Configuring of ikev2

Merge remote-tracking branch 'origin/feature/ikev2_android' into feature/ikev2_android
Start logic
2026-05-30 23:31:14 +03:00 · 2023-07-07 14:19:03 +03:00 · 2023-04-24 15:42:18 +03:00 · 2023-04-24 15:41:24 +03:00 · 2023-04-24 13:19:23 +03:00 · 2023-04-24 13:18:09 +03:00
188 changed files with 6541 additions and 3912 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,4 +2,3 @@ deploy/data/windows/x64/tap/windows_7/OemVista.inf eol=crlf
 deploy/data/windows/x64/tap/windows_10/OemVista.inf eol=crlf
 deploy/data/windows/x32/tap/windows_7/OemVista.inf eol=crlf
 deploy/data/windows/x32/tap/windows_10/OemVista.inf eol=crlf
-client/3rd/* linguist-vendored
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest

    env:
-      QT_VERSION: 6.5.0
+      QT_VERSION: 6.4.1
      QIF_VERSION: 4.5

    steps:
@@ -63,7 +63,7 @@ jobs:
    runs-on: windows-latest

    env:
-      QT_VERSION: 6.5.0
+      QT_VERSION: 6.4.1
      QIF_VERSION: 4.5
      BUILD_ARCH: 64

@@ -124,7 +124,8 @@ jobs:
    runs-on: macos-latest

    env:
-      QT_VERSION: 6.5.0
+      QT_VERSION: 6.4.1
+      QIF_VERSION: 4.4

    steps:
    - name: 'Setup xcode'
@@ -138,18 +139,18 @@ jobs:
        version: ${{ env.QT_VERSION }}
        host: 'mac'
        target: 'desktop'
-        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
        arch: 'clang_64'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
        dir: ${{ runner.temp }}
        set-env: 'true'

-    - name: 'Install iOS Qt'
+    - name: 'Install ios Qt'
      uses: jurplel/install-qt-action@v3
      with:
        version: ${{ env.QT_VERSION }}
        host: 'mac'
        target: 'ios'
-        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
        dir: ${{ runner.temp }}
        setup-python: 'true'
        set-env: 'true'
@@ -199,7 +200,7 @@ jobs:
    runs-on: macos-latest

    env:
-      QT_VERSION: 6.5.0
+      QT_VERSION: 6.4.1
      QIF_VERSION: 4.5

    steps:
@@ -262,7 +263,8 @@ jobs:
        arch: ['android_x86_64', 'android_x86'] #, 'android_armv7', 'android_arm64_v8a']

    env:
-      QT_VERSION: 6.5.0
+      QT_VERSION: 6.4.1
+      QIF_VERSION: 4.5

    steps:
    - name: 'Install desktop Qt'
@@ -291,11 +293,6 @@ jobs:
        set-env: 'true'
        extra: '--external 7z'

-    - name: 'Install GO'
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.17
-
    - name: 'Get sources'
      uses: actions/checkout@v3
      with:
--- a/.gitignore
+++ b/.gitignore
@@ -129,4 +129,4 @@ captures/
 client/3rd/ShadowSocks/ss_ios.xcconfig

 # UML generated pics
-out/
+out/
--- a/.gitmodules
+++ b/.gitmodules
@@ -6,7 +6,7 @@
 	url = https://github.com/WireGuard/wireguard-apple
 [submodule "client/3rd/OpenVPNAdapter"]
 	path = client/3rd/OpenVPNAdapter
-	url = https://github.com/amnezia-vpn/OpenVPNAdapter.git
+	url = https://github.com/ss-abramchuk/OpenVPNAdapter.git
 [submodule "client/3rd/ShadowPath"]
 	path = client/3rd/ShadowPath
 	url = https://github.com/qman9501/ShadowPath
@@ -28,33 +28,15 @@
 [submodule "client/3rd/zlib"]
 	path = client/3rd/zlib
 	url = https://github.com/madler/zlib.git
+[submodule "deploy/amnezia-ios-certificates"]
+	path = deploy/amnezia-ios-certificates
+	url = https://github.com/amnezia-vpn/amnezia-ios-certificates.git
 [submodule "client/3rd/SortFilterProxyModel"]
 	path = client/3rd/SortFilterProxyModel
 	url = https://github.com/mitchcurtis/SortFilterProxyModel.git
-[submodule "client/android/cpp/openvpn3"]
-	path = client/android/cpp/openvpn3
-	url = https://github.com/amnezia-vpn/openvpn3.git
-[submodule "client/android/cpp/asio"]
-	path = client/android/cpp/asio
-	url = https://github.com/chriskohlhoff/asio
-[submodule "client/android/cpp/lz4"]
-	path = client/android/cpp/lz4
-	url = https://github.com/lz4/lz4.git
-[submodule "client/android/cpp/mbedtls"]
-	path = client/android/cpp/mbedtls
-	url = https://github.com/ARMmbed/mbedtls.git
-[submodule "client/android/cpp/openvpn"]
-	path = client/android/cpp/openvpn
-	url = https://github.com/schwabe/openvpn.git
-[submodule "client/android/cpp/openssl"]
-	path = client/android/cpp/openssl
-	url = https://github.com/schwabe/platform_external_openssl.git
-[submodule "client/android/cpp/cloak"]
-	path = client/android/cpp/cloak
-	url = https://github.com/amnezia-vpn/Cloak
-[submodule "client/android/cpp/lzo"]
-	path = client/android/cpp/lzo
-	url = https://github.com/amnezia-vpn/lzo.git
+[submodule "client/3rd/strongswan/sources"]
+	path = client/3rd/strongswan/sources
+	url = https://github.com/kolobchanin/strongswan.git
 [submodule "client/3rd/mbedtls"]
 	path = client/3rd/mbedtls
 	url = https://github.com/Mbed-TLS/mbedtls.git
--- a/.gitpod.Dockerfile
+++ b/.gitpod.Dockerfile
@@ -1,47 +0,0 @@
-FROM gitpod/workspace-full-vnc
-
-USER gitpod
-
-RUN sudo apt-get -q update \
-    && sudo apt-get install -yq \
-        build-essential \
-        libgl1-mesa-dev \
-        libgstreamer-gl1.0-0 \
-        libpulse-dev \
-        libsecret-1-dev \
-        libxcb-glx0 \
-        libxcb-icccm4 \
-        libxcb-image0 \
-        libxcb-keysyms1 \
-        libxcb-randr0 \
-        libxcb-render-util0 \
-        libxcb-render0 \
-        libxcb-shape0 \
-        libxcb-shm0 \
-        libxcb-sync1 \
-        libxcb-util1 \
-        libxcb-xfixes0 \
-        libxcb-xinerama0 \
-        libxcb1 \
-        libxkbcommon-dev \
-        libxkbcommon-x11-0 \
-        libxcb-xkb-dev \
-        p7zip-full \
-    && sudo rm -rf /var/lib/apt/lists/*
-
-RUN sudo pip3 install aqtinstall
-
-ARG QT_VERSION=6.4.1
-ARG QT_ARCH=gcc_64
-
-ARG QT_DIR=/opt/qt
-RUN sudo aqt install-qt --outputdir ${QT_DIR} linux desktop ${QT_VERSION} ${QT_ARCH} --modules \
-    qtremoteobjects \
-    qt5compat \
-    qtshadertools
-ENV QT_BIN_DIR=${QT_DIR}/${QT_VERSION}/${QT_ARCH}/bin
-
-ARG QIF_VERSION=4.5
-ARG QIF_DIR=/opt/qif
-RUN sudo aqt install-tool --outputdir ${QIF_DIR} linux desktop tools_ifw
-ENV QIF_BIN_DIR=${QIF_DIR}/Tools/QtInstallerFramework/${QIF_VERSION}/bin
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -1,8 +0,0 @@
-tasks:
- init: >-
-    deploy/build_linux.sh
-image:
-  file: .gitpod.Dockerfile
-vscode:
-  extensions:
-  - llvm-vs-code-extensions.vscode-clangd
--- a/3rd/QtSsh
+++ b/3rd/QtSsh
--- a/AmneziaVPN.pro
+++ b/AmneziaVPN.pro
@@ -0,0 +1,6 @@
+TEMPLATE = subdirs
+SUBDIRS = client
+
+!ios:!android {
+   SUBDIRS += service
+}
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,13 +1,7 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

 set(PROJECT AmneziaVPN)
-
-project(${PROJECT} VERSION 3.0.7.4
-        DESCRIPTION "AmneziaVPN"
-        HOMEPAGE_URL "https://amnezia.org/"
-)
-set(RELEASE_DATE "2023-05-15")
-set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
+project(${PROJECT})

 if(ANDROID)
    set(QT_ANDROID_BUILD_ALL_ABIS ON)
@@ -21,6 +15,4 @@ add_subdirectory(client)

 if(NOT IOS AND NOT ANDROID)
    add_subdirectory(service)
-
-    include(${CMAKE_SOURCE_DIR}/deploy/installer/config.cmake)
 endif()
--- a/README.md
+++ b/README.md
@@ -1,16 +1,16 @@
 # Amnezia VPN
 ## _The best client for self-hosted VPN_

-[![Build Status](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml/badge.svg?branch=dev)](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml?query=branch:dev)
-[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/amnezia-vpn/amnezia-client)
+[![Build Status](https://github.com/amnezia-vpn/desktop-client/actions/workflows/deploy.yml/badge.svg?branch=dev)]

 Amnezia is a VPN client with the key feature of deploying your own VPN server on you virtual server.

 ## Features
 - Very easy to use - enter your ip address, ssh login and password, and Amnezia client will automatically install VPN docker containers to your server and connect to VPN.
- OpenVPN, ShadowSocks, WireGuard, IKEv2 protocols support.
- Split tunneling support - add any sites to client to enable VPN only for them (only for desktops)
- Windows, MacOS, Linux, Android, iOS releases.
+- OpenVPN and OpenVPN over ShadowSocks protocols support. 
+- Custom VPN routing mode support - add any sites to client to enable VPN only for them.
+- Windows and MacOS support.
+- Unsecure sharing connection profile for family use.

 ## Tech

@@ -20,7 +20,7 @@ AmneziaVPN uses a number of open source projects to work:
 - [OpenVPN](https://openvpn.net/)
 - [ShadowSocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
- [LibSsh](https://libssh.org) - forked form Qt Creator
+- [QtSsh](https://github.com/jaredtao/QtSsh) - forked form Qt Creator
 - and more...

 ## Checking out the source code
@@ -36,35 +36,39 @@ git submodule update --init
 Want to contribute? Welcome!

 ### Building sources and deployment
-Look deploy folder for build scripts. 
+Easiest way to build your own executables - is to fork project and configure [Travis CI](https://travis-ci.com/)  
+Or you can build sources manually using Qt Creator. Qt >= 14.2 supported.  
+Look to the `build_macos.sh` and `build_windows.bat` scripts in `deploy` folder for details.

 ### How to build iOS app from source code on MacOS

-1. First, make sure you have [XCode](https://developer.apple.com/xcode/) installed, at least version 14 or higher.
+1. First, make sure you have [XCode](https://developer.apple.com/xcode/) installed, 
+at least version 12 or higher.

-2. We use QT to generate the XCode project. we need QT version 6.4. Install QT for macos in [here](https://doc.qt.io/qt-6/macos.html)
-
-3. Install cmake is require. We recommend cmake version 3.25. You can install cmake in [here](https://cmake.org/download/)
-
-4. You also need to install go >= v1.16. If you don't have it done already,
+2. We use `qmake` to generate the XCode project and then we "patch" it to add
+extra components such as the wireguard, the browser bridge and so on. We patch
+the XCode project using [xcodeproj](https://github.com/CocoaPods/Xcodeproj). To
+install it:
+```bash
+gem install xcodeproj # probably you want to run this command with `sudo`
+```
+3. You also need to install go >= v1.16. If you don't have it done already,
 download go from the [official website](https://golang.org/dl/) or use Homebrew. 
-Latest version is recommended. Install gomobile
+Latest version is recommended.
+
+4. Navigate inside client folder and generate the XCode project using our script:
 ```bash
-export PATH=$PATH:~/go/bin
-go install golang.org/x/mobile/cmd/gomobile@latest
-gomobile init
+cd client
+./scripts/apple_compile.sh ios
 ```

-5. Build project
+If you have more than one version of Qt installed, you'll most likely get
+a "`qmake` cannot be found in your `$PATH`" error. In this case run this script 
+using QT\IOS\_BIN env to set the path for the Qt5 macos build bin folder.
+For example, the path could look like this:
 ```bash
-export QT_BIN_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/ios/bin"
-export QT_IOS_BIN=$QT_BIN_DIR
-export PATH=$PATH:~/go/bin
-mkdir build-ios
-$QT_IOS_BIN/qt-cmake . -B build-ios -GXcode -DQT_HOST_PATH=$QT_BIN_DIR
+QT_IOS_BIN="/Users/username/Qt/6.4.1/ios/bin" ./scripts/apple_compile.sh ios
 ```
-Replace PATH-TO-QT-FOLDER and QT-VERSION to your environment
-

 If you get `gomobile: command not found` make sure to set PATH to the location 
 of the bin folder where gomobile was installed. Usually, it's in `GOPATH`.
@@ -72,7 +76,7 @@ of the bin folder where gomobile was installed. Usually, it's in `GOPATH`.
 export PATH=$(PATH):/path/to/GOPATH/bin
 ```

-5. Open XCode project. You can then run/test/archive/ship the app.
+5. Xcode should automatically open. You can then run/test/archive/ship the app.

 If build fails with the following error
 ```
--- a/client/3rd/OpenVPNAdapter
+++ b/client/3rd/OpenVPNAdapter
--- a/client/3rd/strongswan/sources
+++ b/client/3rd/strongswan/sources
--- a/client/3rd/strongswan/strongswan.cmake
+++ b/client/3rd/strongswan/strongswan.cmake
@@ -0,0 +1,20 @@
+include(ExternalProject)
+
+set(STRONGSWAN_SOURCES_ROOT ${CMAKE_CURRENT_LIST_DIR}/sources)
+
+ExternalProject_Add(
+    strongswan
+    UPDATE_DISCONNECTED true
+    CONFIGURE_HANDLED_BY_BUILD true
+    PREFIX ${STRONGSWAN_SOURCES_ROOT}
+    SOURCE_DIR ${STRONGSWAN_SOURCES_ROOT}
+    BINARY_DIR ${STRONGSWAN_SOURCES_ROOT}
+    INSTALL_DIR ${STRONGSWAN_SOURCES_ROOT}
+    STAMP_DIR ${STRONGSWAN_SOURCES_ROOT}/stamp
+    LOG_DIR ${STRONGSWAN_SOURCES_ROOT}/log
+    TMP_DIR ${STRONGSWAN_SOURCES_ROOT}/tmp
+    CONFIGURE_COMMAND ./autogen.sh
+    COMMAND ./configure --disable-kernel-netlink
+    BUILD_COMMAND make #dist
+    INSTALL_COMMAND ""
+)
--- a/client/AmneziaVPN-Swift.h
+++ b/client/AmneziaVPN-Swift.h
@@ -0,0 +1,249 @@
+#ifndef AmneziaVPN_Swift_h
+#define AmneziaVPN_Swift_h
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wgcc-compat"
+
+#if !defined(__has_include)
+# define __has_include(x) 0
+#endif
+#if !defined(__has_attribute)
+# define __has_attribute(x) 0
+#endif
+#if !defined(__has_feature)
+# define __has_feature(x) 0
+#endif
+#if !defined(__has_warning)
+# define __has_warning(x) 0
+#endif
+
+#if __has_include(<swift/objc-prologue.h>)
+# include <swift/objc-prologue.h>
+#endif
+
+#pragma clang diagnostic ignored "-Wauto-import"
+#include <Foundation/Foundation.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#if !defined(SWIFT_TYPEDEFS)
+# define SWIFT_TYPEDEFS 1
+# if __has_include(<uchar.h>)
+#  include <uchar.h>
+# elif !defined(__cplusplus)
+typedef uint_least16_t char16_t;
+typedef uint_least32_t char32_t;
+# endif
+typedef float swift_float2  __attribute__((__ext_vector_type__(2)));
+typedef float swift_float3  __attribute__((__ext_vector_type__(3)));
+typedef float swift_float4  __attribute__((__ext_vector_type__(4)));
+typedef double swift_double2  __attribute__((__ext_vector_type__(2)));
+typedef double swift_double3  __attribute__((__ext_vector_type__(3)));
+typedef double swift_double4  __attribute__((__ext_vector_type__(4)));
+typedef int swift_int2  __attribute__((__ext_vector_type__(2)));
+typedef int swift_int3  __attribute__((__ext_vector_type__(3)));
+typedef int swift_int4  __attribute__((__ext_vector_type__(4)));
+typedef unsigned int swift_uint2  __attribute__((__ext_vector_type__(2)));
+typedef unsigned int swift_uint3  __attribute__((__ext_vector_type__(3)));
+typedef unsigned int swift_uint4  __attribute__((__ext_vector_type__(4)));
+#endif
+
+#if !defined(SWIFT_PASTE)
+# define SWIFT_PASTE_HELPER(x, y) x##y
+# define SWIFT_PASTE(x, y) SWIFT_PASTE_HELPER(x, y)
+#endif
+#if !defined(SWIFT_METATYPE)
+# define SWIFT_METATYPE(X) Class
+#endif
+#if !defined(SWIFT_CLASS_PROPERTY)
+# if __has_feature(objc_class_property)
+#  define SWIFT_CLASS_PROPERTY(...) __VA_ARGS__
+# else
+#  define SWIFT_CLASS_PROPERTY(...)
+# endif
+#endif
+
+#if __has_attribute(objc_runtime_name)
+# define SWIFT_RUNTIME_NAME(X) __attribute__((objc_runtime_name(X)))
+#else
+# define SWIFT_RUNTIME_NAME(X)
+#endif
+#if __has_attribute(swift_name)
+# define SWIFT_COMPILE_NAME(X) __attribute__((swift_name(X)))
+#else
+# define SWIFT_COMPILE_NAME(X)
+#endif
+#if __has_attribute(objc_method_family)
+# define SWIFT_METHOD_FAMILY(X) __attribute__((objc_method_family(X)))
+#else
+# define SWIFT_METHOD_FAMILY(X)
+#endif
+#if __has_attribute(noescape)
+# define SWIFT_NOESCAPE __attribute__((noescape))
+#else
+# define SWIFT_NOESCAPE
+#endif
+#if __has_attribute(ns_consumed)
+# define SWIFT_RELEASES_ARGUMENT __attribute__((ns_consumed))
+#else
+# define SWIFT_RELEASES_ARGUMENT
+#endif
+#if __has_attribute(warn_unused_result)
+# define SWIFT_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
+#else
+# define SWIFT_WARN_UNUSED_RESULT
+#endif
+#if __has_attribute(noreturn)
+# define SWIFT_NORETURN __attribute__((noreturn))
+#else
+# define SWIFT_NORETURN
+#endif
+#if !defined(SWIFT_CLASS_EXTRA)
+# define SWIFT_CLASS_EXTRA
+#endif
+#if !defined(SWIFT_PROTOCOL_EXTRA)
+# define SWIFT_PROTOCOL_EXTRA
+#endif
+#if !defined(SWIFT_ENUM_EXTRA)
+# define SWIFT_ENUM_EXTRA
+#endif
+#if !defined(SWIFT_CLASS)
+# if __has_attribute(objc_subclassing_restricted)
+#  define SWIFT_CLASS(SWIFT_NAME) SWIFT_RUNTIME_NAME(SWIFT_NAME) __attribute__((objc_subclassing_restricted)) SWIFT_CLASS_EXTRA
+#  define SWIFT_CLASS_NAMED(SWIFT_NAME) __attribute__((objc_subclassing_restricted)) SWIFT_COMPILE_NAME(SWIFT_NAME) SWIFT_CLASS_EXTRA
+# else
+#  define SWIFT_CLASS(SWIFT_NAME) SWIFT_RUNTIME_NAME(SWIFT_NAME) SWIFT_CLASS_EXTRA
+#  define SWIFT_CLASS_NAMED(SWIFT_NAME) SWIFT_COMPILE_NAME(SWIFT_NAME) SWIFT_CLASS_EXTRA
+# endif
+#endif
+#if !defined(SWIFT_RESILIENT_CLASS)
+# if __has_attribute(objc_class_stub)
+#  define SWIFT_RESILIENT_CLASS(SWIFT_NAME) SWIFT_CLASS(SWIFT_NAME) __attribute__((objc_class_stub))
+#  define SWIFT_RESILIENT_CLASS_NAMED(SWIFT_NAME) __attribute__((objc_class_stub)) SWIFT_CLASS_NAMED(SWIFT_NAME)
+# else
+#  define SWIFT_RESILIENT_CLASS(SWIFT_NAME) SWIFT_CLASS(SWIFT_NAME)
+#  define SWIFT_RESILIENT_CLASS_NAMED(SWIFT_NAME) SWIFT_CLASS_NAMED(SWIFT_NAME)
+# endif
+#endif
+
+#if !defined(SWIFT_PROTOCOL)
+# define SWIFT_PROTOCOL(SWIFT_NAME) SWIFT_RUNTIME_NAME(SWIFT_NAME) SWIFT_PROTOCOL_EXTRA
+# define SWIFT_PROTOCOL_NAMED(SWIFT_NAME) SWIFT_COMPILE_NAME(SWIFT_NAME) SWIFT_PROTOCOL_EXTRA
+#endif
+
+#if !defined(SWIFT_EXTENSION)
+# define SWIFT_EXTENSION(M) SWIFT_PASTE(M##_Swift_, __LINE__)
+#endif
+
+#if !defined(OBJC_DESIGNATED_INITIALIZER)
+# if __has_attribute(objc_designated_initializer)
+#  define OBJC_DESIGNATED_INITIALIZER __attribute__((objc_designated_initializer))
+# else
+#  define OBJC_DESIGNATED_INITIALIZER
+# endif
+#endif
+#if !defined(SWIFT_ENUM_ATTR)
+# if defined(__has_attribute) && __has_attribute(enum_extensibility)
+#  define SWIFT_ENUM_ATTR(_extensibility) __attribute__((enum_extensibility(_extensibility)))
+# else
+#  define SWIFT_ENUM_ATTR(_extensibility)
+# endif
+#endif
+#if !defined(SWIFT_ENUM)
+# define SWIFT_ENUM(_type, _name, _extensibility) enum _name : _type _name; enum SWIFT_ENUM_ATTR(_extensibility) SWIFT_ENUM_EXTRA _name : _type
+# if __has_feature(generalized_swift_name)
+#  define SWIFT_ENUM_NAMED(_type, _name, SWIFT_NAME, _extensibility) enum _name : _type _name SWIFT_COMPILE_NAME(SWIFT_NAME); enum SWIFT_COMPILE_NAME(SWIFT_NAME) SWIFT_ENUM_ATTR(_extensibility) SWIFT_ENUM_EXTRA _name : _type
+# else
+#  define SWIFT_ENUM_NAMED(_type, _name, SWIFT_NAME, _extensibility) SWIFT_ENUM(_type, _name, _extensibility)
+# endif
+#endif
+#if !defined(SWIFT_UNAVAILABLE)
+# define SWIFT_UNAVAILABLE __attribute__((unavailable))
+#endif
+#if !defined(SWIFT_UNAVAILABLE_MSG)
+# define SWIFT_UNAVAILABLE_MSG(msg) __attribute__((unavailable(msg)))
+#endif
+#if !defined(SWIFT_AVAILABILITY)
+# define SWIFT_AVAILABILITY(plat, ...) __attribute__((availability(plat, __VA_ARGS__)))
+#endif
+#if !defined(SWIFT_WEAK_IMPORT)
+# define SWIFT_WEAK_IMPORT __attribute__((weak_import))
+#endif
+#if !defined(SWIFT_DEPRECATED)
+# define SWIFT_DEPRECATED __attribute__((deprecated))
+#endif
+#if !defined(SWIFT_DEPRECATED_MSG)
+# define SWIFT_DEPRECATED_MSG(...) __attribute__((deprecated(__VA_ARGS__)))
+#endif
+#if __has_feature(attribute_diagnose_if_objc)
+# define SWIFT_DEPRECATED_OBJC(Msg) __attribute__((diagnose_if(1, Msg, "warning")))
+#else
+# define SWIFT_DEPRECATED_OBJC(Msg) SWIFT_DEPRECATED_MSG(Msg)
+#endif
+#if !defined(IBSegueAction)
+# define IBSegueAction
+#endif
+#if __has_feature(modules)
+#if __has_warning("-Watimport-in-framework-header")
+#pragma clang diagnostic ignored "-Watimport-in-framework-header"
+#endif
+@import Foundation;
+@import ObjectiveC;
+#endif
+
+#pragma clang diagnostic ignored "-Wproperty-attribute-mismatch"
+#pragma clang diagnostic ignored "-Wduplicate-method-arg"
+#if __has_warning("-Wpragma-clang-attribute")
+# pragma clang diagnostic ignored "-Wpragma-clang-attribute"
+#endif
+#pragma clang diagnostic ignored "-Wunknown-pragmas"
+#pragma clang diagnostic ignored "-Wnullability"
+
+#if __has_attribute(external_source_symbol)
+# pragma push_macro("any")
+# undef any
+# pragma clang attribute push(__attribute__((external_source_symbol(language="Swift", defined_in="AmneziaVPN",generated_declaration))), apply_to=any(function,enum,objc_interface,objc_category,objc_protocol))
+# pragma pop_macro("any")
+#endif
+
+
+@class NSString;
+@class NSData;
+enum ConnectionState : NSInteger;
+@class NSDate;
+@class NSNumber;
+@class VPNIPAddressRange;
+
+SWIFT_CLASS("_TtC10AmneziaVPN18IOSVpnProtocolImpl")
+@interface IOSVpnProtocolImpl : NSObject
+- (nonnull instancetype)initWithBundleID:(NSString * _Nonnull)bundleID privateKey:(NSData * _Nonnull)privateKey deviceIpv4Address:(NSString * _Nonnull)deviceIpv4Address deviceIpv6Address:(NSString * _Nonnull)deviceIpv6Address closure:(void (^ _Nonnull)(enum ConnectionState, NSDate * _Nullable))closure callback:(void (^ _Nonnull)(BOOL))callback OBJC_DESIGNATED_INITIALIZER;
+- (nonnull instancetype)initWithBundleID:(NSString * _Nonnull)bundleID config:(NSString * _Nonnull)config closure:(void (^ _Nonnull)(enum ConnectionState, NSDate * _Nullable))closure callback:(void (^ _Nonnull)(BOOL))callback;
+- (nonnull instancetype)initWithBundleID:(NSString * _Nonnull)bundleID tunnelConfig:(NSString * _Nonnull)tunnelConfig ssConfig:(NSString * _Nonnull)ssConfig closure:(void (^ _Nonnull)(enum ConnectionState, NSDate * _Nullable))closure callback:(void (^ _Nonnull)(BOOL))callback;
+- (void)connectWithDnsServer:(NSString * _Nonnull)dnsServer serverIpv6Gateway:(NSString * _Nonnull)serverIpv6Gateway serverPublicKey:(NSString * _Nonnull)serverPublicKey presharedKey:(NSString * _Nonnull)presharedKey serverIpv4AddrIn:(NSString * _Nonnull)serverIpv4AddrIn serverPort:(NSInteger)serverPort allowedIPAddressRanges:(NSArray<VPNIPAddressRange *> * _Nonnull)allowedIPAddressRanges ipv6Enabled:(Boolean)enabled reason:(NSInteger)reason failureCallback:(void (^ _Nonnull)(void))failureCallback;
+- (void)connectWithOvpnConfig:(NSString * _Nonnull)ovpnConfig failureCallback:(void (^ _Nonnull)(void))failureCallback;
+- (void)connectWithSsConfig:(NSString * _Nonnull)ssConfig ovpnConfig:(NSString * _Nonnull)ovpnConfig failureCallback:(void (^ _Nonnull)(void))failureCallback;
+- (void)disconnect;
+- (void)checkStatusWithCallback:(void (^ _Nonnull)(NSString * _Nonnull, NSString * _Nonnull, NSString * _Nonnull))callback;
+- (nonnull instancetype)init SWIFT_UNAVAILABLE;
+ (nonnull instancetype)new SWIFT_UNAVAILABLE_MSG("-init is unavailable");
+@end
+
+typedef SWIFT_ENUM(NSInteger, ConnectionState, closed) {
+  ConnectionStateError = 0,
+  ConnectionStateConnected = 1,
+  ConnectionStateDisconnected = 2,
+};
+
+SWIFT_CLASS("_TtC10AmneziaVPN17VPNIPAddressRange")
+@interface VPNIPAddressRange : NSObject
+- (nonnull instancetype)initWithAddress:(NSString * _Nonnull)address networkPrefixLength:(uint8_t)networkPrefixLength isIpv6:(BOOL)isIpv6 OBJC_DESIGNATED_INITIALIZER;
+- (nonnull instancetype)init SWIFT_UNAVAILABLE;
+ (nonnull instancetype)new SWIFT_UNAVAILABLE_MSG("-init is unavailable");
+@end
+
+#if __has_attribute(external_source_symbol)
+# pragma clang attribute pop
+#endif
+#pragma clang diagnostic pop
+#endif /* AmneziaVPN_Swift_h */
+
--- a/client/AmneziaVPN.entitlements
+++ b/client/AmneziaVPN.entitlements
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.application-groups</key>
+	<array>
+		<string>group.org.amnezia.AmneziaVPN</string>
+	</array>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)group.org.amnezia.AmneziaVPN</string>
+	</array>
+</dict>
+</plist>
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -1,11 +1,14 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

 set(PROJECT AmneziaVPN)
-project(${PROJECT})
-
-set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
+project(${PROJECT} VERSION 2.1.2)
+set(BUILD_ID 1)
+SET(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
+if(${CMAKE_VERSION} VERSION_GREATER_EQUAL 3.17)
+    cmake_policy(SET CMP0099 OLD)
+endif()

 if(ANDROID)
    # For a some reason cmake do not applying GNU_SOURCE/BSD_SOURCE flags on Android platform.
@@ -13,43 +16,34 @@ if(ANDROID)
    add_definitions(-D_BSD_SOURCE)
 endif()

+if(CMAKE_XCODE_BUILD_SYSTEM VERSION_GREATER_EQUAL 12)
+  cmake_policy(SET CMP0114 NEW)
+endif()
+
+set(CMAKE_AUTOMOC ON)
+set(CMAKE_AUTORCC ON)
+set(CMAKE_AUTOUIC ON)
 set_property(GLOBAL PROPERTY USE_FOLDERS ON)
 set_property(GLOBAL PROPERTY AUTOGEN_TARGETS_FOLDER "Autogen")
 set_property(GLOBAL PROPERTY AUTOMOC_TARGETS_FOLDER "Autogen")
 set_property(GLOBAL PROPERTY PREDEFINED_TARGETS_FOLDER "Autogen")

-set(PACKAGES
-	Widgets Core Gui Network Xml
-	RemoteObjects Quick Svg QuickControls2
-	Core5Compat Concurrent
+find_package(Qt6 REQUIRED COMPONENTS 
+    Widgets Core Gui Network Xml 
+    RemoteObjects Quick Svg QuickControls2 
+    Core5Compat Concurrent
 )
-if(IOS)
-	set(PACKAGES
-		${PACKAGES}
-		Multimedia
-	)
-endif()
-
-find_package(Qt6 REQUIRED COMPONENTS ${PACKAGES})
-
 set(LIBS ${LIBS} 
    Qt6::Widgets Qt6::Core Qt6::Gui
    Qt6::Network Qt6::Xml Qt6::RemoteObjects
    Qt6::Quick Qt6::Svg Qt6::QuickControls2
    Qt6::Core5Compat Qt6::Concurrent
 )
-if(IOS)
-	set(LIBS
-		${LIBS}
-		Qt6::Multimedia
-	)
-endif()

 qt_standard_project_setup()

 if(IOS)
-    #execute_process(COMMAND bash ${CMAKE_CURRENT_LIST_DIR}/scripts/run-build-cloak.sh)
-    execute_process(COMMAND bash ${CMAKE_CURRENT_LIST_DIR}/ios/scripts/openvpn.sh args
+    execute_process(COMMAND bash ${CMAKE_CURRENT_LIST_DIR}/scripts/openvpn.sh args
        WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR})
 endif()

@@ -70,8 +64,6 @@ include_directories(
    ${CMAKE_CURRENT_BINARY_DIR}
 )

-configure_file(${CMAKE_CURRENT_LIST_DIR}/../version.h.in ${CMAKE_CURRENT_BINARY_DIR}/version.h)
-
 set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_LIST_DIR}/migrations.h
    ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc.h
@@ -90,7 +82,6 @@ set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_LIST_DIR}/ui/uilogic.h
    ${CMAKE_CURRENT_LIST_DIR}/ui/qautostart.h
    ${CMAKE_CURRENT_LIST_DIR}/protocols/vpnprotocol.h
-    ${CMAKE_CURRENT_BINARY_DIR}/version.h
    ${CMAKE_CURRENT_LIST_DIR}/core/sshclient.h
 )

@@ -155,11 +146,6 @@ qt6_add_resources(QRC ${QRC} ${CMAKE_CURRENT_LIST_DIR}/resources.qrc)
 if(WIN32)
    add_compile_definitions(MVPN_WINDOWS)

-    configure_file(
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/windows/amneziavpn.rc.in 
-        ${CMAKE_CURRENT_BINARY_DIR}/amneziavpn.rc
-    )
-
    set(HEADERS ${HEADERS}
        ${CMAKE_CURRENT_LIST_DIR}/protocols/ikev2_vpn_protocol_windows.h
    )
@@ -169,7 +155,7 @@ if(WIN32)
    )

    set(RESOURCES ${RESOURCES}
-        ${CMAKE_CURRENT_BINARY_DIR}/amneziavpn.rc
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/windows/amneziavpn.rc
    )

    set(LIBS ${LIBS}
@@ -185,9 +171,6 @@ if(WIN32)
 endif()

 if(APPLE)
-    cmake_policy(SET CMP0099 OLD)
-    cmake_policy(SET CMP0114 NEW)
-
    if(NOT BUILD_OSX_APP_IDENTIFIER)
        set(BUILD_OSX_APP_IDENTIFIER org.amnezia.AmneziaVPN CACHE STRING "OSX Application identifier")
    endif()
@@ -205,6 +188,7 @@ if(APPLE)
    set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM ${BUILD_VPN_DEVELOPMENT_TEAM})
    set(CMAKE_XCODE_ATTRIBUTE_GROUP_ID_IOS ${BUILD_IOS_GROUP_IDENTIFIER})

+   #set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/../../build)
    if(NOT IOS)
        set(CMAKE_OSX_ARCHITECTURES "x86_64" CACHE INTERNAL "" FORCE)

@@ -212,13 +196,9 @@ if(APPLE)
        set(HEADERS ${HEADERS} ${CMAKE_CURRENT_LIST_DIR}/ui/macos_util.h)
        set(SOURCES ${SOURCES} ${CMAKE_CURRENT_LIST_DIR}/ui/macos_util.mm)

-        set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
+        set(CMAKE_OSX_DEPLOYMENT_TARGET 13.0)
        add_compile_definitions(MVPN_MACOS)
-
-        set(ICON_FILE ${CMAKE_CURRENT_SOURCE_DIR}/images/app.icns)
-        set(MACOSX_BUNDLE_ICON_FILE app.icns)
-        set_source_files_properties(${ICON_FILE} PROPERTIES MACOSX_PACKAGE_LOCATION Resources)
-        set(SOURCES ${SOURCES} ${ICON_FILE})
+        # ICON   = $$PWD/images/app.icns

        find_library(FW_COCOA Cocoa)
        find_library(FW_APPLICATIONSERVICES ApplicationServices)
@@ -227,7 +207,7 @@ if(APPLE)
        find_library(FW_APPKIT AppKit)
        find_library(FW_SECURITY Security)

-        set(LIBS ${LIBS}
+        set(LIBS ${LIBS} 
            ${FW_COCOA} ${FW_APPLICATIONSERVICES}
            ${FW_FOUNDATION} ${FW_APPKIT}
            ${FW_SECURITY} ${FW_CORESERVICES}
@@ -236,6 +216,7 @@ if(APPLE)
    endif()
 endif()

+
 if(LINUX AND NOT ANDROID)
    add_compile_definitions(MVPN_LINUX)

@@ -245,7 +226,7 @@ endif()
 if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
    message("Client desktop build")
    add_compile_definitions(AMNEZIA_DESKTOP)
-
+    
    set(HEADERS ${HEADERS}
        ${CMAKE_CURRENT_LIST_DIR}/core/ipcclient.h
        ${CMAKE_CURRENT_LIST_DIR}/core/privileged_process.h
@@ -292,6 +273,8 @@ if(ANDROID)
        ${CMAKE_CURRENT_LIST_DIR}/platforms/android/androidvpnactivity.cpp
        ${CMAKE_CURRENT_LIST_DIR}/protocols/android_vpnprotocol.cpp
    )
+
+    file(COPY ${CMAKE_CURRENT_LIST_DIR}/3rd/strongswan DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/3rd)
 endif()

 if(IOS)
@@ -316,24 +299,26 @@ if(IOS)
    add_compile_definitions(MVPN_IOS)

    set(HEADERS ${HEADERS}
-        ${CMAKE_CURRENT_LIST_DIR}/protocols/ios_vpnprotocol.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosnotificationhandler.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/bigint.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/bigintipv6addr.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddress.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddressrange.h
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QtAppDelegate.h
+        ${CMAKE_CURRENT_LIST_DIR}/protocols/ios_vpnprotocol.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosnotificationhandler.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/json.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/bigint.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/bigintipv6addr.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddress.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddressrange.h 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QtAppDelegate.h 
        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QtAppDelegate-C-Interface.h
    )

    set(SOURCES ${SOURCES}
-        ${CMAKE_CURRENT_LIST_DIR}/protocols/ios_vpnprotocol.mm
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosnotificationhandler.mm
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosglue.mm
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddress.cpp
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddressrange.cpp
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QRCodeReaderBase.mm
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QtAppDelegate.mm
+        ${CMAKE_CURRENT_LIST_DIR}/protocols/ios_vpnprotocol.mm 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosnotificationhandler.mm 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/json.cpp 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosglue.mm 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddress.cpp 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ipaddressrange.cpp 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QRCodeReaderBase.mm 
+        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/QtAppDelegate.mm 
        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/MobileUtils.mm
    )
 endif()
@@ -348,7 +333,9 @@ qt_add_translations(${PROJECT} TS_FILES
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_ru.ts)

 if(APPLE AND NOT IOS)
-    set_target_properties(${PROJECT} PROPERTIES MACOSX_BUNDLE TRUE)
+    set_target_properties(AmneziaVPN PROPERTIES
+        MACOSX_BUNDLE TRUE
+    )
 endif()

 if(IOS)
@@ -356,66 +343,66 @@ if(IOS)
    enable_language(OBJCXX)
    enable_language(Swift)

+    #disable in cicd
    include(cmake/osxtools.cmake)
+    # set(CMAKE_XCODE_GENERATE_TOP_LEVEL_PROJECT_ONLY TRUE)
+
+    set_target_properties(${PROJECT} PROPERTIES XCODE_ATTRIBUTE_ENABLE_BITCODE "NO")
+    set_target_properties(${PROJECT} PROPERTIES XCODE_ATTRIBUTE_ASSETCATALOG_COMPILER_APPICON_NAME "AppIcon")
+
+    set_target_properties(${PROJECT} PROPERTIES XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION)
+    set(CMAKE_XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/../../Frameworks")
+    set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_LIST_DIR}/3rd/OpenVPNAdapter/build/Release-iphoneos)
+
+
+    #need to change for debug and release
+    set_target_properties(${PROJECT} 
+        PROPERTIES XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "org.amnezia.${PROJECT}"
+        XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1"
+        XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
+        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Distribution"
+        )
+
+    set_target_properties(${PROJECT}
+        PROPERTIES XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "org.amnezia.${PROJECT}"
+        XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1"
+        XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
+        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY[variant=Debug] "Apple Development"
+        )

    set(LIBS ${LIBS}
        ${CMAKE_CURRENT_LIST_DIR}/3rd/OpenSSL/lib/ios/iphone/libcrypto.a
        ${CMAKE_CURRENT_LIST_DIR}/3rd/OpenSSL/lib/ios/iphone/libssl.a
-    )
+        )

    target_include_directories(${PROJECT} PRIVATE ${Qt6Gui_PRIVATE_INCLUDE_DIRS})

-    set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-
-    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
-
-        MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_LIST_DIR}/ios/app/Info.plist.in
-        MACOSX_BUNDLE_ICON_FILE "AppIcon"
-        MACOSX_BUNDLE_INFO_STRING "AmneziaVPN"
-        MACOSX_BUNDLE_BUNDLE_NAME "AmneziaVPN"
-        MACOSX_BUNDLE_GUI_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
-        MACOSX_BUNDLE_BUNDLE_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
-        MACOSX_BUNDLE_LONG_VERSION_STRING "${APPLE_PROJECT_VERSION}-${CMAKE_PROJECT_VERSION_TWEAK}"
-        MACOSX_BUNDLE_SHORT_VERSION_STRING "${APPLE_PROJECT_VERSION}"
-
-        XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
-        XCODE_ATTRIBUTE_CODE_SIGN_ENTITLEMENTS "${CMAKE_CURRENT_LIST_DIR}/ios/app/main.entitlements"
-        XCODE_ATTRIBUTE_MARKETING_VERSION "${APPLE_PROJECT_VERSION}"
-        XCODE_ATTRIBUTE_CURRENT_PROJECT_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
-        XCODE_ATTRIBUTE_PRODUCT_NAME "AmneziaVPN"
-        XCODE_ATTRIBUTE_BUNDLE_INFO_STRING "AmneziaVPN"
-
-        XCODE_GENERATE_SCHEME TRUE
-        XCODE_ATTRIBUTE_ENABLE_BITCODE "NO"
-        XCODE_ATTRIBUTE_ASSETCATALOG_COMPILER_APPICON_NAME "AppIcon"
-        XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1,2"
-
-        XCODE_EMBED_FRAMEWORKS_CODE_SIGN_ON_COPY ON
-        XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
-
-        XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/Frameworks"
-
-        XCODE_EMBED_APP_EXTENSIONS networkextension
-
-        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Distribution"
-        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY[variant=Debug] "Apple Development"
-
-        XCODE_ATTRIBUTE_CODE_SIGN_STYLE Manual
-        XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER "match AppStore org.amnezia.AmneziaVPN"
-        XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER[variant=Debug] "match Development org.amnezia.AmneziaVPN"
-    )
-
    set_target_properties(${PROJECT} PROPERTIES
        XCODE_ATTRIBUTE_SWIFT_VERSION "5.0"
        XCODE_ATTRIBUTE_CLANG_ENABLE_MODULES "YES"
        XCODE_ATTRIBUTE_SWIFT_OBJC_BRIDGING_HEADER "${CMAKE_CURRENT_LIST_DIR}/platforms/ios/WireGuard-Bridging-Header.h"
        XCODE_ATTRIBUTE_SWIFT_PRECOMPILE_BRIDGING_HEADER "NO"
+        XCODE_ATTRIBUTE_SWIFT_OPTIMIZATION_LEVEL "-Onone"
        XCODE_ATTRIBUTE_SWIFT_OBJC_INTERFACE_HEADER_NAME "AmneziaVPN-Swift.h"
    )

    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
+        OUTPUT_NAME "AmneziaVPN"
+        MACOSX_BUNDLE ON
+        MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_LIST_DIR}/ios/app/Info.plist.in
+        MACOSX_BUNDLE_BUNDLE_NAME "AmneziaVPN"
+        MACOSX_BUNDLE_BUNDLE_VERSION "${BUILD_ID}"
+        MACOSX_BUNDLE_COPYRIGHT "MPL-2.0"
+        MACOSX_BUNDLE_GUI_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
+        MACOSX_BUNDLE_INFO_STRING "AmneziaVPN"
+        MACOSX_BUNDLE_LONG_VERSION_STRING "${CMAKE_PROJECT_VERSION}-${BUILD_ID}"
+        MACOSX_BUNDLE_SHORT_VERSION_STRING "${CMAKE_PROJECT_VERSION}"
+        XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
+        XCODE_ATTRIBUTE_CODE_SIGN_ENTITLEMENTS "${CMAKE_CURRENT_LIST_DIR}/ios/app/main.entitlements"
+        XCODE_ATTRIBUTE_MARKETING_VERSION "${CMAKE_PROJECT_VERSION}"
+        XCODE_GENERATE_SCHEME TRUE
+        MACOSX_BUNDLE_ICON_FILE "AppIcon"
+
    )

    target_include_directories(${PROJECT} PRIVATE ${CMAKE_CURRENT_LIST_DIR})
@@ -425,10 +412,8 @@ if(IOS)
        -DVPN_NE_BUNDLEID=\"${BUILD_IOS_APP_IDENTIFIER}.network-extension\"
    )

-    target_sources(${PROJECT} PRIVATE
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/iosvpnprotocol.swift
-        ${CMAKE_CURRENT_LIST_DIR}/platforms/ios/ioslogger.swift

+   target_sources(${PROJECT} PRIVATE
        ${CMAKE_CURRENT_LIST_DIR}/3rd/wireguard-apple/Sources/Shared/Keychain.swift
        ${CMAKE_CURRENT_LIST_DIR}/3rd/wireguard-apple/Sources/WireGuardKit/IPAddressRange.swift
        ${CMAKE_CURRENT_LIST_DIR}/3rd/wireguard-apple/Sources/WireGuardKit/InterfaceConfiguration.swift
@@ -445,43 +430,75 @@ if(IOS)
        ${CMAKE_CURRENT_LIST_DIR}/3rd/wireguard-apple/Sources/WireGuardKit/PrivateKey.swift
    )

+    target_sources(${PROJECT} PRIVATE
+        platforms/ios/iosvpnprotocol.swift
+        platforms/ios/ioslogger.swift
+    )
+
    target_sources(${PROJECT} PRIVATE
        ${CMAKE_CURRENT_LIST_DIR}/ios/app/launch.png
        ${CMAKE_CURRENT_LIST_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
-        ${CMAKE_CURRENT_LIST_DIR}/ios/Media.xcassets
    )
    set_source_files_properties(
        ${CMAKE_CURRENT_LIST_DIR}/ios/app/launch.png
        ${CMAKE_CURRENT_LIST_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
+        PROPERTIES MACOSX_PACKAGE_LOCATION "Resources"
+    )
+
+    target_sources(${PROJECT} PRIVATE
+        ${CMAKE_CURRENT_LIST_DIR}/ios/Media.xcassets
+    )
+    set_source_files_properties(
        ${CMAKE_CURRENT_LIST_DIR}/ios/Media.xcassets
        PROPERTIES MACOSX_PACKAGE_LOCATION "Resources"
    )

-
    add_subdirectory(ios/networkextension)
    add_dependencies(${PROJECT} networkextension)
+    set_target_properties(${PROJECT} PROPERTIES XCODE_EMBED_APP_EXTENSIONS networkextension)

    set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
        "${CMAKE_CURRENT_LIST_DIR}/3rd/OpenVPNAdapter/build/Release-iphoneos/OpenVPNAdapter.framework"
    )
+    set_target_properties(${PROJECT} PROPERTIES XCODE_EMBED_FRAMEWORKS_CODE_SIGN_ON_COPY ON)
+    set_target_properties(${PROJECT} PROPERTIES XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION)

-    set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_LIST_DIR}/3rd/OpenVPNAdapter/build/Release-iphoneos)
-    target_link_libraries("networkextension" PRIVATE "${CMAKE_CURRENT_LIST_DIR}/3rd/OpenVPNAdapter/build/Release-iphoneos/OpenVPNAdapter.framework")

+    set_target_properties("networkextension"
+        PROPERTIES XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "org.amnezia.${PROJECT}.network-extension"
+        XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1"
+        XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
+        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Distribution"
+        )
+
+    set_target_properties("networkextension"
+        PROPERTIES XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "org.amnezia.${PROJECT}.network-extension"
+        XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1"
+        XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
+        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY[variant=Debug] "Apple Development"
+        )
+
+    set_target_properties (${PROJECT} PROPERTIES XCODE_ATTRIBUTE_CODE_SIGN_STYLE Manual)
+    set_target_properties(${PROJECT} PROPERTIES XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER "match AppStore org.amnezia.AmneziaVPN")
+    set_target_properties(${PROJECT} PROPERTIES XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER[variant=Debug] "match Development org.amnezia.AmneziaVPN")
+
+    set_target_properties("networkextension" PROPERTIES XCODE_ATTRIBUTE_CODE_SIGN_STYLE Manual)
+    set_target_properties("networkextension" PROPERTIES XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER "match AppStore org.amnezia.AmneziaVPN.network-extension")
+    set_target_properties("networkextension" PROPERTIES XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER[variant=Debug] "match Development org.amnezia.AmneziaVPN.network-extension")
 endif()

 if(ANDROID)
    add_custom_command(
        TARGET ${PROJECT} POST_BUILD
        COMMAND ${CMAKE_COMMAND} -E copy
-            ${CMAKE_CURRENT_LIST_DIR}/android/AndroidManifest.xml
-            ${CMAKE_CURRENT_LIST_DIR}/android/build.gradle
-            ${CMAKE_CURRENT_LIST_DIR}/android/gradle/wrapper/gradle-wrapper.jar
-            ${CMAKE_CURRENT_LIST_DIR}/android/gradle/wrapper/gradle-wrapper.properties
-            ${CMAKE_CURRENT_LIST_DIR}/android/gradlew
-            ${CMAKE_CURRENT_LIST_DIR}/android/gradlew.bat
-            ${CMAKE_CURRENT_LIST_DIR}/android/gradle.properties
-            ${CMAKE_CURRENT_LIST_DIR}/android/res/values/libs.xml
+            ${CMAKE_CURRENT_LIST_DIR}/android/AndroidManifest.xml 
+            ${CMAKE_CURRENT_LIST_DIR}/android/build.gradle 
+            ${CMAKE_CURRENT_LIST_DIR}/android/gradle/wrapper/gradle-wrapper.jar 
+            ${CMAKE_CURRENT_LIST_DIR}/android/gradle/wrapper/gradle-wrapper.properties 
+            ${CMAKE_CURRENT_LIST_DIR}/android/gradlew 
+            ${CMAKE_CURRENT_LIST_DIR}/android/gradlew.bat 
+            ${CMAKE_CURRENT_LIST_DIR}/android/gradle.properties 
+            ${CMAKE_CURRENT_LIST_DIR}/android/res/values/libs.xml 
            ${CMAKE_CURRENT_LIST_DIR}/android/res/xml/fileprovider.xml
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/AuthHelper.java
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/IPCContract.kt
@@ -492,7 +509,6 @@ if(ANDROID)
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/VPNService.kt
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/VPNServiceBinder.kt
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/qt/AmneziaApp.kt
-            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/qt/PackageManagerHelper.java
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/qt/VPNActivity.kt
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/qt/VPNApplication.java
            ${CMAKE_CURRENT_LIST_DIR}/android/src/org/amnezia/vpn/qt/VPNClientBinder.kt
@@ -501,7 +517,7 @@ if(ANDROID)
    )

    set_property(TARGET ${PROJECT} PROPERTY
-        QT_ANDROID_PACKAGE_SOURCE_DIR
+        QT_ANDROID_PACKAGE_SOURCE_DIR 
        ${CMAKE_CURRENT_LIST_DIR}/android
    )

@@ -517,6 +533,12 @@ if(ANDROID)
            ${CMAKE_CURRENT_LIST_DIR}/android/lib/wireguard/${abi}/libwg.so
            ${CMAKE_CURRENT_LIST_DIR}/android/lib/wireguard/${abi}/libwg-go.so
            ${CMAKE_CURRENT_LIST_DIR}/android/lib/wireguard/${abi}/libwg-quick.so
+
+            ${CMAKE_CURRENT_LIST_DIR}/android/lib/openvpn/${abi}/libjbcrypto.so
+            ${CMAKE_CURRENT_LIST_DIR}/android/lib/openvpn/${abi}/libopenvpn.so
+            ${CMAKE_CURRENT_LIST_DIR}/android/lib/openvpn/${abi}/libopvpnutil.so
+            ${CMAKE_CURRENT_LIST_DIR}/android/lib/openvpn/${abi}/libovpn3.so
+            ${CMAKE_CURRENT_LIST_DIR}/android/lib/openvpn/${abi}/libovpnexec.so
        )
    endforeach()

@@ -562,5 +584,5 @@ if(WIN32)
    )
 endif()
 if(IOS)
-    include(cmake/ios-arch-fixup.cmake)
+ #include(cmake/ios-arch-fixup.cmake)
 endif()
--- a/client/Info.plist
+++ b/client/Info.plist
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
+	<key>CFBundleIconFile</key>
+	<string>${ASSETCATALOG_COMPILER_APPICON_NAME}</string>
+	<key>CFBundleIdentifier</key>
+	<string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleSignature</key>
+	<string>${QMAKE_PKGINFO_TYPEINFO}</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
+	<key>NOTE</key>
+	<string>This file was generated by Qt/QMake.</string>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
+	<key>NSSupportsAutomaticGraphicsSwitching</key>
+	<true/>
+</dict>
+</plist>
--- a/client/WireGuard-Bridging-Header.h
+++ b/client/WireGuard-Bridging-Header.h
@@ -0,0 +1,29 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "wireguard-go-version.h"
+#include "3rd/wireguard-apple/Sources/WireGuardKitC/WireGuardKitC.h"
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#define WG_KEY_LEN (32)
+#define WG_KEY_LEN_BASE64 (45)
+#define WG_KEY_LEN_HEX (65)
+
+void key_to_base64(char base64[WG_KEY_LEN_BASE64],
+                   const uint8_t key[WG_KEY_LEN]);
+bool key_from_base64(uint8_t key[WG_KEY_LEN], const char* base64);
+
+void key_to_hex(char hex[WG_KEY_LEN_HEX], const uint8_t key[WG_KEY_LEN]);
+bool key_from_hex(uint8_t key[WG_KEY_LEN], const char* hex);
+
+bool key_eq(const uint8_t key1[WG_KEY_LEN], const uint8_t key2[WG_KEY_LEN]);
+
+void write_msg_to_log(const char* tag, const char* msg);
+
+#import "TargetConditionals.h"
+#if TARGET_OS_OSX
+#  include <libproc.h>
+#endif
--- a/client/amnezia_application.cpp
+++ b/client/amnezia_application.cpp
@@ -8,7 +8,7 @@

 #include "core/servercontroller.h"
 #include "logger.h"
-#include "version.h"
+#include "defines.h"
 #include <QQuickStyle>

 #include "platforms/ios/QRCodeReaderBase.h"
--- a/client/android/build.gradle
+++ b/client/android/build.gradle
@@ -1,7 +1,7 @@
 apply plugin: 'com.github.ben-manes.versions'

 buildscript {
-   ext{
+   ext {
       kotlin_version = "1.7.22"
       //  for libwg
       appcompatVersion = '1.1.0'
@@ -11,8 +11,7 @@ buildscript {
       streamsupportVersion = '1.7.0'
       threetenabpVersion = '1.1.1'
       groupName = 'org.amnezia.vpn'
-       minSdkVer = '24'
-       cmakeMinVersion = "3.25.0+"
+       relativePathToStrongswan = '../3rd/strongswan/sources/src/frontends/android/app/src/main/jni'
   }

    repositories {
@@ -38,8 +37,9 @@ apply plugin: 'kotlin-kapt'

 dependencies {
    implementation fileTree(dir: 'libs', include: ['*.jar', '*.aar'])
-    implementation group: 'org.json', name: 'json', version: '20220924'
+
    implementation 'androidx.core:core-ktx:1.7.0'
+
    implementation 'androidx.appcompat:appcompat:1.4.1'

    implementation "androidx.security:security-crypto:1.1.0-alpha03"
@@ -106,7 +106,7 @@ android {
            resources.srcDirs = ['resources']
            renderscript.srcDirs = ['src']
            assets.srcDirs = ['assets']
-            jniLibs.srcDirs = ['libs']
+            jniLibs.srcDirs = ['libs', relativePathToStrongswan]
            androidTest.assets.srcDirs += files("${qtAndroidDir}/schemas".toString())
       }
    }
@@ -139,39 +139,65 @@ android {
        targetSdkVersion = 31
        versionCode 10 // Change to a higher number
        versionName "2.0.10" // Change to a higher number
+        multiDexEnabled true

        javaCompileOptions.annotationProcessorOptions.arguments = [
            "room.schemaLocation": "${qtAndroidDir}/schemas".toString()
        ]
    }

-   buildTypes {
+    buildTypes {
       release {
           // That would enable treeshaking and remove java code that is just called from qt
           minifyEnabled false
+
           externalNativeBuild {
               cmake {
-                   version cmakeMinVersion
                   arguments "-DANDROID_PACKAGE_NAME=${groupName}",
-                                "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}",
-                                "-DANDROID_PLATFORM=${minSdkVer}"
+                                "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
               }
           }
       }
+
       debug {
           //applicationIdSuffix ".debug"
           //versionNameSuffix "-debug"
           minifyEnabled false
+
           externalNativeBuild {
               cmake {
-                   version cmakeMinVersion
                   arguments "-DANDROID_PACKAGE_NAME=${groupName}",
-                                "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}",
-                                "-DANDROID_PLATFORM=${minSdkVer}"
+                                "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
+
               }
           }
       }
-   }
+    }
+
+    task buildStrongSwanNative(type: Exec) {
+        environment = System.getenv() + ['JNI_PACKAGE': 'org_amnezia_vpn', 'JNI_PACKAGE_STRING': 'org/amnezia/vpn']
+        workingDir "${relativePathToStrongswan}"
+        commandLine "${android.ndkDirectory}/ndk-build", '-j', Runtime.runtime.availableProcessors()
+
+        doLast {
+            copy {
+                from "${workingDir} + /../libs"
+                into 'libs'
+            }
+        }
+    }
+
+    task cleanStrongSwanNative(type: Exec) {
+        workingDir "${relativePathToStrongswan}"
+        commandLine "${android.ndkDirectory}/ndk-build", 'clean'
+    }
+
+    tasks.withType(JavaCompile) {
+        compileTask -> compileTask.dependsOn buildStrongSwanNative
+            options.compilerArgs << "-Xlint:unchecked" << "-Xlint:deprecation"
+    }
+
+    clean.dependsOn 'cleanStrongSwanNative'

 //   externalNativeBuild {
 //       cmake {
@@ -179,12 +205,11 @@ android {
 //       }
 //   }

-    externalNativeBuild {
-        cmake {
-            version cmakeMinVersion
-            path "${projectDir}/cpp/CMakeLists.txt"
-        }
-    }
+//   externalNativeBuild {
+//       cmake {
+//           path 'openvpn/src/main/cpp/CMakeLists.txt'
+//       }
+//   }
 }


--- a/client/android/cpp/CMakeLists.txt
+++ b/client/android/cpp/CMakeLists.txt
@@ -1,267 +0,0 @@
-cmake_minimum_required(VERSION 3.4.1)
-project(AmneziaVPN)
-# Git version string
-
-include(GetGitRevisionDescription.cmake)
-git_describe(OPENVPN2_GIT "${CMAKE_CURRENT_SOURCE_DIR}/openvpn" "--tags" "--always" "--long")
-git_describe(OPENVPN3_GIT "${CMAKE_CURRENT_SOURCE_DIR}/openvpn3" "--tags" "--always" "--long")
-message("OpenVPN 2.x version ${OPENVPN2_GIT}")
-message("OpenVPN 3.x version ${OPENVPN3_GIT}")
-
-# Set mbedtls options
-OPTION(ENABLE_PROGRAMS "" OFF)
-OPTION(USE_SHARED_MBEDTLS_LIBRARY "" OFF)
-OPTION(ENABLE_TESTING "" OFF)
-
-# Own options
-OPTION(OPENVPN2MBED "Use mbed TLS for OpenVPN2" OFF)
-OPTION(OPENVPN3OSSL "Use OpenSSL for OpenVPN3" ON)
-SET(OPENVPN2MBED OFF)
-SET(OPENVPN3OSSL ON)
-
-# STATIC or SHARED
-SET(SSLLIBTYPE STATIC)
-SET(OPENSSL_PATH "openssl")
-
-set(CMAKE_CXX_STANDARD 17)
-
-
-#add_subdirectory(lzo)
-include(tools.cmake)
-include(lzo.cmake)
-include(lz4.cmake)
-include(openssl/openssl.cmake)
-include(cloak.cmake)
-
-if(NOT ${OPENVPN3OSSL} OR ${OPENVPN2MBED})
-    add_subdirectory(mbedtls)
-endif()
-
-    FIND_PACKAGE(SWIG 3.0 REQUIRED)
-
-    add_custom_command(OUTPUT "ovpncli_wrap.cxx"
-            COMMAND ${CMAKE_COMMAND} -E make_directory ovpn3
-            COMMAND ${SWIG_EXECUTABLE} -outdir ovpn3
-            -c++
-            -java -package net.openvpn.ovpn3
-            -outcurrentdir
-            -DOPENVPN_PLATFORM_ANDROID
-            -I${CMAKE_CURRENT_SOURCE_DIR}/openvpn3/client
-            -I${CMAKE_CURRENT_SOURCE_DIR}/openvpn3
-            ${CMAKE_CURRENT_SOURCE_DIR}/openvpn3/client/ovpncli.i)
-
-
-  link_directories(${CMAKE_CURRENT_SOURCE_DIR}/cloak/${ANDROID_ABI}/)
-
-
-  message("${CMAKE_CURRENT_SOURCE_DIR}/cloak/${ANDROID_ABI}/"})
-   
-    set(ovpn3_SRCS
-            openvpn3/client/ovpncli.cpp
-            openvpn3/openvpn/openssl/xkey/xkey_provider.c
-            openvpn3/openvpn/openssl/xkey/xkey_helper.c
-            ovpncli_wrap.cxx)
-
-    add_library(ovpn3 SHARED ${ovpn3_SRCS})
-
-    target_include_directories(ovpn3 PUBLIC
-            ${CMAKE_CURRENT_SOURCE_DIR}/lzo/include
-            ${CMAKE_CURRENT_SOURCE_DIR}/openvpn3
-            ${CMAKE_CURRENT_SOURCE_DIR}/asio/asio/include
-            ${CMAKE_CURRENT_SOURCE_DIR}/openvpn3/client
-            ${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/include
-            )
-
-    if (${OPENVPN3OSSL})
-        target_compile_definitions(ovpn3 PRIVATE
-                -DUSE_OPENSSL
-                )
-        target_link_libraries(ovpn3 crypto ssl lzo lz4 libck-ovpn-plugin)
-    else ()
-        target_compile_definitions(ovpn3 PRIVATE
-                -DUSE_MBEDTLS
-                )
-        target_link_libraries(ovpn3 mbedtls mbedx509 mbedcrypto lzo lz4)
-    endif ()
-
-    target_compile_definitions(ovpn3 PRIVATE
-            -DHAVE_CONFIG_H
-            -DHAVE_LZO
-            -DHAVE_LZ4
-            -DASIO_STANDALONE
-            -DUSE_ASIO
-            -DGIT_VERSION_STRING=\"${OPENVPN3_GIT}\"
-            -DOPENVPN_SHOW_SESSION_TOKEN
-            -DOPENSSL_API_COMPAT=0x10200000L
-            -DOPENVPN_ALLOW_INSECURE_CERTPROFILE
-            -DENABLE_EXTERNAL_PKI
-            )
-#else ()
-#    message("Not budiling OpenVPN for output dir ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
-#endif ()
-
-add_library(ovpnutil SHARED ovpnutil/jniglue.c)
-target_compile_definitions(ovpnutil PRIVATE -DTARGET_ARCH_ABI=\"${ANDROID_ABI}\"
-        -DOPENVPN2_GIT_REVISION=\"${OPENVPN2_GIT}\"
-        -DOPENVPN3_GIT_REVISION=\"${OPENVPN3_GIT}\"
-        )
-target_link_libraries(ovpnutil log)
-
-add_library(rsapss SHARED ovpnutil/rsapss.cpp)
-target_link_libraries(rsapss log crypto ssl)
-
-if (NOT ${CMAKE_LIBRARY_OUTPUT_DIRECTORY} MATCHES "build/intermediates/cmake/.*skeleton.*/")
-    add_library(osslspeedtest SHARED ovpnutil/sslspeed.c)
-    target_link_libraries(osslspeedtest log crypto ssl)
-else ()
-    message("Not budiling SSLSpeedTest for output dir ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
-endif ()
-
-set(openvpn_srcs
-        src/compat/compat-basename.c
-        src/compat/compat-daemon.c
-        src/compat/compat-dirname.c
-        src/compat/compat-gettimeofday.c
-        src/openvpn/argv.c
-        src/openvpn/auth_token.c
-        src/openvpn/base64.c
-        src/openvpn/buffer.c
-        src/openvpn/clinat.c
-        src/openvpn/console.c
-        src/openvpn/console_builtin.c
-        src/openvpn/crypto.c
-        src/openvpn/crypto_openssl.c
-        src/openvpn/crypto_mbedtls.c
-        src/openvpn/cryptoapi.c
-        src/openvpn/dhcp.c
-        src/openvpn/dns.c
-        src/openvpn/dns.h
-        src/openvpn/error.c
-        src/openvpn/event.c
-        src/openvpn/env_set.c
-        src/openvpn/fdmisc.c
-        src/openvpn/forward.c
-        src/openvpn/fragment.c
-        src/openvpn/gremlin.c
-        src/openvpn/helper.c
-        src/openvpn/httpdigest.c
-        src/openvpn/init.c
-        src/openvpn/interval.c
-        src/openvpn/list.c
-        src/openvpn/lladdr.c
-        src/openvpn/lzo.c
-        src/openvpn/manage.c
-        src/openvpn/mbuf.c
-        src/openvpn/misc.c
-        src/openvpn/mroute.c
-        src/openvpn/mss.c
-        src/openvpn/mstats.c
-        src/openvpn/mtcp.c
-        src/openvpn/mtu.c
-        src/openvpn/mudp.c
-        src/openvpn/multi.c
-        src/openvpn/ntlm.c
-        src/openvpn/occ.c
-        src/openvpn/openvpn.c
-        src/openvpn/options.c
-        src/openvpn/options_util.c
-        src/openvpn/otime.c
-        src/openvpn/packet_id.c
-        src/openvpn/perf.c
-        src/openvpn/ping.c
-        src/openvpn/pkcs11.c
-        src/openvpn/pkcs11_openssl.c
-        src/openvpn/platform.c
-        src/openvpn/plugin.c
-        src/openvpn/pool.c
-        src/openvpn/proto.c
-        src/openvpn/proxy.c
-        src/openvpn/ps.c
-        src/openvpn/push.c
-        src/openvpn/reliable.c
-        src/openvpn/route.c
-        src/openvpn/run_command.c
-        src/openvpn/schedule.c
-        src/openvpn/session_id.c
-        src/openvpn/shaper.c
-        src/openvpn/sig.c
-        src/openvpn/socket.c
-        src/openvpn/socks.c
-        src/openvpn/ssl.c
-        src/openvpn/ssl_openssl.c
-        src/openvpn/ssl_mbedtls.c
-        src/openvpn/ssl_ncp.c
-        src/openvpn/ssl_pkt.c
-        src/openvpn/ssl_pkt.h
-        src/openvpn/ssl_util.c
-        src/openvpn/ssl_verify.c
-        src/openvpn/ssl_verify_openssl.c
-        src/openvpn/ssl_verify_mbedtls.c
-        src/openvpn/status.c
-        src/openvpn/tls_crypt.c
-        src/openvpn/tun.c
-        src/openvpn/vlan.c
-        src/openvpn/xkey_helper.c
-        src/openvpn/xkey_provider.c
-        src/openvpn/comp-lz4.c
-        src/openvpn/comp.c
-        src/openvpn/compstub.c
-        )
-
-PREPEND(openvpn_srcs_with_path "openvpn" ${openvpn_srcs})
-
-add_library(openvpn SHARED ${openvpn_srcs_with_path})
-
-target_include_directories(openvpn PRIVATE
-        openvpn-config
-        openvpn/src/compat
-        openvpn/include
-        mbedtls/include
-        lzo/include
-        openvpn
-        )
-target_compile_definitions(openvpn PRIVATE
-        -DHAVE_CONFIG_H
-        -DCONFIGURE_GIT_REVISION=\"${OPENVPN2_GIT}\"
-        -DCONFIGURE_GIT_FLAGS=\"\"
-        -DTARGET_ABI=\"${ANDROID_ABI}\"
-        -DOPENSSL_API_COMPAT=0x11000000L
-        )
-
-if (${OPENVPN2MBED})
-    target_compile_definitions(openvpn PRIVATE
-            -DENABLE_CRYPTO_MBEDTLS=1
-            )
-    target_link_libraries(openvpn mbedtls mbedx509 mbedcrypto lzo lz4)
-else ()
-    target_compile_definitions(openvpn PRIVATE
-            -DENABLE_CRYPTO_OPENSSL=1
-            )
-    target_link_libraries(openvpn crypto ssl lzo lz4)
-endif ()
-
-add_executable(libovpnexec.so minivpn/minivpn.c)
-target_compile_options(libovpnexec.so PRIVATE -fPIE)
-target_link_libraries(libovpnexec.so PRIVATE openvpn -fPIE -pie)
-
-add_executable(pie_openvpn.${ANDROID_ABI} minivpn/minivpn.c)
-target_compile_options(pie_openvpn.${ANDROID_ABI} PRIVATE -fPIE)
-target_link_libraries(pie_openvpn.${ANDROID_ABI} PRIVATE openvpn -fPIE -pie)
-
-# Hack to copy OpenVPN binaries to assets directory
-SET(OVPN_ASSET_DIR ${CMAKE_SOURCE_DIR}/../../../build/ovpnassets)
-
-add_custom_target(makeassetdir ALL
-        COMMAND ${CMAKE_COMMAND} -E make_directory ${OVPN_ASSET_DIR})
-
-add_custom_command(TARGET pie_openvpn.${ANDROID_ABI} POST_BUILD
-        COMMAND
-        ${CMAKE_COMMAND} -E copy
-        $<TARGET_FILE:pie_openvpn.${ANDROID_ABI}>
-        ${OVPN_ASSET_DIR}
-        )
-
-# Hack that these targets are really executed
-add_dependencies(ovpnutil pie_openvpn.${ANDROID_ABI})
-add_dependencies(pie_openvpn.${ANDROID_ABI} makeassetdir)
-
--- a/client/android/cpp/GetGitRevisionDescription.cmake
+++ b/client/android/cpp/GetGitRevisionDescription.cmake
@@ -1,169 +0,0 @@
-# From https://raw.githubusercontent.com/rpavlik/cmake-modules/master/GetGitRevisionDescription.cmake.in
-# - Returns a version string from Git
-#
-# These functions force a re-configure on each git commit so that you can
-# trust the values of the variables in your build system.
-#
-#  get_git_head_revision(<refspecvar> <hashvar> [<additional arguments to git describe> ...])
-#
-# Returns the refspec and sha hash of the current head revision
-#
-#  git_describe(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe on the source tree, and adjusting
-# the output so that it tests false if an error occurs.
-#
-#  git_get_exact_tag(<var> [<additional arguments to git describe> ...])
-#
-# Returns the results of git describe --exact-match on the source tree,
-# and adjusting the output so that it tests false if there was no exact
-# matching tag.
-#
-#  git_local_changes(<var>)
-#
-# Returns either "CLEAN" or "DIRTY" with respect to uncommitted changes.
-# Uses the return code of "git diff-index --quiet HEAD --".
-# Does not regard untracked files.
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE_1_0.txt or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-if(__get_git_revision_description)
-	return()
-endif()
-set(__get_git_revision_description YES)
-
-# We must run the following at "include" time, not at function call time,
-# to find the path to this module rather than the path to a calling list file
-get_filename_component(_gitdescmoddir ${CMAKE_CURRENT_LIST_FILE} PATH)
-
-function(get_git_head_revision _refspecvar _hashvar path)
-	set(GIT_PARENT_DIR "${path}")
-	set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	while(NOT EXISTS "${GIT_DIR}")	# .git dir not found, search parent directories
-		set(GIT_PREVIOUS_PARENT "${GIT_PARENT_DIR}")
-		get_filename_component(GIT_PARENT_DIR ${GIT_PARENT_DIR} PATH)
-		if(GIT_PARENT_DIR STREQUAL GIT_PREVIOUS_PARENT)
-			# We have reached the root directory, we are not in git
-			set(${_refspecvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			set(${_hashvar} "GITDIR-NOTFOUND" PARENT_SCOPE)
-			return()
-		endif()
-		set(GIT_DIR "${GIT_PARENT_DIR}/.git")
-	endwhile()
-	# check if this is a submodule
-	if(NOT IS_DIRECTORY ${GIT_DIR})
-		file(READ ${GIT_DIR} submodule)
-		string(REGEX REPLACE "gitdir: (.*)\n$" "\\1" GIT_DIR_RELATIVE ${submodule})
-		get_filename_component(SUBMODULE_DIR ${GIT_DIR} PATH)
-		get_filename_component(GIT_DIR ${SUBMODULE_DIR}/${GIT_DIR_RELATIVE} ABSOLUTE)
-	endif()
-	set(GIT_DATA "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/git-data")
-	if(NOT EXISTS "${GIT_DATA}")
-		file(MAKE_DIRECTORY "${GIT_DATA}")
-	endif()
-
-	if(NOT EXISTS "${GIT_DIR}/HEAD")
-		return()
-	endif()
-	set(HEAD_FILE "${GIT_DATA}/HEAD")
-	configure_file("${GIT_DIR}/HEAD" "${HEAD_FILE}" COPYONLY)
-
-	configure_file("${_gitdescmoddir}/GetGitRevisionDescription.cmake.in"
-		"${GIT_DATA}/grabRef.cmake"
-		@ONLY)
-	include("${GIT_DATA}/grabRef.cmake")
-
-	set(${_refspecvar} "${HEAD_REF}" PARENT_SCOPE)
-	set(${_hashvar} "${HEAD_HASH}" PARENT_SCOPE)
-endfunction()
-
-function(git_describe _var path)
-	if(NOT GIT_FOUND)
-		find_package(Git QUIET)
-	endif()
-	get_git_head_revision(refspec hash ${path})
-	if(NOT GIT_FOUND)
-		set(${_var} "GIT-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-	if(NOT hash)
-		set(${_var} "HEAD-HASH-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-
-	# TODO sanitize
-	#if((${ARGN}" MATCHES "&&") OR
-	#	(ARGN MATCHES "||") OR
-	#	(ARGN MATCHES "\\;"))
-	#	message("Please report the following error to the project!")
-	#	message(FATAL_ERROR "Looks like someone's doing something nefarious with git_describe! Passed arguments ${ARGN}")
-	#endif()
-
-	#message(STATUS "Arguments to execute_process: ${ARGN}")
-
-	execute_process(COMMAND
-		"${GIT_EXECUTABLE}"
-		describe
-		${hash}
-		${ARGN}
-		WORKING_DIRECTORY
-		${path}
-		RESULT_VARIABLE
-		res
-		OUTPUT_VARIABLE
-		out
-		ERROR_QUIET
-		OUTPUT_STRIP_TRAILING_WHITESPACE)
-	if(NOT res EQUAL 0)
-		set(out "${out}-${res}-NOTFOUND")
-	endif()
-
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()
-
-function(git_get_exact_tag _var path)
-	git_describe(out ${path} --exact-match ${ARGN})
-	set(${_var} "${out}" PARENT_SCOPE)
-endfunction()
-
-function(git_local_changes _var path)
-	if(NOT GIT_FOUND)
-		find_package(Git QUIET)
-	endif()
-	get_git_head_revision(refspec hash path)
-	if(NOT GIT_FOUND)
-		set(${_var} "GIT-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-	if(NOT hash)
-		set(${_var} "HEAD-HASH-NOTFOUND" PARENT_SCOPE)
-		return()
-	endif()
-
-	execute_process(COMMAND
-		"${GIT_EXECUTABLE}"
-		diff-index --quiet HEAD --
-		WORKING_DIRECTORY
-		${path}
-		RESULT_VARIABLE
-		res
-		OUTPUT_VARIABLE
-		out
-		ERROR_QUIET
-		OUTPUT_STRIP_TRAILING_WHITESPACE)
-	if(res EQUAL 0)
-		set(${_var} "CLEAN" PARENT_SCOPE)
-	else()
-		set(${_var} "DIRTY" PARENT_SCOPE)
-	endif()
-endfunction()
--- a/client/android/cpp/GetGitRevisionDescription.cmake.in
+++ b/client/android/cpp/GetGitRevisionDescription.cmake.in
@@ -1,42 +0,0 @@
-# From https://raw.githubusercontent.com/rpavlik/cmake-modules/master/GetGitRevisionDescription.cmake.in
-#
-# Internal file for GetGitRevisionDescription.cmake
-#
-# Requires CMake 2.6 or newer (uses the 'function' command)
-#
-# Original Author:
-# 2009-2010 Ryan Pavlik <rpavlik@iastate.edu> <abiryan@ryand.net>
-# http://academic.cleardefinition.com
-# Iowa State University HCI Graduate Program/VRAC
-#
-# Copyright Iowa State University 2009-2010.
-# Distributed under the Boost Software License, Version 1.0.
-# (See accompanying file LICENSE_1_0.txt or copy at
-# http://www.boost.org/LICENSE_1_0.txt)
-
-set(HEAD_HASH)
-
-file(READ "@HEAD_FILE@" HEAD_CONTENTS LIMIT 1024)
-
-string(STRIP "${HEAD_CONTENTS}" HEAD_CONTENTS)
-if(HEAD_CONTENTS MATCHES "ref")
-	# named branch
-	string(REPLACE "ref: " "" HEAD_REF "${HEAD_CONTENTS}")
-	if(EXISTS "@GIT_DIR@/${HEAD_REF}")
-		configure_file("@GIT_DIR@/${HEAD_REF}" "@GIT_DATA@/head-ref" COPYONLY)
-	else()
-		configure_file("@GIT_DIR@/packed-refs" "@GIT_DATA@/packed-refs" COPYONLY)
-		file(READ "@GIT_DATA@/packed-refs" PACKED_REFS)
-		if(${PACKED_REFS} MATCHES "([0-9a-z]*) ${HEAD_REF}")
-			set(HEAD_HASH "${CMAKE_MATCH_1}")
-		endif()
-	endif()
-else()
-	# detached HEAD
-	configure_file("@GIT_DIR@/HEAD" "@GIT_DATA@/head-ref" COPYONLY)
-endif()
-
-if(NOT HEAD_HASH)
-	file(READ "@GIT_DATA@/head-ref" HEAD_HASH LIMIT 1024)
-	string(STRIP "${HEAD_HASH}" HEAD_HASH)
-endif()
--- a/client/android/cpp/asio
+++ b/client/android/cpp/asio
--- a/client/android/cpp/cloak
+++ b/client/android/cpp/cloak
--- a/client/android/cpp/cloak.cmake
+++ b/client/android/cpp/cloak.cmake
@@ -1,50 +0,0 @@
-cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
-
-set(TARGET ck_ovpn_plugin_go)
-
-set(CLOAK_SRCS cloak/cmd/ck-ovpn-plugin/ck-ovpn-plugin.go)
-set(CLOAK_LIB libck-ovpn-plugin.so)
-
-list(APPEND CMAKE_PROGRAM_PATH "/usr/local/go/bin")
-find_program(GO_EXEC go)
-
-set(BUILD_CMD_ARGS build)
-list(APPEND BUILD_CMD_ARGS -buildmode=c-shared -o ${CMAKE_CURRENT_BINARY_DIR}/${CLOAK_LIB} ${CMAKE_GO_FLAGS} ./...)
-
-set(PREPARE_ENV_ARGS env)
-list(APPEND PREPARE_ENV_ARGS -w CGO_ENABLED=1 GOOS=android)
-
-
-string(REGEX MATCH "[0-9]+$" ANDROID_API_LEVEL ${ANDROID_PLATFORM})
-message(WARNING "build cloak plugin abi=${ANDROID_ABI}, ANDROID_API_LEVEL=${ANDROID_API_LEVEL}")
-
-if ("${ANDROID_ABI}" STREQUAL "x86")
-	list(APPEND PREPARE_ENV_ARGS GOARCH=386)
-    list(APPEND PREPARE_ENV_ARGS CC=${ANDROID_TOOLCHAIN_ROOT}/bin/i686-linux-android${ANDROID_API_LEVEL}-clang)
-elseif ("${ANDROID_ABI}" STREQUAL "x86_64")
-	list(APPEND PREPARE_ENV_ARGS GOARCH=amd64)
-    list(APPEND PREPARE_ENV_ARGS CC=${ANDROID_TOOLCHAIN_ROOT}/bin/x86_64-linux-android${ANDROID_API_LEVEL}-clang)
-elseif ("${ANDROID_ABI}" STREQUAL "arm64-v8a")
-	list(APPEND PREPARE_ENV_ARGS GOARCH=arm64)
-    list(APPEND PREPARE_ENV_ARGS CC=${ANDROID_TOOLCHAIN_ROOT}/bin/aarch64-linux-android${ANDROID_API_LEVEL}-clang)
-elseif ("${ANDROID_ABI}" STREQUAL "armeabi-v7a")
-	list(APPEND PREPARE_ENV_ARGS GOARCH=arm)
-	list(APPEND PREPARE_ENV_ARGS GOARM=7)
-    list(APPEND PREPARE_ENV_ARGS CC=${ANDROID_TOOLCHAIN_ROOT}/bin/armv7a-linux-androideabi${ANDROID_API_LEVEL}-clang)
-endif ()
-
-add_custom_command(
-		OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${CLOAK_LIB}
-		DEPENDS ${CLOAK_SRCS}
-		WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/cloak/cmd/ck-ovpn-plugin
-		COMMAND ${GO_EXEC} ${PREPARE_ENV_ARGS}
-		COMMAND ${GO_EXEC} ${BUILD_CMD_ARGS}
-		COMMENT "Building Go library")
-
-add_custom_target(${TARGET} DEPENDS ${CLOAK_LIB} ${HEADER})
-add_library(libck-ovpn-plugin STATIC IMPORTED GLOBAL)
-add_dependencies(libck-ovpn-plugin ${TARGET})
-set_target_properties(libck-ovpn-plugin
-		PROPERTIES
-		IMPORTED_LOCATION ${CMAKE_CURRENT_BINARY_DIR}/${CLOAK_LIB}
-		INTERFACE_INCLUDE_DIRECTORIES ${CMAKE_CURRENT_BINARY_DIR})
--- a/client/android/cpp/lz4
+++ b/client/android/cpp/lz4
--- a/client/android/cpp/lz4.cmake
+++ b/client/android/cpp/lz4.cmake
@@ -1,7 +0,0 @@
-set(lz4_srcs
-  lz4.c
-  )
-
-PREPEND(lz4_src_with_path "lz4/lib/" ${lz4_srcs})
-add_library(lz4 ${lz4_src_with_path})
-target_include_directories(lz4 PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/lz4/lib")
--- a/client/android/cpp/lzo
+++ b/client/android/cpp/lzo
--- a/client/android/cpp/lzo.cmake
+++ b/client/android/cpp/lzo.cmake
@@ -1,78 +0,0 @@
-# Lzo's own cmake is rather throublesome
-
-set(lzo_srcs
-  lzo1.c
-  lzo1_99.c
-  lzo1a.c
-  lzo1a_99.c
-  lzo1b_1.c
-  lzo1b_2.c
-  lzo1b_3.c
-  lzo1b_4.c
-  lzo1b_5.c
-  lzo1b_6.c
-  lzo1b_7.c
-  lzo1b_8.c
-  lzo1b_9.c
-  lzo1b_99.c
-  lzo1b_9x.c
-  lzo1b_cc.c
-  lzo1b_d1.c
-  lzo1b_d2.c
-  lzo1b_rr.c
-  lzo1b_xx.c
-  lzo1c_1.c
-  lzo1c_2.c
-  lzo1c_3.c
-  lzo1c_4.c
-  lzo1c_5.c
-  lzo1c_6.c
-  lzo1c_7.c
-  lzo1c_8.c
-  lzo1c_9.c
-  lzo1c_99.c
-  lzo1c_9x.c
-  lzo1c_cc.c
-  lzo1c_d1.c
-  lzo1c_d2.c
-  lzo1c_rr.c
-  lzo1c_xx.c
-  lzo1f_1.c
-  lzo1f_9x.c
-  lzo1f_d1.c
-  lzo1f_d2.c
-  lzo1x_1.c
-  lzo1x_1k.c
-  lzo1x_1l.c
-  lzo1x_1o.c
-  lzo1x_9x.c
-  lzo1x_d1.c
-  lzo1x_d2.c
-  lzo1x_d3.c
-  lzo1x_o.c
-  lzo1y_1.c
-  lzo1y_9x.c
-  lzo1y_d1.c
-  lzo1y_d2.c
-  lzo1y_d3.c
-  lzo1y_o.c
-  lzo1z_9x.c
-  lzo1z_d1.c
-  lzo1z_d2.c
-  lzo1z_d3.c
-  lzo2a_9x.c
-  lzo2a_d1.c
-  lzo2a_d2.c
-  lzo_crc.c
-  lzo_init.c
-  lzo_ptr.c
-  lzo_str.c
-  lzo_util.c
-  )
-
-PREPEND(lzo_src_with_path "lzo/src" ${lzo_srcs})
-add_library(lzo ${lzo_src_with_path})
-target_include_directories(lzo PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/lzo/include")
-if (${ANDROID_ABI} STREQUAL "armeabi-v7a")
-    target_compile_options(lzo PRIVATE -O0)
-endif()
--- a/client/android/cpp/mbedtls
+++ b/client/android/cpp/mbedtls
--- a/client/android/cpp/minivpn/minivpn.c
+++ b/client/android/cpp/minivpn/minivpn.c
--- a/client/android/cpp/openssl
+++ b/client/android/cpp/openssl
--- a/client/android/cpp/openvpn
+++ b/client/android/cpp/openvpn
--- a/client/android/cpp/openvpn-config/config.h
+++ b/client/android/cpp/openvpn-config/config.h
@@ -1,684 +0,0 @@
-
-/* config.h.  Generated from config.h.in by configure.  */
-/* config.h.in.  Generated from configure.ac by autoheader.  */
-
-
-/* DISABLE PERSISTEN TUN */
-#undef TUNSETPERSIST
-
-/* Enable deferred authentication */
-#define CONFIGURE_DEF_AUTH 1
-
-/* Enable internal packet filter */
-#undef CONFIGURE_PF //1
-
-/* enable iproute2 support */
-#undef CONFIG_FEATURE_IPROUTE
-
-/* Use memory debugging function in OpenSSL */
-/* #undef CRYPTO_MDEBUG */
-#define HAVE_BASENAME
-/* Use dmalloc memory debugging library */
-/* #undef DMALLOC */
-
-/* Dimension to use for empty array declaration */
-#define EMPTY_ARRAY_SIZE 0
-
-/* Enable client capability only */
-#define ENABLE_CLIENT_ONLY 1
-
-/* Enable debugging support */
-#define ENABLE_DEBUG 1
-
-/* Enable internal fragmentation support */
-#define ENABLE_FRAGMENT 1
-
-/* Enable HTTP proxy support */
-#define ENABLE_HTTP_PROXY 1
-
-/* Enable management server capability */
-#define ENABLE_MANAGEMENT 1
-
-/* Enable multi-homed UDP server capability */
-#define ENABLE_MULTIHOME 0
-
-/* Allow --askpass and --auth-user-pass passwords to be read from a file */
-#define ENABLE_PASSWORD_SAVE 1
-
-/* Enable TCP Server port sharing */
-#define ENABLE_PORT_SHARE 1
-
-/* Enable smaller executable size */
-/* #undef ENABLE_SMALL */
-
-/* Enable Socks proxy support */
-#define ENABLE_SOCKS 1
-
-/* Define to 1 if you have the `accept' function. */
-#define HAVE_ACCEPT 1
-
-/* Define to 1 if you have the <arpa/inet.h> header file. */
-#define HAVE_ARPA_INET_H 1
-
-/* Define to 1 if you have the `bind' function. */
-#define HAVE_BIND 1
-
-/* Define to 1 if you have the `chdir' function. */
-#define HAVE_CHDIR 1
-
-/* Define to 1 if you have the `chroot' function. */
-#define HAVE_CHROOT 1
-
-/* Define to 1 if you have the `chsize' function. */
-/* #undef HAVE_CHSIZE */
-
-/* struct cmsghdr needed for extended socket error support */
-#define HAVE_CMSGHDR 1
-
-/* Define to 1 if you have the `connect' function. */
-#define HAVE_CONNECT 1
-
-/* Define to 1 if your compiler supports GNU GCC-style variadic macros */
-#define HAVE_CPP_VARARG_MACRO_GCC 1
-
-/* Define to 1 if your compiler supports ISO C99 variadic macros */
-#define HAVE_CPP_VARARG_MACRO_ISO 1
-
-/* Define to 1 if you have the `ctime' function. */
-#define HAVE_CTIME 1
-
-/* Define to 1 if you have the <ctype.h> header file. */
-#define HAVE_CTYPE_H 1
-
-/* Define to 1 if you have the `daemon' function. */
-#define HAVE_DAEMON 1
-
-/* Define to 1 if you have the `dup' function. */
-#define HAVE_DUP 1
-
-/* Define to 1 if you have the `dup2' function. */
-#define HAVE_DUP2 1
-
-/* Define to 1 if you have the `ENGINE_cleanup' function. */
-#define HAVE_ENGINE_CLEANUP 0
-
-/* Define to 1 if you have the `ENGINE_load_builtin_engines' function. */
-#define HAVE_ENGINE_LOAD_BUILTIN_ENGINES 0
-
-/* Define to 1 if you have the `ENGINE_register_all_complete' function. */
-#define HAVE_ENGINE_REGISTER_ALL_COMPLETE 0
-
-/* epoll_create function is defined */
-#define HAVE_EPOLL_CREATE 1
-
-/* Define to 1 if you have the <errno.h> header file. */
-#define HAVE_ERRNO_H 1
-
-/* Define to 1 if you have the <err.h> header file. */
-#define HAVE_ERR_H 1
-
-/* Define to 1 if you have the `EVP_CIPHER_CTX_set_key_length' function. */
-#define HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH 1
-
-/* Define to 1 if you have the `execve' function. */
-#define HAVE_EXECVE 1
-
-/* Define to 1 if you have the <fcntl.h> header file. */
-#define HAVE_FCNTL_H 1
-
-/* Define to 1 if you have the `flock' function. */
-#define HAVE_FLOCK 1
-
-/* Define to 1 if you have the `fork' function. */
-#define HAVE_FORK 1
-
-/* Define to 1 if you have the `ftruncate' function. */
-#define HAVE_FTRUNCATE 1
-
-/* Define to 1 if you have the `getgrnam' function. */
-#define HAVE_GETGRNAM 1
-
-/* Define to 1 if you have the `gethostbyname' function. */
-#define HAVE_GETHOSTBYNAME 1
-
-/* Define to 1 if you have the `getpass' function. */
-/* #define HAVE_GETPASS 1 */
-
-/* Define to 1 if you have the `getpeereid' function. */
-/* #undef HAVE_GETPEEREID */
-
-/* Define to 1 if you have the `getpeername' function. */
-#define HAVE_GETPEERNAME 1
-
-/* Define to 1 if you have the `getpid' function. */
-#define HAVE_GETPID 1
-
-/* Define to 1 if you have the `getpwnam' function. */
-#define HAVE_GETPWNAM 1
-
-/* Define to 1 if you have the `getsockname' function. */
-#define HAVE_GETSOCKNAME 1
-
-/* Define to 1 if you have the `getsockopt' function. */
-#define HAVE_GETSOCKOPT 1
-
-/* Define to 1 if you have the `gettimeofday' function. */
-#define HAVE_GETTIMEOFDAY 1
-
-/* Define to 1 if you have the <grp.h> header file. */
-#define HAVE_GRP_H 1
-
-/* Define to 1 if you have the `inet_ntoa' function. */
-#define HAVE_INET_NTOA 1
-
-/* Define to 1 if you have the <inttypes.h> header file. */
-#define HAVE_INTTYPES_H 1
-
-/* struct in_pktinfo needed for IP_PKTINFO support */
-#define HAVE_IN_PKTINFO 1
-
-#define HAVE_IPI_SPEC_DST 1
-
-/* struct iovec needed for IPv6 support */
-#define HAVE_IOVEC 1
-
-/* struct iphdr needed for IPv6 support */
-#define HAVE_IPHDR 1
-
-/* Define to 1 if you have the <linux/errqueue.h> header file. */
-#define HAVE_LINUX_ERRQUEUE_H 1
-
-/* Define to 1 if you have the <linux/if_tun.h> header file. */
-#define HAVE_LINUX_IF_TUN_H 1
-
-/* Define to 1 if you have the <linux/sockios.h> header file. */
-#define HAVE_LINUX_SOCKIOS_H 1
-
-/* Define to 1 if you have the <linux/types.h> header file. */
-#define HAVE_LINUX_TYPES_H 1
-
-/* Define to 1 if you have the `listen' function. */
-#define HAVE_LISTEN 1
-
-/* Define to 1 if you have the <memory.h> header file. */
-#define HAVE_MEMORY_H 1
-
-/* Define to 1 if you have the `memset' function. */
-#define HAVE_MEMSET 1
-
-/* Define to 1 if you have the `mlockall' function. */
-/* #define HAVE_MLOCKALL 1*/
-
-/* struct msghdr needed for extended socket error support */
-#define HAVE_MSGHDR 1
-
-/* Define to 1 if you have the <netdb.h> header file. */
-#define HAVE_NETDB_H 1
-
-/* Define to 1 if you have the <netinet/if_ether.h> header file. */
-#define HAVE_NETINET_IF_ETHER_H 1
-
-/* Define to 1 if you have the <netinet/in.h> header file. */
-#define HAVE_NETINET_IN_H 1
-
-/* Define to 1 if you have the <netinet/in_systm.h> header file. */
-#define HAVE_NETINET_IN_SYSTM_H 1
-
-/* Define to 1 if you have the <netinet/ip.h> header file. */
-#define HAVE_NETINET_IP_H 1
-
-/* Define to 1 if you have the <netinet/tcp.h> header file. */
-#define HAVE_NETINET_TCP_H 1
-
-/* Define to 1 if you have the <net/if.h> header file. */
-#define HAVE_NET_IF_H 1
-
-/* Define to 1 if you have the <net/if_tun.h> header file. */
-/* #undef HAVE_NET_IF_TUN_H */
-
-/* Define to 1 if you have the <net/tun/if_tun.h> header file. */
-/* #undef HAVE_NET_TUN_IF_TUN_H */
-
-/* Define to 1 if you have the `nice' function. */
-#define HAVE_NICE 1
-
-/* Define to 1 if you have the `openlog' function. */
-#define HAVE_OPENLOG 1
-
-/* Define to 1 if you have the <openssl/engine.h> header file. */
-#define HAVE_OPENSSL_ENGINE_H 0
-
-/* Define to 1 if you have the `poll' function. */
-#define HAVE_POLL 1
-
-/* Define if you have POSIX threads libraries and header files. */
-/* #undef HAVE_PTHREAD */
-
-/* Define to 1 if you have the `putenv' function. */
-#define HAVE_PUTENV 1
-
-/* Define to 1 if you have the <pwd.h> header file. */
-#define HAVE_PWD_H 1
-
-/* Define to 1 if you have the `readv' function. */
-#define HAVE_READV 1
-
-/* Define to 1 if you have the `recv' function. */
-#define HAVE_RECV 1
-
-/* Define to 1 if you have the `recvfrom' function. */
-#define HAVE_RECVFROM 1
-
-/* Define to 1 if you have the `recvmsg' function. */
-#define HAVE_RECVMSG 1
-
-/* Define to 1 if you have the <resolv.h> header file. */
-#define HAVE_RESOLV_H 1
-
-/* Indicates if res_init is available */
-#define HAVE_RES_INIT 1
-
-/* Define to 1 if you have the `select' function. */
-#define HAVE_SELECT 1
-
-/* Define to 1 if you have the `send' function. */
-#define HAVE_SEND 1
-
-/* Define to 1 if you have the `sendmsg' function. */
-#define HAVE_SENDMSG 1
-
-/* Define to 1 if you have the `sendto' function. */
-#define HAVE_SENDTO 1
-
-/* SELinux support */
-/* #undef HAVE_SETCON */
-
-/* Define to 1 if you have the `setgid' function. */
-#define HAVE_SETGID 1
-
-/* Define to 1 if you have the `setgroups' function. */
-#define HAVE_SETGROUPS 1
-
-/* Define to 1 if you have the `setsid' function. */
-#define HAVE_SETSID 1
-
-/* Define to 1 if you have the `setsockopt' function. */
-#define HAVE_SETSOCKOPT 1
-
-/* Define to 1 if you have the `setuid' function. */
-#define HAVE_SETUID 1
-
-/* Define to 1 if you have the <signal.h> header file. */
-#define HAVE_SIGNAL_H 1
-
-/* Define to 1 if you have the `socket' function. */
-#define HAVE_SOCKET 1
-
-/* struct sock_extended_err needed for extended socket error support */
-#define HAVE_SOCK_EXTENDED_ERR 1
-
-/* Define to 1 if you have the `stat' function. */
-#define HAVE_STAT 1
-
-/* Define to 1 if you have the <stdarg.h> header file. */
-#define HAVE_STDARG_H 1
-
-/* Define to 1 if you have the <stdint.h> header file. */
-#define HAVE_STDINT_H 1
-
-/* Define to 1 if you have the <stdio.h> header file. */
-#define HAVE_STDIO_H 1
-
-/* Define to 1 if you have the <stdlib.h> header file. */
-#define HAVE_STDLIB_H 1
-
-/* Define to 1 if you have the `strdup' function. */
-#define HAVE_STRDUP 1
-
-/* Define to 1 if you have the `strerror' function. */
-#define HAVE_STRERROR 1
-
-/* Define to 1 if you have the <strings.h> header file. */
-#define HAVE_STRINGS_H 1
-
-/* Define to 1 if you have the <string.h> header file. */
-#define HAVE_STRING_H 1
-
-/* Define to 1 if you have the <stropts.h> header file. */
-#define HAVE_STROPTS_H 1
-
-/* Define to 1 if you have the `syslog' function. */
- #define HAVE_SYSLOG 1
-
-/* Define to 1 if you have the <syslog.h> header file. */
-#define HAVE_SYSLOG_H 1
-
-/* Define to 1 if you have the `system' function. */
-#define HAVE_SYSTEM 1
-
-/* Define to 1 if you have the <sys/epoll.h> header file. */
-#define HAVE_SYS_EPOLL_H 1
-
-/* Define to 1 if you have the <sys/file.h> header file. */
-#define HAVE_SYS_FILE_H 1
-
-/* Define to 1 if you have the <sys/ioctl.h> header file. */
-#define HAVE_SYS_IOCTL_H 1
-
-/* Define to 1 if you have the <sys/mman.h> header file. */
-#define HAVE_SYS_MMAN_H 1
-
-/* Define to 1 if you have the <poll.h> header file. */
-#define HAVE_POLL_H 1
-
-/* Define to 1 if you have the <sys/socket.h> header file. */
-#define HAVE_SYS_SOCKET_H 1
-
-/* Define to 1 if you have the <sys/sockio.h> header file. */
-/* #undef HAVE_SYS_SOCKIO_H */
-
-/* Define to 1 if you have the <sys/stat.h> header file. */
-#define HAVE_SYS_STAT_H 1
-
-/* Define to 1 if you have the <sys/time.h> header file. */
-#define HAVE_SYS_TIME_H 1
-
-/* Define to 1 if you have the <sys/types.h> header file. */
-#define HAVE_SYS_TYPES_H 1
-
-/* Define to 1 if you have the <sys/uio.h> header file. */
-#define HAVE_SYS_UIO_H 1
-
-/* Define to 1 if you have the <sys/un.h> header file. */
-#define HAVE_SYS_UN_H 1
-
-/* Define to 1 if you have <sys/wait.h> that is POSIX.1 compatible. */
-#define HAVE_SYS_WAIT_H 1
-
-/* Define to 1 if you have the `time' function. */
-#define HAVE_TIME 1
-
-/* struct tun_pi needed for IPv6 support */
-#define HAVE_TUN_PI 1
-
-/* Define to 1 if you have the `umask' function. */
-#define HAVE_UMASK 1
-
-/* Define to 1 if you have the <unistd.h> header file. */
-#define HAVE_UNISTD_H 1
-
-/* Define to 1 if you have the `unlink' function. */
-#define HAVE_UNLINK 1
-
-/* Define to 1 if you have the `vfork' function. */
-#define HAVE_VFORK 1
-
-/* Define to 1 if you have the <vfork.h> header file. */
-/* #undef HAVE_VFORK_H */
-
-/* Define to 1 if you have the `vsnprintf' function. */
-#define HAVE_VSNPRINTF 1
-
-/* Define to 1 if `fork' works. */
-#define HAVE_WORKING_FORK 1
-
-/* Define to 1 if `vfork' works. */
-#define HAVE_WORKING_VFORK 1
-
-/* Define to 1 if you have the `writev' function. */
-#define HAVE_WRITEV 1
-
-/* Path to ifconfig tool */
-#define IFCONFIG_PATH "/system/xbin/ifconfig"
-
-/* Path to iproute tool */
-#define IPROUTE_PATH "ip"
-
-/* Use lzo/ directory prefix for LZO header files (for LZO 2.0) */
-#define LZO_HEADER_DIR 1
-
-/* LZO version number */
-#define LZO_VERSION_NUM "2"
-
-/* Name of package */
-#define PACKAGE "openvpn"
-
-/* Define to the address where bug reports for this package should be sent. */
-#define PACKAGE_BUGREPORT "openvpn-users@lists.sourceforge.net"
-
-/* Define to the full name of this package. */
-#define PACKAGE_NAME "OpenVPN"
-
-/* Define to the full name and version of this package. */
-#define PACKAGE_STRING "OpenVPN 2.6-icsopenvpn"
-
-/* Define to the one symbol short name of this package. */
-#define PACKAGE_TARNAME "openvpn"
-
-/* Define to the version of this package. */
-#define PACKAGE_VERSION "2.6_master"
-
-/* Define to the necessary symbol if this constant uses a non-standard name on
-   your system. */
-/* #undef PTHREAD_CREATE_JOINABLE */
-
-/* Define as the return type of signal handlers (`int' or `void'). */
-#define RETSIGTYPE void
-
-/* Path to route tool */
-#define ROUTE_PATH "/system/xbin/route"
-
-/* The size of `unsigned int', as computed by sizeof. */
-#define SIZEOF_UNSIGNED_INT 4
-
-/* The size of `unsigned long', as computed by sizeof. */
-#define SIZEOF_UNSIGNED_LONG 4
-
-/* Define to 1 if you have the ANSI C header files. */
-#define STDC_HEADERS 1
-
-/* Enable strict options check between peers */
-/* #undef STRICT_OPTIONS_CHECK */
-
-/* The TAP-Win32 id defined in tap-win32/SOURCES */
-#define TAP_ID "tap0901"
-
-/* The TAP-Win32 version number is defined in tap-win32/SOURCES */
-#define TAP_WIN32_MIN_MAJOR 9
-
-/* The TAP-Win32 version number is defined in tap-win32/SOURCES */
-#define TAP_WIN32_MIN_MINOR 1
-
-/* A string representing our target */
-#define TARGET_ALIAS TARGET_ABI
-
-/* Are we running on Mac OS X? */
-/* #undef TARGET_DARWIN */
-
-/* Are we running on DragonFlyBSD? */
-/* #undef TARGET_DRAGONFLY */
-
-/* Are we running on FreeBSD? */
-/* #undef TARGET_FREEBSD */
-
-/* Are we running on Android Linux? */
-/* TARGET_LINUX is not enable since the TARGET_XXX options mainly
-   control different tun/tap, ifconfig behaviour and Android VpnProvider
-   is very different from Linux */
-#define TARGET_ANDROID
-
-/* Are we running on Linux? */
-/* #define TARGET_LINUX 1 */
-
-/* Are we running NetBSD? */
-/* #undef TARGET_NETBSD */
-
-/* Are we running on OpenBSD? */
-/* #undef TARGET_OPENBSD */
-
-/* Are we running on Solaris? */
-/* #undef TARGET_SOLARIS */
-
-/* Are we running WIN32? */
-/* #undef TARGET_WIN32 */
-
-/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
-#define TIME_WITH_SYS_TIME 1
-
-/* Win32 builtin */
-/* #undef UF */
-
-/* Use OpenSSL crypto library */
-#define USE_CRYPTO 1
-
-/* Use libdl for dynamic library loading */
-#define USE_LIBDL 1
-
-/* Use LoadLibrary to load DLLs on Windows */
-/* #undef USE_LOAD_LIBRARY */
-
-/* Use LZO compression library */
-#define ENABLE_LZO 1
-#define ENABLE_SNAPPY 1
-#define ENABLE_LZ4 1
-#define NEED_COMPAT_LZ4 1
-
-/* Enable PKCS11 capability */
-/* #undef USE_PKCS11 */
-
-/* Use pthread-based multithreading */
-/* #undef USE_PTHREAD */
-
-/* Use OpenSSL SSL library */
-#define ENABLE_SSL 1
-#define USE_SSL 1
-#define ENABLE_CRYPTO 1
-
-/* via android.mk */
-/*#define ENABLE_CRYPTO_OPENSSL 1*/
-/* #define ENABLE_CRYPTO_POLARSSL 1 */
-
-/* Use valgrind memory debugging library */
-/* #undef USE_VALGRIND */
-
-/* Version number of package */
-//#define VERSION "2.3.1"
-
-/* Enable GNU extensions on systems that have them.  */
-#ifndef _GNU_SOURCE
-# define _GNU_SOURCE 1
-#endif
-
-/* Define to empty if `const' does not conform to ANSI C. */
-/* #undef const */
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-/* #undef gid_t */
-
-/* Some systems don't define in_addr_t */
-/* #undef in_addr_t */
-
-/* Define to `__inline__' or `__inline' if that's what the C compiler
-   calls it, or to nothing if 'inline' is not supported under any name.  */
-#ifndef __cplusplus
-/* #undef inline */
-#endif
-
-/* Define to `long int' if <sys/types.h> does not define. */
-/* #undef off_t */
-
-/* Define to `int' if <sys/types.h> does not define. */
-/* #undef pid_t */
-
-/* Define to `unsigned int' if <sys/types.h> does not define. */
-/* #undef size_t */
-
-/* type to use in place of socklen_t if not defined */
-/* #undef socklen_t */
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-/* #undef uid_t */
-
-/* 16-bit unsigned type */
-/* #undef uint16_t */
-
-/* 32-bit unsigned type */
-/* #undef uint32_t */
-
-/* 8-bit unsigned type */
-/* #undef uint8_t */
-
-/* Define as `fork' if `vfork' does not work. */
-/* #undef vfork */
-
-/* Define to empty if the keyword `volatile' does not work. Warning: valid
-   code using `volatile' can become incorrect without. Disable with care. */
-/* #undef volatile */
-
-// New version
-#define HAVE_INET_NTOP 1
-#define HAVE_INET_PTON 1
-#define HAVE_LZO_LZOUTIL_H 1
-#define HAVE_LZO_LZO1X_H 1
-#define HAVE_SYS_TIME_H 1
-#define HAVE_TIME_H 1
-// #define HAVE_CONFIG_VERSION_H 1
-#define PATH_SEPARATOR_STR "/"
-#define HAVE_SA_FAMILY_T 1
-
-
-// Workaround for bionc
-#define IPPROTO_IP IPPROTO_IP
-#define IPPROTO_TCP IPPROTO_TCP
-
-int res_init();
-
-#define HAVE_AEAD_CIPHER_MODES 1
-
-#define HAVE_EVP_MD_CTX_RESET 1
-#define HAVE_EVP_MD_CTX_FREE 1
-#define HAVE_EVP_MD_CTX_NEW 1
-#define HAVE_EVP_CIPHER_CTX_FREE 1
-#define HAVE_EVP_CIPHER_CTX_NEW 1
-#define HAVE_HMAC_CTX_RESET 1
-#define HAVE_HMAC_CTX_FREE 1
-#define HAVE_HMAC_CTX_NEW 1
-#define HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB_USERDATA 1
-#define HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB 1
-#define HAVE_X509_GET0_PUBKEY 1
-#define HAVE_X509_STORE_GET0_OBJECTS 1
-#define HAVE_X509_OBJECT_FREE 1
-#define HAVE_X509_OBJECT_GET_TYPE 1
-#define HAVE_EVP_PKEY_GET0_RSA 1
-#define HAVE_EVP_PKEY_ID 1
-#define HAVE_EVP_PKEY_GET0_DSA 1
-#define HAVE_RSA_SET_FLAGS 1
-#define HAVE_RSA_GET0_KEY 1
-#define HAVE_RSA_SET0_KEY 1
-#define HAVE_RSA_BITS 1
-#define HAVE_DSA_BITS 1
-#define HAVE_DSA_GET0_PQG 1
-#define HAVE_RSA_METH_NEW 1
-#define HAVE_RSA_METH_FREE 1
-#define HAVE_RSA_METH_SET_PUB_ENC 1
-#define HAVE_RSA_METH_SET_PUB_DEC 1
-#define HAVE_RSA_METH_SET_PRIV_DEC 1
-#define HAVE_RSA_METH_SET_PRIV_ENC 1
-#define HAVE_RSA_METH_SET_INIT 1
-#define HAVE_RSA_METH_SET_FINISH 1
-#define HAVE_RSA_METH_SET0_APP_DATA 1
-#define HAVE_EVP_PKEY_GET0_EC_KEY 1
-#define HAVE_EC_GROUP_ORDER_BITS 1
-#define HAVE_RSA_METH_GET0_APP_DATA 1
-#define HAVE_RSA_METH_SET_SIGN 1
-
-#define ENABLE_OFB_CFB_MODE 1
-
-#define HAVE_X509_GET0_NOTBEFORE 1
-#define HAVE_X509_GET0_NOTAFTER 1
-
-#define HAVE_OPENSSL_VERSION 1
-#define HAVE_EVP_CIPHER_CTX_RESET
-
-
-#define _SOCKLEN_T_DECLARED 1
--- a/client/android/cpp/openvpn-config/openvpn-plugin.h
+++ b/client/android/cpp/openvpn-config/openvpn-plugin.h
@@ -1,875 +0,0 @@
-/* include/openvpn-plugin.h.  Generated from openvpn-plugin.h.in by configure.  */
-/*
- *  OpenVPN -- An application to securely tunnel IP networks
- *             over a single TCP/UDP port, with support for SSL/TLS-based
- *             session authentication and key exchange,
- *             packet encryption, packet authentication, and
- *             packet compression.
- *
- *  Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2
- *  as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#ifndef OPENVPN_PLUGIN_H_
-#define OPENVPN_PLUGIN_H_
-
-#define OPENVPN_PLUGIN_VERSION 3
-
-#ifdef ENABLE_CRYPTO_MBEDTLS
-#include <mbedtls/x509_crt.h>
-#ifndef __OPENVPN_X509_CERT_T_DECLARED
-#define __OPENVPN_X509_CERT_T_DECLARED
-typedef mbedtls_x509_crt openvpn_x509_cert_t;
-#endif
-#else  /* ifdef ENABLE_CRYPTO_MBEDTLS */
-#include <openssl/x509.h>
-#ifndef __OPENVPN_X509_CERT_T_DECLARED
-#define __OPENVPN_X509_CERT_T_DECLARED
-typedef X509 openvpn_x509_cert_t;
-#endif
-#endif
-
-#include <stdarg.h>
-#include <stddef.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* Provide some basic version information to plug-ins at OpenVPN compile time
- * This is will not be the complete version
- */
-#define OPENVPN_VERSION_MAJOR 2
-#define OPENVPN_VERSION_MINOR 5
-#define OPENVPN_VERSION_PATCH "_git"
-
-/*
- * Plug-in types.  These types correspond to the set of script callbacks
- * supported by OpenVPN.
- *
- * This is the general call sequence to expect when running in server mode:
- *
- * Initial Server Startup:
- *
- * FUNC: openvpn_plugin_open_v1
- * FUNC: openvpn_plugin_client_constructor_v1 (this is the top-level "generic"
- *                                             client template)
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_UP
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_ROUTE_UP
- *
- * New Client Connection:
- *
- * FUNC: openvpn_plugin_client_constructor_v1
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_ENABLE_PF
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_TLS_VERIFY (called once for every cert
- *                                                     in the server chain)
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_TLS_FINAL
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_IPCHANGE
- *
- * [If OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY returned OPENVPN_PLUGIN_FUNC_DEFERRED,
- * we don't proceed until authentication is verified via auth_control_file]
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_CLIENT_CONNECT_V2
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_LEARN_ADDRESS
- *
- * [Client session ensues]
- *
- * For each "TLS soft reset", according to reneg-sec option (or similar):
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_ENABLE_PF
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_TLS_VERIFY (called once for every cert
- *                                                     in the server chain)
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_TLS_FINAL
- *
- * [If OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY returned OPENVPN_PLUGIN_FUNC_DEFERRED,
- * we expect that authentication is verified via auth_control_file within
- * the number of seconds defined by the "hand-window" option.  Data channel traffic
- * will continue to flow uninterrupted during this period.]
- *
- * [Client session continues]
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_CLIENT_DISCONNECT
- * FUNC: openvpn_plugin_client_destructor_v1
- *
- * [ some time may pass ]
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_LEARN_ADDRESS (this coincides with a
- *                                                            lazy free of initial
- *                                                            learned addr object)
- * Server Shutdown:
- *
- * FUNC: openvpn_plugin_func_v1 OPENVPN_PLUGIN_DOWN
- * FUNC: openvpn_plugin_client_destructor_v1 (top-level "generic" client)
- * FUNC: openvpn_plugin_close_v1
- */
-#define OPENVPN_PLUGIN_UP                        0
-#define OPENVPN_PLUGIN_DOWN                      1
-#define OPENVPN_PLUGIN_ROUTE_UP                  2
-#define OPENVPN_PLUGIN_IPCHANGE                  3
-#define OPENVPN_PLUGIN_TLS_VERIFY                4
-#define OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY     5
-#define OPENVPN_PLUGIN_CLIENT_CONNECT            6
-#define OPENVPN_PLUGIN_CLIENT_DISCONNECT         7
-#define OPENVPN_PLUGIN_LEARN_ADDRESS             8
-#define OPENVPN_PLUGIN_CLIENT_CONNECT_V2         9
-#define OPENVPN_PLUGIN_TLS_FINAL                10
-#define OPENVPN_PLUGIN_ENABLE_PF                11
-#define OPENVPN_PLUGIN_ROUTE_PREDOWN            12
-#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER     13
-#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2  14
-#define OPENVPN_PLUGIN_CLIENT_CRRESPONSE        15
-#define OPENVPN_PLUGIN_N                        16
-
-/*
- * Build a mask out of a set of plug-in types.
- */
-#define OPENVPN_PLUGIN_MASK(x) (1<<(x))
-
-/*
- * A pointer to a plugin-defined object which contains
- * the object state.
- */
-typedef void *openvpn_plugin_handle_t;
-
-/*
- * Return value for openvpn_plugin_func_v1 function
- */
-#define OPENVPN_PLUGIN_FUNC_SUCCESS  0
-#define OPENVPN_PLUGIN_FUNC_ERROR    1
-#define OPENVPN_PLUGIN_FUNC_DEFERRED 2
-
-/*
- * For Windows (needs to be modified for MSVC)
- */
-#if defined(_WIN32) && !defined(OPENVPN_PLUGIN_H)
-#define OPENVPN_EXPORT __declspec(dllexport)
-#else
-#define OPENVPN_EXPORT
-#endif
-
-/*
- * If OPENVPN_PLUGIN_H is defined, we know that we are being
- * included in an OpenVPN compile, rather than a plugin compile.
- */
-#ifdef OPENVPN_PLUGIN_H
-
-/*
- * We are compiling OpenVPN.
- */
-#define OPENVPN_PLUGIN_DEF        typedef
-#define OPENVPN_PLUGIN_FUNC(name) (*name)
-
-#else  /* ifdef OPENVPN_PLUGIN_H */
-
-/*
- * We are compiling plugin.
- */
-#define OPENVPN_PLUGIN_DEF        OPENVPN_EXPORT
-#define OPENVPN_PLUGIN_FUNC(name) name
-
-#endif
-
-/*
- * Used by openvpn_plugin_func to return structured
- * data.  The plugin should allocate all structure
- * instances, name strings, and value strings with
- * malloc, since OpenVPN will assume that it
- * can free the list by calling free() over the same.
- */
-struct openvpn_plugin_string_list
-{
-    struct openvpn_plugin_string_list *next;
-    char *name;
-    char *value;
-};
-
-
-/* openvpn_plugin_{open,func}_v3() related structs */
-
-/**
- * Defines version of the v3 plugin argument structs
- *
- * Whenever one or more of these structs are modified, this constant
- * must be updated.  A changelog should be appended in this comment
- * as well, to make it easier to see what information is available
- * in the different versions.
- *
- * Version   Comment
- *    1      Initial plugin v3 structures providing the same API as
- *           the v2 plugin interface, X509 certificate information +
- *           a logging API for plug-ins.
- *
- *    2      Added ssl_api member in struct openvpn_plugin_args_open_in
- *           which identifies the SSL implementation OpenVPN is compiled
- *           against.
- *
- *    3      Added ovpn_version, ovpn_version_major, ovpn_version_minor
- *           and ovpn_version_patch to provide the runtime version of
- *           OpenVPN to plug-ins.
- *
- *    4      Exported secure_memzero() as plugin_secure_memzero()
- *
- *    5      Exported openvpn_base64_encode() as plugin_base64_encode()
- *           Exported openvpn_base64_decode() as plugin_base64_decode()
- */
-#define OPENVPN_PLUGINv3_STRUCTVER 5
-
-/**
- * Definitions needed for the plug-in callback functions.
- */
-typedef enum
-{
-    PLOG_ERR    = (1 << 0),/* Error condition message */
-    PLOG_WARN   = (1 << 1),/* General warning message */
-    PLOG_NOTE   = (1 << 2),/* Informational message */
-    PLOG_DEBUG  = (1 << 3),/* Debug message, displayed if verb >= 7 */
-
-    PLOG_ERRNO  = (1 << 8),/* Add error description to message */
-    PLOG_NOMUTE = (1 << 9), /* Mute setting does not apply for message */
-
-} openvpn_plugin_log_flags_t;
-
-
-#ifdef __GNUC__
-#if __USE_MINGW_ANSI_STDIO
-#define _ovpn_chk_fmt(a, b) __attribute__ ((format(gnu_printf, (a), (b))))
-#else
-#define _ovpn_chk_fmt(a, b) __attribute__ ((format(__printf__, (a), (b))))
-#endif
-#else  /* ifdef __GNUC__ */
-#define _ovpn_chk_fmt(a, b)
-#endif
-
-typedef void (*plugin_log_t)(openvpn_plugin_log_flags_t flags,
-                             const char *plugin_name,
-                             const char *format, ...) _ovpn_chk_fmt (3, 4);
-
-typedef void (*plugin_vlog_t)(openvpn_plugin_log_flags_t flags,
-                              const char *plugin_name,
-                              const char *format,
-                              va_list arglist) _ovpn_chk_fmt (3, 0);
-/* #undef _ovpn_chk_fmt */
-
-/**
- *  Export of secure_memzero() to be used inside plug-ins
- *
- *  @param data   Pointer to data to zeroise
- *  @param len    Length of data, in bytes
- *
- */
-typedef void (*plugin_secure_memzero_t)(void *data, size_t len);
-
-/**
- *  Export of openvpn_base64_encode() to be used inside plug-ins
- *
- *  @param data   Pointer to data to BASE64 encode
- *  @param size   Length of data, in bytes
- *  @param *str   Pointer to the return buffer.  This needed memory is
- *                allocated by openvpn_base64_encode() and needs to be free()d
- *                after use.
- *
- *  @return int   Returns the length of the buffer created, or -1 on error.
- *
- */
-typedef int (*plugin_base64_encode_t)(const void *data, int size, char **str);
-
-/**
- *  Export of openvpn_base64_decode() to be used inside plug-ins
- *
- *  @param str    Pointer to the BASE64 encoded data
- *  @param data   Pointer to the buffer where save the decoded data
- *  @param size   Size of the destination buffer
- *
- *  @return int   Returns the length of the decoded data, or -1 on error or
- *                if the destination buffer is too small.
- *
- */
-typedef int (*plugin_base64_decode_t)(const char *str, void *data, int size);
-
-
-/**
- * Used by the openvpn_plugin_open_v3() function to pass callback
- * function pointers to the plug-in.
- *
- * plugin_log
- * plugin_vlog : Use these functions to add information to the OpenVPN log file.
- *               Messages will only be displayed if the plugin_name parameter
- *               is set. PLOG_DEBUG messages will only be displayed with plug-in
- *               debug log verbosity (at the time of writing that's verb >= 7).
- *
- * plugin_secure_memzero
- *             : Use this function to securely wipe sensitive information from
- *               memory.  This function is declared in a way that the compiler
- *               will not remove these function calls during the compiler
- *               optimization phase.
- */
-struct openvpn_plugin_callbacks
-{
-    plugin_log_t plugin_log;
-    plugin_vlog_t plugin_vlog;
-    plugin_secure_memzero_t plugin_secure_memzero;
-    plugin_base64_encode_t plugin_base64_encode;
-    plugin_base64_decode_t plugin_base64_decode;
-};
-
-/**
- * Used by the openvpn_plugin_open_v3() function to indicate to the
- * plug-in what kind of SSL implementation OpenVPN uses.  This is
- * to avoid SEGV issues when OpenVPN is complied against mbed TLS
- * and the plug-in against OpenSSL.
- */
-typedef enum {
-    SSLAPI_NONE,
-    SSLAPI_OPENSSL,
-    SSLAPI_MBEDTLS
-} ovpnSSLAPI;
-
-/**
- * Arguments used to transport variables to the plug-in.
- * The struct openvpn_plugin_args_open_in is only used
- * by the openvpn_plugin_open_v3() function.
- *
- * STRUCT MEMBERS
- *
- * type_mask : Set by OpenVPN to the logical OR of all script
- *             types which this version of OpenVPN supports.
- *
- * argv : a NULL-terminated array of options provided to the OpenVPN
- *        "plug-in" directive.  argv[0] is the dynamic library pathname.
- *
- * envp : a NULL-terminated array of OpenVPN-set environmental
- *        variables in "name=value" format.  Note that for security reasons,
- *        these variables are not actually written to the "official"
- *        environmental variable store of the process.
- *
- * callbacks : a pointer to the plug-in callback function struct.
- *
- */
-struct openvpn_plugin_args_open_in
-{
-    const int type_mask;
-    const char **const argv;
-    const char **const envp;
-    struct openvpn_plugin_callbacks *callbacks;
-    const ovpnSSLAPI ssl_api;
-    const char *ovpn_version;
-    const unsigned int ovpn_version_major;
-    const unsigned int ovpn_version_minor;
-    const char *const ovpn_version_patch;
-};
-
-
-/**
- * Arguments used to transport variables from the plug-in back
- * to the OpenVPN process.  The struct openvpn_plugin_args_open_return
- * is only used by the openvpn_plugin_open_v3() function.
- *
- * STRUCT MEMBERS
- *
- * type_mask  : The plug-in should set this value to the logical OR of all script
- *              types which the plug-in wants to intercept.  For example, if the
- *              script wants to intercept the client-connect and client-disconnect
- *              script types:
- *
- *              type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_CONNECT)
- *                         | OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_DISCONNECT)
- *
- * handle :     Pointer to a global plug-in context, created by the plug-in.  This pointer
- *              is passed on to the other plug-in calls.
- *
- * return_list : used to return data back to OpenVPN.
- *
- */
-struct openvpn_plugin_args_open_return
-{
-    int type_mask;
-    openvpn_plugin_handle_t handle;
-    struct openvpn_plugin_string_list **return_list;
-};
-
-/**
- * Arguments used to transport variables to and from the
- * plug-in.  The struct openvpn_plugin_args_func is only used
- * by the openvpn_plugin_func_v3() function.
- *
- * STRUCT MEMBERS:
- *
- * type : one of the PLUGIN_x types.
- *
- * argv : a NULL-terminated array of "command line" options which
- *        would normally be passed to the script.  argv[0] is the dynamic
- *        library pathname.
- *
- * envp : a NULL-terminated array of OpenVPN-set environmental
- *        variables in "name=value" format.  Note that for security reasons,
- *        these variables are not actually written to the "official"
- *        environmental variable store of the process.
- *
- * handle : Pointer to a global plug-in context, created by the plug-in's openvpn_plugin_open_v3().
- *
- * per_client_context : the per-client context pointer which was returned by
- *        openvpn_plugin_client_constructor_v1, if defined.
- *
- * current_cert_depth : Certificate depth of the certificate being passed over
- *
- * *current_cert : X509 Certificate object received from the client
- *
- */
-struct openvpn_plugin_args_func_in
-{
-    const int type;
-    const char **const argv;
-    const char **const envp;
-    openvpn_plugin_handle_t handle;
-    void *per_client_context;
-    int current_cert_depth;
-    openvpn_x509_cert_t *current_cert;
-};
-
-
-/**
- * Arguments used to transport variables to and from the
- * plug-in.  The struct openvpn_plugin_args_func is only used
- * by the openvpn_plugin_func_v3() function.
- *
- * STRUCT MEMBERS:
- *
- * return_list : used to return data back to OpenVPN for further processing/usage by
- *               the OpenVPN executable.
- *
- */
-struct openvpn_plugin_args_func_return
-{
-    struct openvpn_plugin_string_list **return_list;
-};
-
-/*
- * Multiple plugin modules can be cascaded, and modules can be
- * used in tandem with scripts.  The order of operation is that
- * the module func() functions are called in the order that
- * the modules were specified in the config file.  If a script
- * was specified as well, it will be called last.  If the
- * return code of the module/script controls an authentication
- * function (such as tls-verify or auth-user-pass-verify), then
- * every module and script must return success (0) in order for
- * the connection to be authenticated.
- *
- * Notes:
- *
- * Plugins which use a privilege-separation model (by forking in
- * their initialization function before the main OpenVPN process
- * downgrades root privileges and/or executes a chroot) must
- * daemonize after a fork if the "daemon" environmental variable is
- * set.  In addition, if the "daemon_log_redirect" variable is set,
- * the plugin should preserve stdout/stderr across the daemon()
- * syscall.  See the daemonize() function in plugin/auth-pam/auth-pam.c
- * for an example.
- */
-
-/*
- * Prototypes for functions which OpenVPN plug-ins must define.
- */
-
-/*
- * FUNCTION: openvpn_plugin_open_v2
- *
- * REQUIRED: YES
- *
- * Called on initial plug-in load.  OpenVPN will preserve plug-in state
- * across SIGUSR1 restarts but not across SIGHUP restarts.  A SIGHUP reset
- * will cause the plugin to be closed and reopened.
- *
- * ARGUMENTS
- *
- * *type_mask : Set by OpenVPN to the logical OR of all script
- *              types which this version of OpenVPN supports.  The plug-in
- *              should set this value to the logical OR of all script types
- *              which the plug-in wants to intercept.  For example, if the
- *              script wants to intercept the client-connect and
- *              client-disconnect script types:
- *
- *              *type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_CONNECT)
- *                         | OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_DISCONNECT)
- *
- * argv : a NULL-terminated array of options provided to the OpenVPN
- *        "plug-in" directive.  argv[0] is the dynamic library pathname.
- *
- * envp : a NULL-terminated array of OpenVPN-set environmental
- *        variables in "name=value" format.  Note that for security reasons,
- *        these variables are not actually written to the "official"
- *        environmental variable store of the process.
- *
- * return_list : used to return data back to OpenVPN.
- *
- * RETURN VALUE
- *
- * An openvpn_plugin_handle_t value on success, NULL on failure
- */
-OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_open_v2)
-    (unsigned int *type_mask,
-    const char *argv[],
-    const char *envp[],
-    struct openvpn_plugin_string_list **return_list);
-
-/*
- * FUNCTION: openvpn_plugin_func_v2
- *
- * Called to perform the work of a given script type.
- *
- * REQUIRED: YES
- *
- * ARGUMENTS
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * type : one of the PLUGIN_x types
- *
- * argv : a NULL-terminated array of "command line" options which
- *        would normally be passed to the script.  argv[0] is the dynamic
- *        library pathname.
- *
- * envp : a NULL-terminated array of OpenVPN-set environmental
- *        variables in "name=value" format.  Note that for security reasons,
- *        these variables are not actually written to the "official"
- *        environmental variable store of the process.
- *
- * per_client_context : the per-client context pointer which was returned by
- *        openvpn_plugin_client_constructor_v1, if defined.
- *
- * return_list : used to return data back to OpenVPN.
- *
- * RETURN VALUE
- *
- * OPENVPN_PLUGIN_FUNC_SUCCESS on success, OPENVPN_PLUGIN_FUNC_ERROR on failure
- *
- * In addition, OPENVPN_PLUGIN_FUNC_DEFERRED may be returned by
- * OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY.  This enables asynchronous
- * authentication where the plugin (or one of its agents) may indicate
- * authentication success/failure some number of seconds after the return
- * of the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY handler by writing a single
- * char to the file named by auth_control_file in the environmental variable
- * list (envp).
- *
- * first char of auth_control_file:
- * '0' -- indicates auth failure
- * '1' -- indicates auth success
- *
- * OpenVPN will delete the auth_control_file after it goes out of scope.
- *
- * If an OPENVPN_PLUGIN_ENABLE_PF handler is defined and returns success
- * for a particular client instance, packet filtering will be enabled for that
- * instance.  OpenVPN will then attempt to read the packet filter configuration
- * from the temporary file named by the environmental variable pf_file.  This
- * file may be generated asynchronously and may be dynamically updated during the
- * client session, however the client will be blocked from sending or receiving
- * VPN tunnel packets until the packet filter file has been generated.  OpenVPN
- * will periodically test the packet filter file over the life of the client
- * instance and reload when modified.  OpenVPN will delete the packet filter file
- * when the client instance goes out of scope.
- *
- * Packet filter file grammar:
- *
- * [CLIENTS DROP|ACCEPT]
- * {+|-}common_name1
- * {+|-}common_name2
- * . . .
- * [SUBNETS DROP|ACCEPT]
- * {+|-}subnet1
- * {+|-}subnet2
- * . . .
- * [END]
- *
- * Subnet: IP-ADDRESS | IP-ADDRESS/NUM_NETWORK_BITS
- *
- * CLIENTS refers to the set of clients (by their common-name) which
- * this instance is allowed ('+') to connect to, or is excluded ('-')
- * from connecting to.  Note that in the case of client-to-client
- * connections, such communication must be allowed by the packet filter
- * configuration files of both clients.
- *
- * SUBNETS refers to IP addresses or IP address subnets which this
- * instance may connect to ('+') or is excluded ('-') from connecting
- * to.
- *
- * DROP or ACCEPT defines default policy when there is no explicit match
- * for a common-name or subnet.  The [END] tag must exist.  A special
- * purpose tag called [KILL] will immediately kill the client instance.
- * A given client or subnet rule applies to both incoming and outgoing
- * packets.
- *
- * See plugin/defer/simple.c for an example on using asynchronous
- * authentication and client-specific packet filtering.
- */
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
-    (openvpn_plugin_handle_t handle,
-    const int type,
-    const char *argv[],
-    const char *envp[],
-    void *per_client_context,
-    struct openvpn_plugin_string_list **return_list);
-
-
-/*
- * FUNCTION: openvpn_plugin_open_v3
- *
- * REQUIRED: YES
- *
- * Called on initial plug-in load.  OpenVPN will preserve plug-in state
- * across SIGUSR1 restarts but not across SIGHUP restarts.  A SIGHUP reset
- * will cause the plugin to be closed and reopened.
- *
- * ARGUMENTS
- *
- * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *           should validate that this value is matching the OPENVPN_PLUGINv3_STRUCTVER
- *           value.
- *
- * arguments : Structure with all arguments available to the plug-in.
- *
- * retptr :    used to return data back to OpenVPN.
- *
- * RETURN VALUE
- *
- * OPENVPN_PLUGIN_FUNC_SUCCESS on success, OPENVPN_PLUGIN_FUNC_ERROR on failure
- */
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_open_v3)
-    (const int version,
-    struct openvpn_plugin_args_open_in const *arguments,
-    struct openvpn_plugin_args_open_return *retptr);
-
-/*
- * FUNCTION: openvpn_plugin_func_v3
- *
- * Called to perform the work of a given script type.
- *
- * REQUIRED: YES
- *
- * ARGUMENTS
- *
- * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *           should validate that this value is matching the OPENVPN_PLUGIN_VERSION value.
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * return_list : used to return data back to OpenVPN.
- *
- * RETURN VALUE
- *
- * OPENVPN_PLUGIN_FUNC_SUCCESS on success, OPENVPN_PLUGIN_FUNC_ERROR on failure
- *
- * In addition, OPENVPN_PLUGIN_FUNC_DEFERRED may be returned by
- * OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY.  This enables asynchronous
- * authentication where the plugin (or one of its agents) may indicate
- * authentication success/failure some number of seconds after the return
- * of the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY handler by writing a single
- * char to the file named by auth_control_file in the environmental variable
- * list (envp).
- *
- * first char of auth_control_file:
- * '0' -- indicates auth failure
- * '1' -- indicates auth success
- *
- * OpenVPN will delete the auth_control_file after it goes out of scope.
- *
- * If an OPENVPN_PLUGIN_ENABLE_PF handler is defined and returns success
- * for a particular client instance, packet filtering will be enabled for that
- * instance.  OpenVPN will then attempt to read the packet filter configuration
- * from the temporary file named by the environmental variable pf_file.  This
- * file may be generated asynchronously and may be dynamically updated during the
- * client session, however the client will be blocked from sending or receiving
- * VPN tunnel packets until the packet filter file has been generated.  OpenVPN
- * will periodically test the packet filter file over the life of the client
- * instance and reload when modified.  OpenVPN will delete the packet filter file
- * when the client instance goes out of scope.
- *
- * Packet filter file grammar:
- *
- * [CLIENTS DROP|ACCEPT]
- * {+|-}common_name1
- * {+|-}common_name2
- * . . .
- * [SUBNETS DROP|ACCEPT]
- * {+|-}subnet1
- * {+|-}subnet2
- * . . .
- * [END]
- *
- * Subnet: IP-ADDRESS | IP-ADDRESS/NUM_NETWORK_BITS
- *
- * CLIENTS refers to the set of clients (by their common-name) which
- * this instance is allowed ('+') to connect to, or is excluded ('-')
- * from connecting to.  Note that in the case of client-to-client
- * connections, such communication must be allowed by the packet filter
- * configuration files of both clients.
- *
- * SUBNETS refers to IP addresses or IP address subnets which this
- * instance may connect to ('+') or is excluded ('-') from connecting
- * to.
- *
- * DROP or ACCEPT defines default policy when there is no explicit match
- * for a common-name or subnet.  The [END] tag must exist.  A special
- * purpose tag called [KILL] will immediately kill the client instance.
- * A given client or subnet rule applies to both incoming and outgoing
- * packets.
- *
- * See plugin/defer/simple.c for an example on using asynchronous
- * authentication and client-specific packet filtering.
- */
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v3)
-    (const int version,
-    struct openvpn_plugin_args_func_in const *arguments,
-    struct openvpn_plugin_args_func_return *retptr);
-
-/*
- * FUNCTION: openvpn_plugin_close_v1
- *
- * REQUIRED: YES
- *
- * ARGUMENTS
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * Called immediately prior to plug-in unload.
- */
-OPENVPN_PLUGIN_DEF void OPENVPN_PLUGIN_FUNC(openvpn_plugin_close_v1)
-    (openvpn_plugin_handle_t handle);
-
-/*
- * FUNCTION: openvpn_plugin_abort_v1
- *
- * REQUIRED: NO
- *
- * ARGUMENTS
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * Called when OpenVPN is in the process of aborting due to a fatal error.
- * Will only be called on an open context returned by a prior successful
- * openvpn_plugin_open callback.
- */
-OPENVPN_PLUGIN_DEF void OPENVPN_PLUGIN_FUNC(openvpn_plugin_abort_v1)
-    (openvpn_plugin_handle_t handle);
-
-/*
- * FUNCTION: openvpn_plugin_client_constructor_v1
- *
- * Called to allocate a per-client memory region, which
- * is then passed to the openvpn_plugin_func_v2 function.
- * This function is called every time the OpenVPN server
- * constructs a client instance object, which normally
- * occurs when a session-initiating packet is received
- * by a new client, even before the client has authenticated.
- *
- * This function should allocate the private memory needed
- * by the plugin to track individual OpenVPN clients, and
- * return a void * to this memory region.
- *
- * REQUIRED: NO
- *
- * ARGUMENTS
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * RETURN VALUE
- *
- * void * pointer to plugin's private per-client memory region, or NULL
- * if no memory region is required.
- */
-OPENVPN_PLUGIN_DEF void *OPENVPN_PLUGIN_FUNC(openvpn_plugin_client_constructor_v1)
-    (openvpn_plugin_handle_t handle);
-
-/*
- * FUNCTION: openvpn_plugin_client_destructor_v1
- *
- * This function is called on client instance object destruction.
- *
- * REQUIRED: NO
- *
- * ARGUMENTS
- *
- * handle : the openvpn_plugin_handle_t value which was returned by
- *          openvpn_plugin_open.
- *
- * per_client_context : the per-client context pointer which was returned by
- *        openvpn_plugin_client_constructor_v1, if defined.
- */
-OPENVPN_PLUGIN_DEF void OPENVPN_PLUGIN_FUNC(openvpn_plugin_client_destructor_v1)
-    (openvpn_plugin_handle_t handle, void *per_client_context);
-
-/*
- * FUNCTION: openvpn_plugin_select_initialization_point_v1
- *
- * Several different points exist in OpenVPN's initialization sequence where
- * the openvpn_plugin_open function can be called.  While the default is
- * OPENVPN_PLUGIN_INIT_PRE_DAEMON, this function can be used to select a
- * different initialization point.  For example, if your plugin needs to
- * return configuration parameters to OpenVPN, use
- * OPENVPN_PLUGIN_INIT_PRE_CONFIG_PARSE.
- *
- * REQUIRED: NO
- *
- * RETURN VALUE:
- *
- * An OPENVPN_PLUGIN_INIT_x value.
- */
-#define OPENVPN_PLUGIN_INIT_PRE_CONFIG_PARSE 1
-#define OPENVPN_PLUGIN_INIT_PRE_DAEMON       2 /* default */
-#define OPENVPN_PLUGIN_INIT_POST_DAEMON      3
-#define OPENVPN_PLUGIN_INIT_POST_UID_CHANGE  4
-
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_select_initialization_point_v1)
-    (void);
-
-/*
- * FUNCTION: openvpn_plugin_min_version_required_v1
- *
- * This function is called by OpenVPN to query the minimum
- * plugin interface version number required by the plugin.
- *
- * REQUIRED: NO
- *
- * RETURN VALUE
- *
- * The minimum OpenVPN plugin interface version number necessary to support
- * this plugin.
- */
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_min_version_required_v1)
-    (void);
-
-/*
- * Deprecated functions which are still supported for backward compatibility.
- */
-
-OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_open_v1)
-    (unsigned int *type_mask,
-    const char *argv[],
-    const char *envp[]);
-
-OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v1)
-    (openvpn_plugin_handle_t handle, const int type, const char *argv[], const char *envp[]);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* OPENVPN_PLUGIN_H_ */
--- a/client/android/cpp/openvpn3
+++ b/client/android/cpp/openvpn3
--- a/client/android/cpp/ovpnutil/jniglue.c
+++ b/client/android/cpp/ovpnutil/jniglue.c
@@ -1,40 +0,0 @@
-#include <jni.h>
-#include <android/log.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-
-#include "jniglue.h"
-
-jint JNI_OnLoad(JavaVM *vm, void *reserved) {
-#ifndef NDEBUG
-    __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "Loading openvpn native library $id$ compiled on "   __DATE__ " " __TIME__ );
-#endif
-    return JNI_VERSION_1_2;
-}
-
-
-void android_openvpn_log(int level,const char* prefix,const char* prefix_sep,const char* m1)
-{
-    __android_log_print(ANDROID_LOG_DEBUG,"openvpn","%s%s%s",prefix,prefix_sep,m1);
-}
-
-
-//! Hack to get the current installed ABI of the libraries. See also https://github.com/schwabe/ics-openvpn/issues/391
-jstring Java_de_blinkt_openvpn_core_NativeUtils_getJNIAPI(JNIEnv *env, jclass jo)
-{
-
-    return (*env)->NewStringUTF(env, TARGET_ARCH_ABI);
-}
-
-jstring Java_de_blinkt_openvpn_core_NativeUtils_getOpenVPN2GitVersion(JNIEnv *env, jclass jo)
-{
-
-  return (*env)->NewStringUTF(env, OPENVPN2_GIT_REVISION);
-}
-
-jstring Java_de_blinkt_openvpn_core_NativeUtils_getOpenVPN3GitVersion(JNIEnv *env, jclass jo)
-{
-
-  return (*env)->NewStringUTF(env, OPENVPN3_GIT_REVISION);
-}
--- a/client/android/cpp/ovpnutil/jniglue.h
+++ b/client/android/cpp/ovpnutil/jniglue.h
@@ -1,21 +0,0 @@
-//
-//  jniglue.h
-//  xcopenvpn
-//
-//  Created by Arne Schwabe on 29.03.12.
-//  Copyright (c) 2012 Universität Paderborn. All rights reserved.
-//
-
-#ifndef xcopenvpn_jniglue_h
-#define xcopenvpn_jniglue_h
-void android_openvpn_log(int level,const char* prefix,const char* prefix_sep,const char* m1);
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-    int jniThrowException(JNIEnv* env, const char* className, const char* msg);
-
-#ifdef __cplusplus
-}
-#endif
--- a/client/android/cpp/ovpnutil/rsapss.cpp
+++ b/client/android/cpp/ovpnutil/rsapss.cpp
@@ -1,146 +0,0 @@
-/* Adapted from OpenSSL's rsa_pss.c from OpenSSL 3.0.1 */
-
-/*
- * Copyright 2005-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-#include "jni.h"
-
-#include <openssl/evp.h>
-#include <openssl/rand.h>
-#include <openssl/rsa.h>
-
-#include <array>
-
-static const unsigned char zeroes[] = {0, 0, 0, 0, 0, 0, 0, 0};
-
-static char opensslerr[1024];
-extern "C" jbyteArray Java_de_blinkt_openvpn_core_NativeUtils_rsapss(JNIEnv *env,
-								     jclass,
-								     jint hashtype,
-								     jint MSBits,
-								     jint rsa_size,
-								     jbyteArray from) {
-
-  /*
-  unsigned char *EM,
-				     const unsigned char *mHash,
-				     const EVP_MD *Hash, const EVP_MD *mgf1Hash,
-				     int sLen)
-*/
-
-  jbyte *data = env->GetByteArrayElements(from, nullptr);
-  int datalen = env->GetArrayLength(from);
-
-  const auto *mHash = reinterpret_cast<const unsigned char *>(data);
-
-  const EVP_MD *Hash;
-
-  if (hashtype == 0) {
-    Hash = EVP_md5();
-  } else if (hashtype == 1) {
-    Hash = EVP_sha1();
-  } else if (hashtype == 2) {
-    Hash = EVP_sha224();
-  } else if (hashtype == 3) {
-    Hash = EVP_sha256();
-  } else if (hashtype == 4) {
-    Hash = EVP_sha384();
-  } else if (hashtype == 5) {
-    Hash = EVP_sha512();
-  }
-
-  const EVP_MD *mgf1Hash = Hash;
-
-  int ret = 0;
-  int maskedDBLen, emLen;
-  unsigned char *H, *salt = nullptr, *p;
-  EVP_MD_CTX *ctx = nullptr;
-
-  int hLen = EVP_MD_get_size(Hash);
-  int sLen = hLen; /* RSA_PSS_SALTLEN_DIGEST */
-
-  std::array<unsigned char, 2048> buf{};
-  unsigned char *EM = buf.data();
-
-  if (hLen < 0)
-    goto err;
-
-  emLen = rsa_size;
-  if (MSBits == 0) {
-    *EM++ = 0;
-    emLen--;
-  }
-  if (emLen < hLen + 2) {
-    goto err;
-  }
-  if (sLen == RSA_PSS_SALTLEN_MAX) {
-    sLen = emLen - hLen - 2;
-  } else if (sLen > emLen - hLen - 2) {
-    goto err;
-  }
-
-  if (sLen > 0) {
-    salt = (unsigned char *) OPENSSL_malloc(sLen);
-    if (salt == nullptr) {
-      goto err;
-    }
-    if (RAND_bytes_ex(nullptr, salt, sLen, 0) <= 0)
-      goto err;
-  }
-  maskedDBLen = emLen - hLen - 1;
-  H = EM + maskedDBLen;
-  ctx = EVP_MD_CTX_new();
-  if (ctx == nullptr)
-    goto err;
-  if (!EVP_DigestInit_ex(ctx, Hash, nullptr)
-      || !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
-      || !EVP_DigestUpdate(ctx, mHash, hLen))
-    goto err;
-  if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
-    goto err;
-  if (!EVP_DigestFinal_ex(ctx, H, nullptr))
-    goto err;
-
-  /* Generate dbMask in place then perform XOR on it */
-  if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash))
-    goto err;
-
-  p = EM;
-
-  /*
-   * Initial PS XORs with all zeroes which is a NOP so just update pointer.
-   * Note from a test above this value is guaranteed to be non-negative.
-   */
-  p += emLen - sLen - hLen - 2;
-  *p++ ^= 0x1;
-  if (sLen > 0) {
-    for (int i = 0; i < sLen; i++)
-      *p++ ^= salt[i];
-  }
-  if (MSBits)
-    EM[0] &= 0xFF >> (8 - MSBits);
-
-  /* H is already in place so just set final 0xbc */
-
-  EM[emLen - 1] = 0xbc;
-
-  ret = 1;
-
-  err:
-  EVP_MD_CTX_free(ctx);
-  OPENSSL_clear_free(salt, (size_t) sLen); /* salt != NULL implies sLen > 0 */
-
-
-  jbyteArray jb;
-
-  jb = env->NewByteArray(emLen);
-
-  env->SetByteArrayRegion(jb, 0, emLen, (jbyte *) EM);
-
-  return jb;
-}
--- a/client/android/cpp/ovpnutil/sslspeed.c
+++ b/client/android/cpp/ovpnutil/sslspeed.c
@@ -1,334 +0,0 @@
-/*
- * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* ====================================================================
- * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
- *
- * Portions of the attached software ("Contribution") are developed by
- * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
- *
- * The Contribution is licensed pursuant to the OpenSSL open source
- * license provided above.
- *
- * The ECDH and ECDSA speed test software is originally written by
- * Sumit Gupta of Sun Microsystems Laboratories.
- *
- */
-
-// Modified by Arne Schwabe to give a simple openssl evp speed java api
-
-#include <jni.h>
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <sys/ioctl.h>
-#include <sys/times.h>
-#include <linux/if.h>
-#include <android/log.h>
-#include <unistd.h>
-#include <string.h>
-#include <stdio.h>
-#include <errno.h>
-
-#include "jniglue.h"
-#include <android/log.h>
-
-#include <openssl/crypto.h>
-#include <openssl/rand.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/async.h>
-#include <openssl/provider.h>
-
-
-/* This file just contains code thrown together until it works */
-
-
-#undef SECONDS
-#define SECONDS                 3
-#define PRIME_SECONDS   10
-#define RSA_SECONDS             10
-#define DSA_SECONDS             10
-#define ECDSA_SECONDS   10
-#define ECDH_SECONDS    10
-
-
-typedef struct loopargs_st {
-    unsigned char *buf;
-    unsigned char *buf2;
-    unsigned char *buf_malloc;
-    unsigned char *buf2_malloc;
-    unsigned int siglen;
-    EVP_CIPHER_CTX *ctx;
-    HMAC_CTX *hctx;
-} loopargs_t;
-
-#undef BUFSIZE
-#define BUFSIZE (1024*16+1)
-#define MAX_MISALIGNMENT 63
-
-
-#define MAX_BLOCK_SIZE 128
-static unsigned char iv[2 * MAX_BLOCK_SIZE / 8];
-
-#define SIZE_NUM        7
-static const int lengths[SIZE_NUM] = {
-    16, 64, 256, 1024, 1500, 8 * 1024, 16 * 1024
-};
-
-static int testnum;
-
-# define COND(unused_cond) (run && count<0x7fffffff)
-
-static volatile int run = 0;
-
-#ifdef SIGALRM
-# if defined(__STDC__) || defined(sgi) || defined(_AIX)
-#  define SIGRETTYPE void
-# else
-#  define SIGRETTYPE int
-# endif
-
-
-#define START   0
-#define STOP    1
-#define TM_START        0
-#define TM_STOP         1
-
-static int usertime = 1;
-
-double app_tminterval(int stop, int usertime)
-{
-    double ret = 0;
-    struct tms rus;
-    clock_t now = times(&rus);
-    static clock_t tmstart;
-
-    if (usertime)
-        now = rus.tms_utime;
-
-    if (stop == TM_START)
-        tmstart = now;
-    else {
-        long int tck = sysconf(_SC_CLK_TCK);
-        ret = (now - tmstart) / (double)tck;
-    }
-
-    return (ret);
-}
-
-
-
-
-static double Time_F(int s)
-{
-    double ret = app_tminterval(s, usertime);
-    if (s == STOP)
-        alarm(0);
-    return ret;
-}
-
-#endif
-
-
-static long save_count = 0;
-static int decrypt = 0;
-static int EVP_Update_loop(void *args)
-{
-    loopargs_t *tempargs = *(loopargs_t **)args;
-    unsigned char *buf = tempargs->buf;
-    EVP_CIPHER_CTX *ctx = tempargs->ctx;
-    int outl, count;
-
-    if (decrypt)
-        for (count = 0; COND(nb_iter); count++)
-            EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
-    else
-        for (count = 0; COND(nb_iter); count++)
-            EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
-    if (decrypt)
-        EVP_DecryptFinal_ex(ctx, buf, &outl);
-    else
-        EVP_EncryptFinal_ex(ctx, buf, &outl);
-    return count;
-}
-
-static const EVP_MD *evp_md = NULL;
-static int EVP_Digest_loop(void *args)
-{
-    loopargs_t *tempargs = *(loopargs_t **)args;
-    unsigned char *buf = tempargs->buf;
-    unsigned char md[EVP_MAX_MD_SIZE];
-    int count;
-
-    for (count = 0; COND(nb_iter); count++) {
-        if (!EVP_Digest(buf, lengths[testnum], md, NULL, evp_md, NULL))
-            return -1;
-    }
-    return count;
-}
-
-
-static int run_benchmark(int async_jobs,
-                         int (*loop_function)(void *), loopargs_t *loopargs)
-{
-    int job_op_count = 0;
-    int total_op_count = 0;
-    int num_inprogress = 0;
-    int error = 0, i = 0, ret = 0;
-    OSSL_ASYNC_FD job_fd = 0;
-    size_t num_job_fds = 0;
-
-    run = 1;
-
-    if (async_jobs == 0) {
-        return loop_function((void *)&loopargs);
-    }
-    return 1234567;
-}
-
-
-static void* stop_run(void* arg)
-{
-    __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "stop run thread started");
-    sleep(3);
-    run=0;
-    __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "stop run thread stopped");
-    return NULL;
-}
-
-jdoubleArray Java_de_blinkt_openvpn_core_NativeUtils_getOpenSSLSpeed(JNIEnv* env, jclass thiz, jstring algorithm, jint testnumber)
-{
-
-    OSSL_PROVIDER *legacy;
-    OSSL_PROVIDER *deflt;
-
-    OSSL_LIB_CTX *lib_ctx = OSSL_LIB_CTX_new();
-
-    /* Load Multiple providers into the default (NULL) library context */
-    legacy = OSSL_PROVIDER_load(lib_ctx, "legacy");
-    if (legacy == NULL) {
-        __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "Failed to load Legacy provider\n");
-        return NULL;
-    }
-    deflt = OSSL_PROVIDER_load(lib_ctx, "default");
-    if (deflt == NULL) {
-        __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "Failed to load Default provider\n");
-        OSSL_PROVIDER_unload(legacy);
-        return NULL;
-    }
-
-    static const unsigned char key16[16] = {
-        0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0,
-        0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12
-    };
-    const EVP_CIPHER *evp_cipher = NULL;
-
-    const char* alg = (*env)->GetStringUTFChars( env, algorithm , NULL ) ;
-
-    evp_cipher = EVP_CIPHER_fetch(lib_ctx, alg, NULL);
-    if (evp_cipher == NULL)
-        evp_md = EVP_MD_fetch(lib_ctx, alg, NULL);
-    if (evp_cipher == NULL && evp_md == NULL) {
-        //        BIO_printf(bio_err, "%s: %s is an unknown cipher or digest\n", prog, opt_arg());
-        //jniThrowException(env, "java/security/NoSuchAlgorithmException", "Algorithm not found");
-        __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "Algorithm not found");
-        return NULL;
-    }
-
-    loopargs_t *loopargs = NULL;
-    int loopargs_len = 1;
-    int async_jobs = 0;
-    loopargs = malloc(loopargs_len * sizeof(loopargs_t));
-    memset(loopargs, 0, loopargs_len * sizeof(loopargs_t));
-
-
-    jdoubleArray ret = (*env)->NewDoubleArray(env, 3);
-
-    if (testnum < 0 || testnum >= SIZE_NUM)
-        goto error;
-
-    testnum = testnumber;
-
-
-    for (int i = 0; i < loopargs_len; i++) {
-        int misalign=0;
-        loopargs[i].buf_malloc = malloc((int)BUFSIZE + MAX_MISALIGNMENT + 1);
-        loopargs[i].buf2_malloc = malloc((int)BUFSIZE + MAX_MISALIGNMENT + 1);
-        /* Align the start of buffers on a 64 byte boundary */
-        loopargs[i].buf = loopargs[i].buf_malloc + misalign;
-        loopargs[i].buf2 = loopargs[i].buf2_malloc + misalign;
-    }
-
-
-    int count;
-    double d;
-    if (evp_cipher) {
-        /*
-         * -O3 -fschedule-insns messes up an optimization here!
-         * names[D_EVP] somehow becomes NULL
-         */
-
-
-        for (int k = 0; k < loopargs_len; k++) {
-            loopargs[k].ctx = EVP_CIPHER_CTX_new();
-            if (decrypt)
-                EVP_DecryptInit_ex(loopargs[k].ctx, evp_cipher, NULL, key16, iv);
-            else
-                EVP_EncryptInit_ex(loopargs[k].ctx, evp_cipher, NULL, key16, iv);
-            EVP_CIPHER_CTX_set_padding(loopargs[k].ctx, 0);
-        }
-
-        Time_F(START);
-        pthread_t timer_thread;
-
-        if (pthread_create(&timer_thread, NULL, stop_run, NULL))
-            goto error;
-
-        count = run_benchmark(async_jobs, EVP_Update_loop, loopargs);
-        d = Time_F(STOP);
-        for (int k = 0; k < loopargs_len; k++) {
-            EVP_CIPHER_CTX_free(loopargs[k].ctx);
-        }
-    }
-    if (evp_md) {
-        pthread_t timer_thread;
-        if (pthread_create(&timer_thread, NULL, stop_run, NULL))
-        {
-            __android_log_write(ANDROID_LOG_DEBUG,"openvpn", "creating thread failed");
-            goto error;
-        }
-
-        Time_F(START);
-        count = run_benchmark(async_jobs, EVP_Digest_loop, loopargs);
-        d = Time_F(STOP);
-    }
-
-    // Save results in hacky way
-    double results[] = {(double) lengths[testnum], (double) count, d};
-
-
-    (*env)->SetDoubleArrayRegion(env, ret, 0, 3, results);
-    //        print_result(D_EVP, testnum, count, d);
-
-    OSSL_LIB_CTX_free(lib_ctx);
-    free(loopargs);
-    return ret;
-error:
-    for (int k = 0; k < loopargs_len; k++) {
-      EVP_CIPHER_CTX_free(loopargs[k].ctx);
-    }
-    free(loopargs);
-
-    OSSL_LIB_CTX_free(lib_ctx);
-  return NULL;
-}
--- a/client/android/cpp/tools.cmake
+++ b/client/android/cpp/tools.cmake
@@ -1,7 +0,0 @@
-FUNCTION(PREPEND var prefix)
-   SET(listVar "")
-   FOREACH(f ${ARGN})
-      LIST(APPEND listVar "${prefix}/${f}")
-   ENDFOREACH(f)
-   SET(${var} "${listVar}" PARENT_SCOPE)
-ENDFUNCTION(PREPEND)
--- a/client/android/lib/openvpn/arm64-v8a/libjbcrypto.so
+++ b/client/android/lib/openvpn/arm64-v8a/libjbcrypto.so
--- a/client/android/lib/openvpn/arm64-v8a/libopenvpn.so
+++ b/client/android/lib/openvpn/arm64-v8a/libopenvpn.so
--- a/client/android/lib/openvpn/arm64-v8a/libopvpnutil.so
+++ b/client/android/lib/openvpn/arm64-v8a/libopvpnutil.so
--- a/client/android/lib/openvpn/arm64-v8a/libovpn3.so
+++ b/client/android/lib/openvpn/arm64-v8a/libovpn3.so
--- a/client/android/lib/openvpn/arm64-v8a/libovpnexec.so
+++ b/client/android/lib/openvpn/arm64-v8a/libovpnexec.so
--- a/client/android/lib/openvpn/armeabi-v7a/libjbcrypto.so
+++ b/client/android/lib/openvpn/armeabi-v7a/libjbcrypto.so
--- a/client/android/lib/openvpn/armeabi-v7a/libopenvpn.so
+++ b/client/android/lib/openvpn/armeabi-v7a/libopenvpn.so
--- a/client/android/lib/openvpn/armeabi-v7a/libopvpnutil.so
+++ b/client/android/lib/openvpn/armeabi-v7a/libopvpnutil.so
--- a/client/android/lib/openvpn/armeabi-v7a/libovpn3.so
+++ b/client/android/lib/openvpn/armeabi-v7a/libovpn3.so
--- a/client/android/lib/openvpn/armeabi-v7a/libovpnexec.so
+++ b/client/android/lib/openvpn/armeabi-v7a/libovpnexec.so
--- a/client/android/lib/openvpn/x86/libjbcrypto.so
+++ b/client/android/lib/openvpn/x86/libjbcrypto.so
--- a/client/android/lib/openvpn/x86/libopenvpn.so
+++ b/client/android/lib/openvpn/x86/libopenvpn.so
--- a/client/android/lib/openvpn/x86/libopvpnutil.so
+++ b/client/android/lib/openvpn/x86/libopvpnutil.so
--- a/client/android/lib/openvpn/x86/libovpn3.so
+++ b/client/android/lib/openvpn/x86/libovpn3.so
--- a/client/android/lib/openvpn/x86/libovpnexec.so
+++ b/client/android/lib/openvpn/x86/libovpnexec.so
--- a/client/android/lib/openvpn/x86_64/libjbcrypto.so
+++ b/client/android/lib/openvpn/x86_64/libjbcrypto.so
--- a/client/android/lib/openvpn/x86_64/libopenvpn.so
+++ b/client/android/lib/openvpn/x86_64/libopenvpn.so
--- a/client/android/lib/openvpn/x86_64/libopvpnutil.so
+++ b/client/android/lib/openvpn/x86_64/libopvpnutil.so
--- a/client/android/lib/openvpn/x86_64/libovpn3.so
+++ b/client/android/lib/openvpn/x86_64/libovpn3.so
--- a/client/android/lib/openvpn/x86_64/libovpnexec.so
+++ b/client/android/lib/openvpn/x86_64/libovpnexec.so
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_Config.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_Config.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
@@ -117,12 +117,12 @@ public class ClientAPI_Config {
    return ovpncliJNI.ClientAPI_Config_protoVersionOverride_get(swigCPtr, this);
  }

-  public void setAllowUnusedAddrFamilies(String value) {
-    ovpncliJNI.ClientAPI_Config_allowUnusedAddrFamilies_set(swigCPtr, this, value);
+  public void setIpv6(String value) {
+    ovpncliJNI.ClientAPI_Config_ipv6_set(swigCPtr, this, value);
  }

-  public String getAllowUnusedAddrFamilies() {
-    return ovpncliJNI.ClientAPI_Config_allowUnusedAddrFamilies_get(swigCPtr, this);
+  public String getIpv6() {
+    return ovpncliJNI.ClientAPI_Config_ipv6_get(swigCPtr, this);
  }

  public void setConnTimeout(int value) {
@@ -221,6 +221,14 @@ public class ClientAPI_Config {
    return ovpncliJNI.ClientAPI_Config_defaultKeyDirection_get(swigCPtr, this);
  }

+  public void setForceAesCbcCiphersuites(boolean value) {
+    ovpncliJNI.ClientAPI_Config_forceAesCbcCiphersuites_set(swigCPtr, this, value);
+  }
+
+  public boolean getForceAesCbcCiphersuites() {
+    return ovpncliJNI.ClientAPI_Config_forceAesCbcCiphersuites_get(swigCPtr, this);
+  }
+
  public void setTlsVersionMinOverride(String value) {
    ovpncliJNI.ClientAPI_Config_tlsVersionMinOverride_set(swigCPtr, this, value);
  }
@@ -358,14 +366,6 @@ public class ClientAPI_Config {
    return ovpncliJNI.ClientAPI_Config_gremlinConfig_get(swigCPtr, this);
  }

-  public void setUsePluggableTransports(boolean value) {
-    ovpncliJNI.ClientAPI_Config_usePluggableTransports_set(swigCPtr, this, value);
-  }
-
-  public boolean getUsePluggableTransports() {
-    return ovpncliJNI.ClientAPI_Config_usePluggableTransports_get(swigCPtr, this);
-  }
-
  public void setWintun(boolean value) {
    ovpncliJNI.ClientAPI_Config_wintun_set(swigCPtr, this, value);
  }
@@ -374,30 +374,6 @@ public class ClientAPI_Config {
    return ovpncliJNI.ClientAPI_Config_wintun_get(swigCPtr, this);
  }

-  public void setAllowLocalDnsResolvers(boolean value) {
-    ovpncliJNI.ClientAPI_Config_allowLocalDnsResolvers_set(swigCPtr, this, value);
-  }
-
-  public boolean getAllowLocalDnsResolvers() {
-    return ovpncliJNI.ClientAPI_Config_allowLocalDnsResolvers_get(swigCPtr, this);
-  }
-
-  public void setEnableLegacyAlgorithms(boolean value) {
-    ovpncliJNI.ClientAPI_Config_enableLegacyAlgorithms_set(swigCPtr, this, value);
-  }
-
-  public boolean getEnableLegacyAlgorithms() {
-    return ovpncliJNI.ClientAPI_Config_enableLegacyAlgorithms_get(swigCPtr, this);
-  }
-
-  public void setEnableNonPreferredDCAlgorithms(boolean value) {
-    ovpncliJNI.ClientAPI_Config_enableNonPreferredDCAlgorithms_set(swigCPtr, this, value);
-  }
-
-  public boolean getEnableNonPreferredDCAlgorithms() {
-    return ovpncliJNI.ClientAPI_Config_enableNonPreferredDCAlgorithms_get(swigCPtr, this);
-  }
-
  public ClientAPI_Config() {
    this(ovpncliJNI.new_ClientAPI_Config(), true);
  }
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ConnectionInfo.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ConnectionInfo.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_DynamicChallenge.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_DynamicChallenge.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_EvalConfig.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_EvalConfig.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_Event.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_Event.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKIBase.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKIBase.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKICertRequest.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKICertRequest.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKIRequestBase.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKIRequestBase.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKISignRequest.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ExternalPKISignRequest.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_InterfaceStats.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_InterfaceStats.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_KeyValue.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_KeyValue.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_LLVector.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_LLVector.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_LogInfo.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_LogInfo.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_MergeConfig.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_MergeConfig.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_OpenVPNClient.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_OpenVPNClient.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
@@ -56,6 +56,26 @@ public class ClientAPI_OpenVPNClient extends ClientAPI_TunBuilderBase {
    ovpncliJNI.ClientAPI_OpenVPNClient_director_connect(this, swigCPtr, true, true);
  }

+  public static ClientAPI_MergeConfig merge_config_static(String path, boolean follow_references) {
+    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClient_merge_config_static(path, follow_references), true);
+  }
+
+  public static ClientAPI_MergeConfig merge_config_string_static(String config_content) {
+    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClient_merge_config_string_static(config_content), true);
+  }
+
+  public static ClientAPI_EvalConfig eval_config_static(ClientAPI_Config config) {
+    return new ClientAPI_EvalConfig(ovpncliJNI.ClientAPI_OpenVPNClient_eval_config_static(ClientAPI_Config.getCPtr(config), config), true);
+  }
+
+  public static int max_profile_size() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_max_profile_size();
+  }
+
+  public static boolean parse_dynamic_challenge(String cookie, ClientAPI_DynamicChallenge dc) {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_parse_dynamic_challenge(cookie, ClientAPI_DynamicChallenge.getCPtr(dc), dc);
+  }
+
  public ClientAPI_EvalConfig eval_config(ClientAPI_Config arg0) {
    return new ClientAPI_EvalConfig(ovpncliJNI.ClientAPI_OpenVPNClient_eval_config(swigCPtr, this, ClientAPI_Config.getCPtr(arg0), arg0), true);
  }
@@ -156,4 +176,20 @@ public class ClientAPI_OpenVPNClient extends ClientAPI_TunBuilderBase {
    if (getClass() == ClientAPI_OpenVPNClient.class) ovpncliJNI.ClientAPI_OpenVPNClient_clock_tick(swigCPtr, this); else ovpncliJNI.ClientAPI_OpenVPNClient_clock_tickSwigExplicitClientAPI_OpenVPNClient(swigCPtr, this);
  }

+  public static String crypto_self_test() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_crypto_self_test();
+  }
+
+  public static int app_expire() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_app_expire();
+  }
+
+  public static String platform() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_platform();
+  }
+
+  public static String copyright() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_copyright();
+  }
+
 }
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_OpenVPNClientHelper.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_OpenVPNClientHelper.java
@@ -1,75 +0,0 @@
-/* ----------------------------------------------------------------------------
- * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
- *
- * Do not make changes to this file unless you know what you are doing--modify
- * the SWIG interface file instead.
- * ----------------------------------------------------------------------------- */
-
-package net.openvpn.ovpn3;
-
-public class ClientAPI_OpenVPNClientHelper {
-  private transient long swigCPtr;
-  protected transient boolean swigCMemOwn;
-
-  protected ClientAPI_OpenVPNClientHelper(long cPtr, boolean cMemoryOwn) {
-    swigCMemOwn = cMemoryOwn;
-    swigCPtr = cPtr;
-  }
-
-  protected static long getCPtr(ClientAPI_OpenVPNClientHelper obj) {
-    return (obj == null) ? 0 : obj.swigCPtr;
-  }
-
-  @SuppressWarnings("deprecation")
-  protected void finalize() {
-    delete();
-  }
-
-  public synchronized void delete() {
-    if (swigCPtr != 0) {
-      if (swigCMemOwn) {
-        swigCMemOwn = false;
-        ovpncliJNI.delete_ClientAPI_OpenVPNClientHelper(swigCPtr);
-      }
-      swigCPtr = 0;
-    }
-  }
-
-  public ClientAPI_OpenVPNClientHelper() {
-    this(ovpncliJNI.new_ClientAPI_OpenVPNClientHelper(), true);
-  }
-
-  public ClientAPI_MergeConfig merge_config(String path, boolean follow_references) {
-    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_merge_config(swigCPtr, this, path, follow_references), true);
-  }
-
-  public ClientAPI_MergeConfig merge_config_string(String config_content) {
-    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_merge_config_string(swigCPtr, this, config_content), true);
-  }
-
-  public ClientAPI_EvalConfig eval_config(ClientAPI_Config config) {
-    return new ClientAPI_EvalConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_eval_config(swigCPtr, this, ClientAPI_Config.getCPtr(config), config), true);
-  }
-
-  public static int max_profile_size() {
-    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_max_profile_size();
-  }
-
-  public static boolean parse_dynamic_challenge(String cookie, ClientAPI_DynamicChallenge dc) {
-    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_parse_dynamic_challenge(cookie, ClientAPI_DynamicChallenge.getCPtr(dc), dc);
-  }
-
-  public String crypto_self_test() {
-    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_crypto_self_test(swigCPtr, this);
-  }
-
-  public static String platform() {
-    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_platform();
-  }
-
-  public static String copyright() {
-    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_copyright();
-  }
-
-}
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ProvideCreds.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ProvideCreds.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_RemoteOverride.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_RemoteOverride.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ServerEntry.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ServerEntry.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_ServerEntryVector.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_ServerEntryVector.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_SessionToken.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_SessionToken.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_Status.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_Status.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_StringVec.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_StringVec.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_TransportStats.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_TransportStats.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ClientAPI_TunBuilderBase.java
+++ b/client/android/src/net/openvpn/ovpn3/ClientAPI_TunBuilderBase.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
@@ -104,8 +104,8 @@ public class ClientAPI_TunBuilderBase {
    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_wins_server(swigCPtr, this, address);
  }

-  public boolean tun_builder_set_allow_family(int af, boolean allow) {
-    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_allow_family(swigCPtr, this, af, allow);
+  public boolean tun_builder_set_block_ipv6(boolean block_ipv6) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_block_ipv6(swigCPtr, this, block_ipv6);
  }

  public boolean tun_builder_set_adapter_domain_suffix(String name) {
--- a/client/android/src/net/openvpn/ovpn3/SWIGTYPE_p_std__string.java
+++ b/client/android/src/net/openvpn/ovpn3/SWIGTYPE_p_std__string.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/SWIGTYPE_p_std__vectorT_openvpnClientAPIKeyValue_t.java
+++ b/client/android/src/net/openvpn/ovpn3/SWIGTYPE_p_std__vectorT_openvpnClientAPIKeyValue_t.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ovpncli.java
+++ b/client/android/src/net/openvpn/ovpn3/ovpncli.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
--- a/client/android/src/net/openvpn/ovpn3/ovpncliJNI.java
+++ b/client/android/src/net/openvpn/ovpn3/ovpncliJNI.java
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
 * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 4.0.1
+ * Version 4.0.2
 *
 * Do not make changes to this file unless you know what you are doing--modify
 * the SWIG interface file instead.
@@ -73,7 +73,7 @@ public class ovpncliJNI {
  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_proxy_http(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3);
  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_proxy_https(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3);
  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_wins_server(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
-  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_allow_family(long jarg1, ClientAPI_TunBuilderBase jarg1_, int jarg2, boolean jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_block_ipv6(long jarg1, ClientAPI_TunBuilderBase jarg1_, boolean jarg2);
  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_adapter_domain_suffix(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
  public final static native int ClientAPI_TunBuilderBase_tun_builder_establish(long jarg1, ClientAPI_TunBuilderBase jarg1_);
  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_persist(long jarg1, ClientAPI_TunBuilderBase jarg1_);
@@ -183,8 +183,8 @@ public class ovpncliJNI {
  public final static native String ClientAPI_Config_protoOverride_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_protoVersionOverride_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
  public final static native int ClientAPI_Config_protoVersionOverride_get(long jarg1, ClientAPI_Config jarg1_);
-  public final static native void ClientAPI_Config_allowUnusedAddrFamilies_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
-  public final static native String ClientAPI_Config_allowUnusedAddrFamilies_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_ipv6_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_ipv6_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_connTimeout_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
  public final static native int ClientAPI_Config_connTimeout_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_tunPersist_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
@@ -209,6 +209,8 @@ public class ovpncliJNI {
  public final static native String ClientAPI_Config_privateKeyPassword_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_defaultKeyDirection_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
  public final static native int ClientAPI_Config_defaultKeyDirection_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_forceAesCbcCiphersuites_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_forceAesCbcCiphersuites_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_tlsVersionMinOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
  public final static native String ClientAPI_Config_tlsVersionMinOverride_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_tlsCertProfileOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
@@ -243,16 +245,8 @@ public class ovpncliJNI {
  public final static native long ClientAPI_Config_clockTickMS_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_gremlinConfig_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
  public final static native String ClientAPI_Config_gremlinConfig_get(long jarg1, ClientAPI_Config jarg1_);
-  public final static native void ClientAPI_Config_usePluggableTransports_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
-  public final static native boolean ClientAPI_Config_usePluggableTransports_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native void ClientAPI_Config_wintun_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
  public final static native boolean ClientAPI_Config_wintun_get(long jarg1, ClientAPI_Config jarg1_);
-  public final static native void ClientAPI_Config_allowLocalDnsResolvers_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
-  public final static native boolean ClientAPI_Config_allowLocalDnsResolvers_get(long jarg1, ClientAPI_Config jarg1_);
-  public final static native void ClientAPI_Config_enableLegacyAlgorithms_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
-  public final static native boolean ClientAPI_Config_enableLegacyAlgorithms_get(long jarg1, ClientAPI_Config jarg1_);
-  public final static native void ClientAPI_Config_enableNonPreferredDCAlgorithms_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
-  public final static native boolean ClientAPI_Config_enableNonPreferredDCAlgorithms_get(long jarg1, ClientAPI_Config jarg1_);
  public final static native long new_ClientAPI_Config();
  public final static native void delete_ClientAPI_Config(long jarg1);
  public final static native void ClientAPI_Event_error_set(long jarg1, ClientAPI_Event jarg1_, boolean jarg2);
@@ -378,18 +372,13 @@ public class ovpncliJNI {
  public final static native String ClientAPI_RemoteOverride_error_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
  public final static native long new_ClientAPI_RemoteOverride();
  public final static native void delete_ClientAPI_RemoteOverride(long jarg1);
-  public final static native long new_ClientAPI_OpenVPNClientHelper();
-  public final static native void delete_ClientAPI_OpenVPNClientHelper(long jarg1);
-  public final static native long ClientAPI_OpenVPNClientHelper_merge_config(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, String jarg2, boolean jarg3);
-  public final static native long ClientAPI_OpenVPNClientHelper_merge_config_string(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, String jarg2);
-  public final static native long ClientAPI_OpenVPNClientHelper_eval_config(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, long jarg2, ClientAPI_Config jarg2_);
-  public final static native int ClientAPI_OpenVPNClientHelper_max_profile_size();
-  public final static native boolean ClientAPI_OpenVPNClientHelper_parse_dynamic_challenge(String jarg1, long jarg2, ClientAPI_DynamicChallenge jarg2_);
-  public final static native String ClientAPI_OpenVPNClientHelper_crypto_self_test(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_);
-  public final static native String ClientAPI_OpenVPNClientHelper_platform();
-  public final static native String ClientAPI_OpenVPNClientHelper_copyright();
  public final static native long new_ClientAPI_OpenVPNClient();
  public final static native void delete_ClientAPI_OpenVPNClient(long jarg1);
+  public final static native long ClientAPI_OpenVPNClient_merge_config_static(String jarg1, boolean jarg2);
+  public final static native long ClientAPI_OpenVPNClient_merge_config_string_static(String jarg1);
+  public final static native long ClientAPI_OpenVPNClient_eval_config_static(long jarg1, ClientAPI_Config jarg1_);
+  public final static native int ClientAPI_OpenVPNClient_max_profile_size();
+  public final static native boolean ClientAPI_OpenVPNClient_parse_dynamic_challenge(String jarg1, long jarg2, ClientAPI_DynamicChallenge jarg2_);
  public final static native long ClientAPI_OpenVPNClient_eval_config(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_Config jarg2_);
  public final static native long ClientAPI_OpenVPNClient_provide_creds(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_ProvideCreds jarg2_);
  public final static native boolean ClientAPI_OpenVPNClient_socket_protect(long jarg1, ClientAPI_OpenVPNClient jarg1_, int jarg2, String jarg3, boolean jarg4);
@@ -419,6 +408,10 @@ public class ovpncliJNI {
  public final static native void ClientAPI_OpenVPNClient_remote_overrideSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_RemoteOverride jarg2_);
  public final static native void ClientAPI_OpenVPNClient_clock_tick(long jarg1, ClientAPI_OpenVPNClient jarg1_);
  public final static native void ClientAPI_OpenVPNClient_clock_tickSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native String ClientAPI_OpenVPNClient_crypto_self_test();
+  public final static native int ClientAPI_OpenVPNClient_app_expire();
+  public final static native String ClientAPI_OpenVPNClient_platform();
+  public final static native String ClientAPI_OpenVPNClient_copyright();
  public final static native void ClientAPI_OpenVPNClient_director_connect(ClientAPI_OpenVPNClient obj, long cptr, boolean mem_own, boolean weak_global);
  public final static native void ClientAPI_OpenVPNClient_change_ownership(ClientAPI_OpenVPNClient obj, long cptr, boolean take_or_release);
  public final static native long ClientAPI_ExternalPKICertRequest_SWIGUpcast(long jarg1);
@@ -476,8 +469,8 @@ public class ovpncliJNI {
  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_wins_server(ClientAPI_OpenVPNClient jself, String address) {
    return jself.tun_builder_add_wins_server(address);
  }
-  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_allow_family(ClientAPI_OpenVPNClient jself, int af, boolean allow) {
-    return jself.tun_builder_set_allow_family(af, allow);
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_block_ipv6(ClientAPI_OpenVPNClient jself, boolean block_ipv6) {
+    return jself.tun_builder_set_block_ipv6(block_ipv6);
  }
  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_adapter_domain_suffix(ClientAPI_OpenVPNClient jself, String name) {
    return jself.tun_builder_set_adapter_domain_suffix(name);
--- a/client/android/src/org/amnezia/vpn/IKEv2Thread.kt
+++ b/client/android/src/org/amnezia/vpn/IKEv2Thread.kt
@@ -0,0 +1,761 @@
+package org.amnezia.vpn
+
+import android.annotation.TargetApi
+import android.content.pm.PackageManager
+import android.net.VpnService
+import android.net.VpnService.Builder
+import android.os.Build
+import android.os.ParcelFileDescriptor
+import android.system.OsConstants
+
+import java.lang.Runnable
+
+import org.amnezia.vpn.ikev2.VpnProfile
+import org.amnezia.vpn.ikev2.VpnProfile.SelectedAppsHandling
+import org.amnezia.vpn.ikev2.VpnType
+import org.amnezia.vpn.ikev2.VpnType.VpnTypeFeature
+import org.amnezia.vpn.ikev2.utils.IPRange
+import org.amnezia.vpn.ikev2.utils.IPRangeSet
+import org.amnezia.vpn.ikev2.utils.Utils
+import org.amnezia.vpn.ikev2.utils.Constants
+import org.amnezia.vpn.ikev2.utils.SettingsWriter
+import org.amnezia.vpn.ikev2.utils.SimpleFetcher
+
+const val PACKAGE_NAME = "org.amnezia.vpn"
+const val LOG_FILE = "charon.log"
+const val TAG = "amnezia_ikev2"
+
+class IKEv2Thread(
+    val vpnServiceBuilder: android.net.VpnService.Builder,
+    val filesDirAbsolutePath: String
+): Runnable {
+
+    private val mBuilderAdapter: BuilderAdapter = BuilderAdapter(vpnServiceBuilder)
+
+    private var mCurrentProfile: VpnProfile? = null
+    private var mNextProfile: VpnProfile? = null
+
+    @kotlin.jvm.Volatile
+    private var mCurrentCertificateAlias: String? = null
+
+    @kotlin.jvm.Volatile
+    private var mCurrentUserCertificateAlias: String? = null
+
+    @kotlin.jvm.Volatile
+    private var mProfileUpdated = false
+
+    @kotlin.jvm.Volatile
+    private var mTerminate = false
+
+    @kotlin.jvm.Volatile
+    private var mIsDisconnecting = false
+
+    private val mLogFile: String
+    private val mAppDir: String
+
+    init {
+        mLogFile = filesDirAbsolutePath + java.io.File.separator + LOG_FILE
+        mAppDir = filesDirAbsolutePath
+    }
+
+    fun setNextProfile(profile: VpnProfile) {
+
+        // TODO: take a look at "vpnprofileimportactivity" in starongswan repo 
+        //       to understand how to pass the profile object before starting of ikev2 tunnel
+
+        synchronized(this) {
+            mNextProfile = profile
+            mProfileUpdated = true
+            notifyAll()
+        }
+    }
+
+    override fun run() {
+        while (true) {
+            synchronized(this) {
+                try {
+                    while (!mProfileUpdated) {
+                        Log.i(TAG, "charon contunue")
+                        continue
+                    }
+
+                    mProfileUpdated = false
+                    stopCurrentConnection()
+
+                    if (mNextProfile == null) {
+                        setState(State.DISABLED)
+                        if (mTerminate) {
+                            return@synchronized
+                        }
+                    } else {
+                        mCurrentProfile = mNextProfile
+                        mNextProfile = null
+
+                        val currentProfile = mCurrentProfile
+
+                        /* store this in a separate (volatile) variable to avoid
+                         * a possible deadlock during deinitialization */
+                        mCurrentCertificateAlias = currentProfile!!.certificateAlias
+                        mCurrentUserCertificateAlias = currentProfile!!.userCertificateAlias
+
+                        startConnection(currentProfile)
+
+                        mIsDisconnecting = false
+                        SimpleFetcher.enable()
+                        addNotification()
+                        mBuilderAdapter.setProfile(currentProfile)
+
+                        val flags: Int = currentProfile!!.flags
+
+                        if (initializeCharon(
+                                mBuilderAdapter,
+                                mLogFile,
+                                mAppDir,
+                                currentProfile.vpnType!!.has(VpnTypeFeature.BYOD),
+                                flags and VpnProfile.FLAGS_IPv6_TRANSPORT !== 0
+                            )
+                        ) {
+                            Log.i(TAG, "charon started")
+
+                            if (currentProfile.vpnType!!.has(VpnTypeFeature.USER_PASS) &&
+                                currentProfile.password == null
+                            ) {    /* this can happen if Always-on VPN is enabled with an incomplete profile */
+                                setError(ErrorState.PASSWORD_MISSING)
+                                return@synchronized
+                            }
+
+                            val writer = SettingsWriter()
+                            writer.setValue("global.language", java.util.Locale.getDefault().getLanguage())
+                            writer.setValue("global.mtu", currentProfile.MTU)
+                            writer.setValue("global.nat_keepalive", currentProfile.NATKeepAlive)
+                            writer.setValue("global.rsa_pss", flags and VpnProfile.FLAGS_RSA_PSS !== 0)
+                            writer.setValue("global.crl", flags and VpnProfile.FLAGS_DISABLE_CRL === 0)
+                            writer.setValue("global.ocsp", flags and VpnProfile.FLAGS_DISABLE_OCSP === 0)
+                            writer.setValue("connection.type", currentProfile.vpnType!!.identifier)
+                            writer.setValue("connection.server", currentProfile.gateway)
+                            writer.setValue("connection.port", currentProfile.port)
+                            writer.setValue("connection.username", currentProfile.username)
+                            writer.setValue("connection.password", currentProfile.password)
+                            writer.setValue("connection.local_id", currentProfile.localId)
+                            writer.setValue("connection.remote_id", currentProfile.remoteId)
+                            writer.setValue("connection.certreq", flags and VpnProfile.FLAGS_SUPPRESS_CERT_REQS === 0)
+                            writer.setValue("connection.strict_revocation", flags and VpnProfile.FLAGS_STRICT_REVOCATION !== 0)
+                            writer.setValue("connection.ike_proposal", currentProfile.ikeProposal)
+                            writer.setValue("connection.esp_proposal", currentProfile.espProposal)
+                            initiate(writer.serialize())
+                        } else {
+                            Log.e(TAG, "failed to start charon")
+                            setError(ErrorState.GENERIC_ERROR)
+                            setState(State.DISABLED)
+                            mCurrentProfile = null
+                        }
+                    }
+                } catch (ex: java.lang.InterruptedException) {
+                    stopCurrentConnection()
+                    setState(State.DISABLED)
+                }
+            }
+        }
+    }
+
+    /**
+     * Notify the state service about a new connection attempt.
+     * Called by the handler thread.
+     *
+     * @param profile currently active VPN profile
+     */
+    private fun startConnection(profile: VpnProfile) {
+//        synchronized(mServiceLock) {
+//            if (mService != null) {
+//                mService.startConnection(profile)
+//            }
+//        }
+    }
+
+    /**
+     * Stop any existing connection by deinitializing charon.
+     */
+    private fun stopCurrentConnection() {
+        synchronized(this) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+                mNextProfile?.let {
+                    mBuilderAdapter.setProfile(it)
+                    mBuilderAdapter.establishBlocking()
+                }
+            }
+
+            if (mCurrentProfile != null) {
+                setState(State.DISCONNECTING)
+                mIsDisconnecting = true
+                SimpleFetcher.disable()
+                deinitializeCharon()
+                Log.i(TAG, "charon stopped")
+                mCurrentProfile = null
+                if (mNextProfile == null) {    /* only do this if we are not connecting to another profile */
+                    removeNotification()
+                    mBuilderAdapter.closeBlocking()
+                }
+            }
+        }
+    }
+
+    /**
+     * Update the current VPN state on the state service. Called by the handler
+     * thread and any of charon's threads.
+     *
+     * @param state current state
+     */
+    private fun setState(state: State) {
+//        synchronized(mServiceLock) {
+//            if (mService != null) {
+//                mService.setState(state)
+//            }
+//        }
+    }
+
+    /**
+     * Initialization of charon, provided by libandroidbridge.so
+     *
+     * @param builder BuilderAdapter for this connection
+     * @param logfile absolute path to the logfile
+     * @param appdir absolute path to the data directory of the app
+     * @param byod enable BYOD features
+     * @param ipv6 enable IPv6 transport
+     * @return TRUE if initialization was successful
+     */
+    external fun initializeCharon(
+        builder: BuilderAdapter?,
+        logfile: String?,
+        appdir: String?,
+        byod: Boolean,
+        ipv6: Boolean
+    ): Boolean
+
+    /**
+     * Deinitialize charon, provided by libandroidbridge.so
+     */
+    external fun deinitializeCharon()
+
+    /**
+     * Initiate VPN, provided by libandroidbridge.so
+     */
+    external fun initiate(config: String?)
+
+    /**
+     * Adapter for VpnService.Builder which is used to access it safely via JNI.
+     * There is a corresponding C object to access it from native code.
+     */
+    class BuilderAdapter(val builder: VpnService.Builder) {
+        private lateinit var mProfile: VpnProfile
+        private lateinit var mBuilder: VpnService.Builder
+        private lateinit var mCache: BuilderCache
+        private lateinit var mEstablishedCache: BuilderCache
+        private val mDropper: PacketDropper = PacketDropper()
+
+        init {
+            mBuilder = builder
+        }
+
+        @kotlin.jvm.Synchronized
+        fun setProfile(profile: VpnProfile) {
+            mProfile = profile
+            mBuilder = createBuilder(mProfile.name ?: "")
+            mCache = BuilderCache(mProfile)
+        }
+
+        private fun createBuilder(name: String): VpnService.Builder {
+//            val builder: VpnService.Builder = Builder()
+
+            mBuilder.setSession(name)
+
+            /* even though the option displayed in the system dialog says "Configure"
+			 * we just use our main Activity */
+//            val context: Context = getApplicationContext()
+//            val intent = Intent(context, MainActivity::class.java)
+//            var flags: Int = PendingIntent.FLAG_UPDATE_CURRENT
+//            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+//                flags = flags or PendingIntent.FLAG_IMMUTABLE
+//            }
+//            val pending: PendingIntent = PendingIntent.getActivity(context, 0, intent, flags)
+//            builder.setConfigureIntent(pending)
+
+            /* mark all VPN connections as unmetered (default changed for Android 10) */
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                mBuilder.setMetered(false)
+            }
+            return mBuilder
+        }
+
+        @kotlin.jvm.Synchronized
+        fun addAddress(address: String?, prefixLength: Int): Boolean {
+            try {
+                mCache.addAddress(address, prefixLength)
+            } catch (ex: java.lang.IllegalArgumentException) {
+                return false
+            }
+            return true
+        }
+
+        @kotlin.jvm.Synchronized
+        fun addDnsServer(address: String?): Boolean {
+            try {
+                mCache.addDnsServer(address)
+            } catch (ex: java.lang.IllegalArgumentException) {
+                return false
+            }
+            return true
+        }
+
+        @kotlin.jvm.Synchronized
+        fun addRoute(address: String?, prefixLength: Int): Boolean {
+            try {
+                mCache.addRoute(address, prefixLength)
+            } catch (ex: java.lang.IllegalArgumentException) {
+                return false
+            }
+            return true
+        }
+
+        @kotlin.jvm.Synchronized
+        fun addSearchDomain(domain: String): Boolean {
+            try {
+                mBuilder.addSearchDomain(domain)
+            } catch (ex: java.lang.IllegalArgumentException) {
+                return false
+            }
+            return true
+        }
+
+        @kotlin.jvm.Synchronized
+        fun setMtu(mtu: Int): Boolean {
+            try {
+                mCache.setMtu(mtu)
+            } catch (ex: java.lang.IllegalArgumentException) {
+                return false
+            }
+            return true
+        }
+
+        @kotlin.jvm.Synchronized
+        private fun establishIntern(): ParcelFileDescriptor? {
+            val fd: ParcelFileDescriptor?
+            try {
+                mCache.applyData(mBuilder)
+                fd = mBuilder.establish()
+                if (fd != null) {
+                    closeBlocking()
+                }
+            } catch (ex: java.lang.Exception) {
+                ex.printStackTrace()
+                return null
+            }
+            if (fd == null) {
+                return null
+            }
+            /* now that the TUN device is created we don't need the current
+			 * builder anymore, but we might need another when reestablishing */
+            mBuilder = createBuilder(mProfile.name ?: "")
+            mEstablishedCache = mCache
+            mCache = BuilderCache(mProfile)
+            return fd
+        }
+
+        @kotlin.jvm.Synchronized
+        fun establish(): Int {
+            val fd: ParcelFileDescriptor? = establishIntern()
+            return if (fd != null) fd.detachFd() else -1
+        }
+
+        @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+        @kotlin.jvm.Synchronized
+        fun establishBlocking() {
+            /* just choose some arbitrary values to block all traffic (except for what's configured in the profile) */
+            mCache.addAddress("172.16.252.1", 32)
+            mCache.addAddress("fd00::fd02:1", 128)
+            mCache.addRoute("0.0.0.0", 0)
+            mCache.addRoute("::", 0)
+            /* set DNS servers to avoid DNS leak later */
+            mBuilder.addDnsServer("8.8.8.8")
+            mBuilder.addDnsServer("2001:4860:4860::8888")
+            /* use blocking mode to simplify packet dropping */
+            mBuilder.setBlocking(true)
+            val fd: ParcelFileDescriptor? = establishIntern()
+            if (fd != null) {
+                mDropper.start(fd)
+            }
+        }
+
+        @kotlin.jvm.Synchronized
+        fun closeBlocking() {
+            mDropper.stop()
+        }
+
+        @kotlin.jvm.Synchronized
+        fun establishNoDns(): Int {
+            val fd: ParcelFileDescriptor?
+            if (mEstablishedCache == null) {
+                return -1
+            }
+            fd = try {
+                val builder: VpnService.Builder = createBuilder(mProfile.name ?: "")
+                mEstablishedCache.applyData(builder)
+                builder.establish()
+            } catch (ex: java.lang.Exception) {
+                ex.printStackTrace()
+                return -1
+            }
+            return if (fd == null) {
+                -1
+            } else fd.detachFd()
+        }
+
+        private inner class PacketDropper : java.lang.Runnable {
+            private var mFd: ParcelFileDescriptor? = null
+            private lateinit var mThread: java.lang.Thread
+
+            fun start(fd: ParcelFileDescriptor) {
+                mFd = fd
+                mThread = java.lang.Thread(this)
+                mThread.start()
+            }
+
+            fun stop() {
+                if (mFd != null) {
+                    try {
+                        mThread.interrupt()
+                        mThread.join()
+                        mFd?.close()
+                    } catch (e: java.lang.InterruptedException) {
+                        e.printStackTrace()
+                    } catch (e: java.io.IOException) {
+                        e.printStackTrace()
+                    }
+                    mFd = null
+                }
+            }
+
+            @kotlin.jvm.Synchronized
+            override fun run() {
+                try {
+                    val plain: java.io.FileInputStream = java.io.FileInputStream(mFd?.getFileDescriptor())
+                    val packet: java.nio.ByteBuffer = java.nio.ByteBuffer.allocate(mCache.mMtu)
+                    while (true) {
+                        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {    /* just read and ignore all data, regular read() is not interruptible */
+                            val len: Int = plain.getChannel().read(packet)
+                            packet.clear()
+                            if (len < 0) {
+                                break
+                            }
+                        } else {    /* this is rather ugly but on older platforms not even the NIO version of read() is interruptible */
+                            var wait = true
+                            if (plain.available() > 0) {
+                                val len: Int = plain.read(packet.array())
+                                packet.clear()
+                                if (len < 0 || java.lang.Thread.interrupted()) {
+                                    break
+                                }
+                                /* check again right away, there may be another packet */wait = false
+                            }
+                            if (wait) {
+                                java.lang.Thread.sleep(250)
+                            }
+                        }
+                    }
+                } catch (e: java.nio.channels.ClosedByInterruptException) {
+                    /* regular interruption */
+                } catch (e: java.lang.InterruptedException) {
+                } catch (e: java.io.IOException) {
+                    e.printStackTrace()
+                }
+            }
+        }
+    }
+
+    /**
+     * Cache non DNS related information so we can recreate the builder without
+     * that information when reestablishing IKE_SAs
+     */
+    class BuilderCache(profile: VpnProfile) {
+        val mAddresses: MutableList<IPRange> = java.util.ArrayList<IPRange>()
+        val mRoutesIPv4: MutableList<IPRange> = java.util.ArrayList<IPRange>()
+        val mRoutesIPv6: MutableList<IPRange> = java.util.ArrayList<IPRange>()
+        val mIncludedSubnetsv4: IPRangeSet = IPRangeSet()
+        val mIncludedSubnetsv6: IPRangeSet = IPRangeSet()
+        val mExcludedSubnets: IPRangeSet
+        val mSplitTunneling: Int
+        val mAppHandling: SelectedAppsHandling
+        val mSelectedApps: java.util.SortedSet<String>
+        val mDnsServers: MutableList<java.net.InetAddress> = java.util.ArrayList<java.net.InetAddress>()
+        var mMtu: Int
+        var mIPv4Seen = false
+        var mIPv6Seen = false
+        var mDnsServersConfigured = false
+
+        init {
+            val included: IPRangeSet = IPRangeSet.fromString(profile?.includedSubnets)
+            for (range in included) {
+                if (range.getFrom() is java.net.Inet4Address) {
+                    mIncludedSubnetsv4.add(range)
+                } else if (range.getFrom() is java.net.Inet6Address) {
+                    mIncludedSubnetsv6.add(range)
+                }
+            }
+            mExcludedSubnets = IPRangeSet.fromString(profile.excludedSubnets ?: "")
+            val splitTunneling: Int? = profile.splitTunneling
+            mSplitTunneling = splitTunneling ?: 0
+            var appHandling: SelectedAppsHandling = profile.selectedAppsHandling
+            mSelectedApps = profile.selectedAppsSet
+
+            when (appHandling) {
+                SelectedAppsHandling.SELECTED_APPS_DISABLE -> {
+                    appHandling = SelectedAppsHandling.SELECTED_APPS_EXCLUDE
+                    mSelectedApps.clear()
+                    mSelectedApps.add(PACKAGE_NAME)
+                }
+
+                SelectedAppsHandling.SELECTED_APPS_EXCLUDE -> {
+                    mSelectedApps.add(PACKAGE_NAME)
+                }
+
+                SelectedAppsHandling.SELECTED_APPS_ONLY -> {
+                    mSelectedApps.remove(PACKAGE_NAME)
+                }
+            }
+            mAppHandling = appHandling
+
+            val dnsServers = profile.dnsServers
+            if (dnsServers != null) {
+                for (server in dnsServers.split("\\s+")) {
+                    try {
+                        mDnsServers.add(Utils.parseInetAddress(server))
+                        recordAddressFamily(server)
+                        mDnsServersConfigured = true
+                    } catch (e: java.net.UnknownHostException) {
+                        e.printStackTrace()
+                    }
+                }
+            }
+
+            /* set a default MTU, will be set by the daemon for regular interfaces */
+            val mtu: Int? = profile.MTU
+            mMtu = mtu ?: Constants.MTU_MAX
+        }
+
+        fun addAddress(address: String?, prefixLength: Int) {
+            try {
+                mAddresses.add(IPRange(address, prefixLength))
+                recordAddressFamily(address)
+            } catch (ex: java.net.UnknownHostException) {
+                ex.printStackTrace()
+            }
+        }
+
+        fun addDnsServer(address: String?) {
+            /* ignore received DNS servers if any were configured */
+            if (mDnsServersConfigured) {
+                return
+            }
+            try {
+                mDnsServers.add(Utils.parseInetAddress(address))
+                recordAddressFamily(address)
+            } catch (e: java.net.UnknownHostException) {
+                e.printStackTrace()
+            }
+        }
+
+        fun addRoute(address: String?, prefixLength: Int) {
+            try {
+                if (isIPv6(address)) {
+                    mRoutesIPv6.add(IPRange(address, prefixLength))
+                } else {
+                    mRoutesIPv4.add(IPRange(address, prefixLength))
+                }
+            } catch (ex: java.net.UnknownHostException) {
+                ex.printStackTrace()
+            }
+        }
+
+        fun setMtu(mtu: Int) {
+            mMtu = mtu
+        }
+
+        fun recordAddressFamily(address: String?) {
+            try {
+                if (isIPv6(address)) {
+                    mIPv6Seen = true
+                } else {
+                    mIPv4Seen = true
+                }
+            } catch (ex: java.net.UnknownHostException) {
+                ex.printStackTrace()
+            }
+        }
+
+        @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+        fun applyData(builder: VpnService.Builder) {
+            for (address in mAddresses) {
+                builder.addAddress(address.getFrom(), address.getPrefix())
+            }
+            for (server in mDnsServers) {
+                builder.addDnsServer(server)
+            }
+            /* add routes depending on whether split tunneling is allowed or not,
+			 * that is, whether we have to handle and block non-VPN traffic */
+            if (mSplitTunneling and VpnProfile.SPLIT_TUNNELING_BLOCK_IPV4 === 0) {
+                if (mIPv4Seen) {    /* split tunneling is used depending on the routes and configuration */
+                    val ranges = IPRangeSet()
+                    if (mIncludedSubnetsv4.size() > 0) {
+                        ranges.add(mIncludedSubnetsv4)
+                    } else {
+                        ranges.addAll(mRoutesIPv4)
+                    }
+                    ranges.remove(mExcludedSubnets)
+                    for (subnet in ranges.subnets()) {
+                        try {
+                            builder.addRoute(subnet.getFrom(), subnet.getPrefix())
+                        } catch (e: java.lang.IllegalArgumentException) {    /* some Android versions don't seem to like multicast addresses here,
+							 * ignore it for now */
+                            if (!subnet.getFrom().isMulticastAddress()) {
+                                throw e
+                            }
+                        }
+                    }
+                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {    /* allow traffic that would otherwise be blocked to bypass the VPN */
+                    builder.allowFamily(OsConstants.AF_INET)
+                }
+            } else if (mIPv4Seen) {    /* only needed if we've seen any addresses.  otherwise, traffic
+				 * is blocked by default (we also install no routes in that case) */
+                builder.addRoute("0.0.0.0", 0)
+            }
+            /* same thing for IPv6 */
+            if (mSplitTunneling and VpnProfile.SPLIT_TUNNELING_BLOCK_IPV6 === 0) {
+                if (mIPv6Seen) {
+                    val ranges = IPRangeSet()
+                    if (mIncludedSubnetsv6.size() > 0) {
+                        ranges.add(mIncludedSubnetsv6)
+                    } else {
+                        ranges.addAll(mRoutesIPv6)
+                    }
+                    ranges.remove(mExcludedSubnets)
+                    for (subnet in ranges.subnets()) {
+                        try {
+                            builder.addRoute(subnet.getFrom(), subnet.getPrefix())
+                        } catch (e: java.lang.IllegalArgumentException) {
+                            if (!subnet.getFrom().isMulticastAddress()) {
+                                throw e
+                            }
+                        }
+                    }
+                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+                    builder.allowFamily(OsConstants.AF_INET6)
+                }
+            } else if (mIPv6Seen) {
+                builder.addRoute("::", 0)
+            }
+            /* apply selected applications */
+            if (mSelectedApps.size > 0 &&
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP
+            ) {
+                when (mAppHandling) {
+                    SelectedAppsHandling.SELECTED_APPS_EXCLUDE -> for (app in mSelectedApps) {
+                        try {
+                            builder.addDisallowedApplication(app)
+                        } catch (e: PackageManager.NameNotFoundException) {
+                            // possible if not configured via GUI or app was uninstalled
+                        }
+                    }
+
+                    SelectedAppsHandling.SELECTED_APPS_ONLY -> for (app in mSelectedApps) {
+                        try {
+                            builder.addAllowedApplication(app)
+                        } catch (e: PackageManager.NameNotFoundException) {
+                            // possible if not configured via GUI or app was uninstalled
+                        }
+                    }
+
+                    else -> {}
+                }
+            }
+            builder.setMtu(mMtu)
+        }
+
+        @kotlin.Throws(java.net.UnknownHostException::class)
+        private fun isIPv6(address: String?): Boolean {
+            val addr: java.net.InetAddress = Utils.parseInetAddress(address)
+            if (addr is java.net.Inet4Address) {
+                return false
+            } else if (addr is java.net.Inet6Address) {
+                return true
+            }
+            return false
+        }
+    }
+
+    /**
+     * Function called via JNI to determine information about the Android version.
+     */
+    private fun getAndroidVersion(): String? {
+        var version = "Android " + Build.VERSION.RELEASE + " - " + Build.DISPLAY
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            version += "/" + Build.VERSION.SECURITY_PATCH
+        }
+        return version
+    }
+
+    /**
+     * Function called via JNI to determine information about the device.
+     */
+    private fun getDeviceString(): String? {
+        return ((Build.MODEL + " - " + Build.BRAND).toString() + "/" + Build.PRODUCT).toString() + "/" + Build.MANUFACTURER
+    }
+
+    /**
+     * Add a permanent notification while we are connected to avoid the service getting killed by
+     * the system when low on memory.
+     */
+    private fun addNotification() {
+//        mHandler.post(object : java.lang.Runnable {
+//            fun run() {
+//                mShowNotification = true
+//                startForeground(
+//                    org.strongswan.android.logic.CharonVpnService.VPN_STATE_NOTIFICATION_ID,
+//                    buildNotification(false)
+//                )
+//            }
+//        })
+    }
+
+    /**
+     * Remove the permanent notification.
+     */
+    private fun removeNotification() {
+//        mHandler.post(object : java.lang.Runnable {
+//            fun run() {
+//                mShowNotification = false
+//                stopForeground(true)
+//            }
+//        })
+    }
+
+    /**
+     * Set an error on the state service. Called by the handler thread and any
+     * of charon's threads.
+     *
+     * @param error error state
+     */
+    private fun setError(error: ErrorState) {
+//        synchronized(mServiceLock) {
+//            if (mService != null) {
+//                mService.setError(error)
+//            }
+//        }
+    }
+
+    enum class State {
+        DISABLED, CONNECTING, CONNECTED, DISCONNECTING
+    }
+
+    enum class ErrorState {
+        NO_ERROR, AUTH_FAILED, PEER_AUTH_FAILED, LOOKUP_FAILED, UNREACHABLE, GENERIC_ERROR, PASSWORD_MISSING, CERTIFICATE_UNAVAILABLE
+    }
+}
--- a/client/android/src/org/amnezia/vpn/OpenVPNThreadv3.kt
+++ b/client/android/src/org/amnezia/vpn/OpenVPNThreadv3.kt
@@ -14,7 +14,6 @@ import com.wireguard.android.util.SharedLibraryLoader
 import com.wireguard.config.*
 import com.wireguard.crypto.Key
 import org.json.JSONObject
-import java.util.Base64

 import net.openvpn.ovpn3.ClientAPI_Config
 import net.openvpn.ovpn3.ClientAPI_EvalConfig
@@ -26,7 +25,6 @@ import net.openvpn.ovpn3.ClientAPI_OpenVPNClient
 import net.openvpn.ovpn3.ClientAPI_ProvideCreds
 import net.openvpn.ovpn3.ClientAPI_Status
 import net.openvpn.ovpn3.ClientAPI_TransportStats
-import java.lang.StringBuilder

 class OpenVPNThreadv3(var service: VPNService): ClientAPI_OpenVPNClient(), Runnable {
    private val tag = "OpenVPNThreadv3"
@@ -61,48 +59,7 @@ class OpenVPNThreadv3(var service: VPNService): ClientAPI_OpenVPNClient(), Runna
    override fun run() {

        val config: ClientAPI_Config = ClientAPI_Config()
-
-        val jsonVpnConfig = mService.getVpnConfig()
-        val ovpnConfig = jsonVpnConfig.getJSONObject("openvpn_config_data").getString("config")
-
-        val resultingConfig = StringBuilder()
-        resultingConfig.append(ovpnConfig)
-
-        if (jsonVpnConfig.getString("protocol") == "cloak") {
-            val cloakConfigJson: JSONObject = jsonVpnConfig.getJSONObject("cloak_config_data")
-
-            if (cloakConfigJson.keySet().contains("NumConn")) {
-                cloakConfigJson.put("NumConn", 1)
-            }
-
-            if (cloakConfigJson.keySet().contains("ProxyMethod")) {
-                cloakConfigJson.put("ProxyMethod", "openvpn")
-            }
-
-            if (cloakConfigJson.keySet().contains("port")) {
-                val portValue = cloakConfigJson.get("port")
-                cloakConfigJson.remove("port")
-                cloakConfigJson.put("RemotePort", portValue)
-            }
-
-            if (cloakConfigJson.keySet().contains("remote")) {
-                val hostValue = cloakConfigJson.get("remote")
-                cloakConfigJson.remove("remote")
-                cloakConfigJson.put("RemoteHost", hostValue)
-            }
-
-            val cloakConfig = Base64.getEncoder().encodeToString(
-                jsonVpnConfig.getJSONObject("cloak_config_data").toString().toByteArray()
-            )
-
-            resultingConfig.append("\n<cloak>\n")
-            resultingConfig.append(cloakConfig)
-            resultingConfig.append("\n</cloak>\n")
-
-            config.setUsePluggableTransports(true)
-        }
-
-        config.content = resultingConfig.toString()
+        config.content = mService.getVpnConfig().getJSONObject("openvpn_config_data").getString("config")

        eval_config(config)

@@ -110,6 +67,7 @@ class OpenVPNThreadv3(var service: VPNService): ClientAPI_OpenVPNClient(), Runna
        if (status.getError()) {
            Log.i(tag, "connect() error: " + status.getError() + ": " + status.getMessage())
        }
+
    }

    override fun log(arg0: ClientAPI_LogInfo){
--- a/client/android/src/org/amnezia/vpn/VPNService.kt
+++ b/client/android/src/org/amnezia/vpn/VPNService.kt
@@ -150,6 +150,8 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
    private var mOpenVPNThreadv3: OpenVPNThreadv3? = null
    var currentTunnelHandle = -1

+    private var ikev2VpnThread: IKEv2Thread? = null
+
    private var intent: Intent? = null
    private var flags = 0
    private var startId = 0
@@ -165,6 +167,7 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
        Log.e(tag, "Wireguard Version ${wgVersion()}")
        mOpenVPNThreadv3 = OpenVPNThreadv3(this)
        mAlreadyInitialised = true
+        ikev2VpnThread = IKEv2Thread(mbuilder, getFilesDir().getAbsolutePath())
    }

    override fun onCreate() {
@@ -176,6 +179,7 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
    }

    override fun onUnbind(intent: Intent?): Boolean {
+        Log.v(tag, "Aman: onUnbind....................")
        if (!isUp) {
            // If the Qt Client got closed while we were not connected
            // we do not need to stay as a foreground service.
@@ -184,17 +188,12 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
        return super.onUnbind(intent)
    }

-    override fun onDestroy() {
-        turnOff()
-
-        super.onDestroy()
-    }
-
    /**
     * EntryPoint for the Service, gets Called when AndroidController.cpp
     * calles bindService. Returns the [VPNServiceBinder] so QT can send Requests to it.
     */
    override fun onBind(intent: Intent): IBinder {
+        Log.v(tag, "Aman: onBind....................")

        when (mProtocol) {
            "shadowsocks" -> {
@@ -218,6 +217,7 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
     * or from Booting the device and having "connect on boot" enabled.
     */
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        Log.v(tag, "Aman: onStartCommand....................")
        this.intent = intent
        this.flags = flags
        this.startId = startId
@@ -281,7 +281,6 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
    var isUp: Boolean = false
        get() {
            return when (mProtocol) {
-                "cloak",
                "openvpn" -> {
                    field
                }
@@ -307,7 +306,6 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
            val deviceIpv4: String = ""

            val status = when (mProtocol) {
-                "cloak",
                "openvpn" -> {
                    if (mOpenVPNThreadv3 == null) {
                        Status(null, null, null, null)
@@ -378,9 +376,7 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
        Log.i(tag, "Config: $mConfig")
        mProtocol = mConfig!!.getString("protocol")
        Log.i(tag, "Protocol: $mProtocol")
-
        when (mProtocol) {
-            "cloak",
            "openvpn" -> {
                startOpenVpn()
            }
@@ -391,8 +387,11 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
                startShadowsocks()
                startTest()
            }
+            "ikev2" -> {
+                startIPSEC()
+            }
            else -> {
-                Log.e(tag, "No protocol")
+                Log.e(tag, "Unknown protocol ($mProtocol)")
                return 0
            }
        }
@@ -400,9 +399,22 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
        return 1
    }

+    private fun startIPSEC() {
+        Log.v(tag, "start ipsec")
+        ikev2VpnThread = IKEv2Thread(mbuilder, getFilesDir().getAbsolutePath())
+        
+        // TODO: pass the "vpnprofile" instance as a parameter
+        // ikev2VpnThread.setNextProfile() 
+
+        Thread({
+            ikev2VpnThread?.run()
+        }).start()
+    }
+
    fun establish(): ParcelFileDescriptor? {
        Log.v(tag, "Aman: establish....................")
        mbuilder.allowFamily(OsConstants.AF_INET)
+        mbuilder.allowFamily(OsConstants.AF_INET6)

        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) mbuilder.setMetered(false)
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) setUnderlyingNetworks(null)
@@ -454,13 +466,8 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
    fun turnOff() {
        Log.v(tag, "Aman: turnOff....................")
        when (mProtocol) {
-            "wireguard" -> {
-                wgTurnOff(currentTunnelHandle)
-            }
-            "cloak",
-            "openvpn" -> {
-                ovpnTurnOff()
-            }
+            "wireguard" -> wgTurnOff(currentTunnelHandle)
+            "openvpn" -> ovpnTurnOff()
            "shadowsocks" -> {
                stopRunner(false)
                stopTest()
@@ -469,7 +476,6 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
                Log.e(tag, "No protocol")
            }
        }
-
        currentTunnelHandle = -1
        stopForeground(true)
        isUp = false
@@ -701,10 +707,6 @@ class VPNService : BaseVpnService(), LocalDnsService.Interface {
    }

    private fun startOpenVpn() {
-        if (isUp || mOpenVPNThreadv3 != null) {
-            ovpnTurnOff()
-        }
-
        mOpenVPNThreadv3 = OpenVPNThreadv3(this)

        Thread({
--- a/client/android/src/org/amnezia/vpn/ikev2/VpnProfile.kt
+++ b/client/android/src/org/amnezia/vpn/ikev2/VpnProfile.kt
@@ -0,0 +1,111 @@
+package org.amnezia.vpn.ikev2
+
+import android.text.TextUtils
+
+class VpnProfile : kotlin.Cloneable {
+    var name: String? = null
+    var gateway: String? = null
+    var username: String? = null
+    var password: String? = null
+    var certificateAlias: String? = null
+    var userCertificateAlias: String? = null
+    var remoteId: String? = null
+    var localId: String? = null
+    var excludedSubnets: String? = null
+    var includedSubnets: String? = null
+    var selectedApps: String? = null
+    var ikeProposal: String? = null
+    var espProposal: String? = null
+    var dnsServers: String? = null
+    var MTU: Int? = null
+    var port: Int? = null
+    var splitTunneling: Int? = null
+    var NATKeepAlive: Int? = null
+    private var mFlags: Int? = null
+    var selectedAppsHandling = SelectedAppsHandling.SELECTED_APPS_DISABLE
+    private var mVpnType: VpnType? = null
+    private var mUUID: java.util.UUID?
+    var id: Long = -1
+
+    enum class SelectedAppsHandling(val value: Int) {
+        SELECTED_APPS_DISABLE(0), SELECTED_APPS_EXCLUDE(1), SELECTED_APPS_ONLY(2);
+
+    }
+
+    init {
+        mUUID = java.util.UUID.randomUUID()
+    }
+
+    var uUID: java.util.UUID?
+        get() = mUUID
+        set(uuid) {
+            mUUID = uuid
+        }
+    var vpnType: VpnType?
+        get() = mVpnType
+        set(type) {
+            mVpnType = type
+        }
+
+    fun setSelectedApps(selectedApps: java.util.SortedSet<String?>) {
+        this.selectedApps = if (selectedApps.size > 0) TextUtils.join(" ", selectedApps) else null
+    }
+
+    val selectedAppsSet: java.util.SortedSet<String>
+        get() {
+            val set: java.util.TreeSet<String> = java.util.TreeSet<String>()
+            if (!TextUtils.isEmpty(selectedApps)) {
+                set.addAll(
+                    java.util.Arrays.asList<String>(
+                        *selectedApps!!.split("\\s+".toRegex()).dropLastWhile { it.isEmpty() }
+                            .toTypedArray()))
+            }
+            return set
+        }
+
+    fun setSelectedAppsHandling(value: Int) {
+        selectedAppsHandling = SelectedAppsHandling.SELECTED_APPS_DISABLE
+        for (handling in VpnProfile.SelectedAppsHandling.values()) {
+            if (handling.value == value) {
+                selectedAppsHandling = handling
+                break
+            }
+        }
+    }
+
+    var flags: Int = 0
+
+    override fun toString(): String {
+        return name!!
+    }
+
+    override fun equals(o: Any?): Boolean {
+        if (o != null && o is VpnProfile) {
+            val other = o
+            return if (mUUID != null && other.uUID != null) {
+                mUUID == other.uUID
+            } else id == other.id
+        }
+        return false
+    }
+
+    override fun clone(): VpnProfile {
+        return try {
+            super.clone() as VpnProfile
+        } catch (e: java.lang.CloneNotSupportedException) {
+            throw java.lang.AssertionError()
+        }
+    }
+
+    companion object {
+        /* While storing this as EnumSet would be nicer this simplifies storing it in a database */
+        const val SPLIT_TUNNELING_BLOCK_IPV4 = 1
+        const val SPLIT_TUNNELING_BLOCK_IPV6 = 2
+        const val FLAGS_SUPPRESS_CERT_REQS = 1 shl 0
+        const val FLAGS_DISABLE_CRL = 1 shl 1
+        const val FLAGS_DISABLE_OCSP = 1 shl 2
+        const val FLAGS_STRICT_REVOCATION = 1 shl 3
+        const val FLAGS_RSA_PSS = 1 shl 4
+        const val FLAGS_IPv6_TRANSPORT = 1 shl 5
+    }
+}
--- a/client/android/src/org/amnezia/vpn/ikev2/VpnType.kt
+++ b/client/android/src/org/amnezia/vpn/ikev2/VpnType.kt
@@ -0,0 +1,79 @@
+package org.amnezia.vpn.ikev2
+
+enum class VpnType(
+    /**
+     * The identifier used to store this value in the database
+     * @return identifier
+     */
+    val identifier: String, features: java.util.EnumSet<VpnTypeFeature>
+) {
+    /* the order here must match the items in R.array.vpn_types */
+    IKEV2_EAP("ikev2-eap", java.util.EnumSet.of(VpnTypeFeature.USER_PASS)), IKEV2_CERT(
+        "ikev2-cert", java.util.EnumSet.of(
+            VpnTypeFeature.CERTIFICATE
+        )
+    ),
+    IKEV2_CERT_EAP(
+        "ikev2-cert-eap",
+        java.util.EnumSet.of(VpnTypeFeature.USER_PASS, VpnTypeFeature.CERTIFICATE)
+    ),
+    IKEV2_EAP_TLS(
+        "ikev2-eap-tls", java.util.EnumSet.of(
+            VpnTypeFeature.CERTIFICATE
+        )
+    ),
+    IKEV2_BYOD_EAP("ikev2-byod-eap", java.util.EnumSet.of(VpnTypeFeature.USER_PASS, VpnTypeFeature.BYOD));
+
+    /**
+     * Features of a VPN type.
+     */
+    enum class VpnTypeFeature {
+        /** client certificate is required  */
+        CERTIFICATE,
+
+        /** username and password are required  */
+        USER_PASS,
+
+        /** enable BYOD features  */
+        BYOD
+    }
+
+    private val mFeatures: java.util.EnumSet<VpnTypeFeature>
+
+    /**
+     * Enum which provides additional information about the supported VPN types.
+     *
+     * @param id identifier used to store and transmit this specific type
+     * @param features of the given VPN type
+     * @param certificate true if a client certificate is required
+     */
+    init {
+        mFeatures = features
+    }
+
+    /**
+     * Checks whether a feature is supported/required by this type of VPN.
+     *
+     * @return true if the feature is supported/required
+     */
+    fun has(feature: VpnTypeFeature?): Boolean {
+        return mFeatures.contains(feature)
+    }
+
+    companion object {
+        /**
+         * Get the enum entry with the given identifier.
+         *
+         * @param identifier get the enum entry with this identifier
+         * @return the enum entry, or the default if not found
+         */
+        fun fromIdentifier(identifier: String): VpnType {
+            for (type in VpnType.values()) {
+                if (identifier == type.identifier) {
+                    return type
+                }
+            }
+            return IKEV2_EAP
+        }
+    }
+}
--- a/client/android/src/org/amnezia/vpn/ikev2/utils/BufferedByteWriter.java
+++ b/client/android/src/org/amnezia/vpn/ikev2/utils/BufferedByteWriter.java
@@ -0,0 +1,272 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+package org.amnezia.vpn.ikev2.utils;
+
+import java.nio.ByteBuffer;
+
+/**
+ * Very similar to ByteBuffer (although with a stripped interface) but it
+ * automatically resizes the underlying buffer.
+ */
+public class BufferedByteWriter
+{
+	/**
+	 * The underlying byte buffer
+	 */
+	private byte[] mBuffer;
+
+	/**
+	 * ByteBuffer used as wrapper around the buffer to easily convert values
+	 */
+	private ByteBuffer mWriter;
+
+	/**
+	 * Create a writer with a default initial capacity
+	 */
+	public BufferedByteWriter()
+	{
+		this(0);
+	}
+
+	/**
+	 * Create a writer with the given initial capacity (helps avoid expensive
+	 * resizing if known).
+	 * @param capacity initial capacity
+	 */
+	public BufferedByteWriter(int capacity)
+	{
+		capacity = capacity > 4 ? capacity : 32;
+		mBuffer = new byte[capacity];
+		mWriter = ByteBuffer.wrap(mBuffer);
+	}
+
+	/**
+	 * Ensure that there is enough space available to write the requested
+	 * number of bytes. If necessary the internal buffer is resized.
+	 * @param required required number of bytes
+	 */
+	private void ensureCapacity(int required)
+	{
+		if (mWriter.remaining() >= required)
+		{
+			return;
+		}
+		byte[] buffer = new byte[(mBuffer.length + required) * 2];
+		System.arraycopy(mBuffer, 0, buffer, 0, mWriter.position());
+		mBuffer = buffer;
+		ByteBuffer writer = ByteBuffer.wrap(buffer);
+		writer.position(mWriter.position());
+		mWriter = writer;
+	}
+
+	/**
+	 * Write the given byte array to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put(byte[] value)
+	{
+		ensureCapacity(value.length);
+		mWriter.put(value);
+		return this;
+	}
+
+	/**
+	 * Write the given byte to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put(byte value)
+	{
+		ensureCapacity(1);
+		mWriter.put(value);
+		return this;
+	}
+
+	/**
+	 * Write the 8-bit length of the given data followed by the data itself
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter putLen8(byte[] value)
+	{
+		ensureCapacity(1 + value.length);
+		mWriter.put((byte)value.length);
+		mWriter.put(value);
+		return this;
+	}
+
+	/**
+	 * Write the 16-bit length of the given data followed by the data itself
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter putLen16(byte[] value)
+	{
+		ensureCapacity(2 + value.length);
+		mWriter.putShort((short)value.length);
+		mWriter.put(value);
+		return this;
+	}
+
+	/**
+	 * Write the given short value (16-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put16(byte value)
+	{
+		return this.put16((short)(value & 0xFF));
+	}
+
+	/**
+	 * Write the given short value (16-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put16(short value)
+	{
+		ensureCapacity(2);
+		mWriter.putShort(value);
+		return this;
+	}
+
+	/**
+	 * Write 24-bit of the given value in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put24(byte value)
+	{
+		ensureCapacity(3);
+		mWriter.putShort((short)0);
+		mWriter.put(value);
+		return this;
+	}
+
+	/**
+	 * Write 24-bit of the given value in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put24(short value)
+	{
+		ensureCapacity(3);
+		mWriter.put((byte)0);
+		mWriter.putShort(value);
+		return this;
+	}
+
+	/**
+	 * Write 24-bit of the given value in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put24(int value)
+	{
+		ensureCapacity(3);
+		mWriter.put((byte)(value >> 16));
+		mWriter.putShort((short)value);
+		return this;
+	}
+
+	/**
+	 * Write the given int value (32-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put32(byte value)
+	{
+		return put32(value & 0xFF);
+	}
+
+	/**
+	 * Write the given int value (32-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put32(short value)
+	{
+		return put32(value & 0xFFFF);
+	}
+
+	/**
+	 * Write the given int value (32-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put32(int value)
+	{
+		ensureCapacity(4);
+		mWriter.putInt(value);
+		return this;
+	}
+
+	/**
+	 * Write the given long value (64-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put64(byte value)
+	{
+		return put64(value & 0xFFL);
+	}
+
+	/**
+	 * Write the given long value (64-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put64(short value)
+	{
+		return put64(value & 0xFFFFL);
+	}
+
+	/**
+	 * Write the given long value (64-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put64(int value)
+	{
+		return put64(value & 0xFFFFFFFFL);
+	}
+
+	/**
+	 * Write the given long value (64-bit) in big-endian order to the buffer
+	 * @param value
+	 * @return the writer
+	 */
+	public BufferedByteWriter put64(long value)
+	{
+		ensureCapacity(8);
+		mWriter.putLong(value);
+		return this;
+	}
+
+	/**
+	 * Convert the internal buffer to a new byte array.
+	 * @return byte array
+	 */
+	public byte[] toByteArray()
+	{
+		int length = mWriter.position();
+		byte[] bytes = new byte[length];
+		System.arraycopy(mBuffer, 0, bytes, 0, length);
+		return bytes;
+	}
+}
--- a/client/android/src/org/amnezia/vpn/ikev2/utils/Constants.java
+++ b/client/android/src/org/amnezia/vpn/ikev2/utils/Constants.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016-2020 Tobias Brunner
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+package org.amnezia.vpn.ikev2.utils;
+
+public final class Constants
+{
+	/**
+	 * Intent action used to notify about changes to the VPN profiles
+	 */
+	public static final String VPN_PROFILES_CHANGED = "org.strongswan.android.VPN_PROFILES_CHANGED";
+
+	/**
+	 * Used in the intent above to notify about edits or inserts of a VPN profile (long)
+	 */
+	public static final String VPN_PROFILES_SINGLE = "org.strongswan.android.VPN_PROFILES_SINGLE";
+
+	/**
+	 * Used in the intent above to notify about the deletion of multiple VPN profiles (array of longs)
+	 */
+	public static final String VPN_PROFILES_MULTIPLE = "org.strongswan.android.VPN_PROFILES_MULTIPLE";
+
+	/**
+	 * Limits for MTU
+	 */
+	public static final int MTU_MAX = 1500;
+	public static final int MTU_MIN = 1280;
+
+	/**
+	 * Limits for NAT-T keepalive
+	 */
+	public static final int NAT_KEEPALIVE_MAX = 120;
+	public static final int NAT_KEEPALIVE_MIN = 10;
+
+	/**
+	 * Preference key for default VPN profile
+	 */
+	public static final String PREF_DEFAULT_VPN_PROFILE = "pref_default_vpn_profile";
+
+	/**
+	 * Value used to signify that the most recently used profile should be used as default
+	 */
+	public static final String PREF_DEFAULT_VPN_PROFILE_MRU = "pref_default_vpn_profile_mru";
+
+	/**
+	 * Preference key to store the most recently used VPN profile
+	 */
+	public static final String PREF_MRU_VPN_PROFILE = "pref_mru_vpn_profile";
+
+	/**
+	 * Preference key to store whether the user permanently dismissed our warning to add the app to the power whitelist
+	 */
+	public static final String PREF_IGNORE_POWER_WHITELIST = "pref_ignore_power_whitelist";
+}
--- a/client/android/src/org/amnezia/vpn/ikev2/utils/IPRange.java
+++ b/client/android/src/org/amnezia/vpn/ikev2/utils/IPRange.java
@@ -0,0 +1,510 @@
+/*
+ * Copyright (C) 2012-2017 Tobias Brunner
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+package org.amnezia.vpn.ikev2.utils;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import androidx.annotation.NonNull;
+
+/**
+ * Class that represents a range of IP addresses. This range could be a proper subnet, but that's
+ * not necessarily the case (see {@code getPrefix} and {@code toSubnets}).
+ */
+public class IPRange implements Comparable<IPRange>
+{
+	private final byte[] mBitmask = { (byte)0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
+	private byte[] mFrom;
+	private byte[] mTo;
+	private Integer mPrefix;
+
+	/**
+	 * Determine if the range is a proper subnet and, if so, what the network prefix is.
+	 */
+	private void determinePrefix()
+	{
+		boolean matching = true;
+
+		mPrefix = mFrom.length * 8;
+		for (int i = 0; i < mFrom.length; i++)
+		{
+			for (int bit = 0; bit < 8; bit++)
+			{
+				if (matching)
+				{
+					if ((mFrom[i] & mBitmask[bit]) != (mTo[i] & mBitmask[bit]))
+					{
+						mPrefix = (i * 8) + bit;
+						matching = false;
+					}
+				}
+				else
+				{
+					if ((mFrom[i] & mBitmask[bit]) != 0 || (mTo[i] & mBitmask[bit]) == 0)
+					{
+						mPrefix = null;
+						return;
+					}
+				}
+			}
+		}
+	}
+
+	private IPRange(byte[] from, byte[] to)
+	{
+		mFrom = from;
+		mTo = to;
+		determinePrefix();
+	}
+
+	public IPRange(String from, String to) throws UnknownHostException
+	{
+		this(Utils.parseInetAddress(from), Utils.parseInetAddress(to));
+	}
+
+	public IPRange(InetAddress from, InetAddress to)
+	{
+		initializeFromRange(from, to);
+	}
+
+	private void initializeFromRange(InetAddress from, InetAddress to)
+	{
+		byte[] fa = from.getAddress(), ta = to.getAddress();
+		if (fa.length != ta.length)
+		{
+			throw new IllegalArgumentException("Invalid range");
+		}
+		if (compareAddr(fa, ta) < 0)
+		{
+			mFrom = fa;
+			mTo = ta;
+		}
+		else
+		{
+			mTo = fa;
+			mFrom = ta;
+		}
+		determinePrefix();
+	}
+
+	public IPRange(String base, int prefix) throws UnknownHostException
+	{
+		this(Utils.parseInetAddress(base), prefix);
+	}
+
+	public IPRange(InetAddress base, int prefix)
+	{
+		this(base.getAddress(), prefix);
+	}
+
+	private IPRange(byte[] from, int prefix)
+	{
+		initializeFromCIDR(from, prefix);
+	}
+
+	private void initializeFromCIDR(byte[] from, int prefix)
+	{
+		if (from.length != 4 && from.length != 16)
+		{
+			throw new IllegalArgumentException("Invalid address");
+		}
+		if (prefix < 0 || prefix > from.length * 8)
+		{
+			throw new IllegalArgumentException("Invalid prefix");
+		}
+		byte[] to = from.clone();
+		byte mask = (byte)(0xff << (8 - prefix % 8));
+		int i = prefix / 8;
+
+		if (i < from.length)
+		{
+			from[i] = (byte)(from[i] & mask);
+			to[i] = (byte)(to[i] | ~mask);
+			Arrays.fill(from, i+1, from.length, (byte)0);
+			Arrays.fill(to, i+1, to.length, (byte)0xff);
+		}
+		mFrom = from;
+		mTo = to;
+		mPrefix = prefix;
+	}
+
+	public IPRange(String cidr) throws UnknownHostException
+	{
+		/* only verify the basic structure */
+		if (!cidr.matches("(?i)^(([0-9.]+)|([0-9a-f:]+))(-(([0-9.]+)|([0-9a-f:]+))|(/\\d+))?$"))
+		{
+			throw new IllegalArgumentException("Invalid CIDR or range notation");
+		}
+		if (cidr.contains("-"))
+		{
+			String[] parts = cidr.split("-");
+			InetAddress from = InetAddress.getByName(parts[0]);
+			InetAddress to = InetAddress.getByName(parts[1]);
+			initializeFromRange(from, to);
+		}
+		else
+		{
+			String[] parts = cidr.split("/");
+			InetAddress addr = InetAddress.getByName(parts[0]);
+			byte[] base = addr.getAddress();
+			int prefix = base.length * 8;
+			if (parts.length > 1)
+			{
+				prefix = Integer.parseInt(parts[1]);
+			}
+			initializeFromCIDR(base, prefix);
+		}
+	}
+
+	/**
+	 * Returns the first address of the range. The network ID in case this is a proper subnet.
+	 */
+	public InetAddress getFrom()
+	{
+		try
+		{
+			return InetAddress.getByAddress(mFrom);
+		}
+		catch (UnknownHostException ignored)
+		{
+			return null;
+		}
+	}
+
+	/**
+	 * Returns the last address of the range.
+	 */
+	public InetAddress getTo()
+	{
+		try
+		{
+			return InetAddress.getByAddress(mTo);
+		}
+		catch (UnknownHostException ignored)
+		{
+			return null;
+		}
+	}
+
+	/**
+	 * If this range is a proper subnet returns its prefix, otherwise returns null.
+	 */
+	public Integer getPrefix()
+	{
+		return mPrefix;
+	}
+
+	@Override
+	public int compareTo(@NonNull IPRange other)
+	{
+		int cmp = compareAddr(mFrom, other.mFrom);
+		if (cmp == 0)
+		{	/* smaller ranges first */
+			cmp = compareAddr(mTo, other.mTo);
+		}
+		return cmp;
+	}
+
+	@Override
+	public boolean equals(Object o)
+	{
+		if (o == null || !(o instanceof IPRange))
+		{
+			return false;
+		}
+		return this == o || compareTo((IPRange)o) == 0;
+	}
+
+	@Override
+	public String toString()
+	{
+		try
+		{
+			if (mPrefix != null)
+			{
+				return InetAddress.getByAddress(mFrom).getHostAddress() + "/" + mPrefix;
+			}
+			return InetAddress.getByAddress(mFrom).getHostAddress() + "-" +
+				   InetAddress.getByAddress(mTo).getHostAddress();
+		}
+		catch (UnknownHostException ignored)
+		{
+			return super.toString();
+		}
+	}
+
+	private int compareAddr(byte a[], byte b[])
+	{
+		if (a.length != b.length)
+		{
+			return (a.length < b.length) ? -1 : 1;
+		}
+		for (int i = 0; i < a.length; i++)
+		{
+			if (a[i] != b[i])
+			{
+				if (((int)a[i] & 0xff) < ((int)b[i] & 0xff))
+				{
+					return -1;
+				}
+				else
+				{
+					return 1;
+				}
+			}
+		}
+		return 0;
+	}
+
+	/**
+	 * Check if this range fully contains the given range.
+	 */
+	public boolean contains(IPRange range)
+	{
+		return compareAddr(mFrom, range.mFrom) <= 0 && compareAddr(range.mTo, mTo) <= 0;
+	}
+
+	/**
+	 * Check if this and the given range overlap.
+	 */
+	public boolean overlaps(IPRange range)
+	{
+		return !(compareAddr(mTo, range.mFrom) < 0 || compareAddr(range.mTo, mFrom) < 0);
+	}
+
+	private byte[] dec(byte[] addr)
+	{
+		for (int i = addr.length - 1; i >= 0; i--)
+		{
+			if (--addr[i] != (byte)0xff)
+			{
+				break;
+			}
+		}
+		return addr;
+	}
+
+	private byte[] inc(byte[] addr)
+	{
+		for (int i = addr.length - 1; i >= 0; i--)
+		{
+			if (++addr[i] != 0)
+			{
+				break;
+			}
+		}
+		return addr;
+	}
+
+	/**
+	 * Remove the given range from the current range.  Returns a list of resulting ranges (these are
+	 * not proper subnets). At most two ranges are returned, in case the given range is contained in
+	 * this but does not equal it, which would result in an empty list (which is also the case if
+	 * this range is fully contained in the given range).
+	 */
+	public List<IPRange> remove(IPRange range)
+	{
+		ArrayList<IPRange> list = new ArrayList<>();
+		if (!overlaps(range))
+		{	/*           | this | or | this |
+		     * | range |                     | range | */
+			list.add(this);
+		}
+		else if (!range.contains(this))
+		{	/* we are not completely removed, so none of these cases applies:
+			 * | this  | or  | this  |   or   | this  |
+		     * | range |     | range   |    |   range | */
+			if (compareAddr(mFrom, range.mFrom) < 0 && compareAddr(range.mTo, mTo) < 0)
+			{	/* the removed range is completely within our boundaries:
+				 * |    this    |
+				 *   | range |   */
+				list.add(new IPRange(mFrom, dec(range.mFrom.clone())));
+				list.add(new IPRange(inc(range.mTo.clone()), mTo));
+			}
+			else
+			{	/* one end is within our boundaries the other at or outside it:
+			     * | this     | or    | this     | or | this    |  or  | this    |
+			     * | range |       | range |            | range |           | range | */
+				byte[] from = compareAddr(mFrom, range.mFrom) < 0 ? mFrom : inc(range.mTo.clone());
+				byte[] to = compareAddr(mTo, range.mTo) > 0 ? mTo : dec(range.mFrom.clone());
+				list.add(new IPRange(from, to));
+			}
+		}
+		return list;
+	}
+
+	private boolean adjacent(IPRange range)
+	{
+		if (compareAddr(mTo, range.mFrom) < 0)
+		{
+			byte[] to = inc(mTo.clone());
+			return compareAddr(to, range.mFrom) == 0;
+		}
+		byte[] from = dec(mFrom.clone());
+		return compareAddr(from, range.mTo) == 0;
+	}
+
+	/**
+	 * Merge two adjacent or overlapping ranges, returns null if it's not possible to merge them.
+	 */
+	public IPRange merge(IPRange range)
+	{
+		if (overlaps(range))
+		{
+			if (contains(range))
+			{
+				return this;
+			}
+			else if (range.contains(this))
+			{
+				return range;
+			}
+		}
+		else if (!adjacent(range))
+		{
+			return null;
+		}
+		byte[] from = compareAddr(mFrom, range.mFrom) < 0 ? mFrom : range.mFrom;
+		byte[] to = compareAddr(mTo, range.mTo) > 0 ? mTo : range.mTo;
+		return new IPRange(from, to);
+	}
+
+	/**
+	 * Split the given range into a sorted list of proper subnets.
+	 */
+	public List<IPRange> toSubnets()
+	{
+		ArrayList<IPRange> list = new ArrayList<>();
+		if (mPrefix != null)
+		{
+			list.add(this);
+		}
+		else
+		{
+			int i = 0, bit = 0, prefix, netmask, common_byte, common_bit;
+			int from_cur, from_prev = 0, to_cur, to_prev = 1;
+			boolean from_full = true, to_full = true;
+
+			byte[] from = mFrom.clone();
+			byte[] to = mTo.clone();
+
+			/* find a common prefix */
+			while (i < from.length && (from[i] & mBitmask[bit]) == (to[i] & mBitmask[bit]))
+			{
+				if (++bit == 8)
+				{
+					bit = 0;
+					i++;
+				}
+			}
+			prefix = i * 8 + bit;
+
+			/* at this point we know that the addresses are either equal, or that the
+			 * current bits in the 'from' and 'to' addresses are 0 and 1, respectively.
+			 * we now look at the rest of the bits as two binary trees (0=left, 1=right)
+			 * where 'from' and 'to' are both leaf nodes.  all leaf nodes between these
+			 * nodes are addresses contained in the range.  to collect them as subnets
+			 * we follow the trees from both leaf nodes to their root node and record
+			 * all complete subtrees (right for from, left for to) we come across as
+			 * subnets.  in that process host bits are zeroed out.  if both addresses
+			 * are equal we won't enter the loop below.
+			 *      0_____|_____1       for the 'from' address we assume we start on a
+			 *   0__|__ 1    0__|__1    left subtree (0) and follow the left edges until
+			 *  _|_   _|_   _|_   _|_   we reach the root of this subtree, which is
+			 * |   | |   | |   | |   |  either the root of this whole 'from'-subtree
+			 * 0   1 0   1 0   1 0   1  (causing us to leave the loop) or the root node
+			 * of the right subtree (1) of another node (which actually could be the
+			 * leaf node we start from).  that whole subtree gets recorded as subnet.
+			 * next we follow the right edges to the root of that subtree which again is
+			 * either the 'from'-root or the root node in the left subtree (0) of
+			 * another node.  the complete right subtree of that node is the next subnet
+			 * we record.  from there we assume that we are in that right subtree and
+			 * recursively follow right edges to its root.  for the 'to' address the
+			 * procedure is exactly the same but with left and right reversed.
+			 */
+			if (++bit == 8)
+			{
+				bit = 0;
+				i++;
+			}
+			common_byte = i;
+			common_bit = bit;
+			netmask = from.length * 8;
+			for (i = from.length - 1; i >= common_byte; i--)
+			{
+				int bit_min = (i == common_byte) ? common_bit : 0;
+				for (bit = 7; bit >= bit_min; bit--)
+				{
+					byte mask = mBitmask[bit];
+
+					from_cur = from[i] & mask;
+					if (from_prev == 0 && from_cur != 0)
+					{	/* 0 -> 1: subnet is the whole current (right) subtree */
+						list.add(new IPRange(from.clone(), netmask));
+						from_full = false;
+					}
+					else if (from_prev != 0 && from_cur == 0)
+					{	/* 1 -> 0: invert bit to switch to right subtree and add it */
+						from[i] ^= mask;
+						list.add(new IPRange(from.clone(), netmask));
+						from_cur = 1;
+					}
+					/* clear the current bit */
+					from[i] &= ~mask;
+					from_prev = from_cur;
+
+					to_cur = to[i] & mask;
+					if (to_prev != 0 && to_cur == 0)
+					{	/* 1 -> 0: subnet is the whole current (left) subtree */
+						list.add(new IPRange(to.clone(), netmask));
+						to_full = false;
+					}
+					else if (to_prev == 0 && to_cur != 0)
+					{	/* 0 -> 1: invert bit to switch to left subtree and add it */
+						to[i] ^= mask;
+						list.add(new IPRange(to.clone(), netmask));
+						to_cur = 0;
+					}
+					/* clear the current bit */
+					to[i] &= ~mask;
+					to_prev = to_cur;
+					netmask--;
+				}
+			}
+
+			if (from_full && to_full)
+			{	/* full subnet (from=to or from=0.. and to=1.. after common prefix) - not reachable
+				 * due to the shortcut at the top */
+				list.add(new IPRange(from.clone(), prefix));
+			}
+			else if (from_full)
+			{	/* full from subnet (from=0.. after prefix) */
+				list.add(new IPRange(from.clone(), prefix + 1));
+			}
+			else if (to_full)
+			{	/* full to subnet (to=1.. after prefix) */
+				list.add(new IPRange(to.clone(), prefix + 1));
+			}
+		}
+		Collections.sort(list);
+		return list;
+	}
+}
--- a/client/android/src/org/amnezia/vpn/ikev2/utils/IPRangeSet.java
+++ b/client/android/src/org/amnezia/vpn/ikev2/utils/IPRangeSet.java
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2012-2017 Tobias Brunner
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+package org.amnezia.vpn.ikev2.utils;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+import java.util.TreeSet;
+
+/**
+ * Class that represents a set of IP address ranges (not necessarily proper subnets) and allows
+ * modifying the set and enumerating the resulting subnets.
+ */
+public class IPRangeSet implements Iterable<IPRange>
+{
+	private TreeSet<IPRange> mRanges = new TreeSet<>();
+
+	/**
+	 * Parse the given string (space separated ranges in CIDR or range notation) and return the
+	 * resulting set or {@code null} if the string was invalid. An empty set is returned if the given string
+	 * is {@code null}.
+	 */
+	public static IPRangeSet fromString(String ranges)
+	{
+		IPRangeSet set = new IPRangeSet();
+		if (ranges != null)
+		{
+			for (String range : ranges.split("\\s+"))
+			{
+				try
+				{
+					set.add(new IPRange(range));
+				}
+				catch (Exception unused)
+				{	/* besides due to invalid strings exceptions might get thrown if the string
+					 * contains a hostname (NetworkOnMainThreadException) */
+					return null;
+				}
+			}
+		}
+		return set;
+	}
+
+	/**
+	 * Add a range to this set. Automatically gets merged with existing ranges.
+	 */
+	public void add(IPRange range)
+	{
+		if (mRanges.contains(range))
+		{
+			return;
+		}
+		reinsert:
+		while (true)
+		{
+			Iterator<IPRange> iterator = mRanges.iterator();
+			while (iterator.hasNext())
+			{
+				IPRange existing = iterator.next();
+				IPRange replacement = existing.merge(range);
+				if (replacement != null)
+				{
+					iterator.remove();
+					range = replacement;
+					continue reinsert;
+				}
+			}
+			mRanges.add(range);
+			break;
+		}
+	}
+
+	/**
+	 * Add all ranges from the given set.
+	 */
+	public void add(IPRangeSet ranges)
+	{
+		if (ranges == this)
+		{
+			return;
+		}
+		for (IPRange range : ranges.mRanges)
+		{
+			add(range);
+		}
+	}
+
+	/**
+	 * Add all ranges from the given collection to this set.
+	 */
+	public void addAll(Collection<? extends IPRange> coll)
+	{
+		for (IPRange range : coll)
+		{
+			add(range);
+		}
+	}
+
+	/**
+	 * Remove the given range from this set. Existing ranges are automatically adjusted.
+	 */
+	public void remove(IPRange range)
+	{
+		ArrayList <IPRange> additions = new ArrayList<>();
+		Iterator<IPRange> iterator = mRanges.iterator();
+		while (iterator.hasNext())
+		{
+			IPRange existing = iterator.next();
+			List<IPRange> result = existing.remove(range);
+			if (result.size() == 0)
+			{
+				iterator.remove();
+			}
+			else if (!result.get(0).equals(existing))
+			{
+				iterator.remove();
+				additions.addAll(result);
+			}
+		}
+		mRanges.addAll(additions);
+	}
+
+	/**
+	 * Remove the given ranges from ranges in this set.
+	 */
+	public void remove(IPRangeSet ranges)
+	{
+		if (ranges == this)
+		{
+			mRanges.clear();
+			return;
+		}
+		for (IPRange range : ranges.mRanges)
+		{
+			remove(range);
+		}
+	}
+
+	/**
+	 * Get all the subnets derived from all the ranges in this set.
+	 */
+	public Iterable<IPRange> subnets()
+	{
+		return new Iterable<IPRange>()
+		{
+			@Override
+			public Iterator<IPRange> iterator()
+			{
+				return new Iterator<IPRange>()
+				{
+					private Iterator<IPRange> mIterator = mRanges.iterator();
+					private List<IPRange> mSubnets;
+
+					@Override
+					public boolean hasNext()
+					{
+						return (mSubnets != null && mSubnets.size() > 0) || mIterator.hasNext();
+					}
+
+					@Override
+					public IPRange next()
+					{
+						if (mSubnets == null || mSubnets.size() == 0)
+						{
+							IPRange range = mIterator.next();
+							mSubnets = range.toSubnets();
+						}
+						return mSubnets.remove(0);
+					}
+
+					@Override
+					public void remove()
+					{
+						throw new UnsupportedOperationException();
+					}
+				};
+			}
+		};
+	}
+
+	@Override
+	public Iterator<IPRange> iterator()
+	{
+		return mRanges.iterator();
+	}
+
+	/**
+	 * Returns the number of ranges, not subnets.
+	 */
+	public int size()
+	{
+		return mRanges.size();
+	}
+
+	@Override
+	public String toString()
+	{	/* we could use TextUtils, but that causes the unit tests to fail */
+		StringBuilder sb = new StringBuilder();
+		for (IPRange range : mRanges)
+		{
+			if (sb.length() > 0)
+			{
+				sb.append(" ");
+			}
+			sb.append(range.toString());
+		}
+		return sb.toString();
+	}
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dmitriy Karpushin	aef20430f2	Configuring of ikev2	2023-07-07 14:19:03 +03:00
Dmitriy Karpushin	b818de3378	Merge remote-tracking branch 'origin/feature/ikev2_android' into feature/ikev2_android	2023-04-24 15:42:18 +03:00
Dmitriy Karpushin	cf86c6e912	Start logic	2023-04-24 15:41:24 +03:00
Dmitry Karpushin	483263171b	Merge branch 'dev' into feature/ikev2_android	2023-04-24 13:19:23 +03:00
Dmitriy Karpushin	5fb91d8f5b	Update of strongswan submodule	2023-04-24 13:18:09 +03:00
Dmitriy Karpushin	100f8ad95d	Refactoring of build process + utility classes	2023-04-24 13:05:56 +03:00
Dmitriy Karpushin	e43041572e	Strongswan submodule fixes	2023-04-13 09:55:58 +03:00
Dmitriy Karpushin	4b103a1622	Pre-configuring of StrongSwan from project cmake file	2023-04-13 09:14:56 +03:00
Dmitriy Karpushin	b6c7ef415d	strongswan submodule for IKEv2 support	2023-04-05 16:07:31 +03:00