Merge commit '86cc97e55fe346502462284d2e636a2b3708163e' as 'Sources/OpenVPN3'

Sources/OpenVPN3/openvpn/apple/cf/cf.hpp

@@ -0,0 +1,459 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CF_H
+#define OPENVPN_APPLECRYPTO_CF_CF_H
+
+#include <string>
+#include <iostream>
+#include <sstream>
+#include <algorithm>
+#include <utility>
+#include <exception>
+
+#include <CoreFoundation/CoreFoundation.h>
+
+// Wrapper classes for Apple Core Foundation objects.
+
+#define OPENVPN_CF_WRAP(cls, castmeth, cftype, idmeth) \
+    template <> \
+    struct Type<cftype> \
+    { \
+      static CFTypeRef cast(CFTypeRef obj) \
+      { \
+	if (obj && CFGetTypeID(obj) == idmeth()) \
+	  return obj; \
+	else \
+	  return nullptr; \
+      } \
+    }; \
+    typedef Wrap<cftype> cls; \
+    inline cls castmeth(CFTypeRef obj) \
+    { \
+      CFTypeRef o = Type<cftype>::cast(obj); \
+      if (o) \
+	return cls(cftype(o), GET);	\
+      else \
+	return cls(); \
+    }
+
+namespace openvpn {
+  namespace CF
+  {
+    enum Rule {
+      CREATE,    // create rule
+      GET        // get rule
+    };
+
+    template <typename T> struct Type {};
+
+    template <typename T>
+    class Wrap
+    {
+    public:
+      Wrap() : obj_(nullptr) {}
+
+      explicit Wrap(T obj, const Rule rule=CREATE)
+      {
+	if (rule == GET && obj)
+	  CFRetain(obj);
+	obj_ = obj;
+      }
+
+      Wrap(const Wrap& other)
+      {
+	obj_ = other.obj_;
+	if (obj_)
+	  CFRetain(obj_);
+      }
+
+      Wrap& operator=(const Wrap& other)
+      {
+	if (other.obj_)
+	  CFRetain(other.obj_);
+	if (obj_)
+	  CFRelease(obj_);
+	obj_ = other.obj_;
+	return *this;
+      }
+
+      Wrap(Wrap&& other) noexcept
+      {
+	obj_ = other.obj_;
+	other.obj_ = nullptr;
+      }
+
+      Wrap& operator=(Wrap&& other) noexcept
+      {
+	if (obj_)
+	  CFRelease(obj_);
+	obj_ = other.obj_;
+	other.obj_ = nullptr;
+	return *this;
+      }
+
+      void swap(Wrap& other)
+      {
+	std::swap(obj_, other.obj_);
+      }
+
+      void reset(T obj=nullptr, const Rule rule=CREATE)
+      {
+	if (rule == GET && obj)
+	  CFRetain(obj);
+	if (obj_)
+	  CFRelease(obj_);
+	obj_ = obj;
+      }
+
+      bool defined() const { return obj_ != nullptr; }
+
+      explicit operator bool() const noexcept
+      {
+	return defined();
+      }
+
+      T operator()() const { return obj_; }
+
+      CFTypeRef generic() const { return (CFTypeRef)obj_; }
+
+      static T cast(CFTypeRef obj) { return T(Type<T>::cast(obj)); }
+
+      static Wrap from_generic(CFTypeRef obj, const Rule rule=CREATE)
+      {
+	return Wrap(cast(obj), rule);
+      }
+
+      T release()
+      {
+	T ret = obj_;
+	obj_ = nullptr;
+	return ret;
+      }
+
+      CFTypeRef generic_release()
+      {
+	T ret = obj_;
+	obj_ = nullptr;
+	return (CFTypeRef)ret;
+      }
+
+      // Intended for use with Core Foundation methods that require
+      // a T* for saving a create-rule return value
+      T* mod_ref()
+      {
+	if (obj_)
+	  {
+	    CFRelease(obj_);
+	    obj_ = nullptr;
+	  }
+	return &obj_;
+      }
+
+      void show() const
+      {
+	if (obj_)
+	  CFShow(obj_);
+	else
+	  std::cerr << "CF_UNDEFINED" << std::endl;
+      }
+
+      virtual ~Wrap()
+      {
+	if (obj_)
+	  CFRelease(obj_);
+      }
+
+    private:
+      Wrap& operator=(T obj) = delete; // prevent use because no way to pass rule parameter
+
+      T obj_;
+    };
+
+    // common CF types
+
+    OPENVPN_CF_WRAP(String, string_cast, CFStringRef, CFStringGetTypeID)
+    OPENVPN_CF_WRAP(Number, number_cast, CFNumberRef, CFNumberGetTypeID)
+    OPENVPN_CF_WRAP(Bool, bool_cast, CFBooleanRef, CFBooleanGetTypeID)
+    OPENVPN_CF_WRAP(Data, data_cast, CFDataRef, CFDataGetTypeID)
+    OPENVPN_CF_WRAP(Array, array_cast, CFArrayRef, CFArrayGetTypeID)
+    OPENVPN_CF_WRAP(MutableArray, mutable_array_cast, CFMutableArrayRef, CFArrayGetTypeID)
+    OPENVPN_CF_WRAP(Dict, dict_cast, CFDictionaryRef, CFDictionaryGetTypeID)
+    OPENVPN_CF_WRAP(MutableDict, mutable_dict_cast, CFMutableDictionaryRef, CFDictionaryGetTypeID)
+    OPENVPN_CF_WRAP(Error, error_cast, CFErrorRef, CFErrorGetTypeID);
+
+    // generic CFTypeRef wrapper
+
+    typedef Wrap<CFTypeRef> Generic;
+
+    inline Generic generic_cast(CFTypeRef obj)
+    {
+      return Generic(obj, GET);
+    }
+
+    // constructors
+
+    inline String string(const char *str)
+    {
+      return String(CFStringCreateWithCString(kCFAllocatorDefault, str, kCFStringEncodingUTF8));
+    }
+
+    inline String string(CFStringRef str)
+    {
+      return String(str, GET);
+    }
+
+    inline String string(const String& str)
+    {
+      return String(str);
+    }
+
+    inline String string(const std::string& str)
+    {
+      return String(CFStringCreateWithCString(kCFAllocatorDefault, str.c_str(), kCFStringEncodingUTF8));
+    }
+
+    inline String string(const std::string* str)
+    {
+      return String(CFStringCreateWithCString(kCFAllocatorDefault, str->c_str(), kCFStringEncodingUTF8));
+    }
+
+    inline Number number_from_int(const int n)
+    {
+      return Number(CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &n));
+    }
+
+    inline Number number_from_int32(const SInt32 n)
+    {
+      return Number(CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &n));
+    }
+
+    inline Number number_from_long_long(const long long n)
+    {
+      return Number(CFNumberCreate(kCFAllocatorDefault, kCFNumberLongLongType, &n));
+    }
+
+    inline Number number_from_index(const CFIndex n)
+    {
+      return Number(CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &n));
+    }
+
+    inline Data data(const void *bytes, CFIndex length)
+    {
+      return Data(CFDataCreate(kCFAllocatorDefault, (const UInt8 *)bytes, length));
+    }
+
+    inline Array array(const void **values, CFIndex numValues)
+    {
+      return Array(CFArrayCreate(kCFAllocatorDefault, values, numValues, &kCFTypeArrayCallBacks));
+    }
+
+    inline Dict dict(const void **keys, const void **values, CFIndex numValues)
+    {
+      return Dict(CFDictionaryCreate(kCFAllocatorDefault,
+				     keys,
+				     values,
+				     numValues,
+				     &kCFTypeDictionaryKeyCallBacks,
+				     &kCFTypeDictionaryValueCallBacks));
+    }
+
+    inline Dict const_dict(MutableDict& mdict)
+    {
+      return Dict(mdict(), CF::GET);
+    }
+
+    inline Array const_array(MutableArray& marray)
+    {
+      return Array(marray(), CF::GET);
+    }
+
+    inline Dict empty_dict()
+    {
+      return Dict(CFDictionaryCreate(kCFAllocatorDefault,
+				     nullptr,
+				     nullptr,
+				     0,
+				     &kCFTypeDictionaryKeyCallBacks,
+				     &kCFTypeDictionaryValueCallBacks));
+    }
+
+    inline MutableArray mutable_array(const CFIndex capacity=0)
+    {
+      return MutableArray(CFArrayCreateMutable(kCFAllocatorDefault, capacity, &kCFTypeArrayCallBacks));
+    }
+
+    inline MutableDict mutable_dict(const CFIndex capacity=0)
+    {
+      return MutableDict(CFDictionaryCreateMutable(kCFAllocatorDefault, capacity, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    }
+
+    template <typename DICT>
+    inline MutableDict mutable_dict_copy(const DICT& dict, const CFIndex capacity=0)
+    {
+      if (dict.defined())
+	return MutableDict(CFDictionaryCreateMutableCopy(kCFAllocatorDefault, capacity, dict()));
+      else
+	return mutable_dict(capacity);
+    }
+
+    inline Error error(CFStringRef domain, CFIndex code, CFDictionaryRef userInfo)
+    {
+      return Error(CFErrorCreate(kCFAllocatorDefault, domain, code, userInfo));
+    }
+
+    // accessors
+
+    template <typename ARRAY>
+    inline CFIndex array_len(const ARRAY& array)
+    {
+      if (array.defined())
+	return CFArrayGetCount(array());
+      else
+	return 0;
+    }
+
+    template <typename DICT>
+    inline CFIndex dict_len(const DICT& dict)
+    {
+      if (dict.defined())
+	return CFDictionaryGetCount(dict());
+      else
+	return 0;
+    }
+
+    template <typename ARRAY>
+    inline CFTypeRef array_index(const ARRAY& array, const CFIndex idx)
+    {
+      if (array.defined() && CFArrayGetCount(array()) > idx)
+	return CFArrayGetValueAtIndex(array(), idx);
+      else
+	return nullptr;
+    }
+
+    template <typename DICT, typename KEY>
+    inline CFTypeRef dict_index(const DICT& dict, const KEY& key)
+    {
+      if (dict.defined())
+	{
+	  String keystr = string(key);
+	  if (keystr.defined())
+	    return CFDictionaryGetValue(dict(), keystr());
+	}
+      return nullptr;
+    }
+
+    // string methods
+
+    struct cppstring_error : public std::exception
+    {
+      virtual const char* what() const throw()
+      {
+	return "cppstring_error";
+      }
+    };
+
+    inline std::string cppstring(CFStringRef str)
+    {
+      const CFStringEncoding encoding = kCFStringEncodingUTF8;
+      if (str)
+	{
+	  const CFIndex len = CFStringGetLength(str);
+	  if (len > 0)
+	    {
+	      const CFIndex maxsize = CFStringGetMaximumSizeForEncoding(len, encoding);
+	      char *buf = new char[maxsize];
+	      const Boolean status = CFStringGetCString(str, buf, maxsize, encoding);
+	      if (status)
+		{
+		  std::string ret(buf);
+		  delete [] buf;
+		  return ret;
+		}
+	      else
+		{
+		  delete [] buf;
+		  throw cppstring_error();
+		}
+	    }
+	}
+      return "";
+    }
+
+    inline std::string cppstring(const String& str)
+    {
+      return cppstring(str());
+    }
+
+    inline std::string description(CFTypeRef obj)
+    {
+      if (obj)
+	{
+	  String s(CFCopyDescription(obj));
+	  return cppstring(s);
+	}
+      else
+	return "UNDEF";
+    }
+
+    // format an array of strings (non-string elements in array are ignored)
+    template <typename ARRAY>
+    inline std::string array_to_string(const ARRAY& array, const char delim=',')
+    {
+      std::ostringstream os;
+      const CFIndex len = array_len(array);
+      if (len)
+	{
+	  bool sep = false;
+	  for (CFIndex i = 0; i < len; ++i)
+	    {
+	      const String v(string_cast(array_index(array, i)));
+	      if (v.defined())
+		{
+		  if (sep)
+		    os << delim;
+		  os << cppstring(v);
+		  sep = true;
+		}
+	    }
+	}
+      return os.str();
+    }
+
+    inline bool string_equal(const String& s1, const String& s2, const CFStringCompareFlags compareOptions = 0)
+    {
+      return s1.defined() && s2.defined() && CFStringCompare(s1(), s2(), compareOptions) == kCFCompareEqualTo;
+    }
+
+    // property lists
+    inline Data plist(CFTypeRef obj)
+    {
+      return Data(CFPropertyListCreateData(kCFAllocatorDefault,
+					   obj,
+					   kCFPropertyListBinaryFormat_v1_0,
+					   0,
+					   nullptr));
+    }
+
+  } // namespace CF
+} // namespace openvpn
+
+#endif // OPENVPN_APPLECRYPTO_CF_CF_H

Sources/OpenVPN3/openvpn/apple/cf/cfhelper.hpp

@@ -0,0 +1,261 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFHELPER_H
+#define OPENVPN_APPLECRYPTO_CF_CFHELPER_H
+
+#include <openvpn/buffer/buffer.hpp>
+#include <openvpn/apple/cf/cf.hpp>
+
+// These methods build on the Wrapper classes for Apple Core Foundation objects
+// defined in cf.hpp.  They add additional convenience methods, such as dictionary
+// lookup.
+
+namespace openvpn {
+  namespace CF {
+
+    // essentially a vector of void *, used as source for array and dictionary constructors
+    typedef BufferAllocatedType<CFTypeRef, thread_unsafe_refcount> SrcList;
+
+    inline Array array(const SrcList& values)
+    {
+      return array((const void **)values.c_data(), values.size());
+    }
+
+    inline Dict dict(const SrcList& keys, const SrcList& values)
+    {
+      return dict((const void **)keys.c_data(), (const void **)values.c_data(), std::min(keys.size(), values.size()));
+    }
+
+    inline CFTypeRef mutable_dict_new()
+    {
+      return CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    }
+
+    inline CFTypeRef mutable_array_new()
+    {
+      return CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+    }
+
+    // Lookup or create (if absent) an item in a mutable dictionary.
+    // Return the item, which will be owned by base.
+    template <typename KEY>
+    inline CFTypeRef dict_get_create(CFMutableDictionaryRef base,
+				     const KEY& key,
+				     CFTypeRef (*create_method)())
+    {
+      if (base)
+	{
+	  String keystr = string(key);
+	  CFTypeRef ret = CFDictionaryGetValue(base, keystr()); // try lookup first
+	  if (!ret)
+	    {
+	      // doesn't exist, must create
+	      ret = (*create_method)();
+	      CFDictionaryAddValue(base, keystr(), ret);
+	      CFRelease(ret); // because ret is now owned by base
+	    }
+	  return ret;
+	}
+      return nullptr;
+    }
+
+    // lookup a dict in another dict (base) and return or create if absent
+    template <typename KEY>
+    inline MutableDict dict_get_create_dict(MutableDict& base, const KEY& key)
+    {
+      String keystr = string(key);
+      return mutable_dict_cast(dict_get_create(base(), keystr(), mutable_dict_new));
+    }
+
+    // lookup an array in a dict (base) and return or create if absent
+    template <typename KEY>
+    inline MutableArray dict_get_create_array(MutableDict& base, const KEY& key)
+    {
+      String keystr = string(key);
+      return mutable_array_cast(dict_get_create(base(), keystr(), mutable_array_new));
+    }
+
+    // lookup an object in a dictionary (DICT should be a Dict or a MutableDict)
+    template <typename DICT, typename KEY>
+    inline CFTypeRef dict_get_obj(const DICT& dict, const KEY& key)
+    {
+      return dict_index(dict, key);
+    }
+
+    // lookup a string in a dictionary (DICT should be a Dict or a MutableDict)
+    template <typename DICT, typename KEY>
+    inline std::string dict_get_str(const DICT& dict, const KEY& key)
+    {
+      return cppstring(string_cast(dict_index(dict, key)));
+    }
+
+    // lookup a string in a dictionary (DICT should be a Dict or a MutableDict)
+    template <typename DICT, typename KEY>
+    inline std::string dict_get_str(const DICT& dict, const KEY& key, const std::string& default_value)
+    {
+      String str(string_cast(dict_index(dict, key)));
+      if (str.defined())
+	return cppstring(str());
+      else
+	return default_value;
+    }
+
+    // lookup an integer in a dictionary (DICT should be a Dict or a MutableDict)
+    template <typename DICT, typename KEY>
+    inline int dict_get_int(const DICT& dict, const KEY& key, const int default_value)
+    {
+      int ret;
+      Number num = number_cast(dict_index(dict, key));
+      if (num.defined() && CFNumberGetValue(num(), kCFNumberIntType, &ret))
+	return ret;
+      else
+	return default_value;
+    }
+
+    // lookup a boolean in a dictionary (DICT should be a Dict or a MutableDict)
+    template <typename DICT, typename KEY>
+    inline bool dict_get_bool(const DICT& dict, const KEY& key, const bool default_value)
+    {
+      Bool b = bool_cast(dict_index(dict, key));
+      if (b.defined())
+	{
+	  if (b() == kCFBooleanTrue)
+	    return true;
+	  else if (b() == kCFBooleanFalse)
+	    return false;
+	}
+      return default_value;
+    }
+
+    // like CFDictionarySetValue, but no-op if any args are NULL
+    inline void dictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value)
+    {
+      if (theDict && key && value)
+	CFDictionarySetValue(theDict, key, value);
+    }
+
+    // like CFArrayAppendValue, but no-op if any args are NULL
+    inline void arrayAppendValue(CFMutableArrayRef theArray, const void *value)
+    {
+      if (theArray && value)
+	CFArrayAppendValue(theArray, value);
+    }
+
+    // set a CFTypeRef in a mutable dictionary
+    template <typename KEY>
+    inline void dict_set_obj(MutableDict& dict, const KEY& key, CFTypeRef value)
+    {
+      String keystr = string(key);
+      dictionarySetValue(dict(), keystr(), value);
+    }
+
+    // set a string in a mutable dictionary
+
+    template <typename KEY, typename VALUE>
+    inline void dict_set_str(MutableDict& dict, const KEY& key, const VALUE& value)
+    {
+      String keystr = string(key);
+      String valstr = string(value);
+      dictionarySetValue(dict(), keystr(), valstr());
+    }
+
+    // set a number in a mutable dictionary
+
+    template <typename KEY>
+    inline void dict_set_int(MutableDict& dict, const KEY& key, int value)
+    {
+      String keystr = string(key);
+      Number num = number_from_int(value);
+      dictionarySetValue(dict(), keystr(), num());
+    }
+
+    template <typename KEY>
+    inline void dict_set_int32(MutableDict& dict, const KEY& key, SInt32 value)
+    {
+      String keystr = string(key);
+      Number num = number_from_int32(value);
+      dictionarySetValue(dict(), keystr(), num());
+    }
+
+    template <typename KEY>
+    inline void dict_set_long_long(MutableDict& dict, const KEY& key, long long value)
+    {
+      String keystr = string(key);
+      Number num = number_from_long_long(value);
+      dictionarySetValue(dict(), keystr(), num());
+    }
+
+    template <typename KEY>
+    inline void dict_set_index(MutableDict& dict, const KEY& key, CFIndex value)
+    {
+      String keystr = string(key);
+      Number num = number_from_index(value);
+      dictionarySetValue((CFMutableDictionaryRef)dict(), keystr(), num());
+    }
+
+    // set a boolean in a mutable dictionary
+
+    template <typename KEY>
+    inline void dict_set_bool(MutableDict& dict, const KEY& key, bool value)
+    {
+      String keystr = string(key);
+      CFBooleanRef boolref = value ? kCFBooleanTrue : kCFBooleanFalse;
+      dictionarySetValue(dict(), keystr(), boolref);
+    }
+
+    // append string to a mutable array
+
+    template <typename VALUE>
+    inline void array_append_str(MutableArray& array, const VALUE& value)
+    {
+      String valstr = string(value);
+      arrayAppendValue(array(), valstr());
+    }
+
+    // append a number to a mutable array
+
+    inline void array_append_int(MutableArray& array, int value)
+    {
+      Number num = number_from_int(value);
+      arrayAppendValue(array(), num());
+    }
+
+    inline void array_append_int32(MutableArray& array, SInt32 value)
+    {
+      Number num = number_from_int32(value);
+      arrayAppendValue(array(), num());
+    }
+
+    inline void array_append_long_long(MutableArray& array, long long value)
+    {
+      Number num = number_from_long_long(value);
+      arrayAppendValue(array(), num());
+    }
+
+    inline void array_append_index(MutableArray& array, CFIndex value)
+    {
+      Number num = number_from_index(value);
+      arrayAppendValue(array(), num());
+    }
+  }
+}
+#endif

Sources/OpenVPN3/openvpn/apple/cf/cfhost.hpp

@@ -0,0 +1,33 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFHOST_H
+#define OPENVPN_APPLECRYPTO_CF_CFHOST_H
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(Host, host_cast, CFHostRef, CFHostGetTypeID)
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/cf/cfrunloop.hpp

@@ -0,0 +1,34 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFRUNLOOP_H
+#define OPENVPN_APPLECRYPTO_CF_CFRUNLOOP_H
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(RunLoop, runloop_cast, CFRunLoopRef, CFRunLoopGetTypeID)
+    OPENVPN_CF_WRAP(RunLoopSource, runloop_source_cast, CFRunLoopSourceRef, CFRunLoopSourceGetTypeID);
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/cf/cfsec.hpp

@@ -0,0 +1,58 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFSEC_H
+#define OPENVPN_APPLECRYPTO_CF_CFSEC_H
+
+#include <openvpn/common/platform.hpp>
+
+#include <Security/SecCertificate.h>
+#include <Security/SecIdentity.h>
+#include <Security/SecPolicy.h>
+#include <Security/SecTrust.h>
+
+#ifndef OPENVPN_PLATFORM_IPHONE
+#include <Security/SecKeychain.h>
+#include <Security/SecAccess.h>
+#endif
+
+#include <openvpn/common/size.hpp>
+#include <openvpn/common/exception.hpp>
+#include <openvpn/apple/cf/cf.hpp>
+
+// Define C++ wrappings for Apple security-related objects.
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(Cert, cert_cast, SecCertificateRef, SecCertificateGetTypeID)
+    OPENVPN_CF_WRAP(Key, key_cast, SecKeyRef, SecKeyGetTypeID)
+    OPENVPN_CF_WRAP(Identity, identity_cast, SecIdentityRef, SecIdentityGetTypeID)
+    OPENVPN_CF_WRAP(Policy, policy_cast, SecPolicyRef, SecPolicyGetTypeID)
+    OPENVPN_CF_WRAP(Trust, trust_cast, SecTrustRef, SecTrustGetTypeID)
+#ifndef OPENVPN_PLATFORM_IPHONE
+    OPENVPN_CF_WRAP(Keychain, keychain_cast, SecKeychainRef, SecKeychainGetTypeID)
+    OPENVPN_CF_WRAP(Access, access_cast, SecAccessRef, SecAccessGetTypeID)
+#endif
+  } // namespace CF
+
+} // namespace openvpn
+
+#endif // OPENVPN_APPLECRYPTO_CF_CFSEC_H

Sources/OpenVPN3/openvpn/apple/cf/cfsocket.hpp

@@ -0,0 +1,33 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFSTREAM_H
+#define OPENVPN_APPLECRYPTO_CF_CFSTREAM_H
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(Socket, socket_cast, CFSocketRef, CFSocketGetTypeID)
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/cf/cfstream.hpp

@@ -0,0 +1,34 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFSTREAM_H
+#define OPENVPN_APPLECRYPTO_CF_CFSTREAM_H
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(ReadStream, read_stream_cast, CFReadStreamRef, CFReadStreamGetTypeID)
+    OPENVPN_CF_WRAP(WriteStream, write_stream_cast, CFWriteStreamRef, CFWriteStreamGetTypeID)
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/cf/cftimer.hpp

@@ -0,0 +1,33 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_CFTIMER_H
+#define OPENVPN_APPLECRYPTO_CF_CFTIMER_H
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(Timer, timer_cast, CFRunLoopTimerRef, CFRunLoopTimerGetTypeID)
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/cf/error.hpp

@@ -0,0 +1,67 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_CF_ERROR_H
+#define OPENVPN_APPLECRYPTO_CF_ERROR_H
+
+#include <string>
+
+#include <CoreFoundation/CFBase.h>
+
+#include <openvpn/common/exception.hpp>
+
+// An exception object that encapsulates Apple Core Foundation errors.
+
+namespace openvpn {
+
+  // string exception class
+  class CFException : public std::exception
+  {
+  public:
+    CFException(const std::string& text)
+    {
+      errtxt = text;
+    }
+
+    CFException(const std::string& text, const OSStatus status)
+    {
+      set_errtxt(text, status);
+    }
+
+    virtual const char* what() const throw() { return errtxt.c_str(); }
+    std::string what_str() const { return errtxt; }
+
+    virtual ~CFException() throw() {}
+
+  private:
+    void set_errtxt(const std::string& text, const OSStatus status)
+    {
+      std::ostringstream s;
+      s << text << ": OSX Error code=" << status;
+      errtxt = s.str();
+    }
+
+    std::string errtxt;
+  };
+
+} // namespace openvpn
+
+#endif // OPENVPN_APPLECRYPTO_CF_ERROR_H

Sources/OpenVPN3/openvpn/apple/iosactiveiface.hpp

@@ -0,0 +1,74 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#include <string>
+
+#include <openvpn/apple/reach.hpp>
+#include <openvpn/netconf/enumiface.hpp>
+
+#ifndef OPENVPN_APPLECRYPTO_UTIL_IOSACTIVEIFACE_H
+#define OPENVPN_APPLECRYPTO_UTIL_IOSACTIVEIFACE_H
+
+namespace openvpn {
+
+  class iOSActiveInterface : public ReachabilityInterface
+  {
+  public:
+    virtual Status reachable() const
+    {
+      if (ei.iface_up("en0"))
+	return ReachableViaWiFi;
+      else if (ei.iface_up("pdp_ip0"))
+	return ReachableViaWWAN;
+      else
+	return NotReachable;
+    }
+
+    virtual bool reachableVia(const std::string& net_type) const
+    {
+      const Status r = reachable();
+      if (net_type == "cellular")
+	return r == ReachableViaWWAN;
+      else if (net_type == "wifi")
+	return r == ReachableViaWiFi;
+      else
+	return r != NotReachable;
+    }
+
+    virtual std::string to_string() const
+    {
+      switch (reachable())
+	{
+	case ReachableViaWiFi:
+	  return "ReachableViaWiFi";
+	case ReachableViaWWAN:
+	  return "ReachableViaWWAN";
+	case NotReachable:
+	  return "NotReachable";
+	}
+    }
+
+  private:
+    EnumIface ei;
+  };
+
+}
+#endif

Sources/OpenVPN3/openvpn/apple/maclife.hpp

@@ -0,0 +1,325 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLE_MACLIFE_H
+#define OPENVPN_APPLE_MACLIFE_H
+
+#include <string>
+#include <sstream>
+
+#include <thread>
+
+#include <openvpn/log/logthread.hpp>
+#include <openvpn/apple/cf/cftimer.hpp>
+#include <openvpn/apple/cf/cfhelper.hpp>
+#include <openvpn/apple/cf/cfrunloop.hpp>
+#include <openvpn/apple/reachable.hpp>
+#include <openvpn/client/clilife.hpp>
+#include <openvpn/apple/macsleep.hpp>
+#include <openvpn/apple/scdynstore.hpp>
+
+namespace openvpn {
+  class MacLifeCycle : public ClientLifeCycle, MacSleep, ReachabilityTracker
+  {
+  public:
+    OPENVPN_EXCEPTION(mac_lifecycle_error);
+
+    MacLifeCycle()
+      : ReachabilityTracker(true, false),
+	nc(nullptr),
+	thread(nullptr),
+	paused(false)
+    {
+    }
+
+    virtual ~MacLifeCycle()
+    {
+      stop_thread();
+    }
+
+    virtual bool network_available()
+    {
+      return net_up();
+    }
+
+    virtual void start(NotifyCallback* nc_arg)
+    {
+      if (!thread && nc_arg)
+	{
+	  nc = nc_arg;
+	  thread = new std::thread(&MacLifeCycle::thread_func, this);
+	}
+    }
+
+    virtual void stop()
+    {
+      stop_thread();
+    }
+
+  private:
+    struct State
+    {
+      State()
+	: net_up(false),
+	  sleep(false)
+      {
+      }
+
+      State(bool net_up_arg, const std::string& iface_arg, bool sleep_arg)
+	: net_up(net_up_arg),
+	  iface(iface_arg),
+	  sleep(sleep_arg)
+      {
+      }
+
+      bool operator==(const State& other) const
+      {
+	return net_up == other.net_up && iface == other.iface && sleep == other.sleep;
+      }
+
+      bool operator!=(const State& other) const
+      {
+	return !operator==(other);
+      }
+
+      std::string to_string() const
+      {
+	std::ostringstream os;
+	os << "[net_up=" << net_up << " iface=" << iface << " sleep=" << sleep << ']';
+	return os.str();
+      }
+
+      bool net_up;
+      std::string iface;
+      bool sleep;
+    };
+
+    void stop_thread()
+    {
+      if (thread)
+	{
+	  if (runloop.defined())
+	    CFRunLoopStop(runloop());
+	  thread->join();
+	  delete thread;
+	  thread = nullptr;
+	}
+    }
+
+    void thread_func()
+    {
+      runloop.reset(CFRunLoopGetCurrent(), CF::GET);
+      Log::Context logctx(logwrap);
+      try {
+	// set up dynamic store query object
+	dstore.reset(SCDynamicStoreCreate(kCFAllocatorDefault,
+					  CFSTR("OpenVPN_MacLifeCycle"),
+					  nullptr,
+					  nullptr));
+
+	// init state
+	state = State(net_up(), primary_interface(), false);
+	prev_state = state;
+	paused = false;
+
+	// enable sleep/wakeup notifications
+	mac_sleep_start();
+
+	// enable network reachability notifications
+	reachability_tracker_schedule();
+
+	// enable interface change notifications
+	iface_watch();
+
+	// process event loop until CFRunLoopStop is called from parent thread
+	CFRunLoopRun();
+      }
+      catch (const std::exception& e)
+	{
+	  OPENVPN_LOG("MacLifeCycle exception: " << e.what());
+	}
+
+      // cleanup
+      cancel_action_timer();
+      mac_sleep_stop();
+      reachability_tracker_cancel();
+      dstore.reset();
+    }
+
+    std::string primary_interface()
+    {
+      CF::Dict dict(CF::DynamicStoreCopyDict(dstore, "State:/Network/Global/IPv4"));
+      return CF::dict_get_str(dict, "PrimaryInterface");
+    }
+
+    bool net_up()
+    {
+      ReachabilityViaInternet r;
+      return ReachabilityViaInternet::status_from_flags(r.flags()) != ReachabilityInterface::NotReachable;
+    }
+
+    void iface_watch()
+    {
+      SCDynamicStoreContext context = {0, this, nullptr, nullptr, nullptr};
+      CF::DynamicStore ds(SCDynamicStoreCreate(kCFAllocatorDefault,
+					       CFSTR("OpenVPN_MacLifeCycle_iface_watch"),
+					       iface_watch_callback_static,
+					       &context));
+      if (!ds.defined())
+	throw mac_lifecycle_error("SCDynamicStoreCreate");
+      CF::MutableArray watched_keys(CF::mutable_array());
+      CF::array_append_str(watched_keys, "State:/Network/Global/IPv4");
+      //CF::array_append_str(watched_keys, "State:/Network/Global/IPv6");
+      if (!watched_keys.defined())
+	throw mac_lifecycle_error("watched_keys is undefined");
+      if (!SCDynamicStoreSetNotificationKeys(ds(),
+					     watched_keys(),
+					     nullptr))
+	throw mac_lifecycle_error("SCDynamicStoreSetNotificationKeys failed");
+      CF::RunLoopSource rls(SCDynamicStoreCreateRunLoopSource(kCFAllocatorDefault, ds(), 0));
+      if (!rls.defined())
+	throw mac_lifecycle_error("SCDynamicStoreCreateRunLoopSource failed");
+      CFRunLoopAddSource(CFRunLoopGetCurrent(), rls(), kCFRunLoopDefaultMode);
+    }
+
+    static void iface_watch_callback_static(SCDynamicStoreRef store, CFArrayRef changedKeys, void *arg)
+    {
+      MacLifeCycle *self = (MacLifeCycle *)arg;
+      self->iface_watch_callback(store, changedKeys);
+    }
+
+    void iface_watch_callback(SCDynamicStoreRef store, CFArrayRef changedKeys)
+    {
+      state.iface = primary_interface();
+      OPENVPN_LOG("MacLifeCycle NET_IFACE " << state.iface);
+      schedule_action_timer(1);
+    }
+
+    virtual void notify_sleep()
+    {
+      OPENVPN_LOG("MacLifeCycle SLEEP");
+      state.sleep = true;
+      schedule_action_timer(0);
+    }
+
+    virtual void notify_wakeup()
+    {
+      OPENVPN_LOG("MacLifeCycle WAKEUP");
+      state.sleep = false;
+      schedule_action_timer(1);
+    }
+
+    virtual void reachability_tracker_event(const ReachabilityBase& rb, SCNetworkReachabilityFlags flags)
+    {
+      if (rb.vtype() == ReachabilityBase::Internet)
+	{
+	  const ReachabilityBase::Status status = rb.vstatus(flags);
+	  state.net_up = (status != ReachabilityInterface::NotReachable);
+	  OPENVPN_LOG("MacLifeCycle NET_STATE " << state.net_up << " status=" << ReachabilityBase::render_status(status) << " flags=" << ReachabilityBase::render_flags(flags));
+	  schedule_action_timer(1);
+	}
+    }
+
+    void schedule_action_timer(const int seconds)
+    {
+      cancel_action_timer();
+      if (seconds)
+	{
+	  CFRunLoopTimerContext context = { 0, this, nullptr, nullptr, nullptr };
+	  action_timer.reset(CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + seconds, 0, 0, 0, action_timer_callback_static, &context));
+	  if (action_timer.defined())
+	    CFRunLoopAddTimer(CFRunLoopGetCurrent(), action_timer(), kCFRunLoopCommonModes);
+	  else
+	    OPENVPN_LOG("MacLifeCycle::schedule_action_timer: failed to create timer");
+	}
+      else
+	action_timer_callback(nullptr);
+    }
+
+    void cancel_action_timer()
+    {
+      if (action_timer.defined())
+	{
+	  CFRunLoopTimerInvalidate(action_timer());
+	  action_timer.reset(nullptr);
+	}
+    }
+
+    static void action_timer_callback_static(CFRunLoopTimerRef timer, void *info)
+    {
+      MacLifeCycle* self = (MacLifeCycle*)info;
+      self->action_timer_callback(timer);
+    }
+
+    void action_timer_callback(CFRunLoopTimerRef timer)
+    {
+      try {
+	if (state != prev_state)
+	  {
+	    OPENVPN_LOG("MacLifeCycle ACTION pause=" << paused << " state=" << state.to_string() << " prev=" << prev_state.to_string());
+	    if (paused)
+	      {
+		if (!state.sleep && state.net_up)
+		  {
+		    nc->cln_resume();
+		    paused = false;
+		  }
+	      }
+	    else
+	      {
+		if (state.sleep)
+		  {
+		    nc->cln_pause("sleep");
+		    paused = true;
+		  }
+		else if (!state.net_up)
+		  {
+		    nc->cln_pause("network-unavailable");
+		    paused = true;
+		  }
+		else
+		  {
+		    if (state.iface != prev_state.iface)
+		      nc->cln_reconnect(0);
+		  }
+	      }
+	    prev_state = state;
+	  }
+      }
+      catch (const std::exception& e)
+	{
+	  OPENVPN_LOG("MacLifeCycle::action_timer_callback exception: " << e.what());
+	}
+    }
+
+    NotifyCallback* nc;
+    std::thread* thread;
+    CF::RunLoop runloop;           // run loop in thread
+    CF::DynamicStore dstore;
+    State state;
+    State prev_state;
+    bool paused;
+    CF::Timer action_timer;
+    Log::Context::Wrapper logwrap; // used to carry forward the log context from parent thread
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/macsleep.hpp

@@ -0,0 +1,129 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLE_MACSLEEP_H
+#define OPENVPN_APPLE_MACSLEEP_H
+
+#include <mach/mach_port.h>
+#include <mach/mach_interface.h>
+#include <mach/mach_init.h>
+
+#include <IOKit/pwr_mgt/IOPMLib.h>
+#include <IOKit/IOMessage.h>
+
+#include <openvpn/common/size.hpp>
+
+namespace openvpn {
+  class MacSleep
+  {
+    MacSleep(const MacSleep&) = delete;
+    MacSleep& operator=(const MacSleep&) = delete;
+
+  public:
+    MacSleep()
+      : root_port(0),
+	notifyPortRef(nullptr),
+	notifierObject(0)
+    {
+    }
+
+    virtual ~MacSleep()
+    {
+      mac_sleep_stop();
+    }
+
+    bool mac_sleep_start()
+    {
+      if (!root_port)
+	{
+	  root_port = IORegisterForSystemPower(this, &notifyPortRef, callback_static, &notifierObject);
+	  if (!root_port)
+	    return false;
+	  CFRunLoopAddSource(CFRunLoopGetCurrent(), IONotificationPortGetRunLoopSource(notifyPortRef), kCFRunLoopCommonModes);
+	}
+      return true;
+    }
+
+    void mac_sleep_stop()
+    {
+      if (root_port)
+	{
+	  // remove the sleep notification port from the application runloop
+	  CFRunLoopRemoveSource(CFRunLoopGetCurrent(),
+				IONotificationPortGetRunLoopSource(notifyPortRef),
+				kCFRunLoopCommonModes);
+
+	  // deregister for system sleep notifications
+	  IODeregisterForSystemPower(&notifierObject);
+
+	  // IORegisterForSystemPower implicitly opens the Root Power Domain IOService
+	  // so we close it here
+	  IOServiceClose(root_port);
+
+	  // destroy the notification port allocated by IORegisterForSystemPower
+	  IONotificationPortDestroy(notifyPortRef);
+
+	  // reset object members
+	  root_port = 0;
+	  notifyPortRef = nullptr;
+	  notifierObject = 0;
+	}
+    }
+
+    virtual void notify_sleep() = 0;
+    virtual void notify_wakeup() = 0;
+
+  private:
+    static void callback_static(void* arg, io_service_t service, natural_t messageType, void *messageArgument)
+    {
+      MacSleep* self = (MacSleep*)arg;
+      self->callback(service, messageType, messageArgument);
+    }
+
+    void callback(io_service_t service, natural_t messageType, void *messageArgument)
+    {
+      switch (messageType)
+	{
+        case kIOMessageCanSystemSleep:
+	  IOAllowPowerChange(root_port, (long)messageArgument);
+	  break;
+        case kIOMessageSystemWillSleep:
+	  notify_sleep();
+	  IOAllowPowerChange(root_port, (long)messageArgument);
+	  break;
+	case kIOMessageSystemHasPoweredOn:
+	  notify_wakeup();
+	  break;
+	}
+    }
+
+    // a reference to the Root Power Domain IOService
+    io_connect_t root_port;
+
+    // notification port allocated by IORegisterForSystemPower
+    IONotificationPortRef notifyPortRef;
+
+    // notifier object, used to deregister later
+    io_object_t notifierObject;
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/macver.hpp

@@ -0,0 +1,75 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLE_MACVER_H
+#define OPENVPN_APPLE_MACVER_H
+
+#include <errno.h>
+#include <sys/sysctl.h>
+
+#include <string>
+#include <sstream>
+#include <vector>
+
+#include <openvpn/common/split.hpp>
+#include <openvpn/common/number.hpp>
+#include <openvpn/apple/ver.hpp>
+
+namespace openvpn {
+  namespace Mac {
+    class Version : public AppleVersion
+    {
+    public:
+      // Mac OS X versions
+      // 15.x.x  OS X 10.11.x El Capitan
+      // 14.x.x  OS X 10.10.x Yosemite
+      // 13.x.x  OS X 10.9.x Mavericks
+      // 12.x.x  OS X 10.8.x Mountain Lion
+      // 11.x.x  OS X 10.7.x Lion
+      // 10.x.x  OS X 10.6.x Snow Leopard
+      //  9.x.x  OS X 10.5.x Leopard
+      //  8.x.x  OS X 10.4.x Tiger
+      //  7.x.x  OS X 10.3.x Panther
+      //  6.x.x  OS X 10.2.x Jaguar
+      //  5.x    OS X 10.1.x Puma
+
+      enum {
+	OSX_10_11=15,
+	OSX_10_10=14,
+	OSX_10_9=13,
+	OSX_10_8=12,
+	OSX_10_7=11,
+	OSX_10_6=10,
+      };
+
+      Version()
+      {
+	char str[256];
+	size_t size = sizeof(str);
+	int ret = sysctlbyname("kern.osrelease", str, &size, nullptr, 0);
+	if (!ret)
+	  init(std::string(str, size));
+      }
+    };
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/reach.hpp

@@ -0,0 +1,43 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLECRYPTO_UTIL_REACH_H
+#define OPENVPN_APPLECRYPTO_UTIL_REACH_H
+
+// An interface to various network reachability implementations,
+// primarily for iOS.
+
+namespace openvpn {
+  struct ReachabilityInterface
+  {
+    enum Status {
+      NotReachable,
+      ReachableViaWiFi,
+      ReachableViaWWAN
+    };
+
+    virtual Status reachable() const = 0;
+    virtual bool reachableVia(const std::string& net_type) const = 0;
+    virtual std::string to_string() const = 0;
+    virtual ~ReachabilityInterface() {}
+  };
+}
+#endif

Sources/OpenVPN3/openvpn/apple/reachable.hpp

@@ -0,0 +1,468 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+//
+//  This code is derived from the Apple sample Reachability.m under
+//  the following license.
+//
+// Disclaimer: IMPORTANT:  This Apple software is supplied to you by Apple
+// Inc. ("Apple") in consideration of your agreement to the following
+// terms, and your use, installation, modification or redistribution of
+// this Apple software constitutes acceptance of these terms.  If you do
+// not agree with these terms, please do not use, install, modify or
+// redistribute this Apple software.
+//
+// In consideration of your agreement to abide by the following terms, and
+// subject to these terms, Apple grants you a personal, non-exclusive
+// license, under Apple's copyrights in this original Apple software (the
+// "Apple Software"), to use, reproduce, modify and redistribute the Apple
+// Software, with or without modifications, in source and/or binary forms;
+// provided that if you redistribute the Apple Software in its entirety and
+// without modifications, you must retain this notice and the following
+// text and disclaimers in all such redistributions of the Apple Software.
+// Neither the name, trademarks, service marks or logos of Apple Inc. may
+// be used to endorse or promote products derived from the Apple Software
+// without specific prior written permission from Apple.  Except as
+// expressly stated in this notice, no other rights or licenses, express or
+// implied, are granted by Apple herein, including but not limited to any
+// patent rights that may be infringed by your derivative works or by other
+// works in which the Apple Software may be incorporated.
+//
+// The Apple Software is provided by Apple on an "AS IS" basis.  APPLE
+// MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
+// THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS
+// FOR A PARTICULAR PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND
+// OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS.
+//
+// IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL
+// OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION,
+// MODIFICATION AND/OR DISTRIBUTION OF THE APPLE SOFTWARE, HOWEVER CAUSED
+// AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE),
+// STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE
+// POSSIBILITY OF SUCH DAMAGE.
+//
+// Copyright (C) 2013 Apple Inc. All Rights Reserved.
+
+// Wrapper for Apple SCNetworkReachability methods.
+
+#ifndef OPENVPN_APPLECRYPTO_UTIL_REACHABLE_H
+#define OPENVPN_APPLECRYPTO_UTIL_REACHABLE_H
+
+#import "TargetConditionals.h"
+
+#include <netinet/in.h>
+#include <SystemConfiguration/SCNetworkReachability.h>
+
+#include <string>
+#include <sstream>
+#include <memory>
+
+#include <openvpn/common/socktypes.hpp>
+#include <openvpn/apple/cf/cf.hpp>
+#include <openvpn/apple/reach.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(NetworkReachability, network_reachability_cast, SCNetworkReachabilityRef, SCNetworkReachabilityGetTypeID);
+  }
+
+  class ReachabilityBase
+  {
+  public:
+    typedef ReachabilityInterface::Status Status;
+
+    enum Type {
+      Internet,
+      WiFi,
+    };
+
+    std::string to_string() const
+    {
+      return to_string(flags());
+    }
+
+    std::string to_string(const SCNetworkReachabilityFlags f) const
+    {
+      const Status s = vstatus(f);
+      const Type t = vtype();
+
+      std::string ret;
+      ret += render_type(t);
+      ret += ':';
+      ret += render_status(s);
+      ret += '/';
+      ret += render_flags(f);
+      return ret;
+    }
+
+    Status status() const
+    {
+      return vstatus(flags());
+    }
+
+    SCNetworkReachabilityFlags flags() const
+    {
+      SCNetworkReachabilityFlags f = 0;
+      if (SCNetworkReachabilityGetFlags(reach(), &f) == TRUE)
+	return f;
+      else
+	return 0;
+    }
+
+    static std::string render_type(Type type)
+    {
+      switch (type) {
+      case Internet:
+	return "Internet";
+      case WiFi:
+	return "WiFi";
+      default:
+	return "Type???";
+      }
+    }
+
+    static std::string render_status(const Status status)
+    {
+      switch (status) {
+      case ReachabilityInterface::NotReachable:
+	return "NotReachable";
+      case ReachabilityInterface::ReachableViaWiFi:
+	return "ReachableViaWiFi";
+      case ReachabilityInterface::ReachableViaWWAN:
+	return "ReachableViaWWAN";
+      default:
+	return "ReachableVia???";
+      }
+    }
+
+    static std::string render_flags(const SCNetworkReachabilityFlags flags)
+    {
+      std::string ret;
+#if TARGET_OS_IPHONE || TARGET_IPHONE_SIMULATOR // Mac OS X doesn't define WWAN flags
+      if (flags & kSCNetworkReachabilityFlagsIsWWAN)
+	ret += 'W';
+      else
+#endif
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsReachable)
+	ret += 'R';
+      else
+	ret += '-';
+      ret += ' ';
+      if (flags & kSCNetworkReachabilityFlagsTransientConnection)
+	ret += 't';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsConnectionRequired)
+	ret += 'c';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsConnectionOnTraffic)
+	ret += 'C';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsInterventionRequired)
+	ret += 'i';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsConnectionOnDemand)
+	ret += 'D';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsIsLocalAddress)
+	ret += 'l';
+      else
+	ret += '-';
+      if (flags & kSCNetworkReachabilityFlagsIsDirect)
+	ret += 'd';
+      else
+	ret += '-';
+      return ret;
+    }
+
+    virtual Type vtype() const = 0;
+    virtual Status vstatus(const SCNetworkReachabilityFlags flags) const = 0;
+
+    virtual ~ReachabilityBase() {}
+
+    CF::NetworkReachability reach;
+  };
+
+  class ReachabilityViaInternet : public ReachabilityBase
+  {
+  public:
+    ReachabilityViaInternet()
+    {
+      struct sockaddr_in addr;
+      bzero(&addr, sizeof(addr));
+      addr.sin_len = sizeof(addr);
+      addr.sin_family = AF_INET;
+      reach.reset(SCNetworkReachabilityCreateWithAddress(kCFAllocatorDefault, (struct sockaddr*)&addr));
+    }
+
+    virtual Type vtype() const
+    {
+      return Internet;
+    }
+
+    virtual Status vstatus(const SCNetworkReachabilityFlags flags) const
+    {
+      return status_from_flags(flags);
+    }
+
+    static Status status_from_flags(const SCNetworkReachabilityFlags flags)
+    {
+      if ((flags & kSCNetworkReachabilityFlagsReachable) == 0)
+	{
+	  // The target host is not reachable.
+	  return ReachabilityInterface::NotReachable;
+	}
+
+      Status ret = ReachabilityInterface::NotReachable;
+
+      if ((flags & kSCNetworkReachabilityFlagsConnectionRequired) == 0)
+	{
+	  // If the target host is reachable and no connection is required then
+	  // we'll assume (for now) that you're on Wi-Fi...
+	  ret = ReachabilityInterface::ReachableViaWiFi;
+	}
+
+#if 0 // don't contaminate result by considering on-demand viability
+      if ((((flags & kSCNetworkReachabilityFlagsConnectionOnDemand ) != 0) ||
+	   (flags & kSCNetworkReachabilityFlagsConnectionOnTraffic) != 0))
+	{
+	  // ... and the connection is on-demand (or on-traffic) if the
+	  //     calling application is using the CFSocketStream or higher APIs...
+
+	  if ((flags & kSCNetworkReachabilityFlagsInterventionRequired) == 0)
+	    {
+	      // ... and no [user] intervention is needed...
+	      ret = ReachabilityInterface::ReachableViaWiFi;
+	    }
+	}
+#endif
+
+#if TARGET_OS_IPHONE || TARGET_IPHONE_SIMULATOR // Mac OS X doesn't define WWAN flags
+      if ((flags & kSCNetworkReachabilityFlagsIsWWAN) == kSCNetworkReachabilityFlagsIsWWAN)
+	{
+	  // ... but WWAN connections are OK if the calling application
+	  // is using the CFNetwork APIs.
+	  ret = ReachabilityInterface::ReachableViaWWAN;
+	}
+#endif
+
+      return ret;
+    }
+  };
+
+  class ReachabilityViaWiFi : public ReachabilityBase
+  {
+  public:
+    ReachabilityViaWiFi()
+    {
+      struct sockaddr_in addr;
+      bzero(&addr, sizeof(addr));
+      addr.sin_len = sizeof(addr);
+      addr.sin_family = AF_INET;
+      addr.sin_addr.s_addr = htonl(IN_LINKLOCALNETNUM); // 169.254.0.0.
+      reach.reset(SCNetworkReachabilityCreateWithAddress(kCFAllocatorDefault, (struct sockaddr*)&addr));
+    }
+
+    virtual Type vtype() const
+    {
+      return WiFi;
+    }
+
+    virtual Status vstatus(const SCNetworkReachabilityFlags flags) const
+    {
+      return status_from_flags(flags);
+    }
+
+    static Status status_from_flags(const SCNetworkReachabilityFlags flags)
+    {
+      Status ret = ReachabilityInterface::NotReachable;
+      if ((flags & kSCNetworkReachabilityFlagsReachable) && (flags & kSCNetworkReachabilityFlagsIsDirect))
+	ret = ReachabilityInterface::ReachableViaWiFi;
+      return ret;
+    }
+  };
+
+  class Reachability : public ReachabilityInterface
+  {
+  public:
+    Reachability(const bool enable_internet, const bool enable_wifi)
+    {
+      if (enable_internet)
+	internet.reset(new ReachabilityViaInternet);
+      if (enable_wifi)
+	wifi.reset(new ReachabilityViaWiFi);
+    }
+
+    bool reachableViaWiFi() const {
+      if (internet)
+	{
+	  if (wifi)
+	    return internet->status() == ReachableViaWiFi && wifi->status() == ReachableViaWiFi;
+	  else
+	    return internet->status() == ReachableViaWiFi;
+	}
+      else
+	{
+	  if (wifi)
+	    return wifi->status() == ReachableViaWiFi;
+	  else
+	    return false;
+	}
+    }
+
+    bool reachableViaCellular() const
+    {
+      if (internet)
+	return internet->status() == ReachableViaWWAN;
+      else
+	return false;
+    }
+
+    virtual Status reachable() const
+    {
+      if (reachableViaWiFi())
+	return ReachableViaWiFi;
+      else if (reachableViaCellular())
+	return ReachableViaWWAN;
+      else
+	return NotReachable;
+    }
+
+    virtual bool reachableVia(const std::string& net_type) const
+    {
+      if (net_type == "cellular")
+	return reachableViaCellular();
+      else if (net_type == "wifi")
+	return reachableViaWiFi();
+      else
+	return reachableViaWiFi() || reachableViaCellular();
+    }
+
+    virtual std::string to_string() const
+    {
+      std::string ret;
+      if (internet)
+	ret += internet->to_string();
+      if (internet && wifi)
+	ret += ' ';
+      if (wifi)
+	ret += wifi->to_string();
+      return ret;
+    }
+
+    std::unique_ptr<ReachabilityViaInternet> internet;
+    std::unique_ptr<ReachabilityViaWiFi> wifi;
+  };
+
+  class ReachabilityTracker
+  {
+  public:
+    ReachabilityTracker(const bool enable_internet, const bool enable_wifi)
+      : reachability(enable_internet, enable_wifi),
+	scheduled(false)
+    {
+    }
+
+    void reachability_tracker_schedule()
+    {
+      if (!scheduled)
+	{
+	  if (reachability.internet)
+	    schedule(*reachability.internet, internet_callback_static);
+	  if (reachability.wifi)
+	    schedule(*reachability.wifi, wifi_callback_static);
+	  scheduled = true;
+	}
+    }
+
+    void reachability_tracker_cancel()
+    {
+      if (scheduled)
+	{
+	  if (reachability.internet)
+	    cancel(*reachability.internet);
+	  if (reachability.wifi)
+	    cancel(*reachability.wifi);
+	  scheduled = false;
+	}
+    }
+
+    virtual void reachability_tracker_event(const ReachabilityBase& rb, SCNetworkReachabilityFlags flags) = 0;
+
+    virtual ~ReachabilityTracker()
+    {
+      reachability_tracker_cancel();
+    }
+
+  private:
+    bool schedule(ReachabilityBase& rb, SCNetworkReachabilityCallBack cb)
+    {
+      SCNetworkReachabilityContext context = { 0, this, nullptr, nullptr, nullptr };
+      if (rb.reach.defined())
+	{
+	  if (SCNetworkReachabilitySetCallback(rb.reach(),
+					       cb,
+					       &context) == FALSE)
+	    return false;
+	  if (SCNetworkReachabilityScheduleWithRunLoop(rb.reach(),
+						       CFRunLoopGetCurrent(),
+						       kCFRunLoopCommonModes) == FALSE)
+	    return false;
+	  return true;
+	}
+      else
+	return false;
+    }
+
+    void cancel(ReachabilityBase& rb)
+    {
+      if (rb.reach.defined())
+	SCNetworkReachabilityUnscheduleFromRunLoop(rb.reach(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+    }
+
+    static void internet_callback_static(SCNetworkReachabilityRef target,
+					 SCNetworkReachabilityFlags flags,
+					 void *info)
+    {
+      ReachabilityTracker* self = (ReachabilityTracker*)info;
+      self->reachability_tracker_event(*self->reachability.internet, flags);
+    }
+
+    static void wifi_callback_static(SCNetworkReachabilityRef target,
+				     SCNetworkReachabilityFlags flags,
+				     void *info)
+    {
+      ReachabilityTracker* self = (ReachabilityTracker*)info;
+      self->reachability_tracker_event(*self->reachability.wifi, flags);
+    }
+
+    Reachability reachability;
+    bool scheduled;
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/scdynstore.hpp

@@ -0,0 +1,52 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLE_SCDYNSTORE_H
+#define OPENVPN_APPLE_SCDYNSTORE_H
+
+#include <SystemConfiguration/SCDynamicStore.h>
+
+#include <openvpn/apple/cf/cf.hpp>
+
+namespace openvpn {
+  namespace CF {
+    OPENVPN_CF_WRAP(DynamicStore, dynamic_store_cast, SCDynamicStoreRef, SCDynamicStoreGetTypeID)
+
+    template <typename RET, typename KEY>
+    inline RET DynamicStoreCopy(const DynamicStore& ds, const KEY& key)
+    {
+      String keystr = string(key);
+      return RET(RET::cast(SCDynamicStoreCopyValue(ds(), keystr())));
+    }
+
+    template <typename KEY>
+    inline Dict DynamicStoreCopyDict(const DynamicStore& ds, const KEY& key)
+    {
+      Dict dict = DynamicStoreCopy<Dict>(ds, key);
+      if (dict.defined())
+	return dict;
+      else
+	return CF::empty_dict();
+    }
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/apple/ver.hpp

@@ -0,0 +1,81 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_APPLE_VER_H
+#define OPENVPN_APPLE_VER_H
+
+#include <errno.h>
+#include <sys/sysctl.h>
+
+#include <string>
+#include <sstream>
+#include <vector>
+
+#include <openvpn/common/split.hpp>
+#include <openvpn/common/number.hpp>
+
+namespace openvpn {
+  class AppleVersion
+  {
+  public:
+    int major() const { return ver[0]; }
+    int minor() const { return ver[1]; }
+    int build() const { return ver[2]; }
+
+    std::string to_string() const
+    {
+      std::ostringstream os;
+      os << major() << '.' << minor() << '.' << build();
+      return os.str();
+    }
+
+  protected:
+    AppleVersion()
+    {
+      reset();
+    }
+
+    // verstr should be in the form major.minor.build
+    void init(const std::string& verstr)
+    {
+      typedef std::vector<std::string> StringList;
+      reset();
+      StringList sl;
+      sl.reserve(3);
+      Split::by_char_void<StringList, NullLex, Split::NullLimit>(sl, verstr, '.');
+      for (size_t i = 0; i < 3; ++i)
+	{
+	  if (i < sl.size())
+	    parse_number(sl[i], ver[i]);
+	}
+    }
+
+  private:
+    void reset()
+    {
+      ver[0] = ver[1] = ver[2] = -1;
+    }
+
+    int ver[3];
+  };
+}
+
+#endif