android: Show an error if client certificate is unavailable

This can happen on systems (e.g. Android 7.x) where Always-on VPNs are
triggered right after booting before the KeyChain is unlocked by the user.
Retrieving the certificate chain or private key then fails with
"KeyChainException: IllegalStateException: keystore is LOCKED" until the
user unlocks the screen once.

The built-in client actually also fails in this situation (e.g. with XAuth
RSA), it tries three times then stops and shows an error notification.

diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
index 458204c5332705261cdc27cc39a3e6419cd52261..9b1bcff299da5154bb166c76e4108b9fb04e4f99 100644 (file)
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
@@ -128,7 +128,8 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
        static final int STATE_PEER_AUTH_ERROR = 4;
        static final int STATE_LOOKUP_ERROR = 5;
        static final int STATE_UNREACHABLE_ERROR = 6;
-       static final int STATE_GENERIC_ERROR = 7;
+       static final int STATE_CERTIFICATE_UNAVAILABLE = 7;
+       static final int STATE_GENERIC_ERROR = 8;
 
        @Override
        public int onStartCommand(Intent intent, int flags, int startId)
@@ -589,6 +590,9 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
                        case STATE_UNREACHABLE_ERROR:
                                setErrorDisconnect(ErrorState.UNREACHABLE);
                                break;
+                       case STATE_CERTIFICATE_UNAVAILABLE:
+                               setErrorDisconnect(ErrorState.CERTIFICATE_UNAVAILABLE);
+                               break;
                        case STATE_GENERIC_ERROR:
                                setErrorDisconnect(ErrorState.GENERIC_ERROR);
                                break;
@@ -707,7 +711,6 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
         * @return the private key
         * @throws InterruptedException
         * @throws KeyChainException
-        * @throws CertificateEncodingException
         */
        private PrivateKey getUserKey() throws KeyChainException, InterruptedException
        {

diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/VpnStateService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/VpnStateService.java
index 4f3073691a09192c75fc912c044c742fa4dc4126..f9eb82263aaa00ccc62a2ff96d30280e41e470dc 100644 (file)
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/VpnStateService.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/VpnStateService.java
@@ -62,6 +62,7 @@ public class VpnStateService extends Service
                UNREACHABLE,
                GENERIC_ERROR,
                PASSWORD_MISSING,
+               CERTIFICATE_UNAVAILABLE,
        }
 
        /**
@@ -194,6 +195,8 @@ public class VpnStateService extends Service
                                return R.string.error_unreachable;
                        case PASSWORD_MISSING:
                                return R.string.error_password_missing;
+                       case CERTIFICATE_UNAVAILABLE:
+                               return R.string.error_certificate_unavailable;
                        default:
                                return R.string.error_generic;
                }

diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c
index b1a095bcdf73f92bc1646d4a0feaa16e8f68769a..f4418bd882ab656ede210053c58d6e165e4760ad 100644 (file)
--- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c
+++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c
@@ -794,7 +794,7 @@ static job_requeue_t initiate(private_android_service_t *this)
                {
                        peer_cfg->destroy(peer_cfg);
                        charonservice->update_status(charonservice,
-                                                                                CHARONSERVICE_GENERIC_ERROR);
+                                                                                CHARONSERVICE_CERTIFICATE_UNAVAILABLE);
                        return JOB_REQUEUE_NONE;
                }
        }

diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.h b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.h
index fa2fb42b24f5c70dca93b03c04b87461243e62c2..12353777beeeedc8a36e46343ecf3db0119d3f5e 100644 (file)
--- a/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.h
+++ b/src/frontends/android/app/src/main/jni/libandroidbridge/charonservice.h
@@ -59,6 +59,7 @@ enum android_vpn_state_t {
        CHARONSERVICE_PEER_AUTH_ERROR,
        CHARONSERVICE_LOOKUP_ERROR,
        CHARONSERVICE_UNREACHABLE_ERROR,
+       CHARONSERVICE_CERTIFICATE_UNAVAILABLE,
        CHARONSERVICE_GENERIC_ERROR,
 };
 

diff --git a/src/frontends/android/app/src/main/res/values-de/strings.xml b/src/frontends/android/app/src/main/res/values-de/strings.xml
index 2dbe13fb2f6a3a0dd9ac96d1ae40a096f23576b0..3f9ff83f821c074883c798ca88d5881db9369c89 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-de/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-de/strings.xml
@@ -188,6 +188,7 @@
     <string name="error_assessment_failed">Sicherheitsassessment ist fehlgeschlagen</string>
     <string name="error_generic">Unbekannter Fehler während des Verbindens</string>
     <string name="error_password_missing">Passwort nicht verfügbar</string>
+    <string name="error_certificate_unavailable">Benutzer-Zertifikat nicht verfügbar</string>
     <string name="vpn_connected">VPN verbunden</string>
     <string name="vpn_profile_connected">Dieses VPN Profil ist momentan verbunden!</string>
     <string name="reconnect">Neu verbinden</string>

diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml
index f9a88b825dc851449e153ca98dca21533140786a..fa34739c4a7ec91ae05617d7f1ee54f231c4d4d2 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-pl/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml
@@ -188,6 +188,7 @@
     <string name="error_assessment_failed">Security assessment failed</string>
     <string name="error_generic">Nieznany błąd w czasie połączenia</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">Połączenie z VPN</string>
     <string name="vpn_profile_connected">Ten profil VPN jest obecnie połaczony!</string>
     <string name="reconnect">Połączyć ponownie</string>

diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml
index 8fec5a1d729d867a87a917bb3e40ce8dc7b9761a..9d3bb8eb2f3665ea9df16d06658e1b860cd0ef42 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-ru/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml
@@ -185,6 +185,7 @@
     <string name="error_assessment_failed">Security assessment failed</string>
     <string name="error_generic">Неизвестная ошибка</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">Соединение с VPN установлено</string>
     <string name="vpn_profile_connected">Подключение к этому профилю VPN уже существует!</string>
     <string name="reconnect">Переподключить</string>

diff --git a/src/frontends/android/app/src/main/res/values-ua/strings.xml b/src/frontends/android/app/src/main/res/values-ua/strings.xml
index d9525223b15cdea10c4931caf72299b009f75bc1..7d87b4b94e3be613ae8c07267807ee08cb97d753 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-ua/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-ua/strings.xml
@@ -186,6 +186,7 @@
     <string name="error_assessment_failed">Security assessment failed</string>
     <string name="error_generic">Невідома помилка під час підключення</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">VPN підключено</string>
     <string name="vpn_profile_connected">Цей VPN профіль зараз підключений!</string>
     <string name="reconnect">Перепідключитися</string>

diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml
index 00e6e8ba23c15613517a1fafad7ffacb38f5ec24..54487793e6ac49c35456a67b827644d7802840b3 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml
@@ -185,6 +185,7 @@
     <string name="error_assessment_failed">可靠性评估失败</string>
     <string name="error_generic">连接中遭遇未知失败</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">VPN已连接</string>
     <string name="vpn_profile_connected">此VPN配置目前已连接。</string>
     <string name="reconnect">重连</string>

diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml
index cb7b3438d178568b4f604b38f64cb109a030d669..d0e9065aa339264469f3471674109a8e807e6ec9 100644 (file)
--- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml
+++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml
@@ -185,6 +185,7 @@
     <string name="error_assessment_failed">穩定性評估失敗</string>
     <string name="error_generic">連線中遇到不明錯誤</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">VPN已連線</string>
     <string name="vpn_profile_connected">這個VPN設定檔目前已經連線。</string>
     <string name="reconnect">重新連線</string>

diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml
index a86a1b5111fb35d98daea39645453fa7be2d3237..475fcd91eaaf85dc2b6dbb46d9d652c0b4babf55 100644 (file)
--- a/src/frontends/android/app/src/main/res/values/strings.xml
+++ b/src/frontends/android/app/src/main/res/values/strings.xml
@@ -188,6 +188,7 @@
     <string name="error_assessment_failed">Security assessment failed</string>
     <string name="error_generic">Unspecified failure while connecting</string>
     <string name="error_password_missing">Password unavailable</string>
+    <string name="error_certificate_unavailable">Client certificate unavailable</string>
     <string name="vpn_connected">VPN connected</string>
     <string name="vpn_profile_connected">This VPN profile is currently connected!</string>
     <string name="reconnect">Reconnect</string>