From: Sergey Matveev <stargrave@stargrave.org>
Date: Sun, 13 Mar 2016 08:55:54 +0000 (+0300)
Subject: Merge branch 'develop'
X-Git-Tag: 5.7^0
X-Git-Url: http://www.git.cypherpunks.ru/?p=govpn.git;a=commitdiff_plain;h=cee89cfdfbc6b2b429d56f0b420bc5b981e475b8;hp=124b8310c8fa341a8309ec71a295a7a0fb057950

Merge branch 'develop'
---

diff --git a/VERSION b/VERSION
index 2df33d7..760606e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.6
+5.7
diff --git a/common.mk b/common.mk
index 0730f59..bd2f3a4 100644
--- a/common.mk
+++ b/common.mk
@@ -19,7 +19,7 @@ govpn-verifier:
 	GOPATH=$(GOPATH) go build -ldflags "$(LDFLAGS)" cypherpunks.ru/govpn/cmd/govpn-verifier
 
 bench:
-	GOPATH=$(GOPATH) go test -bench . cypherpunks.ru/govpn/...
+	GOPATH=$(GOPATH) go test -benchmem -bench . cypherpunks.ru/govpn/...
 
 clean:
 	rm -f govpn-client govpn-server govpn-verifier
diff --git a/doc/client.texi b/doc/client.texi
index 5b0ae2b..b6d8aab 100644
--- a/doc/client.texi
+++ b/doc/client.texi
@@ -51,8 +51,9 @@ Set @ref{CPR} in KiB/sec.
 Enable @ref{Encless, encryptionless mode}.
 
 @item -up
-Optional path to script that will be executed after connection is
-established. Interface name will be given to it as a first argument.
+Optional path to @ref{Scripts, script} that will be executed after
+connection is established. Interface name will be given to it as a first
+argument.
 
 @item -down
 Same as @option{-up} above, but it is executed when connection is lost,
@@ -66,8 +67,8 @@ solicitation:
 @verbatim
 client% cat > up.sh <<EOF
 #!/bin/sh
-dhclient $1
-rtsol $1
+dhclient $GOVPN_IFACE
+rtsol $GOVPN_IFACE
 EOF
 client% chmod +x up.sh
 @end verbatim
diff --git a/doc/download.texi b/doc/download.texi
index 7828870..aeab481 100644
--- a/doc/download.texi
+++ b/doc/download.texi
@@ -6,6 +6,10 @@ You can obtain releases source code prepared tarballs from the links below:
 @multitable {XXXXX} {XXXX KiB} {link sign} {xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}
 @headitem Version @tab Size @tab Tarball @tab SHA256 checksum
 
+@item @ref{Release 5.6, 5.6} @tab 311 KiB
+@tab @url{download/govpn-5.6.tar.xz, link} @url{download/govpn-5.6.tar.xz.sig, sign}
+@tab @code{d46b8f742f1e2bf17236868512f1ea5ad80f59c3bac753a56ce41a1f465282a8}
+
 @item @ref{Release 5.5, 5.5} @tab 310 KiB
 @tab @url{download/govpn-5.5.tar.xz, link} @url{download/govpn-5.5.tar.xz.sig, sign}
 @tab @code{2f32e02c34a13eae538be7b44c11e16a8e68c43afc8e4a3071172f9c52b861d8}
diff --git a/doc/glossary.texi b/doc/glossary.texi
index fd865cd..8fed167 100644
--- a/doc/glossary.texi
+++ b/doc/glossary.texi
@@ -8,6 +8,7 @@
 * Timeout::
 * Time synchronization: Timesync.
 * Network transport: Network.
+* Scripts::
 * Proxy::
 * Maximum Transmission Unit: MTU.
 * Statistics: Stats.
@@ -23,6 +24,7 @@
 @include timeout.texi
 @include timesync.texi
 @include netproto.texi
+@include scripts.texi
 @include proxy.texi
 @include mtu.texi
 @include stats.texi
diff --git a/doc/news.ru.texi b/doc/news.ru.texi
index 15219a6..362ada0 100644
--- a/doc/news.ru.texi
+++ b/doc/news.ru.texi
@@ -1,6 +1,14 @@
 @node Новости
 @section Новости
 
+@node Релиз 5.7
+@subsection Релиз 5.7
+@itemize
+@item Имя TAP интерфейса и адрес удалённой стороны теперь передаются в
+up- и down- скрипты через переменные окружения.
+@item Argon2 библиотека обновлена чтобы использовать 1.3 версию алгоритма.
+@end itemize
+
 @node Релиз 5.6
 @subsection Релиз 5.6
 @itemize
diff --git a/doc/news.texi b/doc/news.texi
index 99edbe6..1956730 100644
--- a/doc/news.texi
+++ b/doc/news.texi
@@ -3,6 +3,14 @@
 
 See also this page @ref{Новости, on russian}.
 
+@node Release 5.7
+@section Release 5.7
+@itemize
+@item TAP interface name and remote peer's address are passed to up- and
+down- scripts through environment variables.
+@item Update Argon2 library to use version 1.3 of the algorithm.
+@end itemize
+
 @node Release 5.6
 @section Release 5.6
 @itemize
diff --git a/doc/scripts.texi b/doc/scripts.texi
new file mode 100644
index 0000000..7b2e3c0
--- /dev/null
+++ b/doc/scripts.texi
@@ -0,0 +1,17 @@
+@node Scripts
+@subsection Scripts
+
+Up- and down- scripts used as a hook executed when connection is either
+established or lost. Following environment variables are set during
+their execution:
+
+@table @code
+
+@item GOVPN_REMOTE
+Remote peer's address. In client mode it is server's address.
+
+@item GOVPN_IFACE
+TAP interface name. In server mode this can be empty: that means that
+script must output its name as the first line to stdout.
+
+@end table
diff --git a/doc/server.texi b/doc/server.texi
index 1784a9b..b3c641e 100644
--- a/doc/server.texi
+++ b/doc/server.texi
@@ -40,13 +40,13 @@ stargrave: {                        <-- Peer human readable name
 
 At least one of either @code{iface} or @code{up} must be specified. If
 you specify @code{iface}, then it will be forcefully used to determine
-what TAP interface will be used. If it is not specified, then up-script
-must output interface's name to stdout (first output line).
+what TAP interface will be used. If it is not specified, then
+up-@ref{Scripts, script} must output interface's name to stdout
+(first output line).
 
 For example up-script can be just @code{echo tap10}, or more advanced
 like the following one:
 
-
 @verbatim
 #!/bin/sh
 $tap=$(ifconfig tap create)
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
index 10da969..58d5ce7 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
@@ -21,6 +21,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log"
 	"net"
 	"os"
@@ -48,6 +49,7 @@ var (
 	encless     = flag.Bool("encless", false, "Encryptionless mode")
 	cpr         = flag.Int("cpr", 0, "Enable constant KiB/sec out traffic rate")
 	egdPath     = flag.String("egd", "", "Optional path to EGD socket")
+	warranty    = flag.Bool("warranty", false, "Print warranty information")
 
 	conf        *govpn.PeerConf
 	tap         *govpn.TAP
@@ -59,6 +61,10 @@ var (
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	timeout = *timeoutP
 	var err error
 	log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile)
@@ -156,5 +162,5 @@ MainCycle:
 		close(rehandshaking)
 		close(termination)
 	}
-	govpn.ScriptCall(*downPath, *ifaceName)
+	govpn.ScriptCall(*downPath, *ifaceName, *remoteAddr)
 }
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
index dd35364..4b11eac 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
@@ -83,7 +83,7 @@ HandshakeCycle:
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
index c70cf46..acacbd1 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
@@ -89,7 +89,7 @@ MainCycle:
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
index eac8a98..f7435dd 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
@@ -66,10 +66,10 @@ Processor:
 	heartbeat.Stop()
 }
 
-func callUp(peerId *govpn.PeerId) (string, error) {
+func callUp(peerId *govpn.PeerId, remoteAddr string) (string, error) {
 	ifaceName := confs[*peerId].Iface
 	if confs[*peerId].Up != "" {
-		result, err := govpn.ScriptCall(confs[*peerId].Up, "")
+		result, err := govpn.ScriptCall(confs[*peerId].Up, ifaceName, remoteAddr)
 		if err != nil {
 			log.Println("Script", confs[*peerId].Up, "call failed", err)
 			return "", err
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
index 886b8a8..606caf0 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
@@ -21,6 +21,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log"
 	"net"
 	"os"
@@ -37,10 +38,15 @@ var (
 	stats    = flag.String("stats", "", "Enable stats retrieving on host:port")
 	proxy    = flag.String("proxy", "", "Enable HTTP proxy on host:port")
 	egdPath  = flag.String("egd", "", "Optional path to EGD socket")
+	warranty = flag.Bool("warranty", false, "Print warranty information")
 )
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	timeout := time.Second * time.Duration(govpn.TimeoutDefault)
 	log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile)
 	log.Println(govpn.VersionGet())
@@ -89,6 +95,14 @@ MainCycle:
 	for {
 		select {
 		case <-termSignal:
+			log.Println("Terminating")
+			for _, ps := range peers {
+				govpn.ScriptCall(
+					confs[*ps.peer.Id].Down,
+					ps.tap.Name,
+					ps.peer.Addr,
+				)
+			}
 			break MainCycle
 		case <-hsHeartbeat:
 			now := time.Now()
@@ -115,6 +129,7 @@ MainCycle:
 					go govpn.ScriptCall(
 						confs[*ps.peer.Id].Down,
 						ps.tap.Name,
+						ps.peer.Addr,
 					)
 					ps.terminator <- struct{}{}
 				}
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
index 417fcb1..6ca6967 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
@@ -115,7 +115,7 @@ func handleTCP(conn net.Conn) {
 			kpLock.Unlock()
 			log.Println("Rehandshake processed:", peer.Id.String())
 		} else {
-			ifaceName, err := callUp(peer.Id)
+			ifaceName, err := callUp(peer.Id, peer.Addr)
 			if err != nil {
 				peer = nil
 				break
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
index 73f4d6f..d9197cf 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
@@ -135,7 +135,7 @@ func startUDP() {
 				log.Println("Rehandshake processed:", peer.Id.String())
 			} else {
 				go func(addr string, peer *govpn.Peer) {
-					ifaceName, err := callUp(peer.Id)
+					ifaceName, err := callUp(peer.Id, peer.Addr)
 					if err != nil {
 						return
 					}
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
index 5d59580..bdea079 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
@@ -35,10 +35,15 @@ var (
 	tOpt     = flag.Int("t", govpn.DefaultT, "Argon2d iteration parameter")
 	pOpt     = flag.Int("p", govpn.DefaultP, "Argon2d parallelizm parameter")
 	egdPath  = flag.String("egd", "", "Optional path to EGD socket")
+	warranty = flag.Bool("warranty", false, "Print warranty information")
 )
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	if *egdPath != "" {
 		govpn.EGDInit(*egdPath)
 	}
diff --git a/src/cypherpunks.ru/govpn/common.go b/src/cypherpunks.ru/govpn/common.go
index d3f8ec0..98137c1 100644
--- a/src/cypherpunks.ru/govpn/common.go
+++ b/src/cypherpunks.ru/govpn/common.go
@@ -28,8 +28,11 @@ import (
 const (
 	TimeoutDefault = 60
 	EtherSize      = 14
-	MTUMax         = 9000 + EtherSize
-	MTUDefault     = 1500 + EtherSize
+	MTUMax         = 9000 + EtherSize + 1
+	MTUDefault     = 1500 + EtherSize + 1
+
+	ENV_IFACE  = "GOVPN_IFACE"
+	ENV_REMOTE = "GOVPN_REMOTE"
 )
 
 var (
@@ -40,14 +43,17 @@ var (
 // You have to specify path to it and (inteface name as a rule) something
 // that will be the first argument when calling it. Function will return
 // it's output and possible error.
-func ScriptCall(path, ifaceName string) ([]byte, error) {
+func ScriptCall(path, ifaceName, remoteAddr string) ([]byte, error) {
 	if path == "" {
 		return nil, nil
 	}
 	if _, err := os.Stat(path); err != nil && os.IsNotExist(err) {
 		return nil, err
 	}
-	out, err := exec.Command(path, ifaceName).CombinedOutput()
+	cmd := exec.Command(path)
+	cmd.Env = append(cmd.Env, ENV_IFACE+"="+ifaceName)
+	cmd.Env = append(cmd.Env, ENV_REMOTE+"="+remoteAddr)
+	out, err := cmd.CombinedOutput()
 	if err != nil {
 		log.Println("Script error", path, err, string(out))
 	}
diff --git a/src/cypherpunks.ru/govpn/govpn.go b/src/cypherpunks.ru/govpn/govpn.go
index d65e72b..49a11cc 100644
--- a/src/cypherpunks.ru/govpn/govpn.go
+++ b/src/cypherpunks.ru/govpn/govpn.go
@@ -1,2 +1,17 @@
 // Simple secure, DPI/censorship-resistant free software VPN daemon.
 package govpn
+
+const (
+	Warranty = `This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.`
+)
diff --git a/src/github.com/go-yaml/yaml b/src/github.com/go-yaml/yaml
index f7716cb..a83829b 160000
--- a/src/github.com/go-yaml/yaml
+++ b/src/github.com/go-yaml/yaml
@@ -1 +1 @@
-Subproject commit f7716cbe52baa25d2e9b0d0da546fcf909fc16b4
+Subproject commit a83829b6f1293c91addabc89d0571c246397bbf4
diff --git a/src/github.com/magical/argon2 b/src/github.com/magical/argon2
index 82d59eb..190e3cf 160000
--- a/src/github.com/magical/argon2
+++ b/src/github.com/magical/argon2
@@ -1 +1 @@
-Subproject commit 82d59eb7dab9a6268371a8c6de2100a2c7357bc6
+Subproject commit 190e3cf208e185668db6aa048e4985b7b7b4d890
diff --git a/utils/addroute.sh b/utils/addroute.sh
index a8d85cd..e0ad70b 100755
--- a/utils/addroute.sh
+++ b/utils/addroute.sh
@@ -6,34 +6,34 @@
 # List of parameters passed through environment
 # - reason               -- why this script is called:
 #                           pre-init, connect, disconnect
-# - VPNGATEWAY           -- public address of vpn gateway
-# - TAPDEV               -- tap device
+# - GOVPN_REMOTE         -- public address of VPN gateway
+# - GOVPN_IFACE          -- tap device
 # - INTERNAL_IP4_ADDRESS -- e.g. 172.0.0.2/24
 # - INTERNAL_IP4_GATEWAY -- e.g. 172.0.0.1
 
 
 set_up_dev() {
-  ip tuntap add dev $TAPDEV mode tap
+  ip tuntap add dev $GOVPN_IFACE mode tap
 }
 
 
 tear_down_dev() {
-  ip tuntap del dev $TAPDEV mode tap
+  ip tuntap del dev $GOVPN_IFACE mode tap
 }
 
 
 do_connect() {
   local OLDGW=$(ip route show 0/0 | sed 's/^default//')
-  ip link set dev $TAPDEV up
-  ip addr add $INTERNAL_IP4_ADDRESS dev $TAPDEV
-  ip route add $VPNGATEWAY $OLDGW
-  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
-  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
+  ip link set dev $GOVPN_IFACE up
+  ip addr add $INTERNAL_IP4_ADDRESS dev $GOVPN_IFACE
+  ip route add $GOVPN_REMOTE $OLDGW
+  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
+  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
 }
 
 
 do_disconnect() {
-  ip route del $VPNGATEWAY
+  ip route del $GOVPN_REMOTE
 }