Merge branch 'winwarnings' of https://github.com/dechamps/tinc into 1.1

diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in
index 771a25f..9d9bf76 100644 (file)
--- a/doc/tinc.conf.5.in
+++ b/doc/tinc.conf.5.in
@@ -121,6 +121,8 @@ will automatically set up meta connections to other nodes,
 without requiring
 .Va ConnectTo
 variables.
+.Pp
+Note: it is not possible to connect to nodes using zero (system-assigned) ports in this way.
 .It Va BindToAddress Li = Ar address Op Ar port
 This is the same as
 .Va ListenAddress ,
@@ -340,6 +342,14 @@ To only listen on a specific port but not on a specific address, use
 .Li *
 for the
 .Ar address .
+.Pp
+If
+.Ar port
+is set to zero, it will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. In this case it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
 .It Va LocalDiscovery Li = yes | no Pq yes
 When enabled,
 .Nm tinc
@@ -549,6 +559,14 @@ The port number on which this tinc daemon is listening for incoming connections,
 which is used if no port number is specified in an
 .Va Address
 statement.
+.Pp
+If this is set to zero, the port will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. When setting
+.Va Port
+to zero it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
 .It Va PublicKey Li = Ar key Bq obsolete
 The public RSA key of this tinc daemon.
 It will be used to cryptographically verify it's identity and to set up a secure connection.

diff --git a/src/connection.h b/src/connection.h
index b5d3d18..b74b582 100644 (file)
--- a/src/connection.h
+++ b/src/connection.h
@@ -36,7 +36,7 @@
 
 typedef struct connection_status_t {
                unsigned int pinged:1;                  /* sent ping */
-               unsigned int active:1;                  /* 1 if active.. */
+               unsigned int unused_active:1;
                unsigned int connecting:1;              /* 1 if we are waiting for a non-blocking connect() to finish */
                unsigned int unused_termreq:1;          /* the termination of this connection was requested */
                unsigned int remove_unused:1;           /* Set to 1 if you want this connection removed */
@@ -49,7 +49,7 @@ typedef struct connection_status_t {
                unsigned int log:1;                     /* 1 if this is a control connection requesting log dump */
                unsigned int invitation:1;              /* 1 if this is an invitation */
                unsigned int invitation_used:1;         /* 1 if the invitation has been consumed */
-               unsigned int unused:19;
+               unsigned int unused:18;
 } connection_status_t;
 
 #include "ecdsa.h"

diff --git a/src/control.c b/src/control.c
index dc8890a..98eae80 100644 (file)
--- a/src/control.c
+++ b/src/control.c
@@ -106,7 +106,7 @@ bool control_h(connection_t *c, const char *request) {
                        for list_each(connection_t, other, connection_list) {
                                if(strcmp(other->name, name))
                                        continue;
-                               terminate_connection(other, other->status.active);
+                               terminate_connection(other, other->edge);
                                found = true;
                        }
 

diff --git a/src/invitation.c b/src/invitation.c
index a6996cc..28f9f8c 100644 (file)
--- a/src/invitation.c
+++ b/src/invitation.c
@@ -613,6 +613,7 @@ make_names:
        FILE *fh = fopen(filename, "w");
        if(!fh) {
                fprintf(stderr, "Could not create file %s: %s\n", filename, strerror(errno));
+               fclose(f);
                return false;
        }
 

diff --git a/src/meta.c b/src/meta.c
index 25cca5f..fbd3e26 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -76,7 +76,7 @@ bool send_meta(connection_t *c, const char *buffer, int length) {
 
 void broadcast_meta(connection_t *from, const char *buffer, int length) {
        for list_each(connection_t, c, connection_list)
-               if(c != from && c->status.active)
+               if(c != from && c->edge)
                        send_meta(c, buffer, length);
 }
 

diff --git a/src/net.c b/src/net.c
index 8fe3c51..91b9305 100644 (file)
--- a/src/net.c
+++ b/src/net.c
@@ -97,8 +97,6 @@ void purge(void) {
 void terminate_connection(connection_t *c, bool report) {
        logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Closing connection with %s (%s)", c->name, c->hostname);
 
-       c->status.active = false;
-
        if(c->node && c->node->connection == c)
                c->node->connection = NULL;
 
@@ -155,7 +153,7 @@ static void timeout_handler(void *data) {
                        continue;
 
                if(c->last_ping_time + pingtimeout <= now.tv_sec) {
-                       if(c->status.active) {
+                       if(c->edge) {
                                if(c->status.pinged) {
                                        logger(DEBUG_CONNECTIONS, LOG_INFO, "%s (%s) didn't respond to PING in %ld seconds", c->name, c->hostname, (long)now.tv_sec - c->last_ping_time);
                                } else if(c->last_ping_time + pinginterval <= now.tv_sec) {
@@ -170,7 +168,7 @@ static void timeout_handler(void *data) {
                                else
                                        logger(DEBUG_CONNECTIONS, LOG_WARNING, "Timeout from %s (%s) during authentication", c->name, c->hostname);
                        }
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
        }
 
@@ -204,7 +202,7 @@ static void periodic_handler(void *data) {
                /* Count number of active connections */
                int nc = 0;
                for list_each(connection_t, c, connection_list) {
-                       if(c->status.active && !c->status.control)
+                       if(c->edge)
                                nc++;
                }
 
@@ -251,7 +249,7 @@ static void periodic_handler(void *data) {
                        int i = 0;
 
                        for list_each(connection_t, c, connection_list) {
-                               if(!c->status.active || c->status.control)
+                               if(!c->edge)
                                        continue;
 
                                if(i++ != r)
@@ -263,7 +261,7 @@ static void periodic_handler(void *data) {
                                logger(DEBUG_CONNECTIONS, LOG_INFO, "Autodisconnecting from %s", c->name);
                                list_delete(outgoing_list, c->outgoing);
                                c->outgoing = NULL;
-                               terminate_connection(c, c->status.active);
+                               terminate_connection(c, c->edge);
                                break;
                        }
                }
@@ -293,7 +291,7 @@ static void periodic_handler(void *data) {
 
 void handle_meta_connection_data(connection_t *c) {
        if (!receive_meta(c)) {
-               terminate_connection(c, c->status.active);
+               terminate_connection(c, c->edge);
                return;
        }
 }
@@ -418,7 +416,7 @@ int reload_configuration(void) {
                struct stat s;
                if(stat(fname, &s) || s.st_mtime > last_config_check) {
                        logger(DEBUG_CONNECTIONS, LOG_INFO, "Host config file of %s has been changed", c->name);
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
                free(fname);
        }

diff --git a/src/net_packet.c b/src/net_packet.c
index b7ef519..4ec70fa 100644 (file)
--- a/src/net_packet.c
+++ b/src/net_packet.c
@@ -360,7 +360,6 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        vpn_packet_t pkt1, pkt2;
        vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
        int nextpkt = 0;
-       vpn_packet_t *outpkt = pkt[0];
        size_t outlen;
 
        if(n->status.sptps) {
@@ -402,7 +401,7 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        /* Decrypt the packet */
 
        if(cipher_active(n->incipher)) {
-               outpkt = pkt[nextpkt++];
+               vpn_packet_t *outpkt = pkt[nextpkt++];
                outlen = MAXSIZE;
 
                if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
@@ -459,7 +458,7 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        length_t origlen = inpkt->len;
 
        if(n->incompression) {
-               outpkt = pkt[nextpkt++];
+               vpn_packet_t *outpkt = pkt[nextpkt++];
 
                if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
                        logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
@@ -769,12 +768,12 @@ bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 
        /* Otherwise, send the packet via UDP */
 
-       const sockaddr_t *sa;
+       const sockaddr_t *sa = NULL;
        int sock;
 
        if(to->status.send_locally)
                choose_local_address(to, &sa, &sock);
-       else
+       if(!sa)
                choose_udp_address(to, &sa, &sock);
 
        if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
@@ -937,7 +936,7 @@ void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
                // usually distributes the sending of broadcast packets over all nodes.
                case BMODE_MST:
                        for list_each(connection_t, c, connection_list)
-                               if(c->status.active && c->status.mst && c != from->nexthop->connection)
+                               if(c->edge && c->status.mst && c != from->nexthop->connection)
                                        send_packet(c->node, packet);
                        break;
 

diff --git a/src/net_socket.c b/src/net_socket.c
index b2297af..1bf9d16 100644 (file)
--- a/src/net_socket.c
+++ b/src/net_socket.c
@@ -388,7 +388,7 @@ static void handle_meta_write(connection_t *c) {
                        logger(DEBUG_CONNECTIONS, LOG_ERR, "Could not send %d bytes of data to %s (%s): %s", c->outbuf.len - c->outbuf.offset, c->name, c->hostname, sockstrerror(sockerrno));
                }
 
-               terminate_connection(c, c->status.active);
+               terminate_connection(c, c->edge);
                return;
        }
 
@@ -820,7 +820,7 @@ void try_outgoing_connections(void) {
                if(c->outgoing && c->outgoing->timeout == -1) {
                        c->outgoing = NULL;
                        logger(DEBUG_CONNECTIONS, LOG_INFO, "No more outgoing connection to %s", c->name);
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
        }
 

diff --git a/src/protocol_auth.c b/src/protocol_auth.c
index 778c607..ac486ea 100644 (file)
--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@@ -805,7 +805,6 @@ bool ack_h(connection_t *c, const char *request) {
        /* Activate this connection */
 
        c->allow_request = ALL;
-       c->status.active = true;
 
        logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection with %s (%s) activated", c->name,
                           c->hostname);

diff --git a/src/protocol_key.c b/src/protocol_key.c
index e838f61..fcb748f 100644 (file)
--- a/src/protocol_key.c
+++ b/src/protocol_key.c
@@ -41,7 +41,7 @@ void send_key_changed(void) {
        /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
 
        for list_each(connection_t, c, connection_list)
-               if(c->status.active && c->node && c->node->status.reachable && !c->node->status.sptps)
+               if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps)
                        send_ans_key(c->node);
 
        /* Force key exchange for connections using SPTPS */

diff --git a/src/route.c b/src/route.c
index 8c65c4c..17f1c71 100644 (file)
--- a/src/route.c
+++ b/src/route.c
@@ -203,7 +203,7 @@ static void age_subnets(void *data) {
                        }
 
                        for list_each(connection_t, c, connection_list)
-                               if(c->status.active)
+                               if(c->edge)
                                        send_del_subnet(c, s);
 
                        subnet_del(myself, s);
@@ -238,7 +238,7 @@ static void learn_mac(mac_t *address) {
                /* And tell all other tinc daemons it's our MAC */
 
                for list_each(connection_t, c, connection_list)
-                       if(c->status.active)
+                       if(c->edge)
                                send_add_subnet(c, subnet);
 
                timeout_add(&age_subnets_timeout, age_subnets, NULL, &(struct timeval){10, rand() % 100000});

diff --git a/src/sptps.c b/src/sptps.c
index 3fbd854..e9ce94a 100644 (file)
--- a/src/sptps.c
+++ b/src/sptps.c
@@ -431,13 +431,12 @@ bool sptps_verify_datagram(sptps_t *s, const char *data, size_t len) {
        uint32_t seqno;
        memcpy(&seqno, data, 4);
        seqno = ntohl(seqno);
+       if (!sptps_check_seqno(s, seqno, false))
+               return false;
 
        char buffer[len];
        size_t outlen;
-       if(!chacha_poly1305_decrypt(s->incipher, seqno, data + 4, len - 4, buffer, &outlen))
-               return false;
-
-       return sptps_check_seqno(s, seqno, false);
+       return chacha_poly1305_decrypt(s->incipher, seqno, data + 4, len - 4, buffer, &outlen);
 }
 
 // Receive incoming data, datagram version.

diff --git a/src/subnet_parse.c b/src/subnet_parse.c
index 1d54c13..c919b59 100644 (file)
--- a/src/subnet_parse.c
+++ b/src/subnet_parse.c
@@ -186,6 +186,7 @@ int subnet_compare(const subnet_t *a, const subnet_t *b) {
 bool str2net(subnet_t *subnet, const char *subnetstr) {
        char str[1024];
        strncpy(str, subnetstr, sizeof(str));
+       str[sizeof str - 1] = 0;
        int consumed;
 
        int weight = DEFAULT_WEIGHT;
@@ -255,7 +256,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
                for (int i = 0; i < 4; i++)
                        if (x[i] > 255)
                                return false;
-               sprintf(last_colon, ":%02x%02x:%02x%02x", x[0], x[1], x[2], x[3]);
+               snprintf(last_colon, sizeof str - (last_colon - str), ":%02x%02x:%02x%02x", x[0], x[1], x[2], x[3]);
        }
 
        char* double_colon = strstr(str, "::");