Squashed 'Sources/OpenVPNAdapter/Libraries/Vendors/openvpn/' changes from 275cf80efb..7db7a009b0

7db7a009b0 proto: Client complains about stub compressors 390154d0e4 Update Build instructions for OSX 1b92069834 deps: Update to mbedtls-2.7.12 8cab79540d compression: Extend compression alert to include server pushes 67b4641a99 CompressContext: Add is_any_stub() method cdf9e7bece compression: Issue an Event if compression is activated fa38064403 build script: added a new PROF type "auto" that tries to automatically determine the local platform 7ce7b52b7c MTRand: added OPENVPN_INSECURE_RANDOM compile flag that allows MTRand to masquerade as a secure RNG 85e7e49f72 MTRand: added constructor accepting an initialization seed 1fa3229a10 IPv4, IPv6: added #include <openvpn/common/hash.hpp> 48e9217d26 vcxproj: add missing header file d2a2601b2f Wintun: unmap ring buffers e320bc63ff openssl: Improve OpenSSLContext fencing against multiple declarations 2f8fe2d318 openssl: Missing inline keyword in a couple of compat functions 32b984c0ff enum_dir: use a function template 725ee04593 VPNServerNetblock::Netblock::to_string(): show prefix_len 409d1c52b8 ManClientInstance::Send::describe_user(): added bool show_userprop parameter e05fc16b20 string::indent(): try to fix all the corner cases 4e1645ea80 RunContext: mark virtual Stop* async_stop() with override attribute e8b31c5454 cli: advertise "openurl" as supported SSO method 80b45731eb ICMPv6: added DEST_UNREACH code 679003094d AsioTimerSafe: refactor to allow as drop-in replacement for AsioTimer f7845578f1 RunContext: check for halt in timer closure 84483eda25 AsioPolySock: add support for socket shutdown 1b3402aec3 tcplinkcommon.hpp: added missing include 2e26c7565c time: added nanotime_t typedef c3c8ab7f6b string: added additional detail to split() comment 95ce4f22c8 string: added to_delim() method then redefined first_line() method to use it 448218b1e1 string: added add_leading() method e3b0bf4f5c MSF iterator: allow conversion from ordinary iterator and added exists() method 11412ac50a AsioPolySock: in remote_endpoint_str() method, test for alt_routing_enabled() 9fb4e705f9 Added TimeSkew to skew a time duration by a random flux 7496383002 write_binary_atomic: reduce the length of the temporary filename b31d9c0191 auth-token-user: increase size limit to 340 chars c82644c03a Added BufferLineIterator 115cb656b6 RandomAPI: added randbyte() and randbool() methods 4fa8348689 RunContext: ASIO SIGNAL message now shows signal name rather than number ebfce58513 Added StaticBuffer, a constant-length Buffer for writing that cannot be extended c8f9cb88a4 string::split(): call reserve() on return vector f15e566065 read_binary_unix_fast: should return an int (i.e. errno), not a bool 60501b4513 random: factor out rand32_distribute() from RandomAPI::randrange32() 90123495a5 wintun: get device interfaces list only once ec790df73b wintun: read packets in bulk 0f85d3f729 wintun: use correct io_context when performing initial read a6151cdeab wintun: use auto-reset events 29acfd95f3 libs: update ASIO to 1.14.0 438a0ef287 Remove outdated and unused android build files e9df57969f Merge remote-tracking branch 'origin/released' 44725ad094 ssl: Fix building with OpenSSL 1.0.2 efe3f1f635 version: Reset version reference for git master 8c79c06d94 Make tls-crypt/tls-cryptv2 compile with multiple compilation units 4d18aaeb88 Fix LLVM warnings reported during OS X build 8c9496bb4d Use const_cast for SSL_session_reused 33be562a39 Add missing override keywords to openssl/sslctx.hpp 2c5435a000 dcocli: use compile time define for Tun methods instead of hardcoded iproute 7c39088f00 Allow overriding reported HW_ADDR and support IV_PLAT_VER 7bb1ea19ee Move sending IV_UI_VER and IV_SSO to build_peer_info 23959fa705 Add reporting of IV_SSL_VER 63ab5b5e46 Only initialise static member in OpenSSLContext once ecebb40304 Merge remote-tracking branch 'origin/qa' 52c9702502 wintun: replace volatiles with atomics d720c7104c appveyor: install Strawberry perl 60a253a7ef appveyor: update to VS2019 48f2b5100b wintun: support for privilege separation 6f266be3d8 wintun: ring buffers support baa1ce2ccf vcxproj: bump VS version to 2019 98bfd037e3 tun/win: factor out ClientConfig into separate header aeb5ce0ad7 wintun: open device with SetupAPI 3998d303ce Finalizing the OpenVPN 3 Core library 3.3 release 728733aee7 deps/mbedtls: rebase "enable unsupported critical extensions" patch 43e36ca45a lib-version: update to mbedtls-2.7.11 4dbcd85e50 openssl/cipher.hpp: add missing include <compat.hpp> 69d72ed64f DCOTransport: Fix server side specific trunk handling ff732e3b5d Fix OpenVPN Core build with OpenSSL 1.1.0 0da42f393f Do not use deprecated OpenSSL 1.1.0 methods 35062c0b60 travis.yml: update environment 47046cf6d2 Merge branch 'qa' 6933c395a4 [OVPN3-423] cliconnect.hpp: fix reconnect on Windows after sleep 462c36c813 random_subnet(): added comment ac1d447156 IP::Addr::from_byte_string(): fixed bug for IPv6 case d6eaea3468 string::split(): minor implementation tweaks ca15b7cdf4 hexstr: added dump_hex() variant accepting void * 0e61a2afd7 SessionIDType::find_weak: added conflict parameter 089aec00b1 DCOTransport: new routing code for trunk links 5befbd430f build: added CAP=1 -- build with libcap eb85ada21e signals: added trivial signal_name() function f89013ef92 RunContext: don't try to catch SIGQUIT by default e0ee540135 SessionIDType: added hash() method f0e1f8aa42 logging: added basic components for logrotate fbb0c81f29 UMask: added UMaskDaemon, a umask context object appropriate for daemons 1c7bac90d9 build script: when building with DEBUG=1 on Linux, use -ggdb instead of -g 73cce80e43 OpenSSL: added openssl_reseed_rng() function 25780cf798 OpenSSL: fixed some memory leaks in CipherContextGCM and TokenEncrypt 168dba95f5 OpenSSL: define OPENSSL_SERVER_SNI when OpenSSL version is at least 1.1 84e78d8fed SNI: added OpenVPN client support for SNI (currently OpenSSL only) 310766b270 build: added MTLS_DIST setting 4eaa46a879 MbedTLS: added MBEDTLS_DISABLE_NAME_CONSTRAINTS preprocessor flag 16226d1b05 OpenSSLSign: updated for OpenSSL 1.1 aed0678c96 SSL: added SNI::Metadata, an abstract base class for packaging app-specific SNI metadata in AuthCert 001b731fe2 SNI: create SNI namespace and rename SNIHandlerBase -> SNI::HandlerBase 4bd5869305 README.rst: Make Windows-specific build steps up to date. ac365ee977 wintun: support for 0.4 9245056a2a wintun: support for 0.3 b73d484950 mbedtls: throw exception on unsupported SSL:Const::PEER_CERT_OPTIONAL option 1d6bae4b5b tcplinkcommon: bubble up real exception error c18c8bd156 tcpcli: ensure SSL Factory survives as long as TLS link 4192193087 tls: parse and load TLS specific CA 2a19b7fcff win/tuncli.hpp: fix Wintun padding calculation 44cb9f44da appveyor: make ReleaseOpenSSL default configuration 5485de19a2 win/impersonate: refactor impersonate logic 29a655147b win/tunsetup.hpp: remove unneeded parameter 61794b0efd win: link OpenSSL dynamically e569b84465 win/tuncli.hpp: fix indentation 374c57e708 frame_init.hpp: tweak wintun read buf size c3c45c9b38 tun: added Error::TUN_HALT for tun_error() signaling acd7af5e9a RandomAPI: added randrange32() method c1a7f8cc68 std::clamp() is useful but only available in C++17 and up, so we add our own clamp() f8c71ef1ce Minor change to Error::INACTIVE_TIMEOUT handler 3202ab5fce OpenSSLSign: renamed OpenSSLPKI::X509Base to OpenSSLPKI::X509 to conform to changes in OpenSSLPKI 8d767febb5 ReachabilityBase: added virtual destructor 6a4826965f MbedTLS: update json_override() prototype bee0d8d187 SSL: added SSLConst::SEND_CLIENT_CA_LIST server-side flag and implemented for OpenSSL 5eb39c1dea AuthCert: save the SNI name 3b34449d0e SSLAPI: auth_cert() can now be const a672e91631 SNI server-side: support additional JSON configuration settings 95e761f3cc OpenSSL PKI cleanup d5eb77c53c AuthCert::Fail cleanup 6e98b9aadc SSLAPI: move PKType from SSLConfigAPI into standalone header to avoid dependency inversion bbae814864 OpenSSL: added SNI implementation 5def1d23ab OpenSSLContext: in constructor, removed redundant if statement 1a0747e783 OpenSSLContext: in constructor, consolidate sslopt fixed flags eef9868816 OpenSSLContext::SSL::ssl_handshake_details(): include leaf-cert CN in details f9631cd90f AuthCert::Fail: use std::string for the reason string (instead of const char *) a17b77641f OpenSSLPKI::X509: copy constructor doesn't need erase() and define X509::Ptr 78cae5bb52 OpenSSLPKI::DH: copy constructor doesn't need erase() c0d43a4153 RCPtr: added static_pointer_cast() method 34a3f264f5 [OVPN-314] Add support for signalling SSO support via IV_SSO 7d112eb3e5 cli: enable utf8 console output 980ef1eff8 win/call.hpp: re-encode command output to utf8 fddb440e99 unicode.hpp: customize utf16 conversion routine 4d7c12ac4d [OVPN3-405] Support for non-ASCII profile path on Windows git-subtree-dir: Sources/OpenVPNAdapter/Libraries/Vendors/openvpn git-subtree-split: 7db7a009b0b4eca0fc3733c99c50aff7f7c2556f
2026-04-24 00:00:05 +08:00 · 2019-10-12 15:50:02 +03:00
parent 5edb23a7ab
commit 8e87aecebf
124 changed files with 3202 additions and 1291 deletions
@@ -0,0 +1,99 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+//
+
+#pragma once
+
+#include <openvpn/asio/scoped_asio_stream.hpp>
+#include <openvpn/tun/client/tunbase.hpp>
+#include <openvpn/tun/client/tunprop.hpp>
+#include <openvpn/tun/persist/tunpersist.hpp>
+#include <openvpn/tun/win/client/tunsetup.hpp>
+
+namespace openvpn {
+  namespace TunWin {
+
+    // These types manage the underlying TAP driver HANDLE
+    typedef openvpn_io::windows::stream_handle TAPStream;
+    typedef ScopedAsioStream<TAPStream> ScopedTAPStream;
+    struct TunPersistState {
+      TunProp::State::Ptr state;
+      RingBuffer::Ptr ring_buffer;
+
+      void reset()
+      {
+	state.reset();
+	ring_buffer.reset();
+      }
+    };
+    typedef TunPersistTemplate<ScopedTAPStream, TunPersistState> TunPersist;
+
+    class ClientConfig : public TunClientFactory
+    {
+      friend class Client; // accesses wfp
+
+    public:
+      typedef RCPtr<ClientConfig> Ptr;
+
+      TunProp::Config tun_prop;
+      int n_parallel = 8;         // number of parallel async reads on tun socket
+      bool wintun = false;
+
+      Frame::Ptr frame;
+      SessionStats::Ptr stats;
+
+      Stop* stop = nullptr;
+
+      TunPersist::Ptr tun_persist;
+
+      TunWin::SetupFactory::Ptr tun_setup_factory;
+
+      TunWin::SetupBase::Ptr new_setup_obj(openvpn_io::io_context& io_context)
+      {
+	if (tun_setup_factory)
+	  return tun_setup_factory->new_setup_obj(io_context, wintun);
+	else
+	  return new TunWin::Setup(io_context, wintun);
+      }
+
+      static Ptr new_obj()
+      {
+	return new ClientConfig;
+      }
+
+      virtual TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
+	TunClientParent& parent,
+	TransportClient* transcli) override;
+
+      virtual void finalize(const bool disconnected) override
+      {
+	if (disconnected)
+	  tun_persist.reset();
+      }
+
+      virtual bool layer_2_supported() const override
+      {
+	return true;
+      }
+    };
+  }
+}
+
@@ -35,6 +35,8 @@
 #include <openvpn/common/stop.hpp>
 #include <openvpn/tun/builder/capture.hpp>

+#include <openvpn/tun/win/ringbuffer.hpp>
+
 namespace openvpn {
  namespace TunWin {
    struct SetupBase : public DestructorBase
@@ -46,7 +48,8 @@ namespace openvpn {
      virtual HANDLE establish(const TunBuilderCapture& pull,
 			       const std::wstring& openvpn_app_path,
 			       Stop* stop,
-			       std::ostream& os) = 0;
+			       std::ostream& os,
+			       RingBuffer::Ptr rings) = 0;

      virtual bool l2_ready(const TunBuilderCapture& pull) = 0;

@@ -38,12 +38,10 @@
 #include <openvpn/tun/persist/tunpersist.hpp>
 #include <openvpn/tun/persist/tunwrapasio.hpp>
 #include <openvpn/tun/tunio.hpp>
+#include <openvpn/tun/win/client/clientconfig.hpp>
 #include <openvpn/tun/win/client/tunsetup.hpp>
 #include <openvpn/win/modname.hpp>
-
-#define OPENVPN_WINTUN_START_PADDING_LEN  12
-#define OPENVPN_WINTUN_PACKET_SIZE_LEN    4
-#define OPENVPN_WINTUN_PACKET_ALIGN       16
+#include <openvpn/tun/win/client/wintun.hpp>

 namespace openvpn {
  namespace TunWin {
@@ -71,9 +69,8 @@ namespace openvpn {
 	  const bool retain_stream,
 	  ReadHandler read_handler,
 	  const Frame::Ptr& frame,
-	  const SessionStats::Ptr& stats,
-	  const bool wintun)
-	: Base(read_handler, frame, stats, wintun ? Frame::READ_WINTUN : Frame::READ_TUN)
+	  const SessionStats::Ptr& stats)
+	: Base(read_handler, frame, stats, Frame::READ_TUN)
      {
 	Base::name_ = name;
 	Base::retain_stream = retain_stream;
@@ -81,60 +78,6 @@ namespace openvpn {
      }
    };

-    // These types manage the underlying TAP driver HANDLE
-    typedef openvpn_io::windows::stream_handle TAPStream;
-    typedef ScopedAsioStream<TAPStream> ScopedTAPStream;
-    typedef TunPersistTemplate<ScopedTAPStream> TunPersist;
-
-    class ClientConfig : public TunClientFactory
-    {
-      friend class Client; // accesses wfp
-
-    public:
-      typedef RCPtr<ClientConfig> Ptr;
-
-      TunProp::Config tun_prop;
-      int n_parallel = 8;         // number of parallel async reads on tun socket
-      bool wintun = false;	  // wintun may return up to 256 packets
-
-      Frame::Ptr frame;
-      SessionStats::Ptr stats;
-
-      Stop* stop = nullptr;
-
-      TunPersist::Ptr tun_persist;
-
-      TunWin::SetupFactory::Ptr tun_setup_factory;
-
-      TunWin::SetupBase::Ptr new_setup_obj(openvpn_io::io_context& io_context)
-      {
-	if (tun_setup_factory)
-	  return tun_setup_factory->new_setup_obj(io_context, wintun);
-	else
-	  return new TunWin::Setup(io_context, wintun);
-      }
-
-      static Ptr new_obj()
-      {
-	return new ClientConfig;
-      }
-
-      virtual TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
-						TunClientParent& parent,
-						TransportClient* transcli) override;
-
-      virtual void finalize(const bool disconnected) override
-      {
-	if (disconnected)
-	  tun_persist.reset();
-      }
-
-      virtual bool layer_2_supported() const override
-      {
-	return true;
-      }
-    };
-
    class Client : public TunClient
    {
      friend class ClientConfig;  // calls constructor
@@ -161,7 +104,7 @@ namespace openvpn {
 	      // Check if persisted tun session matches properties of to-be-created session
 	      if (tun_persist->use_persisted_tun(server_addr, config->tun_prop, opt))
 		{
-		  state = tun_persist->state();
+		  state = tun_persist->state().state;
 		  OPENVPN_LOG("TunPersist: reused tun context");
 		}
 	      else
@@ -192,14 +135,14 @@ namespace openvpn {
 		  {
 		    std::ostringstream os;
 		    auto os_print = Cleanup([&os](){ OPENVPN_LOG_STRING(os.str()); });
-		    th = tun_setup->establish(*po, Win::module_name(), config->stop, os);
+		    th = tun_setup->establish(*po, Win::module_name(), config->stop, os, NULL);
 		  }

 		  // create ASIO wrapper for HANDLE
 		  TAPStream* ts = new TAPStream(io_context, th);

 		  // persist tun settings state
-		  if (tun_persist->persist_tun_state(ts, state))
+		  if (tun_persist->persist_tun_state(ts, { state, nullptr }))
 		    OPENVPN_LOG("TunPersist: saving tun context:" << std::endl << tun_persist->options());

 		  // setup handler for external tun close
@@ -225,8 +168,7 @@ namespace openvpn {
 				     true,
 				     this,
 				     config->frame,
-				     config->stats,
-				     config->wintun));
+				     config->stats));
 	      impl->start(config->n_parallel);

 	      if (!dhcp_capture)
@@ -319,19 +261,6 @@ namespace openvpn {
 	    if (dhcp_capture)
 	      dhcp_inspect(buf);

-	    if (config->wintun)
-	    {
-	      // end padding
-	      auto packet_size = buf.size();
-	      auto end_padding_size = OPENVPN_WINTUN_PACKET_ALIGN -
-		(buf.size() & (OPENVPN_WINTUN_PACKET_ALIGN - 1));
-	      buf.write(wintun_padding, end_padding_size);
-
-	      // start padding and size
-	      buf.prepend(wintun_padding, OPENVPN_WINTUN_START_PADDING_LEN);
-	      buf.prepend((unsigned char *)&packet_size, OPENVPN_WINTUN_PACKET_SIZE_LEN);
-	    }
-
 	    return impl->write(buf);
 	  }
 	else
@@ -343,34 +272,7 @@ namespace openvpn {

      void tun_read_handler(PacketFrom::SPtr& pfp) // called by TunImpl
      {
-	if (config->wintun)
-	  {
-	    // we might receive up to 256 packets
-	    while (pfp->buf.size() > 0)
-	    {
-	      // parse wintun encapsulation
-	      auto packet_size = *(std::uint32_t*)pfp->buf.c_data();
-	      pfp->buf.advance(OPENVPN_WINTUN_PACKET_SIZE_LEN);
-	      pfp->buf.advance(OPENVPN_WINTUN_START_PADDING_LEN);
-
-	      // extract individual packet
-	      frame_context.prepare(wintun_packet);
-	      wintun_packet.write(pfp->buf.c_data(), packet_size);
-
-	      parent.tun_recv(wintun_packet);
-
-	      // skip to the next packet
-	      pfp->buf.advance(packet_size);
-
-	      auto padding = (OPENVPN_WINTUN_PACKET_ALIGN -
-		(packet_size & (OPENVPN_WINTUN_PACKET_ALIGN - 1))) % OPENVPN_WINTUN_PACKET_ALIGN;
-	      pfp->buf.advance(padding);
-	    }
-	  }
-	else
-	  {
-	    parent.tun_recv(pfp->buf);
-	  }
+	parent.tun_recv(pfp->buf);

 #ifdef OPENVPN_DEBUG_TAPWIN
 	tap_process_logging();
@@ -487,8 +389,6 @@ namespace openvpn {
      std::unique_ptr<DHCPCapture> dhcp_capture;
      AsioTimer l2_timer;

-      unsigned char wintun_padding[OPENVPN_WINTUN_PACKET_ALIGN] = {};
-      BufferAllocated wintun_packet;
      Frame::Context& frame_context;

      bool halt;
@@ -498,7 +398,10 @@ namespace openvpn {
 							   TunClientParent& parent,
 							   TransportClient* transcli)
    {
-      return TunClient::Ptr(new Client(io_context, this, parent));
+      if (wintun)
+	return TunClient::Ptr(new WintunClient(io_context, this, parent));
+      else
+	return TunClient::Ptr(new Client(io_context, this, parent));
    }

  }
@@ -68,7 +68,8 @@ namespace openvpn {
      virtual HANDLE establish(const TunBuilderCapture& pull,
 			       const std::wstring& openvpn_app_path,
 			       Stop* stop,
-			       std::ostream& os) override // defined by SetupBase
+			       std::ostream& os,
+			       RingBuffer::Ptr ring_buffer) override // defined by SetupBase
      {
 	// close out old remove cmds, if they exist
 	destroy(os);
@@ -104,7 +105,7 @@ namespace openvpn {
 	switch (pull.layer())
 	  {
 	  case Layer::OSI_LAYER_3:
-	    adapter_config(th(), openvpn_app_path, tap, wintun, pull, false, *add_cmds, *remove_cmds, os);
+	    adapter_config(th(), openvpn_app_path, tap, pull, false, *add_cmds, *remove_cmds, os);
 	    break;
 	  case Layer::OSI_LAYER_2:
 	    adapter_config_l2(th(), openvpn_app_path, tap, pull, *add_cmds, *remove_cmds, os);
@@ -123,6 +124,9 @@ namespace openvpn {
 	if (pull.layer() == Layer::OSI_LAYER_2)
 	  l2_state.reset(new L2State(tap, openvpn_app_path));

+	if (ring_buffer)
+	  register_rings(th(), ring_buffer);
+
 	return th.release();
      }

@@ -162,7 +166,7 @@ namespace openvpn {
 	  {
 	    Win::ScopedHANDLE nh;
 	    ActionList::Ptr add_cmds(new ActionList());
-	    adapter_config(nh(), l2s->openvpn_app_path, l2s->tap, wintun, pull, true, *add_cmds, *remove_cmds, os);
+	    adapter_config(nh(), l2s->openvpn_app_path, l2s->tap, pull, true, *add_cmds, *remove_cmds, os);
 	    add_cmds->execute(os);
 	  }
      }
@@ -250,12 +254,36 @@ namespace openvpn {
 	int indices[2] = {0, 0};
      };

+      void register_rings(HANDLE handle, RingBuffer::Ptr ring_buffer)
+      {
+	TUN_REGISTER_RINGS rings;
+
+	ZeroMemory(&rings, sizeof(rings));
+
+	rings.receive.ring = ring_buffer->receive_ring();
+	rings.receive.tail_moved = ring_buffer->receive_ring_tail_moved();
+	rings.receive.ring_size = sizeof(rings.receive.ring->data);
+
+	rings.send.ring = ring_buffer->send_ring();
+	rings.send.tail_moved = ring_buffer->send_ring_tail_moved();
+	rings.send.ring_size = sizeof(rings.send.ring->data);
+
+	{
+	  Win::Impersonate imp(true);
+
+	  if (!DeviceIoControl(handle, TUN_IOCTL_REGISTER_RINGS, &rings, sizeof(rings), NULL, NULL, NULL, NULL))
+	    {
+	      const Win::LastError err;
+	      throw ErrorCode(Error::TUN_REGISTER_RINGS_ERROR, true, "Error registering ring buffers: " + err.message());
+	    }
+	}
+      }
+
 #if _WIN32_WINNT >= 0x0600
      // Configure TAP adapter on Vista and higher
      void adapter_config(HANDLE th,
 			  const std::wstring& openvpn_app_path,
 			  const Util::TapNameGuidPair& tap,
-			  bool wintun,
 			  const TunBuilderCapture& pull,
 			  const bool l2_post,
 			  ActionList& create,
@@ -0,0 +1,318 @@
+#pragma once
+
+#include <openvpn/tun/client/tunbase.hpp>
+#include <openvpn/tun/persist/tunpersist.hpp>
+#include <openvpn/tun/win/client/setupbase.hpp>
+#include <openvpn/tun/win/client/clientconfig.hpp>
+#include <openvpn/win/modname.hpp>
+
+namespace openvpn {
+  namespace TunWin {
+
+    class WintunClient : public TunClient
+    {
+      typedef RCPtr<WintunClient> Ptr;
+
+    public:
+      WintunClient(openvpn_io::io_context& io_context_arg,
+		   ClientConfig* config_arg,
+		   TunClientParent& parent_arg)
+	: io_context(io_context_arg),
+	  config(config_arg),
+	  parent(parent_arg),
+	  state(new TunProp::State()),
+	  frame(config_arg->frame)
+      {
+      }
+
+      // Inherited via TunClient
+      void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&) override
+      {
+	halt = false;
+	if (config->tun_persist)
+	  tun_persist = config->tun_persist; // long-term persistent
+	else
+	  tun_persist.reset(new TunPersist(false, false, nullptr)); // short-term
+
+	try {
+
+	  const IP::Addr server_addr = transcli.server_endpoint_addr();
+
+	  // Check if persisted tun session matches properties of to-be-created session
+	  if (tun_persist->use_persisted_tun(server_addr, config->tun_prop, opt))
+	    {
+	      state = tun_persist->state().state;
+	      ring_buffer = tun_persist->state().ring_buffer;
+	      OPENVPN_LOG("TunPersist: reused tun context");
+	    }
+	  else
+	    {
+	      // notify parent
+	      parent.tun_pre_tun_config();
+
+	      // close old TAP handle if persisted
+	      tun_persist->close();
+
+	      // parse pushed options
+	      TunBuilderCapture::Ptr po(new TunBuilderCapture());
+	      TunProp::configure_builder(po.get(),
+					 state.get(),
+					 config->stats.get(),
+					 server_addr,
+					 config->tun_prop,
+					 opt,
+					 nullptr,
+					 false);
+	      OPENVPN_LOG("CAPTURED OPTIONS:" << std::endl << po->to_string());
+
+	      // create new tun setup object
+	      tun_setup = config->new_setup_obj(io_context);
+
+	      ring_buffer.reset(new RingBuffer(io_context));
+
+	      // open/config TAP
+	      HANDLE th;
+	      {
+		std::ostringstream os;
+		auto os_print = Cleanup([&os]() { OPENVPN_LOG_STRING(os.str()); });
+		th = tun_setup->establish(*po, Win::module_name(), config->stop, os, ring_buffer);
+	      }
+
+	      // create ASIO wrapper for HANDLE
+	      TAPStream* ts = new TAPStream(io_context, th);
+
+	      // persist tun settings state
+	      if (tun_persist->persist_tun_state(ts, { state, ring_buffer }))
+		OPENVPN_LOG("TunPersist: saving tun context:" << std::endl << tun_persist->options());
+
+	      // enable tun_setup destructor
+	      tun_persist->add_destructor(tun_setup);
+
+	      // assert ownership over TAP device handle
+	      tun_setup->confirm();
+	    }
+
+	  openvpn_io::post(io_context, [self=Ptr(this)](){
+	    self->read();
+	  });
+
+	  parent.tun_connected(); // signal that we are connected
+	}
+	catch (const std::exception& e)
+	  {
+	    stop();
+	    Error::Type err = Error::TUN_SETUP_FAILED;
+	    const ExceptionCode* ec = dynamic_cast<const ExceptionCode*>(&e);
+	    if (ec && ec->code_defined())
+	      err = ec->code();
+	    parent.tun_error(err, e.what());
+	  }
+      }
+
+      void stop() override
+      {
+	if (!halt)
+	  {
+	    halt = true;
+
+	    tun_persist.reset();
+	  }
+      }
+
+      void set_disconnect() override
+      {
+
+      }
+
+      bool tun_send(BufferAllocated& buf) override
+      {
+	TUN_RING* receive_ring = ring_buffer->receive_ring();
+
+	ULONG head = receive_ring->head.load(std::memory_order_acquire);
+	if (head > WINTUN_RING_CAPACITY)
+	  {
+	    if (head == 0xFFFFFFFF)
+	      parent.tun_error(Error::TUN_WRITE_ERROR, "invalid ring head/tail or bogus packet received");
+	    return false;
+	  }
+
+	ULONG tail = receive_ring->tail.load(std::memory_order_acquire);
+	if (tail >= WINTUN_RING_CAPACITY)
+	  return false;
+
+	ULONG aligned_packet_size = packet_align(sizeof(TUN_PACKET_HEADER) + buf.size());
+	ULONG buf_space = wrap(head - tail - WINTUN_PACKET_ALIGN);
+	if (aligned_packet_size > buf_space)
+	  {
+	    OPENVPN_LOG("ring is full");
+	    return false;
+	  }
+
+	// copy packet size and data into ring
+	TUN_PACKET* packet = (TUN_PACKET*)& receive_ring->data[tail];
+	packet->size = buf.size();
+	std::memcpy(packet->data, buf.data(), buf.size());
+
+	// move ring tail
+	receive_ring->tail.store(wrap(tail + aligned_packet_size), std::memory_order_release);
+	if (receive_ring->alertable.load(std::memory_order_acquire) != 0)
+	  SetEvent(ring_buffer->receive_ring_tail_moved());
+
+	return true;
+      }
+
+      std::string tun_name() const override
+      {
+	return "wintun";
+      }
+
+      std::string vpn_ip4() const override
+      {
+	if (state->vpn_ip4_addr.specified())
+	  return state->vpn_ip4_addr.to_string();
+	else
+	  return "";
+      }
+
+      std::string vpn_ip6() const override
+      {
+	if (state->vpn_ip6_addr.specified())
+	  return state->vpn_ip6_addr.to_string();
+	else
+	  return "";
+      }
+
+      std::string vpn_gw4() const override
+      {
+	if (state->vpn_ip4_gw.specified())
+	  return state->vpn_ip4_gw.to_string();
+	else
+	  return "";
+      }
+
+      std::string vpn_gw6() const override
+      {
+	if (state->vpn_ip6_gw.specified())
+	  return state->vpn_ip6_gw.to_string();
+	else
+	  return "";
+      }
+
+    private:
+      void read()
+      {
+	TUN_RING* send_ring = ring_buffer->send_ring();
+
+	if (halt)
+	  return;
+
+	ULONG head = send_ring->head.load(std::memory_order_acquire);
+	if (head >= WINTUN_RING_CAPACITY)
+	  {
+	    parent.tun_error(Error::TUN_ERROR, "ring head exceeds ring capacity");
+	    return;
+	  }
+
+	ULONG tail = send_ring->tail.load(std::memory_order_acquire);
+	if (tail >= WINTUN_RING_CAPACITY)
+	  {
+	    parent.tun_error(Error::TUN_ERROR, "ring tail exceeds ring capacity");
+	    return;
+	  }
+
+	while (true)
+	  {
+	    // tail has moved?
+	    if (head == tail)
+	      {
+		ring_buffer->send_tail_moved_asio_event().async_wait([self = Ptr(this)](const openvpn_io::error_code& error) {
+		  if (!error)
+		    self->read();
+		  else
+		    {
+		      if (!self->halt)
+			self->parent.tun_error(Error::TUN_ERROR, "error waiting on ring send tail moved");
+		    }
+		});
+		return;
+	      }
+
+	    // read buffer content
+	    ULONG content_len = wrap(tail - head);
+	    if (content_len < sizeof(TUN_PACKET_HEADER))
+	      {
+		parent.tun_error(Error::TUN_ERROR, "incomplete packet header in send ring");
+		return;
+	      }
+
+	    TUN_PACKET* packet = (TUN_PACKET *)&send_ring->data[head];
+	    if (packet->size > WINTUN_MAX_PACKET_SIZE)
+	      {
+		parent.tun_error(Error::TUN_ERROR, "packet too big in send ring");
+		return;
+	      }
+
+	    ULONG aligned_packet_size = packet_align(sizeof(TUN_PACKET_HEADER) + packet->size);
+	    if (aligned_packet_size > content_len)
+	      {
+		parent.tun_error(Error::TUN_ERROR, "incomplete packet in send ring");
+		return;
+	      }
+
+	    frame->prepare(Frame::READ_TUN, buf);
+
+	    buf.write(packet->data, packet->size);
+
+	    head = wrap(head + aligned_packet_size);
+	    send_ring->head.store(head, std::memory_order_release);
+
+	    parent.tun_recv(buf);
+
+	    if (halt)
+	      return;
+	  }
+      }
+
+      struct TUN_PACKET_HEADER
+      {
+	uint32_t size;
+      };
+
+      struct TUN_PACKET
+      {
+	uint32_t size;
+	UCHAR data[WINTUN_MAX_PACKET_SIZE];
+      };
+
+      ULONG packet_align(ULONG size)
+      {
+	return (size + (WINTUN_PACKET_ALIGN - 1)) & ~(WINTUN_PACKET_ALIGN - 1);
+      }
+
+      ULONG wrap(ULONG value)
+      {
+	return value & (WINTUN_RING_CAPACITY - 1);
+      }
+
+      openvpn_io::io_context& io_context;
+      TunPersist::Ptr tun_persist; // contains the TAP device HANDLE
+      ClientConfig::Ptr config;
+      TunClientParent& parent;
+      TunProp::State::Ptr state;
+      TunWin::SetupBase::Ptr tun_setup;
+
+      TUN_RING* receive_ring = nullptr;
+      TUN_RING* send_ring = nullptr;
+
+      BufferAllocated buf;
+
+      Frame::Ptr frame;
+
+      bool halt = false;
+
+      ScopedHANDLE driver_handle;
+
+      RingBuffer::Ptr ring_buffer;
+    };
+  }
+}