335 lines
16 KiB
XML
335 lines
16 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
Copyright (C) 2012-2020 Tobias Brunner
|
|
Copyright (C) 2012 Giuliano Grassi
|
|
Copyright (C) 2012 Ralf Sager
|
|
|
|
Copyright (C) secunet Security Networks AG
|
|
|
|
This program is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU General Public License as published by the
|
|
Free Software Foundation; either version 2 of the License, or (at your
|
|
option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
|
|
This program is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
for more details.
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
xmlns:tools="http://schemas.android.com/tools">
|
|
|
|
<uses-permission android:name="android.permission.INTERNET" />
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
|
|
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
|
|
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
|
|
<!-- SSID is redacted in the background on Android 10+ without this. -->
|
|
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" />
|
|
<uses-permission android:name="android.permission.NEARBY_WIFI_DEVICES" />
|
|
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
|
|
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
|
|
<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
|
|
<!-- «Recent apps»: per-app traffic totals from the system network statistics;
|
|
granted by the user in Settings > Usage access, never requested silently -->
|
|
<uses-permission android:name="android.permission.PACKAGE_USAGE_STATS"
|
|
tools:ignore="ProtectedPermissions" />
|
|
<uses-permission android:name="android.permission.POST_PROMOTED_NOTIFICATIONS"/>
|
|
<!-- required to install downloaded updates of the app itself -->
|
|
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
|
|
<!-- lets the app install its own updates in the background without the
|
|
system confirmation dialog (Android 12+, same package/signature only) -->
|
|
<uses-permission android:name="android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION" />
|
|
<!-- required to claim update ownership (setRequestUpdateOwnership) so our
|
|
own updates keep being applied silently on Android 14+ -->
|
|
<uses-permission android:name="android.permission.ENFORCE_UPDATE_OWNERSHIP" />
|
|
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"
|
|
android:maxSdkVersion="32" />
|
|
<uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
|
|
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
|
|
<!-- Required to reliably schedule NAT keepalives/rekeyings via the AlarmManager.
|
|
On Android 13+ this special permission is denied by default, but it can be
|
|
granted by the user in system settings (Scheduler falls back to inexact
|
|
alarms while it is not granted). -->
|
|
<uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" />
|
|
<!-- necessary to allow users to select ex-/included apps and EAP-TNC -->
|
|
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"
|
|
tools:ignore="QueryAllPackagesPermission" />
|
|
|
|
<application
|
|
android:name=".logic.StrongSwanApplication"
|
|
android:icon="@mipmap/ic_launcher"
|
|
android:label="@string/app_name"
|
|
android:theme="@style/ApplicationTheme"
|
|
android:windowSoftInputMode="adjustResize"
|
|
android:networkSecurityConfig="@xml/network_security_config"
|
|
android:enableOnBackInvokedCallback="true"
|
|
android:allowBackup="false" >
|
|
<activity
|
|
android:name=".ui.MainActivity"
|
|
android:theme="@style/ShxSplashTheme"
|
|
android:label="@string/main_activity_name"
|
|
android:launchMode="singleTop"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.MAIN" />
|
|
<category android:name="android.intent.category.LAUNCHER" />
|
|
</intent-filter>
|
|
<intent-filter>
|
|
<action android:name="android.service.quicksettings.action.QS_TILE_PREFERENCES" />
|
|
</intent-filter>
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.StatsActivity"
|
|
android:exported="false" />
|
|
<activity
|
|
android:name=".ui.BatteryActivity"
|
|
android:exported="false" />
|
|
<activity
|
|
android:name=".ui.VpnProfileControlActivity"
|
|
android:theme="@style/TransparentActivity"
|
|
android:taskAffinity=""
|
|
android:excludeFromRecents="true"
|
|
android:launchMode="singleTask"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="one.shx.strongswan.ext.action.START_PROFILE" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
</intent-filter>
|
|
<intent-filter>
|
|
<action android:name="one.shx.strongswan.ext.action.DISCONNECT" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
</intent-filter>
|
|
<intent-filter>
|
|
<action android:name="one.shx.strongswan.ext.action.TOGGLE_VPN" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
</intent-filter>
|
|
<!-- deep links for automation tools: shxvpn://connect[?profile=<uuid>], shxvpn://disconnect, shxvpn://toggle -->
|
|
<intent-filter tools:ignore="AppLinkUrlError">
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:scheme="shxvpn" />
|
|
</intent-filter>
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.VpnProfileDetailActivity" >
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.TrustedCertificatesActivity"
|
|
android:label="@string/trusted_certs_title" >
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.LogActivity"
|
|
android:label="@string/log_title" >
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.SettingsActivity"
|
|
android:label="@string/pref_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.TrustedNetworksActivity"
|
|
android:label="@string/auto_connect_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.ConnectivityCheckActivity"
|
|
android:label="@string/health_check_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.RouteCheckActivity"
|
|
android:label="@string/route_check_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.InboxActivity"
|
|
android:label="@string/events_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.DiagnosticsActivity"
|
|
android:label="@string/diag_title">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.OnboardingActivity"
|
|
android:label="@string/app_name">
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.RemediationInstructionsActivity"
|
|
android:label="@string/remediation_instructions_title" >
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.VpnProfileSelectActivity"
|
|
android:label="@string/strongswan_shortcut"
|
|
android:icon="@mipmap/ic_shortcut"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.CREATE_SHORTCUT" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
</intent-filter>
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.VpnProfileImportActivity"
|
|
android:label="@string/profile_import"
|
|
android:theme="@style/TransparentActivity"
|
|
android:taskAffinity=""
|
|
android:excludeFromRecents="true"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:scheme="http" />
|
|
<data android:scheme="https" />
|
|
<data android:scheme="file" />
|
|
<data android:scheme="content" />
|
|
<data android:mimeType="application/vnd.strongswan.profile" />
|
|
</intent-filter>
|
|
<!-- this matches by file extension if no MIME type is provided -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:scheme="http" />
|
|
<data android:scheme="https" />
|
|
<data android:scheme="file" />
|
|
<data android:scheme="content" />
|
|
<data android:host="*" />
|
|
<data android:pathPattern=".*\\..*\\..*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\..*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\.sswan" />
|
|
</intent-filter>
|
|
<!-- this matches by file extension if any MIME type (but not ours) is provided -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:scheme="http" />
|
|
<data android:scheme="https" />
|
|
<data android:scheme="file" />
|
|
<data android:scheme="content" />
|
|
<data android:host="*" />
|
|
<data android:mimeType="*/*" />
|
|
<data android:pathPattern=".*\\..*\\..*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\..*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\..*\\.sswan" />
|
|
<data android:pathPattern=".*\\.sswan" />
|
|
</intent-filter>
|
|
</activity>
|
|
<activity
|
|
android:name=".ui.TrustedCertificateImportActivity"
|
|
android:label="@string/import_certificate"
|
|
android:theme="@style/TransparentActivity"
|
|
android:exported="true">
|
|
<intent-filter tools:ignore="AppLinkUrlError">
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<data android:mimeType="application/x-x509-ca-cert" />
|
|
<data android:mimeType="application/x-x509-server-cert" />
|
|
<data android:mimeType="application/x-pem-file" />
|
|
<data android:mimeType="application/pkix-cert" />
|
|
</intent-filter>
|
|
</activity>
|
|
|
|
<!--
|
|
Managed configuration, called app restrictions for historical reasons
|
|
https://developer.android.com/work/managed-configurations
|
|
-->
|
|
<meta-data
|
|
android:name="android.content.APP_RESTRICTIONS"
|
|
android:resource="@xml/managed_configuration" />
|
|
|
|
<service
|
|
android:name=".logic.VpnStateService"
|
|
android:exported="false">
|
|
</service>
|
|
<service
|
|
android:name=".logic.CharonVpnService"
|
|
android:exported="false"
|
|
android:foregroundServiceType="specialUse"
|
|
android:permission="android.permission.BIND_VPN_SERVICE">
|
|
<intent-filter>
|
|
<action android:name="android.net.VpnService" />
|
|
</intent-filter>
|
|
<property
|
|
android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
|
|
android:value="VpnService instance"/>
|
|
</service>
|
|
<service
|
|
android:name=".ui.VpnTileService"
|
|
android:label="@string/tile_default"
|
|
android:icon="@drawable/ic_notification"
|
|
android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.service.quicksettings.action.QS_TILE" />
|
|
</intent-filter>
|
|
<meta-data
|
|
android:name="android.service.quicksettings.TILE_CATEGORY"
|
|
android:value="android.service.quicksettings.CATEGORY_CONNECTIVITY" />
|
|
<meta-data
|
|
android:name="android.service.quicksettings.TOGGLEABLE_TILE"
|
|
android:value="true" />
|
|
</service>
|
|
|
|
<receiver
|
|
android:name=".ui.widget.ShxWidgetReceiver"
|
|
android:label="@string/widget_label"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
|
|
</intent-filter>
|
|
<meta-data
|
|
android:name="android.appwidget.provider"
|
|
android:resource="@xml/shx_widget_info" />
|
|
</receiver>
|
|
|
|
<provider
|
|
android:name=".data.LogContentProvider"
|
|
android:authorities="one.shx.strongswan.ext.content.log"
|
|
android:exported="true" >
|
|
<!-- android:grantUriPermissions="true" combined with a custom permission does
|
|
not work (probably too many indirections with ACTION_SEND) so we secure
|
|
this provider with a custom ticketing system -->
|
|
</provider>
|
|
<provider
|
|
android:name=".data.ProfileExportProvider"
|
|
android:authorities="one.shx.strongswan.ext.content.export"
|
|
android:exported="true" >
|
|
<!-- same ticketing approach as above for shared VPN profile exports -->
|
|
</provider>
|
|
<!-- serves downloaded updates to the system package installer -->
|
|
<provider
|
|
android:name="androidx.core.content.FileProvider"
|
|
android:authorities="${applicationId}.fileprovider"
|
|
android:exported="false"
|
|
android:grantUriPermissions="true">
|
|
<meta-data
|
|
android:name="android.support.FILE_PROVIDER_PATHS"
|
|
android:resource="@xml/file_paths" />
|
|
</provider>
|
|
<!-- receives the result of the self-update installation -->
|
|
<receiver
|
|
android:name=".logic.updates.UpdateInstallStatusReceiver"
|
|
android:exported="false" />
|
|
<!-- restores an expected VPN connection after the hosting process died;
|
|
only uses a non-wakeup alarm so it never wakes the device -->
|
|
<receiver
|
|
android:name=".logic.WatchdogReceiver"
|
|
android:exported="false" />
|
|
<!-- ends a "pause VPN for N minutes" and reconnects the paused profile -->
|
|
<receiver
|
|
android:name=".logic.PauseReceiver"
|
|
android:exported="false" />
|
|
<!-- runs after the app has updated itself (the system kills the
|
|
process during the install): cleans up and lets auto-connect
|
|
restore the VPN -->
|
|
<receiver
|
|
android:name=".logic.updates.UpdateReplacedReceiver"
|
|
android:exported="false">
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
|
|
</intent-filter>
|
|
</receiver>
|
|
</application>
|
|
|
|
</manifest>
|