<?xml version="1.0" encoding="utf-8"?>
<!--
    Copyright (C) 2012-2020 Tobias Brunner
    Copyright (C) 2012 Giuliano Grassi
    Copyright (C) 2012 Ralf Sager

    Copyright (C) secunet Security Networks AG

    This program is free software; you can redistribute it and/or modify it
    under the terms of the GNU General Public License as published by the
    Free Software Foundation; either version 2 of the License, or (at your
    option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.

    This program is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
    or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    for more details.
-->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <!-- SSID is redacted in the background on Android 10+ without this. -->
    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" />
    <uses-permission android:name="android.permission.NEARBY_WIFI_DEVICES" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
    <!-- Required to reliably schedule NAT keepalives/rekeyings via the AlarmManager.
         On Android 13+ this special permission is denied by default, but it can be
         granted by the user in system settings (Scheduler falls back to inexact
         alarms while it is not granted). -->
    <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" />
    <!-- necessary to allow users to select ex-/included apps and EAP-TNC -->
    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"
        tools:ignore="QueryAllPackagesPermission" />

    <application
        android:name=".logic.StrongSwanApplication"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/ApplicationTheme"
        android:windowSoftInputMode="adjustResize"
        android:networkSecurityConfig="@xml/network_security_config"
        android:enableOnBackInvokedCallback="true"
        android:allowBackup="false" >
        <activity
            android:name=".ui.MainActivity"
            android:label="@string/main_activity_name"
            android:launchMode="singleTop"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.service.quicksettings.action.QS_TILE_PREFERENCES" />
            </intent-filter>
        </activity>
        <activity
            android:name=".ui.VpnProfileControlActivity"
            android:theme="@style/TransparentActivity"
            android:taskAffinity=""
            android:excludeFromRecents="true"
            android:launchMode="singleTask"
            android:exported="true">
            <intent-filter>
                <action android:name="one.shx.strongswan.ext.action.START_PROFILE" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <intent-filter>
                <action android:name="one.shx.strongswan.ext.action.DISCONNECT" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
        </activity>
        <activity
            android:name=".ui.VpnProfileDetailActivity" >
        </activity>
        <activity
            android:name=".ui.TrustedCertificatesActivity"
            android:label="@string/trusted_certs_title" >
        </activity>
        <activity
            android:name=".ui.SelectedApplicationsActivity"
            android:label="@string/profile_select_apps" >
        </activity>
        <activity
            android:name=".ui.LogActivity"
            android:label="@string/log_title" >
        </activity>
		<activity
			android:name=".ui.SettingsActivity"
			android:label="@string/pref_title">
		</activity>
		<activity
			android:name=".ui.TrustedNetworksActivity"
			android:label="@string/auto_connect_title">
		</activity>
        <activity
            android:name=".ui.RemediationInstructionsActivity"
            android:label="@string/remediation_instructions_title"
            android:theme="@style/ApplicationTheme.ActionBar" >
        </activity>
        <activity
            android:name=".ui.VpnProfileSelectActivity"
            android:label="@string/strongswan_shortcut"
            android:icon="@mipmap/ic_shortcut"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.CREATE_SHORTCUT" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
        </activity>
        <activity
            android:name=".ui.VpnProfileImportActivity"
            android:label="@string/profile_import"
            android:theme="@style/ApplicationTheme.ActionBar"
            android:taskAffinity=""
            android:excludeFromRecents="true"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="http" />
                <data android:scheme="https" />
                <data android:scheme="file" />
                <data android:scheme="content" />
                <data android:mimeType="application/vnd.strongswan.profile" />
            </intent-filter>
            <!-- this matches by file extension if no MIME type is provided -->
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="http" />
                <data android:scheme="https" />
                <data android:scheme="file" />
                <data android:scheme="content" />
                <data android:host="*" />
                <data android:pathPattern=".*\\..*\\..*\\..*\\.sswan" />
                <data android:pathPattern=".*\\..*\\..*\\.sswan" />
                <data android:pathPattern=".*\\..*\\.sswan" />
                <data android:pathPattern=".*\\.sswan" />
            </intent-filter>
            <!-- this matches by file extension if any MIME type (but not ours) is provided -->
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="http" />
                <data android:scheme="https" />
                <data android:scheme="file" />
                <data android:scheme="content" />
                <data android:host="*" />
                <data android:mimeType="*/*" />
                <data android:pathPattern=".*\\..*\\..*\\..*\\.sswan" />
                <data android:pathPattern=".*\\..*\\..*\\.sswan" />
                <data android:pathPattern=".*\\..*\\.sswan" />
                <data android:pathPattern=".*\\.sswan" />
            </intent-filter>
        </activity>
        <activity
            android:name=".ui.TrustedCertificateImportActivity"
            android:label="@string/import_certificate"
            android:theme="@style/TransparentActivity"
            android:exported="true">
            <intent-filter tools:ignore="AppLinkUrlError">
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <data android:mimeType="application/x-x509-ca-cert" />
                <data android:mimeType="application/x-x509-server-cert" />
                <data android:mimeType="application/x-pem-file" />
                <data android:mimeType="application/pkix-cert" />
            </intent-filter>
        </activity>

        <!--
            Managed configuration, called app restrictions for historical reasons
            https://developer.android.com/work/managed-configurations
        -->
        <meta-data
            android:name="android.content.APP_RESTRICTIONS"
            android:resource="@xml/managed_configuration" />

        <service
            android:name=".logic.VpnStateService"
            android:exported="false">
        </service>
        <service
            android:name=".logic.CharonVpnService"
            android:exported="false"
            android:foregroundServiceType="specialUse"
            android:permission="android.permission.BIND_VPN_SERVICE">
            <intent-filter>
                <action android:name="android.net.VpnService" />
            </intent-filter>
            <property
                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
                android:value="VpnService instance"/>
        </service>
        <service
            android:name=".ui.VpnTileService"
            android:label="@string/tile_default"
            android:icon="@drawable/ic_notification"
            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
            android:exported="true">
            <intent-filter>
                <action android:name="android.service.quicksettings.action.QS_TILE" />
            </intent-filter>
        </service>

        <provider
            android:name=".data.LogContentProvider"
            android:authorities="one.shx.strongswan.ext.content.log"
            android:exported="true" >
            <!-- android:grantUriPermissions="true" combined with a custom permission does
                 not work (probably too many indirections with ACTION_SEND) so we secure
                 this provider with a custom ticketing system -->
        </provider>
    </application>

</manifest>
