From c89fd2f73f8a84f9ef7742e39476a9645e6d3863 Mon Sep 17 00:00:00 2001 From: cyBerta Date: Thu, 1 Feb 2018 15:30:39 +0100 Subject: #8832 add all ics-openvpn code changes --- .../main/java/de/blinkt/openvpn/VpnProfile.java | 117 ++++++++++++++------- 1 file changed, 77 insertions(+), 40 deletions(-) (limited to 'app/src/main/java/de/blinkt/openvpn/VpnProfile.java') diff --git a/app/src/main/java/de/blinkt/openvpn/VpnProfile.java b/app/src/main/java/de/blinkt/openvpn/VpnProfile.java index aa25da48..1d6f41cd 100644 --- a/app/src/main/java/de/blinkt/openvpn/VpnProfile.java +++ b/app/src/main/java/de/blinkt/openvpn/VpnProfile.java @@ -5,6 +5,8 @@ package de.blinkt.openvpn; +import de.blinkt.openvpn.core.Preferences; +import se.leap.bitmaskclient.BuildConfig; import se.leap.bitmaskclient.R; import android.annotation.SuppressLint; @@ -36,6 +38,8 @@ import java.lang.reflect.Method; import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.security.PrivateKey; +import java.security.Signature; +import java.security.SignatureException; import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; @@ -182,7 +186,6 @@ public class VpnProfile implements Serializable, Cloneable { public boolean mUseUdp = true; - public VpnProfile(String name) { mUuid = UUID.randomUUID(); mName = name; @@ -282,30 +285,42 @@ public class VpnProfile implements Serializable, Cloneable { } + + public static boolean doUseOpenVPN3(Context c) { + SharedPreferences prefs = Preferences.getDefaultSharedPreferences(c); + boolean useOpenVPN3 = prefs.getBoolean("ovpn3", false); + if ("noovpn3".equals(BuildConfig.FLAVOR)) + useOpenVPN3 = false; + return useOpenVPN3; + } + public String getConfigFile(Context context, boolean configForOvpn3) { File cacheDir = context.getCacheDir(); String cfg = ""; - // Enable management interface - cfg += "# Enables connection to GUI\n"; - cfg += "management "; - - cfg += cacheDir.getAbsolutePath() + "/" + "mgmtsocket"; - cfg += " unix\n"; - cfg += "management-client\n"; - // Not needed, see updated man page in 2.3 - //cfg += "management-signal\n"; - cfg += "management-query-passwords\n"; - cfg += "management-hold\n\n"; - if (!configForOvpn3) { + // Enable management interface + cfg += "# Config for OpenVPN 2.x\n"; + cfg += "# Enables connection to GUI\n"; + cfg += "management "; + + cfg += cacheDir.getAbsolutePath() + "/" + "mgmtsocket"; + cfg += " unix\n"; + cfg += "management-client\n"; + // Not needed, see updated man page in 2.3 + //cfg += "management-signal\n"; + cfg += "management-query-passwords\n"; + cfg += "management-hold\n\n"; + cfg += String.format("setenv IV_GUI_VER %s \n", openVpnEscape(getVersionEnvString(context))); - String versionString = String.format(Locale.US, "%d %s %s %s %s %s", Build.VERSION.SDK_INT, Build.VERSION.RELEASE, - NativeUtils.getNativeAPI(), Build.BRAND, Build.BOARD, Build.MODEL); + String versionString = getPlatformVersionEnvString(); cfg += String.format("setenv IV_PLAT_VER %s\n", openVpnEscape(versionString)); + } else { + cfg += "# Config for OpeNVPN 3 C++\n"; } + cfg += "machine-readable-output\n"; cfg += "allow-recursive-routing\n"; @@ -418,8 +433,7 @@ public class VpnProfile implements Serializable, Cloneable { cfg += insertFileData("ca", mCaFilename); } - if (isUserPWAuth()) - { + if (isUserPWAuth()) { if (mAuthenticationType == AUTH_RETRY_NOINTERACT) cfg += "auth-retry nointeract"; } @@ -456,7 +470,7 @@ public class VpnProfile implements Serializable, Cloneable { if (!TextUtils.isEmpty(mIPv6Address)) { // Use our own ip as gateway since we ignore it anyway String fakegw = mIPv6Address.split("/", 2)[0]; - cfg += "ifconfig-ipv6 " + mIPv6Address + " " + fakegw +"\n"; + cfg += "ifconfig-ipv6 " + mIPv6Address + " " + fakegw + "\n"; } } @@ -490,16 +504,12 @@ public class VpnProfile implements Serializable, Cloneable { if (mOverrideDNS || !mUsePull) { if (!TextUtils.isEmpty(mDNS1)) { - if (mDNS1.contains(":")) - cfg += "dhcp-option DNS6 " + mDNS1 + "\n"; - else - cfg += "dhcp-option DNS " + mDNS1 + "\n"; - } if (!TextUtils.isEmpty(mDNS2)) { - if (mDNS2.contains(":")) - cfg += "dhcp-option DNS6 " + mDNS2 + "\n"; - else - cfg += "dhcp-option DNS " + mDNS2 + "\n"; - } if (!TextUtils.isEmpty(mSearchDomain)) + cfg += "dhcp-option DNS " + mDNS1 + "\n"; + } + if (!TextUtils.isEmpty(mDNS2)) { + cfg += "dhcp-option DNS " + mDNS2 + "\n"; + } + if (!TextUtils.isEmpty(mSearchDomain)) cfg += "dhcp-option DOMAIN " + mSearchDomain + "\n"; } @@ -511,9 +521,8 @@ public class VpnProfile implements Serializable, Cloneable { cfg += "mssfix\n"; } - if (mTunMtu >= 48 && mTunMtu != 1500) - { - cfg+= String.format(Locale.US, "tun-mtu %d\n", mTunMtu); + if (mTunMtu >= 48 && mTunMtu != 1500) { + cfg += String.format(Locale.US, "tun-mtu %d\n", mTunMtu); } if (mNobind) @@ -580,7 +589,7 @@ public class VpnProfile implements Serializable, Cloneable { SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context); boolean usesystemproxy = prefs.getBoolean("usesystemproxy", true); - if (usesystemproxy && !mIsOpenVPN22) { + if (usesystemproxy && !mIsOpenVPN22 && !configForOvpn3) { cfg += "# Use system proxy setting\n"; cfg += "management-query-proxy\n"; } @@ -609,6 +618,11 @@ public class VpnProfile implements Serializable, Cloneable { return cfg; } + public String getPlatformVersionEnvString() { + return String.format(Locale.US, "%d %s %s %s %s %s", Build.VERSION.SDK_INT, Build.VERSION.RELEASE, + NativeUtils.getNativeAPI(), Build.BRAND, Build.BOARD, Build.MODEL); + } + public String getVersionEnvString(Context c) { String version = "unknown"; try { @@ -907,12 +921,12 @@ public class VpnProfile implements Serializable, Cloneable { if (mAuthenticationType == TYPE_KEYSTORE || mAuthenticationType == TYPE_USERPASS_KEYSTORE) { if (mAlias == null) return R.string.no_keystore_cert_selected; - } else if (mAuthenticationType == TYPE_CERTIFICATES || mAuthenticationType == TYPE_USERPASS_CERTIFICATES){ + } else if (mAuthenticationType == TYPE_CERTIFICATES || mAuthenticationType == TYPE_USERPASS_CERTIFICATES) { if (TextUtils.isEmpty(mCaFilename)) return R.string.no_ca_cert_selected; } - if (mCheckRemoteCN && mX509AuthType==X509_VERIFY_TLSREMOTE) + if (mCheckRemoteCN && mX509AuthType == X509_VERIFY_TLSREMOTE) return R.string.deprecated_tls_remote; if (!mUsePull || mAuthenticationType == TYPE_STATICKEYS) { @@ -948,6 +962,15 @@ public class VpnProfile implements Serializable, Cloneable { if (noRemoteEnabled) return R.string.remote_no_server_selected; + if (doUseOpenVPN3(context)) { + if (mAuthenticationType == TYPE_STATICKEYS) { + return R.string.openvpn3_nostatickeys; + } + if (mAuthenticationType == TYPE_PKCS12 || mAuthenticationType == TYPE_USERPASS_PKCS12) { + return R.string.openvpn3_pkcs12; + } + } + // Everything okay return R.string.no_error_found; @@ -1068,7 +1091,7 @@ public class VpnProfile implements Serializable, Cloneable { return mPrivateKey; } - public String getSignedData(String b64data) { + public String getSignedData(String b64data, boolean ecdsa) { PrivateKey privkey = getKeystoreKey(); byte[] data = Base64.decode(b64data, Base64.DEFAULT); @@ -1081,19 +1104,33 @@ public class VpnProfile implements Serializable, Cloneable { try { + @SuppressLint("GetInstance") + String keyalgorithm = privkey.getAlgorithm(); + + byte[] signed_bytes; + if (keyalgorithm.equals("EC")) { + Signature signer = Signature.getInstance("NONEwithECDSA"); + + signer.initSign(privkey); + signer.update(data); + signed_bytes = signer.sign(); + + } else { /* ECB is perfectly fine in this special case, since we are using it for the public/private part in the TLS exchange */ - @SuppressLint("GetInstance") - Cipher rsaSigner = Cipher.getInstance("RSA/ECB/PKCS1PADDING"); + Cipher signer; + signer = Cipher.getInstance("RSA/ECB/PKCS1PADDING"); + - rsaSigner.init(Cipher.ENCRYPT_MODE, privkey); + signer.init(Cipher.ENCRYPT_MODE, privkey); - byte[] signed_bytes = rsaSigner.doFinal(data); + signed_bytes = signer.doFinal(data); + } return Base64.encodeToString(signed_bytes, Base64.NO_WRAP); } catch (NoSuchAlgorithmException | InvalidKeyException | IllegalBlockSizeException - | BadPaddingException | NoSuchPaddingException e) { + | BadPaddingException | NoSuchPaddingException | SignatureException e) { VpnStatus.logError(R.string.error_rsa_sign, e.getClass().toString(), e.getLocalizedMessage()); return null; } -- cgit v1.2.3