Project

General

Profile

strongSwan VPN Client for Android 4+ » History » Version 34

Tobias Brunner, 07.09.2017 10:48

1 1 Tobias Brunner
h1. strongSwan VPN Client for Android 4+
2 1 Tobias Brunner
3 21 Tobias Brunner
The "strongSwan VPN Client for Android 4 and newer":https://play.google.com/store/apps/details?id=org.strongswan.android is an app that can be downloaded directly from "Google Play":https://play.google.com/store/apps/details?id=org.strongswan.android.
4 1 Tobias Brunner
5 21 Tobias Brunner
h2. Client Configuration
6 1 Tobias Brunner
7 26 Tobias Brunner
Since version [[AndroidVPNClient#180-2017-01-20|1.8.0]] of the app it is possible to [[AndroidVPNClientProfiles|import VPN profiles]] from files.
8 26 Tobias Brunner
9 21 Tobias Brunner
Client certificates and keys, and CA certificates may be added by [[SimpleCA#Install-certificates-in-other-platforms|bundling them into a PKCS#12 file]] and then importing that file into the Android system keystore. CA certificates and server certificates may also be imported directly into the app since [[AndroidVPNClient#140-2014-07-22|1.4.0]]. Importing CA certificates into the Android system keystore may trigger a warning since Android 4.4 ("Network may be monitored by an unknown third party":https://code.google.com/p/android/issues/detail?id=62644), whereas importing CA certificates directly into the app will work fine.
10 21 Tobias Brunner
11 30 Tobias Brunner
Since [[AndroidVPNClient#190-2017-07-03|1.9.0]] split tunneling may be configured on the client (i.e. to only route specific traffic via VPN and/or to exclude certain traffic from the VPN). The client always proposes 0.0.0.0/0 as remote traffic selector and narrowing performed by the server still applies. Since [[AndroidVPNClient#150-2015-07-28|1.5.0]] the user may opt to block all traffic not destined for the VPN if the server does narrow the traffic selector.
12 30 Tobias Brunner
13 30 Tobias Brunner
Since [[AndroidVPNClient#190-2017-07-03|1.9.0]] it is possible to limit a VPN connection to specific apps or exclude certain apps from using the VPN (to them it will seem as if no VPN is present).
14 30 Tobias Brunner
15 21 Tobias Brunner
The app allows creating shortcuts to initiate individual VPN profiles. These can be added to the launcher to quickly start specific connections. In combination with apps such as Llama or Tasker they also enable triggering VPN connections based on e.g. location, WiFi hotspots, system start or other events.
16 21 Tobias Brunner
17 21 Tobias Brunner
h2. Server Configuration
18 21 Tobias Brunner
19 21 Tobias Brunner
The app is compatible to the [[Windows7|Windows example configurations]] we provide. Since strongSwan version:5.2.1 and version [[AndroidVPNClient#145-2014-11-06|1.4.5]] of the app _fragmentation=yes_ may be added to the server config to use IKEv2 fragmentation, which avoids problems with IP fragmentation during connection establishment (due to large certificates or lots of certificate requests).
20 21 Tobias Brunner
21 21 Tobias Brunner
*Important:* The hostname/IP of the VPN server, as configured in the VPN profile, has to be contained as subjectAltName extension in the VPN server's certificate. Since [[AndroidVPNClient#160-2016-05-02|1.6.0]] the server identity may also be configured explicitly.
22 21 Tobias Brunner
23 21 Tobias Brunner
h2. Known Limitations/Issues
24 21 Tobias Brunner
25 1 Tobias Brunner
 * Only IKEv2 is supported
26 21 Tobias Brunner
 * Client authentication is limited to:
27 21 Tobias Brunner
28 21 Tobias Brunner
   * EAP authentication based on username/password (EAP-MSCHAPv2, EAP-MD5, EAP-GTC)
29 21 Tobias Brunner
   * RSA/ECDSA authentication with private key/certificate
30 21 Tobias Brunner
   * EAP-TLS with private key/certificate (see [[AndroidVPNClient#145-2014-11-06|1.4.5]] for limitations)
31 21 Tobias Brunner
 * The server always has to be authenticated with RSA/ECDSA (even when using EAP-TLS, see [[AndroidVPNClient#145-2014-11-06|1.4.5]])
32 1 Tobias Brunner
 * Only a single tunnel can be established at a time
33 21 Tobias Brunner
 * The IPsec proposal is limited to AES encryption with SHA2/SHA1 data integrity or AES-GCM authenticated encryption. Optionally, using PFS with one of a number of proposed ECP/MODP DH groups.
34 1 Tobias Brunner
35 27 Tobias Brunner
 * The app is not compatible with Google's "Project Fi":https://fi.google.com, which provides its own always-on VPN connection. To use the app this has to be disabled first using the following procedure.
36 22 Tobias Brunner
37 22 Tobias Brunner
   {{collapse(How-to disable Project Fi's always-on VPN)
38 22 Tobias Brunner
The always-on VPN connection can't be disabled without disabling the _Wi-Fi Assistant_ first:
39 22 Tobias Brunner
# In _Settings_ click _Google_
40 22 Tobias Brunner
# Click _Network_
41 22 Tobias Brunner
# Turn off the _Wi-Fi Assistant_ setting
42 22 Tobias Brunner
# Restart the device
43 22 Tobias Brunner
44 22 Tobias Brunner
Then turn off the always-on VPN connection:
45 22 Tobias Brunner
# In _Settings_ click _More_ under _Wireless & Networks_
46 22 Tobias Brunner
# Click _VPN_
47 22 Tobias Brunner
# Click the gear next to the _Wi-Fi Assistant_
48 22 Tobias Brunner
# Make sure "Always On" is not active
49 1 Tobias Brunner
}}
50 27 Tobias Brunner
51 34 Tobias Brunner
 * It might be necessary to exclude the app from any battery saver feature on the system (e.g. on the Xiaomi MIUI8).
52 34 Tobias Brunner
53 27 Tobias Brunner
 * Apps that create a screen overlay, such as _Twilight_ or _Night Mode_, might interfere with the dialog to grant the app permission to create a VPN connection (unable to tap _OK/Grant_). If that's the case, temporarily disable any such app or, if possible, whitelist/exclude the _VPNDialogs_ system app from this feature.
54 22 Tobias Brunner
55 17 Tobias Brunner
 * *Note:* There are some serious issues on Android 4.4 before 4.4.3 (see #462)
56 21 Tobias Brunner
57 4 Tobias Brunner
 * If you have problems with the app, find bugs or have feature requests you may open a new "issue report":https://wiki.strongswan.org/projects/strongswan/issues (please use the search function first to avoid duplicates). You may also send us the log file via email directly from within the app.
58 4 Tobias Brunner
59 21 Tobias Brunner
h2. Further Information
60 9 Noel Kuntze
61 26 Tobias Brunner
 * [[AndroidVPNClientProfiles|File format for VPN profiles]]
62 21 Tobias Brunner
 * [[AndroidVPNClientBuild|How to build the app from sources]]
63 21 Tobias Brunner
 * [[AndroidVPNClientPrivacyPolicy|Privacy Policy]]
64 2 Tobias Brunner
65 1 Tobias Brunner
h2. Changelog
66 30 Tobias Brunner
67 33 Tobias Brunner
h3. 1.9.3 (2017-09-04)
68 33 Tobias Brunner
69 33 Tobias Brunner
* Adds support to verify server certificates via OCSP(Online Certificate Status Protocol)
70 33 Tobias Brunner
* Caches CRLs in the app directory (#2405)
71 33 Tobias Brunner
* The CRL cache may be cleared via main menu
72 33 Tobias Brunner
* Adds a button to reconnect the VPN profile to the "currently connected" dialog
73 33 Tobias Brunner
* Don't apply/configure app selection on Android < 5 (the API is not supported there)
74 33 Tobias Brunner
* Initiator SPIs are reset when retrying while reconnecting, which might avoid issues with @INVALID_KE_PAYLOAD@ notifies
75 33 Tobias Brunner
* Catches some random exceptions (as seen in Play Console)
76 33 Tobias Brunner
77 32 Tobias Brunner
h3. 1.9.2 (2017-07-04)
78 32 Tobias Brunner
79 32 Tobias Brunner
* Fixes a crash on Android <= 5
80 32 Tobias Brunner
* Fixes database update when updating from app versions < 1.8.0
81 32 Tobias Brunner
82 31 Tobias Brunner
h3. 1.9.1 (2017-07-03)
83 31 Tobias Brunner
84 31 Tobias Brunner
* Fixes a crash with pre-existing profiles
85 31 Tobias Brunner
86 30 Tobias Brunner
h3. 1.9.0 (2017-07-03)
87 30 Tobias Brunner
88 30 Tobias Brunner
* Adds support for split-tunneling on the client (only route specific traffic via VPN and/or exclude specific traffic from the VPN)
89 30 Tobias Brunner
* Adds support for per-app VPN (either allow only specific apps to use the VPN or exclude certain apps from using it)
90 30 Tobias Brunner
* Sending of certificate requests may be disabled (while this allows reducing the size of the IKE_AUTH message, e.g. if fragmentation is not supported, it only works if the server also sends its certificate if it didn't receive any certificate requests)
91 30 Tobias Brunner
* NAT-T keepalive interval is now configurable (#2365)
92 30 Tobias Brunner
* [[AndroidVPNClientProfiles|VPN profiles]] may be imported via SAF(Storage Access Framework) and allow the configuration of the new settings
93 30 Tobias Brunner
* CRLs are now fetched with a simple Android-specific HTTP/S fetcher
94 30 Tobias Brunner
* Adds a disconnect button in the permanent notification (#2309)
95 30 Tobias Brunner
* The log view should now be more efficient (#2148)
96 30 Tobias Brunner
* Fixes the handling of backslashes in usernames
97 30 Tobias Brunner
* Adds a Traditional Chinese translation
98 26 Tobias Brunner
99 29 Tobias Brunner
h3. 1.8.2 (2017-02-20)
100 29 Tobias Brunner
101 29 Tobias Brunner
* Fixes an issue while disconnecting on certain devices (#2251)
102 29 Tobias Brunner
103 28 Tobias Brunner
h3. 1.8.1 (2017-02-07)
104 28 Tobias Brunner
105 28 Tobias Brunner
* Adds Simplified Chinese translation
106 28 Tobias Brunner
107 26 Tobias Brunner
h3. 1.8.0 (2017-01-20)
108 26 Tobias Brunner
109 26 Tobias Brunner
* Adds support to [[AndroidVPNClientProfiles|import VPN profiles]] from JSON-encoded files
110 19 Tobias Brunner
111 25 Tobias Brunner
h3. 1.7.2 (2016-12-10)
112 25 Tobias Brunner
113 25 Tobias Brunner
* Re-adds support for the ECC Brainpool DH groups (BoringSSL doesn't provide these)
114 25 Tobias Brunner
115 24 Tobias Brunner
h3. 1.7.1 (2016-12-09)
116 1 Tobias Brunner
117 25 Tobias Brunner
* Fixes a crash (regarding libtpmtss.so) on older Android systems
118 24 Tobias Brunner
119 23 Tobias Brunner
h3. 1.7.0 (2016-12-08)
120 23 Tobias Brunner
121 23 Tobias Brunner
* Adds a permanent notification while connected (or connecting) that shows the current status and which allows running the VpnService instance as foreground service. This in turn should prevent Android from terminating it when low on memory.
122 23 Tobias Brunner
* Supports the ChaCha20/Poly1305 AEAD and Curve25519 DH algorithms
123 23 Tobias Brunner
* Properly validates entered server port and MTU values in the GUI
124 23 Tobias Brunner
* Logs the installed DNS servers
125 23 Tobias Brunner
* Uses BoringSSL instead of OpenSSL
126 23 Tobias Brunner
* Based on strongSwan version:5.5.1
127 19 Tobias Brunner
128 1 Tobias Brunner
h3. 1.6.2 (2016-05-06)
129 20 Tobias Brunner
130 25 Tobias Brunner
* Fixes a crash when importing CA/server certificates via SAF(Storage Access Framework)
131 18 Tobias Brunner
132 18 Tobias Brunner
h3. 1.6.1 (2016-05-04)
133 18 Tobias Brunner
134 18 Tobias Brunner
* Fixes an interoperability issue with Windows Server. version:5.4.0 changed the order of the algorithms in the default IKE proposal.  Algorithms that provide a security of less than 128-bit were moved to the end of the list. Now Windows Server 2012 R2 (in its default configuration at least) only supports _modp1024_. The problem is that Microsoft's IKEv2 implementation only seems to consider the first fifteen algorithms of a specific transform type in the proposal. Because strongSwan supports [[IKEv2CipherSuites#Diffie-Hellman-Groups|quite a lot of DH groups]] and due to the reordering _modp1024_ was now at position 17 in the proposal, which meant Microsoft Server rejected the IKE_SA_INIT message with a NO_PROPOSAL_CHOSEN error.  This has been fixed by removing some of the weaker and rarely used DH groups from the default proposal (commit:fae18fd201).
135 18 Tobias Brunner
* Also corrects the label for the password field in the login dialog
136 16 Tobias Brunner
137 16 Tobias Brunner
h3. 1.6.0 (2016-05-02)
138 16 Tobias Brunner
139 16 Tobias Brunner
* Based on version:5.4.0, which e.g. adds support for IKEv2 redirection
140 16 Tobias Brunner
* Configuration of the server identity. If it is set the identity is sent as IDr during authentication and must match the server's identity exactly (i.e. it disables loose identity matching against all subjectAltNames, see #1268)
141 16 Tobias Brunner
* Selection of the client identity if certificate authentication is used (see #1403)
142 16 Tobias Brunner
* GUI changes:
143 16 Tobias Brunner
** Removed the progress dialogs during dis-/connecting
144 16 Tobias Brunner
** Redesign of the profile editor (reordered, floating labels, helper texts, "gateway"->"server")
145 16 Tobias Brunner
** Tabs in CA certificate manager have been updated (sliding tabs with ViewPager)
146 16 Tobias Brunner
** Switched to the AppCompat theme (Material-like)
147 6 Tobias Brunner
* Increases the NAT-T keepalive interval to 45s (#1326), no attempt to send keepalives is made anymore if there is no connectivity
148 6 Tobias Brunner
* Fixed the font in the log view on Android 5+
149 6 Tobias Brunner
* Native 64-bit build
150 6 Tobias Brunner
151 6 Tobias Brunner
h3. 1.5.0 (2015-07-28)
152 6 Tobias Brunner
153 6 Tobias Brunner
* Based on version:5.3.2
154 6 Tobias Brunner
* Roaming between networks on Android 5 and newer has been fixed (#865)
155 6 Tobias Brunner
* Adds new advanced profile settings:
156 6 Tobias Brunner
** A custom MTU can be specified (currently between 1280 and 1500)
157 6 Tobias Brunner
** The server port can be changed (default is 500, with a switch to 4500 - there is no switch if a custom port is set), #847
158 6 Tobias Brunner
** Split tunneling can be disabled by blocking all traffic that is not destined for the VPN
159 1 Tobias Brunner
*** Only on Android 5 and newer will split tunneling fully work if only one address family is tunneled via VPN (#782)
160 1 Tobias Brunner
* Sets the preferred language for remediation instructions to the system language
161 6 Tobias Brunner
* EAP-TNC does not require a client certificate anymore
162 5 Tobias Brunner
* Fixes a linker issue on Android M
163 5 Tobias Brunner
164 5 Tobias Brunner
h3. 1.4.6 (2015-06-08)
165 5 Tobias Brunner
166 2 Tobias Brunner
* Fix for "CVE-2015-4171":https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-(cve-2015-4171).html.
167 2 Tobias Brunner
168 2 Tobias Brunner
h3. 1.4.5 (2014-11-06)
169 8 Tobias Brunner
170 2 Tobias Brunner
* Based on version:5.2.1 including improved MOBIKE handling and support for IKEv2 fragmentation
171 21 Tobias Brunner
* Enables optional PFS(Perfect Forward Secrecy) for IPsec SAs.  Proposed are cipher suites with and without DH groups, so it's up to the VPN server whether PFS is used or not.
172 8 Tobias Brunner
* Adds basic support for EAP-TLS. Limitations are:
173 21 Tobias Brunner
** EAP-only authentication is not allowed because the AAA identity is not configurable. So to prevent anyone with a valid certificate from impersonating the AAA server and thus the VPN server, the server is authenticated with a certificate (like we do with other authentication methods)
174 21 Tobias Brunner
** It's currently not possible to select a specific CA certificate to authenticate the AAA server certificate, so it either must be issued by the same CA as that of the VPN server or automatic CA certificate selection must be enabled in the VPN profile
175 2 Tobias Brunner
176 2 Tobias Brunner
h3. 1.4.0 (2014-07-22)
177 2 Tobias Brunner
178 2 Tobias Brunner
* Adds the ability to import CA and server certificates directly into the app. On Android 4.4+ the "SAF(Storage Access Framework)":https://developer.android.com/guide/topics/providers/document-provider.html is used to allow users to browse for certificate files (if the MIME-type is not set properly the advanced view has to be used to see all files). On older systems the files may be opened from third-party file managers
179 2 Tobias Brunner
* The GUI indicates if the connection is being reestablished
180 2 Tobias Brunner
* A DNS proxy resolves the VPN server's hostname while reestablishing (plaintext is blocked otherwise)
181 2 Tobias Brunner
* Supports ECDSA private keys on recent Android systems (tested on Android 4.4.4)
182 2 Tobias Brunner
183 2 Tobias Brunner
h3. 1.3.4 (2014-04-25)
184 2 Tobias Brunner
185 2 Tobias Brunner
* Based on version:5.1.3 (fixes a security vulnerability)
186 2 Tobias Brunner
* Links libcrypto (OpenSSL) statically
187 2 Tobias Brunner
* Doesn't limit the number of packets during EAP-TTLS
188 2 Tobias Brunner
189 2 Tobias Brunner
h3. 1.3.3 (2013-11-13)
190 2 Tobias Brunner
191 2 Tobias Brunner
* Based on version:5.1.1
192 2 Tobias Brunner
* Fixed issues with IV generation and padding length calculation for AES-GCM
193 2 Tobias Brunner
* Removes the Vstr dependency
194 2 Tobias Brunner
195 2 Tobias Brunner
h3. 1.3.2 (2013-09-26)
196 2 Tobias Brunner
197 2 Tobias Brunner
* Fixed a regression causing remediation instructions to pile up (EAP-TNC)
198 2 Tobias Brunner
199 2 Tobias Brunner
h3. 1.3.1 (2013-09-23)
200 2 Tobias Brunner
201 2 Tobias Brunner
* Improved recovery after certain connectivity changes
202 2 Tobias Brunner
203 2 Tobias Brunner
h3. 1.3.0 (2013-07-08)
204 2 Tobias Brunner
205 2 Tobias Brunner
* Added support for [[BYOD|EAP-TNC]]
206 2 Tobias Brunner
* Disabled listening on IPv6 because the Linux kernel currently does not support UDP encapsulation of ESP packets for IPv6
207 2 Tobias Brunner
208 17 Tobias Brunner
h3. 1.2.3 (2013-05-03)
209 2 Tobias Brunner
210 2 Tobias Brunner
* Added support for AES-GCM
211 2 Tobias Brunner
* Support for IPv6-in-IPv4 tunnels
212 2 Tobias Brunner
* Uses kernel-netlink to handle interface/IP address enumeration
213 2 Tobias Brunner
214 2 Tobias Brunner
h3. 1.2.2 (2013-03-07)
215 2 Tobias Brunner
216 2 Tobias Brunner
* Added support for combined certificate/EAP authentication (RFC 4739)
217 2 Tobias Brunner
* Added Polish, Ukrainian, and Russian translations
218 2 Tobias Brunner
* Fixed a race condition during reauthentication and a potential freeze while disconnecting
219 17 Tobias Brunner
220 2 Tobias Brunner
h3. 1.2.1 (2012-11-21)
221 2 Tobias Brunner
222 1 Tobias Brunner
* Added shortcuts to VPN profiles to quickly start specific connections from the launcher
223 2 Tobias Brunner
* Added a confirmation dialog if a connection is started but one is already established
224 2 Tobias Brunner
* Fixed a few Android 4.2 specific issues
225 2 Tobias Brunner
226 2 Tobias Brunner
h3. 1.2.0 (2012-10-18)
227 2 Tobias Brunner
228 2 Tobias Brunner
* Added support for MOBIKE e.g. allows switching between different interfaces (e.g. Wifi and 3G/4G)
229 2 Tobias Brunner
* The app tries to keep the connection established until the user disconnects manually
230 2 Tobias Brunner
231 17 Tobias Brunner
h3. 1.1.3 (2012-09-24)
232 2 Tobias Brunner
233 2 Tobias Brunner
* Workaround for a private key issue on Android 4.1
234 2 Tobias Brunner
235 8 Tobias Brunner
h3. 1.1.2 (2012-09-18)
236 2 Tobias Brunner
237 21 Tobias Brunner
* Added loose ID matching: While the client expects the hostname/IP of the VPN server to be contained as subjectAltName in the certificate this allows the responder to use a different IDr than that, as long as it is confirmed by the certificate (the client does not send an IDr anymore)
238 2 Tobias Brunner
239 17 Tobias Brunner
h3. 1.1.1 (2012-09-17)
240 2 Tobias Brunner
241 2 Tobias Brunner
* Fixed a Unicode issue when converting Java to C strings
242 2 Tobias Brunner
243 2 Tobias Brunner
h3. 1.1.0 (2012-09-06)
244 1 Tobias Brunner
245 1 Tobias Brunner
* Added certificate authentication and fixed reauthentication