+ if(priorityinheritance)
+ logger(LOG_WARNING, "%s not supported on this platform for IPv4 connection", "PriorityInheritance");
+#endif
+
+#if !defined(IPPROTO_IPV6) || !defined(IPV6_TCLASS)
+ if(priorityinheritance)
+ logger(LOG_WARNING, "%s not supported on this platform for IPv6 connection", "PriorityInheritance");
+#endif
+
+ if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire))
+ macexpire = 600;
+
+ if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) {
+ if(maxtimeout <= 0) {
+ logger(LOG_ERR, "Bogus maximum timeout!");
+ return false;
+ }
+ } else
+ maxtimeout = 900;
+
+ if(get_config_int(lookup_config(config_tree, "MinTimeout"), &mintimeout)) {
+ if(mintimeout < 0) {
+ logger(LOG_ERR, "Bogus minimum timeout!");
+ return false;
+ }
+ if(mintimeout > maxtimeout) {
+ logger(LOG_WARNING, "Minimum timeout (%d s) cannot be larger than maximum timeout (%d s). Correcting !", mintimeout, maxtimeout );
+ mintimeout=maxtimeout;
+ }
+ } else
+ mintimeout = 0;
+
+ if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) {
+ if(udp_rcvbuf <= 0) {
+ logger(LOG_ERR, "UDPRcvBuf cannot be negative!");
+ return false;
+ }
+ }
+
+ if(get_config_int(lookup_config(config_tree, "UDPSndBuf"), &udp_sndbuf)) {
+ if(udp_sndbuf <= 0) {
+ logger(LOG_ERR, "UDPSndBuf cannot be negative!");
+ return false;
+ }
+ }
+
+ if(get_config_int(lookup_config(config_tree, "ReplayWindow"), &replaywin_int)) {
+ if(replaywin_int < 0) {
+ logger(LOG_ERR, "ReplayWindow cannot be negative!");
+ return false;
+ }
+ replaywin = (unsigned)replaywin_int;
+ }
+
+ if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname)) {
+ if(!strcasecmp(afname, "IPv4"))
+ addressfamily = AF_INET;
+ else if(!strcasecmp(afname, "IPv6"))
+ addressfamily = AF_INET6;
+ else if(!strcasecmp(afname, "any"))
+ addressfamily = AF_UNSPEC;
+ else {
+ logger(LOG_ERR, "Invalid address family!");
+ free(afname);
+ return false;
+ }
+ free(afname);
+ }
+
+ get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames);
+
+ /* Generate packet encryption key */
+
+ if(get_config_string(lookup_config(config_tree, "Cipher"), &cipher)) {
+ if(!strcasecmp(cipher, "none")) {
+ myself->incipher = NULL;
+ } else {
+ myself->incipher = EVP_get_cipherbyname(cipher);
+
+ if(!myself->incipher) {
+ logger(LOG_ERR, "Unrecognized cipher type!");
+ free(cipher);
+ return false;
+ }
+ }
+ free(cipher);
+ } else
+ myself->incipher = EVP_aes_256_cbc();
+
+ if(myself->incipher)
+ myself->inkeylength = EVP_CIPHER_key_length(myself->incipher) + EVP_CIPHER_iv_length(myself->incipher);
+ else
+ myself->inkeylength = 1;
+
+ /* We need to use a stream mode for the meta protocol. Use AES for this,
+ but try to match the key size with the one from the cipher selected
+ by Cipher.
+
+ If Cipher is set to none, still use a low level of encryption for the
+ meta protocol.
+ */
+
+ int keylen = myself->incipher ? EVP_CIPHER_key_length(myself->incipher) : 0;
+ if(keylen <= 16)
+ myself->connection->outcipher = EVP_aes_128_cfb();
+ else if(keylen <= 24)
+ myself->connection->outcipher = EVP_aes_192_cfb();
+ else
+ myself->connection->outcipher = EVP_aes_256_cfb();
+
+ if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime))
+ keylifetime = 3600;
+
+ keyexpires = now + keylifetime;
+
+ /* Check if we want to use message authentication codes... */
+
+ if(get_config_string(lookup_config(config_tree, "Digest"), &digest)) {
+ if(!strcasecmp(digest, "none")) {
+ myself->indigest = NULL;
+ } else {
+ myself->indigest = EVP_get_digestbyname(digest);
+
+ if(!myself->indigest) {
+ logger(LOG_ERR, "Unrecognized digest type!");
+ free(digest);
+ return false;
+ }
+ }
+
+ free(digest);
+ } else
+ myself->indigest = EVP_sha256();
+
+ myself->connection->outdigest = EVP_sha256();
+
+ if(get_config_int(lookup_config(config_tree, "MACLength"), &myself->inmaclength)) {
+ if(myself->indigest) {
+ if(myself->inmaclength > EVP_MD_size(myself->indigest)) {
+ logger(LOG_ERR, "MAC length exceeds size of digest!");
+ return false;
+ } else if(myself->inmaclength < 0) {
+ logger(LOG_ERR, "Bogus MAC length!");
+ return false;
+ }
+ }
+ } else
+ myself->inmaclength = 4;
+
+ myself->connection->outmaclength = 0;
+
+ /* Compression */
+
+ if(get_config_int(lookup_config(config_tree, "Compression"), &myself->incompression)) {
+ if(myself->incompression < 0 || myself->incompression > 11) {
+ logger(LOG_ERR, "Bogus compression level!");
+ return false;
+ }
+ } else
+ myself->incompression = 0;
+
+ myself->connection->outcompression = 0;
+
+ /* Done */
+
+ myself->nexthop = myself;
+ myself->via = myself;
+ myself->status.reachable = true;
+ node_add(myself);
+
+ graph();
+
+ if(strictsubnets)
+ load_all_subnets();
+
+ /* Open device */
+
+ devops = os_devops;
+
+ if(get_config_string(lookup_config(config_tree, "DeviceType"), &type)) {
+ if(!strcasecmp(type, "dummy"))
+ devops = dummy_devops;
+ else if(!strcasecmp(type, "raw_socket"))
+ devops = raw_socket_devops;
+ else if(!strcasecmp(type, "multicast"))
+ devops = multicast_devops;
+#ifdef ENABLE_UML
+ else if(!strcasecmp(type, "uml"))
+ devops = uml_devops;
+#endif
+#ifdef ENABLE_VDE
+ else if(!strcasecmp(type, "vde"))
+ devops = vde_devops;
+#endif
+ free(type);
+ }
+
+ if(!devops.setup())
+ return false;
+
+ /* Run tinc-up script to further initialize the tap interface */
+ xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
+ xasprintf(&envp[1], "DEVICE=%s", device ? : "");
+ xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
+ xasprintf(&envp[3], "NAME=%s", myself->name);
+
+#ifdef HAVE_MINGW
+ Sleep(1000);
+#endif
+#ifdef HAVE_CYGWIN
+ sleep(1);
+#endif
+ execute_script("tinc-up", envp);
+
+ for(i = 0; i < 4; i++)
+ free(envp[i]);
+
+ /* Run subnet-up scripts for our own subnets */
+
+ subnet_update(myself, NULL, true);
+
+ /* Open sockets */
+
+ if(!do_detach && getenv("LISTEN_FDS")) {
+ sockaddr_t sa;
+ socklen_t salen;
+
+ listen_sockets = atoi(getenv("LISTEN_FDS"));
+#ifdef HAVE_UNSETENV
+ unsetenv("LISTEN_FDS");
+#endif
+
+ if(listen_sockets > MAXSOCKETS) {
+ logger(LOG_ERR, "Too many listening sockets");
+ return false;
+ }
+
+ for(i = 0; i < listen_sockets; i++) {
+ salen = sizeof sa;
+ if(getsockname(i + 3, &sa.sa, &salen) < 0) {
+ logger(LOG_ERR, "Could not get address of listen fd %d: %s", i + 3, sockstrerror(errno));
+ return false;
+ }
+
+ listen_socket[i].tcp = i + 3;
+
+#ifdef FD_CLOEXEC
+ fcntl(i + 3, F_SETFD, FD_CLOEXEC);
+#endif
+
+ listen_socket[i].udp = setup_vpn_in_socket(&sa);
+ if(listen_socket[i].udp < 0)
+ return false;
+
+ ifdebug(CONNECTIONS) {
+ hostname = sockaddr2hostname(&sa);
+ logger(LOG_NOTICE, "Listening on %s", hostname);
+ free(hostname);
+ }
+
+ memcpy(&listen_socket[i].sa, &sa, salen);
+ }
+ } else {
+ listen_sockets = 0;
+ cfg = lookup_config(config_tree, "BindToAddress");
+
+ do {
+ get_config_string(cfg, &address);
+ if(cfg)
+ cfg = lookup_config_next(config_tree, cfg);
+
+ char *port = myport;
+
+ if(address) {
+ char *space = strchr(address, ' ');
+ if(space) {
+ *space++ = 0;
+ port = space;
+ }
+
+ if(!strcmp(address, "*"))
+ *address = 0;
+ }
+
+ hint.ai_family = addressfamily;
+ hint.ai_socktype = SOCK_STREAM;
+ hint.ai_protocol = IPPROTO_TCP;
+ hint.ai_flags = AI_PASSIVE;
+
+#if HAVE_DECL_RES_INIT
+ // ensure glibc reloads /etc/resolv.conf.
+ res_init();