81bace09a4
android: Fix import of certificate request flag
2018-07-03 11:31:40 +02:00
a706058118
android: Add flags to control CRL/OCSP fetching and strict revocation
2018-07-03 11:31:40 +02:00
3eda52f039
android: Use activity when reconnecting without (or a possibly wrong) password
2018-07-03 11:31:40 +02:00
5bdb800abf
android: Use startForegroundService() to start VpnService
...
This gives us some time to call startForeground() so we don't get
terminated.
2018-07-03 11:31:40 +02:00
fe1f143277
android: Install a blocking TUN device until the VPN is established
...
It's reinstalled when reconnecting (or during error recovery) and
eventually uninstalled after disconnecting.
Only on Android 5+, otherwise we'd block our fetcher (and Android 4.4 is
stupid in regards to overlapping TUN devices anyway).
Note that Android 8's blocking feature blocks everything that passes by
the VPN, so this only works when tunneling everything (i.e. neither subnets,
nor apps can be excluded from the VPN if that feature is enabled).
2018-07-03 11:31:39 +02:00
99cc2d82d4
android: Exclude our own app from the VPN
...
Otherwise, a blocking VPN interface would prevent our fetcher from working
as we currently rely on an interface that doesn't allow access to the
underlying socket/FD, which would be required to call VpnService.protect().
2018-07-03 11:31:39 +02:00
fb3772ec95
android: Log retries to the same log file
...
It's cleared when a new connection is started or there is a manual
retry.
2018-07-03 11:31:39 +02:00
1350ee1ec7
android: Use capped exponential backoff for automatic retries
2018-07-03 11:31:39 +02:00
2ec6ad71d3
android: Show countdown and retry button in notification
2018-07-03 11:31:39 +02:00
0d9dd4b150
android: Avoid IllegalStateException in state fragments
...
This happened if the state service got connected while such a fragment was
not visible (anymore or at all).
2018-07-03 11:31:38 +02:00
bc52868173
android: Don't hide the notification if we are connecting to a profile
...
In particular, if we are reconnecting after an error.
2018-07-03 11:31:38 +02:00
68afdd3464
android: Add an automatic reconnect on errors
...
This way the connection will be attempted to be kept up even on "fatal"
errors like authentication failures.
2018-07-03 11:31:38 +02:00
f23b107857
android: Show a retry button in the error banner
...
The button to view the log is now below the status info. And since the
IMC results are just below that we don't need a special handling for
that anymore.
2018-07-03 11:31:38 +02:00
063230c27b
android: Add function to quickly reconnect the current profile
2018-07-03 11:31:37 +02:00
ab5dbbc4ab
android: Show an error if client certificate is unavailable
...
This can happen on systems (e.g. Android 7.x) where Always-on VPNs are
triggered right after booting before the KeyChain is unlocked by the user.
Retrieving the certificate chain or private key then fails with
"KeyChainException: IllegalStateException: keystore is LOCKED" until the
user unlocks the screen once.
The built-in client actually also fails in this situation (e.g. with XAuth
RSA), it tries three times then stops and shows an error notification.
2018-07-03 11:31:37 +02:00
f0b3e303c4
android: Show an error if a profile without a password is initiated
...
This could happen if an incomplete profile is used with Always-on VPN.
2018-07-03 11:31:37 +02:00
e145a5e66d
android: Use modern shortcuts on Android 8+
2018-07-03 11:31:37 +02:00
5b6a0a3f9e
android: Add an adaptive launcher icon
...
Using <inset> in a mipmap folder apparently is not fully valid, at least
Android Studio complains about it (it seems to work fine, though).
2018-07-03 11:31:36 +02:00
a7d679ff1b
android: Show the actual error description in the notification
2018-07-03 11:31:36 +02:00
c353734f47
android: Change format for error strings
...
Place the dot in the main message not the descriptions of the individual
errors.
2018-07-03 11:31:36 +02:00
4dbe7ffa3e
android: Collapse Quick Settings drawer if password entry is required
2018-07-03 11:31:36 +02:00
56f599560c
android: Initiate configured default profile when triggered as Always-on VPN
...
With Android 8.1 this isn't triggered after a reboot until the device
has been unlocked once (solving the issue with the key store) and traffic
may optionally be blocked by the user until the VPN is established.
There are still some issues (e.g. password prompts and fatal errors), and we
might need some workaround for older Android releases.
2018-07-03 11:31:36 +02:00
d56f1bf832
android: Just reconnect if the tile is clicked even if there was an error
...
A long press click on the tile (or a click on the notification) will open
the main activity if more information about the error are necessary.
2018-07-03 11:31:35 +02:00
be89310784
android: Allow reconnecting without confirmation in case of an error
2018-07-03 11:31:35 +02:00
6987ddb313
android: Show connection errors as banner, not as modal dialog
2018-07-03 11:31:35 +02:00
64b7a6d622
android: Add Quick Settings tile to toggle VPN state
...
Only if there is no currently active (or previously active) profile does
this currently operate on the configured (or stored most recently used)
profile. This way it's possible to use a different connection and
quickly disable and re-enable it again. When unlocked the profile name
is shown, when locked a generic text is used (this detection doesn't seem
to work 100% reliably). To disconnect, the user is forced to unlock the
device, connecting is possible without, if the credentials are available
and no fatal error occurs (it even works with the system credential store,
at least on Android 8.1).
Note that the tile is not available right after a reboot. It seems that
the system has to be unlocked once to activate third-party tiles (will
be interesting to see how this works together with Always-on VPN).
2018-07-03 11:31:35 +02:00
08c79d5112
android: Store the ID of the most recently used profile as preference
2018-07-03 11:31:35 +02:00
acdac14818
android: Add settings activity and default profile selection
...
The default profile can then be used for a Quick Settings tile or the
Always-on VPN feature.
2018-07-03 11:31:34 +02:00
6e73a939a9
android: Reset error state after user confirmed it
...
This allows other listeners to change their display.
2018-07-03 11:31:34 +02:00
52aaffdeb4
android: Use specific icon when connecting to the VPN
2018-07-03 11:31:34 +02:00
70d6a0cf33
android: Use a handler to show/remove notification from main UI thread
...
This avoids races that were previously seen (e.g. when disconnecting
while connecting, which sometimes showed a "Disconnecting..."
notification).
2018-07-03 11:31:34 +02:00
58d139dad3
android: Use separate activity to control VPN connections
...
This way we don't have to open the main window, but only show a dialog
if necessary (or nothing in many cases).
2018-07-03 11:31:34 +02:00
1d336cc2ae
android: Migrate onAttach() from deprecated version
2018-07-03 11:31:33 +02:00
4671f023c3
android: Make certificate import activity properly transparent
2018-07-03 11:31:33 +02:00
d390d97da4
android: Remove deprecated progress indicator in MainActivity
...
Support for this was already removed with API level 21. On modern
devices loading CA certs should be quick enough anyway.
2018-07-03 11:31:33 +02:00
ed9d5a314c
android: Replace deprecated ProgressDialog during profile import
2018-07-03 11:31:33 +02:00
6ca0b46c20
android: Add notification channel for API level 26+
...
Unfortunately, setLockscreenVisibility() doesn't seem to have any
effect. So the full notification is shown unless the user manually
configures the notification settings.
2018-07-03 11:31:33 +02:00
71f4a20aa1
android: Show profile ID at bottom of advanced settings
...
Can be selected and copied to the clipboard to use in automation
software that doesn't support the shortcut.
2018-07-03 11:31:32 +02:00
93033728a9
android: Accept a profile's UUID when initiating
2018-07-03 11:31:32 +02:00
581f4326d5
android: Add additional Intent filter for import Activity with MIME type mask
...
Chrome creates such an Intent when opening downloaded files (not when
directly opening them), a MIME type is set, but apparently not ours.
2018-07-03 11:31:32 +02:00
93489acc0d
android: UUID is now mandatory
...
Unless there are profiles created with old versions of the app (< 1.8.0)
that were never updated since, all profiles should already have a UUID
assigned. If not, we do that now with a DB migration.
2018-07-03 11:31:32 +02:00
0917caa195
android: Show an error dialog if we can't get permission for VPNs
...
This is either because a third-party VPN app has the always-on feature
enabled, or because the user denied the permission in the system's confirmation
dialog.
If the always-on feature is enabled for a connection of the built-in VPN
client we get an IllegalStateException, for which we show an updated and
clearer error message.
2018-07-03 11:31:32 +02:00
08601c58e9
android: Suppress self-assign warnings with clang
...
These are triggered by the little endian functions in byteorder.h.
2018-07-03 11:31:31 +02:00
929badfefd
android: Build native libraries for all non-deprecated ABIs
...
armeabi has been superseded by armeabi-v7a and the MIPS ABIs were removed
with the latest NDK (r17), after being marked deprecated for a while.
By not specifying APP_ABI we build for all non-deprecated ABIs.
2018-07-03 11:31:31 +02:00
1b67166921
Unify format of HSR copyright statements
2018-05-23 16:32:53 +02:00
7b72909774
controller: Add option to force destruction of an IKE_SA
...
It's optionally possible to wait for a timeout to destroy the SA.
2018-05-22 10:06:07 +02:00
2db6d5b8b3
Fixed some typos, courtesy of codespell
2018-02-13 12:19:54 +01:00
6bafa2d346
android: Always send the client certificate
...
In scenarios where the server accepts client certificates from dozens or
even hundreds of CAs it might be necessary to omit certificate request
payloads from the IKE_SA_INIT response to avoid fragmentation.
As it is rarely the case in road-warrior scenarios that the server
already has the client certificate installed it should not be a problem
to always send it.
2018-02-08 12:15:36 +01:00
0729be1bfe
Merge branch 'android-proposals'
...
Makes IKE and ESP proposals configurable.
2017-11-28 16:23:41 +01:00
4a79434b11
android: Remove modp1024 from the ESP proposals
2017-11-28 16:19:08 +01:00
b03713add4
android: Validate proposal strings when importing profiles
2017-11-17 18:11:43 +01:00
9f962f6c19
android: Validate proposal strings in the GUI
2017-11-17 18:11:43 +01:00
836a943804
android: Add utility JNI function to validate proposal strings
2017-11-17 18:11:39 +01:00
92c1b52487
android: Load JNI libraries in Application class
...
This way they are also loaded when we don't use CharonVpnService.
2017-11-17 18:05:35 +01:00
2d1f65feb3
android: Make IKE/ESP proposals configurable in the GUI
2017-11-17 18:05:35 +01:00
6403ad5457
android: Import IKE/ESP proposals
...
We currently don't validate them here, only when used later will they
get parsed (which includes some checks).
2017-11-17 14:31:06 +01:00
a7c43544dd
android: Use optional custom proposals for IKE and ESP
...
If the proposal is invalid we fall back to the defaults.
2017-11-17 14:31:06 +01:00
24c22a3fa8
android: Add properties for IKE and ESP proposals
2017-11-17 14:31:06 +01:00
8b6c23342c
android: Free settings string passed via JNI
2017-11-17 14:31:06 +01:00
72b7c0ffd8
android: Add support for creating RSASSA-PSS signatures via JNI
2017-11-08 16:48:10 +01:00
de280c2e03
private-key: Add optional parameters argument to sign() method
2017-11-08 16:48:10 +01:00
1fe71a50f1
android: Add log message if failed to retrieve user certificate encoding
2017-11-02 12:19:36 +01:00
66b7a08884
android: Ignore IllegalArgumentException for multicast addresses
...
Some Android versions seem to reject routes that use multicast addresses.
Fixes #2420 .
2017-09-18 11:00:58 +02:00
1926efadde
android: Add disconnect button to dialog if already connected to profile
2017-09-04 10:41:30 +02:00
037b353d2c
android: Load x509 plugin to generate OCSP requests and parse responses
...
BoringSSL does not support OpenSSL's OCSP API.
2017-09-04 10:41:29 +02:00
829cc56a53
android: Add support to POST data via SimpleFetcher
...
That's required for OCSP verification.
2017-09-04 10:41:29 +02:00
6e39240a3e
android: Add option to clear cached CRLs
2017-09-04 10:41:29 +02:00
0bebbae9e3
android: Cache CRLs in app directory
...
Fixes #2405 .
2017-09-04 10:41:25 +02:00
3fe9a436ee
android: Pass absolute path to the app's data directory via JNI
2017-09-04 10:41:25 +02:00
98ab757284
android: Hide app selection in profile editor on Android < 5
2017-09-04 10:41:25 +02:00
0b4f7d646b
android: Only apply app filter on Android 5 and newer
2017-09-04 10:41:24 +02:00
ac3189f792
android: Catch OutOfMemoryError when importing profiles
...
Not sure if this is actually caused because e.g. the file is too large
or due to some encoding issue.
2017-09-04 10:41:24 +02:00
1a9261a923
android: Catch NullPointerException when parsing invalid certificates
2017-09-04 10:41:24 +02:00
e59b78254a
android: Catch NullPointerException when calling VpnService.prepare()
...
According to the Play Console this occurs occasionally.
2017-09-04 10:41:24 +02:00
ca280574ba
Fixed some typos, courtesy of codespell
2017-08-07 17:22:01 +02:00
ccb6e9f1b0
android: Fix database update from older versions
2017-07-04 11:55:04 +02:00
a63b0f9982
android: Fix version string on older Android releases
...
SECURITY_PATCH is apparently only available since Android 6.
2017-07-04 11:54:57 +02:00
ebf369c483
android: Fix null pointer dereference with existing profiles
2017-07-03 13:43:53 +02:00
64c2d3ca3e
android: Only show disconnect button if actually connected
2017-07-03 12:11:30 +02:00
6333a756ee
android: Close activity when dialog is canceled if it was not visible before
...
onPause/onResume() won't work because onPause() is called right before
onNewIntent().
2017-07-03 10:39:26 +02:00
1265b353d4
android: Allow disconnecting via MainActivity but display a confirmation dialog
2017-07-03 10:39:26 +02:00
d0ed8ee89e
android: Add disconnect button to notification
2017-07-03 10:39:23 +02:00
8ae7f8b7a2
android: Make sending certificate requests configurable in the GUI
2017-07-03 10:37:09 +02:00
11eb7e0898
android: Import the flag to suppress certificate requests
2017-07-03 10:37:09 +02:00
3f0592d0fd
android: Add flag to suppress sending certificate requests
2017-07-03 10:37:09 +02:00
0204374e21
android: Add property for simple flags
2017-07-03 10:37:09 +02:00
aa4b6eda59
android: Import NAT-T keepalive interval
2017-07-03 10:33:29 +02:00
a2aa0ca0e4
android: Make NAT-T keepalive interval configurable in the GUI
2017-07-03 10:33:29 +02:00
db599d6b28
android: Use configured NAT-T keepalive interval
2017-07-03 10:33:29 +02:00
a28302317f
android: Add property for NAT-T keepalive interval
2017-07-03 10:33:29 +02:00
0b075420df
android: Use arrays as primary config option for subnets in profile files
2017-07-03 10:27:55 +02:00
646260f464
android: Change format of address ranges and print sets
2017-07-03 10:27:55 +02:00
291ef58c69
android: Make app handling and selection of apps configurable in profile editor
2017-07-03 10:27:54 +02:00
3cc6a03fa0
android: Add simple activity for the selection of apps
2017-07-03 10:27:54 +02:00
eb59c6a38a
android: Add list fragment for the selection of apps
2017-07-03 10:27:54 +02:00
208e15c0ba
android: Add filterable adapter for list of installed/selected apps
2017-07-03 10:27:54 +02:00
238c3061b7
android: Add list item layout for installed/selected apps
2017-07-03 10:27:54 +02:00
5561633fcd
android: Add class that wraps ApplicationInfo for selected apps
2017-07-03 10:27:54 +02:00
cea8213f1b
android: Handle checked state in activated background
2017-07-03 10:27:54 +02:00
34496b787d
android: Add text color for checkable list entries
2017-07-03 10:27:53 +02:00
0974addf93
android: Add a linear layout that is checkable
2017-07-03 10:27:53 +02:00
800f881ad0
android: Add convenience methods to get/set selected apps to/from a sorted set
2017-07-03 10:27:53 +02:00
d134ae21c2
android: Import selected/excluded apps from profile file
2017-07-03 10:27:53 +02:00
f2e7156d91
android: Apply selected apps according to config
...
Either only the selected apps are able to access the VPN or they are
excluded from access to the VPN.
2017-07-03 10:27:53 +02:00
43b33f075a
android: Add property for selected apps to VPN profiles
...
A second property will control if only the selected apps have access to
the VPN or if the selected apps are excluded from the VPN, or if the
functionality is disabled.
2017-07-03 10:27:53 +02:00
05c5e894a9
android: Make custom subnets configurable in the GUI
2017-07-03 10:27:53 +02:00
4a04bd3da5
android: Import custom subnets from profile file
2017-07-03 10:27:53 +02:00
4471a93481
android: Use configured included subnets instead of negotiated TS
2017-07-03 10:27:52 +02:00
abf02a2176
android: Add ability to add a range set to another
2017-07-03 10:27:52 +02:00
a9875259e8
android: Add property for included subnets to VPN profiles
2017-07-03 10:27:52 +02:00
1a63e8e44e
android: Make excluded subnets configurable in the GUI
2017-07-03 10:27:52 +02:00
70f7eb76d9
android: Import excluded subnets from profile file
2017-07-03 10:27:52 +02:00
72b7c289ad
android: Exclude configured subnets from the VPN
2017-07-03 10:27:52 +02:00
1e26483167
android: Implement Iterable interface and addAll() for range set
2017-07-03 10:27:52 +02:00
54714331e4
android: Add ability to remove a range set from another
2017-07-03 10:27:51 +02:00
78b20efb29
android: Parse two addresses separated by - as range
2017-07-03 10:27:51 +02:00
13ead876ad
android: Add property for excluded subnets to VPN profiles
2017-07-03 10:27:51 +02:00
d852a02717
android: Add class to manage a set of IP address ranges/subnets
2017-07-03 10:27:51 +02:00
bcba14504a
android: Add class to handle IP ranges and subnets
2017-07-03 10:27:51 +02:00
c5ba381757
android: Log some information about the Android version and the device
2017-07-03 10:27:51 +02:00
e5ec18009f
android: Escape backslashes in settings values
...
For usernames that use domain specifiers.
2017-07-03 10:27:51 +02:00
59693d6c56
android: Use a specific action to disconnect from the VPN
2017-07-03 10:27:50 +02:00
bef8bc3aac
android: Try to load existing user cert when importing VPN profile
2017-07-03 10:27:50 +02:00
36e8f43617
android: Enable revocation plugin
2017-07-03 10:27:50 +02:00
7b4177578b
android: Add a simple HTTP(S) fetcher for CRLs
2017-07-03 10:27:50 +02:00
74d44e15dc
android: Make log view more efficient
...
This bunches several log messages together before posting Runnables.
Fixes #2148 .
2017-07-03 10:27:45 +02:00
9c4607b454
android: Don't update state fragment if not attached to an Activity
...
When the bound state service finally connects we might not actually be
attached to an Activity.
2017-06-30 09:32:27 +02:00
b14507dd90
android: Make sure every listener at the VPN state service is only registered once
...
We register when the service connects but also in onStart() (as we
unregister in onStop() to avoid updates when not shown). So this could
theoretically cause the listener to get registered twice if the service
is connected before onStart() is called (it seems it usually isn't).
2017-06-30 09:32:27 +02:00
6766c85231
android: Add menu item to import VPN profile via Storage Access Framework
...
This is useful in case the proper MIME type was not set for a downloaded
profile.
2017-06-30 09:32:27 +02:00
edad60ea77
android: Add translation for Traditional Chinese
...
Courtesy of Chris Chiang.
2017-06-30 09:32:27 +02:00
61098dd6a3
android: Move Simplified Chinese translation to values-zg-rCN folder
2017-06-30 09:32:26 +02:00
2e4d110d1e
linked-list: Change return value of find_first() and signature of its callback
...
This avoids the unportable five pointer hack.
2017-05-26 13:56:44 +02:00
8a2e4d4a8b
linked-list: Change interface of callback for invoke_function()
...
This avoids the unportable five pointer hack.
2017-05-26 13:56:44 +02:00
95a63bf281
Migrate all enumerators to venumerate() interface change
2017-05-26 13:56:44 +02:00
94375d46dc
android: Send network change events from a separate thread via JNI
...
Doing this from the main UI thread (which delivers the broadcast) might
cause an ANR if there is a delay (e.g. while acquiring a mutex in the
native parts). There might also have been a race condition during
termination previously because Unregister() was not synchronized so there
might have been dangling events that got delivered while or after the mutex
in the native parts was destroyed.
2017-02-17 13:07:30 +01:00
ad882e1a43
android: Add translation for Simplified Chinese
...
Courtesy of Yick Xie.
2017-02-07 15:59:07 +01:00
9665686bd8
daemon: Use separate method to set default loggers
...
This way it is not necessary to pass the same values to reload the
loggers.
2017-01-25 14:58:09 +01:00
66bf2b788c
android: Handle profile file names with dots in them
2017-01-20 11:44:17 +01:00
9c79af8c38
android: Handle errors when fetching profile in more detail
2017-01-20 11:44:16 +01:00
3107634e30
android: Add activity to import VPN profiles from JSON-encoded files
...
The file format is documented on the wiki.
URLs to .sswan files may be intercepted and downloaded files with a media
type of application/vnd.strongswan.profile may also be opened (the file
extension doesn't matter in that case). Whether downloaded files for which
the media type is not correct but the extension is .sswan can be opened
depends on the app that issues the Intent. For instance, from the default
Downloads app it won't work due to the content:// URLs that do not contain
the file name but when opening the downloaded file from within Chrome's
Downloads view it works as these Intents use file:// URLs, which contain
the complete file name (the latter requires a new permission).
2017-01-20 11:44:07 +01:00
cf6110f152
android: Use a local broadcast to notify about profile changes
...
This allows other components to modify the profiles and notify about
changes.
2017-01-20 11:01:32 +01:00
c4ab9af74e
android: Add a UUID property to the VPN profiles
...
All new or edited profiles get a random UUID. We currently don't
enforce one, though. Later we might change that and use the UUID as
primary key.
2017-01-20 11:01:32 +01:00
9920824e70
android: Make sure libtpmtss is loaded on older systems
...
On newer Android systems this seems to happen automatically (or does at
least not cause crashes if the library is not loaded).
2016-12-09 11:16:42 +01:00
3e85b5a492
android: Ensure that the certificates are loaded when accessing them via JNI
2016-12-08 17:14:49 +01:00
85059424a7
android: Add a public notification
2016-12-08 17:14:49 +01:00
d5070425a0
android: Display a permanent notification while connected
...
This forces the service to run in the foreground, meaning the system
won't kill it when low on memory.
2016-12-08 17:14:49 +01:00
e03c936982
android: Log any installed DNS servers
2016-12-08 17:14:49 +01:00
d6d12bab14
android: Unregister listener in case of error alerts
...
This avoids triggering additional errors via e.g. ike_updown() that
might cause the error message displayed in the GUI to change if the
status fragment is recreated.
References #2134 .
2016-12-08 17:13:16 +01:00
ef2ad9db1c
android: Report an error for invalid integer values
...
Previously we'd just ignore the invalid values without notifying the
user.
2016-12-08 16:43:51 +01:00
cefbf2bf9b
android: Propose curve25519 in the ESP proposals
2016-12-08 16:43:51 +01:00
Tobias Brunner