Add option to prevent respawn of child processes.

This patch adds a command-line option (--dont-respawn, -R) that will
prevent the child processes from respawning. When this option is
specified, if either the checker or vrrp child processes exit the
parent process will raise the SIGTERM signal and exit.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Remove duplicate command-line option code

This patch removes unnecessary code to process command-line
options. All options can be processed with a single while loop that
calls poptGetNextOpt. This patch also adds code to check for errors
while processing options. Note that errors encountered while
processing command-line options are fatal.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Use popt to generate usage

This patch uses the popt library to describe the command-line options
and print usage to stderr. This provides a more clear, concise usage
statement.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Update keepalived man page

The keepalived(8) was out-of-date and, in some cases, inaccurate. This
patch provides a complete rewrite of the keepalived(8) man page. This
includes updated synopsis, description, and options.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Add flexible HTTP checker behaviour for HTTP GET request's port settings.

VirtualServer's port being specified in HTTP GET request
only if `VirtualHost` option is not defined,
otherwise used `VirtualHost` option itself.
Fix pointer arithmetic for VRRP packet

When using IPSEC AH authentication, the pointer arithmetic used to get
the location of the VRRP packet is incorrect. The address of the IPSEC
header must be cast as (char *) in order to get correct address of the
VRRP packet. Without this patch, vrrp_in_chk() will fail to verify
incoming VRRP packets when IPSEC AH is enabled.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Load SSL certificate correctly.

This patch fixes a problem where keepalived will attempt to load an
SSL keyfile as a certificate, resulting in failure to initialize SSL
context.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Fix typo in error messages.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Update GPLv2 license.

This GPLv2 license found in COPYING had a couple errors, including an
incorrect address for the Free Software Foundation. This patch updates
the GPLv2 license to match the license that can be found at:
http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Fix configure.in. Library crypt is needed.
Fix comparison of primary IP addresses.

If a router in the master state receives an advertisement with
priority equal to the local priority, it must also compare the primary
IP addresses (RFC 3768, section 6.4.3). The code to handle this was
comparing two IP addresses with different byte-ordering, resulting in
multiple routers in the master state. This patches resolves the
problem by coverting the local primary IP address to network byte
order for the comparison.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Remove log_message calls from if_get_by_ifname.

The if_get_by_ifname function would log a message if either the
if_queue list was empty or if the interface name was not present in
the list. Since if_get_by_ifname is called to check for the existence
of an interface before adding it to the list, the "No such interface"
message is logged whenever adding a new interface to this list. This
is normal but can be confusing. Since if_get_by_ifname returns NULL
when the interface does not exist, the caller should be responsible
for logging any error messages.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>
Fix a memory leak
Fix a memory leak
set RETVAL for status instead keeping RETVAL set to default of 0
set RETVAL for catch all and so that it exits like all other matches in the case
corrected a typo
genhash: ensure CLRF{2} HTML body separator won't slip

Previously, the code (mistakenly) relied on \r\n\r\n sequence being read
from non-blocking socket in one go, which is not always the case.

This patch builds upon existing infrastructure to "minimize buffer using
no 2*CR/LF found yet" that was probably designed for what is completed
now -- keep up to 4 last bytes of the last read at the beginning of the
working buffer (as these might fit the separator or its part that would
be missed upon subsequent processing), append read data from the current
one and only then try to extract the beginning of HTML body start from
it.  This should guarantee we never miss this event.

Previously, it was possible as observed with, e.g., Python
SimpleHTTPServer.  In such case, the MD5SUM returned was that
of empty string: d41d8cd98f00b204e9800998ecf8427e.

In the wider context of the project, it can have some negative
consequences.  Even after this changeset is applied, it might still
be recommendable to recheck the hash against the output of, e.g.:

  curl -k ${URL} | md5sum

but only in case no redirections or similar fancy things are present.

Also added is an executable test;  demonstration of the issue and
the fix is as follows (dot denotes success, 10 errors encountered
lead to premature exit):

$ ./genhash-test.sh
> Test TESTFILE=genhash-test.sh with
> MD5SUM=0fcdd1e13b2eb119f2eadf73463d2169
> Using GENHASH=../bin/genhash
> Waiting for Python SimpleHTTPServer...
> Serving HTTP on 0.0.0.0 port 8000 ...
> Python SimpleHTTPServer started

BEFORE:

> d41d8cd98f00b204e9800998ecf8427e
> .
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
> ..
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> d41d8cd98f00b204e9800998ecf8427e
>
> --- 10 ---

AFTER:

> .....................................................................
> .....................................................................
> .....................................................................
> .....................................................................
> .....................................................................
> .....................................................................
> .....................................................................
> .................
> --- 0 ---

As apparent, previously the success was random, now it should be
reliable.

Signed-off-by: Jan Pokorný <jpokorny@redhat.com>
genhash: generalize the hash algo parts, add SHA1

This patch adds support for hash algo suite extension with SHA1 being
a first one to be available together with a default MD5.

The remaining change on the health-checker subsystem side is to make
analogous modifications and to teach it to recognize the intended
hash algorithm based on the length of the digest (provided that extra
care is taken that no two algorithms will ever alias in this regard).

Also the test script for genhash was extended to conditionally use SHA1.

Signed-off-by: Jan Pokorný <jpokorny@redhat.com>
Fix macro in keepalived.conf.5 man page.

Signed-off-by: Ryan O'Hara <rohara@redhat.com>