X-Git-Url: https://git.librecmc.org/?p=oweals%2Ftinc.git;a=blobdiff_plain;f=src%2Fnet.c;h=7d81176a76d2cda89fd57f853305c1a1b1ca4bdd;hp=81318e3e446575faf058398dc8745f47f95c7eee;hb=2764532ea72200d0a27ad2d79e6e299c00c62404;hpb=9f64499e40a95a8c05c82924219517aa017fc411

diff --git a/src/net.c b/src/net.c
index 81318e3..7d81176 100644
--- a/src/net.c
+++ b/src/net.c
@@ -17,12 +17,11 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
-    $Id: net.c,v 1.35.4.41 2000/10/20 15:34:35 guus Exp $
+    $Id: net.c,v 1.35.4.75 2000/11/16 17:54:27 zarq Exp $
 */
 
 #include "config.h"
 
-#include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <netdb.h>
@@ -31,14 +30,36 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/signal.h>
-#include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <syslog.h>
 #include <unistd.h>
+#include <sys/ioctl.h>
+/* SunOS really wants sys/socket.h BEFORE net/if.h,
+   and FreeBSD wants these lines below the rest. */
+#include <arpa/inet.h>
+#include <sys/socket.h>
+#include <net/if.h>
+
+#ifdef HAVE_OPENSSL_RAND_H
+# include <openssl/rand.h>
+#else
+# include <rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_EVP_H
+# include <openssl/evp.h>
+#else
+# include <evp.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ERR_H
+# include <openssl/err.h>
+#else
+# include <err.h>
+#endif
 
 #ifdef HAVE_TUNTAP
-#include <net/if.h>
 #include LINUX_IF_TUN_H
 #endif
 
@@ -46,72 +67,61 @@
 #include <xalloc.h>
 
 #include "conf.h"
-#include "encr.h"
+#include "connlist.h"
+#include "list.h"
+#include "meta.h"
 #include "net.h"
 #include "netutl.h"
+#include "process.h"
 #include "protocol.h"
-#include "meta.h"
+#include "subnet.h"
 
 #include "system.h"
 
 int tap_fd = -1;
-int taptype = 0;
+int taptype = TAP_TYPE_ETHERTAP;
 int total_tap_in = 0;
 int total_tap_out = 0;
 int total_socket_in = 0;
 int total_socket_out = 0;
 
-int upstreamindex = 0;
+config_t *upstreamcfg;
 static int seconds_till_retry;
 
-char *unknown = NULL;
+int keylifetime = 0;
+int keyexpires = 0;
 
-/*
-  strip off the MAC adresses of an ethernet frame
-*/
-void strip_mac_addresses(vpn_packet_t *p)
-{
-cp
-  memmove(p->data, p->data + 12, p->len -= 12);
-cp
-}
+char *unknown = NULL;
 
-/*
-  reassemble MAC addresses
-*/
-void add_mac_addresses(vpn_packet_t *p)
-{
-cp
-  memcpy(p->data + 12, p->data, p->len);
-  p->len += 12;
-  p->data[0] = p->data[6] = 0xfe;
-  p->data[1] = p->data[7] = 0xfd;
-  /* Really evil pointer stuff just below! */
-  *((ip_t*)(&p->data[2])) = (ip_t)(htonl(myself->address));
-  *((ip_t*)(&p->data[8])) = *((ip_t*)(&p->data[26]));
-cp
-}
+subnet_t mymac;
 
 int xsend(conn_list_t *cl, vpn_packet_t *inpkt)
 {
   vpn_packet_t outpkt;
   int outlen, outpad;
+  EVP_CIPHER_CTX ctx;
 cp
   outpkt.len = inpkt->len;
-  EVP_EncryptInit(cl->cipher_pktctx, cl->cipher_pkttype, cl->cipher_pktkey, NULL);
-  EVP_EncryptUpdate(cl->cipher_pktctx, outpkt.data, &outlen, inpkt->data, inpkt->len);
-  EVP_EncryptFinal(cl->cipher_pktctx, outpkt.data + outlen, &outpad);
-  outlen += outpad;
   
-  if(debug_lvl > 3)
+  /* Encrypt the packet */
+  
+  EVP_EncryptInit(&ctx, cl->cipher_pkttype, cl->cipher_pktkey, cl->cipher_pktkey + cl->cipher_pkttype->key_len);
+  EVP_EncryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len);
+  EVP_EncryptFinal(&ctx, outpkt.data + outlen, &outpad);
+  outlen += outpad + 2;
+
+/* Bypass
+  outlen = outpkt.len + 2;
+  memcpy(&outpkt, inpkt, outlen);
+*/  
+
+  if(debug_lvl >= DEBUG_TRAFFIC)
     syslog(LOG_ERR, _("Sending packet of %d bytes to %s (%s)"),
            outlen, cl->name, cl->hostname);
 
   total_socket_out += outlen;
 
-  cl->want_ping = 1;
-
-  if((send(cl->socket, (char *) &(outpkt.len), outlen + 2, 0)) < 0)
+  if((send(cl->socket, (char *) &(outpkt.len), outlen, 0)) < 0)
     {
       syslog(LOG_ERR, _("Error sending packet to %s (%s): %m"),
              cl->name, cl->hostname);
@@ -121,28 +131,48 @@ cp
   return 0;
 }
 
-int xrecv(vpn_packet_t *inpkt)
+int xrecv(conn_list_t *cl, vpn_packet_t *inpkt)
 {
   vpn_packet_t outpkt;
   int outlen, outpad;
+  EVP_CIPHER_CTX ctx;
 cp
-  if(debug_lvl > 3)
-    syslog(LOG_ERR, _("Receiving packet of %d bytes"),
-           inpkt->len);
-
   outpkt.len = inpkt->len;
-  EVP_DecryptInit(myself->cipher_pktctx, myself->cipher_pkttype, myself->cipher_pktkey, NULL);
-  EVP_DecryptUpdate(myself->cipher_pktctx, outpkt.data, &outlen, inpkt->data, inpkt->len);
-  /* FIXME: grok DecryptFinal  
-  EVP_DecryptFinal(myself->cipher_pktctx, outpkt.data + outlen, &outpad);
-   */
-   
-  add_mac_addresses(&outpkt);
-
-  if(write(tap_fd, outpkt.data, outpkt.len) < 0)
-    syslog(LOG_ERR, _("Can't write to tap device: %m"));
-  else
-    total_tap_out += outpkt.len;
+
+  /* Decrypt the packet */
+
+  EVP_DecryptInit(&ctx, myself->cipher_pkttype, myself->cipher_pktkey, myself->cipher_pktkey + myself->cipher_pkttype->key_len);
+  EVP_DecryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len + 8);
+  EVP_DecryptFinal(&ctx, outpkt.data + outlen, &outpad);
+  outlen += outpad;
+
+/* Bypass
+  outlen = outpkt.len+2;
+  memcpy(&outpkt, inpkt, outlen);
+*/
+     
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    syslog(LOG_ERR, _("Writing packet of %d bytes to tap device"),
+           outpkt.len, outlen);
+
+  /* Fix mac address */
+
+  memcpy(outpkt.data, mymac.net.mac.address.x, 6);
+
+  if(taptype == TAP_TYPE_TUNTAP)
+    {
+      if(write(tap_fd, outpkt.data, outpkt.len) < 0)
+        syslog(LOG_ERR, _("Can't write to tun/tap device: %m"));
+      else
+        total_tap_out += outpkt.len;
+    }
+  else	/* ethertap */
+    {
+      if(write(tap_fd, outpkt.data - 2, outpkt.len + 2) < 0)
+        syslog(LOG_ERR, _("Can't write to ethertap device: %m"));
+      else
+        total_tap_out += outpkt.len + 2;
+    }
 cp
   return 0;
 }
@@ -225,7 +255,7 @@ cp
   returned a zero exit code
 */
 void flush_queue(conn_list_t *cl, packet_queue_t **pq,
-		 int (*function)(conn_list_t*,void*))
+		 int (*function)(conn_list_t*,vpn_packet_t*))
 {
   queue_element_t *p, *next = NULL;
 cp
@@ -239,7 +269,7 @@ cp
       p = next;
     }
 
-  if(debug_lvl > 3)
+  if(debug_lvl >= DEBUG_TRAFFIC)
     syslog(LOG_DEBUG, _("Queue flushed"));
 cp
 }
@@ -254,7 +284,7 @@ void flush_queues(conn_list_t *cl)
 cp
   if(cl->sq)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >= DEBUG_TRAFFIC)
 	syslog(LOG_DEBUG, _("Flushing send queue for %s (%s)"),
 	       cl->name, cl->hostname);
       flush_queue(cl, &(cl->sq), xsend);
@@ -262,7 +292,7 @@ cp
 
   if(cl->rq)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >=  DEBUG_TRAFFIC)
 	syslog(LOG_DEBUG, _("Flushing receive queue for %s (%s)"),
 	       cl->name, cl->hostname);
       flush_queue(cl, &(cl->rq), xrecv);
@@ -276,22 +306,38 @@ cp
 int send_packet(ip_t to, vpn_packet_t *packet)
 {
   conn_list_t *cl;
+  subnet_t *subnet;
 cp
-  if((cl = lookup_conn_list_ipv4(to)) == NULL)
+  if((subnet = lookup_subnet_ipv4(to)) == NULL)
     {
-      if(debug_lvl > 3)
+      if(debug_lvl >= DEBUG_TRAFFIC)
         {
           syslog(LOG_NOTICE, _("Trying to look up %d.%d.%d.%d in connection list failed!"),
 	         IP_ADDR_V(to));
         }
 
       return -1;
-   }
+    }
+
+  cl = subnet->owner;
     
+  if(cl == myself)
+    {
+      if(debug_lvl >= DEBUG_TRAFFIC)
+        {
+          syslog(LOG_NOTICE, _("Packet with destination %d.%d.%d.%d is looping back to us!"),
+	         IP_ADDR_V(to));
+        }
+
+      return -1;
+    }
+
   /* If we ourselves have indirectdata flag set, we should send only to our uplink! */
 
   /* FIXME - check for indirection and reprogram it The Right Way(tm) this time. */
   
+  /* Connections are now opened beforehand...
+
   if(!cl->status.dataopen)
     if(setup_vpn_connection(cl) < 0)
       {
@@ -299,13 +345,16 @@ cp
 	       cl->name, cl->hostname);
         return -1;
       }
+  */
       
   if(!cl->status.validkey)
     {
-      if(debug_lvl > 3)
+/* FIXME: Don't queue until everything else is fixed.
+      if(debug_lvl >= DEBUG_TRAFFIC)
 	syslog(LOG_INFO, _("No valid key known yet for %s (%s), queueing packet"),
 	       cl->name, cl->hostname);
       add_queue(&(cl->sq), packet, packet->len + 2);
+*/
       if(!cl->status.waitingforkey)
 	send_req_key(myself, cl);			/* Keys should be sent to the host running the tincd */
       return 0;
@@ -313,10 +362,12 @@ cp
 
   if(!cl->status.active)
     {
-      if(debug_lvl > 3)
+/* FIXME: Don't queue until everything else is fixed.
+      if(debug_lvl >= DEBUG_TRAFFIC)
 	syslog(LOG_INFO, _("%s (%s) is not ready, queueing packet"),
 	       cl->name, cl->hostname);
       add_queue(&(cl->sq), packet, packet->len + 2);
+*/
       return 0; /* We don't want to mess up, do we? */
     }
 
@@ -333,12 +384,10 @@ int setup_tap_fd(void)
   int nfd;
   const char *tapfname;
   config_t const *cfg;
-
-#ifdef HAVE_TUNTAP
   struct ifreq ifr;
-#endif
+
 cp  
-  if((cfg = get_config_val(config, tapdevice)))
+  if((cfg = get_config_val(config, config_tapdevice)))
     tapfname = cfg->data.ptr;
   else
 #ifdef HAVE_TUNTAP
@@ -355,7 +404,16 @@ cp
 cp
   tap_fd = nfd;
 
-  taptype = 0;
+  /* Set default MAC address for ethertap devices */
+  
+  taptype = TAP_TYPE_ETHERTAP;
+  mymac.type = SUBNET_MAC;
+  mymac.net.mac.address.x[0] = 0xfe;
+  mymac.net.mac.address.x[1] = 0xfd;
+  mymac.net.mac.address.x[2] = 0x00;
+  mymac.net.mac.address.x[3] = 0x00;
+  mymac.net.mac.address.x[4] = 0x00;
+  mymac.net.mac.address.x[5] = 0x00;
 
 #ifdef HAVE_TUNTAP
   /* Ok now check if this is an old ethertap or a new tun/tap thingie */
@@ -366,16 +424,11 @@ cp
     strncpy(ifr.ifr_name, netname, IFNAMSIZ);
 cp
   if (!ioctl(tap_fd, TUNSETIFF, (void *) &ifr))
-  { 
+  {
     syslog(LOG_INFO, _("%s is a new style tun/tap device"), tapfname);
-    taptype = 1;
-    if((cfg = get_config_val(config, tapsubnet)) == NULL)
-      syslog(LOG_INFO, _("tun/tap device will be left unconfigured"));
-    else
-      /* Setup inetaddr/netmask etc */;
+    taptype = TAP_TYPE_TUNTAP;
   }
 #endif
-  
 cp
   return 0;
 }
@@ -399,27 +452,34 @@ cp
 
   if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   flags = fcntl(nfd, F_GETFL);
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
-      syslog(LOG_ERR, _("fcntl: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fcntl");
       return -1;
     }
 
-  if((cfg = get_config_val(config, interface)))
+  if((cfg = get_config_val(config, config_interface)))
     {
       if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, cfg->data.ptr, strlen(cfg->data.ptr)))
         {
+          close(nfd);
           syslog(LOG_ERR, _("Unable to bind listen socket to interface %s: %m"), cfg->data.ptr);
           return -1;
         }
@@ -429,20 +489,23 @@ cp
   a.sin_family = AF_INET;
   a.sin_port = htons(port);
   
-  if((cfg = get_config_val(config, interfaceip)))
-    a.sin_addr.s_addr = htonl(cfg->data.ip->ip);
+  if((cfg = get_config_val(config, config_interfaceip)))
+    a.sin_addr.s_addr = htonl(cfg->data.ip->address);
   else
     a.sin_addr.s_addr = htonl(INADDR_ANY);
 
   if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
     {
+      close(nfd);
       syslog(LOG_ERR, _("Can't bind to port %hd/tcp: %m"), port);
       return -1;
     }
 
   if(listen(nfd, 3))
     {
-      syslog(LOG_ERR, _("listen: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "listen");
       return -1;
     }
 cp
@@ -461,20 +524,25 @@ int setup_vpn_in_socket(int port)
 cp
   if((nfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0)
     {
+      close(nfd);
       syslog(LOG_ERR, _("Creating socket failed: %m"));
       return -1;
     }
 
   if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
     {
-      syslog(LOG_ERR, _("setsockopt: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
       return -1;
     }
 
   flags = fcntl(nfd, F_GETFL);
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
-      syslog(LOG_ERR, _("fcntl: %m"));
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fcntl");
       return -1;
     }
 
@@ -485,6 +553,7 @@ cp
 
   if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
     {
+      close(nfd);
       syslog(LOG_ERR, _("Can't bind to port %hd/udp: %m"), port);
       return -1;
     }
@@ -501,10 +570,10 @@ int setup_outgoing_meta_socket(conn_list_t *cl)
   struct sockaddr_in a;
   config_t const *cfg;
 cp
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_INFO, _("Trying to connect to %s"), cl->hostname);
 
-  if((cfg = get_config_val(cl->config, port)) == NULL)
+  if((cfg = get_config_val(cl->config, config_port)) == NULL)
     cl->port = 655;
   else
     cl->port = cfg->data.val;
@@ -523,6 +592,7 @@ cp
 
   if(connect(cl->meta_socket, (struct sockaddr *)&a, sizeof(a)) == -1)
     {
+      close(cl->meta_socket);
       syslog(LOG_ERR, _("%s port %hd: %m"), cl->hostname, cl->port);
       return -1;
     }
@@ -530,12 +600,13 @@ cp
   flags = fcntl(cl->meta_socket, F_GETFL);
   if(fcntl(cl->meta_socket, F_SETFL, flags | O_NONBLOCK) < 0)
     {
+      close(cl->meta_socket);
       syslog(LOG_ERR, _("fcntl for %s port %d: %m"),
              cl->hostname, cl->port);
       return -1;
     }
 
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_INFO, _("Connected to %s port %hd"),
          cl->hostname, cl->port);
 
@@ -555,7 +626,7 @@ int setup_outgoing_connection(char *name)
 {
   conn_list_t *ncn;
   struct hostent *h;
-  config_t *cfg;
+  config_t const *cfg;
 cp
   if(check_id(name))
     {
@@ -573,7 +644,7 @@ cp
       return -1;
     }
     
-  if(!(cfg = get_config_val(ncn->config, address)))
+  if(!(cfg = get_config_val(ncn->config, config_address)))
     {
       syslog(LOG_ERR, _("No address specified for %s"));
       free_conn_list(ncn);
@@ -602,7 +673,6 @@ cp
   ncn->buffer = xmalloc(MAXBUFSIZE);
   ncn->buflen = 0;
   ncn->last_ping_time = time(NULL);
-  ncn->want_ping = 0;
 
   conn_list_add(ncn);
 
@@ -612,11 +682,13 @@ cp
 }
 
 /*
-  set up the local sockets (listen only)
+  Configure conn_list_t myself and set up the local sockets (listen only)
 */
 int setup_myself(void)
 {
   config_t const *cfg;
+  config_t *next;
+  subnet_t *net;
 cp
   myself = new_conn_list();
 
@@ -624,7 +696,7 @@ cp
   myself->flags = 0;
   myself->protocol_version = PROT_CURRENT;
 
-  if(!(cfg = get_config_val(config, tincname))) /* Not acceptable */
+  if(!(cfg = get_config_val(config, config_name))) /* Not acceptable */
     {
       syslog(LOG_ERR, _("Name for tinc daemon required!"));
       return -1;
@@ -638,7 +710,7 @@ cp
       return -1;
     }
 cp
-  if(!(cfg = get_config_val(config, privatekey)))
+  if(!(cfg = get_config_val(config, config_privatekey)))
     {
       syslog(LOG_ERR, _("Private key for tinc daemon required!"));
       return -1;
@@ -656,7 +728,7 @@ cp
       return -1;
     }
 cp  
-  if(!(cfg = get_config_val(myself->config, publickey)))
+  if(!(cfg = get_config_val(myself->config, config_publickey)))
     {
       syslog(LOG_ERR, _("Public key for tinc daemon required!"));
       return -1;
@@ -672,35 +744,68 @@ cp
       return -1;
     }
 */
-  if(!(cfg = get_config_val(myself->config, port)))
+  if(!(cfg = get_config_val(myself->config, config_port)))
     myself->port = 655;
   else
     myself->port = cfg->data.val;
 
-  if((cfg = get_config_val(myself->config, indirectdata)))
+  if((cfg = get_config_val(myself->config, config_indirectdata)))
     if(cfg->data.val == stupid_true)
       myself->flags |= EXPORTINDIRECTDATA;
 
-  if((cfg = get_config_val(myself->config, tcponly)))
+  if((cfg = get_config_val(myself->config, config_tcponly)))
     if(cfg->data.val == stupid_true)
       myself->flags |= TCPONLY;
 
+/* Read in all the subnets specified in the host configuration file */
+
+  for(next = myself->config; (cfg = get_config_val(next, config_subnet)); next = cfg->next)
+    {
+      net = new_subnet();
+      net->type = SUBNET_IPV4;
+      net->net.ipv4.address = cfg->data.ip->address;
+      net->net.ipv4.mask = cfg->data.ip->mask;
+      
+      /* Teach newbies what subnets are... */
+      
+      if((net->net.ipv4.address & net->net.ipv4.mask) != net->net.ipv4.address)
+        {
+          syslog(LOG_ERR, _("Network address and subnet mask do not match!"));
+          return -1;
+        }        
+      
+      subnet_add(myself, net);
+    }
+    
   if((myself->meta_socket = setup_listen_meta_socket(myself->port)) < 0)
     {
       syslog(LOG_ERR, _("Unable to set up a listening socket!"));
       return -1;
     }
 
-  if((myself->socket = setup_vpn_in_socket(myself->port)) < 0)
-    {
-      syslog(LOG_ERR, _("Unable to set up an incoming vpn data socket!"));
-      close(myself->meta_socket);
-      return -1;
-    }
+  /* Generate packet encryption key */
+
+  myself->cipher_pkttype = EVP_bf_cfb();
+
+  myself->cipher_pktkeylength = myself->cipher_pkttype->key_len + myself->cipher_pkttype->iv_len;
+
+  myself->cipher_pktkey = (char *)xmalloc(myself->cipher_pktkeylength);
+  RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
+
+  if(!(cfg = get_config_val(config, config_keyexpire)))
+    keylifetime = 3600;
+  else
+    keylifetime = cfg->data.val;
+    
+  keyexpires = time(NULL) + keylifetime;
 
+  /* Activate ourselves */
+  
   myself->status.active = 1;
 
   syslog(LOG_NOTICE, _("Ready: listening on port %hd"), myself->port);
+
+  child_pids = list_new();
 cp
   return 0;
 }
@@ -710,24 +815,25 @@ sigalrm_handler(int a)
 {
   config_t const *cfg;
 cp
-  cfg = get_next_config_val(config, connectto, upstreamindex++);
+  cfg = get_config_val(upstreamcfg, config_connectto);
 
-  if(!upstreamindex && !cfg)
+  if(!cfg && upstreamcfg == config)
     /* No upstream IP given, we're listen only. */
     return;
 
   while(cfg)
     {
+      upstreamcfg = cfg->next;
       if(!setup_outgoing_connection(cfg->data.ptr))   /* function returns 0 when there are no problems */
         {
           signal(SIGALRM, SIG_IGN);
           return;
         }
-      cfg = get_next_config_val(config, connectto, upstreamindex++); /* Or else we try the next ConnectTo line */
+      cfg = get_config_val(upstreamcfg, config_connectto); /* Or else we try the next ConnectTo line */
     }
 
   signal(SIGALRM, sigalrm_handler);
-  upstreamindex = 0;
+  upstreamcfg = config;
   seconds_till_retry += 5;
   if(seconds_till_retry > MAXTIMEOUT)    /* Don't wait more than MAXTIMEOUT seconds. */
     seconds_till_retry = MAXTIMEOUT;
@@ -744,10 +850,16 @@ int setup_network_connections(void)
 {
   config_t const *cfg;
 cp
-  if((cfg = get_config_val(config, pingtimeout)) == NULL)
-    timeout = 5;
+  if((cfg = get_config_val(config, config_pingtimeout)) == NULL)
+    timeout = 60;
   else
-    timeout = cfg->data.val;
+    {
+      timeout = cfg->data.val;
+      if(timeout < 1)
+        {
+          timeout = 86400;
+        }
+     }
 
   if(setup_tap_fd() < 0)
     return -1;
@@ -755,19 +867,23 @@ cp
   if(setup_myself() < 0)
     return -1;
 
-  if((cfg = get_next_config_val(config, connectto, upstreamindex++)) == NULL)
+  /* Run tinc-up script to further initialize the tap interface */
+  execute_script("tinc-up");
+  
+  if(!(cfg = get_config_val(config, config_connectto)))
     /* No upstream IP given, we're listen only. */
     return 0;
 
   while(cfg)
     {
+      upstreamcfg = cfg->next;
       if(!setup_outgoing_connection(cfg->data.ptr))   /* function returns 0 when there are no problems */
         return 0;
-      cfg = get_next_config_val(config, connectto, upstreamindex++); /* Or else we try the next ConnectTo line */
+      cfg = get_config_val(upstreamcfg, config_connectto); /* Or else we try the next ConnectTo line */
     }
     
   signal(SIGALRM, sigalrm_handler);
-  upstreamindex = 0;
+  upstreamcfg = config;
   seconds_till_retry = MAXTIMEOUT;
   syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in %d seconds"), seconds_till_retry);
   alarm(seconds_till_retry);
@@ -784,27 +900,23 @@ void close_network_connections(void)
 cp
   for(p = conn_list; p != NULL; p = p->next)
     {
-      if(p->status.dataopen)
-	{
-	  shutdown(p->socket, 0); /* No more receptions */
-	  close(p->socket);
-	}
-      if(p->status.meta)
-	{
-	  send_termreq(p);
-	  shutdown(p->meta_socket, 0); /* No more receptions */
-          close(p->meta_socket);
-        }
+      p->status.active = 0;
+      terminate_connection(p);
     }
 
   if(myself)
     if(myself->status.active)
       {
 	close(myself->meta_socket);
-	close(myself->socket);
+        free_conn_list(myself);
+        myself = NULL;
       }
 
   close(tap_fd);
+
+  /* Execute tinc-down script right after shutting down the interface */
+  execute_script("tinc-down");
+
   destroy_conn_list();
 
   syslog(LOG_NOTICE, _("Terminating"));
@@ -819,8 +931,9 @@ int setup_vpn_connection(conn_list_t *cl)
 {
   int nfd, flags;
   struct sockaddr_in a;
+  const int one = 1;
 cp
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_TRAFFIC)
     syslog(LOG_DEBUG, _("Opening UDP socket to %s"), cl->hostname);
 
   nfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
@@ -830,12 +943,42 @@ cp
       return -1;
     }
 
+  if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
+    {
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "setsockopt");
+      return -1;
+    }
+
+  flags = fcntl(nfd, F_GETFL);
+  if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
+    {
+      close(nfd);
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "fcntl");
+      return -1;
+    }
+
+  memset(&a, 0, sizeof(a));
+  a.sin_family = AF_INET;
+  a.sin_port = htons(myself->port);
+  a.sin_addr.s_addr = htonl(INADDR_ANY);
+
+  if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
+    {
+      close(nfd);
+      syslog(LOG_ERR, _("Can't bind to port %hd/udp: %m"), myself->port);
+      return -1;
+    }
+
   a.sin_family = AF_INET;
   a.sin_port = htons(cl->port);
   a.sin_addr.s_addr = htonl(cl->address);
 
   if(connect(nfd, (struct sockaddr *)&a, sizeof(a)) == -1)
     {
+      close(nfd);
       syslog(LOG_ERR, _("Connecting to %s port %d failed: %m"),
 	     cl->hostname, cl->port);
       return -1;
@@ -844,6 +987,7 @@ cp
   flags = fcntl(nfd, F_GETFL);
   if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
     {
+      close(nfd);
       syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m %s (%s)"), __FILE__, __LINE__, nfd,
              cl->name, cl->hostname);
       return -1;
@@ -867,9 +1011,10 @@ conn_list_t *create_new_connection(int sfd)
 cp
   p = new_conn_list();
 
-  if(getpeername(sfd, &ci, &len) < 0)
+  if(getpeername(sfd, (struct sockaddr *) &ci, (socklen_t *) &len) < 0)
     {
-      syslog(LOG_ERR, _("Error: getpeername: %m"));
+      syslog(LOG_ERR, _("System call `%s' failed: %m"),
+	     "getpeername");
       return NULL;
     }
 
@@ -881,9 +1026,8 @@ cp
   p->buffer = xmalloc(MAXBUFSIZE);
   p->buflen = 0;
   p->last_ping_time = time(NULL);
-  p->want_ping = 0;
   
-  if(debug_lvl > 0)
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_NOTICE, _("Connection from %s port %d"),
          p->hostname, htons(ci.sin_port));
 
@@ -910,7 +1054,6 @@ cp
     }
 
   FD_SET(myself->meta_socket, fs);
-  FD_SET(myself->socket, fs);
   FD_SET(tap_fd, fs);
 cp
 }
@@ -920,16 +1063,16 @@ cp
   udp socket and write it to the ethertap
   device after being decrypted
 */
-int handle_incoming_vpn_data()
+int handle_incoming_vpn_data(conn_list_t *cl)
 {
   vpn_packet_t pkt;
-  int lenin;
   int x, l = sizeof(x);
+  int lenin;
 cp
-  if(getsockopt(myself->socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
+  if(getsockopt(cl->socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
     {
       syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m"),
-	     __FILE__, __LINE__, myself->socket);
+	     __FILE__, __LINE__, cl->socket);
       return -1;
     }
   if(x)
@@ -938,14 +1081,20 @@ cp
       return -1;
     }
 
-  if(recvfrom(myself->socket, (char *) &(pkt.len), MTU, 0, NULL, NULL) <= 0)
+  if((lenin = recv(cl->socket, (char *) &(pkt.len), MTU, 0)) <= 0)
     {
       syslog(LOG_ERR, _("Receiving packet failed: %m"));
       return -1;
     }
 
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    {
+      syslog(LOG_DEBUG, _("Received packet of %d bytes from %s (%s)"), lenin,
+             cl->name, cl->hostname);
+    }
+
 cp
-  return xrecv(&pkt);
+  return xrecv(cl, &pkt);
 }
 
 /*
@@ -955,12 +1104,14 @@ cp
 void terminate_connection(conn_list_t *cl)
 {
   conn_list_t *p;
-
+  subnet_t *s;
 cp
   if(cl->status.remove)
     return;
 
-  if(debug_lvl > 0)
+  cl->status.remove = 1;
+
+  if(debug_lvl >= DEBUG_CONNECTIONS)
     syslog(LOG_NOTICE, _("Closing connection with %s (%s)"),
            cl->name, cl->hostname);
  
@@ -969,43 +1120,40 @@ cp
   if(cl->status.meta)
     close(cl->meta_socket);
 
-  cl->status.remove = 1;
-
-  /* If this cl isn't active, don't send any DEL_HOSTs. */
-
-/* FIXME: reprogram this.
-  if(cl->status.active)
-    notify_others(cl,NULL,send_del_host);
-*/
-    
 cp
   /* Find all connections that were lost because they were behind cl
      (the connection that was dropped). */
+
   if(cl->status.meta)
     for(p = conn_list; p != NULL; p = p->next)
-      {
-        if((p->nexthop == cl) && (p != cl))
-          {
-            if(cl->status.active && p->status.active)
-/* FIXME: reprogram this
-              notify_others(p,cl,send_del_host);
-*/;
-           if(cl->socket)
-             close(cl->socket);
-	    p->status.active = 0;
-	    p->status.remove = 1;
-          }
-      }
+      if((p->nexthop == cl) && (p != cl))
+        terminate_connection(p);	/* Sounds like recursion, but p does not have a meta connection :) */
+
+  /* Inform others of termination if it was still active */
+
+  if(cl->status.active)
+    for(p = conn_list; p != NULL; p = p->next)
+      if(p->status.meta && p->status.active && p!=cl)
+        send_del_host(p, cl);
+
+  /* Remove the associated subnets */
+
+  for(s = cl->subnets; s; s = s->next)
+    subnet_del(s);
+
+  /* Check if this was our outgoing connection */
     
-  cl->status.active = 0;
-  
-  if(cl->status.outgoing)
+  if(cl->status.outgoing && cl->status.active)
     {
       signal(SIGALRM, sigalrm_handler);
       seconds_till_retry = 5;
       alarm(seconds_till_retry);
       syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in 5 seconds"));
     }
+
+  /* Inactivate */
+
+  cl->status.active = 0;
 cp
 }
 
@@ -1025,26 +1173,21 @@ cp
   now = time(NULL);
   for(p = conn_list; p != NULL; p = p->next)
     {
-      if(p->status.remove)
-	continue;
       if(p->status.active && p->status.meta)
 	{
           if(p->last_ping_time + timeout < now)
             {
-              if(p->status.pinged && !p->status.got_pong)
+              if(p->status.pinged)
                 {
-                  if(debug_lvl > 1)
+                  if(debug_lvl >= DEBUG_PROTOCOL)
   	            syslog(LOG_INFO, _("%s (%s) didn't respond to PING"),
 		           p->name, p->hostname);
 	          p->status.timeout = 1;
 	          terminate_connection(p);
                 }
-              else if(p->want_ping)
+              else
                 {
                   send_ping(p);
-                  p->last_ping_time = now;
-                  p->status.pinged = 1;
-                  p->status.got_pong = 0;
                 }
             }
 	}
@@ -1077,9 +1220,7 @@ cp
       return 0;
     }
 
-  ncn->status.meta = 1;
-  ncn->next = conn_list;
-  conn_list = ncn;
+  conn_list_add(ncn);
 cp
   return 0;
 }
@@ -1091,7 +1232,6 @@ cp
 void check_network_activity(fd_set *f)
 {
   conn_list_t *p;
-  int x, l = sizeof(x);
 cp
   for(p = conn_list; p != NULL; p = p->next)
     {
@@ -1101,16 +1241,15 @@ cp
       if(p->status.dataopen)
 	if(FD_ISSET(p->socket, f))
 	  {
-	    /*
-	      The only thing that can happen to get us here is apparently an
-	      error on this outgoing(!) UDP socket that isn't immediate (i.e.
-	      something that will not trigger an error directly on send()).
-	      I've once got here when it said `No route to host'.
-	    */
+            handle_incoming_vpn_data(p);
+
+            /* Old error stuff (FIXME: copy this to handle_incoming_vpn_data()
+            
 	    getsockopt(p->socket, SOL_SOCKET, SO_ERROR, &x, &l);
 	    syslog(LOG_ERR, _("Outgoing data socket error for %s (%s): %s"),
                    p->name, p->hostname, strerror(x));
 	    terminate_connection(p);
+            */
 	    return;
 	  }  
 
@@ -1123,9 +1262,6 @@ cp
 	    } 
     }
   
-  if(FD_ISSET(myself->socket, f))
-    handle_incoming_vpn_data();
-
   if(FD_ISSET(myself->meta_socket, f))
     handle_new_meta_connection();
 cp
@@ -1138,25 +1274,22 @@ cp
 void handle_tap_input(void)
 {
   vpn_packet_t vp;
-  ip_t from, to;
-  int ether_type, lenin;
+  int lenin;
 cp  
-  memset(&vp, 0, sizeof(vp));
-
-  if(taptype = 1)
+  if(taptype == TAP_TYPE_TUNTAP)
     {
       if((lenin = read(tap_fd, vp.data, MTU)) <= 0)
         {
-          syslog(LOG_ERR, _("Error while reading from tapdevice: %m"));
+          syslog(LOG_ERR, _("Error while reading from tun/tap device: %m"));
           return;
         }
       vp.len = lenin;
     }
-  else
+  else			/* ethertap */
     {
-      if((lenin = read(tap_fd, &vp, MTU)) <= 0)
+      if((lenin = read(tap_fd, vp.data - 2, MTU)) <= 0)
         {
-          syslog(LOG_ERR, _("Error while reading from tapdevice: %m"));
+          syslog(LOG_ERR, _("Error while reading from ethertap device: %m"));
           return;
         }
       vp.len = lenin - 2;
@@ -1164,25 +1297,19 @@ cp
 
   total_tap_in += lenin;
 
-  ether_type = ntohs(*((unsigned short*)(&vp.data[12])));
-  if(ether_type != 0x0800)
-    {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("Non-IP ethernet frame %04x from %02x:%02x:%02x:%02x:%02x:%02x"), ether_type, MAC_ADDR_V(vp.data[6]));
-      return;
-    }
-  
   if(lenin < 32)
     {
-      if(debug_lvl > 3)
-	syslog(LOG_INFO, _("Dropping short packet from %02x:%02x:%02x:%02x:%02x:%02x"), MAC_ADDR_V(vp.data[6]));
+      if(debug_lvl >= DEBUG_TRAFFIC)
+	syslog(LOG_WARNING, _("Received short packet from tap device"));
       return;
     }
 
-  from = ntohl(*((unsigned long*)(&vp.data[26])));
-  to = ntohl(*((unsigned long*)(&vp.data[30])));
+  if(debug_lvl >= DEBUG_TRAFFIC)
+    {
+      syslog(LOG_DEBUG, _("Read packet of length %d from tap device"), vp.len);
+    }
 
-  send_packet(to, &vp);
+  send_packet(ntohl(*((unsigned long*)(&vp.data[30]))), &vp);
 cp
 }
 
@@ -1195,6 +1322,7 @@ void main_loop(void)
   struct timeval tv;
   int r;
   time_t last_ping_check;
+  int t;
 cp
   last_ping_check = time(NULL);
 
@@ -1217,28 +1345,45 @@ cp
 
       if(sighup)
         {
+          syslog(LOG_INFO, _("Rereading configuration file and restarting in 5 seconds"));
           sighup = 0;
-/* FIXME: reprogram this.
-	  if(debug_lvl > 1)
-	    syslog(LOG_INFO, _("Rereading configuration file"));
           close_network_connections();
-          clear_config();
-          if(read_config_file(&config, configfilename))
+          clear_config(&config);
+
+          if(read_server_config())
             {
               syslog(LOG_ERR, _("Unable to reread configuration file, exiting"));
               exit(0);
             }
+
           sleep(5);
-          setup_network_connections();
-*/
+          
+          if(setup_network_connections())
+            return;
+            
           continue;
         }
 
-      if(last_ping_check + timeout < time(NULL))
-	/* Let's check if everybody is still alive */
+      t = time(NULL);
+
+      /* Let's check if everybody is still alive */
+
+      if(last_ping_check + timeout < t)
 	{
 	  check_dead_connections();
           last_ping_check = time(NULL);
+
+          /* Should we regenerate our key? */
+
+          if(keyexpires < t)
+            {
+              if(debug_lvl >= DEBUG_STATUS)
+                syslog(LOG_INFO, _("Regenerating symmetric key"));
+                
+              RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
+              send_key_changed(myself, NULL);
+              keyexpires = time(NULL) + keylifetime;
+            }
 	}
 
       if(r > 0)
@@ -1249,6 +1394,8 @@ cp
           if(FD_ISSET(tap_fd, &fset))
 	    handle_tap_input();
         }
+
+      check_children();
     }
 cp
 }