strongSwan on Android » History » Version 10
strongSwan on Android¶
strongSwan VPN Client for Android 4+¶
There are some limitations at the moment:
- Only IKEv2 is supported
- User authentication is limited to EAP authentication based on username/password (EAP-MSCHAPv2, EAP-MD5)
- No support for MOBIKE yet
- The IPsec implementation is also limited (only AES and SHA1/SHA2 are supported)
More details can be found on a separate page.
strongSwan can also be built for inclusion in the Android system image, that is, directly within the Android source tree. The rest of this document describes how to do so.
A while ago we also created a patch that integrates strongSwan into the default Android 2.2 VPN frontend.
Android Source Tree¶
You will need the complete Android source tree to build strongSwan. Instructions on how to download and build it can be found on the Android website.
To checkout a specific branch or tag of the sources, specify it with the
-b parameter when using the
repo init command.
Since building the whole source tree takes quite a while you should probably start with this first (use
-j to speed this up on multi-core machines):
cd /path/to/android/source . build/envsetup.sh lunch 1 make -j<jobs>
The prebuilt kernel that is used for the emulator lacks some modules required for strongSwan to work correctly. It is therefore required to build a custom kernel.
To get the current kernel config you can use the Android Debug Bridge to download it from the running emulator. After starting the emulator use
adb pull /proc/config.gz config.gzto copy the config to the current directory. Then enable the missing modules, this is mainly
CONFIG_INET_XFRM_MODE_TUNNELbut might include other modules.
Please compare your config to the list of required modules in this wiki (please note that some modules, especially all the IPv6 related modules, are not really required).
Clone the kernel sources and check out an appropriate tag (check the version of the kernel in the emulator). For example (this is for Android 2.2):
git clone https://android.googlesource.com/kernel/goldfish kernel cd kernel git checkout -t origin/android-goldfish-2.6.29
You can then copy your config to this directory and compile the kernel sources using
export ARCH=arm export CROSS_COMPILE=/path/to/android/source/prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin/arm-eabi- make oldconfig make -j<jobs>
To start the emulator using your custom kernel use the following command.
emulator -kernel /path/to/kernel/source/arch/arm/boot/zImage &
If you used Git you can install droid-gcc using
make install, if you downloaded it directly, you have to manually create two symlinks to droid-gcc named droid-gcc and droid-ld in a directory that is included in your PATH environment variable.
Build the Library¶
Download the three helper files to an appropriate working directory and then download and extract the tarball for the Vstr library.
wget http://download.strongswan.org/vstr-1.0.15.tar.bz2 tar xjf vstr-1.0.15.tar.bz2
Adjust the variables in the build script (
DROID_ROOT and optionally
INSTALLDIR). Make sure you specify
DROID_ROOT as an absolute path.
Then build and install the it using
cd vstr-1.0.15 patch -p1 < ../vstr.patch . ../vstr.build
Build the Library¶
Download the helper files to an appropriate working directory, then download and extract the current source tarball of libcurl.
Adjust the variables in the build script (see above), and build and install it using
cd curl-x.x.x . ../curl.build
Now you are ready to build strongSwan. Download the current tarball (or build it yourself from the strongSwan source tree) and extract it in
If you changed
INSTALLDIR in the build scripts above, you will have to change the top Android.mk (or Android.mk.in) accordingly. You can also adjust the plugin list in the that file or enable/disable executables.
The executable you want to include in the system image (starter, charon, scepclient) have to be added to
build/target/product/core.mk. The libraries are automatically installed.
Now just build the Android source tree.
cd /path/to/android/source make