yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] jcasares:
It seems that it doesn't work and I'm not clear about what the issue is. I'm using user+password authentication.

W/info.kghost.android.openvpn.OpenVpnService( 3856): Error generate pkcs12
W/info.kghost.android.openvpn.OpenVpnService( 3856): java.lang.NullPointerException: alias == null
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at android.security.KeyChain.getPrivateKey(KeyChain.java:291)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.prepare(OpenVpnService.java:123)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.doInBackground(OpenVpnService.java:313)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.doInBackground(OpenVpnService.java:44)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at android.os.AsyncTask$2.call(AsyncTask.java:264)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at java.util.concurrent.FutureTask.run(FutureTask.java:137)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
W/info.kghost.android.openvpn.OpenVpnService( 3856):	at java.lang.Thread.run(Thread.java:856)
D/dalvikvm( 2108): GC_CONCURRENT freed 433K, 28% free 10263K/14151K, paused 2ms+3ms
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856): alias == null
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856): java.lang.NullPointerException: alias == null
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at android.security.KeyChain.getPrivateKey(KeyChain.java:291)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.prepare(OpenVpnService.java:123)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.doInBackground(OpenVpnService.java:313)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at info.kghost.android.openvpn.OpenVpnService$Task.doInBackground(OpenVpnService.java:44)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at android.os.AsyncTask$2.call(AsyncTask.java:264)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at java.util.concurrent.FutureTask.run(FutureTask.java:137)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
F/info.kghost.android.openvpn.OpenVpnService$Task( 3856):	at java.lang.Thread.run(Thread.java:856)

Maybe you know why the alias==null happens.
[Android Apps and Games] zealot0630:
Seems there are still some problem when user certification is not set. I'll figure it out soon.
[Android Apps and Games] omriasta:
I'm guessing this applies to me too?
[Android Apps and Games] hamster79:
Hi Zealot!

Thank's for your work but I meant something different: :o

In github.com/kghost/ics-openvpn/blob/master/src/info/kghost/android/openvpn/OpenVpnService.java (line 96 and 97) you are already setting the config option "--ns-cert-type server". But on the server I'd like to logon to is a certificate without this "type server" information installed, so I can't log in (Error in the Log: "SSL3_GET_SERVER_CERTIFICATE: certificate verify failed").

So it would be great if could make THIS option optional (by adding a new setting item for it) or just remove it completely (if I get it right, anybody who want's to could readd it easily with the "Extra arguments" option you mentioned.

Thanks!
[Android Apps and Games] jaidee:
Will try this later. :)
[Android Apps and Games] zealot0630:
I have fix this in 0.9.2 please try.
[Android Apps and Games] jcasares:
I'm having the certificate issue now. I have the same certificate that I use in my PC's OpenVPN client. Copied error log here:

1335519191,D,MANAGEMENT: CMD 'state on all'
1335519191,D,MANAGEMENT: CMD 'hold release'
1335519191,D,MANAGEMENT: CMD 'username 'Auth' "jcasares2"'
1335519191,D,MANAGEMENT: CMD 'password [...]'
1335519191,W,NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
1335519191,,Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
1335519191,,Socket Buffers: R=[110592->131072] S=[110592->131072]
1335519191,,MANAGEMENT: >STATE:1335519191,RESOLVE,,,
1335519196,,Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
1335519196,,Local Options hash (VER=V4): '3514370b'
1335519196,,Expected Remote Options hash (VER=V4): '239669a8'
1335519196,I,UDPv4 link local: [undef]
1335519196,I,UDPv4 link remote: 190.2.X.X:1194
1335519196,,MANAGEMENT: >STATE:1335519196,WAIT,,,
1335519197,,MANAGEMENT: >STATE:1335519197,AUTH,,,
1335519197,,TLS: Initial packet from 190.2.X.X:1194, sid=8433cb96 fd61a9d5
1335519197,W,WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
1335519197,,VERIFY OK: depth=1, /C=IT/O=efw/CN=efw_CA
1335519197,,VERIFY nsCertType ERROR: /C=IT/O=efw/CN=127.0.0.1, require nsCertType=SERVER
1335519197,N,TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
1335519197,N,TLS Error: TLS object -> incoming plaintext read error
1335519197,N,TLS Error: TLS handshake failed
[Android Apps and Games] zealot0630:
Go to advance setting, set the "NS Cert Type" to client or None, and try connect again
[Android Apps and Games] jcasares:
It seems to connect if I set it to none but it crashes immediately after that. Can't even check if it works before the crash.
[Android Apps and Games] hamster79:
Hi Zealot! Work perfectly. The certificate isn't rejected any more, great!

But now I have another problem: the vpn-server is set up to use "auth md5" and your client seems to use "auth sha1". I tried to add "auth md5" as an extra option but this doesn't seam to help. Can I switch the "auth"-type somehow?
[Android Apps and Games] zealot0630:
The client didn't set auth by default, SHA1 is the default value. did you add '--auth md5' or 'auth md5' ? '--auth' should work, but 'auth' won't work.
[Android Apps and Games] zealot0630:
I have fixed the crash in 0.9.3, but there may be problems before the crash. Seems you are using tap mode in the server side, but this client don't support tap mode due to the android API.

W,WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'
W,WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1574'
W,WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
W,WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
[Android Apps and Games] jcasares:
Ok. Then I can't use this client as the server uses TAP. I thought it worked like other OpenVPN implementations (the ones I used on GB) and I missed the clarification in the opening post. Sorry for the confusion.
[Android Apps and Games] jalorod:
Problems creating profile

Hello,

First of all, thank you for your great work.

I have some problems for using the app (with android 4.0.3) in creating the profile for the vpn.

When I wan to select the ca certificate, it appears two links (to galley an music) so I can not select my ca.crt. How can I do?

When I want to select the user certificate, it says that does not exist and says that it is possible to install the p12 or pfx file (but i have only my .crt and .key file for the client). What can I do?

Thank you for your help,
[Android Apps and Games] omriasta:
install OI file manager or File Expert from the market which will allow you to "browse" your SD card for the crt. Also, open the crt file using notepad and make sure there is nothing before the line "Begin Certificate"
[Android Apps and Games] jalorod:
Thank you, in that way I could select the ca certificate (it gives me possibility to select it with OI now and reads it ok), but I can't with the client certificate (if I open it, it doesn't install anything and the app gives me the possibility to install a p12 file only...any help?

Thank you,
[Android Apps and Games] omriasta:
Not sure. I never used the client certificate. Let's see if the dev knows...
[Android Apps and Games] jalorod:
I got it! I converted my key and cert client files (witch ca cert) to a p12 file with openssl:

openssl pkcs12 -export -in input.crt -inkey input.key -certfile root.crt -out bundle.p12

and installed it with OI so I could select it ( I think it's a good idea some explanation about it in a guide for more novice users like me, because openvpn generates these files by default) .

I connected to the VPN, first failing but when activating lzo all seems working perfectly.

I will test these days but thank you very much, an vpn working without rooting...great!!!:D
[Android Apps and Games] zealot0630:
To select the cert you need a file browser, anyone in the market will work.

You must convert the crt/key to p12 or pfx, and install to android keystore, put the crt/key in sdcard is unsafe, every app can read your key without notifying you. there are many guides on how to convert crt/key to p12. I suggest xca, an openssl key management gui.
[Android Apps and Games] JustMan:
Redirect gateway

It seems that "redirect gateway" option does not work on CM9. I manage to connect, but the routing is the same as without tick on redirect gateway. According the attached log: ROUTE default_gateway=192.168.2.1 , but I tried with OpenVPN Settings from the market and it adds the right gateway in that case - 10.8.0.5 and everything is working as expected.
[Android Apps and Games] houlalajaimal:
Won't works with firefox or any networks app

Hi,

First of all, thank you for this application.

I had a problem with my personnal VPN.

I connect to my Vpn server and ping any computer in my local network within terminal.

I can traceroute a internet domain (www.google.com) thru my home internet box (all traffic goes to VPN link).

But the browser can't use the vpn link...

logcat when broser is in use:

W/NetworkStats( 1993): dropping UID delta from unknown iface: iface=tun0 uid=0 set=DEFAULT tag=0x0 rxBytes=220 rxPackets=4 txBytes=116 txPackets=2 operations=0

traceroute in termial...

traceroute to www.google.com (173.194.34.48), 30 hops max, 38 byte packets

1 10.8.0.1 (10.8.0.1) 137.811 ms 158.845 ms 139.283 ms

2 192.168.0.254 (192.168.0.254) 139.993 ms 148.470 ms 160.426 ms

3 78.235.121.254 (78.235.121.254) 178.851 ms 152.362 ms 178.097 ms

4 213.228.22.62 (213.228.22.62) 170.730 ms 151.611 ms 149.805 ms

5 strasbourg-6k-1-v808.intf.routers.proxad.net (212.27.56.113) 169.154 ms 161.769 ms 169.251 ms

6 strasbourg-crs8-1-be1001.intf.routers.proxad.net (78.254.250.217) 159.353 ms 168.398 ms 149.071 ms

7 th2-crs16-1-be1101.intf.routers.proxad.net (212.27.50.9) 180.198 ms 168.961 ms 163.773 ms

8 te0-2-0-3.330.ccr21.par04.atlas.cogentco.com (149.6.164.221) 155.283 ms 142.020 ms 149.593 ms

9 te0-5-0-4.mpd21.par01.atlas.cogentco.com (130.117.48.253) 159.697 ms te0-2-0-4.mpd21.par01.atlas.cogentco.com (130.117.50.145) 148.610 ms te0-1-0-4.mpd21.par01.atlas.cogentco.com (130.117.2.77) 148.866 ms

10 te0-2-0-0.mpd21.fra03.atlas.cogentco.com (130.117.3.169) 168.872 ms te0-3-0-0.mpd21.fra03.atlas.cogentco.com (154.54.36.125) 158.665 ms te0-0-0-0.mpd21.fra03.atlas.cogentco.com (130.117.1.241) 151.300 ms

11 aurora-tel-ltd.demarc.cogentco.com (149.6.140.58) 553.963 ms 545.850 ms 539.816 ms

12 209.85.255.172 (209.85.255.172) 151.964 ms 209.85.255.170 (209.85.255.170) 168.884 ms 209.85.240.64 (209.85.240.64) 153.517 ms

13 72.14.239.60 (72.14.239.60) 169.100 ms 72.14.239.62 (72.14.239.62) 160.233 ms 158.881 ms

14 72.14.235.17 (72.14.235.17) 169.349 ms 169.769 ms 158.856 ms

15 209.85.242.47 (209.85.242.47) 159.692 ms 158.690 ms 169.409 ms

16 par03s03-in-f16.1e100.net (173.194.34.48) 150.074 ms 168.980 ms 180.164 ms
[Android Apps and Games] zealot0630:
Thank you for reporting, Fixed in 0.9.4
[Android Apps and Games] zealot0630:
I'm afraid I can't identify the problem.

W/NetworkStats( 1993): dropping UID delta from unknown iface: iface=tun0 uid=0 set=DEFAULT tag=0x0 rxBytes=220 rxPackets=4 txBytes=116 txPackets=2 operations=0

This only affect statistics.

Maybe the routing table cache isn't flushed when connected. Try run

ip route show table cache

to check your routing table cache when vpn is connected. As not root, my app can't do anything with the routing table.
[Android Apps and Games] JustMan:
Hello zealot0630,

I tried the new version 0.9.4 and it adds routing, but dev tun0 is with link/none. To make things comparable I used other device with CM7 as reference, because "OpenVPN settings" adds different routing. I connected both devices (CM7 and CM9) to my server (one by one in order, not both in the same time) with same key and settings and checked the routing and interfaces. As you can see in the attached outputs on both device I have dev tun0 with different parameters and different routing. I hope it will help you to resolve the issue. If you have some questions, please do not hesitate to ask me. Thanks for your time and development!
[Android Apps and Games] zealot0630:
The tun device is created by andoid API, the app can't control how it is created. But there is no problem with link/none type, this is my link/route which works perfectly:

root@bcm:/# ip ad li tun0
23: tun0: <POINTOPOINT,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/none
inet 192.168.157.10/32 scope global tun0
root@bcm:/# ip ro
192.168.180.1 dev wlan0 scope link
192.168.157.1 dev tun0 scope link
192.168.180.0/22 dev wlan0 proto kernel scope link src 192.168.182.63 metric 318
0.0.0.0/1 dev tun0 scope link
128.0.0.0/1 dev tun0 scope link
default via 192.168.180.1 dev wlan0
default via 192.168.180.1 dev wlan0 metric 318

I don't think there is anything wrong with tun and routing table settings. Can you check your route cache, conntract table and iptables settings ?

# route cache
ip route show table cache
# conntract (need root)
cat /proc/net/ip_conntrack
# iptables (need root)
iptables -S -t
iptables -S -t nat
iptables -S -t mangle
[Android Apps and Games] JustMan:
Hm ... It is interesting. Your routing and link are the same as mine... Please find attached information plus one screenshot on which you can see that I do not received anything and of course the VPN drops. I have no idea why ... but with "OpenVPN settings" application it is working, so the problem is not on the server side. Could you please compare my iptables settings and contract table with yours. I tried to flush route cache, but it did not help.
[Android Apps and Games] rgawenda:
Even if the problem isn't on the server side, can you compare the server logs from both connections?
[Android Apps and Games] JustMan:
It was good point :), but on both connections the logs are the same :confused:. Excluding that the first connection dropped due inactivity timeout (because does not work) and second was disconnected by me. The logs were attached.
[Android Apps and Games] zealot0630:
Seems you enabled LZO compression on the server side, but not on the client side ?
[Android Apps and Games] JustMan:
Thank you very much for your time, development and help!!!

That was the problem exactly. Now it is solved and everything is working as expected.
[Android Apps and Games] kkkhattak:
when i open application it says cant install openvpn
[Android Apps and Games] zealot0630:
Can you provide logcat info ?
[Android Apps and Games] kkkhattak:
Of my phone or application..........
[Android Apps and Games] zealot0630:
Is there any detail info in the error box ?
[Android Apps and Games] bakasani:
Success

I have to thank you for this app, it works perfect on my stock firmware galaxy s2 running ICS 4.03 connecting to an SBS2003 server running openvpn as a service and no need to root my handset, brilliant!

It all started when I was happily using the stock Android l2tp/IPsec vpn client with Gingerbread, then I upgraded to ICS 4.03 via Samsung Kies and ICS broke my l2tp VPN, was I gutted about that and theres no apparent proper fix (that I could find) without rooting :mad:

Until I found this that is, I am now happy again :)

Thanks again, just wanted to report success..
[Android Apps and Games] fmonster:
Hi,

I am unable to connect. The CA certificate loads fine but I get "tls handshake failed'.

I have a tlsauth.key file for my desktop OpenVPN that contains this below but I don't know how to import that into this OpenVPN?

#

# 2048 bit OpenVPN static key

#

-----BEGIN OpenVPN Static key V1-----

blabla

-----END OpenVPN Static key V1-----
[Android Apps and Games] bakasani:
I uploaded my key to my phone then in openvpn advanced settings there is a setting that allows you to select the key location
[Android Apps and Games] fmonster:
Thanks! I was able to import the .key file, but now OpenVPN does not connect and it does not even try: the log is always empty.

!?

Are there other log files that don't show up in the UI so I can try and look at what crashes?
[Android Apps and Games] zealot0630:
Is there any error notify ? And you can get more information by logcat
[Android Apps and Games] mormo:
Works on (not rooted )Htc one X :D Thanks :)
[Android Apps and Games] bgaborchen:
If you are trying to build the android application yourself:

I noticed that after downloading the sources from git, the openvpn ELF file is missing from the assets folder, and it causes the "can't install openvpn" message to appear.

I added the missing file from the latest apk and it works fine (you can find the apk in the downloads section of ics-openvpn)

Also, reading the README.md file from the project can help
[Android Apps and Games] fmonster:
Hi. No errors in that log. I unselected and re-entered the auth key and this time the log finally started logging, but the TLS auth times out.

I installed a cyanogenmod ICS build and the VPN that comes with it works!
[Android Apps and Games] D0bb1n:
One way traffic

First of all thanks for the effort put into this its greatly appreciated.

Yes, I've watched the Noob video, yes I'm a noob.

Yes, I've searched found lots of interesting bits but no direct hits.

HTC Senstation, on UK Vodafone

Running stock 4.0.3 its not rooted.

OpenVPN 0.9.4

The connection comes up fine. But traffic only works in one direction.

i.e. if I ping from Server to Phone, openvpn clocks up received packets but not sent packets. The Server doesn't receive any packets back either.

I've tried enabling "Redirect gateway" it does change the routing table as shown below.

With "Redirect gateway"

0.0.0.0/1 dev tun0 scope link

default via 192.168.108.2 dev wlan0

default via 192.168.108.2 dev wlan0 metric 314

0.0.0.0/1 dev tun0 scope link

192.168.108.0/24 dev wlan0 proto kernel scope link src 192.168.108.186 metric 314

192.168.108.2 dev wlan0 scope link

192.168.121.0/24 dev tun0 scope link

192.168.122.1 dev tun0 scope link

Without "Redirect gateway"

default via 192.168.108.2 dev wlan0

default via 192.168.108.2 dev wlan0 metric 314

0.0.0.0/1 dev tun0 scope link

192.168.108.0/24 dev wlan0 proto kernel scope link src 192.168.108.186 metric 314

192.168.108.2 dev wlan0 scope link

192.168.121.0/24 dev tun0 scope link

192.168.122.1 dev tun0 scope link

I've seen in the older implementation there is an option to fix htc routes, and I've seen scripts and commands. But these older approaches assume you have rooted your phone.

Am I missing something here ?

Thanks in advance for any help or advice.

Dobbs.
[Android Apps and Games] zealot0630:
There is something wrong with your routing table, can you paste your routing table BEFORE connect and the vpn log ?
[Android Apps and Games] arjunking:
Is there any way to remove the lockscreen and still use this app.

It has forced the lockscreen on it.

And can there be an option to remember the password ?

Thanks for the wonderful app
[Android Apps and Games] bakasani:
+1

Just what I would like as well if it could be an option would be great?

Regards
[Android Apps and Games] rgawenda:
No, it isn't, as this is how android works. If you want to use the security provided by the system, the system imposes that requirement back to you.
[Android Apps and Games] Luxferro:
Can anyone help me out? I can connect to my openvpn server (on my tomato router), but I can't get traffic through.

Is anyone using tomato as their server? If so can you share how you have it setup?

in the logs of this android app I see:

P:OpenVPN 2.3_alpha1 arm-linux-androideabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [PF_INET6] [IPv6 payload 20110522-1 (2.2.0)] built on Jun 3 2012
P:NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Network Status: CONNECTED to WIFI null
P:WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
P:UDPv4 link local: [undef]
P:UDPv4 link remote: [AF_INET]**my_wan_ip**:1194
P:[LOU_VPN_SERVER] Peer Connection Initiated with [AF_INET]192.168.1.1:1194
P:OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
P:OpenVPN ROUTE: failed to parse/resolve route for host/network: ::/0
P:do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
P:Initialization Sequence Completed

below is a picture of my router when I connect from work. It connects, but I still get the same errors in the above logs, and no traffic gets through.
[Android Apps and Games] plaisthos:
You are posting in wrong thread. The right thread for the openvpn app from the market is http://xdaforums.com/showthread.php?t=1591258.

But still:

What does "show connection information" show if you are connected? Which mobile phone are you using?
[Android Apps and Games] Luxferro:
It shows that I've sent packets, but haven't received any. I'm on a Galaxy Nexus using CM9.

My guess is it's something on the server end that I need to configure... But I have no real experience with openVPN and have been just following guides I've found on the net. In my previous post is a picture of my server config in tomato, do you see anything wrong there? Or anything else I need to do somewhere else in the router?

edit: I even tried adding this to custom config on server side

push "redirect-gateway def1"

When I try to load a webpage all I see in the logs are stuff like:

P:WWrWrWrWr..........................WRwwrite to TUN/TAP: Invalid argument (code=22)