Merge commit '86cc97e55fe346502462284d2e636a2b3708163e' as 'Sources/OpenVPN3'

Sources/OpenVPN3/openvpn/win/call.hpp

@@ -0,0 +1,167 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// execute a Windows command, capture the output
+
+#ifndef OPENVPN_WIN_CALL_H
+#define OPENVPN_WIN_CALL_H
+
+#include <windows.h>
+#include <shlobj.h>
+
+#include <cstring>
+
+#include <openvpn/common/uniqueptr.hpp>
+#include <openvpn/win/scoped_handle.hpp>
+
+namespace openvpn {
+  namespace Win {
+
+    OPENVPN_EXCEPTION(win_call);
+
+    // console codepage, used to decode output
+    int console_cp = ::GetOEMCP();
+
+    inline std::string call(const std::string& cmd)
+    {
+      // split command name from args
+      std::string name;
+      std::string args;
+      const size_t spcidx = cmd.find_first_of(" ");
+      if (spcidx != std::string::npos)
+	{
+	  name = cmd.substr(0, spcidx);
+	  if (spcidx+1 < cmd.length())
+	    args = cmd.substr(spcidx+1);
+	}
+      else
+	name = cmd;
+
+#if _WIN32_WINNT >= 0x0600
+      // get system path (Vista and higher)
+      wchar_t *syspath_ptr = nullptr;
+      if (::SHGetKnownFolderPath(FOLDERID_System, 0, nullptr, &syspath_ptr) != S_OK)
+	throw win_call("cannot get system path using SHGetKnownFolderPath");
+      unique_ptr_del<wchar_t> syspath(syspath_ptr, [](wchar_t* p) { ::CoTaskMemFree(p); });
+#     define SYSPATH_FMT_CHAR L"s"
+#     define SYSPATH_LEN_METH(x) ::wcslen(x)
+#else
+      // get system path (XP and higher)
+      std::unique_ptr<wchar_t[]> syspath(new wchar_t[MAX_PATH]);
+      if (::SHGetFolderPathW(nullptr, CSIDL_SYSTEM, nullptr, 0, syspath.get()) != S_OK)
+	throw win_call("cannot get system path using SHGetFolderPathW");
+#     define SYSPATH_FMT_CHAR L"s"
+#     define SYSPATH_LEN_METH(x) ::wcslen(x)
+#endif
+
+      // build command line
+      const size_t wcmdlen = SYSPATH_LEN_METH(syspath.get()) + name.length() + args.length() + 64;
+      std::unique_ptr<wchar_t[]> wcmd(new wchar_t[wcmdlen]);
+      const char *spc = "";
+      if (!args.empty())
+	spc = " ";
+      ::_snwprintf(wcmd.get(), wcmdlen, L"\"%" SYSPATH_FMT_CHAR L"\\%S.exe\"%S%S", syspath.get(), name.c_str(), spc, args.c_str());
+      wcmd.get()[wcmdlen-1] = 0;
+      //::wprintf(L"CMD[%d]: %s\n", (int)::wcslen(wcmd.get()), wcmd.get());
+#     undef SYSPATH_FMT_CHAR
+#     undef SYSPATH_LEN_METH
+
+      // Set the bInheritHandle flag so pipe handles are inherited.
+      SECURITY_ATTRIBUTES saAttr;
+      saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
+      saAttr.bInheritHandle = TRUE;
+      saAttr.lpSecurityDescriptor = nullptr;
+
+      // Create a pipe for the child process's STDOUT.
+      ScopedHANDLE cstdout_r; // child write side
+      ScopedHANDLE cstdout_w; // parent read side
+      if (!::CreatePipe(cstdout_r.ref(), cstdout_w.ref(), &saAttr, 0))
+	throw win_call("cannot create pipe for child stdout");
+
+      // Ensure the read handle to the pipe for STDOUT is not inherited.
+      if (!::SetHandleInformation(cstdout_r(), HANDLE_FLAG_INHERIT, 0))
+	throw win_call("SetHandleInformation failed for child stdout pipe");
+
+      // Set up members of the PROCESS_INFORMATION structure.
+      PROCESS_INFORMATION piProcInfo;
+      ::ZeroMemory(&piProcInfo, sizeof(PROCESS_INFORMATION));
+
+      // Set up members of the STARTUPINFO structure.
+      // This structure specifies the STDIN and STDOUT handles for redirection.
+      STARTUPINFOW siStartInfo;
+      ::ZeroMemory(&siStartInfo, sizeof(STARTUPINFO));
+      siStartInfo.cb = sizeof(STARTUPINFO);
+      siStartInfo.hStdError = cstdout_w();
+      siStartInfo.hStdOutput = cstdout_w();
+      siStartInfo.hStdInput = nullptr;
+      siStartInfo.dwFlags |= STARTF_USESTDHANDLES;
+
+      // Create the child process.
+      if (!::CreateProcessW(nullptr,
+			  wcmd.get(),    // command line
+			  nullptr,       // process security attributes
+			  nullptr,       // primary thread security attributes
+			  TRUE,          // handles are inherited
+			  0,             // creation flags
+			  nullptr,       // use parent's environment
+			  nullptr,       // use parent's current directory
+			  &siStartInfo,  // STARTUPINFO pointer
+			  &piProcInfo))  // receives PROCESS_INFORMATION
+	throw win_call("cannot create process");
+
+      // wrap handles to child process and its primary thread.
+      ScopedHANDLE process_hand(piProcInfo.hProcess);
+      ScopedHANDLE thread_hand(piProcInfo.hThread);
+
+      // close child's end of stdout/stderr pipe
+      cstdout_w.close();
+
+      // read child's stdout
+      const size_t outbuf_size = 512;
+      std::unique_ptr<char[]> outbuf(new char[outbuf_size]);
+      std::string out;
+      while (true)
+	{
+	  DWORD dwRead;
+	  if (!::ReadFile(cstdout_r(), outbuf.get(), outbuf_size, &dwRead, nullptr))
+	    break;
+	  if (dwRead == 0)
+	    break;
+	  out += std::string(outbuf.get(), 0, dwRead);
+	}
+
+      // decode output using console codepage, convert to utf16
+      UTF16 utf16output(Win::utf16(out, console_cp));
+
+      // re-encode utf16 to utf8
+      UTF8 utf8output(Win::utf8(utf16output.get()));
+      out.assign(utf8output.get());
+
+      // wait for child to exit
+      if (::WaitForSingleObject(process_hand(), INFINITE) == WAIT_FAILED)
+	throw win_call("WaitForSingleObject failed on child process handle");
+
+      return out;
+    }
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/cmd.hpp

@@ -0,0 +1,65 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_WIN_CMD_H
+#define OPENVPN_WIN_CMD_H
+
+#include <windows.h>
+
+#include <string>
+#include <regex>
+
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/string.hpp>
+#include <openvpn/common/action.hpp>
+#include <openvpn/common/unicode.hpp>
+#include <openvpn/win/call.hpp>
+
+namespace openvpn {
+
+  class WinCmd : public Action
+  {
+  public:
+    typedef RCPtr<WinCmd> Ptr;
+
+    WinCmd(const std::string& command)
+      : cmd(command)
+    {
+    }
+
+    virtual void execute(std::ostream& os) override
+    {
+      os << cmd << std::endl;
+      std::string out = Win::call(cmd);
+      os << out;
+    }
+
+    virtual std::string to_string() const override
+    {
+      return cmd;
+    }
+
+  private:
+    std::string cmd;
+  };
+
+}
+#endif

Sources/OpenVPN3/openvpn/win/console.hpp

@@ -0,0 +1,152 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// console utilities for Windows
+
+#ifndef OPENVPN_WIN_CONSOLE_H
+#define OPENVPN_WIN_CONSOLE_H
+
+#include <windows.h>
+#include <string>
+#include <openvpn/win/handle.hpp>
+
+namespace openvpn {
+  namespace Win {
+    namespace Console {
+
+      class Input
+      {
+	Input(const Input&) = delete;
+	Input& operator=(const Input&) = delete;
+
+      public:
+	Input()
+	  : std_input(Handle::undefined()),
+	    console_mode_save(0)
+	{
+	  // disable control-C
+	  ::SetConsoleCtrlHandler(nullptr, TRUE);
+
+	  HANDLE in = ::GetStdHandle(STD_INPUT_HANDLE);
+	  DWORD mode = 0;
+	  if (Handle::defined(in) && ::GetConsoleMode(in, &mode))
+	    {
+	      // running on a console
+	      const DWORD newmode = mode
+		& ~(ENABLE_WINDOW_INPUT
+		    | ENABLE_PROCESSED_INPUT
+		    | ENABLE_LINE_INPUT
+		    | ENABLE_ECHO_INPUT 
+		    | ENABLE_MOUSE_INPUT);
+
+	      if (newmode == mode || ::SetConsoleMode(in, newmode))
+		{
+		  std_input = in;
+		  console_mode_save = mode;
+		}
+	    }
+	}
+
+	~Input()
+	{
+	  if (Handle::defined(std_input))
+	    ::SetConsoleMode(std_input, console_mode_save);
+	}
+
+	bool available()
+	{
+	  if (Handle::defined(std_input))
+	    {
+	      DWORD n;
+	      if (::GetNumberOfConsoleInputEvents(std_input, &n))
+		return n > 0;
+	    }
+	  return false;
+	}
+
+	unsigned int get()
+	{
+	  if (Handle::defined(std_input))
+	    {
+	      INPUT_RECORD ir;
+	      do {
+		DWORD n;
+		if (!available())
+		  return 0;
+		if (!::ReadConsoleInputA(std_input, &ir, 1, &n))
+		  return 0;
+	      } while (ir.EventType != KEY_EVENT || ir.Event.KeyEvent.bKeyDown != TRUE);
+	      return keyboard_ir_to_key(&ir);
+	    }
+	  else
+	    return 0;
+	}
+
+      private:
+	unsigned int keyboard_ir_to_key(INPUT_RECORD *ir)
+	{
+	  if (ir->Event.KeyEvent.uChar.AsciiChar == 0)
+	    return ir->Event.KeyEvent.wVirtualScanCode;
+
+	  if ((ir->Event.KeyEvent.dwControlKeyState
+	       & (LEFT_ALT_PRESSED | RIGHT_ALT_PRESSED))
+	      && (ir->Event.KeyEvent.wVirtualKeyCode != 18))
+	    return ir->Event.KeyEvent.wVirtualScanCode * 256;
+
+	  return ir->Event.KeyEvent.uChar.AsciiChar;
+	}
+
+	HANDLE std_input;
+	DWORD console_mode_save;
+      };
+
+      class Title
+      {
+	Title(const Title&) = delete;
+	Title& operator=(const Title&) = delete;
+
+      public:
+	Title(const std::string& new_title)
+	  : old_title_defined(false)
+	{
+	  char title[256];
+	  if (::GetConsoleTitleA(title, sizeof(title)))
+	    {
+	      old_title = title;
+	      old_title_defined = true;
+	    }
+	  ::SetConsoleTitleA(new_title.c_str());
+	}
+
+	~Title()
+	{
+	  if (old_title_defined)
+	    ::SetConsoleTitleA(old_title.c_str());
+	}
+      private:
+	bool old_title_defined;
+	std::string old_title;
+      };
+    }
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/event.hpp

@@ -0,0 +1,108 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+//
+
+#ifndef OPENVPN_WIN_EVENT_H
+#define OPENVPN_WIN_EVENT_H
+
+#include <windows.h>
+
+#include <string>
+
+#include <openvpn/buffer/bufhex.hpp>
+#include <openvpn/win/winerr.hpp>
+#include <openvpn/win/scoped_handle.hpp>
+
+namespace openvpn {
+  namespace Win {
+
+    // Wrap a standard Windows Event object
+    class Event
+    {
+    public:
+      explicit Event(BOOL manual_reset=TRUE)
+      {
+	event.reset(::CreateEvent(NULL, manual_reset, FALSE, NULL));
+	if (!event.defined())
+	  {
+	    const Win::LastError err;
+	    OPENVPN_THROW_EXCEPTION("Win::Event: cannot create Windows event: " << err.message());
+	  }
+      }
+
+      std::string duplicate_local()
+      {
+	HANDLE new_handle;
+	if (!::DuplicateHandle(GetCurrentProcess(),
+			      event(),
+			      GetCurrentProcess(),
+			      &new_handle,
+			      0,
+			      FALSE,
+			      DUPLICATE_SAME_ACCESS))
+	  {
+	    const Win::LastError err;
+	    OPENVPN_THROW_EXCEPTION("Win::Event: DuplicateHandle failed: " << err.message());
+	  }
+	return BufHex::render(new_handle);
+      }
+
+      void signal_event()
+      {
+	if (event.defined())
+	  {
+	    ::SetEvent(event());
+	    event.close();
+	  }
+      }
+
+      void release_event()
+      {
+	event.close();
+      }
+
+      HANDLE operator()() const
+      {
+	return event();
+      }
+
+      void reset(HANDLE h)
+      {
+	event.reset(h);
+      }
+
+    private:
+      ScopedHANDLE event;
+    };
+
+    // Windows event object that automatically signals in the destructor
+    struct DestroyEvent : public Event
+    {
+      ~DestroyEvent()
+      {
+	signal_event();
+      }
+    };
+
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/handle.hpp

@@ -0,0 +1,45 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// windows HANDLE utilities
+
+#ifndef OPENVPN_WIN_HANDLE_H
+#define OPENVPN_WIN_HANDLE_H
+
+#include <windows.h>
+
+namespace openvpn {
+  namespace Win {
+    namespace Handle {
+      inline HANDLE undefined()
+      {
+	return INVALID_HANDLE_VALUE;
+      }
+
+      inline bool defined(HANDLE handle)
+      {
+	return handle != nullptr && handle != INVALID_HANDLE_VALUE;
+      }
+    }
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/impersonate.hpp

@@ -0,0 +1,220 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2018 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#pragma once
+
+#include <Windows.h>
+#include <Lmcons.h>
+#include <wtsapi32.h>
+
+#include <openvpn/win/winerr.hpp>
+
+namespace openvpn {
+  namespace Win {
+
+    class Impersonate
+    {
+    public:
+      explicit Impersonate(bool as_local_system)
+	: local_system_(is_local_system_())
+      {
+	if (as_local_system)
+	  {
+	    if (local_system_)
+	      OPENVPN_LOG("ImpersonateAsSystem: running under SYSTEM account, no need to impersonate");
+	    else
+	      impersonate_as_local_system();
+	  }
+	else
+	  {
+	    if (local_system_)
+	      impersonate_as_user();
+	    else
+	      OPENVPN_LOG("ImpersonateAsUser: running under user account, no need to impersonate");
+	  }
+      }
+
+      ~Impersonate()
+      {
+	if (impersonated)
+	  {
+	    if (!RevertToSelf())
+	      {
+		const Win::LastError err;
+		OPENVPN_LOG("Impersonate: RevertToSelf() failed: " << err.message());
+	      }
+	  }
+      }
+
+      bool is_local_system() const
+      {
+	return local_system_;
+      }
+
+    private:
+      void impersonate_as_local_system()
+      {
+	HANDLE thread_token, process_snapshot, winlogon_process, winlogon_token, duplicated_token, file_handle;
+	PROCESSENTRY32 entry = {};
+	entry.dwSize = sizeof(PROCESSENTRY32);
+	BOOL ret;
+	DWORD pid = 0;
+	TOKEN_PRIVILEGES privileges = {};
+	privileges.PrivilegeCount = 1;
+	privileges.Privileges->Attributes = SE_PRIVILEGE_ENABLED;
+
+	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &privileges.Privileges[0].Luid))
+	  return;
+
+	if (!ImpersonateSelf(SecurityImpersonation))
+	  return;
+
+	impersonated = true;
+
+	if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES, FALSE, &thread_token))
+	  return;
+	if (!AdjustTokenPrivileges(thread_token, FALSE, &privileges, sizeof(privileges), NULL, NULL))
+	  {
+	    CloseHandle(thread_token);
+	    return;
+	  }
+	CloseHandle(thread_token);
+
+	process_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	if (process_snapshot == INVALID_HANDLE_VALUE)
+	  return;
+
+	for (ret = Process32First(process_snapshot, &entry); ret; ret = Process32Next(process_snapshot, &entry))
+	  {
+	    if (!_stricmp(entry.szExeFile, "winlogon.exe"))
+	      {
+		pid = entry.th32ProcessID;
+		break;
+	      }
+	  }
+	CloseHandle(process_snapshot);
+	if (!pid)
+	  return;
+
+	winlogon_process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
+	if (!winlogon_process)
+	  return;
+
+	if (!OpenProcessToken(winlogon_process, TOKEN_IMPERSONATE | TOKEN_DUPLICATE, &winlogon_token))
+	  {
+	    CloseHandle(winlogon_process);
+	    return;
+	  }
+	CloseHandle(winlogon_process);
+
+	if (!DuplicateToken(winlogon_token, SecurityImpersonation, &duplicated_token))
+	  {
+	    CloseHandle(winlogon_token);
+	    return;
+	  }
+	CloseHandle(winlogon_token);
+
+	if (!SetThreadToken(NULL, duplicated_token))
+	  {
+	    CloseHandle(duplicated_token);
+	    return;
+	  }
+	CloseHandle(duplicated_token);
+      }
+
+      void impersonate_as_user()
+      {
+	DWORD sessId = WTSGetActiveConsoleSessionId();
+	if (sessId == 0xFFFFFFFF)
+	  {
+	    const Win::LastError err;
+	    OPENVPN_LOG("ImpersonateAsUser: WTSGetActiveConsoleSessionId() failed: " << err.message());
+	    return;
+	  }
+
+	HANDLE hToken;
+	if (!WTSQueryUserToken(sessId, &hToken))
+	  {
+	    const Win::LastError err;
+	    OPENVPN_LOG("ImpersonateAsUser: WTSQueryUserToken() failed: " << err.message());
+	    return;
+	  }
+
+	if (!ImpersonateLoggedOnUser(hToken))
+	  {
+	    CloseHandle(hToken);
+
+	    const Win::LastError err;
+	    OPENVPN_LOG("ImpersonateAsUser: ImpersonateLoggedOnUser() failed: " << err.message());
+	    return;
+	  }
+
+	CloseHandle(hToken);
+
+	impersonated = true;
+
+	char uname[UNLEN + 1];
+	DWORD len = UNLEN + 1;
+	GetUserNameA(uname, &len);
+	OPENVPN_LOG("ImpersonateAsUser: impersonated as " << uname);
+      }
+
+      // https://stackoverflow.com/a/4024388/227024
+      BOOL is_local_system_() const
+      {
+	HANDLE hToken;
+	UCHAR bTokenUser[sizeof(TOKEN_USER) + 8 + 4 * SID_MAX_SUB_AUTHORITIES];
+	PTOKEN_USER pTokenUser = (PTOKEN_USER)bTokenUser;
+	ULONG cbTokenUser;
+	SID_IDENTIFIER_AUTHORITY siaNT = SECURITY_NT_AUTHORITY;
+	PSID pSystemSid;
+	BOOL bSystem;
+
+	// open process token
+	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
+	  return FALSE;
+
+	// retrieve user SID
+	if (!GetTokenInformation(hToken, TokenUser, pTokenUser, sizeof(bTokenUser), &cbTokenUser))
+	  {
+	    CloseHandle(hToken);
+	    return FALSE;
+	  }
+
+	CloseHandle(hToken);
+
+	// allocate LocalSystem well-known SID
+	if (!AllocateAndInitializeSid(&siaNT, 1, SECURITY_LOCAL_SYSTEM_RID,
+	  0, 0, 0, 0, 0, 0, 0, &pSystemSid)) return FALSE;
+
+	// compare the user SID from the token with the LocalSystem SID
+	bSystem = EqualSid(pTokenUser->User.Sid, pSystemSid);
+
+	FreeSid(pSystemSid);
+
+	return bSystem;
+      }
+
+      bool local_system_ = false;
+      bool impersonated = false;
+    };
+  }
+}

Sources/OpenVPN3/openvpn/win/modname.hpp

@@ -0,0 +1,57 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// windows SECURITY_ATTRIBUTES utilities
+
+#ifndef OPENVPN_WIN_MODNAME_H
+#define OPENVPN_WIN_MODNAME_H
+
+#include <windows.h>
+
+#include <string>
+
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/wstring.hpp>
+#include <openvpn/win/winerr.hpp>
+
+namespace openvpn {
+  namespace Win {
+
+      inline std::wstring module_name()
+      {
+	// get path to our binary
+	wchar_t path[MAX_PATH];
+	if (!::GetModuleFileNameW(NULL, path, MAX_PATH))
+	  {
+	    const Win::LastError err;
+	    OPENVPN_THROW_EXCEPTION("GetModuleFileNameW failed: " << err.message());
+	  }
+	return std::wstring(path);
+      }
+
+    inline std::string module_name_utf8()
+    {
+      return wstring::to_utf8(module_name());
+    }
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/reg.hpp

@@ -0,0 +1,117 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// registry utilities for Windows
+
+#ifndef OPENVPN_WIN_REG_H
+#define OPENVPN_WIN_REG_H
+
+#include <windows.h>
+#include <openvpn/win/winerr.hpp>
+#include <openvpn/common/size.hpp>
+
+namespace openvpn {
+  namespace Win {
+
+    template<typename E>
+    static void check_reg_error(DWORD status, const std::string& key)
+      {
+	if (status != ERROR_SUCCESS)
+	  {
+	    const Win::Error err(status);
+	    OPENVPN_THROW(E, "registry key " << key << " error: " << err.message());
+	  }
+      }
+
+    // HKEY wrapper
+    class RegKey
+    {
+      RegKey(const RegKey&) = delete;
+      RegKey& operator=(const RegKey&) = delete;
+
+    public:
+      RegKey() : key(nullptr) {}
+      bool defined() const { return key != nullptr; }
+      HKEY* ref() { return &key; }
+      HKEY operator()() { return key; }
+
+      ~RegKey()
+      {
+	if (defined())
+	  ::RegCloseKey(key);
+      }
+    private:
+      HKEY key;
+    };
+
+    class RegKeyEnumerator : public std::vector<std::string>
+    {
+    public:
+      RegKeyEnumerator(HKEY hkey, const std::string& path)
+      {
+	RegKey regKey;
+	auto status = ::RegOpenKeyExA(hkey,
+				      path.c_str(),
+				      0,
+				      KEY_QUERY_VALUE | KEY_ENUMERATE_SUB_KEYS,
+				      regKey.ref());
+	if (status != ERROR_SUCCESS)
+	    return;
+
+	DWORD subkeys_num;
+	status = ::RegQueryInfoKeyA(regKey(),
+				    nullptr,
+				    nullptr,
+				    NULL,
+				    &subkeys_num,
+				    nullptr,
+				    nullptr,
+				    nullptr,
+				    nullptr,
+				    nullptr,
+				    nullptr,
+				    nullptr);
+
+	if (status != ERROR_SUCCESS)
+	  return;
+
+	const int MAX_KEY_LENGTH = 255;
+	for (auto i = 0; i < subkeys_num; ++ i)
+	  {
+	    DWORD subkey_size = MAX_KEY_LENGTH;
+	    char subkey[MAX_KEY_LENGTH];
+	    status = ::RegEnumKeyExA(regKey(),
+				     i,
+				     subkey,
+				     &subkey_size,
+				     nullptr,
+				     nullptr,
+				     nullptr,
+				     nullptr);
+	    if (status == ERROR_SUCCESS)
+	      push_back(subkey);
+	  }
+      }
+    };
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/scoped_handle.hpp

@@ -0,0 +1,132 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// scoped HANDLE for windows
+
+#ifndef OPENVPN_WIN_SCOPED_HANDLE_H
+#define OPENVPN_WIN_SCOPED_HANDLE_H
+
+#include <windows.h>
+
+#include <openvpn/common/size.hpp>
+#include <openvpn/win/handle.hpp>
+
+namespace openvpn {
+  namespace Win {
+    class ScopedHANDLE
+    {
+      ScopedHANDLE(const ScopedHANDLE&) = delete;
+      ScopedHANDLE& operator=(const ScopedHANDLE&) = delete;
+
+    public:
+      typedef HANDLE base_type;
+
+      ScopedHANDLE() : handle(Handle::undefined()) {}
+
+      explicit ScopedHANDLE(HANDLE h)
+	: handle(h) {}
+
+      HANDLE release()
+      {
+	const HANDLE ret = handle;
+	handle = nullptr;
+	return ret;
+      }
+
+      bool defined() const
+      {
+	return Handle::defined(handle);
+      }
+
+      HANDLE operator()() const
+      {
+	return handle;
+      }
+
+      HANDLE* ref()
+      {
+	return &handle;
+      }
+
+      void reset(HANDLE h)
+      {
+	close();
+	handle = h;
+      }
+
+      void reset()
+      {
+	close();
+      }
+
+      // unusual semantics: replace handle without closing it first
+      void replace(HANDLE h)
+      {
+	handle = h;
+      }
+
+      bool close()
+      {
+	if (defined())
+	  {
+	    __try
+	      {
+		const BOOL ret = ::CloseHandle(handle);
+		//OPENVPN_LOG("**** SH CLOSE hand=" << handle << " ret=" << ret);
+		handle = nullptr;
+		return ret != 0;
+	      }
+	    __except (EXCEPTION_EXECUTE_HANDLER)
+	      {
+		return false;
+	      }
+	  }
+	else
+	  return true;
+      }
+
+      ~ScopedHANDLE()
+      {
+	close();
+      }
+
+      ScopedHANDLE(ScopedHANDLE&& other) noexcept
+      {
+	handle = other.handle;
+	other.handle = nullptr;
+      }
+
+      ScopedHANDLE& operator=(ScopedHANDLE&& other) noexcept
+      {
+	close();
+	handle = other.handle;
+	other.handle = nullptr;
+	return *this;
+      }
+
+    private:
+      HANDLE handle;
+    };
+
+  }
+}
+
+#endif

Sources/OpenVPN3/openvpn/win/sleep.hpp

@@ -0,0 +1,60 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_WIN_SLEEP_H
+#define OPENVPN_WIN_SLEEP_H
+
+#include <windows.h>
+
+#include <string>
+
+#include <openvpn/common/action.hpp>
+#include <openvpn/common/to_string.hpp>
+
+namespace openvpn {
+
+  class WinSleep : public Action
+  {
+  public:
+    typedef RCPtr<WinSleep> Ptr;
+
+    WinSleep(DWORD dwMilliseconds_arg)
+      : dwMilliseconds(dwMilliseconds_arg)
+    {
+    }
+
+    virtual void execute(std::ostream& os) override
+    {
+      os << to_string() << std::endl;
+      ::Sleep(dwMilliseconds);
+    }
+
+    virtual std::string to_string() const override
+    {
+      return "Sleeping for " + openvpn::to_string(dwMilliseconds) + " milliseconds...";
+    }
+
+  private:
+    DWORD dwMilliseconds;
+  };
+
+}
+#endif

Sources/OpenVPN3/openvpn/win/unicode.hpp

@@ -0,0 +1,96 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_WIN_UNICODE_H
+#define OPENVPN_WIN_UNICODE_H
+
+#include <windows.h>
+
+#include <string>
+#include <memory>
+
+#include <openvpn/common/size.hpp>
+#include <openvpn/common/exception.hpp>
+
+namespace openvpn {
+  namespace Win {
+    typedef std::unique_ptr<wchar_t[]> UTF16;
+    typedef std::unique_ptr<char[]> UTF8;
+
+    OPENVPN_SIMPLE_EXCEPTION(win_utf16);
+
+    inline wchar_t* utf16(const std::string& str, int cp=CP_UTF8)
+    {
+      // first get output length (return value includes space for trailing nul)
+      const int len = ::MultiByteToWideChar(cp,
+					    0,
+					    str.c_str(),
+					    -1,
+					    nullptr,
+					    0);
+      if (len <= 0)
+	throw win_utf16();
+      UTF16 ret(new wchar_t[len]);
+      const int len2 = ::MultiByteToWideChar(cp,
+					     0,
+					     str.c_str(),
+					     -1,
+					     ret.get(),
+					     len);
+      if (len != len2)
+	throw win_utf16();
+      return ret.release();
+    }
+
+    inline size_t utf16_strlen(const wchar_t *str)
+    {
+      return ::wcslen(str);
+    }
+
+    inline char* utf8(wchar_t* str)
+    {
+      // first get output length (return value includes space for trailing nul)
+      const int len = ::WideCharToMultiByte(CP_UTF8,
+					    0,
+					    str,
+					    -1,
+					    NULL,
+					    0,
+					    NULL,
+					    NULL);
+      if (len <= 0)
+	throw win_utf16();
+      UTF8 ret(new char[len]);
+      const int len2 = ::WideCharToMultiByte(CP_UTF8,
+					     0,
+					     str,
+					     -1,
+					     ret.get(),
+					     len,
+					     NULL,
+					     NULL);
+      if (len != len2)
+	throw win_utf16();
+      return ret.release();
+    }
+  }
+}
+#endif

Sources/OpenVPN3/openvpn/win/winerr.hpp

@@ -0,0 +1,51 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Windows error utilities
+
+#ifndef OPENVPN_WIN_WINERR_H
+#define OPENVPN_WIN_WINERR_H
+
+#include <windows.h>
+
+#include <openvpn/io/io.hpp>
+
+namespace openvpn {
+  namespace Win {
+    struct Error : public openvpn_io::error_code
+    {
+      Error(const DWORD err)
+	: openvpn_io::error_code(err, openvpn_io::error::get_system_category())
+      {
+      }
+    };
+
+    struct LastError : public Error
+    {
+      LastError()
+	: Error(::GetLastError())
+      {
+      }
+    };
+  }
+}
+
+#endif