similar to: NAT and UDP

Hi, We want to deploy a tinc VPN, with more than 50 sites connected all arround the world. But we cannot trust all our sites with the same level, so the tinc solution (automatic full mesh) is "too automatic" for us : *any* node can add a new node which will be connected directly to others. A solution could be TLS (signing public keys), but create a PKI is another issue for us.

Hello, Linux has a recvmmsg() system call which allows to achieve several recvfrom() at a time. The patch below makes tinc use it (patch against 1.1-pre11). Basically the patch turns the handle_incoming_vpn_data variables into arrays (of size 1 when recvmmsg is not available, and thus compiled the same as before), and makes the code index into the arrays. You may want to use interdiff -w

aG93IHRvIGNoZWNrb3V0IHRoZSBsYXN0IGRldmVsb3AgdGluYz8gKENWUyxjb21wbGllIGFibGUp DQo= Tinc: Discussion list about the tinc VPN daemon Archive: http://mail.nl.linux.org/lists/ Tinc site: http://tinc.nl.linux.org/

--- doc/tinc.conf.5.in | 3 +++ src/linux/device.c | 7 +++++++ 2 files changed, 10 insertions(+), 0 deletions(-) diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in index 2bfd5fe..01f7f81 100644 --- a/doc/tinc.conf.5.in +++ b/doc/tinc.conf.5.in @@ -255,6 +255,9 @@ a lookup if your DNS server is not responding. This does not affect resolving hostnames to IP addresses from the host

Dear Guus, I've attached my first git commit to your repository. It does not contain any new functionalities, but it is a first try to interact with your git copy. Could you please verify, if you can push this commit to your repository? If it works, I'll send you the rest of my work, which contains: 1) some small improvements in logging (using flags instead of counters) 2) the

Hello, Guus Sliepen, on Wed 02 Dec 2015 13:53:37 +0100, wrote: > That's great! It would be good though to split > handle_incoming_vpn_data() into a function that does the actual > recvfrom/mmsg() and one that processes each individual packet, to reduce > the level of indentation and make the functions a bit more readable. > Then I'll merge it :) Here it is. Samuel

Hello, should the cvs trunk compile? a configure first gave me errors. I had to replace any appearance of "[config.h]" to config.h in the Makefile. Then a make did not finish: make[2]: Entering directory `/usr/src/tinc/lib' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/usr/src/tinc/lib' Making all in src make[2]: Entering directory

This makes it work for us: > On Jun 12, 2015, at 5:02 PM, Chris Clements <cclements at outlook.com> wrote: > > This looks like the culprit: > > http://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=7730d5f3ed9bd7c011dced5808130ffcbd74ea6b <http://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=7730d5f3ed9bd7c011dced5808130ffcbd74ea6b> > > >> On Jun 12,

+0100 From: Daniel Schall <tinc-devel at mon-clan.de> Date: Thu, 6 Jan 2011 17:00:35 +0100 Subject: [PATCH] Improved PMTU discovery diff --git a/lib/dropin.c b/lib/dropin.c index 52fb5b8..2b803b1 100644 --- a/lib/dropin.c +++ b/lib/dropin.c @@ -165,8 +165,8 @@ #endif =20 #ifdef HAVE_MINGW -int usleep(long usec) { - Sleep(usec / 1000); - return 0; -} +//int usleep(long usec) { +//

I'm looking over the tinc-1.1 branch again. I'm getting some errors that I haven't been able to track down yet. tinc sometimes crashes either on its own (I think after a timeout has fired?) or when I hit ctrl-C. I've seen a few different behaviors in particular, as reported by valgrind. Dumps below. I suspected the bufferevent changes, but I haven't gotten any revision before

Hello, Last night there appears to have been a loop in the network of my colocation provider. Somehow this loop/packet flood caused tinc to crash. I guess that, even though it seems to have restarted, it did not manage to reconnect/re-open the tap device/something else went wrong; the machine itself was communicating with the internet but I could not access it over the VPN. The most

Sure, I?ll see if we can narrow it down for you. > On Jun 12, 2015, at 2:25 PM, Etienne Dechamps <etienne at edechamps.fr> wrote: > > That's interesting. I'm using a near-HEAD tinc-1.1 myself and haven't > encountered this problem, but I think that's because I'm using it in > router mode, as opposed to switch mode. > > I'm trying to narrow

Hello. I found that anonymous structures does not work on gcc-2.95. If you guys want to support a bit older platforms I suggest fixing it. You can check out patch I created to fix this issue. I just added 2 extra structures to remove anonymous structs inside connection_status_t and node_status_t. Patch is here: ftp://borg.uu3.net/pub/unix/tinc/tinc.patch Attaching it as well. Regards, Borg

Oh, goodie! I'd made a start on the send direction here: https://github.com/dtaht/tinc/commits/master Perhaps that will help. I would not just pull that as it was just some late night hacking... and it turns out the posix time calls I upgraded to to get better than second resolution are not supported on OSX. My ultimate intent was to move to not bottlenecking or dropping packets on the

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=421 netfilter@linuxace.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WORKSFORME ------- Additional Comments From

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=466 Summary: u.tcp used where u.udp should be, in tftp nat helper Product: netfilter/iptables Version: linux-2.6.x Platform: All OS/Version: All Status: NEW Severity: minor Priority: P2 Component: NAT AssignedTo: laforge@netfilter.org

Hi all, Has there been any progress made on using UDP, but being a NAT? To avoid the Received UDP packet from unknown source 1.2.3.4 messages? I'm using TCP as a workaround for now. Thanks. David -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20140424/6114ed74/attachment.html>

It seems if I use port 53, it works (This has both TCP and UDP open) However if I use 500 UDP (TCP is blocked) it doesn't work. On 24 April 2014 19:18, Guus Sliepen <guus at tinc-vpn.org> wrote: > On Thu, Apr 24, 2014 at 07:05:22PM +0100, David Markey wrote: > > > > > Great! How do I enable this feature? > > > > > > It's on by default, just

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=466 netfilter@linuxace.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |netfilter@linuxace.com Status|NEW |RESOLVED Resolution|

A while back I expressed interest in trying to add additional compression formats (XZ, ZPAQ-derived). What would be the best way for me to try these with the 1.1 codebase? And can 1.1 be used with 1.0.x nets out-of-box? http://en.wikipedia.org/wiki/Xz http://mattmahoney.net/dc/zpaq.html -------------- next part -------------- An HTML attachment was scrubbed... URL: