Release 1.0.36-2 for unstable

Closes: #973233

AUTHORS

@@ -1,25 +1,20 @@
 Main tinc authors:
-
 - Guus Sliepen <guus@tinc-vpn.org>
 - Ivo Timmermans (inactive)
 
-Significant code contributions from:
+Significant contributions from:
-
+- Michael Tokarev <mjt@tls.msk.ru>
-- Brandon Black <blblack@gmail.com>
-- Etienne Dechamps <etienne@edechamps.fr>
 - Florian Forster <octo@verplant.org>
 - Grzegorz Dymarek <gregd72002@googlemail.com>
-- Julien Muchembled <jm@jmuchemb.eu>
-- Loïc Grenié <loic.grenie@gmail.com>
 - Max Rijevski <maksuf@gmail.com>
-- Michael Tokarev <mjt@tls.msk.ru>
 - Scott Lamb <slamb@slamb.org>
-- Sven-Haegar Koch <haegar@sdinet.de>
+- Julien Muchembled <jm@jmuchemb.eu>
 - Timothy Redaelli <timothy@redaelli.eu>
+- Brandon Black <blblack@gmail.com>
+- Loïc Grenié <loic.grenie@gmail.com>
 
 These files are from other sources:
-
+ * lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
-* lib/pidfile.h and lib/pidfile.c are by Martin Schulze, taken from
  the syslog 1.3 sources.
 
 * src/bsd/tunemu.c and tunemu.h are by Friedrich Schöller
@@ -28,4 +23,5 @@ These files are from other sources:
 Also some of the macro files in the directory m4, and their
 accompanying files in lib, were taken from GNU fileutils.
 
-Please see the file THANKS for a list of all contributors to tinc.
+Please see the file THANKS for more information on contributions from
+users.

COPYING

@@ -1,4 +1,4 @@
-Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen and others.
+Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen and others.
 See the AUTHORS file for a complete list.
 
 This program is free software; you can redistribute it and/or modify it under

COPYING.README

@@ -1,17 +1,19 @@
 The following applies to tinc:
 
-> This program is released under the GPL with the additional exemption that
+This program is released under the GPL with the additional exemption that
-> compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
+compiling, linking, and/or using OpenSSL is allowed.  You may provide binary
-> packages linked to the OpenSSL libraries, provided that all other requirements
+packages linked to the OpenSSL libraries, provided that all other requirements
-> of the GPL are met.
+of the GPL are met.
 
 The following applies to the LZO library:
 
-> Hereby I grant a special exception to the tinc VPN project
+  Hereby I grant a special exception to the tinc VPN project
-> (https://www.tinc-vpn.org/) to link the LZO library with the OpenSSL library
+  (http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
-> (https://openssl.org).
+  (http://www.openssl.org).
->
+
-> Markus F.X.J. Oberhumer
+  Markus F.X.J. Oberhumer
 
 When tinc is compiled with the --enable-tunemu option, the resulting binary
 falls under the GPL version 3 or later.
+
+

Makefile.am

@@ -2,39 +2,14 @@
 
 AUTOMAKE_OPTIONS = gnu
 
-SUBDIRS =  src doc test systemd
+SUBDIRS = src doc systemd
 
-ACLOCAL_AMFLAGS = -I m4
+ACLOCAL_AMFLAGS = -I m4 
 
 EXTRA_DIST = COPYING.README README.android
 
-@CODE_COVERAGE_RULES@
-
-# If git describe works, force autoconf to run in order to make sure we have the
-# current version number from git in the resulting configure script.
-configure-version:
-	-cd $(srcdir) && git describe && autoconf --force
-
-# Triggering the README target means we are building a distribution (make dist).
-README: configure-version
-
 ChangeLog:
-	(cd $(srcdir) && git log) > ChangeLog
+	git log > ChangeLog
-
-deb:
-	dpkg-buildpackage -rfakeroot
-
-rpm: dist
-	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
-	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
-	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
-
-release:
-	rm -f ChangeLog
-	$(MAKE) ChangeLog
-	echo "Please edit the NEWS file now..."
-	/usr/bin/editor $(srcdir)/NEWS
-	$(MAKE) dist
 
 astyle:
 	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]

Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -94,12 +94,9 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_code_coverage.m4 \
+	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 \
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
-	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
+	$(top_srcdir)/configure.ac
-	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
-	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \
@@ -145,8 +142,8 @@ am__recursive_targets = \
   $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
 	cscope distdir distdir-am dist dist-all distcheck
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
-	$(LISP)config.h.in
+	config.h.in
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
 # *not* preserved.
@@ -222,15 +219,8 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
-CODE_COVERAGE_CFLAGS = @CODE_COVERAGE_CFLAGS@
-CODE_COVERAGE_CPPFLAGS = @CODE_COVERAGE_CPPFLAGS@
-CODE_COVERAGE_CXXFLAGS = @CODE_COVERAGE_CXXFLAGS@
-CODE_COVERAGE_ENABLED = @CODE_COVERAGE_ENABLED@
-CODE_COVERAGE_LDFLAGS = @CODE_COVERAGE_LDFLAGS@
-CODE_COVERAGE_LIBS = @CODE_COVERAGE_LIBS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
-CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@@ -239,21 +229,17 @@ ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
-GCOV = @GCOV@
-GENHTML = @GENHTML@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-LCOV = @LCOV@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
-MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -264,8 +250,6 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
-READLINE_LIBS = @READLINE_LIBS@
-SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@@ -323,8 +307,8 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AUTOMAKE_OPTIONS = gnu
-SUBDIRS = src doc test systemd
+SUBDIRS = src doc systemd
-ACLOCAL_AMFLAGS = -I m4
+ACLOCAL_AMFLAGS = -I m4 
 EXTRA_DIST = COPYING.README README.android
 all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-recursive
@@ -489,6 +473,12 @@ distdir: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
 distdir-am: $(DISTFILES)
+	@case `sed 15q $(srcdir)/NEWS` in \
+	*"$(VERSION)"*) : ;; \
+	*) \
+	  echo "NEWS not updated; not releasing" 1>&2; \
+	  exit 1;; \
+	esac
 	$(am__remove_distdir)
 	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
@@ -568,6 +558,10 @@ dist-xz: distdir
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__post_remove_distdir)
 
+dist-zstd: distdir
+	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
+	$(am__post_remove_distdir)
+
 dist-tarZ: distdir
 	@echo WARNING: "Support for distribution archives compressed with" \
 		       "legacy program 'compress' is deprecated." >&2
@@ -610,6 +604,8 @@ distcheck: dist
 	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
+	*.tar.zst*) \
+	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
@@ -786,7 +782,7 @@ uninstall-am:
 	am--refresh check check-am clean clean-cscope clean-generic \
 	cscope cscopelist-am ctags ctags-am dist dist-all dist-bzip2 \
 	dist-gzip dist-lzip dist-shar dist-tarZ dist-xz dist-zip \
-	distcheck distclean distclean-generic distclean-hdr \
+	dist-zstd distcheck distclean distclean-generic distclean-hdr \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
@@ -801,33 +797,8 @@ uninstall-am:
 .PRECIOUS: Makefile
 
 
-@CODE_COVERAGE_RULES@
-
-# If git describe works, force autoconf to run in order to make sure we have the
-# current version number from git in the resulting configure script.
-configure-version:
-	-cd $(srcdir) && git describe && autoconf --force
-
-# Triggering the README target means we are building a distribution (make dist).
-README: configure-version
-
 ChangeLog:
-	(cd $(srcdir) && git log) > ChangeLog
+	git log > ChangeLog
-
-deb:
-	dpkg-buildpackage -rfakeroot
-
-rpm: dist
-	cp $(distdir).tar.gz /usr/src/redhat/SOURCES/
-	cp redhat/tinc.spec /usr/src/redhat/SOURCES/
-	cd /usr/src/redhat/SOURCES/ && rpm -bb tinc.spec
-
-release:
-	rm -f ChangeLog
-	$(MAKE) ChangeLog
-	echo "Please edit the NEWS file now..."
-	/usr/bin/editor $(srcdir)/NEWS
-	$(MAKE) dist
 
 astyle:
 	astyle --options=.astylerc -nQ src/*.[ch] src/*/*.[ch]

README

@@ -1,7 +1,11 @@
-This is the README file for tinc version 1.1pre17. Installation
+This is the README file for tinc version 1.0.36. Installation
 instructions may be found in the INSTALL file.
 
-tinc is Copyright © 1998-2018 Ivo Timmermans, Guus Sliepen <guus@tinc-vpn.org>, and others.
+tinc is Copyright (C) 1998-2019 by:
+
+Ivo Timmermans,
+Guus Sliepen <guus@tinc-vpn.org>,
+and others.
 
 For a complete list of authors see the AUTHORS file.
 
@@ -11,94 +15,119 @@ the Free Software Foundation; either version 2 of the License, or (at
 your option) any later version. See the file COPYING for more details.
 
 
-This is a pre-release
----------------------
-
-Please note that this is NOT a stable release. Until version 1.1.0 is released,
-please use one of the 1.0.x versions if you need a stable version of tinc.
-
-Although tinc 1.1 will be protocol compatible with tinc 1.0.x, the
-functionality of the tinc program may still change, and the control socket
-protocol is not fixed yet.
-
-
 Security statement
 ------------------
 
-This version uses an experimental and unfinished cryptographic protocol. Use it
+In August 2000, we discovered the existence of a security hole in all versions
-at your own risk.
+of tinc up to and including 1.0pre2. This had to do with the way we exchanged
+keys. Since then, we have been working on a new authentication scheme to make
+tinc as secure as possible. The current version uses the OpenSSL library and
+uses strong authentication with RSA keys.
 
-When connecting to nodes that use the legacy protocol used in tinc 1.0, be
+On the 29th of December 2001, Jerome Etienne posted a security analysis of tinc
-aware that any security issues in tinc 1.0 will apply to tinc 1.1 as well. On
+1.0pre4. Due to a lack of sequence numbers and a message authentication code
-September 6th, 2018, Michael Yonly contacted us and provided proof-of-concept
+for each packet, an attacker could possibly disrupt certain network services or
-code that allowed a remote attacker to create an authenticated, one-way
+launch a denial of service attack by replaying intercepted packets. The current
-connection with a node using the legacy protocol, and also that there was a
+version adds sequence numbers and message authentication codes to prevent such
+attacks.
+
+On September the 15th of 2003, Peter Gutmann contacted us and showed us a
+writeup describing various security issues in several VPN daemons. He showed
+that tinc lacks perfect forward security, the connection authentication could
+be done more properly, that the sequence number we use as an IV is not the best
+practice and that the default length of the HMAC for packets is too short in
+his opinion. We do not know of a way to exploit these weaknesses, but these
+issues are being addressed in the tinc 1.1 branch.
+
+The Sweet32 attack affects versions of tinc prior to 1.0.30.
+
+On September 6th, 2018, Michael Yonly contacted us and provided
+proof-of-concept code that allowed a remote attacker to create an
+authenticated, one-way connection with a node, and also that there was a
 possibility for a man-in-the-middle to force UDP packets from a node to be sent
 in plaintext. The first issue was trivial to exploit on tinc versions prior to
 1.0.30, but the changes in 1.0.30 to mitigate the Sweet32 attack made this
-weakness much harder to exploit. These issues have been fixed in tinc 1.0.35
+weakness much harder to exploit. These issues have been fixed in tinc 1.0.35.
-and tinc 1.1pre17. The new protocol in the tinc 1.1 branch is not susceptible
+The new protocol in the tinc 1.1 branch is not susceptible to these issues.
-to these issues. However, be aware that SPTPS is only used between nodes
+
-running tinc 1.1pre* or later, and in a VPN with nodes running different
+Cryptography is a hard thing to get right. We cannot make any
-versions, the security might only be as good as that of the oldest version.
+guarantees. Time, review and feedback are the only things that can
+prove the security of any cryptographic product. If you wish to review
+tinc or give us feedback, you are strongly encouraged to do so.
 
 
 Compatibility
 -------------
 
-Version 1.1pre17 is compatible with 1.0pre8, 1.0 and later, but not with older
+Version 1.0.35 is compatible with 1.0pre8, 1.0 and later, but not with older
-versions of tinc.
+versions of tinc. Note that since version 1.0.30, tinc requires all nodes in
-
+the VPN to be compiled with a version of LibreSSL or OpenSSL that supports the
-When the ExperimentalProtocol option is used, tinc is still compatible with
+AES256 and SHA256 algorithms.
-1.0.X, 1.1pre11 and later, but not with any version between 1.1pre1 and
-1.1pre10.
 
 
 Requirements
 ------------
 
-In order to compile tinc, you will need a GNU C compiler environment. Please
+The OpenSSL library is used for all cryptographic functions. You can find it at
-ensure you have the latest stable versions of all the required libraries:
+https://www.openssl.org/. You will need version 1.0.1 or later with support for
+AES256 and SHA256 enabled. If this library is not installed on your system, the
+configure script will fail.  The manual in doc/tinc.texi contains more detailed
+information on how to install this library. Alternatively, you may also use the
+LibreSSL library.
 
-- LibreSSL (http://www.libressl.org/) or OpenSSL (https://openssl.org/) version 1.0.0 or later.
+The zlib library is used for optional compression. You can
+find it at https://zlib.net/. Because of a possible exploit in
+earlier versions we recommend that you download version 1.1.4 or later.
 
-The following libraries are used by default, but can be disabled if necessary:
+The LZO library is also used for optional compression. You can
+find it at https://www.oberhumer.com/opensource/lzo/.
 
-- zlib (https://zlib.net/)
+In order to compile tinc, you will need a C99 compliant compiler.
-- LZO (https://www.oberhumer.com/opensource/lzo/)
-- ncurses (https://invisible-island.net/ncurses/)
-- readline (https://cnswww.cns.cwru.edu/php/chet/readline/rltop.html)
 
 
 Features
 --------
 
-Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number
+This version of tinc supports multiple virtual networks at once. To
-of nodes. Instead of configuring tunnels, you give tinc the location and
+use this feature, you may supply a netname via the -n or --net
-public key of a few nodes in the VPN. After making the initial connections to
+options. The standard locations for the config files will then be
-those nodes, tinc will learn about all other nodes on the VPN, and will make
+/etc/tinc/<net>/.
-connections automatically. When direct connections are not possible, data will
-be forwarded by intermediate nodes.
 
-Tinc 1.1 support two protocols. The first is a legacy protocol that provides
+tincd regenerates its encryption key pairs. It does this on the first
-backwards compatibility with tinc 1.0 nodes, and which by default uses 2048 bit
+activity after the keys have expired. This period is adjustable in the
-RSA keys for authentication, and encrypts traffic using AES256 in CBC mode
+configuration file, and the default time is 3600 seconds (one hour).
-and HMAC-SHA256. The second is a new protocol which uses Curve25519 keys for
-authentication, and encrypts traffic using Chacha20-Poly1305, and provides
-forward secrecy.
 
-Tinc fully supports IPv6.
+This version supports multiple subnets at once. They are also sorted
+on subnet mask size. This means that it is possible to have
+overlapping subnets on the VPN, as long as their subnet mask sizes
+differ.
 
-Tinc can operate in several routing modes. In the default mode, "router", every
+Since pre5, tinc can operate in several routing modes. The default mode,
-node is associated with one or more IPv4 and/or IPv6 Subnets. The other two
+"router", works exactly like the older version, and uses Subnet lines to
-modes, "switch" and "hub", let the tinc daemons work together to form a virtual
+determine the destination of packets. The other two modes, "switch" and "hub",
-Ethernet network switch or hub.
+allow the tinc daemons to work together like a single network switch or hub.
+This is useful for bridging networks. The latter modes only work properly on
+Linux, FreeBSD and Windows.
+
+The algorithms used for encryption and generating message authentication codes
+can now be changed in the configuration files. All cipher and digest algorithms
+supported by OpenSSL can be used. Useful ciphers are "blowfish" (default),
+"bf-ofb", "des", "des3", et cetera. Useful digests are "sha1" (default), "md5",
+et cetera.
+
+Support for routing IPv6 packets has been added. Just add Subnet lines with
+IPv6 addresses (without using :: abbreviations) and use ifconfig or ip (from
+the iproute package) to give the virtual network interface corresponding IPv6
+addresses. tinc does not provide autoconfiguration for IPv6 hosts. Consider
+using radvd or zebra if you need it.
+
+It is also possible to make tunnels to other tinc daemons over IPv6 networks,
+if the operating system supports IPv6.  tinc will automatically use both IPv6
+and IPv4 when available, but this can be changed by adding the option
+"AddressFamily = ipv4" or "AddressFamily = ipv6" to the tinc.conf file.
 
 Normally, when started tinc will detach and run in the background. In a native
 Windows environment this means tinc will install itself as a service, which will
-restart after reboots. To prevent tinc from detaching or running as a service,
+restart after reboots.  To prevent tinc from detaching or running as a service,
 use the -D option.
 
-The status of the VPN can be queried using the "tinc" command, which connects
-to a running tinc daemon via a control connection. The same tool also makes it
-easy to start and stop tinc, and to change its configuration.

README.android

@@ -1,23 +1,25 @@
-Quick how-to cross compile tinc for Android (done from $HOME/android/):
+Quick how-to cross compile tinc for android (done from $HOME/android/):
 
-- Download Android NDK and setup local ARM toolchain:
+- Download android NDK and setup local ARM toolchain:
+wget http://dl.google.com/android/ndk/android-ndk-r9d-linux-x86.tar.bz2
+tar xfj android-ndk-r9d-linux-x86.tar.bz2
+./android-ndk-r9d/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
 
-        wget http://dl.google.com/android/ndk/android-ndk-r8b-linux-x86.tar.bz2
+- Download and cross-compile openSSL for ARM:
-        tar xfj android-ndk-r8b-linux-x86.tar.bz2
+wget http://www.openssl.org/source/openssl-1.0.1h.tar.gz
-        ./android-ndk-r8b/build/tools/make-standalone-toolchain.sh --platform=android-5 --install-dir=/tmp/my-android-toolchain
+tar xfz openssl-1.0.1h.tar.gz
-
+cd openssl-1.0.1h
-- Download and cross-compile OpenSSL for ARM:
+./Configure dist
-
+make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
-        wget http://www.openssl.org/source/openssl-1.0.1c.tar.gz
+cd -
-        tar xfz openssl-1.0.1c.tar.gz
-        cd openssl-1.0.1c
-        ./Configure dist
-        make CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc AR="/tmp/my-android-toolchain/bin/arm-linux-androideabi-ar r" RANLIB=/tmp/my-android-toolchain/bin/arm-linux-androideabi-ranlib
 
 - Clone and cross-compile tinc:
+git clone git://tinc-vpn.org/tinc
+cd tinc
+autoreconf -fsi
+CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1g --with-openssl-include=$HOME/android/openssl-1.0.1g/include/ --disable-hardening
+make -j5
+
+- Strip tincd binary to make it smaller
+/tmp/my-android-toolchain/bin/arm-linux-androideabi-strip src/tincd
 
-        git clone git://tinc-vpn.org/tinc
-        cd tinc
-        autoreconf -fsi
-        CC=/tmp/my-android-toolchain/bin/arm-linux-androideabi-gcc ./configure --host=arm-linux --disable-lzo --with-openssl-lib=$HOME/android/openssl-1.0.1c --with-openssl-include=$HOME/android/openssl-1.0.1c/include/
-        make -j5

THANKS

@@ -22,6 +22,7 @@ We would like to thank the following people for their contributions to tinc:
 * Delf Eldkraft
 * Dennis Joachimsthaler
 * dnk
+* Егор Палкин
 * Élie Bouttier
 * Enrique Zanardi
 * Erik Tews
@@ -37,11 +38,12 @@ We would like to thank the following people for their contributions to tinc:
 * Gusariev Oleksandr
 * Hans Bayle
 * Harvest
-* Ivo Smits
 * Ivo van Dong
+* Ivo Smits
 * James Cook
 * James MacLean
 * Jamie Briggs
+* Jan Štembera
 * Jason Harper
 * Jason Livesay
 * Jasper Krijgsman
@@ -49,8 +51,8 @@ We would like to thank the following people for their contributions to tinc:
 * Jeroen Domburg
 * Jeroen Ubbink
 * Jerome Etienne
-* Jochen Voss
 * Jo-Philipp Wich
+* Jochen Voss
 * Julien Muchembled
 * Lavrans Laading
 * Loïc Dachary
@@ -71,21 +73,24 @@ We would like to thank the following people for their contributions to tinc:
 * Max Rijevski
 * Menno Smits
 * Mesar Hameed
+* Michael Taylor
 * Michael Tokarev
 * Michael Yonli
 * Miles Nordin
-* Murat Donmez
 * Nathan Stratton Treadway
+* Murat Donmez
 * Nick Hibma
 * Nick Patavalis
 * Paul Littlefield
 * Philipp Babel
 * Pierre Emeriaud
 * Pierre-Olivier Mercier
+* Rafael Wolf
 * Rafael Sadowski
 * Rafał Leśniak
 * Rhosyn Celyn
 * Robert van der Meulen
+* Robert Waniek
 * Rumko
 * Ryan Miller
 * Sam Bryan
@@ -104,6 +109,7 @@ We would like to thank the following people for their contributions to tinc:
 * Tonnerre Lombard
 * Ulrich Seifert
 * Vil Brekin
+* Vincent Laurent
 * Vittorio Gambaletta
 * Wendy Willard
 * Wessel Dankers

aclocal.m4

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -20,7 +20,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])
 
-# Copyright (C) 2002-2018 Free Software Foundation, Inc.
+# Copyright (C) 2002-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -35,7 +35,7 @@ AC_DEFUN([AM_AUTOMAKE_VERSION],
 [am__api_version='1.16'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.16.1], [],
+m4_if([$1], [1.16.2], [],
       [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])
 
@@ -51,14 +51,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.16.1])dnl
+[AM_AUTOMAKE_VERSION([1.16.2])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
   [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])
 
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -110,7 +110,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`
 
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
-# Copyright (C) 1997-2018 Free Software Foundation, Inc.
+# Copyright (C) 1997-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -141,7 +141,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])
 
-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -332,7 +332,7 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl
 
 # Generate code to set up dependency tracking.              -*- Autoconf -*-
 
-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -371,7 +371,9 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
   done
   if test $am_rc -ne 0; then
     AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
-    for automatic dependency tracking.  Try re-running configure with the
+    for automatic dependency tracking.  If GNU make was not used, consider
+    re-running the configure script with MAKE="gmake" (or whatever is
+    necessary).  You can also try re-running configure with the
     '--disable-dependency-tracking' option to at least be able to build
     the package (albeit without support for automatic dependency tracking).])
   fi
@@ -398,7 +400,7 @@ AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
 
 # Do all the work for Automake.                             -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -595,7 +597,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -616,7 +618,7 @@ if test x"${install_sh+set}" != xset; then
 fi
 AC_SUBST([install_sh])])
 
-# Copyright (C) 2003-2018 Free Software Foundation, Inc.
+# Copyright (C) 2003-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -637,7 +639,7 @@ AC_SUBST([am__leading_dot])])
 
 # Check to see how 'make' treats includes.	            -*- Autoconf -*-
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -680,7 +682,7 @@ AC_SUBST([am__quote])])
 
 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-
 
-# Copyright (C) 1997-2018 Free Software Foundation, Inc.
+# Copyright (C) 1997-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -719,7 +721,7 @@ fi
 
 # Helper functions for option handling.                     -*- Autoconf -*-
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -748,7 +750,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])
 
-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -795,7 +797,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -814,7 +816,7 @@ AC_DEFUN([AM_RUN_LOG],
 
 # Check to make sure that the build environment is sane.    -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -895,7 +897,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])
 
-# Copyright (C) 2009-2018 Free Software Foundation, Inc.
+# Copyright (C) 2009-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -955,7 +957,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])
 
-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -983,7 +985,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])
 
-# Copyright (C) 2006-2018 Free Software Foundation, Inc.
+# Copyright (C) 2006-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1002,7 +1004,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
 
 # Check how to create a tarball.                            -*- Autoconf -*-
 
-# Copyright (C) 2004-2018 Free Software Foundation, Inc.
+# Copyright (C) 2004-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1138,12 +1140,7 @@ m4_include([m4/ax_append_flag.m4])
 m4_include([m4/ax_cflags_warn_all.m4])
 m4_include([m4/ax_check_compile_flag.m4])
 m4_include([m4/ax_check_link_flag.m4])
-m4_include([m4/ax_code_coverage.m4])
 m4_include([m4/ax_require_defined.m4])
-m4_include([m4/curses.m4])
-m4_include([m4/libgcrypt.m4])
 m4_include([m4/lzo.m4])
-m4_include([m4/miniupnpc.m4])
 m4_include([m4/openssl.m4])
-m4_include([m4/readline.m4])
 m4_include([m4/zlib.m4])

compile

@@ -3,7 +3,7 @@
 
 scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -53,7 +53,7 @@ func_file_conv ()
 	  MINGW*)
 	    file_conv=mingw
 	    ;;
-	  CYGWIN*)
+	  CYGWIN* | MSYS*)
 	    file_conv=cygwin
 	    ;;
 	  *)
@@ -67,7 +67,7 @@ func_file_conv ()
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/*)
+	cygwin/* | msys/*)
 	  file=`cygpath -m "$file" || echo "$file"`
 	  ;;
 	wine/*)

config.h.in

@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
-/* Disable support for the legacy (tinc 1.0) protocol */
-#undef DISABLE_LEGACY
-
 /* Support for jumbograms (packets up to 9000 bytes) */
 #undef ENABLE_JUMBOGRAMS
 
@@ -18,6 +15,9 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 
+/* Define to 1 if you have the <arpa/nameser.h> header file. */
+#undef HAVE_ARPA_NAMESER_H
+
 /* Define to 1 if you have the `asprintf' function. */
 #undef HAVE_ASPRINTF
 
@@ -27,12 +27,6 @@
 /* Unknown BSD variant */
 #undef HAVE_BSD
 
-/* have curses support */
-#undef HAVE_CURSES
-
-/* Define to 1 if you have the <curses.h> header file. */
-#undef HAVE_CURSES_H
-
 /* Cygwin */
 #undef HAVE_CYGWIN
 
@@ -46,6 +40,22 @@
    you don't. */
 #undef HAVE_DECL_EVP_AES_256_CFB
 
+/* Define to 1 if you have the declaration of `freeaddrinfo', and to 0 if you
+   don't. */
+#undef HAVE_DECL_FREEADDRINFO
+
+/* Define to 1 if you have the declaration of `gai_strerror', and to 0 if you
+   don't. */
+#undef HAVE_DECL_GAI_STRERROR
+
+/* Define to 1 if you have the declaration of `getaddrinfo', and to 0 if you
+   don't. */
+#undef HAVE_DECL_GETADDRINFO
+
+/* Define to 1 if you have the declaration of `getnameinfo', and to 0 if you
+   don't. */
+#undef HAVE_DECL_GETNAMEINFO
+
 /* Define to 1 if you have the declaration of `OpenSSL_add_all_algorithms',
    and to 0 if you don't. */
 #undef HAVE_DECL_OPENSSL_ADD_ALL_ALGORITHMS
@@ -63,9 +73,6 @@
 /* DragonFly */
 #undef HAVE_DRAGONFLY
 
-/* Define to 1 if you have the `ERR_remove_state' function. */
-#undef HAVE_ERR_REMOVE_STATE
-
 /* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
 #undef HAVE_EVP_CIPHER_CTX_NEW
 
@@ -87,9 +94,6 @@
 /* FreeBSD */
 #undef HAVE_FREEBSD
 
-/* Define to 1 if you have the <gcrypt.h> header file. */
-#undef HAVE_GCRYPT_H
-
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
@@ -99,12 +103,12 @@
 /* Define to 1 if you have the `gettimeofday' function. */
 #undef HAVE_GETTIMEOFDAY
 
-/* Define to 1 if you have the `HMAC_CTX_new' function. */
-#undef HAVE_HMAC_CTX_NEW
-
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
+/* Define to 1 if you have the `nsl' library (-lnsl). */
+#undef HAVE_LIBNSL
+
 /* Define to 1 if you have the `resolv' library (-lresolv). */
 #undef HAVE_LIBRESOLV
 
@@ -138,18 +142,9 @@
 /* MinGW */
 #undef HAVE_MINGW
 
-/* have miniupnpc support */
-#undef HAVE_MINIUPNPC
-
-/* Define to 1 if you have the <miniupnpc/miniupnpc.h> header file. */
-#undef HAVE_MINIUPNPC_MINIUPNPC_H
-
 /* Define to 1 if you have the `mlockall' function. */
 #undef HAVE_MLOCKALL
 
-/* Define to 1 if you have the `nanosleep' function. */
-#undef HAVE_NANOSLEEP
-
 /* NetBSD */
 #undef HAVE_NETBSD
 
@@ -237,30 +232,24 @@
 /* Define to 1 if you have the <openssl/sha.h> header file. */
 #undef HAVE_OPENSSL_SHA_H
 
+/* Define to 1 if you have the `pselect' function. */
+#undef HAVE_PSELECT
+
 /* Define to 1 if you have the `putenv' function. */
 #undef HAVE_PUTENV
 
 /* Define to 1 if you have the `RAND_bytes' function. */
 #undef HAVE_RAND_BYTES
 
-/* have readline support */
-#undef HAVE_READLINE
-
-/* Define to 1 if you have the <readline/history.h> header file. */
-#undef HAVE_READLINE_HISTORY_H
-
-/* Define to 1 if you have the <readline/readline.h> header file. */
-#undef HAVE_READLINE_READLINE_H
-
-/* Define to 1 if you have the `recvmmsg' function. */
-#undef HAVE_RECVMMSG
-
 /* Define to 1 if you have the <resolv.h> header file. */
 #undef HAVE_RESOLV_H
 
 /* Define to 1 if you have the `RSA_set0_key' function. */
 #undef HAVE_RSA_SET0_KEY
 
+/* Define to 1 if the system has the type `socklen_t'. */
+#undef HAVE_SOCKLEN_T
+
 /* Solaris/SunOS */
 #undef HAVE_SOLARIS
 
@@ -279,6 +268,9 @@
 /* Define to 1 if you have the `strsignal' function. */
 #undef HAVE_STRSIGNAL
 
+/* Define to 1 if the system has the type `struct addrinfo'. */
+#undef HAVE_STRUCT_ADDRINFO
+
 /* Define to 1 if the system has the type `struct arphdr'. */
 #undef HAVE_STRUCT_ARPHDR
 
@@ -294,6 +286,12 @@
 /* Define to 1 if the system has the type `struct icmp6_hdr'. */
 #undef HAVE_STRUCT_ICMP6_HDR
 
+/* Define to 1 if the system has the type `struct in6_addr'. */
+#undef HAVE_STRUCT_IN6_ADDR
+
+/* Define to 1 if the system has the type `struct in_addr'. */
+#undef HAVE_STRUCT_IN_ADDR
+
 /* Define to 1 if the system has the type `struct ip'. */
 #undef HAVE_STRUCT_IP
 
@@ -306,9 +304,15 @@
 /* Define to 1 if the system has the type `struct nd_opt_hdr'. */
 #undef HAVE_STRUCT_ND_OPT_HDR
 
+/* Define to 1 if the system has the type `struct sockaddr_in6'. */
+#undef HAVE_STRUCT_SOCKADDR_IN6
+
 /* Define to 1 if you have the <syslog.h> header file. */
 #undef HAVE_SYSLOG_H
 
+/* Define to 1 if you have the `system' function. */
+#undef HAVE_SYSTEM
+
 /* Define to 1 if you have the <sys/file.h> header file. */
 #undef HAVE_SYS_FILE_H
 
@@ -336,8 +340,8 @@
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H
 
-/* Define to 1 if you have the <sys/un.h> header file. */
+/* Define to 1 if you have the <sys/uio.h> header file. */
-#undef HAVE_SYS_UN_H
+#undef HAVE_SYS_UIO_H
 
 /* Define to 1 if you have the <sys/wait.h> header file. */
 #undef HAVE_SYS_WAIT_H
@@ -348,6 +352,9 @@
 /* Define to 1 if you have the `unsetenv' function. */
 #undef HAVE_UNSETENV
 
+/* Define to 1 if you have the `usleep' function. */
+#undef HAVE_USLEEP
+
 /* Define to 1 if you have the `vsyslog' function. */
 #undef HAVE_VSYSLOG
 
@@ -412,6 +419,9 @@
 /* Version number of package */
 #undef VERSION
 
+/* Compile with support for Windows 2000 */
+#undef WITH_WINDOWS2000
+
 /* Define to 1 if on MINIX. */
 #undef _MINIX
 
@@ -428,8 +438,5 @@
 /* Defined if the __malloc__ attribute is not supported. */
 #undef __malloc__
 
-/* Defined if the __nonnull__ attribute is not supported. */
+/* Define to `int' if <sys/types.h> does not define. */
-#undef __nonnull__
+#undef pid_t
-
-/* Defined if the __warn_unused_result__ attribute is not supported. */
-#undef __warn_unused_result__

configure.ac

@@ -1,11 +1,9 @@
 dnl Process this file with autoconf to produce a configure script.
 
-origcflags="$CFLAGS"
-
 AC_PREREQ(2.61)
-AC_INIT([tinc], m4_esyscmd_s((git describe || echo UNKNOWN) | sed 's/release-//'))
+AC_INIT([tinc], [1.0.36])
 AC_CONFIG_SRCDIR([src/tincd.c])
-AM_INIT_AUTOMAKE([std-options subdir-objects nostdinc silent-rules -Wall])
+AM_INIT_AUTOMAKE([1.11 check-news std-options subdir-objects nostdinc silent-rules -Wall])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_SILENT_RULES([yes])
@@ -20,11 +18,8 @@ dnl Checks for programs.
 AC_PROG_CC_C99
 AC_PROG_CPP
 AC_PROG_INSTALL
-AM_PROG_CC_C_O
 
-dnl Check whether to enable code coverage testing, and if so, clear the default CFLAGS.
+AM_PROG_CC_C_O
-AX_CODE_COVERAGE
-AS_IF([test "x$enable_code_coverage" = "xyes" -a "x$origcflags" = "x"], [CFLAGS=""])
 
 dnl Check and set OS
 
@@ -71,9 +66,7 @@ case $host_os in
   *mingw*)
     mingw=true
     AC_DEFINE(HAVE_MINGW, 1, [MinGW])
-    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32 -liphlpapi"
+    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32"
-    LDFLAGS="$LDFLAGS -static"
-    CPPFLAGS="$CPPFLAGS -DMINIUPNP_STATICLIB"
   ;;
   *)
     AC_MSG_ERROR("Unknown operating system.")
@@ -114,6 +107,13 @@ AC_ARG_ENABLE(tunemu,
   [tunemu=false]
 )
 
+AC_ARG_WITH(windows2000,
+  AS_HELP_STRING([--with-windows2000], [compile with support for Windows 2000. This disables support for tunneling over existing IPv6 networks.]),
+  [ AS_IF([test "x$with_windows2000" = "xyes"],
+      [AC_DEFINE(WITH_WINDOWS2000, 1, [Compile with support for Windows 2000])])
+  ]
+)
+
 AC_ARG_WITH(systemd,
   AS_HELP_STRING([--with-systemd@<:@=DIR@:>@], [install systemd service files @<:@to DIR if specified@:>@]),
   [ systemd=true; systemd_path="$with_systemd" ],
@@ -137,8 +137,12 @@ AM_CONDITIONAL(WITH_SYSTEMD, test "$systemd" = true)
 
 AC_CACHE_SAVE
 
-AS_IF([test -d /sw/include], [CPPFLAGS="$CPPFLAGS -I/sw/include"])
+if test -d /sw/include ; then
-AS_IF([test -d /sw/lib], [LIBS="$LIBS -L/sw/lib"])
+  CPPFLAGS="$CPPFLAGS -I/sw/include"
+fi
+if test -d /sw/lib ; then
+  LIBS="$LIBS -L/sw/lib"
+fi
 
 dnl Compiler hardening flags
 dnl No -fstack-protector-all because it doesn't work on all platforms or architectures.
@@ -165,11 +169,13 @@ AS_IF([test "x$enable_hardening" != "xno"],
   ]
 );
 
+dnl Checks for libraries.
+
 dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
 
-AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/un.h sys/wait.h netdb.h arpa/inet.h dirent.h getopt.h])
+AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/uio.h sys/wait.h netdb.h arpa/inet.h arpa/nameser.h dirent.h getopt.h])
-AC_CHECK_HEADERS([net/if.h net/if_types.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
+AC_CHECK_HEADERS([net/if.h net/if_types.h linux/if_tun.h net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
   [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_HEADERS([netinet/if_ether.h netinet/ip.h netinet/ip6.h resolv.h],
@@ -180,78 +186,48 @@ AC_CHECK_HEADERS([netinet/tcp.h netinet/ip_icmp.h netinet/icmp6.h],
 )
 
 dnl Checks for typedefs, structures, and compiler characteristics.
-tinc_ATTRIBUTE(__malloc__)
+AC_TYPE_PID_T
-tinc_ATTRIBUTE(__nonnull__)
-tinc_ATTRIBUTE(__warn_unused_result__)
 
-AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip, struct icmp, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
+tinc_ATTRIBUTE(__malloc__)
+
+AC_CHECK_TYPES([socklen_t, struct ether_header, struct arphdr, struct ether_arp, struct in_addr, struct addrinfo, struct ip, struct icmp, struct in6_addr, struct sockaddr_in6, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
   [#include "$srcdir/src/have.h"]
 )
 
 dnl Checks for library functions.
 AC_TYPE_SIGNAL
-AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall putenv recvmmsg strsignal nanosleep unsetenv vsyslog devname fdevname],
+AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall pselect putenv strsignal system unsetenv usleep vsyslog devname fdevname],
   [], [], [#include "$srcdir/src/have.h"]
 )
 
 AC_CHECK_FUNC(getopt_long, [getopt=true; AC_DEFINE(HAVE_GETOPT_LONG, 1, [getopt_long()])], [getopt=false])
 AM_CONDITIONAL(GETOPT, test "$getopt" = true)
 
+dnl Support for SunOS
+
+AC_CHECK_FUNC(socket, [], [
+  AC_CHECK_LIB(socket, connect)
+])
+AC_CHECK_FUNC(gethostbyname, [], [
+  AC_CHECK_LIB(nsl, gethostbyname)
+])
+
+AC_CHECK_DECLS([freeaddrinfo, gai_strerror, getaddrinfo, getnameinfo],
+  [], [], [#include "$srcdir/src/have.h"]
+)
+
 AC_CHECK_DECLS([res_init], [AC_CHECK_LIB(resolv, res_init)], [], [
   #include <netinet/in.h>
   #include <resolv.h>
 ])
 
-dnl Operating system specific checks
-case $host_os in
-  *linux*)
-    AC_CHECK_HEADERS([linux/if_tun.h],
-      [], [AC_MSG_ERROR([Required header file missng])], [#include "$srcdir/src/have.h"]
-    )
-  ;;
-  *bsd*|*dragonfly*|*darwin*)
-    AC_CHECK_HEADERS([net/if_tun.h net/if_utun.h net/tun/if_tun.h net/if_tap.h net/tap/if_tap.h],
-      [], [], [#include "$srcdir/src/have.h"]
-    )
-  ;;
-  *solaris*)
-    AC_CHECK_FUNC(socket, [], [AC_CHECK_LIB(socket, connect)])
-  ;;
-  *)
-  ;;
-esac
-
 AC_CACHE_SAVE
 
-AC_ARG_ENABLE(legacy-protocol,
-  AS_HELP_STRING([--disable-legacy-protocol], [disable support for the legacy (tinc 1.0) protocol]),
-  [ AS_IF([test "x$enable_legacy_protocol" = "xno"],
-    [ AC_DEFINE(DISABLE_LEGACY, 1, [Disable support for the legacy (tinc 1.0) protocol]) ])
-  ]
-)
-
 dnl These are defined in files in m4/
 
-dnl AC_ARG_WITH(libgcrypt, AC_HELP_STRING([--with-libgcrypt], [enable use of libgcrypt instead of OpenSSL])], [])
-dnl AC_ARG_WITH(openssl, AC_HELP_STRING([--without-openssl], [disable support for OpenSSL])], [])
-
-tinc_CURSES
-tinc_READLINE
 tinc_ZLIB
 tinc_LZO
-
+tinc_OPENSSL
-AS_IF([test "x$enable_legacy_protocol" != "xno"],
-      [AS_IF([test -n "$with_libgcrypt"],
-	     [gcrypt=true; tinc_LIBGCRYPT],
-	     [openssl=true; tinc_OPENSSL])
-      ]
-)
-
-AM_CONDITIONAL(OPENSSL, test -n "$openssl")
-AM_CONDITIONAL(GCRYPT, test -n "$gcrypt")
-
-tinc_MINIUPNPC
-AM_CONDITIONAL(MINIUPNPC, test "x$enable_miniupnpc" = "xyes")
 
 dnl Check if support for jumbograms is requested
 AC_ARG_ENABLE(jumbograms,
@@ -266,6 +242,6 @@ if test "x$runstatedir" = "x"; then
   AC_SUBST([runstatedir], ['${localstatedir}/run'])
 fi
 
-AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile test/Makefile systemd/Makefile])
+AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile systemd/Makefile])
 
 AC_OUTPUT

debian/NEWS

@@ -0,0 +1,14 @@
+tinc (1.0.27-1) unstable; urgency=medium
+
+  This package now provides native systemd service files, allowing multiple
+  instances of tinc to be managed. Existing networks listed in
+  /etc/tinc/nets.boot will be converted to service instances once during this
+  upgrade. Afterwards, you can enable and disable networks using:
+  
+    systemctl enable tinc@<netname>
+    systemctl disable tinc@<netname>
+  
+  If you do not have systemd installed, the SysV init script will continue to
+  work as usual. For more information, see README.Debian.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:33:55 +0200

debian/README.Debian

@@ -0,0 +1,80 @@
+tinc for Debian
+---------------
+
+The manual for tinc is also available as info pages, type `info tinc'
+to read it.
+
+There are several ways in which tinc may be automatically started at boot:
+
+Systemd
+-------
+
+Since 1.0.27-1, the tinc package comes with native systemd service files.
+To enable and start a net, call:
+
+systemctl enable tinc@<netname>
+systemctl start tinc@<netname>
+
+This will cause a tincd to be started which uses the configuration from
+/etc/tinc/<netname>, and also makes sure that it will be started next time your
+system boots.
+
+Apart from controlling individual instances, you can also start/stop/reload all
+enabled instances simultaneously by omitting @<netname>, for example:
+
+systemctl reload tinc
+
+Note that when you have systemd installed on your system, the file
+/etc/tinc/nets.boot will not be used anymore to automatically start tinc
+daemons. If the variable EXTRA is defined in /etc/default/tinc, it will be
+passed on to tinc. The variable LIMITS is however not used.
+
+The service files that come with this package start tinc unconditionally.
+However, tinc does support socket activation. If you wish to write a socket
+unit for tinc, use the ListenStream option to specify on which port(s) and
+address(es) tinc should listen.
+
+SysVinit
+--------
+
+The system startup script for tinc, /etc/init.d/tinc, uses the file
+/etc/tinc/nets.boot to find out which networks have to be started. Use one
+netname per line. Lines starting with a # are ignored.
+
+/etc/network/interfaces
+-----------------------
+
+You can create a stanza in /etc/network/interfaces, and add a line with
+"tinc-net <netname>". This will cause a tincd to be started which uses the
+configuration from /etc/tinc/<netname>. You can use an inet static (with
+address and netmask options) or inet dhcp stanza, in which case the ifup will
+configure the VPN interface and you do not need to have a tinc-up script.
+
+The following options are also recognized and map directly to the corresponding
+command line options for tincd:
+
+tinc-config <directory>
+tinc-debug <level>
+tinc-mlock yes
+tinc-logfile <filename>
+tinc-pidfile <filename>
+tinc-chroot yes
+tinc-user <username>
+
+An example stanza:
+
+iface vpn inet static
+	address 192.168.2.42
+	netmask 255.255.0.0
+	tinc-net myvpn
+	tinc-debug 1
+	tinc-mlock yes
+	tinc-user nobody
+	tinc-pidfile /tmp/tinc.pid
+
+This will start a tinc daemon that reads its configuration from
+/etc/tinc/myvpn, logs at debug level 1, locks itself in RAM, runs as user
+nobody, and creates a network interface called "vpn". Ifup then sets the
+address and netmask on that interface.
+
+ -- Guus Sliepen <guus@debian.org>, Sun, 10 April 2016, 01:38:08 +0200

debian/changelog

@@ -0,0 +1,685 @@
+tinc (1.0.36-2) unstable; urgency=medium
+
+  * Disable support for libvdeplug. Closes: #973233
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 22 Nov 2020 10:40:27 +0100
+
+tinc (1.0.36-1) unstable; urgency=medium
+
+  * New upstream version 1.0.36
+  * Add Vcs tags to debian/control.
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 26 Aug 2019 14:17:21 +0200
+
+tinc (1.0.35-2) unstable; urgency=medium
+
+  * Bump Standards-Version and Build-Depend on debhelper-compat (= 12).
+  * Remove calls to dh_installinit and dh_systemd_start from debian/rules,
+    compat level 12 does the right thing by default.
+  * Ensure we clean up doc/tinc.info.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 28 Jan 2019 21:54:45 +0100
+
+tinc (1.0.35-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Includes fixes for CVE-2018-16737, CVE-2018-16738, CVE-2018-16758.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 08 Oct 2018 16:09:06 +0200
+
+tinc (1.0.34-1) unstable; urgency=medium
+
+  [ Guus Sliepen ]
+  * New upstream release.
+    - Fixes a potential segmentation fault when connecting to an IPv6
+      peer via a proxy. Closes: #887401
+  * Add support for the $EXTRA variable in /etc/default/tinc when using
+    systemd. Closes: #887116
+
+  [ Benda Xu ]
+  * Prevent possible incorrect IPv6 checksums due to function inlining.
+    Closes: #891400
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 12 Jun 2018 23:00:49 +0200
+
+tinc (1.0.33-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Test for /etc/default/tinc before trying to source it. Closes: #777262
+  * Use --runstatedir=/run.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 04 Nov 2017 16:22:06 +0100
+
+tinc (1.0.32-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Add a note to new nets.boot files that it is not used with systemd.
+    Closes: #841052
+  * In the post-down script, read the pid file only once. Closes: #832784
+  * Explicitly use /bin/sleep from coreutils. Closes: #772379
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 05 Sep 2017 20:23:36 +0200
+
+tinc (1.0.31-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Bump debian/compat.
+  * Add missing Depends: lsb-base.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 15 Jan 2017 16:20:40 +0100
+
+tinc (1.0.29-2) unstable; urgency=medium
+
+  * Rebuild with libssl-dev from unstable.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Oct 2016 13:09:46 +0200
+
+tinc (1.0.29-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump debian/compat.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 10 Oct 2016 22:30:25 +0200
+
+tinc (1.0.28-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Fixes FTBFS on kfreebsd.
+  * Systemd service files are now provided by upstream.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 15:44:28 +0200
+
+tinc (1.0.27-2) unstable; urgency=medium
+
+  * Fix tinc@.service.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 12:45:33 +0200
+
+tinc (1.0.27-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Add native systemd unit files.
+  * Automatically convert networks listed in nets.boot to systemd service
+    instances on upgrade.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:39:16 +0200
+
+tinc (1.0.26-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Use the contents, not the presence, of the pidfile to check that tincd is
+    shut down properly. Closes: #774682
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 05 Jul 2015 17:23:08 +0200
+
+tinc (1.0.24-2) unstable; urgency=medium
+
+  * Improve the init script: stopping tinc now waits for the process to
+    terminate. If that doesn't happen in 5 seconds, it will send the TERM
+    signal again (which helps if tinc is waiting for a script to finish
+    executing). It now also detects whether the process mentioned in the PID
+    file is actually running, and if not it will exit early and without
+    warnings. Closes: #748107
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 14 May 2014 21:44:16 +0200
+
+tinc (1.0.24-1) unstable; urgency=medium
+
+  [ Guus Sliepen ]
+  * New upstream release
+  * Add a debian/watch file.
+  * Bump Standards-Version.
+
+  [ Gian Piero Carrubba ]
+  * Allow resource limits to be set in /etc/default/tinc.
+    Closes: #690685, #704702
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 11 May 2014 21:17:13 +0200
+
+tinc (1.0.23-2) unstable; urgency=low
+
+  * Use if-statements instead of && in shell scripts. Closes: #731279
+    The && operator does not clear the error status, and if the next statement
+    in a shell script does not change the error status it would cause the
+    script to prematurely exit. Thanks to Peter Reinholdtsen for spotting it.
+  * Use absolute path to tincd in the if-post-down script.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 05 Dec 2013 09:41:13 +0000
+
+tinc (1.0.23-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 19 Oct 2013 21:06:05 +0200
+
+tinc (1.0.22-1) unstable; urgency=low
+
+  * New upstream release.
+    - Handles whitespace between command line flags and optional arguments.
+      Closes: #710267
+  * Bump Standards-Version.
+  * Source /lib/lsb/init-functions in the init.d script.
+  * Don't use texi2html anymore, use automake's install-html target which uses
+    makeinfo.
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 14 Aug 2013 15:34:29 +0200
+
+tinc (1.0.21-1) unstable; urgency=low
+
+  * New upstream release.
+    - Includes fix for CVE-2013-1428.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 05 May 2013 10:42:33 +0200
+
+tinc (1.0.19-3) unstable; urgency=high
+
+  * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 12 Apr 2013 22:52:10 +0200
+
+tinc (1.0.19-2) unstable; urgency=low
+
+  * Fix behaviour of tinc-pidfile. Closes: #679130
+  * Enable parallel building in debian/rules.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 26 Jun 2012 18:28:34 +0200
+
+tinc (1.0.19-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump debian/compat so tinc gets built with hardening flags.
+  * Allow tinc-pidfile in /etc/network/interfaces.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 25 Jun 2012 20:29:22 +0200
+
+tinc (1.0.18-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 25 Mar 2012 18:52:15 +0200
+
+tinc (1.0.17-1) unstable; urgency=low
+
+  * New upstream release.
+  * Enable support for UML and VDE.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 10 Mar 2012 14:50:00 +0100
+
+tinc (1.0.16-1) unstable; urgency=low
+
+  * New upstream release.
+  * Mention alarm option in /etc/init.d/tinc's usage information.
+    Closes: #631761
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 23 Jul 2011 14:37:56 +0200
+
+tinc (1.0.15-1) unstable; urgency=low
+
+  * New upstream release.
+  * Send SIGALRM to running tinc daemons whenever an interface is brought up
+    with the ifupdown framework. Based on a patch from Joachim Breitner.
+    Closes: #629880
+  * Allow tinc daemons to be started using ifupdown.
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 24 Jun 2011 18:21:51 +0200
+
+tinc (1.0.14-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 09 May 2011 00:25:37 +0200
+
+tinc (1.0.13-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 13 Apr 2010 12:06:36 +0200
+
+tinc (1.0.12-2) unstable; urgency=low
+
+  * Remove debconf questions. Closes: #572116
+    Apparently debconf may not be used to ask a question at install time and
+    use the answer at upgrade time. Instead of kludging around this
+    restriction, no questions are asked anymore, and tinc will now always be
+    restarted when upgrading.
+  * Wait up to 5 seconds for tinc daemon to stop before restarting it.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 02 Mar 2010 14:01:36 +0100
+
+tinc (1.0.12-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Migrate from CDBS to debhelper.
+  * Convert source package to 3.0 (quilt) format.
+  * Remove useless tinc.modules.
+  * Use init.d script from Michael Tokarev, allowing per-network arguments to
+    tincd.
+  * Remove update-rc.d calls from postinst and postrm.
+  * Let the init.d script depend on $remote_fs.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 04 Feb 2010 00:56:45 +0100
+
+tinc (1.0.11-1) unstable; urgency=low
+
+  * New upstream release.
+  * Cope with texi2html arbitrarily changing its output directory.
+    Closes: #552927
+  * Do not stop tinc when configuring a new version, just restart after
+    the upgrade.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 01 Nov 2009 20:37:16 +0100
+
+tinc (1.0.10-1) unstable; urgency=low
+
+  * New upstream release.
+  * Include Russian debconf translation. Closes: #548759
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 18 Oct 2009 16:31:49 +0200
+
+tinc (1.0.9-1) unstable; urgency=low
+
+  * New upstream release.
+    - Binds IPv6 sockets only to IPv6. Closes: #440150
+  * Update copyright file. Closes: #482566
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 26 Dec 2008 13:25:05 +0100
+
+tinc (1.0.8-2) unstable; urgency=low
+
+  * Include Portugese debconf translation. Closes: #434191
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 14 Aug 2007 13:50:27 +0200
+
+tinc (1.0.8-1) unstable; urgency=low
+
+  * New upstream release. Closes: #173987
+  * Include german debconf translation. Closes: #412351
+  * Build-Depend on texinfo. Closes: #424209
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 16 May 2007 17:59:16 +0200
+
+tinc (1.0.7-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Fri,  5 Jan 2007 15:55:42 +0100
+
+tinc (1.0.6-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 18 Dec 2006 15:41:03 +0100
+
+tinc (1.0.5-1) unstable; urgency=low
+
+  * New upstream release. Closes: #391610
+  * Add an LSB section to the init script.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 14 Nov 2006 16:32:20 +0100
+
+tinc (1.0.4-4) unstable; urgency=low
+
+  * Include swedish debconf translation. Closes: #332963
+  * Remove nets.boot on purge. Closes: #333303
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 17 Oct 2005 12:34:32 +0200
+
+tinc (1.0.4-3) unstable; urgency=low
+
+  * Depend on debconf | debconf-2.0.
+  * Include vietnamese debconf translation. Closes: #322305
+  * Include japanese debconf translation. Closes: #319591
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 29 Sep 2005 11:15:34 +0200
+
+tinc (1.0.4-2) unstable; urgency=low
+
+  * Compensate for change in texinfo's output directory. Closes: #318562
+  * Include Czech translation of the debconf questions. Closes: #312982
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 16 Jul 2005 11:42:04 +0200
+
+tinc (1.0.4-1) unstable; urgency=low
+
+  * New upstream release. Closes: #294819
+  * Update french translation of debconf template. Closes: #293371, #296148
+  * Allow dashes in nets.boot. Closes: #296281
+
+ -- Guus Sliepen <guus@debian.org>  Wed,  4 May 2005 21:56:22 +0200
+
+tinc (1.0.3-4) unstable; urgency=low
+
+  * Call debconf early in postinst so it won't get confused by output
+    from other commands in the postinst script. Closes: #292920
+  * If MAKEDEV doesn't know about net/tun, fall back to tun.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 31 Jan 2005 13:27:16 +0100
+
+tinc (1.0.3-3) unstable; urgency=low
+
+  * Fix clean rule in debian/rules.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 23:16:59 +0000
+
+tinc (1.0.3-2) unstable; urgency=low
+
+  * Don't check for /dev/tap* in postinst if we don't create them anyway.
+  * MAKEDEV expects net/tun instead of tun.
+  * Don't ask if /dev/net/tun should be created, just do it.
+    Closes: #259489, #292450
+  * Move $EXTRA from init.d/tinc to /etc/default/tinc. Closes: #281366
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 14:10:02 +0100
+
+tinc (1.0.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Adopting the package from Ivo.
+  * Use invoke-rc.d, and tell user to do so as well. Closes: #223276
+  * Let force-reload do the same thing as reload. Closes: #230180
+
+ -- Guus Sliepen <guus@debian.org>  Fri,  1 Oct 2004 21:04:14 +0200
+
+tinc (1.0.2-2) unstable; urgency=low
+
+  * debian/control: Oops, really make that automake1.7.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 21:53:04 +0100
+
+tinc (1.0.2-1) unstable; urgency=low
+
+  * New upstream release:
+      * Fix broken replies to CHAL_RESP.  (Closes: #217646)
+  * debian/control: Updated automake build dependency to automake1.7.
+    (Closes: #219360)
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 19:56:04 +0100
+
+tinc (1.0.1-2) unstable; urgency=low
+
+  * debian/dirs: Removed, moved contents to tinc.dirs.
+    (Closes: #208591)
+  * debian/docs: Renamed to tinc.docs.
+  * debian/rules: Install the contents of doc/sample-config.tar.gz in
+    /usr/share/doc/tinc/examples instead of /etc/tinc.
+  * debian/Makefile*: Removed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 10 Sep 2003 12:19:32 +0200
+
+tinc (1.0.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * debian/patches/001_openbsd_device.c.patch: Removed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 14 Aug 2003 17:03:28 +0200
+
+tinc (1.0release-1) unstable; urgency=low
+
+  * New upstream version.  (Closes: #204639)
+      * Fixes switching back to normal logging mode when killing with
+        SIGINT twice.  (Closes: #175633)
+      * Uses one SSL context struct for each connection, speeding up
+        encrypting/decrypting data; don't throw away out of sequence
+        packets.  (Closes: #188874)
+      * Fixes handling of broadcast messages.  (Closes: #175632)
+  * debian/rules: Use cdbs.
+  * debian/control: Build-Depend on cdbs, liblzo-dev.
+  * debian/patches/001_openbsd_device.c.patch: Sync openbsd/device.c to
+    latest CVS version.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Aug 2003 16:13:29 +0200
+
+tinc (1.0pre8-6) unstable; urgency=low
+
+  * debian/po/fr.po: Added French debconf translation.  (Closes: #201803)
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 18 Jul 2003 10:03:20 +0200
+
+tinc (1.0pre8-5) unstable; urgency=low
+
+  * debian/*: Change to po-debconf, thanks to From: Michel Grentzinger
+    <mic.grentz@online.fr> for the patch:
+      - change debhelper dependency to 4.1.16 (according to man
+        po-debconf),
+      - manually add nl translation in old tinc.templates (master),
+      - run debconf-gettextize debian/tinc.templates,
+      - move old templates files (debian/tinc.templates.*),
+      - change construction "If you say no" to "If you refuse",
+  * debian/rules: Call po2debconf.
+  * debian/rules: Don't copy COPYING.README to the package.
+  * debian/control: Update Standards-Version.
+  * debian/conffiles: Removed.
+  * debian/postinst: No longer use mknod directly, use MAKEDEV.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 15 Jul 2003 20:13:47 +0200
+
+tinc (1.0pre8-4) unstable; urgency=low
+
+  * src/net.h, src/net_packet.c, src/net_setup.c: Apply fix from CVS
+    for OpenSSL-related memory leaks.  (Closes: #189432)
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon,  5 May 2003 15:00:29 +0200
+
+tinc (1.0pre8-3) unstable; urgency=low
+
+  * m4/openssl.m4: Updated to CVS version.  (Closes: #184400)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 13 Mar 2003 17:24:42 +0100
+
+tinc (1.0pre8-2) unstable; urgency=low
+
+  * debian/postinst: Create /dev/net/tun if it doesn't exist.
+  * debian/tinc.modules: Add alias for /dev/net/tun.
+  * debian/rules: Install tinc.modules.
+  * These things together: (Closes: #151967, #153156)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Nov 2002 22:45:38 +0100
+
+tinc (1.0pre8-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/rules:
+      - DEB_BUILD_OPTIONS support.
+      - Enable --enable-tracing by default.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 17 Sep 2002 13:50:44 +0200
+
+tinc (1.0pre7-3) unstable; urgency=low
+
+  * Properly install _all_ info pages. (Closes: #144718)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 29 May 2002 14:01:21 +0200
+
+tinc (1.0pre7-2) unstable; urgency=low
+
+  * Dutch translation wasn't being installed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 11 Apr 2002 09:26:14 +0200
+
+tinc (1.0pre7-1) unstable; urgency=medium
+
+  * New upstream release.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue,  9 Apr 2002 16:04:46 +0200
+
+tinc (1.0pre6-3) unstable; urgency=medium
+
+  * Synched with upstream CVS.
+  * Added build dependency on zlib1g-dev. (Closes: #141705)
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon,  8 Apr 2002 21:19:31 +0200
+
+tinc (1.0pre6-2) unstable; urgency=low
+
+  * The Section was non-US again, so changed it back to main/net.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 28 Mar 2002 07:26:10 +0100
+
+tinc (1.0pre6-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixed text in debian/copyright
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 27 Mar 2002 23:10:07 +0100
+
+tinc (1.0pre5-4) unstable; urgency=low
+
+  * Added a debconf question for restarting on upgrade.
+  * Added reload option to init.d, start with EXTRA='-d' default.
+  * Moved from non-US to main.
+  * Install example configuration files.
+  * The HTML documentation wasn't installed; fixed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 26 Mar 2002 20:14:19 +0100
+
+tinc (1.0pre5-3) unstable; urgency=low
+
+  * Config variables are now treated case sentitivly again.
+  * Added a forgotten xstrdup.
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 15 Feb 2002 12:35:17 +0100
+
+tinc (1.0pre5-2) unstable; urgency=low
+
+  * MaxTimeout accidentally wasn't configurable. (Closes: #119653)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Feb 2002 13:36:54 +0100
+
+tinc (1.0pre5-1) unstable; urgency=low
+
+  * New upstream version. (Closes: #119653)
+  * Init script redone in sh.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Feb 2002 16:39:53 +0100
+
+tinc (1.0pre4-1.cvs010621.6) unstable; urgency=low
+
+  * Somehow po-Makefile.in.in.diff got lost, readded. (Closes: #119157)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 15 Nov 2001 17:00:03 +0100
+
+tinc (1.0pre4-1.cvs010621.5) unstable; urgency=low
+
+  * Fix a typo in postinst that let it MAKEDEV even on devfs.
+    (Closes: #116034)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 18 Oct 2001 09:35:16 +0200
+
+tinc (1.0pre4-1.cvs010621.4) unstable; urgency=low
+
+  * Ask before creating the device files. (Closes: #111099)
+  * Add a section to the info file.
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 12 Oct 2001 20:47:09 +0200
+
+tinc (1.0pre4-1.cvs010621.3) unstable; urgency=low
+
+  * Build and install html documentation. (Closes: #106843)
+  * Remove build-time dependency on libc6-dev.
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon, 30 Jul 2001 22:03:52 +0200
+
+tinc (1.0pre4-1.cvs010621.2) unstable; urgency=low
+
+  * Changed location of the pidfile. (Closes: #102798)
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun,  1 Jul 2001 01:57:43 +0200
+
+tinc (1.0pre4-1.cvs010621.1) unstable; urgency=low
+
+  * New upstream version. (Closes: #98730)
+  * Rebuilding automatically inserted new config.{sub|guess}.
+    (Closes: #98165)
+  * Updated Standards-Version.
+  * Don't include a sample configuration file.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 21 Jun 2001 14:08:49 +0200
+
+tinc (1.0pre3-5) unstable; urgency=low
+
+  * Fixed an error in the init script that prevented tinc from
+    starting correctly.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu,  8 Feb 2001 02:45:09 +0100
+
+tinc (1.0pre3-4) unstable; urgency=low
+
+  * Change build-depends for OpenSSL to libssl096-dev
+    (Closes: #84197, #84873).
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun,  4 Feb 2001 22:43:22 +0100
+
+tinc (1.0pre3-3) unstable; urgency=low
+
+  * Set architecture to any (really this time!) (Closes: #80451).
+  * Section set to non-US
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 23 Jan 2001 22:52:53 +0100
+
+tinc (1.0pre3-2) unstable; urgency=low
+
+  * Set architecture to any (Closes: #80451).
+  * Added tinc.modules with some useful module aliases.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat, 13 Jan 2001 16:10:57 +0100
+
+tinc (1.0pre3-1) unstable; urgency=low
+
+  * New upstream version (1.0pre3) (Closes: #71274).
+  * Better Depends and Build-Depends lines.
+  * Dropped dependencies on libgmp, added libssl.
+  * doc-base.tinc: New file.
+  * Deleted the file shlibs, as there on longer is a libblowfish.
+  * Patch po/Makefile.in.in from po-Makefile.in.in.diff if necessary.
+  * Use dh_perl to get accurate perl dependencies.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu,  9 Nov 2000 21:58:40 +0100
+
+tinc (1.0pre2-1.1) unstable; urgency=low
+
+  * NMU at Ivo's request as his application is being processed, and his
+    sponsor is based in the US.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 Jun 2000 21:52:30 +0200
+
+tinc (1.0pre2-1) unstable; urgency=low
+
+  * postinst creates a file /etc/tinc/nets.boot, containing all networks
+    to be started upon system startup;
+  * init.d script starts all networks from that list.
+  * postinst script creates tap devices.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Tue, 16 May 2000 00:06:25 +0200
+
+tinc (1.0pre1-0.4) unstable; urgency=low
+
+  * postinst script.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Mon, 15 May 2000 19:22:05 +0200
+
+tinc (1.0pre1-0.3) unstable; urgency=low
+
+  * system startup script.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Sun, 14 May 2000 22:58:02 +0200
+  
+tinc (1.0pre1-0.2) unstable; urgency=low
+
+  * Included the blowfish license.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
+
+tinc (1.0pre1-0.1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
+
+

debian/control

@@ -0,0 +1,20 @@
+Source: tinc
+Section: net
+Priority: optional
+Maintainer: Guus Sliepen <guus@debian.org>
+Standards-Version: 4.4.0
+Build-Depends: libssl-dev, debhelper-compat (= 12), gettext, texinfo, zlib1g-dev, liblzo2-dev
+Homepage: http://www.tinc-vpn.org/
+Vcs-Browser: https://salsa.debian.org/guus/tinc
+Vcs-Git: https://salsa.debian.org/guus/tinc.git
+Rules-Requires-Root: no
+
+Package: tinc
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 3.0-6)
+Description: Virtual Private Network daemon
+ tinc is a daemon with which you can create a virtual private network
+ (VPN). One daemon can handle multiple connections, so you can
+ create an entire (moderately sized) VPN with only one daemon per
+ participating computer.

debian/copyright

@@ -0,0 +1,34 @@
+This package was debianized by Ivo Timmermans <ivo@debian.org> on
+Fri, 21 Apr 2000 17:07:50 +0200.
+
+It was downloaded from http://www.tinc-vpn.org/
+
+Upstream Authors:
+ Guus Sliepen <guus@tinc-vpn.org>
+ Ivo Timmermans <ivo@tinc-vpn.org>
+
+Copyright (C) 1998-2005 Ivo Timmermans
+              1998-2008 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+On Debian GNU/Linux systems, the complete text of the GNU General Public
+License version 2 can be found in /usr/share/common-licenses/GPL-2.
+
+The following applies to tinc:
+
+This program is released under the GPL with the additional exemption
+that compiling, linking, and/or using OpenSSL is allowed.  You may
+provide binary packages linked to the OpenSSL libraries, provided that
+all other requirements of the GPL are met.
+
+The following applies to the LZO library:
+
+Hereby I grant a special exception to the tinc VPN project
+(http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
+(http://www.openssl.org).
+
+Markus F.X.J. Oberhumer

debian/doc-base.tinc

@@ -0,0 +1,10 @@
+Document: tinc
+Title: tinc Manual
+Author: Ivo Timmermans, Guus Sliepen
+Abstract: This manual describes how to set up a Virtual Private
+ Network with tinc.
+Section: System/Security
+
+Format: HTML
+Files: /usr/share/doc/tinc/tinc.html/*
+Index: /usr/share/doc/tinc/tinc.html/index.html

debian/info

@@ -0,0 +1 @@
+doc/tinc.info

debian/patches/fix-incorrect-icmpv6-checksum

@@ -0,0 +1,65 @@
+Package: tinc
+Version: 1.0.33-1
+Severity: important
+
+Dear Guus,
+
+I have been using tinc since 2009 and it is great!
+
+When PMTUDiscovery=yes and Mode=switch, and if ipv6 is used inside
+tinc, the ICMPv6 "Packet Too Big" packets have incorrect checksums.
+It can be reproduced by `ping6 <host in tinc> -s 1800` and `tcpdump -i
+<tinc interface>`.  Consequently, the host ignores the tinc-generated
+ICMPv6 packets, PMTUDiscovery does not work and the connections freeze
+when data flows are big.
+
+I find the bug is gone if the function "inet_checksum" in route.c is
+not inlined, either by compiling tinc with "-O2
+-fno-inline-functions", or apply a patch such as,
+
+diff --git a/src/route.c b/src/route.c
+index ff82c06e..cd55383a 100644
+--- a/src/route.c
++++ b/src/route.c
+@@ -60,7 +60,7 @@ static const size_t opt_size = sizeof(struct nd_opt_hdr);
+
+ /* RFC 1071 */
+
+-static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
++__attribute__ ((noinline)) static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
+ 	uint16_t *p = data;
+ 	uint32_t checksum = prevsum ^ 0xFFFF;
+
+
+
+I have tested with gcc-7.3.0 and gcc-5.4.0.  They behaved the same.  I
+am not good at assembly to find out what really happened, but it is
+for sure that inet_checksum does not work as expected if compiled
+inline.
+
+Thanks!
+
+Yours,
+Benda
+
+-- System Information:
+Debian Release: buster/sid
+  APT prefers unstable
+  APT policy: (500, 'unstable')
+Architecture: amd64 (x86_64)
+
+Kernel: Linux 4.9.0-5-amd64 (SMP w/8 CPU cores)
+Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
+Shell: /bin/sh linked to /bin/dash
+Init: sysvinit (via /sbin/init)
+
+Versions of packages tinc depends on:
+ii  libc6      2.26-2
+ii  liblzo2-2  2.08-1.2+b2
+ii  libssl1.1  1.1.0g-2
+ii  lsb-base   9.20170808
+ii  zlib1g     1:1.2.8.dfsg-5
+
+tinc recommends no packages.
+
+tinc suggests no packages.

debian/patches/series

@@ -0,0 +1,2 @@
+fix-incorrect-icmpv6-checksum
+support-etc-defaults-tinc

debian/patches/support-etc-defaults-tinc

@@ -0,0 +1,12 @@
+--- a/systemd/tinc@.service.in
++++ b/systemd/tinc@.service.in
+@@ -9,7 +9,8 @@
+ [Service]
+ Type=simple
+ WorkingDirectory=@sysconfdir@/tinc/%i
+-ExecStart=@sbindir@/tincd -n %i -D
++EnvironmentFile=/etc/default/tinc
++ExecStart=@sbindir@/tincd -n %i -D $EXTRA
+ ExecReload=@sbindir@/tincd -n %i -kHUP
+ KillMode=mixed
+ Restart=on-failure

debian/postinst

@@ -0,0 +1,31 @@
+#! /bin/sh
+
+NETSFILE="/etc/tinc/nets.boot"
+
+set -e
+
+case "$1" in
+    configure)
+	if [ ! -e /dev/.devfsd ] ; then if [ ! -e /dev/.devfs ] ; then
+		if [ ! -e /dev/net/tun ] ; then if [ ! -e /dev/tun ] ; then if [ -e /dev/MAKEDEV ]; then
+			echo "Creating tun device..."
+			cd /dev && ./MAKEDEV net/tun 2>/dev/null || ./MAKEDEV tun 2>/dev/null || echo "Failed to create tun device."
+		fi; fi; fi
+	fi; fi
+
+	if [ ! -e $NETSFILE ] ; then
+	    echo "## This file contains all names of the networks to be started on system startup when using sysvinit." > $NETSFILE
+	    echo "## If you are using systemd, use systemctl enable tinc@netname to enable individual networks." >> $NETSFILE
+	fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+#DEBHELPER#

debian/postrm

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = purge ]; then
+    rm -f /etc/tinc/nets.boot
+fi
+
+#DEBHELPER#

debian/preinst

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+NETSFILE="/etc/tinc/nets.boot"
+SYSTEM="/lib/systemd/system"
+WANTS="/etc/systemd/system/multi-user.target.wants"
+
+set -e
+
+case "$1" in
+	upgrade)
+		if dpkg --compare-versions "$2" '<<' "1.0.27-1"; then
+			if [ -f "$NETSFILE" ]; then
+				echo -n "Creating systemd service instances from nets.boot:"
+				mkdir -p "$WANTS"
+				egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
+					echo -n " $net"
+					ln -s "$SYSTEM/tinc@.service" "$WANTS/tinc@$net.service" 2>/dev/null || true
+				done
+				echo "."
+			fi
+		fi
+	;;
+
+	*)
+	;;
+esac
+
+#DEBHELPER#

debian/rules

@@ -0,0 +1,16 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@
+
+override_dh_clean:
+	dh_clean
+	rm -f doc/tinc.info
+
+override_dh_auto_configure:
+	dh_auto_configure -- --enable-uml --with-systemd=/lib/systemd/system --runstatedir=/run
+
+override_dh_auto_install:
+	dh_auto_install -- install-html
+	# Remove info dir file
+	rm -f debian/tinc/usr/share/info/dir

debian/source/format

@@ -0,0 +1 @@
+3.0 (quilt)

debian/tinc.default

@@ -0,0 +1,7 @@
+# Extra options to be passed to tincd.
+# EXTRA="-d"
+
+# Limits to be configured for the tincd process. Please read your shell
+# (pointed by /bin/sh) documentation for ulimit. You probably want to raise the
+# max locked memory value if using both --mlock and --user flags.
+# LIMITS="-l 1024"

debian/tinc.dirs

@@ -0,0 +1,7 @@
+usr/sbin
+usr/share
+etc
+etc/init.d
+usr/share/locale
+usr/share/doc/tinc
+etc/tinc

debian/tinc.docs

@@ -0,0 +1,3 @@
+NEWS
+README
+AUTHORS

debian/tinc.files

@@ -0,0 +1,6 @@
+usr/sbin/tincd
+usr/share/man
+etc
+usr/share/doc/tinc
+usr/share/locale
+usr/share/info

debian/tinc.if-post-down

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+# Determine location of the PID file
+
+EXTRA=""
+if [ -n "$IF_TINC_PIDFILE" ]; then
+	EXTRA="--pidfile=$IF_TINC_PIDFILE"
+else
+	IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
+fi
+
+# Stop the tinc daemon
+
+read pid rest < $IF_TINC_PIDFILE 2>/dev/null
+
+/usr/sbin/tincd -n "$IF_TINC_NET" -k $EXTRA
+
+# Wait for it to shut down properly
+
+/bin/sleep 0.1
+i=0;
+while [ -f $IF_TINC_PIDFILE ] ; do
+	if [ ! -e "/proc/$pid" ] ; then
+		exit 0
+	fi
+
+	if [ $i = '30' ] ; then
+		echo 'Failed to stop tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+exit 0

debian/tinc.if-pre-up

@@ -0,0 +1,70 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+# Read options from /etc/default
+
+[ -r /etc/default/tinc ] && . /etc/default/tinc
+
+# Set process limits
+
+setlimits() {
+  while [ $# -gt 0 ]; do
+    parm=$1 ; shift
+    if [ -n "$1" -a "${1#-}" = "$1" ]; then
+      value=$1 ; shift
+      ulimit $parm $value
+    else
+      ulimit $parm
+    fi
+  done
+}
+
+test -n "$LIMITS" && setlimits $LIMITS
+
+# Read options from /etc/network/interfaces
+
+[ -n "$IF_TINC_CONFIG" ]          && EXTRA="$EXTRA -c $IF_TINC_CONFIG"
+[ -n "$IF_TINC_DEBUG" ]           && EXTRA="$EXTRA -d$IF_TINC_DEBUG"
+[ -n "$IF_TINC_MLOCK" ]           && EXTRA="$EXTRA --mlock"
+[ -n "$IF_TINC_LOGFILE" ]         && EXTRA="$EXTRA --logfile=$IF_TINC_LOGFILE"
+[ -n "$IF_TINC_PIDFILE" ]         && EXTRA="$EXTRA --pidfile=$IF_TINC_PIDFILE" || IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
+[ -n "$IF_TINC_CHROOT" ]          && EXTRA="$EXTRA --chroot"
+[ -n "$IF_TINC_USER" ]            && EXTRA="$EXTRA --user=$IF_TINC_USER"
+
+
+# Start tinc daemon
+
+/usr/sbin/tincd -n "$IF_TINC_NET" -o "Interface=$IFACE" $EXTRA
+
+# Wait for it to come up properly
+
+/bin/sleep 0.1
+i=0;
+while [ ! -f $IF_TINC_PIDFILE ] ; do
+	if [ $i = '30' ] ; then
+		echo 'Failed to start tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+while read pid rest < $IF_TINC_PIDFILE ; do
+	if [ -e "/proc/$pid" ] ; then
+		exit 0
+	fi
+
+	if [ $i = '30' ] ; then
+		echo 'Failed to start tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+exit 0

debian/tinc.if-up

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -n "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+invoke-rc.d tinc alarm || exit 0

debian/tinc.init

@@ -0,0 +1,140 @@
+#! /bin/sh
+#
+### BEGIN INIT INFO
+# Provides:          tinc
+# Required-Start:    $remote_fs $network
+# Required-Stop:     $remote_fs $network
+# Should-Start:      $syslog $named
+# Should-Stop:       $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start tinc daemons
+# Description:       Create a file $NETSFILE (/etc/tinc/nets.boot),
+#                    and put all the names of the networks in there.
+#                    These names must be valid directory names under
+#                    $TCONF (/etc/tinc). Lines starting with a # will be
+#                    ignored in this file.
+### END INIT INFO
+#
+# Based on Lubomir Bulej's Redhat init script.
+
+. /lib/lsb/init-functions
+
+DAEMON="/usr/sbin/tincd"
+NAME="tinc"
+DESC="tinc daemons"
+TCONF="/etc/tinc"
+NETSFILE="$TCONF/nets.boot"
+NETS=""
+
+test -f $DAEMON || exit 0
+
+[ -r /etc/default/tinc ] && . /etc/default/tinc
+
+# foreach_net "what-to-say" action [arguments...]
+foreach_net() {
+  if [ ! -f $NETSFILE ] ; then
+    echo "Please create $NETSFILE."
+    exit 0
+  fi
+  echo -n "$1"
+  shift
+  egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
+    echo -n " $net"
+    "$@" $net $args
+  done
+  echo "."
+}
+
+signal_running() {
+  for i in /var/run/tinc.*pid; do
+    if [ -f "$i" ]; then
+      head -1 $i | while read pid; do
+        kill -$1 $pid
+      done
+    fi
+  done
+}
+
+setlimits() {
+  while [ $# -gt 0 ]; do
+    parm=$1 ; shift
+    if [ -n "$1" -a "${1#-}" = "$1" ]; then
+      value=$1 ; shift
+      ulimit $parm $value
+    else
+      ulimit $parm
+    fi
+  done
+}
+
+test -n "$LIMITS" && setlimits $LIMITS
+
+start() {
+  $DAEMON $EXTRA -n "$@"
+}
+
+stop() {
+  [ -f /var/run/tinc.$1.pid ] || return
+  read pid rest </var/run/tinc.$1.pid || return
+  kill -0 "$pid" 2>/dev/null || return
+
+  $DAEMON -n $1 -k || return
+
+  i=0;
+  /bin/sleep 0.5
+
+  # Wait for the pidfile to disappear
+  while [ -f /var/run/tinc.$1.pid ]; do
+    # And check that there is an actual process running
+    kill -0 "$pid" 2>/dev/null || return
+
+    if [ $i = '10' ] ; then
+      # It's still alive, kill it again and give up
+        $DAEMON -n $1 -k && /bin/sleep 0.5
+      break
+    else
+      echo -n "."
+      i=$(($i+1))
+    fi
+
+    /bin/sleep 0.5
+  done
+}
+
+reload() {
+  $DAEMON -n $1 -kHUP
+}
+
+alarm() {
+  $DAEMON -n $1 -kALRM
+}
+
+restart() {
+  stop "$@"
+  start "$@"
+}
+
+case "$1" in
+  start)
+    foreach_net "Starting $DESC:" start
+  ;;
+  stop)
+    foreach_net "Stopping $DESC:" stop
+  ;;
+  reload|force-reload)
+    foreach_net "Reloading $DESC configuration:" reload
+  ;;
+  restart)
+    foreach_net "Restarting $DESC:" restart
+  ;;
+  alarm)
+    signal_running ALRM
+  ;;
+  *)
+    echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|alarm}"
+    exit 1
+  ;;
+esac
+
+exit 0

debian/upstream/signing-key.asc

@@ -0,0 +1,70 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBEVZzTABEADawFv/ibQ48uA1eRhL07vdM36Pcq2HDyuyNA+vYEalNH4jLmha
+nGPvDALWwX0DXIWDAG8zeTj8s8zliLIjuPS4WRI2YdKIvWeG9fEvpKSXVWa42ica
+dpzn/H2aBd4Ax6rQaiTXKOvxANAp2Veb+73ssPV5AL00uGTpzhh98xQzfFQCZ9ZL
+YSVPqbMed5oCt/4jM9FBO2CuBtkfiO0dVVYtW7FAVjcIlE2NaZol/KGvz7wsS+yA
+dE42W0l5MdQueLmTF4AIUSSTyPFGMQoyqh+MPif73Y589IGcW6GdfKYWnVDo6Trh
+HOhcEky+uTYKb6NL0vrJgUiYVMzAOXFDdJni1eQGO6EfZRNYtTga3alWq/jVelK7
+BID5JyNbkrTAqdPnhJGivVyk8gGX3+Hng8rkXTfWhp6yAYau1QfBm0F2tIQmpL1C
++7DoLvFErboQf685jXJBjzyvsJxB2ZLH1OOw6mNL0hy2LFkIyGza/bktY2em4apo
+KWV5AM5LpyW6THH1oDS7706xFNkf4IFhKE0hKPzBiRnMDjRtMI131lkc5+P8Lqf5
+jLTCFUgbEhU6Dz2YjhHAumVm0NWJETUpFDtVvMrqk+mp5xldUOWRNlYQC5aQOyda
+eHOlNzB/BFbPhKMWI/zWlEH6f0t6WjHb4iwpWO47511aVNHF59aPzbAHxwARAQAB
+tC9UaW5jIERldmVsb3BtZW50IFRlYW0gPHRpbmMtZGV2ZWxAdGluYy12cG4ub3Jn
+PokCNgQTAQIAIAUCRVnNMAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEEpg
+hLnA1x9KxOAQAMPhO2WTXv9AaGQBQhyyoGseKoSfcRjtI9YEfE0OInQQ2E+SPYF/
+dkfeLGAUqa4foTYQlMqfw70vBhTdVCb7HLTGn6/ICFUtDwakUQCgUQGlUVQiondA
+8W6jj+QWrh5BQhHuXy2nCVaKnksu0/xQPsJotghxuYqaot3iJ4qVw9iT/Yeo9irH
+Ffftqu0OVCdQ5zQuFNI9YCv/C83L59ecH7bOzYz2efTyobvxrhmgQtgOQwCWOE09
+Kr3veM9KLG33YoXlqv8QN/3CwtsJvSwfhj+R2JowZC7RqHe/yznRzmRMsgbrolxi
+uiJLonGxcNNkD7WhXi7/zL4A/JaC27XrFf1MPLv8aiTwnOIfrXd5jawpauUOZOXK
+UjIZHlIqviB0r5s7A+AFeHW38Tp9VzNuQ7aEl5bHbSXV+s7DTAwGb279z0AVaJ3h
+5hWFxupw7UoGdzROwCBYzeX3sioAL6QvkXua8X6zOH45VEiSwrRX3Hlx/MLo7Z4g
+PWgFLf6WviHQXCG834To1XIwUk9RgNsL7OzGjtaCuRymADImKMNwierq2zTfoRFQ
+v9onIadIMF1fsc70hiBG9yAi36MEuk4VxG8Jc3PQQfSFm4RWazv1k3E0AAIob2Ek
+DLVjvLO62Navo/OQ6D7yyiX0qes5S7/k3F1h8+87eRn3yxZE2kbxPg8KuQENBEVZ
+zYYBCACoYgExmMKEtABL3pir/IXI4exR/45hkP6txFIrkVQb8DGJ9H39kiDr4gtj
+F+pvcgMpec35S3m4fJ7WhDNvbDB4ZvONc1NMKs9cqDXfB+TLWPm4W+SkcKUrs+nK
+i8l7ieggTALJcvRoLTX2EFmUFrD6y870W3rK2SfC/0VJX8Ou5cPbwCeueExjo5x0
+3gNfu0jWUS0cyA9y+1rVVekrLuJY/+SI4jv3gdzrYbxD0f6dpbpC37QHoJdd0KGF
+acPtT2azjY+HxW10EA3Aw9oZWFXnb1nFg2RbDpkaGLmLbaXweltLyw154UmCXxym
+PXPqi9bSfEkj0GiYrapk4mW114u9ABEBAAGJA0QEGAECAA8FAkVZzYcCGwIFCQHh
+M4ABKQkQSmCEucDXH0rAXSAEGQECAAYFAkVZzYcACgkQ017duBDeLmmu3wf/TFZM
+tLKxiyQPtGSTE3eULPdWCEMDZXdSPTY0QHM7Zvh+qn1ei+iFpD0549MYnBEAwDIV
+4o62Nrcg8IPu0CEkZIAn2JiFFGYvMGk91awZGV1GS3umd7Dt349E1oKDPZVzRn+j
+QIKarXxxabRmx2s/dZZgSs/eguWTboBFmvls9tVfe8x/xPvcHFmqHVUoGKEJy6Tm
+no+s4yNjpc5wAaRml+GYf1tK9WMFuZn79qKxkYv4WI96dXR0FL59YbFRkkaI+1/b
+G31MvWTqVjY1nJGslByFPUUB8Ca1djtp1gx6NXnOYr3V5MEDfdbjjPu79No+/y6M
+tIua5yNtSRlk2nKhIqo3D/sGQ/uHijiMRAtoLhiyqYMc9W9vx/KOoCUHoMJqE39a
+Eputvgwwo0rwgSmNfB1dzneFojBdJ47WBSHC8NKtkpJj6mzvvlaI9jmEpK54x3nl
+OmBj3X/xaepoRGAtrmgTBP4A9hSjrTMGu/tUQjlX+Xcr6n3g7GSVe5FpUyIMPXEU
++JZDTiEUyn1OdzfNGmnWP+KJX5pQVq4czf5XK6otLZJELDVw/Hbjnjmdz5WOKgEH
+jSof3WPeMBgPAcd/cMAZeiGtWM1UpJBHqEXTkthmrpmtRftJKDbooNM9d5OwKiT+
+I3vNBv/plMSr8NDjhTWC+ihrN6RBj1vaqpDgGpucPhoO2hwNqWuI4q5WUKtCyw6J
+An7ErNaH4c0nVaZq6kJ8Vxdt+LpKYmOsJ8y9xtl6StcrkKNn+6ZfCfee7DEo2bvb
+scfpqJqqOqb5KOagTpYs8mo6yQ3leRvFtoeBOQHVQzct23EwOMxbDyeunT50a1eH
+MZTEWuIiuCUudM81QXU46oIcaAtj8tpG0Tmnku9g27EjwxUt+8kVmhlPHMb2TdoF
+k5d0ce+JuxIG5+i+t8sUCorMc8zfp4g1bxZeMOcPnfyO3bSW11EVcN7ZxHlFC+XE
+YOByP50CM3P8lItPlQ+WpY9kYWjiwu9kVPaGQ16G47nspngJInU5dhka3KJGtIZe
+q7kBDQRFWc3GAQgAz/JUs24niKsd0ZtOjUWd4R4y0gjS0kC/vvLL2gbXYkA9tcjG
+5iEvVWJY34QsudX0v1ULsVnJ89X/gsk8hAhAia1TQm+0Qq+MSxEaQkMSaOO8N70U
+XzgH1dielvpea20WO4MyWQuRIJ0K2nsGmEPnt6ZP7fK8HVHFNggP/mQ6LMu1reAF
+gvb8cEtjb9B5QaCUEoLjsbsuo+vLW7AWy4GfIRNESHw2Qt08AUaGrihpu6zi7N2b
+QkHHJtqa63GzYJ+kYzAVvrFJXdwL/TRXLBzv+6yyvYSIHi8uB6/o6CZN6hpjfpME
+ph+oYPqXeNOyMd1E9Kg8ymcPrNyQKfE3WnCRXQARAQABiQIlBBgBAgAPBQJFWc3H
+AhsMBQkB4TOAAAoJEEpghLnA1x9KXYMP/3D9JYti6C8DWuX2hWv+2SUbLcMa5u1e
+ETewIo5S3mqGWSaxX4YLPVRkZ1lOLmFysOLimf0thYm7IsatLcWmBdYUpK92ilvr
+Sk2sKlhrOoBXEX/79Kz+Aj5PjeyiQxgQ7Ba/afwhU6aTqs2Dp1T0YNu2eBvV+1QH
+lZnW2Wh96zzwc0dJUuY9eBk5Fgpu08Wce7o6jxFPtVyAaQa0zcNAmw2TSY7wbunJ
+WTl9OgATAyqVCuhWW7AnPcSqkH8lQigSc00wfqJKOD2Us0FqN6UKDCZTyQkdP6hx
+G+3aUkkvGSOxy7u9bVWmrikuJMoiIY/CH/m+GcJJATVibI7t5MhhtBGySKc3PAwc
+58sVe9AnbDvs84efrNP59j2KG2KKqcqjTGAmKyJnG3N50xJGakDIsqfneIRNWpEE
+pOOPaOqR4qnPAS9OSt9A3hqBpWPjQcScd6AuO+J2PE5y23pTnb9PtLBQb5e4VFiv
+N54u8j4bU2CO0SC2isZ3CR68dPHthWsxt4XbjhgktjbpQRQ8L2EDBQ8oE13GOrOw
+P8x4Q0eC5uzkXNyRqzKOsxlZEuc+75aDDd3M2GDw08FG7GI1p/L+NgenwT+9TmFX
+2hOKVrjgyx+fPut1t5DJJubDWXGOK33qvrL7HTCEv1zz7LNbbPwwNHK4lfMAWuJW
+D9wc3Y9Se/P/
+=5MAs
+-----END PGP PUBLIC KEY BLOCK-----

debian/watch

@@ -0,0 +1,2 @@
+version=3
+opts=pgpsigurlmangle=s/$/.sig/ http://www.tinc-vpn.org/packages/tinc-(1\.0\.\d+)\.tar\.gz

depcomp

@@ -3,7 +3,7 @@
 
 scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

doc/Makefile.am

@@ -3,23 +3,20 @@
 info_TEXINFOS = tinc.texi
 tinc_TEXINFOS = tincinclude.texi
 
-man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
+man_MANS = tincd.8 tinc.conf.5
 
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
 
-CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi
+CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
+
+texi2html: tinc.texi
+	$(AM_V_GEN)texi2html -split=chapter $<
 
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $? > $@
+	$(AM_V_GEN)w3mman2html $< > $@
-
-tinc.8.html: tinc.8
-	$(AM_V_GEN)w3mman2html $? > $@
-
-tinc-gui.8.html: tinc-gui.8
-	$(AM_V_GEN)w3mman2html $? > $@
 
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $? > $@
+	$(AM_V_GEN)w3mman2html $< > $@
 
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
@@ -31,12 +28,6 @@ substitute = sed \
 tincd.8: $(srcdir)/tincd.8.in
 	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
 
-tinc.8: $(srcdir)/tinc.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.8.in > $@
-
-tinc-gui.8: $(srcdir)/tinc-gui.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc-gui.8.in > $@
-
 tinc.conf.5: $(srcdir)/tinc.conf.5.in
 	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
 

doc/Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -94,12 +94,9 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
 	$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
 	$(top_srcdir)/m4/ax_check_compile_flag.m4 \
 	$(top_srcdir)/m4/ax_check_link_flag.m4 \
-	$(top_srcdir)/m4/ax_code_coverage.m4 \
+	$(top_srcdir)/m4/ax_require_defined.m4 $(top_srcdir)/m4/lzo.m4 \
-	$(top_srcdir)/m4/ax_require_defined.m4 \
+	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/zlib.m4 \
-	$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libgcrypt.m4 \
+	$(top_srcdir)/configure.ac
-	$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/miniupnpc.m4 \
-	$(top_srcdir)/m4/openssl.m4 $(top_srcdir)/m4/readline.m4 \
-	$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
@@ -212,15 +209,8 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
-CODE_COVERAGE_CFLAGS = @CODE_COVERAGE_CFLAGS@
-CODE_COVERAGE_CPPFLAGS = @CODE_COVERAGE_CPPFLAGS@
-CODE_COVERAGE_CXXFLAGS = @CODE_COVERAGE_CXXFLAGS@
-CODE_COVERAGE_ENABLED = @CODE_COVERAGE_ENABLED@
-CODE_COVERAGE_LDFLAGS = @CODE_COVERAGE_LDFLAGS@
-CODE_COVERAGE_LIBS = @CODE_COVERAGE_LIBS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
-CURSES_LIBS = @CURSES_LIBS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
@@ -229,21 +219,17 @@ ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
-GCOV = @GCOV@
-GENHTML = @GENHTML@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-LCOV = @LCOV@
 LDFLAGS = @LDFLAGS@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
-MINIUPNPC_LIBS = @MINIUPNPC_LIBS@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -254,8 +240,6 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
-READLINE_LIBS = @READLINE_LIBS@
-SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
 STRIP = @STRIP@
@@ -314,9 +298,9 @@ top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 info_TEXINFOS = tinc.texi
 tinc_TEXINFOS = tincinclude.texi
-man_MANS = tincd.8 tinc.8 tinc.conf.5 tinc-gui.8
+man_MANS = tincd.8 tinc.conf.5
-EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.8.in tinc.conf.5.in tinc-gui.8.in sample-config
+EXTRA_DIST = tincinclude.texi.in tincd.8.in tinc.conf.5.in sample-config
-CLEANFILES = *.html tincd.8 tinc.8 tinc.conf.5 tinc-gui.8 tincinclude.texi
+CLEANFILES = *.html tincd.8 tinc.conf.5 tincinclude.texi
 substitute = sed \
 	-e s,'@PACKAGE\@',"$(PACKAGE)",g \
 	-e s,'@VERSION\@',"$(VERSION)",g \
@@ -846,27 +830,18 @@ uninstall-man: uninstall-man5 uninstall-man8
 .PRECIOUS: Makefile
 
 
+texi2html: tinc.texi
+	$(AM_V_GEN)texi2html -split=chapter $<
+
 tincd.8.html: tincd.8
-	$(AM_V_GEN)w3mman2html $? > $@
+	$(AM_V_GEN)w3mman2html $< > $@
-
-tinc.8.html: tinc.8
-	$(AM_V_GEN)w3mman2html $? > $@
-
-tinc-gui.8.html: tinc-gui.8
-	$(AM_V_GEN)w3mman2html $? > $@
 
 tinc.conf.5.html: tinc.conf.5
-	$(AM_V_GEN)w3mman2html $? > $@
+	$(AM_V_GEN)w3mman2html $< > $@
 
 tincd.8: $(srcdir)/tincd.8.in
 	$(AM_V_GEN)$(substitute) $(srcdir)/tincd.8.in > $@
 
-tinc.8: $(srcdir)/tinc.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.8.in > $@
-
-tinc-gui.8: $(srcdir)/tinc-gui.8.in
-	$(AM_V_GEN)$(substitute) $(srcdir)/tinc-gui.8.in > $@
-
 tinc.conf.5: $(srcdir)/tinc.conf.5.in
 	$(AM_V_GEN)$(substitute) $(srcdir)/tinc.conf.5.in > $@
 

doc/sample-config/tinc.conf

@@ -16,7 +16,7 @@ Name = alpha
 ConnectTo = beta
 
 # The tap device tinc will use.
-# Default is /dev/tap0 for ethertap or FreeBSD,
+# /dev/tap0 for ethertap, FreeBSD or OpenBSD
-# /dev/tun0 for Solaris and OpenBSD,
+# /dev/tun0 for Solaris
-# and /dev/net/tun for Linux tun/tap device.
+# /dev/net/tun for Linux tun/tap
 Device = /dev/net/tun

doc/tinc-gui.8.in

@@ -1,57 +0,0 @@
-.Dd 2011-06-26
-.Dt TINC-GUI 8
-.\" Manual page created by:
-.\" Guus Sliepen <guus@tinc-vpn.org>
-.Sh NAME
-.Nm tinc-gui
-.Nd tinc GUI
-.Sh SYNOPSIS
-.Nm
-.Op Fl n
-.Op Fl -net Ns = Ns Ar NETNAME
-.Op Fl -pidfile Ns = Ns Ar FILENAME
-.Op Fl -help
-.Sh DESCRIPTION
-This is a Python/wxWidgets based graphical user interface for tinc, a secure virtual private network (VPN) project.
-.Nm
-communicates with
-.Xr tincd 8
-to alter and inspect the running VPN's state.
-It can show the current settings, the list of connections, nodes, subnets, and edges.
-For now, the debug level can be changed from the GUI, and by right-clicking on a node in the list of connections,
-a pop-up menu will appear that allows one to disconnect that node.
-.Sh OPTIONS
-.Bl -tag -width indent
-.It Fl n, -net Ns = Ns Ar NETNAME
-Communicate with tincd(8) connected with
-.Ar NETNAME .
-.It Fl -pidfile Ns = Ns Ar FILENAME
-Use the cookie from
-.Ar FILENAME
-to authenticate with a running tinc daemon.
-If unspecified, the default is
-.Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
-.It Fl -help
-Display short list of options.
-.El
-.Sh BUGS
-The GUI is not finished yet, the final version will have much more functionality.
-If you find any bugs, report them to tinc@tinc-vpn.org.
-.Sh SEE ALSO
-.Xr tincd 8 ,
-.Pa http://www.tinc-vpn.org/ .
-.Pp
-The full documentation for tinc is maintained as a Texinfo manual.
-If the info and tinc programs are properly installed at your site,
-the command
-.Ic info tinc
-should give you access to the complete manual.
-.Pp
-tinc comes with ABSOLUTELY NO WARRANTY.
-This is free software, and you are welcome to redistribute it under certain conditions;
-see the file COPYING for details.
-.Sh AUTHORS
-.An "Ivo Timmermans"
-.An "Guus Sliepen" Aq guus@tinc-vpn.org
-.Pp
-And thanks to many others for their contributions to tinc!

doc/tinc.8.in

@@ -1,345 +0,0 @@
-.Dd 2014-01-16
-.Dt TINCCTL 8
-.\" Manual page created by:
-.\" Scott Lamb
-.Sh NAME
-.Nm tinc
-.Nd tinc VPN control
-.Sh SYNOPSIS
-.Nm
-.Op Fl bcn
-.Op Fl -config Ns = Ns Ar DIR
-.Op Fl -net Ns = Ns Ar NETNAME
-.Op Fl -pidfile Ns = Ns Ar FILENAME
-.Op Fl -batch
-.Op Fl -force
-.Op Fl -help
-.Op Fl -version
-.Op Ar COMMAND
-.Sh DESCRIPTION
-This is the control program of tinc, a secure virtual private network (VPN)
-project.
-.Nm
-can start and stop
-.Xr tincd 8 ,
-and can to alter and inspect the state of a running VPN.
-It can also be used to change the configuration,
-or to import or export host configuration files from other nodes.
-
-If
-.Nm
-is started with a
-.Ar COMMAND ,
-this command is immediately executed, after which
-.Nm
-exits.
-If no
-.Ar COMMAND
-is given,
-.Nm
-will act as a shell;
-it will display a prompt, and commands can be entered on the prompt.
-If
-.Nm
-is compiled with libreadline, history and command completion are available on the prompt.
-One can also pipe a script containing commands through
-.Nm .
-In that case, lines starting with a # symbol will be ignored.
-.Sh OPTIONS
-.Bl -tag -width indent
-.It Fl n, -net Ns = Ns Ar NETNAME
-Communicate with tincd(8) connected with
-.Ar NETNAME .
-.It Fl -pidfile Ns = Ns Ar FILENAME
-Use the cookie from
-.Ar FILENAME
-to authenticate with a running tinc daemon.
-If unspecified, the default is
-.Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
-.It Fl b, -batch
-Don't ask for anything (non-interactive mode).
-.It Fl -force
-Force some commands to work despite warnings.
-.It Fl -help
-Display short list of options.
-.It Fl -version
-Output version information and exit.
-.El
-.Sh ENVIRONMENT VARIABLES
-.Bl -tag -width indent
-.It Ev NETNAME
-If no netname is specified on the command line with the
-.Fl n
-option, the value of this environment variable is used.
-.El
-.Sh COMMANDS
-.Bl -tag -width indent
-.It init Op Ar name
-Create initial configuration files and RSA and Ed25519 keypairs with default length.
-If no
-.Ar name
-for this node is given, it will be asked for.
-.It get Ar variable
-Print the current value of configuration variable
-.Ar variable .
-If more than one variable with the same name exists,
-the value of each of them will be printed on a separate line.
-.It set Ar variable Ar value
-Set configuration variable
-.Ar variable
-to the given
-.Ar value .
-All previously existing configuration variables with the same name are removed.
-To set a variable for a specific host, use the notation
-.Ar host Ns Li . Ns Ar variable .
-.It add Ar variable Ar value
-As above, but without removing any previously existing configuration variables.
-If the variable already exists with the given value, nothing happens.
-.It del Ar variable Op Ar value
-Remove configuration variables with the same name and
-.Ar value .
-If no
-.Ar value
-is given, all configuration variables with the same name will be removed.
-.It edit Ar filename
-Start an editor for the given configuration file.
-You do not need to specify the full path to the file.
-.It export
-Export the host configuration file of the local node to standard output.
-.It export-all
-Export all host configuration files to standard output.
-.It import
-Import host configuration data generated by the
-.Nm
-export command from standard input.
-Already existing host configuration files are not overwritten unless the option
-.Fl -force
-is used.
-.It exchange
-The same as export followed by import.
-.It exchange-all
-The same as export-all followed by import.
-.It invite Ar name
-Prepares an invitation for a new node with the given
-.Ar name ,
-and prints a short invitation URL that can be used with the join command.
-.It join Op Ar URL
-Join an existing VPN using an invitation URL created using the invite command.
-If no
-.Ar URL
-is given, it will be read from standard input.
-.It start Op tincd options
-Start
-.Xr tincd 8 ,
-optionally with the given extra options.
-.It stop
-Stop
-.Xr tincd 8 .
-.It restart Op tincd options
-Restart
-.Xr tincd 8 ,
-optionally with the given extra options.
-.It reload
-Partially rereads configuration files. Connections to hosts whose host
-config files are removed are closed. New outgoing connections specified
-in
-.Xr tinc.conf 5
-will be made.
-.It pid
-Shows the PID of the currently running
-.Xr tincd 8 .
-.It generate-keys Op bits
-Generate both RSA and Ed25519 keypairs (see below) and exit.
-.It generate-ed25519-keys
-Generate public/private Ed25519 keypair and exit.
-.It generate-rsa-keys Op bits
-Generate public/private RSA keypair and exit.
-If
-.Ar bits
-is omitted, the default length will be 2048 bits.
-When saving keys to existing files, tinc will not delete the old keys;
-you have to remove them manually.
-.It dump [reachable] nodes
-Dump a list of all known nodes in the VPN.
-If the keyword reachable is used, only lists reachable nodes.
-.It dump edges
-Dump a list of all known connections in the VPN.
-.It dump subnets
-Dump a list of all known subnets in the VPN.
-.It dump connections
-Dump a list of all meta connections with ourself.
-.It dump graph | digraph
-Dump a graph of the VPN in
-.Xr dotty 1
-format.
-Nodes are colored according to their reachability:
-red nodes are unreachable, orange nodes are indirectly reachable, green nodes are directly reachable.
-Black nodes are either directly or indirectly reachable, but direct reachability has not been tried yet.
-.It dump invitations
-Dump a list of outstanding invitations.
-The filename of the invitation, as well as the name of the node that is being invited is shown for each invitation.
-.It info Ar node | subnet | address
-Show information about a particular node, subnet or address.
-If an address is given, any matching subnet will be shown.
-.It purge
-Purges all information remembered about unreachable nodes.
-.It debug Ar N
-Sets debug level to
-.Ar N .
-.It log Op Ar N
-Capture log messages from a running tinc daemon.
-An optional debug level can be given that will be applied only for log messages sent to
-.Nm tinc .
-.It retry
-Forces
-.Xr tincd 8
-to try to connect to all uplinks immediately.
-Usually
-.Xr tincd 8
-attempts to do this itself,
-but increases the time it waits between the attempts each time it failed,
-and if
-.Xr tincd 8
-didn't succeed to connect to an uplink the first time after it started,
-it defaults to the maximum time of 15 minutes.
-.It disconnect Ar NODE
-Closes the meta connection with the given
-.Ar NODE .
-.It top
-If
-.Nm
-is compiled with libcurses support, this will display live traffic statistics
-for all the known nodes, similar to the UNIX
-.Xr top 1
-command.
-See below for more information.
-.It pcap
-Dump VPN traffic going through the local tinc node in
-.Xr pcap-savefile 5
-format to standard output,
-from where it can be redirected to a file or piped through a program that can parse it directly,
-such as
-.Xr tcpdump 8 .
-.It network Op Ar netname
-If
-.Ar netname
-is given, switch to that network.
-Otherwise, display a list of all networks for which configuration files exist.
-.It fsck
-This will check the configuration files for possible problems,
-such as unsafe file permissions, missing executable bit on script,
-unknown and obsolete configuration variables, wrong public and/or private keys, and so on.
-.Pp
-When problems are found, this will be printed on a line with WARNING or ERROR in front of it.
-Most problems must be corrected by the user itself, however in some cases (like file permissions and missing public keys),
-tinc will ask if it should fix the problem.
-.It sign Op Ar filename
-Sign a file with the local node's private key.
-If no
-.Ar filename
-is given, the file is read from standard input.
-The signed file is written to standard output.
-.It verify Ar name Op Ar filename
-Check the signature of a file against a node's public key.
-The
-.Ar name
-of the node must be given,
-or can be
-.Li .
-to check against the local node's public key, or
-.Li *
-to allow a signature from any node whose public key is known.
-If no
-.Ar filename
-is given, the file is read from standard input.
-If the verification is successful,
-a copy of the input with the signature removed is written to standard output,
-and the exit code will be zero.
-If the verification failed,
-nothing will be written to standard output, and the exit code will be non-zero.
-.El
-.Sh EXAMPLES
-Examples of some commands:
-.Bd -literal -offset indent
-tinc -n vpn dump graph | circo -Txlib
-tinc -n vpn pcap | tcpdump -r -
-tinc -n vpn top
-.Pp
-.Ed
-Examples of changing the configuration using
-.Nm :
-.Bd -literal -offset indent
-tinc -n vpn init foo
-tinc -n vpn add Subnet 192.168.1.0/24
-tinc -n vpn add bar.Address bar.example.com
-tinc -n vpn add ConnectTo bar
-tinc -n vpn export | gpg --clearsign | mail -s "My config" vpnmaster@example.com
-.Ed
-.Sh TOP
-The top command connects to a running tinc daemon and repeatedly queries its per-node traffic counters.
-It displays a list of all the known nodes in the left-most column,
-and the amount of bytes and packets read from and sent to each node in the other columns.
-By default, the information is updated every second.
-The behaviour of the top command can be changed using the following keys:
-.Bl -tag
-.It Ic s
-Change the interval between updates.
-After pressing the
-.Ic s
-key, enter the desired interval in seconds, followed by enter.
-Fractional seconds are honored.
-Intervals lower than 0.1 seconds are not allowed.
-.It Ic c
-Toggle between displaying current traffic rates (in packets and bytes per second)
-and cumulative traffic (total packets and bytes since the tinc daemon started).
-.It Ic n
-Sort the list of nodes by name.
-.It Ic i
-Sort the list of nodes by incoming amount of bytes.
-.It Ic I
-Sort the list of nodes by incoming amount of packets.
-.It Ic o
-Sort the list of nodes by outgoing amount of bytes.
-.It Ic O
-Sort the list of nodes by outgoing amount of packets.
-.It Ic t
-Sort the list of nodes by sum of incoming and outgoing amount of bytes.
-.It Ic T
-Sort the list of nodes by sum of incoming and outgoing amount of packets.
-.It Ic b
-Show amount of traffic in bytes.
-.It Ic k
-Show amount of traffic in kilobytes.
-.It Ic M
-Show amount of traffic in megabytes.
-.It Ic G
-Show amount of traffic in gigabytes.
-.It Ic q
-Quit.
-.El
-.Sh BUGS
-If you find any bugs, report them to tinc@tinc-vpn.org.
-.Sh SEE ALSO
-.Xr tincd 8 ,
-.Xr tinc.conf 5 ,
-.Xr dotty 1 ,
-.Xr pcap-savefile 5 ,
-.Xr tcpdump 8 ,
-.Xr top 1 ,
-.Pa http://www.tinc-vpn.org/ ,
-.Pa http://www.cabal.org/ .
-.Pp
-The full documentation for tinc is maintained as a Texinfo manual.
-If the info and tinc programs are properly installed at your site,
-the command
-.Ic info tinc
-should give you access to the complete manual.
-.Pp
-tinc comes with ABSOLUTELY NO WARRANTY.
-This is free software, and you are welcome to redistribute it under certain conditions;
-see the file COPYING for details.
-.Sh AUTHORS
-.An "Ivo Timmermans"
-.An "Guus Sliepen" Aq guus@tinc-vpn.org
-.Pp
-And thanks to many others for their contributions to tinc!

doc/tinc.conf.5.in

@@ -1,4 +1,4 @@
-.Dd 2017-09-02
+.Dd 2016-10-29
 .Dt TINC.CONF 5
 .\" Manual page created by:
 .\" Ivo Timmermans
@@ -11,12 +11,20 @@ The files in the
 .Pa @sysconfdir@/tinc/
 directory contain runtime and security information for the tinc daemon.
 .Sh NETWORKS
-To distinguish multiple instances of tinc running on one computer,
+It is perfectly ok for you to run more than one tinc daemon.
-you can use the
+However, in its default form,
-.Fl n
+you will soon notice that you can't use two different configuration files without the
-option to assign a network name to each tinc daemon.
+.Fl c
+option.
 .Pp
-The effect of this option is that the daemon will set its configuration root to
+We have thought of another way of dealing with this: network names.
+This means that you call
+.Nm
+with the
+.Fl n
+option, which will assign a name to this daemon.
+.Pp
+The effect of this is that the daemon will set its configuration root to
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa / ,
 where 
 .Ar NETNAME
@@ -24,14 +32,13 @@ is your argument to the
 .Fl n
 option.
 You'll notice that messages appear in syslog as coming from
-.Nm tincd. Ns Ar NETNAME ,
+.Nm tincd. Ns Ar NETNAME .
-and on Linux, unless specified otherwise, the name of the virtual network interface will be the same as the network name.
 .Pp
-It is recommended that you use network names even if you run only one instance of tinc.
+However, it is not strictly necessary that you call tinc with the
-However, you can choose not to use the
 .Fl n
 option.
-In this case, the network name would just be empty, and
+In this case, the network name would just be empty,
+and it will be used as such.
 .Nm tinc
 now looks for files in
 .Pa @sysconfdir@/tinc/ ,
@@ -41,6 +48,11 @@ the configuration file should be
 .Pa @sysconfdir@/tinc/tinc.conf ,
 and the host configuration files are now expected to be in
 .Pa @sysconfdir@/tinc/hosts/ .
+.Pp
+But it is highly recommended that you use this feature of
+.Nm tinc ,
+because it will be so much clearer whom your daemon talks to.
+Hence, we will assume that you use it.
 .Sh NAMES
 Each tinc daemon must have a name that is unique in the network which it will be part of.
 The name will be used by other tinc daemons for identification.
@@ -51,34 +63,24 @@ file.
 To make things easy,
 choose something that will give unique and easy to remember names to your tinc daemon(s).
 You could try things like hostnames, owner surnames or location names.
-However, you are only allowed to use alphanumerical characters (a-z, A-Z, and 0-9) and underscores (_) in the name.
-.Sh INITIAL CONFIGURATION
-If you have not configured tinc yet, you can easily create a basic configuration using the following command:
-.Bd -literal -offset indent
-.Nm tinc Fl n Ar NETNAME Li init Ar NAME
-.Ed
-.Pp
-You can further change the configuration as needed either by manually editing the configuration files,
-or by using
-.Xr tinc 8 .
 .Sh PUBLIC/PRIVATE KEYS
-The
+You should use 
-.Nm tinc Li init
+.Ic tincd -K
-command will have generated both RSA and Ed25519 public/private keypairs.
+to generate public/private keypairs.
-The private keys should be stored in files named
+It will generate two keys.
-.Pa rsa_key.priv
+The private key should be stored in a separate file
-and
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv
-.Pa ed25519_key.priv
+\-\- where 
-in the directory
+.Ar NETNAME
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /
+stands for the network (see 
-The public keys should be stored in the host configuration file
+.Sx NETWORKS )
-.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME .
+above.
-The RSA keys are used for backwards compatibility with tinc version 1.0.
+The public key should be stored in the host configuration file
-If you are upgrading from version 1.0 to 1.1, you can keep the old configuration files,
+.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME
-but you will need to create Ed25519 keys using the following command:
+\-\- where
-.Bd -literal -offset indent
+.Va NAME
-.Nm tinc Fl n Ar NETNAME Li generate-ed25519-keys
+stands for the name of the local tinc daemon (see
-.Ed
+.Sx NAMES ) .
 .Sh SERVER CONFIGURATION
 The server configuration of the daemon is done in the file
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc.conf .
@@ -101,10 +103,6 @@ Although all configuration options for the local host listed in this document ca
 it is recommended to put host specific configuration options in the host configuration file,
 as this makes it easy to exchange with other nodes.
 .Pp
-You can edit the config file manually, but it is recommended that you use
-.Xr tinc 8
-to change configuration variables for you.
-.Pp
 Here are all valid variables, listed in alphabetical order.
 The default value is given between parentheses.
 .Bl -tag -width indent
@@ -114,24 +112,26 @@ If
 .Qq any
 is selected, then depending on the operating system both IPv4 and IPv6 or just
 IPv6 listening sockets will be created.
-.It Va AutoConnect Li = yes | no Po yes
+.It Va BindToAddress Li = Ar address Oo Ar port Oc Bq experimental
-If set to yes,
+If your computer has more than one IPv4 or IPv6 address,
 .Nm tinc
-will automatically set up meta connections to other nodes,
+will by default listen on all of them for incoming connections.
-without requiring
+Multiple
-.Va ConnectTo
-variables.
-.Pp
-Note: it is not possible to connect to nodes using zero (system-assigned) ports in this way.
-.It Va BindToAddress Li = Ar address Op Ar port
-This is the same as
-.Va ListenAddress ,
-however the address given with the
 .Va BindToAddress
-option will also be used for outgoing connections. This is useful if your
+variables may be specified,
-computer has more than one IPv4 or IPv6 address, and you want 
+in which case listening sockets for each specified address are made.
-.Nm tinc
+.Pp
-to only use a specific one for outgoing packets.
+If no
+.Ar port
+is specified, the socket will be bound to the port specified by the
+.Va Port
+option, or to port 655 if neither is given.
+To only bind to a specific port but not to a specific address, use
+.Li *
+for the
+.Ar address .
+.Pp
+This option may not work on all platforms.
 .It Va BindToInterface Li = Ar interface Bq experimental
 If your computer has more than one network interface,
 .Nm tinc
@@ -157,13 +157,6 @@ Broadcast packets are sent directly to all nodes that can be reached directly.
 Broadcast packets received from other nodes are never forwarded.
 If the IndirectData option is also set, broadcast packets will only be sent to nodes which we have a meta connection to.
 .El
-.It Va BroadcastSubnet Li = Ar address Ns Op Li / Ns Ar prefixlength
-Declares a broadcast subnet. Any packet with a destination address falling into such a subnet will be routed as a broadcast (provided all nodes have it declared).
-This is most useful to declare subnet broadcast addresses (e.g. 10.42.255.255), otherwise
-.Nm tinc
-won't know what to do with them.
-.Pp
-Note that global broadcast addresses (MAC ff:ff:ff:ff:ff:ff, IPv4 255.255.255.255), as well as multicast space (IPv4 224.0.0.0/4, IPv6 ff00::/8) are always considered broadcast addresses and don't need to be declared.
 .It Va ConnectTo Li = Ar name
 Specifies which other tinc daemon to connect to on startup.
 Multiple
@@ -176,9 +169,7 @@ The names should be known to this tinc daemon
 line).
 .Pp
 If you don't specify a host with
-.Va ConnectTo
+.Va ConnectTo ,
-and have disabled
-.Va AutoConnect ,
 .Nm tinc
 won't try to connect to other daemons at all,
 and will instead just listen for incoming connections.
@@ -202,13 +193,6 @@ instead of
 .Va Device .
 The info pages of the tinc package contain more information
 about configuring the virtual network device.
-.It Va DeviceStandby Li = yes | no Po no Pc
-When disabled,
-.Nm tinc
-calls tinc-up on startup, and tinc-down on shutdown. When enabled,
-.Nm tinc
-will only call tinc-up when at least one node is reachable, and will call tinc-down as soon as no nodes are reachable.
-On Windows, this also determines when the virtual network interface "cable" is "plugged".
 .It Va DeviceType Li = Ar type Pq platform dependent
 The type of the virtual network device.
 Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used.
@@ -234,10 +218,6 @@ Do NOT connect multiple
 .Nm tinc 
 daemons to the same multicast address, this will very likely cause routing loops.
 Also note that this can cause decrypted VPN packets to be sent out on a real network if misconfigured.
-.It fd
-Use a file descriptor.
-All packets are read from this interface.
-Packets received for the local node are written to it.
 .It uml Pq not compiled in by default
 Create a UNIX socket with the filename specified by
 .Va Device ,
@@ -284,17 +264,6 @@ When this option is enabled, packets that cannot be sent directly to the destina
 but which would have to be forwarded by an intermediate node, are dropped instead.
 When combined with the IndirectData option,
 packets for nodes for which we do not have a meta connection with are also dropped.
-.It Va Ed25519PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /ed25519_key.priv Pc
-The file in which the private Ed25519 key of this tinc daemon resides.
-This is only used if
-.Va ExperimentalProtocol
-is enabled.
-.It Va ExperimentalProtocol Li = yes | no Pq yes
-When this option is enabled, the SPTPS protocol will be used when connecting to nodes that also support it.
-Ephemeral ECDH will be used for key exchanges,
-and Ed25519 will be used instead of RSA for authentication.
-When enabled, an Ed25519 key must have been generated before with
-.Nm tinc generate-ed25519-keys .
 .It Va Forwarding Li = off | internal | kernel Po internal Pc Bq experimental
 This option selects the way indirect packets are forwarded.
 .Bl -tag -width indent
@@ -306,16 +275,22 @@ Incoming packets that are meant for another node are forwarded by tinc internall
 .Pp
 This is the default mode, and unless you really know you need another forwarding mode, don't change it.
 .It kernel
-Incoming packets using the legacy protocol are always sent to the TUN/TAP device,
+Incoming packets are always sent to the TUN/TAP device, even if the packets are not for the local node.
-even if the packets are not for the local node.
 This is less efficient, but allows the kernel to apply its routing and firewall rules on them,
 and can also help debugging.
-Incoming packets using the SPTPS protocol are dropped, since they are end-to-end encrypted.
 .El
-.It Va FWMark Li = Ar value Po 0 Pc Bq experimental
+.It Va GraphDumpFile Li = Ar filename Bq experimental
-When set to a non-zero value, all TCP and UDP sockets created by tinc will use the given value as the firewall mark.
+If this option is present,
-This can be used for mark-based routing or for packet filtering.
+.Nm tinc
-This option is currently only supported on Linux.
+will dump the current network graph to the file
+.Ar filename
+every minute, unless there were no changes to the graph.
+The file is in a format that can be read by graphviz tools.
+If
+.Ar filename
+starts with a pipe symbol |,
+then the rest of the filename is interpreted as a shell command
+that is executed, the graph is then sent to stdin.
 .It Va Hostnames Li = yes | no Pq no
 This option selects whether IP addresses (both real and on the VPN) should
 be resolved. Since DNS lookups are blocking, it might affect tinc's
@@ -333,40 +308,11 @@ Under Windows, this variable is used to select which network interface will be u
 If you specified a
 .Va Device ,
 this variable is almost always already correctly set.
-.It Va InvitationExpire Li = Ar seconds Pq 604800
-This option controls the period invitations are valid.
 .It Va KeyExpire Li = Ar seconds Pq 3600
 This option controls the period the encryption keys used to encrypt the data are valid.
 It is common practice to change keys at regular intervals to make it even harder for crackers,
 even though it is thought to be nearly impossible to crack a single key.
-.It Va ListenAddress Li = Ar address Op Ar port
+.It Va LocalDiscovery Li = yes | no Po no Pc Bq experimental
-If your computer has more than one IPv4 or IPv6 address,
-.Nm tinc
-will by default listen on all of them for incoming connections.
-This option can be used to restrict which addresses tinc listens on.
-Multiple
-.Va ListenAddress
-variables may be specified,
-in which case listening sockets for each specified address are made.
-.Pp
-If no
-.Ar port
-is specified, the socket will listen on the port specified by the
-.Va Port
-option, or to port 655 if neither is given.
-To only listen on a specific port but not on a specific address, use
-.Li *
-for the
-.Ar address .
-.Pp
-If
-.Ar port
-is set to zero, it will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. In this case it is recommended to set
-.Va AddressFamily
-as well, otherwise
-.Nm tinc
-will assign different ports to different address families but other nodes can only know of one.
-.It Va LocalDiscovery Li = yes | no Pq yes
 When enabled,
 .Nm tinc
 will try to detect peers that are on the same local network.
@@ -374,20 +320,14 @@ This will allow direct communication using LAN addresses, even if both peers are
 and they only ConnectTo a third node outside the NAT,
 which normally would prevent the peers from learning each other's LAN address.
 .Pp
-Currently, local discovery is implemented by sending some packets to the local address of the node during UDP discovery. This will not work with old nodes that don't transmit their local address.
+Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery.
-.It Va LogLevel Li = level Pq 0
+This feature may not work in all possible situations.
-This option controls the verbosity of the logging. The higher the debug level, the more messages it will log.
 .It Va MACExpire Li = Ar seconds Pq 600
 This option controls the amount of time MAC addresses are kept before they are removed.
 This only has effect when
 .Va Mode
 is set to
 .Qq switch .
-.It Va MaxConnectionBurst Li = Ar count Pq 100
-This option controls how many connections tinc accepts in quick succession.
-If there are more connections than the given number in a short time interval,
-tinc will reduce the number of accepted connections to only one per second,
-until the burst has passed.
 .It Va MaxTimeout Li = Ar seconds Pq 900
 This is the maximum delay before trying to reconnect to other tinc daemons.
 .It Va Mode Li = router | switch | hub Pq router
@@ -397,7 +337,7 @@ This option selects the way packets are routed to other daemons.
 In this mode
 .Va Subnet
 variables in the host configuration files will be used to form a routing table.
-Only packets of routable protocols (IPv4 and IPv6) are supported in this mode.
+Only unicast packets of routable protocols (IPv4 and IPv6) are supported in this mode.
 .Pp
 This is the default mode, and unless you really know you need another mode, don't change it.
 .It switch
@@ -415,8 +355,7 @@ while no routing table is managed.
 .It Va Name Li = Ar name Bq required
 This is the name which identifies this tinc daemon.
 It must be unique for the virtual private network this daemon will connect to.
-.Va Name
+The Name may only consist of alphanumeric and underscore characters.
-may only consist of alphanumeric and underscore characters (a-z, A-Z, 0-9 and _), and is case sensitive.
 If 
 .Va Name
 starts with a
@@ -446,9 +385,7 @@ It will allow this tinc daemon to authenticate itself to other daemons.
 .It Va PrivateKeyFile Li = Ar filename Po Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv Pc
 The file in which the private RSA key of this tinc daemon resides.
 .It Va ProcessPriority Li = low | normal | high
-When this option is used the priority of the 
+When this option is used the priority of the tincd process will be adjusted.
-.Nm tincd
-process will be adjusted.
 Increasing the priority may help to reduce latency and packet loss on the VPN.
 .It Va Proxy Li = socks4 | socks5 | http | exec Ar ... Bq experimental
 Use a proxy when making outgoing connections.
@@ -482,13 +419,13 @@ and
 .Ev REMOTEPORT
 are available.
 .El
-.It Va ReplayWindow Li = Ar bytes Pq 32
+.It Va ReplayWindow Li = Ar bytes Pq 16
 This is the size of the replay tracking window for each remote node, in bytes.
 The window is a bitfield which tracks 1 packet per bit, so for example
-the default setting of 32 will track up to 256 packets in the window. In high
+the default setting of 16 will track up to 128 packets in the window.  In high
 bandwidth scenarios, setting this to a higher value can reduce packet loss from
 the interaction of replay tracking with underlying real packet loss and/or
-reordering. Setting this to zero will disable replay tracking completely and
+reordering.  Setting this to zero will disable replay tracking completely and
 pass all traffic, but leaves tinc vulnerable to replay-based attacks on your
 traffic.
 .It Va StrictSubnets Li = yes | no Po no Pc Bq experimental
@@ -503,42 +440,12 @@ and will only allow connections with nodes for which host config files are prese
 .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 directory.
 Setting this options also implicitly sets StrictSubnets.
-.It Va UDPDiscovery Li = yes | no Po yes Pc
+.It Va UDPRcvBuf Li = Ar bytes Pq OS default
-When this option is enabled tinc will try to establish UDP connectivity to nodes,
-using TCP while it determines if a node is reachable over UDP. If it is disabled,
-tinc always assumes a node is reachable over UDP.
-Note that tinc will never use UDP with nodes that have
-.Va TCPOnly
-enabled.
-.It Va UDPDiscoveryKeepaliveInterval Li = Ar seconds Pq 9
-The minimum amount of time between sending UDP ping datagrams to check UDP connectivity once it has been established.
-Note that these pings are large, since they are used to verify link MTU as well.
-.It Va UDPDiscoveryInterval Li = Ar seconds Pq 2
-The minimum amount of time between sending UDP ping datagrams to try to establish UDP connectivity.
-.It Va UDPDiscoveryTimeout Li = Ar seconds Pq 30
-If tinc doesn't receive any UDP ping replies over the specified interval,
-it will assume UDP communication is broken and will fall back to TCP.
-.It Va UDPInfoInterval Li = Ar seconds Pq 5
-The minimum amount of time between sending periodic updates about UDP addresses, which are mostly useful for UDP hole punching.
-.It Va UDPRcvBuf Li = Ar bytes Pq 1048576
 Sets the socket receive buffer size for the UDP socket, in bytes.
-If set to zero, the default buffer size will be used by the operating system.
+If unset, the default buffer size will be used by the operating system.
-Note: this setting can have a significant impact on performance, especially raw throughput.
+.It Va UDPSndBuf Li = Ar bytes Pq OS default
-.It Va UDPSndBuf Li = Ar bytes Pq 1048576
 Sets the socket send buffer size for the UDP socket, in bytes.
-If set to zero, the default buffer size will be used by the operating system.
+If unset, the default buffer size will be used by the operating system.
-Note: this setting can have a significant impact on performance, especially raw throughput.
-.It Va UPnP Li = yes | udponly | no Po no Pc
-If this option is enabled then tinc will search for UPnP-IGD devices on the local network.
-It will then create and maintain port mappings for tinc's listening TCP and UDP ports.
-If set to "udponly", tinc will only create a mapping for its UDP (data) port, not for its TCP (metaconnection) port.
-Note that tinc must have been built with miniupnpc support for this feature to be available.
-Furthermore, be advised that enabling this can have security implications, because the miniupnpc library that
-tinc uses might not be well-hardened with regard to malicious UPnP replies.
-.It Va UPnPDiscoverWait Li = Ar seconds Pq 5
-The amount of time to wait for replies when probing the local network for UPnP devices.
-.It Va UPnPRefreshPeriod Li = Ar seconds Pq 60
-How often tinc will re-add the port mapping, in case it gets reset on the UPnP device. This also controls the duration of the port mapping itself, which will be set to twice that duration.
 .El
 .Sh HOST CONFIGURATION FILES
 The host configuration files contain all information needed
@@ -561,15 +468,13 @@ Multiple
 .Va Address
 variables can be specified, in which case each address will be tried until a working
 connection has been established.
-.It Va Cipher Li = Ar cipher Pq blowfish
+.It Va Cipher Li = Ar cipher Pq aes-256-cbc
 The symmetric cipher algorithm used to encrypt UDP packets.
 Any cipher supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet encryption.
 It is best to use only those ciphers which support CBC mode.
-This option has no effect for connections between nodes using
-.Va ExperimentalProtocol .
 .It Va ClampMSS Li = yes | no Pq yes
 This option specifies whether tinc should clamp the maximum segment size (MSS)
 of TCP packets to the path MTU. This helps in situations where ICMP
@@ -578,14 +483,12 @@ Fragmentation Needed or Packet too Big messages are dropped by firewalls.
 This option sets the level of compression used for UDP packets.
 Possible values are 0 (off), 1 (fast zlib) and any integer up to 9 (best zlib),
 10 (fast lzo) and 11 (best lzo).
-.It Va Digest Li = Ar digest Pq sha1
+.It Va Digest Li = Ar digest Pq sha256
 The digest algorithm used to authenticate UDP packets.
 Any digest supported by LibreSSL or OpenSSL is recognised.
 Furthermore, specifying
 .Qq none
 will turn off packet authentication.
-This option has no effect for connections between nodes using
-.Va ExperimentalProtocol .
 .It Va IndirectData Li = yes | no Pq no
 When set to yes, only nodes which already have a meta connection to you
 will try to establish direct communication with you.
@@ -595,28 +498,16 @@ The length of the message authentication code used to authenticate UDP packets.
 Can be anything from
 .Qq 0
 up to the length of the digest produced by the digest algorithm.
-This option has no effect for connections between nodes using
-.Va ExperimentalProtocol .
 .It Va PMTU Li = Ar mtu Po 1514 Pc
 This option controls the initial path MTU to this node.
 .It Va PMTUDiscovery Li = yes | no Po yes Pc
 When this option is enabled, tinc will try to discover the path MTU to this node.
 After the path MTU has been discovered, it will be enforced on the VPN.
-.It Va MTUInfoInterval Li = Ar seconds Pq 5
-The minimum amount of time between sending periodic updates about relay path MTU. Useful for quickly determining MTU to indirect nodes.
 .It Va Port Li = Ar port Pq 655
 The port number on which this tinc daemon is listening for incoming connections,
 which is used if no port number is specified in an
 .Va Address
 statement.
-.Pp
-If this is set to zero, the port will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. When setting
-.Va Port
-to zero it is recommended to set
-.Va AddressFamily
-as well, otherwise
-.Nm tinc
-will assign different ports to different address families but other nodes can only know of one.
 .It Va PublicKey Li = Ar key Bq obsolete
 The public RSA key of this tinc daemon.
 It will be used to cryptographically verify it's identity and to set up a secure connection.
@@ -651,7 +542,7 @@ IPv6 subnets are notated like fec0:0:0:1::/64.
 MAC addresses are notated like 0:1a:2b:3c:4d:5e.
 .Pp
 A Subnet can be given a weight to indicate its priority over identical Subnets
-owned by different nodes. The default weight is 10. Lower values indicate
+owned by different nodes.  The default weight is 10. Lower values indicate
 higher priority. Packets will be sent to the node with the highest priority,
 unless that node is not reachable, in which case the node with the next highest
 priority will be tried, and so on.
@@ -665,12 +556,6 @@ Setting this options also implicitly sets IndirectData.
 .Pp
 Since version 1.0.10, tinc will automatically detect whether communication via
 UDP is possible or not.
-.It Va Weight Li = Ar weight
-If this variable is set, it overrides the weight given to connections made with
-another host. A higher
-.Ar weight
-means a lower priority is given to this connection when broadcasting or
-forwarding packets.
 .El
 .Sh SCRIPTS
 Apart from reading the server and host configuration files,
@@ -684,23 +569,17 @@ This guarantees that scripts will execute in the exact same order as the events
 If you need to run commands asynchronously, you have to ensure yourself that they are being run in the background.
 .Pp
 Under Windows (not Cygwin), the scripts must have the extension
-.Pa .bat
+.Pa .bat .
-or
-.Pa .cmd .
 .Bl -tag -width indent
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
 This is the most important script.
-If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device (or when the first node becomes reachable if
+If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device.
-.Va DeviceStandby
-is used).
 It should be used to set up the corresponding network interface,
 but can also be used to start other things.
 .Pp
 Under Windows you can use the Network Connections control panel instead of creating this script.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-down
-This script is started right before the tinc daemon quits (or when the last node becomes unreachable if
+This script is started right before the tinc daemon quits.
-.Va DeviceStandby
-is used).
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Ar HOST Ns Pa -up
 This script is started when the tinc daemon with name
 .Ar HOST
@@ -718,10 +597,6 @@ This script is started when a Subnet becomes reachable.
 The Subnet and the node it belongs to are passed in environment variables.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /subnet-down
 This script is started when a Subnet becomes unreachable.
-.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-created
-This script is started when a new invitation has been created.
-.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-accepted
-This script is started when an invitation has been used.
 .El
 .Pp
 The scripts are started without command line arguments, but can make use of certain environment variables.
@@ -730,8 +605,6 @@ Under UNIX like operating systems the names of environment variables must be pre
 in scripts.
 Under Windows, in
 .Pa .bat
-or
-.Pa .cmd
 files, they have to be put between
 .Li %
 signs.
@@ -757,14 +630,6 @@ When a host becomes (un)reachable, this is set to the port number it uses for co
 When a subnet becomes (un)reachable, this is set to the subnet.
 .It Ev WEIGHT
 When a subnet becomes (un)reachable, this is set to the subnet weight.
-.It Ev INVITATION_FILE
-When the
-.Pa invitation-created
-script is called, this is set to the file where the invitation details will be stored.
-.It Ev INVITATION_URL
-When the
-.Pa invitation-created
-script is called, this is set to the invitation URL that has been created.
 .El
 .Pp
 Do not forget that under UNIX operating systems, you have to make the scripts executable, using the command
@@ -778,7 +643,7 @@ The top directory for configuration files.
 The default name of the server configuration file for net
 .Ar NETNAME .
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /conf.d/
-Optional directory from which any .conf file will be loaded
+Optional directory from which any *.conf file will be loaded
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/
 Host configuration files are kept in this directory.
 .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up
@@ -789,14 +654,9 @@ It can be used to set up the corresponding network interface.
 If an executable file with this name exists,
 it will be executed right before the tinc daemon is going to close
 its connection to the virtual network device.
-.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitations/
-This directory contains outstanding invitations.
-.It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /invitation-data
-After a successful join, this file contains a copy of the invitation data received.
 .El
 .Sh SEE ALSO
 .Xr tincd 8 ,
-.Xr tinc 8 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.tldp.org/LDP/nag2/ .
 .Pp

doc/tincd.8.in

@@ -1,4 +1,4 @@
-.Dd 2013-01-14
+.Dd 2014-05-11
 .Dt TINCD 8
 .\" Manual page created by:
 .\" Ivo Timmermans
@@ -8,15 +8,17 @@
 .Nd tinc VPN daemon
 .Sh SYNOPSIS
 .Nm
-.Op Fl cdDKnsoLRU
+.Op Fl cdDkKnoLRU
 .Op Fl -config Ns = Ns Ar DIR
 .Op Fl -no-detach
 .Op Fl -debug Ns Op = Ns Ar LEVEL
+.Op Fl -kill Ns Op = Ns Ar SIGNAL
 .Op Fl -net Ns = Ns Ar NETNAME
+.Op Fl -generate-keys Ns Op = Ns Ar BITS
 .Op Fl -option Ns = Ns Ar [HOST.]KEY=VALUE
 .Op Fl -mlock
 .Op Fl -logfile Ns Op = Ns Ar FILE
-.Op Fl -syslog
+.Op Fl -pidfile Ns = Ns Ar FILE
 .Op Fl -bypass-security
 .Op Fl -chroot
 .Op Fl -user Ns = Ns Ar USER
@@ -52,6 +54,14 @@ If not mentioned otherwise, this will show log messages on the standard error ou
 Increase debug level or set it to
 .Ar LEVEL
 (see below).
+.It Fl k, -kill Ns Op = Ns Ar SIGNAL
+Attempt to kill a running
+.Nm
+(optionally with the specified
+.Ar SIGNAL
+instead of SIGTERM) and exit.
+Under Windows (not Cygwin) the optional argument is ignored,
+the service will always be stopped and removed.
 .It Fl n, -net Ns = Ns Ar NETNAME
 Connect to net
 .Ar NETNAME .
@@ -63,6 +73,13 @@ for
 .Ar NETNAME
 is the same as not specifying any
 .Ar NETNAME .
+.It Fl K, -generate-keys Ns Op = Ns Ar BITS
+Generate public/private RSA keypair and exit.
+If
+.Ar BITS
+is omitted, the default length will be 2048 bits.
+When saving keys to existing files, tinc will not delete the old keys,
+you have to remove them manually.
 .It Fl o, -option Ns = Ns Ar [HOST.]KEY=VALUE
 Without specifying a
 .Ar HOST ,
@@ -82,25 +99,18 @@ This option can be used more than once to specify multiple configuration variabl
 .It Fl L, -mlock
 Lock tinc into main memory.
 This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
-This option is not supported on all platforms.
 .It Fl -logfile Ns Op = Ns Ar FILE
 Write log entries to a file instead of to the system logging facility.
 If
 .Ar FILE
 is omitted, the default is
 .Pa @localstatedir@/log/tinc. Ns Ar NETNAME Ns Pa .log.
-.It Fl s, -syslog
+.It Fl -pidfile Ns = Ns Ar FILE
-When this option is is set, tinc uses syslog instead of stderr in --no-detach mode.
+Write PID to
-.It Fl -pidfile Ns = Ns Ar FILENAME
-Store a cookie in
-.Ar FILENAME
-which allows
-.Xr tinc 8
-to authenticate.
-If
 .Ar FILE
-is omitted, the default is
+instead of
 .Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
+Under Windows this option will be ignored.
 .It Fl -bypass-security
 Disables encryption and authentication of the meta protocol.
 Only useful for debugging.
@@ -108,12 +118,10 @@ Only useful for debugging.
 With this option tinc chroots into the directory where network
 config is located (@sysconfdir@/tinc/NETNAME if -n option is used,
 or to the directory specified with -c option) after initialization.
-This option is not supported on all platforms.
 .It Fl U, -user Ns = Ns Ar USER
 setuid to the specified
 .Ar USER
 after initialization.
-This option is not supported on all platforms.
 .It Fl -help
 Display short list of options.
 .It Fl -version
@@ -143,6 +151,15 @@ If the
 .Fl -logfile
 option is used, this will also close and reopen the log file,
 useful when log rotation is used.
+.It INT
+Temporarily increases debug level to 5.
+Send this signal again to revert to the original level.
+.It USR1
+Dumps the connection list to syslog.
+.It USR2
+Dumps virtual network device statistics, all known nodes, edges and subnets to syslog.
+.It WINCH
+Purges all information remembered about unreachable nodes.
 .El
 .Sh DEBUG LEVELS
 The tinc daemon can send a lot of messages to the syslog.
@@ -189,7 +206,6 @@ If you find any bugs, report them to tinc@tinc-vpn.org.
 .Sh TODO
 A lot, especially security auditing.
 .Sh SEE ALSO
-.Xr tinc 8 ,
 .Xr tinc.conf 5 ,
 .Pa https://www.tinc-vpn.org/ ,
 .Pa http://www.cabal.org/ .

doc/tincinclude.texi

@@ -1,5 +1,5 @@
-@set VERSION 1.1pre17
+@set VERSION 1.0.36
 @set PACKAGE tinc
 @set sysconfdir /etc
 @set localstatedir /var
-@set runstatedir /var/run
+@set runstatedir /run

install-sh

@@ -451,7 +451,18 @@ do
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
 
     # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask &&
+     { test -z "$stripcmd" || {
+	 # Create $dsttmp read-write so that cp doesn't create it read-only,
+	 # which would cause strip to fail.
+	 if test -z "$doit"; then
+	   : >"$dsttmp" # No need to fork-exec 'touch'.
+	 else
+	   $doit touch "$dsttmp"
+	 fi
+       }
+     } &&
+     $doit_exec $cpprog "$src" "$dsttmp") &&
 
     # and set any options; do chmod last to preserve setuid bits.
     #

m4/ax_append_flag.m4

@@ -49,23 +49,21 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 6
+#serial 2
 
 AC_DEFUN([AX_APPEND_FLAG],
-[dnl
+[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
-AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_SET_IF
+AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])dnl
-AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])
+AS_VAR_SET_IF(FLAGS,
-AS_VAR_SET_IF(FLAGS,[
+  [case " AS_VAR_GET(FLAGS) " in
-  AS_CASE([" AS_VAR_GET(FLAGS) "],
+    *" $1 "*)
-    [*" $1 "*], [AC_RUN_LOG([: FLAGS already contains $1])],
+      AC_RUN_LOG([: FLAGS already contains $1])
-    [
+      ;;
-     AS_VAR_APPEND(FLAGS,[" $1"])
+    *)
-     AC_RUN_LOG([: FLAGS="$FLAGS"])
+      AC_RUN_LOG([: FLAGS="$FLAGS $1"])
-    ])
+      AS_VAR_SET(FLAGS, ["AS_VAR_GET(FLAGS) $1"])
-  ],
+      ;;
-  [
+   esac],
-  AS_VAR_SET(FLAGS,[$1])
+  [AS_VAR_SET(FLAGS,["$1"])])
-  AC_RUN_LOG([: FLAGS="$FLAGS"])
-  ])
 AS_VAR_POPDEF([FLAGS])dnl
 ])dnl AX_APPEND_FLAG

m4/ax_code_coverage.m4

@@ -1,264 +0,0 @@
-# ===========================================================================
-#     https://www.gnu.org/software/autoconf-archive/ax_code_coverage.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_CODE_COVERAGE()
-#
-# DESCRIPTION
-#
-#   Defines CODE_COVERAGE_CPPFLAGS, CODE_COVERAGE_CFLAGS,
-#   CODE_COVERAGE_CXXFLAGS and CODE_COVERAGE_LIBS which should be included
-#   in the CPPFLAGS, CFLAGS CXXFLAGS and LIBS/LIBADD variables of every
-#   build target (program or library) which should be built with code
-#   coverage support. Also defines CODE_COVERAGE_RULES which should be
-#   substituted in your Makefile; and $enable_code_coverage which can be
-#   used in subsequent configure output. CODE_COVERAGE_ENABLED is defined
-#   and substituted, and corresponds to the value of the
-#   --enable-code-coverage option, which defaults to being disabled.
-#
-#   Test also for gcov program and create GCOV variable that could be
-#   substituted.
-#
-#   Note that all optimisation flags in CFLAGS must be disabled when code
-#   coverage is enabled.
-#
-#   Usage example:
-#
-#   configure.ac:
-#
-#     AX_CODE_COVERAGE
-#
-#   Makefile.am:
-#
-#     @CODE_COVERAGE_RULES@
-#     my_program_LIBS = ... $(CODE_COVERAGE_LIBS) ...
-#     my_program_CPPFLAGS = ... $(CODE_COVERAGE_CPPFLAGS) ...
-#     my_program_CFLAGS = ... $(CODE_COVERAGE_CFLAGS) ...
-#     my_program_CXXFLAGS = ... $(CODE_COVERAGE_CXXFLAGS) ...
-#
-#   This results in a "check-code-coverage" rule being added to any
-#   Makefile.am which includes "@CODE_COVERAGE_RULES@" (assuming the module
-#   has been configured with --enable-code-coverage). Running `make
-#   check-code-coverage` in that directory will run the module's test suite
-#   (`make check`) and build a code coverage report detailing the code which
-#   was touched, then print the URI for the report.
-#
-#   In earlier versions of this macro, CODE_COVERAGE_LDFLAGS was defined
-#   instead of CODE_COVERAGE_LIBS. They are both still defined, but use of
-#   CODE_COVERAGE_LIBS is preferred for clarity; CODE_COVERAGE_LDFLAGS is
-#   deprecated. They have the same value.
-#
-#   This code was derived from Makefile.decl in GLib, originally licenced
-#   under LGPLv2.1+.
-#
-# LICENSE
-#
-#   Copyright (c) 2012, 2016 Philip Withnall
-#   Copyright (c) 2012 Xan Lopez
-#   Copyright (c) 2012 Christian Persch
-#   Copyright (c) 2012 Paolo Borelli
-#   Copyright (c) 2012 Dan Winship
-#   Copyright (c) 2015 Bastien ROUCARIES
-#
-#   This library is free software; you can redistribute it and/or modify it
-#   under the terms of the GNU Lesser General Public License as published by
-#   the Free Software Foundation; either version 2.1 of the License, or (at
-#   your option) any later version.
-#
-#   This library is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU Lesser General Public License
-#   along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-#serial 21
-
-AC_DEFUN([AX_CODE_COVERAGE],[
-	dnl Check for --enable-code-coverage
-	AC_REQUIRE([AC_PROG_SED])
-
-	# allow to override gcov location
-	AC_ARG_WITH([gcov],
-	  [AS_HELP_STRING([--with-gcov[=GCOV]], [use given GCOV for coverage (GCOV=gcov).])],
-	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=$with_gcov],
-	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=gcov])
-
-	AC_MSG_CHECKING([whether to build with code coverage support])
-	AC_ARG_ENABLE([code-coverage],
-	  AS_HELP_STRING([--enable-code-coverage],
-	  [Whether to enable code coverage support]),,
-	  enable_code_coverage=no)
-
-	AM_CONDITIONAL([CODE_COVERAGE_ENABLED], [test x$enable_code_coverage = xyes])
-	AC_SUBST([CODE_COVERAGE_ENABLED], [$enable_code_coverage])
-	AC_MSG_RESULT($enable_code_coverage)
-
-	AS_IF([ test "$enable_code_coverage" = "yes" ], [
-		# check for gcov
-		AC_CHECK_TOOL([GCOV],
-		  [$_AX_CODE_COVERAGE_GCOV_PROG_WITH],
-		  [:])
-		AS_IF([test "X$GCOV" = "X:"],
-		  [AC_MSG_ERROR([gcov is needed to do coverage])])
-		AC_SUBST([GCOV])
-
-		dnl Check if gcc is being used
-		AS_IF([ test "$GCC" = "no" ], [
-			AC_MSG_ERROR([not compiling with gcc, which is required for gcov code coverage])
-		])
-
-		AC_CHECK_PROG([LCOV], [lcov], [lcov])
-		AC_CHECK_PROG([GENHTML], [genhtml], [genhtml])
-
-		AS_IF([ test -z "$LCOV" ], [
-			AC_MSG_ERROR([To enable code coverage reporting you must have lcov installed])
-		])
-
-		AS_IF([ test -z "$GENHTML" ], [
-			AC_MSG_ERROR([Could not find genhtml from the lcov package])
-		])
-
-		dnl Build the code coverage flags
-		dnl Define CODE_COVERAGE_LDFLAGS for backwards compatibility
-		CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
-		CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_LIBS="-lgcov"
-		CODE_COVERAGE_LDFLAGS="$CODE_COVERAGE_LIBS"
-
-		AC_SUBST([CODE_COVERAGE_CPPFLAGS])
-		AC_SUBST([CODE_COVERAGE_CFLAGS])
-		AC_SUBST([CODE_COVERAGE_CXXFLAGS])
-		AC_SUBST([CODE_COVERAGE_LIBS])
-		AC_SUBST([CODE_COVERAGE_LDFLAGS])
-
-		[CODE_COVERAGE_RULES_CHECK='
-	-$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) -k check
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture
-']
-		[CODE_COVERAGE_RULES_CAPTURE='
-	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS)
-	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --remove "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
-	-@rm -f $(CODE_COVERAGE_OUTPUT_FILE).tmp
-	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS)
-	@echo "file://$(abs_builddir)/$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
-']
-		[CODE_COVERAGE_RULES_CLEAN='
-clean: code-coverage-clean
-distclean: code-coverage-clean
-code-coverage-clean:
-	-$(LCOV) --directory $(top_builddir) -z
-	-rm -rf $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_FILE).tmp $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-	-find . \( -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" \) -delete
-']
-	], [
-		[CODE_COVERAGE_RULES_CHECK='
-	@echo "Need to reconfigure with --enable-code-coverage"
-']
-		CODE_COVERAGE_RULES_CAPTURE="$CODE_COVERAGE_RULES_CHECK"
-		CODE_COVERAGE_RULES_CLEAN=''
-	])
-
-[CODE_COVERAGE_RULES='
-# Code coverage
-#
-# Optional:
-#  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
-#    Multiple directories may be specified, separated by whitespace.
-#    (Default: $(top_builddir))
-#  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
-#    by lcov for code coverage. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
-#  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
-#    reports to be created. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
-#  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
-#    set to 0 to disable it and leave empty to stay with the default.
-#    (Default: empty)
-#  - CODE_COVERAGE_LCOV_SHOPTS_DEFAULT: Extra options shared between both lcov
-#    instances. (Default: based on $CODE_COVERAGE_BRANCH_COVERAGE)
-#  - CODE_COVERAGE_LCOV_SHOPTS: Extra options to shared between both lcov
-#    instances. (Default: $CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-#  - CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH: --gcov-tool pathtogcov
-#  - CODE_COVERAGE_LCOV_OPTIONS_DEFAULT: Extra options to pass to the
-#    collecting lcov instance. (Default: $CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-#  - CODE_COVERAGE_LCOV_OPTIONS: Extra options to pass to the collecting lcov
-#    instance. (Default: $CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
-#  - CODE_COVERAGE_LCOV_RMOPTS_DEFAULT: Extra options to pass to the filtering
-#    lcov instance. (Default: empty)
-#  - CODE_COVERAGE_LCOV_RMOPTS: Extra options to pass to the filtering lcov
-#    instance. (Default: $CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
-#  - CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT: Extra options to pass to the
-#    genhtml instance. (Default: based on $CODE_COVERAGE_BRANCH_COVERAGE)
-#  - CODE_COVERAGE_GENHTML_OPTIONS: Extra options to pass to the genhtml
-#    instance. (Default: $CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
-#  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
-#
-# The generated report will be titled using the $(PACKAGE_NAME) and
-# $(PACKAGE_VERSION). In order to add the current git hash to the title,
-# use the git-version-gen script, available online.
-
-# Optional variables
-CODE_COVERAGE_DIRECTORY ?= $(top_builddir)
-CODE_COVERAGE_OUTPUT_FILE ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
-CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage
-CODE_COVERAGE_BRANCH_COVERAGE ?=
-CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= $(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
-CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
-CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
-CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
-CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=\
-$(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULTS)
-CODE_COVERAGE_IGNORE_PATTERN ?=
-
-code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
-code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_cap_0 = @echo "  LCOV   --capture"\
- $(CODE_COVERAGE_OUTPUT_FILE);
-code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
-code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_ign_0 = @echo "  LCOV   --remove /tmp/*"\
- $(CODE_COVERAGE_IGNORE_PATTERN);
-code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
-code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_genhtml_0 = @echo "  GEN   " $(CODE_COVERAGE_OUTPUT_DIRECTORY);
-code_coverage_quiet = $(code_coverage_quiet_$(V))
-code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
-code_coverage_quiet_0 = --quiet
-
-# sanitizes the test-name: replaces with underscores: dashes and dots
-code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
-
-# Use recursive makes in order to ignore errors during check
-check-code-coverage:'"$CODE_COVERAGE_RULES_CHECK"'
-
-# Capture code coverage data
-code-coverage-capture: code-coverage-capture-hook'"$CODE_COVERAGE_RULES_CAPTURE"'
-
-# Hook rule executed before code-coverage-capture, overridable by the user
-code-coverage-capture-hook:
-
-'"$CODE_COVERAGE_RULES_CLEAN"'
-
-GITIGNOREFILES ?=
-GITIGNOREFILES += $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-
-A''M_DISTCHECK_CONFIGURE_FLAGS ?=
-A''M_DISTCHECK_CONFIGURE_FLAGS += --disable-code-coverage
-
-.PHONY: check-code-coverage code-coverage-capture code-coverage-capture-hook code-coverage-clean
-']
-
-	AC_SUBST([CODE_COVERAGE_RULES])
-	m4_ifdef([_AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE([CODE_COVERAGE_RULES])])
-])

m4/curses.m4

@@ -1,44 +0,0 @@
-dnl Check to find the curses headers/libraries
-
-AC_DEFUN([tinc_CURSES],
-[
-  AC_ARG_ENABLE([curses],
-    AS_HELP_STRING([--disable-curses], [disable curses support]))
-  AS_IF([test "x$enable_curses" != "xno"], [
-  AC_DEFINE(HAVE_CURSES, 1, [have curses support])
-    curses=true
-    AC_ARG_WITH(curses,
-      AS_HELP_STRING([--with-curses=DIR], [curses base directory, or:]),
-      [curses="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval/include"
-       LDFLAGS="$LDFLAGS -L$withval/lib"]
-    )
-
-    AC_ARG_WITH(curses-include,
-      AS_HELP_STRING([--with-curses-include=DIR], [curses headers directory]),
-      [curses_include="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval"]
-    )
-
-    AC_ARG_WITH(curses-lib,
-      AS_HELP_STRING([--with-curses-lib=DIR], [curses library directory]),
-      [curses_lib="$withval"
-       LDFLAGS="$LDFLAGS -L$withval"]
-    )
-
-    AC_CHECK_HEADERS(curses.h,
-      [],
-      [AC_MSG_ERROR("curses header files not found."); break]
-    )
-
-    AC_CHECK_LIB(ncurses, initscr,
-      [CURSES_LIBS="-lncurses"; AC_CHECK_LIB(tinfo, wtimeout, [CURSES_LIBS+=" -ltinfo"], [])],
-      [AC_CHECK_LIB(curses, initscr,
-        [CURSES_LIBS="-lcurses"],
-        [AC_MSG_ERROR("curses libraries not found.")]
-      )]
-    )
-  ])
-
-  AC_SUBST(CURSES_LIBS)
-])

m4/libgcrypt.m4

@@ -1,33 +0,0 @@
-dnl Check to find the libgcrypt headers/libraries
-
-AC_DEFUN([tinc_LIBGCRYPT],
-[
-  AC_ARG_WITH(libgcrypt,
-    AS_HELP_STRING([--with-libgcrypt=DIR], [libgcrypt base directory, or:]),
-    [libgcrypt="$withval"
-     CPPFLAGS="$CPPFLAGS -I$withval/include"
-     LDFLAGS="$LDFLAGS -L$withval/lib"]
-  )
-
-  AC_ARG_WITH(libgcrypt-include,
-    AS_HELP_STRING([--with-libgcrypt-include=DIR], [libgcrypt headers directory (without trailing /libgcrypt)]),
-    [libgcrypt_include="$withval"
-     CPPFLAGS="$CPPFLAGS -I$withval"]
-  )
-
-  AC_ARG_WITH(libgcrypt-lib,
-    AS_HELP_STRING([--with-libgcrypt-lib=DIR], [libgcrypt library directory]),
-    [libgcrypt_lib="$withval"
-     LDFLAGS="$LDFLAGS -L$withval"]
-  )
-
-  AC_CHECK_HEADERS([gcrypt.h],
-    [],
-    [AC_MSG_ERROR([libgcrypt header files not found.]); break]
-  )
-
-  AC_CHECK_LIB(gcrypt, gcry_cipher_encrypt,
-    [LIBS="-lgcrypt $LIBS"],
-    [AC_MSG_ERROR([libgcrypt libraries not found.])]
-  )
-])

m4/miniupnpc.m4

@@ -1,40 +0,0 @@
-dnl Check to find the miniupnpc headers/libraries
-
-AC_DEFUN([tinc_MINIUPNPC],
-[
-  AC_ARG_ENABLE([miniupnpc],
-    AS_HELP_STRING([--enable-miniupnpc], [enable miniupnpc support]))
-  AS_IF([test "x$enable_miniupnpc" = "xyes"], [
-  AC_DEFINE(HAVE_MINIUPNPC, 1, [have miniupnpc support])
-    AC_ARG_WITH(miniupnpc,
-      AS_HELP_STRING([--with-miniupnpc=DIR], [miniupnpc base directory, or:]),
-      [miniupnpc="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval/include"
-       LDFLAGS="$LDFLAGS -L$withval/lib"]
-    )
-
-    AC_ARG_WITH(miniupnpc-include,
-      AS_HELP_STRING([--with-miniupnpc-include=DIR], [miniupnpc headers directory]),
-      [miniupnpc_include="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval"]
-    )
-
-    AC_ARG_WITH(miniupnpc-lib,
-      AS_HELP_STRING([--with-miniupnpc-lib=DIR], [miniupnpc library directory]),
-      [miniupnpc_lib="$withval"
-       LDFLAGS="$LDFLAGS -L$withval"]
-    )
-
-    AC_CHECK_HEADERS(miniupnpc/miniupnpc.h,
-      [],
-      [AC_MSG_ERROR("miniupnpc header files not found."); break]
-    )
-
-    AC_CHECK_LIB(miniupnpc, upnpDiscover,
-      [MINIUPNPC_LIBS="$LIBS -lminiupnpc"],
-      [AC_MSG_ERROR("miniupnpc libraries not found.")]
-    )
-  ])
-
-  AC_SUBST(MINIUPNPC_LIBS)
-])

m4/openssl.m4

@@ -35,7 +35,7 @@ AC_DEFUN([tinc_OPENSSL],
      LDFLAGS="$LDFLAGS -L$withval"]
   )
 
-  AC_CHECK_HEADERS([openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h],
+  AC_CHECK_HEADERS(openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h,
     [],
     [AC_MSG_ERROR([LibreSSL/OpenSSL header files not found.]); break]
   )
@@ -54,6 +54,5 @@ AC_DEFUN([tinc_OPENSSL],
     [#include <openssl/evp.h>]
   )
 
-  AC_CHECK_FUNCS([BN_GENCB_new ERR_remove_state RSA_set0_key], , , [#include <openssl/rsa.h>])
+  AC_CHECK_FUNCS([BN_GENCB_new RSA_set0_key], , , [#include <openssl/rsa.h>])
-  AC_CHECK_FUNCS([HMAC_CTX_new], , , [#include <openssl/hmac.h>])
 ])

m4/readline.m4

@@ -1,42 +0,0 @@
-dnl Check to find the readline headers/libraries
-
-AC_DEFUN([tinc_READLINE],
-[
-  AC_ARG_ENABLE([readline],
-    AS_HELP_STRING([--disable-readline], [disable readline support]))
-  AS_IF([test "x$enable_readline" != "xno"], [
-  AC_DEFINE(HAVE_READLINE, 1, [have readline support])
-    readline=true
-    AC_ARG_WITH(readline,
-      AS_HELP_STRING([--with-readline=DIR], [readline base directory, or:]),
-      [readline="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval/include"
-       LDFLAGS="$LDFLAGS -L$withval/lib"]
-    )
-
-    AC_ARG_WITH(readline-include,
-      AS_HELP_STRING([--with-readline-include=DIR], [readline headers directory]),
-      [readline_include="$withval"
-       CPPFLAGS="$CPPFLAGS -I$withval"]
-    )
-
-    AC_ARG_WITH(readline-lib,
-      AS_HELP_STRING([--with-readline-lib=DIR], [readline library directory]),
-      [readline_lib="$withval"
-       LDFLAGS="$LDFLAGS -L$withval"]
-    )
-
-    AC_CHECK_HEADERS([readline/readline.h readline/history.h],
-      [],
-      [AC_MSG_ERROR("readline header files not found."); break]
-    )
-
-    AC_CHECK_LIB(readline, readline,
-      [READLINE_LIBS="-lreadline"],
-      [AC_MSG_ERROR("readline library not found.")],
-      [$CURSES_LIBS]
-    )
-  ])
-
-  AC_SUBST(READLINE_LIBS)
-])

missing

@@ -3,7 +3,7 @@
 
 scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify

src/Makefile.am

@@ -1,174 +1,54 @@
 ## Produce this file with automake to get Makefile.in
 
-sbin_PROGRAMS = tincd tinc
+sbin_PROGRAMS = tincd
-check_PROGRAMS = sptps_test sptps_keypair
-EXTRA_PROGRAMS = sptps_test sptps_keypair
-
-CLEANFILES = version_git.h
-
-.PHONY: version-stamp
-version-stamp:
-
-version_git.h: version-stamp
-	$(AM_V_GEN)echo >$@
-	@-(cd $(srcdir) && git describe 2>/dev/null >/dev/null) && echo '#define GIT_DESCRIPTION "'`(cd $(srcdir) && git describe) | sed 's/release-//'`'"' >$@ ||:
-${srcdir}/version.c: version_git.h
-
-## Now a hack to appease some versions of BSD make that don't understand that "./foo" is the same as "foo".
-if BSD
-version.c: ${srcdir}/version.c
-endif
-
-if LINUX
-EXTRA_PROGRAMS += sptps_speed
-endif
-
-ed25519_SOURCES = \
-	ed25519/ed25519.h \
-	ed25519/fe.c ed25519/fe.h \
-	ed25519/fixedint.h \
-	ed25519/ge.c ed25519/ge.h \
-	ed25519/key_exchange.c \
-	ed25519/keypair.c \
-	ed25519/precomp_data.h \
-	ed25519/sc.c ed25519/sc.h \
-	ed25519/sha512.c ed25519/sha512.h \
-	ed25519/sign.c \
-	ed25519/verify.c
-
-chacha_poly1305_SOURCES = \
-	chacha-poly1305/chacha.c chacha-poly1305/chacha.h \
-	chacha-poly1305/chacha-poly1305.c chacha-poly1305/chacha-poly1305.h \
-	chacha-poly1305/poly1305.c chacha-poly1305/poly1305.h
 
 tincd_SOURCES = \
-	address_cache.c address_cache.h \
+	have.h \
-	autoconnect.c autoconnect.h \
+	system.h \
-	buffer.c buffer.h \
+	avl_tree.c avl_tree.h \
-	cipher.h \
 	conf.c conf.h \
 	connection.c connection.h \
-	control.c control.h \
-	control_common.h \
-	crypto.h \
 	device.h \
-	digest.h \
 	dropin.c dropin.h \
 	dummy_device.c \
-	ecdh.h \
-	ecdsa.h \
-	ecdsagen.h \
 	edge.c edge.h \
 	ethernet.h \
 	event.c event.h \
-	fd_device.c \
+	fake-getaddrinfo.c fake-getaddrinfo.h \
+	fake-getnameinfo.c fake-getnameinfo.h \
 	graph.c graph.h \
-	hash.c hash.h \
-	have.h \
 	ipv4.h \
 	ipv6.h \
 	list.c list.h \
 	logger.c logger.h \
 	meta.c meta.h \
 	multicast_device.c \
-	names.c names.h \
 	net.c net.h \
 	net_packet.c \
 	net_setup.c \
 	net_socket.c \
 	netutl.c netutl.h \
 	node.c node.h \
-	prf.h \
+	pidfile.c pidfile.h \
 	process.c process.h \
 	protocol.c protocol.h \
 	protocol_auth.c \
 	protocol_edge.c \
-	protocol_key.c \
 	protocol_misc.c \
+	protocol_key.c \
 	protocol_subnet.c \
+	proxy.c proxy.h \
 	raw_socket_device.c \
 	route.c route.h \
-	rsa.h \
-	rsagen.h \
-	script.c script.h \
-	splay_tree.c splay_tree.h \
-	sptps.c sptps.h \
 	subnet.c subnet.h \
-	subnet_parse.c \
-	system.h \
 	tincd.c \
 	utils.c utils.h \
-	xalloc.h \
+	xalloc.h
-	version.c version.h \
-	ed25519/ecdh.c \
-	ed25519/ecdsa.c \
-	$(ed25519_SOURCES) \
-	$(chacha_poly1305_SOURCES)
-
-tinc_SOURCES = \
-	dropin.c dropin.h \
-	fsck.c fsck.h \
-	ifconfig.c ifconfig.h \
-	info.c info.h \
-	invitation.c invitation.h \
-	list.c list.h \
-	names.c names.h \
-	netutl.c netutl.h \
-	script.c script.h \
-	sptps.c sptps.h \
-	subnet_parse.c subnet.h \
-	tincctl.c tincctl.h \
-	top.c top.h \
-	utils.c utils.h \
-	version.c version.h \
-	ed25519/ecdh.c \
-	ed25519/ecdsa.c \
-	ed25519/ecdsagen.c \
-	$(ed25519_SOURCES) \
-	$(chacha_poly1305_SOURCES)
-
-sptps_test_SOURCES = \
-	logger.c logger.h \
-	sptps.c sptps.h \
-	sptps_test.c \
-	utils.c utils.h \
-	ed25519/ecdh.c \
-	ed25519/ecdsa.c \
-	$(ed25519_SOURCES) \
-	$(chacha_poly1305_SOURCES)
-
-sptps_keypair_SOURCES = \
-	sptps_keypair.c \
-	utils.c utils.h \
-	ed25519/ecdsagen.c \
-	$(ed25519_SOURCES)
-
-sptps_speed_SOURCES = \
-	logger.c logger.h \
-	sptps.c sptps.h \
-	sptps_speed.c \
-	utils.c utils.h \
-	ed25519/ecdh.c \
-	ed25519/ecdsa.c \
-	ed25519/ecdsagen.c \
-	$(ed25519_SOURCES) \
-	$(chacha_poly1305_SOURCES)
-
-## Conditionally compile device drivers
 
 if !GETOPT
 tincd_SOURCES += \
 	getopt.c getopt.h \
 	getopt1.c
-tinc_SOURCES += \
-	getopt.c getopt.h \
-	getopt1.c
-sptps_test_SOURCES += \
-	getopt.c getopt.h \
-	getopt1.c
-sptps_keypair_SOURCES += \
-	getopt.c getopt.h \
-	getopt1.c
 endif
 
 if LINUX
@@ -202,88 +82,8 @@ if VDE
 tincd_SOURCES += vde_device.c
 endif
 
-if OPENSSL
-tincd_SOURCES += \
-	openssl/cipher.c \
-	openssl/crypto.c \
-	openssl/digest.c openssl/digest.h \
-	openssl/prf.c \
-	openssl/rsa.c
-tinc_SOURCES += \
-	openssl/cipher.c \
-	openssl/crypto.c \
-	openssl/digest.c openssl/digest.h \
-	openssl/prf.c \
-	openssl/rsa.c \
-	openssl/rsagen.c
-sptps_test_SOURCES += \
-	openssl/crypto.c \
-	openssl/digest.c openssl/digest.h \
-	openssl/prf.c
-sptps_keypair_SOURCES += \
-	openssl/crypto.c
-sptps_speed_SOURCES += \
-	openssl/crypto.c \
-	openssl/digest.c openssl/digest.h \
-	openssl/prf.c
-else
-if GCRYPT
-tincd_SOURCES += \
-	gcrypt/cipher.c \
-	gcrypt/crypto.c \
-	gcrypt/digest.c gcrypt/digest.h \
-	gcrypt/prf.c \
-	gcrypt/rsa.c
-tinc_SOURCES += \
-	gcrypt/cipher.c \
-	gcrypt/crypto.c \
-	gcrypt/digest.c gcrypt/digest.h \
-	gcrypt/prf.c \
-	gcrypt/rsa.c \
-	gcrypt/rsagen.c
-sptps_test_SOURCES += \
-	gcrypt/cipher.c \
-	gcrypt/crypto.c \
-	gcrypt/digest.c gcrypt/digest.h \
-	gcrypt/prf.c
-sptps_keypair_SOURCES += \
-	openssl/crypto.c
-sptps_speed_SOURCES += \
-	openssl/crypto.c \
-	openssl/digest.c openssl/digest.h \
-	openssl/prf.c
-else
-tincd_SOURCES += \
-	nolegacy/crypto.c \
-	nolegacy/prf.c
-tinc_SOURCES += \
-	nolegacy/crypto.c \
-	nolegacy/prf.c
-sptps_test_SOURCES += \
-	nolegacy/crypto.c \
-	nolegacy/prf.c
-sptps_keypair_SOURCES += \
-	nolegacy/crypto.c
-sptps_speed_SOURCES += \
-	nolegacy/crypto.c \
-	nolegacy/prf.c
-endif
-endif
-
-if MINIUPNPC
-tincd_SOURCES += upnp.h upnp.c
-tincd_LDADD = $(MINIUPNPC_LIBS)
-tincd_LDFLAGS = -pthread
-endif
-
-tinc_LDADD = $(READLINE_LIBS) $(CURSES_LIBS)
-sptps_speed_LDADD = -lrt
-
-LIBS = @LIBS@ -lm $(CODE_COVERAGE_LIBS)
-
 if TUNEMU
 LIBS += -lpcap
 endif
 
-AM_CFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DRUNSTATEDIR=\"$(runstatedir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -DSBINDIR=\"$(sbindir)\" -iquote. $(CODE_COVERAGE_CFLAGS)
+AM_CPPFLAGS = -DCONFDIR=\"$(sysconfdir)\" -DRUNSTATEDIR=\"$(runstatedir)\" -DLOCALSTATEDIR=\"$(localstatedir)\" -I $(abs_top_builddir)/
-AM_CPPFLAGS = $(CODE_COVERAGE_CPPFLAGS)

src/address_cache.c

@@ -1,277 +0,0 @@
-/*
-    address_cache.c -- Manage cache of recently seen addresses
-    Copyright (C) 2018 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "system.h"
-
-#include "address_cache.h"
-#include "conf.h"
-#include "names.h"
-#include "netutl.h"
-#include "xalloc.h"
-
-static const unsigned int NOT_CACHED = -1;
-
-// Find edges pointing to this node, and use them to build a list of unique, known addresses.
-static struct addrinfo *get_known_addresses(node_t *n) {
-	struct addrinfo *ai = NULL;
-	struct addrinfo *oai = NULL;
-
-	for splay_each(edge_t, e, n->edge_tree) {
-		if(!e->reverse) {
-			continue;
-		}
-
-		bool found = false;
-
-		for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) {
-			if(!sockaddrcmp(&e->reverse->address, (sockaddr_t *)aip->ai_addr)) {
-				found = true;
-				break;
-			}
-		}
-
-		if(found) {
-			continue;
-		}
-
-		oai = ai;
-		ai = xzalloc(sizeof(*ai));
-		ai->ai_family = e->reverse->address.sa.sa_family;
-		ai->ai_socktype = SOCK_STREAM;
-		ai->ai_protocol = IPPROTO_TCP;
-		ai->ai_addrlen = SALEN(e->reverse->address.sa);
-		ai->ai_addr = xmalloc(ai->ai_addrlen);
-		memcpy(ai->ai_addr, &e->reverse->address, ai->ai_addrlen);
-		ai->ai_next = oai;
-	}
-
-	return ai;
-}
-
-static void free_known_addresses(struct addrinfo *ai) {
-	for(struct addrinfo *aip = ai, *next; aip; aip = next) {
-		next = aip->ai_next;
-		free(aip);
-	}
-}
-
-static unsigned int find_cached(address_cache_t *cache, const sockaddr_t *sa) {
-	for(unsigned int i = 0; i < cache->data.used; i++)
-		if(!sockaddrcmp(&cache->data.address[i], sa)) {
-			return i;
-		}
-
-	return NOT_CACHED;
-}
-
-void add_recent_address(address_cache_t *cache, const sockaddr_t *sa) {
-	// Check if it's already cached
-	unsigned int pos = find_cached(cache, sa);
-
-	// It's in the first spot, so nothing to do
-	if(pos == 0) {
-		return;
-	}
-
-	// Shift everything, move/add the address to the first slot
-	if(pos == NOT_CACHED) {
-		if(cache->data.used < MAX_CACHED_ADDRESSES) {
-			cache->data.used++;
-		}
-
-		pos = cache->data.used - 1;
-	}
-
-	memmove(&cache->data.address[1], &cache->data.address[0], pos * sizeof(cache->data.address[0]));
-
-	cache->data.address[0] = *sa;
-
-	// Write the cache
-	char fname[PATH_MAX];
-	snprintf(fname, sizeof(fname), "%s" SLASH "cache" SLASH "%s", confbase, cache->node->name);
-	FILE *fp = fopen(fname, "wb");
-
-	if(fp) {
-		fwrite(&cache->data, sizeof(cache->data), 1, fp);
-		fclose(fp);
-	}
-}
-
-const sockaddr_t *get_recent_address(address_cache_t *cache) {
-	// Check if there is an address in our cache of recently seen addresses
-	if(cache->tried < cache->data.used) {
-		return &cache->data.address[cache->tried++];
-	}
-
-	// Next, check any recently seen addresses not in our cache
-	while(cache->tried == cache->data.used) {
-		if(!cache->ai) {
-			cache->aip = cache->ai = get_known_addresses(cache->node);
-		}
-
-		if(cache->ai) {
-			if(cache->aip) {
-				sockaddr_t *sa = (sockaddr_t *)cache->aip->ai_addr;
-				cache->aip = cache->aip->ai_next;
-
-				if(find_cached(cache, sa) != NOT_CACHED) {
-					continue;
-				}
-
-				return sa;
-			} else {
-				free_known_addresses(cache->ai);
-				cache->ai = NULL;
-			}
-		}
-
-		cache->tried++;
-	}
-
-	// Otherwise, check if there are any known Address statements
-	if(!cache->config_tree) {
-		init_configuration(&cache->config_tree);
-		read_host_config(cache->config_tree, cache->node->name, false);
-		cache->cfg = lookup_config(cache->config_tree, "Address");
-	}
-
-	while(cache->cfg && !cache->ai) {
-		char *address, *port;
-
-		get_config_string(cache->cfg, &address);
-
-		char *space = strchr(address, ' ');
-
-		if(space) {
-			port = xstrdup(space + 1);
-			*space = 0;
-		} else {
-			if(!get_config_string(lookup_config(cache->config_tree, "Port"), &port)) {
-				port = xstrdup("655");
-			}
-		}
-
-		cache->aip = cache->ai = str2addrinfo(address, port, SOCK_STREAM);
-
-		if(cache->ai) {
-			struct addrinfo *ai = NULL;
-
-			for(; cache->aip; cache->aip = cache->aip->ai_next) {
-				struct addrinfo *oai = ai;
-
-				ai = xzalloc(sizeof(*ai));
-				ai->ai_family = cache->aip->ai_family;
-				ai->ai_socktype = cache->aip->ai_socktype;
-				ai->ai_protocol = cache->aip->ai_protocol;
-				ai->ai_addrlen = cache->aip->ai_addrlen;
-				ai->ai_addr = xmalloc(ai->ai_addrlen);
-				memcpy(ai->ai_addr, cache->aip->ai_addr, ai->ai_addrlen);
-				ai->ai_next = oai;
-			}
-
-			freeaddrinfo(cache->ai);
-			cache->aip = cache->ai = ai;
-		}
-
-		free(address);
-		free(port);
-
-		cache->cfg = lookup_config_next(cache->config_tree, cache->cfg);
-	}
-
-	if(cache->ai) {
-		if(cache->aip) {
-			sockaddr_t *sa = (sockaddr_t *)cache->aip->ai_addr;
-
-			cache->aip = cache->aip->ai_next;
-			return sa;
-		} else {
-			free_known_addresses(cache->ai);
-			cache->ai = NULL;
-		}
-	}
-
-	// We're all out of addresses.
-	exit_configuration(&cache->config_tree);
-	return false;
-}
-
-address_cache_t *open_address_cache(node_t *node) {
-	address_cache_t *cache = xmalloc(sizeof(*cache));
-	cache->node = node;
-
-	// Try to open an existing address cache
-	char fname[PATH_MAX];
-	snprintf(fname, sizeof(fname), "%s" SLASH "cache" SLASH "%s", confbase, node->name);
-	FILE *fp = fopen(fname, "rb");
-
-	if(!fp || fread(&cache->data, sizeof(cache->data), 1, fp) != 1 || cache->data.version != ADDRESS_CACHE_VERSION) {
-		memset(&cache->data, 0, sizeof(cache->data));
-	}
-
-	if(fp) {
-		fclose(fp);
-	}
-
-	// Ensure we have a valid state
-	cache->config_tree = NULL;
-	cache->cfg = NULL;
-	cache->ai = NULL;
-	cache->aip = NULL;
-	cache->tried = 0;
-	cache->data.version = ADDRESS_CACHE_VERSION;
-
-	if(cache->data.used > MAX_CACHED_ADDRESSES) {
-		cache->data.used = 0;
-	}
-
-	return cache;
-}
-
-void reset_address_cache(address_cache_t *cache, const sockaddr_t *sa) {
-	if(sa) {
-		add_recent_address(cache, sa);
-	}
-
-	if(cache->config_tree) {
-		exit_configuration(&cache->config_tree);
-	}
-
-	if(cache->ai) {
-		free_known_addresses(cache->ai);
-	}
-
-	cache->config_tree = NULL;
-	cache->cfg = NULL;
-	cache->ai = NULL;
-	cache->aip = NULL;
-	cache->tried = 0;
-}
-
-void close_address_cache(address_cache_t *cache) {
-	if(cache->config_tree) {
-		exit_configuration(&cache->config_tree);
-	}
-
-	if(cache->ai) {
-		free_known_addresses(cache->ai);
-	}
-
-	free(cache);
-}

src/address_cache.h

@@ -1,50 +0,0 @@
-#ifndef TINC_ADDRESS_CACHE_H
-#define TINC_ADDRESS_CACHE_H
-
-/*
-    address_cache.h -- header for address_cache.c
-    Copyright (C) 2018 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "net.h"
-
-#define MAX_CACHED_ADDRESSES 8
-#define ADDRESS_CACHE_VERSION 1
-
-typedef struct address_cache_t {
-	struct node_t *node;
-	struct splay_tree_t *config_tree;
-	struct config_t *cfg;
-	struct addrinfo *ai;
-	struct addrinfo *aip;
-	unsigned int tried;
-
-	struct {
-		unsigned int version;
-		unsigned int used;
-		sockaddr_t address[MAX_CACHED_ADDRESSES];
-	} data;
-} address_cache_t;
-
-void add_recent_address(address_cache_t *cache, const sockaddr_t *sa);
-const sockaddr_t *get_recent_address(address_cache_t *cache);
-
-address_cache_t *open_address_cache(struct node_t *node);
-void reset_address_cache(address_cache_t *cache, const sockaddr_t *sa);
-void close_address_cache(address_cache_t *cache);
-
-#endif

src/autoconnect.c

@@ -1,195 +0,0 @@
-/*
-    autoconnect.c -- automatic connection establishment
-    Copyright (C) 2017 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "system.h"
-
-#include "connection.h"
-#include "logger.h"
-#include "node.h"
-#include "xalloc.h"
-
-static void make_new_connection() {
-	/* Select a random node we haven't connected to yet. */
-	int count = 0;
-
-	for splay_each(node_t, n, node_tree) {
-		if(n == myself || n->connection || !(n->status.has_address || n->status.reachable)) {
-			continue;
-		}
-
-		count++;
-	}
-
-	if(!count) {
-		return;
-	}
-
-	int r = rand() % count;
-
-	for splay_each(node_t, n, node_tree) {
-		if(n == myself || n->connection || !(n->status.has_address || n->status.reachable)) {
-			continue;
-		}
-
-		if(r--) {
-			continue;
-		}
-
-		bool found = false;
-
-		for list_each(outgoing_t, outgoing, outgoing_list) {
-			if(outgoing->node == n) {
-				found = true;
-				break;
-			}
-		}
-
-		if(!found) {
-			logger(DEBUG_CONNECTIONS, LOG_INFO, "Autoconnecting to %s", n->name);
-			outgoing_t *outgoing = xzalloc(sizeof(*outgoing));
-			outgoing->node = n;
-			list_insert_tail(outgoing_list, outgoing);
-			setup_outgoing_connection(outgoing, false);
-		}
-
-		break;
-	}
-}
-
-static void connect_to_unreachable() {
-	/* Select a random known node. The rationale is that if there are many
-	 * reachable nodes, and only a few unreachable nodes, we don't want all
-	 * reachable nodes to try to connect to the unreachable ones at the
-	 * same time. This way, we back off automatically. Conversely, if there
-	 * are only a few reachable nodes, and many unreachable ones, we're
-	 * going to try harder to connect to them. */
-
-	int r = rand() % node_tree->count;
-
-	for splay_each(node_t, n, node_tree) {
-		if(r--) {
-			continue;
-		}
-
-		/* Is it unreachable and do we know an address for it? If not, return. */
-		if(n == myself || n->connection || n->status.reachable || !n->status.has_address) {
-			return;
-		}
-
-		/* Are we already trying to make an outgoing connection to it? If so, return. */
-		for list_each(outgoing_t, outgoing, outgoing_list) {
-			if(outgoing->node == n) {
-				return;
-			}
-		}
-
-		logger(DEBUG_CONNECTIONS, LOG_INFO, "Autoconnecting to %s", n->name);
-		outgoing_t *outgoing = xzalloc(sizeof(*outgoing));
-		outgoing->node = n;
-		list_insert_tail(outgoing_list, outgoing);
-		setup_outgoing_connection(outgoing, false);
-
-		return;
-	}
-}
-
-static void drop_superfluous_outgoing_connection() {
-	/* Choose a random outgoing connection to a node that has at least one other connection. */
-	int count = 0;
-
-	for list_each(connection_t, c, connection_list) {
-		if(!c->edge || !c->outgoing || !c->node || c->node->edge_tree->count < 2) {
-			continue;
-		}
-
-		count++;
-	}
-
-	if(!count) {
-		return;
-	}
-
-	int r = rand() % count;
-
-	for list_each(connection_t, c, connection_list) {
-		if(!c->edge || !c->outgoing || !c->node || c->node->edge_tree->count < 2) {
-			continue;
-		}
-
-		if(r--) {
-			continue;
-		}
-
-		logger(DEBUG_CONNECTIONS, LOG_INFO, "Autodisconnecting from %s", c->name);
-		list_delete(outgoing_list, c->outgoing);
-		c->outgoing = NULL;
-		terminate_connection(c, c->edge);
-		break;
-	}
-}
-
-static void drop_superfluous_pending_connections() {
-	for list_each(outgoing_t, o, outgoing_list) {
-		/* Only look for connections that are waiting to be retried later. */
-		bool found = false;
-
-		for list_each(connection_t, c, connection_list) {
-			if(c->outgoing == o) {
-				found = true;
-				break;
-			}
-		}
-
-		if(found) {
-			continue;
-		}
-
-		logger(DEBUG_CONNECTIONS, LOG_INFO, "Cancelled outgoing connection to %s", o->node->name);
-		list_delete_node(outgoing_list, node);
-	}
-}
-
-void do_autoconnect() {
-	/* Count number of active connections. */
-	int nc = 0;
-
-	for list_each(connection_t, c, connection_list) {
-		if(c->edge) {
-			nc++;
-		}
-	}
-
-	/* Less than 3 connections? Eagerly try to make a new one. */
-	if(nc < 3) {
-		make_new_connection();
-		return;
-	}
-
-	/* More than 3 connections? See if we can get rid of a superfluous one. */
-	if(nc > 3) {
-		drop_superfluous_outgoing_connection();
-	}
-
-
-	/* Check if there are unreachable nodes that we should try to connect to. */
-	connect_to_unreachable();
-
-	/* Drop pending outgoing connections from the outgoing list. */
-	drop_superfluous_pending_connections();
-}

src/autoconnect.h

@@ -1,25 +0,0 @@
-#ifndef TINC_AUTOCONNECT_H
-#define TINC_AUTOCONNECT_H
-
-/*
-    autoconnect.h -- header for autoconnect.c
-    Copyright (C) 2017 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-extern void do_autoconnect(void);
-
-#endif

src/avl_tree.c

@@ -0,0 +1,757 @@
+/*
+    avl_tree.c -- avl_ tree and linked list convenience
+    Copyright (C) 1998 Michael H. Buselli
+                  2000-2005 Ivo Timmermans,
+                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
+
+    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
+    instead of depths, to add the ->next and ->prev and to generally obfuscate
+    the code. Mail me if you found a bug.
+
+    Cleaned up and incorporated some of the ideas from the red-black tree
+    library for inclusion into tinc (https://www.tinc-vpn.org/) by
+    Guus Sliepen <guus@tinc-vpn.org>.
+*/
+
+#include "system.h"
+
+#include "avl_tree.h"
+#include "xalloc.h"
+
+#ifdef AVL_COUNT
+#define AVL_NODE_COUNT(n)  ((n) ? (n)->count : 0)
+#define AVL_L_COUNT(n)     (AVL_NODE_COUNT((n)->left))
+#define AVL_R_COUNT(n)     (AVL_NODE_COUNT((n)->right))
+#define AVL_CALC_COUNT(n)  (AVL_L_COUNT(n) + AVL_R_COUNT(n) + 1)
+#endif
+
+#ifdef AVL_DEPTH
+#define AVL_NODE_DEPTH(n)  ((n) ? (n)->depth : 0)
+#define L_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->left))
+#define R_AVL_DEPTH(n)     (AVL_NODE_DEPTH((n)->right))
+#define AVL_CALC_DEPTH(n)  ((L_AVL_DEPTH(n)>R_AVL_DEPTH(n)?L_AVL_DEPTH(n):R_AVL_DEPTH(n)) + 1)
+#endif
+
+#ifndef AVL_DEPTH
+static int lg(unsigned int u) __attribute__((__const__));
+
+static int lg(unsigned int u) {
+	int r = 1;
+
+	if(!u) {
+		return 0;
+	}
+
+	if(u & 0xffff0000) {
+		u >>= 16;
+		r += 16;
+	}
+
+	if(u & 0x0000ff00) {
+		u >>= 8;
+		r += 8;
+	}
+
+	if(u & 0x000000f0) {
+		u >>= 4;
+		r += 4;
+	}
+
+	if(u & 0x0000000c) {
+		u >>= 2;
+		r += 2;
+	}
+
+	if(u & 0x00000002) {
+		r++;
+	}
+
+	return r;
+}
+#endif
+
+/* Internal helper functions */
+
+static int avl_check_balance(const avl_node_t *node) {
+#ifdef AVL_DEPTH
+	int d;
+
+	d = R_AVL_DEPTH(node) - L_AVL_DEPTH(node);
+
+	return d < -1 ? -1 : d > 1 ? 1 : 0;
+#else
+	/*      int d;
+	 *      d = lg(AVL_R_COUNT(node)) - lg(AVL_L_COUNT(node));
+	 *      d = d<-1?-1:d>1?1:0;
+	 */
+	int pl, r;
+
+	pl = lg(AVL_L_COUNT(node));
+	r = AVL_R_COUNT(node);
+
+	if(r >> pl + 1) {
+		return 1;
+	}
+
+	if(pl < 2 || r >> pl - 2) {
+		return 0;
+	}
+
+	return -1;
+#endif
+}
+
+static void avl_rebalance(avl_tree_t *tree, avl_node_t *node) {
+	avl_node_t *child;
+	avl_node_t *gchild;
+	avl_node_t *parent;
+	avl_node_t **superparent;
+
+	while(node) {
+		parent = node->parent;
+
+		superparent =
+		        parent ? node ==
+		        parent->left ? &parent->left : &parent->right : &tree->root;
+
+		switch(avl_check_balance(node)) {
+		case -1:
+			child = node->left;
+#ifdef AVL_DEPTH
+
+			if(L_AVL_DEPTH(child) >= R_AVL_DEPTH(child)) {
+#else
+
+			if(AVL_L_COUNT(child) >= AVL_R_COUNT(child)) {
+#endif
+				node->left = child->right;
+
+				if(node->left) {
+					node->left->parent = node;
+				}
+
+				child->right = node;
+				node->parent = child;
+				*superparent = child;
+				child->parent = parent;
+#ifdef AVL_COUNT
+				node->count = AVL_CALC_COUNT(node);
+				child->count = AVL_CALC_COUNT(child);
+#endif
+#ifdef AVL_DEPTH
+				node->depth = AVL_CALC_DEPTH(node);
+				child->depth = AVL_CALC_DEPTH(child);
+#endif
+			} else {
+				gchild = child->right;
+				node->left = gchild->right;
+
+				if(node->left) {
+					node->left->parent = node;
+				}
+
+				child->right = gchild->left;
+
+				if(child->right) {
+					child->right->parent = child;
+				}
+
+				gchild->right = node;
+
+				gchild->right->parent = gchild;
+				gchild->left = child;
+
+				gchild->left->parent = gchild;
+
+				*superparent = gchild;
+				gchild->parent = parent;
+#ifdef AVL_COUNT
+				node->count = AVL_CALC_COUNT(node);
+				child->count = AVL_CALC_COUNT(child);
+				gchild->count = AVL_CALC_COUNT(gchild);
+#endif
+#ifdef AVL_DEPTH
+				node->depth = AVL_CALC_DEPTH(node);
+				child->depth = AVL_CALC_DEPTH(child);
+				gchild->depth = AVL_CALC_DEPTH(gchild);
+#endif
+			}
+
+			break;
+
+		case 1:
+			child = node->right;
+#ifdef AVL_DEPTH
+
+			if(R_AVL_DEPTH(child) >= L_AVL_DEPTH(child)) {
+#else
+
+			if(AVL_R_COUNT(child) >= AVL_L_COUNT(child)) {
+#endif
+				node->right = child->left;
+
+				if(node->right) {
+					node->right->parent = node;
+				}
+
+				child->left = node;
+				node->parent = child;
+				*superparent = child;
+				child->parent = parent;
+#ifdef AVL_COUNT
+				node->count = AVL_CALC_COUNT(node);
+				child->count = AVL_CALC_COUNT(child);
+#endif
+#ifdef AVL_DEPTH
+				node->depth = AVL_CALC_DEPTH(node);
+				child->depth = AVL_CALC_DEPTH(child);
+#endif
+			} else {
+				gchild = child->left;
+				node->right = gchild->left;
+
+				if(node->right) {
+					node->right->parent = node;
+				}
+
+				child->left = gchild->right;
+
+				if(child->left) {
+					child->left->parent = child;
+				}
+
+				gchild->left = node;
+
+				gchild->left->parent = gchild;
+				gchild->right = child;
+
+				gchild->right->parent = gchild;
+
+				*superparent = gchild;
+				gchild->parent = parent;
+#ifdef AVL_COUNT
+				node->count = AVL_CALC_COUNT(node);
+				child->count = AVL_CALC_COUNT(child);
+				gchild->count = AVL_CALC_COUNT(gchild);
+#endif
+#ifdef AVL_DEPTH
+				node->depth = AVL_CALC_DEPTH(node);
+				child->depth = AVL_CALC_DEPTH(child);
+				gchild->depth = AVL_CALC_DEPTH(gchild);
+#endif
+			}
+
+			break;
+
+		default:
+#ifdef AVL_COUNT
+			node->count = AVL_CALC_COUNT(node);
+#endif
+#ifdef AVL_DEPTH
+			node->depth = AVL_CALC_DEPTH(node);
+#endif
+		}
+
+		node = parent;
+	}
+}
+
+/* (De)constructors */
+
+avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete) {
+	avl_tree_t *tree;
+
+	tree = xmalloc_and_zero(sizeof(avl_tree_t));
+	tree->compare = compare;
+	tree->delete = delete;
+
+	return tree;
+}
+
+void avl_free_tree(avl_tree_t *tree) {
+	free(tree);
+}
+
+avl_node_t *avl_alloc_node(void) {
+	return xmalloc_and_zero(sizeof(avl_node_t));
+}
+
+void avl_free_node(avl_tree_t *tree, avl_node_t *node) {
+	if(node->data && tree->delete) {
+		tree->delete(node->data);
+	}
+
+	free(node);
+}
+
+/* Searching */
+
+void *avl_search(const avl_tree_t *tree, const void *data) {
+	avl_node_t *node;
+
+	node = avl_search_node(tree, data);
+
+	return node ? node->data : NULL;
+}
+
+void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result) {
+	avl_node_t *node;
+
+	node = avl_search_closest_node(tree, data, result);
+
+	return node ? node->data : NULL;
+}
+
+void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data) {
+	avl_node_t *node;
+
+	node = avl_search_closest_smaller_node(tree, data);
+
+	return node ? node->data : NULL;
+}
+
+void *avl_search_closest_greater(const avl_tree_t *tree, const void *data) {
+	avl_node_t *node;
+
+	node = avl_search_closest_greater_node(tree, data);
+
+	return node ? node->data : NULL;
+}
+
+avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data) {
+	avl_node_t *node;
+	int result;
+
+	node = avl_search_closest_node(tree, data, &result);
+
+	return result ? NULL : node;
+}
+
+avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data,
+                                    int *result) {
+	avl_node_t *node;
+	int c;
+
+	node = tree->root;
+
+	if(!node) {
+		if(result) {
+			*result = 0;
+		}
+
+		return NULL;
+	}
+
+	for(;;) {
+		c = tree->compare(data, node->data);
+
+		if(c < 0) {
+			if(node->left) {
+				node = node->left;
+			} else {
+				if(result) {
+					*result = -1;
+				}
+
+				break;
+			}
+		} else if(c > 0) {
+			if(node->right) {
+				node = node->right;
+			} else {
+				if(result) {
+					*result = 1;
+				}
+
+				break;
+			}
+		} else {
+			if(result) {
+				*result = 0;
+			}
+
+			break;
+		}
+	}
+
+	return node;
+}
+
+avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree,
+                const void *data) {
+	avl_node_t *node;
+	int result;
+
+	node = avl_search_closest_node(tree, data, &result);
+
+	if(result < 0) {
+		node = node->prev;
+	}
+
+	return node;
+}
+
+avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree,
+                const void *data) {
+	avl_node_t *node;
+	int result;
+
+	node = avl_search_closest_node(tree, data, &result);
+
+	if(result > 0) {
+		node = node->next;
+	}
+
+	return node;
+}
+
+/* Insertion and deletion */
+
+avl_node_t *avl_insert(avl_tree_t *tree, void *data) {
+	avl_node_t *closest, *new;
+	int result;
+
+	if(!tree->root) {
+		new = avl_alloc_node();
+		new->data = data;
+		avl_insert_top(tree, new);
+	} else {
+		closest = avl_search_closest_node(tree, data, &result);
+
+		switch(result) {
+		case -1:
+			new = avl_alloc_node();
+			new->data = data;
+			avl_insert_before(tree, closest, new);
+			break;
+
+		case 1:
+			new = avl_alloc_node();
+			new->data = data;
+			avl_insert_after(tree, closest, new);
+			break;
+
+		default:
+			return NULL;
+		}
+	}
+
+#ifdef AVL_COUNT
+	new->count = 1;
+#endif
+#ifdef AVL_DEPTH
+	new->depth = 1;
+#endif
+
+	return new;
+}
+
+avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node) {
+	avl_node_t *closest;
+	int result;
+
+	if(!tree->root) {
+		avl_insert_top(tree, node);
+	} else {
+		closest = avl_search_closest_node(tree, node->data, &result);
+
+		switch(result) {
+		case -1:
+			avl_insert_before(tree, closest, node);
+			break;
+
+		case 1:
+			avl_insert_after(tree, closest, node);
+			break;
+
+		case 0:
+			return NULL;
+		}
+	}
+
+#ifdef AVL_COUNT
+	node->count = 1;
+#endif
+#ifdef AVL_DEPTH
+	node->depth = 1;
+#endif
+
+	return node;
+}
+
+void avl_insert_top(avl_tree_t *tree, avl_node_t *node) {
+	node->prev = node->next = node->parent = NULL;
+	tree->head = tree->tail = tree->root = node;
+}
+
+void avl_insert_before(avl_tree_t *tree, avl_node_t *before,
+                       avl_node_t *node) {
+	if(!before) {
+		if(tree->tail) {
+			avl_insert_after(tree, tree->tail, node);
+		} else {
+			avl_insert_top(tree, node);
+		}
+
+		return;
+	}
+
+	node->next = before;
+	node->parent = before;
+	node->prev = before->prev;
+
+	if(before->left) {
+		avl_insert_after(tree, before->prev, node);
+		return;
+	}
+
+	if(before->prev) {
+		before->prev->next = node;
+	} else {
+		tree->head = node;
+	}
+
+	before->prev = node;
+	before->left = node;
+
+	avl_rebalance(tree, before);
+}
+
+void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node) {
+	if(!after) {
+		if(tree->head) {
+			avl_insert_before(tree, tree->head, node);
+		} else {
+			avl_insert_top(tree, node);
+		}
+
+		return;
+	}
+
+	if(after->right) {
+		avl_insert_before(tree, after->next, node);
+		return;
+	}
+
+	node->prev = after;
+	node->parent = after;
+	node->next = after->next;
+
+	if(after->next) {
+		after->next->prev = node;
+	} else {
+		tree->tail = node;
+	}
+
+	after->next = node;
+	after->right = node;
+
+	avl_rebalance(tree, after);
+}
+
+avl_node_t *avl_unlink(avl_tree_t *tree, void *data) {
+	avl_node_t *node;
+
+	node = avl_search_node(tree, data);
+
+	if(node) {
+		avl_unlink_node(tree, node);
+	}
+
+	return node;
+}
+
+void avl_unlink_node(avl_tree_t *tree, avl_node_t *node) {
+	avl_node_t *parent;
+	avl_node_t **superparent;
+	avl_node_t *subst, *left, *right;
+	avl_node_t *balnode;
+
+	if(node->prev) {
+		node->prev->next = node->next;
+	} else {
+		tree->head = node->next;
+	}
+
+	if(node->next) {
+		node->next->prev = node->prev;
+	} else {
+		tree->tail = node->prev;
+	}
+
+	parent = node->parent;
+
+	superparent =
+	        parent ? node ==
+	        parent->left ? &parent->left : &parent->right : &tree->root;
+
+	left = node->left;
+	right = node->right;
+
+	if(!left) {
+		*superparent = right;
+
+		if(right) {
+			right->parent = parent;
+		}
+
+		balnode = parent;
+	} else if(!right) {
+		*superparent = left;
+		left->parent = parent;
+		balnode = parent;
+	} else {
+		subst = node->prev;
+
+		if(!subst) { // This only happens if node is not actually in a tree at all.
+			abort();
+		}
+
+		if(subst == left) {
+			balnode = subst;
+		} else {
+			balnode = subst->parent;
+			balnode->right = subst->left;
+
+			if(balnode->right) {
+				balnode->right->parent = balnode;
+			}
+
+			subst->left = left;
+			left->parent = subst;
+		}
+
+		subst->right = right;
+		subst->parent = parent;
+		right->parent = subst;
+		*superparent = subst;
+	}
+
+	avl_rebalance(tree, balnode);
+
+	node->next = node->prev = node->parent = node->left = node->right = NULL;
+
+#ifdef AVL_COUNT
+	node->count = 0;
+#endif
+#ifdef AVL_DEPTH
+	node->depth = 0;
+#endif
+}
+
+void avl_delete_node(avl_tree_t *tree, avl_node_t *node) {
+	avl_unlink_node(tree, node);
+	avl_free_node(tree, node);
+}
+
+void avl_delete(avl_tree_t *tree, void *data) {
+	avl_node_t *node;
+
+	node = avl_search_node(tree, data);
+
+	if(node) {
+		avl_delete_node(tree, node);
+	}
+}
+
+/* Fast tree cleanup */
+
+void avl_delete_tree(avl_tree_t *tree) {
+	avl_node_t *node, *next;
+
+	for(node = tree->head; node; node = next) {
+		next = node->next;
+		avl_free_node(tree, node);
+	}
+
+	avl_free_tree(tree);
+}
+
+/* Tree walking */
+
+void avl_foreach(const avl_tree_t *tree, avl_action_t action) {
+	avl_node_t *node, *next;
+
+	for(node = tree->head; node; node = next) {
+		next = node->next;
+		action(node->data);
+	}
+}
+
+void avl_foreach_node(const avl_tree_t *tree, avl_action_t action) {
+	avl_node_t *node, *next;
+
+	for(node = tree->head; node; node = next) {
+		next = node->next;
+		action(node);
+	}
+}
+
+/* Indexing */
+
+#ifdef AVL_COUNT
+unsigned int avl_count(const avl_tree_t *tree) {
+	return AVL_NODE_COUNT(tree->root);
+}
+
+avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index) {
+	avl_node_t *node;
+	unsigned int c;
+
+	node = tree->root;
+
+	while(node) {
+		c = AVL_L_COUNT(node);
+
+		if(index < c) {
+			node = node->left;
+		} else if(index > c) {
+			node = node->right;
+			index -= c + 1;
+		} else {
+			return node;
+		}
+	}
+
+	return NULL;
+}
+
+unsigned int avl_index(const avl_node_t *node) {
+	avl_node_t *next;
+	unsigned int index;
+
+	index = AVL_L_COUNT(node);
+
+	while((next = node->parent)) {
+		if(node == next->right) {
+			index += AVL_L_COUNT(next) + 1;
+		}
+
+		node = next;
+	}
+
+	return index;
+}
+#endif
+#ifdef AVL_DEPTH
+unsigned int avl_depth(const avl_tree_t *tree) {
+	return AVL_NODE_DEPTH(tree->root);
+}
+#endif

src/avl_tree.h

@@ -0,0 +1,142 @@
+#ifndef TINC_AVL_TREE_H
+#define TINC_AVL_TREE_H
+
+/*
+    avl_tree.h -- header file for avl_tree.c
+    Copyright (C) 1998 Michael H. Buselli
+                  2000-2005 Ivo Timmermans,
+                  2000-2006 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2005 Wessel Dankers <wsl@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+    Original AVL tree library by Michael H. Buselli <cosine@cosine.org>.
+
+    Modified 2000-11-28 by Wessel Dankers <wsl@tinc-vpn.org> to use counts
+    instead of depths, to add the ->next and ->prev and to generally obfuscate
+    the code. Mail me if you found a bug.
+
+    Cleaned up and incorporated some of the ideas from the red-black tree
+    library for inclusion into tinc (https://www.tinc-vpn.org/) by
+    Guus Sliepen <guus@tinc-vpn.org>.
+*/
+
+#ifndef AVL_DEPTH
+#ifndef AVL_COUNT
+#define AVL_DEPTH
+#endif
+#endif
+
+typedef struct avl_node_t {
+
+	/* Linked list part */
+
+	struct avl_node_t *next;
+	struct avl_node_t *prev;
+
+	/* Tree part */
+
+	struct avl_node_t *parent;
+	struct avl_node_t *left;
+	struct avl_node_t *right;
+
+#ifdef AVL_COUNT
+	unsigned int count;
+#endif
+#ifdef AVL_DEPTH
+	unsigned char depth;
+#endif
+
+	/* Payload */
+
+	void *data;
+
+} avl_node_t;
+
+typedef int (*avl_compare_t)(const void *data1, const void *data2);
+typedef void (*avl_action_t)(const void *data);
+typedef void (*avl_action_node_t)(const avl_node_t *node);
+
+typedef struct avl_tree_t {
+
+	/* Linked list part */
+
+	avl_node_t *head;
+	avl_node_t *tail;
+
+	/* Tree part */
+
+	avl_node_t *root;
+
+	avl_compare_t compare;
+	avl_action_t delete;
+
+} avl_tree_t;
+
+/* (De)constructors */
+
+extern avl_tree_t *avl_alloc_tree(avl_compare_t compare, avl_action_t delete);
+extern void avl_free_tree(avl_tree_t *tree);
+
+extern avl_node_t *avl_alloc_node(void);
+extern void avl_free_node(avl_tree_t *tree, avl_node_t *node);
+
+/* Insertion and deletion */
+
+extern avl_node_t *avl_insert(avl_tree_t *tree, void *data);
+extern avl_node_t *avl_insert_node(avl_tree_t *tree, avl_node_t *node);
+
+extern void avl_insert_top(avl_tree_t *tree, avl_node_t *node);
+extern void avl_insert_before(avl_tree_t *tree, avl_node_t *before, avl_node_t *node);
+extern void avl_insert_after(avl_tree_t *tree, avl_node_t *after, avl_node_t *node);
+
+extern avl_node_t *avl_unlink(avl_tree_t *tree, void *data);
+extern void avl_unlink_node(avl_tree_t *tree, avl_node_t *node);
+extern void avl_delete(avl_tree_t *tree, void *data);
+extern void avl_delete_node(avl_tree_t *tree, avl_node_t *node);
+
+/* Fast tree cleanup */
+
+extern void avl_delete_tree(avl_tree_t *tree);
+
+/* Searching */
+
+extern void *avl_search(const avl_tree_t *tree, const void *data);
+extern void *avl_search_closest(const avl_tree_t *tree, const void *data, int *result);
+extern void *avl_search_closest_smaller(const avl_tree_t *tree, const void *data);
+extern void *avl_search_closest_greater(const avl_tree_t *tree, const void *data);
+
+extern avl_node_t *avl_search_node(const avl_tree_t *tree, const void *data);
+extern avl_node_t *avl_search_closest_node(const avl_tree_t *tree, const void *data, int *result);
+extern avl_node_t *avl_search_closest_smaller_node(const avl_tree_t *tree, const void *data);
+extern avl_node_t *avl_search_closest_greater_node(const avl_tree_t *tree, const void *data);
+
+/* Tree walking */
+
+extern void avl_foreach(const avl_tree_t *tree, avl_action_t action);
+extern void avl_foreach_node(const avl_tree_t *tree, avl_action_t action);
+
+/* Indexing */
+
+#ifdef AVL_COUNT
+extern unsigned int avl_count(const avl_tree_t *tree);
+extern avl_node_t *avl_get_node(const avl_tree_t *tree, unsigned int index);
+extern unsigned int avl_index(const avl_node_t *node);
+#endif
+#ifdef AVL_DEPTH
+extern unsigned int avl_depth(const avl_tree_t *tree);
+#endif
+
+#endif

src/bsd/device.c

@@ -1,7 +1,7 @@
 /*
     device.c -- Interaction BSD tun/tap device
     Copyright (C) 2001-2005 Ivo Timmermans,
-                  2001-2017 Guus Sliepen <guus@tinc-vpn.org>
+                  2001-2016 Guus Sliepen <guus@tinc-vpn.org>
                   2009      Grzegorz Dymarek <gregd72002@googlemail.com>
 
     This program is free software; you can redistribute it and/or modify
@@ -24,14 +24,13 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
-#include "../names.h"
 #include "../net.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
 
 #ifdef ENABLE_TUNEMU
-#include "bsd/tunemu.h"
+#include "tunemu.h"
 #endif
 
 #ifdef HAVE_NET_IF_UTUN_H
@@ -57,6 +56,8 @@ int device_fd = -1;
 char *device = NULL;
 char *iface = NULL;
 static const char *device_info = "OS X utun device";
+static uint64_t device_total_in = 0;
+static uint64_t device_total_out = 0;
 #if defined(ENABLE_TUNEMU)
 static device_type_t device_type = DEVICE_TYPE_TUNEMU;
 #elif defined(HAVE_OPENBSD) || defined(HAVE_FREEBSD) || defined(HAVE_DRAGONFLY)
@@ -70,7 +71,7 @@ static bool setup_utun(void) {
 	device_fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
 
 	if(device_fd == -1) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
+		logger(LOG_ERR, "Could not open PF_SYSTEM socket: %s\n", strerror(errno));
 		return false;
 	}
 
@@ -79,7 +80,7 @@ static bool setup_utun(void) {
 	strlcpy(info.ctl_name, UTUN_CONTROL_NAME, sizeof(info.ctl_name));
 
 	if(ioctl(device_fd, CTLIOCGINFO, &info) == -1) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
+		logger(LOG_ERR, "ioctl(CTLIOCGINFO) failed: %s", strerror(errno));
 		return false;
 	}
 
@@ -103,7 +104,7 @@ static bool setup_utun(void) {
 	};
 
 	if(connect(device_fd, (struct sockaddr *)&sc, sizeof(sc)) == -1) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
+		logger(LOG_ERR, "Could not connect utun socket: %s\n", strerror(errno));
 		return false;
 	}
 
@@ -116,14 +117,22 @@ static bool setup_utun(void) {
 		iface = xstrdup(name);
 	}
 
-	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
+	logger(LOG_INFO, "%s is a %s", device, device_info);
 
 	return true;
 }
 #endif
 
 static bool setup_device(void) {
-	get_config_string(lookup_config(config_tree, "Device"), &device);
+	// Find out which device file to open
+
+	if(!get_config_string(lookup_config(config_tree, "Device"), &device)) {
+		if(routing_mode == RMODE_ROUTER) {
+			device = xstrdup(DEFAULT_TUN_DEVICE);
+		} else {
+			device = xstrdup(DEFAULT_TAP_DEVICE);
+		}
+	}
 
 	// Find out if it's supposed to be a tun or a tap device
 
@@ -152,36 +161,26 @@ static bool setup_device(void) {
 		} else if(!strcasecmp(type, "tap")) {
 			device_type = DEVICE_TYPE_TAP;
 		} else {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Unknown device type %s!", type);
+			logger(LOG_ERR, "Unknown device type %s!", type);
 			return false;
 		}
 	} else {
 #ifdef HAVE_NET_IF_UTUN_H
 
-		if(device && (strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0)) {
+		if(strncmp(device, "utun", 4) == 0 || strncmp(device, "/dev/utun", 9) == 0) {
 			device_type = DEVICE_TYPE_UTUN;
 		} else
 #endif
-			if((device && strstr(device, "tap")) || routing_mode != RMODE_ROUTER) {
+			if(strstr(device, "tap") || routing_mode != RMODE_ROUTER) {
 				device_type = DEVICE_TYPE_TAP;
 			}
 	}
 
 	if(routing_mode == RMODE_SWITCH && device_type != DEVICE_TYPE_TAP) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Only tap devices support switch mode!");
+		logger(LOG_ERR, "Only tap devices support switch mode!");
 		return false;
 	}
 
-	// Find out which device file to open
-
-	if(!device) {
-		if(device_type == DEVICE_TYPE_TAP) {
-			device = xstrdup(DEFAULT_TAP_DEVICE);
-		} else {
-			device = xstrdup(DEFAULT_TUN_DEVICE);
-		}
-	}
-
 	// Open the device
 
 	switch(device_type) {
@@ -204,7 +203,7 @@ static bool setup_device(void) {
 	}
 
 	if(device_fd < 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open %s: %s", device, strerror(errno));
+		logger(LOG_ERR, "Could not open %s: %s", device, strerror(errno));
 		return false;
 	}
 
@@ -234,7 +233,7 @@ static bool setup_device(void) {
 	if(!get_config_string(lookup_config(config_tree, "Interface"), &iface)) {
 		iface = xstrdup(strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname);
 	} else if(strcmp(iface, strrchr(realname, '/') ? strrchr(realname, '/') + 1 : realname)) {
-		logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
+		logger(LOG_WARNING, "Warning: Interface does not match Device. $INTERFACE might be set incorrectly.");
 	}
 
 	// Configure the device as best as we can
@@ -249,7 +248,7 @@ static bool setup_device(void) {
 			const int zero = 0;
 
 			if(ioctl(device_fd, TUNSIFHEAD, &zero, sizeof(zero)) == -1) {
-				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
+				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
@@ -271,7 +270,7 @@ static bool setup_device(void) {
 			const int one = 1;
 
 			if(ioctl(device_fd, TUNSIFHEAD, &one, sizeof(one)) == -1) {
-				logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
+				logger(LOG_ERR, "System call `%s' failed: %s", "ioctl", strerror(errno));
 				return false;
 			}
 		}
@@ -298,7 +297,10 @@ static bool setup_device(void) {
 			struct ifreq ifr;
 
 			if(ioctl(device_fd, TAPGIFNAME, (void *)&ifr) == 0) {
-				free(iface);
+				if(iface) {
+					free(iface);
+				}
+
 				iface = xstrdup(ifr.ifr_name);
 			}
 		}
@@ -321,7 +323,7 @@ static bool setup_device(void) {
 
 #endif
 
-	logger(DEBUG_ALWAYS, LOG_INFO, "%s is a %s", device, device_info);
+	logger(LOG_INFO, "%s is a %s", device, device_info);
 
 	return true;
 }
@@ -339,115 +341,112 @@ static void close_device(void) {
 		close(device_fd);
 	}
 
-	device_fd = -1;
-
 	free(device);
-	device = NULL;
 	free(iface);
-	iface = NULL;
-	device_info = NULL;
 }
 
 static bool read_packet(vpn_packet_t *packet) {
-	int inlen;
+	int lenin;
 
 	switch(device_type) {
 	case DEVICE_TYPE_TUN:
 #ifdef ENABLE_TUNEMU
 	case DEVICE_TYPE_TUNEMU:
 		if(device_type == DEVICE_TYPE_TUNEMU) {
-			inlen = tunemu_read(device_fd, DATA(packet) + 14, MTU - 14);
+			lenin = tunemu_read(device_fd, packet->data + 14, MTU - 14);
 		} else
 #endif
-			inlen = read(device_fd, DATA(packet) + 14, MTU - 14);
+			lenin = read(device_fd, packet->data + 14, MTU - 14);
 
-		if(inlen <= 0) {
+		if(lenin <= 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 
-		switch(DATA(packet)[14] >> 4) {
+		switch(packet->data[14] >> 4) {
 		case 4:
-			DATA(packet)[12] = 0x08;
+			packet->data[12] = 0x08;
-			DATA(packet)[13] = 0x00;
+			packet->data[13] = 0x00;
 			break;
 
 		case 6:
-			DATA(packet)[12] = 0x86;
+			packet->data[12] = 0x86;
-			DATA(packet)[13] = 0xDD;
+			packet->data[13] = 0xDD;
 			break;
 
 		default:
-			logger(DEBUG_TRAFFIC, LOG_ERR,
+			ifdebug(TRAFFIC) logger(LOG_ERR,
-			       "Unknown IP version %d while reading packet from %s %s",
+			                        "Unknown IP version %d while reading packet from %s %s",
-			       DATA(packet)[14] >> 4, device_info, device);
+			                        packet->data[14] >> 4, device_info, device);
 			return false;
 		}
 
-		memset(DATA(packet), 0, 12);
+		memset(packet->data, 0, 12);
-		packet->len = inlen + 14;
+		packet->len = lenin + 14;
 		break;
 
 	case DEVICE_TYPE_UTUN:
 	case DEVICE_TYPE_TUNIFHEAD: {
-		if((inlen = read(device_fd, DATA(packet) + 10, MTU - 10)) <= 0) {
+		if((lenin = read(device_fd, packet->data + 10, MTU - 10)) <= 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 
-		switch(DATA(packet)[14] >> 4) {
+		switch(packet->data[14] >> 4) {
 		case 4:
-			DATA(packet)[12] = 0x08;
+			packet->data[12] = 0x08;
-			DATA(packet)[13] = 0x00;
+			packet->data[13] = 0x00;
 			break;
 
 		case 6:
-			DATA(packet)[12] = 0x86;
+			packet->data[12] = 0x86;
-			DATA(packet)[13] = 0xDD;
+			packet->data[13] = 0xDD;
 			break;
 
 		default:
-			logger(DEBUG_TRAFFIC, LOG_ERR,
+			ifdebug(TRAFFIC) logger(LOG_ERR,
-			       "Unknown IP version %d while reading packet from %s %s",
+			                        "Unknown IP version %d while reading packet from %s %s",
-			       DATA(packet)[14] >> 4, device_info, device);
+			                        packet->data[14] >> 4, device_info, device);
 			return false;
 		}
 
-		memset(DATA(packet), 0, 12);
+		memset(packet->data, 0, 12);
-		packet->len = inlen + 10;
+		packet->len = lenin + 10;
 		break;
 	}
 
 	case DEVICE_TYPE_TAP:
-		if((inlen = read(device_fd, DATA(packet), MTU)) <= 0) {
+		if((lenin = read(device_fd, packet->data, MTU)) <= 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
 
-		packet->len = inlen;
+		packet->len = lenin;
 		break;
 
 	default:
 		return false;
 	}
 
-	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s",
+	device_total_in += packet->len;
-	       packet->len, device_info);
+
+	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s",
+	                        packet->len, device_info);
 
 	return true;
 }
 
 static bool write_packet(vpn_packet_t *packet) {
-	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
+	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
-	       packet->len, device_info);
+	                        packet->len, device_info);
 
 	switch(device_type) {
 	case DEVICE_TYPE_TUN:
-		if(write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
+		if(write(device_fd, packet->data + 14, packet->len - 14) < 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
@@ -456,7 +455,7 @@ static bool write_packet(vpn_packet_t *packet) {
 
 	case DEVICE_TYPE_UTUN:
 	case DEVICE_TYPE_TUNIFHEAD: {
-		int af = (DATA(packet)[12] << 8) + DATA(packet)[13];
+		int af = (packet->data[12] << 8) + packet->data[13];
 		uint32_t type;
 
 		switch(af) {
@@ -469,16 +468,16 @@ static bool write_packet(vpn_packet_t *packet) {
 			break;
 
 		default:
-			logger(DEBUG_TRAFFIC, LOG_ERR,
+			ifdebug(TRAFFIC) logger(LOG_ERR,
-			       "Unknown address family %x while writing packet to %s %s",
+			                        "Unknown address family %x while writing packet to %s %s",
-			       af, device_info, device);
+			                        af, device_info, device);
 			return false;
 		}
 
-		memcpy(DATA(packet) + 10, &type, sizeof(type));
+		memcpy(packet->data + 10, &type, sizeof(type));
 
-		if(write(device_fd, DATA(packet) + 10, packet->len - 10) < 0) {
+		if(write(device_fd, packet->data + 10, packet->len - 10) < 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Can't write to %s %s: %s", device_info, device,
+			logger(LOG_ERR, "Can't write to %s %s: %s", device_info, device,
 			       strerror(errno));
 			return false;
 		}
@@ -487,8 +486,8 @@ static bool write_packet(vpn_packet_t *packet) {
 	}
 
 	case DEVICE_TYPE_TAP:
-		if(write(device_fd, DATA(packet), packet->len) < 0) {
+		if(write(device_fd, packet->data, packet->len) < 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
@@ -498,8 +497,8 @@ static bool write_packet(vpn_packet_t *packet) {
 #ifdef ENABLE_TUNEMU
 
 	case DEVICE_TYPE_TUNEMU:
-		if(tunemu_write(device_fd, DATA(packet) + 14, packet->len - 14) < 0) {
+		if(tunemu_write(device_fd, packet->data + 14, packet->len - 14) < 0) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info,
+			logger(LOG_ERR, "Error while writing to %s %s: %s", device_info,
 			       device, strerror(errno));
 			return false;
 		}
@@ -511,12 +510,21 @@ static bool write_packet(vpn_packet_t *packet) {
 		return false;
 	}
 
+	device_total_out += packet->len;
+
 	return true;
 }
 
+static void dump_device_stats(void) {
+	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
+	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
+	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
+}
+
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
+	.dump_stats = dump_device_stats,
 };

src/bsd/tunemu.c

@@ -45,9 +45,9 @@
 #define PPPIOCSFLAGS    _IOW('t', 89, int)
 #define PPPIOCSNPMODE   _IOW('t', 75, struct npioctl)
 #define PPPIOCATTCHAN   _IOW('t', 56, int)
-#define PPPIOCGCHAN     _IOR('t', 55, int)
+#define PPPIOCGCHAN             _IOR('t', 55, int)
 #define PPPIOCCONNECT   _IOW('t', 58, int)
-#define PPPIOCGUNIT     _IOR('t', 86, int)
+#define PPPIOCGUNIT             _IOR('t', 86, int)
 
 struct sockaddr_ppp {
 	u_int8_t ppp_len;
@@ -83,7 +83,7 @@ static char *data_buffer = NULL;
 static void tun_error(char *format, ...) {
 	va_list vl;
 	va_start(vl, format);
-	vsnprintf(tunemu_error, sizeof(tunemu_error), format, vl);
+	vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
 	va_end(vl);
 }
 

src/buffer.c

@@ -1,110 +0,0 @@
-/*
-    buffer.c -- buffer management
-    Copyright (C) 2011 Guus Sliepen <guus@tinc-vpn.org>,
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "system.h"
-
-#include "buffer.h"
-#include "xalloc.h"
-
-void buffer_compact(buffer_t *buffer, uint32_t maxsize) {
-	if(buffer->len >= maxsize || buffer->offset / 7 > buffer->len / 8) {
-		memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
-		buffer->len -= buffer->offset;
-		buffer->offset = 0;
-	}
-}
-
-// Make sure we can add size bytes to the buffer, and return a pointer to the start of those bytes.
-
-char *buffer_prepare(buffer_t *buffer, uint32_t size) {
-	if(!buffer->data) {
-		buffer->maxlen = size;
-		buffer->data = xmalloc(size);
-	} else {
-		if(buffer->offset && buffer->len + size > buffer->maxlen) {
-			memmove(buffer->data, buffer->data + buffer->offset, buffer->len - buffer->offset);
-			buffer->len -= buffer->offset;
-			buffer->offset = 0;
-		}
-
-		if(buffer->len + size > buffer->maxlen) {
-			buffer->maxlen = buffer->len + size;
-			buffer->data = xrealloc(buffer->data, buffer->maxlen);
-		}
-	}
-
-	char *start = buffer->data + buffer->len;
-
-	buffer->len += size;
-
-	return start;
-}
-
-// Copy data into the buffer.
-
-void buffer_add(buffer_t *buffer, const char *data, uint32_t size) {
-	memcpy(buffer_prepare(buffer, size), data, size);
-}
-
-// Remove given number of bytes from the buffer, return a pointer to the start of them.
-
-static char *buffer_consume(buffer_t *buffer, uint32_t size) {
-	char *start = buffer->data + buffer->offset;
-
-	buffer->offset += size;
-
-	if(buffer->offset >= buffer->len) {
-		buffer->offset = 0;
-		buffer->len = 0;
-	}
-
-	return start;
-}
-
-// Check if there is a complete line in the buffer, and if so, return it NULL-terminated.
-
-char *buffer_readline(buffer_t *buffer) {
-	char *newline = memchr(buffer->data + buffer->offset, '\n', buffer->len - buffer->offset);
-
-	if(!newline) {
-		return NULL;
-	}
-
-	uint32_t len = newline + 1 - (buffer->data + buffer->offset);
-	*newline = 0;
-	return buffer_consume(buffer, len);
-}
-
-// Check if we have enough bytes in the buffer, and if so, return a pointer to the start of them.
-
-char *buffer_read(buffer_t *buffer, uint32_t size) {
-	if(buffer->len - buffer->offset < size) {
-		return NULL;
-	}
-
-	return buffer_consume(buffer, size);
-}
-
-void buffer_clear(buffer_t *buffer) {
-	free(buffer->data);
-	buffer->data = NULL;
-	buffer->maxlen = 0;
-	buffer->len = 0;
-	buffer->offset = 0;
-}

src/buffer.h

@@ -1,18 +0,0 @@
-#ifndef TINC_BUFFER_H
-#define TINC_BUFFER_H
-
-typedef struct buffer_t {
-	char *data;
-	uint32_t maxlen;
-	uint32_t len;
-	uint32_t offset;
-} buffer_t;
-
-extern void buffer_compact(buffer_t *buffer, uint32_t maxsize);
-extern char *buffer_prepare(buffer_t *buffer, uint32_t size);
-extern void buffer_add(buffer_t *buffer, const char *data, uint32_t size);
-extern char *buffer_readline(buffer_t *buffer);
-extern char *buffer_read(buffer_t *buffer, uint32_t size);
-extern void buffer_clear(buffer_t *buffer);
-
-#endif

src/chacha-poly1305/chacha-poly1305.c

@@ -1,106 +0,0 @@
-#include "../system.h"
-
-#include "../cipher.h"
-#include "../xalloc.h"
-
-#include "chacha.h"
-#include "chacha-poly1305.h"
-#include "poly1305.h"
-
-struct chacha_poly1305_ctx {
-	struct chacha_ctx main_ctx, header_ctx;
-};
-
-chacha_poly1305_ctx_t *chacha_poly1305_init(void) {
-	chacha_poly1305_ctx_t *ctx = xzalloc(sizeof(*ctx));
-	return ctx;
-}
-
-void chacha_poly1305_exit(chacha_poly1305_ctx_t *ctx) {
-	free(ctx);
-}
-
-bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *vkey) {
-	const uint8_t *key = vkey;
-	chacha_keysetup(&ctx->main_ctx, key, 256);
-	chacha_keysetup(&ctx->header_ctx, key + 32, 256);
-	return true;
-}
-
-static void put_u64(void *vp, uint64_t v) {
-	uint8_t *p = (uint8_t *) vp;
-
-	p[0] = (uint8_t)(v >> 56) & 0xff;
-	p[1] = (uint8_t)(v >> 48) & 0xff;
-	p[2] = (uint8_t)(v >> 40) & 0xff;
-	p[3] = (uint8_t)(v >> 32) & 0xff;
-	p[4] = (uint8_t)(v >> 24) & 0xff;
-	p[5] = (uint8_t)(v >> 16) & 0xff;
-	p[6] = (uint8_t)(v >> 8) & 0xff;
-	p[7] = (uint8_t) v & 0xff;
-}
-
-bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *voutdata, size_t *outlen) {
-	uint8_t seqbuf[8];
-	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };      /* NB little-endian */
-	uint8_t poly_key[POLY1305_KEYLEN];
-	uint8_t *outdata = voutdata;
-
-	/*
-	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
-	 * packet sequence number.
-	 */
-	memset(poly_key, 0, sizeof(poly_key));
-	put_u64(seqbuf, seqnr);
-	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
-	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
-
-	/* Set Chacha's block counter to 1 */
-	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
-
-	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
-	poly1305_auth(outdata + inlen, outdata, inlen, poly_key);
-
-	if(outlen) {
-		*outlen = inlen + POLY1305_TAGLEN;
-	}
-
-	return true;
-}
-
-bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *vindata, size_t inlen, void *outdata, size_t *outlen) {
-	uint8_t seqbuf[8];
-	const uint8_t one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 };      /* NB little-endian */
-	uint8_t expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
-	const uint8_t *indata = vindata;
-
-	/*
-	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
-	 * packet sequence number.
-	 */
-	memset(poly_key, 0, sizeof(poly_key));
-	put_u64(seqbuf, seqnr);
-	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
-	chacha_encrypt_bytes(&ctx->main_ctx, poly_key, poly_key, sizeof(poly_key));
-
-	/* Set Chacha's block counter to 1 */
-	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
-
-	/* Check tag before anything else */
-	inlen -= POLY1305_TAGLEN;
-	const uint8_t *tag = indata + inlen;
-
-	poly1305_auth(expected_tag, indata, inlen, poly_key);
-
-	if(memcmp(expected_tag, tag, POLY1305_TAGLEN)) {
-		return false;
-	}
-
-	chacha_encrypt_bytes(&ctx->main_ctx, indata, outdata, inlen);
-
-	if(outlen) {
-		*outlen = inlen;
-	}
-
-	return true;
-}

src/chacha-poly1305/chacha-poly1305.h

@@ -1,15 +0,0 @@
-#ifndef CHACHA_POLY1305_H
-#define CHACHA_POLY1305_H
-
-#define CHACHA_POLY1305_KEYLEN 64
-
-typedef struct chacha_poly1305_ctx chacha_poly1305_ctx_t;
-
-extern chacha_poly1305_ctx_t *chacha_poly1305_init(void);
-extern void chacha_poly1305_exit(chacha_poly1305_ctx_t *);
-extern bool chacha_poly1305_set_key(chacha_poly1305_ctx_t *ctx, const void *key);
-
-extern bool chacha_poly1305_encrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
-extern bool chacha_poly1305_decrypt(chacha_poly1305_ctx_t *ctx, uint64_t seqnr, const void *indata, size_t inlen, void *outdata, size_t *outlen);
-
-#endif //CHACHA_POLY1305_H

src/chacha-poly1305/chacha.c

@@ -1,224 +0,0 @@
-/*
-chacha-merged.c version 20080118
-D. J. Bernstein
-Public domain.
-*/
-
-#include "../system.h"
-
-#include "chacha.h"
-
-typedef struct chacha_ctx chacha_ctx;
-
-#define U8C(v) (v##U)
-#define U32C(v) (v##U)
-
-#define U8V(v) ((uint8_t)(v) & U8C(0xFF))
-#define U32V(v) ((uint32_t)(v) & U32C(0xFFFFFFFF))
-
-#define ROTL32(v, n) \
-	(U32V((v) << (n)) | ((v) >> (32 - (n))))
-
-#define U8TO32_LITTLE(p) \
-	(((uint32_t)((p)[0])      ) | \
-	 ((uint32_t)((p)[1]) <<  8) | \
-	 ((uint32_t)((p)[2]) << 16) | \
-	 ((uint32_t)((p)[3]) << 24))
-
-#define U32TO8_LITTLE(p, v) \
-	do { \
-		(p)[0] = U8V((v)      ); \
-		(p)[1] = U8V((v) >>  8); \
-		(p)[2] = U8V((v) >> 16); \
-		(p)[3] = U8V((v) >> 24); \
-	} while (0)
-
-#define ROTATE(v,c) (ROTL32(v,c))
-#define XOR(v,w) ((v) ^ (w))
-#define PLUS(v,w) (U32V((v) + (w)))
-#define PLUSONE(v) (PLUS((v),1))
-
-#define QUARTERROUND(a,b,c,d) \
-	a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
-	c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
-	a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
-	c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
-
-static const char sigma[16] = "expand 32-byte k";
-static const char tau[16] = "expand 16-byte k";
-
-void chacha_keysetup(chacha_ctx *x, const uint8_t *k, uint32_t kbits) {
-	const char *constants;
-
-	x->input[4] = U8TO32_LITTLE(k + 0);
-	x->input[5] = U8TO32_LITTLE(k + 4);
-	x->input[6] = U8TO32_LITTLE(k + 8);
-	x->input[7] = U8TO32_LITTLE(k + 12);
-
-	if(kbits == 256) {      /* recommended */
-		k += 16;
-		constants = sigma;
-	} else {                /* kbits == 128 */
-		constants = tau;
-	}
-
-	x->input[8] = U8TO32_LITTLE(k + 0);
-	x->input[9] = U8TO32_LITTLE(k + 4);
-	x->input[10] = U8TO32_LITTLE(k + 8);
-	x->input[11] = U8TO32_LITTLE(k + 12);
-	x->input[0] = U8TO32_LITTLE(constants + 0);
-	x->input[1] = U8TO32_LITTLE(constants + 4);
-	x->input[2] = U8TO32_LITTLE(constants + 8);
-	x->input[3] = U8TO32_LITTLE(constants + 12);
-}
-
-void chacha_ivsetup(chacha_ctx *x, const uint8_t *iv, const uint8_t *counter) {
-	x->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 0);
-	x->input[13] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 4);
-	x->input[14] = U8TO32_LITTLE(iv + 0);
-	x->input[15] = U8TO32_LITTLE(iv + 4);
-}
-
-void
-chacha_encrypt_bytes(chacha_ctx *x, const uint8_t *m, uint8_t *c, uint32_t bytes) {
-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
-	uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
-	uint8_t *ctarget = NULL;
-	uint8_t tmp[64];
-	uint32_t i;
-
-	if(!bytes) {
-		return;
-	}
-
-	j0 = x->input[0];
-	j1 = x->input[1];
-	j2 = x->input[2];
-	j3 = x->input[3];
-	j4 = x->input[4];
-	j5 = x->input[5];
-	j6 = x->input[6];
-	j7 = x->input[7];
-	j8 = x->input[8];
-	j9 = x->input[9];
-	j10 = x->input[10];
-	j11 = x->input[11];
-	j12 = x->input[12];
-	j13 = x->input[13];
-	j14 = x->input[14];
-	j15 = x->input[15];
-
-	for(;;) {
-		if(bytes < 64) {
-			for(i = 0; i < bytes; ++i) {
-				tmp[i] = m[i];
-			}
-
-			m = tmp;
-			ctarget = c;
-			c = tmp;
-		}
-
-		x0 = j0;
-		x1 = j1;
-		x2 = j2;
-		x3 = j3;
-		x4 = j4;
-		x5 = j5;
-		x6 = j6;
-		x7 = j7;
-		x8 = j8;
-		x9 = j9;
-		x10 = j10;
-		x11 = j11;
-		x12 = j12;
-		x13 = j13;
-		x14 = j14;
-		x15 = j15;
-
-		for(i = 20; i > 0; i -= 2) {
-			QUARTERROUND(x0, x4, x8, x12)
-			QUARTERROUND(x1, x5, x9, x13)
-			QUARTERROUND(x2, x6, x10, x14)
-			QUARTERROUND(x3, x7, x11, x15)
-			QUARTERROUND(x0, x5, x10, x15)
-			QUARTERROUND(x1, x6, x11, x12)
-			QUARTERROUND(x2, x7, x8, x13)
-			QUARTERROUND(x3, x4, x9, x14)
-		}
-
-		x0 = PLUS(x0, j0);
-		x1 = PLUS(x1, j1);
-		x2 = PLUS(x2, j2);
-		x3 = PLUS(x3, j3);
-		x4 = PLUS(x4, j4);
-		x5 = PLUS(x5, j5);
-		x6 = PLUS(x6, j6);
-		x7 = PLUS(x7, j7);
-		x8 = PLUS(x8, j8);
-		x9 = PLUS(x9, j9);
-		x10 = PLUS(x10, j10);
-		x11 = PLUS(x11, j11);
-		x12 = PLUS(x12, j12);
-		x13 = PLUS(x13, j13);
-		x14 = PLUS(x14, j14);
-		x15 = PLUS(x15, j15);
-
-		x0 = XOR(x0, U8TO32_LITTLE(m + 0));
-		x1 = XOR(x1, U8TO32_LITTLE(m + 4));
-		x2 = XOR(x2, U8TO32_LITTLE(m + 8));
-		x3 = XOR(x3, U8TO32_LITTLE(m + 12));
-		x4 = XOR(x4, U8TO32_LITTLE(m + 16));
-		x5 = XOR(x5, U8TO32_LITTLE(m + 20));
-		x6 = XOR(x6, U8TO32_LITTLE(m + 24));
-		x7 = XOR(x7, U8TO32_LITTLE(m + 28));
-		x8 = XOR(x8, U8TO32_LITTLE(m + 32));
-		x9 = XOR(x9, U8TO32_LITTLE(m + 36));
-		x10 = XOR(x10, U8TO32_LITTLE(m + 40));
-		x11 = XOR(x11, U8TO32_LITTLE(m + 44));
-		x12 = XOR(x12, U8TO32_LITTLE(m + 48));
-		x13 = XOR(x13, U8TO32_LITTLE(m + 52));
-		x14 = XOR(x14, U8TO32_LITTLE(m + 56));
-		x15 = XOR(x15, U8TO32_LITTLE(m + 60));
-
-		j12 = PLUSONE(j12);
-
-		if(!j12) {
-			j13 = PLUSONE(j13);
-			/* stopping at 2^70 bytes per nonce is user's responsibility */
-		}
-
-		U32TO8_LITTLE(c + 0, x0);
-		U32TO8_LITTLE(c + 4, x1);
-		U32TO8_LITTLE(c + 8, x2);
-		U32TO8_LITTLE(c + 12, x3);
-		U32TO8_LITTLE(c + 16, x4);
-		U32TO8_LITTLE(c + 20, x5);
-		U32TO8_LITTLE(c + 24, x6);
-		U32TO8_LITTLE(c + 28, x7);
-		U32TO8_LITTLE(c + 32, x8);
-		U32TO8_LITTLE(c + 36, x9);
-		U32TO8_LITTLE(c + 40, x10);
-		U32TO8_LITTLE(c + 44, x11);
-		U32TO8_LITTLE(c + 48, x12);
-		U32TO8_LITTLE(c + 52, x13);
-		U32TO8_LITTLE(c + 56, x14);
-		U32TO8_LITTLE(c + 60, x15);
-
-		if(bytes <= 64) {
-			if(bytes < 64) {
-				for(i = 0; i < bytes; ++i) {
-					ctarget[i] = c[i];
-				}
-			}
-
-			x->input[12] = j12;
-			x->input[13] = j13;
-			return;
-		}
-
-		bytes -= 64;
-		c += 64;
-		m += 64;
-	}
-}

src/chacha-poly1305/chacha.h

@@ -1,24 +0,0 @@
-/*
-chacha-merged.c version 20080118
-D. J. Bernstein
-Public domain.
-*/
-
-#ifndef CHACHA_H
-#define CHACHA_H
-
-struct chacha_ctx {
-	uint32_t input[16];
-};
-
-#define CHACHA_MINKEYLEN        16
-#define CHACHA_NONCELEN         8
-#define CHACHA_CTRLEN           8
-#define CHACHA_STATELEN         (CHACHA_NONCELEN+CHACHA_CTRLEN)
-#define CHACHA_BLOCKLEN         64
-
-void chacha_keysetup(struct chacha_ctx *x, const uint8_t *k, uint32_t kbits);
-void chacha_ivsetup(struct chacha_ctx *x, const uint8_t *iv, const uint8_t *ctr);
-void chacha_encrypt_bytes(struct chacha_ctx *x, const uint8_t *m, uint8_t *c, uint32_t bytes);
-
-#endif /* CHACHA_H */

src/chacha-poly1305/poly1305.c

@@ -1,205 +0,0 @@
-/*
- * Public Domain poly1305 from Andrew Moon
- * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
- */
-
-#include "../system.h"
-
-#include "poly1305.h"
-
-#define mul32x32_64(a,b) ((uint64_t)(a) * (b))
-
-#define U8TO32_LE(p) \
-	(((uint32_t)((p)[0])) | \
-	 ((uint32_t)((p)[1]) <<  8) | \
-	 ((uint32_t)((p)[2]) << 16) | \
-	 ((uint32_t)((p)[3]) << 24))
-
-#define U32TO8_LE(p, v) \
-	do { \
-		(p)[0] = (uint8_t)((v)); \
-		(p)[1] = (uint8_t)((v) >>  8); \
-		(p)[2] = (uint8_t)((v) >> 16); \
-		(p)[3] = (uint8_t)((v) >> 24); \
-	} while (0)
-
-void
-poly1305_auth(unsigned char out[POLY1305_TAGLEN], const unsigned char *m, size_t inlen, const unsigned char key[POLY1305_KEYLEN]) {
-	uint32_t t0, t1, t2, t3;
-	uint32_t h0, h1, h2, h3, h4;
-	uint32_t r0, r1, r2, r3, r4;
-	uint32_t s1, s2, s3, s4;
-	uint32_t b, nb;
-	size_t j;
-	uint64_t t[5];
-	uint64_t f0, f1, f2, f3;
-	uint32_t g0, g1, g2, g3, g4;
-	uint64_t c;
-	unsigned char mp[16];
-
-	/* clamp key */
-	t0 = U8TO32_LE(key + 0);
-	t1 = U8TO32_LE(key + 4);
-	t2 = U8TO32_LE(key + 8);
-	t3 = U8TO32_LE(key + 12);
-
-	/* precompute multipliers */
-	r0 = t0 & 0x3ffffff;
-	t0 >>= 26;
-	t0 |= t1 << 6;
-	r1 = t0 & 0x3ffff03;
-	t1 >>= 20;
-	t1 |= t2 << 12;
-	r2 = t1 & 0x3ffc0ff;
-	t2 >>= 14;
-	t2 |= t3 << 18;
-	r3 = t2 & 0x3f03fff;
-	t3 >>= 8;
-	r4 = t3 & 0x00fffff;
-
-	s1 = r1 * 5;
-	s2 = r2 * 5;
-	s3 = r3 * 5;
-	s4 = r4 * 5;
-
-	/* init state */
-	h0 = 0;
-	h1 = 0;
-	h2 = 0;
-	h3 = 0;
-	h4 = 0;
-
-	/* full blocks */
-	if(inlen < 16) {
-		goto poly1305_donna_atmost15bytes;
-	}
-
-poly1305_donna_16bytes:
-	m += 16;
-	inlen -= 16;
-
-	t0 = U8TO32_LE(m - 16);
-	t1 = U8TO32_LE(m - 12);
-	t2 = U8TO32_LE(m - 8);
-	t3 = U8TO32_LE(m - 4);
-
-	h0 += t0 & 0x3ffffff;
-	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
-	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
-	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
-	h4 += (t3 >> 8) | (1 << 24);
-
-poly1305_donna_mul:
-	t[0] = mul32x32_64(h0, r0) + mul32x32_64(h1, s4) + mul32x32_64(h2, s3) + mul32x32_64(h3, s2) + mul32x32_64(h4, s1);
-	t[1] = mul32x32_64(h0, r1) + mul32x32_64(h1, r0) + mul32x32_64(h2, s4) + mul32x32_64(h3, s3) + mul32x32_64(h4, s2);
-	t[2] = mul32x32_64(h0, r2) + mul32x32_64(h1, r1) + mul32x32_64(h2, r0) + mul32x32_64(h3, s4) + mul32x32_64(h4, s3);
-	t[3] = mul32x32_64(h0, r3) + mul32x32_64(h1, r2) + mul32x32_64(h2, r1) + mul32x32_64(h3, r0) + mul32x32_64(h4, s4);
-	t[4] = mul32x32_64(h0, r4) + mul32x32_64(h1, r3) + mul32x32_64(h2, r2) + mul32x32_64(h3, r1) + mul32x32_64(h4, r0);
-
-	h0 = (uint32_t) t[0] & 0x3ffffff;
-	c = (t[0] >> 26);
-	t[1] += c;
-	h1 = (uint32_t) t[1] & 0x3ffffff;
-	b = (uint32_t)(t[1] >> 26);
-	t[2] += b;
-	h2 = (uint32_t) t[2] & 0x3ffffff;
-	b = (uint32_t)(t[2] >> 26);
-	t[3] += b;
-	h3 = (uint32_t) t[3] & 0x3ffffff;
-	b = (uint32_t)(t[3] >> 26);
-	t[4] += b;
-	h4 = (uint32_t) t[4] & 0x3ffffff;
-	b = (uint32_t)(t[4] >> 26);
-	h0 += b * 5;
-
-	if(inlen >= 16) {
-		goto poly1305_donna_16bytes;
-	}
-
-	/* final bytes */
-poly1305_donna_atmost15bytes:
-
-	if(!inlen) {
-		goto poly1305_donna_finish;
-	}
-
-	for(j = 0; j < inlen; j++) {
-		mp[j] = m[j];
-	}
-
-	mp[j++] = 1;
-
-	for(; j < 16; j++) {
-		mp[j] = 0;
-	}
-
-	inlen = 0;
-
-	t0 = U8TO32_LE(mp + 0);
-	t1 = U8TO32_LE(mp + 4);
-	t2 = U8TO32_LE(mp + 8);
-	t3 = U8TO32_LE(mp + 12);
-
-	h0 += t0 & 0x3ffffff;
-	h1 += ((((uint64_t) t1 << 32) | t0) >> 26) & 0x3ffffff;
-	h2 += ((((uint64_t) t2 << 32) | t1) >> 20) & 0x3ffffff;
-	h3 += ((((uint64_t) t3 << 32) | t2) >> 14) & 0x3ffffff;
-	h4 += (t3 >> 8);
-
-	goto poly1305_donna_mul;
-
-poly1305_donna_finish:
-	b = h0 >> 26;
-	h0 = h0 & 0x3ffffff;
-	h1 += b;
-	b = h1 >> 26;
-	h1 = h1 & 0x3ffffff;
-	h2 += b;
-	b = h2 >> 26;
-	h2 = h2 & 0x3ffffff;
-	h3 += b;
-	b = h3 >> 26;
-	h3 = h3 & 0x3ffffff;
-	h4 += b;
-	b = h4 >> 26;
-	h4 = h4 & 0x3ffffff;
-	h0 += b * 5;
-	b = h0 >> 26;
-	h0 = h0 & 0x3ffffff;
-	h1 += b;
-
-	g0 = h0 + 5;
-	b = g0 >> 26;
-	g0 &= 0x3ffffff;
-	g1 = h1 + b;
-	b = g1 >> 26;
-	g1 &= 0x3ffffff;
-	g2 = h2 + b;
-	b = g2 >> 26;
-	g2 &= 0x3ffffff;
-	g3 = h3 + b;
-	b = g3 >> 26;
-	g3 &= 0x3ffffff;
-	g4 = h4 + b - (1 << 26);
-
-	b = (g4 >> 31) - 1;
-	nb = ~b;
-	h0 = (h0 & nb) | (g0 & b);
-	h1 = (h1 & nb) | (g1 & b);
-	h2 = (h2 & nb) | (g2 & b);
-	h3 = (h3 & nb) | (g3 & b);
-	h4 = (h4 & nb) | (g4 & b);
-
-	f0 = ((h0) | (h1 << 26)) + (uint64_t) U8TO32_LE(&key[16]);
-	f1 = ((h1 >> 6) | (h2 << 20)) + (uint64_t) U8TO32_LE(&key[20]);
-	f2 = ((h2 >> 12) | (h3 << 14)) + (uint64_t) U8TO32_LE(&key[24]);
-	f3 = ((h3 >> 18) | (h4 << 8)) + (uint64_t) U8TO32_LE(&key[28]);
-
-	U32TO8_LE(&out[0], f0);
-	f1 += (f0 >> 32);
-	U32TO8_LE(&out[4], f1);
-	f2 += (f1 >> 32);
-	U32TO8_LE(&out[8], f2);
-	f3 += (f2 >> 32);
-	U32TO8_LE(&out[12], f3);
-}

src/chacha-poly1305/poly1305.h

@@ -1,16 +0,0 @@
-/* $OpenBSD: poly1305.h,v 1.2 2013/12/19 22:57:13 djm Exp $ */
-
-/*
- * Public Domain poly1305 from Andrew Moon
- * poly1305-donna-unrolled.c from https://github.com/floodyberry/poly1305-donna
- */
-
-#ifndef POLY1305_H
-#define POLY1305_H
-
-#define POLY1305_KEYLEN         32
-#define POLY1305_TAGLEN         16
-
-void poly1305_auth(uint8_t out[POLY1305_TAGLEN], const uint8_t *m, size_t inlen, const uint8_t key[POLY1305_KEYLEN]);
-
-#endif                          /* POLY1305_H */

src/cipher.h

@@ -1,46 +0,0 @@
-#ifndef TINC_CIPHER_H
-#define TINC_CIPHER_H
-
-/*
-    cipher.h -- header file cipher.c
-    Copyright (C) 2007-2016 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#define CIPHER_MAX_BLOCK_SIZE 32
-#define CIPHER_MAX_IV_SIZE 16
-#define CIPHER_MAX_KEY_SIZE 32
-
-#ifndef DISABLE_LEGACY
-
-typedef struct cipher cipher_t;
-
-extern cipher_t *cipher_open_by_name(const char *name) __attribute__((__malloc__));
-extern cipher_t *cipher_open_by_nid(int nid) __attribute__((__malloc__));
-extern void cipher_close(cipher_t *cipher);
-extern size_t cipher_keylength(const cipher_t *cipher);
-extern size_t cipher_blocksize(const cipher_t *cipher);
-extern uint64_t cipher_budget(const cipher_t *cipher);
-extern bool cipher_set_key(cipher_t *cipher, void *key, bool encrypt) __attribute__((__warn_unused_result__));
-extern bool cipher_set_key_from_rsa(cipher_t *cipher, void *rsa, size_t len, bool encrypt) __attribute__((__warn_unused_result__));
-extern bool cipher_encrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__((__warn_unused_result__));
-extern bool cipher_decrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) __attribute__((__warn_unused_result__));
-extern int cipher_get_nid(const cipher_t *cipher);
-extern bool cipher_active(const cipher_t *cipher);
-
-#endif
-
-#endif

src/conf.c

@@ -1,11 +1,10 @@
 /*
     conf.c -- configuration code
-    Copyright (C) 1998      Robert van der Meulen
+    Copyright (C) 1998 Robert van der Meulen
                   1998-2005 Ivo Timmermans
-                  2000      Cris van Pelt
+                  2000-2014 Guus Sliepen <guus@tinc-vpn.org>
                   2010-2011 Julien Muchembled <jm@jmuchemb.eu>
-                  2000-2015 Guus Sliepen <guus@tinc-vpn.org>
+                  2000 Cris van Pelt
-                  2013      Florent Clairambault <florent@clairambault.fr>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -24,23 +23,25 @@
 
 #include "system.h"
 
-#include "splay_tree.h"
+#include "avl_tree.h"
 #include "connection.h"
 #include "conf.h"
 #include "list.h"
 #include "logger.h"
-#include "names.h"
+#include "netutl.h"                             /* for str2address */
-#include "netutl.h"             /* for str2address */
 #include "protocol.h"
-#include "utils.h"              /* for cp */
+#include "utils.h"                              /* for cp */
 #include "xalloc.h"
 
-splay_tree_t *config_tree;
+avl_tree_t *config_tree;
 
-int pinginterval = 0;           /* seconds between pings */
+int pinginterval = 0;                   /* seconds between pings */
-int pingtimeout = 0;            /* seconds to wait for response */
+int pingtimeout = 0;                    /* seconds to wait for response */
+char *confbase = NULL;                  /* directory in which all config files are */
+char *netname = NULL;                   /* name of the vpn network */
 list_t *cmdline_conf = NULL;    /* global/host configuration values given at the command line */
 
+
 static int config_compare(const config_t *a, const config_t *b) {
 	int result;
 
@@ -66,17 +67,17 @@ static int config_compare(const config_t *a, const config_t *b) {
 	}
 }
 
-void init_configuration(splay_tree_t **config_tree) {
+void init_configuration(avl_tree_t **config_tree) {
-	*config_tree = splay_alloc_tree((splay_compare_t) config_compare, (splay_action_t) free_config);
+	*config_tree = avl_alloc_tree((avl_compare_t) config_compare, (avl_action_t) free_config);
 }
 
-void exit_configuration(splay_tree_t **config_tree) {
+void exit_configuration(avl_tree_t **config_tree) {
-	splay_delete_tree(*config_tree);
+	avl_delete_tree(*config_tree);
 	*config_tree = NULL;
 }
 
 config_t *new_config(void) {
-	return xzalloc(sizeof(config_t));
+	return xmalloc_and_zero(sizeof(config_t));
 }
 
 void free_config(config_t *cfg) {
@@ -86,18 +87,18 @@ void free_config(config_t *cfg) {
 	free(cfg);
 }
 
-void config_add(splay_tree_t *config_tree, config_t *cfg) {
+void config_add(avl_tree_t *config_tree, config_t *cfg) {
-	splay_insert(config_tree, cfg);
+	avl_insert(config_tree, cfg);
 }
 
-config_t *lookup_config(splay_tree_t *config_tree, char *variable) {
+config_t *lookup_config(const avl_tree_t *config_tree, char *variable) {
 	config_t cfg, *found;
 
 	cfg.variable = variable;
 	cfg.file = NULL;
 	cfg.line = 0;
 
-	found = splay_search_closest_greater(config_tree, &cfg);
+	found = avl_search_closest_greater(config_tree, &cfg);
 
 	if(!found) {
 		return NULL;
@@ -110,11 +111,11 @@ config_t *lookup_config(splay_tree_t *config_tree, char *variable) {
 	return found;
 }
 
-config_t *lookup_config_next(splay_tree_t *config_tree, const config_t *cfg) {
+config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg) {
-	splay_node_t *node;
+	avl_node_t *node;
 	config_t *found;
 
-	node = splay_search_node(config_tree, cfg);
+	node = avl_search_node(config_tree, cfg);
 
 	if(node) {
 		if(node->next) {
@@ -142,7 +143,7 @@ bool get_config_bool(const config_t *cfg, bool *result) {
 		return true;
 	}
 
-	logger(DEBUG_ALWAYS, LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
+	logger(LOG_ERR, "\"yes\" or \"no\" expected for configuration variable %s in %s line %d",
 	       cfg->variable, cfg->file, cfg->line);
 
 	return false;
@@ -157,7 +158,7 @@ bool get_config_int(const config_t *cfg, int *result) {
 		return true;
 	}
 
-	logger(DEBUG_ALWAYS, LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
+	logger(LOG_ERR, "Integer expected for configuration variable %s in %s line %d",
 	       cfg->variable, cfg->file, cfg->line);
 
 	return false;
@@ -187,7 +188,7 @@ bool get_config_address(const config_t *cfg, struct addrinfo **result) {
 		return true;
 	}
 
-	logger(DEBUG_ALWAYS, LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
+	logger(LOG_ERR, "Hostname or IP address expected for configuration variable %s in %s line %d",
 	       cfg->variable, cfg->file, cfg->line);
 
 	return false;
@@ -201,7 +202,7 @@ bool get_config_subnet(const config_t *cfg, subnet_t **result) {
 	}
 
 	if(!str2net(&subnet, cfg->value)) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
+		logger(LOG_ERR, "Subnet expected for configuration variable %s in %s line %d",
 		       cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
@@ -209,10 +210,10 @@ bool get_config_subnet(const config_t *cfg, subnet_t **result) {
 	/* Teach newbies what subnets are... */
 
 	if(((subnet.type == SUBNET_IPV4)
-	                && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(subnet.net.ipv4.address)))
+	                && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(ipv4_t)))
 	                || ((subnet.type == SUBNET_IPV6)
-	                    && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(subnet.net.ipv6.address)))) {
+	                    && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(ipv6_t)))) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
+		logger(LOG_ERR, "Network address and prefix length do not match for configuration variable %s in %s line %d",
 		       cfg->variable, cfg->file, cfg->line);
 		return false;
 	}
@@ -245,10 +246,9 @@ static char *readline(FILE *fp, char *buf, size_t buflen) {
 		return buf;
 	}
 
-	/* kill newline and carriage return if necessary */
+	*newline = '\0';        /* kill newline */
-	*newline = '\0';
 
-	if(newline > p && newline[-1] == '\r') {
+	if(newline > p && newline[-1] == '\r') { /* and carriage return if necessary */
 		newline[-1] = '\0';
 	}
 
@@ -282,10 +282,10 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
 		const char err[] = "No value for variable";
 
 		if(fname)
-			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' on line %d while reading config file %s",
+			logger(LOG_ERR, "%s `%s' on line %d while reading config file %s",
 			       err, variable, lineno, fname);
 		else
-			logger(DEBUG_ALWAYS, LOG_ERR, "%s `%s' in command line option %d",
+			logger(LOG_ERR, "%s `%s' in command line option %d",
 			       err, variable, lineno);
 
 		return NULL;
@@ -304,7 +304,7 @@ config_t *parse_config_line(char *line, const char *fname, int lineno) {
   Parse a configuration file and put the results in the configuration tree
   starting at *base.
 */
-bool read_config_file(splay_tree_t *config_tree, const char *fname, bool verbose) {
+bool read_config_file(avl_tree_t *config_tree, const char *fname) {
 	FILE *fp;
 	char buffer[MAX_STRING_SIZE];
 	char *line;
@@ -316,7 +316,7 @@ bool read_config_file(splay_tree_t *config_tree, const char *fname, bool verbose
 	fp = fopen(fname, "r");
 
 	if(!fp) {
-		logger(verbose ? DEBUG_ALWAYS : DEBUG_CONNECTIONS, LOG_ERR, "Cannot open config file %s: %s", fname, strerror(errno));
+		logger(LOG_ERR, "Cannot open config file %s: %s", fname, strerror(errno));
 		return false;
 	}
 
@@ -364,12 +364,11 @@ bool read_config_file(splay_tree_t *config_tree, const char *fname, bool verbose
 	return result;
 }
 
-void read_config_options(splay_tree_t *config_tree, const char *prefix) {
+void read_config_options(avl_tree_t *config_tree, const char *prefix) {
 	size_t prefix_len = prefix ? strlen(prefix) : 0;
 
 	for(const list_node_t *node = cmdline_conf->tail; node; node = node->prev) {
 		const config_t *cfg = node->data;
-		config_t *new;
 
 		if(!prefix) {
 			if(strchr(cfg->variable, '.')) {
@@ -382,7 +381,7 @@ void read_config_options(splay_tree_t *config_tree, const char *prefix) {
 			}
 		}
 
-		new = new_config();
+		config_t *new = new_config();
 
 		if(prefix) {
 			new->variable = xstrdup(cfg->variable + prefix_len + 1);
@@ -404,14 +403,14 @@ bool read_server_config(void) {
 
 	read_config_options(config_tree, NULL);
 
-	snprintf(fname, sizeof(fname), "%s" SLASH "tinc.conf", confbase);
+	snprintf(fname, sizeof(fname), "%s/tinc.conf", confbase);
 	errno = 0;
-	x = read_config_file(config_tree, fname, true);
+	x = read_config_file(config_tree, fname);
 
 	// We will try to read the conf files in the "conf.d" dir
 	if(x) {
 		char dname[PATH_MAX];
-		snprintf(dname, sizeof(dname), "%s" SLASH "conf.d", confbase);
+		snprintf(dname, sizeof(dname), "%s/conf.d", confbase);
 		DIR *dir = opendir(dname);
 
 		// If we can find this dir
@@ -424,12 +423,12 @@ bool read_server_config(void) {
 
 				// And we try to read the ones that end with ".conf"
 				if(l > 5 && !strcmp(".conf", & ep->d_name[ l - 5 ])) {
-					if((size_t)snprintf(fname, sizeof(fname), "%s" SLASH "%s", dname, ep->d_name) >= sizeof(fname)) {
+					if((size_t)snprintf(fname, sizeof(fname), "%s/%s", dname, ep->d_name) >= sizeof(fname)) {
-						logger(DEBUG_ALWAYS, LOG_ERR, "Pathname too long: %s/%s", dname, ep->d_name);
+						logger(LOG_ERR, "Pathname too long: %s/%s", dname, ep->d_name);
 						return false;
 					}
 
-					x = read_config_file(config_tree, fname, true);
+					x = read_config_file(config_tree, fname);
 				}
 			}
 
@@ -438,32 +437,166 @@ bool read_server_config(void) {
 	}
 
 	if(!x && errno) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
+		logger(LOG_ERR, "Failed to read `%s': %s", fname, strerror(errno));
 	}
 
 	return x;
 }
 
-bool read_host_config(splay_tree_t *config_tree, const char *name, bool verbose) {
+bool read_connection_config(connection_t *c) {
-	read_config_options(config_tree, name);
-
 	char fname[PATH_MAX];
-	snprintf(fname, sizeof(fname), "%s" SLASH "hosts" SLASH "%s", confbase, name);
+	bool x;
-	return read_config_file(config_tree, fname, verbose);
+
+	read_config_options(c->config_tree, c->name);
+
+	snprintf(fname, sizeof(fname), "%s/hosts/%s", confbase, c->name);
+	x = read_config_file(c->config_tree, fname);
+
+	return x;
 }
 
-bool append_config_file(const char *name, const char *key, const char *value) {
+static void disable_old_keys(const char *filename) {
-	char fname[PATH_MAX];
+	char tmpfile[PATH_MAX] = "";
-	snprintf(fname, sizeof(fname), "%s" SLASH "hosts" SLASH "%s", confbase, name);
+	char buf[1024];
+	bool disabled = false;
+	FILE *r, *w;
 
-	FILE *fp = fopen(fname, "a");
+	r = fopen(filename, "r");
 
-	if(!fp) {
+	if(!r) {
-		logger(DEBUG_ALWAYS, LOG_DEBUG, "Cannot open config file %s: %s", fname, strerror(errno));
+		return;
-		return false;
 	}
 
-	fprintf(fp, "\n# The following line was automatically added by tinc\n%s = %s\n", key, value);
+	int len = snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
-	fclose(fp);
+
-	return true;
+	if(len < 0 || len >= PATH_MAX) {
+		fprintf(stderr, "Pathname too long: %s.tmp\n", filename);
+		w = NULL;
+	} else {
+		w = fopen(tmpfile, "w");
+	}
+
+	while(fgets(buf, sizeof(buf), r)) {
+		if(!strncmp(buf, "-----BEGIN RSA", 14)) {
+			buf[11] = 'O';
+			buf[12] = 'L';
+			buf[13] = 'D';
+			disabled = true;
+		} else if(!strncmp(buf, "-----END RSA", 12)) {
+			buf[ 9] = 'O';
+			buf[10] = 'L';
+			buf[11] = 'D';
+			disabled = true;
+		}
+
+		if(w && fputs(buf, w) < 0) {
+			disabled = false;
+			break;
+		}
+	}
+
+	if(w) {
+		fclose(w);
+	}
+
+	fclose(r);
+
+	if(!w && disabled) {
+		fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
+		return;
+	}
+
+	if(disabled) {
+#ifdef HAVE_MINGW
+		// We cannot atomically replace files on Windows.
+		char bakfile[PATH_MAX] = "";
+		snprintf(bakfile, sizeof(bakfile), "%s.bak", filename);
+
+		if(rename(filename, bakfile) || rename(tmpfile, filename)) {
+			rename(bakfile, filename);
+#else
+
+		if(rename(tmpfile, filename)) {
+#endif
+			fprintf(stderr, "Warning: old key(s) found, remove them by hand!\n");
+		} else  {
+#ifdef HAVE_MINGW
+			unlink(bakfile);
+#endif
+			fprintf(stderr, "Warning: old key(s) found and disabled.\n");
+		}
+	}
+
+	unlink(tmpfile);
 }
+
+FILE *ask_and_open(const char *filename, const char *what) {
+	FILE *r;
+	char directory[PATH_MAX];
+	char line[PATH_MAX];
+	char abspath[PATH_MAX];
+	const char *fn;
+
+	/* Check stdin and stdout */
+	if(!isatty(0) || !isatty(1)) {
+		/* Argh, they are running us from a script or something.  Write
+		   the files to the current directory and let them burn in hell
+		   for ever. */
+		fn = filename;
+	} else {
+		/* Ask for a file and/or directory name. */
+		fprintf(stdout, "Please enter a file to save %s to [%s]: ",
+		        what, filename);
+		fflush(stdout);
+
+		fn = readline(stdin, line, sizeof(line));
+
+		if(!fn) {
+			fprintf(stderr, "Error while reading stdin: %s\n",
+			        strerror(errno));
+			return NULL;
+		}
+
+		if(!strlen(fn))
+			/* User just pressed enter. */
+		{
+			fn = filename;
+		}
+	}
+
+#ifdef HAVE_MINGW
+
+	if(fn[0] != '\\' && fn[0] != '/' && !strchr(fn, ':')) {
+#else
+
+	if(fn[0] != '/') {
+#endif
+		/* The directory is a relative path or a filename. */
+		getcwd(directory, sizeof(directory));
+
+		if((size_t)snprintf(abspath, sizeof(abspath), "%s/%s", directory, fn) >= sizeof(abspath)) {
+			fprintf(stderr, "Pathname too long: %s/%s\n", directory, fn);
+			return NULL;
+		}
+
+		fn = abspath;
+	}
+
+	umask(0077);                            /* Disallow everything for group and other */
+
+	disable_old_keys(fn);
+
+	/* Open it first to keep the inode busy */
+
+	r = fopen(fn, "a");
+
+	if(!r) {
+		fprintf(stderr, "Error opening file `%s': %s\n",
+		        fn, strerror(errno));
+		return NULL;
+	}
+
+	return r;
+}
+
+

src/conf.h

@@ -4,7 +4,7 @@
 /*
     conf.h -- header for conf.c
     Copyright (C) 1998-2005 Ivo Timmermans
-                  2000-2013 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2012 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -21,9 +21,8 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
+#include "avl_tree.h"
 #include "list.h"
-#include "splay_tree.h"
-#include "subnet.h"
 
 typedef struct config_t {
 	char *variable;
@@ -32,33 +31,37 @@ typedef struct config_t {
 	int line;
 } config_t;
 
+#include "subnet.h"
 
-extern splay_tree_t *config_tree;
+extern avl_tree_t *config_tree;
 
 extern int pinginterval;
 extern int pingtimeout;
 extern int maxtimeout;
+extern int mintimeout;
 extern bool bypass_security;
+extern char *confbase;
+extern char *netname;
 extern list_t *cmdline_conf;
 
-extern void init_configuration(splay_tree_t **config_tree);
+extern void init_configuration(avl_tree_t **config_tree);
-extern void exit_configuration(splay_tree_t **config_tree);
+extern void exit_configuration(avl_tree_t **config_tree);
 extern config_t *new_config(void) __attribute__((__malloc__));
-extern void free_config(config_t *config);
+extern void free_config(config_t *cfg);
-extern void config_add(splay_tree_t *config_tree, config_t *config);
+extern void config_add(avl_tree_t *config_tree, config_t *cfg);
-extern config_t *lookup_config(splay_tree_t *config_tree, char *variable);
+extern config_t *lookup_config(const avl_tree_t *config_tree, char *variable);
-extern config_t *lookup_config_next(splay_tree_t *config_tree, const config_t *config);
+extern config_t *lookup_config_next(const avl_tree_t *config_tree, const config_t *cfg);
-extern bool get_config_bool(const config_t *config, bool *result);
+extern bool get_config_bool(const config_t *cfg, bool *result);
-extern bool get_config_int(const config_t *config, int *result);
+extern bool get_config_int(const config_t *cfg, int *result);
-extern bool get_config_string(const config_t *config, char **result);
+extern bool get_config_string(const config_t *cfg, char **result);
-extern bool get_config_address(const config_t *config, struct addrinfo **result);
+extern bool get_config_address(const config_t *cfg, struct addrinfo **result);
-extern bool get_config_subnet(const config_t *config, struct subnet_t **result);
+extern bool get_config_subnet(const config_t *cfg, struct subnet_t **result);
 
 extern config_t *parse_config_line(char *line, const char *fname, int lineno);
-extern bool read_config_file(splay_tree_t *config_tree, const char *filename, bool verbose);
+extern bool read_config_file(avl_tree_t *config_tree, const char *fname);
-extern void read_config_options(splay_tree_t *config_tree, const char *prefix);
+extern void read_config_options(avl_tree_t *config_tree, const char *prefix);
 extern bool read_server_config(void);
-extern bool read_host_config(splay_tree_t *config_tree, const char *name, bool verbose);
+extern bool read_connection_config(struct connection_t *c);
-extern bool append_config_file(const char *name, const char *key, const char *value);
+extern FILE *ask_and_open(const char *fname, const char *what);
 
 #endif

src/connection.c

@@ -1,6 +1,6 @@
 /*
     connection.c -- connection list management
-    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
                   2008      Max Rijevski <maksuf@gmail.com>
 
@@ -21,68 +21,100 @@
 
 #include "system.h"
 
-#include "list.h"
+#include "avl_tree.h"
-#include "cipher.h"
 #include "conf.h"
-#include "control_common.h"
-#include "list.h"
 #include "logger.h"
-#include "net.h"
-#include "rsa.h"
 #include "subnet.h"
 #include "utils.h"
 #include "xalloc.h"
 
-list_t *connection_list;
+avl_tree_t *connection_tree;    /* Meta connections */
 connection_t *everyone;
 
+static int connection_compare(const connection_t *a, const connection_t *b) {
+	return a < b ? -1 : a == b ? 0 : 1;
+}
+
 void init_connections(void) {
-	connection_list = list_alloc((list_action_t) free_connection);
+	connection_tree = avl_alloc_tree((avl_compare_t) connection_compare, (avl_action_t) free_connection);
 	everyone = new_connection();
 	everyone->name = xstrdup("everyone");
 	everyone->hostname = xstrdup("BROADCAST");
 }
 
 void exit_connections(void) {
-	list_delete_list(connection_list);
+	avl_delete_tree(connection_tree);
 	free_connection(everyone);
 }
 
 connection_t *new_connection(void) {
-	return xzalloc(sizeof(connection_t));
+	connection_t *c;
+
+	c = xmalloc_and_zero(sizeof(connection_t));
+
+	if(!c) {
+		return NULL;
+	}
+
+	gettimeofday(&c->start, NULL);
+
+	return c;
+}
+
+void free_connection_partially(connection_t *c) {
+	free(c->inkey);
+	free(c->outkey);
+	free(c->mychallenge);
+	free(c->hischallenge);
+	free(c->outbuf);
+
+	c->inkey = NULL;
+	c->outkey = NULL;
+	c->mychallenge = NULL;
+	c->hischallenge = NULL;
+	c->outbuf = NULL;
+
+	c->status.pinged = false;
+	c->status.active = false;
+	c->status.connecting = false;
+	c->status.timeout = false;
+	c->status.encryptout = false;
+	c->status.decryptin = false;
+	c->status.mst = false;
+
+	c->options = 0;
+	c->buflen = 0;
+	c->reqlen = 0;
+	c->tcplen = 0;
+	c->allow_request = 0;
+	c->outbuflen = 0;
+	c->outbufsize = 0;
+	c->outbufstart = 0;
+	c->last_ping_time = 0;
+	c->last_flushed_time = 0;
+	c->inbudget = 0;
+	c->outbudget = 0;
+
+	if(c->inctx) {
+		EVP_CIPHER_CTX_reset(c->inctx);
+		free(c->inctx);
+		c->inctx = NULL;
+	}
+
+	if(c->outctx) {
+		EVP_CIPHER_CTX_reset(c->outctx);
+		free(c->outctx);
+		c->outctx = NULL;
+	}
+
+	if(c->rsa_key) {
+		RSA_free(c->rsa_key);
+		c->rsa_key = NULL;
+	}
 }
 
 void free_connection(connection_t *c) {
-	if(!c) {
+	free_connection_partially(c);
-		return;
-	}
-
-#ifndef DISABLE_LEGACY
-	cipher_close(c->incipher);
-	digest_close(c->indigest);
-	cipher_close(c->outcipher);
-	digest_close(c->outdigest);
-	rsa_free(c->rsa);
-#endif
-
-	sptps_stop(&c->sptps);
-	ecdsa_free(c->ecdsa);
-
-	free(c->hischallenge);
-	free(c->mychallenge);
-
-	buffer_clear(&c->inbuf);
-	buffer_clear(&c->outbuf);
-
-	io_del(&c->io);
-
-	if(c->socket > 0) {
-		if(c->status.tarpit) {
-			tarpit(c->socket);
-		} else {
-			closesocket(c->socket);
-		}
-	}
 
 	free(c->name);
 	free(c->hostname);
@@ -95,20 +127,25 @@ void free_connection(connection_t *c) {
 }
 
 void connection_add(connection_t *c) {
-	list_insert_tail(connection_list, c);
+	avl_insert(connection_tree, c);
 }
 
 void connection_del(connection_t *c) {
-	list_delete(connection_list, c);
+	avl_delete(connection_tree, c);
 }
 
-bool dump_connections(connection_t *cdump) {
+void dump_connections(void) {
-	for list_each(connection_t, c, connection_list) {
+	avl_node_t *node;
-		send_request(cdump, "%d %d %s %s %x %d %x",
+	connection_t *c;
-		             CONTROL, REQ_DUMP_CONNECTIONS,
+
-		             c->name, c->hostname, c->options, c->socket,
+	logger(LOG_DEBUG, "Connections:");
-		             bitfield_to_int(&c->status, sizeof(c->status)));
+
+	for(node = connection_tree->head; node; node = node->next) {
+		c = node->data;
+		logger(LOG_DEBUG, " %s at %s options %x socket %d status %04x outbuf %d/%d/%d",
+		       c->name, c->hostname, c->options, c->socket, bitfield_to_int(&c->status, sizeof(c->status)),
+		       c->outbufsize, c->outbufstart, c->outbuflen);
 	}
 
-	return send_request(cdump, "%d %d", CONTROL, REQ_DUMP_CONNECTIONS);
+	logger(LOG_DEBUG, "End of connections.");
 }

src/connection.h

@@ -3,7 +3,7 @@
 
 /*
     connection.h -- header for connection.c
-    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2016 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
 
     This program is free software; you can redistribute it and/or modify
@@ -21,50 +21,45 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
-#include "buffer.h"
+#include <openssl/rsa.h>
-#include "cipher.h"
+#include <openssl/evp.h>
-#include "digest.h"
+
-#include "rsa.h"
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#include "list.h"
+#define EVP_CIPHER_CTX_reset(c) EVP_CIPHER_CTX_cleanup(c)
-#include "sptps.h"
+#endif
+
+#include "avl_tree.h"
 
 #define OPTION_INDIRECT         0x0001
 #define OPTION_TCPONLY          0x0002
 #define OPTION_PMTU_DISCOVERY   0x0004
 #define OPTION_CLAMP_MSS        0x0008
-#define OPTION_VERSION(x) ((x) >> 24) /* Top 8 bits are for protocol minor version */
 
 typedef struct connection_status_t {
-	unsigned int pinged: 1;                 /* sent ping */
+	unsigned int pinged: 1;         /* sent ping */
-	unsigned int unused_active: 1;
+	unsigned int active: 1;         /* 1 if active.. */
-	unsigned int connecting: 1;             /* 1 if we are waiting for a non-blocking connect() to finish */
+	unsigned int connecting: 1;     /* 1 if we are waiting for a non-blocking connect() to finish */
-	unsigned int unused_termreq: 1;         /* the termination of this connection was requested */
+	unsigned int unused_termreq: 1; /* the termination of this connection was requested */
-	unsigned int remove_unused: 1;          /* Set to 1 if you want this connection removed */
+	unsigned int remove: 1;         /* Set to 1 if you want this connection removed */
-	unsigned int timeout_unused: 1;         /* 1 if gotten timeout */
+	unsigned int timeout: 1;        /* 1 if gotten timeout */
-	unsigned int encryptout: 1;             /* 1 if we can encrypt outgoing traffic */
+	unsigned int encryptout: 1;     /* 1 if we can encrypt outgoing traffic */
-	unsigned int decryptin: 1;              /* 1 if we have to decrypt incoming traffic */
+	unsigned int decryptin: 1;      /* 1 if we have to decrypt incoming traffic */
-	unsigned int mst: 1;                    /* 1 if this connection is part of a minimum spanning tree */
+	unsigned int mst: 1;            /* 1 if this connection is part of a minimum spanning tree */
-	unsigned int control: 1;                /* 1 if this is a control connection */
+	unsigned int proxy_passed: 1;   /* 1 if we are connecting via a proxy and we have finished talking with it */
-	unsigned int pcap: 1;                   /* 1 if this is a control connection requesting packet capture */
+	unsigned int tarpit: 1;         /* 1 if the connection should be added to the tarpit */
-	unsigned int log: 1;                    /* 1 if this is a control connection requesting log dump */
+	unsigned int unused: 21;
-	unsigned int invitation: 1;             /* 1 if this is an invitation */
-	unsigned int invitation_used: 1;        /* 1 if the invitation has been consumed */
-	unsigned int tarpit: 1;                 /* 1 if the connection should be added to the tarpit */
-	unsigned int unused: 17;
 } connection_status_t;
 
-#include "ecdsa.h"
 #include "edge.h"
 #include "net.h"
 #include "node.h"
 
 typedef struct connection_t {
 	char *name;                     /* name he claims to have */
-	char *hostname;                 /* the hostname of its real ip */
 
 	union sockaddr_t address;       /* his real (internet) ip */
-	int protocol_major;             /* used protocol */
+	char *hostname;                 /* the hostname of its real ip */
-	int protocol_minor;             /* used protocol */
+	int protocol_version;           /* used protocol */
 
 	int socket;                     /* socket used for this connection */
 	uint32_t options;               /* options for this connection */
@@ -76,48 +71,53 @@ typedef struct connection_t {
 	struct node_t *node;            /* node associated with the other end */
 	struct edge_t *edge;            /* edge associated with this connection */
 
-#ifndef DISABLE_LEGACY
+	RSA *rsa_key;                   /* his public/private key */
-	rsa_t *rsa;                     /* his public RSA key */
+	const EVP_CIPHER *incipher;     /* Cipher he will use to send data to us */
-	cipher_t *incipher;             /* Cipher he will use to send data to us */
+	const EVP_CIPHER *outcipher;    /* Cipher we will use to send data to him */
-	cipher_t *outcipher;            /* Cipher we will use to send data to him */
+	EVP_CIPHER_CTX *inctx;          /* Context of encrypted meta data that will come from him to us */
-	digest_t *indigest;
+	EVP_CIPHER_CTX *outctx;         /* Context of encrypted meta data that will be sent from us to him */
-	digest_t *outdigest;
+	uint64_t inbudget;              /* Encrypted bytes send budget */
-	uint64_t inbudget;
+	uint64_t outbudget;             /* Encrypted bytes receive budget */
-	uint64_t outbudget;
+	char *inkey;                    /* His symmetric meta key + iv */
-#endif
+	char *outkey;                   /* Our symmetric meta key + iv */
-
+	int inkeylength;                /* Length of his key + iv */
-	ecdsa_t *ecdsa;                 /* his public ECDSA key */
+	int outkeylength;               /* Length of our key + iv */
-	sptps_t sptps;
+	const EVP_MD *indigest;
-
+	const EVP_MD *outdigest;
 	int inmaclength;
 	int outmaclength;
 	int incompression;
 	int outcompression;
+	char *mychallenge;              /* challenge we received from him */
+	char *hischallenge;             /* challenge we sent to him */
 
-	char *hischallenge;             /* The challenge we sent to him */
+	char buffer[MAXBUFSIZE];        /* metadata input buffer */
-	char *mychallenge;              /* The challenge we received */
+	int buflen;                     /* bytes read into buffer */
-
+	int reqlen;                     /* length of incoming request */
-	struct buffer_t inbuf;
+	length_t tcplen;                /* length of incoming TCPpacket */
-	struct buffer_t outbuf;
-	io_t io;                        /* input/output event on this metadata connection */
-	int tcplen;                     /* length of incoming TCPpacket */
-	int sptpslen;                   /* length of incoming SPTPS packet */
 	int allow_request;              /* defined if there's only one request possible */
 
-	time_t last_ping_time;          /* last time we saw some activity from the other end or pinged them */
+	char *outbuf;                   /* metadata output buffer */
+	int outbufstart;                /* index of first meaningful byte in output buffer */
+	int outbuflen;                  /* number of meaningful bytes in output buffer */
+	int outbufsize;                 /* number of bytes allocated to output buffer */
 
-	splay_tree_t *config_tree;      /* Pointer to configuration tree belonging to him */
+	time_t last_ping_time;          /* last time we saw some activity from the other end or pinged them */
+	time_t last_flushed_time;       /* last time buffer was empty. Only meaningful if outbuflen > 0 */
+
+	avl_tree_t *config_tree;        /* Pointer to configuration tree belonging to him */
 } connection_t;
 
-extern list_t *connection_list;
+extern avl_tree_t *connection_tree;
 extern connection_t *everyone;
 
 extern void init_connections(void);
 extern void exit_connections(void);
 extern connection_t *new_connection(void) __attribute__((__malloc__));
 extern void free_connection(connection_t *c);
+extern void free_connection_partially(connection_t *c);
 extern void connection_add(connection_t *c);
 extern void connection_del(connection_t *c);
-extern bool dump_connections(struct connection_t *c);
+extern void dump_connections(void);
 
 #endif

src/control.c

@@ -1,241 +0,0 @@
-/*
-    control.c -- Control socket handling.
-    Copyright (C) 2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "system.h"
-#include "crypto.h"
-#include "conf.h"
-#include "control.h"
-#include "control_common.h"
-#include "graph.h"
-#include "logger.h"
-#include "meta.h"
-#include "names.h"
-#include "net.h"
-#include "netutl.h"
-#include "protocol.h"
-#include "route.h"
-#include "utils.h"
-#include "xalloc.h"
-
-char controlcookie[65];
-
-static bool control_return(connection_t *c, int type, int error) {
-	return send_request(c, "%d %d %d", CONTROL, type, error);
-}
-
-static bool control_ok(connection_t *c, int type) {
-	return control_return(c, type, 0);
-}
-
-bool control_h(connection_t *c, const char *request) {
-	int type;
-
-	if(!c->status.control || c->allow_request != CONTROL) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Unauthorized control request from %s (%s)", c->name, c->hostname);
-		return false;
-	}
-
-	if(sscanf(request, "%*d %d", &type) != 1) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "CONTROL", c->name, c->hostname);
-		return false;
-	}
-
-	switch(type) {
-	case REQ_STOP:
-		event_exit();
-		return control_ok(c, REQ_STOP);
-
-	case REQ_DUMP_NODES:
-		return dump_nodes(c);
-
-	case REQ_DUMP_EDGES:
-		return dump_edges(c);
-
-	case REQ_DUMP_SUBNETS:
-		return dump_subnets(c);
-
-	case REQ_DUMP_CONNECTIONS:
-		return dump_connections(c);
-
-	case REQ_PURGE:
-		purge();
-		return control_ok(c, REQ_PURGE);
-
-	case REQ_SET_DEBUG: {
-		int new_level;
-
-		if(sscanf(request, "%*d %*d %d", &new_level) != 1) {
-			return false;
-		}
-
-		send_request(c, "%d %d %d", CONTROL, REQ_SET_DEBUG, debug_level);
-
-		if(new_level >= 0) {
-			debug_level = new_level;
-		}
-
-		return true;
-	}
-
-	case REQ_RETRY:
-		retry();
-		return control_ok(c, REQ_RETRY);
-
-	case REQ_RELOAD:
-		logger(DEBUG_ALWAYS, LOG_NOTICE, "Got '%s' command", "reload");
-		int result = reload_configuration();
-		return control_return(c, REQ_RELOAD, result);
-
-	case REQ_DISCONNECT: {
-		char name[MAX_STRING_SIZE];
-		bool found = false;
-
-		if(sscanf(request, "%*d %*d " MAX_STRING, name) != 1) {
-			return control_return(c, REQ_DISCONNECT, -1);
-		}
-
-		for list_each(connection_t, other, connection_list) {
-			if(strcmp(other->name, name)) {
-				continue;
-			}
-
-			terminate_connection(other, other->edge);
-			found = true;
-		}
-
-		return control_return(c, REQ_DISCONNECT, found ? 0 : -2);
-	}
-
-	case REQ_DUMP_TRAFFIC:
-		return dump_traffic(c);
-
-	case REQ_PCAP:
-		sscanf(request, "%*d %*d %d", &c->outmaclength);
-		c->status.pcap = true;
-		pcap = true;
-		return true;
-
-	case REQ_LOG:
-		sscanf(request, "%*d %*d %d", &c->outcompression);
-		c->status.log = true;
-		logcontrol = true;
-		return true;
-
-	default:
-		return send_request(c, "%d %d", CONTROL, REQ_INVALID);
-	}
-}
-
-bool init_control(void) {
-	randomize(controlcookie, sizeof(controlcookie) / 2);
-	bin2hex(controlcookie, controlcookie, sizeof(controlcookie) / 2);
-
-	mode_t mask = umask(0);
-	umask(mask | 077);
-	FILE *f = fopen(pidfilename, "w");
-	umask(mask);
-
-	if(!f) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Cannot write control socket cookie file %s: %s", pidfilename, strerror(errno));
-		return false;
-	}
-
-	// Get the address and port of the first listening socket
-
-	char *localhost = NULL;
-	sockaddr_t sa = {0};
-	socklen_t len = sizeof(sa);
-
-	// Make sure we have a valid address, and map 0.0.0.0 and :: to 127.0.0.1 and ::1.
-
-	if(getsockname(listen_socket[0].tcp.fd, &sa.sa, &len)) {
-		xasprintf(&localhost, "127.0.0.1 port %s", myport);
-	} else {
-		if(sa.sa.sa_family == AF_INET) {
-			if(sa.in.sin_addr.s_addr == 0) {
-				sa.in.sin_addr.s_addr = htonl(0x7f000001);
-			}
-		} else if(sa.sa.sa_family == AF_INET6) {
-			static const uint8_t zero[16] = {0};
-
-			if(!memcmp(sa.in6.sin6_addr.s6_addr, zero, sizeof(zero))) {
-				sa.in6.sin6_addr.s6_addr[15] = 1;
-			}
-		}
-
-		localhost = sockaddr2hostname(&sa);
-	}
-
-	fprintf(f, "%d %s %s\n", (int)getpid(), controlcookie, localhost);
-
-	free(localhost);
-	fclose(f);
-
-#ifndef HAVE_MINGW
-	int unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);
-
-	if(unix_fd < 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not create UNIX socket: %s", sockstrerror(sockerrno));
-		return false;
-	}
-
-	struct sockaddr_un sa_un;
-
-	sa_un.sun_family = AF_UNIX;
-
-	strncpy(sa_un.sun_path, unixsocketname, sizeof(sa_un.sun_path));
-
-	sa_un.sun_path[sizeof(sa_un.sun_path) - 1] = 0;
-
-	if(connect(unix_fd, (struct sockaddr *)&sa_un, sizeof(sa_un)) >= 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "UNIX socket %s is still in use!", unixsocketname);
-		return false;
-	}
-
-	unlink(unixsocketname);
-
-	umask(mask | 077);
-	int result = bind(unix_fd, (struct sockaddr *)&sa_un, sizeof(sa_un));
-	umask(mask);
-
-	if(result < 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not bind UNIX socket to %s: %s", unixsocketname, sockstrerror(sockerrno));
-		return false;
-	}
-
-	if(listen(unix_fd, 3) < 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not listen on UNIX socket %s: %s", unixsocketname, sockstrerror(sockerrno));
-		return false;
-	}
-
-	io_add(&unix_socket, handle_new_unix_connection, &unix_socket, unix_fd, IO_READ);
-#endif
-
-	return true;
-}
-
-void exit_control(void) {
-#ifndef HAVE_MINGW
-	unlink(unixsocketname);
-	io_del(&unix_socket);
-	close(unix_socket.fd);
-#endif
-
-	unlink(pidfilename);
-}

src/control.h

@@ -1,27 +0,0 @@
-#ifndef TINC_CONTROL_H
-#define TINC_CONTROL_H
-
-/*
-    control.h -- header for control.c.
-    Copyright (C) 2007 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-extern bool init_control(void);
-extern void exit_control(void);
-extern char controlcookie[];
-
-#endif

src/control_common.h

@@ -1,48 +0,0 @@
-#ifndef TINC_CONTROL_COMMON_H
-#define TINC_CONTROL_COMMON_H
-
-/*
-    control_protocol.h -- control socket protocol.
-    Copyright (C) 2007      Scott Lamb <slamb@slamb.org>
-                  2009-2012 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "protocol.h"
-
-enum request_type {
-	REQ_INVALID = -1,
-	REQ_STOP = 0,
-	REQ_RELOAD,
-	REQ_RESTART,
-	REQ_DUMP_NODES,
-	REQ_DUMP_EDGES,
-	REQ_DUMP_SUBNETS,
-	REQ_DUMP_CONNECTIONS,
-	REQ_DUMP_GRAPH,
-	REQ_PURGE,
-	REQ_SET_DEBUG,
-	REQ_RETRY,
-	REQ_CONNECT,
-	REQ_DISCONNECT,
-	REQ_DUMP_TRAFFIC,
-	REQ_PCAP,
-	REQ_LOG,
-};
-
-#define TINC_CTL_VERSION_CURRENT 0
-
-#endif

src/crypto.h

@@ -1,27 +0,0 @@
-#ifndef TINC_CRYPTO_H
-#define TINC_CRYPTO_H
-
-/*
-    crypto.h -- header for crypto.c
-    Copyright (C) 2007-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-extern void crypto_init(void);
-extern void crypto_exit(void);
-extern void randomize(void *buf, size_t buflen);
-
-#endif

src/cygwin/device.c

@@ -1,7 +1,7 @@
 /*
     device.c -- Interaction with Windows tap driver in a Cygwin environment
     Copyright (C) 2002-2005 Ivo Timmermans,
-                  2002-2014 Guus Sliepen <guus@tinc-vpn.org>
+                  2002-2016 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -27,7 +27,6 @@
 #include "../conf.h"
 #include "../device.h"
 #include "../logger.h"
-#include "../names.h"
 #include "../route.h"
 #include "../utils.h"
 #include "../xalloc.h"
@@ -40,6 +39,9 @@ char *device = NULL;
 char *iface = NULL;
 static const char *device_info = "Windows tap device";
 
+static uint64_t device_total_in = 0;
+static uint64_t device_total_out = 0;
+
 static pid_t reader_pid;
 static int sp[2];
 
@@ -66,7 +68,7 @@ static bool setup_device(void) {
 	/* Open registry and look for network adapters */
 
 	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, NETWORK_CONNECTIONS_KEY, 0, KEY_READ, &key)) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
+		logger(LOG_ERR, "Unable to read registry: %s", winerror(GetLastError()));
 		return false;
 	}
 
@@ -125,7 +127,7 @@ static bool setup_device(void) {
 	RegCloseKey(key);
 
 	if(!found) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "No Windows tap device found!");
+		logger(LOG_ERR, "No Windows tap device found!");
 		return false;
 	}
 
@@ -144,7 +146,7 @@ static bool setup_device(void) {
 	   Furthermore I don't really know how to do it the "Windows" way. */
 
 	if(socketpair(AF_UNIX, SOCK_DGRAM, PF_UNIX, sp)) {
-		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
+		logger(LOG_DEBUG, "System call `%s' failed: %s", "socketpair", strerror(errno));
 		return false;
 	}
 
@@ -153,7 +155,7 @@ static bool setup_device(void) {
 	device_handle = CreateFile(tapname, GENERIC_WRITE,  FILE_SHARE_READ,  0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 
 	if(device_handle == INVALID_HANDLE_VALUE) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
+		logger(LOG_ERR, "Could not open Windows tap device %s (%s) for writing: %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
 
@@ -162,7 +164,7 @@ static bool setup_device(void) {
 	/* Get MAC address from tap device */
 
 	if(!DeviceIoControl(device_handle, TAP_IOCTL_GET_MAC, mymac.x, sizeof(mymac.x), mymac.x, sizeof(mymac.x), &len, 0)) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
+		logger(LOG_ERR, "Could not get MAC address from Windows tap device %s (%s): %s", device, iface, winerror(GetLastError()));
 		return false;
 	}
 
@@ -175,7 +177,7 @@ static bool setup_device(void) {
 	reader_pid = fork();
 
 	if(reader_pid == -1) {
-		logger(DEBUG_ALWAYS, LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
+		logger(LOG_DEBUG, "System call `%s' failed: %s", "fork", strerror(errno));
 		return false;
 	}
 
@@ -184,20 +186,20 @@ static bool setup_device(void) {
 		   It passes everything it reads to the socket. */
 
 		char buf[MTU];
-		long inlen;
+		long lenin;
 
 		CloseHandle(device_handle);
 
 		device_handle = CreateFile(tapname, GENERIC_READ, FILE_SHARE_WRITE, 0,  OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 
 		if(device_handle == INVALID_HANDLE_VALUE) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
+			logger(LOG_ERR, "Could not open Windows tap device %s (%s) for reading: %s", device, iface, winerror(GetLastError()));
 			buf[0] = 0;
 			write(sp[1], buf, 1);
 			exit(1);
 		}
 
-		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader forked and running.");
+		logger(LOG_DEBUG, "Tap reader forked and running.");
 
 		/* Notify success */
 
@@ -207,19 +209,19 @@ static bool setup_device(void) {
 		/* Pass packets */
 
 		for(;;) {
-			ReadFile(device_handle, buf, MTU, &inlen, NULL);
+			ReadFile(device_handle, buf, MTU, &lenin, NULL);
-			write(sp[1], buf, inlen);
+			write(sp[1], buf, lenin);
 		}
 	}
 
 	read(device_fd, &gelukt, 1);
 
 	if(gelukt != 1) {
-		logger(DEBUG_ALWAYS, LOG_DEBUG, "Tap reader failed!");
+		logger(LOG_DEBUG, "Tap reader failed!");
 		return false;
 	}
 
-	logger(DEBUG_ALWAYS, LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
+	logger(LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
 
 	return true;
 }
@@ -228,51 +230,58 @@ static void close_device(void) {
 	close(sp[0]);
 	close(sp[1]);
 	CloseHandle(device_handle);
-	device_handle = INVALID_HANDLE_VALUE;
 
 	kill(reader_pid, SIGKILL);
 
 	free(device);
-	device = NULL;
 	free(iface);
-	iface = NULL;
-	device_info = NULL;
 }
 
 static bool read_packet(vpn_packet_t *packet) {
-	int inlen;
+	int lenin;
 
-	if((inlen = read(sp[0], DATA(packet), MTU)) <= 0) {
+	if((lenin = read(sp[0], packet->data, MTU)) <= 0) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Error while reading from %s %s: %s", device_info,
+		logger(LOG_ERR, "Error while reading from %s %s: %s", device_info,
 		       device, strerror(errno));
 		return false;
 	}
 
-	packet->len = inlen;
+	packet->len = lenin;
 
-	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
+	device_total_in += packet->len;
-	       device_info);
+
+	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Read packet of %d bytes from %s", packet->len,
+	                        device_info);
 
 	return true;
 }
 
 static bool write_packet(vpn_packet_t *packet) {
-	long outlen;
+	long lenout;
 
-	logger(DEBUG_TRAFFIC, LOG_DEBUG, "Writing packet of %d bytes to %s",
+	ifdebug(TRAFFIC) logger(LOG_DEBUG, "Writing packet of %d bytes to %s",
-	       packet->len, device_info);
+	                        packet->len, device_info);
 
-	if(!WriteFile(device_handle, DATA(packet), packet->len, &outlen, NULL)) {
+	if(!WriteFile(device_handle, packet->data, packet->len, &lenout, NULL)) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
+		logger(LOG_ERR, "Error while writing to %s %s: %s", device_info, device, winerror(GetLastError()));
 		return false;
 	}
 
+	device_total_out += packet->len;
+
 	return true;
 }
 
+static void dump_device_stats(void) {
+	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
+	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
+	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
+}
+
 const devops_t os_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
+	.dump_stats = dump_device_stats,
 };

src/device.h

@@ -25,22 +25,21 @@
 
 extern int device_fd;
 extern char *device;
+
 extern char *iface;
 
 typedef struct devops_t {
 	bool (*setup)(void);
 	void (*close)(void);
-	bool (*read)(struct vpn_packet_t *);
+	bool (*read)(struct vpn_packet_t *packet);
-	bool (*write)(struct vpn_packet_t *);
+	bool (*write)(struct vpn_packet_t *packet);
-	void (*enable)(void);   /* optional */
+	void (*dump_stats)(void);
-	void (*disable)(void);  /* optional */
 } devops_t;
 
 extern const devops_t os_devops;
 extern const devops_t dummy_devops;
 extern const devops_t raw_socket_devops;
 extern const devops_t multicast_devops;
-extern const devops_t fd_devops;
 extern const devops_t uml_devops;
 extern const devops_t vde_devops;
 extern devops_t devops;

src/digest.h

@@ -1,42 +0,0 @@
-#ifndef TINC_DIGEST_H
-#define TINC_DIGEST_H
-
-/*
-    digest.h -- header file digest.c
-    Copyright (C) 2007-2016 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#define DIGEST_MAX_SIZE 64
-
-#ifndef DISABLE_LEGACY
-
-typedef struct digest digest_t;
-
-extern digest_t *digest_open_by_name(const char *name, int maclength) __attribute__((__malloc__));
-extern digest_t *digest_open_by_nid(int nid, int maclength) __attribute__((__malloc__));
-extern void digest_close(digest_t *digest);
-extern bool digest_create(digest_t *digest, const void *indata, size_t inlen, void *outdata) __attribute__((__warn_unused_result__));
-extern bool digest_verify(digest_t *digest, const void *indata, size_t inlen, const void *digestdata) __attribute__((__warn_unused_result__));
-extern bool digest_set_key(digest_t *digest, const void *key, size_t len) __attribute__((__warn_unused_result__));
-extern int digest_get_nid(const digest_t *digest);
-extern size_t digest_keylength(const digest_t *digest);
-extern size_t digest_length(const digest_t *digest);
-extern bool digest_active(const digest_t *digest);
-
-#endif
-
-#endif

src/dropin.c

@@ -107,6 +107,7 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
 
 	va_copy(aq, ap);
 	status = vsnprintf(*buf, len, fmt, aq);
+	buf[len - 1] = 0;
 	va_end(aq);
 
 	if(status >= 0) {
@@ -114,7 +115,7 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
 	}
 
 	if(status > len - 1) {
-		len = status + 1;
+		len = status;
 		va_copy(aq, ap);
 		status = vsnprintf(*buf, len, fmt, aq);
 		va_end(aq);
@@ -126,25 +127,16 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
 
 #ifndef HAVE_GETTIMEOFDAY
 int gettimeofday(struct timeval *tv, void *tz) {
-#ifdef HAVE_MINGW
-	FILETIME ft;
-	GetSystemTimeAsFileTime(&ft);
-	uint64_t lt = (uint64_t)ft.dwLowDateTime | ((uint64_t)ft.dwHighDateTime << 32);
-	lt -= 116444736000000000ULL;
-	tv->tv_sec = lt / 10000000;
-	tv->tv_usec = (lt / 10) % 1000000;
-#else
-#warning No high resolution time source!
 	tv->tv_sec = time(NULL);
 	tv->tv_usec = 0;
-#endif
 	return 0;
 }
 #endif
 
-#ifndef HAVE_NANOSLEEP
+#ifndef HAVE_USLEEP
-int nanosleep(const struct timespec *req, struct timespec *rem) {
+int usleep(long long usec) {
-	struct timeval tv = {req->tv_sec, req->tv_nsec / 1000};
+	struct timeval tv = {usec / 1000000, (usec / 1000) % 1000};
-	return select(0, NULL, NULL, NULL, &tv);
+	select(0, NULL, NULL, NULL, &tv);
+	return 0;
 }
 #endif

src/dropin.h

@@ -4,7 +4,7 @@
 /*
     dropin.h -- header file for dropin.c
     Copyright (C) 2000-2005 Ivo Timmermans,
-                  2000-2016 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2011 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -21,50 +21,28 @@
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
+#include "fake-getaddrinfo.h"
+#include "fake-getnameinfo.h"
+
 #ifndef HAVE_DAEMON
-extern int daemon(int, int);
+extern int daemon(int nochdir, int noclose);
+#endif
+
+#ifndef HAVE_GET_CURRENT_DIR_NAME
+extern char *get_current_dir_name(void);
 #endif
 
 #ifndef HAVE_ASPRINTF
-extern int asprintf(char **, const char *, ...);
+extern int asprintf(char **buf, const char *fmt, ...);
-extern int vasprintf(char **, const char *, va_list ap);
+extern int vasprintf(char **buf, const char *fmt, va_list ap);
 #endif
 
 #ifndef HAVE_GETTIMEOFDAY
-extern int gettimeofday(struct timeval *, void *);
+extern int gettimeofday(struct timeval *tv, void *tz);
 #endif
 
-#ifndef HAVE_NANOSLEEP
+#ifndef HAVE_USLEEP
-extern int nanosleep(const struct timespec *req, struct timespec *rem);
+extern int usleep(long long usec);
-#endif
-
-#ifndef timeradd
-#define timeradd(a, b, r) do {\
-		(r)->tv_sec = (a)->tv_sec + (b)->tv_sec;\
-		(r)->tv_usec = (a)->tv_usec + (b)->tv_usec;\
-		if((r)->tv_usec >= 1000000)\
-			(r)->tv_sec++, (r)->tv_usec -= 1000000;\
-	} while (0)
-#endif
-
-#ifndef timersub
-#define timersub(a, b, r) do {\
-		(r)->tv_sec = (a)->tv_sec - (b)->tv_sec;\
-		(r)->tv_usec = (a)->tv_usec - (b)->tv_usec;\
-		if((r)->tv_usec < 0)\
-			(r)->tv_sec--, (r)->tv_usec += 1000000;\
-	} while (0)
-#endif
-
-#ifdef HAVE_MINGW
-#define mkdir(a, b) mkdir(a)
-#ifndef SHUT_RDWR
-#define SHUT_RDWR SD_BOTH
-#endif
-#endif
-
-#ifndef EAI_SYSTEM
-#define EAI_SYSTEM 0
 #endif
 
 #endif

src/dummy_device.c

@@ -1,6 +1,6 @@
 /*
     device.c -- Dummy device
-    Copyright (C) 2011-2012 Guus Sliepen <guus@tinc-vpn.org>
+    Copyright (C) 2011 Guus Sliepen <guus@tinc-vpn.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -26,14 +26,19 @@
 
 static const char *device_info = "dummy device";
 
+static uint64_t device_total_in = 0;
+static uint64_t device_total_out = 0;
+
 static bool setup_device(void) {
 	device = xstrdup("dummy");
 	iface = xstrdup("dummy");
-	logger(DEBUG_ALWAYS, LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
+	logger(LOG_INFO, "%s (%s) is a %s", device, iface, device_info);
 	return true;
 }
 
 static void close_device(void) {
+	free(device);
+	free(iface);
 }
 
 static bool read_packet(vpn_packet_t *packet) {
@@ -42,13 +47,20 @@ static bool read_packet(vpn_packet_t *packet) {
 }
 
 static bool write_packet(vpn_packet_t *packet) {
-	(void)packet;
+	device_total_out += packet->len;
 	return true;
 }
 
+static void dump_device_stats(void) {
+	logger(LOG_DEBUG, "Statistics for %s %s:", device_info, device);
+	logger(LOG_DEBUG, " total bytes in:  %10"PRIu64, device_total_in);
+	logger(LOG_DEBUG, " total bytes out: %10"PRIu64, device_total_out);
+}
+
 const devops_t dummy_devops = {
 	.setup = setup_device,
 	.close = close_device,
 	.read = read_packet,
 	.write = write_packet,
+	.dump_stats = dump_device_stats,
 };

src/ecdh.h

@@ -1,34 +0,0 @@
-#ifndef TINC_ECDH_H
-#define TINC_ECDH_H
-
-/*
-    ecdh.h -- header file for ecdh.c
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#define ECDH_SIZE 32
-#define ECDH_SHARED_SIZE 32
-
-#ifndef TINC_ECDH_INTERNAL
-typedef struct ecdh ecdh_t;
-#endif
-
-extern ecdh_t *ecdh_generate_public(void *pubkey) __attribute__((__malloc__));
-extern bool ecdh_compute_shared(ecdh_t *ecdh, const void *pubkey, void *shared) __attribute__((__warn_unused_result__));
-extern void ecdh_free(ecdh_t *ecdh);
-
-#endif

src/ecdsa.h

@@ -1,37 +0,0 @@
-#ifndef TINC_ECDSA_H
-#define TINC_ECDSA_H
-
-/*
-    ecdsa.h -- ECDSA key handling
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#ifndef TINC_ECDSA_INTERNAL
-typedef struct ecdsa ecdsa_t;
-#endif
-
-extern ecdsa_t *ecdsa_set_base64_public_key(const char *p) __attribute__((__malloc__));
-extern char *ecdsa_get_base64_public_key(ecdsa_t *ecdsa);
-extern ecdsa_t *ecdsa_read_pem_public_key(FILE *fp) __attribute__((__malloc__));
-extern ecdsa_t *ecdsa_read_pem_private_key(FILE *fp) __attribute__((__malloc__));
-extern size_t ecdsa_size(ecdsa_t *ecdsa);
-extern bool ecdsa_sign(ecdsa_t *ecdsa, const void *in, size_t inlen, void *out) __attribute__((__warn_unused_result__));
-extern bool ecdsa_verify(ecdsa_t *ecdsa, const void *in, size_t inlen, const void *out) __attribute__((__warn_unused_result__));
-extern bool ecdsa_active(ecdsa_t *ecdsa);
-extern void ecdsa_free(ecdsa_t *ecdsa);
-
-#endif

src/ecdsagen.h

@@ -1,29 +0,0 @@
-#ifndef TINC_ECDSAGEN_H
-#define TINC_ECDSAGEN_H
-
-/*
-    ecdsagen.h -- ECDSA key generation and export
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "ecdsa.h"
-
-extern ecdsa_t *ecdsa_generate(void) __attribute__((__malloc__));
-extern bool ecdsa_write_pem_public_key(ecdsa_t *ecdsa, FILE *fp) __attribute__((__warn_unused_result__));
-extern bool ecdsa_write_pem_private_key(ecdsa_t *ecdsa, FILE *fp) __attribute__((__warn_unused_result__));
-
-#endif

src/ed25519/ecdh.c

@@ -1,51 +0,0 @@
-/*
-    ecdh.c -- Diffie-Hellman key exchange handling
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "../system.h"
-
-#include "ed25519.h"
-
-#define TINC_ECDH_INTERNAL
-typedef struct ecdh_t {
-	uint8_t private[64];
-} ecdh_t;
-
-#include "../crypto.h"
-#include "../ecdh.h"
-#include "../xalloc.h"
-
-ecdh_t *ecdh_generate_public(void *pubkey) {
-	ecdh_t *ecdh = xzalloc(sizeof(*ecdh));
-
-	uint8_t seed[32];
-	randomize(seed, sizeof(seed));
-	ed25519_create_keypair(pubkey, ecdh->private, seed);
-
-	return ecdh;
-}
-
-bool ecdh_compute_shared(ecdh_t *ecdh, const void *pubkey, void *shared) {
-	ed25519_key_exchange(shared, pubkey, ecdh->private);
-	free(ecdh);
-	return true;
-}
-
-void ecdh_free(ecdh_t *ecdh) {
-	free(ecdh);
-}

src/ed25519/ecdsa.c

@@ -1,168 +0,0 @@
-/*
-    ecdsa.c -- ECDSA key handling
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "../system.h"
-
-#include "ed25519.h"
-
-#define TINC_ECDSA_INTERNAL
-typedef struct {
-	uint8_t private[64];
-	uint8_t public[32];
-} ecdsa_t;
-
-#include "../logger.h"
-#include "../ecdsa.h"
-#include "../utils.h"
-#include "../xalloc.h"
-
-// Get and set ECDSA keys
-//
-ecdsa_t *ecdsa_set_base64_public_key(const char *p) {
-	int len = strlen(p);
-
-	if(len != 43) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Invalid size %d for public key!", len);
-		return 0;
-	}
-
-	ecdsa_t *ecdsa = xzalloc(sizeof(*ecdsa));
-	len = b64decode(p, ecdsa->public, len);
-
-	if(len != 32) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "Invalid format of public key! len = %d", len);
-		free(ecdsa);
-		return 0;
-	}
-
-	return ecdsa;
-}
-
-char *ecdsa_get_base64_public_key(ecdsa_t *ecdsa) {
-	char *base64 = xmalloc(44);
-	b64encode(ecdsa->public, base64, sizeof(ecdsa->public));
-
-	return base64;
-}
-
-// Read PEM ECDSA keys
-
-static bool read_pem(FILE *fp, const char *type, void *vbuf, size_t size) {
-	char line[1024];
-	bool data = false;
-	size_t typelen = strlen(type);
-	char *buf = vbuf;
-
-	while(fgets(line, sizeof(line), fp)) {
-		if(!data) {
-			if(strncmp(line, "-----BEGIN ", 11)) {
-				continue;
-			}
-
-			if(strncmp(line + 11, type, typelen)) {
-				continue;
-			}
-
-			data = true;
-			continue;
-		}
-
-		if(!strncmp(line, "-----END ", 9)) {
-			break;
-		}
-
-		size_t linelen = strcspn(line, "\r\n");
-		size_t len = b64decode(line, line, linelen);
-
-		if(!len) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Invalid base64 data in PEM file\n");
-			errno = EINVAL;
-			return false;
-		}
-
-		if(len > size) {
-			logger(DEBUG_ALWAYS, LOG_ERR, "Too much base64 data in PEM file\n");
-			errno = EINVAL;
-			return false;
-		}
-
-		memcpy(buf, line, len);
-		buf += len;
-		size -= len;
-	}
-
-	if(size) {
-		if(data) {
-			errno = EINVAL;
-			logger(DEBUG_ALWAYS, LOG_ERR, "Too little base64 data in PEM file\n");
-		} else {
-			errno = ENOENT;
-		}
-
-		return false;
-	}
-
-	return true;
-}
-
-ecdsa_t *ecdsa_read_pem_public_key(FILE *fp) {
-	ecdsa_t *ecdsa = xzalloc(sizeof(*ecdsa));
-
-	if(read_pem(fp, "ED25519 PUBLIC KEY", ecdsa->public, sizeof(ecdsa->public))) {
-		return ecdsa;
-	}
-
-	free(ecdsa);
-	return 0;
-}
-
-ecdsa_t *ecdsa_read_pem_private_key(FILE *fp) {
-	ecdsa_t *ecdsa = xmalloc(sizeof(*ecdsa));
-
-	if(read_pem(fp, "ED25519 PRIVATE KEY", ecdsa->private, sizeof(*ecdsa))) {
-		return ecdsa;
-	}
-
-	free(ecdsa);
-	return 0;
-}
-
-size_t ecdsa_size(ecdsa_t *ecdsa) {
-	(void)ecdsa;
-	return 64;
-}
-
-// TODO: standardise output format?
-
-bool ecdsa_sign(ecdsa_t *ecdsa, const void *in, size_t len, void *sig) {
-	ed25519_sign(sig, in, len, ecdsa->public, ecdsa->private);
-	return true;
-}
-
-bool ecdsa_verify(ecdsa_t *ecdsa, const void *in, size_t len, const void *sig) {
-	return ed25519_verify(sig, in, len, ecdsa->public);
-}
-
-bool ecdsa_active(ecdsa_t *ecdsa) {
-	return ecdsa;
-}
-
-void ecdsa_free(ecdsa_t *ecdsa) {
-	free(ecdsa);
-}

src/ed25519/ecdsagen.c

@@ -1,73 +0,0 @@
-/*
-    ecdsagen.c -- ECDSA key generation and export
-    Copyright (C) 2011-2013 Guus Sliepen <guus@tinc-vpn.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-#include "../system.h"
-
-#include "ed25519.h"
-
-#define TINC_ECDSA_INTERNAL
-typedef struct {
-	uint8_t private[64];
-	uint8_t public[32];
-} ecdsa_t;
-
-#include "../crypto.h"
-#include "../ecdsagen.h"
-#include "../utils.h"
-#include "../xalloc.h"
-
-// Generate ECDSA key
-
-ecdsa_t *ecdsa_generate(void) {
-	ecdsa_t *ecdsa = xzalloc(sizeof(*ecdsa));
-
-	uint8_t seed[32];
-	randomize(seed, sizeof(seed));
-	ed25519_create_keypair(ecdsa->public, ecdsa->private, seed);
-
-	return ecdsa;
-}
-
-// Write PEM ECDSA keys
-
-static bool write_pem(FILE *fp, const char *type, void *vbuf, size_t size) {
-	fprintf(fp, "-----BEGIN %s-----\n", type);
-
-	char *buf = vbuf;
-	char base64[65];
-
-	while(size) {
-		size_t todo = size > 48 ? 48 : size;
-		b64encode(buf, base64, todo);
-		fprintf(fp, "%s\n", base64);
-		buf += todo;
-		size -= todo;
-	}
-
-	fprintf(fp, "-----END %s-----\n", type);
-	return !ferror(fp);
-}
-
-bool ecdsa_write_pem_public_key(ecdsa_t *ecdsa, FILE *fp) {
-	return write_pem(fp, "ED25519 PUBLIC KEY", ecdsa->public, sizeof(ecdsa->public));
-}
-
-bool ecdsa_write_pem_private_key(ecdsa_t *ecdsa, FILE *fp) {
-	return write_pem(fp, "ED25519 PRIVATE KEY", ecdsa->private, sizeof(*ecdsa));
-}