Skip to contentSkip to conversation

Fast recovery when host is in unreachable network

PATCH In review Lev Stipakov 3 participants 7 messages Mar 2, 2015 – Oct 10, 2015

lore
Share & tools
lore

Lev Stipakov

author
#0 lore raw

PATCH 1/1 Fast recovery when host is in unreachable network

When client connects to the server which is in unreachable network (for example hostname got resolved into ipv6 address and client has no ipv6), throw SIGUSR1 and connect to the next server without waiting 60 seconds for "TLS key negotiation failed".

---
 src/openvpn/forward.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
src/openvpn/forward.c +10 -0
index a3323e9..8eb8434 100644
@@ -1090,6 +1090,7 @@ void
 process_outgoing_link (struct context *c)
 {
   struct gc_arena gc = gc_new ();
+  int error_code = 0;
 
   perf_push (PERF_PROC_OUT_LINK);
 

@@ -1177,6 +1178,7 @@ process_outgoing_link (struct context *c)
 	}
 
       /* Check return status */
+      error_code = openvpn_errno();
       check_status (size, "write", c->c2.link_socket, NULL);
 
       if (size > 0)

@@ -1193,6 +1195,14 @@ process_outgoing_link (struct context *c)
       /* if not a ping/control message, indicate activity regarding --inactive parameter */
       if (c->c2.buf.len > 0 )
         register_activity (c, size);
+
+      /* for unreachable network and "connecting" state switch to the next host */
+      if (size < 0 && ENETUNREACH == error_code && !tls_initial_packet_received (c->c2.tls_multi)
+	  && c->options.mode == MODE_POINT_TO_POINT)
+	{
+	  msg (M_INFO, "Network unreachable, restarting");
+	  register_signal (c, SIGUSR1, "network-unreachable");
+	}
     }
   else
     {
Signature · 1 line
1.9.1
#1 lore raw

Am 02.03.15 um 18:58 schrieb Lev Stipakov:

Quoted 4 lines

When client connects to the server which is in unreachable network (for example hostname got resolved into ipv6 address and client has no ipv6), throw SIGUSR1 and connect to the next server without waiting 60 seconds for "TLS key negotiation failed".

ACK. It works for me and code looks good.

Arne

#2 lore raw
In reply to Lev Stipakov

Your patch has been applied to the master branch.

commit 99daa6b19270775006f034f21936c98a9005477d

Author: Lev Stipakov
Date:   Mon Mar 2 19:58:31 2015 +0200
     Fast recovery when host is in unreachable network

     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9498
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#3 lore raw

Hi,

Quoted 1 line · Gert Doering

Your patch has been applied to the master branch.

And *blam* it explodes if --disable-crypto is used...

gcc -DHAVE_CONFIG_H -I. -I../.. -I../../include -I../../include
+-I../../src/compat -g -O2 -MT forward.o -MD -MP -MF
+.deps/forward.Tpo -c -o forward.o forward.c
forward.c: In function 'process_outgoing_link':
forward.c:1203: error: 'struct context_2' has no member named 'tls_multi' *** [forward.o] Error code 1

Waiting for an update :-)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
author
#4 lore raw

PATCH 1/1 Fix compilcation error with --disable-crypto

Also disable behavior for static key setup.

---
 src/openvpn/forward.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
src/openvpn/forward.c +5 -2
index 513fbae..c17be35 100644
@@ -1199,13 +1199,16 @@ process_outgoing_link (struct context *c)
       if (c->c2.buf.len > 0 )
         register_activity (c, size);
 
+
+#ifdef ENABLE_CRYPTO
       /* for unreachable network and "connecting" state switch to the next host */
-      if (size < 0 && ENETUNREACH == error_code && !tls_initial_packet_received (c->c2.tls_multi)
-	  && c->options.mode == MODE_POINT_TO_POINT)
+      if (size < 0 && ENETUNREACH == error_code && c->c2.tls_multi &&
+          !tls_initial_packet_received (c->c2.tls_multi) && c->options.mode == MODE_POINT_TO_POINT)
 	{
 	  msg (M_INFO, "Network unreachable, restarting");
 	  register_signal (c, SIGUSR1, "network-unreachable");
 	}
+#endif
     }
   else
     {
Signature · 1 line
1.9.1
#5 lore raw

Re: [Openvpn-devel] [PATCH] Fix compilcation error with --disable-crypto

Am 10.10.15 um 12:14 schrieb Lev Stipakov:

Quoted 1 line

Also disable behavior for static key setup.

ACK from.

Arne

#6 lore raw

[Openvpn-devel] [PATCH applied] Re: Fix compilcation error with --disable-crypto

In reply to Lev Stipakov

Your patch has been applied to the master branch.

(I've taken the liberty to fix the typo in the commit message :) )

commit b05a453be5dd21326e79f42b0a363f2f23eaa29a

Author: Lev Stipakov
Date:   Sat Oct 10 13:14:29 2015 +0300
     Fix compilation error with --disable-crypto

     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10231
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering