Tobias Brunner
84ee9577e1
It looks like Android 9 incorrectly continues to use the regular DNS servers after the blocking TUN device is replaced with the actual interface. Setting DNS servers prevents that (since all traffic is blocked, which ones doesn't really matter but local/loopback addresses are rejected). Interestingly, if the VPN server later does not assign any DNS servers, there is no fallback to the non-VPN DNS servers for some reason (that's definitely not as documented). This could potentially be a problem as we don't offer an option to configure DNS servers in the VPN profile. Neither issue is seen on older Android versions (only tested on 7.1.1).
To build this within the NDK the following things have to be done:
- By default the strongSwan sources of the current Git tree are used. They have
to be prepared first (see HACKING for a list of required tools):
./autogen.sh && ./configure && make && make distclean
It is also possible to use the sources from a different directory (e.g. an
extracted tarball) by setting strongswan_DIR in app/src/main/jni/Android.mk.
- The OpenSSL or BoringSSL sources are expected in app/src/main/jni/openssl.
Since the sources need to be changed to be built on Android (and especially
in the NDK) we provide a modified mirror of the official Android repositories
on git.strongswan.org.