X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fnet.c;h=016b86ad6207e19603f3f2d64972a63a521bf14a;hp=3df55a76b03540254c6e5580057c5d053d66120e;hb=15246df85d6171c92478541a835effb96d6085c4;hpb=f6d79366b3efaef0a458717aac5e6754630dd434

diff --git a/src/net.c b/src/net.c
index 3df55a76..016b86ad 100644
--- a/src/net.c
+++ b/src/net.c
@@ -17,7 +17,7 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
-    $Id: net.c,v 1.35.4.25 2000/08/09 09:34:21 guus Exp $
+    $Id: net.c,v 1.35.4.64 2000/11/04 15:32:05 zarq Exp $
 */
 
 #include "config.h"
@@ -25,6 +25,8 @@
 #include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/sockios.h>
+#include <net/if.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <stdio.h>
@@ -36,165 +38,182 @@
 #include <sys/types.h>
 #include <syslog.h>
 #include <unistd.h>
+#include <sys/ioctl.h>
+#include <openssl/rand.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+
+#ifdef HAVE_TUNTAP
+#include LINUX_IF_TUN_H
+#endif
 
-#include <cipher.h>
 #include <utils.h>
 #include <xalloc.h>
 
 #include "conf.h"
-#include "encr.h"
+#include "connlist.h"
+#include "meta.h"
 #include "net.h"
 #include "netutl.h"
 #include "protocol.h"
+#include "subnet.h"
 
 #include "system.h"
 
 int tap_fd = -1;
-
+int taptype = TAP_TYPE_ETHERTAP;
 int total_tap_in = 0;
 int total_tap_out = 0;
 int total_socket_in = 0;
 int total_socket_out = 0;
 
-int upstreamindex = 0;
+config_t *upstreamcfg;
 static int seconds_till_retry;
 
-/* The global list of existing connections */
-conn_list_t *conn_list = NULL;
-conn_list_t *myself = NULL;
+int keylifetime = 0;
+int keyexpires = 0;
 
-/*
-  strip off the MAC adresses of an ethernet frame
-*/
-void strip_mac_addresses(vpn_packet_t *p)
-{
-  unsigned char tmp[MAXSIZE];
-cp
-  memcpy(tmp, p->data, p->len);
-  p->len -= 12;
-  memcpy(p->data, &tmp[12], p->len);
-cp
-}
+char *unknown = NULL;
+char *interface_name = NULL;  /* Contains the name of the interface */
+
+subnet_t mymac;
 
 /*
-  reassemble MAC addresses
+  Execute the given script.
+  This function doesn't really belong here.
 */
-void add_mac_addresses(vpn_packet_t *p)
+int execute_script(const char* name)
 {
-  unsigned char tmp[MAXSIZE];
-cp
-  memcpy(&tmp[12], p->data, p->len);
-  p->len += 12;
-  tmp[0] = tmp[6] = 0xfe;
-  tmp[1] = tmp[7] = 0xfd;
-  *((ip_t*)(&tmp[2])) = (ip_t)(htonl(myself->vpn_ip));
-  *((ip_t*)(&tmp[8])) = *((ip_t*)(&tmp[26]));
-  memcpy(p->data, &tmp[0], p->len);
-cp
+  char *scriptname;
+  pid_t pid;
+  char *s;
+
+  if((pid = fork()) < 0)
+    {
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fork");
+      return -1;
+    }
+
+  if(pid)
+    {
+      return 0;
+    }
+
+  /* Child here */
+
+  asprintf(&scriptname, "%s/%s", confbase, name);
+  asprintf(&s, "IFNAME=%s", interface_name);
+  putenv(s);
+  free(s);
+
+  if(netname)
+    {
+      asprintf(&s, "NETNAME=%s", netname);
+      putenv(s);
+      free(s);
+    }
+  else
+    {
+      unsetenv("NETNAME");
+    }
+
+  if(chdir(confbase) < 0)
+    {
+      syslog(LOG_ERR, _("Couldn't chdir to `%s': %m"),
+	     confbase);
+    }
+  
+  execl(scriptname, NULL);
+  /* No return on success */
+  
+  if(errno != ENOENT)  /* Ignore if the file does not exist */
+    syslog(LOG_WARNING, _("Error executing `%s': %m"), scriptname);
+
+  /* No need to free things */
+  exit(0);
 }
 
-int xsend(conn_list_t *cl, void *packet)
+int xsend(conn_list_t *cl, vpn_packet_t *inpkt)
 {
-  real_packet_t rp;
+  vpn_packet_t outpkt;
+  int outlen, outpad;
+  EVP_CIPHER_CTX ctx;
 cp
-  do_encrypt((vpn_packet_t*)packet, &rp, cl->key);
-  rp.from = htonl(myself->vpn_ip);
-  rp.data.len = htons(rp.data.len);
-  rp.len = htons(rp.len);
+  outpkt.len = inpkt->len;
+  
+  /* Encrypt the packet */
+  
+  EVP_EncryptInit(&ctx, cl->cipher_pkttype, cl->cipher_pktkey, cl->cipher_pktkey + cl->cipher_pkttype->key_len);
+  EVP_EncryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len);
+  EVP_EncryptFinal(&ctx, outpkt.data + outlen, &outpad);
+  outlen += outpad + 2;
 
-  if(debug_lvl > 3)
+/* Bypass
+  outlen = outpkt.len + 2;
+  memcpy(&outpkt, inpkt, outlen);
+*/  
+
+  if(debug_lvl >= DEBUG_TRAFFIC)
     syslog(LOG_ERR, _("Sending packet of %d bytes to %s (%s)"),
-           ntohs(rp.len), cl->vpn_hostname, cl->real_hostname);
+           outlen, cl->name, cl->hostname);
 
-  total_socket_out += ntohs(rp.len);
+  total_socket_out += outlen;
 
   cl->want_ping = 1;
 
-  if((cl->flags | myself->flags) & TCPONLY)
-      return send_tcppacket(cl, (void*)&rp, ntohs(rp.len));
-
-  if((send(cl->socket, (char*)&rp, ntohs(rp.len), 0)) < 0)
+  if((send(cl->socket, (char *) &(outpkt.len), outlen, 0)) < 0)
     {
       syslog(LOG_ERR, _("Error sending packet to %s (%s): %m"),
-             cl->vpn_hostname, cl->real_hostname);
+             cl->name, cl->hostname);
       return -1;
     }
 cp
   return 0;
 }
 
-int xrecv(conn_list_t *cl, void *packet)
+int xrecv(vpn_packet_t *inpkt)
 {
-  vpn_packet_t vp;
-  int lenin;
+  vpn_packet_t outpkt;
+  int outlen, outpad;
+  EVP_CIPHER_CTX ctx;
 cp
-  do_decrypt((real_packet_t*)packet, &vp, cl->key);
-  add_mac_addresses(&vp);
+  outpkt.len = inpkt->len;
 
-  if(debug_lvl > 3)
-    syslog(LOG_ERR, _("Receiving packet of %d bytes from %s (%s)"),
-           ((real_packet_t*)packet)->len, cl->vpn_hostname, cl->real_hostname);
+  /* Decrypt the packet */
 
-  if((lenin = write(tap_fd, &vp, vp.len + sizeof(vp.len))) < 0)
-    syslog(LOG_ERR, _("Can't write to tap device: %m"));
-  else
-    total_tap_out += lenin;
+  EVP_DecryptInit(&ctx, myself->cipher_pkttype, myself->cipher_pktkey, myself->cipher_pktkey + myself->cipher_pkttype->key_len);
+  EVP_DecryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len + 8);
+  EVP_DecryptFinal(&ctx, outpkt.data + outlen, &outpad);
+  outlen += outpad;
 
-  cl->want_ping = 0;
-  cl->last_ping_time = time(NULL);
-cp
-  return 0;
-}
-
-int tcprecv(conn_list_t *cl, real_packet_t *rp)
-{
-  vpn_packet_t vp;
-  int lenin;
-  conn_list_t *f;
-cp
-  rp->data.len = ntohs(rp->data.len);
-  rp->len = ntohs(rp->len);
-  rp->from = ntohl(rp->from);
-
-  total_socket_in += rp->len;
-  
-  if(rp->len >= 0)
-    {
-      f = lookup_conn(rp->from);
-      if(!f)
-	{
-	  syslog(LOG_ERR, _("Got packet from %s (%s) with unknown origin %d.%d.%d.%d?"),
-		 cl->vpn_hostname, cl->real_hostname, IP_ADDR_V(rp->from));
-	  return -1;
-	}
+/* Bypass
+  outlen = outpkt.len+2;
+  memcpy(&outpkt, inpkt, outlen);
+*/
+     
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    syslog(LOG_ERR, _("Writing packet of %d bytes to tap device"),
+           outpkt.len, outlen);
 
-      if(f->status.validkey)
-        {
-          do_decrypt(rp, &vp, cl->key);
-          add_mac_addresses(&vp);
+  /* Fix mac address */
 
-          if(debug_lvl > 3)
-            syslog(LOG_ERR, _("Receiving packet of %d bytes from %s (%s)"),
-                   rp->len, cl->vpn_hostname, cl->real_hostname);
+  memcpy(outpkt.data, mymac.net.mac.address.x, 6);
 
-          if((lenin = write(tap_fd, &vp, vp.len + sizeof(vp.len))) < 0)
-            syslog(LOG_ERR, _("Can't write to tap device: %m"));
-          else
-            total_tap_out += lenin;
-        }
+  if(taptype == TAP_TYPE_TUNTAP)
+    {
+      if(write(tap_fd, outpkt.data, outpkt.len) < 0)
+        syslog(LOG_ERR, _("Can't write to tun/tap device: %m"));
       else
-	{
-          add_queue(&(cl->sq), rp, rp->len + 2);
-	  if(!cl->status.waitingforkey)
-	    send_key_request(rp->from);
-	}
-
-      if(my_key_expiry <= time(NULL))
-	regenerate_keys();
+        total_tap_out += outpkt.len;
+    }
+  else	/* ethertap */
+    {
+      if(write(tap_fd, outpkt.data - 2, outpkt.len + 2) < 0)
+        syslog(LOG_ERR, _("Can't write to ethertap device: %m"));
+      else
+        total_tap_out += outpkt.len + 2;
     }
-
-  cl->want_ping = 0;
-  cl->last_ping_time = time(NULL);
 cp
   return 0;
 }
@@ -291,7 +310,7 @@ cp
       p = next;
     }
 
-  if(debug_lvl > 3)
+  if(debug_lvl >= DEBUG_TRAFFIC)
     syslog(LOG_DEBUG, _("Queue flushed"));
 cp
 }
@@ -306,17 +325,17 @@ void flush_queues(conn_list_t *cl)
 cp
   if(cl->sq)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >= DEBUG_TRAFFIC)
 	syslog(LOG_DEBUG, _("Flushing send queue for %s (%s)"),
-	       cl->vpn_hostname, cl->real_hostname);
+	       cl->name, cl->hostname);
       flush_queue(cl, &(cl->sq), xsend);
     }
 
   if(cl->rq)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >=  DEBUG_TRAFFIC)
 	syslog(LOG_DEBUG, _("Flushing receive queue for %s (%s)"),
-	       cl->vpn_hostname, cl->real_hostname);
+	       cl->name, cl->hostname);
       flush_queue(cl, &(cl->rq), xrecv);
     }
 cp
@@ -328,96 +347,54 @@ cp
 int send_packet(ip_t to, vpn_packet_t *packet)
 {
   conn_list_t *cl;
+  subnet_t *subnet;
 cp
-  if((cl = lookup_conn(to)) == NULL)
+  if((subnet = lookup_subnet_ipv4(to)) == NULL)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >= DEBUG_TRAFFIC)
         {
           syslog(LOG_NOTICE, _("Trying to look up %d.%d.%d.%d in connection list failed!"),
 	         IP_ADDR_V(to));
         }
-        
-      /* Is this really necessary? If we can't find "to", then neither should any uplink. (GS) */
-      
+
       return -1;
-        
-      for(cl = conn_list; cl != NULL && !cl->status.outgoing; cl = cl->next);
-      if(!cl)
-        { /* No open outgoing connection has been found. */
-	  if(debug_lvl > 3)
-	    syslog(LOG_NOTICE, _("There is no remote host I can send this packet to!"));
-          return -1;
-        }
-    }
+   }
+
+  cl = subnet->owner;
     
   /* If we ourselves have indirectdata flag set, we should send only to our uplink! */
-  
-  if(myself->flags & EXPORTINDIRECTDATA)
-    {
-      for(cl = conn_list; cl != NULL && !cl->status.outgoing; cl = cl->next);
-      if(!cl)
-        { /* No open outgoing connection has been found. */
-	  if(debug_lvl > 3)
-	    syslog(LOG_NOTICE, _("There is no remote host I can send this packet to!"));
-          return -1;
-        }
-    }
-  else
-
-  /* If indirectdata flag is set for the destination we just looked up,
-   * then real_ip is actually the vpn_ip of the gateway tincd
-   * it is behind.
-   */
-   
-  if(cl->flags & INDIRECTDATA)
-    {
-      if(debug_lvl > 3)
-        syslog(LOG_NOTICE, _("Indirect packet to %s via %s"),
-               cl->vpn_hostname, cl->real_hostname);
-      if((cl = lookup_conn(cl->real_ip)) == NULL)
-        {
-          if(debug_lvl > 3)
-              syslog(LOG_NOTICE, _("Indirect look up %d.%d.%d.%d in connection list failed!"),
-	             IP_ADDR_V(to));
-            
-          /* Gateway tincd dead? Should we kill it? (GS) */
-
-          return -1;
-        }
-      if(cl->flags & INDIRECTDATA)  /* This should not happen */
-        {
-          if(debug_lvl > 3)
-              syslog(LOG_NOTICE, _("Double indirection for %d.%d.%d.%d"),
-	             IP_ADDR_V(to));
-          return -1;        
-        }
-    }            
-
-  if(my_key_expiry <= time(NULL))
-    regenerate_keys();
 
+  /* FIXME - check for indirection and reprogram it The Right Way(tm) this time. */
+  
   if(!cl->status.dataopen)
     if(setup_vpn_connection(cl) < 0)
       {
-        syslog(LOG_ERR, _("Could not open UDP connection to %s (%s)"), cl->vpn_hostname, cl->real_hostname);
+        syslog(LOG_ERR, _("Could not open UDP connection to %s (%s)"),
+	       cl->name, cl->hostname);
         return -1;
       }
       
   if(!cl->status.validkey)
     {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("%s (%s) has no valid key, queueing packet"), cl->vpn_hostname, cl->real_hostname);
+/* FIXME: Don't queue until everything else is fixed.
+      if(debug_lvl >= DEBUG_TRAFFIC)
+	syslog(LOG_INFO, _("No valid key known yet for %s (%s), queueing packet"),
+	       cl->name, cl->hostname);
       add_queue(&(cl->sq), packet, packet->len + 2);
+*/
       if(!cl->status.waitingforkey)
-	send_key_request(cl->vpn_ip);			/* Keys should be sent to the host running the tincd */
+	send_req_key(myself, cl);			/* Keys should be sent to the host running the tincd */
       return 0;
     }
 
   if(!cl->status.active)
     {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("%s (%s) is not ready, queueing packet"), cl->vpn_hostname, cl->real_hostname);
+/* FIXME: Don't queue until everything else is fixed.
+      if(debug_lvl >= DEBUG_TRAFFIC)
+	syslog(LOG_INFO, _("%s (%s) is not ready, queueing packet"),
+	       cl->name, cl->hostname);
       add_queue(&(cl->sq), packet, packet->len + 2);
+*/
       return 0; /* We don't want to mess up, do we? */
     }
 
@@ -434,19 +411,58 @@ int setup_tap_fd(void)
   int nfd;
   const char *tapfname;
   config_t const *cfg;
+  struct ifreq ifr;
+
 cp  
-  if((cfg = get_config_val(tapdevice)) == NULL)
-    tapfname = "/dev/tap0";
-  else
+  if((cfg = get_config_val(config, tapdevice)))
     tapfname = cfg->data.ptr;
-
+  else
+#ifdef HAVE_TUNTAP
+    tapfname = "/dev/misc/net/tun";
+#else
+    tapfname = "/dev/tap0";
+#endif
+cp
   if((nfd = open(tapfname, O_RDWR | O_NONBLOCK)) < 0)
     {
       syslog(LOG_ERR, _("Could not open %s: %m"), tapfname);
       return -1;
     }
-
+cp
   tap_fd = nfd;
+
+  /* Set default MAC address for ethertap devices */
+  
+  taptype = TAP_TYPE_ETHERTAP;
+  mymac.type = SUBNET_MAC;
+  mymac.net.mac.address.x[0] = 0xfe;
+  mymac.net.mac.address.x[1] = 0xfd;
+  mymac.net.mac.address.x[2] = 0x00;
+  mymac.net.mac.address.x[3] = 0x00;
+  mymac.net.mac.address.x[4] = 0x00;
+  mymac.net.mac.address.x[5] = 0x00;
+
+#ifdef HAVE_TUNTAP
+  /* Ok now check if this is an old ethertap or a new tun/tap thingie */
+  memset(&ifr, 0, sizeof(ifr));
+cp
+  ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
+  if (netname)
+    strncpy(ifr.ifr_name, netname, IFNAMSIZ);
+cp
+  if (!ioctl(tap_fd, TUNSETIFF, (void *) &ifr))
+  { 
+    syslog(LOG_INFO, _("%s is a new style tun/tap device"), tapfname);
+    taptype = TAP_TYPE_TUNTAP;
+  }
+#endif
+
+  /* Add name of network interface to environment (for scripts) */
+
+  ioctl(tap_fd, SIOCGIFNAME, (void *) &ifr);
+  interface_name = xmalloc(strlen(ifr.ifr_name));
+  strcpy(interface_name, ifr.ifr_name);
+  
 cp
   return 0;
 }
@@ -460,6 +476,7 @@ int setup_listen_meta_socket(int port)
   int nfd, flags;
   struct sockaddr_in a;
   const int one = 1;
+  config_t const *cfg;
 cp
   if((nfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
     {
@@ -469,27 +486,43 @@ cp
 
   if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   flags = fcntl(nfd, F_GETFL);
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
-      syslog(LOG_ERR, _("fcntl: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fcntl");
       return -1;
     }
 
+  if((cfg = get_config_val(config, interface)))
+    {
+      if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, cfg->data.ptr, strlen(cfg->data.ptr)))
+        {
+          syslog(LOG_ERR, _("Unable to bind listen socket to interface %s: %m"), cfg->data.ptr);
+          return -1;
+        }
+    }
+
   memset(&a, 0, sizeof(a));
   a.sin_family = AF_INET;
   a.sin_port = htons(port);
-  a.sin_addr.s_addr = htonl(INADDR_ANY);
+  
+  if((cfg = get_config_val(config, interfaceip)))
+    a.sin_addr.s_addr = htonl(cfg->data.ip->address);
+  else
+    a.sin_addr.s_addr = htonl(INADDR_ANY);
 
   if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
     {
@@ -499,7 +532,8 @@ cp
 
   if(listen(nfd, 3))
     {
-      syslog(LOG_ERR, _("listen: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "listen");
       return -1;
     }
 cp
@@ -524,14 +558,16 @@ cp
 
   if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   flags = fcntl(nfd, F_GETFL);
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
-      syslog(LOG_ERR, _("fcntl: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fcntl");
       return -1;
     }
 
@@ -558,10 +594,10 @@ int setup_outgoing_meta_socket(conn_list_t *cl)
   struct sockaddr_in a;
   config_t const *cfg;
 cp
-  if(debug_lvl > 0)
-    syslog(LOG_INFO, _("Trying to connect to %s"), cl->real_hostname);
+  if(debug_lvl >= DEBUG_CONNECTIONS)
+    syslog(LOG_INFO, _("Trying to connect to %s"), cl->hostname);
 
-  if((cfg = get_config_val(upstreamport)) == NULL)
+  if((cfg = get_config_val(cl->config, port)) == NULL)
     cl->port = 655;
   else
     cl->port = cfg->data.val;
@@ -570,17 +606,17 @@ cp
   if(cl->meta_socket == -1)
     {
       syslog(LOG_ERR, _("Creating socket for %s port %d failed: %m"),
-             cl->real_hostname, cl->port);
+             cl->hostname, cl->port);
       return -1;
     }
 
   a.sin_family = AF_INET;
   a.sin_port = htons(cl->port);
-  a.sin_addr.s_addr = htonl(cl->real_ip);
+  a.sin_addr.s_addr = htonl(cl->address);
 
   if(connect(cl->meta_socket, (struct sockaddr *)&a, sizeof(a)) == -1)
     {
-      syslog(LOG_ERR, _("%s port %hd: %m"), cl->real_hostname, cl->port);
+      syslog(LOG_ERR, _("%s port %hd: %m"), cl->hostname, cl->port);
       return -1;
     }
 
@@ -588,13 +624,15 @@ cp
   if(fcntl(cl->meta_socket, F_SETFL, flags | O_NONBLOCK) < 0)
     {
       syslog(LOG_ERR, _("fcntl for %s port %d: %m"),
-             cl->real_hostname, cl->port);
+             cl->hostname, cl->port);
       return -1;
     }
 
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_INFO, _("Connected to %s port %hd"),
-         cl->real_hostname, cl->port);
+         cl->hostname, cl->port);
+
+  cl->status.meta = 1;
 cp
   return 0;
 }
@@ -606,84 +644,192 @@ cp
   an authentication sequence during which
   we will do just that.
 */
-int setup_outgoing_connection(char *hostname)
+int setup_outgoing_connection(char *name)
 {
   conn_list_t *ncn;
   struct hostent *h;
+  config_t const *cfg;
 cp
-  if(!(h = gethostbyname(hostname)))
+  if(check_id(name))
     {
-      syslog(LOG_ERR, _("Error looking up `%s': %m"), hostname);
+      syslog(LOG_ERR, _("Invalid name for outgoing connection"));
       return -1;
     }
 
   ncn = new_conn_list();
-  ncn->real_ip = ntohl(*((ip_t*)(h->h_addr_list[0])));
-  ncn->real_hostname = hostlookup(htonl(ncn->real_ip));
+  asprintf(&ncn->name, "%s", name);
+    
+  if(read_host_config(ncn))
+    {
+      syslog(LOG_ERR, _("Error reading host configuration file for %s"));
+      free_conn_list(ncn);
+      return -1;
+    }
+    
+  if(!(cfg = get_config_val(ncn->config, address)))
+    {
+      syslog(LOG_ERR, _("No address specified for %s"));
+      free_conn_list(ncn);
+      return -1;
+    }
+    
+  if(!(h = gethostbyname(cfg->data.ptr)))
+    {
+      syslog(LOG_ERR, _("Error looking up `%s': %m"), cfg->data.ptr);
+      free_conn_list(ncn);
+      return -1;
+    }
+
+  ncn->address = ntohl(*((ip_t*)(h->h_addr_list[0])));
+  ncn->hostname = hostlookup(htonl(ncn->address));
   
   if(setup_outgoing_meta_socket(ncn) < 0)
     {
       syslog(LOG_ERR, _("Could not set up a meta connection to %s"),
-             ncn->real_hostname);
-      free_conn_element(ncn);
+             ncn->hostname);
+      free_conn_list(ncn);
       return -1;
     }
 
-  ncn->status.meta = 1;
   ncn->status.outgoing = 1;
-  ncn->next = conn_list;
-  conn_list = ncn;
+  ncn->buffer = xmalloc(MAXBUFSIZE);
+  ncn->buflen = 0;
+  ncn->last_ping_time = time(NULL);
+  ncn->want_ping = 0;
+
+  conn_list_add(ncn);
+
+  send_id(ncn);
 cp
   return 0;
 }
 
 /*
-  set up the local sockets (listen only)
+  Configure conn_list_t myself and set up the local sockets (listen only)
 */
 int setup_myself(void)
 {
   config_t const *cfg;
+  subnet_t *net;
 cp
   myself = new_conn_list();
 
-  if(!(cfg = get_config_val(myvpnip)))
+  asprintf(&myself->hostname, "MYSELF"); /* FIXME? Do hostlookup on ourselves? */
+  myself->flags = 0;
+  myself->protocol_version = PROT_CURRENT;
+
+  if(!(cfg = get_config_val(config, tincname))) /* Not acceptable */
     {
-      syslog(LOG_ERR, _("No value for my VPN IP given"));
+      syslog(LOG_ERR, _("Name for tinc daemon required!"));
       return -1;
     }
+  else
+    asprintf(&myself->name, "%s", (char*)cfg->data.val);
 
-  myself->vpn_ip = cfg->data.ip->ip;
-  myself->vpn_hostname = hostlookup(htonl(myself->vpn_ip));
-  myself->real_hostname = hostlookup(htonl(myself->vpn_ip));
-  myself->vpn_mask = cfg->data.ip->mask;
-  myself->flags = 0;
+  if(check_id(myself->name))
+    {
+      syslog(LOG_ERR, _("Invalid name for myself!"));
+      return -1;
+    }
+cp
+  if(!(cfg = get_config_val(config, privatekey)))
+    {
+      syslog(LOG_ERR, _("Private key for tinc daemon required!"));
+      return -1;
+    }
+  else
+    {
+      myself->rsa_key = RSA_new();
+      BN_hex2bn(&myself->rsa_key->d, cfg->data.ptr);
+      BN_hex2bn(&myself->rsa_key->e, "FFFF");
+    }
 
-  if(!(cfg = get_config_val(listenport)))
+  if(read_host_config(myself))
+    {
+      syslog(LOG_ERR, _("Cannot open host configuration file for myself!"));
+      return -1;
+    }
+cp  
+  if(!(cfg = get_config_val(myself->config, publickey)))
+    {
+      syslog(LOG_ERR, _("Public key for tinc daemon required!"));
+      return -1;
+    }
+  else
+    {
+      BN_hex2bn(&myself->rsa_key->n, cfg->data.ptr);
+    }
+/*
+  if(RSA_check_key(myself->rsa_key) != 1)
+    {
+      syslog(LOG_ERR, _("Invalid public/private keypair!"));
+      return -1;
+    }
+*/
+  if(!(cfg = get_config_val(myself->config, port)))
     myself->port = 655;
   else
     myself->port = cfg->data.val;
 
-  if((cfg = get_config_val(indirectdata)))
+  if((cfg = get_config_val(myself->config, indirectdata)))
     if(cfg->data.val == stupid_true)
       myself->flags |= EXPORTINDIRECTDATA;
 
-  if((cfg = get_config_val(tcponly)))
+  if((cfg = get_config_val(myself->config, tcponly)))
     if(cfg->data.val == stupid_true)
       myself->flags |= TCPONLY;
 
+/* Read in all the subnets specified in the host configuration file */
+
+  for(cfg = myself->config; (cfg = get_config_val(cfg, subnet)); cfg = cfg->next)
+    {
+      net = new_subnet();
+      net->type = SUBNET_IPV4;
+      net->net.ipv4.address = cfg->data.ip->address;
+      net->net.ipv4.mask = cfg->data.ip->mask;
+      
+      /* Teach newbies what subnets are... */
+      
+      if((net->net.ipv4.address & net->net.ipv4.mask) != net->net.ipv4.address)
+        {
+          syslog(LOG_ERR, _("Network address and subnet mask do not match!"));
+          return -1;
+        }        
+      
+      subnet_add(myself, net);
+    }
+    
   if((myself->meta_socket = setup_listen_meta_socket(myself->port)) < 0)
     {
-      syslog(LOG_ERR, _("Unable to set up a listening socket"));
+      syslog(LOG_ERR, _("Unable to set up a listening socket!"));
       return -1;
     }
 
   if((myself->socket = setup_vpn_in_socket(myself->port)) < 0)
     {
-      syslog(LOG_ERR, _("Unable to set up an incoming vpn data socket"));
+      syslog(LOG_ERR, _("Unable to set up an incoming vpn data socket!"));
       close(myself->meta_socket);
       return -1;
     }
 
+  /* Generate packet encryption key */
+
+  myself->cipher_pkttype = EVP_bf_cfb();
+
+  myself->cipher_pktkeylength = myself->cipher_pkttype->key_len + myself->cipher_pkttype->iv_len;
+
+  myself->cipher_pktkey = (char *)xmalloc(myself->cipher_pktkeylength);
+  RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
+
+  if(!(cfg = get_config_val(config, keyexpire)))
+    keylifetime = 3600;
+  else
+    keylifetime = cfg->data.val;
+    
+  keyexpires = time(NULL) + keylifetime;
+
+  /* Activate ourselves */
+  
   myself->status.active = 1;
 
   syslog(LOG_NOTICE, _("Ready: listening on port %hd"), myself->port);
@@ -696,20 +842,25 @@ sigalrm_handler(int a)
 {
   config_t const *cfg;
 cp
-  cfg = get_next_config_val(upstreamip, upstreamindex++);
+  cfg = get_config_val(upstreamcfg, connectto);
+
+  if(!cfg && upstreamcfg == config)
+    /* No upstream IP given, we're listen only. */
+    return;
 
   while(cfg)
     {
+      upstreamcfg = cfg->next;
       if(!setup_outgoing_connection(cfg->data.ptr))   /* function returns 0 when there are no problems */
         {
           signal(SIGALRM, SIG_IGN);
           return;
         }
-      cfg = get_next_config_val(upstreamip, upstreamindex++); /* Or else we try the next ConnectTo line */
+      cfg = get_config_val(upstreamcfg, connectto); /* Or else we try the next ConnectTo line */
     }
 
   signal(SIGALRM, sigalrm_handler);
-  upstreamindex = 0;
+  upstreamcfg = config;
   seconds_till_retry += 5;
   if(seconds_till_retry > MAXTIMEOUT)    /* Don't wait more than MAXTIMEOUT seconds. */
     seconds_till_retry = MAXTIMEOUT;
@@ -726,7 +877,7 @@ int setup_network_connections(void)
 {
   config_t const *cfg;
 cp
-  if((cfg = get_config_val(pingtimeout)) == NULL)
+  if((cfg = get_config_val(config, pingtimeout)) == NULL)
     timeout = 5;
   else
     timeout = cfg->data.val;
@@ -737,19 +888,23 @@ cp
   if(setup_myself() < 0)
     return -1;
 
-  if((cfg = get_next_config_val(upstreamip, upstreamindex++)) == NULL)
+  /* Run tinc-up script to further initialize the tap interface */
+  execute_script("tinc-up");
+  
+  if(!(cfg = get_config_val(config, connectto)))
     /* No upstream IP given, we're listen only. */
     return 0;
 
   while(cfg)
     {
+      upstreamcfg = cfg->next;
       if(!setup_outgoing_connection(cfg->data.ptr))   /* function returns 0 when there are no problems */
         return 0;
-      cfg = get_next_config_val(upstreamip, upstreamindex++); /* Or else we try the next ConnectTo line */
+      cfg = get_config_val(upstreamcfg, connectto); /* Or else we try the next ConnectTo line */
     }
     
   signal(SIGALRM, sigalrm_handler);
-  upstreamindex = 0;
+  upstreamcfg = config;
   seconds_till_retry = MAXTIMEOUT;
   syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in %d seconds"), seconds_till_retry);
   alarm(seconds_till_retry);
@@ -766,17 +921,8 @@ void close_network_connections(void)
 cp
   for(p = conn_list; p != NULL; p = p->next)
     {
-      if(p->status.dataopen)
-	{
-	  shutdown(p->socket, 0); /* No more receptions */
-	  close(p->socket);
-	}
-      if(p->status.meta)
-	{
-	  send_termreq(p);
-	  shutdown(p->meta_socket, 0); /* No more receptions */
-          close(p->meta_socket);
-        }
+      p->status.active = 0;
+      terminate_connection(p);
     }
 
   if(myself)
@@ -784,9 +930,15 @@ cp
       {
 	close(myself->meta_socket);
 	close(myself->socket);
+        free_conn_list(myself);
+        myself = NULL;
       }
 
   close(tap_fd);
+
+  /* Execute tinc-down script right after shutting down the interface */
+  execute_script("tinc-down");
+
   destroy_conn_list();
 
   syslog(LOG_NOTICE, _("Terminating"));
@@ -802,8 +954,8 @@ int setup_vpn_connection(conn_list_t *cl)
   int nfd, flags;
   struct sockaddr_in a;
 cp
-  if(debug_lvl > 0)
-    syslog(LOG_DEBUG, _("Opening UDP socket to %s"), cl->real_hostname);
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    syslog(LOG_DEBUG, _("Opening UDP socket to %s"), cl->hostname);
 
   nfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
   if(nfd == -1)
@@ -814,12 +966,12 @@ cp
 
   a.sin_family = AF_INET;
   a.sin_port = htons(cl->port);
-  a.sin_addr.s_addr = htonl(cl->real_ip);
+  a.sin_addr.s_addr = htonl(cl->address);
 
   if(connect(nfd, (struct sockaddr *)&a, sizeof(a)) == -1)
     {
       syslog(LOG_ERR, _("Connecting to %s port %d failed: %m"),
-	     cl->real_hostname, cl->port);
+	     cl->hostname, cl->port);
       return -1;
     }
 
@@ -827,7 +979,7 @@ cp
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
       syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m %s (%s)"), __FILE__, __LINE__, nfd,
-             cl->vpn_hostname, cl->real_hostname);
+             cl->name, cl->hostname);
       return -1;
     }
 
@@ -851,27 +1003,26 @@ cp
 
   if(getpeername(sfd, &ci, &len) < 0)
     {
-      syslog(LOG_ERR, _("Error: getpeername: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "getpeername");
       return NULL;
     }
 
-  p->real_ip = ntohl(ci.sin_addr.s_addr);
-  p->real_hostname = hostlookup(ci.sin_addr.s_addr);
+  p->name = unknown;
+  p->address = ntohl(ci.sin_addr.s_addr);
+  p->hostname = hostlookup(ci.sin_addr.s_addr);
   p->meta_socket = sfd;
   p->status.meta = 1;
+  p->buffer = xmalloc(MAXBUFSIZE);
   p->buflen = 0;
   p->last_ping_time = time(NULL);
   p->want_ping = 0;
   
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_NOTICE, _("Connection from %s port %d"),
-         p->real_hostname, htons(ci.sin_port));
+         p->hostname, htons(ci.sin_port));
 
-  if(send_basic_info(p) < 0)
-    {
-      free_conn_element(p);
-      return NULL;
-    }
+  p->allow_request = ID;
 cp
   return p;
 }
@@ -904,63 +1055,39 @@ cp
   udp socket and write it to the ethertap
   device after being decrypted
 */
-int handle_incoming_vpn_data(conn_list_t *cl)
+int handle_incoming_vpn_data()
 {
-  real_packet_t rp;
-  int lenin;
+  vpn_packet_t pkt;
   int x, l = sizeof(x);
-  conn_list_t *f;
+  struct sockaddr from;
+  int lenin;
+  socklen_t fromlen = sizeof(from);
 cp
-  if(getsockopt(cl->socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
+  if(getsockopt(myself->socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
     {
-      syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m %s (%s)"), __FILE__, __LINE__, cl->socket,
-             cl->vpn_hostname, cl->real_hostname);
+      syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m"),
+	     __FILE__, __LINE__, myself->socket);
       return -1;
     }
   if(x)
     {
-      syslog(LOG_ERR, _("Incoming data socket error for %s (%s): %s"),
-             cl->vpn_hostname, cl->real_hostname, sys_errlist[x]);
+      syslog(LOG_ERR, _("Incoming data socket error: %s"), strerror(x));
       return -1;
     }
 
-  rp.len = -1;
-  lenin = recvfrom(cl->socket, &rp, MTU, 0, NULL, NULL);
-  if(lenin <= 0)
+  if((lenin = recvfrom(myself->socket, (char *) &(pkt.len), MTU, 0, &from, &fromlen)) <= 0)
     {
-      syslog(LOG_ERR, _("Receiving packet from %s (%s) failed: %m"), cl->vpn_hostname, cl->real_hostname);
+      syslog(LOG_ERR, _("Receiving packet failed: %m"));
       return -1;
     }
-  total_socket_in += lenin;
 
-  rp.data.len = ntohs(rp.data.len);
-  rp.len = ntohs(rp.len);
-  rp.from = ntohl(rp.from);
-
-  if(rp.len >= 0)
+  if(debug_lvl >= DEBUG_TRAFFIC)
     {
-      f = lookup_conn(rp.from);
-      if(!f)
-	{
-	  syslog(LOG_ERR, _("Got packet from %s (%s) with unknown origin %d.%d.%d.%d?"),
-		 cl->vpn_hostname, cl->real_hostname, IP_ADDR_V(rp.from));
-	  return -1;
-	}
-
-      if(f->status.validkey)
-	xrecv(f, &rp);
-      else
-	{
-	  add_queue(&(f->rq), &rp, rp.len);
-	  if(!cl->status.waitingforkey)
-	    send_key_request(rp.from);
-	}
+      syslog(LOG_DEBUG, _("Received packet of %d bytes"), lenin);
+    } 
 
-      if(my_key_expiry <= time(NULL))
-	regenerate_keys();
-    }
 cp
-  return 0;
+  return xrecv(&pkt);
 }
 
 /*
@@ -970,58 +1097,56 @@ cp
 void terminate_connection(conn_list_t *cl)
 {
   conn_list_t *p;
-
+  subnet_t *s;
 cp
   if(cl->status.remove)
     return;
 
-  if(debug_lvl > 0)
-    syslog(LOG_NOTICE, _("Closing connection with %s (%s)"),
-           cl->vpn_hostname, cl->real_hostname);
+  cl->status.remove = 1;
 
-  if(cl->status.timeout)
-    send_timeout(cl);
-/*  else if(!cl->status.termreq)
-    send_termreq(cl);
- */
+  if(debug_lvl >= DEBUG_CONNECTIONS)
+    syslog(LOG_NOTICE, _("Closing connection with %s (%s)"),
+           cl->name, cl->hostname);
  
   if(cl->socket)
     close(cl->socket);
   if(cl->status.meta)
     close(cl->meta_socket);
 
-  cl->status.remove = 1;
-
-  /* If this cl isn't active, don't send any DEL_HOSTs. */
-  if(cl->status.active)
-    notify_others(cl,NULL,send_del_host);
-    
 cp
   /* Find all connections that were lost because they were behind cl
      (the connection that was dropped). */
+
   if(cl->status.meta)
     for(p = conn_list; p != NULL; p = p->next)
-      {
-        if((p->nexthop == cl) && (p != cl))
-          {
-            if(cl->status.active && p->status.active)
-              notify_others(p,cl,send_del_host);
-           if(cl->socket)
-             close(cl->socket);
-	    p->status.active = 0;
-	    p->status.remove = 1;
-          }
-      }
+      if((p->nexthop == cl) && (p != cl))
+        terminate_connection(p);	/* Sounds like recursion, but p does not have a meta connection :) */
+
+  /* Inform others of termination if it was still active */
+
+  if(cl->status.active)
+    for(p = conn_list; p != NULL; p = p->next)
+      if(p->status.meta && p->status.active && p!=cl)
+        send_del_host(p, cl);
+
+  /* Remove the associated subnets */
+
+  for(s = cl->subnets; s; s = s->next)
+    subnet_del(s);
+
+  /* Check if this was our outgoing connection */
     
-  cl->status.active = 0;
-  
-  if(cl->status.outgoing)
+  if(cl->status.outgoing && cl->status.active)
     {
       signal(SIGALRM, sigalrm_handler);
       seconds_till_retry = 5;
       alarm(seconds_till_retry);
       syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in 5 seconds"));
     }
+
+  /* Inactivate */
+
+  cl->status.active = 0;
 cp
 }
 
@@ -1041,17 +1166,15 @@ cp
   now = time(NULL);
   for(p = conn_list; p != NULL; p = p->next)
     {
-      if(p->status.remove)
-	continue;
       if(p->status.active && p->status.meta)
 	{
           if(p->last_ping_time + timeout < now)
             {
               if(p->status.pinged && !p->status.got_pong)
                 {
-                  if(debug_lvl > 1)
+                  if(debug_lvl >= DEBUG_PROTOCOL)
   	            syslog(LOG_INFO, _("%s (%s) didn't respond to PING"),
-		           p->vpn_hostname, p->real_hostname);
+		           p->name, p->hostname);
 	          p->status.timeout = 1;
 	          terminate_connection(p);
                 }
@@ -1073,13 +1196,13 @@ cp
   accept a new tcp connect and create a
   new connection
 */
-int handle_new_meta_connection(conn_list_t *cl)
+int handle_new_meta_connection()
 {
   conn_list_t *ncn;
   struct sockaddr client;
   int nfd, len = sizeof(client);
 cp
-  if((nfd = accept(cl->meta_socket, &client, &len)) < 0)
+  if((nfd = accept(myself->meta_socket, &client, &len)) < 0)
     {
       syslog(LOG_ERR, _("Accepting a new connection failed: %m"));
       return -1;
@@ -1093,135 +1216,8 @@ cp
       return 0;
     }
 
-  ncn->status.meta = 1;
-  ncn->next = conn_list;
-  conn_list = ncn;
-cp
-  return 0;
-}
-
-/*
-  dispatch any incoming meta requests
-*/
-int handle_incoming_meta_data(conn_list_t *cl)
-{
-  int x, l = sizeof(x);
-  int request, oldlen, i;
-  int lenin = 0;
+  conn_list_add(ncn);
 cp
-  if(getsockopt(cl->meta_socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
-    {
-      syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m %s (%s)"), __FILE__, __LINE__, cl->meta_socket,
-             cl->vpn_hostname, cl->real_hostname);
-      return -1;
-    }
-  if(x)
-    {
-      syslog(LOG_ERR, _("Metadata socket error for %s (%s): %s"),
-             cl->vpn_hostname, cl->real_hostname, sys_errlist[x]);
-      return -1;
-    }
-
-  if(cl->buflen >= MAXBUFSIZE)
-    {
-      syslog(LOG_ERR, _("Metadata read buffer overflow!"));
-      return -1;
-    }
-
-  lenin = read(cl->meta_socket, cl->buffer, MAXBUFSIZE-cl->buflen);
-
-  if(lenin<=0)
-    {
-      if(errno==EINTR)
-        return 0;      
-      if(errno==0)
-        {
-          if(debug_lvl>0)
-            syslog(LOG_NOTICE, _("Connection closed by %s (%s)"),
-                cl->vpn_hostname, cl->real_hostname);
-        }
-      else
-        syslog(LOG_ERR, _("Metadata socket read error for %s (%s): %m"),
-               cl->vpn_hostname, cl->real_hostname);
-      return -1;
-    }
-
-  oldlen = cl->buflen;
-  cl->buflen += lenin;
-
-  for(;;)
-    {
-      if(cl->tcppacket)
-        {
-          if(cl->buflen >= cl->tcppacket)
-            {
-              tcprecv(cl, (real_packet_t *)cl->buffer);
-              cl->buflen -= cl->tcppacket;
-              memmove(cl->buffer, cl->buffer + cl->tcppacket, cl->buflen);
-              oldlen = 0;
-              cl->tcppacket=0;
-            }
-          else
-            {
-              break;
-            }
-        }
-      else
-        {
-          cl->reqlen = 0;
-
-          for(i = oldlen; i < cl->buflen; i++)
-            {
-              if(cl->buffer[i] == '\n')
-                {
-                  cl->buffer[i] = 0;  /* replace end-of-line by end-of-string so we can use sscanf */
-                  cl->reqlen = i + 1;
-                  break;
-                }
-            }
-
-          if(cl->reqlen)
-            {
-              if(debug_lvl > 2)
-                syslog(LOG_DEBUG, _("Got request from %s (%s): %s"),
-                             cl->vpn_hostname, cl->real_hostname, cl->buffer);
-              if(sscanf(cl->buffer, "%d", &request) == 1)
-                {
-                  if((request < 0) || (request > 255) || (request_handlers[request] == NULL))
-                    {
-                      syslog(LOG_ERR, _("Unknown request from %s (%s)"),
-                             cl->vpn_hostname, cl->real_hostname);
-                      return -1;
-                    }
-
-                  if(request_handlers[request](cl))  /* Something went wrong. Probably scriptkiddies. Terminate. */
-                    {
-                      syslog(LOG_ERR, _("Error while processing request from %s (%s)"),
-                             cl->vpn_hostname, cl->real_hostname);
-                      return -1;
-                    }
-                }
-              else
-                {
-                  syslog(LOG_ERR, _("Bogus data received from %s (%s)"),
-                             cl->vpn_hostname, cl->real_hostname);
-                  return -1;
-                }
-
-              cl->buflen -= cl->reqlen;
-              memmove(cl->buffer, cl->buffer + cl->reqlen, cl->buflen);
-              oldlen = 0;
-            }
-          else
-            {
-              break;
-            }
-        }
-    }
-
-  cl->last_ping_time = time(NULL);
-  cl->want_ping = 0;
-cp  
   return 0;
 }
 
@@ -1250,14 +1246,14 @@ cp
 	    */
 	    getsockopt(p->socket, SOL_SOCKET, SO_ERROR, &x, &l);
 	    syslog(LOG_ERR, _("Outgoing data socket error for %s (%s): %s"),
-                   p->vpn_hostname, p->real_hostname, sys_errlist[x]);
+                   p->name, p->hostname, strerror(x));
 	    terminate_connection(p);
 	    return;
 	  }  
 
       if(p->status.meta)
 	if(FD_ISSET(p->meta_socket, f))
-	  if(handle_incoming_meta_data(p) < 0)
+	  if(receive_meta(p) < 0)
 	    {
 	      terminate_connection(p);
 	      return;
@@ -1265,10 +1261,10 @@ cp
     }
   
   if(FD_ISSET(myself->socket, f))
-    handle_incoming_vpn_data(myself);
+    handle_incoming_vpn_data();
 
   if(FD_ISSET(myself->meta_socket, f))
-    handle_new_meta_connection(myself);
+    handle_new_meta_connection();
 cp
 }
 
@@ -1279,42 +1275,42 @@ cp
 void handle_tap_input(void)
 {
   vpn_packet_t vp;
-  ip_t from, to;
-  int ether_type, lenin;
+  int lenin;
 cp  
-  memset(&vp, 0, sizeof(vp));
-  if((lenin = read(tap_fd, &vp, MTU)) <= 0)
+  if(taptype == TAP_TYPE_TUNTAP)
     {
-      syslog(LOG_ERR, _("Error while reading from tapdevice: %m"));
-      return;
+      if((lenin = read(tap_fd, vp.data, MTU)) <= 0)
+        {
+          syslog(LOG_ERR, _("Error while reading from tun/tap device: %m"));
+          return;
+        }
+      vp.len = lenin;
+    }
+  else			/* ethertap */
+    {
+      if((lenin = read(tap_fd, vp.data - 2, MTU)) <= 0)
+        {
+          syslog(LOG_ERR, _("Error while reading from ethertap device: %m"));
+          return;
+        }
+      vp.len = lenin - 2;
     }
 
   total_tap_in += lenin;
 
-  ether_type = ntohs(*((unsigned short*)(&vp.data[12])));
-  if(ether_type != 0x0800)
-    {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("Non-IP ethernet frame %04x from " MAC_ADDR_S),
-	       ether_type, MAC_ADDR_V(vp.data[6]));
-      return;
-    }
-  
   if(lenin < 32)
     {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("Dropping short packet"));
+      if(debug_lvl >= DEBUG_TRAFFIC)
+	syslog(LOG_WARNING, _("Received short packet from tap device"));
       return;
     }
 
-  from = ntohl(*((unsigned long*)(&vp.data[26])));
-  to = ntohl(*((unsigned long*)(&vp.data[30])));
-
-  vp.len = (length_t)lenin - 2;
-
-  strip_mac_addresses(&vp);
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    {
+      syslog(LOG_DEBUG, _("Read packet of length %d from tap device"), vp.len);
+    }
 
-  send_packet(to, &vp);
+  send_packet(ntohl(*((unsigned long*)(&vp.data[30]))), &vp);
 cp
 }
 
@@ -1327,6 +1323,7 @@ void main_loop(void)
   struct timeval tv;
   int r;
   time_t last_ping_check;
+  int t;
 cp
   last_ping_check = time(NULL);
 
@@ -1349,24 +1346,45 @@ cp
 
       if(sighup)
         {
+          syslog(LOG_INFO, _("Rereading configuration file and restarting in 5 seconds"));
           sighup = 0;
           close_network_connections();
-          clear_config();
-          if(read_config_file(configfilename))
+          clear_config(&config);
+
+          if(read_server_config())
             {
               syslog(LOG_ERR, _("Unable to reread configuration file, exiting"));
               exit(0);
             }
+
           sleep(5);
-          setup_network_connections();
+          
+          if(setup_network_connections())
+            return;
+            
           continue;
         }
 
-      if(last_ping_check + timeout < time(NULL))
-	/* Let's check if everybody is still alive */
+      t = time(NULL);
+
+      /* Let's check if everybody is still alive */
+
+      if(last_ping_check + timeout < t)
 	{
 	  check_dead_connections();
           last_ping_check = time(NULL);
+
+          /* Should we regenerate our key? */
+
+          if(keyexpires < t)
+            {
+              if(debug_lvl >= DEBUG_STATUS)
+                syslog(LOG_INFO, _("Regenerating symmetric key"));
+                
+              RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
+              send_key_changed(myself, NULL);
+              keyexpires = time(NULL) + keylifetime;
+            }
 	}
 
       if(r > 0)