From 8b6c23342c6c4ebece42f4274113c932af025fa5 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Nov 2017 18:14:26 +0100 Subject: [PATCH 01/11] android: Free settings string passed via JNI --- .../android/app/src/main/jni/libandroidbridge/charonservice.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c index 62427338a..2891eabe0 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c @@ -712,5 +712,7 @@ JNI_METHOD(CharonVpnService, initiate, void, config = androidjni_convert_jstring(env, jconfig); settings = settings_create_string(config); + free(config); + initiate(settings); } From 24c22a3fa86af848ae5d46f769932fcfe0ab7aac Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Nov 2017 10:18:59 +0100 Subject: [PATCH 02/11] android: Add properties for IKE and ESP proposals --- .../strongswan/android/data/VpnProfile.java | 21 +++++++++++++++++++ .../android/data/VpnProfileDataSource.java | 17 ++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java index 82886843d..00cd393ca 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java @@ -34,6 +34,7 @@ public class VpnProfile implements Cloneable private String mName, mGateway, mUsername, mPassword, mCertificate, mUserCertificate; private String mRemoteId, mLocalId, mExcludedSubnets, mIncludedSubnets, mSelectedApps; + private String mIkeProposal, mEspProposal; private Integer mMTU, mPort, mSplitTunneling, mNATKeepAlive, mFlags; private SelectedAppsHandling mSelectedAppsHandling = SelectedAppsHandling.SELECTED_APPS_DISABLE; private VpnType mVpnType; @@ -114,6 +115,26 @@ public class VpnProfile implements Cloneable this.mVpnType = type; } + public String getIkeProposal() + { + return mIkeProposal; + } + + public void setIkeProposal(String proposal) + { + this.mIkeProposal = proposal; + } + + public String getEspProposal() + { + return mEspProposal; + } + + public void setEspProposal(String proposal) + { + this.mEspProposal = proposal; + } + public String getUsername() { return mUsername; diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java index d31ad3c64..2fef57770 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java @@ -53,6 +53,8 @@ public class VpnProfileDataSource public static final String KEY_SELECTED_APPS_LIST = "selected_apps_list"; public static final String KEY_NAT_KEEPALIVE = "nat_keepalive"; public static final String KEY_FLAGS = "flags"; + public static final String KEY_IKE_PROPOSAL = "ike_proposal"; + public static final String KEY_ESP_PROPOSAL = "esp_proposal"; private DatabaseHelper mDbHelper; private SQLiteDatabase mDatabase; @@ -61,7 +63,7 @@ public class VpnProfileDataSource private static final String DATABASE_NAME = "strongswan.db"; private static final String TABLE_VPNPROFILE = "vpnprofile"; - private static final int DATABASE_VERSION = 14; + private static final int DATABASE_VERSION = 15; public static final DbColumn[] COLUMNS = new DbColumn[] { new DbColumn(KEY_ID, "INTEGER PRIMARY KEY AUTOINCREMENT", 1), @@ -84,6 +86,8 @@ public class VpnProfileDataSource new DbColumn(KEY_SELECTED_APPS_LIST, "TEXT", 12), new DbColumn(KEY_NAT_KEEPALIVE, "INTEGER", 13), new DbColumn(KEY_FLAGS, "INTEGER", 14), + new DbColumn(KEY_IKE_PROPOSAL, "TEXT", 15), + new DbColumn(KEY_ESP_PROPOSAL, "TEXT", 15), }; private static final String[] ALL_COLUMNS = getColumns(DATABASE_VERSION); @@ -212,6 +216,13 @@ public class VpnProfileDataSource db.execSQL("ALTER TABLE " + TABLE_VPNPROFILE + " ADD " + KEY_FLAGS + " INTEGER;"); } + if (oldVersion < 15) + { + db.execSQL("ALTER TABLE " + TABLE_VPNPROFILE + " ADD " + KEY_IKE_PROPOSAL + + " TEXT;"); + db.execSQL("ALTER TABLE " + TABLE_VPNPROFILE + " ADD " + KEY_ESP_PROPOSAL + + " TEXT;"); + } } private void updateColumns(SQLiteDatabase db, int version) @@ -393,6 +404,8 @@ public class VpnProfileDataSource profile.setSelectedApps(cursor.getString(cursor.getColumnIndex(KEY_SELECTED_APPS_LIST))); profile.setNATKeepAlive(getInt(cursor, cursor.getColumnIndex(KEY_NAT_KEEPALIVE))); profile.setFlags(getInt(cursor, cursor.getColumnIndex(KEY_FLAGS))); + profile.setIkeProposal(cursor.getString(cursor.getColumnIndex(KEY_IKE_PROPOSAL))); + profile.setEspProposal(cursor.getString(cursor.getColumnIndex(KEY_ESP_PROPOSAL))); return profile; } @@ -418,6 +431,8 @@ public class VpnProfileDataSource values.put(KEY_SELECTED_APPS_LIST, profile.getSelectedApps()); values.put(KEY_NAT_KEEPALIVE, profile.getNATKeepAlive()); values.put(KEY_FLAGS, profile.getFlags()); + values.put(KEY_IKE_PROPOSAL, profile.getIkeProposal()); + values.put(KEY_ESP_PROPOSAL, profile.getEspProposal()); return values; } From a7c43544ddf761a56725bfbe8bffc492458fa749 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Nov 2017 09:49:24 +0100 Subject: [PATCH 03/11] android: Use optional custom proposals for IKE and ESP If the proposal is invalid we fall back to the defaults. --- .../android/logic/CharonVpnService.java | 2 + .../backend/android_service.c | 85 +++++++++++++------ 2 files changed, 63 insertions(+), 24 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java index 61535ffa2..95c2ccd1f 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java @@ -261,6 +261,8 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe writer.setValue("connection.local_id", mCurrentProfile.getLocalId()); writer.setValue("connection.remote_id", mCurrentProfile.getRemoteId()); writer.setValue("connection.certreq", (mCurrentProfile.getFlags() & VpnProfile.FLAGS_SUPPRESS_CERT_REQS) == 0); + writer.setValue("connection.ike_proposal", mCurrentProfile.getIkeProposal()); + writer.setValue("connection.esp_proposal", mCurrentProfile.getEspProposal()); initiate(writer.serialize()); } else diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c index 809814b53..5c4a03842 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2010-2016 Tobias Brunner + * Copyright (C) 2010-2017 Tobias Brunner * Copyright (C) 2012 Giuliano Grassi * Copyright (C) 2012 Ralf Sager * HSR Hochschule fuer Technik Rapperswil @@ -707,6 +707,27 @@ static bool add_auth_cfg_cert(private_android_service_t *this, return TRUE; } +static proposal_t *parse_proposal(private_android_service_t *this, + protocol_id_t proto, char *opt) +{ + proposal_t *proposal = NULL; + char *prop; + + prop = this->settings->get_str(this->settings, opt, NULL); + if (!prop || !strlen(prop)) + { + return NULL; + } + + proposal = proposal_create_from_string(proto, prop); + if (!proposal) + { + DBG1(DBG_CFG, "invalid %N proposal '%s', falling back to defaults", + protocol_id_names, proto, prop); + } + return proposal; +} + static job_requeue_t initiate(private_android_service_t *this) { identification_t *gateway = NULL; @@ -714,6 +735,7 @@ static job_requeue_t initiate(private_android_service_t *this) peer_cfg_t *peer_cfg; child_cfg_t *child_cfg; traffic_selector_t *ts; + proposal_t *proposal; ike_sa_t *ike_sa; auth_cfg_t *auth; peer_cfg_create_t peer = { @@ -747,8 +769,16 @@ static job_requeue_t initiate(private_android_service_t *this) ike_cfg = ike_cfg_create(IKEV2, certreq, TRUE, "0.0.0.0", charon->socket->get_port(charon->socket, FALSE), server, port, FRAGMENTATION_YES, 0); - ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE)); - ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE)); + proposal = parse_proposal(this, PROTO_IKE, "connection.ike_proposal"); + if (proposal) + { + ike_cfg->add_proposal(ike_cfg, proposal); + } + else + { + ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE)); + ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE)); + } peer_cfg = peer_cfg_create("android", ike_cfg, &peer); peer_cfg->add_virtual_ip(peer_cfg, host_create_any(AF_INET)); @@ -795,27 +825,34 @@ static job_requeue_t initiate(private_android_service_t *this) peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE); child_cfg = child_cfg_create("android", &child); - /* create ESP proposals with and without DH groups, let responder decide - * if PFS is used */ - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128gcm16-aes256gcm16-chacha20poly1305-" - "curve25519-ecp256-modp3072")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128-sha256-curve25519-ecp256-modp3072")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes256-sha384-ecp521-modp8192")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128-aes192-aes256-sha1-sha256-sha384-sha512-" - "curve25519-ecp256-ecp384-ecp521-" - "modp2048-modp3072-modp4096-modp1024")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128gcm16-aes256gcm16-chacha20poly1305")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128-sha256")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes256-sha384")); - child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, - "aes128-aes192-aes256-sha1-sha256-sha384-sha512")); + proposal = parse_proposal(this, PROTO_ESP, "connection.esp_proposal"); + if (proposal) + { + child_cfg->add_proposal(child_cfg, proposal); + } + else + { /* create ESP proposals with and without DH groups, let responder decide + * if PFS is used */ + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128gcm16-aes256gcm16-chacha20poly1305-" + "curve25519-ecp256-modp3072")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-sha256-curve25519-ecp256-modp3072")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes256-sha384-ecp521-modp8192")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-aes192-aes256-sha1-sha256-sha384-sha512-" + "curve25519-ecp256-ecp384-ecp521-" + "modp2048-modp3072-modp4096-modp1024")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128gcm16-aes256gcm16-chacha20poly1305")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-sha256")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes256-sha384")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-aes192-aes256-sha1-sha256-sha384-sha512")); + } ts = traffic_selector_create_from_cidr("0.0.0.0/0", 0, 0, 65535); child_cfg->add_traffic_selector(child_cfg, TRUE, ts); ts = traffic_selector_create_from_cidr("0.0.0.0/0", 0, 0, 65535); From 6403ad5457af029c1f8cad088faf39271150160a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Nov 2017 10:23:09 +0100 Subject: [PATCH 04/11] android: Import IKE/ESP proposals We currently don't validate them here, only when used later will they get parsed (which includes some checks). --- .../org/strongswan/android/ui/VpnProfileImportActivity.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java index cee95c36f..97ba11bf7 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java @@ -497,6 +497,8 @@ public class VpnProfileImportActivity extends AppCompatActivity } } + profile.setIkeProposal(obj.optString("ike-proposal", null)); + profile.setEspProposal(obj.optString("esp-proposal", null)); profile.setMTU(getInteger(obj, "mtu", Constants.MTU_MIN, Constants.MTU_MAX)); profile.setNATKeepAlive(getInteger(obj, "nat-keepalive", Constants.NAT_KEEPALIVE_MIN, Constants.NAT_KEEPALIVE_MAX)); JSONObject split = obj.optJSONObject("split-tunneling"); From 2d1f65feb3d901c126df47b2e690818192a80f43 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Nov 2017 11:18:13 +0100 Subject: [PATCH 05/11] android: Make IKE/ESP proposals configurable in the GUI --- .../android/ui/VpnProfileDetailActivity.java | 21 +++++++- .../main/res/layout/profile_detail_view.xml | 52 +++++++++++++++++++ .../app/src/main/res/values-de/strings.xml | 6 +++ .../app/src/main/res/values-pl/strings.xml | 6 +++ .../app/src/main/res/values-ru/strings.xml | 6 +++ .../app/src/main/res/values-ua/strings.xml | 6 +++ .../src/main/res/values-zh-rCN/strings.xml | 6 +++ .../src/main/res/values-zh-rTW/strings.xml | 6 +++ .../app/src/main/res/values/strings.xml | 6 +++ 9 files changed, 114 insertions(+), 1 deletion(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java index 8792fd7e4..6ba8f80fb 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java @@ -37,6 +37,7 @@ import android.text.SpannableString; import android.text.Spanned; import android.text.TextUtils; import android.text.TextWatcher; +import android.text.method.LinkMovementMethod; import android.util.Log; import android.view.Menu; import android.view.MenuInflater; @@ -126,6 +127,10 @@ public class VpnProfileDetailActivity extends AppCompatActivity private CheckBox mBlockIPv6; private Spinner mSelectSelectedAppsHandling; private RelativeLayout mSelectApps; + private TextInputLayoutHelper mIkeProposalWrap; + private EditText mIkeProposal; + private TextInputLayoutHelper mEspProposalWrap; + private EditText mEspProposal; @Override public void onCreate(Bundle savedInstanceState) @@ -181,6 +186,13 @@ public class VpnProfileDetailActivity extends AppCompatActivity mSelectSelectedAppsHandling = (Spinner)findViewById(R.id.apps_handling); mSelectApps = (RelativeLayout)findViewById(R.id.select_applications); + mIkeProposal = (EditText)findViewById(R.id.ike_proposal); + mIkeProposalWrap = (TextInputLayoutHelper)findViewById(R.id.ike_proposal_wrap); + mEspProposal = (EditText)findViewById(R.id.esp_proposal); + mEspProposalWrap = (TextInputLayoutHelper)findViewById(R.id.esp_proposal_wrap); + /* make the link clickable */ + ((TextView)findViewById(R.id.proposal_intro)).setMovementMethod(LinkMovementMethod.getInstance()); + final SpaceTokenizer spaceTokenizer = new SpaceTokenizer(); mName.setTokenizer(spaceTokenizer); mRemoteId.setTokenizer(spaceTokenizer); @@ -546,7 +558,8 @@ public class VpnProfileDetailActivity extends AppCompatActivity mProfile.getPort() != null || mProfile.getNATKeepAlive() != null || (flags != null && flags != 0) || (st != null && st != 0) || mProfile.getIncludedSubnets() != null || mProfile.getExcludedSubnets() != null || - mProfile.getSelectedAppsHandling() != SelectedAppsHandling.SELECTED_APPS_DISABLE; + mProfile.getSelectedAppsHandling() != SelectedAppsHandling.SELECTED_APPS_DISABLE || + mProfile.getIkeProposal() != null || mProfile.getEspProposal() != null; } mShowAdvanced.setVisibility(!show ? View.VISIBLE : View.GONE); mAdvancedSettings.setVisibility(show ? View.VISIBLE : View.GONE); @@ -686,6 +699,10 @@ public class VpnProfileDetailActivity extends AppCompatActivity mProfile.setSplitTunneling(st == 0 ? null : st); mProfile.setSelectedAppsHandling(mSelectedAppsHandling); mProfile.setSelectedApps(mSelectedApps); + String ike = mIkeProposal.getText().toString().trim(); + mProfile.setIkeProposal(ike.isEmpty() ? null : ike); + String esp = mEspProposal.getText().toString().trim(); + mProfile.setEspProposal(esp.isEmpty() ? null : esp); } /** @@ -719,6 +736,8 @@ public class VpnProfileDetailActivity extends AppCompatActivity mBlockIPv6.setChecked(mProfile.getSplitTunneling() != null && (mProfile.getSplitTunneling() & VpnProfile.SPLIT_TUNNELING_BLOCK_IPV6) != 0); mSelectedAppsHandling = mProfile.getSelectedAppsHandling(); mSelectedApps = mProfile.getSelectedAppsSet(); + mIkeProposal.setText(mProfile.getIkeProposal()); + mEspProposal.setText(mProfile.getEspProposal()); flags = mProfile.getFlags(); useralias = mProfile.getUserCertificateAlias(); local_id = mProfile.getLocalId(); diff --git a/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml b/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml index f765dbcf1..d4d88314d 100644 --- a/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml +++ b/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml @@ -362,6 +362,58 @@ android:id="@+id/select_applications" layout="@layout/two_line_button" /> + + + + + + + + + + + + + + + + diff --git a/src/frontends/android/app/src/main/res/values-de/strings.xml b/src/frontends/android/app/src/main/res/values-de/strings.xml index 84d6bcd01..93eeb2a51 100644 --- a/src/frontends/android/app/src/main/res/values-de/strings.xml +++ b/src/frontends/android/app/src/main/res/values-de/strings.xml @@ -96,6 +96,12 @@ Keine Apps ausgewählt Eine App ausgewählt %1$d Apps ausgewählt + Algorithmen + Optionale spezifische Algorithmen für IKEv2 und/oder IPsec/ESP die statt der Standardwerte verwendet werden sollen. Eine Liste gültiger Algorithmen kann unserem Wiki entnommen werden (nicht alle werden von dieser App unterstützt). Beide Felder erwarten eine Liste von Algorithmen, jeweils mit einem Bindestrich getrennt. + IKEv2 Algorithmen + Für non-AEAD/klassische Verschlüsselungsalgorithmen wird ein Integritätsalgorithmus, eine pseudozufällige Funktion (PRF, optional, ansonsten wird eine auf dem Integritätsalgorithmus basierende verwendet) und eine Diffie-Hellman Gruppe benötigt (z.B. aes256-sha256-ecp256). Für kombinierte/AEAD Algorithmen wird der Integritätsalgorithmus weggelassen aber eine PRF wird benötigt (z.B. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithmen + Für non-AEAD/klassische Verschlüsselungsalgorithmen wird ein Integritätsalgorithmus benötigt, eine Diffie-Hellman Gruppe ist optional (z.B. aes256-sha256 oder aes256-sha256-ecp256). Für kombinierte/AEAD Algorithmen wird der Integritätsalgorithmus weggelassen (z.B. aes256gcm16 oder aes256gcm16-ecp256). Falls eine DH Gruppe angegeben wird, kommt während dem IPsec SA Rekeying ein DH Schlüsselaustausch zur Anwendung. Beim initialen Verbindungsaufbau hat eine DH Gruppe hier keinen Einfluss, weil die Schlüssel dort von der IKE SA abgeleitet werden. Deshalb wird eine Fehlkonfiguration mit dem Server erst später während dem Rekeying zu einem Fehler führen. VPN Profile importieren VPN Profil-Import fehlgeschlagen VPN Profil-Import fehlgeschlagen: %1$s diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml index c6a8b53f3..cc48a9b28 100644 --- a/src/frontends/android/app/src/main/res/values-pl/strings.xml +++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml @@ -96,6 +96,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. Import VPN profile Failed to import VPN profile Failed to import VPN profile: %1$s diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml index b47c4993a..a42230099 100644 --- a/src/frontends/android/app/src/main/res/values-ru/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml @@ -93,6 +93,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. Import VPN profile Failed to import VPN profile Failed to import VPN profile: %1$s diff --git a/src/frontends/android/app/src/main/res/values-ua/strings.xml b/src/frontends/android/app/src/main/res/values-ua/strings.xml index 69258b048..3f4a4c62f 100644 --- a/src/frontends/android/app/src/main/res/values-ua/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ua/strings.xml @@ -94,6 +94,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. Import VPN profile Failed to import VPN profile Failed to import VPN profile: %1$s diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml index a88e7aa9e..7d0d529a4 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml @@ -93,6 +93,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. 导入VPN配置 导入VPN配置失败 导入VPN配置失败: %1$s diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml index 8ef0feb2e..4e87530a9 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml @@ -93,6 +93,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. 匯入VPN設定檔 匯入VPN設定檔失敗 匯入VPN設定檔失敗: %1$s diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml index a02de6b1c..c51f373ea 100644 --- a/src/frontends/android/app/src/main/res/values/strings.xml +++ b/src/frontends/android/app/src/main/res/values/strings.xml @@ -96,6 +96,12 @@ No applications selected One application selected %1$d applications selected + Algorithms + Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. + IKEv2 Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). + IPsec/ESP Algorithms + For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. Import VPN profile Failed to import VPN profile Failed to import VPN profile: %1$s From 92c1b524870be547dd0387e3010825cb146fa865 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 16:41:52 +0100 Subject: [PATCH 06/11] android: Load JNI libraries in Application class This way they are also loaded when we don't use CharonVpnService. --- .../android/logic/CharonVpnService.java | 24 ----------------- .../android/logic/StrongSwanApplication.java | 26 +++++++++++++++++++ 2 files changed, 26 insertions(+), 24 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java index 95c2ccd1f..b6e7e2d64 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java @@ -1073,28 +1073,4 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe { return Build.MODEL + " - " + Build.BRAND + "/" + Build.PRODUCT + "/" + Build.MANUFACTURER; } - - /* - * The libraries are extracted to /data/data/org.strongswan.android/... - * during installation. On newer releases most are loaded in JNI_OnLoad. - */ - static - { - if (Build.VERSION.SDK_INT < Build.VERSION_CODES.JELLY_BEAN_MR2) - { - System.loadLibrary("strongswan"); - - if (MainActivity.USE_BYOD) - { - System.loadLibrary("tpmtss"); - System.loadLibrary("tncif"); - System.loadLibrary("tnccs"); - System.loadLibrary("imcv"); - } - - System.loadLibrary("charon"); - System.loadLibrary("ipsec"); - } - System.loadLibrary("androidbridge"); - } } diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/StrongSwanApplication.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/StrongSwanApplication.java index d642b67b3..19711e447 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/StrongSwanApplication.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/StrongSwanApplication.java @@ -18,9 +18,11 @@ package org.strongswan.android.logic; import java.security.Security; import org.strongswan.android.security.LocalCertificateKeyStoreProvider; +import org.strongswan.android.ui.MainActivity; import android.app.Application; import android.content.Context; +import android.os.Build; public class StrongSwanApplication extends Application { @@ -45,4 +47,28 @@ public class StrongSwanApplication extends Application { return StrongSwanApplication.mContext; } + + /* + * The libraries are extracted to /data/data/org.strongswan.android/... + * during installation. On newer releases most are loaded in JNI_OnLoad. + */ + static + { + if (Build.VERSION.SDK_INT < Build.VERSION_CODES.JELLY_BEAN_MR2) + { + System.loadLibrary("strongswan"); + + if (MainActivity.USE_BYOD) + { + System.loadLibrary("tpmtss"); + System.loadLibrary("tncif"); + System.loadLibrary("tnccs"); + System.loadLibrary("imcv"); + } + + System.loadLibrary("charon"); + System.loadLibrary("ipsec"); + } + System.loadLibrary("androidbridge"); + } } From 2307bffe5603007bd26f6da487742f74e3268650 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 17:15:14 +0100 Subject: [PATCH 07/11] proposal: Move proposal_t from libcharon to libstrongswan This allows us to use it without having to initialize libcharon, which was required for the logging (we probably could have included debug.h instead of daemon.h to workaround that but this seems more correct). --- src/charon-tkm/tests/keymat_tests.c | 2 +- src/conftest/hooks/custom_proposal.c | 2 +- src/libcharon/Android.mk | 1 - src/libcharon/Makefile.am | 1 - src/libcharon/config/child_cfg.h | 2 +- src/libcharon/config/ike_cfg.h | 2 +- src/libcharon/config/peer_cfg.h | 2 +- src/libcharon/daemon.c | 6 ------ src/libcharon/encoding/payloads/proposal_substructure.h | 2 +- src/libcharon/encoding/payloads/transform_substructure.h | 2 +- src/libcharon/processing/jobs/delete_child_sa_job.h | 2 +- src/libcharon/processing/jobs/rekey_child_sa_job.h | 3 ++- src/libcharon/processing/jobs/update_sa_job.h | 2 +- src/libcharon/sa/child_sa.h | 2 +- src/libcharon/sa/keymat.h | 2 +- src/libcharon/tests/Makefile.am | 1 - src/libcharon/tests/libcharon_tests.h | 1 - src/libstrongswan/Android.mk | 2 +- src/libstrongswan/Makefile.am | 4 ++-- .../config => libstrongswan/crypto/proposal}/proposal.c | 1 - .../config => libstrongswan/crypto/proposal}/proposal.h | 2 +- src/libstrongswan/crypto/proposal/proposal_keywords.h | 2 +- src/libstrongswan/library.c | 3 +++ src/libstrongswan/tests/Makefile.am | 1 + .../tests/suites/test_proposal.c | 2 +- src/libstrongswan/tests/tests.h | 1 + 26 files changed, 24 insertions(+), 29 deletions(-) rename src/{libcharon/config => libstrongswan/crypto/proposal}/proposal.c (99%) rename src/{libcharon/config => libstrongswan/crypto/proposal}/proposal.h (99%) rename src/{libcharon => libstrongswan}/tests/suites/test_proposal.c (99%) diff --git a/src/charon-tkm/tests/keymat_tests.c b/src/charon-tkm/tests/keymat_tests.c index 8bba1f9d9..d4751f7d0 100644 --- a/src/charon-tkm/tests/keymat_tests.c +++ b/src/charon-tkm/tests/keymat_tests.c @@ -17,7 +17,7 @@ #include #include -#include +#include #include #include diff --git a/src/conftest/hooks/custom_proposal.c b/src/conftest/hooks/custom_proposal.c index c4f8385c0..5e1cec089 100644 --- a/src/conftest/hooks/custom_proposal.c +++ b/src/conftest/hooks/custom_proposal.c @@ -18,7 +18,7 @@ #include #include -#include +#include typedef struct private_custom_proposal_t private_custom_proposal_t; diff --git a/src/libcharon/Android.mk b/src/libcharon/Android.mk index f381860b9..d1fb33702 100644 --- a/src/libcharon/Android.mk +++ b/src/libcharon/Android.mk @@ -16,7 +16,6 @@ config/backend_manager.c config/backend_manager.h config/backend.h \ config/child_cfg.c config/child_cfg.h \ config/ike_cfg.c config/ike_cfg.h \ config/peer_cfg.c config/peer_cfg.h \ -config/proposal.c config/proposal.h \ control/controller.c control/controller.h \ daemon.c daemon.h \ encoding/generator.c encoding/generator.h \ diff --git a/src/libcharon/Makefile.am b/src/libcharon/Makefile.am index 964a19ec8..fe28f1ead 100644 --- a/src/libcharon/Makefile.am +++ b/src/libcharon/Makefile.am @@ -14,7 +14,6 @@ config/backend_manager.c config/backend_manager.h config/backend.h \ config/child_cfg.c config/child_cfg.h \ config/ike_cfg.c config/ike_cfg.h \ config/peer_cfg.c config/peer_cfg.h \ -config/proposal.c config/proposal.h \ control/controller.c control/controller.h \ daemon.c daemon.h \ encoding/generator.c encoding/generator.h \ diff --git a/src/libcharon/config/child_cfg.h b/src/libcharon/config/child_cfg.h index 93904ec71..e2834fa8f 100644 --- a/src/libcharon/config/child_cfg.h +++ b/src/libcharon/config/child_cfg.h @@ -31,7 +31,7 @@ typedef struct child_cfg_create_t child_cfg_create_t; #include #include -#include +#include #include /** diff --git a/src/libcharon/config/ike_cfg.h b/src/libcharon/config/ike_cfg.h index 034996f60..302024443 100644 --- a/src/libcharon/config/ike_cfg.h +++ b/src/libcharon/config/ike_cfg.h @@ -31,7 +31,7 @@ typedef struct ike_cfg_t ike_cfg_t; #include #include #include -#include +#include #include /** diff --git a/src/libcharon/config/peer_cfg.h b/src/libcharon/config/peer_cfg.h index b294ae72f..6074a7cd4 100644 --- a/src/libcharon/config/peer_cfg.h +++ b/src/libcharon/config/peer_cfg.h @@ -32,7 +32,7 @@ typedef struct peer_cfg_create_t peer_cfg_create_t; #include #include #include -#include +#include #include #include #include diff --git a/src/libcharon/daemon.c b/src/libcharon/daemon.c index 7c9f83d12..e4b819710 100644 --- a/src/libcharon/daemon.c +++ b/src/libcharon/daemon.c @@ -55,7 +55,6 @@ #include #include #include -#include #include #include #include @@ -989,11 +988,6 @@ bool libcharon_init() dbg_old = dbg; dbg = dbg_bus; - lib->printf_hook->add_handler(lib->printf_hook, 'P', - proposal_printf_hook, - PRINTF_HOOK_ARGTYPE_POINTER, - PRINTF_HOOK_ARGTYPE_END); - if (lib->integrity && !lib->integrity->check(lib->integrity, "libcharon", libcharon_init)) { diff --git a/src/libcharon/encoding/payloads/proposal_substructure.h b/src/libcharon/encoding/payloads/proposal_substructure.h index 796c10890..cad597e58 100644 --- a/src/libcharon/encoding/payloads/proposal_substructure.h +++ b/src/libcharon/encoding/payloads/proposal_substructure.h @@ -29,7 +29,7 @@ typedef struct proposal_substructure_t proposal_substructure_t; #include #include #include -#include +#include #include #include #include diff --git a/src/libcharon/encoding/payloads/transform_substructure.h b/src/libcharon/encoding/payloads/transform_substructure.h index cb75f1ea7..a9d4f9f7d 100644 --- a/src/libcharon/encoding/payloads/transform_substructure.h +++ b/src/libcharon/encoding/payloads/transform_substructure.h @@ -32,7 +32,7 @@ typedef struct transform_substructure_t transform_substructure_t; #include #include #include -#include +#include /** * IKEv1 Value for a transform payload. diff --git a/src/libcharon/processing/jobs/delete_child_sa_job.h b/src/libcharon/processing/jobs/delete_child_sa_job.h index b2d5a11f6..b33ea617b 100644 --- a/src/libcharon/processing/jobs/delete_child_sa_job.h +++ b/src/libcharon/processing/jobs/delete_child_sa_job.h @@ -27,7 +27,7 @@ typedef struct delete_child_sa_job_t delete_child_sa_job_t; #include #include #include -#include +#include /** diff --git a/src/libcharon/processing/jobs/rekey_child_sa_job.h b/src/libcharon/processing/jobs/rekey_child_sa_job.h index 1de06fd07..1c9d9b400 100644 --- a/src/libcharon/processing/jobs/rekey_child_sa_job.h +++ b/src/libcharon/processing/jobs/rekey_child_sa_job.h @@ -26,7 +26,7 @@ typedef struct rekey_child_sa_job_t rekey_child_sa_job_t; #include #include #include -#include +#include /** * Class representing an REKEY_CHILD_SA Job. @@ -50,4 +50,5 @@ struct rekey_child_sa_job_t { */ rekey_child_sa_job_t *rekey_child_sa_job_create(protocol_id_t protocol, uint32_t spi, host_t *dst); + #endif /** REKEY_CHILD_SA_JOB_H_ @}*/ diff --git a/src/libcharon/processing/jobs/update_sa_job.h b/src/libcharon/processing/jobs/update_sa_job.h index ed978dc8b..17beb68b6 100644 --- a/src/libcharon/processing/jobs/update_sa_job.h +++ b/src/libcharon/processing/jobs/update_sa_job.h @@ -26,7 +26,7 @@ typedef struct update_sa_job_t update_sa_job_t; #include #include #include -#include +#include /** * Update the addresses of an IKE and its CHILD_SAs. diff --git a/src/libcharon/sa/child_sa.h b/src/libcharon/sa/child_sa.h index 082404d93..85c1a42cf 100644 --- a/src/libcharon/sa/child_sa.h +++ b/src/libcharon/sa/child_sa.h @@ -30,7 +30,7 @@ typedef struct child_sa_t child_sa_t; #include #include #include -#include +#include #include /** diff --git a/src/libcharon/sa/keymat.h b/src/libcharon/sa/keymat.h index bc40b3d92..17d2efe37 100644 --- a/src/libcharon/sa/keymat.h +++ b/src/libcharon/sa/keymat.h @@ -27,7 +27,7 @@ typedef struct keymat_t keymat_t; #include #include #include -#include +#include #include #include diff --git a/src/libcharon/tests/Makefile.am b/src/libcharon/tests/Makefile.am index 8f762a2e6..5ebd0456c 100644 --- a/src/libcharon/tests/Makefile.am +++ b/src/libcharon/tests/Makefile.am @@ -3,7 +3,6 @@ TESTS = libcharon_tests exchange_tests check_PROGRAMS = $(TESTS) libcharon_tests_SOURCES = \ - suites/test_proposal.c \ suites/test_ike_cfg.c \ suites/test_mem_pool.c \ suites/test_message_chapoly.c \ diff --git a/src/libcharon/tests/libcharon_tests.h b/src/libcharon/tests/libcharon_tests.h index f770f464d..d17ea041d 100644 --- a/src/libcharon/tests/libcharon_tests.h +++ b/src/libcharon/tests/libcharon_tests.h @@ -24,7 +24,6 @@ * @ingroup libcharon-tests */ -TEST_SUITE(proposal_suite_create) TEST_SUITE(ike_cfg_suite_create) TEST_SUITE(mem_pool_suite_create) TEST_SUITE_DEPEND(message_chapoly_suite_create, AEAD, ENCR_CHACHA20_POLY1305, 32) diff --git a/src/libstrongswan/Android.mk b/src/libstrongswan/Android.mk index 0247add96..fb7c62a8a 100644 --- a/src/libstrongswan/Android.mk +++ b/src/libstrongswan/Android.mk @@ -8,7 +8,7 @@ asn1/asn1.c asn1/asn1_parser.c asn1/oid.c bio/bio_reader.c bio/bio_writer.c \ collections/blocking_queue.c collections/enumerator.c collections/hashtable.c \ collections/array.c \ collections/linked_list.c crypto/crypters/crypter.c crypto/hashers/hasher.c \ -crypto/hashers/hash_algorithm_set.c \ +crypto/hashers/hash_algorithm_set.c crypto/proposal/proposal.c \ crypto/proposal/proposal_keywords.c crypto/proposal/proposal_keywords_static.c \ crypto/prfs/prf.c crypto/prfs/mac_prf.c crypto/pkcs5.c \ crypto/rngs/rng.c crypto/prf_plus.c crypto/signers/signer.c \ diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am index a9759aeee..66539a879 100644 --- a/src/libstrongswan/Makefile.am +++ b/src/libstrongswan/Makefile.am @@ -6,7 +6,7 @@ asn1/asn1.c asn1/asn1_parser.c asn1/oid.c bio/bio_reader.c bio/bio_writer.c \ collections/blocking_queue.c collections/enumerator.c collections/hashtable.c \ collections/array.c \ collections/linked_list.c crypto/crypters/crypter.c crypto/hashers/hasher.c \ -crypto/hashers/hash_algorithm_set.c \ +crypto/hashers/hash_algorithm_set.c crypto/proposal/proposal.c \ crypto/proposal/proposal_keywords.c crypto/proposal/proposal_keywords_static.c \ crypto/prfs/prf.c crypto/prfs/mac_prf.c crypto/pkcs5.c \ crypto/rngs/rng.c crypto/prf_plus.c crypto/signers/signer.c \ @@ -69,7 +69,7 @@ asn1/asn1.h asn1/asn1_parser.h asn1/oid.h bio/bio_reader.h bio/bio_writer.h \ collections/blocking_queue.h collections/enumerator.h collections/hashtable.h \ collections/linked_list.h collections/array.h collections/dictionary.h \ crypto/crypters/crypter.h crypto/hashers/hasher.h \ -crypto/hashers/hash_algorithm_set.h crypto/mac.h \ +crypto/hashers/hash_algorithm_set.h crypto/mac.h crypto/proposal/proposal.h \ crypto/proposal/proposal_keywords.h crypto/proposal/proposal_keywords_static.h \ crypto/prfs/prf.h crypto/prfs/mac_prf.h crypto/rngs/rng.h crypto/nonce_gen.h \ crypto/prf_plus.h crypto/signers/signer.h crypto/signers/mac_signer.h \ diff --git a/src/libcharon/config/proposal.c b/src/libstrongswan/crypto/proposal/proposal.c similarity index 99% rename from src/libcharon/config/proposal.c rename to src/libstrongswan/crypto/proposal/proposal.c index 46c3c9400..221375f7b 100644 --- a/src/libcharon/config/proposal.c +++ b/src/libstrongswan/crypto/proposal/proposal.c @@ -19,7 +19,6 @@ #include "proposal.h" -#include #include #include diff --git a/src/libcharon/config/proposal.h b/src/libstrongswan/crypto/proposal/proposal.h similarity index 99% rename from src/libcharon/config/proposal.h rename to src/libstrongswan/crypto/proposal/proposal.h index 0dc70f4c5..d9a2af79f 100644 --- a/src/libcharon/config/proposal.h +++ b/src/libstrongswan/crypto/proposal/proposal.h @@ -16,7 +16,7 @@ /** * @defgroup proposal proposal - * @{ @ingroup config + * @{ @ingroup crypto */ #ifndef PROPOSAL_H_ diff --git a/src/libstrongswan/crypto/proposal/proposal_keywords.h b/src/libstrongswan/crypto/proposal/proposal_keywords.h index 856abdce6..b062221e5 100644 --- a/src/libstrongswan/crypto/proposal/proposal_keywords.h +++ b/src/libstrongswan/crypto/proposal/proposal_keywords.h @@ -37,7 +37,7 @@ /** * @defgroup proposal_keywords proposal_keywords - * @{ @ingroup crypto + * @{ @ingroup proposal */ #ifndef PROPOSAL_KEYWORDS_H_ diff --git a/src/libstrongswan/library.c b/src/libstrongswan/library.c index 7944b9356..dbdf5cfe9 100644 --- a/src/libstrongswan/library.c +++ b/src/libstrongswan/library.c @@ -26,6 +26,7 @@ #include #include #include +#include #define CHECKSUM_LIBRARY IPSEC_LIB_DIR"/libchecksum.so" @@ -369,6 +370,8 @@ bool library_init(char *settings, const char *namespace) PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_END); pfh->add_handler(pfh, 'R', traffic_selector_printf_hook, PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_END); + pfh->add_handler(pfh, 'P', proposal_printf_hook, + PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_END); this->objects = hashtable_create((hashtable_hash_t)hash, (hashtable_equals_t)equals, 4); diff --git a/src/libstrongswan/tests/Makefile.am b/src/libstrongswan/tests/Makefile.am index 07f5eb5f2..5737e7a17 100644 --- a/src/libstrongswan/tests/Makefile.am +++ b/src/libstrongswan/tests/Makefile.am @@ -47,6 +47,7 @@ libstrongswan_tests_SOURCES = tests.h tests.c \ suites/test_auth_cfg.c \ suites/test_hasher.c \ suites/test_crypter.c \ + suites/test_proposal.c \ suites/test_crypto_factory.c \ suites/test_iv_gen.c \ suites/test_pen.c \ diff --git a/src/libcharon/tests/suites/test_proposal.c b/src/libstrongswan/tests/suites/test_proposal.c similarity index 99% rename from src/libcharon/tests/suites/test_proposal.c rename to src/libstrongswan/tests/suites/test_proposal.c index f1591794a..91766266d 100644 --- a/src/libcharon/tests/suites/test_proposal.c +++ b/src/libstrongswan/tests/suites/test_proposal.c @@ -15,7 +15,7 @@ #include "test_suite.h" -#include +#include static struct { protocol_id_t proto; diff --git a/src/libstrongswan/tests/tests.h b/src/libstrongswan/tests/tests.h index 525bdeb94..5fab227f2 100644 --- a/src/libstrongswan/tests/tests.h +++ b/src/libstrongswan/tests/tests.h @@ -40,6 +40,7 @@ TEST_SUITE(printf_suite_create) TEST_SUITE(auth_cfg_suite_create) TEST_SUITE(hasher_suite_create) TEST_SUITE(crypter_suite_create) +TEST_SUITE(proposal_suite_create) TEST_SUITE(crypto_factory_suite_create) TEST_SUITE_DEPEND(iv_gen_suite_create, RNG, RNG_STRONG) TEST_SUITE(pen_suite_create) From 836a9438047370d852b13544e47a99702d436a5a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 17:26:51 +0100 Subject: [PATCH 08/11] android: Add utility JNI function to validate proposal strings --- .../org/strongswan/android/utils/Utils.java | 13 ++++++++-- .../main/jni/libandroidbridge/charonservice.c | 26 +++++++++++++++++++ 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/utils/Utils.java b/src/frontends/android/app/src/main/java/org/strongswan/android/utils/Utils.java index b5c447f31..f2e8e0058 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/utils/Utils.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/utils/Utils.java @@ -1,6 +1,6 @@ /* - * Copyright (C) 2014 Tobias Brunner - * Hochschule fuer Technik Rapperswil + * Copyright (C) 2014-2017 Tobias Brunner + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -37,4 +37,13 @@ public class Utils } return new String(hex); } + + /** + * Validate the given proposal string + * + * @param ike true for IKE, false for ESP + * @param proposal proposal string + * @return true if valid + */ + public native static boolean isProposalValid(boolean ike, String proposal); } diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c index 2891eabe0..06c5cada4 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c @@ -716,3 +716,29 @@ JNI_METHOD(CharonVpnService, initiate, void, initiate(settings); } + +/** + * Utility function to verify proposal strings (static, so `this` is the class) + */ +JNI_METHOD_P(org_strongswan_android_utils, Utils, isProposalValid, jboolean, + jboolean ike, jstring proposal) +{ + proposal_t *prop; + char *str; + bool valid; + + dbg = dbg_android; + + if (!library_init(NULL, "charon")) + { + library_deinit(); + return FALSE; + } + str = androidjni_convert_jstring(env, proposal); + prop = proposal_create_from_string(ike ? PROTO_IKE : PROTO_ESP, str); + valid = prop != NULL; + DESTROY_IF(prop); + free(str); + library_deinit(); + return valid; +} From 9f962f6c1917551fa99904f81687c042345c0f0b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 17:40:52 +0100 Subject: [PATCH 09/11] android: Validate proposal strings in the GUI --- .../android/ui/VpnProfileDetailActivity.java | 22 +++++++++++++++++++ .../app/src/main/res/values-de/strings.xml | 1 + .../app/src/main/res/values-pl/strings.xml | 1 + .../app/src/main/res/values-ru/strings.xml | 1 + .../app/src/main/res/values-ua/strings.xml | 1 + .../src/main/res/values-zh-rCN/strings.xml | 1 + .../src/main/res/values-zh-rTW/strings.xml | 1 + .../app/src/main/res/values/strings.xml | 1 + 8 files changed, 29 insertions(+) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java index 6ba8f80fb..37c5b3357 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java @@ -70,6 +70,7 @@ import org.strongswan.android.ui.adapter.CertificateIdentitiesAdapter; import org.strongswan.android.ui.widget.TextInputLayoutHelper; import org.strongswan.android.utils.Constants; import org.strongswan.android.utils.IPRangeSet; +import org.strongswan.android.utils.Utils; import java.security.cert.X509Certificate; import java.util.ArrayList; @@ -653,6 +654,16 @@ public class VpnProfileDetailActivity extends AppCompatActivity Constants.NAT_KEEPALIVE_MIN, Constants.NAT_KEEPALIVE_MAX)); valid = false; } + if (!validateProposal(mIkeProposal, true)) + { + mIkeProposalWrap.setError(getString(R.string.alert_text_no_proposal)); + valid = false; + } + if (!validateProposal(mEspProposal, false)) + { + mEspProposalWrap.setError(getString(R.string.alert_text_no_proposal)); + valid = false; + } return valid; } @@ -845,6 +856,17 @@ public class VpnProfileDetailActivity extends AppCompatActivity return value.isEmpty() || IPRangeSet.fromString(value) != null; } + /** + * Check that the value in the given text box is a valid proposal + * + * @param view text box + */ + private boolean validateProposal(EditText view, boolean ike) + { + String value = view.getText().toString().trim(); + return value.isEmpty() || Utils.isProposalValid(ike, value); + } + private class SelectUserCertOnClickListener implements OnClickListener, KeyChainAliasCallback { @Override diff --git a/src/frontends/android/app/src/main/res/values-de/strings.xml b/src/frontends/android/app/src/main/res/values-de/strings.xml index 93eeb2a51..49a0ab411 100644 --- a/src/frontends/android/app/src/main/res/values-de/strings.xml +++ b/src/frontends/android/app/src/main/res/values-de/strings.xml @@ -119,6 +119,7 @@ Bitte wählen Sie eines aus oder aktivieren Sie Automatisch wählen Bitte geben Sie eine Nummer von %1$d - %2$d ein Bitte geben Sie mit Leerzeichen getrennte, gültige Subnetzte und/oder IP-Adressen ein + Bitte geben Sie eine mit Bindestrichen getrennte, gültige Liste von Algorithmen ein EAP-TNC kann Ihre Privatsphäre beeinträchtigen Gerätedaten werden an den Server-Betreiber gesendet Trusted Network Connect (TNC) erlaubt Server-Betreibern den Gesundheitszustand von Endgeräten zu prüfen.

Dazu kann der Betreiber Daten verlangen, wie etwa eine eindeutige Identifikationsnummer, eine Liste der installierten Pakete, Systemeinstellungen oder kryptografische Prüfsummen von Dateien.

Solche Daten werden nur übermittelt nachdem die Identität des Servers geprüft wurde.]]> diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml index cc48a9b28..61fd3f09e 100644 --- a/src/frontends/android/app/src/main/res/values-pl/strings.xml +++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml @@ -119,6 +119,7 @@ Wybierz lub uaktywnij jeden Wybierz automatycznie Please enter a number in the range from %1$d - %2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml index a42230099..a2b3ada45 100644 --- a/src/frontends/android/app/src/main/res/values-ru/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml @@ -116,6 +116,7 @@ Пожалуйста выберите один Выбрать автоматически Please enter a number in the range from %1$d - %2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-ua/strings.xml b/src/frontends/android/app/src/main/res/values-ua/strings.xml index 3f4a4c62f..bfe4719cd 100644 --- a/src/frontends/android/app/src/main/res/values-ua/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ua/strings.xml @@ -117,6 +117,7 @@ Будь ласка виберіть один Вибрати автоматично Please enter a number in the range from %1$d - %2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml index 7d0d529a4..bda732443 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml @@ -116,6 +116,7 @@ 请选择一项或激活 自动选择 请输入一个数字范围从%1$d到%2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC可能会影响您的隐私 设备数据已被发送至服务器管理员 Trusted Network Connect (TNC) 允许服务器管理员评定一个用户设备的状况。

出于此目的，服务器管理员可能要求以下数据如独立ID、已安装软件列表、系统设置、或加密过的文件校验值。

任何数据都仅将在验证过服务器的身份ID之后被发出。]]> diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml index 4e87530a9..2d4992333 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml @@ -116,6 +116,7 @@ 請選擇一項或啟動 自動選擇 請輸入一個數字範圍從%1$d到%2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC可能會影響您的隱私安全 裝置資料已經發送給伺服器管理者 Trusted Network Connect (TNC) 可以讓伺服器管理者評估用戶裝置的狀況。

在這個目的下，伺服器管理者可能會要求以下資料，例如ID、已安裝的App項目、系統設定、或加密檔案驗證值。

任何資料都只有在驗證伺服器的身分ID之後才會被送出。]]> diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml index c51f373ea..dd22d3be7 100644 --- a/src/frontends/android/app/src/main/res/values/strings.xml +++ b/src/frontends/android/app/src/main/res/values/strings.xml @@ -119,6 +119,7 @@ Please select one or activate Select automatically Please enter a number in the range from %1$d - %2$d Please enter valid subnets and/or IP addresses, separated by spaces + Please enter a valid list of algorithms, separated by hyphens EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> From b03713add4a634eec797d3a8503cff05a5eed6e9 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 17:45:52 +0100 Subject: [PATCH 10/11] android: Validate proposal strings when importing profiles --- .../android/ui/VpnProfileImportActivity.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java index 97ba11bf7..43c0035cf 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java @@ -59,6 +59,7 @@ import org.strongswan.android.security.TrustedCertificateEntry; import org.strongswan.android.ui.widget.TextInputLayoutHelper; import org.strongswan.android.utils.Constants; import org.strongswan.android.utils.IPRangeSet; +import org.strongswan.android.utils.Utils; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; @@ -497,8 +498,8 @@ public class VpnProfileImportActivity extends AppCompatActivity } } - profile.setIkeProposal(obj.optString("ike-proposal", null)); - profile.setEspProposal(obj.optString("esp-proposal", null)); + profile.setIkeProposal(getProposal(obj, "ike-proposal", true)); + profile.setEspProposal(getProposal(obj, "esp-proposal", false)); profile.setMTU(getInteger(obj, "mtu", Constants.MTU_MIN, Constants.MTU_MAX)); profile.setNATKeepAlive(getInteger(obj, "nat-keepalive", Constants.NAT_KEEPALIVE_MIN, Constants.NAT_KEEPALIVE_MAX)); JSONObject split = obj.optJSONObject("split-tunneling"); @@ -536,6 +537,19 @@ public class VpnProfileImportActivity extends AppCompatActivity return res < min || res > max ? null : res; } + private String getProposal(JSONObject obj, String key, boolean ike) throws JSONException + { + String value = obj.optString(key, null); + if (!TextUtils.isEmpty(value)) + { + if (!Utils.isProposalValid(ike, value)) + { + throw new JSONException(getString(R.string.profile_import_failed_value, key)); + } + } + return value; + } + private String getSubnets(JSONObject split, String key) throws JSONException { ArrayList subnets = new ArrayList<>(); From 5a6f687bdf83db15054d6a5e2b60429eb6b1308a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 17 Nov 2017 18:07:09 +0100 Subject: [PATCH 11/11] android: New release after adding configurable proposals --- src/frontends/android/app/build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/build.gradle b/src/frontends/android/app/build.gradle index ca11abe02..bc26c331e 100644 --- a/src/frontends/android/app/build.gradle +++ b/src/frontends/android/app/build.gradle @@ -8,8 +8,8 @@ android { applicationId "org.strongswan.android" minSdkVersion 15 targetSdkVersion 22 - versionCode 48 - versionName "1.9.4" + versionCode 49 + versionName "1.9.5" } sourceSets.main {