From f696080a3e32ba340cc4c5c70e39eb8e8857da89 Mon Sep 17 00:00:00 2001
From: Sergey Matveev <stargrave@stargrave.org>
Date: Mon, 7 Mar 2016 14:39:18 +0300
Subject: [PATCH] Pass parameters to scripts through environment variables

---
 VERSION                                       |  2 +-
 doc/client.texi                               |  9 +++++----
 doc/glossary.texi                             |  2 ++
 doc/news.ru.texi                              |  7 +++++++
 doc/news.texi                                 |  7 +++++++
 doc/scripts.texi                              | 17 ++++++++++++++++
 doc/server.texi                               |  6 +++---
 .../govpn/cmd/govpn-client/main.go            |  2 +-
 .../govpn/cmd/govpn-client/tcp.go             |  2 +-
 .../govpn/cmd/govpn-client/udp.go             |  2 +-
 .../govpn/cmd/govpn-server/common.go          |  4 ++--
 .../govpn/cmd/govpn-server/main.go            |  1 +
 .../govpn/cmd/govpn-server/tcp.go             |  2 +-
 .../govpn/cmd/govpn-server/udp.go             |  2 +-
 src/cypherpunks.ru/govpn/common.go            | 10 ++++++++--
 utils/addroute.sh                             | 20 +++++++++----------
 16 files changed, 68 insertions(+), 27 deletions(-)
 create mode 100644 doc/scripts.texi

diff --git a/VERSION b/VERSION
index 2df33d7..760606e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.6
+5.7
diff --git a/doc/client.texi b/doc/client.texi
index 5b0ae2b..b6d8aab 100644
--- a/doc/client.texi
+++ b/doc/client.texi
@@ -51,8 +51,9 @@ Set @ref{CPR} in KiB/sec.
 Enable @ref{Encless, encryptionless mode}.
 
 @item -up
-Optional path to script that will be executed after connection is
-established. Interface name will be given to it as a first argument.
+Optional path to @ref{Scripts, script} that will be executed after
+connection is established. Interface name will be given to it as a first
+argument.
 
 @item -down
 Same as @option{-up} above, but it is executed when connection is lost,
@@ -66,8 +67,8 @@ solicitation:
 @verbatim
 client% cat > up.sh <<EOF
 #!/bin/sh
-dhclient $1
-rtsol $1
+dhclient $GOVPN_IFACE
+rtsol $GOVPN_IFACE
 EOF
 client% chmod +x up.sh
 @end verbatim
diff --git a/doc/glossary.texi b/doc/glossary.texi
index fd865cd..8fed167 100644
--- a/doc/glossary.texi
+++ b/doc/glossary.texi
@@ -8,6 +8,7 @@
 * Timeout::
 * Time synchronization: Timesync.
 * Network transport: Network.
+* Scripts::
 * Proxy::
 * Maximum Transmission Unit: MTU.
 * Statistics: Stats.
@@ -23,6 +24,7 @@
 @include timeout.texi
 @include timesync.texi
 @include netproto.texi
+@include scripts.texi
 @include proxy.texi
 @include mtu.texi
 @include stats.texi
diff --git a/doc/news.ru.texi b/doc/news.ru.texi
index 15219a6..aee4aeb 100644
--- a/doc/news.ru.texi
+++ b/doc/news.ru.texi
@@ -1,6 +1,13 @@
 @node Новости
 @section Новости
 
+@node Релиз 5.7
+@subsection Релиз 5.7
+@itemize
+@item Имя TAP интерфейса и адрес удалённой стороны теперь передаются в
+up- и down- скрипты через переменные окружения.
+@end itemize
+
 @node Релиз 5.6
 @subsection Релиз 5.6
 @itemize
diff --git a/doc/news.texi b/doc/news.texi
index 99edbe6..c226c0c 100644
--- a/doc/news.texi
+++ b/doc/news.texi
@@ -3,6 +3,13 @@
 
 See also this page @ref{Новости, on russian}.
 
+@node Release 5.7
+@section Release 5.7
+@itemize
+@item TAP interface name and remote peer's address are passed to up- and
+down- scripts through environment variables.
+@end itemize
+
 @node Release 5.6
 @section Release 5.6
 @itemize
diff --git a/doc/scripts.texi b/doc/scripts.texi
new file mode 100644
index 0000000..7b2e3c0
--- /dev/null
+++ b/doc/scripts.texi
@@ -0,0 +1,17 @@
+@node Scripts
+@subsection Scripts
+
+Up- and down- scripts used as a hook executed when connection is either
+established or lost. Following environment variables are set during
+their execution:
+
+@table @code
+
+@item GOVPN_REMOTE
+Remote peer's address. In client mode it is server's address.
+
+@item GOVPN_IFACE
+TAP interface name. In server mode this can be empty: that means that
+script must output its name as the first line to stdout.
+
+@end table
diff --git a/doc/server.texi b/doc/server.texi
index 1784a9b..b3c641e 100644
--- a/doc/server.texi
+++ b/doc/server.texi
@@ -40,13 +40,13 @@ stargrave: {                        <-- Peer human readable name
 
 At least one of either @code{iface} or @code{up} must be specified. If
 you specify @code{iface}, then it will be forcefully used to determine
-what TAP interface will be used. If it is not specified, then up-script
-must output interface's name to stdout (first output line).
+what TAP interface will be used. If it is not specified, then
+up-@ref{Scripts, script} must output interface's name to stdout
+(first output line).
 
 For example up-script can be just @code{echo tap10}, or more advanced
 like the following one:
 
-
 @verbatim
 #!/bin/sh
 $tap=$(ifconfig tap create)
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
index 10da969..032a288 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
@@ -156,5 +156,5 @@ MainCycle:
 		close(rehandshaking)
 		close(termination)
 	}
-	govpn.ScriptCall(*downPath, *ifaceName)
+	govpn.ScriptCall(*downPath, *ifaceName, *remoteAddr)
 }
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
index dd35364..4b11eac 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
@@ -83,7 +83,7 @@ HandshakeCycle:
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
index c70cf46..acacbd1 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
@@ -89,7 +89,7 @@ MainCycle:
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
index eac8a98..f7435dd 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
@@ -66,10 +66,10 @@ Processor:
 	heartbeat.Stop()
 }
 
-func callUp(peerId *govpn.PeerId) (string, error) {
+func callUp(peerId *govpn.PeerId, remoteAddr string) (string, error) {
 	ifaceName := confs[*peerId].Iface
 	if confs[*peerId].Up != "" {
-		result, err := govpn.ScriptCall(confs[*peerId].Up, "")
+		result, err := govpn.ScriptCall(confs[*peerId].Up, ifaceName, remoteAddr)
 		if err != nil {
 			log.Println("Script", confs[*peerId].Up, "call failed", err)
 			return "", err
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
index 886b8a8..0c385c7 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
@@ -115,6 +115,7 @@ MainCycle:
 					go govpn.ScriptCall(
 						confs[*ps.peer.Id].Down,
 						ps.tap.Name,
+						ps.peer.Addr,
 					)
 					ps.terminator <- struct{}{}
 				}
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
index 417fcb1..6ca6967 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
@@ -115,7 +115,7 @@ func handleTCP(conn net.Conn) {
 			kpLock.Unlock()
 			log.Println("Rehandshake processed:", peer.Id.String())
 		} else {
-			ifaceName, err := callUp(peer.Id)
+			ifaceName, err := callUp(peer.Id, peer.Addr)
 			if err != nil {
 				peer = nil
 				break
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
index 73f4d6f..d9197cf 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
@@ -135,7 +135,7 @@ func startUDP() {
 				log.Println("Rehandshake processed:", peer.Id.String())
 			} else {
 				go func(addr string, peer *govpn.Peer) {
-					ifaceName, err := callUp(peer.Id)
+					ifaceName, err := callUp(peer.Id, peer.Addr)
 					if err != nil {
 						return
 					}
diff --git a/src/cypherpunks.ru/govpn/common.go b/src/cypherpunks.ru/govpn/common.go
index dc7fbe0..98137c1 100644
--- a/src/cypherpunks.ru/govpn/common.go
+++ b/src/cypherpunks.ru/govpn/common.go
@@ -30,6 +30,9 @@ const (
 	EtherSize      = 14
 	MTUMax         = 9000 + EtherSize + 1
 	MTUDefault     = 1500 + EtherSize + 1
+
+	ENV_IFACE  = "GOVPN_IFACE"
+	ENV_REMOTE = "GOVPN_REMOTE"
 )
 
 var (
@@ -40,14 +43,17 @@ var (
 // You have to specify path to it and (inteface name as a rule) something
 // that will be the first argument when calling it. Function will return
 // it's output and possible error.
-func ScriptCall(path, ifaceName string) ([]byte, error) {
+func ScriptCall(path, ifaceName, remoteAddr string) ([]byte, error) {
 	if path == "" {
 		return nil, nil
 	}
 	if _, err := os.Stat(path); err != nil && os.IsNotExist(err) {
 		return nil, err
 	}
-	out, err := exec.Command(path, ifaceName).CombinedOutput()
+	cmd := exec.Command(path)
+	cmd.Env = append(cmd.Env, ENV_IFACE+"="+ifaceName)
+	cmd.Env = append(cmd.Env, ENV_REMOTE+"="+remoteAddr)
+	out, err := cmd.CombinedOutput()
 	if err != nil {
 		log.Println("Script error", path, err, string(out))
 	}
diff --git a/utils/addroute.sh b/utils/addroute.sh
index a8d85cd..e0ad70b 100755
--- a/utils/addroute.sh
+++ b/utils/addroute.sh
@@ -6,34 +6,34 @@
 # List of parameters passed through environment
 # - reason               -- why this script is called:
 #                           pre-init, connect, disconnect
-# - VPNGATEWAY           -- public address of vpn gateway
-# - TAPDEV               -- tap device
+# - GOVPN_REMOTE         -- public address of VPN gateway
+# - GOVPN_IFACE          -- tap device
 # - INTERNAL_IP4_ADDRESS -- e.g. 172.0.0.2/24
 # - INTERNAL_IP4_GATEWAY -- e.g. 172.0.0.1
 
 
 set_up_dev() {
-  ip tuntap add dev $TAPDEV mode tap
+  ip tuntap add dev $GOVPN_IFACE mode tap
 }
 
 
 tear_down_dev() {
-  ip tuntap del dev $TAPDEV mode tap
+  ip tuntap del dev $GOVPN_IFACE mode tap
 }
 
 
 do_connect() {
   local OLDGW=$(ip route show 0/0 | sed 's/^default//')
-  ip link set dev $TAPDEV up
-  ip addr add $INTERNAL_IP4_ADDRESS dev $TAPDEV
-  ip route add $VPNGATEWAY $OLDGW
-  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
-  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
+  ip link set dev $GOVPN_IFACE up
+  ip addr add $INTERNAL_IP4_ADDRESS dev $GOVPN_IFACE
+  ip route add $GOVPN_REMOTE $OLDGW
+  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
+  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
 }
 
 
 do_disconnect() {
-  ip route del $VPNGATEWAY
+  ip route del $GOVPN_REMOTE
 }
 
 
-- 
2.44.0