From 791aea49e6cdab83c5ac9ca203104859a57f4260 Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Thu, 4 Feb 2016 23:19:59 -0500
Subject: [PATCH 01/14] Do not use interactive service if running as admin

Connecting to a named pipe server while running with admin rights is not
secure in some windows versions. As the interactive service is not required
to set routes while running as admin, this looks like a safe compromise.

Fix based on feedback from Heiko Hund
- Move IsUserAdmin() check before opening the service pipe

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 misc.c    | 25 +++++++++++++++++++++++++
 misc.h    |  2 ++
 openvpn.c |  5 +++--
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/misc.c b/misc.c
index e21dd93..0326f97 100644
--- a/misc.c
+++ b/misc.c
@@ -190,3 +190,28 @@ ForceForegroundWindow(HWND hWnd)
 
     return ret;
 }
+
+/*
+ * Check user has admin rights
+ * Taken from https://msdn.microsoft.com/en-us/library/windows/desktop/aa376389(v=vs.85).aspx
+ * Returns true if the calling process token has the local Administrators group enabled
+ * in its SID.  Assumes the caller is not impersonating and has access to open its own 
+ * process token.
+ */
+BOOL IsUserAdmin(VOID)
+{
+    BOOL b;
+    SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
+    PSID AdministratorsGroup;
+
+    b = AllocateAndInitializeSid (&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID,
+                                  DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0,
+                                  &AdministratorsGroup);
+    if(b)
+    {
+        CheckTokenMembership(NULL, AdministratorsGroup, &b);
+        FreeSid(AdministratorsGroup);
+    }
+
+    return(b);
+}
diff --git a/misc.h b/misc.h
index 615ba73..8792755 100644
--- a/misc.h
+++ b/misc.h
@@ -30,4 +30,6 @@ BOOL streq(LPCSTR, LPCSTR);
 BOOL wcsbegins(LPCWSTR, LPCWSTR);
 
 BOOL ForceForegroundWindow(HWND);
+
+BOOL IsUserAdmin(VOID);
 #endif
diff --git a/openvpn.c b/openvpn.c
index 7ccf45f..213a189 100644
--- a/openvpn.c
+++ b/openvpn.c
@@ -692,10 +692,11 @@ StartOpenVPN(connection_t *c)
         (o.proxy_source != config ? _T("--management-query-proxy ") : _T("")));
 
     /* Try to open the service pipe */
-    service = CreateFile(_T("\\\\.\\pipe\\openvpn\\service"),
+    if (!IsUserAdmin())
+      service = CreateFile(_T("\\\\.\\pipe\\openvpn\\service"),
                 GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
 
-    if (service != INVALID_HANDLE_VALUE)
+    if (service && service != INVALID_HANDLE_VALUE)
     {
         DWORD size = _tcslen(c->config_dir) + _tcslen(options) + sizeof(c->manage.password) + 3;
         TCHAR startup_info[1024];

From 4437ce7a8cd7e0508d26fede84fcaf5d040a8c05 Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Thu, 4 Feb 2016 23:28:09 -0500
Subject: [PATCH 02/14] Change default log file location to a OpenVPN/log in
 user's profile directory

Change the default log file location to OpenVPN/log in user's profile directory
to support running without admin privileges using the interactive service.
The registry keys are moved to HKCU from HKLM to allow for user-specific
settings as well as to avoid the need for running the GUI as admin at the
first instance.

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 openvpn-gui-res.h         |  1 +
 registry.c                | 18 ++++++++++++------
 res/openvpn-gui-res-en.rc |  1 +
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index 86057bb..8377ce3 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -239,5 +239,6 @@
 #define IDS_ERR_OPEN_WRITE_REG          1810
 #define IDS_ERR_READ_SET_KEY            1811
 #define IDS_ERR_WRITE_REGVALUE          1812
+#define IDS_ERR_GET_PROFILE_DIR         1813
 
 #endif
diff --git a/registry.c b/registry.c
index 70d8149..923c7dd 100644
--- a/registry.c
+++ b/registry.c
@@ -42,6 +42,7 @@ GetRegistryKeys()
   TCHAR windows_dir[MAX_PATH];
   TCHAR temp_path[MAX_PATH];
   TCHAR openvpn_path[MAX_PATH];
+  TCHAR profile_dir[MAX_PATH];
   HKEY regkey;
 
   if (!GetWindowsDirectory(windows_dir, _countof(windows_dir))) {
@@ -50,6 +51,11 @@ GetRegistryKeys()
     return(false);
   }
 
+  if (SHGetFolderPath(NULL, CSIDL_PROFILE, NULL, SHGFP_TYPE_CURRENT, profile_dir) != S_OK) {
+    ShowLocalizedMsg(IDS_ERR_GET_PROFILE_DIR);
+    return(false);
+  }
+
   /* Get path to OpenVPN installation. */
   if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\OpenVPN"), 0, KEY_READ, &regkey)
       != ERROR_SUCCESS) 
@@ -78,7 +84,7 @@ GetRegistryKeys()
   if (!GetRegKey(_T("exe_path"), o.exe_path, 
       temp_path, _countof(o.exe_path))) return(false);
 
-  _sntprintf_0(temp_path, _T("%slog"), openvpn_path);
+  _sntprintf_0(temp_path, _T("%s\\OpenVPN\\log"), profile_dir);
   if (!GetRegKey(_T("log_dir"), o.log_dir, 
       temp_path, _countof(o.log_dir))) return(false);
 
@@ -178,7 +184,7 @@ int GetRegKey(const TCHAR name[], TCHAR *data, const TCHAR default_data[], DWORD
       return(true);
     }
 
-  status = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
+  status = RegOpenKeyEx(HKEY_CURRENT_USER,
                        _T("SOFTWARE\\OpenVPN-GUI"),
                        0,
                        KEY_READ,
@@ -186,7 +192,7 @@ int GetRegKey(const TCHAR name[], TCHAR *data, const TCHAR default_data[], DWORD
 
   if (status != ERROR_SUCCESS)
     {
-      if (RegCreateKeyEx(HKEY_LOCAL_MACHINE,
+      if (RegCreateKeyEx(HKEY_CURRENT_USER,
                         _T("Software\\OpenVPN-GUI"),
                         0,
                         _T(""),
@@ -197,7 +203,7 @@ int GetRegKey(const TCHAR name[], TCHAR *data, const TCHAR default_data[], DWORD
                         &dwDispos) != ERROR_SUCCESS)
         {
           /* error creating registry key */
-          ShowLocalizedMsg(IDS_ERR_CREATE_REG_KEY);
+          ShowLocalizedMsg(IDS_ERR_CREATE_REG_HKCU_KEY, _T("OpenVPN-GUI"));
           return(false);
         }  
     }
@@ -208,7 +214,7 @@ int GetRegKey(const TCHAR name[], TCHAR *data, const TCHAR default_data[], DWORD
   if (status != ERROR_SUCCESS || type != REG_SZ)
     {
       /* key did not exist - set default value */
-      status = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
+      status = RegOpenKeyEx(HKEY_CURRENT_USER,
 			  _T("SOFTWARE\\OpenVPN-GUI"),
 			  0,
 			  KEY_READ | KEY_WRITE,
@@ -216,7 +222,7 @@ int GetRegKey(const TCHAR name[], TCHAR *data, const TCHAR default_data[], DWORD
 
       if (status != ERROR_SUCCESS) {
          /* can't open registry for writing */
-         ShowLocalizedMsg(IDS_ERR_OPEN_WRITE_REG);
+         ShowLocalizedMsg(IDS_ERR_WRITE_REGVALUE, _T("OpenVPN-GUI"), name);
          return(false);
       }    
       if(!SetRegistryValue(openvpn_key_write, name, default_data))
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index 490efcb..431f4bd 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -325,6 +325,7 @@ BEGIN
 
     /* registry */
     IDS_ERR_GET_WINDOWS_DIR "Error getting Windows Directory."
+    IDS_ERR_GET_PROFILE_DIR "Error getting User Profile Directory."
     IDS_ERR_GET_PROGRAM_DIR "Error getting ""Program"" folder name."
     IDS_ERR_OPEN_REGISTRY "Error opening registry for reading (HKLM\\SOFTWARE\\OpenVPN).\n " \
                       "OpenVPN is probably not installed"

From 09334e71a0277ecf00e45b389c9238a150e13317 Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Thu, 4 Feb 2016 23:41:02 -0500
Subject: [PATCH 03/14] Fix the path of notepad.exe

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 registry.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/registry.c b/registry.c
index 923c7dd..f220566 100644
--- a/registry.c
+++ b/registry.c
@@ -93,11 +93,11 @@ GetRegistryKeys()
   if (!GetRegKey(_T("priority"), o.priority_string, 
       _T("NORMAL_PRIORITY_CLASS"), _countof(o.priority_string))) return(false);
 
-  _sntprintf_0(temp_path, _T("%s\\notepad.exe"), windows_dir);
+  _sntprintf_0(temp_path, _T("%s\\system32\\notepad.exe"), windows_dir);
   if (!GetRegKey(_T("log_viewer"), o.log_viewer, 
       temp_path, _countof(o.log_viewer))) return(false);
 
-  _sntprintf_0(temp_path, _T("%s\\notepad.exe"), windows_dir);
+  _sntprintf_0(temp_path, _T("%s\\system32\\notepad.exe"), windows_dir);
   if (!GetRegKey(_T("editor"), o.editor, 
       temp_path, _countof(o.editor))) return(false);
 

From cdec68ef917c9c55e37f27680c23db1e8a993e3d Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Sat, 13 Feb 2016 22:34:25 -0500
Subject: [PATCH 04/14] Put --log first in the command line

This is needed to avoid early messages going to stdout leaving no
trace of errors when openvpn exits before management interface is up.
It also ensures that any --log directives in the config do not override
the log file location.

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 openvpn.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/openvpn.c b/openvpn.c
index 7ccf45f..e8cc180 100644
--- a/openvpn.c
+++ b/openvpn.c
@@ -682,12 +682,13 @@ StartOpenVPN(connection_t *c)
     /* Create a management interface password */
     GetRandomPassword(c->manage.password, sizeof(c->manage.password) - 1);
 
-    /* Construct command line */
-    _sntprintf_0(cmdline, _T("openvpn --config \"%s\" "
-        "--setenv IV_GUI_VER \"%S\" --service %s 0 --log%s \"%s\" --auth-retry interact "
+    /* Construct command line -- put log first */
+    _sntprintf_0(cmdline, _T("openvpn --log%s \"%s\" --config \"%s\" "
+        "--setenv IV_GUI_VER \"%S\" --service %s 0 --auth-retry interact "
         "--management %S %hd stdin --management-query-passwords %s"
-        "--management-hold"), c->config_file, PACKAGE_STRING, exit_event_name,
+        "--management-hold"),
         (o.append_string[0] == '1' ? _T("-append") : _T("")), c->log_path,
+        c->config_file, PACKAGE_STRING, exit_event_name,
         inet_ntoa(c->manage.skaddr.sin_addr), ntohs(c->manage.skaddr.sin_port),
         (o.proxy_source != config ? _T("--management-query-proxy ") : _T("")));
 

From 352e44f03d28eaf99359710f4f213bb1ef8a1299 Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Sat, 13 Feb 2016 22:44:52 -0500
Subject: [PATCH 05/14] Better error reporting when connection fails to come up

- Handle early errors (openvpn exits before management connection is up)
    with a helpful error message that points the user to view log.
- Include only readable config files in the connection list
- Warn if no connection profiles found

TODO: handle startup errors from interactive service
---
 manage.c                  |  5 ++++-
 openvpn-gui-res.h         |  4 ++++
 openvpn.c                 | 11 ++++++++---
 openvpn_config.c          | 27 ++++++++++++++++++++++++++-
 options.h                 |  3 ++-
 res/openvpn-gui-res-en.rc |  5 +++++
 6 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/manage.c b/manage.c
index 4ec6891..d6c3c18 100644
--- a/manage.c
+++ b/manage.c
@@ -54,7 +54,6 @@ InitManagement(const mgmt_rtmsg_handler *handler)
     }
 }
 
-
 /*
  * Connect to the OpenVPN management interface and register
  * asynchronous socket event notification for it
@@ -205,7 +204,11 @@ OnManagement(SOCKET sk, LPARAM lParam)
             if (time(NULL) < c->manage.timeout)
                 connect(c->manage.sk, (SOCKADDR *)&c->manage.skaddr, sizeof(c->manage.skaddr));
             else
+            {
+                /* Connection to MI timed out. */
+                c->state = timedout;
                 rtmsg_handler[stop](c, "");
+            }
         }
         break;
 
diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index 8377ce3..2bf9d23 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -156,6 +156,8 @@
 #define IDS_ERR_CONN_SCRIPT_FAILED      1248
 #define IDS_ERR_RUN_CONN_SCRIPT_TIMEOUT 1249
 #define IDS_ERR_CONFIG_EXIST            1251
+#define IDS_NFO_CONN_TIMEOUT            1252
+#define IDS_NFO_NO_CONFIGS              1253
 
 /* Program Startup Related */
 #define IDS_ERR_OPEN_DEBUG_FILE         1301
@@ -225,6 +227,8 @@
 #define IDS_ERR_OPEN_SCMGR              1706
 #define IDS_ERR_STOP_SERVICE            1707
 #define IDS_NFO_RESTARTED               1708
+#define IDS_ERR_ACCESS_SERVICE_PIPE     1709
+#define IDS_ERR_WRITE_SERVICE_PIPE      1710
 
 /* Registry Related */
 #define IDS_ERR_GET_WINDOWS_DIR         1801
diff --git a/openvpn.c b/openvpn.c
index 213a189..c30f589 100644
--- a/openvpn.c
+++ b/openvpn.c
@@ -341,6 +341,7 @@ void
 OnStop(connection_t *c, UNUSED char *msg)
 {
     UINT txt_id, msg_id;
+    TCHAR *msg_xtra;
     SetMenuStatus(c, disconnected);
 
     switch (c->state)
@@ -366,9 +367,13 @@ OnStop(connection_t *c, UNUSED char *msg)
     case resuming:
     case connecting:
     case reconnecting:
+    case timedout:
         /* We have failed to (re)connect */
         txt_id = c->state == reconnecting ? IDS_NFO_STATE_FAILED_RECONN : IDS_NFO_STATE_FAILED;
         msg_id = c->state == reconnecting ? IDS_NFO_RECONN_FAILED : IDS_NFO_CONN_FAILED;
+        msg_xtra = c->state == timedout ? c->log_path : c->config_name;
+        if (c->state == timedout)
+            msg_id = IDS_NFO_CONN_TIMEOUT;
 
         c->state = disconnecting;
         CheckAndSetTrayIcon();
@@ -382,7 +387,7 @@ OnStop(connection_t *c, UNUSED char *msg)
             SetForegroundWindow(c->hwndStatus);
             ShowWindow(c->hwndStatus, SW_SHOW);
         }
-        ShowLocalizedMsg(msg_id, c->config_name);
+        ShowLocalizedMsg(msg_id, msg_xtra);
         SendMessage(c->hwndStatus, WM_CLOSE, 0, 0);
         break;
 
@@ -703,7 +708,7 @@ StartOpenVPN(connection_t *c)
         DWORD dwMode = PIPE_READMODE_MESSAGE;
         if (!SetNamedPipeHandleState(service, &dwMode, NULL, NULL))
         {
-            // TODO: add error message
+            ShowLocalizedMsg (IDS_ERR_ACCESS_SERVICE_PIPE);
             CloseHandle(c->exit_event);
             goto out;
         }
@@ -715,7 +720,7 @@ StartOpenVPN(connection_t *c)
 
         if (!WriteFile(service, startup_info, size * sizeof (TCHAR), &written, NULL))
         {
-            // TODO: add error message
+            ShowLocalizedMsg (IDS_ERR_WRITE_SERVICE_PIPE);
             CloseHandle(c->exit_event);
             goto out;
         }
diff --git a/openvpn_config.c b/openvpn_config.c
index f40a110..1adb579 100644
--- a/openvpn_config.c
+++ b/openvpn_config.c
@@ -61,6 +61,22 @@ match(const WIN32_FIND_DATA *find, const TCHAR *ext)
     return match_false;
 }
 
+static bool
+CheckReadAccess (const TCHAR *path)
+{
+    HANDLE h;
+    bool ret = FALSE;
+
+    h = CreateFile (path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
+                   FILE_ATTRIBUTE_NORMAL, NULL);
+    if ( h != INVALID_HANDLE_VALUE )
+    {
+        ret = TRUE;
+        CloseHandle (h);
+    }
+
+    return ret;
+}
 
 static int
 ConfigAlreadyExists(TCHAR *newconfig)
@@ -111,6 +127,8 @@ BuildFileList()
     HANDLE find_handle;
     TCHAR find_string[MAX_PATH];
     TCHAR subdir_table[MAX_CONFIG_SUBDIRS][MAX_PATH];
+    TCHAR fullpath[MAX_PATH];
+    static int warn_no_configs = 1;
     int subdirs = 0;
     int i;
 
@@ -134,7 +152,9 @@ BuildFileList()
         match_t match_type = match(&find_obj, o.ext_string);
         if (match_type == match_file)
         {
-            AddConfigFileToList(o.num_configs++, find_obj.cFileName, o.config_dir);
+            _sntprintf_0(fullpath, _T("%s\\%s"), o.config_dir, find_obj.cFileName);
+            if (CheckReadAccess (fullpath))
+                AddConfigFileToList(o.num_configs++, find_obj.cFileName, o.config_dir);
         }
         else if (match_type == match_dir)
         {
@@ -184,4 +204,9 @@ BuildFileList()
 
         FindClose(find_handle);
     }
+    if (o.num_configs == 0 && warn_no_configs)
+    {
+        ShowLocalizedMsg(IDS_NFO_NO_CONFIGS, o.config_dir);
+        warn_no_configs = 0;
+    }
 }
diff --git a/options.h b/options.h
index 6165d67..d581c49 100644
--- a/options.h
+++ b/options.h
@@ -67,7 +67,8 @@ typedef enum {
     disconnecting,
     suspending,
     suspended,
-    resuming
+    resuming,
+    timedout
 } conn_state_t;
 
 /* Connections parameters */
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index 431f4bd..1b6ebb0 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -182,6 +182,7 @@ BEGIN
 
     /* OpenVPN */
     IDS_ERR_MANY_CONFIGS "OpenVPN GUI does not support more than %d configs. Please contact the author if you have the need for more."
+    IDS_NFO_NO_CONFIGS "No readable connection profiles (config files) found at %s"
     IDS_ERR_ONE_CONN_OLD_VER "You can only have one connection running at the same time when using an older version on OpenVPN than 2.0-beta6."
     IDS_ERR_STOP_SERV_OLD_VER "You cannot use OpenVPN GUI to start a connection while the OpenVPN Service is running (with OpenVPN 1.5/1.6). Stop OpenVPN Service first if you want to use OpenVPN GUI."
     IDS_ERR_CREATE_EVENT "CreateEvent failed on exit event: %s"
@@ -226,6 +227,8 @@ BEGIN
     IDS_ERR_CONFIG_EXIST "There already exist a config file named '%s'. You cannot " \
                          "have multiple config files with the same name, even if " \
                          "they reside in diffrent folders."
+    IDS_NFO_CONN_TIMEOUT "Connecting to management interface failed.\n" \
+                         "View log file (%s) for more details."
     /* main - Resources */
     IDS_ERR_OPEN_DEBUG_FILE "Error opening debug file (%s) for output."
     IDS_ERR_CREATE_PATH "Could not create %s path:\n%s"
@@ -322,6 +325,8 @@ BEGIN
     IDS_ERR_OPEN_SCMGR "OpenSCManager failed (%d)"
     IDS_ERR_STOP_SERVICE "Failed to stop OpenVPN Service"
     IDS_NFO_RESTARTED "OpenVPN Service Restarted."
+    IDS_ERR_ACCESS_SERVICE_PIPE "Access to service pipe failed."
+    IDS_ERR_WRITE_SERVICE_PIPE "Writing to service pipe failed."
 
     /* registry */
     IDS_ERR_GET_WINDOWS_DIR "Error getting Windows Directory."

From d0c37ecbccdadd52452dc6f2a5b5091892c90cdd Mon Sep 17 00:00:00 2001
From: Leonardo Basilio <leobasilio@gmail.com>
Date: Tue, 16 Feb 2016 22:19:52 -0200
Subject: [PATCH 06/14] Updating README build instructions

---
 README | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 323361b..22c27c4 100644
--- a/README
+++ b/README
@@ -228,4 +228,8 @@ Building OpenVPN GUI from source
 
 * Start a bash shell by running msys.bat.
 
-* Run "make" from the OpenVPN GUI source directory. 
+* Run at the OpenVPN GUI source directory:
+
+$ autoreconf -i
+$ ./configure
+$ make

From 46a1bc715cc18e9d782e503cdcba5dfddde780e8 Mon Sep 17 00:00:00 2001
From: Leonardo Basilio <leobasilio@gmail.com>
Date: Tue, 16 Feb 2016 22:20:53 -0200
Subject: [PATCH 07/14] Adding "Import file" feature

---
 main.c                    | 54 +++++++++++++++++++++++++++++++++++++++
 openvpn-gui-res.h         |  6 +++++
 res/openvpn-gui-res-en.rc |  5 ++++
 res/openvpn-gui-res-pt.rc |  5 ++++
 tray.c                    |  2 ++
 tray.h                    |  1 +
 6 files changed, 73 insertions(+)

diff --git a/main.c b/main.c
index 20e81ab..5f3644d 100644
--- a/main.c
+++ b/main.c
@@ -28,6 +28,7 @@
 #include <wtsapi32.h>
 #include <prsht.h>
 #include <pbt.h>
+#include <commdlg.h>
 
 #include "tray.h"
 #include "openvpn.h"
@@ -53,6 +54,7 @@
 LRESULT CALLBACK WindowProcedure (HWND, UINT, WPARAM, LPARAM);
 static void ShowSettingsDialog();
 void CloseApplication(HWND hwnd);
+void ImportConfigFile();
 
 /*  Class name and window title  */
 TCHAR szClassName[ ] = _T("OpenVPN-GUI");
@@ -349,6 +351,9 @@ LRESULT CALLBACK WindowProcedure (HWND hwnd, UINT message, WPARAM wParam, LPARAM
         ShowChangePassphraseDialog(&o.conn[LOWORD(wParam) - IDM_PASSPHRASEMENU]);
       }
 #endif
+      if (LOWORD(wParam) == IDM_IMPORT) {
+        ImportConfigFile();
+      }
       if (LOWORD(wParam) == IDM_SETTINGS) {
         ShowSettingsDialog();
       }
@@ -525,6 +530,55 @@ CloseApplication(HWND hwnd)
     DestroyWindow(hwnd);
 }
 
+void
+ImportConfigFile()
+{
+    
+    TCHAR filter[32];
+
+    memset(filter, 0, sizeof(filter));
+    _sntprintf_0(filter, _T("*.%s *.%s"), o.ext_string, o.ext_string);
+    filter[2 + _tcslen(o.ext_string)] = _T('\0');
+    
+    OPENFILENAME fn;
+    TCHAR source[MAX_PATH] = _T("");
+
+    fn.lStructSize = sizeof(OPENFILENAME);
+    fn.hwndOwner = NULL;
+    fn.lpstrFilter = filter;
+    fn.lpstrCustomFilter = NULL;
+    fn.nFilterIndex = 1;
+    fn.lpstrFile = source;
+    fn.nMaxFile = MAX_PATH;
+    fn.lpstrFileTitle = NULL;
+    fn.lpstrInitialDir = NULL;
+    fn.lpstrTitle = NULL;
+    fn.Flags = OFN_DONTADDTORECENT | OFN_FILEMUSTEXIST;
+    fn.lpstrDefExt = NULL;
+
+    if (GetOpenFileName(&fn)) 
+    {
+        
+        TCHAR destination[MAX_PATH];
+        PTCHAR fileName = source + fn.nFileOffset;
+
+        _sntprintf_0(destination, _T("%s\\%s"), o.config_dir, fileName);
+        
+        if (!CopyFile(source, destination, TRUE)) 
+        {
+            if (GetLastError() == ERROR_FILE_EXISTS) 
+            {
+                fileName[_tcslen(fileName) - _tcslen(o.ext_string) - 1] = _T('\0');
+                ShowLocalizedMsg(IDS_ERR_IMPORT_EXISTS, fileName);
+            }
+            else
+                ShowLocalizedMsg(IDS_ERR_IMPORT_FAILED);
+        }
+
+    }
+    
+}
+
 #ifdef DEBUG
 void PrintDebugMsg(TCHAR *msg)
 {
diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index 8377ce3..aee142e 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -107,6 +107,7 @@
 #define IDS_MENU_SERVICEONLY_STOP       1020
 #define IDS_MENU_SERVICEONLY_RESTART    1021
 #define IDS_MENU_ASK_STOP_SERVICE       1022
+#define IDS_MENU_IMPORT                 1023
 
 /* LogViewer Dialog */
 #define IDS_ERR_START_LOG_VIEWER        1101
@@ -241,4 +242,9 @@
 #define IDS_ERR_WRITE_REGVALUE          1812
 #define IDS_ERR_GET_PROFILE_DIR         1813
 
+/* Importation Related */
+
+#define IDS_ERR_IMPORT_EXISTS           1901
+#define IDS_ERR_IMPORT_FAILED           1902
+
 #endif
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index 431f4bd..e6e4f7d 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -160,6 +160,7 @@ BEGIN
     IDS_TIP_CONNECTED_SINCE "\nConnected since: "
     IDS_TIP_ASSIGNED_IP "\nAssigned IP: %s"
     IDS_MENU_SERVICE "OpenVPN Service"
+    IDS_MENU_IMPORT "Import file…"
     IDS_MENU_SETTINGS "Settings…"
     IDS_MENU_CLOSE "Exit"
     IDS_MENU_CONNECT "Connect"
@@ -339,4 +340,8 @@ BEGIN
                        "once as Administrator to update the registry."
     IDS_ERR_READ_SET_KEY "Error reading and setting registry key ""%s""."
     IDS_ERR_WRITE_REGVALUE "Error writing registry value ""HKEY_CURRENT_USER\\%s\\%s""."
+
+    /* importation */
+    IDS_ERR_IMPORT_EXISTS "A config named ""%s"" already exists."
+    IDS_ERR_IMPORT_FAILED "Failed to import file."
 END
diff --git a/res/openvpn-gui-res-pt.rc b/res/openvpn-gui-res-pt.rc
index 5d1eb5d..6456346 100644
--- a/res/openvpn-gui-res-pt.rc
+++ b/res/openvpn-gui-res-pt.rc
@@ -147,6 +147,7 @@ BEGIN
     IDS_TIP_CONNECTED_SINCE "\nConectado desde: "
     IDS_TIP_ASSIGNED_IP "\nIP atribuído: %s"
     IDS_MENU_SERVICE "Serviço OpenVPN"
+    IDS_MENU_IMPORT "Importar arquivo…"
     IDS_MENU_SETTINGS "Configurações…"
     IDS_MENU_CLOSE "Sair"
     IDS_MENU_CONNECT "Conectar"
@@ -324,4 +325,8 @@ BEGIN
                            "uma vez como Administrador para alterar o registro."
     IDS_ERR_READ_SET_KEY "Erro ao ler e ajustar chave de registro ""%s""."
     IDS_ERR_WRITE_REGVALUE "Erro ao gravar valor da chave de registro ""HKEY_CURRENT_USER\\%s\\%s""."
+
+    /* importation */
+    IDS_ERR_IMPORT_EXISTS "Já existe uma configuração com o nome ""%s""."
+    IDS_ERR_IMPORT_FAILED "Falha ao importar o arquivo."
 END
diff --git a/tray.c b/tray.c
index 018b00e..150a106 100644
--- a/tray.c
+++ b/tray.c
@@ -91,6 +91,7 @@ CreatePopupMenus()
             AppendMenu(hMenu, MF_SEPARATOR, 0, 0);
         }
 
+        AppendMenu(hMenu, MF_STRING, IDM_IMPORT, LoadLocalizedString(IDS_MENU_IMPORT));
         AppendMenu(hMenu, MF_STRING ,IDM_SETTINGS, LoadLocalizedString(IDS_MENU_SETTINGS));
         AppendMenu(hMenu, MF_STRING ,IDM_CLOSE, LoadLocalizedString(IDS_MENU_CLOSE));
 
@@ -116,6 +117,7 @@ CreatePopupMenus()
             AppendMenu(hMenu, MF_SEPARATOR, 0, 0);
         }
 
+        AppendMenu(hMenu, MF_STRING, IDM_IMPORT, LoadLocalizedString(IDS_MENU_IMPORT));
         AppendMenu(hMenu, MF_STRING, IDM_SETTINGS, LoadLocalizedString(IDS_MENU_SETTINGS));
         AppendMenu(hMenu, MF_STRING, IDM_CLOSE, LoadLocalizedString(IDS_MENU_CLOSE));
 
diff --git a/tray.h b/tray.h
index 9225eff..f417698 100644
--- a/tray.h
+++ b/tray.h
@@ -33,6 +33,7 @@
 
 #define IDM_SETTINGS            221
 #define IDM_CLOSE               223
+#define IDM_IMPORT              224
 
 #define IDM_CONNECTMENU         300
 #define IDM_DISCONNECTMENU      (MAX_CONFIGS + IDM_CONNECTMENU)

From 01051c51be080be4830ee7ebb9c8f2887e153363 Mon Sep 17 00:00:00 2001
From: Leonardo Basilio <leobasilio@gmail.com>
Date: Tue, 16 Feb 2016 22:50:20 -0200
Subject: [PATCH 08/14] Make sure full config path exists before importing file

---
 main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/main.c b/main.c
index 5f3644d..361f0e5 100644
--- a/main.c
+++ b/main.c
@@ -29,6 +29,7 @@
 #include <prsht.h>
 #include <pbt.h>
 #include <commdlg.h>
+#include <shlobj.h>
 
 #include "tray.h"
 #include "openvpn.h"
@@ -562,6 +563,9 @@ ImportConfigFile()
         TCHAR destination[MAX_PATH];
         PTCHAR fileName = source + fn.nFileOffset;
 
+        /* make sure full config path exists */
+        SHCreateDirectoryEx(NULL, o.config_dir, NULL);
+
         _sntprintf_0(destination, _T("%s\\%s"), o.config_dir, fileName);
         
         if (!CopyFile(source, destination, TRUE)) 

From 5ce1298452181eb6b569766a91fba30f1aff89e8 Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Tue, 16 Feb 2016 15:49:13 -0500
Subject: [PATCH 09/14] Warn if interative service is not installed or not
 running

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 main.c                    |  3 +++
 openvpn-gui-res.h         |  2 ++
 res/openvpn-gui-res-en.rc |  4 ++++
 service.c                 | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 43 insertions(+)

diff --git a/main.c b/main.c
index 20e81ab..b6b97be 100644
--- a/main.c
+++ b/main.c
@@ -178,6 +178,9 @@ int WINAPI _tWinMain (HINSTANCE hThisInstance,
     exit(1);
   }
 
+  if (!IsUserAdmin())
+    CheckIServiceStatus();
+
   BuildFileList();
   if (!VerifyAutoConnections()) {
     exit(1);
diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index 2bf9d23..8a949ef 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -229,6 +229,8 @@
 #define IDS_NFO_RESTARTED               1708
 #define IDS_ERR_ACCESS_SERVICE_PIPE     1709
 #define IDS_ERR_WRITE_SERVICE_PIPE      1710
+#define IDS_ERR_NOTSTARTED_ISERVICE     1711
+#define IDS_ERR_INSTALL_ISERVICE        1712
 
 /* Registry Related */
 #define IDS_ERR_GET_WINDOWS_DIR         1801
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index 1b6ebb0..c994810 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -327,6 +327,10 @@ BEGIN
     IDS_NFO_RESTARTED "OpenVPN Service Restarted."
     IDS_ERR_ACCESS_SERVICE_PIPE "Access to service pipe failed."
     IDS_ERR_WRITE_SERVICE_PIPE "Writing to service pipe failed."
+    IDS_ERR_INSTALL_ISERVICE     """OpenVPNServiceInteractive"" is not installed.\n"
+                                 "Tasks requiring administrative access may not work."
+    IDS_ERR_NOTSTARTED_ISERVICE  """OpenVPNServiceInteractive"" is not started.\n"
+                                 "Tasks requiring administrative access may not work."
 
     /* registry */
     IDS_ERR_GET_WINDOWS_DIR "Error getting Windows Directory."
diff --git a/service.c b/service.c
index 21cab44..fc7367f 100644
--- a/service.c
+++ b/service.c
@@ -241,6 +241,40 @@ int MyReStartService()
     return(false);
 }
 
+bool
+CheckIServiceStatus()
+{
+    SC_HANDLE schSCManager;
+    SC_HANDLE schService;
+    SERVICE_STATUS ssStatus;
+
+    // Open a handle to the SC Manager database.
+    schSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);
+
+    if (NULL == schSCManager)
+        return(false);
+
+    schService = OpenService(schSCManager, _T("OpenVPNServiceInteractive"),
+                             SERVICE_QUERY_STATUS);
+    if (schService == NULL &&
+        GetLastError() == ERROR_SERVICE_DOES_NOT_EXIST)
+    {
+        /* warn that iservice is not installed */
+        ShowLocalizedMsg(IDS_ERR_INSTALL_ISERVICE);
+        return(false);
+    }
+
+    if (!QueryServiceStatus(schService, &ssStatus))
+        return(false);
+
+    if (ssStatus.dwCurrentState != SERVICE_RUNNING)
+    {
+        /* warn that iservice is not started */
+        ShowLocalizedMsg(IDS_ERR_NOTSTARTED_ISERVICE);
+        return(false);
+    }
+    return true;
+}
 
 int CheckServiceStatus()
 {

From 4c429d0b6b987d600176c8a0608d6dcf76108063 Mon Sep 17 00:00:00 2001
From: Leonardo Basilio <leobasilio@gmail.com>
Date: Thu, 18 Feb 2016 14:03:02 -0200
Subject: [PATCH 10/14] Fixes following pull request discussion

* Proper filter string size
* Copy config to subdirectory
---
 main.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/main.c b/main.c
index 361f0e5..0a04546 100644
--- a/main.c
+++ b/main.c
@@ -29,7 +29,6 @@
 #include <prsht.h>
 #include <pbt.h>
 #include <commdlg.h>
-#include <shlobj.h>
 
 #include "tray.h"
 #include "openvpn.h"
@@ -535,11 +534,9 @@ void
 ImportConfigFile()
 {
     
-    TCHAR filter[32];
+    TCHAR filter[37];
 
-    memset(filter, 0, sizeof(filter));
-    _sntprintf_0(filter, _T("*.%s *.%s"), o.ext_string, o.ext_string);
-    filter[2 + _tcslen(o.ext_string)] = _T('\0');
+    _sntprintf_0(filter, _T("*.%s%c*.%s%c"), o.ext_string, _T('\0'), o.ext_string, _T('\0'));
     
     OPENFILENAME fn;
     TCHAR source[MAX_PATH] = _T("");
@@ -559,26 +556,35 @@ ImportConfigFile()
 
     if (GetOpenFileName(&fn)) 
     {
-        
+
         TCHAR destination[MAX_PATH];
         PTCHAR fileName = source + fn.nFileOffset;
 
-        /* make sure full config path exists */
-        SHCreateDirectoryEx(NULL, o.config_dir, NULL);
-
         _sntprintf_0(destination, _T("%s\\%s"), o.config_dir, fileName);
+
+        destination[_tcslen(destination) - _tcslen(o.ext_string) - 1] = _T('\0');
         
-        if (!CopyFile(source, destination, TRUE)) 
+        if (EnsureDirExists(destination))
         {
-            if (GetLastError() == ERROR_FILE_EXISTS) 
+
+            _sntprintf_0(destination, _T("%s\\%s"), destination, fileName);
+            
+            if (!CopyFile(source, destination, TRUE))
             {
-                fileName[_tcslen(fileName) - _tcslen(o.ext_string) - 1] = _T('\0');
-                ShowLocalizedMsg(IDS_ERR_IMPORT_EXISTS, fileName);
+                if (GetLastError() == ERROR_FILE_EXISTS)
+                {
+                    fileName[_tcslen(fileName) - _tcslen(o.ext_string) - 1] = _T('\0');
+                    ShowLocalizedMsg(IDS_ERR_IMPORT_EXISTS, fileName);
+                    return;
+                }
             }
             else
-                ShowLocalizedMsg(IDS_ERR_IMPORT_FAILED);
+                return;
+
         }
 
+        ShowLocalizedMsg(IDS_ERR_IMPORT_FAILED);
+
     }
     
 }

From b47d3545e4b658fc14500432bbb2de71171f9f81 Mon Sep 17 00:00:00 2001
From: Leonardo Basilio <leobasilio@gmail.com>
Date: Sun, 21 Feb 2016 12:15:40 -0300
Subject: [PATCH 11/14] Improving feedback messages when importing

---
 main.c                    | 5 ++++-
 openvpn-gui-res.h         | 1 +
 res/openvpn-gui-res-en.rc | 4 +++-
 res/openvpn-gui-res-pt.rc | 4 +++-
 4 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/main.c b/main.c
index 0a04546..03c0fc2 100644
--- a/main.c
+++ b/main.c
@@ -579,11 +579,14 @@ ImportConfigFile()
                 }
             }
             else
+            {
+                ShowLocalizedMsg(IDS_NFO_IMPORT_SUCCESS);
                 return;
+            }
 
         }
 
-        ShowLocalizedMsg(IDS_ERR_IMPORT_FAILED);
+        ShowLocalizedMsg(IDS_ERR_IMPORT_FAILED, destination);
 
     }
     
diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index aee142e..4ff7c4e 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -246,5 +246,6 @@
 
 #define IDS_ERR_IMPORT_EXISTS           1901
 #define IDS_ERR_IMPORT_FAILED           1902
+#define IDS_NFO_IMPORT_SUCCESS          1903
 
 #endif
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index e6e4f7d..aa028bb 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -343,5 +343,7 @@ BEGIN
 
     /* importation */
     IDS_ERR_IMPORT_EXISTS "A config named ""%s"" already exists."
-    IDS_ERR_IMPORT_FAILED "Failed to import file."
+    IDS_ERR_IMPORT_FAILED "Failed to import file. The following path could not be created.\n\n" \
+                          "%s\n\nMake sure you have the right permissions."
+    IDS_NFO_IMPORT_SUCCESS "File imported successfully."
 END
diff --git a/res/openvpn-gui-res-pt.rc b/res/openvpn-gui-res-pt.rc
index 6456346..78ed4c2 100644
--- a/res/openvpn-gui-res-pt.rc
+++ b/res/openvpn-gui-res-pt.rc
@@ -328,5 +328,7 @@ BEGIN
 
     /* importation */
     IDS_ERR_IMPORT_EXISTS "Já existe uma configuração com o nome ""%s""."
-    IDS_ERR_IMPORT_FAILED "Falha ao importar o arquivo."
+    IDS_ERR_IMPORT_FAILED "Falha ao importar o arquivo. O seguinte caminho não pôde ser criado.\n\n" \
+                          "%s\n\nCertifique-se de que você possui as permissões necessárias."
+    IDS_NFO_IMPORT_SUCCESS "Arquivo importado com sucesso."
 END

From fbb5348540a755ee7468066c0ec7ab0120117de6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuli=20Sepp=C3=A4nen?= <samuli@openvpn.net>
Date: Mon, 22 Feb 2016 10:50:11 +0200
Subject: [PATCH 12/14] Bump version in "master" branch to 11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

URL: https://github.com/OpenVPN/openvpn-gui/pull/16

Signed-off-by: Samuli Seppänen <samuli@openvpn.net>
---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index 442af4a..5090ccf 100644
--- a/configure.ac
+++ b/configure.ac
@@ -19,7 +19,7 @@ dnl  distribution); if not, write to the Free Software Foundation, Inc.,
 dnl  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 AC_PREREQ(2.59)
-define([_GUI_VERSION], [10])
+define([_GUI_VERSION], [11])
 AC_INIT([OpenVPN GUI],[_GUI_VERSION],[openvpn-devel@lists.sourceforge.net],[openvpn-gui],[https://github.com/openvpn/openvpn-gui/])
 AC_DEFINE([PACKAGE_VERSION_RESOURCE], [_GUI_VERSION,0,0,0], [Version in windows resource format])
 AC_CONFIG_AUX_DIR([.])

From fe5a1c9b71bfd9d5a9f3c8f4009c3af8b0d1a1fd Mon Sep 17 00:00:00 2001
From: Soar Qin <soarchin@gmail.com>
Date: Sat, 27 Feb 2016 13:51:13 +0800
Subject: [PATCH 13/14] Adding static-challenge support

---
 Makefile.am                    |   3 +-
 misc.c                         | 107 +++++++++++++++++++++++++++++++++
 misc.h                         |   1 +
 openvpn-gui-res.h              |   5 ++
 openvpn.c                      |  60 +++++++++++++++---
 res/openvpn-gui-res-de.rc      |  18 ++++++
 res/openvpn-gui-res-dk.rc      |  18 ++++++
 res/openvpn-gui-res-en.rc      |  18 ++++++
 res/openvpn-gui-res-es.rc      |  18 ++++++
 res/openvpn-gui-res-fi.rc      |  18 ++++++
 res/openvpn-gui-res-fr.rc      |  18 ++++++
 res/openvpn-gui-res-it.rc      |  18 ++++++
 res/openvpn-gui-res-jp.rc      |  18 ++++++
 res/openvpn-gui-res-nl.rc      |  18 ++++++
 res/openvpn-gui-res-no.rc      |  18 ++++++
 res/openvpn-gui-res-pl.rc      |  18 ++++++
 res/openvpn-gui-res-pt.rc      |  18 ++++++
 res/openvpn-gui-res-ru.rc      |  18 ++++++
 res/openvpn-gui-res-se.rc      |  18 ++++++
 res/openvpn-gui-res-tr.rc      |  18 ++++++
 res/openvpn-gui-res-ua.rc      |  18 ++++++
 res/openvpn-gui-res-zh-hant.rc |  18 ++++++
 22 files changed, 471 insertions(+), 11 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index ed47121..8b78fc1 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -98,7 +98,8 @@ openvpn_gui_LDADD = \
 	-lws2_32 \
 	-lcomctl32 \
 	-lwinhttp \
-	-lwtsapi32
+	-lwtsapi32 \
+	-lcrypt32
 
 openvpn-gui-res.o: $(openvpn_gui_RESOURCES) $(srcdir)/openvpn-gui-res.h
 	$(RCCOMPILE) -i $< -o $@
diff --git a/misc.c b/misc.c
index 0326f97..0777d03 100644
--- a/misc.c
+++ b/misc.c
@@ -24,6 +24,7 @@
 #endif
 
 #include <windows.h>
+#include <wincrypt.h>
 #include <tchar.h>
 #include <string.h>
 #include <stdlib.h>
@@ -33,6 +34,35 @@
 #include "manage.h"
 #include "misc.h"
 
+/*
+ * Helper function to do base64 conversion through CryptoAPI
+ */
+static void
+Base64Encode(const char *input, int input_len, char **output)
+{
+    DWORD output_len;
+    if (!CryptBinaryToStringA((const BYTE *) input, (DWORD) input_len,
+        CRYPT_STRING_BASE64, NULL, &output_len) || output_len == 0)
+    {
+        *output = NULL;
+        return;
+    }
+    *output = (char *)malloc(output_len);
+    if (!CryptBinaryToStringA((const BYTE *) input, (DWORD) input_len,
+        CRYPT_STRING_BASE64, *output, &output_len))
+    {
+        free(*output);
+        *output = NULL;
+        return;
+    }
+    /* Trim trailing "\r\n" manually.
+       Actually they can be stripped by adding CRYPT_STRING_NOCRLF to dwFlags,
+       but Windows XP/2003 does not support this flag. */
+    if(output_len > 1 && (*output)[output_len - 1] == '\x0A'
+        && (*output)[output_len - 2] == '\x0D')
+        (*output)[output_len - 2] = 0;
+}
+
 /*
  * Helper function to convert UCS-2 text from a dialog item to UTF-8.
  * Caller must free *str if *len != 0.
@@ -125,6 +155,83 @@ out:
 }
 
 
+
+/*
+ * Generate a management command from double user inputs and send it
+ */
+BOOL
+ManagementCommandFromInputBase64(connection_t *c, LPCSTR fmt, HWND hDlg,int id, int id2)
+{
+    BOOL retval = FALSE;
+    LPSTR input, input2, input_b64, input2_b64, cmd;
+    int input_len, input2_len, cmd_len, pos;
+
+    GetDlgItemTextUtf8(hDlg, id, &input, &input_len);
+    GetDlgItemTextUtf8(hDlg, id2, &input2, &input2_len);
+
+    /* Escape input if needed */
+    for (pos = 0; pos < input_len; ++pos)
+    {
+        if (input[pos] == '\\' || input[pos] == '"')
+        {
+            LPSTR buf = realloc(input, ++input_len + 1);
+            if (buf == NULL)
+                goto out;
+
+            input = buf;
+            memmove(input + pos + 1, input + pos, input_len - pos + 1);
+            input[pos] = '\\';
+            pos += 1;
+        }
+    }
+    for (pos = 0; pos < input2_len; ++pos)
+    {
+        if (input2[pos] == '\\' || input2[pos] == '"')
+        {
+            LPSTR buf = realloc(input2, ++input2_len + 1);
+            if (buf == NULL)
+                goto out;
+
+            input2 = buf;
+            memmove(input2 + pos + 1, input2 + pos, input2_len - pos + 1);
+            input2[pos] = '\\';
+            pos += 1;
+        }
+    }
+
+    Base64Encode(input, input_len, &input_b64);
+    Base64Encode(input2, input2_len, &input2_b64);
+
+    cmd_len = input_len * 2 + input2_len * 2 + strlen(fmt);
+    cmd = malloc(cmd_len);
+    if (cmd)
+    {
+        snprintf(cmd, cmd_len, fmt, input_b64, input2_b64);
+        retval = ManagementCommand(c, cmd, NULL, regular);
+        free(cmd);
+    }
+    free(input_b64);
+    free(input2_b64);
+
+out:
+    /* Clear buffers with potentially secret content */
+    if (input_len)
+    {
+        memset(input, 'x', input_len);
+        SetDlgItemTextA(hDlg, id, input);
+        free(input);
+    }
+    if (input2_len)
+    {
+        memset(input2, 'x', input2_len);
+        SetDlgItemTextA(hDlg, id2, input2);
+        free(input2);
+    }
+
+    return retval;
+}
+
+
 /*
  * Ensures the given directory exists, by checking for and
  * creating missing parts of the path.
diff --git a/misc.h b/misc.h
index 8792755..f463a6a 100644
--- a/misc.h
+++ b/misc.h
@@ -23,6 +23,7 @@
 #define MISC_H
 
 BOOL ManagementCommandFromInput(connection_t *, LPCSTR, HWND, int);
+BOOL ManagementCommandFromInputBase64(connection_t *, LPCSTR, HWND, int, int);
 
 BOOL EnsureDirExists(LPTSTR);
 
diff --git a/openvpn-gui-res.h b/openvpn-gui-res.h
index 865d2ab..633d621 100644
--- a/openvpn-gui-res.h
+++ b/openvpn-gui-res.h
@@ -56,6 +56,11 @@
 #define ID_EDT_AUTH_USER                 181
 #define ID_EDT_AUTH_PASS                 182
 
+/* Auth Username/Password/Challenge Dialog */
+#define ID_DLG_AUTH_CHALLENGE            183
+#define ID_TXT_AUTH_CHALLENGE            184
+#define ID_EDT_AUTH_CHALLENGE            185
+
 /* Proxy Settings Dialog */
 #define ID_DLG_PROXY                     200
 #define ID_RB_PROXY_OPENVPN              210
diff --git a/openvpn.c b/openvpn.c
index e78e407..e7da90d 100644
--- a/openvpn.c
+++ b/openvpn.c
@@ -52,6 +52,12 @@ extern options_t o;
 
 const TCHAR *cfgProp = _T("conn");
 
+typedef struct {
+    connection_t *c;
+    int challenge_echo;
+    char *challenge_str;
+} auth_param_t;
+
 /*
  * Receive banner on connection to management interface
  * Format: <BANNER>
@@ -202,27 +208,41 @@ OnStateChange(connection_t *c, char *data)
 
 
 /*
- * DialogProc for OpenVPN username/password auth dialog windows
+ * DialogProc for OpenVPN username/password/challenge auth dialog windows
  */
 INT_PTR CALLBACK
 UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
 {
-    connection_t *c;
+    auth_param_t *param;
 
     switch (msg)
     {
     case WM_INITDIALOG:
         /* Set connection for this dialog and show it */
-        c = (connection_t *) lParam;
-        SetProp(hwndDlg, cfgProp, (HANDLE) c);
-        if (c->state == resuming)
+        param = (auth_param_t *) lParam;
+        SetProp(hwndDlg, cfgProp, (HANDLE) param);
+        if (param->challenge_str)
+        {
+            int wchars_num = MultiByteToWideChar(CP_UTF8, 0, param->challenge_str, -1, NULL, 0);
+            LPWSTR wstr = (LPWSTR)malloc(sizeof(WCHAR) * wchars_num);
+            HWND wnd_challenge = GetDlgItem(hwndDlg, ID_EDT_AUTH_CHALLENGE);
+
+            MultiByteToWideChar(CP_UTF8, 0, param->challenge_str, -1, wstr, wchars_num);
+            SetDlgItemTextW(hwndDlg, ID_TXT_AUTH_CHALLENGE, wstr);
+            free(wstr);
+            /* Set/Remove style ES_PASSWORD by SetWindowLong(GWL_STYLE) does nothing,
+               send EM_SETPASSWORDCHAR just works. */
+            if(param->challenge_echo)
+                SendMessage(wnd_challenge, EM_SETPASSWORDCHAR, 0, 0);
+        }
+        if (param->c->state == resuming)
             ForceForegroundWindow(hwndDlg);
         else
             SetForegroundWindow(hwndDlg);
         break;
 
     case WM_COMMAND:
-        c = (connection_t *) GetProp(hwndDlg, cfgProp);
+        param = (auth_param_t *) GetProp(hwndDlg, cfgProp);
         switch (LOWORD(wParam))
         {
         case ID_EDT_AUTH_USER:
@@ -234,14 +254,17 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
             break;
 
         case IDOK:
-            ManagementCommandFromInput(c, "username \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_USER);
-            ManagementCommandFromInput(c, "password \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_PASS);
+            ManagementCommandFromInput(param->c, "username \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_USER);
+            if (param->challenge_str)
+                ManagementCommandFromInputBase64(param->c, "password \"Auth\" \"SCRV1:%s:%s\"", hwndDlg, ID_EDT_AUTH_PASS, ID_EDT_AUTH_CHALLENGE);
+            else
+                ManagementCommandFromInput(param->c, "password \"Auth\" \"%s\"", hwndDlg, ID_EDT_AUTH_PASS);
             EndDialog(hwndDlg, LOWORD(wParam));
             return TRUE;
 
         case IDCANCEL:
             EndDialog(hwndDlg, LOWORD(wParam));
-            StopOpenVPN(c);
+            StopOpenVPN(param->c);
             return TRUE;
         }
         break;
@@ -251,6 +274,9 @@ UserAuthDialogFunc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
         return TRUE;
 
     case WM_NCDESTROY:
+        param = (auth_param_t *) GetProp(hwndDlg, cfgProp);
+        if (param->challenge_str) free(param->challenge_str);
+        free(param);
         RemoveProp(hwndDlg, cfgProp);
         break;
     }
@@ -317,7 +343,21 @@ OnPassword(connection_t *c, char *msg)
 
     if (strstr(msg, "'Auth'"))
     {
-        LocalizedDialogBoxParam(ID_DLG_AUTH, UserAuthDialogFunc, (LPARAM) c);
+        char* chstr = strstr(msg, "SC:");
+        auth_param_t *param = (auth_param_t *) malloc(sizeof(auth_param_t));
+        param->c = c;
+        if (chstr)
+        {
+            param->challenge_echo = *(chstr + 3) != '0';
+            param->challenge_str = strdup(chstr + 5);
+            LocalizedDialogBoxParam(ID_DLG_AUTH_CHALLENGE, UserAuthDialogFunc, (LPARAM) param);
+        }
+        else
+        {
+            param->challenge_echo = 0;
+            param->challenge_str = NULL;
+            LocalizedDialogBoxParam(ID_DLG_AUTH, UserAuthDialogFunc, (LPARAM) param);
+        }
     }
     else if (strstr(msg, "'Private Key'"))
     {
diff --git a/res/openvpn-gui-res-de.rc b/res/openvpn-gui-res-de.rc
index c744137..126bf63 100644
--- a/res/openvpn-gui-res-de.rc
+++ b/res/openvpn-gui-res-de.rc
@@ -49,6 +49,24 @@ BEGIN
     PUSHBUTTON "Abbrechen", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_GERMAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Benutzer:", 0, 6, 9, 50, 10
+    LTEXT "Passwort:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "Ok", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Abbrechen", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-dk.rc b/res/openvpn-gui-res-dk.rc
index 2feba1f..1c3c35a 100644
--- a/res/openvpn-gui-res-dk.rc
+++ b/res/openvpn-gui-res-dk.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "Annuller", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_DANISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Brugernavn:", 0, 6, 9, 50, 10
+    LTEXT "Password:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Annuller", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-en.rc b/res/openvpn-gui-res-en.rc
index 54bfc1f..999086c 100644
--- a/res/openvpn-gui-res-en.rc
+++ b/res/openvpn-gui-res-en.rc
@@ -49,6 +49,24 @@ BEGIN
     PUSHBUTTON "Cancel", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_ENGLISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Username:", 0, 6, 9, 50, 10
+    LTEXT "Password:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Cancel", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-es.rc b/res/openvpn-gui-res-es.rc
index 58f55ec..a1c37fa 100644
--- a/res/openvpn-gui-res-es.rc
+++ b/res/openvpn-gui-res-es.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Cancelar", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_SPANISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Usuario:", 0, 6, 9, 50, 10
+    LTEXT "Password:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Cancelar", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-fi.rc b/res/openvpn-gui-res-fi.rc
index 5d3d0a4..1d7a3bd 100644
--- a/res/openvpn-gui-res-fi.rc
+++ b/res/openvpn-gui-res-fi.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "Peruuta", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_FINNISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Käyttäjänimi:", 0, 6, 9, 50, 10
+    LTEXT "Salasana:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Peruuta", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-fr.rc b/res/openvpn-gui-res-fr.rc
index 1b08ef8..e92a78b 100644
--- a/res/openvpn-gui-res-fr.rc
+++ b/res/openvpn-gui-res-fr.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Annuler", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_FRENCH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Utilisateur:", 0, 6, 9, 50, 10
+    LTEXT "Mot de passe:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Annuler", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-it.rc b/res/openvpn-gui-res-it.rc
index 9765b26..f91c0d2 100644
--- a/res/openvpn-gui-res-it.rc
+++ b/res/openvpn-gui-res-it.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Annulla", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_ITALIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Nome utente:", 0, 6, 9, 50, 10
+    LTEXT "Password:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Annulla", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-jp.rc b/res/openvpn-gui-res-jp.rc
index 7fc85d8..41b570a 100644
--- a/res/openvpn-gui-res-jp.rc
+++ b/res/openvpn-gui-res-jp.rc
@@ -51,6 +51,24 @@ BEGIN
     PUSHBUTTON "キャンセル", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_JAPANESE, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "ユーザー名:", 0, 6, 9, 50, 10
+    LTEXT "パスワード:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "キャンセル", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-nl.rc b/res/openvpn-gui-res-nl.rc
index 74c3fd0..b7c6b93 100644
--- a/res/openvpn-gui-res-nl.rc
+++ b/res/openvpn-gui-res-nl.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Annuleren", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_DUTCH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Gebruikersnaam:", 0, 6, 9, 50, 10
+    LTEXT "Wachtwoord:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Annuleren", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-no.rc b/res/openvpn-gui-res-no.rc
index fd2c8d2..9ea2fd7 100644
--- a/res/openvpn-gui-res-no.rc
+++ b/res/openvpn-gui-res-no.rc
@@ -49,6 +49,24 @@ BEGIN
     PUSHBUTTON "Avbryt", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_NORWEGIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Brukernavn:", 0, 6, 9, 50, 10
+    LTEXT "Passord:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Avbryt", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-pl.rc b/res/openvpn-gui-res-pl.rc
index 943e967..6c3e0c8 100644
--- a/res/openvpn-gui-res-pl.rc
+++ b/res/openvpn-gui-res-pl.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "Anuluj", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_POLISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Użytkownik:", 0, 6, 9, 50, 10
+    LTEXT "Hasło:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Anuluj", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-pt.rc b/res/openvpn-gui-res-pt.rc
index 78ed4c2..36ff0da 100644
--- a/res/openvpn-gui-res-pt.rc
+++ b/res/openvpn-gui-res-pt.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Cancelar", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_PORTUGUESE, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Usuário:", 0, 6, 9, 50, 10
+    LTEXT "Senha:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Cancelar", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-ru.rc b/res/openvpn-gui-res-ru.rc
index b7c19df..d24341b 100644
--- a/res/openvpn-gui-res-ru.rc
+++ b/res/openvpn-gui-res-ru.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "Отмена", IDCANCEL, 100, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_RUSSIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Имя пользователя:", 0, 6, 9, 50, 10
+    LTEXT "Пароль:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Отмена", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-se.rc b/res/openvpn-gui-res-se.rc
index b679958..ddecb56 100644
--- a/res/openvpn-gui-res-se.rc
+++ b/res/openvpn-gui-res-se.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Avbryt", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_SWEDISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Användarnamn:", 0, 6, 9, 50, 10
+    LTEXT "Lösenord:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Avbryt", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-tr.rc b/res/openvpn-gui-res-tr.rc
index acc86a2..efd0672 100644
--- a/res/openvpn-gui-res-tr.rc
+++ b/res/openvpn-gui-res-tr.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "Çıkış", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_TURKISH, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Kullanıcı Adı:", 0, 6, 9, 50, 10
+    LTEXT "Şifre:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "Tamam", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Çıkış", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-ua.rc b/res/openvpn-gui-res-ua.rc
index ba476ea..ef97937 100644
--- a/res/openvpn-gui-res-ua.rc
+++ b/res/openvpn-gui-res-ua.rc
@@ -48,6 +48,24 @@ BEGIN
     PUSHBUTTON "Скасувати", IDCANCEL, 100, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_UKRAINIAN, SUBLANG_DEFAULT
+BEGIN
+    LTEXT "Ім'я користувача:", 0, 6, 9, 50, 10
+    LTEXT "Пароль:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "OK", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "Скасувати", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER
diff --git a/res/openvpn-gui-res-zh-hant.rc b/res/openvpn-gui-res-zh-hant.rc
index d12d018..be3325b 100644
--- a/res/openvpn-gui-res-zh-hant.rc
+++ b/res/openvpn-gui-res-zh-hant.rc
@@ -50,6 +50,24 @@ BEGIN
     PUSHBUTTON "取消", IDCANCEL, 90, 42, 52, 14
 END
 
+/* Auth Username/Password/Challenge Dialog */
+ID_DLG_AUTH_CHALLENGE DIALOG 6, 18, 160, 96
+STYLE WS_POPUP | WS_VISIBLE | WS_CAPTION | DS_CENTER | DS_SETFOREGROUND
+CAPTION "OpenVPN - User Authentication"
+FONT 8, "Microsoft Sans Serif"
+LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_TRADITIONAL
+BEGIN
+    LTEXT "使用者名稱:", 0, 6, 9, 50, 10
+    LTEXT "密碼:", 0, 6, 26, 50, 10
+    LTEXT "Response:", 0, 6, 60, 50, 10
+    EDITTEXT ID_EDT_AUTH_USER, 60, 6, 94, 12, ES_AUTOHSCROLL
+    EDITTEXT ID_EDT_AUTH_PASS, 60, 23, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    LTEXT "", ID_TXT_AUTH_CHALLENGE, 6, 43, 148, 10
+    EDITTEXT ID_EDT_AUTH_CHALLENGE, 60, 57, 94, 12, ES_PASSWORD | ES_AUTOHSCROLL
+    PUSHBUTTON "確認", IDOK, 20, 76, 50, 14, BS_PUSHBUTTON | WS_TABSTOP | WS_DISABLED
+    PUSHBUTTON "取消", IDCANCEL, 90, 76, 52, 14
+END
+
 /* Status Dialog */
 ID_DLG_STATUS DIALOG 6, 18, 380, 210
 STYLE WS_SIZEBOX | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | DS_CENTER

From 686a4d5d8ce6108387b013f6a637f673f639902e Mon Sep 17 00:00:00 2001
From: Selva Nair <selva.nair@gmail.com>
Date: Mon, 29 Feb 2016 10:37:07 -0500
Subject: [PATCH 14/14] Revert "Run with highest privilege available"

This reverts commit 2af86368964a55c662a2f8548f363e2d65fcbb94.

Requiring "highestAvalable" privilege is no longer required,
nor advisable, as the same functionality is provided using
the interactive service with the GUI running with limited rights.

Signed-off-by: Selva Nair <selva.nair@gmail.com>
---
 res/openvpn-gui.manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/res/openvpn-gui.manifest b/res/openvpn-gui.manifest
index 45c34b5..9371d71 100644
--- a/res/openvpn-gui.manifest
+++ b/res/openvpn-gui.manifest
@@ -21,7 +21,7 @@
     <security>
         <requestedPrivileges>
             <requestedExecutionLevel
-                level="highestAvailable"
+                level="asInvoker"
                 uiAccess="false"/>
         </requestedPrivileges>
     </security>