Releasing 1.1pre3.

diff --git a/NEWS b/NEWS
index 191c2f217e6f4efa76f4765758dfe554d5bb4b66..806f2b79317ae1dbc05f9d34cc69924f8c4985c9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,28 @@
-Version 1.1pre2              Juli 17 2011
+Version 1.1pre3              October 14 2012
+
+ * New experimental protocol:
+   * Uses 521 bit ECDSA keys for authentication.
+   * Uses AES-256-CTR and HMAC-SHA256.
+   * Always provides perfect forward secrecy.
+   * Used for both meta-connections and VPN packets.
+   * VPN packets are encrypted end-to-end.
+
+ * Many improvements to tincctl:
+   * "config" command shows/adds/changes configuration variables.
+   * "export" and "import" commands help exchange configuration files.
+   * "init" command sets up initial configuration files.
+   * "info" command shows details about a node, subnet or address.
+   * "log" command shows live log messages.
+   * Without a command it acts as a shell, with history and TAB completion.
+   * Improved starting/stopping tincd.
+   * Improved graph output.
+
+ * When trying to directly send UDP packets to a node for which multiple
+   addresses are known, all of them are tried.
+
+ * Many small fixes, code cleanups and documentation updates.
+
+Version 1.1pre2              July 17 2011

 
  * .cookie files are renamed to .pid files, which are compatible with 1.0.x.
 
 
  * .cookie files are renamed to .pid files, which are compatible with 1.0.x.
 

diff --git a/README b/README
index ec7653baa9d006f648dc6e94434eba61b7bdea07..10cb0b5e9cc841e2a31e19724a5993849e29bd98 100644 (file)
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-This is the README file for tinc version 1.1pre2. Installation
+This is the README file for tinc version 1.1pre3. Installation

 instructions may be found in the INSTALL file.
 
 tinc is Copyright (C) 1998-2012 by:
 instructions may be found in the INSTALL file.
 
 tinc is Copyright (C) 1998-2012 by:


@@ -29,81 +29,66 @@ protocol is not fixed yet.
 Security statement
 ------------------
 
 Security statement
 ------------------
 

-This version uses an experimental and unfinished cryptographic protocol. Use
-it at your own risk.
+This version uses an experimental and unfinished cryptographic protocol. Use it
+at your own risk.

 
 
 Compatibility
 -------------
 
 
 
 Compatibility
 -------------
 

-Version 1.1pre2 is compatible with 1.0pre8, 1.0 and later, but not with older
+Version 1.1pre3 is compatible with 1.0pre8, 1.0 and later, but not with older

 versions of tinc.
 
 When the ExperimentalProtocol option is used, tinc is still compatible with
 versions of tinc.
 
 When the ExperimentalProtocol option is used, tinc is still compatible with

-1.0.X and 1.1pre2 itself, but not with any other 1.1preX version.
+1.0.X and 1.1pre3 itself, but not with any other 1.1preX version.

 
 
 Requirements
 ------------
 
 
 
 Requirements
 ------------
 

-OpenSSL (http://www.openssl.org/) version 1.0.0 or later.
-
-The zlib library is used for optional compression. You can find it at
-http://www.gzip.org/zlib/.
+In order to compile tinc, you will need a GNU C compiler environment. Please
+ensure you have the latest stable versions of all the required libraries:

 
 

-The lzo library is also used for optional compression. You can find it at
-http://www.oberhumer.com/opensource/lzo/.
+- OpenSSL (http://www.openssl.org/) version 1.0.0 or later.
+- Libevent (http://monkey.org/~provos/libevent/)

 
 

-Since 1.1, the libevent library is used for the main event loop. You can find
-it at http://monkey.org/~provos/libevent/.
+The following libraries are used by default, but can be disabled if necessary:

 
 

-In order to compile tinc, you will need a GNU C compiler environment. Please
-ensure you have the latest stable versions of all the required libraries.
+- zlib (http://www.gzip.org/zlib/)
+- lzo (http://www.oberhumer.com/opensource/lzo/)
+- ncurses (http://invisible-island.net/ncurses/)
+- readline (ftp://ftp.gnu.org/pub/gnu/readline/)

 
 
 Features
 --------
 
 
 
 Features
 --------
 

-This version of tinc supports multiple virtual networks at once. To
-use this feature, you may supply a netname via the -n or --net
-options. The standard locations for the config files will then be
-/etc/tinc/<net>/.
-
-tincd regenerates its encryption key pairs. It does this on the first
-activity after the keys have expired. This period is adjustable in the
-configuration file, and the default time is 3600 seconds (one hour).
-
-This version supports multiple subnets at once. They are also sorted
-on subnet mask size. This means that it is possible to have
-overlapping subnets on the VPN, as long as their subnet mask sizes
-differ.
-
-Since pre5, tinc can operate in several routing modes. The default mode,
-"router", works exactly like the older version, and uses Subnet lines to
-determine the destination of packets. The other two modes, "switch" and "hub",
-allow the tinc daemons to work together like a single network switch or hub.
-This is useful for bridging networks. The latter modes only work properly on
-Linux, FreeBSD and Windows.
-
-The algorithms used for encryption and generating message authentication codes
-can now be changed in the configuration files. All cipher and digest algorithms
-supported by OpenSSL can be used. Useful ciphers are "blowfish" (default),
-"bf-ofb", "des", "des3", etcetera. Useful digests are "sha1" (default), "md5",
-etcetera.
-
-Support for routing IPv6 packets has been added. Just add Subnet lines with
-IPv6 addresses (without using :: abbreviations) and use ifconfig or ip (from
-the iproute package) to give the virtual network interface corresponding IPv6
-addresses. tinc does not provide autoconfiguration for IPv6 hosts, if you need
-it use radvd or zebra.
-
-It is also possible to make tunnels to other tinc daemons over IPv6 networks,
-if the operating system supports IPv6.  tinc will automatically use both IPv6
-and IPv4 when available, but this can be changed by adding the option
-"AddressFamily = ipv4" or "AddressFamily = ipv6" to the tinc.conf file.
+Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number
+of nodes. Instead of configuring tunnels, you give tinc the location and
+public key of a few nodes in the VPN. After making the initial connections to
+those nodes, tinc will learn about all other nodes on the VPN, and will make
+connections automatically. When direct connections are not possible, data will
+be forwarded by intermediate nodes.
+
+By default, nodes authenticate each other using 2048 bit RSA (or 521 bit
+ECDSA*) keys. Traffic is encrypted using Blowfish in CBC mode (or AES-256 in
+CTR mode*), authenticated using HMAC-SHA1 (or HMAC-SHA-256*), and is protected
+against replay attacks.
+
+*) When using the ExperimentalProtocol option.
+
+Tinc fully supports IPv6.
+
+Tinc can operate in several routing modes. In the default mode, "router", every
+node is associated with one or more IPv4 and/or IPv6 Subnets. The other two
+modes, "switch" and "hub", let the tinc daemons work together to form a virtual
+Ethernet network switch or hub.

 
 Normally, when started tinc will detach and run in the background. In a native
 Windows environment this means tinc will intall itself as a service, which will
 restart after reboots.  To prevent tinc from detaching or running as a service,
 use the -D option.
 
 
 Normally, when started tinc will detach and run in the background. In a native
 Windows environment this means tinc will intall itself as a service, which will
 restart after reboots.  To prevent tinc from detaching or running as a service,
 use the -D option.
 

+The status of the VPN can be queried using the "tincctl" tool, which connects
+to a running tinc daemon via a control connection. The same tool also makes it
+easy to start and stop tinc, and to change its configuration.

diff --git a/configure.in b/configure.in
index 5f1902bf187289b0b4e729c93720b3f3c7c1799a..57815376e39be7540c8d42a92b01993b330065e8 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -4,7 +4,7 @@ AC_PREREQ(2.61)
 AC_INIT
 AC_CONFIG_SRCDIR([src/tincd.c])
 AC_GNU_SOURCE
 AC_INIT
 AC_CONFIG_SRCDIR([src/tincd.c])
 AC_GNU_SOURCE

-AM_INIT_AUTOMAKE(tinc, 1.1pre2)
+AM_INIT_AUTOMAKE(tinc, 1.1pre3)

 AC_CONFIG_HEADERS([config.h])
 AM_MAINTAINER_MODE
 
 AC_CONFIG_HEADERS([config.h])
 AM_MAINTAINER_MODE