-- 
cgit v1.2.3

From cf6655a6e29d23132190b6c04c08ab372214b9a4 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Fri, 7 Feb 2014 19:07:48 +0000
Subject: * inital commit for RAIL mode   - added information about it at
 manpage   - updated output for --help * white space cleanups * updated
 copyright header

---
 ChangeLog              | 10 ++++--
 LICENSE                |  4 +--
 README                 | 20 ++++++------
 doc/Makefile           | 20 ++++++------
 doc/uanytun.8          | 45 ++++++++++++++++++--------
 doc/uanytun.8.txt      | 85 ++++++++++++++++++++++++++++++--------------------
 src/Makefile           |  4 +--
 src/auth_algo.c        | 30 +++++++++---------
 src/auth_algo.h        |  4 +--
 src/bsd/tun.c          | 32 +++++++++----------
 src/cipher.c           | 36 ++++++++++-----------
 src/cipher.h           |  4 +--
 src/configure          |  2 +-
 src/daemon.h           |  5 ++-
 src/datatypes.h        |  4 +--
 src/encrypted_packet.c |  6 ++--
 src/encrypted_packet.h |  4 +--
 src/init_crypt.h       |  8 ++---
 src/key_derivation.c   | 18 +++++------
 src/key_derivation.h   |  4 +--
 src/linux/tun.c        | 40 ++++++++++++------------
 src/log.c              | 10 +++---
 src/log.h              |  4 +--
 src/log_targets.h      | 20 ++++++------
 src/options.c          | 20 ++++++------
 src/options.h          |  4 +--
 src/plain_packet.c     |  8 ++---
 src/plain_packet.h     |  6 ++--
 src/seq_window.c       | 16 +++++-----
 src/seq_window.h       |  4 +--
 src/sig_handler.c      |  4 +--
 src/sig_handler.h      |  4 +--
 src/string_list.c      |  8 ++---
 src/string_list.h      |  4 +--
 src/sysexec.c          |  8 ++---
 src/sysexec.h          |  4 +--
 src/tun.h              |  6 ++--
 src/tun_helper.h       |  6 ++--
 src/uanytun.c          | 42 ++++++++++++-------------
 src/udp.c              | 23 +++++++-------
 src/udp.h              |  4 +--
 41 files changed, 315 insertions(+), 275 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 33d4752..ba6fa1c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+201?.??.?? -- Version 0.?.?
+
+* added RAIL mode
+
 2010.02.16 -- Version 0.3.3
 
 * added -v|--version option
@@ -18,11 +22,11 @@
 * improved script execution
 * added signal handling without races
 * all log_targets print time now too
-	
+
 2009.05.01 -- Version 0.3
 
 * updated to new protocol specification (extended label and crypto role)
-  Mind that due this protocol changes this version is incompatible to older 
+  Mind that due this protocol changes this version is incompatible to older
   version of anytun and uanytun
 * the auth tag length can now be configured
 * added extended logging support (syslog, file, stdout and stderr)
@@ -40,7 +44,7 @@
 
 * fixed bug which prevents the daemon from using the right cipher
   key when using a key derivation rate other than 1
-	
+
 2009.01.11 -- Version 0.2
 
 * added crypto support using libgcrypt or openssl
diff --git a/LICENSE b/LICENSE
index 1406bb5..caee980 100644
--- a/LICENSE
+++ b/LICENSE
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/README b/README
index b9eee04..10c3b10 100644
--- a/README
+++ b/README
@@ -1,8 +1,8 @@
 Dependencies
 ============
 
-uAnytun can be built by using either libgcrypt or the openssl-crypto library. 
-The latter is more performant in most cases but there are some license 
+uAnytun can be built by using either libgcrypt or the openssl-crypto library.
+The latter is more performant in most cases but there are some license
 issues when using this library. It also needs more space when installed.
 
 
@@ -11,7 +11,7 @@ Linux
 (this includes Debian with FreeBSD Kernel)
 
 using libgcrypt:
- 
+
  build-essential
  libgcrypt11-dev
 
@@ -46,7 +46,7 @@ if you want to rebuild the manpage:
  textproc/libxslt
  textproc/docbook-xsl
  sysutils/readlink
- misc/getopt 
+ misc/getopt
 
 
 
@@ -75,7 +75,7 @@ using ssl crypto library:
 # ./configure --use-ssl-crypto
 # make
 
-Notes: 
+Notes:
   - try './configure --help' for further information
   - if using openssl pre 0.9.8 you have to disable passphrase
     because openssl had no SHA256 implementation prior to this
@@ -110,20 +110,20 @@ Usage:
 init.d script
 -------------
 
-The init.d script can be used to start uanytun at boot time. It searches for 
+The init.d script can be used to start uanytun at boot time. It searches for
 configuration files which reside at $CONFIG_DIR. For each instance of uanytun
 which should be started there must be a directory containing at least a file
 named config. This file must contain all command line parameter which should
 be used when starting the daemon. One line for each parameter. Empty lines and
 lines starting with # are ignored. Besides the config file there may be a script
-named post-up.sh which will be called when the tun/tap device comes up. 
+named post-up.sh which will be called when the tun/tap device comes up.
 This is an example of how the init.d script can be used to start uanytun:
 
 # /etc/init.d/uanytun start client1 p2p-a
 
 In this case the script will start 2 instances of uanytun using the config files
-$CONFIG_DIR/client1/config and $CONFIG_DIR/p2p-a/config. 
+$CONFIG_DIR/client1/config and $CONFIG_DIR/p2p-a/config.
 If no instance name is specified the script will use the file $CONFIG_DIR/autostart
-to determine which instances to start or stop. This file must contain a list 
-of instance names which should be used when no names are specified at the command 
+to determine which instances to start or stop. This file must contain a list
+of instance names which should be used when no names are specified at the command
 line. One line for each name. Empty lines and lines starting with # are ignored.
diff --git a/doc/Makefile b/doc/Makefile
index b5eecb8..f2b6ac9 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -13,9 +13,9 @@
 ##  message authentication based on the methodes used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
-##  
 ##
-##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+##
+##  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -35,21 +35,21 @@
 
 VERSION=$(shell cat ../version)
 
-.PHONY: clean 
+.PHONY: clean
 
 all: manpage
 
 uanytun.8: uanytun.8.txt
-	a2x -f manpage $<
-	@ sed -i -e 's/\[FIXME: source\]/uanytun ${VERSION}/' $@
-	@ sed -i -e 's/\[FIXME: manual\]/uanytun user manual/' $@
-	@ sed -i -e 's/^uanytun$$/\\fBuanytun\\fR/' $@
-	@ sed -i -e 's/^  \[ \([^ ]*\)/  [ \\fB\1\\fR/' $@
+  a2x -f manpage $<
+  @ sed -i -e 's/\[FIXME: source\]/uanytun ${VERSION}/' $@
+  @ sed -i -e 's/\[FIXME: manual\]/uanytun user manual/' $@
+  @ sed -i -e 's/^uanytun$$/\\fBuanytun\\fR/' $@
+  @ sed -i -e 's/^  \[ \([^ ]*\)/  [ \\fB\1\\fR/' $@
 
 manpage: uanytun.8
 
 clean:
-	rm -f uanytun.8.xml
+  rm -f uanytun.8.xml
 
 realclean: clean
-	rm -f uanytun.8
+  rm -f uanytun.8
diff --git a/doc/uanytun.8 b/doc/uanytun.8
index aae36cb..4e60f6b 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -1,13 +1,22 @@
 '\" t
 .\"     Title: uanytun
 .\"    Author: [see the "AUTHORS" section]
-.\" Generator: DocBook XSL Stylesheets v1.75.1 <http://docbook.sf.net/>
-.\"      Date: 12/14/2010
-.\"    Manual: uanytun user manual
-.\"    Source: uanytun trunk
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 02/07/2014
+.\"    Manual: \ \&
+.\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "UANYTUN" "8" "12/14/2010" "uanytun trunk" "uanytun user manual"
+.TH "UANYTUN" "8" "02/07/2014" "\ \&" "\ \&"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 .\" -----------------------------------------------------------------
@@ -33,9 +42,9 @@ uanytun \- micro anycast tunneling daemon
   [ \fB\-L|\-\-log\fR <target>:<level>[,<param1>[,<param2>[\&.\&.]]] ]
   [ \fB\-U|\-\-debug\fR ]
   [ \fB\-i|\-\-interface\fR <ip\-address> ]
-  [ \fB\-p|\-\-port\fR <port> ]
+  [ \fB\-p|\-\-port\fR <port>[:<port>] ]
   [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
-  [ \fB\-o|\-\-remote\-port\fR <port> ]
+  [ \fB\-o|\-\-remote\-port\fR <port>[:<port>] ]
   [ \fB\-4|\-\-ipv4\-only\fR ]
   [ \fB\-6|\-\-ipv6\-only\fR ]
   [ \fB\-d|\-\-dev\fR <name> ]
@@ -139,9 +148,13 @@ to run in debug mode\&. It implicits
 This IP address is used as the sender address for outgoing packets\&. The default is to not use a special inteface and just bind on all interfaces\&.
 .RE
 .PP
-\fB\-p, \-\-port \fR\fB\fI<port>\fR\fR
+\fB\-p, \-\-port \fR\fB\fI<port>[:<port>]\fR\fR
 .RS 4
-The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. default: 4444
+The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. The default port is 4444\&. You can also specify a port range which enables
+\fBRAIL\fR
+mode\&. See section
+\fBRAIL\fR
+below to find out what this is\&.
 .RE
 .PP
 \fB\-r, \-\-remote\-host \fR\fB\fI<hostname|ip>\fR\fR
@@ -149,9 +162,12 @@ The local UDP port that is used to send and receive the payload data\&. The two
 This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&.
 .RE
 .PP
-\fB\-o, \-\-remote\-port \fR\fB\fI<port>\fR\fR
+\fB\-o, \-\-remote\-port \fR\fB\fI<port>[:<port>]\fR\fR
 .RS 4
-The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&.
+The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&. When RAIL mode is enabled the port range must be of the same length as the range defined with
+\fB\-p, \-\-port\fR\&. See section
+\fBRAIL\fR
+below for more information about this mode\&.
 .RE
 .PP
 \fB\-4, \-\-ipv4\-only\fR
@@ -216,7 +232,7 @@ does not support synchronisation it can\(cqt be used as an anycast endpoint ther
 .RS 4
 seqence window size
 
-Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
+Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\*(Aq sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
 .RE
 .PP
 \fB\-k, \-\-kd\(emprf \fR\fB\fI<kd\-prf type>\fR\fR
@@ -359,6 +375,9 @@ The number of bytes to use for the auth tag\&. This value defaults to 10 bytes u
 \fInull\fR
 auth algo is used in which case it defaults to 0\&.
 .RE
+.SH "RAIL"
+.sp
+\fBRAIL\fR stands for Redundant Array of Inexpensive Links\&. Like RAID spreads the blocks of a disk volume over multiple physical disks, \fBRAIL\fR will spread the UDP packets over multiple physical links\&. More precisly for each packet \fBuAnytun\fR reads, from the TUN/TAP device, it will send out multiple UDP packets\&. All of those to the same host but with different destination ports\&. Using policy\-based routing mechanisms these packets can now be seperated and sent out on several interfaces\&. The server\-side will then pick the first of the packets that arrives and discards all others\&. For this to work the size of the sequence window (\fB\-w\fR) must not be set to 0\&. As soon as the server\-side learns the remote endpoints of all or some of the links it will as well send multiple UDP packets for each payload packet\&.
 .SH "EXAMPLES"
 .SS "P2P Setup between two unicast enpoints:"
 .sp
@@ -417,4 +436,4 @@ Christian Pointner <equinox@anytun\&.org>
 Main web site: http://www\&.anytun\&.org/
 .SH "COPYING"
 .sp
-Copyright (C) 2008\-2010 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
+Copyright (C) 2008\-2014 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 1ebed47..5a75bcb 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -21,9 +21,9 @@ uanytun
   [ -L|--log <target>:<level>[,<param1>[,<param2>[..]]] ]
   [ -U|--debug ]
   [ -i|--interface <ip-address> ]
-  [ -p|--port <port> ]
+  [ -p|--port <port>[:<port>] ]
   [ -r|--remote-host <hostname|ip> ]
-  [ -o|--remote-port <port> ]
+  [ -o|--remote-port <port>[:<port>] ]
   [ -4|--ipv4-only ]
   [ -6|--ipv6-only ]
   [ -d|--dev <name> ]
@@ -51,9 +51,9 @@ DESCRIPTION
 (SATP). It provides a complete VPN solution similar to OpenVPN or
 IPsec in tunnel mode. The main difference is that anycast enables the
 setup of tunnels between an arbitrary combination of anycast, unicast
-and multicast hosts. Unlike Anytun which is a full featured implementation 
-uAnytun has no support for multiple connections or synchronisation. It is a 
-small single threaded implementation intended to act as a client on small 
+and multicast hosts. Unlike Anytun which is a full featured implementation
+uAnytun has no support for multiple connections or synchronisation. It is a
+small single threaded implementation intended to act as a client on small
 platforms.
 
 
@@ -69,7 +69,7 @@ passed to the daemon:
    instead of becoming a daemon which is the default.
 
 *-u, --username '<username>'*::
-   run as this user. If no group is specified (*-g*) the default group of 
+   run as this user. If no group is specified (*-g*) the default group of
    the user is used. The default is to not drop privileges.
 
 *-g, --groupname '<groupname>'*::
@@ -77,30 +77,30 @@ passed to the daemon:
    The default is to not drop privileges.
 
 *-C, --chroot '<path>'*::
-   Instruct *uAnytun* to run in a chroot jail. The default is 
+   Instruct *uAnytun* to run in a chroot jail. The default is
    to not run in chroot.
 
 *-P, --write-pid <filename>*::
-   Instruct *uAnytun* to write it's pid to this file. The default is 
+   Instruct *uAnytun* to write it's pid to this file. The default is
    to not create a pid file.
 
 *-L, --log '<target>:<level>[,<param1>[,<param2>[..]]]'*::
    add log target to logging system. This can be invoked several times
-   in order to log to different targets at the same time. Every target 
+   in order to log to different targets at the same time. Every target
    has its own log level which is a number between 0 and 5. Where 0 means
    disabling log and 5 means debug messages are enabled. +
    The file target can be used more than once with different levels.
-   If no target is provided at the command line a single target with the 
+   If no target is provided at the command line a single target with the
    config 'syslog:3,uanytun,daemon' is added. +
    The following targets are supported:
 
    'syslog';; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
    'file';; log to file, parameters <level>[,<path>]
    'stdout';; log to standard output, parameters <level>
-   'stderr';; log to standard error, parameters <level> 
+   'stderr';; log to standard error, parameters <level>
 
 *-U, --debug*::
-   This option instructs *uAnytun* to run in debug mode. It implicits *-D* 
+   This option instructs *uAnytun* to run in debug mode. It implicits *-D*
    (don't daemonize) and adds a log target with the configuration
    'stdout:5' (logging with maximum level). In future releases there might
    be additional output when this option is supplied.
@@ -110,10 +110,12 @@ passed to the daemon:
    packets. The default is to not use a special inteface and just
    bind on all interfaces.
 
-*-p, --port '<port>'*::
+*-p, --port '<port>[:<port>]'*::
    The local UDP port that is used to send and receive the
    payload data. The two tunnel endpoints can use different
-   ports. default: 4444
+   ports. The default port is 4444.
+   You can also specify a port range which enables *RAIL* mode. See section
+   *RAIL* below to find out what this is.
 
 *-r, --remote-host '<hostname|ip>'*::
    This option can be used to specify the remote tunnel
@@ -122,11 +124,14 @@ passed to the daemon:
    an address, it is automatically determined after receiving
    the first data packet.
 
-*-o, --remote-port '<port>'*::
+*-o, --remote-port '<port>[:<port>]'*::
    The UDP port used for payload data by the remote host
    (specified with -p on the remote host). If you do not specify
    a port, it is automatically determined after receiving
    the first data packet.
+   When RAIL mode is enabled the port range must be of the same length
+   as the range defined with *-p, --port*.
+   See section *RAIL* below for more information about this mode.
 
 *-4, --ipv4-only*::
    Resolv to IPv4 addresses only. The default is to resolv both
@@ -155,7 +160,7 @@ passed to the daemon:
    '<prefix>';; the prefix length of the network
 
 *-x, --post-up-script '<script>'*::
-   This option instructs *uAnytun* to run this script after the interface 
+   This option instructs *uAnytun* to run this script after the interface
    is created. By default no script will be executed.
 
 *-m, --mux '<mux-id>'*::
@@ -164,9 +169,9 @@ passed to the daemon:
 *-s, --sender-id '<sender id>'*::
    Each anycast tunnel endpoint needs a unique sender id
    (1, 2, 3, ...). It is needed to distinguish the senders
-   in case of replay attacks. As *uAnytun* does not support 
-   synchronisation it can't be used as an anycast endpoint therefore 
-   this option is quite useless but implemented for compatibility 
+   in case of replay attacks. As *uAnytun* does not support
+   synchronisation it can't be used as an anycast endpoint therefore
+   this option is quite useless but implemented for compatibility
    reasons. default: 0
 
 *-w, --window-size '<window size>'*::
@@ -185,7 +190,7 @@ passed to the daemon:
 
 *-k, --kd--prf '<kd-prf type>'*::
    key derivation pseudo random function +
-   The pseudo random function which is used for calculating the 
+   The pseudo random function which is used for calculating the
    session keys and session salt. +
    Possible values:
 
@@ -198,16 +203,16 @@ passed to the daemon:
 *-e, --role '<role>'*::
    SATP uses different session keys for inbound and outbound traffic. The
    role parameter is used to determine which keys to use for outbound or
-   inbound packets. On both sides of a vpn connection different roles have 
-   to be used. Possible values are 'left' and 'right'. You may also use 
-   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as 
+   inbound packets. On both sides of a vpn connection different roles have
+   to be used. Possible values are 'left' and 'right'. You may also use
+   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as
    a replacement for 'right'. By default 'left' is used.
 
 *-E, --passphrase '<pass phrase>'*::
    This passphrase is used to generate the master key and master salt.
-   For the master key the last n bits of the SHA256 digest of the 
-   passphrase (where n is the length of the master key in bits) is used. 
-   The master salt gets generated with the SHA1 digest. 
+   For the master key the last n bits of the SHA256 digest of the
+   passphrase (where n is the length of the master key in bits) is used.
+   The master salt gets generated with the SHA1 digest.
    You may force a specific key and or salt by using *--key* and *--salt*.
 
 *-K, --key '<master key>'*::
@@ -236,7 +241,7 @@ passed to the daemon:
 *-a, --auth-algo '<algo type>'*::
    message authentication algorithm +
    This option sets the message authentication algorithm. +
-   If HMAC-SHA1 is used, the packet length is increased. The additional bytes 
+   If HMAC-SHA1 is used, the packet length is increased. The additional bytes
    contain the authentication data. see *--auth-tag-length* for more info. +
    Possible values:
 
@@ -244,8 +249,22 @@ passed to the daemon:
    'sha1';; HMAC-SHA1, default value
 
 *-b, --auth-tag-length '<length>'*::
-   The number of bytes to use for the auth tag. This value defaults to 10 bytes 
-   unless the 'null' auth algo is used in which case it defaults to 0. 
+   The number of bytes to use for the auth tag. This value defaults to 10 bytes
+   unless the 'null' auth algo is used in which case it defaults to 0.
+
+RAIL
+----
+
+*RAIL* stands for Redundant Array of Inexpensive Links. Like RAID spreads
+the blocks of a disk volume over multiple physical disks, *RAIL* will spread the
+UDP packets over multiple physical links. More precisly for each packet *uAnytun*
+reads, from the TUN/TAP device, it will send out multiple UDP packets. All of those to
+the same host but with different destination ports. Using policy-based routing mechanisms
+these packets can now be seperated and sent out on several interfaces.
+The server-side will then pick the first of the packets that arrives and discards all others.
+For this to work the size of the sequence window (*-w*) must not be set to 0.
+As soon as the server-side learns the remote endpoints of all or some of the links it will
+as well send multiple UDP packets for each payload packet.
 
 
 EXAMPLES
@@ -267,7 +286,7 @@ uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ct
 
 One unicast and one anycast tunnel endpoint:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- 
+
 Unicast tunnel endpoint:
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -300,7 +319,7 @@ Main web site: http://www.anytun.org/
 COPYING
 -------
 
-Copyright \(C) 2008-2010 Christian Pointner. This  program is  free 
-software: you can redistribute it and/or modify it under the terms 
-of the GNU General Public License as published by the Free Software 
+Copyright \(C) 2008-2014 Christian Pointner. This  program is  free
+software: you can redistribute it and/or modify it under the terms
+of the GNU General Public License as published by the Free Software
 Foundation, either version 3 of the License, or any later version.
diff --git a/src/Makefile b/src/Makefile
index 5ed36d9..6653b60 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -13,9 +13,9 @@
 ##  message authentication based on the methodes used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
-##  
 ##
-##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+##
+##  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
diff --git a/src/auth_algo.c b/src/auth_algo.c
index b148946..a71b639 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -1,4 +1,4 @@
-/*
+w/*
  *  uAnytun
  *
  *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -50,7 +50,7 @@ auth_algo_type_t auth_algo_get_type(const char* type)
     return aa_null;
   else if(!strcmp(type, "sha1"))
     return aa_sha1;
-  
+
   return aa_unknown;
 }
 
@@ -65,7 +65,7 @@ u_int32_t auth_algo_get_max_length(const char* type)
 
 int auth_algo_init(auth_algo_t* aa, const char* type)
 {
-  if(!aa) 
+  if(!aa)
     return -1;
 
   aa->type_ = auth_algo_get_type(type);
@@ -103,7 +103,7 @@ void auth_algo_close(auth_algo_t* aa)
 
 void auth_algo_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* packet)
 {
-  if(!aa) 
+  if(!aa)
     return;
 
   if(aa->type_ == aa_null)
@@ -118,7 +118,7 @@ void auth_algo_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivation_di
 
 int auth_algo_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* packet)
 {
-  if(!aa) 
+  if(!aa)
     return 0;
 
   if(aa->type_ == aa_null)
@@ -159,7 +159,7 @@ int auth_algo_sha1_init(auth_algo_t* aa)
   if(err) {
     log_printf(ERROR, "failed to open message digest algo: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 #else
   HMAC_CTX_init(&params->ctx_);
   HMAC_Init_ex(&params->ctx_, NULL, 0, EVP_sha1(), NULL);
@@ -181,7 +181,7 @@ void auth_algo_sha1_close(auth_algo_t* aa)
       gcry_md_close(params->handle_);
 #else
     HMAC_CTX_cleanup(&params->ctx_);
-#endif    
+#endif
 
     free(aa->params_);
   }
@@ -212,8 +212,8 @@ void auth_algo_sha1_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
     return;
-  } 
-  
+  }
+
   gcry_md_reset(params->handle_);
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
   gcry_md_final(params->handle_);
@@ -260,7 +260,7 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 
   gcry_md_reset(params->handle_);
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
@@ -280,11 +280,11 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(length > SHA1_LENGTH) {
     u_int32_t i;
     for(i=0; i < (encrypted_packet_get_auth_tag_length(packet) - SHA1_LENGTH); ++i)
-      if(tag[i]) return 0; 
+      if(tag[i]) return 0;
   }
-  
+
   int result = memcmp(&tag[encrypted_packet_get_auth_tag_length(packet) - length], &hmac[SHA1_LENGTH - length], length);
-  
+
   if(result)
     return 0;
 
diff --git a/src/auth_algo.h b/src/auth_algo.h
index 1007955..d911ca8 100644
--- a/src/auth_algo.h
+++ b/src/auth_algo.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index a995c35..734c3d8 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -58,9 +58,9 @@
 
 int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, const char* ifcfg_addr, u_int16_t ifcfg_prefix)
 {
-  if(!dev) 
+  if(!dev)
     return -1;
- 
+
   tun_conf(dev, dev_name, dev_type, ifcfg_addr, ifcfg_prefix, 1400);
   dev->actual_name_ = NULL;
 
@@ -109,7 +109,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
         tun_close(dev);
         return -2;
       }
-        
+
       dev->fd_ = open(device_file_tmp, O_RDWR);
       free(device_file_tmp);
       if(dev->fd_ >= 0)
@@ -125,7 +125,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
       log_printf(ERROR, "can't open device file dynamically: no unused node left");
     else
       log_printf(ERROR, "can't open device file (%s): %s", device_file, strerror(errno));
-    
+
     tun_close(dev);
     return -1;
   }
@@ -164,18 +164,18 @@ int tun_init_post(tun_device_t* dev)
   dev->with_pi_ = 1;
   if(dev->type_ == TYPE_TAP)
     dev->with_pi_ = 0;
-  
-  struct tuninfo ti;  
+
+  struct tuninfo ti;
 
   if(ioctl(dev->fd_, TUNGIFINFO, &ti) < 0) {
     log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
     return -1;
-  }  
+  }
 
   ti.flags |= IFF_MULTICAST;
   if(dev->type_ == TYPE_TUN)
     ti.flags &= ~IFF_POINTOPOINT;
-  
+
   if(ioctl(dev->fd_, TUNSIFINFO, &ti) < 0) {
     log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
     return -1;
@@ -199,20 +199,20 @@ int tun_init_post(tun_device_t* dev)
     if(ioctl(dev->fd_, TUNSLMODE, &arg) < 0) {
       log_printf(ERROR, "can't disable link-layer mode for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
 
     arg = 1;
     if(ioctl(dev->fd_, TUNSIFHEAD, &arg) < 0) {
       log_printf(ERROR, "can't enable multi-af mode for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
 
     arg = IFF_BROADCAST;
     arg |= IFF_MULTICAST;
     if(ioctl(dev->fd_, TUNSIFMODE, &arg) < 0) {
       log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
   }
 
   return 0;
@@ -268,7 +268,7 @@ int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
   {
     struct iovec iov[2];
     u_int32_t type;
-    
+
     iov[0].iov_base = &type;
     iov[0].iov_len = sizeof(type);
     iov[1].iov_base = buf;
@@ -292,13 +292,13 @@ int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
     struct iovec iov[2];
     u_int32_t type;
     struct ip *hdr = (struct ip*)buf;
-    
+
     type = 0;
     if(hdr->ip_v == 4)
       type = htonl(AF_INET);
     else
       type = htonl(AF_INET6);
-    
+
     iov[0].iov_base = &type;
     iov[0].iov_len = sizeof(type);
     iov[1].iov_base = buf;
diff --git a/src/cipher.c b/src/cipher.c
index 427ce9a..5040686 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -47,7 +47,7 @@
 
 int cipher_init(cipher_t* c, const char* type)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
   c->key_length_ = 0;
@@ -61,7 +61,7 @@ int cipher_init(cipher_t* c, const char* type)
     if(type[7] == 0) {
       c->key_length_ = C_AESCTR_DEFAULT_KEY_LENGTH;
     }
-    else if(type[7] != '-') 
+    else if(type[7] != '-')
       return -1;
     else {
       const char* tmp = &type[8];
@@ -113,12 +113,12 @@ void cipher_close(cipher_t* c)
 
 int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir, plain_packet_t* in, encrypted_packet_t* out, seq_nr_t seq_nr, sender_id_t sender_id, mux_t mux)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
-	int32_t len;
+  int32_t len;
   if(c->type_ == c_null)
-    len = cipher_null_crypt(plain_packet_get_packet(in), plain_packet_get_length(in), 
+    len = cipher_null_crypt(plain_packet_get_packet(in), plain_packet_get_length(in),
                             encrypted_packet_get_payload(out), encrypted_packet_get_payload_length(out));
 #ifndef NO_CRYPT
   else if(c->type_ == c_aes_ctr)
@@ -134,7 +134,7 @@ int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
   if(len < 0)
     return 0;
 
-	encrypted_packet_set_sender_id(out, sender_id);
+  encrypted_packet_set_sender_id(out, sender_id);
   encrypted_packet_set_seq_nr(out, seq_nr);
   encrypted_packet_set_mux(out, mux);
 
@@ -145,10 +145,10 @@ int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
 
 int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* in, plain_packet_t* out)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
-	int32_t len;
+  int32_t len;
   if(c->type_ == c_null)
     len = cipher_null_crypt(encrypted_packet_get_payload(in), encrypted_packet_get_payload_length(in),
                             plain_packet_get_packet(out), plain_packet_get_length(out));
@@ -163,11 +163,11 @@ int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
     log_printf(ERROR, "unknown cipher type");
     return -1;
   }
-  
+
   if(len < 0)
     return 0;
 
-	plain_packet_set_length(out, len);
+  plain_packet_set_length(out, len);
 
   return 0;
 }
@@ -176,7 +176,7 @@ int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
 
 int32_t cipher_null_crypt(u_int8_t* in, u_int32_t ilen, u_int8_t* out, u_int32_t olen)
 {
-	memcpy(out, in, (ilen < olen) ? ilen : olen);
+  memcpy(out, in, (ilen < olen) ? ilen : olen);
   return (ilen < olen) ? ilen : olen;
 }
 
@@ -227,7 +227,7 @@ int cipher_aesctr_init(cipher_t* c)
   if(err) {
     log_printf(ERROR, "failed to open cipher: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 #endif
 
   return 0;
@@ -253,7 +253,7 @@ int cipher_aesctr_calc_ctr(cipher_t* c, key_derivation_t* kd, key_derivation_dir
 {
   if(!c || !c->params_)
     return -1;
-  
+
   cipher_aesctr_param_t* params = c->params_;
 
   int ret = key_derivation_generate(kd, dir, LABEL_SALT, seq_nr, c->salt_.buf_, C_AESCTR_SALT_LENGTH);
@@ -286,7 +286,7 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
   int ret = key_derivation_generate(kd, dir, LABEL_ENC, seq_nr, c->key_.buf_, c->key_.length_);
   if(ret < 0)
     return ret;
-  
+
 #ifdef USE_SSL_CRYPTO
   ret = AES_set_encrypt_key(c->key_.buf_, c->key_length_, &params->aes_key_);
   if(ret) {
@@ -306,7 +306,7 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
     log_printf(ERROR, "failed to calculate cipher CTR");
     return ret;
   }
-  
+
 #ifndef USE_SSL_CRYPTO
   err = gcry_cipher_setctr(params->handle_, params->ctr_.buf_, C_AESCTR_CTR_LENGTH);
   if(err) {
@@ -329,6 +329,6 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
   AES_ctr128_encrypt(in, out, (ilen < olen) ? ilen : olen, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
 
-  return (ilen < olen) ? ilen : olen;  
+  return (ilen < olen) ? ilen : olen;
 }
 #endif
diff --git a/src/cipher.h b/src/cipher.h
index e33d815..4582a46 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/configure b/src/configure
index d2f60a8..90a5739 100755
--- a/src/configure
+++ b/src/configure
@@ -16,7 +16,7 @@
 #  tunneling and relaying of packets of any protocol.
 #
 #
-#  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+#  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 #
 #  This file is part of uAnytun.
 #
diff --git a/src/daemon.h b/src/daemon.h
index 9e6f1b2..05fa83e 100644
--- a/src/daemon.h
+++ b/src/daemon.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -172,4 +172,3 @@ void daemonize()
 }
 
 #endif
-
diff --git a/src/datatypes.h b/src/datatypes.h
index 0105062..a374022 100644
--- a/src/datatypes.h
+++ b/src/datatypes.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/encrypted_packet.c b/src/encrypted_packet.c
index 12f04ef..801d8e6 100644
--- a/src/encrypted_packet.c
+++ b/src/encrypted_packet.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -188,7 +188,7 @@ mux_t encrypted_packet_get_mux(encrypted_packet_t* packet)
 {
   if(!packet)
     return 0;
-  
+
   return MUX_T_NTOH(packet->data_.header_.mux_);
 }
 
diff --git a/src/encrypted_packet.h b/src/encrypted_packet.h
index 4afe323..fcd16ab 100644
--- a/src/encrypted_packet.h
+++ b/src/encrypted_packet.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/init_crypt.h b/src/init_crypt.h
index 2461a54..848f9d7 100644
--- a/src/init_crypt.h
+++ b/src/init_crypt.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -54,7 +54,7 @@ int init_crypt()
 
 #define MIN_GCRYPT_VERSION "1.2.0"
 
-int init_crypt() 
+int init_crypt()
 {
   if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
     log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
@@ -81,7 +81,7 @@ int init_crypt()
 
 int init_crypt()
 {
-// nothing here 
+// nothing here
   return 0;
 }
 
diff --git a/src/key_derivation.c b/src/key_derivation.c
index 8e6e95a..a9c4f6d 100644
--- a/src/key_derivation.c
+++ b/src/key_derivation.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -48,7 +48,7 @@
 
 int key_derivation_init(key_derivation_t* kd, const char* type, role_t role, const char* passphrase, u_int8_t* key, u_int32_t key_len, u_int8_t* salt, u_int32_t salt_len)
 {
-  if(!kd) 
+  if(!kd)
     return -1;
 
   kd->role_ = role;
@@ -62,7 +62,7 @@ int key_derivation_init(key_derivation_t* kd, const char* type, role_t role, con
     if(type[7] == 0) {
       kd->key_length_ = KD_AESCTR_DEFAULT_KEY_LENGTH;
     }
-    else if(type[7] != '-') 
+    else if(type[7] != '-')
       return -1;
     else {
       const char* tmp = &type[8];
@@ -127,7 +127,7 @@ int key_derivation_generate_master_key(key_derivation_t* kd, const char* passphr
   if(kd->master_key_.buf_) {
     log_printf(WARNING, "master key and passphrase provided, ignoring passphrase");
     return 0;
-  }    
+  }
   log_printf(NOTICE, "using passphrase to generate master key");
 
   if(!key_length || (key_length % 8)) {
@@ -183,7 +183,7 @@ int key_derivation_generate_master_salt(key_derivation_t* kd, const char* passph
   if(kd->master_salt_.buf_) {
     log_printf(WARNING, "master salt and passphrase provided, ignoring passphrase");
     return 0;
-  }    
+  }
   log_printf(NOTICE, "using passphrase to generate master salt");
 
   if(!salt_length || (salt_length % 8)) {
@@ -247,7 +247,7 @@ void key_derivation_close(key_derivation_t* kd)
 
 int key_derivation_generate(key_derivation_t* kd, key_derivation_dir_t dir, satp_prf_label_t label, seq_nr_t seq_nr, u_int8_t* key, u_int32_t len)
 {
-  if(!kd || !key) 
+  if(!kd || !key)
     return -1;
 
   if(label >= LABEL_NIL) {
@@ -361,7 +361,7 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
   if(err) {
     log_printf(ERROR, "failed to open key derivation cipher: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 
   err = gcry_cipher_setkey(params->handle_, kd->master_key_.buf_, kd->master_key_.length_);
   if(err) {
@@ -457,6 +457,6 @@ int key_derivation_aesctr_generate(key_derivation_t* kd, key_derivation_dir_t di
   memset(key, 0, len);
   AES_ctr128_encrypt(key, key, len, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
-  
+
   return 0;
 }
diff --git a/src/key_derivation.h b/src/key_derivation.h
index d037157..5268faf 100644
--- a/src/key_derivation.h
+++ b/src/key_derivation.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/linux/tun.c b/src/linux/tun.c
index 43370f0..acd823e 100644
--- a/src/linux/tun.c
+++ b/src/linux/tun.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -59,44 +59,44 @@
 #include "sysexec.h"
 
 int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, const char* ifcfg_addr, u_int16_t ifcfg_prefix){
-  if(!dev) 
+  if(!dev)
     return -1;
- 
+
   tun_conf(dev, dev_name, dev_type, ifcfg_addr, ifcfg_prefix, 1400);
   dev->actual_name_ = NULL;
 
-	dev->fd_ = open(DEFAULT_DEVICE, O_RDWR);
-	if(dev->fd_ < 0) {
+  dev->fd_ = open(DEFAULT_DEVICE, O_RDWR);
+  if(dev->fd_ < 0) {
     log_printf(ERROR, "can't open device file (%s): %s", DEFAULT_DEVICE, strerror(errno));
     tun_close(dev);
     return -1;
   }
 
-	struct ifreq ifr;
-	memset(&ifr, 0, sizeof(ifr));
+  struct ifreq ifr;
+  memset(&ifr, 0, sizeof(ifr));
 
   if(dev->type_ == TYPE_TUN) {
     ifr.ifr_flags = IFF_TUN;
     dev->with_pi_ = 1;
-  } 
+  }
   else if(dev->type_ == TYPE_TAP) {
     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
     dev->with_pi_ = 0;
-  } 
+  }
   else {
     log_printf(ERROR, "unable to recognize type of device (tun or tap)");
     tun_close(dev);
     return -1;
   }
 
-	if(dev_name)
-		strncpy(ifr.ifr_name, dev_name, IFNAMSIZ);
+  if(dev_name)
+    strncpy(ifr.ifr_name, dev_name, IFNAMSIZ);
 
-	if(!ioctl(dev->fd_, TUNSETIFF, &ifr)) {
-		dev->actual_name_ = strdup(ifr.ifr_name);
-	} else if(!ioctl(dev->fd_, (('T' << 8) | 202), &ifr)) {
-		dev->actual_name_ = strdup(ifr.ifr_name);
-	} else {
+  if(!ioctl(dev->fd_, TUNSETIFF, &ifr)) {
+    dev->actual_name_ = strdup(ifr.ifr_name);
+  } else if(!ioctl(dev->fd_, (('T' << 8) | 202), &ifr)) {
+    dev->actual_name_ = strdup(ifr.ifr_name);
+  } else {
     log_printf(ERROR, "tun/tap device ioctl failed: %s", strerror(errno));
     tun_close(dev);
     return -1;
@@ -147,7 +147,7 @@ int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
   {
     struct iovec iov[2];
     struct tun_pi tpi;
-    
+
     iov[0].iov_base = &tpi;
     iov[0].iov_len = sizeof(tpi);
     iov[1].iov_base = buf;
@@ -171,13 +171,13 @@ int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
     struct iovec iov[2];
     struct tun_pi tpi;
     struct iphdr *hdr = (struct iphdr *)buf;
-    
+
     tpi.flags = 0;
     if(hdr->version == 4)
       tpi.proto = htons(ETH_P_IP);
     else
       tpi.proto = htons(ETH_P_IPV6);
-    
+
     iov[0].iov_base = &tpi;
     iov[0].iov_len = sizeof(tpi);
     iov[1].iov_base = buf;
diff --git a/src/log.c b/src/log.c
index d789123..5659d3a 100644
--- a/src/log.c
+++ b/src/log.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -85,7 +85,7 @@ int log_targets_target_exists(log_targets_t* targets, log_target_type_t type)
     if(tmp->type_ == type)
       return 1;
     tmp = tmp->next_;
-  }  
+  }
   return 0;
 }
 
@@ -148,7 +148,7 @@ int log_targets_add(log_targets_t* targets, const char* conf)
     log_target_t* tmp = targets->first_;
     while(tmp->next_)
       tmp = tmp->next_;
-    
+
     tmp->next_ = new_target;
   }
   return 0;
@@ -248,7 +248,7 @@ void log_print_hex_dump(log_prio_t prio, const u_int8_t* buf, u_int32_t len)
     if(offset < 0)
       return;
     char* ptr = &msg[offset];
-    
+
     for(i=0; i < len; i++) {
       if(((i+1)*3) >= (MSG_LENGTH_MAX - offset))
         break;
diff --git a/src/log.h b/src/log.h
index 17de487..a87286d 100644
--- a/src/log.h
+++ b/src/log.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log_targets.h b/src/log_targets.h
index 4a19d8e..babe1d1 100644
--- a/src/log_targets.h
+++ b/src/log_targets.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -42,7 +42,7 @@ static char* get_time_formatted()
 {
   char* time_string;
   time_t t = time(NULL);
-  if(t < 0) 
+  if(t < 0)
     time_string = "<time read error>";
   else {
     time_string = ctime(&t);
@@ -79,7 +79,7 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
 {
   if(!self || (conf && conf[0] == 0))
     return -1;
-  
+
   self->param_ = malloc(sizeof(log_target_syslog_param_t));
   if(!self->param_)
     return -2;
@@ -95,7 +95,7 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
       if(!len) {
         free(self->param_);
         return -1;
-      }  
+      }
       logname = malloc(len+1);
       if(logname) {
         strncpy(logname, conf, len);
@@ -116,13 +116,13 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
     ((log_target_syslog_param_t*)(self->param_))->facility_ = DAEMON;
     return 0;
   }
-  
+
   if(end[1] == 0 || end[1] == ',') {
     free(logname);
     free(self->param_);
     return -1;
   }
-    
+
   const char* start = end + 1;
   end = strchr(start, ',');
   int i;
@@ -157,7 +157,7 @@ void log_target_syslog_log(log_target_t* self, log_prio_t prio, const char* msg)
   if(!self || !self->param_ || !self->opened_)
     return;
 
-  syslog((prio + 2) | ((log_target_syslog_param_t*)(self->param_))->facility_, "%s", msg);  
+  syslog((prio + 2) | ((log_target_syslog_param_t*)(self->param_))->facility_, "%s", msg);
 }
 
 void log_target_syslog_close(log_target_t* self)
@@ -209,7 +209,7 @@ int log_target_file_init(log_target_t* self, const char* conf)
 {
   if(!self || (conf && conf[0] == 0))
     return -1;
-  
+
   self->param_ = malloc(sizeof(log_target_file_param_t));
   if(!self->param_)
     return -2;
@@ -224,7 +224,7 @@ int log_target_file_init(log_target_t* self, const char* conf)
       if(!len) {
         free(self->param_);
         return -1;
-      }  
+      }
       logfilename = malloc(len+1);
       if(logfilename) {
         strncpy(logfilename, conf, len);
diff --git a/src/options.c b/src/options.c
index 331a3c3..d3116ba 100644
--- a/src/options.c
+++ b/src/options.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -152,9 +152,9 @@ int options_parse_hex_string(const char* hex, buffer_t* buffer)
   if(hex_len%2)
     return 1;
 
-  if(buffer->buf_) 
+  if(buffer->buf_)
     free(buffer->buf_);
-  
+
   buffer->length_ = hex_len/2;
   buffer->buf_ = malloc(buffer->length_);
   if(!buffer->buf_) {
@@ -189,7 +189,7 @@ int options_parse_ifconfig(const char* arg, ifconfig_param_t* ifcfg)
         free(str);
         return 1;
       }
-      
+
       ifcfg->prefix_length_ = atoi(ptr);
       ifcfg->net_addr_ = strdup(str);
       free(str);
@@ -268,7 +268,7 @@ int options_parse(options_t* opt, int argc, char* argv[])
     PARSE_STRING_PARAM("-a","--auth-algo", opt->auth_algo_)
     PARSE_INT_PARAM("-b","--auth-tag-length", opt->auth_tag_length_)
 #endif
-    else 
+    else
       return i;
   }
   if(ipv4_only && ipv6_only)
@@ -308,13 +308,13 @@ void options_parse_post(options_t* opt)
     return;
 
 #ifndef NO_CRYPT
-  if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") && 
+  if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") &&
      strcmp(opt->kd_prf_, "null")) {
     if(opt->kd_prf_)
       free(opt->kd_prf_);
     opt->kd_prf_ = strdup("null");
   }
-  if((strcmp(opt->cipher_, "null") || strcmp(opt->auth_algo_, "null")) && 
+  if((strcmp(opt->cipher_, "null") || strcmp(opt->auth_algo_, "null")) &&
      !strcmp(opt->kd_prf_, "null")) {
     log_printf(WARNING, "using NULL key derivation with encryption and or authentication enabled!");
   }
@@ -433,14 +433,14 @@ void options_print_usage()
   printf("        [-C|--chroot] <path>                chroot to this directory\n");
   printf("        [-P|--write-pid] <path>             write pid to this file\n");
   printf("        [-i|--interface] <ip-address>       local ip address to bind to\n");
-  printf("        [-p|--port] <port>                  local port to bind to\n");
+  printf("        [-p|--port] <port>                  local port to bind to (use port:port for range - RAIL)\n");
   printf("        [-s|--sender-id ] <sender id>       the sender id to use\n");
   printf("        [-L|--log] <target>:<level>[,<param1>[,<param2>..]]\n");
   printf("                                            add a log target, can be invoked several times\n");
   printf("        [-U|--debug]                        don't daemonize and log to stdout with maximum log level\n");
 
   printf("        [-r|--remote-host] <hostname|ip>    remote host\n");
-  printf("        [-o|--remote-port] <port>           remote port\n");
+  printf("        [-o|--remote-port] <port>           remote port (use port:port for range - RAIL)\n");
   printf("        [-4|--ipv4-only]                    always resolv IPv4 addresses\n");
   printf("        [-6|--ipv6-only]                    always resolv IPv6 addresses\n");
   printf("        [-d|--dev] <name>                   device name\n");
diff --git a/src/options.h b/src/options.h
index 66c9e99..699f2c7 100644
--- a/src/options.h
+++ b/src/options.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/plain_packet.c b/src/plain_packet.c
index 29ba5fe..53bddb9 100644
--- a/src/plain_packet.c
+++ b/src/plain_packet.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -77,7 +77,7 @@ void plain_packet_set_length(plain_packet_t* packet, u_int32_t len)
 {
   if(!packet)
     return;
-  
+
   if(len > PLAIN_PACKET_SIZE_MAX)
     len = PLAIN_PACKET_SIZE_MAX - sizeof(payload_type_t);
   else if(len < sizeof(payload_type_t))
@@ -85,7 +85,7 @@ void plain_packet_set_length(plain_packet_t* packet, u_int32_t len)
   else
     len -= sizeof(payload_type_t);
 
-  packet->payload_length_ = len;  
+  packet->payload_length_ = len;
 }
 
 u_int8_t* plain_packet_get_payload(plain_packet_t* packet)
diff --git a/src/plain_packet.h b/src/plain_packet.h
index 0dc62b7..54c0f8d 100644
--- a/src/plain_packet.h
+++ b/src/plain_packet.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -41,7 +41,7 @@
 #define PAYLOAD_TYPE_TAP 0x6558
 #define PAYLOAD_TYPE_TUN 0x0000
 #define PAYLOAD_TYPE_TUN4 0x0800
-#define PAYLOAD_TYPE_TUN6 0x86DD 
+#define PAYLOAD_TYPE_TUN6 0x86DD
 #define PAYLOAD_TYPE_UNKNOWN 0xFFFF
 
 struct plain_packet_struct {
diff --git a/src/seq_window.c b/src/seq_window.c
index 0f58adb..3a1355f 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -152,12 +152,12 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
           ptr->max_ -= SEQ_NR_MAX/2;
         else if(shifted == 2)
           ptr->max_ += SEQ_NR_MAX/2;
-        
+
         return 0;
       }
-      
+
       seq_nr_t diff = ptr->max_ - seq_nr;
-      window_size_t pos = diff > ptr->pos_ ? ptr->pos_ + win->size_ : ptr->pos_; 
+      window_size_t pos = diff > ptr->pos_ ? ptr->pos_ + win->size_ : ptr->pos_;
       pos -= diff;
 
       if(shifted == 1)
@@ -170,7 +170,7 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
       return ret;
     }
     ptr = ptr->next_;
-  }  
+  }
   if(!win->first_) {
     win->first_ = seq_win_new_element(sender_id, seq_nr, win->size_);
     if(!win->first_)
@@ -184,7 +184,7 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
     if(!ptr->next_)
       return -2;
   }
-  
+
   return 0;
 }
 
@@ -204,7 +204,7 @@ void seq_win_print(seq_win_t* win)
         printf("O");
       else
         printf(".");
-      
+
       if(i)
         i--;
       else
diff --git a/src/seq_window.h b/src/seq_window.h
index b699ee9..3a5478e 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sig_handler.c b/src/sig_handler.c
index 7c5c695..c596339 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sig_handler.h b/src/sig_handler.h
index 8219618..749c80d 100644
--- a/src/sig_handler.h
+++ b/src/sig_handler.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/string_list.c b/src/string_list.c
index 5e0ddf8..260dd92 100644
--- a/src/string_list.c
+++ b/src/string_list.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -43,7 +43,7 @@ void string_list_init(string_list_t* list)
 {
   if(!list)
     return;
-  
+
   list->first_ = NULL;
 }
 
@@ -104,7 +104,7 @@ void string_list_print(string_list_t* list, const char* head, const char* tail)
 {
   if(!list)
     return;
-  
+
   string_list_element_t* tmp = list->first_;
   while(tmp) {
     printf("%s%s%s", head, tmp->string_, tail);
diff --git a/src/string_list.h b/src/string_list.h
index 9e210ae..2e29822 100644
--- a/src/string_list.h
+++ b/src/string_list.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sysexec.c b/src/sysexec.c
index 708d8d0..1191401 100644
--- a/src/sysexec.c
+++ b/src/sysexec.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -82,7 +82,7 @@ int uanytun_exec(const char* script, char* const argv[], char* const evp[])
         log_printf(WARNING, "can't open stderr");
     }
     execve(script, argv, evp);
-        // if execve returns, an error occurred, but logging doesn't work 
+        // if execve returns, an error occurred, but logging doesn't work
         // because we closed all file descriptors, so just write errno to
         // pipe and call exit
     int ret = write(pipefd[1], (void*)(&errno), sizeof(errno));
@@ -107,7 +107,7 @@ int uanytun_exec(const char* script, char* const argv[], char* const evp[])
     }
   }
   if(WIFEXITED(status))
-    log_printf(NOTICE, "script '%s' returned %d", script, WEXITSTATUS(status));  
+    log_printf(NOTICE, "script '%s' returned %d", script, WEXITSTATUS(status));
   else if(WIFSIGNALED(status))
     log_printf(NOTICE, "script '%s' terminated after signal %d", script, WTERMSIG(status));
   else
diff --git a/src/sysexec.h b/src/sysexec.h
index faed8eb..7527584 100644
--- a/src/sysexec.h
+++ b/src/sysexec.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/tun.h b/src/tun.h
index 230b88d..5051e19 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -57,7 +57,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
 int tun_init_post(tun_device_t* dev);
 void tun_do_ifconfig(tun_device_t* dev);
 void tun_close(tun_device_t* dev);
-  
+
 int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len);
 int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len);
 
diff --git a/src/tun_helper.h b/src/tun_helper.h
index 9d55267..6417d1c 100644
--- a/src/tun_helper.h
+++ b/src/tun_helper.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -92,7 +92,7 @@ const char* tun_get_type_string(tun_device_t* dev)
 {
   if(!dev || dev->fd_ < 0)
     return "";
-  
+
   switch(dev->type_)
   {
   case TYPE_UNDEF: return "undef"; break;
diff --git a/src/uanytun.c b/src/uanytun.c
index d804d05..1317de1 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -72,7 +72,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
     log_printf(ERROR, "could not initialize cipher of type %s", opt->cipher_);
     return ret;
   }
-  
+
 #ifndef NO_CRYPT
   ret = auth_algo_init(aa, opt->auth_algo_);
   if(ret) {
@@ -114,25 +114,25 @@ int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packe
     log_printf(ERROR, "error on reading from device: %s", strerror(errno));
     return 0;
   }
-  
+
   plain_packet_set_payload_length(plain_packet, len);
-  
+
   if(dev->type_ == TYPE_TUN)
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TUN);
   else if(dev->type_ == TYPE_TAP)
-    plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TAP);    
+    plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TAP);
   else
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_UNKNOWN);
 
   if(!sock->remote_end_set_)
     return 0;
-  
-  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_); 
-  
+
+  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_);
+
 #ifndef NO_CRYPT
   auth_algo_generate(aa, kd, kd_outbound, encrypted_packet);
 #endif
- 
+
   len = udp_write(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet));
   if(len == -1)
     log_printf(ERROR, "error on sending udp packet: %s", strerror(errno));
@@ -166,12 +166,12 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
     return 0;
   }
 #endif
-  
+
   if(encrypted_packet_get_mux(encrypted_packet) != opt->mux_) {
     log_printf(WARNING, "wrong mux value, discarding packet");
     return 0;
   }
-  
+
   int result = seq_win_check_and_add(seq_win, encrypted_packet_get_sender_id(encrypted_packet), encrypted_packet_get_seq_nr(encrypted_packet));
   if(result > 0) {
     log_printf(WARNING, "detected replay attack, discarding packet");
@@ -181,7 +181,7 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
     log_printf(ERROR, "memory error at sequence window");
     return -2;
   }
-   
+
   udp_set_active_sock(sock, fd);
   if(remote.len_ != sock->remote_end_.len_ || memcmp(&(remote.addr_), &(sock->remote_end_.addr_), remote.len_)) {
     memcpy(&(sock->remote_end_.addr_), &(remote.addr_), remote.len_);
@@ -196,14 +196,14 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
     return 0;
   }
 
-  int ret = cipher_decrypt(c, kd, kd_inbound, encrypted_packet, plain_packet); 
-  if(ret) 
+  int ret = cipher_decrypt(c, kd, kd_inbound, encrypted_packet, plain_packet);
+  if(ret)
     return ret;
- 
+
   len = tun_write(dev, plain_packet_get_payload(plain_packet), plain_packet_get_payload_length(plain_packet));
   if(len == -1)
     log_printf(ERROR, "error on writing to device: %s", strerror(errno));
-  
+
   return 0;
 }
 
@@ -269,7 +269,7 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
     udp_socket_t* s = sock->socks_;
     while(s) {
       if(FD_ISSET(s->fd_, &readyfds)) {
-        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
+        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win);
         if(return_value)
           break;
       }
@@ -311,7 +311,7 @@ int main(int argc, char* argv[])
       options_print_version();
     }
 
-    if(ret != -2 && ret != -5) 
+    if(ret != -2 && ret != -5)
       options_print_usage();
 
     if(ret == -1 || ret == -5)
@@ -331,7 +331,7 @@ int main(int argc, char* argv[])
       case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
       default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
       }
-        
+
       options_clear(&opt);
       log_close();
       exit(ret);
@@ -420,7 +420,7 @@ int main(int argc, char* argv[])
       options_clear(&opt);
       log_close();
       exit(-1);
-    }  
+    }
 
   if(opt.daemonize_) {
     pid_t oldpid = getpid();
diff --git a/src/udp.c b/src/udp.c
index 1491d75..6173f7f 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -54,7 +54,7 @@
 
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
 {
-  if(!sock || !port) 
+  if(!sock || !port)
     return -1;
 
   sock->socks_ = NULL;
@@ -110,7 +110,7 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
       prev_sock->next_ = new_sock;
       prev_sock = new_sock;
     }
-    
+
     memcpy(&(new_sock->local_end_.addr_), r->ai_addr, r->ai_addrlen);
     new_sock->local_end_.len_ = r->ai_addrlen;
     new_sock->fd_ = socket(new_sock->local_end_.addr_.ss_family, SOCK_DGRAM, 0);
@@ -134,7 +134,7 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
       udp_close(sock);
       return -1;
     }
-  
+
     char* local_string = udp_endpoint_to_string(new_sock->local_end_);
     if(local_string) {
       log_printf(NOTICE, "listening on: %s", local_string);
@@ -165,7 +165,7 @@ int udp_init_fd_set(udp_t* sock, fd_set* set)
 
 int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
-  if(!sock || !remote_addr || !port) 
+  if(!sock || !remote_addr || !port)
     return -1;
 
   struct addrinfo hints, *res;
@@ -232,10 +232,10 @@ void udp_close(udp_t* sock)
   while(sock->socks_) {
     if(sock->socks_->fd_ > 0)
       close(sock->socks_->fd_);
-    
+
     udp_socket_t*s = sock->socks_;
     sock->socks_ = sock->socks_->next_;
-    
+
     free(s);
   }
   sock->socks_ = NULL;
@@ -245,13 +245,13 @@ char* udp_endpoint_to_string(udp_endpoint_t e)
 {
   char addrstr[INET6_ADDRSTRLEN + 1], portstr[6], *ret;
   char addrport_sep = ':';
-  
+
   switch(e.addr_.ss_family)
   {
   case AF_INET: addrport_sep = ':'; break;
   case AF_INET6: addrport_sep = '.'; break;
   case AF_UNSPEC: return NULL;
-  default: return strdup("unknown address type"); 
+  default: return strdup("unknown address type");
   }
 
   int errcode  = getnameinfo((struct sockaddr *)&(e.addr_), e.len_, addrstr, sizeof(addrstr), portstr, sizeof(portstr), NI_NUMERICHOST | NI_NUMERICSERV);
@@ -268,7 +268,7 @@ char* udp_get_remote_end_string(udp_t* sock)
 
   return udp_endpoint_to_string(sock->remote_end_);
 }
- 
+
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
 {
   if(!sock || !remote_end)
@@ -284,4 +284,3 @@ int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
 
   return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_.addr_), sock->remote_end_.len_);
 }
-
diff --git a/src/udp.h b/src/udp.h
index 4c5fdc8..ca2a00a 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -13,9 +13,9 @@
  *  message authentication based on the methodes used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
-- 
cgit v1.2.3


From e059b856aaef4db1bbb081ba16fd046d4c3cffc3 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sat, 8 Feb 2014 07:02:06 +0000
Subject: fixed errors introduces by white space cleanup

---
 doc/Makefile    | 15 ++++++++-------
 src/auth_algo.c |  2 +-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/doc/Makefile b/doc/Makefile
index f2b6ac9..2ed666b 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -40,16 +40,17 @@ VERSION=$(shell cat ../version)
 all: manpage
 
 uanytun.8: uanytun.8.txt
-  a2x -f manpage $<
-  @ sed -i -e 's/\[FIXME: source\]/uanytun ${VERSION}/' $@
-  @ sed -i -e 's/\[FIXME: manual\]/uanytun user manual/' $@
-  @ sed -i -e 's/^uanytun$$/\\fBuanytun\\fR/' $@
-  @ sed -i -e 's/^  \[ \([^ ]*\)/  [ \\fB\1\\fR/' $@
+	a2x -f manpage $<
+	@ sed -i -e 's/\[FIXME: source\]/uanytun ${VERSION}/' $@
+	@ sed -i -e 's/\[FIXME: manual\]/uanytun user manual/' $@
+	@ sed -i -e 's/^uanytun$$/\\fBuanytun\\fR/' $@
+	@ sed -i -e 's/^  \[ \([^ ]*\)/  [ \\fB\1\\fR/' $@
 
 manpage: uanytun.8
 
 clean:
-  rm -f uanytun.8.xml
+	rm -f uanytun.8
+	rm -f uanytun.8.xml
 
 realclean: clean
-  rm -f uanytun.8
+	rm -f uanytun.8
diff --git a/src/auth_algo.c b/src/auth_algo.c
index a71b639..db87e7a 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -1,4 +1,4 @@
-w/*
+/*
  *  uAnytun
  *
  *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
-- 
cgit v1.2.3


From 3e8961a52dc443acc1f75033da64015fe2883c96 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sat, 8 Feb 2014 07:13:10 +0000
Subject: reverted clean target for doc

---
 doc/Makefile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/Makefile b/doc/Makefile
index 2ed666b..3a1a672 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -49,7 +49,6 @@ uanytun.8: uanytun.8.txt
 manpage: uanytun.8
 
 clean:
-	rm -f uanytun.8
 	rm -f uanytun.8.xml
 
 realclean: clean
-- 
cgit v1.2.3


From 6e5b0f1df2c4baf62fd0e98b81d22a6b39f4f7c2 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sat, 8 Feb 2014 16:02:20 +0000
Subject: fixed help output

---
 src/options.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/options.c b/src/options.c
index d3116ba..3271c06 100644
--- a/src/options.c
+++ b/src/options.c
@@ -433,14 +433,14 @@ void options_print_usage()
   printf("        [-C|--chroot] <path>                chroot to this directory\n");
   printf("        [-P|--write-pid] <path>             write pid to this file\n");
   printf("        [-i|--interface] <ip-address>       local ip address to bind to\n");
-  printf("        [-p|--port] <port>                  local port to bind to (use port:port for range - RAIL)\n");
+  printf("        [-p|--port] <port>[:<port>]         local port to bind to (use port:port for range - RAIL)\n");
   printf("        [-s|--sender-id ] <sender id>       the sender id to use\n");
   printf("        [-L|--log] <target>:<level>[,<param1>[,<param2>..]]\n");
   printf("                                            add a log target, can be invoked several times\n");
   printf("        [-U|--debug]                        don't daemonize and log to stdout with maximum log level\n");
 
   printf("        [-r|--remote-host] <hostname|ip>    remote host\n");
-  printf("        [-o|--remote-port] <port>           remote port (use port:port for range - RAIL)\n");
+  printf("        [-o|--remote-port] <port>[:<port>]  remote port (use port:port for range - RAIL)\n");
   printf("        [-4|--ipv4-only]                    always resolv IPv4 addresses\n");
   printf("        [-6|--ipv6-only]                    always resolv IPv6 addresses\n");
   printf("        [-d|--dev] <name>                   device name\n");
-- 
cgit v1.2.3


From 5d24910be65973162960748d03bed221b63e3bc7 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 9 Feb 2014 13:25:44 +0000
Subject: refactored name

---
 src/uanytun.c | 2 +-
 src/udp.c     | 2 +-
 src/udp.h     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 1317de1..a0265d5 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -387,7 +387,7 @@ int main(int argc, char* argv[])
   }
 
   if(opt.remote_addr_) {
-    if(!udp_set_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
+    if(!udp_resolv_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
       char* remote_string = udp_get_remote_end_string(&sock);
       if(remote_string) {
         log_printf(NOTICE, "set remote end to: %s", remote_string);
diff --git a/src/udp.c b/src/udp.c
index 6173f7f..b75a8e6 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -163,7 +163,7 @@ int udp_init_fd_set(udp_t* sock, fd_set* set)
   return max_fd;
 }
 
-int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !remote_addr || !port)
     return -1;
diff --git a/src/udp.h b/src/udp.h
index ca2a00a..284d41f 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -63,7 +63,7 @@ typedef struct udp_struct udp_t;
 
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
 int udp_init_fd_set(udp_t* sock, fd_set* set);
-int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
+int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
 void udp_set_active_sock(udp_t* sock, int fd);
 void udp_close(udp_t* sock);
 
-- 
cgit v1.2.3


From 8f720015cbec4c29b8264c126875bcef5c0a08a3 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 9 Feb 2014 13:43:13 +0000
Subject: remote end is now stored at every sock

---
 src/uanytun.c | 17 ++++++++++-------
 src/udp.c     | 22 ++++++++++++----------
 src/udp.h     |  4 ++--
 3 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index a0265d5..3473b24 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -124,7 +124,7 @@ int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packe
   else
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_UNKNOWN);
 
-  if(!sock->remote_end_set_)
+  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
     return 0;
 
   cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_);
@@ -183,12 +183,15 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
   }
 
   udp_set_active_sock(sock, fd);
-  if(remote.len_ != sock->remote_end_.len_ || memcmp(&(remote.addr_), &(sock->remote_end_.addr_), remote.len_)) {
-    memcpy(&(sock->remote_end_.addr_), &(remote.addr_), remote.len_);
-    sock->remote_end_set_ = 1;
-    char* addrstring = udp_endpoint_to_string(remote);
-    log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
-    free(addrstring);
+  if(sock->active_sock_) {
+    if(remote.len_ != sock->active_sock_->remote_end_.len_ ||
+       memcmp(&(remote.addr_), &(sock->active_sock_->remote_end_.addr_), remote.len_)) {
+      memcpy(&(sock->active_sock_->remote_end_.addr_), &(remote.addr_), remote.len_);
+      sock->active_sock_->remote_end_set_ = 1;
+      char* addrstring = udp_endpoint_to_string(remote);
+      log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
+      free(addrstring);
+    }
   }
 
   if(encrypted_packet_get_payload_length(encrypted_packet) <= plain_packet_get_header_length()) {
diff --git a/src/udp.c b/src/udp.c
index b75a8e6..883e9fc 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -59,9 +59,6 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
 
   sock->socks_ = NULL;
   sock->active_sock_ = NULL;
-  memset(&(sock->remote_end_.addr_), 0, sizeof(sock->remote_end_.addr_));
-  sock->remote_end_.len_ = sizeof(sock->remote_end_.addr_);
-  sock->remote_end_set_ = 0;
 
   struct addrinfo hints, *res;
 
@@ -100,6 +97,9 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
     }
     memset(&(new_sock->local_end_.addr_), 0, sizeof(new_sock->local_end_.addr_));
     new_sock->local_end_.len_ = sizeof(new_sock->local_end_.addr_);
+    memset(&(new_sock->remote_end_.addr_), 0, sizeof(new_sock->remote_end_.addr_));
+    new_sock->remote_end_.len_ = sizeof(new_sock->remote_end_.addr_);
+    new_sock->remote_end_set_ = 0;
     new_sock->next_ = NULL;
 
     if(!sock->socks_) {
@@ -189,9 +189,6 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
     log_printf(ERROR, "getaddrinfo returned no address for %s:%s", remote_addr, port);
     return -1;
   }
-  memcpy(&(sock->remote_end_.addr_), res->ai_addr, res->ai_addrlen);
-  sock->remote_end_.len_ = res->ai_addrlen;
-  sock->remote_end_set_ = 1;
 
   if(!sock->active_sock_) {
     udp_socket_t* s = sock->socks_;
@@ -203,6 +200,11 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
       s = s->next_;
     }
   }
+  if(sock->active_sock_) {
+    memcpy(&(sock->active_sock_->remote_end_.addr_), res->ai_addr, res->ai_addrlen);
+    sock->active_sock_->remote_end_.len_ = res->ai_addrlen;
+    sock->active_sock_->remote_end_set_ = 1;
+  }
 
   freeaddrinfo(res);
 
@@ -263,10 +265,10 @@ char* udp_endpoint_to_string(udp_endpoint_t e)
 
 char* udp_get_remote_end_string(udp_t* sock)
 {
-  if(!sock || !sock->remote_end_set_)
+  if(!sock || !sock->active_sock_->remote_end_set_)
     return NULL;
 
-  return udp_endpoint_to_string(sock->remote_end_);
+  return udp_endpoint_to_string(sock->active_sock_->remote_end_);
 }
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
@@ -279,8 +281,8 @@ int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t*
 
 int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
 {
-  if(!sock || !sock->remote_end_set_ || !sock->active_sock_)
+  if(!sock || !sock->active_sock_ || !sock->active_sock_->remote_end_set_)
     return 0;
 
-  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_.addr_), sock->remote_end_.len_);
+  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->active_sock_->remote_end_.addr_), sock->active_sock_->remote_end_.len_);
 }
diff --git a/src/udp.h b/src/udp.h
index 284d41f..2684c13 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -49,6 +49,8 @@ typedef struct {
 struct udp_socket_struct {
   int fd_;
   udp_endpoint_t local_end_;
+  udp_endpoint_t remote_end_;
+  int remote_end_set_;
   struct udp_socket_struct* next_;
 };
 typedef struct udp_socket_struct udp_socket_t;
@@ -56,8 +58,6 @@ typedef struct udp_socket_struct udp_socket_t;
 struct udp_struct {
   udp_socket_t* socks_;
   udp_socket_t* active_sock_;
-  udp_endpoint_t remote_end_;
-  int remote_end_set_;
 };
 typedef struct udp_struct udp_t;
 
-- 
cgit v1.2.3


From 72fa004f63e49103512ba3c29836f2cdeda19423 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 9 Feb 2014 23:12:44 +0000
Subject: moved remote end handling and active sock to udp.c

---
 src/uanytun.c | 14 ++------------
 src/udp.c     | 56 ++++++++++++++++++++++++++++++++++++++++++--------------
 src/udp.h     |  5 +++--
 3 files changed, 47 insertions(+), 28 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 3473b24..674e7bb 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -124,7 +124,7 @@ int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packe
   else
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_UNKNOWN);
 
-  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+  if(!udp_has_remote(sock))
     return 0;
 
   cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_);
@@ -182,17 +182,7 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
     return -2;
   }
 
-  udp_set_active_sock(sock, fd);
-  if(sock->active_sock_) {
-    if(remote.len_ != sock->active_sock_->remote_end_.len_ ||
-       memcmp(&(remote.addr_), &(sock->active_sock_->remote_end_.addr_), remote.len_)) {
-      memcpy(&(sock->active_sock_->remote_end_.addr_), &(remote.addr_), remote.len_);
-      sock->active_sock_->remote_end_set_ = 1;
-      char* addrstring = udp_endpoint_to_string(remote);
-      log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
-      free(addrstring);
-    }
-  }
+  udp_update_remote(sock, fd, &remote);
 
   if(encrypted_packet_get_payload_length(encrypted_packet) <= plain_packet_get_header_length()) {
     log_printf(WARNING, "ignoring packet with zero length payload");
diff --git a/src/udp.c b/src/udp.c
index 883e9fc..e774ef4 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -135,7 +135,7 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
       return -1;
     }
 
-    char* local_string = udp_endpoint_to_string(new_sock->local_end_);
+    char* local_string = udp_endpoint_to_string(&(new_sock->local_end_));
     if(local_string) {
       log_printf(NOTICE, "listening on: %s", local_string);
       free(local_string);
@@ -163,6 +163,14 @@ int udp_init_fd_set(udp_t* sock, fd_set* set)
   return max_fd;
 }
 
+int udp_has_remote(udp_t* sock)
+{
+  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+    return 0;
+
+  return 1;
+}
+
 int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !remote_addr || !port)
@@ -211,18 +219,35 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
   return 0;
 }
 
-void udp_set_active_sock(udp_t* sock, int fd)
+void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote)
 {
-  if(!sock || (sock->active_sock_ && sock->active_sock_->fd_ == fd))
+  if(!sock)
     return;
 
-  udp_socket_t* s = sock->socks_;
-  while(s) {
-    if(s->fd_ == fd) {
-      sock->active_sock_ = s;
-      return;
+  if(!(sock->active_sock_) || sock->active_sock_->fd_ == fd) {
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if(s->fd_ == fd) {
+        sock->active_sock_ = s;
+        break;
+      }
+      s = s->next_;
+    }
+  }
+
+  if(!remote)
+    return;
+
+  if(sock->active_sock_) {
+    if(remote->len_ != sock->active_sock_->remote_end_.len_ ||
+       memcmp(&(remote->addr_), &(sock->active_sock_->remote_end_.addr_), remote->len_)) {
+      memcpy(&(sock->active_sock_->remote_end_.addr_), &(remote->addr_), remote->len_);
+      sock->active_sock_->remote_end_.len_ = remote->len_;
+      sock->active_sock_->remote_end_set_ = 1;
+      char* addrstring = udp_endpoint_to_string(remote);
+      log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
+      free(addrstring);
     }
-    s = s->next_;
   }
 }
 
@@ -243,20 +268,23 @@ void udp_close(udp_t* sock)
   sock->socks_ = NULL;
 }
 
-char* udp_endpoint_to_string(udp_endpoint_t e)
+char* udp_endpoint_to_string(udp_endpoint_t* e)
 {
+  if(!e)
+    return strdup("<null>");
+
   char addrstr[INET6_ADDRSTRLEN + 1], portstr[6], *ret;
   char addrport_sep = ':';
 
-  switch(e.addr_.ss_family)
+  switch(e->addr_.ss_family)
   {
   case AF_INET: addrport_sep = ':'; break;
   case AF_INET6: addrport_sep = '.'; break;
   case AF_UNSPEC: return NULL;
-  default: return strdup("unknown address type");
+  default: return strdup("<unknown address type>");
   }
 
-  int errcode  = getnameinfo((struct sockaddr *)&(e.addr_), e.len_, addrstr, sizeof(addrstr), portstr, sizeof(portstr), NI_NUMERICHOST | NI_NUMERICSERV);
+  int errcode  = getnameinfo((struct sockaddr *)&(e->addr_), e->len_, addrstr, sizeof(addrstr), portstr, sizeof(portstr), NI_NUMERICHOST | NI_NUMERICSERV);
   if (errcode != 0) return NULL;
   int len = asprintf(&ret, "%s%c%s", addrstr, addrport_sep ,portstr);
   if(len == -1) return NULL;
@@ -268,7 +296,7 @@ char* udp_get_remote_end_string(udp_t* sock)
   if(!sock || !sock->active_sock_->remote_end_set_)
     return NULL;
 
-  return udp_endpoint_to_string(sock->active_sock_->remote_end_);
+  return udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
 }
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
diff --git a/src/udp.h b/src/udp.h
index 2684c13..ffc87d6 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -63,11 +63,12 @@ typedef struct udp_struct udp_t;
 
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
 int udp_init_fd_set(udp_t* sock, fd_set* set);
+int udp_has_remote(udp_t* sock);
 int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
-void udp_set_active_sock(udp_t* sock, int fd);
+void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote);
 void udp_close(udp_t* sock);
 
-char* udp_endpoint_to_string(udp_endpoint_t e);
+char* udp_endpoint_to_string(udp_endpoint_t* e);
 char* udp_get_remote_end_string(udp_t* sock);
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
-- 
cgit v1.2.3


From acbad345d0ae2c197e51ec66c9b9c0e0a1cd991e Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 10 Feb 2014 00:05:52 +0000
Subject: improved handling of sequence numbers (only increment if packet is
 sent)

---
 src/uanytun.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 674e7bb..5b30b54 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -104,7 +104,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
 }
 
 int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
-                     cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t seq_nr)
+                     cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t* seq_nr)
 {
   plain_packet_set_payload_length(plain_packet, -1);
   encrypted_packet_set_length(encrypted_packet, -1);
@@ -127,8 +127,8 @@ int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packe
   if(!udp_has_remote(sock))
     return 0;
 
-  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_);
-
+  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, *seq_nr, opt->sender_id_, opt->mux_);
+  (*seq_nr)++;
 #ifndef NO_CRYPT
   auth_algo_generate(aa, kd, kd_outbound, encrypted_packet);
 #endif
@@ -253,8 +253,7 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
     }
 
     if(FD_ISSET(dev->fd_, &readyfds)) {
-      return_value = process_tun_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, seq_nr);
-      seq_nr++;
+      return_value = process_tun_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_nr);
       if(return_value)
         break;
     }
-- 
cgit v1.2.3


From 5c9ae52239d7185b98a3eed64899fbce73942706 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 10 Feb 2014 01:28:44 +0000
Subject: moved less invasive check for mux value to the top

---
 src/uanytun.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 5b30b54..edb0bfe 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -153,13 +153,17 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
   if(len == -1) {
     log_printf(ERROR, "error on receiving udp packet: %s", strerror(errno));
     return 0;
-  }
-  else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
+  } else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
     log_printf(WARNING, "received packet is too short");
     return 0;
   }
   encrypted_packet_set_length(encrypted_packet, len);
 
+  if(encrypted_packet_get_mux(encrypted_packet) != opt->mux_) {
+    log_printf(WARNING, "wrong mux value, discarding packet");
+    return 0;
+  }
+
 #ifndef NO_CRYPT
   if(!auth_algo_check_tag(aa, kd, kd_inbound, encrypted_packet)) {
     log_printf(WARNING, "wrong authentication tag, discarding packet");
@@ -167,17 +171,11 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
   }
 #endif
 
-  if(encrypted_packet_get_mux(encrypted_packet) != opt->mux_) {
-    log_printf(WARNING, "wrong mux value, discarding packet");
-    return 0;
-  }
-
   int result = seq_win_check_and_add(seq_win, encrypted_packet_get_sender_id(encrypted_packet), encrypted_packet_get_seq_nr(encrypted_packet));
   if(result > 0) {
     log_printf(WARNING, "detected replay attack, discarding packet");
     return 0;
-  }
-  else if(result < 0) {
+  } else if(result < 0) {
     log_printf(ERROR, "memory error at sequence window");
     return -2;
   }
-- 
cgit v1.2.3


From a6ba8d2faa437cfa171834cbcbe81317750b27b7 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 10 Feb 2014 03:43:53 +0000
Subject: clang --analyze yielded bugs

---
 src/cipher.c     | 4 +---
 src/seq_window.c | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/cipher.c b/src/cipher.c
index 5040686..d6eae57 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -241,10 +241,8 @@ void cipher_aesctr_close(cipher_t* c)
   if(c->params_) {
 #ifndef USE_SSL_CRYPTO
     cipher_aesctr_param_t* params = c->params_;
-    if(params->handle_)
-      gcry_cipher_close(params->handle_);
+    gcry_cipher_close(params->handle_);
 #endif
-
     free(c->params_);
   }
 }
diff --git a/src/seq_window.c b/src/seq_window.c
index 3a1355f..5adf5b3 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -81,7 +81,7 @@ seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, wind
   e->sender_id_ = sender_id;
   e->max_ = max;
   e->pos_ = 0;
-  e->window_ = malloc(sizeof(seq_nr_t)*size);
+  e->window_ = malloc(sizeof((*e->window_))*size);
   if(!e->window_) {
     free(e);
     return NULL;
-- 
cgit v1.2.3


From 0b0b66bdeab69e0cd95f657ddee5bab5c0c7187c Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 10 Feb 2014 19:54:17 +0000
Subject: added explicit option for RAIL mode

---
 doc/uanytun.8     | 18 ++++++++++++++----
 doc/uanytun.8.txt |  7 ++++++-
 src/options.c     |  5 ++++-
 src/options.h     |  1 +
 src/uanytun.c     |  2 +-
 src/udp.c         |  6 +++++-
 src/udp.h         |  3 ++-
 7 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/doc/uanytun.8 b/doc/uanytun.8
index 4e60f6b..4fe8184 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -2,12 +2,12 @@
 .\"     Title: uanytun
 .\"    Author: [see the "AUTHORS" section]
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 02/07/2014
+.\"      Date: 02/10/2014
 .\"    Manual: \ \&
 .\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "UANYTUN" "8" "02/07/2014" "\ \&" "\ \&"
+.TH "UANYTUN" "8" "02/10/2014" "\ \&" "\ \&"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -43,6 +43,7 @@ uanytun \- micro anycast tunneling daemon
   [ \fB\-U|\-\-debug\fR ]
   [ \fB\-i|\-\-interface\fR <ip\-address> ]
   [ \fB\-p|\-\-port\fR <port>[:<port>] ]
+  [ \fB\-Y|\-\-rail\-mode\fR ]
   [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
   [ \fB\-o|\-\-remote\-port\fR <port>[:<port>] ]
   [ \fB\-4|\-\-ipv4\-only\fR ]
@@ -150,9 +151,18 @@ This IP address is used as the sender address for outgoing packets\&. The defaul
 .PP
 \fB\-p, \-\-port \fR\fB\fI<port>[:<port>]\fR\fR
 .RS 4
-The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. The default port is 4444\&. You can also specify a port range which enables
+The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. The default port is 4444\&. In
 \fBRAIL\fR
-mode\&. See section
+mode you must specify a port range\&. See section
+\fBRAIL\fR
+below to find out what this is\&.
+.RE
+.PP
+\fB\-Y, \-\-rail\-mode\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in RAIL mode\&. See section
 \fBRAIL\fR
 below to find out what this is\&.
 .RE
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 5a75bcb..5bb236f 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -22,6 +22,7 @@ uanytun
   [ -U|--debug ]
   [ -i|--interface <ip-address> ]
   [ -p|--port <port>[:<port>] ]
+  [ -Y|--rail-mode ]
   [ -r|--remote-host <hostname|ip> ]
   [ -o|--remote-port <port>[:<port>] ]
   [ -4|--ipv4-only ]
@@ -114,7 +115,11 @@ passed to the daemon:
    The local UDP port that is used to send and receive the
    payload data. The two tunnel endpoints can use different
    ports. The default port is 4444.
-   You can also specify a port range which enables *RAIL* mode. See section
+   In *RAIL* mode you must specify a port range. See section
+   *RAIL* below to find out what this is.
+
+*-Y, --rail-mode*::
+   This option instructs *uAnytun* to run in RAIL mode. See section
    *RAIL* below to find out what this is.
 
 *-r, --remote-host '<hostname|ip>'*::
diff --git a/src/options.c b/src/options.c
index 3271c06..240a286 100644
--- a/src/options.c
+++ b/src/options.c
@@ -209,7 +209,6 @@ int options_parse_ifconfig(const char* arg, ifconfig_param_t* ifcfg)
   return 1;
 }
 
-
 int options_parse(options_t* opt, int argc, char* argv[])
 {
   if(!opt)
@@ -246,6 +245,7 @@ int options_parse(options_t* opt, int argc, char* argv[])
     PARSE_INT_PARAM("-s","--sender-id", opt->sender_id_)
     PARSE_STRING_LIST("-L","--log", opt->log_targets_)
     PARSE_BOOL_PARAM("-U", "--debug", opt->debug_)
+    PARSE_BOOL_PARAM("-Y", "--rail-mode", opt->rail_mode_)
     PARSE_STRING_PARAM("-r","--remote-host", opt->remote_addr_)
     PARSE_STRING_PARAM("-o","--remote-port", opt->remote_port_)
     PARSE_BOOL_PARAM("-4","--ipv4-only", ipv4_only)
@@ -347,6 +347,7 @@ void options_default(options_t* opt)
   opt->local_addr_ = NULL;
   opt->local_port_ = strdup("4444");
   opt->sender_id_ = 0;
+  opt->rail_mode_ = 0;
   opt->remote_addr_ = NULL;
   opt->remote_port_ = strdup("4444");
   opt->resolv_addr_type_ = ANY;
@@ -439,6 +440,7 @@ void options_print_usage()
   printf("                                            add a log target, can be invoked several times\n");
   printf("        [-U|--debug]                        don't daemonize and log to stdout with maximum log level\n");
 
+  printf("        [-Y|--rail-mode]                    enable RAIL mode\n");
   printf("        [-r|--remote-host] <hostname|ip>    remote host\n");
   printf("        [-o|--remote-port] <port>[:<port>]  remote port (use port:port for range - RAIL)\n");
   printf("        [-4|--ipv4-only]                    always resolv IPv4 addresses\n");
@@ -487,6 +489,7 @@ void options_print(options_t* opt)
   printf("local_addr: '%s'\n", opt->local_addr_);
   printf("local_port: '%s'\n", opt->local_port_);
   printf("sender_id: %d\n", opt->sender_id_);
+  printf("rail-mode: %s\n", !opt->rail_mode_ ? "false" : "true");
   printf("remote_addr: '%s'\n", opt->remote_addr_);
   printf("remote_port: '%s'\n", opt->remote_port_);
   printf("resolv_addr_type: ");
diff --git a/src/options.h b/src/options.h
index 699f2c7..05f1c21 100644
--- a/src/options.h
+++ b/src/options.h
@@ -62,6 +62,7 @@ struct options_struct {
   char* local_addr_;
   char* local_port_;
   sender_id_t sender_id_;
+  int rail_mode_;
   char* remote_addr_;
   char* remote_port_;
   resolv_addr_type_t resolv_addr_type_;
diff --git a/src/uanytun.c b/src/uanytun.c
index edb0bfe..c23294c 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -367,7 +367,7 @@ int main(int argc, char* argv[])
 
 
   udp_t sock;
-  ret = udp_init(&sock, opt.local_addr_, opt.local_port_, opt.resolv_addr_type_);
+  ret = udp_init(&sock, opt.local_addr_, opt.local_port_, opt.resolv_addr_type_, opt.rail_mode_);
   if(ret) {
     log_printf(ERROR, "error on udp_init, exitting");
     tun_close(&dev);
diff --git a/src/udp.c b/src/udp.c
index e774ef4..f81dee7 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -52,13 +52,14 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode)
 {
   if(!sock || !port)
     return -1;
 
   sock->socks_ = NULL;
   sock->active_sock_ = NULL;
+  sock->rail_mode_ = rail_mode;
 
   struct addrinfo hints, *res;
 
@@ -146,6 +147,9 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
 
   freeaddrinfo(res);
 
+  if(sock->rail_mode_)
+    log_printf(NOTICE, "RAIL mode enabled");
+
   return 0;
 }
 
diff --git a/src/udp.h b/src/udp.h
index ffc87d6..8f54ed4 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -58,10 +58,11 @@ typedef struct udp_socket_struct udp_socket_t;
 struct udp_struct {
   udp_socket_t* socks_;
   udp_socket_t* active_sock_;
+  int rail_mode_;
 };
 typedef struct udp_struct udp_t;
 
-int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode);
 int udp_init_fd_set(udp_t* sock, fd_set* set);
 int udp_has_remote(udp_t* sock);
 int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
-- 
cgit v1.2.3


From f329c57d9e76983759bb47da16dd3204e0accbc8 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 10 Feb 2014 21:40:21 +0000
Subject: fixed typos at manpage

---
 doc/uanytun.8     | 6 +++---
 doc/uanytun.8.txt | 7 ++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/doc/uanytun.8 b/doc/uanytun.8
index 4fe8184..c02198a 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -387,7 +387,7 @@ auth algo is used in which case it defaults to 0\&.
 .RE
 .SH "RAIL"
 .sp
-\fBRAIL\fR stands for Redundant Array of Inexpensive Links\&. Like RAID spreads the blocks of a disk volume over multiple physical disks, \fBRAIL\fR will spread the UDP packets over multiple physical links\&. More precisly for each packet \fBuAnytun\fR reads, from the TUN/TAP device, it will send out multiple UDP packets\&. All of those to the same host but with different destination ports\&. Using policy\-based routing mechanisms these packets can now be seperated and sent out on several interfaces\&. The server\-side will then pick the first of the packets that arrives and discards all others\&. For this to work the size of the sequence window (\fB\-w\fR) must not be set to 0\&. As soon as the server\-side learns the remote endpoints of all or some of the links it will as well send multiple UDP packets for each payload packet\&.
+\fBRAIL\fR stands for Redundant Array of Inexpensive Links\&. Like RAID spreads the blocks of a disk volume over multiple physical disks, \fBRAIL\fR will spread the UDP packets over multiple physical links\&. More precisly for each packet \fBuAnytun\fR reads, from the TUN/TAP device, it will send out multiple UDP packets\&. All of those to the same host but with different destination ports\&. Using policy\-based routing mechanisms these packets can now be seperated and sent out on several interfaces\&. The server\-side will then pick the first of the packets that arrive and discards all others\&. For this to work the size of the sequence window (\fB\-w\fR) must not be set to 0\&. As soon as the server\-side learns the remote endpoints of all or some of the links it will as well send multiple UDP packets for each payload packet\&.
 .SH "EXAMPLES"
 .SS "P2P Setup between two unicast enpoints:"
 .sp
@@ -399,7 +399,7 @@ auth algo is used in which case it defaults to 0\&.
 \fBHost A:\fR
 .RS 4
 .sp
-uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
+uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E have_a_very_safe_and_productive_day \-e left
 .RE
 .sp
 .it 1 an-trap
@@ -410,7 +410,7 @@ uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ct
 \fBHost B:\fR
 .RS 4
 .sp
-uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
+uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E have_a_very_safe_and_productive_day \-e right
 .RE
 .SS "One unicast and one anycast tunnel endpoint:"
 .sp
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 5bb236f..2a47318 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -257,6 +257,7 @@ passed to the daemon:
    The number of bytes to use for the auth tag. This value defaults to 10 bytes
    unless the 'null' auth algo is used in which case it defaults to 0.
 
+
 RAIL
 ----
 
@@ -266,7 +267,7 @@ UDP packets over multiple physical links. More precisly for each packet *uAnytun
 reads, from the TUN/TAP device, it will send out multiple UDP packets. All of those to
 the same host but with different destination ports. Using policy-based routing mechanisms
 these packets can now be seperated and sent out on several interfaces.
-The server-side will then pick the first of the packets that arrives and discards all others.
+The server-side will then pick the first of the packets that arrive and discards all others.
 For this to work the size of the sequence window (*-w*) must not be set to 0.
 As soon as the server-side learns the remote endpoints of all or some of the links it will
 as well send multiple UDP packets for each payload packet.
@@ -281,12 +282,12 @@ P2P Setup between two unicast enpoints:
 Host A:
 ^^^^^^^
 
-uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e left
 
 Host B:
 ^^^^^^^
-uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e right
 
 One unicast and one anycast tunnel endpoint:
-- 
cgit v1.2.3


From 935e861444060673e40204f435e01ffe18a0d63e Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 20:24:50 +0000
Subject: depending on rail mode call update_remote before or after seq_window
 check

---
 src/uanytun.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index c23294c..6ebd721 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -171,6 +171,9 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
   }
 #endif
 
+  if(sock->rail_mode_)
+    udp_update_remote(sock, fd, &remote);
+
   int result = seq_win_check_and_add(seq_win, encrypted_packet_get_sender_id(encrypted_packet), encrypted_packet_get_seq_nr(encrypted_packet));
   if(result > 0) {
     log_printf(WARNING, "detected replay attack, discarding packet");
@@ -180,7 +183,8 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
     return -2;
   }
 
-  udp_update_remote(sock, fd, &remote);
+  if(!sock->rail_mode_)
+    udp_update_remote(sock, fd, &remote);
 
   if(encrypted_packet_get_payload_length(encrypted_packet) <= plain_packet_get_header_length()) {
     log_printf(WARNING, "ignoring packet with zero length payload");
-- 
cgit v1.2.3


From 835599bb64c77907cc7d2230fc02349f1981886c Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 20:33:55 +0000
Subject: moved local socket resolver to subroutine

---
 src/udp.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index f81dee7..c3e755f 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -52,15 +52,8 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode)
+static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
 {
-  if(!sock || !port)
-    return -1;
-
-  sock->socks_ = NULL;
-  sock->active_sock_ = NULL;
-  sock->rail_mode_ = rail_mode;
-
   struct addrinfo hints, *res;
 
   res = NULL;
@@ -146,6 +139,21 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   }
 
   freeaddrinfo(res);
+  return 0;
+}
+
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode)
+{
+  if(!sock || !port)
+    return -1;
+
+  sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
+  sock->rail_mode_ = rail_mode;
+
+  int ret = udp_resolv_local(sock, local_addr, port, resolv_type);
+  if(ret)
+    return ret;
 
   if(sock->rail_mode_)
     log_printf(NOTICE, "RAIL mode enabled");
-- 
cgit v1.2.3


From 819982bdae5e04275908cd21db81248faf5a3d26 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 21:52:48 +0000
Subject: listening in multiple sockets works now

---
 src/udp.c | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index c3e755f..c600e98 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -80,7 +80,8 @@ static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* por
   }
 
   struct addrinfo* r = res;
-  udp_socket_t* prev_sock = NULL;
+  udp_socket_t* prev_sock = sock->socks_;
+  while(prev_sock && prev_sock->next_) prev_sock = prev_sock->next_;
   while(r) {
     udp_socket_t* new_sock = malloc(sizeof(udp_socket_t));
     if(!new_sock) {
@@ -151,9 +152,34 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   sock->active_sock_ = NULL;
   sock->rail_mode_ = rail_mode;
 
-  int ret = udp_resolv_local(sock, local_addr, port, resolv_type);
-  if(ret)
-    return ret;
+  const char* colon = strchr(port, ':');
+  if(!colon) {
+    int ret = udp_resolv_local(sock, local_addr, port, resolv_type);
+    if(ret)
+      return ret;
+  } else {
+    if(!rail_mode)
+      log_printf(WARNING, "A port range has been defined - enabling RAIL mode");
+    sock->rail_mode_ = 1;
+
+    u_int32_t port_num, port_end;
+    port_num = atoi(port);
+    port_end = atoi(colon+1);
+    if(port_num < 1 || port_num > 65535 ||
+       port_end < 1 || port_end > 65535 || port_end < port_num) {
+      log_printf(ERROR, "illegal port range");
+      return -1;
+    }
+    do {
+      char port_str[10];
+      snprintf(port_str, sizeof(port_str), "%d", port_num);
+      int ret = udp_resolv_local(sock, local_addr, port_str, resolv_type);
+      if(ret)
+        return ret;
+
+      port_num++;
+    } while(port_num <= port_end);
+  }
 
   if(sock->rail_mode_)
     log_printf(NOTICE, "RAIL mode enabled");
@@ -278,6 +304,7 @@ void udp_close(udp_t* sock)
     free(s);
   }
   sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
 }
 
 char* udp_endpoint_to_string(udp_endpoint_t* e)
-- 
cgit v1.2.3


From 6d74bbab1620acdf71915c8189c683acde8c3f84 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 22:31:13 +0000
Subject: fixed memory error at udp_endpoint_to_string

---
 src/udp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/udp.c b/src/udp.c
index c600e98..9054f10 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -332,7 +332,7 @@ char* udp_endpoint_to_string(udp_endpoint_t* e)
 
 char* udp_get_remote_end_string(udp_t* sock)
 {
-  if(!sock || !sock->active_sock_->remote_end_set_)
+  if(!sock || !sock->active_sock_ || !sock->active_sock_->remote_end_set_)
     return NULL;
 
   return udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
-- 
cgit v1.2.3


From 381efd6da6e85fce4a30857aab729bea30d3e1e0 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 23:10:11 +0000
Subject: fixed remote socket resolving

---
 src/udp.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index 9054f10..44bd814 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -236,20 +236,27 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
     return -1;
   }
 
-  if(!sock->active_sock_) {
-    udp_socket_t* s = sock->socks_;
-    while(s) {
-      if(s->local_end_.addr_.ss_family == res->ai_family) {
-        sock->active_sock_ = s;
-        break;
+  struct addrinfo* r = res;
+  while(r) {
+    if(!sock->active_sock_) {
+      udp_socket_t* s = sock->socks_;
+      while(s) {
+        if(s->local_end_.addr_.ss_family == r->ai_family) {
+          sock->active_sock_ = s;
+          break;
+        }
+        s = s->next_;
       }
-      s = s->next_;
     }
-  }
-  if(sock->active_sock_) {
-    memcpy(&(sock->active_sock_->remote_end_.addr_), res->ai_addr, res->ai_addrlen);
-    sock->active_sock_->remote_end_.len_ = res->ai_addrlen;
-    sock->active_sock_->remote_end_set_ = 1;
+
+    if(sock->active_sock_) {
+      memcpy(&(sock->active_sock_->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
+      sock->active_sock_->remote_end_.len_ = r->ai_addrlen;
+      sock->active_sock_->remote_end_set_ = 1;
+      break;
+    }
+
+    r = r->ai_next;
   }
 
   freeaddrinfo(res);
@@ -332,7 +339,7 @@ char* udp_endpoint_to_string(udp_endpoint_t* e)
 
 char* udp_get_remote_end_string(udp_t* sock)
 {
-  if(!sock || !sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+  if(!sock || !(sock->active_sock_) || !(sock->active_sock_->remote_end_set_))
     return NULL;
 
   return udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
-- 
cgit v1.2.3


From 6f0681c3327ec5eb8a33d5e873bfeafe4c5c6340 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Tue, 11 Feb 2014 23:30:52 +0000
Subject: small refactoring

---
 src/udp.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index 44bd814..635b310 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -143,6 +143,17 @@ static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* por
   return 0;
 }
 
+static int udp_split_port_range(const char* port, const char* colon, u_int32_t* low, u_int32_t* high)
+{
+  *low = atoi(port);
+  *high = atoi(colon+1);
+  if(*low < 1 || *low > 65535 || *high < 1 || *high > 65535 || *high < *low) {
+    log_printf(ERROR, "illegal port range");
+    return -1;
+  }
+  return 0;
+}
+
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode)
 {
   if(!sock || !port)
@@ -163,13 +174,8 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
     sock->rail_mode_ = 1;
 
     u_int32_t port_num, port_end;
-    port_num = atoi(port);
-    port_end = atoi(colon+1);
-    if(port_num < 1 || port_num > 65535 ||
-       port_end < 1 || port_end > 65535 || port_end < port_num) {
-      log_printf(ERROR, "illegal port range");
+    if(udp_split_port_range(port, colon, &port_num, &port_end))
       return -1;
-    }
     do {
       char port_str[10];
       snprintf(port_str, sizeof(port_str), "%d", port_num);
-- 
cgit v1.2.3


From f32ba56f0e81554647c34935862928351df4f7ea Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 21:02:43 +0000
Subject: removed useless remote_end_to_string added rail version vor udp_write

---
 src/uanytun.c | 11 ++---------
 src/udp.c     | 58 ++++++++++++++++++++++++++++++++++++++++++++++------------
 src/udp.h     |  1 -
 3 files changed, 48 insertions(+), 22 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 6ebd721..75d21ce 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -380,15 +380,8 @@ int main(int argc, char* argv[])
     exit(ret);
   }
 
-  if(opt.remote_addr_) {
-    if(!udp_resolv_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
-      char* remote_string = udp_get_remote_end_string(&sock);
-      if(remote_string) {
-        log_printf(NOTICE, "set remote end to: %s", remote_string);
-        free(remote_string);
-      }
-    }
-  }
+  if(opt.remote_addr_)
+    udp_resolv_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_);
 
 
   FILE* pid_file = NULL;
diff --git a/src/udp.c b/src/udp.c
index 635b310..43b2cfe 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -209,10 +209,17 @@ int udp_init_fd_set(udp_t* sock, fd_set* set)
 
 int udp_has_remote(udp_t* sock)
 {
-  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+  if(!sock->rail_mode_ && (!sock->active_sock_ || !sock->active_sock_->remote_end_set_))
     return 0;
 
-  return 1;
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    if(s->remote_end_set_)
+      return 1;
+    s = s->next_;
+  }
+
+  return 0;
 }
 
 int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
@@ -259,6 +266,11 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
       memcpy(&(sock->active_sock_->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
       sock->active_sock_->remote_end_.len_ = r->ai_addrlen;
       sock->active_sock_->remote_end_set_ = 1;
+      char* remote_string = udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
+      if(remote_string) {
+        log_printf(NOTICE, "set remote end to: %s", remote_string);
+        free(remote_string);
+      }
       break;
     }
 
@@ -343,26 +355,48 @@ char* udp_endpoint_to_string(udp_endpoint_t* e)
   return ret;
 }
 
-char* udp_get_remote_end_string(udp_t* sock)
-{
-  if(!sock || !(sock->active_sock_) || !(sock->active_sock_->remote_end_set_))
-    return NULL;
-
-  return udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
-}
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
 {
-  if(!sock || !remote_end)
+  if(!sock || !buf || !remote_end)
     return -1;
 
   return recvfrom(fd, buf, len, 0, (struct sockaddr *)&(remote_end->addr_), &(remote_end->len_));
 }
 
-int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
+
+static int udp_write_active_sock(udp_t* sock, u_int8_t* buf, u_int32_t len)
 {
-  if(!sock || !sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
     return 0;
 
   return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->active_sock_->remote_end_.addr_), sock->active_sock_->remote_end_.len_);
 }
+
+static int udp_write_rail(udp_t* sock, u_int8_t* buf, u_int32_t len)
+{
+  int i=0;
+
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    if(s->remote_end_set_) {
+      sendto(s->fd_, buf, len, 0, (struct sockaddr *)&(s->remote_end_.addr_), s->remote_end_.len_);
+      i++;
+    }
+    s = s->next_;
+  }
+
+  log_printf(DEBUG, "sent %d Bytes to %d sockets", len, i);
+  return len;
+}
+
+int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
+{
+  if(!sock || !buf)
+    return 0;
+
+  if(sock->rail_mode_)
+    return udp_write_rail(sock, buf, len);
+
+  return udp_write_active_sock(sock, buf, len);
+}
diff --git a/src/udp.h b/src/udp.h
index 8f54ed4..5b74c2d 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -70,7 +70,6 @@ void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote);
 void udp_close(udp_t* sock);
 
 char* udp_endpoint_to_string(udp_endpoint_t* e);
-char* udp_get_remote_end_string(udp_t* sock);
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
 int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len);
-- 
cgit v1.2.3


From a65230483369fd3124f9b810e52080630dfcc75c Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 21:45:05 +0000
Subject: introduced socket indexes for easier debugging

---
 src/udp.c | 20 +++++++++++++-------
 src/udp.h |  1 +
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index 43b2cfe..1ba63b1 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -52,7 +52,7 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, unsigned int* idx)
 {
   struct addrinfo hints, *res;
 
@@ -96,6 +96,7 @@ static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* por
     new_sock->remote_end_.len_ = sizeof(new_sock->remote_end_.addr_);
     new_sock->remote_end_set_ = 0;
     new_sock->next_ = NULL;
+    new_sock->idx_ = (*idx)++;
 
     if(!sock->socks_) {
       sock->socks_ = new_sock;
@@ -132,7 +133,7 @@ static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* por
 
     char* local_string = udp_endpoint_to_string(&(new_sock->local_end_));
     if(local_string) {
-      log_printf(NOTICE, "listening on: %s", local_string);
+      log_printf(NOTICE, "socket[%d] listening on: %s", new_sock->idx_, local_string);
       free(local_string);
     }
 
@@ -163,9 +164,10 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   sock->active_sock_ = NULL;
   sock->rail_mode_ = rail_mode;
 
+  unsigned int idx = 0;
   const char* colon = strchr(port, ':');
   if(!colon) {
-    int ret = udp_resolv_local(sock, local_addr, port, resolv_type);
+    int ret = udp_resolv_local(sock, local_addr, port, resolv_type, &idx);
     if(ret)
       return ret;
   } else {
@@ -179,7 +181,7 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
     do {
       char port_str[10];
       snprintf(port_str, sizeof(port_str), "%d", port_num);
-      int ret = udp_resolv_local(sock, local_addr, port_str, resolv_type);
+      int ret = udp_resolv_local(sock, local_addr, port_str, resolv_type, &idx);
       if(ret)
         return ret;
 
@@ -249,6 +251,7 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
     return -1;
   }
 
+  int found = 0;
   struct addrinfo* r = res;
   while(r) {
     if(!sock->active_sock_) {
@@ -266,9 +269,10 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
       memcpy(&(sock->active_sock_->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
       sock->active_sock_->remote_end_.len_ = r->ai_addrlen;
       sock->active_sock_->remote_end_set_ = 1;
+      found = 1;
       char* remote_string = udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
       if(remote_string) {
-        log_printf(NOTICE, "set remote end to: %s", remote_string);
+        log_printf(NOTICE, "socket[%d] set remote end to: %s", sock->active_sock_->idx_, remote_string);
         free(remote_string);
       }
       break;
@@ -276,9 +280,11 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
 
     r = r->ai_next;
   }
-
   freeaddrinfo(res);
 
+  if(!found)
+    log_printf(WARNING, "no remote address found that fits any of the local address families");
+
   return 0;
 }
 
@@ -308,7 +314,7 @@ void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote)
       sock->active_sock_->remote_end_.len_ = remote->len_;
       sock->active_sock_->remote_end_set_ = 1;
       char* addrstring = udp_endpoint_to_string(remote);
-      log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
+      log_printf(NOTICE, "socket[%d] autodetected remote host changed %s", sock->active_sock_->idx_, addrstring);
       free(addrstring);
     }
   }
diff --git a/src/udp.h b/src/udp.h
index 5b74c2d..355a761 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -48,6 +48,7 @@ typedef struct {
 
 struct udp_socket_struct {
   int fd_;
+  unsigned int idx_;
   udp_endpoint_t local_end_;
   udp_endpoint_t remote_end_;
   int remote_end_set_;
-- 
cgit v1.2.3


From 21aff5c02627d3b135fbd3e70dbdee3f464b863b Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 22:43:12 +0000
Subject: added rail for remote resolving

---
 src/udp.c | 63 ++++++++++++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 44 insertions(+), 19 deletions(-)

diff --git a/src/udp.c b/src/udp.c
index 1ba63b1..8e638e2 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -224,11 +224,8 @@ int udp_has_remote(udp_t* sock)
   return 0;
 }
 
-int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+static int udp_resolv_remote__(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
-  if(!sock || !remote_addr || !port)
-    return -1;
-
   struct addrinfo hints, *res;
 
   res = NULL;
@@ -254,25 +251,23 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
   int found = 0;
   struct addrinfo* r = res;
   while(r) {
-    if(!sock->active_sock_) {
-      udp_socket_t* s = sock->socks_;
-      while(s) {
-        if(s->local_end_.addr_.ss_family == r->ai_family) {
-          sock->active_sock_ = s;
-          break;
-        }
-        s = s->next_;
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if(s->local_end_.addr_.ss_family == r->ai_family && !(s->remote_end_set_)) {
+        sock->active_sock_ = s;
+        break;
       }
+      s = s->next_;
     }
 
-    if(sock->active_sock_) {
-      memcpy(&(sock->active_sock_->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
-      sock->active_sock_->remote_end_.len_ = r->ai_addrlen;
-      sock->active_sock_->remote_end_set_ = 1;
+    if(s) {
+      memcpy(&(s->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
+      s->remote_end_.len_ = r->ai_addrlen;
+      s->remote_end_set_ = 1;
       found = 1;
-      char* remote_string = udp_endpoint_to_string(&(sock->active_sock_->remote_end_));
+      char* remote_string = udp_endpoint_to_string(&(s->remote_end_));
       if(remote_string) {
-        log_printf(NOTICE, "socket[%d] set remote end to: %s", sock->active_sock_->idx_, remote_string);
+        log_printf(NOTICE, "socket[%d] set remote end to: %s", s->idx_, remote_string);
         free(remote_string);
       }
       break;
@@ -283,7 +278,37 @@ int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, re
   freeaddrinfo(res);
 
   if(!found)
-    log_printf(WARNING, "no remote address found that fits any of the local address families");
+    log_printf(WARNING, "no remote address for '%s' found that fits any of the local address families", remote_addr);
+
+  return 0;
+}
+
+int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+{
+  if(!sock || !remote_addr || !port)
+    return -1;
+
+  const char* colon = strchr(port, ':');
+  if(!colon) {
+    return udp_resolv_remote__(sock, remote_addr, port, resolv_type);
+  } else {
+    if(!sock->rail_mode_)
+      log_printf(WARNING, "A port range has been defined - enabling RAIL mode");
+    sock->rail_mode_ = 1;
+
+    u_int32_t port_num, port_end;
+    if(udp_split_port_range(port, colon, &port_num, &port_end))
+      return -1;
+    do {
+      char port_str[10];
+      snprintf(port_str, sizeof(port_str), "%d", port_num);
+      int ret = udp_resolv_remote__(sock, remote_addr, port_str, resolv_type);
+      if(ret)
+        return ret;
+
+      port_num++;
+    } while(port_num <= port_end);
+  }
 
   return 0;
 }
-- 
cgit v1.2.3


From 620de3643bedc3704708e21b2a4de3864fcc2f13 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 22:51:04 +0000
Subject: removed debug output

---
 src/udp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/udp.c b/src/udp.c
index 8e638e2..1257b07 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -417,7 +417,6 @@ static int udp_write_rail(udp_t* sock, u_int8_t* buf, u_int32_t len)
     s = s->next_;
   }
 
-  log_printf(DEBUG, "sent %d Bytes to %d sockets", len, i);
   return len;
 }
 
-- 
cgit v1.2.3


From 11bf4cad5161328ace3da83554ca93c6e9d16892 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 23:09:40 +0000
Subject: clearing sequence window when receiving SIGHUP

---
 src/sig_handler.c |  2 +-
 src/uanytun.c     | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/sig_handler.c b/src/sig_handler.c
index c596339..69b96e3 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -129,7 +129,7 @@ int signal_handle()
       case SIGINT: log_printf(NOTICE, "SIG-Int caught, exitting"); return_value = 1; break;
       case SIGQUIT: log_printf(NOTICE, "SIG-Quit caught, exitting"); return_value = 1; break;
       case SIGTERM: log_printf(NOTICE, "SIG-Term caught, exitting"); return_value = 1; break;
-      case SIGHUP: log_printf(NOTICE, "SIG-Hup caught"); break;
+      case SIGHUP: log_printf(NOTICE, "SIG-Hup caught"); return_value = 2; break;
       case SIGUSR1: log_printf(NOTICE, "SIG-Usr1 caught"); break;
       case SIGUSR2: log_printf(NOTICE, "SIG-Usr2 caught"); break;
       default: log_printf(WARNING, "unknown signal %d caught, ignoring", sig); break;
diff --git a/src/uanytun.c b/src/uanytun.c
index 75d21ce..bb573d7 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -248,10 +248,16 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
       continue;
 
     if(FD_ISSET(sig_fd, &readyfds)) {
-      if(signal_handle()) {
-        return_value = 1;
+      return_value = signal_handle();
+      if(return_value == 1)
         break;
+      else if(return_value == 2) {
+        seq_win_clear(&seq_win);
+        log_printf(NOTICE, "sequence window cleared");
+        return_value = 0;
       }
+      else
+        return_value = 0;
     }
 
     if(FD_ISSET(dev->fd_, &readyfds)) {
-- 
cgit v1.2.3


From b42ea191d55a7a98c7ba0373d92eaea663b5d350 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 13 Feb 2014 23:50:34 +0000
Subject: renamed udp fd_set function

---
 src/uanytun.c | 2 +-
 src/udp.c     | 2 +-
 src/udp.h     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index bb573d7..3f21cfa 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -225,7 +225,7 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
 
   FD_ZERO(&readfds);
   FD_SET(dev->fd_, &readfds);
-  int nfds = udp_init_fd_set(sock, &readfds);
+  int nfds = udp_fill_fd_set(sock, &readfds);
   nfds = dev->fd_ > nfds ? dev->fd_ : nfds;
 
   int return_value = 0;
diff --git a/src/udp.c b/src/udp.c
index 1257b07..a556923 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -195,7 +195,7 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   return 0;
 }
 
-int udp_init_fd_set(udp_t* sock, fd_set* set)
+int udp_fill_fd_set(udp_t* sock, fd_set* set)
 {
   int max_fd = 0;
 
diff --git a/src/udp.h b/src/udp.h
index 355a761..3e81650 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -64,7 +64,7 @@ struct udp_struct {
 typedef struct udp_struct udp_t;
 
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, int rail_mode);
-int udp_init_fd_set(udp_t* sock, fd_set* set);
+int udp_fill_fd_set(udp_t* sock, fd_set* set);
 int udp_has_remote(udp_t* sock);
 int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
 void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote);
-- 
cgit v1.2.3


From 804b774416f86f358897345f1d15674ff46d7acf Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Wed, 19 Feb 2014 22:42:18 +0000
Subject: also resetting seq_nr on HUP signal

---
 src/uanytun.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/uanytun.c b/src/uanytun.c
index 3f21cfa..392c055 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -253,6 +253,7 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
         break;
       else if(return_value == 2) {
         seq_win_clear(&seq_win);
+        seq_nr = 0;
         log_printf(NOTICE, "sequence window cleared");
         return_value = 0;
       }
-- 
cgit v1.2.3


From b658bf6d9e91dad82d52add72ba998b1e65bb8ea Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Wed, 19 Feb 2014 23:02:24 +0000
Subject: fixed remote end auto detection

---
 src/udp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/udp.c b/src/udp.c
index a556923..f336c6e 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -318,7 +318,7 @@ void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote)
   if(!sock)
     return;
 
-  if(!(sock->active_sock_) || sock->active_sock_->fd_ == fd) {
+  if(!(sock->active_sock_) || sock->active_sock_->fd_ != fd) {
     udp_socket_t* s = sock->socks_;
     while(s) {
       if(s->fd_ == fd) {
-- 
cgit v1.2.3


From 963cfb6b627555c85e3f4cc871b2d9058075858f Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Wed, 19 Feb 2014 23:10:41 +0000
Subject: disable replay attack warning when in rail mode

---
 src/uanytun.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/uanytun.c b/src/uanytun.c
index 392c055..3453a38 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -176,7 +176,8 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
 
   int result = seq_win_check_and_add(seq_win, encrypted_packet_get_sender_id(encrypted_packet), encrypted_packet_get_seq_nr(encrypted_packet));
   if(result > 0) {
-    log_printf(WARNING, "detected replay attack, discarding packet");
+    if(!(sock->rail_mode_))
+      log_printf(WARNING, "detected replay attack, discarding packet");
     return 0;
   } else if(result < 0) {
     log_printf(ERROR, "memory error at sequence window");
-- 
cgit v1.2.3


From dc9f51920869354c1a4735e039657cd7edae19aa Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Thu, 20 Feb 2014 00:25:53 +0000
Subject: making seq_win_clear reacallable

---
 src/seq_window.c | 4 +++-
 src/seq_window.h | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/seq_window.c b/src/seq_window.c
index 5adf5b3..55be299 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -67,9 +67,11 @@ void seq_win_clear(seq_win_t* win)
 
     free(to_free);
   }
+
+  win->first_ = NULL;
 }
 
-seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size)
+static seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size)
 {
   if(!size)
     return NULL;
diff --git a/src/seq_window.h b/src/seq_window.h
index 3a5478e..51bb1eb 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -53,7 +53,6 @@ typedef struct seq_win_struct seq_win_t;
 
 int seq_win_init(seq_win_t* win, window_size_t size);
 void seq_win_clear(seq_win_t* win);
-seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size);
 int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr);
 
 void seq_win_print(seq_win_t* win);
-- 
cgit v1.2.3


From c1ce4524b4fb143edf770ed09aba0b057e16aa65 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 24 Feb 2014 17:07:11 +0000
Subject: added examples for rail mode

---
 doc/uanytun.8     | 27 +++++++++++++++++++++++++--
 doc/uanytun.8.txt | 17 +++++++++++++++++
 2 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/doc/uanytun.8 b/doc/uanytun.8
index c02198a..fe7855f 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -2,12 +2,12 @@
 .\"     Title: uanytun
 .\"    Author: [see the "AUTHORS" section]
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 02/10/2014
+.\"      Date: 02/24/2014
 .\"    Manual: \ \&
 .\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "UANYTUN" "8" "02/10/2014" "\ \&" "\ \&"
+.TH "UANYTUN" "8" "02/24/2014" "\ \&" "\ \&"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -435,6 +435,29 @@ uanytun \-r anycast\&.anytun\&.org \-d anytun0 \-t tun \-n 192\&.0\&.2\&.2/30 \-
 .sp
 As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for this purpose\&. You have to use \fBAnytun\fR for that job\&.
 .RE
+.SS "Rail Setup for 3 links:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBClient:\fR
+.RS 4
+.sp
+uanytun \-t tun \-n 192\&.168\&.42\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E rail_MODE_is_VERY_cool \-e client \-w 64 \-Y \-r rail\&.example\&.com \-o 4440:4442
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBServer:\fR
+.RS 4
+.sp
+uanytun \-t tun \-n 192\&.168\&.42\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E rail_MODE_is_VERY_cool \-e server \-w 64 \-Y \-p 4440:4442
+.RE
 .SH "BUGS"
 .sp
 Most likely there are some bugs in \fBuAnytun\fR\&. If you find a bug, please let the developers know at uanytun@anytun\&.org\&. Of course, patches are preferred\&.
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 2a47318..a3af139 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -290,6 +290,7 @@ Host B:
 uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e right
 
+
 One unicast and one anycast tunnel endpoint:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -304,8 +305,24 @@ As *uAnytun* can't work as an anycast endpoint it can't be used for this purpose
 have to use *Anytun* for that job.
 
 
+Rail Setup for 3 links:
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Client:
+^^^^^^^
+
+uanytun -t tun -n 192.168.42.2/30 -c aes-ctr-256 -k aes-ctr-256 -E rail_MODE_is_VERY_cool
+        -e client -w 64 -Y -r rail.example.com -o 4440:4442
+
+Server:
+^^^^^^^
+uanytun -t tun -n 192.168.42.1/30 -c aes-ctr-256 -k aes-ctr-256 -E rail_MODE_is_VERY_cool
+        -e server -w 64 -Y -p 4440:4442
+
+
 BUGS
 ----
+
 Most likely there are some bugs in *uAnytun*. If you find a bug, please let
 the developers know at uanytun@anytun.org. Of course, patches are preferred.
 
-- 
cgit v1.2.3


From 39431a7787dc7b709f7a7f88bad521db2562d2f5 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 24 Feb 2014 17:25:22 +0000
Subject: updated examples for rail mode

---
 doc/uanytun.8                  |  2 +-
 doc/uanytun.8.txt              |  2 +-
 etc/uanytun/rail-client/config | 91 ++++++++++++++++++++++++++++++++++++++++++
 etc/uanytun/rail-server/config | 91 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 184 insertions(+), 2 deletions(-)
 create mode 100644 etc/uanytun/rail-client/config
 create mode 100644 etc/uanytun/rail-server/config

diff --git a/doc/uanytun.8 b/doc/uanytun.8
index fe7855f..615be1e 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -445,7 +445,7 @@ As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for th
 \fBClient:\fR
 .RS 4
 .sp
-uanytun \-t tun \-n 192\&.168\&.42\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E rail_MODE_is_VERY_cool \-e client \-w 64 \-Y \-r rail\&.example\&.com \-o 4440:4442
+uanytun \-t tun \-n 192\&.168\&.42\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E rail_MODE_is_VERY_cool \-e client \-w 64 \-Y \-p 1233:1235 \-r rail\&.example\&.com \-o 4440:4442
 .RE
 .sp
 .it 1 an-trap
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index a3af139..5a507ca 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -312,7 +312,7 @@ Client:
 ^^^^^^^
 
 uanytun -t tun -n 192.168.42.2/30 -c aes-ctr-256 -k aes-ctr-256 -E rail_MODE_is_VERY_cool
-        -e client -w 64 -Y -r rail.example.com -o 4440:4442
+        -e client -w 64 -Y -p 1233:1235 -r rail.example.com -o 4440:4442
 
 Server:
 ^^^^^^^
diff --git a/etc/uanytun/rail-client/config b/etc/uanytun/rail-client/config
new file mode 100644
index 0000000..3671eee
--- /dev/null
+++ b/etc/uanytun/rail-client/config
@@ -0,0 +1,91 @@
+#############################
+## Main options             #
+#############################
+
+role client
+
+## device type tun = ip/ipv6, tap = ethernet
+type tun
+
+## Automaticaly configure the interface
+## the address hast to be supplied in CIDR notation
+ifconfig 192.168.42.2/30
+
+## payload encryption algorithm
+#cipher null
+#cipher aes-ctr-128
+#cipher aes-ctr-192
+#cipher aes-ctr-256
+cipher aes-ctr
+
+## message authentication algorithm
+#auth-algo null
+auth-algo sha1
+
+##message auth tag length
+#auth-tag-length 10
+
+## Passphrase
+## this is used to generate the crypto-key and salt
+## this should be al least 30 characters
+passphrase RAID_is_nice_but_RAIL_is_cooler
+
+## local ip address to bind to (for tunnel data)
+## (if you run an anycast cluster this has to be the anycast ip address)
+#interface <ip-address>
+
+## local port to bind to (for tunnel data)
+## the number of ports here must be at least as high as the number of
+## remote ports - so in this case up to 5 links may be used
+port 8880:8884
+
+## The remote host and port (for RAIL a port range is needed)
+remote-host rail.example.com
+remote-port 8880:8884
+
+## enable RAIL mode
+rail-mode
+
+#############################
+## Debug options            #
+#############################
+
+## don't run in background
+#nodaemonize
+
+## additional log to standard output with a level of 5
+#log stdout:5
+
+
+#############################
+## Expert options           #
+#############################
+
+## log to syslog with a level of 3
+log syslog:3,uanytun-rail-client,daemon
+
+## change user and group after init
+#username uanytun
+#groupname uanytun
+
+## chroot to users home directory
+#chroot /var/run/uanytun
+
+## key derivation pseudo random function
+#kd-prf null
+#kd-prf aes-ctr
+#kd-prf aes-ctr-128
+#kd-prf aes-ctr-192
+#kd-prf aes-ctr-256
+
+## Device name
+dev rail0
+
+## Manually set encryption key and salt
+## (this replaces the passphrase)
+#key 0123456789ABCDEF0123456789ABCDEF
+#salt 0123456789ABCD0123456789ABCD
+
+## Setting a window size > 0 will enable replay protection
+## This is needed for RAIL to work
+window-size 100
diff --git a/etc/uanytun/rail-server/config b/etc/uanytun/rail-server/config
new file mode 100644
index 0000000..0f34557
--- /dev/null
+++ b/etc/uanytun/rail-server/config
@@ -0,0 +1,91 @@
+#############################
+## Main options             #
+#############################
+
+role server
+
+## device type tun = ip/ipv6, tap = ethernet
+type tun
+
+## Automaticaly configure the interface
+## the address hast to be supplied in CIDR notation
+ifconfig 192.168.42.1/30
+
+## payload encryption algorithm
+#cipher null
+#cipher aes-ctr-128
+#cipher aes-ctr-192
+#cipher aes-ctr-256
+cipher aes-ctr
+
+## message authentication algorithm
+#auth-algo null
+auth-algo sha1
+
+##message auth tag length
+#auth-tag-length 10
+
+## Passphrase
+## this is used to generate the crypto-key and salt
+## this should be al least 30 characters
+passphrase RAID_is_nice_but_RAIL_is_cooler
+
+## local ip address to bind to (for tunnel data)
+## (if you run an anycast cluster this has to be the anycast ip address)
+#interface <ip-address>
+
+## local port to bind to (for tunnel data)
+## the number of ports here must be at least as high as the number of
+## remote ports defined at the client configuration (in this case 5)
+port 8880:8884
+
+## The remote host and port will be learned from the first messages
+#remote-host client.unknown
+#remote-port 8880:8884
+
+## enable RAIL mode
+rail-mode
+
+#############################
+## Debug options            #
+#############################
+
+## don't run in background
+#nodaemonize
+
+## additional log to standard output with a level of 5
+#log stdout:5
+
+
+#############################
+## Expert options           #
+#############################
+
+## log to syslog with a level of 3
+log syslog:3,uanytun-rail-server,daemon
+
+## change user and group after init
+#username uanytun
+#groupname uanytun
+
+## chroot to users home directory
+#chroot /var/run/uanytun
+
+## key derivation pseudo random function
+#kd-prf null
+#kd-prf aes-ctr
+#kd-prf aes-ctr-128
+#kd-prf aes-ctr-192
+#kd-prf aes-ctr-256
+
+## Device name
+dev rail0
+
+## Manually set encryption key and salt
+## (this replaces the passphrase)
+#key 0123456789ABCDEF0123456789ABCDEF
+#salt 0123456789ABCD0123456789ABCD
+
+## Setting a window size > 0 will enable replay protection
+## This is needed for RAIL to work
+window-size 100
-- 
cgit v1.2.3


From 467411e19534438c9cf7a4c01395ec3494d9d2d0 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Mon, 24 Feb 2014 17:37:50 +0000
Subject: added configure switch for default libgcrypt fixed unused variable
 warning

---
 src/configure | 4 ++++
 src/options.c | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/src/configure b/src/configure
index 90a5739..542b4b4 100755
--- a/src/configure
+++ b/src/configure
@@ -60,6 +60,7 @@ print_usage() {
   echo "          --no-manpage              dont't install manpage"
   echo "          --examplesdir=<DIR>       the path to the examples files (default: $PREFIX/share/examples)"
   echo "          --no-examples             dont't install example files"
+  echo "          --use-gcrypt              use libgcrypt (this is the default)"
   echo "          --use-ssl-crypto          use ssl crypto library instead of libgcrypt"
   echo "          --no-crypto               disable crypto at all (only NULL cipher)"
   echo "          --disable-passphrase      disable master key and salt passphrase"
@@ -97,6 +98,9 @@ do
   --no-examples)
     INSTALLEXAMPLES=0
   ;;
+  --use-gcrypt)
+    CRYPTO_LIB='gcrypt'
+  ;;
   --use-ssl-crypto)
     CRYPTO_LIB='ssl'
   ;;
diff --git a/src/options.c b/src/options.c
index 240a286..4b5df26 100644
--- a/src/options.c
+++ b/src/options.c
@@ -224,7 +224,9 @@ int options_parse(options_t* opt, int argc, char* argv[])
 
   argc--;
 
+#ifndef NO_CRYPT
   char* role = NULL;
+#endif
   int i, ipv4_only = 0, ipv6_only = 0;
   for(i=1; argc > 0; ++i)
   {
-- 
cgit v1.2.3


From 879487e049987cfcad564bf421b97145b130c1c6 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 8 Jun 2014 18:56:10 +0000
Subject: merged changelog from trunk

---
 ChangeLog | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index ba6fa1c..4022f95 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,11 @@
 
 * added RAIL mode
 
+2014.06.08 -- Version 0.3.5
+
+* fixed build issues for clang
+* refactored the multi socket support
+
 2010.02.16 -- Version 0.3.3
 
 * added -v|--version option
-- 
cgit v1.2.3


From d201613b477106ba85e32845542d5f73163fe5d5 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 29 Jun 2014 15:53:21 +0000
Subject: merged trunk changes to rail branch

---
 ChangeLog              |   7 ++-
 LICENSE                |  18 +++++++-
 README                 |  14 ++++--
 doc/Makefile           |  15 +++++-
 src/Makefile           |  15 +++++-
 src/auth_algo.c        |  77 +++++++++++++++++++++----------
 src/auth_algo.h        |  31 ++++++++++---
 src/bsd/tun.c          |  15 +++++-
 src/cipher.c           |  62 +++++++++++++++++++------
 src/cipher.h           |  31 ++++++++++---
 src/configure          |  29 ++++++++++--
 src/daemon.h           |  15 +++++-
 src/datatypes.h        |  15 +++++-
 src/encrypted_packet.c |  15 +++++-
 src/encrypted_packet.h |  15 +++++-
 src/init_crypt.h       |  41 +++++++++++++----
 src/key_derivation.c   | 122 +++++++++++++++++++++++++++++++++----------------
 src/key_derivation.h   |  31 ++++++++++---
 src/linux/tun.c        |  15 +++++-
 src/log.c              |  15 +++++-
 src/log.h              |  15 +++++-
 src/log_targets.h      |  15 +++++-
 src/options.c          |  15 +++++-
 src/options.h          |  15 +++++-
 src/plain_packet.c     |  15 +++++-
 src/plain_packet.h     |  15 +++++-
 src/seq_window.c       |  17 ++++++-
 src/seq_window.h       |  15 +++++-
 src/sig_handler.c      |  15 +++++-
 src/sig_handler.h      |  15 +++++-
 src/string_list.c      |  15 +++++-
 src/string_list.h      |  15 +++++-
 src/sysexec.c          |  15 +++++-
 src/sysexec.h          |  15 +++++-
 src/tun.h              |  15 +++++-
 src/tun_helper.h       |  15 +++++-
 src/uanytun.c          |  15 +++++-
 src/udp.c              |  15 +++++-
 src/udp.h              |  15 +++++-
 39 files changed, 738 insertions(+), 147 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 4022f95..18ad3b8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,7 +2,12 @@
 
 * added RAIL mode
 
-2014.06.08 -- Version 0.3.5
+2014.06.21 -- Version 0.3.5
+
+* added support for libnettle as crypt library
+* added an exception to the license which allows linking with OpenSSL
+
+2014.06.08 -- Version 0.3.4
 
 * fixed build issues for clang
 * refactored the multi socket support
diff --git a/LICENSE b/LICENSE
index caee980..8146513 100644
--- a/LICENSE
+++ b/LICENSE
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,7 +31,23 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ *
  */
+
+
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
diff --git a/README b/README
index 10c3b10..e2e0d75 100644
--- a/README
+++ b/README
@@ -1,8 +1,8 @@
 Dependencies
 ============
 
-uAnytun can be built by using either libgcrypt or the openssl-crypto library.
-The latter is more performant in most cases but there are some license
+uAnytun can be built by using either libgcrypt, libnettle or the openssl-crypto
+library. The latter is more performant in most cases but there are some license
 issues when using this library. It also needs more space when installed.
 
 
@@ -20,7 +20,13 @@ using ssl crypto library:
  build-essential
  libssl-dev
 
+using nettle crypto library:
+
+ build-essential
+ nettle-dev
+
 if you want clang as compiler
+
  clang
 
 if you want to rebuild the manpage:
@@ -56,10 +62,9 @@ Installation
 Getting the source via subversion:
 ----------------------------------
 
-svn co https://svn.anytun.org/uanytun/trunk uanytun
+svn co http://svn.anytun.org/uanytun/trunk uanytun
 cd uanytun
 
-
 Building from source
 --------------------
 
@@ -75,6 +80,7 @@ using ssl crypto library:
 # ./configure --use-ssl-crypto
 # make
 
+
 Notes:
   - try './configure --help' for further information
   - if using openssl pre 0.9.8 you have to disable passphrase
diff --git a/doc/Makefile b/doc/Makefile
index 3a1a672..1e4b315 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -10,7 +10,7 @@
 ##  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 ##  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 ##  ethernet, ip, arp ...). satp directly includes cryptography and
-##  message authentication based on the methodes used by SRTP.  It is
+##  message authentication based on the methods used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
 ##
@@ -32,6 +32,19 @@
 ##  You should have received a copy of the GNU General Public License
 ##  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 ##
+##  In addition, as a special exception, the copyright holders give
+##  permission to link the code of portions of this program with the
+##  OpenSSL library under certain conditions as described in each
+##  individual source file, and distribute linked combinations
+##  including the two.
+##  You must obey the GNU General Public License in all respects
+##  for all of the code used other than OpenSSL.  If you modify
+##  file(s) with this exception, you may extend this exception to your
+##  version of the file(s), but you are not obligated to do so.  If you
+##  do not wish to do so, delete this exception statement from your
+##  version.  If you delete this exception statement from all source
+##  files in the program, then also delete it here.
+##
 
 VERSION=$(shell cat ../version)
 
diff --git a/src/Makefile b/src/Makefile
index 6653b60..feccbaa 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -10,7 +10,7 @@
 ##  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 ##  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 ##  ethernet, ip, arp ...). satp directly includes cryptography and
-##  message authentication based on the methodes used by SRTP.  It is
+##  message authentication based on the methods used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
 ##
@@ -32,6 +32,19 @@
 ##  You should have received a copy of the GNU General Public License
 ##  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 ##
+##  In addition, as a special exception, the copyright holders give
+##  permission to link the code of portions of this program with the
+##  OpenSSL library under certain conditions as described in each
+##  individual source file, and distribute linked combinations
+##  including the two.
+##  You must obey the GNU General Public License in all respects
+##  for all of the code used other than OpenSSL.  If you modify
+##  file(s) with this exception, you may extend this exception to your
+##  version of the file(s), but you are not obligated to do so.  If you
+##  do not wish to do so, delete this exception statement from your
+##  version.  If you delete this exception statement from all source
+##  files in the program, then also delete it here.
+##
 
 ifneq ($(MAKECMDGOALS),distclean)
 include include.mk
diff --git a/src/auth_algo.c b/src/auth_algo.c
index db87e7a..ac102c7 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -152,17 +165,19 @@ int auth_algo_sha1_init(auth_algo_t* aa)
   if(!aa->params_)
     return -2;
 
+#if defined(USE_SSL_CRYPTO)
+  auth_algo_sha1_param_t* params = aa->params_;
+  HMAC_CTX_init(&params->ctx_);
+  HMAC_Init_ex(&params->ctx_, NULL, 0, EVP_sha1(), NULL);
+#elif defined(USE_NETTLE)
+  // nothing here
+#else  // USE_GCRYPT is the default
   auth_algo_sha1_param_t* params = aa->params_;
-
-#ifndef USE_SSL_CRYPTO
   gcry_error_t err = gcry_md_open(&params->handle_, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC);
   if(err) {
     log_printf(ERROR, "failed to open message digest algo: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  HMAC_CTX_init(&params->ctx_);
-  HMAC_Init_ex(&params->ctx_, NULL, 0, EVP_sha1(), NULL);
 #endif
 
   return 0;
@@ -174,13 +189,15 @@ void auth_algo_sha1_close(auth_algo_t* aa)
     return;
 
   if(aa->params_) {
+#if defined(USE_SSL_CRYPTO)
+    auth_algo_sha1_param_t* params = aa->params_;
+    HMAC_CTX_cleanup(&params->ctx_);
+#elif defined(USE_NETTLE)
+    // nothing here
+#else  // USE_GCRYPT is the default
     auth_algo_sha1_param_t* params = aa->params_;
-
-#ifndef USE_SSL_CRYPTO
     if(params->handle_)
       gcry_md_close(params->handle_);
-#else
-    HMAC_CTX_cleanup(&params->ctx_);
 #endif
 
     free(aa->params_);
@@ -207,7 +224,19 @@ void auth_algo_sha1_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(ret < 0)
     return;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
+  HMAC_Final(&params->ctx_, hmac, NULL);
+#elif defined(USE_NETTLE)
+  hmac_sha1_set_key(&params->ctx_, aa->key_.length_, aa->key_.buf_);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  hmac_sha1_update(&params->ctx_, encrypted_packet_get_auth_portion_length(packet), encrypted_packet_get_auth_portion(packet));
+  hmac_sha1_digest(&params->ctx_, SHA1_LENGTH, hmac);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_md_setkey(params->handle_, aa->key_.buf_, aa->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
@@ -218,12 +247,6 @@ void auth_algo_sha1_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
   gcry_md_final(params->handle_);
   u_int8_t* hmac = gcry_md_read(params->handle_, 0);
-#else
-  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
-
-  u_int8_t hmac[SHA1_LENGTH];
-  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
-  HMAC_Final(&params->ctx_, hmac, NULL);
 #endif
 
   u_int8_t* tag = encrypted_packet_get_auth_tag(packet);
@@ -255,7 +278,19 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(ret < 0)
     return 0;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
+  HMAC_Final(&params->ctx_, hmac, NULL);
+#elif defined(USE_NETTLE)
+  hmac_sha1_set_key(&params->ctx_, aa->key_.length_, aa->key_.buf_);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  hmac_sha1_update(&params->ctx_, encrypted_packet_get_auth_portion_length(packet), encrypted_packet_get_auth_portion(packet));
+  hmac_sha1_digest(&params->ctx_, SHA1_LENGTH, hmac);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_md_setkey(params->handle_, aa->key_.buf_, aa->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
@@ -266,12 +301,6 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
   gcry_md_final(params->handle_);
   u_int8_t* hmac = gcry_md_read(params->handle_, 0);
-#else
-  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
-
-  u_int8_t hmac[SHA1_LENGTH];
-  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
-  HMAC_Final(&params->ctx_, hmac, NULL);
 #endif
 
   u_int8_t* tag = encrypted_packet_get_auth_tag(packet);
diff --git a/src/auth_algo.h b/src/auth_algo.h
index d911ca8..d1e5178 100644
--- a/src/auth_algo.h
+++ b/src/auth_algo.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,15 +31,30 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_auth_algo_h_INCLUDED
 #define UANYTUN_auth_algo_h_INCLUDED
 
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/hmac.h>
+#elif defined(USE_NETTLE)
+#include <nettle/hmac.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 #include "key_derivation.h"
 #include "encrypted_packet.h"
@@ -66,10 +81,12 @@ int auth_algo_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivation_di
 #define SHA1_LENGTH 20
 
 struct auth_algo_sha1_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_md_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   HMAC_CTX ctx_;
+#elif defined(USE_NETTLE)
+  struct hmac_sha1_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_md_hd_t handle_;
 #endif
 };
 typedef struct auth_algo_sha1_param_struct auth_algo_sha1_param_t;
diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index 734c3d8..a469c58 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/cipher.c b/src/cipher.c
index d6eae57..f87e2cf 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -39,6 +52,9 @@
 #include "encrypted_packet.h"
 
 #include "cipher.h"
+#if defined(USE_NETTLE)
+#include <nettle/ctr.h>
+#endif
 
 #include "log.h"
 
@@ -210,7 +226,11 @@ int cipher_aesctr_init(cipher_t* c)
   if(!c->params_)
     return -2;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  // nothing here
+#elif defined(USE_NETTLE)
+  // nothing here
+#else  // USE_GCRYPT is the default
   int algo;
   switch(c->key_length_) {
   case 128: algo = GCRY_CIPHER_AES128; break;
@@ -239,7 +259,11 @@ void cipher_aesctr_close(cipher_t* c)
     return;
 
   if(c->params_) {
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+    // nothing here
+#elif defined(USE_NETTLE)
+    // nothing here
+#else  // USE_GCRYPT is the default
     cipher_aesctr_param_t* params = c->params_;
     gcry_cipher_close(params->handle_);
 #endif
@@ -285,13 +309,15 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
   if(ret < 0)
     return ret;
 
-#ifdef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
   ret = AES_set_encrypt_key(c->key_.buf_, c->key_length_, &params->aes_key_);
   if(ret) {
-    log_printf(ERROR, "failed to set cipher ssl aes-key (code: %d)", ret);
+    log_printf(ERROR, "failed to set cipher key (code: %d)", ret);
     return -1;
   }
-#else
+#elif defined(USE_NETTLE)
+  aes_set_encrypt_key(&params->ctx_, c->key_.length_, c->key_.buf_);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_cipher_setkey(params->handle_, c->key_.buf_, c->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set cipher key: %s", gcry_strerror(err));
@@ -305,7 +331,21 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
     return ret;
   }
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  u_int32_t num = 0;
+  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
+  AES_ctr128_encrypt(in, out, (ilen < olen) ? ilen : olen, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
+#elif defined(USE_NETTLE)
+  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  ctr_crypt(&params->ctx_, (nettle_crypt_func *)(aes_encrypt), AES_BLOCK_SIZE, params->ctr_.buf_, (ilen < olen) ? ilen : olen, out, in);
+#else  // USE_GCRYPT is the default
   err = gcry_cipher_setctr(params->handle_, params->ctr_.buf_, C_AESCTR_CTR_LENGTH);
   if(err) {
     log_printf(ERROR, "failed to set cipher CTR: %s", gcry_strerror(err));
@@ -317,14 +357,6 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
     log_printf(ERROR, "failed to de/encrypt packet: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
-    log_printf(ERROR, "failed to set cipher CTR: size don't fits");
-    return -1;
-  }
-  u_int32_t num = 0;
-  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
-  AES_ctr128_encrypt(in, out, (ilen < olen) ? ilen : olen, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
 
   return (ilen < olen) ? ilen : olen;
diff --git a/src/cipher.h b/src/cipher.h
index 4582a46..570df8d 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,16 +31,31 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_cipher_h_INCLUDED
 #define UANYTUN_cipher_h_INCLUDED
 
 #ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/aes.h>
+#elif defined(USE_NETTLE)
+#include <nettle/aes.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 #include "key_derivation.h"
 #else
@@ -94,11 +109,13 @@ union __attribute__((__packed__)) cipher_aesctr_ctr_union {
 typedef union cipher_aesctr_ctr_union cipher_aesctr_ctr_t;
 
 struct cipher_aesctr_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_cipher_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   AES_KEY aes_key_;
   u_int8_t ecount_buf_[AES_BLOCK_SIZE];
+#elif defined(USE_NETTLE)
+  struct aes_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_cipher_hd_t handle_;
 #endif
   cipher_aesctr_ctr_t ctr_;
 };
diff --git a/src/configure b/src/configure
index 542b4b4..16d5cc7 100755
--- a/src/configure
+++ b/src/configure
@@ -11,7 +11,7 @@
 #  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 #  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 #  ethernet, ip, arp ...). satp directly includes cryptography and
-#  message authentication based on the methodes used by SRTP.  It is
+#  message authentication based on the methods used by SRTP.  It is
 #  intended to deliver a generic, scaleable and secure solution for
 #  tunneling and relaying of packets of any protocol.
 #
@@ -33,6 +33,19 @@
 #  You should have received a copy of the GNU General Public License
 #  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 #
+#   In addition, as a special exception, the copyright holders give
+#   permission to link the code of portions of this program with the
+#   OpenSSL library under certain conditions as described in each
+#   individual source file, and distribute linked combinations
+#   including the two.
+#   You must obey the GNU General Public License in all respects
+#   for all of the code used other than OpenSSL.  If you modify
+#   file(s) with this exception, you may extend this exception to your
+#   version of the file(s), but you are not obligated to do so.  If you
+#   do not wish to do so, delete this exception statement from your
+#   version.  If you delete this exception statement from all source
+#   files in the program, then also delete it here.
+#
 
 TARGET=`uname -s`
 EBUILD_COMPAT=0
@@ -61,7 +74,8 @@ print_usage() {
   echo "          --examplesdir=<DIR>       the path to the examples files (default: $PREFIX/share/examples)"
   echo "          --no-examples             dont't install example files"
   echo "          --use-gcrypt              use libgcrypt (this is the default)"
-  echo "          --use-ssl-crypto          use ssl crypto library instead of libgcrypt"
+  echo "          --use-nettle              use libnettle instead of libgcrypt"
+  echo "          --use-ssl-crypto          use openssl crypto library instead of libgcrypt"
   echo "          --no-crypto               disable crypto at all (only NULL cipher)"
   echo "          --disable-passphrase      disable master key and salt passphrase"
   echo "          --enable-passphrase       enable master key and salt passphrase"
@@ -101,6 +115,9 @@ do
   --use-gcrypt)
     CRYPTO_LIB='gcrypt'
   ;;
+  --use-nettle)
+    CRYPTO_LIB='nettle'
+  ;;
   --use-ssl-crypto)
     CRYPTO_LIB='ssl'
   ;;
@@ -169,8 +186,14 @@ esac
 
 case $CRYPTO_LIB in
   gcrypt)
+    CFLAGS=$CFLAGS' -DUSE_GCRYPT'
     LDFLAGS=$LDFLAGS' -lgcrypt'
-    echo "using libgcrypt library"
+    echo "using gcrypt library"
+  ;;
+  nettle)
+    CFLAGS=$CFLAGS' -DUSE_NETTLE'
+    LDFLAGS=$LDFLAGS' -lnettle'
+    echo "using nettle library"
   ;;
   ssl)
     CFLAGS=$CFLAGS' -DUSE_SSL_CRYPTO'
diff --git a/src/daemon.h b/src/daemon.h
index 05fa83e..9a477a7 100644
--- a/src/daemon.h
+++ b/src/daemon.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_daemon_h_INCLUDED
diff --git a/src/datatypes.h b/src/datatypes.h
index a374022..58434c8 100644
--- a/src/datatypes.h
+++ b/src/datatypes.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_datatypes_h_INCLUDED
diff --git a/src/encrypted_packet.c b/src/encrypted_packet.c
index 801d8e6..2d46f40 100644
--- a/src/encrypted_packet.c
+++ b/src/encrypted_packet.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/encrypted_packet.h b/src/encrypted_packet.h
index fcd16ab..3f66f12 100644
--- a/src/encrypted_packet.h
+++ b/src/encrypted_packet.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_encrypted_packet_h_INCLUDED
diff --git a/src/init_crypt.h b/src/init_crypt.h
index 848f9d7..b0c6a49 100644
--- a/src/init_crypt.h
+++ b/src/init_crypt.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_init_crypt_h_INCLUDED
@@ -48,7 +61,23 @@ int init_crypt()
 #else
 
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+
+int init_crypt()
+{
+// nothing here
+  return 0;
+}
+
+#elif defined(USE_NETTLE)
+
+int init_crypt()
+{
+// nothing here
+  return 0;
+}
+
+#else  // USE_GCRYPT is the default
 
 #include <gcrypt.h>
 
@@ -77,14 +106,6 @@ int init_crypt()
   return 0;
 }
 
-#else
-
-int init_crypt()
-{
-// nothing here
-  return 0;
-}
-
 #endif
 
 
diff --git a/src/key_derivation.c b/src/key_derivation.c
index a9c4f6d..f2d8548 100644
--- a/src/key_derivation.c
+++ b/src/key_derivation.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,14 +31,31 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
 
 #include "key_derivation.h"
 
-#ifdef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/sha.h>
+#elif defined(USE_NETTLE)
+#include <nettle/sha1.h>
+#include <nettle/sha2.h>
+#include <nettle/ctr.h>
 #endif
 
 #include "log.h"
@@ -135,30 +152,39 @@ int key_derivation_generate_master_key(key_derivation_t* kd, const char* passphr
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
-  if(key_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA256) * 8)) {
-#else
+#if defined(USE_SSL_CRYPTO)
   if(key_length > (SHA256_DIGEST_LENGTH * 8)) {
+#elif defined(USE_NETTLE)
+  if(key_length > (SHA256_DIGEST_SIZE * 8)) {
+#else  // USE_GCRYPT is the default
+  if(key_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA256) * 8)) {
 #endif
     log_printf(ERROR, "master key too long for passphrase algorithm");
     return -1;
   }
 
   buffer_t digest;
-#ifndef USE_SSL_CRYPTO
-  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA256);
-#else
+#if defined(USE_SSL_CRYPTO)
   digest.length_ = SHA256_DIGEST_LENGTH;
+#elif defined(USE_NETTLE)
+  digest.length_ = SHA256_DIGEST_SIZE;
+#else  // USE_GCRYPT is the default
+  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA256);
 #endif
   digest.buf_ = malloc(digest.length_);
   if(!digest.buf_)
     return -2;
 
 
-#ifndef USE_SSL_CRYPTO
-  gcry_md_hash_buffer(GCRY_MD_SHA256, digest.buf_, passphrase, strlen(passphrase));
-#else
+#if defined(USE_SSL_CRYPTO)
   SHA256((const u_int8_t*)passphrase, strlen(passphrase), digest.buf_);
+#elif defined(USE_NETTLE)
+  struct sha256_ctx ctx;
+  sha256_init(&ctx);
+  sha256_update(&ctx, strlen(passphrase), (const u_int8_t*)passphrase);
+  sha256_digest(&ctx, digest.length_, digest.buf_);
+#else  // USE_GCRYPT is the default
+  gcry_md_hash_buffer(GCRY_MD_SHA256, digest.buf_, passphrase, strlen(passphrase));
 #endif
 
   kd->master_key_.length_ = key_length/8;
@@ -191,29 +217,38 @@ int key_derivation_generate_master_salt(key_derivation_t* kd, const char* passph
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
-  if(salt_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA1) * 8)) {
-#else
+#if defined(USE_SSL_CRYPTO)
   if(salt_length > (SHA_DIGEST_LENGTH * 8)) {
+#elif defined(USE_NETTLE)
+  if(salt_length > (SHA1_DIGEST_SIZE * 8)) {
+#else  // USE_GCRYPT is the default
+  if(salt_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA1) * 8)) {
 #endif
     log_printf(ERROR, "master salt too long for passphrase algorithm");
     return -1;
   }
 
   buffer_t digest;
-#ifndef USE_SSL_CRYPTO
-  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA1);
-#else
+#if defined(USE_SSL_CRYPTO)
   digest.length_ = SHA_DIGEST_LENGTH;
+#elif defined(USE_NETTLE)
+  digest.length_ = SHA1_DIGEST_SIZE;
+#else  // USE_GCRYPT is the default
+  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA1);
 #endif
   digest.buf_ = malloc(digest.length_);
   if(!digest.buf_)
     return -2;
 
-#ifndef USE_SSL_CRYPTO
-  gcry_md_hash_buffer(GCRY_MD_SHA1, digest.buf_, passphrase, strlen(passphrase));
-#else
+#if defined(USE_SSL_CRYPTO)
   SHA1((const u_int8_t*)passphrase, strlen(passphrase), digest.buf_);
+#elif defined(USE_NETTLE)
+  struct sha1_ctx ctx;
+  sha1_init(&ctx);
+  sha1_update(&ctx, strlen(passphrase), (const u_int8_t*)passphrase);
+  sha1_digest(&ctx, digest.length_, digest.buf_);
+#else  // USE_GCRYPT is the default
+  gcry_md_hash_buffer(GCRY_MD_SHA1, digest.buf_, passphrase, strlen(passphrase));
 #endif
 
   kd->master_salt_.length_ = salt_length/8;
@@ -330,7 +365,7 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
     return -2;
 
   key_derivation_aesctr_param_t* params = kd->params_;
-#ifndef USE_SSL_CRYPTO
+#ifdef USE_GCRYPT
   params->handle_ = 0;
 #endif
 
@@ -345,7 +380,15 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
   }
 #endif
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  int ret = AES_set_encrypt_key(kd->master_key_.buf_, kd->master_key_.length_*8, &params->aes_key_);
+  if(ret) {
+    log_printf(ERROR, "failed to set key derivation ssl aes-key (code: %d)", ret);
+    return -1;
+  }
+#elif defined(USE_NETTLE)
+  aes_set_encrypt_key(&params->ctx_, kd->master_key_.length_, kd->master_key_.buf_);
+#else  // USE_GCRYPT is the default
   int algo;
   switch(kd->key_length_) {
   case 128: algo = GCRY_CIPHER_AES128; break;
@@ -368,12 +411,6 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
     log_printf(ERROR, "failed to set key derivation key: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  int ret = AES_set_encrypt_key(kd->master_key_.buf_, kd->master_key_.length_*8, &params->aes_key_);
-  if(ret) {
-    log_printf(ERROR, "failed to set key derivation ssl aes-key (code: %d)", ret);
-    return -1;
-  }
 #endif
 
   return 0;
@@ -385,7 +422,7 @@ void key_derivation_aesctr_close(key_derivation_t* kd)
     return;
 
   if(kd->params_) {
-#ifndef USE_SSL_CRYPTO
+#ifdef USE_GCRYPT
     key_derivation_aesctr_param_t* params = kd->params_;
     if(params->handle_)
       gcry_cipher_close(params->handle_);
@@ -428,7 +465,23 @@ int key_derivation_aesctr_generate(key_derivation_t* kd, key_derivation_dir_t di
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set key derivation CTR: size don't fits");
+    return -1;
+  }
+  u_int32_t num = 0;
+  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
+  memset(key, 0, len);
+  AES_ctr128_encrypt(key, key, len, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
+#elif defined(USE_NETTLE)
+  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  memset(key, 0, len);
+  ctr_crypt(&params->ctx_, (nettle_crypt_func *)(aes_encrypt), AES_BLOCK_SIZE, params->ctr_.buf_, len, key, key);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_cipher_reset(params->handle_);
   if(err) {
     log_printf(ERROR, "failed to reset key derivation cipher: %s", gcry_strerror(err));
@@ -447,15 +500,6 @@ int key_derivation_aesctr_generate(key_derivation_t* kd, key_derivation_dir_t di
     log_printf(ERROR, "failed to generate key derivation bitstream: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
-    log_printf(ERROR, "failed to set key derivation CTR: size don't fits");
-    return -1;
-  }
-  u_int32_t num = 0;
-  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
-  memset(key, 0, len);
-  AES_ctr128_encrypt(key, key, len, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
 
   return 0;
diff --git a/src/key_derivation.h b/src/key_derivation.h
index 5268faf..0f0942e 100644
--- a/src/key_derivation.h
+++ b/src/key_derivation.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,15 +31,30 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_key_derivation_h_INCLUDED
 #define UANYTUN_key_derivation_h_INCLUDED
 
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/aes.h>
+#elif defined(USE_NETTLE)
+#include <nettle/aes.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 
 #include "options.h"
@@ -103,11 +118,13 @@ union __attribute__((__packed__)) key_derivation_aesctr_ctr_union {
 typedef union key_derivation_aesctr_ctr_union key_derivation_aesctr_ctr_t;
 
 struct key_derivation_aesctr_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_cipher_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   AES_KEY aes_key_;
   u_int8_t ecount_buf_[AES_BLOCK_SIZE];
+#elif defined(USE_NETTLE)
+  struct aes_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_cipher_hd_t handle_;
 #endif
   key_derivation_aesctr_ctr_t ctr_;
 };
diff --git a/src/linux/tun.c b/src/linux/tun.c
index acd823e..c77cea1 100644
--- a/src/linux/tun.c
+++ b/src/linux/tun.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #define _GNU_SOURCE
diff --git a/src/log.c b/src/log.c
index 5659d3a..b094d49 100644
--- a/src/log.c
+++ b/src/log.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/log.h b/src/log.h
index a87286d..9f89b4c 100644
--- a/src/log.h
+++ b/src/log.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_log_h_INCLUDED
diff --git a/src/log_targets.h b/src/log_targets.h
index babe1d1..a0a774b 100644
--- a/src/log_targets.h
+++ b/src/log_targets.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_log_targets_h_INCLUDED
diff --git a/src/options.c b/src/options.c
index 4b5df26..f12eb1b 100644
--- a/src/options.c
+++ b/src/options.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/options.h b/src/options.h
index 05f1c21..fa4d554 100644
--- a/src/options.h
+++ b/src/options.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_options_h_INCLUDED
diff --git a/src/plain_packet.c b/src/plain_packet.c
index 53bddb9..868ebd8 100644
--- a/src/plain_packet.c
+++ b/src/plain_packet.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/plain_packet.h b/src/plain_packet.h
index 54c0f8d..5b79c39 100644
--- a/src/plain_packet.h
+++ b/src/plain_packet.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_plain_packet_h_INCLUDED
diff --git a/src/seq_window.c b/src/seq_window.c
index 55be299..2d225a4 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -201,7 +214,7 @@ void seq_win_print(seq_win_t* win)
   while(ptr) {
     printf(" [%u]: (%u)-", ptr->sender_id_, ptr->max_);
     window_size_t i = ptr->pos_;
-    while(1) {
+    for(;;) {
       if(ptr->window_[i])
         printf("O");
       else
diff --git a/src/seq_window.h b/src/seq_window.h
index 51bb1eb..612c2d1 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_seq_window_h_INCLUDED
diff --git a/src/sig_handler.c b/src/sig_handler.c
index 69b96e3..5de168e 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/sig_handler.h b/src/sig_handler.h
index 749c80d..fbb66b6 100644
--- a/src/sig_handler.h
+++ b/src/sig_handler.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_sig_handler_h_INCLUDED
diff --git a/src/string_list.c b/src/string_list.c
index 260dd92..97bc057 100644
--- a/src/string_list.c
+++ b/src/string_list.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include <string.h>
diff --git a/src/string_list.h b/src/string_list.h
index 2e29822..03ca276 100644
--- a/src/string_list.h
+++ b/src/string_list.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_string_list_h_INCLUDED
diff --git a/src/sysexec.c b/src/sysexec.c
index 1191401..814d5ff 100644
--- a/src/sysexec.c
+++ b/src/sysexec.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/sysexec.h b/src/sysexec.h
index 7527584..da6555e 100644
--- a/src/sysexec.h
+++ b/src/sysexec.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_sysexec_h_INCLUDED
diff --git a/src/tun.h b/src/tun.h
index 5051e19..fa6e689 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_tun_h_INCLUDED
diff --git a/src/tun_helper.h b/src/tun_helper.h
index 6417d1c..15a1c81 100644
--- a/src/tun_helper.h
+++ b/src/tun_helper.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_tun_helper_h_INCLUDED
diff --git a/src/uanytun.c b/src/uanytun.c
index 3453a38..93ddf63 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
diff --git a/src/udp.c b/src/udp.c
index f336c6e..75ee6ab 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #define _GNU_SOURCE
diff --git a/src/udp.h b/src/udp.h
index 3e81650..bb266b0 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -10,7 +10,7 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_udp_h_INCLUDED
-- 
cgit v1.2.3


From addbe8b6aed113ad40866be5cb5ff563067ecb46 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@anytun.org>
Date: Sun, 29 Jun 2014 15:53:42 +0000
Subject: fixed checking (missing OpenssL License File)

---
 LICENSE.OpenSSL | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 186 insertions(+)
 create mode 100644 LICENSE.OpenSSL

diff --git a/LICENSE.OpenSSL b/LICENSE.OpenSSL
new file mode 100644
index 0000000..4b57596
--- /dev/null
+++ b/LICENSE.OpenSSL
@@ -0,0 +1,186 @@
+/*
+ *  uAnytun
+ *
+ *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
+ *  featured implementation uAnytun has no support for multiple connections
+ *  or synchronisation. It is a small single threaded implementation intended
+ *  to act as a client on small platforms.
+ *  The secure anycast tunneling protocol (satp) defines a protocol used
+ *  for communication between any combination of unicast and anycast
+ *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
+ *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
+ *  ethernet, ip, arp ...). satp directly includes cryptography and
+ *  message authentication based on the methods used by SRTP.  It is
+ *  intended to deliver a generic, scaleable and secure solution for
+ *  tunneling and relaying of packets of any protocol.
+ *
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
+ *
+ *  This file is part of uAnytun.
+ *
+ *  uAnytun is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  any later version.
+ *
+ *  uAnytun is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ *
+ */
+
+Certain source files in this program permit linking with the OpenSSL
+library (http://www.openssl.org), which otherwise wouldn't be allowed
+under the GPL.  For purposes of identifying OpenSSL, most source files
+giving this permission limit it to versions of OpenSSL having a license
+identical to that listed in this file (LICENSE.OpenSSL).  It is not
+necessary for the copyright years to match between this file and the
+OpenSSL version in question.  However, note that because this file is
+an extension of the license statements of these source files, this file
+may not be changed except with permission from all copyright holders
+of source files in this program which reference this file.
+
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts. Actually both licenses are BSD-style
+  Open Source licenses. In case of any license issues related to OpenSSL
+  please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
-- 
cgit v1.2.3