/*      $OpenBSD: net.c,v 1.24 2022/01/28 06:33:27 guenther Exp $       */

/*
 * Copyright (c) 2005 Håkan Olsson.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * This code was written under funding by Multicom Security AB.
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <ifaddrs.h>
#include <netdb.h>
#include <signal.h>

#include <openssl/aes.h>
#include <openssl/sha.h>

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "sasyncd.h"
#include "net.h"

struct msg {
        u_int8_t        *buf;
        u_int32_t        len;
        int              refcnt;
};

struct qmsg {
        SIMPLEQ_ENTRY(qmsg)     next;
        struct msg      *msg;
};

int     *listeners;
AES_KEY aes_key[2];
#define AES_IV_LEN      AES_BLOCK_SIZE

/* We never send (or expect to receive) messages smaller/larger than this. */
#define MSG_MINLEN      12
#define MSG_MAXLEN      4096

/* Local prototypes. */
static u_int8_t *net_read(struct syncpeer *, u_int32_t *, u_int32_t *);
static int       net_set_sa(struct sockaddr *, char *, in_port_t);
static void      net_check_peers(void *);

/* Pretty-print a buffer. */
void
dump_buf(int lvl, u_int8_t *b, u_int32_t len, char *title)
{
        u_int32_t       i, off, blen;
        u_int8_t        *buf;
        const char      def[] = "Buffer:";

        if (cfgstate.verboselevel < lvl)
                return;

        blen = 2 * (len + len / 36) + 3 + (title ? strlen(title) : sizeof def);
        if (!(buf = calloc(1, blen)))
                return;

        snprintf(buf, blen, "%s\n ", title ? title : def);
        off = strlen(buf);
        for (i = 0; i < len; i++, off+=2) {
                snprintf(buf + off, blen - off, "%02x", b[i]);
                if ((i+1) % 36 == 0) {
                        off += 2;
                        snprintf(buf + off, blen - off, "\n ");
                }
        }
        log_msg(lvl, "%s", buf);
        free(buf);
}

/* Add a listening socket. */
static int
net_add_listener(struct sockaddr *sa)
{
        char    host[NI_MAXHOST], port[NI_MAXSERV];
        int     r, s;

        s = socket(sa->sa_family, SOCK_STREAM, 0);
        if (s < 0) {
                perror("net_add_listener: socket()");
                close(s);
                return -1;
        }

        r = 1;
        if (setsockopt(s, SOL_SOCKET,
                cfgstate.listen_on ? SO_REUSEADDR : SO_REUSEPORT, (void *)&r,
                sizeof r)) {
                perror("net_add_listener: setsockopt()");
                close(s);
                return -1;
        }

        if (bind(s, sa, sa->sa_family == AF_INET ? sizeof(struct sockaddr_in) :
                sizeof (struct sockaddr_in6))) {
                perror("net_add_listener: bind()");
                close(s);
                return -1;
        }

        if (listen(s, 3)) {
                perror("net_add_listener: listen()");
                close(s);
                return -1;
        }

        if (getnameinfo(sa, sa->sa_len, host, sizeof host, port, sizeof port,
                NI_NUMERICHOST | NI_NUMERICSERV))
                log_msg(2, "listening on port %u fd %d", cfgstate.listen_port,
                    s);
        else
                log_msg(2, "listening on %s port %s fd %d", host, port, s);

        return s;
}

/* Allocate and fill in listeners array. */
static int
net_setup_listeners(void)
{
        struct sockaddr_storage  sa_storage;
        struct sockaddr         *sa = (struct sockaddr *)&sa_storage;
        struct sockaddr_in      *sin = (struct sockaddr_in *)sa;
        struct sockaddr_in6     *sin6 = (struct sockaddr_in6 *)sa;
        struct ifaddrs          *ifap = 0, *ifa;
        int                      i, count;

        /* Setup listening sockets.  */
        memset(&sa_storage, 0, sizeof sa_storage);
        if (net_set_sa(sa, cfgstate.listen_on, cfgstate.listen_port) == 0) {
                listeners = calloc(2, sizeof(int));
                if (!listeners) {
                        perror("net_setup_listeners: calloc()");
                        goto errout;
                }
                listeners[1] = -1;
                listeners[0] = net_add_listener(sa);
                if (listeners[0] == -1) {
                        log_msg(0, "net_setup_listeners: could not find "
                            "listen address (%s)", cfgstate.listen_on);
                        goto errout;
                }
                return 0;
        }

        /*
         * If net_set_sa() failed, cfgstate.listen_on is probably an
         * interface name, so we should listen on all its addresses.
         */

        if (getifaddrs(&ifap) != 0) {
                perror("net_setup_listeners: getifaddrs()");
                goto errout;
        }

        /* How many addresses matches? */
        for (count = 0, ifa = ifap; ifa; ifa = ifa->ifa_next) {
                if (!ifa->ifa_name || !ifa->ifa_addr ||
                    (ifa->ifa_addr->sa_family != AF_INET &&
                        ifa->ifa_addr->sa_family != AF_INET6))
                        continue;
                if (cfgstate.listen_family &&
                    cfgstate.listen_family != ifa->ifa_addr->sa_family)
                        continue;
                if (strcmp(ifa->ifa_name, cfgstate.listen_on) != 0)
                        continue;
                count++;
        }

        if (!count) {
                log_msg(0, "net_setup_listeners: no listeners found for %s",
                    cfgstate.listen_on);
                goto errout;
        }

        /* Allocate one extra slot and set to -1, marking end of array. */
        listeners = calloc(count + 1, sizeof(int));
        if (!listeners) {
                perror("net_setup_listeners: calloc()");
                goto errout;
        }
        for (i = 0; i <= count; i++)
                listeners[i] = -1;

        /* Create listening sockets */
        for (count = 0, ifa = ifap; ifa; ifa = ifa->ifa_next) {
                if (!ifa->ifa_name || !ifa->ifa_addr ||
                    (ifa->ifa_addr->sa_family != AF_INET &&
                        ifa->ifa_addr->sa_family != AF_INET6))
                        continue;
                if (cfgstate.listen_family &&
                    cfgstate.listen_family != ifa->ifa_addr->sa_family)
                        continue;
                if (strcmp(ifa->ifa_name, cfgstate.listen_on) != 0)
                        continue;

                memset(&sa_storage, 0, sizeof sa_storage);
                sa->sa_family = ifa->ifa_addr->sa_family;
                switch (sa->sa_family) {
                case AF_INET:
                        sin->sin_port = htons(cfgstate.listen_port);
                        sin->sin_len = sizeof *sin;
                        memcpy(&sin->sin_addr,
                            &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr,
                            sizeof sin->sin_addr);
                        break;
                case AF_INET6:
                        sin6->sin6_port = htons(cfgstate.listen_port);
                        sin6->sin6_len = sizeof *sin6;
                        memcpy(&sin6->sin6_addr,
                            &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr,
                            sizeof sin6->sin6_addr);
                        break;
                }

                listeners[count] = net_add_listener(sa);
                if (listeners[count] == -1) {
                        log_msg(2, "net_setup_listeners(setup): failed to "
                            "add listener, count = %d", count);
                        goto errout;
                }
                count++;
        }
        freeifaddrs(ifap);
        return 0;

  errout:
        if (ifap)
                freeifaddrs(ifap);
        if (listeners) {
                for (i = 0; listeners[i] != -1; i++)
                        close(listeners[i]);
                free(listeners);
        }
        return -1;
}

int
net_init(void)
{
        struct syncpeer *p;

        if (AES_set_encrypt_key(cfgstate.sharedkey, cfgstate.sharedkey_len,
            &aes_key[0]) ||
            AES_set_decrypt_key(cfgstate.sharedkey, cfgstate.sharedkey_len,
            &aes_key[1])) {
                fprintf(stderr, "Bad AES shared key\n");
                return -1;
        }

        if (net_setup_listeners())
                return -1;

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) {
                p->socket = -1;
                SIMPLEQ_INIT(&p->msgs);
        }

        net_check_peers(0);
        return 0;
}

static void
net_enqueue(struct syncpeer *p, struct msg *m)
{
        struct qmsg     *qm;

        if (p->socket < 0)
                return;

        qm = calloc(1, sizeof *qm);
        if (!qm) {
                log_err("net_enqueue: calloc()");
                return;
        }

        qm->msg = m;
        m->refcnt++;

        SIMPLEQ_INSERT_TAIL(&p->msgs, qm, next);
        return;
}

/*
 * Queue a message for transmission to a particular peer,
 * or to all peers if no peer is specified.
 */
int
net_queue(struct syncpeer *p0, u_int32_t msgtype, u_int8_t *buf, u_int32_t len)
{
        struct syncpeer *p = p0;
        struct msg      *m;
        SHA_CTX          ctx;
        u_int8_t         hash[SHA_DIGEST_LENGTH];
        u_int8_t         iv[AES_IV_LEN], tmp_iv[AES_IV_LEN];
        u_int32_t        v, padlen = 0;
        int              i, offset;

        m = calloc(1, sizeof *m);
        if (!m) {
                log_err("net_queue: calloc()");
                free(buf);
                return -1;
        }

        /* Generate hash */
        SHA1_Init(&ctx);
        SHA1_Update(&ctx, buf, len);
        SHA1_Final(hash, &ctx);
        dump_buf(2, hash, sizeof hash, "net_queue: computed hash");

        /* Padding required? */
        i = len % AES_IV_LEN;
        if (i) {
                u_int8_t *pbuf;
                i = AES_IV_LEN - i;
                pbuf = realloc(buf, len + i);
                if (!pbuf) {
                        log_err("net_queue: realloc()");
                        free(buf);
                        free(m);
                        return -1;
                }
                padlen = i;
                while (i > 0)
                        pbuf[len++] = (u_int8_t)i--;
                buf = pbuf;
        }

        /* Get random IV */
        for (i = 0; (size_t)i <= sizeof iv - sizeof v; i += sizeof v) {
                v = arc4random();
                memcpy(&iv[i], &v, sizeof v);
        }
        dump_buf(2, iv, sizeof iv, "net_queue: IV");
        memcpy(tmp_iv, iv, sizeof tmp_iv);

        /* Encrypt */
        dump_buf(2, buf, len, "net_queue: pre encrypt");
        AES_cbc_encrypt(buf, buf, len, &aes_key[0], tmp_iv, AES_ENCRYPT);
        dump_buf(2, buf, len, "net_queue: post encrypt");

        /* Allocate send buffer */
        m->len = len + sizeof iv + sizeof hash + 3 * sizeof(u_int32_t);
        m->buf = malloc(m->len);
        if (!m->buf) {
                free(m);
                free(buf);
                log_err("net_queue: calloc()");
                return -1;
        }
        offset = 0;

        /* Fill it (order must match parsing code in net_read()) */
        v = htonl(m->len - sizeof(u_int32_t));
        memcpy(m->buf + offset, &v, sizeof v);
        offset += sizeof v;
        v = htonl(msgtype);
        memcpy(m->buf + offset, &v, sizeof v);
        offset += sizeof v;
        v = htonl(padlen);
        memcpy(m->buf + offset, &v, sizeof v);
        offset += sizeof v;
        memcpy(m->buf + offset, hash, sizeof hash);
        offset += sizeof hash;
        memcpy(m->buf + offset, iv, sizeof iv);
        offset += sizeof iv;
        memcpy(m->buf + offset, buf, len);
        free(buf);

        if (p)
                net_enqueue(p, m);
        else
                for (p = LIST_FIRST(&cfgstate.peerlist); p;
                     p = LIST_NEXT(p, link))
                        net_enqueue(p, m);

        if (!m->refcnt) {
                free(m->buf);
                free(m);
        }

        return 0;
}

/* Set all write pending filedescriptors. */
int
net_set_pending_wfds(fd_set *fds)
{
        struct syncpeer *p;
        int             max_fd = -1;

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link))
                if (p->socket > -1 && SIMPLEQ_FIRST(&p->msgs)) {
                        FD_SET(p->socket, fds);
                        if (p->socket > max_fd)
                                max_fd = p->socket;
                }
        return max_fd + 1;
}

/*
 * Set readable filedescriptors. They are basically the same as for write,
 * plus the listening socket.
 */
int
net_set_rfds(fd_set *fds)
{
        struct syncpeer *p;
        int             i, max_fd = -1;

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) {
                if (p->socket > -1)
                        FD_SET(p->socket, fds);
                if (p->socket > max_fd)
                        max_fd = p->socket;
        }
        for (i = 0; listeners[i] != -1; i++) {
                FD_SET(listeners[i], fds);
                if (listeners[i] > max_fd)
                        max_fd = listeners[i];
        }
        return max_fd + 1;
}

static void
net_accept(int accept_socket)
{
        struct sockaddr_storage  sa_storage, sa_storage2;
        struct sockaddr         *sa = (struct sockaddr *)&sa_storage;
        struct sockaddr         *sa2 = (struct sockaddr *)&sa_storage2;
        struct sockaddr_in      *sin, *sin2;
        struct sockaddr_in6     *sin6, *sin62;
        struct syncpeer         *p;
        socklen_t                socklen;
        int                      s, found;

        /* Accept a new incoming connection */
        socklen = sizeof sa_storage;
        memset(&sa_storage, 0, socklen);
        memset(&sa_storage2, 0, socklen);
        s = accept(accept_socket, sa, &socklen);
        if (s > -1) {
                /* Setup the syncpeer structure */
                found = 0;
                for (p = LIST_FIRST(&cfgstate.peerlist); p && !found;
                     p = LIST_NEXT(p, link)) {

                        /* Match? */
                        if (net_set_sa(sa2, p->name, 0))
                                continue;
                        if (sa->sa_family != sa2->sa_family)
                                continue;
                        if (sa->sa_family == AF_INET) {
                                sin = (struct sockaddr_in *)sa;
                                sin2 = (struct sockaddr_in *)sa2;
                                if (memcmp(&sin->sin_addr, &sin2->sin_addr,
                                        sizeof(struct in_addr)))
                                        continue;
                        } else {
                                sin6 = (struct sockaddr_in6 *)sa;
                                sin62 = (struct sockaddr_in6 *)sa2;
                                if (memcmp(&sin6->sin6_addr, &sin62->sin6_addr,
                                        sizeof(struct in6_addr)))
                                        continue;
                        }
                        /* Match! */
                        found++;
                        p->socket = s;
                        log_msg(1, "net: peer \"%s\" connected", p->name);
                        if (cfgstate.runstate == MASTER)
                                timer_add("pfkey_snap", 2, pfkey_snapshot, p);
                }
                if (!found) {
                        log_msg(1, "net: found no matching peer for accepted "
                            "socket, closing.");
                        close(s);
                }
        } else if (errno != EWOULDBLOCK && errno != EINTR &&
            errno != ECONNABORTED)
                log_err("net: accept()");
}

void
net_handle_messages(fd_set *fds)
{
        struct syncpeer *p;
        u_int8_t        *msg;
        u_int32_t        msgtype, msglen;
        int              i;

        for (i = 0; listeners[i] != -1; i++)
                if (FD_ISSET(listeners[i], fds))
                        net_accept(listeners[i]);

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) {
                if (p->socket < 0 || !FD_ISSET(p->socket, fds))
                        continue;
                msg = net_read(p, &msgtype, &msglen);
                if (!msg)
                        continue;

                log_msg(2, "net_handle_messages: got msg type %u len %u from "
                    "peer %s", msgtype, msglen, p->name);

                switch (msgtype) {
                case MSG_SYNCCTL:
                        net_ctl_handle_msg(p, msg, msglen);
                        free(msg);
                        break;

                case MSG_PFKEYDATA:
                        if (p->runstate != MASTER ||
                            cfgstate.runstate == MASTER) {
                                log_msg(1, "net: got PFKEY message from "
                                    "non-MASTER peer");
                                free(msg);
                                if (cfgstate.runstate == MASTER)
                                        net_ctl_send_state(p);
                                else
                                        net_ctl_send_error(p, 0);
                        } else if (pfkey_queue_message(msg, msglen))
                                free(msg);
                        break;

                default:
                        log_msg(0, "net: got unknown message type %u len %u "
                            "from peer %s", msgtype, msglen, p->name);
                        free(msg);
                        net_ctl_send_error(p, 0);
                }
        }
}

void
net_send_messages(fd_set *fds)
{
        struct syncpeer *p;
        struct qmsg     *qm;
        struct msg      *m;
        ssize_t          r;

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) {
                if (p->socket < 0 || !FD_ISSET(p->socket, fds))
                        continue;
                qm = SIMPLEQ_FIRST(&p->msgs);
                if (!qm) {
                        /* XXX Log */
                        continue;
                }
                m = qm->msg;

                log_msg(2, "net_send_messages: msg %p len %u ref %d "
                    "to peer %s", m, m->len, m->refcnt, p->name);

                /* write message */
                r = write(p->socket, m->buf, m->len);
                if (r == -1) {
                        net_disconnect_peer(p);
                        log_msg(0, "net_send_messages: write() failed, "
                            "peer disconnected");
                } else if (r < (ssize_t)m->len) {
                        /* retransmit later */
                        continue;
                }

                /* cleanup */
                SIMPLEQ_REMOVE_HEAD(&p->msgs, next);
                free(qm);

                if (--m->refcnt < 1) {
                        log_msg(2, "net_send_messages: freeing msg %p", m);
                        free(m->buf);
                        free(m);
                }
        }
        return;
}

void
net_disconnect_peer(struct syncpeer *p)
{
        if (p->socket > -1) {
                log_msg(1, "net_disconnect_peer: peer \"%s\" removed",
                    p->name);
                close(p->socket);
        }
        p->socket = -1;
}

void
net_shutdown(void)
{
        struct syncpeer *p;
        struct qmsg     *qm;
        struct msg      *m;
        int              i;

        while ((p = LIST_FIRST(&cfgstate.peerlist))) {
                while ((qm = SIMPLEQ_FIRST(&p->msgs))) {
                        SIMPLEQ_REMOVE_HEAD(&p->msgs, next);
                        m = qm->msg;
                        if (--m->refcnt < 1) {
                                free(m->buf);
                                free(m);
                        }
                        free(qm);
                }
                net_disconnect_peer(p);
                free(p->sa);
                free(p->name);
                LIST_REMOVE(p, link);
                cfgstate.peercnt--;
                free(p);
        }

        if (listeners) {
                for (i = 0; listeners[i] != -1; i++)
                        close(listeners[i]);
                free(listeners);
                listeners = 0;
        }
}

/*
 * Helper functions (local) below here.
 */

static u_int8_t *
net_read(struct syncpeer *p, u_int32_t *msgtype, u_int32_t *msglen)
{
        u_int8_t        *msg, *blob, *rhash, *iv, hash[SHA_DIGEST_LENGTH];
        u_int32_t        v, blob_len, pos = 0;
        int              padlen = 0, offset = 0;
        ssize_t          r;
        SHA_CTX          ctx;

        /* Read blob length */
        r = read(p->socket, &v, sizeof v);
        if (r != (ssize_t)sizeof v) {
                if (r < 1)
                        net_disconnect_peer(p);
                return NULL;
        }

        blob_len = ntohl(v);
        if (blob_len < sizeof hash + AES_IV_LEN + 2 * sizeof(u_int32_t))
                return NULL;
        *msglen = blob_len - sizeof hash - AES_IV_LEN - 2 * sizeof(u_int32_t);
        if (*msglen < MSG_MINLEN || *msglen > MSG_MAXLEN)
                return NULL;

        /* Read message blob */
        blob = malloc(blob_len);
        if (!blob) {
                log_err("net_read: malloc()");
                return NULL;
        }

        while (blob_len > pos) {
                switch (r = read(p->socket, blob + pos, blob_len - pos)) {
                case -1:
                        if (errno == EINTR || errno == EAGAIN)
                                continue;
                        /* FALLTHROUGH */
                case 0:
                        net_disconnect_peer(p);
                        free(blob);
                        return NULL;
                        /* NOTREACHED */
                default:
                        pos += r;
                }
        }

        offset = 0;
        memcpy(&v, blob + offset, sizeof v);
        *msgtype = ntohl(v);
        offset += sizeof v;

        if (*msgtype > MSG_MAXTYPE) {
                free(blob);
                return NULL;
        }

        memcpy(&v, blob + offset, sizeof v);
        padlen = ntohl(v);
        offset += sizeof v;

        rhash = blob + offset;
        iv    = rhash + sizeof hash;
        msg = malloc(*msglen);
        if (!msg) {
                free(blob);
                return NULL;
        }
        memcpy(msg, iv + AES_IV_LEN, *msglen);

        dump_buf(2, rhash, sizeof hash, "net_read: got hash");
        dump_buf(2, iv, AES_IV_LEN, "net_read: got IV");
        dump_buf(2, msg, *msglen, "net_read: pre decrypt");
        AES_cbc_encrypt(msg, msg, *msglen, &aes_key[1], iv, AES_DECRYPT);
        dump_buf(2, msg, *msglen, "net_read: post decrypt");
        *msglen -= padlen;

        SHA1_Init(&ctx);
        SHA1_Update(&ctx, msg, *msglen);
        SHA1_Final(hash, &ctx);
        dump_buf(2, hash, sizeof hash, "net_read: computed hash");

        if (memcmp(hash, rhash, sizeof hash) != 0) {
                free(blob);
                free(msg);
                log_msg(0, "net_read: got bad message (typo in shared key?)");
                return NULL;
        }
        free(blob);
        return msg;
}

static int
net_set_sa(struct sockaddr *sa, char *name, in_port_t port)
{
        struct sockaddr_in      *sin = (struct sockaddr_in *)sa;
        struct sockaddr_in6     *sin6 = (struct sockaddr_in6 *)sa;

        if (!name) {
                /* XXX Assume IPv4 */
                sa->sa_family = AF_INET;
                sin->sin_port = htons(port);
                sin->sin_len = sizeof *sin;
                return 0;
        }

        if (inet_pton(AF_INET, name, &sin->sin_addr) == 1) {
                sa->sa_family = AF_INET;
                sin->sin_port = htons(port);
                sin->sin_len = sizeof *sin;
                return 0;
        }

        if (inet_pton(AF_INET6, name, &sin6->sin6_addr) == 1) {
                sa->sa_family = AF_INET6;
                sin6->sin6_port = htons(port);
                sin6->sin6_len = sizeof *sin6;
                return 0;
        }

        return -1;
}

static void
got_sigalrm(int s)
{
        return;
}

void
net_connect(void)
{
        struct itimerval        iv;
        struct syncpeer         *p;

        signal(SIGALRM, got_sigalrm);
        memset(&iv, 0, sizeof iv);
        iv.it_value.tv_sec = 5;
        iv.it_interval.tv_sec = 5;
        setitimer(ITIMER_REAL, &iv, NULL);

        for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) {
                if (p->socket > -1)
                        continue;
                if (!p->sa) {
                        p->sa = calloc(1, sizeof(struct sockaddr_storage));
                        if (!p->sa)
                                return;
                        if (net_set_sa(p->sa, p->name, cfgstate.listen_port))
                                continue;
                }
                p->socket = socket(p->sa->sa_family, SOCK_STREAM, 0);
                if (p->socket < 0) {
                        log_err("peer \"%s\": socket()", p->name);
                        continue;
                }
                if (connect(p->socket, p->sa, p->sa->sa_len)) {
                        log_msg(1, "net_connect: peer \"%s\" not ready yet",
                            p->name);
                        net_disconnect_peer(p);
                        continue;
                }
                if (net_ctl_send_state(p)) {
                        log_msg(0, "net_connect: peer \"%s\" failed", p->name);
                        net_disconnect_peer(p);
                        continue;
                }
                log_msg(1, "net_connect: peer \"%s\" connected, fd %d",
                    p->name, p->socket);

                /* Schedule a pfkey sync to the newly connected peer. */
                if (cfgstate.runstate == MASTER)
                        timer_add("pfkey_snapshot", 2, pfkey_snapshot, p);
        }

        timerclear(&iv.it_value);
        timerclear(&iv.it_interval);
        setitimer(ITIMER_REAL, &iv, NULL);
        signal(SIGALRM, SIG_IGN);

        return;
}

static void
net_check_peers(void *arg)
{
        net_connect();
        (void)timer_add("peer recheck", 600, net_check_peers, 0);
}