Co-authored-by: Julien Muchembled <jm@nexedi.com>

Here, it's simpler and safer. We will also want to have private methods that
don't start with an underscore.

Certificates are deleted 30 days after they get invalid,
so that unused prefixes can be reallocated.

This fixes the following error:

  TypeError: unsupported operand type(s) for -: 'NoneType' and 'int'
  Traceback (most recent call last):
    File "/usr/sbin/re6stnet", line 438, in main
      tunnel_manager.handleTunnelEvent(read_pipe.readline())
    File "/usr/lib/python2.7/dist-packages/re6st/tunnel.py", line 389, in handleTunnelEvent
      m(*args)
    File "/usr/lib/python2.7/dist-packages/re6st/tunnel.py", line 412, in _ovpn_route_up
      self._connection_dict[prefix].connected()
    File "/usr/lib/python2.7/dist-packages/re6st/tunnel.py", line 76, in connected
      i = self._retry - 1

What happened is probably that a route_up notification was received just before
killing/recreating the connection for the same node, and then process twice
the same OpenVPN notification: in this case, the first was for a previous
connection and should have been ignored.

We'll have to revive UDP because we experienced congestion with TCP.
This should make UDP efficient in good environment.
MTU discovery is required however to enable UDP by default.

This fixes up commit e3781aff
(Reduce probability of dying when the system lacks memory").

- new -V/--version command line option
- protocol extended to get the version of any node in the network,
  which will allow to track those running an old version of re6st

It's already in 're6stnet_subnet' and it's useful to bind to 're6stnet_ip'
without having to edit it first.

256 * (1 - (1-42/256.)**(15/4.)) ≈ 125
where:
- 42 is default rtt-decay
- 4 is default hello in babeld
- 15 is default hello in re6st

This makes sure re6st does not stop working because a connection is stuck.

Also accepts packets from loopback.

It's normal such failure happens occasionally and re6st retries later so:
- do not frighten user/admin with 500 status and ssl errors
- do not waste resources by killing session with registry

This prevents re6stnet from killing tunnels prematurely.

Current implementation is too aggressive and after some time, babeld stops
working properly, with log full of:

  setsockopt(IPV6_JOIN_GROUP): Cannot allocate memory
  setsockopt(IPV6_LEAVE_GROUP): Cannot assign requested address

Some servers can only be accessed via their re6st IP. re6st itself uses little
memory so it should not die when it fails to fork.

This is a workaround waiting that we have better criteria to select tunnels
to create or destroy.

UDP protocol is useless if nothing is done to prevent fragmentation.
Otherwise, it is at best unefficient.

There exist routers on the internet that filter fragmented packets with specific
data. This is hard to debug because TCP connections hang randomly when there is
no OpenVPN encryption.

Now, only TCP is enabled by default. A second protocol should be there for
better performance when possible, either existing UDP one (provided it is
guaranteed there is no fragmentation) or something better (GRE ?).