From 4918e681eef83d378593b9589809ea49b895ef7b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 25 Sep 2025 18:37:15 +0200 Subject: [PATCH] android: Allow selecting a user certificate for managed profiles This is only enabled for profiles that are not distributed with a certificate. --- .../android/data/VpnProfileManagedDataSource.java | 15 +++++++++++---- .../android/ui/VpnProfileDetailActivity.java | 13 ++++++++++--- .../app/src/main/res/values-de/strings.xml | 2 +- .../app/src/main/res/values-pl/strings.xml | 2 +- .../app/src/main/res/values-ru/strings.xml | 2 +- .../app/src/main/res/values-uk/strings.xml | 2 +- .../app/src/main/res/values-zh-rCN/strings.xml | 2 +- .../app/src/main/res/values-zh-rTW/strings.xml | 2 +- .../android/app/src/main/res/values/strings.xml | 2 +- 9 files changed, 28 insertions(+), 14 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileManagedDataSource.java b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileManagedDataSource.java index 0f6ec6292d..eaf0cfaac8 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileManagedDataSource.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/data/VpnProfileManagedDataSource.java @@ -33,6 +33,7 @@ import java.util.UUID; public class VpnProfileManagedDataSource implements VpnProfileDataSource { private static final String NAME_MANAGED_VPN_PROFILES = "org.strongswan.android.data.VpnProfileManagedDataSource.preferences"; + private static final String PREFIX_USER_CERT = "usercert:"; private final ManagedConfigurationService mManagedConfigurationService; private final SharedPreferences mSharedPreferences; @@ -52,11 +53,14 @@ public class VpnProfileManagedDataSource implements VpnProfileDataSource @Override public void close() { - /* remove passwords that are no longer referenced by a VPN profile */ - final Set actualKeys = mManagedConfigurationService.getManagedProfiles().keySet(); - + /* remove settings not referenced by a VPN profile */ final Set storedKeys = new HashSet<>(mSharedPreferences.getAll().keySet()); - storedKeys.removeAll(actualKeys); + + for (String uuid : mManagedConfigurationService.getManagedProfiles().keySet()) + { + storedKeys.remove(uuid); + storedKeys.remove(PREFIX_USER_CERT + uuid); + } final SharedPreferences.Editor editor = mSharedPreferences.edit(); for (String key : storedKeys) @@ -84,6 +88,7 @@ public class VpnProfileManagedDataSource implements VpnProfileDataSource final SharedPreferences.Editor editor = mSharedPreferences.edit(); editor.putString(profile.getUUID().toString(), profile.getPassword()); + editor.putString(PREFIX_USER_CERT + profile.getUUID().toString(), profile.getUserCertificateAlias()); return editor.commit(); } @@ -100,8 +105,10 @@ public class VpnProfileManagedDataSource implements VpnProfileDataSource private VpnProfile prepareVpnProfile(VpnProfile managedProfile) { final String password = mSharedPreferences.getString(managedProfile.getUUID().toString(), managedProfile.getPassword()); + final String alias = mSharedPreferences.getString(PREFIX_USER_CERT + managedProfile.getUUID().toString(), managedProfile.getUserCertificateAlias()); final VpnProfile vpnProfile = managedProfile.clone(); vpnProfile.setPassword(password); + vpnProfile.setUserCertificateAlias(alias); vpnProfile.setDataSource(this); return vpnProfile; } diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java index 13e38273e6..aeef179ce5 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/ui/VpnProfileDetailActivity.java @@ -54,6 +54,7 @@ import android.widget.Spinner; import android.widget.TextView; import org.strongswan.android.R; +import org.strongswan.android.data.ManagedVpnProfile; import org.strongswan.android.data.VpnProfile; import org.strongswan.android.data.VpnProfile.SelectedAppsHandling; import org.strongswan.android.data.VpnProfileDataSource; @@ -817,7 +818,7 @@ public class VpnProfileDetailActivity extends AppCompatActivity alias = mProfile.getCertificateAlias(); getSupportActionBar().setTitle(mProfile.getName()); - setReadOnly(mProfile.isReadOnly()); + setReadOnly(mProfile); } else { @@ -882,8 +883,10 @@ public class VpnProfileDetailActivity extends AppCompatActivity } } - private void setReadOnly(final boolean readOnly) + private void setReadOnly(final VpnProfile profile) { + final boolean readOnly = profile.isReadOnly(); + mManagedProfile.setVisibility(readOnly ? View.VISIBLE : View.GONE); mName.setEnabled(!readOnly); @@ -920,8 +923,12 @@ public class VpnProfileDetailActivity extends AppCompatActivity if (readOnly) { + ManagedVpnProfile managedProfile = (ManagedVpnProfile)profile; mSelectCert.setOnClickListener(null); - mSelectUserCert.setOnClickListener(null); + if (managedProfile.getUserCertificate() != null) + { + mSelectUserCert.setOnClickListener(null); + } } } diff --git a/src/frontends/android/app/src/main/res/values-de/strings.xml b/src/frontends/android/app/src/main/res/values-de/strings.xml index 6047ed63f0..3691a598c8 100644 --- a/src/frontends/android/app/src/main/res/values-de/strings.xml +++ b/src/frontends/android/app/src/main/res/values-de/strings.xml @@ -158,7 +158,7 @@ Bitte geben Sie mit Leerzeichen getrennte, gültige Subnetzte und/oder IP-Adressen ein Bitte geben Sie mit Leerzeichen getrennte, gültige IP-Adressen ein Bitte geben Sie eine mit Bindestrichen getrennte, gültige Liste von Algorithmen ein - Dieses Profil wird von Ihrem Administrator verwaltet und kann nicht bearbeitet werden. Nur das Passwort kann geändert werden + Dieses Profil wird von Ihrem Administrator verwaltet und kann nicht bearbeitet werden. Nur das Passwort bzw. Benutzer-Zertifikat kann geändert werden EAP-TNC kann Ihre Privatsphäre beeinträchtigen Gerätedaten werden an den Server-Betreiber gesendet Trusted Network Connect (TNC) erlaubt Server-Betreibern den Gesundheitszustand von Endgeräten zu prüfen.

Dazu kann der Betreiber Daten verlangen, wie etwa eine eindeutige Identifikationsnummer, eine Liste der installierten Pakete, Systemeinstellungen oder kryptografische Prüfsummen von Dateien.

Solche Daten werden nur übermittelt nachdem die Identität des Servers geprüft wurde.]]> diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml index 8d98fe36b8..4a3b92201b 100644 --- a/src/frontends/android/app/src/main/res/values-pl/strings.xml +++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml @@ -160,7 +160,7 @@ Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml index 0f8c724ad7..bb7173e920 100644 --- a/src/frontends/android/app/src/main/res/values-ru/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml @@ -154,7 +154,7 @@ Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-uk/strings.xml b/src/frontends/android/app/src/main/res/values-uk/strings.xml index 2b552b6064..c92f170b24 100644 --- a/src/frontends/android/app/src/main/res/values-uk/strings.xml +++ b/src/frontends/android/app/src/main/res/values-uk/strings.xml @@ -155,7 +155,7 @@ Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml index fe96028367..d2b21f2271 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml @@ -154,7 +154,7 @@ 请输入有效的子网和/或IP地址，用空格分隔 请输入有效的IP地址，以空格分隔 请输入用连字符分隔的有效算法列表 - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC可能会影响您的隐私 设备数据已被发送至服务器管理员 可信网络连接t (TNC) 允许服务器管理员评定一个用户设备的状况。

出于此目的，服务器管理员可能要求以下数据如独立ID、已安装软件列表、系统设置、或加密过的文件校验值。

任何数据都仅将在验证过服务器的身份ID之后被发出。]]> diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml index 26f3e80a10..6c74fc7867 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml @@ -154,7 +154,7 @@ Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC可能會影響您的隱私安全 裝置資料已經發送給伺服器管理者 Trusted Network Connect (TNC) 可以讓伺服器管理者評估用戶裝置的狀況。

在這個目的下，伺服器管理者可能會要求以下資料，例如ID、已安裝的App項目、系統設定、或加密檔案驗證值。

任何資料都只有在驗證伺服器的身分ID之後才會被送出。]]> diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml index 7f031bec83..667375864d 100644 --- a/src/frontends/android/app/src/main/res/values/strings.xml +++ b/src/frontends/android/app/src/main/res/values/strings.xml @@ -158,7 +158,7 @@ Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password + This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> -- 2.47.3