Squashed 'OpenVPN Adapter/Vendors/openvpn/' changes from 4095565..3e002c8

3e002c8 remove unused Jenkinsfile
16b1055 [OVPN3-140] Update company names in copyrights
6caca2c [OVPN3-140] Relicense back to AGPLv3
4f9ae74 cliproto: react to tls_warnings
546547b Proto: export tls_warnings attribute from SSL session
7cbaa26 SSLAPI: add tls_warning attribute
7ed93a3 clievent: add Warn event class
7a71ba1 win: get 'arch' param value from environment
61bb21b win: make parameter optional
15d66c4 [OVPN3-141] win: disable WPO
97d9c28 [OU-15] mbedtls: remove duplicated code
95aec32 [OU-15] mbedtls: refactor X509Cert to allow reuse der2pem
946753e [OVPN3-135] Win: remove unneeded default route
d7f8c47 nrpt: create separate policy per dns suffix
577b5ca cli.cpp: fix typ0 in define
fc8f89d [OVPN3-129] android: ensure all SWIG files are archived and saved
e143bc0 [OVPN3-129] android: improve build system in order to perform full build
06d23ec [OVPN3-129] build-system: let scripts download dependencies
76bb99c fix usage of to_string() in Android
44c183a time: mute type conversion warnings for UWP client
7d7490c transport: enable socket protect call for UWP
1c003ac transport: pass protocol type to external factory
c0de92c transport: add stop_requeueing method
e2c60c8 android: build core library with MD5 support
3928069 [OVPN3-119] mbedTLS: create INSECURE profile including MD5
4f99310 remove function accidentally duplicated by last merge
b91d841 self-test: add missing includes
19e33c4 [OA-14] mbedTLS: relax x509 date/time format check
f3cf645 [OVPN3-116] disable SSL_CBC_RECORD_SPLITTING
fca9ed2 [OVPN3-105] ParseClientConfig: avoid crash when not all key material is provided
7299fef [OC-42] Android: specify API level on command line
d3da3df android: build client lib for x86 (for emulator)
8e501c5 Update version for mbedTLS and lz4
e57676e ParseClientConfig: export config to json format
9aa715f ParseClientConfig: export configuration to ovpn file format
1eab4cb ParseClientConfig: add helper constructor
71a59e4 ParseClientConfig: store the entire ovpn profile
e0bb85a Transport: convert from transport protocol to config string
2fe56c3 Compress: convert from ctx type to config string
174ee25 OpenSSL: implement stub methods for new private_key_type/length() SSLAPIs
3d57708 mbedTLS: implement private_key_type/length() API
a3210f0 SSLAPI: add private_key_type/length() getter methods
8ffe888 OpenSSL: implement stub methods for new extract_* SSLAPIs
16e9160 mbedTLS: implement extended API for key material extraction
fe3d519 SSLAPI: extend API with methods to extract key material
2b4c850 Debugging: added header and build flag for valgrind run-time extensions.
b948cde ManClientInstance::Factory: added virtual stop() method.
121e975 client API: added portOverride
106981c JSON: allow alternative JSON library implementations
f206ae2 logging: added logdatetime.hpp which prepends date/time to log lines
49e933d Time: added to_double, delta_float, and delta_str methods
569b1da daemon.hpp: added class WritePid for managing pid files
63e9e04 ClientProto: reset CoarseTime object when AsioTimer is canceled
f64b501 Cleanup: allow functor to be passed by value.
ebe2560 RunContext: add configurable exit via EXIT_IN env var for debugging
1fbff4f tls-crypt: revised server-side validate_initial_packet() methods to use a BufferAllocated rather than a Buffer.
0090c51 SSLConst: added new ssl_flags() method which filters out non-ssl flags from given argument.
8379b0a CryptoDCInstance: added new RekeyType PRIMARY_SECONDARY_SWAP and use it in ProtoContext::promote_secondary_to_primary() since it more accurately reflects the underlying implementation.
18f45c2 ManClientInstance::Send: added AuthStatus::Type parameter to disconnect_user() method.
4bba803 Listen::List: added expand_ports() method.
5122e7d Listen::List: in port_offset(), set n_threads to 0 since number-of-threads data for port_offset items isn't really relevant.
4e11a6c StaticKey: added render_to_base64() and init_from_rng() methods.
190ece9 CryptoAlgs: added mode() method.
76e65cf CryptoAlgs: added AEAD_NONCE_TAIL_SIZE constant (set to 8 bytes) to represent the size in bytes of AEAD "nonce tail" normally taken from the HMAC key material.
2738718 compress: added method_to_string() method, i.e. the inverse of parse_method().
7b47f99 compress: since parse_method() performs a linear search on method, reorder so that more frequently used methods appear at the top of the list.
b428f74 library: added integer is_pow2() and log2() methods based on efficient __builtin_ffs and __builtin_clz intrinsics.
4926011 Android: adapt toolchain scripts to new SDK and move to API 26
ad4e995 mbedTLS: use mbedtls API to initialize cert object
908c611 transport: use socket_protect to communicate socket handle on UWP
92a6216 build win: read certain params from env
8166ea8 common: define uwp platform macro
0186bf6 common: report platform name as "uwp"
3f291b0 netconf: disable getting hwaddr for UWP
6365d26 transport: external factory
2ffa0c9 transport: synchronous DNS lookup
2c09c7c cliconnect.hpp: support for AsioWork always on
4f5a04d rand.hpp: allow external entropy source
b19c5da time.hpp: use GetTickCount64 on Vista and newer
712ccfc android: export DEP_DIR via vars files only if not already defined
1b5a784 asio: make sure to switch to DEP_DIR before building
4302651 changes to support android building
6f56b2b Merge pull request #21 from OpenVPN/make_test_proto_deterministic
3a5ef2b travis-ci: make testing binary deterministic
b76882d mbedtls: fix typ0 in exception message
40065a6 avoid "uninitialized variable warning"
f33e7c2 [OVPN3-5] tls-crypt: add tls-crypt support in proto.hpp test unit
74c5f4f [OVPN3-5] tls-crypt: introduce tls-crypt support
389353c proto.cpp: uninit process at the end of the execution
56a831f [OVPN3-5] crypto/ssl: add support for AES-256-CTR
7cbf539 [OVPN3-5] build script: allow user to specify its own mbedTLS folder and LDFLAGS
8ae2a3f Integrate Google Test framework
68ae101 Add swig build to jenkins pipeline
d496311 ovpncli.hpp: inline LogInfo constructor for clarity
96e0d89 Revert "Merged in OVPN3-21-prepend-log-record-with-unique- (pull request #7)"
7db95cc Make build fail on compilation errors
860129a TunBuilderCapture: make (to|from)_json methods public
2486494 random: added helper class Rand2 containing a crypto and non-crypto RNG
04175c2 appversion.hpp: Stringize VERSION -> MY_VERSION
81cb887 build script: added DPROF=1 flag
a3dd47f timestr.hpp: moved milliseconds_since_epoch() to time/epoch.hpp
59b9492 sslchoose.hpp: added SSL_LIB_NAME
8fcb797 ProtoContext::KeyContext::raw_recv() : fix state transition
e49e993 ProtoContext: comment edit
1d941aa VPNServerNetblock::Netblock refactor
7190495 Server-side renamings to break up long class names using namespaces.
3f74ec1 Listen::List: minor changes
79c789b RandomAPI: comment edit
5b5af36 Added SSLConst::SERVER_TO_SERVER flag
fe00df4 OpenSSLContext::Config::set_rng: call assert_crypto()
3ae0076 In sslchoose.hpp, move OPENVPN_LOG_SSL macro to new file ssllog.hpp
1502cf6 URL::Parse: made is_valid_uri_char() standalone and moved to validate_uri.hpp
2dcb189 Added HTTP::Status::SwitchingProtocols constant
2f57024 HTTP::HeaderList: added get_value_trim_lower() method
bee94d2 HTTP::HeaderList: get_value() and get_value_trim() should return std::string instead of const std::string
5debab1 Frame::Context: #define OPENVPN_NO_IO to allow building without i/o layer
faf8f8f StaticKey: added parse_from_base64() method
d11f250 HashString: added final_base64() method
c373bf8 CompressContext: use C++11 member initialization and remove explicit attribute on constructor
bd75cd7 RCPtr: added operator==() and operator!=() methods
7be33c5 PThreadBarrier: fixed incorrect comment
6f5f77b Link: use move semantics
17a5d89 inotify.hpp: no longer used
8ce39fc added render_hex() and render_hex_sep() methods that accept void* data
ddc8e8a Function: use std::forward
76ee587 write_binary_atomic(): added tmpdir (temporary directory) parameter
f366d55 base64: encode() now accepts void* data
462fe90 BufferType: added read(), write(), and prepend() variants that accept void* data
9ad1be4 IP::RouteType: added host_bits() method
3ebc8c7 IPv[46]::Addr::to_sockaddr() now accepts optional port number
ce0977b Support Cityhash.
fdbb0b9 IP::Addr: added validate_prefix_len()
25146d8 IP::Addr::from_ipv[4|6](): use move semantics
a264f99 Merge pull request #20 from OpenVPN/fix_travis_ci_coverity
966e212 travis: don't mess up the SSL libs for wget/curl
2b8f09d Merge pull request #19 from OpenVPN/antonio/travis-ci-to-coverity
127cbb0 travis.yml: send build to Coverity SCAN when building master
2bca49b Merge pull request #15 from OpenVPN/antonio/travis-ci
a5ce566 add basic support for Travis CI
f9b14e9 macOS: add basic logging support
2b9188d Remotelist: pass meaningful port value to resolve::async_resolve()
4ebdbd0 Merged in OVPN3-38-improve-jenkins-pipeline-script (pull request #8)
832cf7f Report build status to Bitbucket
62423c9 Merged in OVPN3-21-prepend-log-record-with-unique- (pull request #7)
cce2455 Prepend log string with unique reference.
f26b08b Merged in OVPN3-25-pipeline-build (pull request #4)
dc5ff1f Add OpenSSL version building.
c77e1d6 Add pipeline script for multiplatform build.
4fab9b0 Merged in OVPN3-18-vs-project (pull request #2)
8eb0d6c Add Visual Studio project info to README
67c4989 Visual Studio 2015 solution and project files
52bfcd3 Merged in OVPN3-17 (pull request #1)
5f648ce Document Windows build process
3213c48 Support for local build settings
b3ec01b Support for gpl version of mbedtls
903abc8 Support for zipballs
4029579 AsioPolySock: support bind to local address.
1e85566 Use openvpn::strerror_str() instead of std::strerror().
3ba37fc OpenVPN 3 client: added OPENVPN_OVPNCLI_ASYNC_SETUP flag.

git-subtree-dir: OpenVPN Adapter/Vendors/openvpn
git-subtree-split: 3e002c83ce2e9f9f40ddcee750d3cfa664238abe

openvpn/crypto/bs64_data_limit.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/cipher.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/crypto_aead.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/crypto_chm.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/cryptoalgs.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 
@@ -49,6 +49,9 @@ namespace openvpn {
       DES_EDE3_CBC,
       BF_CBC,
 
+      // CTR ciphers
+      AES_256_CTR,
+
       // AEAD ciphers
       AES_128_GCM,
       AES_192_GCM,
@@ -79,6 +82,12 @@ namespace openvpn {
       F_ALLOW_DC=(1<<4),  // alg may be used in OpenVPN data channel
     };
 
+    // size in bytes of AEAD "nonce tail" normally taken from
+    // HMAC key material
+    enum {
+      AEAD_NONCE_TAIL_SIZE = 8
+    };
+
     class Alg
     {
     public:
@@ -120,6 +129,7 @@ namespace openvpn {
       { "DES-CBC",      F_CIPHER|F_ALLOW_DC|CBC_HMAC,           8,  8,  8 },
       { "DES-EDE3-CBC", F_CIPHER|F_ALLOW_DC|CBC_HMAC,          24,  8,  8 },
       { "BF-CBC",       F_CIPHER|F_ALLOW_DC|CBC_HMAC,          16,  8,  8 },
+      { "AES-256-CTR",  F_CIPHER,                              32, 16, 16 },
       { "AES-128-GCM",  F_CIPHER|F_ALLOW_DC|AEAD,              16, 12, 16 },
       { "AES-192-GCM",  F_CIPHER|F_ALLOW_DC|AEAD,              24, 12, 16 },
       { "AES-256-GCM",  F_CIPHER|F_ALLOW_DC|AEAD,              32, 12, 16 },
@@ -208,6 +218,12 @@ namespace openvpn {
       return alg.block_size();
     }
 
+    inline Mode mode(const Type type)
+    {
+      const Alg& alg = get(type);
+      return alg.mode();
+    }
+
     inline Type legal_dc_cipher(const Type type)
     {
       const Alg& alg = get(type);

openvpn/crypto/cryptodc.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 
@@ -86,9 +86,10 @@ namespace openvpn {
 
     enum RekeyType {
       ACTIVATE_PRIMARY,
-      DEACTIVATE_SECONDARY,
-      PROMOTE_SECONDARY_TO_PRIMARY,
+      ACTIVATE_PRIMARY_MOVE,
       NEW_SECONDARY,
+      PRIMARY_SECONDARY_SWAP,
+      DEACTIVATE_SECONDARY,
       DEACTIVATE_ALL,
     };
 

openvpn/crypto/cryptodcsel.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/decrypt_chm.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/digestapi.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/encrypt_chm.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/hashstr.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 
@@ -26,6 +26,7 @@
 
 #include <openvpn/buffer/buffer.hpp>
 #include <openvpn/common/hexstr.hpp>
+#include <openvpn/common/base64.hpp>
 #include <openvpn/crypto/digestapi.hpp>
 
 namespace openvpn {
@@ -80,6 +81,12 @@ namespace openvpn {
       return render_hex_generic(*bp);
     }
 
+    std::string final_base64()
+    {
+      BufferPtr bp = final();
+      return base64->encode(*bp);
+    }
+
   private:
     DigestInstance::Ptr ctx;
   };

openvpn/crypto/ovpnhmac.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/packet_id.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/selftest.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 

openvpn/crypto/static_key.hpp

@@ -4,18 +4,18 @@
 //               packet encryption, packet authentication, and
 //               packet compression.
 //
-//    Copyright (C) 2012-2017 OpenVPN Technologies, Inc.
+//    Copyright (C) 2012-2017 OpenVPN Inc.
 //
 //    This program is free software: you can redistribute it and/or modify
-//    it under the terms of the GNU General Public License Version 3
+//    it under the terms of the GNU Affero General Public License Version 3
 //    as published by the Free Software Foundation.
 //
 //    This program is distributed in the hope that it will be useful,
 //    but WITHOUT ANY WARRANTY; without even the implied warranty of
 //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//    GNU General Public License for more details.
+//    GNU Affero General Public License for more details.
 //
-//    You should have received a copy of the GNU General Public License
+//    You should have received a copy of the GNU Affero General Public License
 //    along with this program in the COPYING file.
 //    If not, see <http://www.gnu.org/licenses/>.
 
@@ -31,7 +31,9 @@
 #include <openvpn/common/hexstr.hpp>
 #include <openvpn/common/file.hpp>
 #include <openvpn/common/splitlines.hpp>
+#include <openvpn/common/base64.hpp>
 #include <openvpn/buffer/buffer.hpp>
+#include <openvpn/random/randapi.hpp>
 
 namespace openvpn {
 
@@ -51,6 +53,25 @@ namespace openvpn {
 
     std::string render_hex() const { return openvpn::render_hex_generic(key_data_); }
 
+    void parse_from_base64(const std::string& b64, const size_t capacity)
+    {
+      key_data_.reset(capacity, key_t::DESTRUCT_ZERO);
+      base64->decode(key_data_, b64);
+    }
+
+    std::string render_to_base64() const
+    {
+      return base64->encode(key_data_);
+    }
+
+    void init_from_rng(RandomAPI& rng, const size_t key_size)
+    {
+      rng.assert_crypto();
+      key_data_.init(key_size, key_t::DESTRUCT_ZERO);
+      rng.rand_bytes(key_data_.data(), key_size);
+      key_data_.set_size(key_size);
+    }
+
   private:
     key_t key_data_;
   };

openvpn/crypto/tls_crypt.hpp

@@ -0,0 +1,344 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// OpenVPN TLS-Crypt classes
+
+#ifndef OPENVPN_CRYPTO_TLSCRYPT_H
+#define OPENVPN_CRYPTO_TLSCRYPT_H
+
+#include <string>
+
+#include <openvpn/common/size.hpp>
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/rc.hpp>
+#include <openvpn/common/memneq.hpp>
+#include <openvpn/crypto/static_key.hpp>
+#include <openvpn/crypto/cryptoalgs.hpp>
+#include <openvpn/crypto/packet_id.hpp>
+#include <openvpn/ssl/psid.hpp>
+
+namespace openvpn {
+
+  // OpenVPN protocol HMAC usage for HMAC/CTR integrity checking and tls-crypt
+
+  // Control packet format when tls-crypt is enabled:
+  // [OP]  [PSID]  [PID]  [HMAC] [...]
+
+  template <typename CRYPTO_API>
+  class TLSCrypt
+  {
+  public:
+    OPENVPN_SIMPLE_EXCEPTION(ovpn_tls_crypt_context_digest_size);
+    OPENVPN_SIMPLE_EXCEPTION(ovpn_tls_crypt_context_bad_sizing);
+    OPENVPN_SIMPLE_EXCEPTION(ovpn_tls_crypt_wrong_mode);
+
+    TLSCrypt() : mode(CRYPTO_API::CipherContext::MODE_UNDEF) {}
+
+    TLSCrypt(const CryptoAlgs::Type digest, const StaticKey& key_hmac,
+	     const CryptoAlgs::Type cipher, const StaticKey& key_crypt,
+	     const int mode)
+    {
+      init(digest, key_hmac, cipher, key_crypt, mode);
+    }
+
+    bool defined() const { return ctx_hmac.is_initialized() && ctx_crypt.is_initialized(); }
+
+    // size of out buffer to pass to hmac
+    size_t output_hmac_size() const
+    {
+      return ctx_hmac.size();
+    }
+
+    void init(const CryptoAlgs::Type digest, const StaticKey& key_hmac,
+	      const CryptoAlgs::Type cipher, const StaticKey& key_crypt,
+	      const int mode_arg)
+    {
+      const CryptoAlgs::Alg& alg_hmac = CryptoAlgs::get(digest);
+
+      // check that key is large enough
+      if (key_hmac.size() < alg_hmac.size())
+	throw ovpn_tls_crypt_context_digest_size();
+
+      // initialize HMAC context with digest type and key
+      ctx_hmac.init(digest, key_hmac.data(), alg_hmac.size());
+
+      // initialize Cipher context with cipher, key and mode
+      ctx_crypt.init(cipher, key_crypt.data(), mode_arg);
+
+      mode = mode_arg;
+    }
+
+    bool hmac_gen(unsigned char *header, const size_t header_len,
+		  const unsigned char *payload, const size_t payload_len)
+    {
+      if (header_len < head_size + output_hmac_size())
+	return false;
+
+      hmac_pre(header, payload, payload_len);
+      ctx_hmac.final(header + head_size);
+
+      return true;
+    }
+
+    bool hmac_cmp(const unsigned char *header, const size_t header_len,
+		  const unsigned char *payload, const size_t payload_len)
+    {
+      unsigned char local_hmac[CRYPTO_API::HMACContext::MAX_HMAC_SIZE];
+
+      if (header_len < head_size + output_hmac_size())
+	return false;
+
+      hmac_pre(header, payload, payload_len);
+      ctx_hmac.final(local_hmac);
+
+      return !crypto::memneq(header + head_size, local_hmac, output_hmac_size());
+    }
+
+    size_t encrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+		   const unsigned char *in, const size_t ilen)
+    {
+      if (mode != CRYPTO_API::CipherContext::ENCRYPT)
+	throw ovpn_tls_crypt_wrong_mode();
+
+      return encrypt_decrypt(iv, out, olen, in, ilen);
+    }
+
+    size_t decrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+		   const unsigned char *in, const size_t ilen)
+    {
+      if (mode != CRYPTO_API::CipherContext::DECRYPT)
+	throw ovpn_tls_crypt_wrong_mode();
+
+      return encrypt_decrypt(iv, out, olen, in, ilen);
+    }
+
+  private:
+    // assume length check on header has already been performed
+    void hmac_pre(const unsigned char *header, const unsigned char *payload,
+		  const size_t payload_len)
+    {
+      ctx_hmac.reset();
+      ctx_hmac.update(header, head_size);
+      ctx_hmac.update(payload, payload_len);
+    }
+
+    size_t encrypt_decrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+			   const unsigned char *in, const size_t ilen)
+    {
+      ctx_crypt.reset(iv);
+
+      size_t outlen = 0;
+
+      if (!ctx_crypt.update(out, olen, in, ilen, outlen))
+        return 0;
+
+      if (!ctx_crypt.final(out + outlen, olen - outlen, outlen))
+        return 0;
+
+      return outlen;
+    }
+
+    typename CRYPTO_API::HMACContext ctx_hmac;
+    typename CRYPTO_API::CipherContext ctx_crypt;
+    int mode;
+
+    static const size_t head_size;
+  };
+
+  // initialize static member with non-constexpr.
+  // This is the size of the header in a TLSCrypt-wrapped packets,
+  // excluding the HMAC. Format:
+  //
+  // [OP]  [PSID]  [PID]  [HMAC] [...]
+  //
+  template <typename CRYPTO_API>
+  const size_t TLSCrypt<CRYPTO_API>::head_size = 1 + ProtoSessionID::SIZE + PacketID::size(PacketID::LONG_FORM);
+
+  // OvpnHMAC wrapper API using dynamic polymorphism
+
+  class TLSCryptInstance : public RC<thread_unsafe_refcount>
+  {
+  public:
+    typedef RCPtr<TLSCryptInstance> Ptr;
+
+    virtual void init(const StaticKey& key_hmac, const StaticKey& key_crypt) = 0;
+
+    virtual size_t output_hmac_size() const = 0;
+
+    virtual bool hmac_gen(unsigned char *header, const size_t header_len,
+			  const unsigned char *payload, const size_t payload_len) = 0;
+
+    virtual bool hmac_cmp(const unsigned char *header, const size_t header_len,
+			  const unsigned char *payload, const size_t payload_len) = 0;
+
+    virtual size_t encrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+			   const unsigned char *in, const size_t ilen) = 0;
+
+    virtual size_t decrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+			   const unsigned char *in, const size_t ilen) = 0;
+  };
+
+  class TLSCryptContext : public RC<thread_unsafe_refcount>
+  {
+  public:
+    typedef RCPtr<TLSCryptContext> Ptr;
+
+    virtual size_t digest_size() const = 0;
+
+    virtual size_t cipher_key_size() const = 0;
+
+    virtual TLSCryptInstance::Ptr new_obj_send() = 0;
+
+    virtual TLSCryptInstance::Ptr new_obj_recv() = 0;
+  };
+
+  class TLSCryptFactory : public RC<thread_unsafe_refcount>
+  {
+  public:
+    typedef RCPtr<TLSCryptFactory> Ptr;
+
+    virtual TLSCryptContext::Ptr new_obj(const CryptoAlgs::Type digest_type,
+					 const CryptoAlgs::Type cipher_type) = 0;
+  };
+
+  // TLSCrypt wrapper implementation using dynamic polymorphism
+
+  template <typename CRYPTO_API>
+  class CryptoTLSCryptInstance : public TLSCryptInstance
+  {
+  public:
+    CryptoTLSCryptInstance(const CryptoAlgs::Type digest_arg,
+			   const CryptoAlgs::Type cipher_arg,
+			   int mode_arg)
+      : digest(digest_arg),
+	cipher(cipher_arg),
+	mode(mode_arg)
+    {
+    }
+
+    void init(const StaticKey& key_hmac, const StaticKey& key_crypt)
+    {
+      tls_crypt.init(digest, key_hmac, cipher, key_crypt, mode);
+    }
+
+    size_t output_hmac_size() const
+    {
+      return tls_crypt.output_hmac_size();
+    }
+
+    void ovpn_hmac_reset()
+    {
+      tls_crypt.ovpn_hmac_reset();
+    }
+
+    void ovpn_hmac_update(const unsigned char *in, const size_t in_size)
+    {
+      tls_crypt.ovpn_hmac_update(in, in_size);
+    }
+
+    void ovpn_hmac_write(unsigned char *out)
+    {
+      tls_crypt.ovpn_hmac_write(out);
+    }
+
+    bool hmac_gen(unsigned char *header, const size_t header_len,
+		  const unsigned char *payload, const size_t payload_len)
+    {
+      return tls_crypt.hmac_gen(header, header_len, payload, payload_len);
+    }
+
+    // verify the HMAC generated by hmac_gen, return true if verified
+    bool hmac_cmp(const unsigned char *header, const size_t header_len,
+		  const unsigned char *payload, const size_t payload_len)
+    {
+      return tls_crypt.hmac_cmp(header, header_len, payload, payload_len);
+    }
+
+    size_t encrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+		   const unsigned char *in, const size_t ilen)
+    {
+      return tls_crypt.encrypt(iv, out, olen, in, ilen);
+    }
+
+    size_t decrypt(const unsigned char *iv, unsigned char *out, const size_t olen,
+		   const unsigned char *in, const size_t ilen)
+    {
+      return tls_crypt.decrypt(iv, out, olen, in, ilen);
+    }
+
+  private:
+    typename CryptoAlgs::Type digest;
+    typename CryptoAlgs::Type cipher;
+    int mode;
+    TLSCrypt<CRYPTO_API> tls_crypt;
+  };
+
+  template <typename CRYPTO_API>
+  class CryptoTLSCryptContext : public TLSCryptContext
+  {
+  public:
+    CryptoTLSCryptContext(const CryptoAlgs::Type digest_type,
+			  const CryptoAlgs::Type cipher_type)
+      : digest(digest_type),
+	cipher(cipher_type)
+    {
+    }
+
+    virtual size_t digest_size() const
+    {
+      return CryptoAlgs::size(digest);
+    }
+
+    virtual size_t cipher_key_size() const
+    {
+      return CryptoAlgs::key_length(cipher);
+    }
+
+    virtual TLSCryptInstance::Ptr new_obj_send()
+    {
+      return new CryptoTLSCryptInstance<CRYPTO_API>(digest, cipher,
+						    CRYPTO_API::CipherContext::ENCRYPT);
+    }
+
+    virtual TLSCryptInstance::Ptr new_obj_recv()
+    {
+      return new CryptoTLSCryptInstance<CRYPTO_API>(digest, cipher,
+						    CRYPTO_API::CipherContext::DECRYPT);
+    }
+
+  private:
+    CryptoAlgs::Type digest;
+    CryptoAlgs::Type cipher;
+  };
+
+  template <typename CRYPTO_API>
+  class CryptoTLSCryptFactory : public TLSCryptFactory
+  {
+  public:
+    virtual TLSCryptContext::Ptr new_obj(const CryptoAlgs::Type digest_type,
+					 const CryptoAlgs::Type cipher_type)
+    {
+      return new CryptoTLSCryptContext<CRYPTO_API>(digest_type, cipher_type);
+    }
+  };
+}
+
+#endif