Merge GH #2143 Add Roughtime

12 files changed, 1305 insertions, 11 deletions

diff --git a/src/lib/misc/roughtime/info.txt b/src/lib/misc/roughtime/info.txt
new file mode 100644
index 000000000..560f52666
--- /dev/null
+++ b/src/lib/misc/roughtime/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ROUGHTIME -> 20190220
+</defines>
+
+<requires>
+ed25519
+rng
+sha2_64
+socket
+</requires>
diff --git a/src/lib/misc/roughtime/roughtime.cpp b/src/lib/misc/roughtime/roughtime.cpp
new file mode 100644
index 000000000..94a9a6b82
--- /dev/null
+++ b/src/lib/misc/roughtime/roughtime.cpp
@@ -0,0 +1,457 @@
+/*
+* Roughtime
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/roughtime.h>
+
+#include <botan/base64.h>
+#include <botan/hash.h>
+#include <botan/internal/socket_udp.h>
+#include <botan/pubkey.h>
+#include <botan/rng.h>
+
+#include <cmath>
+#include <map>
+#include <sstream>
+
+namespace Botan {
+
+namespace {
+
+template< bool B, class T = void >
+using enable_if_t = typename std::enable_if<B,T>::type;
+
+template<class T>
+struct is_array : std::false_type {};
+
+template<class T, std::size_t N>
+struct is_array<std::array<T,N>>:std::true_type{};
+
+template<typename T>
+T from_little_endian(const uint8_t* t, size_t N = sizeof(T))
+   {
+   static_assert(sizeof(T)<=sizeof(int64_t),"");
+   return (N == 0) ? T(0) : (T(static_cast<int64_t>(t[N-1]) << ((N-1)*8)) + from_little_endian<T>(t,N-1));
+   }
+
+template<typename T, enable_if_t<is_array<T>::value>* = nullptr>
+T copy(const uint8_t* t)
+   {
+   return typecast_copy<T>(t); //arrays are endianess indepedent, so we do a memcpy
+   }
+
+template<typename T, enable_if_t<!is_array<T>::value>* = nullptr>
+T copy(const uint8_t* t)
+   {
+   return from_little_endian<T>(t); //other types are arithmetic, so we account that roughtime serializes as little endian
+   }
+
+template<typename T>
+std::map<std::string, std::vector<uint8_t>> unpack_roughtime_packet(T bytes)
+   {
+   if(bytes.size() < 8)
+      { throw Roughtime::Roughtime_Error("Map length is under minimum of 8 bytes"); }
+   const auto buf = bytes.data();
+   const uint32_t num_tags = buf[0];
+   const uint32_t start_content = num_tags * 8;
+   if(start_content > bytes.size())
+      { throw Roughtime::Roughtime_Error("Map length too small to contain all tags"); }
+   uint32_t start = start_content;
+   std::map<std::string, std::vector<uint8_t>> tags;
+   for(uint32_t i=0; i<num_tags; ++i)
+      {
+      const uint32_t end = ((i+1) == num_tags) ? bytes.size() : start_content + from_little_endian<uint32_t>(buf + 4 + i*4);
+      if(end > bytes.size())
+         { throw Roughtime::Roughtime_Error("Tag end index out of bounds"); }
+      if(end < start)
+         { throw Roughtime::Roughtime_Error("Tag offset must be more than previous tag offset"); }
+      const char* label_ptr = cast_uint8_ptr_to_char(buf) + (num_tags+i)*4;
+      const char label[] = {label_ptr[0], label_ptr[1], label_ptr[2], label_ptr[3], 0};
+      auto ret = tags.emplace(label, std::vector<uint8_t>(buf+start, buf+end));
+      if(!ret.second)
+         { throw Roughtime::Roughtime_Error(std::string("Map has duplicated tag: ") + label); }
+      start = end;
+      }
+   return tags;
+   }
+
+template<typename T>
+T get(const std::map<std::string, std::vector<uint8_t>>& map, const std::string& label)
+   {
+   const auto& tag = map.find(label);
+   if(tag == map.end())
+      { throw Roughtime::Roughtime_Error("Tag " + label + " not found"); }
+   if(tag->second.size() != sizeof(T))
+      { throw Roughtime::Roughtime_Error("Tag " + label + " has unexpected size"); }
+   return copy<T>(tag->second.data());
+   }
+
+const std::vector<uint8_t>& get_v(const std::map<std::string, std::vector<uint8_t>>& map, const std::string& label)
+   {
+   const auto& tag = map.find(label);
+   if(tag == map.end())
+      { throw Roughtime::Roughtime_Error("Tag " + label + " not found"); }
+   return tag->second;
+   }
+
+bool verify_signature(const std::array<uint8_t, 32>& pk, const std::vector<uint8_t>& payload,
+                      const std::array<uint8_t, 64>& signature)
+   {
+   const char context[] = "RoughTime v1 response signature";
+   Ed25519_PublicKey key(std::vector<uint8_t>(pk.data(), pk.data()+pk.size()));
+   PK_Verifier verifier(key, "Pure");
+   verifier.update(cast_char_ptr_to_uint8(context), sizeof(context)); //add context including \0
+   verifier.update(payload);
+   return verifier.check_signature(signature.data(), signature.size());
+   }
+
+std::array<uint8_t, 64> hashLeaf(const std::array<uint8_t, 64>& leaf)
+   {
+   std::array<uint8_t, 64> ret;
+   std::unique_ptr<HashFunction> hash(HashFunction::create_or_throw("SHA-512"));
+   hash->update(0);
+   hash->update(leaf.data(), leaf.size());
+   hash->final(ret.data());
+   return ret;
+   }
+
+void hashNode(std::array<uint8_t, 64>& hash, const std::array<uint8_t, 64>& node, bool reverse)
+   {
+   std::unique_ptr<HashFunction> h(HashFunction::create_or_throw("SHA-512"));
+   h->update(1);
+   if(reverse)
+      {
+      h->update(node.data(), node.size());
+      h->update(hash.data(), hash.size());
+      }
+   else
+      {
+      h->update(hash.data(), hash.size());
+      h->update(node.data(), node.size());
+      }
+   h->final(hash.data());
+   }
+
+template<size_t N, typename T>
+std::array<uint8_t, N> vector_to_array(std::vector<uint8_t,T> vec)
+   {
+   if(vec.size() != N)
+      { throw std::logic_error("Invalid vector size"); }
+   return typecast_copy<std::array<uint8_t, N>>(vec.data());
+   }
+}
+
+namespace Roughtime {
+
+Nonce::Nonce(const std::vector<uint8_t>& nonce)
+   {
+   if(nonce.size() != 64)
+      { throw Invalid_Argument("Nonce lenght must be 64"); }
+   m_nonce = typecast_copy<std::array<uint8_t, 64>>(nonce.data());
+   }
+Nonce::Nonce(RandomNumberGenerator& rng)
+   {
+   rng.randomize(m_nonce.data(), m_nonce.size());
+   }
+
+std::array<uint8_t, request_min_size> encode_request(const Nonce& nonce)
+   {
+   std::array<uint8_t, request_min_size> buf = {2, 0, 0, 0, 64, 0, 0, 0, 'N', 'O', 'N', 'C', 'P', 'A', 'D', 0xff};
+   std::memcpy(buf.data() + 16, nonce.get_nonce().data(), nonce.get_nonce().size());
+   std::memset(buf.data() + 16 + nonce.get_nonce().size(), 0, buf.size() - 16 - nonce.get_nonce().size());
+   return buf;
+   }
+
+Response Response::from_bits(const std::vector<uint8_t>& response,
+                             const Nonce& nonce)
+   {
+   const auto response_v = unpack_roughtime_packet(response);
+   const auto cert = unpack_roughtime_packet(get_v(response_v, "CERT"));
+   const auto cert_dele = get<std::array<uint8_t, 72>>(cert, "DELE");
+   const auto cert_sig =  get<std::array<uint8_t, 64>>(cert, "SIG");
+   const auto cert_dele_v = unpack_roughtime_packet(cert_dele);
+   const auto srep = get_v(response_v, "SREP");
+   const auto srep_v = unpack_roughtime_packet(srep);
+
+   const auto cert_dele_pubk = get<std::array<uint8_t, 32>>(cert_dele_v, "PUBK");
+   const auto sig  = get<std::array<uint8_t, 64>>(response_v, "SIG");
+   if(!verify_signature(cert_dele_pubk, srep, sig))
+      { throw Roughtime_Error("Response signature invalid"); }
+
+   const auto indx = get<uint32_t>(response_v, "INDX");
+   const auto path = get_v(response_v, "PATH");
+   const auto srep_root = get<std::array<uint8_t, 64>>(srep_v, "ROOT");
+   const auto size = path.size();
+   const auto levels = size/64;
+
+   if(size % 64)
+      { throw Roughtime_Error("Merkle tree path size must be multiple of 64 bytes"); }
+   if(indx >= (1u << levels))
+      { throw Roughtime_Error("Merkle tree path is too short"); }
+
+   auto hash = hashLeaf(nonce.get_nonce());
+   auto index = indx;
+   auto level = 0u;
+   while(level < levels)
+      {
+      hashNode(hash, typecast_copy<std::array<uint8_t, 64>>(path.data() + level*64), index&1);
+      ++level;
+      index>>=1;
+      }
+
+   if(srep_root != hash)
+      { throw Roughtime_Error("Nonce verification failed"); }
+
+   const auto cert_dele_maxt = sys_microseconds64(get<microseconds64>(cert_dele_v, "MAXT"));
+   const auto cert_dele_mint = sys_microseconds64(get<microseconds64>(cert_dele_v, "MINT"));
+   const auto srep_midp = sys_microseconds64(get<microseconds64>(srep_v, "MIDP"));
+   const auto srep_radi = get<microseconds32>(srep_v, "RADI");
+   if(srep_midp < cert_dele_mint)
+      { throw Roughtime_Error("Midpoint earlier than delegation start"); }
+   if(srep_midp > cert_dele_maxt)
+      { throw Roughtime_Error("Midpoint later than delegation end"); }
+   return {cert_dele, cert_sig, srep_midp, srep_radi};
+   }
+
+bool Response::validate(const Ed25519_PublicKey& pk) const
+   {
+   const char context[] = "RoughTime v1 delegation signature--";
+   PK_Verifier verifier(pk, "Pure");
+   verifier.update(cast_char_ptr_to_uint8(context), sizeof(context)); //add context including \0
+   verifier.update(m_cert_dele.data(), m_cert_dele.size());
+   return verifier.check_signature(m_cert_sig.data(), m_cert_sig.size());
+   }
+
+Nonce nonce_from_blind(const std::vector<uint8_t>& previous_response,
+                       const Nonce& blind)
+   {
+   std::array<uint8_t, 64> ret;
+   const auto blind_arr = blind.get_nonce();
+   std::unique_ptr<Botan::HashFunction> hash(Botan::HashFunction::create_or_throw("SHA-512"));
+   hash->update(previous_response);
+   hash->update(hash->final());
+   hash->update(blind_arr.data(), blind_arr.size());
+   hash->final(ret.data());
+
+   return ret;
+   }
+
+Chain::Chain(const std::string& str)
+   {
+   std::stringstream ss(str);
+   const std::string ERROR_MESSAGE = "Line does not have 4 space separated fields";
+   for(std::string s; std::getline(ss, s);)
+      {
+      size_t start = 0, end = 0;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto publicKeyType = s.substr(start, end-start);
+      if(publicKeyType != "ed25519")
+         { throw Not_Implemented("Only ed25519 publicKeyType is implemented"); }
+
+      start = end + 1;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto serverPublicKey = Botan::Ed25519_PublicKey(Botan::base64_decode(s.substr(start, end-start)));
+
+      start = end + 1;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      if((end - start) != 88)
+         {
+         throw Decoding_Error("Nonce has invalid length");
+         }
+      const auto vec = Botan::base64_decode(s.substr(start, end-start));
+      const auto nonceOrBlind = Nonce(vector_to_array<64>(Botan::base64_decode(s.substr(start, end-start))));
+
+      start = end + 1;
+      end = s.find(' ', start);
+      if(end != std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto response = Botan::unlock(Botan::base64_decode(s.substr(start)));
+
+      m_links.push_back({response, serverPublicKey, nonceOrBlind});
+      }
+   }
+std::vector<Response> Chain::responses() const
+   {
+   std::vector<Response> responses;
+   for(unsigned i = 0; i < m_links.size(); ++i)
+      {
+      const auto& l = m_links[i];
+      const auto nonce = i ? nonce_from_blind(m_links[i-1].response(), l.nonce_or_blind()) : l.nonce_or_blind();
+      const auto response = Response::from_bits(l.response(), nonce);
+      if(!response.validate(l.public_key()))
+         { throw Roughtime_Error("Invalid signature or public key"); }
+      responses.push_back(response);
+      }
+   return responses;
+   }
+Nonce Chain::next_nonce(const Nonce& blind) const
+   {
+   return m_links.empty()
+          ? blind
+          : nonce_from_blind(m_links.back().response(), blind);
+   }
+void Chain::append(const Link& new_link, size_t max_chain_size)
+   {
+   if(max_chain_size <= 0)
+      { throw Invalid_Argument("Max chain size must be positive"); }
+
+   while(m_links.size() >= max_chain_size)
+      {
+      if(m_links.size() == 1)
+         {
+         auto new_link_updated = new_link;
+         new_link_updated.nonce_or_blind() =
+            nonce_from_blind(m_links[0].response(), new_link.nonce_or_blind()); //we need to convert blind to nonce
+         m_links.clear();
+         m_links.push_back(new_link_updated);
+         return;
+         }
+      if(m_links.size() >= 2)
+         {
+         m_links[1].nonce_or_blind() =
+            nonce_from_blind(m_links[0].response(), m_links[1].nonce_or_blind()); //we need to convert blind to nonce
+         }
+      m_links.erase(m_links.begin());
+      }
+   m_links.push_back(new_link);
+   }
+
+std::string Chain::to_string() const
+   {
+   std::string s;
+   s.reserve((7+1 + 88+1 + 44+1 + 480)*m_links.size());
+   for(const auto& link : m_links)
+      {
+      s += "ed25519";
+      s += ' ';
+      s += Botan::base64_encode(link.public_key().get_public_key());
+      s += ' ';
+      s += Botan::base64_encode(link.nonce_or_blind().get_nonce().data(), link.nonce_or_blind().get_nonce().size());
+      s += ' ';
+      s += Botan::base64_encode(link.response());
+      s += '\n';
+      }
+   return s;
+   }
+
+std::vector<uint8_t> online_request(const std::string& uri,
+                                    const Nonce& nonce,
+                                    std::chrono::milliseconds timeout)
+   {
+   const std::chrono::system_clock::time_point start_time = std::chrono::system_clock::now();
+   auto socket = OS::open_socket_udp(uri, timeout);
+   if(!socket)
+      { throw Not_Implemented("No socket support enabled in build"); }
+
+   const auto encoded = encode_request(nonce);
+   socket->write(encoded.data(), encoded.size());
+
+   if(std::chrono::system_clock::now() - start_time > timeout)
+      { throw System_Error("Timeout during socket write"); }
+
+   std::vector<uint8_t> buffer;
+   buffer.resize(360+64*10+1); //response basic size is 360 bytes + 64 bytes for each level of merkle tree
+                               //add one additional byte to be able to differentiate if datagram got truncated
+   const auto n = socket->read(buffer.data(), buffer.size());
+
+   if(!n || std::chrono::system_clock::now() - start_time > timeout)
+      { throw System_Error("Timeout waiting for response"); }
+
+   if(n == buffer.size())
+      { throw System_Error("Buffer too small"); }
+
+   buffer.resize(n);
+   return buffer;
+   }
+
+std::vector<Server_Information> servers_from_str(const std::string& str)
+   {
+   std::vector<Server_Information> servers;
+   std::stringstream ss(str);
+   const std::string ERROR_MESSAGE = "Line does not have at least 5 space separated fields";
+   for(std::string s; std::getline(ss, s);)
+      {
+      size_t start = 0, end = 0;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto name = s.substr(start, end-start);
+
+      start = end + 1;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto publicKeyType = s.substr(start, end-start);
+      if(publicKeyType != "ed25519")
+         { throw Not_Implemented("Only ed25519 publicKeyType is implemented"); }
+
+      start = end + 1;
+      end = s.find(' ', start);
+
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto publicKeyBase64 = s.substr(start, end-start);
+      const auto publicKey = Botan::Ed25519_PublicKey(Botan::base64_decode(publicKeyBase64));
+
+      start = end + 1;
+      end = s.find(' ', start);
+      if(end == std::string::npos)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+      const auto protocol = s.substr(start, end-start);
+      if(protocol != "udp")
+         { throw Not_Implemented("Only UDP protocol is implemented"); }
+
+      const auto addresses = [&]()
+         {
+         std::vector<std::string> addresses;
+         for(;;)
+            {
+            start = end + 1;
+            end = s.find(' ', start);
+            const auto address = s.substr(start, (end == std::string::npos) ? std::string::npos : end-start);
+            if(address.empty())
+               { return addresses; }
+            addresses.push_back(address);
+            if(end == std::string::npos)
+               { return addresses; }
+            }
+         }
+      ();
+      if(addresses.size() == 0)
+         {
+         throw Decoding_Error(ERROR_MESSAGE);
+         }
+
+      servers.push_back({name, publicKey, std::move(addresses)});
+      }
+   return servers;
+   }
+
+}
+
+}
diff --git a/src/lib/misc/roughtime/roughtime.h b/src/lib/misc/roughtime/roughtime.h
new file mode 100644
index 000000000..595e693b9
--- /dev/null
+++ b/src/lib/misc/roughtime/roughtime.h
@@ -0,0 +1,164 @@
+/*
+* Roughtime
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_ROUGHTIME_H_
+#define BOTAN_ROUGHTIME_H_
+
+#include <array>
+#include <chrono>
+#include <vector>
+
+#include <botan/ed25519.h>
+
+namespace Botan {
+
+class RandomNumberGenerator;
+
+namespace Roughtime {
+
+constexpr unsigned request_min_size = 1024;
+
+class BOTAN_PUBLIC_API(2, 13) Roughtime_Error final : public Decoding_Error
+   {
+   public:
+      explicit Roughtime_Error(const std::string& s) : Decoding_Error("Roughtime " + s) {}
+      ErrorType error_type() const noexcept override { return ErrorType::RoughtimeError; }
+   };
+
+class BOTAN_PUBLIC_API(2, 13) Nonce final
+   {
+   public:
+      Nonce() = default;
+      Nonce(const std::vector<uint8_t>& nonce);
+      Nonce(RandomNumberGenerator& rng);
+      Nonce(const std::array<uint8_t, 64>& nonce)
+         {
+         m_nonce = nonce;
+         }
+      bool operator==(const Nonce& rhs) const { return m_nonce == rhs.m_nonce; }
+      const std::array<uint8_t, 64>& get_nonce() const { return m_nonce; }
+   private:
+      std::array<uint8_t, 64> m_nonce;
+   };
+
+
+/**
+* An Roughtime request.
+*/
+BOTAN_PUBLIC_API(2, 13)
+std::array<uint8_t, request_min_size> encode_request(const Nonce& nonce);
+
+/**
+* An Roughtime response.
+*/
+class BOTAN_PUBLIC_API(2, 13) Response final
+   {
+   public:
+      using microseconds32 = std::chrono::duration<uint32_t, std::micro>;
+      using microseconds64 = std::chrono::duration<uint64_t, std::micro>;
+      using sys_microseconds64 = std::chrono::time_point<std::chrono::system_clock, microseconds64>;
+
+      static Response from_bits(const std::vector<uint8_t>& response, const Nonce& nonce);
+
+      bool validate(const Ed25519_PublicKey& pk) const;
+
+      sys_microseconds64 utc_midpoint() const { return m_utc_midpoint; }
+
+      microseconds32 utc_radius() const { return m_utc_radius; }
+   private:
+      Response(std::array<uint8_t, 72> dele, std::array<uint8_t, 64> sig, sys_microseconds64 utc_midp,
+               microseconds32 utc_radius)
+         : m_cert_dele(dele)
+         , m_cert_sig(sig)
+         , m_utc_midpoint {utc_midp}
+         , m_utc_radius {utc_radius}
+         {}
+      const std::array<uint8_t, 72> m_cert_dele;
+      const std::array<uint8_t, 64> m_cert_sig;
+      const sys_microseconds64 m_utc_midpoint;
+      const microseconds32 m_utc_radius;
+   };
+
+class BOTAN_PUBLIC_API(2, 13) Link final
+   {
+   public:
+      Link(const std::vector<uint8_t>& response,
+           const Ed25519_PublicKey& public_key,
+           const Nonce& nonce_or_blind)
+         : m_response{response}
+         , m_public_key{public_key}
+         , m_nonce_or_blind{nonce_or_blind}
+         {}
+      const std::vector<uint8_t>& response() const { return m_response; }
+      const Ed25519_PublicKey& public_key() const { return m_public_key; }
+      const Nonce& nonce_or_blind() const { return m_nonce_or_blind; }
+      Nonce& nonce_or_blind() { return m_nonce_or_blind; }
+
+   private:
+      std::vector<uint8_t> m_response;
+      Ed25519_PublicKey m_public_key;
+      Nonce m_nonce_or_blind;
+   };
+
+class BOTAN_PUBLIC_API(2, 13) Chain final
+   {
+   public:
+      Chain() = default; //empty
+      Chain(const std::string& str);
+      const std::vector<Link>& links() const { return m_links; }
+      std::vector<Response> responses() const;
+      Nonce next_nonce(const Nonce& blind) const;
+      void append(const Link& new_link, size_t max_chain_size);
+      std::string to_string() const;
+   private:
+      std::vector<Link> m_links;
+   };
+
+/**
+*/
+BOTAN_PUBLIC_API(2, 13)
+Nonce nonce_from_blind(const std::vector<uint8_t>& previous_response,
+                       const Nonce& blind);
+
+/**
+* Makes an online Roughtime request via UDP and returns the Roughtime response.
+* @param url Roughtime server UDP endpoint (host:port)
+* @param timeout a timeout on the UDP request
+* @return Roughtime response
+*/
+BOTAN_PUBLIC_API(2, 13)
+std::vector<uint8_t> online_request(const std::string& uri,
+                                    const Nonce& nonce,
+                                    std::chrono::milliseconds timeout = std::chrono::seconds(3));
+
+struct BOTAN_PUBLIC_API(2, 13) Server_Information final
+   {
+public:
+   Server_Information(const std::string& name,
+                      const Botan::Ed25519_PublicKey& public_key,
+                      const std::vector<std::string>& addresses)
+      : m_name { name }
+      , m_public_key { public_key }
+      , m_addresses { addresses }
+      {}
+   const std::string& name() const {return m_name;}
+   const Botan::Ed25519_PublicKey& public_key() const {return m_public_key;}
+   const std::vector<std::string>& addresses() const {return m_addresses;}
+
+private:
+   std::string m_name;
+   Botan::Ed25519_PublicKey m_public_key;
+   std::vector<std::string> m_addresses;
+   };
+
+BOTAN_PUBLIC_API(2, 13)
+std::vector<Server_Information> servers_from_str(const std::string& str);
+
+}
+}
+
+#endif
diff --git a/src/lib/utils/exceptn.h b/src/lib/utils/exceptn.h
index 0259a225b..442ec91e6 100644
--- a/src/lib/utils/exceptn.h
+++ b/src/lib/utils/exceptn.h
@@ -53,6 +53,8 @@ enum class ErrorType {
    HttpError,
    /** A message with an invalid authentication tag was detected */
    InvalidTag,
+   /** An error during Roughtime validation */
+   RoughtimeError,
 
    /** An error when calling OpenSSL */
    OpenSSLError = 200,
diff --git a/src/lib/utils/mem_ops.h b/src/lib/utils/mem_ops.h
index 569cb409b..4206875b2 100644
--- a/src/lib/utils/mem_ops.h
+++ b/src/lib/utils/mem_ops.h
@@ -10,6 +10,7 @@
 
 #include <botan/types.h>
 #include <cstring>
+#include <type_traits>
 #include <vector>
 
 namespace Botan {
@@ -113,6 +114,15 @@ template<typename T> inline void clear_mem(T* ptr, size_t n)
    clear_bytes(ptr, sizeof(T)*n);
    }
 
+
+
+// is_trivially_copyable is missing in g++ < 5.0
+#if !__clang__ && __GNUG__ && __GNUC__ < 5
+#define IS_TRIVIALLY_COPYABLE(T) true
+#else
+#define IS_TRIVIALLY_COPYABLE(T) std::is_trivially_copyable<T>::value
+#endif
+
 /**
 * Copy memory
 * @param out the destination array
@@ -121,6 +131,7 @@ template<typename T> inline void clear_mem(T* ptr, size_t n)
 */
 template<typename T> inline void copy_mem(T* out, const T* in, size_t n)
    {
+   static_assert(std::is_trivial<typename std::decay<T>::type>::value, "");
    if(n > 0)
       {
       std::memmove(out, in, sizeof(T)*n);
@@ -129,11 +140,13 @@ template<typename T> inline void copy_mem(T* out, const T* in, size_t n)
 
 template<typename T> inline void typecast_copy(uint8_t out[], T in[], size_t N)
    {
+   static_assert(IS_TRIVIALLY_COPYABLE(T), "");
    std::memcpy(out, in, sizeof(T)*N);
    }
 
 template<typename T> inline void typecast_copy(T out[], const uint8_t in[], size_t N)
    {
+   static_assert(std::is_trivial<T>::value, "");
    std::memcpy(out, in, sizeof(T)*N);
    }
 
@@ -144,9 +157,18 @@ template<typename T> inline void typecast_copy(uint8_t out[], T in)
 
 template<typename T> inline void typecast_copy(T& out, const uint8_t in[])
    {
+   static_assert(std::is_trivial<typename std::decay<T>::type>::value, "");
    typecast_copy(&out, in, 1);
    }
 
+template <class To, class From> inline To typecast_copy(const From *src) noexcept
+   {
+   static_assert(IS_TRIVIALLY_COPYABLE(From) && std::is_trivial<To>::value, "");
+   To dst;
+   std::memcpy(&dst, src, sizeof(To));
+   return dst;
+   }
+
 /**
 * Set memory to a fixed value
 * @param ptr a pointer to an array of bytes
diff --git a/src/lib/utils/os_utils.cpp b/src/lib/utils/os_utils.cpp
index a27e9117f..84a2d0ebe 100644
--- a/src/lib/utils/os_utils.cpp
+++ b/src/lib/utils/os_utils.cpp
@@ -47,6 +47,7 @@
 
 #if defined(BOTAN_TARGET_OS_HAS_WIN32)
   #define NOMINMAX 1
+  #define _WINSOCKAPI_ // stop windows.h including winsock.h
   #include <windows.h>
 #endif
 
diff --git a/src/lib/utils/socket/info.txt b/src/lib/utils/socket/info.txt
index 330e784c5..ceeaa18ee 100644
--- a/src/lib/utils/socket/info.txt
+++ b/src/lib/utils/socket/info.txt
@@ -3,7 +3,9 @@ SOCKETS -> 20171216
 </defines>
 
 <header:internal>
+uri.h
 socket.h
+socket_udp.h
 </header:internal>
 
 <libs>
diff --git a/src/lib/utils/socket/socket.cpp b/src/lib/utils/socket/socket.cpp
index 41177809e..54033bc55 100644
--- a/src/lib/utils/socket/socket.cpp
+++ b/src/lib/utils/socket/socket.cpp
@@ -31,10 +31,7 @@
   #include <fcntl.h>
 
 #elif defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
-  #define NOMINMAX 1
-  #include <winsock2.h>
   #include <ws2tcpip.h>
-  #include <windows.h>
 #endif
 
 namespace Botan {
@@ -72,7 +69,7 @@ class Asio_Socket final : public OS::Socket
 
          if(ec)
             throw boost::system::system_error(ec);
-         if(ec || m_tcp.is_open() == false)
+         if(m_tcp.is_open() == false)
             throw System_Error("Connection to host " + hostname + " failed");
          }
 
@@ -82,8 +79,8 @@ class Asio_Socket final : public OS::Socket
 
          boost::system::error_code ec = boost::asio::error::would_block;
 
-         boost::asio::async_write(m_tcp, boost::asio::buffer(buf, len),
-                                  [&ec](boost::system::error_code e, size_t) { ec = e; });
+         m_tcp.async_send(boost::asio::buffer(buf, len),
+                           [&ec](boost::system::error_code e, size_t) { ec = e; });
 
          while(ec == boost::asio::error::would_block) { m_io.run_one(); }
 
@@ -100,11 +97,8 @@ class Asio_Socket final : public OS::Socket
          boost::system::error_code ec = boost::asio::error::would_block;
          size_t got = 0;
 
-         auto read_cb = [&](const boost::system::error_code cb_ec, size_t cb_got) {
-            ec = cb_ec; got = cb_got;
-         };
-
-         m_tcp.async_read_some(boost::asio::buffer(buf, len), read_cb);
+         m_tcp.async_read_some(boost::asio::buffer(buf, len),
+                               [&](boost::system::error_code cb_ec, size_t cb_got) { ec = cb_ec; got = cb_got; });
 
          while(ec == boost::asio::error::would_block) { m_io.run_one(); }
 
diff --git a/src/lib/utils/socket/socket_udp.cpp b/src/lib/utils/socket/socket_udp.cpp
new file mode 100644
index 000000000..651fe1b0c
--- /dev/null
+++ b/src/lib/utils/socket/socket_udp.cpp
@@ -0,0 +1,337 @@
+/*
+* (C) 2015,2016,2017 Jack Lloyd
+* (C) 2016 Daniel Neus
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/internal/socket_udp.h>
+#include <botan/internal/uri.h>
+#include <botan/exceptn.h>
+#include <botan/mem_ops.h>
+#include <chrono>
+
+#if defined(BOTAN_HAS_BOOST_ASIO)
+   /*
+   * We don't need serial port support anyway, and asking for it
+   * causes macro conflicts with Darwin's termios.h when this
+   * file is included in the amalgamation. GH #350
+   */
+   #define BOOST_ASIO_DISABLE_SERIAL_PORT
+   #include <boost/asio.hpp>
+   #include <boost/asio/system_timer.hpp>
+#elif defined(BOTAN_TARGET_OS_HAS_SOCKETS)
+   #include <sys/socket.h>
+   #include <sys/time.h>
+   #include <netinet/in.h>
+   #include <netdb.h>
+   #include <string.h>
+   #include <unistd.h>
+   #include <errno.h>
+   #include <fcntl.h>
+
+#elif defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+   #include <ws2tcpip.h>
+#endif
+
+namespace Botan {
+
+namespace {
+
+#if defined(BOTAN_HAS_BOOST_ASIO)
+class Asio_SocketUDP final : public OS::SocketUDP
+   {
+   public:
+      Asio_SocketUDP(const std::string& hostname,
+                     const std::string& service,
+                     std::chrono::microseconds timeout) :
+         m_timeout(timeout), m_timer(m_io), m_udp(m_io)
+         {
+         m_timer.expires_from_now(m_timeout);
+         check_timeout();
+
+         boost::asio::ip::udp::resolver resolver(m_io);
+         boost::asio::ip::udp::resolver::query query(hostname, service);
+         boost::asio::ip::udp::resolver::iterator dns_iter = resolver.resolve(query);
+
+         boost::system::error_code ec = boost::asio::error::would_block;
+
+         auto connect_cb = [&ec](const boost::system::error_code& e,
+         boost::asio::ip::udp::resolver::iterator) { ec = e; };
+
+         boost::asio::async_connect(m_udp, dns_iter, connect_cb);
+
+         while(ec == boost::asio::error::would_block)
+            {
+            m_io.run_one();
+            }
+
+         if(ec)
+            { throw boost::system::system_error(ec); }
+         if(m_udp.is_open() == false)
+            { throw System_Error("Connection to host " + hostname + " failed"); }
+         }
+
+      void write(const uint8_t buf[], size_t len) override
+         {
+         m_timer.expires_from_now(m_timeout);
+
+         boost::system::error_code ec = boost::asio::error::would_block;
+
+         m_udp.async_send(boost::asio::buffer(buf, len),
+         [&ec](boost::system::error_code e, size_t) { ec = e; });
+
+         while(ec == boost::asio::error::would_block)
+            {
+            m_io.run_one();
+            }
+
+         if(ec)
+            {
+            throw boost::system::system_error(ec);
+            }
+         }
+
+      size_t read(uint8_t buf[], size_t len) override
+         {
+         m_timer.expires_from_now(m_timeout);
+
+         boost::system::error_code ec = boost::asio::error::would_block;
+         size_t got = 0;
+
+         m_udp.async_receive(boost::asio::buffer(buf, len),
+         [&](boost::system::error_code cb_ec, size_t cb_got) { ec = cb_ec; got = cb_got; });
+
+         while(ec == boost::asio::error::would_block)
+            {
+            m_io.run_one();
+            }
+
+         if(ec)
+            {
+            if(ec == boost::asio::error::eof)
+               { return 0; }
+            throw boost::system::system_error(ec); // Some other error.
+            }
+
+         return got;
+         }
+
+   private:
+      void check_timeout()
+         {
+         if(m_udp.is_open() && m_timer.expires_at() < std::chrono::system_clock::now())
+            {
+            boost::system::error_code err;
+            m_udp.close(err);
+            }
+
+         m_timer.async_wait(std::bind(&Asio_SocketUDP::check_timeout, this));
+         }
+
+      const std::chrono::microseconds m_timeout;
+      boost::asio::io_service m_io;
+      boost::asio::system_timer m_timer;
+      boost::asio::ip::udp::socket m_udp;
+   };
+#elif defined(BOTAN_TARGET_OS_HAS_SOCKETS) || defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+class BSD_SocketUDP final : public OS::SocketUDP
+   {
+   public:
+      BSD_SocketUDP(const std::string& hostname,
+                    const std::string& service,
+                    std::chrono::microseconds timeout) : m_timeout(timeout)
+         {
+         socket_init();
+
+         m_socket = invalid_socket();
+
+         addrinfo* res;
+         addrinfo hints;
+         clear_mem(&hints, 1);
+         hints.ai_family = AF_UNSPEC;
+         hints.ai_socktype = SOCK_DGRAM;
+
+         int rc = ::getaddrinfo(hostname.c_str(), service.c_str(), &hints, &res);
+
+         if(rc != 0)
+            {
+            throw System_Error("Name resolution failed for " + hostname, rc);
+            }
+
+         for(addrinfo* rp = res; (m_socket == invalid_socket()) && (rp != nullptr); rp = rp->ai_next)
+            {
+            if(rp->ai_family != AF_INET && rp->ai_family != AF_INET6)
+               { continue; }
+
+            m_socket = ::socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
+
+            if(m_socket == invalid_socket())
+               {
+               // unsupported socket type?
+               continue;
+               }
+
+            set_nonblocking(m_socket);
+            memcpy(&sa, res->ai_addr, res->ai_addrlen);
+            salen=res->ai_addrlen;
+            }
+
+         ::freeaddrinfo(res);
+
+         if(m_socket == invalid_socket())
+            {
+            throw System_Error("Connecting to " + hostname +
+                               " for service " + service + " failed", errno);
+            }
+         }
+
+      ~BSD_SocketUDP()
+         {
+         close_socket(m_socket);
+         m_socket = invalid_socket();
+         socket_fini();
+         }
+
+      void write(const uint8_t buf[], size_t len) override
+         {
+         fd_set write_set;
+         FD_ZERO(&write_set);
+         FD_SET(m_socket, &write_set);
+
+         size_t sent_so_far = 0;
+         while(sent_so_far != len)
+            {
+            struct timeval timeout = make_timeout_tv();
+            int active = ::select(m_socket + 1, nullptr, &write_set, nullptr, &timeout);
+
+            if(active == 0)
+               { throw System_Error("Timeout during socket write"); }
+
+            const size_t left = len - sent_so_far;
+            socket_op_ret_type sent = ::sendto(m_socket, cast_uint8_ptr_to_char(buf + sent_so_far), left, 0, (sockaddr*)&sa, salen);
+            if(sent < 0)
+               { throw System_Error("Socket write failed", errno); }
+            else
+               { sent_so_far += static_cast<size_t>(sent); }
+            }
+         }
+
+      size_t read(uint8_t buf[], size_t len) override
+         {
+         fd_set read_set;
+         FD_ZERO(&read_set);
+         FD_SET(m_socket, &read_set);
+
+         struct timeval timeout = make_timeout_tv();
+         int active = ::select(m_socket + 1, &read_set, nullptr, nullptr, &timeout);
+
+         if(active == 0)
+            { throw System_Error("Timeout during socket read"); }
+
+         socket_op_ret_type got = ::recvfrom(m_socket, cast_uint8_ptr_to_char(buf), len, 0, nullptr, nullptr);
+
+         if(got < 0)
+            { throw System_Error("Socket read failed", errno); }
+
+         return static_cast<size_t>(got);
+         }
+
+   private:
+#if defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+      typedef SOCKET socket_type;
+      typedef int socket_op_ret_type;
+      static socket_type invalid_socket() { return INVALID_SOCKET; }
+      static void close_socket(socket_type s) { ::closesocket(s); }
+      static std::string get_last_socket_error() { return std::to_string(::WSAGetLastError()); }
+
+      static bool nonblocking_connect_in_progress()
+         {
+         return (::WSAGetLastError() == WSAEWOULDBLOCK);
+         }
+
+      static void set_nonblocking(socket_type s)
+         {
+         u_long nonblocking = 1;
+         ::ioctlsocket(s, FIONBIO, &nonblocking);
+         }
+
+      static void socket_init()
+         {
+         WSAData wsa_data;
+         WORD wsa_version = MAKEWORD(2, 2);
+
+         if(::WSAStartup(wsa_version, &wsa_data) != 0)
+            {
+            throw System_Error("WSAStartup() failed", WSAGetLastError());
+            }
+
+         if(LOBYTE(wsa_data.wVersion) != 2 || HIBYTE(wsa_data.wVersion) != 2)
+            {
+            ::WSACleanup();
+            throw System_Error("Could not find a usable version of Winsock.dll");
+            }
+         }
+
+      static void socket_fini()
+         {
+         ::WSACleanup();
+         }
+#else
+      typedef int socket_type;
+      typedef ssize_t socket_op_ret_type;
+      static socket_type invalid_socket() { return -1; }
+      static void close_socket(socket_type s) { ::close(s); }
+      static std::string get_last_socket_error() { return ::strerror(errno); }
+      static bool nonblocking_connect_in_progress() { return (errno == EINPROGRESS); }
+      static void set_nonblocking(socket_type s)
+         {
+         if(::fcntl(s, F_SETFL, O_NONBLOCK) < 0)
+            { throw System_Error("Setting socket to non-blocking state failed", errno); }
+         }
+
+      static void socket_init() {}
+      static void socket_fini() {}
+#endif
+      sockaddr_storage sa;
+      socklen_t salen;
+      struct timeval make_timeout_tv() const
+         {
+         struct timeval tv;
+         tv.tv_sec = m_timeout.count() / 1000000;
+         tv.tv_usec = m_timeout.count() % 1000000;
+         return tv;
+         }
+
+      const std::chrono::microseconds m_timeout;
+      socket_type m_socket;
+   };
+#endif
+}
+
+std::unique_ptr<OS::SocketUDP>
+OS::open_socket_udp(const std::string& hostname,
+                    const std::string& service,
+                    std::chrono::microseconds timeout)
+   {
+#if defined(BOTAN_HAS_BOOST_ASIO)
+   return std::unique_ptr<OS::SocketUDP>(new Asio_SocketUDP(hostname, service, timeout));
+#elif defined(BOTAN_TARGET_OS_HAS_SOCKETS) || defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+   return std::unique_ptr<OS::SocketUDP>(new BSD_SocketUDP(hostname, service, timeout));
+#else
+   return std::unique_ptr<OS::SocketUDP>();
+#endif
+   }
+
+std::unique_ptr<OS::SocketUDP>
+OS::open_socket_udp(const std::string& uri_string,
+                    std::chrono::microseconds timeout)
+   {
+   const auto uri = URI::fromAny(uri_string);
+   if(uri.port == 0)
+      { throw Invalid_Argument("UDP port not specified"); }
+   return open_socket_udp(uri.host, std::to_string(uri.port), timeout);
+   }
+
+}
diff --git a/src/lib/utils/socket/socket_udp.h b/src/lib/utils/socket/socket_udp.h
new file mode 100644
index 000000000..4a9346c2b
--- /dev/null
+++ b/src/lib/utils/socket/socket_udp.h
@@ -0,0 +1,73 @@
+/*
+* (C) 2015,2016,2017 Jack Lloyd
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_SOCKET_UDP_H_
+#define BOTAN_SOCKET_UDP_H_
+
+#include <botan/types.h>
+#include <string>
+#include <chrono>
+
+namespace Botan {
+
+namespace OS {
+
+/*
+* This header is internal (not installed) and these functions are not
+* intended to be called by applications. However they are given public
+* visibility (using BOTAN_TEST_API macro) for the tests. This also probably
+* allows them to be overridden by the application on ELF systems, but
+* this hasn't been tested.
+*/
+
+
+/**
+* A wrapper around a simple blocking UDP socket
+*/
+class BOTAN_TEST_API SocketUDP
+   {
+   public:
+      /**
+      * The socket will be closed upon destruction
+      */
+      virtual ~SocketUDP() = default;
+
+      /**
+      * Write to the socket. Returns immediately.
+      * Throws on error.
+      */
+      virtual void write(const uint8_t buf[], size_t len) = 0;
+
+      /**
+      * Reads up to len bytes, returns bytes written to buf.
+      * Returns 0 on EOF. Throws on error.
+      */
+      virtual size_t read(uint8_t buf[], size_t len) = 0;
+   };
+
+/**
+* Open up a socket. Will throw on error. Returns null if sockets are
+* not available on this platform.
+*/
+std::unique_ptr<SocketUDP>
+BOTAN_TEST_API open_socket_udp(const std::string& hostname,
+                               const std::string& service,
+                               std::chrono::microseconds timeout);
+
+/**
+* Open up a socket. Will throw on error. Returns null if sockets are
+* not available on this platform.
+*/
+std::unique_ptr<SocketUDP>
+BOTAN_TEST_API open_socket_udp(const std::string& uri,
+                               std::chrono::microseconds timeout);
+
+
+} // OS
+} // Botan
+
+#endif
diff --git a/src/lib/utils/socket/uri.cpp b/src/lib/utils/socket/uri.cpp
new file mode 100644
index 000000000..ea7188b31
--- /dev/null
+++ b/src/lib/utils/socket/uri.cpp
@@ -0,0 +1,183 @@
+/*
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/internal/uri.h>
+#include <botan/exceptn.h>
+
+#include <regex>
+
+#if defined(BOTAN_TARGET_OS_HAS_SOCKETS)
+   #include <arpa/inet.h>
+#elif defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+   #include <ws2tcpip.h>
+#endif
+
+#if defined(BOTAN_TARGET_OS_HAS_SOCKETS) || defined(BOTAN_TARGET_OS_HAS_WINSOCK2)
+
+namespace {
+
+constexpr bool isdigit(char ch)
+   {
+   return ch >= '0' && ch <= '9';
+   }
+
+bool isDomain(const std::string& domain)
+   {
+#if defined(__GLIBCXX__) && (__GLIBCXX__ < 20160726) //GCC 4.8 does not support regex
+   return true;
+#endif
+   std::regex re(
+      R"(^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$)");
+   std::cmatch m;
+   return std::regex_match(domain.c_str(), m, re);
+   }
+
+bool isIPv4(const std::string& ip)
+   {
+   sockaddr_storage inaddr;
+   return !!inet_pton(AF_INET, ip.c_str(), &inaddr);
+   }
+
+bool isIPv6(const std::string& ip)
+   {
+   sockaddr_storage in6addr;
+   return !!inet_pton(AF_INET6, ip.c_str(), &in6addr);
+   }
+}
+
+namespace Botan {
+
+URI URI::fromDomain(const std::string& uri)
+   {
+   unsigned port = 0;
+   const auto port_pos = uri.find(':');
+   if(port_pos != std::string::npos)
+      {
+      for(char c : uri.substr(port_pos+1))
+         {
+         if(!isdigit(c))
+            { throw Invalid_Argument("invalid"); }
+         port = port*10 + c - '0';
+         if(port > 65535)
+            { throw Invalid_Argument("invalid"); }
+         }
+      }
+   const auto domain = uri.substr(0, port_pos);
+   if(isIPv4(domain))
+      { throw Invalid_Argument("invalid"); }
+   if(!isDomain(domain))
+      { throw Invalid_Argument("invalid"); }
+   return {Type::Domain, domain, uint16_t(port)};
+   }
+
+URI URI::fromIPv4(const std::string& uri)
+   {
+   unsigned port = 0;
+   const auto port_pos = uri.find(':');
+   if(port_pos != std::string::npos)
+      {
+      for(char c : uri.substr(port_pos+1))
+         {
+         if(!isdigit(c))
+            { throw Invalid_Argument("invalid"); }
+         port = port*10 + c - '0';
+         if(port > 65535)
+            { throw Invalid_Argument("invalid"); }
+         }
+      }
+   const auto ip = uri.substr(0, port_pos);
+   if(!isIPv4(ip))
+      { throw Invalid_Argument("invalid"); }
+   return { Type::IPv4, ip, uint16_t(port) };
+   }
+
+URI URI::fromIPv6(const std::string& uri)
+   {
+   unsigned port = 0;
+   const auto port_pos = uri.find(']');
+   const bool with_braces = (port_pos != std::string::npos);
+   if((uri[0]=='[') != with_braces)
+      { throw Invalid_Argument("invalid"); }
+
+   if(with_braces && (uri.size() > port_pos + 1))
+      {
+      if(uri[port_pos+1]!=':')
+         { throw Invalid_Argument("invalid"); }
+      for(char c : uri.substr(port_pos+2))
+         {
+         if(!isdigit(c))
+            { throw Invalid_Argument("invalid"); }
+         port = port*10 + c - '0';
+         if(port > 65535)
+            { throw Invalid_Argument("invalid"); }
+         }
+      }
+   const auto ip = uri.substr((with_braces ? 1 : 0), port_pos - with_braces);
+   if(!isIPv6(ip))
+      { throw Invalid_Argument("invalid"); }
+   return { Type::IPv6, ip, uint16_t(port) };
+   }
+
+URI URI::fromAny(const std::string& uri)
+   {
+
+   bool colon_seen=false;
+   bool non_number=false;
+   if(uri[0]=='[')
+      { return fromIPv6(uri); }
+   for(auto c : uri)
+      {
+      if(c == ':')
+         {
+         if(colon_seen) //seen two ':'
+            { return fromIPv6(uri); }
+         colon_seen = true;
+         }
+      else if(!isdigit(c) && c !=  '.')
+         {
+         non_number=true;
+         }
+      }
+   if(!non_number)
+      {
+      if(isIPv4(uri.substr(0, uri.find(':'))))
+         {
+         return fromIPv4(uri);
+         }
+      }
+   return fromDomain(uri);
+   }
+
+std::string URI::to_string() const
+   {
+   if(type == Type::NotSet)
+      {
+      throw Invalid_Argument("not set");
+      }
+
+   if(port != 0)
+      {
+      if(type == Type::IPv6)
+         { return "[" + host + "]:" + std::to_string(port); }
+      return host + ":" + std::to_string(port);
+      }
+   return host;
+   }
+
+}
+
+#else
+
+namespace Botan {
+
+URI URI::fromDomain(const std::string&) {throw Not_Implemented("No socket support enabled in build");}
+URI URI::fromIPv4(const std::string&) {throw Not_Implemented("No socket support enabled in build");}
+URI URI::fromIPv6(const std::string&) {throw Not_Implemented("No socket support enabled in build");}
+URI URI::fromAny(const std::string&) {throw Not_Implemented("No socket support enabled in build");}
+
+}
+
+#endif
diff --git a/src/lib/utils/socket/uri.h b/src/lib/utils/socket/uri.h
new file mode 100644
index 000000000..a9f68ac41
--- /dev/null
+++ b/src/lib/utils/socket/uri.h
@@ -0,0 +1,49 @@
+/*
+* (C) 2019 Nuno Goncalves <[email protected]>
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_URI_H_
+#define BOTAN_URI_H_
+
+#include <cstdint>
+#include <string>
+
+#include <botan/build.h>
+
+namespace Botan {
+
+struct BOTAN_TEST_API URI
+   {
+   enum class Type : uint8_t
+      {
+      NotSet,
+      IPv4,
+      IPv6,
+      Domain,
+      };
+   static URI fromAny(const std::string& uri);
+   static URI fromIPv4(const std::string& uri);
+   static URI fromIPv6(const std::string& uri);
+   static URI fromDomain(const std::string& uri);
+   URI() = default;
+   URI(Type type, const std::string& host, unsigned short port)
+      : type { type }
+      , host { host }
+      , port { port }
+      {}
+   bool operator==(const URI& a) const
+      {
+      return type == a.type && host == a.host && port == a.port;
+      }
+   std::string to_string() const;
+
+   const Type type{Type::NotSet};
+   const std::string host{};
+   const uint16_t port{};
+   };
+
+}
+
+#endif