Standardize logging with bgpd OK claudio@

Use ibuf_data() instead of accessing ibuf->buf directly. OK tb@

Simplify and clean up the code. Try to use more ibuf idioms but the mix of types used in these functions make this rather hard. The expected data checks are still not great but a step in the right direction. OK tb@

Replace a ibuf_reserve() dance to add a NUL byte with ibuf_add_zero(buf, 1). Same thing but far less nasty. OK tb@

check_send_expect() does some nasty ibuf magic to allow fn_match() to work with a buffer that is not a real string. The wpos is decremented in the wrong spot and would affect both binary and non binary checks. Simplify this code by using strndup. OK rob@ benno@

Add support for binary protocol health checking. Feedback and guidance from benno@ and reky@. Man page tweaks from jmc@. ok benno@

In case of a tcp read timeout, the destination host state needs to be set to HOST_DOWN. Noticed and fixed by Rivo Nurges <Rivo DOT Nurges AT smit DOT ee> ok and reminder florian@

if configured, set the ttl (IPV6_UNICAST_HOPS) for ipv6 tcp checks. From Kapetanakis Giannis, thanks. ok florian@

use __func__ in log messages. fix some whitespace while here. From Hiltjo Posthuma hiltjo -AT codemadness -DOT- org, thanks! ok florian, claudio

Migrate relayd to use libtls for TLS. Still does the TLS privsep via the engine but at least we can use a sane API for new features. Going in now so it is possible to work with this in tree. General agreement at d2k17.

Do not loose the send/expect validation error on timeout. When a read timeout is reached, the code also has to check if there is already anything in the input buffer and verify it again. This fixes relayd and relayctl to show "send/expect failed" instead of "tcp read timeout". Found by Michael W. Lucas (while working on the Relayd Mastery book). Thanks. OK benno@

This adds the host_error output and the http code (when available) to the host-check log. ok claudio@

now that ibuf_free() checks for null, we can remove the check here. ok mmcc@ millert@

revert check_tcp rev 1.41 by yasuoka@ This part was not meant to be commited, only the bits in check_icmp.c and relayd.h are ok. ok yasuoka@

Use SOCK_NONBLOCK in relayd as well. OK benno@

Increase the input side socket buffer size for "check icmp" not to drop the reply messages when "check icmp" is used with many hosts. ok reyk benno

Clean up the relayd headers with help of include-what-you-use and some manual review. Based on common practice, relayd.h now includes the necessary headers for itself. OK benno@

Adapt to <limits.h> universe. ok millert

Change the keyword "ssl" to "tls" to reflect reality since we effectively disabled support for the SSL protocols. SSL remains a common term describing SSL/TLS, there is some controvery about this change, and the name really doesn't matter, but I feel confident about it now. (btw., sthen@ pointed out some historical context: http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) OK benno@, with input from tedu@

Use log_warn() to include errno if write() fails. From thib

don't leak fds in failure path (ie when hosts are down) from Martin Matuska in PR 6624 ok phessler@

Fix reload support in relayd(8) by reimplementing large parts of the daemon infrastructure. The previous design made it fairly hard to reload the complex data structures, especially relays and protocols. One of the reasons was that the privsep'd relayd processes had two ways of getting their configuration: 1) from memory after forking from the parent process and 2) and (partially) via imsgs after reload. The new implementation first forks the privsep'd children before the parents loads the configuration and sends it via imsgs to them; so it is only like 2) before. It is based on an approach that I first implemented for iked(8) and I also fixed many bugs in the code. Thanks to many testers including dlg@ sthen@ phessler@ ok pyr@ dlg@ sthen@

Update all logging and debug functions to use the __func__ macro instead of static function names. __func__ is C99 and perfectly fine to use. It also avoids printing errors; for example if a statement log_debug("foo:"..) was moved or copied from function foo() to bar() and the log message was not updated...

Only set SO_REUSEPORT for listening ports. Fixes "Address already in use" errors seen on high load. OK reyk@ pyr@

The relayd processes did already bump up the socket file descriptor resource limits to the maximum of the daemon class but the host check process (hce/health checks) didn't and was limited to a fairly low default of 128 open sockets (openfiles-cur=128 in login.conf). This was reached fairly quickly with "check tcp" of many hosts. This diff increases the maximum number of monitored hosts and concurrent health checks in relayd in a significant way and may fix issues for people that have around 100 or more hosts (or fewer hosts with multiple checked ports). tested by phessler@ ok jsg@