denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,639 Commits 1 Branch 0 Tags
1f6f501978a089c2e3ea3e679b56c86beb472316
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 1f6f501978 android: Enum added for VPN types 2012-08-27 15:33:58 +02:00
Tobias Brunner 8a9956762c android: Simplified handling of error dialog that is displayed if VpnService API is not supported 2012-08-27 10:48:13 +02:00
Tobias Brunner aa55040192 android: LoginDialog refactored so it also works when the device is rotated 2012-08-27 10:48:13 +02:00
Tobias Brunner e09f4120d4 android: Added a field to store selected user certificate 2012-08-27 10:48:13 +02:00
Tobias Brunner a21fac9a85 Log configured IKE_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner d2b4dff5dd Log configured CHILD_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner 1184493407 Fall back to local address as IKEv1 identity if nothing else is configured 2012-08-24 12:55:01 +02:00
Tobias Brunner 454fb91367 Removed deprecated options from ipsec.conf template 2012-08-24 11:52:01 +02:00
Tobias Brunner 20915d6fa7 Apply send delay before adding non-ESP marker 
Otherwise the packet header could not be parsed correctly when NAT-T is
used.
 2012-08-24 11:23:36 +02:00
Tobias Brunner 3570c43968 openssl: Fix registration of the PUBKEY builder 
libtls drops support for RSA suites if it does not find an RSA backend
(final builder for RSA public keys).
 2012-08-18 17:49:57 +02:00
Tobias Brunner ef73bb52b1 Without the ties to PAM we can build eap-gtc on Android 2012-08-17 14:24:48 +02:00
Tobias Brunner ba27bf2af0 CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin 2012-08-17 14:24:48 +02:00
Tobias Brunner 113d2a6b99 Removed manual EAP method registration in eap-gtc plugin 2012-08-17 14:24:37 +02:00
Tobias Brunner 91c0e0e3d9 Enable build of eap-tls, eap-ttls and eap-peap on Android 2012-08-17 13:55:44 +02:00
Tobias Brunner 7ab348370c Add a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr 
At least on Android the latter would be required.
 2012-08-17 11:47:52 +02:00
Tobias Brunner 21d8392041 starter: Restore original config in case also= is used (which reads the same values) 2012-08-16 16:45:11 +02:00
Tobias Brunner 31a0e24b0f Increased log level when listing interfaces and IP addresses during startup 
This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.
 2012-08-16 16:14:15 +02:00
Tobias Brunner 71b89d6722 Only load kernel plugins in starter when flushing SAD/SPD entries 
This avoids keeping the kernel sockets open when they are not actually
needed, which could lead to resource problems (in particular with PF_KEY
where all open sockets receive all messages).

Fixes #217.
 2012-08-16 16:14:15 +02:00
Tobias Brunner aaefeafb49 Enable UDP decapsulation for both address families 
Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).
 2012-08-16 15:26:37 +02:00
Tobias Brunner 11b514bff6 Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part 2012-08-16 10:03:49 +02:00
Tobias Brunner f0b8d8c2c4 New Android release after adding error dialog 
Skipped one version due to a rebasing mishap.
 2012-08-15 11:23:06 +02:00
Tobias Brunner 8df118f733 Show an error message if VPN is not supported 
Some devices have Android 4 installed but the system images still seem to
lack the components that are required for VPN support. One such
component is the dialog used to grant permission to create .
 2012-08-15 11:19:43 +02:00
Tobias Brunner c8d0c3b03d Enable search for certificate lists (via SearchView in ActionBar) 2012-08-14 12:01:41 +02:00
Tobias Brunner 4db2d6336e Added new UI to select a specific CA certificate 
With this change there is no need to wait for all certificates being loaded
anymore (this happens only when the user opens the selection activity).
 2012-08-14 12:01:41 +02:00
Tobias Brunner cb431e12da Don't try to save profile ID if there is none 2012-08-14 12:01:41 +02:00
Tobias Brunner 7546735fec List fragment for trusted certificates can notify listeners about clicks 2012-08-14 12:01:41 +02:00
Tobias Brunner b0b0eac6eb Added an activity that shows lists of CA certificates in two tabs 2012-08-14 12:01:41 +02:00
Tobias Brunner caf85c872f Added a ListFragment that lists trusted certificates (loaded via a custom Loader) 2012-08-14 12:01:41 +02:00
Tobias Brunner db8bea8311 Changed TrustedCertificateAdapter for use with ListViews and TrustedCertificateEntry 2012-08-14 12:01:41 +02:00
Tobias Brunner af46e950b1 Remove certificate spinner from edit view 2012-08-14 12:01:41 +02:00
Tobias Brunner f075536ebe Function to get only system-wide CA certificates added to TrustedCertificateManager 2012-08-14 12:01:40 +02:00
Tobias Brunner 2dc8998419 Added class to store trusted certificate entries for lists 2012-08-14 12:01:40 +02:00
Tobias Brunner 3a917ac77f Validate netmask in mem_pool_create 2012-08-13 13:54:28 +02:00
Tobias Brunner 305d98b780 Validate netmask in traffic_selector_create_from_subnet 
Fixes #216.
 2012-08-13 13:46:19 +02:00
Tobias Brunner 36a3981d47 Comment fixed 2012-08-13 13:17:53 +02:00
Tobias Brunner 09ae3d79ca Merge branch 'android-app' 
This branch introduces a userland IPsec implementation (libipsec) and an
Android App which targets the VpnService API that is provided by Android 4+.

The implementation is based on the bachelor thesis 'Userland IPsec for
Android 4' by Giuliano Grassi and Ralf Sager.
 2012-08-13 12:07:52 +02:00
Tobias Brunner efbb5e8c57 Ensure thread IDs always start with 1 even if the library is reused 
Within the Android App the library stays loaded in memory and is just
initialized/deinitialized with each connection, the static thread
counter would continuously increase without this patch.
 2012-08-13 11:28:08 +02:00
Tobias Brunner 1fcaa71291 Added a button to the error dialog that allows to view the log file 2012-08-13 11:28:08 +02:00
Tobias Brunner fbacc6506c Use major.minor.revision version numbers for Android application 2012-08-13 11:28:08 +02:00
Tobias Brunner 064f4f75c0 Only allow access to log file via explicitly created URIs 
Since ContentProviders are public and permissions don't seem to work any
other application could access the log file.  With this token system
only URIs we explicitly created can be accessed.
 2012-08-13 11:27:55 +02:00
Tobias Brunner 6c54c10838 Menu option added that allows users to send the log file 2012-08-13 11:22:21 +02:00
Tobias Brunner c3afe9d35b Add ContentProvider to access log file from other applications 2012-08-13 11:22:21 +02:00
Tobias Brunner ae10e8c458 Watch for changes to the log file so we can reopen it 
If the log fragment is shown while the daemon starts (which is not the
case at the moment, but maybe later on tablets) the file reader would not
notice that the file got truncated.  The same applies if the file is deleted
directly on the file system e.g. with adb shell.
 2012-08-13 11:22:21 +02:00
Tobias Brunner bad119c55a Add an Activity that shows the log fragment 2012-08-13 11:22:20 +02:00
Tobias Brunner f9a162a235 Add a fragment that can display charon's log file 
It continuously reads from the log file in a separate thread while displayed.
 2012-08-13 11:22:20 +02:00
Tobias Brunner 658ed96fce Added special ScrollView with auto-scrolling feature 
The ability to auto-scroll is disabled as soon as the user manually
scrolls around and re-enable when the user scrolls to the bottom.
 2012-08-13 11:22:20 +02:00
Tobias Brunner fe05f1f05c Charon logs to a file in the App's data directory 2012-08-13 11:22:20 +02:00
Tobias Brunner 4308ce1cf7 Moved Java to C string conversion function to android_jni header file 2012-08-13 11:22:20 +02:00
Tobias Brunner 6db742e7e5 Log charon version and uname() output, split libcharon and charon initialization 2012-08-13 11:22:20 +02:00
Tobias Brunner a7c8b166a1 Only call disconnect() from CharonVpnService if we are not already disconnecting 2012-08-13 11:22:20 +02:00
Tobias Brunner 496e096e7b Load single certificates directly from the KeyStore if we cannot get the read lock 
This helps when running in the emulator as loading the certificates
takes quite a while there.  This way a configured CA certificates is loaded
directly without having to wait for all certificates being cached.
 2012-08-13 11:22:19 +02:00
Tobias Brunner c0fe43f002 Use colors from the Android color palette for the VPN status texts 2012-08-13 11:22:14 +02:00
Tobias Brunner 374f62535f Localized title for contextual action bar 2012-08-13 11:18:52 +02:00
Tobias Brunner 05427857e2 German translation added 2012-08-13 11:18:52 +02:00
Tobias Brunner 9c0be3ac69 Show MainActiviy if the user clicks 'Configure' in Android's VPN dialog 2012-08-13 11:18:52 +02:00
Tobias Brunner bebe2d397e Keep reporting the error until the user dismisses it 
Even when the Activity is closed and later reopened.
 2012-08-13 11:18:52 +02:00
Tobias Brunner 264dd8d372 Show an error dialog when errors occur while establishing the VPN 2012-08-13 11:18:51 +02:00
Tobias Brunner 8062f973e1 Show a button to disconnect the VPN once it is established 2012-08-13 11:18:51 +02:00
Tobias Brunner a43bdf9a37 Show current VPN state and profile name 
Show modal dialogs while connecting and disconnecting the VPN.
 2012-08-13 11:18:51 +02:00
Tobias Brunner e7908526fd Add a fragment to MainActivity which will display the current VPN state 
The fragment is bound to the VpnStateService and registered as listener.
 2012-08-13 11:18:51 +02:00
Tobias Brunner 9d0f8a3a95 Use a separate (volatile) variable for certificate alias 
If a connection is started while certificates are still loading and the
initiation is then canceled a deadlock could result if the daemon is
trying to enumerate the certificates just then.
 2012-08-13 11:18:23 +02:00
Tobias Brunner a39a301a12 Don't set the source address on Android 2012-08-13 11:11:37 +02:00
Tobias Brunner 644db4d7c5 Close IKE_SA on Android immediately if setting up CHILD_SA fails 2012-08-13 11:11:20 +02:00
Tobias Brunner 76e55491eb Reduce number of retransmits on Android 2012-08-13 11:09:34 +02:00
Tobias Brunner 2483f6a4e0 Job added which handles plain text packets read from TUN device 2012-08-13 11:09:34 +02:00
Tobias Brunner d9531100fa Added a handler that writes inbound plain text packets to the TUN device 2012-08-13 11:09:34 +02:00
Tobias Brunner 3b3cf0c87a Add simple callbacks to receive/send ESP packets via libipsec/receiver. 2012-08-13 11:09:34 +02:00
Tobias Brunner 30ba2ff777 Add routes based on the installed IPsec policies to the TUN device builder 2012-08-13 11:09:34 +02:00
Tobias Brunner 62e6630b24 Add virtual IP to the TUN device builder 
After the CHILD_SA is established we can easily get this address from
the IKE_SA.
 2012-08-13 11:09:34 +02:00
Tobias Brunner a2993d7243 Create a TUN device via VpnService.Builder once the CHILD_SA is established 2012-08-13 11:09:34 +02:00
Tobias Brunner 3a05756b42 An Android specific attribute handler installs DNS servers via Builder 2012-08-13 11:09:33 +02:00
Tobias Brunner ae4f1ea180 Native counterpart of VpnService.Builder added, exposed by charonservice 2012-08-13 11:09:33 +02:00
Tobias Brunner 5215d512bf Adapter class added around VpnService.Builder which allows to access it via JNI 2012-08-13 11:00:29 +02:00
Tobias Brunner f12b3ad2c9 Don't print hosts as %any if %+H is used 
That is, the plus sign can be used in the format string to force a numeric
string representation of all host_t objects even 0.0.0.0 and :: which
would otherwise be printed as %any and %any6.
 2012-08-13 11:00:29 +02:00
Tobias Brunner 495e12aead Add support for '+' in custom format specifiers 2012-08-13 11:00:28 +02:00
Tobias Brunner c6c39c783b Initiate an SA via native JNI method 2012-08-13 11:00:28 +02:00
Tobias Brunner dffee9e2b0 Helper function added that retrieves a local IP address 2012-08-13 11:00:28 +02:00
Tobias Brunner 66211196a7 android_service_t handles initiation of an SA and tracks its progress 
Status updates are delivered via charonservice (JNI).
 2012-08-13 11:00:28 +02:00
Tobias Brunner 3aa5c609c3 Android specific credential set also provides user credentials 2012-08-13 11:00:28 +02:00
Tobias Brunner 8430e54d83 Added an Android specific credential set that provides CA certificates via JNI 2012-08-13 11:00:28 +02:00
Tobias Brunner 2bec193a1b CharonVpnService provides a function to get trusted certificates via JNI 2012-08-13 11:00:28 +02:00
Tobias Brunner 8c2af60ceb Function added that allows to update VPN state via JNI 2012-08-13 11:00:28 +02:00
Tobias Brunner 1b8877727c Add a function to disconnect any current VPN connection 2012-08-13 11:00:27 +02:00
Tobias Brunner d4f7675199 Implement kernel_ipsec_t.bypass_socket() via JNI and VpnService.protect() 2012-08-13 11:00:27 +02:00
Tobias Brunner 03de55ad98 CharonVpnService binds to VpnStateService and does basic state updates 2012-08-13 11:00:27 +02:00
Tobias Brunner a4f9028e08 CharonVpnService reacts on Intents and properly inits/deinits charon 
Charon is initialized with every new connection attempt and
deinitialized when the service is terminated or it receives an empty
Intent (or before starting a new connection).

A separate thread is used to handle the connection attempts, this thread
acts as main thread for charon.
 2012-08-13 11:00:27 +02:00
Tobias Brunner d1220566ef Service added that keeps track of VPN state and notifies listeners about changes 
It is ensured that listeners are notified only from the main thread.
 2012-08-13 11:00:27 +02:00
Tobias Brunner 175088517f Add an Android specific kernel_ipsec_t implementation 
This is pretty much a proxy class that delegates everything (that is
currently supported) to libipsec.
 2012-08-13 11:00:27 +02:00
Tobias Brunner 24447cf49f Add an Android specific kernel_net_t implementation 
This currently provides only no-ops and is just added because a
kernel-net implementation is required and kernel-netlink can't be used
at the moment.
 2012-08-13 11:00:27 +02:00
Tobias Brunner 6e04147743 Clone the current VPN profile before updating the password 
Storing the password on the original object would be problematic in case
the user mistypes the password (no prompt would be shown the second time).

An alternative would be to just return the ID of the selected profile
and then fetch it from the database.
 2012-08-13 11:00:26 +02:00
Tobias Brunner 8d4eea5325 Allow VpnProfile objects to be cloned 2012-08-13 11:00:26 +02:00
Tobias Brunner b1340aa129 Prompt the user for a password if none is configured in the VPN profile 2012-08-13 11:00:26 +02:00
Tobias Brunner fcb5448017 Allow selection of a CA certificate for a VPN profile 
This solution is just temporary as it really is not that user-friendly
to select CA certificates with a Spinner widget.
 2012-08-13 11:00:26 +02:00
Tobias Brunner 8db37772f5 Simplified asynchronous loading of CA certificates in MainActivity 2012-08-13 11:00:26 +02:00
Tobias Brunner b21979f12f Added simple adapter for trusted certificates (to be used with a Spinner widget) 2012-08-13 11:00:26 +02:00
Tobias Brunner 529c8c88a3 Keep a global reference to the CharonVpnService object in charonservice 2012-08-13 11:00:26 +02:00
Tobias Brunner a304874319 Add signal handler for fatal signals to libandroidbridge 2012-08-13 11:00:26 +02:00
Tobias Brunner d200749424 Set default log level in libandroidbridge 2012-08-13 11:00:25 +02:00
Tobias Brunner 6316b50280 Renamed main Activity (shorter name in Launcher) 2012-08-13 11:00:25 +02:00
Tobias Brunner 0b362ed837 MainActivity starts CharonVpnService if a VpnProfile is clicked in the list 
This is done by implementing the OnVpnProfileSelectedListener interface
provided by VpnProfileListFragment.
 2012-08-13 11:00:25 +02:00