConnectionsPage(wx.Panel):
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
        self.list = SuperListCtrl(self, id)
        self.list.InsertColumn(0, 'Name')
        self.list.InsertColumn(1, 'Address')
        self.list.InsertColumn(2, 'Port')
        self.list.InsertColumn(3, 'Options')
        self.list.InsertColumn(4, 'Weight')
        hbox = wx.BoxSizer(wx.HORIZONTAL)
        hbox.Add(self.list, 1, wx.EXPAND)
        self.SetSizer(hbox)
        self.refresh()
    class ContextMenu(wx.Menu):
        def __init__(self, item):
            wx.Menu.__init__(self)
            self.item = item
            disconnect = wx.MenuItem(self, -1, 'Disconnect')
            self.AppendItem(disconnect)
            self.Bind(wx.EVT_MENU, self.on_disconnect, id=disconnect.GetId())
        def on_disconnect(self, event):
            vpn.disconnect(self.item[0])
    def on_context(self, event):
        idx = event.GetIndex()
        self.PopupMenu(self.ContextMenu(self.list.itemDataMap[event.GetIndex()]), event.GetPosition())
    def refresh(self):
        sortstate = self.list.GetSortState()
        self.list.itemDataMap = {}
        i = 0
        for key, connection in vpn.connections.items():
            if self.list.GetItemCount() <= i:
                self.list.InsertStringItem(i, connection.name)
            else:
                self.list.SetStringItem(i, 0, connection.name)
            self.list.SetStringItem(i, 1, connection.address)
            self.list.SetStringItem(i, 2, connection.port)
            self.list.SetStringItem(i, 3, str(connection.options))
            self.list.SetStringItem(i, 4, str(connection.weight))
            self.list.itemDataMap[i] = (connection.name, connection.address, connection.port, connection.options,
                                        connection.weight)
            self.list.Bind(wx.EVT_LIST_ITEM_RIGHT_CLICK, self.on_context)
            self.list.SetItemData(i, i)
            i += 1
        while self.list.GetItemCount() > i:
            self.list.DeleteItem(self.list.GetItemCount() - 1)
        self.list.SortListItems(sortstate[0], sortstate[1])
 class NodesPage(wx.Panel):
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
        self.list = SuperListCtrl(self, id)
        self.list.InsertColumn(0, 'Name')
        self.list.InsertColumn(1, 'Address')
        self.list.InsertColumn(2, 'Port')
        self.list.InsertColumn(3, 'Cipher')
        self.list.InsertColumn(4, 'Digest')
        self.list.InsertColumn(5, 'MACLength')
        self.list.InsertColumn(6, 'Compression')
        self.list.InsertColumn(7, 'Options')
        self.list.InsertColumn(8, 'Status')
        self.list.InsertColumn(9, 'Nexthop')
        self.list.InsertColumn(10, 'Via')
        self.list.InsertColumn(11, 'Distance')
        self.list.InsertColumn(12, 'PMTU')
        self.list.InsertColumn(13, 'Min MTU')
        self.list.InsertColumn(14, 'Max MTU')
        self.list.InsertColumn(15, 'Since')
        hbox = wx.BoxSizer(wx.HORIZONTAL)
        hbox.Add(self.list, 1, wx.EXPAND)
        self.SetSizer(hbox)
        self.refresh()
    def refresh(self):
        sortstate = self.list.GetSortState()
        self.list.itemDataMap = {}
        i = 0
        for key, node in vpn.nodes.items():
            if self.list.GetItemCount() <= i:
                self.list.InsertStringItem(i, node.name)
            else:
                self.list.SetStringItem(i, 0, node.name)
            self.list.SetStringItem(i, 1, node.address)
            self.list.SetStringItem(i, 2, node.port)
            self.list.SetStringItem(i, 3, str(node.cipher))
            self.list.SetStringItem(i, 4, str(node.digest))
            self.list.SetStringItem(i, 5, str(node.maclength))
            self.list.SetStringItem(i, 6, str(node.compression))
            self.list.SetStringItem(i, 7, format(node.options, "x"))
            self.list.SetStringItem(i, 8, format(node.status, "04x"))
            self.list.SetStringItem(i, 9, node.nexthop)
            self.list.SetStringItem(i, 10, node.via)
            self.list.SetStringItem(i, 11, str(node.distance))
            self.list.SetStringItem(i, 12, str(node.pmtu))
            self.list.SetStringItem(i, 13, str(node.minmtu))
            self.list.SetStringItem(i, 14, str(node.maxmtu))
            if node.last_state_change:
                since = time.strftime("%Y-%m-%d %H:%M", time.localtime(node.last_state_change))
            else:
                since = "never"
            self.list.SetStringItem(i, 15, since)
            self.list.itemDataMap[i] = (node.name, node.address, node.port, node.cipher, node.digest, node.maclength,
                                        node.compression, node.options, node.status, node.nexthop, node.via,
                                        node.distance, node.pmtu, node.minmtu, node.maxmtu, since)
            self.list.SetItemData(i, i)
            i += 1
        while self.list.GetItemCount() > i:
            self.list.DeleteItem(self.list.GetItemCount() - 1)
        self.list.SortListItems(sortstate[0], sortstate[1])
 class EdgesPage(wx.Panel):
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
        self.list = SuperListCtrl(self, id)
        self.list.InsertColumn(0, 'From')
        self.list.InsertColumn(1, 'To')
        self.list.InsertColumn(2, 'Address')
        self.list.InsertColumn(3, 'Port')
        self.list.InsertColumn(4, 'Options')
        self.list.InsertColumn(5, 'Weight')
        hbox = wx.BoxSizer(wx.HORIZONTAL)
        hbox.Add(self.list, 1, wx.EXPAND)
        self.SetSizer(hbox)
        self.refresh()
    def refresh(self):
        sortstate = self.list.GetSortState()
        self.list.itemDataMap = {}
        i = 0
        for key, edge in vpn.edges.items():
            if self.list.GetItemCount() <= i:
                self.list.InsertStringItem(i, edge.source)
            else:
                self.list.SetStringItem(i, 0, edge.source)
            self.list.SetStringItem(i, 1, edge.sink)
            self.list.SetStringItem(i, 2, edge.address)
            self.list.SetStringItem(i, 3, edge.port)
            self.list.SetStringItem(i, 4, format(edge.options, "x"))
            self.list.SetStringItem(i, 5, str(edge.weight))
            self.list.itemDataMap[i] = (edge.source, edge.sink, edge.address, edge.port, edge.options, edge.weight)
            self.list.SetItemData(i, i)
            i += 1
        while self.list.GetItemCount() > i:
            self.list.DeleteItem(self.list.GetItemCount() - 1)
        self.list.SortListItems(sortstate[0], sortstate[1])
 class SubnetsPage(wx.Panel):
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
        self.list = SuperListCtrl(self, id)
        self.list.InsertColumn(0, 'Subnet', wx.LIST_FORMAT_RIGHT)
        self.list.InsertColumn(1, 'Weight', wx.LIST_FORMAT_RIGHT)
        self.list.InsertColumn(2, 'Owner')
        hbox = wx.BoxSizer(wx.HORIZONTAL)
        hbox.Add(self.list, 1, wx.EXPAND)
        self.SetSizer(hbox)
        self.refresh()
    def refresh(self):
        sortstate = self.list.GetSortState()
        self.list.itemDataMap = {}
        i = 0
        for key, subnet in vpn.subnets.items():
            if self.list.GetItemCount() <= i:
                self.list.InsertStringItem(i, subnet.address + '/' + subnet.prefixlen)
            else:
                self.list.SetStringItem(i, 0, subnet.address + '/' + subnet.prefixlen)
            self.list.SetStringItem(i, 1, str(subnet.weight))
            self.list.SetStringItem(i, 2, subnet.owner)
            self.list.itemDataMap[i] = (subnet.address + '/' + subnet.prefixlen, subnet.weight, subnet.owner)
            self.list.SetItemData(i, i)
            i += 1
        while self.list.GetItemCount() > i:
            self.list.DeleteItem(self.list.GetItemCount() - 1)
        self.list.SortListItems(sortstate[0], sortstate[1])
 class StatusPage(wx.Panel):
    def __init__(self, parent, id):
        wx.Panel.__init__(self, parent, id)
 class GraphPage(wx.Window):
    def __init__(self, parent, id):
        wx.Window.__init__(self, parent, id)
 class NetPage(wx.Notebook):
    def __init__(self, parent, id):
        wx.Notebook.__init__(self, parent)
        self.settings = SettingsPage(self, id)
        self.connections = ConnectionsPage(self, id)
        self.nodes = NodesPage(self, id)
        self.edges = EdgesPage(self, id)
        self.subnets = SubnetsPage(self, id)
        self.graph = GraphPage(self, id)
        self.status = StatusPage(self, id)
        self.AddPage(self.settings, 'Settings')
        # self.AddPage(self.status, 'Status')
        self.AddPage(self.connections, 'Connections')
        self.AddPage(self.nodes, 'Nodes')
        self.AddPage(self.edges, 'Edges')
        self.AddPage(self.subnets, 'Subnets')
        # self.AddPage(self.graph, 'Graph')
 class MainWindow(wx.Frame):
    def __init__(self, parent, id, title):
        wx.Frame.__init__(self, parent, id, title)
        menubar = wx.MenuBar()
        menu = wx.Menu()
        menu.Append(1, '&Quit\tCtrl-X', 'Quit tinc GUI')
        menubar.Append(menu, '&File')
        # nb = wx.Notebook(self, -1)
        # nb.SetPadding((0, 0))
        self.np = NetPage(self, -1)
        # nb.AddPage(np, 'VPN')
        self.timer = wx.Timer(self, -1)
        self.Bind(wx.EVT_TIMER, self.on_timer, self.timer)
        self.timer.Start(1000)
        self.Bind(wx.EVT_MENU, self.on_quit, id=1)
        self.SetMenuBar(menubar)
        self.Show()
    def on_quit(self, event):
        app.ExitMainLoop()
    def on_timer(self, event):
        vpn.refresh()
        self.np.nodes.refresh()
        self.np.subnets.refresh()
        self.np.edges.refresh()
        self.np.connections.refresh()
 def main(netname, pidfile):
    global vpn, app
    if netname is None:
        netname = os.getenv('NETNAME')
    vpn = VPN(netname, pidfile)
    vpn.connect()
    app = wx.App()
    mw = MainWindow(None, -1, 'Tinc GUI')
    """
    def OnTaskBarIcon(event):
        mw.Raise()
    """
    """
    icon = wx.Icon("tincgui.ico", wx.BITMAP_TYPE_PNG)
    taskbaricon = wx.TaskBarIcon()
    taskbaricon.SetIcon(icon, 'Tinc GUI')
    wx.EVT_TASKBAR_RIGHT_UP(taskbaricon, OnTaskBarIcon)
    """
    app.MainLoop()
    vpn.close()
 if __name__ == '__main__':
    argparser = ArgumentParser(epilog='Report bugs to tinc@tinc-vpn.org.')
    argparser.add_argument('-n', '--net', metavar='NETNAME', dest='netname', help='Connect to net NETNAME')
    argparser.add_argument('-p', '--pidfile', help='Path to the pid file (containing the controlcookie)')
    options = argparser.parse_args()
    main(options.netname, options.pidfile)
--- a/49
+++ b/49
@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
-scriptversion=2018-03-11.20; # UTC
+scriptversion=2014-09-12.12; # UTC
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@ -271,18 +271,15 @@ do
    fi
    dst=$dst_arg
-    # If destination is a directory, append the input filename.
+    # If destination is a directory, append the input filename; won't work
    # if double slashes aren't ignored.
    if test -d "$dst"; then
      if test "$is_target_a_directory" = never; then
        echo "$0: $dst_arg: Is a directory" >&2
        exit 1
      fi
      dstdir=$dst
-      dstbase=`basename "$src"`
+      dst=$dstdir/`basename "$src"`
      case $dst in
 	*/) dst=$dst$dstbase;;
 	*)  dst=$dst/$dstbase;;
      esac
      dstdir_status=0
    else
      dstdir=`dirname "$dst"`
@ -291,11 +288,6 @@ do
    fi
  fi
  case $dstdir in
    */) dstdirslash=$dstdir;;
    *)  dstdirslash=$dstdir/;;
  esac
  obsolete_mkdir_used=false
  if test $dstdir_status != 0; then
@ -332,16 +324,14 @@ do
            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
            ;;
          *)
-            # Note that $RANDOM variable is not portable (e.g. dash);  Use it
+            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # here however when possible just to lower collision chance.
+            # lower collision chance
            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
            trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
-            # Because "mkdir -p" follows existing symlinks and we likely work
+            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # directly in world-writeable /tmp, make sure that the '$tmpdir'
+            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # directory is successfully created first before we actually test
+            # that nobody tries to guess the $tmpdir name.
            # 'mkdir -p' feature.
            if (umask $mkdir_umask &&
                $mkdirprog $mkdir_mode "$tmpdir" &&
                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
@ -444,25 +434,14 @@ do
  else
    # Make a couple of temp file names in the proper directory.
-    dsttmp=${dstdirslash}_inst.$$_
+    dsttmp=$dstdir/_inst.$$_
-    rmtmp=${dstdirslash}_rm.$$_
+    rmtmp=$dstdir/_rm.$$_
    # Trap to clean up those temp files at exit.
    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
    # Copy the file name to the temp name.
-    (umask $cp_umask &&
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
     { test -z "$stripcmd" || {
 	 # Create $dsttmp read-write so that cp doesn't create it read-only,
 	 # which would cause strip to fail.
 	 if test -z "$doit"; then
 	   : >"$dsttmp" # No need to fork-exec 'touch'.
 	 else
 	   $doit touch "$dsttmp"
 	 fi
       }
     } &&
     $doit_exec $cpprog "$src" "$dsttmp") &&
    # and set any options; do chmod last to preserve setuid bits.
    #
@ -521,9 +500,9 @@ do
 done
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:
--- a/m4/ax_append_flag.m4
+++ b/m4/ax_append_flag.m4
@ -1,69 +0,0 @@
 # ===========================================================================
 #      http://www.gnu.org/software/autoconf-archive/ax_append_flag.html
 # ===========================================================================
 #
 # SYNOPSIS
 #
 #   AX_APPEND_FLAG(FLAG, [FLAGS-VARIABLE])
 #
 # DESCRIPTION
 #
 #   FLAG is appended to the FLAGS-VARIABLE shell variable, with a space
 #   added in between.
 #
 #   If FLAGS-VARIABLE is not specified, the current language's flags (e.g.
 #   CFLAGS) is used.  FLAGS-VARIABLE is not changed if it already contains
 #   FLAG.  If FLAGS-VARIABLE is unset in the shell, it is set to exactly
 #   FLAG.
 #
 #   NOTE: Implementation based on AX_CFLAGS_GCC_OPTION.
 #
 # LICENSE
 #
 #   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 #   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
 #   This program is free software: you can redistribute it and/or modify it
 #   under the terms of the GNU General Public License as published by the
 #   Free Software Foundation, either version 3 of the License, or (at your
 #   option) any later version.
 #
 #   This program is distributed in the hope that it will be useful, but
 #   WITHOUT ANY WARRANTY; without even the implied warranty of
 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
 #   with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
 #   scripts that are the output of Autoconf when processing the Macro. You
 #   need not follow the terms of the GNU General Public License when using
 #   or distributing such scripts, even though portions of the text of the
 #   Macro appear in them. The GNU General Public License (GPL) does govern
 #   all other use of the material that constitutes the Autoconf Macro.
 #
 #   This special exception to the GPL applies to versions of the Autoconf
 #   Macro released by the Autoconf Archive. When you make and distribute a
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 #serial 2
 AC_DEFUN([AX_APPEND_FLAG],
 [AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
 AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])dnl
 AS_VAR_SET_IF(FLAGS,
  [case " AS_VAR_GET(FLAGS) " in
    *" $1 "*)
      AC_RUN_LOG([: FLAGS already contains $1])
      ;;
    *)
      AC_RUN_LOG([: FLAGS="$FLAGS $1"])
      AS_VAR_SET(FLAGS, ["AS_VAR_GET(FLAGS) $1"])
      ;;
   esac],
  [AS_VAR_SET(FLAGS,["$1"])])
 AS_VAR_POPDEF([FLAGS])dnl
 ])dnl AX_APPEND_FLAG
--- a/m4/ax_cflags_warn_all.m4
+++ b/m4/ax_cflags_warn_all.m4
@ -1,122 +0,0 @@
 # ===========================================================================
 #    http://www.gnu.org/software/autoconf-archive/ax_cflags_warn_all.html
 # ===========================================================================
 #
 # SYNOPSIS
 #
 #   AX_CFLAGS_WARN_ALL   [(shellvar [,default, [A/NA]])]
 #   AX_CXXFLAGS_WARN_ALL [(shellvar [,default, [A/NA]])]
 #   AX_FCFLAGS_WARN_ALL  [(shellvar [,default, [A/NA]])]
 #
 # DESCRIPTION
 #
 #   Try to find a compiler option that enables most reasonable warnings.
 #
 #   For the GNU compiler it will be -Wall (and -ansi -pedantic) The result
 #   is added to the shellvar being CFLAGS, CXXFLAGS, or FCFLAGS by default.
 #
 #   Currently this macro knows about the GCC, Solaris, Digital Unix, AIX,
 #   HP-UX, IRIX, NEC SX-5 (Super-UX 10), Cray J90 (Unicos 10.0.0.8), and
 #   Intel compilers.  For a given compiler, the Fortran flags are much more
 #   experimental than their C equivalents.
 #
 #    - $1 shell-variable-to-add-to : CFLAGS, CXXFLAGS, or FCFLAGS
 #    - $2 add-value-if-not-found : nothing
 #    - $3 action-if-found : add value to shellvariable
 #    - $4 action-if-not-found : nothing
 #
 #   NOTE: These macros depend on AX_APPEND_FLAG.
 #
 # LICENSE
 #
 #   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 #   Copyright (c) 2010 Rhys Ulerich <rhys.ulerich@gmail.com>
 #
 #   This program is free software; you can redistribute it and/or modify it
 #   under the terms of the GNU General Public License as published by the
 #   Free Software Foundation; either version 3 of the License, or (at your
 #   option) any later version.
 #
 #   This program is distributed in the hope that it will be useful, but
 #   WITHOUT ANY WARRANTY; without even the implied warranty of
 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
 #   with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
 #   scripts that are the output of Autoconf when processing the Macro. You
 #   need not follow the terms of the GNU General Public License when using
 #   or distributing such scripts, even though portions of the text of the
 #   Macro appear in them. The GNU General Public License (GPL) does govern
 #   all other use of the material that constitutes the Autoconf Macro.
 #
 #   This special exception to the GPL applies to versions of the Autoconf
 #   Macro released by the Autoconf Archive. When you make and distribute a
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 #serial 15
 AC_DEFUN([AX_FLAGS_WARN_ALL],[dnl
 AS_VAR_PUSHDEF([FLAGS],[_AC_LANG_PREFIX[]FLAGS])dnl
 AS_VAR_PUSHDEF([VAR],[ac_cv_[]_AC_LANG_ABBREV[]flags_warn_all])dnl
 AC_CACHE_CHECK([m4_ifval($1,$1,FLAGS) for maximum warnings],
 VAR,[VAR="no, unknown"
 ac_save_[]FLAGS="$[]FLAGS"
 for ac_arg dnl
 in "-warn all  % -warn all"   dnl Intel
   "-pedantic  % -Wall"       dnl GCC
   "-xstrconst % -v"          dnl Solaris C
   "-std1      % -verbose -w0 -warnprotos" dnl Digital Unix
   "-qlanglvl=ansi % -qsrcmsg -qinfo=all:noppt:noppc:noobs:nocnd" dnl AIX
   "-ansi -ansiE % -fullwarn" dnl IRIX
   "+ESlit     % +w1"         dnl HP-UX C
   "-Xc        % -pvctl[,]fullmsg" dnl NEC SX-5 (Super-UX 10)
   "-h conform % -h msglevel 2" dnl Cray C (Unicos)
   #
 do FLAGS="$ac_save_[]FLAGS "`echo $ac_arg | sed -e 's,%%.*,,' -e 's,%,,'`
   AC_COMPILE_IFELSE([AC_LANG_PROGRAM],
                     [VAR=`echo $ac_arg | sed -e 's,.*% *,,'` ; break])
 done
 FLAGS="$ac_save_[]FLAGS"
 ])
 AS_VAR_POPDEF([FLAGS])dnl
 AX_REQUIRE_DEFINED([AX_APPEND_FLAG])
 case ".$VAR" in
     .ok|.ok,*) m4_ifvaln($3,$3) ;;
   .|.no|.no,*) m4_default($4,[m4_ifval($2,[AX_APPEND_FLAG([$2], [$1])])]) ;;
   *) m4_default($3,[AX_APPEND_FLAG([$VAR], [$1])]) ;;
 esac
 AS_VAR_POPDEF([VAR])dnl
 ])dnl AX_FLAGS_WARN_ALL
 dnl  implementation tactics:
 dnl   the for-argument contains a list of options. The first part of
 dnl   these does only exist to detect the compiler - usually it is
 dnl   a global option to enable -ansi or -extrawarnings. All other
 dnl   compilers will fail about it. That was needed since a lot of
 dnl   compilers will give false positives for some option-syntax
 dnl   like -Woption or -Xoption as they think of it is a pass-through
 dnl   to later compile stages or something. The "%" is used as a
 dnl   delimiter. A non-option comment can be given after "%%" marks
 dnl   which will be shown but not added to the respective C/CXXFLAGS.
 AC_DEFUN([AX_CFLAGS_WARN_ALL],[dnl
 AC_LANG_PUSH([C])
 AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
 AC_LANG_POP([C])
 ])
 AC_DEFUN([AX_CXXFLAGS_WARN_ALL],[dnl
 AC_LANG_PUSH([C++])
 AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
 AC_LANG_POP([C++])
 ])
 AC_DEFUN([AX_FCFLAGS_WARN_ALL],[dnl
 AC_LANG_PUSH([Fortran])
 AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
 AC_LANG_POP([Fortran])
 ])
--- a/m4/ax_require_defined.m4
+++ b/m4/ax_require_defined.m4
@ -1,37 +0,0 @@
 # ===========================================================================
 #    http://www.gnu.org/software/autoconf-archive/ax_require_defined.html
 # ===========================================================================
 #
 # SYNOPSIS
 #
 #   AX_REQUIRE_DEFINED(MACRO)
 #
 # DESCRIPTION
 #
 #   AX_REQUIRE_DEFINED is a simple helper for making sure other macros have
 #   been defined and thus are available for use.  This avoids random issues
 #   where a macro isn't expanded.  Instead the configure script emits a
 #   non-fatal:
 #
 #     ./configure: line 1673: AX_CFLAGS_WARN_ALL: command not found
 #
 #   It's like AC_REQUIRE except it doesn't expand the required macro.
 #
 #   Here's an example:
 #
 #     AX_REQUIRE_DEFINED([AX_CHECK_LINK_FLAG])
 #
 # LICENSE
 #
 #   Copyright (c) 2014 Mike Frysinger <vapier@gentoo.org>
 #
 #   Copying and distribution of this file, with or without modification, are
 #   permitted in any medium without royalty provided the copyright notice
 #   and this notice are preserved. This file is offered as-is, without any
 #   warranty.
 #serial 1
 AC_DEFUN([AX_REQUIRE_DEFINED], [dnl
  m4_ifndef([$1], [m4_fatal([macro ]$1[ is not defined; is a m4 file missing?])])
 ])dnl AX_REQUIRE_DEFINED
--- a/m4/curses.m4
+++ b/m4/curses.m4
@ -0,0 +1,44 @@
 dnl Check to find the curses headers/libraries
 AC_DEFUN([tinc_CURSES],
 [
  AC_ARG_ENABLE([curses],
    AS_HELP_STRING([--disable-curses], [disable curses support]))
  AS_IF([test "x$enable_curses" != "xno"], [
  AC_DEFINE(HAVE_CURSES, 1, [have curses support])
    curses=true
    AC_ARG_WITH(curses,
      AS_HELP_STRING([--with-curses=DIR], [curses base directory, or:]),
      [curses="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval/include"
       LDFLAGS="$LDFLAGS -L$withval/lib"]
    )
    AC_ARG_WITH(curses-include,
      AS_HELP_STRING([--with-curses-include=DIR], [curses headers directory]),
      [curses_include="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval"]
    )
    AC_ARG_WITH(curses-lib,
      AS_HELP_STRING([--with-curses-lib=DIR], [curses library directory]),
      [curses_lib="$withval"
       LDFLAGS="$LDFLAGS -L$withval"]
    )
    AC_CHECK_HEADERS(curses.h,
      [],
      [AC_MSG_ERROR("curses header files not found."); break]
    )
    AC_CHECK_LIB(ncurses, initscr,
      [CURSES_LIBS="-lncurses"],
      [AC_CHECK_LIB(curses, initscr,
        [CURSES_LIBS="-lcurses"],
        [AC_MSG_ERROR("curses libraries not found.")]
      )]
    )
  ])
  AC_SUBST(CURSES_LIBS)
 ])
--- a/m4/libgcrypt.m4
+++ b/m4/libgcrypt.m4
@ -0,0 +1,33 @@
 dnl Check to find the libgcrypt headers/libraries
 AC_DEFUN([tinc_LIBGCRYPT],
 [
  AC_ARG_WITH(libgcrypt,
    AS_HELP_STRING([--with-libgcrypt=DIR], [libgcrypt base directory, or:]),
    [libgcrypt="$withval"
     CPPFLAGS="$CPPFLAGS -I$withval/include"
     LDFLAGS="$LDFLAGS -L$withval/lib"]
  )
  AC_ARG_WITH(libgcrypt-include,
    AS_HELP_STRING([--with-libgcrypt-include=DIR], [libgcrypt headers directory (without trailing /libgcrypt)]),
    [libgcrypt_include="$withval"
     CPPFLAGS="$CPPFLAGS -I$withval"]
  )
  AC_ARG_WITH(libgcrypt-lib,
    AS_HELP_STRING([--with-libgcrypt-lib=DIR], [libgcrypt library directory]),
    [libgcrypt_lib="$withval"
     LDFLAGS="$LDFLAGS -L$withval"]
  )
  AC_CHECK_HEADERS([gcrypt.h],
    [],
    [AC_MSG_ERROR([libgcrypt header files not found.]); break]
  )
  AC_CHECK_LIB(gcrypt, gcry_cipher_encrypt,
    [LIBS="-lgcrypt $LIBS"],
    [AC_MSG_ERROR([libgcrypt libraries not found.])]
  )
 ])
--- a/m4/miniupnpc.m4
+++ b/m4/miniupnpc.m4
@ -0,0 +1,40 @@
 dnl Check to find the miniupnpc headers/libraries
 AC_DEFUN([tinc_MINIUPNPC],
 [
  AC_ARG_ENABLE([miniupnpc],
    AS_HELP_STRING([--enable-miniupnpc], [enable miniupnpc support]))
  AS_IF([test "x$enable_miniupnpc" = "xyes"], [
  AC_DEFINE(HAVE_MINIUPNPC, 1, [have miniupnpc support])
    AC_ARG_WITH(miniupnpc,
      AS_HELP_STRING([--with-miniupnpc=DIR], [miniupnpc base directory, or:]),
      [miniupnpc="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval/include"
       LDFLAGS="$LDFLAGS -L$withval/lib"]
    )
    AC_ARG_WITH(miniupnpc-include,
      AS_HELP_STRING([--with-miniupnpc-include=DIR], [miniupnpc headers directory]),
      [miniupnpc_include="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval"]
    )
    AC_ARG_WITH(miniupnpc-lib,
      AS_HELP_STRING([--with-miniupnpc-lib=DIR], [miniupnpc library directory]),
      [miniupnpc_lib="$withval"
       LDFLAGS="$LDFLAGS -L$withval"]
    )
    AC_CHECK_HEADERS(miniupnpc/miniupnpc.h,
      [],
      [AC_MSG_ERROR("miniupnpc header files not found."); break]
    )
    AC_CHECK_LIB(miniupnpc, upnpDiscover,
      [MINIUPNPC_LIBS="$LIBS -lminiupnpc"],
      [AC_MSG_ERROR("miniupnpc libraries not found.")]
    )
  ])
  AC_SUBST(MINIUPNPC_LIBS)
 ])
--- a/m4/openssl.m4
+++ b/m4/openssl.m4
@ -35,7 +35,7 @@ AC_DEFUN([tinc_OPENSSL],
     LDFLAGS="$LDFLAGS -L$withval"]
  )
-  AC_CHECK_HEADERS(openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h,
+  AC_CHECK_HEADERS([openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h],
    [],
    [AC_MSG_ERROR([LibreSSL/OpenSSL header files not found.]); break]
  )
@ -45,14 +45,12 @@ AC_DEFUN([tinc_OPENSSL],
    [AC_MSG_ERROR([LibreSSL/OpenSSL libraries not found.])]
  )
-  AC_CHECK_FUNCS([RAND_bytes EVP_EncryptInit_ex EVP_CIPHER_CTX_new], ,
+  AC_CHECK_FUNCS([RAND_status EVP_EncryptInit_ex], ,
    [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
  )
-  AC_CHECK_DECLS([OpenSSL_add_all_algorithms, EVP_aes_256_cfb], ,
+  AC_CHECK_DECLS([OpenSSL_add_all_algorithms], ,
    [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
    [#include <openssl/evp.h>]
  )
  AC_CHECK_FUNCS([BN_GENCB_new RSA_set0_key], , , [#include <openssl/rsa.h>])
 ])
--- a/m4/readline.m4
+++ b/m4/readline.m4
@ -0,0 +1,42 @@
 dnl Check to find the readline headers/libraries
 AC_DEFUN([tinc_READLINE],
 [
  AC_ARG_ENABLE([readline],
    AS_HELP_STRING([--disable-readline], [disable readline support]))
  AS_IF([test "x$enable_readline" != "xno"], [
  AC_DEFINE(HAVE_READLINE, 1, [have readline support])
    readline=true
    AC_ARG_WITH(readline,
      AS_HELP_STRING([--with-readline=DIR], [readline base directory, or:]),
      [readline="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval/include"
       LDFLAGS="$LDFLAGS -L$withval/lib"]
    )
    AC_ARG_WITH(readline-include,
      AS_HELP_STRING([--with-readline-include=DIR], [readline headers directory]),
      [readline_include="$withval"
       CPPFLAGS="$CPPFLAGS -I$withval"]
    )
    AC_ARG_WITH(readline-lib,
      AS_HELP_STRING([--with-readline-lib=DIR], [readline library directory]),
      [readline_lib="$withval"
       LDFLAGS="$LDFLAGS -L$withval"]
    )
    AC_CHECK_HEADERS([readline/readline.h readline/history.h],
      [],
      [AC_MSG_ERROR("readline header files not found."); break]
    )
    AC_CHECK_LIB(readline, readline,
      [READLINE_LIBS="-lreadline"],
      [AC_MSG_ERROR("readline library not found.")],
      [$CURSES_LIBS]
    )
  ])
  AC_SUBST(READLINE_LIBS)
 ])
--- a/16
+++ b/16
@ -1,9 +1,9 @@
 #! /bin/sh
 # Common wrapper for a few potentially missing GNU programs.
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2013-10-28.13; # UTC
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 # This program is free software; you can redistribute it and/or modify
@ -17,7 +17,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@ -101,9 +101,9 @@ else
  exit $st
 fi
-perl_URL=https://www.perl.org/
+perl_URL=http://www.perl.org/
-flex_URL=https://github.com/westes/flex
+flex_URL=http://flex.sourceforge.net/
-gnu_software_URL=https://www.gnu.org/software
+gnu_software_URL=http://www.gnu.org/software
 program_details ()
 {
@ -207,9 +207,9 @@ give_advice "$1" | sed -e '1s/^/WARNING: /' \
 exit $st
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:
--- a/src/Makefile.am
+++ b/src/Makefile.am
@ -1,54 +1,170 @@
 ## Produce this file with automake to get Makefile.in
-sbin_PROGRAMS = tincd
+sbin_PROGRAMS = tincd tinc sptps_test sptps_keypair
 CLEANFILES = version_git.h
 .PHONY: version-stamp
 version-stamp:
 version_git.h: version-stamp
 	$(AM_V_GEN)echo >$@
 	@-(cd $(srcdir) && git describe 2>/dev/null >/dev/null) && echo '#define GIT_DESCRIPTION "'`(cd $(srcdir) && git describe) | sed 's/release-//'`'"' >$@ ||:
 ${srcdir}/version.c: version_git.h
 ## Now a hack to appease some versions of BSD make that don't understand that "./foo" is the same as "foo".
 if BSD
 version.c: ${srcdir}/version.c
 endif
 if LINUX
 sbin_PROGRAMS += sptps_speed
 endif
 ed25519_SOURCES = \
 	ed25519/add_scalar.c \
 	ed25519/ed25519.h \
 	ed25519/fe.c ed25519/fe.h \
 	ed25519/fixedint.h \
 	ed25519/ge.c ed25519/ge.h \
 	ed25519/key_exchange.c \
 	ed25519/keypair.c \
 	ed25519/precomp_data.h \
 	ed25519/sc.c ed25519/sc.h \
 	ed25519/sha512.c ed25519/sha512.h \
 	ed25519/sign.c \
 	ed25519/verify.c
 chacha_poly1305_SOURCES = \
 	chacha-poly1305/chacha.c chacha-poly1305/chacha.h \
 	chacha-poly1305/chacha-poly1305.c chacha-poly1305/chacha-poly1305.h \
 	chacha-poly1305/poly1305.c chacha-poly1305/poly1305.h
 tincd_SOURCES = \
-	have.h \
+	buffer.c buffer.h \
-	system.h \
+	cipher.h \
 	avl_tree.c avl_tree.h \
 	conf.c conf.h \
 	connection.c connection.h \
 	control.c control.h \
 	control_common.h \
 	crypto.h \
 	device.h \
 	digest.h \
 	dropin.c dropin.h \
 	dummy_device.c \
 	ecdh.h \
 	ecdsa.h \
 	ecdsagen.h \
 	edge.c edge.h \
 	ethernet.h \
 	event.c event.h \
 	fake-getaddrinfo.c fake-getaddrinfo.h \
 	fake-getnameinfo.c fake-getnameinfo.h \
 	graph.c graph.h \
 	hash.c hash.h \
 	have.h \
 	ipv4.h \
 	ipv6.h \
 	list.c list.h \
 	logger.c logger.h \
 	meta.c meta.h \
 	multicast_device.c \
 	names.c names.h \
 	net.c net.h \
 	net_packet.c \
 	net_setup.c \
 	net_socket.c \
 	netutl.c netutl.h \
 	node.c node.h \
-	pidfile.c pidfile.h \
+	prf.h \
 	process.c process.h \
 	protocol.c protocol.h \
 	protocol_auth.c \
 	protocol_edge.c \
 	protocol_misc.c \
 	protocol_key.c \
 	protocol_misc.c \
 	protocol_subnet.c \
 	proxy.c proxy.h \
 	raw_socket_device.c \
 	route.c route.h \
 	rsa.h \
 	rsagen.h \
 	script.c script.h \
 	splay_tree.c splay_tree.h \
 	sptps.c sptps.h \
 	subnet.c subnet.h \
 	subnet_parse.c \
 	system.h \
 	tincd.c \
 	utils.c utils.h \
-	xalloc.h
+	xalloc.h \
 	version.c version.h \
 	ed25519/ecdh.c \
 	ed25519/ecdsa.c \
 	$(ed25519_SOURCES) \
 	$(chacha_poly1305_SOURCES)
 tinc_SOURCES = \
 	dropin.c dropin.h \
 	fsck.c fsck.h \
 	ifconfig.c ifconfig.h \
 	info.c info.h \
 	invitation.c invitation.h \
 	list.c list.h \
 	names.c names.h \
 	netutl.c netutl.h \
 	script.c script.h \
 	sptps.c sptps.h \
 	subnet_parse.c subnet.h \
 	tincctl.c tincctl.h \
 	top.c top.h \
 	utils.c utils.h \
 	version.c version.h \
 	ed25519/ecdh.c \
 	ed25519/ecdsa.c \
 	ed25519/ecdsagen.c \
 	$(ed25519_SOURCES) \
 	$(chacha_poly1305_SOURCES)
 sptps_test_SOURCES = \
 	logger.c logger.h \
 	sptps.c sptps.h \
 	sptps_test.c \
 	utils.c utils.h \
 	ed25519/ecdh.c \
 	ed25519/ecdsa.c \
 	$(ed25519_SOURCES) \
 	$(chacha_poly1305_SOURCES)
 sptps_keypair_SOURCES = \
 	sptps_keypair.c \
 	utils.c utils.h \
 	ed25519/ecdsagen.c \
 	$(ed25519_SOURCES)
 sptps_speed_SOURCES = \
 	logger.c logger.h \
 	sptps.c sptps.h \
 	sptps_speed.c \
 	utils.c utils.h \
 	ed25519/ecdh.c \
 	ed25519/ecdsa.c \
 	ed25519/ecdsagen.c \
 	$(ed25519_SOURCES) \
 	$(chacha_poly1305_SOURCES)
 ## Conditionally compile device drivers
 if !GETOPT
 tincd_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
 tinc_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
 sptps_test_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
 sptps_keypair_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
 endif
 if LINUX
@ -82,8 +198,87 @@ if VDE
 tincd_SOURCES += vde_device.c
 endif
 if OPENSSL
 tincd_SOURCES += \
 	openssl/cipher.c \
 	openssl/crypto.c \
 	openssl/digest.c openssl/digest.h \
 	openssl/prf.c \
 	openssl/rsa.c
 tinc_SOURCES += \
 	openssl/cipher.c \
 	openssl/crypto.c \
 	openssl/digest.c openssl/digest.h \
 	openssl/prf.c \
 	openssl/rsa.c \
 	openssl/rsagen.c
 sptps_test_SOURCES += \
 	openssl/crypto.c \
 	openssl/digest.c openssl/digest.h \
 	openssl/prf.c
 sptps_keypair_SOURCES += \
 	openssl/crypto.c
 sptps_speed_SOURCES += \
 	openssl/crypto.c \
 	openssl/digest.c openssl/digest.h \
 	openssl/prf.c
 else
 if GCRYPT
 tincd_SOURCES += \
 	gcrypt/cipher.c \
 	gcrypt/crypto.c \
 	gcrypt/digest.c gcrypt/digest.h \
 	gcrypt/prf.c \
 	gcrypt/rsa.c
 tinc_SOURCES += \
 	gcrypt/cipher.c \
 	gcrypt/crypto.c \
 	gcrypt/digest.c gcrypt/digest.h \
 	gcrypt/prf.c \
 	gcrypt/rsa.c \
 	gcrypt/rsagen.c
 sptps_test_SOURCES += \
 	gcrypt/cipher.c \
 	gcrypt/crypto.c \
 	gcrypt/digest.c gcrypt/digest.h \
 	gcrypt/prf.c
 sptps_keypair_SOURCES += \
 	openssl/crypto.c
 sptps_speed_SOURCES += \
 	openssl/crypto.c \
 	openssl/digest.c openssl/digest.h \
 	openssl/prf.c
 else
 tincd_SOURCES += \
 	nolegacy/crypto.c \
 	nolegacy/prf.c
 tinc_SOURCES += \
 	nolegacy/crypto.c \
 	nolegacy/prf.c
 sptps_test_SOURCES += \
 	nolegacy/crypto.c \
 	nolegacy/prf.c
 sptps_keypair_SOURCES += \
 	nolegacy/crypto.c
 sptps_speed_SOURCES += \
 	nolegacy/crypto.c \
 	nolegacy/prf.c
 endif
 endif
 if MINIUPNPC
 tincd_SOURCES += upnp.h upnp.c
 tincd_LDADD = $(MINIUPNPC_LIBS)
 tincd_LDFLAGS = -pthread
 endif
 tinc_LDADD = $(READLINE_LIBS) $(CURSES_LIBS)
 sptps_speed_LDADD = -lrt
 LIBS = @LIBS@ -lm
 if TUNEMU
 LIBS += -lpcap
 endif
-AM_CPPFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DRUNSTATEDIR=\"$(runstatedir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -I $(abs_top_builddir)/
+AM_CFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -DSBINDIR=\"$(sbindir)\" -iquote.
--- a/src/Makefile.in
+++ b/src/Makefile.in
--- a/src/avl_tree.c
+++ b/src/avl_tree.c
@ -1,757 +0,0 @@
 /*
    avl_tree.c -- avl_ tree and linked list convenience
    Copyright (C) 1998 Michael H. Buselli
                  2000-2005 Ivo Timmermans,
                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
    instead of depths, to add the ->next and ->prev and to generally obfuscate
    the code. Mail me if you found a bug.
    Cleaned up and incorporated some of the ideas from the red-black tree
    library for inclusion into tinc (https://www.tinc-vpn.org/) by
    Guus Sliepen <guus@tinc-vpn.org>.
 */
 #include "system.h"
 #include "avl_tree.h"
 #include "xalloc.h"
 #ifdef AVL_COUNT
 #define AVL_NODE_COUNT(n)  ((n) ? (n)->count : 0)
 #define AVL_L_COUNT(n)     (AVL_NODE_COUNT((n)->left))
 #define AVL_R_COUNT(n)     (AVL_NODE_COUNT((n)->right))
 #define AVL_CALC_COUNT(n)  (AVL_L_COUNT(n) + AVL_R_COUNT(n) + 1)
 #endif
 #ifdef AVL_DEPTH
 #define AVL_NODE_DEPTH(n)  ((n) ? (n)->depth : 0)
 #define L_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->left))
 #define R_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->right))
 #define AVL_CALC_DEPTH(n)  ((L_AVL_DEPTH(n)>R_AVL_DEPTH(n)?L_AVL_DEPTH(n):R_AVL_DEPTH(n)) + 1)
 #endif
 #ifndef AVL_DEPTH
 static int lg(unsigned int u) __attribute__((__const__));
 static int lg(unsigned int u) {
 	int r = 1;
 	if(!u) {
 		return 0;
 	}
 	if(u & 0xffff0000) {
 		u >>= 16;
 		r += 16;
 	}
 	if(u & 0x0000ff00) {
 		u >>= 8;
 		r += 8;
 	}
 	if(u & 0x000000f0) {
 		u >>= 4;
 		r += 4;
 	}
 	if(u & 0x0000000c) {
 		u >>= 2;
 		r += 2;
 	}
 	if(u & 0x00000002) {
 		r++;
 	}
 	return r;
 }
 #endif
 /* Internal helper functions */
 static int avl_check_balance(const avl_node_t *node) {
 #ifdef AVL_DEPTH
 	int d;
 	d = R_AVL_DEPTH(node) - L_AVL_DEPTH(node);
 	return d < -1 ? -1 : d > 1 ? 1 : 0;
 #else
 	/*      int d;
 	 *      d = lg(AVL_R_COUNT(node)) - lg(AVL_L_COUNT(node));
 	 *      d = d<-1?-1:d>1?1:0;
 	 */
 	int pl, r;
 	pl = lg(AVL_L_COUNT(node));
 	r = AVL_R_COUNT(node);
 	if(r >> pl + 1) {
 		return 1;
 	}
 	if(pl < 2 || r >> pl - 2) {
 		return 0;
 	}
 	return -1;
 #endif
 }
 static void avl_rebalance(avl_tree_t *tree, avl_node_t *node) {
 	avl_node_t *child;
 	avl_node_t *gchild;
 	avl_node_t *parent;
 	avl_node_t **superparent;
 	while(node) {
 		parent = node->parent;
 		superparent =
 		        parent ? node ==
 		        parent->left ? &parent->left : &parent->right : &tree->root;
 		switch(avl_check_balance(node)) {
 		case -1:
 			child = node->left;
 #ifdef AVL_DEPTH
 			if(L_AVL_DEPTH(child) >= R_AVL_DEPTH(child)) {
 #else
 			if(AVL_L_COUNT(child) >= AVL_R_COUNT(child)) {
 #endif
 				node->left = child->right;
 				if(node->left) {
 					node->left->parent = node;
 				}
 				child->right = node;
 				node->parent = child;
 				*superparent = child;
 				child->parent = parent;
 #ifdef AVL_COUNT
 				node->count = AVL_CALC_COUNT(node);
 				child->count = AVL_CALC_COUNT(child);
 #endif
 #ifdef AVL_DEPTH
 				node->depth = AVL_CALC_DEPTH(node);
 				child->depth = AVL_CALC_DEPTH(child);
 #endif
 			} else {
 				gchild = child->right;
 				node->left = gchild->right;
 				if(node->left) {
 					node->left->parent = node;
 				}
 				child->right = gchild->left;
 				if(child->right) {
 					child->right->parent = child;
 				}
 				gchild->right = node;
 				gchild->right->parent = gchild;
 				gchild->left = child;
 				gchild->left->parent = gchild;
 				*superparent = gchild;
 				gchild->parent = parent;
 #ifdef AVL_COUNT
 				node->count = AVL_CALC_COUNT(node);
 				child->count = AVL_CALC_COUNT(child);
 				gchild->count = AVL_CALC_COUNT(gchild);
 #endif
 #ifdef AVL_DEPTH
 				node->depth = AVL_CALC_DEPTH(node);
 				child->depth = AVL_CALC_DEPTH(child);
 				gchild->depth = AVL_CALC_DEPTH(gchild);
 #endif
 			}
 			break;
 		case 1:
 			child = node->right;
 #ifdef AVL_DEPTH
 			if(R_AVL_DEPTH(child) >= L_AVL_DEPTH(child)) {
 #else
 			if(AVL_R_COUNT(child) >= AVL_L_COUNT(child)) {
 #endif
 				node->right = child->left;
 				if(node->right) {
 					node->right->parent = node;
 				}
 				child->left = node;
 				node->parent = child;
 				*superparent = child;
 				child->parent = parent;
 #ifdef AVL_COUNT
 				node->count = AVL_CALC_COUNT(node);
 				child->count = AVL_CALC_COUNT(child);
 #endif
 #ifdef AVL_DEPTH
 				node->depth = AVL_CALC_DEPTH(node);
 				child->depth = AVL_CALC_DEPTH(child);
 #endif
 			} else {
 				gchild = child->left;
 				node->right = gchild->left;
 				if(node->right) {
 					node->right->parent = node;
 				}
 				child->left = gchild->right;
 				if(child->left) {
 					child->left->parent = child;
 				}
 				gchild->left = node;
 				gchild->left->parent = gchild;
 				gchild->right = child;
 				gchild->right->parent = gchild;
 				*superparent = gchild;
 				gchild->parent = parent;
 #ifdef AVL_COUNT
 				node->count = AVL_CALC_COUNT(node);
 				child->count = AVL_CALC_COUNT(child);
 				gchild->count = AVL_CALC_COUNT(gchild);
 #endif
 #ifdef AVL_DEPTH
 				node->depth = AVL_CALC_DEPTH(node);
 				child->depth = AVL_CALC_DEPTH(child);
 				gchild->depth = AVL_CALC_DEPTH(gchild);
 #endif
 			}
 			break;
 		default:
 #ifdef AVL_COUNT
 			node->count = AVL_CALC_COUNT(node);
 #endif
 #ifdef AVL_DEPTH
 			node->depth = AVL_CALC_DEPTH(node);
 #endif
 		}
 		node = parent;
 	}
 }
 /* (De)constructors */
 avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete) {
 	avl_tree_t *tree;
 	tree = xmalloc_and_zero(sizeof(avl_tree_t));
 	tree->compare = compare;
 	tree->delete = delete;
 	return tree;
 }
 void avl_free_tree(avl_tree_t *tree) {
 	free(tree);
 }
 avl_node_t *avl_alloc_node(void) {
 	return xmalloc_and_zero(sizeof(avl_node_t));
 }
 void avl_free_node(avl_tree_t *tree, avl_node_t *node) {
 	if(node->data && tree->delete) {
 		tree->delete(node->data);
 	}
 	free(node);
 }
 /* Searching */
 void *avl_search(const avl_tree_t *tree, const void *data) {
 	avl_node_t *node;
 	node = avl_search_node(tree, data);
 	return node ? node->data : NULL;
 }
 void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result) {
 	avl_node_t *node;
 	node = avl_search_closest_node(tree, data, result);
 	return node ? node->data : NULL;
 }
 void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data) {
 	avl_node_t *node;
 	node = avl_search_closest_smaller_node(tree, data);
 	return node ? node->data : NULL;
 }
 void *avl_search_closest_greater(const avl_tree_t *tree, const void *data) {
 	avl_node_t *node;
 	node = avl_search_closest_greater_node(tree, data);
 	return node ? node->data : NULL;
 }
 avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data) {
 	avl_node_t *node;
 	int result;
 	node = avl_search_closest_node(tree, data, &result);
 	return result ? NULL : node;
 }
 avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data,
                                    int *result) {
 	avl_node_t *node;
 	int c;
 	node = tree->root;
 	if(!node) {
 		if(result) {
 			*result = 0;
 		}
 		return NULL;
 	}
 	for(;;) {
 		c = tree->compare(data, node->data);
 		if(c < 0) {
 			if(node->left) {
 				node = node->left;
 			} else {
 				if(result) {
 					*result = -1;
 				}
 				break;
 			}
 		} else if(c > 0) {
 			if(node->right) {
 				node = node->right;
 			} else {
 				if(result) {
 					*result = 1;
 				}
 				break;
 			}
 		} else {
 			if(result) {
 				*result = 0;
 			}
 			break;
 		}
 	}
 	return node;
 }
 avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree,
                const void *data) {
 	avl_node_t *node;
 	int result;
 	node = avl_search_closest_node(tree, data, &result);
 	if(result < 0) {
 		node = node->prev;
 	}
 	return node;
 }
 avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree,
                const void *data) {
 	avl_node_t *node;
 	int result;
 	node = avl_search_closest_node(tree, data, &result);
 	if(result > 0) {
 		node = node->next;
 	}
 	return node;
 }
 /* Insertion and deletion */
 avl_node_t *avl_insert(avl_tree_t *tree, void *data) {
 	avl_node_t *closest, *new;
 	int result;
 	if(!tree->root) {
 		new = avl_alloc_node();
 		new->data = data;
 		avl_insert_top(tree, new);
 	} else {
 		closest = avl_search_closest_node(tree, data, &result);
 		switch(result) {
 		case -1:
 			new = avl_alloc_node();
 			new->data = data;
 			avl_insert_before(tree, closest, new);
 			break;
 		case 1:
 			new = avl_alloc_node();
 			new->data = data;
 			avl_insert_after(tree, closest, new);
 			break;
 		default:
 			return NULL;
 		}
 	}
 #ifdef AVL_COUNT
 	new->count = 1;
 #endif
 #ifdef AVL_DEPTH
 	new->depth = 1;
 #endif
 	return new;
 }
 avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node) {
 	avl_node_t *closest;
 	int result;
 	if(!tree->root) {
 		avl_insert_top(tree, node);
 	} else {
 		closest = avl_search_closest_node(tree, node->data, &result);
 		switch(result) {
 		case -1:
 			avl_insert_before(tree, closest, node);
 			break;
 		case 1:
 			avl_insert_after(tree, closest, node);
 			break;
 		case 0:
 			return NULL;
 		}
 	}
 #ifdef AVL_COUNT
 	node->count = 1;
 #endif
 #ifdef AVL_DEPTH
 	node->depth = 1;
 #endif
 	return node;
 }
 void avl_insert_top(avl_tree_t *tree, avl_node_t *node) {
 	node->prev = node->next = node->parent = NULL;
 	tree->head = tree->tail = tree->root = node;
 }
 void avl_insert_before(avl_tree_t *tree, avl_node_t *before,
                       avl_node_t *node) {
 	if(!before) {
 		if(tree->tail) {
 			avl_insert_after(tree, tree->tail, node);
 		} else {
 			avl_insert_top(tree, node);
 		}
 		return;
 	}
 	node->next = before;
 	node->parent = before;
 	node->prev = before->prev;
 	if(before->left) {
 		avl_insert_after(tree, before->prev, node);
 		return;
 	}
 	if(before->prev) {
 		before->prev->next = node;
 	} else {
 		tree->head = node;
 	}
 	before->prev = node;
 	before->left = node;
 	avl_rebalance(tree, before);
 }
 void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node) {
 	if(!after) {
 		if(tree->head) {
 			avl_insert_before(tree, tree->head, node);
 		} else {
 			avl_insert_top(tree, node);
 		}
 		return;
 	}
 	if(after->right) {
 		avl_insert_before(tree, after->next, node);
 		return;
 	}
 	node->prev = after;
 	node->parent = after;
 	node->next = after->next;
 	if(after->next) {
 		after->next->prev = node;
 	} else {
 		tree->tail = node;
 	}
 	after->next = node;
 	after->right = node;
 	avl_rebalance(tree, after);
 }
 avl_node_t *avl_unlink(avl_tree_t *tree, void *data) {
 	avl_node_t *node;
 	node = avl_search_node(tree, data);
 	if(node) {
 		avl_unlink_node(tree, node);
 	}
 	return node;
 }
 void avl_unlink_node(avl_tree_t *tree, avl_node_t *node) {
 	avl_node_t *parent;
 	avl_node_t **superparent;
 	avl_node_t *subst, *left, *right;
 	avl_node_t *balnode;
 	if(node->prev) {
 		node->prev->next = node->next;
 	} else {
 		tree->head = node->next;
 	}
 	if(node->next) {
 		node->next->prev = node->prev;
 	} else {
 		tree->tail = node->prev;
 	}
 	parent = node->parent;
 	superparent =
 	        parent ? node ==
 	        parent->left ? &parent->left : &parent->right : &tree->root;
 	left = node->left;
 	right = node->right;
 	if(!left) {
 		*superparent = right;
 		if(right) {
 			right->parent = parent;
 		}
 		balnode = parent;
 	} else if(!right) {
 		*superparent = left;
 		left->parent = parent;
 		balnode = parent;
 	} else {
 		subst = node->prev;
 		if(!subst) { // This only happens if node is not actually in a tree at all.
 			abort();
 		}
 		if(subst == left) {
 			balnode = subst;
 		} else {
 			balnode = subst->parent;
 			balnode->right = subst->left;
 			if(balnode->right) {
 				balnode->right->parent = balnode;
 			}
 			subst->left = left;
 			left->parent = subst;
 		}
 		subst->right = right;
 		subst->parent = parent;
 		right->parent = subst;
 		*superparent = subst;
 	}
 	avl_rebalance(tree, balnode);
 	node->next = node->prev = node->parent = node->left = node->right = NULL;
 #ifdef AVL_COUNT
 	node->count = 0;
 #endif
 #ifdef AVL_DEPTH
 	node->depth = 0;
 #endif
 }
 void avl_delete_node(avl_tree_t *tree, avl_node_t *node) {
 	avl_unlink_node(tree, node);
 	avl_free_node(tree, node);
 }
 void avl_delete(avl_tree_t *tree, void *data) {
 	avl_node_t *node;
 	node = avl_search_node(tree, data);
 	if(node) {
 		avl_delete_node(tree, node);
 	}
 }
 /* Fast tree cleanup */
 void avl_delete_tree(avl_tree_t *tree) {
 	avl_node_t *node, *next;
 	for(node = tree->head; node; node = next) {
 		next = node->next;
 		avl_free_node(tree, node);
 	}
 	avl_free_tree(tree);
 }
 /* Tree walking */
 void avl_foreach(const avl_tree_t *tree, avl_action_t action) {
 	avl_node_t *node, *next;
 	for(node = tree->head; node; node = next) {
 		next = node->next;
 		action(node->data);
 	}
 }
 void avl_foreach_node(const avl_tree_t *tree, avl_action_t action) {
 	avl_node_t *node, *next;
 	for(node = tree->head; node; node = next) {
 		next = node->next;
 		action(node);
 	}
 }
 /* Indexing */
 #ifdef AVL_COUNT
 unsigned int avl_count(const avl_tree_t *tree) {
 	return AVL_NODE_COUNT(tree->root);
 }
 avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index) {
 	avl_node_t *node;
 	unsigned int c;
 	node = tree->root;
 	while(node) {
 		c = AVL_L_COUNT(node);
 		if(index < c) {
 			node = node->left;
 		} else if(index > c) {
 			node = node->right;
 			index -= c + 1;
 		} else {
 			return node;
 		}
 	}
 	return NULL;
 }
 unsigned int avl_index(const avl_node_t *node) {
 	avl_node_t *next;
 	unsigned int index;
 	index = AVL_L_COUNT(node);
 	while((next = node->parent)) {
 		if(node == next->right) {
 			index += AVL_L_COUNT(next) + 1;
 		}
 		node = next;
 	}
 	return index;
 }
 #endif
 #ifdef AVL_DEPTH
 unsigned int avl_depth(const avl_tree_t *tree) {
 	return AVL_NODE_DEPTH(tree->root);
 }
 #endif
--- a/src/avl_tree.h
+++ b/src/avl_tree.h
@ -1,142 +0,0 @@
 #ifndef TINC_AVL_TREE_H
 #define TINC_AVL_TREE_H
 /*
    avl_tree.h -- header file for avl_tree.c
    Copyright (C) 1998 Michael H. Buselli
                  2000-2005 Ivo Timmermans,
                  2000-2006 Guus Sliepen <guus@tinc-vpn.org>
                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
    instead of depths, to add the ->next and ->prev and to generally obfuscate
    the code. Mail me if you found a bug.
    Cleaned up and incorporated some of the ideas from the red-black tree
    library for inclusion into tinc (https://www.tinc-vpn.org/) by
    Guus Sliepen <guus@tinc-vpn.org>.
 */
 #ifndef AVL_DEPTH
 #ifndef AVL_COUNT
 #define AVL_DEPTH
 #endif
 #endif
 typedef struct avl_node_t {
 	/* Linked list part */
 	struct avl_node_t *next;
 	struct avl_node_t *prev;
 	/* Tree part */
 	struct avl_node_t *parent;
 	struct avl_node_t *left;
 	struct avl_node_t *right;
 #ifdef AVL_COUNT
 	unsigned int count;
 #endif
 #ifdef AVL_DEPTH
 	unsigned char depth;
 #endif
 	/* Payload */
 	void *data;
 } avl_node_t;
 typedef int (*avl_compare_t)(const void *data1, const void *data2);
 typedef void (*avl_action_t)(const void *data);
 typedef void (*avl_action_node_t)(const avl_node_t *node);
 typedef struct avl_tree_t {
 	/* Linked list part */
 	avl_node_t *head;
 	avl_node_t *tail;
 	/* Tree part */
 	avl_node_t *root;
 	avl_compare_t compare;
 	avl_action_t delete;
 } avl_tree_t;
 /* (De)constructors */
 extern avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete);
 extern void avl_free_tree(avl_tree_t *tree);
 extern avl_node_t *avl_alloc_node(void);
 extern void avl_free_node(avl_tree_t *tree, avl_node_t *node);
 /* Insertion and deletion */
 extern avl_node_t *avl_insert(avl_tree_t *tree, void *data);
 extern avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node);
 extern void avl_insert_top(avl_tree_t *tree, avl_node_t *node);
 extern void avl_insert_before(avl_tree_t *tree, avl_node_t *before, avl_node_t *node);
 extern void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node);
 extern avl_node_t *avl_unlink(avl_tree_t *tree, void *data);
 extern void avl_unlink_node(avl_tree_t *tree, avl_node_t *node);
 extern void avl_delete(avl_tree_t *tree, void *data);
 extern void avl_delete_node(avl_tree_t *tree, avl_node_t *node);
 /* Fast tree cleanup */
 extern void avl_delete_tree(avl_tree_t *tree);
 /* Searching */
 extern void *avl_search(const avl_tree_t *tree, const void *data);
 extern void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result);
 extern void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data);
 extern void *avl_search_closest_greater(const avl_tree_t *tree, const void *data);
 extern avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data);
 extern avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data, int *result);
 extern avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree, const void *data);
 extern avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree, const void *data);
 /* Tree walking */
 extern void avl_foreach(const avl_tree_t *tree, avl_action_t action);
 extern void avl_foreach_node(const avl_tree_t *tree, avl_action_t action);
 /* Indexing */
 #ifdef AVL_COUNT
 extern unsigned int avl_count(const avl_tree_t *tree);
 extern avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index);
 extern unsigned int avl_index(const avl_node_t *node);
 #endif
 #ifdef AVL_DEPTH
 extern unsigned int avl_depth(const avl_tree_t *tree);
 #endif
 #endif
--- a/src/bsd/device.c
+++ b/src/bsd/device.c
@ -24,13 +24,14 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
 #include "../names.h"
 #include "../net.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
 #ifdef ENABLE_TUNEMU
-#include "tunemu.h"
+#include "bsd/tunemu.h"
 #endif
 #ifdef HAVE_NET_IF_UTUN_H
@ -55,9 +56,7 @@ typedef enum device_type {
 int device_fd = -1;
 char *device = NULL;
 char *iface = NULL;
-static const char *device_info = "OS X utun device";
+static char *device_info = NULL;
 static uint64_t device_total_in = 0;
 static uint64_t device_total_out = 0;
 #if defined(ENABLE_TUNEMU)
 static device_type_t device_type = DEVICE_TYPE_TUNEMU;
 #elif defined(HAVE_OPENBSD) || defined(HAVE_FREEBSD) || defined(HAVE_DRAGONFLY)
@ -69,141 +68,127 @@ static device_type_t device_type = DEVICE_TYPE_TUN;
 #ifdef HAVE_NET_IF_UTUN_H
 static bool setup_utun(void) {
 	device_fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
 	if(device_fd == -1) {
-		logger(LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
 		return false;
 	}
 	struct ctl_info info = {};
-
+	strlcpy(info.ctl_name, UTUN_CONTROL_NAME, sizeof info.ctl_name);
 	strlcpy(info.ctl_name, UTUN_CONTROL_NAME, sizeof(info.ctl_name));
 	if(ioctl(device_fd, CTLIOCGINFO, &info) == -1) {
-		logger(LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
 		return false;
 	}
 	int unit = -1;
 	char *p = strstr(device, "utun"), *e = NULL;
 	if(p) {
 		unit = strtol(p + 4, &e, 10);
-
+		if(!e)
 		if(!e) {
 			unit = -1;
 		}
 	}
 	struct sockaddr_ctl sc = {
 		.sc_id = info.ctl_id,
-		.sc_len = sizeof(sc),
+		.sc_len = sizeof sc,
 		.sc_family = AF_SYSTEM,
 		.ss_sysaddr = AF_SYS_CONTROL,
 		.sc_unit = unit + 1,
 	};
 	if(connect(device_fd, (struct sockaddr *)&sc, sizeof(sc)) == -1) {
-		logger(LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
 		return false;
 	}
 	char name[64] = "";
-	socklen_t len = sizeof(name);
+	socklen_t len = sizeof name;
 	if(getsockopt(device_fd, SYSPROTO_CONTROL, UTUN_OPT_IFNAME, name, &len)) {
 		iface = xstrdup(device);
 	} else {
 		iface = xstrdup(name);
 	}
-	logger(LOG_INFO, "%s is a %s", device, device_info);
+	device_info = "OS X utun device";
 	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
 	return true;
 }
 #endif
 static bool setup_device(void) {
-	// Find out which device file to open
+	get_config_string(lookup_config(config_tree, "Device"), &device);
 	if(!get_config_string(lookup_config(config_tree, "Device"), &device)) {
 		if(routing_mode == RMODE_ROUTER) {
 			device = xstrdup(DEFAULT_TUN_DEVICE);
 		} else {
 			device = xstrdup(DEFAULT_TAP_DEVICE);
 		}
 	}
 	// Find out if it's supposed to be a tun or a tap device
 	char *type;
 	if(get_config_string(lookup_config(config_tree, "DeviceType"), &type)) {
 		if(!strcasecmp(type, "tun"))
 			/* use default */;
 #ifdef ENABLE_TUNEMU
-		else if(!strcasecmp(type, "tunemu")) {
+		else if(!strcasecmp(type, "tunemu"))
 			device_type = DEVICE_TYPE_TUNEMU;
 		}
 #endif
 #ifdef HAVE_NET_IF_UTUN_H
-		else if(!strcasecmp(type, "utun")) {
+		else if(!strcasecmp(type, "utun"))
 			device_type = DEVICE_TYPE_UTUN;
 		}
 #endif
-		else if(!strcasecmp(type, "tunnohead")) {
+		else if(!strcasecmp(type, "tunnohead"))
 			device_type = DEVICE_TYPE_TUN;
-		} else if(!strcasecmp(type, "tunifhead")) {
+		else if(!strcasecmp(type, "tunifhead"))
 			device_type = DEVICE_TYPE_TUNIFHEAD;
-		} else if(!strcasecmp(type, "tap")) {
+		else if(!strcasecmp(type, "tap"))
 			device_type = DEVICE_TYPE_TAP;
-		} else {
+		else {
-			logger(LOG_ERR, "Unknown device type %s!", type);
+			logger(DEBUG_ALWAYS, LOG_ERR, "Unknown device type %s!", type);
 			return false;
 		}
 	} else {
 #ifdef HAVE_NET_IF_UTUN_H
-
+		if(device && (strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0))
 		if(strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0) {
 			device_type = DEVICE_TYPE_UTUN;
-		} else
+		else
 #endif
-			if(strstr(device, "tap") || routing_mode != RMODE_ROUTER) {
+		if((device && strstr(device, "tap")) || routing_mode != RMODE_ROUTER)
-				device_type = DEVICE_TYPE_TAP;
+			device_type = DEVICE_TYPE_TAP;
 			}
 	}
 	if(routing_mode == RMODE_SWITCH && device_type != DEVICE_TYPE_TAP) {
-		logger(LOG_ERR, "Only tap devices support switch mode!");
+		logger(DEBUG_ALWAYS, LOG_ERR, "Only tap devices support switch mode!");
 		return false;
 	}
 	// Find out which device file to open
 	if(!device) {
 		if(device_type == DEVICE_TYPE_TAP)
 			device = xstrdup(DEFAULT_TAP_DEVICE);
 		else
 			device = xstrdup(DEFAULT_TUN_DEVICE);
 	}
 	// Open the device
 	switch(device_type) {
 #ifdef ENABLE_TUNEMU
-
+		case DEVICE_TYPE_TUNEMU: {
-	case DEVICE_TYPE_TUNEMU: {
+			char dynamic_name[256] = "";
-		char dynamic_name[256] = "";
+			device_fd = tunemu_open(dynamic_name);
-		device_fd = tunemu_open(dynamic_name);
+		}
-	}
+			break;
 	break;
 #endif
 #ifdef HAVE_NET_IF_UTUN_H
-
+		case DEVICE_TYPE_UTUN:
-	case DEVICE_TYPE_UTUN:
+			return setup_utun();
 		return setup_utun();
 #endif
-
+		default:
-	default:
+			device_fd = open(device, O_RDWR | O_NONBLOCK);
 		device_fd = open(device, O_RDWR | O_NONBLOCK);
 	}
 	if(device_fd < 0) {
-		logger(LOG_ERR, "Could not open %s: %s", device, strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open %s: %s", device, strerror(errno));
 		return false;
 	}
@ -213,117 +198,95 @@ static bool setup_device(void) {
 	// Guess what the corresponding interface is called
-	char *realname = NULL;
+	char *realname;
 #if defined(HAVE_FDEVNAME)
-	realname = fdevname(device_fd);
+	realname = fdevname(device_fd) ? : device;
 #elif defined(HAVE_DEVNAME)
 	struct stat buf;
-
+	if(!fstat(device_fd, &buf))
-	if(!fstat(device_fd, &buf)) {
+		realname = devname(buf.st_rdev, S_IFCHR) ? : device;
-		realname = devname(buf.st_rdev, S_IFCHR);
+#else
-	}
+	realname = device;
 #endif
-	if(!realname) {
+	if(!get_config_string(lookup_config(config_tree, "Interface"), &iface))
 		realname = device;
 	}
 	if(!get_config_string(lookup_config(config_tree, "Interface"), &iface)) {
 		iface = xstrdup(strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname);
-	} else if(strcmp(iface, strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname)) {
+	else if(strcmp(iface, strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname))
-		logger(LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
+		logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
 	}
 	// Configure the device as best as we can
 	switch(device_type) {
-	default:
+		default:
-		device_type = DEVICE_TYPE_TUN;
+			device_type = DEVICE_TYPE_TUN;
-
+		case DEVICE_TYPE_TUN:
 	case DEVICE_TYPE_TUN:
 #ifdef TUNSIFHEAD
 		{
 			const int zero = 0;
-
+			if(ioctl(device_fd, TUNSIFHEAD, &zero, sizeof zero) == -1) {
-			if(ioctl(device_fd, TUNSIFHEAD, &zero, sizeof(zero)) == -1) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
 #endif
 #if defined(TUNSIFMODE) && defined(IFF_BROADCAST) && defined(IFF_MULTICAST)
 		{
 			const int mode = IFF_BROADCAST | IFF_MULTICAST;
-			ioctl(device_fd, TUNSIFMODE, &mode, sizeof(mode));
+			ioctl(device_fd, TUNSIFMODE, &mode, sizeof mode);
 		}
 #endif
-		device_info = "Generic BSD tun device";
+			device_info = "Generic BSD tun device";
-		break;
+			break;
-
+		case DEVICE_TYPE_TUNIFHEAD:
 	case DEVICE_TYPE_TUNIFHEAD:
 #ifdef TUNSIFHEAD
 		{
 			const int one = 1;
-
+			if(ioctl(device_fd, TUNSIFHEAD, &one, sizeof one) == -1) {
-			if(ioctl(device_fd, TUNSIFHEAD, &one, sizeof(one)) == -1) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
 #endif
 #if defined(TUNSIFMODE) && defined(IFF_BROADCAST) && defined(IFF_MULTICAST)
 		{
-			const int mode = IFF_BROADCAST | IFF_MULTICAST;
+				const int mode = IFF_BROADCAST | IFF_MULTICAST;
-			ioctl(device_fd, TUNSIFMODE, &mode, sizeof(mode));
+				ioctl(device_fd, TUNSIFMODE, &mode, sizeof mode);
 		}
 #endif
-		device_info = "Generic BSD tun device";
+			device_info = "Generic BSD tun device";
-		break;
+			break;
-
+		case DEVICE_TYPE_TAP:
-	case DEVICE_TYPE_TAP:
+			if(routing_mode == RMODE_ROUTER)
-		if(routing_mode == RMODE_ROUTER) {
+				overwrite_mac = true;
-			overwrite_mac = true;
+			device_info = "Generic BSD tap device";
 		}
 		device_info = "Generic BSD tap device";
 #ifdef TAPGIFNAME
-		{
+			{
-			struct ifreq ifr;
+				struct ifreq ifr;
-
+				if(ioctl(device_fd, TAPGIFNAME, (void*)&ifr) == 0) {
-			if(ioctl(device_fd, TAPGIFNAME, (void *)&ifr) == 0) {
+					if(iface)
-				if(iface) {
+						free(iface);
-					free(iface);
+					iface = xstrdup(ifr.ifr_name);
 				}
 				iface = xstrdup(ifr.ifr_name);
 			}
 		}
 #endif
-		break;
+			break;
 #ifdef ENABLE_TUNEMU
-
+		case DEVICE_TYPE_TUNEMU:
-	case DEVICE_TYPE_TUNEMU:
+			device_info = "BSD tunemu device";
-		device_info = "BSD tunemu device";
+			break;
 		break;
 #endif
 	}
 #ifdef SIOCGIFADDR
-
+	if(overwrite_mac)
 	if(overwrite_mac) {
 		ioctl(device_fd, SIOCGIFADDR, mymac.x);
 	}
 #endif
-	logger(LOG_INFO, "%s is a %s", device, device_info);
+	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
 	return true;
 }
@ -331,200 +294,180 @@ static bool setup_device(void) {
 static void close_device(void) {
 	switch(device_type) {
 #ifdef ENABLE_TUNEMU
-
+		case DEVICE_TYPE_TUNEMU:
-	case DEVICE_TYPE_TUNEMU:
+			tunemu_close(device_fd);
-		tunemu_close(device_fd);
+			break;
 		break;
 #endif
-
+		default:
-	default:
+			close(device_fd);
 		close(device_fd);
 	}
 	device_fd = -1;
-	free(device);
+	free(device); device = NULL;
-	free(iface);
+	free(iface); iface = NULL;
 	device_info = NULL;
 }
 static bool read_packet(vpn_packet_t *packet) {
-	int lenin;
+	int inlen;
 	switch(device_type) {
-	case DEVICE_TYPE_TUN:
+		case DEVICE_TYPE_TUN:
 #ifdef ENABLE_TUNEMU
-	case DEVICE_TYPE_TUNEMU:
+		case DEVICE_TYPE_TUNEMU:
-		if(device_type == DEVICE_TYPE_TUNEMU) {
+			if(device_type == DEVICE_TYPE_TUNEMU)
-			lenin = tunemu_read(device_fd, packet->data + 14, MTU - 14);
+				inlen = tunemu_read(device_fd, DATA(packet) + 14, MTU - 14);
-		} else
+			else
 #endif
-			lenin = read(device_fd, packet->data + 14, MTU - 14);
+				inlen = read(device_fd, DATA(packet) + 14, MTU - 14);
-		if(lenin <= 0) {
+			if(inlen <= 0) {
-			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
-			       device, strerror(errno));
+					   device, strerror(errno));
-			return false;
+				return false;
-		}
+			}
-		switch(packet->data[14] >> 4) {
+			switch(DATA(packet)[14] >> 4) {
-		case 4:
+				case 4:
-			packet->data[12] = 0x08;
+					DATA(packet)[12] = 0x08;
-			packet->data[13] = 0x00;
+					DATA(packet)[13] = 0x00;
 					break;
 				case 6:
 					DATA(packet)[12] = 0x86;
 					DATA(packet)[13] = 0xDD;
 					break;
 				default:
 					logger(DEBUG_TRAFFIC, LOG_ERR,
 							   "Unknown IP version %d while reading packet from %s %s",
 							   DATA(packet)[14] >> 4, device_info, device);
 					return false;
 			}
 			memset(DATA(packet), 0, 12);
 			packet->len = inlen + 14;
 			break;
-		case 6:
+		case DEVICE_TYPE_UTUN:
-			packet->data[12] = 0x86;
+		case DEVICE_TYPE_TUNIFHEAD: {
-			packet->data[13] = 0xDD;
+			if((inlen = read(device_fd, packet->data + 10, MTU - 10)) <= 0) {
 				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
 					   device, strerror(errno));
 				return false;
 			}
 			switch (packet->data[14] >> 4) {
 				case 4:
 					DATA(packet)[12] = 0x08;
 					DATA(packet)[13] = 0x00;
 					break;
 				case 6:
 					DATA(packet)[12] = 0x86;
 					DATA(packet)[13] = 0xDD;
 					break;
 				default:
 					logger(DEBUG_TRAFFIC, LOG_ERR,
 							   "Unknown IP version %d while reading packet from %s %s",
 							   packet->data[14] >> 4, device_info, device);
 					return false;
 			}
 			memset(DATA(packet), 0, 12);
 			packet->len = inlen + 10;
 			break;
 		}
 		case DEVICE_TYPE_TAP:
 			if((inlen = read(device_fd, DATA(packet), MTU)) <= 0) {
 				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
 					   device, strerror(errno));
 				return false;
 			}
 			packet->len = inlen;
 			break;
 		default:
 			ifdebug(TRAFFIC) logger(LOG_ERR,
 			                        "Unknown IP version %d while reading packet from %s %s",
 			                        packet->data[14] >> 4, device_info, device);
 			return false;
 		}
 		memset(packet->data, 0, 12);
 		packet->len = lenin + 14;
 		break;
 	case DEVICE_TYPE_UTUN:
 	case DEVICE_TYPE_TUNIFHEAD: {
 		if((lenin = read(device_fd, packet->data + 10, MTU - 10)) <= 0) {
 			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 		switch(packet->data[14] >> 4) {
 		case 4:
 			packet->data[12] = 0x08;
 			packet->data[13] = 0x00;
 			break;
 		case 6:
 			packet->data[12] = 0x86;
 			packet->data[13] = 0xDD;
 			break;
 		default:
 			ifdebug(TRAFFIC) logger(LOG_ERR,
 			                        "Unknown IP version %d while reading packet from %s %s",
 			                        packet->data[14] >> 4, device_info, device);
 			return false;
 		}
 		memset(packet->data, 0, 12);
 		packet->len = lenin + 10;
 		break;
 	}
-	case DEVICE_TYPE_TAP:
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s",
-		if((lenin = read(device_fd, packet->data, MTU)) <= 0) {
+			   packet->len, device_info);
 			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 		packet->len = lenin;
 		break;
 	default:
 		return false;
 	}
 	device_total_in += packet->len;
 	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s",
 	                        packet->len, device_info);
 	return true;
 }
 static bool write_packet(vpn_packet_t *packet) {
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
-	                        packet->len, device_info);
+			   packet->len, device_info);
 	switch(device_type) {
-	case DEVICE_TYPE_TUN:
+		case DEVICE_TYPE_TUN:
-		if(write(device_fd, packet->data + 14, packet->len - 14) < 0) {
+			if(write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
-			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			       device, strerror(errno));
+					   device, strerror(errno));
-			return false;
+				return false;
-		}
+			}
 		break;
 	case DEVICE_TYPE_UTUN:
 	case DEVICE_TYPE_TUNIFHEAD: {
 		int af = (packet->data[12] << 8) + packet->data[13];
 		uint32_t type;
 		switch(af) {
 		case 0x0800:
 			type = htonl(AF_INET);
 			break;
-		case 0x86DD:
+		case DEVICE_TYPE_UTUN:
-			type = htonl(AF_INET6);
+		case DEVICE_TYPE_TUNIFHEAD: {
 			int af = (DATA(packet)[12] << 8) + DATA(packet)[13];
 			uint32_t type;
 			switch (af) {
 				case 0x0800:
 					type = htonl(AF_INET);
 					break;
 				case 0x86DD:
 					type = htonl(AF_INET6);
 					break;
 				default:
 					logger(DEBUG_TRAFFIC, LOG_ERR,
 							   "Unknown address family %x while writing packet to %s %s",
 							   af, device_info, device);
 					return false;
 			}
 			memcpy(packet->data + 10, &type, sizeof type);
 			if(write(device_fd, packet->data + 10, packet->len - 10) < 0) {
 				logger(DEBUG_ALWAYS, LOG_ERR, "Can't write to %s %s: %s", device_info, device,
 					   strerror(errno));
 				return false;
 			}
 			break;
 		default:
 			ifdebug(TRAFFIC) logger(LOG_ERR,
 			                        "Unknown address family %x while writing packet to %s %s",
 			                        af, device_info, device);
 			return false;
 		}
-		memcpy(packet->data + 10, &type, sizeof(type));
+		case DEVICE_TYPE_TAP:
-
+			if(write(device_fd, DATA(packet), packet->len) < 0) {
-		if(write(device_fd, packet->data + 10, packet->len - 10) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			logger(LOG_ERR, "Can't write to %s %s: %s", device_info, device,
+					   device, strerror(errno));
-			       strerror(errno));
+				return false;
-			return false;
+			}
-		}
+			break;
 		break;
 	}
 	case DEVICE_TYPE_TAP:
 		if(write(device_fd, packet->data, packet->len) < 0) {
 			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 		break;
 #ifdef ENABLE_TUNEMU
-
+		case DEVICE_TYPE_TUNEMU:
-	case DEVICE_TYPE_TUNEMU:
+			if(tunemu_write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
-		if(tunemu_write(device_fd, packet->data + 14, packet->len - 14) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
+					   device, strerror(errno));
-			       device, strerror(errno));
+				return false;
-			return false;
+			}
-		}
+			break;
 		break;
 #endif
-	default:
+		default:
-		return false;
+			return false;
 	}
 	device_total_out += packet->len;
 	return true;
 }
 static void dump_device_stats(void) {
 	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
 	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
 	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
 }
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
 	.dump_stats = dump_device_stats,
 };
--- a/src/bsd/tunemu.c
+++ b/src/bsd/tunemu.c
@ -45,25 +45,28 @@
 #define PPPIOCSFLAGS    _IOW('t', 89, int)
 #define PPPIOCSNPMODE   _IOW('t', 75, struct npioctl)
 #define PPPIOCATTCHAN   _IOW('t', 56, int)
-#define PPPIOCGCHAN             _IOR('t', 55, int)
+#define PPPIOCGCHAN     _IOR('t', 55, int)
 #define PPPIOCCONNECT   _IOW('t', 58, int)
-#define PPPIOCGUNIT             _IOR('t', 86, int)
+#define PPPIOCGUNIT     _IOR('t', 86, int)
-struct sockaddr_ppp {
+struct sockaddr_ppp
 {
 	u_int8_t ppp_len;
 	u_int8_t ppp_family;
 	u_int16_t ppp_proto;
 	u_int32_t ppp_cookie;
 };
-enum NPmode {
+enum NPmode
 {
 	NPMODE_PASS,
-	NPMODE_DROP,
+    NPMODE_DROP,
-	NPMODE_ERROR,
+    NPMODE_ERROR,
-	NPMODE_QUEUE
+    NPMODE_QUEUE
 };
-struct npioctl {
+struct npioctl
 {
 	int protocol;
 	enum NPmode mode;
 };
@ -80,55 +83,58 @@ static pcap_t *pcap = NULL;
 static int data_buffer_length = 0;
 static char *data_buffer = NULL;
-static void tun_error(char *format, ...) {
+static void tun_error(char *format, ...)
 {
 	va_list vl;
 	va_start(vl, format);
 	vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
 	va_end(vl);
 }
-static void tun_noerror() {
+static void tun_noerror()
 {
 	*tunemu_error = 0;
 }
-static void closeall() {
+static void closeall()
-	int fd = getdtablesize();
+{
-
+    int fd = getdtablesize();
-	while(fd--) {
+	while (fd--)
 		close(fd);
 	}
-	open("/dev/null", O_RDWR, 0);
+    open("/dev/null", O_RDWR, 0);
-	dup(0);
+    dup(0);
-	dup(0);
+    dup(0);
 }
-static int ppp_load_kext() {
+static int ppp_load_kext()
 {
 	int pid = fork();
-
+	if (pid < 0)
-	if(pid < 0) {
+	{
 		tun_error("fork for ppp kext: %s", strerror(errno));
 		return -1;
 	}
-	if(pid == 0) {
+	if (pid == 0)
 	{
 		closeall();
 		execle("/sbin/kextload", "kextload", PPP_KEXT_PATH, NULL, NULL);
 		exit(1);
 	}
 	int status;
-
+	while (waitpid(pid, &status, 0) < 0)
-	while(waitpid(pid, &status, 0) < 0) {
+	{
-		if(errno == EINTR) {
+		if (errno == EINTR)
 			continue;
 		}
 		tun_error("waitpid for ppp kext: %s", strerror(errno));
 		return -1;
 	}
-	if(WEXITSTATUS(status) != 0) {
+	if (WEXITSTATUS(status) != 0)
 	{
 		tun_error("could not load ppp kext \"%s\"", PPP_KEXT_PATH);
 		return -1;
 	}
@ -137,73 +143,74 @@ static int ppp_load_kext() {
 	return 0;
 }
-static int ppp_new_instance() {
+static int ppp_new_instance()
 {
 	// create ppp socket
-	int ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
+    int ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
-
+    if (ppp_sockfd < 0)
-	if(ppp_sockfd < 0) {
+	{
-		if(ppp_load_kext() < 0) {
+		if (ppp_load_kext() < 0)
 			return -1;
 		}
 		ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
-
+		if (ppp_sockfd < 0)
-		if(ppp_sockfd < 0) {
+		{
 			tun_error("creating ppp socket: %s", strerror(errno));
 			return -1;
 		}
 	}
 	// connect to ppp procotol
-	struct sockaddr_ppp pppaddr;
+    struct sockaddr_ppp pppaddr;
-	pppaddr.ppp_len = sizeof(struct sockaddr_ppp);
+    pppaddr.ppp_len = sizeof(struct sockaddr_ppp);
-	pppaddr.ppp_family = AF_PPP;
+    pppaddr.ppp_family = AF_PPP;
-	pppaddr.ppp_proto = PPPPROTO_CTL;
+    pppaddr.ppp_proto = PPPPROTO_CTL;
-	pppaddr.ppp_cookie = 0;
+    pppaddr.ppp_cookie = 0;
-
+    if (connect(ppp_sockfd, (struct sockaddr *)&pppaddr, sizeof(struct sockaddr_ppp)) < 0)
-	if(connect(ppp_sockfd, (struct sockaddr *)&pppaddr, sizeof(struct sockaddr_ppp)) < 0) {
+	{
 		tun_error("connecting ppp socket: %s", strerror(errno));
 		close(ppp_sockfd);
 		return -1;
-	}
+    }
 	tun_noerror();
 	return ppp_sockfd;
 }
-static int ppp_new_unit(int *unit_number) {
+static int ppp_new_unit(int *unit_number)
 {
 	int fd = ppp_new_instance();
-
+	if (fd < 0)
 	if(fd < 0) {
 		return -1;
 	}
 	// create ppp unit
-	if(ioctl(fd, PPPIOCNEWUNIT, unit_number) < 0) {
+	if (ioctl(fd, PPPIOCNEWUNIT, unit_number) < 0)
 	{
 		tun_error("creating ppp unit: %s", strerror(errno));
 		close(fd);
 		return -1;
-	}
+    }
 	tun_noerror();
 	return fd;
 }
-static int ppp_setup_unit(int unit_fd) {
+static int ppp_setup_unit(int unit_fd)
 {
 	// send traffic to program
 	int flags = SC_LOOP_TRAFFIC;
-
+	if (ioctl(unit_fd, PPPIOCSFLAGS, &flags) < 0)
-	if(ioctl(unit_fd, PPPIOCSFLAGS, &flags) < 0) {
+	{
 		tun_error("setting ppp loopback mode: %s", strerror(errno));
 		return -1;
-	}
+    }
 	// allow packets
 	struct npioctl npi;
 	npi.protocol = PPP_IP;
 	npi.mode = NPMODE_PASS;
-
+	if (ioctl(unit_fd, PPPIOCSNPMODE, &npi) < 0)
-	if(ioctl(unit_fd, PPPIOCSNPMODE, &npi) < 0) {
+	{
 		tun_error("starting ppp unit: %s", strerror(errno));
 		return -1;
 	}
@ -212,8 +219,10 @@ static int ppp_setup_unit(int unit_fd) {
 	return 0;
 }
-static int open_pcap() {
+static int open_pcap()
-	if(pcap != NULL) {
+{
 	if (pcap != NULL)
 	{
 		pcap_use_count++;
 		return 0;
 	}
@ -222,7 +231,8 @@ static int open_pcap() {
 	pcap = pcap_open_live("lo0", BUFSIZ, 0, 1, errbuf);
 	pcap_use_count = 1;
-	if(pcap == NULL) {
+	if (pcap == NULL)
 	{
 		tun_error("opening pcap: %s", errbuf);
 		return -1;
 	}
@ -231,57 +241,59 @@ static int open_pcap() {
 	return 0;
 }
-static void close_pcap() {
+static void close_pcap()
-	if(pcap == NULL) {
+{
 	if (pcap == NULL)
 		return;
 	}
 	pcap_use_count--;
-
+	if (pcap_use_count == 0)
-	if(pcap_use_count == 0) {
+	{
 		pcap_close(pcap);
 		pcap = NULL;
 	}
 }
-static void allocate_data_buffer(int size) {
+static void allocate_data_buffer(int size)
-	if(data_buffer_length < size) {
+{
 	if (data_buffer_length < size)
 	{
 		free(data_buffer);
 		data_buffer_length = size;
 		data_buffer = malloc(data_buffer_length);
 	}
 }
-static void make_device_name(tunemu_device device, int unit_number) {
+static void make_device_name(tunemu_device device, int unit_number)
 {
 	snprintf(device, sizeof(tunemu_device), "ppp%d", unit_number);
 }
-static int check_device_name(tunemu_device device) {
+static int check_device_name(tunemu_device device)
-	if(strlen(device) < 4) {
+{
 	if (strlen(device) < 4)
 		return -1;
 	}
 	int unit_number = atoi(device + 3);
-
+	if (unit_number < 0 || unit_number > 999)
 	if(unit_number < 0 || unit_number > 999) {
 		return -1;
 	}
 	tunemu_device compare;
 	make_device_name(compare, unit_number);
-	if(strcmp(device, compare) != 0) {
+	if (strcmp(device, compare) != 0)
 		return -1;
 	}
 	return 0;
 }
-int tunemu_open(tunemu_device device) {
+int tunemu_open(tunemu_device device)
 {
 	int ppp_unit_number = -1;
-
+	if (device[0] != 0)
-	if(device[0] != 0) {
+	{
-		if(check_device_name(device) < 0) {
+		if (check_device_name(device) < 0)
 		{
 			tun_error("invalid device name \"%s\"", device);
 			return -1;
 		}
@ -290,17 +302,17 @@ int tunemu_open(tunemu_device device) {
 	}
 	int ppp_unit_fd = ppp_new_unit(&ppp_unit_number);
-
+	if (ppp_unit_fd < 0)
 	if(ppp_unit_fd < 0) {
 		return -1;
 	}
-	if(ppp_setup_unit(ppp_unit_fd) < 0) {
+	if (ppp_setup_unit(ppp_unit_fd) < 0)
 	{
 		close(ppp_unit_fd);
 		return -1;
 	}
-	if(open_pcap() < 0) {
+	if (open_pcap() < 0)
 	{
 		close(ppp_unit_fd);
 		return -1;
 	}
@ -310,40 +322,39 @@ int tunemu_open(tunemu_device device) {
 	return ppp_unit_fd;
 }
-int tunemu_close(int ppp_sockfd) {
+int tunemu_close(int ppp_sockfd)
 {
 	int ret = close(ppp_sockfd);
-	if(ret == 0) {
+	if (ret == 0)
 		close_pcap();
 	}
 	return ret;
 }
-int tunemu_read(int ppp_sockfd, char *buffer, int length) {
+int tunemu_read(int ppp_sockfd, char *buffer, int length)
 {
 	allocate_data_buffer(length + 2);
 	length = read(ppp_sockfd, data_buffer, length + 2);
-
+	if (length < 0)
-	if(length < 0) {
+	{
 		tun_error("reading packet: %s", strerror(errno));
 		return length;
 	}
 	tun_noerror();
 	length -= 2;
-
+	if (length < 0)
 	if(length < 0) {
 		return 0;
 	}
 	memcpy(buffer, data_buffer + 2, length);
 	return length;
 }
-int tunemu_write(int ppp_sockfd, char *buffer, int length) {
+int tunemu_write(int ppp_sockfd, char *buffer, int length)
 {
 	allocate_data_buffer(length + 4);
 	data_buffer[0] = 0x02;
@ -353,25 +364,23 @@ int tunemu_write(int ppp_sockfd, char *buffer, int length) {
 	memcpy(data_buffer + 4, buffer, length);
-	if(pcap == NULL) {
+	if (pcap == NULL)
 	{
 		tun_error("pcap not open");
 		return -1;
 	}
 	length = pcap_inject(pcap, data_buffer, length + 4);
-
+	if (length < 0)
-	if(length < 0) {
+	{
 		tun_error("injecting packet: %s", pcap_geterr(pcap));
 		return length;
 	}
 	tun_noerror();
 	length -= 4;
-
+	if (length < 0)
 	if(length < 0) {
 		return 0;
 	}
 	return length;
 }
--- a/src/buffer.c
+++ b/src/buffer.c
@ -0,0 +1,108 @@
 /*
    buffer.c -- buffer management
    Copyright (C) 2011 Guus Sliepen <guus@tinc-vpn.org>,
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "system.h"
 #include "buffer.h"
 #include "xalloc.h"
 void buffer_compact(buffer_t *buffer, int maxsize) {
 	if(buffer->len >= maxsize || buffer->offset / 7 > buffer->len / 8) {
 		memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
 		buffer->len -= buffer->offset;
 		buffer->offset = 0;
 	}
 }
 // Make sure we can add size bytes to the buffer, and return a pointer to the start of those bytes.
 char *buffer_prepare(buffer_t *buffer, int size) {
 	if(!buffer->data) {
 		buffer->maxlen = size;
 		buffer->data = xmalloc(size);
 	} else {
 		if(buffer->offset && buffer->len + size > buffer->maxlen) {
 			memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
 			buffer->len -= buffer->offset;
 			buffer->offset = 0;
 		}
 		if(buffer->len + size > buffer->maxlen) {
 			buffer->maxlen = buffer->len + size;
 			buffer->data = xrealloc(buffer->data, buffer->maxlen);
 		}
 	}
 	char *start = buffer->data + buffer->len;
 	buffer->len += size;
 	return start;
 }
 // Copy data into the buffer.
 void buffer_add(buffer_t *buffer, const char *data, int size) {
 	memcpy(buffer_prepare(buffer, size), data, size);
 }
 // Remove given number of bytes from the buffer, return a pointer to the start of them.
 static char *buffer_consume(buffer_t *buffer, int size) {
 	char *start = buffer->data + buffer->offset;
 	buffer->offset += size;
 	if(buffer->offset >= buffer->len) {
 		buffer->offset = 0;
 		buffer->len = 0;
 	}
 	return start;
 }
 // Check if there is a complete line in the buffer, and if so, return it NULL-terminated.
 char *buffer_readline(buffer_t *buffer) {
 	char *newline = memchr(buffer->data + buffer->offset, '\n', buffer->len - buffer->offset);
 	if(!newline)
 		return NULL;
 	int len = newline + 1 - (buffer->data + buffer->offset);
 	*newline = 0;
 	return buffer_consume(buffer, len);
 }
 // Check if we have enough bytes in the buffer, and if so, return a pointer to the start of them.
 char *buffer_read(buffer_t *buffer, int size) {
 	if(buffer->len - buffer->offset < size)
 		return NULL;
 	return buffer_consume(buffer, size);
 }
 void buffer_clear(buffer_t *buffer) {
 	free(buffer->data);
 	buffer->data = NULL;
 	buffer->maxlen = 0;
 	buffer->len = 0;
 	buffer->offset = 0;
 }
--- a/src/buffer.h
+++ b/src/buffer.h
@ -0,0 +1,18 @@
 #ifndef __TINC_BUFFER_H__
 #define __TINC_BUFFER_H__
 typedef struct buffer_t {
 	char *data;
 	int maxlen;
 	int len;
 	int offset;
 } buffer_t;
 extern void buffer_compact(buffer_t *buffer, int maxsize);
 extern char *buffer_prepare(buffer_t *buffer, int size);
 extern void buffer_add(buffer_t *buffer, const char *data, int size);
 extern char *buffer_readline(buffer_t *buffer);
 extern char *buffer_read(buffer_t *buffer, int size);
 extern void buffer_clear(buffer_t *buffer);
 #endif
--- a/src/chacha-poly1305/chacha-poly1305.c
+++ b/src/chacha-poly1305/chacha-poly1305.c
@ -0,0 +1,103 @@
 #include "../system.h"
 #include "../cipher.h"
 #include "../xalloc.h"
 #include "chacha.h"
 #include "chacha-poly1305.h"
 #include "poly1305.h"
 struct chacha_poly1305_ctx {
 	struct chacha_ctx main_ctx, header_ctx;
 };
 chacha_poly1305_ctx_t *chacha_poly1305_init(void)
 {
 	chacha_poly1305_ctx_t *ctx = xzalloc(sizeof *ctx);
 	return ctx;
 }
 void chacha_poly1305_exit(chacha_poly1305_ctx_t *ctx)
 {
 	free(ctx);
 }
 bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *key)
 {
 	chacha_keysetup(&ctx->main_ctx, key, 256);
 	chacha_keysetup(&ctx->header_ctx, key + 32, 256);
 	return true;
 }
 static void put_u64(void *vp, uint64_t v)
 {
 	uint8_t *p = (uint8_t *) vp;
 	p[0] = (uint8_t) (v >> 56) & 0xff;
 	p[1] = (uint8_t) (v >> 48) & 0xff;
 	p[2] = (uint8_t) (v >> 40) & 0xff;
 	p[3] = (uint8_t) (v >> 32) & 0xff;
 	p[4] = (uint8_t) (v >> 24) & 0xff;
 	p[5] = (uint8_t) (v >> 16) & 0xff;
 	p[6] = (uint8_t) (v >> 8) & 0xff;
 	p[7] = (uint8_t) v & 0xff;
 }
 bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen) {
 	uint8_t seqbuf[8];
 	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };	/* NB little-endian */
 	uint8_t poly_key[POLY1305_KEYLEN];
 	/*
 	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
 	 * packet sequence number.
 	 */
 	memset(poly_key, 0, sizeof(poly_key));
 	put_u64(seqbuf, seqnr);
 	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
 	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
 	/* Set Chacha's block counter to 1 */
 	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
 	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
 	poly1305_auth(outdata + inlen, outdata, inlen, poly_key);
 	if (outlen)
 		*outlen = inlen + POLY1305_TAGLEN;
 	return true;
 }
 bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen) {
 	uint8_t seqbuf[8];
 	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };	/* NB little-endian */
 	uint8_t expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
 	/*
 	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
 	 * packet sequence number.
 	 */
 	memset(poly_key, 0, sizeof(poly_key));
 	put_u64(seqbuf, seqnr);
 	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
 	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
 	/* Set Chacha's block counter to 1 */
 	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
 	/* Check tag before anything else */
 	inlen -= POLY1305_TAGLEN;
 	const uint8_t *tag = indata + inlen;
 	poly1305_auth(expected_tag, indata, inlen, poly_key);
 	if (memcmp(expected_tag, tag, POLY1305_TAGLEN))
 		return false;
 	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
 	if (outlen)
 		*outlen = inlen;
 	return true;
 }
--- a/src/chacha-poly1305/chacha-poly1305.h
+++ b/src/chacha-poly1305/chacha-poly1305.h
@ -0,0 +1,15 @@
 #ifndef CHACHA_POLY1305_H
 #define CHACHA_POLY1305_H
 #define CHACHA_POLY1305_KEYLEN 64
 typedef struct chacha_poly1305_ctx chacha_poly1305_ctx_t;
 extern chacha_poly1305_ctx_t *chacha_poly1305_init(void);
 extern void chacha_poly1305_exit(chacha_poly1305_ctx_t *);
 extern bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *key);
 extern bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
 extern bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
 #endif //CHACHA_POLY1305_H
--- a/src/chacha-poly1305/chacha.c
+++ b/src/chacha-poly1305/chacha.c
@ -0,0 +1,215 @@
 /*
 chacha-merged.c version 20080118
 D. J. Bernstein
 Public domain.
 */
 #include "../system.h"
 #include "chacha.h"
 typedef struct chacha_ctx chacha_ctx;
 #define U8C(v) (v##U)
 #define U32C(v) (v##U)
 #define U8V(v) ((uint8_t)(v) & U8C(0xFF))
 #define U32V(v) ((uint32_t)(v) & U32C(0xFFFFFFFF))
 #define ROTL32(v, n) \
 	(U32V((v) << (n)) | ((v) >> (32 - (n))))
 #define U8TO32_LITTLE(p) \
 	(((uint32_t)((p)[0])      ) | \
 	 ((uint32_t)((p)[1]) <<  8) | \
 	 ((uint32_t)((p)[2]) << 16) | \
 	 ((uint32_t)((p)[3]) << 24))
 #define U32TO8_LITTLE(p, v) \
 	do { \
 		(p)[0] = U8V((v)      ); \
 		(p)[1] = U8V((v) >>  8); \
 		(p)[2] = U8V((v) >> 16); \
 		(p)[3] = U8V((v) >> 24); \
 	} while (0)
 #define ROTATE(v,c) (ROTL32(v,c))
 #define XOR(v,w) ((v) ^ (w))
 #define PLUS(v,w) (U32V((v) + (w)))
 #define PLUSONE(v) (PLUS((v),1))
 #define QUARTERROUND(a,b,c,d) \
 	a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
 	c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
 	a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
 	c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
 static const char sigma[16] = "expand 32-byte k";
 static const char tau[16] = "expand 16-byte k";
 void chacha_keysetup(chacha_ctx *x, const uint8_t *k, uint32_t kbits)
 {
 	const char *constants;
 	x->input[4] = U8TO32_LITTLE(k + 0);
 	x->input[5] = U8TO32_LITTLE(k + 4);
 	x->input[6] = U8TO32_LITTLE(k + 8);
 	x->input[7] = U8TO32_LITTLE(k + 12);
 	if (kbits == 256) {	/* recommended */
 		k += 16;
 		constants = sigma;
 	} else {		/* kbits == 128 */
 		constants = tau;
 	}
 	x->input[8] = U8TO32_LITTLE(k + 0);
 	x->input[9] = U8TO32_LITTLE(k + 4);
 	x->input[10] = U8TO32_LITTLE(k + 8);
 	x->input[11] = U8TO32_LITTLE(k + 12);
 	x->input[0] = U8TO32_LITTLE(constants + 0);
 	x->input[1] = U8TO32_LITTLE(constants + 4);
 	x->input[2] = U8TO32_LITTLE(constants + 8);
 	x->input[3] = U8TO32_LITTLE(constants + 12);
 }
 void chacha_ivsetup(chacha_ctx *x, const uint8_t *iv, const uint8_t *counter)
 {
 	x->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 0);
 	x->input[13] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 4);
 	x->input[14] = U8TO32_LITTLE(iv + 0);
 	x->input[15] = U8TO32_LITTLE(iv + 4);
 }
 void
 chacha_encrypt_bytes(chacha_ctx *x, const uint8_t *m, uint8_t *c, uint32_t bytes)
 {
 	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
 	uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
 	uint8_t *ctarget = NULL;
 	uint8_t tmp[64];
 	uint32_t i;
 	if (!bytes)
 		return;
 	j0 = x->input[0];
 	j1 = x->input[1];
 	j2 = x->input[2];
 	j3 = x->input[3];
 	j4 = x->input[4];
 	j5 = x->input[5];
 	j6 = x->input[6];
 	j7 = x->input[7];
 	j8 = x->input[8];
 	j9 = x->input[9];
 	j10 = x->input[10];
 	j11 = x->input[11];
 	j12 = x->input[12];
 	j13 = x->input[13];
 	j14 = x->input[14];
 	j15 = x->input[15];
 	for (;;) {
 		if (bytes < 64) {
 			for (i = 0; i < bytes; ++i)
 				tmp[i] = m[i];
 			m = tmp;
 			ctarget = c;
 			c = tmp;
 		}
 		x0 = j0;
 		x1 = j1;
 		x2 = j2;
 		x3 = j3;
 		x4 = j4;
 		x5 = j5;
 		x6 = j6;
 		x7 = j7;
 		x8 = j8;
 		x9 = j9;
 		x10 = j10;
 		x11 = j11;
 		x12 = j12;
 		x13 = j13;
 		x14 = j14;
 		x15 = j15;
 		for (i = 20; i > 0; i -= 2) {
 			QUARTERROUND(x0, x4, x8, x12)
 			QUARTERROUND(x1, x5, x9, x13)
 			QUARTERROUND(x2, x6, x10, x14)
 			QUARTERROUND(x3, x7, x11, x15)
 			QUARTERROUND(x0, x5, x10, x15)
 			QUARTERROUND(x1, x6, x11, x12)
 			QUARTERROUND(x2, x7, x8, x13)
 			QUARTERROUND(x3, x4, x9, x14)
 		}
 		x0 = PLUS(x0, j0);
 		x1 = PLUS(x1, j1);
 		x2 = PLUS(x2, j2);
 		x3 = PLUS(x3, j3);
 		x4 = PLUS(x4, j4);
 		x5 = PLUS(x5, j5);
 		x6 = PLUS(x6, j6);
 		x7 = PLUS(x7, j7);
 		x8 = PLUS(x8, j8);
 		x9 = PLUS(x9, j9);
 		x10 = PLUS(x10, j10);
 		x11 = PLUS(x11, j11);
 		x12 = PLUS(x12, j12);
 		x13 = PLUS(x13, j13);
 		x14 = PLUS(x14, j14);
 		x15 = PLUS(x15, j15);
 		x0 = XOR(x0, U8TO32_LITTLE(m + 0));
 		x1 = XOR(x1, U8TO32_LITTLE(m + 4));
 		x2 = XOR(x2, U8TO32_LITTLE(m + 8));
 		x3 = XOR(x3, U8TO32_LITTLE(m + 12));
 		x4 = XOR(x4, U8TO32_LITTLE(m + 16));
 		x5 = XOR(x5, U8TO32_LITTLE(m + 20));
 		x6 = XOR(x6, U8TO32_LITTLE(m + 24));
 		x7 = XOR(x7, U8TO32_LITTLE(m + 28));
 		x8 = XOR(x8, U8TO32_LITTLE(m + 32));
 		x9 = XOR(x9, U8TO32_LITTLE(m + 36));
 		x10 = XOR(x10, U8TO32_LITTLE(m + 40));
 		x11 = XOR(x11, U8TO32_LITTLE(m + 44));
 		x12 = XOR(x12, U8TO32_LITTLE(m + 48));
 		x13 = XOR(x13, U8TO32_LITTLE(m + 52));
 		x14 = XOR(x14, U8TO32_LITTLE(m + 56));
 		x15 = XOR(x15, U8TO32_LITTLE(m + 60));
 		j12 = PLUSONE(j12);
 		if (!j12) {
 			j13 = PLUSONE(j13);
 			/* stopping at 2^70 bytes per nonce is user's responsibility */
 		}
 		U32TO8_LITTLE(c + 0, x0);
 		U32TO8_LITTLE(c + 4, x1);
 		U32TO8_LITTLE(c + 8, x2);
 		U32TO8_LITTLE(c + 12, x3);
 		U32TO8_LITTLE(c + 16, x4);
 		U32TO8_LITTLE(c + 20, x5);
 		U32TO8_LITTLE(c + 24, x6);
 		U32TO8_LITTLE(c + 28, x7);
 		U32TO8_LITTLE(c + 32, x8);
 		U32TO8_LITTLE(c + 36, x9);
 		U32TO8_LITTLE(c + 40, x10);
 		U32TO8_LITTLE(c + 44, x11);
 		U32TO8_LITTLE(c + 48, x12);
 		U32TO8_LITTLE(c + 52, x13);
 		U32TO8_LITTLE(c + 56, x14);
 		U32TO8_LITTLE(c + 60, x15);
 		if (bytes <= 64) {
 			if (bytes < 64) {
 				for (i = 0; i < bytes; ++i)
 					ctarget[i] = c[i];
 			}
 			x->input[12] = j12;
 			x->input[13] = j13;
 			return;
 		}
 		bytes -= 64;
 		c += 64;
 		m += 64;
 	}
 }
--- a/src/chacha-poly1305/chacha.h
+++ b/src/chacha-poly1305/chacha.h
@ -0,0 +1,24 @@
 /*
 chacha-merged.c version 20080118
 D. J. Bernstein
 Public domain.
 */
 #ifndef CHACHA_H
 #define CHACHA_H
 struct chacha_ctx {
 	uint32_t input[16];
 };
 #define CHACHA_MINKEYLEN 	16
 #define CHACHA_NONCELEN		8
 #define CHACHA_CTRLEN		8
 #define CHACHA_STATELEN		(CHACHA_NONCELEN+CHACHA_CTRLEN)
 #define CHACHA_BLOCKLEN		64
 void chacha_keysetup(struct chacha_ctx *x, const uint8_t *k, uint32_t kbits);
 void chacha_ivsetup(struct chacha_ctx *x, const uint8_t *iv, const uint8_t *ctr);
 void chacha_encrypt_bytes(struct chacha_ctx *x, const uint8_t *m, uint8_t * c, uint32_t bytes);
 #endif /* CHACHA_H */
--- a/src/chacha-poly1305/poly1305.c
+++ b/src/chacha-poly1305/poly1305.c
@ -0,0 +1,197 @@
 /* 
 * Public Domain poly1305 from Andrew Moon
 * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
 */
 #include "../system.h"
 #include "poly1305.h"
 #define mul32x32_64(a,b) ((uint64_t)(a) * (b))
 #define U8TO32_LE(p) \
 	(((uint32_t)((p)[0])) | \
 	 ((uint32_t)((p)[1]) <<  8) | \
 	 ((uint32_t)((p)[2]) << 16) | \
 	 ((uint32_t)((p)[3]) << 24))
 #define U32TO8_LE(p, v) \
 	do { \
 		(p)[0] = (uint8_t)((v)); \
 		(p)[1] = (uint8_t)((v) >>  8); \
 		(p)[2] = (uint8_t)((v) >> 16); \
 		(p)[3] = (uint8_t)((v) >> 24); \
 	} while (0)
 void
 poly1305_auth(unsigned char out[POLY1305_TAGLEN], const unsigned char *m, size_t inlen, const unsigned char key[POLY1305_KEYLEN])
 {
 	uint32_t t0, t1, t2, t3;
 	uint32_t h0, h1, h2, h3, h4;
 	uint32_t r0, r1, r2, r3, r4;
 	uint32_t s1, s2, s3, s4;
 	uint32_t b, nb;
 	size_t j;
 	uint64_t t[5];
 	uint64_t f0, f1, f2, f3;
 	uint32_t g0, g1, g2, g3, g4;
 	uint64_t c;
 	unsigned char mp[16];
 	/* clamp key */
 	t0 = U8TO32_LE(key + 0);
 	t1 = U8TO32_LE(key + 4);
 	t2 = U8TO32_LE(key + 8);
 	t3 = U8TO32_LE(key + 12);
 	/* precompute multipliers */
 	r0 = t0 & 0x3ffffff;
 	t0 >>= 26;
 	t0 |= t1 << 6;
 	r1 = t0 & 0x3ffff03;
 	t1 >>= 20;
 	t1 |= t2 << 12;
 	r2 = t1 & 0x3ffc0ff;
 	t2 >>= 14;
 	t2 |= t3 << 18;
 	r3 = t2 & 0x3f03fff;
 	t3 >>= 8;
 	r4 = t3 & 0x00fffff;
 	s1 = r1 * 5;
 	s2 = r2 * 5;
 	s3 = r3 * 5;
 	s4 = r4 * 5;
 	/* init state */
 	h0 = 0;
 	h1 = 0;
 	h2 = 0;
 	h3 = 0;
 	h4 = 0;
 	/* full blocks */
 	if (inlen < 16)
 		goto poly1305_donna_atmost15bytes;
 poly1305_donna_16bytes:
 	m += 16;
 	inlen -= 16;
 	t0 = U8TO32_LE(m - 16);
 	t1 = U8TO32_LE(m - 12);
 	t2 = U8TO32_LE(m - 8);
 	t3 = U8TO32_LE(m - 4);
 	h0 += t0 & 0x3ffffff;
 	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
 	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
 	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
 	h4 += (t3 >> 8) | (1 << 24);
 poly1305_donna_mul:
 	t[0] = mul32x32_64(h0, r0) + mul32x32_64(h1, s4) + mul32x32_64(h2, s3) + mul32x32_64(h3, s2) + mul32x32_64(h4, s1);
 	t[1] = mul32x32_64(h0, r1) + mul32x32_64(h1, r0) + mul32x32_64(h2, s4) + mul32x32_64(h3, s3) + mul32x32_64(h4, s2);
 	t[2] = mul32x32_64(h0, r2) + mul32x32_64(h1, r1) + mul32x32_64(h2, r0) + mul32x32_64(h3, s4) + mul32x32_64(h4, s3);
 	t[3] = mul32x32_64(h0, r3) + mul32x32_64(h1, r2) + mul32x32_64(h2, r1) + mul32x32_64(h3, r0) + mul32x32_64(h4, s4);
 	t[4] = mul32x32_64(h0, r4) + mul32x32_64(h1, r3) + mul32x32_64(h2, r2) + mul32x32_64(h3, r1) + mul32x32_64(h4, r0);
 	h0 = (uint32_t) t[0] & 0x3ffffff;
 	c = (t[0] >> 26);
 	t[1] += c;
 	h1 = (uint32_t) t[1] & 0x3ffffff;
 	b = (uint32_t) (t[1] >> 26);
 	t[2] += b;
 	h2 = (uint32_t) t[2] & 0x3ffffff;
 	b = (uint32_t) (t[2] >> 26);
 	t[3] += b;
 	h3 = (uint32_t) t[3] & 0x3ffffff;
 	b = (uint32_t) (t[3] >> 26);
 	t[4] += b;
 	h4 = (uint32_t) t[4] & 0x3ffffff;
 	b = (uint32_t) (t[4] >> 26);
 	h0 += b * 5;
 	if (inlen >= 16)
 		goto poly1305_donna_16bytes;
 	/* final bytes */
 poly1305_donna_atmost15bytes:
 	if (!inlen)
 		goto poly1305_donna_finish;
 	for (j = 0; j < inlen; j++)
 		mp[j] = m[j];
 	mp[j++] = 1;
 	for (; j < 16; j++)
 		mp[j] = 0;
 	inlen = 0;
 	t0 = U8TO32_LE(mp + 0);
 	t1 = U8TO32_LE(mp + 4);
 	t2 = U8TO32_LE(mp + 8);
 	t3 = U8TO32_LE(mp + 12);
 	h0 += t0 & 0x3ffffff;
 	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
 	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
 	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
 	h4 += (t3 >> 8);
 	goto poly1305_donna_mul;
 poly1305_donna_finish:
 	b = h0 >> 26;
 	h0 = h0 & 0x3ffffff;
 	h1 += b;
 	b = h1 >> 26;
 	h1 = h1 & 0x3ffffff;
 	h2 += b;
 	b = h2 >> 26;
 	h2 = h2 & 0x3ffffff;
 	h3 += b;
 	b = h3 >> 26;
 	h3 = h3 & 0x3ffffff;
 	h4 += b;
 	b = h4 >> 26;
 	h4 = h4 & 0x3ffffff;
 	h0 += b * 5;
 	b = h0 >> 26;
 	h0 = h0 & 0x3ffffff;
 	h1 += b;
 	g0 = h0 + 5;
 	b = g0 >> 26;
 	g0 &= 0x3ffffff;
 	g1 = h1 + b;
 	b = g1 >> 26;
 	g1 &= 0x3ffffff;
 	g2 = h2 + b;
 	b = g2 >> 26;
 	g2 &= 0x3ffffff;
 	g3 = h3 + b;
 	b = g3 >> 26;
 	g3 &= 0x3ffffff;
 	g4 = h4 + b - (1 << 26);
 	b = (g4 >> 31) - 1;
 	nb = ~b;
 	h0 = (h0 & nb) | (g0 & b);
 	h1 = (h1 & nb) | (g1 & b);
 	h2 = (h2 & nb) | (g2 & b);
 	h3 = (h3 & nb) | (g3 & b);
 	h4 = (h4 & nb) | (g4 & b);
 	f0 = ((h0) | (h1 << 26)) + (uint64_t) U8TO32_LE(&key[16]);
 	f1 = ((h1 >> 6) | (h2 << 20)) + (uint64_t) U8TO32_LE(&key[20]);
 	f2 = ((h2 >> 12) | (h3 << 14)) + (uint64_t) U8TO32_LE(&key[24]);
 	f3 = ((h3 >> 18) | (h4 << 8)) + (uint64_t) U8TO32_LE(&key[28]);
 	U32TO8_LE(&out[0], f0);
 	f1 += (f0 >> 32);
 	U32TO8_LE(&out[4], f1);
 	f2 += (f1 >> 32);
 	U32TO8_LE(&out[8], f2);
 	f3 += (f2 >> 32);
 	U32TO8_LE(&out[12], f3);
 }
--- a/src/chacha-poly1305/poly1305.h
+++ b/src/chacha-poly1305/poly1305.h
@ -0,0 +1,16 @@
 /* $OpenBSD: poly1305.h,v 1.2 2013/12/19 22:57:13 djm Exp $ */
 /* 
 * Public Domain poly1305 from Andrew Moon
 * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
 */
 #ifndef POLY1305_H
 #define POLY1305_H
 #define POLY1305_KEYLEN		32
 #define POLY1305_TAGLEN		16
 void poly1305_auth(uint8_t out[POLY1305_TAGLEN], const uint8_t *m, size_t inlen, const uint8_t key[POLY1305_KEYLEN]);
 #endif				/* POLY1305_H */
--- a/src/cipher.h
+++ b/src/cipher.h
@ -0,0 +1,47 @@
 /*
    cipher.h -- header file cipher.c
    Copyright (C) 2007-2013 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __TINC_CIPHER_H__
 #define __TINC_CIPHER_H__
 #define CIPHER_MAX_BLOCK_SIZE 32
 #define CIPHER_MAX_IV_SIZE 16
 #define CIPHER_MAX_KEY_SIZE 32
 #ifndef DISABLE_LEGACY
 typedef struct cipher cipher_t;
 extern cipher_t *cipher_open_by_name(const char *) __attribute__ ((__malloc__));
 extern cipher_t *cipher_open_by_nid(int) __attribute__ ((__malloc__));
 extern cipher_t *cipher_open_blowfish_ofb(void) __attribute__ ((__malloc__));
 extern void cipher_close(cipher_t *);
 extern size_t cipher_keylength(const cipher_t *);
 extern size_t cipher_blocksize(const cipher_t *);
 extern void cipher_get_key(const cipher_t *, void *);
 extern bool cipher_set_key(cipher_t *, void *, bool) __attribute__ ((__warn_unused_result__));
 extern bool cipher_set_key_from_rsa(cipher_t *, void *, size_t, bool) __attribute__ ((__warn_unused_result__));
 extern bool cipher_encrypt(cipher_t *, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__ ((__warn_unused_result__));
 extern bool cipher_decrypt(cipher_t *, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__ ((__warn_unused_result__));
 extern int cipher_get_nid(const cipher_t *);
 extern bool cipher_active(const cipher_t *);
 #endif
 #endif
--- a/src/conf.c
+++ b/src/conf.c
@ -1,10 +1,11 @@
 /*
    conf.c -- configuration code
-    Copyright (C) 1998 Robert van der Meulen
+    Copyright (C) 1998      Robert van der Meulen
                  1998-2005 Ivo Timmermans
-                  2000-2014 Guus Sliepen <guus@tinc-vpn.org>
+                  2000      Cris van Pelt
                  2010-2011 Julien Muchembled <jm@jmuchemb.eu>
-                  2000 Cris van Pelt
+                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
                  2013      Florent Clairambault <florent@clairambault.fr>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@ -23,107 +24,104 @@
 #include "system.h"
-#include "avl_tree.h"
+#include "splay_tree.h"
 #include "connection.h"
 #include "conf.h"
 #include "list.h"
 #include "logger.h"
-#include "netutl.h"                             /* for str2address */
+#include "names.h"
 #include "netutl.h"             /* for str2address */
 #include "protocol.h"
-#include "utils.h"                              /* for cp */
+#include "utils.h"              /* for cp */
 #include "xalloc.h"
-avl_tree_t *config_tree;
+splay_tree_t *config_tree;
-int pinginterval = 0;                   /* seconds between pings */
+int pinginterval = 0;           /* seconds between pings */
-int pingtimeout = 0;                    /* seconds to wait for response */
+int pingtimeout = 0;            /* seconds to wait for response */
 char *confbase = NULL;                  /* directory in which all config files are */
 char *netname = NULL;                   /* name of the vpn network */
 list_t *cmdline_conf = NULL;    /* global/host configuration values given at the command line */
 static int config_compare(const config_t *a, const config_t *b) {
 	int result;
 	result = strcasecmp(a->variable, b->variable);
-	if(result) {
+	if(result)
 		return result;
 	}
 	/* give priority to command line options */
 	result = !b->file - !a->file;
-
+	if (result)
 	if(result) {
 		return result;
 	}
 	result = a->line - b->line;
-	if(result) {
+	if(result)
 		return result;
-	} else {
+	else
 		return a->file ? strcmp(a->file, b->file) : 0;
 	}
 }
-void init_configuration(avl_tree_t **config_tree) {
+void init_configuration(splay_tree_t ** config_tree) {
-	*config_tree = avl_alloc_tree((avl_compare_t) config_compare, (avl_action_t) free_config);
+	*config_tree = splay_alloc_tree((splay_compare_t) config_compare, (splay_action_t) free_config);
 }
-void exit_configuration(avl_tree_t **config_tree) {
+void exit_configuration(splay_tree_t ** config_tree) {
-	avl_delete_tree(*config_tree);
+	splay_delete_tree(*config_tree);
 	*config_tree = NULL;
 }
 config_t *new_config(void) {
-	return xmalloc_and_zero(sizeof(config_t));
+	return xzalloc(sizeof(config_t));
 }
 void free_config(config_t *cfg) {
-	free(cfg->variable);
+	if(cfg->variable)
-	free(cfg->value);
+		free(cfg->variable);
-	free(cfg->file);
+
 	if(cfg->value)
 		free(cfg->value);
 	if(cfg->file)
 		free(cfg->file);
 	free(cfg);
 }
-void config_add(avl_tree_t *config_tree, config_t *cfg) {
+void config_add(splay_tree_t *config_tree, config_t *cfg) {
-	avl_insert(config_tree, cfg);
+	splay_insert(config_tree, cfg);
 }
-config_t *lookup_config(const avl_tree_t *config_tree, char *variable) {
+config_t *lookup_config(splay_tree_t *config_tree, char *variable) {
 	config_t cfg, *found;
 	cfg.variable = variable;
 	cfg.file = NULL;
 	cfg.line = 0;
-	found = avl_search_closest_greater(config_tree, &cfg);
+	found = splay_search_closest_greater(config_tree, &cfg);
-	if(!found) {
+	if(!found)
 		return NULL;
 	}
-	if(strcasecmp(found->variable, variable)) {
+	if(strcasecmp(found->variable, variable))
 		return NULL;
 	}
 	return found;
 }
-config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg) {
+config_t *lookup_config_next(splay_tree_t *config_tree, const config_t *cfg) {
-	avl_node_t *node;
+	splay_node_t *node;
 	config_t *found;
-	node = avl_search_node(config_tree, cfg);
+	node = splay_search_node(config_tree, cfg);
 	if(node) {
 		if(node->next) {
 			found = node->next->data;
-			if(!strcasecmp(found->variable, cfg->variable)) {
+			if(!strcasecmp(found->variable, cfg->variable))
 				return found;
 			}
 		}
 	}
@ -131,9 +129,8 @@ config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg)
 }
 bool get_config_bool(const config_t *cfg, bool *result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
 	}
 	if(!strcasecmp(cfg->value, "yes")) {
 		*result = true;
@ -143,31 +140,28 @@ bool get_config_bool(const config_t *cfg, bool *result) {
 		return true;
 	}
-	logger(LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
+	logger(DEBUG_ALWAYS, LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+		   cfg->variable, cfg->file, cfg->line);
 	return false;
 }
 bool get_config_int(const config_t *cfg, int *result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
 	}
-	if(sscanf(cfg->value, "%d", result) == 1) {
+	if(sscanf(cfg->value, "%d", result) == 1)
 		return true;
 	}
-	logger(LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
+	logger(DEBUG_ALWAYS, LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+		   cfg->variable, cfg->file, cfg->line);
 	return false;
 }
 bool get_config_string(const config_t *cfg, char **result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
 	}
 	*result = xstrdup(cfg->value);
@ -177,9 +171,8 @@ bool get_config_string(const config_t *cfg, char **result) {
 bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 	struct addrinfo *ai;
-	if(!cfg) {
+	if(!cfg)
 		return false;
 	}
 	ai = str2addrinfo(cfg->value, NULL, 0);
@ -188,33 +181,32 @@ bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 		return true;
 	}
-	logger(LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
+	logger(DEBUG_ALWAYS, LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+		   cfg->variable, cfg->file, cfg->line);
 	return false;
 }
-bool get_config_subnet(const config_t *cfg, subnet_t **result) {
+bool get_config_subnet(const config_t *cfg, subnet_t ** result) {
-	subnet_t subnet = {0};
+	subnet_t subnet = {NULL};
-	if(!cfg) {
+	if(!cfg)
 		return false;
 	}
 	if(!str2net(&subnet, cfg->value)) {
-		logger(LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
+		logger(DEBUG_ALWAYS, LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
-		       cfg->variable, cfg->file, cfg->line);
+			   cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
 	/* Teach newbies what subnets are... */
 	if(((subnet.type == SUBNET_IPV4)
-	                && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(ipv4_t)))
+		&& !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof subnet.net.ipv4.address))
-	                || ((subnet.type == SUBNET_IPV6)
+		|| ((subnet.type == SUBNET_IPV6)
-	                    && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(ipv6_t)))) {
+		&& !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof subnet.net.ipv6.address))) {
-		logger(LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
+		logger(DEBUG_ALWAYS, LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
-		       cfg->variable, cfg->file, cfg->line);
+			   cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
@ -226,31 +218,27 @@ bool get_config_subnet(const config_t *cfg, subnet_t **result) {
 /*
  Read exactly one line and strip the trailing newline if any.
 */
-static char *readline(FILE *fp, char *buf, size_t buflen) {
+static char *readline(FILE * fp, char *buf, size_t buflen) {
 	char *newline = NULL;
 	char *p;
-	if(feof(fp)) {
+	if(feof(fp))
 		return NULL;
 	}
 	p = fgets(buf, buflen, fp);
-	if(!p) {
+	if(!p)
 		return NULL;
 	}
 	newline = strchr(p, '\n');
-	if(!newline) {
+	if(!newline)
 		return buf;
 	}
-	*newline = '\0';        /* kill newline */
+	/* kill newline and carriage return if necessary */
-
+	*newline = '\0';
-	if(newline > p && newline[-1] == '\r') { /* and carriage return if necessary */
+	if(newline > p && newline[-1] == '\r')
 		newline[-1] = '\0';
 	}
 	return buf;
 }
@ -262,32 +250,26 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
 	variable = value = line;
 	eol = line + strlen(line);
-
+	while(strchr("\t ", *--eol))
 	while(strchr("\t ", *--eol)) {
 		*eol = '\0';
 	}
 	len = strcspn(value, "\t =");
 	value += len;
 	value += strspn(value, "\t ");
 	if(*value == '=') {
 		value++;
 		value += strspn(value, "\t ");
 	}
 	variable[len] = '\0';
 	if(!*value) {
 		const char err[] = "No value for variable";
-
+		if (fname)
-		if(fname)
+			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' on line %d while reading config file %s",
-			logger(LOG_ERR, "%s `%s' on line %d while reading config file %s",
+				err, variable, lineno, fname);
 			       err, variable, lineno, fname);
 		else
-			logger(LOG_ERR, "%s `%s' in command line option %d",
+			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' in command line option %d",
-			       err, variable, lineno);
+				err, variable, lineno);
 		return NULL;
 	}
@ -304,7 +286,7 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
  Parse a configuration file and put the results in the configuration tree
  starting at *base.
 */
-bool read_config_file(avl_tree_t *config_tree, const char *fname) {
+bool read_config_file(splay_tree_t *config_tree, const char *fname) {
 	FILE *fp;
 	char buffer[MAX_STRING_SIZE];
 	char *line;
@ -316,32 +298,27 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 	fp = fopen(fname, "r");
 	if(!fp) {
-		logger(LOG_ERR, "Cannot open config file %s: %s", fname, strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Cannot open config file %s: %s", fname, strerror(errno));
 		return false;
 	}
 	for(;;) {
-		line = readline(fp, buffer, sizeof(buffer));
+		line = readline(fp, buffer, sizeof buffer);
 		if(!line) {
-			if(feof(fp)) {
+			if(feof(fp))
 				result = true;
 			}
 			break;
 		}
 		lineno++;
-		if(!*line || *line == '#') {
+		if(!*line || *line == '#')
 			continue;
 		}
 		if(ignore) {
-			if(!strncmp(line, "-----END", 8)) {
+			if(!strncmp(line, "-----END", 8))
 				ignore = false;
 			}
 			continue;
 		}
@ -351,11 +328,8 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 		}
 		cfg = parse_config_line(line, fname, lineno);
-
+		if (!cfg)
 		if(!cfg) {
 			break;
 		}
 		config_add(config_tree, cfg);
 	}
@ -364,31 +338,27 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 	return result;
 }
-void read_config_options(avl_tree_t *config_tree, const char *prefix) {
+void read_config_options(splay_tree_t *config_tree, const char *prefix) {
 	size_t prefix_len = prefix ? strlen(prefix) : 0;
 	for(const list_node_t *node = cmdline_conf->tail; node; node = node->prev) {
 		const config_t *cfg = node->data;
 		config_t *new;
 		if(!prefix) {
-			if(strchr(cfg->variable, '.')) {
+			if(strchr(cfg->variable, '.'))
 				continue;
 			}
 		} else {
 			if(strncmp(prefix, cfg->variable, prefix_len) ||
-			                cfg->variable[prefix_len] != '.') {
+			   cfg->variable[prefix_len] != '.')
 				continue;
 			}
 		}
-		config_t *new = new_config();
+		new = new_config();
-
+		if(prefix)
 		if(prefix) {
 			new->variable = xstrdup(cfg->variable + prefix_len + 1);
-		} else {
+		else
 			new->variable = xstrdup(cfg->variable);
 		}
 		new->value = xstrdup(cfg->value);
 		new->file = NULL;
 		new->line = cfg->line;
@ -403,200 +373,61 @@ bool read_server_config(void) {
 	read_config_options(config_tree, NULL);
-	snprintf(fname, sizeof(fname), "%s/tinc.conf", confbase);
+	snprintf(fname, sizeof fname, "%s" SLASH "tinc.conf", confbase);
 	errno = 0;
 	x = read_config_file(config_tree, fname);
 	// We will try to read the conf files in the "conf.d" dir
-	if(x) {
+	if (x) {
 		char dname[PATH_MAX];
-		snprintf(dname, sizeof(dname), "%s/conf.d", confbase);
+		snprintf(dname, sizeof dname, "%s" SLASH "conf.d", confbase);
-		DIR *dir = opendir(dname);
+		DIR *dir = opendir (dname);
 		// If we can find this dir
-		if(dir) {
+		if (dir) { 
 			struct dirent *ep;
 			// We list all the files in it
-			while(x && (ep = readdir(dir))) {
+			while (x && (ep = readdir (dir))) {
 				size_t l = strlen(ep->d_name);
 				// And we try to read the ones that end with ".conf"
-				if(l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
+				if (l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
-					if((size_t)snprintf(fname, sizeof(fname), "%s/%s", dname, ep->d_name) >= sizeof(fname)) {
+					snprintf(fname, sizeof fname, "%s" SLASH "%s", dname, ep->d_name);
 						logger(LOG_ERR, "Pathname too long: %s/%s", dname, ep->d_name);
 						return false;
 					}
 					x = read_config_file(config_tree, fname);
 				}
 			}
-
+			closedir (dir);
 			closedir(dir);
 		}
 	}
-	if(!x && errno) {
+	if(!x && errno)
-		logger(LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
 	}
 	return x;
 }
-bool read_connection_config(connection_t *c) {
+bool read_host_config(splay_tree_t *config_tree, const char *name) {
 	char fname[PATH_MAX];
 	bool x;
-	read_config_options(c->config_tree, c->name);
+	read_config_options(config_tree, name);
-	snprintf(fname, sizeof(fname), "%s/hosts/%s", confbase, c->name);
+	snprintf(fname, sizeof fname, "%s" SLASH "hosts" SLASH "%s", confbase, name);
-	x = read_config_file(c->config_tree, fname);
+	x = read_config_file(config_tree, fname);
 	return x;
 }
-static void disable_old_keys(const char *filename) {
+bool append_config_file(const char *name, const char *key, const char *value) {
-	char tmpfile[PATH_MAX] = "";
+	char fname[PATH_MAX];
-	char buf[1024];
+	snprintf(fname, sizeof fname, "%s" SLASH "hosts" SLASH "%s", confbase, name);
 	bool disabled = false;
 	FILE *r, *w;
-	r = fopen(filename, "r");
+	FILE *fp = fopen(fname, "a");
-	if(!r) {
+	if(!fp) {
-		return;
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Cannot open config file %s: %s", fname, strerror(errno));
 		return false;
 	}
-	int len = snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
+	fprintf(fp, "\n# The following line was automatically added by tinc\n%s = %s\n", key, value);
-
+	fclose(fp);
-	if(len < 0 || len >= PATH_MAX) {
+	return true;
 		fprintf(stderr, "Pathname too long: %s.tmp\n", filename);
 		w = NULL;
 	} else {
 		w = fopen(tmpfile, "w");
 	}
 	while(fgets(buf, sizeof(buf), r)) {
 		if(!strncmp(buf, "-----BEGIN RSA", 14)) {
 			buf[11] = 'O';
 			buf[12] = 'L';
 			buf[13] = 'D';
 			disabled = true;
 		} else if(!strncmp(buf, "-----END RSA", 12)) {
 			buf[ 9] = 'O';
 			buf[10] = 'L';
 			buf[11] = 'D';
 			disabled = true;
 		}
 		if(w && fputs(buf, w) < 0) {
 			disabled = false;
 			break;
 		}
 	}
 	if(w) {
 		fclose(w);
 	}
 	fclose(r);
 	if(!w && disabled) {
 		fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
 		return;
 	}
 	if(disabled) {
 #ifdef HAVE_MINGW
 		// We cannot atomically replace files on Windows.
 		char bakfile[PATH_MAX] = "";
 		snprintf(bakfile, sizeof(bakfile), "%s.bak", filename);
 		if(rename(filename, bakfile) || rename(tmpfile, filename)) {
 			rename(bakfile, filename);
 #else
 		if(rename(tmpfile, filename)) {
 #endif
 			fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
 		} else  {
 #ifdef HAVE_MINGW
 			unlink(bakfile);
 #endif
 			fprintf(stderr, "Warning: old key(s) found and disabled.\n");
 		}
 	}
 	unlink(tmpfile);
 }
 FILE *ask_and_open(const char *filename, const char *what) {
 	FILE *r;
 	char directory[PATH_MAX];
 	char line[PATH_MAX];
 	char abspath[PATH_MAX];
 	const char *fn;
 	/* Check stdin and stdout */
 	if(!isatty(0) || !isatty(1)) {
 		/* Argh, they are running us from a script or something.  Write
 		   the files to the current directory and let them burn in hell
 		   for ever. */
 		fn = filename;
 	} else {
 		/* Ask for a file and/or directory name. */
 		fprintf(stdout, "Please enter a file to save %s to [%s]: ",
 		        what, filename);
 		fflush(stdout);
 		fn = readline(stdin, line, sizeof(line));
 		if(!fn) {
 			fprintf(stderr, "Error while reading stdin: %s\n",
 			        strerror(errno));
 			return NULL;
 		}
 		if(!strlen(fn))
 			/* User just pressed enter. */
 		{
 			fn = filename;
 		}
 	}
 #ifdef HAVE_MINGW
 	if(fn[0] != '\\' && fn[0] != '/' && !strchr(fn, ':')) {
 #else
 	if(fn[0] != '/') {
 #endif
 		/* The directory is a relative path or a filename. */
 		getcwd(directory, sizeof(directory));
 		if((size_t)snprintf(abspath, sizeof(abspath), "%s/%s", directory, fn) >= sizeof(abspath)) {
 			fprintf(stderr, "Pathname too long: %s/%s\n", directory, fn);
 			return NULL;
 		}
 		fn = abspath;
 	}
 	umask(0077);                            /* Disallow everything for group and other */
 	disable_old_keys(fn);
 	/* Open it first to keep the inode busy */
 	r = fopen(fn, "a");
 	if(!r) {
 		fprintf(stderr, "Error opening file `%s': %s\n",
 		        fn, strerror(errno));
 		return NULL;
 	}
 	return r;
 }
--- a/src/conf.h
+++ b/src/conf.h
@ -1,10 +1,7 @@
 #ifndef TINC_CONF_H
 #define TINC_CONF_H
 /*
    conf.h -- header for conf.c
    Copyright (C) 1998-2005 Ivo Timmermans
-                  2000-2012 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2013 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@ -21,8 +18,12 @@
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "avl_tree.h"
+#ifndef __TINC_CONF_H__
 #define __TINC_CONF_H__
 #include "list.h"
 #include "splay_tree.h"
 #include "subnet.h"
 typedef struct config_t {
 	char *variable;
@ -31,37 +32,33 @@ typedef struct config_t {
 	int line;
 } config_t;
 #include "subnet.h"
-extern avl_tree_t *config_tree;
+extern splay_tree_t *config_tree;
 extern int pinginterval;
 extern int pingtimeout;
 extern int maxtimeout;
 extern int mintimeout;
 extern bool bypass_security;
 extern char *confbase;
 extern char *netname;
 extern list_t *cmdline_conf;
-extern void init_configuration(avl_tree_t **config_tree);
+extern void init_configuration(splay_tree_t **);
-extern void exit_configuration(avl_tree_t **config_tree);
+extern void exit_configuration(splay_tree_t **);
-extern config_t *new_config(void) __attribute__((__malloc__));
+extern config_t *new_config(void) __attribute__ ((__malloc__));
-extern void free_config(config_t *cfg);
+extern void free_config(config_t *);
-extern void config_add(avl_tree_t *config_tree, config_t *cfg);
+extern void config_add(splay_tree_t *, config_t *);
-extern config_t *lookup_config(const avl_tree_t *config_tree, char *variable);
+extern config_t *lookup_config(splay_tree_t *, char *);
-extern config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg);
+extern config_t *lookup_config_next(splay_tree_t *, const config_t *);
-extern bool get_config_bool(const config_t *cfg, bool *result);
+extern bool get_config_bool(const config_t *, bool *);
-extern bool get_config_int(const config_t *cfg, int *result);
+extern bool get_config_int(const config_t *, int *);
-extern bool get_config_string(const config_t *cfg, char **result);
+extern bool get_config_string(const config_t *, char **);
-extern bool get_config_address(const config_t *cfg, struct addrinfo **result);
+extern bool get_config_address(const config_t *, struct addrinfo **);
-extern bool get_config_subnet(const config_t *cfg, struct subnet_t **result);
+extern bool get_config_subnet(const config_t *, struct subnet_t **);
-extern config_t *parse_config_line(char *line, const char *fname, int lineno);
+extern config_t *parse_config_line(char *, const char *, int);
-extern bool read_config_file(avl_tree_t *config_tree, const char *fname);
+extern bool read_config_file(splay_tree_t *, const char *);
-extern void read_config_options(avl_tree_t *config_tree, const char *prefix);
+extern void read_config_options(splay_tree_t *, const char *);
 extern bool read_server_config(void);
-extern bool read_connection_config(struct connection_t *c);
+extern bool read_host_config(splay_tree_t *, const char *);
-extern FILE *ask_and_open(const char *fname, const char *what);
+extern bool append_config_file(const char *, const char *, const char *);
-#endif
+#endif /* __TINC_CONF_H__ */
--- a/src/connection.c
+++ b/src/connection.c
@ -1,6 +1,6 @@
 /*
    connection.c -- connection list management
-    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
                  2000-2005 Ivo Timmermans
                  2008      Max Rijevski <maksuf@gmail.com>
@ -21,131 +21,85 @@
 #include "system.h"
-#include "avl_tree.h"
+#include "list.h"
 #include "cipher.h"
 #include "conf.h"
 #include "control_common.h"
 #include "list.h"
 #include "logger.h"
 #include "rsa.h"
 #include "subnet.h"
 #include "utils.h"
 #include "xalloc.h"
-avl_tree_t *connection_tree;    /* Meta connections */
+list_t *connection_list;
 connection_t *everyone;
 static int connection_compare(const connection_t *a, const connection_t *b) {
 	return a < b ? -1 : a == b ? 0 : 1;
 }
 void init_connections(void) {
-	connection_tree = avl_alloc_tree((avl_compare_t) connection_compare, (avl_action_t) free_connection);
+	connection_list = list_alloc((list_action_t) free_connection);
 	everyone = new_connection();
 	everyone->name = xstrdup("everyone");
 	everyone->hostname = xstrdup("BROADCAST");
 }
 void exit_connections(void) {
-	avl_delete_tree(connection_tree);
+	list_delete_list(connection_list);
 	free_connection(everyone);
 }
 connection_t *new_connection(void) {
-	connection_t *c;
+	return xzalloc(sizeof(connection_t));
 	c = xmalloc_and_zero(sizeof(connection_t));
 	if(!c) {
 		return NULL;
 	}
 	gettimeofday(&c->start, NULL);
 	return c;
 }
 void free_connection_partially(connection_t *c) {
 	free(c->inkey);
 	free(c->outkey);
 	free(c->mychallenge);
 	free(c->hischallenge);
 	free(c->outbuf);
 	c->inkey = NULL;
 	c->outkey = NULL;
 	c->mychallenge = NULL;
 	c->hischallenge = NULL;
 	c->outbuf = NULL;
 	c->status.pinged = false;
 	c->status.active = false;
 	c->status.connecting = false;
 	c->status.timeout = false;
 	c->status.encryptout = false;
 	c->status.decryptin = false;
 	c->status.mst = false;
 	c->options = 0;
 	c->buflen = 0;
 	c->reqlen = 0;
 	c->tcplen = 0;
 	c->allow_request = 0;
 	c->outbuflen = 0;
 	c->outbufsize = 0;
 	c->outbufstart = 0;
 	c->last_ping_time = 0;
 	c->last_flushed_time = 0;
 	c->inbudget = 0;
 	c->outbudget = 0;
 	if(c->inctx) {
 		EVP_CIPHER_CTX_reset(c->inctx);
 		free(c->inctx);
 		c->inctx = NULL;
 	}
 	if(c->outctx) {
 		EVP_CIPHER_CTX_reset(c->outctx);
 		free(c->outctx);
 		c->outctx = NULL;
 	}
 	if(c->rsa_key) {
 		RSA_free(c->rsa_key);
 		c->rsa_key = NULL;
 	}
 }
 void free_connection(connection_t *c) {
-	free_connection_partially(c);
+	if(!c)
 		return;
 #ifndef DISABLE_LEGACY
 	cipher_close(c->incipher);
 	digest_close(c->indigest);
 	cipher_close(c->outcipher);
 	digest_close(c->outdigest);
 	rsa_free(c->rsa);
 #endif
 	sptps_stop(&c->sptps);
 	ecdsa_free(c->ecdsa);
 	free(c->hischallenge);
 	buffer_clear(&c->inbuf);
 	buffer_clear(&c->outbuf);
 	io_del(&c->io);
 	if(c->socket > 0)
 		closesocket(c->socket);
 	free(c->name);
 	free(c->hostname);
-	if(c->config_tree) {
+	if(c->config_tree)
 		exit_configuration(&c->config_tree);
 	}
 	free(c);
 }
 void connection_add(connection_t *c) {
-	avl_insert(connection_tree, c);
+	list_insert_tail(connection_list, c);
 }
 void connection_del(connection_t *c) {
-	avl_delete(connection_tree, c);
+	list_delete(connection_list, c);
 }
-void dump_connections(void) {
+bool dump_connections(connection_t *cdump) {
-	avl_node_t *node;
+	for list_each(connection_t, c, connection_list) {
-	connection_t *c;
+		send_request(cdump, "%d %d %s %s %x %d %x",
-
+				CONTROL, REQ_DUMP_CONNECTIONS,
-	logger(LOG_DEBUG, "Connections:");
+				c->name, c->hostname, c->options, c->socket,
-
+				bitfield_to_int(&c->status, sizeof c->status));
 	for(node = connection_tree->head; node; node = node->next) {
 		c = node->data;
 		logger(LOG_DEBUG, " %s at %s options %x socket %d status %04x outbuf %d/%d/%d",
 		       c->name, c->hostname, c->options, c->socket, bitfield_to_int(&c->status, sizeof(c->status)),
 		       c->outbufsize, c->outbufstart, c->outbuflen);
 	}
-	logger(LOG_DEBUG, "End of connections.");
+	return send_request(cdump, "%d %d", CONTROL, REQ_DUMP_CONNECTIONS);
 }
--- a/src/connection.h
+++ b/src/connection.h
@ -1,9 +1,6 @@
 #ifndef TINC_CONNECTION_H
 #define TINC_CONNECTION_H
 /*
    connection.h -- header for connection.c
-    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
                  2000-2005 Ivo Timmermans
    This program is free software; you can redistribute it and/or modify
@ -21,45 +18,52 @@
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include <openssl/rsa.h>
+#ifndef __TINC_CONNECTION_H__
-#include <openssl/evp.h>
+#define __TINC_CONNECTION_H__
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#include "buffer.h"
-#define EVP_CIPHER_CTX_reset(c) EVP_CIPHER_CTX_cleanup(c)
+#include "cipher.h"
-#endif
+#include "digest.h"
-
+#include "rsa.h"
-#include "avl_tree.h"
+#include "list.h"
 #include "sptps.h"
 #define OPTION_INDIRECT         0x0001
 #define OPTION_TCPONLY          0x0002
 #define OPTION_PMTU_DISCOVERY   0x0004
 #define OPTION_CLAMP_MSS        0x0008
 #define OPTION_VERSION(x) ((x) >> 24) /* Top 8 bits are for protocol minor version */
 typedef struct connection_status_t {
-	unsigned int pinged: 1;         /* sent ping */
+		unsigned int pinged:1;                  /* sent ping */
-	unsigned int active: 1;         /* 1 if active.. */
+		unsigned int unused_active:1;
-	unsigned int connecting: 1;     /* 1 if we are waiting for a non-blocking connect() to finish */
+		unsigned int connecting:1;              /* 1 if we are waiting for a non-blocking connect() to finish */
-	unsigned int unused_termreq: 1; /* the termination of this connection was requested */
+		unsigned int unused_termreq:1;          /* the termination of this connection was requested */
-	unsigned int remove: 1;         /* Set to 1 if you want this connection removed */
+		unsigned int remove_unused:1;           /* Set to 1 if you want this connection removed */
-	unsigned int timeout: 1;        /* 1 if gotten timeout */
+		unsigned int timeout_unused:1;          /* 1 if gotten timeout */
-	unsigned int encryptout: 1;     /* 1 if we can encrypt outgoing traffic */
+		unsigned int encryptout:1;              /* 1 if we can encrypt outgoing traffic */
-	unsigned int decryptin: 1;      /* 1 if we have to decrypt incoming traffic */
+		unsigned int decryptin:1;               /* 1 if we have to decrypt incoming traffic */
-	unsigned int mst: 1;            /* 1 if this connection is part of a minimum spanning tree */
+		unsigned int mst:1;                     /* 1 if this connection is part of a minimum spanning tree */
-	unsigned int proxy_passed: 1;   /* 1 if we are connecting via a proxy and we have finished talking with it */
+		unsigned int control:1;                 /* 1 if this is a control connection */
-	unsigned int tarpit: 1;         /* 1 if the connection should be added to the tarpit */
+		unsigned int pcap:1;                    /* 1 if this is a control connection requesting packet capture */
-	unsigned int unused: 21;
+		unsigned int log:1;                     /* 1 if this is a control connection requesting log dump */
 		unsigned int invitation:1;              /* 1 if this is an invitation */
 		unsigned int invitation_used:1;         /* 1 if the invitation has been consumed */
 		unsigned int unused:18;
 } connection_status_t;
 #include "ecdsa.h"
 #include "edge.h"
 #include "net.h"
 #include "node.h"
 typedef struct connection_t {
 	char *name;                     /* name he claims to have */
 	char *hostname;                 /* the hostname of its real ip */
 	union sockaddr_t address;       /* his real (internet) ip */
-	char *hostname;                 /* the hostname of its real ip */
+	int protocol_major;             /* used protocol */
-	int protocol_version;           /* used protocol */
+	int protocol_minor;             /* used protocol */
 	int socket;                     /* socket used for this connection */
 	uint32_t options;               /* options for this connection */
@ -71,53 +75,45 @@ typedef struct connection_t {
 	struct node_t *node;            /* node associated with the other end */
 	struct edge_t *edge;            /* edge associated with this connection */
-	RSA *rsa_key;                   /* his public/private key */
+#ifndef DISABLE_LEGACY
-	const EVP_CIPHER *incipher;     /* Cipher he will use to send data to us */
+	rsa_t *rsa;                     /* his public RSA key */
-	const EVP_CIPHER *outcipher;    /* Cipher we will use to send data to him */
+	cipher_t *incipher;             /* Cipher he will use to send data to us */
-	EVP_CIPHER_CTX *inctx;          /* Context of encrypted meta data that will come from him to us */
+	cipher_t *outcipher;            /* Cipher we will use to send data to him */
-	EVP_CIPHER_CTX *outctx;         /* Context of encrypted meta data that will be sent from us to him */
+	digest_t *indigest;
-	uint64_t inbudget;              /* Encrypted bytes send budget */
+	digest_t *outdigest;
-	uint64_t outbudget;             /* Encrypted bytes receive budget */
+#endif
-	char *inkey;                    /* His symmetric meta key + iv */
+
-	char *outkey;                   /* Our symmetric meta key + iv */
+	ecdsa_t *ecdsa;                 /* his public ECDSA key */
-	int inkeylength;                /* Length of his key + iv */
+	sptps_t sptps;
-	int outkeylength;               /* Length of our key + iv */
+
 	const EVP_MD *indigest;
 	const EVP_MD *outdigest;
 	int inmaclength;
 	int outmaclength;
 	int incompression;
 	int outcompression;
 	char *mychallenge;              /* challenge we received from him */
 	char *hischallenge;             /* challenge we sent to him */
-	char buffer[MAXBUFSIZE];        /* metadata input buffer */
+	char *hischallenge;             /* The challenge we sent to him */
-	int buflen;                     /* bytes read into buffer */
+
-	int reqlen;                     /* length of incoming request */
+	struct buffer_t inbuf;
-	length_t tcplen;                /* length of incoming TCPpacket */
+	struct buffer_t outbuf;
 	io_t io;                        /* input/output event on this metadata connection */
 	int tcplen;                     /* length of incoming TCPpacket */
 	int sptpslen;			/* length of incoming SPTPS packet */
 	int allow_request;              /* defined if there's only one request possible */
 	char *outbuf;                   /* metadata output buffer */
 	int outbufstart;                /* index of first meaningful byte in output buffer */
 	int outbuflen;                  /* number of meaningful bytes in output buffer */
 	int outbufsize;                 /* number of bytes allocated to output buffer */
 	time_t last_ping_time;          /* last time we saw some activity from the other end or pinged them */
 	time_t last_flushed_time;       /* last time buffer was empty. Only meaningful if outbuflen > 0 */
-	avl_tree_t *config_tree;        /* Pointer to configuration tree belonging to him */
+	splay_tree_t *config_tree;      /* Pointer to configuration tree belonging to him */
 } connection_t;
-extern avl_tree_t *connection_tree;
+extern list_t *connection_list;
 extern connection_t *everyone;
 extern void init_connections(void);
 extern void exit_connections(void);
-extern connection_t *new_connection(void) __attribute__((__malloc__));
+extern connection_t *new_connection(void) __attribute__ ((__malloc__));
-extern void free_connection(connection_t *c);
+extern void free_connection(connection_t *);
-extern void free_connection_partially(connection_t *c);
+extern void connection_add(connection_t *);
-extern void connection_add(connection_t *c);
+extern void connection_del(connection_t *);
-extern void connection_del(connection_t *c);
+extern bool dump_connections(struct connection_t *);
 extern void dump_connections(void);
-#endif
+#endif /* __TINC_CONNECTION_H__ */
--- a/src/control.c
+++ b/src/control.c
@ -0,0 +1,224 @@
 /*
    control.c -- Control socket handling.
    Copyright (C) 2013 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "system.h"
 #include "crypto.h"
 #include "conf.h"
 #include "control.h"
 #include "control_common.h"
 #include "graph.h"
 #include "logger.h"
 #include "meta.h"
 #include "names.h"
 #include "net.h"
 #include "netutl.h"
 #include "protocol.h"
 #include "route.h"
 #include "utils.h"
 #include "xalloc.h"
 char controlcookie[65];
 static bool control_return(connection_t *c, int type, int error) {
 	return send_request(c, "%d %d %d", CONTROL, type, error);
 }
 static bool control_ok(connection_t *c, int type) {
 	return control_return(c, type, 0);
 }
 bool control_h(connection_t *c, const char *request) {
 	int type;
 	if(!c->status.control || c->allow_request != CONTROL) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Unauthorized control request from %s (%s)", c->name, c->hostname);
 		return false;
 	}
 	if(sscanf(request, "%*d %d", &type) != 1) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "CONTROL", c->name, c->hostname);
 		return false;
 	}
 	switch (type) {
 		case REQ_STOP:
 			event_exit();
 			return control_ok(c, REQ_STOP);
 		case REQ_DUMP_NODES:
 			return dump_nodes(c);
 		case REQ_DUMP_EDGES:
 			return dump_edges(c);
 		case REQ_DUMP_SUBNETS:
 			return dump_subnets(c);
 		case REQ_DUMP_CONNECTIONS:
 			return dump_connections(c);
 		case REQ_PURGE:
 			purge();
 			return control_ok(c, REQ_PURGE);
 		case REQ_SET_DEBUG: {
 			int new_level;
 			if(sscanf(request, "%*d %*d %d", &new_level) != 1)
 				return false;
 			send_request(c, "%d %d %d", CONTROL, REQ_SET_DEBUG, debug_level);
 			if(new_level >= 0)
 				debug_level = new_level;
 			return true;
 		}
 		case REQ_RETRY:
 			retry();
 			return control_ok(c, REQ_RETRY);
 		case REQ_RELOAD:
 			logger(DEBUG_ALWAYS, LOG_NOTICE, "Got '%s' command", "reload");
 			int result = reload_configuration();
 			return control_return(c, REQ_RELOAD, result);
 		case REQ_DISCONNECT: {
 			char name[MAX_STRING_SIZE];
 			bool found = false;
 			if(sscanf(request, "%*d %*d " MAX_STRING, name) != 1)
 				return control_return(c, REQ_DISCONNECT, -1);
 			for list_each(connection_t, other, connection_list) {
 				if(strcmp(other->name, name))
 					continue;
 				terminate_connection(other, other->edge);
 				found = true;
 			}
 			return control_return(c, REQ_DISCONNECT, found ? 0 : -2);
 		}
 		case REQ_DUMP_TRAFFIC:
 			return dump_traffic(c);
 		case REQ_PCAP:
 			sscanf(request, "%*d %*d %d", &c->outmaclength);
 			c->status.pcap = true;
 			pcap = true;
 			return true;
 		case REQ_LOG:
 			sscanf(request, "%*d %*d %d", &c->outcompression);
 			c->status.log = true;
 			logcontrol = true;
 			return true;
 		default:
 			return send_request(c, "%d %d", CONTROL, REQ_INVALID);
 	}
 }
 bool init_control(void) {
 	randomize(controlcookie, sizeof controlcookie / 2);
 	bin2hex(controlcookie, controlcookie, sizeof controlcookie / 2);
 	mode_t mask = umask(0);
 	umask(mask | 077);
 	FILE *f = fopen(pidfilename, "w");
 	umask(mask);
 	if(!f) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Cannot write control socket cookie file %s: %s", pidfilename, strerror(errno));
 		return false;
 	}
 	// Get the address and port of the first listening socket
 	char *localhost = NULL;
 	sockaddr_t sa;
 	socklen_t len = sizeof sa;
 	// Make sure we have a valid address, and map 0.0.0.0 and :: to 127.0.0.1 and ::1.
 	if(getsockname(listen_socket[0].tcp.fd, (struct sockaddr *)&sa, &len)) {
 		xasprintf(&localhost, "127.0.0.1 port %s", myport);
 	} else {
 		if(sa.sa.sa_family == AF_INET) {
 			if(sa.in.sin_addr.s_addr == 0)
 				sa.in.sin_addr.s_addr = htonl(0x7f000001);
 		} else if(sa.sa.sa_family == AF_INET6) {
 			static const uint8_t zero[16] = {0};
 			if(!memcmp(sa.in6.sin6_addr.s6_addr, zero, sizeof zero))
 				sa.in6.sin6_addr.s6_addr[15] = 1;
 		}
 		localhost = sockaddr2hostname(&sa);
 	}
 	fprintf(f, "%d %s %s\n", (int)getpid(), controlcookie, localhost);
 	free(localhost);
 	fclose(f);
 #ifndef HAVE_MINGW
 	int unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);
 	if(unix_fd < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Could not create UNIX socket: %s", sockstrerror(sockerrno));
 		return false;
 	}
 	struct sockaddr_un sa_un;
 	sa_un.sun_family = AF_UNIX;
 	strncpy(sa_un.sun_path, unixsocketname, sizeof sa_un.sun_path);
 	if(connect(unix_fd, (struct sockaddr *)&sa_un, sizeof sa_un) >= 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "UNIX socket %s is still in use!", unixsocketname);
 		return false;
 	}
 	unlink(unixsocketname);
 	umask(mask | 077);
 	int result = bind(unix_fd, (struct sockaddr *)&sa_un, sizeof sa_un);
 	umask(mask);
 	if(result < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Could not bind UNIX socket to %s: %s", unixsocketname, sockstrerror(sockerrno));
 		return false;
 	}
 	if(listen(unix_fd, 3) < 0) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Could not listen on UNIX socket %s: %s", unixsocketname, sockstrerror(sockerrno));
 		return false;
 	}
 	io_add(&unix_socket, handle_new_unix_connection, &unix_socket, unix_fd, IO_READ);
 #endif
 	return true;
 }
 void exit_control(void) {
 #ifndef HAVE_MINGW
 	unlink(unixsocketname);
 	io_del(&unix_socket);
 	close(unix_socket.fd);
 #endif
 	unlink(pidfilename);
 }
--- a/src/control.h
+++ b/src/control.h
@ -0,0 +1,27 @@
 /*
    control.h -- header for control.c.
    Copyright (C) 2007 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __TINC_CONTROL_H__
 #define __TINC_CONTROL_H__
 extern bool init_control();
 extern void exit_control();
 extern char controlcookie[];
 #endif
--- a/src/control_common.h
+++ b/src/control_common.h
@ -0,0 +1,48 @@
 /*
    control_protocol.h -- control socket protocol.
    Copyright (C) 2007      Scott Lamb <slamb@slamb.org>
                  2009-2012 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __TINC_CONTROL_PROTOCOL_H__
 #define __TINC_CONTROL_PROTOCOL_H__
 #include "protocol.h"
 enum request_type {
 	REQ_INVALID = -1,
 	REQ_STOP = 0,
 	REQ_RELOAD,
 	REQ_RESTART,
 	REQ_DUMP_NODES,
 	REQ_DUMP_EDGES,
 	REQ_DUMP_SUBNETS,
 	REQ_DUMP_CONNECTIONS,
 	REQ_DUMP_GRAPH,
 	REQ_PURGE,
 	REQ_SET_DEBUG,
 	REQ_RETRY,
 	REQ_CONNECT,
 	REQ_DISCONNECT,
 	REQ_DUMP_TRAFFIC,
 	REQ_PCAP,
 	REQ_LOG,
 };
 #define TINC_CTL_VERSION_CURRENT 0
 #endif
--- a/src/crypto.h
+++ b/src/crypto.h
@ -0,0 +1,27 @@
 /*
    crypto.h -- header for crypto.c
    Copyright (C) 2007-2013 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __TINC_CRYPTO_H__
 #define __TINC_CRYPTO_H__
 extern void crypto_init();
 extern void crypto_exit();
 extern void randomize(void *, size_t);
 #endif
--- a/src/cygwin/device.c
+++ b/src/cygwin/device.c
@ -1,7 +1,7 @@
 /*
    device.c -- Interaction with Windows tap driver in a Cygwin environment
    Copyright (C) 2002-2005 Ivo Timmermans,
-                  2002-2016 Guus Sliepen <guus@tinc-vpn.org>
+                  2002-2014 Guus Sliepen <guus@tinc-vpn.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@ -27,6 +27,7 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
 #include "../names.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
@ -37,10 +38,7 @@ int device_fd = -1;
 static HANDLE device_handle = INVALID_HANDLE_VALUE;
 char *device = NULL;
 char *iface = NULL;
-static const char *device_info = "Windows tap device";
+static char *device_info = NULL;
 static uint64_t device_total_in = 0;
 static uint64_t device_total_out = 0;
 static pid_t reader_pid;
 static int sp[2];
@ -61,62 +59,54 @@ static bool setup_device(void) {
 	get_config_string(lookup_config(config_tree, "Device"), &device);
 	get_config_string(lookup_config(config_tree, "Interface"), &iface);
-	if(device && iface) {
+	if(device && iface)
 		logger(LOG_WARNING, "Warning: both Device and Interface specified, results may not be as expected");
 	}
 	/* Open registry and look for network adapters */
 	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, NETWORK_CONNECTIONS_KEY, 0, KEY_READ, &key)) {
-		logger(LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
 		return false;
 	}
-	for(i = 0; ; i++) {
+	for (i = 0; ; i++) {
-		len = sizeof(adapterid);
+		len = sizeof adapterid;
-
+		if(RegEnumKeyEx(key, i, adapterid, &len, 0, 0, 0, NULL))
 		if(RegEnumKeyEx(key, i, adapterid, &len, 0, 0, 0, NULL)) {
 			break;
 		}
 		/* Find out more about this adapter */
-		snprintf(regpath, sizeof(regpath), "%s\\%s\\Connection", NETWORK_CONNECTIONS_KEY, adapterid);
+		snprintf(regpath, sizeof regpath, "%s\\%s\\Connection", NETWORK_CONNECTIONS_KEY, adapterid);
-		if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, regpath, 0, KEY_READ, &key2)) {
+		if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, regpath, 0, KEY_READ, &key2))
 			continue;
 		}
-		len = sizeof(adaptername);
+		len = sizeof adaptername;
 		err = RegQueryValueEx(key2, "Name", 0, 0, adaptername, &len);
 		RegCloseKey(key2);
-		if(err) {
+		if(err)
 			continue;
 		}
 		if(device) {
 			if(!strcmp(device, adapterid)) {
 				found = true;
 				break;
-			} else {
+			} else
 				continue;
 			}
 		}
 		if(iface) {
 			if(!strcmp(iface, adaptername)) {
 				found = true;
 				break;
-			} else {
+			} else
 				continue;
 			}
 		}
-		snprintf(tapname, sizeof(tapname), USERMODEDEVICEDIR "%s" TAPSUFFIX, adapterid);
+		snprintf(tapname, sizeof tapname, USERMODEDEVICEDIR "%s" TAPSUFFIX, adapterid);
 		device_handle = CreateFile(tapname, GENERIC_WRITE | GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 		if(device_handle != INVALID_HANDLE_VALUE) {
 			CloseHandle(device_handle);
 			found = true;
@ -127,35 +117,33 @@ static bool setup_device(void) {
 	RegCloseKey(key);
 	if(!found) {
-		logger(LOG_ERR, "No Windows tap device found!");
+		logger(DEBUG_ALWAYS, LOG_ERR, "No Windows tap device found!");
 		return false;
 	}
-	if(!device) {
+	if(!device)
 		device = xstrdup(adapterid);
 	}
-	if(!iface) {
+	if(!iface)
 		iface = xstrdup(adaptername);
 	}
-	snprintf(tapname, sizeof(tapname), USERMODEDEVICEDIR "%s" TAPSUFFIX, device);
+	snprintf(tapname, sizeof tapname, USERMODEDEVICEDIR "%s" TAPSUFFIX, device);
 	/* Now we are going to open this device twice: once for reading and once for writing.
 	   We do this because apparently it isn't possible to check for activity in the select() loop.
 	   Furthermore I don't really know how to do it the "Windows" way. */
 	if(socketpair(AF_UNIX, SOCK_DGRAM, PF_UNIX, sp)) {
-		logger(LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
 		return false;
 	}
 	/* The parent opens the tap device for writing. */
-	device_handle = CreateFile(tapname, GENERIC_WRITE,  FILE_SHARE_READ,  0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
+	device_handle = CreateFile(tapname, GENERIC_WRITE,  FILE_SHARE_READ,  0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM , 0);
 	if(device_handle == INVALID_HANDLE_VALUE) {
-		logger(LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
@ -163,8 +151,8 @@ static bool setup_device(void) {
 	/* Get MAC address from tap device */
-	if(!DeviceIoControl(device_handle, TAP_IOCTL_GET_MAC, mymac.x, sizeof(mymac.x), mymac.x, sizeof(mymac.x), &len, 0)) {
+	if(!DeviceIoControl(device_handle, TAP_IOCTL_GET_MAC, mymac.x, sizeof mymac.x, mymac.x, sizeof mymac.x, &len, 0)) {
-		logger(LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
@ -177,7 +165,7 @@ static bool setup_device(void) {
 	reader_pid = fork();
 	if(reader_pid == -1) {
-		logger(LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
 		return false;
 	}
@ -186,20 +174,20 @@ static bool setup_device(void) {
 		   It passes everything it reads to the socket. */
 		char buf[MTU];
-		long lenin;
+		long inlen;
 		CloseHandle(device_handle);
 		device_handle = CreateFile(tapname, GENERIC_READ, FILE_SHARE_WRITE, 0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 		if(device_handle == INVALID_HANDLE_VALUE) {
-			logger(LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
+			logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
 			buf[0] = 0;
 			write(sp[1], buf, 1);
 			exit(1);
 		}
-		logger(LOG_DEBUG, "Tap reader forked and running.");
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader forked and running.");
 		/* Notify success */
@ -209,19 +197,20 @@ static bool setup_device(void) {
 		/* Pass packets */
 		for(;;) {
-			ReadFile(device_handle, buf, MTU, &lenin, NULL);
+			ReadFile(device_handle, buf, MTU, &inlen, NULL);
-			write(sp[1], buf, lenin);
+			write(sp[1], buf, inlen);
 		}
 	}
 	read(device_fd, &gelukt, 1);
 	if(gelukt != 1) {
-		logger(LOG_DEBUG, "Tap reader failed!");
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader failed!");
 		return false;
 	}
-	logger(LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
+	device_info = "Windows tap device";
 	logger(DEBUG_ALWAYS, LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
 	return true;
 }
@ -229,59 +218,49 @@ static bool setup_device(void) {
 static void close_device(void) {
 	close(sp[0]);
 	close(sp[1]);
-	CloseHandle(device_handle);
+	CloseHandle(device_handle); device_handle = INVALID_HANDLE_VALUE;
 	kill(reader_pid, SIGKILL);
-	free(device);
+	free(device); device = NULL;
-	free(iface);
+	free(iface); iface = NULL;
 	device_info = NULL;
 }
 static bool read_packet(vpn_packet_t *packet) {
-	int lenin;
+	int inlen;
-	if((lenin = read(sp[0], packet->data, MTU)) <= 0) {
+	if((inlen = read(sp[0], DATA(packet), MTU)) <= 0) {
-		logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
+		logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
-		       device, strerror(errno));
+			   device, strerror(errno));
 		return false;
 	}
-	packet->len = lenin;
+	packet->len = inlen;
-	device_total_in += packet->len;
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
-
+			   device_info);
 	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
 	                        device_info);
 	return true;
 }
 static bool write_packet(vpn_packet_t *packet) {
-	long lenout;
+	long outlen;
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
-	                        packet->len, device_info);
+			   packet->len, device_info);
-	if(!WriteFile(device_handle, packet->data, packet->len, &lenout, NULL)) {
+	if(!WriteFile (device_handle, DATA(packet), packet->len, &outlen, NULL)) {
-		logger(LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
 		return false;
 	}
 	device_total_out += packet->len;
 	return true;
 }
 static void dump_device_stats(void) {
 	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
 	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
 	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
 }
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
 	.dump_stats = dump_device_stats,
 };
--- a/src/device.h
+++ b/src/device.h
@ -1,6 +1,3 @@
 #ifndef TINC_DEVICE_H
 #define TINC_DEVICE_H
 /*
    device.h -- generic header for device.c
    Copyright (C) 2001-2005 Ivo Timmermans
@ -21,19 +18,22 @@
    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #ifndef __TINC_DEVICE_H__
 #define __TINC_DEVICE_H__
 #include "net.h"
 extern int device_fd;
 extern char *device;
 extern char *iface;
 typedef struct devops_t {
 	bool (*setup)(void);
 	void (*close)(void);
-	bool (*read)(struct vpn_packet_t *packet);
+	bool (*read)(struct vpn_packet_t *);
-	bool (*write)(struct vpn_packet_t *packet);
+	bool (*write)(struct vpn_packet_t *);
-	void (*dump_stats)(void);
+	void (*enable)(void);   /* optional */
 	void (*disable)(void);  /* optional */
 } devops_t;
 extern const devops_t os_devops;
@ -44,4 +44,4 @@ extern const devops_t uml_devops;
 extern const devops_t vde_devops;
 extern devops_t devops;
-#endif
+#endif /* __TINC_DEVICE_H__ */
--- a/Show more
+++ b/Show more
		`@ -1,2 +0,0 @@`
			`fix-incorrect-icmpv6-checksum`
			`support-etc-defaults-tinc`
		`@ -1,2 +0,0 @@`
			`version=3`
			`opts=pgpsigurlmangle=s/$/.sig/ http://www.tinc-vpn.org/packages/tinc-(1\.0\.\d+)\.tar\.gz`
		`@ -1 +0,0 @@`
			# Generate this file with `tincd -n example -K`
		`@ -0,0 +1,3 @@`
							`dist_bin_SCRIPTS = tinc-gui`

							`extra_DIST = README.gui`