VERSION                                             |  2 +-
 common.mk                                           |  2 +-
 doc/client.texi                                     |  9 +++++----
 doc/download.texi                                   |  4 ++++
 doc/glossary.texi                                   |  2 ++
 doc/news.ru.texi                                    |  8 ++++++++
 doc/news.texi                                       |  8 ++++++++
 doc/scripts.texi                                    | 17 +++++++++++++++++
 doc/server.texi                                     |  6 +++---
 src/cypherpunks.ru/govpn/cmd/govpn-client/main.go   |  8 +++++++-
 src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go    |  2 +-
 src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go    |  2 +-
 src/cypherpunks.ru/govpn/cmd/govpn-server/common.go |  4 ++--
 src/cypherpunks.ru/govpn/cmd/govpn-server/main.go   | 15 +++++++++++++++
 src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go    |  2 +-
 src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go    |  2 +-
 src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go |  5 +++++
 src/cypherpunks.ru/govpn/common.go                  | 14 ++++++++++----
 src/cypherpunks.ru/govpn/govpn.go                   | 15 +++++++++++++++
 utils/addroute.sh                                   | 20 ++++++++++----------

diff --git a/VERSION b/VERSION
index 2df33d76977064e686bccc1b213c1c9186354aba..760606e1ffff82566e95fa1bfa840ca7d1024dd5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.6
+5.7
diff --git a/common.mk b/common.mk
index 0730f59f283057ac2d1e8759d52f15e3624d34ee..bd2f3a42bbfc8e162877434ec2db7aa7dda31a50 100644
--- a/common.mk
+++ b/common.mk
@@ -19,7 +19,7 @@ govpn-verifier:
 	GOPATH=$(GOPATH) go build -ldflags "$(LDFLAGS)" cypherpunks.ru/govpn/cmd/govpn-verifier
 
 bench:
-	GOPATH=$(GOPATH) go test -bench . cypherpunks.ru/govpn/...
+	GOPATH=$(GOPATH) go test -benchmem -bench . cypherpunks.ru/govpn/...
 
 clean:
 	rm -f govpn-client govpn-server govpn-verifier
diff --git a/doc/client.texi b/doc/client.texi
index 5b0ae2b7fda2723894f76a765641ae736c656f95..b6d8aab2a544863e63c7ef6f7cff7af539172b7d 100644
--- a/doc/client.texi
+++ b/doc/client.texi
@@ -51,8 +51,9 @@ @item -encless
 Enable @ref{Encless, encryptionless mode}.
 
 @item -up
-Optional path to script that will be executed after connection is
-established. Interface name will be given to it as a first argument.
+Optional path to @ref{Scripts, script} that will be executed after
+connection is established. Interface name will be given to it as a first
+argument.
 
 @item -down
 Same as @option{-up} above, but it is executed when connection is lost,
@@ -66,8 +67,8 @@
 @verbatim
 client% cat > up.sh <<EOF
 #!/bin/sh
-dhclient $1
-rtsol $1
+dhclient $GOVPN_IFACE
+rtsol $GOVPN_IFACE
 EOF
 client% chmod +x up.sh
 @end verbatim
diff --git a/doc/download.texi b/doc/download.texi
index 7828870d95cb7c7eadbdcd63359d327b1fd571e0..aeab4810cb2280208cb2854f44ff6f42a952e710 100644
--- a/doc/download.texi
+++ b/doc/download.texi
@@ -6,6 +6,10 @@
 @multitable {XXXXX} {XXXX KiB} {link sign} {xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}
 @headitem Version @tab Size @tab Tarball @tab SHA256 checksum
 
+@item @ref{Release 5.6, 5.6} @tab 311 KiB
+@tab @url{download/govpn-5.6.tar.xz, link} @url{download/govpn-5.6.tar.xz.sig, sign}
+@tab @code{d46b8f742f1e2bf17236868512f1ea5ad80f59c3bac753a56ce41a1f465282a8}
+
 @item @ref{Release 5.5, 5.5} @tab 310 KiB
 @tab @url{download/govpn-5.5.tar.xz, link} @url{download/govpn-5.5.tar.xz.sig, sign}
 @tab @code{2f32e02c34a13eae538be7b44c11e16a8e68c43afc8e4a3071172f9c52b861d8}
diff --git a/doc/glossary.texi b/doc/glossary.texi
index fd865cdbde5552ade5d2bdaadd59dc7752495a87..8fed1674d4070f9c0dd4da1ddb9d9dd915427565 100644
--- a/doc/glossary.texi
+++ b/doc/glossary.texi
@@ -8,6 +8,7 @@ * Password Authenticated Key Agreement: PAKE.
 * Timeout::
 * Time synchronization: Timesync.
 * Network transport: Network.
+* Scripts::
 * Proxy::
 * Maximum Transmission Unit: MTU.
 * Statistics: Stats.
@@ -23,6 +24,7 @@ @include pake.texi
 @include timeout.texi
 @include timesync.texi
 @include netproto.texi
+@include scripts.texi
 @include proxy.texi
 @include mtu.texi
 @include stats.texi
diff --git a/doc/news.ru.texi b/doc/news.ru.texi
index 15219a64de96e194608fa62161c61e53911bf011..362ada0d5fd13824ca62cb0005732b3c3b7333c7 100644
--- a/doc/news.ru.texi
+++ b/doc/news.ru.texi
@@ -1,6 +1,14 @@
 @node Новости
 @section Новости
 
+@node Релиз 5.7
+@subsection Релиз 5.7
+@itemize
+@item Имя TAP интерфейса и адрес удалённой стороны теперь передаются в
+up- и down- скрипты через переменные окружения.
+@item Argon2 библиотека обновлена чтобы использовать 1.3 версию алгоритма.
+@end itemize
+
 @node Релиз 5.6
 @subsection Релиз 5.6
 @itemize
diff --git a/doc/news.texi b/doc/news.texi
index 99edbe60397bbc862bb75dce04f2668819de920f..195673066d58143ba802834900c0add6f356b7ec 100644
--- a/doc/news.texi
+++ b/doc/news.texi
@@ -3,6 +3,14 @@ @unnumbered News
 
 See also this page @ref{Новости, on russian}.
 
+@node Release 5.7
+@section Release 5.7
+@itemize
+@item TAP interface name and remote peer's address are passed to up- and
+down- scripts through environment variables.
+@item Update Argon2 library to use version 1.3 of the algorithm.
+@end itemize
+
 @node Release 5.6
 @section Release 5.6
 @itemize
diff --git a/doc/scripts.texi b/doc/scripts.texi
new file mode 100644
index 0000000000000000000000000000000000000000..7b2e3c0f78b08c12b83efea73fdac384667c8ed7
--- /dev/null
+++ b/doc/scripts.texi
@@ -0,0 +1,17 @@
+@node Scripts
+@subsection Scripts
+
+Up- and down- scripts used as a hook executed when connection is either
+established or lost. Following environment variables are set during
+their execution:
+
+@table @code
+
+@item GOVPN_REMOTE
+Remote peer's address. In client mode it is server's address.
+
+@item GOVPN_IFACE
+TAP interface name. In server mode this can be empty: that means that
+script must output its name as the first line to stdout.
+
+@end table
diff --git a/doc/server.texi b/doc/server.texi
index 1784a9bb4858390d276b5354ba083c1dc3f45c24..b3c641e00fe7b2234978926eec7d0326aa57ce98 100644
--- a/doc/server.texi
+++ b/doc/server.texi
@@ -40,12 +40,12 @@ @end verbatim
 
 At least one of either @code{iface} or @code{up} must be specified. If
 you specify @code{iface}, then it will be forcefully used to determine
-what TAP interface will be used. If it is not specified, then up-script
-must output interface's name to stdout (first output line).
+what TAP interface will be used. If it is not specified, then
+up-@ref{Scripts, script} must output interface's name to stdout
+(first output line).
 
 For example up-script can be just @code{echo tap10}, or more advanced
 like the following one:
-
 
 @verbatim
 #!/bin/sh
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
index 10da96929ed6f6786c9e4b0000bb009b7e03ea10..58d5ce7d8597022df5a0a9e9197cf71f1dce0cdf 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/main.go
@@ -21,6 +21,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log"
 	"net"
 	"os"
@@ -48,6 +49,7 @@ 	noisy       = flag.Bool("noise", false, "Enable noise appending")
 	encless     = flag.Bool("encless", false, "Encryptionless mode")
 	cpr         = flag.Int("cpr", 0, "Enable constant KiB/sec out traffic rate")
 	egdPath     = flag.String("egd", "", "Optional path to EGD socket")
+	warranty    = flag.Bool("warranty", false, "Print warranty information")
 
 	conf        *govpn.PeerConf
 	tap         *govpn.TAP
@@ -59,6 +61,10 @@ )
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	timeout = *timeoutP
 	var err error
 	log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile)
@@ -156,5 +162,5 @@ 		close(timeouted)
 		close(rehandshaking)
 		close(termination)
 	}
-	govpn.ScriptCall(*downPath, *ifaceName)
+	govpn.ScriptCall(*downPath, *ifaceName, *remoteAddr)
 }
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
index dd353649ad4db37ee0f2a1b0b673b7e7d71b2a76..4b11eac1091f8c5cca3bd458d95230fc1ba89b7e 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/tcp.go
@@ -83,7 +83,7 @@ 		}
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
index c70cf46c1ea2c3e8a22b5f8fdded82ef43b7a243..acacbd15473b435abbada466ec37f8030e66ff85 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-client/udp.go
@@ -89,7 +89,7 @@ 		}
 		log.Println("Handshake completed")
 		knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
 		if firstUpCall {
-			go govpn.ScriptCall(*upPath, *ifaceName)
+			go govpn.ScriptCall(*upPath, *ifaceName, *remoteAddr)
 			firstUpCall = false
 		}
 		hs.Zero()
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
index eac8a98097b10ac1c4c11f2ca7e55ab6505072c3..f7435dddcd766a63337e23e9762fd20d5ec5cfdb 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/common.go
@@ -66,10 +66,10 @@ 	ps.peer.Zero()
 	heartbeat.Stop()
 }
 
-func callUp(peerId *govpn.PeerId) (string, error) {
+func callUp(peerId *govpn.PeerId, remoteAddr string) (string, error) {
 	ifaceName := confs[*peerId].Iface
 	if confs[*peerId].Up != "" {
-		result, err := govpn.ScriptCall(confs[*peerId].Up, "")
+		result, err := govpn.ScriptCall(confs[*peerId].Up, ifaceName, remoteAddr)
 		if err != nil {
 			log.Println("Script", confs[*peerId].Up, "call failed", err)
 			return "", err
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
index 886b8a812b365dae21960e36232e4d18b0e6618f..606caf0ede5ccbb32c0e0e267dbadfc9d6f59793 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/main.go
@@ -21,6 +21,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log"
 	"net"
 	"os"
@@ -37,10 +38,15 @@ 	confPath = flag.String("conf", "peers.yaml", "Path to configuration YAML")
 	stats    = flag.String("stats", "", "Enable stats retrieving on host:port")
 	proxy    = flag.String("proxy", "", "Enable HTTP proxy on host:port")
 	egdPath  = flag.String("egd", "", "Optional path to EGD socket")
+	warranty = flag.Bool("warranty", false, "Print warranty information")
 )
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	timeout := time.Second * time.Duration(govpn.TimeoutDefault)
 	log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile)
 	log.Println(govpn.VersionGet())
@@ -89,6 +95,14 @@ MainCycle:
 	for {
 		select {
 		case <-termSignal:
+			log.Println("Terminating")
+			for _, ps := range peers {
+				govpn.ScriptCall(
+					confs[*ps.peer.Id].Down,
+					ps.tap.Name,
+					ps.peer.Addr,
+				)
+			}
 			break MainCycle
 		case <-hsHeartbeat:
 			now := time.Now()
@@ -115,6 +129,7 @@ 					delete(peersById, *ps.peer.Id)
 					go govpn.ScriptCall(
 						confs[*ps.peer.Id].Down,
 						ps.tap.Name,
+						ps.peer.Addr,
 					)
 					ps.terminator <- struct{}{}
 				}
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
index 417fcb1601f9fac8c67509ca5693a2b447891656..6ca6967f60af4c892b50d59242ddf273a17d7154 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/tcp.go
@@ -115,7 +115,7 @@ 			peersByIdLock.Unlock()
 			kpLock.Unlock()
 			log.Println("Rehandshake processed:", peer.Id.String())
 		} else {
-			ifaceName, err := callUp(peer.Id)
+			ifaceName, err := callUp(peer.Id, peer.Addr)
 			if err != nil {
 				peer = nil
 				break
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
index 73f4d6fbc7e79cf678f50aab5730d661099dd994..d9197cfbbe0e52c8721ffb27bf4f7b818b1abe0c 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-server/udp.go
@@ -135,7 +135,7 @@ 				kpLock.Unlock()
 				log.Println("Rehandshake processed:", peer.Id.String())
 			} else {
 				go func(addr string, peer *govpn.Peer) {
-					ifaceName, err := callUp(peer.Id)
+					ifaceName, err := callUp(peer.Id, peer.Addr)
 					if err != nil {
 						return
 					}
diff --git a/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go b/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
index 5d595803fcad085acd30e35f55ee896e1021fff3..bdea0791f3d165101ece4219997d1edc21d23665 100644
--- a/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
+++ b/src/cypherpunks.ru/govpn/cmd/govpn-verifier/main.go
@@ -35,10 +35,15 @@ 	mOpt     = flag.Int("m", govpn.DefaultM, "Argon2d memory parameter (KiBs)")
 	tOpt     = flag.Int("t", govpn.DefaultT, "Argon2d iteration parameter")
 	pOpt     = flag.Int("p", govpn.DefaultP, "Argon2d parallelizm parameter")
 	egdPath  = flag.String("egd", "", "Optional path to EGD socket")
+	warranty = flag.Bool("warranty", false, "Print warranty information")
 )
 
 func main() {
 	flag.Parse()
+	if *warranty {
+		fmt.Println(govpn.Warranty)
+		return
+	}
 	if *egdPath != "" {
 		govpn.EGDInit(*egdPath)
 	}
diff --git a/src/cypherpunks.ru/govpn/common.go b/src/cypherpunks.ru/govpn/common.go
index d3f8ec04a595ad62cf960ccfd1ca70310411212f..98137c1c3bc4e5e91744c1c8fb22b87c12afb613 100644
--- a/src/cypherpunks.ru/govpn/common.go
+++ b/src/cypherpunks.ru/govpn/common.go
@@ -28,8 +28,11 @@
 const (
 	TimeoutDefault = 60
 	EtherSize      = 14
-	MTUMax         = 9000 + EtherSize
-	MTUDefault     = 1500 + EtherSize
+	MTUMax         = 9000 + EtherSize + 1
+	MTUDefault     = 1500 + EtherSize + 1
+
+	ENV_IFACE  = "GOVPN_IFACE"
+	ENV_REMOTE = "GOVPN_REMOTE"
 )
 
 var (
@@ -40,14 +43,17 @@ // Call external program/script.
 // You have to specify path to it and (inteface name as a rule) something
 // that will be the first argument when calling it. Function will return
 // it's output and possible error.
-func ScriptCall(path, ifaceName string) ([]byte, error) {
+func ScriptCall(path, ifaceName, remoteAddr string) ([]byte, error) {
 	if path == "" {
 		return nil, nil
 	}
 	if _, err := os.Stat(path); err != nil && os.IsNotExist(err) {
 		return nil, err
 	}
-	out, err := exec.Command(path, ifaceName).CombinedOutput()
+	cmd := exec.Command(path)
+	cmd.Env = append(cmd.Env, ENV_IFACE+"="+ifaceName)
+	cmd.Env = append(cmd.Env, ENV_REMOTE+"="+remoteAddr)
+	out, err := cmd.CombinedOutput()
 	if err != nil {
 		log.Println("Script error", path, err, string(out))
 	}
diff --git a/src/cypherpunks.ru/govpn/govpn.go b/src/cypherpunks.ru/govpn/govpn.go
index d65e72b84038387a64714ad106b15a922f5202d8..49a11ccf659c7e30d00139cdac3ce7656733e044 100644
--- a/src/cypherpunks.ru/govpn/govpn.go
+++ b/src/cypherpunks.ru/govpn/govpn.go
@@ -1,2 +1,17 @@
 // Simple secure, DPI/censorship-resistant free software VPN daemon.
 package govpn
+
+const (
+	Warranty = `This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.`
+)
diff --git a/utils/addroute.sh b/utils/addroute.sh
index a8d85cd4226f5f05b6561f8d37d3a9dbbec6d586..e0ad70b886a11d2944ff10f9df3602f26a0c1054 100755
--- a/utils/addroute.sh
+++ b/utils/addroute.sh
@@ -6,34 +6,34 @@
 # List of parameters passed through environment
 # - reason               -- why this script is called:
 #                           pre-init, connect, disconnect
-# - VPNGATEWAY           -- public address of vpn gateway
-# - TAPDEV               -- tap device
+# - GOVPN_REMOTE         -- public address of VPN gateway
+# - GOVPN_IFACE          -- tap device
 # - INTERNAL_IP4_ADDRESS -- e.g. 172.0.0.2/24
 # - INTERNAL_IP4_GATEWAY -- e.g. 172.0.0.1
 
 
 set_up_dev() {
-  ip tuntap add dev $TAPDEV mode tap
+  ip tuntap add dev $GOVPN_IFACE mode tap
 }
 
 
 tear_down_dev() {
-  ip tuntap del dev $TAPDEV mode tap
+  ip tuntap del dev $GOVPN_IFACE mode tap
 }
 
 
 do_connect() {
   local OLDGW=$(ip route show 0/0 | sed 's/^default//')
-  ip link set dev $TAPDEV up
-  ip addr add $INTERNAL_IP4_ADDRESS dev $TAPDEV
-  ip route add $VPNGATEWAY $OLDGW
-  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
-  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $TAPDEV
+  ip link set dev $GOVPN_IFACE up
+  ip addr add $INTERNAL_IP4_ADDRESS dev $GOVPN_IFACE
+  ip route add $GOVPN_REMOTE $OLDGW
+  ip route add 0/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
+  ip route add 128/1 via $INTERNAL_IP4_GATEWAY dev $GOVPN_IFACE
 }
 
 
 do_disconnect() {
-  ip route del $VPNGATEWAY
+  ip route del $GOVPN_REMOTE
 }