From 9094cfdb27dda0585389ef3e2cbdbb9d42d5e5d5 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Mon, 14 Dec 2009 04:16:52 +0100
Subject: [PATCH 01/16] Adjust path of example files in README file on the fly

---
 debian/rules | 1 +
 1 file changed, 1 insertion(+)

diff --git a/debian/rules b/debian/rules
index a259e2e..6212bf6 100755
--- a/debian/rules
+++ b/debian/rules
@@ -49,6 +49,7 @@ install: build
 	cd src && $(MAKE) DESTDIR=$(CURDIR)/debian/uanytun install && cd ..
 	# Fix unusual path:
 	mv debian/uanytun/usr/share/uanytun/examples/uanytun debian/uanytun/usr/share/uanytun/examples/config
+	echo "example configurations can be found at /usr/share/uanytun/examples/config" > debian/uanytun/etc/uanytun/README
 
 # Build architecture-independent files here.
 binary-indep: install
-- 
2.1.4


From 4798faf0f2aa4d9710df772fa923462bed88a6ab Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Mon, 14 Dec 2009 17:18:00 +0100
Subject: [PATCH 02/16] Fix broken upstream init script, drop chroot stuff from
 default config.

---
 debian/rules           | 2 +-
 debian/uanytun.default | 5 -----
 etc/init.d/uanytun     | 2 +-
 3 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/debian/rules b/debian/rules
index 6212bf6..1cfd3ad 100755
--- a/debian/rules
+++ b/debian/rules
@@ -67,7 +67,7 @@ binary-arch: install
 	dh_link
 	dh_strip
 	dh_compress
-	mkdir -p debian/uanytun/usr/share/lintian/overrides/ 
+	mkdir -p debian/uanytun/usr/share/lintian/overrides/
 	cp -av debian/overrides debian/uanytun/usr/share/lintian/overrides/uanytun
 	dh_fixperms
 	find debian/uanytun -type f -name config     -exec chmod 600 {} \;
diff --git a/debian/uanytun.default b/debian/uanytun.default
index 5e05210..d9d62c4 100644
--- a/debian/uanytun.default
+++ b/debian/uanytun.default
@@ -1,10 +1,5 @@
 # Defaults for uanytun initscript
 # sourced by /etc/init.d/uanytun
 
-# Note: chroot is tricky and not reliable yet. Use it only
-#       if you know what you're doing.
-#CHROOTDIR='/var/run/uanytun'
-#DAEMONOPTS="--chroot $CHROOTDIR --username nobody"
-
 # Additional options that are passed to the Daemon.
 DAEMONOPTS="--username uanytun"
diff --git a/etc/init.d/uanytun b/etc/init.d/uanytun
index 781e809..07cb448 100755
--- a/etc/init.d/uanytun
+++ b/etc/init.d/uanytun
@@ -31,7 +31,7 @@ start_vpn () {
       test -d $CHROOTDIR || mkdir -p $CHROOTDIR
     fi
     DAEMONARG=`sed 's/#.*//' < $CONFIG_DIR/$NAME/config | grep -e '\w' | sed  's/^/--/' | tr '\n' ' '`
-    $DAEMON --write-pid /var/run/uanytun.$NAME.pid $POSTUP $DAEMONARG || STATUS="FAILED"
+    $DAEMON --write-pid /var/run/uanytun.$NAME.pid $POSTUP $DAEMONOPTS $DAEMONARG || STATUS="FAILED"
   else
     STATUS="no config found"
   fi
-- 
2.1.4


From 5deb67854450a43e4809b287b1eaace73dca46bb Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Mon, 14 Dec 2009 17:25:20 +0100
Subject: [PATCH 03/16] Add debian/prerm

---
 debian/postinst |  2 --
 debian/postrm   |  2 --
 debian/prerm    | 12 ++++++++++++
 3 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100755 debian/prerm

diff --git a/debian/postinst b/debian/postinst
index 8b783fe..b72feed 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -10,5 +10,3 @@ fi
 if [ "$1" = "configure" ]; then
   adduser --quiet --system --group --no-create-home --home /var/run/uanytun uanytun
 fi
-
-#DEBHELPER#
diff --git a/debian/postrm b/debian/postrm
index 345ff3c..9088e15 100755
--- a/debian/postrm
+++ b/debian/postrm
@@ -13,5 +13,3 @@ if [ "$1" = "purge" ] ; then
       echo "Not removing uanytun user and group: adduser package not found." >&2
    fi
 fi
-
-#DEBHELPER#
diff --git a/debian/prerm b/debian/prerm
new file mode 100755
index 0000000..01b209c
--- /dev/null
+++ b/debian/prerm
@@ -0,0 +1,12 @@
+#!/bin/sh
+# prerm script for uanytun
+
+set -e
+
+if [ -x "/etc/init.d/uanytun" ] && [ "$1" = remove ]; then
+  if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+    invoke-rc.d uanytun stop || true
+  else
+    /etc/init.d/uanytun stop || true
+  fi
+fi
-- 
2.1.4


From 1a22a6c452036d88e5ff792d7a0924cdfd841c10 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Mon, 14 Dec 2009 17:43:35 +0100
Subject: [PATCH 04/16] Update changelog for initial upload.

---
 debian/changelog | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index e8cd3c2..623053a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,12 +1,6 @@
 uanytun (0.3.2-1) unstable; urgency=low
 
-  * New Upstream Version
-
- -- Michael Prokop <mika@debian.org>  Mon, 14 Dec 2009 02:45:47 +0100
-
-uanytun (0.3-1) unstable; urgency=low
-
   * Initial release (Closes: #531082)
 
- -- Michael Prokop <mika@debian.org>  Fri, 29 May 2009 22:19:50 +0200
+ -- Michael Prokop <mika@debian.org>  Mon, 14 Dec 2009 17:43:13 +0100
 
-- 
2.1.4


From 069ec4b2800bc68766b47184a36e494a99c02820 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 23 Dec 2009 03:47:48 +0100
Subject: [PATCH 05/16] Drop asciidoc and related packages from build-depends
 and ship manpages statically instead.

---
 debian/control   |   2 +-
 debian/rules     |  11 +-
 debian/uanytun.8 | 408 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 411 insertions(+), 10 deletions(-)
 create mode 100644 debian/uanytun.8

diff --git a/debian/control b/debian/control
index f7e8cd3..6058d3a 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: uanytun
 Section: net
 Priority: extra
 Maintainer: Michael Prokop <mika@debian.org>
-Build-Depends: debhelper (>= 5), asciidoc, docbook-xsl, libgcrypt11-dev, xsltproc
+Build-Depends: debhelper (>= 5), libgcrypt11-dev
 Standards-Version: 3.8.3
 Homepage: http://www.anytun.org/
 Vcs-git: git://git.grml.org/uanytun.git
diff --git a/debian/rules b/debian/rules
index 1cfd3ad..b6b42b9 100755
--- a/debian/rules
+++ b/debian/rules
@@ -12,7 +12,7 @@
 configure: configure-stamp
 configure-stamp:
 	dh_testdir
-	cd src && ./configure --prefix=/usr --sysconfdir=/etc --examplesdir=/usr/share/uanytun/examples && cd ..
+	cd src && ./configure --no-manpage --prefix=/usr --sysconfdir=/etc --examplesdir=/usr/share/uanytun/examples && cd ..
 	touch configure-stamp
 
 build: build-stamp
@@ -21,7 +21,6 @@ build-stamp: configure-stamp
 	dh_testdir
 
 	cd src && $(MAKE) && cd ..
-	cd doc && $(MAKE) && cd ..
 
 	touch $@
 
@@ -30,12 +29,6 @@ clean:
 	dh_testroot
 	rm -f build-stamp configure-stamp
 
-	cd src && $(MAKE) distclean && cd ..
-	cd doc && $(MAKE) clean && cd ..
-
-	# drop leftover file:
-	rm -f src/tun.c
-
 	# Add here commands to clean up after the build process.
 	$(MAKE) --directory=$(CURDIR)/src distclean
 	dh_clean
@@ -63,7 +56,7 @@ binary-arch: install
 	dh_installdocs
 	dh_installexamples
 	dh_installinit
-	dh_installman doc/uanytun.8
+	dh_installman debian/uanytun.8
 	dh_link
 	dh_strip
 	dh_compress
diff --git a/debian/uanytun.8 b/debian/uanytun.8
new file mode 100644
index 0000000..5b51ce1
--- /dev/null
+++ b/debian/uanytun.8
@@ -0,0 +1,408 @@
+'\" t
+.\"     Title: uanytun
+.\"    Author: [see the "AUTHORS" section]
+.\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
+.\"      Date: 12/14/2009
+.\"    Manual: uanytun user manual
+.\"    Source: uanytun 0.3.2
+.\"  Language: English
+.\"
+.TH "UANYTUN" "8" "12/14/2009" "uanytun 0.3.2" "uanytun user manual"
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+uanytun \- micro anycast tunneling daemon
+.SH "SYNOPSIS"
+.sp
+.nf
+\fBuanytun\fR
+  [ \fB\-h|\-\-help\fR ]
+  [ \fB\-D|\-\-nodaemonize\fR ]
+  [ \fB\-u|\-\-username\fR <username> ]
+  [ \fB\-g|\-\-groupname\fR <groupname> ]
+  [ \fB\-C|\-\-chroot\fR <path> ]
+  [ \fB\-P|\-\-write\-pid\fR <filename> ]
+  [ \fB\-L|\-\-log\fR <target>:<level>[,<param1>[,<param2>[\&.\&.]]] ]
+  [ \fB\-i|\-\-interface\fR <ip\-address> ]
+  [ \fB\-p|\-\-port\fR <port> ]
+  [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
+  [ \fB\-o|\-\-remote\-port\fR <port> ]
+  [ \fB\-4|\-\-ipv4\-only\fR ]
+  [ \fB\-6|\-\-ipv6\-only\fR ]
+  [ \fB\-d|\-\-dev\fR <name> ]
+  [ \fB\-t|\-\-type\fR <tun|tap> ]
+  [ \fB\-n|\-\-ifconfig\fR <local>/<prefix> ]
+  [ \fB\-x|\-\-post\-up\-script\fR <script> ]
+  [ \fB\-m|\-\-mux\fR <mux\-id> ]
+  [ \fB\-s|\-\-sender\-id\fR <sender id> ]
+  [ \fB\-w|\-\-window\-size\fR <window size> ]
+  [ \fB\-k|\-\-kd\-prf\fR <kd\-prf type> ]
+  [ \fB\-e|\-\-role\fR <role> ]
+  [ \fB\-E|\-\-passphrase\fR <pass phrase> ]
+  [ \fB\-K|\-\-key\fR <master key> ]
+  [ \fB\-A|\-\-salt\fR <master salt> ]
+  [ \fB\-c|\-\-cipher\fR <cipher type> ]
+  [ \fB\-a|\-\-auth\-algo\fR <algo type> ]
+  [ \fB\-b|\-\-auth\-tag\-length\fR <length> ]
+.fi
+.SH "DESCRIPTION"
+.sp
+\fBuAnytun\fR is a tiny implementation of the Secure Anycast Tunneling Protocol (SATP)\&. It provides a complete VPN solution similar to OpenVPN or IPsec in tunnel mode\&. The main difference is that anycast enables the setup of tunnels between an arbitrary combination of anycast, unicast and multicast hosts\&. Unlike Anytun which is a full featured implementation uAnytun has no support for multiple connections or synchronisation\&. It is a small single threaded implementation intended to act as a client on small platforms\&.
+.SH "OPTIONS"
+.sp
+\fBuAnytun\fR has been designed as a peer to peer application, so there is no difference between client and server\&. The following options can be passed to the daemon:
+.PP
+\fB\-D, \-\-nodaemonize\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in foreground instead of becoming a daemon which is the default\&.
+.RE
+.PP
+\fB\-u, \-\-username <username>\fR
+.RS 4
+run as this user\&. If no group is specified (\fB\-g\fR) the default group of the user is used\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-g, \-\-groupname <groupname>\fR
+.RS 4
+run as this group\&. If no username is specified (\fB\-u\fR) this gets ignored\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-C, \-\-chroot <path>\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to run in a chroot jail\&. The default is to not run in chroot\&.
+.RE
+.PP
+\fB\-P, \-\-write\-pid <filename>\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to write it\(cqs pid to this file\&. The default is to not create a pid file\&.
+.RE
+.PP
+\fB\-L, \-\-log <target>:<level>[,<param1>[,<param2>[\&.\&.]]]\fR
+.RS 4
+add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
+
+The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config
+\fBsyslog:3,uanytun,daemon\fR
+is added\&.
+
+The following targets are supported:
+.PP
+\fBsyslog\fR
+.RS 4
+log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+.RE
+.PP
+\fBfile\fR
+.RS 4
+log to file, parameters <level>[,<path>]
+.RE
+.PP
+\fBstdout\fR
+.RS 4
+log to standard output, parameters <level>
+.RE
+.PP
+\fBstderr\fR
+.RS 4
+log to standard error, parameters <level>
+.RE
+.RE
+.PP
+\fB\-i, \-\-interface <ip address>\fR
+.RS 4
+This IP address is used as the sender address for outgoing packets\&. The default is to not use a special inteface and just bind on all interfaces\&.
+.RE
+.PP
+\fB\-p, \-\-port <port>\fR
+.RS 4
+The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. default: 4444
+.RE
+.PP
+\fB\-r, \-\-remote\-host <hostname|ip>\fR
+.RS 4
+This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-o, \-\-remote\-port <port>\fR
+.RS 4
+The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-4, \-\-ipv4\-only\fR
+.RS 4
+Resolv to IPv4 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-6, \-\-ipv6\-only\fR
+.RS 4
+Resolv to IPv6 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-d, \-\-dev <name>\fR
+.RS 4
+device name
+
+By default, tapN is used for Ethernet tunnel interfaces, and tunN for IP tunnels, respectively\&. This option can be used to manually override these defaults\&.
+.RE
+.PP
+\fB\-t, \-\-type <tun|tap>\fR
+.RS 4
+device type
+
+Type of the tunnels to create\&. Use tap for Ethernet tunnels, tun for IP tunnels\&.
+.RE
+.PP
+\fB\-n, \-\-ifconfig <local>/<prefix>\fR
+.RS 4
+The local IP address and prefix length\&. The remote tunnel endpoint has to use a different IP address in the same subnet\&.
+.PP
+\fB<local>\fR
+.RS 4
+the local IP address for the tun/tap device
+.RE
+.PP
+\fB<prefix>\fR
+.RS 4
+the prefix length of the network
+.RE
+.RE
+.PP
+\fB\-x, \-\-post\-up\-script <script>\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run this script after the interface is created\&. By default no script will be executed\&.
+.RE
+.PP
+\fB\-m, \-\-mux <mux\-id>\fR
+.RS 4
+the multiplex id to use\&. default: 0
+.RE
+.PP
+\fB\-s, \-\-sender\-id <sender id>\fR
+.RS 4
+Each anycast tunnel endpoint needs a unique sender id (1, 2, 3, \&...)\&. It is needed to distinguish the senders in case of replay attacks\&. As
+\fBuAnytun\fR
+does not support synchronisation it can\(cqt be used as an anycast endpoint therefore this option is quite useless but implemented for compability reasons\&. default: 0
+.RE
+.PP
+\fB\-w, \-\-window\-size <window size>\fR
+.RS 4
+seqence window size
+
+Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
+.RE
+.PP
+\fB\-k, \-\-kd\(emprf <kd\-prf type>\fR
+.RS 4
+key derivation pseudo random function
+
+The pseudo random function which is used for calculating the session keys and session salt\&.
+
+Possible values:
+.PP
+\fBnull\fR
+.RS 4
+no random function, keys and salt are set to 0\&.\&.00
+.RE
+.PP
+\fBaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fBaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fBaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fBaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-e, \-\-role <role>\fR
+.RS 4
+SATP uses different session keys for inbound and outbound traffic\&. The role parameter is used to determine which keys to use for outbound or inbound packets\&. On both sides of a vpn connection different roles have to be used\&. Possible values are
+\fBleft\fR
+and
+\fBright\fR\&. You may also use
+\fBalice\fR
+or
+\fBserver\fR
+as a replacement for
+\fBleft\fR
+and
+\fBbob\fR
+or
+\fBclient\fR
+as a replacement for
+\fBright\fR\&. By default
+\fBleft\fR
+is used\&.
+.RE
+.PP
+\fB\-E, \-\-passphrase <pass phrase>\fR
+.RS 4
+This passphrase is used to generate the master key and master salt\&. For the master key the last n bits of the SHA256 digest of the passphrase (where n is the length of the master key in bits) is used\&. The master salt gets generated with the SHA1 digest\&. You may force a specific key and or salt by using
+\fB\-\-key\fR
+and
+\fB\-\-salt\fR\&.
+.RE
+.PP
+\fB\-K, \-\-key <master key>\fR
+.RS 4
+master key to use for key derivation
+
+Master key in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits)\&.
+.RE
+.PP
+\fB\-A, \-\-salt <master salt>\fR
+.RS 4
+master salt to use for key derivation
+
+Master salt in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes)\&.
+.RE
+.PP
+\fB\-c, \-\-cipher <cipher type>\fR
+.RS 4
+payload encryption algorithm
+
+Encryption algorithm used for encrypting the payload
+
+Possible values:
+.PP
+\fBnull\fR
+.RS 4
+no encryption
+.RE
+.PP
+\fBaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fBaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fBaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fBaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-a, \-\-auth\-algo <algo type>\fR
+.RS 4
+message authentication algorithm
+
+This option sets the message authentication algorithm\&.
+
+If HMAC\-SHA1 is used, the packet length is increased\&. The additional bytes contain the authentication data\&. see
+\fB\-\-auth\-tag\-length\fR
+for more info\&.
+
+Possible values:
+.PP
+\fBnull\fR
+.RS 4
+no message authentication
+.RE
+.PP
+\fBsha1\fR
+.RS 4
+HMAC\-SHA1, default value
+.RE
+.RE
+.PP
+\fB\-b, \-\-auth\-tag\-length <length>\fR
+.RS 4
+The number of bytes to use for the auth tag\&. This value defaults to 10 bytes unless the
+\fBnull\fR
+auth algo is used in which case it defaults to 0\&.
+.RE
+.SH "EXAMPLES"
+.SS "P2P Setup between two unicast enpoints:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost A:\fR
+.RS 4
+.sp
+uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost B:\fR
+.RS 4
+.sp
+uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
+.RE
+.SS "One unicast and one anycast tunnel endpoint:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBUnicast tunnel endpoint:\fR
+.RS 4
+.sp
+uanytun \-r anycast\&.anytun\&.org \-d anytun0 \-t tun \-n 192\&.0\&.2\&.2/30 \-a null \-c null \-w 0 \-e client
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBAnycast tunnel endpoints:\fR
+.RS 4
+.sp
+As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for this purpose\&. You have to use \fBAnytun\fR for that job\&.
+.RE
+.SH "BUGS"
+.sp
+Most likely there are some bugs in \fBuAnytun\fR\&. If you find a bug, please let the developers know at uanytun@anytun\&.org\&. Of course, patches are preferred\&.
+.SH "AUTHORS"
+.sp
+Christian Pointner <equinox@anytun\&.org>
+.SH "RESOURCES"
+.sp
+Main web site: http://www\&.anytun\&.org/
+.SH "COPYING"
+.sp
+Copyright (C) 2008\-2009 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
-- 
2.1.4


From 0a5d793f3b44075f4b150c37800e4d5093c8f01d Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 23 Dec 2009 03:56:37 +0100
Subject: [PATCH 06/16] Apply patch based on the one from Cyril Brulebois for
 anytun to fix FTBFS on GNU/kFreeBSD.

---
 src/bsd/tun.c | 4 ++--
 src/configure | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index 21d16a4..46c7c1c 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -183,7 +183,7 @@ int tun_init_post(tun_device_t* dev)
   return 0;
 }
 
-#elif defined(__GNUC__) && defined(__FreeBSD__)
+#elif defined(__GNUC__) && (defined(__FreeBSD__) || defined(__FreeBSD_kernel__))
 
 int tun_init_post(tun_device_t* dev)
 {
@@ -318,7 +318,7 @@ void tun_do_ifconfig(tun_device_t* dev)
   if(dev->type_ == TYPE_TAP) {
 #if defined(__GNUC__) && defined(__OpenBSD__)
     end = "link0";
-#elif defined(__GNUC__) && defined(__FreeBSD__)
+#elif defined(__GNUC__) && (defined(__FreeBSD__) || defined(__FreeBSD_kernel__))
     end = "up";
 #elif defined(__GNUC__) && defined(__NetBSD__)
     end = NULL;
diff --git a/src/configure b/src/configure
index f4ed32d..ac2dc03 100755
--- a/src/configure
+++ b/src/configure
@@ -147,7 +147,7 @@ case $TARGET in
     ln -sf linux/tun.c
     echo "loading Linux specific TUN Device"
   ;;
-  OpenBSD|FreeBSD|NetBSD)
+  OpenBSD|FreeBSD|NetBSD|GNU/kFreeBSD)
     rm -f tun.c
     ln -sf bsd/tun.c
     echo "loading BSD specific TUN Device"
-- 
2.1.4


From 062bd1b2d8cd74c1965229043dc5bbbbd8cbf50a Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 23 Dec 2009 03:55:02 +0100
Subject: [PATCH 07/16] Update changelog for release 0.3.2-2.

---
 debian/changelog | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 623053a..c386032 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+uanytun (0.3.2-2) unstable; urgency=low
+
+  * Drop asciidoc and related packages from build-depends and ship
+    manpage statically instead. Upstream will ship manpage in
+    next release through the tarball.
+  * Apply patch based on the one from Cyril Brulebois for anytun to fix
+    FTBFS on GNU/kFreeBSD.
+
+ -- Michael Prokop <mika@debian.org>  Wed, 23 Dec 2009 03:50:43 +0100
+
 uanytun (0.3.2-1) unstable; urgency=low
 
   * Initial release (Closes: #531082)
-- 
2.1.4


From aa74a4fd24d8e8537f76531e6257fa90145355d3 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 17 Feb 2010 03:03:11 +0100
Subject: [PATCH 08/16] Imported Upstream version 0.3.3

---
 ChangeLog              |   8 +
 README                 |   5 +-
 doc/Makefile           |   7 +-
 doc/uanytun.8          | 420 +++++++++++++++++++++++++++++++++++++++++++++++++
 doc/uanytun.8.txt      | 103 ++++++------
 etc/init.d/uanytun     |  54 +++----
 src/Makefile           |   3 +-
 src/auth_algo.c        |   2 +-
 src/auth_algo.h        |   2 +-
 src/bsd/tun.c          |   6 +-
 src/cipher.c           |   2 +-
 src/cipher.h           |   2 +-
 src/configure          |  55 ++++---
 src/daemon.h           |   4 +-
 src/datatypes.h        |   2 +-
 src/encrypted_packet.c |   2 +-
 src/encrypted_packet.h |   2 +-
 src/init_crypt.h       |  93 +++++++++++
 src/key_derivation.c   |   2 +-
 src/key_derivation.h   |   2 +-
 src/linux/tun.c        |   2 +-
 src/log.c              |   2 +-
 src/log.h              |   2 +-
 src/log_targets.h      |   2 +-
 src/options.c          |  31 +++-
 src/options.h          |   3 +-
 src/plain_packet.c     |   2 +-
 src/plain_packet.h     |   2 +-
 src/seq_window.c       |   2 +-
 src/seq_window.h       |   2 +-
 src/sig_handler.c      |   9 +-
 src/sig_handler.h      |   2 +-
 src/string_list.c      |   2 +-
 src/string_list.h      |   2 +-
 src/sysexec.c          |   2 +-
 src/sysexec.h          |   2 +-
 src/tun.h              |   2 +-
 src/tun_helper.h       |   2 +-
 src/uanytun.c          | 127 ++++++---------
 src/udp.c              | 182 ++++++++++++++-------
 src/udp.h              |  26 +--
 version                |   2 +-
 42 files changed, 888 insertions(+), 298 deletions(-)
 create mode 100644 doc/uanytun.8
 create mode 100644 src/init_crypt.h

diff --git a/ChangeLog b/ChangeLog
index edeb953..33d4752 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010.02.16 -- Version 0.3.3
+
+* added -v|--version option
+* added prebuilt manpage to release tarball (less build deps)
+* added multi socket support which allows simultanous usage
+  of IPv4 and IPv6 even on operating systems without V4_MAPPED
+  address support
+
 2009.12.02 -- Version 0.3.2
 
 * clenaups and improvements at configure and install target of Makefile
diff --git a/README b/README
index 00a88bc..1c70648 100644
--- a/README
+++ b/README
@@ -8,6 +8,7 @@ issues when using this library. It also needs more space when installed.
 
 Linux
 -----
+(this includes Debian with FreeBSD Kernel)
 
 using libgcrypt:
  
@@ -19,7 +20,7 @@ using ssl crypto library:
  build-essential
  libssl-dev
 
-only for manpage:
+if you want to rebuild the manpage:
 
  asciidoc
 
@@ -36,7 +37,7 @@ using ssl crypto library:
 
  devel/gmake
 
-only for manpage:
+if you want to rebuild the manpage:
 
  textproc/asciidoc
  textproc/libxslt
diff --git a/doc/Makefile b/doc/Makefile
index 97db23e..b5eecb8 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -15,7 +15,7 @@
 ##  tunneling and relaying of packets of any protocol.
 ##  
 ##
-##  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -49,4 +49,7 @@ uanytun.8: uanytun.8.txt
 manpage: uanytun.8
 
 clean:
-	rm -f uanytun.8 uanytun.8.xml
+	rm -f uanytun.8.xml
+
+realclean: clean
+	rm -f uanytun.8
diff --git a/doc/uanytun.8 b/doc/uanytun.8
new file mode 100644
index 0000000..7126c00
--- /dev/null
+++ b/doc/uanytun.8
@@ -0,0 +1,420 @@
+'\" t
+.\"     Title: uanytun
+.\"    Author: [see the "AUTHORS" section]
+.\" Generator: DocBook XSL Stylesheets v1.75.1 <http://docbook.sf.net/>
+.\"      Date: 02/17/2010
+.\"    Manual: uanytun user manual
+.\"    Source: uanytun 0.3.3
+.\"  Language: English
+.\"
+.TH "UANYTUN" "8" "02/17/2010" "uanytun 0.3.3" "uanytun user manual"
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+uanytun \- micro anycast tunneling daemon
+.SH "SYNOPSIS"
+.sp
+.nf
+\fBuanytun\fR
+  [ \fB\-h|\-\-help\fR ]
+  [ \fB\-D|\-\-nodaemonize\fR ]
+  [ \fB\-u|\-\-username\fR <username> ]
+  [ \fB\-g|\-\-groupname\fR <groupname> ]
+  [ \fB\-C|\-\-chroot\fR <path> ]
+  [ \fB\-P|\-\-write\-pid\fR <filename> ]
+  [ \fB\-L|\-\-log\fR <target>:<level>[,<param1>[,<param2>[\&.\&.]]] ]
+  [ \fB\-U|\-\-debug\fR ]
+  [ \fB\-i|\-\-interface\fR <ip\-address> ]
+  [ \fB\-p|\-\-port\fR <port> ]
+  [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
+  [ \fB\-o|\-\-remote\-port\fR <port> ]
+  [ \fB\-4|\-\-ipv4\-only\fR ]
+  [ \fB\-6|\-\-ipv6\-only\fR ]
+  [ \fB\-d|\-\-dev\fR <name> ]
+  [ \fB\-t|\-\-type\fR <tun|tap> ]
+  [ \fB\-n|\-\-ifconfig\fR <local>/<prefix> ]
+  [ \fB\-x|\-\-post\-up\-script\fR <script> ]
+  [ \fB\-m|\-\-mux\fR <mux\-id> ]
+  [ \fB\-s|\-\-sender\-id\fR <sender id> ]
+  [ \fB\-w|\-\-window\-size\fR <window size> ]
+  [ \fB\-k|\-\-kd\-prf\fR <kd\-prf type> ]
+  [ \fB\-e|\-\-role\fR <role> ]
+  [ \fB\-E|\-\-passphrase\fR <pass phrase> ]
+  [ \fB\-K|\-\-key\fR <master key> ]
+  [ \fB\-A|\-\-salt\fR <master salt> ]
+  [ \fB\-c|\-\-cipher\fR <cipher type> ]
+  [ \fB\-a|\-\-auth\-algo\fR <algo type> ]
+  [ \fB\-b|\-\-auth\-tag\-length\fR <length> ]
+.fi
+.SH "DESCRIPTION"
+.sp
+\fBuAnytun\fR is a tiny implementation of the Secure Anycast Tunneling Protocol (SATP)\&. It provides a complete VPN solution similar to OpenVPN or IPsec in tunnel mode\&. The main difference is that anycast enables the setup of tunnels between an arbitrary combination of anycast, unicast and multicast hosts\&. Unlike Anytun which is a full featured implementation uAnytun has no support for multiple connections or synchronisation\&. It is a small single threaded implementation intended to act as a client on small platforms\&.
+.SH "OPTIONS"
+.sp
+\fBuAnytun\fR has been designed as a peer to peer application, so there is no difference between client and server\&. The following options can be passed to the daemon:
+.PP
+\fB\-D, \-\-nodaemonize\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in foreground instead of becoming a daemon which is the default\&.
+.RE
+.PP
+\fB\-u, \-\-username \fR\fB\fI<username>\fR\fR
+.RS 4
+run as this user\&. If no group is specified (\fB\-g\fR) the default group of the user is used\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-g, \-\-groupname \fR\fB\fI<groupname>\fR\fR
+.RS 4
+run as this group\&. If no username is specified (\fB\-u\fR) this gets ignored\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-C, \-\-chroot \fR\fB\fI<path>\fR\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to run in a chroot jail\&. The default is to not run in chroot\&.
+.RE
+.PP
+\fB\-P, \-\-write\-pid <filename>\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to write it\(cqs pid to this file\&. The default is to not create a pid file\&.
+.RE
+.PP
+\fB\-L, \-\-log \fR\fB\fI<target>:<level>[,<param1>[,<param2>[\&.\&.]]]\fR\fR
+.RS 4
+add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
+
+The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config
+\fIsyslog:3,uanytun,daemon\fR
+is added\&.
+
+The following targets are supported:
+.PP
+\fIsyslog\fR
+.RS 4
+log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+.RE
+.PP
+\fIfile\fR
+.RS 4
+log to file, parameters <level>[,<path>]
+.RE
+.PP
+\fIstdout\fR
+.RS 4
+log to standard output, parameters <level>
+.RE
+.PP
+\fIstderr\fR
+.RS 4
+log to standard error, parameters <level>
+.RE
+.RE
+.PP
+\fB\-U, \-\-debug\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in debug mode\&. It implicits
+\fB\-D\fR
+(don\(cqt daemonize) and adds a log target with the configuration
+\fIstdout:5\fR
+(logging with maximum level)\&. In future releases there might be additional output when this option is supplied\&.
+.RE
+.PP
+\fB\-i, \-\-interface \fR\fB\fI<ip address>\fR\fR
+.RS 4
+This IP address is used as the sender address for outgoing packets\&. The default is to not use a special inteface and just bind on all interfaces\&.
+.RE
+.PP
+\fB\-p, \-\-port \fR\fB\fI<port>\fR\fR
+.RS 4
+The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. default: 4444
+.RE
+.PP
+\fB\-r, \-\-remote\-host \fR\fB\fI<hostname|ip>\fR\fR
+.RS 4
+This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-o, \-\-remote\-port \fR\fB\fI<port>\fR\fR
+.RS 4
+The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-4, \-\-ipv4\-only\fR
+.RS 4
+Resolv to IPv4 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-6, \-\-ipv6\-only\fR
+.RS 4
+Resolv to IPv6 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-d, \-\-dev \fR\fB\fI<name>\fR\fR
+.RS 4
+device name
+
+By default, tapN is used for Ethernet tunnel interfaces, and tunN for IP tunnels, respectively\&. This option can be used to manually override these defaults\&.
+.RE
+.PP
+\fB\-t, \-\-type \fR\fB\fI<tun|tap>\fR\fR
+.RS 4
+device type
+
+Type of the tunnels to create\&. Use tap for Ethernet tunnels, tun for IP tunnels\&.
+.RE
+.PP
+\fB\-n, \-\-ifconfig \fR\fB\fI<local>/<prefix>\fR\fR
+.RS 4
+The local IP address and prefix length\&. The remote tunnel endpoint has to use a different IP address in the same subnet\&.
+.PP
+\fI<local>\fR
+.RS 4
+the local IP address for the tun/tap device
+.RE
+.PP
+\fI<prefix>\fR
+.RS 4
+the prefix length of the network
+.RE
+.RE
+.PP
+\fB\-x, \-\-post\-up\-script \fR\fB\fI<script>\fR\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run this script after the interface is created\&. By default no script will be executed\&.
+.RE
+.PP
+\fB\-m, \-\-mux \fR\fB\fI<mux\-id>\fR\fR
+.RS 4
+the multiplex id to use\&. default: 0
+.RE
+.PP
+\fB\-s, \-\-sender\-id \fR\fB\fI<sender id>\fR\fR
+.RS 4
+Each anycast tunnel endpoint needs a unique sender id (1, 2, 3, \&...)\&. It is needed to distinguish the senders in case of replay attacks\&. As
+\fBuAnytun\fR
+does not support synchronisation it can\(cqt be used as an anycast endpoint therefore this option is quite useless but implemented for compatibility reasons\&. default: 0
+.RE
+.PP
+\fB\-w, \-\-window\-size \fR\fB\fI<window size>\fR\fR
+.RS 4
+seqence window size
+
+Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
+.RE
+.PP
+\fB\-k, \-\-kd\(emprf \fR\fB\fI<kd\-prf type>\fR\fR
+.RS 4
+key derivation pseudo random function
+
+The pseudo random function which is used for calculating the session keys and session salt\&.
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no random function, keys and salt are set to 0\&.\&.00
+.RE
+.PP
+\fIaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fIaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fIaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fIaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-e, \-\-role \fR\fB\fI<role>\fR\fR
+.RS 4
+SATP uses different session keys for inbound and outbound traffic\&. The role parameter is used to determine which keys to use for outbound or inbound packets\&. On both sides of a vpn connection different roles have to be used\&. Possible values are
+\fIleft\fR
+and
+\fIright\fR\&. You may also use
+\fIalice\fR
+or
+\fIserver\fR
+as a replacement for
+\fIleft\fR
+and
+\fIbob\fR
+or
+\fIclient\fR
+as a replacement for
+\fIright\fR\&. By default
+\fIleft\fR
+is used\&.
+.RE
+.PP
+\fB\-E, \-\-passphrase \fR\fB\fI<pass phrase>\fR\fR
+.RS 4
+This passphrase is used to generate the master key and master salt\&. For the master key the last n bits of the SHA256 digest of the passphrase (where n is the length of the master key in bits) is used\&. The master salt gets generated with the SHA1 digest\&. You may force a specific key and or salt by using
+\fB\-\-key\fR
+and
+\fB\-\-salt\fR\&.
+.RE
+.PP
+\fB\-K, \-\-key \fR\fB\fI<master key>\fR\fR
+.RS 4
+master key to use for key derivation
+
+Master key in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits)\&.
+.RE
+.PP
+\fB\-A, \-\-salt \fR\fB\fI<master salt>\fR\fR
+.RS 4
+master salt to use for key derivation
+
+Master salt in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes)\&.
+.RE
+.PP
+\fB\-c, \-\-cipher \fR\fB\fI<cipher type>\fR\fR
+.RS 4
+payload encryption algorithm
+
+Encryption algorithm used for encrypting the payload
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no encryption
+.RE
+.PP
+\fIaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fIaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fIaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fIaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-a, \-\-auth\-algo \fR\fB\fI<algo type>\fR\fR
+.RS 4
+message authentication algorithm
+
+This option sets the message authentication algorithm\&.
+
+If HMAC\-SHA1 is used, the packet length is increased\&. The additional bytes contain the authentication data\&. see
+\fB\-\-auth\-tag\-length\fR
+for more info\&.
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no message authentication
+.RE
+.PP
+\fIsha1\fR
+.RS 4
+HMAC\-SHA1, default value
+.RE
+.RE
+.PP
+\fB\-b, \-\-auth\-tag\-length \fR\fB\fI<length>\fR\fR
+.RS 4
+The number of bytes to use for the auth tag\&. This value defaults to 10 bytes unless the
+\fInull\fR
+auth algo is used in which case it defaults to 0\&.
+.RE
+.SH "EXAMPLES"
+.SS "P2P Setup between two unicast enpoints:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost A:\fR
+.RS 4
+.sp
+uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost B:\fR
+.RS 4
+.sp
+uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
+.RE
+.SS "One unicast and one anycast tunnel endpoint:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBUnicast tunnel endpoint:\fR
+.RS 4
+.sp
+uanytun \-r anycast\&.anytun\&.org \-d anytun0 \-t tun \-n 192\&.0\&.2\&.2/30 \-a null \-c null \-w 0 \-e client
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBAnycast tunnel endpoints:\fR
+.RS 4
+.sp
+As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for this purpose\&. You have to use \fBAnytun\fR for that job\&.
+.RE
+.SH "BUGS"
+.sp
+Most likely there are some bugs in \fBuAnytun\fR\&. If you find a bug, please let the developers know at uanytun@anytun\&.org\&. Of course, patches are preferred\&.
+.SH "AUTHORS"
+.sp
+Christian Pointner <equinox@anytun\&.org>
+.SH "RESOURCES"
+.sp
+Main web site: http://www\&.anytun\&.org/
+.SH "COPYING"
+.sp
+Copyright (C) 2008\-2010 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 1ed21ca..6fde9d2 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -19,6 +19,7 @@ uanytun
   [ -C|--chroot <path> ]
   [ -P|--write-pid <filename> ]
   [ -L|--log <target>:<level>[,<param1>[,<param2>[..]]] ]
+  [ -U|--debug ]
   [ -i|--interface <ip-address> ]
   [ -p|--port <port> ]
   [ -r|--remote-host <hostname|ip> ]
@@ -67,15 +68,15 @@ passed to the daemon:
    This option instructs *uAnytun* to run in foreground
    instead of becoming a daemon which is the default.
 
-*-u, --username <username>*::
+*-u, --username '<username>'*::
    run as this user. If no group is specified (*-g*) the default group of 
    the user is used. The default is to not drop privileges.
 
-*-g, --groupname <groupname>*::
+*-g, --groupname '<groupname>'*::
    run as this group. If no username is specified (*-u*) this gets ignored.
    The default is to not drop privileges.
 
-*-C, --chroot <path>*::
+*-C, --chroot '<path>'*::
    Instruct *uAnytun* to run in a chroot jail. The default is 
    to not run in chroot.
 
@@ -83,39 +84,45 @@ passed to the daemon:
    Instruct *uAnytun* to write it's pid to this file. The default is 
    to not create a pid file.
 
-*-L, --log <target>:<level>[,<param1>[,<param2>[..]]]*::
+*-L, --log '<target>:<level>[,<param1>[,<param2>[..]]]'*::
    add log target to logging system. This can be invoked several times
    in order to log to different targets at the same time. Every target 
    hast its own log level which is a number between 0 and 5. Where 0 means
    disabling log and 5 means debug messages are enabled. +
    The file target can be used more the once with different levels.
    If no target is provided at the command line a single target with the 
-   config *syslog:3,uanytun,daemon* is added. +
+   config 'syslog:3,uanytun,daemon' is added. +
    The following targets are supported:
 
-   *syslog*;; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
-   *file*;; log to file, parameters <level>[,<path>]
-   *stdout*;; log to standard output, parameters <level>
-   *stderr*;; log to standard error, parameters <level> 
+   'syslog';; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+   'file';; log to file, parameters <level>[,<path>]
+   'stdout';; log to standard output, parameters <level>
+   'stderr';; log to standard error, parameters <level> 
 
-*-i, --interface <ip address>*::
+*-U, --debug*::
+   This option instructs *uAnytun* to run in debug mode. It implicits *-D* 
+   (don't daemonize) and adds a log target with the configuration
+   'stdout:5' (logging with maximum level). In future releases there might
+   be additional output when this option is supplied.
+
+*-i, --interface '<ip address>'*::
    This IP address is used as the sender address for outgoing
    packets. The default is to not use a special inteface and just
    bind on all interfaces.
 
-*-p, --port <port>*::
+*-p, --port '<port>'*::
    The local UDP port that is used to send and receive the
    payload data. The two tunnel endpoints can use different
    ports. default: 4444
 
-*-r, --remote-host <hostname|ip>*::
+*-r, --remote-host '<hostname|ip>'*::
    This option can be used to specify the remote tunnel
    endpoint. In case of anycast tunnel endpoints, the
    anycast IP address has to be used. If you do not specify
    an address, it is automatically determined after receiving
    the first data packet.
 
-*-o, --remote-port <port>*::
+*-o, --remote-port '<port>'*::
    The UDP port used for payload data by the remote host
    (specified with -p on the remote host). If you do not specify
    a port, it is automatically determined after receiving
@@ -129,40 +136,40 @@ passed to the daemon:
    Resolv to IPv6 addresses only. The default is to resolv both
    IPv4 and IPv6 addresses.
 
-*-d, --dev <name>*::
+*-d, --dev '<name>'*::
    device name +
    By default, tapN is used for Ethernet tunnel interfaces,
    and tunN for IP tunnels, respectively. This option can
    be used to manually override these defaults.
 
-*-t, --type <tun|tap>*::
+*-t, --type '<tun|tap>'*::
    device type +
    Type of the tunnels to create. Use tap for Ethernet
    tunnels, tun for IP tunnels.
 
-*-n, --ifconfig <local>/<prefix>*::
+*-n, --ifconfig '<local>/<prefix>'*::
    The local IP address and prefix length. The remote tunnel endpoint
    has to use a different IP address in the same subnet.
 
-   *<local>*;; the local IP address for the tun/tap device
-   *<prefix>*;; the prefix length of the network
+   '<local>';; the local IP address for the tun/tap device
+   '<prefix>';; the prefix length of the network
 
-*-x, --post-up-script <script>*::
+*-x, --post-up-script '<script>'*::
    This option instructs *uAnytun* to run this script after the interface 
    is created. By default no script will be executed.
 
-*-m, --mux <mux-id>*::
+*-m, --mux '<mux-id>'*::
    the multiplex id to use. default: 0
 
-*-s, --sender-id  <sender id>*::
+*-s, --sender-id '<sender id>'*::
    Each anycast tunnel endpoint needs a unique sender id
    (1, 2, 3, ...). It is needed to distinguish the senders
    in case of replay attacks. As *uAnytun* does not support 
    synchronisation it can't be used as an anycast endpoint therefore 
-   this option is quite useless but implemented for compability 
+   this option is quite useless but implemented for compatibility 
    reasons. default: 0
 
-*-w, --window-size <window size>*::
+*-w, --window-size '<window size>'*::
    seqence window size +
    Sometimes, packets arrive out of order on the receiver
    side. This option defines the size of a list of received
@@ -176,69 +183,69 @@ passed to the daemon:
    By default the sequence window is disabled and therefore a
    window size of 0 is used.
 
-*-k, --kd--prf <kd-prf type>*::
+*-k, --kd--prf '<kd-prf type>'*::
    key derivation pseudo random function +
    The pseudo random function which is used for calculating the 
    session keys and session salt. +
    Possible values:
 
-   *null*;; no random function, keys and salt are set to 0..00
-   *aes-ctr*;; AES in counter mode with 128 Bits, default value
-   *aes-ctr-128*;; AES in counter mode with 128 Bits
-   *aes-ctr-192*;; AES in counter mode with 192 Bits
-   *aes-ctr-256*;; AES in counter mode with 256 Bits
+   'null';; no random function, keys and salt are set to 0..00
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
 
-*-e, --role <role>*::
+*-e, --role '<role>'*::
    SATP uses different session keys for inbound and outbound traffic. The
    role parameter is used to determine which keys to use for outbound or
    inbound packets. On both sides of a vpn connection different roles have 
-   to be used. Possible values are *left* and *right*. You may also use 
-   *alice* or *server* as a replacement for *left* and *bob* or *client* as 
-   a replacement for *right*. By default *left* is used.
+   to be used. Possible values are 'left' and 'right'. You may also use 
+   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as 
+   a replacement for 'right'. By default 'left' is used.
 
-*-E, --passphrase <pass phrase>*::
+*-E, --passphrase '<pass phrase>'*::
    This passphrase is used to generate the master key and master salt.
    For the master key the last n bits of the SHA256 digest of the 
    passphrase (where n is the length of the master key in bits) is used. 
    The master salt gets generated with the SHA1 digest. 
    You may force a specific key and or salt by using *--key* and *--salt*.
 
-*-K, --key <master key>*::
+*-K, --key '<master key>'*::
    master key to use for key derivation +
    Master key in hexadecimal notation, e.g.
    01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length
    of 32, 48 or 64 characters (128, 192 or 256 bits).
 
-*-A, --salt <master salt>*::
+*-A, --salt '<master salt>'*::
    master salt to use for key derivation +
    Master salt in hexadecimal notation, e.g.
    01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length
    of 28 characters (14 bytes).
 
-*-c, --cipher <cipher type>*::
+*-c, --cipher '<cipher type>'*::
    payload encryption algorithm +
    Encryption algorithm used for encrypting the payload +
    Possible values:
 
-   *null*;; no encryption
-   *aes-ctr*;; AES in counter mode with 128 Bits, default value
-   *aes-ctr-128*;; AES in counter mode with 128 Bits
-   *aes-ctr-192*;; AES in counter mode with 192 Bits
-   *aes-ctr-256*;; AES in counter mode with 256 Bits
+   'null';; no encryption
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
 
-*-a, --auth-algo <algo type>*::
+*-a, --auth-algo '<algo type>'*::
    message authentication algorithm +
    This option sets the message authentication algorithm. +
    If HMAC-SHA1 is used, the packet length is increased. The additional bytes 
    contain the authentication data. see *--auth-tag-length* for more info. +
    Possible values:
 
-   *null*;; no message authentication
-   *sha1*;; HMAC-SHA1, default value
+   'null';; no message authentication
+   'sha1';; HMAC-SHA1, default value
 
-*-b, --auth-tag-length <length>*::
+*-b, --auth-tag-length '<length>'*::
    The number of bytes to use for the auth tag. This value defaults to 10 bytes 
-   unless the *null* auth algo is used in which case it defaults to 0. 
+   unless the 'null' auth algo is used in which case it defaults to 0. 
 
 
 EXAMPLES
@@ -293,7 +300,7 @@ Main web site: http://www.anytun.org/
 COPYING
 -------
 
-Copyright \(C) 2008-2009 Christian Pointner. This  program is  free 
+Copyright \(C) 2008-2010 Christian Pointner. This  program is  free 
 software: you can redistribute it and/or modify it under the terms 
 of the GNU General Public License as published by the Free Software 
 Foundation, either version 3 of the License, or any later version.
diff --git a/etc/init.d/uanytun b/etc/init.d/uanytun
index 781e809..9c2414a 100755
--- a/etc/init.d/uanytun
+++ b/etc/init.d/uanytun
@@ -13,6 +13,7 @@ DAEMON=/usr/sbin/uanytun
 CONFIG_DIR=/etc/uanytun
 NAME=uanytun
 DESC=uanytun
+VARRUN_DIR=/var/run/$NAME
 
 test -x $DAEMON || exit 0
 
@@ -23,15 +24,16 @@ fi
 
 start_vpn () {
   STATUS="OK"
-  if [ -f $CONFIG_DIR/$NAME/config ] ; then
+  if [ -f $CONFIG_DIR/$VPNNAME/config ] ; then
     POSTUP=''
-    test -f  $CONFIG_DIR/$NAME/post-up.sh && POSTUP="-x $CONFIG_DIR/$NAME/post-up.sh"
-    CHROOTDIR=`grep '^chroot' < $CONFIG_DIR/$NAME/config | sed 's/chroot\s*//'`
+    test -f  $CONFIG_DIR/$VPNNAME/post-up.sh && POSTUP="-x $CONFIG_DIR/$VPNNAME/post-up.sh"
+    CHROOTDIR=`grep '^chroot' < $CONFIG_DIR/$VPNNAME/config | sed 's/chroot\s*//'`
     if [ -n "$CHROOTDIR" ] ; then
       test -d $CHROOTDIR || mkdir -p $CHROOTDIR
     fi
-    DAEMONARG=`sed 's/#.*//' < $CONFIG_DIR/$NAME/config | grep -e '\w' | sed  's/^/--/' | tr '\n' ' '`
-    $DAEMON --write-pid /var/run/uanytun.$NAME.pid $POSTUP $DAEMONARG || STATUS="FAILED"
+    test -d $VARRUN_DIR || mkdir -p $VARRUN_DIR
+    DAEMONARG=`sed 's/#.*//' < $CONFIG_DIR/$VPNNAME/config | grep -e '\w' | sed  's/^/--/' | tr '\n' ' '`
+    $DAEMON --write-pid $VARRUN_DIR/$VPNNAME.pid $POSTUP $DAEMONOPTS $DAEMONARG || STATUS="FAILED"
   else
     STATUS="no config found"
   fi
@@ -48,8 +50,8 @@ case "$1" in
   echo -n "Starting $DESC:"
   if test -z "$2" ; then
     if [ -f $CONFIG_DIR/autostart ] ; then
-      for NAME in `sed 's/#.*//'  <  $CONFIG_DIR/autostart | grep -e '\w'`; do
-        echo -n " $NAME"
+      for VPNNAME in `sed 's/#.*//'  <  $CONFIG_DIR/autostart | grep -e '\w'`; do
+        echo -n " $VPNNAME"
         start_vpn
       done
     else
@@ -59,8 +61,8 @@ case "$1" in
   else
     while shift ; do
       [ -z "$1" ] && break
-      NAME=$1
-      echo -n " $NAME"
+      VPNNAME=$1
+      echo -n " $VPNNAME"
       start_vpn
     done
   fi
@@ -69,20 +71,18 @@ case "$1" in
   stop)
   echo -n "Stoping $DESC:"
   if test -z "$2" ; then
-    for PIDFILE in `ls /var/run/uanytun.*.pid 2> /dev/null`; do
-      NAME=`echo $PIDFILE | cut -c18-`
-      NAME=${NAME%%.pid}
-      echo -n " $NAME"
+    for PIDFILE in `ls $VARRUN_DIR/*.pid 2> /dev/null`; do
+      VPNNAME=`basename $PIDFILE .pid`
+      echo -n " $VPNNAME"
       stop_vpn
     done
   else
     while shift ; do
       [ -z "$1" ] && break
-      if test -e /var/run/uanytun.$1.pid ; then
-        PIDFILE=`ls /var/run/uanytun.$1.pid 2> /dev/null`
-        NAME=`echo $PIDFILE | cut -c18-`
-        NAME=${NAME%%.pid}
-        echo -n " $NAME"
+      if test -e $VARRUN_DIR/$1.pid ; then
+        PIDFILE=`ls $VARRUN_DIR/$1.pid 2> /dev/null`
+        VPNNAME=`basename $PIDFILE .pid`
+        echo -n " $VPNNAME"
         stop_vpn
       else
         echo -n " (failure: No such tunnel is running: $1)"
@@ -94,21 +94,19 @@ case "$1" in
   reload)
   echo -n "Reloading $DESC:"
   if test -z "$2" ; then
-    for PIDFILE in `ls /var/run/uanytun.*.pid 2> /dev/null`; do
-      NAME=`echo $PIDFILE | cut -c18-`
-      NAME=${NAME%%.pid}
-      echo -n " $NAME"
+    for PIDFILE in `ls $VARRUN_DIR/*.pid 2> /dev/null`; do
+      VPNNAME=`basename $PIDFILE .pid`
+      echo -n " $VPNNAME"
       stop_vpn
       start_vpn
     done
   else
     while shift ; do
       [ -z "$1" ] && break
-      if test -e /var/run/uanytun.$1.pid ; then
-        PIDFILE=`ls /var/run/uanytun.$1.pid 2> /dev/null`
-        NAME=`echo $PIDFILE | cut -c18-`
-        NAME=${NAME%%.pid}
-        echo -n " $NAME"
+      if test -e $VARRUN_DIR/$1.pid ; then
+        PIDFILE=`ls $VARRUN_DIR/$1.pid 2> /dev/null`
+        VPNNAME=`basename $PIDFILE .pid`
+        echo -n " $VPNNAME"
         stop_vpn
         start_vpn
       else
@@ -118,7 +116,7 @@ case "$1" in
   fi
   echo "."
   ;;
-  restart)
+  restart|force-reload)
     SCRIPT=$0
     shift
     $SCRIPT stop $*
diff --git a/src/Makefile b/src/Makefile
index 4124575..5ed36d9 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -15,7 +15,7 @@
 ##  tunneling and relaying of packets of any protocol.
 ##  
 ##
-##  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -89,6 +89,7 @@ distclean: cleanall
 	find . -name *.o -exec rm -f {} \;
 	find . -name "*.\~*" -exec rm -rf {} \;
 	rm -f include.mk
+	rm -f version.h
 	rm -f tun.c
 
 clean:
diff --git a/src/auth_algo.c b/src/auth_algo.c
index 69d4ec0..b148946 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/auth_algo.h b/src/auth_algo.h
index 1f08a3f..1007955 100644
--- a/src/auth_algo.h
+++ b/src/auth_algo.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index 21d16a4..a995c35 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -183,7 +183,7 @@ int tun_init_post(tun_device_t* dev)
   return 0;
 }
 
-#elif defined(__GNUC__) && defined(__FreeBSD__)
+#elif defined(__GNUC__) && (defined(__FreeBSD__) || defined(__FreeBSD_kernel__))
 
 int tun_init_post(tun_device_t* dev)
 {
@@ -318,7 +318,7 @@ void tun_do_ifconfig(tun_device_t* dev)
   if(dev->type_ == TYPE_TAP) {
 #if defined(__GNUC__) && defined(__OpenBSD__)
     end = "link0";
-#elif defined(__GNUC__) && defined(__FreeBSD__)
+#elif defined(__GNUC__) && (defined(__FreeBSD__) || defined(__FreeBSD_kernel__))
     end = "up";
 #elif defined(__GNUC__) && defined(__NetBSD__)
     end = NULL;
diff --git a/src/cipher.c b/src/cipher.c
index a91facb..8913f64 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/cipher.h b/src/cipher.h
index d65c761..e33d815 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/configure b/src/configure
index f4ed32d..ee80582 100755
--- a/src/configure
+++ b/src/configure
@@ -16,7 +16,7 @@
 #  tunneling and relaying of packets of any protocol.
 #  
 #
-#  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+#  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 #
 #  This file is part of uAnytun.
 #
@@ -43,7 +43,6 @@ LDFLAGS='-g -Wall -O2'
 
 CRYPTO_LIB='gcrypt'
 PASSPHRASE=1
-V4_MAPPED=1
 
 PREFIX='/usr/local'
 SBINDIR=''
@@ -67,9 +66,6 @@ print_usage() {
   echo "          --no-crypto               disable crypto at all (only NULL cipher)"
   echo "          --disable-passphrase      disable master key and salt passphrase"
   echo "          --enable-passphrase       enable master key and salt passphrase"
-  echo "          --disable-v4-mapped       disable V4-Mapped addresses (this means to disable"
-  echo "                                    simultanious use of IPv4 and IPv6)"
-  echo "          --enable-v4-mapped        enable V4-Mapped addresses"
 }
 
 for arg
@@ -111,12 +107,6 @@ do
   --enable-passphrase)
     PASSPHRASE=1
   ;;
-  --disable-v4-mapped)
-    V4_MAPPED=0 
-  ;; 
-  --enable-v4-mapped)
-    V4_MAPPED=2
-  ;; 
   --ebuild-compat)
     EBUILD_COMPAT=1
   ;;
@@ -139,7 +129,7 @@ if [ -n "$ERRORS" ] && [ $EBUILD_COMPAT -ne 1 ]; then
   exit 1
 fi
 
-
+rm -f version.h
 rm -f include.mk
 case $TARGET in 
   Linux)
@@ -147,18 +137,15 @@ case $TARGET in
     ln -sf linux/tun.c
     echo "loading Linux specific TUN Device"
   ;;
-  OpenBSD|FreeBSD|NetBSD)
+  OpenBSD|FreeBSD|NetBSD|GNU/kFreeBSD)
     rm -f tun.c
     ln -sf bsd/tun.c
     echo "loading BSD specific TUN Device"
     CFLAGS=$CFLAGS' -I/usr/local/include'
     LDFLAGS=$LDFLAGS' -L/usr/local/lib'
-    if [ $V4_MAPPED -ne 2 ]; then
-      V4_MAPPED=0
-    fi
   ;;
   *)
-    echo "Plattform not supported"
+    echo "platform not supported"
     exit 1;
   ;;
 esac
@@ -186,11 +173,6 @@ if [ $PASSPHRASE -eq 0 ]; then
   echo "disabling master key and salt passphrase"
 fi
 
-if [ $V4_MAPPED -eq 0 ]; then
-  CFLAGS=$CFLAGS' -DNO_V4MAPPED'
-  echo "WARNING: disabling V4 mapped addresses, this prevents uanytun from using IPv6 and IPv4 Sockets at the same time"
-fi
-
 if [ -z "$SBINDIR" ]; then
   SBINDIR=$PREFIX/sbin
 fi
@@ -238,4 +220,33 @@ else
   echo "not installing example files"
 fi
 
+VERSION=`cat ../version`
+if which svn >/dev/null; then
+  SVN_REV=`svn info | grep "^Revision: " | awk '{print($2)}'`
+  if [ -n "$SVN_REV" ]; then
+    VERSION="$VERSION (svn$SVN_REV)"
+  fi
+fi
+HOSTNAME=`hostname`
+DATE=`date +"%d.%m.%Y %H:%M:%S %Z"`
+
+cat >> version.h <<EOF
+/* 
+ * uanytun version info
+ *
+ * this file was created automatically
+ * do not edit this file directly
+ * use ./configure instead
+ */
+
+#ifndef UANYTUN_version_h_INCLUDED
+#define UANYTUN_version_h_INCLUDED
+
+#define VERSION_STRING_0 "uanytun version $VERSION"
+#define VERSION_STRING_1 "built on $HOSTNAME, $DATE"
+
+#endif
+
+EOF
+
 exit 0
diff --git a/src/daemon.h b/src/daemon.h
index 22e0ac0..04a4d4f 100644
--- a/src/daemon.h
+++ b/src/daemon.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -109,7 +109,7 @@ int priv_drop(priv_info_t* priv)
 int do_chroot(const char* chrootdir)
 {
   if(getuid() != 0) {
-    log_printf(ERROR, "this programm has to be run as root in order to run in a chroot");
+    log_printf(ERROR, "this program has to be run as root in order to run in a chroot");
     return -1;
   }
 
diff --git a/src/datatypes.h b/src/datatypes.h
index ae57112..0105062 100644
--- a/src/datatypes.h
+++ b/src/datatypes.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/encrypted_packet.c b/src/encrypted_packet.c
index c6db3d8..12f04ef 100644
--- a/src/encrypted_packet.c
+++ b/src/encrypted_packet.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/encrypted_packet.h b/src/encrypted_packet.h
index f654b2c..4afe323 100644
--- a/src/encrypted_packet.h
+++ b/src/encrypted_packet.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/init_crypt.h b/src/init_crypt.h
new file mode 100644
index 0000000..2461a54
--- /dev/null
+++ b/src/init_crypt.h
@@ -0,0 +1,93 @@
+/*
+ *  uAnytun
+ *
+ *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
+ *  featured implementation uAnytun has no support for multiple connections
+ *  or synchronisation. It is a small single threaded implementation intended
+ *  to act as a client on small platforms.
+ *  The secure anycast tunneling protocol (satp) defines a protocol used
+ *  for communication between any combination of unicast and anycast
+ *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
+ *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
+ *  ethernet, ip, arp ...). satp directly includes cryptography and
+ *  message authentication based on the methodes used by SRTP.  It is
+ *  intended to deliver a generic, scaleable and secure solution for
+ *  tunneling and relaying of packets of any protocol.
+ *  
+ *
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  This file is part of uAnytun.
+ *
+ *  uAnytun is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  any later version.
+ *
+ *  uAnytun is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UANYTUN_init_crypt_h_INCLUDED
+#define UANYTUN_init_crypt_h_INCLUDED
+
+#ifdef NO_CRYPT
+
+
+int init_crypt()
+{
+  return 0;
+}
+
+
+#else
+
+
+#ifndef USE_SSL_CRYPTO
+
+#include <gcrypt.h>
+
+#define MIN_GCRYPT_VERSION "1.2.0"
+
+int init_crypt() 
+{
+  if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
+    log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
+    return -1;
+  }
+
+  gcry_error_t err = gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
+  if(err) {
+    log_printf(ERROR, "failed to disable secure memory: %s", gcry_strerror(err));
+    return -1;
+  }
+
+  err = gcry_control(GCRYCTL_INITIALIZATION_FINISHED);
+  if(err) {
+    log_printf(ERROR, "failed to finish libgcrypt initialization: %s", gcry_strerror(err));
+    return -1;
+  }
+
+  log_printf(NOTICE, "libgcrypt init finished");
+  return 0;
+}
+
+#else
+
+int init_crypt()
+{
+// nothing here 
+  return 0;
+}
+
+#endif
+
+
+#endif
+
+#endif
diff --git a/src/key_derivation.c b/src/key_derivation.c
index 7e98416..a01695b 100644
--- a/src/key_derivation.c
+++ b/src/key_derivation.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/key_derivation.h b/src/key_derivation.h
index 7f75685..d037157 100644
--- a/src/key_derivation.h
+++ b/src/key_derivation.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/linux/tun.c b/src/linux/tun.c
index 10037ea..85cdc01 100644
--- a/src/linux/tun.c
+++ b/src/linux/tun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log.c b/src/log.c
index 43a0a5a..ae323e9 100644
--- a/src/log.c
+++ b/src/log.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log.h b/src/log.h
index 2717622..17de487 100644
--- a/src/log.h
+++ b/src/log.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log_targets.h b/src/log_targets.h
index 8db3812..4a19d8e 100644
--- a/src/log_targets.h
+++ b/src/log_targets.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/options.c b/src/options.c
index f5010bf..331a3c3 100644
--- a/src/options.c
+++ b/src/options.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -34,6 +34,7 @@
  */
 
 #include "datatypes.h"
+#include "version.h"
 
 #include "options.h"
 
@@ -233,6 +234,8 @@ int options_parse(options_t* opt, int argc, char* argv[])
 
     if(!strcmp(str,"-h") || !strcmp(str,"--help"))
       return -1;
+    else if(!strcmp(str,"-v") || !strcmp(str,"--version"))
+      return -5;
     PARSE_INVERSE_BOOL_PARAM("-D","--nodaemonize", opt->daemonize_)
     PARSE_STRING_PARAM("-u","--username", opt->username_)
     PARSE_STRING_PARAM("-g","--groupname", opt->groupname_)
@@ -242,6 +245,7 @@ int options_parse(options_t* opt, int argc, char* argv[])
     PARSE_STRING_PARAM("-p","--port", opt->local_port_)
     PARSE_INT_PARAM("-s","--sender-id", opt->sender_id_)
     PARSE_STRING_LIST("-L","--log", opt->log_targets_)
+    PARSE_BOOL_PARAM("-U", "--debug", opt->debug_)
     PARSE_STRING_PARAM("-r","--remote-host", opt->remote_addr_)
     PARSE_STRING_PARAM("-o","--remote-port", opt->remote_port_)
     PARSE_BOOL_PARAM("-4","--ipv4-only", ipv4_only)
@@ -274,6 +278,14 @@ int options_parse(options_t* opt, int argc, char* argv[])
   if(ipv6_only)
     opt->resolv_addr_type_ = IPV6_ONLY;
 
+  if(opt->debug_) {
+    string_list_add(&opt->log_targets_, "stdout:5");
+    opt->daemonize_ = 0;
+  }
+
+  if(!opt->log_targets_.first_)
+    string_list_add(&opt->log_targets_, "syslog:3,uanytun,daemon");
+
 #ifndef NO_CRYPT
   if(role) {
     if(!strcmp(role, "alice") || !strcmp(role, "server") || !strcmp(role, "left"))
@@ -295,13 +307,6 @@ void options_parse_post(options_t* opt)
   if(!opt)
     return;
 
-#ifdef NO_V4MAPPED
-  if(opt->resolv_addr_type_ == ANY) {
-    opt->resolv_addr_type_ = IPV4_ONLY;
-    log_printf(WARNING, "No support for V4-mapped Adresses on this platform, defaulting to only use IPv4 addresses");
-  }
-#endif
-
 #ifndef NO_CRYPT
   if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") && 
      strcmp(opt->kd_prf_, "null")) {
@@ -338,6 +343,7 @@ void options_default(options_t* opt)
   opt->chroot_dir_ = NULL;
   opt->pid_file_ = NULL;
   string_list_init(&opt->log_targets_);
+  opt->debug_ = 0;
   opt->local_addr_ = NULL;
   opt->local_port_ = strdup("4444");
   opt->sender_id_ = 0;
@@ -420,6 +426,7 @@ void options_print_usage()
 {
   printf("USAGE:\n");
   printf("uanytun [-h|--help]                         prints this...\n");
+  printf("        [-v|--version]                      print version info and exit\n");
   printf("        [-D|--nodaemonize]                  don't run in background\n");
   printf("        [-u|--username] <username>          change to this user\n");
   printf("        [-g|--groupname] <groupname>        change to this group\n");
@@ -430,6 +437,7 @@ void options_print_usage()
   printf("        [-s|--sender-id ] <sender id>       the sender id to use\n");
   printf("        [-L|--log] <target>:<level>[,<param1>[,<param2>..]]\n");
   printf("                                            add a log target, can be invoked several times\n");
+  printf("        [-U|--debug]                        don't daemonize and log to stdout with maximum log level\n");
 
   printf("        [-r|--remote-host] <hostname|ip>    remote host\n");
   printf("        [-o|--remote-port] <port>           remote port\n");
@@ -456,6 +464,12 @@ void options_print_usage()
 #endif
 }
 
+void options_print_version()
+{
+  printf("%s\n", VERSION_STRING_0);
+  printf("%s\n", VERSION_STRING_1);
+}
+
 void options_print(options_t* opt)
 {
   if(!opt)
@@ -469,6 +483,7 @@ void options_print(options_t* opt)
   printf("pid_file: '%s'\n", opt->pid_file_);
   printf("log_targets: \n");
   string_list_print(&opt->log_targets_, "  '", "'\n");
+  printf("debug: %s\n", !opt->debug_ ? "false" : "true");
   printf("local_addr: '%s'\n", opt->local_addr_);
   printf("local_port: '%s'\n", opt->local_port_);
   printf("sender_id: %d\n", opt->sender_id_);
diff --git a/src/options.h b/src/options.h
index ee7763d..ccc5044 100644
--- a/src/options.h
+++ b/src/options.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -58,6 +58,7 @@ struct options_struct {
   char* chroot_dir_;
   char* pid_file_;
   string_list_t log_targets_;
+  int debug_;
   char* local_addr_;
   char* local_port_;
   sender_id_t sender_id_;
diff --git a/src/plain_packet.c b/src/plain_packet.c
index 6995d42..29ba5fe 100644
--- a/src/plain_packet.c
+++ b/src/plain_packet.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/plain_packet.h b/src/plain_packet.h
index 6f1b385..0dc62b7 100644
--- a/src/plain_packet.h
+++ b/src/plain_packet.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/seq_window.c b/src/seq_window.c
index a855f68..0f58adb 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/seq_window.h b/src/seq_window.h
index 385cbdb..b699ee9 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sig_handler.c b/src/sig_handler.c
index ca2e18f..bed72ba 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -36,16 +36,13 @@
 #include "datatypes.h"
 
 #include "log.h"
+#include "sig_handler.h"
+
 #include <signal.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <sys/select.h>
 #include <errno.h>
 
-#include "sig_handler.h"
-
-#include <stdio.h>
-
 
 static int sig_pipe_fds[2];
 
diff --git a/src/sig_handler.h b/src/sig_handler.h
index 1995e1a..8219618 100644
--- a/src/sig_handler.h
+++ b/src/sig_handler.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/string_list.c b/src/string_list.c
index a4f4ab8..5e0ddf8 100644
--- a/src/string_list.c
+++ b/src/string_list.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/string_list.h b/src/string_list.h
index cd054cb..9e210ae 100644
--- a/src/string_list.h
+++ b/src/string_list.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sysexec.c b/src/sysexec.c
index 2cea52e..6e4e821 100644
--- a/src/sysexec.c
+++ b/src/sysexec.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sysexec.h b/src/sysexec.h
index 0aabde1..faed8eb 100644
--- a/src/sysexec.h
+++ b/src/sysexec.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/tun.h b/src/tun.h
index b74e0b1..230b88d 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/tun_helper.h b/src/tun_helper.h
index bd9b438..9d55267 100644
--- a/src/tun_helper.h
+++ b/src/tun_helper.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/uanytun.c b/src/uanytun.c
index 0e36781..53acbaf 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -56,49 +56,14 @@
 #ifndef NO_CRYPT
 #include "key_derivation.h"
 #include "auth_algo.h"
-
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#endif
+#else
+typedef u_int8_t auth_algo_t;
 #endif
-
+#include "init_crypt.h"
 
 #include "daemon.h"
 #include "sysexec.h"
 
-#ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-
-#define MIN_GCRYPT_VERSION "1.2.0"
-
-int init_libgcrypt()
-{
-  if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
-    log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
-    return -1;
-  }
-
-  gcry_error_t err = gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-  if(err) {
-    log_printf(ERROR, "failed to disable secure memory: %s", gcry_strerror(err));
-    return -1;
-  }
-
-  err = gcry_control(GCRYCTL_INITIALIZATION_FINISHED);
-  if(err) {
-    log_printf(ERROR, "failed to finish libgcrypt initialization: %s", gcry_strerror(err));
-    return -1;
-  }
-
-  log_printf(NOTICE, "libgcrypt init finished");
-  return 0;
-}
-#endif
-#endif
-
-#ifdef NO_CRYPT
-typedef u_int8_t auth_algo_t;
-#endif
 
 int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_win_t* seq_win)
 {
@@ -138,7 +103,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
   return 0;
 }
 
-int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
+int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
                      cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t seq_nr)
 {
   plain_packet_set_payload_length(plain_packet, -1);
@@ -167,7 +132,7 @@ int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plai
 #ifndef NO_CRYPT
   auth_algo_generate(aa, kd, kd_outbound, encrypted_packet);
 #endif
-  
+ 
   len = udp_write(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet));
   if(len == -1)
     log_printf(ERROR, "error on sending udp packet: %s", strerror(errno));
@@ -175,7 +140,7 @@ int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plai
   return 0;
 }
 
-int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
+int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
                       cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_win_t* seq_win)
 {
   plain_packet_set_payload_length(plain_packet, -1);
@@ -183,13 +148,13 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
 
   udp_endpoint_t remote;
   memset(&remote, 0, sizeof(udp_endpoint_t));
-  int len = udp_read(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet), &remote);
+  int len = udp_read(sock, fd, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet), &remote);
   if(len == -1) {
     log_printf(ERROR, "error on receiving udp packet: %s", strerror(errno));
     return 0;
   }
   else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
-    log_printf(WARNING, "received packet is to short");
+    log_printf(WARNING, "received packet is too short");
     return 0;
   }
   encrypted_packet_set_length(encrypted_packet, len);
@@ -216,6 +181,7 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
     return -2;
   }
    
+  udp_set_active_sock(sock, fd);
   if(memcmp(&remote, &(sock->remote_end_), sizeof(remote))) {
     memcpy(&(sock->remote_end_), &remote, sizeof(remote));
     sock->remote_end_set_ = 1;
@@ -241,7 +207,7 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
 }
 
 
-int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
+int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
 {
   log_printf(INFO, "entering main loop");
 
@@ -263,8 +229,8 @@ int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
 
   FD_ZERO(&readfds);
   FD_SET(dev->fd_, &readfds);
-  FD_SET(sock->fd_, &readfds);
-  int nfds = dev->fd_ > sock->fd_ ? dev->fd_ : sock->fd_;
+  int nfds = udp_init_fd_set(sock, &readfds);
+  nfds = dev->fd_ > nfds ? dev->fd_ : nfds;
 
   int return_value = 0;
   int sig_fd = signal_init();
@@ -299,10 +265,14 @@ int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
         break;
     }
 
-    if(FD_ISSET(sock->fd_, &readyfds)) {
-      return_value = process_sock_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
-      if(return_value)
-        break;
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if(FD_ISSET(s->fd_, &readyfds)) {
+        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
+        if(return_value)
+          break;
+      }
+      s = s->next_;
     }
   }
 
@@ -336,35 +306,36 @@ int main(int argc, char* argv[])
     if(ret == -4) {
       fprintf(stderr, "syntax error: unknown role name\n\n");
     }
+    if(ret == -5) {
+      options_print_version();
+    }
 
-    if(ret != -2) 
+    if(ret != -2 && ret != -5) 
       options_print_usage();
 
+    if(ret == -1 || ret == -5)
+      ret = 0;
+
     options_clear(&opt);
     log_close();
     exit(ret);
   }
   string_list_element_t* tmp = opt.log_targets_.first_;
-  if(!tmp) {
-    log_add_target("syslog:3,uanytun,daemon");
-  }
-  else {
-    while(tmp) {
-      ret = log_add_target(tmp->string_);
-      if(ret) {
-        switch(ret) {
-        case -2: fprintf(stderr, "memory error on log_add_target, exitting\n"); break;
-        case -3: fprintf(stderr, "unknown log target: '%s', exitting\n", tmp->string_); break;
-        case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
-        default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
-        }
-        
-        options_clear(&opt);
-        log_close();
-        exit(ret);
+  while(tmp) {
+    ret = log_add_target(tmp->string_);
+    if(ret) {
+      switch(ret) {
+      case -2: fprintf(stderr, "memory error on log_add_target, exitting\n"); break;
+      case -3: fprintf(stderr, "unknown log target: '%s', exitting\n", tmp->string_); break;
+      case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
+      default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
       }
-      tmp = tmp->next_;
+        
+      options_clear(&opt);
+      log_close();
+      exit(ret);
     }
+    tmp = tmp->next_;
   }
 
   log_printf(NOTICE, "just started...");
@@ -378,17 +349,13 @@ int main(int argc, char* argv[])
       exit(-1);
     }
 
-#ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-  ret = init_libgcrypt();
+  ret = init_crypt();
   if(ret) {
-    log_printf(ERROR, "error on libgcrpyt initialization, exitting");
+    log_printf(ERROR, "error on crpyto initialization, exitting");
     options_clear(&opt);
     log_close();
     exit(ret);
   }
-#endif
-#endif
 
   tun_device_t dev;
   ret = tun_init(&dev, opt.dev_name_, opt.dev_type_, opt.ifconfig_param_.net_addr_, opt.ifconfig_param_.prefix_length_);
@@ -408,7 +375,7 @@ int main(int argc, char* argv[])
   }
 
 
-  udp_socket_t sock;
+  udp_t sock;
   ret = udp_init(&sock, opt.local_addr_, opt.local_port_, opt.resolv_addr_type_);
   if(ret) {
     log_printf(ERROR, "error on udp_init, exitting");
@@ -417,12 +384,6 @@ int main(int argc, char* argv[])
     log_close();
     exit(ret);
   }
-  char* local_string = udp_get_local_end_string(&sock);
-  if(local_string) {
-    log_printf(NOTICE, "listening on: %s", local_string);
-    free(local_string);
-  }
-
 
   if(opt.remote_addr_) {
     if(!udp_set_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
diff --git a/src/udp.c b/src/udp.c
index 7f539a8..3e1def6 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -49,14 +49,14 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !port) 
     return -1;
- 
-  sock->fd_ = 0;
-  memset(&(sock->local_end_), 0, sizeof(sock->local_end_));
-  memset(&(sock->remote_end_), 0, sizeof(sock->local_end_));
+
+  sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
+  memset(&(sock->remote_end_), 0, sizeof(sock->remote_end_));
   sock->remote_end_set_ = 0;
 
   struct addrinfo hints, *res;
@@ -64,12 +64,12 @@ int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resol
   res = NULL;
   memset (&hints, 0, sizeof (hints));
   hints.ai_socktype = SOCK_DGRAM;
-  hints.ai_flags |= AI_PASSIVE;
+  hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG;
 
   switch(resolv_type) {
-  case IPV4_ONLY: hints.ai_family = PF_INET; break;
-  case IPV6_ONLY: hints.ai_family = PF_INET6; break;
-  default: hints.ai_family = PF_UNSPEC; break;
+  case IPV4_ONLY: hints.ai_family = AF_INET; break;
+  case IPV6_ONLY: hints.ai_family = AF_INET6; break;
+  default: hints.ai_family = AF_UNSPEC; break;
   }
 
   int errcode = getaddrinfo(local_addr, port, &hints, &res);
@@ -78,46 +78,86 @@ int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resol
     udp_close(sock);
     return -1;
   }
-
   if(!res) {
     udp_close(sock);
     log_printf(ERROR, "getaddrinfo returned no address for %s:%s", local_addr, port);
     return -1;
   }
 
-  memcpy(&(sock->local_end_), res->ai_addr, res->ai_addrlen);
+  struct addrinfo* r = res;
+  udp_socket_t* prev_sock = NULL;
+  while(r) {
+    udp_socket_t* new_sock = malloc(sizeof(udp_socket_t));
+    if(!new_sock) {
+      log_printf(ERROR, "memory error at udp_init");
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -2;
+    }
+    memset(&(new_sock->local_end_), 0, sizeof(new_sock->local_end_));
+    new_sock->next_ = NULL;
+
+    if(!sock->socks_) {
+      sock->socks_ = new_sock;
+      prev_sock = new_sock;
+    }
+    else {
+      prev_sock->next_ = new_sock;
+      prev_sock = new_sock;
+    }
+    
+    memcpy(&(new_sock->local_end_), r->ai_addr, r->ai_addrlen);
+    new_sock->fd_ = socket(r->ai_family, SOCK_DGRAM, 0);
+    if(new_sock->fd_ < 0) {
+      log_printf(ERROR, "Error on opening udp socket: %s", strerror(errno));
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -1;
+    }
+
+    if(r->ai_family == AF_INET6) {
+      int on = 1;
+      if(setsockopt(new_sock->fd_, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)))
+        log_printf(ERROR, "Error on setting IPV6_V6ONLY socket option: %s", strerror(errno));
+    }
+
+    errcode = bind(new_sock->fd_, r->ai_addr, r->ai_addrlen);
+    if(errcode) {
+      log_printf(ERROR, "Error on binding udp socket: %s", strerror(errno));
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -1;
+    }
+  
+    char* local_string = udp_endpoint_to_string(new_sock->local_end_);
+    if(local_string) {
+      log_printf(NOTICE, "listening on: %s", local_string);
+      free(local_string);
+    }
 
-  sock->fd_ = socket(res->ai_family, SOCK_DGRAM, 0);
-  if(sock->fd_ < 0) {
-    log_printf(ERROR, "Error on opening udp socket: %s", strerror(errno));
-    freeaddrinfo(res);
-    udp_close(sock);
-    return -1;
+    r = r->ai_next;
   }
 
-  errcode = bind(sock->fd_, res->ai_addr, res->ai_addrlen);
-  if(errcode) {
-    log_printf(ERROR, "Error on binding udp socket: %s", strerror(errno));
-    freeaddrinfo(res);
-    udp_close(sock);
-    return -1;
-  }
-  
-/* this doesn't work on linux ?? */
-/* #ifdef NO_V4MAPPED */
-/*   if(res->ai_family == AF_INET6) { */
-/*     log_printf(NOTICE, "disabling V4-Mapped addresses"); */
-/*     int on = 1; */
-/*     if(setsockopt(sock->fd_, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on))) */
-/*       log_printf(ERROR, "Error on setting IPV6_V6ONLY socket option: %s", strerror(errno)); */
-/*   } */
-/* #endif */
   freeaddrinfo(res);
 
   return 0;
 }
 
-int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_init_fd_set(udp_t* sock, fd_set* set)
+{
+  int max_fd = 0;
+
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    FD_SET(s->fd_, set);
+    max_fd = s->fd_ > max_fd ? s->fd_ : max_fd;
+    s = s->next_;
+  }
+
+  return max_fd;
+}
+
+int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !remote_addr || !port) 
     return -1;
@@ -145,18 +185,53 @@ int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port
   }
   memcpy(&(sock->remote_end_), res->ai_addr, res->ai_addrlen);
   sock->remote_end_set_ = 1;
+
+  if(!sock->active_sock_) {
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if((((struct sockaddr *)&s->local_end_)->sa_family) == res->ai_family) {
+        sock->active_sock_ = s;
+        break;
+      }
+      s = s->next_;
+    }
+  }
+
   freeaddrinfo(res);
 
   return 0;
 }
 
-void udp_close(udp_socket_t* sock)
+void udp_set_active_sock(udp_t* sock, int fd)
+{
+  if(!sock || (sock->active_sock_ && sock->active_sock_->fd_ == fd))
+    return;
+
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    if(s->fd_ == fd) {
+      sock->active_sock_ = s;
+      return;
+    }
+    s = s->next_;
+  }
+}
+
+void udp_close(udp_t* sock)
 {
   if(!sock)
     return;
 
-  if(sock->fd_ > 0)
-    close(sock->fd_);
+  while(sock->socks_) {
+    if(sock->socks_->fd_ > 0)
+      close(sock->socks_->fd_);
+    
+    udp_socket_t*s = sock->socks_;
+    sock->socks_ = sock->socks_->next_;
+    
+    free(s);
+  }
+  sock->socks_ = NULL;
 }
 
 char* udp_endpoint_to_string(udp_endpoint_t e)
@@ -194,15 +269,7 @@ char* udp_endpoint_to_string(udp_endpoint_t e)
   return ret;
 }
 
-char* udp_get_local_end_string(udp_socket_t* sock)
-{
-  if(!sock)
-    return NULL;
-
-  return udp_endpoint_to_string(sock->local_end_);
-}
-
-char* udp_get_remote_end_string(udp_socket_t* sock)
+char* udp_get_remote_end_string(udp_t* sock)
 {
   if(!sock || !sock->remote_end_set_)
     return NULL;
@@ -210,27 +277,26 @@ char* udp_get_remote_end_string(udp_socket_t* sock)
   return udp_endpoint_to_string(sock->remote_end_);
 }
  
-int udp_read(udp_socket_t* sock, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
+int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
 {
   if(!sock || !remote_end)
     return -1;
 
   socklen_t socklen = sizeof(*remote_end);
-  return recvfrom(sock->fd_, buf, len, 0, (struct sockaddr *)remote_end, &socklen);
+  return recvfrom(fd, buf, len, 0, (struct sockaddr *)remote_end, &socklen);
 }
 
-int udp_write(udp_socket_t* sock, u_int8_t* buf, u_int32_t len)
+int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
 {
-  if(!sock || !sock->remote_end_set_)
-    return -1;
+  if(!sock || !sock->remote_end_set_ || !sock->active_sock_)
+    return 0;
 
   socklen_t socklen = sizeof(sock->remote_end_);
-#ifdef NO_V4MAPPED
-  if((((struct sockaddr *)&sock->local_end_)->sa_family) == AF_INET)
+  if((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET)
     socklen = sizeof(struct sockaddr_in);
-  else if ((((struct sockaddr *)&sock->local_end_)->sa_family) == AF_INET6)
+  else if ((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET6)
     socklen = sizeof(struct sockaddr_in6);
-#endif
-  return sendto(sock->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_), socklen);;
+
+  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_), socklen);
 }
 
diff --git a/src/udp.h b/src/udp.h
index 02a1c26..edf0160 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -46,20 +46,28 @@ typedef struct sockaddr_storage udp_endpoint_t;
 struct udp_socket_struct {
   int fd_;
   udp_endpoint_t local_end_;
+  struct udp_socket_struct* next_;
+};
+typedef struct udp_socket_struct udp_socket_t;
+
+struct udp_struct {
+  udp_socket_t* socks_;
+  udp_socket_t* active_sock_;
   udp_endpoint_t remote_end_;
   int remote_end_set_;
 };
-typedef struct udp_socket_struct udp_socket_t;
+typedef struct udp_struct udp_t;
 
-int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
-int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
-void udp_close(udp_socket_t* sock);
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
+int udp_init_fd_set(udp_t* sock, fd_set* set);
+int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
+void udp_set_active_sock(udp_t* sock, int fd);
+void udp_close(udp_t* sock);
 
 char* udp_endpoint_to_string(udp_endpoint_t e);
-char* udp_get_local_end_string(udp_socket_t* sock);
-char* udp_get_remote_end_string(udp_socket_t* sock);
+char* udp_get_remote_end_string(udp_t* sock);
 
-int udp_read(udp_socket_t* sock, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
-int udp_write(udp_socket_t* sock, u_int8_t* buf, u_int32_t len);
+int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
+int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len);
 
 #endif
diff --git a/version b/version
index d15723f..1c09c74 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-0.3.2
+0.3.3
-- 
2.1.4


From 4d61c93845abce1e45c4a41562ecb3fa4e3bdcc3 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 17 Feb 2010 03:06:17 +0100
Subject: [PATCH 09/16] Imported Upstream version 0.3.3

---
 ChangeLog              |   8 +
 README                 |   5 +-
 doc/Makefile           |   7 +-
 doc/uanytun.8          | 420 +++++++++++++++++++++++++++++++++++++++++++++++++
 doc/uanytun.8.txt      | 103 ++++++------
 etc/init.d/uanytun     |  54 +++----
 src/Makefile           |   3 +-
 src/auth_algo.c        |   2 +-
 src/auth_algo.h        |   2 +-
 src/bsd/tun.c          |   2 +-
 src/cipher.c           |   2 +-
 src/cipher.h           |   2 +-
 src/configure          |  53 ++++---
 src/daemon.h           |   4 +-
 src/datatypes.h        |   2 +-
 src/encrypted_packet.c |   2 +-
 src/encrypted_packet.h |   2 +-
 src/init_crypt.h       |  93 +++++++++++
 src/key_derivation.c   |   2 +-
 src/key_derivation.h   |   2 +-
 src/linux/tun.c        |   2 +-
 src/log.c              |   2 +-
 src/log.h              |   2 +-
 src/log_targets.h      |   2 +-
 src/options.c          |  31 +++-
 src/options.h          |   3 +-
 src/plain_packet.c     |   2 +-
 src/plain_packet.h     |   2 +-
 src/seq_window.c       |   2 +-
 src/seq_window.h       |   2 +-
 src/sig_handler.c      |   9 +-
 src/sig_handler.h      |   2 +-
 src/string_list.c      |   2 +-
 src/string_list.h      |   2 +-
 src/sysexec.c          |   2 +-
 src/sysexec.h          |   2 +-
 src/tun.h              |   2 +-
 src/tun_helper.h       |   2 +-
 src/uanytun.c          | 127 ++++++---------
 src/udp.c              | 182 ++++++++++++++-------
 src/udp.h              |  26 +--
 version                |   2 +-
 42 files changed, 885 insertions(+), 295 deletions(-)
 create mode 100644 doc/uanytun.8
 create mode 100644 src/init_crypt.h

diff --git a/ChangeLog b/ChangeLog
index edeb953..33d4752 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010.02.16 -- Version 0.3.3
+
+* added -v|--version option
+* added prebuilt manpage to release tarball (less build deps)
+* added multi socket support which allows simultanous usage
+  of IPv4 and IPv6 even on operating systems without V4_MAPPED
+  address support
+
 2009.12.02 -- Version 0.3.2
 
 * clenaups and improvements at configure and install target of Makefile
diff --git a/README b/README
index 00a88bc..1c70648 100644
--- a/README
+++ b/README
@@ -8,6 +8,7 @@ issues when using this library. It also needs more space when installed.
 
 Linux
 -----
+(this includes Debian with FreeBSD Kernel)
 
 using libgcrypt:
  
@@ -19,7 +20,7 @@ using ssl crypto library:
  build-essential
  libssl-dev
 
-only for manpage:
+if you want to rebuild the manpage:
 
  asciidoc
 
@@ -36,7 +37,7 @@ using ssl crypto library:
 
  devel/gmake
 
-only for manpage:
+if you want to rebuild the manpage:
 
  textproc/asciidoc
  textproc/libxslt
diff --git a/doc/Makefile b/doc/Makefile
index 97db23e..b5eecb8 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -15,7 +15,7 @@
 ##  tunneling and relaying of packets of any protocol.
 ##  
 ##
-##  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -49,4 +49,7 @@ uanytun.8: uanytun.8.txt
 manpage: uanytun.8
 
 clean:
-	rm -f uanytun.8 uanytun.8.xml
+	rm -f uanytun.8.xml
+
+realclean: clean
+	rm -f uanytun.8
diff --git a/doc/uanytun.8 b/doc/uanytun.8
new file mode 100644
index 0000000..7126c00
--- /dev/null
+++ b/doc/uanytun.8
@@ -0,0 +1,420 @@
+'\" t
+.\"     Title: uanytun
+.\"    Author: [see the "AUTHORS" section]
+.\" Generator: DocBook XSL Stylesheets v1.75.1 <http://docbook.sf.net/>
+.\"      Date: 02/17/2010
+.\"    Manual: uanytun user manual
+.\"    Source: uanytun 0.3.3
+.\"  Language: English
+.\"
+.TH "UANYTUN" "8" "02/17/2010" "uanytun 0.3.3" "uanytun user manual"
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+uanytun \- micro anycast tunneling daemon
+.SH "SYNOPSIS"
+.sp
+.nf
+\fBuanytun\fR
+  [ \fB\-h|\-\-help\fR ]
+  [ \fB\-D|\-\-nodaemonize\fR ]
+  [ \fB\-u|\-\-username\fR <username> ]
+  [ \fB\-g|\-\-groupname\fR <groupname> ]
+  [ \fB\-C|\-\-chroot\fR <path> ]
+  [ \fB\-P|\-\-write\-pid\fR <filename> ]
+  [ \fB\-L|\-\-log\fR <target>:<level>[,<param1>[,<param2>[\&.\&.]]] ]
+  [ \fB\-U|\-\-debug\fR ]
+  [ \fB\-i|\-\-interface\fR <ip\-address> ]
+  [ \fB\-p|\-\-port\fR <port> ]
+  [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
+  [ \fB\-o|\-\-remote\-port\fR <port> ]
+  [ \fB\-4|\-\-ipv4\-only\fR ]
+  [ \fB\-6|\-\-ipv6\-only\fR ]
+  [ \fB\-d|\-\-dev\fR <name> ]
+  [ \fB\-t|\-\-type\fR <tun|tap> ]
+  [ \fB\-n|\-\-ifconfig\fR <local>/<prefix> ]
+  [ \fB\-x|\-\-post\-up\-script\fR <script> ]
+  [ \fB\-m|\-\-mux\fR <mux\-id> ]
+  [ \fB\-s|\-\-sender\-id\fR <sender id> ]
+  [ \fB\-w|\-\-window\-size\fR <window size> ]
+  [ \fB\-k|\-\-kd\-prf\fR <kd\-prf type> ]
+  [ \fB\-e|\-\-role\fR <role> ]
+  [ \fB\-E|\-\-passphrase\fR <pass phrase> ]
+  [ \fB\-K|\-\-key\fR <master key> ]
+  [ \fB\-A|\-\-salt\fR <master salt> ]
+  [ \fB\-c|\-\-cipher\fR <cipher type> ]
+  [ \fB\-a|\-\-auth\-algo\fR <algo type> ]
+  [ \fB\-b|\-\-auth\-tag\-length\fR <length> ]
+.fi
+.SH "DESCRIPTION"
+.sp
+\fBuAnytun\fR is a tiny implementation of the Secure Anycast Tunneling Protocol (SATP)\&. It provides a complete VPN solution similar to OpenVPN or IPsec in tunnel mode\&. The main difference is that anycast enables the setup of tunnels between an arbitrary combination of anycast, unicast and multicast hosts\&. Unlike Anytun which is a full featured implementation uAnytun has no support for multiple connections or synchronisation\&. It is a small single threaded implementation intended to act as a client on small platforms\&.
+.SH "OPTIONS"
+.sp
+\fBuAnytun\fR has been designed as a peer to peer application, so there is no difference between client and server\&. The following options can be passed to the daemon:
+.PP
+\fB\-D, \-\-nodaemonize\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in foreground instead of becoming a daemon which is the default\&.
+.RE
+.PP
+\fB\-u, \-\-username \fR\fB\fI<username>\fR\fR
+.RS 4
+run as this user\&. If no group is specified (\fB\-g\fR) the default group of the user is used\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-g, \-\-groupname \fR\fB\fI<groupname>\fR\fR
+.RS 4
+run as this group\&. If no username is specified (\fB\-u\fR) this gets ignored\&. The default is to not drop privileges\&.
+.RE
+.PP
+\fB\-C, \-\-chroot \fR\fB\fI<path>\fR\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to run in a chroot jail\&. The default is to not run in chroot\&.
+.RE
+.PP
+\fB\-P, \-\-write\-pid <filename>\fR
+.RS 4
+Instruct
+\fBuAnytun\fR
+to write it\(cqs pid to this file\&. The default is to not create a pid file\&.
+.RE
+.PP
+\fB\-L, \-\-log \fR\fB\fI<target>:<level>[,<param1>[,<param2>[\&.\&.]]]\fR\fR
+.RS 4
+add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
+
+The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config
+\fIsyslog:3,uanytun,daemon\fR
+is added\&.
+
+The following targets are supported:
+.PP
+\fIsyslog\fR
+.RS 4
+log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+.RE
+.PP
+\fIfile\fR
+.RS 4
+log to file, parameters <level>[,<path>]
+.RE
+.PP
+\fIstdout\fR
+.RS 4
+log to standard output, parameters <level>
+.RE
+.PP
+\fIstderr\fR
+.RS 4
+log to standard error, parameters <level>
+.RE
+.RE
+.PP
+\fB\-U, \-\-debug\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run in debug mode\&. It implicits
+\fB\-D\fR
+(don\(cqt daemonize) and adds a log target with the configuration
+\fIstdout:5\fR
+(logging with maximum level)\&. In future releases there might be additional output when this option is supplied\&.
+.RE
+.PP
+\fB\-i, \-\-interface \fR\fB\fI<ip address>\fR\fR
+.RS 4
+This IP address is used as the sender address for outgoing packets\&. The default is to not use a special inteface and just bind on all interfaces\&.
+.RE
+.PP
+\fB\-p, \-\-port \fR\fB\fI<port>\fR\fR
+.RS 4
+The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. default: 4444
+.RE
+.PP
+\fB\-r, \-\-remote\-host \fR\fB\fI<hostname|ip>\fR\fR
+.RS 4
+This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-o, \-\-remote\-port \fR\fB\fI<port>\fR\fR
+.RS 4
+The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&.
+.RE
+.PP
+\fB\-4, \-\-ipv4\-only\fR
+.RS 4
+Resolv to IPv4 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-6, \-\-ipv6\-only\fR
+.RS 4
+Resolv to IPv6 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
+.RE
+.PP
+\fB\-d, \-\-dev \fR\fB\fI<name>\fR\fR
+.RS 4
+device name
+
+By default, tapN is used for Ethernet tunnel interfaces, and tunN for IP tunnels, respectively\&. This option can be used to manually override these defaults\&.
+.RE
+.PP
+\fB\-t, \-\-type \fR\fB\fI<tun|tap>\fR\fR
+.RS 4
+device type
+
+Type of the tunnels to create\&. Use tap for Ethernet tunnels, tun for IP tunnels\&.
+.RE
+.PP
+\fB\-n, \-\-ifconfig \fR\fB\fI<local>/<prefix>\fR\fR
+.RS 4
+The local IP address and prefix length\&. The remote tunnel endpoint has to use a different IP address in the same subnet\&.
+.PP
+\fI<local>\fR
+.RS 4
+the local IP address for the tun/tap device
+.RE
+.PP
+\fI<prefix>\fR
+.RS 4
+the prefix length of the network
+.RE
+.RE
+.PP
+\fB\-x, \-\-post\-up\-script \fR\fB\fI<script>\fR\fR
+.RS 4
+This option instructs
+\fBuAnytun\fR
+to run this script after the interface is created\&. By default no script will be executed\&.
+.RE
+.PP
+\fB\-m, \-\-mux \fR\fB\fI<mux\-id>\fR\fR
+.RS 4
+the multiplex id to use\&. default: 0
+.RE
+.PP
+\fB\-s, \-\-sender\-id \fR\fB\fI<sender id>\fR\fR
+.RS 4
+Each anycast tunnel endpoint needs a unique sender id (1, 2, 3, \&...)\&. It is needed to distinguish the senders in case of replay attacks\&. As
+\fBuAnytun\fR
+does not support synchronisation it can\(cqt be used as an anycast endpoint therefore this option is quite useless but implemented for compatibility reasons\&. default: 0
+.RE
+.PP
+\fB\-w, \-\-window\-size \fR\fB\fI<window size>\fR\fR
+.RS 4
+seqence window size
+
+Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
+.RE
+.PP
+\fB\-k, \-\-kd\(emprf \fR\fB\fI<kd\-prf type>\fR\fR
+.RS 4
+key derivation pseudo random function
+
+The pseudo random function which is used for calculating the session keys and session salt\&.
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no random function, keys and salt are set to 0\&.\&.00
+.RE
+.PP
+\fIaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fIaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fIaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fIaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-e, \-\-role \fR\fB\fI<role>\fR\fR
+.RS 4
+SATP uses different session keys for inbound and outbound traffic\&. The role parameter is used to determine which keys to use for outbound or inbound packets\&. On both sides of a vpn connection different roles have to be used\&. Possible values are
+\fIleft\fR
+and
+\fIright\fR\&. You may also use
+\fIalice\fR
+or
+\fIserver\fR
+as a replacement for
+\fIleft\fR
+and
+\fIbob\fR
+or
+\fIclient\fR
+as a replacement for
+\fIright\fR\&. By default
+\fIleft\fR
+is used\&.
+.RE
+.PP
+\fB\-E, \-\-passphrase \fR\fB\fI<pass phrase>\fR\fR
+.RS 4
+This passphrase is used to generate the master key and master salt\&. For the master key the last n bits of the SHA256 digest of the passphrase (where n is the length of the master key in bits) is used\&. The master salt gets generated with the SHA1 digest\&. You may force a specific key and or salt by using
+\fB\-\-key\fR
+and
+\fB\-\-salt\fR\&.
+.RE
+.PP
+\fB\-K, \-\-key \fR\fB\fI<master key>\fR\fR
+.RS 4
+master key to use for key derivation
+
+Master key in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits)\&.
+.RE
+.PP
+\fB\-A, \-\-salt \fR\fB\fI<master salt>\fR\fR
+.RS 4
+master salt to use for key derivation
+
+Master salt in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes)\&.
+.RE
+.PP
+\fB\-c, \-\-cipher \fR\fB\fI<cipher type>\fR\fR
+.RS 4
+payload encryption algorithm
+
+Encryption algorithm used for encrypting the payload
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no encryption
+.RE
+.PP
+\fIaes\-ctr\fR
+.RS 4
+AES in counter mode with 128 Bits, default value
+.RE
+.PP
+\fIaes\-ctr\-128\fR
+.RS 4
+AES in counter mode with 128 Bits
+.RE
+.PP
+\fIaes\-ctr\-192\fR
+.RS 4
+AES in counter mode with 192 Bits
+.RE
+.PP
+\fIaes\-ctr\-256\fR
+.RS 4
+AES in counter mode with 256 Bits
+.RE
+.RE
+.PP
+\fB\-a, \-\-auth\-algo \fR\fB\fI<algo type>\fR\fR
+.RS 4
+message authentication algorithm
+
+This option sets the message authentication algorithm\&.
+
+If HMAC\-SHA1 is used, the packet length is increased\&. The additional bytes contain the authentication data\&. see
+\fB\-\-auth\-tag\-length\fR
+for more info\&.
+
+Possible values:
+.PP
+\fInull\fR
+.RS 4
+no message authentication
+.RE
+.PP
+\fIsha1\fR
+.RS 4
+HMAC\-SHA1, default value
+.RE
+.RE
+.PP
+\fB\-b, \-\-auth\-tag\-length \fR\fB\fI<length>\fR\fR
+.RS 4
+The number of bytes to use for the auth tag\&. This value defaults to 10 bytes unless the
+\fInull\fR
+auth algo is used in which case it defaults to 0\&.
+.RE
+.SH "EXAMPLES"
+.SS "P2P Setup between two unicast enpoints:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost A:\fR
+.RS 4
+.sp
+uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBHost B:\fR
+.RS 4
+.sp
+uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
+.RE
+.SS "One unicast and one anycast tunnel endpoint:"
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBUnicast tunnel endpoint:\fR
+.RS 4
+.sp
+uanytun \-r anycast\&.anytun\&.org \-d anytun0 \-t tun \-n 192\&.0\&.2\&.2/30 \-a null \-c null \-w 0 \-e client
+.RE
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBAnycast tunnel endpoints:\fR
+.RS 4
+.sp
+As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for this purpose\&. You have to use \fBAnytun\fR for that job\&.
+.RE
+.SH "BUGS"
+.sp
+Most likely there are some bugs in \fBuAnytun\fR\&. If you find a bug, please let the developers know at uanytun@anytun\&.org\&. Of course, patches are preferred\&.
+.SH "AUTHORS"
+.sp
+Christian Pointner <equinox@anytun\&.org>
+.SH "RESOURCES"
+.sp
+Main web site: http://www\&.anytun\&.org/
+.SH "COPYING"
+.sp
+Copyright (C) 2008\-2010 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 1ed21ca..6fde9d2 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -19,6 +19,7 @@ uanytun
   [ -C|--chroot <path> ]
   [ -P|--write-pid <filename> ]
   [ -L|--log <target>:<level>[,<param1>[,<param2>[..]]] ]
+  [ -U|--debug ]
   [ -i|--interface <ip-address> ]
   [ -p|--port <port> ]
   [ -r|--remote-host <hostname|ip> ]
@@ -67,15 +68,15 @@ passed to the daemon:
    This option instructs *uAnytun* to run in foreground
    instead of becoming a daemon which is the default.
 
-*-u, --username <username>*::
+*-u, --username '<username>'*::
    run as this user. If no group is specified (*-g*) the default group of 
    the user is used. The default is to not drop privileges.
 
-*-g, --groupname <groupname>*::
+*-g, --groupname '<groupname>'*::
    run as this group. If no username is specified (*-u*) this gets ignored.
    The default is to not drop privileges.
 
-*-C, --chroot <path>*::
+*-C, --chroot '<path>'*::
    Instruct *uAnytun* to run in a chroot jail. The default is 
    to not run in chroot.
 
@@ -83,39 +84,45 @@ passed to the daemon:
    Instruct *uAnytun* to write it's pid to this file. The default is 
    to not create a pid file.
 
-*-L, --log <target>:<level>[,<param1>[,<param2>[..]]]*::
+*-L, --log '<target>:<level>[,<param1>[,<param2>[..]]]'*::
    add log target to logging system. This can be invoked several times
    in order to log to different targets at the same time. Every target 
    hast its own log level which is a number between 0 and 5. Where 0 means
    disabling log and 5 means debug messages are enabled. +
    The file target can be used more the once with different levels.
    If no target is provided at the command line a single target with the 
-   config *syslog:3,uanytun,daemon* is added. +
+   config 'syslog:3,uanytun,daemon' is added. +
    The following targets are supported:
 
-   *syslog*;; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
-   *file*;; log to file, parameters <level>[,<path>]
-   *stdout*;; log to standard output, parameters <level>
-   *stderr*;; log to standard error, parameters <level> 
+   'syslog';; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+   'file';; log to file, parameters <level>[,<path>]
+   'stdout';; log to standard output, parameters <level>
+   'stderr';; log to standard error, parameters <level> 
 
-*-i, --interface <ip address>*::
+*-U, --debug*::
+   This option instructs *uAnytun* to run in debug mode. It implicits *-D* 
+   (don't daemonize) and adds a log target with the configuration
+   'stdout:5' (logging with maximum level). In future releases there might
+   be additional output when this option is supplied.
+
+*-i, --interface '<ip address>'*::
    This IP address is used as the sender address for outgoing
    packets. The default is to not use a special inteface and just
    bind on all interfaces.
 
-*-p, --port <port>*::
+*-p, --port '<port>'*::
    The local UDP port that is used to send and receive the
    payload data. The two tunnel endpoints can use different
    ports. default: 4444
 
-*-r, --remote-host <hostname|ip>*::
+*-r, --remote-host '<hostname|ip>'*::
    This option can be used to specify the remote tunnel
    endpoint. In case of anycast tunnel endpoints, the
    anycast IP address has to be used. If you do not specify
    an address, it is automatically determined after receiving
    the first data packet.
 
-*-o, --remote-port <port>*::
+*-o, --remote-port '<port>'*::
    The UDP port used for payload data by the remote host
    (specified with -p on the remote host). If you do not specify
    a port, it is automatically determined after receiving
@@ -129,40 +136,40 @@ passed to the daemon:
    Resolv to IPv6 addresses only. The default is to resolv both
    IPv4 and IPv6 addresses.
 
-*-d, --dev <name>*::
+*-d, --dev '<name>'*::
    device name +
    By default, tapN is used for Ethernet tunnel interfaces,
    and tunN for IP tunnels, respectively. This option can
    be used to manually override these defaults.
 
-*-t, --type <tun|tap>*::
+*-t, --type '<tun|tap>'*::
    device type +
    Type of the tunnels to create. Use tap for Ethernet
    tunnels, tun for IP tunnels.
 
-*-n, --ifconfig <local>/<prefix>*::
+*-n, --ifconfig '<local>/<prefix>'*::
    The local IP address and prefix length. The remote tunnel endpoint
    has to use a different IP address in the same subnet.
 
-   *<local>*;; the local IP address for the tun/tap device
-   *<prefix>*;; the prefix length of the network
+   '<local>';; the local IP address for the tun/tap device
+   '<prefix>';; the prefix length of the network
 
-*-x, --post-up-script <script>*::
+*-x, --post-up-script '<script>'*::
    This option instructs *uAnytun* to run this script after the interface 
    is created. By default no script will be executed.
 
-*-m, --mux <mux-id>*::
+*-m, --mux '<mux-id>'*::
    the multiplex id to use. default: 0
 
-*-s, --sender-id  <sender id>*::
+*-s, --sender-id '<sender id>'*::
    Each anycast tunnel endpoint needs a unique sender id
    (1, 2, 3, ...). It is needed to distinguish the senders
    in case of replay attacks. As *uAnytun* does not support 
    synchronisation it can't be used as an anycast endpoint therefore 
-   this option is quite useless but implemented for compability 
+   this option is quite useless but implemented for compatibility 
    reasons. default: 0
 
-*-w, --window-size <window size>*::
+*-w, --window-size '<window size>'*::
    seqence window size +
    Sometimes, packets arrive out of order on the receiver
    side. This option defines the size of a list of received
@@ -176,69 +183,69 @@ passed to the daemon:
    By default the sequence window is disabled and therefore a
    window size of 0 is used.
 
-*-k, --kd--prf <kd-prf type>*::
+*-k, --kd--prf '<kd-prf type>'*::
    key derivation pseudo random function +
    The pseudo random function which is used for calculating the 
    session keys and session salt. +
    Possible values:
 
-   *null*;; no random function, keys and salt are set to 0..00
-   *aes-ctr*;; AES in counter mode with 128 Bits, default value
-   *aes-ctr-128*;; AES in counter mode with 128 Bits
-   *aes-ctr-192*;; AES in counter mode with 192 Bits
-   *aes-ctr-256*;; AES in counter mode with 256 Bits
+   'null';; no random function, keys and salt are set to 0..00
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
 
-*-e, --role <role>*::
+*-e, --role '<role>'*::
    SATP uses different session keys for inbound and outbound traffic. The
    role parameter is used to determine which keys to use for outbound or
    inbound packets. On both sides of a vpn connection different roles have 
-   to be used. Possible values are *left* and *right*. You may also use 
-   *alice* or *server* as a replacement for *left* and *bob* or *client* as 
-   a replacement for *right*. By default *left* is used.
+   to be used. Possible values are 'left' and 'right'. You may also use 
+   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as 
+   a replacement for 'right'. By default 'left' is used.
 
-*-E, --passphrase <pass phrase>*::
+*-E, --passphrase '<pass phrase>'*::
    This passphrase is used to generate the master key and master salt.
    For the master key the last n bits of the SHA256 digest of the 
    passphrase (where n is the length of the master key in bits) is used. 
    The master salt gets generated with the SHA1 digest. 
    You may force a specific key and or salt by using *--key* and *--salt*.
 
-*-K, --key <master key>*::
+*-K, --key '<master key>'*::
    master key to use for key derivation +
    Master key in hexadecimal notation, e.g.
    01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length
    of 32, 48 or 64 characters (128, 192 or 256 bits).
 
-*-A, --salt <master salt>*::
+*-A, --salt '<master salt>'*::
    master salt to use for key derivation +
    Master salt in hexadecimal notation, e.g.
    01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length
    of 28 characters (14 bytes).
 
-*-c, --cipher <cipher type>*::
+*-c, --cipher '<cipher type>'*::
    payload encryption algorithm +
    Encryption algorithm used for encrypting the payload +
    Possible values:
 
-   *null*;; no encryption
-   *aes-ctr*;; AES in counter mode with 128 Bits, default value
-   *aes-ctr-128*;; AES in counter mode with 128 Bits
-   *aes-ctr-192*;; AES in counter mode with 192 Bits
-   *aes-ctr-256*;; AES in counter mode with 256 Bits
+   'null';; no encryption
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
 
-*-a, --auth-algo <algo type>*::
+*-a, --auth-algo '<algo type>'*::
    message authentication algorithm +
    This option sets the message authentication algorithm. +
    If HMAC-SHA1 is used, the packet length is increased. The additional bytes 
    contain the authentication data. see *--auth-tag-length* for more info. +
    Possible values:
 
-   *null*;; no message authentication
-   *sha1*;; HMAC-SHA1, default value
+   'null';; no message authentication
+   'sha1';; HMAC-SHA1, default value
 
-*-b, --auth-tag-length <length>*::
+*-b, --auth-tag-length '<length>'*::
    The number of bytes to use for the auth tag. This value defaults to 10 bytes 
-   unless the *null* auth algo is used in which case it defaults to 0. 
+   unless the 'null' auth algo is used in which case it defaults to 0. 
 
 
 EXAMPLES
@@ -293,7 +300,7 @@ Main web site: http://www.anytun.org/
 COPYING
 -------
 
-Copyright \(C) 2008-2009 Christian Pointner. This  program is  free 
+Copyright \(C) 2008-2010 Christian Pointner. This  program is  free 
 software: you can redistribute it and/or modify it under the terms 
 of the GNU General Public License as published by the Free Software 
 Foundation, either version 3 of the License, or any later version.
diff --git a/etc/init.d/uanytun b/etc/init.d/uanytun
index 07cb448..9c2414a 100755
--- a/etc/init.d/uanytun
+++ b/etc/init.d/uanytun
@@ -13,6 +13,7 @@ DAEMON=/usr/sbin/uanytun
 CONFIG_DIR=/etc/uanytun
 NAME=uanytun
 DESC=uanytun
+VARRUN_DIR=/var/run/$NAME
 
 test -x $DAEMON || exit 0
 
@@ -23,15 +24,16 @@ fi
 
 start_vpn () {
   STATUS="OK"
-  if [ -f $CONFIG_DIR/$NAME/config ] ; then
+  if [ -f $CONFIG_DIR/$VPNNAME/config ] ; then
     POSTUP=''
-    test -f  $CONFIG_DIR/$NAME/post-up.sh && POSTUP="-x $CONFIG_DIR/$NAME/post-up.sh"
-    CHROOTDIR=`grep '^chroot' < $CONFIG_DIR/$NAME/config | sed 's/chroot\s*//'`
+    test -f  $CONFIG_DIR/$VPNNAME/post-up.sh && POSTUP="-x $CONFIG_DIR/$VPNNAME/post-up.sh"
+    CHROOTDIR=`grep '^chroot' < $CONFIG_DIR/$VPNNAME/config | sed 's/chroot\s*//'`
     if [ -n "$CHROOTDIR" ] ; then
       test -d $CHROOTDIR || mkdir -p $CHROOTDIR
     fi
-    DAEMONARG=`sed 's/#.*//' < $CONFIG_DIR/$NAME/config | grep -e '\w' | sed  's/^/--/' | tr '\n' ' '`
-    $DAEMON --write-pid /var/run/uanytun.$NAME.pid $POSTUP $DAEMONOPTS $DAEMONARG || STATUS="FAILED"
+    test -d $VARRUN_DIR || mkdir -p $VARRUN_DIR
+    DAEMONARG=`sed 's/#.*//' < $CONFIG_DIR/$VPNNAME/config | grep -e '\w' | sed  's/^/--/' | tr '\n' ' '`
+    $DAEMON --write-pid $VARRUN_DIR/$VPNNAME.pid $POSTUP $DAEMONOPTS $DAEMONARG || STATUS="FAILED"
   else
     STATUS="no config found"
   fi
@@ -48,8 +50,8 @@ case "$1" in
   echo -n "Starting $DESC:"
   if test -z "$2" ; then
     if [ -f $CONFIG_DIR/autostart ] ; then
-      for NAME in `sed 's/#.*//'  <  $CONFIG_DIR/autostart | grep -e '\w'`; do
-        echo -n " $NAME"
+      for VPNNAME in `sed 's/#.*//'  <  $CONFIG_DIR/autostart | grep -e '\w'`; do
+        echo -n " $VPNNAME"
         start_vpn
       done
     else
@@ -59,8 +61,8 @@ case "$1" in
   else
     while shift ; do
       [ -z "$1" ] && break
-      NAME=$1
-      echo -n " $NAME"
+      VPNNAME=$1
+      echo -n " $VPNNAME"
       start_vpn
     done
   fi
@@ -69,20 +71,18 @@ case "$1" in
   stop)
   echo -n "Stoping $DESC:"
   if test -z "$2" ; then
-    for PIDFILE in `ls /var/run/uanytun.*.pid 2> /dev/null`; do
-      NAME=`echo $PIDFILE | cut -c18-`
-      NAME=${NAME%%.pid}
-      echo -n " $NAME"
+    for PIDFILE in `ls $VARRUN_DIR/*.pid 2> /dev/null`; do
+      VPNNAME=`basename $PIDFILE .pid`
+      echo -n " $VPNNAME"
       stop_vpn
     done
   else
     while shift ; do
       [ -z "$1" ] && break
-      if test -e /var/run/uanytun.$1.pid ; then
-        PIDFILE=`ls /var/run/uanytun.$1.pid 2> /dev/null`
-        NAME=`echo $PIDFILE | cut -c18-`
-        NAME=${NAME%%.pid}
-        echo -n " $NAME"
+      if test -e $VARRUN_DIR/$1.pid ; then
+        PIDFILE=`ls $VARRUN_DIR/$1.pid 2> /dev/null`
+        VPNNAME=`basename $PIDFILE .pid`
+        echo -n " $VPNNAME"
         stop_vpn
       else
         echo -n " (failure: No such tunnel is running: $1)"
@@ -94,21 +94,19 @@ case "$1" in
   reload)
   echo -n "Reloading $DESC:"
   if test -z "$2" ; then
-    for PIDFILE in `ls /var/run/uanytun.*.pid 2> /dev/null`; do
-      NAME=`echo $PIDFILE | cut -c18-`
-      NAME=${NAME%%.pid}
-      echo -n " $NAME"
+    for PIDFILE in `ls $VARRUN_DIR/*.pid 2> /dev/null`; do
+      VPNNAME=`basename $PIDFILE .pid`
+      echo -n " $VPNNAME"
       stop_vpn
       start_vpn
     done
   else
     while shift ; do
       [ -z "$1" ] && break
-      if test -e /var/run/uanytun.$1.pid ; then
-        PIDFILE=`ls /var/run/uanytun.$1.pid 2> /dev/null`
-        NAME=`echo $PIDFILE | cut -c18-`
-        NAME=${NAME%%.pid}
-        echo -n " $NAME"
+      if test -e $VARRUN_DIR/$1.pid ; then
+        PIDFILE=`ls $VARRUN_DIR/$1.pid 2> /dev/null`
+        VPNNAME=`basename $PIDFILE .pid`
+        echo -n " $VPNNAME"
         stop_vpn
         start_vpn
       else
@@ -118,7 +116,7 @@ case "$1" in
   fi
   echo "."
   ;;
-  restart)
+  restart|force-reload)
     SCRIPT=$0
     shift
     $SCRIPT stop $*
diff --git a/src/Makefile b/src/Makefile
index 4124575..5ed36d9 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -15,7 +15,7 @@
 ##  tunneling and relaying of packets of any protocol.
 ##  
 ##
-##  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -89,6 +89,7 @@ distclean: cleanall
 	find . -name *.o -exec rm -f {} \;
 	find . -name "*.\~*" -exec rm -rf {} \;
 	rm -f include.mk
+	rm -f version.h
 	rm -f tun.c
 
 clean:
diff --git a/src/auth_algo.c b/src/auth_algo.c
index 69d4ec0..b148946 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/auth_algo.h b/src/auth_algo.h
index 1f08a3f..1007955 100644
--- a/src/auth_algo.h
+++ b/src/auth_algo.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index 46c7c1c..a995c35 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/cipher.c b/src/cipher.c
index a91facb..8913f64 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/cipher.h b/src/cipher.h
index d65c761..e33d815 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/configure b/src/configure
index ac2dc03..ee80582 100755
--- a/src/configure
+++ b/src/configure
@@ -16,7 +16,7 @@
 #  tunneling and relaying of packets of any protocol.
 #  
 #
-#  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+#  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
 #
 #  This file is part of uAnytun.
 #
@@ -43,7 +43,6 @@ LDFLAGS='-g -Wall -O2'
 
 CRYPTO_LIB='gcrypt'
 PASSPHRASE=1
-V4_MAPPED=1
 
 PREFIX='/usr/local'
 SBINDIR=''
@@ -67,9 +66,6 @@ print_usage() {
   echo "          --no-crypto               disable crypto at all (only NULL cipher)"
   echo "          --disable-passphrase      disable master key and salt passphrase"
   echo "          --enable-passphrase       enable master key and salt passphrase"
-  echo "          --disable-v4-mapped       disable V4-Mapped addresses (this means to disable"
-  echo "                                    simultanious use of IPv4 and IPv6)"
-  echo "          --enable-v4-mapped        enable V4-Mapped addresses"
 }
 
 for arg
@@ -111,12 +107,6 @@ do
   --enable-passphrase)
     PASSPHRASE=1
   ;;
-  --disable-v4-mapped)
-    V4_MAPPED=0 
-  ;; 
-  --enable-v4-mapped)
-    V4_MAPPED=2
-  ;; 
   --ebuild-compat)
     EBUILD_COMPAT=1
   ;;
@@ -139,7 +129,7 @@ if [ -n "$ERRORS" ] && [ $EBUILD_COMPAT -ne 1 ]; then
   exit 1
 fi
 
-
+rm -f version.h
 rm -f include.mk
 case $TARGET in 
   Linux)
@@ -153,12 +143,9 @@ case $TARGET in
     echo "loading BSD specific TUN Device"
     CFLAGS=$CFLAGS' -I/usr/local/include'
     LDFLAGS=$LDFLAGS' -L/usr/local/lib'
-    if [ $V4_MAPPED -ne 2 ]; then
-      V4_MAPPED=0
-    fi
   ;;
   *)
-    echo "Plattform not supported"
+    echo "platform not supported"
     exit 1;
   ;;
 esac
@@ -186,11 +173,6 @@ if [ $PASSPHRASE -eq 0 ]; then
   echo "disabling master key and salt passphrase"
 fi
 
-if [ $V4_MAPPED -eq 0 ]; then
-  CFLAGS=$CFLAGS' -DNO_V4MAPPED'
-  echo "WARNING: disabling V4 mapped addresses, this prevents uanytun from using IPv6 and IPv4 Sockets at the same time"
-fi
-
 if [ -z "$SBINDIR" ]; then
   SBINDIR=$PREFIX/sbin
 fi
@@ -238,4 +220,33 @@ else
   echo "not installing example files"
 fi
 
+VERSION=`cat ../version`
+if which svn >/dev/null; then
+  SVN_REV=`svn info | grep "^Revision: " | awk '{print($2)}'`
+  if [ -n "$SVN_REV" ]; then
+    VERSION="$VERSION (svn$SVN_REV)"
+  fi
+fi
+HOSTNAME=`hostname`
+DATE=`date +"%d.%m.%Y %H:%M:%S %Z"`
+
+cat >> version.h <<EOF
+/* 
+ * uanytun version info
+ *
+ * this file was created automatically
+ * do not edit this file directly
+ * use ./configure instead
+ */
+
+#ifndef UANYTUN_version_h_INCLUDED
+#define UANYTUN_version_h_INCLUDED
+
+#define VERSION_STRING_0 "uanytun version $VERSION"
+#define VERSION_STRING_1 "built on $HOSTNAME, $DATE"
+
+#endif
+
+EOF
+
 exit 0
diff --git a/src/daemon.h b/src/daemon.h
index 22e0ac0..04a4d4f 100644
--- a/src/daemon.h
+++ b/src/daemon.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -109,7 +109,7 @@ int priv_drop(priv_info_t* priv)
 int do_chroot(const char* chrootdir)
 {
   if(getuid() != 0) {
-    log_printf(ERROR, "this programm has to be run as root in order to run in a chroot");
+    log_printf(ERROR, "this program has to be run as root in order to run in a chroot");
     return -1;
   }
 
diff --git a/src/datatypes.h b/src/datatypes.h
index ae57112..0105062 100644
--- a/src/datatypes.h
+++ b/src/datatypes.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/encrypted_packet.c b/src/encrypted_packet.c
index c6db3d8..12f04ef 100644
--- a/src/encrypted_packet.c
+++ b/src/encrypted_packet.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/encrypted_packet.h b/src/encrypted_packet.h
index f654b2c..4afe323 100644
--- a/src/encrypted_packet.h
+++ b/src/encrypted_packet.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/init_crypt.h b/src/init_crypt.h
new file mode 100644
index 0000000..2461a54
--- /dev/null
+++ b/src/init_crypt.h
@@ -0,0 +1,93 @@
+/*
+ *  uAnytun
+ *
+ *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
+ *  featured implementation uAnytun has no support for multiple connections
+ *  or synchronisation. It is a small single threaded implementation intended
+ *  to act as a client on small platforms.
+ *  The secure anycast tunneling protocol (satp) defines a protocol used
+ *  for communication between any combination of unicast and anycast
+ *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
+ *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
+ *  ethernet, ip, arp ...). satp directly includes cryptography and
+ *  message authentication based on the methodes used by SRTP.  It is
+ *  intended to deliver a generic, scaleable and secure solution for
+ *  tunneling and relaying of packets of any protocol.
+ *  
+ *
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  This file is part of uAnytun.
+ *
+ *  uAnytun is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  any later version.
+ *
+ *  uAnytun is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UANYTUN_init_crypt_h_INCLUDED
+#define UANYTUN_init_crypt_h_INCLUDED
+
+#ifdef NO_CRYPT
+
+
+int init_crypt()
+{
+  return 0;
+}
+
+
+#else
+
+
+#ifndef USE_SSL_CRYPTO
+
+#include <gcrypt.h>
+
+#define MIN_GCRYPT_VERSION "1.2.0"
+
+int init_crypt() 
+{
+  if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
+    log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
+    return -1;
+  }
+
+  gcry_error_t err = gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
+  if(err) {
+    log_printf(ERROR, "failed to disable secure memory: %s", gcry_strerror(err));
+    return -1;
+  }
+
+  err = gcry_control(GCRYCTL_INITIALIZATION_FINISHED);
+  if(err) {
+    log_printf(ERROR, "failed to finish libgcrypt initialization: %s", gcry_strerror(err));
+    return -1;
+  }
+
+  log_printf(NOTICE, "libgcrypt init finished");
+  return 0;
+}
+
+#else
+
+int init_crypt()
+{
+// nothing here 
+  return 0;
+}
+
+#endif
+
+
+#endif
+
+#endif
diff --git a/src/key_derivation.c b/src/key_derivation.c
index 7e98416..a01695b 100644
--- a/src/key_derivation.c
+++ b/src/key_derivation.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/key_derivation.h b/src/key_derivation.h
index 7f75685..d037157 100644
--- a/src/key_derivation.h
+++ b/src/key_derivation.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/linux/tun.c b/src/linux/tun.c
index 10037ea..85cdc01 100644
--- a/src/linux/tun.c
+++ b/src/linux/tun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log.c b/src/log.c
index 43a0a5a..ae323e9 100644
--- a/src/log.c
+++ b/src/log.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log.h b/src/log.h
index 2717622..17de487 100644
--- a/src/log.h
+++ b/src/log.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/log_targets.h b/src/log_targets.h
index 8db3812..4a19d8e 100644
--- a/src/log_targets.h
+++ b/src/log_targets.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/options.c b/src/options.c
index f5010bf..331a3c3 100644
--- a/src/options.c
+++ b/src/options.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -34,6 +34,7 @@
  */
 
 #include "datatypes.h"
+#include "version.h"
 
 #include "options.h"
 
@@ -233,6 +234,8 @@ int options_parse(options_t* opt, int argc, char* argv[])
 
     if(!strcmp(str,"-h") || !strcmp(str,"--help"))
       return -1;
+    else if(!strcmp(str,"-v") || !strcmp(str,"--version"))
+      return -5;
     PARSE_INVERSE_BOOL_PARAM("-D","--nodaemonize", opt->daemonize_)
     PARSE_STRING_PARAM("-u","--username", opt->username_)
     PARSE_STRING_PARAM("-g","--groupname", opt->groupname_)
@@ -242,6 +245,7 @@ int options_parse(options_t* opt, int argc, char* argv[])
     PARSE_STRING_PARAM("-p","--port", opt->local_port_)
     PARSE_INT_PARAM("-s","--sender-id", opt->sender_id_)
     PARSE_STRING_LIST("-L","--log", opt->log_targets_)
+    PARSE_BOOL_PARAM("-U", "--debug", opt->debug_)
     PARSE_STRING_PARAM("-r","--remote-host", opt->remote_addr_)
     PARSE_STRING_PARAM("-o","--remote-port", opt->remote_port_)
     PARSE_BOOL_PARAM("-4","--ipv4-only", ipv4_only)
@@ -274,6 +278,14 @@ int options_parse(options_t* opt, int argc, char* argv[])
   if(ipv6_only)
     opt->resolv_addr_type_ = IPV6_ONLY;
 
+  if(opt->debug_) {
+    string_list_add(&opt->log_targets_, "stdout:5");
+    opt->daemonize_ = 0;
+  }
+
+  if(!opt->log_targets_.first_)
+    string_list_add(&opt->log_targets_, "syslog:3,uanytun,daemon");
+
 #ifndef NO_CRYPT
   if(role) {
     if(!strcmp(role, "alice") || !strcmp(role, "server") || !strcmp(role, "left"))
@@ -295,13 +307,6 @@ void options_parse_post(options_t* opt)
   if(!opt)
     return;
 
-#ifdef NO_V4MAPPED
-  if(opt->resolv_addr_type_ == ANY) {
-    opt->resolv_addr_type_ = IPV4_ONLY;
-    log_printf(WARNING, "No support for V4-mapped Adresses on this platform, defaulting to only use IPv4 addresses");
-  }
-#endif
-
 #ifndef NO_CRYPT
   if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") && 
      strcmp(opt->kd_prf_, "null")) {
@@ -338,6 +343,7 @@ void options_default(options_t* opt)
   opt->chroot_dir_ = NULL;
   opt->pid_file_ = NULL;
   string_list_init(&opt->log_targets_);
+  opt->debug_ = 0;
   opt->local_addr_ = NULL;
   opt->local_port_ = strdup("4444");
   opt->sender_id_ = 0;
@@ -420,6 +426,7 @@ void options_print_usage()
 {
   printf("USAGE:\n");
   printf("uanytun [-h|--help]                         prints this...\n");
+  printf("        [-v|--version]                      print version info and exit\n");
   printf("        [-D|--nodaemonize]                  don't run in background\n");
   printf("        [-u|--username] <username>          change to this user\n");
   printf("        [-g|--groupname] <groupname>        change to this group\n");
@@ -430,6 +437,7 @@ void options_print_usage()
   printf("        [-s|--sender-id ] <sender id>       the sender id to use\n");
   printf("        [-L|--log] <target>:<level>[,<param1>[,<param2>..]]\n");
   printf("                                            add a log target, can be invoked several times\n");
+  printf("        [-U|--debug]                        don't daemonize and log to stdout with maximum log level\n");
 
   printf("        [-r|--remote-host] <hostname|ip>    remote host\n");
   printf("        [-o|--remote-port] <port>           remote port\n");
@@ -456,6 +464,12 @@ void options_print_usage()
 #endif
 }
 
+void options_print_version()
+{
+  printf("%s\n", VERSION_STRING_0);
+  printf("%s\n", VERSION_STRING_1);
+}
+
 void options_print(options_t* opt)
 {
   if(!opt)
@@ -469,6 +483,7 @@ void options_print(options_t* opt)
   printf("pid_file: '%s'\n", opt->pid_file_);
   printf("log_targets: \n");
   string_list_print(&opt->log_targets_, "  '", "'\n");
+  printf("debug: %s\n", !opt->debug_ ? "false" : "true");
   printf("local_addr: '%s'\n", opt->local_addr_);
   printf("local_port: '%s'\n", opt->local_port_);
   printf("sender_id: %d\n", opt->sender_id_);
diff --git a/src/options.h b/src/options.h
index ee7763d..ccc5044 100644
--- a/src/options.h
+++ b/src/options.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -58,6 +58,7 @@ struct options_struct {
   char* chroot_dir_;
   char* pid_file_;
   string_list_t log_targets_;
+  int debug_;
   char* local_addr_;
   char* local_port_;
   sender_id_t sender_id_;
diff --git a/src/plain_packet.c b/src/plain_packet.c
index 6995d42..29ba5fe 100644
--- a/src/plain_packet.c
+++ b/src/plain_packet.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/plain_packet.h b/src/plain_packet.h
index 6f1b385..0dc62b7 100644
--- a/src/plain_packet.h
+++ b/src/plain_packet.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/seq_window.c b/src/seq_window.c
index a855f68..0f58adb 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/seq_window.h b/src/seq_window.h
index 385cbdb..b699ee9 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sig_handler.c b/src/sig_handler.c
index ca2e18f..bed72ba 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -36,16 +36,13 @@
 #include "datatypes.h"
 
 #include "log.h"
+#include "sig_handler.h"
+
 #include <signal.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <sys/select.h>
 #include <errno.h>
 
-#include "sig_handler.h"
-
-#include <stdio.h>
-
 
 static int sig_pipe_fds[2];
 
diff --git a/src/sig_handler.h b/src/sig_handler.h
index 1995e1a..8219618 100644
--- a/src/sig_handler.h
+++ b/src/sig_handler.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/string_list.c b/src/string_list.c
index a4f4ab8..5e0ddf8 100644
--- a/src/string_list.c
+++ b/src/string_list.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/string_list.h b/src/string_list.h
index cd054cb..9e210ae 100644
--- a/src/string_list.h
+++ b/src/string_list.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sysexec.c b/src/sysexec.c
index 2cea52e..6e4e821 100644
--- a/src/sysexec.c
+++ b/src/sysexec.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/sysexec.h b/src/sysexec.h
index 0aabde1..faed8eb 100644
--- a/src/sysexec.h
+++ b/src/sysexec.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/tun.h b/src/tun.h
index b74e0b1..230b88d 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/tun_helper.h b/src/tun_helper.h
index bd9b438..9d55267 100644
--- a/src/tun_helper.h
+++ b/src/tun_helper.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
diff --git a/src/uanytun.c b/src/uanytun.c
index 0e36781..53acbaf 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -56,49 +56,14 @@
 #ifndef NO_CRYPT
 #include "key_derivation.h"
 #include "auth_algo.h"
-
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#endif
+#else
+typedef u_int8_t auth_algo_t;
 #endif
-
+#include "init_crypt.h"
 
 #include "daemon.h"
 #include "sysexec.h"
 
-#ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-
-#define MIN_GCRYPT_VERSION "1.2.0"
-
-int init_libgcrypt()
-{
-  if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
-    log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
-    return -1;
-  }
-
-  gcry_error_t err = gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-  if(err) {
-    log_printf(ERROR, "failed to disable secure memory: %s", gcry_strerror(err));
-    return -1;
-  }
-
-  err = gcry_control(GCRYCTL_INITIALIZATION_FINISHED);
-  if(err) {
-    log_printf(ERROR, "failed to finish libgcrypt initialization: %s", gcry_strerror(err));
-    return -1;
-  }
-
-  log_printf(NOTICE, "libgcrypt init finished");
-  return 0;
-}
-#endif
-#endif
-
-#ifdef NO_CRYPT
-typedef u_int8_t auth_algo_t;
-#endif
 
 int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_win_t* seq_win)
 {
@@ -138,7 +103,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
   return 0;
 }
 
-int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
+int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
                      cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t seq_nr)
 {
   plain_packet_set_payload_length(plain_packet, -1);
@@ -167,7 +132,7 @@ int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plai
 #ifndef NO_CRYPT
   auth_algo_generate(aa, kd, kd_outbound, encrypted_packet);
 #endif
-  
+ 
   len = udp_write(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet));
   if(len == -1)
     log_printf(ERROR, "error on sending udp packet: %s", strerror(errno));
@@ -175,7 +140,7 @@ int process_tun_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plai
   return 0;
 }
 
-int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
+int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
                       cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_win_t* seq_win)
 {
   plain_packet_set_payload_length(plain_packet, -1);
@@ -183,13 +148,13 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
 
   udp_endpoint_t remote;
   memset(&remote, 0, sizeof(udp_endpoint_t));
-  int len = udp_read(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet), &remote);
+  int len = udp_read(sock, fd, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet), &remote);
   if(len == -1) {
     log_printf(ERROR, "error on receiving udp packet: %s", strerror(errno));
     return 0;
   }
   else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
-    log_printf(WARNING, "received packet is to short");
+    log_printf(WARNING, "received packet is too short");
     return 0;
   }
   encrypted_packet_set_length(encrypted_packet, len);
@@ -216,6 +181,7 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
     return -2;
   }
    
+  udp_set_active_sock(sock, fd);
   if(memcmp(&remote, &(sock->remote_end_), sizeof(remote))) {
     memcpy(&(sock->remote_end_), &remote, sizeof(remote));
     sock->remote_end_set_ = 1;
@@ -241,7 +207,7 @@ int process_sock_data(tun_device_t* dev, udp_socket_t* sock, options_t* opt, pla
 }
 
 
-int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
+int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
 {
   log_printf(INFO, "entering main loop");
 
@@ -263,8 +229,8 @@ int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
 
   FD_ZERO(&readfds);
   FD_SET(dev->fd_, &readfds);
-  FD_SET(sock->fd_, &readfds);
-  int nfds = dev->fd_ > sock->fd_ ? dev->fd_ : sock->fd_;
+  int nfds = udp_init_fd_set(sock, &readfds);
+  nfds = dev->fd_ > nfds ? dev->fd_ : nfds;
 
   int return_value = 0;
   int sig_fd = signal_init();
@@ -299,10 +265,14 @@ int main_loop(tun_device_t* dev, udp_socket_t* sock, options_t* opt)
         break;
     }
 
-    if(FD_ISSET(sock->fd_, &readyfds)) {
-      return_value = process_sock_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
-      if(return_value)
-        break;
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if(FD_ISSET(s->fd_, &readyfds)) {
+        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
+        if(return_value)
+          break;
+      }
+      s = s->next_;
     }
   }
 
@@ -336,35 +306,36 @@ int main(int argc, char* argv[])
     if(ret == -4) {
       fprintf(stderr, "syntax error: unknown role name\n\n");
     }
+    if(ret == -5) {
+      options_print_version();
+    }
 
-    if(ret != -2) 
+    if(ret != -2 && ret != -5) 
       options_print_usage();
 
+    if(ret == -1 || ret == -5)
+      ret = 0;
+
     options_clear(&opt);
     log_close();
     exit(ret);
   }
   string_list_element_t* tmp = opt.log_targets_.first_;
-  if(!tmp) {
-    log_add_target("syslog:3,uanytun,daemon");
-  }
-  else {
-    while(tmp) {
-      ret = log_add_target(tmp->string_);
-      if(ret) {
-        switch(ret) {
-        case -2: fprintf(stderr, "memory error on log_add_target, exitting\n"); break;
-        case -3: fprintf(stderr, "unknown log target: '%s', exitting\n", tmp->string_); break;
-        case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
-        default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
-        }
-        
-        options_clear(&opt);
-        log_close();
-        exit(ret);
+  while(tmp) {
+    ret = log_add_target(tmp->string_);
+    if(ret) {
+      switch(ret) {
+      case -2: fprintf(stderr, "memory error on log_add_target, exitting\n"); break;
+      case -3: fprintf(stderr, "unknown log target: '%s', exitting\n", tmp->string_); break;
+      case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
+      default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
       }
-      tmp = tmp->next_;
+        
+      options_clear(&opt);
+      log_close();
+      exit(ret);
     }
+    tmp = tmp->next_;
   }
 
   log_printf(NOTICE, "just started...");
@@ -378,17 +349,13 @@ int main(int argc, char* argv[])
       exit(-1);
     }
 
-#ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-  ret = init_libgcrypt();
+  ret = init_crypt();
   if(ret) {
-    log_printf(ERROR, "error on libgcrpyt initialization, exitting");
+    log_printf(ERROR, "error on crpyto initialization, exitting");
     options_clear(&opt);
     log_close();
     exit(ret);
   }
-#endif
-#endif
 
   tun_device_t dev;
   ret = tun_init(&dev, opt.dev_name_, opt.dev_type_, opt.ifconfig_param_.net_addr_, opt.ifconfig_param_.prefix_length_);
@@ -408,7 +375,7 @@ int main(int argc, char* argv[])
   }
 
 
-  udp_socket_t sock;
+  udp_t sock;
   ret = udp_init(&sock, opt.local_addr_, opt.local_port_, opt.resolv_addr_type_);
   if(ret) {
     log_printf(ERROR, "error on udp_init, exitting");
@@ -417,12 +384,6 @@ int main(int argc, char* argv[])
     log_close();
     exit(ret);
   }
-  char* local_string = udp_get_local_end_string(&sock);
-  if(local_string) {
-    log_printf(NOTICE, "listening on: %s", local_string);
-    free(local_string);
-  }
-
 
   if(opt.remote_addr_) {
     if(!udp_set_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
diff --git a/src/udp.c b/src/udp.c
index 7f539a8..3e1def6 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -49,14 +49,14 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !port) 
     return -1;
- 
-  sock->fd_ = 0;
-  memset(&(sock->local_end_), 0, sizeof(sock->local_end_));
-  memset(&(sock->remote_end_), 0, sizeof(sock->local_end_));
+
+  sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
+  memset(&(sock->remote_end_), 0, sizeof(sock->remote_end_));
   sock->remote_end_set_ = 0;
 
   struct addrinfo hints, *res;
@@ -64,12 +64,12 @@ int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resol
   res = NULL;
   memset (&hints, 0, sizeof (hints));
   hints.ai_socktype = SOCK_DGRAM;
-  hints.ai_flags |= AI_PASSIVE;
+  hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG;
 
   switch(resolv_type) {
-  case IPV4_ONLY: hints.ai_family = PF_INET; break;
-  case IPV6_ONLY: hints.ai_family = PF_INET6; break;
-  default: hints.ai_family = PF_UNSPEC; break;
+  case IPV4_ONLY: hints.ai_family = AF_INET; break;
+  case IPV6_ONLY: hints.ai_family = AF_INET6; break;
+  default: hints.ai_family = AF_UNSPEC; break;
   }
 
   int errcode = getaddrinfo(local_addr, port, &hints, &res);
@@ -78,46 +78,86 @@ int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resol
     udp_close(sock);
     return -1;
   }
-
   if(!res) {
     udp_close(sock);
     log_printf(ERROR, "getaddrinfo returned no address for %s:%s", local_addr, port);
     return -1;
   }
 
-  memcpy(&(sock->local_end_), res->ai_addr, res->ai_addrlen);
+  struct addrinfo* r = res;
+  udp_socket_t* prev_sock = NULL;
+  while(r) {
+    udp_socket_t* new_sock = malloc(sizeof(udp_socket_t));
+    if(!new_sock) {
+      log_printf(ERROR, "memory error at udp_init");
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -2;
+    }
+    memset(&(new_sock->local_end_), 0, sizeof(new_sock->local_end_));
+    new_sock->next_ = NULL;
+
+    if(!sock->socks_) {
+      sock->socks_ = new_sock;
+      prev_sock = new_sock;
+    }
+    else {
+      prev_sock->next_ = new_sock;
+      prev_sock = new_sock;
+    }
+    
+    memcpy(&(new_sock->local_end_), r->ai_addr, r->ai_addrlen);
+    new_sock->fd_ = socket(r->ai_family, SOCK_DGRAM, 0);
+    if(new_sock->fd_ < 0) {
+      log_printf(ERROR, "Error on opening udp socket: %s", strerror(errno));
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -1;
+    }
+
+    if(r->ai_family == AF_INET6) {
+      int on = 1;
+      if(setsockopt(new_sock->fd_, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)))
+        log_printf(ERROR, "Error on setting IPV6_V6ONLY socket option: %s", strerror(errno));
+    }
+
+    errcode = bind(new_sock->fd_, r->ai_addr, r->ai_addrlen);
+    if(errcode) {
+      log_printf(ERROR, "Error on binding udp socket: %s", strerror(errno));
+      freeaddrinfo(res);
+      udp_close(sock);
+      return -1;
+    }
+  
+    char* local_string = udp_endpoint_to_string(new_sock->local_end_);
+    if(local_string) {
+      log_printf(NOTICE, "listening on: %s", local_string);
+      free(local_string);
+    }
 
-  sock->fd_ = socket(res->ai_family, SOCK_DGRAM, 0);
-  if(sock->fd_ < 0) {
-    log_printf(ERROR, "Error on opening udp socket: %s", strerror(errno));
-    freeaddrinfo(res);
-    udp_close(sock);
-    return -1;
+    r = r->ai_next;
   }
 
-  errcode = bind(sock->fd_, res->ai_addr, res->ai_addrlen);
-  if(errcode) {
-    log_printf(ERROR, "Error on binding udp socket: %s", strerror(errno));
-    freeaddrinfo(res);
-    udp_close(sock);
-    return -1;
-  }
-  
-/* this doesn't work on linux ?? */
-/* #ifdef NO_V4MAPPED */
-/*   if(res->ai_family == AF_INET6) { */
-/*     log_printf(NOTICE, "disabling V4-Mapped addresses"); */
-/*     int on = 1; */
-/*     if(setsockopt(sock->fd_, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on))) */
-/*       log_printf(ERROR, "Error on setting IPV6_V6ONLY socket option: %s", strerror(errno)); */
-/*   } */
-/* #endif */
   freeaddrinfo(res);
 
   return 0;
 }
 
-int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_init_fd_set(udp_t* sock, fd_set* set)
+{
+  int max_fd = 0;
+
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    FD_SET(s->fd_, set);
+    max_fd = s->fd_ > max_fd ? s->fd_ : max_fd;
+    s = s->next_;
+  }
+
+  return max_fd;
+}
+
+int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
 {
   if(!sock || !remote_addr || !port) 
     return -1;
@@ -145,18 +185,53 @@ int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port
   }
   memcpy(&(sock->remote_end_), res->ai_addr, res->ai_addrlen);
   sock->remote_end_set_ = 1;
+
+  if(!sock->active_sock_) {
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if((((struct sockaddr *)&s->local_end_)->sa_family) == res->ai_family) {
+        sock->active_sock_ = s;
+        break;
+      }
+      s = s->next_;
+    }
+  }
+
   freeaddrinfo(res);
 
   return 0;
 }
 
-void udp_close(udp_socket_t* sock)
+void udp_set_active_sock(udp_t* sock, int fd)
+{
+  if(!sock || (sock->active_sock_ && sock->active_sock_->fd_ == fd))
+    return;
+
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    if(s->fd_ == fd) {
+      sock->active_sock_ = s;
+      return;
+    }
+    s = s->next_;
+  }
+}
+
+void udp_close(udp_t* sock)
 {
   if(!sock)
     return;
 
-  if(sock->fd_ > 0)
-    close(sock->fd_);
+  while(sock->socks_) {
+    if(sock->socks_->fd_ > 0)
+      close(sock->socks_->fd_);
+    
+    udp_socket_t*s = sock->socks_;
+    sock->socks_ = sock->socks_->next_;
+    
+    free(s);
+  }
+  sock->socks_ = NULL;
 }
 
 char* udp_endpoint_to_string(udp_endpoint_t e)
@@ -194,15 +269,7 @@ char* udp_endpoint_to_string(udp_endpoint_t e)
   return ret;
 }
 
-char* udp_get_local_end_string(udp_socket_t* sock)
-{
-  if(!sock)
-    return NULL;
-
-  return udp_endpoint_to_string(sock->local_end_);
-}
-
-char* udp_get_remote_end_string(udp_socket_t* sock)
+char* udp_get_remote_end_string(udp_t* sock)
 {
   if(!sock || !sock->remote_end_set_)
     return NULL;
@@ -210,27 +277,26 @@ char* udp_get_remote_end_string(udp_socket_t* sock)
   return udp_endpoint_to_string(sock->remote_end_);
 }
  
-int udp_read(udp_socket_t* sock, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
+int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
 {
   if(!sock || !remote_end)
     return -1;
 
   socklen_t socklen = sizeof(*remote_end);
-  return recvfrom(sock->fd_, buf, len, 0, (struct sockaddr *)remote_end, &socklen);
+  return recvfrom(fd, buf, len, 0, (struct sockaddr *)remote_end, &socklen);
 }
 
-int udp_write(udp_socket_t* sock, u_int8_t* buf, u_int32_t len)
+int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
 {
-  if(!sock || !sock->remote_end_set_)
-    return -1;
+  if(!sock || !sock->remote_end_set_ || !sock->active_sock_)
+    return 0;
 
   socklen_t socklen = sizeof(sock->remote_end_);
-#ifdef NO_V4MAPPED
-  if((((struct sockaddr *)&sock->local_end_)->sa_family) == AF_INET)
+  if((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET)
     socklen = sizeof(struct sockaddr_in);
-  else if ((((struct sockaddr *)&sock->local_end_)->sa_family) == AF_INET6)
+  else if ((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET6)
     socklen = sizeof(struct sockaddr_in6);
-#endif
-  return sendto(sock->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_), socklen);;
+
+  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_), socklen);
 }
 
diff --git a/src/udp.h b/src/udp.h
index 02a1c26..edf0160 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -15,7 +15,7 @@
  *  tunneling and relaying of packets of any protocol.
  *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -46,20 +46,28 @@ typedef struct sockaddr_storage udp_endpoint_t;
 struct udp_socket_struct {
   int fd_;
   udp_endpoint_t local_end_;
+  struct udp_socket_struct* next_;
+};
+typedef struct udp_socket_struct udp_socket_t;
+
+struct udp_struct {
+  udp_socket_t* socks_;
+  udp_socket_t* active_sock_;
   udp_endpoint_t remote_end_;
   int remote_end_set_;
 };
-typedef struct udp_socket_struct udp_socket_t;
+typedef struct udp_struct udp_t;
 
-int udp_init(udp_socket_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
-int udp_set_remote(udp_socket_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
-void udp_close(udp_socket_t* sock);
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
+int udp_init_fd_set(udp_t* sock, fd_set* set);
+int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
+void udp_set_active_sock(udp_t* sock, int fd);
+void udp_close(udp_t* sock);
 
 char* udp_endpoint_to_string(udp_endpoint_t e);
-char* udp_get_local_end_string(udp_socket_t* sock);
-char* udp_get_remote_end_string(udp_socket_t* sock);
+char* udp_get_remote_end_string(udp_t* sock);
 
-int udp_read(udp_socket_t* sock, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
-int udp_write(udp_socket_t* sock, u_int8_t* buf, u_int32_t len);
+int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
+int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len);
 
 #endif
diff --git a/version b/version
index d15723f..1c09c74 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-0.3.2
+0.3.3
-- 
2.1.4


From c5f985859279574098e56810a09352573245eb4f Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 17 Feb 2010 03:13:56 +0100
Subject: [PATCH 10/16] Use manpage from doc/uanytun.8.

---
 debian/rules     |   2 +-
 debian/uanytun.8 | 408 -------------------------------------------------------
 2 files changed, 1 insertion(+), 409 deletions(-)
 delete mode 100644 debian/uanytun.8

diff --git a/debian/rules b/debian/rules
index b6b42b9..2b6b62b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -56,7 +56,7 @@ binary-arch: install
 	dh_installdocs
 	dh_installexamples
 	dh_installinit
-	dh_installman debian/uanytun.8
+	dh_installman doc/uanytun.8
 	dh_link
 	dh_strip
 	dh_compress
diff --git a/debian/uanytun.8 b/debian/uanytun.8
deleted file mode 100644
index 5b51ce1..0000000
--- a/debian/uanytun.8
+++ /dev/null
@@ -1,408 +0,0 @@
-'\" t
-.\"     Title: uanytun
-.\"    Author: [see the "AUTHORS" section]
-.\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
-.\"      Date: 12/14/2009
-.\"    Manual: uanytun user manual
-.\"    Source: uanytun 0.3.2
-.\"  Language: English
-.\"
-.TH "UANYTUN" "8" "12/14/2009" "uanytun 0.3.2" "uanytun user manual"
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-uanytun \- micro anycast tunneling daemon
-.SH "SYNOPSIS"
-.sp
-.nf
-\fBuanytun\fR
-  [ \fB\-h|\-\-help\fR ]
-  [ \fB\-D|\-\-nodaemonize\fR ]
-  [ \fB\-u|\-\-username\fR <username> ]
-  [ \fB\-g|\-\-groupname\fR <groupname> ]
-  [ \fB\-C|\-\-chroot\fR <path> ]
-  [ \fB\-P|\-\-write\-pid\fR <filename> ]
-  [ \fB\-L|\-\-log\fR <target>:<level>[,<param1>[,<param2>[\&.\&.]]] ]
-  [ \fB\-i|\-\-interface\fR <ip\-address> ]
-  [ \fB\-p|\-\-port\fR <port> ]
-  [ \fB\-r|\-\-remote\-host\fR <hostname|ip> ]
-  [ \fB\-o|\-\-remote\-port\fR <port> ]
-  [ \fB\-4|\-\-ipv4\-only\fR ]
-  [ \fB\-6|\-\-ipv6\-only\fR ]
-  [ \fB\-d|\-\-dev\fR <name> ]
-  [ \fB\-t|\-\-type\fR <tun|tap> ]
-  [ \fB\-n|\-\-ifconfig\fR <local>/<prefix> ]
-  [ \fB\-x|\-\-post\-up\-script\fR <script> ]
-  [ \fB\-m|\-\-mux\fR <mux\-id> ]
-  [ \fB\-s|\-\-sender\-id\fR <sender id> ]
-  [ \fB\-w|\-\-window\-size\fR <window size> ]
-  [ \fB\-k|\-\-kd\-prf\fR <kd\-prf type> ]
-  [ \fB\-e|\-\-role\fR <role> ]
-  [ \fB\-E|\-\-passphrase\fR <pass phrase> ]
-  [ \fB\-K|\-\-key\fR <master key> ]
-  [ \fB\-A|\-\-salt\fR <master salt> ]
-  [ \fB\-c|\-\-cipher\fR <cipher type> ]
-  [ \fB\-a|\-\-auth\-algo\fR <algo type> ]
-  [ \fB\-b|\-\-auth\-tag\-length\fR <length> ]
-.fi
-.SH "DESCRIPTION"
-.sp
-\fBuAnytun\fR is a tiny implementation of the Secure Anycast Tunneling Protocol (SATP)\&. It provides a complete VPN solution similar to OpenVPN or IPsec in tunnel mode\&. The main difference is that anycast enables the setup of tunnels between an arbitrary combination of anycast, unicast and multicast hosts\&. Unlike Anytun which is a full featured implementation uAnytun has no support for multiple connections or synchronisation\&. It is a small single threaded implementation intended to act as a client on small platforms\&.
-.SH "OPTIONS"
-.sp
-\fBuAnytun\fR has been designed as a peer to peer application, so there is no difference between client and server\&. The following options can be passed to the daemon:
-.PP
-\fB\-D, \-\-nodaemonize\fR
-.RS 4
-This option instructs
-\fBuAnytun\fR
-to run in foreground instead of becoming a daemon which is the default\&.
-.RE
-.PP
-\fB\-u, \-\-username <username>\fR
-.RS 4
-run as this user\&. If no group is specified (\fB\-g\fR) the default group of the user is used\&. The default is to not drop privileges\&.
-.RE
-.PP
-\fB\-g, \-\-groupname <groupname>\fR
-.RS 4
-run as this group\&. If no username is specified (\fB\-u\fR) this gets ignored\&. The default is to not drop privileges\&.
-.RE
-.PP
-\fB\-C, \-\-chroot <path>\fR
-.RS 4
-Instruct
-\fBuAnytun\fR
-to run in a chroot jail\&. The default is to not run in chroot\&.
-.RE
-.PP
-\fB\-P, \-\-write\-pid <filename>\fR
-.RS 4
-Instruct
-\fBuAnytun\fR
-to write it\(cqs pid to this file\&. The default is to not create a pid file\&.
-.RE
-.PP
-\fB\-L, \-\-log <target>:<level>[,<param1>[,<param2>[\&.\&.]]]\fR
-.RS 4
-add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
-
-The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config
-\fBsyslog:3,uanytun,daemon\fR
-is added\&.
-
-The following targets are supported:
-.PP
-\fBsyslog\fR
-.RS 4
-log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
-.RE
-.PP
-\fBfile\fR
-.RS 4
-log to file, parameters <level>[,<path>]
-.RE
-.PP
-\fBstdout\fR
-.RS 4
-log to standard output, parameters <level>
-.RE
-.PP
-\fBstderr\fR
-.RS 4
-log to standard error, parameters <level>
-.RE
-.RE
-.PP
-\fB\-i, \-\-interface <ip address>\fR
-.RS 4
-This IP address is used as the sender address for outgoing packets\&. The default is to not use a special inteface and just bind on all interfaces\&.
-.RE
-.PP
-\fB\-p, \-\-port <port>\fR
-.RS 4
-The local UDP port that is used to send and receive the payload data\&. The two tunnel endpoints can use different ports\&. default: 4444
-.RE
-.PP
-\fB\-r, \-\-remote\-host <hostname|ip>\fR
-.RS 4
-This option can be used to specify the remote tunnel endpoint\&. In case of anycast tunnel endpoints, the anycast IP address has to be used\&. If you do not specify an address, it is automatically determined after receiving the first data packet\&.
-.RE
-.PP
-\fB\-o, \-\-remote\-port <port>\fR
-.RS 4
-The UDP port used for payload data by the remote host (specified with \-p on the remote host)\&. If you do not specify a port, it is automatically determined after receiving the first data packet\&.
-.RE
-.PP
-\fB\-4, \-\-ipv4\-only\fR
-.RS 4
-Resolv to IPv4 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
-.RE
-.PP
-\fB\-6, \-\-ipv6\-only\fR
-.RS 4
-Resolv to IPv6 addresses only\&. The default is to resolv both IPv4 and IPv6 addresses\&.
-.RE
-.PP
-\fB\-d, \-\-dev <name>\fR
-.RS 4
-device name
-
-By default, tapN is used for Ethernet tunnel interfaces, and tunN for IP tunnels, respectively\&. This option can be used to manually override these defaults\&.
-.RE
-.PP
-\fB\-t, \-\-type <tun|tap>\fR
-.RS 4
-device type
-
-Type of the tunnels to create\&. Use tap for Ethernet tunnels, tun for IP tunnels\&.
-.RE
-.PP
-\fB\-n, \-\-ifconfig <local>/<prefix>\fR
-.RS 4
-The local IP address and prefix length\&. The remote tunnel endpoint has to use a different IP address in the same subnet\&.
-.PP
-\fB<local>\fR
-.RS 4
-the local IP address for the tun/tap device
-.RE
-.PP
-\fB<prefix>\fR
-.RS 4
-the prefix length of the network
-.RE
-.RE
-.PP
-\fB\-x, \-\-post\-up\-script <script>\fR
-.RS 4
-This option instructs
-\fBuAnytun\fR
-to run this script after the interface is created\&. By default no script will be executed\&.
-.RE
-.PP
-\fB\-m, \-\-mux <mux\-id>\fR
-.RS 4
-the multiplex id to use\&. default: 0
-.RE
-.PP
-\fB\-s, \-\-sender\-id <sender id>\fR
-.RS 4
-Each anycast tunnel endpoint needs a unique sender id (1, 2, 3, \&...)\&. It is needed to distinguish the senders in case of replay attacks\&. As
-\fBuAnytun\fR
-does not support synchronisation it can\(cqt be used as an anycast endpoint therefore this option is quite useless but implemented for compability reasons\&. default: 0
-.RE
-.PP
-\fB\-w, \-\-window\-size <window size>\fR
-.RS 4
-seqence window size
-
-Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
-.RE
-.PP
-\fB\-k, \-\-kd\(emprf <kd\-prf type>\fR
-.RS 4
-key derivation pseudo random function
-
-The pseudo random function which is used for calculating the session keys and session salt\&.
-
-Possible values:
-.PP
-\fBnull\fR
-.RS 4
-no random function, keys and salt are set to 0\&.\&.00
-.RE
-.PP
-\fBaes\-ctr\fR
-.RS 4
-AES in counter mode with 128 Bits, default value
-.RE
-.PP
-\fBaes\-ctr\-128\fR
-.RS 4
-AES in counter mode with 128 Bits
-.RE
-.PP
-\fBaes\-ctr\-192\fR
-.RS 4
-AES in counter mode with 192 Bits
-.RE
-.PP
-\fBaes\-ctr\-256\fR
-.RS 4
-AES in counter mode with 256 Bits
-.RE
-.RE
-.PP
-\fB\-e, \-\-role <role>\fR
-.RS 4
-SATP uses different session keys for inbound and outbound traffic\&. The role parameter is used to determine which keys to use for outbound or inbound packets\&. On both sides of a vpn connection different roles have to be used\&. Possible values are
-\fBleft\fR
-and
-\fBright\fR\&. You may also use
-\fBalice\fR
-or
-\fBserver\fR
-as a replacement for
-\fBleft\fR
-and
-\fBbob\fR
-or
-\fBclient\fR
-as a replacement for
-\fBright\fR\&. By default
-\fBleft\fR
-is used\&.
-.RE
-.PP
-\fB\-E, \-\-passphrase <pass phrase>\fR
-.RS 4
-This passphrase is used to generate the master key and master salt\&. For the master key the last n bits of the SHA256 digest of the passphrase (where n is the length of the master key in bits) is used\&. The master salt gets generated with the SHA1 digest\&. You may force a specific key and or salt by using
-\fB\-\-key\fR
-and
-\fB\-\-salt\fR\&.
-.RE
-.PP
-\fB\-K, \-\-key <master key>\fR
-.RS 4
-master key to use for key derivation
-
-Master key in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits)\&.
-.RE
-.PP
-\fB\-A, \-\-salt <master salt>\fR
-.RS 4
-master salt to use for key derivation
-
-Master salt in hexadecimal notation, e\&.g\&. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes)\&.
-.RE
-.PP
-\fB\-c, \-\-cipher <cipher type>\fR
-.RS 4
-payload encryption algorithm
-
-Encryption algorithm used for encrypting the payload
-
-Possible values:
-.PP
-\fBnull\fR
-.RS 4
-no encryption
-.RE
-.PP
-\fBaes\-ctr\fR
-.RS 4
-AES in counter mode with 128 Bits, default value
-.RE
-.PP
-\fBaes\-ctr\-128\fR
-.RS 4
-AES in counter mode with 128 Bits
-.RE
-.PP
-\fBaes\-ctr\-192\fR
-.RS 4
-AES in counter mode with 192 Bits
-.RE
-.PP
-\fBaes\-ctr\-256\fR
-.RS 4
-AES in counter mode with 256 Bits
-.RE
-.RE
-.PP
-\fB\-a, \-\-auth\-algo <algo type>\fR
-.RS 4
-message authentication algorithm
-
-This option sets the message authentication algorithm\&.
-
-If HMAC\-SHA1 is used, the packet length is increased\&. The additional bytes contain the authentication data\&. see
-\fB\-\-auth\-tag\-length\fR
-for more info\&.
-
-Possible values:
-.PP
-\fBnull\fR
-.RS 4
-no message authentication
-.RE
-.PP
-\fBsha1\fR
-.RS 4
-HMAC\-SHA1, default value
-.RE
-.RE
-.PP
-\fB\-b, \-\-auth\-tag\-length <length>\fR
-.RS 4
-The number of bytes to use for the auth tag\&. This value defaults to 10 bytes unless the
-\fBnull\fR
-auth algo is used in which case it defaults to 0\&.
-.RE
-.SH "EXAMPLES"
-.SS "P2P Setup between two unicast enpoints:"
-.sp
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.br
-.ps +1
-\fBHost A:\fR
-.RS 4
-.sp
-uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
-.RE
-.sp
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.br
-.ps +1
-\fBHost B:\fR
-.RS 4
-.sp
-uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
-.RE
-.SS "One unicast and one anycast tunnel endpoint:"
-.sp
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.br
-.ps +1
-\fBUnicast tunnel endpoint:\fR
-.RS 4
-.sp
-uanytun \-r anycast\&.anytun\&.org \-d anytun0 \-t tun \-n 192\&.0\&.2\&.2/30 \-a null \-c null \-w 0 \-e client
-.RE
-.sp
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.br
-.ps +1
-\fBAnycast tunnel endpoints:\fR
-.RS 4
-.sp
-As \fBuAnytun\fR can\(cqt work as an anycast endpoint it can\(cqt be used for this purpose\&. You have to use \fBAnytun\fR for that job\&.
-.RE
-.SH "BUGS"
-.sp
-Most likely there are some bugs in \fBuAnytun\fR\&. If you find a bug, please let the developers know at uanytun@anytun\&.org\&. Of course, patches are preferred\&.
-.SH "AUTHORS"
-.sp
-Christian Pointner <equinox@anytun\&.org>
-.SH "RESOURCES"
-.sp
-Main web site: http://www\&.anytun\&.org/
-.SH "COPYING"
-.sp
-Copyright (C) 2008\-2009 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
-- 
2.1.4


From b436236431c1c97b0fa90802393debd91192897a Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@debian.org>
Date: Wed, 17 Feb 2010 03:10:26 +0100
Subject: [PATCH 11/16] Update for release 0.3.3-1.

---
 debian/changelog   | 8 ++++++++
 debian/control     | 2 +-
 etc/init.d/uanytun | 4 ++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index c386032..8f220a5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+uanytun (0.3.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bump Standards-Version to 3.8.4 (no further changes).
+  * Add $remote_fs to Required-{Start,Stop} in initscript.
+
+ -- Michael Prokop <mika@debian.org>  Wed, 17 Feb 2010 03:10:04 +0100
+
 uanytun (0.3.2-2) unstable; urgency=low
 
   * Drop asciidoc and related packages from build-depends and ship
diff --git a/debian/control b/debian/control
index 6058d3a..763a22d 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: net
 Priority: extra
 Maintainer: Michael Prokop <mika@debian.org>
 Build-Depends: debhelper (>= 5), libgcrypt11-dev
-Standards-Version: 3.8.3
+Standards-Version: 3.8.4
 Homepage: http://www.anytun.org/
 Vcs-git: git://git.grml.org/uanytun.git
 Vcs-Browser: http://git.grml.org/?p=uanytun.git
diff --git a/etc/init.d/uanytun b/etc/init.d/uanytun
index 9c2414a..9071e5a 100755
--- a/etc/init.d/uanytun
+++ b/etc/init.d/uanytun
@@ -1,8 +1,8 @@
 #! /bin/sh
 ### BEGIN INIT INFO
 # Provides:          uanytun
-# Required-Start:    $network $named $syslog
-# Required-Stop:     
+# Required-Start:    $remote_fs $network $named $syslog
+# Required-Stop:     $remote_fs
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # Short-Description: Start anycast tunneling daemon at boot time
-- 
2.1.4


From 71f6f666a3d69c6e1e7a77e238362c5bbe288e66 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@grml.org>
Date: Fri, 29 Aug 2014 13:45:10 -0700
Subject: [PATCH 12/16] Imported Upstream version 0.3.5

---
 ChangeLog              |  16 +++-
 LICENSE                |  22 ++++-
 LICENSE.OpenSSL        | 186 ++++++++++++++++++++++++++++++++++++++++
 README                 |  31 ++++---
 doc/Makefile           |  21 ++++-
 doc/uanytun.8          |  31 ++++---
 doc/uanytun.8.txt      |  66 ++++++++-------
 etc/init.d/uanytun     |   4 +-
 src/Makefile           |  19 ++++-
 src/auth_algo.c        | 105 ++++++++++++++---------
 src/auth_algo.h        |  35 ++++++--
 src/bsd/tun.c          |  47 ++++++----
 src/cipher.c           | 106 ++++++++++++++---------
 src/cipher.h           |  35 ++++++--
 src/configure          |  76 +++++++++++++----
 src/daemon.h           |  26 ++++--
 src/datatypes.h        |  19 ++++-
 src/encrypted_packet.c |  21 ++++-
 src/encrypted_packet.h |  19 ++++-
 src/init_crypt.h       |  47 +++++++---
 src/key_derivation.c   | 141 +++++++++++++++++++-----------
 src/key_derivation.h   |  35 ++++++--
 src/linux/tun.c        |  61 ++++++++-----
 src/log.c              |  28 ++++--
 src/log.h              |  19 ++++-
 src/log_targets.h      |  35 +++++---
 src/options.c          |  34 +++++---
 src/options.h          |  20 ++++-
 src/plain_packet.c     |  23 +++--
 src/plain_packet.h     |  21 ++++-
 src/seq_window.c       |  37 +++++---
 src/seq_window.h       |  20 ++++-
 src/sig_handler.c      |  34 ++++++--
 src/sig_handler.h      |  19 ++++-
 src/string_list.c      |  23 +++--
 src/string_list.h      |  19 ++++-
 src/sysexec.c          |  30 +++++--
 src/sysexec.h          |  19 ++++-
 src/tun.h              |  21 ++++-
 src/tun_helper.h       |  21 ++++-
 src/uanytun.c          | 118 +++++++++++++-------------
 src/udp.c              | 226 ++++++++++++++++++++++++++++++-------------------
 src/udp.h              |  39 ++++++---
 version                |   2 +-
 44 files changed, 1420 insertions(+), 557 deletions(-)
 create mode 100644 LICENSE.OpenSSL

diff --git a/ChangeLog b/ChangeLog
index 33d4752..8b9c45a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2014.06.21 -- Version 0.3.5
+
+* added support for libnettle as crypt library
+* added an exception to the license which allows linking with OpenSSL
+
+2014.06.08 -- Version 0.3.4
+
+* fixed build issues for clang
+* refactored the multi socket support
+
 2010.02.16 -- Version 0.3.3
 
 * added -v|--version option
@@ -18,11 +28,11 @@
 * improved script execution
 * added signal handling without races
 * all log_targets print time now too
-	
+
 2009.05.01 -- Version 0.3
 
 * updated to new protocol specification (extended label and crypto role)
-  Mind that due this protocol changes this version is incompatible to older 
+  Mind that due this protocol changes this version is incompatible to older
   version of anytun and uanytun
 * the auth tag length can now be configured
 * added extended logging support (syslog, file, stdout and stderr)
@@ -40,7 +50,7 @@
 
 * fixed bug which prevents the daemon from using the right cipher
   key when using a key derivation rate other than 1
-	
+
 2009.01.11 -- Version 0.2
 
 * added crypto support using libgcrypt or openssl
diff --git a/LICENSE b/LICENSE
index 1406bb5..8146513 100644
--- a/LICENSE
+++ b/LICENSE
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2008 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,7 +31,23 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ *
  */
+
+
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
diff --git a/LICENSE.OpenSSL b/LICENSE.OpenSSL
new file mode 100644
index 0000000..4b57596
--- /dev/null
+++ b/LICENSE.OpenSSL
@@ -0,0 +1,186 @@
+/*
+ *  uAnytun
+ *
+ *  uAnytun is a tiny implementation of SATP. Unlike Anytun which is a full
+ *  featured implementation uAnytun has no support for multiple connections
+ *  or synchronisation. It is a small single threaded implementation intended
+ *  to act as a client on small platforms.
+ *  The secure anycast tunneling protocol (satp) defines a protocol used
+ *  for communication between any combination of unicast and anycast
+ *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
+ *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
+ *  ethernet, ip, arp ...). satp directly includes cryptography and
+ *  message authentication based on the methods used by SRTP.  It is
+ *  intended to deliver a generic, scaleable and secure solution for
+ *  tunneling and relaying of packets of any protocol.
+ *
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
+ *
+ *  This file is part of uAnytun.
+ *
+ *  uAnytun is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  any later version.
+ *
+ *  uAnytun is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ *
+ */
+
+Certain source files in this program permit linking with the OpenSSL
+library (http://www.openssl.org), which otherwise wouldn't be allowed
+under the GPL.  For purposes of identifying OpenSSL, most source files
+giving this permission limit it to versions of OpenSSL having a license
+identical to that listed in this file (LICENSE.OpenSSL).  It is not
+necessary for the copyright years to match between this file and the
+OpenSSL version in question.  However, note that because this file is
+an extension of the license statements of these source files, this file
+may not be changed except with permission from all copyright holders
+of source files in this program which reference this file.
+
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts. Actually both licenses are BSD-style
+  Open Source licenses. In case of any license issues related to OpenSSL
+  please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
diff --git a/README b/README
index 1c70648..dc07a11 100644
--- a/README
+++ b/README
@@ -1,8 +1,8 @@
 Dependencies
 ============
 
-uAnytun can be built by using either libgcrypt or the openssl-crypto library. 
-The latter is more performant in most cases but there are some license 
+uAnytun can be built by using either libgcrypt, libnettle or the openssl-crypto
+library. The latter is more performant in most cases but there are some license
 issues when using this library. It also needs more space when installed.
 
 
@@ -11,7 +11,7 @@ Linux
 (this includes Debian with FreeBSD Kernel)
 
 using libgcrypt:
- 
+
  build-essential
  libgcrypt11-dev
 
@@ -20,6 +20,15 @@ using ssl crypto library:
  build-essential
  libssl-dev
 
+using nettle crypto library:
+
+ build-essential
+ nettle-dev
+
+if you want clang as compiler
+
+ clang
+
 if you want to rebuild the manpage:
 
  asciidoc
@@ -43,7 +52,7 @@ if you want to rebuild the manpage:
  textproc/libxslt
  textproc/docbook-xsl
  sysutils/readlink
- misc/getopt 
+ misc/getopt
 
 
 
@@ -72,7 +81,7 @@ using ssl crypto library:
 # ./configure --use-ssl-crypto
 # make
 
-Notes: 
+Notes:
   - try './configure --help' for further information
   - if using openssl pre 0.9.8 you have to disable passphrase
     because openssl had no SHA256 implementation prior to this
@@ -93,7 +102,7 @@ Uninstalling
 
 # sudo make remove
 
-This removes everytthing except for the config files
+This removes everything except for the config files
 
 # sudo make purge
 
@@ -107,20 +116,20 @@ Usage:
 init.d script
 -------------
 
-The init.d script can be used to start uanytun at boot time. It searches for 
+The init.d script can be used to start uanytun at boot time. It searches for
 configuration files which reside at $CONFIG_DIR. For each instance of uanytun
 which should be started there must be a directory containing at least a file
 named config. This file must contain all command line parameter which should
 be used when starting the daemon. One line for each parameter. Empty lines and
 lines starting with # are ignored. Besides the config file there may be a script
-named post-up.sh which will be called when the tun/tap device comes up. 
+named post-up.sh which will be called when the tun/tap device comes up.
 This is an example of how the init.d script can be used to start uanytun:
 
 # /etc/init.d/uanytun start client1 p2p-a
 
 In this case the script will start 2 instances of uanytun using the config files
-$CONFIG_DIR/client1/config and $CONFIG_DIR/p2p-a/config. 
+$CONFIG_DIR/client1/config and $CONFIG_DIR/p2p-a/config.
 If no instance name is specified the script will use the file $CONFIG_DIR/autostart
-to determine which instances to start or stop. This file must contain a list 
-of instance names which should be used when no names are specified at the command 
+to determine which instances to start or stop. This file must contain a list
+of instance names which should be used when no names are specified at the command
 line. One line for each name. Empty lines and lines starting with # are ignored.
diff --git a/doc/Makefile b/doc/Makefile
index b5eecb8..1e4b315 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -10,12 +10,12 @@
 ##  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 ##  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 ##  ethernet, ip, arp ...). satp directly includes cryptography and
-##  message authentication based on the methodes used by SRTP.  It is
+##  message authentication based on the methods used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
-##  
 ##
-##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+##
+##  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -32,10 +32,23 @@
 ##  You should have received a copy of the GNU General Public License
 ##  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 ##
+##  In addition, as a special exception, the copyright holders give
+##  permission to link the code of portions of this program with the
+##  OpenSSL library under certain conditions as described in each
+##  individual source file, and distribute linked combinations
+##  including the two.
+##  You must obey the GNU General Public License in all respects
+##  for all of the code used other than OpenSSL.  If you modify
+##  file(s) with this exception, you may extend this exception to your
+##  version of the file(s), but you are not obligated to do so.  If you
+##  do not wish to do so, delete this exception statement from your
+##  version.  If you delete this exception statement from all source
+##  files in the program, then also delete it here.
+##
 
 VERSION=$(shell cat ../version)
 
-.PHONY: clean 
+.PHONY: clean
 
 all: manpage
 
diff --git a/doc/uanytun.8 b/doc/uanytun.8
index 7126c00..299c742 100644
--- a/doc/uanytun.8
+++ b/doc/uanytun.8
@@ -1,13 +1,22 @@
 '\" t
 .\"     Title: uanytun
 .\"    Author: [see the "AUTHORS" section]
-.\" Generator: DocBook XSL Stylesheets v1.75.1 <http://docbook.sf.net/>
-.\"      Date: 02/17/2010
-.\"    Manual: uanytun user manual
-.\"    Source: uanytun 0.3.3
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 06/21/2014
+.\"    Manual: \ \&
+.\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "UANYTUN" "8" "02/17/2010" "uanytun 0.3.3" "uanytun user manual"
+.TH "UANYTUN" "8" "06/21/2014" "\ \&" "\ \&"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 .\" -----------------------------------------------------------------
@@ -94,9 +103,9 @@ to write it\(cqs pid to this file\&. The default is to not create a pid file\&.
 .PP
 \fB\-L, \-\-log \fR\fB\fI<target>:<level>[,<param1>[,<param2>[\&.\&.]]]\fR\fR
 .RS 4
-add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target hast its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
+add log target to logging system\&. This can be invoked several times in order to log to different targets at the same time\&. Every target has its own log level which is a number between 0 and 5\&. Where 0 means disabling log and 5 means debug messages are enabled\&.
 
-The file target can be used more the once with different levels\&. If no target is provided at the command line a single target with the config
+The file target can be used more than once with different levels\&. If no target is provided at the command line a single target with the config
 \fIsyslog:3,uanytun,daemon\fR
 is added\&.
 
@@ -216,7 +225,7 @@ does not support synchronisation it can\(cqt be used as an anycast endpoint ther
 .RS 4
 seqence window size
 
-Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\' sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
+Sometimes, packets arrive out of order on the receiver side\&. This option defines the size of a list of received packets\*(Aq sequence numbers\&. If, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped\&. A value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their secuence number\&. By default the sequence window is disabled and therefore a window size of 0 is used\&.
 .RE
 .PP
 \fB\-k, \-\-kd\(emprf \fR\fB\fI<kd\-prf type>\fR\fR
@@ -370,7 +379,7 @@ auth algo is used in which case it defaults to 0\&.
 \fBHost A:\fR
 .RS 4
 .sp
-uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e left
+uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E have_a_very_safe_and_productive_day \-e left
 .RE
 .sp
 .it 1 an-trap
@@ -381,7 +390,7 @@ uanytun \-r hostb\&.example\&.com \-t tun \-n 192\&.168\&.123\&.1/30 \-c aes\-ct
 \fBHost B:\fR
 .RS 4
 .sp
-uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \e \-E have_a_very_safe_and_productive_day \-e right
+uanytun \-r hosta\&.example\&.com \-t tun \-n 192\&.168\&.123\&.2/30 \-c aes\-ctr\-256 \-k aes\-ctr\-256 \-E have_a_very_safe_and_productive_day \-e right
 .RE
 .SS "One unicast and one anycast tunnel endpoint:"
 .sp
@@ -417,4 +426,4 @@ Christian Pointner <equinox@anytun\&.org>
 Main web site: http://www\&.anytun\&.org/
 .SH "COPYING"
 .sp
-Copyright (C) 2008\-2010 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
+Copyright (C) 2008\-2014 Christian Pointner\&. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version\&.
diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 6fde9d2..ed978d4 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -51,9 +51,9 @@ DESCRIPTION
 (SATP). It provides a complete VPN solution similar to OpenVPN or
 IPsec in tunnel mode. The main difference is that anycast enables the
 setup of tunnels between an arbitrary combination of anycast, unicast
-and multicast hosts. Unlike Anytun which is a full featured implementation 
-uAnytun has no support for multiple connections or synchronisation. It is a 
-small single threaded implementation intended to act as a client on small 
+and multicast hosts. Unlike Anytun which is a full featured implementation
+uAnytun has no support for multiple connections or synchronisation. It is a
+small single threaded implementation intended to act as a client on small
 platforms.
 
 
@@ -69,7 +69,7 @@ passed to the daemon:
    instead of becoming a daemon which is the default.
 
 *-u, --username '<username>'*::
-   run as this user. If no group is specified (*-g*) the default group of 
+   run as this user. If no group is specified (*-g*) the default group of
    the user is used. The default is to not drop privileges.
 
 *-g, --groupname '<groupname>'*::
@@ -77,30 +77,30 @@ passed to the daemon:
    The default is to not drop privileges.
 
 *-C, --chroot '<path>'*::
-   Instruct *uAnytun* to run in a chroot jail. The default is 
+   Instruct *uAnytun* to run in a chroot jail. The default is
    to not run in chroot.
 
 *-P, --write-pid <filename>*::
-   Instruct *uAnytun* to write it's pid to this file. The default is 
+   Instruct *uAnytun* to write it's pid to this file. The default is
    to not create a pid file.
 
 *-L, --log '<target>:<level>[,<param1>[,<param2>[..]]]'*::
    add log target to logging system. This can be invoked several times
-   in order to log to different targets at the same time. Every target 
-   hast its own log level which is a number between 0 and 5. Where 0 means
+   in order to log to different targets at the same time. Every target
+   has its own log level which is a number between 0 and 5. Where 0 means
    disabling log and 5 means debug messages are enabled. +
-   The file target can be used more the once with different levels.
-   If no target is provided at the command line a single target with the 
+   The file target can be used more than once with different levels.
+   If no target is provided at the command line a single target with the
    config 'syslog:3,uanytun,daemon' is added. +
    The following targets are supported:
 
    'syslog';; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
    'file';; log to file, parameters <level>[,<path>]
    'stdout';; log to standard output, parameters <level>
-   'stderr';; log to standard error, parameters <level> 
+   'stderr';; log to standard error, parameters <level>
 
 *-U, --debug*::
-   This option instructs *uAnytun* to run in debug mode. It implicits *-D* 
+   This option instructs *uAnytun* to run in debug mode. It implicits *-D*
    (don't daemonize) and adds a log target with the configuration
    'stdout:5' (logging with maximum level). In future releases there might
    be additional output when this option is supplied.
@@ -155,7 +155,7 @@ passed to the daemon:
    '<prefix>';; the prefix length of the network
 
 *-x, --post-up-script '<script>'*::
-   This option instructs *uAnytun* to run this script after the interface 
+   This option instructs *uAnytun* to run this script after the interface
    is created. By default no script will be executed.
 
 *-m, --mux '<mux-id>'*::
@@ -164,9 +164,9 @@ passed to the daemon:
 *-s, --sender-id '<sender id>'*::
    Each anycast tunnel endpoint needs a unique sender id
    (1, 2, 3, ...). It is needed to distinguish the senders
-   in case of replay attacks. As *uAnytun* does not support 
-   synchronisation it can't be used as an anycast endpoint therefore 
-   this option is quite useless but implemented for compatibility 
+   in case of replay attacks. As *uAnytun* does not support
+   synchronisation it can't be used as an anycast endpoint therefore
+   this option is quite useless but implemented for compatibility
    reasons. default: 0
 
 *-w, --window-size '<window size>'*::
@@ -185,7 +185,7 @@ passed to the daemon:
 
 *-k, --kd--prf '<kd-prf type>'*::
    key derivation pseudo random function +
-   The pseudo random function which is used for calculating the 
+   The pseudo random function which is used for calculating the
    session keys and session salt. +
    Possible values:
 
@@ -198,16 +198,16 @@ passed to the daemon:
 *-e, --role '<role>'*::
    SATP uses different session keys for inbound and outbound traffic. The
    role parameter is used to determine which keys to use for outbound or
-   inbound packets. On both sides of a vpn connection different roles have 
-   to be used. Possible values are 'left' and 'right'. You may also use 
-   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as 
+   inbound packets. On both sides of a vpn connection different roles have
+   to be used. Possible values are 'left' and 'right'. You may also use
+   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as
    a replacement for 'right'. By default 'left' is used.
 
 *-E, --passphrase '<pass phrase>'*::
    This passphrase is used to generate the master key and master salt.
-   For the master key the last n bits of the SHA256 digest of the 
-   passphrase (where n is the length of the master key in bits) is used. 
-   The master salt gets generated with the SHA1 digest. 
+   For the master key the last n bits of the SHA256 digest of the
+   passphrase (where n is the length of the master key in bits) is used.
+   The master salt gets generated with the SHA1 digest.
    You may force a specific key and or salt by using *--key* and *--salt*.
 
 *-K, --key '<master key>'*::
@@ -236,7 +236,7 @@ passed to the daemon:
 *-a, --auth-algo '<algo type>'*::
    message authentication algorithm +
    This option sets the message authentication algorithm. +
-   If HMAC-SHA1 is used, the packet length is increased. The additional bytes 
+   If HMAC-SHA1 is used, the packet length is increased. The additional bytes
    contain the authentication data. see *--auth-tag-length* for more info. +
    Possible values:
 
@@ -244,8 +244,8 @@ passed to the daemon:
    'sha1';; HMAC-SHA1, default value
 
 *-b, --auth-tag-length '<length>'*::
-   The number of bytes to use for the auth tag. This value defaults to 10 bytes 
-   unless the 'null' auth algo is used in which case it defaults to 0. 
+   The number of bytes to use for the auth tag. This value defaults to 10 bytes
+   unless the 'null' auth algo is used in which case it defaults to 0.
 
 
 EXAMPLES
@@ -257,17 +257,18 @@ P2P Setup between two unicast enpoints:
 Host A:
 ^^^^^^^
 
-uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e left
 
 Host B:
 ^^^^^^^
-uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e right
 
+
 One unicast and one anycast tunnel endpoint:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- 
+
 Unicast tunnel endpoint:
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -281,6 +282,7 @@ have to use *Anytun* for that job.
 
 BUGS
 ----
+
 Most likely there are some bugs in *uAnytun*. If you find a bug, please let
 the developers know at uanytun@anytun.org. Of course, patches are preferred.
 
@@ -300,7 +302,7 @@ Main web site: http://www.anytun.org/
 COPYING
 -------
 
-Copyright \(C) 2008-2010 Christian Pointner. This  program is  free 
-software: you can redistribute it and/or modify it under the terms 
-of the GNU General Public License as published by the Free Software 
+Copyright \(C) 2008-2014 Christian Pointner. This  program is  free
+software: you can redistribute it and/or modify it under the terms
+of the GNU General Public License as published by the Free Software
 Foundation, either version 3 of the License, or any later version.
diff --git a/etc/init.d/uanytun b/etc/init.d/uanytun
index 9c2414a..9071e5a 100755
--- a/etc/init.d/uanytun
+++ b/etc/init.d/uanytun
@@ -1,8 +1,8 @@
 #! /bin/sh
 ### BEGIN INIT INFO
 # Provides:          uanytun
-# Required-Start:    $network $named $syslog
-# Required-Stop:     
+# Required-Start:    $remote_fs $network $named $syslog
+# Required-Stop:     $remote_fs
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # Short-Description: Start anycast tunneling daemon at boot time
diff --git a/src/Makefile b/src/Makefile
index 5ed36d9..feccbaa 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -10,12 +10,12 @@
 ##  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 ##  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 ##  ethernet, ip, arp ...). satp directly includes cryptography and
-##  message authentication based on the methodes used by SRTP.  It is
+##  message authentication based on the methods used by SRTP.  It is
 ##  intended to deliver a generic, scaleable and secure solution for
 ##  tunneling and relaying of packets of any protocol.
-##  
 ##
-##  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+##
+##  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 ##
 ##  This file is part of uAnytun.
 ##
@@ -32,6 +32,19 @@
 ##  You should have received a copy of the GNU General Public License
 ##  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 ##
+##  In addition, as a special exception, the copyright holders give
+##  permission to link the code of portions of this program with the
+##  OpenSSL library under certain conditions as described in each
+##  individual source file, and distribute linked combinations
+##  including the two.
+##  You must obey the GNU General Public License in all respects
+##  for all of the code used other than OpenSSL.  If you modify
+##  file(s) with this exception, you may extend this exception to your
+##  version of the file(s), but you are not obligated to do so.  If you
+##  do not wish to do so, delete this exception statement from your
+##  version.  If you delete this exception statement from all source
+##  files in the program, then also delete it here.
+##
 
 ifneq ($(MAKECMDGOALS),distclean)
 include include.mk
diff --git a/src/auth_algo.c b/src/auth_algo.c
index b148946..ac102c7 100644
--- a/src/auth_algo.c
+++ b/src/auth_algo.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -50,7 +63,7 @@ auth_algo_type_t auth_algo_get_type(const char* type)
     return aa_null;
   else if(!strcmp(type, "sha1"))
     return aa_sha1;
-  
+
   return aa_unknown;
 }
 
@@ -65,7 +78,7 @@ u_int32_t auth_algo_get_max_length(const char* type)
 
 int auth_algo_init(auth_algo_t* aa, const char* type)
 {
-  if(!aa) 
+  if(!aa)
     return -1;
 
   aa->type_ = auth_algo_get_type(type);
@@ -103,7 +116,7 @@ void auth_algo_close(auth_algo_t* aa)
 
 void auth_algo_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* packet)
 {
-  if(!aa) 
+  if(!aa)
     return;
 
   if(aa->type_ == aa_null)
@@ -118,7 +131,7 @@ void auth_algo_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivation_di
 
 int auth_algo_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* packet)
 {
-  if(!aa) 
+  if(!aa)
     return 0;
 
   if(aa->type_ == aa_null)
@@ -152,17 +165,19 @@ int auth_algo_sha1_init(auth_algo_t* aa)
   if(!aa->params_)
     return -2;
 
+#if defined(USE_SSL_CRYPTO)
+  auth_algo_sha1_param_t* params = aa->params_;
+  HMAC_CTX_init(&params->ctx_);
+  HMAC_Init_ex(&params->ctx_, NULL, 0, EVP_sha1(), NULL);
+#elif defined(USE_NETTLE)
+  // nothing here
+#else  // USE_GCRYPT is the default
   auth_algo_sha1_param_t* params = aa->params_;
-
-#ifndef USE_SSL_CRYPTO
   gcry_error_t err = gcry_md_open(&params->handle_, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC);
   if(err) {
     log_printf(ERROR, "failed to open message digest algo: %s", gcry_strerror(err));
     return -1;
-  } 
-#else
-  HMAC_CTX_init(&params->ctx_);
-  HMAC_Init_ex(&params->ctx_, NULL, 0, EVP_sha1(), NULL);
+  }
 #endif
 
   return 0;
@@ -174,14 +189,16 @@ void auth_algo_sha1_close(auth_algo_t* aa)
     return;
 
   if(aa->params_) {
+#if defined(USE_SSL_CRYPTO)
+    auth_algo_sha1_param_t* params = aa->params_;
+    HMAC_CTX_cleanup(&params->ctx_);
+#elif defined(USE_NETTLE)
+    // nothing here
+#else  // USE_GCRYPT is the default
     auth_algo_sha1_param_t* params = aa->params_;
-
-#ifndef USE_SSL_CRYPTO
     if(params->handle_)
       gcry_md_close(params->handle_);
-#else
-    HMAC_CTX_cleanup(&params->ctx_);
-#endif    
+#endif
 
     free(aa->params_);
   }
@@ -207,23 +224,29 @@ void auth_algo_sha1_generate(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(ret < 0)
     return;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
+  HMAC_Final(&params->ctx_, hmac, NULL);
+#elif defined(USE_NETTLE)
+  hmac_sha1_set_key(&params->ctx_, aa->key_.length_, aa->key_.buf_);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  hmac_sha1_update(&params->ctx_, encrypted_packet_get_auth_portion_length(packet), encrypted_packet_get_auth_portion(packet));
+  hmac_sha1_digest(&params->ctx_, SHA1_LENGTH, hmac);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_md_setkey(params->handle_, aa->key_.buf_, aa->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
     return;
-  } 
-  
+  }
+
   gcry_md_reset(params->handle_);
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
   gcry_md_final(params->handle_);
   u_int8_t* hmac = gcry_md_read(params->handle_, 0);
-#else
-  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
-
-  u_int8_t hmac[SHA1_LENGTH];
-  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
-  HMAC_Final(&params->ctx_, hmac, NULL);
 #endif
 
   u_int8_t* tag = encrypted_packet_get_auth_tag(packet);
@@ -255,23 +278,29 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(ret < 0)
     return 0;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
+  HMAC_Final(&params->ctx_, hmac, NULL);
+#elif defined(USE_NETTLE)
+  hmac_sha1_set_key(&params->ctx_, aa->key_.length_, aa->key_.buf_);
+
+  u_int8_t hmac[SHA1_LENGTH];
+  hmac_sha1_update(&params->ctx_, encrypted_packet_get_auth_portion_length(packet), encrypted_packet_get_auth_portion(packet));
+  hmac_sha1_digest(&params->ctx_, SHA1_LENGTH, hmac);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_md_setkey(params->handle_, aa->key_.buf_, aa->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set hmac key: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 
   gcry_md_reset(params->handle_);
   gcry_md_write(params->handle_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
   gcry_md_final(params->handle_);
   u_int8_t* hmac = gcry_md_read(params->handle_, 0);
-#else
-  HMAC_Init_ex(&params->ctx_, aa->key_.buf_, aa->key_.length_, EVP_sha1(), NULL);
-
-  u_int8_t hmac[SHA1_LENGTH];
-  HMAC_Update(&params->ctx_, encrypted_packet_get_auth_portion(packet), encrypted_packet_get_auth_portion_length(packet));
-  HMAC_Final(&params->ctx_, hmac, NULL);
 #endif
 
   u_int8_t* tag = encrypted_packet_get_auth_tag(packet);
@@ -280,11 +309,11 @@ int auth_algo_sha1_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivati
   if(length > SHA1_LENGTH) {
     u_int32_t i;
     for(i=0; i < (encrypted_packet_get_auth_tag_length(packet) - SHA1_LENGTH); ++i)
-      if(tag[i]) return 0; 
+      if(tag[i]) return 0;
   }
-  
+
   int result = memcmp(&tag[encrypted_packet_get_auth_tag_length(packet) - length], &hmac[SHA1_LENGTH - length], length);
-  
+
   if(result)
     return 0;
 
diff --git a/src/auth_algo.h b/src/auth_algo.h
index 1007955..d1e5178 100644
--- a/src/auth_algo.h
+++ b/src/auth_algo.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,15 +31,30 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_auth_algo_h_INCLUDED
 #define UANYTUN_auth_algo_h_INCLUDED
 
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/hmac.h>
+#elif defined(USE_NETTLE)
+#include <nettle/hmac.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 #include "key_derivation.h"
 #include "encrypted_packet.h"
@@ -66,10 +81,12 @@ int auth_algo_check_tag(auth_algo_t* aa, key_derivation_t* kd, key_derivation_di
 #define SHA1_LENGTH 20
 
 struct auth_algo_sha1_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_md_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   HMAC_CTX ctx_;
+#elif defined(USE_NETTLE)
+  struct hmac_sha1_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_md_hd_t handle_;
 #endif
 };
 typedef struct auth_algo_sha1_param_struct auth_algo_sha1_param_t;
diff --git a/src/bsd/tun.c b/src/bsd/tun.c
index a995c35..a469c58 100644
--- a/src/bsd/tun.c
+++ b/src/bsd/tun.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -58,9 +71,9 @@
 
 int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, const char* ifcfg_addr, u_int16_t ifcfg_prefix)
 {
-  if(!dev) 
+  if(!dev)
     return -1;
- 
+
   tun_conf(dev, dev_name, dev_type, ifcfg_addr, ifcfg_prefix, 1400);
   dev->actual_name_ = NULL;
 
@@ -109,7 +122,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
         tun_close(dev);
         return -2;
       }
-        
+
       dev->fd_ = open(device_file_tmp, O_RDWR);
       free(device_file_tmp);
       if(dev->fd_ >= 0)
@@ -125,7 +138,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
       log_printf(ERROR, "can't open device file dynamically: no unused node left");
     else
       log_printf(ERROR, "can't open device file (%s): %s", device_file, strerror(errno));
-    
+
     tun_close(dev);
     return -1;
   }
@@ -164,18 +177,18 @@ int tun_init_post(tun_device_t* dev)
   dev->with_pi_ = 1;
   if(dev->type_ == TYPE_TAP)
     dev->with_pi_ = 0;
-  
-  struct tuninfo ti;  
+
+  struct tuninfo ti;
 
   if(ioctl(dev->fd_, TUNGIFINFO, &ti) < 0) {
     log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
     return -1;
-  }  
+  }
 
   ti.flags |= IFF_MULTICAST;
   if(dev->type_ == TYPE_TUN)
     ti.flags &= ~IFF_POINTOPOINT;
-  
+
   if(ioctl(dev->fd_, TUNSIFINFO, &ti) < 0) {
     log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
     return -1;
@@ -199,20 +212,20 @@ int tun_init_post(tun_device_t* dev)
     if(ioctl(dev->fd_, TUNSLMODE, &arg) < 0) {
       log_printf(ERROR, "can't disable link-layer mode for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
 
     arg = 1;
     if(ioctl(dev->fd_, TUNSIFHEAD, &arg) < 0) {
       log_printf(ERROR, "can't enable multi-af mode for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
 
     arg = IFF_BROADCAST;
     arg |= IFF_MULTICAST;
     if(ioctl(dev->fd_, TUNSIFMODE, &arg) < 0) {
       log_printf(ERROR, "can't enable multicast for interface: %s", strerror(errno));
       return -1;
-    }  
+    }
   }
 
   return 0;
@@ -268,7 +281,7 @@ int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
   {
     struct iovec iov[2];
     u_int32_t type;
-    
+
     iov[0].iov_base = &type;
     iov[0].iov_len = sizeof(type);
     iov[1].iov_base = buf;
@@ -292,13 +305,13 @@ int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
     struct iovec iov[2];
     u_int32_t type;
     struct ip *hdr = (struct ip*)buf;
-    
+
     type = 0;
     if(hdr->ip_v == 4)
       type = htonl(AF_INET);
     else
       type = htonl(AF_INET6);
-    
+
     iov[0].iov_base = &type;
     iov[0].iov_len = sizeof(type);
     iov[1].iov_base = buf;
diff --git a/src/cipher.c b/src/cipher.c
index 8913f64..f87e2cf 100644
--- a/src/cipher.c
+++ b/src/cipher.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -39,6 +52,9 @@
 #include "encrypted_packet.h"
 
 #include "cipher.h"
+#if defined(USE_NETTLE)
+#include <nettle/ctr.h>
+#endif
 
 #include "log.h"
 
@@ -47,7 +63,7 @@
 
 int cipher_init(cipher_t* c, const char* type)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
   c->key_length_ = 0;
@@ -61,7 +77,7 @@ int cipher_init(cipher_t* c, const char* type)
     if(type[7] == 0) {
       c->key_length_ = C_AESCTR_DEFAULT_KEY_LENGTH;
     }
-    else if(type[7] != '-') 
+    else if(type[7] != '-')
       return -1;
     else {
       const char* tmp = &type[8];
@@ -113,12 +129,12 @@ void cipher_close(cipher_t* c)
 
 int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir, plain_packet_t* in, encrypted_packet_t* out, seq_nr_t seq_nr, sender_id_t sender_id, mux_t mux)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
-	int32_t len;
+  int32_t len;
   if(c->type_ == c_null)
-    len = cipher_null_crypt(plain_packet_get_packet(in), plain_packet_get_length(in), 
+    len = cipher_null_crypt(plain_packet_get_packet(in), plain_packet_get_length(in),
                             encrypted_packet_get_payload(out), encrypted_packet_get_payload_length(out));
 #ifndef NO_CRYPT
   else if(c->type_ == c_aes_ctr)
@@ -134,7 +150,7 @@ int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
   if(len < 0)
     return 0;
 
-	encrypted_packet_set_sender_id(out, sender_id);
+  encrypted_packet_set_sender_id(out, sender_id);
   encrypted_packet_set_seq_nr(out, seq_nr);
   encrypted_packet_set_mux(out, mux);
 
@@ -145,10 +161,10 @@ int cipher_encrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
 
 int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir, encrypted_packet_t* in, plain_packet_t* out)
 {
-  if(!c) 
+  if(!c)
     return -1;
 
-	int32_t len;
+  int32_t len;
   if(c->type_ == c_null)
     len = cipher_null_crypt(encrypted_packet_get_payload(in), encrypted_packet_get_payload_length(in),
                             plain_packet_get_packet(out), plain_packet_get_length(out));
@@ -163,11 +179,11 @@ int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
     log_printf(ERROR, "unknown cipher type");
     return -1;
   }
-  
+
   if(len < 0)
     return 0;
 
-	plain_packet_set_length(out, len);
+  plain_packet_set_length(out, len);
 
   return 0;
 }
@@ -176,7 +192,7 @@ int cipher_decrypt(cipher_t* c, key_derivation_t* kd, key_derivation_dir_t dir,
 
 int32_t cipher_null_crypt(u_int8_t* in, u_int32_t ilen, u_int8_t* out, u_int32_t olen)
 {
-	memcpy(out, in, (ilen < olen) ? ilen : olen);
+  memcpy(out, in, (ilen < olen) ? ilen : olen);
   return (ilen < olen) ? ilen : olen;
 }
 
@@ -210,9 +226,11 @@ int cipher_aesctr_init(cipher_t* c)
   if(!c->params_)
     return -2;
 
-  cipher_aesctr_param_t* params = c->params_;
-
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  // nothing here
+#elif defined(USE_NETTLE)
+  // nothing here
+#else  // USE_GCRYPT is the default
   int algo;
   switch(c->key_length_) {
   case 128: algo = GCRY_CIPHER_AES128; break;
@@ -224,11 +242,12 @@ int cipher_aesctr_init(cipher_t* c)
   }
   }
 
+  cipher_aesctr_param_t* params = c->params_;
   gcry_error_t err = gcry_cipher_open(&params->handle_, algo, GCRY_CIPHER_MODE_CTR, 0);
   if(err) {
     log_printf(ERROR, "failed to open cipher: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 #endif
 
   return 0;
@@ -240,13 +259,14 @@ void cipher_aesctr_close(cipher_t* c)
     return;
 
   if(c->params_) {
+#if defined(USE_SSL_CRYPTO)
+    // nothing here
+#elif defined(USE_NETTLE)
+    // nothing here
+#else  // USE_GCRYPT is the default
     cipher_aesctr_param_t* params = c->params_;
-
-#ifndef USE_SSL_CRYPTO
-    if(params->handle_)
-      gcry_cipher_close(params->handle_);
+    gcry_cipher_close(params->handle_);
 #endif
-
     free(c->params_);
   }
 }
@@ -255,7 +275,7 @@ int cipher_aesctr_calc_ctr(cipher_t* c, key_derivation_t* kd, key_derivation_dir
 {
   if(!c || !c->params_)
     return -1;
-  
+
   cipher_aesctr_param_t* params = c->params_;
 
   int ret = key_derivation_generate(kd, dir, LABEL_SALT, seq_nr, c->salt_.buf_, C_AESCTR_SALT_LENGTH);
@@ -288,14 +308,16 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
   int ret = key_derivation_generate(kd, dir, LABEL_ENC, seq_nr, c->key_.buf_, c->key_.length_);
   if(ret < 0)
     return ret;
-  
-#ifdef USE_SSL_CRYPTO
+
+#if defined(USE_SSL_CRYPTO)
   ret = AES_set_encrypt_key(c->key_.buf_, c->key_length_, &params->aes_key_);
   if(ret) {
-    log_printf(ERROR, "failed to set cipher ssl aes-key (code: %d)", ret);
+    log_printf(ERROR, "failed to set cipher key (code: %d)", ret);
     return -1;
   }
-#else
+#elif defined(USE_NETTLE)
+  aes_set_encrypt_key(&params->ctx_, c->key_.length_, c->key_.buf_);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_cipher_setkey(params->handle_, c->key_.buf_, c->key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set cipher key: %s", gcry_strerror(err));
@@ -308,8 +330,22 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
     log_printf(ERROR, "failed to calculate cipher CTR");
     return ret;
   }
-  
-#ifndef USE_SSL_CRYPTO
+
+#if defined(USE_SSL_CRYPTO)
+  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  u_int32_t num = 0;
+  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
+  AES_ctr128_encrypt(in, out, (ilen < olen) ? ilen : olen, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
+#elif defined(USE_NETTLE)
+  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  ctr_crypt(&params->ctx_, (nettle_crypt_func *)(aes_encrypt), AES_BLOCK_SIZE, params->ctr_.buf_, (ilen < olen) ? ilen : olen, out, in);
+#else  // USE_GCRYPT is the default
   err = gcry_cipher_setctr(params->handle_, params->ctr_.buf_, C_AESCTR_CTR_LENGTH);
   if(err) {
     log_printf(ERROR, "failed to set cipher CTR: %s", gcry_strerror(err));
@@ -321,16 +357,8 @@ int32_t cipher_aesctr_crypt(cipher_t* c, key_derivation_t* kd, key_derivation_di
     log_printf(ERROR, "failed to de/encrypt packet: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  if(C_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
-    log_printf(ERROR, "failed to set cipher CTR: size don't fits");
-    return -1;
-  }
-  u_int32_t num = 0;
-  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
-  AES_ctr128_encrypt(in, out, (ilen < olen) ? ilen : olen, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
 
-  return (ilen < olen) ? ilen : olen;  
+  return (ilen < olen) ? ilen : olen;
 }
 #endif
diff --git a/src/cipher.h b/src/cipher.h
index e33d815..570df8d 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,16 +31,31 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_cipher_h_INCLUDED
 #define UANYTUN_cipher_h_INCLUDED
 
 #ifndef NO_CRYPT
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/aes.h>
+#elif defined(USE_NETTLE)
+#include <nettle/aes.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 #include "key_derivation.h"
 #else
@@ -94,11 +109,13 @@ union __attribute__((__packed__)) cipher_aesctr_ctr_union {
 typedef union cipher_aesctr_ctr_union cipher_aesctr_ctr_t;
 
 struct cipher_aesctr_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_cipher_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   AES_KEY aes_key_;
   u_int8_t ecount_buf_[AES_BLOCK_SIZE];
+#elif defined(USE_NETTLE)
+  struct aes_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_cipher_hd_t handle_;
 #endif
   cipher_aesctr_ctr_t ctr_;
 };
diff --git a/src/configure b/src/configure
index ee80582..16d5cc7 100755
--- a/src/configure
+++ b/src/configure
@@ -11,12 +11,12 @@
 #  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
 #  mode and allows tunneling of every ETHER TYPE protocol (e.g.
 #  ethernet, ip, arp ...). satp directly includes cryptography and
-#  message authentication based on the methodes used by SRTP.  It is
+#  message authentication based on the methods used by SRTP.  It is
 #  intended to deliver a generic, scaleable and secure solution for
 #  tunneling and relaying of packets of any protocol.
-#  
 #
-#  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+#
+#  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
 #
 #  This file is part of uAnytun.
 #
@@ -33,13 +33,24 @@
 #  You should have received a copy of the GNU General Public License
 #  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
 #
+#   In addition, as a special exception, the copyright holders give
+#   permission to link the code of portions of this program with the
+#   OpenSSL library under certain conditions as described in each
+#   individual source file, and distribute linked combinations
+#   including the two.
+#   You must obey the GNU General Public License in all respects
+#   for all of the code used other than OpenSSL.  If you modify
+#   file(s) with this exception, you may extend this exception to your
+#   version of the file(s), but you are not obligated to do so.  If you
+#   do not wish to do so, delete this exception statement from your
+#   version.  If you delete this exception statement from all source
+#   files in the program, then also delete it here.
+#
 
 TARGET=`uname -s`
-
 EBUILD_COMPAT=0
 
-CFLAGS='-g -O2'
-LDFLAGS='-g -Wall -O2'
+USE_CLANG=0
 
 CRYPTO_LIB='gcrypt'
 PASSPHRASE=1
@@ -62,10 +73,13 @@ print_usage() {
   echo "          --no-manpage              dont't install manpage"
   echo "          --examplesdir=<DIR>       the path to the examples files (default: $PREFIX/share/examples)"
   echo "          --no-examples             dont't install example files"
-  echo "          --use-ssl-crypto          use ssl crypto library instead of libgcrypt"
+  echo "          --use-gcrypt              use libgcrypt (this is the default)"
+  echo "          --use-nettle              use libnettle instead of libgcrypt"
+  echo "          --use-ssl-crypto          use openssl crypto library instead of libgcrypt"
   echo "          --no-crypto               disable crypto at all (only NULL cipher)"
   echo "          --disable-passphrase      disable master key and salt passphrase"
   echo "          --enable-passphrase       enable master key and salt passphrase"
+  echo "          --use-clang               use clang/llvm as compiler/linker"
 }
 
 for arg
@@ -74,6 +88,9 @@ do
   --target=*)
     TARGET=${arg#--target=}
   ;;
+  --use-clang)
+    USE_CLANG=1
+  ;;
   --prefix=*)
     PREFIX=${arg#--prefix=}
   ;;
@@ -95,12 +112,18 @@ do
   --no-examples)
     INSTALLEXAMPLES=0
   ;;
+  --use-gcrypt)
+    CRYPTO_LIB='gcrypt'
+  ;;
+  --use-nettle)
+    CRYPTO_LIB='nettle'
+  ;;
   --use-ssl-crypto)
     CRYPTO_LIB='ssl'
   ;;
   --no-crypto)
     CRYPTO_LIB='none'
-  ;; 
+  ;;
   --disable-passphrase)
     PASSPHRASE=0
   ;;
@@ -129,9 +152,19 @@ if [ -n "$ERRORS" ] && [ $EBUILD_COMPAT -ne 1 ]; then
   exit 1
 fi
 
+if [ $USE_CLANG -eq 0 ]; then
+  CFLAGS='-g -Wall -O2'
+  LDFLAGS='-g -Wall -O2'
+  COMPILER='gcc'
+else
+  CFLAGS='-g -O2'
+  LDFLAGS='-g -O2'
+  COMPILER='clang'
+fi
+
 rm -f version.h
 rm -f include.mk
-case $TARGET in 
+case $TARGET in
   Linux)
     rm -f tun.c
     ln -sf linux/tun.c
@@ -153,8 +186,14 @@ esac
 
 case $CRYPTO_LIB in
   gcrypt)
+    CFLAGS=$CFLAGS' -DUSE_GCRYPT'
     LDFLAGS=$LDFLAGS' -lgcrypt'
-    echo "using libgcrypt library"
+    echo "using gcrypt library"
+  ;;
+  nettle)
+    CFLAGS=$CFLAGS' -DUSE_NETTLE'
+    LDFLAGS=$LDFLAGS' -lnettle'
+    echo "using nettle library"
   ;;
   ssl)
     CFLAGS=$CFLAGS' -DUSE_SSL_CRYPTO'
@@ -163,7 +202,6 @@ case $CRYPTO_LIB in
   ;;
   none)
     CFLAGS=$CFLAGS' -DNO_CRYPT'
-    echo "NO_CRYPT_OBJ = 1" >> include.mk
     echo "disabling crypto"
   ;;
 esac
@@ -189,13 +227,13 @@ if [ -z "$EXAMPLESDIR" ]; then
   EXAMPLESDIR=$PREFIX/share/examples
 fi
 
-cat >> include.mk <<EOF
+cat > include.mk <<EOF
 # this file was created automatically
-# do not edit this file directly 
+# do not edit this file directly
 # use ./configure instead
 
 TARGET := $TARGET
-CC := gcc
+CC := $COMPILER
 CFLAGS := $CFLAGS
 LDFLAGS := $LDFLAGS
 STRIP := strip
@@ -206,6 +244,10 @@ SBINDIR := $SBINDIR
 ETCDIR := $ETCDIR
 EOF
 
+if [ $CRYPTO_LIB = "none" ]; then
+  echo "NO_CRYPT_OBJ = 1" >> include.mk
+fi
+
 if [ $INSTALLMANPAGE -eq 1 ]; then
   echo "MANDIR := $MANDIR" >> include.mk
   echo "installing manpage"
@@ -222,7 +264,7 @@ fi
 
 VERSION=`cat ../version`
 if which svn >/dev/null; then
-  SVN_REV=`svn info | grep "^Revision: " | awk '{print($2)}'`
+  SVN_REV=`svn info 2> /dev/null | grep "^Revision: " | awk '{print($2)}'`
   if [ -n "$SVN_REV" ]; then
     VERSION="$VERSION (svn$SVN_REV)"
   fi
@@ -230,8 +272,8 @@ fi
 HOSTNAME=`hostname`
 DATE=`date +"%d.%m.%Y %H:%M:%S %Z"`
 
-cat >> version.h <<EOF
-/* 
+cat > version.h <<EOF
+/*
  * uanytun version info
  *
  * this file was created automatically
diff --git a/src/daemon.h b/src/daemon.h
index 04a4d4f..9a477a7 100644
--- a/src/daemon.h
+++ b/src/daemon.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_daemon_h_INCLUDED
@@ -60,7 +73,7 @@ int priv_init(priv_info_t* priv, const char* username, const char* groupname)
 
   priv->pw_ = getpwnam(username);
   if(!priv->pw_) {
-    log_printf(ERROR, "unkown user %s", username);
+    log_printf(ERROR, "unknown user %s", username);
     return -1;
   }
 
@@ -70,7 +83,7 @@ int priv_init(priv_info_t* priv, const char* username, const char* groupname)
     priv->gr_ = getgrgid(priv->pw_->pw_gid);
 
   if(!priv->gr_) {
-    log_printf(ERROR, "unkown group %s", groupname);
+    log_printf(ERROR, "unknown group %s", groupname);
     return -1;
   }
 
@@ -122,6 +135,8 @@ int do_chroot(const char* chrootdir)
     log_printf(ERROR, "can't change to /: %s", strerror(errno));
     return -1;
   }
+
+  return 0;
 }
 
 void daemonize()
@@ -170,4 +185,3 @@ void daemonize()
 }
 
 #endif
-
diff --git a/src/datatypes.h b/src/datatypes.h
index 0105062..58434c8 100644
--- a/src/datatypes.h
+++ b/src/datatypes.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_datatypes_h_INCLUDED
diff --git a/src/encrypted_packet.c b/src/encrypted_packet.c
index 12f04ef..2d46f40 100644
--- a/src/encrypted_packet.c
+++ b/src/encrypted_packet.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -188,7 +201,7 @@ mux_t encrypted_packet_get_mux(encrypted_packet_t* packet)
 {
   if(!packet)
     return 0;
-  
+
   return MUX_T_NTOH(packet->data_.header_.mux_);
 }
 
diff --git a/src/encrypted_packet.h b/src/encrypted_packet.h
index 4afe323..3f66f12 100644
--- a/src/encrypted_packet.h
+++ b/src/encrypted_packet.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_encrypted_packet_h_INCLUDED
diff --git a/src/init_crypt.h b/src/init_crypt.h
index 2461a54..b0c6a49 100644
--- a/src/init_crypt.h
+++ b/src/init_crypt.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_init_crypt_h_INCLUDED
@@ -48,13 +61,29 @@ int init_crypt()
 #else
 
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+
+int init_crypt()
+{
+// nothing here
+  return 0;
+}
+
+#elif defined(USE_NETTLE)
+
+int init_crypt()
+{
+// nothing here
+  return 0;
+}
+
+#else  // USE_GCRYPT is the default
 
 #include <gcrypt.h>
 
 #define MIN_GCRYPT_VERSION "1.2.0"
 
-int init_crypt() 
+int init_crypt()
 {
   if(!gcry_check_version(MIN_GCRYPT_VERSION)) {
     log_printf(NOTICE, "invalid Version of libgcrypt, should be >= %s", MIN_GCRYPT_VERSION);
@@ -77,14 +106,6 @@ int init_crypt()
   return 0;
 }
 
-#else
-
-int init_crypt()
-{
-// nothing here 
-  return 0;
-}
-
 #endif
 
 
diff --git a/src/key_derivation.c b/src/key_derivation.c
index a01695b..f2d8548 100644
--- a/src/key_derivation.c
+++ b/src/key_derivation.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,14 +31,31 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
 
 #include "key_derivation.h"
 
-#ifdef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/sha.h>
+#elif defined(USE_NETTLE)
+#include <nettle/sha1.h>
+#include <nettle/sha2.h>
+#include <nettle/ctr.h>
 #endif
 
 #include "log.h"
@@ -48,7 +65,7 @@
 
 int key_derivation_init(key_derivation_t* kd, const char* type, role_t role, const char* passphrase, u_int8_t* key, u_int32_t key_len, u_int8_t* salt, u_int32_t salt_len)
 {
-  if(!kd) 
+  if(!kd)
     return -1;
 
   kd->role_ = role;
@@ -62,7 +79,7 @@ int key_derivation_init(key_derivation_t* kd, const char* type, role_t role, con
     if(type[7] == 0) {
       kd->key_length_ = KD_AESCTR_DEFAULT_KEY_LENGTH;
     }
-    else if(type[7] != '-') 
+    else if(type[7] != '-')
       return -1;
     else {
       const char* tmp = &type[8];
@@ -127,7 +144,7 @@ int key_derivation_generate_master_key(key_derivation_t* kd, const char* passphr
   if(kd->master_key_.buf_) {
     log_printf(WARNING, "master key and passphrase provided, ignoring passphrase");
     return 0;
-  }    
+  }
   log_printf(NOTICE, "using passphrase to generate master key");
 
   if(!key_length || (key_length % 8)) {
@@ -135,30 +152,39 @@ int key_derivation_generate_master_key(key_derivation_t* kd, const char* passphr
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
-  if(key_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA256) * 8)) {
-#else
+#if defined(USE_SSL_CRYPTO)
   if(key_length > (SHA256_DIGEST_LENGTH * 8)) {
+#elif defined(USE_NETTLE)
+  if(key_length > (SHA256_DIGEST_SIZE * 8)) {
+#else  // USE_GCRYPT is the default
+  if(key_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA256) * 8)) {
 #endif
     log_printf(ERROR, "master key too long for passphrase algorithm");
     return -1;
   }
 
   buffer_t digest;
-#ifndef USE_SSL_CRYPTO
-  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA256);
-#else
+#if defined(USE_SSL_CRYPTO)
   digest.length_ = SHA256_DIGEST_LENGTH;
+#elif defined(USE_NETTLE)
+  digest.length_ = SHA256_DIGEST_SIZE;
+#else  // USE_GCRYPT is the default
+  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA256);
 #endif
   digest.buf_ = malloc(digest.length_);
   if(!digest.buf_)
     return -2;
 
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  SHA256((const u_int8_t*)passphrase, strlen(passphrase), digest.buf_);
+#elif defined(USE_NETTLE)
+  struct sha256_ctx ctx;
+  sha256_init(&ctx);
+  sha256_update(&ctx, strlen(passphrase), (const u_int8_t*)passphrase);
+  sha256_digest(&ctx, digest.length_, digest.buf_);
+#else  // USE_GCRYPT is the default
   gcry_md_hash_buffer(GCRY_MD_SHA256, digest.buf_, passphrase, strlen(passphrase));
-#else
-  SHA256(passphrase, strlen(passphrase), digest.buf_);
 #endif
 
   kd->master_key_.length_ = key_length/8;
@@ -183,7 +209,7 @@ int key_derivation_generate_master_salt(key_derivation_t* kd, const char* passph
   if(kd->master_salt_.buf_) {
     log_printf(WARNING, "master salt and passphrase provided, ignoring passphrase");
     return 0;
-  }    
+  }
   log_printf(NOTICE, "using passphrase to generate master salt");
 
   if(!salt_length || (salt_length % 8)) {
@@ -191,29 +217,38 @@ int key_derivation_generate_master_salt(key_derivation_t* kd, const char* passph
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
-  if(salt_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA1) * 8)) {
-#else
+#if defined(USE_SSL_CRYPTO)
   if(salt_length > (SHA_DIGEST_LENGTH * 8)) {
+#elif defined(USE_NETTLE)
+  if(salt_length > (SHA1_DIGEST_SIZE * 8)) {
+#else  // USE_GCRYPT is the default
+  if(salt_length > (gcry_md_get_algo_dlen(GCRY_MD_SHA1) * 8)) {
 #endif
     log_printf(ERROR, "master salt too long for passphrase algorithm");
     return -1;
   }
 
   buffer_t digest;
-#ifndef USE_SSL_CRYPTO
-  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA1);
-#else
+#if defined(USE_SSL_CRYPTO)
   digest.length_ = SHA_DIGEST_LENGTH;
+#elif defined(USE_NETTLE)
+  digest.length_ = SHA1_DIGEST_SIZE;
+#else  // USE_GCRYPT is the default
+  digest.length_ = gcry_md_get_algo_dlen(GCRY_MD_SHA1);
 #endif
   digest.buf_ = malloc(digest.length_);
   if(!digest.buf_)
     return -2;
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  SHA1((const u_int8_t*)passphrase, strlen(passphrase), digest.buf_);
+#elif defined(USE_NETTLE)
+  struct sha1_ctx ctx;
+  sha1_init(&ctx);
+  sha1_update(&ctx, strlen(passphrase), (const u_int8_t*)passphrase);
+  sha1_digest(&ctx, digest.length_, digest.buf_);
+#else  // USE_GCRYPT is the default
   gcry_md_hash_buffer(GCRY_MD_SHA1, digest.buf_, passphrase, strlen(passphrase));
-#else
-  SHA1(passphrase, strlen(passphrase), digest.buf_);
 #endif
 
   kd->master_salt_.length_ = salt_length/8;
@@ -247,7 +282,7 @@ void key_derivation_close(key_derivation_t* kd)
 
 int key_derivation_generate(key_derivation_t* kd, key_derivation_dir_t dir, satp_prf_label_t label, seq_nr_t seq_nr, u_int8_t* key, u_int32_t len)
 {
-  if(!kd || !key) 
+  if(!kd || !key)
     return -1;
 
   if(label >= LABEL_NIL) {
@@ -330,7 +365,7 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
     return -2;
 
   key_derivation_aesctr_param_t* params = kd->params_;
-#ifndef USE_SSL_CRYPTO
+#ifdef USE_GCRYPT
   params->handle_ = 0;
 #endif
 
@@ -345,7 +380,15 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
   }
 #endif
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  int ret = AES_set_encrypt_key(kd->master_key_.buf_, kd->master_key_.length_*8, &params->aes_key_);
+  if(ret) {
+    log_printf(ERROR, "failed to set key derivation ssl aes-key (code: %d)", ret);
+    return -1;
+  }
+#elif defined(USE_NETTLE)
+  aes_set_encrypt_key(&params->ctx_, kd->master_key_.length_, kd->master_key_.buf_);
+#else  // USE_GCRYPT is the default
   int algo;
   switch(kd->key_length_) {
   case 128: algo = GCRY_CIPHER_AES128; break;
@@ -361,19 +404,13 @@ int key_derivation_aesctr_init(key_derivation_t* kd, const char* passphrase)
   if(err) {
     log_printf(ERROR, "failed to open key derivation cipher: %s", gcry_strerror(err));
     return -1;
-  } 
+  }
 
   err = gcry_cipher_setkey(params->handle_, kd->master_key_.buf_, kd->master_key_.length_);
   if(err) {
     log_printf(ERROR, "failed to set key derivation key: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  int ret = AES_set_encrypt_key(kd->master_key_.buf_, kd->master_key_.length_*8, &params->aes_key_);
-  if(ret) {
-    log_printf(ERROR, "failed to set key derivation ssl aes-key (code: %d)", ret);
-    return -1;
-  }
 #endif
 
   return 0;
@@ -385,9 +422,8 @@ void key_derivation_aesctr_close(key_derivation_t* kd)
     return;
 
   if(kd->params_) {
+#ifdef USE_GCRYPT
     key_derivation_aesctr_param_t* params = kd->params_;
-
-#ifndef USE_SSL_CRYPTO
     if(params->handle_)
       gcry_cipher_close(params->handle_);
 #endif
@@ -429,7 +465,23 @@ int key_derivation_aesctr_generate(key_derivation_t* kd, key_derivation_dir_t di
     return -1;
   }
 
-#ifndef USE_SSL_CRYPTO
+#if defined(USE_SSL_CRYPTO)
+  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set key derivation CTR: size don't fits");
+    return -1;
+  }
+  u_int32_t num = 0;
+  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
+  memset(key, 0, len);
+  AES_ctr128_encrypt(key, key, len, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
+#elif defined(USE_NETTLE)
+  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
+    log_printf(ERROR, "failed to set cipher CTR: size doesn't fit");
+    return -1;
+  }
+  memset(key, 0, len);
+  ctr_crypt(&params->ctx_, (nettle_crypt_func *)(aes_encrypt), AES_BLOCK_SIZE, params->ctr_.buf_, len, key, key);
+#else  // USE_GCRYPT is the default
   gcry_error_t err = gcry_cipher_reset(params->handle_);
   if(err) {
     log_printf(ERROR, "failed to reset key derivation cipher: %s", gcry_strerror(err));
@@ -448,16 +500,7 @@ int key_derivation_aesctr_generate(key_derivation_t* kd, key_derivation_dir_t di
     log_printf(ERROR, "failed to generate key derivation bitstream: %s", gcry_strerror(err));
     return -1;
   }
-#else
-  if(KD_AESCTR_CTR_LENGTH != AES_BLOCK_SIZE) {
-    log_printf(ERROR, "failed to set key derivation CTR: size don't fits");
-    return -1;
-  }
-  u_int32_t num = 0;
-  memset(params->ecount_buf_, 0, AES_BLOCK_SIZE);
-  memset(key, 0, len);
-  AES_ctr128_encrypt(key, key, len, &params->aes_key_, params->ctr_.buf_, params->ecount_buf_, &num);
 #endif
-  
+
   return 0;
 }
diff --git a/src/key_derivation.h b/src/key_derivation.h
index d037157..0f0942e 100644
--- a/src/key_derivation.h
+++ b/src/key_derivation.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,15 +31,30 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_key_derivation_h_INCLUDED
 #define UANYTUN_key_derivation_h_INCLUDED
 
-#ifndef USE_SSL_CRYPTO
-#include <gcrypt.h>
-#else
+#if defined(USE_SSL_CRYPTO)
 #include <openssl/aes.h>
+#elif defined(USE_NETTLE)
+#include <nettle/aes.h>
+#else  // USE_GCRYPT is the default
+#include <gcrypt.h>
 #endif
 
 #include "options.h"
@@ -103,11 +118,13 @@ union __attribute__((__packed__)) key_derivation_aesctr_ctr_union {
 typedef union key_derivation_aesctr_ctr_union key_derivation_aesctr_ctr_t;
 
 struct key_derivation_aesctr_param_struct {
-#ifndef USE_SSL_CRYPTO
-  gcry_cipher_hd_t handle_;
-#else
+#if defined(USE_SSL_CRYPTO)
   AES_KEY aes_key_;
   u_int8_t ecount_buf_[AES_BLOCK_SIZE];
+#elif defined(USE_NETTLE)
+  struct aes_ctx ctx_;
+#else  // USE_GCRYPT is the default
+  gcry_cipher_hd_t handle_;
 #endif
   key_derivation_aesctr_ctr_t ctr_;
 };
diff --git a/src/linux/tun.c b/src/linux/tun.c
index 85cdc01..c77cea1 100644
--- a/src/linux/tun.c
+++ b/src/linux/tun.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,8 +31,22 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 
 #include "datatypes.h"
@@ -58,44 +72,44 @@
 #include "sysexec.h"
 
 int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, const char* ifcfg_addr, u_int16_t ifcfg_prefix){
-  if(!dev) 
+  if(!dev)
     return -1;
- 
+
   tun_conf(dev, dev_name, dev_type, ifcfg_addr, ifcfg_prefix, 1400);
   dev->actual_name_ = NULL;
 
-	dev->fd_ = open(DEFAULT_DEVICE, O_RDWR);
-	if(dev->fd_ < 0) {
+  dev->fd_ = open(DEFAULT_DEVICE, O_RDWR);
+  if(dev->fd_ < 0) {
     log_printf(ERROR, "can't open device file (%s): %s", DEFAULT_DEVICE, strerror(errno));
     tun_close(dev);
     return -1;
   }
 
-	struct ifreq ifr;
-	memset(&ifr, 0, sizeof(ifr));
+  struct ifreq ifr;
+  memset(&ifr, 0, sizeof(ifr));
 
   if(dev->type_ == TYPE_TUN) {
     ifr.ifr_flags = IFF_TUN;
     dev->with_pi_ = 1;
-  } 
+  }
   else if(dev->type_ == TYPE_TAP) {
     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
     dev->with_pi_ = 0;
-  } 
+  }
   else {
     log_printf(ERROR, "unable to recognize type of device (tun or tap)");
     tun_close(dev);
     return -1;
   }
 
-	if(dev_name)
-		strncpy(ifr.ifr_name, dev_name, IFNAMSIZ);
+  if(dev_name)
+    strncpy(ifr.ifr_name, dev_name, IFNAMSIZ);
 
-	if(!ioctl(dev->fd_, TUNSETIFF, &ifr)) {
-		dev->actual_name_ = strdup(ifr.ifr_name);
-	} else if(!ioctl(dev->fd_, (('T' << 8) | 202), &ifr)) {
-		dev->actual_name_ = strdup(ifr.ifr_name);
-	} else {
+  if(!ioctl(dev->fd_, TUNSETIFF, &ifr)) {
+    dev->actual_name_ = strdup(ifr.ifr_name);
+  } else if(!ioctl(dev->fd_, (('T' << 8) | 202), &ifr)) {
+    dev->actual_name_ = strdup(ifr.ifr_name);
+  } else {
     log_printf(ERROR, "tun/tap device ioctl failed: %s", strerror(errno));
     tun_close(dev);
     return -1;
@@ -116,6 +130,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
 int tun_init_post(tun_device_t* dev)
 {
 // nothing yet
+  return 0;
 }
 
 void tun_close(tun_device_t* dev)
@@ -145,7 +160,7 @@ int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
   {
     struct iovec iov[2];
     struct tun_pi tpi;
-    
+
     iov[0].iov_base = &tpi;
     iov[0].iov_len = sizeof(tpi);
     iov[1].iov_base = buf;
@@ -169,13 +184,13 @@ int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len)
     struct iovec iov[2];
     struct tun_pi tpi;
     struct iphdr *hdr = (struct iphdr *)buf;
-    
+
     tpi.flags = 0;
     if(hdr->version == 4)
       tpi.proto = htons(ETH_P_IP);
     else
       tpi.proto = htons(ETH_P_IPV6);
-    
+
     iov[0].iov_base = &tpi;
     iov[0].iov_len = sizeof(tpi);
     iov[1].iov_base = buf;
@@ -192,8 +207,8 @@ void tun_do_ifconfig(tun_device_t* dev)
     return;
 
   char* mtu_str = NULL;
-  asprintf(&mtu_str, "%d", dev->mtu_);
-  if(!mtu_str) {
+  int len = asprintf(&mtu_str, "%d", dev->mtu_);
+  if(len == -1) {
     log_printf(ERROR, "Execution of ifconfig failed");
     return;
   }
diff --git a/src/log.c b/src/log.c
index ae323e9..b094d49 100644
--- a/src/log.c
+++ b/src/log.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,10 +31,24 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
 
+#include <ctype.h>
 #include <string.h>
 #include <stdarg.h>
 #include <stdlib.h>
@@ -84,7 +98,7 @@ int log_targets_target_exists(log_targets_t* targets, log_target_type_t type)
     if(tmp->type_ == type)
       return 1;
     tmp = tmp->next_;
-  }  
+  }
   return 0;
 }
 
@@ -147,7 +161,7 @@ int log_targets_add(log_targets_t* targets, const char* conf)
     log_target_t* tmp = targets->first_;
     while(tmp->next_)
       tmp = tmp->next_;
-    
+
     tmp->next_ = new_target;
   }
   return 0;
@@ -246,8 +260,8 @@ void log_print_hex_dump(log_prio_t prio, const u_int8_t* buf, u_int32_t len)
     int offset = snprintf(msg, MSG_LENGTH_MAX, "dump(%d): ", len);
     if(offset < 0)
       return;
-    u_int8_t* ptr = &msg[offset];
-    
+    char* ptr = &msg[offset];
+
     for(i=0; i < len; i++) {
       if(((i+1)*3) >= (MSG_LENGTH_MAX - offset))
         break;
diff --git a/src/log.h b/src/log.h
index 17de487..9f89b4c 100644
--- a/src/log.h
+++ b/src/log.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_log_h_INCLUDED
diff --git a/src/log_targets.h b/src/log_targets.h
index 4a19d8e..a0a774b 100644
--- a/src/log_targets.h
+++ b/src/log_targets.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_log_targets_h_INCLUDED
@@ -42,7 +55,7 @@ static char* get_time_formatted()
 {
   char* time_string;
   time_t t = time(NULL);
-  if(t < 0) 
+  if(t < 0)
     time_string = "<time read error>";
   else {
     time_string = ctime(&t);
@@ -79,7 +92,7 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
 {
   if(!self || (conf && conf[0] == 0))
     return -1;
-  
+
   self->param_ = malloc(sizeof(log_target_syslog_param_t));
   if(!self->param_)
     return -2;
@@ -95,7 +108,7 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
       if(!len) {
         free(self->param_);
         return -1;
-      }  
+      }
       logname = malloc(len+1);
       if(logname) {
         strncpy(logname, conf, len);
@@ -116,13 +129,13 @@ int log_target_syslog_init(log_target_t* self, const char* conf)
     ((log_target_syslog_param_t*)(self->param_))->facility_ = DAEMON;
     return 0;
   }
-  
+
   if(end[1] == 0 || end[1] == ',') {
     free(logname);
     free(self->param_);
     return -1;
   }
-    
+
   const char* start = end + 1;
   end = strchr(start, ',');
   int i;
@@ -157,7 +170,7 @@ void log_target_syslog_log(log_target_t* self, log_prio_t prio, const char* msg)
   if(!self || !self->param_ || !self->opened_)
     return;
 
-  syslog((prio + 2) | ((log_target_syslog_param_t*)(self->param_))->facility_, "%s", msg);  
+  syslog((prio + 2) | ((log_target_syslog_param_t*)(self->param_))->facility_, "%s", msg);
 }
 
 void log_target_syslog_close(log_target_t* self)
@@ -209,7 +222,7 @@ int log_target_file_init(log_target_t* self, const char* conf)
 {
   if(!self || (conf && conf[0] == 0))
     return -1;
-  
+
   self->param_ = malloc(sizeof(log_target_file_param_t));
   if(!self->param_)
     return -2;
@@ -224,7 +237,7 @@ int log_target_file_init(log_target_t* self, const char* conf)
       if(!len) {
         free(self->param_);
         return -1;
-      }  
+      }
       logfilename = malloc(len+1);
       if(logfilename) {
         strncpy(logfilename, conf, len);
diff --git a/src/options.c b/src/options.c
index 331a3c3..df32b1b 100644
--- a/src/options.c
+++ b/src/options.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -152,9 +165,9 @@ int options_parse_hex_string(const char* hex, buffer_t* buffer)
   if(hex_len%2)
     return 1;
 
-  if(buffer->buf_) 
+  if(buffer->buf_)
     free(buffer->buf_);
-  
+
   buffer->length_ = hex_len/2;
   buffer->buf_ = malloc(buffer->length_);
   if(!buffer->buf_) {
@@ -189,7 +202,7 @@ int options_parse_ifconfig(const char* arg, ifconfig_param_t* ifcfg)
         free(str);
         return 1;
       }
-      
+
       ifcfg->prefix_length_ = atoi(ptr);
       ifcfg->net_addr_ = strdup(str);
       free(str);
@@ -209,7 +222,6 @@ int options_parse_ifconfig(const char* arg, ifconfig_param_t* ifcfg)
   return 1;
 }
 
-
 int options_parse(options_t* opt, int argc, char* argv[])
 {
   if(!opt)
@@ -225,7 +237,9 @@ int options_parse(options_t* opt, int argc, char* argv[])
 
   argc--;
 
+#ifndef NO_CRYPT
   char* role = NULL;
+#endif
   int i, ipv4_only = 0, ipv6_only = 0;
   for(i=1; argc > 0; ++i)
   {
@@ -268,7 +282,7 @@ int options_parse(options_t* opt, int argc, char* argv[])
     PARSE_STRING_PARAM("-a","--auth-algo", opt->auth_algo_)
     PARSE_INT_PARAM("-b","--auth-tag-length", opt->auth_tag_length_)
 #endif
-    else 
+    else
       return i;
   }
   if(ipv4_only && ipv6_only)
@@ -308,13 +322,13 @@ void options_parse_post(options_t* opt)
     return;
 
 #ifndef NO_CRYPT
-  if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") && 
+  if(!strcmp(opt->cipher_, "null") && !strcmp(opt->auth_algo_, "null") &&
      strcmp(opt->kd_prf_, "null")) {
     if(opt->kd_prf_)
       free(opt->kd_prf_);
     opt->kd_prf_ = strdup("null");
   }
-  if((strcmp(opt->cipher_, "null") || strcmp(opt->auth_algo_, "null")) && 
+  if((strcmp(opt->cipher_, "null") || strcmp(opt->auth_algo_, "null")) &&
      !strcmp(opt->kd_prf_, "null")) {
     log_printf(WARNING, "using NULL key derivation with encryption and or authentication enabled!");
   }
diff --git a/src/options.h b/src/options.h
index ccc5044..8f3593f 100644
--- a/src/options.h
+++ b/src/options.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_options_h_INCLUDED
@@ -92,6 +105,7 @@ void options_parse_post(options_t* opt);
 void options_default(options_t* opt);
 void options_clear(options_t* opt);
 void options_print_usage();
+void options_print_version();
 void options_print(options_t* opt);
 
 #endif
diff --git a/src/plain_packet.c b/src/plain_packet.c
index 29ba5fe..868ebd8 100644
--- a/src/plain_packet.c
+++ b/src/plain_packet.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -77,7 +90,7 @@ void plain_packet_set_length(plain_packet_t* packet, u_int32_t len)
 {
   if(!packet)
     return;
-  
+
   if(len > PLAIN_PACKET_SIZE_MAX)
     len = PLAIN_PACKET_SIZE_MAX - sizeof(payload_type_t);
   else if(len < sizeof(payload_type_t))
@@ -85,7 +98,7 @@ void plain_packet_set_length(plain_packet_t* packet, u_int32_t len)
   else
     len -= sizeof(payload_type_t);
 
-  packet->payload_length_ = len;  
+  packet->payload_length_ = len;
 }
 
 u_int8_t* plain_packet_get_payload(plain_packet_t* packet)
diff --git a/src/plain_packet.h b/src/plain_packet.h
index 0dc62b7..5b79c39 100644
--- a/src/plain_packet.h
+++ b/src/plain_packet.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_plain_packet_h_INCLUDED
@@ -41,7 +54,7 @@
 #define PAYLOAD_TYPE_TAP 0x6558
 #define PAYLOAD_TYPE_TUN 0x0000
 #define PAYLOAD_TYPE_TUN4 0x0800
-#define PAYLOAD_TYPE_TUN6 0x86DD 
+#define PAYLOAD_TYPE_TUN6 0x86DD
 #define PAYLOAD_TYPE_UNKNOWN 0xFFFF
 
 struct plain_packet_struct {
diff --git a/src/seq_window.c b/src/seq_window.c
index 0f58adb..fbeb3eb 100644
--- a/src/seq_window.c
+++ b/src/seq_window.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -67,9 +80,11 @@ void seq_win_clear(seq_win_t* win)
 
     free(to_free);
   }
+
+  win->first_ = NULL;
 }
 
-seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size)
+static seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size)
 {
   if(!size)
     return NULL;
@@ -81,7 +96,7 @@ seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, wind
   e->sender_id_ = sender_id;
   e->max_ = max;
   e->pos_ = 0;
-  e->window_ = malloc(sizeof(seq_nr_t)*size);
+  e->window_ = malloc(sizeof((*e->window_))*size);
   if(!e->window_) {
     free(e);
     return NULL;
@@ -152,12 +167,12 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
           ptr->max_ -= SEQ_NR_MAX/2;
         else if(shifted == 2)
           ptr->max_ += SEQ_NR_MAX/2;
-        
+
         return 0;
       }
-      
+
       seq_nr_t diff = ptr->max_ - seq_nr;
-      window_size_t pos = diff > ptr->pos_ ? ptr->pos_ + win->size_ : ptr->pos_; 
+      window_size_t pos = diff > ptr->pos_ ? ptr->pos_ + win->size_ : ptr->pos_;
       pos -= diff;
 
       if(shifted == 1)
@@ -170,7 +185,7 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
       return ret;
     }
     ptr = ptr->next_;
-  }  
+  }
   if(!win->first_) {
     win->first_ = seq_win_new_element(sender_id, seq_nr, win->size_);
     if(!win->first_)
@@ -184,7 +199,7 @@ int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr
     if(!ptr->next_)
       return -2;
   }
-  
+
   return 0;
 }
 
@@ -204,7 +219,7 @@ void seq_win_print(seq_win_t* win)
         printf("O");
       else
         printf(".");
-      
+
       if(i)
         i--;
       else
diff --git a/src/seq_window.h b/src/seq_window.h
index b699ee9..612c2d1 100644
--- a/src/seq_window.h
+++ b/src/seq_window.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_seq_window_h_INCLUDED
@@ -53,7 +66,6 @@ typedef struct seq_win_struct seq_win_t;
 
 int seq_win_init(seq_win_t* win, window_size_t size);
 void seq_win_clear(seq_win_t* win);
-seq_win_element_t* seq_win_new_element(sender_id_t sender_id, seq_nr_t max, window_size_t size);
 int seq_win_check_and_add(seq_win_t* win, sender_id_t sender_id, seq_nr_t seq_nr);
 
 void seq_win_print(seq_win_t* win);
diff --git a/src/sig_handler.c b/src/sig_handler.c
index bed72ba..5de168e 100644
--- a/src/sig_handler.c
+++ b/src/sig_handler.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -42,7 +55,7 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
-
+#include <string.h>
 
 static int sig_pipe_fds[2];
 
@@ -79,17 +92,22 @@ int signal_init()
     }
   }
 
-  struct sigaction act;
+  struct sigaction act, ign;
   act.sa_handler = sig_handler;
   sigfillset(&act.sa_mask);
   act.sa_flags = 0;
+  ign.sa_handler = SIG_IGN;
+  sigfillset(&ign.sa_mask);
+  ign.sa_flags = 0;
 
   if((sigaction(SIGINT, &act, NULL) < 0) ||
      (sigaction(SIGQUIT, &act, NULL) < 0) ||
      (sigaction(SIGTERM, &act, NULL) < 0) ||
      (sigaction(SIGHUP, &act, NULL) < 0) ||
      (sigaction(SIGUSR1, &act, NULL) < 0) ||
-     (sigaction(SIGUSR2, &act, NULL) < 0)) {
+     (sigaction(SIGUSR2, &act, NULL) < 0) ||
+     (sigaction(SIGCHLD, &ign, NULL) < 0) ||
+     (sigaction(SIGPIPE, &ign, NULL) < 0)) {
 
     log_printf(ERROR, "signal handling init failed (sigaction error: %s)", strerror(errno));
     close(sig_pipe_fds[0]);
@@ -124,7 +142,7 @@ int signal_handle()
       case SIGINT: log_printf(NOTICE, "SIG-Int caught, exitting"); return_value = 1; break;
       case SIGQUIT: log_printf(NOTICE, "SIG-Quit caught, exitting"); return_value = 1; break;
       case SIGTERM: log_printf(NOTICE, "SIG-Term caught, exitting"); return_value = 1; break;
-      case SIGHUP: log_printf(NOTICE, "SIG-Hup caught"); break;
+      case SIGHUP: log_printf(NOTICE, "SIG-Hup caught"); return_value = 2; break;
       case SIGUSR1: log_printf(NOTICE, "SIG-Usr1 caught"); break;
       case SIGUSR2: log_printf(NOTICE, "SIG-Usr2 caught"); break;
       default: log_printf(WARNING, "unknown signal %d caught, ignoring", sig); break;
@@ -150,6 +168,8 @@ void signal_stop()
   sigaction(SIGHUP, &act, NULL);
   sigaction(SIGUSR1, &act, NULL);
   sigaction(SIGUSR2, &act, NULL);
+  sigaction(SIGPIPE, &act, NULL);
+  sigaction(SIGCHLD, &act, NULL);
 
   close(sig_pipe_fds[0]);
   close(sig_pipe_fds[1]);
diff --git a/src/sig_handler.h b/src/sig_handler.h
index 8219618..fbb66b6 100644
--- a/src/sig_handler.h
+++ b/src/sig_handler.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_sig_handler_h_INCLUDED
diff --git a/src/string_list.c b/src/string_list.c
index 5e0ddf8..97bc057 100644
--- a/src/string_list.c
+++ b/src/string_list.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include <string.h>
@@ -43,7 +56,7 @@ void string_list_init(string_list_t* list)
 {
   if(!list)
     return;
-  
+
   list->first_ = NULL;
 }
 
@@ -104,7 +117,7 @@ void string_list_print(string_list_t* list, const char* head, const char* tail)
 {
   if(!list)
     return;
-  
+
   string_list_element_t* tmp = list->first_;
   while(tmp) {
     printf("%s%s%s", head, tmp->string_, tail);
diff --git a/src/string_list.h b/src/string_list.h
index 9e210ae..03ca276 100644
--- a/src/string_list.h
+++ b/src/string_list.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_string_list_h_INCLUDED
diff --git a/src/sysexec.c b/src/sysexec.c
index 6e4e821..814d5ff 100644
--- a/src/sysexec.c
+++ b/src/sysexec.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,10 +31,24 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
 
+#include <unistd.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -42,6 +56,7 @@
 #include <sys/wait.h>
 #include <sys/select.h>
 #include <stdlib.h>
+#include <stdio.h>
 #include <string.h>
 
 #include "sysexec.h"
@@ -80,10 +95,11 @@ int uanytun_exec(const char* script, char* const argv[], char* const evp[])
         log_printf(WARNING, "can't open stderr");
     }
     execve(script, argv, evp);
-        // if execve returns, an error occurred, but logging doesn't work 
+        // if execve returns, an error occurred, but logging doesn't work
         // because we closed all file descriptors, so just write errno to
         // pipe and call exit
-    write(pipefd[1], (void*)(&errno), sizeof(errno));
+    int ret = write(pipefd[1], (void*)(&errno), sizeof(errno));
+    if(ret == -1) exit(-1);
     exit(-1);
   }
   close(pipefd[1]);
@@ -104,11 +120,11 @@ int uanytun_exec(const char* script, char* const argv[], char* const evp[])
     }
   }
   if(WIFEXITED(status))
-    log_printf(NOTICE, "script '%s' returned %d", script, WEXITSTATUS(status));  
+    log_printf(NOTICE, "script '%s' returned %d", script, WEXITSTATUS(status));
   else if(WIFSIGNALED(status))
     log_printf(NOTICE, "script '%s' terminated after signal %d", script, WTERMSIG(status));
   else
-    log_printf(ERROR, "executing script '%s': unkown error", script);
+    log_printf(ERROR, "executing script '%s': unknown error", script);
 
   close(pipefd[0]);
   return status;
diff --git a/src/sysexec.h b/src/sysexec.h
index faed8eb..da6555e 100644
--- a/src/sysexec.h
+++ b/src/sysexec.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_sysexec_h_INCLUDED
diff --git a/src/tun.h b/src/tun.h
index 230b88d..fa6e689 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_tun_h_INCLUDED
@@ -57,7 +70,7 @@ int tun_init(tun_device_t* dev, const char* dev_name, const char* dev_type, cons
 int tun_init_post(tun_device_t* dev);
 void tun_do_ifconfig(tun_device_t* dev);
 void tun_close(tun_device_t* dev);
-  
+
 int tun_read(tun_device_t* dev, u_int8_t* buf, u_int32_t len);
 int tun_write(tun_device_t* dev, u_int8_t* buf, u_int32_t len);
 
diff --git a/src/tun_helper.h b/src/tun_helper.h
index 9d55267..15a1c81 100644
--- a/src/tun_helper.h
+++ b/src/tun_helper.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_tun_helper_h_INCLUDED
@@ -92,7 +105,7 @@ const char* tun_get_type_string(tun_device_t* dev)
 {
   if(!dev || dev->fd_ < 0)
     return "";
-  
+
   switch(dev->type_)
   {
   case TYPE_UNDEF: return "undef"; break;
diff --git a/src/uanytun.c b/src/uanytun.c
index 53acbaf..159f773 100644
--- a/src/uanytun.c
+++ b/src/uanytun.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #include "datatypes.h"
@@ -72,7 +85,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
     log_printf(ERROR, "could not initialize cipher of type %s", opt->cipher_);
     return ret;
   }
-  
+
 #ifndef NO_CRYPT
   ret = auth_algo_init(aa, opt->auth_algo_);
   if(ret) {
@@ -104,7 +117,7 @@ int init_main_loop(options_t* opt, cipher_t* c, auth_algo_t* aa, key_derivation_
 }
 
 int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packet_t* plain_packet, encrypted_packet_t* encrypted_packet,
-                     cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t seq_nr)
+                     cipher_t* c, auth_algo_t* aa, key_derivation_t* kd, seq_nr_t* seq_nr)
 {
   plain_packet_set_payload_length(plain_packet, -1);
   encrypted_packet_set_length(encrypted_packet, -1);
@@ -114,25 +127,25 @@ int process_tun_data(tun_device_t* dev, udp_t* sock, options_t* opt, plain_packe
     log_printf(ERROR, "error on reading from device: %s", strerror(errno));
     return 0;
   }
-  
+
   plain_packet_set_payload_length(plain_packet, len);
-  
+
   if(dev->type_ == TYPE_TUN)
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TUN);
   else if(dev->type_ == TYPE_TAP)
-    plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TAP);    
+    plain_packet_set_type(plain_packet, PAYLOAD_TYPE_TAP);
   else
     plain_packet_set_type(plain_packet, PAYLOAD_TYPE_UNKNOWN);
 
-  if(!sock->remote_end_set_)
+  if(!udp_has_remote(sock))
     return 0;
-  
-  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, seq_nr, opt->sender_id_, opt->mux_); 
-  
+
+  cipher_encrypt(c, kd, kd_outbound, plain_packet, encrypted_packet, *seq_nr, opt->sender_id_, opt->mux_);
+  (*seq_nr)++;
 #ifndef NO_CRYPT
   auth_algo_generate(aa, kd, kd_outbound, encrypted_packet);
 #endif
- 
+
   len = udp_write(sock, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet));
   if(len == -1)
     log_printf(ERROR, "error on sending udp packet: %s", strerror(errno));
@@ -147,62 +160,54 @@ int process_sock_data(tun_device_t* dev, int fd, udp_t* sock, options_t* opt, pl
   encrypted_packet_set_length(encrypted_packet, -1);
 
   udp_endpoint_t remote;
-  memset(&remote, 0, sizeof(udp_endpoint_t));
+  memset(&(remote.addr_), 0, sizeof(remote.addr_));
+  remote.len_ = sizeof(remote.addr_);
   int len = udp_read(sock, fd, encrypted_packet_get_packet(encrypted_packet), encrypted_packet_get_length(encrypted_packet), &remote);
   if(len == -1) {
     log_printf(ERROR, "error on receiving udp packet: %s", strerror(errno));
     return 0;
-  }
-  else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
+  } else if(len < encrypted_packet_get_minimum_length(encrypted_packet)) {
     log_printf(WARNING, "received packet is too short");
     return 0;
   }
   encrypted_packet_set_length(encrypted_packet, len);
 
+  if(encrypted_packet_get_mux(encrypted_packet) != opt->mux_) {
+    log_printf(WARNING, "wrong mux value, discarding packet");
+    return 0;
+  }
+
 #ifndef NO_CRYPT
   if(!auth_algo_check_tag(aa, kd, kd_inbound, encrypted_packet)) {
     log_printf(WARNING, "wrong authentication tag, discarding packet");
     return 0;
   }
 #endif
-  
-  if(encrypted_packet_get_mux(encrypted_packet) != opt->mux_) {
-    log_printf(WARNING, "wrong mux value, discarding packet");
-    return 0;
-  }
-  
+
   int result = seq_win_check_and_add(seq_win, encrypted_packet_get_sender_id(encrypted_packet), encrypted_packet_get_seq_nr(encrypted_packet));
   if(result > 0) {
     log_printf(WARNING, "detected replay attack, discarding packet");
     return 0;
-  }
-  else if(result < 0) {
+  } else if(result < 0) {
     log_printf(ERROR, "memory error at sequence window");
     return -2;
   }
-   
-  udp_set_active_sock(sock, fd);
-  if(memcmp(&remote, &(sock->remote_end_), sizeof(remote))) {
-    memcpy(&(sock->remote_end_), &remote, sizeof(remote));
-    sock->remote_end_set_ = 1;
-    char* addrstring = udp_endpoint_to_string(remote);
-    log_printf(NOTICE, "autodetected remote host changed %s", addrstring);
-    free(addrstring);
-  }
+
+  udp_update_remote(sock, fd, &remote);
 
   if(encrypted_packet_get_payload_length(encrypted_packet) <= plain_packet_get_header_length()) {
     log_printf(WARNING, "ignoring packet with zero length payload");
     return 0;
   }
 
-  int ret = cipher_decrypt(c, kd, kd_inbound, encrypted_packet, plain_packet); 
-  if(ret) 
+  int ret = cipher_decrypt(c, kd, kd_inbound, encrypted_packet, plain_packet);
+  if(ret)
     return ret;
- 
+
   len = tun_write(dev, plain_packet_get_payload(plain_packet), plain_packet_get_payload_length(plain_packet));
   if(len == -1)
     log_printf(ERROR, "error on writing to device: %s", strerror(errno));
-  
+
   return 0;
 }
 
@@ -229,13 +234,13 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
 
   FD_ZERO(&readfds);
   FD_SET(dev->fd_, &readfds);
-  int nfds = udp_init_fd_set(sock, &readfds);
+  int nfds = udp_fill_fd_set(sock, &readfds);
   nfds = dev->fd_ > nfds ? dev->fd_ : nfds;
 
   int return_value = 0;
   int sig_fd = signal_init();
   if(sig_fd < 0)
-    return_value -1;
+    return_value = -1;
 
   FD_SET(sig_fd, &readfds);
   nfds = (nfds < sig_fd) ? sig_fd : nfds;
@@ -252,15 +257,21 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
       continue;
 
     if(FD_ISSET(sig_fd, &readyfds)) {
-      if(signal_handle()) {
-        return_value = 1;
+      return_value = signal_handle();
+      if(return_value == 1)
         break;
+      else if(return_value == 2) {
+        seq_win_clear(&seq_win);
+        seq_nr = 0;
+        log_printf(NOTICE, "sequence window cleared");
+        return_value = 0;
       }
+      else
+        return_value = 0;
     }
 
     if(FD_ISSET(dev->fd_, &readyfds)) {
-      return_value = process_tun_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, seq_nr);
-      seq_nr++;
+      return_value = process_tun_data(dev, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_nr);
       if(return_value)
         break;
     }
@@ -268,7 +279,7 @@ int main_loop(tun_device_t* dev, udp_t* sock, options_t* opt)
     udp_socket_t* s = sock->socks_;
     while(s) {
       if(FD_ISSET(s->fd_, &readyfds)) {
-        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win); 
+        return_value = process_sock_data(dev, s->fd_, sock, opt, &plain_packet, &encrypted_packet, &c, &aa, &kd, &seq_win);
         if(return_value)
           break;
       }
@@ -310,7 +321,7 @@ int main(int argc, char* argv[])
       options_print_version();
     }
 
-    if(ret != -2 && ret != -5) 
+    if(ret != -2 && ret != -5)
       options_print_usage();
 
     if(ret == -1 || ret == -5)
@@ -330,7 +341,7 @@ int main(int argc, char* argv[])
       case -4: fprintf(stderr, "this log target is only allowed once: '%s', exitting\n", tmp->string_); break;
       default: fprintf(stderr, "syntax error near: '%s', exitting\n", tmp->string_); break;
       }
-        
+
       options_clear(&opt);
       log_close();
       exit(ret);
@@ -371,7 +382,7 @@ int main(int argc, char* argv[])
     log_printf(NOTICE, "executing post-up script '%s'", opt.post_up_script_);
     char* const argv[] = { opt.post_up_script_, dev.actual_name_, NULL };
     char* const evp[] = { NULL };
-    int ret = uanytun_exec(opt.post_up_script_, argv, evp);
+    uanytun_exec(opt.post_up_script_, argv, evp);
   }
 
 
@@ -385,15 +396,8 @@ int main(int argc, char* argv[])
     exit(ret);
   }
 
-  if(opt.remote_addr_) {
-    if(!udp_set_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_)) {
-      char* remote_string = udp_get_remote_end_string(&sock);
-      if(remote_string) {
-        log_printf(NOTICE, "set remote end to: %s", remote_string);
-        free(remote_string);
-      }
-    }
-  }
+  if(opt.remote_addr_)
+    udp_resolv_remote(&sock, opt.remote_addr_, opt.remote_port_, opt.resolv_addr_type_);
 
 
   FILE* pid_file = NULL;
@@ -419,7 +423,7 @@ int main(int argc, char* argv[])
       options_clear(&opt);
       log_close();
       exit(-1);
-    }  
+    }
 
   if(opt.daemonize_) {
     pid_t oldpid = getpid();
diff --git a/src/udp.c b/src/udp.c
index 3e1def6..9217688 100644
--- a/src/udp.c
+++ b/src/udp.c
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,8 +31,24 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
+#define _GNU_SOURCE
+#include <stdio.h>
+
 #include "datatypes.h"
 
 #include "udp.h"
@@ -49,16 +65,8 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+static int udp_resolv_local(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type, unsigned int* idx)
 {
-  if(!sock || !port) 
-    return -1;
-
-  sock->socks_ = NULL;
-  sock->active_sock_ = NULL;
-  memset(&(sock->remote_end_), 0, sizeof(sock->remote_end_));
-  sock->remote_end_set_ = 0;
-
   struct addrinfo hints, *res;
 
   res = NULL;
@@ -85,7 +93,8 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   }
 
   struct addrinfo* r = res;
-  udp_socket_t* prev_sock = NULL;
+  udp_socket_t* prev_sock = sock->socks_;
+  while(prev_sock && prev_sock->next_) prev_sock = prev_sock->next_;
   while(r) {
     udp_socket_t* new_sock = malloc(sizeof(udp_socket_t));
     if(!new_sock) {
@@ -94,8 +103,13 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
       udp_close(sock);
       return -2;
     }
-    memset(&(new_sock->local_end_), 0, sizeof(new_sock->local_end_));
+    memset(&(new_sock->local_end_.addr_), 0, sizeof(new_sock->local_end_.addr_));
+    new_sock->local_end_.len_ = sizeof(new_sock->local_end_.addr_);
+    memset(&(new_sock->remote_end_.addr_), 0, sizeof(new_sock->remote_end_.addr_));
+    new_sock->remote_end_.len_ = sizeof(new_sock->remote_end_.addr_);
+    new_sock->remote_end_set_ = 0;
     new_sock->next_ = NULL;
+    new_sock->idx_ = (*idx)++;
 
     if(!sock->socks_) {
       sock->socks_ = new_sock;
@@ -105,9 +119,10 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
       prev_sock->next_ = new_sock;
       prev_sock = new_sock;
     }
-    
-    memcpy(&(new_sock->local_end_), r->ai_addr, r->ai_addrlen);
-    new_sock->fd_ = socket(r->ai_family, SOCK_DGRAM, 0);
+
+    memcpy(&(new_sock->local_end_.addr_), r->ai_addr, r->ai_addrlen);
+    new_sock->local_end_.len_ = r->ai_addrlen;
+    new_sock->fd_ = socket(new_sock->local_end_.addr_.ss_family, SOCK_DGRAM, 0);
     if(new_sock->fd_ < 0) {
       log_printf(ERROR, "Error on opening udp socket: %s", strerror(errno));
       freeaddrinfo(res);
@@ -121,17 +136,17 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
         log_printf(ERROR, "Error on setting IPV6_V6ONLY socket option: %s", strerror(errno));
     }
 
-    errcode = bind(new_sock->fd_, r->ai_addr, r->ai_addrlen);
+    errcode = bind(new_sock->fd_, (struct sockaddr*)&(new_sock->local_end_.addr_), new_sock->local_end_.len_);
     if(errcode) {
       log_printf(ERROR, "Error on binding udp socket: %s", strerror(errno));
       freeaddrinfo(res);
       udp_close(sock);
       return -1;
     }
-  
-    char* local_string = udp_endpoint_to_string(new_sock->local_end_);
+
+    char* local_string = udp_endpoint_to_string(&(new_sock->local_end_));
     if(local_string) {
-      log_printf(NOTICE, "listening on: %s", local_string);
+      log_printf(NOTICE, "socket[%d] listening on: %s", new_sock->idx_, local_string);
       free(local_string);
     }
 
@@ -139,11 +154,26 @@ int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_
   }
 
   freeaddrinfo(res);
+  return 0;
+}
+
+int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type)
+{
+  if(!sock || !port)
+    return -1;
+
+  sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
+
+  unsigned int idx = 0;
+  int ret = udp_resolv_local(sock, local_addr, port, resolv_type, &idx);
+  if(ret)
+    return ret;
 
   return 0;
 }
 
-int udp_init_fd_set(udp_t* sock, fd_set* set)
+int udp_fill_fd_set(udp_t* sock, fd_set* set)
 {
   int max_fd = 0;
 
@@ -157,13 +187,28 @@ int udp_init_fd_set(udp_t* sock, fd_set* set)
   return max_fd;
 }
 
-int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+int udp_has_remote(udp_t* sock)
 {
-  if(!sock || !remote_addr || !port) 
-    return -1;
+  if(!sock->active_sock_ || !sock->active_sock_->remote_end_set_)
+    return 0;
 
+  udp_socket_t* s = sock->socks_;
+  while(s) {
+    if(s->remote_end_set_)
+      return 1;
+    s = s->next_;
+  }
+
+  return 0;
+}
+
+int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type)
+{
   struct addrinfo hints, *res;
 
+  if(!sock || !remote_addr || !port)
+    return -1;
+
   res = NULL;
   memset (&hints, 0, sizeof (hints));
   hints.ai_socktype = SOCK_DGRAM;
@@ -183,37 +228,71 @@ int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resol
     log_printf(ERROR, "getaddrinfo returned no address for %s:%s", remote_addr, port);
     return -1;
   }
-  memcpy(&(sock->remote_end_), res->ai_addr, res->ai_addrlen);
-  sock->remote_end_set_ = 1;
 
-  if(!sock->active_sock_) {
+  int found = 0;
+  struct addrinfo* r = res;
+  while(r) {
     udp_socket_t* s = sock->socks_;
     while(s) {
-      if((((struct sockaddr *)&s->local_end_)->sa_family) == res->ai_family) {
+      if(s->local_end_.addr_.ss_family == r->ai_family && !(s->remote_end_set_)) {
         sock->active_sock_ = s;
         break;
       }
       s = s->next_;
     }
-  }
 
+    if(s) {
+      memcpy(&(s->remote_end_.addr_), r->ai_addr, r->ai_addrlen);
+      s->remote_end_.len_ = r->ai_addrlen;
+      s->remote_end_set_ = 1;
+      found = 1;
+      char* remote_string = udp_endpoint_to_string(&(s->remote_end_));
+      if(remote_string) {
+        log_printf(NOTICE, "socket[%d] set remote end to: %s", s->idx_, remote_string);
+        free(remote_string);
+      }
+      break;
+    }
+
+    r = r->ai_next;
+  }
   freeaddrinfo(res);
 
+  if(!found)
+    log_printf(WARNING, "no remote address for '%s' found that fits any of the local address families", remote_addr);
+
   return 0;
 }
 
-void udp_set_active_sock(udp_t* sock, int fd)
+void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote)
 {
-  if(!sock || (sock->active_sock_ && sock->active_sock_->fd_ == fd))
+  if(!sock)
     return;
 
-  udp_socket_t* s = sock->socks_;
-  while(s) {
-    if(s->fd_ == fd) {
-      sock->active_sock_ = s;
-      return;
+  if(!(sock->active_sock_) || sock->active_sock_->fd_ != fd) {
+    udp_socket_t* s = sock->socks_;
+    while(s) {
+      if(s->fd_ == fd) {
+        sock->active_sock_ = s;
+        break;
+      }
+      s = s->next_;
+    }
+  }
+
+  if(!remote)
+    return;
+
+  if(sock->active_sock_) {
+    if(remote->len_ != sock->active_sock_->remote_end_.len_ ||
+       memcmp(&(remote->addr_), &(sock->active_sock_->remote_end_.addr_), remote->len_)) {
+      memcpy(&(sock->active_sock_->remote_end_.addr_), &(remote->addr_), remote->len_);
+      sock->active_sock_->remote_end_.len_ = remote->len_;
+      sock->active_sock_->remote_end_set_ = 1;
+      char* addrstring = udp_endpoint_to_string(remote);
+      log_printf(NOTICE, "socket[%d] autodetected remote host changed %s", sock->active_sock_->idx_, addrstring);
+      free(addrstring);
     }
-    s = s->next_;
   }
 }
 
@@ -225,78 +304,53 @@ void udp_close(udp_t* sock)
   while(sock->socks_) {
     if(sock->socks_->fd_ > 0)
       close(sock->socks_->fd_);
-    
+
     udp_socket_t*s = sock->socks_;
     sock->socks_ = sock->socks_->next_;
-    
+
     free(s);
   }
   sock->socks_ = NULL;
+  sock->active_sock_ = NULL;
 }
 
-char* udp_endpoint_to_string(udp_endpoint_t e)
+char* udp_endpoint_to_string(udp_endpoint_t* e)
 {
-  void* ptr;
-  u_int16_t port;
-  size_t addrstr_len = 0;
-  char* addrstr, *ret;
+  if(!e)
+    return strdup("<null>");
+
+  char addrstr[INET6_ADDRSTRLEN + 1], portstr[6], *ret;
   char addrport_sep = ':';
 
-  switch (((struct sockaddr *)&e)->sa_family)
+  switch(e->addr_.ss_family)
   {
-  case AF_INET:
-    ptr = &((struct sockaddr_in *)&e)->sin_addr;
-    port = ntohs(((struct sockaddr_in *)&e)->sin_port);
-    addrstr_len = INET_ADDRSTRLEN + 1;
-    addrport_sep = ':';
-    break;
-  case AF_INET6:
-    ptr = &((struct sockaddr_in6 *)&e)->sin6_addr;
-    port = ntohs(((struct sockaddr_in6 *)&e)->sin6_port);
-    addrstr_len = INET6_ADDRSTRLEN + 1;
-    addrport_sep = '.';
-    break;
-  default:
-    asprintf(&ret, "unknown address type");
-    return ;
+  case AF_INET: addrport_sep = ':'; break;
+  case AF_INET6: addrport_sep = '.'; break;
+  case AF_UNSPEC: return NULL;
+  default: return strdup("<unknown address type>");
   }
-  addrstr = malloc(addrstr_len);
-  if(!addrstr)
-    return NULL;
-  inet_ntop (((struct sockaddr *)&e)->sa_family, ptr, addrstr, addrstr_len);
-  asprintf(&ret, "%s%c%d", addrstr, addrport_sep ,port);
-  free(addrstr);
+
+  int errcode  = getnameinfo((struct sockaddr *)&(e->addr_), e->len_, addrstr, sizeof(addrstr), portstr, sizeof(portstr), NI_NUMERICHOST | NI_NUMERICSERV);
+  if (errcode != 0) return NULL;
+  int len = asprintf(&ret, "%s%c%s", addrstr, addrport_sep ,portstr);
+  if(len == -1) return NULL;
   return ret;
 }
 
-char* udp_get_remote_end_string(udp_t* sock)
-{
-  if(!sock || !sock->remote_end_set_)
-    return NULL;
 
-  return udp_endpoint_to_string(sock->remote_end_);
-}
- 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end)
 {
-  if(!sock || !remote_end)
+  if(!sock || !buf || !remote_end)
     return -1;
 
-  socklen_t socklen = sizeof(*remote_end);
-  return recvfrom(fd, buf, len, 0, (struct sockaddr *)remote_end, &socklen);
+  return recvfrom(fd, buf, len, 0, (struct sockaddr *)&(remote_end->addr_), &(remote_end->len_));
 }
 
+
 int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len)
 {
-  if(!sock || !sock->remote_end_set_ || !sock->active_sock_)
+  if(!sock || !buf || !sock->active_sock_ || !sock->active_sock_->remote_end_set_)
     return 0;
 
-  socklen_t socklen = sizeof(sock->remote_end_);
-  if((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET)
-    socklen = sizeof(struct sockaddr_in);
-  else if ((((struct sockaddr *)&sock->active_sock_->local_end_)->sa_family) == AF_INET6)
-    socklen = sizeof(struct sockaddr_in6);
-
-  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->remote_end_), socklen);
+  return sendto(sock->active_sock_->fd_, buf, len, 0, (struct sockaddr *)&(sock->active_sock_->remote_end_.addr_), sock->active_sock_->remote_end_.len_);
 }
-
diff --git a/src/udp.h b/src/udp.h
index edf0160..d0d218d 100644
--- a/src/udp.h
+++ b/src/udp.h
@@ -10,12 +10,12 @@
  *  tunnel endpoints.  It has less protocol overhead than IPSec in Tunnel
  *  mode and allows tunneling of every ETHER TYPE protocol (e.g.
  *  ethernet, ip, arp ...). satp directly includes cryptography and
- *  message authentication based on the methodes used by SRTP.  It is
+ *  message authentication based on the methods used by SRTP.  It is
  *  intended to deliver a generic, scaleable and secure solution for
  *  tunneling and relaying of packets of any protocol.
- *  
  *
- *  Copyright (C) 2007-2010 Christian Pointner <equinox@anytun.org>
+ *
+ *  Copyright (C) 2007-2014 Christian Pointner <equinox@anytun.org>
  *
  *  This file is part of uAnytun.
  *
@@ -31,6 +31,19 @@
  *
  *  You should have received a copy of the GNU General Public License
  *  along with uAnytun. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL.  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so.  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version.  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
  */
 
 #ifndef UANYTUN_udp_h_INCLUDED
@@ -41,11 +54,17 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 
-typedef struct sockaddr_storage udp_endpoint_t;
+typedef struct {
+  socklen_t len_;
+  struct sockaddr_storage addr_;
+} udp_endpoint_t;
 
 struct udp_socket_struct {
   int fd_;
+  unsigned int idx_;
   udp_endpoint_t local_end_;
+  udp_endpoint_t remote_end_;
+  int remote_end_set_;
   struct udp_socket_struct* next_;
 };
 typedef struct udp_socket_struct udp_socket_t;
@@ -53,19 +72,17 @@ typedef struct udp_socket_struct udp_socket_t;
 struct udp_struct {
   udp_socket_t* socks_;
   udp_socket_t* active_sock_;
-  udp_endpoint_t remote_end_;
-  int remote_end_set_;
 };
 typedef struct udp_struct udp_t;
 
 int udp_init(udp_t* sock, const char* local_addr, const char* port, resolv_addr_type_t resolv_type);
-int udp_init_fd_set(udp_t* sock, fd_set* set);
-int udp_set_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
-void udp_set_active_sock(udp_t* sock, int fd);
+int udp_fill_fd_set(udp_t* sock, fd_set* set);
+int udp_has_remote(udp_t* sock);
+int udp_resolv_remote(udp_t* sock, const char* remote_addr, const char* port, resolv_addr_type_t resolv_type);
+void udp_update_remote(udp_t* sock, int fd, udp_endpoint_t* remote);
 void udp_close(udp_t* sock);
 
-char* udp_endpoint_to_string(udp_endpoint_t e);
-char* udp_get_remote_end_string(udp_t* sock);
+char* udp_endpoint_to_string(udp_endpoint_t* e);
 
 int udp_read(udp_t* sock, int fd, u_int8_t* buf, u_int32_t len, udp_endpoint_t* remote_end);
 int udp_write(udp_t* sock, u_int8_t* buf, u_int32_t len);
diff --git a/version b/version
index 1c09c74..c2c0004 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-0.3.3
+0.3.5
-- 
2.1.4


From d1e000bd3565360922c50bad828395ccf05715a5 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@grml.org>
Date: Fri, 29 Aug 2014 13:45:42 -0700
Subject: [PATCH 13/16] Bump Standards-Version to 3.9.5

---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 763a22d..bb1c8c3 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: net
 Priority: extra
 Maintainer: Michael Prokop <mika@debian.org>
 Build-Depends: debhelper (>= 5), libgcrypt11-dev
-Standards-Version: 3.8.4
+Standards-Version: 3.9.5
 Homepage: http://www.anytun.org/
 Vcs-git: git://git.grml.org/uanytun.git
 Vcs-Browser: http://git.grml.org/?p=uanytun.git
-- 
2.1.4


From a836c46f144432b55f3e73494074e4361d4cae78 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@grml.org>
Date: Fri, 29 Aug 2014 13:46:10 -0700
Subject: [PATCH 14/16] wrap-and-sort the debian directory

---
 debian/control | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/debian/control b/debian/control
index bb1c8c3..6bdec95 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,8 @@ Source: uanytun
 Section: net
 Priority: extra
 Maintainer: Michael Prokop <mika@debian.org>
-Build-Depends: debhelper (>= 5), libgcrypt11-dev
+Build-Depends: debhelper (>= 5),
+               libgcrypt11-dev
 Standards-Version: 3.9.5
 Homepage: http://www.anytun.org/
 Vcs-git: git://git.grml.org/uanytun.git
@@ -10,10 +11,12 @@ Vcs-Browser: http://git.grml.org/?p=uanytun.git
 
 Package: uanytun
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, adduser
+Depends: adduser,
+         ${misc:Depends},
+         ${shlibs:Depends}
 Description: tiny implementation of the secure anycast tunneling protocol
- uAnytun is a tiny implementation of SATP (Secure Anycast Tunneling                                                                                                               
- Protocol). Unlike Anytun which is a full featured implementation                                                                                                                 
+ uAnytun is a tiny implementation of SATP (Secure Anycast Tunneling
+ Protocol). Unlike Anytun which is a full featured implementation
  uAnytun has no support for multiple connections or synchronisation.
  It is a small single threaded implementation intended to act as a
  client on small platforms. SATP defines a protocol used for
-- 
2.1.4


From 2fd4cc8434440138fa1792b453fce2b913c092e3 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@grml.org>
Date: Fri, 29 Aug 2014 13:49:41 -0700
Subject: [PATCH 15/16] Update dependency from libgcrypt11-dev to
 libgcrypt20-dev

---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 6bdec95..ff42f0a 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: net
 Priority: extra
 Maintainer: Michael Prokop <mika@debian.org>
 Build-Depends: debhelper (>= 5),
-               libgcrypt11-dev
+               libgcrypt20-dev
 Standards-Version: 3.9.5
 Homepage: http://www.anytun.org/
 Vcs-git: git://git.grml.org/uanytun.git
-- 
2.1.4


From 8f745eb8662efdef643c061e47883fbaf1b8b744 Mon Sep 17 00:00:00 2001
From: Michael Prokop <mika@grml.org>
Date: Fri, 29 Aug 2014 13:50:09 -0700
Subject: [PATCH 16/16] Release new version 0.3.5-1

---
 debian/changelog | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 8f220a5..c4a6dec 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+uanytun (0.3.5-1) unstable; urgency=medium
+
+  * [71f6f66] Imported Upstream version 0.3.5
+    - Includes support for clang [Closes: #745643]
+  * [d1e000b] Bump Standards-Version to 3.9.5
+  * [a836c46] wrap-and-sort the debian directory
+  * [2fd4cc8] Update dependency from libgcrypt11-dev to libgcrypt20-dev
+
+ -- Michael Prokop <mika@grml.org>  Fri, 29 Aug 2014 13:49:59 -0700
+
 uanytun (0.3.3-1) unstable; urgency=low
 
   * New upstream release.
-- 
2.1.4