From 1435bd2e1bb6a1f49cb51dd4650a200e50544b13 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 14 Jul 2014 15:06:40 +0200 Subject: [PATCH 1/4] android: Change to CONNECTING state if CHILD_SA goes down Unless we are disconnecting. This currently triggers the connecting dialog, perhaps just updating the status text would do too (when switching from CONNECTED to CONNECTING, not from DISCONNECTED to CONNECTING). --- .../src/org/strongswan/android/logic/CharonVpnService.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java index 31172ab44..13024512e 100644 --- a/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java @@ -354,7 +354,10 @@ public class CharonVpnService extends VpnService implements Runnable switch (status) { case STATE_CHILD_SA_DOWN: - /* we ignore this as we use closeaction=restart */ + if (!mIsDisconnecting) + { + setState(State.CONNECTING); + } break; case STATE_CHILD_SA_UP: setState(State.CONNECTED); From fb5d541503e44f2ca727661040d2fce9392ee96f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 14 Jul 2014 15:08:24 +0200 Subject: [PATCH 2/4] android: Set CHILD_STATE_DOWN whenever the CHILD_SA goes down No matter what triggers it. We also don't close the TUN device, but we might handle that differently in the future to allow reestablishing the IKE_SA if host names have to be re-resolved via DNS. --- .../android/jni/libandroidbridge/backend/android_service.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index db9bebcc5..c893f62fe 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -381,14 +381,8 @@ METHOD(listener_t, child_updown, bool, } else { - if (ike_sa->has_condition(ike_sa, COND_REAUTHENTICATING)) - { /* we ignore this during reauthentication */ - return TRUE; - } - close_tun_device(this); charonservice->update_status(charonservice, CHARONSERVICE_CHILD_STATE_DOWN); - return FALSE; } } return TRUE; From 08d545e29aa57277c520df0d02f99b6591db0a35 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 14 Jul 2014 15:10:49 +0200 Subject: [PATCH 3/4] android: Set CHILD_STATE_DOWN when the IKE_SA gets reestablished --- .../jni/libandroidbridge/backend/android_service.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index c893f62fe..d73dc4582 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -392,7 +392,8 @@ METHOD(listener_t, ike_updown, bool, private_android_service_t *this, ike_sa_t *ike_sa, bool up) { /* this callback is only registered during initiation, so if the IKE_SA - * goes down we assume an authentication error */ + * goes down we assume some kind of authentication error, more specific + * errors are catched in the alert() handler */ if (this->ike_sa == ike_sa && !up) { charonservice->update_status(charonservice, @@ -452,6 +453,11 @@ METHOD(listener_t, ike_reestablish, bool, this->ike_sa = new; /* re-register hook to detect initiation failures */ this->public.listener.ike_updown = _ike_updown; + /* if the IKE_SA got deleted by the responder we get the child_down() + * event on the old IKE_SA after this hook has been called, so they + * get ignored and thus we trigger the event here */ + charonservice->update_status(charonservice, + CHARONSERVICE_CHILD_STATE_DOWN); /* the TUN device will be closed when the new CHILD_SA is established */ } return TRUE; From 394be2d5563eedf284984f8180e51353af45a621 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 14 Jul 2014 15:43:06 +0200 Subject: [PATCH 4/4] android: Delay disconnecting on errors until user dismisses them If e.g. reauthentication fails we don't want to close the TUN device until the user acknowledged the error and is thus aware of the failure. --- .../src/org/strongswan/android/logic/CharonVpnService.java | 6 ++---- .../src/org/strongswan/android/ui/VpnStateFragment.java | 4 ++++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java index 13024512e..d53d478b2 100644 --- a/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/src/org/strongswan/android/logic/CharonVpnService.java @@ -322,9 +322,8 @@ public class CharonVpnService extends VpnService implements Runnable } /** - * Set an error on the state service and disconnect the current connection. - * This is not done by calling stopCurrentConnection() above, but instead - * is done asynchronously via state service. + * Set an error on the state service. Called by the handler thread and any + * of charon's threads. * * @param error error state */ @@ -337,7 +336,6 @@ public class CharonVpnService extends VpnService implements Runnable if (!mIsDisconnecting) { mService.setError(error); - mService.disconnect(); } } } diff --git a/src/frontends/android/src/org/strongswan/android/ui/VpnStateFragment.java b/src/frontends/android/src/org/strongswan/android/ui/VpnStateFragment.java index f0a03a513..160ba951b 100644 --- a/src/frontends/android/src/org/strongswan/android/ui/VpnStateFragment.java +++ b/src/frontends/android/src/org/strongswan/android/ui/VpnStateFragment.java @@ -313,6 +313,10 @@ public class VpnStateFragment extends Fragment implements VpnStateListener private void clearError() { + if (mService != null) + { + mService.disconnect(); + } mDismissedConnectionID = mErrorConnectionID; updateView(); }