Merge pull request #91 from selvanair/pkcs11-pin-v3

pkcs11 pin prompt

main.c

@@ -116,6 +116,8 @@ int WINAPI _tWinMain (HINSTANCE hThisInstance,
       { password, OnPassword },
       { proxy,    OnProxy },
       { stop,     OnStop },
+      { needok,   OnNeedOk },
+      { needstr,  OnNeedStr },
       { 0,        NULL }
   };
   InitManagement(handler);

manage.c

@@ -312,6 +312,16 @@ OnManagement(SOCKET sk, LPARAM lParam)
                     if (rtmsg_handler[ready])
                         rtmsg_handler[ready](c, pos + 5);
                 }
+                else if (strncmp(pos, "NEED-OK:", 8) == 0)
+                {
+                    if (rtmsg_handler[needok])
+                        rtmsg_handler[needok](c, pos + 8);
+                }
+                else if (strncmp(pos, "NEED-STR:", 9) == 0)
+                {
+                    if (rtmsg_handler[needstr])
+                        rtmsg_handler[needstr](c, pos + 9);
+                }
             }
             else if (c->manage.cmd_queue)
             {

misc.c

@@ -40,7 +40,7 @@
  * Helper function to do base64 conversion through CryptoAPI
  * Returns TRUE on success, FALSE on error. Caller must free *output.
  */
-static BOOL
+BOOL
 Base64Encode(const char *input, int input_len, char **output)
 {
     DWORD output_len;
@@ -61,6 +61,9 @@ Base64Encode(const char *input, int input_len, char **output)
         return FALSE;
     }
     *output = (char *)malloc(output_len);
+    if (*output == NULL)
+        return FALSE;
+
     if (!CryptBinaryToStringA((const BYTE *) input, (DWORD) input_len,
         CRYPT_STRING_BASE64, *output, &output_len))
     {
@@ -80,6 +83,46 @@ Base64Encode(const char *input, int input_len, char **output)
 
     return TRUE;
 }
+/*
+ * Decode a nul-terminated base64 encoded input and save the result in
+ * an allocated buffer *output. The caller must free *output after use.
+ * The decoded output is nul-terminated so that the caller may treat
+ * it as a string when appropriate.
+ *
+ * Return the length of the decoded result (excluding nul) or -1 on
+ * error.
+ */
+int
+Base64Decode(const char *input, char **output)
+{
+    DWORD len;
+
+    PrintDebug (L"decoding %S", input);
+    if (!CryptStringToBinaryA(input, 0, CRYPT_STRING_BASE64_ANY,
+                              NULL, &len, NULL, NULL) || len == 0)
+    {
+        *output = NULL;
+        return -1;
+    }
+
+    *output = malloc(len + 1);
+    if (*output == NULL)
+        return -1;
+
+    if (!CryptStringToBinaryA(input, 0,
+        CRYPT_STRING_BASE64, (BYTE *) *output, &len, NULL, NULL))
+    {
+        free(*output);
+        *output = NULL;
+        return -1;
+    }
+
+    /* NUL terminate output */
+    (*output)[len] = '\0';
+    PrintDebug (L"Decoded output %S", *output);
+
+    return len;
+}
 
 /*
  * Helper function to convert UCS-2 text from a dialog item to UTF-8.
@@ -384,3 +427,29 @@ CheckFileAccess (const TCHAR *path, int access)
 
     return ret;
 }
+
+/*
+ * Convert a NUL terminated utf8 string to widechar. The caller must free
+ * the returned pointer. Return NULL on error.
+ */
+WCHAR *
+Widen(const char *utf8)
+{
+    WCHAR *wstr = NULL;
+    if (!utf8)
+        return wstr;
+
+    int nch = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
+    if (nch > 0)
+        wstr = malloc(sizeof(WCHAR) * nch);
+    if (wstr)
+        nch =  MultiByteToWideChar(CP_UTF8, 0, utf8, -1, wstr, nch);
+
+    if (nch == 0 && wstr)
+    {
+        free (wstr);
+        wstr = NULL;
+    }
+
+    return wstr;
+}

misc.h

@@ -36,4 +36,7 @@ BOOL IsUserAdmin(VOID);
 HANDLE InitSemaphore (void);
 BOOL CheckFileAccess (const TCHAR *path, int access);
 
+BOOL Base64Encode(const char *input, int input_len, char **output);
+int Base64Decode(const char *input, char **output);
+WCHAR *Widen(const char *utf8);
 #endif

openvpn-gui-res.h

@@ -62,6 +62,11 @@
 #define ID_EDT_AUTH_CHALLENGE            185
 #define ID_CHK_SAVE_PASS                 186
 
+/* Challenege Response Dialog */
+#define ID_DLG_CHALLENGE_RESPONSE        190
+#define ID_TXT_DESCRIPTION               191
+#define ID_EDT_RESPONSE                  192
+
 /* Proxy Settings Dialog */
 #define ID_DLG_PROXY                     200
 #define ID_RB_PROXY_OPENVPN              210
@@ -296,7 +301,12 @@
 /* Save password related messages */
 #define IDS_NFO_DELETE_PASS             2001
 
+/* Token password dialog related */
+#define IDS_NFO_TOKEN_PASSWORD_CAPTION  2100
+#define IDS_NFO_TOKEN_PASSWORD_REQUEST  2101
+
 /* Timer IDs */
 #define IDT_STOP_TIMER                  2500  /* Timer used to trigger force termination */
 
+
 #endif

openvpn.c

@@ -59,12 +59,46 @@ TerminateOpenVPN(connection_t *c);
 
 const TCHAR *cfgProp = _T("conn");
 
+#define FLAG_CR_TYPE_SCRV1 0x1    /* static challenege */
+#define FLAG_CR_TYPE_CRV1  0x2    /* dynamic challenege */
+#define FLAG_CR_ECHO       0x4    /* echo the response */
+#define FLAG_CR_RESPONSE   0x8    /* response needed */
+#define FLAG_PASS_TOKEN    0x10   /* PKCS11 token password needed */
+#define FLAG_STRING_PKCS11 0x20   /* PKCS11 id needed */
+#define FLAG_PASS_PKEY     0x40   /* Private key password needed */
+
 typedef struct {
     connection_t *c;
-    int challenge_echo;
+    unsigned int flags;
-    char *challenge_str;
+    char *str;
+    char *id;
+    char *user;
 } auth_param_t;
 
+static void
+WriteStatusLog (connection_t *c, const WCHAR *prefix, const WCHAR *line, BOOL fileio);
+
+static void
+free_auth_param (auth_param_t *param)
+{
+    if (!param)
+        return;
+    free (param->str);
+    free (param->id);
+    free (param->user);
+    free (param);
+}
+
+void
+AppendTextToCaption (HANDLE hwnd, const WCHAR *str)
+{
+    WCHAR old[256];
+    WCHAR new[256];
+    GetWindowTextW (hwnd, old, _countof(old));
+    _sntprintf_0 (new, L"%s (%s)", old, str);
+    SetWindowText (hwnd, new);
+}
+
 /*
  * Receive banner on connection to management interface
  * Format: <BANNER>
@@ -170,7 +204,7 @@ OnStateChange(connection_t *c, char *data)
             *pos = '\0';
 
         /* Convert the IP address to Unicode */
-        MultiByteToWideChar(CP_ACP, 0, local_ip, -1, c->ip, _countof(c->ip));
+        MultiByteToWideChar(CP_UTF8, 0, local_ip, -1, c->ip, _countof(c->ip));
 
         /* Show connection tray balloon */
         if ((c->state == connecting   && o.show_balloon != 0)
@@ -198,14 +232,17 @@ OnStateChange(connection_t *c, char *data)
     }
     else if (strcmp(state, "RECONNECTING") == 0)
     {
-        if (strcmp(message, "auth-failure") == 0
+        if (!c->dynamic_cr)
-        ||  strcmp(message, "private-key-password-failure") == 0)
+        {
-            c->failed_psw_attempts++;
+            if (strcmp(message, "auth-failure") == 0 || strcmp(message, "private-key-password-failure") == 0)
+                c->failed_psw_attempts++;
 
-        if (strcmp(message, "auth-failure") == 0 && (c->flags & FLAG_SAVE_AUTH_PASS))
+            if (strcmp(message, "auth-failure") == 0 && (c->flags & FLAG_SAVE_AUTH_PASS))
-            SaveAuthPass(c->config_name, L"");
+                SaveAuthPass(c->config_name, L""); /* clear saved password */
-        else if (strcmp(message, "private-key-password-failure") == 0 && (c->flags & FLAG_SAVE_KEY_PASS))
+
-            SaveKeyPass(c->config_name, L"");
+            else if (strcmp(message, "private-key-password-failure") == 0 && (c->flags & FLAG_SAVE_KEY_PASS))
+                SaveKeyPass(c->config_name, L"");  /* clear saved private key password */
+        }
 
         c->state = reconnecting;
         CheckAndSetTrayIcon();
@@ -215,7 +252,6 @@ OnStateChange(connection_t *c, char *data)
     }
 }
 
-
 /*
  * DialogProc for OpenVPN username/password/challenge auth dialog windows
  */
@@ -232,19 +268,24 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
         /* Set connection for this dialog and show it */
         param = (auth_param_t *) lParam;
         SetProp(hwndDlg, cfgProp, (HANDLE) param);
-        if (param->challenge_str)
+
+        if (param->str)
         {
-            int wchars_num = MultiByteToWideChar(CP_UTF8, 0, param->challenge_str, -1, NULL, 0);
+            LPWSTR wstr = Widen (param->str);
-            LPWSTR wstr = (LPWSTR)malloc(sizeof(WCHAR) * wchars_num);
             HWND wnd_challenge = GetDlgItem(hwndDlg, ID_EDT_AUTH_CHALLENGE);
 
-            MultiByteToWideChar(CP_UTF8, 0, param->challenge_str, -1, wstr, wchars_num);
+            if (!wstr)
-            SetDlgItemTextW(hwndDlg, ID_TXT_AUTH_CHALLENGE, wstr);
+                WriteStatusLog(param->c, L"GUI> ", L"Error converting challenge string to widechar", false);
+            else
+                SetDlgItemTextW(hwndDlg, ID_TXT_AUTH_CHALLENGE, wstr);
+
             free(wstr);
+
             /* Set/Remove style ES_PASSWORD by SetWindowLong(GWL_STYLE) does nothing,
                send EM_SETPASSWORDCHAR just works. */
-            if(param->challenge_echo)
+            if (param->flags & FLAG_CR_ECHO)
                 SendMessage(wnd_challenge, EM_SETPASSWORDCHAR, 0, 0);
+
         }
         if (RecallUsername(param->c->config_name, username))
             SetDlgItemTextW(hwndDlg, ID_EDT_AUTH_USER, username);
@@ -256,10 +297,13 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
         if (param->c->flags & FLAG_SAVE_AUTH_PASS)
             Button_SetCheck(GetDlgItem (hwndDlg, ID_CHK_SAVE_PASS), BST_CHECKED);
 
+        AppendTextToCaption (hwndDlg, param->c->config_name);
+
         if (param->c->state == resuming)
             ForceForegroundWindow(hwndDlg);
         else
             SetForegroundWindow(hwndDlg);
+
         break;
 
     case WM_COMMAND:
@@ -298,7 +342,7 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
                 SecureZeroMemory(password, sizeof(password));
             }
             ManagementCommandFromInput(param->c, "username \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_USER);
-            if (param->challenge_str)
+            if (param->flags & FLAG_CR_TYPE_SCRV1)
                 ManagementCommandFromInputBase64(param->c, "password \"Auth\" \"SCRV1:%s:%s\"", hwndDlg, ID_EDT_AUTH_PASS, ID_EDT_AUTH_CHALLENGE);
             else
                 ManagementCommandFromInput(param->c, "password \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_PASS);
@@ -318,8 +362,7 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
 
     case WM_NCDESTROY:
         param = (auth_param_t *) GetProp(hwndDlg, cfgProp);
-        if (param->challenge_str) free(param->challenge_str);
+        free_auth_param (param);
-        free(param);
         RemoveProp(hwndDlg, cfgProp);
         break;
     }
@@ -327,6 +370,127 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
     return FALSE;
 }
 
+/*
+ * DialogProc for challenge-response, token PIN etc.
+ */
+INT_PTR CALLBACK
+GenericPassDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
+{
+    auth_param_t *param;
+
+    switch (msg)
+    {
+    case WM_INITDIALOG:
+        param = (auth_param_t *) lParam;
+        SetProp(hwndDlg, cfgProp, (HANDLE) param);
+
+        WCHAR *wstr = Widen (param->str);
+        if (!wstr)
+        {
+            WriteStatusLog(param->c, L"GUI> ", L"Error converting challenge string to widechar", false);
+            EndDialog(hwndDlg, LOWORD(wParam));
+            break;
+        }
+        if (param->flags & FLAG_CR_TYPE_CRV1)
+        {
+            SetDlgItemTextW(hwndDlg, ID_TXT_DESCRIPTION, wstr);
+
+            /* Set password echo on if needed */
+            if (param->flags & FLAG_CR_ECHO)
+                SendMessage(GetDlgItem(hwndDlg, ID_EDT_RESPONSE), EM_SETPASSWORDCHAR, 0, 0);
+        }
+        else if (param->flags & FLAG_PASS_TOKEN)
+        {
+            SetWindowText(hwndDlg, LoadLocalizedString(IDS_NFO_TOKEN_PASSWORD_CAPTION));
+            SetDlgItemText(hwndDlg, ID_TXT_DESCRIPTION, LoadLocalizedString(IDS_NFO_TOKEN_PASSWORD_REQUEST, param->id));
+        }
+        else
+        {
+            WriteStatusLog(param->c, L"GUI> ", L"Unknown password request", false);
+            SetDlgItemText(hwndDlg, ID_TXT_DESCRIPTION, wstr);
+        }
+        free(wstr);
+
+        AppendTextToCaption (hwndDlg, param->c->config_name);
+        if (param->c->state == resuming)
+            ForceForegroundWindow(hwndDlg);
+        else
+            SetForegroundWindow(hwndDlg);
+
+        break;
+
+    case WM_COMMAND:
+        param = (auth_param_t *) GetProp(hwndDlg, cfgProp);
+        const char *template;
+        char *fmt;
+        switch (LOWORD(wParam))
+        {
+        case IDOK:
+            if (param->flags & FLAG_CR_TYPE_CRV1)
+            {
+                /* send username */
+                template = "username \"Auth\" \"%s\"";
+                fmt = malloc(strlen(template) + strlen(param->user));
+
+                if (fmt)
+                {
+                    sprintf(fmt, template, param->user);
+                    ManagementCommand(param->c, fmt, NULL, regular);
+                    free(fmt);
+                }
+                else /* no memory? send an emty username and let it error out */
+                {
+                    WriteStatusLog(param->c, L"GUI> ",
+                        L"Out of memory: sending a generic username for dynamic CR", false);
+                    ManagementCommand(param->c, "username \"Auth\" \"user\"", NULL, regular);
+                }
+
+                /* password template */
+                template = "password \"Auth\" \"CRV1::%s::%%s\"";
+            }
+            else /* generic password request of type param->id */
+            {
+                template = "password \"%s\" \"%%s\"";
+            }
+
+            fmt = malloc(strlen(template) + strlen(param->id));
+            if (fmt)
+            {
+                sprintf(fmt, template, param->id);
+                PrintDebug(L"Send passwd to mgmt with format: '%S'", fmt);
+                ManagementCommandFromInput(param->c, fmt, hwndDlg, ID_EDT_RESPONSE);
+                free (fmt);
+            }
+            else /* no memory? send stop signal */
+            {
+                WriteStatusLog(param->c, L"GUI> ",
+                    L"Out of memory in password dialog: sending stop signal", false);
+                StopOpenVPN (param->c);
+            }
+
+            EndDialog(hwndDlg, LOWORD(wParam));
+            return TRUE;
+
+        case IDCANCEL:
+            EndDialog(hwndDlg, LOWORD(wParam));
+            StopOpenVPN(param->c);
+            return TRUE;
+        }
+        break;
+
+    case WM_CLOSE:
+        EndDialog(hwndDlg, LOWORD(wParam));
+        return TRUE;
+
+    case WM_NCDESTROY:
+        param = (auth_param_t *) GetProp(hwndDlg, cfgProp);
+        free_auth_param (param);
+        RemoveProp(hwndDlg, cfgProp);
+        break;
+    }
+
+    return FALSE;
+}
 
 /*
  * DialogProc for OpenVPN private key password dialog windows
@@ -343,6 +507,7 @@ PrivKeyPassDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
         /* Set connection for this dialog and show it */
         c = (connection_t *) lParam;
         SetProp(hwndDlg, cfgProp, (HANDLE) c);
+        AppendTextToCaption (hwndDlg, c->config_name);
         if (RecallKeyPass(c->config_name, passphrase) && wcslen(passphrase))
         {
             /* Use the saved password and skip the dialog */
@@ -405,31 +570,193 @@ PrivKeyPassDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
   return FALSE;
 }
 
+static void
+free_dynamic_cr (connection_t *c)
+{
+    free (c->dynamic_cr);
+    c->dynamic_cr = NULL;
+}
 
 /*
- * Handle the request to release a hold from the OpenVPN management interface
+ * Parse dynamic challenge string received from the server. Returns
+ * true on success. The caller must free param->str and param->id
+ * even on error.
+ */
+static BOOL
+parse_dynamic_cr (const char *str, auth_param_t *param)
+{
+    BOOL ret = FALSE;
+    char *token[4] = {0};
+    char *p = strdup (str);
+
+    int i;
+    char *p1;
+
+    if (!param || !p) goto out;
+
+    /* expected: str = "E,R:challenge_id:user_b64:challenge_str" */
+    for (i = 0, p1 = p; i < 4; ++i, p1 = NULL)
+    {
+        token[i] = strtok (p1, ":"); /* strtok is thread-safe on Windows */
+        if (!token[i])
+        {
+            WriteStatusLog(param->c, L"GUI> ", L"Error parsing dynamic challenge string", false);
+            goto out;
+        }
+    }
+
+    if (Base64Decode(token[2], &param->user) < 0)
+    {
+        WriteStatusLog(param->c, L"GUI> ", L"Error decoding the username in dynamic challenge string", false);
+        goto out;
+    }
+
+    param->flags |= FLAG_CR_TYPE_CRV1;
+    param->flags |= strchr(token[0], 'E') ? FLAG_CR_ECHO : 0;
+    param->flags |= strchr(token[0], 'R') ? FLAG_CR_RESPONSE : 0;
+    param->id = strdup(token[1]);
+    param->str = strdup(token[3]);
+    if (!param->id || !param->str)
+        goto out;
+
+    ret = TRUE;
+
+out:
+    free (p);
+    return ret;
+}
+
+/*
+ * Parse password or string request of the form "Need 'What' password/string MSG:message"
+ * and assign param->id = What, param->str = message. Also set param->flags if the type
+ * of the requested info is known. If message is empty param->id is copied to param->str.
+ * Return true on succsess. The caller must free param even when the function fails.
+ */
+static BOOL
+parse_input_request (const char *msg, auth_param_t *param)
+{
+    BOOL ret = FALSE;
+    char *p = strdup (msg);
+    char *sep[4] = {" ", "'", " ", ""}; /* separators to use to break up msg */
+    char *token[4];
+
+    char *p1 = p;
+    for (int i = 0; i < 4; ++i, p1 = NULL)
+    {
+        token[i] = strtok (p1, sep[i]); /* strtok is thread-safe on Windows */
+        if (!token[i] && i < 3) /* first three tokens required */
+            goto out;
+    }
+    if (token[3] && strncmp(token[3], "MSG:", 4) == 0)
+        token[3] += 4;
+    if (!token[3] || !*token[3]) /* use id as the description if none provided */
+        token[3] = token[1];
+
+    PrintDebug (L"Tokens: '%S' '%S' '%S' '%S'", token[0], token[1],
+                token[2], token[3]);
+
+    if (strcmp (token[0], "Need") != 0)
+        goto out;
+
+    if ((param->id = strdup(token[1])) == NULL)
+        goto out;
+
+    if (strcmp(token[2], "password") == 0)
+    {
+        if (strcmp (param->id, "Private Key") == 0)
+            param->flags |= FLAG_PASS_PKEY;
+        else
+            param->flags |= FLAG_PASS_TOKEN;
+    }
+    else if (strcmp(token[2], "string") == 0
+             && strcmp (param->id, "pkcs11-id-request") == 0)
+    {
+        param->flags |= FLAG_STRING_PKCS11;
+    }
+
+    param->str = strdup (token[3]);
+    if (param->str == NULL)
+        goto out;
+
+    PrintDebug (L"parse_input_request: id = '%S' str = '%S' flags = %u",
+                param->id, param->str, param->flags);
+    ret = TRUE;
+
+out:
+    free (p);
+    if (!ret)
+        PrintDebug (L"Error parsing password/string request msg: <%S>", msg);
+    return ret;
+}
+
+/*
+ * Handle >PASSWORD: request from OpenVPN management interface
  */
 void
 OnPassword(connection_t *c, char *msg)
 {
+    PrintDebug(L"OnPassword with msg = %S", msg);
     if (strncmp(msg, "Verification Failed", 19) == 0)
+    {
+        /* If the failure is due to dynamic challenge save the challenge string */
+        char *chstr = strstr(msg, "CRV1:");
+
+        free_dynamic_cr (c);
+        if (chstr)
+        {
+            chstr += 5; /* beginning of dynamic CR string */
+
+            /* Check if a response is required: ie.,  starts with R or E,R */
+            if (strncmp (chstr, "R", 1) != 0 && strncmp (chstr, "E,R", 3) != 0)
+            {
+                PrintDebug(L"Got dynamic challenge request with no response required: <%S>", chstr);
+                return;
+            }
+
+            /* Save the string for later processing during next Auth request */
+            c->dynamic_cr = strdup(chstr);
+            if (c->dynamic_cr && (chstr =  strstr (c->dynamic_cr, "']")) != NULL)
+                *chstr = '\0';
+
+            PrintDebug(L"Got dynamic challenge: <%S>", c->dynamic_cr);
+        }
+
         return;
+    }
 
     if (strstr(msg, "'Auth'"))
     {
-        char* chstr = strstr(msg, "SC:");
+        char *chstr;
-        auth_param_t *param = (auth_param_t *) malloc(sizeof(auth_param_t));
+        auth_param_t *param = (auth_param_t *) calloc(1, sizeof(auth_param_t));
-        param->c = c;
+
-        if (chstr)
+        if (!param)
         {
-            param->challenge_echo = *(chstr + 3) != '0';
+            WriteStatusLog (c, L"GUI> ", L"Error: Out of memory - ignoring user-auth request", false);
-            param->challenge_str = strdup(chstr + 5);
+            return;
+        }
+        param->c = c;
+
+        if (c->dynamic_cr)
+        {
+            if (!parse_dynamic_cr (c->dynamic_cr, param))
+            {
+                WriteStatusLog (c, L"GUI> ", L"Error parsing dynamic challenge string", FALSE);
+                free_dynamic_cr (c);
+                free_auth_param (param);
+                return;
+            }
+            LocalizedDialogBoxParam(ID_DLG_CHALLENGE_RESPONSE, GenericPassDialogFunc, (LPARAM) param);
+            free_dynamic_cr (c);
+        }
+        else if ( (chstr = strstr(msg, "SC:")) && strlen (chstr) > 5)
+        {
+            param->flags |= FLAG_CR_TYPE_SCRV1;
+            param->flags |= (*(chstr + 3) != '0') ? FLAG_CR_ECHO : 0;
+            param->str = strdup(chstr + 5);
             LocalizedDialogBoxParam(ID_DLG_AUTH_CHALLENGE, UserAuthDialogFunc, (LPARAM) param);
         }
         else
         {
-            param->challenge_echo = 0;
-            param->challenge_str = NULL;
             LocalizedDialogBoxParam(ID_DLG_AUTH, UserAuthDialogFunc, (LPARAM) param);
         }
     }
@@ -445,6 +772,24 @@ OnPassword(connection_t *c, char *msg)
     {
         QueryProxyAuth(c, socks);
     }
+    /* All other password requests such as PKCS11 pin */
+    else if (strncmp(msg, "Need '", 6) == 0)
+    {
+        auth_param_t *param = (auth_param_t *) calloc(1, sizeof(auth_param_t));
+
+        if (!param)
+        {
+            WriteStatusLog (c, L"GUI> ", L"Error: Out of memory - ignoring user-auth request", false);
+            return;
+        }
+        param->c = c;
+        if (!parse_input_request (msg, param))
+        {
+            free_auth_param(param);
+            return;
+        }
+        LocalizedDialogBoxParam(ID_DLG_CHALLENGE_RESPONSE, GenericPassDialogFunc, (LPARAM) param);
+    }
 }
 
 
@@ -756,7 +1101,7 @@ OnService(connection_t *c, UNUSED char *msg)
     while (p && *p)
     {
         next = WrapLine (p);
-        WriteStatusLog (c, prefix, p, c->manage.connected ? FALSE : TRUE);
+        WriteStatusLog (c, prefix, p, false);
         p = next;
     }
     free (buf);
@@ -802,6 +1147,65 @@ OnProcess (connection_t *c, UNUSED char *msg)
     OnStop (c, NULL);
 }
 
+/*
+ * Called when NEED-OK is received
+ */
+void
+OnNeedOk (connection_t *c, char *msg)
+{
+    char *resp = NULL;
+    WCHAR *wstr = NULL;
+    auth_param_t *param = (auth_param_t *) calloc(1, sizeof(auth_param_t));
+
+    if (!param)
+    {
+        WriteStatusLog(c, L"GUI> ", L"Error: out of memory while processing NEED-OK. Sending stop signal", false);
+        StopOpenVPN(c);
+        return;
+    }
+    if (!parse_input_request(msg, param))
+        goto out;
+
+    /* allocate space for response : "needok param->id cancel/ok" */
+    resp = malloc (strlen(param->id) + strlen("needok \' \' cancel"));
+    wstr = Widen(param->str);
+
+    if (!wstr || !resp)
+    {
+        WriteStatusLog(c, L"GUI> ", L"Error: out of memory while processing NEED-OK. Sending stop signal", false);
+        StopOpenVPN(c);
+        goto out;
+    }
+
+    const char *fmt;
+    if (MessageBoxW (NULL, wstr, L""PACKAGE_NAME, MB_OKCANCEL) == IDOK)
+    {
+        fmt = "needok \'%s\' ok";
+    }
+    else
+    {
+        ManagementCommand (c, "auth-retry none", NULL, regular);
+        fmt = "needok \'%s\' cancel";
+    }
+
+    sprintf (resp, fmt, param->id);
+    ManagementCommand (c, resp, NULL, regular);
+
+out:
+    free_auth_param (param);
+    free(wstr);
+    free(resp);
+}
+
+/*
+ * Called when NEED-STR is received
+ */
+void
+OnNeedStr (connection_t *c, UNUSED char *msg)
+{
+    WriteStatusLog (c, L"GUI> ", L"Error: Received NEED-STR message -- not implemented", false);
+}
+
 /*
  * Close open handles
  */
@@ -810,6 +1214,8 @@ Cleanup (connection_t *c)
 {
     CloseManagement (c);
 
+    free_dynamic_cr (c);
+
     if (c->hProcess)
         CloseHandle (c->hProcess);
     c->hProcess = NULL;

openvpn.h

@@ -35,6 +35,8 @@ void OnLogLine(connection_t *, char *);
 void OnStateChange(connection_t *, char *);
 void OnPassword(connection_t *, char *);
 void OnStop(connection_t *, char *);
+void OnNeedOk(connection_t *, char *);
+void OnNeedStr(connection_t *, char *);
 
 void DisablePasswordSave(connection_t *);
 

openvpn_config.c

@@ -107,7 +107,7 @@ AddConfigFileToList(int config, const TCHAR *filename, const TCHAR *config_dir)
 
 #ifndef DISABLE_CHANGE_PASSWORD
     if (CheckKeyFileWriteAccess (c))
-        c->flags |= ALLOW_CHANGE_PASSPHRASE;
+        c->flags |= FLAG_ALLOW_CHANGE_PASSPHRASE;
 #endif
 
     /* Check if connection should be autostarted */

options.h

@@ -83,9 +83,9 @@ typedef struct {
     WCHAR readbuf[512];
 } service_io_t;
 
-#define FLAG_SAVE_KEY_PASS  1<<4
+#define FLAG_ALLOW_CHANGE_PASSPHRASE (1<<1)
-#define FLAG_SAVE_AUTH_PASS 1<<5
+#define FLAG_SAVE_KEY_PASS  (1<<4)
-#define ALLOW_CHANGE_PASSPHRASE (1<<1)
+#define FLAG_SAVE_AUTH_PASS (1<<5)
 
 typedef struct {
     unsigned short major, minor, build, revision;
@@ -122,6 +122,7 @@ struct connection {
     DWORD threadId;
     HWND hwndStatus;
     int flags;
+    char *dynamic_cr;              /* Pointer to buffer for dynamic challenge string received */
 };
 
 /* All options used within OpenVPN GUI */

res/openvpn-gui-res-de.rc

@@ -70,6 +70,20 @@ BEGIN
     PUSHBUTTON "Abbrechen", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_GERMAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "Ok", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Abbrechen", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-dk.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "Annuller", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_DANISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Annuller", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-en.rc

@@ -70,6 +70,20 @@ BEGIN
     PUSHBUTTON "Cancel", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_ENGLISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Cancel", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
@@ -434,4 +448,9 @@ BEGIN
 
     /* save/delete password */
     IDS_NFO_DELETE_PASS "Press OK to delete saved passwords for config ""%s"""
+
+    /* Token password related */
+    IDS_NFO_TOKEN_PASSWORD_CAPTION "OpenVPN - Token Password"
+    IDS_NFO_TOKEN_PASSWORD_REQUEST "Input Password/PIN for Token '%S'"
+
 END

res/openvpn-gui-res-es.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Cancelar", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_SPANISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Cancelar", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-fi.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "Peruuta", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_FINNISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Peruuta", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-fr.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Annuler", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_FRENCH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Annuler", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-it.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Annulla", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_ITALIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Annulla", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-jp.rc

@@ -71,6 +71,19 @@ BEGIN
     PUSHBUTTON "OK", IDOK, 20, 92, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
     PUSHBUTTON "キャンセル", IDCANCEL, 90, 92, 52, 14
 END
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_JAPANESE, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "キャンセル", IDCANCEL, 90, 51, 52, 14
+END
 
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210

res/openvpn-gui-res-nl.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Annuleren", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_DUTCH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Annuleren", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-no.rc

@@ -70,6 +70,20 @@ BEGIN
     PUSHBUTTON "Avbryt", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_NORWEGIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Avbryt", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-pl.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "Anuluj", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_POLISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Anuluj", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-pt.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Cancelar", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_PORTUGUESE, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Cancelar", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-ru.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "Отмена", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_RUSSIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Отмена", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-se.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Avbryt", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_SWEDISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Avbryt", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-tr.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "Çıkış", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_TURKISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "Tamam", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Çıkış", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-ua.rc

@@ -69,6 +69,20 @@ BEGIN
     PUSHBUTTON "Скасувати", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_UKRAINIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "Скасувати", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

res/openvpn-gui-res-zh-hant.rc

@@ -71,6 +71,20 @@ BEGIN
     PUSHBUTTON "取消", IDCANCEL, 90, 92, 52, 14
 END
 
+/* Challenge Response Dialog */
+ID_DLG_CHALLENGE_RESPONSE DIALOG 6, 18, 212, 72
+STYLE WS_SIZEBOX | WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - Challenge Response"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_TRADITIONAL
+BEGIN
+    LTEXT "", ID_TXT_DESCRIPTION, 6, 9, 208, 10
+    LTEXT "Response:", 0, 6, 30, 50, 10
+    EDITTEXT ID_EDT_RESPONSE, 60, 27, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "確認", IDOK, 20, 51, 50, 14, BS_PUSHBUTTON | WS_TABSTOP
+    PUSHBUTTON "取消", IDCANCEL, 90, 51, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

tray.c

@@ -79,7 +79,7 @@ CreatePopupMenus()
         AppendMenu(hMenu, MF_STRING, IDM_CLEARPASSMENU, LoadLocalizedString(IDS_MENU_CLEARPASS));
 
 #ifndef DISABLE_CHANGE_PASSWORD
-        if (o.conn[0].flags & ALLOW_CHANGE_PASSPHRASE)
+        if (o.conn[0].flags & FLAG_ALLOW_CHANGE_PASSPHRASE)
             AppendMenu(hMenu, MF_STRING, IDM_PASSPHRASEMENU, LoadLocalizedString(IDS_MENU_PASSPHRASE));
 #endif
 
@@ -127,7 +127,7 @@ CreatePopupMenus()
             AppendMenu(hMenuConn[i], MF_STRING, IDM_CLEARPASSMENU + i, LoadLocalizedString(IDS_MENU_CLEARPASS));
 
 #ifndef DISABLE_CHANGE_PASSWORD
-            if (o.conn[i].flags & ALLOW_CHANGE_PASSPHRASE)
+            if (o.conn[i].flags & FLAG_ALLOW_CHANGE_PASSPHRASE)
                 AppendMenu(hMenuConn[i], MF_STRING, IDM_PASSPHRASEMENU + i, LoadLocalizedString(IDS_MENU_PASSPHRASE));
 #endif