denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,974 Commits 1 Branch 0 Tags
06afb5f109df3f1aee7351dc9df1ee49c0c8a1cb
Commit Graph
18974 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen 06afb5f109 cert-enroll: add init.d support to cert-install-sssd 2024-03-03 17:12:48 +01:00
Tobias Brunner f994e0a428 utils: Define ignore_result() so it requires a semicolon 
It previously also added its own empty statement.
 2024-02-29 16:02:28 +01:00
Tobias Brunner 6dee8587f0 Remove obvious empty statements (i.e. stray semicolons) 2024-02-29 15:30:40 +01:00
Tobias Brunner 9d1f325a77 github: Update GitHub-provided actions for Node.js update 2024-02-29 09:06:59 +01:00
Tobias Brunner a380dc4989 utils: Define DESTROY_*_IF() macros without terminating semicolon 
This avoids double semicolons (i.e. empty statements) and is how
DESTROY_IF() is already defined.
 2024-02-29 09:06:43 +01:00
Tobias Brunner b21178b43c android: New release after adding fix for existing shortcuts/Intents 2024-02-26 11:14:14 +01:00
Tobias Brunner 45371da846 android: Add fallback for the old name of the profile ID extra 
This fixes existing shortcuts and automation via Intents.

Fixes: 8e3b921abe ("android: Always use UUID to access profiles")
 2024-02-26 11:01:55 +01:00
Tobias Brunner 1f5aa8017f Revert "kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windows" 
This reverts commit 8b9b11919d.

Since ESN was negotiated via proposal, just configuring the SA without
ESN won't work as the ICV will be incorrect if the peer enabled ESN
on its SA.  While the Linux kernel currently doesn't support disabling
replay protection for SAs that use ESN, this at least gets users an
explicit error not just dropped packets, and it will automatically work
if the kernel supports this combination at some point.

References strongswan/strongswan#2117
 2024-02-23 18:00:32 +01:00
Andreas Steffen f566a85fcf Version bump to 5.9.14dr1 2024-02-22 15:51:24 +01:00
Tobias Brunner b7fdc10a3c Use Botan 3.3.0 for tests 2024-02-22 13:49:46 +01:00
Tobias Brunner 4be75c5ab1 Merge branch 'android-managed-configurations' 
This adds support for managed configurations via enterprise mobility
management (EMM) systems. Also changes details regarding the SQL data
source.
 2024-02-22 13:37:01 +01:00
Tobias Brunner 7db629e4bc android: New release after adding support for managed configurations 2024-02-21 12:24:53 +01:00
Tobias Brunner 51a5d96b36 android: Add translations for managed configuration strings 
Not actually translating anything, but making the linter happy.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 8c6b3019a7 android: Update managed certificates if config changes 2024-02-21 12:24:53 +01:00
Markus Pfeiffer b0ba845e27 android: Add manager for managed user certificates 
This can be used to install, replace or delete currently installed user
certificates based on the app's current managed configuration.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer aa06d75491 android: Add manager for managed trusted certificates 
This is used to install, replace or delete currently installed trusted
certificates based on the app's current managed configuration.

Certificates that are shared between multiple profiles are protected
and not uninstalled if a profile that uses it remains.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 9cb23f650a android: Add utility class to determine differences in two lists of objects 
This allows determining the difference between two lists in the form of
inserts, updates and deletes (and unchanged elements).
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 97cb35afe5 android: Add repository for managed user certificates 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 99dfa8cb0e android: Add repository for managed trusted certificates 2024-02-21 12:24:53 +01:00
Markus Pfeiffer a04798a796 android: Add base repository for installed managed certificates 2024-02-21 12:24:53 +01:00
Markus Pfeiffer cd67c30fd1 android: Add installer for managed user certificates/keys 
This installs the configured user certificate into Android's key store
using the DevicePolicyManager.

This is only accessible if the app is installed on an enrolled device and
has been granted the CERT_INSTALL delegate scope.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer fb302d967c android: Add installer for managed trusted certificates 
This installs a configured CA or server certificate into the app's local
key store.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer e2f505350e android: Add database migration for managed certificates 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 6882f17741 android: Add trusted and user certificates to ManagedVpnProfile 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 9cbc03e84f android: Add entities for CA/server and user certificates 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 22bce57e4c android: Add utility that parses a PKCS#12 container and extracts a KeyPair 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 4ac9fc327e android: Add utility that converts a Base64 string to a X509Certificate 2024-02-21 12:24:53 +01:00
Markus Pfeiffer afcb56400e android: Add utility class that pairs a certificate with a private key 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 8a50651212 android: Add password for client certificate to managed config 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 9a917252e2 android: Provide global database helper instance 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 861ac0109a android: Extend database helper with table definition 
This simplifies database migration.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 802047cae8 android: Move database helper into separate class 
Reduce strong coupling between database helper and VPN profiles, to
prepare for the addition of other tables.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 42626c1dd8 android: Hide unmanaged profiles by default 
Such profiles could exist if a user already had strongSwan installed.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 0af501ef26 android: Disable access to settings depending on managed configuration 2024-02-21 12:24:53 +01:00
Markus Pfeiffer fe13782e3c android: Hide menu items depending on managed configuration 
Hide and disable menu items when disabled by the managed configuration.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 4bfeb3b000 android: Add data source for managed VPN profiles 
Include the managed VPN profile data source in the profile source,
to show profiles from both sources in the UI.
 2024-02-21 12:24:53 +01:00
Tobias Brunner 8f04d15dfd android: Expose static instance for Application object 
While it seems to be possible to cast Context.getApplicationContext()
to the application class, there really is no documented reason why that
should actually be the same object.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 36f62585bb android: Expose managed configuration globally and notify listeners on changes 
Triggers a broadcast if the configuration changed and updates the
profile list accordingly (previously only handled removal of multiple
profiles).

If the app resumes, the configuration is also loaded and listeners are
notified in case the config was updated while the app was in the
background.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 8796e9bb31 android: Add ManagedConfigurationService and related classes 
Add service that provides access to managed configurations.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer c2007d5b09 android: Add managed_configuration.xml 
Add managed configuration and associated English strings.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 01ea7b92bd android: Make VpnType#fromIdentifier null-safe 2024-02-21 12:24:53 +01:00
Markus Pfeiffer a5167a69e0 android: Add data source to VpnProfile 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 5f9f279a33 android: Show warning message for read-only profiles in detail view 
Show a message explaining that a managed profile can't be edited in
its detail view.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer c9c65a94c9 android: Add label to read-only profiles in list 
Show "Managed profile" in the list of VPN profiles, to make it
immediately obvious that a profile is managed/read-only.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer d3f5c3a760 android: Disable copy/delete for read-only profiles 
If a profile is marked as read-only, do not allow users to copy or
delete the profile.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 150dc5ab64 android: Make selected apps read-only 
Also prevent users from changing selected apps in read-only VPN profiles.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 3391f7a465 android: Prevent editing of read-only profiles 
Do not allow users to edit read-only VPN profiles, with the exception of
the profile's password.
 2024-02-21 12:24:53 +01:00
Markus Pfeiffer 9618c83c03 android: Add read-only flag to VpnProfile 2024-02-21 12:24:52 +01:00
Markus Pfeiffer 8e3b921abe android: Always use UUID to access profiles 
Use the UUID rather than the ID to ensure there are no conflicts between
profiles from the database and managed profiles.
 2024-02-21 12:24:52 +01:00
Markus Pfeiffer d629e1d358 android: Fix version number on port column 
The onUpgrade method creates this column for database version 6. Update
the DbColumn definition to match that version number.
 2024-02-21 12:24:52 +01:00