Release 1.0.36-2 for unstable

Disable support for livdeplug.
Closes: #973233
2020-11-22 10:40:54 +01:00 · 2020-11-22 10:40:00 +01:00 · 2019-08-26 14:20:47 +02:00 · 2019-08-26 14:15:02 +02:00 · 2019-08-26 14:00:57 +02:00 · 2019-08-26 13:52:00 +02:00
53 changed files with 2236 additions and 918 deletions
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen and others.
+Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen and others.
 See the AUTHORS file for a complete list.

 This program is free software; you can redistribute it and/or modify it under
--- a/23
+++ b/23
@ -1,3 +1,26 @@
+Version 1.0.36                                            August 26 2019
+------------------------------------------------------------------------
+
+Guus Sliepen (8):
+      Remove the call to RAND_load_file().
+      Update THANKS.
+      Backport tinc 1.1's str2net() function.
+      Update THANKS.
+      Fix spelling errors found by codespell.
+      Reformat all code using astyle.
+      Add a missing check for a pathname being too long.
+      Releasing 1.0.36.
+
+Rosen Penev (2):
+      Fix compilation when OpenSSL has no ENGINE support
+      Fix compilation without deprecated OpenSSL APIs
+
+Quentin Rameau (1):
+      Double-quote nodes in graphviz network file
+
+Werner Schreiber (1):
+      Fix segfault when dest->mtu is 0.
+
 Version 1.0.35                                           October 05 2018
 ------------------------------------------------------------------------

--- a/Makefile.in
+++ b/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -142,8 +142,8 @@ am__recursive_targets = \
  $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
 	cscope distdir distdir-am dist dist-all distcheck
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
-	$(LISP)config.h.in
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
+	config.h.in
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
 # *not* preserved.
@ -166,7 +166,7 @@ CSCOPE = cscope
 DIST_SUBDIRS = $(SUBDIRS)
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in AUTHORS \
 	COPYING ChangeLog INSTALL NEWS README THANKS compile \
-	config.guess config.sub install-sh missing
+	config.guess config.sub depcomp install-sh missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@ -558,6 +558,10 @@ dist-xz: distdir
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__post_remove_distdir)

+dist-zstd: distdir
+	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
+	$(am__post_remove_distdir)
+
 dist-tarZ: distdir
 	@echo WARNING: "Support for distribution archives compressed with" \
 		       "legacy program 'compress' is deprecated." >&2
@ -600,6 +604,8 @@ distcheck: dist
 	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
+	*.tar.zst*) \
+	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
@ -776,7 +782,7 @@ uninstall-am:
 	am--refresh check check-am clean clean-cscope clean-generic \
 	cscope cscopelist-am ctags ctags-am dist dist-all dist-bzip2 \
 	dist-gzip dist-lzip dist-shar dist-tarZ dist-xz dist-zip \
-	distcheck distclean distclean-generic distclean-hdr \
+	dist-zstd distcheck distclean distclean-generic distclean-hdr \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
--- a/14
+++ b/14
@ -1,7 +1,21 @@
+Version 1.0.36               August 26 2019
+
+ * Fix compiling tinc with certain versions of the OpenSSL library.
+ * Fix parsing some IPv6 addresses with :: in them.
+ * Fix GraphDumpFile output to handle node names starting with a digit.
+ * Fix a potential segmentation fault when fragmenting packets.
+
+Thanks to Rosen Penev, Quentin Rameau and Werner Schreiber for their
+contributions to this version of tinc.
+
 Version 1.0.35               October 5 2018

 * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
 * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).
+ * Minor fixes in the documentation.
+
+Thanks to Amine Amri and Rafael Sadowski for their contributions to this
+version of tinc.

 Version 1.0.34               June 12 2018

--- a/4
+++ b/4
@ -1,7 +1,7 @@
-This is the README file for tinc version 1.0.35. Installation
+This is the README file for tinc version 1.0.36. Installation
 instructions may be found in the INSTALL file.

-tinc is Copyright (C) 1998-2018 by:
+tinc is Copyright (C) 1998-2019 by:

 Ivo Timmermans,
 Guus Sliepen <guus@tinc-vpn.org>,
--- a/6
+++ b/6
@ -22,6 +22,7 @@ We would like to thank the following people for their contributions to tinc:
 * Delf Eldkraft
 * Dennis Joachimsthaler
 * dnk
+* Егор Палкин
 * Élie Bouttier
 * Enrique Zanardi
 * Erik Tews
@ -42,6 +43,7 @@ We would like to thank the following people for their contributions to tinc:
 * James Cook
 * James MacLean
 * Jamie Briggs
+* Jan Štembera
 * Jason Harper
 * Jason Livesay
 * Jasper Krijgsman
@ -71,6 +73,7 @@ We would like to thank the following people for their contributions to tinc:
 * Max Rijevski
 * Menno Smits
 * Mesar Hameed
+* Michael Taylor
 * Michael Tokarev
 * Michael Yonli
 * Miles Nordin
@ -82,10 +85,12 @@ We would like to thank the following people for their contributions to tinc:
 * Philipp Babel
 * Pierre Emeriaud
 * Pierre-Olivier Mercier
+* Rafael Wolf
 * Rafael Sadowski
 * Rafał Leśniak
 * Rhosyn Celyn
 * Robert van der Meulen
+* Robert Waniek
 * Rumko
 * Ryan Miller
 * Sam Bryan
@ -104,6 +109,7 @@ We would like to thank the following people for their contributions to tinc:
 * Tonnerre Lombard
 * Ulrich Seifert
 * Vil Brekin
+* Vincent Laurent
 * Vittorio Gambaletta
 * Wendy Willard
 * Wessel Dankers
--- a/aclocal.m4
+++ b/aclocal.m4
@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.2 -*- Autoconf -*-

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -20,7 +20,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])

-# Copyright (C) 2002-2018 Free Software Foundation, Inc.
+# Copyright (C) 2002-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -35,7 +35,7 @@ AC_DEFUN([AM_AUTOMAKE_VERSION],
 [am__api_version='1.16'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.16.1], [],
+m4_if([$1], [1.16.2], [],
      [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])

@ -51,14 +51,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.16.1])dnl
+[AM_AUTOMAKE_VERSION([1.16.2])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
  [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])

 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -110,7 +110,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`

 # AM_CONDITIONAL                                            -*- Autoconf -*-

-# Copyright (C) 1997-2018 Free Software Foundation, Inc.
+# Copyright (C) 1997-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -141,7 +141,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])

-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -332,7 +332,7 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl

 # Generate code to set up dependency tracking.              -*- Autoconf -*-

-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -371,7 +371,9 @@ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS],
  done
  if test $am_rc -ne 0; then
    AC_MSG_FAILURE([Something went wrong bootstrapping makefile fragments
-    for automatic dependency tracking.  Try re-running configure with the
+    for automatic dependency tracking.  If GNU make was not used, consider
+    re-running the configure script with MAKE="gmake" (or whatever is
+    necessary).  You can also try re-running configure with the
    '--disable-dependency-tracking' option to at least be able to build
    the package (albeit without support for automatic dependency tracking).])
  fi
@ -398,7 +400,7 @@ AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],

 # Do all the work for Automake.                             -*- Autoconf -*-

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -595,7 +597,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -616,7 +618,7 @@ if test x"${install_sh+set}" != xset; then
 fi
 AC_SUBST([install_sh])])

-# Copyright (C) 2003-2018 Free Software Foundation, Inc.
+# Copyright (C) 2003-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -637,7 +639,7 @@ AC_SUBST([am__leading_dot])])

 # Check to see how 'make' treats includes.	            -*- Autoconf -*-

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -680,7 +682,7 @@ AC_SUBST([am__quote])])

 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-

-# Copyright (C) 1997-2018 Free Software Foundation, Inc.
+# Copyright (C) 1997-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -719,7 +721,7 @@ fi

 # Helper functions for option handling.                     -*- Autoconf -*-

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -748,7 +750,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])

-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -795,7 +797,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -814,7 +816,7 @@ AC_DEFUN([AM_RUN_LOG],

 # Check to make sure that the build environment is sane.    -*- Autoconf -*-

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -895,7 +897,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])

-# Copyright (C) 2009-2018 Free Software Foundation, Inc.
+# Copyright (C) 2009-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -955,7 +957,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])

-# Copyright (C) 2001-2018 Free Software Foundation, Inc.
+# Copyright (C) 2001-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -983,7 +985,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])

-# Copyright (C) 2006-2018 Free Software Foundation, Inc.
+# Copyright (C) 2006-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@ -1002,7 +1004,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])

 # Check how to create a tarball.                            -*- Autoconf -*-

-# Copyright (C) 2004-2018 Free Software Foundation, Inc.
+# Copyright (C) 2004-2020 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
--- a/6
+++ b/6
@ -3,7 +3,7 @@

 scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@ -53,7 +53,7 @@ func_file_conv ()
 	  MINGW*)
 	    file_conv=mingw
 	    ;;
-	  CYGWIN*)
+	  CYGWIN* | MSYS*)
 	    file_conv=cygwin
 	    ;;
 	  *)
@ -67,7 +67,7 @@ func_file_conv ()
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/*)
+	cygwin/* | msys/*)
 	  file=`cygpath -m "$file" || echo "$file"`
 	  ;;
 	wine/*)
--- a/24
+++ b/24
@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for tinc 1.0.35.
+# Generated by GNU Autoconf 2.69 for tinc 1.0.36.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@ -577,8 +577,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='tinc'
 PACKAGE_TARNAME='tinc'
-PACKAGE_VERSION='1.0.35'
-PACKAGE_STRING='tinc 1.0.35'
+PACKAGE_VERSION='1.0.36'
+PACKAGE_STRING='tinc 1.0.36'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''

@ -1321,7 +1321,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures tinc 1.0.35 to adapt to many kinds of systems.
+\`configure' configures tinc 1.0.36 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@ -1392,7 +1392,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of tinc 1.0.35:";;
+     short | recursive ) echo "Configuration of tinc 1.0.36:";;
   esac
  cat <<\_ACEOF

@ -1509,7 +1509,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-tinc configure 1.0.35
+tinc configure 1.0.36
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@ -1974,7 +1974,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by tinc $as_me 1.0.35, which was
+It was created by tinc $as_me 1.0.36, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@ -2838,7 +2838,7 @@ fi

 # Define the identity of the package.
 PACKAGE='tinc'
- VERSION='1.0.35'
+ VERSION='1.0.36'


 cat >>confdefs.h <<_ACEOF
@ -7333,7 +7333,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by tinc $as_me 1.0.35, which was
+This file was extended by tinc $as_me 1.0.36, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@ -7399,7 +7399,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-tinc config.status 1.0.35
+tinc config.status 1.0.36
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@ -8211,7 +8211,9 @@ $as_echo X/"$am_mf" |
    { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "Something went wrong bootstrapping makefile fragments
-    for automatic dependency tracking.  Try re-running configure with the
+    for automatic dependency tracking.  If GNU make was not used, consider
+    re-running the configure script with MAKE=\"gmake\" (or whatever is
+    necessary).  You can also try re-running configure with the
    '--disable-dependency-tracking' option to at least be able to build
    the package (albeit without support for automatic dependency tracking).
 See \`config.log' for more details" "$LINENO" 5; }
--- a/configure.ac
+++ b/configure.ac
@ -1,7 +1,7 @@
 dnl Process this file with autoconf to produce a configure script.

 AC_PREREQ(2.61)
-AC_INIT([tinc], [1.0.35])
+AC_INIT([tinc], [1.0.36])
 AC_CONFIG_SRCDIR([src/tincd.c])
 AM_INIT_AUTOMAKE([1.11 check-news std-options subdir-objects nostdinc silent-rules -Wall])
 AC_CONFIG_HEADERS([config.h])
@ -237,7 +237,7 @@ AC_ARG_ENABLE(jumbograms,
  ]
 )

-dnl Ensure runstatedir is set if we are using a version of autoconf that does not suppport it
+dnl Ensure runstatedir is set if we are using a version of autoconf that does not support it
 if test "x$runstatedir" = "x"; then
  AC_SUBST([runstatedir], ['${localstatedir}/run'])
 fi
--- a/debian/NEWS
+++ b/debian/NEWS
@ -0,0 +1,14 @@
+tinc (1.0.27-1) unstable; urgency=medium
+
+  This package now provides native systemd service files, allowing multiple
+  instances of tinc to be managed. Existing networks listed in
+  /etc/tinc/nets.boot will be converted to service instances once during this
+  upgrade. Afterwards, you can enable and disable networks using:
+  
+    systemctl enable tinc@<netname>
+    systemctl disable tinc@<netname>
+  
+  If you do not have systemd installed, the SysV init script will continue to
+  work as usual. For more information, see README.Debian.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:33:55 +0200
--- a/debian/README.Debian
+++ b/debian/README.Debian
@ -0,0 +1,80 @@
+tinc for Debian
+---------------
+
+The manual for tinc is also available as info pages, type `info tinc'
+to read it.
+
+There are several ways in which tinc may be automatically started at boot:
+
+Systemd
+-------
+
+Since 1.0.27-1, the tinc package comes with native systemd service files.
+To enable and start a net, call:
+
+systemctl enable tinc@<netname>
+systemctl start tinc@<netname>
+
+This will cause a tincd to be started which uses the configuration from
+/etc/tinc/<netname>, and also makes sure that it will be started next time your
+system boots.
+
+Apart from controlling individual instances, you can also start/stop/reload all
+enabled instances simultaneously by omitting @<netname>, for example:
+
+systemctl reload tinc
+
+Note that when you have systemd installed on your system, the file
+/etc/tinc/nets.boot will not be used anymore to automatically start tinc
+daemons. If the variable EXTRA is defined in /etc/default/tinc, it will be
+passed on to tinc. The variable LIMITS is however not used.
+
+The service files that come with this package start tinc unconditionally.
+However, tinc does support socket activation. If you wish to write a socket
+unit for tinc, use the ListenStream option to specify on which port(s) and
+address(es) tinc should listen.
+
+SysVinit
+--------
+
+The system startup script for tinc, /etc/init.d/tinc, uses the file
+/etc/tinc/nets.boot to find out which networks have to be started. Use one
+netname per line. Lines starting with a # are ignored.
+
+/etc/network/interfaces
+-----------------------
+
+You can create a stanza in /etc/network/interfaces, and add a line with
+"tinc-net <netname>". This will cause a tincd to be started which uses the
+configuration from /etc/tinc/<netname>. You can use an inet static (with
+address and netmask options) or inet dhcp stanza, in which case the ifup will
+configure the VPN interface and you do not need to have a tinc-up script.
+
+The following options are also recognized and map directly to the corresponding
+command line options for tincd:
+
+tinc-config <directory>
+tinc-debug <level>
+tinc-mlock yes
+tinc-logfile <filename>
+tinc-pidfile <filename>
+tinc-chroot yes
+tinc-user <username>
+
+An example stanza:
+
+iface vpn inet static
+	address 192.168.2.42
+	netmask 255.255.0.0
+	tinc-net myvpn
+	tinc-debug 1
+	tinc-mlock yes
+	tinc-user nobody
+	tinc-pidfile /tmp/tinc.pid
+
+This will start a tinc daemon that reads its configuration from
+/etc/tinc/myvpn, logs at debug level 1, locks itself in RAM, runs as user
+nobody, and creates a network interface called "vpn". Ifup then sets the
+address and netmask on that interface.
+
+ -- Guus Sliepen <guus@debian.org>, Sun, 10 April 2016, 01:38:08 +0200
--- a/debian/changelog
+++ b/debian/changelog
@ -0,0 +1,685 @@
+tinc (1.0.36-2) unstable; urgency=medium
+
+  * Disable support for libvdeplug. Closes: #973233
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 22 Nov 2020 10:40:27 +0100
+
+tinc (1.0.36-1) unstable; urgency=medium
+
+  * New upstream version 1.0.36
+  * Add Vcs tags to debian/control.
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 26 Aug 2019 14:17:21 +0200
+
+tinc (1.0.35-2) unstable; urgency=medium
+
+  * Bump Standards-Version and Build-Depend on debhelper-compat (= 12).
+  * Remove calls to dh_installinit and dh_systemd_start from debian/rules,
+    compat level 12 does the right thing by default.
+  * Ensure we clean up doc/tinc.info.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 28 Jan 2019 21:54:45 +0100
+
+tinc (1.0.35-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Includes fixes for CVE-2018-16737, CVE-2018-16738, CVE-2018-16758.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 08 Oct 2018 16:09:06 +0200
+
+tinc (1.0.34-1) unstable; urgency=medium
+
+  [ Guus Sliepen ]
+  * New upstream release.
+    - Fixes a potential segmentation fault when connecting to an IPv6
+      peer via a proxy. Closes: #887401
+  * Add support for the $EXTRA variable in /etc/default/tinc when using
+    systemd. Closes: #887116
+
+  [ Benda Xu ]
+  * Prevent possible incorrect IPv6 checksums due to function inlining.
+    Closes: #891400
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 12 Jun 2018 23:00:49 +0200
+
+tinc (1.0.33-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Test for /etc/default/tinc before trying to source it. Closes: #777262
+  * Use --runstatedir=/run.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 04 Nov 2017 16:22:06 +0100
+
+tinc (1.0.32-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Add a note to new nets.boot files that it is not used with systemd.
+    Closes: #841052
+  * In the post-down script, read the pid file only once. Closes: #832784
+  * Explicitly use /bin/sleep from coreutils. Closes: #772379
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 05 Sep 2017 20:23:36 +0200
+
+tinc (1.0.31-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Bump debian/compat.
+  * Add missing Depends: lsb-base.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 15 Jan 2017 16:20:40 +0100
+
+tinc (1.0.29-2) unstable; urgency=medium
+
+  * Rebuild with libssl-dev from unstable.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Oct 2016 13:09:46 +0200
+
+tinc (1.0.29-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump debian/compat.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 10 Oct 2016 22:30:25 +0200
+
+tinc (1.0.28-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Fixes FTBFS on kfreebsd.
+  * Systemd service files are now provided by upstream.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 15:44:28 +0200
+
+tinc (1.0.27-2) unstable; urgency=medium
+
+  * Fix tinc@.service.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 12:45:33 +0200
+
+tinc (1.0.27-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Add native systemd unit files.
+  * Automatically convert networks listed in nets.boot to systemd service
+    instances on upgrade.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 10 Apr 2016 01:39:16 +0200
+
+tinc (1.0.26-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Use the contents, not the presence, of the pidfile to check that tincd is
+    shut down properly. Closes: #774682
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 05 Jul 2015 17:23:08 +0200
+
+tinc (1.0.24-2) unstable; urgency=medium
+
+  * Improve the init script: stopping tinc now waits for the process to
+    terminate. If that doesn't happen in 5 seconds, it will send the TERM
+    signal again (which helps if tinc is waiting for a script to finish
+    executing). It now also detects whether the process mentioned in the PID
+    file is actually running, and if not it will exit early and without
+    warnings. Closes: #748107
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 14 May 2014 21:44:16 +0200
+
+tinc (1.0.24-1) unstable; urgency=medium
+
+  [ Guus Sliepen ]
+  * New upstream release
+  * Add a debian/watch file.
+  * Bump Standards-Version.
+
+  [ Gian Piero Carrubba ]
+  * Allow resource limits to be set in /etc/default/tinc.
+    Closes: #690685, #704702
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 11 May 2014 21:17:13 +0200
+
+tinc (1.0.23-2) unstable; urgency=low
+
+  * Use if-statements instead of && in shell scripts. Closes: #731279
+    The && operator does not clear the error status, and if the next statement
+    in a shell script does not change the error status it would cause the
+    script to prematurely exit. Thanks to Peter Reinholdtsen for spotting it.
+  * Use absolute path to tincd in the if-post-down script.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 05 Dec 2013 09:41:13 +0000
+
+tinc (1.0.23-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 19 Oct 2013 21:06:05 +0200
+
+tinc (1.0.22-1) unstable; urgency=low
+
+  * New upstream release.
+    - Handles whitespace between command line flags and optional arguments.
+      Closes: #710267
+  * Bump Standards-Version.
+  * Source /lib/lsb/init-functions in the init.d script.
+  * Don't use texi2html anymore, use automake's install-html target which uses
+    makeinfo.
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 14 Aug 2013 15:34:29 +0200
+
+tinc (1.0.21-1) unstable; urgency=low
+
+  * New upstream release.
+    - Includes fix for CVE-2013-1428.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 05 May 2013 10:42:33 +0200
+
+tinc (1.0.19-3) unstable; urgency=high
+
+  * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 12 Apr 2013 22:52:10 +0200
+
+tinc (1.0.19-2) unstable; urgency=low
+
+  * Fix behaviour of tinc-pidfile. Closes: #679130
+  * Enable parallel building in debian/rules.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 26 Jun 2012 18:28:34 +0200
+
+tinc (1.0.19-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump debian/compat so tinc gets built with hardening flags.
+  * Allow tinc-pidfile in /etc/network/interfaces.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 25 Jun 2012 20:29:22 +0200
+
+tinc (1.0.18-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 25 Mar 2012 18:52:15 +0200
+
+tinc (1.0.17-1) unstable; urgency=low
+
+  * New upstream release.
+  * Enable support for UML and VDE.
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 10 Mar 2012 14:50:00 +0100
+
+tinc (1.0.16-1) unstable; urgency=low
+
+  * New upstream release.
+  * Mention alarm option in /etc/init.d/tinc's usage information.
+    Closes: #631761
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 23 Jul 2011 14:37:56 +0200
+
+tinc (1.0.15-1) unstable; urgency=low
+
+  * New upstream release.
+  * Send SIGALRM to running tinc daemons whenever an interface is brought up
+    with the ifupdown framework. Based on a patch from Joachim Breitner.
+    Closes: #629880
+  * Allow tinc daemons to be started using ifupdown.
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 24 Jun 2011 18:21:51 +0200
+
+tinc (1.0.14-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump Standards-Version.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 09 May 2011 00:25:37 +0200
+
+tinc (1.0.13-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 13 Apr 2010 12:06:36 +0200
+
+tinc (1.0.12-2) unstable; urgency=low
+
+  * Remove debconf questions. Closes: #572116
+    Apparently debconf may not be used to ask a question at install time and
+    use the answer at upgrade time. Instead of kludging around this
+    restriction, no questions are asked anymore, and tinc will now always be
+    restarted when upgrading.
+  * Wait up to 5 seconds for tinc daemon to stop before restarting it.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 02 Mar 2010 14:01:36 +0100
+
+tinc (1.0.12-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump Standards-Version.
+  * Migrate from CDBS to debhelper.
+  * Convert source package to 3.0 (quilt) format.
+  * Remove useless tinc.modules.
+  * Use init.d script from Michael Tokarev, allowing per-network arguments to
+    tincd.
+  * Remove update-rc.d calls from postinst and postrm.
+  * Let the init.d script depend on $remote_fs.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 04 Feb 2010 00:56:45 +0100
+
+tinc (1.0.11-1) unstable; urgency=low
+
+  * New upstream release.
+  * Cope with texi2html arbitrarily changing its output directory.
+    Closes: #552927
+  * Do not stop tinc when configuring a new version, just restart after
+    the upgrade.
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 01 Nov 2009 20:37:16 +0100
+
+tinc (1.0.10-1) unstable; urgency=low
+
+  * New upstream release.
+  * Include Russian debconf translation. Closes: #548759
+
+ -- Guus Sliepen <guus@debian.org>  Sun, 18 Oct 2009 16:31:49 +0200
+
+tinc (1.0.9-1) unstable; urgency=low
+
+  * New upstream release.
+    - Binds IPv6 sockets only to IPv6. Closes: #440150
+  * Update copyright file. Closes: #482566
+
+ -- Guus Sliepen <guus@debian.org>  Fri, 26 Dec 2008 13:25:05 +0100
+
+tinc (1.0.8-2) unstable; urgency=low
+
+  * Include Portugese debconf translation. Closes: #434191
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 14 Aug 2007 13:50:27 +0200
+
+tinc (1.0.8-1) unstable; urgency=low
+
+  * New upstream release. Closes: #173987
+  * Include german debconf translation. Closes: #412351
+  * Build-Depend on texinfo. Closes: #424209
+
+ -- Guus Sliepen <guus@debian.org>  Wed, 16 May 2007 17:59:16 +0200
+
+tinc (1.0.7-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Fri,  5 Jan 2007 15:55:42 +0100
+
+tinc (1.0.6-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 18 Dec 2006 15:41:03 +0100
+
+tinc (1.0.5-1) unstable; urgency=low
+
+  * New upstream release. Closes: #391610
+  * Add an LSB section to the init script.
+
+ -- Guus Sliepen <guus@debian.org>  Tue, 14 Nov 2006 16:32:20 +0100
+
+tinc (1.0.4-4) unstable; urgency=low
+
+  * Include swedish debconf translation. Closes: #332963
+  * Remove nets.boot on purge. Closes: #333303
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 17 Oct 2005 12:34:32 +0200
+
+tinc (1.0.4-3) unstable; urgency=low
+
+  * Depend on debconf | debconf-2.0.
+  * Include vietnamese debconf translation. Closes: #322305
+  * Include japanese debconf translation. Closes: #319591
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 29 Sep 2005 11:15:34 +0200
+
+tinc (1.0.4-2) unstable; urgency=low
+
+  * Compensate for change in texinfo's output directory. Closes: #318562
+  * Include Czech translation of the debconf questions. Closes: #312982
+
+ -- Guus Sliepen <guus@debian.org>  Sat, 16 Jul 2005 11:42:04 +0200
+
+tinc (1.0.4-1) unstable; urgency=low
+
+  * New upstream release. Closes: #294819
+  * Update french translation of debconf template. Closes: #293371, #296148
+  * Allow dashes in nets.boot. Closes: #296281
+
+ -- Guus Sliepen <guus@debian.org>  Wed,  4 May 2005 21:56:22 +0200
+
+tinc (1.0.3-4) unstable; urgency=low
+
+  * Call debconf early in postinst so it won't get confused by output
+    from other commands in the postinst script. Closes: #292920
+  * If MAKEDEV doesn't know about net/tun, fall back to tun.
+
+ -- Guus Sliepen <guus@debian.org>  Mon, 31 Jan 2005 13:27:16 +0100
+
+tinc (1.0.3-3) unstable; urgency=low
+
+  * Fix clean rule in debian/rules.
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 23:16:59 +0000
+
+tinc (1.0.3-2) unstable; urgency=low
+
+  * Don't check for /dev/tap* in postinst if we don't create them anyway.
+  * MAKEDEV expects net/tun instead of tun.
+  * Don't ask if /dev/net/tun should be created, just do it.
+    Closes: #259489, #292450
+  * Move $EXTRA from init.d/tinc to /etc/default/tinc. Closes: #281366
+
+ -- Guus Sliepen <guus@debian.org>  Thu, 27 Jan 2005 14:10:02 +0100
+
+tinc (1.0.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Adopting the package from Ivo.
+  * Use invoke-rc.d, and tell user to do so as well. Closes: #223276
+  * Let force-reload do the same thing as reload. Closes: #230180
+
+ -- Guus Sliepen <guus@debian.org>  Fri,  1 Oct 2004 21:04:14 +0200
+
+tinc (1.0.2-2) unstable; urgency=low
+
+  * debian/control: Oops, really make that automake1.7.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 21:53:04 +0100
+
+tinc (1.0.2-1) unstable; urgency=low
+
+  * New upstream release:
+      * Fix broken replies to CHAL_RESP.  (Closes: #217646)
+  * debian/control: Updated automake build dependency to automake1.7.
+    (Closes: #219360)
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat,  8 Nov 2003 19:56:04 +0100
+
+tinc (1.0.1-2) unstable; urgency=low
+
+  * debian/dirs: Removed, moved contents to tinc.dirs.
+    (Closes: #208591)
+  * debian/docs: Renamed to tinc.docs.
+  * debian/rules: Install the contents of doc/sample-config.tar.gz in
+    /usr/share/doc/tinc/examples instead of /etc/tinc.
+  * debian/Makefile*: Removed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 10 Sep 2003 12:19:32 +0200
+
+tinc (1.0.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * debian/patches/001_openbsd_device.c.patch: Removed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 14 Aug 2003 17:03:28 +0200
+
+tinc (1.0release-1) unstable; urgency=low
+
+  * New upstream version.  (Closes: #204639)
+      * Fixes switching back to normal logging mode when killing with
+        SIGINT twice.  (Closes: #175633)
+      * Uses one SSL context struct for each connection, speeding up
+        encrypting/decrypting data; don't throw away out of sequence
+        packets.  (Closes: #188874)
+      * Fixes handling of broadcast messages.  (Closes: #175632)
+  * debian/rules: Use cdbs.
+  * debian/control: Build-Depend on cdbs, liblzo-dev.
+  * debian/patches/001_openbsd_device.c.patch: Sync openbsd/device.c to
+    latest CVS version.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Aug 2003 16:13:29 +0200
+
+tinc (1.0pre8-6) unstable; urgency=low
+
+  * debian/po/fr.po: Added French debconf translation.  (Closes: #201803)
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 18 Jul 2003 10:03:20 +0200
+
+tinc (1.0pre8-5) unstable; urgency=low
+
+  * debian/*: Change to po-debconf, thanks to From: Michel Grentzinger
+    <mic.grentz@online.fr> for the patch:
+      - change debhelper dependency to 4.1.16 (according to man
+        po-debconf),
+      - manually add nl translation in old tinc.templates (master),
+      - run debconf-gettextize debian/tinc.templates,
+      - move old templates files (debian/tinc.templates.*),
+      - change construction "If you say no" to "If you refuse",
+  * debian/rules: Call po2debconf.
+  * debian/rules: Don't copy COPYING.README to the package.
+  * debian/control: Update Standards-Version.
+  * debian/conffiles: Removed.
+  * debian/postinst: No longer use mknod directly, use MAKEDEV.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 15 Jul 2003 20:13:47 +0200
+
+tinc (1.0pre8-4) unstable; urgency=low
+
+  * src/net.h, src/net_packet.c, src/net_setup.c: Apply fix from CVS
+    for OpenSSL-related memory leaks.  (Closes: #189432)
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon,  5 May 2003 15:00:29 +0200
+
+tinc (1.0pre8-3) unstable; urgency=low
+
+  * m4/openssl.m4: Updated to CVS version.  (Closes: #184400)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 13 Mar 2003 17:24:42 +0100
+
+tinc (1.0pre8-2) unstable; urgency=low
+
+  * debian/postinst: Create /dev/net/tun if it doesn't exist.
+  * debian/tinc.modules: Add alias for /dev/net/tun.
+  * debian/rules: Install tinc.modules.
+  * These things together: (Closes: #151967, #153156)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Nov 2002 22:45:38 +0100
+
+tinc (1.0pre8-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/rules:
+      - DEB_BUILD_OPTIONS support.
+      - Enable --enable-tracing by default.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 17 Sep 2002 13:50:44 +0200
+
+tinc (1.0pre7-3) unstable; urgency=low
+
+  * Properly install _all_ info pages. (Closes: #144718)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 29 May 2002 14:01:21 +0200
+
+tinc (1.0pre7-2) unstable; urgency=low
+
+  * Dutch translation wasn't being installed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 11 Apr 2002 09:26:14 +0200
+
+tinc (1.0pre7-1) unstable; urgency=medium
+
+  * New upstream release.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue,  9 Apr 2002 16:04:46 +0200
+
+tinc (1.0pre6-3) unstable; urgency=medium
+
+  * Synched with upstream CVS.
+  * Added build dependency on zlib1g-dev. (Closes: #141705)
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon,  8 Apr 2002 21:19:31 +0200
+
+tinc (1.0pre6-2) unstable; urgency=low
+
+  * The Section was non-US again, so changed it back to main/net.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 28 Mar 2002 07:26:10 +0100
+
+tinc (1.0pre6-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixed text in debian/copyright
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 27 Mar 2002 23:10:07 +0100
+
+tinc (1.0pre5-4) unstable; urgency=low
+
+  * Added a debconf question for restarting on upgrade.
+  * Added reload option to init.d, start with EXTRA='-d' default.
+  * Moved from non-US to main.
+  * Install example configuration files.
+  * The HTML documentation wasn't installed; fixed.
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 26 Mar 2002 20:14:19 +0100
+
+tinc (1.0pre5-3) unstable; urgency=low
+
+  * Config variables are now treated case sentitivly again.
+  * Added a forgotten xstrdup.
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 15 Feb 2002 12:35:17 +0100
+
+tinc (1.0pre5-2) unstable; urgency=low
+
+  * MaxTimeout accidentally wasn't configurable. (Closes: #119653)
+
+ -- Ivo Timmermans <ivo@debian.org>  Wed, 13 Feb 2002 13:36:54 +0100
+
+tinc (1.0pre5-1) unstable; urgency=low
+
+  * New upstream version. (Closes: #119653)
+  * Init script redone in sh.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun, 10 Feb 2002 16:39:53 +0100
+
+tinc (1.0pre4-1.cvs010621.6) unstable; urgency=low
+
+  * Somehow po-Makefile.in.in.diff got lost, readded. (Closes: #119157)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 15 Nov 2001 17:00:03 +0100
+
+tinc (1.0pre4-1.cvs010621.5) unstable; urgency=low
+
+  * Fix a typo in postinst that let it MAKEDEV even on devfs.
+    (Closes: #116034)
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 18 Oct 2001 09:35:16 +0200
+
+tinc (1.0pre4-1.cvs010621.4) unstable; urgency=low
+
+  * Ask before creating the device files. (Closes: #111099)
+  * Add a section to the info file.
+
+ -- Ivo Timmermans <ivo@debian.org>  Fri, 12 Oct 2001 20:47:09 +0200
+
+tinc (1.0pre4-1.cvs010621.3) unstable; urgency=low
+
+  * Build and install html documentation. (Closes: #106843)
+  * Remove build-time dependency on libc6-dev.
+
+ -- Ivo Timmermans <ivo@debian.org>  Mon, 30 Jul 2001 22:03:52 +0200
+
+tinc (1.0pre4-1.cvs010621.2) unstable; urgency=low
+
+  * Changed location of the pidfile. (Closes: #102798)
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun,  1 Jul 2001 01:57:43 +0200
+
+tinc (1.0pre4-1.cvs010621.1) unstable; urgency=low
+
+  * New upstream version. (Closes: #98730)
+  * Rebuilding automatically inserted new config.{sub|guess}.
+    (Closes: #98165)
+  * Updated Standards-Version.
+  * Don't include a sample configuration file.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu, 21 Jun 2001 14:08:49 +0200
+
+tinc (1.0pre3-5) unstable; urgency=low
+
+  * Fixed an error in the init script that prevented tinc from
+    starting correctly.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu,  8 Feb 2001 02:45:09 +0100
+
+tinc (1.0pre3-4) unstable; urgency=low
+
+  * Change build-depends for OpenSSL to libssl096-dev
+    (Closes: #84197, #84873).
+
+ -- Ivo Timmermans <ivo@debian.org>  Sun,  4 Feb 2001 22:43:22 +0100
+
+tinc (1.0pre3-3) unstable; urgency=low
+
+  * Set architecture to any (really this time!) (Closes: #80451).
+  * Section set to non-US
+
+ -- Ivo Timmermans <ivo@debian.org>  Tue, 23 Jan 2001 22:52:53 +0100
+
+tinc (1.0pre3-2) unstable; urgency=low
+
+  * Set architecture to any (Closes: #80451).
+  * Added tinc.modules with some useful module aliases.
+
+ -- Ivo Timmermans <ivo@debian.org>  Sat, 13 Jan 2001 16:10:57 +0100
+
+tinc (1.0pre3-1) unstable; urgency=low
+
+  * New upstream version (1.0pre3) (Closes: #71274).
+  * Better Depends and Build-Depends lines.
+  * Dropped dependencies on libgmp, added libssl.
+  * doc-base.tinc: New file.
+  * Deleted the file shlibs, as there on longer is a libblowfish.
+  * Patch po/Makefile.in.in from po-Makefile.in.in.diff if necessary.
+  * Use dh_perl to get accurate perl dependencies.
+
+ -- Ivo Timmermans <ivo@debian.org>  Thu,  9 Nov 2000 21:58:40 +0100
+
+tinc (1.0pre2-1.1) unstable; urgency=low
+
+  * NMU at Ivo's request as his application is being processed, and his
+    sponsor is based in the US.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 Jun 2000 21:52:30 +0200
+
+tinc (1.0pre2-1) unstable; urgency=low
+
+  * postinst creates a file /etc/tinc/nets.boot, containing all networks
+    to be started upon system startup;
+  * init.d script starts all networks from that list.
+  * postinst script creates tap devices.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Tue, 16 May 2000 00:06:25 +0200
+
+tinc (1.0pre1-0.4) unstable; urgency=low
+
+  * postinst script.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Mon, 15 May 2000 19:22:05 +0200
+
+tinc (1.0pre1-0.3) unstable; urgency=low
+
+  * system startup script.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Sun, 14 May 2000 22:58:02 +0200
+  
+tinc (1.0pre1-0.2) unstable; urgency=low
+
+  * Included the blowfish license.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
+
+tinc (1.0pre1-0.1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Ivo Timmermans <itimmermans@bigfoot.com>  Fri, 21 Apr 2000 17:07:50 +0200
+
+
--- a/debian/control
+++ b/debian/control
@ -0,0 +1,20 @@
+Source: tinc
+Section: net
+Priority: optional
+Maintainer: Guus Sliepen <guus@debian.org>
+Standards-Version: 4.4.0
+Build-Depends: libssl-dev, debhelper-compat (= 12), gettext, texinfo, zlib1g-dev, liblzo2-dev
+Homepage: http://www.tinc-vpn.org/
+Vcs-Browser: https://salsa.debian.org/guus/tinc
+Vcs-Git: https://salsa.debian.org/guus/tinc.git
+Rules-Requires-Root: no
+
+Package: tinc
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 3.0-6)
+Description: Virtual Private Network daemon
+ tinc is a daemon with which you can create a virtual private network
+ (VPN). One daemon can handle multiple connections, so you can
+ create an entire (moderately sized) VPN with only one daemon per
+ participating computer.
--- a/debian/copyright
+++ b/debian/copyright
@ -0,0 +1,34 @@
+This package was debianized by Ivo Timmermans <ivo@debian.org> on
+Fri, 21 Apr 2000 17:07:50 +0200.
+
+It was downloaded from http://www.tinc-vpn.org/
+
+Upstream Authors:
+ Guus Sliepen <guus@tinc-vpn.org>
+ Ivo Timmermans <ivo@tinc-vpn.org>
+
+Copyright (C) 1998-2005 Ivo Timmermans
+              1998-2008 Guus Sliepen <guus@tinc-vpn.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+On Debian GNU/Linux systems, the complete text of the GNU General Public
+License version 2 can be found in /usr/share/common-licenses/GPL-2.
+
+The following applies to tinc:
+
+This program is released under the GPL with the additional exemption
+that compiling, linking, and/or using OpenSSL is allowed.  You may
+provide binary packages linked to the OpenSSL libraries, provided that
+all other requirements of the GPL are met.
+
+The following applies to the LZO library:
+
+Hereby I grant a special exception to the tinc VPN project
+(http://tinc.nl.linux.org/) to link the LZO library with the OpenSSL library
+(http://www.openssl.org).
+
+Markus F.X.J. Oberhumer
--- a/debian/doc-base.tinc
+++ b/debian/doc-base.tinc
@ -0,0 +1,10 @@
+Document: tinc
+Title: tinc Manual
+Author: Ivo Timmermans, Guus Sliepen
+Abstract: This manual describes how to set up a Virtual Private
+ Network with tinc.
+Section: System/Security
+
+Format: HTML
+Files: /usr/share/doc/tinc/tinc.html/*
+Index: /usr/share/doc/tinc/tinc.html/index.html
--- a/debian/info
+++ b/debian/info
@ -0,0 +1 @@
+doc/tinc.info
--- a/debian/patches/fix-incorrect-icmpv6-checksum
+++ b/debian/patches/fix-incorrect-icmpv6-checksum
@ -0,0 +1,65 @@
+Package: tinc
+Version: 1.0.33-1
+Severity: important
+
+Dear Guus,
+
+I have been using tinc since 2009 and it is great!
+
+When PMTUDiscovery=yes and Mode=switch, and if ipv6 is used inside
+tinc, the ICMPv6 "Packet Too Big" packets have incorrect checksums.
+It can be reproduced by `ping6 <host in tinc> -s 1800` and `tcpdump -i
+<tinc interface>`.  Consequently, the host ignores the tinc-generated
+ICMPv6 packets, PMTUDiscovery does not work and the connections freeze
+when data flows are big.
+
+I find the bug is gone if the function "inet_checksum" in route.c is
+not inlined, either by compiling tinc with "-O2
+-fno-inline-functions", or apply a patch such as,
+
+diff --git a/src/route.c b/src/route.c
+index ff82c06e..cd55383a 100644
+--- a/src/route.c
+++ b/src/route.c
+@@ -60,7 +60,7 @@ static const size_t opt_size = sizeof(struct nd_opt_hdr);
+
+ /* RFC 1071 */
+
+-static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
+__attribute__ ((noinline)) static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
+ 	uint16_t *p = data;
+ 	uint32_t checksum = prevsum ^ 0xFFFF;
+
+
+
+I have tested with gcc-7.3.0 and gcc-5.4.0.  They behaved the same.  I
+am not good at assembly to find out what really happened, but it is
+for sure that inet_checksum does not work as expected if compiled
+inline.
+
+Thanks!
+
+Yours,
+Benda
+
+-- System Information:
+Debian Release: buster/sid
+  APT prefers unstable
+  APT policy: (500, 'unstable')
+Architecture: amd64 (x86_64)
+
+Kernel: Linux 4.9.0-5-amd64 (SMP w/8 CPU cores)
+Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
+Shell: /bin/sh linked to /bin/dash
+Init: sysvinit (via /sbin/init)
+
+Versions of packages tinc depends on:
+ii  libc6      2.26-2
+ii  liblzo2-2  2.08-1.2+b2
+ii  libssl1.1  1.1.0g-2
+ii  lsb-base   9.20170808
+ii  zlib1g     1:1.2.8.dfsg-5
+
+tinc recommends no packages.
+
+tinc suggests no packages.
--- a/debian/patches/series
+++ b/debian/patches/series
@ -0,0 +1,2 @@
+fix-incorrect-icmpv6-checksum
+support-etc-defaults-tinc
--- a/debian/patches/support-etc-defaults-tinc
+++ b/debian/patches/support-etc-defaults-tinc
@ -0,0 +1,12 @@
+--- a/systemd/tinc@.service.in
+++ b/systemd/tinc@.service.in
+@@ -9,7 +9,8 @@
+ [Service]
+ Type=simple
+ WorkingDirectory=@sysconfdir@/tinc/%i
+-ExecStart=@sbindir@/tincd -n %i -D
+EnvironmentFile=/etc/default/tinc
+ExecStart=@sbindir@/tincd -n %i -D $EXTRA
+ ExecReload=@sbindir@/tincd -n %i -kHUP
+ KillMode=mixed
+ Restart=on-failure
--- a/debian/postinst
+++ b/debian/postinst
@ -0,0 +1,31 @@
+#! /bin/sh
+
+NETSFILE="/etc/tinc/nets.boot"
+
+set -e
+
+case "$1" in
+    configure)
+	if [ ! -e /dev/.devfsd ] ; then if [ ! -e /dev/.devfs ] ; then
+		if [ ! -e /dev/net/tun ] ; then if [ ! -e /dev/tun ] ; then if [ -e /dev/MAKEDEV ]; then
+			echo "Creating tun device..."
+			cd /dev && ./MAKEDEV net/tun 2>/dev/null || ./MAKEDEV tun 2>/dev/null || echo "Failed to create tun device."
+		fi; fi; fi
+	fi; fi
+
+	if [ ! -e $NETSFILE ] ; then
+	    echo "## This file contains all names of the networks to be started on system startup when using sysvinit." > $NETSFILE
+	    echo "## If you are using systemd, use systemctl enable tinc@netname to enable individual networks." >> $NETSFILE
+	fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+#DEBHELPER#
--- a/debian/postrm
+++ b/debian/postrm
@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = purge ]; then
+    rm -f /etc/tinc/nets.boot
+fi
+
+#DEBHELPER#
--- a/debian/preinst
+++ b/debian/preinst
@ -0,0 +1,28 @@
+#!/bin/sh
+
+NETSFILE="/etc/tinc/nets.boot"
+SYSTEM="/lib/systemd/system"
+WANTS="/etc/systemd/system/multi-user.target.wants"
+
+set -e
+
+case "$1" in
+	upgrade)
+		if dpkg --compare-versions "$2" '<<' "1.0.27-1"; then
+			if [ -f "$NETSFILE" ]; then
+				echo -n "Creating systemd service instances from nets.boot:"
+				mkdir -p "$WANTS"
+				egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
+					echo -n " $net"
+					ln -s "$SYSTEM/tinc@.service" "$WANTS/tinc@$net.service" 2>/dev/null || true
+				done
+				echo "."
+			fi
+		fi
+	;;
+
+	*)
+	;;
+esac
+
+#DEBHELPER#
--- a/debian/rules
+++ b/debian/rules
@ -0,0 +1,16 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@
+
+override_dh_clean:
+	dh_clean
+	rm -f doc/tinc.info
+
+override_dh_auto_configure:
+	dh_auto_configure -- --enable-uml --with-systemd=/lib/systemd/system --runstatedir=/run
+
+override_dh_auto_install:
+	dh_auto_install -- install-html
+	# Remove info dir file
+	rm -f debian/tinc/usr/share/info/dir
--- a/debian/source/format
+++ b/debian/source/format
@ -0,0 +1 @@
+3.0 (quilt)
--- a/debian/tinc.default
+++ b/debian/tinc.default
@ -0,0 +1,7 @@
+# Extra options to be passed to tincd.
+# EXTRA="-d"
+
+# Limits to be configured for the tincd process. Please read your shell
+# (pointed by /bin/sh) documentation for ulimit. You probably want to raise the
+# max locked memory value if using both --mlock and --user flags.
+# LIMITS="-l 1024"
--- a/debian/tinc.dirs
+++ b/debian/tinc.dirs
@ -0,0 +1,7 @@
+usr/sbin
+usr/share
+etc
+etc/init.d
+usr/share/locale
+usr/share/doc/tinc
+etc/tinc
--- a/debian/tinc.docs
+++ b/debian/tinc.docs
@ -0,0 +1,3 @@
+NEWS
+README
+AUTHORS
--- a/debian/tinc.files
+++ b/debian/tinc.files
@ -0,0 +1,6 @@
+usr/sbin/tincd
+usr/share/man
+etc
+usr/share/doc/tinc
+usr/share/locale
+usr/share/info
--- a/debian/tinc.if-post-down
+++ b/debian/tinc.if-post-down
@ -0,0 +1,41 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+# Determine location of the PID file
+
+EXTRA=""
+if [ -n "$IF_TINC_PIDFILE" ]; then
+	EXTRA="--pidfile=$IF_TINC_PIDFILE"
+else
+	IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
+fi
+
+# Stop the tinc daemon
+
+read pid rest < $IF_TINC_PIDFILE 2>/dev/null
+
+/usr/sbin/tincd -n "$IF_TINC_NET" -k $EXTRA
+
+# Wait for it to shut down properly
+
+/bin/sleep 0.1
+i=0;
+while [ -f $IF_TINC_PIDFILE ] ; do
+	if [ ! -e "/proc/$pid" ] ; then
+		exit 0
+	fi
+
+	if [ $i = '30' ] ; then
+		echo 'Failed to stop tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+exit 0
--- a/debian/tinc.if-pre-up
+++ b/debian/tinc.if-pre-up
@ -0,0 +1,70 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -z "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+# Read options from /etc/default
+
+[ -r /etc/default/tinc ] && . /etc/default/tinc
+
+# Set process limits
+
+setlimits() {
+  while [ $# -gt 0 ]; do
+    parm=$1 ; shift
+    if [ -n "$1" -a "${1#-}" = "$1" ]; then
+      value=$1 ; shift
+      ulimit $parm $value
+    else
+      ulimit $parm
+    fi
+  done
+}
+
+test -n "$LIMITS" && setlimits $LIMITS
+
+# Read options from /etc/network/interfaces
+
+[ -n "$IF_TINC_CONFIG" ]          && EXTRA="$EXTRA -c $IF_TINC_CONFIG"
+[ -n "$IF_TINC_DEBUG" ]           && EXTRA="$EXTRA -d$IF_TINC_DEBUG"
+[ -n "$IF_TINC_MLOCK" ]           && EXTRA="$EXTRA --mlock"
+[ -n "$IF_TINC_LOGFILE" ]         && EXTRA="$EXTRA --logfile=$IF_TINC_LOGFILE"
+[ -n "$IF_TINC_PIDFILE" ]         && EXTRA="$EXTRA --pidfile=$IF_TINC_PIDFILE" || IF_TINC_PIDFILE=/var/run/tinc.$IF_TINC_NET.pid
+[ -n "$IF_TINC_CHROOT" ]          && EXTRA="$EXTRA --chroot"
+[ -n "$IF_TINC_USER" ]            && EXTRA="$EXTRA --user=$IF_TINC_USER"
+
+
+# Start tinc daemon
+
+/usr/sbin/tincd -n "$IF_TINC_NET" -o "Interface=$IFACE" $EXTRA
+
+# Wait for it to come up properly
+
+/bin/sleep 0.1
+i=0;
+while [ ! -f $IF_TINC_PIDFILE ] ; do
+	if [ $i = '30' ] ; then
+		echo 'Failed to start tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+while read pid rest < $IF_TINC_PIDFILE ; do
+	if [ -e "/proc/$pid" ] ; then
+		exit 0
+	fi
+
+	if [ $i = '30' ] ; then
+		echo 'Failed to start tinc daemon!'
+		exit 1
+	fi
+	/bin/sleep 0.1
+	i=$(($i+1))
+done
+
+exit 0
--- a/debian/tinc.if-up
+++ b/debian/tinc.if-up
@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$METHOD" = loopback -o -n "$IF_TINC_NET" ]; then
+	exit 0
+fi
+
+invoke-rc.d tinc alarm || exit 0
--- a/debian/tinc.init
+++ b/debian/tinc.init
@ -0,0 +1,140 @@
+#! /bin/sh
+#
+### BEGIN INIT INFO
+# Provides:          tinc
+# Required-Start:    $remote_fs $network
+# Required-Stop:     $remote_fs $network
+# Should-Start:      $syslog $named
+# Should-Stop:       $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start tinc daemons
+# Description:       Create a file $NETSFILE (/etc/tinc/nets.boot),
+#                    and put all the names of the networks in there.
+#                    These names must be valid directory names under
+#                    $TCONF (/etc/tinc). Lines starting with a # will be
+#                    ignored in this file.
+### END INIT INFO
+#
+# Based on Lubomir Bulej's Redhat init script.
+
+. /lib/lsb/init-functions
+
+DAEMON="/usr/sbin/tincd"
+NAME="tinc"
+DESC="tinc daemons"
+TCONF="/etc/tinc"
+NETSFILE="$TCONF/nets.boot"
+NETS=""
+
+test -f $DAEMON || exit 0
+
+[ -r /etc/default/tinc ] && . /etc/default/tinc
+
+# foreach_net "what-to-say" action [arguments...]
+foreach_net() {
+  if [ ! -f $NETSFILE ] ; then
+    echo "Please create $NETSFILE."
+    exit 0
+  fi
+  echo -n "$1"
+  shift
+  egrep '^[ ]*[a-zA-Z0-9_-]+' $NETSFILE | while read net args; do
+    echo -n " $net"
+    "$@" $net $args
+  done
+  echo "."
+}
+
+signal_running() {
+  for i in /var/run/tinc.*pid; do
+    if [ -f "$i" ]; then
+      head -1 $i | while read pid; do
+        kill -$1 $pid
+      done
+    fi
+  done
+}
+
+setlimits() {
+  while [ $# -gt 0 ]; do
+    parm=$1 ; shift
+    if [ -n "$1" -a "${1#-}" = "$1" ]; then
+      value=$1 ; shift
+      ulimit $parm $value
+    else
+      ulimit $parm
+    fi
+  done
+}
+
+test -n "$LIMITS" && setlimits $LIMITS
+
+start() {
+  $DAEMON $EXTRA -n "$@"
+}
+
+stop() {
+  [ -f /var/run/tinc.$1.pid ] || return
+  read pid rest </var/run/tinc.$1.pid || return
+  kill -0 "$pid" 2>/dev/null || return
+
+  $DAEMON -n $1 -k || return
+
+  i=0;
+  /bin/sleep 0.5
+
+  # Wait for the pidfile to disappear
+  while [ -f /var/run/tinc.$1.pid ]; do
+    # And check that there is an actual process running
+    kill -0 "$pid" 2>/dev/null || return
+
+    if [ $i = '10' ] ; then
+      # It's still alive, kill it again and give up
+        $DAEMON -n $1 -k && /bin/sleep 0.5
+      break
+    else
+      echo -n "."
+      i=$(($i+1))
+    fi
+
+    /bin/sleep 0.5
+  done
+}
+
+reload() {
+  $DAEMON -n $1 -kHUP
+}
+
+alarm() {
+  $DAEMON -n $1 -kALRM
+}
+
+restart() {
+  stop "$@"
+  start "$@"
+}
+
+case "$1" in
+  start)
+    foreach_net "Starting $DESC:" start
+  ;;
+  stop)
+    foreach_net "Stopping $DESC:" stop
+  ;;
+  reload|force-reload)
+    foreach_net "Reloading $DESC configuration:" reload
+  ;;
+  restart)
+    foreach_net "Restarting $DESC:" restart
+  ;;
+  alarm)
+    signal_running ALRM
+  ;;
+  *)
+    echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|alarm}"
+    exit 1
+  ;;
+esac
+
+exit 0
--- a/debian/upstream/signing-key.asc
+++ b/debian/upstream/signing-key.asc
@ -0,0 +1,70 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBEVZzTABEADawFv/ibQ48uA1eRhL07vdM36Pcq2HDyuyNA+vYEalNH4jLmha
+nGPvDALWwX0DXIWDAG8zeTj8s8zliLIjuPS4WRI2YdKIvWeG9fEvpKSXVWa42ica
+dpzn/H2aBd4Ax6rQaiTXKOvxANAp2Veb+73ssPV5AL00uGTpzhh98xQzfFQCZ9ZL
+YSVPqbMed5oCt/4jM9FBO2CuBtkfiO0dVVYtW7FAVjcIlE2NaZol/KGvz7wsS+yA
+dE42W0l5MdQueLmTF4AIUSSTyPFGMQoyqh+MPif73Y589IGcW6GdfKYWnVDo6Trh
+HOhcEky+uTYKb6NL0vrJgUiYVMzAOXFDdJni1eQGO6EfZRNYtTga3alWq/jVelK7
+BID5JyNbkrTAqdPnhJGivVyk8gGX3+Hng8rkXTfWhp6yAYau1QfBm0F2tIQmpL1C
+7DoLvFErboQf685jXJBjzyvsJxB2ZLH1OOw6mNL0hy2LFkIyGza/bktY2em4apo
+KWV5AM5LpyW6THH1oDS7706xFNkf4IFhKE0hKPzBiRnMDjRtMI131lkc5+P8Lqf5
+jLTCFUgbEhU6Dz2YjhHAumVm0NWJETUpFDtVvMrqk+mp5xldUOWRNlYQC5aQOyda
+eHOlNzB/BFbPhKMWI/zWlEH6f0t6WjHb4iwpWO47511aVNHF59aPzbAHxwARAQAB
+tC9UaW5jIERldmVsb3BtZW50IFRlYW0gPHRpbmMtZGV2ZWxAdGluYy12cG4ub3Jn
+PokCNgQTAQIAIAUCRVnNMAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEEpg
+hLnA1x9KxOAQAMPhO2WTXv9AaGQBQhyyoGseKoSfcRjtI9YEfE0OInQQ2E+SPYF/
+dkfeLGAUqa4foTYQlMqfw70vBhTdVCb7HLTGn6/ICFUtDwakUQCgUQGlUVQiondA
+8W6jj+QWrh5BQhHuXy2nCVaKnksu0/xQPsJotghxuYqaot3iJ4qVw9iT/Yeo9irH
+Ffftqu0OVCdQ5zQuFNI9YCv/C83L59ecH7bOzYz2efTyobvxrhmgQtgOQwCWOE09
+Kr3veM9KLG33YoXlqv8QN/3CwtsJvSwfhj+R2JowZC7RqHe/yznRzmRMsgbrolxi
+uiJLonGxcNNkD7WhXi7/zL4A/JaC27XrFf1MPLv8aiTwnOIfrXd5jawpauUOZOXK
+UjIZHlIqviB0r5s7A+AFeHW38Tp9VzNuQ7aEl5bHbSXV+s7DTAwGb279z0AVaJ3h
+5hWFxupw7UoGdzROwCBYzeX3sioAL6QvkXua8X6zOH45VEiSwrRX3Hlx/MLo7Z4g
+PWgFLf6WviHQXCG834To1XIwUk9RgNsL7OzGjtaCuRymADImKMNwierq2zTfoRFQ
+v9onIadIMF1fsc70hiBG9yAi36MEuk4VxG8Jc3PQQfSFm4RWazv1k3E0AAIob2Ek
+DLVjvLO62Navo/OQ6D7yyiX0qes5S7/k3F1h8+87eRn3yxZE2kbxPg8KuQENBEVZ
+zYYBCACoYgExmMKEtABL3pir/IXI4exR/45hkP6txFIrkVQb8DGJ9H39kiDr4gtj
+F+pvcgMpec35S3m4fJ7WhDNvbDB4ZvONc1NMKs9cqDXfB+TLWPm4W+SkcKUrs+nK
+i8l7ieggTALJcvRoLTX2EFmUFrD6y870W3rK2SfC/0VJX8Ou5cPbwCeueExjo5x0
+3gNfu0jWUS0cyA9y+1rVVekrLuJY/+SI4jv3gdzrYbxD0f6dpbpC37QHoJdd0KGF
+acPtT2azjY+HxW10EA3Aw9oZWFXnb1nFg2RbDpkaGLmLbaXweltLyw154UmCXxym
+PXPqi9bSfEkj0GiYrapk4mW114u9ABEBAAGJA0QEGAECAA8FAkVZzYcCGwIFCQHh
+M4ABKQkQSmCEucDXH0rAXSAEGQECAAYFAkVZzYcACgkQ017duBDeLmmu3wf/TFZM
+tLKxiyQPtGSTE3eULPdWCEMDZXdSPTY0QHM7Zvh+qn1ei+iFpD0549MYnBEAwDIV
+4o62Nrcg8IPu0CEkZIAn2JiFFGYvMGk91awZGV1GS3umd7Dt349E1oKDPZVzRn+j
+QIKarXxxabRmx2s/dZZgSs/eguWTboBFmvls9tVfe8x/xPvcHFmqHVUoGKEJy6Tm
+no+s4yNjpc5wAaRml+GYf1tK9WMFuZn79qKxkYv4WI96dXR0FL59YbFRkkaI+1/b
+G31MvWTqVjY1nJGslByFPUUB8Ca1djtp1gx6NXnOYr3V5MEDfdbjjPu79No+/y6M
+tIua5yNtSRlk2nKhIqo3D/sGQ/uHijiMRAtoLhiyqYMc9W9vx/KOoCUHoMJqE39a
+Eputvgwwo0rwgSmNfB1dzneFojBdJ47WBSHC8NKtkpJj6mzvvlaI9jmEpK54x3nl
+OmBj3X/xaepoRGAtrmgTBP4A9hSjrTMGu/tUQjlX+Xcr6n3g7GSVe5FpUyIMPXEU
+JZDTiEUyn1OdzfNGmnWP+KJX5pQVq4czf5XK6otLZJELDVw/Hbjnjmdz5WOKgEH
+jSof3WPeMBgPAcd/cMAZeiGtWM1UpJBHqEXTkthmrpmtRftJKDbooNM9d5OwKiT+
+I3vNBv/plMSr8NDjhTWC+ihrN6RBj1vaqpDgGpucPhoO2hwNqWuI4q5WUKtCyw6J
+An7ErNaH4c0nVaZq6kJ8Vxdt+LpKYmOsJ8y9xtl6StcrkKNn+6ZfCfee7DEo2bvb
+scfpqJqqOqb5KOagTpYs8mo6yQ3leRvFtoeBOQHVQzct23EwOMxbDyeunT50a1eH
+MZTEWuIiuCUudM81QXU46oIcaAtj8tpG0Tmnku9g27EjwxUt+8kVmhlPHMb2TdoF
+k5d0ce+JuxIG5+i+t8sUCorMc8zfp4g1bxZeMOcPnfyO3bSW11EVcN7ZxHlFC+XE
+YOByP50CM3P8lItPlQ+WpY9kYWjiwu9kVPaGQ16G47nspngJInU5dhka3KJGtIZe
+q7kBDQRFWc3GAQgAz/JUs24niKsd0ZtOjUWd4R4y0gjS0kC/vvLL2gbXYkA9tcjG
+5iEvVWJY34QsudX0v1ULsVnJ89X/gsk8hAhAia1TQm+0Qq+MSxEaQkMSaOO8N70U
+XzgH1dielvpea20WO4MyWQuRIJ0K2nsGmEPnt6ZP7fK8HVHFNggP/mQ6LMu1reAF
+gvb8cEtjb9B5QaCUEoLjsbsuo+vLW7AWy4GfIRNESHw2Qt08AUaGrihpu6zi7N2b
+QkHHJtqa63GzYJ+kYzAVvrFJXdwL/TRXLBzv+6yyvYSIHi8uB6/o6CZN6hpjfpME
+ph+oYPqXeNOyMd1E9Kg8ymcPrNyQKfE3WnCRXQARAQABiQIlBBgBAgAPBQJFWc3H
+AhsMBQkB4TOAAAoJEEpghLnA1x9KXYMP/3D9JYti6C8DWuX2hWv+2SUbLcMa5u1e
+ETewIo5S3mqGWSaxX4YLPVRkZ1lOLmFysOLimf0thYm7IsatLcWmBdYUpK92ilvr
+Sk2sKlhrOoBXEX/79Kz+Aj5PjeyiQxgQ7Ba/afwhU6aTqs2Dp1T0YNu2eBvV+1QH
+lZnW2Wh96zzwc0dJUuY9eBk5Fgpu08Wce7o6jxFPtVyAaQa0zcNAmw2TSY7wbunJ
+WTl9OgATAyqVCuhWW7AnPcSqkH8lQigSc00wfqJKOD2Us0FqN6UKDCZTyQkdP6hx
+G+3aUkkvGSOxy7u9bVWmrikuJMoiIY/CH/m+GcJJATVibI7t5MhhtBGySKc3PAwc
+58sVe9AnbDvs84efrNP59j2KG2KKqcqjTGAmKyJnG3N50xJGakDIsqfneIRNWpEE
+pOOPaOqR4qnPAS9OSt9A3hqBpWPjQcScd6AuO+J2PE5y23pTnb9PtLBQb5e4VFiv
+N54u8j4bU2CO0SC2isZ3CR68dPHthWsxt4XbjhgktjbpQRQ8L2EDBQ8oE13GOrOw
+P8x4Q0eC5uzkXNyRqzKOsxlZEuc+75aDDd3M2GDw08FG7GI1p/L+NgenwT+9TmFX
+2hOKVrjgyx+fPut1t5DJJubDWXGOK33qvrL7HTCEv1zz7LNbbPwwNHK4lfMAWuJW
+D9wc3Y9Se/P/
+=5MAs
+-----END PGP PUBLIC KEY BLOCK-----
--- a/debian/watch
+++ b/debian/watch
@ -0,0 +1,2 @@
+version=3
+opts=pgpsigurlmangle=s/$/.sig/ http://www.tinc-vpn.org/packages/tinc-(1\.0\.\d+)\.tar\.gz
--- a/2
+++ b/2
@ -3,7 +3,7 @@

 scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1999-2018 Free Software Foundation, Inc.
+# Copyright (C) 1999-2020 Free Software Foundation, Inc.

 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/doc/Makefile.in
+++ b/doc/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
--- a/doc/texinfo.tex
+++ b/doc/texinfo.tex
--- a/doc/tinc.info
+++ b/doc/tinc.info
@ -1,14 +1,14 @@
-This is tinc.info, produced by makeinfo version 6.5 from tinc.texi.
+This is tinc.info, produced by makeinfo version 6.7 from tinc.texi.

 INFO-DIR-SECTION Networking tools
 START-INFO-DIR-ENTRY
 * tinc: (tinc).              The tinc Manual.
 END-INFO-DIR-ENTRY

-This is the info manual for tinc version 1.0.35, a Virtual Private
+This is the info manual for tinc version 1.0.36, a Virtual Private
 Network daemon.

-   Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen
+   Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen
 <guus@tinc-vpn.org> and Wessel Dankers <wsl@tinc-vpn.org>.

   Permission is granted to make and distribute verbatim copies of this
@ -117,10 +117,10 @@ for both the receiving and sending end, it has become largely
 runtime-configurable--in short, it has become a full-fledged
 professional package.

-   Tinc also allows more than two sites to connect to eachother and form
-a single VPN. Traditionally VPNs are created by making tunnels, which
-only have two endpoints.  Larger VPNs with more sites are created by
-adding more tunnels.  Tinc takes another approach: only endpoints are
+   Tinc also allows more than two sites to connect to each other and
+form a single VPN. Traditionally VPNs are created by making tunnels,
+which only have two endpoints.  Larger VPNs with more sites are created
+by adding more tunnels.  Tinc takes another approach: only endpoints are
 specified, the software itself will take care of creating the tunnels.
 This allows for easier configuration and improved scalability.

@ -791,13 +791,13 @@ DeviceType = <TYPE> (platform dependent)

     uml (not compiled in by default)
          Create a UNIX socket with the filename specified by DEVICE, or
-          '/var/run/NETNAME.umlsocket' if not specified.  Tinc will wait
-          for a User Mode Linux instance to connect to this socket.
+          '/run/NETNAME.umlsocket' if not specified.  Tinc will wait for
+          a User Mode Linux instance to connect to this socket.

     vde (not compiled in by default)
          Uses the libvdeplug library to connect to a Virtual
          Distributed Ethernet switch, using the UNIX socket specified
-          by DEVICE, or '/var/run/vde.ctl' if not specified.
+          by DEVICE, or '/run/vde.ctl' if not specified.

     Also, in case tinc does not seem to correctly interpret packets
     received from the virtual network device, it can be used to change
@ -1597,7 +1597,7 @@ command line options.
     '/var/log/tinc.NETNAME.log'.

 '--pidfile=FILE'
-     Write PID to FILE instead of '/var/run/tinc.NETNAME.pid'.
+     Write PID to FILE instead of '/run/tinc.NETNAME.pid'.

 '--bypass-security'
     Disables encryption and authentication.  Only useful for debugging.
@ -2278,7 +2278,7 @@ address these issues in tinc 2.0.
   Cryptography is a hard thing to get right.  We cannot make any
 guarantees.  Time, review and feedback are the only things that can
 prove the security of any cryptographic product.  If you wish to review
-tinc or give us feedback, you are stronly encouraged to do so.
+tinc or give us feedback, you are strongly encouraged to do so.


 File: tinc.info,  Node: Platform specific information,  Next: About us,  Prev: Technical information,  Up: Top
@ -2720,66 +2720,71 @@ Node: Top806
 Node: Introduction1105
 Node: Virtual Private Networks1915
 Node: tinc3639
-Node: Supported platforms5166
-Node: Preparations5867
-Node: Configuring the kernel6123
-Node: Configuration of Linux kernels6533
-Node: Configuration of FreeBSD kernels7388
-Node: Configuration of OpenBSD kernels7853
-Node: Configuration of NetBSD kernels8210
-Node: Configuration of Solaris kernels8615
-Node: Configuration of Darwin (Mac OS X) kernels9278
-Node: Configuration of Windows10097
-Node: Libraries10637
-Node: LibreSSL/OpenSSL11046
-Node: zlib13588
-Node: lzo14617
-Node: Installation15600
-Node: Building and installing tinc16510
-Node: Darwin (Mac OS X) build environment17170
-Node: Cygwin (Windows) build environment17735
-Node: MinGW (Windows) build environment18324
-Node: System files18918
-Node: Device files19183
-Node: Other files19599
-Node: Configuration20212
-Node: Configuration introduction20523
-Node: Multiple networks21791
-Node: How connections work23217
-Node: Configuration files24439
-Node: Main configuration variables25933
-Node: Host configuration variables42189
-Node: Scripts47721
-Node: How to configure50987
-Node: Generating keypairs52245
-Node: Network interfaces52744
-Node: Example configuration54592
-Node: Running tinc59917
-Node: Runtime options60507
-Node: Signals64136
-Node: Debug levels65327
-Node: Solving problems66263
-Node: Error messages67815
-Node: Sending bug reports71824
-Node: Technical information72771
-Node: The connection73002
-Node: The UDP tunnel73314
-Node: The meta-connection76366
-Node: The meta-protocol77835
-Node: Security82852
-Node: Authentication protocol83994
-Node: Encryption of network packets89039
-Node: Security issues90415
-Node: Platform specific information92054
-Node: Interface configuration92314
-Node: Routes94610
-Node: Automatically starting tinc96660
-Node: Linux96883
-Node: Windows98104
-Node: Other platforms98609
-Node: About us98891
-Node: Contact information99066
-Node: Authors99469
-Node: Concept Index99874
+Node: Supported platforms5167
+Node: Preparations5868
+Node: Configuring the kernel6124
+Node: Configuration of Linux kernels6534
+Node: Configuration of FreeBSD kernels7389
+Node: Configuration of OpenBSD kernels7854
+Node: Configuration of NetBSD kernels8211
+Node: Configuration of Solaris kernels8616
+Node: Configuration of Darwin (Mac OS X) kernels9279
+Node: Configuration of Windows10098
+Node: Libraries10638
+Node: LibreSSL/OpenSSL11047
+Node: zlib13589
+Node: lzo14618
+Node: Installation15601
+Node: Building and installing tinc16511
+Node: Darwin (Mac OS X) build environment17171
+Node: Cygwin (Windows) build environment17736
+Node: MinGW (Windows) build environment18325
+Node: System files18919
+Node: Device files19184
+Node: Other files19600
+Node: Configuration20213
+Node: Configuration introduction20524
+Node: Multiple networks21792
+Node: How connections work23218
+Node: Configuration files24440
+Node: Main configuration variables25934
+Node: Host configuration variables42182
+Node: Scripts47714
+Node: How to configure50980
+Node: Generating keypairs52238
+Node: Network interfaces52737
+Node: Example configuration54585
+Node: Running tinc59910
+Node: Runtime options60500
+Node: Signals64125
+Node: Debug levels65316
+Node: Solving problems66252
+Node: Error messages67804
+Node: Sending bug reports71813
+Node: Technical information72760
+Node: The connection72991
+Node: The UDP tunnel73303
+Node: The meta-connection76355
+Node: The meta-protocol77824
+Node: Security82841
+Node: Authentication protocol83983
+Node: Encryption of network packets89028
+Node: Security issues90404
+Node: Platform specific information92044
+Node: Interface configuration92304
+Node: Routes94600
+Node: Automatically starting tinc96650
+Node: Linux96873
+Node: Windows98094
+Node: Other platforms98599
+Node: About us98881
+Node: Contact information99056
+Node: Authors99459
+Node: Concept Index99864

 End Tag Table
+
+
+Local Variables:
+coding: utf-8
+End:
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
@ -15,7 +15,7 @@

 This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.

-Copyright @copyright{} 1998-2018 Ivo Timmermans,
+Copyright @copyright{} 1998-2019 Ivo Timmermans,
 Guus Sliepen <guus@@tinc-vpn.org> and
 Wessel Dankers <wsl@@tinc-vpn.org>.

@ -39,7 +39,7 @@ permission notice identical to this one.
@vskip 0pt plus 1filll
 This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.

-Copyright @copyright{} 1998-2018 Ivo Timmermans,
+Copyright @copyright{} 1998-2019 Ivo Timmermans,
 Guus Sliepen <guus@@tinc-vpn.org> and
 Wessel Dankers <wsl@@tinc-vpn.org>.

@ -155,7 +155,7 @@ professional package.

@cindex traditional VPNs
@cindex scalability
-Tinc also allows more than two sites to connect to eachother and form a single VPN.
+Tinc also allows more than two sites to connect to each other and form a single VPN.
 Traditionally VPNs are created by making tunnels, which only have two endpoints.
 Larger VPNs with more sites are created by adding more tunnels.
 Tinc takes another approach: only endpoints are specified,
@ -2433,7 +2433,7 @@ We will address these issues in tinc 2.0.
 Cryptography is a hard thing to get right. We cannot make any
 guarantees. Time, review and feedback are the only things that can
 prove the security of any cryptographic product. If you wish to review
-tinc or give us feedback, you are stronly encouraged to do so.
+tinc or give us feedback, you are strongly encouraged to do so.


@c ==================================================================
--- a/doc/tincinclude.texi
+++ b/doc/tincinclude.texi
@ -1,5 +1,5 @@
-@set VERSION 1.0.35
+@set VERSION 1.0.36
@set PACKAGE tinc
@set sysconfdir /etc
@set localstatedir /var
-@set runstatedir /var/run
+@set runstatedir /run
--- a/13
+++ b/13
@ -451,7 +451,18 @@ do
    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0

    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask &&
+     { test -z "$stripcmd" || {
+	 # Create $dsttmp read-write so that cp doesn't create it read-only,
+	 # which would cause strip to fail.
+	 if test -z "$doit"; then
+	   : >"$dsttmp" # No need to fork-exec 'touch'.
+	 else
+	   $doit touch "$dsttmp"
+	 fi
+       }
+     } &&
+     $doit_exec $cpprog "$src" "$dsttmp") &&

    # and set any options; do chmod last to preserve setuid bits.
    #
--- a/2
+++ b/2
@ -3,7 +3,7 @@

 scriptversion=2018-03-07.03; # UTC

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2020 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.

 # This program is free software; you can redistribute it and/or modify
--- a/src/Makefile.in
+++ b/src/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
--- a/src/conf.c
+++ b/src/conf.c
@ -467,9 +467,14 @@ static void disable_old_keys(const char *filename) {
 		return;
 	}

-	snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
+	int len = snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);

-	w = fopen(tmpfile, "w");
+	if(len < 0 || len >= PATH_MAX) {
+		fprintf(stderr, "Pathname too long: %s.tmp\n", filename);
+		w = NULL;
+	} else {
+		w = fopen(tmpfile, "w");
+	}

 	while(fgets(buf, sizeof(buf), r)) {
 		if(!strncmp(buf, "-----BEGIN RSA", 14)) {
--- a/src/connection.c
+++ b/src/connection.c
@ -96,13 +96,13 @@ void free_connection_partially(connection_t *c) {
 	c->outbudget = 0;

 	if(c->inctx) {
-		EVP_CIPHER_CTX_cleanup(c->inctx);
+		EVP_CIPHER_CTX_reset(c->inctx);
 		free(c->inctx);
 		c->inctx = NULL;
 	}

 	if(c->outctx) {
-		EVP_CIPHER_CTX_cleanup(c->outctx);
+		EVP_CIPHER_CTX_reset(c->outctx);
 		free(c->outctx);
 		c->outctx = NULL;
 	}
--- a/src/connection.h
+++ b/src/connection.h
@ -24,6 +24,10 @@
 #include <openssl/rsa.h>
 #include <openssl/evp.h>

+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define EVP_CIPHER_CTX_reset(c) EVP_CIPHER_CTX_cleanup(c)
+#endif
+
 #include "avl_tree.h"

 #define OPTION_INDIRECT         0x0001
--- a/src/graph.c
+++ b/src/graph.c
@ -360,13 +360,13 @@ void dump_graph(void) {
 	/* dump all nodes first */
 	for(node = node_tree->head; node; node = node->next) {
 		n = node->data;
-		fprintf(file, "	%s [label = \"%s\"];\n", n->name, n->name);
+		fprintf(file, "	\"%s\" [label = \"%s\"];\n", n->name, n->name);
 	}

 	/* now dump all edges */
 	for(node = edge_weight_tree->head; node; node = node->next) {
 		e = node->data;
-		fprintf(file, "	%s -> %s;\n", e->from->name, e->to->name);
+		fprintf(file, "	\"%s\" -> \"%s\";\n", e->from->name, e->to->name);
 	}

 	fprintf(file, "}\n");
--- a/src/net_setup.c
+++ b/src/net_setup.c
@ -27,6 +27,7 @@
 #include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
+#include <openssl/bn.h>

 #include "avl_tree.h"
 #include "conf.h"
--- a/src/route.c
+++ b/src/route.c
@ -581,7 +581,7 @@ static void fragment_ipv4_packet(node_t *dest, vpn_packet_t *packet, length_t et
 	ifdebug(TRAFFIC) logger(LOG_INFO, "Fragmenting packet of %d bytes to %s (%s)", packet->len, dest->name, dest->hostname);

 	offset = packet->data + ether_size + ip_size;
-	maxlen = (dest->mtu - ether_size - ip_size) & ~0x7;
+	maxlen = (MAX(dest->mtu, 590) - ether_size - ip_size) & ~0x7;
 	ip_off = ntohs(ip.ip_off);
 	origf = ip_off & ~IP_OFFMASK;
 	ip_off &= IP_OFFMASK;
--- a/src/subnet.c
+++ b/src/subnet.c
@ -1,6 +1,6 @@
 /*
    subnet.c -- handle subnet lookups and lists
-    Copyright (C) 2000-2014 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2019 Guus Sliepen <guus@tinc-vpn.org>,
                  2000-2005 Ivo Timmermans

    This program is free software; you can redistribute it and/or modify
@ -205,177 +205,162 @@ void subnet_del(node_t *n, subnet_t *subnet) {
 /* Ascii representation of subnets */

 bool str2net(subnet_t *subnet, const char *subnetstr) {
-	int i, l;
-	uint16_t x[8];
+	char str[1024];
+	strncpy(str, subnetstr, sizeof(str));
+	str[sizeof(str) - 1] = 0;
+	int consumed;
+
 	int weight = 10;
+	char *weight_separator = strchr(str, '#');

-	if(sscanf(subnetstr, "%hu.%hu.%hu.%hu/%d#%d",
-	                &x[0], &x[1], &x[2], &x[3], &l, &weight) >= 5) {
-		if(l < 0 || l > 32) {
+	if(weight_separator) {
+		char *weight_str = weight_separator + 1;
+
+		if(sscanf(weight_str, "%d%n", &weight, &consumed) < 1) {
 			return false;
 		}

-		subnet->type = SUBNET_IPV4;
-		subnet->net.ipv4.prefixlength = l;
-		subnet->weight = weight;
-
-		for(i = 0; i < 4; i++) {
-			if(x[i] > 255) {
-				return false;
-			}
-
-			subnet->net.ipv4.address.x[i] = x[i];
-		}
-
-		return true;
-	}
-
-	if(sscanf(subnetstr, "%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx/%d#%d",
-	                &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &x[6], &x[7],
-	                &l, &weight) >= 9) {
-		if(l < 0 || l > 128) {
+		if(weight_str[consumed]) {
 			return false;
 		}

-		subnet->type = SUBNET_IPV6;
-		subnet->net.ipv6.prefixlength = l;
-		subnet->weight = weight;
-
-		for(i = 0; i < 8; i++) {
-			subnet->net.ipv6.address.x[i] = htons(x[i]);
-		}
-
-		return true;
+		*weight_separator = 0;
 	}

-	if(sscanf(subnetstr, "%hu.%hu.%hu.%hu#%d", &x[0], &x[1], &x[2], &x[3], &weight) >= 4) {
-		subnet->type = SUBNET_IPV4;
-		subnet->net.ipv4.prefixlength = 32;
-		subnet->weight = weight;
+	int prefixlength = -1;
+	char *prefixlength_separator = strchr(str, '/');

-		for(i = 0; i < 4; i++) {
-			if(x[i] > 255) {
-				return false;
-			}
+	if(prefixlength_separator) {
+		char *prefixlength_str = prefixlength_separator + 1;

-			subnet->net.ipv4.address.x[i] = x[i];
+		if(sscanf(prefixlength_str, "%d%n", &prefixlength, &consumed) < 1) {
+			return false;
 		}

-		return true;
-	}
-
-	if(sscanf(subnetstr, "%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx#%d",
-	                &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &x[6], &x[7], &weight) >= 8) {
-		subnet->type = SUBNET_IPV6;
-		subnet->net.ipv6.prefixlength = 128;
-		subnet->weight = weight;
-
-		for(i = 0; i < 8; i++) {
-			subnet->net.ipv6.address.x[i] = htons(x[i]);
+		if(prefixlength_str[consumed]) {
+			return false;
 		}

-		return true;
+		*prefixlength_separator = 0;
+
+		if(prefixlength < 0) {
+			return false;
+		}
 	}

-	if(sscanf(subnetstr, "%hx:%hx:%hx:%hx:%hx:%hx#%d",
-	                &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &weight) >= 6) {
+	uint16_t x[8];
+
+	if(sscanf(str, "%hx:%hx:%hx:%hx:%hx:%hx%n", &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &consumed) >= 6 && !str[consumed]) {
+		/*
+		   Normally we should check that each part has two digits to prevent ambiguities.
+		   However, in old tinc versions net2str() will aggressively return MAC addresses with one-digit parts,
+		   so we have to accept them otherwise we would be unable to parse ADD_SUBNET messages.
+		*/
+		if(prefixlength >= 0) {
+			return false;
+		}
+
 		subnet->type = SUBNET_MAC;
 		subnet->weight = weight;

-		for(i = 0; i < 6; i++) {
+		for(int i = 0; i < 6; i++) {
 			subnet->net.mac.address.x[i] = x[i];
 		}

 		return true;
 	}

-	// IPv6 short form
-	if(strstr(subnetstr, "::")) {
-		const char *p;
-		char *q;
-		int colons = 0;
+	if(sscanf(str, "%hu.%hu.%hu.%hu%n", &x[0], &x[1], &x[2], &x[3], &consumed) >= 4 && !str[consumed]) {
+		if(prefixlength == -1) {
+			prefixlength = 32;
+		}

-		// Count number of colons
-		for(p = subnetstr; *p; p++)
-			if(*p == ':') {
-				colons++;
-			}
-
-		if(colons > 7) {
+		if(prefixlength > 32) {
 			return false;
 		}

-		// Scan numbers before the double colon
-		p = subnetstr;
+		subnet->type = SUBNET_IPV4;
+		subnet->net.ipv4.prefixlength = prefixlength;
+		subnet->weight = weight;

-		for(i = 0; i < colons; i++) {
-			if(*p == ':') {
-				break;
-			}
-
-			x[i] = strtoul(p, &q, 0x10);
-
-			if(!q || p == q || *q != ':') {
+		for(int i = 0; i < 4; i++) {
+			if(x[i] > 255) {
 				return false;
 			}

-			p = ++q;
+			subnet->net.ipv4.address.x[i] = x[i];
 		}

-		p++;
-		colons -= i;
+		return true;
+	}

-		if(!i) {
-			p++;
-			colons--;
-		}
+	/* IPv6 */

-		if(!*p || *p == '/' || *p == '#') {
-			colons--;
-		}
+	char *last_colon = strrchr(str, ':');

-		// Fill in the blanks
-		for(; i < 8 - colons; i++) {
-			x[i] = 0;
-		}
-
-		// Scan the remaining numbers
-		for(; i < 8; i++) {
-			x[i] = strtoul(p, &q, 0x10);
-
-			if(!q || p == q) {
+	if(last_colon && sscanf(last_colon, ":%hu.%hu.%hu.%hu%n", &x[0], &x[1], &x[2], &x[3], &consumed) >= 4 && !last_colon[consumed]) {
+		/* Dotted quad suffix notation, convert to standard IPv6 notation */
+		for(int i = 0; i < 4; i++)
+			if(x[i] > 255) {
 				return false;
 			}

-			if(i == 7) {
-				p = q;
-				break;
+		snprintf(last_colon, sizeof(str) - (last_colon - str), ":%02x%02x:%02x%02x", x[0], x[1], x[2], x[3]);
+	}
+
+	char *double_colon = strstr(str, "::");
+
+	if(double_colon) {
+		/* Figure out how many zero groups we need to expand */
+		int zero_group_count = 8;
+
+		for(const char *cur = str; *cur; cur++)
+			if(*cur != ':') {
+				zero_group_count--;
+
+				while(cur[1] && cur[1] != ':') {
+					cur++;
+				}
 			}

-			if(*q != ':') {
-				return false;
-			}
-
-			p = ++q;
+		if(zero_group_count < 1) {
+			return false;
 		}

-		l = 128;
+		/* Split the double colon in the middle to make room for zero groups */
+		double_colon++;
+		memmove(double_colon + (zero_group_count * 2 - 1), double_colon, strlen(double_colon) + 1);

-		if(*p == '/') {
-			sscanf(p, "/%d#%d", &l, &weight);
-		} else if(*p == '#') {
-			sscanf(p, "#%d", &weight);
+		/* Write zero groups in the resulting gap, overwriting the second colon */
+		for(int i = 0; i < zero_group_count; i++) {
+			memcpy(&double_colon[i * 2], "0:", 2);
 		}

-		if(l < 0 || l > 128) {
+		/* Remove any leading or trailing colons */
+		if(str[0] == ':') {
+			memmove(&str[0], &str[1], strlen(&str[1]) + 1);
+		}
+
+		if(str[strlen(str) - 1] == ':') {
+			str[strlen(str) - 1] = 0;
+		}
+	}
+
+	if(sscanf(str, "%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx%n",
+	                &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &x[6], &x[7], &consumed) >= 8 && !str[consumed]) {
+		if(prefixlength == -1) {
+			prefixlength = 128;
+		}
+
+		if(prefixlength > 128) {
 			return false;
 		}

 		subnet->type = SUBNET_IPV6;
-		subnet->net.ipv6.prefixlength = l;
+		subnet->net.ipv6.prefixlength = prefixlength;
 		subnet->weight = weight;

-		for(i = 0; i < 8; i++) {
+		for(int i = 0; i < 8; i++) {
 			subnet->net.ipv6.address.x[i] = htons(x[i]);
 		}

--- a/src/tincd.c
+++ b/src/tincd.c
@ -1,7 +1,7 @@
 /*
    tincd.c -- the main file for tincd
    Copyright (C) 1998-2005 Ivo Timmermans
-                  2000-2018 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2019 Guus Sliepen <guus@tinc-vpn.org>
                  2008      Max Rijevski <maksuf@gmail.com>
                  2009      Michael Tokarev <mjt@tls.msk.ru>
                  2010      Julien Muchembled <jm@jmuchemb.eu>
@ -37,7 +37,10 @@
 #include <openssl/rsa.h>
 #include <openssl/pem.h>
 #include <openssl/evp.h>
+#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
+#endif
+#include <openssl/bn.h>

 #ifdef HAVE_LZO
 #include LZO1X_H
@ -651,7 +654,7 @@ int main(int argc, char **argv) {

 	if(show_version) {
 		printf("%s version %s\n", PACKAGE, VERSION);
-		printf("Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen and others.\n"
+		printf("Copyright (C) 1998-2019 Ivo Timmermans, Guus Sliepen and others.\n"
 		       "See the AUTHORS file for a complete list.\n\n"
 		       "tinc comes with ABSOLUTELY NO WARRANTY.  This is free software,\n"
 		       "and you are welcome to redistribute it under certain conditions;\n"
@ -685,17 +688,14 @@ int main(int argc, char **argv) {

 	init_configuration(&config_tree);

-	/* Slllluuuuuuurrrrp! */
-
-	if(RAND_load_file("/dev/urandom", 1024) != 1024) {
-		logger(LOG_ERR, "Error initializing RNG!");
-		return 1;
-	}
-
+#ifndef OPENSSL_NO_ENGINE
 	ENGINE_load_builtin_engines();
 	ENGINE_register_all_complete();
+#endif

+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	OpenSSL_add_all_algorithms();
+#endif

 	if(generate_keys) {
 		read_server_config();
@ -814,9 +814,13 @@ end:

 	free(priority);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	EVP_cleanup();
 	ERR_free_strings();
+#ifndef OPENSSL_NO_ENGINE
 	ENGINE_cleanup();
+#endif
+#endif

 	exit_configuration(&config_tree);
 	list_delete_list(cmdline_conf);
--- a/systemd/Makefile.in
+++ b/systemd/Makefile.in
@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.1 from Makefile.am.
+# Makefile.in generated by automake 1.16.2 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2018 Free Software Foundation, Inc.
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,