Guus Sliepen [Sat, 7 Oct 2017 14:54:52 +0000 (16:54 +0200)]
Use getcwd() instead of get_current_dir_name().
Guus Sliepen [Sat, 7 Oct 2017 14:51:13 +0000 (16:51 +0200)]
Remove unused/obsolete checks from configure.ac.
Guus Sliepen [Fri, 6 Oct 2017 19:40:03 +0000 (21:40 +0200)]
Fix a few minor memory leaks.
Guus Sliepen [Fri, 6 Oct 2017 19:39:24 +0000 (21:39 +0200)]
Use stack-allocated strings for temporary filenames.
Guus Sliepen [Fri, 6 Oct 2017 19:25:59 +0000 (21:25 +0200)]
Never remove items from cmdline_conf.
We should treat cmdline_conf as const, so we can call read_config_options()
more than once with prefix = NULL.
Closes #155 on GitHub.
Guus Sliepen [Tue, 3 Oct 2017 19:22:39 +0000 (21:22 +0200)]
Prepare for automatic code formatting using Artistic Style.
Guus Sliepen [Tue, 3 Oct 2017 19:07:09 +0000 (21:07 +0200)]
Give absolute path for #include to AC_CHECK_HEADERS().
Taken from Etienne Dechamp's patch to support VPATH builds for tinc 1.1.
Guus Sliepen [Tue, 3 Oct 2017 18:59:00 +0000 (20:59 +0200)]
Use AC_CONFIG_MACRO_DIR().
nemunaire [Wed, 27 Sep 2017 16:47:13 +0000 (18:47 +0200)]
Allow compilation from a build directory
Rafael Sadowski [Tue, 3 Oct 2017 08:23:37 +0000 (10:23 +0200)]
fix tinc.conf for OpenBSD
Guus Sliepen [Mon, 2 Oct 2017 18:54:57 +0000 (20:54 +0200)]
Fix a potential memory leak.
Found by the Clang static analyzer.
Guus Sliepen [Sun, 1 Oct 2017 20:04:35 +0000 (22:04 +0200)]
Udpate THANKS.
Guus Sliepen [Sat, 2 Sep 2017 14:31:04 +0000 (16:31 +0200)]
Releasing 1.0.32.
Guus Sliepen [Sun, 30 Jul 2017 14:14:14 +0000 (16:14 +0200)]
Don't try to bind Proxy = exec sockets to an address.
Guus Sliepen [Sun, 30 Jul 2017 14:11:56 +0000 (16:11 +0200)]
Set status.proxy_passed early for Proxy = exec.
Guus Sliepen [Sun, 30 Jul 2017 14:04:49 +0000 (16:04 +0200)]
Fix Proxy = exec.
Guus Sliepen [Tue, 27 Jun 2017 21:36:52 +0000 (23:36 +0200)]
Don't forget about outgoing connections on host file read errors.
If the host config file for an outgoing connection cannot be read, or if
it doesn't contain any Address, don't forget about the ConnectTo, but go
straight to MaxTimeout seconds for retries.
Guus Sliepen [Sun, 28 May 2017 10:42:25 +0000 (12:42 +0200)]
Set KillMode=mixed in the systemd service file.
This ensures only the main process is sent the SIGTERM, and not anything
else that might have started in the same control group, including the
tinc-down script.
Closes #145 on GitHub.
Guus Sliepen [Sun, 28 May 2017 10:25:53 +0000 (12:25 +0200)]
Move logging of "would block" messages to debug level 4.
Guus Sliepen [Thu, 27 Apr 2017 18:58:10 +0000 (20:58 +0200)]
Bind outgoing TCP sockets.
This is important for multi-homed users that want to ensure the source
address of outgoing TCP connections is the same as the address that tinc
is listening on.
Binding is done automatically if there is exactly one listening address
for a given address family.
Guus Sliepen [Wed, 19 Apr 2017 08:26:18 +0000 (10:26 +0200)]
Fix Solaris DeviceType = tap in router Mode.
Guus Sliepen [Sat, 8 Apr 2017 11:06:48 +0000 (13:06 +0200)]
Use getmsg()/putmsg() instead of read()/write() on Solaris.
This fixes a problem where read() returns packets from the IP layer before
fragmentation is done.
Guus Sliepen [Sat, 8 Apr 2017 11:05:11 +0000 (13:05 +0200)]
Use /dev/udp instead of /dev/ip on Solaris.
Guus Sliepen [Tue, 21 Mar 2017 20:48:08 +0000 (21:48 +0100)]
Merge remote-tracking branch 'VittGam/master'
Guus Sliepen [Mon, 20 Mar 2017 18:19:01 +0000 (19:19 +0100)]
Don't dereference myself->incipher if it's NULL.
This fixes #142 on GitHub.
Guus Sliepen [Sun, 15 Jan 2017 14:50:49 +0000 (15:50 +0100)]
Releasing 1.0.31.
Élie Bouttier [Mon, 31 Oct 2016 20:06:32 +0000 (21:06 +0100)]
Remove ExecStop in tinc@.service
This avoid tinc to receive SIGTERM twice (through ExecStop and through systemd
directly) which prevented tinc-down script to be executed.
Guus Sliepen [Sun, 30 Oct 2016 13:18:39 +0000 (14:18 +0100)]
Releasing 1.0.30.
Guus Sliepen [Sun, 30 Oct 2016 12:11:24 +0000 (13:11 +0100)]
Use CFB mode for meta-connections to improve security.
Guus Sliepen [Sat, 29 Oct 2016 20:14:45 +0000 (22:14 +0200)]
Use AES in CTR mode instead of OFB mode for meta-connections.
This gives a very nice speedup while preserving the stream characteristics.
Guus Sliepen [Sat, 29 Oct 2016 20:10:32 +0000 (22:10 +0200)]
Really fix byte budget calculation.
We want to use the underlying cipher's block length, but if it's a stream
mode this will be 1. In that case, use the IV length. Ensure we never get
a budget that cannot be stored in a 64 bits integer.
Thanks to Wessel Dankers for helping getting this right.
Guus Sliepen [Sat, 29 Oct 2016 18:56:43 +0000 (20:56 +0200)]
Fix bit shifting arithmetic so the code actually does what the last commit message says.
Guus Sliepen [Sat, 29 Oct 2016 17:51:35 +0000 (19:51 +0200)]
Enforce maximum amount of bytes sent/received on meta-connections.
This is sqrt(2^{block_length_in_bits}).
Guus Sliepen [Sat, 29 Oct 2016 13:24:34 +0000 (15:24 +0200)]
Use AES256 and SHA256 by default, also for the meta-connections.
At the start of the decade, there were still distributions that shipped
with versions of OpenSSL that did not support these algorithms. By now
everyone should support them. The old defaults were Blowfish and SHA1,
both of which are not considered secure anymore.
The meta-protocol now always uses AES in OFB mode, but the key length
will adapt to the one specified by the Cipher option. The digest for the
meta-protocol is hardcoded to SHA256.
Guus Sliepen [Fri, 14 Oct 2016 12:44:06 +0000 (14:44 +0200)]
Delay sending the real ID request until after a proxy request is granted.
Guus Sliepen [Fri, 14 Oct 2016 12:27:49 +0000 (14:27 +0200)]
Log only the first line of a proxy request rejection message.
Guus Sliepen [Fri, 14 Oct 2016 12:27:19 +0000 (14:27 +0200)]
Fix proxy reply parsing broken by the previous commit.
Guus Sliepen [Thu, 13 Oct 2016 14:45:37 +0000 (16:45 +0200)]
Allow non-empty lines after status code from a HTTP proxy.
Vittorio Gambaletta (VittGam) [Wed, 12 Oct 2016 12:09:34 +0000 (14:09 +0200)]
route: Support ToS/DiffServ priority inheritance when routing IPv6 packets.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Guus Sliepen [Sun, 9 Oct 2016 13:42:14 +0000 (15:42 +0200)]
Releasing 1.0.29.
Guus Sliepen [Sun, 9 Oct 2016 13:16:42 +0000 (15:16 +0200)]
Fix compiler warnings about format string errors on BSD.
Guus Sliepen [Sun, 9 Oct 2016 13:09:52 +0000 (15:09 +0200)]
Fix possibly unitialized variable.
Guus Sliepen [Sun, 9 Oct 2016 12:38:35 +0000 (14:38 +0200)]
Add ax_require_defined.m4.
Guus Sliepen [Tue, 27 Sep 2016 12:18:20 +0000 (14:18 +0200)]
Add a copy of ax_append_flag.m4.
This is a dependency of ax_cflags_warn_all.m4.
Guus Sliepen [Tue, 26 Jul 2016 14:47:02 +0000 (16:47 +0200)]
Log warnings about dropped packets only with debug level 5 or higher.
Guus Sliepen [Thu, 23 Jun 2016 13:32:47 +0000 (15:32 +0200)]
Force nul-termination of strings after vsnprintf().
Apparently, on Windows this function might not always be properly
terminated.
Guus Sliepen [Wed, 22 Jun 2016 15:42:13 +0000 (17:42 +0200)]
Check return value of RSA_generate_key_ex().
Guus Sliepen [Wed, 22 Jun 2016 15:38:06 +0000 (17:38 +0200)]
Add -Wall to CFLAGS.
Guus Sliepen [Wed, 15 Jun 2016 09:12:09 +0000 (11:12 +0200)]
Ensure compatibility with OpenSSL 1.1.0.
Guus Sliepen [Sun, 5 Jun 2016 13:23:07 +0000 (15:23 +0200)]
Preserve IPv6 scope_id in edges.
When creating an edge after authenticating a peer, we copy the address
used for the TCP connection, but change the port to that used for UDP.
But the way we did it discarded the scope_id for IPv6 addresses. This
prevented UDP communication from working correctly when connecting to a
peer on the same LAN using an IPv6 link-local address.
Thanks to Rafał Leśniak for pointing out this issue.
Guus Sliepen [Sun, 10 Apr 2016 13:08:01 +0000 (15:08 +0200)]
Releasing 1.0.28.
Guus Sliepen [Sun, 10 Apr 2016 13:04:59 +0000 (15:04 +0200)]
Update links in the documentation.
Guus Sliepen [Sun, 10 Apr 2016 12:47:21 +0000 (14:47 +0200)]
Explicitly mention that LibreSSL can be used as well.
Guus Sliepen [Sun, 10 Apr 2016 12:30:20 +0000 (14:30 +0200)]
Ensure the service files are in the tarball.
Guus Sliepen [Sun, 10 Apr 2016 12:13:53 +0000 (14:13 +0200)]
Update .gitignore.
Guus Sliepen [Sun, 10 Apr 2016 12:13:44 +0000 (14:13 +0200)]
Add systemd service files.
Guus Sliepen [Sun, 10 Apr 2016 11:41:54 +0000 (13:41 +0200)]
Really remove use of __DATE__ and __TIME__ to facilitate reproducible builds.
Guus Sliepen [Sun, 10 Apr 2016 11:40:42 +0000 (13:40 +0200)]
Fix compiling bsd/device.c on systems without utun.
Guus Sliepen [Sat, 9 Apr 2016 22:50:15 +0000 (00:50 +0200)]
Releasing 1.0.27.
Guus Sliepen [Sat, 9 Apr 2016 22:05:13 +0000 (00:05 +0200)]
Add support for OS X utun interfaces.
Guus Sliepen [Sat, 9 Apr 2016 20:17:47 +0000 (22:17 +0200)]
Enable silent builds by default.
Cleaner build messages make it easier to spot compiler warnings and errors.
Use make V=1 to get the verbose output back.
Guus Sliepen [Sat, 9 Apr 2016 16:40:09 +0000 (18:40 +0200)]
Use SIOCGIFADDR on BSDs that support it.
Guus Sliepen [Sat, 9 Apr 2016 16:39:40 +0000 (18:39 +0200)]
Use devname() if available to support devfs cloning on BSD.
Some BSD flavors allow opening /dev/tun and/or /dev/tap, which automatically
create a new tun or tap interface with an unused number. To find out which
number the interface got, you have to call devname() on the device file
that was opened.
The semantics are different from the way Linux's /dev/tun works though.
In particular, after closing the device, the interface will continue to exist.
Restarting tincd would cause the old interface to stay around, and a new
one to be created. One could add a tinc-down script with the following line:
ifconfig $INTERFACE destroy
But that is still no guarantee that restarting tinc will give you the same
interface. So the default tun and tap device will stay /dev/tun0 and /dev/tap0
for all BSD flavors to avoid surprises for existing users.
Guus Sliepen [Sat, 9 Apr 2016 16:30:48 +0000 (18:30 +0200)]
Every BSD flavor has a tap device nowadays.
Guus Sliepen [Sat, 9 Apr 2016 14:11:00 +0000 (16:11 +0200)]
Get rid of a warning when compiling tinc using MinGW.
Because Windows has the wrong declaration of setsockopt().
Guus Sliepen [Sat, 9 Apr 2016 14:00:08 +0000 (16:00 +0200)]
Cast 0xff to char before comparing it to another char.
Clang warned about this.
Guus Sliepen [Sat, 9 Apr 2016 13:42:12 +0000 (15:42 +0200)]
Remove use of __DATE__ and __TIME__ to facilitate reproducible builds.
Guus Sliepen [Sat, 9 Apr 2016 13:21:26 +0000 (15:21 +0200)]
Update copyright notices.
Guus Sliepen [Fri, 8 Apr 2016 16:09:30 +0000 (18:09 +0200)]
Use iface instead of interface.
This was accidentally added in commit
2f03a5d.
Guus Sliepen [Fri, 8 Apr 2016 16:05:24 +0000 (18:05 +0200)]
Update THANKS.
Guus Sliepen [Fri, 8 Apr 2016 16:03:35 +0000 (18:03 +0200)]
Update .gitignore.
Guus Sliepen [Fri, 8 Apr 2016 15:49:49 +0000 (17:49 +0200)]
Don't compile getopt*.c if the system provides getopt_long().
LunarShaddow [Tue, 8 Mar 2016 07:28:11 +0000 (15:28 +0800)]
Proofing README.
LunarShaddow [Mon, 7 Mar 2016 07:43:04 +0000 (15:43 +0800)]
re-arrange include sequence to avoid a mingw introduced bug.
refers: https://www.cygwin.com/ml/cygwin/2012-12/msg00194.html
LunarShaddow [Mon, 7 Mar 2016 07:42:34 +0000 (15:42 +0800)]
fix typo
Guus Sliepen [Sun, 28 Feb 2016 15:28:28 +0000 (16:28 +0100)]
Fix forwarding of edge updates.
Commit
e4670fc accidentily prevented ADD_EDGE messages from propagating
in some cases.
Guus Sliepen [Sat, 27 Feb 2016 13:46:01 +0000 (14:46 +0100)]
Add warnings for bad combinations of Device and Interface.
On Linux, the name of the tun/tap interface can be set freely. However,
on most other operating systems, tinc cannot change the name of the
interface. In those situations, it is possible to specify a Device and
an Interface that conflict with each other. On BSD, this can cause
$INTERFACE to be set incorrectly, on Windows, this results in a
potentially unreliable way in which a TAP-Win32 interface is selected.
Guus Sliepen [Sat, 27 Feb 2016 13:22:36 +0000 (14:22 +0100)]
Small fixes for the documentation.
Guus Sliepen [Sat, 27 Feb 2016 13:21:53 +0000 (14:21 +0100)]
Clarify that scripts are called synchronously.
Guus Sliepen [Sat, 27 Feb 2016 13:18:20 +0000 (14:18 +0100)]
Improve performance of edge updates.
Guus Sliepen [Mon, 16 Nov 2015 13:33:39 +0000 (14:33 +0100)]
Fix warnings from the Clang Static Analyzer.
These were all harmless.
Guus Sliepen [Mon, 18 Jan 2016 12:58:46 +0000 (13:58 +0100)]
Fix compatibility with TAP-Win32 9.0.0.21 and later.
Tinc was a bit sloppy writing packets to the TAP-Win32 device using
overlapped I/O. It worked with older versions of the driver, but it
caused lots of dropped packets with newer versions of the driver (that
use the NDIS 6 API).
Guus Sliepen [Thu, 14 Jan 2016 14:07:22 +0000 (15:07 +0100)]
Only add a reflexive address when we're sure it's working.
Guus Sliepen [Fri, 6 Nov 2015 07:48:35 +0000 (08:48 +0100)]
Add ability to use proxies to connect to hostnames when there is no nameserver.
This adds support for SOCKS4a, and enhances the support for SOCKS5 and
HTTP.
Guus Sliepen [Sun, 1 Nov 2015 20:07:56 +0000 (21:07 +0100)]
Update "now" after connect() when making outgoing connections.
It could be that address resolution takes a long time, don't let that
count against a connection. This is especially important when using a
nameserver from the VPN.
Guus Sliepen [Fri, 30 Oct 2015 14:46:54 +0000 (15:46 +0100)]
Attribution for various contributors.
Vittorio Gambaletta (VittGam) [Fri, 25 Sep 2015 14:51:51 +0000 (16:51 +0200)]
Remove forward declaration for do_decrement_ttl.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Vittorio Gambaletta (VittGam) [Fri, 25 Sep 2015 13:35:28 +0000 (15:35 +0200)]
s/broadcast_packet_helper/route_broadcast/
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Vittorio Gambaletta (VittGam) [Fri, 25 Sep 2015 02:52:25 +0000 (04:52 +0200)]
Fix DecrementTTL option for packets destined to the local node.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Guus Sliepen [Thu, 24 Sep 2015 15:08:29 +0000 (17:08 +0200)]
Add missing AM_PROG_CC_C_O to configure.ac.
Nathan Stratton Treadway [Sat, 12 Sep 2015 14:33:52 +0000 (16:33 +0200)]
Fix invalid checksum generation.
Use equation 3 given in RFC 1624 and the UpdateTTL() example function given
RFC 1141.
Vittorio Gambaletta (VittGam) [Fri, 4 Sep 2015 15:04:03 +0000 (17:04 +0200)]
Try to reply with node address only when decrementing the TTL.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Vittorio Gambaletta (VittGam) [Fri, 4 Sep 2015 02:00:57 +0000 (04:00 +0200)]
Fix source IP address for ICMP unreachable packets generated by tinc.
Try to send ICMP unreachable replies from an address assigned to the
local machine, instead of the destination address of the original
packet.
The address is found by looking up the route towards the sender of
the packet that generated the error; in usual configurations, this
is the tinc interface.
This also fixes the traceroute display in mtr when using the
DecrementTTL option.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Vittorio Gambaletta (VittGam) [Thu, 3 Sep 2015 14:02:50 +0000 (16:02 +0200)]
Fix DecrementTTL option.
The option was not actually working, as it could be seen on traceroute or mtr.
The problem is that it was checking if the TTL was < 1 (so equal to 0) before decrementing it.
This meant that a packet with a TTL of 1 was being sent with a TTL of 0 on the VPN, instead of being discarded with the ICMP error message.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Florian Weik [Fri, 28 Aug 2015 12:52:21 +0000 (14:52 +0200)]
Fix NAME variable in subnet-* scripts for local subnets.
Guus Sliepen [Sun, 5 Jul 2015 14:12:07 +0000 (16:12 +0200)]
Releasing 1.0.26.
Guus Sliepen [Sun, 5 Jul 2015 14:04:11 +0000 (16:04 +0200)]
Don't try to call res_init() if ./configure told us it doesn't exist.
Guus Sliepen [Sun, 5 Jul 2015 14:03:22 +0000 (16:03 +0200)]
Fix unputenv() on Windows.
Guus Sliepen [Sun, 5 Jul 2015 14:03:03 +0000 (16:03 +0200)]
Only check for -fno-strict-overflow if -fwrapv does not work.
Guus Sliepen [Sun, 5 Jul 2015 13:31:24 +0000 (15:31 +0200)]
Attribution for various contributors.