From 8f2b6d709448fa9be6538bbc70235b6900eb7c63 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 15:31:14 +0200 Subject: [PATCH 01/17] testing: Ignore hosts that are not running during shutdown This allows properly terminating the environment if a host has crashed or was terminated manually for some reason. --- testing/stop-testing | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/testing/stop-testing b/testing/stop-testing index 8abf5f223..6f705b812 100755 --- a/testing/stop-testing +++ b/testing/stop-testing @@ -24,7 +24,12 @@ done for host in $STRONGSWANHOSTS do log_action "Guest $host" - execute "virsh shutdown $host" + + if running_any $host; then + execute "virsh shutdown $host" + else + echo_warn "...not running" + fi rm -f $VIRTIMGSTORE/$host.$IMGEXT done From ad2caae301db3379f6597ad96044b02ef96aec01 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 5 Oct 2020 15:59:47 +0200 Subject: [PATCH 02/17] android: Update Gradle plugin --- src/frontends/android/build.gradle | 2 +- .../android/gradle/wrapper/gradle-wrapper.properties | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/frontends/android/build.gradle b/src/frontends/android/build.gradle index b2d55abd8..3798c323a 100644 --- a/src/frontends/android/build.gradle +++ b/src/frontends/android/build.gradle @@ -4,7 +4,7 @@ buildscript { google() } dependencies { - classpath 'com.android.tools.build:gradle:3.6.3' + classpath 'com.android.tools.build:gradle:4.0.1' } } diff --git a/src/frontends/android/gradle/wrapper/gradle-wrapper.properties b/src/frontends/android/gradle/wrapper/gradle-wrapper.properties index aabd2d068..35b130583 100644 --- a/src/frontends/android/gradle/wrapper/gradle-wrapper.properties +++ b/src/frontends/android/gradle/wrapper/gradle-wrapper.properties @@ -1,6 +1,6 @@ -#Wed Feb 26 10:22:42 CET 2020 +#Mon Oct 05 15:58:06 CEST 2020 distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-5.6.4-all.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-6.1.1-all.zip From f71f6f659ff1a792c689f01abdf4b1c1c88a83b1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 13:42:10 +0200 Subject: [PATCH 03/17] android: Set compile-/targetSdkVersion to 29 This will be mandatory for existing apps on Nov 2, 2020. --- src/frontends/android/app/build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/build.gradle b/src/frontends/android/app/build.gradle index 2e818421f..14469f427 100644 --- a/src/frontends/android/app/build.gradle +++ b/src/frontends/android/app/build.gradle @@ -1,12 +1,12 @@ apply plugin: 'com.android.application' android { - compileSdkVersion 28 + compileSdkVersion 29 defaultConfig { applicationId "org.strongswan.android" minSdkVersion 15 - targetSdkVersion 28 + targetSdkVersion 29 versionCode 72 versionName "2.3.0" } From ea303d3f5ae4a19e0a2fc9897ee7472ba742d54a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 13:43:40 +0200 Subject: [PATCH 04/17] android: Update dependencies --- src/frontends/android/app/build.gradle | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/frontends/android/app/build.gradle b/src/frontends/android/app/build.gradle index 14469f427..ccbf5f7c9 100644 --- a/src/frontends/android/app/build.gradle +++ b/src/frontends/android/app/build.gradle @@ -46,10 +46,10 @@ android { } dependencies { - implementation 'androidx.appcompat:appcompat:1.1.0' - implementation 'androidx.preference:preference:1.1.0' + implementation 'androidx.appcompat:appcompat:1.2.0' + implementation 'androidx.preference:preference:1.1.1' implementation 'androidx.legacy:legacy-support-v4:1.0.0' - implementation 'com.google.android.material:material:1.0.0' + implementation 'com.google.android.material:material:1.2.1' testImplementation 'junit:junit:4.12' testImplementation 'org.mockito:mockito-core:2.28.2' testImplementation 'org.powermock:powermock-core:2.0.2' From e106fce48379fb018b6f966e7973c7b3fc27c86b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 13:47:06 +0200 Subject: [PATCH 05/17] android: Consistently use PreferenceManager from AndroidX android.preference.PreferenceManager has been deprecated. The one from AndroidX was already in use in some places. --- .../java/org/strongswan/android/logic/CharonVpnService.java | 2 +- .../main/java/org/strongswan/android/ui/VpnTileService.java | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java index 3e4305845..5cf2fe5d3 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java @@ -35,7 +35,6 @@ import android.os.Bundle; import android.os.Handler; import android.os.IBinder; import android.os.ParcelFileDescriptor; -import android.preference.PreferenceManager; import android.security.KeyChain; import android.security.KeyChainException; import android.system.OsConstants; @@ -77,6 +76,7 @@ import java.util.SortedSet; import androidx.core.app.NotificationCompat; import androidx.core.content.ContextCompat; +import androidx.preference.PreferenceManager; public class CharonVpnService extends VpnService implements Runnable, VpnStateService.VpnStateListener { diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnTileService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnTileService.java index 6016ebfbb..df3c666f0 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnTileService.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnTileService.java @@ -25,7 +25,6 @@ import android.content.SharedPreferences; import android.graphics.drawable.Icon; import android.os.Build; import android.os.IBinder; -import android.preference.PreferenceManager; import android.service.quicksettings.Tile; import android.service.quicksettings.TileService; @@ -36,6 +35,8 @@ import org.strongswan.android.data.VpnType; import org.strongswan.android.logic.VpnStateService; import org.strongswan.android.utils.Constants; +import androidx.preference.PreferenceManager; + @TargetApi(Build.VERSION_CODES.N) public class VpnTileService extends TileService implements VpnStateService.VpnStateListener { From a7713372d3f351993ae5357e109c5087d450ca9f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 14:28:05 +0200 Subject: [PATCH 06/17] android: Replace deprecated getFragmentManager() in TNC-related Fragments --- .../main/java/org/strongswan/android/ui/ImcStateFragment.java | 4 ++-- .../android/ui/RemediationInstructionsFragment.java | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/ImcStateFragment.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/ImcStateFragment.java index fe8e770db..9178a1be9 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/ImcStateFragment.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/ImcStateFragment.java @@ -88,7 +88,7 @@ public class ImcStateFragment extends Fragment implements VpnStateListener context.bindService(new Intent(context, VpnStateService.class), mServiceConnection, Service.BIND_AUTO_CREATE); /* hide it initially */ - getFragmentManager().beginTransaction().hide(this).commit(); + getParentFragmentManager().beginTransaction().hide(this).commit(); } @Override @@ -192,7 +192,7 @@ public class ImcStateFragment extends Fragment implements VpnStateListener public void updateView() { - FragmentManager fm = getFragmentManager(); + FragmentManager fm = getParentFragmentManager(); if (fm == null) { return; diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/RemediationInstructionsFragment.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/RemediationInstructionsFragment.java index d00f561e0..636d88e16 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/RemediationInstructionsFragment.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/RemediationInstructionsFragment.java @@ -81,7 +81,7 @@ public class RemediationInstructionsFragment extends ListFragment { super.onStart(); - boolean two_pane = getFragmentManager().findFragmentById(R.id.remediation_instruction_fragment) != null; + boolean two_pane = getParentFragmentManager().findFragmentById(R.id.remediation_instruction_fragment) != null; if (two_pane) { /* two-pane layout, make list items selectable */ getListView().setChoiceMode(ListView.CHOICE_MODE_SINGLE); From 1c82e65cbed7fc66d6d2df970dd9c36d46a5da74 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 6 Oct 2020 15:08:39 +0200 Subject: [PATCH 07/17] android: Ignore deprecation warning for legacy code in NetworkManager --- .../java/org/strongswan/android/logic/NetworkManager.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/NetworkManager.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/NetworkManager.java index e283cd56d..ec7e80eef 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/NetworkManager.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/NetworkManager.java @@ -21,7 +21,6 @@ import android.content.Intent; import android.content.IntentFilter; import android.net.ConnectivityManager; import android.net.Network; -import android.net.NetworkInfo; import android.net.NetworkRequest; import android.os.Build; @@ -126,10 +125,12 @@ public class NetworkManager extends BroadcastReceiver implements Runnable } } + @SuppressWarnings("deprecation") public boolean isConnected() { + /* deprecated since API level 29 */ ConnectivityManager cm = (ConnectivityManager)mContext.getSystemService(Context.CONNECTIVITY_SERVICE); - NetworkInfo info = null; + android.net.NetworkInfo info = null; if (cm != null) { info = cm.getActiveNetworkInfo(); From 217d8ab81e8590bc88b66d92c3bd9e437e335131 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 8 Oct 2020 16:42:37 +0200 Subject: [PATCH 08/17] android: Fix port scanning IMC Since 9e88bb987d65 ("Subscribed Scanner IMC/IMV to IETF_FIREWALL PA subtype") the port filter attribute is requested with a different message type. --- .../app/src/main/jni/libandroidbridge/byod/imc_android.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/byod/imc_android.c b/src/frontends/android/app/src/main/jni/libandroidbridge/byod/imc_android.c index 262026537..d639460f9 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/byod/imc_android.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/byod/imc_android.c @@ -53,7 +53,7 @@ static const char imc_name[] = "Android"; static pen_type_t msg_types[] = { { PEN_IETF, PA_SUBTYPE_IETF_OPERATING_SYSTEM }, - { PEN_IETF, PA_SUBTYPE_IETF_VPN }, + { PEN_IETF, PA_SUBTYPE_IETF_FIREWALL }, { PEN_TCG, PA_SUBTYPE_TCG_PTS }, }; From 294c022faeed257b05d40ef41d3d532cdc5ff617 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 4 Feb 2016 11:27:48 +0100 Subject: [PATCH 09/17] android: Add ability to lookup IPv6 source addresses --- .../main/jni/libandroidbridge/charonservice.c | 1 + .../jni/libandroidbridge/kernel/android_net.c | 48 +++++++++++++++++-- 2 files changed, 44 insertions(+), 5 deletions(-) diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c index bb8bdba82..6426e4502 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c @@ -545,6 +545,7 @@ static void charonservice_init(JNIEnv *env, jobject service, jobject builder, PLUGIN_PROVIDE(CUSTOM, "kernel-ipsec"), PLUGIN_CALLBACK(kernel_net_register, kernel_android_net_create), PLUGIN_PROVIDE(CUSTOM, "kernel-net"), + PLUGIN_DEPENDS(CUSTOM, "socket"), PLUGIN_CALLBACK(charonservice_register, NULL), PLUGIN_PROVIDE(CUSTOM, "android-backend"), PLUGIN_DEPENDS(CUSTOM, "libcharon"), diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/kernel/android_net.c b/src/frontends/android/app/src/main/jni/libandroidbridge/kernel/android_net.c index cc6072244..6423df167 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/kernel/android_net.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/kernel/android_net.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012-2015 Tobias Brunner + * Copyright (C) 2012-2016 Tobias Brunner * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -58,10 +58,15 @@ struct private_android_net_t { linked_list_t *vips; /** - * Socket used to determine source address + * Socket used to determine source address (IPv4) */ int socket_v4; + /** + * Socket used to determine source address (IPv6) + */ + int socket_v6; + /** * Whether the device is currently connected */ @@ -116,10 +121,24 @@ METHOD(kernel_net_t, get_source_addr, host_t*, socklen_t addrlen; timeval_t now; job_t *job; + int socket; + if (dest->get_family(dest) == AF_INET) + { + socket = this->socket_v4; + } + else + { + socket = this->socket_v6; + } + if (socket < 0) + { + DBG1(DBG_KNL, "unable to determine src address for address family"); + return NULL; + } addrlen = *dest->get_sockaddr_len(dest); addr.sockaddr.sa_family = AF_UNSPEC; - if (connect(this->socket_v4, &addr.sockaddr, addrlen) < 0) + if (connect(socket, &addr.sockaddr, addrlen) < 0) { DBG1(DBG_KNL, "failed to disconnect socket: %s", strerror(errno)); return NULL; @@ -129,7 +148,7 @@ METHOD(kernel_net_t, get_source_addr, host_t*, * at all */ charonservice->bypass_socket(charonservice, -1, 0); } - if (connect(this->socket_v4, dest->get_sockaddr(dest), addrlen) < 0) + if (connect(socket, dest->get_sockaddr(dest), addrlen) < 0) { /* don't report an error if we are not connected (ENETUNREACH) */ if (errno != ENETUNREACH) @@ -159,7 +178,7 @@ METHOD(kernel_net_t, get_source_addr, host_t*, } return NULL; } - if (getsockname(this->socket_v4, &addr.sockaddr, &addrlen) < 0) + if (getsockname(socket, &addr.sockaddr, &addrlen) < 0) { DBG1(DBG_KNL, "failed to determine src address: %s", strerror(errno)); return NULL; @@ -276,6 +295,7 @@ METHOD(kernel_net_t, destroy, void, this->mutex->destroy(this->mutex); this->vips->destroy(this->vips); close(this->socket_v4); + close(this->socket_v6); free(this); } @@ -314,6 +334,24 @@ kernel_net_t *kernel_android_net_create() } charonservice->bypass_socket(charonservice, this->socket_v4, AF_INET); + switch (charon->socket->supported_families(charon->socket)) + { + case SOCKET_FAMILY_IPV6: + case SOCKET_FAMILY_BOTH: + this->socket_v6 = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); + if (this->socket_v6 < 0) + { + DBG1(DBG_KNL, "failed to create socket to lookup IPv6 src " + "addresses: %s", strerror(errno)); + } + charonservice->bypass_socket(charonservice, this->socket_v6, + AF_INET6); + break; + default: + this->socket_v6 = -1; + break; + } + this->mutex->lock(this->mutex); this->network_manager->add_connectivity_cb( this->network_manager, (void*)connectivity_cb, this); From 0bc826c2f286ba84626e33a43058e12064a0ceeb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Oct 2020 11:39:40 +0200 Subject: [PATCH 10/17] android: IPV6_PKTINFO is supported (i.e. struct in6_pktinfo is available) --- src/frontends/android/app/src/main/jni/Android.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/src/frontends/android/app/src/main/jni/Android.mk b/src/frontends/android/app/src/main/jni/Android.mk index b7f5ed8ad..54c4bb947 100644 --- a/src/frontends/android/app/src/main/jni/Android.mk +++ b/src/frontends/android/app/src/main/jni/Android.mk @@ -48,6 +48,7 @@ strongswan_CFLAGS := \ -DHAVE_IPSEC_MODE_BEET \ -DHAVE_IPSEC_DIR_FWD \ -DHAVE_IN6ADDR_ANY \ + -DHAVE_IN6_PKTINFO \ -DHAVE_NETINET_IP6_H \ -DCONFIG_H_INCLUDED \ -DMONOLITHIC \ From 35819143878ff1d315001153a6eb504efbb38e9d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 15 Oct 2020 17:28:46 +0200 Subject: [PATCH 11/17] android: Add flag to enable IPv6 transport addresses --- .../java/org/strongswan/android/data/VpnProfile.java | 1 + .../strongswan/android/logic/CharonVpnService.java | 6 ++++-- .../jni/libandroidbridge/backend/android_service.c | 2 +- .../src/main/jni/libandroidbridge/charonservice.c | 12 ++++++------ 4 files changed, 12 insertions(+), 9 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java index eb863867d..1f077529d 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfile.java @@ -36,6 +36,7 @@ public class VpnProfile implements Cloneable public static final int FLAGS_DISABLE_OCSP = 1 << 2; public static final int FLAGS_STRICT_REVOCATION = 1 << 3; public static final int FLAGS_RSA_PSS = 1 << 4; + public static final int FLAGS_IPv6_TRANSPORT = 1 << 5; private String mName, mGateway, mUsername, mPassword, mCertificate, mUserCertificate; private String mRemoteId, mLocalId, mExcludedSubnets, mIncludedSubnets, mSelectedApps; diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java index 5cf2fe5d3..da6ea6374 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java @@ -288,7 +288,8 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe SimpleFetcher.enable(); addNotification(); mBuilderAdapter.setProfile(mCurrentProfile); - if (initializeCharon(mBuilderAdapter, mLogFile, mAppDir, mCurrentProfile.getVpnType().has(VpnTypeFeature.BYOD))) + if (initializeCharon(mBuilderAdapter, mLogFile, mAppDir, mCurrentProfile.getVpnType().has(VpnTypeFeature.BYOD), + (mCurrentProfile.getFlags() & VpnProfile.FLAGS_IPv6_TRANSPORT) != 0)) { Log.i(TAG, "charon started"); @@ -775,9 +776,10 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe * @param logfile absolute path to the logfile * @param appdir absolute path to the data directory of the app * @param byod enable BYOD features + * @param ipv6 enable IPv6 transport * @return TRUE if initialization was successful */ - public native boolean initializeCharon(BuilderAdapter builder, String logfile, String appdir, boolean byod); + public native boolean initializeCharon(BuilderAdapter builder, String logfile, String appdir, boolean byod, boolean ipv6); /** * Deinitialize charon, provided by libandroidbridge.so diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c index ba7a10ddb..c1c1e3acd 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c @@ -744,7 +744,7 @@ static job_requeue_t initiate(private_android_service_t *this) auth_cfg_t *auth; ike_cfg_create_t ike = { .version = IKEV2, - .local = "0.0.0.0", + .local = "", .local_port = charon->socket->get_port(charon->socket, FALSE), .force_encap = TRUE, .fragmentation = FRAGMENTATION_YES, diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c index 6426e4502..16e31d84d 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.c @@ -479,7 +479,7 @@ static bool charonservice_register(plugin_t *plugin, plugin_feature_t *feature, /** * Set strongswan.conf options */ -static void set_options(char *logfile) +static void set_options(char *logfile, jboolean ipv6) { lib->settings->set_int(lib->settings, "charon.plugins.android_log.loglevel", ANDROID_DEBUG_LEVEL); @@ -516,10 +516,10 @@ static void set_options(char *logfile) * information */ lib->settings->set_bool(lib->settings, "charon.plugins.socket-default.set_source", FALSE); - /* the Linux kernel does currently not support UDP encaspulation for IPv6 - * so lets disable IPv6 for now to avoid issues with dual-stack gateways */ + /* the Linux kernel only supports UDP encap for IPv6 since 5.8, so let's use + * IPv6 only if requested, to avoid issues with older dual-stack servers */ lib->settings->set_bool(lib->settings, - "charon.plugins.socket-default.use_ipv6", FALSE); + "charon.plugins.socket-default.use_ipv6", ipv6); #ifdef USE_BYOD lib->settings->set_str(lib->settings, @@ -634,7 +634,7 @@ static void __attribute__ ((constructor))register_logger() * Initialize charon and the libraries via JNI */ JNI_METHOD(CharonVpnService, initializeCharon, jboolean, - jobject builder, jstring jlogfile, jstring jappdir, jboolean byod) + jobject builder, jstring jlogfile, jstring jappdir, jboolean byod, jboolean ipv6) { struct sigaction action; struct utsname utsname; @@ -656,7 +656,7 @@ JNI_METHOD(CharonVpnService, initializeCharon, jboolean, /* set options before initializing other libraries that might read them */ logfile = androidjni_convert_jstring(env, jlogfile); - set_options(logfile); + set_options(logfile, ipv6); free(logfile); if (!libipsec_init()) From 7d100951239db057cedc72ba8e6aa51145895064 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 15 Oct 2020 17:49:53 +0200 Subject: [PATCH 12/17] android: Import IPv6 transport flag --- .../strongswan/android/ui/VpnProfileImportActivity.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java index 33b396629..a9c8b56de 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileImportActivity.java @@ -1,5 +1,5 @@ /* - * Copyright (C) 2016-2019 Tobias Brunner + * Copyright (C) 2016-2020 Tobias Brunner * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -528,6 +528,11 @@ public class VpnProfileImportActivity extends AppCompatActivity profile.setDnsServers(getAddressList(obj, "dns-servers")); profile.setMTU(getInteger(obj, "mtu", Constants.MTU_MIN, Constants.MTU_MAX)); profile.setNATKeepAlive(getInteger(obj, "nat-keepalive", Constants.NAT_KEEPALIVE_MIN, Constants.NAT_KEEPALIVE_MAX)); + if (obj.optBoolean("ipv6-transport", false)) + { + flags |= VpnProfile.FLAGS_IPv6_TRANSPORT; + } + JSONObject split = obj.optJSONObject("split-tunneling"); if (split != null) { From 21476a8d91c3bbb3f824921e0910b6ae118f88cd Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 15 Oct 2020 18:00:09 +0200 Subject: [PATCH 13/17] android: Make IPv6 transport flag configurable in the GUI --- .../android/ui/VpnProfileDetailActivity.java | 6 +++++- .../src/main/res/layout/profile_detail_view.xml | 17 +++++++++++++++++ .../app/src/main/res/values-de/strings.xml | 2 ++ .../app/src/main/res/values-pl/strings.xml | 2 ++ .../app/src/main/res/values-ru/strings.xml | 2 ++ .../app/src/main/res/values-ua/strings.xml | 2 ++ .../app/src/main/res/values-zh-rCN/strings.xml | 2 ++ .../app/src/main/res/values-zh-rTW/strings.xml | 2 ++ .../android/app/src/main/res/values/strings.xml | 4 +++- 9 files changed, 37 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java index fac9b34ea..5373c4095 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012-2019 Tobias Brunner + * Copyright (C) 2012-2020 Tobias Brunner * Copyright (C) 2012 Giuliano Grassi * Copyright (C) 2012 Ralf Sager * HSR Hochschule fuer Technik Rapperswil @@ -124,6 +124,7 @@ public class VpnProfileDetailActivity extends AppCompatActivity private Switch mUseOcsp; private Switch mStrictRevocation; private Switch mRsaPss; + private Switch mIPv6Transport; private EditText mNATKeepalive; private TextInputLayoutHelper mNATKeepaliveWrap; private EditText mIncludedSubnets; @@ -194,6 +195,7 @@ public class VpnProfileDetailActivity extends AppCompatActivity mUseOcsp = findViewById(R.id.use_ocsp); mStrictRevocation= findViewById(R.id.strict_revocation); mRsaPss= findViewById(R.id.rsa_pss); + mIPv6Transport= findViewById(R.id.ipv6_transport); mIncludedSubnets = (EditText)findViewById(R.id.included_subnets); mIncludedSubnetsWrap = (TextInputLayoutHelper)findViewById(R.id.included_subnets_wrap); mExcludedSubnets = (EditText)findViewById(R.id.excluded_subnets); @@ -712,6 +714,7 @@ public class VpnProfileDetailActivity extends AppCompatActivity flags |= !mUseOcsp.isChecked() ? VpnProfile.FLAGS_DISABLE_OCSP : 0; flags |= mStrictRevocation.isChecked() ? VpnProfile.FLAGS_STRICT_REVOCATION : 0; flags |= mRsaPss.isChecked() ? VpnProfile.FLAGS_RSA_PSS : 0; + flags |= mIPv6Transport.isChecked() ? VpnProfile.FLAGS_IPv6_TRANSPORT : 0; mProfile.setFlags(flags); mProfile.setIncludedSubnets(getString(mIncludedSubnets)); mProfile.setExcludedSubnets(getString(mExcludedSubnets)); @@ -782,6 +785,7 @@ public class VpnProfileDetailActivity extends AppCompatActivity mUseOcsp.setChecked(flags == null || (flags & VpnProfile.FLAGS_DISABLE_OCSP) == 0); mStrictRevocation.setChecked(flags != null && (flags & VpnProfile.FLAGS_STRICT_REVOCATION) != 0); mRsaPss.setChecked(flags != null && (flags & VpnProfile.FLAGS_RSA_PSS) != 0); + mIPv6Transport.setChecked(flags != null && (flags & VpnProfile.FLAGS_IPv6_TRANSPORT) != 0); /* check if the user selected a user certificate previously */ useralias = savedInstanceState == null ? useralias : savedInstanceState.getString(VpnProfileDataSource.KEY_USER_CERTIFICATE); diff --git a/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml b/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml index acab0b2f1..d5935b42c 100644 --- a/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml +++ b/src/frontends/android/app/src/main/res/layout/profile_detail_view.xml @@ -365,6 +365,23 @@ android:textSize="12sp" android:text="@string/profile_rsa_pss_hint" /> + + + + Im strikten Modus schlägt die Authentisierung nicht nur dann fehl, wenn das Server-Zertifikat gesperrt wurde, sondern auch wenn der Status des Zertifikats unbekannt ist (z.B. weil OCSP fehl schlug und keine gültige CRL verfügbar war). RSA/PSS Signaturen verwenden Verwendet das stärkere PSS Encoding anstatt des klassischen PKCS#1 Encoding für RSA Signaturen. Die Authentisierung wird fehlschlagen, wenn der Server solche Signaturen nicht unterstützt. + IPv6 Transport-Adressen verwenden + Verwende IPv6 für die äusseren Transport-Adressen, falls verfügbar. Dies kann nur aktiviert werden, wenn der Server UDP Encapsulation für IPv6 unterstützt. Zu beachten ist, dass dies beim Linux Kernel erst seit Version 5.8 der Fall ist und somit viele Server noch keine Unterstützung bieten. Split-Tunneling Standardmässig leitet der Client allen Netzwerkverkehr durch den VPN Tunnel, ausser der Server schränkt die Subnetze beim Verbindungsaufbau ein, in welchem Fall nur der Verkehr via VPN geleitet wird, den der Server erlaubt (der Rest wird standardmässig behandelt, als ob kein VPN vorhanden wäre). Blockiere IPv4 Verkehr der nicht für das VPN bestimmt ist diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml index 7e4327fed..791ee1380 100644 --- a/src/frontends/android/app/src/main/res/values-pl/strings.xml +++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml @@ -105,6 +105,8 @@ In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. + Use IPv6 transport addresses + Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. Split tunneling By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). Block IPv4 traffic not destined for the VPN diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml index 6b23723b4..e4421bf16 100644 --- a/src/frontends/android/app/src/main/res/values-ru/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml @@ -102,6 +102,8 @@ In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. + Use IPv6 transport addresses + Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. Split tunneling By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). Block IPv4 traffic not destined for the VPN diff --git a/src/frontends/android/app/src/main/res/values-ua/strings.xml b/src/frontends/android/app/src/main/res/values-ua/strings.xml index 7f414e524..5a6e3aa61 100644 --- a/src/frontends/android/app/src/main/res/values-ua/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ua/strings.xml @@ -103,6 +103,8 @@ In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. + Use IPv6 transport addresses + Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. Split tunneling By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). Block IPv4 traffic not destined for the VPN diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml index 75a3bef33..efb27552a 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml @@ -102,6 +102,8 @@ In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. + Use IPv6 transport addresses + Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. 拆分隧道 By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). 屏蔽不通过VPN的IPV4流量 diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml index 28e4e5ae1..ba04ad43f 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml @@ -102,6 +102,8 @@ In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. + Use IPv6 transport addresses + Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. 拆分隧道 By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). 屏蔽不通过VPN的IPV4流量 diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml index b72aad9c6..3d01d4f7c 100644 --- a/src/frontends/android/app/src/main/res/values/strings.xml +++ b/src/frontends/android/app/src/main/res/values/strings.xml @@ -1,6 +1,6 @@