aboutsummaryrefslogtreecommitdiffstats
path: root/src/frontends/android/jni
Commit message (Collapse)AuthorAgeFilesLines
* android: Migrate to the Gradle build systemTobias Brunner2015-11-1230-5948/+0
| | | | | This uses a manual way to trigger the NDK build (the default with on-the-fly Android.mk files does not work for us).
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-101-3/+4
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* android: Keep NDK API level at 19Tobias Brunner2015-07-281-0/+1
| | | | | | The headers/libraries changed a lot with level 21 so that our app won't run on devices with Android < 5 when built against it. We currently don't need any new native APIs so that should be fine.
* android: Retrigger a roam event if reportedly connected but no source ↵Tobias Brunner2015-07-281-2/+35
| | | | | | | | | | | | | | | | | | address found In dual-stack environments the IPv6 connectivity (via autoconfiguration) might be established before the IPv4 connectivity (via DHCP). It seems Android triggers the CONNECTIVITY_ACTION broadcast already when the first family is fully configured. At that time we might not be able to find an IPv4 source address. And since Android does not trigger the broadcast again if IPv4 connectivity is established, the connection is broken afterwards. So we store the connectivity state and if we are reportedly connected but still find no source address we trigger a roam event to recheck for an IPv4 address. This will cause regular rechecks if a device enters an IPv6-only network, but I guess that's rare (otherwise we could limit the number of rechecks done between connectivity changes).
* android: Add method to check for connectivity to NetworkManagerTobias Brunner2015-07-282-3/+33
|
* android: Fix kernel-net implementation on Android 4.3 and earlierTobias Brunner2015-07-282-0/+36
| | | | | | | | | | Before fwmarks were used protected sockets were bound to the outbound interface via SO_BINDTODEVICE. This does not always seem to work well together with our connect()/getsockname() trick if the server is covered by the traffic selectors. Calling protect() again after disconnecting the socket seems to help, but if there is no connectivity at all we still get the virtual IP back (maybe protect() does not bind the socket to any interface then).
* android: Add a custom kernel-net implementation to replace kernel-netlinkTobias Brunner2015-07-284-48/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When roaming from a mobile network to WiFi on Android 5.x the event received via ConnectivityManager is triggered before the mobile connection is fully torn down (i.e. before the interface is disabled and the routes disappear). So for strongSwan the current path still seems valid and since no roam event is triggered later the daemon never switches to WiFi and the connection is broken afterwards. A possible solution to this is enabling roam events in the kernel-netlink plugin. That would trigger an event when the device is finally disconnected from the mobile network. However, this could actually take a some time, during which traffic continues to be sent via mobile network instead of WiFi. That's because Android now uses multiple routing tables, routing rules and fwmarks to direct traffic to the appropriate interface/table, but in our plugin we don't have the information available that would allow us to make the switch to a different network/routing table earlier (and we actually prefer the current path if it is still valid). Additionally, the plugin produces quite a bit more events than ConnectivityManager (which was one of the reasons to use the latter in the first place). This custom kernel-net implementation is now specifically tailored for Android. Roam events are still triggered via ConnectivityManager but the source address is determined via connect()/getsockname() on a VPN excluded UDP socket, which does use the correct routing table as intended by Android. That way the daemon immediately sees a different source IP when connectivity changes even if the device is connected to multiple networks concurrently.
* android: Manually load libraries with dlopen() and RTLD_GLOBAL on Android MTobias Brunner2015-07-281-1/+38
| | | | | | | | | | | | | | | | | This fixes an issue when using the Android M preview. Bionic's dynamic linker was changed so that symbols in libraries loaded with RTLD_LOCAL were not found anymore in dlsym(RTLD_DEFAULT, ...). This is the case for libraries loaded with System.loadLibrary(), therefore, the plugin loader in libstrongswan was not able to resolve any symbols defined in other libraries loaded later. While this seems to have been broken unintentionally for existing apps (fix at [1]), it will again be a problem whenever we decide to increase targetSdkVersion beyond 22 (or until that fix makes it into the system/emulator images). Unfortunately, the dynamic loader in releases prior to Android 4.3 can't load libandroidbridge without also loading its dependencies. [1] https://github.com/android/platform_bionic/commit/1913352c6b
* android: Apply configured server portTobias Brunner2015-07-281-1/+4
|
* android: Apply configured MTUTobias Brunner2015-07-283-7/+21
| | | | | | While it is stored as property of individual profiles it is really a global setting because we currently don't support more than one connection.
* android: Set preferred language for remediation instructionsTobias Brunner2015-07-281-0/+4
|
* android: Encode connection settings as single Java string argumentTobias Brunner2015-07-283-72/+45
| | | | This makes adding new configuration settings easier.
* android: Enable charon.initiator_only optionTobias Brunner2015-07-281-0/+2
|
* libipsec: Pass separate inbound/update flags to the IPsec SA managerMartin Willi2015-03-091-2/+3
| | | | | Similar to other kernel interfaces, the libipsec backends uses the flag for different purposes, and therefore should get separate flags.
* attribute-handler: Pass full IKE_SA to handler backendsMartin Willi2015-02-201-4/+3
|
* attributes: Move the configuration attributes framework to libcharonMartin Willi2015-02-201-4/+4
|
* ike: Consistently log CHILD_SAs with their unique_id instead of their reqidMartin Willi2015-02-201-1/+1
|
* ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqidMartin Willi2015-02-201-2/+1
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-201-3/+3
|
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-1/+1
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()Martin Willi2015-02-201-2/+1
|
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-2/+2
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()Martin Willi2015-02-191-1/+1
|
* android: Build binaries for MIPSTobias Brunner2014-11-061-1/+1
|
* android: Increase fragment sizeTobias Brunner2014-11-061-0/+3
| | | | We use the same value we use as MTU on TUN devices.
* android: Enable IKEv2 fragmentationTobias Brunner2014-11-061-1/+1
|
* android: Use %any as AAA identity, but disable EAP-only authenticationTobias Brunner2014-11-061-5/+3
| | | | | | | Without verification of the identity we can't prevent a malicious user with a valid certificate from impersonating the AAA server and thus the VPN gateway. So unless we make the AAA identity configurable we have to prevent EAP-only authentication.
* android: Add support for signature schemes used by EAP-TLSTobias Brunner2014-11-061-19/+34
|
* android: Allow enumeration of untrusted certificatesTobias Brunner2014-11-061-1/+1
|
* android: Handle EAP-TLS in Android serviceTobias Brunner2014-11-061-6/+19
|
* android: Enable EAP-TLS plugin in the appTobias Brunner2014-11-061-1/+1
|
* android: Fix PA-TNC construction based on data passed via JNITobias Brunner2014-10-151-3/+2
|
* android: Implement get_contracts() method in IMC state objectTobias Brunner2014-10-141-0/+14
|
* android: Update receive_message() to new imc_msg_t.receive() signatureTobias Brunner2014-10-131-2/+4
|
* android: Remove references to libptsTobias Brunner2014-10-133-8/+2
|
* plugin-loader: Support a reload() callback for static featuresMartin Willi2014-09-221-2/+2
|
* android: Reduce CHILD_SA lifetimeTobias Brunner2014-09-121-2/+2
|
* android: Add DH groups to ESP proposalsTobias Brunner2014-09-121-2/+12
|
* android: Reestablish IKE_SA if CHILD_SA rekeying failedTobias Brunner2014-09-121-3/+36
|
* android: Report error if CHILD_SA rekeying failsTobias Brunner2014-09-121-0/+6
|
* android: Add support for querying use stats of a CHILD_SATobias Brunner2014-09-091-1/+2
|
* dns-proxy: Don't use proxy socket if we fail to bypass itTobias Brunner2014-07-301-0/+2
| | | | | | | | | This will result in an infinite loop as packets sent over that socket will again pass through the TUN device and the DNS proxy. Apparently, bypassing fails when airplane mode is enabled. Fixes #662.
* android: For keyingtries > 0 notify the GUI if the limit is reached when ↵Tobias Brunner2014-07-221-0/+17
| | | | | | | | | | reestablishing The IKE_SA is destroyed anyway, so letting the GUI remain in "connecting" state would be incorrect. We still use keyingtries=0 for now, though. And we still abort after the first failed attempt initially, in case there is a configuration error.
* android: Terminate IKE_SA if initial IKE_SA_INIT failsTobias Brunner2014-07-221-1/+23
| | | | | | | | | | Since VpnStateService.disconnect() is now not called until the error dialog is dismissed the daemon would continue to try connecting. So while the error dialog is shown the connection might actually be successfully established in the background, which is not intended. This way the IKE_SA is destroyed right after sending the IKE_SA_INIT of the second connection attempt (due to keyingtries=0).
* android: Only allow DNS queries for the configured hostnameTobias Brunner2014-07-221-0/+2
|
* android: Add optional filter functionality to DNS proxyTobias Brunner2014-07-222-3/+119
| | | | | If specified only queries for a list of allowed host names will be proxied.
* android: Recreate the TUN device without DNS when reestablishing IKE_SAsTobias Brunner2014-07-221-0/+38
| | | | | This enables DNS resolution while reestablishing if the VPN gateway pushed DNS servers to the client that are only reachable via VPN.
* android: Add method to BuilderAdapter to re-establish without DNS-related dataTobias Brunner2014-07-222-5/+27
| | | | | | Non-DNS data is cached in the BuilderAdapter so the TUN device can be recreated easily (since the CHILD_SA is gone we couldn't actually gather that information).
* android: Use DNS proxy when reestablishing IKE_SAsTobias Brunner2014-07-221-4/+44
|
* bus: Add ike_reestablish_pre hook, called before DNS resolutionTobias Brunner2014-07-221-4/+5
| | | | | The old hook is renamed to ike_reestablish_post and is now also called when the initiation of the new IKE_SA failed.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-28 19:14:16 +0000