AUTHORS

@@ -1,20 +1,25 @@
 Main tinc authors:
+
 - Guus Sliepen <guus@tinc-vpn.org>
 - Ivo Timmermans (inactive)
 
-Significant contributions from:
-- Michael Tokarev <mjt@tls.msk.ru>
+Significant code contributions from:
+
+- Brandon Black <blblack@gmail.com>
+- Etienne Dechamps <etienne@edechamps.fr>
 - Florian Forster <octo@verplant.org>
 - Grzegorz Dymarek <gregd72002@googlemail.com>
-- Max Rijevski <maksuf@gmail.com>
-- Scott Lamb <slamb@slamb.org>
 - Julien Muchembled <jm@jmuchemb.eu>
-- Timothy Redaelli <timothy@redaelli.eu>
-- Brandon Black <blblack@gmail.com>
 - Loïc Grenié <loic.grenie@gmail.com>
+- Max Rijevski <maksuf@gmail.com>
+- Michael Tokarev <mjt@tls.msk.ru>
+- Scott Lamb <slamb@slamb.org>
+- Sven-Haegar Koch <haegar@sdinet.de>
+- Timothy Redaelli <timothy@redaelli.eu>
 
 These files are from other sources:
- * lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
+
+* lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
  the syslog 1.3 sources.
 
 * src/bsd/tunemu.c and tunemu.h are by Friedrich Schöller
@@ -23,5 +28,4 @@ These files are from other sources:
 Also some of the macro files in the directory m4, and their
 accompanying files in lib, were taken from GNU fileutils.
 
-Please see the file THANKS for more information on contributions from
-users.
+Please see the file THANKS for a list of all contributors to tinc.

COPYING

@@ -1,4 +1,4 @@
-Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen and others.
+Copyright (C) 1998-2017 Ivo Timmermans, Guus Sliepen and others.
 See the AUTHORS file for a complete list.
 
 This program is free software; you can redistribute it and/or modify it under

COPYING.README

@@ -1,19 +1,17 @@
 The following applies to tinc:
 
-This program is released under the GPL with the additional exemption that
-compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
-packages linked to the OpenSSL libraries, provided that all other requirements
-of the GPL are met.
+> This program is released under the GPL with the additional exemption that
+> compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
+> packages linked to the OpenSSL libraries, provided that all other requirements
+> of the GPL are met.
 
 The following applies to the LZO library:
 
-  Hereby I grant a special exception to the tinc VPN project
-  (http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
-  (http://www.openssl.org).
-
-  Markus F.X.J. Oberhumer
+> Hereby I grant a special exception to the tinc VPN project
+> (https://www.tinc-vpn.org/) to link the LZO library with the OpenSSL library
+> (https://openssl.org).
+>
+> Markus F.X.J. Oberhumer
 
 When tinc is compiled with the --enable-tunemu option, the resulting binary
 falls under the GPL version 3 or later.
-
-

Makefile.am

@@ -2,14 +2,34 @@
 
 AUTOMAKE_OPTIONS = gnu
 
-SUBDIRS = src doc systemd
+SUBDIRS =  src doc gui test systemd
 
-ACLOCAL_AMFLAGS = -I m4 
+ACLOCAL_AMFLAGS = -I m4
 
 EXTRA_DIST = COPYING.README README.android
 
-ChangeLog:
-	git log > ChangeLog
+# If git describe works, force autoconf to run in order to make sure we have the
+# current version number from git in the resulting configure script.
+configure-version:
+	-cd $(srcdir) && git describe && autoconf --force
 
-astyle:
-	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]
+# Triggering the README target means we are building a distribution (make dist).
+README: configure-version
+
+ChangeLog:
+	(cd $(srcdir) && git log) > ChangeLog
+
+deb:
+	dpkg-buildpackage -rfakeroot
+
+rpm: dist
+	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
+	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
+	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
+
+release:
+	rm -f ChangeLog
+	$(MAKE) ChangeLog
+	echo "Please edit the NEWS file now..."
+	/usr/bin/editor $(srcdir)/NEWS
+	$(MAKE) dist

Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.2 from Makefile.am.
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2020 Free Software Foundation, Inc.
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -94,9 +94,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
-	$(top_srcdir)/configure.ac
+	$(top_srcdir)/m4/ax_require_defined.m4 \
+	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
+	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
+	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \
@@ -141,9 +143,9 @@ am__recursive_targets = \
   $(RECURSIVE_CLEAN_TARGETS) \
   $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	cscope distdir distdir-am dist dist-all distcheck
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
-	config.h.in
+	cscope distdir dist dist-all distcheck
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
+	$(LISP)config.h.in
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
 # *not* preserved.
@@ -221,6 +223,7 @@ CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@@ -238,8 +241,10 @@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
+LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
+MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -250,6 +255,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
+READLINE_LIBS = @READLINE_LIBS@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@@ -307,8 +313,8 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AUTOMAKE_OPTIONS = gnu
-SUBDIRS = src doc systemd
-ACLOCAL_AMFLAGS = -I m4 
+SUBDIRS = src doc gui test systemd
+ACLOCAL_AMFLAGS = -I m4
 EXTRA_DIST = COPYING.README README.android
 all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-recursive
@@ -335,8 +341,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' $(SHELL) ./config.status'; \
 	    $(SHELL) ./config.status;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -469,16 +475,7 @@ distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
 
-distdir: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) distdir-am
-
-distdir-am: $(DISTFILES)
-	@case `sed 15q $(srcdir)/NEWS` in \
-	*"$(VERSION)"*) : ;; \
-	*) \
-	  echo "NEWS not updated; not releasing" 1>&2; \
-	  exit 1;; \
-	esac
+distdir: $(DISTFILES)
 	$(am__remove_distdir)
 	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
@@ -558,10 +555,6 @@ dist-xz: distdir
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__post_remove_distdir)
 
-dist-zstd: distdir
-	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
-	$(am__post_remove_distdir)
-
 dist-tarZ: distdir
 	@echo WARNING: "Support for distribution archives compressed with" \
 		       "legacy program 'compress' is deprecated." >&2
@@ -604,8 +597,6 @@ distcheck: dist
 	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
-	*.tar.zst*) \
-	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
@@ -782,7 +773,7 @@ uninstall-am:
 	am--refresh check check-am clean clean-cscope clean-generic \
 	cscope cscopelist-am ctags ctags-am dist dist-all dist-bzip2 \
 	dist-gzip dist-lzip dist-shar dist-tarZ dist-xz dist-zip \
-	dist-zstd distcheck distclean distclean-generic distclean-hdr \
+	distcheck distclean distclean-generic distclean-hdr \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
@@ -797,11 +788,31 @@ uninstall-am:
 .PRECIOUS: Makefile
 
 
-ChangeLog:
-	git log > ChangeLog
+# If git describe works, force autoconf to run in order to make sure we have the
+# current version number from git in the resulting configure script.
+configure-version:
+	-cd $(srcdir) && git describe && autoconf --force
 
-astyle:
-	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]
+# Triggering the README target means we are building a distribution (make dist).
+README: configure-version
+
+ChangeLog:
+	(cd $(srcdir) && git log) > ChangeLog
+
+deb:
+	dpkg-buildpackage -rfakeroot
+
+rpm: dist
+	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
+	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
+	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
+
+release:
+	rm -f ChangeLog
+	$(MAKE) ChangeLog
+	echo "Please edit the NEWS file now..."
+	/usr/bin/editor $(srcdir)/NEWS
+	$(MAKE) dist
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.

README

@@ -1,11 +1,7 @@
-This is the README file for tinc version 1.0.36. Installation
+This is the README file for tinc version 1.1pre15. Installation
 instructions may be found in the INSTALL file.
 
-tinc is Copyright (C) 1998-2019 by:
-
-Ivo Timmermans,
-Guus Sliepen <guus@tinc-vpn.org>,
-and others.
+tinc is Copyright © 1998-2017 Ivo Timmermans, Guus Sliepen <guus@tinc-vpn.org>, and others.
 
 For a complete list of authors see the AUTHORS file.
 
@@ -15,119 +11,80 @@ the Free Software Foundation; either version 2 of the License, or (at
 your option) any later version. See the file COPYING for more details.
 
 
+This is a pre-release
+---------------------
+
+Please note that this is NOT a stable release. Until version 1.1.0 is released,
+please use one of the 1.0.x versions if you need a stable version of tinc.
+
+Although tinc 1.1 will be protocol compatible with tinc 1.0.x, the
+functionality of the tinc program may still change, and the control socket
+protocol is not fixed yet.
+
+
 Security statement
 ------------------
 
-In August 2000, we discovered the existence of a security hole in all versions
-of tinc up to and including 1.0pre2. This had to do with the way we exchanged
-keys. Since then, we have been working on a new authentication scheme to make
-tinc as secure as possible. The current version uses the OpenSSL library and
-uses strong authentication with RSA keys.
-
-On the 29th of December 2001, Jerome Etienne posted a security analysis of tinc
-1.0pre4. Due to a lack of sequence numbers and a message authentication code
-for each packet, an attacker could possibly disrupt certain network services or
-launch a denial of service attack by replaying intercepted packets. The current
-version adds sequence numbers and message authentication codes to prevent such
-attacks.
-
-On September the 15th of 2003, Peter Gutmann contacted us and showed us a
-writeup describing various security issues in several VPN daemons. He showed
-that tinc lacks perfect forward security, the connection authentication could
-be done more properly, that the sequence number we use as an IV is not the best
-practice and that the default length of the HMAC for packets is too short in
-his opinion. We do not know of a way to exploit these weaknesses, but these
-issues are being addressed in the tinc 1.1 branch.
-
-The Sweet32 attack affects versions of tinc prior to 1.0.30.
-
-On September 6th, 2018, Michael Yonly contacted us and provided
-proof-of-concept code that allowed a remote attacker to create an
-authenticated, one-way connection with a node, and also that there was a
-possibility for a man-in-the-middle to force UDP packets from a node to be sent
-in plaintext. The first issue was trivial to exploit on tinc versions prior to
-1.0.30, but the changes in 1.0.30 to mitigate the Sweet32 attack made this
-weakness much harder to exploit. These issues have been fixed in tinc 1.0.35.
-The new protocol in the tinc 1.1 branch is not susceptible to these issues.
-
-Cryptography is a hard thing to get right. We cannot make any
-guarantees. Time, review and feedback are the only things that can
-prove the security of any cryptographic product. If you wish to review
-tinc or give us feedback, you are strongly encouraged to do so.
+This version uses an experimental and unfinished cryptographic protocol. Use it
+at your own risk.
 
 
 Compatibility
 -------------
 
-Version 1.0.35 is compatible with 1.0pre8, 1.0 and later, but not with older
-versions of tinc. Note that since version 1.0.30, tinc requires all nodes in
-the VPN to be compiled with a version of LibreSSL or OpenSSL that supports the
-AES256 and SHA256 algorithms.
+Version 1.1pre15 is compatible with 1.0pre8, 1.0 and later, but not with older
+versions of tinc.
+
+When the ExperimentalProtocol option is used, tinc is still compatible with
+1.0.X, 1.1pre11 and later, but not with any version between 1.1pre1 and
+1.1pre10.
 
 
 Requirements
 ------------
 
-The OpenSSL library is used for all cryptographic functions. You can find it at
-https://www.openssl.org/. You will need version 1.0.1 or later with support for
-AES256 and SHA256 enabled. If this library is not installed on your system, the
-configure script will fail.  The manual in doc/tinc.texi contains more detailed
-information on how to install this library. Alternatively, you may also use the
-LibreSSL library.
+In order to compile tinc, you will need a GNU C compiler environment. Please
+ensure you have the latest stable versions of all the required libraries:
 
-The zlib library is used for optional compression. You can
-find it at https://zlib.net/. Because of a possible exploit in
-earlier versions we recommend that you download version 1.1.4 or later.
+- LibreSSL (http://www.libressl.org/) or OpenSSL (https://openssl.org/) version 1.0.0 or later.
 
-The LZO library is also used for optional compression. You can
-find it at https://www.oberhumer.com/opensource/lzo/.
+The following libraries are used by default, but can be disabled if necessary:
 
-In order to compile tinc, you will need a C99 compliant compiler.
+- zlib (http://www.zlib.net/)
+- LZO (https://www.oberhumer.com/opensource/lzo/)
+- ncurses (http://invisible-island.net/ncurses/)
+- readline (https://cnswww.cns.cwru.edu/php/chet/readline/rltop.html)
 
 
 Features
 --------
 
-This version of tinc supports multiple virtual networks at once. To
-use this feature, you may supply a netname via the -n or --net
-options. The standard locations for the config files will then be
-/etc/tinc/<net>/.
+Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number
+of nodes. Instead of configuring tunnels, you give tinc the location and
+public key of a few nodes in the VPN. After making the initial connections to
+those nodes, tinc will learn about all other nodes on the VPN, and will make
+connections automatically. When direct connections are not possible, data will
+be forwarded by intermediate nodes.
 
-tincd regenerates its encryption key pairs. It does this on the first
-activity after the keys have expired. This period is adjustable in the
-configuration file, and the default time is 3600 seconds (one hour).
+Tinc 1.1 support two protocols. The first is a legacy protocol that provides
+backwards compatibility with tinc 1.0 nodes, and which by default uses 2048 bit
+RSA keys for authentication, and encrypts traffic using Blowfish in CBC mode
+and HMAC-SHA1. The second is a new protocol which uses Curve25519 keys for
+authentication, and encrypts traffic using Chacha20-Poly1305, and provides
+forward secrecy.
 
-This version supports multiple subnets at once. They are also sorted
-on subnet mask size. This means that it is possible to have
-overlapping subnets on the VPN, as long as their subnet mask sizes
-differ.
+Tinc fully supports IPv6.
 
-Since pre5, tinc can operate in several routing modes. The default mode,
-"router", works exactly like the older version, and uses Subnet lines to
-determine the destination of packets. The other two modes, "switch" and "hub",
-allow the tinc daemons to work together like a single network switch or hub.
-This is useful for bridging networks. The latter modes only work properly on
-Linux, FreeBSD and Windows.
-
-The algorithms used for encryption and generating message authentication codes
-can now be changed in the configuration files. All cipher and digest algorithms
-supported by OpenSSL can be used. Useful ciphers are "blowfish" (default),
-"bf-ofb", "des", "des3", et cetera. Useful digests are "sha1" (default), "md5",
-et cetera.
-
-Support for routing IPv6 packets has been added. Just add Subnet lines with
-IPv6 addresses (without using :: abbreviations) and use ifconfig or ip (from
-the iproute package) to give the virtual network interface corresponding IPv6
-addresses. tinc does not provide autoconfiguration for IPv6 hosts. Consider
-using radvd or zebra if you need it.
-
-It is also possible to make tunnels to other tinc daemons over IPv6 networks,
-if the operating system supports IPv6.  tinc will automatically use both IPv6
-and IPv4 when available, but this can be changed by adding the option
-"AddressFamily = ipv4" or "AddressFamily = ipv6" to the tinc.conf file.
+Tinc can operate in several routing modes. In the default mode, "router", every
+node is associated with one or more IPv4 and/or IPv6 Subnets. The other two
+modes, "switch" and "hub", let the tinc daemons work together to form a virtual
+Ethernet network switch or hub.
 
 Normally, when started tinc will detach and run in the background. In a native
 Windows environment this means tinc will install itself as a service, which will
 restart after reboots.  To prevent tinc from detaching or running as a service,
 use the -D option.
 
+The status of the VPN can be queried using the "tinc" command, which connects
+to a running tinc daemon via a control connection. The same tool also makes it
+easy to start and stop tinc, and to change its configuration.

README.android

@@ -1,25 +1,23 @@
-Quick how-to cross compile tinc for android (done from $HOME/android/):
+Quick how-to cross compile tinc for Android (done from $HOME/android/):
 
-- Download android NDK and setup local ARM toolchain:
-wget http://dl.google.com/android/ndk/android-ndk-r9d-linux-x86.tar.bz2
-tar xfj android-ndk-r9d-linux-x86.tar.bz2
-./android-ndk-r9d/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
+- Download Android NDK and setup local ARM toolchain:
 
-- Download and cross-compile openSSL for ARM:
-wget http://www.openssl.org/source/openssl-1.0.1h.tar.gz
-tar xfz openssl-1.0.1h.tar.gz
-cd openssl-1.0.1h
-./Configure dist
-make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
-cd -
+        wget http://dl.google.com/android/ndk/android-ndk-r8b-linux-x86.tar.bz2
+        tar xfj android-ndk-r8b-linux-x86.tar.bz2
+        ./android-ndk-r8b/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
+
+- Download and cross-compile OpenSSL for ARM:
+
+        wget http://www.openssl.org/source/openssl-1.0.1c.tar.gz
+        tar xfz openssl-1.0.1c.tar.gz
+        cd openssl-1.0.1c
+        ./Configure dist
+        make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
 
 - Clone and cross-compile tinc:
-git clone git://tinc-vpn.org/tinc
-cd tinc
-autoreconf -fsi
-CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1g --with-openssl-include=$HOME/android/openssl-1.0.1g/include/ --disable-hardening
-make -j5
-
-- Strip tincd binary to make it smaller
-/tmp/my-android-toolchain/bin/arm-linux-androideabi-strip src/tincd
 
+        git clone git://tinc-vpn.org/tinc
+        cd tinc
+        autoreconf -fsi
+        CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1c --with-openssl-include=$HOME/android/openssl-1.0.1c/include/
+        make -j5

THANKS

@@ -5,12 +5,9 @@ We would like to thank the following people for their contributions to tinc:
 * Alexis Hildebrandt
 * Allesandro Gatti
 * Andreas van Cranenburgh
-* Andrew Hahn
 * Anthony G. Basile
 * Armijn Hemel
 * Armin Fisslthaler
-* Aron Cowan
-* Ashish Bajaj
 * Baptiste Jonglez
 * Borg
 * Brandon Black
@@ -22,31 +19,24 @@ We would like to thank the following people for their contributions to tinc:
 * Delf Eldkraft
 * Dennis Joachimsthaler
 * dnk
-* Егор Палкин
-* Élie Bouttier
 * Enrique Zanardi
 * Erik Tews
 * Etienne Dechamps
 * Florent Clairambault
-* Florian Forster
 * Florian Klink
 * Florian Weik
 * Flynn Marquardt
 * Franz Pletz
 * Gary Kessler and Claudia Gonzalez
 * Grzegorz Dymarek
-* Gusariev Oleksandr
 * Hans Bayle
 * Harvest
 * Ivo van Dong
-* Ivo Smits
 * James Cook
 * James MacLean
 * Jamie Briggs
-* Jan Štembera
 * Jason Harper
 * Jason Livesay
-* Jasper Krijgsman
 * Jelle de Jong
 * Jeroen Domburg
 * Jeroen Ubbink
@@ -58,7 +48,6 @@ We would like to thank the following people for their contributions to tinc:
 * Loïc Dachary
 * Loïc Grenié
 * Lubomír Bulej
-* luckyhacky
 * LunarShaddow
 * Mads Kiilerich
 * Marc A. Lehmann
@@ -73,9 +62,7 @@ We would like to thank the following people for their contributions to tinc:
 * Max Rijevski
 * Menno Smits
 * Mesar Hameed
-* Michael Taylor
 * Michael Tokarev
-* Michael Yonli
 * Miles Nordin
 * Nathan Stratton Treadway
 * Murat Donmez
@@ -84,15 +71,10 @@ We would like to thank the following people for their contributions to tinc:
 * Paul Littlefield
 * Philipp Babel
 * Pierre Emeriaud
-* Pierre-Olivier Mercier
-* Rafael Wolf
-* Rafael Sadowski
 * Rafał Leśniak
 * Rhosyn Celyn
 * Robert van der Meulen
-* Robert Waniek
 * Rumko
-* Ryan Miller
 * Sam Bryan
 * Samuel Thibault
 * Saverio Proto
@@ -109,9 +91,7 @@ We would like to thank the following people for their contributions to tinc:
 * Tonnerre Lombard
 * Ulrich Seifert
 * Vil Brekin
-* Vincent Laurent
 * Vittorio Gambaletta
-* Wendy Willard
 * Wessel Dankers
 * William A. Kennington III
 * William McArthur

aclocal.m4

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
+# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
 
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2017 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -20,7 +20,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])
 
-# Copyright (C) 2002-2020 Free Software Foundation, Inc.
+# Copyright (C) 2002-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -32,10 +32,10 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN([AM_AUTOMAKE_VERSION],
-[am__api_version='1.16'
+[am__api_version='1.15'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.16.2], [],
+m4_if([$1], [1.15.1], [],
       [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])
 
@@ -51,14 +51,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.16.2])dnl
+[AM_AUTOMAKE_VERSION([1.15.1])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
   [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])
 
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -110,7 +110,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`
 
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -141,7 +141,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])
 
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -332,12 +332,13 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl
 
 # Generate code to set up dependency tracking.              -*- Autoconf -*-
 
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
 
+
 # _AM_OUTPUT_DEPENDENCY_COMMANDS
 # ------------------------------
 AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
@@ -345,43 +346,49 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
   # Older Autoconf quotes --file arguments for eval, but not when files
   # are listed without --file.  Let's play safe and only enable the eval
   # if we detect the quoting.
-  # TODO: see whether this extra hack can be removed once we start
-  # requiring Autoconf 2.70 or later.
-  AS_CASE([$CONFIG_FILES],
-          [*\'*], [eval set x "$CONFIG_FILES"],
-          [*], [set x $CONFIG_FILES])
+  case $CONFIG_FILES in
+  *\'*) eval set x "$CONFIG_FILES" ;;
+  *)   set x $CONFIG_FILES ;;
+  esac
   shift
-  # Used to flag and report bootstrapping failures.
-  am_rc=0
-  for am_mf
+  for mf
   do
     # Strip MF so we end up with the name of the file.
-    am_mf=`AS_ECHO(["$am_mf"]) | sed -e 's/:.*$//'`
-    # Check whether this is an Automake generated Makefile which includes
-    # dependency-tracking related rules and includes.
-    # Grep'ing the whole file directly is not great: AIX grep has a line
+    mf=`echo "$mf" | sed -e 's/:.*$//'`
+    # Check whether this is an Automake generated Makefile or not.
+    # We used to match only the files named 'Makefile.in', but
+    # some people rename them; so instead we look at the file content.
+    # Grep'ing the first line is not enough: some people post-process
+    # each Makefile.in and add a new line on top of each file to say so.
+    # Grep'ing the whole file is not good either: AIX grep has a line
     # limit of 2048, but all sed's we know have understand at least 4000.
-    sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
-      || continue
-    am_dirpart=`AS_DIRNAME(["$am_mf"])`
-    am_filepart=`AS_BASENAME(["$am_mf"])`
-    AM_RUN_LOG([cd "$am_dirpart" \
-      && sed -e '/# am--include-marker/d' "$am_filepart" \
-        | $MAKE -f - am--depfiles]) || am_rc=$?
+    if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
+      dirpart=`AS_DIRNAME("$mf")`
+    else
+      continue
+    fi
+    # Extract the definition of DEPDIR, am__include, and am__quote
+    # from the Makefile without running 'make'.
+    DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
+    test -z "$DEPDIR" && continue
+    am__include=`sed -n 's/^am__include = //p' < "$mf"`
+    test -z "$am__include" && continue
+    am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
+    # Find all dependency output files, they are included files with
+    # $(DEPDIR) in their names.  We invoke sed twice because it is the
+    # simplest approach to changing $(DEPDIR) to its actual value in the
+    # expansion.
+    for file in `sed -n "
+      s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \
+	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
+      # Make sure the directory exists.
+      test -f "$dirpart/$file" && continue
+      fdir=`AS_DIRNAME(["$file"])`
+      AS_MKDIR_P([$dirpart/$fdir])
+      # echo "creating $dirpart/$file"
+      echo '# dummy' > "$dirpart/$file"
+    done
   done
-  if test $am_rc -ne 0; then
-    AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
-    for automatic dependency tracking.  If GNU make was not used, consider
-    re-running the configure script with MAKE="gmake" (or whatever is
-    necessary).  You can also try re-running configure with the
-    '--disable-dependency-tracking' option to at least be able to build
-    the package (albeit without support for automatic dependency tracking).])
-  fi
-  AS_UNSET([am_dirpart])
-  AS_UNSET([am_filepart])
-  AS_UNSET([am_mf])
-  AS_UNSET([am_rc])
-  rm -f conftest-deps.mk
 }
 ])# _AM_OUTPUT_DEPENDENCY_COMMANDS
 
@@ -390,17 +397,18 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
 # -----------------------------
 # This macro should only be invoked once -- use via AC_REQUIRE.
 #
-# This code is only required when automatic dependency tracking is enabled.
-# This creates each '.Po' and '.Plo' makefile fragment that we'll need in
-# order to bootstrap the dependency handling code.
+# This code is only required when automatic dependency tracking
+# is enabled.  FIXME.  This creates each '.P' file that we will
+# need in order to bootstrap the dependency handling code.
 AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
 [AC_CONFIG_COMMANDS([depfiles],
      [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS],
-     [AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"])])
+     [AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"])
+])
 
 # Do all the work for Automake.                             -*- Autoconf -*-
 
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -487,8 +495,8 @@ AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl
 AC_REQUIRE([AC_PROG_MKDIR_P])dnl
 # For better backward compatibility.  To be removed once Automake 1.9.x
 # dies out for good.  For more background, see:
-# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST([mkdir_p], ['$(MKDIR_P)'])
 # We need awk for the "check" target (and possibly the TAP driver).  The
 # system "awk" is bad on some platforms.
@@ -555,7 +563,7 @@ END
 Aborting the configuration process, to ensure you take notice of the issue.
 
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <https://www.gnu.org/software/coreutils/>.
+that behaves properly: <http://www.gnu.org/software/coreutils/>.
 
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@@ -597,7 +605,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -618,7 +626,7 @@ if test x"${install_sh+set}" != xset; then
 fi
 AC_SUBST([install_sh])])
 
-# Copyright (C) 2003-2020 Free Software Foundation, Inc.
+# Copyright (C) 2003-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -639,7 +647,7 @@ AC_SUBST([am__leading_dot])])
 
 # Check to see how 'make' treats includes.	            -*- Autoconf -*-
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -647,42 +655,49 @@ AC_SUBST([am__leading_dot])])
 
 # AM_MAKE_INCLUDE()
 # -----------------
-# Check whether make has an 'include' directive that can support all
-# the idioms we need for our automatic dependency tracking code.
+# Check to see how make treats includes.
 AC_DEFUN([AM_MAKE_INCLUDE],
-[AC_MSG_CHECKING([whether ${MAKE-make} supports the include directive])
-cat > confinc.mk << 'END'
+[am_make=${MAKE-make}
+cat > confinc << 'END'
 am__doit:
-	@echo this is the am__doit target >confinc.out
+	@echo this is the am__doit target
 .PHONY: am__doit
 END
+# If we don't find an include directive, just comment out the code.
+AC_MSG_CHECKING([for style of include used by $am_make])
 am__include="#"
 am__quote=
-# BSD make does it like this.
-echo '.include "confinc.mk" # ignored' > confmf.BSD
-# Other make implementations (GNU, Solaris 10, AIX) do it like this.
-echo 'include confinc.mk # ignored' > confmf.GNU
-_am_result=no
-for s in GNU BSD; do
-  AM_RUN_LOG([${MAKE-make} -f confmf.$s && cat confinc.out])
-  AS_CASE([$?:`cat confinc.out 2>/dev/null`],
-      ['0:this is the am__doit target'],
-      [AS_CASE([$s],
-          [BSD], [am__include='.include' am__quote='"'],
-          [am__include='include' am__quote=''])])
-  if test "$am__include" != "#"; then
-    _am_result="yes ($s style)"
-    break
-  fi
-done
-rm -f confinc.* confmf.*
-AC_MSG_RESULT([${_am_result}])
-AC_SUBST([am__include])])
-AC_SUBST([am__quote])])
+_am_result=none
+# First try GNU make style include.
+echo "include confinc" > confmf
+# Ignore all kinds of additional output from 'make'.
+case `$am_make -s -f confmf 2> /dev/null` in #(
+*the\ am__doit\ target*)
+  am__include=include
+  am__quote=
+  _am_result=GNU
+  ;;
+esac
+# Now try BSD make style include.
+if test "$am__include" = "#"; then
+   echo '.include "confinc"' > confmf
+   case `$am_make -s -f confmf 2> /dev/null` in #(
+   *the\ am__doit\ target*)
+     am__include=.include
+     am__quote="\""
+     _am_result=BSD
+     ;;
+   esac
+fi
+AC_SUBST([am__include])
+AC_SUBST([am__quote])
+AC_MSG_RESULT([$_am_result])
+rm -f confinc confmf
+])
 
 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-
 
-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -721,7 +736,7 @@ fi
 
 # Helper functions for option handling.                     -*- Autoconf -*-
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -750,7 +765,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])
 
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -797,7 +812,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -816,7 +831,7 @@ AC_DEFUN([AM_RUN_LOG],
 
 # Check to make sure that the build environment is sane.    -*- Autoconf -*-
 
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -897,7 +912,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])
 
-# Copyright (C) 2009-2020 Free Software Foundation, Inc.
+# Copyright (C) 2009-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -957,7 +972,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])
 
-# Copyright (C) 2001-2020 Free Software Foundation, Inc.
+# Copyright (C) 2001-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -985,7 +1000,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])
 
-# Copyright (C) 2006-2020 Free Software Foundation, Inc.
+# Copyright (C) 2006-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1004,7 +1019,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
 
 # Check how to create a tarball.                            -*- Autoconf -*-
 
-# Copyright (C) 2004-2020 Free Software Foundation, Inc.
+# Copyright (C) 2004-2017 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1141,6 +1156,10 @@ m4_include([m4/ax_cflags_warn_all.m4])
 m4_include([m4/ax_check_compile_flag.m4])
 m4_include([m4/ax_check_link_flag.m4])
 m4_include([m4/ax_require_defined.m4])
+m4_include([m4/curses.m4])
+m4_include([m4/libgcrypt.m4])
 m4_include([m4/lzo.m4])
+m4_include([m4/miniupnpc.m4])
 m4_include([m4/openssl.m4])
+m4_include([m4/readline.m4])
 m4_include([m4/zlib.m4])

compile

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2012-10-14.11; # UTC
 
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -53,7 +53,7 @@ func_file_conv ()
 	  MINGW*)
 	    file_conv=mingw
 	    ;;
-	  CYGWIN* | MSYS*)
+	  CYGWIN*)
 	    file_conv=cygwin
 	    ;;
 	  *)
@@ -67,7 +67,7 @@ func_file_conv ()
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/* | msys/*)
+	cygwin/*)
 	  file=`cygpath -m "$file" || echo "$file"`
 	  ;;
 	wine/*)
@@ -255,8 +255,7 @@ EOF
     echo "compile $scriptversion"
     exit $?
     ;;
-  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
-  icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
+  cl | *[/\\]cl | cl.exe | *[/\\]cl.exe )
     func_cl_wrapper "$@"      # Doesn't return...
     ;;
 esac
@@ -340,9 +339,9 @@ exit $ret
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:

config.h.in

@@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+/* Disable support for the legacy (tinc 1.0) protocol */
+#undef DISABLE_LEGACY
+
 /* Support for jumbograms (packets up to 9000 bytes) */
 #undef ENABLE_JUMBOGRAMS
 
@@ -15,9 +18,6 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 
-/* Define to 1 if you have the <arpa/nameser.h> header file. */
-#undef HAVE_ARPA_NAMESER_H
-
 /* Define to 1 if you have the `asprintf' function. */
 #undef HAVE_ASPRINTF
 
@@ -27,6 +27,12 @@
 /* Unknown BSD variant */
 #undef HAVE_BSD
 
+/* have curses support */
+#undef HAVE_CURSES
+
+/* Define to 1 if you have the <curses.h> header file. */
+#undef HAVE_CURSES_H
+
 /* Cygwin */
 #undef HAVE_CYGWIN
 
@@ -36,29 +42,9 @@
 /* Darwin (MacOS/X) */
 #undef HAVE_DARWIN
 
-/* Define to 1 if you have the declaration of `EVP_aes_256_cfb', and to 0 if
-   you don't. */
-#undef HAVE_DECL_EVP_AES_256_CFB
-
-/* Define to 1 if you have the declaration of `freeaddrinfo', and to 0 if you
-   don't. */
-#undef HAVE_DECL_FREEADDRINFO
-
-/* Define to 1 if you have the declaration of `gai_strerror', and to 0 if you
-   don't. */
-#undef HAVE_DECL_GAI_STRERROR
-
-/* Define to 1 if you have the declaration of `getaddrinfo', and to 0 if you
-   don't. */
-#undef HAVE_DECL_GETADDRINFO
-
-/* Define to 1 if you have the declaration of `getnameinfo', and to 0 if you
-   don't. */
-#undef HAVE_DECL_GETNAMEINFO
-
-/* Define to 1 if you have the declaration of `OpenSSL_add_all_algorithms',
-   and to 0 if you don't. */
-#undef HAVE_DECL_OPENSSL_ADD_ALL_ALGORITHMS
+/* Define to 1 if you have the declaration of `OpenSSL_add_all_algorithms
+   EVP_aes_256_cfb', and to 0 if you don't. */
+#undef HAVE_DECL_OPENSSL_ADD_ALL_ALGORITHMS_EVP_AES_256_CFB
 
 /* Define to 1 if you have the declaration of `res_init', and to 0 if you
    don't. */
@@ -73,6 +59,9 @@
 /* DragonFly */
 #undef HAVE_DRAGONFLY
 
+/* Define to 1 if you have the `ERR_remove_state' function. */
+#undef HAVE_ERR_REMOVE_STATE
+
 /* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
 #undef HAVE_EVP_CIPHER_CTX_NEW
 
@@ -94,6 +83,12 @@
 /* FreeBSD */
 #undef HAVE_FREEBSD
 
+/* Define to 1 if you have the `ftime' function. */
+#undef HAVE_FTIME
+
+/* Define to 1 if you have the <gcrypt.h> header file. */
+#undef HAVE_GCRYPT_H
+
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
@@ -106,9 +101,6 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the `nsl' library (-lnsl). */
-#undef HAVE_LIBNSL
-
 /* Define to 1 if you have the `resolv' library (-lresolv). */
 #undef HAVE_LIBRESOLV
 
@@ -142,9 +134,18 @@
 /* MinGW */
 #undef HAVE_MINGW
 
+/* have miniupnpc support */
+#undef HAVE_MINIUPNPC
+
+/* Define to 1 if you have the <miniupnpc/miniupnpc.h> header file. */
+#undef HAVE_MINIUPNPC_MINIUPNPC_H
+
 /* Define to 1 if you have the `mlockall' function. */
 #undef HAVE_MLOCKALL
 
+/* Define to 1 if you have the `nanosleep' function. */
+#undef HAVE_NANOSLEEP
+
 /* NetBSD */
 #undef HAVE_NETBSD
 
@@ -232,24 +233,30 @@
 /* Define to 1 if you have the <openssl/sha.h> header file. */
 #undef HAVE_OPENSSL_SHA_H
 
-/* Define to 1 if you have the `pselect' function. */
-#undef HAVE_PSELECT
-
 /* Define to 1 if you have the `putenv' function. */
 #undef HAVE_PUTENV
 
 /* Define to 1 if you have the `RAND_bytes' function. */
 #undef HAVE_RAND_BYTES
 
+/* have readline support */
+#undef HAVE_READLINE
+
+/* Define to 1 if you have the <readline/history.h> header file. */
+#undef HAVE_READLINE_HISTORY_H
+
+/* Define to 1 if you have the <readline/readline.h> header file. */
+#undef HAVE_READLINE_READLINE_H
+
+/* Define to 1 if you have the `recvmmsg' function. */
+#undef HAVE_RECVMMSG
+
 /* Define to 1 if you have the <resolv.h> header file. */
 #undef HAVE_RESOLV_H
 
 /* Define to 1 if you have the `RSA_set0_key' function. */
 #undef HAVE_RSA_SET0_KEY
 
-/* Define to 1 if the system has the type `socklen_t'. */
-#undef HAVE_SOCKLEN_T
-
 /* Solaris/SunOS */
 #undef HAVE_SOLARIS
 
@@ -268,9 +275,6 @@
 /* Define to 1 if you have the `strsignal' function. */
 #undef HAVE_STRSIGNAL
 
-/* Define to 1 if the system has the type `struct addrinfo'. */
-#undef HAVE_STRUCT_ADDRINFO
-
 /* Define to 1 if the system has the type `struct arphdr'. */
 #undef HAVE_STRUCT_ARPHDR
 
@@ -286,12 +290,6 @@
 /* Define to 1 if the system has the type `struct icmp6_hdr'. */
 #undef HAVE_STRUCT_ICMP6_HDR
 
-/* Define to 1 if the system has the type `struct in6_addr'. */
-#undef HAVE_STRUCT_IN6_ADDR
-
-/* Define to 1 if the system has the type `struct in_addr'. */
-#undef HAVE_STRUCT_IN_ADDR
-
 /* Define to 1 if the system has the type `struct ip'. */
 #undef HAVE_STRUCT_IP
 
@@ -304,15 +302,9 @@
 /* Define to 1 if the system has the type `struct nd_opt_hdr'. */
 #undef HAVE_STRUCT_ND_OPT_HDR
 
-/* Define to 1 if the system has the type `struct sockaddr_in6'. */
-#undef HAVE_STRUCT_SOCKADDR_IN6
-
 /* Define to 1 if you have the <syslog.h> header file. */
 #undef HAVE_SYSLOG_H
 
-/* Define to 1 if you have the `system' function. */
-#undef HAVE_SYSTEM
-
 /* Define to 1 if you have the <sys/file.h> header file. */
 #undef HAVE_SYS_FILE_H
 
@@ -340,8 +332,8 @@
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H
 
-/* Define to 1 if you have the <sys/uio.h> header file. */
-#undef HAVE_SYS_UIO_H
+/* Define to 1 if you have the <sys/un.h> header file. */
+#undef HAVE_SYS_UN_H
 
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
@@ -352,9 +344,6 @@
 /* Define to 1 if you have the `unsetenv' function. */
 #undef HAVE_UNSETENV
 
-/* Define to 1 if you have the `usleep' function. */
-#undef HAVE_USLEEP
-
 /* Define to 1 if you have the `vsyslog' function. */
 #undef HAVE_VSYSLOG
 
@@ -419,9 +408,6 @@
 /* Version number of package */
 #undef VERSION
 
-/* Compile with support for Windows 2000 */
-#undef WITH_WINDOWS2000
-
 /* Define to 1 if on MINIX. */
 #undef _MINIX
 
@@ -438,5 +424,5 @@
 /* Defined if the __malloc__ attribute is not supported. */
 #undef __malloc__
 
-/* Define to `int' if <sys/types.h> does not define. */
-#undef pid_t
+/* Defined if the __warn_unused_result__ attribute is not supported. */
+#undef __warn_unused_result__

config.sub

@@ -1,8 +1,8 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2018 Free Software Foundation, Inc.
+#   Copyright 1992-2016 Free Software Foundation, Inc.
 
-timestamp='2018-02-22'
+timestamp='2016-11-04'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@ timestamp='2018-02-22'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <https://www.gnu.org/licenses/>.
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -33,7 +33,7 @@ timestamp='2018-02-22'
 # Otherwise, we print the canonical config type on stdout and succeed.
 
 # You can get the latest version of this script from:
-# https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
 
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -57,7 +57,7 @@ Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
 
 Canonicalize a configuration name.
 
-Options:
+Operation modes:
   -h, --help         print this help, then exit
   -t, --time-stamp   print date of last modification, then exit
   -v, --version      print version number, then exit
@@ -67,7 +67,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2018 Free Software Foundation, Inc.
+Copyright 1992-2016 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -94,7 +94,7 @@ while test $# -gt 0 ; do
 
     *local*)
        # First pass through any local machine types.
-       echo "$1"
+       echo $1
        exit ;;
 
     * )
@@ -112,7 +112,7 @@ esac
 
 # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
 # Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
+maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
   linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
@@ -120,16 +120,16 @@ case $maybe_os in
   kopensolaris*-gnu* | cloudabi*-eabi* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
   android-linux)
     os=-linux-android
-    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
     ;;
   *)
-    basic_machine=`echo "$1" | sed 's/-[^-]*$//'`
-    if [ "$basic_machine" != "$1" ]
-    then os=`echo "$1" | sed 's/.*-/-/'`
+    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
+    if [ $basic_machine != $1 ]
+    then os=`echo $1 | sed 's/.*-/-/'`
     else os=; fi
     ;;
 esac
@@ -178,44 +178,44 @@ case $os in
 		;;
 	-sco6)
 		os=-sco5v6
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5)
 		os=-sco3.2v5
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco4)
 		os=-sco3.2v4
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2.[4-9]*)
 		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2v[4-9]*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5v6*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco*)
 		os=-sco3.2v2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-udk*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-isc)
 		os=-isc2.2
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-clix*)
 		basic_machine=clipper-intergraph
 		;;
 	-isc*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
 	-lynx*178)
 		os=-lynxos178
@@ -227,7 +227,10 @@ case $os in
 		os=-lynxos
 		;;
 	-ptx*)
-		basic_machine=`echo "$1" | sed -e 's/86-.*/86-sequent/'`
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
+		;;
+	-windowsnt*)
+		os=`echo $os | sed -e 's/windowsnt/winnt/'`
 		;;
 	-psos*)
 		os=-psos
@@ -260,7 +263,7 @@ case $basic_machine in
 	| fido | fr30 | frv | ft32 \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| hexagon \
-	| i370 | i860 | i960 | ia16 | ia64 \
+	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| k1om \
 	| le32 | le64 \
@@ -296,7 +299,7 @@ case $basic_machine in
 	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pj | pjl \
+	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pru \
 	| pyramid \
@@ -312,7 +315,7 @@ case $basic_machine in
 	| ubicom32 \
 	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
 	| visium \
-	| wasm32 \
+	| we32k \
 	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
@@ -333,7 +336,7 @@ case $basic_machine in
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65)
+	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
 	ms1)
 		basic_machine=mt-unknown
@@ -362,7 +365,7 @@ case $basic_machine in
 	  ;;
 	# Object if more than one company name word.
 	*-*-*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 	# Recognize the basic CPU types with company name.
@@ -385,7 +388,7 @@ case $basic_machine in
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia16-* | ia64-* \
+	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
 	| k1om-* \
 	| le32-* | le64-* \
@@ -443,7 +446,6 @@ case $basic_machine in
 	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
 	| vax-* \
 	| visium-* \
-	| wasm32-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
@@ -457,7 +459,7 @@ case $basic_machine in
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
 	386bsd)
-		basic_machine=i386-pc
+		basic_machine=i386-unknown
 		os=-bsd
 		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
@@ -491,7 +493,7 @@ case $basic_machine in
 		basic_machine=x86_64-pc
 		;;
 	amd64-*)
-		basic_machine=x86_64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	amdahl)
 		basic_machine=580-amdahl
@@ -536,7 +538,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	blackfin-*)
-		basic_machine=bfin-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	bluegene*)
@@ -544,13 +546,13 @@ case $basic_machine in
 		os=-cnk
 		;;
 	c54x-*)
-		basic_machine=tic54x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c55x-*)
-		basic_machine=tic55x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c6x-*)
-		basic_machine=tic6x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	c90)
 		basic_machine=c90-cray
@@ -639,7 +641,7 @@ case $basic_machine in
 		basic_machine=rs6000-bull
 		os=-bosx
 		;;
-	dpx2*)
+	dpx2* | dpx2*-bull)
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
@@ -648,7 +650,7 @@ case $basic_machine in
 		os=$os"spe"
 		;;
 	e500v[12]-*)
-		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=$os"spe"
 		;;
 	ebmon29k)
@@ -740,6 +742,9 @@ case $basic_machine in
 	hp9k8[0-9][0-9] | hp8[0-9][0-9])
 		basic_machine=hppa1.0-hp
 		;;
+	hppa-next)
+		os=-nextstep3
+		;;
 	hppaosf)
 		basic_machine=hppa1.1-hp
 		os=-osf
@@ -752,26 +757,26 @@ case $basic_machine in
 		basic_machine=i370-ibm
 		;;
 	i*86v32)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv4
 		;;
 	i*86v)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-solaris2
 		;;
 	i386mach)
 		basic_machine=i386-mach
 		os=-mach
 		;;
-	vsta)
+	i386-vsta | vsta)
 		basic_machine=i386-unknown
 		os=-vsta
 		;;
@@ -790,16 +795,19 @@ case $basic_machine in
 		os=-sysv
 		;;
 	leon-*|leon[3-9]-*)
-		basic_machine=sparc-`echo "$basic_machine" | sed 's/-.*//'`
+		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
 		;;
 	m68knommu)
 		basic_machine=m68k-unknown
 		os=-linux
 		;;
 	m68knommu-*)
-		basic_machine=m68k-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
+	m88k-omron*)
+		basic_machine=m88k-omron
+		;;
 	magnum | m3230)
 		basic_machine=mips-mips
 		os=-sysv
@@ -831,10 +839,10 @@ case $basic_machine in
 		os=-mint
 		;;
 	mips3*-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`-unknown
+		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
 	monitor)
 		basic_machine=m68k-rom68k
@@ -853,7 +861,7 @@ case $basic_machine in
 		os=-msdos
 		;;
 	ms1-*)
-		basic_machine=`echo "$basic_machine" | sed -e 's/ms1-/mt-/'`
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
 		basic_machine=i686-pc
@@ -895,7 +903,7 @@ case $basic_machine in
 		basic_machine=v70-nec
 		os=-sysv
 		;;
-	next | m*-next)
+	next | m*-next )
 		basic_machine=m68k-next
 		case $os in
 		    -nextstep* )
@@ -940,12 +948,6 @@ case $basic_machine in
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
-	nsv-tandem)
-		basic_machine=nsv-tandem
-		;;
-	nsx-tandem)
-		basic_machine=nsx-tandem
-		;;
 	op50n-* | op60c-*)
 		basic_machine=hppa1.1-oki
 		os=-proelf
@@ -978,7 +980,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	parisc-*)
-		basic_machine=hppa-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	pbd)
@@ -994,7 +996,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		;;
 	pc98-*)
-		basic_machine=i386-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
@@ -1009,16 +1011,16 @@ case $basic_machine in
 		basic_machine=i786-pc
 		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentium4-*)
-		basic_machine=i786-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pn)
 		basic_machine=pn-gould
@@ -1028,23 +1030,23 @@ case $basic_machine in
 	ppc | ppcbe)	basic_machine=powerpc-unknown
 		;;
 	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ps2)
 		basic_machine=i386-ibm
@@ -1098,10 +1100,17 @@ case $basic_machine in
 	sequent)
 		basic_machine=i386-sequent
 		;;
+	sh)
+		basic_machine=sh-hitachi
+		os=-hms
+		;;
 	sh5el)
 		basic_machine=sh5le-unknown
 		;;
-	simso-wrs)
+	sh64)
+		basic_machine=sh64-unknown
+		;;
+	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
 		;;
@@ -1120,7 +1129,7 @@ case $basic_machine in
 		os=-sysv4
 		;;
 	strongarm-* | thumb-*)
-		basic_machine=arm-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	sun2)
 		basic_machine=m68000-sun
@@ -1242,9 +1251,6 @@ case $basic_machine in
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
-	x64)
-		basic_machine=x86_64-pc
-		;;
 	xbox)
 		basic_machine=i686-pc
 		os=-mingw32
@@ -1253,12 +1259,20 @@ case $basic_machine in
 		basic_machine=xps100-honeywell
 		;;
 	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo "$basic_machine" | sed 's/^xscale/arm/'`
+		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
 		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
 		;;
+	z8k-*-coff)
+		basic_machine=z8k-unknown
+		os=-sim
+		;;
+	z80-*-coff)
+		basic_machine=z80-unknown
+		os=-sim
+		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1287,6 +1301,10 @@ case $basic_machine in
 	vax)
 		basic_machine=vax-dec
 		;;
+	pdp10)
+		# there are many clones, so DEC is not a safe bet
+		basic_machine=pdp10-unknown
+		;;
 	pdp11)
 		basic_machine=pdp11-dec
 		;;
@@ -1296,6 +1314,9 @@ case $basic_machine in
 	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
+	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
+		basic_machine=sparc-sun
+		;;
 	cydra)
 		basic_machine=cydra-cydrome
 		;;
@@ -1315,7 +1336,7 @@ case $basic_machine in
 		# Make sure to match an already-canonicalized machine name.
 		;;
 	*)
-		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1323,10 +1344,10 @@ esac
 # Here we canonicalize certain aliases for manufacturers.
 case $basic_machine in
 	*-digital*)
-		basic_machine=`echo "$basic_machine" | sed 's/digital.*/dec/'`
+		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
 		;;
 	*-commodore*)
-		basic_machine=`echo "$basic_machine" | sed 's/commodore.*/cbm/'`
+		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
 		;;
 	*)
 		;;
@@ -1337,8 +1358,8 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-	# First match some system type aliases that might get confused
-	# with valid system types.
+	# First match some system type aliases
+	# that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
 	-auroraux)
 		os=-auroraux
@@ -1349,19 +1370,18 @@ case $os in
 	-solaris)
 		os=-solaris2
 		;;
+	-svr4*)
+		os=-sysv4
+		;;
 	-unixware*)
 		os=-sysv4.2uw
 		;;
 	-gnu/linux*)
 		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
 		;;
-	# es1800 is here to avoid being matched by es* (a different OS)
-	-es1800*)
-		os=-ose
-		;;
-	# Now accept the basic system types.
+	# First accept the basic system types.
 	# The portable systems comes first.
-	# Each alternative MUST end in a * to match a version number.
+	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
@@ -1371,26 +1391,25 @@ case $os in
 	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
 	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
-	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -windiss* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
 	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
-	      | -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox* | -bme* \
-	      | -midnightbsd*)
+	      | -onefs* | -tirtos* | -phoenix* | -fuchsia*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1407,12 +1426,12 @@ case $os in
 	-nto*)
 		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
-	-sim | -xray | -os68k* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* \
+	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
-		os=`echo "$os" | sed -e 's|mac|macos|'`
+		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
 	-linux-dietlibc)
 		os=-linux-dietlibc
@@ -1421,10 +1440,10 @@ case $os in
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
 	-sunos5*)
-		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
+		os=`echo $os | sed -e 's|sunos5|solaris2|'`
 		;;
 	-sunos6*)
-		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
+		os=`echo $os | sed -e 's|sunos6|solaris3|'`
 		;;
 	-opened*)
 		os=-openedition
@@ -1435,6 +1454,12 @@ case $os in
 	-wince*)
 		os=-wince
 		;;
+	-osfrose*)
+		os=-osfrose
+		;;
+	-osf*)
+		os=-osf
+		;;
 	-utek*)
 		os=-bsd
 		;;
@@ -1459,7 +1484,7 @@ case $os in
 	-nova*)
 		os=-rtmk-nova
 		;;
-	-ns2)
+	-ns2 )
 		os=-nextstep2
 		;;
 	-nsk*)
@@ -1481,7 +1506,7 @@ case $os in
 	-oss*)
 		os=-sysv3
 		;;
-	-svr4*)
+	-svr4)
 		os=-sysv4
 		;;
 	-svr3)
@@ -1496,28 +1521,24 @@ case $os in
 	-ose*)
 		os=-ose
 		;;
+	-es1800*)
+		os=-ose
+		;;
+	-xenix)
+		os=-xenix
+		;;
 	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 		os=-mint
 		;;
+	-aros*)
+		os=-aros
+		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
 	-dicos*)
 		os=-dicos
 		;;
-	-pikeos*)
-		# Until real need of OS specific support for
-		# particular features comes up, bare metal
-		# configurations are quite functional.
-		case $basic_machine in
-		    arm*)
-			os=-eabi
-			;;
-		    *)
-			os=-elf
-			;;
-		esac
-		;;
 	-nacl*)
 		;;
 	-ios)
@@ -1527,7 +1548,7 @@ case $os in
 	*)
 		# Get rid of the `-' at the beginning of $os.
 		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`"$1"\': system \`"$os"\' not recognized 1>&2
+		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1617,12 +1638,12 @@ case $basic_machine in
 	sparc-* | *-sun)
 		os=-sunos4.1.1
 		;;
-	pru-*)
-		os=-elf
-		;;
 	*-be)
 		os=-beos
 		;;
+	*-haiku)
+		os=-haiku
+		;;
 	*-ibm)
 		os=-aix
 		;;
@@ -1662,7 +1683,7 @@ case $basic_machine in
 	m88k-omron*)
 		os=-luna
 		;;
-	*-next)
+	*-next )
 		os=-nextstep
 		;;
 	*-sequent)
@@ -1677,6 +1698,9 @@ case $basic_machine in
 	i370-*)
 		os=-mvs
 		;;
+	*-next)
+		os=-nextstep3
+		;;
 	*-gould)
 		os=-sysv
 		;;
@@ -1786,15 +1810,15 @@ case $basic_machine in
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo "$basic_machine" | sed "s/unknown/$vendor/"`
+		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
 		;;
 esac
 
-echo "$basic_machine$os"
+echo $basic_machine$os
 exit
 
 # Local variables:
-# eval: (add-hook 'write-file-functions 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"

configure.ac

@@ -1,9 +1,10 @@
 dnl Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.61)
-AC_INIT([tinc], [1.0.36])
+AC_INIT([tinc], m4_esyscmd_s((git describe || echo UNKNOWN) | sed 's/release-//'))
 AC_CONFIG_SRCDIR([src/tincd.c])
-AM_INIT_AUTOMAKE([1.11 check-news std-options subdir-objects nostdinc silent-rules -Wall])
+AC_GNU_SOURCE
+AM_INIT_AUTOMAKE([std-options subdir-objects nostdinc silent-rules -Wall])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_SILENT_RULES([yes])
@@ -18,6 +19,7 @@ dnl Checks for programs.
 AC_PROG_CC_C99
 AC_PROG_CPP
 AC_PROG_INSTALL
+AC_PROG_LN_S
 
 AM_PROG_CC_C_O
 
@@ -66,7 +68,9 @@ case $host_os in
   *mingw*)
     mingw=true
     AC_DEFINE(HAVE_MINGW, 1, [MinGW])
-    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32"
+    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32 -liphlpapi"
+    LDFLAGS="$LDFLAGS -static"
+    CPPFLAGS="$CPPFLAGS -DMINIUPNP_STATICLIB"
   ;;
   *)
     AC_MSG_ERROR("Unknown operating system.")
@@ -107,20 +111,13 @@ AC_ARG_ENABLE(tunemu,
   [tunemu=false]
 )
 
-AC_ARG_WITH(windows2000,
-  AS_HELP_STRING([--with-windows2000], [compile with support for Windows 2000. This disables support for tunneling over existing IPv6 networks.]),
-  [ AS_IF([test "x$with_windows2000" = "xyes"],
-      [AC_DEFINE(WITH_WINDOWS2000, 1, [Compile with support for Windows 2000])])
-  ]
-)
-
 AC_ARG_WITH(systemd,
   AS_HELP_STRING([--with-systemd@<:@=DIR@:>@], [install systemd service files @<:@to DIR if specified@:>@]),
   [ systemd=true; systemd_path="$with_systemd" ],
   [ systemd=false ]
 )
 
-AS_IF([test "x$with_systemd" = "xyes"], [systemd_path="\${libdir}/systemd/system"],
+AS_IF([test "x$with_systemd" = "xyes"], [systemd_path="/lib/systemd/system"],
       [AS_IF([test "x$with_systemd" = "xno"], [systemd=false])])
 
 AC_SUBST(systemd_path, $systemd_path)
@@ -137,12 +134,8 @@ AM_CONDITIONAL(WITH_SYSTEMD, test "$systemd" = true)
 
 AC_CACHE_SAVE
 
-if test -d /sw/include ; then
-  CPPFLAGS="$CPPFLAGS -I/sw/include"
-fi
-if test -d /sw/lib ; then
-  LIBS="$LIBS -L/sw/lib"
-fi
+AS_IF([test -d /sw/include], [CPPFLAGS="$CPPFLAGS -I/sw/include"])
+AS_IF([test -d /sw/lib], [LIBS="$LIBS -L/sw/lib"])
 
 dnl Compiler hardening flags
 dnl No -fstack-protector-all because it doesn't work on all platforms or architectures.
@@ -169,13 +162,11 @@ AS_IF([test "x$enable_hardening" != "xno"],
   ]
 );
 
-dnl Checks for libraries.
-
 dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
 
-AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h arpa/nameser.h dirent.h getopt.h])
-AC_CHECK_HEADERS([net/if.h net/if_types.h linux/if_tun.h net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
+AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/un.h sys/wait.h netdb.h arpa/inet.h dirent.h getopt.h])
+AC_CHECK_HEADERS([net/if.h net/if_types.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
   [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_HEADERS([netinet/if_ether.h netinet/ip.h netinet/ip6.h resolv.h],
@@ -186,48 +177,77 @@ AC_CHECK_HEADERS([netinet/tcp.h netinet/ip_icmp.h netinet/icmp6.h],
 )
 
 dnl Checks for typedefs, structures, and compiler characteristics.
-AC_TYPE_PID_T
-
 tinc_ATTRIBUTE(__malloc__)
+tinc_ATTRIBUTE(__warn_unused_result__)
 
-AC_CHECK_TYPES([socklen_t, struct ether_header, struct arphdr, struct ether_arp, struct in_addr, struct addrinfo, struct ip, struct icmp, struct in6_addr, struct sockaddr_in6, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
+AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip, struct icmp, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
   [#include "$srcdir/src/have.h"]
 )
 
 dnl Checks for library functions.
 AC_TYPE_SIGNAL
-AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall pselect putenv strsignal system unsetenv usleep vsyslog devname fdevname],
+AC_CHECK_FUNCS([asprintf daemon fchmod flock ftime fork gettimeofday mlockall putenv recvmmsg strsignal nanosleep unsetenv vsyslog devname fdevname],
   [], [], [#include "$srcdir/src/have.h"]
 )
 
 AC_CHECK_FUNC(getopt_long, [getopt=true; AC_DEFINE(HAVE_GETOPT_LONG, 1, [getopt_long()])], [getopt=false])
 AM_CONDITIONAL(GETOPT, test "$getopt" = true)
 
-dnl Support for SunOS
-
-AC_CHECK_FUNC(socket, [], [
-  AC_CHECK_LIB(socket, connect)
-])
-AC_CHECK_FUNC(gethostbyname, [], [
-  AC_CHECK_LIB(nsl, gethostbyname)
-])
-
-AC_CHECK_DECLS([freeaddrinfo, gai_strerror, getaddrinfo, getnameinfo],
-  [], [], [#include "$srcdir/src/have.h"]
-)
-
 AC_CHECK_DECLS([res_init], [AC_CHECK_LIB(resolv, res_init)], [], [
   #include <netinet/in.h>
   #include <resolv.h>
 ])
 
+dnl Operating system specific checks
+case $host_os in
+  *linux*)
+    AC_CHECK_HEADERS([linux/if_tun.h],
+      [], [AC_MSG_ERROR([Required header file missng])], [#include "$srcdir/src/have.h"]
+    )
+  ;;
+  *bsd*|*dragonfly*|*darwin*)
+    AC_CHECK_HEADERS([net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h],
+      [], [], [#include "$srcdir/src/have.h"]
+    )
+  ;;
+  *solaris*)
+    AC_CHECK_FUNC(socket, [], [AC_CHECK_LIB(socket, connect)])
+  ;;
+  *)
+  ;;
+esac
+
 AC_CACHE_SAVE
 
+AC_ARG_ENABLE(legacy-protocol,
+  AS_HELP_STRING([--disable-legacy-protocol], [disable support for the legacy (tinc 1.0) protocol]),
+  [ AS_IF([test "x$enable_legacy_protocol" = "xno"],
+    [ AC_DEFINE(DISABLE_LEGACY, 1, [Disable support for the legacy (tinc 1.0) protocol]) ])
+  ]
+)
+
 dnl These are defined in files in m4/
 
+dnl AC_ARG_WITH(libgcrypt, AC_HELP_STRING([--with-libgcrypt], [enable use of libgcrypt instead of OpenSSL])], [])
+dnl AC_ARG_WITH(openssl, AC_HELP_STRING([--without-openssl], [disable support for OpenSSL])], [])
+
+tinc_CURSES
+tinc_READLINE
 tinc_ZLIB
 tinc_LZO
-tinc_OPENSSL
+
+AS_IF([test "x$enable_legacy_protocol" != "xno"],
+      [AS_IF([test -n "$with_libgcrypt"],
+	     [gcrypt=true; tinc_LIBGCRYPT],
+	     [openssl=true; tinc_OPENSSL])
+      ]
+)
+
+AM_CONDITIONAL(OPENSSL, test -n "$openssl")
+AM_CONDITIONAL(GCRYPT, test -n "$gcrypt")
+
+tinc_MINIUPNPC
+AM_CONDITIONAL(MINIUPNPC, test "x$enable_miniupnpc" = "xyes")
 
 dnl Check if support for jumbograms is requested
 AC_ARG_ENABLE(jumbograms,
@@ -237,11 +257,6 @@ AC_ARG_ENABLE(jumbograms,
   ]
 )
 
-dnl Ensure runstatedir is set if we are using a version of autoconf that does not support it
-if test "x$runstatedir" = "x"; then
-  AC_SUBST([runstatedir], ['${localstatedir}/run'])
-fi
-
-AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile systemd/Makefile])
+AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile gui/Makefile test/Makefile systemd/Makefile])
 
 AC_OUTPUT

debian/NEWS

@@ -1,14 +0,0 @@
-tinc (1.0.27-1) unstable; urgency=medium
-
-  This package now provides native systemd service files, allowing multiple
-  instances of tinc to be managed. Existing networks listed in
-  /etc/tinc/nets.boot will be converted to service instances once during this
-  upgrade. Afterwards, you can enable and disable networks using:
-  
-    systemctl enable tinc@<netname>
-    systemctl disable tinc@<netname>
-  
-  If you do not have systemd installed, the SysV init script will continue to
-  work as usual. For more information, see README.Debian.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:33:55 +0200

debian/README.Debian

@@ -1,80 +0,0 @@
-tinc for Debian
----------------
-
-The manual for tinc is also available as info pages, type `info tinc'
-to read it.
-
-There are several ways in which tinc may be automatically started at boot:
-
-Systemd
--------
-
-Since 1.0.27-1, the tinc package comes with native systemd service files.
-To enable and start a net, call:
-
-systemctl enable tinc@<netname>
-systemctl start tinc@<netname>
-
-This will cause a tincd to be started which uses the configuration from
-/etc/tinc/<netname>, and also makes sure that it will be started next time your
-system boots.
-
-Apart from controlling individual instances, you can also start/stop/reload all
-enabled instances simultaneously by omitting @<netname>, for example:
-
-systemctl reload tinc
-
-Note that when you have systemd installed on your system, the file
-/etc/tinc/nets.boot will not be used anymore to automatically start tinc
-daemons. If the variable EXTRA is defined in /etc/default/tinc, it will be
-passed on to tinc. The variable LIMITS is however not used.
-
-The service files that come with this package start tinc unconditionally.
-However, tinc does support socket activation. If you wish to write a socket
-unit for tinc, use the ListenStream option to specify on which port(s) and
-address(es) tinc should listen.
-
-SysVinit
---------
-
-The system startup script for tinc, /etc/init.d/tinc, uses the file
-/etc/tinc/nets.boot to find out which networks have to be started. Use one
-netname per line. Lines starting with a # are ignored.
-
-/etc/network/interfaces
------------------------
-
-You can create a stanza in /etc/network/interfaces, and add a line with
-"tinc-net <netname>". This will cause a tincd to be started which uses the
-configuration from /etc/tinc/<netname>. You can use an inet static (with
-address and netmask options) or inet dhcp stanza, in which case the ifup will
-configure the VPN interface and you do not need to have a tinc-up script.
-
-The following options are also recognized and map directly to the corresponding
-command line options for tincd:
-
-tinc-config <directory>
-tinc-debug <level>
-tinc-mlock yes
-tinc-logfile <filename>
-tinc-pidfile <filename>
-tinc-chroot yes
-tinc-user <username>
-
-An example stanza:
-
-iface vpn inet static
-	address 192.168.2.42
-	netmask 255.255.0.0
-	tinc-net myvpn
-	tinc-debug 1
-	tinc-mlock yes
-	tinc-user nobody
-	tinc-pidfile /tmp/tinc.pid
-
-This will start a tinc daemon that reads its configuration from
-/etc/tinc/myvpn, logs at debug level 1, locks itself in RAM, runs as user
-nobody, and creates a network interface called "vpn". Ifup then sets the
-address and netmask on that interface.
-
- -- Guus Sliepen <guus@debian.org>, Sun, 10 April 2016, 01:38:08 +0200

debian/changelog

@@ -1,685 +0,0 @@
-tinc (1.0.36-2) unstable; urgency=medium
-
-  * Disable support for libvdeplug. Closes: #973233
-
- -- Guus Sliepen <guus@debian.org>  Sun, 22 Nov 2020 10:40:27 +0100
-
-tinc (1.0.36-1) unstable; urgency=medium
-
-  * New upstream version 1.0.36
-  * Add Vcs tags to debian/control.
-  * Bump Standards-Version.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 26 Aug 2019 14:17:21 +0200
-
-tinc (1.0.35-2) unstable; urgency=medium
-
-  * Bump Standards-Version and Build-Depend on debhelper-compat (= 12).
-  * Remove calls to dh_installinit and dh_systemd_start from debian/rules,
-    compat level 12 does the right thing by default.
-  * Ensure we clean up doc/tinc.info.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 28 Jan 2019 21:54:45 +0100
-
-tinc (1.0.35-1) unstable; urgency=medium
-
-  * New upstream release.
-    - Includes fixes for CVE-2018-16737, CVE-2018-16738, CVE-2018-16758.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 08 Oct 2018 16:09:06 +0200
-
-tinc (1.0.34-1) unstable; urgency=medium
-
-  [ Guus Sliepen ]
-  * New upstream release.
-    - Fixes a potential segmentation fault when connecting to an IPv6
-      peer via a proxy. Closes: #887401
-  * Add support for the $EXTRA variable in /etc/default/tinc when using
-    systemd. Closes: #887116
-
-  [ Benda Xu ]
-  * Prevent possible incorrect IPv6 checksums due to function inlining.
-    Closes: #891400
-
- -- Guus Sliepen <guus@debian.org>  Tue, 12 Jun 2018 23:00:49 +0200
-
-tinc (1.0.33-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Test for /etc/default/tinc before trying to source it. Closes: #777262
-  * Use --runstatedir=/run.
-
- -- Guus Sliepen <guus@debian.org>  Sat, 04 Nov 2017 16:22:06 +0100
-
-tinc (1.0.32-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Add a note to new nets.boot files that it is not used with systemd.
-    Closes: #841052
-  * In the post-down script, read the pid file only once. Closes: #832784
-  * Explicitly use /bin/sleep from coreutils. Closes: #772379
-  * Bump Standards-Version.
-
- -- Guus Sliepen <guus@debian.org>  Tue, 05 Sep 2017 20:23:36 +0200
-
-tinc (1.0.31-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Bump Standards-Version.
-  * Bump debian/compat.
-  * Add missing Depends: lsb-base.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 15 Jan 2017 16:20:40 +0100
-
-tinc (1.0.29-2) unstable; urgency=medium
-
-  * Rebuild with libssl-dev from unstable.
-
- -- Guus Sliepen <guus@debian.org>  Thu, 27 Oct 2016 13:09:46 +0200
-
-tinc (1.0.29-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Bump debian/compat.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 10 Oct 2016 22:30:25 +0200
-
-tinc (1.0.28-1) unstable; urgency=medium
-
-  * New upstream release.
-    - Fixes FTBFS on kfreebsd.
-  * Systemd service files are now provided by upstream.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 15:44:28 +0200
-
-tinc (1.0.27-2) unstable; urgency=medium
-
-  * Fix tinc@.service.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 12:45:33 +0200
-
-tinc (1.0.27-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Bump Standards-Version.
-  * Add native systemd unit files.
-  * Automatically convert networks listed in nets.boot to systemd service
-    instances on upgrade.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:39:16 +0200
-
-tinc (1.0.26-1) unstable; urgency=medium
-
-  * New upstream release.
-  * Use the contents, not the presence, of the pidfile to check that tincd is
-    shut down properly. Closes: #774682
-  * Bump Standards-Version.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 05 Jul 2015 17:23:08 +0200
-
-tinc (1.0.24-2) unstable; urgency=medium
-
-  * Improve the init script: stopping tinc now waits for the process to
-    terminate. If that doesn't happen in 5 seconds, it will send the TERM
-    signal again (which helps if tinc is waiting for a script to finish
-    executing). It now also detects whether the process mentioned in the PID
-    file is actually running, and if not it will exit early and without
-    warnings. Closes: #748107
-
- -- Guus Sliepen <guus@debian.org>  Wed, 14 May 2014 21:44:16 +0200
-
-tinc (1.0.24-1) unstable; urgency=medium
-
-  [ Guus Sliepen ]
-  * New upstream release
-  * Add a debian/watch file.
-  * Bump Standards-Version.
-
-  [ Gian Piero Carrubba ]
-  * Allow resource limits to be set in /etc/default/tinc.
-    Closes: #690685, #704702
-
- -- Guus Sliepen <guus@debian.org>  Sun, 11 May 2014 21:17:13 +0200
-
-tinc (1.0.23-2) unstable; urgency=low
-
-  * Use if-statements instead of && in shell scripts. Closes: #731279
-    The && operator does not clear the error status, and if the next statement
-    in a shell script does not change the error status it would cause the
-    script to prematurely exit. Thanks to Peter Reinholdtsen for spotting it.
-  * Use absolute path to tincd in the if-post-down script.
-
- -- Guus Sliepen <guus@debian.org>  Thu, 05 Dec 2013 09:41:13 +0000
-
-tinc (1.0.23-1) unstable; urgency=low
-
-  * New upstream release.
-
- -- Guus Sliepen <guus@debian.org>  Sat, 19 Oct 2013 21:06:05 +0200
-
-tinc (1.0.22-1) unstable; urgency=low
-
-  * New upstream release.
-    - Handles whitespace between command line flags and optional arguments.
-      Closes: #710267
-  * Bump Standards-Version.
-  * Source /lib/lsb/init-functions in the init.d script.
-  * Don't use texi2html anymore, use automake's install-html target which uses
-    makeinfo.
-
- -- Guus Sliepen <guus@debian.org>  Wed, 14 Aug 2013 15:34:29 +0200
-
-tinc (1.0.21-1) unstable; urgency=low
-
-  * New upstream release.
-    - Includes fix for CVE-2013-1428.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 05 May 2013 10:42:33 +0200
-
-tinc (1.0.19-3) unstable; urgency=high
-
-  * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).
-
- -- Guus Sliepen <guus@debian.org>  Fri, 12 Apr 2013 22:52:10 +0200
-
-tinc (1.0.19-2) unstable; urgency=low
-
-  * Fix behaviour of tinc-pidfile. Closes: #679130
-  * Enable parallel building in debian/rules.
-
- -- Guus Sliepen <guus@debian.org>  Tue, 26 Jun 2012 18:28:34 +0200
-
-tinc (1.0.19-1) unstable; urgency=low
-
-  * New upstream release.
-  * Bump debian/compat so tinc gets built with hardening flags.
-  * Allow tinc-pidfile in /etc/network/interfaces.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 25 Jun 2012 20:29:22 +0200
-
-tinc (1.0.18-1) unstable; urgency=low
-
-  * New upstream release.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 25 Mar 2012 18:52:15 +0200
-
-tinc (1.0.17-1) unstable; urgency=low
-
-  * New upstream release.
-  * Enable support for UML and VDE.
-
- -- Guus Sliepen <guus@debian.org>  Sat, 10 Mar 2012 14:50:00 +0100
-
-tinc (1.0.16-1) unstable; urgency=low
-
-  * New upstream release.
-  * Mention alarm option in /etc/init.d/tinc's usage information.
-    Closes: #631761
-
- -- Guus Sliepen <guus@debian.org>  Sat, 23 Jul 2011 14:37:56 +0200
-
-tinc (1.0.15-1) unstable; urgency=low
-
-  * New upstream release.
-  * Send SIGALRM to running tinc daemons whenever an interface is brought up
-    with the ifupdown framework. Based on a patch from Joachim Breitner.
-    Closes: #629880
-  * Allow tinc daemons to be started using ifupdown.
-
- -- Guus Sliepen <guus@debian.org>  Fri, 24 Jun 2011 18:21:51 +0200
-
-tinc (1.0.14-1) unstable; urgency=low
-
-  * New upstream release.
-  * Bump Standards-Version.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 09 May 2011 00:25:37 +0200
-
-tinc (1.0.13-1) unstable; urgency=low
-
-  * New upstream release.
-
- -- Guus Sliepen <guus@debian.org>  Tue, 13 Apr 2010 12:06:36 +0200
-
-tinc (1.0.12-2) unstable; urgency=low
-
-  * Remove debconf questions. Closes: #572116
-    Apparently debconf may not be used to ask a question at install time and
-    use the answer at upgrade time. Instead of kludging around this
-    restriction, no questions are asked anymore, and tinc will now always be
-    restarted when upgrading.
-  * Wait up to 5 seconds for tinc daemon to stop before restarting it.
-
- -- Guus Sliepen <guus@debian.org>  Tue, 02 Mar 2010 14:01:36 +0100
-
-tinc (1.0.12-1) unstable; urgency=low
-
-  * New upstream release.
-  * Bump Standards-Version.
-  * Migrate from CDBS to debhelper.
-  * Convert source package to 3.0 (quilt) format.
-  * Remove useless tinc.modules.
-  * Use init.d script from Michael Tokarev, allowing per-network arguments to
-    tincd.
-  * Remove update-rc.d calls from postinst and postrm.
-  * Let the init.d script depend on $remote_fs.
-
- -- Guus Sliepen <guus@debian.org>  Thu, 04 Feb 2010 00:56:45 +0100
-
-tinc (1.0.11-1) unstable; urgency=low
-
-  * New upstream release.
-  * Cope with texi2html arbitrarily changing its output directory.
-    Closes: #552927
-  * Do not stop tinc when configuring a new version, just restart after
-    the upgrade.
-
- -- Guus Sliepen <guus@debian.org>  Sun, 01 Nov 2009 20:37:16 +0100
-
-tinc (1.0.10-1) unstable; urgency=low
-
-  * New upstream release.
-  * Include Russian debconf translation. Closes: #548759
-
- -- Guus Sliepen <guus@debian.org>  Sun, 18 Oct 2009 16:31:49 +0200
-
-tinc (1.0.9-1) unstable; urgency=low
-
-  * New upstream release.
-    - Binds IPv6 sockets only to IPv6. Closes: #440150
-  * Update copyright file. Closes: #482566
-
- -- Guus Sliepen <guus@debian.org>  Fri, 26 Dec 2008 13:25:05 +0100
-
-tinc (1.0.8-2) unstable; urgency=low
-
-  * Include Portugese debconf translation. Closes: #434191
-
- -- Guus Sliepen <guus@debian.org>  Tue, 14 Aug 2007 13:50:27 +0200
-
-tinc (1.0.8-1) unstable; urgency=low
-
-  * New upstream release. Closes: #173987
-  * Include german debconf translation. Closes: #412351
-  * Build-Depend on texinfo. Closes: #424209
-
- -- Guus Sliepen <guus@debian.org>  Wed, 16 May 2007 17:59:16 +0200
-
-tinc (1.0.7-1) unstable; urgency=low
-
-  * New upstream release.
-
- -- Guus Sliepen <guus@debian.org>  Fri,  5 Jan 2007 15:55:42 +0100
-
-tinc (1.0.6-1) unstable; urgency=low
-
-  * New upstream release.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 18 Dec 2006 15:41:03 +0100
-
-tinc (1.0.5-1) unstable; urgency=low
-
-  * New upstream release. Closes: #391610
-  * Add an LSB section to the init script.
-
- -- Guus Sliepen <guus@debian.org>  Tue, 14 Nov 2006 16:32:20 +0100
-
-tinc (1.0.4-4) unstable; urgency=low
-
-  * Include swedish debconf translation. Closes: #332963
-  * Remove nets.boot on purge. Closes: #333303
-
- -- Guus Sliepen <guus@debian.org>  Mon, 17 Oct 2005 12:34:32 +0200
-
-tinc (1.0.4-3) unstable; urgency=low
-
-  * Depend on debconf | debconf-2.0.
-  * Include vietnamese debconf translation. Closes: #322305
-  * Include japanese debconf translation. Closes: #319591
-
- -- Guus Sliepen <guus@debian.org>  Thu, 29 Sep 2005 11:15:34 +0200
-
-tinc (1.0.4-2) unstable; urgency=low
-
-  * Compensate for change in texinfo's output directory. Closes: #318562
-  * Include Czech translation of the debconf questions. Closes: #312982
-
- -- Guus Sliepen <guus@debian.org>  Sat, 16 Jul 2005 11:42:04 +0200
-
-tinc (1.0.4-1) unstable; urgency=low
-
-  * New upstream release. Closes: #294819
-  * Update french translation of debconf template. Closes: #293371, #296148
-  * Allow dashes in nets.boot. Closes: #296281
-
- -- Guus Sliepen <guus@debian.org>  Wed,  4 May 2005 21:56:22 +0200
-
-tinc (1.0.3-4) unstable; urgency=low
-
-  * Call debconf early in postinst so it won't get confused by output
-    from other commands in the postinst script. Closes: #292920
-  * If MAKEDEV doesn't know about net/tun, fall back to tun.
-
- -- Guus Sliepen <guus@debian.org>  Mon, 31 Jan 2005 13:27:16 +0100
-
-tinc (1.0.3-3) unstable; urgency=low
-
-  * Fix clean rule in debian/rules.
-
- -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 23:16:59 +0000
-
-tinc (1.0.3-2) unstable; urgency=low
-
-  * Don't check for /dev/tap* in postinst if we don't create them anyway.
-  * MAKEDEV expects net/tun instead of tun.
-  * Don't ask if /dev/net/tun should be created, just do it.
-    Closes: #259489, #292450
-  * Move $EXTRA from init.d/tinc to /etc/default/tinc. Closes: #281366
-
- -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 14:10:02 +0100
-
-tinc (1.0.3-1) unstable; urgency=low
-
-  * New upstream release.
-  * Adopting the package from Ivo.
-  * Use invoke-rc.d, and tell user to do so as well. Closes: #223276
-  * Let force-reload do the same thing as reload. Closes: #230180
-
- -- Guus Sliepen <guus@debian.org>  Fri,  1 Oct 2004 21:04:14 +0200
-
-tinc (1.0.2-2) unstable; urgency=low
-
-  * debian/control: Oops, really make that automake1.7.
-
- -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 21:53:04 +0100
-
-tinc (1.0.2-1) unstable; urgency=low
-
-  * New upstream release:
-      * Fix broken replies to CHAL_RESP.  (Closes: #217646)
-  * debian/control: Updated automake build dependency to automake1.7.
-    (Closes: #219360)
-
- -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 19:56:04 +0100
-
-tinc (1.0.1-2) unstable; urgency=low
-
-  * debian/dirs: Removed, moved contents to tinc.dirs.
-    (Closes: #208591)
-  * debian/docs: Renamed to tinc.docs.
-  * debian/rules: Install the contents of doc/sample-config.tar.gz in
-    /usr/share/doc/tinc/examples instead of /etc/tinc.
-  * debian/Makefile*: Removed.
-
- -- Ivo Timmermans <ivo@debian.org>  Wed, 10 Sep 2003 12:19:32 +0200
-
-tinc (1.0.1-1) unstable; urgency=low
-
-  * New upstream release.
-  * debian/patches/001_openbsd_device.c.patch: Removed.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 14 Aug 2003 17:03:28 +0200
-
-tinc (1.0release-1) unstable; urgency=low
-
-  * New upstream version.  (Closes: #204639)
-      * Fixes switching back to normal logging mode when killing with
-        SIGINT twice.  (Closes: #175633)
-      * Uses one SSL context struct for each connection, speeding up
-        encrypting/decrypting data; don't throw away out of sequence
-        packets.  (Closes: #188874)
-      * Fixes handling of broadcast messages.  (Closes: #175632)
-  * debian/rules: Use cdbs.
-  * debian/control: Build-Depend on cdbs, liblzo-dev.
-  * debian/patches/001_openbsd_device.c.patch: Sync openbsd/device.c to
-    latest CVS version.
-
- -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Aug 2003 16:13:29 +0200
-
-tinc (1.0pre8-6) unstable; urgency=low
-
-  * debian/po/fr.po: Added French debconf translation.  (Closes: #201803)
-
- -- Ivo Timmermans <ivo@debian.org>  Fri, 18 Jul 2003 10:03:20 +0200
-
-tinc (1.0pre8-5) unstable; urgency=low
-
-  * debian/*: Change to po-debconf, thanks to From: Michel Grentzinger
-    <mic.grentz@online.fr> for the patch:
-      - change debhelper dependency to 4.1.16 (according to man
-        po-debconf),
-      - manually add nl translation in old tinc.templates (master),
-      - run debconf-gettextize debian/tinc.templates,
-      - move old templates files (debian/tinc.templates.*),
-      - change construction "If you say no" to "If you refuse",
-  * debian/rules: Call po2debconf.
-  * debian/rules: Don't copy COPYING.README to the package.
-  * debian/control: Update Standards-Version.
-  * debian/conffiles: Removed.
-  * debian/postinst: No longer use mknod directly, use MAKEDEV.
-
- -- Ivo Timmermans <ivo@debian.org>  Tue, 15 Jul 2003 20:13:47 +0200
-
-tinc (1.0pre8-4) unstable; urgency=low
-
-  * src/net.h, src/net_packet.c, src/net_setup.c: Apply fix from CVS
-    for OpenSSL-related memory leaks.  (Closes: #189432)
-
- -- Ivo Timmermans <ivo@debian.org>  Mon,  5 May 2003 15:00:29 +0200
-
-tinc (1.0pre8-3) unstable; urgency=low
-
-  * m4/openssl.m4: Updated to CVS version.  (Closes: #184400)
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 13 Mar 2003 17:24:42 +0100
-
-tinc (1.0pre8-2) unstable; urgency=low
-
-  * debian/postinst: Create /dev/net/tun if it doesn't exist.
-  * debian/tinc.modules: Add alias for /dev/net/tun.
-  * debian/rules: Install tinc.modules.
-  * These things together: (Closes: #151967, #153156)
-
- -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Nov 2002 22:45:38 +0100
-
-tinc (1.0pre8-1) unstable; urgency=low
-
-  * New upstream version.
-  * debian/rules:
-      - DEB_BUILD_OPTIONS support.
-      - Enable --enable-tracing by default.
-
- -- Ivo Timmermans <ivo@debian.org>  Tue, 17 Sep 2002 13:50:44 +0200
-
-tinc (1.0pre7-3) unstable; urgency=low
-
-  * Properly install _all_ info pages. (Closes: #144718)
-
- -- Ivo Timmermans <ivo@debian.org>  Wed, 29 May 2002 14:01:21 +0200
-
-tinc (1.0pre7-2) unstable; urgency=low
-
-  * Dutch translation wasn't being installed.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 11 Apr 2002 09:26:14 +0200
-
-tinc (1.0pre7-1) unstable; urgency=medium
-
-  * New upstream release.
-
- -- Ivo Timmermans <ivo@debian.org>  Tue,  9 Apr 2002 16:04:46 +0200
-
-tinc (1.0pre6-3) unstable; urgency=medium
-
-  * Synched with upstream CVS.
-  * Added build dependency on zlib1g-dev. (Closes: #141705)
-
- -- Ivo Timmermans <ivo@debian.org>  Mon,  8 Apr 2002 21:19:31 +0200
-
-tinc (1.0pre6-2) unstable; urgency=low
-
-  * The Section was non-US again, so changed it back to main/net.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 28 Mar 2002 07:26:10 +0100
-
-tinc (1.0pre6-1) unstable; urgency=low
-
-  * New upstream release.
-  * Fixed text in debian/copyright
-
- -- Ivo Timmermans <ivo@debian.org>  Wed, 27 Mar 2002 23:10:07 +0100
-
-tinc (1.0pre5-4) unstable; urgency=low
-
-  * Added a debconf question for restarting on upgrade.
-  * Added reload option to init.d, start with EXTRA='-d' default.
-  * Moved from non-US to main.
-  * Install example configuration files.
-  * The HTML documentation wasn't installed; fixed.
-
- -- Ivo Timmermans <ivo@debian.org>  Tue, 26 Mar 2002 20:14:19 +0100
-
-tinc (1.0pre5-3) unstable; urgency=low
-
-  * Config variables are now treated case sentitivly again.
-  * Added a forgotten xstrdup.
-
- -- Ivo Timmermans <ivo@debian.org>  Fri, 15 Feb 2002 12:35:17 +0100
-
-tinc (1.0pre5-2) unstable; urgency=low
-
-  * MaxTimeout accidentally wasn't configurable. (Closes: #119653)
-
- -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Feb 2002 13:36:54 +0100
-
-tinc (1.0pre5-1) unstable; urgency=low
-
-  * New upstream version. (Closes: #119653)
-  * Init script redone in sh.
-
- -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Feb 2002 16:39:53 +0100
-
-tinc (1.0pre4-1.cvs010621.6) unstable; urgency=low
-
-  * Somehow po-Makefile.in.in.diff got lost, readded. (Closes: #119157)
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 15 Nov 2001 17:00:03 +0100
-
-tinc (1.0pre4-1.cvs010621.5) unstable; urgency=low
-
-  * Fix a typo in postinst that let it MAKEDEV even on devfs.
-    (Closes: #116034)
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 18 Oct 2001 09:35:16 +0200
-
-tinc (1.0pre4-1.cvs010621.4) unstable; urgency=low
-
-  * Ask before creating the device files. (Closes: #111099)
-  * Add a section to the info file.
-
- -- Ivo Timmermans <ivo@debian.org>  Fri, 12 Oct 2001 20:47:09 +0200
-
-tinc (1.0pre4-1.cvs010621.3) unstable; urgency=low
-
-  * Build and install html documentation. (Closes: #106843)
-  * Remove build-time dependency on libc6-dev.
-
- -- Ivo Timmermans <ivo@debian.org>  Mon, 30 Jul 2001 22:03:52 +0200
-
-tinc (1.0pre4-1.cvs010621.2) unstable; urgency=low
-
-  * Changed location of the pidfile. (Closes: #102798)
-
- -- Ivo Timmermans <ivo@debian.org>  Sun,  1 Jul 2001 01:57:43 +0200
-
-tinc (1.0pre4-1.cvs010621.1) unstable; urgency=low
-
-  * New upstream version. (Closes: #98730)
-  * Rebuilding automatically inserted new config.{sub|guess}.
-    (Closes: #98165)
-  * Updated Standards-Version.
-  * Don't include a sample configuration file.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu, 21 Jun 2001 14:08:49 +0200
-
-tinc (1.0pre3-5) unstable; urgency=low
-
-  * Fixed an error in the init script that prevented tinc from
-    starting correctly.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu,  8 Feb 2001 02:45:09 +0100
-
-tinc (1.0pre3-4) unstable; urgency=low
-
-  * Change build-depends for OpenSSL to libssl096-dev
-    (Closes: #84197, #84873).
-
- -- Ivo Timmermans <ivo@debian.org>  Sun,  4 Feb 2001 22:43:22 +0100
-
-tinc (1.0pre3-3) unstable; urgency=low
-
-  * Set architecture to any (really this time!) (Closes: #80451).
-  * Section set to non-US
-
- -- Ivo Timmermans <ivo@debian.org>  Tue, 23 Jan 2001 22:52:53 +0100
-
-tinc (1.0pre3-2) unstable; urgency=low
-
-  * Set architecture to any (Closes: #80451).
-  * Added tinc.modules with some useful module aliases.
-
- -- Ivo Timmermans <ivo@debian.org>  Sat, 13 Jan 2001 16:10:57 +0100
-
-tinc (1.0pre3-1) unstable; urgency=low
-
-  * New upstream version (1.0pre3) (Closes: #71274).
-  * Better Depends and Build-Depends lines.
-  * Dropped dependencies on libgmp, added libssl.
-  * doc-base.tinc: New file.
-  * Deleted the file shlibs, as there on longer is a libblowfish.
-  * Patch po/Makefile.in.in from po-Makefile.in.in.diff if necessary.
-  * Use dh_perl to get accurate perl dependencies.
-
- -- Ivo Timmermans <ivo@debian.org>  Thu,  9 Nov 2000 21:58:40 +0100
-
-tinc (1.0pre2-1.1) unstable; urgency=low
-
-  * NMU at Ivo's request as his application is being processed, and his
-    sponsor is based in the US.
-
- -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 Jun 2000 21:52:30 +0200
-
-tinc (1.0pre2-1) unstable; urgency=low
-
-  * postinst creates a file /etc/tinc/nets.boot, containing all networks
-    to be started upon system startup;
-  * init.d script starts all networks from that list.
-  * postinst script creates tap devices.
-
- -- Ivo Timmermans <itimmermans@bigfoot.com>  Tue, 16 May 2000 00:06:25 +0200
-
-tinc (1.0pre1-0.4) unstable; urgency=low
-
-  * postinst script.
-
- -- Ivo Timmermans <itimmermans@bigfoot.com>  Mon, 15 May 2000 19:22:05 +0200
-
-tinc (1.0pre1-0.3) unstable; urgency=low
-
-  * system startup script.
-
- -- Ivo Timmermans <itimmermans@bigfoot.com>  Sun, 14 May 2000 22:58:02 +0200
-  
-tinc (1.0pre1-0.2) unstable; urgency=low
-
-  * Included the blowfish license.
-
- -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
-
-tinc (1.0pre1-0.1) unstable; urgency=low
-
-  * Initial Release.
-
- -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
-
-

debian/control

@@ -1,20 +0,0 @@
-Source: tinc
-Section: net
-Priority: optional
-Maintainer: Guus Sliepen <guus@debian.org>
-Standards-Version: 4.4.0
-Build-Depends: libssl-dev, debhelper-compat (= 12), gettext, texinfo, zlib1g-dev, liblzo2-dev
-Homepage: http://www.tinc-vpn.org/
-Vcs-Browser: https://salsa.debian.org/guus/tinc
-Vcs-Git: https://salsa.debian.org/guus/tinc.git
-Rules-Requires-Root: no
-
-Package: tinc
-Architecture: any
-Pre-Depends: ${misc:Pre-Depends}
-Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 3.0-6)
-Description: Virtual Private Network daemon
- tinc is a daemon with which you can create a virtual private network
- (VPN). One daemon can handle multiple connections, so you can
- create an entire (moderately sized) VPN with only one daemon per
- participating computer.

debian/copyright

@@ -1,34 +0,0 @@
-This package was debianized by Ivo Timmermans <ivo@debian.org> on
-Fri, 21 Apr 2000 17:07:50 +0200.
-
-It was downloaded from http://www.tinc-vpn.org/
-
-Upstream Authors:
- Guus Sliepen <guus@tinc-vpn.org>
- Ivo Timmermans <ivo@tinc-vpn.org>
-
-Copyright (C) 1998-2005 Ivo Timmermans
-              1998-2008 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-On Debian GNU/Linux systems, the complete text of the GNU General Public
-License version 2 can be found in /usr/share/common-licenses/GPL-2.
-
-The following applies to tinc:
-
-This program is released under the GPL with the additional exemption
-that compiling, linking, and/or using OpenSSL is allowed.  You may
-provide binary packages linked to the OpenSSL libraries, provided that
-all other requirements of the GPL are met.
-
-The following applies to the LZO library:
-
-Hereby I grant a special exception to the tinc VPN project
-(http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
-(http://www.openssl.org).
-
-Markus F.X.J. Oberhumer

debian/doc-base.tinc

@@ -1,10 +0,0 @@
-Document: tinc
-Title: tinc Manual
-Author: Ivo Timmermans, Guus Sliepen
-Abstract: This manual describes how to set up a Virtual Private
- Network with tinc.
-Section: System/Security
-
-Format: HTML
-Files: /usr/share/doc/tinc/tinc.html/*
-Index: /usr/share/doc/tinc/tinc.html/index.html

debian/info

@@ -1 +0,0 @@
-doc/tinc.info

debian/patches/fix-incorrect-icmpv6-checksum

@@ -1,65 +0,0 @@
-Package: tinc
-Version: 1.0.33-1
-Severity: important
-
-Dear Guus,
-
-I have been using tinc since 2009 and it is great!
-
-When PMTUDiscovery=yes and Mode=switch, and if ipv6 is used inside
-tinc, the ICMPv6 "Packet Too Big" packets have incorrect checksums.
-It can be reproduced by `ping6 <host in tinc> -s 1800` and `tcpdump -i
-<tinc interface>`.  Consequently, the host ignores the tinc-generated
-ICMPv6 packets, PMTUDiscovery does not work and the connections freeze
-when data flows are big.
-
-I find the bug is gone if the function "inet_checksum" in route.c is
-not inlined, either by compiling tinc with "-O2
--fno-inline-functions", or apply a patch such as,
-
-diff --git a/src/route.c b/src/route.c
-index ff82c06e..cd55383a 100644
---- a/src/route.c
-+++ b/src/route.c
-@@ -60,7 +60,7 @@ static const size_t opt_size = sizeof(struct nd_opt_hdr);
-
- /* RFC 1071 */
-
--static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
-+__attribute__ ((noinline)) static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
- 	uint16_t *p = data;
- 	uint32_t checksum = prevsum ^ 0xFFFF;
-
-
-
-I have tested with gcc-7.3.0 and gcc-5.4.0.  They behaved the same.  I
-am not good at assembly to find out what really happened, but it is
-for sure that inet_checksum does not work as expected if compiled
-inline.
-
-Thanks!
-
-Yours,
-Benda
-
--- System Information:
-Debian Release: buster/sid
-  APT prefers unstable
-  APT policy: (500, 'unstable')
-Architecture: amd64 (x86_64)
-
-Kernel: Linux 4.9.0-5-amd64 (SMP w/8 CPU cores)
-Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
-Shell: /bin/sh linked to /bin/dash
-Init: sysvinit (via /sbin/init)
-
-Versions of packages tinc depends on:
-ii  libc6      2.26-2
-ii  liblzo2-2  2.08-1.2+b2
-ii  libssl1.1  1.1.0g-2
-ii  lsb-base   9.20170808
-ii  zlib1g     1:1.2.8.dfsg-5
-
-tinc recommends no packages.
-
-tinc suggests no packages.

debian/patches/series

@@ -1,2 +0,0 @@
-fix-incorrect-icmpv6-checksum
-support-etc-defaults-tinc

debian/patches/support-etc-defaults-tinc

@@ -1,12 +0,0 @@
---- a/systemd/tinc@.service.in
-+++ b/systemd/tinc@.service.in
-@@ -9,7 +9,8 @@
- [Service]
- Type=simple
- WorkingDirectory=@sysconfdir@/tinc/%i
--ExecStart=@sbindir@/tincd -n %i -D
-+EnvironmentFile=/etc/default/tinc
-+ExecStart=@sbindir@/tincd -n %i -D $EXTRA
- ExecReload=@sbindir@/tincd -n %i -kHUP
- KillMode=mixed
- Restart=on-failure

debian/postinst

@@ -1,31 +0,0 @@
-#! /bin/sh
-
-NETSFILE="/etc/tinc/nets.boot"
-
-set -e
-
-case "$1" in
-    configure)
-	if [ ! -e /dev/.devfsd ] ; then if [ ! -e /dev/.devfs ] ; then
-		if [ ! -e /dev/net/tun ] ; then if [ ! -e /dev/tun ] ; then if [ -e /dev/MAKEDEV ]; then
-			echo "Creating tun device..."
-			cd /dev && ./MAKEDEV net/tun 2>/dev/null || ./MAKEDEV tun 2>/dev/null || echo "Failed to create tun device."
-		fi; fi; fi
-	fi; fi
-
-	if [ ! -e $NETSFILE ] ; then
-	    echo "## This file contains all names of the networks to be started on system startup when using sysvinit." > $NETSFILE
-	    echo "## If you are using systemd, use systemctl enable tinc@netname to enable individual networks." >> $NETSFILE
-	fi
-    ;;
-
-    abort-upgrade|abort-remove|abort-deconfigure)
-    ;;
-
-    *)
-        echo "postinst called with unknown argument \`$1'" >&2
-        exit 0
-    ;;
-esac
-
-#DEBHELPER#

debian/postrm

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ "$1" = purge ]; then
-    rm -f /etc/tinc/nets.boot
-fi
-
-#DEBHELPER#

debian/preinst

@@ -1,28 +0,0 @@
-#!/bin/sh
-
-NETSFILE="/etc/tinc/nets.boot"
-SYSTEM="/lib/systemd/system"
-WANTS="/etc/systemd/system/multi-user.target.wants"
-
-set -e
-
-case "$1" in
-	upgrade)
-		if dpkg --compare-versions "$2" '<<' "1.0.27-1"; then
-			if [ -f "$NETSFILE" ]; then
-				echo -n "Creating systemd service instances from nets.boot:"
-				mkdir -p "$WANTS"
-				egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
-					echo -n " $net"
-					ln -s "$SYSTEM/tinc@.service" "$WANTS/tinc@$net.service" 2>/dev/null || true
-				done
-				echo "."
-			fi
-		fi
-	;;
-
-	*)
-	;;
-esac
-
-#DEBHELPER#

debian/rules

@@ -1,16 +0,0 @@
-#!/usr/bin/make -f
-
-%:
-	dh $@
-
-override_dh_clean:
-	dh_clean
-	rm -f doc/tinc.info
-
-override_dh_auto_configure:
-	dh_auto_configure -- --enable-uml --with-systemd=/lib/systemd/system --runstatedir=/run
-
-override_dh_auto_install:
-	dh_auto_install -- install-html
-	# Remove info dir file
-	rm -f debian/tinc/usr/share/info/dir

debian/source/format

@@ -1 +0,0 @@
-3.0 (quilt)

debian/tinc.default

@@ -1,7 +0,0 @@
-# Extra options to be passed to tincd.
-# EXTRA="-d"
-
-# Limits to be configured for the tincd process. Please read your shell
-# (pointed by /bin/sh) documentation for ulimit. You probably want to raise the
-# max locked memory value if using both --mlock and --user flags.
-# LIMITS="-l 1024"

debian/tinc.dirs

@@ -1,7 +0,0 @@
-usr/sbin
-usr/share
-etc
-etc/init.d
-usr/share/locale
-usr/share/doc/tinc
-etc/tinc

debian/tinc.docs

@@ -1,3 +0,0 @@
-NEWS
-README
-AUTHORS

debian/tinc.files

@@ -1,6 +0,0 @@
-usr/sbin/tincd
-usr/share/man
-etc
-usr/share/doc/tinc
-usr/share/locale
-usr/share/info

debian/tinc.if-post-down

@@ -1,41 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
-	exit 0
-fi
-
-# Determine location of the PID file
-
-EXTRA=""
-if [ -n "$IF_TINC_PIDFILE" ]; then
-	EXTRA="--pidfile=$IF_TINC_PIDFILE"
-else
-	IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
-fi
-
-# Stop the tinc daemon
-
-read pid rest < $IF_TINC_PIDFILE 2>/dev/null
-
-/usr/sbin/tincd -n "$IF_TINC_NET" -k $EXTRA
-
-# Wait for it to shut down properly
-
-/bin/sleep 0.1
-i=0;
-while [ -f $IF_TINC_PIDFILE ] ; do
-	if [ ! -e "/proc/$pid" ] ; then
-		exit 0
-	fi
-
-	if [ $i = '30' ] ; then
-		echo 'Failed to stop tinc daemon!'
-		exit 1
-	fi
-	/bin/sleep 0.1
-	i=$(($i+1))
-done
-
-exit 0

debian/tinc.if-pre-up

@@ -1,70 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
-	exit 0
-fi
-
-# Read options from /etc/default
-
-[ -r /etc/default/tinc ] && . /etc/default/tinc
-
-# Set process limits
-
-setlimits() {
-  while [ $# -gt 0 ]; do
-    parm=$1 ; shift
-    if [ -n "$1" -a "${1#-}" = "$1" ]; then
-      value=$1 ; shift
-      ulimit $parm $value
-    else
-      ulimit $parm
-    fi
-  done
-}
-
-test -n "$LIMITS" && setlimits $LIMITS
-
-# Read options from /etc/network/interfaces
-
-[ -n "$IF_TINC_CONFIG" ]          && EXTRA="$EXTRA -c $IF_TINC_CONFIG"
-[ -n "$IF_TINC_DEBUG" ]           && EXTRA="$EXTRA -d$IF_TINC_DEBUG"
-[ -n "$IF_TINC_MLOCK" ]           && EXTRA="$EXTRA --mlock"
-[ -n "$IF_TINC_LOGFILE" ]         && EXTRA="$EXTRA --logfile=$IF_TINC_LOGFILE"
-[ -n "$IF_TINC_PIDFILE" ]         && EXTRA="$EXTRA --pidfile=$IF_TINC_PIDFILE" || IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
-[ -n "$IF_TINC_CHROOT" ]          && EXTRA="$EXTRA --chroot"
-[ -n "$IF_TINC_USER" ]            && EXTRA="$EXTRA --user=$IF_TINC_USER"
-
-
-# Start tinc daemon
-
-/usr/sbin/tincd -n "$IF_TINC_NET" -o "Interface=$IFACE" $EXTRA
-
-# Wait for it to come up properly
-
-/bin/sleep 0.1
-i=0;
-while [ ! -f $IF_TINC_PIDFILE ] ; do
-	if [ $i = '30' ] ; then
-		echo 'Failed to start tinc daemon!'
-		exit 1
-	fi
-	/bin/sleep 0.1
-	i=$(($i+1))
-done
-
-while read pid rest < $IF_TINC_PIDFILE ; do
-	if [ -e "/proc/$pid" ] ; then
-		exit 0
-	fi
-
-	if [ $i = '30' ] ; then
-		echo 'Failed to start tinc daemon!'
-		exit 1
-	fi
-	/bin/sleep 0.1
-	i=$(($i+1))
-done
-
-exit 0

debian/tinc.if-up

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ "$METHOD" = loopback -o -n "$IF_TINC_NET" ]; then
-	exit 0
-fi
-
-invoke-rc.d tinc alarm || exit 0

debian/tinc.init

@@ -1,140 +0,0 @@
-#! /bin/sh
-#
-### BEGIN INIT INFO
-# Provides:          tinc
-# Required-Start:    $remote_fs $network
-# Required-Stop:     $remote_fs $network
-# Should-Start:      $syslog $named
-# Should-Stop:       $syslog
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Start tinc daemons
-# Description:       Create a file $NETSFILE (/etc/tinc/nets.boot),
-#                    and put all the names of the networks in there.
-#                    These names must be valid directory names under
-#                    $TCONF (/etc/tinc). Lines starting with a # will be
-#                    ignored in this file.
-### END INIT INFO
-#
-# Based on Lubomir Bulej's Redhat init script.
-
-. /lib/lsb/init-functions
-
-DAEMON="/usr/sbin/tincd"
-NAME="tinc"
-DESC="tinc daemons"
-TCONF="/etc/tinc"
-NETSFILE="$TCONF/nets.boot"
-NETS=""
-
-test -f $DAEMON || exit 0
-
-[ -r /etc/default/tinc ] && . /etc/default/tinc
-
-# foreach_net "what-to-say" action [arguments...]
-foreach_net() {
-  if [ ! -f $NETSFILE ] ; then
-    echo "Please create $NETSFILE."
-    exit 0
-  fi
-  echo -n "$1"
-  shift
-  egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
-    echo -n " $net"
-    "$@" $net $args
-  done
-  echo "."
-}
-
-signal_running() {
-  for i in /var/run/tinc.*pid; do
-    if [ -f "$i" ]; then
-      head -1 $i | while read pid; do
-        kill -$1 $pid
-      done
-    fi
-  done
-}
-
-setlimits() {
-  while [ $# -gt 0 ]; do
-    parm=$1 ; shift
-    if [ -n "$1" -a "${1#-}" = "$1" ]; then
-      value=$1 ; shift
-      ulimit $parm $value
-    else
-      ulimit $parm
-    fi
-  done
-}
-
-test -n "$LIMITS" && setlimits $LIMITS
-
-start() {
-  $DAEMON $EXTRA -n "$@"
-}
-
-stop() {
-  [ -f /var/run/tinc.$1.pid ] || return
-  read pid rest </var/run/tinc.$1.pid || return
-  kill -0 "$pid" 2>/dev/null || return
-
-  $DAEMON -n $1 -k || return
-
-  i=0;
-  /bin/sleep 0.5
-
-  # Wait for the pidfile to disappear
-  while [ -f /var/run/tinc.$1.pid ]; do
-    # And check that there is an actual process running
-    kill -0 "$pid" 2>/dev/null || return
-
-    if [ $i = '10' ] ; then
-      # It's still alive, kill it again and give up
-        $DAEMON -n $1 -k && /bin/sleep 0.5
-      break
-    else
-      echo -n "."
-      i=$(($i+1))
-    fi
-
-    /bin/sleep 0.5
-  done
-}
-
-reload() {
-  $DAEMON -n $1 -kHUP
-}
-
-alarm() {
-  $DAEMON -n $1 -kALRM
-}
-
-restart() {
-  stop "$@"
-  start "$@"
-}
-
-case "$1" in
-  start)
-    foreach_net "Starting $DESC:" start
-  ;;
-  stop)
-    foreach_net "Stopping $DESC:" stop
-  ;;
-  reload|force-reload)
-    foreach_net "Reloading $DESC configuration:" reload
-  ;;
-  restart)
-    foreach_net "Restarting $DESC:" restart
-  ;;
-  alarm)
-    signal_running ALRM
-  ;;
-  *)
-    echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|alarm}"
-    exit 1
-  ;;
-esac
-
-exit 0

debian/upstream/signing-key.asc

@@ -1,70 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQINBEVZzTABEADawFv/ibQ48uA1eRhL07vdM36Pcq2HDyuyNA+vYEalNH4jLmha
-nGPvDALWwX0DXIWDAG8zeTj8s8zliLIjuPS4WRI2YdKIvWeG9fEvpKSXVWa42ica
-dpzn/H2aBd4Ax6rQaiTXKOvxANAp2Veb+73ssPV5AL00uGTpzhh98xQzfFQCZ9ZL
-YSVPqbMed5oCt/4jM9FBO2CuBtkfiO0dVVYtW7FAVjcIlE2NaZol/KGvz7wsS+yA
-dE42W0l5MdQueLmTF4AIUSSTyPFGMQoyqh+MPif73Y589IGcW6GdfKYWnVDo6Trh
-HOhcEky+uTYKb6NL0vrJgUiYVMzAOXFDdJni1eQGO6EfZRNYtTga3alWq/jVelK7
-BID5JyNbkrTAqdPnhJGivVyk8gGX3+Hng8rkXTfWhp6yAYau1QfBm0F2tIQmpL1C
-+7DoLvFErboQf685jXJBjzyvsJxB2ZLH1OOw6mNL0hy2LFkIyGza/bktY2em4apo
-KWV5AM5LpyW6THH1oDS7706xFNkf4IFhKE0hKPzBiRnMDjRtMI131lkc5+P8Lqf5
-jLTCFUgbEhU6Dz2YjhHAumVm0NWJETUpFDtVvMrqk+mp5xldUOWRNlYQC5aQOyda
-eHOlNzB/BFbPhKMWI/zWlEH6f0t6WjHb4iwpWO47511aVNHF59aPzbAHxwARAQAB
-tC9UaW5jIERldmVsb3BtZW50IFRlYW0gPHRpbmMtZGV2ZWxAdGluYy12cG4ub3Jn
-PokCNgQTAQIAIAUCRVnNMAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEEpg
-hLnA1x9KxOAQAMPhO2WTXv9AaGQBQhyyoGseKoSfcRjtI9YEfE0OInQQ2E+SPYF/
-dkfeLGAUqa4foTYQlMqfw70vBhTdVCb7HLTGn6/ICFUtDwakUQCgUQGlUVQiondA
-8W6jj+QWrh5BQhHuXy2nCVaKnksu0/xQPsJotghxuYqaot3iJ4qVw9iT/Yeo9irH
-Ffftqu0OVCdQ5zQuFNI9YCv/C83L59ecH7bOzYz2efTyobvxrhmgQtgOQwCWOE09
-Kr3veM9KLG33YoXlqv8QN/3CwtsJvSwfhj+R2JowZC7RqHe/yznRzmRMsgbrolxi
-uiJLonGxcNNkD7WhXi7/zL4A/JaC27XrFf1MPLv8aiTwnOIfrXd5jawpauUOZOXK
-UjIZHlIqviB0r5s7A+AFeHW38Tp9VzNuQ7aEl5bHbSXV+s7DTAwGb279z0AVaJ3h
-5hWFxupw7UoGdzROwCBYzeX3sioAL6QvkXua8X6zOH45VEiSwrRX3Hlx/MLo7Z4g
-PWgFLf6WviHQXCG834To1XIwUk9RgNsL7OzGjtaCuRymADImKMNwierq2zTfoRFQ
-v9onIadIMF1fsc70hiBG9yAi36MEuk4VxG8Jc3PQQfSFm4RWazv1k3E0AAIob2Ek
-DLVjvLO62Navo/OQ6D7yyiX0qes5S7/k3F1h8+87eRn3yxZE2kbxPg8KuQENBEVZ
-zYYBCACoYgExmMKEtABL3pir/IXI4exR/45hkP6txFIrkVQb8DGJ9H39kiDr4gtj
-F+pvcgMpec35S3m4fJ7WhDNvbDB4ZvONc1NMKs9cqDXfB+TLWPm4W+SkcKUrs+nK
-i8l7ieggTALJcvRoLTX2EFmUFrD6y870W3rK2SfC/0VJX8Ou5cPbwCeueExjo5x0
-3gNfu0jWUS0cyA9y+1rVVekrLuJY/+SI4jv3gdzrYbxD0f6dpbpC37QHoJdd0KGF
-acPtT2azjY+HxW10EA3Aw9oZWFXnb1nFg2RbDpkaGLmLbaXweltLyw154UmCXxym
-PXPqi9bSfEkj0GiYrapk4mW114u9ABEBAAGJA0QEGAECAA8FAkVZzYcCGwIFCQHh
-M4ABKQkQSmCEucDXH0rAXSAEGQECAAYFAkVZzYcACgkQ017duBDeLmmu3wf/TFZM
-tLKxiyQPtGSTE3eULPdWCEMDZXdSPTY0QHM7Zvh+qn1ei+iFpD0549MYnBEAwDIV
-4o62Nrcg8IPu0CEkZIAn2JiFFGYvMGk91awZGV1GS3umd7Dt349E1oKDPZVzRn+j
-QIKarXxxabRmx2s/dZZgSs/eguWTboBFmvls9tVfe8x/xPvcHFmqHVUoGKEJy6Tm
-no+s4yNjpc5wAaRml+GYf1tK9WMFuZn79qKxkYv4WI96dXR0FL59YbFRkkaI+1/b
-G31MvWTqVjY1nJGslByFPUUB8Ca1djtp1gx6NXnOYr3V5MEDfdbjjPu79No+/y6M
-tIua5yNtSRlk2nKhIqo3D/sGQ/uHijiMRAtoLhiyqYMc9W9vx/KOoCUHoMJqE39a
-Eputvgwwo0rwgSmNfB1dzneFojBdJ47WBSHC8NKtkpJj6mzvvlaI9jmEpK54x3nl
-OmBj3X/xaepoRGAtrmgTBP4A9hSjrTMGu/tUQjlX+Xcr6n3g7GSVe5FpUyIMPXEU
-+JZDTiEUyn1OdzfNGmnWP+KJX5pQVq4czf5XK6otLZJELDVw/Hbjnjmdz5WOKgEH
-jSof3WPeMBgPAcd/cMAZeiGtWM1UpJBHqEXTkthmrpmtRftJKDbooNM9d5OwKiT+
-I3vNBv/plMSr8NDjhTWC+ihrN6RBj1vaqpDgGpucPhoO2hwNqWuI4q5WUKtCyw6J
-An7ErNaH4c0nVaZq6kJ8Vxdt+LpKYmOsJ8y9xtl6StcrkKNn+6ZfCfee7DEo2bvb
-scfpqJqqOqb5KOagTpYs8mo6yQ3leRvFtoeBOQHVQzct23EwOMxbDyeunT50a1eH
-MZTEWuIiuCUudM81QXU46oIcaAtj8tpG0Tmnku9g27EjwxUt+8kVmhlPHMb2TdoF
-k5d0ce+JuxIG5+i+t8sUCorMc8zfp4g1bxZeMOcPnfyO3bSW11EVcN7ZxHlFC+XE
-YOByP50CM3P8lItPlQ+WpY9kYWjiwu9kVPaGQ16G47nspngJInU5dhka3KJGtIZe
-q7kBDQRFWc3GAQgAz/JUs24niKsd0ZtOjUWd4R4y0gjS0kC/vvLL2gbXYkA9tcjG
-5iEvVWJY34QsudX0v1ULsVnJ89X/gsk8hAhAia1TQm+0Qq+MSxEaQkMSaOO8N70U
-XzgH1dielvpea20WO4MyWQuRIJ0K2nsGmEPnt6ZP7fK8HVHFNggP/mQ6LMu1reAF
-gvb8cEtjb9B5QaCUEoLjsbsuo+vLW7AWy4GfIRNESHw2Qt08AUaGrihpu6zi7N2b
-QkHHJtqa63GzYJ+kYzAVvrFJXdwL/TRXLBzv+6yyvYSIHi8uB6/o6CZN6hpjfpME
-ph+oYPqXeNOyMd1E9Kg8ymcPrNyQKfE3WnCRXQARAQABiQIlBBgBAgAPBQJFWc3H
-AhsMBQkB4TOAAAoJEEpghLnA1x9KXYMP/3D9JYti6C8DWuX2hWv+2SUbLcMa5u1e
-ETewIo5S3mqGWSaxX4YLPVRkZ1lOLmFysOLimf0thYm7IsatLcWmBdYUpK92ilvr
-Sk2sKlhrOoBXEX/79Kz+Aj5PjeyiQxgQ7Ba/afwhU6aTqs2Dp1T0YNu2eBvV+1QH
-lZnW2Wh96zzwc0dJUuY9eBk5Fgpu08Wce7o6jxFPtVyAaQa0zcNAmw2TSY7wbunJ
-WTl9OgATAyqVCuhWW7AnPcSqkH8lQigSc00wfqJKOD2Us0FqN6UKDCZTyQkdP6hx
-G+3aUkkvGSOxy7u9bVWmrikuJMoiIY/CH/m+GcJJATVibI7t5MhhtBGySKc3PAwc
-58sVe9AnbDvs84efrNP59j2KG2KKqcqjTGAmKyJnG3N50xJGakDIsqfneIRNWpEE
-pOOPaOqR4qnPAS9OSt9A3hqBpWPjQcScd6AuO+J2PE5y23pTnb9PtLBQb5e4VFiv
-N54u8j4bU2CO0SC2isZ3CR68dPHthWsxt4XbjhgktjbpQRQ8L2EDBQ8oE13GOrOw
-P8x4Q0eC5uzkXNyRqzKOsxlZEuc+75aDDd3M2GDw08FG7GI1p/L+NgenwT+9TmFX
-2hOKVrjgyx+fPut1t5DJJubDWXGOK33qvrL7HTCEv1zz7LNbbPwwNHK4lfMAWuJW
-D9wc3Y9Se/P/
-=5MAs
------END PGP PUBLIC KEY BLOCK-----

debian/watch

@@ -1,2 +0,0 @@
-version=3
-opts=pgpsigurlmangle=s/$/.sig/ http://www.tinc-vpn.org/packages/tinc-(1\.0\.\d+)\.tar\.gz

depcomp

@@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2016-01-11.22; # UTC
 
-# Copyright (C) 1999-2020 Free Software Foundation, Inc.
+# Copyright (C) 1999-2017 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -783,7 +783,7 @@ exit 0
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"

doc/Makefile.am

@@ -1,35 +1,55 @@
 ## Process this file with automake to get Makefile.in
 
 info_TEXINFOS = tinc.texi
-tinc_TEXINFOS = tincinclude.texi
 
-man_MANS = tincd.8 tinc.conf.5
+man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
 
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config.tar.gz
 
-CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
+CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi sample-config.tar.gz
 
-texi2html: tinc.texi
-	$(AM_V_GEN)texi2html -split=chapter $<
+# Use `ginstall' in the definition of man_MANS to avoid
+# confusion with the `install' target.  The install rule transforms `ginstall'
+# to install before applying any user-specified name transformations.
+transform = s/ginstall/install/; @program_transform_name@
+
+# For additional rules usually of interest only to the maintainer,
+# see GNUmakefile and Makefile.maint.
+
+sample-config.tar.gz: sample-config
+	$(AM_V_GEN)GZIP=$(GZIP_ENV) $(AMTAR) chozf $@ --exclude .svn $<
 
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
+
+tinc.8.html: tinc.8
+	$(AM_V_GEN)w3mman2html $? > $@
+
+tinc-gui.8.html: tinc-gui.8
+	$(AM_V_GEN)w3mman2html $? > $@
 
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
 
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
 	-e s,'@VERSION\@',"$(VERSION)",g \
 	-e s,'@sysconfdir\@',"$(sysconfdir)",g \
-	-e s,'@runstatedir\@',"$(runstatedir)",g \
 	-e s,'@localstatedir\@',"$(localstatedir)",g
 
-tincd.8: $(srcdir)/tincd.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
+tincd.8: tincd.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
 
-tinc.conf.5: $(srcdir)/tinc.conf.5.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
+tinc.8: tinc.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
 
-tincinclude.texi: $(srcdir)/tincinclude.texi.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincinclude.texi.in > $@
+tinc-gui.8: tinc-gui.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
+
+tinc.conf.5: tinc.conf.5.in
+	$(AM_V_GEN)$(substitute) $? > $@
+
+tincinclude.texi: tincinclude.texi.in
+	$(AM_V_GEN)$(substitute) $? > $@
+	
+tinc.texi: tincinclude.texi

doc/Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.2 from Makefile.am.
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2020 Free Software Foundation, Inc.
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -78,7 +78,6 @@ install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
 install_sh_SCRIPT = $(install_sh) -c
 INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
 NORMAL_INSTALL = :
 PRE_INSTALL = :
 POST_INSTALL = :
@@ -94,9 +93,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
-	$(top_srcdir)/configure.ac
+	$(top_srcdir)/m4/ax_require_defined.m4 \
+	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
+	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
+	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
@@ -197,8 +198,13 @@ man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man_MANS)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-am__DIST_COMMON = $(srcdir)/Makefile.in $(tinc_TEXINFOS) texinfo.tex
+am__DIST_COMMON = $(srcdir)/Makefile.in texinfo.tex
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+
+# Use `ginstall' in the definition of man_MANS to avoid
+# confusion with the `install' target.  The install rule transforms `ginstall'
+# to install before applying any user-specified name transformations.
+transform = s/ginstall/install/; @program_transform_name@
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
@@ -211,6 +217,7 @@ CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@@ -228,8 +235,10 @@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
+LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
+MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -240,6 +249,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
+READLINE_LIBS = @READLINE_LIBS@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@@ -297,15 +307,13 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 info_TEXINFOS = tinc.texi
-tinc_TEXINFOS = tincinclude.texi
-man_MANS = tincd.8 tinc.conf.5
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
-CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
+man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config.tar.gz
+CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi sample-config.tar.gz
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
 	-e s,'@VERSION\@',"$(VERSION)",g \
 	-e s,'@sysconfdir\@',"$(sysconfdir)",g \
-	-e s,'@runstatedir\@',"$(runstatedir)",g \
 	-e s,'@localstatedir\@',"$(localstatedir)",g
 
 all: all-am
@@ -329,8 +337,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -385,10 +393,10 @@ $(am__aclocal_m4_deps):
 	else \
 	  rm -rf $(@:.html=.htp); exit 1; \
 	fi
-$(srcdir)/tinc.info: tinc.texi $(tinc_TEXINFOS)
-tinc.dvi: tinc.texi $(tinc_TEXINFOS)
-tinc.pdf: tinc.texi $(tinc_TEXINFOS)
-tinc.html: tinc.texi $(tinc_TEXINFOS)
+$(srcdir)/tinc.info: tinc.texi 
+tinc.dvi: tinc.texi 
+tinc.pdf: tinc.texi 
+tinc.html: tinc.texi 
 .dvi.ps:
 	$(AM_V_DVIPS)TEXINPUTS="$(am__TEXINFO_TEX_DIR)$(PATH_SEPARATOR)$$TEXINPUTS" \
 	$(DVIPS) $(AM_V_texinfo) -o $@ $<
@@ -575,10 +583,7 @@ ctags CTAGS:
 cscope cscopelist:
 
 
-distdir: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) distdir-am
-
-distdir-am: $(DISTFILES)
+distdir: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -830,23 +835,40 @@ uninstall-man: uninstall-man5 uninstall-man8
 .PRECIOUS: Makefile
 
 
-texi2html: tinc.texi
-	$(AM_V_GEN)texi2html -split=chapter $<
+# For additional rules usually of interest only to the maintainer,
+# see GNUmakefile and Makefile.maint.
+
+sample-config.tar.gz: sample-config
+	$(AM_V_GEN)GZIP=$(GZIP_ENV) $(AMTAR) chozf $@ --exclude .svn $<
 
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
+
+tinc.8.html: tinc.8
+	$(AM_V_GEN)w3mman2html $? > $@
+
+tinc-gui.8.html: tinc-gui.8
+	$(AM_V_GEN)w3mman2html $? > $@
 
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $< > $@
+	$(AM_V_GEN)w3mman2html $? > $@
 
-tincd.8: $(srcdir)/tincd.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
+tincd.8: tincd.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
 
-tinc.conf.5: $(srcdir)/tinc.conf.5.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
+tinc.8: tinc.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
 
-tincinclude.texi: $(srcdir)/tincinclude.texi.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tincinclude.texi.in > $@
+tinc-gui.8: tinc-gui.8.in
+	$(AM_V_GEN)$(substitute) $? > $@
+
+tinc.conf.5: tinc.conf.5.in
+	$(AM_V_GEN)$(substitute) $? > $@
+
+tincinclude.texi: tincinclude.texi.in
+	$(AM_V_GEN)$(substitute) $? > $@
+
+tinc.texi: tincinclude.texi
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.

doc/sample-config/hosts/alpha

@@ -1,15 +0,0 @@
-# Sample host configuration file
-
-# The real IP address of this tinc host. Can be used by other tinc hosts.
-Address = 123.234.35.67
-
-# Portnumber for incoming connections. Default is 655.
-Port = 655
-
-# Subnet on the virtual private network that is local for this host.
-Subnet = 192.168.1.0/24
-
-# The public key generated by `tincd -n example -K' is stored here
------BEGIN RSA PUBLIC KEY-----
-...
------END RSA PUBLIC KEY-----

doc/sample-config/hosts/beta

@@ -1,16 +0,0 @@
-# Sample host configuration file
-# This file was generated by host beta.
-
-# The real IP address of this tinc host. Can be used by other tinc hosts.
-Address = 123.45.67.189
-
-# Portnumber for incoming connections. Default is 655.
-Port = 6500
-
-# Subnet on the virtual private network that is local for this host.
-Subnet = 192.168.2.0/24
-
-# The public key generated by `tincd -n example -K' is stored here
------BEGIN RSA PUBLIC KEY-----
-...
------END RSA PUBLIC KEY-----

doc/sample-config/rsa_key.priv

@@ -1 +0,0 @@
-# Generate this file with `tincd -n example -K`

doc/sample-config/tinc-down

@@ -1,4 +0,0 @@
-#!/bin/sh
-# This file closes down the tap device.
-
-ifconfig $INTERFACE down

doc/sample-config/tinc-up

@@ -1,11 +0,0 @@
-#!/bin/sh
-# This file sets up the tap device.
-# It gives you the freedom to do anything you want with it.
-# Use the correct name for the tap device:
-# The environment variable $INTERFACE is set to the right name
-# on most platforms, but if it doesn't work try to set it manually.
-
-# Give it the right ip and netmask. Remember, the subnet of the
-# tap device must be larger than that of the individual Subnets
-# as defined in the host configuration file!
-ifconfig $INTERFACE 192.168.1.1 netmask 255.255.0.0

doc/sample-config/tinc.conf

@@ -1,22 +0,0 @@
-# Sample tinc configuration file
-
-# This is a comment.
-# Spaces and tabs are eliminated.
-# The = sign isn't strictly necessary any longer, though you may want
-# to leave it in as it improves readability :)
-# Variable names are treated case insensitive.
-
-# The name of this tinc host. Required.
-Name = alpha
-
-# The internet host to connect with.
-# Comment these out to make yourself a listen-only connection
-# You must use the name of another tinc host.
-# May be used multiple times for redundance.
-ConnectTo = beta
-
-# The tap device tinc will use.
-# /dev/tap0 for ethertap, FreeBSD or OpenBSD
-# /dev/tun0 for Solaris
-# /dev/net/tun for Linux tun/tap
-Device = /dev/net/tun

doc/tinc-gui.8.in

@@ -0,0 +1,57 @@
+.Dd 2011-06-26
+.Dt TINC-GUI 8
+.\" Manual page created by:
+.\" Guus Sliepen <guus@tinc-vpn.org>
+.Sh NAME
+.Nm tinc-gui
+.Nd tinc GUI
+.Sh SYNOPSIS
+.Nm
+.Op Fl n
+.Op Fl -net Ns = Ns Ar NETNAME
+.Op Fl -pidfile Ns = Ns Ar FILENAME
+.Op Fl -help
+.Sh DESCRIPTION
+This is a Python/wxWidgets based graphical user interface for tinc, a secure virtual private network (VPN) project.
+.Nm
+communicates with
+.Xr tincd 8
+to alter and inspect the running VPN's state.
+It can show the current settings, the list of connections, nodes, subnets, and edges.
+For now, the debug level can be changed from the GUI, and by right-clicking on a node in the list of connections,
+a pop-up menu will appear that allows one to disconnect that node.
+.Sh OPTIONS
+.Bl -tag -width indent
+.It Fl n, -net Ns = Ns Ar NETNAME
+Communicate with tincd(8) connected with
+.Ar NETNAME .
+.It Fl -pidfile Ns = Ns Ar FILENAME
+Use the cookie from
+.Ar FILENAME
+to authenticate with a running tinc daemon.
+If unspecified, the default is
+.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
+.It Fl -help
+Display short list of options.
+.El
+.Sh BUGS
+The GUI is not finished yet, the final version will have much more functionality.
+If you find any bugs, report them to tinc@tinc-vpn.org.
+.Sh SEE ALSO
+.Xr tincd 8 ,
+.Pa http://www.tinc-vpn.org/ .
+.Pp
+The full documentation for tinc is maintained as a Texinfo manual.
+If the info and tinc programs are properly installed at your site,
+the command
+.Ic info tinc
+should give you access to the complete manual.
+.Pp
+tinc comes with ABSOLUTELY NO WARRANTY.
+This is free software, and you are welcome to redistribute it under certain conditions;
+see the file COPYING for details.
+.Sh AUTHORS
+.An "Ivo Timmermans"
+.An "Guus Sliepen" Aq guus@tinc-vpn.org
+.Pp
+And thanks to many others for their contributions to tinc!

doc/tinc.8.in

@@ -0,0 +1,342 @@
+.Dd 2014-01-16
+.Dt TINCCTL 8
+.\" Manual page created by:
+.\" Scott Lamb
+.Sh NAME
+.Nm tinc
+.Nd tinc VPN control
+.Sh SYNOPSIS
+.Nm
+.Op Fl cn
+.Op Fl -config Ns = Ns Ar DIR
+.Op Fl -net Ns = Ns Ar NETNAME
+.Op Fl -pidfile Ns = Ns Ar FILENAME
+.Op Fl -force
+.Op Fl -help
+.Op Fl -version
+.Op Ar COMMAND
+.Sh DESCRIPTION
+This is the control program of tinc, a secure virtual private network (VPN)
+project.
+.Nm
+can start and stop
+.Xr tincd 8 ,
+and can to alter and inspect the state of a running VPN.
+It can also be used to change the configuration,
+or to import or export host configuration files from other nodes.
+
+If
+.Nm
+is started with a
+.Ar COMMAND ,
+this command is immediately executed, after which
+.Nm
+exits.
+If no
+.Ar COMMAND
+is given,
+.Nm
+will act as a shell;
+it will display a prompt, and commands can be entered on the prompt.
+If
+.Nm
+is compiled with libreadline, history and command completion are available on the prompt.
+One can also pipe a script containing commands through
+.Nm .
+In that case, lines starting with a # symbol will be ignored.
+.Sh OPTIONS
+.Bl -tag -width indent
+.It Fl n, -net Ns = Ns Ar NETNAME
+Communicate with tincd(8) connected with
+.Ar NETNAME .
+.It Fl -pidfile Ns = Ns Ar FILENAME
+Use the cookie from
+.Ar FILENAME
+to authenticate with a running tinc daemon.
+If unspecified, the default is
+.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
+.It Fl -force
+Force some commands to work despite warnings.
+.It Fl -help
+Display short list of options.
+.It Fl -version
+Output version information and exit.
+.El
+.Sh ENVIRONMENT VARIABLES
+.Bl -tag -width indent
+.It Ev NETNAME
+If no netname is specified on the command line with the
+.Fl n
+option, the value of this environment variable is used.
+.El
+.Sh COMMANDS
+.Bl -tag -width indent
+.It init Op Ar name
+Create initial configuration files and RSA and Ed25519 keypairs with default length.
+If no
+.Ar name
+for this node is given, it will be asked for.
+.It get Ar variable
+Print the current value of configuration variable
+.Ar variable .
+If more than one variable with the same name exists,
+the value of each of them will be printed on a separate line.
+.It set Ar variable Ar value
+Set configuration variable
+.Ar variable
+to the given
+.Ar value .
+All previously existing configuration variables with the same name are removed.
+To set a variable for a specific host, use the notation
+.Ar host Ns Li . Ns Ar variable .
+.It add Ar variable Ar value
+As above, but without removing any previously existing configuration variables.
+If the variable already exists with the given value, nothing happens.
+.It del Ar variable Op Ar value
+Remove configuration variables with the same name and
+.Ar value .
+If no
+.Ar value
+is given, all configuration variables with the same name will be removed.
+.It edit Ar filename
+Start an editor for the given configuration file.
+You do not need to specify the full path to the file.
+.It export
+Export the host configuration file of the local node to standard output.
+.It export-all
+Export all host configuration files to standard output.
+.It import
+Import host configuration data generated by the
+.Nm
+export command from standard input.
+Already existing host configuration files are not overwritten unless the option
+.Fl -force
+is used.
+.It exchange
+The same as export followed by import.
+.It exchange-all
+The same as export-all followed by import.
+.It invite Ar name
+Prepares an invitation for a new node with the given
+.Ar name ,
+and prints a short invitation URL that can be used with the join command.
+.It join Op Ar URL
+Join an existing VPN using an invitation URL created using the invite command.
+If no
+.Ar URL
+is given, it will be read from standard input.
+.It start Op tincd options
+Start
+.Xr tincd 8 ,
+optionally with the given extra options.
+.It stop
+Stop
+.Xr tincd 8 .
+.It restart Op tincd options
+Restart
+.Xr tincd 8 ,
+optionally with the given extra options.
+.It reload
+Partially rereads configuration files. Connections to hosts whose host
+config files are removed are closed. New outgoing connections specified
+in
+.Xr tinc.conf 5
+will be made.
+.It pid
+Shows the PID of the currently running
+.Xr tincd 8 .
+.It generate-keys Op bits
+Generate both RSA and Ed25519 keypairs (see below) and exit.
+.It generate-ed25519-keys
+Generate public/private Ed25519 keypair and exit.
+.It generate-rsa-keys Op bits
+Generate public/private RSA keypair and exit.
+If
+.Ar bits
+is omitted, the default length will be 2048 bits.
+When saving keys to existing files, tinc will not delete the old keys;
+you have to remove them manually.
+.It dump [reachable] nodes
+Dump a list of all known nodes in the VPN.
+If the keyword reachable is used, only lists reachable nodes.
+.It dump edges
+Dump a list of all known connections in the VPN.
+.It dump subnets
+Dump a list of all known subnets in the VPN.
+.It dump connections
+Dump a list of all meta connections with ourself.
+.It dump graph | digraph
+Dump a graph of the VPN in
+.Xr dotty 1
+format.
+Nodes are colored according to their reachability:
+red nodes are unreachable, orange nodes are indirectly reachable, green nodes are directly reachable.
+Black nodes are either directly or indirectly reachable, but direct reachability has not been tried yet.
+.It dump invitations
+Dump a list of outstanding invitations.
+The filename of the invitation, as well as the name of the node that is being invited is shown for each invitation.
+.It info Ar node | subnet | address
+Show information about a particular node, subnet or address.
+If an address is given, any matching subnet will be shown.
+.It purge
+Purges all information remembered about unreachable nodes.
+.It debug Ar N
+Sets debug level to
+.Ar N .
+.It log Op Ar N
+Capture log messages from a running tinc daemon.
+An optional debug level can be given that will be applied only for log messages sent to
+.Nm tinc .
+.It retry
+Forces
+.Xr tincd 8
+to try to connect to all uplinks immediately.
+Usually
+.Xr tincd 8
+attempts to do this itself,
+but increases the time it waits between the attempts each time it failed,
+and if
+.Xr tincd 8
+didn't succeed to connect to an uplink the first time after it started,
+it defaults to the maximum time of 15 minutes.
+.It disconnect Ar NODE
+Closes the meta connection with the given
+.Ar NODE .
+.It top
+If
+.Nm
+is compiled with libcurses support, this will display live traffic statistics
+for all the known nodes, similar to the UNIX
+.Xr top 1
+command.
+See below for more information.
+.It pcap
+Dump VPN traffic going through the local tinc node in
+.Xr pcap-savefile 5
+format to standard output,
+from where it can be redirected to a file or piped through a program that can parse it directly,
+such as
+.Xr tcpdump 8 .
+.It network Op Ar netname
+If
+.Ar netname
+is given, switch to that network.
+Otherwise, display a list of all networks for which configuration files exist.
+.It fsck
+This will check the configuration files for possible problems,
+such as unsafe file permissions, missing executable bit on script,
+unknown and obsolete configuration variables, wrong public and/or private keys, and so on.
+.Pp
+When problems are found, this will be printed on a line with WARNING or ERROR in front of it.
+Most problems must be corrected by the user itself, however in some cases (like file permissions and missing public keys),
+tinc will ask if it should fix the problem.
+.It sign Op Ar filename
+Sign a file with the local node's private key.
+If no
+.Ar filename
+is given, the file is read from standard input.
+The signed file is written to standard output.
+.It verify Ar name Op Ar filename
+Check the signature of a file against a node's public key.
+The
+.Ar name
+of the node must be given,
+or can be
+.Li .
+to check against the local node's public key, or
+.Li *
+to allow a signature from any node whose public key is known.
+If no
+.Ar filename
+is given, the file is read from standard input.
+If the verification is succesful,
+a copy of the input with the signature removed is written to standard output,
+and the exit code will be zero.
+If the verification failed,
+nothing will be written to standard output, and the exit code will be non-zero.
+.El
+.Sh EXAMPLES
+Examples of some commands:
+.Bd -literal -offset indent
+tinc -n vpn dump graph | circo -Txlib
+tinc -n vpn pcap | tcpdump -r -
+tinc -n vpn top
+.Pp
+.Ed
+Examples of changing the configuration using
+.Nm :
+.Bd -literal -offset indent
+tinc -n vpn init foo
+tinc -n vpn add Subnet 192.168.1.0/24
+tinc -n vpn add bar.Address bar.example.com
+tinc -n vpn add ConnectTo bar
+tinc -n vpn export | gpg --clearsign | mail -s "My config" vpnmaster@example.com
+.Ed
+.Sh TOP
+The top command connects to a running tinc daemon and repeatedly queries its per-node traffic counters.
+It displays a list of all the known nodes in the left-most column,
+and the amount of bytes and packets read from and sent to each node in the other columns.
+By default, the information is updated every second.
+The behaviour of the top command can be changed using the following keys:
+.Bl -tag
+.It Ic s
+Change the interval between updates.
+After pressing the
+.Ic s
+key, enter the desired interval in seconds, followed by enter.
+Fractional seconds are honored.
+Intervals lower than 0.1 seconds are not allowed.
+.It Ic c
+Toggle between displaying current traffic rates (in packets and bytes per second)
+and cumulative traffic (total packets and bytes since the tinc daemon started).
+.It Ic n
+Sort the list of nodes by name.
+.It Ic i
+Sort the list of nodes by incoming amount of bytes.
+.It Ic I
+Sort the list of nodes by incoming amount of packets.
+.It Ic o
+Sort the list of nodes by outgoing amount of bytes.
+.It Ic O
+Sort the list of nodes by outgoing amount of packets.
+.It Ic t
+Sort the list of nodes by sum of incoming and outgoing amount of bytes.
+.It Ic T
+Sort the list of nodes by sum of incoming and outgoing amount of packets.
+.It Ic b
+Show amount of traffic in bytes.
+.It Ic k
+Show amount of traffic in kilobytes.
+.It Ic M
+Show amount of traffic in megabytes.
+.It Ic G
+Show amount of traffic in gigabytes.
+.It Ic q
+Quit.
+.El
+.Sh BUGS
+If you find any bugs, report them to tinc@tinc-vpn.org.
+.Sh SEE ALSO
+.Xr tincd 8 ,
+.Xr tinc.conf 5 ,
+.Xr dotty 1 ,
+.Xr pcap-savefile 5 ,
+.Xr tcpdump 8 ,
+.Xr top 1 ,
+.Pa http://www.tinc-vpn.org/ ,
+.Pa http://www.cabal.org/ .
+.Pp
+The full documentation for tinc is maintained as a Texinfo manual.
+If the info and tinc programs are properly installed at your site,
+the command
+.Ic info tinc
+should give you access to the complete manual.
+.Pp
+tinc comes with ABSOLUTELY NO WARRANTY.
+This is free software, and you are welcome to redistribute it under certain conditions;
+see the file COPYING for details.
+.Sh AUTHORS
+.An "Ivo Timmermans"
+.An "Guus Sliepen" Aq guus@tinc-vpn.org
+.Pp
+And thanks to many others for their contributions to tinc!

doc/tinc.conf.5.in

@@ -1,4 +1,4 @@
-.Dd 2016-10-29
+.Dd 2017-09-02
 .Dt TINC.CONF 5
 .\" Manual page created by:
 .\" Ivo Timmermans
@@ -11,20 +11,12 @@ The files in the
 .Pa @sysconfdir@/tinc/
 directory contain runtime and security information for the tinc daemon.
 .Sh NETWORKS
-It is perfectly ok for you to run more than one tinc daemon.
-However, in its default form,
-you will soon notice that you can't use two different configuration files without the
-.Fl c
-option.
-.Pp
-We have thought of another way of dealing with this: network names.
-This means that you call
-.Nm
-with the
+To distinguish multiple instances of tinc running on one computer,
+you can use the
 .Fl n
-option, which will assign a name to this daemon.
+option to assign a network name to each tinc daemon.
 .Pp
-The effect of this is that the daemon will set its configuration root to
+The effect of this option is that the daemon will set its configuration root to
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa / ,
 where 
 .Ar NETNAME
@@ -32,13 +24,14 @@ is your argument to the
 .Fl n
 option.
 You'll notice that messages appear in syslog as coming from
-.Nm tincd. Ns Ar NETNAME .
+.Nm tincd. Ns Ar NETNAME ,
+and on Linux, unless specified otherwise, the name of the virtual network interface will be the same as the network name.
 .Pp
-However, it is not strictly necessary that you call tinc with the
+It is recommended that you use network names even if you run only one instance of tinc.
+However, you can choose not to use the
 .Fl n
 option.
-In this case, the network name would just be empty,
-and it will be used as such.
+In this case, the network name would just be empty, and
 .Nm tinc
 now looks for files in
 .Pa @sysconfdir@/tinc/ ,
@@ -48,11 +41,6 @@ the configuration file should be
 .Pa @sysconfdir@/tinc/tinc.conf ,
 and the host configuration files are now expected to be in
 .Pa @sysconfdir@/tinc/hosts/ .
-.Pp
-But it is highly recommended that you use this feature of
-.Nm tinc ,
-because it will be so much clearer whom your daemon talks to.
-Hence, we will assume that you use it.
 .Sh NAMES
 Each tinc daemon must have a name that is unique in the network which it will be part of.
 The name will be used by other tinc daemons for identification.
@@ -63,24 +51,34 @@ file.
 To make things easy,
 choose something that will give unique and easy to remember names to your tinc daemon(s).
 You could try things like hostnames, owner surnames or location names.
+However, you are only allowed to use alphanumerical characters (a-z, A-Z, and 0-9) and underscores (_) in the name.
+.Sh INITIAL CONFIGURATION
+If you have not configured tinc yet, you can easily create a basic configuration using the following command:
+.Bd -literal -offset indent
+.Nm tinc Fl n Ar NETNAME Li init Ar NAME
+.Ed
+.Pp
+You can further change the configuration as needed either by manually editing the configuration files,
+or by using
+.Xr tinc 8 .
 .Sh PUBLIC/PRIVATE KEYS
-You should use 
-.Ic tincd -K
-to generate public/private keypairs.
-It will generate two keys.
-The private key should be stored in a separate file
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv
-\-\- where 
-.Ar NETNAME
-stands for the network (see 
-.Sx NETWORKS )
-above.
-The public key should be stored in the host configuration file
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME
-\-\- where
-.Va NAME
-stands for the name of the local tinc daemon (see
-.Sx NAMES ) .
+The
+.Nm tinc Li init
+command will have generated both RSA and Ed25519 public/private keypairs.
+The private keys should be stored in files named
+.Pa rsa_key.priv
+and
+.Pa ed25519_key.priv
+in the directory
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /
+The public keys should be stored in the host configuration file
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME .
+The RSA keys are used for backwards compatibility with tinc version 1.0.
+If you are upgrading from version 1.0 to 1.1, you can keep the old configuration files,
+but you will need to create Ed25519 keys using the following command:
+.Bd -literal -offset indent
+.Nm tinc Fl n Ar NETNAME Li generate-ed25519-keys
+.Ed
 .Sh SERVER CONFIGURATION
 The server configuration of the daemon is done in the file
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc.conf .
@@ -103,6 +101,10 @@ Although all configuration options for the local host listed in this document ca
 it is recommended to put host specific configuration options in the host configuration file,
 as this makes it easy to exchange with other nodes.
 .Pp
+You can edit the config file manually, but it is recommended that you use
+.Xr tinc 8
+to change configuration variables for you.
+.Pp
 Here are all valid variables, listed in alphabetical order.
 The default value is given between parentheses.
 .Bl -tag -width indent
@@ -112,26 +114,24 @@ If
 .Qq any
 is selected, then depending on the operating system both IPv4 and IPv6 or just
 IPv6 listening sockets will be created.
-.It Va BindToAddress Li = Ar address Oo Ar port Oc Bq experimental
-If your computer has more than one IPv4 or IPv6 address,
+.It Va AutoConnect Li = yes | no Po no Pc Bq experimental
+If set to yes,
 .Nm tinc
-will by default listen on all of them for incoming connections.
-Multiple
+will automatically set up meta connections to other nodes,
+without requiring
+.Va ConnectTo
+variables.
+.Pp
+Note: it is not possible to connect to nodes using zero (system-assigned) ports in this way.
+.It Va BindToAddress Li = Ar address Op Ar port
+This is the same as
+.Va ListenAddress ,
+however the address given with the
 .Va BindToAddress
-variables may be specified,
-in which case listening sockets for each specified address are made.
-.Pp
-If no
-.Ar port
-is specified, the socket will be bound to the port specified by the
-.Va Port
-option, or to port 655 if neither is given.
-To only bind to a specific port but not to a specific address, use
-.Li *
-for the
-.Ar address .
-.Pp
-This option may not work on all platforms.
+option will also be used for outgoing connections. This is useful if your
+computer has more than one IPv4 or IPv6 address, and you want 
+.Nm tinc
+to only use a specific one for outgoing packets.
 .It Va BindToInterface Li = Ar interface Bq experimental
 If your computer has more than one network interface,
 .Nm tinc
@@ -157,6 +157,13 @@ Broadcast packets are sent directly to all nodes that can be reached directly.
 Broadcast packets received from other nodes are never forwarded.
 If the IndirectData option is also set, broadcast packets will only be sent to nodes which we have a meta connection to.
 .El
+.It Va BroadcastSubnet Li = Ar address Ns Op Li / Ns Ar prefixlength
+Declares a broadcast subnet. Any packet with a destination address falling into such a subnet will be routed as a broadcast (provided all nodes have it declared).
+This is most useful to declare subnet broadcast addresses (e.g. 10.42.255.255), otherwise
+.Nm tinc
+won't know what to do with them.
+.Pp
+Note that global broadcast addresses (MAC ff:ff:ff:ff:ff:ff, IPv4 255.255.255.255), as well as multicast space (IPv4 224.0.0.0/4, IPv6 ff00::/8) are always considered broadcast addresses and don't need to be declared.
 .It Va ConnectTo Li = Ar name
 Specifies which other tinc daemon to connect to on startup.
 Multiple
@@ -169,7 +176,9 @@ The names should be known to this tinc daemon
 line).
 .Pp
 If you don't specify a host with
-.Va ConnectTo ,
+.Va ConnectTo
+and don't enable
+.Va AutoConnect ,
 .Nm tinc
 won't try to connect to other daemons at all,
 and will instead just listen for incoming connections.
@@ -193,6 +202,13 @@ instead of
 .Va Device .
 The info pages of the tinc package contain more information
 about configuring the virtual network device.
+.It Va DeviceStandby Li = yes | no Po no Pc
+When disabled,
+.Nm tinc
+calls tinc-up on startup, and tinc-down on shutdown. When enabled,
+.Nm tinc
+will only call tinc-up when at least one node is reachable, and will call tinc-down as soon as no nodes are reachable.
+On Windows, this also determines when the virtual network interface "cable" is "plugged".
 .It Va DeviceType Li = Ar type Pq platform dependent
 The type of the virtual network device.
 Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used.
@@ -218,11 +234,15 @@ Do NOT connect multiple
 .Nm tinc 
 daemons to the same multicast address, this will very likely cause routing loops.
 Also note that this can cause decrypted VPN packets to be sent out on a real network if misconfigured.
+.It fd
+Use a file descriptor.
+All packets are read from this interface.
+Packets received for the local node are written to it.
 .It uml Pq not compiled in by default
 Create a UNIX socket with the filename specified by
 .Va Device ,
 or
-.Pa @runstatedir@/ Ns Ar NETNAME Ns Pa .umlsocket
+.Pa @localstatedir@/run/ Ns Ar NETNAME Ns Pa .umlsocket
 if not specified.
 .Nm tinc
 will wait for a User Mode Linux instance to connect to this socket.
@@ -231,7 +251,7 @@ Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch,
 using the UNIX socket specified by
 .Va Device ,
 or
-.Pa @runstatedir@/vde.ctl
+.Pa @localstatedir@/run/vde.ctl
 if not specified.
 .El
 Also, in case tinc does not seem to correctly interpret packets received from the virtual network device,
@@ -264,6 +284,17 @@ When this option is enabled, packets that cannot be sent directly to the destina
 but which would have to be forwarded by an intermediate node, are dropped instead.
 When combined with the IndirectData option,
 packets for nodes for which we do not have a meta connection with are also dropped.
+.It Va Ed25519PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /ed25519_key.priv Pc
+The file in which the private Ed25519 key of this tinc daemon resides.
+This is only used if
+.Va ExperimentalProtocol
+is enabled.
+.It Va ExperimentalProtocol Li = yes | no Pq yes
+When this option is enabled, the SPTPS protocol will be used when connecting to nodes that also support it.
+Ephemeral ECDH will be used for key exchanges,
+and Ed25519 will be used instead of RSA for authentication.
+When enabled, an Ed25519 key must have been generated before with
+.Nm tinc generate-ed25519-keys .
 .It Va Forwarding Li = off | internal | kernel Po internal Pc Bq experimental
 This option selects the way indirect packets are forwarded.
 .Bl -tag -width indent
@@ -279,18 +310,6 @@ Incoming packets are always sent to the TUN/TAP device, even if the packets are
 This is less efficient, but allows the kernel to apply its routing and firewall rules on them,
 and can also help debugging.
 .El
-.It Va GraphDumpFile Li = Ar filename Bq experimental
-If this option is present,
-.Nm tinc
-will dump the current network graph to the file
-.Ar filename
-every minute, unless there were no changes to the graph.
-The file is in a format that can be read by graphviz tools.
-If
-.Ar filename
-starts with a pipe symbol |,
-then the rest of the filename is interpreted as a shell command
-that is executed, the graph is then sent to stdin.
 .It Va Hostnames Li = yes | no Pq no
 This option selects whether IP addresses (both real and on the VPN) should
 be resolved. Since DNS lookups are blocking, it might affect tinc's
@@ -308,11 +327,40 @@ Under Windows, this variable is used to select which network interface will be u
 If you specified a
 .Va Device ,
 this variable is almost always already correctly set.
+.It Va InvitationExpire Li = Ar seconds Pq 604800
+This option controls the period invitations are valid.
 .It Va KeyExpire Li = Ar seconds Pq 3600
 This option controls the period the encryption keys used to encrypt the data are valid.
 It is common practice to change keys at regular intervals to make it even harder for crackers,
 even though it is thought to be nearly impossible to crack a single key.
-.It Va LocalDiscovery Li = yes | no Po no Pc Bq experimental
+.It Va ListenAddress Li = Ar address Op Ar port
+If your computer has more than one IPv4 or IPv6 address,
+.Nm tinc
+will by default listen on all of them for incoming connections.
+This option can be used to restrict which addresses tinc listens on.
+Multiple
+.Va ListenAddress
+variables may be specified,
+in which case listening sockets for each specified address are made.
+.Pp
+If no
+.Ar port
+is specified, the socket will listen on the port specified by the
+.Va Port
+option, or to port 655 if neither is given.
+To only listen on a specific port but not on a specific address, use
+.Li *
+for the
+.Ar address .
+.Pp
+If
+.Ar port
+is set to zero, it will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. In this case it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
+.It Va LocalDiscovery Li = yes | no Pq yes
 When enabled,
 .Nm tinc
 will try to detect peers that are on the same local network.
@@ -320,14 +368,20 @@ This will allow direct communication using LAN addresses, even if both peers are
 and they only ConnectTo a third node outside the NAT,
 which normally would prevent the peers from learning each other's LAN address.
 .Pp
-Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery.
-This feature may not work in all possible situations.
+Currently, local discovery is implemented by sending some packets to the local address of the node during UDP discovery. This will not work with old nodes that don't transmit their local address.
+.It Va LogLevel Li = level Pq 0
+This option controls the verbosity of the logging. The higher the debug level, the more messages it will log.
 .It Va MACExpire Li = Ar seconds Pq 600
 This option controls the amount of time MAC addresses are kept before they are removed.
 This only has effect when
 .Va Mode
 is set to
 .Qq switch .
+.It Va MaxConnectionBurst Li = Ar count Pq 100
+This option controls how many connections tinc accepts in quick succession.
+If there are more connections than the given number in a short time interval,
+tinc will reduce the number of accepted connections to only one per second,
+until the burst has passed.
 .It Va MaxTimeout Li = Ar seconds Pq 900
 This is the maximum delay before trying to reconnect to other tinc daemons.
 .It Va Mode Li = router | switch | hub Pq router
@@ -337,7 +391,7 @@ This option selects the way packets are routed to other daemons.
 In this mode
 .Va Subnet
 variables in the host configuration files will be used to form a routing table.
-Only unicast packets of routable protocols (IPv4 and IPv6) are supported in this mode.
+Only packets of routable protocols (IPv4 and IPv6) are supported in this mode.
 .Pp
 This is the default mode, and unless you really know you need another mode, don't change it.
 .It switch
@@ -355,7 +409,8 @@ while no routing table is managed.
 .It Va Name Li = Ar name Bq required
 This is the name which identifies this tinc daemon.
 It must be unique for the virtual private network this daemon will connect to.
-The Name may only consist of alphanumeric and underscore characters.
+.Va Name
+may only consist of alphanumeric and underscore characters (a-z, A-Z, 0-9 and _), and is case sensitive.
 If 
 .Va Name
 starts with a
@@ -385,7 +440,9 @@ It will allow this tinc daemon to authenticate itself to other daemons.
 .It Va PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv Pc
 The file in which the private RSA key of this tinc daemon resides.
 .It Va ProcessPriority Li = low | normal | high
-When this option is used the priority of the tincd process will be adjusted.
+When this option is used the priority of the 
+.Nm tincd
+process will be adjusted.
 Increasing the priority may help to reduce latency and packet loss on the VPN.
 .It Va Proxy Li = socks4 | socks5 | http | exec Ar ... Bq experimental
 Use a proxy when making outgoing connections.
@@ -419,13 +476,13 @@ and
 .Ev REMOTEPORT
 are available.
 .El
-.It Va ReplayWindow Li = Ar bytes Pq 16
+.It Va ReplayWindow Li = Ar bytes Pq 32
 This is the size of the replay tracking window for each remote node, in bytes.
 The window is a bitfield which tracks 1 packet per bit, so for example
-the default setting of 16 will track up to 128 packets in the window.  In high
+the default setting of 32 will track up to 256 packets in the window. In high
 bandwidth scenarios, setting this to a higher value can reduce packet loss from
 the interaction of replay tracking with underlying real packet loss and/or
-reordering.  Setting this to zero will disable replay tracking completely and
+reordering. Setting this to zero will disable replay tracking completely and
 pass all traffic, but leaves tinc vulnerable to replay-based attacks on your
 traffic.
 .It Va StrictSubnets Li = yes | no Po no Pc Bq experimental
@@ -440,12 +497,42 @@ and will only allow connections with nodes for which host config files are prese
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 directory.
 Setting this options also implicitly sets StrictSubnets.
-.It Va UDPRcvBuf Li = Ar bytes Pq OS default
+.It Va UDPDiscovery Li = yes | no Po yes Pc
+When this option is enabled tinc will try to establish UDP connectivity to nodes,
+using TCP while it determines if a node is reachable over UDP. If it is disabled,
+tinc always assumes a node is reachable over UDP.
+Note that tinc will never use UDP with nodes that have
+.Va TCPOnly
+enabled.
+.It Va UDPDiscoveryKeepaliveInterval Li = Ar seconds Pq 9
+The minimum amount of time between sending UDP ping datagrams to check UDP connectivity once it has been established.
+Note that these pings are large, since they are used to verify link MTU as well.
+.It Va UDPDiscoveryInterval Li = Ar seconds Pq 2
+The minimum amount of time between sending UDP ping datagrams to try to establish UDP connectivity.
+.It Va UDPDiscoveryTimeout Li = Ar seconds Pq 30
+If tinc doesn't receive any UDP ping replies over the specified interval,
+it will assume UDP communication is broken and will fall back to TCP.
+.It Va UDPInfoInterval Li = Ar seconds Pq 5
+The minimum amount of time between sending periodic updates about UDP addresses, which are mostly useful for UDP hole punching.
+.It Va UDPRcvBuf Li = Ar bytes Pq 1048576
 Sets the socket receive buffer size for the UDP socket, in bytes.
-If unset, the default buffer size will be used by the operating system.
-.It Va UDPSndBuf Li = Ar bytes Pq OS default
+If set to zero, the default buffer size will be used by the operating system.
+Note: this setting can have a significant impact on performance, especially raw throughput.
+.It Va UDPSndBuf Li = Ar bytes Pq 1048576
 Sets the socket send buffer size for the UDP socket, in bytes.
-If unset, the default buffer size will be used by the operating system.
+If set to zero, the default buffer size will be used by the operating system.
+Note: this setting can have a significant impact on performance, especially raw throughput.
+.It Va UPnP Li = yes | udponly | no Po no Pc
+If this option is enabled then tinc will search for UPnP-IGD devices on the local network.
+It will then create and maintain port mappings for tinc's listening TCP and UDP ports.
+If set to "udponly", tinc will only create a mapping for its UDP (data) port, not for its TCP (metaconnection) port.
+Note that tinc must have been built with miniupnpc support for this feature to be available.
+Furthermore, be advised that enabling this can have security implications, because the miniupnpc library that
+tinc uses might not be well-hardened with regard to malicious UPnP replies.
+.It Va UPnPDiscoverWait Li = Ar seconds Pq 5
+The amount of time to wait for replies when probing the local network for UPnP devices.
+.It Va UPnPRefreshPeriod Li = Ar seconds Pq 60
+How often tinc will re-add the port mapping, in case it gets reset on the UPnP device. This also controls the duration of the port mapping itself, which will be set to twice that duration.
 .El
 .Sh HOST CONFIGURATION FILES
 The host configuration files contain all information needed
@@ -468,13 +555,15 @@ Multiple
 .Va Address
 variables can be specified, in which case each address will be tried until a working
 connection has been established.
-.It Va Cipher Li = Ar cipher Pq aes-256-cbc
+.It Va Cipher Li = Ar cipher Pq blowfish
 The symmetric cipher algorithm used to encrypt UDP packets.
 Any cipher supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet encryption.
 It is best to use only those ciphers which support CBC mode.
+This option has no effect for connections between nodes using
+.Va ExperimentalProtocol .
 .It Va ClampMSS Li = yes | no Pq yes
 This option specifies whether tinc should clamp the maximum segment size (MSS)
 of TCP packets to the path MTU. This helps in situations where ICMP
@@ -483,12 +572,14 @@ Fragmentation Needed or Packet too Big messages are dropped by firewalls.
 This option sets the level of compression used for UDP packets.
 Possible values are 0 (off), 1 (fast zlib) and any integer up to 9 (best zlib),
 10 (fast lzo) and 11 (best lzo).
-.It Va Digest Li = Ar digest Pq sha256
+.It Va Digest Li = Ar digest Pq sha1
 The digest algorithm used to authenticate UDP packets.
 Any digest supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet authentication.
+This option has no effect for connections between nodes using
+.Va ExperimentalProtocol .
 .It Va IndirectData Li = yes | no Pq no
 When set to yes, only nodes which already have a meta connection to you
 will try to establish direct communication with you.
@@ -498,16 +589,28 @@ The length of the message authentication code used to authenticate UDP packets.
 Can be anything from
 .Qq 0
 up to the length of the digest produced by the digest algorithm.
+This option has no effect for connections between nodes using
+.Va ExperimentalProtocol .
 .It Va PMTU Li = Ar mtu Po 1514 Pc
 This option controls the initial path MTU to this node.
 .It Va PMTUDiscovery Li = yes | no Po yes Pc
 When this option is enabled, tinc will try to discover the path MTU to this node.
 After the path MTU has been discovered, it will be enforced on the VPN.
+.It Va MTUInfoInterval Li = Ar seconds Pq 5
+The minimum amount of time between sending periodic updates about relay path MTU. Useful for quickly determining MTU to indirect nodes.
 .It Va Port Li = Ar port Pq 655
 The port number on which this tinc daemon is listening for incoming connections,
 which is used if no port number is specified in an
 .Va Address
 statement.
+.Pp
+If this is set to zero, the port will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. When setting
+.Va Port
+to zero it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
 .It Va PublicKey Li = Ar key Bq obsolete
 The public RSA key of this tinc daemon.
 It will be used to cryptographically verify it's identity and to set up a secure connection.
@@ -542,7 +645,7 @@ IPv6 subnets are notated like fec0:0:0:1::/64.
 MAC addresses are notated like 0:1a:2b:3c:4d:5e.
 .Pp
 A Subnet can be given a weight to indicate its priority over identical Subnets
-owned by different nodes.  The default weight is 10. Lower values indicate
+owned by different nodes. The default weight is 10. Lower values indicate
 higher priority. Packets will be sent to the node with the highest priority,
 unless that node is not reachable, in which case the node with the next highest
 priority will be tried, and so on.
@@ -556,6 +659,12 @@ Setting this options also implicitly sets IndirectData.
 .Pp
 Since version 1.0.10, tinc will automatically detect whether communication via
 UDP is possible or not.
+.It Va Weight Li = Ar weight
+If this variable is set, it overrides the weight given to connections made with
+another host. A higher
+.Ar weight
+means a lower priority is given to this connection when broadcasting or
+forwarding packets.
 .El
 .Sh SCRIPTS
 Apart from reading the server and host configuration files,
@@ -569,17 +678,23 @@ This guarantees that scripts will execute in the exact same order as the events
 If you need to run commands asynchronously, you have to ensure yourself that they are being run in the background.
 .Pp
 Under Windows (not Cygwin), the scripts must have the extension
-.Pa .bat .
+.Pa .bat
+or
+.Pa .cmd .
 .Bl -tag -width indent
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
 This is the most important script.
-If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device.
+If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device (or when the first node becomes reachable if
+.Va DeviceStandby
+is used).
 It should be used to set up the corresponding network interface,
 but can also be used to start other things.
 .Pp
 Under Windows you can use the Network Connections control panel instead of creating this script.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-down
-This script is started right before the tinc daemon quits.
+This script is started right before the tinc daemon quits (or when the last node becomes unreachable if
+.Va DeviceStandby
+is used).
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Ar HOST Ns Pa -up
 This script is started when the tinc daemon with name
 .Ar HOST
@@ -597,6 +712,10 @@ This script is started when a Subnet becomes reachable.
 The Subnet and the node it belongs to are passed in environment variables.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /subnet-down
 This script is started when a Subnet becomes unreachable.
+.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-created
+This script is started when a new invitation has been created.
+.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-accepted
+This script is started when an invitation has been used.
 .El
 .Pp
 The scripts are started without command line arguments, but can make use of certain environment variables.
@@ -605,6 +724,8 @@ Under UNIX like operating systems the names of environment variables must be pre
 in scripts.
 Under Windows, in
 .Pa .bat
+or
+.Pa .cmd
 files, they have to be put between
 .Li %
 signs.
@@ -630,6 +751,14 @@ When a host becomes (un)reachable, this is set to the port number it uses for co
 When a subnet becomes (un)reachable, this is set to the subnet.
 .It Ev WEIGHT
 When a subnet becomes (un)reachable, this is set to the subnet weight.
+.It Ev INVITATION_FILE
+When the
+.Pa invitation-created
+script is called, this is set to the file where the invitation details will be stored.
+.It Ev INVITATION_URL
+When the
+.Pa invitation-created
+script is called, this is set to the invitation URL that has been created.
 .El
 .Pp
 Do not forget that under UNIX operating systems, you have to make the scripts executable, using the command
@@ -643,7 +772,7 @@ The top directory for configuration files.
 The default name of the server configuration file for net
 .Ar NETNAME .
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /conf.d/
-Optional directory from which any *.conf file will be loaded
+Optional directory from which any .conf file will be loaded
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 Host configuration files are kept in this directory.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
@@ -654,9 +783,14 @@ It can be used to set up the corresponding network interface.
 If an executable file with this name exists,
 it will be executed right before the tinc daemon is going to close
 its connection to the virtual network device.
+.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitations/
+This directory contains outstanding invitations.
+.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-data
+After a succesful join, this file contains a copy of the invitation data received.
 .El
 .Sh SEE ALSO
 .Xr tincd 8 ,
+.Xr tinc 8 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.tldp.org/LDP/nag2/ .
 .Pp

doc/tincd.8.in

@@ -1,4 +1,4 @@
-.Dd 2014-05-11
+.Dd 2013-01-14
 .Dt TINCD 8
 .\" Manual page created by:
 .\" Ivo Timmermans
@@ -8,17 +8,15 @@
 .Nd tinc VPN daemon
 .Sh SYNOPSIS
 .Nm
-.Op Fl cdDkKnoLRU
+.Op Fl cdDKnsoLRU
 .Op Fl -config Ns = Ns Ar DIR
 .Op Fl -no-detach
 .Op Fl -debug Ns Op = Ns Ar LEVEL
-.Op Fl -kill Ns Op = Ns Ar SIGNAL
 .Op Fl -net Ns = Ns Ar NETNAME
-.Op Fl -generate-keys Ns Op = Ns Ar BITS
 .Op Fl -option Ns = Ns Ar [HOST.]KEY=VALUE
 .Op Fl -mlock
 .Op Fl -logfile Ns Op = Ns Ar FILE
-.Op Fl -pidfile Ns = Ns Ar FILE
+.Op Fl -syslog
 .Op Fl -bypass-security
 .Op Fl -chroot
 .Op Fl -user Ns = Ns Ar USER
@@ -54,14 +52,6 @@ If not mentioned otherwise, this will show log messages on the standard error ou
 Increase debug level or set it to
 .Ar LEVEL
 (see below).
-.It Fl k, -kill Ns Op = Ns Ar SIGNAL
-Attempt to kill a running
-.Nm
-(optionally with the specified
-.Ar SIGNAL
-instead of SIGTERM) and exit.
-Under Windows (not Cygwin) the optional argument is ignored,
-the service will always be stopped and removed.
 .It Fl n, -net Ns = Ns Ar NETNAME
 Connect to net
 .Ar NETNAME .
@@ -73,13 +63,6 @@ for
 .Ar NETNAME
 is the same as not specifying any
 .Ar NETNAME .
-.It Fl K, -generate-keys Ns Op = Ns Ar BITS
-Generate public/private RSA keypair and exit.
-If
-.Ar BITS
-is omitted, the default length will be 2048 bits.
-When saving keys to existing files, tinc will not delete the old keys,
-you have to remove them manually.
 .It Fl o, -option Ns = Ns Ar [HOST.]KEY=VALUE
 Without specifying a
 .Ar HOST ,
@@ -99,18 +82,25 @@ This option can be used more than once to specify multiple configuration variabl
 .It Fl L, -mlock
 Lock tinc into main memory.
 This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
+This option is not supported on all platforms.
 .It Fl -logfile Ns Op = Ns Ar FILE
 Write log entries to a file instead of to the system logging facility.
 If
 .Ar FILE
 is omitted, the default is
 .Pa @localstatedir@/log/tinc. Ns Ar NETNAME Ns Pa .log.
-.It Fl -pidfile Ns = Ns Ar FILE
-Write PID to
+.It Fl s, -syslog
+When this option is is set, tinc uses syslog instead of stderr in --no-detach mode.
+.It Fl -pidfile Ns = Ns Ar FILENAME
+Store a cookie in
+.Ar FILENAME
+which allows
+.Xr tinc 8
+to authenticate.
+If
 .Ar FILE
-instead of
-.Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
-Under Windows this option will be ignored.
+is omitted, the default is
+.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
 .It Fl -bypass-security
 Disables encryption and authentication of the meta protocol.
 Only useful for debugging.
@@ -118,10 +108,12 @@ Only useful for debugging.
 With this option tinc chroots into the directory where network
 config is located (@sysconfdir@/tinc/NETNAME if -n option is used,
 or to the directory specified with -c option) after initialization.
+This option is not supported on all platforms.
 .It Fl U, -user Ns = Ns Ar USER
 setuid to the specified
 .Ar USER
 after initialization.
+This option is not supported on all platforms.
 .It Fl -help
 Display short list of options.
 .It Fl -version
@@ -151,15 +143,6 @@ If the
 .Fl -logfile
 option is used, this will also close and reopen the log file,
 useful when log rotation is used.
-.It INT
-Temporarily increases debug level to 5.
-Send this signal again to revert to the original level.
-.It USR1
-Dumps the connection list to syslog.
-.It USR2
-Dumps virtual network device statistics, all known nodes, edges and subnets to syslog.
-.It WINCH
-Purges all information remembered about unreachable nodes.
 .El
 .Sh DEBUG LEVELS
 The tinc daemon can send a lot of messages to the syslog.
@@ -190,7 +173,7 @@ This will log all network traffic over the virtual private network.
 Directory containing the configuration files tinc uses.
 For more information, see
 .Xr tinc.conf 5 .
-.It Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid
+.It Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid
 The PID of the currently running
 .Nm
 is stored in this file.
@@ -206,6 +189,7 @@ If you find any bugs, report them to tinc@tinc-vpn.org.
 .Sh TODO
 A lot, especially security auditing.
 .Sh SEE ALSO
+.Xr tinc 8 ,
 .Xr tinc.conf 5 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.cabal.org/ .

doc/tincinclude.texi

@@ -1,5 +0,0 @@
-@set VERSION 1.0.36
-@set PACKAGE tinc
-@set sysconfdir /etc
-@set localstatedir /var
-@set runstatedir /run

doc/tincinclude.texi.in

@@ -2,4 +2,3 @@
 @set PACKAGE @PACKAGE@
 @set sysconfdir @sysconfdir@
 @set localstatedir @localstatedir@
-@set runstatedir @runstatedir@

gui/Makefile.am

@@ -0,0 +1,3 @@
+dist_bin_SCRIPTS = tinc-gui
+
+extra_DIST = README.gui

gui/Makefile.in

@@ -0,0 +1,507 @@
+# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = gui
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
+	$(top_srcdir)/m4/ax_append_flag.m4 \
+	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
+	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
+	$(top_srcdir)/m4/ax_check_link_flag.m4 \
+	$(top_srcdir)/m4/ax_require_defined.m4 \
+	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
+	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
+	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(dist_bin_SCRIPTS) \
+	$(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(bindir)"
+SCRIPTS = $(dist_bin_SCRIPTS)
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+SOURCES =
+DIST_SOURCES =
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CURSES_LIBS = @CURSES_LIBS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
+MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
+MKDIR_P = @MKDIR_P@
+OBJEXT = @OBJEXT@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+READLINE_LIBS = @READLINE_LIBS@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+systemd_path = @systemd_path@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+dist_bin_SCRIPTS = tinc-gui
+extra_DIST = README.gui
+all: all-am
+
+.SUFFIXES:
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu gui/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --gnu gui/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+install-dist_binSCRIPTS: $(dist_bin_SCRIPTS)
+	@$(NORMAL_INSTALL)
+	@list='$(dist_bin_SCRIPTS)'; test -n "$(bindir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
+	done | \
+	sed -e 'p;s,.*/,,;n' \
+	    -e 'h;s|.*|.|' \
+	    -e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
+	$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
+	  { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
+	    if ($$2 == $$4) { files[d] = files[d] " " $$1; \
+	      if (++n[d] == $(am__install_max)) { \
+		print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
+	    else { print "f", d "/" $$4, $$1 } } \
+	  END { for (d in files) print "f", d, files[d] }' | \
+	while read type dir files; do \
+	     if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
+	     test -z "$$files" || { \
+	       echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(bindir)$$dir'"; \
+	       $(INSTALL_SCRIPT) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \
+	     } \
+	; done
+
+uninstall-dist_binSCRIPTS:
+	@$(NORMAL_UNINSTALL)
+	@list='$(dist_bin_SCRIPTS)'; test -n "$(bindir)" || exit 0; \
+	files=`for p in $$list; do echo "$$p"; done | \
+	       sed -e 's,.*/,,;$(transform)'`; \
+	dir='$(DESTDIR)$(bindir)'; $(am__uninstall_files_from_dir)
+
+installcheck-dist_binSCRIPTS: $(dist_bin_SCRIPTS)
+	bad=0; pid=$$$$; list="$(dist_bin_SCRIPTS)"; for p in $$list; do \
+	  case ' $(AM_INSTALLCHECK_STD_OPTIONS_EXEMPT) ' in \
+	   *" $$p "* | *" $(srcdir)/$$p "*) continue;; \
+	  esac; \
+	  f=`echo "$$p" | sed 's,^.*/,,;$(transform)'`; \
+	  for opt in --help --version; do \
+	    if "$(DESTDIR)$(bindir)/$$f" $$opt >c$${pid}_.out \
+	         2>c$${pid}_.err </dev/null \
+		 && test -n "`cat c$${pid}_.out`" \
+		 && test -z "`cat c$${pid}_.err`"; then :; \
+	    else echo "$$f does not support $$opt" 1>&2; bad=1; fi; \
+	  done; \
+	done; rm -f c$${pid}_.???; exit $$bad
+tags TAGS:
+
+ctags CTAGS:
+
+cscope cscopelist:
+
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(SCRIPTS)
+installdirs:
+	for dir in "$(DESTDIR)$(bindir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic mostlyclean-am
+
+distclean: distclean-am
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am: install-dist_binSCRIPTS
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am: installcheck-dist_binSCRIPTS
+
+maintainer-clean: maintainer-clean-am
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-generic
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-dist_binSCRIPTS
+
+.MAKE: install-am install-strip
+
+.PHONY: all all-am check check-am clean clean-generic cscopelist-am \
+	ctags-am distclean distclean-generic distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dist_binSCRIPTS install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am install-man \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-strip installcheck installcheck-am \
+	installcheck-dist_binSCRIPTS installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
+	pdf-am ps ps-am tags-am uninstall uninstall-am \
+	uninstall-dist_binSCRIPTS
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

gui/tinc-gui

@@ -0,0 +1,634 @@
+#!/usr/bin/env python2
+
+# tinc-gui -- GUI for controlling a running tincd
+# Copyright (C) 2009-2014 Guus Sliepen <guus@tinc-vpn.org>
+#                    2014 Dennis Joachimsthaler <dennis@efjot.de>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import string
+import socket
+import os
+import platform
+import time
+from argparse import ArgumentParser
+
+import wx
+from wx.lib.mixins.listctrl import ColumnSorterMixin
+from wx.lib.mixins.listctrl import ListCtrlAutoWidthMixin
+
+if platform.system() == 'Windows':
+    import _winreg
+
+# Classes to interface with a running tinc daemon
+REQ_STOP = 0
+REQ_RELOAD = 1
+REQ_RESTART = 2
+REQ_DUMP_NODES = 3
+REQ_DUMP_EDGES = 4
+REQ_DUMP_SUBNETS = 5
+REQ_DUMP_CONNECTIONS = 6
+REQ_DUMP_GRAPH = 7
+REQ_PURGE = 8
+REQ_SET_DEBUG = 9
+REQ_RETRY = 10
+REQ_CONNECT = 11
+REQ_DISCONNECT = 12
+
+ID = 0
+ACK = 4
+CONTROL = 18
+
+
+class Node(object):
+    def __init__(self, args):
+        self.name = args[0]
+        self.id = args[1]
+
+        self.address = args[2]
+        self.port = args[4]
+
+        self.cipher = int(args[5])
+        self.digest = int(args[6])
+        self.maclength = int(args[7])
+
+        self.compression = int(args[8])
+        self.options = int(args[9], 0x10)
+        self.status = int(args[10], 0x10)
+
+        self.nexthop = args[11]
+        self.via = args[12]
+        self.distance = int(args[13])
+        self.pmtu = int(args[14])
+        self.minmtu = int(args[15])
+        self.maxmtu = int(args[16])
+
+        self.last_state_change = float(args[17])
+
+        self.subnets = {}
+
+
+class Edge(object):
+    def __init__(self, args):
+        self.source = args[0]
+        self.sink = args[1]
+
+        self.address = args[2]
+        self.port = args[4]
+
+        self.options = int(args[-2], 16)
+        self.weight = int(args[-1])
+
+
+class Subnet(object):
+    def __init__(self, args):
+        if args[0].find('#') >= 0:
+            address, self.weight = args[0].split('#', 1)
+        else:
+            self.weight = 10
+            address = args[0]
+
+        if address.find('/') >= 0:
+            self.address, self.prefixlen = address.split('/', 1)
+        else:
+            self.address = address
+            self.prefixlen = '48'
+
+        self.owner = args[1]
+
+
+class Connection(object):
+    def __init__(self, args):
+        self.name = args[0]
+
+        self.address = args[1]
+        self.port = args[3]
+
+        self.options = int(args[4], 0x10)
+        self.socket = int(args[5])
+        self.status = int(args[6], 0x10)
+
+        self.weight = 'n/a'
+
+
+class VPN(object):
+    def __init__(self, netname=None, pidfile=None, confdir='/etc/tinc', piddir='/run'):
+        if platform.system() == 'Windows':
+            sam = _winreg.KEY_READ
+            if platform.machine().endswith('64'):
+                sam = sam | _winreg.KEY_WOW64_64KEY
+            try:
+                reg = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
+                try:
+                    key = _winreg.OpenKey(reg, "SOFTWARE\\tinc", 0, sam)
+                except WindowsError:
+                    key = _winreg.OpenKey(reg, "SOFTWARE\\Wow6432Node\\tinc", 0, sam)
+                confdir = _winreg.QueryValue(key, None)
+            except WindowsError:
+                pass
+
+        if netname:
+            self.netname = netname
+            self.confbase = os.path.join(confdir, netname)
+        else:
+            self.confbase = confdir
+
+        self.tincconf = os.path.join(self.confbase, 'tinc.conf')
+
+        if pidfile is not None:
+            self.pidfile = pidfile
+        else:
+            if platform.system() == 'Windows':
+                self.pidfile = os.path.join(self.confbase, 'pid')
+            else:
+                if netname:
+                    self.pidfile = os.path.join(piddir, 'tinc.' + netname + '.pid')
+                else:
+                    self.pidfile = os.path.join(piddir, 'tinc.pid')
+
+        self.sf = None
+        self.name = None
+        self.port = None
+        self.nodes = {}
+        self.edges = {}
+        self.subnets = {}
+        self.connections = {}
+
+    def connect(self):
+        # read the pidfile
+        f = open(self.pidfile)
+        info = string.split(f.readline())
+        f.close()
+
+        # check if there is a UNIX socket as well
+        if self.pidfile.endswith('.pid'):
+            unixfile = self.pidfile.replace('.pid', '.socket');
+        else:
+            unixfile = self.pidfile + '.socket';
+
+        if os.path.exists(unixfile):
+            # use it if it exists
+            print(unixfile + " exists!");
+            s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+            s.connect(unixfile)
+        else:
+            # otherwise connect via TCP
+            print(unixfile + " does not exist.");
+            if ':' in info[2]:
+                af = socket.AF_INET6
+            else:
+                af = socket.AF_INET
+            s = socket.socket(af, socket.SOCK_STREAM)
+            s.connect((info[2], int(info[4])))
+
+        self.sf = s.makefile()
+        s.close()
+        hello = string.split(self.sf.readline())
+        self.name = hello[1]
+        self.sf.write('0 ^' + info[1] + ' 17\r\n')
+        self.sf.flush()
+        resp = string.split(self.sf.readline())
+        self.port = info[4]
+        self.refresh()
+
+    def refresh(self):
+        for request in (REQ_DUMP_NODES, REQ_DUMP_EDGES, REQ_DUMP_SUBNETS, REQ_DUMP_CONNECTIONS):
+            self.sf.write('{} {}\r\n'.format(CONTROL, request))
+        self.sf.flush()
+
+        for node in self.nodes.values():
+            node.visited = False
+        for edge in self.edges.values():
+            edge.visited = False
+        for subnet in self.subnets.values():
+            subnet.visited = False
+        for connections in self.connections.values():
+            connections.visited = False
+
+        while True:
+            resp = string.split(self.sf.readline())
+            if len(resp) < 2:
+                break
+            if resp[0] != '18':
+                break
+            if resp[1] == '3':
+                if len(resp) < 19:
+                    continue
+                node = self.nodes.get(resp[2]) or Node(resp[2:])
+                node.visited = True
+                self.nodes[resp[2]] = node
+            elif resp[1] == '4':
+                if len(resp) < 9:
+                    continue
+                edge = self.nodes.get((resp[2], resp[3])) or Edge(resp[2:])
+                edge.visited = True
+                self.edges[(resp[2], resp[3])] = edge
+            elif resp[1] == '5':
+                if len(resp) < 4:
+                    continue
+                subnet = self.subnets.get((resp[2], resp[3])) or Subnet(resp[2:])
+                subnet.visited = True
+                self.subnets[(resp[2], resp[3])] = subnet
+                if subnet.owner == "(broadcast)":
+                    continue
+                self.nodes[subnet.owner].subnets[resp[2]] = subnet
+            elif resp[1] == '6':
+                if len(resp) < 9:
+                    break
+                connection = self.connections.get((resp[2], resp[3], resp[5])) or Connection(resp[2:])
+                connection.visited = True
+                self.connections[(resp[2], resp[3], resp[5])] = connection
+            else:
+                break
+
+        for key, subnet in self.subnets.items():
+            if not subnet.visited:
+                del self.subnets[key]
+
+        for key, edge in self.edges.items():
+            if not edge.visited:
+                del self.edges[key]
+
+        for key, node in self.nodes.items():
+            if not node.visited:
+                del self.nodes[key]
+            else:
+                for key, subnet in node.subnets.items():
+                    if not subnet.visited:
+                        del node.subnets[key]
+
+        for key, connection in self.connections.items():
+            if not connection.visited:
+                del self.connections[key]
+
+    def close(self):
+        self.sf.close()
+
+    def disconnect(self, name):
+        self.sf.write('18 12 ' + name + '\r\n')
+        self.sf.flush()
+        resp = string.split(self.sf.readline())
+
+    def debug(self, level=-1):
+        self.sf.write('18 9 ' + str(level) + '\r\n')
+        self.sf.flush()
+        resp = string.split(self.sf.readline())
+        return int(resp[2])
+
+
+class SuperListCtrl(wx.ListCtrl, ColumnSorterMixin, ListCtrlAutoWidthMixin):
+    def __init__(self, parent, style):
+        wx.ListCtrl.__init__(self, parent, -1, style=wx.LC_REPORT | wx.LC_HRULES | wx.LC_VRULES)
+        ListCtrlAutoWidthMixin.__init__(self)
+        ColumnSorterMixin.__init__(self, 16)
+
+    def GetListCtrl(self):
+        return self
+
+
+class SettingsPage(wx.Panel):
+    def on_debug_level(self, event):
+        vpn.debug(self.debug.GetValue())
+
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+        grid = wx.FlexGridSizer(cols=2)
+        grid.AddGrowableCol(1, 1)
+
+        namelabel = wx.StaticText(self, -1, 'Name:')
+        self.name = wx.TextCtrl(self, -1, vpn.name)
+        grid.Add(namelabel)
+        grid.Add(self.name, 1, wx.EXPAND)
+
+        portlabel = wx.StaticText(self, -1, 'Port:')
+        self.port = wx.TextCtrl(self, -1, vpn.port)
+        grid.Add(portlabel)
+        grid.Add(self.port)
+
+        debuglabel = wx.StaticText(self, -1, 'Debug level:')
+        self.debug = wx.SpinCtrl(self, min=0, max=5, initial=vpn.debug())
+        self.debug.Bind(wx.EVT_SPINCTRL, self.on_debug_level)
+        grid.Add(debuglabel)
+        grid.Add(self.debug)
+
+        modelabel = wx.StaticText(self, -1, 'Mode:')
+        self.mode = wx.ComboBox(self, -1, style=wx.CB_READONLY, value='Router', choices=['Router', 'Switch', 'Hub'])
+        grid.Add(modelabel)
+        grid.Add(self.mode)
+
+        self.SetSizer(grid)
+
+
+class ConnectionsPage(wx.Panel):
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+        self.list = SuperListCtrl(self, id)
+        self.list.InsertColumn(0, 'Name')
+        self.list.InsertColumn(1, 'Address')
+        self.list.InsertColumn(2, 'Port')
+        self.list.InsertColumn(3, 'Options')
+        self.list.InsertColumn(4, 'Weight')
+
+        hbox = wx.BoxSizer(wx.HORIZONTAL)
+        hbox.Add(self.list, 1, wx.EXPAND)
+        self.SetSizer(hbox)
+        self.refresh()
+
+    class ContextMenu(wx.Menu):
+        def __init__(self, item):
+            wx.Menu.__init__(self)
+
+            self.item = item
+
+            disconnect = wx.MenuItem(self, -1, 'Disconnect')
+            self.AppendItem(disconnect)
+            self.Bind(wx.EVT_MENU, self.on_disconnect, id=disconnect.GetId())
+
+        def on_disconnect(self, event):
+            vpn.disconnect(self.item[0])
+
+    def on_context(self, event):
+        idx = event.GetIndex()
+        self.PopupMenu(self.ContextMenu(self.list.itemDataMap[event.GetIndex()]), event.GetPosition())
+
+    def refresh(self):
+        sortstate = self.list.GetSortState()
+        self.list.itemDataMap = {}
+        i = 0
+
+        for key, connection in vpn.connections.items():
+            if self.list.GetItemCount() <= i:
+                self.list.InsertStringItem(i, connection.name)
+            else:
+                self.list.SetStringItem(i, 0, connection.name)
+            self.list.SetStringItem(i, 1, connection.address)
+            self.list.SetStringItem(i, 2, connection.port)
+            self.list.SetStringItem(i, 3, str(connection.options))
+            self.list.SetStringItem(i, 4, str(connection.weight))
+            self.list.itemDataMap[i] = (connection.name, connection.address, connection.port, connection.options,
+                                        connection.weight)
+            self.list.Bind(wx.EVT_LIST_ITEM_RIGHT_CLICK, self.on_context)
+            self.list.SetItemData(i, i)
+            i += 1
+
+        while self.list.GetItemCount() > i:
+            self.list.DeleteItem(self.list.GetItemCount() - 1)
+
+        self.list.SortListItems(sortstate[0], sortstate[1])
+
+
+class NodesPage(wx.Panel):
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+        self.list = SuperListCtrl(self, id)
+        self.list.InsertColumn(0, 'Name')
+        self.list.InsertColumn(1, 'Address')
+        self.list.InsertColumn(2, 'Port')
+        self.list.InsertColumn(3, 'Cipher')
+        self.list.InsertColumn(4, 'Digest')
+        self.list.InsertColumn(5, 'MACLength')
+        self.list.InsertColumn(6, 'Compression')
+        self.list.InsertColumn(7, 'Options')
+        self.list.InsertColumn(8, 'Status')
+        self.list.InsertColumn(9, 'Nexthop')
+        self.list.InsertColumn(10, 'Via')
+        self.list.InsertColumn(11, 'Distance')
+        self.list.InsertColumn(12, 'PMTU')
+        self.list.InsertColumn(13, 'Min MTU')
+        self.list.InsertColumn(14, 'Max MTU')
+        self.list.InsertColumn(15, 'Since')
+
+        hbox = wx.BoxSizer(wx.HORIZONTAL)
+        hbox.Add(self.list, 1, wx.EXPAND)
+        self.SetSizer(hbox)
+        self.refresh()
+
+    def refresh(self):
+        sortstate = self.list.GetSortState()
+        self.list.itemDataMap = {}
+        i = 0
+
+        for key, node in vpn.nodes.items():
+            if self.list.GetItemCount() <= i:
+                self.list.InsertStringItem(i, node.name)
+            else:
+                self.list.SetStringItem(i, 0, node.name)
+            self.list.SetStringItem(i, 1, node.address)
+            self.list.SetStringItem(i, 2, node.port)
+            self.list.SetStringItem(i, 3, str(node.cipher))
+            self.list.SetStringItem(i, 4, str(node.digest))
+            self.list.SetStringItem(i, 5, str(node.maclength))
+            self.list.SetStringItem(i, 6, str(node.compression))
+            self.list.SetStringItem(i, 7, format(node.options, "x"))
+            self.list.SetStringItem(i, 8, format(node.status, "04x"))
+            self.list.SetStringItem(i, 9, node.nexthop)
+            self.list.SetStringItem(i, 10, node.via)
+            self.list.SetStringItem(i, 11, str(node.distance))
+            self.list.SetStringItem(i, 12, str(node.pmtu))
+            self.list.SetStringItem(i, 13, str(node.minmtu))
+            self.list.SetStringItem(i, 14, str(node.maxmtu))
+            if node.last_state_change:
+                since = time.strftime("%Y-%m-%d %H:%M", time.localtime(node.last_state_change))
+            else:
+                since = "never"
+            self.list.SetStringItem(i, 15, since)
+            self.list.itemDataMap[i] = (node.name, node.address, node.port, node.cipher, node.digest, node.maclength,
+                                        node.compression, node.options, node.status, node.nexthop, node.via,
+                                        node.distance, node.pmtu, node.minmtu, node.maxmtu, since)
+            self.list.SetItemData(i, i)
+            i += 1
+
+        while self.list.GetItemCount() > i:
+            self.list.DeleteItem(self.list.GetItemCount() - 1)
+
+        self.list.SortListItems(sortstate[0], sortstate[1])
+
+
+class EdgesPage(wx.Panel):
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+        self.list = SuperListCtrl(self, id)
+        self.list.InsertColumn(0, 'From')
+        self.list.InsertColumn(1, 'To')
+        self.list.InsertColumn(2, 'Address')
+        self.list.InsertColumn(3, 'Port')
+        self.list.InsertColumn(4, 'Options')
+        self.list.InsertColumn(5, 'Weight')
+
+        hbox = wx.BoxSizer(wx.HORIZONTAL)
+        hbox.Add(self.list, 1, wx.EXPAND)
+        self.SetSizer(hbox)
+        self.refresh()
+
+    def refresh(self):
+        sortstate = self.list.GetSortState()
+        self.list.itemDataMap = {}
+        i = 0
+
+        for key, edge in vpn.edges.items():
+            if self.list.GetItemCount() <= i:
+                self.list.InsertStringItem(i, edge.source)
+            else:
+                self.list.SetStringItem(i, 0, edge.source)
+            self.list.SetStringItem(i, 1, edge.sink)
+            self.list.SetStringItem(i, 2, edge.address)
+            self.list.SetStringItem(i, 3, edge.port)
+            self.list.SetStringItem(i, 4, format(edge.options, "x"))
+            self.list.SetStringItem(i, 5, str(edge.weight))
+            self.list.itemDataMap[i] = (edge.source, edge.sink, edge.address, edge.port, edge.options, edge.weight)
+            self.list.SetItemData(i, i)
+            i += 1
+
+        while self.list.GetItemCount() > i:
+            self.list.DeleteItem(self.list.GetItemCount() - 1)
+
+        self.list.SortListItems(sortstate[0], sortstate[1])
+
+
+class SubnetsPage(wx.Panel):
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+        self.list = SuperListCtrl(self, id)
+        self.list.InsertColumn(0, 'Subnet', wx.LIST_FORMAT_RIGHT)
+        self.list.InsertColumn(1, 'Weight', wx.LIST_FORMAT_RIGHT)
+        self.list.InsertColumn(2, 'Owner')
+        hbox = wx.BoxSizer(wx.HORIZONTAL)
+        hbox.Add(self.list, 1, wx.EXPAND)
+        self.SetSizer(hbox)
+        self.refresh()
+
+    def refresh(self):
+        sortstate = self.list.GetSortState()
+        self.list.itemDataMap = {}
+        i = 0
+
+        for key, subnet in vpn.subnets.items():
+            if self.list.GetItemCount() <= i:
+                self.list.InsertStringItem(i, subnet.address + '/' + subnet.prefixlen)
+            else:
+                self.list.SetStringItem(i, 0, subnet.address + '/' + subnet.prefixlen)
+            self.list.SetStringItem(i, 1, str(subnet.weight))
+            self.list.SetStringItem(i, 2, subnet.owner)
+            self.list.itemDataMap[i] = (subnet.address + '/' + subnet.prefixlen, subnet.weight, subnet.owner)
+            self.list.SetItemData(i, i)
+            i += 1
+
+        while self.list.GetItemCount() > i:
+            self.list.DeleteItem(self.list.GetItemCount() - 1)
+
+        self.list.SortListItems(sortstate[0], sortstate[1])
+
+
+class StatusPage(wx.Panel):
+    def __init__(self, parent, id):
+        wx.Panel.__init__(self, parent, id)
+
+
+class GraphPage(wx.Window):
+    def __init__(self, parent, id):
+        wx.Window.__init__(self, parent, id)
+
+
+class NetPage(wx.Notebook):
+    def __init__(self, parent, id):
+        wx.Notebook.__init__(self, parent)
+        self.settings = SettingsPage(self, id)
+        self.connections = ConnectionsPage(self, id)
+        self.nodes = NodesPage(self, id)
+        self.edges = EdgesPage(self, id)
+        self.subnets = SubnetsPage(self, id)
+        self.graph = GraphPage(self, id)
+        self.status = StatusPage(self, id)
+
+        self.AddPage(self.settings, 'Settings')
+        # self.AddPage(self.status, 'Status')
+        self.AddPage(self.connections, 'Connections')
+        self.AddPage(self.nodes, 'Nodes')
+        self.AddPage(self.edges, 'Edges')
+        self.AddPage(self.subnets, 'Subnets')
+
+        # self.AddPage(self.graph, 'Graph')
+
+
+class MainWindow(wx.Frame):
+    def __init__(self, parent, id, title):
+        wx.Frame.__init__(self, parent, id, title)
+
+        menubar = wx.MenuBar()
+
+        menu = wx.Menu()
+        menu.Append(1, '&Quit\tCtrl-X', 'Quit tinc GUI')
+        menubar.Append(menu, '&File')
+
+        # nb = wx.Notebook(self, -1)
+        # nb.SetPadding((0, 0))
+        self.np = NetPage(self, -1)
+        # nb.AddPage(np, 'VPN')
+
+        self.timer = wx.Timer(self, -1)
+        self.Bind(wx.EVT_TIMER, self.on_timer, self.timer)
+        self.timer.Start(1000)
+        self.Bind(wx.EVT_MENU, self.on_quit, id=1)
+        self.SetMenuBar(menubar)
+        self.Show()
+
+    def on_quit(self, event):
+        app.ExitMainLoop()
+
+    def on_timer(self, event):
+        vpn.refresh()
+        self.np.nodes.refresh()
+        self.np.subnets.refresh()
+        self.np.edges.refresh()
+        self.np.connections.refresh()
+
+
+def main(netname, pidfile):
+    global vpn, app
+
+    if netname is None:
+        netname = os.getenv('NETNAME')
+
+    vpn = VPN(netname, pidfile)
+    vpn.connect()
+
+    app = wx.App()
+    mw = MainWindow(None, -1, 'Tinc GUI')
+
+    """
+    def OnTaskBarIcon(event):
+        mw.Raise()
+    """
+
+    """
+    icon = wx.Icon("tincgui.ico", wx.BITMAP_TYPE_PNG)
+    taskbaricon = wx.TaskBarIcon()
+    taskbaricon.SetIcon(icon, 'Tinc GUI')
+    wx.EVT_TASKBAR_RIGHT_UP(taskbaricon, OnTaskBarIcon)
+    """
+
+    app.MainLoop()
+    vpn.close()
+
+
+if __name__ == '__main__':
+    argparser = ArgumentParser(epilog='Report bugs to tinc@tinc-vpn.org.')
+
+    argparser.add_argument('-n', '--net', metavar='NETNAME', dest='netname', help='Connect to net NETNAME')
+    argparser.add_argument('-p', '--pidfile', help='Path to the pid file (containing the controlcookie)')
+
+    options = argparser.parse_args()
+
+    main(options.netname, options.pidfile)

install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2018-03-11.20; # UTC
+scriptversion=2014-09-12.12; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -271,18 +271,15 @@ do
     fi
     dst=$dst_arg
 
-    # If destination is a directory, append the input filename.
+    # If destination is a directory, append the input filename; won't work
+    # if double slashes aren't ignored.
     if test -d "$dst"; then
       if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
       dstdir=$dst
-      dstbase=`basename "$src"`
-      case $dst in
-	*/) dst=$dst$dstbase;;
-	*)  dst=$dst/$dstbase;;
-      esac
+      dst=$dstdir/`basename "$src"`
       dstdir_status=0
     else
       dstdir=`dirname "$dst"`
@@ -291,11 +288,6 @@ do
     fi
   fi
 
-  case $dstdir in
-    */) dstdirslash=$dstdir;;
-    *)  dstdirslash=$dstdir/;;
-  esac
-
   obsolete_mkdir_used=false
 
   if test $dstdir_status != 0; then
@@ -332,16 +324,14 @@ do
             # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
             ;;
           *)
-            # Note that $RANDOM variable is not portable (e.g. dash);  Use it
-            # here however when possible just to lower collision chance.
+            # $RANDOM is not portable (e.g. dash);  use it when possible to
+            # lower collision chance
             tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-
             trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-            # Because "mkdir -p" follows existing symlinks and we likely work
-            # directly in world-writeable /tmp, make sure that the '$tmpdir'
-            # directory is successfully created first before we actually test
-            # 'mkdir -p' feature.
+            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
+            # create the $tmpdir first (and fail if unsuccessful) to make sure
+            # that nobody tries to guess the $tmpdir name.
             if (umask $mkdir_umask &&
                 $mkdirprog $mkdir_mode "$tmpdir" &&
                 exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
@@ -444,25 +434,14 @@ do
   else
 
     # Make a couple of temp file names in the proper directory.
-    dsttmp=${dstdirslash}_inst.$$_
-    rmtmp=${dstdirslash}_rm.$$_
+    dsttmp=$dstdir/_inst.$$_
+    rmtmp=$dstdir/_rm.$$_
 
     # Trap to clean up those temp files at exit.
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
 
     # Copy the file name to the temp name.
-    (umask $cp_umask &&
-     { test -z "$stripcmd" || {
-	 # Create $dsttmp read-write so that cp doesn't create it read-only,
-	 # which would cause strip to fail.
-	 if test -z "$doit"; then
-	   : >"$dsttmp" # No need to fork-exec 'touch'.
-	 else
-	   $doit touch "$dsttmp"
-	 fi
-       }
-     } &&
-     $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
 
     # and set any options; do chmod last to preserve setuid bits.
     #
@@ -521,9 +500,9 @@ do
 done
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:

m4/ax_append_flag.m4

@@ -49,21 +49,23 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 2
+#serial 6
 
 AC_DEFUN([AX_APPEND_FLAG],
-[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
-AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])dnl
-AS_VAR_SET_IF(FLAGS,
-  [case " AS_VAR_GET(FLAGS) " in
-    *" $1 "*)
-      AC_RUN_LOG([: FLAGS already contains $1])
-      ;;
-    *)
-      AC_RUN_LOG([: FLAGS="$FLAGS $1"])
-      AS_VAR_SET(FLAGS, ["AS_VAR_GET(FLAGS) $1"])
-      ;;
-   esac],
-  [AS_VAR_SET(FLAGS,["$1"])])
+[dnl
+AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_SET_IF
+AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])
+AS_VAR_SET_IF(FLAGS,[
+  AS_CASE([" AS_VAR_GET(FLAGS) "],
+    [*" $1 "*], [AC_RUN_LOG([: FLAGS already contains $1])],
+    [
+     AS_VAR_APPEND(FLAGS,[" $1"])
+     AC_RUN_LOG([: FLAGS="$FLAGS"])
+    ])
+  ],
+  [
+  AS_VAR_SET(FLAGS,[$1])
+  AC_RUN_LOG([: FLAGS="$FLAGS"])
+  ])
 AS_VAR_POPDEF([FLAGS])dnl
 ])dnl AX_APPEND_FLAG

m4/curses.m4

@@ -0,0 +1,44 @@
+dnl Check to find the curses headers/libraries
+
+AC_DEFUN([tinc_CURSES],
+[
+  AC_ARG_ENABLE([curses],
+    AS_HELP_STRING([--disable-curses], [disable curses support]))
+  AS_IF([test "x$enable_curses" != "xno"], [
+  AC_DEFINE(HAVE_CURSES, 1, [have curses support])
+    curses=true
+    AC_ARG_WITH(curses,
+      AS_HELP_STRING([--with-curses=DIR], [curses base directory, or:]),
+      [curses="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval/include"
+       LDFLAGS="$LDFLAGS -L$withval/lib"]
+    )
+
+    AC_ARG_WITH(curses-include,
+      AS_HELP_STRING([--with-curses-include=DIR], [curses headers directory]),
+      [curses_include="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval"]
+    )
+
+    AC_ARG_WITH(curses-lib,
+      AS_HELP_STRING([--with-curses-lib=DIR], [curses library directory]),
+      [curses_lib="$withval"
+       LDFLAGS="$LDFLAGS -L$withval"]
+    )
+
+    AC_CHECK_HEADERS(curses.h,
+      [],
+      [AC_MSG_ERROR("curses header files not found."); break]
+    )
+
+    AC_CHECK_LIB(ncurses, initscr,
+      [CURSES_LIBS="-lncurses"],
+      [AC_CHECK_LIB(curses, initscr,
+        [CURSES_LIBS="-lcurses"],
+        [AC_MSG_ERROR("curses libraries not found.")]
+      )]
+    )
+  ])
+
+  AC_SUBST(CURSES_LIBS)
+])

m4/libgcrypt.m4

@@ -0,0 +1,33 @@
+dnl Check to find the libgcrypt headers/libraries
+
+AC_DEFUN([tinc_LIBGCRYPT],
+[
+  AC_ARG_WITH(libgcrypt,
+    AS_HELP_STRING([--with-libgcrypt=DIR], [libgcrypt base directory, or:]),
+    [libgcrypt="$withval"
+     CPPFLAGS="$CPPFLAGS -I$withval/include"
+     LDFLAGS="$LDFLAGS -L$withval/lib"]
+  )
+
+  AC_ARG_WITH(libgcrypt-include,
+    AS_HELP_STRING([--with-libgcrypt-include=DIR], [libgcrypt headers directory (without trailing /libgcrypt)]),
+    [libgcrypt_include="$withval"
+     CPPFLAGS="$CPPFLAGS -I$withval"]
+  )
+
+  AC_ARG_WITH(libgcrypt-lib,
+    AS_HELP_STRING([--with-libgcrypt-lib=DIR], [libgcrypt library directory]),
+    [libgcrypt_lib="$withval"
+     LDFLAGS="$LDFLAGS -L$withval"]
+  )
+
+  AC_CHECK_HEADERS([gcrypt.h],
+    [],
+    [AC_MSG_ERROR([libgcrypt header files not found.]); break]
+  )
+
+  AC_CHECK_LIB(gcrypt, gcry_cipher_encrypt,
+    [LIBS="-lgcrypt $LIBS"],
+    [AC_MSG_ERROR([libgcrypt libraries not found.])]
+  )
+])

m4/miniupnpc.m4

@@ -0,0 +1,40 @@
+dnl Check to find the miniupnpc headers/libraries
+
+AC_DEFUN([tinc_MINIUPNPC],
+[
+  AC_ARG_ENABLE([miniupnpc],
+    AS_HELP_STRING([--enable-miniupnpc], [enable miniupnpc support]))
+  AS_IF([test "x$enable_miniupnpc" = "xyes"], [
+  AC_DEFINE(HAVE_MINIUPNPC, 1, [have miniupnpc support])
+    AC_ARG_WITH(miniupnpc,
+      AS_HELP_STRING([--with-miniupnpc=DIR], [miniupnpc base directory, or:]),
+      [miniupnpc="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval/include"
+       LDFLAGS="$LDFLAGS -L$withval/lib"]
+    )
+
+    AC_ARG_WITH(miniupnpc-include,
+      AS_HELP_STRING([--with-miniupnpc-include=DIR], [miniupnpc headers directory]),
+      [miniupnpc_include="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval"]
+    )
+
+    AC_ARG_WITH(miniupnpc-lib,
+      AS_HELP_STRING([--with-miniupnpc-lib=DIR], [miniupnpc library directory]),
+      [miniupnpc_lib="$withval"
+       LDFLAGS="$LDFLAGS -L$withval"]
+    )
+
+    AC_CHECK_HEADERS(miniupnpc/miniupnpc.h,
+      [],
+      [AC_MSG_ERROR("miniupnpc header files not found."); break]
+    )
+
+    AC_CHECK_LIB(miniupnpc, upnpDiscover,
+      [MINIUPNPC_LIBS="$LIBS -lminiupnpc"],
+      [AC_MSG_ERROR("miniupnpc libraries not found.")]
+    )
+  ])
+
+  AC_SUBST(MINIUPNPC_LIBS)
+])

m4/openssl.m4

@@ -35,7 +35,7 @@ AC_DEFUN([tinc_OPENSSL],
      LDFLAGS="$LDFLAGS -L$withval"]
   )
 
-  AC_CHECK_HEADERS(openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h,
+  AC_CHECK_HEADERS([openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h],
     [],
     [AC_MSG_ERROR([LibreSSL/OpenSSL header files not found.]); break]
   )
@@ -49,10 +49,10 @@ AC_DEFUN([tinc_OPENSSL],
     [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
   )
 
-  AC_CHECK_DECLS([OpenSSL_add_all_algorithms, EVP_aes_256_cfb], ,
+  AC_CHECK_DECLS([OpenSSL_add_all_algorithms EVP_aes_256_cfb], ,
     [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
     [#include <openssl/evp.h>]
   )
 
-  AC_CHECK_FUNCS([BN_GENCB_new RSA_set0_key], , , [#include <openssl/rsa.h>])
+  AC_CHECK_FUNCS([BN_GENCB_new ERR_remove_state RSA_set0_key], , , [#include <openssl/rsa.h>])
 ])

m4/readline.m4

@@ -0,0 +1,42 @@
+dnl Check to find the readline headers/libraries
+
+AC_DEFUN([tinc_READLINE],
+[
+  AC_ARG_ENABLE([readline],
+    AS_HELP_STRING([--disable-readline], [disable readline support]))
+  AS_IF([test "x$enable_readline" != "xno"], [
+  AC_DEFINE(HAVE_READLINE, 1, [have readline support])
+    readline=true
+    AC_ARG_WITH(readline,
+      AS_HELP_STRING([--with-readline=DIR], [readline base directory, or:]),
+      [readline="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval/include"
+       LDFLAGS="$LDFLAGS -L$withval/lib"]
+    )
+
+    AC_ARG_WITH(readline-include,
+      AS_HELP_STRING([--with-readline-include=DIR], [readline headers directory]),
+      [readline_include="$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval"]
+    )
+
+    AC_ARG_WITH(readline-lib,
+      AS_HELP_STRING([--with-readline-lib=DIR], [readline library directory]),
+      [readline_lib="$withval"
+       LDFLAGS="$LDFLAGS -L$withval"]
+    )
+
+    AC_CHECK_HEADERS([readline/readline.h readline/history.h],
+      [],
+      [AC_MSG_ERROR("readline header files not found."); break]
+    )
+
+    AC_CHECK_LIB(readline, readline,
+      [READLINE_LIBS="-lreadline"],
+      [AC_MSG_ERROR("readline library not found.")],
+      [$CURSES_LIBS]
+    )
+  ])
+
+  AC_SUBST(READLINE_LIBS)
+])

missing

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Common wrapper for a few potentially missing GNU programs.
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2013-10-28.13; # UTC
 
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@ scriptversion=2018-03-07.03; # UTC
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -101,9 +101,9 @@ else
   exit $st
 fi
 
-perl_URL=https://www.perl.org/
-flex_URL=https://github.com/westes/flex
-gnu_software_URL=https://www.gnu.org/software
+perl_URL=http://www.perl.org/
+flex_URL=http://flex.sourceforge.net/
+gnu_software_URL=http://www.gnu.org/software
 
 program_details ()
 {
@@ -207,9 +207,9 @@ give_advice "$1" | sed -e '1s/^/WARNING: /' \
 exit $st
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:

src/Makefile.am

@@ -1,54 +1,173 @@
 ## Produce this file with automake to get Makefile.in
 
-sbin_PROGRAMS = tincd
+sbin_PROGRAMS = tincd tinc
+check_PROGRAMS = sptps_test sptps_keypair
+EXTRA_PROGRAMS = sptps_test sptps_keypair
+
+CLEANFILES = version_git.h
+
+.PHONY: version-stamp
+version-stamp:
+
+version_git.h: version-stamp
+	$(AM_V_GEN)echo >$@
+	@-(cd $(srcdir) && git describe 2>/dev/null >/dev/null) && echo '#define GIT_DESCRIPTION "'`(cd $(srcdir) && git describe) | sed 's/release-//'`'"' >$@ ||:
+${srcdir}/version.c: version_git.h
+
+## Now a hack to appease some versions of BSD make that don't understand that "./foo" is the same as "foo".
+if BSD
+version.c: ${srcdir}/version.c
+endif
+
+if LINUX
+EXTRA_PROGRAMS += sptps_speed
+endif
+
+ed25519_SOURCES = \
+	ed25519/ed25519.h \
+	ed25519/fe.c ed25519/fe.h \
+	ed25519/fixedint.h \
+	ed25519/ge.c ed25519/ge.h \
+	ed25519/key_exchange.c \
+	ed25519/keypair.c \
+	ed25519/precomp_data.h \
+	ed25519/sc.c ed25519/sc.h \
+	ed25519/sha512.c ed25519/sha512.h \
+	ed25519/sign.c \
+	ed25519/verify.c
+
+chacha_poly1305_SOURCES = \
+	chacha-poly1305/chacha.c chacha-poly1305/chacha.h \
+	chacha-poly1305/chacha-poly1305.c chacha-poly1305/chacha-poly1305.h \
+	chacha-poly1305/poly1305.c chacha-poly1305/poly1305.h
 
 tincd_SOURCES = \
-	have.h \
-	system.h \
-	avl_tree.c avl_tree.h \
+	autoconnect.c autoconnect.h \
+	buffer.c buffer.h \
+	cipher.h \
 	conf.c conf.h \
 	connection.c connection.h \
+	control.c control.h \
+	control_common.h \
+	crypto.h \
 	device.h \
+	digest.h \
 	dropin.c dropin.h \
 	dummy_device.c \
+	ecdh.h \
+	ecdsa.h \
+	ecdsagen.h \
 	edge.c edge.h \
 	ethernet.h \
 	event.c event.h \
-	fake-getaddrinfo.c fake-getaddrinfo.h \
-	fake-getnameinfo.c fake-getnameinfo.h \
+	fd_device.c \
 	graph.c graph.h \
+	hash.c hash.h \
+	have.h \
 	ipv4.h \
 	ipv6.h \
 	list.c list.h \
 	logger.c logger.h \
 	meta.c meta.h \
 	multicast_device.c \
+	names.c names.h \
 	net.c net.h \
 	net_packet.c \
 	net_setup.c \
 	net_socket.c \
 	netutl.c netutl.h \
 	node.c node.h \
-	pidfile.c pidfile.h \
+	prf.h \
 	process.c process.h \
 	protocol.c protocol.h \
 	protocol_auth.c \
 	protocol_edge.c \
-	protocol_misc.c \
 	protocol_key.c \
+	protocol_misc.c \
 	protocol_subnet.c \
-	proxy.c proxy.h \
 	raw_socket_device.c \
 	route.c route.h \
+	rsa.h \
+	rsagen.h \
+	script.c script.h \
+	splay_tree.c splay_tree.h \
+	sptps.c sptps.h \
 	subnet.c subnet.h \
+	subnet_parse.c \
+	system.h \
 	tincd.c \
 	utils.c utils.h \
-	xalloc.h
+	xalloc.h \
+	version.c version.h \
+	ed25519/ecdh.c \
+	ed25519/ecdsa.c \
+	$(ed25519_SOURCES) \
+	$(chacha_poly1305_SOURCES)
+
+tinc_SOURCES = \
+	dropin.c dropin.h \
+	fsck.c fsck.h \
+	ifconfig.c ifconfig.h \
+	info.c info.h \
+	invitation.c invitation.h \
+	list.c list.h \
+	names.c names.h \
+	netutl.c netutl.h \
+	script.c script.h \
+	sptps.c sptps.h \
+	subnet_parse.c subnet.h \
+	tincctl.c tincctl.h \
+	top.c top.h \
+	utils.c utils.h \
+	version.c version.h \
+	ed25519/ecdh.c \
+	ed25519/ecdsa.c \
+	ed25519/ecdsagen.c \
+	$(ed25519_SOURCES) \
+	$(chacha_poly1305_SOURCES)
+
+sptps_test_SOURCES = \
+	logger.c logger.h \
+	sptps.c sptps.h \
+	sptps_test.c \
+	utils.c utils.h \
+	ed25519/ecdh.c \
+	ed25519/ecdsa.c \
+	$(ed25519_SOURCES) \
+	$(chacha_poly1305_SOURCES)
+
+sptps_keypair_SOURCES = \
+	sptps_keypair.c \
+	utils.c utils.h \
+	ed25519/ecdsagen.c \
+	$(ed25519_SOURCES)
+
+sptps_speed_SOURCES = \
+	logger.c logger.h \
+	sptps.c sptps.h \
+	sptps_speed.c \
+	utils.c utils.h \
+	ed25519/ecdh.c \
+	ed25519/ecdsa.c \
+	ed25519/ecdsagen.c \
+	$(ed25519_SOURCES) \
+	$(chacha_poly1305_SOURCES)
+
+## Conditionally compile device drivers
 
 if !GETOPT
 tincd_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
+tinc_SOURCES += \
+	getopt.c getopt.h \
+	getopt1.c
+sptps_test_SOURCES += \
+	getopt.c getopt.h \
+	getopt1.c
+sptps_keypair_SOURCES += \
+	getopt.c getopt.h \
+	getopt1.c
 endif
 
 if LINUX
@@ -82,8 +201,87 @@ if VDE
 tincd_SOURCES += vde_device.c
 endif
 
+if OPENSSL
+tincd_SOURCES += \
+	openssl/cipher.c \
+	openssl/crypto.c \
+	openssl/digest.c openssl/digest.h \
+	openssl/prf.c \
+	openssl/rsa.c
+tinc_SOURCES += \
+	openssl/cipher.c \
+	openssl/crypto.c \
+	openssl/digest.c openssl/digest.h \
+	openssl/prf.c \
+	openssl/rsa.c \
+	openssl/rsagen.c
+sptps_test_SOURCES += \
+	openssl/crypto.c \
+	openssl/digest.c openssl/digest.h \
+	openssl/prf.c
+sptps_keypair_SOURCES += \
+	openssl/crypto.c
+sptps_speed_SOURCES += \
+	openssl/crypto.c \
+	openssl/digest.c openssl/digest.h \
+	openssl/prf.c
+else
+if GCRYPT
+tincd_SOURCES += \
+	gcrypt/cipher.c \
+	gcrypt/crypto.c \
+	gcrypt/digest.c gcrypt/digest.h \
+	gcrypt/prf.c \
+	gcrypt/rsa.c
+tinc_SOURCES += \
+	gcrypt/cipher.c \
+	gcrypt/crypto.c \
+	gcrypt/digest.c gcrypt/digest.h \
+	gcrypt/prf.c \
+	gcrypt/rsa.c \
+	gcrypt/rsagen.c
+sptps_test_SOURCES += \
+	gcrypt/cipher.c \
+	gcrypt/crypto.c \
+	gcrypt/digest.c gcrypt/digest.h \
+	gcrypt/prf.c
+sptps_keypair_SOURCES += \
+	openssl/crypto.c
+sptps_speed_SOURCES += \
+	openssl/crypto.c \
+	openssl/digest.c openssl/digest.h \
+	openssl/prf.c
+else
+tincd_SOURCES += \
+	nolegacy/crypto.c \
+	nolegacy/prf.c
+tinc_SOURCES += \
+	nolegacy/crypto.c \
+	nolegacy/prf.c
+sptps_test_SOURCES += \
+	nolegacy/crypto.c \
+	nolegacy/prf.c
+sptps_keypair_SOURCES += \
+	nolegacy/crypto.c
+sptps_speed_SOURCES += \
+	nolegacy/crypto.c \
+	nolegacy/prf.c
+endif
+endif
+
+if MINIUPNPC
+tincd_SOURCES += upnp.h upnp.c
+tincd_LDADD = $(MINIUPNPC_LIBS)
+tincd_LDFLAGS = -pthread
+endif
+
+tinc_LDADD = $(READLINE_LIBS) $(CURSES_LIBS)
+sptps_speed_LDADD = -lrt
+
+LIBS = @LIBS@ -lm
+
 if TUNEMU
 LIBS += -lpcap
 endif
 
-AM_CPPFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DRUNSTATEDIR=\"$(runstatedir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -I $(abs_top_builddir)/
+AM_CFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -DSBINDIR=\"$(sbindir)\" -iquote.

src/autoconnect.c

@@ -0,0 +1,174 @@
+/*
+    autoconnect.c -- automatic connection establishment
+    Copyright (C) 2017 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#include "system.h"
+
+#include "connection.h"
+#include "logger.h"
+#include "node.h"
+#include "xalloc.h"
+
+static void make_new_connection() {
+	/* Select a random node we haven't connected to yet. */
+	int count = 0;
+	for splay_each(node_t, n, node_tree) {
+		if(n == myself || n->connection || !(n->status.has_address || n->status.reachable))
+			continue;
+		count++;
+	}
+
+	if(!count)
+		return;
+
+	int r = rand() % count;
+
+	for splay_each(node_t, n, node_tree) {
+		if(n == myself || n->connection || !(n->status.has_address || n->status.reachable))
+			continue;
+
+		if(r--)
+			continue;
+
+		bool found = false;
+
+		for list_each(outgoing_t, outgoing, outgoing_list) {
+			if(!strcmp(outgoing->name, n->name)) {
+				found = true;
+				break;
+			}
+		}
+
+		if(!found) {
+			logger(DEBUG_CONNECTIONS, LOG_INFO, "Autoconnecting to %s", n->name);
+			outgoing_t *outgoing = xzalloc(sizeof *outgoing);
+			outgoing->name = xstrdup(n->name);
+			list_insert_tail(outgoing_list, outgoing);
+			setup_outgoing_connection(outgoing);
+		}
+
+		break;
+	}
+}
+
+static void connect_to_unreachable() {
+	/* Select a random known node. The rationale is that if there are many
+	 * reachable nodes, and only a few unreachable nodes, we don't want all
+	 * reachable nodes to try to connect to the unreachable ones at the
+	 * same time. This way, we back off automatically. Conversely, if there
+	 * are only a few reachable nodes, and many unreachable ones, we're
+	 * going to try harder to connect to them. */
+
+	int r = rand() % node_tree->count;
+
+	for splay_each(node_t, n, node_tree) {
+		if(r--)
+			continue;
+
+		/* Is it unreachable and do we know an address for it? If not, return. */
+		if(n == myself || n->connection || n->status.reachable || !n->status.has_address)
+			return;
+
+		/* Are we already trying to make an outgoing connection to it? If not, return. */
+		for list_each(outgoing_t, outgoing, outgoing_list)
+			if(!strcmp(outgoing->name, n->name))
+				return;
+
+		logger(DEBUG_CONNECTIONS, LOG_INFO, "Autoconnecting to %s", n->name);
+		outgoing_t *outgoing = xzalloc(sizeof *outgoing);
+		outgoing->name = xstrdup(n->name);
+		list_insert_tail(outgoing_list, outgoing);
+		setup_outgoing_connection(outgoing);
+
+		return;
+	}
+}
+
+static void drop_superfluous_outgoing_connection() {
+	/* Choose a random outgoing connection to a node that has at least one other connection. */
+	int count = 0;
+	for list_each(connection_t, c, connection_list) {
+		if(!c->edge || !c->outgoing || !c->node || c->node->edge_tree->count < 2)
+			continue;
+		count++;
+	}
+
+	if(!count)
+		return;
+
+	int r = rand() % count;
+
+	for list_each(connection_t, c, connection_list) {
+		if(!c->edge || !c->outgoing || !c->node || c->node->edge_tree->count < 2)
+			continue;
+		
+		if(r--)
+			continue;
+
+		logger(DEBUG_CONNECTIONS, LOG_INFO, "Autodisconnecting from %s", c->name);
+		list_delete(outgoing_list, c->outgoing);
+		c->outgoing = NULL;
+		terminate_connection(c, c->edge);
+		break;
+	}
+}
+
+static void drop_superfluous_pending_connections() {
+	for list_each(outgoing_t, o, outgoing_list) {
+		/* Only look for connections that are waiting to be retried later. */
+		bool found = false;
+		for list_each(connection_t, c, connection_list) {
+			if(c->outgoing == o) {
+				found = true;
+				break;
+			}
+		}
+
+		if(found)
+			continue;
+
+		logger(DEBUG_CONNECTIONS, LOG_INFO, "Cancelled outgoing connection to %s", o->name);
+		list_delete_node(outgoing_list, node);
+	}
+}
+
+void do_autoconnect() {
+	/* Count number of active connections. */
+	int nc = 0;
+	for list_each(connection_t, c, connection_list) {
+		if(c->edge)
+			nc++;
+	}
+
+	/* Less than 3 connections? Eagerly try to make a new one. */
+	if(nc < 3) {
+		make_new_connection();
+		return;
+	}
+	
+	/* More than 3 connections? See if we can get rid of a superfluous one. */
+	if(nc > 3)
+		drop_superfluous_outgoing_connection();
+
+
+	/* Check if there are unreachable nodes that we should try to connect to. */
+	connect_to_unreachable();
+
+	/* Drop pending outgoing connections from the outgoing list. */
+	drop_superfluous_pending_connections();
+}

src/autoconnect.h

@@ -0,0 +1,25 @@
+/*
+    autoconnect.h -- header for autoconnect.c
+    Copyright (C) 2017 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_AUTOCONNECT_H__
+#define __TINC_AUTOCONNECT_H__
+
+extern void do_autoconnect(void);
+
+#endif

src/avl_tree.c

@@ -1,757 +0,0 @@
-/*
-    avl_tree.c -- avl_ tree and linked list convenience
-    Copyright (C) 1998 Michael H. Buselli
-                  2000-2005 Ivo Timmermans,
-                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
-                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
-
-    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
-    instead of depths, to add the ->next and ->prev and to generally obfuscate
-    the code. Mail me if you found a bug.
-
-    Cleaned up and incorporated some of the ideas from the red-black tree
-    library for inclusion into tinc (https://www.tinc-vpn.org/) by
-    Guus Sliepen <guus@tinc-vpn.org>.
-*/
-
-#include "system.h"
-
-#include "avl_tree.h"
-#include "xalloc.h"
-
-#ifdef AVL_COUNT
-#define AVL_NODE_COUNT(n)  ((n) ? (n)->count : 0)
-#define AVL_L_COUNT(n)     (AVL_NODE_COUNT((n)->left))
-#define AVL_R_COUNT(n)     (AVL_NODE_COUNT((n)->right))
-#define AVL_CALC_COUNT(n)  (AVL_L_COUNT(n) + AVL_R_COUNT(n) + 1)
-#endif
-
-#ifdef AVL_DEPTH
-#define AVL_NODE_DEPTH(n)  ((n) ? (n)->depth : 0)
-#define L_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->left))
-#define R_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->right))
-#define AVL_CALC_DEPTH(n)  ((L_AVL_DEPTH(n)>R_AVL_DEPTH(n)?L_AVL_DEPTH(n):R_AVL_DEPTH(n)) + 1)
-#endif
-
-#ifndef AVL_DEPTH
-static int lg(unsigned int u) __attribute__((__const__));
-
-static int lg(unsigned int u) {
-	int r = 1;
-
-	if(!u) {
-		return 0;
-	}
-
-	if(u & 0xffff0000) {
-		u >>= 16;
-		r += 16;
-	}
-
-	if(u & 0x0000ff00) {
-		u >>= 8;
-		r += 8;
-	}
-
-	if(u & 0x000000f0) {
-		u >>= 4;
-		r += 4;
-	}
-
-	if(u & 0x0000000c) {
-		u >>= 2;
-		r += 2;
-	}
-
-	if(u & 0x00000002) {
-		r++;
-	}
-
-	return r;
-}
-#endif
-
-/* Internal helper functions */
-
-static int avl_check_balance(const avl_node_t *node) {
-#ifdef AVL_DEPTH
-	int d;
-
-	d = R_AVL_DEPTH(node) - L_AVL_DEPTH(node);
-
-	return d < -1 ? -1 : d > 1 ? 1 : 0;
-#else
-	/*      int d;
-	 *      d = lg(AVL_R_COUNT(node)) - lg(AVL_L_COUNT(node));
-	 *      d = d<-1?-1:d>1?1:0;
-	 */
-	int pl, r;
-
-	pl = lg(AVL_L_COUNT(node));
-	r = AVL_R_COUNT(node);
-
-	if(r >> pl + 1) {
-		return 1;
-	}
-
-	if(pl < 2 || r >> pl - 2) {
-		return 0;
-	}
-
-	return -1;
-#endif
-}
-
-static void avl_rebalance(avl_tree_t *tree, avl_node_t *node) {
-	avl_node_t *child;
-	avl_node_t *gchild;
-	avl_node_t *parent;
-	avl_node_t **superparent;
-
-	while(node) {
-		parent = node->parent;
-
-		superparent =
-		        parent ? node ==
-		        parent->left ? &parent->left : &parent->right : &tree->root;
-
-		switch(avl_check_balance(node)) {
-		case -1:
-			child = node->left;
-#ifdef AVL_DEPTH
-
-			if(L_AVL_DEPTH(child) >= R_AVL_DEPTH(child)) {
-#else
-
-			if(AVL_L_COUNT(child) >= AVL_R_COUNT(child)) {
-#endif
-				node->left = child->right;
-
-				if(node->left) {
-					node->left->parent = node;
-				}
-
-				child->right = node;
-				node->parent = child;
-				*superparent = child;
-				child->parent = parent;
-#ifdef AVL_COUNT
-				node->count = AVL_CALC_COUNT(node);
-				child->count = AVL_CALC_COUNT(child);
-#endif
-#ifdef AVL_DEPTH
-				node->depth = AVL_CALC_DEPTH(node);
-				child->depth = AVL_CALC_DEPTH(child);
-#endif
-			} else {
-				gchild = child->right;
-				node->left = gchild->right;
-
-				if(node->left) {
-					node->left->parent = node;
-				}
-
-				child->right = gchild->left;
-
-				if(child->right) {
-					child->right->parent = child;
-				}
-
-				gchild->right = node;
-
-				gchild->right->parent = gchild;
-				gchild->left = child;
-
-				gchild->left->parent = gchild;
-
-				*superparent = gchild;
-				gchild->parent = parent;
-#ifdef AVL_COUNT
-				node->count = AVL_CALC_COUNT(node);
-				child->count = AVL_CALC_COUNT(child);
-				gchild->count = AVL_CALC_COUNT(gchild);
-#endif
-#ifdef AVL_DEPTH
-				node->depth = AVL_CALC_DEPTH(node);
-				child->depth = AVL_CALC_DEPTH(child);
-				gchild->depth = AVL_CALC_DEPTH(gchild);
-#endif
-			}
-
-			break;
-
-		case 1:
-			child = node->right;
-#ifdef AVL_DEPTH
-
-			if(R_AVL_DEPTH(child) >= L_AVL_DEPTH(child)) {
-#else
-
-			if(AVL_R_COUNT(child) >= AVL_L_COUNT(child)) {
-#endif
-				node->right = child->left;
-
-				if(node->right) {
-					node->right->parent = node;
-				}
-
-				child->left = node;
-				node->parent = child;
-				*superparent = child;
-				child->parent = parent;
-#ifdef AVL_COUNT
-				node->count = AVL_CALC_COUNT(node);
-				child->count = AVL_CALC_COUNT(child);
-#endif
-#ifdef AVL_DEPTH
-				node->depth = AVL_CALC_DEPTH(node);
-				child->depth = AVL_CALC_DEPTH(child);
-#endif
-			} else {
-				gchild = child->left;
-				node->right = gchild->left;
-
-				if(node->right) {
-					node->right->parent = node;
-				}
-
-				child->left = gchild->right;
-
-				if(child->left) {
-					child->left->parent = child;
-				}
-
-				gchild->left = node;
-
-				gchild->left->parent = gchild;
-				gchild->right = child;
-
-				gchild->right->parent = gchild;
-
-				*superparent = gchild;
-				gchild->parent = parent;
-#ifdef AVL_COUNT
-				node->count = AVL_CALC_COUNT(node);
-				child->count = AVL_CALC_COUNT(child);
-				gchild->count = AVL_CALC_COUNT(gchild);
-#endif
-#ifdef AVL_DEPTH
-				node->depth = AVL_CALC_DEPTH(node);
-				child->depth = AVL_CALC_DEPTH(child);
-				gchild->depth = AVL_CALC_DEPTH(gchild);
-#endif
-			}
-
-			break;
-
-		default:
-#ifdef AVL_COUNT
-			node->count = AVL_CALC_COUNT(node);
-#endif
-#ifdef AVL_DEPTH
-			node->depth = AVL_CALC_DEPTH(node);
-#endif
-		}
-
-		node = parent;
-	}
-}
-
-/* (De)constructors */
-
-avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete) {
-	avl_tree_t *tree;
-
-	tree = xmalloc_and_zero(sizeof(avl_tree_t));
-	tree->compare = compare;
-	tree->delete = delete;
-
-	return tree;
-}
-
-void avl_free_tree(avl_tree_t *tree) {
-	free(tree);
-}
-
-avl_node_t *avl_alloc_node(void) {
-	return xmalloc_and_zero(sizeof(avl_node_t));
-}
-
-void avl_free_node(avl_tree_t *tree, avl_node_t *node) {
-	if(node->data && tree->delete) {
-		tree->delete(node->data);
-	}
-
-	free(node);
-}
-
-/* Searching */
-
-void *avl_search(const avl_tree_t *tree, const void *data) {
-	avl_node_t *node;
-
-	node = avl_search_node(tree, data);
-
-	return node ? node->data : NULL;
-}
-
-void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result) {
-	avl_node_t *node;
-
-	node = avl_search_closest_node(tree, data, result);
-
-	return node ? node->data : NULL;
-}
-
-void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data) {
-	avl_node_t *node;
-
-	node = avl_search_closest_smaller_node(tree, data);
-
-	return node ? node->data : NULL;
-}
-
-void *avl_search_closest_greater(const avl_tree_t *tree, const void *data) {
-	avl_node_t *node;
-
-	node = avl_search_closest_greater_node(tree, data);
-
-	return node ? node->data : NULL;
-}
-
-avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data) {
-	avl_node_t *node;
-	int result;
-
-	node = avl_search_closest_node(tree, data, &result);
-
-	return result ? NULL : node;
-}
-
-avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data,
-                                    int *result) {
-	avl_node_t *node;
-	int c;
-
-	node = tree->root;
-
-	if(!node) {
-		if(result) {
-			*result = 0;
-		}
-
-		return NULL;
-	}
-
-	for(;;) {
-		c = tree->compare(data, node->data);
-
-		if(c < 0) {
-			if(node->left) {
-				node = node->left;
-			} else {
-				if(result) {
-					*result = -1;
-				}
-
-				break;
-			}
-		} else if(c > 0) {
-			if(node->right) {
-				node = node->right;
-			} else {
-				if(result) {
-					*result = 1;
-				}
-
-				break;
-			}
-		} else {
-			if(result) {
-				*result = 0;
-			}
-
-			break;
-		}
-	}
-
-	return node;
-}
-
-avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree,
-                const void *data) {
-	avl_node_t *node;
-	int result;
-
-	node = avl_search_closest_node(tree, data, &result);
-
-	if(result < 0) {
-		node = node->prev;
-	}
-
-	return node;
-}
-
-avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree,
-                const void *data) {
-	avl_node_t *node;
-	int result;
-
-	node = avl_search_closest_node(tree, data, &result);
-
-	if(result > 0) {
-		node = node->next;
-	}
-
-	return node;
-}
-
-/* Insertion and deletion */
-
-avl_node_t *avl_insert(avl_tree_t *tree, void *data) {
-	avl_node_t *closest, *new;
-	int result;
-
-	if(!tree->root) {
-		new = avl_alloc_node();
-		new->data = data;
-		avl_insert_top(tree, new);
-	} else {
-		closest = avl_search_closest_node(tree, data, &result);
-
-		switch(result) {
-		case -1:
-			new = avl_alloc_node();
-			new->data = data;
-			avl_insert_before(tree, closest, new);
-			break;
-
-		case 1:
-			new = avl_alloc_node();
-			new->data = data;
-			avl_insert_after(tree, closest, new);
-			break;
-
-		default:
-			return NULL;
-		}
-	}
-
-#ifdef AVL_COUNT
-	new->count = 1;
-#endif
-#ifdef AVL_DEPTH
-	new->depth = 1;
-#endif
-
-	return new;
-}
-
-avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node) {
-	avl_node_t *closest;
-	int result;
-
-	if(!tree->root) {
-		avl_insert_top(tree, node);
-	} else {
-		closest = avl_search_closest_node(tree, node->data, &result);
-
-		switch(result) {
-		case -1:
-			avl_insert_before(tree, closest, node);
-			break;
-
-		case 1:
-			avl_insert_after(tree, closest, node);
-			break;
-
-		case 0:
-			return NULL;
-		}
-	}
-
-#ifdef AVL_COUNT
-	node->count = 1;
-#endif
-#ifdef AVL_DEPTH
-	node->depth = 1;
-#endif
-
-	return node;
-}
-
-void avl_insert_top(avl_tree_t *tree, avl_node_t *node) {
-	node->prev = node->next = node->parent = NULL;
-	tree->head = tree->tail = tree->root = node;
-}
-
-void avl_insert_before(avl_tree_t *tree, avl_node_t *before,
-                       avl_node_t *node) {
-	if(!before) {
-		if(tree->tail) {
-			avl_insert_after(tree, tree->tail, node);
-		} else {
-			avl_insert_top(tree, node);
-		}
-
-		return;
-	}
-
-	node->next = before;
-	node->parent = before;
-	node->prev = before->prev;
-
-	if(before->left) {
-		avl_insert_after(tree, before->prev, node);
-		return;
-	}
-
-	if(before->prev) {
-		before->prev->next = node;
-	} else {
-		tree->head = node;
-	}
-
-	before->prev = node;
-	before->left = node;
-
-	avl_rebalance(tree, before);
-}
-
-void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node) {
-	if(!after) {
-		if(tree->head) {
-			avl_insert_before(tree, tree->head, node);
-		} else {
-			avl_insert_top(tree, node);
-		}
-
-		return;
-	}
-
-	if(after->right) {
-		avl_insert_before(tree, after->next, node);
-		return;
-	}
-
-	node->prev = after;
-	node->parent = after;
-	node->next = after->next;
-
-	if(after->next) {
-		after->next->prev = node;
-	} else {
-		tree->tail = node;
-	}
-
-	after->next = node;
-	after->right = node;
-
-	avl_rebalance(tree, after);
-}
-
-avl_node_t *avl_unlink(avl_tree_t *tree, void *data) {
-	avl_node_t *node;
-
-	node = avl_search_node(tree, data);
-
-	if(node) {
-		avl_unlink_node(tree, node);
-	}
-
-	return node;
-}
-
-void avl_unlink_node(avl_tree_t *tree, avl_node_t *node) {
-	avl_node_t *parent;
-	avl_node_t **superparent;
-	avl_node_t *subst, *left, *right;
-	avl_node_t *balnode;
-
-	if(node->prev) {
-		node->prev->next = node->next;
-	} else {
-		tree->head = node->next;
-	}
-
-	if(node->next) {
-		node->next->prev = node->prev;
-	} else {
-		tree->tail = node->prev;
-	}
-
-	parent = node->parent;
-
-	superparent =
-	        parent ? node ==
-	        parent->left ? &parent->left : &parent->right : &tree->root;
-
-	left = node->left;
-	right = node->right;
-
-	if(!left) {
-		*superparent = right;
-
-		if(right) {
-			right->parent = parent;
-		}
-
-		balnode = parent;
-	} else if(!right) {
-		*superparent = left;
-		left->parent = parent;
-		balnode = parent;
-	} else {
-		subst = node->prev;
-
-		if(!subst) { // This only happens if node is not actually in a tree at all.
-			abort();
-		}
-
-		if(subst == left) {
-			balnode = subst;
-		} else {
-			balnode = subst->parent;
-			balnode->right = subst->left;
-
-			if(balnode->right) {
-				balnode->right->parent = balnode;
-			}
-
-			subst->left = left;
-			left->parent = subst;
-		}
-
-		subst->right = right;
-		subst->parent = parent;
-		right->parent = subst;
-		*superparent = subst;
-	}
-
-	avl_rebalance(tree, balnode);
-
-	node->next = node->prev = node->parent = node->left = node->right = NULL;
-
-#ifdef AVL_COUNT
-	node->count = 0;
-#endif
-#ifdef AVL_DEPTH
-	node->depth = 0;
-#endif
-}
-
-void avl_delete_node(avl_tree_t *tree, avl_node_t *node) {
-	avl_unlink_node(tree, node);
-	avl_free_node(tree, node);
-}
-
-void avl_delete(avl_tree_t *tree, void *data) {
-	avl_node_t *node;
-
-	node = avl_search_node(tree, data);
-
-	if(node) {
-		avl_delete_node(tree, node);
-	}
-}
-
-/* Fast tree cleanup */
-
-void avl_delete_tree(avl_tree_t *tree) {
-	avl_node_t *node, *next;
-
-	for(node = tree->head; node; node = next) {
-		next = node->next;
-		avl_free_node(tree, node);
-	}
-
-	avl_free_tree(tree);
-}
-
-/* Tree walking */
-
-void avl_foreach(const avl_tree_t *tree, avl_action_t action) {
-	avl_node_t *node, *next;
-
-	for(node = tree->head; node; node = next) {
-		next = node->next;
-		action(node->data);
-	}
-}
-
-void avl_foreach_node(const avl_tree_t *tree, avl_action_t action) {
-	avl_node_t *node, *next;
-
-	for(node = tree->head; node; node = next) {
-		next = node->next;
-		action(node);
-	}
-}
-
-/* Indexing */
-
-#ifdef AVL_COUNT
-unsigned int avl_count(const avl_tree_t *tree) {
-	return AVL_NODE_COUNT(tree->root);
-}
-
-avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index) {
-	avl_node_t *node;
-	unsigned int c;
-
-	node = tree->root;
-
-	while(node) {
-		c = AVL_L_COUNT(node);
-
-		if(index < c) {
-			node = node->left;
-		} else if(index > c) {
-			node = node->right;
-			index -= c + 1;
-		} else {
-			return node;
-		}
-	}
-
-	return NULL;
-}
-
-unsigned int avl_index(const avl_node_t *node) {
-	avl_node_t *next;
-	unsigned int index;
-
-	index = AVL_L_COUNT(node);
-
-	while((next = node->parent)) {
-		if(node == next->right) {
-			index += AVL_L_COUNT(next) + 1;
-		}
-
-		node = next;
-	}
-
-	return index;
-}
-#endif
-#ifdef AVL_DEPTH
-unsigned int avl_depth(const avl_tree_t *tree) {
-	return AVL_NODE_DEPTH(tree->root);
-}
-#endif

src/avl_tree.h

@@ -1,142 +0,0 @@
-#ifndef TINC_AVL_TREE_H
-#define TINC_AVL_TREE_H
-
-/*
-    avl_tree.h -- header file for avl_tree.c
-    Copyright (C) 1998 Michael H. Buselli
-                  2000-2005 Ivo Timmermans,
-                  2000-2006 Guus Sliepen <guus@tinc-vpn.org>
-                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
-
-    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
-    instead of depths, to add the ->next and ->prev and to generally obfuscate
-    the code. Mail me if you found a bug.
-
-    Cleaned up and incorporated some of the ideas from the red-black tree
-    library for inclusion into tinc (https://www.tinc-vpn.org/) by
-    Guus Sliepen <guus@tinc-vpn.org>.
-*/
-
-#ifndef AVL_DEPTH
-#ifndef AVL_COUNT
-#define AVL_DEPTH
-#endif
-#endif
-
-typedef struct avl_node_t {
-
-	/* Linked list part */
-
-	struct avl_node_t *next;
-	struct avl_node_t *prev;
-
-	/* Tree part */
-
-	struct avl_node_t *parent;
-	struct avl_node_t *left;
-	struct avl_node_t *right;
-
-#ifdef AVL_COUNT
-	unsigned int count;
-#endif
-#ifdef AVL_DEPTH
-	unsigned char depth;
-#endif
-
-	/* Payload */
-
-	void *data;
-
-} avl_node_t;
-
-typedef int (*avl_compare_t)(const void *data1, const void *data2);
-typedef void (*avl_action_t)(const void *data);
-typedef void (*avl_action_node_t)(const avl_node_t *node);
-
-typedef struct avl_tree_t {
-
-	/* Linked list part */
-
-	avl_node_t *head;
-	avl_node_t *tail;
-
-	/* Tree part */
-
-	avl_node_t *root;
-
-	avl_compare_t compare;
-	avl_action_t delete;
-
-} avl_tree_t;
-
-/* (De)constructors */
-
-extern avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete);
-extern void avl_free_tree(avl_tree_t *tree);
-
-extern avl_node_t *avl_alloc_node(void);
-extern void avl_free_node(avl_tree_t *tree, avl_node_t *node);
-
-/* Insertion and deletion */
-
-extern avl_node_t *avl_insert(avl_tree_t *tree, void *data);
-extern avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node);
-
-extern void avl_insert_top(avl_tree_t *tree, avl_node_t *node);
-extern void avl_insert_before(avl_tree_t *tree, avl_node_t *before, avl_node_t *node);
-extern void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node);
-
-extern avl_node_t *avl_unlink(avl_tree_t *tree, void *data);
-extern void avl_unlink_node(avl_tree_t *tree, avl_node_t *node);
-extern void avl_delete(avl_tree_t *tree, void *data);
-extern void avl_delete_node(avl_tree_t *tree, avl_node_t *node);
-
-/* Fast tree cleanup */
-
-extern void avl_delete_tree(avl_tree_t *tree);
-
-/* Searching */
-
-extern void *avl_search(const avl_tree_t *tree, const void *data);
-extern void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result);
-extern void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data);
-extern void *avl_search_closest_greater(const avl_tree_t *tree, const void *data);
-
-extern avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data);
-extern avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data, int *result);
-extern avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree, const void *data);
-extern avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree, const void *data);
-
-/* Tree walking */
-
-extern void avl_foreach(const avl_tree_t *tree, avl_action_t action);
-extern void avl_foreach_node(const avl_tree_t *tree, avl_action_t action);
-
-/* Indexing */
-
-#ifdef AVL_COUNT
-extern unsigned int avl_count(const avl_tree_t *tree);
-extern avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index);
-extern unsigned int avl_index(const avl_node_t *node);
-#endif
-#ifdef AVL_DEPTH
-extern unsigned int avl_depth(const avl_tree_t *tree);
-#endif
-
-#endif

src/bsd/device.c

@@ -1,7 +1,7 @@
 /*
     device.c -- Interaction BSD tun/tap device
     Copyright (C) 2001-2005 Ivo Timmermans,
-                  2001-2016 Guus Sliepen <guus@tinc-vpn.org>
+                  2001-2017 Guus Sliepen <guus@tinc-vpn.org>
                   2009      Grzegorz Dymarek <gregd72002@googlemail.com>
 
     This program is free software; you can redistribute it and/or modify
@@ -24,13 +24,14 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
+#include "../names.h"
 #include "../net.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
 
 #ifdef ENABLE_TUNEMU
-#include "tunemu.h"
+#include "bsd/tunemu.h"
 #endif
 
 #ifdef HAVE_NET_IF_UTUN_H
@@ -55,9 +56,7 @@ typedef enum device_type {
 int device_fd = -1;
 char *device = NULL;
 char *iface = NULL;
-static const char *device_info = "OS X utun device";
-static uint64_t device_total_in = 0;
-static uint64_t device_total_out = 0;
+static char *device_info = NULL;
 #if defined(ENABLE_TUNEMU)
 static device_type_t device_type = DEVICE_TYPE_TUNEMU;
 #elif defined(HAVE_OPENBSD) || defined(HAVE_FREEBSD) || defined(HAVE_DRAGONFLY)
@@ -69,141 +68,127 @@ static device_type_t device_type = DEVICE_TYPE_TUN;
 #ifdef HAVE_NET_IF_UTUN_H
 static bool setup_utun(void) {
 	device_fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
-
 	if(device_fd == -1) {
-		logger(LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
 		return false;
 	}
 
 	struct ctl_info info = {};
-
-	strlcpy(info.ctl_name, UTUN_CONTROL_NAME, sizeof(info.ctl_name));
+	strlcpy(info.ctl_name, UTUN_CONTROL_NAME, sizeof info.ctl_name);
 
 	if(ioctl(device_fd, CTLIOCGINFO, &info) == -1) {
-		logger(LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
 		return false;
 	}
 
 	int unit = -1;
 	char *p = strstr(device, "utun"), *e = NULL;
-
 	if(p) {
 		unit = strtol(p + 4, &e, 10);
-
-		if(!e) {
+		if(!e)
 			unit = -1;
-		}
 	}
 
 	struct sockaddr_ctl sc = {
 		.sc_id = info.ctl_id,
-		.sc_len = sizeof(sc),
+		.sc_len = sizeof sc,
 		.sc_family = AF_SYSTEM,
 		.ss_sysaddr = AF_SYS_CONTROL,
 		.sc_unit = unit + 1,
 	};
 
 	if(connect(device_fd, (struct sockaddr *)&sc, sizeof(sc)) == -1) {
-		logger(LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
 		return false;
 	}
 
 	char name[64] = "";
-	socklen_t len = sizeof(name);
-
+	socklen_t len = sizeof name;
 	if(getsockopt(device_fd, SYSPROTO_CONTROL, UTUN_OPT_IFNAME, name, &len)) {
 		iface = xstrdup(device);
 	} else {
 		iface = xstrdup(name);
 	}
 
-	logger(LOG_INFO, "%s is a %s", device, device_info);
+	device_info = "OS X utun device";
+
+	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
 
 	return true;
 }
 #endif
 
 static bool setup_device(void) {
-	// Find out which device file to open
-
-	if(!get_config_string(lookup_config(config_tree, "Device"), &device)) {
-		if(routing_mode == RMODE_ROUTER) {
-			device = xstrdup(DEFAULT_TUN_DEVICE);
-		} else {
-			device = xstrdup(DEFAULT_TAP_DEVICE);
-		}
-	}
+	get_config_string(lookup_config(config_tree, "Device"), &device);
 
 	// Find out if it's supposed to be a tun or a tap device
 
 	char *type;
-
 	if(get_config_string(lookup_config(config_tree, "DeviceType"), &type)) {
 		if(!strcasecmp(type, "tun"))
 			/* use default */;
-
 #ifdef ENABLE_TUNEMU
-		else if(!strcasecmp(type, "tunemu")) {
+		else if(!strcasecmp(type, "tunemu"))
 			device_type = DEVICE_TYPE_TUNEMU;
-		}
-
 #endif
 #ifdef HAVE_NET_IF_UTUN_H
-		else if(!strcasecmp(type, "utun")) {
+		else if(!strcasecmp(type, "utun"))
 			device_type = DEVICE_TYPE_UTUN;
-		}
-
 #endif
-		else if(!strcasecmp(type, "tunnohead")) {
+		else if(!strcasecmp(type, "tunnohead"))
 			device_type = DEVICE_TYPE_TUN;
-		} else if(!strcasecmp(type, "tunifhead")) {
+		else if(!strcasecmp(type, "tunifhead"))
 			device_type = DEVICE_TYPE_TUNIFHEAD;
-		} else if(!strcasecmp(type, "tap")) {
+		else if(!strcasecmp(type, "tap"))
 			device_type = DEVICE_TYPE_TAP;
-		} else {
-			logger(LOG_ERR, "Unknown device type %s!", type);
+		else {
+			logger(DEBUG_ALWAYS, LOG_ERR, "Unknown device type %s!", type);
 			return false;
 		}
 	} else {
 #ifdef HAVE_NET_IF_UTUN_H
-
-		if(strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0) {
+		if(device && (strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0))
 			device_type = DEVICE_TYPE_UTUN;
-		} else
+		else
 #endif
-			if(strstr(device, "tap") || routing_mode != RMODE_ROUTER) {
-				device_type = DEVICE_TYPE_TAP;
-			}
+		if((device && strstr(device, "tap")) || routing_mode != RMODE_ROUTER)
+			device_type = DEVICE_TYPE_TAP;
 	}
 
 	if(routing_mode == RMODE_SWITCH && device_type != DEVICE_TYPE_TAP) {
-		logger(LOG_ERR, "Only tap devices support switch mode!");
+		logger(DEBUG_ALWAYS, LOG_ERR, "Only tap devices support switch mode!");
 		return false;
 	}
 
+	// Find out which device file to open
+
+	if(!device) {
+		if(device_type == DEVICE_TYPE_TAP)
+			device = xstrdup(DEFAULT_TAP_DEVICE);
+		else
+			device = xstrdup(DEFAULT_TUN_DEVICE);
+	}
+
 	// Open the device
 
 	switch(device_type) {
 #ifdef ENABLE_TUNEMU
-
-	case DEVICE_TYPE_TUNEMU: {
-		char dynamic_name[256] = "";
-		device_fd = tunemu_open(dynamic_name);
-	}
-	break;
+		case DEVICE_TYPE_TUNEMU: {
+			char dynamic_name[256] = "";
+			device_fd = tunemu_open(dynamic_name);
+		}
+			break;
 #endif
 #ifdef HAVE_NET_IF_UTUN_H
-
-	case DEVICE_TYPE_UTUN:
-		return setup_utun();
+		case DEVICE_TYPE_UTUN:
+			return setup_utun();
 #endif
-
-	default:
-		device_fd = open(device, O_RDWR | O_NONBLOCK);
+		default:
+			device_fd = open(device, O_RDWR | O_NONBLOCK);
 	}
 
 	if(device_fd < 0) {
-		logger(LOG_ERR, "Could not open %s: %s", device, strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open %s: %s", device, strerror(errno));
 		return false;
 	}
 
@@ -219,111 +204,90 @@ static bool setup_device(void) {
 	realname = fdevname(device_fd);
 #elif defined(HAVE_DEVNAME)
 	struct stat buf;
-
-	if(!fstat(device_fd, &buf)) {
+	if(!fstat(device_fd, &buf))
 		realname = devname(buf.st_rdev, S_IFCHR);
-	}
-
 #endif
 
-	if(!realname) {
+	if(!realname)
 		realname = device;
-	}
 
-	if(!get_config_string(lookup_config(config_tree, "Interface"), &iface)) {
+	if(!get_config_string(lookup_config(config_tree, "Interface"), &iface))
 		iface = xstrdup(strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname);
-	} else if(strcmp(iface, strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname)) {
-		logger(LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
-	}
+	else if(strcmp(iface, strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname))
+		logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
 
 	// Configure the device as best as we can
 
 	switch(device_type) {
-	default:
-		device_type = DEVICE_TYPE_TUN;
-
-	case DEVICE_TYPE_TUN:
+		default:
+			device_type = DEVICE_TYPE_TUN;
+		case DEVICE_TYPE_TUN:
 #ifdef TUNSIFHEAD
 		{
 			const int zero = 0;
-
-			if(ioctl(device_fd, TUNSIFHEAD, &zero, sizeof(zero)) == -1) {
-				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
+			if(ioctl(device_fd, TUNSIFHEAD, &zero, sizeof zero) == -1) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
-
 #endif
 #if defined(TUNSIFMODE) && defined(IFF_BROADCAST) && defined(IFF_MULTICAST)
 		{
 			const int mode = IFF_BROADCAST | IFF_MULTICAST;
-			ioctl(device_fd, TUNSIFMODE, &mode, sizeof(mode));
+			ioctl(device_fd, TUNSIFMODE, &mode, sizeof mode);
 		}
 #endif
 
-		device_info = "Generic BSD tun device";
-		break;
-
-	case DEVICE_TYPE_TUNIFHEAD:
+			device_info = "Generic BSD tun device";
+			break;
+		case DEVICE_TYPE_TUNIFHEAD:
 #ifdef TUNSIFHEAD
 		{
 			const int one = 1;
-
-			if(ioctl(device_fd, TUNSIFHEAD, &one, sizeof(one)) == -1) {
-				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
+			if(ioctl(device_fd, TUNSIFHEAD, &one, sizeof one) == -1) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
-
 #endif
 #if defined(TUNSIFMODE) && defined(IFF_BROADCAST) && defined(IFF_MULTICAST)
 		{
-			const int mode = IFF_BROADCAST | IFF_MULTICAST;
-			ioctl(device_fd, TUNSIFMODE, &mode, sizeof(mode));
+				const int mode = IFF_BROADCAST | IFF_MULTICAST;
+				ioctl(device_fd, TUNSIFMODE, &mode, sizeof mode);
 		}
 #endif
 
-		device_info = "Generic BSD tun device";
-		break;
-
-	case DEVICE_TYPE_TAP:
-		if(routing_mode == RMODE_ROUTER) {
-			overwrite_mac = true;
-		}
-
-		device_info = "Generic BSD tap device";
+			device_info = "Generic BSD tun device";
+			break;
+		case DEVICE_TYPE_TAP:
+			if(routing_mode == RMODE_ROUTER)
+				overwrite_mac = true;
+			device_info = "Generic BSD tap device";
 #ifdef TAPGIFNAME
-		{
-			struct ifreq ifr;
-
-			if(ioctl(device_fd, TAPGIFNAME, (void *)&ifr) == 0) {
-				if(iface) {
-					free(iface);
+			{
+				struct ifreq ifr;
+				if(ioctl(device_fd, TAPGIFNAME, (void*)&ifr) == 0) {
+					if(iface)
+						free(iface);
+					iface = xstrdup(ifr.ifr_name);
 				}
-
-				iface = xstrdup(ifr.ifr_name);
 			}
-		}
 
 #endif
-		break;
+			break;
 #ifdef ENABLE_TUNEMU
-
-	case DEVICE_TYPE_TUNEMU:
-		device_info = "BSD tunemu device";
-		break;
+		case DEVICE_TYPE_TUNEMU:
+			device_info = "BSD tunemu device";
+			break;
 #endif
 	}
 
 #ifdef SIOCGIFADDR
-
-	if(overwrite_mac) {
+	if(overwrite_mac)
 		ioctl(device_fd, SIOCGIFADDR, mymac.x);
-	}
-
 #endif
 
-	logger(LOG_INFO, "%s is a %s", device, device_info);
+	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
 
 	return true;
 }
@@ -331,200 +295,180 @@ static bool setup_device(void) {
 static void close_device(void) {
 	switch(device_type) {
 #ifdef ENABLE_TUNEMU
-
-	case DEVICE_TYPE_TUNEMU:
-		tunemu_close(device_fd);
-		break;
+		case DEVICE_TYPE_TUNEMU:
+			tunemu_close(device_fd);
+			break;
 #endif
-
-	default:
-		close(device_fd);
+		default:
+			close(device_fd);
 	}
+	device_fd = -1;
 
-	free(device);
-	free(iface);
+	free(device); device = NULL;
+	free(iface); iface = NULL;
+	device_info = NULL;
 }
 
 static bool read_packet(vpn_packet_t *packet) {
-	int lenin;
+	int inlen;
 
 	switch(device_type) {
-	case DEVICE_TYPE_TUN:
+		case DEVICE_TYPE_TUN:
 #ifdef ENABLE_TUNEMU
-	case DEVICE_TYPE_TUNEMU:
-		if(device_type == DEVICE_TYPE_TUNEMU) {
-			lenin = tunemu_read(device_fd, packet->data + 14, MTU - 14);
-		} else
+		case DEVICE_TYPE_TUNEMU:
+			if(device_type == DEVICE_TYPE_TUNEMU)
+				inlen = tunemu_read(device_fd, DATA(packet) + 14, MTU - 14);
+			else
 #endif
-			lenin = read(device_fd, packet->data + 14, MTU - 14);
+				inlen = read(device_fd, DATA(packet) + 14, MTU - 14);
 
-		if(lenin <= 0) {
-			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
+			if(inlen <= 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
 
-		switch(packet->data[14] >> 4) {
-		case 4:
-			packet->data[12] = 0x08;
-			packet->data[13] = 0x00;
+			switch(DATA(packet)[14] >> 4) {
+				case 4:
+					DATA(packet)[12] = 0x08;
+					DATA(packet)[13] = 0x00;
+					break;
+				case 6:
+					DATA(packet)[12] = 0x86;
+					DATA(packet)[13] = 0xDD;
+					break;
+				default:
+					logger(DEBUG_TRAFFIC, LOG_ERR,
+							   "Unknown IP version %d while reading packet from %s %s",
+							   DATA(packet)[14] >> 4, device_info, device);
+					return false;
+			}
+
+			memset(DATA(packet), 0, 12);
+			packet->len = inlen + 14;
 			break;
 
-		case 6:
-			packet->data[12] = 0x86;
-			packet->data[13] = 0xDD;
+		case DEVICE_TYPE_UTUN:
+		case DEVICE_TYPE_TUNIFHEAD: {
+			if((inlen = read(device_fd, DATA(packet) + 10, MTU - 10)) <= 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
+
+			switch (DATA(packet)[14] >> 4) {
+				case 4:
+					DATA(packet)[12] = 0x08;
+					DATA(packet)[13] = 0x00;
+					break;
+
+				case 6:
+					DATA(packet)[12] = 0x86;
+					DATA(packet)[13] = 0xDD;
+					break;
+
+				default:
+					logger(DEBUG_TRAFFIC, LOG_ERR,
+							   "Unknown IP version %d while reading packet from %s %s",
+							   DATA(packet)[14] >> 4, device_info, device);
+					return false;
+			}
+
+			memset(DATA(packet), 0, 12);
+			packet->len = inlen + 10;
+			break;
+		}
+
+		case DEVICE_TYPE_TAP:
+			if((inlen = read(device_fd, DATA(packet), MTU)) <= 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
+
+			packet->len = inlen;
 			break;
 
 		default:
-			ifdebug(TRAFFIC) logger(LOG_ERR,
-			                        "Unknown IP version %d while reading packet from %s %s",
-			                        packet->data[14] >> 4, device_info, device);
 			return false;
-		}
-
-		memset(packet->data, 0, 12);
-		packet->len = lenin + 14;
-		break;
-
-	case DEVICE_TYPE_UTUN:
-	case DEVICE_TYPE_TUNIFHEAD: {
-		if((lenin = read(device_fd, packet->data + 10, MTU - 10)) <= 0) {
-			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
-
-		switch(packet->data[14] >> 4) {
-		case 4:
-			packet->data[12] = 0x08;
-			packet->data[13] = 0x00;
-			break;
-
-		case 6:
-			packet->data[12] = 0x86;
-			packet->data[13] = 0xDD;
-			break;
-
-		default:
-			ifdebug(TRAFFIC) logger(LOG_ERR,
-			                        "Unknown IP version %d while reading packet from %s %s",
-			                        packet->data[14] >> 4, device_info, device);
-			return false;
-		}
-
-		memset(packet->data, 0, 12);
-		packet->len = lenin + 10;
-		break;
 	}
 
-	case DEVICE_TYPE_TAP:
-		if((lenin = read(device_fd, packet->data, MTU)) <= 0) {
-			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
-
-		packet->len = lenin;
-		break;
-
-	default:
-		return false;
-	}
-
-	device_total_in += packet->len;
-
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s",
-	                        packet->len, device_info);
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s",
+			   packet->len, device_info);
 
 	return true;
 }
 
 static bool write_packet(vpn_packet_t *packet) {
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
-	                        packet->len, device_info);
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
+			   packet->len, device_info);
 
 	switch(device_type) {
-	case DEVICE_TYPE_TUN:
-		if(write(device_fd, packet->data + 14, packet->len - 14) < 0) {
-			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
-
-		break;
-
-	case DEVICE_TYPE_UTUN:
-	case DEVICE_TYPE_TUNIFHEAD: {
-		int af = (packet->data[12] << 8) + packet->data[13];
-		uint32_t type;
-
-		switch(af) {
-		case 0x0800:
-			type = htonl(AF_INET);
+		case DEVICE_TYPE_TUN:
+			if(write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
 			break;
 
-		case 0x86DD:
-			type = htonl(AF_INET6);
+		case DEVICE_TYPE_UTUN:
+		case DEVICE_TYPE_TUNIFHEAD: {
+			int af = (DATA(packet)[12] << 8) + DATA(packet)[13];
+			uint32_t type;
+
+			switch (af) {
+				case 0x0800:
+					type = htonl(AF_INET);
+					break;
+				case 0x86DD:
+					type = htonl(AF_INET6);
+					break;
+				default:
+					logger(DEBUG_TRAFFIC, LOG_ERR,
+							   "Unknown address family %x while writing packet to %s %s",
+							   af, device_info, device);
+					return false;
+			}
+
+			memcpy(DATA(packet) + 10, &type, sizeof type);
+
+			if(write(device_fd, DATA(packet) + 10, packet->len - 10) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Can't write to %s %s: %s", device_info, device,
+					   strerror(errno));
+				return false;
+			}
 			break;
-
-		default:
-			ifdebug(TRAFFIC) logger(LOG_ERR,
-			                        "Unknown address family %x while writing packet to %s %s",
-			                        af, device_info, device);
-			return false;
 		}
 
-		memcpy(packet->data + 10, &type, sizeof(type));
-
-		if(write(device_fd, packet->data + 10, packet->len - 10) < 0) {
-			logger(LOG_ERR, "Can't write to %s %s: %s", device_info, device,
-			       strerror(errno));
-			return false;
-		}
-
-		break;
-	}
-
-	case DEVICE_TYPE_TAP:
-		if(write(device_fd, packet->data, packet->len) < 0) {
-			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
-
-		break;
+		case DEVICE_TYPE_TAP:
+			if(write(device_fd, DATA(packet), packet->len) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
+			break;
 
 #ifdef ENABLE_TUNEMU
-
-	case DEVICE_TYPE_TUNEMU:
-		if(tunemu_write(device_fd, packet->data + 14, packet->len - 14) < 0) {
-			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
-			       device, strerror(errno));
-			return false;
-		}
-
-		break;
+		case DEVICE_TYPE_TUNEMU:
+			if(tunemu_write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
+				logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+					   device, strerror(errno));
+				return false;
+			}
+			break;
 #endif
 
-	default:
-		return false;
+		default:
+			return false;
 	}
 
-	device_total_out += packet->len;
-
 	return true;
 }
 
-static void dump_device_stats(void) {
-	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
-	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
-	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
-}
-
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
-	.dump_stats = dump_device_stats,
 };

src/bsd/tunemu.c

@@ -45,25 +45,28 @@
 #define PPPIOCSFLAGS    _IOW('t', 89, int)
 #define PPPIOCSNPMODE   _IOW('t', 75, struct npioctl)
 #define PPPIOCATTCHAN   _IOW('t', 56, int)
-#define PPPIOCGCHAN             _IOR('t', 55, int)
+#define PPPIOCGCHAN     _IOR('t', 55, int)
 #define PPPIOCCONNECT   _IOW('t', 58, int)
-#define PPPIOCGUNIT             _IOR('t', 86, int)
+#define PPPIOCGUNIT     _IOR('t', 86, int)
 
-struct sockaddr_ppp {
+struct sockaddr_ppp
+{
 	u_int8_t ppp_len;
 	u_int8_t ppp_family;
 	u_int16_t ppp_proto;
 	u_int32_t ppp_cookie;
 };
 
-enum NPmode {
+enum NPmode
+{
 	NPMODE_PASS,
-	NPMODE_DROP,
-	NPMODE_ERROR,
-	NPMODE_QUEUE
+    NPMODE_DROP,
+    NPMODE_ERROR,
+    NPMODE_QUEUE
 };
 
-struct npioctl {
+struct npioctl
+{
 	int protocol;
 	enum NPmode mode;
 };
@@ -80,55 +83,58 @@ static pcap_t *pcap = NULL;
 static int data_buffer_length = 0;
 static char *data_buffer = NULL;
 
-static void tun_error(char *format, ...) {
+static void tun_error(char *format, ...)
+{
 	va_list vl;
 	va_start(vl, format);
-	vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
+	vsnprintf(tunemu_error, sizeof tunemu_error, format, vl);
 	va_end(vl);
 }
 
-static void tun_noerror() {
+static void tun_noerror()
+{
 	*tunemu_error = 0;
 }
 
-static void closeall() {
-	int fd = getdtablesize();
-
-	while(fd--) {
+static void closeall()
+{
+    int fd = getdtablesize();
+	while (fd--)
 		close(fd);
-	}
 
-	open("/dev/null", O_RDWR, 0);
-	dup(0);
-	dup(0);
+    open("/dev/null", O_RDWR, 0);
+    dup(0);
+    dup(0);
 }
 
-static int ppp_load_kext() {
+static int ppp_load_kext()
+{
 	int pid = fork();
-
-	if(pid < 0) {
+	if (pid < 0)
+	{
 		tun_error("fork for ppp kext: %s", strerror(errno));
 		return -1;
 	}
 
-	if(pid == 0) {
+	if (pid == 0)
+	{
 		closeall();
 		execle("/sbin/kextload", "kextload", PPP_KEXT_PATH, NULL, NULL);
 		exit(1);
 	}
 
 	int status;
-
-	while(waitpid(pid, &status, 0) < 0) {
-		if(errno == EINTR) {
+	while (waitpid(pid, &status, 0) < 0)
+	{
+		if (errno == EINTR)
 			continue;
-		}
 
 		tun_error("waitpid for ppp kext: %s", strerror(errno));
 		return -1;
 	}
 
-	if(WEXITSTATUS(status) != 0) {
+	if (WEXITSTATUS(status) != 0)
+	{
 		tun_error("could not load ppp kext \"%s\"", PPP_KEXT_PATH);
 		return -1;
 	}
@@ -137,73 +143,74 @@ static int ppp_load_kext() {
 	return 0;
 }
 
-static int ppp_new_instance() {
+static int ppp_new_instance()
+{
 	// create ppp socket
-	int ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
-
-	if(ppp_sockfd < 0) {
-		if(ppp_load_kext() < 0) {
+    int ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
+    if (ppp_sockfd < 0)
+	{
+		if (ppp_load_kext() < 0)
 			return -1;
-		}
 
 		ppp_sockfd = socket(PF_PPP, SOCK_RAW, PPPPROTO_CTL);
-
-		if(ppp_sockfd < 0) {
+		if (ppp_sockfd < 0)
+		{
 			tun_error("creating ppp socket: %s", strerror(errno));
 			return -1;
 		}
 	}
 
 	// connect to ppp procotol
-	struct sockaddr_ppp pppaddr;
-	pppaddr.ppp_len = sizeof(struct sockaddr_ppp);
-	pppaddr.ppp_family = AF_PPP;
-	pppaddr.ppp_proto = PPPPROTO_CTL;
-	pppaddr.ppp_cookie = 0;
-
-	if(connect(ppp_sockfd, (struct sockaddr *)&pppaddr, sizeof(struct sockaddr_ppp)) < 0) {
+    struct sockaddr_ppp pppaddr;
+    pppaddr.ppp_len = sizeof(struct sockaddr_ppp);
+    pppaddr.ppp_family = AF_PPP;
+    pppaddr.ppp_proto = PPPPROTO_CTL;
+    pppaddr.ppp_cookie = 0;
+    if (connect(ppp_sockfd, (struct sockaddr *)&pppaddr, sizeof(struct sockaddr_ppp)) < 0)
+	{
 		tun_error("connecting ppp socket: %s", strerror(errno));
 		close(ppp_sockfd);
 		return -1;
-	}
+    }
 
 	tun_noerror();
 	return ppp_sockfd;
 }
 
-static int ppp_new_unit(int *unit_number) {
+static int ppp_new_unit(int *unit_number)
+{
 	int fd = ppp_new_instance();
-
-	if(fd < 0) {
+	if (fd < 0)
 		return -1;
-	}
 
 	// create ppp unit
-	if(ioctl(fd, PPPIOCNEWUNIT, unit_number) < 0) {
+	if (ioctl(fd, PPPIOCNEWUNIT, unit_number) < 0)
+	{
 		tun_error("creating ppp unit: %s", strerror(errno));
 		close(fd);
 		return -1;
-	}
+    }
 
 	tun_noerror();
 	return fd;
 }
 
-static int ppp_setup_unit(int unit_fd) {
+static int ppp_setup_unit(int unit_fd)
+{
 	// send traffic to program
 	int flags = SC_LOOP_TRAFFIC;
-
-	if(ioctl(unit_fd, PPPIOCSFLAGS, &flags) < 0) {
+	if (ioctl(unit_fd, PPPIOCSFLAGS, &flags) < 0)
+	{
 		tun_error("setting ppp loopback mode: %s", strerror(errno));
 		return -1;
-	}
+    }
 
 	// allow packets
 	struct npioctl npi;
 	npi.protocol = PPP_IP;
 	npi.mode = NPMODE_PASS;
-
-	if(ioctl(unit_fd, PPPIOCSNPMODE, &npi) < 0) {
+	if (ioctl(unit_fd, PPPIOCSNPMODE, &npi) < 0)
+	{
 		tun_error("starting ppp unit: %s", strerror(errno));
 		return -1;
 	}
@@ -212,8 +219,10 @@ static int ppp_setup_unit(int unit_fd) {
 	return 0;
 }
 
-static int open_pcap() {
-	if(pcap != NULL) {
+static int open_pcap()
+{
+	if (pcap != NULL)
+	{
 		pcap_use_count++;
 		return 0;
 	}
@@ -222,7 +231,8 @@ static int open_pcap() {
 	pcap = pcap_open_live("lo0", BUFSIZ, 0, 1, errbuf);
 	pcap_use_count = 1;
 
-	if(pcap == NULL) {
+	if (pcap == NULL)
+	{
 		tun_error("opening pcap: %s", errbuf);
 		return -1;
 	}
@@ -231,57 +241,59 @@ static int open_pcap() {
 	return 0;
 }
 
-static void close_pcap() {
-	if(pcap == NULL) {
+static void close_pcap()
+{
+	if (pcap == NULL)
 		return;
-	}
 
 	pcap_use_count--;
-
-	if(pcap_use_count == 0) {
+	if (pcap_use_count == 0)
+	{
 		pcap_close(pcap);
 		pcap = NULL;
 	}
 }
 
-static void allocate_data_buffer(int size) {
-	if(data_buffer_length < size) {
+static void allocate_data_buffer(int size)
+{
+	if (data_buffer_length < size)
+	{
 		free(data_buffer);
 		data_buffer_length = size;
 		data_buffer = malloc(data_buffer_length);
 	}
 }
 
-static void make_device_name(tunemu_device device, int unit_number) {
+static void make_device_name(tunemu_device device, int unit_number)
+{
 	snprintf(device, sizeof(tunemu_device), "ppp%d", unit_number);
 }
 
-static int check_device_name(tunemu_device device) {
-	if(strlen(device) < 4) {
+static int check_device_name(tunemu_device device)
+{
+	if (strlen(device) < 4)
 		return -1;
-	}
 
 	int unit_number = atoi(device + 3);
-
-	if(unit_number < 0 || unit_number > 999) {
+	if (unit_number < 0 || unit_number > 999)
 		return -1;
-	}
 
 	tunemu_device compare;
 	make_device_name(compare, unit_number);
 
-	if(strcmp(device, compare) != 0) {
+	if (strcmp(device, compare) != 0)
 		return -1;
-	}
 
 	return 0;
 }
 
-int tunemu_open(tunemu_device device) {
+int tunemu_open(tunemu_device device)
+{
 	int ppp_unit_number = -1;
-
-	if(device[0] != 0) {
-		if(check_device_name(device) < 0) {
+	if (device[0] != 0)
+	{
+		if (check_device_name(device) < 0)
+		{
 			tun_error("invalid device name \"%s\"", device);
 			return -1;
 		}
@@ -290,17 +302,17 @@ int tunemu_open(tunemu_device device) {
 	}
 
 	int ppp_unit_fd = ppp_new_unit(&ppp_unit_number);
-
-	if(ppp_unit_fd < 0) {
+	if (ppp_unit_fd < 0)
 		return -1;
-	}
 
-	if(ppp_setup_unit(ppp_unit_fd) < 0) {
+	if (ppp_setup_unit(ppp_unit_fd) < 0)
+	{
 		close(ppp_unit_fd);
 		return -1;
 	}
 
-	if(open_pcap() < 0) {
+	if (open_pcap() < 0)
+	{
 		close(ppp_unit_fd);
 		return -1;
 	}
@@ -310,40 +322,39 @@ int tunemu_open(tunemu_device device) {
 	return ppp_unit_fd;
 }
 
-int tunemu_close(int ppp_sockfd) {
+int tunemu_close(int ppp_sockfd)
+{
 	int ret = close(ppp_sockfd);
 
-	if(ret == 0) {
+	if (ret == 0)
 		close_pcap();
-	}
 
 	return ret;
 }
 
-int tunemu_read(int ppp_sockfd, char *buffer, int length) {
+int tunemu_read(int ppp_sockfd, char *buffer, int length)
+{
 	allocate_data_buffer(length + 2);
 
 	length = read(ppp_sockfd, data_buffer, length + 2);
-
-	if(length < 0) {
+	if (length < 0)
+	{
 		tun_error("reading packet: %s", strerror(errno));
 		return length;
 	}
-
 	tun_noerror();
 
 	length -= 2;
-
-	if(length < 0) {
+	if (length < 0)
 		return 0;
-	}
 
 	memcpy(buffer, data_buffer + 2, length);
 
 	return length;
 }
 
-int tunemu_write(int ppp_sockfd, char *buffer, int length) {
+int tunemu_write(int ppp_sockfd, char *buffer, int length)
+{
 	allocate_data_buffer(length + 4);
 
 	data_buffer[0] = 0x02;
@@ -353,25 +364,23 @@ int tunemu_write(int ppp_sockfd, char *buffer, int length) {
 
 	memcpy(data_buffer + 4, buffer, length);
 
-	if(pcap == NULL) {
+	if (pcap == NULL)
+	{
 		tun_error("pcap not open");
 		return -1;
 	}
 
 	length = pcap_inject(pcap, data_buffer, length + 4);
-
-	if(length < 0) {
+	if (length < 0)
+	{
 		tun_error("injecting packet: %s", pcap_geterr(pcap));
 		return length;
 	}
-
 	tun_noerror();
 
 	length -= 4;
-
-	if(length < 0) {
+	if (length < 0)
 		return 0;
-	}
 
 	return length;
 }

src/buffer.c

@@ -0,0 +1,108 @@
+/*
+    buffer.c -- buffer management
+    Copyright (C) 2011 Guus Sliepen <guus@tinc-vpn.org>,
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#include "system.h"
+
+#include "buffer.h"
+#include "xalloc.h"
+
+void buffer_compact(buffer_t *buffer, int maxsize) {
+	if(buffer->len >= maxsize || buffer->offset / 7 > buffer->len / 8) {
+		memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
+		buffer->len -= buffer->offset;
+		buffer->offset = 0;
+	}
+}
+
+// Make sure we can add size bytes to the buffer, and return a pointer to the start of those bytes.
+
+char *buffer_prepare(buffer_t *buffer, int size) {
+	if(!buffer->data) {
+		buffer->maxlen = size;
+		buffer->data = xmalloc(size);
+	} else {
+		if(buffer->offset && buffer->len + size > buffer->maxlen) {
+			memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
+			buffer->len -= buffer->offset;
+			buffer->offset = 0;
+		}
+
+		if(buffer->len + size > buffer->maxlen) {
+			buffer->maxlen = buffer->len + size;
+			buffer->data = xrealloc(buffer->data, buffer->maxlen);
+		}
+	}
+
+	char *start = buffer->data + buffer->len;
+
+	buffer->len += size;
+
+	return start;
+}
+
+// Copy data into the buffer.
+
+void buffer_add(buffer_t *buffer, const char *data, int size) {
+	memcpy(buffer_prepare(buffer, size), data, size);
+}
+
+// Remove given number of bytes from the buffer, return a pointer to the start of them.
+
+static char *buffer_consume(buffer_t *buffer, int size) {
+	char *start = buffer->data + buffer->offset;
+
+	buffer->offset += size;
+
+	if(buffer->offset >= buffer->len) {
+		buffer->offset = 0;
+		buffer->len = 0;
+	}
+
+	return start;
+}
+
+// Check if there is a complete line in the buffer, and if so, return it NULL-terminated.
+
+char *buffer_readline(buffer_t *buffer) {
+	char *newline = memchr(buffer->data + buffer->offset, '\n', buffer->len - buffer->offset);
+
+	if(!newline)
+		return NULL;
+
+	int len = newline + 1 - (buffer->data + buffer->offset);
+	*newline = 0;
+	return buffer_consume(buffer, len);
+}
+
+// Check if we have enough bytes in the buffer, and if so, return a pointer to the start of them.
+
+char *buffer_read(buffer_t *buffer, int size) {
+	if(buffer->len - buffer->offset < size)
+		return NULL;
+
+	return buffer_consume(buffer, size);
+}
+
+void buffer_clear(buffer_t *buffer) {
+	free(buffer->data);
+	buffer->data = NULL;
+	buffer->maxlen = 0;
+	buffer->len = 0;
+	buffer->offset = 0;
+}

src/buffer.h

@@ -0,0 +1,18 @@
+#ifndef __TINC_BUFFER_H__
+#define __TINC_BUFFER_H__
+
+typedef struct buffer_t {
+	char *data;
+	int maxlen;
+	int len;
+	int offset;
+} buffer_t;
+
+extern void buffer_compact(buffer_t *buffer, int maxsize);
+extern char *buffer_prepare(buffer_t *buffer, int size);
+extern void buffer_add(buffer_t *buffer, const char *data, int size);
+extern char *buffer_readline(buffer_t *buffer);
+extern char *buffer_read(buffer_t *buffer, int size);
+extern void buffer_clear(buffer_t *buffer);
+
+#endif

src/chacha-poly1305/chacha-poly1305.c

@@ -0,0 +1,103 @@
+#include "../system.h"
+
+#include "../cipher.h"
+#include "../xalloc.h"
+
+#include "chacha.h"
+#include "chacha-poly1305.h"
+#include "poly1305.h"
+
+struct chacha_poly1305_ctx {
+	struct chacha_ctx main_ctx, header_ctx;
+};
+
+chacha_poly1305_ctx_t *chacha_poly1305_init(void)
+{
+	chacha_poly1305_ctx_t *ctx = xzalloc(sizeof *ctx);
+	return ctx;
+}
+
+void chacha_poly1305_exit(chacha_poly1305_ctx_t *ctx)
+{
+	free(ctx);
+}
+
+bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *key)
+{
+	chacha_keysetup(&ctx->main_ctx, key, 256);
+	chacha_keysetup(&ctx->header_ctx, key + 32, 256);
+	return true;
+}
+
+static void put_u64(void *vp, uint64_t v)
+{
+	uint8_t *p = (uint8_t *) vp;
+
+	p[0] = (uint8_t) (v >> 56) & 0xff;
+	p[1] = (uint8_t) (v >> 48) & 0xff;
+	p[2] = (uint8_t) (v >> 40) & 0xff;
+	p[3] = (uint8_t) (v >> 32) & 0xff;
+	p[4] = (uint8_t) (v >> 24) & 0xff;
+	p[5] = (uint8_t) (v >> 16) & 0xff;
+	p[6] = (uint8_t) (v >> 8) & 0xff;
+	p[7] = (uint8_t) v & 0xff;
+}
+
+bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen) {
+	uint8_t seqbuf[8];
+	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };	/* NB little-endian */
+	uint8_t poly_key[POLY1305_KEYLEN];
+
+	/*
+	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
+	 * packet sequence number.
+	 */
+	memset(poly_key, 0, sizeof(poly_key));
+	put_u64(seqbuf, seqnr);
+	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
+	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
+
+	/* Set Chacha's block counter to 1 */
+	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
+
+	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
+	poly1305_auth(outdata + inlen, outdata, inlen, poly_key);
+
+	if (outlen)
+		*outlen = inlen + POLY1305_TAGLEN;
+
+	return true;
+}
+
+bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen) {
+	uint8_t seqbuf[8];
+	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };	/* NB little-endian */
+	uint8_t expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
+
+	/*
+	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
+	 * packet sequence number.
+	 */
+	memset(poly_key, 0, sizeof(poly_key));
+	put_u64(seqbuf, seqnr);
+	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
+	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
+
+	/* Set Chacha's block counter to 1 */
+	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
+
+	/* Check tag before anything else */
+	inlen -= POLY1305_TAGLEN;
+	const uint8_t *tag = indata + inlen;
+
+	poly1305_auth(expected_tag, indata, inlen, poly_key);
+	if (memcmp(expected_tag, tag, POLY1305_TAGLEN))
+		return false;
+
+	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
+
+	if (outlen)
+		*outlen = inlen;
+
+	return true;
+}

src/chacha-poly1305/chacha-poly1305.h

@@ -0,0 +1,15 @@
+#ifndef CHACHA_POLY1305_H
+#define CHACHA_POLY1305_H
+
+#define CHACHA_POLY1305_KEYLEN 64
+
+typedef struct chacha_poly1305_ctx chacha_poly1305_ctx_t;
+
+extern chacha_poly1305_ctx_t *chacha_poly1305_init(void);
+extern void chacha_poly1305_exit(chacha_poly1305_ctx_t *);
+extern bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *key);
+
+extern bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
+extern bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
+
+#endif //CHACHA_POLY1305_H

src/chacha-poly1305/chacha.c

@@ -0,0 +1,215 @@
+/*
+chacha-merged.c version 20080118
+D. J. Bernstein
+Public domain.
+*/
+
+#include "../system.h"
+
+#include "chacha.h"
+
+typedef struct chacha_ctx chacha_ctx;
+
+#define U8C(v) (v##U)
+#define U32C(v) (v##U)
+
+#define U8V(v) ((uint8_t)(v) & U8C(0xFF))
+#define U32V(v) ((uint32_t)(v) & U32C(0xFFFFFFFF))
+
+#define ROTL32(v, n) \
+	(U32V((v) << (n)) | ((v) >> (32 - (n))))
+
+#define U8TO32_LITTLE(p) \
+	(((uint32_t)((p)[0])      ) | \
+	 ((uint32_t)((p)[1]) <<  8) | \
+	 ((uint32_t)((p)[2]) << 16) | \
+	 ((uint32_t)((p)[3]) << 24))
+
+#define U32TO8_LITTLE(p, v) \
+	do { \
+		(p)[0] = U8V((v)      ); \
+		(p)[1] = U8V((v) >>  8); \
+		(p)[2] = U8V((v) >> 16); \
+		(p)[3] = U8V((v) >> 24); \
+	} while (0)
+
+#define ROTATE(v,c) (ROTL32(v,c))
+#define XOR(v,w) ((v) ^ (w))
+#define PLUS(v,w) (U32V((v) + (w)))
+#define PLUSONE(v) (PLUS((v),1))
+
+#define QUARTERROUND(a,b,c,d) \
+	a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
+	c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
+	a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
+	c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
+
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";
+
+void chacha_keysetup(chacha_ctx *x, const uint8_t *k, uint32_t kbits)
+{
+	const char *constants;
+
+	x->input[4] = U8TO32_LITTLE(k + 0);
+	x->input[5] = U8TO32_LITTLE(k + 4);
+	x->input[6] = U8TO32_LITTLE(k + 8);
+	x->input[7] = U8TO32_LITTLE(k + 12);
+	if (kbits == 256) {	/* recommended */
+		k += 16;
+		constants = sigma;
+	} else {		/* kbits == 128 */
+		constants = tau;
+	}
+	x->input[8] = U8TO32_LITTLE(k + 0);
+	x->input[9] = U8TO32_LITTLE(k + 4);
+	x->input[10] = U8TO32_LITTLE(k + 8);
+	x->input[11] = U8TO32_LITTLE(k + 12);
+	x->input[0] = U8TO32_LITTLE(constants + 0);
+	x->input[1] = U8TO32_LITTLE(constants + 4);
+	x->input[2] = U8TO32_LITTLE(constants + 8);
+	x->input[3] = U8TO32_LITTLE(constants + 12);
+}
+
+void chacha_ivsetup(chacha_ctx *x, const uint8_t *iv, const uint8_t *counter)
+{
+	x->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 0);
+	x->input[13] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 4);
+	x->input[14] = U8TO32_LITTLE(iv + 0);
+	x->input[15] = U8TO32_LITTLE(iv + 4);
+}
+
+void
+chacha_encrypt_bytes(chacha_ctx *x, const uint8_t *m, uint8_t *c, uint32_t bytes)
+{
+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+	uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
+	uint8_t *ctarget = NULL;
+	uint8_t tmp[64];
+	uint32_t i;
+
+	if (!bytes)
+		return;
+
+	j0 = x->input[0];
+	j1 = x->input[1];
+	j2 = x->input[2];
+	j3 = x->input[3];
+	j4 = x->input[4];
+	j5 = x->input[5];
+	j6 = x->input[6];
+	j7 = x->input[7];
+	j8 = x->input[8];
+	j9 = x->input[9];
+	j10 = x->input[10];
+	j11 = x->input[11];
+	j12 = x->input[12];
+	j13 = x->input[13];
+	j14 = x->input[14];
+	j15 = x->input[15];
+
+	for (;;) {
+		if (bytes < 64) {
+			for (i = 0; i < bytes; ++i)
+				tmp[i] = m[i];
+			m = tmp;
+			ctarget = c;
+			c = tmp;
+		}
+		x0 = j0;
+		x1 = j1;
+		x2 = j2;
+		x3 = j3;
+		x4 = j4;
+		x5 = j5;
+		x6 = j6;
+		x7 = j7;
+		x8 = j8;
+		x9 = j9;
+		x10 = j10;
+		x11 = j11;
+		x12 = j12;
+		x13 = j13;
+		x14 = j14;
+		x15 = j15;
+		for (i = 20; i > 0; i -= 2) {
+			QUARTERROUND(x0, x4, x8, x12)
+			QUARTERROUND(x1, x5, x9, x13)
+			QUARTERROUND(x2, x6, x10, x14)
+			QUARTERROUND(x3, x7, x11, x15)
+			QUARTERROUND(x0, x5, x10, x15)
+			QUARTERROUND(x1, x6, x11, x12)
+			QUARTERROUND(x2, x7, x8, x13)
+			QUARTERROUND(x3, x4, x9, x14)
+		}
+		x0 = PLUS(x0, j0);
+		x1 = PLUS(x1, j1);
+		x2 = PLUS(x2, j2);
+		x3 = PLUS(x3, j3);
+		x4 = PLUS(x4, j4);
+		x5 = PLUS(x5, j5);
+		x6 = PLUS(x6, j6);
+		x7 = PLUS(x7, j7);
+		x8 = PLUS(x8, j8);
+		x9 = PLUS(x9, j9);
+		x10 = PLUS(x10, j10);
+		x11 = PLUS(x11, j11);
+		x12 = PLUS(x12, j12);
+		x13 = PLUS(x13, j13);
+		x14 = PLUS(x14, j14);
+		x15 = PLUS(x15, j15);
+
+		x0 = XOR(x0, U8TO32_LITTLE(m + 0));
+		x1 = XOR(x1, U8TO32_LITTLE(m + 4));
+		x2 = XOR(x2, U8TO32_LITTLE(m + 8));
+		x3 = XOR(x3, U8TO32_LITTLE(m + 12));
+		x4 = XOR(x4, U8TO32_LITTLE(m + 16));
+		x5 = XOR(x5, U8TO32_LITTLE(m + 20));
+		x6 = XOR(x6, U8TO32_LITTLE(m + 24));
+		x7 = XOR(x7, U8TO32_LITTLE(m + 28));
+		x8 = XOR(x8, U8TO32_LITTLE(m + 32));
+		x9 = XOR(x9, U8TO32_LITTLE(m + 36));
+		x10 = XOR(x10, U8TO32_LITTLE(m + 40));
+		x11 = XOR(x11, U8TO32_LITTLE(m + 44));
+		x12 = XOR(x12, U8TO32_LITTLE(m + 48));
+		x13 = XOR(x13, U8TO32_LITTLE(m + 52));
+		x14 = XOR(x14, U8TO32_LITTLE(m + 56));
+		x15 = XOR(x15, U8TO32_LITTLE(m + 60));
+
+		j12 = PLUSONE(j12);
+		if (!j12) {
+			j13 = PLUSONE(j13);
+			/* stopping at 2^70 bytes per nonce is user's responsibility */
+		}
+
+		U32TO8_LITTLE(c + 0, x0);
+		U32TO8_LITTLE(c + 4, x1);
+		U32TO8_LITTLE(c + 8, x2);
+		U32TO8_LITTLE(c + 12, x3);
+		U32TO8_LITTLE(c + 16, x4);
+		U32TO8_LITTLE(c + 20, x5);
+		U32TO8_LITTLE(c + 24, x6);
+		U32TO8_LITTLE(c + 28, x7);
+		U32TO8_LITTLE(c + 32, x8);
+		U32TO8_LITTLE(c + 36, x9);
+		U32TO8_LITTLE(c + 40, x10);
+		U32TO8_LITTLE(c + 44, x11);
+		U32TO8_LITTLE(c + 48, x12);
+		U32TO8_LITTLE(c + 52, x13);
+		U32TO8_LITTLE(c + 56, x14);
+		U32TO8_LITTLE(c + 60, x15);
+
+		if (bytes <= 64) {
+			if (bytes < 64) {
+				for (i = 0; i < bytes; ++i)
+					ctarget[i] = c[i];
+			}
+			x->input[12] = j12;
+			x->input[13] = j13;
+			return;
+		}
+		bytes -= 64;
+		c += 64;
+		m += 64;
+	}
+}

src/chacha-poly1305/chacha.h

@@ -0,0 +1,24 @@
+/*
+chacha-merged.c version 20080118
+D. J. Bernstein
+Public domain.
+*/
+
+#ifndef CHACHA_H
+#define CHACHA_H
+
+struct chacha_ctx {
+	uint32_t input[16];
+};
+
+#define CHACHA_MINKEYLEN 	16
+#define CHACHA_NONCELEN		8
+#define CHACHA_CTRLEN		8
+#define CHACHA_STATELEN		(CHACHA_NONCELEN+CHACHA_CTRLEN)
+#define CHACHA_BLOCKLEN		64
+
+void chacha_keysetup(struct chacha_ctx *x, const uint8_t *k, uint32_t kbits);
+void chacha_ivsetup(struct chacha_ctx *x, const uint8_t *iv, const uint8_t *ctr);
+void chacha_encrypt_bytes(struct chacha_ctx *x, const uint8_t *m, uint8_t * c, uint32_t bytes);
+
+#endif /* CHACHA_H */

src/chacha-poly1305/poly1305.c

@@ -0,0 +1,197 @@
+/* 
+ * Public Domain poly1305 from Andrew Moon
+ * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
+ */
+
+#include "../system.h"
+
+#include "poly1305.h"
+
+#define mul32x32_64(a,b) ((uint64_t)(a) * (b))
+
+#define U8TO32_LE(p) \
+	(((uint32_t)((p)[0])) | \
+	 ((uint32_t)((p)[1]) <<  8) | \
+	 ((uint32_t)((p)[2]) << 16) | \
+	 ((uint32_t)((p)[3]) << 24))
+
+#define U32TO8_LE(p, v) \
+	do { \
+		(p)[0] = (uint8_t)((v)); \
+		(p)[1] = (uint8_t)((v) >>  8); \
+		(p)[2] = (uint8_t)((v) >> 16); \
+		(p)[3] = (uint8_t)((v) >> 24); \
+	} while (0)
+
+void
+poly1305_auth(unsigned char out[POLY1305_TAGLEN], const unsigned char *m, size_t inlen, const unsigned char key[POLY1305_KEYLEN])
+{
+	uint32_t t0, t1, t2, t3;
+	uint32_t h0, h1, h2, h3, h4;
+	uint32_t r0, r1, r2, r3, r4;
+	uint32_t s1, s2, s3, s4;
+	uint32_t b, nb;
+	size_t j;
+	uint64_t t[5];
+	uint64_t f0, f1, f2, f3;
+	uint32_t g0, g1, g2, g3, g4;
+	uint64_t c;
+	unsigned char mp[16];
+
+	/* clamp key */
+	t0 = U8TO32_LE(key + 0);
+	t1 = U8TO32_LE(key + 4);
+	t2 = U8TO32_LE(key + 8);
+	t3 = U8TO32_LE(key + 12);
+
+	/* precompute multipliers */
+	r0 = t0 & 0x3ffffff;
+	t0 >>= 26;
+	t0 |= t1 << 6;
+	r1 = t0 & 0x3ffff03;
+	t1 >>= 20;
+	t1 |= t2 << 12;
+	r2 = t1 & 0x3ffc0ff;
+	t2 >>= 14;
+	t2 |= t3 << 18;
+	r3 = t2 & 0x3f03fff;
+	t3 >>= 8;
+	r4 = t3 & 0x00fffff;
+
+	s1 = r1 * 5;
+	s2 = r2 * 5;
+	s3 = r3 * 5;
+	s4 = r4 * 5;
+
+	/* init state */
+	h0 = 0;
+	h1 = 0;
+	h2 = 0;
+	h3 = 0;
+	h4 = 0;
+
+	/* full blocks */
+	if (inlen < 16)
+		goto poly1305_donna_atmost15bytes;
+
+ poly1305_donna_16bytes:
+	m += 16;
+	inlen -= 16;
+
+	t0 = U8TO32_LE(m - 16);
+	t1 = U8TO32_LE(m - 12);
+	t2 = U8TO32_LE(m - 8);
+	t3 = U8TO32_LE(m - 4);
+
+	h0 += t0 & 0x3ffffff;
+	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
+	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
+	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
+	h4 += (t3 >> 8) | (1 << 24);
+
+ poly1305_donna_mul:
+	t[0] = mul32x32_64(h0, r0) + mul32x32_64(h1, s4) + mul32x32_64(h2, s3) + mul32x32_64(h3, s2) + mul32x32_64(h4, s1);
+	t[1] = mul32x32_64(h0, r1) + mul32x32_64(h1, r0) + mul32x32_64(h2, s4) + mul32x32_64(h3, s3) + mul32x32_64(h4, s2);
+	t[2] = mul32x32_64(h0, r2) + mul32x32_64(h1, r1) + mul32x32_64(h2, r0) + mul32x32_64(h3, s4) + mul32x32_64(h4, s3);
+	t[3] = mul32x32_64(h0, r3) + mul32x32_64(h1, r2) + mul32x32_64(h2, r1) + mul32x32_64(h3, r0) + mul32x32_64(h4, s4);
+	t[4] = mul32x32_64(h0, r4) + mul32x32_64(h1, r3) + mul32x32_64(h2, r2) + mul32x32_64(h3, r1) + mul32x32_64(h4, r0);
+
+	h0 = (uint32_t) t[0] & 0x3ffffff;
+	c = (t[0] >> 26);
+	t[1] += c;
+	h1 = (uint32_t) t[1] & 0x3ffffff;
+	b = (uint32_t) (t[1] >> 26);
+	t[2] += b;
+	h2 = (uint32_t) t[2] & 0x3ffffff;
+	b = (uint32_t) (t[2] >> 26);
+	t[3] += b;
+	h3 = (uint32_t) t[3] & 0x3ffffff;
+	b = (uint32_t) (t[3] >> 26);
+	t[4] += b;
+	h4 = (uint32_t) t[4] & 0x3ffffff;
+	b = (uint32_t) (t[4] >> 26);
+	h0 += b * 5;
+
+	if (inlen >= 16)
+		goto poly1305_donna_16bytes;
+
+	/* final bytes */
+ poly1305_donna_atmost15bytes:
+	if (!inlen)
+		goto poly1305_donna_finish;
+
+	for (j = 0; j < inlen; j++)
+		mp[j] = m[j];
+	mp[j++] = 1;
+	for (; j < 16; j++)
+		mp[j] = 0;
+	inlen = 0;
+
+	t0 = U8TO32_LE(mp + 0);
+	t1 = U8TO32_LE(mp + 4);
+	t2 = U8TO32_LE(mp + 8);
+	t3 = U8TO32_LE(mp + 12);
+
+	h0 += t0 & 0x3ffffff;
+	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
+	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
+	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
+	h4 += (t3 >> 8);
+
+	goto poly1305_donna_mul;
+
+ poly1305_donna_finish:
+	b = h0 >> 26;
+	h0 = h0 & 0x3ffffff;
+	h1 += b;
+	b = h1 >> 26;
+	h1 = h1 & 0x3ffffff;
+	h2 += b;
+	b = h2 >> 26;
+	h2 = h2 & 0x3ffffff;
+	h3 += b;
+	b = h3 >> 26;
+	h3 = h3 & 0x3ffffff;
+	h4 += b;
+	b = h4 >> 26;
+	h4 = h4 & 0x3ffffff;
+	h0 += b * 5;
+	b = h0 >> 26;
+	h0 = h0 & 0x3ffffff;
+	h1 += b;
+
+	g0 = h0 + 5;
+	b = g0 >> 26;
+	g0 &= 0x3ffffff;
+	g1 = h1 + b;
+	b = g1 >> 26;
+	g1 &= 0x3ffffff;
+	g2 = h2 + b;
+	b = g2 >> 26;
+	g2 &= 0x3ffffff;
+	g3 = h3 + b;
+	b = g3 >> 26;
+	g3 &= 0x3ffffff;
+	g4 = h4 + b - (1 << 26);
+
+	b = (g4 >> 31) - 1;
+	nb = ~b;
+	h0 = (h0 & nb) | (g0 & b);
+	h1 = (h1 & nb) | (g1 & b);
+	h2 = (h2 & nb) | (g2 & b);
+	h3 = (h3 & nb) | (g3 & b);
+	h4 = (h4 & nb) | (g4 & b);
+
+	f0 = ((h0) | (h1 << 26)) + (uint64_t) U8TO32_LE(&key[16]);
+	f1 = ((h1 >> 6) | (h2 << 20)) + (uint64_t) U8TO32_LE(&key[20]);
+	f2 = ((h2 >> 12) | (h3 << 14)) + (uint64_t) U8TO32_LE(&key[24]);
+	f3 = ((h3 >> 18) | (h4 << 8)) + (uint64_t) U8TO32_LE(&key[28]);
+
+	U32TO8_LE(&out[0], f0);
+	f1 += (f0 >> 32);
+	U32TO8_LE(&out[4], f1);
+	f2 += (f1 >> 32);
+	U32TO8_LE(&out[8], f2);
+	f3 += (f2 >> 32);
+	U32TO8_LE(&out[12], f3);
+}

src/chacha-poly1305/poly1305.h

@@ -0,0 +1,16 @@
+/* $OpenBSD: poly1305.h,v 1.2 2013/12/19 22:57:13 djm Exp $ */
+
+/* 
+ * Public Domain poly1305 from Andrew Moon
+ * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
+ */
+
+#ifndef POLY1305_H
+#define POLY1305_H
+
+#define POLY1305_KEYLEN		32
+#define POLY1305_TAGLEN		16
+
+void poly1305_auth(uint8_t out[POLY1305_TAGLEN], const uint8_t *m, size_t inlen, const uint8_t key[POLY1305_KEYLEN]);
+
+#endif				/* POLY1305_H */

src/cipher.h

@@ -0,0 +1,47 @@
+/*
+    cipher.h -- header file cipher.c
+    Copyright (C) 2007-2016 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_CIPHER_H__
+#define __TINC_CIPHER_H__
+
+#define CIPHER_MAX_BLOCK_SIZE 32
+#define CIPHER_MAX_IV_SIZE 16
+#define CIPHER_MAX_KEY_SIZE 32
+
+#ifndef DISABLE_LEGACY
+
+typedef struct cipher cipher_t;
+
+extern cipher_t *cipher_open_by_name(const char *) __attribute__ ((__malloc__));
+extern cipher_t *cipher_open_by_nid(int) __attribute__ ((__malloc__));
+extern void cipher_close(cipher_t *);
+extern size_t cipher_keylength(const cipher_t *);
+extern size_t cipher_blocksize(const cipher_t *);
+extern uint64_t cipher_budget(const cipher_t *);
+extern void cipher_get_key(const cipher_t *, void *);
+extern bool cipher_set_key(cipher_t *, void *, bool) __attribute__ ((__warn_unused_result__));
+extern bool cipher_set_key_from_rsa(cipher_t *, void *, size_t, bool) __attribute__ ((__warn_unused_result__));
+extern bool cipher_encrypt(cipher_t *, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__ ((__warn_unused_result__));
+extern bool cipher_decrypt(cipher_t *, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__ ((__warn_unused_result__));
+extern int cipher_get_nid(const cipher_t *);
+extern bool cipher_active(const cipher_t *);
+
+#endif
+
+#endif

src/conf.c

@@ -1,10 +1,11 @@
 /*
     conf.c -- configuration code
-    Copyright (C) 1998 Robert van der Meulen
+    Copyright (C) 1998      Robert van der Meulen
                   1998-2005 Ivo Timmermans
-                  2000-2014 Guus Sliepen <guus@tinc-vpn.org>
+                  2000      Cris van Pelt
                   2010-2011 Julien Muchembled <jm@jmuchemb.eu>
-                  2000 Cris van Pelt
+                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
+                  2013      Florent Clairambault <florent@clairambault.fr>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -23,107 +24,104 @@
 
 #include "system.h"
 
-#include "avl_tree.h"
+#include "splay_tree.h"
 #include "connection.h"
 #include "conf.h"
 #include "list.h"
 #include "logger.h"
-#include "netutl.h"                             /* for str2address */
+#include "names.h"
+#include "netutl.h"             /* for str2address */
 #include "protocol.h"
-#include "utils.h"                              /* for cp */
+#include "utils.h"              /* for cp */
 #include "xalloc.h"
 
-avl_tree_t *config_tree;
+splay_tree_t *config_tree;
 
-int pinginterval = 0;                   /* seconds between pings */
-int pingtimeout = 0;                    /* seconds to wait for response */
-char *confbase = NULL;                  /* directory in which all config files are */
-char *netname = NULL;                   /* name of the vpn network */
+int pinginterval = 0;           /* seconds between pings */
+int pingtimeout = 0;            /* seconds to wait for response */
 list_t *cmdline_conf = NULL;    /* global/host configuration values given at the command line */
 
-
 static int config_compare(const config_t *a, const config_t *b) {
 	int result;
 
 	result = strcasecmp(a->variable, b->variable);
 
-	if(result) {
+	if(result)
 		return result;
-	}
 
 	/* give priority to command line options */
 	result = !b->file - !a->file;
-
-	if(result) {
+	if (result)
 		return result;
-	}
 
 	result = a->line - b->line;
 
-	if(result) {
+	if(result)
 		return result;
-	} else {
+	else
 		return a->file ? strcmp(a->file, b->file) : 0;
-	}
 }
 
-void init_configuration(avl_tree_t **config_tree) {
-	*config_tree = avl_alloc_tree((avl_compare_t) config_compare, (avl_action_t) free_config);
+void init_configuration(splay_tree_t ** config_tree) {
+	*config_tree = splay_alloc_tree((splay_compare_t) config_compare, (splay_action_t) free_config);
 }
 
-void exit_configuration(avl_tree_t **config_tree) {
-	avl_delete_tree(*config_tree);
+void exit_configuration(splay_tree_t ** config_tree) {
+	splay_delete_tree(*config_tree);
 	*config_tree = NULL;
 }
 
 config_t *new_config(void) {
-	return xmalloc_and_zero(sizeof(config_t));
+	return xzalloc(sizeof(config_t));
 }
 
 void free_config(config_t *cfg) {
-	free(cfg->variable);
-	free(cfg->value);
-	free(cfg->file);
+	if(cfg->variable)
+		free(cfg->variable);
+
+	if(cfg->value)
+		free(cfg->value);
+
+	if(cfg->file)
+		free(cfg->file);
+
 	free(cfg);
 }
 
-void config_add(avl_tree_t *config_tree, config_t *cfg) {
-	avl_insert(config_tree, cfg);
+void config_add(splay_tree_t *config_tree, config_t *cfg) {
+	splay_insert(config_tree, cfg);
 }
 
-config_t *lookup_config(const avl_tree_t *config_tree, char *variable) {
+config_t *lookup_config(splay_tree_t *config_tree, char *variable) {
 	config_t cfg, *found;
 
 	cfg.variable = variable;
 	cfg.file = NULL;
 	cfg.line = 0;
 
-	found = avl_search_closest_greater(config_tree, &cfg);
+	found = splay_search_closest_greater(config_tree, &cfg);
 
-	if(!found) {
+	if(!found)
 		return NULL;
-	}
 
-	if(strcasecmp(found->variable, variable)) {
+	if(strcasecmp(found->variable, variable))
 		return NULL;
-	}
 
 	return found;
 }
 
-config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg) {
-	avl_node_t *node;
+config_t *lookup_config_next(splay_tree_t *config_tree, const config_t *cfg) {
+	splay_node_t *node;
 	config_t *found;
 
-	node = avl_search_node(config_tree, cfg);
+	node = splay_search_node(config_tree, cfg);
 
 	if(node) {
 		if(node->next) {
 			found = node->next->data;
 
-			if(!strcasecmp(found->variable, cfg->variable)) {
+			if(!strcasecmp(found->variable, cfg->variable))
 				return found;
-			}
 		}
 	}
 
@@ -131,9 +129,8 @@ config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg)
 }
 
 bool get_config_bool(const config_t *cfg, bool *result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
-	}
 
 	if(!strcasecmp(cfg->value, "yes")) {
 		*result = true;
@@ -143,31 +140,28 @@ bool get_config_bool(const config_t *cfg, bool *result) {
 		return true;
 	}
 
-	logger(LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+	logger(DEBUG_ALWAYS, LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
+		   cfg->variable, cfg->file, cfg->line);
 
 	return false;
 }
 
 bool get_config_int(const config_t *cfg, int *result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
-	}
 
-	if(sscanf(cfg->value, "%d", result) == 1) {
+	if(sscanf(cfg->value, "%d", result) == 1)
 		return true;
-	}
 
-	logger(LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+	logger(DEBUG_ALWAYS, LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
+		   cfg->variable, cfg->file, cfg->line);
 
 	return false;
 }
 
 bool get_config_string(const config_t *cfg, char **result) {
-	if(!cfg) {
+	if(!cfg)
 		return false;
-	}
 
 	*result = xstrdup(cfg->value);
 
@@ -177,9 +171,8 @@ bool get_config_string(const config_t *cfg, char **result) {
 bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 	struct addrinfo *ai;
 
-	if(!cfg) {
+	if(!cfg)
 		return false;
-	}
 
 	ai = str2addrinfo(cfg->value, NULL, 0);
 
@@ -188,33 +181,32 @@ bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 		return true;
 	}
 
-	logger(LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
-	       cfg->variable, cfg->file, cfg->line);
+	logger(DEBUG_ALWAYS, LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
+		   cfg->variable, cfg->file, cfg->line);
 
 	return false;
 }
 
-bool get_config_subnet(const config_t *cfg, subnet_t **result) {
-	subnet_t subnet = {0};
+bool get_config_subnet(const config_t *cfg, subnet_t ** result) {
+	subnet_t subnet = {NULL};
 
-	if(!cfg) {
+	if(!cfg)
 		return false;
-	}
 
 	if(!str2net(&subnet, cfg->value)) {
-		logger(LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
-		       cfg->variable, cfg->file, cfg->line);
+		logger(DEBUG_ALWAYS, LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
+			   cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
 
 	/* Teach newbies what subnets are... */
 
 	if(((subnet.type == SUBNET_IPV4)
-	                && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(ipv4_t)))
-	                || ((subnet.type == SUBNET_IPV6)
-	                    && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(ipv6_t)))) {
-		logger(LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
-		       cfg->variable, cfg->file, cfg->line);
+		&& !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof subnet.net.ipv4.address))
+		|| ((subnet.type == SUBNET_IPV6)
+		&& !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof subnet.net.ipv6.address))) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
+			   cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
 
@@ -226,31 +218,27 @@ bool get_config_subnet(const config_t *cfg, subnet_t **result) {
 /*
   Read exactly one line and strip the trailing newline if any.
 */
-static char *readline(FILE *fp, char *buf, size_t buflen) {
+static char *readline(FILE * fp, char *buf, size_t buflen) {
 	char *newline = NULL;
 	char *p;
 
-	if(feof(fp)) {
+	if(feof(fp))
 		return NULL;
-	}
 
 	p = fgets(buf, buflen, fp);
 
-	if(!p) {
+	if(!p)
 		return NULL;
-	}
 
 	newline = strchr(p, '\n');
 
-	if(!newline) {
+	if(!newline)
 		return buf;
-	}
 
-	*newline = '\0';        /* kill newline */
-
-	if(newline > p && newline[-1] == '\r') { /* and carriage return if necessary */
+	/* kill newline and carriage return if necessary */
+	*newline = '\0';
+	if(newline > p && newline[-1] == '\r')
 		newline[-1] = '\0';
-	}
 
 	return buf;
 }
@@ -262,32 +250,26 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
 	variable = value = line;
 
 	eol = line + strlen(line);
-
-	while(strchr("\t ", *--eol)) {
+	while(strchr("\t ", *--eol))
 		*eol = '\0';
-	}
 
 	len = strcspn(value, "\t =");
 	value += len;
 	value += strspn(value, "\t ");
-
 	if(*value == '=') {
 		value++;
 		value += strspn(value, "\t ");
 	}
-
 	variable[len] = '\0';
 
 	if(!*value) {
 		const char err[] = "No value for variable";
-
-		if(fname)
-			logger(LOG_ERR, "%s `%s' on line %d while reading config file %s",
-			       err, variable, lineno, fname);
+		if (fname)
+			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' on line %d while reading config file %s",
+				err, variable, lineno, fname);
 		else
-			logger(LOG_ERR, "%s `%s' in command line option %d",
-			       err, variable, lineno);
-
+			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' in command line option %d",
+				err, variable, lineno);
 		return NULL;
 	}
 
@@ -304,7 +286,7 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
   Parse a configuration file and put the results in the configuration tree
   starting at *base.
 */
-bool read_config_file(avl_tree_t *config_tree, const char *fname) {
+bool read_config_file(splay_tree_t *config_tree, const char *fname) {
 	FILE *fp;
 	char buffer[MAX_STRING_SIZE];
 	char *line;
@@ -316,32 +298,27 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 	fp = fopen(fname, "r");
 
 	if(!fp) {
-		logger(LOG_ERR, "Cannot open config file %s: %s", fname, strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Cannot open config file %s: %s", fname, strerror(errno));
 		return false;
 	}
 
 	for(;;) {
-		line = readline(fp, buffer, sizeof(buffer));
+		line = readline(fp, buffer, sizeof buffer);
 
 		if(!line) {
-			if(feof(fp)) {
+			if(feof(fp))
 				result = true;
-			}
-
 			break;
 		}
 
 		lineno++;
 
-		if(!*line || *line == '#') {
+		if(!*line || *line == '#')
 			continue;
-		}
 
 		if(ignore) {
-			if(!strncmp(line, "-----END", 8)) {
+			if(!strncmp(line, "-----END", 8))
 				ignore = false;
-			}
-
 			continue;
 		}
 
@@ -351,11 +328,8 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 		}
 
 		cfg = parse_config_line(line, fname, lineno);
-
-		if(!cfg) {
+		if (!cfg)
 			break;
-		}
-
 		config_add(config_tree, cfg);
 	}
 
@@ -364,31 +338,27 @@ bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 	return result;
 }
 
-void read_config_options(avl_tree_t *config_tree, const char *prefix) {
+void read_config_options(splay_tree_t *config_tree, const char *prefix) {
 	size_t prefix_len = prefix ? strlen(prefix) : 0;
 
 	for(const list_node_t *node = cmdline_conf->tail; node; node = node->prev) {
 		const config_t *cfg = node->data;
+		config_t *new;
 
 		if(!prefix) {
-			if(strchr(cfg->variable, '.')) {
+			if(strchr(cfg->variable, '.'))
 				continue;
-			}
 		} else {
 			if(strncmp(prefix, cfg->variable, prefix_len) ||
-			                cfg->variable[prefix_len] != '.') {
+			   cfg->variable[prefix_len] != '.')
 				continue;
-			}
 		}
 
-		config_t *new = new_config();
-
-		if(prefix) {
+		new = new_config();
+		if(prefix)
 			new->variable = xstrdup(cfg->variable + prefix_len + 1);
-		} else {
+		else
 			new->variable = xstrdup(cfg->variable);
-		}
-
 		new->value = xstrdup(cfg->value);
 		new->file = NULL;
 		new->line = cfg->line;
@@ -403,200 +373,61 @@ bool read_server_config(void) {
 
 	read_config_options(config_tree, NULL);
 
-	snprintf(fname, sizeof(fname), "%s/tinc.conf", confbase);
+	snprintf(fname, sizeof fname, "%s" SLASH "tinc.conf", confbase);
 	errno = 0;
 	x = read_config_file(config_tree, fname);
 
 	// We will try to read the conf files in the "conf.d" dir
-	if(x) {
+	if (x) {
 		char dname[PATH_MAX];
-		snprintf(dname, sizeof(dname), "%s/conf.d", confbase);
-		DIR *dir = opendir(dname);
-
+		snprintf(dname, sizeof dname, "%s" SLASH "conf.d", confbase);
+		DIR *dir = opendir (dname);
 		// If we can find this dir
-		if(dir) {
+		if (dir) { 
 			struct dirent *ep;
-
 			// We list all the files in it
-			while(x && (ep = readdir(dir))) {
+			while (x && (ep = readdir (dir))) {
 				size_t l = strlen(ep->d_name);
-
 				// And we try to read the ones that end with ".conf"
-				if(l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
-					if((size_t)snprintf(fname, sizeof(fname), "%s/%s", dname, ep->d_name) >= sizeof(fname)) {
-						logger(LOG_ERR, "Pathname too long: %s/%s", dname, ep->d_name);
-						return false;
-					}
-
+				if (l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
+					snprintf(fname, sizeof fname, "%s" SLASH "%s", dname, ep->d_name);
 					x = read_config_file(config_tree, fname);
 				}
 			}
-
-			closedir(dir);
+			closedir (dir);
 		}
 	}
 
-	if(!x && errno) {
-		logger(LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
-	}
+	if(!x && errno)
+		logger(DEBUG_ALWAYS, LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
 
 	return x;
 }
 
-bool read_connection_config(connection_t *c) {
+bool read_host_config(splay_tree_t *config_tree, const char *name) {
 	char fname[PATH_MAX];
 	bool x;
 
-	read_config_options(c->config_tree, c->name);
+	read_config_options(config_tree, name);
 
-	snprintf(fname, sizeof(fname), "%s/hosts/%s", confbase, c->name);
-	x = read_config_file(c->config_tree, fname);
+	snprintf(fname, sizeof fname, "%s" SLASH "hosts" SLASH "%s", confbase, name);
+	x = read_config_file(config_tree, fname);
 
 	return x;
 }
 
-static void disable_old_keys(const char *filename) {
-	char tmpfile[PATH_MAX] = "";
-	char buf[1024];
-	bool disabled = false;
-	FILE *r, *w;
+bool append_config_file(const char *name, const char *key, const char *value) {
+	char fname[PATH_MAX];
+	snprintf(fname, sizeof fname, "%s" SLASH "hosts" SLASH "%s", confbase, name);
 
-	r = fopen(filename, "r");
+	FILE *fp = fopen(fname, "a");
 
-	if(!r) {
-		return;
+	if(!fp) {
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Cannot open config file %s: %s", fname, strerror(errno));
+		return false;
 	}
 
-	int len = snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
-
-	if(len < 0 || len >= PATH_MAX) {
-		fprintf(stderr, "Pathname too long: %s.tmp\n", filename);
-		w = NULL;
-	} else {
-		w = fopen(tmpfile, "w");
-	}
-
-	while(fgets(buf, sizeof(buf), r)) {
-		if(!strncmp(buf, "-----BEGIN RSA", 14)) {
-			buf[11] = 'O';
-			buf[12] = 'L';
-			buf[13] = 'D';
-			disabled = true;
-		} else if(!strncmp(buf, "-----END RSA", 12)) {
-			buf[ 9] = 'O';
-			buf[10] = 'L';
-			buf[11] = 'D';
-			disabled = true;
-		}
-
-		if(w && fputs(buf, w) < 0) {
-			disabled = false;
-			break;
-		}
-	}
-
-	if(w) {
-		fclose(w);
-	}
-
-	fclose(r);
-
-	if(!w && disabled) {
-		fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
-		return;
-	}
-
-	if(disabled) {
-#ifdef HAVE_MINGW
-		// We cannot atomically replace files on Windows.
-		char bakfile[PATH_MAX] = "";
-		snprintf(bakfile, sizeof(bakfile), "%s.bak", filename);
-
-		if(rename(filename, bakfile) || rename(tmpfile, filename)) {
-			rename(bakfile, filename);
-#else
-
-		if(rename(tmpfile, filename)) {
-#endif
-			fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
-		} else  {
-#ifdef HAVE_MINGW
-			unlink(bakfile);
-#endif
-			fprintf(stderr, "Warning: old key(s) found and disabled.\n");
-		}
-	}
-
-	unlink(tmpfile);
+	fprintf(fp, "\n# The following line was automatically added by tinc\n%s = %s\n", key, value);
+	fclose(fp);
+	return true;
 }
-
-FILE *ask_and_open(const char *filename, const char *what) {
-	FILE *r;
-	char directory[PATH_MAX];
-	char line[PATH_MAX];
-	char abspath[PATH_MAX];
-	const char *fn;
-
-	/* Check stdin and stdout */
-	if(!isatty(0) || !isatty(1)) {
-		/* Argh, they are running us from a script or something.  Write
-		   the files to the current directory and let them burn in hell
-		   for ever. */
-		fn = filename;
-	} else {
-		/* Ask for a file and/or directory name. */
-		fprintf(stdout, "Please enter a file to save %s to [%s]: ",
-		        what, filename);
-		fflush(stdout);
-
-		fn = readline(stdin, line, sizeof(line));
-
-		if(!fn) {
-			fprintf(stderr, "Error while reading stdin: %s\n",
-			        strerror(errno));
-			return NULL;
-		}
-
-		if(!strlen(fn))
-			/* User just pressed enter. */
-		{
-			fn = filename;
-		}
-	}
-
-#ifdef HAVE_MINGW
-
-	if(fn[0] != '\\' && fn[0] != '/' && !strchr(fn, ':')) {
-#else
-
-	if(fn[0] != '/') {
-#endif
-		/* The directory is a relative path or a filename. */
-		getcwd(directory, sizeof(directory));
-
-		if((size_t)snprintf(abspath, sizeof(abspath), "%s/%s", directory, fn) >= sizeof(abspath)) {
-			fprintf(stderr, "Pathname too long: %s/%s\n", directory, fn);
-			return NULL;
-		}
-
-		fn = abspath;
-	}
-
-	umask(0077);                            /* Disallow everything for group and other */
-
-	disable_old_keys(fn);
-
-	/* Open it first to keep the inode busy */
-
-	r = fopen(fn, "a");
-
-	if(!r) {
-		fprintf(stderr, "Error opening file `%s': %s\n",
-		        fn, strerror(errno));
-		return NULL;
-	}
-
-	return r;
-}
-
-

src/conf.h

@@ -1,10 +1,7 @@
-#ifndef TINC_CONF_H
-#define TINC_CONF_H
-
 /*
     conf.h -- header for conf.c
     Copyright (C) 1998-2005 Ivo Timmermans
-                  2000-2012 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2013 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -21,8 +18,12 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
-#include "avl_tree.h"
+#ifndef __TINC_CONF_H__
+#define __TINC_CONF_H__
+
 #include "list.h"
+#include "splay_tree.h"
+#include "subnet.h"
 
 typedef struct config_t {
 	char *variable;
@@ -31,37 +32,33 @@ typedef struct config_t {
 	int line;
 } config_t;
 
-#include "subnet.h"
 
-extern avl_tree_t *config_tree;
+extern splay_tree_t *config_tree;
 
 extern int pinginterval;
 extern int pingtimeout;
 extern int maxtimeout;
-extern int mintimeout;
 extern bool bypass_security;
-extern char *confbase;
-extern char *netname;
 extern list_t *cmdline_conf;
 
-extern void init_configuration(avl_tree_t **config_tree);
-extern void exit_configuration(avl_tree_t **config_tree);
-extern config_t *new_config(void) __attribute__((__malloc__));
-extern void free_config(config_t *cfg);
-extern void config_add(avl_tree_t *config_tree, config_t *cfg);
-extern config_t *lookup_config(const avl_tree_t *config_tree, char *variable);
-extern config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg);
-extern bool get_config_bool(const config_t *cfg, bool *result);
-extern bool get_config_int(const config_t *cfg, int *result);
-extern bool get_config_string(const config_t *cfg, char **result);
-extern bool get_config_address(const config_t *cfg, struct addrinfo **result);
-extern bool get_config_subnet(const config_t *cfg, struct subnet_t **result);
+extern void init_configuration(splay_tree_t **);
+extern void exit_configuration(splay_tree_t **);
+extern config_t *new_config(void) __attribute__ ((__malloc__));
+extern void free_config(config_t *);
+extern void config_add(splay_tree_t *, config_t *);
+extern config_t *lookup_config(splay_tree_t *, char *);
+extern config_t *lookup_config_next(splay_tree_t *, const config_t *);
+extern bool get_config_bool(const config_t *, bool *);
+extern bool get_config_int(const config_t *, int *);
+extern bool get_config_string(const config_t *, char **);
+extern bool get_config_address(const config_t *, struct addrinfo **);
+extern bool get_config_subnet(const config_t *, struct subnet_t **);
 
-extern config_t *parse_config_line(char *line, const char *fname, int lineno);
-extern bool read_config_file(avl_tree_t *config_tree, const char *fname);
-extern void read_config_options(avl_tree_t *config_tree, const char *prefix);
+extern config_t *parse_config_line(char *, const char *, int);
+extern bool read_config_file(splay_tree_t *, const char *);
+extern void read_config_options(splay_tree_t *, const char *);
 extern bool read_server_config(void);
-extern bool read_connection_config(struct connection_t *c);
-extern FILE *ask_and_open(const char *fname, const char *what);
+extern bool read_host_config(splay_tree_t *, const char *);
+extern bool append_config_file(const char *, const char *, const char *);
 
-#endif
+#endif /* __TINC_CONF_H__ */

src/connection.c

@@ -1,6 +1,6 @@
 /*
     connection.c -- connection list management
-    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
                   2008      Max Rijevski <maksuf@gmail.com>
 
@@ -21,131 +21,85 @@
 
 #include "system.h"
 
-#include "avl_tree.h"
+#include "list.h"
+#include "cipher.h"
 #include "conf.h"
+#include "control_common.h"
+#include "list.h"
 #include "logger.h"
+#include "rsa.h"
 #include "subnet.h"
 #include "utils.h"
 #include "xalloc.h"
 
-avl_tree_t *connection_tree;    /* Meta connections */
+list_t *connection_list;
 connection_t *everyone;
 
-static int connection_compare(const connection_t *a, const connection_t *b) {
-	return a < b ? -1 : a == b ? 0 : 1;
-}
-
 void init_connections(void) {
-	connection_tree = avl_alloc_tree((avl_compare_t) connection_compare, (avl_action_t) free_connection);
+	connection_list = list_alloc((list_action_t) free_connection);
 	everyone = new_connection();
 	everyone->name = xstrdup("everyone");
 	everyone->hostname = xstrdup("BROADCAST");
 }
 
 void exit_connections(void) {
-	avl_delete_tree(connection_tree);
+	list_delete_list(connection_list);
 	free_connection(everyone);
 }
 
 connection_t *new_connection(void) {
-	connection_t *c;
-
-	c = xmalloc_and_zero(sizeof(connection_t));
-
-	if(!c) {
-		return NULL;
-	}
-
-	gettimeofday(&c->start, NULL);
-
-	return c;
-}
-
-void free_connection_partially(connection_t *c) {
-	free(c->inkey);
-	free(c->outkey);
-	free(c->mychallenge);
-	free(c->hischallenge);
-	free(c->outbuf);
-
-	c->inkey = NULL;
-	c->outkey = NULL;
-	c->mychallenge = NULL;
-	c->hischallenge = NULL;
-	c->outbuf = NULL;
-
-	c->status.pinged = false;
-	c->status.active = false;
-	c->status.connecting = false;
-	c->status.timeout = false;
-	c->status.encryptout = false;
-	c->status.decryptin = false;
-	c->status.mst = false;
-
-	c->options = 0;
-	c->buflen = 0;
-	c->reqlen = 0;
-	c->tcplen = 0;
-	c->allow_request = 0;
-	c->outbuflen = 0;
-	c->outbufsize = 0;
-	c->outbufstart = 0;
-	c->last_ping_time = 0;
-	c->last_flushed_time = 0;
-	c->inbudget = 0;
-	c->outbudget = 0;
-
-	if(c->inctx) {
-		EVP_CIPHER_CTX_reset(c->inctx);
-		free(c->inctx);
-		c->inctx = NULL;
-	}
-
-	if(c->outctx) {
-		EVP_CIPHER_CTX_reset(c->outctx);
-		free(c->outctx);
-		c->outctx = NULL;
-	}
-
-	if(c->rsa_key) {
-		RSA_free(c->rsa_key);
-		c->rsa_key = NULL;
-	}
+	return xzalloc(sizeof(connection_t));
 }
 
 void free_connection(connection_t *c) {
-	free_connection_partially(c);
+	if(!c)
+		return;
+
+#ifndef DISABLE_LEGACY
+	cipher_close(c->incipher);
+	digest_close(c->indigest);
+	cipher_close(c->outcipher);
+	digest_close(c->outdigest);
+	rsa_free(c->rsa);
+#endif
+
+	sptps_stop(&c->sptps);
+	ecdsa_free(c->ecdsa);
+
+	free(c->hischallenge);
+
+	buffer_clear(&c->inbuf);
+	buffer_clear(&c->outbuf);
+
+	io_del(&c->io);
+
+	if(c->socket > 0)
+		closesocket(c->socket);
 
 	free(c->name);
 	free(c->hostname);
 
-	if(c->config_tree) {
+	if(c->config_tree)
 		exit_configuration(&c->config_tree);
-	}
 
 	free(c);
 }
 
 void connection_add(connection_t *c) {
-	avl_insert(connection_tree, c);
+	list_insert_tail(connection_list, c);
 }
 
 void connection_del(connection_t *c) {
-	avl_delete(connection_tree, c);
+	list_delete(connection_list, c);
 }
 
-void dump_connections(void) {
-	avl_node_t *node;
-	connection_t *c;
-
-	logger(LOG_DEBUG, "Connections:");
-
-	for(node = connection_tree->head; node; node = node->next) {
-		c = node->data;
-		logger(LOG_DEBUG, " %s at %s options %x socket %d status %04x outbuf %d/%d/%d",
-		       c->name, c->hostname, c->options, c->socket, bitfield_to_int(&c->status, sizeof(c->status)),
-		       c->outbufsize, c->outbufstart, c->outbuflen);
+bool dump_connections(connection_t *cdump) {
+	for list_each(connection_t, c, connection_list) {
+		send_request(cdump, "%d %d %s %s %x %d %x",
+				CONTROL, REQ_DUMP_CONNECTIONS,
+				c->name, c->hostname, c->options, c->socket,
+				bitfield_to_int(&c->status, sizeof c->status));
 	}
 
-	logger(LOG_DEBUG, "End of connections.");
+	return send_request(cdump, "%d %d", CONTROL, REQ_DUMP_CONNECTIONS);
 }

src/connection.h

@@ -1,9 +1,6 @@
-#ifndef TINC_CONNECTION_H
-#define TINC_CONNECTION_H
-
 /*
     connection.h -- header for connection.c
-    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
 
     This program is free software; you can redistribute it and/or modify
@@ -21,45 +18,52 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
-#include <openssl/rsa.h>
-#include <openssl/evp.h>
+#ifndef __TINC_CONNECTION_H__
+#define __TINC_CONNECTION_H__
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define EVP_CIPHER_CTX_reset(c) EVP_CIPHER_CTX_cleanup(c)
-#endif
-
-#include "avl_tree.h"
+#include "buffer.h"
+#include "cipher.h"
+#include "digest.h"
+#include "rsa.h"
+#include "list.h"
+#include "sptps.h"
 
 #define OPTION_INDIRECT         0x0001
 #define OPTION_TCPONLY          0x0002
 #define OPTION_PMTU_DISCOVERY   0x0004
 #define OPTION_CLAMP_MSS        0x0008
+#define OPTION_VERSION(x) ((x) >> 24) /* Top 8 bits are for protocol minor version */
 
 typedef struct connection_status_t {
-	unsigned int pinged: 1;         /* sent ping */
-	unsigned int active: 1;         /* 1 if active.. */
-	unsigned int connecting: 1;     /* 1 if we are waiting for a non-blocking connect() to finish */
-	unsigned int unused_termreq: 1; /* the termination of this connection was requested */
-	unsigned int remove: 1;         /* Set to 1 if you want this connection removed */
-	unsigned int timeout: 1;        /* 1 if gotten timeout */
-	unsigned int encryptout: 1;     /* 1 if we can encrypt outgoing traffic */
-	unsigned int decryptin: 1;      /* 1 if we have to decrypt incoming traffic */
-	unsigned int mst: 1;            /* 1 if this connection is part of a minimum spanning tree */
-	unsigned int proxy_passed: 1;   /* 1 if we are connecting via a proxy and we have finished talking with it */
-	unsigned int tarpit: 1;         /* 1 if the connection should be added to the tarpit */
-	unsigned int unused: 21;
+		unsigned int pinged:1;                  /* sent ping */
+		unsigned int unused_active:1;
+		unsigned int connecting:1;              /* 1 if we are waiting for a non-blocking connect() to finish */
+		unsigned int unused_termreq:1;          /* the termination of this connection was requested */
+		unsigned int remove_unused:1;           /* Set to 1 if you want this connection removed */
+		unsigned int timeout_unused:1;          /* 1 if gotten timeout */
+		unsigned int encryptout:1;              /* 1 if we can encrypt outgoing traffic */
+		unsigned int decryptin:1;               /* 1 if we have to decrypt incoming traffic */
+		unsigned int mst:1;                     /* 1 if this connection is part of a minimum spanning tree */
+		unsigned int control:1;                 /* 1 if this is a control connection */
+		unsigned int pcap:1;                    /* 1 if this is a control connection requesting packet capture */
+		unsigned int log:1;                     /* 1 if this is a control connection requesting log dump */
+		unsigned int invitation:1;              /* 1 if this is an invitation */
+		unsigned int invitation_used:1;         /* 1 if the invitation has been consumed */
+		unsigned int unused:18;
 } connection_status_t;
 
+#include "ecdsa.h"
 #include "edge.h"
 #include "net.h"
 #include "node.h"
 
 typedef struct connection_t {
 	char *name;                     /* name he claims to have */
+	char *hostname;                 /* the hostname of its real ip */
 
 	union sockaddr_t address;       /* his real (internet) ip */
-	char *hostname;                 /* the hostname of its real ip */
-	int protocol_version;           /* used protocol */
+	int protocol_major;             /* used protocol */
+	int protocol_minor;             /* used protocol */
 
 	int socket;                     /* socket used for this connection */
 	uint32_t options;               /* options for this connection */
@@ -71,53 +75,47 @@ typedef struct connection_t {
 	struct node_t *node;            /* node associated with the other end */
 	struct edge_t *edge;            /* edge associated with this connection */
 
-	RSA *rsa_key;                   /* his public/private key */
-	const EVP_CIPHER *incipher;     /* Cipher he will use to send data to us */
-	const EVP_CIPHER *outcipher;    /* Cipher we will use to send data to him */
-	EVP_CIPHER_CTX *inctx;          /* Context of encrypted meta data that will come from him to us */
-	EVP_CIPHER_CTX *outctx;         /* Context of encrypted meta data that will be sent from us to him */
-	uint64_t inbudget;              /* Encrypted bytes send budget */
-	uint64_t outbudget;             /* Encrypted bytes receive budget */
-	char *inkey;                    /* His symmetric meta key + iv */
-	char *outkey;                   /* Our symmetric meta key + iv */
-	int inkeylength;                /* Length of his key + iv */
-	int outkeylength;               /* Length of our key + iv */
-	const EVP_MD *indigest;
-	const EVP_MD *outdigest;
+#ifndef DISABLE_LEGACY
+	rsa_t *rsa;                     /* his public RSA key */
+	cipher_t *incipher;             /* Cipher he will use to send data to us */
+	cipher_t *outcipher;            /* Cipher we will use to send data to him */
+	digest_t *indigest;
+	digest_t *outdigest;
+	uint64_t inbudget;
+	uint64_t outbudget;
+#endif
+
+	ecdsa_t *ecdsa;                 /* his public ECDSA key */
+	sptps_t sptps;
+
 	int inmaclength;
 	int outmaclength;
 	int incompression;
 	int outcompression;
-	char *mychallenge;              /* challenge we received from him */
-	char *hischallenge;             /* challenge we sent to him */
 
-	char buffer[MAXBUFSIZE];        /* metadata input buffer */
-	int buflen;                     /* bytes read into buffer */
-	int reqlen;                     /* length of incoming request */
-	length_t tcplen;                /* length of incoming TCPpacket */
+	char *hischallenge;             /* The challenge we sent to him */
+
+	struct buffer_t inbuf;
+	struct buffer_t outbuf;
+	io_t io;                        /* input/output event on this metadata connection */
+	int tcplen;                     /* length of incoming TCPpacket */
+	int sptpslen;			/* length of incoming SPTPS packet */
 	int allow_request;              /* defined if there's only one request possible */
 
-	char *outbuf;                   /* metadata output buffer */
-	int outbufstart;                /* index of first meaningful byte in output buffer */
-	int outbuflen;                  /* number of meaningful bytes in output buffer */
-	int outbufsize;                 /* number of bytes allocated to output buffer */
-
 	time_t last_ping_time;          /* last time we saw some activity from the other end or pinged them */
-	time_t last_flushed_time;       /* last time buffer was empty. Only meaningful if outbuflen > 0 */
 
-	avl_tree_t *config_tree;        /* Pointer to configuration tree belonging to him */
+	splay_tree_t *config_tree;      /* Pointer to configuration tree belonging to him */
 } connection_t;
 
-extern avl_tree_t *connection_tree;
+extern list_t *connection_list;
 extern connection_t *everyone;
 
 extern void init_connections(void);
 extern void exit_connections(void);
-extern connection_t *new_connection(void) __attribute__((__malloc__));
-extern void free_connection(connection_t *c);
-extern void free_connection_partially(connection_t *c);
-extern void connection_add(connection_t *c);
-extern void connection_del(connection_t *c);
-extern void dump_connections(void);
+extern connection_t *new_connection(void) __attribute__ ((__malloc__));
+extern void free_connection(connection_t *);
+extern void connection_add(connection_t *);
+extern void connection_del(connection_t *);
+extern bool dump_connections(struct connection_t *);
 
-#endif
+#endif /* __TINC_CONNECTION_H__ */

src/control.c

@@ -0,0 +1,224 @@
+/*
+    control.c -- Control socket handling.
+    Copyright (C) 2013 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#include "system.h"
+#include "crypto.h"
+#include "conf.h"
+#include "control.h"
+#include "control_common.h"
+#include "graph.h"
+#include "logger.h"
+#include "meta.h"
+#include "names.h"
+#include "net.h"
+#include "netutl.h"
+#include "protocol.h"
+#include "route.h"
+#include "utils.h"
+#include "xalloc.h"
+
+char controlcookie[65];
+
+static bool control_return(connection_t *c, int type, int error) {
+	return send_request(c, "%d %d %d", CONTROL, type, error);
+}
+
+static bool control_ok(connection_t *c, int type) {
+	return control_return(c, type, 0);
+}
+
+bool control_h(connection_t *c, const char *request) {
+	int type;
+
+	if(!c->status.control || c->allow_request != CONTROL) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Unauthorized control request from %s (%s)", c->name, c->hostname);
+		return false;
+	}
+
+	if(sscanf(request, "%*d %d", &type) != 1) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "CONTROL", c->name, c->hostname);
+		return false;
+	}
+
+	switch (type) {
+		case REQ_STOP:
+			event_exit();
+			return control_ok(c, REQ_STOP);
+
+		case REQ_DUMP_NODES:
+			return dump_nodes(c);
+
+		case REQ_DUMP_EDGES:
+			return dump_edges(c);
+
+		case REQ_DUMP_SUBNETS:
+			return dump_subnets(c);
+
+		case REQ_DUMP_CONNECTIONS:
+			return dump_connections(c);
+
+		case REQ_PURGE:
+			purge();
+			return control_ok(c, REQ_PURGE);
+
+		case REQ_SET_DEBUG: {
+			int new_level;
+			if(sscanf(request, "%*d %*d %d", &new_level) != 1)
+				return false;
+			send_request(c, "%d %d %d", CONTROL, REQ_SET_DEBUG, debug_level);
+			if(new_level >= 0)
+				debug_level = new_level;
+			return true;
+		}
+
+		case REQ_RETRY:
+			retry();
+			return control_ok(c, REQ_RETRY);
+
+		case REQ_RELOAD:
+			logger(DEBUG_ALWAYS, LOG_NOTICE, "Got '%s' command", "reload");
+			int result = reload_configuration();
+			return control_return(c, REQ_RELOAD, result);
+
+		case REQ_DISCONNECT: {
+			char name[MAX_STRING_SIZE];
+			bool found = false;
+
+			if(sscanf(request, "%*d %*d " MAX_STRING, name) != 1)
+				return control_return(c, REQ_DISCONNECT, -1);
+
+			for list_each(connection_t, other, connection_list) {
+				if(strcmp(other->name, name))
+					continue;
+				terminate_connection(other, other->edge);
+				found = true;
+			}
+
+			return control_return(c, REQ_DISCONNECT, found ? 0 : -2);
+		}
+
+		case REQ_DUMP_TRAFFIC:
+			return dump_traffic(c);
+
+		case REQ_PCAP:
+			sscanf(request, "%*d %*d %d", &c->outmaclength);
+			c->status.pcap = true;
+			pcap = true;
+			return true;
+
+		case REQ_LOG:
+			sscanf(request, "%*d %*d %d", &c->outcompression);
+			c->status.log = true;
+			logcontrol = true;
+			return true;
+
+		default:
+			return send_request(c, "%d %d", CONTROL, REQ_INVALID);
+	}
+}
+
+bool init_control(void) {
+	randomize(controlcookie, sizeof controlcookie / 2);
+	bin2hex(controlcookie, controlcookie, sizeof controlcookie / 2);
+
+	mode_t mask = umask(0);
+	umask(mask | 077);
+	FILE *f = fopen(pidfilename, "w");
+	umask(mask);
+
+	if(!f) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Cannot write control socket cookie file %s: %s", pidfilename, strerror(errno));
+		return false;
+	}
+
+	// Get the address and port of the first listening socket
+
+	char *localhost = NULL;
+	sockaddr_t sa;
+	socklen_t len = sizeof sa;
+
+	// Make sure we have a valid address, and map 0.0.0.0 and :: to 127.0.0.1 and ::1.
+
+	if(getsockname(listen_socket[0].tcp.fd, (struct sockaddr *)&sa, &len)) {
+		xasprintf(&localhost, "127.0.0.1 port %s", myport);
+	} else {
+		if(sa.sa.sa_family == AF_INET) {
+			if(sa.in.sin_addr.s_addr == 0)
+				sa.in.sin_addr.s_addr = htonl(0x7f000001);
+		} else if(sa.sa.sa_family == AF_INET6) {
+			static const uint8_t zero[16] = {0};
+			if(!memcmp(sa.in6.sin6_addr.s6_addr, zero, sizeof zero))
+				sa.in6.sin6_addr.s6_addr[15] = 1;
+		}
+
+		localhost = sockaddr2hostname(&sa);
+	}
+
+	fprintf(f, "%d %s %s\n", (int)getpid(), controlcookie, localhost);
+
+	free(localhost);
+	fclose(f);
+
+#ifndef HAVE_MINGW
+	int unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);
+	if(unix_fd < 0) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not create UNIX socket: %s", sockstrerror(sockerrno));
+		return false;
+	}
+
+	struct sockaddr_un sa_un;
+	sa_un.sun_family = AF_UNIX;
+	strncpy(sa_un.sun_path, unixsocketname, sizeof sa_un.sun_path);
+
+	if(connect(unix_fd, (struct sockaddr *)&sa_un, sizeof sa_un) >= 0) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "UNIX socket %s is still in use!", unixsocketname);
+		return false;
+	}
+
+	unlink(unixsocketname);
+
+	umask(mask | 077);
+	int result = bind(unix_fd, (struct sockaddr *)&sa_un, sizeof sa_un);
+	umask(mask);
+
+	if(result < 0) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not bind UNIX socket to %s: %s", unixsocketname, sockstrerror(sockerrno));
+		return false;
+	}
+
+	if(listen(unix_fd, 3) < 0) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not listen on UNIX socket %s: %s", unixsocketname, sockstrerror(sockerrno));
+		return false;
+	}
+
+	io_add(&unix_socket, handle_new_unix_connection, &unix_socket, unix_fd, IO_READ);
+#endif
+
+	return true;
+}
+
+void exit_control(void) {
+#ifndef HAVE_MINGW
+	unlink(unixsocketname);
+	io_del(&unix_socket);
+	close(unix_socket.fd);
+#endif
+
+	unlink(pidfilename);
+}

src/control.h

@@ -0,0 +1,27 @@
+/*
+    control.h -- header for control.c.
+    Copyright (C) 2007 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_CONTROL_H__
+#define __TINC_CONTROL_H__
+
+extern bool init_control();
+extern void exit_control();
+extern char controlcookie[];
+
+#endif

src/control_common.h

@@ -0,0 +1,48 @@
+/*
+    control_protocol.h -- control socket protocol.
+    Copyright (C) 2007      Scott Lamb <slamb@slamb.org>
+                  2009-2012 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_CONTROL_PROTOCOL_H__
+#define __TINC_CONTROL_PROTOCOL_H__
+
+#include "protocol.h"
+
+enum request_type {
+	REQ_INVALID = -1,
+	REQ_STOP = 0,
+	REQ_RELOAD,
+	REQ_RESTART,
+	REQ_DUMP_NODES,
+	REQ_DUMP_EDGES,
+	REQ_DUMP_SUBNETS,
+	REQ_DUMP_CONNECTIONS,
+	REQ_DUMP_GRAPH,
+	REQ_PURGE,
+	REQ_SET_DEBUG,
+	REQ_RETRY,
+	REQ_CONNECT,
+	REQ_DISCONNECT,
+	REQ_DUMP_TRAFFIC,
+	REQ_PCAP,
+	REQ_LOG,
+};
+
+#define TINC_CTL_VERSION_CURRENT 0
+
+#endif

src/crypto.h

@@ -0,0 +1,27 @@
+/*
+    crypto.h -- header for crypto.c
+    Copyright (C) 2007-2013 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_CRYPTO_H__
+#define __TINC_CRYPTO_H__
+
+extern void crypto_init();
+extern void crypto_exit();
+extern void randomize(void *, size_t);
+
+#endif

src/cygwin/device.c

@@ -1,7 +1,7 @@
 /*
     device.c -- Interaction with Windows tap driver in a Cygwin environment
     Copyright (C) 2002-2005 Ivo Timmermans,
-                  2002-2016 Guus Sliepen <guus@tinc-vpn.org>
+                  2002-2014 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -27,6 +27,7 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
+#include "../names.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
@@ -37,10 +38,7 @@ int device_fd = -1;
 static HANDLE device_handle = INVALID_HANDLE_VALUE;
 char *device = NULL;
 char *iface = NULL;
-static const char *device_info = "Windows tap device";
-
-static uint64_t device_total_in = 0;
-static uint64_t device_total_out = 0;
+static char *device_info = NULL;
 
 static pid_t reader_pid;
 static int sp[2];
@@ -61,62 +59,54 @@ static bool setup_device(void) {
 	get_config_string(lookup_config(config_tree, "Device"), &device);
 	get_config_string(lookup_config(config_tree, "Interface"), &iface);
 
-	if(device && iface) {
+	if(device && iface)
 		logger(LOG_WARNING, "Warning: both Device and Interface specified, results may not be as expected");
-	}
 
 	/* Open registry and look for network adapters */
 
 	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, NETWORK_CONNECTIONS_KEY, 0, KEY_READ, &key)) {
-		logger(LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
 		return false;
 	}
 
-	for(i = 0; ; i++) {
-		len = sizeof(adapterid);
-
-		if(RegEnumKeyEx(key, i, adapterid, &len, 0, 0, 0, NULL)) {
+	for (i = 0; ; i++) {
+		len = sizeof adapterid;
+		if(RegEnumKeyEx(key, i, adapterid, &len, 0, 0, 0, NULL))
 			break;
-		}
 
 		/* Find out more about this adapter */
 
-		snprintf(regpath, sizeof(regpath), "%s\\%s\\Connection", NETWORK_CONNECTIONS_KEY, adapterid);
+		snprintf(regpath, sizeof regpath, "%s\\%s\\Connection", NETWORK_CONNECTIONS_KEY, adapterid);
 
-		if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, regpath, 0, KEY_READ, &key2)) {
+		if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, regpath, 0, KEY_READ, &key2))
 			continue;
-		}
 
-		len = sizeof(adaptername);
+		len = sizeof adaptername;
 		err = RegQueryValueEx(key2, "Name", 0, 0, adaptername, &len);
 
 		RegCloseKey(key2);
 
-		if(err) {
+		if(err)
 			continue;
-		}
 
 		if(device) {
 			if(!strcmp(device, adapterid)) {
 				found = true;
 				break;
-			} else {
+			} else
 				continue;
-			}
 		}
 
 		if(iface) {
 			if(!strcmp(iface, adaptername)) {
 				found = true;
 				break;
-			} else {
+			} else
 				continue;
-			}
 		}
 
-		snprintf(tapname, sizeof(tapname), USERMODEDEVICEDIR "%s" TAPSUFFIX, adapterid);
+		snprintf(tapname, sizeof tapname, USERMODEDEVICEDIR "%s" TAPSUFFIX, adapterid);
 		device_handle = CreateFile(tapname, GENERIC_WRITE | GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
-
 		if(device_handle != INVALID_HANDLE_VALUE) {
 			CloseHandle(device_handle);
 			found = true;
@@ -127,35 +117,33 @@ static bool setup_device(void) {
 	RegCloseKey(key);
 
 	if(!found) {
-		logger(LOG_ERR, "No Windows tap device found!");
+		logger(DEBUG_ALWAYS, LOG_ERR, "No Windows tap device found!");
 		return false;
 	}
 
-	if(!device) {
+	if(!device)
 		device = xstrdup(adapterid);
-	}
 
-	if(!iface) {
+	if(!iface)
 		iface = xstrdup(adaptername);
-	}
 
-	snprintf(tapname, sizeof(tapname), USERMODEDEVICEDIR "%s" TAPSUFFIX, device);
+	snprintf(tapname, sizeof tapname, USERMODEDEVICEDIR "%s" TAPSUFFIX, device);
 
 	/* Now we are going to open this device twice: once for reading and once for writing.
 	   We do this because apparently it isn't possible to check for activity in the select() loop.
 	   Furthermore I don't really know how to do it the "Windows" way. */
 
 	if(socketpair(AF_UNIX, SOCK_DGRAM, PF_UNIX, sp)) {
-		logger(LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
 		return false;
 	}
 
 	/* The parent opens the tap device for writing. */
 
-	device_handle = CreateFile(tapname, GENERIC_WRITE,  FILE_SHARE_READ,  0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
+	device_handle = CreateFile(tapname, GENERIC_WRITE,  FILE_SHARE_READ,  0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM , 0);
 
 	if(device_handle == INVALID_HANDLE_VALUE) {
-		logger(LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
 
@@ -163,8 +151,8 @@ static bool setup_device(void) {
 
 	/* Get MAC address from tap device */
 
-	if(!DeviceIoControl(device_handle, TAP_IOCTL_GET_MAC, mymac.x, sizeof(mymac.x), mymac.x, sizeof(mymac.x), &len, 0)) {
-		logger(LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
+	if(!DeviceIoControl(device_handle, TAP_IOCTL_GET_MAC, mymac.x, sizeof mymac.x, mymac.x, sizeof mymac.x, &len, 0)) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
 
@@ -177,7 +165,7 @@ static bool setup_device(void) {
 	reader_pid = fork();
 
 	if(reader_pid == -1) {
-		logger(LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
 		return false;
 	}
 
@@ -186,20 +174,20 @@ static bool setup_device(void) {
 		   It passes everything it reads to the socket. */
 
 		char buf[MTU];
-		long lenin;
+		long inlen;
 
 		CloseHandle(device_handle);
 
 		device_handle = CreateFile(tapname, GENERIC_READ, FILE_SHARE_WRITE, 0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 
 		if(device_handle == INVALID_HANDLE_VALUE) {
-			logger(LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
+			logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
 			buf[0] = 0;
 			write(sp[1], buf, 1);
 			exit(1);
 		}
 
-		logger(LOG_DEBUG, "Tap reader forked and running.");
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader forked and running.");
 
 		/* Notify success */
 
@@ -209,19 +197,20 @@ static bool setup_device(void) {
 		/* Pass packets */
 
 		for(;;) {
-			ReadFile(device_handle, buf, MTU, &lenin, NULL);
-			write(sp[1], buf, lenin);
+			ReadFile(device_handle, buf, MTU, &inlen, NULL);
+			write(sp[1], buf, inlen);
 		}
 	}
 
 	read(device_fd, &gelukt, 1);
-
 	if(gelukt != 1) {
-		logger(LOG_DEBUG, "Tap reader failed!");
+		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader failed!");
 		return false;
 	}
 
-	logger(LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
+	device_info = "Windows tap device";
+
+	logger(DEBUG_ALWAYS, LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
 
 	return true;
 }
@@ -229,59 +218,49 @@ static bool setup_device(void) {
 static void close_device(void) {
 	close(sp[0]);
 	close(sp[1]);
-	CloseHandle(device_handle);
+	CloseHandle(device_handle); device_handle = INVALID_HANDLE_VALUE;
 
 	kill(reader_pid, SIGKILL);
 
-	free(device);
-	free(iface);
+	free(device); device = NULL;
+	free(iface); iface = NULL;
+	device_info = NULL;
 }
 
 static bool read_packet(vpn_packet_t *packet) {
-	int lenin;
+	int inlen;
 
-	if((lenin = read(sp[0], packet->data, MTU)) <= 0) {
-		logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
-		       device, strerror(errno));
+	if((inlen = read(sp[0], DATA(packet), MTU)) <= 0) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+			   device, strerror(errno));
 		return false;
 	}
 
-	packet->len = lenin;
+	packet->len = inlen;
 
-	device_total_in += packet->len;
-
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
-	                        device_info);
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
+			   device_info);
 
 	return true;
 }
 
 static bool write_packet(vpn_packet_t *packet) {
-	long lenout;
+	long outlen;
 
-	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
-	                        packet->len, device_info);
+	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
+			   packet->len, device_info);
 
-	if(!WriteFile(device_handle, packet->data, packet->len, &lenout, NULL)) {
-		logger(LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
+	if(!WriteFile (device_handle, DATA(packet), packet->len, &outlen, NULL)) {
+		logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
 		return false;
 	}
 
-	device_total_out += packet->len;
-
 	return true;
 }
 
-static void dump_device_stats(void) {
-	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
-	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
-	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
-}
-
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
-	.dump_stats = dump_device_stats,
 };

src/device.h

@@ -1,6 +1,3 @@
-#ifndef TINC_DEVICE_H
-#define TINC_DEVICE_H
-
 /*
     device.h -- generic header for device.c
     Copyright (C) 2001-2005 Ivo Timmermans
@@ -21,27 +18,31 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
+#ifndef __TINC_DEVICE_H__
+#define __TINC_DEVICE_H__
+
 #include "net.h"
 
 extern int device_fd;
 extern char *device;
-
 extern char *iface;
 
 typedef struct devops_t {
 	bool (*setup)(void);
 	void (*close)(void);
-	bool (*read)(struct vpn_packet_t *packet);
-	bool (*write)(struct vpn_packet_t *packet);
-	void (*dump_stats)(void);
+	bool (*read)(struct vpn_packet_t *);
+	bool (*write)(struct vpn_packet_t *);
+	void (*enable)(void);   /* optional */
+	void (*disable)(void);  /* optional */
 } devops_t;
 
 extern const devops_t os_devops;
 extern const devops_t dummy_devops;
 extern const devops_t raw_socket_devops;
 extern const devops_t multicast_devops;
+extern const devops_t fd_devops;
 extern const devops_t uml_devops;
 extern const devops_t vde_devops;
 extern devops_t devops;
 
-#endif
+#endif /* __TINC_DEVICE_H__ */

src/digest.h

@@ -0,0 +1,42 @@
+/*
+    digest.h -- header file digest.c
+    Copyright (C) 2007-2016 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef __TINC_DIGEST_H__
+#define __TINC_DIGEST_H__
+
+#define DIGEST_MAX_SIZE 64
+
+#ifndef DISABLE_LEGACY
+
+typedef struct digest digest_t;
+
+extern digest_t *digest_open_by_name(const char *name, int maclength) __attribute__ ((__malloc__));
+extern digest_t *digest_open_by_nid(int nid, int maclength) __attribute__ ((__malloc__));
+extern void digest_close(digest_t *);
+extern bool digest_create(digest_t *, const void *indata, size_t inlen, void *outdata) __attribute__ ((__warn_unused_result__));
+extern bool digest_verify(digest_t *, const void *indata, size_t inlen, const void *digestdata) __attribute__ ((__warn_unused_result__));
+extern bool digest_set_key(digest_t *, const void *key, size_t len) __attribute__ ((__warn_unused_result__));
+extern int digest_get_nid(const digest_t *);
+extern size_t digest_keylength(const digest_t *);
+extern size_t digest_length(const digest_t *);
+extern bool digest_active(const digest_t *);
+
+#endif
+
+#endif