Update README.md

Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>

README.md

@@ -1,54 +1,112 @@
 # Glorytun
 
-Small, Simple and Stupid VPN over [mud](https://github.com/angt/mud).
+Glorytun is a small, simple and secure VPN over [mud](https://github.com/angt/mud).
+It runs on Linux, OpenBSD, FreeBSD and MacOS.
 
-### Build and Install
+## Features
+
+The key features of Glorytun come directly from mud:
+
+ * **Fast and highly secure**
+
+   The use of UDP and [libsodium](https://github.com/jedisct1/libsodium) allows you to secure
+   your communications without impacting performance.
+   Glorytun uses AES only if AES-NI is available otherwise ChaCha20 is used.
+   You can force the use of ChaCha20 for higher security.
+   All messages are encrypted, authenticated and marked with a timestamp.
+   Perfect forward secrecy is also implemented with ECDH over Curve25519.
+
+ * **Multipath and active failover**
+
+   This is the main feature of Glorytun that allows to build an SD-WAN like service.
+   This allows a TCP connection to explore and exploit multiple links without being disconnected.
+
+ * **Path MTU discovery without ICMP**
+
+   Bad MTU configuration is a very common problem in the world of VPN.
+   As it is critical, Glorytun will try to setup it correctly by guessing its value.
+   It doesn't rely on ICMP Next-hop MTU to avoid black holes.
+
+## Build and Install
 
 Glorytun depends on [libsodium](https://github.com/jedisct1/libsodium) version >= 1.0.4.
+We recommend the use of [meson](http://mesonbuild.com) for building instead of
+the more classical autotools suite (also available for old systems).
 
-On Ubuntu, the following command should be sufficient:
+On Ubuntu, the following command should be sufficient to get all the necessary build dependencies:
 
     $ sudo apt-get install meson libsodium-dev pkg-config
 
-Grab the latest release from github:
+To build and install the latest release from github:
 
     $ git clone https://github.com/angt/glorytun --recursive
-    $ cd glorytun
+    $ meson glorytun glorytun/build
+    $ sudo ninja -C glorytun/build install
 
-To build and install the latest version with [meson](http://mesonbuild.com):
+This will install all binaries in `/usr/local/bin` by default.
 
-    $ meson build
+You can easily customize your setup with meson (see `meson help`).
-    $ sudo ninja -C build install
 
-The more classical autotools suite is also available.
+## Usage
 
-### Easy setup with systemd
+Just run `glorytun` with no arguments to view the list of available commands:
 
-Just call `glorytun-setup` and follow the instructions.
+```
+$ glorytun
+available commands:
 
-First, setup the server:
+  show     show all running tunnels
+  bench    start a crypto bench
+  bind     start a new tunnel
+  set      change tunnel properties
+  keygen   generate a new secret key
+  path     manage paths
+  version  show version
 
-    $ sudo glorytun-setup
+```
-    Config filename (tun0):
-    Server ip (enter for server conf):
-    Bind to port (5000):
-    Server key (enter to generate a new one):
-    Your new key: NEW_KEY
-    Start glorytun now ? (enter to skip): y
 
-Copy the new generated key and use it when configuring the client:
+Use the keyword `help` after a command to show its usage.
 
-    $ sudo glorytun-setup
+## Mini HowTo
-    Config filename (tun0):
-    Server ip (enter for server conf): SERVER_IP
-    Server port (5000):
-    Server key (enter to generate a new one): NEW_KEY
-    Start glorytun now ? (enter to skip): y
 
-You can check easily if it works by looking at your public ip.
+Glorytun does not touch the configuration of its network interface (except for the MTU),
-To stop the service:
+It is up to the user to do it according to the tools available
+on his system (systemd-networkd, netifd, ...).
+This also allows a wide variety of configurations.
 
-    $ sudo systemctl stop glorytun@tun0
+To start a server:
+
+    # (umask 066; glorytun keygen > my_secret_key)
+    # glorytun bind 0.0.0.0 keyfile my_secret_key &
+
+You should now have an unconfigured network interface (let's say `tun0`).
+For exemple, the simplest setup with `ifconfig`:
+
+    # ifconfig tun0 10.0.1.1 pointopoint 10.0.1.2 up
+
+To check if the server is running, simply call `glorytun show`.
+It will show you all the running tunnels.
+
+To start a new client, you need to get the secret key generated for the server.
+Then simply call:
+
+    # glorytun bind 0.0.0.0 to SERVER_IP keyfile my_secret_key &
+    # ifconfig tun0 10.0.1.2 pointopoint 10.0.1.1 up
+
+Here the tricky part... You need to specify your paths or glorytun will not send anything, it's easy:
+
+    # glorytun path LOCAL_IPADDR up
+
+Again, to check if your path is working, you can watch its status with `glorytun path`.
+You should now be able to ping your server with `ping 10.0.1.1`.
+
+If you have systemd-networkd, you can use the helper program `glorytun-setup`.
+
+## Thanks
+
+ * @jedisct1 for all his help and the code for MacOS/BSD.
+ * The team OTB (@bessa, @gregdel, @pouulet, @sduponch and @simon) for all tests and discussions.
+ * OVH
 
 ---
 

configure.ac

@@ -4,7 +4,6 @@ AC_INIT([glorytun],
         [https://github.com/angt/glorytun/issues],
         [glorytun],
         [https://github.com/angt/glorytun])
-AC_DEFINE_UNQUOTED([VERSION_MAJOR], [m4_esyscmd([./version.sh major])])
 AC_CONFIG_SRCDIR([src/common.h])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_MACRO_DIR([m4])

src/bind.c

@@ -94,8 +94,6 @@ gt_setup_mtu(struct mud *mud, const char *tun_name)
     if (mtu == oldmtu)
         return mtu;
 
-    gt_log("setup MTU to %zu on interface %s\n", mtu, tun_name);
-
     if (iface_set_mtu(tun_name, mtu) == -1)
         perror("tun_set_mtu");
 
@@ -113,8 +111,6 @@ gt_bind(int argc, char **argv)
     unsigned short peer_port = bind_port;
     const char *dev = NULL;
     const char *keyfile = NULL;
-    size_t bufsize = 64 * 1024 * 1024;
-    size_t mtu = 1330;
 
     struct argz toz[] = {
         {NULL, "IPADDR", &peer_addr, argz_addr},
@@ -126,19 +122,23 @@ gt_bind(int argc, char **argv)
         {NULL, "PORT", &bind_port, argz_ushort},
         {"to", NULL, &toz, argz_option},
         {"dev", "NAME", &dev, argz_str},
-        {"mtu", "BYTES", &mtu, argz_bytes},
         {"keyfile", "FILE", &keyfile, argz_str},
         {"chacha", NULL, NULL, argz_option},
         {"persist", NULL, NULL, argz_option},
-        {"bufsize", "BYTES", &bufsize, argz_bytes},
         {NULL}};
 
     if (argz(bindz, argc, argv))
         return 1;
 
+    if (str_empty(keyfile)) {
+        gt_log("a keyfile is needed!\n");
+        return 1;
+    }
+
     gt_set_port((struct sockaddr *)&bind_addr, bind_port);
     gt_set_port((struct sockaddr *)&peer_addr, peer_port);
 
+    const size_t bufsize = 4096U;
     unsigned char *buf = malloc(bufsize);
 
     if (!buf) {
@@ -156,31 +156,23 @@ gt_bind(int argc, char **argv)
         return 1;
     }
 
-    if (str_empty(keyfile)) {
+    if (gt_setup_secretkey(mud, keyfile))
-        if (mud_set_key(mud, NULL, 0)) {
+        return 1;
-            gt_log("couldn't generate a new key\n");
-            return 1;
-        }
-    } else {
-        if (gt_setup_secretkey(mud, keyfile))
-            return 1;
-    }
 
     if (!chacha && mud_set_aes(mud)) {
-        gt_log("AES is not available\n");
+        gt_log("AES is not available, enjoy ChaCha20!\n");
         chacha = 1;
     }
 
     char tun_name[64];
-    int tun_fd = tun_create(tun_name, sizeof(tun_name) - 1, dev);
+    const int tun_fd = tun_create(tun_name, sizeof(tun_name) - 1, dev);
 
     if (tun_fd == -1) {
         gt_log("couldn't create tun device\n");
         return 1;
     }
 
-    mud_set_mtu(mud, mtu);
+    size_t mtu = gt_setup_mtu(mud, tun_name);
-    mtu = gt_setup_mtu(mud, tun_name);
 
     if (tun_set_persist(tun_fd, persist) == -1)
         perror("tun_set_persist");
@@ -192,25 +184,27 @@ gt_bind(int argc, char **argv)
         }
     }
 
-    int ctl_fd = ctl_create(GT_RUNDIR, tun_name);
+    const int ctl_fd = ctl_create(GT_RUNDIR, tun_name);
 
     if (ctl_fd == -1) {
         perror("ctl_create");
         return 1;
     }
 
-    int mud_fd = mud_get_fd(mud);
+    const int mud_fd = mud_get_fd(mud);
 
     fd_set_nonblock(tun_fd);
     fd_set_nonblock(mud_fd);
     fd_set_nonblock(ctl_fd);
 
-    gt_log("running...\n");
+    const long pid = (long)getpid();
+
+    gt_log("running on device %s as pid %li\n", tun_name, pid);
 
     fd_set rfds;
     FD_ZERO(&rfds);
 
-    int last_fd = 1 + MAX(tun_fd, MAX(mud_fd, ctl_fd));
+    const int last_fd = 1 + MAX(tun_fd, MAX(mud_fd, ctl_fd));
 
     while (!gt_quit) {
         FD_SET(tun_fd, &rfds);
@@ -289,6 +283,7 @@ gt_bind(int argc, char **argv)
                         res.ret = errno;
                     break;
                 case CTL_STATUS:
+                    res.status.pid = pid;
                     res.status.mtu = mtu;
                     res.status.chacha = chacha;
                     res.status.bind = bind_addr;
@@ -312,11 +307,8 @@ gt_bind(int argc, char **argv)
                     perror("tun_read");
             } else if ((!ip_get_common(&ic, buf, r)) &&
                        (mud_send(mud, buf, r, ic.tc) == -1)) {
-                if (errno == EMSGSIZE) {
+                if (errno != EAGAIN)
-                    mtu = gt_setup_mtu(mud, tun_name);
-                } else if (errno != EAGAIN) {
                     perror("mud_send");
-                }
             }
         }
 

src/ctl.c

@@ -153,8 +153,8 @@ ctl_connect(const char *dir, const char *file)
                 continue;
 
             if (file) {
-                file = NULL;
+                closedir(dp);
-                break;
+                return -3;
             }
 
             file = &d->d_name[0];
@@ -162,8 +162,7 @@ ctl_connect(const char *dir, const char *file)
 
         if (!file) {
             closedir(dp);
-            errno = ENOENT;
+            return -2;
-            return -1;
         }
     }
 

src/ctl.h

@@ -26,6 +26,7 @@ struct ctl_msg {
         } path;
         struct mud_path path_status;
         struct {
+            long pid;
             size_t mtu;
             int chacha;
             struct sockaddr_storage bind;

src/main.c

@@ -69,15 +69,14 @@ main(int argc, char **argv)
         {"version", "show version", gt_version},
         {NULL}};
 
-    if (argc < 2)
+    if (argv[1]) {
-        return gt_show(argc, argv);
+        for (int k = 0; cmd[k].name; k++) {
-
+            if (!str_cmp(cmd[k].name, argv[1]))
-    for (int k = 0; cmd[k].name; k++) {
+                return cmd[k].call(argc - 1, argv + 1);
-        if (!str_cmp(cmd[k].name, argv[1]))
+        }
-            return cmd[k].call(argc - 1, argv + 1);
     }
 
-    printf("unknown command `%s', available commands:\n\n", argv[1]);
+    printf("available commands:\n\n");
 
     int len = 0;
 

src/path.c

@@ -48,11 +48,16 @@ gt_path_status(int fd)
         }
 
         printf("path %s\n"
-               "  bind:   %s port %"PRIu16"\n"
+               "  bind:     %s port %"PRIu16"\n"
-               "  public: %s port %"PRIu16"\n"
+               "  public:   %s port %"PRIu16"\n"
-               "  peer:   %s port %"PRIu16"\n"
+               "  peer:     %s port %"PRIu16"\n"
-               "  mtu:    %zu bytes\n"
+               "  mtu:      %zu bytes\n"
-               "  rtt:    %.3f ms\n",
+               "  rtt:      %.3f ms\n"
+               "  rttvar:   %.3f ms\n"
+               "  upload:   %"PRIu64" bytes/s (max: %"PRIu64")\n"
+               "  download: %"PRIu64" bytes/s (max: %"PRIu64")\n"
+               "  output:   %"PRIu64" packets\n"
+               "  input:    %"PRIu64" packets\n",
                statestr,
                bindstr[0] ? bindstr : "-",
                gt_get_port((struct sockaddr *)&res.path_status.local_addr),
@@ -60,8 +65,15 @@ gt_path_status(int fd)
                gt_get_port((struct sockaddr *)&res.path_status.r_addr),
                peerstr[0] ? peerstr : "-",
                gt_get_port((struct sockaddr *)&res.path_status.addr),
-               res.path_status.mtu.ok + 28U,     /* ip+udp hdr */
+               res.path_status.mtu.ok,
-               res.path_status.rtt/(double)1e3);
+               res.path_status.rtt/(double)1e3,
+               res.path_status.rttvar/(double)1e3,
+               res.path_status.r_rate,
+               res.path_status.r_ratemax,
+               res.path_status.recv.rate,
+               res.path_status.recv.ratemax,
+               res.path_status.send.total,
+               res.path_status.recv.total);
     } while (res.ret == EAGAIN);
 
     return 0;
@@ -87,9 +99,20 @@ gt_path(int argc, char **argv)
 
     int fd = ctl_connect(GT_RUNDIR, dev);
 
-    if (fd == -1) {
+    if (fd < 0) {
-        perror("path");
+        switch (fd) {
-        ctl_delete(fd);
+        case -1:
+            perror("path");
+            break;
+        case -2:
+            gt_log("no device\n");
+            break;
+        case -3:
+            gt_log("please choose a device\n");
+            break;
+        default:
+            gt_log("couldn't connect\n");
+        }
         return 1;
     }
 

src/set.c

@@ -149,8 +149,20 @@ gt_set(int argc, char **argv)
 
     int fd = ctl_connect(GT_RUNDIR, dev);
 
-    if (fd == -1) {
+    if (fd < 0) {
-        perror("set");
+        switch (fd) {
+        case -1:
+            perror("set");
+            break;
+        case -2:
+            gt_log("no device\n");
+            break;
+        case -3:
+            gt_log("please choose a device\n");
+            break;
+        default:
+            gt_log("couldn't connect\n");
+        }
         return 1;
     }
 

src/show.c

@@ -29,21 +29,25 @@ gt_show_dev_status(int fd, const char *dev)
 
     if (server) {
         printf("server %s:\n"
+               "  pid:       %li\n"
                "  bind:      %s port %"PRIu16"\n"
                "  mtu:       %zu\n"
                "  cipher:    %s\n",
                dev,
+               res.status.pid,
                bindstr[0] ? bindstr : "-",
                gt_get_port((struct sockaddr *)&res.status.bind),
                res.status.mtu,
                res.status.chacha ? "chacha20poly1305" : "aes256gcm");
     } else {
         printf("client %s:\n"
+               "  pid:       %li\n"
                "  bind:      %s port %"PRIu16"\n"
                "  peer:      %s port %"PRIu16"\n"
                "  mtu:       %zu\n"
                "  cipher:    %s\n",
                dev,
+               res.status.pid,
                bindstr[0] ? bindstr : "-",
                gt_get_port((struct sockaddr *)&res.status.bind),
                peerstr[0] ? peerstr : "-",
@@ -60,8 +64,9 @@ gt_show_dev(const char *dev)
 {
     int fd = ctl_connect(GT_RUNDIR, dev);
 
-    if (fd == -1) {
+    if (fd < 0) {
-        perror(dev);
+        if (fd == -1)
+            perror("show");
         return -1;
     }
 

version.sh

@@ -1,13 +1,12 @@
 #!/bin/sh
 
-[ -z "${VERSION}" ] && VERSION=`git describe --tags --match='v[0-9].*' 2>/dev/null` \
+[ -z "${VERSION}" ] && VERSION="$(git describe --tags --match='v[0-9].*' 2>/dev/null)" \
-                    && VERSION=${VERSION#v}
+                    && VERSION="${VERSION#v}"
 
-[ -z "${VERSION}" ] && VERSION=`cat VERSION 2>/dev/null`
+[ -z "${VERSION}" ] && VERSION="$(git rev-parse HEAD 2>/dev/null)"
 
-[ -z "${VERSION}" ] && VERSION=0.0.0
+[ -z "${VERSION}" ] && VERSION="$(cat VERSION 2>/dev/null)"
 
-[ "$1" = "major"  ] && printf ${VERSION%%.*} \
+[ -z "${VERSION}" ] && VERSION="0.0.0"
-                    && exit 0
 
-printf ${VERSION} | tee VERSION
+printf "%s" "${VERSION}" | tee VERSION