Attention is currently required from: plaisthos, stipa.
Hello plaisthos, ralf_lici,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1752?usp=email
to look at the new patch set (#30).
Change subject: oob: Add --server-probe-reply to advertise probe reply values
......................................................................
oob: Add --server-probe-reply to advertise probe reply values
Add a server option, --server-probe-reply max-latency-diff [weight]
[prio], setting the values the server returns in its OOB PROBE_REPLY. An
unconfigured server advertises weight 50, priority 100 and a 10 ms
max-latency-diff.
max-latency-diff is how much slower than the fastest server a server may
be and still count as equally good; 0 asks clients to pick strictly by
latency, so only servers whose measured RTT ties the fastest stay
candidates, with weight still splitting exact ties. All three values are
range-checked to 0..65535.
The server puts the values into the probe_reply it builds once a probe
is accepted; the client already reads and ranks remotes by them. The
option takes at least the margin and is a server-mode option.
Also add the 2.8 changelog entry for the out-of-band probing feature.
Change-Id: Id74cfae7e9d69029d2ddbf635ee85a2a6cedc3d8
Signed-off-by: Lev Stipakov <[email protected]>
---
M Changes.md
M doc/man-sections/server-options.rst
M src/openvpn/mudp.c
M src/openvpn/options.c
M src/openvpn/options.h
5 files changed, 92 insertions(+), 5 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/52/1752/30
diff --git a/Changes.md b/Changes.md
index 2684251..cb85456 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,5 +1,15 @@
# Overview of changes in 2.8
+## New features
+
+* **Out-of-band server probing and server-controlled selection**
+
+ With `--server-probe`, a client probes all configured UDP remotes before
+ connecting and reorders them based on the replies: reachable servers are
tried
+ first, ordered by server-advertised priority, measured latency and advertised
+ weight with DNS-SRV-like semantics. Servers advertise these values with
+ `--server-probe-reply`.
+
## User-visible Changes
* **Parsing Distinguished Names in certificates**
diff --git a/doc/man-sections/server-options.rst
b/doc/man-sections/server-options.rst
index 9dfa6bd..bf030d7 100644
--- a/doc/man-sections/server-options.rst
+++ b/doc/man-sections/server-options.rst
@@ -662,6 +662,39 @@
Pushing of the ``--tun-ipv6`` directive is done for older clients which
require an explicit ``--tun-ipv6`` in their configuration.
+--server-probe-reply args
+ Set the values a server advertises in its replies to out-of-band
+ probes from clients using ``--server-probe``.
+
+ Valid syntaxes::
+
+ server-probe-reply max-latency-diff
+ server-probe-reply max-latency-diff weight
+ server-probe-reply max-latency-diff weight priority
+
+ ``max-latency-diff`` is the candidate-band margin in milliseconds that
+ *this* server announces. When it is the fastest server of its priority
+ group, a probing client treats every server within that margin of it as
+ equal and picks among them by ``weight``; the margin of a slower server
+ has no effect. The default is :code:`10`; :code:`0` means only servers
+ tying it exactly count as equal, and ``weight`` still distributes load
+ between those. A client that sets its own margin with ``--server-probe``
+ overrides every advertised value.
+
+ ``weight`` (default :code:`50`) and ``priority`` (default :code:`100`)
+ have DNS SRV (RFC 2782) semantics: clients try servers with a lower
+ priority value first (lower is better), and distribute load between
+ equally-good servers of the same priority proportionally to their
+ weights.
+
+ All values are in the range :code:`0` to :code:`65535`. A UDP server
+ answers probes by default, whether or not this option is given, and
+ the values above only change what it advertises. Replies are stateless
+ and rate-limited. A probe whose timestamp is more than ``--hand-window``
+ away from the server's clock is answered only within a small budget, a
+ twentieth of ``--connect-freq-initial``, so a client with a wrong clock
+ can still probe while a replayed probe is answered at most that often.
+
--stale-routes-check args
Remove routes which haven't had activity for ``n`` seconds (i.e. the ageing
time). This check is run every ``t`` seconds (i.e. check interval).
diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index ae0d568c..b956523 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -257,8 +257,13 @@
return false;
}
- /* the reply echoes the peer's session id */
- struct oob_probe_reply reply = { .peer_session_id =
state->peer_session_id };
+ /* the echo of the peer's session id, plus what we advertise */
+ struct oob_probe_reply reply = {
+ .peer_session_id = state->peer_session_id,
+ .priority = m->top.options.server_probe_reply_priority,
+ .weight = m->top.options.server_probe_reply_weight,
+ .max_latency_diff =
m->top.options.server_probe_reply_max_latency_diff,
+ };
/* Our session id is a stateless SYN cookie (the same HMAC the
three-way
* handshake uses): we keep no per-probe state, and the reply can later
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 35ef2af..3601286 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -44,6 +44,7 @@
#include "ssl.h"
#include "ssl_ncp.h"
#include "options.h"
+#include "oob.h"
#include "misc.h"
#include "socket_util.h"
#include "packet_id.h"
@@ -480,6 +481,8 @@
"--auth-user-pass-optional : Allow connections by clients that don't\n"
" specify a username/password.\n"
"--client-to-client : Internally route client-to-client traffic.\n"
+ "--server-probe-reply m [w [p]] : Advertise latency margin m (ms), weight
w\n"
+ " and priority p in replies to --server-probe clients.\n"
"--duplicate-cn : Allow multiple clients with the same common name to\n"
" concurrently connect.\n"
"--client-connect cmd : Run command cmd on client connection.\n"
@@ -813,10 +816,16 @@
o->ce.proto = PROTO_UDP;
o->ce.af = AF_UNSPEC;
- /* The client latency margin is -1 = "not set": the client's value is
- * authoritative when given, otherwise each server's advertised margin (or
- * the built-in default) applies. */
+ /* server-probe defaults. The client latency margin is -1 = "not set": the
+ * client's value is authoritative when given, otherwise the margin
advertised
+ * by the fastest server of a priority group applies to that group. An
+ * (unconfigured) server advertises weight 50 / priority 100 and a margin
of
+ * OOB_DEFAULT_LATENCY_MARGIN_MS -- announcing 0 would ask clients to pick
+ * strictly by latency and never by weight. */
o->server_probe_latency_margin = -1;
+ o->server_probe_reply_weight = 50;
+ o->server_probe_reply_priority = 100;
+ o->server_probe_reply_max_latency_diff = OOB_DEFAULT_LATENCY_MARGIN_MS;
o->ce.bind_ipv6_only = false;
o->ce.connect_retry_seconds = 1;
o->ce.connect_retry_seconds_max = 300;
@@ -2005,6 +2014,7 @@
MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
MUST_BE_UNDEF(cf_max, "connect-freq");
MUST_BE_UNDEF(cf_per, "connect-freq");
+ MUST_BE_UNDEF(server_probe_reply_defined, "server-probe-reply");
MUST_BE_FALSE(options->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED |
SSLF_CLIENT_CERT_OPTIONAL),
"verify-client-cert");
@@ -5105,6 +5115,27 @@
options->server_probe_latency_margin = margin;
}
}
+ else if (streq(p[0], "server-probe-reply") && p[1] && !p[4])
+ {
+ VERIFY_PERMISSION(OPT_P_GENERAL);
+ /* --server-probe-reply max-latency-diff [weight] [prio] */
+ options->server_probe_reply_defined = true;
+ int vals[3] = { options->server_probe_reply_max_latency_diff,
+ options->server_probe_reply_weight,
+ options->server_probe_reply_priority };
+ for (int i = 0; i < 3 && p[i + 1]; i++)
+ {
+ vals[i] = positive_atoi(p[i + 1], msglevel);
+ if (vals[i] > 0xffff)
+ {
+ msg(msglevel, "--server-probe-reply: values must be 0 to
65535");
+ goto err;
+ }
+ }
+ options->server_probe_reply_max_latency_diff = (uint16_t)vals[0];
+ options->server_probe_reply_weight = (uint16_t)vals[1];
+ options->server_probe_reply_priority = (uint16_t)vals[2];
+ }
else if (streq(p[0], "nice") && p[1] && !p[2])
{
VERIFY_PERMISSION(OPT_P_NICE);
diff --git a/src/openvpn/options.h b/src/openvpn/options.h
index c2cde60..67e3659 100644
--- a/src/openvpn/options.h
+++ b/src/openvpn/options.h
@@ -341,6 +341,14 @@
/* client: default candidate-band margin in ms (--server-probe
[max-latency-diff]):
* servers within this RTT of the fastest are treated as equally fast */
int server_probe_latency_margin;
+ /* server: values advertised in the OOB PROBE_REPLY (--server-probe-reply).
+ * priority/weight follow DNS-SRV semantics; max_latency_diff is the
+ * candidate band this server asks clients to use (0 = only the fastest
+ * server of the group is a candidate). */
+ uint16_t server_probe_reply_priority;
+ uint16_t server_probe_reply_weight;
+ uint16_t server_probe_reply_max_latency_diff;
+ bool server_probe_reply_defined;
bool mlock;
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1752?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id74cfae7e9d69029d2ddbf635ee85a2a6cedc3d8
Gerrit-Change-Number: 1752
Gerrit-PatchSet: 30
Gerrit-Owner: stipa <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-Reviewer: ralf_lici <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: stipa <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
