gmane.network.tinc.devel

[Announcement] Tinc version 1.0.21 and 1.1pre7 released

Guus Sliepen — 2013-04-22T20:00:34

Because of a security vulnerability in tinc that was recently discovered, we
hereby release tinc versions 1.0.21 and 1.1pre7. Here is a summary of the
changes in tinc 1.0.21:

 * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Here is a summary of the changes in tinc 1.1pre7:

 * Fixed large latencies on Windows.
 * Renamed the tincctl tool to tinc.
 * Simplified changing the configuration using the tinc tool.
 * Added a full description of the ExperimentalProtocol to the manual.
 * Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Thanks to Martin Schobert for auditing tinc and reporting the vulnerability.
He discovered a potential stack overflow that can be triggered by an
authenticated peer. This can be used to cause a tinc daemon to crash, or in the
worst case, it might be possible to execute code on another node as the user
running tincd. This bug has been present in all versions of tinc. All users of
tinc should upgrade to 1.0.21 or 1.1pre7 as soon as possible.

Automatic exchange of dynamic node-IPs between nodes

Bartsch, Rene — 2013-03-26T11:45:48

Hi,

I'm new to Tinc, so a "Hello" to all! :-)

In my setup one master node has a static public IP. All other nodes have dynamic public IPs changing every 24 hours (and yes, in Germany even Global IPv6 Unicast Prefixes are dynamic on DSL/Cable sockets :-( ).

To distribute the dynamic node-IPs to all other nodes, the following "host-up" script is used:

------------------------------------------------------------- snip --------------------------------------------------------------

#!/bin/bash

FILE="/etc/tinc/$NETNAME/hosts/$NODE"
ADDRESS="Address = $REMOTEADDRESS $REMOTEPORT"

if grep -q Address $FILE; then
    /bin/sed s:'^Address.*=.*$':"$ADDRESS": -i $FILE
else
    echo $ADDRESS >> $FILE
fi

------------------------------------------------------------- snap 
--------------------------------------------------------------


Please implement such a function directly into the Tinc code! Maybe even with distributed tables without the need of a master with a static IP.

Best regards,

Renne

Problem with local Discovery in tinc-pre

muh Kuh — 2013-03-12T19:52:29

I'm currently running tinc-pre6 on 2 nodes in a larger network.
My Laptop (Lassulus), lan ip: 192.168.2.100, tinc-ip: 10.243.0.2
My Server (alphalabs), lan ip: 192.168.2.103, tinc-ip: 10.243.1.10
internet vserver (slowpoke), no lan ip, tinc-ip: 10.243.232.121

Everything works fine until both nodes are in the same LAN. The first
2-3 minutes everything is fine. Pings between the machines go through
other servers so they are between 50-80ms, 0% packet loss.
But as soon as localDiscovery starts to kick in the pings drop to 20ms
(which is good) but packet loss goes up to 90% (tested with ping -f).
For every lost packet tincd (started with -D -d4) shows the Error:
"Received UDP packet from unknown source 192.168.2.103 port 655".
Every 2-3 seconds the packet loss stops and tincd reports: "UDP
address of alphalabs set to 192.168.2.103 port 655"
But after <1second the packet loss begins again with the unknown source error.

log snippet:
UDP address of alphalabs set to 192.168.2.103 port 655
UDP address of slowpoke s

Another suggestion for putting tinc to good use

Michael Adams — 2012-12-16T06:15:43

A while back, I suggested adding some compressors to tinc to increase the 
options available for its use: never had the time to take a crack at doing 
such adding. I have found something else that may or may not be a good fit 
with tinc: a WAN-optimization/delta compression mechanism. Such mechanisms 
reduce the amount of traffic carried over a network, by detecting and 
omitting duplicate content.

http://wanproxy.org/tools.shtml

http://www.ezrentacar.com | http://www.facebook.com/ezrentacar

Kernel 3.7 has a new layer-2 UDP networking mechanism

Michael Adams — 2012-12-11T17:00:07

http://linux-network-plumber.blogspot.com.es/2012/09/just-published-linux-kernel.html

http://blog.scottlowe.org/2011/12/02/examining-vxlan/

Not sure how this would help or hurt tinc-vpn

tinc1.1pre4 tincctl restart

muh Kuh — 2012-12-06T00:31:59

I cant restart my tincd with 'tincctl restart -n $NETNAME'
I get the message: 'Could not restart tinc daemon'

It works with 'tincctl stop -n NETNAME && tincctl start -n NETNAME'
but sometimes the /var/run/tinc.$NETNAME.pid file is missing so I need
to kill tinc manually

question using android JNI with openssl,etc. to build tinc

Steven Bishop — 2012-07-30T15:04:38

Hello,
I was hoping someone already had experience on using JNI and could
help me figure out how android.mk file uses pre-built libraries with
Android SDK. I have done some research and ordered an Android NDK
book, although I am sitting at work wanting to do something(since I
have nothing to do). I know openssl and zlib libraries are able to be
found in Android SDK, which would just require LZO to be ported.
Thanks

SPAM Blokkering van uw lopende rekening bij de RABOBANK -een dringend bericht.

2012-07-09T14:47:02

[Announcement] Version 1.0.19 released

Guus Sliepen — 2012-06-25T18:07:52

With pleasure we announce the release of version 1.0.19. Here is a
summary of the changes:

 * Allow :: notation in IPv6 Subnets.

 * Add support for systemd style socket activation.

 * Allow environment variables to be used for the Name option.

 * Add basic support for SOCKS proxies, HTTP proxies, and proxying through an
   external command.

This version of tinc is compatible with 1.0pre8, 1.0 and later, but not
with earlier version of tinc.

Facebook issued some IP6-IP6 kernel patch

Michael Adams — 2012-06-12T05:30:15

I know I have some quirky behavior involving my layer two tinc host, and the 
IPv6 subnet that runs off of it. Facebook just issued a kernel patch that 
changes the behavior of the IPv6 tunnel mechanism: I can't tell from the 
patch itself, if it might also improve functionality for non IP6-IP6 
tunnels.

https://www.facebook.com/notes/facebook-engineering/under-the-hood-network-implementation-for-world-ipv6-launch/10150873176303920

http://marc.info/?l=linux-netdev&m=133891157525531&w=2

[PATCH] add (errnum) in front of windows error messages

Michael Tokarev — 2012-05-04T12:41:47

On localized, non-English versions of windows, it is
common to have two active charsets -- for console applications
and for GUI applications, together with localized error messages
returned by windows.  But two charsets are rarely compatible,
so sending the same byte sequence to console and to windows
event log makes one or another to be unreadable.  So at least
include the error number, this way it will be possible to
lookup the actual error test using external ways.

Signed-off-by: Michael Tokarev <mjt-XAri/EZa3C4vJsYlp49lxw< at >public.gmane.org>
---
 lib/utils.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/utils.c b/lib/utils.c
index 6ea904a..405097b 100644
--- a/lib/utils.c
+++ b/lib/utils.c
< at >< at > -53,15 +53,17 < at >< at > void bin2hex(char *src, char *dst, int length) {
 #endif
 
 const char *winerror(int err) {
-static char buf[1024], *newline;
+static char buf[1024], *ptr;
+
+ptr = buf + sprintf(buf, "(%d) ", err);
 
 if (!FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT

[PATCH] struct sockaddr_ll usage needs to include linux/if_packet.h

Michael Tokarev — 2012-05-04T12:41:21

Signed-off-by: Michael Tokarev <mjt-XAri/EZa3C4vJsYlp49lxw< at >public.gmane.org>
---
 src/raw_socket_device.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/raw_socket_device.c b/src/raw_socket_device.c
index 1dd726f..78de359 100644
--- a/src/raw_socket_device.c
+++ b/src/raw_socket_device.c
< at >< at > -33,6 +33,9 < at >< at >
 #include "xalloc.h"
 
 #if defined(PF_PACKET) && defined(ETH_P_ALL) && defined(AF_PACKET)
+
+#include <linux/if_packet.h>
+
 static char *device_info;
 
 static uint64_t device_total_in = 0;

[PATCH] configure.in: fix AC_ARG_ENABLE and AC_ARG_WITH

Anthony G. Basile — 2012-03-26T10:29:40

From: "Anthony G. Basile" <basile-yzvPICuk2ABaTBw8ZCwS0De48wsgrGvP< at >public.gmane.org>

The current configure.in file does not correctly make use of these
macros.  The resulting configure file will therefore enable an item
even if --disable-FEATURE is given.  This patch restores the intended
behavior.
---
 configure.in |   50 +++++++++++++++++++++++++++++++++-----------------
 1 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/configure.in b/configure.in
index 2ea69f6..a03baf6 100644
--- a/configure.in
+++ b/configure.in
< at >< at > -73,30 +73,44 < at >< at > case $host_os in
 esac
 
 AC_ARG_ENABLE(uml,
-  AS_HELP_STRING([--enable-uml], [enable support for User Mode Linux]),
-  [ AC_DEFINE(ENABLE_UML, 1, [Support for UML])
-    uml=true
-  ]
+  AS_HELP_STRING([--disable-uml], [enable support for User Mode Linux]),
+  [ AS_IF([test "x$enable_uml" = "xyes"],
+      [ AC_DEFINE(ENABLE_UML, 1, [Support for UML])
+        uml=true
+      ],
+      [uml=false])
+  ],
+  [uml=disable]
 )
 
 AC_ARG_ENABLE(vde,
-  AS_HELP_S

[Announcement] Version 1.0.18 released

Guus Sliepen — 2012-03-25T16:48:18

With pleasure we announce the release of version 1.0.18. Here is a
summary of the changes:

 * Fixed IPv6 in switch mode by turning off DecrementTTL by default.

 * Allow a port number to be specified in BindToAddress, which also allows tinc
   to listen on multiple ports.

 * Add support for multicast communication with UML/QEMU/KVM.

This version of tinc is compatible with 1.0pre8, 1.0 and later, but not
with earlier version of tinc.

[Announcement] Version 1.0.16 released

Guus Sliepen — 2011-07-23T12:29:15

With pleasure we announce the release of version 1.0.16. Here is a
summary of the changes:

 * Fixed a performance issue with TCP communication under Windows.

 * Fixed code that, during network outages, would cause tinc to exit when it
   thought two nodes with identical Names were on the VPN.

This version of tinc is compatible with 1.0pre8, 1.0 and later, but not
with earlier version of tinc.

Question on how to get involved in 1.1 development

Michael Adams — 2011-07-18T18:08:11

A while back I expressed interest in trying to add additional 
compression formats (XZ, ZPAQ-derived). What would be the best way for 
me to try these with the 1.1 codebase? And can 1.1 be used with 1.0.x 
nets out-of-box?

http://en.wikipedia.org/wiki/Xz
http://mattmahoney.net/dc/zpaq.html

[Announcement] Version 1.1pre2 released

Guus Sliepen — 2011-07-17T19:07:25

With pleasure we announce the release of version 1.1pre2. Here is a
summary of the changes:

 * .cookie files are renamed to .pid files, which are compatible with 1.0.x.

 * Experimental protocol enhancements that can be enabled with the option
   ExperimentalProtocol = yes:

   * Ephemeral ECDH key exchange will be used for both the meta protocol and
     UDP session keys.
   * Key exchanges are signed with ECDSA.
   * ECDSA public keys are automatically exchanged after RSA authentication if
     nodes do not know each other's ECDSA public key yet.

This is the second pre-release of the 1.1 branch of tinc. Tinc 1.1 is protocol
compatible with 1.0.x, but will have large architectural changes and new
features. Tinc 1.0.x will still be maintained. Please try out this new version,
and let us know what you think of, and report any bugs you find.

[Announcement] Version 1.1pre1 released

Guus Sliepen — 2011-06-25T14:07:15

With pleasure we announce the release of version 1.1pre1. Here is a
summary of the changes:

 * Control interface allows control of a running tinc daemon. Used by:
   * tincctl, a commandline utility
   * tinc-gui, a preliminary GUI implemented in Python/wxWidgets

 * Code cleanups and reorganization. 

 * Repleacable cryptography backend, currently supports OpenSSL and libgcrypt.

 * Use libevent to handle I/O events and timeouts.

 * Use splay trees instead of AVL trees to manage internal datastructures.

This is the first pre-release of the 1.1 branch of tinc. Tinc 1.1 is protocol
compatible with 1.0.x, but will have large architectural changes and new
features. Tinc 1.0.x will still be maintained. Please try out this new version,
and let us know what you think of, and report any bugs you find.

[Announcement] Version 1.0.15 released

Guus Sliepen — 2011-06-24T14:46:31

With pleasure we announce the release of version 1.0.15. Here is a
summary of the changes:

 * Improved logging to file.

 * Reduced amount of process wakeups on platforms which support pselect().

 * Fixed ProcessPriority option under Windows.

Thanks to Loïc Grenié for his contribution to this version of tinc.

This version of tinc is compatible with 1.0pre8, 1.0 and later, but not
with earlier version of tinc.

1.0.14 error on Windows-XP

Michael Schmitz — 2011-06-16T05:27:08

Hi...

Tinc v1.0.13 works fine on Windows XP but Tinc v1.0.14 shows only an error
message (tinc -n xxx -d5 -D). The error message is "System command
'setpriority' failed. Command not found"...

Any suggestions ?

Kind regards,
Michael

nearly-tickless-tinc

Loïc Grenié — 2011-05-29T17:43:54

    Hi,

    tinc has a fixed timeout of 1 second for select() in the main
  loop. I think this could be improved. Do you think the following
  patch goes into the right direction ?

     I don't know whether pselect() is standard enough (works under
  "current" linux, however I don't know about the other arches). Maybe
  a config option is necessary.

     It's probably possible to simplify at least signal handling (I've
  tried to keep SIGHUP and SIGALRM blocking as they are,
  however I suspect that tincd unblocks those signals at the
  beginning or, at least, does not modify their blocking while
  running). It is also undoubtedly possible to improve the patch
  in other ways.

     Tell me if you are interested and whether I should modify
  anything.

     Thanks a lot,

           Loïc

PS: patch against 1.0.14