fix: make Linux DNS setup reliable under killswitch

- Set DNS resolvers via systemd-resolved after flushDns on connect (vpnConnection.cpp)
- RevertLink after systemd-resolved restart on disconnect (DnsUtilsLinux)
- Add scheduleRetry() to retry full DNS setup on D-Bus transient failures
- Reduce D-Bus call timeout to 5s; use systemctl restart for flushDns
- Guard maybeUpdateResolvers with #ifndef Q_OS_LINUX to preserve macOS/Windows DNS

.github/workflows/deploy.yml

@@ -414,10 +414,6 @@ jobs:
       matrix:
         xcode-version: [16.2, 16.4, 26.4]
         include:
-          - xcode-version: 16.2
-            os: macos-15
-          - xcode-version: 16.4
-            os: macos-15
           - xcode-version: 26.4
             os: macos-26
 
@@ -454,7 +450,7 @@ jobs:
 # ------------------------------------------------------
 
   Build-MacOS:
-    runs-on: macos-15
+    runs-on: macos-latest
 
     needs: Bake-Prebuilts-MacOS
     if: ${{ always() }}
@@ -501,7 +497,7 @@ jobs:
     - name: 'Setup xcode'
       uses: maxim-lobanov/setup-xcode@v1
       with:
-        xcode-version: '26.3.0'
+        xcode-version: '16.2.0'
 
     - name: 'Install Qt'
       uses: jurplel/install-qt-action@v4
@@ -554,10 +550,6 @@ jobs:
       matrix:
         xcode-version: [16.2, 16.4, 26.4]
         include:
-          - xcode-version: 16.2
-            os: macos-15
-          - xcode-version: 16.4
-            os: macos-15
           - xcode-version: 26.4
             os: macos-26
 
@@ -594,7 +586,7 @@ jobs:
 # ------------------------------------------------------
 
   Build-MacOS-NE:
-    runs-on: macos-26
+    runs-on: macos-latest
 
     needs: Bake-Prebuilts-MacOS-NE
     if: ${{ always() }}
@@ -618,12 +610,6 @@ jobs:
       PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
 
     steps:
-    - name: 'Get sources'
-      uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-
     - uses: ./.github/actions/apple-setup-provisioning-profile
       with:
         provisioning_profile_base64: ${{ secrets.MAC_APP_PROVISIONING_PROFILE }}
@@ -661,6 +647,12 @@ jobs:
           go install golang.org/x/mobile/cmd/gomobile@latest
           gomobile init
 
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
     - name: 'Setup python'
       uses: actions/setup-python@v6
       with:

.gitmodules

@@ -7,6 +7,9 @@
 [submodule "client/3rd/amneziawg-apple"]
 	path = client/3rd/amneziawg-apple
 	url = https://github.com/amnezia-vpn/amneziawg-apple
+[submodule "client/3rd/QSimpleCrypto"]
+	path = client/3rd/QSimpleCrypto
+	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
 [submodule "client/3rd/qtgamepad"]
 	path = client/3rd/qtgamepad
 	url = https://github.com/amnezia-vpn/qtgamepad.git

CMakeLists.txt

@@ -4,7 +4,7 @@ set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.9.0.4)
+set(AMNEZIAVPN_VERSION 4.9.0.2)
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
 set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
@@ -28,7 +28,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")
 
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2133)
+set(APP_ANDROID_VERSION_CODE 2123)
 
 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
     set(MZ_PLATFORM_NAME "linux")

README_RU.md

@@ -28,7 +28,7 @@
 
 - Простой в использовании — введите IP-адрес, SSH-логин и пароль, и Amnezia автоматически установит VPN-контейнеры Docker на ваш сервер и подключится к VPN.
 - Классические VPN-протоколы: OpenVPN, WireGuard и IKEv2.
-- Протоколы с маскировкой трафика (обфускацией): OpenVPN с плагином [Cloak](https://github.com/cbeuw/Cloak), Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) и XRay.
+- Протоколы с маскировкой трафика (обфускацией): OpenVPN с плагином [Cloak](https://github.com/cbeuw/Cloak), Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) and XRay.
 - Поддержка Split Tunneling — добавляйте любые сайты или приложения в список, чтобы включить VPN только для них.
 - Поддерживает платформы: Windows, macOS, Linux, Android, iOS.
 - Поддержка конфигурации протокола AmneziaWG на [бета-прошивке Keenetic](https://docs.keenetic.com/ua/air/kn-1611/en/6319-latest-development-release.html#UUID-186c4108-5afd-c10b-f38a-cdff6c17fab3_section-idm33192196168192-improved).

client/CMakeLists.txt

@@ -103,7 +103,6 @@ include(${CMAKE_CURRENT_LIST_DIR}/cmake/sources.cmake)
 include_directories(
     ${CMAKE_CURRENT_LIST_DIR}/../ipc
     ${CMAKE_CURRENT_LIST_DIR}/../common/logger
-    ${CMAKE_CURRENT_LIST_DIR}/../common/crypto
     ${CMAKE_CURRENT_LIST_DIR}
     ${CMAKE_CURRENT_BINARY_DIR}
 )
@@ -258,10 +257,6 @@ install(SCRIPT ${QT_DEPLOY_SCRIPT}
 
 if (APPLE AND NOT IOS AND NOT MACOS_NE)
     list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/macos/update-resolv-conf.sh")
-    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED "NO"
-        XCODE_ATTRIBUTE_CODE_SIGNING_REQUIRED "NO"
-    )
 endif()
 if (LINUX AND NOT ANDROID)
     list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/linux/update-resolv-conf.sh")

client/amneziaApplication.cpp

@@ -22,7 +22,6 @@
 #include "logger.h"
 #include "ui/controllers/qml/pageController.h"
 #include "ui/models/installedAppsModel.h"
-#include "ui/utils/mtProxyPublicHostInput.h"
 #include "version.h"
 
 #include "platforms/ios/QRCodeReaderBase.h"
@@ -222,9 +221,6 @@ void AmneziaApplication::registerTypes()
 
     qmlRegisterType<InstalledAppsModel>("InstalledAppsModel", 1, 0, "InstalledAppsModel");
 
-    qmlRegisterType<PublicHostInputValidator>("MtProxyConfig", 1, 0, "PublicHostInputValidator");
-    qmlRegisterType<PublicHostInputValidator>("TelemtConfig", 1, 0, "PublicHostInputValidator");
-
     amnezia::declareQmlProtocolEnum();
     Vpn::declareQmlVpnConnectionStateEnum();
     PageLoader::declareQmlPageEnum();

client/android/src/org/amnezia/vpn/AmneziaActivity.kt

@@ -42,7 +42,6 @@ import androidx.core.view.OnApplyWindowInsetsListener
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.WindowInsetsControllerCompat
-import java.io.File
 import java.io.IOException
 import kotlin.LazyThreadSafetyMode.NONE
 import kotlin.coroutines.CoroutineContext
@@ -764,13 +763,7 @@ class AmneziaActivity : QtActivity() {
     fun openFile(filter: String?) {
         Log.v(TAG, "Open file with filter: $filter")
         mainScope.launch {
-            val systemPickerPackage = listOf("com.google.android.documentsui", "com.android.documentsui")
-                .firstOrNull { pkg ->
-                    try { packageManager.getPackageInfo(pkg, 0); true }
-                    catch (_: PackageManager.NameNotFoundException) { false }
-                }
-
-            val intent = if (!isOnTv() && systemPickerPackage != null) {
+            val intent = if (!isOnTv()) {
                 val mimeTypes = if (!filter.isNullOrEmpty()) {
                     val extensionRegex = "\\*\\.([a-z0-9]+)".toRegex(IGNORE_CASE)
                     val mime = MimeTypeMap.getSingleton()
@@ -796,7 +789,6 @@ class AmneziaActivity : QtActivity() {
                             else -> type = "*/*"
                         }
                     }
-                    `package` = systemPickerPackage
                 }
             } else {
                 Intent(this@AmneziaActivity, TvFilePicker::class.java)
@@ -808,11 +800,8 @@ class AmneziaActivity : QtActivity() {
                         if (isOnTv() && it?.hasExtra("activityNotFound") == true) {
                             showNoFileBrowserAlertDialog()
                         }
-                        val uri = it?.data?.let { u ->
-                            if (u.scheme == "content") {
-                                try { grantUriPermission(packageName, u, Intent.FLAG_GRANT_READ_URI_PERMISSION) } catch (_: Exception) {}
-                            }
-                            u
+                        val uri = it?.data?.apply {
+                            grantUriPermission(packageName, this, Intent.FLAG_GRANT_READ_URI_PERMISSION)
                         }?.toString() ?: ""
                         Log.v(TAG, "Open file: $uri")
                         if (uri.isNotEmpty()) {
@@ -852,12 +841,7 @@ class AmneziaActivity : QtActivity() {
         Log.v(TAG, "Get fd for $fileName")
         return blockingCall(Dispatchers.IO) {
             try {
-                val uri = Uri.parse(fileName)
-                pfd = if (uri.scheme == "file") {
-                    ParcelFileDescriptor.open(File(uri.path!!), ParcelFileDescriptor.MODE_READ_ONLY)
-                } else {
-                    contentResolver.openFileDescriptor(uri, "r")
-                }
+                pfd = contentResolver.openFileDescriptor(Uri.parse(fileName), "r")
                 pfd?.fd ?: -1
             } catch (e: Exception) {
                 Log.e(TAG, "Failed to get fd: $e")
@@ -1077,10 +1061,12 @@ class AmneziaActivity : QtActivity() {
     @Suppress("unused")
     fun sendTouch(x: Float, y: Float) {
         Log.v(TAG, "Send touch: $x, $y")
-        findQtWindow(window.decorView)?.let {
-            Log.v(TAG, "Send touch to $it")
-            it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_DOWN))
-            it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_UP))
+        blockingCall {
+            findQtWindow(window.decorView)?.let {
+                Log.v(TAG, "Send touch to $it")
+                it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_DOWN))
+                it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_UP))
+            }
         }
     }
 

client/android/src/org/amnezia/vpn/TvFilePicker.kt

@@ -1,36 +1,30 @@
 package org.amnezia.vpn
 
-import android.Manifest
-import android.app.AlertDialog
 import android.content.ActivityNotFoundException
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.net.Uri
 import android.os.Build
 import android.os.Bundle
-import android.os.Environment
 import androidx.activity.ComponentActivity
 import androidx.activity.result.contract.ActivityResultContracts
 import org.amnezia.vpn.util.Log
-import java.io.File
 
 private const val TAG = "TvFilePicker"
-private const val READ_STORAGE_REQUEST_CODE = 1001
 
 class TvFilePicker : ComponentActivity() {
 
-    // SAF launcher for Android 10+ where File API is blocked by scoped storage
-    private val safLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
+    private val fileChooseResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
         override fun createIntent(context: Context, input: Array<String>): Intent {
             val intent = super.createIntent(context, input)
-            val activities = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
                 context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
             } else {
                 @Suppress("DEPRECATION")
                 context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
             }
-            if (activities.all {
+            if (activitiesToResolveIntent.all {
                     val name = it.activityInfo.packageName
                     name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
                 }) {
@@ -38,140 +32,38 @@ class TvFilePicker : ComponentActivity() {
             }
             return intent
         }
-    }) { uri ->
+    }) {
         setResult(RESULT_OK, Intent().apply {
-            data = uri
+            data = it
             addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
         })
         finish()
     }
 
-    private val directoryStack = ArrayDeque<File>()
-
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         Log.v(TAG, "onCreate")
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            launchSaf()
-        } else {
-            checkPermissionAndBrowse()
-        }
+        getFile()
     }
 
-    @Deprecated("Deprecated in Java")
-    override fun onBackPressed() {
-        navigateBack()
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        Log.v(TAG, "onNewIntent")
+        getFile()
     }
 
-    private fun launchSaf() {
+    private fun getFile() {
         try {
-            safLauncher.launch(arrayOf("*/*"))
+            Log.v(TAG, "getFile")
+            fileChooseResultLauncher.launch(arrayOf("*/*"))
         } catch (_: ActivityNotFoundException) {
-            Log.w(TAG, "No SAF activity found")
+            Log.w(TAG, "Activity not found")
             setResult(RESULT_CANCELED, Intent().apply { putExtra("activityNotFound", true) })
             finish()
         } catch (e: Exception) {
-            Log.e(TAG, "SAF launch failed: $e")
+            Log.e(TAG, "Failed to get file: $e")
             setResult(RESULT_CANCELED)
             finish()
         }
     }
-
-    private fun checkPermissionAndBrowse() {
-        if (checkSelfPermission(Manifest.permission.READ_EXTERNAL_STORAGE) != PackageManager.PERMISSION_GRANTED) {
-            requestPermissions(arrayOf(Manifest.permission.READ_EXTERNAL_STORAGE), READ_STORAGE_REQUEST_CODE)
-        } else {
-            showRootDirectory()
-        }
-    }
-
-    override fun onRequestPermissionsResult(requestCode: Int, permissions: Array<String>, grantResults: IntArray) {
-        super.onRequestPermissionsResult(requestCode, permissions, grantResults)
-        if (requestCode == READ_STORAGE_REQUEST_CODE &&
-            grantResults.firstOrNull() == PackageManager.PERMISSION_GRANTED) {
-            showRootDirectory()
-        } else {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-    }
-
-    private fun showRootDirectory() {
-        @Suppress("DEPRECATION")
-        val primaryExternal = Environment.getExternalStorageDirectory()
-        val storageDir = File("/storage")
-        // Pre-seed stack with /storage so Back from primary storage goes there (USB drives etc.)
-        if (storageDir.exists() && storageDir.canonicalPath != primaryExternal.canonicalPath) {
-            directoryStack.addLast(storageDir)
-        }
-        showDirectory(primaryExternal)
-    }
-
-    private fun navigateBack() {
-        if (directoryStack.size > 1) {
-            directoryStack.removeLast()
-            val parent = directoryStack.removeLast()
-            showDirectory(parent)
-        } else {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-    }
-
-    private fun showDirectory(dir: File) {
-        directoryStack.addLast(dir)
-        Log.v(TAG, "Showing directory: ${dir.absolutePath}")
-
-        val entries = try {
-            dir.listFiles()
-                ?.sortedWith(compareBy({ !it.isDirectory }, { it.name.lowercase() }))
-                ?: emptyList()
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to list directory: $e")
-            emptyList()
-        }
-
-        val names = entries.map { if (it.isDirectory) "[${it.name}]" else it.name }.toTypedArray()
-
-        val builder = AlertDialog.Builder(this)
-            .setTitle(dir.absolutePath)
-
-        if (entries.isEmpty()) {
-            builder.setMessage("No files available")
-        } else {
-            builder.setItems(names) { dialog, which ->
-                dialog.dismiss()
-                val selected = entries[which]
-                if (selected.isDirectory) {
-                    showDirectory(selected)
-                } else {
-                    Log.v(TAG, "Selected file: ${selected.absolutePath}")
-                    setResult(RESULT_OK, Intent().apply {
-                        data = Uri.fromFile(selected)
-                        addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-                    })
-                    finish()
-                }
-            }
-        }
-
-        if (directoryStack.size > 1) {
-            builder.setNegativeButton("↑ Back") { dialog, _ ->
-                dialog.dismiss()
-                navigateBack()
-            }
-        } else {
-            builder.setNegativeButton(android.R.string.cancel) { _, _ ->
-                setResult(RESULT_CANCELED)
-                finish()
-            }
-        }
-
-        builder.setOnCancelListener {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-
-        builder.show()
-    }
 }

client/cmake/3rdparty.cmake

@@ -2,8 +2,9 @@ set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
 
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/Modules;${CMAKE_MODULE_PATH}")
 
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel ${CMAKE_BINARY_DIR}/3rd/SortFilterProxyModel)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel)
 set(LIBS ${LIBS} SortFilterProxyModel)
+include(${CLIENT_ROOT_DIR}/cmake/QSimpleCrypto.cmake)
 
 include(${CLIENT_ROOT_DIR}/3rd/qrcodegen/qrcodegen.cmake)
 
@@ -11,24 +12,20 @@ add_compile_definitions(_WINSOCKAPI_)
 
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain ${CMAKE_BINARY_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
 
 if(ANDROID)
     # Use qtgamepad from amnezia-vpn/qtgamepad repository
     # Only if Qt6CorePrivate is available (required by qtgamepad)
     find_package(Qt6CorePrivate CONFIG QUIET)
     if(Qt6CorePrivate_FOUND)
-        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad ${CMAKE_BINARY_DIR}/3rd/qtgamepad)
+        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
         # Link both the C++ module and QML plugin
-        if(TARGET ${PROJECT})
+        if(TARGET GamepadLegacy)
             target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
-        else()
-            list(APPEND LIBS GamepadLegacy)
         endif()
-        if(TARGET ${PROJECT})
+        if(TARGET GamepadLegacyQuickPrivate)
             target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
-        else()
-            list(APPEND LIBS GamepadLegacyQuickPrivate)
         endif()
         message(STATUS "Gamepad support enabled for Android")
     else()
@@ -39,6 +36,7 @@ endif()
 set(LIBS ${LIBS} qt6keychain)
 
 include_directories(
+    ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src/include
     ${CLIENT_ROOT_DIR}/3rd/qtkeychain/qtkeychain
     ${CMAKE_CURRENT_BINARY_DIR}/3rd/qtkeychain
 )

client/cmake/QSimpleCrypto.cmake

@@ -0,0 +1,21 @@
+set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
+set(QSIMPLECRYPTO_DIR ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src)
+
+include_directories(${QSIMPLECRYPTO_DIR})
+
+set(HEADERS ${HEADERS}
+    ${QSIMPLECRYPTO_DIR}/include/QAead.h
+    ${QSIMPLECRYPTO_DIR}/include/QBlockCipher.h
+    ${QSIMPLECRYPTO_DIR}/include/QRsa.h
+    ${QSIMPLECRYPTO_DIR}/include/QSimpleCrypto_global.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509Store.h
+)
+
+set(SOURCES ${SOURCES}
+    ${QSIMPLECRYPTO_DIR}/sources/QAead.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QBlockCipher.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QRsa.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509Store.cpp
+)

client/cmake/ios.cmake

@@ -121,11 +121,6 @@ target_sources(${PROJECT} PRIVATE
     ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )
 
-set_source_files_properties(
-    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets
-    PROPERTIES MACOSX_PACKAGE_LOCATION Resources
-)
-
 target_sources(${PROJECT} PRIVATE
     ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
     ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets

client/cmake/sources.cmake

@@ -52,16 +52,13 @@ set(HEADERS ${HEADERS}
     ${CLIENT_ROOT_DIR}/core/protocols/qmlRegisterProtocols.h
     ${CLIENT_ROOT_DIR}/ui/utils/pages.h
     ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.h
-    ${CLIENT_ROOT_DIR}/ui/utils/mtProxyPublicHostInput.h
     ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.h
     ${CMAKE_CURRENT_BINARY_DIR}/version.h
     ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.h
     ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/payloadSender.h
     ${CLIENT_ROOT_DIR}/core/utils/serialization/serialization.h
     ${CLIENT_ROOT_DIR}/core/utils/serialization/transfer.h
     ${CLIENT_ROOT_DIR}/../common/logger/logger.h
-    ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.h
     ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.h
     ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.h
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
@@ -130,11 +127,9 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.cpp
     ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.cpp
     ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/mtProxyPublicHostInput.cpp
     ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.cpp
     ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.cpp
     ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/payloadSender.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serialization/outbound.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serialization/inbound.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serialization/ss.cpp
@@ -144,7 +139,6 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess_new.cpp
     ${CLIENT_ROOT_DIR}/../common/logger/logger.cpp
-    ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.cpp
     ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.cpp
     ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serverConfigUtils.cpp

client/core/controllers/api/newsController.cpp

@@ -78,8 +78,7 @@ QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
             m_appSettingsRepository->getGatewayEndpoint(),
             m_appSettingsRepository->isDevGatewayEnv(),
             apiDefs::requestTimeoutMsecs,
-            m_appSettingsRepository->isStrictKillSwitchEnabled(),
-            m_appSettingsRepository);
+            m_appSettingsRepository->isStrictKillSwitchEnabled());
 
     QJsonObject payload;
     payload.insert("locale", m_appSettingsRepository->getAppLanguage().name().split("_").first());

client/core/controllers/api/servicesCatalogController.cpp

@@ -242,7 +242,7 @@ ErrorCode ServicesCatalogController::fillAvailableServices(QJsonObject &services
 ErrorCode ServicesCatalogController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody)
 {
     GatewayController gatewayController(m_appSettingsRepository->getGatewayEndpoint(), m_appSettingsRepository->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
-                                        m_appSettingsRepository->isStrictKillSwitchEnabled(), m_appSettingsRepository);
+                                        m_appSettingsRepository->isStrictKillSwitchEnabled());
     return gatewayController.post(endpoint, apiPayload, responseBody);
 }
 

client/core/controllers/api/subscriptionController.cpp

@@ -56,38 +56,6 @@ QString getSubscriptionStatusForRenewal(const ApiConfig &apiConfig)
 
     return QStringLiteral("active");
 }
-
-QString normalizeCaptchaSolution(const QString &captchaSolution)
-{
-    QString normalizedSolution;
-    normalizedSolution.reserve(captchaSolution.size());
-    for (const QChar &ch : captchaSolution) {
-        const ushort u = ch.unicode();
-        if (u >= '0' && u <= '9') {
-            normalizedSolution += ch;
-        } else if (u >= 0xFF10 && u <= 0xFF19) {
-            normalizedSolution += QChar(static_cast<char16_t>(u - 0xFF10 + '0'));
-        }
-    }
-    return normalizedSolution.isEmpty() ? captchaSolution.trimmed() : normalizedSolution;
-}
-
-bool fillCaptchaInfoFromResponse(const QByteArray &responseBody, SubscriptionController::CaptchaInfo &captchaInfo)
-{
-    const QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
-    if (!jsonDoc.isObject()) {
-        return false;
-    }
-    const QJsonObject jsonObj = jsonDoc.object();
-    if (!jsonObj.contains(QStringLiteral("captcha_id")) || !jsonObj.contains(QStringLiteral("captcha_image"))) {
-        return false;
-    }
-    captchaInfo.captchaId = jsonObj.value(QStringLiteral("captcha_id")).toString();
-    captchaInfo.captchaImageBase64 = jsonObj.value(QStringLiteral("captcha_image")).toString();
-    captchaInfo.hint = jsonObj.value(QStringLiteral("hint")).toString();
-    captchaInfo.isRequired = true;
-    return true;
-}
 }
 
 
@@ -230,6 +198,9 @@ void SubscriptionController::updateApiConfigInJson(QJsonObject &serverConfigJson
     
     if (serverConfigJson.value(configKey::configVersion).toInt() == serverConfigUtils::ConfigSource::AmneziaGateway) {
         QJsonObject responseObj = QJsonDocument::fromJson(apiResponseBody).object();
+        if (responseObj.contains(apiDefs::key::supportedProtocols)) {
+            apiConfig.insert(apiDefs::key::supportedProtocols, responseObj.value(apiDefs::key::supportedProtocols).toArray());
+        }
         if (responseObj.contains(apiDefs::key::serviceInfo)) {
             apiConfig.insert(apiDefs::key::serviceInfo, responseObj.value(apiDefs::key::serviceInfo).toObject());
         }
@@ -241,7 +212,7 @@ void SubscriptionController::updateApiConfigInJson(QJsonObject &serverConfigJson
 ErrorCode SubscriptionController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody, bool isTestPurchase)
 {
     GatewayController gatewayController(m_appSettingsRepository->getGatewayEndpoint(isTestPurchase), m_appSettingsRepository->isDevGatewayEnv(isTestPurchase), apiDefs::requestTimeoutMsecs,
-                                        m_appSettingsRepository->isStrictKillSwitchEnabled(), m_appSettingsRepository);
+                                        m_appSettingsRepository->isStrictKillSwitchEnabled());
     return gatewayController.post(endpoint, apiPayload, responseBody);
 }
 
@@ -266,7 +237,14 @@ ErrorCode SubscriptionController::importServiceFromGateway(const QString &userCo
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);
 
     if (errorCode == ErrorCode::ApiCaptchaRequiredError) {
-        fillCaptchaInfoFromResponse(responseBody, captchaInfo);
+        QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
+        if (jsonDoc.isObject()) {
+            QJsonObject jsonObj = jsonDoc.object();
+            captchaInfo.captchaId = jsonObj.value("captcha_id").toString();
+            captchaInfo.captchaImageBase64 = jsonObj.value("captcha_image").toString();
+            captchaInfo.hint = jsonObj.value("hint").toString();
+            captchaInfo.isRequired = true;
+        }
         return errorCode;
     }
 
@@ -432,8 +410,7 @@ ErrorCode SubscriptionController::importServiceFromAppStore(const QString &userC
     return ErrorCode::NoError;
 }
 
-ErrorCode SubscriptionController::updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent,
-                                                           CaptchaInfo *captchaInfoOut, ProtocolData *usedProtocolDataOut)
+ErrorCode SubscriptionController::updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent)
 {
     auto apiV2 = m_serversRepository->apiV2Config(serverId);
     if (!apiV2.has_value()) {
@@ -441,25 +418,8 @@ ErrorCode SubscriptionController::updateServiceFromGateway(const QString &server
     }
     const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     QString serviceProtocol = apiV2->serviceProtocol();
-
-    if (!newCountryCode.isEmpty()) {
-        const auto availableCountries = apiV2->apiConfig.availableCountries;
-        for (const auto &country : availableCountries) {
-            const auto countryObject = country.toObject();
-            if (countryObject.value(apiDefs::key::serverCountryCode).toString() != newCountryCode) {
-                continue;
-            }
-
-            const auto availableProtocols = countryObject.value(apiDefs::key::availableProtocols).toArray();
-            if (!availableProtocols.isEmpty() && !availableProtocols.contains(serviceProtocol)) {
-                serviceProtocol = availableProtocols.first().toString();
-            }
-            break;
-        }
-    }
-
     ProtocolData protocolData = generateProtocolData(serviceProtocol);
-
+    
     QJsonObject authDataJson = apiV2->authData.toJson();
     GatewayRequestData gatewayRequestData { QSysInfo::productType(),
                                             QString(APP_VERSION),
@@ -481,11 +441,6 @@ ErrorCode SubscriptionController::updateServiceFromGateway(const QString &server
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody, isTestPurchase);
     if (errorCode != ErrorCode::NoError) {
-        if (errorCode == ErrorCode::ApiCaptchaRequiredError && captchaInfoOut) {
-            if (fillCaptchaInfoFromResponse(responseBody, *captchaInfoOut) && usedProtocolDataOut) {
-                *usedProtocolDataOut = protocolData;
-            }
-        }
         if (errorCode == ErrorCode::ApiSubscriptionExpiredError && !apiV2->apiConfig.isInAppPurchase) {
             ApiV2ServerConfig expiredApiV2 = *apiV2;
             expiredApiV2.apiConfig.subscriptionExpiredByServer = true;
@@ -495,40 +450,29 @@ ErrorCode SubscriptionController::updateServiceFromGateway(const QString &server
         return errorCode;
     }
 
-    return applyUpdatedServiceConfig(serverId, serviceProtocol, protocolData, responseBody);
-}
-
-ErrorCode SubscriptionController::applyUpdatedServiceConfig(const QString &serverId, const QString &serviceProtocol,
-                                                           const ProtocolData &protocolData, const QByteArray &responseBody)
-{
-    auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    if (!apiV2.has_value()) {
-        return ErrorCode::InternalError;
-    }
-
     QJsonObject serverConfigJson;
-    ErrorCode errorCode = extractServerConfigJsonFromResponse(responseBody, serviceProtocol, protocolData, serverConfigJson);
+    errorCode = extractServerConfigJsonFromResponse(responseBody, serviceProtocol, protocolData, serverConfigJson);
     if (errorCode != ErrorCode::NoError) {
         return errorCode;
     }
-
+    
     updateApiConfigInJson(serverConfigJson, apiV2->apiConfig.serviceType, serviceProtocol, apiV2->apiConfig.userCountryCode, responseBody);
-
+    
     if (serverConfigJson.value(configKey::configVersion).toInt() != serverConfigUtils::ConfigSource::AmneziaGateway) {
         return ErrorCode::InternalError;
     }
 
     ApiV2ServerConfig newApiV2Config = ApiV2ServerConfig::fromJson(serverConfigJson);
     ApiV2ServerConfig* newApiV2 = &newApiV2Config;
-
+    
     newApiV2->apiConfig.vpnKey = apiV2->apiConfig.vpnKey;
     newApiV2->apiConfig.isTestPurchase = apiV2->apiConfig.isTestPurchase;
     newApiV2->apiConfig.isInAppPurchase = apiV2->apiConfig.isInAppPurchase;
     newApiV2->apiConfig.subscriptionExpiredByServer = false;
-
+    
     newApiV2->authData = apiV2->authData;
     newApiV2->crc = apiV2->crc;
-
+    
     if (apiV2->nameOverriddenByUser) {
         newApiV2->name = apiV2->name;
         newApiV2->displayName = apiV2->displayName;
@@ -540,59 +484,6 @@ ErrorCode SubscriptionController::applyUpdatedServiceConfig(const QString &serve
     return ErrorCode::NoError;
 }
 
-ErrorCode SubscriptionController::resolveUpdateServiceCaptcha(const QString &serverId, const QString &newCountryCode,
-                                                              bool isConnectEvent, const ProtocolData &protocolData,
-                                                              const QString &captchaId, const QString &captchaSolution,
-                                                              CaptchaInfo *retryCaptchaOut)
-{
-    auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    if (!apiV2.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
-    QString serviceProtocol = apiV2->serviceProtocol();
-
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            newCountryCode,
-                                            apiV2->serviceType(),
-                                            serviceProtocol,
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-
-    if (isConnectEvent) {
-        apiPayload[apiDefs::key::isConnectEvent] = true;
-    }
-
-    apiPayload["captcha_id"] = captchaId;
-    apiPayload["captcha_solution"] = normalizeCaptchaSolution(captchaSolution);
-
-    QByteArray responseBody;
-    ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody, isTestPurchase);
-    if (errorCode != ErrorCode::NoError) {
-        if (retryCaptchaOut
-            && (errorCode == ErrorCode::ApiCaptchaInvalidError || errorCode == ErrorCode::ApiCaptchaRefreshError
-                || errorCode == ErrorCode::ApiCaptchaRequiredError)) {
-            fillCaptchaInfoFromResponse(responseBody, *retryCaptchaOut);
-        }
-        if (errorCode == ErrorCode::ApiSubscriptionExpiredError && !apiV2->apiConfig.isInAppPurchase) {
-            ApiV2ServerConfig expiredApiV2 = *apiV2;
-            expiredApiV2.apiConfig.subscriptionExpiredByServer = true;
-            m_serversRepository->editServer(serverId, expiredApiV2.toJson(),
-                                           serverConfigUtils::configTypeFromJson(expiredApiV2.toJson()));
-        }
-        return errorCode;
-    }
-
-    return applyUpdatedServiceConfig(serverId, serviceProtocol, protocolData, responseBody);
-}
-
 ErrorCode SubscriptionController::deactivateDevice(const QString &serverId)
 {
     auto apiV2 = m_serversRepository->apiV2Config(serverId);
@@ -757,20 +648,19 @@ ErrorCode SubscriptionController::prepareVpnKeyExport(const QString &serverId, Q
     return ErrorCode::NoError;
 }
 
-ErrorCode SubscriptionController::validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers,
-                                                         CaptchaInfo *captchaInfoOut, ProtocolData *usedProtocolDataOut)
+ErrorCode SubscriptionController::validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers)
 {
     if (!m_serversRepository->apiV2Config(serverId).has_value()) {
         return ErrorCode::NoError;
     }
 
     if (!hasInstalledContainers) {
-        return updateServiceFromGateway(serverId, "", true, captchaInfoOut, usedProtocolDataOut);
+        return updateServiceFromGateway(serverId, "", true);
     }
 
     if (isApiKeyExpired(serverId)) {
         qDebug() << "attempt to update api config by expires_at event";
-        return updateServiceFromGateway(serverId, "", true, captchaInfoOut, usedProtocolDataOut);
+        return updateServiceFromGateway(serverId, "", true);
     }
 
     return ErrorCode::NoError;
@@ -862,36 +752,6 @@ bool SubscriptionController::isVlessProtocol(const QString &serverId) const
     return apiV2.has_value() && apiV2->serviceProtocol() == "vless";
 }
 
-QString SubscriptionController::currentProtocol(const QString &serverId) const
-{
-    auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    return apiV2.has_value() ? apiV2->serviceProtocol() : QString();
-}
-
-QStringList SubscriptionController::availableProtocols(const QString &serverId) const
-{
-    auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    if (!apiV2.has_value()) {
-        return {};
-    }
-
-    const auto currentCountryCode = apiV2->apiConfig.serverCountryCode;
-    const auto availableCountries = apiV2->apiConfig.availableCountries;
-
-    QStringList protocols;
-    for (const auto &country : availableCountries) {
-        const auto countryObject = country.toObject();
-        if (countryObject.value(apiDefs::key::serverCountryCode).toString() != currentCountryCode) {
-            continue;
-        }
-        for (const auto &protocol : countryObject.value(apiDefs::key::availableProtocols).toArray()) {
-            protocols.push_back(protocol.toString());
-        }
-        break;
-    }
-    return protocols;
-}
-
 ErrorCode SubscriptionController::processAppStorePurchase(const QString &userCountryCode, const QString &serviceType,
                                                           const QString &serviceProtocol, const QString &productId,
                                                           int *duplicateServerIndex)
@@ -1089,8 +949,7 @@ QFuture<QPair<ErrorCode, QString>> SubscriptionController::getRenewalLink(const
     auto gatewayController = QSharedPointer<GatewayController>::create(m_appSettingsRepository->getGatewayEndpoint(isTestPurchase),
                                                                        m_appSettingsRepository->isDevGatewayEnv(isTestPurchase),
                                                                        apiDefs::requestTimeoutMsecs,
-                                                                       m_appSettingsRepository->isStrictKillSwitchEnabled(),
-                                                                       m_appSettingsRepository);
+                                                                       m_appSettingsRepository->isStrictKillSwitchEnabled());
     auto postFuture = gatewayController->postAsync(QString("%1v1/renewal_link"), apiPayload);
     auto *watcher = new QFutureWatcher<QPair<ErrorCode, QByteArray>>();
     QObject::connect(watcher, &QFutureWatcher<QPair<ErrorCode, QByteArray>>::finished,
@@ -1134,7 +993,17 @@ ErrorCode SubscriptionController::resolveImportServiceCaptcha(const QString &use
     appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
 
     apiPayload["captcha_id"] = captchaId;
-    apiPayload["captcha_solution"] = normalizeCaptchaSolution(captchaSolution);
+    QString normalizedSolution;
+    normalizedSolution.reserve(captchaSolution.size());
+    for (const QChar &ch : captchaSolution) {
+        const ushort u = ch.unicode();
+        if (u >= '0' && u <= '9') {
+            normalizedSolution += ch;
+        } else if (u >= 0xFF10 && u <= 0xFF19) {
+            normalizedSolution += QChar(static_cast<char16_t>(u - 0xFF10 + '0'));
+        }
+    }
+    apiPayload["captcha_solution"] = normalizedSolution.isEmpty() ? captchaSolution.trimmed() : normalizedSolution;
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);
@@ -1142,7 +1011,16 @@ ErrorCode SubscriptionController::resolveImportServiceCaptcha(const QString &use
         if (retryCaptchaOut
             && (errorCode == ErrorCode::ApiCaptchaInvalidError || errorCode == ErrorCode::ApiCaptchaRefreshError
                 || errorCode == ErrorCode::ApiCaptchaRequiredError)) {
-            fillCaptchaInfoFromResponse(responseBody, *retryCaptchaOut);
+            const QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
+            if (jsonDoc.isObject()) {
+                const QJsonObject jsonObj = jsonDoc.object();
+                if (jsonObj.contains(QStringLiteral("captcha_id")) && jsonObj.contains(QStringLiteral("captcha_image"))) {
+                    retryCaptchaOut->captchaId = jsonObj.value(QStringLiteral("captcha_id")).toString();
+                    retryCaptchaOut->captchaImageBase64 = jsonObj.value(QStringLiteral("captcha_image")).toString();
+                    retryCaptchaOut->hint = jsonObj.value(QStringLiteral("hint")).toString();
+                    retryCaptchaOut->isRequired = true;
+                }
+            }
         }
         return errorCode;
     }

client/core/controllers/api/subscriptionController.h

@@ -66,12 +66,7 @@ public:
                                         const QString &transactionId, bool isTestPurchase,
                                         int *duplicateServerIndex = nullptr);
 
-    ErrorCode updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent,
-                                       CaptchaInfo *captchaInfoOut = nullptr, ProtocolData *usedProtocolDataOut = nullptr);
-
-    ErrorCode resolveUpdateServiceCaptcha(const QString &serverId, const QString &newCountryCode, bool isConnectEvent,
-                                          const ProtocolData &protocolData, const QString &captchaId,
-                                          const QString &captchaSolution, CaptchaInfo *retryCaptchaOut = nullptr);
+    ErrorCode updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent);
 
     ErrorCode deactivateDevice(const QString &serverId);
 
@@ -83,8 +78,7 @@ public:
 
     ErrorCode prepareVpnKeyExport(const QString &serverId, QString &vpnKey);
 
-    ErrorCode validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers,
-                                      CaptchaInfo *captchaInfoOut = nullptr, ProtocolData *usedProtocolDataOut = nullptr);
+    ErrorCode validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers);
 
     void removeApiConfig(const QString &serverId);
 
@@ -92,8 +86,6 @@ public:
 
     void setCurrentProtocol(const QString &serverId, const QString &protocolName);
     bool isVlessProtocol(const QString &serverId) const;
-    QString currentProtocol(const QString &serverId) const;
-    QStringList availableProtocols(const QString &serverId) const;
 
     ErrorCode getAccountInfo(const QString &serverId, QJsonObject &accountInfo);
     QFuture<QPair<ErrorCode, QString>> getRenewalLink(const QString &serverId);
@@ -123,10 +115,8 @@ private:
     ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody, bool isTestPurchase = false);
     bool isApiKeyExpired(const QString &serverId) const;
     
-    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol,
+    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol, 
                                                    const ProtocolData &protocolData, QJsonObject &serverConfigJson);
-    ErrorCode applyUpdatedServiceConfig(const QString &serverId, const QString &serviceProtocol,
-                                        const ProtocolData &protocolData, const QByteArray &responseBody);
     void updateApiConfigInJson(QJsonObject &serverConfigJson, const QString &serviceType, 
                                 const QString &serviceProtocol, const QString &userCountryCode,
                                 const QByteArray &apiResponseBody);

client/core/controllers/connectionController.cpp

@@ -6,7 +6,6 @@
 #include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
-#include "core/utils/payloadSender.h"
 #include "core/utils/utilities.h"
 #include "core/utils/serverConfigUtils.h"
 #include "version.h"
@@ -219,11 +218,6 @@ ErrorCode ConnectionController::openConnection(const QString &serverId)
         return errorCode;
     }
 
-    const auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    if (apiV2.has_value() && !apiV2->sendPayload.isEmpty()) {
-        PayloadSender::sendAll(apiV2->sendPayload);
-    }
-
     emit openConnectionRequested(serverId, container, vpnConfiguration);
     return ErrorCode::NoError;
 }

client/core/controllers/coreController.cpp

@@ -22,8 +22,7 @@
 #endif
 
 CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                               QQmlApplicationEngine *engine, QObject *parent,
-                               bool skipPlatformControllerInit)
+                               QQmlApplicationEngine *engine, QObject *parent)
     : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings), m_engine(engine)
 {
     initRepositories();
@@ -32,10 +31,8 @@ CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnectio
     initControllers();
     initSignalHandlers();
 
-    if (!skipPlatformControllerInit) {
-        initAndroidController();
-        initAppleController();
-    }
+    initAndroidController();
+    initAppleController();
     initLogging();
 
     m_translator = new QTranslator(this);

client/core/controllers/coreController.h

@@ -90,8 +90,7 @@ class CoreController : public QObject
 
 public:
     explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                            QQmlApplicationEngine *engine, QObject *parent = nullptr,
-                            bool skipPlatformControllerInit = false);
+                            QQmlApplicationEngine *engine, QObject *parent = nullptr);
 
     PageController* pageController() const;
     void setQmlRoot();
@@ -115,7 +114,7 @@ protected:
     AppSplitTunnelingModel* appSplitTunnelingModelProtected() const { return m_appSplitTunnelingModel; }
     IpSplitTunnelingModel* ipSplitTunnelingModelProtected() const { return m_ipSplitTunnelingModel; }
     LanguageModel* languageModelProtected() const { return m_languageModel; }
-    ConnectionUiController* connectionUiControllerProtected() const { return m_connectionUiController; }
+
     InstallUiController* installUiControllerProtected() const { return m_installUiController; }
     ImportController* importCoreControllerProtected() const { return m_importCoreController; }
     ExportController* exportControllerProtected() const { return m_exportController; }

client/core/controllers/coreSignalHandlers.cpp

@@ -205,8 +205,10 @@ void CoreSignalHandlers::initAdminConfigRevokedHandler()
 {
     connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
             [this](const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
-            }, Qt::DirectConnection);
+                QtConcurrent::run([this, serverId, containerConfig, container]() {
+                    m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
+                });
+            });
 
     connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
             [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {

client/core/controllers/gatewayController.cpp

@@ -12,14 +12,14 @@
 #include <QPromise>
 #include <QUrl>
 
-#include <openssl/rsa.h>
+#include "QBlockCipher.h"
+#include "QRsa.h"
 
 #include "amneziaApplication.h"
-#include "core/repositories/secureAppSettingsRepository.h"
 #include "core/utils/api/apiUtils.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/networkUtilities.h"
-#include "cryptoUtils.h"
+#include "core/utils/utilities.h"
 
 #ifdef AMNEZIA_DESKTOP
     #include "core/utils/ipcClient.h"
@@ -45,75 +45,15 @@ namespace
     constexpr QLatin1String unprocessableSubscriptionMessage("Failed to retrieve subscription information. Is it activated?");
 
     constexpr int proxyStorageRequestTimeoutMsecs = 3000;
-
-    QStringList shuffledProxyUrls(const QStringList &proxyUrls)
-    {
-        QStringList shuffled = proxyUrls;
-        std::random_device randomDevice;
-        std::mt19937 generator(randomDevice());
-        std::shuffle(shuffled.begin(), shuffled.end(), generator);
-        return shuffled;
-    }
-
-    QString getProxyUrlsCacheKey(const QString &serviceType, const QString &userCountryCode)
-    {
-        return QStringLiteral("service_%1_country_%2").arg(serviceType, userCountryCode);
-    }
-
-    bool decryptProxyUrlsPayload(const QByteArray &encryptedPayload, bool isDevEnvironment, QByteArray &decryptedPayload)
-    {
-        QByteArray key = isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-        if (!isDevEnvironment) {
-            QCryptographicHash hash(QCryptographicHash::Sha512);
-            hash.addData(key);
-            QByteArray h = hash.result().toHex();
-
-            QByteArray decKey = QByteArray::fromHex(h.left(64));
-            QByteArray iv = QByteArray::fromHex(h.mid(64, 32));
-            QByteArray ba = QByteArray::fromBase64(encryptedPayload);
-
-            decryptedPayload = CryptoUtils::decryptAes256Cbc(ba, decKey, iv);
-            if (decryptedPayload.isEmpty()) {
-                return false;
-            }
-        } else {
-            decryptedPayload = encryptedPayload;
-        }
-        return true;
-    }
-
-    QStringList readCachedProxyUrls(const QByteArray &cachedProxyUrlsEncrypted, bool isDevEnvironment)
-    {
-        if (cachedProxyUrlsEncrypted.isEmpty()) {
-            return {};
-        }
-
-        QByteArray cachedProxyUrlsDecrypted;
-        if (!decryptProxyUrlsPayload(cachedProxyUrlsEncrypted, isDevEnvironment, cachedProxyUrlsDecrypted)) {
-            qCritical() << "error decrypting cached proxy urls payload";
-            return {};
-        }
-
-        QJsonArray endpointsArray = QJsonDocument::fromJson(cachedProxyUrlsDecrypted).array();
-        QStringList endpoints;
-        endpoints.reserve(endpointsArray.size());
-        for (const QJsonValue &endpoint : endpointsArray) {
-            endpoints.push_back(endpoint.toString());
-        }
-
-        return endpoints;
-    }
 }
 
 GatewayController::GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                                     const bool isStrictKillSwitchEnabled, SecureAppSettingsRepository *appSettingsRepository,
-                                     QObject *parent)
+                                     const bool isStrictKillSwitchEnabled, QObject *parent)
     : QObject(parent),
       m_gatewayEndpoint(gatewayEndpoint),
       m_isDevEnvironment(isDevEnvironment),
       m_requestTimeoutMsecs(requestTimeoutMsecs),
-      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled),
-      m_appSettingsRepository(appSettingsRepository)
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
 {
 }
 
@@ -147,29 +87,40 @@ GatewayController::EncryptedRequestData GatewayController::prepareRequest(const
     }
 #endif
 
-    encRequestData.key = CryptoUtils::generateRandomBytes(32);
-    encRequestData.iv = CryptoUtils::generateRandomBytes(32);
-    encRequestData.salt = CryptoUtils::generateRandomBytes(8);
+    QSimpleCrypto::QBlockCipher blockCipher;
+    encRequestData.key = blockCipher.generatePrivateSalt(32);
+    encRequestData.iv = blockCipher.generatePrivateSalt(32);
+    encRequestData.salt = blockCipher.generatePrivateSalt(8);
 
     QJsonObject keyPayload;
     keyPayload[apiDefs::key::aesKey] = QString(encRequestData.key.toBase64());
     keyPayload[apiDefs::key::aesIv] = QString(encRequestData.iv.toBase64());
     keyPayload[apiDefs::key::aesSalt] = QString(encRequestData.salt.toBase64());
 
-    QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-    EVP_PKEY *publicKey = CryptoUtils::loadPublicKeyFromPem(rsaKey);
-    if (publicKey == nullptr) {
-        qCritical() << "error loading public key from environment variables";
-        encRequestData.errorCode = ErrorCode::ApiMissingAgwPublicKey;
-        return encRequestData;
-    }
+    QByteArray encryptedKeyPayload;
+    QByteArray encryptedApiPayload;
+    try {
+        QSimpleCrypto::QRsa rsa;
 
-    QByteArray encryptedKeyPayload = CryptoUtils::rsaEncrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
-    EVP_PKEY_free(publicKey);
+        EVP_PKEY *publicKey = nullptr;
+        try {
+            QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+            QSimpleCrypto::QRsa rsa;
+            publicKey = rsa.getPublicKeyFromByteArray(rsaKey);
+        } catch (...) {
+            Utils::logException();
+            qCritical() << "error loading public key from environment variables";
+            encRequestData.errorCode = ErrorCode::ApiMissingAgwPublicKey;
+            return encRequestData;
+        }
 
-    QByteArray encryptedApiPayload = CryptoUtils::encryptAes256Cbc(QJsonDocument(apiPayload).toJson(), encRequestData.key, encRequestData.iv);
+        encryptedKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
+        EVP_PKEY_free(publicKey);
 
-    if (encryptedKeyPayload.isEmpty() || encryptedApiPayload.isEmpty()) {
+        encryptedApiPayload = blockCipher.encryptAesBlockCipher(QJsonDocument(apiPayload).toJson(), encRequestData.key, encRequestData.iv,
+                                                                "", encRequestData.salt);
+    } catch (...) {
+        Utils::logException();
         qCritical() << "error when encrypting the request body";
         encRequestData.errorCode = ErrorCode::ApiConfigDecryptionError;
         return encRequestData;
@@ -191,11 +142,11 @@ GatewayController::DecryptionResult GatewayController::tryDecryptResponseBody(co
     result.decryptedBody = encryptedResponseBody;
     result.isDecryptionSuccessful = false;
 
-    QByteArray decrypted = CryptoUtils::decryptAes256Cbc(encryptedResponseBody, key, iv);
-    if (!decrypted.isEmpty()) {
-        result.decryptedBody = decrypted;
+    try {
+        QSimpleCrypto::QBlockCipher blockCipher;
+        result.decryptedBody = blockCipher.decryptAesBlockCipher(encryptedResponseBody, key, iv, "", salt);
         result.isDecryptionSuccessful = true;
-    } else {
+    } catch (...) {
         result.decryptedBody = encryptedResponseBody;
         result.isDecryptionSuccessful = false;
     }
@@ -314,6 +265,7 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
             }
 
             if (!decryptionResult.isDecryptionSuccessful) {
+                Utils::logException();
                 qCritical() << "error when decrypting the request body";
                 promise->addResult(qMakePair(ErrorCode::ApiConfigDecryptionError, QByteArray()));
                 promise->finish();
@@ -356,9 +308,8 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
             QStringList proxyStorageUrls;
             appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
             appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
-            const QString proxyUrlsCacheKey = getProxyUrlsCacheKey(serviceType, userCountryCode);
 
-            getProxyUrlsAsync(proxyStorageUrls, 0, proxyUrlsCacheKey, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
+            getProxyUrlsAsync(proxyStorageUrls, 0, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
                 getProxyUrlAsync(proxyUrls, 0, [this, encRequestData, endpoint, processResponse](const QString &proxyUrl) {
                     bypassProxyAsync(endpoint, proxyUrl, encRequestData,
                                      [processResponse, this](const QByteArray &decryptedBody, bool isDecryptionSuccessful,
@@ -404,6 +355,8 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
     std::shuffle(primaryBaseUrls.begin(), primaryBaseUrls.end(), generator);
     std::shuffle(fallbackBaseUrls.begin(), fallbackBaseUrls.end(), generator);
 
+    QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+
     auto appendStorageUrls = [&serviceType, &userCountryCode](const QStringList &baseUrls, QStringList &target) {
         if (!serviceType.isEmpty()) {
             for (const auto &baseUrl : baseUrls) {
@@ -419,12 +372,10 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
     QStringList proxyStorageUrls;
     appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
     appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
-    const QString proxyUrlsCacheKey = getProxyUrlsCacheKey(serviceType, userCountryCode);
-    const QByteArray cachedProxyUrlsEncrypted = m_appSettingsRepository->readGatewayProxyUrls(proxyUrlsCacheKey);
 
     if (proxyStorageUrls.empty()) {
         qDebug() << "empty storage endpoint list";
-        return readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment);
+        return {};
     }
 
     for (const auto &proxyStorageUrl : proxyStorageUrls) {
@@ -439,8 +390,26 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
             auto encryptedResponseBody = reply->readAll();
             reply->deleteLater();
 
+            EVP_PKEY *privateKey = nullptr;
             QByteArray responseBody;
-            if (!decryptProxyUrlsPayload(encryptedResponseBody, m_isDevEnvironment, responseBody)) {
+            try {
+                if (!m_isDevEnvironment) {
+                    QCryptographicHash hash(QCryptographicHash::Sha512);
+                    hash.addData(key);
+                    QByteArray hashResult = hash.result().toHex();
+
+                    QByteArray key = QByteArray::fromHex(hashResult.left(64));
+                    QByteArray iv = QByteArray::fromHex(hashResult.mid(64, 32));
+
+                    QByteArray ba = QByteArray::fromBase64(encryptedResponseBody);
+
+                    QSimpleCrypto::QBlockCipher blockCipher;
+                    responseBody = blockCipher.decryptAesBlockCipher(ba, key, iv);
+                } else {
+                    responseBody = encryptedResponseBody;
+                }
+            } catch (...) {
+                Utils::logException();
                 qCritical() << "error loading private key from environment variables or decrypting payload" << encryptedResponseBody;
                 continue;
             }
@@ -451,8 +420,6 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
             for (const auto &endpoint : endpointsArray) {
                 endpoints.push_back(endpoint.toString());
             }
-            m_appSettingsRepository->writeGatewayProxyUrls(proxyUrlsCacheKey, encryptedResponseBody);
-
             return endpoints;
         } else {
             auto replyError = reply->error();
@@ -464,7 +431,7 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
             reply->deleteLater();
         }
     }
-    return readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment);
+    return {};
 }
 
 bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody,
@@ -606,12 +573,10 @@ void GatewayController::bypassProxy(const QString &endpoint, const QString &serv
 }
 
 void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                                          const QString &proxyUrlsCacheKey, std::function<void(const QStringList &)> onComplete)
+                                          std::function<void(const QStringList &)> onComplete)
 {
-    const QByteArray cachedProxyUrlsEncrypted = m_appSettingsRepository->readGatewayProxyUrls(proxyUrlsCacheKey);
-
     if (currentProxyStorageIndex >= proxyStorageUrls.size()) {
-        onComplete(shuffledProxyUrls(readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment)));
+        onComplete({});
         return;
     }
 
@@ -624,17 +589,33 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co
 
     // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) { *(state->sslErrors) = e; });
 
-    connect(reply, &QNetworkReply::finished, this,
-            [this, proxyStorageUrls, currentProxyStorageIndex, proxyUrlsCacheKey, onComplete, reply]() {
+    connect(reply, &QNetworkReply::finished, this, [this, proxyStorageUrls, currentProxyStorageIndex, onComplete, reply]() {
         if (reply->error() == QNetworkReply::NoError) {
             QByteArray encrypted = reply->readAll();
             reply->deleteLater();
 
             QByteArray responseBody;
-            if (!decryptProxyUrlsPayload(encrypted, m_isDevEnvironment, responseBody)) {
+            try {
+                QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+                if (!m_isDevEnvironment) {
+                    QCryptographicHash hash(QCryptographicHash::Sha512);
+                    hash.addData(key);
+                    QByteArray h = hash.result().toHex();
+
+                    QByteArray decKey = QByteArray::fromHex(h.left(64));
+                    QByteArray iv = QByteArray::fromHex(h.mid(64, 32));
+                    QByteArray ba = QByteArray::fromBase64(encrypted);
+
+                    QSimpleCrypto::QBlockCipher cipher;
+                    responseBody = cipher.decryptAesBlockCipher(ba, decKey, iv);
+                } else {
+                    responseBody = encrypted;
+                }
+            } catch (...) {
+                Utils::logException();
                 qCritical() << "error decrypting payload";
                 QMetaObject::invokeMethod(
-                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, proxyUrlsCacheKey, onComplete); }, Qt::QueuedConnection);
+                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
                 return;
             }
 
@@ -642,9 +623,13 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co
             QStringList endpoints;
             for (const QJsonValue &endpoint : endpointsArray)
                 endpoints.push_back(endpoint.toString());
-            m_appSettingsRepository->writeGatewayProxyUrls(proxyUrlsCacheKey, encrypted);
 
-            onComplete(shuffledProxyUrls(endpoints));
+            QStringList shuffled = endpoints;
+            std::random_device randomDevice;
+            std::mt19937 generator(randomDevice());
+            std::shuffle(shuffled.begin(), shuffled.end(), generator);
+
+            onComplete(shuffled);
             return;
         }
 
@@ -653,7 +638,7 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co
         qDebug() << "go to the next storage endpoint";
         reply->deleteLater();
         QMetaObject::invokeMethod(
-                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, proxyUrlsCacheKey, onComplete); }, Qt::QueuedConnection);
+                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
     });
 }
 

client/core/controllers/gatewayController.h

@@ -16,16 +16,13 @@
     #include "platforms/ios/ios_controller.h"
 #endif
 
-class SecureAppSettingsRepository;
-
 class GatewayController : public QObject
 {
     Q_OBJECT
 
 public:
     explicit GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                               const bool isStrictKillSwitchEnabled, SecureAppSettingsRepository *appSettingsRepository,
-                               QObject *parent = nullptr);
+                               const bool isStrictKillSwitchEnabled, QObject *parent = nullptr);
 
     amnezia::ErrorCode post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody);
     QFuture<QPair<amnezia::ErrorCode, QByteArray>> postAsync(const QString &endpoint, const QJsonObject apiPayload);
@@ -58,7 +55,7 @@ private:
                      std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction);
 
     void getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                           const QString &proxyUrlsCacheKey, std::function<void(const QStringList &)> onComplete);
+                           std::function<void(const QStringList &)> onComplete);
     void getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex, std::function<void(const QString &)> onComplete);
     void bypassProxyAsync(
             const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
@@ -68,7 +65,6 @@ private:
     QString m_gatewayEndpoint;
     bool m_isDevEnvironment = false;
     bool m_isStrictKillSwitchEnabled = false;
-    SecureAppSettingsRepository *m_appSettingsRepository = nullptr;
 
     inline static QString m_proxyUrl;
 };

client/core/controllers/selfhosted/installController.cpp

@@ -2,7 +2,6 @@
 
 #include "core/models/protocolConfig.h"
 
-#include <QCoreApplication>
 #include <QDebug>
 #include <QEventLoop>
 #include <QFutureWatcher>
@@ -21,6 +20,7 @@
 #include "core/installers/sftpInstaller.h"
 #include "core/installers/socks5Installer.h"
 #include "core/installers/mtProxyInstaller.h"
+#include "core/configurators/xrayConfigurator.h"
 #include "core/installers/telemtInstaller.h"
 #include "core/installers/torInstaller.h"
 #include "core/installers/wireguardInstaller.h"
@@ -103,7 +103,7 @@ ErrorCode InstallController::setupContainer(const ServerCredentials &credentials
                                             bool isUpdate)
 {
     qDebug().noquote() << "InstallController::setupContainer" << ContainerUtils::containerToString(container);
-    SshSession sshSession;
+    SshSession sshSession(this);
     ErrorCode e = ErrorCode::NoError;
 
     e = isUserInSudo(credentials, sshSession);
@@ -168,11 +168,11 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         }
         if (container == DockerContainer::MtProxy) {
             ServerCredentials credentials = adminConfig->credentials();
-            SshSession sshSession;
+            SshSession sshSession(this);
             MtProxyInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         } else if (container == DockerContainer::Telemt) {
             ServerCredentials credentials = adminConfig->credentials();
-            SshSession sshSession;
+            SshSession sshSession(this);
             TelemtInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         }
         adminConfig->updateContainerConfig(container, newConfig);
@@ -188,11 +188,21 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
 
     bool reinstallRequired = isReinstallContainerRequired(container, oldConfig, newConfig);
     qDebug() << "InstallController::updateServerConfig for container" << container << "reinstall required is" << reinstallRequired;
 
+    bool xrayServerSettingsChanged = false;
+    if (container == DockerContainer::Xray || container == DockerContainer::SSXray) {
+        const auto *oldXrayConfig = oldConfig.getXrayProtocolConfig();
+        const auto *newXrayConfig = newConfig.getXrayProtocolConfig();
+        if (oldXrayConfig && newXrayConfig) {
+            xrayServerSettingsChanged =
+                    !oldXrayConfig->serverConfig.hasEqualServerSettings(newXrayConfig->serverConfig);
+        }
+    }
+
     ErrorCode errorCode = ErrorCode::NoError;
     if (reinstallRequired) {
         errorCode = setupContainer(credentials, container, newConfig, true);
@@ -201,11 +211,20 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         if (errorCode == ErrorCode::NoError) {
             errorCode = startupContainerWorker(credentials, container, newConfig, sshSession);
         }
+    }
 
-        if (errorCode == ErrorCode::NoError
-            && (container == DockerContainer::MtProxy || container == DockerContainer::Telemt)) {
-            const QString containerName = ContainerUtils::containerToString(container);
-            errorCode = sshSession.runScript(credentials, "sudo docker restart " + containerName);
+    const bool skipXrayInboundSync =
+            newConfig.getXrayProtocolConfig() && newConfig.getXrayProtocolConfig()->serverConfig.isThirdPartyConfig;
+
+    if (errorCode == ErrorCode::NoError && xrayServerSettingsChanged && !skipXrayInboundSync) {
+        DnsSettings dnsSettings = { m_appSettingsRepository->primaryDns(), m_appSettingsRepository->secondaryDns() };
+        XrayConfigurator xrayConfigurator(&sshSession);
+        qDebug() << "InstallController::updateServerConfig applying Xray server inbound sync, reinstall="
+                 << reinstallRequired;
+        errorCode = xrayConfigurator.applyServerSettingsToRemote(credentials, container, newConfig, dnsSettings, false);
+        if (errorCode != ErrorCode::NoError) {
+            qDebug() << "InstallController::updateServerConfig Xray inbound sync failed, error="
+                     << static_cast<int>(errorCode);
         }
     }
 
@@ -697,7 +716,13 @@ bool InstallController::isReinstallContainerRequired(DockerContainer container,
         const auto *newXrayConfig = newConfig.getXrayProtocolConfig();
 
         if (oldXrayConfig && newXrayConfig) {
-            if (!oldXrayConfig->serverConfig.hasEqualServerSettings(newXrayConfig->serverConfig)) {
+            const QString oldPort = oldXrayConfig->serverConfig.port.isEmpty()
+                    ? QString(protocols::xray::defaultPort)
+                    : oldXrayConfig->serverConfig.port;
+            const QString newPort = newXrayConfig->serverConfig.port.isEmpty()
+                    ? QString(protocols::xray::defaultPort)
+                    : newXrayConfig->serverConfig.port;
+            if (oldPort != newPort) {
                 return true;
             }
         }
@@ -714,6 +739,18 @@ bool InstallController::isReinstallContainerRequired(DockerContainer container,
             if (oldPort != newPort) {
                 return true;
             }
+            const QString oldTransport = oldMt->transportMode.isEmpty() ? QString(
+                    protocols::mtProxy::transportModeStandard)
+                                                                        : oldMt->transportMode;
+            const QString newTransport = newMt->transportMode.isEmpty() ? QString(
+                    protocols::mtProxy::transportModeStandard)
+                                                                        : newMt->transportMode;
+            if (oldTransport != newTransport) {
+                return true;
+            }
+            if (oldMt->tlsDomain != newMt->tlsDomain) {
+                return true;
+            }
         }
     }
 
@@ -728,6 +765,39 @@ bool InstallController::isReinstallContainerRequired(DockerContainer container,
             if (oldPort != newPort) {
                 return true;
             }
+            const QString oldTransport = oldT->transportMode.isEmpty()
+                    ? QString(protocols::telemt::transportModeStandard)
+                    : oldT->transportMode;
+            const QString newTransport = newT->transportMode.isEmpty()
+                    ? QString(protocols::telemt::transportModeStandard)
+                    : newT->transportMode;
+            if (oldTransport != newTransport) {
+                return true;
+            }
+            if (oldT->tlsDomain != newT->tlsDomain) {
+                return true;
+            }
+            if (oldT->maskEnabled != newT->maskEnabled) {
+                return true;
+            }
+            if (oldT->tlsEmulation != newT->tlsEmulation) {
+                return true;
+            }
+            if (oldT->useMiddleProxy != newT->useMiddleProxy) {
+                return true;
+            }
+            if (oldT->tag != newT->tag) {
+                return true;
+            }
+            const QString oldUser = oldT->userName.isEmpty()
+                    ? QString::fromUtf8(protocols::telemt::defaultUserName)
+                    : oldT->userName;
+            const QString newUser = newT->userName.isEmpty()
+                    ? QString::fromUtf8(protocols::telemt::defaultUserName)
+                    : newT->userName;
+            if (oldUser != newUser) {
+                return true;
+            }
         }
     }
 
@@ -767,20 +837,6 @@ ErrorCode InstallController::installDockerWorker(const ServerCredentials &creden
 
     qDebug().noquote() << "InstallController::installDockerWorker" << stdOut;
 
-    if (container == DockerContainer::MtProxy || container == DockerContainer::Telemt) {
-        QString conntrackOut;
-        auto cbConntrack = [&](const QString &data, libssh::Client &) {
-            conntrackOut += data + "\n";
-            return ErrorCode::NoError;
-        };
-        sshSession.runScript(
-                credentials,
-                sshSession.replaceVars(amnezia::scriptData(SharedScriptType::install_conntrack),
-                                       amnezia::genBaseVars(credentials, DockerContainer::None, QString(), QString())),
-                cbConntrack, cbConntrack);
-        qDebug().noquote() << "InstallController::installDockerWorker install_conntrack:" << conntrackOut;
-    }
-
     if (container == DockerContainer::Awg2) {
         QRegularExpression kernelVersionRegex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
         QRegularExpressionMatch match = kernelVersionRegex.match(stdOut);
@@ -927,7 +983,7 @@ ErrorCode InstallController::rebootServer(const QString &serverId)
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
 
     QString script = QString("sudo reboot");
 
@@ -955,7 +1011,7 @@ ErrorCode InstallController::removeAllContainers(const QString &serverId)
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
     ErrorCode errorCode = sshSession.runScript(credentials, amnezia::scriptData(SharedScriptType::remove_all_containers));
 
     if (errorCode == ErrorCode::NoError) {
@@ -977,7 +1033,7 @@ ErrorCode InstallController::removeContainer(const QString &serverId, DockerCont
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
     const amnezia::ScriptVars removeContainerVars =
             amnezia::genBaseVars(credentials, container, QString(), QString());
     const bool removeDataVolume = (container == DockerContainer::MtProxy || container == DockerContainer::Telemt);
@@ -1086,7 +1142,7 @@ ErrorCode InstallController::scanServerForInstalledContainers(const QString &ser
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
 
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
@@ -1129,7 +1185,7 @@ ErrorCode InstallController::scanServerForInstalledContainers(const QString &ser
 ErrorCode InstallController::installServer(const ServerCredentials &credentials, DockerContainer container, int port,
                                            TransportProto transportProto, bool &wasContainerInstalled)
 {
-    SshSession sshSession;
+    SshSession sshSession(this);
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
     if (errorCode) {
@@ -1198,7 +1254,7 @@ ErrorCode InstallController::installContainer(const QString &serverId, DockerCon
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
     
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
@@ -1240,7 +1296,7 @@ ErrorCode InstallController::installContainer(const QString &serverId, DockerCon
 ErrorCode InstallController::checkSshConnection(ServerCredentials &credentials, QString &output,
                                                 std::function<QString()> passphraseCallback)
 {
-    SshSession sshSession;
+    SshSession sshSession(this);
     ErrorCode errorCode = ErrorCode::NoError;
 
     if (credentials.secretData.contains("BEGIN") && credentials.secretData.contains("PRIVATE KEY")) {
@@ -1521,7 +1577,7 @@ ErrorCode InstallController::setDockerContainerEnabledState(const QString &serve
         return ErrorCode::InternalError;
     }
     const QString containerName = ContainerUtils::containerToString(container);
-    SshSession sshSession;
+    SshSession sshSession(this);
     const QString script = enabled ? QStringLiteral("sudo docker start %1").arg(containerName)
                                    : QStringLiteral("sudo docker stop %1").arg(containerName);
     const ErrorCode runError = sshSession.runScript(credentials, script);
@@ -1561,7 +1617,7 @@ ErrorCode InstallController::queryDockerContainerStatus(const QString &serverId,
         stdOut += data;
         return ErrorCode::NoError;
     };
-    SshSession sshSession;
+    SshSession sshSession(this);
     const QString script = QStringLiteral(
             "sudo docker inspect --format '{{.State.Status}}' %1 2>/dev/null || echo 'not_found'")
             .arg(containerName);
@@ -1595,7 +1651,7 @@ ErrorCode InstallController::queryMtProxyDiagnostics(const QString &serverId, Do
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession;
+    SshSession sshSession(this);
     return MtProxyInstaller::queryDiagnostics(sshSession, credentials, container, listenPort, out);
 }
 
@@ -1618,7 +1674,7 @@ QString InstallController::fetchDockerContainerSecret(const QString &serverId, D
         stdOut += data;
         return ErrorCode::NoError;
     };
-    SshSession sshSession;
+    SshSession sshSession(this);
     const QString path = QStringLiteral("/data/secret");
     const QString cmd = QStringLiteral("sudo docker exec %1 cat %2").arg(containerName, path);
     const ErrorCode errorCode = sshSession.runScript(credentials, cmd, cbReadStdOut);

client/core/controllers/updateController.cpp

@@ -95,8 +95,7 @@ void UpdateController::fetchGatewayUrl()
     auto gatewayController = QSharedPointer<GatewayController>::create(m_appSettingsRepository->getGatewayEndpoint(),
                                                                        m_appSettingsRepository->isDevGatewayEnv(),
                                                                        7000,
-                                                                       m_appSettingsRepository->isStrictKillSwitchEnabled(),
-                                                                       m_appSettingsRepository);
+                                                                       m_appSettingsRepository->isStrictKillSwitchEnabled());
 
     QJsonObject apiPayload;
     apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);

client/core/installers/mtProxyInstaller.cpp

@@ -71,62 +71,48 @@ ErrorCode MtProxyInstaller::queryDiagnostics(SshSession &sshSession, const Serve
                                              DockerContainer container, int listenPort,
                                              MtProxyContainerDiagnostics &out)
 {
-    out = { };
-    if (container == DockerContainer::MtProxy || container == DockerContainer::Telemt) {
-        const QString containerName = ContainerUtils::containerToString(container);
-        const bool isTelemt = container == DockerContainer::Telemt;
-
-        const QString sportFilter = QString::number(listenPort);
-        const QString peersCmd = QStringLiteral("sudo conntrack -L -p tcp --dport ") + sportFilter
-                + QStringLiteral(" 2>/dev/null | grep ESTABLISHED | awk '{for(i=1;i<=NF;i++) if($i ~ /^src=/){print "
-                                 "substr($i,5); break}}'");
-        const QString publicFilter = QStringLiteral(" | grep -vE "
-                                                    "'^(10\\.|127\\.|169\\.254\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3["
-                                                    "01])\\.|::1$|fe80:|f[cd][0-9a-f][0-9a-f]:)'");
-        const QString clientsCmd =
-                QStringLiteral("CLIENTS=$(") + peersCmd + publicFilter + QStringLiteral(" | sort -u | grep -c .); ");
-        const QString confFile =
-                isTelemt ? QStringLiteral("/data/config.toml") : QStringLiteral("/data/proxy-multi.conf");
-        const QString statsUrl = QString();
-
-        const QString script = QStringLiteral("CN=") + containerName + QStringLiteral("; ")
-                + QStringLiteral("PORT_OK=$(sudo ss -tlnp 2>/dev/null | grep -q :") + QString::number(listenPort)
-                + QStringLiteral(" && echo yes || echo no); ")
-                + QStringLiteral("TG_OK=$(curl -s --max-time 5 -o /dev/null -w '%{http_code}' "
-                                 "https://core.telegram.org/getProxySecret 2>/dev/null | grep -q '200' && echo yes || "
-                                 "echo no); ")
-                + clientsCmd + QStringLiteral("CONF_TIME=$(sudo docker exec \"$CN\" sh -c 'stat -c \"%y\" ") + confFile
-                + QStringLiteral(" 2>/dev/null | cut -d. -f1' 2>/dev/null || echo unknown); ")
-                + QStringLiteral("echo \"PORT_OK=${PORT_OK}\"; ") + QStringLiteral("echo \"TG_OK=${TG_OK}\"; ")
-                + QStringLiteral("echo \"CLIENTS=${CLIENTS:-0}\"; ") + QStringLiteral("echo \"CONF_TIME=${CONF_TIME}\"; ")
-                + QStringLiteral("echo \"STATS=") + statsUrl + QStringLiteral("\";");
-
-        QString stdOut;
-        auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
-            stdOut += data;
-            return ErrorCode::NoError;
-        };
-        const ErrorCode errorCode = sshSession.runScript(credentials, script, cbReadStdOut);
-        if (errorCode != ErrorCode::NoError) {
-            return errorCode;
-        }
-        for (const QString &line : stdOut.split('\n', Qt::SkipEmptyParts)) {
-            if (line.startsWith(QLatin1String("PORT_OK="))) {
-                out.portReachable = line.mid(8).trimmed() == QLatin1String("yes");
-            } else if (line.startsWith(QLatin1String("TG_OK="))) {
-                out.upstreamReachable = line.mid(6).trimmed() == QLatin1String("yes");
-            } else if (line.startsWith(QLatin1String("CLIENTS="))) {
-                out.clientsConnected = line.mid(8).trimmed().toInt();
-            } else if (line.startsWith(QLatin1String("CONF_TIME="))) {
-                out.lastConfigRefresh = line.mid(10).trimmed();
-            } else if (line.startsWith(QLatin1String("STATS="))) {
-                out.statsEndpoint = line.mid(6).trimmed();
-            }
-        }
-        return ErrorCode::NoError;
+    out = {};
+    if (container != DockerContainer::MtProxy && container != DockerContainer::Telemt) {
+        return ErrorCode::InternalError;
     }
+    const QString containerName = ContainerUtils::containerToString(container);
+    const QString script =
+            QStringLiteral(
+                    "PORT_OK=$(sudo docker exec %1 sh -c 'ss -tlnp 2>/dev/null | grep -q :%2 && echo yes || echo no' 2>/dev/null || echo no); "
+                    "TG_OK=$(curl -s --max-time 5 -o /dev/null -w '%%{http_code}' https://core.telegram.org/getProxySecret 2>/dev/null | grep -q '200' && echo yes || echo no); "
+                    "CLIENTS=$(sudo docker exec amnezia-mtproxy sh -c 'curl -s --max-time 3 http://localhost:2398/stats 2>/dev/null | grep -o \"total_special_connections:[0-9]*\" | cut -d: -f2' 2>/dev/null); "
+                    "CONF_TIME=$(sudo docker exec amnezia-mtproxy sh -c 'stat -c \"%%y\" /data/proxy-multi.conf 2>/dev/null | cut -d. -f1' 2>/dev/null || echo unknown); "
+                    "echo \"PORT_OK=${PORT_OK}\"; "
+                    "echo \"TG_OK=${TG_OK}\"; "
+                    "echo \"CLIENTS=${CLIENTS:-0}\"; "
+                    "echo \"CONF_TIME=${CONF_TIME}\"; "
+                    "echo \"STATS=http://localhost:2398/stats\";")
+                    .arg(containerName)
+                    .arg(listenPort);
 
-    return ErrorCode::InternalError;
+    QString stdOut;
+    auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
+        stdOut += data;
+        return ErrorCode::NoError;
+    };
+    const ErrorCode errorCode = sshSession.runScript(credentials, script, cbReadStdOut);
+    if (errorCode != ErrorCode::NoError) {
+        return errorCode;
+    }
+    for (const QString &line : stdOut.split('\n', Qt::SkipEmptyParts)) {
+        if (line.startsWith(QLatin1String("PORT_OK="))) {
+            out.portReachable = line.mid(8).trimmed() == QLatin1String("yes");
+        } else if (line.startsWith(QLatin1String("TG_OK="))) {
+            out.upstreamReachable = line.mid(6).trimmed() == QLatin1String("yes");
+        } else if (line.startsWith(QLatin1String("CLIENTS="))) {
+            out.clientsConnected = line.mid(8).trimmed().toInt();
+        } else if (line.startsWith(QLatin1String("CONF_TIME="))) {
+            out.lastConfigRefresh = line.mid(10).trimmed();
+        } else if (line.startsWith(QLatin1String("STATS="))) {
+            out.statsEndpoint = line.mid(6).trimmed();
+        }
+    }
+    return ErrorCode::NoError;
 }
 
 void MtProxyInstaller::uploadClientSettingsSnapshot(SshSession &sshSession, const ServerCredentials &credentials,

client/core/models/api/apiConfig.cpp

@@ -144,6 +144,10 @@ QJsonObject ApiConfig::toJson() const
         obj[apiDefs::key::availableCountries] = availableCountries;
     }
     
+    if (!supportedProtocols.isEmpty()) {
+        obj[apiDefs::key::supportedProtocols] = supportedProtocols;
+    }
+    
     QJsonObject serviceInfoObj = serviceInfo.toJson();
     if (!serviceInfoObj.isEmpty()) {
         obj[apiDefs::key::serviceInfo] = serviceInfoObj;
@@ -194,6 +198,7 @@ ApiConfig ApiConfig::fromJson(const QJsonObject& json)
     config.issuedConfigs = json.value(apiDefs::key::issuedConfigs).toInt(0);
     
     config.availableCountries = json.value(apiDefs::key::availableCountries).toArray();
+    config.supportedProtocols = json.value(apiDefs::key::supportedProtocols).toArray();
     
     QJsonObject serviceInfoObj = json.value(apiDefs::key::serviceInfo).toObject();
     if (!serviceInfoObj.isEmpty()) {

client/core/models/api/apiConfig.h

@@ -34,6 +34,7 @@ struct ApiConfig
     int maxDeviceCount;
     int issuedConfigs;
     QJsonArray availableCountries;
+    QJsonArray supportedProtocols;
     
     struct ServiceInfo {
         bool isAdVisible = false;

client/core/models/api/apiV2ServerConfig.cpp

@@ -121,11 +121,7 @@ QJsonObject ApiV2ServerConfig::toJson() const
     if (!dns2.isEmpty()) {
         obj[configKey::dns2] = dns2;
     }
-
-    if (!sendPayload.isEmpty()) {
-        obj[configKey::sendPayload] = sendPayload;
-    }
-
+    
     if (crc > 0) {
         obj[configKey::crc] = crc;
     }
@@ -169,7 +165,6 @@ ApiV2ServerConfig ApiV2ServerConfig::fromJson(const QJsonObject& json)
     
     config.dns1 = json.value(configKey::dns1).toString();
     config.dns2 = json.value(configKey::dns2).toString();
-    config.sendPayload = json.value(configKey::sendPayload).toArray();
     
     config.crc = json.value(configKey::crc).toInt(0);
     

client/core/models/api/apiV2ServerConfig.h

@@ -1,7 +1,6 @@
 #ifndef APIV2SERVERCONFIG_H
 #define APIV2SERVERCONFIG_H
 
-#include <QJsonArray>
 #include <QJsonObject>
 #include <QMap>
 #include <QPair>
@@ -29,7 +28,6 @@ struct ApiV2ServerConfig {
     DockerContainer defaultContainer;
     QString dns1;
     QString dns2;
-    QJsonArray sendPayload;
     
     QString name;
     bool nameOverriddenByUser = false;

client/core/models/protocols/awgProtocolConfig.cpp

@@ -196,21 +196,11 @@ QJsonObject AwgClientConfig::toJson() const
         obj[configKey::transportPacketMagicHeader] = transportPacketMagicHeader;
     }
     
-    if (!specialJunk1.isEmpty()) {
-        obj[configKey::specialJunk1] = specialJunk1;
-    }
-    if (!specialJunk2.isEmpty()) {
-        obj[configKey::specialJunk2] = specialJunk2;
-    }
-    if (!specialJunk3.isEmpty()) {
-        obj[configKey::specialJunk3] = specialJunk3;
-    }
-    if (!specialJunk4.isEmpty()) {
-        obj[configKey::specialJunk4] = specialJunk4;
-    }
-    if (!specialJunk5.isEmpty()) {
-        obj[configKey::specialJunk5] = specialJunk5;
-    }
+    obj[configKey::specialJunk1] = specialJunk1;
+    obj[configKey::specialJunk2] = specialJunk2;
+    obj[configKey::specialJunk3] = specialJunk3;
+    obj[configKey::specialJunk4] = specialJunk4;
+    obj[configKey::specialJunk5] = specialJunk5;
     
     if (isObfuscationEnabled) {
         obj[configKey::isObfuscationEnabled] = isObfuscationEnabled;

client/core/repositories/secureAppSettingsRepository.cpp

@@ -280,24 +280,6 @@ void SecureAppSettingsRepository::toggleDevGatewayEnv(bool enabled)
     setValue("Conf/devGatewayEnv", enabled);
 }
 
-QByteArray SecureAppSettingsRepository::readGatewayProxyUrls(const QString &cacheKey) const
-{
-    if (cacheKey.isEmpty()) {
-        return {};
-    }
-
-    return value(QStringLiteral("Conf/proxyUrls/") + cacheKey).toByteArray();
-}
-
-void SecureAppSettingsRepository::writeGatewayProxyUrls(const QString &cacheKey, const QByteArray &proxyUrlsEncrypted)
-{
-    if (cacheKey.isEmpty()) {
-        return;
-    }
-
-    setValue(QStringLiteral("Conf/proxyUrls/") + cacheKey, proxyUrlsEncrypted);
-}
-
 bool SecureAppSettingsRepository::isKillSwitchEnabled() const
 {
     return value("Conf/killSwitchEnabled", true).toBool();

client/core/repositories/secureAppSettingsRepository.h

@@ -59,9 +59,7 @@ public:
     void setDevGatewayEndpoint();
     bool isDevGatewayEnv(bool isTestPurchase = false) const;
     void toggleDevGatewayEnv(bool enabled);
-    QByteArray readGatewayProxyUrls(const QString &cacheKey) const;
-    void writeGatewayProxyUrls(const QString &cacheKey, const QByteArray &proxyUrlsEncrypted);
-
+    
     bool isKillSwitchEnabled() const;
     void setKillSwitchEnabled(bool enabled);
     bool isStrictKillSwitchEnabled() const;

client/core/utils/constants/apiKeys.h

@@ -18,8 +18,8 @@ namespace apiDefs
         constexpr QLatin1String stackType("stack_type");
         constexpr QLatin1String cliVersion("cli_version");
         constexpr QLatin1String cliName("cli_name");
+        constexpr QLatin1String supportedProtocols("supported_protocols");
         constexpr QLatin1String availableCountries("available_countries");
-        constexpr QLatin1String availableProtocols("available_protocols");
         constexpr QLatin1String installationUuid("installation_uuid");
         constexpr QLatin1String uuid("installation_uuid");
         constexpr QLatin1String osVersion("os_version");

client/core/utils/constants/configKeys.h

@@ -25,13 +25,6 @@ namespace amnezia
         constexpr QLatin1String config("config");
         constexpr QLatin1String configVersion("config_version");
 
-        constexpr QLatin1String sendPayload("send_payload");
-        constexpr QLatin1String sendPayloadEndpoint("endpoint");
-        constexpr QLatin1String sendPayloadTimeoutMs("timeout_ms");
-        constexpr QLatin1String sendPayloadProtocol("protocol");
-        constexpr QLatin1String sendPayloadData("payload");
-        constexpr QLatin1String sendPayloadExpectedResponse("expected_response");
-
         constexpr QLatin1String containers("containers");
         constexpr QLatin1String container("container");
         constexpr QLatin1String defaultContainer("defaultContainer");

client/core/utils/constants/protocolConstants.h

@@ -271,7 +271,6 @@ namespace amnezia
             constexpr char workersModeAuto[]       = "auto";
             constexpr char workersModeManual[]     = "manual";
             constexpr int  maxWorkers              = 32;
-            constexpr int  botTagHexLength         = 32;
         }
 
     } // namespace protocols

client/core/utils/networkUtilities.cpp

@@ -286,7 +286,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     return { resGateway, QNetworkInterface::interfaceFromIndex(resIndex) };
 #endif
 #ifdef Q_OS_LINUX
-    constexpr int BUFFER_SIZE = 100;
+    constexpr int BUFFER_SIZE = 8192;
     int     received_bytes = 0, msg_len = 0, route_attribute_len = 0;
     int     sock = -1, msgseq = 0;
     struct  nlmsghdr *nlh, *nlmsg;
@@ -294,7 +294,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     // This struct contain route attributes (route type)
     struct  rtattr *route_attribute;
     char    gateway_address[INET_ADDRSTRLEN], interface[IF_NAMESIZE];
-    char    msgbuf[BUFFER_SIZE], buffer[BUFFER_SIZE];
+    char    msgbuf[100], buffer[BUFFER_SIZE];
     char    *ptr = buffer;
     struct timeval tv;
 
@@ -339,8 +339,8 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         nlh = (struct nlmsghdr *) ptr;
 
         /* Check if the header is valid */
-        if((NLMSG_OK(nlmsg, received_bytes) == 0) ||
-            (nlmsg->nlmsg_type == NLMSG_ERROR))
+        if((NLMSG_OK(nlh, received_bytes) == 0) ||
+            (nlh->nlmsg_type == NLMSG_ERROR))
         {
             perror("Error in received packet");
             return {};
@@ -355,13 +355,15 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         }
 
         /* Break if its not a multi part message */
-        if ((nlmsg->nlmsg_flags & NLM_F_MULTI) == 0)
+        if ((nlh->nlmsg_flags & NLM_F_MULTI) == 0)
             break;
     }
-    while ((nlmsg->nlmsg_seq != msgseq) || (nlmsg->nlmsg_pid != getpid()));
+    while ((nlh->nlmsg_seq != msgseq) || (nlh->nlmsg_pid != getpid()));
 
     /* parse response */
-    for ( ; NLMSG_OK(nlh, received_bytes); nlh = NLMSG_NEXT(nlh, received_bytes))
+    int remaining = msg_len + received_bytes;
+    nlh = (struct nlmsghdr *) buffer;
+    for ( ; NLMSG_OK(nlh, remaining); nlh = NLMSG_NEXT(nlh, remaining))
     {
         /* Get the route data */
         route_entry = (struct rtmsg *) NLMSG_DATA(nlh);
@@ -370,6 +372,10 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         if (route_entry->rtm_table != RT_TABLE_MAIN)
             continue;
 
+        /* Reset per-route to avoid cross-route state pollution */
+        memset(gateway_address, 0, sizeof(gateway_address));
+        memset(interface, 0, sizeof(interface));
+
         route_attribute = (struct rtattr *) RTM_RTA(route_entry);
         route_attribute_len = RTM_PAYLOAD(nlh);
 
@@ -395,6 +401,8 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
             break;
         }
     }
+    if (!(*gateway_address) || !(*interface))
+        qDebug() << "getGatewayAndIface: no gateway found";
     close(sock);
     return { gateway_address, QNetworkInterface::interfaceFromName(interface) };
 #endif

client/core/utils/payloadSender.cpp

@@ -1,193 +0,0 @@
-#include "payloadSender.h"
-
-#include <QDebug>
-#include <QEventLoop>
-#include <QHostAddress>
-#include <QJsonObject>
-#include <QRandomGenerator>
-#include <QRegularExpression>
-#include <QTcpSocket>
-#include <QTimer>
-#include <QUdpSocket>
-
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/networkUtilities.h"
-
-using namespace amnezia;
-
-namespace
-{
-    constexpr char protoUdp[] = "udp";
-    constexpr char protoTcp[] = "tcp";
-
-    QByteArray randomBytes(int count)
-    {
-        if (count <= 0) {
-            return {};
-        }
-        QByteArray bytes(count, Qt::Uninitialized);
-        for (int i = 0; i < count; ++i) {
-            bytes[i] = static_cast<char>(QRandomGenerator::global()->bounded(256));
-        }
-        return bytes;
-    }
-
-    bool parseEndpoint(const QString &endpoint, QString &host, quint16 &port)
-    {
-        const int separatorIndex = endpoint.lastIndexOf(QLatin1Char(':'));
-        if (separatorIndex <= 0 || separatorIndex == endpoint.size() - 1) {
-            return false;
-        }
-        host = endpoint.left(separatorIndex);
-        bool ok = false;
-        const uint parsedPort = endpoint.mid(separatorIndex + 1).toUInt(&ok);
-        if (!ok || parsedPort == 0 || parsedPort > 65535) {
-            return false;
-        }
-        port = static_cast<quint16>(parsedPort);
-        return true;
-    }
-
-    enum class ExchangeResult { Sent, Matched, Mismatch, Timeout };
-
-    ExchangeResult waitForResponse(QAbstractSocket &socket, const QByteArray &expectedResponse, int timeoutMs)
-    {
-        if (expectedResponse.isEmpty()) {
-            return ExchangeResult::Sent;
-        }
-
-        QByteArray response;
-        QEventLoop loop;
-        QTimer timer;
-        timer.setSingleShot(true);
-        QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
-        QObject::connect(&socket, &QIODevice::readyRead, &loop, [&]() {
-            response.append(socket.readAll());
-            if (response.size() >= expectedResponse.size()) {
-                loop.quit();
-            }
-        });
-
-        timer.start(timeoutMs);
-        loop.exec();
-
-        if (response.isEmpty()) {
-            return ExchangeResult::Timeout;
-        }
-        return response == expectedResponse ? ExchangeResult::Matched : ExchangeResult::Mismatch;
-    }
-}
-
-QByteArray PayloadSender::buildPayload(const QString &tagString)
-{
-    QByteArray result;
-    if (tagString.isEmpty()) {
-        return result;
-    }
-
-    static const QRegularExpression tagRegExp(QStringLiteral("<([^>]*)>"));
-    QRegularExpressionMatchIterator it = tagRegExp.globalMatch(tagString);
-    while (it.hasNext()) {
-        const QRegularExpressionMatch match = it.next();
-        const QStringList parts = match.captured(1).simplified().split(QLatin1Char(' '), Qt::SkipEmptyParts);
-        if (parts.isEmpty()) {
-            continue;
-        }
-
-        const QString tag = parts.at(0).toLower();
-        if (tag == QLatin1String("b")) {
-            if (parts.size() < 2) {
-                continue;
-            }
-            QString hex = parts.at(1);
-            if (hex.startsWith(QLatin1String("0x"), Qt::CaseInsensitive)) {
-                hex = hex.mid(2);
-            }
-            result.append(QByteArray::fromHex(hex.toLatin1()));
-        } else if (tag == QLatin1String("r")) {
-            if (parts.size() < 2) {
-                continue;
-            }
-            bool ok = false;
-            const int count = parts.at(1).toInt(&ok);
-            if (ok) {
-                result.append(randomBytes(count));
-            }
-        } else {
-            qWarning() << "PayloadSender: unknown payload tag" << tag;
-        }
-    }
-
-    return result;
-}
-
-void PayloadSender::sendAll(const QJsonArray &sendPayload)
-{
-    for (int i = 0; i < sendPayload.size(); ++i) {
-        const QJsonValue value = sendPayload.at(i);
-        if (!value.isObject()) {
-            continue;
-        }
-        sendEntry(value.toObject(), i);
-    }
-}
-
-void PayloadSender::sendEntry(const QJsonObject &entry, int index)
-{
-    const QString endpoint = entry.value(configKey::sendPayloadEndpoint).toString();
-    QString host;
-    quint16 port = 0;
-    if (!parseEndpoint(endpoint, host, port)) {
-        qWarning() << "PayloadSender: skipping entry" << index << "- invalid endpoint" << endpoint;
-        return;
-    }
-
-    const QString protocol = entry.value(configKey::sendPayloadProtocol).toString().toLower();
-    const int timeoutMs = entry.value(configKey::sendPayloadTimeoutMs).toInt();
-    const QByteArray payload = buildPayload(entry.value(configKey::sendPayloadData).toString());
-    const QByteArray expectedResponse = buildPayload(entry.value(configKey::sendPayloadExpectedResponse).toString());
-
-    const QString resolvedHost = NetworkUtilities::getIPAddress(host);
-    const QHostAddress hostAddress(resolvedHost.isEmpty() ? host : resolvedHost);
-
-    QUdpSocket udpSocket;
-    QTcpSocket tcpSocket;
-    QAbstractSocket *socket = nullptr;
-    if (protocol == protoUdp) {
-        socket = &udpSocket;
-        if (udpSocket.writeDatagram(payload, hostAddress, port) < 0) {
-            qWarning() << "PayloadSender: entry" << index << "- udp write failed to" << endpoint << udpSocket.errorString();
-            return;
-        }
-    } else if (protocol == protoTcp) {
-        socket = &tcpSocket;
-        tcpSocket.connectToHost(hostAddress, port);
-        if (!tcpSocket.waitForConnected(timeoutMs)) {
-            qWarning() << "PayloadSender: entry" << index << "- tcp connect failed to" << endpoint << tcpSocket.errorString();
-            return;
-        }
-        if (tcpSocket.write(payload) != payload.size()) {
-            qWarning() << "PayloadSender: entry" << index << "- tcp write failed to" << endpoint << tcpSocket.errorString();
-            return;
-        }
-        tcpSocket.flush();
-    } else {
-        qWarning() << "PayloadSender: skipping entry" << index << "- unsupported protocol" << protocol;
-        return;
-    }
-
-    switch (waitForResponse(*socket, expectedResponse, timeoutMs)) {
-    case ExchangeResult::Sent:
-        qInfo() << "PayloadSender: entry" << index << "-" << protocol << "payload sent to" << endpoint;
-        break;
-    case ExchangeResult::Matched:
-        qInfo() << "PayloadSender: entry" << index << "-" << protocol << "expected response received from" << endpoint;
-        break;
-    case ExchangeResult::Mismatch:
-        qWarning() << "PayloadSender: entry" << index << "-" << protocol << "response mismatch from" << endpoint;
-        break;
-    case ExchangeResult::Timeout:
-        qWarning() << "PayloadSender: entry" << index << "-" << protocol << "response timeout from" << endpoint;
-        break;
-    }
-}

client/core/utils/payloadSender.h

@@ -1,18 +0,0 @@
-#ifndef PAYLOADSENDER_H
-#define PAYLOADSENDER_H
-
-#include <QByteArray>
-#include <QJsonArray>
-#include <QString>
-
-class PayloadSender
-{
-public:
-    static void sendAll(const QJsonArray &sendPayload);
-    static QByteArray buildPayload(const QString &tagString);
-
-private:
-    static void sendEntry(const QJsonObject &entry, int index);
-};
-
-#endif // PAYLOADSENDER_H

client/core/utils/selfhosted/scriptsRegistry.cpp

@@ -50,7 +50,6 @@ QString amnezia::scriptName(SharedScriptType type)
     switch (type) {
     case SharedScriptType::prepare_host: return QLatin1String("prepare_host.sh");
     case SharedScriptType::install_docker: return QLatin1String("install_docker.sh");
-    case SharedScriptType::install_conntrack: return QLatin1String("install_conntrack.sh");
     case SharedScriptType::build_container: return QLatin1String("build_container.sh");
     case SharedScriptType::remove_container: return QLatin1String("remove_container.sh");
     case SharedScriptType::remove_all_containers: return QLatin1String("remove_all_containers.sh");
@@ -367,14 +366,6 @@ amnezia::ScriptVars amnezia::genTelemtVars(const ContainerConfig &containerConfi
         vars.append({ { "$TELEMT_USE_MIDDLE_PROXY", c.useMiddleProxy ? QLatin1String("true") : QLatin1String("false") } });
         vars.append({ { "$TELEMT_MASK", c.maskEnabled ? QLatin1String("true") : QLatin1String("false") } });
         vars.append({ { "$TELEMT_TLS_EMULATION", c.tlsEmulation ? QLatin1String("true") : QLatin1String("false") } });
-
-        QStringList additionalList;
-        for (const QString &s : c.additionalSecrets) {
-            if (!s.isEmpty()) {
-                additionalList << s;
-            }
-        }
-        vars.append({ { "$TELEMT_ADDITIONAL_SECRETS", additionalList.join(QLatin1Char(',')) } });
     }
 
     return vars;

client/core/utils/selfhosted/scriptsRegistry.h

@@ -21,7 +21,6 @@ enum SharedScriptType {
     // General scripts
     prepare_host,
     install_docker,
-    install_conntrack,
     build_container,
     remove_container,
     remove_all_containers,

client/daemon/daemon.cpp

@@ -78,14 +78,6 @@ bool Daemon::activate(const InterfaceConfig& config) {
         return false;
       }
 
-      if (!dnsutils()->restoreResolvers()) {
-        return false;
-      }
-
-      if (!maybeUpdateResolvers(config)) {
-        return false;
-      }
-
       bool status = run(Switch, config);
       logger.debug() << "Connection status:" << status;
       if (status) {
@@ -142,10 +134,6 @@ bool Daemon::activate(const InterfaceConfig& config) {
     return false;
   }
 
-  if (!maybeUpdateResolvers(config)) {
-    return false;
-  }
-
   // set routing
   for (const IPAddress& ip : config.m_allowedIPAddressRanges) {
     if (!wgutils()->updateRoutePrefix(ip)) {
@@ -154,6 +142,12 @@ bool Daemon::activate(const InterfaceConfig& config) {
     }
   }
 
+#ifndef Q_OS_LINUX
+  if (!maybeUpdateResolvers(config)) {
+    return false;
+  }
+#endif
+
   bool status = run(Up, config);
   logger.debug() << "Connection status:" << status;
   if (status) {
@@ -168,15 +162,20 @@ bool Daemon::activate(const InterfaceConfig& config) {
 bool Daemon::maybeUpdateResolvers(const InterfaceConfig& config) {
   if ((config.m_hopType == InterfaceConfig::MultiHopExit) ||
       (config.m_hopType == InterfaceConfig::SingleHop)) {
+    if (!dnsutils()) {
+      logger.error() << "dnsutils is null, cannot update resolvers";
+      return false;
+    }
+
     QList<QHostAddress> resolvers;
     resolvers.append(QHostAddress(config.m_primaryDnsServer));
     if (!config.m_secondaryDnsServer.isEmpty()) {
         resolvers.append(QHostAddress(config.m_secondaryDnsServer));
     }
 
-    // If the DNS is not the Gateway, it's a user defined DNS
-    // thus, not add any other :)
-    if (config.m_primaryDnsServer == config.m_serverIpv4Gateway) {
+    // If the DNS is the Gateway, also add IPv6 gateway (only if non-empty)
+    if (config.m_primaryDnsServer == config.m_serverIpv4Gateway &&
+        !config.m_serverIpv6Gateway.isEmpty()) {
       resolvers.append(QHostAddress(config.m_serverIpv6Gateway));
     }
 
@@ -390,55 +389,55 @@ bool Daemon::parseConfig(const QJsonObject& obj, InterfaceConfig& config) {
 
   config.m_killSwitchEnabled = QVariant(obj.value("killSwitchOption").toString()).toBool();
 
-  if (const auto jc = obj.value("Jc"); !jc.isUndefined()) {
-    config.m_junkPacketCount = jc.toString();
+  if (!obj.value("Jc").isNull()) {
+    config.m_junkPacketCount = obj.value("Jc").toString();
   }
-  if (const auto jmin = obj.value("Jmin"); !jmin.isUndefined()) {
-    config.m_junkPacketMinSize = jmin.toString();
+  if (!obj.value("Jmin").isNull()) {
+    config.m_junkPacketMinSize = obj.value("Jmin").toString();
   }
-  if (const auto jmax = obj.value("Jmax"); !jmax.isUndefined()) {
-    config.m_junkPacketMaxSize = jmax.toString();
+  if (!obj.value("Jmax").isNull()) {
+    config.m_junkPacketMaxSize = obj.value("Jmax").toString();
   }
-  if (const auto s1 = obj.value("S1"); !s1.isUndefined()) {
-    config.m_initPacketJunkSize = s1.toString();
+  if (!obj.value("S1").isNull()) {
+    config.m_initPacketJunkSize = obj.value("S1").toString();
   }
-  if (const auto s2 = obj.value("S2"); !s2.isUndefined()) {
-    config.m_responsePacketJunkSize = s2.toString();
+  if (!obj.value("S2").isNull()) {
+    config.m_responsePacketJunkSize = obj.value("S2").toString();
   }
-  if (const auto s3 = obj.value("S3"); !s3.isUndefined()) {
-    config.m_cookieReplyPacketJunkSize = s3.toString();
+  if (!obj.value("S3").isNull()) {
+    config.m_cookieReplyPacketJunkSize = obj.value("S3").toString();
   }
-  if (const auto s4 = obj.value("S4"); !s4.isUndefined()) {
-    config.m_transportPacketJunkSize = s4.toString();
+  if (!obj.value("S4").isNull()) {
+    config.m_transportPacketJunkSize = obj.value("S4").toString();
   }
 
-  if (const auto h1 = obj.value("H1"); !h1.isUndefined()) {
-    config.m_initPacketMagicHeader = h1.toString();
+  if (!obj.value("H1").isNull()) {
+    config.m_initPacketMagicHeader = obj.value("H1").toString();
   }
-  if (const auto h2 = obj.value("H2"); !h2.isUndefined()) {
-    config.m_responsePacketMagicHeader = h2.toString();
+  if (!obj.value("H2").isNull()) {
+    config.m_responsePacketMagicHeader = obj.value("H2").toString();
   }
-  if (const auto h3 = obj.value("H3"); !h3.isUndefined()) {
-    config.m_underloadPacketMagicHeader = h3.toString();
+  if (!obj.value("H3").isNull()) {
+    config.m_underloadPacketMagicHeader = obj.value("H3").toString();
   }
-  if (const auto h4 = obj.value("H4"); !h4.isUndefined()) {
-    config.m_transportPacketMagicHeader = h4.toString();
+  if (!obj.value("H4").isNull()) {
+    config.m_transportPacketMagicHeader = obj.value("H4").toString();
   }
 
-  if (const auto i1 = obj.value("I1"); !i1.isUndefined()) {
-    config.m_specialJunk["I1"] = i1.toString();
+  if (!obj.value("I1").isNull()) {
+    config.m_specialJunk["I1"] = obj.value("I1").toString();
   }
-  if (const auto i2 = obj.value("I2"); !i2.isUndefined()) {
-    config.m_specialJunk["I2"] = i2.toString();
+  if (!obj.value("I2").isNull()) {
+    config.m_specialJunk["I2"] = obj.value("I2").toString();
   }
-  if (const auto i3 = obj.value("I3"); !i3.isUndefined()) {
-    config.m_specialJunk["I3"] = i3.toString();
+  if (!obj.value("I3").isNull()) {
+    config.m_specialJunk["I3"] = obj.value("I3").toString();
   }
-  if (const auto i4 = obj.value("I4"); !i4.isUndefined()) {
-    config.m_specialJunk["I4"] = i4.toString();
+  if (!obj.value("I4").isNull()) {
+    config.m_specialJunk["I4"] = obj.value("I4").toString();
   }
-  if (const auto i5 = obj.value("I5"); !i5.isUndefined()) {
-    config.m_specialJunk["I5"] = i5.toString();
+  if (!obj.value("I5").isNull()) {
+    config.m_specialJunk["I5"] = obj.value("I5").toString();
   }
 
   return true;
@@ -613,7 +612,7 @@ void Daemon::checkHandshake() {
       pendingHandshakes++;
     }
   }
-
+  
   // Check again if there were connections that haven't completed a handshake.
   if (pendingHandshakes > 0) {
     m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);

client/images/controls/arrow-left-right.svg

@@ -1,6 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M17 11L21 7L17 3" stroke="#D7D8DB" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-<path d="M21 7H9" stroke="#D7D8DB" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-<path d="M7 21L3 17L7 13" stroke="#D7D8DB" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-<path d="M15 17H3" stroke="#D7D8DB" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>

client/images/images.qrc

@@ -10,7 +10,6 @@
         <file>controls/app.svg</file>
         <file>controls/archive-restore.svg</file>
         <file>controls/arrow-left.svg</file>
-        <file>controls/arrow-left-right.svg</file>
         <file>controls/arrow-right.svg</file>
         <file>controls/bug.svg</file>
         <file>controls/check.svg</file>

client/ios/app/Info.plist.in

@@ -82,32 +82,10 @@
 		<key>NSAllowsLocalNetworking</key>
 		<true/>
 	</dict>
-	<key>CFBundleIconName</key>
-	<string>AppIcon</string>
 	<key>CFBundleIcons</key>
-	<dict>
-		<key>CFBundlePrimaryIcon</key>
-		<dict>
-			<key>CFBundleIconFiles</key>
-			<array>
-				<string>AppIcon</string>
-			</array>
-			<key>CFBundleIconName</key>
-			<string>AppIcon</string>
-		</dict>
-	</dict>
-	<key>CFBundleIcons~ipad</key>
-	<dict>
-		<key>CFBundlePrimaryIcon</key>
-		<dict>
-			<key>CFBundleIconFiles</key>
-			<array>
-				<string>AppIcon</string>
-			</array>
-			<key>CFBundleIconName</key>
-			<string>AppIcon</string>
-		</dict>
-	</dict>
+        <dict/>
+        <key>CFBundleIcons~ipad</key>
+        <dict/>
 	<key>UTImportedTypeDeclarations</key>
 	<array>
 		<dict>

client/platforms/linux/daemon/dnsutilslinux.cpp

@@ -7,10 +7,14 @@
 #include <net/if.h>
 
 #include <QDBusVariant>
+#include <QNetworkInterface>
+#include <QTimer>
 #include <QtDBus/QtDBus>
 
+#include "core/utils/networkUtilities.h"
 #include "leakdetector.h"
 #include "logger.h"
+#include "router_linux.h"
 
 constexpr const char* DBUS_RESOLVE_SERVICE = "org.freedesktop.resolve1";
 constexpr const char* DBUS_RESOLVE_PATH = "/org/freedesktop/resolve1";
@@ -27,24 +31,78 @@ DnsUtilsLinux::DnsUtilsLinux(QObject* parent) : DnsUtils(parent) {
   logger.debug() << "DnsUtilsLinux created.";
 
   QDBusConnection conn = QDBusConnection::systemBus();
-  m_resolver = new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
-                                  DBUS_RESOLVE_MANAGER, conn, this);
+  auto* watcher = new QDBusServiceWatcher(
+      DBUS_RESOLVE_SERVICE, conn,
+      QDBusServiceWatcher::WatchForRegistration |
+      QDBusServiceWatcher::WatchForUnregistration, this);
+
+  connect(watcher, &QDBusServiceWatcher::serviceRegistered,
+          this, &DnsUtilsLinux::onResolverRegistered);
+  connect(watcher, &QDBusServiceWatcher::serviceUnregistered,
+          this, &DnsUtilsLinux::onResolverUnregistered);
+
+  if (conn.interface()->isServiceRegistered(DBUS_RESOLVE_SERVICE)) {
+    onResolverRegistered();
+  }
+}
+
+void DnsUtilsLinux::onResolverRegistered() {
+  m_resolver.reset(new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
+                                      DBUS_RESOLVE_MANAGER,
+                                      QDBusConnection::systemBus()));
+  logger.debug() << "systemd-resolved available, DNS resolver initialized";
+
+  if (m_revertAfterRegister > 0) {
+    logger.debug() << "Calling RevertLink after restart for ifindex" << m_revertAfterRegister;
+    QDBusMessage msg = QDBusMessage::createMethodCall(
+        DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "RevertLink");
+    msg.setArguments({QVariant::fromValue(m_revertAfterRegister)});
+    QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
+    int savedIdx = m_revertAfterRegister;
+    m_revertAfterRegister = 0;
+    QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
+    QObject::connect(watcher, &QDBusPendingCallWatcher::finished, this,
+                     [this, savedIdx](QDBusPendingCallWatcher* w) {
+                       QDBusPendingReply<> r = *w;
+                       if (r.isError()) {
+                         logger.debug() << "RevertLink after restart failed for ifindex" << savedIdx
+                                        << ":" << r.error().message();
+                       } else {
+                         logger.debug() << "RevertLink after restart succeeded for ifindex" << savedIdx;
+                       }
+                       w->deleteLater();
+                     });
+  }
+
+  if (!m_pendingIfname.isEmpty()) {
+    logger.debug() << "Re-applying DNS configuration for" << m_pendingIfname;
+    updateResolvers(m_pendingIfname, m_pendingResolvers);
+  }
+}
+
+void DnsUtilsLinux::onResolverUnregistered() {
+  logger.debug() << "systemd-resolved disappeared, dropping DNS resolver";
+  m_resolver.reset();
 }
 
 DnsUtilsLinux::~DnsUtilsLinux() {
   MZ_COUNT_DTOR(DnsUtilsLinux);
 
-  for (auto iterator = m_linkDomains.constBegin();
-       iterator != m_linkDomains.constEnd(); ++iterator) {
-    QList<QVariant> argumentList;
-    argumentList << QVariant::fromValue(iterator.key());
-    argumentList << QVariant::fromValue(iterator.value());
-    m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
-                                          argumentList);
-  }
+  if (m_revertOnDestroy && m_resolver) {
+    if (m_gatewayIfindex > 0)
+      setLinkDefaultRoute(m_gatewayIfindex, true);
 
-  if (m_ifindex > 0) {
-    m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
+    for (auto iterator = m_linkDomains.constBegin();
+         iterator != m_linkDomains.constEnd(); ++iterator) {
+      QList<QVariant> argumentList;
+      argumentList << QVariant::fromValue(iterator.key());
+      argumentList << QVariant::fromValue(iterator.value());
+      m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
+                                            argumentList);
+    }
+    if (m_ifindex > 0) {
+      m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
+    }
   }
 
   logger.debug() << "DnsUtilsLinux destroyed.";
@@ -52,51 +110,100 @@ DnsUtilsLinux::~DnsUtilsLinux() {
 
 bool DnsUtilsLinux::updateResolvers(const QString& ifname,
                                     const QList<QHostAddress>& resolvers) {
+  m_revertAfterRegister = 0;
+
+  if (m_gatewayIfindex > 0) {
+    setLinkDefaultRoute(m_gatewayIfindex, true);
+    m_gatewayIfindex = 0;
+  }
+
+  const int previousIfindex = m_ifindex;
   m_ifindex = if_nametoindex(qPrintable(ifname));
   if (m_ifindex <= 0) {
     logger.error() << "Unable to resolve ifindex for" << ifname;
     return false;
   }
 
+  // Reset retry counter only when called externally (not from scheduleRetry)
+  if (ifname != m_pendingIfname || resolvers != m_pendingResolvers)
+    m_domainRetries = 0;
+
+  m_pendingIfname = ifname;
+  m_pendingResolvers = resolvers;
+
+  if (!m_resolver) {
+    logger.debug() << "systemd-resolved not ready, queuing DNS configuration";
+    return true;
+  }
+
+  const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
+  if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
+    m_gatewayIfindex = gwIdx;
+    setLinkDefaultRoute(gwIdx, false);
+  }
+
   setLinkDNS(m_ifindex, resolvers);
   setLinkDefaultRoute(m_ifindex, true);
   updateLinkDomains();
+
+  if (previousIfindex > 0 && previousIfindex != m_ifindex) {
+    m_resolver->callWithArgumentList(QDBus::Block, QStringLiteral("RevertLink"),
+                                     {QVariant::fromValue(previousIfindex)});
+  }
   return true;
 }
 
 bool DnsUtilsLinux::restoreResolvers() {
+  m_revertOnDestroy = true;
+  m_pendingIfname.clear();
+  m_pendingResolvers.clear();
+
+  if (m_gatewayIfindex > 0) {
+    setLinkDefaultRoute(m_gatewayIfindex, true);
+    m_gatewayIfindex = 0;
+  }
+
   for (auto iterator = m_linkDomains.constBegin();
        iterator != m_linkDomains.constEnd(); ++iterator) {
     setLinkDomains(iterator.key(), iterator.value());
   }
   m_linkDomains.clear();
 
-  /* Revert the VPN interface's DNS configuration */
   if (m_ifindex > 0) {
-    QList<QVariant> argumentList = {QVariant::fromValue(m_ifindex)};
-    QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
-        QStringLiteral("RevertLink"), argumentList);
-
-    QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
-    QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
-                     SLOT(dnsCallCompleted(QDBusPendingCallWatcher*)));
-
+    m_revertAfterRegister = m_ifindex;
     m_ifindex = 0;
   }
 
   return true;
 }
 
+void DnsUtilsLinux::scheduleRetry() {
+  if (m_pendingIfname.isEmpty() || m_retryPending || m_domainRetries >= 5)
+    return;
+  m_retryPending = true;
+  ++m_domainRetries;
+  logger.debug() << "Retrying full DNS setup (" << m_domainRetries << "/5)";
+  QTimer::singleShot(1000, this, [this]() {
+    m_retryPending = false;
+    if (!m_pendingIfname.isEmpty())
+      updateResolvers(m_pendingIfname, m_pendingResolvers);
+  });
+}
+
 void DnsUtilsLinux::dnsCallCompleted(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<> reply = *call;
   if (reply.isError()) {
-    logger.error() << "Error received from the DBus service";
+    logger.debug() << "DBus call failed (may be transient after systemd-resolved restart)";
+    logger.debug() << "Restarting resolved to clear its query backlog";
+    RouterLinux::Instance().flushDns();
+    scheduleRetry();
   }
   delete call;
 }
 
 void DnsUtilsLinux::setLinkDNS(int ifindex,
                                const QList<QHostAddress>& resolvers) {
+  if (!m_resolver) return;
   QList<DnsResolver> resolverList;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
@@ -111,8 +218,10 @@ void DnsUtilsLinux::setLinkDNS(int ifindex,
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(resolverList);
-  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
-      QStringLiteral("SetLinkDNS"), argumentList);
+  QDBusMessage msg = QDBusMessage::createMethodCall(
+      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDNS");
+  msg.setArguments(argumentList);
+  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -121,6 +230,7 @@ void DnsUtilsLinux::setLinkDNS(int ifindex,
 
 void DnsUtilsLinux::setLinkDomains(int ifindex,
                                    const QList<DnsLinkDomain>& domains) {
+  if (!m_resolver) return;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
   if (ifname) {
@@ -135,8 +245,10 @@ void DnsUtilsLinux::setLinkDomains(int ifindex,
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(domains);
-  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
-      QStringLiteral("SetLinkDomains"), argumentList);
+  QDBusMessage msg = QDBusMessage::createMethodCall(
+      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDomains");
+  msg.setArguments(argumentList);
+  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -144,11 +256,14 @@ void DnsUtilsLinux::setLinkDomains(int ifindex,
 }
 
 void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
+  if (!m_resolver) return;
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(enable);
-  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
-      QStringLiteral("SetLinkDefaultRoute"), argumentList);
+  QDBusMessage msg = QDBusMessage::createMethodCall(
+      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDefaultRoute");
+  msg.setArguments(argumentList);
+  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -156,6 +271,7 @@ void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
 }
 
 void DnsUtilsLinux::updateLinkDomains() {
+  if (!m_resolver) return;
   /* Get the list of search domains, and remove any others that might conspire
    * to satisfy DNS resolution. Unfortunately, this is a pain because Qt doesn't
    * seem to be able to demarshall complex property types.
@@ -165,7 +281,7 @@ void DnsUtilsLinux::updateLinkDomains() {
   message << QString(DBUS_RESOLVE_MANAGER);
   message << QString("Domains");
   QDBusPendingReply<QVariant> reply =
-      m_resolver->connection().asyncCall(message);
+      m_resolver->connection().asyncCall(message, 5000);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -174,11 +290,13 @@ void DnsUtilsLinux::updateLinkDomains() {
 
 void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<QVariant> reply = *call;
+  call->deleteLater();
   if (reply.isError()) {
-    logger.error() << "Error retrieving the DNS  domains from the DBus service";
-    delete call;
+    logger.debug() << "DBus Domains call failed (may be transient after systemd-resolved restart)";
+    scheduleRetry();
     return;
   }
+  m_domainRetries = 0;
 
   /* Update the state of the DNS domains */
   m_linkDomains.clear();
@@ -204,9 +322,17 @@ void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   }
 
   /* Add a root search domain for the new interface. */
-  QList<DnsLinkDomain> newlist = {root};
-  setLinkDomains(m_ifindex, newlist);
-  delete call;
+  if (m_ifindex > 0) {
+    setLinkDomains(m_ifindex, {root});
+
+    /* Disable DefaultRoute on the physical gateway so systemd-resolved
+     * routes all DNS through the VPN interface. */
+    const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
+    if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
+      m_gatewayIfindex = gwIdx;
+      setLinkDefaultRoute(gwIdx, false);
+    }
+  }
 }
 
 static DnsMetatypeRegistrationProxy s_dnsMetatypeProxy;

client/platforms/linux/daemon/dnsutilslinux.h

@@ -6,7 +6,12 @@
 #define DNSUTILSLINUX_H
 
 #include <QDBusInterface>
+#include <QScopedPointer>
 #include <QDBusPendingCallWatcher>
+#include <QDBusServiceWatcher>
+#include <QHostAddress>
+#include <QList>
+#include <QString>
 
 #include "daemon/dnsutils.h"
 #include "dbustypeslinux.h"
@@ -29,13 +34,25 @@ class DnsUtilsLinux final : public DnsUtils {
   void updateLinkDomains();
 
  private slots:
+  void onResolverRegistered();
+  void onResolverUnregistered();
   void dnsCallCompleted(QDBusPendingCallWatcher*);
   void dnsDomainsReceived(QDBusPendingCallWatcher*);
 
+ private:
+  void scheduleRetry();
+
  private:
   int m_ifindex = 0;
+  int m_gatewayIfindex = 0;
+  int m_domainRetries = 0;
+  bool m_revertOnDestroy = false;
+  bool m_retryPending = false;
+  int m_revertAfterRegister = 0;
   QMap<int, DnsLinkDomainList> m_linkDomains;
-  QDBusInterface* m_resolver = nullptr;
+  QScopedPointer<QDBusInterface> m_resolver;
+  QString m_pendingIfname;
+  QList<QHostAddress> m_pendingResolvers;
 };
 
 #endif  // DNSUTILSLINUX_H

client/platforms/linux/daemon/linuxfirewall.cpp

@@ -103,13 +103,6 @@ int LinuxFirewall::linkChain(LinuxFirewall::IPVersion ip, const QString& chain,
     const QString cmd = getCommand(ip);
     if (mustBeFirst)
     {
-        // This monster shell script does the following:
-        // 1. Check if a rule with the appropriate target exists at the top of the parent chain
-        // 2. If not, insert a jump rule at the top of the parent chain
-        // 3. Look for and delete a single rule with the designated target at an index > 1
-        //    (we can't safely delete all rules at once since rule numbers change)
-        // TODO: occasionally this script results in warnings in logs "Bad rule (does a matching rule exist in the chain?)" - this happens when
-        // the e.g OUTPUT chain is empty but this script attempts to delete things from it anyway. It doesn't cause any problems, but we should still fix at some point..
         return execute(QStringLiteral("if ! %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) == 1 && $2 == \"%3\" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then %1 -I %2 -j %3 -t %4 && %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) > 1 && $2 == \"%3\" { print $1; exit }' | xargs -r %1 -t %4 -D %2 ; fi").arg(cmd, parent, chain, tableName));
     }
     else

client/platforms/linux/daemon/wireguardutilslinux.cpp

@@ -237,7 +237,11 @@ bool WireguardUtilsLinux::updatePeer(const InterfaceConfig& config) {
     // Exclude the server address, except for multihop exit servers.
     if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
         (m_rtmonitor != nullptr)) {
-        m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
+        if (!config.m_serverIpv4AddrIn.isEmpty() &&
+            !m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn))) {
+            logger.error() << "No gateway — cannot add server exclusion route";
+            return false;
+        }
         m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
     }
 

client/platforms/windows/daemon/windowsdaemon.cpp

@@ -62,29 +62,12 @@ void WindowsDaemon::prepareActivation(const InterfaceConfig& config, int inetAda
 }
 
 void WindowsDaemon::activateSplitTunnel(const InterfaceConfig& config, int vpnAdapterIndex) {
-    if (m_splitTunnelManager == nullptr) {
-        if (config.m_vpnDisabledApps.length() > 0) {
-            logger.error() << "Split tunnel manager is not initialized";
-            emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-        }
+    if (m_splitTunnelManager == nullptr)
         return;
-    }
 
   if (config.m_vpnDisabledApps.length() > 0) {
-      if (!m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex)) {
-          logger.error() << "Failed to start split tunnel";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-          logger.error() << "Failed to apply split tunnel app exclusions";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->isRunning()) {
-          logger.error() << "Split tunnel did not reach running state";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      }
+      m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex);
+      m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps);
   } else {
       m_splitTunnelManager->stop();
   }
@@ -96,9 +79,7 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
       // The Client has sent us a list of disabled apps, but we failed
       // to init the the split tunnel driver.
       // So let the client know this was not possible
-      logger.error() << "Split tunnel manager is not initialized";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-      return false;
     }
     return true;
   }
@@ -109,20 +90,14 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
   }
   if (config.m_vpnDisabledApps.length() > 0) {
     if (!m_splitTunnelManager->start(m_inetAdapterIndex)) {
-      logger.error() << "Split tunnel start failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     };
     if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-      logger.error() << "Split tunnel app exclusion failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-      return false;
     };
     // Now the driver should be running (State == 4)
     if (!m_splitTunnelManager->isRunning()) {
-      logger.error() << "Split tunnel did not reach running state";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     }
     return true;
   }

client/platforms/windows/daemon/windowsfirewall.cpp

@@ -36,8 +36,6 @@
 // ID for the Firewall Sublayer
 DEFINE_GUID(ST_FW_WINFW_BASELINE_SUBLAYER_KEY, 0xc78056ff, 0x2bc1, 0x4211, 0xaa,
             0xdd, 0x7f, 0x35, 0x8d, 0xef, 0x20, 0x2d);
-DEFINE_GUID(ST_FW_WINFW_DNS_SUBLAYER_KEY, 0x60090787, 0xcca1, 0x4937, 0xaa,
-            0xce, 0x51, 0x25, 0x6e, 0xf4, 0x81, 0xf3);
 // ID for the Mullvad Split-Tunnel Sublayer Provider
 DEFINE_GUID(ST_FW_PROVIDER_KEY, 0xe2c114ee, 0xf32a, 0x4264, 0xa6, 0xcb, 0x3f,
             0xa7, 0x99, 0x63, 0x56, 0xd9);
@@ -51,53 +49,6 @@ constexpr uint8_t LOW_WEIGHT = 0;
 constexpr uint8_t MED_WEIGHT = 7;
 constexpr uint8_t HIGH_WEIGHT = 13;
 constexpr uint8_t MAX_WEIGHT = 15;
-
-bool ensureSublayer(HANDLE wfp, const GUID& key, const wchar_t* name,
-                    const wchar_t* description) {
-  FWPM_SUBLAYER0* maybeLayer = nullptr;
-  DWORD result = FwpmSubLayerGetByKey0(wfp, &key, &maybeLayer);
-  if (result == ERROR_SUCCESS) {
-    logger.debug() << "The Sublayer Already Exists:"
-                   << QString::fromWCharArray(name);
-    FwpmFreeMemory0(reinterpret_cast<void**>(&maybeLayer));
-    return true;
-  }
-  if (result != FWP_E_SUBLAYER_NOT_FOUND) {
-    logger.error() << "FwpmSubLayerGetByKey0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  result = FwpmTransactionBegin(wfp, NULL);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  FWPM_SUBLAYER0 subLayer;
-  memset(&subLayer, 0, sizeof(subLayer));
-  subLayer.subLayerKey = key;
-  subLayer.displayData.name = const_cast<PWSTR>(name);
-  subLayer.displayData.description = const_cast<PWSTR>(description);
-  subLayer.weight = 0xFFFF;
-
-  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
-  if (result != ERROR_SUCCESS) {
-    FwpmTransactionAbort0(wfp);
-    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
-    return false;
-  }
-
-  result = FwpmTransactionCommit0(wfp);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-  logger.debug() << "Initialised Sublayer:" << QString::fromWCharArray(name);
-  return true;
-}
 }  // namespace
 
 WindowsFirewall* WindowsFirewall::create(QObject* parent) {
@@ -165,12 +116,47 @@ bool WindowsFirewall::initSublayer() {
   }
   auto cleanup = qScopeGuard([&] { FwpmEngineClose0(wfp); });
 
-  return ensureSublayer(wfp, ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-Sublayer",
-                        L"Filters that enforce a good baseline") &&
-         ensureSublayer(wfp, ST_FW_WINFW_DNS_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-DNS-Sublayer",
-                        L"DNS filters for split tunneling");
+  // Check if the Layer Already Exists
+  FWPM_SUBLAYER0* maybeLayer;
+  result = FwpmSubLayerGetByKey0(wfp, &ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
+                                 &maybeLayer);
+  if (result == ERROR_SUCCESS) {
+    logger.debug() << "The Sublayer Already Exists!";
+    FwpmFreeMemory0((void**)&maybeLayer);
+    return true;
+  }
+
+  // Step 1: Start Transaction
+  result = FwpmTransactionBegin(wfp, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+
+  // Step 3: Add Sublayer
+  FWPM_SUBLAYER0 subLayer;
+  memset(&subLayer, 0, sizeof(subLayer));
+  subLayer.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
+  subLayer.displayData.name = (PWSTR)L"Amnezia-SplitTunnel-Sublayer";
+  subLayer.displayData.description =
+      (PWSTR)L"Filters that enforce a good baseline";
+  subLayer.weight = 0xFFFF;
+
+  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
+    return false;
+  }
+  // Step 4: Commit!
+  result = FwpmTransactionCommit0(wfp);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+  logger.debug() << "Initialised Sublayer";
+  return true;
 }
 
 bool WindowsFirewall::enableInterface(int vpnAdapterIndex) {

client/platforms/windows/daemon/windowssplittunnel.cpp

@@ -24,7 +24,6 @@
 #include <QFileInfo>
 #include <QNetworkInterface>
 #include <QScopeGuard>
-#include <QUrl>
 
 #pragma region
 
@@ -149,18 +148,6 @@ ProcessInfo getProcessInfo(HANDLE process, const PROCESSENTRY32W& processMeta) {
   return pi;
 }
 
-QString normalizeExecutablePath(const QString& path) {
-  QString normalized = path.trimmed();
-  if (normalized.startsWith("file:", Qt::CaseInsensitive)) {
-    const QString localPath = QUrl(normalized).toLocalFile();
-    if (!localPath.isEmpty()) {
-      normalized = localPath;
-    }
-  }
-  normalized.replace('/', '\\');
-  return normalized;
-}
-
 }  // namespace
 
 std::unique_ptr<WindowsSplitTunnel> WindowsSplitTunnel::create(
@@ -300,10 +287,6 @@ bool WindowsSplitTunnel::excludeApps(const QStringList& appPaths) {
 
   logger.debug() << "Pushing new Ruleset for Split-Tunnel " << state;
   auto config = generateAppConfiguration(appPaths);
-  if (config.empty()) {
-    logger.error() << "No valid split-tunnel application rules generated";
-    return false;
-  }
 
   DWORD bytesReturned;
   auto ok = DeviceIoControl(m_driver, IOCTL_SET_CONFIGURATION, &config[0],
@@ -331,7 +314,7 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
     auto ok = DeviceIoControl(m_driver, IOCTL_INITIALIZE, nullptr, 0, nullptr,
                               0, &bytesReturned, nullptr);
     if (!ok) {
-      logger.error() << "Driver init failed. Error:" << GetLastError();
+      logger.error() << "Driver init failed";
       return false;
     }
   }
@@ -340,16 +323,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   if (getState() == STATE_INITIALIZED) {
     logger.debug() << "State is Init, requires process config";
     auto config = generateProcessBlob();
-    if (config.empty()) {
-      logger.error() << "Process configuration blob is empty";
-      return false;
-    }
     auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_PROCESSES, &config[0],
                               (DWORD)config.size(), nullptr, 0, &bytesReturned,
                               nullptr);
     if (!ok) {
-      logger.error() << "Failed to set Process Config. Error:"
-                     << GetLastError();
+      logger.error() << "Failed to set Process Config";
       return false;
     }
     logger.debug() << "Set Process Config ok || new State:" << stateString();
@@ -362,16 +340,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   logger.debug() << "Driver is  ready || new State:" << stateString();
 
   auto config = generateIPConfiguration(inetAdapterIndex, vpnAdapterIndex);
-  if (config.empty()) {
-    logger.error() << "Network configuration blob is empty. Internet adapter:"
-                   << inetAdapterIndex << "VPN adapter:" << vpnAdapterIndex;
-    return false;
-  }
   auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_IP_ADDRESSES, &config[0],
                             (DWORD)config.size(), nullptr, 0, &bytesReturned,
                             nullptr);
   if (!ok) {
-    logger.error() << "Failed to set Network Config. Error:" << GetLastError();
+    logger.error() << "Failed to set Network Config";
     return false;
   }
   logger.debug() << "New Network Config Applied || new State:" << stateString();
@@ -431,22 +404,13 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   size_t cummulated_string_size = 0;
   QStringList dosPaths;
   for (auto const& path : appPaths) {
-    const QString normalizedPath = normalizeExecutablePath(path);
-    auto dosPath = convertPath(normalizedPath);
-    if (dosPath.isEmpty()) {
-      logger.error() << "Rejecting split-tunnel app path with empty device "
-                        "conversion:"
-                     << normalizedPath;
-      continue;
-    }
+    auto dosPath = convertPath(path);
     dosPaths.append(dosPath);
     cummulated_string_size += dosPath.toStdWString().size() * sizeof(wchar_t);
-  }
-  if (dosPaths.isEmpty()) {
-    return {};
+    logger.debug() << dosPath;
   }
   size_t bufferSize = sizeof(CONFIGURATION_HEADER) +
-                      (sizeof(CONFIGURATION_ENTRY) * dosPaths.size()) +
+                      (sizeof(CONFIGURATION_ENTRY) * appPaths.size()) +
                       cummulated_string_size;
   std::vector<uint8_t> outBuffer(bufferSize);
 
@@ -454,7 +418,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   auto entry = (CONFIGURATION_ENTRY*)(header + 1);
 
   auto stringDest = &outBuffer[0] + sizeof(CONFIGURATION_HEADER) +
-                    (sizeof(CONFIGURATION_ENTRY) * dosPaths.size());
+                    (sizeof(CONFIGURATION_ENTRY) * appPaths.size());
 
   SIZE_T stringOffset = 0;
 
@@ -473,7 +437,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
     stringOffset += stringLength;
   }
 
-  header->NumEntries = dosPaths.length();
+  header->NumEntries = appPaths.length();
   header->TotalLength = bufferSize;
 
   return outBuffer;
@@ -485,7 +449,9 @@ std::vector<std::byte> WindowsSplitTunnel::generateIPConfiguration(
 
   auto config = reinterpret_cast<IP_ADDRESSES_CONFIG*>(&out[0]);
 
-  if (vpnAdapterIndex == 0) {
+  auto ifaces = QNetworkInterface::allInterfaces();
+
+    if (vpnAdapterIndex == 0) {
     vpnAdapterIndex = WindowsCommons::VPNAdapterIndex();
   }
   // Always the VPN
@@ -554,7 +520,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateProcessBlob() {
     auto process_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE,
                                       currentProcess.th32ProcessID);
 
-    if (process_handle == nullptr) {
+    if (process_handle == INVALID_HANDLE_VALUE) {
       continue;
     }
     ProcessInfo info = getProcessInfo(process_handle, currentProcess);
@@ -674,48 +640,23 @@ bool WindowsSplitTunnel::isInstalled() {
 }
 
 QString WindowsSplitTunnel::convertPath(const QString& path) {
-  const QString normalizedPath = normalizeExecutablePath(path);
-  if (normalizedPath.isEmpty()) {
-    logger.error() << "Empty executable path for DOS device conversion";
-    return "";
-  }
-  auto parts = normalizedPath.split("\\", Qt::SkipEmptyParts);
-  if (parts.isEmpty()) {
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
-    return "";
-  }
+  auto parts = path.split("/");
   QString driveLetter = parts.takeFirst();
   if (!driveLetter.contains(":") || parts.size() == 0) {
     // device should contain : for e.g C:
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
     return "";
   }
-  QByteArray buffer(2048 * sizeof(wchar_t), 0);
-  DWORD ok = 0;
-  DWORD err = ERROR_SUCCESS;
-  for (int attempt = 0; attempt < 4; ++attempt) {
-    ok = QueryDosDeviceW(reinterpret_cast<LPCWSTR>(driveLetter.utf16()),
-                         reinterpret_cast<LPWSTR>(buffer.data()),
-                         buffer.size() / sizeof(wchar_t));
-    if (ok != 0) {
-      break;
-    }
-    err = GetLastError();
-    if (err != ERROR_INSUFFICIENT_BUFFER) {
-      WindowsUtils::windowsLog("Err fetching dos path");
-      logger.error() << "QueryDosDeviceW failed for" << driveLetter
-                     << "error:" << err;
-      return "";
-    }
+  QByteArray buffer(2048, 0xFFu);
+  auto ok = QueryDosDeviceW(qUtf16Printable(driveLetter),
+                            (wchar_t*)buffer.data(), buffer.size() / 2);
+
+  if (ok == ERROR_INSUFFICIENT_BUFFER) {
     buffer.resize(buffer.size() * 2);
-    buffer.fill(0);
+    ok = QueryDosDeviceW(qUtf16Printable(driveLetter), (wchar_t*)buffer.data(),
+                         buffer.size() / 2);
   }
   if (ok == 0) {
     WindowsUtils::windowsLog("Err fetching dos path");
-    logger.error() << "QueryDosDeviceW failed after buffer growth for"
-                   << driveLetter << "error:" << err;
     return "";
   }
   QString deviceName;

client/secureQSettings.cpp

@@ -1,7 +1,8 @@
 #include "secureQSettings.h"
 
+#include "../client/3rd/QSimpleCrypto/src/include/QAead.h"
+#include "../client/3rd/QSimpleCrypto/src/include/QBlockCipher.h"
 #include "core/utils/utilities.h"
-#include "cryptoUtils.h"
 #include <QDataStream>
 #include <QDebug>
 #include <QEventLoop>
@@ -179,8 +180,11 @@ void SecureQSettings::clearSettings()
 
 QByteArray SecureQSettings::encryptText(const QByteArray &value) const
 {
-    QByteArray result = CryptoUtils::encryptAes256Cbc(value, getEncKey(), getEncIv());
-    if (result.isEmpty() && !value.isEmpty()) {
+    QSimpleCrypto::QBlockCipher cipher;
+    QByteArray result;
+    try {
+        result = cipher.encryptAesBlockCipher(value, getEncKey(), getEncIv());
+    } catch (...) { // todo change error handling in QSimpleCrypto?
         qCritical() << "error when encrypting the settings value";
     }
     return result;
@@ -188,8 +192,11 @@ QByteArray SecureQSettings::encryptText(const QByteArray &value) const
 
 QByteArray SecureQSettings::decryptText(const QByteArray &ba) const
 {
-    QByteArray result = CryptoUtils::decryptAes256Cbc(ba, getEncKey(), getEncIv());
-    if (result.isEmpty() && !ba.isEmpty()) {
+    QSimpleCrypto::QBlockCipher cipher;
+    QByteArray result;
+    try {
+        result = cipher.decryptAesBlockCipher(ba, getEncKey(), getEncIv());
+    } catch (...) { // todo change error handling in QSimpleCrypto?
         qCritical() << "error when decrypting the settings value";
     }
     return result;
@@ -218,7 +225,8 @@ QByteArray SecureQSettings::getEncKey() const
 
     if (m_key.isEmpty()) {
         // Create new key
-        QByteArray key = CryptoUtils::generateRandomBytes(32);
+        QSimpleCrypto::QBlockCipher cipher;
+        QByteArray key = cipher.generatePrivateSalt(32);
         if (key.isEmpty()) {
             qCritical() << "SecureQSettings::getEncKey Unable to generate new enc key";
         }
@@ -246,7 +254,8 @@ QByteArray SecureQSettings::getEncIv() const
 
     if (m_iv.isEmpty()) {
         // Create new IV
-        QByteArray iv = CryptoUtils::generateRandomBytes(32);
+        QSimpleCrypto::QBlockCipher cipher;
+        QByteArray iv = cipher.generatePrivateSalt(32);
         if (iv.isEmpty()) {
             qCritical() << "SecureQSettings::getEncIv Unable to generate new enc IV";
         }

client/server_scripts/install_conntrack.sh

@@ -1,10 +0,0 @@
-if command -v conntrack > /dev/null 2>&1; then echo "conntrack already installed"; exit 0; fi;\
-if which apt-get > /dev/null 2>&1; then pm=$(which apt-get); silent_inst="-yq install --install-recommends"; check_pkgs="-yq update"; conntrack_pkg="conntrack"; dist="debian";\
-elif which dnf > /dev/null 2>&1; then pm=$(which dnf); silent_inst="-yq install"; check_pkgs="-yq check-update"; conntrack_pkg="conntrack-tools"; dist="fedora";\
-elif which yum > /dev/null 2>&1; then pm=$(which yum); silent_inst="-y -q install"; check_pkgs="-y -q check-update"; conntrack_pkg="conntrack-tools"; dist="centos";\
-elif which zypper > /dev/null 2>&1; then pm=$(which zypper); silent_inst="-nq install"; check_pkgs="-nq refresh"; conntrack_pkg="conntrack-tools"; dist="opensuse";\
-elif which pacman > /dev/null 2>&1; then pm=$(which pacman); silent_inst="-S --noconfirm --noprogressbar --quiet"; check_pkgs="-Sup"; conntrack_pkg="conntrack-tools"; dist="archlinux";\
-else echo "Packet manager not found"; exit 0; fi;\
-if [ "$dist" = "debian" ]; then export DEBIAN_FRONTEND=noninteractive; fi;\
-sudo $pm $check_pkgs; sudo $pm $silent_inst $conntrack_pkg;\
-command -v conntrack > /dev/null 2>&1 && echo "conntrack installed" || echo "conntrack install failed"

client/server_scripts/serverScripts.qrc

@@ -18,7 +18,6 @@
         <file>dns/Dockerfile</file>
         <file>dns/run_container.sh</file>
         <file>install_docker.sh</file>
-        <file>install_conntrack.sh</file>
         <file>ipsec/configure_container.sh</file>
         <file>ipsec/Dockerfile</file>
         <file>ipsec/mobileconfig.plist</file>

client/server_scripts/telemt/configure_container.sh

@@ -61,12 +61,6 @@ rm -f /data/config.toml
     echo ""
     echo "[access.users]"
     echo "$TELEMT_USER_NAME = \"$SECRET\""
-    i=1
-    for EXTRA in $(echo "$TELEMT_ADDITIONAL_SECRETS" | tr ',' ' '); do
-        echo "$EXTRA" | grep -qE '^[0-9a-fA-F]{32}$' || continue
-        echo "extra_$i = \"$EXTRA\""
-        i=$((i + 1))
-    done
 } > /data/config.toml
 
 echo "$SECRET" > /data/secret

client/ui/controllers/api/subscriptionUiController.cpp

@@ -303,8 +303,6 @@ bool SubscriptionUiController::importFreeFromGateway()
         emit installServerFromApiFinished(tr("%1 installed successfully.").arg(m_apiServicesModel->getSelectedServiceName()));
         return true;
     } else if (errorCode == ErrorCode::ApiCaptchaRequiredError && captchaInfo.isRequired) {
-        m_captchaState = CaptchaState{};
-        m_captchaState.flow = CaptchaFlow::Import;
         m_captchaState.userCountryCode = userCountryCode;
         m_captchaState.serviceType = serviceType;
         m_captchaState.serviceProtocol = serviceProtocol;
@@ -329,11 +327,6 @@ void SubscriptionUiController::onCaptchaSolved(const QString &captchaId, const Q
         return;
     }
 
-    if (m_captchaState.flow == CaptchaFlow::Update) {
-        resolveUpdateCaptcha(captchaId, solution);
-        return;
-    }
-
     SubscriptionController::ProtocolData protocolData;
     protocolData.certPrivKey = m_captchaState.openvpnPrivKey;
     protocolData.wireGuardClientPrivKey = m_captchaState.wireguardClientPrivKey;
@@ -375,33 +368,6 @@ void SubscriptionUiController::onRefreshCaptchaRequested()
         return;
     }
 
-    if (m_captchaState.flow == CaptchaFlow::Update) {
-        SubscriptionController::CaptchaInfo captchaInfo;
-        SubscriptionController::ProtocolData usedProtocolData;
-        ErrorCode errorCode = m_subscriptionController->updateServiceFromGateway(
-                m_captchaState.serverId,
-                m_captchaState.newCountryCode,
-                m_captchaState.isConnectEvent,
-                &captchaInfo,
-                &usedProtocolData);
-
-        if (errorCode == ErrorCode::ApiCaptchaRequiredError && captchaInfo.isRequired) {
-            m_captchaState.updateProtocolData = usedProtocolData;
-            emit captchaRequired(captchaInfo.captchaId, captchaInfo.captchaImageBase64,
-                                 captchaInfo.hint.isEmpty() ? tr("Enter the digits from the image to continue") : captchaInfo.hint);
-        } else if (errorCode == ErrorCode::NoError) {
-            emitCaptchaUpdateSuccess();
-        } else {
-            m_captchaState.isPending = false;
-            if (errorCode == ErrorCode::ApiSubscriptionExpiredError) {
-                emit subscriptionExpiredOnServer();
-            } else {
-                emit errorOccurred(errorCode);
-            }
-        }
-        return;
-    }
-
     SubscriptionController::ProtocolData protocolData;
     protocolData.certPrivKey = m_captchaState.openvpnPrivKey;
     protocolData.wireGuardClientPrivKey = m_captchaState.wireguardClientPrivKey;
@@ -426,39 +392,6 @@ void SubscriptionUiController::onRefreshCaptchaRequested()
     }
 }
 
-void SubscriptionUiController::resolveUpdateCaptcha(const QString &captchaId, const QString &solution)
-{
-    SubscriptionController::CaptchaInfo retryCaptcha;
-    ErrorCode errorCode = m_subscriptionController->resolveUpdateServiceCaptcha(
-            m_captchaState.serverId,
-            m_captchaState.newCountryCode,
-            m_captchaState.isConnectEvent,
-            m_captchaState.updateProtocolData,
-            captchaId,
-            solution,
-            &retryCaptcha);
-
-    if (errorCode == ErrorCode::NoError) {
-        emitCaptchaUpdateSuccess();
-        return;
-    }
-
-    if ((errorCode == ErrorCode::ApiCaptchaInvalidError || errorCode == ErrorCode::ApiCaptchaRefreshError
-         || errorCode == ErrorCode::ApiCaptchaRequiredError)
-        && retryCaptcha.isRequired) {
-        emit captchaRequired(retryCaptcha.captchaId, retryCaptcha.captchaImageBase64,
-                             retryCaptcha.hint.isEmpty() ? tr("Enter the digits from the image to continue") : retryCaptcha.hint);
-        return;
-    }
-
-    m_captchaState.isPending = false;
-    if (errorCode == ErrorCode::ApiSubscriptionExpiredError) {
-        emit subscriptionExpiredOnServer();
-    } else {
-        emit errorOccurred(errorCode);
-    }
-}
-
 bool SubscriptionUiController::importTrialFromGateway(const QString &email)
 {
     emit trialEmailError(QString());
@@ -490,29 +423,20 @@ bool SubscriptionUiController::updateServiceFromGateway(const QString &serverId,
                 || oldApiV2->apiConfig.isSubscriptionExpired();
     }
 
-    SubscriptionController::CaptchaInfo captchaInfo;
-    SubscriptionController::ProtocolData usedProtocolData;
-    ErrorCode errorCode = m_subscriptionController->updateServiceFromGateway(serverId, newCountryCode, isConnectEvent,
-                                                                             &captchaInfo, &usedProtocolData);
+    ErrorCode errorCode = m_subscriptionController->updateServiceFromGateway(serverId, newCountryCode, isConnectEvent);
 
     if (errorCode == ErrorCode::NoError) {
-        emitUpdateSuccess(wasSubscriptionExpired, reloadServiceConfig, newCountryName);
+        if (wasSubscriptionExpired) {
+            emit subscriptionRefreshNeeded();
+        }
+        if (reloadServiceConfig) {
+            emit reloadServerFromApiFinished(tr("API config reloaded"));
+        } else if (newCountryName.isEmpty()) {
+            emit updateServerFromApiFinished();
+        } else {
+            emit changeApiCountryFinished(tr("Successfully changed the country of connection to %1").arg(newCountryName));
+        }
         return true;
-    } else if (errorCode == ErrorCode::ApiCaptchaRequiredError && captchaInfo.isRequired) {
-        m_captchaState = CaptchaState{};
-        m_captchaState.flow = CaptchaFlow::Update;
-        m_captchaState.serverId = serverId;
-        m_captchaState.newCountryCode = newCountryCode;
-        m_captchaState.newCountryName = newCountryName;
-        m_captchaState.isConnectEvent = isConnectEvent;
-        m_captchaState.reloadServiceConfig = reloadServiceConfig;
-        m_captchaState.wasSubscriptionExpired = wasSubscriptionExpired;
-        m_captchaState.updateProtocolData = usedProtocolData;
-        m_captchaState.isPending = true;
-
-        emit captchaRequired(captchaInfo.captchaId, captchaInfo.captchaImageBase64,
-                             captchaInfo.hint.isEmpty() ? tr("Enter the digits from the image to continue") : captchaInfo.hint);
-        return false;
     } else {
         if (errorCode == ErrorCode::ApiSubscriptionExpiredError) {
             emit subscriptionExpiredOnServer();
@@ -523,37 +447,6 @@ bool SubscriptionUiController::updateServiceFromGateway(const QString &serverId,
     }
 }
 
-void SubscriptionUiController::emitUpdateSuccess(bool wasSubscriptionExpired, bool reloadServiceConfig, const QString &newCountryName)
-{
-    if (wasSubscriptionExpired) {
-        emit subscriptionRefreshNeeded();
-    }
-    if (reloadServiceConfig) {
-        emit reloadServerFromApiFinished(tr("API config reloaded"));
-    } else if (newCountryName.isEmpty()) {
-        emit updateServerFromApiFinished();
-    } else {
-        emit changeApiCountryFinished(tr("Successfully changed the country of connection to %1").arg(newCountryName));
-    }
-}
-
-void SubscriptionUiController::emitCaptchaUpdateSuccess()
-{
-    const bool fromValidateConfig = m_captchaState.fromValidateConfig;
-    const bool wasSubscriptionExpired = m_captchaState.wasSubscriptionExpired;
-    const bool reloadServiceConfig = m_captchaState.reloadServiceConfig;
-    const QString newCountryName = m_captchaState.newCountryName;
-
-    m_captchaState.isPending = false;
-    emit captchaFlowDismissRequested();
-
-    if (fromValidateConfig) {
-        emit configValidated(true);
-        return;
-    }
-    emitUpdateSuccess(wasSubscriptionExpired, reloadServiceConfig, newCountryName);
-}
-
 
 bool SubscriptionUiController::deactivateDevice(const QString &serverId)
 {
@@ -589,25 +482,7 @@ void SubscriptionUiController::validateConfig()
 
     bool hasInstalledContainers = m_serversController->hasInstalledContainers(serverId);
 
-    SubscriptionController::CaptchaInfo captchaInfo;
-    SubscriptionController::ProtocolData usedProtocolData;
-    ErrorCode errorCode = m_subscriptionController->validateAndUpdateConfig(serverId, hasInstalledContainers,
-                                                                            &captchaInfo, &usedProtocolData);
-
-    if (errorCode == ErrorCode::ApiCaptchaRequiredError && captchaInfo.isRequired) {
-        m_captchaState = CaptchaState{};
-        m_captchaState.flow = CaptchaFlow::Update;
-        m_captchaState.fromValidateConfig = true;
-        m_captchaState.serverId = serverId;
-        m_captchaState.isConnectEvent = true;
-        m_captchaState.updateProtocolData = usedProtocolData;
-        m_captchaState.isPending = true;
-
-        emit captchaRequired(captchaInfo.captchaId, captchaInfo.captchaImageBase64,
-                             captchaInfo.hint.isEmpty() ? tr("Enter the digits from the image to continue") : captchaInfo.hint);
-        emit configValidated(false);
-        return;
-    }
+    ErrorCode errorCode = m_subscriptionController->validateAndUpdateConfig(serverId, hasInstalledContainers);
 
     if (errorCode != ErrorCode::NoError) {
         if (errorCode == ErrorCode::ApiSubscriptionExpiredError) {
@@ -633,18 +508,6 @@ bool SubscriptionUiController::isVlessProtocol(const QString &serverId)
 }
 
 
-QString SubscriptionUiController::currentProtocol(const QString &serverId)
-{
-    return m_subscriptionController->currentProtocol(serverId);
-}
-
-
-QStringList SubscriptionUiController::availableProtocols(const QString &serverId)
-{
-    return m_subscriptionController->availableProtocols(serverId);
-}
-
-
 void SubscriptionUiController::removeApiConfig(const QString &serverId)
 {
     m_subscriptionController->removeApiConfig(serverId);

client/ui/controllers/api/subscriptionUiController.h

@@ -57,8 +57,6 @@ public slots:
 
     void setCurrentProtocol(const QString &serverId, const QString &protocolName);
     bool isVlessProtocol(const QString &serverId);
-    QString currentProtocol(const QString &serverId);
-    QStringList availableProtocols(const QString &serverId);
 
     bool isCaptchaAwaitingUser() const;
     void onCaptchaSolved(const QString &captchaId, const QString &solution);
@@ -97,15 +95,7 @@ signals:
     void unsupportedConnectDrawerRequested();
 
 private:
-    enum class CaptchaFlow {
-        Import,
-        Update
-    };
-
     struct CaptchaState {
-        CaptchaFlow flow = CaptchaFlow::Import;
-
-        // Import flow
         QString userCountryCode;
         QString serviceType;
         QString serviceProtocol;
@@ -113,25 +103,10 @@ private:
         QString wireguardClientPrivKey;
         QString wireguardClientPubKey;
         QString xrayUuid;
-
-        // Update flow
-        QString serverId;
-        QString newCountryCode;
-        QString newCountryName;
-        bool isConnectEvent = false;
-        bool reloadServiceConfig = false;
-        bool wasSubscriptionExpired = false;
-        bool fromValidateConfig = false;
-        SubscriptionController::ProtocolData updateProtocolData;
-
         bool isPending = false;
     } m_captchaState;
 
 private:
-    void emitUpdateSuccess(bool wasSubscriptionExpired, bool reloadServiceConfig, const QString &newCountryName);
-    void emitCaptchaUpdateSuccess();
-    void resolveUpdateCaptcha(const QString &captchaId, const QString &solution);
-
     QList<QString> getQrCodes();
     int getQrCodesCount();
     QString getVpnKey();

client/ui/controllers/selfhosted/installUiController.cpp

@@ -9,7 +9,6 @@
 #include <QStandardPaths>
 #include <QFutureWatcher>
 #include <QtConcurrent>
-#include <utility>
 
 #include "core/utils/api/apiUtils.h"
 #include "core/controllers/selfhosted/installController.h"
@@ -363,27 +362,17 @@ void InstallUiController::setContainerEnabled(const QString &serverId, int conta
     }
 
     emit serverIsBusy(true);
+    const ErrorCode errorCode = m_installController->setDockerContainerEnabledState(serverId, container, enabled);
+    emit serverIsBusy(false);
 
-    InstallController *installController = m_installController;
-    auto *watcher = new QFutureWatcher<ErrorCode>(this);
-    QObject::connect(watcher, &QFutureWatcher<ErrorCode>::finished, this,
-                     [this, watcher, serverId, container, enabled]() {
-                         const ErrorCode errorCode = watcher->result();
-                         watcher->deleteLater();
-                         emit serverIsBusy(false);
+    if (errorCode == ErrorCode::NoError) {
+        const ContainerConfig currentConfig = m_serversController->getContainerConfig(serverId, container);
+        m_protocolModel->updateModel(currentConfig);
+        emit setContainerEnabledFinished(enabled);
+        return;
+    }
 
-                         if (errorCode == ErrorCode::NoError) {
-                             const ContainerConfig currentConfig = m_serversController->getContainerConfig(serverId, container);
-                             m_protocolModel->updateModel(currentConfig);
-                             emit setContainerEnabledFinished(enabled);
-                             return;
-                         }
-                         emit installationErrorOccurred(errorCode);
-                     });
-    QFuture<ErrorCode> future = QtConcurrent::run([installController, serverId, container, enabled]() -> ErrorCode {
-        return installController->setDockerContainerEnabledState(serverId, container, enabled);
-    });
-    watcher->setFuture(future);
+    emit installationErrorOccurred(errorCode);
 }
 
 void InstallUiController::refreshContainerStatus(const QString &serverId, int containerIndex)
@@ -393,23 +382,13 @@ void InstallUiController::refreshContainerStatus(const QString &serverId, int co
         return;
     }
 
-    using StatusResult = std::pair<int, int>; // {status, errorCode}
-    InstallController *installController = m_installController;
-    auto *watcher = new QFutureWatcher<StatusResult>(this);
-    QObject::connect(watcher, &QFutureWatcher<StatusResult>::finished, this, [this, watcher]() {
-        const StatusResult result = watcher->result();
-        watcher->deleteLater();
-        emit containerStatusRefreshed(result.first, result.second);
-    });
-    QFuture<StatusResult> future = QtConcurrent::run([installController, serverId, container]() -> StatusResult {
-        int status = 3;
-        const ErrorCode errorCode = installController->queryDockerContainerStatus(serverId, container, status);
-        if (errorCode != ErrorCode::NoError) {
-            return { 3, static_cast<int>(errorCode) };
-        }
-        return { status, static_cast<int>(ErrorCode::NoError) };
-    });
-    watcher->setFuture(future);
+    int status = 3;
+    const ErrorCode errorCode = m_installController->queryDockerContainerStatus(serverId, container, status);
+    if (errorCode != ErrorCode::NoError) {
+        emit containerStatusRefreshed(3);
+        return;
+    }
+    emit containerStatusRefreshed(status);
 }
 
 void InstallUiController::refreshContainerDiagnostics(const QString &serverId, int containerIndex, int port)
@@ -419,27 +398,14 @@ void InstallUiController::refreshContainerDiagnostics(const QString &serverId, i
         return;
     }
 
-    using DiagResult = std::pair<bool, MtProxyContainerDiagnostics>;
-    InstallController *installController = m_installController;
-    auto *watcher = new QFutureWatcher<DiagResult>(this);
-    QObject::connect(watcher, &QFutureWatcher<DiagResult>::finished, this, [this, watcher]() {
-        const DiagResult result = watcher->result();
-        watcher->deleteLater();
-        if (!result.first) {
-            emit containerDiagnosticsRefreshed(false, false, -1, QString(), QString());
-            return;
-        }
-        const MtProxyContainerDiagnostics &diag = result.second;
-        emit containerDiagnosticsRefreshed(diag.portReachable, diag.upstreamReachable, diag.clientsConnected,
-                                           diag.lastConfigRefresh, diag.statsEndpoint);
-    });
-    QFuture<DiagResult> future =
-            QtConcurrent::run([installController, serverId, container, port]() -> DiagResult {
-                MtProxyContainerDiagnostics diag;
-                const ErrorCode errorCode = installController->queryMtProxyDiagnostics(serverId, container, port, diag);
-                return { errorCode == ErrorCode::NoError, diag };
-            });
-    watcher->setFuture(future);
+    MtProxyContainerDiagnostics diag;
+    const ErrorCode errorCode = m_installController->queryMtProxyDiagnostics(serverId, container, port, diag);
+    if (errorCode != ErrorCode::NoError) {
+        emit containerDiagnosticsRefreshed(false, false, -1, QString(), QString());
+        return;
+    }
+    emit containerDiagnosticsRefreshed(diag.portReachable, diag.upstreamReachable, diag.clientsConnected,
+                                       diag.lastConfigRefresh, diag.statsEndpoint);
 }
 
 void InstallUiController::fetchContainerSecret(const QString &serverId, int containerIndex)
@@ -449,17 +415,8 @@ void InstallUiController::fetchContainerSecret(const QString &serverId, int cont
         return;
     }
 
-    InstallController *installController = m_installController;
-    auto *watcher = new QFutureWatcher<QString>(this);
-    QObject::connect(watcher, &QFutureWatcher<QString>::finished, this, [this, watcher]() {
-        const QString secret = watcher->result();
-        watcher->deleteLater();
-        emit containerSecretFetched(secret);
-    });
-    QFuture<QString> future = QtConcurrent::run([installController, serverId, container]() -> QString {
-        return installController->fetchDockerContainerSecret(serverId, container);
-    });
-    watcher->setFuture(future);
+    const QString secret = m_installController->fetchDockerContainerSecret(serverId, container);
+    emit containerSecretFetched(secret);
 }
 
 void InstallUiController::rebootServer(const QString &serverId)

client/ui/controllers/selfhosted/installUiController.h

@@ -114,7 +114,7 @@ signals:
     void removeAllContainersFinished(const QString &finishedMessage);
     void removeContainerFinished(const QString &finishedMessage);
     void setContainerEnabledFinished(bool enabled);
-    void containerStatusRefreshed(int status, int errorCode);
+    void containerStatusRefreshed(int status);
     void containerDiagnosticsRefreshed(bool portReachable, bool upstreamReachable, int clientsConnected,
                                        const QString &lastConfigRefresh, const QString &statsEndpoint);
     void containerSecretFetched(const QString &secret);

client/ui/models/api/apiAccountInfoModel.cpp

@@ -73,6 +73,12 @@ QVariant ApiAccountInfoModel::data(const QModelIndex &index, int role) const
         }
         return false;
     }
+    case IsProtocolSelectionSupportedRole: {
+        if (m_accountInfoData.supportedProtocols.size() > 1) {
+            return true;
+        }
+        return false;
+    }
     case IsSubscriptionExpiredRole: {
         if (m_accountInfoData.configType == serverConfigUtils::ConfigType::AmneziaFreeV3) {
             return false;
@@ -126,6 +132,10 @@ void ApiAccountInfoModel::updateModel(const QJsonObject &accountInfoObject, cons
     accountInfoData.subscriptionDescription = accountInfoObject.value(apiDefs::key::subscriptionDescription).toString();
     accountInfoData.isRenewalAvailable = accountInfoObject.value(apiDefs::key::isRenewalAvailable).toBool(false);
 
+    for (const auto &protocol : accountInfoObject.value(apiDefs::key::supportedProtocols).toArray()) {
+        accountInfoData.supportedProtocols.push_back(protocol.toString());
+    }
+
     m_accountInfoData = accountInfoData;
 
     m_supportInfo = accountInfoObject.value(apiDefs::key::supportInfo).toObject();
@@ -191,6 +201,7 @@ QHash<int, QByteArray> ApiAccountInfoModel::roleNames() const
     roles[IsComponentVisibleRole] = "isComponentVisible";
     roles[IsSubscriptionRenewalAvailableRole] = "isSubscriptionRenewalAvailable";
     roles[HasExpiredWorkerRole] = "hasExpiredWorker";
+    roles[IsProtocolSelectionSupportedRole] = "isProtocolSelectionSupported";
     roles[IsSubscriptionExpiredRole] = "isSubscriptionExpired";
     roles[IsSubscriptionExpiringSoonRole] = "isSubscriptionExpiringSoon";
     roles[IsInAppPurchaseRole] = "isInAppPurchase";

client/ui/models/api/apiAccountInfoModel.h

@@ -22,6 +22,7 @@ public:
         IsComponentVisibleRole,
         IsSubscriptionRenewalAvailableRole,
         HasExpiredWorkerRole,
+        IsProtocolSelectionSupportedRole,
         IsSubscriptionExpiredRole,
         IsSubscriptionExpiringSoonRole,
         IsInAppPurchaseRole
@@ -57,6 +58,8 @@ private:
 
         serverConfigUtils::ConfigType configType;
 
+        QStringList supportedProtocols;
+
         QString subscriptionDescription;
 
         bool isInAppPurchase = false;

client/ui/models/services/mtProxyConfigModel.cpp

@@ -1,6 +1,6 @@
 #include "mtProxyConfigModel.h"
 
-#include "ui/utils/mtProxyPublicHostInput.h"
+#include "ui/models/utils/mtproxy_public_host_input.h"
 
 #include "core/utils/networkUtilities.h"
 #include "core/utils/qrCodeUtils.h"
@@ -8,14 +8,19 @@
 #include "core/utils/constants/configKeys.h"
 #include "qrcodegen.hpp"
 
+#include <QClipboard>
+#include <QGuiApplication>
 #include <QHostAddress>
 #include <QRegExp>
 #include <QRegularExpression>
 #include <QtGlobal>
+#include <qqml.h>
 
 using namespace amnezia;
 
-MtProxyConfigModel::MtProxyConfigModel(QObject *parent) : QAbstractListModel(parent) {}
+MtProxyConfigModel::MtProxyConfigModel(QObject *parent) : QAbstractListModel(parent) {
+    qmlRegisterType<PublicHostInputValidator>("MtProxyConfig", 1, 0, "PublicHostInputValidator");
+}
 
 int MtProxyConfigModel::rowCount(const QModelIndex &parent) const {
     Q_UNUSED(parent);
@@ -327,7 +332,7 @@ void MtProxyConfigModel::removeAdditionalSecret(int idx) {
 QVariantList MtProxyConfigModel::additionalSecretsList() const {
     QVariantList out;
     out.reserve(m_protocolConfig.additionalSecrets.size());
-    for (const auto &s : m_protocolConfig.additionalSecrets) {
+    for (const auto &s: m_protocolConfig.additionalSecrets) {
         if (!s.isEmpty()) {
             out.append(s);
         }
@@ -393,9 +398,6 @@ bool MtProxyConfigModel::isValidPublicHost(const QString &host) const {
         return NetworkUtilities::checkIPv4Format(t);
     }
     if (a.protocol() == QHostAddress::IPv6Protocol) {
-        if (a.isNull() || a.isLoopback() || a == QHostAddress(QHostAddress::AnyIPv6)) {
-            return false;
-        }
         return true;
     }
     static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
@@ -502,12 +504,20 @@ bool MtProxyConfigModel::isValidFakeTlsDomain(const QString &domain) const {
     if (!re.exactMatch(t)) {
         return false;
     }
+    // ee + 32 hex (base secret) + hex(UTF-8 domain); keep headroom under typical client limits.
     if (t.toUtf8().size() > 111) {
         return false;
     }
     return true;
 }
 
+QString MtProxyConfigModel::clipboardText() const {
+    if (QClipboard *c = QGuiApplication::clipboard()) {
+        return c->text();
+    }
+    return QString();
+}
+
 QString MtProxyConfigModel::sanitizeFakeTlsDomainFieldText(const QString &input) const {
     const QString t = normalizeFakeTlsDomainInput(input);
     QString out;
@@ -568,6 +578,7 @@ QString MtProxyConfigModel::sanitizeMtProxyTagFieldText(const QString &input) co
     if (trimmed.startsWith(QLatin1String("0x"), Qt::CaseInsensitive)) {
         trimmed = trimmed.mid(2).trimmed();
     }
+    // Prefer a contiguous 32-hex run (paste from bot message with extra text).
     static const QRegularExpression runHex(QStringLiteral(R"(([0-9a-fA-F]{32}))"));
     const QRegularExpressionMatch m = runHex.match(trimmed);
     if (m.hasMatch()) {
@@ -588,6 +599,18 @@ QString MtProxyConfigModel::sanitizeMtProxyTagFieldText(const QString &input) co
     return out;
 }
 
+QString MtProxyConfigModel::sanitizeWorkersFieldText(const QString &input) const {
+    QString out;
+    out.reserve(qMin(input.size(), 3));
+    for (const QChar &c: input) {
+        const ushort u = c.unicode();
+        if (u >= '0' && u <= '9' && out.size() < 3) {
+            out.append(c);
+        }
+    }
+    return out;
+}
+
 QString MtProxyConfigModel::sanitizeOptionalIpv4FieldText(const QString &input) const {
     QString out;
     out.reserve(qMin(input.size(), 15));

client/ui/models/services/mtProxyConfigModel.h

@@ -128,12 +128,16 @@ public slots:
 
     Q_INVOKABLE bool isFakeTlsDomainInputAllowed(const QString &text) const;
 
+    Q_INVOKABLE QString clipboardText() const;
+
     Q_INVOKABLE QString sanitizePublicHostFieldText(const QString &input) const;
 
     Q_INVOKABLE QString sanitizePortFieldText(const QString &input) const;
 
     Q_INVOKABLE QString sanitizeMtProxyTagFieldText(const QString &input) const;
 
+    Q_INVOKABLE QString sanitizeWorkersFieldText(const QString &input) const;
+
     Q_INVOKABLE QString sanitizeOptionalIpv4FieldText(const QString &input) const;
 
     Q_INVOKABLE bool isFakeTlsDomainTypingIncomplete(const QString &text) const;

client/ui/models/services/telemtConfigModel.cpp

@@ -1,12 +1,7 @@
 #include "telemtConfigModel.h"
 
-#include "ui/utils/mtProxyPublicHostInput.h"
-
-#include <QHostAddress>
-#include <QRegExp>
 #include <QRegularExpression>
 
-#include "core/utils/networkUtilities.h"
 #include "core/utils/qrCodeUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
@@ -54,11 +49,7 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::TagRole: {
-            const QString tag = sanitizeMtProxyTagFieldText(value.toString());
-            if (!isValidMtProxyTag(tag)) {
-                return false;
-            }
-            m_protocolConfig.tag = tag;
+            m_protocolConfig.tag = value.toString();
             break;
         }
         case Roles::IsEnabledRole: {
@@ -66,11 +57,7 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::PublicHostRole: {
-            const QString h = value.toString().trimmed();
-            if (!isValidPublicHost(h)) {
-                return false;
-            }
-            m_protocolConfig.publicHost = h;
+            m_protocolConfig.publicHost = value.toString();
             break;
         }
         case Roles::TransportModeRole: {
@@ -78,11 +65,7 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::TlsDomainRole: {
-            const QString d = value.toString().trimmed();
-            if (!isValidFakeTlsDomain(d)) {
-                return false;
-            }
-            m_protocolConfig.tlsDomain = d;
+            m_protocolConfig.tlsDomain = value.toString();
             break;
         }
         case Roles::AdditionalSecretsRole: {
@@ -102,19 +85,11 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::NatInternalIpRole: {
-            const QString ip = value.toString().trimmed();
-            if (!isValidOptionalIpv4(ip)) {
-                return false;
-            }
-            m_protocolConfig.natInternalIp = ip;
+            m_protocolConfig.natInternalIp = value.toString();
             break;
         }
         case Roles::NatExternalIpRole: {
-            const QString ip = value.toString().trimmed();
-            if (!isValidOptionalIpv4(ip)) {
-                return false;
-            }
-            m_protocolConfig.natExternalIp = ip;
+            m_protocolConfig.natExternalIp = value.toString();
             break;
         }
         case Roles::MaskEnabledRole: {
@@ -263,7 +238,7 @@ void TelemtConfigModel::setSecret(const QString &secret) {
 }
 
 bool TelemtConfigModel::validateAndSetSecret(const QString &rawSecret) {
-    if (!QRegularExpression("^[0-9a-fA-F]{32}$").match(rawSecret).hasMatch()) {
+    if (!QRegularExpression(QStringLiteral("^[0-9a-fA-F]{32}$")).match(rawSecret).hasMatch()) {
         return false;
     }
     setData(index(0), rawSecret, SecretRole);
@@ -279,11 +254,7 @@ void TelemtConfigModel::setTag(const QString &tag) {
 }
 
 void TelemtConfigModel::setPublicHost(const QString &host) {
-    const QString t = host.trimmed();
-    if (!isValidPublicHost(t)) {
-        return;
-    }
-    setData(index(0), t, PublicHostRole);
+    setData(index(0), host, PublicHostRole);
 }
 
 void TelemtConfigModel::setTransportMode(const QString &mode) {
@@ -291,15 +262,13 @@ void TelemtConfigModel::setTransportMode(const QString &mode) {
 }
 
 QString TelemtConfigModel::getTransportMode() const {
-    return m_protocolConfig.transportMode.isEmpty()
-           ? QString(protocols::telemt::transportModeStandard)
-           : m_protocolConfig.transportMode;
+    return m_protocolConfig.transportMode.isEmpty() ? QString::fromUtf8(protocols::telemt::transportModeStandard)
+                                                    : m_protocolConfig.transportMode;
 }
 
 QString TelemtConfigModel::getTlsDomain() const {
-    return m_protocolConfig.tlsDomain.isEmpty()
-           ? QString(protocols::telemt::defaultTlsDomain)
-           : m_protocolConfig.tlsDomain;
+    return m_protocolConfig.tlsDomain.isEmpty() ? QString::fromUtf8(protocols::telemt::defaultTlsDomain)
+                                                : m_protocolConfig.tlsDomain;
 }
 
 QString TelemtConfigModel::getPublicHost() const {
@@ -307,11 +276,7 @@ QString TelemtConfigModel::getPublicHost() const {
 }
 
 void TelemtConfigModel::setTlsDomain(const QString &domain) {
-    const QString t = domain.trimmed();
-    if (!isValidFakeTlsDomain(t)) {
-        return;
-    }
-    setData(index(0), t, TlsDomainRole);
+    setData(index(0), domain, TlsDomainRole);
 }
 
 void TelemtConfigModel::setWorkersMode(const QString &mode) {
@@ -327,19 +292,11 @@ void TelemtConfigModel::setNatEnabled(bool enabled) {
 }
 
 void TelemtConfigModel::setNatInternalIp(const QString &ip) {
-    const QString t = ip.trimmed();
-    if (!isValidOptionalIpv4(t)) {
-        return;
-    }
-    setData(index(0), t, NatInternalIpRole);
+    setData(index(0), ip, NatInternalIpRole);
 }
 
 void TelemtConfigModel::setNatExternalIp(const QString &ip) {
-    const QString t = ip.trimmed();
-    if (!isValidOptionalIpv4(t)) {
-        return;
-    }
-    setData(index(0), t, NatExternalIpRole);
+    setData(index(0), ip, NatExternalIpRole);
 }
 
 void TelemtConfigModel::setMaskEnabled(bool enabled) {
@@ -377,17 +334,6 @@ void TelemtConfigModel::removeAdditionalSecret(int idx) {
     emit dataChanged(index(0), index(0), QList<int>{AdditionalSecretsRole});
 }
 
-QVariantList TelemtConfigModel::additionalSecretsList() const {
-    QVariantList out;
-    out.reserve(m_protocolConfig.additionalSecrets.size());
-    for (const auto &s : m_protocolConfig.additionalSecrets) {
-        if (!s.isEmpty()) {
-            out.append(s);
-        }
-    }
-    return out;
-}
-
 void TelemtConfigModel::setEnabled(bool enabled) {
     m_protocolConfig.isEnabled = enabled;
     emit dataChanged(index(0), index(0), QList<int>{IsEnabledRole});
@@ -402,15 +348,15 @@ QString TelemtConfigModel::generateQrCode(const QString &text) {
 }
 
 QString TelemtConfigModel::defaultTlsDomain() const {
-    return protocols::telemt::defaultTlsDomain;
+    return QString::fromUtf8(protocols::telemt::defaultTlsDomain);
 }
 
 QString TelemtConfigModel::defaultPort() const {
-    return protocols::telemt::defaultPort;
+    return QString::fromUtf8(protocols::telemt::defaultPort);
 }
 
 QString TelemtConfigModel::defaultWorkers() const {
-    return protocols::telemt::defaultWorkers;
+    return QString::fromUtf8(protocols::telemt::defaultWorkers);
 }
 
 int TelemtConfigModel::maxWorkers() const {
@@ -418,303 +364,19 @@ int TelemtConfigModel::maxWorkers() const {
 }
 
 QString TelemtConfigModel::transportModeStandard() const {
-    return protocols::telemt::transportModeStandard;
+    return QString::fromUtf8(protocols::telemt::transportModeStandard);
 }
 
 QString TelemtConfigModel::transportModeFakeTLS() const {
-    return protocols::telemt::transportModeFakeTLS;
+    return QString::fromUtf8(protocols::telemt::transportModeFakeTLS);
 }
 
 QString TelemtConfigModel::workersModeAuto() const {
-    return protocols::telemt::workersModeAuto;
+    return QString::fromUtf8(protocols::telemt::workersModeAuto);
 }
 
 QString TelemtConfigModel::workersModeManual() const {
-    return protocols::telemt::workersModeManual;
-}
-
-bool TelemtConfigModel::isValidPublicHost(const QString &host) const {
-    const QString t = host.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    if (t.length() > 253) {
-        return false;
-    }
-    QHostAddress a(t);
-    if (a.protocol() == QHostAddress::IPv4Protocol) {
-        return NetworkUtilities::checkIPv4Format(t);
-    }
-    if (a.protocol() == QHostAddress::IPv6Protocol) {
-        if (a.isNull() || a.isLoopback() || a == QHostAddress(QHostAddress::AnyIPv6)) {
-            return false;
-        }
-        return true;
-    }
-    static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
-    if (onlyAsciiDigits.match(t).hasMatch()) {
-        return false;
-    }
-    return NetworkUtilities::domainRegExp().exactMatch(t);
-}
-
-bool TelemtConfigModel::isPublicHostInputAllowed(const QString &text) const {
-    return mtproxyPublicHostInputAllowed(text);
-}
-
-bool TelemtConfigModel::isPublicHostTypingIncomplete(const QString &text) const {
-    const QString t = text.trimmed();
-    if (isValidPublicHost(t)) {
-        return false;
-    }
-
-    static const QRegularExpression onlyDigitDot(QStringLiteral(R"(^[0-9.]+$)"));
-    if (onlyDigitDot.match(t).hasMatch()) {
-        if (t.endsWith(QLatin1Char('.'))) {
-            return true;
-        }
-        const QStringList parts = t.split(QLatin1Char('.'), Qt::KeepEmptyParts);
-        if (parts.size() < 4) {
-            return true;
-        }
-        for (const QString &part: parts) {
-            if (part.isEmpty()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    if (t.contains(QLatin1Char(':'))) {
-        if (t.contains(QLatin1String(":::"))) {
-            return false;
-        }
-        if (t.endsWith(QLatin1Char(':'))) {
-            return true;
-        }
-        QHostAddress a(t);
-        if (a.protocol() == QHostAddress::IPv6Protocol) {
-            return false;
-        }
-        if (!t.contains(QLatin1String("::")) && t.count(QLatin1Char(':')) < 7 && !t.contains(QLatin1Char('.'))) {
-            return true;
-        }
-        return false;
-    }
-
-    if (!t.contains(QLatin1Char('.'))) {
-        return true;
-    }
-
-    return false;
-}
-
-bool TelemtConfigModel::isValidMtProxyTag(const QString &tag) const {
-    if (tag.isEmpty()) {
-        return true;
-    }
-    static const QRegularExpression re(
-            QStringLiteral("^([0-9a-fA-F]{%1})$").arg(protocols::telemt::botTagHexLength));
-    return re.match(tag).hasMatch();
-}
-
-bool TelemtConfigModel::isMtProxyTagTypingIncomplete(const QString &text) const {
-    const QString t = text.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    static const QRegularExpression hexOnly(QStringLiteral(R"(^[0-9a-fA-F]*$)"));
-    if (!hexOnly.match(t).hasMatch()) {
-        return false;
-    }
-    return t.size() < protocols::telemt::botTagHexLength;
-}
-
-int TelemtConfigModel::mtProxyBotTagHexLength() const {
-    return protocols::telemt::botTagHexLength;
-}
-
-bool TelemtConfigModel::isValidFakeTlsDomain(const QString &domain) const {
-    const QString t = domain.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    if (t.length() > 253) {
-        return false;
-    }
-    QHostAddress addr;
-    if (addr.setAddress(t)) {
-        return false;
-    }
-    static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
-    if (onlyAsciiDigits.match(t).hasMatch()) {
-        return false;
-    }
-    QRegExp re(NetworkUtilities::domainRegExp());
-    re.setCaseSensitivity(Qt::CaseInsensitive);
-    if (!re.exactMatch(t)) {
-        return false;
-    }
-    if (t.toUtf8().size() > 111) {
-        return false;
-    }
-    return true;
-}
-
-QString TelemtConfigModel::normalizeFakeTlsDomainInput(const QString &input) const {
-    QString t = input.trimmed();
-    if (t.startsWith(QLatin1String("https://"), Qt::CaseInsensitive)) {
-        t = t.mid(8);
-    } else if (t.startsWith(QLatin1String("http://"), Qt::CaseInsensitive)) {
-        t = t.mid(7);
-    }
-    if (const int slash = t.indexOf(QLatin1Char('/')); slash >= 0) {
-        t = t.left(slash);
-    }
-    if (const int at = t.indexOf(QLatin1Char('@')); at >= 0) {
-        t = t.mid(at + 1);
-    }
-    if (const int colon = t.indexOf(QLatin1Char(':')); colon >= 0) {
-        t = t.left(colon);
-    }
-    if (t.startsWith(QLatin1String("www."), Qt::CaseInsensitive)) {
-        const QString rest = t.mid(4);
-        if (rest.contains(QLatin1Char('.'))) {
-            t = rest;
-        }
-    }
-    return t.trimmed();
-}
-
-bool TelemtConfigModel::isFakeTlsDomainTypingIncomplete(const QString &text) const {
-    const QString t = text.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    if (isValidFakeTlsDomain(t)) {
-        return false;
-    }
-    if (t.contains(QLatin1Char('/')) || t.contains(QLatin1Char(':')) || t.contains(QLatin1Char('@'))
-        || t.contains(QLatin1Char(' '))) {
-        return false;
-    }
-    if (t.contains(QLatin1String(".."))) {
-        return false;
-    }
-    if (!t.contains(QLatin1Char('.'))) {
-        return true;
-    }
-    if (t.endsWith(QLatin1Char('.'))) {
-        return true;
-    }
-    static const QRegularExpression legalPartial(QStringLiteral(R"(^[a-zA-Z0-9.-]*$)"));
-    if (!legalPartial.match(t).hasMatch()) {
-        return false;
-    }
-    return true;
-}
-
-bool TelemtConfigModel::isFakeTlsDomainInputAllowed(const QString &text) const {
-    if (text.length() > 253) {
-        return false;
-    }
-    static const QRegularExpression re(QStringLiteral(R"(^[a-zA-Z0-9.-]*$)"));
-    return re.match(text).hasMatch();
-}
-
-QString TelemtConfigModel::sanitizeFakeTlsDomainFieldText(const QString &input) const {
-    const QString t = normalizeFakeTlsDomainInput(input);
-    QString out;
-    out.reserve(t.size());
-    for (const QChar &c: t) {
-        const ushort u = c.unicode();
-        const bool letter = (u >= 'a' && u <= 'z') || (u >= 'A' && u <= 'Z');
-        const bool digit = (u >= '0' && u <= '9');
-        if (letter || digit || u == '.' || u == '-') {
-            out.append(c);
-        }
-    }
-    if (out.size() > 253) {
-        out.truncate(253);
-    }
-    return out;
-}
-
-QString TelemtConfigModel::sanitizePublicHostFieldText(const QString &input) const {
-    QString out;
-    const int cap = qMin(input.size(), 253);
-    out.reserve(cap);
-    for (const QChar &c: input) {
-        if (out.size() >= 253) {
-            break;
-        }
-        const ushort u = c.unicode();
-        if ((u >= 'a' && u <= 'z') || (u >= 'A' && u <= 'Z') || (u >= '0' && u <= '9') || u == '.' || u == ':' ||
-            u == '-') {
-            out.append(c);
-        }
-    }
-    return out;
-}
-
-QString TelemtConfigModel::sanitizePortFieldText(const QString &input) const {
-    QString out;
-    out.reserve(qMin(input.size(), 5));
-    for (const QChar &c: input) {
-        const ushort u = c.unicode();
-        if (u >= '0' && u <= '9' && out.size() < 5) {
-            out.append(c);
-        }
-    }
-    return out;
-}
-
-QString TelemtConfigModel::sanitizeMtProxyTagFieldText(const QString &input) const {
-    QString trimmed = input.trimmed();
-    if (trimmed.startsWith(QLatin1String("0x"), Qt::CaseInsensitive)) {
-        trimmed = trimmed.mid(2).trimmed();
-    }
-    static const QRegularExpression runHex(QStringLiteral(R"(([0-9a-fA-F]{32}))"));
-    const QRegularExpressionMatch m = runHex.match(trimmed);
-    if (m.hasMatch()) {
-        return m.captured(1);
-    }
-    const int cap = protocols::telemt::botTagHexLength;
-    QString out;
-    out.reserve(qMin(trimmed.size(), cap));
-    for (const QChar &c: trimmed) {
-        if (out.size() >= cap) {
-            break;
-        }
-        const ushort u = c.unicode();
-        if ((u >= '0' && u <= '9') || (u >= 'a' && u <= 'f') || (u >= 'A' && u <= 'F')) {
-            out.append(c);
-        }
-    }
-    return out;
-}
-
-QString TelemtConfigModel::sanitizeOptionalIpv4FieldText(const QString &input) const {
-    QString out;
-    out.reserve(qMin(input.size(), 15));
-    for (const QChar &c: input) {
-        if (out.size() >= 15) {
-            break;
-        }
-        const ushort u = c.unicode();
-        if ((u >= '0' && u <= '9') || u == '.') {
-            out.append(c);
-        }
-    }
-    return out;
-}
-
-bool TelemtConfigModel::isValidOptionalIpv4(const QString &ip) const {
-    const QString t = ip.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    return NetworkUtilities::checkIPv4Format(t);
+    return QString::fromUtf8(protocols::telemt::workersModeManual);
 }
 
 QHash<int, QByteArray> TelemtConfigModel::roleNames() const {

client/ui/models/services/telemtConfigModel.h

@@ -88,8 +88,6 @@ public slots:
 
     Q_INVOKABLE void removeAdditionalSecret(int idx);
 
-    Q_INVOKABLE QVariantList additionalSecretsList() const;
-
     Q_INVOKABLE QString generateQrCode(const QString &text);
 
     Q_INVOKABLE void setEnabled(bool enabled);
@@ -118,44 +116,12 @@ public slots:
 
     Q_INVOKABLE QString workersModeManual() const;
 
-    Q_INVOKABLE bool isValidPublicHost(const QString &host) const;
-
-    Q_INVOKABLE bool isPublicHostInputAllowed(const QString &text) const;
-
-    Q_INVOKABLE bool isPublicHostTypingIncomplete(const QString &text) const;
-
-    Q_INVOKABLE bool isValidMtProxyTag(const QString &tag) const;
-
-    Q_INVOKABLE bool isMtProxyTagTypingIncomplete(const QString &text) const;
-
-    Q_INVOKABLE int mtProxyBotTagHexLength() const;
-
-    Q_INVOKABLE bool isValidFakeTlsDomain(const QString &domain) const;
-
-    Q_INVOKABLE bool isFakeTlsDomainTypingIncomplete(const QString &text) const;
-
-    Q_INVOKABLE bool isFakeTlsDomainInputAllowed(const QString &text) const;
-
-    Q_INVOKABLE QString sanitizeFakeTlsDomainFieldText(const QString &input) const;
-
-    Q_INVOKABLE QString sanitizePublicHostFieldText(const QString &input) const;
-
-    Q_INVOKABLE QString sanitizePortFieldText(const QString &input) const;
-
-    Q_INVOKABLE QString sanitizeMtProxyTagFieldText(const QString &input) const;
-
-    Q_INVOKABLE QString sanitizeOptionalIpv4FieldText(const QString &input) const;
-
-    Q_INVOKABLE bool isValidOptionalIpv4(const QString &ip) const;
-
 protected:
     QHash<int, QByteArray> roleNames() const override;
 
 private:
     static void applyDefaults(amnezia::TelemtProtocolConfig &c);
 
-    QString normalizeFakeTlsDomainInput(const QString &input) const;
-
     amnezia::DockerContainer m_container = amnezia::DockerContainer::None;
     QJsonObject m_fullConfig;
     amnezia::TelemtProtocolConfig m_protocolConfig;

client/ui/models/utils/mtproxy_public_host_input.cpp

@@ -1,4 +1,4 @@
-#include "mtProxyPublicHostInput.h"
+#include "mtproxy_public_host_input.h"
 
 #include <QRegularExpression>
 

client/ui/models/utils/mtproxy_public_host_input.h

@@ -1,5 +1,5 @@
-#ifndef MTPROXYPUBLICHOSTINPUT_H
-#define MTPROXYPUBLICHOSTINPUT_H
+#ifndef MTPROXY_PUBLIC_HOST_INPUT_H
+#define MTPROXY_PUBLIC_HOST_INPUT_H
 
 #include <QString>
 

client/ui/qml/Controls2/CaptchaDialogType.qml

@@ -20,42 +20,13 @@ Popup {
     signal captchaSolved(string captchaId, string solution)
     signal refreshCaptchaRequested()
 
-    readonly property int keyboardHeight: {
-        if (PageController.imeHeight > 0) {
-            return PageController.imeHeight
-        }
-        if (Qt.platform.os === "ios" && Qt.inputMethod.visible) {
-            const r = Qt.inputMethod.keyboardRectangle
-            if (r.height <= 0) {
-                return 0
-            }
-            return Math.max(0, Math.round(parent.height - r.y))
-        }
-        return 0
-    }
-
     leftMargin: 25
     rightMargin: 25
     bottomMargin: 70 + SettingsController.safeAreaBottomMargin
 
     width: parent.width - leftMargin - rightMargin
 
-    x: Math.round((parent.width - width) / 2)
-    y: {
-        const centered = Math.round((parent.height - height) / 2)
-        if (root.keyboardHeight === 0) {
-            return centered
-        }
-        return Math.max(20, Math.min(centered, parent.height - root.keyboardHeight - height - 16))
-    }
-
-    Behavior on y {
-        NumberAnimation {
-            duration: 150
-            easing.type: Easing.OutCubic
-        }
-    }
-
+    anchors.centerIn: parent
     modal: true
     closePolicy: Popup.NoAutoClose
 
@@ -66,7 +37,7 @@ Popup {
     onOpened: {
         timer.start()
         solutionField.textField.text = ""
-        solutionField.textField.forceActiveFocus()
+        solutionField.textField.focus = true
     }
 
     onCaptchaIdChanged: {

client/ui/qml/Controls2/ContextMenuType.qml

@@ -4,7 +4,7 @@ import QtQuick.Controls
 Menu {
     property var textObj
 
-    popupType: Qt.platform.os === "ios" ? Popup.Item : Popup.Native
+    popupType: Popup.Native
 
     property Item inputBlocker: null
 

client/ui/qml/Controls2/TextAreaType.qml

@@ -93,9 +93,7 @@ Rectangle {
 
                 wrapMode: Text.Wrap
 
-                ContextMenu.menu: Qt.platform.os === "ios" ? null : contextMenu
-
-                ContextMenuType {
+                ContextMenu.menu: ContextMenuType {
                     id: contextMenu
                     textObj: textArea
                 }

client/ui/qml/Controls2/TextAreaWithFooterType.qml

@@ -79,9 +79,7 @@ Rectangle {
 
                 wrapMode: Text.Wrap
 
-                ContextMenu.menu: Qt.platform.os === "ios" ? null : contextMenu
-
-                ContextMenuType {
+                ContextMenu.menu: ContextMenuType {
                     id: contextMenu
                     textObj: textArea
                 }

client/ui/qml/Controls2/TextFieldWithHeaderType.qml

@@ -144,9 +144,7 @@ Item {
                             }
                         }
 
-                        ContextMenu.menu: Qt.platform.os === "ios" ? null : contextMenu
-
-                        ContextMenuType {
+                        ContextMenu.menu: ContextMenuType {
                             id: contextMenu
                             textObj: textField
                         }

client/ui/qml/Pages2/PageHome.qml

@@ -21,41 +21,6 @@ PageType {
 
     property var containersDropDownRef: null
 
-    property var apiAvailableProtocols: []
-    property string apiCurrentProtocol: ""
-
-    readonly property bool isApiProtocolSelectionVisible: ServersUiController.isDefaultServerFromApi && root.apiAvailableProtocols.length > 0
-
-    function updateApiProtocolState() {
-        if (ServersUiController.isDefaultServerFromApi) {
-            root.apiAvailableProtocols = SubscriptionUiController.availableProtocols(ServersUiController.defaultServerId)
-            root.apiCurrentProtocol = SubscriptionUiController.currentProtocol(ServersUiController.defaultServerId)
-        } else {
-            root.apiAvailableProtocols = []
-            root.apiCurrentProtocol = ""
-        }
-    }
-
-    function protocolDisplayName(protocol) {
-        switch (protocol) {
-        case "awg": return "AmneziaWG"
-        case "vless": return "VLESS"
-        default: return protocol
-        }
-    }
-
-    Component.onCompleted: {
-        root.updateApiProtocolState()
-    }
-
-    Connections {
-        target: ServersUiController
-
-        function onDefaultServerIdChanged() {
-            root.updateApiProtocolState()
-        }
-    }
-
     Connections {
         target: Qt.application
 
@@ -245,10 +210,6 @@ PageType {
                     drawer.collapsedHeight = collapsed.implicitHeight
                 }
 
-                onImplicitHeightChanged: {
-                    drawer.collapsedHeight = collapsed.implicitHeight
-                }
-
                 DividerType {
                     Layout.topMargin: 10
                     Layout.fillWidth: false
@@ -350,7 +311,7 @@ PageType {
                     objectName: "rowLayoutLabel"
                     Layout.alignment: Qt.AlignHCenter | Qt.AlignVCenter
                     Layout.topMargin: 8
-                    Layout.bottomMargin: root.isApiProtocolSelectionVisible ? 8 : (drawer.isCollapsedStateActive ? 44 : ServersUiController.isDefaultServerFromApi ? 61 : 16)
+                    Layout.bottomMargin: drawer.isCollapsedStateActive ? 44 : ServersUiController.isDefaultServerFromApi ? 61 : 16
                     spacing: 0
 
                     BasicButtonType {
@@ -404,61 +365,6 @@ PageType {
                         }
                     }
                 }
-
-                RowLayout {
-                    objectName: "protocolRowLayout"
-                    Layout.alignment: Qt.AlignHCenter | Qt.AlignVCenter
-                    Layout.bottomMargin: drawer.isCollapsedStateActive ? 44 : 61
-                    spacing: 0
-
-                    visible: root.isApiProtocolSelectionVisible
-
-                    BasicButtonType {
-                        id: protocolButton
-                        objectName: "protocolButton"
-
-                        enabled: root.apiAvailableProtocols.length > 1
-                        hoverEnabled: enabled
-
-                        implicitHeight: 36
-
-                        leftPadding: 16
-                        rightPadding: 16
-
-                        defaultColor: AmneziaStyle.color.transparent
-                        hoveredColor: AmneziaStyle.color.translucentWhite
-                        pressedColor: AmneziaStyle.color.sheerWhite
-                        disabledColor: AmneziaStyle.color.transparent
-                        textColor: AmneziaStyle.color.mutedGray
-
-                        buttonTextLabel.lineHeight: 16
-                        buttonTextLabel.font.pixelSize: 13
-                        buttonTextLabel.font.weight: 400
-
-                        text: root.apiAvailableProtocols.length > 1
-                            ? root.protocolDisplayName(root.apiCurrentProtocol)
-                            : root.protocolDisplayName(root.apiAvailableProtocols[0])
-                        leftImageSource: "qrc:/images/controls/arrow-left-right.svg"
-                        leftImageColor: AmneziaStyle.color.mutedGray
-
-                        rightImageSource: enabled ? "qrc:/images/controls/chevron-down.svg" : ""
-
-                        Keys.onEnterPressed: this.clicked()
-                        Keys.onReturnPressed: this.clicked()
-
-                        onClicked: {
-                            if (ConnectionController.isConnectionInProgress) {
-                                PageController.showNotificationMessage(qsTr("Unable change protocol while trying to make an active connection"))
-                                return
-                            }
-                            if (ConnectionController.isConnected) {
-                                PageController.showNotificationMessage(qsTr("Cannot change protocol during active connection"))
-                                return
-                            }
-                            protocolSelectionDrawer.openTriggered()
-                        }
-                    }
-                }
             }
 
             ColumnLayout {
@@ -573,119 +479,4 @@ PageType {
             }
         }
     }
-
-    DrawerType2 {
-        id: protocolSelectionDrawer
-        objectName: "protocolSelectionDrawer"
-
-        anchors.fill: parent
-
-        expandedStateContent: Item {
-            id: protocolDrawerContainer
-
-            implicitHeight: root.height * 0.5
-
-            Component.onCompleted: {
-                protocolSelectionDrawer.expandedHeight = protocolDrawerContainer.implicitHeight
-            }
-
-            ColumnLayout {
-                id: protocolDrawerHeader
-
-                anchors.top: parent.top
-                anchors.left: parent.left
-                anchors.right: parent.right
-                anchors.topMargin: 16
-
-                BackButtonType {
-                    id: protocolDrawerBackButton
-
-                    Layout.fillWidth: true
-
-                    backButtonImage: "qrc:/images/controls/arrow-left.svg"
-                    backButtonFunction: function() { protocolSelectionDrawer.closeTriggered() }
-                }
-
-                Header2Type {
-                    Layout.fillWidth: true
-                    Layout.topMargin: 16
-                    Layout.leftMargin: 16
-                    Layout.rightMargin: 16
-
-                    headerText: qsTr("VPN protocol")
-                }
-            }
-
-            ListViewType {
-                id: protocolDrawerListView
-
-                anchors.top: protocolDrawerHeader.bottom
-                anchors.left: parent.left
-                anchors.right: parent.right
-                anchors.bottom: parent.bottom
-                anchors.topMargin: 16
-
-                model: root.apiAvailableProtocols
-
-                ButtonGroup {
-                    id: protocolDrawerButtonGroup
-                }
-
-                delegate: Item {
-                    implicitWidth: protocolDrawerListView.width
-                    implicitHeight: protocolDrawerDelegate.implicitHeight
-
-                    ColumnLayout {
-                        id: protocolDrawerDelegate
-
-                        anchors.fill: parent
-                        anchors.leftMargin: 16
-                        anchors.rightMargin: 16
-
-                        VerticalRadioButton {
-                            id: protocolDrawerRadioButton
-
-                            Layout.fillWidth: true
-
-                            text: root.protocolDisplayName(modelData)
-
-                            ButtonGroup.group: protocolDrawerButtonGroup
-
-                            checkable: !ConnectionController.isConnected
-                            checked: modelData === root.apiCurrentProtocol
-
-                            onClicked: {
-                                protocolSelectionDrawer.closeTriggered()
-
-                                if (modelData === root.apiCurrentProtocol) {
-                                    return
-                                }
-
-                                if (ConnectionController.isConnected) {
-                                    PageController.showNotificationMessage(qsTr("Cannot change protocol during active connection"))
-                                    return
-                                }
-
-                                PageController.showBusyIndicator(true)
-                                ServersUiController.setProcessedServerId(ServersUiController.defaultServerId)
-                                SubscriptionUiController.setCurrentProtocol(ServersUiController.defaultServerId, modelData)
-                                if (!SubscriptionUiController.updateServiceFromGateway(ServersUiController.defaultServerId, "", "", true)) {
-                                    SubscriptionUiController.setCurrentProtocol(ServersUiController.defaultServerId, root.apiCurrentProtocol)
-                                }
-                                root.updateApiProtocolState()
-                                PageController.showBusyIndicator(false)
-                            }
-
-                            Keys.onEnterPressed: protocolDrawerRadioButton.clicked()
-                            Keys.onReturnPressed: protocolDrawerRadioButton.clicked()
-                        }
-
-                        DividerType {
-                            Layout.fillWidth: true
-                        }
-                    }
-                }
-            }
-        }
-    }
 }

client/ui/qml/Pages2/PageSettingsApiServerInfo.qml

@@ -259,9 +259,41 @@ PageType {
             }
 
             DividerType {
-                visible: (!root.isSubscriptionExpired && !root.isSubscriptionExpiringSoon
-                    && root.isSubscriptionRenewalAvailable && !root.isInAppPurchase)
-                    || footer.isVisibleForAmneziaFree
+                visible: !root.isSubscriptionExpired && !root.isSubscriptionExpiringSoon
+                    && root.isSubscriptionRenewalAvailable && !root.isInAppPurchase
+            }
+
+            SwitcherType {
+                id: switcher
+
+                readonly property bool isVlessProtocol: SubscriptionUiController.isVlessProtocol(ServersUiController.processedServerId)
+                readonly property bool isProtocolSwitchBlocked: ServersUiController.isDefaultServerCurrentlyProcessed() && ConnectionController.isConnected
+
+                Layout.fillWidth: true
+                Layout.topMargin: 24
+                Layout.rightMargin: 16
+                Layout.leftMargin: 16
+                Layout.bottomMargin: 24
+
+                visible: ApiAccountInfoModel.data("isProtocolSelectionSupported")
+                enabled: !switcher.isProtocolSwitchBlocked
+
+                text: qsTr("Use VLESS protocol")
+                checked: switcher.isVlessProtocol
+                onToggled: function() {
+                    if (ServersUiController.isDefaultServerCurrentlyProcessed() && ConnectionController.isConnected) {
+                        PageController.showNotificationMessage(qsTr("Cannot change protocol during active connection"))
+                    } else {
+                        PageController.showBusyIndicator(true)
+                        SubscriptionUiController.setCurrentProtocol(ServersUiController.processedServerId, switcher.isVlessProtocol ? "awg" : "vless")
+                        SubscriptionUiController.updateServiceFromGateway(ServersUiController.processedServerId, "", "", true)
+                        PageController.showBusyIndicator(false)
+                    }
+                }
+            }
+
+            DividerType {
+                visible: footer.isVisibleForAmneziaFree
             }
 
             WarningType {

client/ui/qml/Pages2/PageSettingsBackup.qml

@@ -17,8 +17,6 @@ import "../Controls2/TextTypes"
 PageType {
     id: root
 
-    property bool isRestoringBackup: false
-
     Connections {
         target: SettingsController
 
@@ -136,14 +134,9 @@ PageType {
                 textColor: AmneziaStyle.color.paleGray
                 borderWidth: 1
 
-                enabled: !root.isRestoringBackup
-
                 text: qsTr("Restore from backup")
 
                 clickedFunc: function() {
-                    if (root.isRestoringBackup) {
-                        return
-                    }
                     var filePath = SystemController.getFileName(qsTr("Open backup file"),
                                                                 qsTr("Backup files (*.backup)"))
                     if (filePath !== "") {
@@ -155,10 +148,6 @@ PageType {
     }
 
     function restoreBackup(filePath) {
-        if (root.isRestoringBackup) {
-            return
-        }
-
         var headerText = qsTr("Import settings from a backup file?")
         var descriptionText = qsTr("All current settings will be reset");
         var yesButtonText = qsTr("Continue")
@@ -168,13 +157,9 @@ PageType {
             if (ConnectionController.isConnected) {
                 PageController.showNotificationMessage(qsTr("Cannot restore backup settings during active connection"))
             } else {
-                root.isRestoringBackup = true
                 PageController.showBusyIndicator(true)
-                Qt.callLater(function() {
-                    SettingsController.restoreAppConfig(filePath)
-                    PageController.showBusyIndicator(false)
-                    root.isRestoringBackup = false
-                })
+                SettingsController.restoreAppConfig(filePath)
+                PageController.showBusyIndicator(false)
             }
         }
         var noButtonFunction = function() {

client/ui/qml/Pages2/PageSetupWizardConfigSource.qml

@@ -16,8 +16,6 @@ import "../Config"
 PageType {
     id: root
 
-    property bool isRestoringBackup: false
-
     Connections {
         target: ImportController
 
@@ -230,8 +228,6 @@ PageType {
                 rightImageSource: "qrc:/images/controls/chevron-right.svg"
                 leftImageSource: imageSource
 
-                enabled: !root.isRestoringBackup
-
                 onClicked: { handler() }
 
                 Keys.onEnterPressed: this.clicked()
@@ -318,19 +314,12 @@ PageType {
         property string imageSource: "qrc:/images/controls/archive-restore.svg"
         property bool isVisible: PageController.isStartPageVisible()
         property var handler: function() {
-            if (root.isRestoringBackup) {
-                return
-            }
             var filePath = SystemController.getFileName(qsTr("Open backup file"),
                                                         qsTr("Backup files (*.backup)"))
             if (filePath !== "") {
-                root.isRestoringBackup = true
                 PageController.showBusyIndicator(true)
-                Qt.callLater(function() {
-                    SettingsController.restoreAppConfig(filePath)
-                    PageController.showBusyIndicator(false)
-                    root.isRestoringBackup = false
-                })
+                SettingsController.restoreAppConfig(filePath)
+                PageController.showBusyIndicator(false)
             }
         }
     }

client/ui/qml/Pages2/PageShareConnection.qml

@@ -320,7 +320,7 @@ PageType {
                 Layout.rightMargin: 16
                 visible: isQrCodeVisible
                 horizontalAlignment: Text.AlignHCenter
-                text: qsTr("To read the QR code in the Amnezia app, tap + in the main menu → 'QR code'")
+                text: qsTr("To read the QR code in the Amnezia app, select \"Add server\" → \"I have data to connect\" → \"QR code, key or settings file\"")
             }
         }
     }

client/vpnConnection.cpp

@@ -17,6 +17,7 @@
 #ifdef AMNEZIA_DESKTOP
     #include "core/utils/ipcClient.h"
     #include <core/protocols/wireGuardProtocol.h>
+    #include "daemon/wireguardutils.h"
 #endif
 
 #ifdef Q_OS_ANDROID
@@ -127,6 +128,23 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
                 else
                     qWarning() << "VpnConnection::onConnectionStateChanged: Failed to flush DNS";
 
+#ifdef Q_OS_LINUX
+                if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
+                    QString dns1 = m_vpnConfiguration.value(configKey::dns1).toString();
+                    QString dns2 = m_vpnConfiguration.value(configKey::dns2).toString();
+                    QList<QHostAddress> resolvers;
+                    if (!dns1.isEmpty()) resolvers << QHostAddress(dns1);
+                    if (!dns2.isEmpty()) resolvers << QHostAddress(dns2);
+                    if (!resolvers.isEmpty()) {
+                        auto r = iface->updateResolvers(WG_INTERFACE, resolvers);
+                        if (r.waitForFinished() && r.returnValue())
+                            qDebug() << "VpnConnection: DNS resolvers set via systemd-resolved";
+                        else
+                            qWarning() << "VpnConnection: Failed to set DNS resolvers";
+                    }
+                }
+#endif
+
                 if (!ContainerUtils::isAwgContainer(container) && container != DockerContainer::WireGuard) {
                     QString dns1 = m_vpnConfiguration.value(configKey::dns1).toString();
                     QString dns2 = m_vpnConfiguration.value(configKey::dns2).toString();
@@ -160,6 +178,11 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
             } break;
             case Vpn::ConnectionState::Disconnected:
             case Vpn::ConnectionState::Error: {
+#ifdef Q_OS_LINUX
+                if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
+                    iface->restoreResolvers();
+                }
+#endif
                 auto flushDns = iface->flushDns();
                 if (flushDns.waitForFinished() && flushDns.returnValue())
                     qDebug() << "VpnConnection::onConnectionStateChanged: Successfully flushed DNS";

cmake/platform_settings.cmake

@@ -12,7 +12,7 @@ if(APPLE)
         set(CMAKE_OSX_ARCHITECTURES "arm64;x86_64" CACHE STRING "" FORCE)
     else()
         set(CMAKE_OSX_DEPLOYMENT_TARGET "13.0" CACHE STRING "" FORCE)
-        set(CMAKE_OSX_ARCHITECTURES "arm64;x86_64" CACHE STRING "" FORCE)
+        set(CMAKE_OSX_ARCHITECTURES "x86_64" CACHE STRING "" FORCE)
     endif()
 endif()
 

common/crypto/cryptoUtils.cpp

@@ -1,180 +0,0 @@
-#include "cryptoUtils.h"
-
-#include <memory>
-
-#include <QDebug>
-
-#include <openssl/err.h>
-#include <openssl/pem.h>
-#include <openssl/rand.h>
-
-namespace
-{
-    constexpr int kAesKeySize = 32;   // AES-256
-    constexpr int kAesIvSize = 16;    // CBC block size
-    constexpr int kAesBlockSize = 16;
-
-    QByteArray lastOpenSslError()
-    {
-        return QByteArray(ERR_error_string(ERR_get_error(), nullptr));
-    }
-}
-
-QByteArray CryptoUtils::generateRandomBytes(int size)
-{
-    if (size <= 0) {
-        qCritical() << "CryptoUtils::generateRandomBytes invalid size" << size;
-        return {};
-    }
-
-    QByteArray buffer(size, Qt::Uninitialized);
-    if (RAND_bytes(reinterpret_cast<unsigned char *>(buffer.data()), size) != 1) {
-        qCritical() << "CryptoUtils::generateRandomBytes RAND_bytes failed:" << lastOpenSslError();
-        return {};
-    }
-
-    return buffer;
-}
-
-QByteArray CryptoUtils::encryptAes256Cbc(const QByteArray &data, const QByteArray &key, const QByteArray &iv)
-{
-    if (key.size() != kAesKeySize || iv.size() < kAesIvSize) {
-        qCritical() << "CryptoUtils::encryptAes256Cbc invalid key/iv size" << key.size() << iv.size();
-        return {};
-    }
-
-    std::unique_ptr<EVP_CIPHER_CTX, decltype(&EVP_CIPHER_CTX_free)> ctx { EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free };
-    if (!ctx) {
-        qCritical() << "CryptoUtils::encryptAes256Cbc EVP_CIPHER_CTX_new failed:" << lastOpenSslError();
-        return {};
-    }
-
-    if (EVP_EncryptInit_ex(ctx.get(), EVP_aes_256_cbc(), nullptr, reinterpret_cast<const unsigned char *>(key.constData()),
-                           reinterpret_cast<const unsigned char *>(iv.constData()))
-        != 1) {
-        qCritical() << "CryptoUtils::encryptAes256Cbc EVP_EncryptInit_ex failed:" << lastOpenSslError();
-        return {};
-    }
-
-    QByteArray cipherText(data.size() + kAesBlockSize, Qt::Uninitialized);
-    int length = 0;
-    int cipherTextLength = 0;
-
-    if (EVP_EncryptUpdate(ctx.get(), reinterpret_cast<unsigned char *>(cipherText.data()), &length,
-                          reinterpret_cast<const unsigned char *>(data.constData()), data.size())
-        != 1) {
-        qCritical() << "CryptoUtils::encryptAes256Cbc EVP_EncryptUpdate failed:" << lastOpenSslError();
-        return {};
-    }
-    cipherTextLength = length;
-
-    if (EVP_EncryptFinal_ex(ctx.get(), reinterpret_cast<unsigned char *>(cipherText.data()) + cipherTextLength, &length) != 1) {
-        qCritical() << "CryptoUtils::encryptAes256Cbc EVP_EncryptFinal_ex failed:" << lastOpenSslError();
-        return {};
-    }
-    cipherTextLength += length;
-
-    cipherText.resize(cipherTextLength);
-    return cipherText;
-}
-
-QByteArray CryptoUtils::decryptAes256Cbc(const QByteArray &data, const QByteArray &key, const QByteArray &iv)
-{
-    if (key.size() != kAesKeySize || iv.size() < kAesIvSize) {
-        qCritical() << "CryptoUtils::decryptAes256Cbc invalid key/iv size" << key.size() << iv.size();
-        return {};
-    }
-
-    std::unique_ptr<EVP_CIPHER_CTX, decltype(&EVP_CIPHER_CTX_free)> ctx { EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free };
-    if (!ctx) {
-        qCritical() << "CryptoUtils::decryptAes256Cbc EVP_CIPHER_CTX_new failed:" << lastOpenSslError();
-        return {};
-    }
-
-    if (EVP_DecryptInit_ex(ctx.get(), EVP_aes_256_cbc(), nullptr, reinterpret_cast<const unsigned char *>(key.constData()),
-                           reinterpret_cast<const unsigned char *>(iv.constData()))
-        != 1) {
-        qCritical() << "CryptoUtils::decryptAes256Cbc EVP_DecryptInit_ex failed:" << lastOpenSslError();
-        return {};
-    }
-
-    QByteArray plainText(data.size() + kAesBlockSize, Qt::Uninitialized);
-    int length = 0;
-    int plainTextLength = 0;
-
-    if (EVP_DecryptUpdate(ctx.get(), reinterpret_cast<unsigned char *>(plainText.data()), &length,
-                          reinterpret_cast<const unsigned char *>(data.constData()), data.size())
-        != 1) {
-        qCritical() << "CryptoUtils::decryptAes256Cbc EVP_DecryptUpdate failed:" << lastOpenSslError();
-        return {};
-    }
-    plainTextLength = length;
-
-    if (EVP_DecryptFinal_ex(ctx.get(), reinterpret_cast<unsigned char *>(plainText.data()) + plainTextLength, &length) != 1) {
-        qCritical() << "CryptoUtils::decryptAes256Cbc EVP_DecryptFinal_ex failed:" << lastOpenSslError();
-        return {};
-    }
-    plainTextLength += length;
-
-    plainText.resize(plainTextLength);
-    return plainText;
-}
-
-EVP_PKEY *CryptoUtils::loadPublicKeyFromPem(const QByteArray &pem)
-{
-    std::unique_ptr<BIO, decltype(&BIO_free)> bio { BIO_new_mem_buf(pem.constData(), pem.size()), BIO_free };
-    if (!bio) {
-        qCritical() << "CryptoUtils::loadPublicKeyFromPem BIO_new_mem_buf failed:" << lastOpenSslError();
-        return nullptr;
-    }
-
-    EVP_PKEY *key = PEM_read_bio_PUBKEY(bio.get(), nullptr, nullptr, nullptr);
-    if (!key) {
-        qCritical() << "CryptoUtils::loadPublicKeyFromPem PEM_read_bio_PUBKEY failed:" << lastOpenSslError();
-        return nullptr;
-    }
-
-    return key;
-}
-
-QByteArray CryptoUtils::rsaEncrypt(const QByteArray &data, EVP_PKEY *publicKey, int padding)
-{
-    if (!publicKey) {
-        qCritical() << "CryptoUtils::rsaEncrypt public key is null";
-        return {};
-    }
-
-    std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> ctx { EVP_PKEY_CTX_new(publicKey, nullptr), EVP_PKEY_CTX_free };
-    if (!ctx) {
-        qCritical() << "CryptoUtils::rsaEncrypt EVP_PKEY_CTX_new failed:" << lastOpenSslError();
-        return {};
-    }
-
-    if (EVP_PKEY_encrypt_init(ctx.get()) != 1) {
-        qCritical() << "CryptoUtils::rsaEncrypt EVP_PKEY_encrypt_init failed:" << lastOpenSslError();
-        return {};
-    }
-
-    if (EVP_PKEY_CTX_set_rsa_padding(ctx.get(), padding) != 1) {
-        qCritical() << "CryptoUtils::rsaEncrypt EVP_PKEY_CTX_set_rsa_padding failed:" << lastOpenSslError();
-        return {};
-    }
-
-    const auto *plainData = reinterpret_cast<const unsigned char *>(data.constData());
-
-    std::size_t cipherTextLength = 0;
-    if (EVP_PKEY_encrypt(ctx.get(), nullptr, &cipherTextLength, plainData, data.size()) != 1) {
-        qCritical() << "CryptoUtils::rsaEncrypt couldn't determine buffer length:" << lastOpenSslError();
-        return {};
-    }
-
-    QByteArray cipherText(static_cast<int>(cipherTextLength), Qt::Uninitialized);
-    if (EVP_PKEY_encrypt(ctx.get(), reinterpret_cast<unsigned char *>(cipherText.data()), &cipherTextLength, plainData, data.size())
-        != 1) {
-        qCritical() << "CryptoUtils::rsaEncrypt EVP_PKEY_encrypt failed:" << lastOpenSslError();
-        return {};
-    }
-
-    cipherText.resize(static_cast<int>(cipherTextLength));
-    return cipherText;
-}

common/crypto/cryptoUtils.h

@@ -1,35 +0,0 @@
-#ifndef CRYPTOUTILS_H
-#define CRYPTOUTILS_H
-
-#include <QByteArray>
-
-#include <openssl/evp.h>
-
-// Thin wrapper around OpenSSL EVP used for local settings encryption and for
-// the API-gateway request/response envelope. Replaces the unmaintained
-// QSimpleCrypto library. All functions report failures by returning an empty
-// QByteArray (or nullptr) and logging, without throwing.
-//
-// Wire compatibility note: encryptAes256Cbc/decryptAes256Cbc reproduce the exact
-// behaviour of QSimpleCrypto::QBlockCipher (AES-256-CBC, PKCS7 padding, first
-// 16 bytes of the IV buffer), so data written by previous app versions stays
-// readable and gateway requests keep the same format.
-namespace CryptoUtils
-{
-    // Cryptographically secure random bytes of the requested size.
-    QByteArray generateRandomBytes(int size);
-
-    // AES-256-CBC with PKCS7 padding. key must be 32 bytes, iv must be at least
-    // 16 bytes (only the first 16 are used, matching the legacy behaviour).
-    QByteArray encryptAes256Cbc(const QByteArray &data, const QByteArray &key, const QByteArray &iv);
-    QByteArray decryptAes256Cbc(const QByteArray &data, const QByteArray &key, const QByteArray &iv);
-
-    // Loads an RSA public key from PEM bytes. Returns nullptr on failure.
-    // The caller owns the result and must free it with EVP_PKEY_free().
-    EVP_PKEY *loadPublicKeyFromPem(const QByteArray &pem);
-
-    // RSA encryption with the given OpenSSL padding (e.g. RSA_PKCS1_PADDING).
-    QByteArray rsaEncrypt(const QByteArray &data, EVP_PKEY *publicKey, int padding);
-}
-
-#endif // CRYPTOUTILS_H

conanfile.py

@@ -19,26 +19,26 @@ class AmneziaVPN(ConanFile):
 
         if has_service:
             if os == "Windows":
-                self.requires("awg-windows/0.2.0")
+                self.requires("awg-windows/0.1.9")
                 self.requires("tap-windows6/9.27.0")
                 self.requires("win-split-tunnel/1.2.5.0")
                 self.requires("wintun/0.14.1")
             else:
-                self.requires("awg-go/0.2.19")
+                self.requires("awg-go/0.2.18")
 
-            self.requires("amnezia-xray-bindings/1.2.0")
+            self.requires("amnezia-xray-bindings/1.1.0")
             self.requires("tun2socks/2.6.0")
             self.requires("openvpn/2.7.0")
             self.requires("v2ray-rules-dat/202603162227")
 
         if has_ne:
-            self.requires("awg-apple/2.0.3")
+            self.requires("awg-apple/2.0.2")
             self.requires("hev-socks5-tunnel/2.15.0", options={"as_framework": True})
             self.requires("openvpnadapter/1.0.0")
 
         if os == "Android":
-            self.requires("amnezia-libxray/1.0.1")
-            self.requires("awg-android/2.0.2")
+            self.requires("amnezia-libxray/1.0.0")
+            self.requires("awg-android/2.0.1")
             self.requires("openvpn-pt-android/1.0.0")
 
         # expicitly use libssh@amnezia to prevent it from being downloaded from conan-center

recipes/amnezia-libxray/conanfile.py

@@ -11,7 +11,7 @@ from pathlib import Path
 
 class AmneziaLibxray(ConanFile):
     name = "amnezia-libxray"
-    version = "1.0.1"
+    version = "1.0.0"
     settings = "os", "arch", "compiler"
 
     def configure(self):
@@ -29,8 +29,8 @@ class AmneziaLibxray(ConanFile):
             raise ConanInvalidConfiguration(f"{self.name} v{self.version} does not support {self.settings.os}")
 
     def source(self):
-        get(self, f"https://github.com/amnezia-vpn/amnezia-libxray/archive/refs/tags/v{self.version}.zip",
-            sha256="f17bca781d4a2fad4dfda9e8b1c0f6960a3f75f6218b906b1b0e2458652ffa5a", strip_root=True
+        get(self, "https://github.com/amnezia-vpn/amnezia-libxray/archive/refs/tags/v1.0.0.zip",
+            sha256="0c50c5acd5063a9fc3cfbb5b3e11481d30cfa3762b3cb1d72130248ff498e9df", strip_root=True
         )
 
     def generate(self):

recipes/amnezia-xray-bindings/conanfile.py

@@ -3,25 +3,14 @@ from conan.tools.files import get, copy, collect_libs, chdir, rename
 from conan.tools.layout import basic_layout
 from conan.errors import ConanInvalidConfiguration
 from conan.tools.gnu import Autotools, AutotoolsToolchain
-from conan.tools.apple import XCRun, is_apple_os
-from conan.tools.apple.apple import _to_apple_arch
-from conan.tools.env import Environment
 
 import os
-import shlex
-
 
 class AmneziaXrayBindings(ConanFile):
     name = "amnezia-xray-bindings"
-    version = "1.2.0"
+    version = "1.1.0"
     settings = "os", "arch", "compiler"
 
-    _arch_map = {
-        "x86": "386",
-        "x86_64": "amd64",
-        "armv8": "arm64"
-    }
-
     @property
     def _goos(self):
         return {
@@ -30,15 +19,15 @@ class AmneziaXrayBindings(ConanFile):
             "Macos": "darwin",
             "Windows": "windows"
         }.get(str(self.settings.os))
-
+    
     @property
-    def _archs(self):
-        return str(self.settings.arch).split("|")
-
-    @property
-    def _is_multiarch(self):
-        return len(self._archs) > 1
-
+    def _goarch(self):
+        return {
+            "x86": "386",
+            "x86_64": "amd64",
+            "armv8": "arm64"
+        }.get(str(self.settings.arch))
+    
     @property
     def _is_windows(self):
         return str(self.settings.os).startswith("Windows")
@@ -65,80 +54,55 @@ class AmneziaXrayBindings(ConanFile):
             self.tool_requires("mingw-builds/15.1.0")
 
     def validate(self):
-        if not self._goos or not all(arch in self._arch_map for arch in self._archs):
+        if not self._goos or not self._goarch:
             raise ConanInvalidConfiguration(
                 f"{self.name} v{self.version} does not support {self.settings.os} {self.settings.arch}"
             )
 
-        if self._is_multiarch and not is_apple_os(self):
-            raise ConanInvalidConfiguration(
-                f"{self.name} v{self.version} does not support multiarch builds"
-            )
-
     def source(self):
-        get(self, f"https://github.com/amnezia-vpn/amnezia-xray-bindings/archive/v{self.version}.zip",
-            sha256="45b687dcd90cf1d953ece9c9f42d0b02785b2bbb33a97f5bad229f048da34d7c", strip_root=True)
+        get(self, "https://github.com/amnezia-vpn/amnezia-xray-bindings/archive/v1.1.0.zip",
+            sha256="6ea768ec7002cedd422a39aea17704b888acaf794432aa5937cfc92fb6d80eb5", strip_root=True)
 
     def generate(self):
         tc = AutotoolsToolchain(self)
-        tc.apple_arch_flag = None
+        tc.make_args = [
+            "LIB_ARC=libamnezia_xray.a"
+        ]
         env = tc.environment()
-        env.define("GOPATH", os.path.join(self.build_folder, "gopath"))
-        env.define("GOMODCACHE", os.path.join(self.build_folder, "gopath", "pkg", "mod"))
-        env.define("GOCACHE", os.path.join(self.build_folder, "gocache"))
+        env.define("ARCH", self._goarch)
+        env.define("GOARCH", self._goarch)
         env.define("GOOS", self._goos)
+        env.define("CGO_LDFLAGS", tc.ldflags)
+        env.define("CGO_CFLAGS", tc.cflags)
         if self._is_windows:
             env.define("OS", "windows")
-        self._ldflags = tc.ldflags
-        self._cflags = tc.cflags
         tc.generate(env)
 
     def build(self):
         with chdir(self, self.source_folder):
-            for arch in self._archs:
-                build_dir = os.path.join(self.build_folder, arch) if self._is_multiarch else self.build_folder
-                goarch = self._arch_map.get(arch)
-
-                cflags = list(self._cflags)
-                ldflags = list(self._ldflags)
-                if is_apple_os(self):
-                    cflags.append(f"-arch {_to_apple_arch(arch)}")
-                    ldflags.append(f"-arch {_to_apple_arch(arch)}")
-
-                env = Environment()
-                env.define("ARCH", goarch)
-                env.define("CGO_CFLAGS", " ".join(cflags))
-                env.define("CGO_LDFLAGS", " ".join(ldflags))
-                with env.vars(self).apply():
-                    at = Autotools(self)
-                    at.make(args=[
-                        f"BUILD_DIR={build_dir.replace("\\", "/") if self._is_windows else build_dir}"
-                    ])
-
-            if is_apple_os(self) and self._is_multiarch:
-                lipo = XCRun(self).find('lipo')
-                archives = [os.path.join(self.build_folder, arch, "amnezia_xray.a") for arch in self._archs]
-                output = os.path.join(self.build_folder, "amnezia_xray.a")
-                self.run("{} -create -output {} {}".format(
-                    shlex.quote(lipo),
-                    shlex.quote(output),
-                    shlex.join(archives)
-                ))
-
-                copy(self, "*.h", os.path.join(self.build_folder, self._archs[0]), self.build_folder)
+            autotools = Autotools(self)
+            autotools.make()
 
     def _rename_header(self):
         if not self._is_windows:
-            rename(self,
-                os.path.join(self.package_folder, "lib", "amnezia_xray.a"),
-                os.path.join(self.package_folder, "lib", "libamnezia_xray.a")
-            )
+            rename(self, os.path.join(self.package_folder, "include", "libamnezia_xray.h"),
+                    os.path.join(self.package_folder, "include", "amnezia_xray.h"))
+
+    def _rename_libs(self):
+        # workaround of bad naming strategy in amnezia-xray-bindings
+        # TODO: change it and kick out the code below
+        lib_dir = os.path.join(self.package_folder, "lib")
+        for fname in os.listdir(lib_dir):
+            if not fname.startswith("lib"):
+                src = os.path.join(lib_dir, fname)
+                dst = os.path.join(lib_dir, "lib" + fname)
+                os.rename(src, dst)
 
     def package(self):
-        copy(self, "amnezia_xray.h", src=self.build_folder, dst=os.path.join(self.package_folder, "include"), keep_path=False)
-        copy(self, "amnezia_xray.a", src=self.build_folder, dst=os.path.join(self.package_folder, "lib"), keep_path=False)
-        copy(self, "amnezia_xray.lib", src=self.build_folder, dst=os.path.join(self.package_folder, "lib"), keep_path=False)
-        copy(self, "amnezia_xray.dll", src=self.build_folder, dst=os.path.join(self.package_folder, "bin"), keep_path=False)
+        copy(self, "*.h", src=self.build_folder, dst=os.path.join(self.package_folder, "include"))
+        copy(self, "*.a", src=self.build_folder, dst=os.path.join(self.package_folder, "lib"))
+        copy(self, "*.lib", src=self.build_folder, dst=os.path.join(self.package_folder, "lib"))
+        copy(self, "*.dll", src=self.build_folder, dst=os.path.join(self.package_folder, "bin"))
         self._rename_header()
 
     def package_info(self):

recipes/awg-android/conanfile.py

@@ -9,7 +9,7 @@ import platform
 
 class AwgAndroid(ConanFile):
     name = "awg-android"
-    version = "2.0.2"
+    version = "2.0.1"
     settings = "os", "arch", "build_type", "compiler"
 
     def configure(self):

recipes/awg-apple/conanfile.py

@@ -9,7 +9,7 @@ import os
 
 class AwgApple(ConanFile):
     name = "awg-apple"
-    version = "2.0.3"
+    version = "2.0.2"
     settings = "os", "arch", "compiler"
 
     @property
@@ -39,7 +39,7 @@ class AwgApple(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-apple/archive/refs/tags/v{self.version}.zip",
-            sha256="a868f0dfbded869b6c08b7a7a0e8c1a5485e649a179f4d1715b1b93664ea4fd4", strip_root=True
+            sha256="a04f49eac9f82bbf5dd9031bab188d44de2b3482efde1b6e970821de1d5a3c5d", strip_root=True
         )
 
     def generate(self):

recipes/awg-go/conanfile.py

@@ -1,31 +1,17 @@
 from conan import ConanFile
 from conan.errors import ConanInvalidConfiguration
 from conan.tools.layout import basic_layout
-from conan.tools.files import get, chdir
-from conan.tools.apple import XCRun
+from conan.tools.files import get, copy
 from conan.tools.gnu import Autotools, AutotoolsToolchain
-from conan.tools.apple import is_apple_os
-from conan.tools.apple.apple import _to_apple_arch
-from conan.tools.env import Environment
 
 import os
-import shlex
-
 
 class AwgGo(ConanFile):
     name = "awg-go"
-    version = "0.2.19"
+    version = "0.2.18"
     package_type = "application"
     settings = "os", "arch"
 
-    _binary_name = "amneziawg-go"
-
-    _arch_map = {
-        "x86": "386",
-        "x86_64": "amd64",
-        "armv8": "arm64"
-    }
-
     @property
     def _goos(self):
         return {
@@ -35,12 +21,12 @@ class AwgGo(ConanFile):
         }.get(str(self.settings.os))
 
     @property
-    def _archs(self):
-        return str(self.settings.arch).split("|")
-    
-    @property
-    def _is_multiarch(self):
-        return len(self._archs) > 1
+    def _goarch(self):
+        return {
+            "x86": "386",
+            "x86_64": "amd64",
+            "armv8": "arm64"
+        }.get(str(self.settings.arch))
 
     def layout(self):
         basic_layout(self, build_folder=".")
@@ -49,76 +35,33 @@ class AwgGo(ConanFile):
         self.tool_requires("go/1.26.0")
 
     def validate(self):
-        if not self._goos or not all(arch in self._arch_map for arch in self._archs):
+        if not self._goos or not self._goarch:
             raise ConanInvalidConfiguration(
                 f"{self.name} v{self.version} does not support {self.settings.os} {self.settings.arch}"
             )
-        
-        if self._is_multiarch and not is_apple_os(self):
-            raise ConanInvalidConfiguration(
-                f"{self.name} v{self.version} does not support multiarch builds"
-            )
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-go/archive/refs/tags/v{self.version}.zip",
-            sha256="430396f9f2d4f6559ac69f178b707f955f7f847723b78e9de748b73d7e718798", strip_root=True
+            sha256="58eefbd012e79bd1525f0e02d748979e9480acc1a339df8ceb3b9ffafcedb1ba", strip_root=True
         )
 
     def generate(self):
         tc = AutotoolsToolchain(self)
-        tc.apple_arch_flag = None
         env = tc.environment()
-        env.define("GOPATH", os.path.join(self.build_folder, "gopath"))
-        env.define("GOMODCACHE", os.path.join(self.build_folder, "gopath", "pkg", "mod"))
-        env.define("GOCACHE", os.path.join(self.build_folder, "gocache"))
-        env.define("GOTELEMETRY", "off")
         env.define("GOOS", self._goos)
-        self._ldflags = tc.ldflags
-        self._cflags = tc.cflags
+        env.define("GOARCH", self._goarch)
+        env.define("CGO_LDFLAGS", tc.ldflags)
+        env.define("CGO_CFLAGS", tc.cflags)
         tc.generate(env)
 
     def build(self):
-        with chdir(self, self.source_folder):
-            for arch in self._archs:
-                goarch = self._arch_map.get(arch)
-
-                ldflags = self._ldflags
-                cflags = self._cflags
-                if is_apple_os(self):
-                    ldflags.append(f"-arch {_to_apple_arch(arch)}")
-                    cflags.append(f"-arch {_to_apple_arch(arch)}")
-
-                env = Environment()
-                env.define("GOARCH", goarch)
-                env.define("CGO_LDFLAGS", " ".join(ldflags))
-                env.define("CGO_CFLAGS", " ".join(cflags))
-                with env.vars(self).apply():
-                    at = Autotools(self)
-                    at.make()
-                    if self._is_multiarch:
-                        os.rename(
-                            os.path.join(self.source_folder, self._binary_name),
-                            os.path.join(self.source_folder, f"{self._binary_name}-{arch}")
-                        )
-
-            if is_apple_os(self) and self._is_multiarch:
-                lipo = XCRun(self).find("lipo")
-                output = os.path.join(self.build_folder, self._binary_name)
-                binaries = [os.path.join(self.build_folder, f"{self._binary_name}-{arch}") for arch in self._archs]
-                self.run("{} -create -output {} {}".format(
-                    shlex.quote(lipo),
-                    shlex.quote(output),
-                    shlex.join(binaries)
-                ))
+        at = Autotools(self)
+        at.make()
 
     def package(self):
-        with chdir(self, self.source_folder):
-            at = Autotools(self)
-            at.make("install", args=[
-                f"BINDIR={self.package_folder}",
-            ])
+        copy(self, "amneziawg-go", src=self.build_folder, dst=self.package_folder)
 
     def package_info(self):
         self.cpp_info.exe = True
-        self.cpp_info.location = os.path.join(self.package_folder, self._binary_name)
+        self.cpp_info.location = os.path.join(self.package_folder, "amneziawg-go")
         self.cpp_info.set_property("cmake_target_name", "amnezia::awg-go")

recipes/awg-windows/conanfile.py

@@ -8,7 +8,7 @@ import os
 
 class AwgWindows(ConanFile):
     name = "awg-windows"
-    version = "0.2.0"
+    version = "0.1.9"
     settings = "os", "arch"
 
     @property
@@ -63,7 +63,7 @@ class AwgWindows(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-windows/archive/refs/tags/v{self.version}.zip",
-            sha256="9e74240b9bae2f9c8a9381bdf6e5a43ad37653de186e01e0f5a92935e4310252", strip_root=True)
+            sha256="5c29a75cb2beae291cc51b64840a39f838da5f300b9e956f7964813a687ec74c", strip_root=True)
         
     def generate(self):
         tc = AutotoolsToolchain(self)

recipes/tun2socks/conanfile.py

@@ -2,15 +2,10 @@ from conan import ConanFile
 from conan.tools.layout import basic_layout
 from conan.tools.files import get, copy, chdir
 from conan.errors import ConanInvalidConfiguration
-from conan.tools.apple import XCRun
 from conan.tools.gnu import Autotools, AutotoolsToolchain
 from conan.tools.env import Environment
-from conan.tools.apple import is_apple_os
-from conan.tools.apple.apple import _to_apple_arch
 
 import os
-import shlex
-
 
 class Tun2Socks(ConanFile):
     name = "tun2socks"
@@ -18,14 +13,6 @@ class Tun2Socks(ConanFile):
     package_type = "application"
     settings = "os", "arch"
 
-    _binary_name = "tun2socks"
-
-    _arch_map = {
-        "x86": "386",
-        "x86_64": "amd64",
-        "armv8": "arm64"
-    }
-
     @property
     def _goos(self):
         return {
@@ -35,35 +22,29 @@ class Tun2Socks(ConanFile):
         }.get(str(self.settings.os))
 
     @property
-    def _archs(self):
-        return str(self.settings.arch).split("|")
+    def _goarch(self):
+        return {
+            "x86": "386",
+            "x86_64": "amd64",
+            "armv8": "arm64"
+        }.get(str(self.settings.arch))
     
-    @property
-    def _is_multiarch(self):
-        return len(self._archs) > 1
-
     @property
     def _is_windows(self):
         return str(self.settings.get_safe("os")).startswith("Windows")
-
+    
     @property
-    def _binary_name_ext(self):
-        ext = ".exe" if self._is_windows else ""
-        return f"{self._binary_name}{ext}"
+    def _ext(self):
+        return ".exe" if self._is_windows else ""
 
     def layout(self):
         basic_layout(self)
 
     def validate(self):
-        if not self._goos or not all(arch in self._arch_map for arch in self._archs):
+        if not self._goos or not self._goarch:
             raise ConanInvalidConfiguration(
                 f"{self.name} v{self.version} does not support {self.settings.os} {self.settings.arch}"
             )
-        
-        if self._is_multiarch and not is_apple_os(self):
-            raise ConanInvalidConfiguration(
-                f"{self.name} v{self.version} does not support multiarch builds"
-            )
 
     def build_requirements(self):
         self.tool_requires("go/1.26.0")
@@ -84,59 +65,26 @@ class Tun2Socks(ConanFile):
 
     def generate(self):
         tc = AutotoolsToolchain(self)
-        tc.apple_arch_flag = None
         env = tc.environment()
-        env.define("GOPATH", os.path.join(self.build_folder, "gopath"))
-        env.define("GOMODCACHE", os.path.join(self.build_folder, "gopath", "pkg", "mod"))
-        env.define("GOCACHE", os.path.join(self.build_folder, "gocache"))
-        env.define("GOTELEMETRY", "off")
         env.define("LDFLAGS", "")
+        env.define("CGO_LDFLAGS", tc.ldflags)
+        env.define("CGO_CFLAGS", tc.cflags)
         env.define("GOOS", self._goos)
-        self._ldflags = tc.ldflags
-        self._cflags = tc.cflags
+        env.define("GOARCH", self._goarch)
         tc.generate(env)
 
     def build(self):
         with chdir(self, self.source_folder):
-            for arch in self._archs:
-                build_dir = os.path.join(self.build_folder, arch) if self._is_multiarch else self.build_folder
-                goarch = self._arch_map.get(arch)
-
-                ldflags = self._ldflags
-                cflags = self._cflags
-                if is_apple_os(self):
-                    ldflags.append(f"-arch {_to_apple_arch(arch)}")
-                    cflags.append(f"-arch {_to_apple_arch(arch)}")
-
-                env = Environment()
-                env.define("GOARCH", goarch)
-                env.define("CGO_LDFLAGS", " ".join(ldflags))
-                env.define("CGO_CFLAGS", " ".join(cflags))
-                with env.vars(self).apply():
-                    at = Autotools(self)
-                    at.make("tun2socks", args=[
-                        f"BUILD_DIR={build_dir.replace("\\", "/") if self._is_windows else build_dir}"
-                    ])
-                    if self._is_windows:
-                        os.rename(
-                            os.path.join(build_dir, self._binary_name),
-                            os.path.join(build_dir, self._binary_name_ext)
-                        )
-
-        if self._is_multiarch:
-            lipo = XCRun(self).find('lipo')
-            output = os.path.join(self.build_folder, self._binary_name_ext)
-            binaries = [os.path.join(self.build_folder, arch, self._binary_name_ext) for arch in self._archs]
-            self.run("{} -create -output {} {}".format(
-                shlex.quote(lipo),
-                shlex.quote(output),
-                shlex.join(binaries)
-            ))
+            at = Autotools(self)
+            at.make("tun2socks")
 
     def package(self):
-        copy(self, self._binary_name_ext, src=self.build_folder, dst=self.package_folder)
+        copy(self, "tun2socks", src=self.build_folder, dst=self.package_folder)
+        if self._is_windows:
+            with chdir(self, self.package_folder):
+                os.rename(src="tun2socks", dst="tun2socks.exe")
 
     def package_info(self):
         self.cpp_info.exe = True
-        self.cpp_info.location = os.path.join(self.package_folder, self._binary_name_ext)
+        self.cpp_info.location = os.path.join(self.package_folder, f"tun2socks{self._ext}")
         self.cpp_info.set_property("cmake_target_name", "xjasonlyu::tun2socks")

service/server/CMakeLists.txt

@@ -18,9 +18,14 @@ qt_standard_project_setup()
 
 configure_file(${CMAKE_SOURCE_DIR}/version.h.in ${CMAKE_CURRENT_BINARY_DIR}/version.h)
 
+set(QSIMPLECRYPTO_DIR ${CMAKE_CURRENT_LIST_DIR}/../../client/3rd/QSimpleCrypto/src)
+
+include_directories(
+    ${QSIMPLECRYPTO_DIR}
+)
+
 set(HEADERS
     ${CMAKE_CURRENT_LIST_DIR}/../../client/core/utils/utilities.h
-    ${CMAKE_CURRENT_LIST_DIR}/../../common/crypto/cryptoUtils.h
     ${CMAKE_CURRENT_LIST_DIR}/../../client/secureQSettings.h
     ${CMAKE_CURRENT_LIST_DIR}/../../client/core/utils/networkUtilities.h
     ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipc.h
@@ -33,11 +38,16 @@ set(HEADERS
     ${CMAKE_CURRENT_LIST_DIR}/systemservice.h
     ${CMAKE_CURRENT_LIST_DIR}/xray.h
     ${CMAKE_CURRENT_BINARY_DIR}/version.h
+    ${QSIMPLECRYPTO_DIR}/include/QAead.h
+    ${QSIMPLECRYPTO_DIR}/include/QBlockCipher.h
+    ${QSIMPLECRYPTO_DIR}/include/QRsa.h
+    ${QSIMPLECRYPTO_DIR}/include/QSimpleCrypto_global.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509Store.h
 )
 
 set(SOURCES
     ${CMAKE_CURRENT_LIST_DIR}/../../client/core/utils/utilities.cpp
-    ${CMAKE_CURRENT_LIST_DIR}/../../common/crypto/cryptoUtils.cpp
     ${CMAKE_CURRENT_LIST_DIR}/../../client/secureQSettings.cpp
     ${CMAKE_CURRENT_LIST_DIR}/../../client/core/utils/networkUtilities.cpp
     ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipcserver.cpp
@@ -49,6 +59,11 @@ set(SOURCES
     ${CMAKE_CURRENT_LIST_DIR}/killswitch.cpp
     ${CMAKE_CURRENT_LIST_DIR}/systemservice.cpp
     ${CMAKE_CURRENT_LIST_DIR}/xray.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QAead.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QBlockCipher.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QRsa.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509Store.cpp
 )
 
 # Mozilla headres
@@ -282,7 +297,6 @@ include_directories(
     ${CMAKE_CURRENT_LIST_DIR}/../../client
     ${CMAKE_CURRENT_LIST_DIR}/../../ipc
     ${CMAKE_CURRENT_LIST_DIR}/../../common/logger
-    ${CMAKE_CURRENT_LIST_DIR}/../../common/crypto
     ${CMAKE_CURRENT_BINARY_DIR}
 )
 
@@ -333,12 +347,6 @@ if(APPLE)
         DESTINATION ${CMAKE_INSTALL_BINDIR}
         COMPONENT AmneziaVPN
     )
-    add_custom_command(TARGET ${PROJECT} POST_BUILD
-        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
-        ${CMAKE_SOURCE_DIR}/deploy/data/macos/pf
-        "$<TARGET_FILE_DIR:${PROJECT}>/pf"
-        COMMAND_EXPAND_LISTS
-    )
 endif()
 
 # install non-linked dependencies
@@ -348,8 +356,6 @@ if(WIN32)
 
     find_package(wintun REQUIRED)
     list(APPEND CONAN_BINS $<TARGET_FILE:zx2c4::wintun>)
-
-    list(APPEND CONAN_BINS $<TARGET_FILE:OpenSSL::SSL> $<TARGET_FILE:OpenSSL::Crypto>)
 else()
     find_package(awg-go REQUIRED)
     list(APPEND CONAN_EXECS $<TARGET_FILE:amnezia::awg-go>)

service/server/router_linux.cpp

@@ -182,7 +182,7 @@ bool RouterLinux::flushDns()
     if (output.isEmpty())
         qDebug().noquote() << "Flush dns completed";
     else
-        qDebug().noquote() << "OUTPUT systemctl restart nscd/systemd-resolved: " + output;
+        qDebug().noquote() << "OUTPUT systemctl restart: " + output;
 
     return true;
 }

service/server/tapcontroller_win.cpp

@@ -6,10 +6,9 @@
 #include <QOperatingSystemVersion>
 
 #include "tapcontroller_win.h"
-#include "core/utils/utilities.h"
 
 #define TAP_EXE_ERROR { \
-    qDebug() << "TapController: Can't start devcon.exe"; \
+    qDebug() << "TapController: Can't start tapinstall.exe"; \
     return false; \
     }
 
@@ -77,7 +76,7 @@ QStringList TapController::getTapList()
     QProcess tapInstallProc;
     tapInstallProc.start(getTapInstallPath(), QStringList() << "find" << "tap0901" );
     if(!tapInstallProc.waitForStarted()) {
-        qDebug() << "TapController: Can't start devcon.exe";
+        qDebug() << "TapController: TapController: Can't start tapinstall.exe";
         return QStringList();
     }
     tapInstallProc.waitForFinished();
@@ -257,17 +256,22 @@ bool TapController::checkOpenVpn()
 
 QString TapController::getTapInstallPath()
 {
-    return getTapDriverDir() + "\\devcon.exe";
+    return getTapDriverDir() + "\\tapinstall.exe";
 }
 
 QString TapController::getOpenVpnPath()
 {
-    return Utils::openVpnExecPath();
+    return qApp->applicationDirPath() + "\\openvpn\\openvpn.exe";
 }
 
 QString TapController::getTapDriverDir()
 {
-    return qApp->applicationDirPath() + "\\tap";
+    if (oldDriversRequired()) {
+        return qApp->applicationDirPath() + "\\tap\\windows_7";
+    }
+    else {
+        return qApp->applicationDirPath() + "\\tap\\windows_10";
+    }
 }
 
 bool TapController::removeDriver(const QString& tapInstanceId)