From c7307ccc521a8d0f66c5332d2b26fee3155eba6e Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Thu, 5 Jun 2025 16:13:45 +0200
Subject: [PATCH] android: Allow setting proxy settings in managed profiles

---
 .../android/data/ManagedVpnProfile.java       |  8 +++++
 .../android/data/VpnProfileDataSource.java    |  1 +
 .../strings_managed_configuration.xml         |  9 ++++++
 .../strings_managed_configuration.xml         |  9 ++++++
 .../strings_managed_configuration.xml         |  9 ++++++
 .../strings_managed_configuration.xml         |  9 ++++++
 .../strings_managed_configuration.xml         |  9 ++++++
 .../strings_managed_configuration.xml         |  9 ++++++
 .../values/strings_managed_configuration.xml  | 10 +++++++
 .../main/res/xml/managed_configuration.xml    | 30 +++++++++++++++++++
 10 files changed, 103 insertions(+)

diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/ManagedVpnProfile.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/ManagedVpnProfile.java
index 30943aa6b..47e85a5ca 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/ManagedVpnProfile.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/ManagedVpnProfile.java
@@ -83,6 +83,14 @@ public class ManagedVpnProfile extends VpnProfile
 			setIncludedSubnets(getString(splitTunneling, VpnProfileDataSource.KEY_INCLUDED_SUBNETS));
 		}
 
+		final Bundle proxyServer = bundle.getBundle(VpnProfileDataSource.KEY_PROXY_SERVER);
+		if (proxyServer != null)
+		{
+			setProxyHost(getString(proxyServer, VpnProfileDataSource.KEY_PROXY_HOST));
+			setProxyPort(getInt(proxyServer, VpnProfileDataSource.KEY_PROXY_PORT, 1, 65_535));
+			setProxyExclusions(getString(proxyServer, VpnProfileDataSource.KEY_PROXY_EXCLUSIONS));
+		}
+
 		setSplitTunneling(splitFlags);
 		setFlags(flags);
 	}
diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java
index 541d2eb9a..b5289337c 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileDataSource.java
@@ -50,6 +50,7 @@ public interface VpnProfileDataSource
 	String KEY_IKE_PROPOSAL = "ike_proposal";
 	String KEY_ESP_PROPOSAL = "esp_proposal";
 	String KEY_DNS_SERVERS = "dns_servers";
+	String KEY_PROXY_SERVER = "proxy_server";
 	String KEY_PROXY_HOST = "proxy_host";
 	String KEY_PROXY_PORT = "proxy_port";
 	String KEY_PROXY_EXCLUSIONS = "proxy_exclusions";
diff --git a/src/frontends/android/app/src/main/res/values-de/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-de/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-de/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-de/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values-pl/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-pl/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-pl/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-pl/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values-ru/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-ru/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-ru/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-ru/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values-uk/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-uk/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-uk/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-uk/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings_managed_configuration.xml
index 74e59cfe7..c7d516011 100644
--- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings_managed_configuration.xml
@@ -108,4 +108,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/values/strings_managed_configuration.xml b/src/frontends/android/app/src/main/res/values/strings_managed_configuration.xml
index 74e59cfe7..04922033d 100644
--- a/src/frontends/android/app/src/main/res/values/strings_managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/values/strings_managed_configuration.xml
@@ -1,5 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
+    Copyright (C) 2025 Tobias Brunner
     Copyright (C) 2023 Relution GmbH
 
     Copyright (C) secunet Security Networks AG
@@ -108,4 +109,13 @@
     <string name="managed_config_split_tunneling_block_ipv6_title">@string/profile_split_tunnelingv6_title</string>
     <string name="managed_config_split_tunneling_block_ipv6_description">Specifies whether to block IPv6 traffic that\'s not destined for the VPN. Forces all IPv6 traffic via VPN (traffic that does not match the negotiated traffic selector is then just dropped). Thus this is basically equivalent to including ::/0 in subnets</string>
 
+    <!-- Managed configuration, VPN profile, proxy server -->
+    <string name="managed_config_proxy_server_bundle_title">@string/profile_proxy_server_label</string>
+    <string name="managed_config_proxy_server_bundle_description">@string/profile_proxy_server_intro</string>
+    <string name="managed_config_proxy_host_title">@string/profile_proxy_host_label</string>
+    <string name="managed_config_proxy_host_description">@string/profile_proxy_host_hint</string>
+    <string name="managed_config_proxy_port_title">@string/profile_proxy_port_label</string>
+    <string name="managed_config_proxy_port_description">@string/profile_proxy_port_hint</string>
+    <string name="managed_config_proxy_exclusions_title">@string/profile_proxy_exclusions_label</string>
+    <string name="managed_config_proxy_exclusions_description">@string/profile_proxy_exclusions_hint</string>
 </resources>
diff --git a/src/frontends/android/app/src/main/res/xml/managed_configuration.xml b/src/frontends/android/app/src/main/res/xml/managed_configuration.xml
index e86ad721e..8c2a70eb8 100644
--- a/src/frontends/android/app/src/main/res/xml/managed_configuration.xml
+++ b/src/frontends/android/app/src/main/res/xml/managed_configuration.xml
@@ -1,5 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
+    Copyright (C) 2025 Tobias Brunner
     Copyright (C) 2023 Relution GmbH
 
     Copyright (C) secunet Security Networks AG
@@ -305,6 +306,35 @@
 
             </restriction>
 
+            <restriction
+                android:description="@string/managed_config_proxy_server_bundle_description"
+                android:key="proxy_server"
+                android:restrictionType="bundle"
+                android:title="@string/managed_config_proxy_server_bundle_title">
+
+                <restriction
+                    android:defaultValue=""
+                    android:description="@string/managed_config_proxy_host_description"
+                    android:key="proxy_host"
+                    android:restrictionType="string"
+                    android:title="@string/managed_config_proxy_host_title" />
+
+                <restriction
+                    android:defaultValue="-1"
+                    android:description="@string/managed_config_proxy_port_description"
+                    android:key="proxy_port"
+                    android:restrictionType="integer"
+                    android:title="@string/managed_config_proxy_port_description" />
+
+                <restriction
+                    android:defaultValue=""
+                    android:description="@string/managed_config_proxy_exclusions_description"
+                    android:key="proxy_exclusions"
+                    android:restrictionType="string"
+                    android:title="@string/managed_config_proxy_exclusions_title" />
+
+            </restriction>
+
         </restriction>
     </restriction>
 </restrictions>