Merge commit '86cc97e55fe346502462284d2e636a2b3708163e' as 'Sources/OpenVPN3'

Sources/OpenVPN3/openvpn/tun/builder/base.hpp

@@ -0,0 +1,254 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_TUN_BUILDER_BASE_H
+#define OPENVPN_TUN_BUILDER_BASE_H
+
+#include <string>
+
+namespace openvpn {
+  class TunBuilderBase
+  {
+  public:
+    // Tun builder methods, loosely based on the Android VpnService.Builder
+    // abstraction.  These methods comprise an abstraction layer that
+    // allows the OpenVPN C++ core to call out to external methods for
+    // establishing the tunnel, adding routes, etc.
+
+    // All methods returning bool use the return
+    // value to indicate success (true) or fail (false).
+    // tun_builder_new() should be called first, then arbitrary setter methods,
+    // and finally tun_builder_establish to return the socket descriptor
+    // for the session.  IP addresses are pre-validated before being passed to
+    // these methods.
+    // This interface is based on Android's VpnService.Builder.
+
+    // Callback to construct a new tun builder
+    // Should be called first.
+    virtual bool tun_builder_new()
+    {
+      return false;
+    }
+
+    // Optional callback that indicates OSI layer, should be 2 or 3.
+    // Defaults to 3.
+    virtual bool tun_builder_set_layer(int layer)
+    {
+      return true;
+    }
+
+    // Callback to set address of remote server
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_remote_address(const std::string& address, bool ipv6)
+    {
+      return false;
+    }
+
+    // Callback to add network address to VPN interface
+    // May be called more than once per tun_builder session
+    virtual bool tun_builder_add_address(const std::string& address,
+					 int prefix_length,
+					 const std::string& gateway, // optional
+					 bool ipv6,
+					 bool net30)
+    {
+      return false;
+    }
+
+    // Optional callback to set default value for route metric.
+    // Guaranteed to be called before other methods that deal
+    // with routes such as tun_builder_add_route and
+    // tun_builder_reroute_gw.  Route metric is ignored
+    // if < 0.
+    virtual bool tun_builder_set_route_metric_default(int metric)
+    {
+      return true;
+    }
+
+    // Callback to reroute default gateway to VPN interface.
+    // ipv4 is true if the default route to be added should be IPv4.
+    // ipv6 is true if the default route to be added should be IPv6.
+    // flags are defined in RGWFlags (rgwflags.hpp).
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_reroute_gw(bool ipv4,
+					bool ipv6,
+					unsigned int flags)
+    {
+      return false;
+    }
+
+    // Callback to add route to VPN interface
+    // May be called more than once per tun_builder session
+    // metric is optional and should be ignored if < 0
+    virtual bool tun_builder_add_route(const std::string& address,
+				       int prefix_length,
+				       int metric,
+				       bool ipv6)
+    {
+      return false;
+    }
+
+    // Callback to exclude route from VPN interface
+    // May be called more than once per tun_builder session
+    // metric is optional and should be ignored if < 0
+    virtual bool tun_builder_exclude_route(const std::string& address,
+					   int prefix_length,
+					   int metric,
+					   bool ipv6)
+    {
+      return false;
+    }
+
+    // Callback to add DNS server to VPN interface
+    // May be called more than once per tun_builder session
+    // If reroute_dns is true, all DNS traffic should be routed over the
+    // tunnel, while if false, only DNS traffic that matches an added search
+    // domain should be routed.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    virtual bool tun_builder_add_dns_server(const std::string& address, bool ipv6)
+    {
+      return false;
+    }
+
+    // Callback to add search domain to DNS resolver
+    // May be called more than once per tun_builder session
+    // See tun_builder_add_dns_server above for description of
+    // reroute_dns parameter.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    virtual bool tun_builder_add_search_domain(const std::string& domain)
+    {
+      return false;
+    }
+
+    // Callback to set MTU of the VPN interface
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_mtu(int mtu)
+    {
+      return false;
+    }
+
+    // Callback to set the session name
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_session_name(const std::string& name)
+    {
+      return false;
+    }
+
+    // Callback to add a host which should bypass the proxy
+    // May be called more than once per tun_builder session
+    virtual bool tun_builder_add_proxy_bypass(const std::string& bypass_host)
+    {
+      return false;
+    }
+
+    // Callback to set the proxy "Auto Config URL"
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_proxy_auto_config_url(const std::string& url)
+    {
+      return false;
+    }
+
+    // Callback to set the HTTP proxy
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_proxy_http(const std::string& host, int port)
+    {
+      return false;
+    }
+
+    // Callback to set the HTTPS proxy
+    // Never called more than once per tun_builder session.
+    virtual bool tun_builder_set_proxy_https(const std::string& host, int port)
+    {
+      return false;
+    }
+
+    // Callback to add Windows WINS server to VPN interface.
+    // WINS server addresses are always IPv4.
+    // May be called more than once per tun_builder session.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    virtual bool tun_builder_add_wins_server(const std::string& address)
+    {
+      return false;
+    }
+
+    // Optional callback that indicates whether IPv6 traffic should be
+    // blocked, to prevent unencrypted IPv6 packet leakage when the
+    // tunnel is IPv4-only, but the local machine has IPv6 connectivity
+    // to the internet.  Enabled by "block-ipv6" config var.
+    virtual bool tun_builder_set_block_ipv6(bool block_ipv6)
+    {
+      return true;
+    }
+
+    // Optional callback to set a DNS suffix on tun/tap adapter.
+    // Currently only implemented on Windows, where it will
+    // set the "Connection-specific DNS Suffix" property on
+    // the TAP driver.
+    virtual bool tun_builder_set_adapter_domain_suffix(const std::string& name)
+    {
+      return true;
+    }
+
+    // Callback to establish the VPN tunnel, returning a file descriptor
+    // to the tunnel, which the caller will henceforth own.  Returns -1
+    // if the tunnel could not be established.
+    // Always called last after tun_builder session has been configured.
+    virtual int tun_builder_establish()
+    {
+      return -1;
+    }
+
+    // Return true if tun interface may be persisted, i.e. rolled
+    // into a new session with properties untouched.  This method
+    // is only called after all other tests of persistence
+    // allowability succeed, therefore it can veto persistence.
+    // If persistence is ultimately enabled,
+    // tun_builder_establish_lite() will be called.  Otherwise,
+    // tun_builder_establish() will be called.
+    virtual bool tun_builder_persist()
+    {
+      return true;
+    }
+
+    // When the exclude local network option is enabled this
+    // function is called to get a list of local networks so routes
+    // to exclude them from the VPN network are generated
+    // This should be a list of CIDR networks (e.g. 192.168.0.0/24)
+    virtual const std::vector<std::string> tun_builder_get_local_networks(bool ipv6)
+    {
+      return {};
+    }
+
+    // Indicates a reconnection with persisted tun state.
+    virtual void tun_builder_establish_lite()
+    {
+    }
+
+    // Indicates that tunnel is being torn down.
+    // If disconnect == true, then the teardown is occurring
+    // prior to final disconnect.
+    virtual void tun_builder_teardown(bool disconnect) {}
+
+    virtual ~TunBuilderBase() {}
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/builder/capture.hpp

@@ -0,0 +1,821 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// An artificial TunBuilder object, used to log the tun builder settings,
+// but doesn't actually configure anything.
+
+#ifndef OPENVPN_TUN_BUILDER_CAPTURE_H
+#define OPENVPN_TUN_BUILDER_CAPTURE_H
+
+#include <string>
+#include <sstream>
+#include <vector>
+
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/rc.hpp>
+#include <openvpn/common/size.hpp>
+#include <openvpn/common/hostport.hpp>
+#include <openvpn/common/to_string.hpp>
+#include <openvpn/common/jsonlib.hpp>
+#include <openvpn/tun/builder/base.hpp>
+#include <openvpn/client/rgopt.hpp>
+#include <openvpn/addr/ip.hpp>
+#include <openvpn/addr/route.hpp>
+#include <openvpn/http/urlparse.hpp>
+#include <openvpn/tun/layer.hpp>
+
+#ifdef HAVE_JSON
+#include <openvpn/common/jsonhelper.hpp>
+#endif
+
+namespace openvpn {
+  class TunBuilderCapture : public TunBuilderBase, public RC<thread_unsafe_refcount>
+  {
+  public:
+    typedef RCPtr<TunBuilderCapture> Ptr;
+
+    // builder data classes
+
+    class RemoteAddress
+    {
+    public:
+      std::string address;
+      bool ipv6 = false;
+
+      std::string to_string() const
+      {
+	std::string ret = address;
+	if (ipv6)
+	  ret += " [IPv6]";
+	return ret;
+      }
+
+      bool defined() const
+      {
+	return !address.empty();
+      }
+
+      void validate(const std::string& title) const
+      {
+	IP::Addr(address, title, ipv6 ? IP::Addr::V6 : IP::Addr::V4);
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["address"] = Json::Value(address);
+	root["ipv6"] = Json::Value(ipv6);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	if (!json::is_dict(root, title))
+	  return;
+	json::to_string(root, address, "address", title);
+	json::to_bool(root, ipv6, "ipv6", title);
+      }
+#endif
+    };
+
+    class RerouteGW
+    {
+    public:
+      bool ipv4 = false;
+      bool ipv6 = false;
+      unsigned int flags = 0;
+
+      std::string to_string() const
+      {
+	std::ostringstream os;
+	const RedirectGatewayFlags rgf(flags);
+	os << "IPv4=" << ipv4 << " IPv6=" << ipv6 << " flags=" << rgf.to_string();
+	return os.str();
+      }
+
+      void validate(const std::string& title) const
+      {
+	// nothing to validate
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["ipv4"] = Json::Value(ipv4);
+	root["ipv6"] = Json::Value(ipv6);
+	root["flags"] = Json::Value((Json::UInt)flags);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_bool(root, ipv4, "ipv4", title);
+	json::to_bool(root, ipv6, "ipv6", title);
+	json::to_uint(root, flags, "flags", title);
+      }
+#endif
+    };
+
+    class RouteBase
+    {
+    public:
+      std::string address;
+      int prefix_length = 0;
+      int metric = -1;     // optional
+      std::string gateway; // optional
+      bool ipv6 = false;
+      bool net30 = false;
+
+      std::string to_string() const
+      {
+	std::ostringstream os;
+	os << address << '/' << prefix_length;
+	if (!gateway.empty())
+	  os << " -> " << gateway;
+	if (metric >= 0)
+	  os << " [METRIC=" << metric << ']';
+	if (ipv6)
+	  os << " [IPv6]";
+	if (net30)
+	  os << " [net30]";
+	return os.str();
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["address"] = Json::Value(address);
+	root["prefix_length"] = Json::Value(prefix_length);
+	root["metric"] = Json::Value(metric);
+	root["gateway"] = Json::Value(gateway);
+	root["ipv6"] = Json::Value(ipv6);
+	root["net30"] = Json::Value(net30);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_string(root, address, "address", title);
+	json::to_int(root, prefix_length, "prefix_length", title);
+	json::to_int(root, metric, "metric", title);
+	json::to_string(root, gateway, "gateway", title);
+	json::to_bool(root, ipv6, "ipv6", title);
+	json::to_bool(root, net30, "net30", title);
+      }
+#endif
+
+    protected:
+      void validate_(const std::string& title, const bool require_canonical) const
+      {
+	const IP::Addr::Version ver = ipv6 ? IP::Addr::V6 : IP::Addr::V4;
+	const IP::Route route = IP::route_from_string_prefix(address, prefix_length, title, ver);
+	if (require_canonical && !route.is_canonical())
+	  OPENVPN_THROW_EXCEPTION(title << " : not a canonical route: " << route);
+	if (!gateway.empty())
+	  IP::Addr(gateway, title + ".gateway", ver);
+	if (net30 && route.prefix_len != 30)
+	  OPENVPN_THROW_EXCEPTION(title << " : not a net30 route: " << route);
+      }
+    };
+
+    class RouteAddress : public RouteBase // may be non-canonical
+    {
+    public:
+      void validate(const std::string& title) const
+      {
+	validate_(title, false);
+      }
+    };
+
+    class Route : public RouteBase // must be canonical
+    {
+    public:
+      void validate(const std::string& title) const
+      {
+	validate_(title, true);
+      }
+    };
+
+    class DNSServer
+    {
+    public:
+      std::string address;
+      bool ipv6 = false;
+
+      std::string to_string() const
+      {
+	std::string ret = address;
+	if (ipv6)
+	  ret += " [IPv6]";
+	return ret;
+      }
+
+      void validate(const std::string& title) const
+      {
+	IP::Addr(address, title, ipv6 ? IP::Addr::V6 : IP::Addr::V4);
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["address"] = Json::Value(address);
+	root["ipv6"] = Json::Value(ipv6);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_string(root, address, "address", title);
+	json::to_bool(root, ipv6, "ipv6", title);
+      }
+#endif
+    };
+
+    class SearchDomain
+    {
+    public:
+      std::string domain;
+
+      std::string to_string() const
+      {
+	return domain;
+      }
+
+      void validate(const std::string& title) const
+      {
+	HostPort::validate_host(domain, title);
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["domain"] = Json::Value(domain);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_string(root, domain, "domain", title);
+      }
+#endif
+    };
+
+    class ProxyBypass
+    {
+    public:
+      std::string bypass_host;
+
+      std::string to_string() const
+      {
+	return bypass_host;
+      }
+
+      bool defined() const
+      {
+	return !bypass_host.empty();
+      }
+
+      void validate(const std::string& title) const
+      {
+	if (defined())
+	  HostPort::validate_host(bypass_host, title);
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["bypass_host"] = Json::Value(bypass_host);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_string(root, bypass_host, "bypass_host", title);
+      }
+#endif
+    };
+
+    class ProxyAutoConfigURL
+    {
+    public:
+      std::string url;
+
+      std::string to_string() const
+      {
+	return url;
+      }
+
+      bool defined() const {
+	return !url.empty();
+      }
+
+      void validate(const std::string& title) const
+      {
+	try {
+	  if (defined())
+	    (URL::Parse(url));
+	}
+	catch (const std::exception& e)
+	  {
+	    OPENVPN_THROW_EXCEPTION(title << " : error parsing ProxyAutoConfigURL: " << e.what());
+	  }
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["url"] = Json::Value(url);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	if (!json::is_dict(root, title))
+	  return;
+	json::to_string(root, url, "url", title);
+      }
+#endif
+    };
+
+    class ProxyHostPort
+    {
+    public:
+      std::string host;
+      int port = 0;
+
+      std::string to_string() const
+      {
+	std::ostringstream os;
+	os << host << ' ' << port;
+	return os.str();
+      }
+
+      bool defined() const {
+	return !host.empty();
+      }
+
+      void validate(const std::string& title) const
+      {
+	if (defined())
+	  {
+	    HostPort::validate_host(host, title);
+	    HostPort::validate_port(port, title);
+	  }
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["host"] = Json::Value(host);
+	root["port"] = Json::Value(port);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	if (!json::is_dict(root, title))
+	  return;
+	json::to_string(root, host, "host", title);
+	json::to_int(root, port, "port", title);
+      }
+#endif
+    };
+
+    class WINSServer
+    {
+    public:
+      std::string address;
+
+      std::string to_string() const
+      {
+	std::string ret = address;
+	return ret;
+      }
+
+      void validate(const std::string& title) const
+      {
+	IP::Addr(address, title, IP::Addr::V4);
+      }
+
+#ifdef HAVE_JSON
+      Json::Value to_json() const
+      {
+	Json::Value root(Json::objectValue);
+	root["address"] = Json::Value(address);
+	return root;
+      }
+
+      void from_json(const Json::Value& root, const std::string& title)
+      {
+	json::assert_dict(root, title);
+	json::to_string(root, address, "address", title);
+      }
+#endif
+    };
+
+    virtual bool tun_builder_set_remote_address(const std::string& address, bool ipv6) override
+    {
+      remote_address.address = address;
+      remote_address.ipv6 = ipv6;
+      return true;
+    }
+
+    virtual bool tun_builder_add_address(const std::string& address, int prefix_length, const std::string& gateway, bool ipv6, bool net30) override
+    {
+      RouteAddress r;
+      r.address = address;
+      r.prefix_length = prefix_length;
+      r.gateway = gateway;
+      r.ipv6 = ipv6;
+      r.net30 = net30;
+      if (ipv6)
+	tunnel_address_index_ipv6 = (int)tunnel_addresses.size();
+      else
+	tunnel_address_index_ipv4 = (int)tunnel_addresses.size();
+      tunnel_addresses.push_back(r);
+      return true;
+    }
+
+    virtual bool tun_builder_reroute_gw(bool ipv4, bool ipv6, unsigned int flags) override
+    {
+      reroute_gw.ipv4 = ipv4;
+      reroute_gw.ipv6 = ipv6;
+      reroute_gw.flags = flags;
+      return true;
+    }
+
+    virtual bool tun_builder_set_route_metric_default(int metric) override
+    {
+      route_metric_default = metric;
+      return true;
+    }
+
+    virtual bool tun_builder_add_route(const std::string& address, int prefix_length, int metric, bool ipv6) override
+    {
+      Route r;
+      r.address = address;
+      r.prefix_length = prefix_length;
+      r.metric = metric;
+      r.ipv6 = ipv6;
+      add_routes.push_back(r);
+      return true;
+    }
+
+    virtual bool tun_builder_exclude_route(const std::string& address, int prefix_length, int metric, bool ipv6) override
+    {
+      Route r;
+      r.address = address;
+      r.prefix_length = prefix_length;
+      r.metric = metric;
+      r.ipv6 = ipv6;
+      exclude_routes.push_back(r);
+      return true;
+    }
+
+    virtual bool tun_builder_add_dns_server(const std::string& address, bool ipv6) override
+    {
+      DNSServer dns;
+      dns.address = address;
+      dns.ipv6 = ipv6;
+      dns_servers.push_back(dns);
+      return true;
+    }
+
+    virtual bool tun_builder_add_search_domain(const std::string& domain) override
+    {
+      SearchDomain dom;
+      dom.domain = domain;
+      search_domains.push_back(dom);
+      return true;
+    }
+
+    virtual bool tun_builder_set_adapter_domain_suffix(const std::string& name) override
+    {
+      adapter_domain_suffix = name;
+      return true;
+    }
+
+    virtual bool tun_builder_set_layer(int layer) override
+    {
+      this->layer = Layer::from_value(layer);
+      return true;
+    }
+
+    virtual bool tun_builder_set_mtu(int mtu) override
+    {
+      this->mtu =  mtu;
+      return true;
+    }
+
+    virtual bool tun_builder_set_session_name(const std::string& name) override
+    {
+      session_name = name;
+      return true;
+    }
+
+    virtual bool tun_builder_add_proxy_bypass(const std::string& bypass_host) override
+    {
+      ProxyBypass b;
+      b.bypass_host = bypass_host;
+      proxy_bypass.push_back(b);
+      return true;
+    }
+
+    virtual bool tun_builder_set_proxy_auto_config_url(const std::string& url) override
+    {
+      proxy_auto_config_url.url = url;
+      return true;
+    }
+
+    virtual bool tun_builder_set_proxy_http(const std::string& host, int port) override
+    {
+      http_proxy.host = host;
+      http_proxy.port = port;      
+      return true;
+    }
+
+    virtual bool tun_builder_set_proxy_https(const std::string& host, int port) override
+    {
+      https_proxy.host = host;
+      https_proxy.port = port;      
+      return true;
+    }
+
+    virtual bool tun_builder_add_wins_server(const std::string& address) override
+    {
+      WINSServer wins;
+      wins.address = address;
+      wins_servers.push_back(wins);
+      return true;
+    }
+
+    virtual bool tun_builder_set_block_ipv6(bool value) override
+    {
+      block_ipv6 = value;
+      return true;
+    }
+
+    void reset_tunnel_addresses()
+    {
+      tunnel_addresses.clear();
+      tunnel_address_index_ipv4 = -1;
+      tunnel_address_index_ipv6 = -1;
+    }
+
+    void reset_dns_servers()
+    {
+      dns_servers.clear();
+    }
+
+    const RouteAddress* vpn_ipv4() const
+    {
+      if (tunnel_address_index_ipv4 >= 0)
+	return &tunnel_addresses[tunnel_address_index_ipv4];
+      else
+	return nullptr;
+    }
+
+    const RouteAddress* vpn_ipv6() const
+    {
+      if (tunnel_address_index_ipv6 >= 0)
+	return &tunnel_addresses[tunnel_address_index_ipv6];
+      else
+	return nullptr;
+    }
+
+    const RouteAddress* vpn_ip(const IP::Addr::Version v) const
+    {
+      switch (v)
+	{
+	case IP::Addr::V4:
+	  return vpn_ipv4();
+	case IP::Addr::V6:
+	  return vpn_ipv6();
+	default:
+	  return nullptr;
+	}
+    }
+
+    void validate() const
+    {
+      validate_layer("root");
+      validate_mtu("root");
+      remote_address.validate("remote_address");
+      validate_list(tunnel_addresses, "tunnel_addresses");
+      validate_tunnel_address_indices("root");
+      reroute_gw.validate("reroute_gw");
+      validate_list(add_routes, "add_routes");
+      validate_list(exclude_routes, "exclude_routes");
+      validate_list(dns_servers, "dns_servers");
+      validate_list(search_domains, "search_domains");
+      validate_list(proxy_bypass, "proxy_bypass");
+      proxy_auto_config_url.validate("proxy_auto_config_url");
+      http_proxy.validate("http_proxy");
+      https_proxy.validate("https_proxy");
+    }
+
+    std::string to_string() const
+    {
+      std::ostringstream os;
+      os << "Session Name: " << session_name << std::endl;
+      os << "Layer: " << layer.str() << std::endl;
+      if (mtu)
+	os << "MTU: " << mtu << std::endl;
+      os << "Remote Address: " << remote_address.to_string() << std::endl;
+      render_list(os, "Tunnel Addresses", tunnel_addresses);
+      os << "Reroute Gateway: " << reroute_gw.to_string() << std::endl;
+      os << "Block IPv6: " << (block_ipv6 ? "yes" : "no") << std::endl;
+      if (route_metric_default >= 0)
+	os << "Route Metric Default: " << route_metric_default << std::endl;
+      render_list(os, "Add Routes", add_routes);
+      render_list(os, "Exclude Routes", exclude_routes);
+      render_list(os, "DNS Servers", dns_servers);
+      render_list(os, "Search Domains", search_domains);
+      if (!adapter_domain_suffix.empty())
+	os << "Adapter Domain Suffix: " << adapter_domain_suffix << std::endl;
+      if (!proxy_bypass.empty())
+	render_list(os, "Proxy Bypass", proxy_bypass);
+      if (proxy_auto_config_url.defined())
+	os << "Proxy Auto Config URL: " << proxy_auto_config_url.to_string() << std::endl;
+      if (http_proxy.defined())
+	os << "HTTP Proxy: " << http_proxy.to_string() << std::endl;
+      if (https_proxy.defined())
+	os << "HTTPS Proxy: " << https_proxy.to_string() << std::endl;
+      if (!wins_servers.empty())
+	render_list(os, "WINS Servers", wins_servers);
+      return os.str();
+    }
+
+#ifdef HAVE_JSON
+
+    Json::Value to_json() const
+    {
+      Json::Value root(Json::objectValue);
+      root["session_name"] = Json::Value(session_name);
+      root["mtu"] = Json::Value(mtu);
+      root["layer"] = Json::Value(layer.value());
+      if (remote_address.defined())
+	root["remote_address"] = remote_address.to_json();
+      json::from_vector(root, tunnel_addresses, "tunnel_addresses");
+      root["tunnel_address_index_ipv4"] = Json::Value(tunnel_address_index_ipv4);
+      root["tunnel_address_index_ipv6"] = Json::Value(tunnel_address_index_ipv6);
+      root["reroute_gw"] = reroute_gw.to_json();
+      root["block_ipv6"] = Json::Value(block_ipv6);
+      root["route_metric_default"] = Json::Value(route_metric_default);
+      json::from_vector(root, add_routes, "add_routes");
+      json::from_vector(root, exclude_routes, "exclude_routes");
+      json::from_vector(root, dns_servers, "dns_servers");
+      json::from_vector(root, wins_servers, "wins_servers");
+      json::from_vector(root, search_domains, "search_domains");
+      root["adapter_domain_suffix"] = Json::Value(adapter_domain_suffix);
+      json::from_vector(root, proxy_bypass, "proxy_bypass");
+      if (proxy_auto_config_url.defined())
+	root["proxy_auto_config_url"] = proxy_auto_config_url.to_json();
+      if (http_proxy.defined())
+	root["http_proxy"] = http_proxy.to_json();
+      if (https_proxy.defined())
+	root["https_proxy"] = https_proxy.to_json();
+      return root;
+    }
+
+    static TunBuilderCapture::Ptr from_json(const Json::Value& root)
+    {
+      const std::string title = "root";
+      TunBuilderCapture::Ptr tbc(new TunBuilderCapture);
+      json::assert_dict(root, title);
+      json::to_string(root, tbc->session_name, "session_name", title);
+      tbc->layer = Layer::from_value(json::get_int(root, "layer", title));
+      json::to_int(root, tbc->mtu, "mtu", title);
+      tbc->remote_address.from_json(root["remote_address"], "remote_address");
+      json::to_vector(root, tbc->tunnel_addresses, "tunnel_addresses", title);
+      json::to_int(root, tbc->tunnel_address_index_ipv4, "tunnel_address_index_ipv4", title);
+      json::to_int(root, tbc->tunnel_address_index_ipv6, "tunnel_address_index_ipv6", title);
+      tbc->reroute_gw.from_json(root["reroute_gw"], "reroute_gw");
+      json::to_bool(root, tbc->block_ipv6, "block_ipv6", title);
+      json::to_int(root, tbc->route_metric_default, "route_metric_default", title);
+      json::to_vector(root, tbc->add_routes, "add_routes", title);
+      json::to_vector(root, tbc->exclude_routes, "exclude_routes", title);
+      json::to_vector(root, tbc->dns_servers, "dns_servers", title);
+      json::to_vector(root, tbc->wins_servers, "wins_servers", title);
+      json::to_vector(root, tbc->search_domains, "search_domains", title);
+      json::to_string(root, tbc->adapter_domain_suffix, "adapter_domain_suffix", title);
+      json::to_vector(root, tbc->proxy_bypass, "proxy_bypass", title);
+      tbc->proxy_auto_config_url.from_json(root["proxy_auto_config_url"], "proxy_auto_config_url");
+      tbc->http_proxy.from_json(root["http_proxy"], "http_proxy");
+      tbc->https_proxy.from_json(root["https_proxy"], "https_proxy");
+      return tbc;
+    }
+
+#endif // HAVE_JSON
+
+    // builder data
+    std::string session_name;
+    int mtu = 0;
+    Layer layer{Layer::OSI_LAYER_3};       // OSI layer
+    RemoteAddress remote_address;          // real address of server
+    std::vector<RouteAddress> tunnel_addresses;   // local tunnel addresses
+    int tunnel_address_index_ipv4 = -1;    // index into tunnel_addresses for IPv4 entry (or -1 if undef)
+    int tunnel_address_index_ipv6 = -1;    // index into tunnel_addresses for IPv6 entry (or -1 if undef)
+    RerouteGW reroute_gw;                  // redirect-gateway info
+    bool block_ipv6 = false;               // block IPv6 traffic while VPN is active
+    int route_metric_default = -1;         // route-metric directive
+    std::vector<Route> add_routes;         // routes that should be added to tunnel
+    std::vector<Route> exclude_routes;     // routes that should be excluded from tunnel
+    std::vector<DNSServer> dns_servers;    // VPN DNS servers
+    std::vector<SearchDomain> search_domains;  // domain suffixes whose DNS requests should be tunnel-routed
+    std::string adapter_domain_suffix;     // domain suffix on tun/tap adapter (currently Windows only)
+
+    std::vector<ProxyBypass> proxy_bypass; // hosts that should bypass proxy
+    ProxyAutoConfigURL proxy_auto_config_url;
+    ProxyHostPort http_proxy;
+    ProxyHostPort https_proxy;
+
+    std::vector<WINSServer> wins_servers;  // Windows WINS servers
+
+  private:
+    template <typename LIST>
+    static void render_list(std::ostream& os, const std::string& title, const LIST& list)
+    {
+      os << title << ':' << std::endl;
+      for (auto &e : list)
+	os << "  " << e.to_string() << std::endl;
+    }
+
+    template <typename LIST>
+    static void validate_list(const LIST& list, const std::string& title)
+    {
+      int i = 0;
+      for (auto &e : list)
+	{
+	  e.validate(title + '[' + openvpn::to_string(i) + ']');
+	  ++i;
+	}
+    }
+
+    bool validate_tunnel_index(const int index) const
+    {
+      if (index == -1)
+	return true;
+      return index >= 0 && index <= tunnel_addresses.size();
+    }
+
+    void validate_tunnel_address_indices(const std::string& title) const
+    {
+      if (!validate_tunnel_index(tunnel_address_index_ipv4))
+	OPENVPN_THROW_EXCEPTION(title << ".tunnel_address_index_ipv4 : IPv4 tunnel address index out of range: " << tunnel_address_index_ipv4);
+      if (!validate_tunnel_index(tunnel_address_index_ipv6))
+	OPENVPN_THROW_EXCEPTION(title << ".tunnel_address_index_ipv6 : IPv6 tunnel address index out of range: " << tunnel_address_index_ipv6);
+      const RouteAddress* r4 = vpn_ipv4();
+      if (r4 && r4->ipv6)
+	OPENVPN_THROW_EXCEPTION(title << ".tunnel_address_index_ipv4 : IPv4 tunnel address index points to wrong address type: " << r4->to_string());
+      const RouteAddress* r6 = vpn_ipv6();
+      if (r6 && !r6->ipv6)
+	OPENVPN_THROW_EXCEPTION(title << ".tunnel_address_index_ipv6 : IPv6 tunnel address index points to wrong address type: " << r6->to_string());
+    }
+
+    void validate_mtu(const std::string& title) const
+    {
+      if (mtu < 0 || mtu > 65536)
+	OPENVPN_THROW_EXCEPTION(title << ".mtu : MTU out of range: " << mtu);
+    }
+
+    void validate_layer(const std::string& title) const
+    {
+      if (!layer.defined())
+	OPENVPN_THROW_EXCEPTION(title << ": layer undefined");
+    }
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/builder/client.hpp

@@ -0,0 +1,317 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Generic, cross-platform tun interface that drives a TunBuilderBase API.
+// Fully supports IPv6.  To make this work on a given platform, define
+// a TunBuilderBase for the platform.
+
+#ifndef OPENVPN_TUN_BUILDER_CLIENT_H
+#define OPENVPN_TUN_BUILDER_CLIENT_H
+
+#include <memory>
+
+#include <openvpn/tun/client/tunprop.hpp>
+#include <openvpn/tun/persist/tunpersist.hpp>
+#include <openvpn/common/scoped_fd.hpp>
+#include <openvpn/tun/tunio.hpp>
+
+namespace openvpn {
+  namespace TunBuilderClient {
+
+    OPENVPN_EXCEPTION(tun_builder_error);
+
+    // struct used to pass received tun packets
+    struct PacketFrom
+    {
+      typedef std::unique_ptr<PacketFrom> SPtr;
+      BufferAllocated buf;
+    };
+
+    // our TunPersist class, specialized for Unix file descriptors
+    typedef TunPersistTemplate<ScopedFD> TunPersist;
+
+    // A simplified tun interface where pre-existing
+    // socket is provided.
+    template <typename ReadHandler>
+    class Tun : public TunIO<ReadHandler, PacketFrom, openvpn_io::posix::stream_descriptor>
+    {
+      typedef TunIO<ReadHandler, PacketFrom, openvpn_io::posix::stream_descriptor> Base;
+
+    public:
+      typedef RCPtr<Tun> Ptr;
+
+      Tun(openvpn_io::io_context& io_context,
+	  const int socket,
+	  const bool retain_sd_arg,
+	  const bool tun_prefix_arg,
+	  ReadHandler read_handler_arg,
+	  const Frame::Ptr& frame_arg,
+	  const SessionStats::Ptr& stats_arg)
+	: Base(read_handler_arg, frame_arg, stats_arg)
+      {
+	Base::stream = new openvpn_io::posix::stream_descriptor(io_context, socket);
+	Base::name_ = "tun";
+	Base::retain_stream = retain_sd_arg;
+	Base::tun_prefix = tun_prefix_arg;
+      }
+
+      ~Tun() { Base::stop(); }
+    };
+
+    // A factory for the Client class
+    class ClientConfig : public TunClientFactory
+    {
+    public:
+      typedef RCPtr<ClientConfig> Ptr;
+
+      TunProp::Config tun_prop;
+      int n_parallel;            // number of parallel async reads on tun socket
+      bool retain_sd;
+      bool tun_prefix;
+      Frame::Ptr frame;
+      SessionStats::Ptr stats;
+      EmulateExcludeRouteFactory::Ptr eer_factory;
+      TunPersist::Ptr tun_persist;
+      TunBuilderBase* builder;
+
+      static Ptr new_obj()
+      {
+	return new ClientConfig;
+      }
+
+      TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
+						TunClientParent& parent,
+						TransportClient* transcli) override;
+
+      void finalize(const bool disconnected) override
+      {
+	if (disconnected)
+	  tun_persist.reset();
+      }
+
+    private:
+      ClientConfig()
+	: n_parallel(8), retain_sd(false), tun_prefix(false), builder(nullptr) {}
+    };
+
+    // The tun interface
+    class Client : public TunClient
+    {
+      friend class ClientConfig;  // calls constructor
+      friend class TunIO<Client*, PacketFrom, openvpn_io::posix::stream_descriptor>;  // calls tun_read_handler
+
+      typedef Tun<Client*> TunImpl;
+
+    public:
+      virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&) override
+      {
+	if (!impl)
+	  {
+	    halt = false;
+	    if (config->tun_persist)
+	      tun_persist = config->tun_persist; // long-term persistent
+	    else
+	      tun_persist.reset(new TunPersist(false, config->retain_sd, config->builder)); // short-term
+
+	    try {
+	      int sd = -1;
+	      const IP::Addr server_addr = transcli.server_endpoint_addr();
+
+	      // Check if persisted tun session matches properties of to-be-created session
+	      if (tun_persist->use_persisted_tun(server_addr, config->tun_prop, opt))
+		{
+		  sd = tun_persist->obj();
+		  state = tun_persist->state();
+		  OPENVPN_LOG("TunPersist: reused tun context");
+
+		  // indicate reconnection with persisted state
+		  config->builder->tun_builder_establish_lite();
+		}
+	      else
+		{
+		  TunBuilderBase* tb = config->builder;
+
+		  // reset target tun builder object
+		  if (!tb->tun_builder_new())
+		    throw tun_builder_error("tun_builder_new failed");
+
+		  // notify parent
+		  parent.tun_pre_tun_config();
+
+		  // configure the tun builder
+		  TunProp::configure_builder(tb, state.get(), config->stats.get(), server_addr,
+					     config->tun_prop, opt, config->eer_factory.get(), false);
+
+		  // start tun
+		  sd = tb->tun_builder_establish();
+		}
+
+	      if (sd == -1)
+		{
+		  parent.tun_error(Error::TUN_IFACE_CREATE, "cannot acquire tun interface socket");
+		  return;
+		}
+
+	      // persist state
+	      if (tun_persist->persist_tun_state(sd, state))
+		  OPENVPN_LOG("TunPersist: saving tun context:" << std::endl << tun_persist->options());
+
+	      impl.reset(new TunImpl(io_context,
+				     sd,
+				     true,
+				     config->tun_prefix,
+				     this,
+				     config->frame,
+				     config->stats
+				     ));
+	      impl->start(config->n_parallel);
+
+	      // signal that we are connected
+	      parent.tun_connected();
+	    }
+	    catch (const std::exception& e)
+	      {
+		if (tun_persist)
+		  tun_persist->close();
+		stop();
+		parent.tun_error(Error::TUN_SETUP_FAILED, e.what());
+	      }
+	  }
+      }
+
+      virtual bool tun_send(BufferAllocated& buf) override
+      {
+	return send(buf);
+      }
+
+      virtual std::string tun_name() const override
+      {
+	if (impl)
+	  return impl->name();
+	else
+	  return "UNDEF_TUN";
+      }
+
+      virtual std::string vpn_ip4() const override
+      {
+	if (state->vpn_ip4_addr.specified())
+	  return state->vpn_ip4_addr.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_ip6() const override
+      {
+	if (state->vpn_ip6_addr.specified())
+	  return state->vpn_ip6_addr.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_gw4() const override
+      {
+	if (state->vpn_ip4_gw.specified())
+	  return state->vpn_ip4_gw.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_gw6() const override
+      {
+	if (state->vpn_ip6_gw.specified())
+	  return state->vpn_ip6_gw.to_string();
+	else
+	  return "";
+      }
+
+      virtual void set_disconnect() override
+      {
+	if (tun_persist)
+	  tun_persist->set_disconnect();
+      }
+
+      virtual void stop() override { stop_(); }
+      virtual ~Client() { stop_(); }
+
+    private:
+      Client(openvpn_io::io_context& io_context_arg,
+	     ClientConfig* config_arg,
+	     TunClientParent& parent_arg)
+	:  io_context(io_context_arg),
+	   config(config_arg),
+	   parent(parent_arg),
+	   halt(false),
+	   state(new TunProp::State())
+      {
+      }
+
+      bool send(Buffer& buf)
+      {
+	if (impl)
+	  return impl->write(buf);
+	else
+	  return false;
+      }
+
+      void tun_read_handler(PacketFrom::SPtr& pfp) // called by TunImpl
+      {
+	parent.tun_recv(pfp->buf);
+      }
+
+      void tun_error_handler(const Error::Type errtype, // called by TunImpl
+			     const openvpn_io::error_code* error)
+      {
+      }
+
+      void stop_()
+      {
+	if (!halt)
+	  {
+	    halt = true;
+
+	    // stop tun
+	    if (impl)
+	      impl->stop();
+	    tun_persist.reset();
+	  }
+      }
+
+
+      openvpn_io::io_context& io_context;
+      TunPersist::Ptr tun_persist; // owns the tun socket descriptor
+      ClientConfig::Ptr config;
+      TunClientParent& parent;
+      TunImpl::Ptr impl;
+      bool halt;
+      TunProp::State::Ptr state;
+    };
+
+    inline TunClient::Ptr ClientConfig::new_tun_client_obj(openvpn_io::io_context& io_context,
+							   TunClientParent& parent,
+							   TransportClient* transcli)
+    {
+      return TunClient::Ptr(new Client(io_context, this, parent));
+    }
+
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/builder/rgwflags.hpp

@@ -0,0 +1,35 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_TUN_BUILDER_RGWFLAGS_H
+#define OPENVPN_TUN_BUILDER_RGWFLAGS_H
+
+namespace openvpn {
+  namespace RGWFlags {
+    // These flags are passed as the flags argument to TunBuilderBase::tun_builder_reroute_gw
+    // NOTE: must not collide with RG_x flags in rgopt.hpp.
+    enum {
+      EmulateExcludeRoutes=(1<<16),
+    };
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/builder/setup.hpp

@@ -0,0 +1,62 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Client tun setup base class for unix
+
+#ifndef OPENVPN_TUN_BUILDER_SETUP_H
+#define OPENVPN_TUN_BUILDER_SETUP_H
+
+#include <openvpn/common/jsonlib.hpp>
+#include <openvpn/common/destruct.hpp>
+#include <openvpn/common/stop.hpp>
+#include <openvpn/tun/builder/capture.hpp>
+
+namespace openvpn {
+  namespace TunBuilderSetup {
+    struct Config
+    {
+#ifdef HAVE_JSON
+      virtual Json::Value to_json() = 0;
+      virtual void from_json(const Json::Value& root, const std::string& title) = 0;
+#endif
+      virtual ~Config() {}
+    };
+
+    struct Base : public DestructorBase
+    {
+      typedef RCPtr<Base> Ptr;
+
+      virtual int establish(const TunBuilderCapture& pull,
+			    Config* config,
+			    Stop* stop,
+			    std::ostream& os) = 0;
+    };
+
+    struct Factory : public RC<thread_unsafe_refcount>
+    {
+      typedef RCPtr<Factory> Ptr;
+
+      virtual Base::Ptr new_setup_obj() = 0;
+    };
+  }
+}
+
+#endif